BYR Achieve · 镜像论坛

☆─────────────────────────────────────☆ qingqing (wahaha) 于 (Sun Dec 2 09:16:51 2007) 提到: 系统时间被改，system32下多出很多莫名其妙的exe和dll ☆─────────────────────────────────────☆ rebirthatsix (茫犭者) 于 (Sun Dec 2 09:25:28 2007) 提到: 置顶，日志 ☆─────────────────────────────────────☆ qingqing (wahaha) 于 (Sun Dec 2 09:27:52 2007) 提到: HijackThis_815汉化版扫描日志 V1.99.1 保存于 9:26:37, 日期 2005-12-2 操作系统： Windows XP SP2 (WinNT 5.01.2600) 浏览器： Internet Explorer v6.00 SP2 (6.00.2900.2180) 当前运行的进程： C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe C:\Program Files\Elantech\ktp.exe C:\WINDOWS\SOUNDMAN.EXE D:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe E:\workshop\Java\jre1.5.0_06\bin\jusched.exe D:\Program Files\Google\Gmail Notifier\gnotify.exe C:\WINDOWS\system32\ctfmon.exe D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\explorer.exe E:\恶意软件清理助手\恶意软件清理助手.exe C:\WINDOWS\regedit.exe C:\WINDOWS\system32\svchost.exe E:\auto.exe D:\auto.exe C:\WINDOWS\system32\61DDA92D.EXE d:\Program Files\WinRAR\WinRAR.exe C:\DOCUME~1\chinchin\LOCALS~1\Temp\Rar$EX00.890\HijackThis.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\workshop\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O2 - BHO: NavigatMon Class - {B69F34DD-F0F9-42DC-9EDD-957187DA688D} - D:\Program Files\360安踩全卫朗士縗\safemon\safemon.dll (file missing) O3 - IE工具栏增项: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - 启动项HKLM\\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - 启动项HKLM\\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - 启动项HKLM\\Run: [kav] "D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" O4 - 启动项HKLM\\Run: [KTPWare] C:\Program Files\Elantech\ktp.exe O4 - 启动项HKLM\\Run: [SoundMan] SOUNDMAN.EXE O4 - 启动项HKLM\\Run: [Acrobat Assistant 8.0] "D:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" O4 - 启动项HKLM\\Run: [SunJavaUpdateSched] E:\workshop\Java\jre1.5.0_06\bin\jusched.exe O4 - 启动项HKLM\\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload O4 - 启动项HKLM\\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] D:\Program Files\Google\Gmail Notifier\gnotify.exe O4 - 启动项HKLM\\Run: [360Safetray] D:\Program Files\360安全卫士\safemon\360Tray.exe /start O4 - 启动项HKLM\\Run: [DbgHlp32] C:\WINDOWS\DbgHlp32.exe O4 - 启动项HKLM\\Run: [upxdnd] C:\WINDOWS\upxdnd.exe O4 - 启动项HKLM\\Run: [NVDispDrv] C:\WINDOWS\NVDispDRV.EXE O4 - 启动项HKLM\\Run: [AVPSrv] C:\WINDOWS\AVPSrv.exE O4 - 启动项HKLM\\Run: [cmdbcs] C:\WINDOWS\cmdbcs.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O8 - IE右键菜单中的新增项目: Append to existing PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - IE右键菜单中的新增项目: Convert link target to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - IE右键菜单中的新增项目: Convert link target to existing PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - IE右键菜单中的新增项目: Convert selected links to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - IE右键菜单中的新增项目: Convert selected links to existing PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - IE右键菜单中的新增项目: Convert selection to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - IE右键菜单中的新增项目: Convert selection to existing PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - IE右键菜单中的新增项目: Convert to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - IE右键菜单中的新增项目: 导出到 Microsoft Office Excel(&X) - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - 浏览器额外的按钮: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\workshop\Java\jre1.5.0_06\bin\ssv.dll O9 - 浏览器额外的“工具”菜单项: Sun Java 控制台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\workshop\Java\jre1.5.0_06\bin\ssv.dll O9 - 浏览器额外的按钮: Web反病毒保护 - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll O9 - 浏览器额外的按钮: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - 浏览器额外的按钮: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - 浏览器额外的“工具”菜单项: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - “受信任的站点”中添加项: *.raisehr.cn O15 - “受信任的站点”中添加项: *.raisehr.com O18 - 列举现有的协议: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - 列举现有的协议: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll O23 - NT 服务: 7BEA8ADD - Unknown owner - C:\WINDOWS\system32\61DDA92D.EXE O23 - NT 服务: 卡巴斯基反病毒6.0 (AVP) - Unknown owner - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing) O23 - NT 服务: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe ☆─────────────────────────────────────☆ qingqing (wahaha) 于 (Sun Dec 2 09:30:50 2007) 提到: 那些新生成的exe dll 删了重启后又会出现 ☆─────────────────────────────────────☆ rebirthatsix (茫犭者) 于 (Sun Dec 2 09:38:03 2007) 提到: 稍等，我看看 ☆─────────────────────────────────────☆ rebirthatsix (茫犭者) 于 (Sun Dec 2 09:47:22 2007) 提到: ftp里还有一个sreng2，你用那个全部扫描把日志保存下来上传，更详细一些我现在看不到你的进程是否有被注入线程的先给你提供个解决方法，如果没有线程监控应该可以用icesword结束进程，按住ctrl把d:\auto.exe,e:\auto.exe,C:\WINDOWS\system32\61DDA92D.EXE这三个进程同时给选上，然后直接一起结束了。结束之后刷新几次进程列表，看看这几个进程中是否会有自动重新启动的如果没有，那么用icesword把每个盘符下面的autorun.inf和auto.exe删除，并且把服务7BEA8ADD - Unknown owner - C:\WINDOWS\system32\61DDA92D.EXE 这项改为禁止启动，这两步之后最好也多刷新几次看看是否会被自动改回来接下来如果正常，就去把c:\windows\system32\61dda92d.exe这个文件删除，然后把注册表中的的启动项启动项HKLM\\Run: [DbgHlp32] C:\WINDOWS\DbgHlp32.exe O4 - 启动项HKLM\\Run: [upxdnd] C:\WINDOWS\upxdnd.exe O4 - 启动项HKLM\\Run: [NVDispDrv] C:\WINDOWS\NVDispDRV.EXE O4 - 启动项HKLM\\Run: [AVPSrv] C:\WINDOWS\AVPSrv.exE O4 - 启动项HKLM\\Run: [cmdbcs] C:\WINDOWS\cmdbcs.exe 这几个都给删除，所有过程最好都用icesword来完成其中如果碰到有自动恢复的情况，再发帖 ☆─────────────────────────────────────☆ rebirthatsix (茫犭者) 于 (Sun Dec 2 09:49:19 2007) 提到: 最后那几个启动项对应的文件也可以删除 ☆─────────────────────────────────────☆ qingqing (wahaha) 于 (Sun Dec 2 10:09:04 2007) 提到: autorun.inf和auto.exe删了刷新又有了 ☆─────────────────────────────────────☆ qingqing (wahaha) 于 (Sun Dec 2 10:14:48 2007) 提到: [CODE] 2005-12-02,10:14:15 System Repair Engineer 2.5.16.900 Smallfrogs (http://www.KZTechs.com) Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能以下内容被选中：所有的启动项目（包括注册表、启动文件夹、服务等）浏览器加载项正在运行的进程（包括进程模块信息）文件关联 Winsock 提供者 Autorun.inf HOSTS 文件进程特权扫描启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows Publisher] <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows Publisher] <IgfxTray><C:\WINDOWS\system32\igfxtray.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher] <HotKeysCmds><C:\WINDOWS\system32\hkcmd.exe> [(Verified)Microsoft Windows Publisher] <kav><"D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"> [Kaspersky Lab] <KTPWare><C:\Program Files\Elantech\ktp.exe> [(Verified)Microsoft Windows Publisher] <SoundMan><SOUNDMAN.EXE> [(Verified)Microsoft Windows Publisher] <Acrobat Assistant 8.0><"D:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"> [(Verified)"Adobe Systems, Incorporated"] <SunJavaUpdateSched><E:\workshop\Java\jre1.5.0_06\bin\jusched.exe> [Sun Microsystems, Inc.] <IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload> [(Verified)Microsoft Corporation] <{0228e555-4f9c-4e35-a3ec-b109a192b4c2}><D:\Program Files\Google\Gmail Notifier\gnotify.exe> [Google Inc.] <360Safetray><D:\Program Files\360安全卫士\safemon\360Tray.exe /start> [奇虎网] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] <MSDEG32><LYLoader.exe> [N/A] <MSDWG32><LYLoadbr.exe> [N/A] <MSDCG32 ><LYLeador.exe> [N/A] <MSDOG32><LYLoador.exe> [N/A] <MSDSG32><LYLoadar.exe> [N/A] <MSDMG32><LYLoadmr.exe> [N/A] <MSDHG32><LYLoadhr.exe> [N/A] <MSDQG32><LYLoadqr.exe> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [(Verified)Microsoft Windows Component Publisher] <Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher] <UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon] <WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll> [Kaspersky Lab] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}] <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] <Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A] ================================== 启动文件夹 N/A ================================== 服务 [7BEA8ADD / 7BEA8ADD][Stopped/Auto Start] <C:\WINDOWS\system32\61DDA92D.EXE -k><> [卡巴斯基反病毒6.0 / AVP][Running/Auto Start] <"D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r><Kaspersky Lab> [FLEXnet Licensing Service / FLEXnet Licensing Service][Running/Manual Start] <"C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe"><Macrovision Europe Ltd.> [Human Interface Device Access / HidServ][Stopped/Disabled] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A> ================================== 驱动程序 [Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start] <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.> [BCM5701 Gigabit Ethernet / b57w2k][Stopped/Manual Start] <system32\DRIVERS\b57xp32.sys><Broadcom Corporation> [BCM 10/100 Ethernet Network Adapter Driver / BCM44X2][Stopped/Manual Start] <system32\DRIVERS\BCM4E5.SYS><Broadcom Corporation> [Broadcom 440x 10/100 Integrated Controller XP Driver / bcm4sbxp][Running/Manual Start] <system32\DRIVERS\bcm4sbxp.sys><Broadcom Corporation> [dtscsi / dtscsi][Running/Manual Start] <\SystemRoot\System32\Drivers\dtscsi.sys><N/A> [HSFHWICH / HSFHWICH][Running/Manual Start] <system32\DRIVERS\HSFHWICH.sys><Conexant Systems, Inc.> [HSF_DP / HSF_DP][Running/Manual Start] <system32\DRIVERS\HSF_DP.sys><Conexant Systems, Inc.> [ialm / ialm][Running/Manual Start] <system32\DRIVERS\ialmnt5.sys><Intel Corporation> [kl1 / kl1][Running/Boot Start] <\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab> [klif / klif][Running/System Start] <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab> [Elantech Touchpad / Ktp][Running/Manual Start] <system32\DRIVERS\Ktp.sys><ELANTECH Devices Corp.> [mdmxsdk / mdmxsdk][Running/Auto Start] <system32\DRIVERS\mdmxsdk.sys><Conexant> [Netpas Win32 Virtual Network Adapter / netpasadapter1][Stopped/Manual Start] <system32\DRIVERS\netpas.sys><Netpas> [Direct Parallel Link Driver / Ptilink][Running/Manual Start] <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.> [Secdrv / Secdrv][Stopped/Manual Start] <system32\DRIVERS\secdrv.sys><N/A> [sptd / sptd][Running/Boot Start] <\SystemRoot\System32\Drivers\sptd.sys><N/A> [TSP / TSP][Stopped/Manual Start] <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab> [winachsf / winachsf][Running/Manual Start] <system32\DRIVERS\HSF_CNXT.sys><Conexant Systems, Inc.> ================================== 浏览器加载项 [Adobe PDF Reader Link Helper] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated> [SSVHelper Class] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} <E:\workshop\Java\jre1.5.0_06\bin\ssv.dll, Sun Microsystems, Inc.> [Adobe PDF Conversion Toolbar Helper] {AE7CD045-E861-484f-8273-0445EE161910} <D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll, Adobe Systems Incorporated> [NavigatMon Class] {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <D:\Program Files\360安踩全卫朗士縗\safemon\safemon.dll, N/A> [Java Plug-in] {08B0E5C0-4FCB-11CF-AAA5-00401C608501} <E:\workshop\Java\jre1.5.0_06\bin\ssv.dll, Sun Microsystems, Inc.> [Web反病毒保护] {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll, Kaspersky Lab> [信息检索(&R)] {92780B25-18CC-41C8-B9BE-3C9C571A8263} <D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL, Microsoft Corporation> [Messenger] {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation> [Adobe PDF] {47833539-D0C5-4125-9FA8-0819E2EAAC93} <D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll, Adobe Systems Incorporated> [Adobe PDF Reader Link Helper] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated> [Adobe PDF] {47833539-D0C5-4125-9FA8-0819E2EAAC93} <D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll, Adobe Systems Incorporated> [SSVHelper Class] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} <E:\workshop\Java\jre1.5.0_06\bin\ssv.dll, Sun Microsystems, Inc.> [Adobe PDF Conversion Toolbar Helper] {AE7CD045-E861-484F-8273-0445EE161910} <D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll, Adobe Systems Incorporated> [NavigatMon Class] {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <D:\Program Files\360安踩全卫朗士縗\safemon\safemon.dll, N/A> [Append to existing PDF] <res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html, N/A> [Convert link target to Adobe PDF] <res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html, N/A> [Convert link target to existing PDF] <res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html, N/A> [Convert selected links to Adobe PDF] <res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html, N/A> [Convert selected links to existing PDF] <res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html, N/A> [Convert selection to Adobe PDF] <res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html, N/A> [Convert selection to existing PDF] <res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html, N/A> [Convert to Adobe PDF] <res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html, N/A> [导出到 Microsoft Office Excel(&X)] <res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000, N/A> ================================== 正在运行的进程 [PID: 468 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 644 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\BCFB3EDC.DLL] [, ] [PID: 668 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\klogon.dll] [Kaspersky Lab, 6.0.0.299] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\WINDOWS\system32\BCFB3EDC.DLL] [, ] [PID: 796 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\BCFB3EDC.DLL] [, ] [C:\WINDOWS\system32\LYMANGR.DLL] [N/A, ] [PID: 808 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\BCFB3EDC.DLL] [, ] [PID: 964 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\BCFB3EDC.DLL] [, ] [PID: 1028 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\BCFB3EDC.DLL] [, ] [PID: 1124 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\BCFB3EDC.DLL] [, ] [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scr_ch_pg.dll] [Kaspersky Lab, 1.0.6.299] [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\klscav.dll] [Kaspersky Lab, 6.0.0.299] [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\pr_remote.dll] [Kaspersky Lab, 6.0.0.299] [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll] [Kaspersky Lab, 6.0.0.299] [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prkernel.ppl] [Kaspersky Lab, 6.0.0.304] [d:\program files\kaspersky lab\kaspersky anti-virus 6.0\params.ppl] [Kaspersky Lab, 6.0.0.299] [d:\program files\kaspersky lab\kaspersky anti-virus 6.0\pxstub.ppl] [Kaspersky Lab, 6.0.0.299] [d:\program files\kaspersky lab\kaspersky anti-virus 6.0\tempfile.ppl] [Kaspersky Lab, 6.0.0.299] [C:\WINDOWS\system32\wups2.dll] [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)] [PID: 1168 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\BCFB3EDC.DLL] [, ] [PID: 1264 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\BCFB3EDC.DLL] [, ] [PID: 1540 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)] [C:\WINDOWS\system32\AdobePDF.dll] [Adobe Systems Incorporated., 8.0.0.00] [D:\Program Files\Adobe\Acrobat 8.0\Acrobat\adistres.dll] [Adobe Systems Incorporated., 8.1.0.2007051000] [C:\WINDOWS\system32\mdimon.dll] [Microsoft Corporation, 11.3.2175.0] [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll] [Microsoft Corporation, 11.3.2175.0] [C:\WINDOWS\system32\BCFB3EDC.DLL] [, ] [PID: 1972 / chinchin][C:\WINDOWS\system32\igfxtray.exe] [Intel Corporation, 3.0.0.4020] [C:\WINDOWS\system32\hccutils.DLL] [Intel Corporation, 3.0.0.4020] [C:\WINDOWS\system32\igfxdev.dll] [Intel Corporation, 3.0.0.4020] [C:\WINDOWS\system32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4020] [C:\WINDOWS\system32\igfxres.dll] [Intel Corporation, 3.0.0.4020] [C:\WINDOWS\system32\igfxress.dll] [Intel Corporation, 3.0.0.4020] [C:\WINDOWS\system32\BCFB3EDC.DLL] [, ] [C:\WINDOWS\system32\LotusHlp.dll] [N/A, ] [C:\WINDOWS\system32\cmdbcs.dll] [N/A, ] [C:\WINDOWS\system32\AVPSrv.dll] [N/A, ] [C:\WINDOWS\system32\mppds.dll] [N/A, ] [C:\WINDOWS\system32\MsPrint32D.dll] [N/A, ] [C:\WINDOWS\system32\Kvsc3.dll] [N/A, ] [C:\WINDOWS\system32\NVDispDrv.dll] [N/A, ] [C:\WINDOWS\system32\upxdnd.dll] [N/A, ] [C:\WINDOWS\system32\DbgHlp32.dll] [N/A, ] [C:\WINDOWS\system32\GenProtect.dll] [N/A, ] [PID: 1988 / chinchin][C:\WINDOWS\system32\hkcmd.exe] [Intel Corporation, 3.0.0.4020] [C:\WINDOWS\system32\hccutils.DLL] [Intel Corporation, 3.0.0.4020] [C:\WINDOWS\system32\igfxdev.dll] [Intel Corporation, 3.0.0.4020] [C:\WINDOWS\system32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4020] [C:\WINDOWS\system32\igfxhk.dll] [Intel Corporation, 3.0.0.4020] [C:\WINDOWS\system32\igfxres.dll] [Intel Corporation, 3.0.0.4020] [C:\WINDOWS\system32\BCFB3EDC.DLL] [, ] [C:\WINDOWS\system32\LotusHlp.dll] [N/A, ] [C:\WINDOWS\system32\cmdbcs.dll] [N/A, ] [C:\WINDOWS\system32\AVPSrv.dll] [N/A, ] [C:\WINDOWS\system32\mppds.dll] [N/A, ] [C:\WINDOWS\system32\MsPrint32D.dll] [N/A, ] [C:\WINDOWS\system32\Kvsc3.dll] [N/A, ] [C:\WINDOWS\system32\NVDispDrv.dll] [N/A, ] [C:\WINDOWS\system32\upxdnd.dll] [N/A, ] [C:\WINDOWS\system32\DbgHlp32.dll] [N/A, ] [C:\WINDOWS\system32\GenProtect.dll] [N/A, ] [PID: 2008 / chinchin][C:\Program Files\Elantech\ktp.exe] [ELANTECH Devices Corp., 5, 0, 1, 6] [C:\Program Files\Elantech\KtpXPdll.dll] [ELANTECH Devices Corp., 5, 0, 0, 0] [C:\Program Files\Elantech\KtpDll.Dll] [ELANTECH Devices Corp., 5.0.1.6] [C:\Program Files\Elantech\ELANDLL.Dll] [ELANTECH Devices Corp., 5.0.0.0] [C:\WINDOWS\system32\BCFB3EDC.DLL] [, ] [C:\WINDOWS\system32\GenProtect.dll] [N/A, ] [C:\WINDOWS\system32\DbgHlp32.dll] [N/A, ] [C:\WINDOWS\system32\NVDispDrv.dll] [N/A, ] [C:\WINDOWS\system32\upxdnd.dll] [N/A, ] [C:\WINDOWS\system32\Kvsc3.dll] [N/A, ] [C:\WINDOWS\system32\MsPrint32D.dll] [N/A, ] [C:\WINDOWS\system32\mppds.dll] [N/A, ] [C:\WINDOWS\system32\AVPSrv.dll] [N/A, ] [C:\WINDOWS\system32\cmdbcs.dll] [N/A, ] [C:\WINDOWS\system32\LotusHlp.dll] [N/A, ] [PID: 2016 / chinchin][C:\WINDOWS\SOUNDMAN.EXE] [Realtek Semiconductor Corp., 5.1.0.36] [C:\WINDOWS\system32\BCFB3EDC.DLL] [, ] [C:\WINDOWS\system32\LotusHlp.dll] [N/A, ] [C:\WINDOWS\system32\cmdbcs.dll] [N/A, ] [C:\WINDOWS\system32\AVPSrv.dll] [N/A, ] [C:\WINDOWS\system32\mppds.dll] [N/A, ] [C:\WINDOWS\system32\MsPrint32D.dll] [N/A, ] [C:\WINDOWS\system32\Kvsc3.dll] [N/A, ] [C:\WINDOWS\system32\NVDispDrv.dll] [N/A, ] [C:\WINDOWS\system32\upxdnd.dll] [N/A, ] [C:\WINDOWS\system32\DbgHlp32.dll] [N/A, ] [C:\WINDOWS\system32\GenProtect.dll] [N/A, ] [PID: 212 / chinchin][D:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe] [Adobe Systems Inc., 8.1.0.2007051000] [D:\Program Files\Adobe\Acrobat 8.0\Acrobat\FNP_Act_Installer.dll] [Macrovision Europe Ltd., 11.03.005] [D:\Program Files\Adobe\Acrobat 8.0\Acrobat\asneu.dll] [Adobe Systems Inc., 1, 6, 0, 8] [D:\Program Files\Adobe\Acrobat 8.0\Acrobat\adobe_personalization.dll] [Adobe Systems Incorporated, 2,0,0,37] [D:\Program Files\Adobe\Acrobat 8.0\Acrobat\adobe_epic.dll] [Adobe Systems Incorporated, 2,0,0,37] [D:\Program Files\Adobe\Acrobat 8.0\Acrobat\adobe_pcd.dll] [Adobe Systems Incorporated, 1,0,0] [C:\WINDOWS\system32\BCFB3EDC.DLL] [, ] [D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroTray.DEU] [Adobe Systems Inc., 8.0.0.0] [D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroTray.FRA] [Adobe Systems Inc., 8.0.0.0] [C:\WINDOWS\system32\LotusHlp.dll] [N/A, ] [C:\WINDOWS\system32\cmdbcs.dll] [N/A, ] [C:\WINDOWS\system32\AVPSrv.dll] [N/A, ] [C:\WINDOWS\system32\mppds.dll] [N/A, ] [C:\WINDOWS\system32\MsPrint32D.dll] [N/A, ] [C:\WINDOWS\system32\Kvsc3.dll] [N/A, ] [C:\WINDOWS\system32\NVDispDrv.dll] [N/A, ] [C:\WINDOWS\system32\upxdnd.dll] [N/A, ] [C:\WINDOWS\system32\DbgHlp32.dll] [N/A, ] [C:\WINDOWS\system32\GenProtect.dll] [N/A, ] [PID: 240 / chinchin][E:\workshop\Java\jre1.5.0_06\bin\jusched.exe] [Sun Microsystems, Inc., 5.0.60.5] [C:\WINDOWS\system32\BCFB3EDC.DLL] [, ] [PID: 260 / chinchin][D:\Program Files\Google\Gmail Notifier\gnotify.exe] [Google Inc., 1.0.25.0] [C:\WINDOWS\system32\BCFB3EDC.DLL] [, ] [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scr_ch_pg.dll] [Kaspersky Lab, 1.0.6.299] [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\klscav.dll] [Kaspersky Lab, 6.0.0.299] [C:\WINDOWS\system32\LotusHlp.dll] [N/A, ] [C:\WINDOWS\system32\cmdbcs.dll] [N/A, ] [C:\WINDOWS\system32\AVPSrv.dll] [N/A, ] [C:\WINDOWS\system32\mppds.dll] [N/A, ] [C:\WINDOWS\system32\MsPrint32D.dll] [N/A, ] [C:\WINDOWS\system32\Kvsc3.dll] [N/A, ] [C:\WINDOWS\system32\NVDispDrv.dll] [N/A, ] [C:\WINDOWS\system32\upxdnd.dll] [N/A, ] [C:\WINDOWS\system32\DbgHlp32.dll] [N/A, ] [C:\WINDOWS\system32\GenProtect.dll] [N/A, ] [C:\WINDOWS\system32\MsIMMs32.dll] [N/A, ] [C:\WINDOWS\system32\msccrt.dll] [N/A, ] [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\pr_remote.dll] [Kaspersky Lab, 6.0.0.299] [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll] [Kaspersky Lab, 6.0.0.299] [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prkernel.ppl] [Kaspersky Lab, 6.0.0.304] [d:\program files\kaspersky lab\kaspersky anti-virus 6.0\params.ppl] [Kaspersky Lab, 6.0.0.299] [d:\program files\kaspersky lab\kaspersky anti-virus 6.0\pxstub.ppl] [Kaspersky Lab, 6.0.0.299] [d:\program files\kaspersky lab\kaspersky anti-virus 6.0\tempfile.ppl] [Kaspersky Lab, 6.0.0.299] [PID: 232 / chinchin][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\BCFB3EDC.DLL] [, ] [C:\WINDOWS\system32\GenProtect.dll] [N/A, ] [C:\WINDOWS\system32\DbgHlp32.dll] [N/A, ] [C:\WINDOWS\system32\Kvsc3.dll] [N/A, ] [C:\WINDOWS\system32\NVDispDrv.dll] [N/A, ] [C:\WINDOWS\system32\upxdnd.dll] [N/A, ] [C:\WINDOWS\system32\MsPrint32D.dll] [N/A, ] [C:\WINDOWS\system32\mppds.dll] [N/A, ] [C:\WINDOWS\system32\AVPSrv.dll] [N/A, ] [C:\WINDOWS\system32\cmdbcs.dll] [N/A, ] [C:\WINDOWS\system32\LotusHlp.dll] [N/A, ] [PID: 552 / SYSTEM][C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE] [Microsoft Corporation, 7.00.9466] [C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\2052\mdmui.dll] [Microsoft Corporation, 7.00.9466] [C:\WINDOWS\system32\BCFB3EDC.DLL] [, ] [PID: 2196 / SYSTEM][C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe] [Macrovision Europe Ltd., 11.03.005] [PID: 2664 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1096 / chinchin][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll] [Adobe Systems Incorporated, 8.1.0.0] [C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 8.0.0.2006102200] [E:\workshop\Java\jre1.5.0_06\bin\ssv.dll] [Sun Microsystems, Inc., 5.0.60.5] [C:\Program Files\Common Files\Microsoft Shared\INK\PENCHS.DLL] [Microsoft Corporation, 1.0.1038.0] [D:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510] [C:\Program Files\Elantech\KtpDll.Dll] [ELANTECH Devices Corp., 5.0.1.6] [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scr_ch_pg.dll] [Kaspersky Lab, 1.0.6.299] [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\klscav.dll] [Kaspersky Lab, 6.0.0.299] [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\pr_remote.dll] [Kaspersky Lab, 6.0.0.299] [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll] [Kaspersky Lab, 6.0.0.299] [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prkernel.ppl] [Kaspersky Lab, 6.0.0.304] [d:\program files\kaspersky lab\kaspersky anti-virus 6.0\params.ppl] [Kaspersky Lab, 6.0.0.299] [d:\program files\kaspersky lab\kaspersky anti-virus 6.0\pxstub.ppl] [Kaspersky Lab, 6.0.0.299] [d:\program files\kaspersky lab\kaspersky anti-virus 6.0\tempfile.ppl] [Kaspersky Lab, 6.0.0.299] [d:\program files\kaspersky lab\kaspersky anti-virus 6.0\nfio.ppl] [Kaspersky Lab, 6.0.0.299] [d:\program files\kaspersky lab\kaspersky anti-virus 6.0\fsdrvplgn.ppl] [Kaspersky Lab, 6.0.0.299] [C:\WINDOWS\system32\GenProtect.dll] [N/A, ] [C:\WINDOWS\system32\DbgHlp32.dll] [N/A, ] [C:\WINDOWS\system32\NVDispDrv.dll] [N/A, ] [C:\WINDOWS\system32\upxdnd.dll] [N/A, ] [C:\WINDOWS\system32\Kvsc3.dll] [N/A, ] [C:\WINDOWS\system32\MsPrint32D.dll] [N/A, ] [C:\WINDOWS\system32\mppds.dll] [N/A, ] [C:\WINDOWS\system32\AVPSrv.dll] [N/A, ] [C:\WINDOWS\system32\cmdbcs.dll] [N/A, ] [C:\WINDOWS\system32\LotusHlp.dll] [N/A, ] [C:\WINDOWS\system32\MsIMMs32.dll] [N/A, ] [C:\WINDOWS\system32\msccrt.dll] [N/A, ] [C:\WINDOWS\system32\IMSC40A.IME] [Microsoft Corporation, 6.0.0.2527] [C:\PROGRA~1\COMMON~1\MICROS~1\IME\SHARED2.0\MSCAND20.DLL] [Microsoft Corporation, 9.0.5510.0] [C:\WINDOWS\system32\msdmo.dll] [, ] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 1100 / chinchin][C:\WINDOWS\explorer.exe] [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234)] [C:\WINDOWS\system32\BCFB3EDC.DLL] [, ] [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scr_ch_pg.dll] [Kaspersky Lab, 1.0.6.299] [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\klscav.dll] [Kaspersky Lab, 6.0.0.299] [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\pr_remote.dll] [Kaspersky Lab, 6.0.0.299] [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll] [Kaspersky Lab, 6.0.0.299] [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prkernel.ppl] [Kaspersky Lab, 6.0.0.304] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [d:\program files\kaspersky lab\kaspersky anti-virus 6.0\params.ppl] [Kaspersky Lab, 6.0.0.299] [d:\program files\kaspersky lab\kaspersky anti-virus 6.0\pxstub.ppl] [Kaspersky Lab, 6.0.0.299] [d:\program files\kaspersky lab\kaspersky anti-virus 6.0\tempfile.ppl] [Kaspersky Lab, 6.0.0.299] [C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 8.0.0.2006102200] [D:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510] [C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 8.1.0.0] [C:\Program Files\Elantech\KtpDll.Dll] [ELANTECH Devices Corp., 5.0.1.6] [C:\WINDOWS\system32\GenProtect.dll] [N/A, ] [C:\WINDOWS\system32\DbgHlp32.dll] [N/A, ] [C:\WINDOWS\system32\upxdnd.dll] [N/A, ] [C:\WINDOWS\system32\NVDispDrv.dll] [N/A, ] [C:\WINDOWS\system32\Kvsc3.dll] [N/A, ] [C:\WINDOWS\system32\msccrt.dll] [N/A, ] [C:\WINDOWS\system32\MsPrint32D.dll] [N/A, ] [C:\WINDOWS\system32\mppds.dll] [N/A, ] [C:\WINDOWS\system32\AVPSrv.dll] [N/A, ] [C:\WINDOWS\system32\MsIMMs32.dll] [N/A, ] [C:\WINDOWS\system32\cmdbcs.dll] [N/A, ] [C:\WINDOWS\853957WL.DLL] [N/A, ] [C:\WINDOWS\system32\LotusHlp.dll] [N/A, ] [C:\WINDOWS\853957MM.DLL] [N/A, ] [d:\Program Files\WinRAR\rarext.dll] [N/A, ] [d:\Program Files\UltraEdit\ue32ctmn.dll] [, 1.0] [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\shellex.dll] [Kaspersky Lab, 6.0.0.299] [D:\Program Files\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll] [Adobe Systems Inc., 8.1.5.2007051000\0] [C:\WINDOWS\system32\igfxpph.dll] [Intel Corporation, 3.0.0.4020] [C:\WINDOWS\system32\hccutils.DLL] [Intel Corporation, 3.0.0.4020] [PID: 2384 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1740 / chinchin][C:\WINDOWS\system32\taskmgr.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\cmdbcs.dll] [N/A, ] [C:\WINDOWS\system32\AVPSrv.dll] [N/A, ] [C:\WINDOWS\system32\mppds.dll] [N/A, ] [C:\WINDOWS\system32\MsPrint32D.dll] [N/A, ] [C:\WINDOWS\system32\Kvsc3.dll] [N/A, ] [C:\WINDOWS\system32\upxdnd.dll] [N/A, ] [C:\WINDOWS\system32\DbgHlp32.dll] [N/A, ] [C:\WINDOWS\system32\MsIMMs32.dll] [N/A, ] [C:\WINDOWS\system32\msccrt.dll] [N/A, ] [C:\WINDOWS\system32\LotusHlp.dll] [N/A, ] [C:\WINDOWS\system32\NVDispDrv.dll] [N/A, ] [C:\WINDOWS\system32\GenProtect.dll] [N/A, ] [PID: 4032 / chinchin][D:\Program Files\FlashxP\FlashFXP（熊熊优化版—06级回迁特别版）\FlashFXP.exe] [IniCom Networks, Inc., 3.4.0.1145] [C:\WINDOWS\system32\cmdbcs.dll] [N/A, ] [C:\WINDOWS\system32\AVPSrv.dll] [N/A, ] [C:\WINDOWS\system32\mppds.dll] [N/A, ] [C:\WINDOWS\system32\MsPrint32D.dll] [N/A, ] [C:\WINDOWS\system32\Kvsc3.dll] [N/A, ] [C:\WINDOWS\system32\upxdnd.dll] [N/A, ] [C:\WINDOWS\system32\DbgHlp32.dll] [N/A, ] [D:\Program Files\FlashxP\FlashFXP（熊熊优化版—06级回迁特别版）\libeay32.dll] [The OpenSSL Project, http://www.openssl.org/, 0.9.8b] [D:\Program Files\FlashxP\FlashFXP（熊熊优化版—06级回迁特别版）\ssleay32.dll] [The OpenSSL Project, http://www.openssl.org/, 0.9.8b] [C:\WINDOWS\system32\MsIMMs32.dll] [N/A, ] [C:\WINDOWS\system32\msccrt.dll] [N/A, ] [C:\WINDOWS\system32\LotusHlp.dll] [N/A, ] [C:\WINDOWS\system32\NVDispDrv.dll] [N/A, ] [C:\WINDOWS\system32\GenProtect.dll] [N/A, ] [PID: 4016 / chinchin][D:\Kill 毒\sreng2\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900] [C:\WINDOWS\system32\LotusHlp.dll] [N/A, ] [C:\WINDOWS\system32\cmdbcs.dll] [N/A, ] [C:\WINDOWS\system32\AVPSrv.dll] [N/A, ] [C:\WINDOWS\system32\mppds.dll] [N/A, ] [C:\WINDOWS\system32\MsPrint32D.dll] [N/A, ] [C:\WINDOWS\system32\Kvsc3.dll] [N/A, ] [C:\WINDOWS\system32\NVDispDrv.dll] [N/A, ] [C:\WINDOWS\system32\upxdnd.dll] [N/A, ] [C:\WINDOWS\system32\DbgHlp32.dll] [N/A, ] [C:\WINDOWS\system32\GenProtect.dll] [N/A, ] [C:\WINDOWS\system32\MsIMMs32.dll] [N/A, ] [C:\WINDOWS\system32\msccrt.dll] [N/A, ] [D:\Kill 毒\sreng2\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15] [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scr_ch_pg.dll] [Kaspersky Lab, 1.0.6.299] [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\klscav.dll] [Kaspersky Lab, 6.0.0.299] ================================== 文件关联 .TXT Error. [C:\WINDOWS\notepad.exe %1] .EXE OK. ["%1" %*] .COM OK. ["%1" %*] .PIF OK. ["%1" %*] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %*] .SCR OK. ["%1" /S] .CHM Error. ["hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf [C:\] [AutoRun] open=auto.exe shellexecute=auto.exe shell\Auto\command=auto.exe [D:\] [AutoRun] open=auto.exe shellexecute=auto.exe shell\Auto\command=auto.exe [E:\] [AutoRun] open=auto.exe shellexecute=auto.exe shell\Auto\command=auto.exe ================================== HOSTS 文件 127.0.0.1 localhost ================================== 进程特权扫描特殊特权被允许： SeLoadDriverPrivilege [PID = 240, E:\WORKSHOP\JAVA\JRE1.5.0_06\BIN\JUSCHED.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 260, D:\PROGRAM FILES\GOOGLE\GMAIL NOTIFIER\GNOTIFY.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 4032, D:\PROGRAM FILES\FLASHXP\FLASHFXP（熊熊优化版—06级回迁特别版）\FLASHFXP.EXE] ================================== API HOOK RVA 错误： LoadLibraryA (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys) RVA 错误： LoadLibraryExA (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys) RVA 错误： LoadLibraryExW (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys) RVA 错误： LoadLibraryW (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys) RVA 错误： GetProcAddress (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys) ================================== 隐藏进程 N/A ================================== [/CODE] ☆─────────────────────────────────────☆ kissblue (断情) 于 (Sun Dec 2 10:36:40 2007) 提到: explorer.exe ☆─────────────────────────────────────☆ qingqing (wahaha) 于 (Sun Dec 2 10:45:14 2007) 提到: 不明白【在 kissblue 的大作中提到: 】 : explorer.exe ☆─────────────────────────────────────☆ rebirthatsix (茫犭者) 于 (Sun Dec 2 14:19:52 2007) 提到: 刚回来，看完了 C:\WINDOWS\system32\BCFB3EDC.DLL 这个插入了你的几乎所有进程用icesword把所有有这个dll文件的中的以这个文件所起的线程给终止了同时你的机器还被它自动下载了其它的病毒，并且也有注入进程杀是能杀，自己有耐心一个一个把线程结束了就可以线程都结束了之后按照我之前给的顺序删除那些文件和服务以及注册表就可以了 ☆─────────────────────────────────────☆ rebirthatsix (茫犭者) 于 (Sun Dec 2 14:22:42 2007) 提到: 结束线程的工作最好用process explorer来做，这样能够看到每个进程中所起线程对应的镜像文件 ☆─────────────────────────────────────☆ rebirthatsix (茫犭者) 于 (Sun Dec 2 14:25:08 2007) 提到: 还有你可以用icesword强制删除这个dll文件，看看会不会自动产生，如果不会就容易很多我就纳闷你开着卡巴怎么可能会被线程插入的要是卡巴问你什么你都点yes的话，那我觉得你还是不要用卡巴了，用和不用一个样 ☆─────────────────────────────────────☆ qingqing (wahaha) 于 (Sun Dec 2 14:25:10 2007) 提到: 没耐心重装系统吗？哭了…… 【在 rebirthatsix 的大作中提到: 】 : 刚回来，看完了 : C:\WINDOWS\system32\BCFB3EDC.DLL : 这个插入了你的几乎所有进程 : ................... ☆─────────────────────────────────────☆ rebirthatsix (茫犭者) 于 (Sun Dec 2 14:27:08 2007) 提到: 【在 qingqing 的大作中提到: 】 : 没耐心重装系统吗？哭了…… 没耐心那就重装，记得重装完不要去双击d,e盘，要先用地址栏直接访问d,e盘，然后把autorun和auto自己手动删除一般写这种病毒的人不是对社会具有极度的仇恨就是某些病毒公司估计放出的 ☆─────────────────────────────────────☆ qingqing (wahaha) 于 (Sun Dec 2 14:29:25 2007) 提到: 貌似系统时间被改了之后 kav就不起作用了【在 rebirthatsix 的大作中提到: 】 : 还有你可以用icesword强制删除这个dll文件，看看会不会自动产生，如果不会就容易很多 : 我就纳闷你开着卡巴怎么可能会被线程插入的 : 要是卡巴问你什么你都点yes的话，那我觉得你还是不要用卡巴了，用和不用一个样 ☆─────────────────────────────────────☆ rebirthatsix (茫犭者) 于 (Sun Dec 2 14:31:38 2007) 提到: 【在 qingqing 的大作中提到: 】 : 貌似系统时间被改了之后 kav就不起作用了那它也得能改你时间啊。。。你是不是不打windows update的？ ☆─────────────────────────────────────☆ kissblue (断情) 于 (Sun Dec 2 16:58:43 2007) 提到: MM问我有没代理杀毒的... MZ可以考虑让她请吃饭. ☆─────────────────────────────────────☆ rebirthatsix (茫犭者) 于 (Sun Dec 2 21:30:54 2007) 提到: 【在 kissblue 的大作中提到: 】 : MM问我有没代理杀毒的... : MZ可以考虑让她请吃饭. 我和她说了我只有下个周末才有空帮她看电脑。。。。她如果愿意等就行 ☆─────────────────────────────────────☆ zshq (火炎焱【坚定的JOB-HUNTER】) 于 (Tue Dec 4 10:45:26 2007) 提到: 上周中了这个木马费了好大的劲才搞定 ☆─────────────────────────────────────☆ qingqing (wahaha) 于 (Sun Dec 9 18:18:02 2007) 提到: 自己重装了呵呵【在 rebirthatsix 的大作中提到: 】 : 我和她说了我只有下个周末才有空帮她看电脑。。。。 : 她如果愿意等就行 ☆─────────────────────────────────────☆ qingqing (wahaha) 于 (Sun Dec 9 18:18:45 2007) 提到: 自己请自己吃饭 ~ 【在 kissblue 的大作中提到: 】 : MM问我有没代理杀毒的... : MZ可以考虑让她请吃饭.

[合集] [怎么杀]Trojan-PSW.Win32.OnLineGames