MM 美女美景-这个木马老是杀不掉 -中华网博客

首页

爱秒爱日 - 个人首页┆控制面板┆搜索┆帮助┆退出

爱秒爱日

活力地带

个人首页

给我留言

控制面板

我的文章

我的相册

最近更新的BLOG列表

最新更新的文章列表

发表文章

这个木马老是杀不掉

2007-12-19 23:54:07.0

计算机重启后删除: 木马程序 Trojan-Downloader.Win32.Agent.bbb 文件: C:\WINDOWS\system32\drivers\rwqgw.sys
请大家帮帮忙

[ 本帖最后由寂寞舟于 2007-6-6 16:17 编辑 ]

下载执行System Repair Engineer (SREng)

按「智能扫描」，再按「扫描」
最后，按「保存报告」，保存到桌面
将 SREngLOG.log 中内容完整的复制粘贴上来，不要做任何修改。
如出现无法运行，请重命名或修改扩展名，如xic.exe/xic.com/xic.bat/xic.scr等

复制内容到剪贴板

代码:

2007-06-06,15:16:19



System Repair Engineer 2.4.12.806

Smallfrogs ([url]http://www.KZTechs.com[/url])



Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能



以下内容被选中：

    所有的启动项目（包括注册表、启动文件夹、服务等）

    浏览器加载项

    正在运行的进程（包括进程模块信息）

    文件关联

    Winsock 提供者

    Autorun.inf

    HOSTS 文件





启动项目

注册表

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]

[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]

    <load><>  [N/A]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Publisher]

    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Publisher]

    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows Publisher]

    <IgfxTray><C:\WINDOWS\system32\igfxtray.exe>  [(Verified)Microsoft Windows Publisher]

    <HotKeysCmds><C:\WINDOWS\system32\hkcmd.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]

    <SoundMan><SOUNDMAN.EXE>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]

    <Apoint><C:\Program Files\Apoint2K\Apoint.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]

    <CplBCL50><C:\Program Files\EzButton\CplBCL50.EXE>  [Dritek System Inc.]

    <kis><"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe">  [Kaspersky Lab]

    <IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload>  [(Verified)Microsoft Corporation]

    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]

    <BigDog303><C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)>  [N/A]

    <System><C:\Program Files\Common Files\system\Updaterun.exe>  []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

    <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]

    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]

    <AppInit_DLLs><C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll>  [Kaspersky Lab]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]

    <WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll>  [Kaspersky Lab]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]

    <WinlogonNotify: WgaLogon><WgaLogon.dll>  [(Verified)Microsoft Corporation]



==================================

启动文件夹

[wnwb]

  <C:\Documents and Settings\woailuo\「开始」菜单\程序\启动\wnwb.lnk --> E:\程序\wnwb2006\wnwb.exe [仅供内部使用 estudy.ys168.com ]><N>



==================================

服务

[Adobe LM Service / Adobe LM Service][Stopped/Manual Start]

  <"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>

[卡巴斯基互联网安全套装 6.0 / AVP][Running/Auto Start]

  <"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r><Kaspersky Lab>

[Local Connection Manager / BUZOR][Running/Auto Start]

  <C:\WINDOWS\SYSTEM32\RUNDLLFOROUR.EXE C:\WINDOWS\SYSTEM32\WBEM\URTPN.DLL,Export 1087><Microsoft Corporation>

[Windows Gateway / Indtry][Running/Auto Start]

  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\fkjwl.dll><Microsoft Corporation>



==================================

驱动程序

[acpidisk / acpidisk][Stopped/Auto Start]

  <\??\C:\WINDOWS\system32\drivers\acpidisk.sys><N/A>

[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]

  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>

[Alps Pointing-device Filter Driver / ApfiltrService][Running/Manual Start]

  <system32\DRIVERS\Apfiltr.sys><Alps Electric Co., Ltd.>

[Dritek HotKey Keyboard Filter Driver / DKbFltr][Running/Manual Start]

  <System32\Drivers\DKbFltr.sys><Dritek System Inc.>

[ialm / ialm][Running/Manual Start]

  <system32\DRIVERS\ialmnt5.sys><Intel Corporation>

[Sony Ericsson 750 driver (WDM) / k750bus][Stopped/Manual Start]

  <system32\DRIVERS\k750bus.sys><MCCI>

[Sony Ericsson 750 USB WMC Modem Filter / k750mdfl][Stopped/Manual Start]

  <system32\DRIVERS\k750mdfl.sys><MCCI>

[Sony Ericsson 750 USB WMC Modem Drivers / k750mdm][Stopped/Manual Start]

  <system32\DRIVERS\k750mdm.sys><MCCI>

[Sony Ericsson 750 USB WMC Device Management Drivers / k750mgmt][Stopped/Manual Start]

  <system32\DRIVERS\k750mgmt.sys><MCCI>

[Sony Ericsson 750 USB WMC OBEX Interface Drivers / k750obex][Stopped/Manual Start]

  <system32\DRIVERS\k750obex.sys><MCCI>

[kl1 / kl1][Running/Boot Start]

  <\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>

[klif / klif][Running/System Start]

  <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>

[Mtlmnt5 / Mtlmnt5][Running/Manual Start]

  <system32\DRIVERS\Mtlmnt5.sys><>

[Mtlstrm / Mtlstrm][Stopped/Manual Start]

  <system32\DRIVERS\Mtlstrm.sys><>

[npkcrypt / npkcrypt][Running/Auto Start]

  <\??\E:\程序文件\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>

[NtMtlFax / NtMtlFax][Stopped/Manual Start]

  <system32\DRIVERS\NtMtlFax.sys><>

[Direct Parallel Link Driver / Ptilink][Running/Manual Start]

  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>

[Realtek RTL8139/810x/8169/8110 all in one NDIS NT Driver / RTL8023][Running/Manual Start]

  <system32\DRIVERS\Rtlnic51.sys><Realtek Semiconductor Corporation>

[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]

  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>

[rwqg / rwqgw][Running/Boot Start]

  <\SystemRoot\System32\DRIVERS\rwqgw.sys><N/A>

[Secdrv / Secdrv][Stopped/Manual Start]

  <system32\DRIVERS\secdrv.sys><N/A>

[SmartLink AMR_PCI Driver / Slntamr][Running/Manual Start]

  <system32\DRIVERS\slntamr.sys><>

[SlNtHal / SlNtHal][Stopped/Manual Start]

  <system32\DRIVERS\Slnthal.sys><>

[SlWdmSup / SlWdmSup][Running/Manual Start]

  <system32\DRIVERS\SlWdmSup.sys><Vireo Software>

[SMC IrCC Miniport Device Driver / SMCIRDA][Running/Manual Start]

  <system32\DRIVERS\smcirda.sys><SMC>

[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]

  <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>

[VIMICRO USB PC Camera (ZC0301PLH) / ZSMC303][Stopped/Manual Start]

  <System32\Drivers\usbVM303.sys><Vimicro Corporation>

[Intel(R) Graphics Platform (SoftBIOS) Driver / {6080A529-897E-4629-A488-ABA0C29B635E}][Running/Manual Start]

  <system32\drivers\ialmsbw.sys><Intel Corporation>

[Intel(R) Graphics Chipset (KCH) Driver / {D31A0762-0CEB-444e-ACFF-B049A1F6FE91}][Running/Manual Start]

  <system32\drivers\ialmkchw.sys><Intel Corporation>



==================================

浏览器加载项

[ThunderAtOnce Class]

  {01443AEC-0FD1-40fd-9C87-E93D1494C233} <E:\程序文件\迅雷\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>

[Thunder Browser Helper]

  {06849E9E-C8D7-4D59-B87D-784B7D6BE0B3} <E:\程序文件\迅雷\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>

[AcroIEHlprObj Class]

  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <, N/A>

[Info cache]

  {385AB8C6-FB22-4D17-8834-064E2BA0A6F0} <C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll, 金泰丰(广州)科技有限公司>

[AcroIEToolbarHelper Class]

  {AE7CD045-E861-484f-8273-0445EE161910} <, N/A>

[启动迅雷5]

  {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <E:\程序文件\迅雷\Thunder.exe, Thunder Networking Technologies,LTD>

[Web反病毒保护]

  {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll, Kaspersky Lab>

[Messenger]

  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>

[Adobe PDF]

  {47833539-D0C5-4125-9FA8-0819E2EAAC93} <, N/A>

[PasswordEditCtrl Class]

  {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>

[ThunderAtOnce Class]

  {01443AEC-0FD1-40FD-9C87-E93D1494C233} <E:\程序文件\迅雷\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>

[Thunder Browser Helper]

  {06849E9E-C8D7-4D59-B87D-784B7D6BE0B3} <E:\程序文件\迅雷\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>

[AcroIEHlprObj Class]

  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <, N/A>

[Windows Genuine Advantage Validation Tool]

  {17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\legitcheckcontrol.dll, Microsoft Corporation>

[Windows Media Player]

  {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>

[HTML Document]

  {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>

[DHTML Edit Control Safe for Scripting for IE5]

  {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>

[IETag Factory]

  {38481807-CA0E-42D2-BF39-B33AF135CC4D} <C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\IETAG.DLL, Microsoft Corporation>

[Info cache]

  {385AB8C6-FB22-4D17-8834-064E2BA0A6F0} <C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll, 金泰丰(广州)科技有限公司>

[Adobe PDF]

  {47833539-D0C5-4125-9FA8-0819E2EAAC93} <, N/A>

[Thunder Agent Class]

  {485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <E:\程序文件\迅雷\ComDlls\ThunderAgent_Now.dll, Thunder Networking Technologies,LTD>

[Shell Name Space]

  {55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>

[WUWebControl Class]

  {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>

[Windows Media Player]

  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>

[Microsoft Web 浏览器]

  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>

[Thunder Browser Helper]

  {889D2FEB-5411-4565-8998-1DD2C5261283} <E:\程序文件\迅雷\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>

[Microsoft Scriptlet Component]

  {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>

[AcroIEToolbarHelper Class]

  {AE7CD045-E861-484F-8273-0445EE161910} <, N/A>

[SearchAssistantOC]

  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>

[RDS.DataSpace]

  {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>

[Shockwave Flash Object]

  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>

[PasswordEditCtrl Class]

  {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>

[上传到QQ网络硬盘]

  <E:\程序文件\QQ\AddToNetDisk.htm, N/A>

[使用迅雷下载]

  <E:\程序文件\迅雷\Program\geturl.htm, N/A>

[使用迅雷下载全部链接]

  <E:\程序文件\迅雷\Program\getallurl.htm, N/A>

[导出到 Microsoft Office Excel(&X)]

  <res://E:\程序文件\word\OFFICE11\EXCEL.EXE/3000, N/A>

[添加到QQ自定义面板]

  <E:\程序文件\QQ\AddPanel.htm, N/A>

[添加到QQ表情]

  <E:\程序文件\QQ\AddEmotion.htm, N/A>

[用QQ彩信发送该图片]

  <E:\程序文件\QQ\SendMMS.htm, N/A>

[转换为 Adobe PDF]

  <res://E:\程序文件\read\Acrobat\AcroIEFavClient.dll/AcroIECapture.html, N/A>

[转换为现有 PDF]

  <res://E:\程序文件\read\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html, N/A>

[转换选定的链接为 Adobe PDF]

  <res://E:\程序文件\read\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html, N/A>

[转换选定的链接为现有 PDF]

  <res://E:\程序文件\read\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html, N/A>

[转换选项为 Adobe PDF]

  <res://E:\程序文件\read\Acrobat\AcroIEFavClient.dll/AcroIECapture.html, N/A>

[转换选项为现有 PDF]

  <res://E:\程序文件\read\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html, N/A>

[转换链接目标为 Adobe PDF]

  <res://E:\程序文件\read\Acrobat\AcroIEFavClient.dll/AcroIECapture.html, N/A>

[转换链接目标为现有 PDF]

  <res://E:\程序文件\read\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html, N/A>



==================================

正在运行的进程

[PID: 524][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 588][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 612][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\klogon.dll]  [Kaspersky Lab, 6.0.0.299]

    [C:\WINDOWS\system32\WgaLogon.dll]  [Microsoft Corporation, 1.7.0018.5]

    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]

[PID: 656][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 668][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 820][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 896][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 964][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [c:\windows\system32\uxtuneup.dll]  [TuneUp Software GmbH, 1.0.0.2]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]

    [c:\windows\system32\fkjwl.dll]  [Microsoft Corporation, 5.1.2600.0]

[PID: 1784][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\fmytz.dll]  [N/A, ]

    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]

    [E:\程序文件\read\ActiveX\PDFShell.CHS]  [Adobe Systems, Inc., 7.0.0.0]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]

    [C:\WINDOWS\SYSTEM32\WBEM\URTPN.DLL]  [Microsoft Corporation, 5, 1, 2600, 2709]

    [E:\程序文件\迅雷\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 1, 4]

    [E:\程序文件\迅雷\Components\ResWorker\DsBho_00.dll]  [, 1, 0, 0, 2]

    [E:\程序文件\迅雷\Components\ResWorker\DataProcessor_00.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 4]

    [E:\程序文件\word\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]

    [E:\程序文件\read\ActiveX\PDFShell.dll]  [Adobe Systems, Inc., 7.0.0.0]

    [E:\程序\wnwb2006\WNMKEY.DLL]  [深圳世强软件开发部 [url]www.wnwb.com[/url] , 2005, 7, 5, 1]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\shellex.dll]  [Kaspersky Lab, 6.0.0.299]

[PID: 508][C:\WINDOWS\system32\igfxtray.exe]  [Intel Corporation, 3.0.0.2285]

    [C:\WINDOWS\system32\hccutils.DLL]  [Intel Corporation, 3.0.0.2285]

    [C:\WINDOWS\system32\igfxdev.dll]  [Intel Corporation, 3.0.0.2285]

    [C:\WINDOWS\system32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.2285]

    [C:\WINDOWS\system32\igfxres.dll]  [Intel Corporation, 3.0.0.2285]

    [C:\WINDOWS\system32\igfxress.dll]  [Intel Corporation, 3.0.0.2285]

[PID: 520][C:\WINDOWS\system32\hkcmd.exe]  [Intel Corporation, 3.0.0.2285]

    [C:\WINDOWS\system32\hccutils.DLL]  [Intel Corporation, 3.0.0.2285]

    [C:\WINDOWS\system32\igfxdev.dll]  [Intel Corporation, 3.0.0.2285]

    [C:\WINDOWS\system32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.2285]

    [C:\WINDOWS\system32\igfxhk.dll]  [Intel Corporation, 3.0.0.2285]

    [C:\WINDOWS\system32\igfxres.dll]  [Intel Corporation, 3.0.0.2285]

[PID: 544][C:\WINDOWS\SOUNDMAN.EXE]  [Realtek Semiconductor Corp., 5.1.02]

[PID: 564][C:\Program Files\Apoint2K\Apoint.exe]  [Alps Electric Co., Ltd., 5.3.10.166]

    [C:\WINDOWS\system32\VXDIF.DLL]  [Alps Electric Co., Ltd., 6.0.2.65]

    [C:\Program Files\Apoint2K\Apoint.DLL]  [Alps Electric Co., Ltd., 5.3.203.165]

    [C:\Program Files\Apoint2K\EzAuto.dll]  [Alps Electric Co., Ltd., 4.5.1.83]

    [C:\Program Files\Apoint2K\EzLaunch.DLL]  [Alps Electric Co., Ltd., 4.5.0.47]

[PID: 576][C:\Program Files\EzButton\CplBCL50.EXE]  [Dritek System Inc., 1.00]

    [C:\Program Files\EzButton\SzUPFUtl.dll]  [Dritek System Inc., 1.00]

    [C:\Program Files\EzButton\OSDUtl.dll]  [Dritek System Inc., 1.00]

    [C:\Program Files\EzButton\RgnMaker.dll]  [Dritek System Inc., 12.07.1999 ( VC60 )]

    [C:\Program Files\EzButton\CDRomUtl.dll]  [Dritek System Inc., 1.00]

    [C:\Program Files\EzButton\MixerUtl.dll]  [Dritek System Inc., 1.00]

    [C:\Program Files\EzButton\ComFnUtl.dll]  [Dritek System Inc., 1.00]

    [C:\Program Files\EzButton\LgKCUtl.dll]  [Dritek System Inc., 2, 0, 1, 1]

    [C:\Program Files\EzButton\Wnd2File.dll]  [Dritek System Inc., 3.00]

    [C:\Program Files\EzButton\TkBarUtl.dll]  [Dritek System Inc., 1.00]

[PID: 808][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3018]

[PID: 812][C:\WINDOWS\VM303_STI.EXE]  [Vimicro, 4, 3, 625, 61]

    [C:\WINDOWS\system32\msdmo.dll]  [, ]

[PID: 836][C:\Program Files\Common Files\system\Updaterun.exe]  [N/A, ]

[PID: 936][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 1092][C:\Program Files\Apoint2K\Apntex.exe]  [Alps Electric Co., Ltd., 5.0.1.15]

    [C:\WINDOWS\system32\VXDIF.DLL]  [Alps Electric Co., Ltd., 6.0.2.65]

[PID: 1104][E:\程序\wnwb2006\wnwb.exe]  [仅供内部使用 estudy.ys168.com , 2006, 1, 18, 1]

    [E:\程序\wnwb2006\WNMKEY.DLL]  [深圳世强软件开发部 [url]www.wnwb.com[/url] , 2005, 7, 5, 1]

[PID: 1132][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 1804][E:\程序文件\迅雷\Program\Thunder5.exe]  [Thunder Networking Technologies,LTD, 5, 6, 2, 300]

    [E:\程序文件\迅雷\Program\TaskManager.dll]  [Thunder Networking Technologies,LTD, 1, 1, 0, 21]

    [E:\程序文件\迅雷\Program\download_interface.dll]  [Thunder Networking Technologies,LTD, 2, 15, 2, 85]

    [E:\程序文件\迅雷\Program\stlport_vc646.dll]  [STLport Consulting, Inc., 4.6.2003.1031]

    [E:\程序文件\迅雷\Program\asyn_dns.dll]  [Thunder Networking Technologies,LTD, 2, 15, 2, 85]

    [E:\程序文件\迅雷\Program\BHOStub.dll]  [Thunder Networking Technologies,LTD, 1, 1, 0, 8]

    [E:\程序文件\迅雷\Components\DownAndPlay\DownAndPlay.dll]  [, 1, 0, 0, 3]

    [E:\程序文件\迅雷\Program\iTargetAD.dll]  [Thunder Networking Technologies,LTD, 1, 0, 2, 26]

    [C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx]  [Adobe Systems, Inc., 9,0,45,0]

    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]

    [E:\程序文件\迅雷\Components\InMedia\iEmbedShell.dll]  [　, 1, 0, 0, 17]

    [E:\程序文件\迅雷\Program\FloatBar.dll]  [Giganology Inc., 1, 0, 0, 2]

[PID: 2360][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]

    [E:\程序文件\迅雷\ComDlls\TDAtOnce_Now.dll]  [Thunder Networking Technologies,LTD, 1.0.0.4]

    [E:\程序文件\迅雷\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 1, 4]

    [E:\程序文件\迅雷\Components\ResWorker\DsBho_00.dll]  [, 1, 0, 0, 2]

    [E:\程序文件\迅雷\Components\ResWorker\DataProcessor_00.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 4]

    [C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll]  [金泰丰(广州)科技有限公司, 2, 3, 0, 0]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll]  [Kaspersky Lab, 1.0.6.299]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll]  [Kaspersky Lab, 6.0.0.299]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll]  [Kaspersky Lab, 6.0.0.299]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll]  [Kaspersky Lab, 6.0.0.299]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl]  [Kaspersky Lab, 6.0.0.304]

    [c:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl]  [Kaspersky Lab, 6.0.0.299]

    [c:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl]  [Kaspersky Lab, 6.0.0.299]

    [c:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl]  [Kaspersky Lab, 6.0.0.299]

    [c:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl]  [Kaspersky Lab, 6.0.0.299]

    [c:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl]  [Kaspersky Lab, 6.0.0.299]

    [E:\程序文件\word\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]

    [C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx]  [Adobe Systems, Inc., 9,0,45,0]

    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]

    [E:\程序文件\迅雷\ComDlls\ThunderAgent_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 3, 20]

[PID: 1984][E:\迅雷\sreng2\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]



==================================

文件关联

.TXT  Error. [C:\WINDOWS\notepad.exe %1]

.EXE  OK. ["%1" %*]

.COM  OK. ["%1" %*]

.PIF  OK. ["%1" %*]

.REG  OK. [regedit.exe "%1"]

.BAT  OK. ["%1" %*]

.SCR  OK. ["%1" /S]

.CHM  Error. ["hh.exe" %1]

.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]

.INI  Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]

.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]

.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]

.JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]

.LNK  OK. [{00021401-0000-0000-C000-000000000046}]



==================================

Winsock 提供者

N/A



==================================

Autorun.inf

N/A



==================================

HOSTS 文件

127.0.0.1       localhost



==================================

API HOOK

RVA  错误： LoadLibraryA (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xB2A02B25)

RVA  错误： LoadLibraryExA (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xB2A02D67)

RVA  错误： LoadLibraryExW (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xB2A02F0B)

RVA  错误： LoadLibraryW (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xB2A02C49)

RVA  错误： GetProcAddress (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0xB2A02E8F)



==================================

隐藏进程

N/A



==================================

关闭系统还原：在「我的电脑」上按右键，选择「属性」
进入「系统还原」，勾选「在所有驱动器上关闭系统还原」，按下「应用」，出现提示对话框时按「是」（病毒清理后请自己决定是否打开系统还原）

清理临时文件夹:点此下载ATF Cleaner
执行后，勾选「全选」，按下「立刻清理」

根据SREng扫描日志请按照如下步骤，尝试删除和修复

1.建议使用XDelBox删除以下文件：(XDelBox下载)
使用说明：删除时复制所有要删除文件的路径，在待删除文件列表里点击右键选择从剪贴板导入，导入后在要删除文件上点击右键，选择立刻重启删除，电脑会重启进入DOS界面进行删除操作。运行xdelbox前最好卸载所有可移动存储介质（包括U盘，MP3忽略即可)

c:\program files\common files\system\updaterun.exe
c:\windows\system32\fmytz.dll
c:\windows\system32\wbem\urtpn.dll
c:\windows\system32\fkjwl.dll
c:\windows\system32\rundllforour.exe
c:\windows\system32\wbem\urtpn.dll
c:\windows\system32\drivers\acpidisk.sys
c:\windows\system32\drivers\rwqgw.sys

2.删除重启后使用SREng修复下面各项：

启动项目－－服务－－ Win32服务应用程序之如下项删除：
[Windows Gateway / Indtry] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\fkjwl.dll>
[Local Connection Manager / BUZOR] <C:\WINDOWS\SYSTEM32\RUNDLLFOROUR.EXE C:\WINDOWS\SYSTEM32\WBEM\URTPN.DLL,Export 1087>

启动项目－－服务－－驱动程序之如下项删除：
[acpidisk / acpidisk] <\??\C:\WINDOWS\system32\drivers\acpidisk.sys>
[rwqg / rwqgw] <\SystemRoot\System32\DRIVERS\rwqgw.sys>

系统恢复－－文件关联－－修复
.TXT  Error. [C:\WINDOWS\notepad.exe %1]
.CHM  Error. ["hh.exe" %1]
.INI  Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]

最后下载windows清理助手清理恶意软件以及自身杀软升级至最新，进行全盘杀毒
http://www.arswp.com/download/arswp/arswp.rar

标签：
证券/理财股票收盘点评空方多方下跌 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1
相关文章:

文章评论

[以下网友留言只代表其个人观点，不代表中华网的观点或立场]

发表评论

昵称：

主页：

内容：

表情：

r /> [转换链接目标为 Adobe PDF]
  <res://E:\程序文件\read\Acrobat\AcroIEFavClient.dll/AcroIECapture.html, N/A>
[转换链接目标为现有 PDF]
  <res://E:\程序文件\read\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html, N/A>

==================================
正在运行的进程
[PID: 524][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 588][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 612][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\klogon.dll]  [Kaspersky Lab, 6.0.0.299]
[C:\WINDOWS\system32\WgaLogon.dll]  [Microsoft Corporation, 1.7.0018.5]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 656][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 668][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 820][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 896][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 964][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[c:\windows\system32\uxtuneup.dll]  [TuneUp Software GmbH, 1.0.0.2]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
[c:\windows\system32\fkjwl.dll]  [Microsoft Corporation, 5.1.2600.0]
[PID: 1784][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\fmytz.dll]  [N/A, ]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[E:\程序文件\read\ActiveX\PDFShell.CHS]  [Adobe Systems, Inc., 7.0.0.0]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
[C:\WINDOWS\SYSTEM32\WBEM\URTPN.DLL]  [Microsoft Corporation, 5, 1, 2600, 2709]
[E:\程序文件\迅雷\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 1, 4]
[E:\程序文件\迅雷\Components\ResWorker\DsBho_00.dll]  [, 1, 0, 0, 2]
[E:\程序文件\迅雷\Components\ResWorker\DataProcessor_00.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 4]
[E:\程序文件\word\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
[E:\程序文件\read\ActiveX\PDFShell.dll]  [Adobe Systems, Inc., 7.0.0.0]
[E:\程序\wnwb2006\WNMKEY.DLL]  [深圳世强软件开发部 [url]www.wnwb.com[/url] , 2005, 7, 5, 1]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\shellex.dll]  [Kaspersky Lab, 6.0.0.299]
[PID: 508][C:\WINDOWS\system32\igfxtray.exe]  [Intel Corporation, 3.0.0.2285]
[C:\WINDOWS\system32\hccutils.DLL]  [Intel Corporation, 3.0.0.2285]
[C:\WINDOWS\system32\igfxdev.dll]  [Intel Corporation, 3.0.0.2285]
[C:\WINDOWS\system32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.2285]
[C:\WINDOWS\system32\igfxres.dll]  [Intel Corporation, 3.0.0.2285]
[C:\WINDOWS\system32\igfxress.dll]  [Intel Corporation, 3.0.0.2285]
[PID: 520][C:\WINDOWS\system32\hkcmd.exe]  [Intel Corporation, 3.0.0.2285]
[C:\WINDOWS\system32\hccutils.DLL]  [Intel Corporation, 3.0.0.2285]
[C:\WINDOWS\system32\igfxdev.dll]  [Intel Corporation, 3.0.0.2285]
[C:\WINDOWS\system32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.2285]
[C:\WINDOWS\system32\igfxhk.dll]  [Intel Corporation, 3.0.0.2285]
[C:\WINDOWS\system32\igfxres.dll]  [Intel Corporation, 3.0.0.2285]
[PID: 544][C:\WINDOWS\SOUNDMAN.EXE]  [Realtek Semiconductor Corp., 5.1.02]
[PID: 564][C:\Program Files\Apoint2K\Apoint.exe]  [Alps Electric Co., Ltd., 5.3.10.166]
[C:\WINDOWS\system32\VXDIF.DLL]  [Alps Electric Co., Ltd., 6.0.2.65]
[C:\Program Files\Apoint2K\Apoint.DLL]  [Alps Electric Co., Ltd., 5.3.203.165]
[C:\Program Files\Apoint2K\EzAuto.dll]  [Alps Electric Co., Ltd., 4.5.1.83]
[C:\Program Files\Apoint2K\EzLaunch.DLL]  [Alps Electric Co., Ltd., 4.5.0.47]
[PID: 576][C:\Program Files\EzButton\CplBCL50.EXE]  [Dritek System Inc., 1.00]
[C:\Program Files\EzButton\SzUPFUtl.dll]  [Dritek System Inc., 1.00]
[C:\Program Files\EzButton\OSDUtl.dll]  [Dritek System Inc., 1.00]
[C:\Program Files\EzButton\RgnMaker.dll]  [Dritek System Inc., 12.07.1999 ( VC60 )]
[C:\Program Files\EzButton\CDRomUtl.dll]  [Dritek System Inc., 1.00]
[C:\Program Files\EzButton\MixerUtl.dll]  [Dritek System Inc., 1.00]
[C:\Program Files\EzButton\ComFnUtl.dll]  [Dritek System Inc., 1.00]
[C:\Program Files\EzButton\LgKCUtl.dll]  [Dritek System Inc., 2, 0, 1, 1]
[C:\Program Files\EzButton\Wnd2File.dll]  [Dritek System Inc., 3.00]
[C:\Program Files\EzButton\TkBarUtl.dll]  [Dritek System Inc., 1.00]
[PID: 808][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3018]
[PID: 812][C:\WINDOWS\VM303_STI.EXE]  [Vimicro, 4, 3, 625, 61]
[C:\WINDOWS\system32\msdmo.dll]  [, ]
[PID: 836][C:\Program Files\Common Files\system\Updaterun.exe]  [N/A, ]
[PID: 936][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1092][C:\Program Files\Apoint2K\Apntex.exe]  [Alps Electric Co., Ltd., 5.0.1.15]
[C:\WINDOWS\system32\VXDIF.DLL]  [Alps Electric Co., Ltd., 6.0.2.65]
[PID: 1104][E:\程序\wnwb2006\wnwb.exe]  [仅供内部使用 estudy.ys168.com , 2006, 1, 18, 1]
[E:\程序\wnwb2006\WNMKEY.DLL]  [深圳世强软件开发部 [url]www.wnwb.com[/url] , 2005, 7, 5, 1]
[PID: 1132][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1804][E:\程序文件\迅雷\Program\Thunder5.exe]  [Thunder Networking Technologies,LTD, 5, 6, 2, 300]
[E:\程序文件\迅雷\Program\TaskManager.dll]  [Thunder Networking Technologies,LTD, 1, 1, 0, 21]
[E:\程序文件\迅雷\Program\download_interface.dll]  [Thunder Networking Technologies,LTD, 2, 15, 2, 85]
[E:\程序文件\迅雷\Program\stlport_vc646.dll]  [STLport Consulting, Inc., 4.6.2003.1031]
[E:\程序文件\迅雷\Program\asyn_dns.dll]  [Thunder Networking Technologies,LTD, 2, 15, 2, 85]
[E:\程序文件\迅雷\Program\BHOStub.dll]  [Thunder Networking Technologies,LTD, 1, 1, 0, 8]
[E:\程序文件\迅雷\Components\DownAndPlay\DownAndPlay.dll]  [, 1, 0, 0, 3]
[E:\程序文件\迅雷\Program\iTargetAD.dll]  [Thunder Networking Technologies,LTD, 1, 0, 2, 26]
[C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx]  [Adobe Systems, Inc., 9,0,45,0]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
[E:\程序文件\迅雷\Components\InMedia\iEmbedShell.dll]  [　, 1, 0, 0, 17]
[E:\程序文件\迅雷\Program\FloatBar.dll]  [Giganology Inc., 1, 0, 0, 2]
[PID: 2360][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[E:\程序文件\迅雷\ComDlls\TDAtOnce_Now.dll]  [Thunder Networking Technologies,LTD, 1.0.0.4]
[E:\程序文件\迅雷\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 1, 4]
[E:\程序文件\迅雷\Components\ResWorker\DsBho_00.dll]  [, 1, 0, 0, 2]
[E:\程序文件\迅雷\Components\ResWorker\DataProcessor_00.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 4]
[C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll]  [金泰丰(广州)科技有限公司, 2, 3, 0, 0]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll]  [Kaspersky Lab, 1.0.6.299]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll]  [Kaspersky Lab, 6.0.0.299]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll]  [Kaspersky Lab, 6.0.0.299]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll]  [Kaspersky Lab, 6.0.0.299]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl]  [Kaspersky Lab, 6.0.0.304]
[c:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl]  [Kaspersky Lab, 6.0.0.299]
[c:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl]  [Kaspersky Lab, 6.0.0.299]
[c:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl]  [Kaspersky Lab, 6.0.0.299]
[c:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl]  [Kaspersky Lab, 6.0.0.299]
[c:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl]  [Kaspersky Lab, 6.0.0.299]
[E:\程序文件\word\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
[C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx]  [Adobe Systems, Inc., 9,0,45,0]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[E:\程序文件\迅雷\ComDlls\ThunderAgent_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 3, 20]
[PID: 1984][E:\迅雷\sreng2\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]

==================================
文件关联
.TXT  Error. [C:\WINDOWS\notepad.exe %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. [  错误： LoadLibraryExA (危险等级: 一般,  被下面模块所"%1" /S]
.CHM  Error. ["hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1    localhost

==================================
API HOOK
RVA  错误： LoadLibraryA (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xB2A02B25)
RVA  错误： LoadLibraryExA (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xB2A02D67)
RVA  错误： LoadLibraryExW (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xB2A02F0B)
RVA  错误： LoadLibraryW (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xB2A02C49)
RVA  错误： GetProcAddress (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0xB2A02E8F)

==================================
隐藏进程
N/A

==================================

关闭系统还原：在「我的电脑」上按右键，选择「属性」
进入「系统还原」，勾选「在所有驱动器上关闭系统还原」，按下「应用」，出现提示对话框时按「是」（病毒清理后请自己决定是否打开系统还原）

清理临时文件夹:点此下载ATF Cleaner
钅� －－服务－－ Win32服务应用程序之如下项删除：
[Windows Gateway / Indtry] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\fkjwl.dll>
[Local Connection Manager / BUZOR] <C:\WINDOWS\SYSTEM32\RUNDLLFOROUR.EXE C:\WINDOWS\SYSTEM32\WBEM\URTPN.DLL,Export 1087>

启动项目－－服务－－驱动程序之如下项删除：
[acpidisk / acpidisk] <\??\C:\WINDOWS\system32\drivers\acpidisk.sys>
[rwqg / rwqgw] <\SystemRoot\System32\DRIVERS\rwqgw.sys>

系统恢复－－文件关联－－修复
.TXT  Error. [C:\WINDOWS\notepad.exe %1]
.CHM  Error. ["hh.exe" %1]
.INI  Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]

最后下载windows清理助手清理恶意软件以及自身杀软升级至最新，进行全盘杀毒
http://www.arswp.com/download/arswp/arswp.rar

标签：
证券/理财股票收盘点评空方多方下跌 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1
相关文章: