.Wsd880
我的电脑中毒了，不知道什么原因。特征如下。
1。显示不了隐藏文件。点察看所有文件，没有反应。
2。总是不时地谈出一些广告网页。
3。今天发现右下角的系统音量标志修改不了音量。造成播放rmvb文件没有声音。
4. 卡巴沙岛51%就杀不动了，昨天杀了14个小时在安全模式下。
扫描结果如下
2006-09-27,16:53:31
System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程?樾畔ⅲ?br>
文件关联
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
＜MsnMsgr＞＜＂C:\Program Files\MSN Messenger\MsnMsgr.Exe＂ /background＞ [Microsoft Corporation]
＜ctfmon.exe＞＜C:\WINDOWS\system32\ctfmon.exe＞ [Microsoft Corporation]
＜ATI Launchpad＞＜＂C:\Program Files\ATI Technologies\main\launchpd.exe＂＞ [ATI Technologies Inc.]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] .
＜load＞＜＞ []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
＜IMSCMig＞＜C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload＞ [Microsoft Corporation]
＜ATIPTA＞＜C:\WINDOWS\atiptaxx.exe＞ [ATI Technologies, Inc.]
＜KernelFaultCheck＞＜%systemroot%\system32\dumprep 0 -k＞ []
＜KAVPersonal50＞＜＂C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe＂ /minimize＞ [Kaspersky Lab]
＜StormCodec_Helper＞＜＂C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe＂ /S /opti＞ []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
＜shell＞＜Explorer.exe＞ [Microsoft Corporation]
＜Userinit＞＜C:\WINDOWS\system32\userinit.exe,＞ [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
＜AppInit_DLLs＞＜＞ []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
＜UIHost＞＜logonui.exe＞ [Microsoft Corporation]
================================== ;
启动文件夹
[Adobe Reader Speed Launch]
＜C:\Documents and Settings\All Users.WINDOWS\「开始」菜单\程序\启动\Adobe Reader Speed Launch.lnk＞＜N＞
[AutoCAD 启动加速器]
＜C:\Documents and Settings\All Users.WINDOWS\「开始」菜单\程序\启动\AutoCAD 启动加速器.lnk＞＜N＞
==================================
服务
[Ati HotKey Poller / Ati HotKey Poller]
＜C:\WINDOWS\system32\Ati2evxx.exe＞＜N/A＞
[ATI Smart / ATI Smart]
＜C:\WINDOWS\system32\ati2sgag.exe＞＜＞
[Autodesk Licensing Service / Autodesk Licensing Service]
＜＂C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe＂＞＜Autodesk, Inc.＞
[Kaspersky Anti-Virus Service / kavsvc]
＜＂C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe＂＞＜Kaspersky Lab＞
==================================
浏览器加载项
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} ＜F:\Program Files\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated＞
[Ad Engine]
{077FD0C3-1291-4104-A356-41E36B252682} ＜C:\Program Files\Yayad\AdCore.dll, CDM＞ ;
[MyIEHelper Class]
{16B770A0-0E87-4278-B748-2460D64A8386} ＜C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\IEHelper\IEHelper_5014.dll, N/A＞
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} ＜C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, N/A＞
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} ＜d:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD＞
[Windows ToyClass]
{E3DB85B5-C559-4894-B474-42E89FAA1EFD} ＜C:\WINDOWS\system32\winmsd.dll, Microsoft Corporation＞
[启动迅雷]
{0062C9BD-B349-40DE-91A0-755F37ACD559} ＜d:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD＞
[浩方对战平台]
{0A155D3C-68E2-4215-A47A-E800A446447A} ＜E:\游戏\浩方对战平台\GameClient.exe, 上海浩方在线信息技术有限公司＞
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} ＜C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, N/A＞
[番茄花园]
{6096E38F-5AC1-4391-8EC4-75DFA92FB32F} ＜http://www.tomatolei.com, N/A＞
[信息检索(&R)] (www.dngz.net)
{92780B25-18CC-41C8-B9BE-3C9C571A8263} ＜F:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL, Microsoft Corporation＞
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} ＜C:\Program Files\Tencent\QQ\QQIEHelper.dll, N/A＞
[BitComet工具栏]
{3F1ABCDB-A875-46c1-8345-B72A4567E486} ＜C:\Program Files\BitComet\BitCometBar\BitCometBar0.6.dll, N/A＞
[WebActivater Control]
{3D8F74EE-8692-4F8F-B8D2-7522E732519E} ＜C:\WINDOWS\system32\WEBACT~1.OCX, QQ＞
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} ＜F:\Program Files\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated＞
[Ad Engine]
{077FD0C3-1291-4104-A356-41E36B252682} ＜C:\Program Files\Yayad\AdCore.dll, CDM＞
[MyIEHelper Class]
{16B770A0-0E87-4278-B748-2460D64A8386} ＜C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\IEHelper\IEHelper_5014.dll, N/A＞
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} ＜C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation＞
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} ＜%SystemRoot%\system32\mshtml.dll, N/A＞ ;
[DHTML Edit Control Safe for Scripting for IE5]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} ＜C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation＞
[BitComet工具栏]
{3F1ABCDB-A875-46C1-8345-B72A4567E486} ＜C:\Program Files\BitComet\BitCometBar\BitCometBar0.6.dll, N/A＞
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} ＜C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, N/A＞
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} ＜C:\WINDOWS\system32\wmp.dll, Microsoft Corporation＞
[MediaComm Class]
{7670648D-461B-42AF-BDFE-46D26AF5EFF2} ＜d:\Program Files\Thunder Network\Thunder\Components\InMedia\MediaAddin07.dll, Thunder Networking Technologies,LTD＞
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} ＜C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation＞
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} ＜d:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD＞
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} ＜%SystemRoot%\system32\shdocvw.dll, N/A＞ ,
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} ＜C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation＞
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} ＜C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.＞
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} ＜C:\WINDOWS\system32\macromed\flash\Flash.ocx, Macromedia, Inc.＞
[Windows ToyClass]
{E3DB85B5-C559-4894-B474-42E89FAA1EFD} ＜C:\WINDOWS\system32\winmsd.dll, Microsoft Corporation＞
[&使用迅雷下载]
＜d:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A＞
[&使用迅雷下载全部链接]
＜d:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A＞
[上传到QQ网络硬盘]
＜C:\Program Files\Tencent\qq\AddToNetDisk.htm, N/A＞
[导出到 Microsoft Office Excel(&X)]
＜res://F:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000, N/A＞
[添加到QQ自定义面板]
＜C:\Program Files\Tencent\qq\AddPanel.htm, N/A＞
[添加到QQ表情]
＜C:\Program Files\Tencent\qq\AddEmotion.htm, N/A＞
dngz.net版权所有
[用QQ彩信发送该图片]
＜C:\Program Files\Tencent\qq\SendMMS.htm, N/A＞
[访问通用网址]
＜, N/A＞
==================================
正在运行的进程
[PID: 536][\SystemRoot\System32\smss.exe] ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 592][\?\C:\WINDOWS\system32\csrss.exe] ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 616][\?\C:\WINDOWS\system32\winlogon.exe] ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 660][C:\WINDOWS\system32\services.exe] ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[C:\WINDOWS\system32\wshcon32.dll] ＜＞＜4, 1, 0, 0＞
[C:\WINDOWS\system32\quartz32.dll] ＜＞＜4, 1, 0, 0＞
[C:\WINDOWS\system32\secur.dll] ＜＞＜4, 1, 0, 0＞
[PID: 672][C:\WINDOWS\system32\lsass.exe] ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 832][C:\WINDOWS\system32\svchost.exe] ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 880][C:\WINDOWS\system32\svchost.exe] ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞ ~
[C:\WINDOWS\system32\wshcon32.dll] ＜＞＜4, 1, 0, 0＞
[PID: 1100][C:\WINDOWS\system32\svchost.exe] ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 1180][C:\WINDOWS\system32\svchost.exe] ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 1268][C:\WINDOWS\system32\spoolsv.exe] ＜Microsoft Corporation＞＜5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)＞
[PID: 1688][C:\WINDOWS\System32\alg.exe] ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 1556][C:\WINDOWS\Explorer.EXE] ＜Microsoft Corporation＞＜6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)＞
[C:\WINDOWS\system32\AcSignIcon.dll] ＜Autodesk＞＜16.1.63.0＞
[C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] ＜Autodesk＞＜16.1.63.0＞
[F:\Program Files\ActiveX\PDFShell.dll] ＜Adobe Systems, Inc.＞＜7.0.0.0＞
[F:\Program Files\ActiveX\AcroIEHelper.dll] ＜Adobe Systems Incorporated＞＜7.0.0.2004121400＞
[d:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll] ＜Thunder Networking Technologies,LTD＞＜5, 0, 0, 2＞ 本文来自 www.dngz.net
[C:\WINDOWS\system32\winmsd.dll] ＜Microsoft Corporation＞＜2, 0, 0, 1＞
[C:\Program Files\WinRAR\rarext.dll] ＜N/A＞＜N/A＞
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\shellex.dll] ＜Kaspersky Lab＞＜5.0.527.1＞
[C:\PROGRA~1\ftctry\Commenu.dll] ＜Fygsoft and Microsoft＞＜2.0.0.0＞
[PID: 360][C:\WINDOWS\atiptaxx.exe] ＜ATI Technologies, Inc.＞＜6.14.10.5014＞
[C:\WINDOWS\ATRPUIXX.CHS] ＜ATI Technologies, Inc.＞＜6.14.10.5014＞
[C:\WINDOWS\atipdsxx.dll] ＜ATI Technologies, Inc.＞＜6.14.10.5014＞
[C:\WINDOWS\atipdxxx.dll] ＜ATI Technologies, Inc.＞＜6.14.10.5014＞
[PID: 976][C:\WINDOWS\system32\ctfmon.exe] ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 2124][C:\Program Files\Yayad\AdPop.Exe] ＜CDM＞＜1.0.0.1＞
[C:\Program Files\Yayad\autoupdate.dll] ＜CDM＞＜1.0.0.1＞
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\scrchpg.dll] ＜Kaspersky Lab＞＜5.0.527.20＞
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\scbridge.dll] ＜Kaspersky Lab＞＜5.0.527.1＞ ;
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\klipc.dll] ＜Kaspersky Lab＞＜5.0.527.0＞
[C:\WINDOWS\system32\secur.dll] ＜＞＜4, 1, 0, 0＞
[PID: 3636][C:\Program Files\Maxthon\Maxthon.exe] ＜MY Soft Technology＞＜1, 2, 4, 18＞
[C:\Program Files\Maxthon\maxzlib.dll] ＜ ＞＜1, 0, 0, 2＞
[C:\WINDOWS\system32\AcSignIcon.dll] ＜Autodesk＞＜16.1.63.0＞
[C:\Program Files\Maxthon\Plugin\FloatBar\FloatBar.dll] ＜＞＜1, 8, 0, 0＞
[C:\Program Files\Maxthon\Services\RealTime\real_time.dll] ＜＞＜1, 0, 0, 1＞
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\scrchpg.dll] ＜Kaspersky Lab＞＜5.0.527.20＞
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\scbridge.dll] ＜Kaspersky Lab＞＜5.0.527.1＞
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\klipc.dll] ＜Kaspersky Lab＞＜5.0.527.0＞
[C:\WINDOWS\system32\macromed\flash\Flash.ocx] ＜Macromedia, Inc.＞＜7,0,19,0＞
[C:\WINDOWS\system32\msdmo.dll] ＜N/A＞＜N/A＞ 欢迎来到(www.dngz.net)
[C:\WINDOWS\system32\l3codeca.acm] ＜Fraunhofer Institut Integrierte Schaltungen IIS＞＜1, 9, 0, 0305＞
[C:\WINDOWS\system32\secur.dll] ＜＞＜4, 1, 0, 0＞
[C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] ＜Autodesk＞＜16.1.63.0＞
[C:\WINDOWS\system32\ffdshow.ax] ＜N/A＞＜1, 0, 0, 1＞
[C:\Program Files\Ringz Studio\Storm Codec\Codecs\VSFilter.dll] ＜Gabest＞＜1, 0, 0, 9＞
[C:\WINDOWS\system32\CHENHU4.IME] ＜chenhu＞＜5.8＞
[PID: 1160][C:\WINDOWS\System32\svchost.exe] ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 4576][D:\soft\杀毒软件\sreng2系统修复\SREng.exe] ＜Smallfrogs Studio＞＜2.0.21.505＞
[C:\WINDOWS\system32\secur.dll] ＜＞＜4, 1, 0, 0＞
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. [＂%1＂ %*]
.COM OK. [＂%1＂ %*]
.PIF OK. [＂%1＂ %*]
.REG OK. [regedit.exe ＂%1＂]
.BAT OK. [＂%1＂ %*]
.SCR Error. [AutoCADScriptFile]
.CHM OK. [＂C:\WINDOWS\hh.exe＂ %1] dngz.net
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe ＂%1＂ %*]
.JS OK. [%SystemRoot%\System32\WScript.exe ＂%1＂ %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
==================================
希望高人给帮帮忙看看。多谢了。
修复隐藏文件显示不了（保存以下代码为hidden.reg）
[code]Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden]
＂Text＂=＂@shell32.dll,-30499＂
＂Type＂=＂group＂
＂Bitmap＂=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,\
00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,53,00,\
48,00,45,00,4c,00,4c,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,2c,00,34,00,00,\
00
＂HelpID＂=＂shell.hlp＃51131＂
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN] ;
＂RegPath＂=＂Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced＂
＂Text＂=＂@shell32.dll,-30501＂
＂Type＂=＂radio＂
＂CheckedValue＂=dword:00000002
＂ValueName＂=＂Hidden＂
＂DefaultValue＂=dword:00000002
＂HKeyRoot＂=dword:80000001
＂HelpID＂=＂shell.hlp＃51104＂
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
＂RegPath＂=＂Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced＂
＂Text＂=＂@shell32.dll,-30500＂
＂Type＂=＂radio＂
＂CheckedValue＂=dword:00000001
＂ValueName＂=＂Hidden＂
＂DefaultValue＂=dword:00000002
＂HKeyRoot＂=dword:80000001
＂HelpID＂=＂shell.hlp＃51105＂[/code]
弹出广告窗口：
[C:\WINDOWS\system32\wshcon32.dll] ＜＞＜4, 1, 0, 0＞
[C:\WINDOWS\system32\quartz32.dll] ＜＞＜4, 1, 0, 0＞
[C:\WINDOWS\system32\secur.dll] ＜＞＜4, 1, 0, 0＞
下载置顶“LSPFIX”“WinSockXPFix”“KILLBOX”软件备用！
首先到安全模式下用LSPFIX修复以上文件，然后用KILLBOX删除文件，最后用WinSockXPFix修复一下系统