求助 - 中 Infostealer.Lineage 病毒

[放下是真功夫]

Running Processes
[PID: 368][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 428][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 452][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 496][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 508][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 664][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 712][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 824][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 876][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 936][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1140][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\pKerme123.dll] <N/A><N/A>
[C:\WINDOWS\system32\fzgdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\Kerne0223.dll] <N/A><N/A>
[C:\Program Files\Yahoo!\Messenger\idle.dll] <Yahoo! Inc.><1, 0, 0, 2>
[C:\Program Files\Norton AntiVirus\NavShExt.dll] <Symantec Corporation><11.0.9.16>
[C:\Program Files\Common Files\Symantec Shared\ccL30.dll] <Symantec Corporation><103.0.6.5>
[PID: 1748][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1952][C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE] <Microsoft Corporation><7.00.9466>
[PID: 568][C:\WINDOWS\system32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: dnsrv(bld4act)>
[PID: 1012][C:\Program Files\Winamp\winampa.exe] <N/A><N/A>
[C:\WINDOWS\system32\pKerme123.dll] <N/A><N/A>
[C:\WINDOWS\system32\fzgdll.dll] <N/A><N/A>
[PID: 1800][C:\WINDOWS\Config\svhost32.exe] <N/A><N/A>
[C:\WINDOWS\system32\fzgdll.dll] <N/A><N/A>
[PID: 1820][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\pKerme123.dll] <N/A><N/A>
[C:\WINDOWS\system32\fzgdll.dll] <N/A><N/A>
[PID: 1828][C:\WINDOWS\system32\Kerne0223.exe] <N/A><N/A>
[C:\WINDOWS\system32\Kerne0223.dll] <N/A><N/A>
[C:\WINDOWS\system32\pKerme123.dll] <N/A><N/A>
[PID: 472][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 2676][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\pKerme123.dll] <N/A><N/A>
[C:\Program Files\Norton AntiVirus\NavShExt.dll] <Symantec Corporation><11.0.9.16>
[C:\Program Files\Common Files\Symantec Shared\ccL30.dll] <Symantec Corporation><103.0.6.5>
[C:\WINDOWS\system32\fzgdll.dll] <N/A><N/A>
[C:\Program Files\Common Files\Symantec Shared\Script Blocking\scrauth.dll] <Symantec Corporation><11.0.9.16>
[C:\Program Files\Common Files\Symantec Shared\Script Blocking\ScrBlock.dll] <Symantec Corporation><11.0.9.16>
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] <Symantec Corporation><103.0.6.5>
[C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx] <Macromedia, Inc.><8,0,24,0>
[C:\WINDOWS\system32\Macromed\Common\SwSupport.dll] <Macromedia, Inc.><10.1r11>
[C:\Program Files\Yahoo!\Messenger\idle.dll] <Yahoo! Inc.><1, 0, 0, 2>
[PID: 2720][C:\Program Files\MSN Messenger\msnmsgr.exe] <Microsoft Corporation><7.5.0324>
[C:\WINDOWS\system32\pKerme123.dll] <N/A><N/A>
[C:\WINDOWS\system32\fzgdll.dll] <N/A><N/A>
[C:\Program Files\Yahoo!\Messenger\idle.dll] <Yahoo! Inc.><1, 0, 0, 2>
[C:\WINDOWS\system32\msdmo.dll] <N/A><N/A>
[C:\Program Files\Common Files\Symantec Shared\Script Blocking\scrauth.dll] <Symantec Corporation><11.0.9.16>
[C:\Program Files\Common Files\Symantec Shared\Script Blocking\ScrBlock.dll] <Symantec Corporation><11.0.9.16>
[C:\Program Files\Common Files\Symantec Shared\ccL30.dll] <Symantec Corporation><103.0.6.5>
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] <Symantec Corporation><103.0.6.5>
[C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx] <Macromedia, Inc.><8,0,24,0>
[C:\WINDOWS\system32\Macromed\Common\SwSupport.dll] <Macromedia, Inc.><10.1r11>
[PID: 2740][C:\Program Files\Yahoo!\Messenger\YPager.exe] <N/A><N/A>
[C:\Program Files\Yahoo!\Messenger\idle.dll] <Yahoo! Inc.><1, 0, 0, 2>
[C:\Program Files\Yahoo!\Messenger\ygxa_2.dll] <Yahoo! Inc.><2004, 2, 19, 1>
[C:\Program Files\Yahoo!\Messenger\pcre.dll] <Pcre><3.9>
[C:\Program Files\Yahoo!\Messenger\YML.dll] <N/A><3, 0, 0, 2>
[C:\Program Files\Yahoo!\Messenger\YImage.dll] <Yahoo! Inc.><1, 0, 0, 1>
[C:\Program Files\Yahoo!\Messenger\xmlparse.dll] <N/A><N/A>
[C:\Program Files\Yahoo!\Messenger\xmltok.dll] <N/A><N/A>
[C:\WINDOWS\system32\pKerme123.dll] <N/A><N/A>
[C:\Program Files\Yahoo!\Messenger\ft60.dll] <Yahoo! Inc.><1.0.0.4>
[C:\Program Files\Yahoo!\Messenger\res_msgr.dll] <Yahoo! Inc.><6, 0, 0, 1610>
[C:\Program Files\Yahoo!\Shared\YbSkin2.dll] <Yahoo! Inc.><2005, 6, 3, 1>
[C:\Program Files\Yahoo!\Messenger\MyYahoo.dll] <Yahoo! Inc.><6, 0, 0, 600>
[C:\Program Files\Yahoo!\Messenger\D32-FW.DLL] <Distinct Corporation><3.4.6>
[C:\WINDOWS\system32\icm32.dll] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx] <Macromedia, Inc.><8,0,24,0>
[C:\WINDOWS\system32\Macromed\Common\SwSupport.dll] <Macromedia, Inc.><10.1r11>
[C:\WINDOWS\system32\fzgdll.dll] <N/A><N/A>
[C:\Program Files\Yahoo!\Messenger\yvoicesm.dll] <N/A><1, 0, 201, 1>
[C:\Program Files\Yahoo!\Messenger\yvoiceui.dll] <N/A><N/A>
[C:\Program Files\Yahoo!\Messenger\yaudiomgr.dll] <N/A><1, 0, 200, 1>
[C:\Program Files\Yahoo!\Messenger\yxtldr.dll] <N/A><1, 0, 200, 1>
[C:\Program Files\Yahoo!\Messenger\rvsip.dll] <RADVISION><3.1.1.30>
[C:\Program Files\Yahoo!\Messenger\rvcommon.dll] <RADVISION><1.0.18>
[C:\Program Files\Yahoo!\Messenger\rvads.dll] <RADVISION><3.1.1.30>
[C:\Program Files\Yahoo!\Messenger\rvsdp.dll] <RADVISION><>
[C:\Program Files\Yahoo!\Messenger\yv_res.dll] <N/A><N/A>
[C:\Program Files\Yahoo!\Messenger\eyeBeamAsDLL.dll] <N/A><N/A>
[C:\Program Files\Yahoo!\Messenger\AEC_PC_DLL.dll] <N/A><N/A>
[C:\Program Files\Common Files\Symantec Shared\Script Blocking\scrauth.dll] <Symantec Corporation><11.0.9.16>
[C:\Program Files\Common Files\Symantec Shared\Script Blocking\ScrBlock.dll] <Symantec Corporation><11.0.9.16>
[C:\Program Files\Common Files\Symantec Shared\ccL30.dll] <Symantec Corporation><103.0.6.5>
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] <Symantec Corporation><103.0.6.5>
[PID: 4048][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\pKerme123.dll] <N/A><N/A>
[C:\Program Files\Norton AntiVirus\NavShExt.dll] <Symantec Corporation><11.0.9.16>
[C:\Program Files\Common Files\Symantec Shared\ccL30.dll] <Symantec Corporation><103.0.6.5>
[C:\WINDOWS\system32\fzgdll.dll] <N/A><N/A>
[C:\Program Files\Yahoo!\Messenger\idle.dll] <Yahoo! Inc.><1, 0, 0, 2>
[C:\Program Files\Common Files\Symantec Shared\Script Blocking\scrauth.dll] <Symantec Corporation><11.0.9.16>
[C:\Program Files\Common Files\Symantec Shared\Script Blocking\ScrBlock.dll] <Symantec Corporation><11.0.9.16>
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] <Symantec Corporation><103.0.6.5>
[C:\Program Files\Yahoo!\Messenger\YPagerChecker.dll] <TODO: <Company name>><1.0.0.1>
[C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx] <Macromedia, Inc.><8,0,24,0>
[PID: 3248][C:\Program Files\WinRAR\WinRAR.exe] <N/A><N/A>
[C:\WINDOWS\system32\pKerme123.dll] <N/A><N/A>
[C:\WINDOWS\system32\fzgdll.dll] <N/A><N/A>
[C:\Program Files\Yahoo!\Messenger\idle.dll] <Yahoo! Inc.><1, 0, 0, 2>
[PID: 316][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.381\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\WINDOWS\system32\pKerme123.dll] <N/A><N/A>
[C:\WINDOWS\system32\fzgdll.dll] <N/A><N/A>
[C:\Program Files\Yahoo!\Messenger\idle.dll] <Yahoo! Inc.><1, 0, 0, 2>