昨天刚上班，一位同事说他的电脑反应很慢，让偶去检修。
打开任务管理器，看到IEXPLORE.New之类的，肯定是中标了。
下载pe_xscan扫描了log，重启电脑到带网络连接的安全模式下，使用在线网页分析，发现可疑项：
pe_xscan 07-03-17 by Purple Endurer
2007-4-4 8:26:38
Windows XP Service Pack 2(5.1.2600)
管理员用户组
[System Process] * 0 C:/Program Files/Internet Explorer/PLUGINS/SystemKb.sys | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/IEXPLORE.Dat | 2007-4-4 8:8:10 C:/Program Files/Internet Explorer/IEXPLORE.Sys | 2007-4-4 8:8:6 C:/WINDOWS/system32/winlogon.exe * 548 | 2004-8-17 12:0:0 | Microsoft(R) Windows(R) Operating System | 5.1.2600.2180 | Windows NT Logon Application | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | winlogon | WINLOGON.EXE C:/WINDOWS/system32/C01B1EF6.DLL | 2007-4-4 8:8:8 | Microsoft(R) Windows(R) Operating System| ?| ? | (C) Microsoft Corporation. All rights reserved.| ? | Microsoft Corporation| ?| ?| ? C:/WINDOWS/system32/FF7A0ADE.DLL | 2007-4-4 8:8:8 | Microsoft(R) Windows(R) Operating System| ?| ? | (C) Microsoft Corporation. All rights reserved.| ? | Microsoft Corporation| ?| ?| ? C:/Program Files/Rising/Rav/CCenter.exe * 872 | 2006-8-16 17:12:22 | Rising Antivirus Software | 18, 0, 0, 3 | CCenter | Copyright Rising 2002 | 18, 0, 0, 3 | Beijing Rising Technology Co., Ltd. | | Beijing Rising Technology Co., Ltd. | CCenter.exe C:/Program Files/Internet Explorer/IEXPLORE.Dat | 2007-4-4 8:8:10 C:/Program Files/Internet Explorer/IEXPLORE.win | 2007-4-4 8:8:8 C:/Program Files/Internet Explorer/IEXPLORE.Sys | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/PLUGINS/SystemKb.sys | 2007-4-4 8:8:6 C:/Program Files/Common Files/Microsoft Shared/MSINFO/NewInfo.rxk | 2007-4-4 8:8:6 C:/WINDOWS/System32/svchost.exe * 888 | 2004-8-17 12:0:0 | Microsoft? Windows? Operating System | 5.1.2600.2180 | Generic Host Process for Win32 Services | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | svchost.exe | svchost.exe C:/Program Files/Internet Explorer/IEXPLORE.Dat | 2007-4-4 8:8:10 C:/Program Files/Internet Explorer/IEXPLORE.win | 2007-4-4 8:8:8 C:/Program Files/Internet Explorer/IEXPLORE.Sys | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/PLUGINS/SystemKb.sys | 2007-4-4 8:8:6 C:/Program Files/Common Files/Microsoft Shared/MSINFO/NewInfo.rxk | 2007-4-4 8:8:6 Explorer.EXE * 1312 C:/program files/internet explorer/iexplore.exe * 1612 | 2004-8-17 20:0:0 | Microsoft(R) Windows(R) Operating System | 6.00.2900.2180 | Internet Explorer | (C) Microsoft Corporation. All rights reserved. | 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | iexplore | IEXPLORE.EXE C:/Program Files/Internet Explorer/PLUGINS/SystemKb.sys | 2007-4-4 8:8:6 C:/WINDOWS/system32/mcdsrv32_070402.dll | 2007-4-4 8:8:0 C:/WINDOWS/system32/AlxTB1.dll | 2006-10-31 8:7:44 | AlxTB Module | 1, 0, 0, 1 | AlxTB Module | Copyright 2000-2003 | 7, 2, 0, 2 | Alexa Internet| ? | AlxTB | AlxTB.DLL C:/Program Files/Internet Explorer/IEXPLORE.Dat | 2007-4-4 8:8:10 C:/Program Files/Internet Explorer/IEXPLORE.Sys | 2007-4-4 8:8:6 C:/Program Files/Common Files/Microsoft Shared/MSINFO/NewInfo.rxk | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/IEXPLORE.win | 2007-4-4 8:8:8 C:/CONFIG.EXE * 1908 | 2007-3-30 8:29:24 C:/Program Files/Common Files/Microsoft Shared/MSINFO/system.2dt * 2000 | 2007-3-29 16:19:30 C:/Program Files/Common Files/Microsoft Shared/MSINFO/NewInfo.rxk | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/IEXPLORE.Dat | 2007-4-4 8:8:10 C:/Program Files/Internet Explorer/IEXPLORE.win | 2007-4-4 8:8:8 C:/Program Files/Internet Explorer/IEXPLORE.Sys | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/PLUGINS/SystemKb.sys | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/PLUGINS/system2.jmp * 2024 | 2007-3-29 16:24:50 C:/Program Files/Internet Explorer/PLUGINS/SystemKb.sys | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/IEXPLORE.Dat | 2007-4-4 8:8:10 C:/Program Files/Internet Explorer/IEXPLORE.win | 2007-4-4 8:8:8 C:/Program Files/Internet Explorer/IEXPLORE.Sys | 2007-4-4 8:8:6 C:/Program Files/Common Files/Microsoft Shared/MSINFO/NewInfo.rxk | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/IEXPLORE.ime * 2044 | 2007-3-30 11:52:22 C:/Program Files/Internet Explorer/IEXPLORE.Sys | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/IEXPLORE.Dat | 2007-4-4 8:8:10 C:/Program Files/Internet Explorer/IEXPLORE.win | 2007-4-4 8:8:8 C:/Program Files/Internet Explorer/PLUGINS/SystemKb.sys | 2007-4-4 8:8:6 C:/Program Files/Common Files/Microsoft Shared/MSINFO/NewInfo.rxk | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/IEXPLORE.New * 192 | 2007-3-30 14:50:18 C:/Program Files/Internet Explorer/IEXPLORE.win | 2007-4-4 8:8:8 C:/Program Files/Internet Explorer/IEXPLORE.Dat | 2007-4-4 8:8:10 C:/Program Files/Internet Explorer/IEXPLORE.Sys | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/PLUGINS/SystemKb.sys | 2007-4-4 8:8:6 C:/Program Files/Common Files/Microsoft Shared/MSINFO/NewInfo.rxk | 2007-4-4 8:8:6 C:/WINDOWS/system32/B4C050A.exe * 220 | 2007-4-4 8:8:8 C:/Program Files/Internet Explorer/PLUGINS/SystemKb.sys | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/IEXPLORE.Dat | 2007-4-4 8:8:10 C:/Program Files/Internet Explorer/IEXPLORE.Sys | 2007-4-4 8:8:6 C:/Program Files/Common Files/Microsoft Shared/MSINFO/NewInfo.rxk | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/IEXPLORE.win | 2007-4-4 8:8:8 C:/WINDOWS/system32/D97A73FB.exe * 224 | 2007-4-4 8:8:8 C:/Program Files/Internet Explorer/PLUGINS/SystemKb.sys | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/IEXPLORE.Dat | 2007-4-4 8:8:10 C:/Program Files/Internet Explorer/IEXPLORE.Sys | 2007-4-4 8:8:6 C:/Program Files/Common Files/Microsoft Shared/MSINFO/NewInfo.rxk | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/IEXPLORE.win | 2007-4-4 8:8:8 C:/Program Files/Internet Explorer/IEXPLORE.jmp * 248 | 2007-3-30 14:50:18 C:/Program Files/Internet Explorer/IEXPLORE.Dat | 2007-4-4 8:8:10 C:/Program Files/Internet Explorer/IEXPLORE.win | 2007-4-4 8:8:8 C:/Program Files/Internet Explorer/IEXPLORE.Sys | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/PLUGINS/SystemKb.sys | 2007-4-4 8:8:6 C:/Program Files/Common Files/Microsoft Shared/MSINFO/NewInfo.rxk | 2007-4-4 8:8:6 C:/WINDOWS/SOUNDMAN.EXE * 420 | 2006-3-2 16:22:4 | Realtek Sound Manager | 5, 1, 0, 52 | Realtek Sound Manager | Copyright (c) 2001-2004 Realtek Semiconductor Corp. | 5, 1, 0, 52 | Realtek Semiconductor Corp. | | ALSMTray | ALSMTray.exe C:/Program Files/Internet Explorer/PLUGINS/SystemKb.sys | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/IEXPLORE.Dat | 2007-4-4 8:8:10 C:/Program Files/Internet Explorer/IEXPLORE.Sys | 2007-4-4 8:8:6 C:/Program Files/Rising/Rav/RavTask.exe * 488 | 2006-8-16 17:12:22 | Rising Antivirus Software | 18, 0, 0, 22 | RavTimer | Copyright (c) 1998-2006 Rising Corp. | 18, 0, 0, 22 | Beijing Rising Technology Co., Ltd. | | Beijing Rising Technology Co., Ltd. | RavTimer.exe C:/Program Files/Internet Explorer/PLUGINS/SystemKb.sys | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/IEXPLORE.Dat | 2007-4-4 8:8:10 C:/Program Files/Internet Explorer/IEXPLORE.Sys | 2007-4-4 8:8:6 C:/Program Files/Common Files/Microsoft Shared/MSINFO/NewInfo.rxk | 2007-4-4 8:8:6 C:/Program Files/Tencent/QQLive/MiniQQLive.exe * 520 | 2007-3-1 15:18:44 | RTX | 3,5,200,2281 | QQLive | | 3,5,200,2281 | Tencent | | MiniQQLive | C:/Program Files/Internet Explorer/PLUGINS/SystemKb.sys | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/IEXPLORE.Dat | 2007-4-4 8:8:10 C:/Program Files/Internet Explorer/IEXPLORE.Sys | 2007-4-4 8:8:6 C:/Program Files/Common Files/Microsoft Shared/MSINFO/NewInfo.rxk | 2007-4-4 8:8:6 C:/Program Files/Common Files/Real/Update_OB/realsched.exe * 744 | 2006-12-9 18:9:44 | RealPlayer (32-bit) | 0.1.0.3512 | RealNetworks Scheduler | Copyright ? RealNetworks, Inc. 1995-2004 | 0.1.0.3512 | RealNetworks, Inc. | RealAudio(tm) is a trademark of RealNetworks, Inc. | schedapp | realsched.exe C:/Program Files/Internet Explorer/PLUGINS/SystemKb.sys | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/IEXPLORE.Dat | 2007-4-4 8:8:10 C:/Program Files/Internet Explorer/IEXPLORE.Sys | 2007-4-4 8:8:6 c:/windows/system32/webpnt.exe * 1072 | 2007-4-2 14:45:8 | Microsoft Web Printer | 5.2600.2180 | Microsoft Web Printer | C) Microsoft Corporation. All rights reserved. | 5.2600.2180 | Microsoft Corporation| ? | WEBPNT | WEBPNT.EXE c:/windows/system32/webpnt.exe | 2007-4-2 14:45:8 | Microsoft Web Printer | 5.2600.2180 | Microsoft Web Printer | C) Microsoft Corporation. All rights reserved. | 5.2600.2180 | Microsoft Corporation| ? | WEBPNT | WEBPNT.EXE C:/Program Files/Internet Explorer/IEXPLORE.Dat | 2007-4-4 8:8:10 C:/Program Files/Internet Explorer/IEXPLORE.win | 2007-4-4 8:8:8 C:/Program Files/Internet Explorer/IEXPLORE.Sys | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/PLUGINS/SystemKb.sys | 2007-4-4 8:8:6 C:/Program Files/Common Files/Microsoft Shared/MSINFO/NewInfo.rxk | 2007-4-4 8:8:6 C:/WINDOWS/system32/ctfmon.exe * 1164 | 2004-8-17 12:0:0 | Microsoft? Windows? Operating System | 5.1.2600.2180 | CTF Loader | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | CTFMON | CTFMON.EXE C:/Program Files/Internet Explorer/PLUGINS/SystemKb.sys | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/IEXPLORE.Dat | 2007-4-4 8:8:10 C:/Program Files/Internet Explorer/IEXPLORE.Sys | 2007-4-4 8:8:6 C:/Program Files/Common Files/Microsoft Shared/MSINFO/NewInfo.rxk | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/IEXPLORE.win | 2007-4-4 8:8:8 C:/WINDOWS/system32/conime.exe * 1216 | 2004-8-17 12:0:0 | Microsoft? Windows? Operating System | 5.1.2600.2180 | Console IME | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | Console | CONIME.EXE C:/Program Files/Internet Explorer/PLUGINS/SystemKb.sys | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/IEXPLORE.Dat | 2007-4-4 8:8:10 C:/Program Files/Internet Explorer/IEXPLORE.Sys | 2007-4-4 8:8:6 C:/program files/Internet Explorer/IEXPLORE.EXE * 2236 | 2004-8-17 20:0:0 | Microsoft(R) Windows(R) Operating System | 6.00.2900.2180 | Internet Explorer | (C) Microsoft Corporation. All rights reserved. | 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | iexplore | IEXPLORE.EXE C:/Program Files/Internet Explorer/PLUGINS/SystemKb.sys | 2007-4-4 8:8:6 C:/WINDOWS/system32/AlxTB1.dll | 2006-10-31 8:7:44 | AlxTB Module | 1, 0, 0, 1 | AlxTB Module | Copyright 2000-2003 | 7, 2, 0, 2 | Alexa Internet| ? | AlxTB | AlxTB.DLL C:/Program Files/Internet Explorer/IEXPLORE.Dat | 2007-4-4 8:8:10 C:/Program Files/Internet Explorer/IEXPLORE.Sys | 2007-4-4 8:8:6 C:/Program Files/Common Files/Microsoft Shared/MSINFO/NewInfo.rxk | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/IEXPLORE.win | 2007-4-4 8:8:8 C:/Program Files/Common Files/Microsoft Shared/MSINFO/system.2dt * 2840 | 2007-3-29 16:19:30 C:/Program Files/Common Files/Microsoft Shared/MSINFO/system.2dt | 2007-3-29 16:19:30 C:/Program Files/Common Files/Microsoft Shared/MSINFO/NewInfo.rxk | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/PLUGINS/system2.jmp * 2860 | 2007-3-29 16:24:50 C:/Program Files/Internet Explorer/PLUGINS/system2.jmp | 2007-3-29 16:24:50 C:/Program Files/Internet Explorer/PLUGINS/SystemKb.sys | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/IEXPLORE.ime * 2880 | 2007-3-30 11:52:22 C:/Program Files/Internet Explorer/IEXPLORE.ime | 2007-3-30 11:52:22 C:/Program Files/Internet Explorer/IEXPLORE.Sys | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/IEXPLORE.New * 2904 | 2007-3-30 14:50:18 C:/Program Files/Internet Explorer/IEXPLORE.New | 2007-3-30 14:50:18 C:/Program Files/Internet Explorer/IEXPLORE.win | 2007-4-4 8:8:8 C:/Program Files/Internet Explorer/IEXPLORE.jmp * 2924 | 2007-3-30 14:50:18 C:/Program Files/Internet Explorer/IEXPLORE.jmp | 2007-3-30 14:50:18 C:/Program Files/Internet Explorer/IEXPLORE.Dat | 2007-4-4 8:8:10 C:/WINDOWS/system32/dllcache/ykwcs.exe * 2824 | 2007-4-4 8:9:48 C:/WINDOWS/system32/svchost.exe * 2932 | 2004-8-17 12:0:0 | Microsoft? Windows? Operating System | 5.1.2600.2180 | Generic Host Process for Win32 Services | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | svchost.exe | svchost.exe C:/Program Files/Internet Explorer/IEXPLORE.Dat | 2007-4-4 8:8:10 C:/Program Files/Internet Explorer/IEXPLORE.win | 2007-4-4 8:8:8 C:/Program Files/Internet Explorer/IEXPLORE.Sys | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/PLUGINS/SystemKb.sys | 2007-4-4 8:8:6 C:/Program Files/Common Files/Microsoft Shared/MSINFO/NewInfo.rxk | 2007-4-4 8:8:6 C:/Program Files/Internet Explorer/IEXPLORE.EXE * 652 | 2004-8-17 20:0:0 | Microsoft(R) Windows(R) Operating System | 6.00.2900.2180 | Internet Explorer | (C) Microsoft Corporation. All rights reserved. | 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | iexplore | IEXPLORE.EXE C:/WINDOWS/system32/AlxTB1.dll | 2006-10-31 8:7:44 | AlxTB Module | 1, 0, 0, 1 | AlxTB Module | Copyright 2000-2003 | 7, 2, 0, 2 | Alexa Internet| ? | AlxTB | AlxTB.DLL iexplore.exe * 3096 iexplore.exe * 3540 SVCHOSI.exe * 3828 F2 - REG: system.ini: UserInit=C:/WINDOWS/system32/userinit.exe,rundll32.exe C:/WINDOWS/system32/mcdsrv16_070402.dll start O1 - Hosts: 127.0.0.1 locator.metadata.windowsmedia.com O1 - Hosts: 127.0.0.1 onlinestore.smgbb.cn O2 - BHO Advance Helper - {8E25AC4A-B129-451B-BEE2-3B510BB751DA} - C:/WINDOWS/system32/NTDLL32.dll O2 - BHO IE Browser Helper - {D0903A3B-F0EA-434a-9742-98C5335C7946} - C:/WINDOWS/system32/IEHelper.dll O2 - BHO AlxTB BHO Class - {F1FABE79-25FC-46de-8C5A-2C6DB9D64333} - C:/WINDOWS/system32/AlxTB1.dll O4 - HKCR/../Run: [msr1e4er6] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/servicer.exe O4 - HKCR/../Run: [w48jmh4480mz] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/winlog0n.exe O4 - HKCR/../Run: [h4rr1] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/c0nime.exe O4 - HKCR/../Run: [kgs7kj4zt] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/cftmon.exe O4 - HKCR/../Run: [9erjfccm] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/iexpl0re.exe O4 - HKCR/../Run: [sz] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/Servere.exe O4 - HKCR/../Run: [hc1m1h305f7] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/crasos.exe O4 - HKCR/../Run: [zkeczl5mjug1] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/rundl132.exe O4 - HKCR/../Run: [svc] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/byetmr.exe O4 - HKCR/../Run: [System Boot Check] C:/Documents and Settings/Administrator/Local Settings/Temporary Internet Files/Content.IE5/CVQ5OL86/qq[1].exe O4 - HKLM/../Run: [NMGameX_AutoRun] C:/WINDOWS/system32/Rundll32.exe NMGameX.dll,LiveProcess /aa O4 - HKLM/../Run: [cmdbcs] C:/WINDOWS/cmdbcs.exe O4 - HKLM/../Run: [SVCHOSI] C:/Program Files/Internet Explorer/SVCHOSI.exe O4 - HKLM/../Run: [Windows Media Player] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/Windows Media Player.exe O8 - IE右键菜单附加项 : Alexa Web Search - http://client.alexa.com/holiday/script/actions/search.htmO8 - IE右键菜单附加项 : Get Alexa Data - http://client.alexa.com/holiday/script/actions/sitedata.htmO8 - IE右键菜单附加项 : Mail to a Friend... - http://client.alexa.com/holiday/script/actions/mailto.htmO8 - IE右键菜单附加项 : See Related Links - http://client.alexa.com/holiday/script/actions/related.htmO8 - IE右键菜单附加项 : Write a Review... - http://client.alexa.com/holiday/script/actions/review.htm O9 - IE工具栏扩展按钮HKCR：雨林木风 - {06A70D58-8D40-49DD-B46B-DC00AA3ADCA4} - http://www.ylmf.comO9 - IE工具菜单扩展项HKCR： - {06A70D58-8D40-49DD-B46B-DC00AA3ADCA4} - http://www.ylmf.com O20 - AppInit_DLLs: C:/WINDOWS/system32/NTDLL32.dll O23 - 服务: C01B1EF6 (C01B1EF6) - C:/WINDOWS/system32/C01B1EF6.EXE -service | 2007-3-30 15:12:26 | Microsoft(R) Windows(R) Operating System| ?| ? | (C) Microsoft Corporation. All rights reserved.| ? | Microsoft Corporation| ?| ?| ?(自动) O23 - 服务: FF7A0ADE (FF7A0ADE) - C:/WINDOWS/system32/FF7A0ADE.EXE -service | 2007-4-4 8:27:8 | Microsoft(R) Windows(R) Operating System| ?| ? | (C) Microsoft Corporation. All rights reserved.| ? | Microsoft Corporation| ?| ?| ?(自动) O23 - 服务: JRAID () - System32/Drivers/JRAID.SYS | JMicron JR036X RAID Driver | 5.1.2600.1040 | JMicron JR036X RAID Driver | Copyright (C) JMicron Technology Corp. 2005-2006 | 5.1.2600.1040 built by: WinDDK | JMicron Technology Corp.| ? | JRAID.SYS 1.04.04 | JRAID.SYS(引导) O23 - 服务: mv614x () - System32/Drivers/mv614x.sys(引导) O23 - 服务: NPF (Netgroup Packet Filter) - system32/DRIVERS/npf.sys | WinPcap Netgroup Packet Filter Driver | 3, 1, 0, 27 | npf | Copyright ? 2005 CACE Technologies. Copyright ? 2003-2005 NetGroup, Politecnico di Torino. | 3, 1, 0, 27 | CACE Technologies | | NPF + TME | npf.sys(手动) O23 - 服务: TomDemoService (TomDemoService) - C:/CONFIG.EXE | 2007-3-30 8:29:24(自动) O23 - 服务: vmscsi () - System32/Drivers/vmscsi.sys | VMware, Inc. Script1 Application | 1, 2, 0, 0 | VMware SCSI Controller | Copyright ? 1998-2003 VMware, Inc. | 1, 2, 0, 0 | VMware, Inc. | | vmscsi.sys | vmscsi.sys(引导) O23 - 服务: WebPrint (WebPrint) - c:/windows/system32/webprint.exe | 2007-4-2 14:45:8 | Microsoft Web Printer | 5.2600.2180 | Microsoft Web Printer | C) Microsoft Corporation. All rights reserved. | 5.2600.2180 | Microsoft Corporation| ? | WEBPNT | WEBPNT.EXE(自动) O23 - 服务: Windows Firewall (Windows Firewall) - C:/WINDOWS/system32/SVCH0ST.EXE | 2007-3-30 16:18:30(自动) O23 - 服务: wuauserv (Automatic Updates) - C:/WINDOWS/system32/drivers/svchost.exe | 2007-4-4 8:9:48(自动) O24 - [] - {A6011F8F-A7F8-49AA-9ADA-49127D43138F} = C:/Program Files/Common Files/Microsoft Shared/MSINFO/NewInfo.rxk O24 - [] - {754FB7D8-B8FE-4810-B363-A788CD060F1F} = C:/Program Files/Internet Explorer/PLUGINS/SystemKb.sys O24 - [] - {99F1D023-7CEB-4586-80F7-BB1A98DB7602} = C:/Program Files/Internet Explorer/IEXPLORE.Sys O24 - [] - {923509F1-45CB-4EC0-BDE0-1DED35B8FD60} = C:/Program Files/Internet Explorer/IEXPLORE.win O24 - [] - {FEB94F5A-69F3-4645-8C2B-9E71D270AF2E} = C:/Program Files/Internet Explorer/IEXPLORE.Dat 这台电脑中的瑞星还是2006的，已经无法升级了。 有一些项目与 昨天才提醒，今天就有网友点击QQ信息中的网址，中Worm.Viking.pk/Worm.Win32.Viking.jg了 http://endurer.bokee.com/6174316.html http://blog.sina.com.cn/u/49926d910100080bjavascript:void(0) 相似。 到江民网站下载了Viking专杀工具传给网友查杀，果然清除了一些。 再用瑞星在线免费查毒，又查出一堆： 2007-4-4 10:45:7 瑞星杀毒助手 Windows XP Service Pack 2(5.1.2600) 文件名 病毒名 C:/WINDOWS/system32/cmdbcs.dll Trojan.PSW.OnlineGames.aao C:/WINDOWS/system32/C01B1EF6.EXE Trojan.IMMSG.TBMSG.df C:/WINDOWS/system32/C01B1EF6T.EXE Trojan.IMMSG.TBMSG.df C:/WINDOWS/system32/C01B1EF6.DLL Trojan.IMMSG.TBMSG.df C:/WINDOWS/system32/D97A73FB.exe Trojan.DL.Agent.mry C:/WINDOWS/system32/FF7A0ADE.EXE Trojan.IMMSG.TBMSG.dh C:/WINDOWS/system32/FF7A0ADET.EXE Trojan.IMMSG.TBMSG.dh C:/WINDOWS/system32/FF7A0ADE.DLL Trojan.IMMSG.Tbmsg.dg C:/WINDOWS/system32/B4C050A.exe Trojan.IMMSG.TBMSG.dh C:/WINDOWS/system32/kdjs1.exe>>upack0.36 Trojan.Clicker.PopHot.cq C:/WINDOWS/system32/ridiap070402.exe>>upack0.36 Trojan.Clicker.PopHot.cq C:/WINDOWS/system32/scrie070402.scr>>upack0.36 Trojan.Clicker.PopHot.cq C:/WINDOWS/system32/SVCH0ST.EXE Backdoor.Agent.ibv C:/WINDOWS/cmdbcs.exe Trojan.PSW.OnlineGames.aaq C:/Documents and Settings/Administrator/Local Settings/Temp/ck3.exe.exe>>UPX Trojan.PSW.Agent.jqu C:/Documents and Settings/Administrator/Local Settings/Temp/Qqzo0.dll Trojan.PSW.OnlineGames.yo C:/Documents and Settings/Administrator/Local Settings/Temp/LgSy0.dll>>UPX Trojan.PSW.XYOnline.nc C:/Documents and Settings/Administrator/Local Settings/Temp/lg.dll Trojan.PSW.LMir.mhl C:/Documents and Settings/Administrator/Local Settings/Temp/banner.jpg>>UPX Trojan.PSW.QQPass.rtq C:/Documents and Settings/Administrator/Local Settings/Temp/LgSy1.dll>>UPX Trojan.PSW.XYOnline.nc C:/Documents and Settings/Administrator/Local Settings/Temp/Qqzo1.dll Trojan.PSW.OnlineGames.yo C:/Documents and Settings/Administrator/Local Settings/Temp/Rav30.dll>>UPX Trojan.PSW.OnlineGames.yq C:/Documents and Settings/Administrator/Local Settings/Temp/Msxo1.dll>>UPX Trojan.PSW.OnlineGames.yw C:/Documents and Settings/Administrator/Local Settings/Temp/LgSy2.dll>>UPX Trojan.PSW.OnlineGames.yv C:/Documents and Settings/Administrator/Local Settings/Temp/Gjzo1.dll>>UPX Trojan.PSW.OnlineGames.yu C:/Documents and Settings/Administrator/Local Settings/Temp/Rav31.dll>>UPX Trojan.PSW.OnlineGames.yq C:/Documents and Settings/Administrator/Local Settings/Temp/Rav21.dll>>upack0.34 Trojan.PSW.OnlineGames.yx C:/Documents and Settings/Administrator/Local Settings/Temp/Wmzo1.dll>>UPX Trojan.PSW.OnlineGames.yz C:/Documents and Settings/Administrator/Local Settings/Temp/Gjzo0.dll>>UPX Trojan.PSW.OnlineGames.yu C:/Documents and Settings/Administrator/Local Settings/Temp/Msxo0.dll>>UPX Trojan.PSW.OnlineGames.yw C:/Documents and Settings/Administrator/Local Settings/Temp/Rav20.dll>>upack0.34 Trojan.PSW.OnlineGames.yx C:/Documents and Settings/Administrator/Local Settings/Temp/Wmzo0.dll>>UPX Trojan.PSW.OnlineGames.yz C:/Documents and Settings/Administrator/Local Settings/Temp/shua.exe.exe>>UPX Trojan.PSW.QQPass.rvt C:/Program Files/Common Files/Microsoft Shared/MSInfo/NewInfo.rxk Trojan.PSW.QQPass.rug C:/Program Files/Internet Explorer/PLUGINS/system2.jmp Trojan.PSW.QQPass.rtw C:/Program Files/Internet Explorer/PLUGINS/SystemKb.sys Trojan.PSW.QQPass.rtn C:/Program Files/Internet Explorer/IEXPLORE.Sys Trojan.PSW.QQPass.rtq C:/Program Files/Internet Explorer/IEXPLORE.win Trojan.PSW.QQPass.rtp C:/Program Files/Internet Explorer/IEXPLORE.Dat Trojan.PSW.QQPass.rts C:/Program Files/Internet Explorer/IEXPLORE.Tmp Trojan.PSW.Agent.jqu C:/Program Files/Internet Explorer/IEXPLORE.Bak Trojan.PSW.QQPass.rvt C:/CONFIG.EXE>>fsg2.0 Trojan.DL.Delf.yfw D:/mie.com>>upack0.36 Trojan.Clicker.PopHot.cq 到 http://endurer.ys168.com 下载 瑞星杀毒助手来解决，O24那几个删除不了（需要先用IceSword从内存中卸载），偶用了下次启动时删除功能。 再下载 Dr.Web Cure It扫描，又是一堆，其中很多Windows系统文件infected with Trojan.Starter.171，看来江民的Viking专杀还得继续升级。 Dr.Web(R) Scanner for Windows v4.33.2 (4.33.2.10067) Log generated on: 2007-04-04, 10:49:36 [Administrator] c:/documents and settings/localservice/local settings/temporary internet files/content.ie5/6yb6gzi7/qq[1].exe infected with Trojan.DownLoader.17951 - deleted c:/program files/internet explorer/plugins/systemkb.sys infected with Trojan.PWS.Qqpass.510 - will be cured after reboot c:/windows/inf/unregmp2.exe infected with Trojan.Starter.171 - cured c:/windows/system32/alg.exe infected with Trojan.Starter.171 - cured …… c:/windows/system32/vssvc.exe infected with Trojan.Starter.171 - cured c:/windows/system32/wbem/wmiapsrv.exe infected with Trojan.Starter.171 - cured c:/windows/system32/wdfmgr.exe infected with Trojan.Starter.171 - cured C:/Program Files/Common Files/Microsoft Shared/asoee.exe probably infected with DLOADER.Trojan C:/Program Files/Windows Media Player/hwswl.exe probably infected with DLOADER.Trojan C:/Program Files/Internet Explorer/Connection Wizard/aanaa.exe probably infected with DLOADER.Trojan C:/Program Files/Internet Explorer/PLUGINS/SystemKb.sys infected with Trojan.PWS.Qqpass.510 - will be cured after reboot C:/WINDOWS/twunk_32.exe infected with Trojan.Starter.171 - cured …… C:/WINDOWS/Alcrmv.exe infected with Trojan.Starter.171 - cured C:/WINDOWS/system32/sort.exe infected with Trojan.Starter.171 - cured …… C:/WINDOWS/system32/ayhip.exe probably infected with DLOADER.Trojan C:/WINDOWS/system32/kmoau.exe probably infected with DLOADER.Trojan C:/WINDOWS/system32/mcdsrv32_070402.dll probably infected with DLOADER.Trojan C:/WINDOWS/system32/notepad.exe.delete_on_reboot.delete_on_reboot.delete_on_reboot.delete_on_reboot infected with Trojan.Starter.171 - will be cured after reboot C:/WINDOWS/system32/drivers/kekci.exe probably infected with DLOADER.Trojan …… C:/WINDOWS/system32/wbem/mofcomp.exe infected with Trojan.Starter.171 - cured …… C:/WINDOWS/system32/npp/nppagent.exe infected with Trojan.Starter.171 - cured C:/WINDOWS/system32/dllcache/twunk_32.exe infected with Trojan.Starter.171 - cured …… >C:/WINDOWS/system32/dllcache/ykwcs.exe probably infected with DLOADER.Trojan C:/WINDOWS/system32/usmt/migload.exe infected with Trojan.Starter.171 - cured …… >C:/WINDOWS/system32/IME/kumsu.exe probably infected with DLOADER.Trojan C:/WINDOWS/system32/IME/PINTLGNT/IMSCINST.EXE infected with Trojan.Starter.171 - cured C:/WINDOWS/system32/Com/comrepl.exe infected with Trojan.Starter.171 - cured C:/WINDOWS/system32/Restore/srdiag.exe infected with Trojan.Starter.171 - cured C:/WINDOWS/system32/Macromed/Flash/genuinst.exe infected with Trojan.Starter.171 - cured …… C:/WINDOWS/system32/ReinstallBackups/0002/DriverFiles/SOUNDMAN.EXE infected with Trojan.Starter.171 - cured …… C:/WINDOWS/system32/NMGameX/iLobby/ilobby.exe infected with Trojan.Starter.171 - cured >C:/WINDOWS/system/bmxny.exe probably infected with DLOADER.Trojan C:/WINDOWS/msagent/agentsvr.exe infected with Trojan.Starter.171 - cured >C:/WINDOWS/addins/ywwca.exe probably infected with DLOADER.Trojan C:/WINDOWS/Temp/alcupd.exe infected with Trojan.Starter.171 - cured …… C:/WINDOWS/ime/jpwb/unins000.exe infected with Trojan.Starter.171 - cured …… C:/WINDOWS/Installer/{90110804-6000-11D3-8CFE-0150048383C9}/unbndico.exe infected with Trojan.Starter.171 - cured 修复： 最好是格式化硬盘所有分区，重装系统…… 因为修复太麻烦了…… O2 - BHO Advance Helper - {8E25AC4A-B129-451B-BEE2-3B510BB751DA} - C:/WINDOWS/system32/NTDLL32.dll O2 - BHO IE Browser Helper - {D0903A3B-F0EA-434a-9742-98C5335C7946} - C:/WINDOWS/system32/IEHelper.dll O20 - AppInit_DLLs: C:/WINDOWS/system32/NTDLL32.dll 用IceSword才搞定。
