这究竟是中毒了，还是机子其他什么地方出了错啊？(页 1) - 病毒救援区 - 卡饭论坛 _杀毒软件_防火墙_HIPS_反病毒_计算机安全

xindeshenhua 发表于 2008-9-4 11:45

这究竟是中毒了，还是机子其他什么地方出了错啊？

1在执行删除文件或右键查看文件属性的时候，会出现explorer及drwtsn32错误
2单击浏览器书签或链接地址，有数个页面同时弹出，再单击页面标签，原本的选择动作的效果变成了关闭标签页

在杀毒无效的情况下，我决定使用系统还原软件将C盘还原到出厂状态，却发现还原程序无法开启，于是乎重启机子，在进入windows前靠热键将还原强制执行，之后

两个问题都在一定程度上得到缓解
1两种错误提示不再频繁弹出，但系统程序忽然陷入无响应状态的情况依然存在
2单击标签页的选择动作变成了关闭页面的问题解决，而选择一个地址打开多个页面的情况还是偶尔出现

难道没有彻底解决问题的办法吗？现在这里确认一下，这究竟是不是病毒引起的现象啊？

[[i] 本帖最后由 xindeshenhua 于 2008-9-4 11:48 编辑 [/i]]

Amazing 发表于 2008-9-4 12:01

系统无响应的话，可能是某个程序占用资源较大........

标签页的问题.....关闭的时候有没有系统提示，iexplorer.exe错误？

有数个页面同时弹出...这个会不会是什么恶意软件？

如果怀疑是病毒，扫描SREng日志。

xindeshenhua 发表于 2008-9-4 13:42

[quote]如果怀疑是病毒，扫描SREng日志。[/quote]

Amazing 发表于 2008-9-4 14:00

运行SREngLdr--智能扫描--（勾选）检查进程模块的数字签名--扫描--保存报告--得到SREngLOG

打开SREngLOG--全选--复制--粘贴--发表帖子

xindeshenhua 发表于 2008-9-4 14:23

[CODE]

2008-09-04,14:18:15

System Repair Engineer 2.6.12.1018
Smallfrogs ([url]http://www.KZTechs.com[/url])

Windows XP Home Edition Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
<DAEMON Tools Lite><"D:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun>  [(Verified)DAEMON Tools Code Signing Services]
<PhotoBroadcast.exe><; D:\Program Files\Bokee App\PhotoBroadcast_Loader.exe>  [File is missing]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><>  [N/A]
<run><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Publisher]
<PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Publisher]
<PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows Publisher]
<Alert><; C:\Program Files\Starsoftcomm\StarCenter\alert.exe>  []
<StarCenter><; C:\Program Files\Starsoftcomm\StarCenter\StarCenter.exe>  [starsoftcomm]
<AutoUpd><; C:\Program Files\Starsoftcomm\StarCenter\UpdTray.exe>  []
<RTHDCPL><; RTHDCPL.EXE>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<Alcmtr><; ALCMTR.EXE>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<NvCplDaemon><; RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>  [NVIDIA Corporation]
<nwiz><; nwiz.exe /install>  []
<NvMediaCenter><; RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit>  [NVIDIA Corporation]
<IMSCMig><; C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload>  [(Verified)Microsoft Corporation]
<TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [(Verified)"RealNetworks, Inc."]
<egui><"C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice>  [(Verified)"ESET, spol. s r.o."]
<Adobe Reader Speed Launcher><; "D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe">  [(Verified)"Adobe Systems, Incorporated"]
<OutpostMonitor><D:\PROGRA~1\Agnitum\OUTPOS~1\op_mon.exe /tray /noservice>  [(Verified)Agnitum Ltd.]
<OutpostFeedBack><"D:\Program Files\Agnitum\Outpost Firewall Pro\feedback.exe" /dump:os_startup>  [(Verified)Agnitum Ltd.]
<MSConfig><C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><d:\progra~1\agnitum\outpos~1\wl_hook.dll>  [(Verified)Agnitum Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
<Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [File is missing]

==================================
启动文件夹
N/A

==================================
服务
[Agnitum Client Security Service / acssrv][Running/Auto Start]
  <D:\PROGRA~1\Agnitum\OUTPOS~1\acs.exe><Agnitum Ltd.>
[Application Management / AppMgmt][Stopped/Manual Start]
  <C:\WINDOWS\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\appmgmts.dll><N/A>
[Ati HotKey Poller / Ati HotKey Poller][Stopped/Auto Start]
  <C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[ATI Smart / ATI Smart][Stopped/Auto Start]
  <C:\WINDOWS\system32\ati2sgag.exe><>
[Eset HTTP Server / EhttpSrv][Stopped/Manual Start]
  <"C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe"><ESET>
[Eset Service / ekrn][Running/Auto Start]
  <"C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe"><ESET>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
  <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[Sandboxie Service / SbieSvc][Running/Auto Start]
  <C:\Program Files\360safe\Shield\SbieSvc.exe><tzuk>

==================================
驱动程序
[Agnitum firewall driver / afw][Running/Manual Start]
  <system32\DRIVERS\afw.sys><Agnitum Ltd.>
[afwcore / afwcore][Running/Manual Start]
  <system32\drivers\afwcore.sys><Agnitum Ltd.>
[ASWFilt / ASWFilt][Stopped/Manual Start]
  <system32\Filt\ASWFilt.dll><Agnitum Ltd.>
[ati2mtag / ati2mtag][Stopped/Manual Start]
  <system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[CMIUCR.SYS CM220 Card Reader Driver / CMISTOR][Stopped/Manual Start]
  <system32\DRIVERS\cmiucr.SYS><N/A>
[eamon / eamon][Running/Auto Start]
  <system32\DRIVERS\eamon.sys><ESET>
[easdrv / easdrv][Running/System Start]
  <system32\DRIVERS\easdrv.sys><ESET>
[epfwtdir / epfwtdir][Running/System Start]
  <system32\DRIVERS\epfwtdir.sys><N/A>
[Microsoft UAA Bus Driver for High Definition Audio / HDAudBus][Running/Manual Start]
  <system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
[Service for Realtek HD Audio (WDM) / IntcAzAudAddService][Running/Manual Start]
  <system32\drivers\RtkHDAud.sys><Realtek Semiconductor Corp.>
[nv / nv][Running/Manual Start]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[SandBox / SandBox][Running/System Start]
  <system32\DRIVERS\SandBox.sys><Agnitum Ltd.>
[SbieDrv / SbieDrv][Running/Manual Start]
  <\??\C:\Program Files\360safe\Shield\SbieDrv.sys><tzuk>
[SCBACK / SCBACK][Stopped/Boot Start]
  <\SystemRoot\System32\drivers\SCBACK.SYS><StarSoftComm>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
[sptd / sptd][Running/Boot Start]
  <\SystemRoot\System32\Drivers\sptd.sys><N/A>
[SSCFLTXP / SSCFLTXP][Running/Boot Start]
  <\SystemRoot\System32\drivers\SSCFLTXP.SYS><Windows (R) 2000 DDK provider>

==================================
浏览器加载项
[ThunderAtOnce Class]
  {01443AEC-0FD1-40fd-9C87-E93D1494C233} <E:\Thunder.v5.7.1.338.NoAD-Ayu\Thunder\ComDlls\TDAtOnce_Now.dll, (Signed) Thunder Networking Technologies,LTD>
[Thunder Browser Helper]
  {2F364305-AA45-47B5-9F9D-39A8B94E7EF7} <E:\Thunder.v5.7.1.338.NoAD-Ayu\Thunder\ComDlls\xunleiBHO_Now.dll, (Signed) Thunder Networking Technologies,LTD>
[IeCatch5 Class]
  {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <D:\FLASHGET\jccatch.dll, FlashGet>
[Quick Tune]
  {44627E97-789B-40d4-B5C2-58BD171129A1} <D:\Program Files\Agnitum\Outpost Firewall Pro\ie_bar.dll, (Signed) Agnitum Ltd.>
[信息检索(&R)]
  {92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, (Signed) Microsoft Corporation>
[FlashGet]
  {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <D:\FLASHGET\flashget.exe, FlashGet.com>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, (Signed) Microsoft Corporation>
[FlashGet Bar]
  {E0E899AB-F487-11D5-8D29-0050BA6940E3} <D:\FLASHGET\fgiebar.dll, Amaze Soft>
[AxSubmitControl Class]
  {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} <C:\WINDOWS\DOWNLO~1\SUBMIT~1.DLL, >
[ThunderAtOnce Class]
  {01443AEC-0FD1-40FD-9C87-E93D1494C233} <E:\Thunder.v5.7.1.338.NoAD-Ayu\Thunder\ComDlls\TDAtOnce_Now.dll, (Signed) Thunder Networking Technologies,LTD>
[Thunder Browser Helper]
  {06849E9E-C8D7-4D59-B87D-784B7D6BE0B3} <E:\Thunder.v5.7.1.338.NoAD-Ayu\Thunder\ComDlls\xunleiBHO_Now.dll, (Signed) Thunder Networking Technologies,LTD>
[]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <, >
[ThunderServer.WebThunder]
  {1DE5794D-B609-4A3E-9E40-22594D5BEAAC} <E:\Thunder.v5.7.1.338.NoAD-Ayu\Thunder\ComDlls\Faker.dll, >
[Thunder Browser Helper]
  {2F364305-AA45-47B5-9F9D-39A8B94E7EF7} <E:\Thunder.v5.7.1.338.NoAD-Ayu\Thunder\ComDlls\xunleiBHO_Now.dll, (Signed) Thunder Networking Technologies,LTD>
[IeCatch5 Class]
  {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <D:\FLASHGET\jccatch.dll, FlashGet>
[]
  {44627E97-789B-40D4-B5C2-58BD171129A1} <, >
[Thunder Agent Class]
  {485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <E:\Thunder.v5.7.1.338.NoAD-Ayu\Thunder\ComDlls\ThunderAgent_Now.dll, Thunder Networking Technologies,LTD>
[JetCar.Netscape]
  {69C7BEA7-0A70-4291-81ED-405D19AEE270} <E:\Thunder.v5.7.1.338.NoAD-Ayu\Thunder\ComDlls\Faker.dll, >
[]
  {80BF4637-D65B-43F3-BB60-C5DD3D5FB7B9} <, >
[360SafeLive]
  {87515F61-A66C-4319-A0E0-D416CB8059E3} <D:\Program Files\360safe\live.dll, (Signed) 360.cn>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <E:\Thunder.v5.7.1.338.NoAD-Ayu\Thunder\ComDlls\xunleiBHO_Now.dll, (Signed) Thunder Networking Technologies,LTD>
[]
  {92780B25-18CC-41C8-B9BE-3C9C571A8263} <, >
[]
  {B5A34A93-D538-43A7-8371-864CB6148D12} <, >
[]
  {D6E814A0-E0C5-11D4-8D29-0050BA6940E3} <, >
[QQIEHelper.QQRightClick]
  {E654770F-10E4-47BC-A309-4CAD96A096E6} <E:\Thunder.v5.7.1.338.NoAD-Ayu\Thunder\ComDlls\Faker.dll, >
[]
  {FB5F1910-F110-11D2-BB9E-00C04F795683} <, >
[&U使用纳米机器人下载并收藏]
  <D:\Program Files\NamiRobot\Data\du.html, N/A>
[使用网际快车下载]
  <D:\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
  <D:\FlashGet\jc_all.htm, N/A>
[使用迅雷下载]
  <E:\Thunder.v5.7.1.338.NoAD-Ayu\Thunder\Program\geturl.htm, N/A>
[使用迅雷下载全部链接]
  <E:\Thunder.v5.7.1.338.NoAD-Ayu\Thunder\Program\getallurl.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
  <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>

==================================

xindeshenhua 发表于 2008-9-4 14:24

正在运行的进程
[PID: 680 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 732 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 756 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[d:\progra~1\agnitum\outpos~1\wl_hook.dll]  [Agnitum Ltd., 6.5.2358.9115]
[C:\WINDOWS\system32\Ati2evxx.dll]  [ATI Technologies Inc., 6.14.10.4119]
[C:\WINDOWS\system32\SOGOUPY.IME]  [Sogou.com Inc., 3.5.0.0]
[PID: 800 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[d:\progra~1\agnitum\outpos~1\wl_hook.dll]  [Agnitum Ltd., 6.5.2358.9115]
[PID: 812 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 992 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1064 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1160 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1236 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1376 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1704 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[d:\progra~1\agnitum\outpos~1\wl_hook.dll]  [Agnitum Ltd., 6.5.2358.9115]
[C:\WINDOWS\system32\ZLMhp1.DLL]  [Zenographics, 5, 51, 1203, 0]
[C:\WINDOWS\system32\ZLM.dll]  [Zenographics, Inc., 5, 50, 1416, 0]
[C:\WINDOWS\system32\ZPJL.dll]  [Zenographics, Inc., 1, 0, 1410, 1]
[C:\WINDOWS\system32\ZSPOOL.dll]  [Zenographics, Inc., 5, 51, 709, 0]
[C:\WINDOWS\system32\mdimon.dll]  [Microsoft Corporation, 11.3.1897.0]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\IMFPrint.DLL]  [Zenographics, Inc., 5, 54, 330, 0]
[C:\WINDOWS\system32\Imf32.dll]  [Zenographics, Inc., 5, 51, 405, 0]
[C:\WINDOWS\system32\ZTAG32.dll]  [Zenographics, Inc., 5, 50, 1725, 0]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll]  [Microsoft Corporation, 11.3.1897.0]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\ZPPPCL.DLL]  [Zenographics, Inc., 5, 51, 710, 0]
[C:\WINDOWS\system32\ZPP.dll]  [Zenographics, Inc., 5, 51, 709, 0]
[C:\WINDOWS\system32\ZGDI32.dll]  [Zenographics, Inc., 5, 51, 628, 0]
[PID: 1948 / xindeshenhua][C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe]  [ESET, 3.0.621 ]
[C:\WINDOWS\system32\SOGOUPY.IME]  [Sogou.com Inc., 3.5.0.0]
[E:\Program Files\SogouInput\Plugin\SgImeWord.dll]  [Sogou.com Inc., 3.5.0.0]
[C:\Program Files\ESET\ESET NOD32 Antivirus\eguiScan.dll]  [ESET, 3.0.621 ]
[C:\Program Files\ESET\ESET NOD32 Antivirus\eguiAmon.dll]  [ESET, 3.0.621 ]
[C:\Program Files\ESET\ESET NOD32 Antivirus\eguiEmon.dll]  [ESET, 3.0.621 ]
[C:\Program Files\ESET\ESET NOD32 Antivirus\eguiEpfw.dll]  [ESET, 3.0.621 ]
[C:\Program Files\ESET\ESET NOD32 Antivirus\eguiUpdate.dll]  [ESET, 3.0.621 ]
[C:\Program Files\ESET\ESET NOD32 Antivirus\eguiMailPlugins.dll]  [ESET, 3.0.621 ]
[PID: 1980 / xindeshenhua][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[d:\progra~1\agnitum\outpos~1\wl_hook.dll]  [Agnitum Ltd., 6.5.2358.9115]
[C:\WINDOWS\system32\SOGOUPY.IME]  [Sogou.com Inc., 3.5.0.0]
[E:\Program Files\SogouInput\Plugin\SgImeWord.dll]  [Sogou.com Inc., 3.5.0.0]
[PID: 1988 / xindeshenhua][D:\Program Files\DAEMON Tools Lite\daemon.exe]  [DT Soft Ltd, 4.30.1.0]
[d:\progra~1\agnitum\outpos~1\wl_hook.dll]  [Agnitum Ltd., 6.5.2358.9115]
[C:\WINDOWS\system32\SOGOUPY.IME]  [Sogou.com Inc., 3.5.0.0]
[E:\Program Files\SogouInput\Plugin\SgImeWord.dll]  [Sogou.com Inc., 3.5.0.0]
[D:\Program Files\DAEMON Tools Lite\DaemonPlugin.dll]  [DT Soft Ltd, 4.12.0.0]
[D:\Program Files\DAEMON Tools Lite\daemon.dll]  [DT Soft Ltd., 4.30.0.0]
[D:\Program Files\DAEMON Tools Lite\imgengine.dll]  [DT Soft Ltd., 1.17.0.0]
[D:\Program Files\DAEMON Tools Lite\Lang\CHS.dll]  [N/A, ]
[D:\Program Files\DAEMON Tools Lite\Lang\ENU.dll]  [N/A, ]
[D:\Program Files\DAEMON Tools Lite\Plugins\ISOmaker.dll]  [DT Soft Ltd, 1.0.0.0]
[PID: 252 / SYSTEM][C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe]  [ESET, 3.0.621 ]
[C:\Program Files\ESET\ESET NOD32 Antivirus\ekrnScan.dll]  [ESET, 3.0.621 ]
[C:\Program Files\ESET\ESET NOD32 Antivirus\ekrnScanLang.dll]  [N/A, ]
[C:\Program Files\ESET\ESET NOD32 Antivirus\ekrnAmon.dll]  [ESET, 3.0.621 ]
[C:\Program Files\ESET\ESET NOD32 Antivirus\ekrnEmon.dll]  [ESET, 3.0.621 ]
[C:\Program Files\ESET\ESET NOD32 Antivirus\ekrnEpfw.dll]  [ESET, 3.0.621 ]
[C:\Program Files\ESET\ESET NOD32 Antivirus\ekrnUpdate.dll]  [ESET, 3.0.621 ]
[C:\Program Files\ESET\ESET NOD32 Antivirus\updater.dll]  [ESET, 3.0.621 ]
[C:\Program Files\ESET\ESET NOD32 Antivirus\ekrnMailPlugins.dll]  [ESET, 3.0.621 ]
[C:\WINDOWS\system32\SOGOUPY.IME]  [Sogou.com Inc., 3.5.0.0]
[PID: 348 / SYSTEM][C:\WINDOWS\system32\nvsvc32.exe]  [NVIDIA Corporation, 6.14.10.8466]
[d:\progra~1\agnitum\outpos~1\wl_hook.dll]  [Agnitum Ltd., 6.5.2358.9115]
[C:\WINDOWS\system32\SOGOUPY.IME]  [Sogou.com Inc., 3.5.0.0]
[PID: 396 / SYSTEM][C:\Program Files\360safe\Shield\SbieSvc.exe]  [tzuk, 3.26.22]
[C:\Program Files\360safe\Shield\SbieDll.dll]  [tzuk, 3.26.22]
[d:\progra~1\agnitum\outpos~1\wl_hook.dll]  [Agnitum Ltd., 6.5.2358.9115]
[PID: 508 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2284 / xindeshenhua][C:\WINDOWS\system32\drwtsn32.exe]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[d:\progra~1\agnitum\outpos~1\wl_hook.dll]  [Agnitum Ltd., 6.5.2358.9115]
[PID: 2932 / xindeshenhua][C:\WINDOWS\system32\drwtsn32.exe]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[d:\progra~1\agnitum\outpos~1\wl_hook.dll]  [Agnitum Ltd., 6.5.2358.9115]
[PID: 2992 / xindeshenhua][C:\WINDOWS\explorer.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[d:\progra~1\agnitum\outpos~1\wl_hook.dll]  [Agnitum Ltd., 6.5.2358.9115]
[C:\WINDOWS\system32\SOGOUPY.IME]  [Sogou.com Inc., 3.5.0.0]
[E:\Program Files\SogouInput\Plugin\SgImeWord.dll]  [Sogou.com Inc., 3.5.0.0]
[D:\FLASHGET\jccatch.dll]  [FlashGet, 1, 1, 5, 0]
[C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.CHS]  [Adobe Systems, Inc., 8.0.0.0]
[C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll]  [Adobe Systems, Inc., 8.1.0.0]
[C:\WINDOWS\system32\nvcpl.dll]  [NVIDIA Corporation, 6.14.10.8466]
[C:\WINDOWS\system32\NVRSZHC.DLL]  [NVIDIA Corporation, 6.14.10.8466]
[C:\WINDOWS\system32\nvshell.dll]  [, ]
[PID: 3676 / xindeshenhua][E:\Program Files\Mozilla Firefox\firefox.exe]  [Mozilla Corporation, 1.9]
[E:\Program Files\Mozilla Firefox\xul.dll]  [Mozilla Foundation, 1.9]
[E:\Program Files\Mozilla Firefox\sqlite3.dll]  [sqlite.org, 3.5.4.1]
[E:\Program Files\Mozilla Firefox\MOZCRT19.dll]  [Mozilla Foundation, 8.00.0000]
[E:\Program Files\Mozilla Firefox\js3250.dll]  [Netscape Communications Corporation, 4.0]
[E:\Program Files\Mozilla Firefox\nspr4.dll]  [Mozilla Foundation, 4.7.1]
[E:\Program Files\Mozilla Firefox\smime3.dll]  [Mozilla Foundation, 3.12.0.3 Basic ECC]
[E:\Program Files\Mozilla Firefox\nss3.dll]  [Mozilla Foundation, 3.12.0.3 Basic ECC]
[E:\Program Files\Mozilla Firefox\nssutil3.dll]  [Mozilla Foundation, 3.12.0.3 Basic ECC]
[E:\Program Files\Mozilla Firefox\plc4.dll]  [Mozilla Foundation, 4.7.1]
[E:\Program Files\Mozilla Firefox\plds4.dll]  [Mozilla Foundation, 4.7.1]
[E:\Program Files\Mozilla Firefox\ssl3.dll]  [Mozilla Foundation, 3.12.0.3 Basic ECC]
[E:\Program Files\Mozilla Firefox\xpcom.dll]  [Mozilla Foundation, 1.9]
[d:\progra~1\agnitum\outpos~1\wl_hook.dll]  [Agnitum Ltd., 6.5.2358.9115]
[C:\WINDOWS\system32\SOGOUPY.IME]  [Sogou.com Inc., 3.5.0.0]
[E:\Program Files\SogouInput\Plugin\SgImeWord.dll]  [Sogou.com Inc., 3.5.0.0]
[E:\Program Files\Mozilla Firefox\components\browserdirprovider.dll]  [Mozilla Foundation, 1.9]
[E:\Program Files\Mozilla Firefox\softokn3.dll]  [Mozilla Foundation, 3.12.0.3 Basic ECC]
[E:\Program Files\Mozilla Firefox\nssdbm3.dll]  [Mozilla Foundation, 3.12.0.3 Basic ECC]
[E:\Program Files\Mozilla Firefox\freebl3.dll]  [Mozilla Foundation, 3.12.0.3 Basic ECC]
[E:\Program Files\Mozilla Firefox\nssckbi.dll]  [Mozilla Foundation, 1.70]
[E:\Program Files\Mozilla Firefox\components\brwsrcmp.dll]  [Mozilla Foundation, 1.9]
[PID: 2644 / xindeshenhua][D:\Downloads\sreng2\SREngLdr.EXE]  [Smallfrogs Studio, 2.6.12.1018]
[PID: 4076 / xindeshenhua][D:\Downloads\sreng2\SREc10d39d3.EXE]  [Smallfrogs Studio, 2.6.12.1018]
[C:\WINDOWS\system32\SOGOUPY.IME]  [Sogou.com Inc., 3.5.0.0]
[E:\Program Files\SogouInput\Plugin\SgImeWord.dll]  [Sogou.com Inc., 3.5.0.0]
[D:\Downloads\sreng2\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1    localhost

==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 348, C:\WINDOWS\SYSTEM32\NVSVC32.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 396, C:\PROGRAM FILES\360SAFE\SHIELD\SBIESVC.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2644, D:\DOWNLOADS\SRENG2\SRENGLDR.EXE]

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================

[/CODE]

Amazing 发表于 2008-9-4 14:37

日志没看出问题[:06:]

3楼的情况是正常的，Outpost Firewall 的。

xindeshenhua 发表于 2008-9-4 15:45

这么说不是中毒？再到安全模式下扫扫看吗？

Amazing 发表于 2008-9-4 15:52

个人建议，换个浏览器，看看有没有问题了.

去安全模式扫描病毒？可以的。

xindeshenhua 发表于 2008-9-5 12:32

这两天问题还愈演愈烈了……
这个是windows清理助手的扫描结果……

dl123100 发表于 2008-9-5 12:37

转一条CmdLineExt的解释。

产品名称：cmdlineext.dll
公司：Sony DADC Austria AG
档案：cmdlineext.dll

cmdlineext.dll是版权保护的组成部分，属于索尼securom ROM的版权保护,用来寻找仿真机,即虚拟驱动.如DAEMON Tools.

securom是一个很有效的版权保护。它已被证实对很多系统造成严重的性能问题。不幸的是，许多游戏中必须使用它。

xindeshenhua 发表于 2008-9-5 12:47

[quote]原帖由 [i]dl123100[/i] 于 2008-9-5 12:37 发表 [url=http://bbs.kafan.cn/redirect.php?goto=findpost&pid=4740708&ptid=321426][img]http://bbs.kafan.cn/images/common/back.gif[/img][/url]
转一条CmdLineExt的解释。

产品名称：cmdlineext.dll
公司：Sony DADC Austria AG
档案：cmdlineext.dll

cmdlineext.dll是版权保护的组成部分，属于索尼securom ROM的版权保护,用来寻找仿真机,即虚拟驱动 ... [/quote]
看这样子也不像是因为它造成的错误……
安全模式下之下，360扫描不到任何病毒
NOD32……昨天因为时间太晚，我担心晃到别人于是乎关了显示器，结果它的扫描居然被终止了，但我发现它在安全模式下的扫描似乎是无视我设定的白名单的……

页: [1]

卡饭论坛's Archiver

这究竟是中毒了，还是机子其他什么地方出了错啊？