进行清理时发现Administrator Messagers
恶意软件，清理后
提示清理成功，但重启电脑后又有该恶意
软件。安全摸索下
删除，重启后问题依旧。请问如何解决啊。
==============================================================
金山清理
专家系统诊断报告
该诊断报告由金山清理专家提供
http://www.duba.net
==============================================================
诊断
时间: 2008-07-03, 09:56
诊断平台: Windows XP [5.1.2600] Service Pack 2
IE版本: Internet Explorer V7.0.11.5730
计算机物理内存: 1533(MB)
当前可用内存: 951(MB)
硬盘总大小: 149(GB)
硬盘可用空间: 50(GB)
清理专家版本: 2008.06.13.404
恶意软件库版本: 2008.07.02.1
漏洞库版本: 2008.06.26.1
==============================================================
常规启动项
==============================================================
该项来源: HKEY_LOCAL_
MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[IMJPMIG8.1] <; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.
EXE" /Spoil /RemAdvDef /Migration32>
[nwiz] <nwiz.exe /install>
文件路径: C:\WINDOWS\system32\nwiz.exe [分析中]
[SoundMAX] <"C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray>
文件路径: C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [分析中]
[QuickTime Task] <; "D:\
程序\QuickTime\qttask.exe" -atboottime>
==============================================================
启动文件夹位置
==============================================================
Common Startup: C:\Documents and Settings\All Users\「开始」菜单\程序\启动
Startup: C:\Documents and Settings\Administrator\「开始」菜单\程序\启动
Common Startup: %ALLUSERSPROFILE%\「开始」菜单\程序\启动
==============================================================
Host File
==============================================================
127.0.0.1 localhost
==============================================================
系统服务
==============================================================
该项来源: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
[Thunder4] [已启用] <C:\WINDOWS\system32\Thunder4.exe>
文件路径: C:\WINDOWS\system32\Thunder4.exe [分析中]
==============================================================
驱动程序
==============================================================
该项来源: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
[ATSpy] [已启用] <\??\C:\WINDOWS\system32\ATSpy.sys>
[sptd] [已启用] <System32\Drivers\sptd.sys>
文件路径: C:\WINDOWS\system32\Drivers\sptd.sys [文件无法访问]
==============================================================
BHO
==============================================================
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
[FG2CatchUrl]
{1F364306-AA45-47B5-9F9D-39A8B94E7EF1} <D:\程序\FlashGet Network\Flashget\ComDlls\bhoCATCH.
dll>
[TozBfdla Class]
{C1ECDEEA-57D7-DCBF-C797-38649529F020} <C:\WINDOWS\DOWNLO~1\juunlll.dll>
==============================================================
当前
进程
==============================================================
名称: Thunder4.exe [已启用]
文件路径: C:\WINDOWS\system32\Thunder4.exe [分析中]
模块文件: C:\WINDOWS\system32\ntdll.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\kernel32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\USER32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\GDI32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\IMM32.DLL (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\ADVAPI32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\RPCRT4.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\Secur32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\LPK.DLL (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\USP10.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\msvcrt.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\TEMP\E_4\krnln.fnr
模块文件: C:\WINDOWS\system32\COMCTL32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\comdlg32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\SHLWAPI.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\ole32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\OLEAUT32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\OLEPRO32.DLL (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\WINMM.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\WINSPOOL.DRV (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\WS2_32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\WS2HELP.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\uxtheme.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\msctfime.ime (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\SETUPAPI.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\TEMP\E_4\dp1.fne
名称: Smax4.exe [已启用]
命令行: "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
文件路径: C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [分析中] (Analog Devices. Inc.)
模块文件: C:\WINDOWS\system32\ntdll.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\kernel32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\WINMM.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\USER32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\GDI32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\ADVAPI32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\RPCRT4.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\Secur32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\VERSION.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\MFC42.DLL (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\msvcrt.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\SHLWAPI.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\WinSxS\X86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\COMCTL32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\ole32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\IMM32.DLL (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\LPK.DLL (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\USP10.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\MFC42LOC.DLL (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\uxtheme.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\apphelp.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\msctfime.ime (Microsoft Corporation)
模块文件: C:\程序\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL (Kingsoft Corporation)
模块文件: C:\WINDOWS\system32\OLEAUT32.dll (Microsoft Corporation)
模块文件: C:\程序\Kingsoft\Kingsoft Internet Security 2008\kis.dll (Kingsoft Corporation)
模块文件: C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\MFC80U.DLL (Microsoft Corporation)
模块文件: C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCR80.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCP80.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\MFC80CHS.DLL (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\MSCTF.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\DSound.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\WINTRUST.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\CRYPT32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\MSASN1.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\IMAGEHLP.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\wdmaud.drv (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\msacm32.drv (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\MSACM32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\midimap.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\KsUser.dll (Microsoft Corporation)
==============================================================
第3方IE插件
==============================================================
名称: nprfxins.dll [已启用]
文件路径: C:\Program Files\Internet Explorer\PLUGINS\RichFX\Player\nprfxins.dll [分析中]
==============================================================
IE扩展按钮
==============================================================
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions
[番茄花园]
<{6096E38F-5AC1-4391-8EC4-75DFA92FB32F}> <
http://www.tomatolei.com>
==============================================================
IE扩展菜单
==============================================================
该项来源: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt
<使用快车(Flas&hGet)
下载> <D:\程序\FlashGet Network\Flashget\ComDlls\Bholink.htm>
<使用快车(Flash&Get)下载全部链接> <D:\程序\FlashGet Network\Flashget\ComDlls\Bhoall.htm>
<使用迅雷下载> <C:\程序\Thunder Network\Thunder\Program\geturl.htm>
文件路径: C:\程序\Thunder Network\Thunder\Program\geturl.htm [分析中]
<添加到QQ表情> <D:\程序\Tencent\QQ\AddEmotion.htm>
文件路径: D:\程序\Tencent\QQ\AddEmotion.htm [分析中]
==============================================================
ActiveX控件
==============================================================
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components
[{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
<{89B4C1CD-B018-4511-B0A1-5476DBF70820}> <C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install>
文件路径: C:\WINDOWS\system32\mscories.dll [分析中]
--------------------------------------------------------------
该项来源: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
[FG2CatchUrl]
<{1F364306-AA45-47B5-9F9D-39A8B94E7EF1}> <D:\程序\FlashGet Network\Flashget\ComDlls\bhoCATCH.dll>
[TozBfdla Class]
<{C1ECDEEA-57D7-DCBF-C797-38649529F020}> <C:\WINDOWS\DOWNLO~1\juunlll.dll>
[QQPlayerSvr Proxy Control]
<{CD108273-D434-43E6-AA90-1469F97EB398}> <D:\程序\Tencent\QQ\QQPlayerProxy.dll>
[Thunder DapCtrl]
<{EF1EA76E-5428-4e40-85A1-D4DD2893183A}> <C:\程序\Thunder Network\WebThunder\DownAndPlay\DapCtrl1.3.17.20.647.dll>
[FG2CatchUrl]
<{FB5DA724-162B-11D3-8B9B-AA70B4B0B525}> <D:\程序\FlashGet Network\Flashget\ComDlls\bhoCATCH.dll>
==============================================================
其他安全区域
==============================================================
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
[显示摇曳 CPL 扩展] <deskpan.dll>
[Desktop Explorer] <C:\WINDOWS\system32\nvshell.dll>
文件路径: C:\WINDOWS\system32\nvshell.dll [分析中]
[{1E9B04FB-F9E5-4718-997B-B8DA88302A47}] <C:\WINDOWS\system32\nvshell.dll>
文件路径: C:\WINDOWS\system32\nvshell.dll [分析中]
[nView Desktop Context Menu] <C:\WINDOWS\system32\nvshell.dll>
文件路径: C:\WINDOWS\system32\nvshell.dll [分析中]
[
本帖最后由 一把锈剑 于 2008-7-3 11:37 编辑 ]
