求助 - 中 Infostealer.Lineage 病毒

[放下是真功夫]

2006-06-13,13:16:57

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- Administrative User - Completed Functions Allowed

Follow item(s) have been choosed:
All Boot Items (Including Registry, Startup Folders, Services and so on)
Browser Add-ons
Runing Processes (Including process model information)
File Associations


Boot Items


Registry

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
(ctfmon.exe)(C:\WINDOWS\system32\ctfmon.exe) [Microsoft Corporation]
(Kerne0223)(C:\WINDOWS\system32\Kerne0223.exe) []
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
(load)() []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
(IMJPMIG8.1)(; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32) [Microsoft Corporation]
(ccApp)("C:\Program Files\Common Files\Symantec Shared\ccApp.exe") [Symantec Corporation]
(CJIMETIPSYNC)(C:\Program Files\Common Files\Microsoft Shared\IME\IMTC65\CHANGJIE\CINTLCFG.EXE /CJIMETIPSync) [Microsoft Corp.]
(PHIMETIPSYNC)(C:\Program Files\Common Files\Microsoft Shared\IME\IMTC65\PHONETIC\TINTLCFG.EXE /PHIMETIPSync) [Microsoft Corp.]
(Symantec NetDriver Monitor)(C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer) [Symantec Corporation]
(NeroFilterCheck)(C:\WINDOWS\system32\NeroCheck.exe) [Ahead Software Gmbh]
(WinampAgent)(C:\Program Files\Winamp\winampa.exe) []
(fzg)(C:\WINDOWS\Config\svhost32.exe) []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
(shell)(Explorer.exe) [Microsoft Corporation]
(Userinit)(C:\WINDOWS\system32\userinit.exe,) [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
(AppInit_DLLs)() []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
(UIHost)(logonui.exe) [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
({3EA18648-FAF6-490D-9C92-8FD729028A58})(C:\WINDOWS\system32\RegistryInfo.dll) []
({8E3526E3-F160-437B-9095-46A011877CBE})(C:\WINDOWS\system32\pKerme123.dll) []