Board logo

标题: 中了 Downloader.Agent.clq木马 以解决 [打印本页]
作者: kc2588664     时间: 2008-9-30 14:16    标题: 中了 Downloader.Agent.clq木马 以解决

AVG Anti-Spyware - 扫描报告
---------------------------------------------------------

+ 创建时间:        13:59:12 2008-9-30

+ 扫描结果:       



C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\E8QTZLOS\stat[3].htm -> Downloader.Agent.clq : 未进行操作.
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\E8QTZLOS\stat[4].htm -> Downloader.Agent.clq : 未进行操作.
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\L7R9R538\c[3].htm -> Downloader.Agent.clq : 未进行操作.
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\L7R9R538\stat[2].htm -> Downloader.Agent.clq : 未进行操作.
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MK0G83VZ\stat[1].htm -> Downloader.Agent.clq : 未进行操作.
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\N2U1WJEC\stat[2].htm -> Downloader.Agent.clq : 未进行操作.
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\RAKUM5OG\c[2].htm -> Downloader.Agent.clq : 未进行操作.
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ZA75TXNF\stat[1].htm -> Downloader.Agent.clq : 未进行操作.
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ZA75TXNF\stat[2].htm -> Downloader.Agent.clq : 未进行操作.
D:\My Documents\Cookies\administrator@adtech[1].txt -> TrackingCookie.Adtech : 未进行操作.
D:\My Documents\Cookies\administrator@mediaplex[1].txt -> TrackingCookie.Mediaplex : 未进行操作.
D:\My Documents\Cookies\administrator@real[2].txt -> TrackingCookie.Real : 未进行操作.
D:\My Documents\Cookies\administrator@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : 未进行操作.
D:\My Documents\Cookies\administrator@serving-sys[2].txt -> TrackingCookie.Serving-sys : 未进行操作.
D:\My Documents\Cookies\administrator@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : 未进行操作.


::报告结束

[ Last edited by kc2588664 on 2008-9-30 at 07:20 ]
作者: kc2588664     时间: 2008-9-30 14:19
各位高手：
非常感谢您留心我这份系统诊断报告，小菜鸟十万火急等待您的帮助！
该诊断报告由360安全卫士提供 http://www.360.cn
诊断时间: 2008-09-30  14:14:04
诊断平台: Microsoft Windows XP  Service Pack 2
IE版本: Internet Explorer V6.0.2900.2180 Build:62900.2180
计算机物理内存:895.23MB - 当前可用内存:546.29MB

100 - 未知 - Process: MPSVC.exe [MPSVC] -
100 - 未知 - Process: MPSVC2.exe [MPSVC2] -
100 - 未知 - Process: MPSVC1.exe [MPSVC1] -
100 - 未知 - Process: MPMon.exe [MPMon] -
100 - 未知 - Process: guard.exe [AVG Anti-Spyware guard] - D:\Program Files\AVG Anti-Spyware 7.5\guard.exe
100 - 未知 - Process: SRSSSC.exe [SRS Audio Sandbox 控制台] - D:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe
100 - 未知 - Process: RocketDock.exe [] - D:\Program Files\RocketDock_Leopard_Black\RocketDock_Leopard_Black\RocketDock.exe
100 - 未知 - Process: TXPlatform.exe [Tencent Instant Messaging Platform] - C:\Program Files\Tencent\qq\TXPlatform.exe
100 - 未知 - Process: TheWorld.exe [TheWorld Browser] - D:\Program Files\TheWorld 2.0\TheWorld.exe
R0 - 未知 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.hao123.com/
R0 - 未知 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page=about:blank
R1 - 未知 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL=about:blank
O1 - 未知 - Host: 127.0.0.1 444.gmwo07.com
O1 - 未知 - Host: 127.0.0.1 333.gmwo07.com
O1 - 未知 - Host: 127.0.0.1 222.gmwo07.com
O1 - 未知 - Host: 127.0.0.1 111.gmwo07.com
O1 - 未知 - Host: 127.0.0.1 haha.yaoyao09.com
O1 - 未知 - Host: 127.0.0.1 www.noseqing.cn
O1 - 未知 - Host: 127.0.0.1 fg.pvs360.com
O1 - 未知 - Host: 127.0.0.1 cw.pvs360.com
O1 - 未知 - Host: 127.0.0.1 ta.pvs360.com
O1 - 未知 - Host: 127.0.0.1 dl.pvs360.com
O1 - 未知 - Host: 127.0.0.1 ok.sl8cjs.cn
O1 - 未知 - Host: 127.0.0.1 nc.mskess.com
O1 - 未知 - Host: 127.0.0.1 idc.windowsupdeta.cn
O2 - 未知 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - [RealPlayer Download and Record Plugin for Internet Explorer] - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - 未知 - BHO: (IEFXZ) - [IEFXZ] - {6A49F431-2A2E-41a5-9080-0F41D1A3AEC2} - C:\PROGRA~1\IEfxz\iefxz.dll
O4 - 未知 - HKLM\..\Run: [amd_dc_opt] [AMD Dual-Core Optimizer] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - 未知 - HKCU\..\Run: [SRS Audio Sandbox] [SRS Audio Sandbox 控制台] "D:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe" /hideme
O4 - 未知 - HKCU\..\Run: [RocketDock] [] "D:\Program Files\RocketDock_Leopard_Black\RocketDock_Leopard_Black\RocketDock.exe"
O8 - 未知 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\qq\AddEmotion.htm
O9 - 未知 - Extra button: IEFXZTool(HKCU) - C:\PROGRA~1\IEfxz\iefxz.dll
O23 - 未知 - Service: AVG Anti-Spyware Guard [AVG Anti-Spyware Guard] - D:\Program Files\AVG Anti-Spyware 7.5\guard.exe - (running)
O23 - 未知 - Service: avp [Provides protection against viruses and other malicious software.] - " - (not running)
O23 - 未知 - Service: MPSVCService [微点主动防御软件] - C:\Program Files\Micropoint\MPSVC.exe - (running)
O23 - 未知 - Service: UxTuneUp [Allows for the use of designs without a Microsoft Visual Style signature.] - C:\WINDOWS\System32\uxtuneup.dll - (running)
O23 - 未知 - Service: PnpWMmng [Windows驱动即插即用管理器] - D:\PROGRA~1\完美卸~1\PnpWMmng.exe - (not running)
O28 - 未知 - IELINK: C:\DOCUME~1\ADMINI~1\APPLIC~1\MICROS~1\INTERN~1\QUICKL~1\启动IN~1.LNK - c:\windows\web\index.htm

=======================================
作者: kc2588664     时间: 2008-9-30 14:20
100 - 安全 - Process: smss.exe [进程为会话管理子系统用以初始化系统变量，ms-dos驱动名称类似lpt1以及com，调用win32壳子系统和运行在windows登陆过程。] - C:\WINDOWS\System32\smss.exe
100 - 安全 - Process: csrss.exe [客户端服务子系统，用以控制windows图形相关子系统。] - C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=base
100 - 安全 - Process: WINLOGON.EXE [windows nt用户登陆程序。] - C:\WINDOWS\system32\winlogon.exe
100 - 安全 - Process: services.exe [用于管理windows服务系统进程。] - C:\WINDOWS\system32\services.exe
100 - 安全 - Process: lsass.exe [本地安全权限服务控制windows安全机制。] - C:\WINDOWS\system32\lsass.exe
100 - 安全 - Process: ati2evxx.exe [ati显卡相关后台程序。] - C:\WINDOWS\system32\Ati2evxx.exe
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost -k DcomLaunch
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost -k rpcss
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\System32\svchost.exe -k netsvcs
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost.exe -k LocalService
100 - 安全 - Process: SbieSvc.exe [360安全浏览器相关进程。] - C:\Program Files\360safe\Shield\SbieSvc.exe
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost.exe -k imgsvc
100 - 安全 - Process: 360tray.exe [360安全卫士实时保护模块] - D:\Program Files\360safe\safemon\360Tray.exe
100 - 安全 - Process: ctfmon.exe [office xp输入法图标。] - C:\WINDOWS\system32\ctfmon.exe
100 - 安全 - Process: explorer.exe [windows program manager或者windows explorer用于控制windows图形shell，包括开始菜单、任务栏，桌面和文件管理。] - C:\WINDOWS\explorer.exe
100 - 安全 - Process: QQ.exe [腾讯公司出品的qq即时通讯软件。] - C:\Program Files\Tencent\qq\QQ.exe
100 - 安全 - Process: conime.exe [console ime ime输入法控制台软件。] - C:\WINDOWS\system32\conime.exe
100 - 安全 - Process: IEXPLORE.EXE [microsoft internet explorer浏览器用于浏览网页。] - C:\Program Files\internet explorer\iexplore.exe
100 - 安全 - Process: 360Safe.exe [360安全卫士] - D:\Program Files\360safe\360Safe.exe
R1 - 安全 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=about:blank
R1 - 安全 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=about:blank
O1 - 安全 - Host: 127.0.0.1 c0mo.com
O1 - 安全 - Host: 127.0.0.1 gxgxy.net
O1 - 安全 - Host: 127.0.0.1 pvs360.com
O1 - 安全 - Host: 127.0.0.1 sl8cjs.cn
O1 - 安全 - Host: 127.0.0.1 windowsupdeta.cn
O1 - 安全 - Host: 127.0.0.1 up.22x44.com
O1 - 安全 - Host: 127.0.0.1 my.531jx.cn
O1 - 安全 - Host: 127.0.0.1 nx.51ylb.cn
O1 - 安全 - Host: 127.0.0.1 llboss.com
O1 - 安全 - Host: 127.0.0.1 down.malasc.cn
O1 - 安全 - Host: 127.0.0.1 d2.llsging.com
O1 - 安全 - Host: 127.0.0.1 171817.171817.com
O1 - 安全 - Host: 127.0.0.1 wg.47255.com
O1 - 安全 - Host: 127.0.0.1 www.tomwg.com
O1 - 安全 - Host: 127.0.0.1 tp.shpzhan.cn
O1 - 安全 - Host: 127.0.0.1 1.joppnqq.com
O1 - 安全 - Host: 127.0.0.1 xx.exiao01.com
O1 - 安全 - Host: 127.0.0.1 www.22aaa.com
O1 - 安全 - Host: 127.0.0.1 ilove.com
O1 - 安全 - Host: 127.0.0.1 xxx.mmma.biz
O1 - 安全 - Host: 127.0.0.1 www.868wg.com
O1 - 安全 - Host: 127.0.0.1 2.joppnqq.com
O1 - 安全 - Host: 127.0.0.1 1.jopanqc.com
O1 - 安全 - Host: 127.0.0.1 yu.8s7.net
O1 - 安全 - Host: 127.0.0.1 1.jopmmqq.com
O1 - 安全 - Host: 127.0.0.1 cao.kv8.info
O1 - 安全 - Host: 127.0.0.1 xtx.kv8.info
O1 - 安全 - Host: 127.0.0.1 new.749571.com
O1 - 安全 - Host: 127.0.0.1 xxx.vh7.biz
O1 - 安全 - Host: 127.0.0.1 1.jopenkk.com
O1 - 安全 - Host: 127.0.0.1 d.93se.com
O1 - 安全 - Host: 127.0.0.1 3.joppnqq.com
O1 - 安全 - Host: 127.0.0.1 xxx.j41m.com
O1 - 安全 - Host: 127.0.0.1 1.jopenqc.com
O1 - 安全 - Host: 127.0.0.1 xxx.m111.biz
O1 - 安全 - Host: 127.0.0.1 down.18dd.net
O1 - 安全 - Host: 127.0.0.1 www.333292.com
O1 - 安全 - Host: 127.0.0.1 qqq.hao1658.com
O1 - 安全 - Host: 127.0.0.1 qqq.dzydhx.com
O1 - 安全 - Host: 127.0.0.1 www.exiao01.com
O1 - 安全 - Host: 127.0.0.1 www.cike007.cn
O2 - 安全 - BHO: (ThunderAtOnce Class) - [迅雷浏览器高级特性支持模块。] - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - C:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll
O2 - 安全 - BHO: (Thunder Browser Helper) - [迅雷附带下载监视器相关文件。] - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll
O4 - 安全 - HKLM\..\Run: [360Safetray] [360safe实时保护功能模块。] D:\Program Files\360safe\safemon\360Tray.exe /start
O4 - 安全 - HKCU\..\Run: [ctfmon.exe] [office xp输入法图标。] C:\WINDOWS\system32\ctfmon.exe
O8 - 安全 - Extra context menu item: 使用迅雷下载 - C:\Program Files\Thunder\Program\geturl.htm
O8 - 安全 - Extra context menu item: 使用迅雷下载全部链接 - C:\Program Files\Thunder\Program\getallurl.htm
O16 - 安全 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Flash播放器) - http://fpdownload.macromedia.com ... s/flash/swflash.cab
O18 - 安全 - Protocol: OFFICE 相关 - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
O21 - 安全 - Protocol Icons: HKCR\http\shell\open\command - "C:\Program Files\internet explorer\iexplore.exe" "%1"
O21 - 安全 - Protocol Icons: HKCR\ftp\shell\open\command - "C:\Program Files\internet explorer\iexplore.exe" "%1"
O21 - 安全 - Protocol Icons: HKCR\https\shell\open\command - "C:\Program Files\internet explorer\iexplore.exe" "%1"
O21 - 安全 - Protocol Icons: HKCR\htmlfile\shell\open\command - "C:\Program Files\internet explorer\iexplore.exe" "%1"
O23 - 安全 - Service: Ati HotKey Poller [ati显卡相关后台程序。] - C:\WINDOWS\system32\Ati2evxx.exe - (running)
O23 - 安全 - Service: ATI Smart [是一个ati图形显示卡驱程的相关进程。] - C:\WINDOWS\system32\ati2sgag.exe - (not running)
O23 - 安全 - Service: SbieSvc [360安全浏览器相关服务。] - C:\Program Files\360safe\Shield\SbieSvc.exe - (running)

=======================================
作者: kc2588664     时间: 2008-9-30 14:20
O31 - 未知 - SEApproved: {42071714-76d4-11d1-8b24-00a0c9068ff3} - deskpan.dll -  -  -  - 0 -
O31 - 未知 - SEApproved: 无效的CLSID：Shell extensions for file compression -  -  -  -  - 0 -
O31 - 未知 - SEApproved: 无效的CLSID：加密上下文菜单 -  -  -  -  - 0 -
O31 - 未知 - SEApproved: {0DF44EAA-FF21-4412-828E-260A8728E7F1} -  -  -  -  - 0 -
O31 - 未知 - SEApproved: {00E7B358-F65B-4dcf-83DF-CD026B94BFD4} -  -  -  -  - 0 -
O31 - 未知 - SEApproved: {7A9D77BD-5403-11d2-8785-2E0420524153} -  -  -  -  - 0 -
O31 - 未知 - SEApproved: {e82a2d71-5b2f-43a0-97b8-81be15854de8} - C:\WINDOWS\system32\dfshim.dll - Microsoft Corporation - Application Deployment Support Library - 2.0.50727.42 - 83456 - b3511383c8be3a8c5b88a78971fc1141
O31 - 未知 - SEApproved: {E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} - C:\WINDOWS\system32\dfshim.dll - Microsoft Corporation - Application Deployment Support Library - 2.0.50727.42 - 83456 - b3511383c8be3a8c5b88a78971fc1141
O31 - 未知 - SEApproved: {B41DB860-8EE4-11D2-9906-E49FADC173CA} - C:\Program Files\WinRAR\rarext.dll -  -  -  - 129024 - 60fe004235a8108446dcfc1e526fde0e
O31 - 未知 - SEApproved: {5E2121EE-0300-11D4-8D3B-444553540000} - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll -  - ACE Context Menu - 2.0.0.0 - 688128 - 70f168522361476edef1fb2efe8e438a
O31 - 未知 - SEApproved: {6C125022-639D-43cc-9F3D-647E6CC69EF1} - C:\WINDOWS\ContextBG.dll - Grigri - Apply a background to the shell context menu - 1.0.0.1 - 217088 - f87730190d95a8254ef8442fbab2621b
O31 - 未知 - SEApproved: {45AC2688-0253-4ED8-97DE-B5370FA7D48A} - C:\Premium8yue\shlext.dll -  -  -  - 0 -
O31 - 未知 - SEApproved: {23170F69-40C1-278A-1000-000100020000} - C:\Program Files\7-Zip\7-zip.dll - Igor Pavlov - 7-Zip Shell Extension - 4.60.0.0 - 70144 - db4efb5309bbd060a0e36bd2042226bf
O31 - 未知 - Directory Menu: {B41DB860-8EE4-11D2-9906-E49FADC173CA} - C:\Program Files\WinRAR\rarext.dll -  -  -  - 129024 - 60fe004235a8108446dcfc1e526fde0e
O31 - 未知 - LSA: Security Packages - sv1_0.dll -  -  -  - 0 -
O31 - 未知 - LSA: Security Packages - channel.dll -  -  -  - 0 -

=======================================

O40 - winlogon.exe - Micropoint Corporation - C:\Program Files\Micropoint\mp110031.dll - mp110031 - 93079e2a8882c9c57a43a25ca9b26bf3
O40 - services.exe - Micropoint Corporation - C:\Program Files\Micropoint\mp110031.dll - mp110031 - 93079e2a8882c9c57a43a25ca9b26bf3
O40 - lsass.exe - Micropoint Corporation - C:\Program Files\Micropoint\mp110031.dll - mp110031 - 93079e2a8882c9c57a43a25ca9b26bf3
O40 - svchost.exe - Micropoint Corporation - C:\Program Files\Micropoint\mp110031.dll - mp110031 - 93079e2a8882c9c57a43a25ca9b26bf3
O40 - svchost.exe - Micropoint Corporation - C:\Program Files\Micropoint\mp110031.dll - mp110031 - 93079e2a8882c9c57a43a25ca9b26bf3
O40 - svchost.exe - Micropoint Corporation - C:\Program Files\Micropoint\mp110031.dll - mp110031 - 93079e2a8882c9c57a43a25ca9b26bf3
O40 - svchost.exe - Micropoint Corporation - C:\Program Files\Micropoint\mp110031.dll - mp110031 - 93079e2a8882c9c57a43a25ca9b26bf3
O40 - svchost.exe - Micropoint Corporation - C:\Program Files\Micropoint\mp110031.dll - mp110031 - 93079e2a8882c9c57a43a25ca9b26bf3
O40 - explorer.exe -  - D:\Program Files\RocketDock_Leopard_Black\RocketDock_Leopard_Black\RocketDock.dll -  - 4a2a05b25df4385f5aec6f07b1c1e93d
O40 - explorer.exe - Micropoint Corporation - C:\Program Files\Micropoint\mp110031.dll - mp110031 - 93079e2a8882c9c57a43a25ca9b26bf3
O40 - explorer.exe - Grigri - C:\WINDOWS\ContextBG.dll - Apply a background to the shell context menu - f87730190d95a8254ef8442fbab2621b

=======================================

O41 - mp110001 - mp110001 - C:\WINDOWS\system32\drivers\mp110001.sys - (running) - mp110001 - MicroPoint Corporation - a9b4ea4aaeb3b1f691e80ad00ee9a822
O41 - mp110002 - mp110002 - C:\WINDOWS\system32\drivers\mp110002.sys - (running) - mp110002 - Micropoint Corporation - e50c4dd05b90ae9656e720f4c1098200
O41 - mp110003 - mp110003 - C:\WINDOWS\system32\drivers\mp110003.sys - (running) - mp110003 - Micropoint Corporation - a2b2871a9b02b90d768b3c45527a44f0
O41 - mp110004 - mp110004 - C:\WINDOWS\system32\drivers\mp110004.sys - (running) - mp110004 - Micropoint Corporation - cf142f1ce5107e39f5f121ad6c60e849
O41 - mp110005 - mp110005 - C:\WINDOWS\system32\drivers\mp110005.sys - (running) - mp110005 - Micropoint Corporation - 5f2cbb5fd38ec72edae35ccae611bbf7
O41 - mp110006 - mp110006 - C:\WINDOWS\system32\drivers\mp110006.sys - (running) - mp110006 - Micropoint Corporation - 2e737a47e5824198477966c7ec0d8dc9
O41 - mp110007 - mp110007 - C:\WINDOWS\system32\drivers\mp110007.sys - (running) - mp110007 - Micropoint Corporation - 3cdd1407c2959d0fcbb253bd7464ce9d
O41 - mp110008 - mp110008 - C:\WINDOWS\system32\drivers\mp110008.sys - (running) - mp110008 - Micropoint Corporation - fe5e48f05ccae50f4556d1898331169d
O41 - mp110009 - mp110009 - C:\WINDOWS\system32\drivers\mp110009.sys - (running) - mp110009 - Micropoint Corporation - 98a09f7cad0dbfab61e987cc4738438f
O41 - mp110010 - mp110010 - C:\WINDOWS\system32\drivers\mp110010.sys - (running) - mp110010 - Micropoint Corporation - 876bbf572431e5ac7d26ba9029a9c86f
O41 - mp110011 - mp110011 - C:\WINDOWS\system32\drivers\mp110011.sys - (running) - mp110011 - Micropoint Corporation - eaf4b6c5d59aaf4a280055514696696e
O41 - mp110013 - mp110013 - C:\WINDOWS\system32\drivers\mp110013.sys - (running) - mp110013 - Micropoint Corporation - 2e71687c70cc40130365caf7e5301a62
O41 - PnpWmkDrv - PnpWmkDrv - C:\WINDOWS\system32\drivers\PnpWmkDrv.sys - (running) -  -  - ce5a9ec8892d5dfb09d031f5ad501cac
O41 - ROCKEYNT - Rockey Device Driver - C:\WINDOWS\system32\drivers\Rockeynt.sys - (running) - Rockey Device Driver - FeiTian Tech Co.,Ltd - 1aba1d70f793c75c354195b521b4e735
O41 - SbieDrv - Sandboxie Kernel Mode Driver - C:\Program Files\360safe\Shield\SbieDrv.sys - (running) - Sandboxie Kernel Mode Driver - tzuk - e4b7af4f68cd948edbdc528882924d00
O41 - sptd - sptd - C:\WINDOWS\system32\drivers\sptd.sys - (running) -  -  -
O41 - AlcwWmDrv - AlcwWmDrv - C:\WINDOWS\system32\drivers\AlcwWmDrv.sys - (not running) -  -  - 3eb4aa5adc8a6f9a2329d32c9a2be1dc
O41 - NPF - NPF - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsb\npf.sys - (not running) -  -  -
O41 - UCORESYS - UCORESYS - D:\Downloads\AFUWIN4.33\AFUWIN4.33\UCORESYS.SYS - (not running) -  -  -
O41 - WmRegProDrv - 完美卸载 保护驱动 - C:\WINDOWS\system32\drivers\WmRegProDrv.sys - (not running) - 完美卸载 保护驱动 - Windows (R) 2000 DDK provider - 2acc856d2255adc7db239dd667cb2ca8

=======================================
360Safe.exe=4.3.0.1008
AntiAdwa.dll=4.2.0.1001
AntiEng.dll=4.3.0.1001
AntiActi.dll=2.0.0.3000
CleanHis.dll=4.2.0.1002
live.dll=1.0.1.1028

=======================================
作者: Legend     时间: 2008-9-30 14:47
从楼主报警日志的情况上看，楼主浏览了某些恶意站点里头的脚本文件报警的。请楼主稍微描述一下您的情况！楼主是在什么时候报警的！报警之前具体做过什么操作！
作者: kc2588664     时间: 2008-9-30 15:17
谢谢我以解决了 ，刚才在百度上查找电影 ，无意间打开一个可能是恶意网站。谢谢你的及时回复，刚查了下资料，断网用Windows清理助手 清理掉了，刚从启电脑， 又用AVG查了下  没有了   谢谢版主:lol:



欢迎光临 微点交流论坛 (http://bbs.micropoint.com.cn/) bbs.micropoint.com.cn