草根站长
老司机 路子野 随时超车
注意事项
1、下载后根据您系统的情况选择X86/X64,X86为32位电脑,X64为64位电脑。 如果您不知道是X86还是X64,可以逐个尝试。病毒的清除 由于病毒关联了EXE文件,我们建议这样处理: 首先打开注册表编辑器或用来恢复文件关联的工具(如RegFix),先不要关闭(否则再次启动应用程序的时候使病毒又重新加载,或者将“.exe”的后缀名改为“.com”也可以。),然后通过任务管理器或KillBox或者是TroyanFindInfo等进程管理工具结束病毒Rundll32.exe的进程,接下来恢复EXE和TXT文件关联,最后再找到病判胡册毒文件删除掉: %System%\ .exe %System%\notepad .exe %Windows%\System\RUNDLL32.EXE(如果是Windows 2000/XP) %Windows%\System32\RUNDLL32.EXE(如果是Windows 9x) 还有一步,到QQ安装目录下,把病毒生成的TIMPlatform.exe删除,然后把TIMP1atform.exe改名为TIMPlatform.exe即可。 注:推荐使用工具来恢复TXT文件关联。 木马可以把自己改为系统启动时必定会调用的某个文件名,并复制到比原文件要浅一级以上的目录里。Windows系统搜寻一个不带路径信息的文件时遵循一种“从外到里”的规则,这就意味着,如果有两个同样名称的文件分别放在C:\和C:\Windows下,Windows会执行C:\下的程序,而不是C:\Windows下的,这就是木马运行起来的方式。但关键是如果你以为删除掉这些木马程序就万事大吉的话,你会发现在删除之后哭都来不及:系统也出了故障,所有应用程序都打不开了。因为在Windows系统里,文件的打开操作是通过注册表内相应键值指定的应用程序来执行的,这个部分位于注册表的“HKEY_CLASSES_ROOT”主键内。而应用程序自身也被视为一个文件,它也属于一种文件类型,同样可以用其他方式开启,只不过Windows设置它的调用程序为“"%1" %*”,但是木马程序则修改了应用程序(EXE文件)的并联方式,它将EXE后缀名对应的exefile类型的“打开方掘宏式”改成了“木马程序 "%1" %*”,也就是说,系统是通过调用木马程序将原来的.exe程序打开。所以当你把木马杀死后,没有东西给被改变并联方式的.exe文件传递做腊参数,就没法启动这些程序,自然你的电脑的应用程序就打不开了。 一种最最最方便简捷有效的方法来恢复.exe文件的关联文件:新建一个记事本文件,把下面的复制进去 Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\exefile\shell\open\command] @="\"%1\" %*" 直接保存,然后右键点此文件,选打开方式-〉选择程序-〉浏览到windows文件夹里双击regedit,把信息加到注册表就可以了 。
Logfile of HijackThis v1.99.1Scan saved at 14:51:00, on 2006-6-23Platform: Windows XP (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\SYSTEM32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\拿绝system32\lsass.exeC:\WINDOWS\System32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\ctfmon.exeC:\WINDOWS\System32\taskmgr.exeC:\WINDOWS\System32\凳敏仔svchost.exeC:\Documents and Settings\CSU\桌面\hijackthis\HijackThis.exeR3 - URLSearchHook: (no name) - {6575FB3E-48B8-4289-8AB4-3783B09C3902} - C:\WINDOWS\System32\Pygnj.dllR3 - URLSearchHook: (no name) - {4E220532-61A0-489F-BE8B-4F2D9DD71A8B} - C:\WINDOWS\System32\Rtiojb.dllR3 - URLSearchHook: (no name) - {8C166205-07BE-4BA7-8CBA-93B95F03C387} - (no file)R3 - URLSearchHook: (no name) - {BAB88C82-BA00-4F4E-950F-5DC99BFEC880} - (no file)R3 - URLSearchHook: (no name) - {04692ACD-1DE3-4A0D-AAFA-77C7EA342F5F} - C:\WINDOWS\枣汪System32\Ohhg.dllR3 - URLSearchHook: (no name) - {06738CA5-7DBD-4078-8489-B9EB604BEB41} - C:\WINDOWS\System32\Vlmalg.dllR3 - URLSearchHook: (no name) - {F82C5248-EEFB-49C7-A7E6-EEDA37B16F9D} - (no file)R3 - URLSearchHook: (no name) - {F23EDC75-B645-4901-8D1D-46B7CB796864} - (no file)R3 - URLSearchHook: (no name) - {79761012-8D9D-4075-B20E-95FED3D1C0B6} - (no file)R3 - URLSearchHook: (no name) - {D50255AB-FA0E-4B9C-B1EB-F9547E83935A} - (no file)R3 - URLSearchHook: (no name) - {3FED950A-1483-475E-9D81-9305F7B2B045} - C:\WINDOWS\System32\Sguhej.dllR3 - URLSearchHook: (no name) - {41BA8C43-270D-4B0E-9B39-4E187DE63F26} - C:\WINDOWS\System32\Lnjl.dllR3 - URLSearchHook: (no name) - {FFA0E5E1-325C-4630-8074-075CC0091F87} - (no file)R3 - URLSearchHook: (no name) - {C4784BCB-EF15-4955-B282-AD8C0F54B9C9} - (no file)R3 - URLSearchHook: (no name) - {8B8665DB-BF75-4C4D-ABEA-700DCF9E42AC} - (no file)R3 - URLSearchHook: (no name) - {29A5BACC-FB42-44DD-B5A7-E8918DCCD321} - C:\WINDOWS\System32\Qeeyy.dllR3 - URLSearchHook: (no name) - {22A60DBF-E7F2-4773-A926-945C622E9169} - C:\WINDOWS\System32\Ngsc.dllR3 - URLSearchHook: (no name) - {7CB5AE9D-E6C4-4C14-8C77-73D159EE2B44} - (no file)R3 - URLSearchHook: (no name) - {1BB0CA34-B154-436E-9241-B24C2474F1C3} - C:\WINDOWS\System32\Pvup.dllR3 - URLSearchHook: (no name) - {7C6C0B30-8922-414D-ADBD-BFEC0A8D04AF} - (no file)R3 - URLSearchHook: (no name) - {B4333730-3ADB-4CD9-AECF-1A983FB68743} - (no file)R3 - URLSearchHook: (no name) - {CDB20122-9CA9-4FB9-BC6E-04756F28F327} - (no file)R3 - URLSearchHook: (no name) - {989E07F2-EF3C-43DA-BE32-65476223B29A} - C:\WINDOWS\System32\Dzrrto.dllR3 - URLSearchHook: (no name) - {A679BBF2-CD60-486D-8BF0-595F16DE2456} - C:\WINDOWS\System32\Aicft.dllR3 - URLSearchHook: (no name) - {88827FE4-F2E5-44C7-BCED-DB659C8BC026} - C:\WINDOWS\System32\Nkfy.dllR3 - URLSearchHook: (no name) - {55D7F288-C0BB-493E-A872-B85885F8D6BB} - C:\WINDOWS\System32\Txgguc.dllR3 - URLSearchHook: (no name) - {DDB3B2E6-2BB2-46CE-80B7-3D1E5F132B33} - C:\WINDOWS\System32\Vqvczr.dllR3 - URLSearchHook: (no name) - {3F974741-271C-4CE7-B27F-76EA34D6B69D} - C:\WINDOWS\System32\Unpwp.dllR3 - URLSearchHook: (no name) - {94FA969E-52B7-431B-B17D-7264452AD6D0} - C:\WINDOWS\System32\Wopc.dllR3 - URLSearchHook: (no name) - {59D17B85-B32A-46FF-8873-530CC4F7B972} - C:\WINDOWS\System32\Iqaa.dllR3 - URLSearchHook: (no name) - {D935604B-E00B-40D9-A5A8-215F6C037E4E} - C:\WINDOWS\System32\Qtpjd.dllR3 - URLSearchHook: (no name) - {B81BFBF5-7189-483A-9830-DDD42836B170} - C:\WINDOWS\System32\Dwiuj.dllR3 - URLSearchHook: (no name) - {ACA07D98-BE49-4D71-B3CC-94AFDA9695A9} - C:\WINDOWS\System32\Cytoz.dllR3 - URLSearchHook: (no name) - {53E226BA-49F4-416F-94C6-9503E4A7C394} - C:\WINDOWS\System32\Wzcryk.dllR3 - URLSearchHook: (no name) - {F249B9A0-3CD8-413C-B3B3-BF9EF7FAEF16} - C:\WINDOWS\System32\Kllw.dllR3 - URLSearchHook: (no name) - {F0033F0D-25E9-4726-874A-D88AD8CEB302} - C:\WINDOWS\System32\Qthgdc.dllR3 - URLSearchHook: (no name) - {B034A3F3-E8F3-49F9-A3F3-0FC4A2C845D1} - C:\WINDOWS\System32\Gtor.dllR3 - URLSearchHook: (no name) - {9981A82C-6DB4-4C86-8E76-BE0CF6692E84} - C:\WINDOWS\System32\Hfcy.dllR3 - URLSearchHook: (no name) - {5D245A79-CBFC-493B-ABC2-05EF6526E331} - C:\WINDOWS\System32\Wbmh.dllR3 - URLSearchHook: (no name) - {7A9D12FE-BD09-4361-A99F-93236A98D827} - C:\WINDOWS\System32\Wzbjyr.dllR3 - URLSearchHook: (no name) - {98E9AC73-15B1-4D47-8112-477EF713F00A} - C:\WINDOWS\System32\Frexh.dllR3 - URLSearchHook: (no name) - {FD23D9A4-BF4C-4971-A5AD-BF6C371F4C12} - C:\WINDOWS\System32\Qeci.dllR3 - URLSearchHook: (no name) - {5A8E5432-7A14-42E9-A900-B57F64337B33} - C:\WINDOWS\System32\Sxaxw.dllR3 - URLSearchHook: (no name) - {887A32F5-89D8-4525-A37F-95B79E476AEC} - C:\WINDOWS\System32\Wjzwnz.dllR3 - URLSearchHook: (no name) - {C5210EF3-8746-4991-A6AC-0D229605D48C} - C:\WINDOWS\System32\Ufkc.dllR3 - URLSearchHook: (no name) - {F2C5E7B0-F055-4733-B840-674442FCB3E5} - C:\WINDOWS\System32\Avzl.dllR3 - URLSearchHook: Tencent SearchHook - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - C:\Program Files\TENCENT\Adplus\SSAddr.dllR3 - URLSearchHook: (no name) - {4469E825-1533-4407-AE2A-EAFF565892DB} - C:\WINDOWS\System32\Auxnif.dllR3 - URLSearchHook: (no name) - {FA67A197-0095-46E1-AB54-1F2D3A433EFF} - C:\WINDOWS\System32\Rzdydg.dllR3 - URLSearchHook: (no name) - {150010A0-850C-41F4-A36F-B71FCD63ED7C} - C:\WINDOWS\System32\Vfxk.dllR3 - URLSearchHook: (no name) - {17DC23F0-2F9C-4341-904C-C2083EBE6901} - C:\WINDOWS\System32\Axif.dllR3 - URLSearchHook: (no name) - {9545819F-EFC6-4F4E-A0D8-24AE04BB4512} - C:\WINDOWS\System32\Dtxnuy.dllR3 - URLSearchHook: (no name) - {5D7A15DF-BF6B-4B43-8A1B-1B2EC44638B1} - C:\WINDOWS\System32\Dbbdo.dllR3 - URLSearchHook: (no name) - {9B6F8884-B1A5-479E-80D7-B3473EC6BEF9} - C:\WINDOWS\System32\Blinl.dllF2 - REG:system.ini: UserInit=userinit.exeO2 - BHO: ThunderIEHelper - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\System32\xunleibho_v14.dllO2 - BHO: (no name) - {04692ACD-1DE3-4A0D-AAFA-77C7EA342F5F} - C:\WINDOWS\System32\Ohhg.dllO2 - BHO: (no name) - {06738CA5-7DBD-4078-8489-B9EB604BEB41} - C:\WINDOWS\System32\Vlmalg.dllO2 - BHO: Tencent Browser Helper - {0C7C23EF-A848-485B-873C-0ED954731014} - C:\Program Files\TENCENT\Adplus\SSAddr.dllO2 - BHO: (no name) - {150010A0-850C-41F4-A36F-B71FCD63ED7C} - C:\WINDOWS\System32\Vfxk.dllO2 - BHO: (no name) - {17DC23F0-2F9C-4341-904C-C2083EBE6901} - C:\WINDOWS\System32\Axif.dllO2 - BHO: (no name) - {1BB0CA34-B154-436E-9241-B24C2474F1C3} - C:\WINDOWS\System32\Pvup.dllO2 - BHO: (no name) - {22A60DBF-E7F2-4773-A926-945C622E9169} - C:\WINDOWS\System32\Ngsc.dllO2 - BHO: (no name) - {29A5BACC-FB42-44DD-B5A7-E8918DCCD321} - C:\WINDOWS\System32\Qeeyy.dllO2 - BHO: (no name) - {4469E825-1533-4407-AE2A-EAFF565892DB} - C:\WINDOWS\System32\Auxnif.dllO2 - BHO: (no name) - {53E226BA-49F4-416F-94C6-9503E4A7C394} - C:\WINDOWS\System32\Wzcryk.dllO2 - BHO: (no name) - {59D17B85-B32A-46FF-8873-530CC4F7B972} - C:\WINDOWS\System32\Iqaa.dllO2 - BHO: (no name) - {5A8E5432-7A14-42E9-A900-B57F64337B33} - C:\WINDOWS\System32\Sxaxw.dllO2 - BHO: (no name) - {5D245A79-CBFC-493B-ABC2-05EF6526E331} - C:\WINDOWS\System32\Wbmh.dllO2 - BHO: (no name) - {5D7A15DF-BF6B-4B43-8A1B-1B2EC44638B1} - C:\WINDOWS\System32\Dbbdo.dllO2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - C:\PROGRA~1\baidu\bar\baidubar.dllO2 - BHO: (no name) - {7A9D12FE-BD09-4361-A99F-93236A98D827} - C:\WINDOWS\System32\Wzbjyr.dllO2 - BHO: (no name) - {887A32F5-89D8-4525-A37F-95B79E476AEC} - C:\WINDOWS\System32\Wjzwnz.dllO2 - BHO: (no name) - {9545819F-EFC6-4F4E-A0D8-24AE04BB4512} - C:\WINDOWS\System32\Dtxnuy.dllO2 - BHO: (no name) - {98E9AC73-15B1-4D47-8112-477EF713F00A} - C:\WINDOWS\System32\Frexh.dllO2 - BHO: (no name) - {9981A82C-6DB4-4C86-8E76-BE0CF6692E84} - C:\WINDOWS\System32\Hfcy.dllO2 - BHO: (no name) - {9B6F8884-B1A5-479E-80D7-B3473EC6BEF9} - C:\WINDOWS\System32\Blinl.dllO2 - BHO: (no name) - {ACA07D98-BE49-4D71-B3CC-94AFDA9695A9} - C:\WINDOWS\System32\Cytoz.dllO2 - BHO: (no name) - {B034A3F3-E8F3-49F9-A3F3-0FC4A2C845D1} - C:\WINDOWS\System32\Gtor.dllO2 - BHO: (no name) - {B81BFBF5-7189-483A-9830-DDD42836B170} - C:\WINDOWS\System32\Dwiuj.dllO2 - BHO: (no name) - {C5210EF3-8746-4991-A6AC-0D229605D48C} - C:\WINDOWS\System32\Ufkc.dllO2 - BHO: (no name) - {D935604B-E00B-40D9-A5A8-215F6C037E4E} - C:\WINDOWS\System32\Qtpjd.dllO2 - BHO: (no name) - {F0033F0D-25E9-4726-874A-D88AD8CEB302} - C:\WINDOWS\System32\Qthgdc.dllO2 - BHO: (no name) - {F249B9A0-3CD8-413C-B3B3-BF9EF7FAEF16} - C:\WINDOWS\System32\Kllw.dllO2 - BHO: (no name) - {F2C5E7B0-F055-4733-B840-674442FCB3E5} - C:\WINDOWS\System32\Avzl.dllO2 - BHO: (no name) - {FA67A197-0095-46E1-AB54-1F2D3A433EFF} - C:\WINDOWS\System32\Rzdydg.dllO2 - BHO: (no name) - {FD23D9A4-BF4C-4971-A5AD-BF6C371F4C12} - C:\WINDOWS\System32\Qeci.dllO3 - Toolbar: 百度超级搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\PROGRA~1\baidu\bar\baidubar.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKLM\..\Run: [kav] "D:\防火\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"O4 - HKLM\..\Run: [stup1.exe] C:\PROGRA~1\TENCENT\Adplus\stup1.exeO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exeO8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\geturl.htmO8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\getallurl.htmO8 - Extra context menu item: &使用迷你迅雷下载 - C:\Program Files\Sandai\ThunderMini\geturl.htmO8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htmO8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htmO8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htmO8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htmO9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\防火\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dllO11 - Options group: [TBH] 搜搜地址栏搜索O14 - IERESET.INF: SEARCH_PAGE_URL=O14 - IERESET.INF: START_PAGE_URL=O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1147170891942O20 - Winlogon Notify: klogon - C:\WINDOWS\System32\klogon.dllO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exeO23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - D:\防火\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exeO23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - D:\tools\Kerio\Personal Firewall 4\kpf4ss.exe--------------------------------------------------------
)对于静态链接模孙的dll,它的全局变量和静态变量什么时候初旦岩始化,是在dllmain函数之前么,和exe的全局变量谁先初始化?如果是动态链接的话,又是什么顺序?2)对于动态链接的dll,使用旦迟链loadlibrary()函数,它会创建自己的堆么?freelibrary()函数的调用会引起vc进行内存泄露检查么,那它检测的是那部分的内存泄露,是这个dll函数中的么?3)在windows核心编程里头有以下代码:VOID EXEFunc(){ PVOID pv = DLLFunc(); //Access the storage pointed to by pv... //Assumes that pv is in EXE's C/C++ run-time heap free(pv);} PVOID DLLFunc(){ //Allocate block from DLL's C/C++ run-time heap return(malloc(100)); }
版权声明:本文标题:agentdpv.dll下载-agentdpv.dll文件下载内容由互联网整理发布,该文观点仅代表作者本人,转载请联系作者并注明出处:http://www.jjzxjc.com/jiaocheng/7190.html,本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌抄袭侵权/违法违规的内容, 请联系我们举报,一经查实,本站将立刻删除。