瑞星卡卡安全论坛
风华 - 2005-11-13 11:14:00
我是WIN2000系统~近来发现网速没以前快了~而且QQ之类的软件时常掉线。我家两台电脑上网~用路由器连接的~（路由器自动拨号~包月宽带~IP设置自动获取）系统内带正版瑞星杀毒软件~已更新！监控就没关过~（所有监空都开着了~也仔细设置过！我本身对计算机有一定了解）怎么还会中病毒呢~！迷茫啊~请指教哈~~
看了看大虾的几个帖子~下了个AutoRuns软件~（可惜全英文的~有中文的没？）不知道保存的对不对~全不全！虽然瑞星提示我BackDoor.GPigeon.tar已清除~不过看帖子说这样杀不掉~~~帮忙看一下吧！在此谢过~！
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
+ NvCplDaemon NVIDIA Display Properties Extension NVIDIA Corporation c:\winnt\system32\nvcpl.dll
+ RavMon RavMon Rising realtime monitor Beijing Rising Technology Co., Ltd. f:\rising\rav\ravmon.exe
+ RavTimer RavTimer Beijing Rising Technology Co., Ltd. f:\rising\rav\ravtimer.exe
+ SoundMan Avance Sound Manager Avance Logic, Inc. c:\winnt\soundman.exe
HKLM\System\CurrentControlSet\Services
+ NVSvc Provides system and desktop level support to the NVIDIA display driver NVIDIA Corporation c:\winnt\system32\nvsvc32.exe
+ RsCCenter CCenter rising f:\rising\rav\ccenter.exe
+ RsRavMon RavMon Beijing Rising Technology Co., Ltd. f:\rising\rav\ravmond.exe
+ RSVPE 为计算机提供磁盘维护，备份扇区碎片文件，还原设置。 c:\winnt\rsvpe.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
+ RISING Rising Shell Ext Module Beijing Rising Technology Co., Ltd. c:\winnt\system32\ravext.dll
风华 - 2005-11-13 11:22:00
有大虾在不？给看看哈！
风华 - 2005-11-13 12:06:00
没有高手在么？
不言放弃 - 2005-11-13 12:09:00
你的报告没有什么问题
建议用HIJACKTHIS导出LOG
风华 - 2005-11-13 12:29:00
重新启动了一下~又中这个病毒了~也提示清除了~晕了。。。
风华 - 2005-11-13 12:37:00
HijackThis_zww汉化版扫描日志 V1.99.1
保存于 12:45:55, 日期 2005-11-13
操作系统： Windows 2000 (WinNT 5.00.2195)
浏览器： Internet Explorer v6.00 (6.00.2462.0000)
当前运行的进程：
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
F:\RISING\RAV\Ravmond.exe
F:\RISING\RAV\RavStub.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\nvsvc32.exe
F:\RISING\RAV\CCENTER.EXE
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.exe
C:\WINNT\soundman.exe
F:\RISING\RAV\RAVTIMER.EXE
F:\RISING\RAV\RAVMON.EXE
C:\WINNT\System32\internat.exe
C:\Program Files\Internet Explorer\iexplore.exe
F:\tool.zip\瑞星\HijackThis V1.99.1 完全汉化版\HijackThis1991zww.exe
O1 - Hosts: 222.89.109.112 www.99bb.com
O1 - Hosts: 222.89.109.112 99bb.com
O1 - Hosts: 222.89.109.112 www.zdao.com
O1 - Hosts: 222.89.109.112 zdao.com
O1 - Hosts: 222.89.109.112 www.aisex.com
O1 - Hosts: 222.89.109.112 aisex.com
O1 - Hosts: 222.89.109.112 www.qq190.com
O1 - Hosts: 222.89.109.112 qq190.com
O1 - Hosts: 222.89.109.112 www.wanmm.com
O1 - Hosts: 222.89.109.112 wanmm.com
O1 - Hosts: 222.89.109.112 www.qq163.com
O1 - Hosts: 222.89.109.112 qq163.com
O1 - Hosts: 222.89.109.112 www.sex141.com
O1 - Hosts: 222.89.109.112 sex141.com
O1 - Hosts: 222.89.109.112 www.my990.com
O1 - Hosts: 222.89.109.112 my990.com
O1 - Hosts: 222.89.109.112 ad.my990.com
O1 - Hosts: 222.89.109.112 www.ttjj.com
O1 - Hosts: 222.89.109.112 ttjj.com
O1 - Hosts: 222.89.109.112 www.7t7t.com
O1 - Hosts: 222.89.109.112 7t7t.com
O1 - Hosts: 222.89.109.112 www.123987.com
O1 - Hosts: 222.89.109.112 www.123987.com/7sese/
O1 - Hosts: 222.89.109.112 www.oursm.com
O1 - Hosts: 222.89.109.112 oursm.com
O1 - Hosts: 222.89.109.112 www.palacemoon.com
O1 - Hosts: 222.89.109.112 palacemoon.com
O1 - Hosts: 222.89.109.112 18dy.com
O1 - Hosts: 222.89.109.112 www.18dy.com
O1 - Hosts: 222.89.109.112 49m.cn
O1 - Hosts: 222.89.109.112 www.49m.cn
O1 - Hosts: 222.89.109.112 123.xuanji8.com
O1 - Hosts: 222.89.109.112 ohkk.xuanji8.com
O1 - Hosts: 222.89.109.112 123.52lhc.com
O1 - Hosts: 222.89.109.112 7sese.com222.89.109.112 www.7sese.com
O1 - Hosts: 222.89.109.112 www.hao119.com
O1 - Hosts: 222.89.109.112 7sese.com
O1 - Hosts: 222.89.109.112 www.7sese.com
O1 - Hosts: 222.89.109.112 www.hao358.com
O1 - Hosts: 222.89.109.112 www.ee456.com
O1 - Hosts: 222.89.109.112 video.12san.com
O1 - Hosts: 222.89.109.112 www.eachz.com
O1 - Hosts: 222.89.109.112 www.avl.cn
O1 - Hosts: 222.89.109.112 avl.cn
O1 - Hosts: 222.89.109.112 www.98756.net
O1 - Hosts: 222.89.109.112 7sese.org
O1 - Hosts: 222.89.109.112 www.7sese.org
O1 - Hosts: 222.89.109.112 kanvcd.com
O1 - Hosts: 222.89.109.112 www.kanvcd.com
O1 - Hosts: 222.89.109.112 cn.movies.yahoo
O1 - Hosts: 222.89.109.112 www.zfvod.com
O1 - Hosts: 222.89.109.112 zfvod.com
O1 - Hosts: 222.89.109.112 media.netandtv.com
O1 - Hosts: 222.89.109.112 p2p.55660.com
O1 - Hosts: 222.89.109.112 media.netandtv.com
O1 - Hosts: 222.89.109.112 www.sol.sohu.com
O1 - Hosts: 222.89.109.112 www.sexhu.cn
O1 - Hosts: 222.89.109.112 sexhu.cn
O1 - Hosts: 222.89.109.112 www.blogchina.com
O1 - Hosts: 222.89.109.112 5blogchina.com
O1 - Hosts: 222.89.109.112 www.5806.net
O1 - Hosts: 222.89.109.112 zhao999.com
O1 - Hosts: 222.89.109.112 www.zhao999.com
O1 - Hosts: 222.89.109.112 movie.xmfdc.net
O1 - Hosts: 222.89.109.112 www.movie110.com
O1 - Hosts: 222.89.109.112 movie110.com
O1 - Hosts: 222.89.109.112 www.yesky.com
O1 - Hosts: 222.89.109.112 yesky.com
O1 - Hosts: 222.89.109.112 www.178ya.com
O1 - Hosts: 222.89.109.112 178ya.com
O1 - Hosts: 222.89.109.112 www.3668.cn
O1 - Hosts: 222.89.109.112 3668.cn
O1 - Hosts: 222.89.109.112 www.hao45.com
O1 - Hosts: 222.89.109.112 hao45.com
O1 - Hosts: 222.89.109.112 www.5sese.com
O1 - Hosts: 222.89.109.112 5sese.com
O1 - Hosts: 222.89.109.112 woyy.51.net
O1 - Hosts: 222.89.109.112 3668.cn
O1 - Hosts: 222.89.109.112 www.3668.cn
O1 - Hosts: 222.89.109.112 tu68.com
O1 - Hosts: 222.89.109.112 www.tu68.com
O1 - Hosts: 222.89.109.112 avxiu.com
O1 - Hosts: 222.89.109.112 www.avxiu.com
O1 - Hosts: 222.89.109.112 18dy.net
O1 - Hosts: 222.89.109.112 www.18dy.net
O1 - Hosts: 222.89.109.112 avxiu.com
O1 - Hosts: 222.89.109.112 www.avxiu.com
O1 - Hosts: 222.89.109.112 hk.18dy.com
O1 - Hosts: 222.89.109.112 dianying.gghggh.com
O1 - Hosts: 222.89.109.112 lady3.****net
O1 - Hosts: 222.89.109.112 kan56.zj.com
O1 - Hosts: 222.89.109.112 88848.net
O1 - Hosts: 222.89.109.112 www.88848.net
O1 - Hosts: 222.89.109.112 xonline.org
O1 - Hosts: 222.89.109.112 www.xonline.org
O1 - Hosts: 222.89.109.112 dy.nuoy.com
O1 - Hosts: 222.89.109.112 www.korea-av.com
O1 - Hosts: 222.89.109.112 korea-av.com
O1 - Hosts: 222.89.109.112 movie.bucuo.org
O1 - Hosts: 222.89.109.112 mv888.com
O1 - Hosts: 222.89.109.112 www.mv888.com
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - (no file)
O3 - IE工具栏增项: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - IE工具栏增项: (no name) - {F60C7D81-8471-4D40-AAFE-56D318F34C2D} - (no file)
O4 - 启动项HKLM\\Run: [Synchronization Manager] mobsync.exe /logon
O4 - 启动项HKLM\\Run: [SoundMan] soundman.exe
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - 启动项HKLM\\Run: [RavTimer] F:\RISING\RAV\RAVTIMER.EXE
O4 - 启动项HKLM\\Run: [RavMon] F:\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - IE右键菜单中的新增项目: &Download by NetAnts - F:\NETANTS\NAGet.htm
O8 - IE右键菜单中的新增项目: Download &All by NetAnts - F:\NETANTS\NAGetAll.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - F:\Tencent\QQ\AddEmotion.htm
O9 - 浏览器额外的按钮: (no name) - {233A9694-667E-11d1-9DFB-006097D5040A} - (no file)
O14 - IERESET.INF: SEARCH_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=iear=iesearch(&A)
O16 - DPF: {56A7DC70-E102-4408-A34A-AE06FEF01586} - http://iebar.t2t2.com/iebar.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1122820147288
O23 - NT 服务: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - NT 服务: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - rising - F:\RISING\RAV\CCENTER.EXE
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - F:\RISING\RAV\Ravmond.exe
O23 - NT 服务: Smarytcer RSVPE (RSVPE) - Unknown owner - C:\WINNT\RSVPE.exe
风华 - 2005-11-13 12:37:00
日志发上来了~帮我看看~对了，我自己还使用了upiea软件，屏蔽了部分软件！不过我一般只用upiea清理一下垃圾文件~省事呵呵~偶尔查看一下启动项
希望快乐 - 2005-11-13 12:42:00
先帮你顶了..
爱已过时 - 2005-11-13 12:45:00
| 引用: |
【风华的贴子】日志发上来了~帮我看看~对了，我自己还使用了upiea软件，屏蔽了部分软件！不过我一般只用upiea清理一下垃圾文件~省事呵呵~偶尔查看一下启动项
........................... |
ppdog - 2005-11-13 13:45:00
修复：
所有O1项
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - (no file)
O3 - IE工具栏增项: (no name) - {F60C7D81-8471-4D40-AAFE-56D318F34C2D} - (no file)
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - 浏览器额外的按钮: (no name) - {233A9694-667E-11d1-9DFB-006097D5040A} - (no file)
鸽子应该是这一项
O23 - NT 服务: Smarytcer RSVPE (RSVPE) - Unknown owner - C:\WINNT\RSVPE.exe
风华 - 2005-11-13 18:42:00
试试看
风华 - 2005-11-13 18:44:00
O23 - NT 服务: Smarytcer RSVPE (RSVPE) - Unknown owner - C:\WINNT\RSVPE.exe
这个是不是？
风华 - 2005-11-13 19:01:00
修复完了~启动后还是查杀到BackDoor.GPigeon.tar了~~怎么搞？
风华 - 2005-11-13 19:19:00
看了几篇帖子~看的我一头雾水~~~某帖子说在注册表找信息~我一个都没找到~！应该怎么办？老大推荐个帖子~~
风华 - 2005-11-13 19:24:00
修复了O23 - NT 服务: Smarytcer RSVPE (RSVPE) - Unknown owner - C:\WINNT\RSVPE.exe后~~马上再次扫描~出现如下日志
HijackThis_zww汉化版扫描日志 V1.99.1
保存于 19:32:11, 日期 2005-11-13
操作系统： Windows 2000 (WinNT 5.00.2195)
浏览器： Internet Explorer v6.00 (6.00.2462.0000)
当前运行的进程：
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
F:\RISING\RAV\Ravmond.exe
F:\RISING\RAV\RavStub.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\nvsvc32.exe
F:\RISING\RAV\CCENTER.EXE
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.exe
F:\RISING\RAV\RAVTIMER.EXE
F:\RISING\RAV\RAVMON.EXE
C:\WINNT\System32\internat.exe
F:\tool.zip\瑞星\HijackThis V1.99.1 完全汉化版\HijackThis1991zww.exe
O3 - IE工具栏增项: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - 启动项HKLM\\Run: [Synchronization Manager] mobsync.exe /logon
O4 - 启动项HKLM\\Run: [SoundMan] soundman.exe
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - 启动项HKLM\\Run: [RavTimer] F:\RISING\RAV\RAVTIMER.EXE
O4 - 启动项HKLM\\Run: [RavMon] F:\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O8 - IE右键菜单中的新增项目: &Download by NetAnts - F:\NETANTS\NAGet.htm
O8 - IE右键菜单中的新增项目: Download &All by NetAnts - F:\NETANTS\NAGetAll.htm
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - F:\Tencent\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - F:\Tencent\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - F:\Tencent\QQ\SendMMS.htm
O14 - IERESET.INF: SEARCH_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=iear=iesearch(&A)
O16 - DPF: {56A7DC70-E102-4408-A34A-AE06FEF01586} - http://iebar.t2t2.com/iebar.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1122820147288
O18 - 列举现有的协议: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\System32\mshtml.dll
O18 - 列举现有的协议: cdl - {3DD53D40-7B8B-11D0-B013-00AA0059CE02} - C:\WINNT\system32\urlmon.dll
O18 - 列举现有的协议: file - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINNT\system32\urlmon.dll
O18 - 列举现有的协议: ftp - {79EAC9E3-BAF9-11CE-8C82-00AA004BA90B} - C:\WINNT\system32\urlmon.dll
O18 - 列举现有的协议: gopher - {79EAC9E4-BAF9-11CE-8C82-00AA004BA90B} - C:\WINNT\system32\urlmon.dll
O18 - 列举现有的协议: http - {79EAC9E2-BAF9-11CE-8C82-00AA004BA90B} - C:\WINNT\system32\urlmon.dll
O18 - 列举现有的协议: https - {79EAC9E5-BAF9-11CE-8C82-00AA004BA90B} - C:\WINNT\system32\urlmon.dll
O18 - 列举现有的协议: ipp - (no CLSID) - (no file)
O18 - 列举现有的协议: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINNT\System32\itss.dll
O18 - 列举现有的协议: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\System32\mshtml.dll
O18 - 列举现有的协议: local - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINNT\system32\urlmon.dll
O18 - 列举现有的协议: mailto - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\System32\mshtml.dll
O18 - 列举现有的协议: mhtml - {05300401-BCBC-11D0-85E3-00C04FD85AB4} - C:\WINNT\System32\inetcomm.dll
O18 - 列举现有的协议: mk - {79EAC9E6-BAF9-11CE-8C82-00AA004BA90B} - C:\WINNT\system32\urlmon.dll
O18 - 列举现有的协议: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINNT\System32\itss.dll
O18 - 列举现有的协议: msdaipp - (no CLSID) - (no file)
O18 - 列举现有的协议: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\System32\mshtml.dll
O18 - 列举现有的协议: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINNT\System32\mshtml.dll
O18 - 列举现有的协议: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\System32\mshtml.dll
O18 - 列举现有的协议: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINNT\System32\msdxm.ocx
O23 - NT 服务: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - NT 服务: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - rising - F:\RISING\RAV\CCENTER.EXE
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - F:\RISING\RAV\Ravmond.exe
O23 - NT 服务: Smarytcer RSVPE (RSVPE) - Unknown owner - C:\WINNT\RSVPE.exe
突然出来这么多~吓 我一跳~再次扫描后出现如下日志
HijackThis_zww汉化版扫描日志 V1.99.1
保存于 19:33:41, 日期 2005-11-13
操作系统： Windows 2000 (WinNT 5.00.2195)
浏览器： Internet Explorer v6.00 (6.00.2462.0000)
当前运行的进程：
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
F:\RISING\RAV\Ravmond.exe
F:\RISING\RAV\RavStub.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\nvsvc32.exe
F:\RISING\RAV\CCENTER.EXE
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.exe
F:\RISING\RAV\RAVTIMER.EXE
F:\RISING\RAV\RAVMON.EXE
C:\WINNT\System32\internat.exe
C:\WINNT\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
F:\tool.zip\瑞星\HijackThis V1.99.1 完全汉化版\HijackThis1991zww.exe
O3 - IE工具栏增项: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - 启动项HKLM\\Run: [Synchronization Manager] mobsync.exe /logon
O4 - 启动项HKLM\\Run: [SoundMan] soundman.exe
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - 启动项HKLM\\Run: [RavTimer] F:\RISING\RAV\RAVTIMER.EXE
O4 - 启动项HKLM\\Run: [RavMon] F:\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O8 - IE右键菜单中的新增项目: &Download by NetAnts - F:\NETANTS\NAGet.htm
O8 - IE右键菜单中的新增项目: Download &All by NetAnts - F:\NETANTS\NAGetAll.htm
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - F:\Tencent\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - F:\Tencent\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - F:\Tencent\QQ\SendMMS.htm
O14 - IERESET.INF: SEARCH_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=iear=iesearch(&A)
O16 - DPF: {56A7DC70-E102-4408-A34A-AE06FEF01586} - http://iebar.t2t2.com/iebar.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1122820147288
O23 - NT 服务: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - NT 服务: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - rising - F:\RISING\RAV\CCENTER.EXE
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - F:\RISING\RAV\Ravmond.exe
O23 - NT 服务: Smarytcer RSVPE (RSVPE) - Unknown owner - C:\WINNT\RSVPE.exe
帮忙看一下~我先去 安全模式 修复下试试~！
帅哥坐车不用票 - 2005-11-13 19:25:00
修复了还要删除文件啊，有些鸽子是不改注册表的，文件是关键。
神无 - 2005-11-13 19:25:00
O1 - Hosts: 222.89.109.112 www.99bb.com
O1 - Hosts: 222.89.109.112 99bb.com
O1 - Hosts: 222.89.109.112 www.zdao.com
O1 - Hosts: 222.89.109.112 zdao.com
O1 - Hosts: 222.89.109.112 www.aisex.com
O1 - Hosts: 222.89.109.112 aisex.com
O1 - Hosts: 222.89.109.112 www.qq190.com
O1 - Hosts: 222.89.109.112 qq190.com
O1 - Hosts: 222.89.109.112 www.wanmm.com
O1 - Hosts: 222.89.109.112 wanmm.com
O1 - Hosts: 222.89.109.112 www.qq163.com
O1 - Hosts: 222.89.109.112 qq163.com
O1 - Hosts: 222.89.109.112 www.sex141.com
O1 - Hosts: 222.89.109.112 sex141.com
O1 - Hosts: 222.89.109.112 www.my990.com
O1 - Hosts: 222.89.109.112 my990.com
O1 - Hosts: 222.89.109.112 ad.my990.com
O1 - Hosts: 222.89.109.112 www.ttjj.com
O1 - Hosts: 222.89.109.112 ttjj.com
O1 - Hosts: 222.89.109.112 www.7t7t.com
O1 - Hosts: 222.89.109.112 7t7t.com
O1 - Hosts: 222.89.109.112 www.123987.com
O1 - Hosts: 222.89.109.112 www.123987.com/7sese/
O1 - Hosts: 222.89.109.112 www.oursm.com
O1 - Hosts: 222.89.109.112 oursm.com
O1 - Hosts: 222.89.109.112 www.palacemoon.com
O1 - Hosts: 222.89.109.112 palacemoon.com
O1 - Hosts: 222.89.109.112 18dy.com
O1 - Hosts: 222.89.109.112 www.18dy.com
O1 - Hosts: 222.89.109.112 49m.cn
O1 - Hosts: 222.89.109.112 www.49m.cn
O1 - Hosts: 222.89.109.112 123.xuanji8.com
O1 - Hosts: 222.89.109.112 ohkk.xuanji8.com
O1 - Hosts: 222.89.109.112 123.52lhc.com
O1 - Hosts: 222.89.109.112 7sese.com222.89.109.112 www.7sese.com
O1 - Hosts: 222.89.109.112 www.hao119.com
O1 - Hosts: 222.89.109.112 7sese.com
O1 - Hosts: 222.89.109.112 www.7sese.com
O1 - Hosts: 222.89.109.112 www.hao358.com
O1 - Hosts: 222.89.109.112 www.ee456.com
O1 - Hosts: 222.89.109.112 video.12san.com
O1 - Hosts: 222.89.109.112 www.eachz.com
O1 - Hosts: 222.89.109.112 www.avl.cn
O1 - Hosts: 222.89.109.112 avl.cn
O1 - Hosts: 222.89.109.112 www.98756.net
O1 - Hosts: 222.89.109.112 7sese.org
O1 - Hosts: 222.89.109.112 www.7sese.org
O1 - Hosts: 222.89.109.112 kanvcd.com
O1 - Hosts: 222.89.109.112 www.kanvcd.com
O1 - Hosts: 222.89.109.112 cn.movies.yahoo
O1 - Hosts: 222.89.109.112 www.zfvod.com
O1 - Hosts: 222.89.109.112 zfvod.com
O1 - Hosts: 222.89.109.112 media.netandtv.com
O1 - Hosts: 222.89.109.112 p2p.55660.com
O1 - Hosts: 222.89.109.112 media.netandtv.com
O1 - Hosts: 222.89.109.112 www.sol.sohu.com
O1 - Hosts: 222.89.109.112 www.sexhu.cn
O1 - Hosts: 222.89.109.112 sexhu.cn
O1 - Hosts: 222.89.109.112 www.blogchina.com
O1 - Hosts: 222.89.109.112 5blogchina.com
O1 - Hosts: 222.89.109.112 www.5806.net
O1 - Hosts: 222.89.109.112 zhao999.com
O1 - Hosts: 222.89.109.112 www.zhao999.com
O1 - Hosts: 222.89.109.112 movie.xmfdc.net
O1 - Hosts: 222.89.109.112 www.movie110.com
O1 - Hosts: 222.89.109.112 movie110.com
O1 - Hosts: 222.89.109.112 www.yesky.com
O1 - Hosts: 222.89.109.112 yesky.com
O1 - Hosts: 222.89.109.112 www.178ya.com
O1 - Hosts: 222.89.109.112 178ya.com
O1 - Hosts: 222.89.109.112 www.3668.cn
O1 - Hosts: 222.89.109.112 3668.cn
O1 - Hosts: 222.89.109.112 www.hao45.com
O1 - Hosts: 222.89.109.112 hao45.com
O1 - Hosts: 222.89.109.112 www.5sese.com
O1 - Hosts: 222.89.109.112 5sese.com
O1 - Hosts: 222.89.109.112 woyy.51.net
O1 - Hosts: 222.89.109.112 3668.cn
O1 - Hosts: 222.89.109.112 www.3668.cn
O1 - Hosts: 222.89.109.112 tu68.com
O1 - Hosts: 222.89.109.112 www.tu68.com
O1 - Hosts: 222.89.109.112 avxiu.com
O1 - Hosts: 222.89.109.112 www.avxiu.com
O1 - Hosts: 222.89.109.112 18dy.net
O1 - Hosts: 222.89.109.112 www.18dy.net
O1 - Hosts: 222.89.109.112 avxiu.com
O1 - Hosts: 222.89.109.112 www.avxiu.com
O1 - Hosts: 222.89.109.112 hk.18dy.com
O1 - Hosts: 222.89.109.112 dianying.gghggh.com
O1 - Hosts: 222.89.109.112 lady3.****net
O1 - Hosts: 222.89.109.112 kan56.zj.com
O1 - Hosts: 222.89.109.112 88848.net
O1 - Hosts: 222.89.109.112 www.88848.net
O1 - Hosts: 222.89.109.112 xonline.org
O1 - Hosts: 222.89.109.112 www.xonline.org
O1 - Hosts: 222.89.109.112 dy.nuoy.com
O1 - Hosts: 222.89.109.112 www.korea-av.com
O1 - Hosts: 222.89.109.112 korea-av.com
O1 - Hosts: 222.89.109.112 movie.bucuo.org
O1 - Hosts: 222.89.109.112 mv888.com
O1 - Hosts: 222.89.109.112 www.mv888.com
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - (no file)
O16 - DPF: {56A7DC70-E102-4408-A34A-AE06FEF01586} - http://iebar.t2t2.com/iebar.cab
修复这几项.
O23 - NT 服务: Smarytcer RSVPE (RSVPE) - Unknown owner - C:\WINNT\RSVPE.exe
这个是灰鸽子.
http://forum.ikaka.com/topic.asp?board=28&artid=6202404关于查杀“灰鸽子2005”的一点建议
http://forum.ikaka.com/topic.asp?board=28&artid=5666824灰鸽子查杀方法总结
神无 - 2005-11-13 19:29:00
O23 - NT 服务: Smarytcer RSVPE (RSVPE) - Unknown owner - C:\WINNT\RSVPE.exe
灰鸽子没杀掉,看看这两个帖子.
http://forum.ikaka.com/topic.asp?board=28&artid=6202404关于查杀“灰鸽子2005”的一点建议
http://forum.ikaka.com/topic.asp?board=28&artid=5666824灰鸽子查杀方法总结
风华 - 2005-11-13 19:43:00
文件在哪在哪啊~~~~`在安全模式下还是这个样子~昏迷ING~~
风华 - 2005-11-13 19:52:00
刚才网卡没刷出来大虾给的回复~（我老出现这种网络延时呢？比如上chinaren校友录~往往要刷新N次才能看到最近的同学留言~！有时自己发完了~也要多刷几次才能看见）
看了看帖子~~发现个问题哈~我不知道哪个是病毒注册的系统服务名~~能告诉我么？
神无 - 2005-11-13 19:56:00
Smarytcer RSVPE (RSVPE) 前面那个,或是括号里的那个.反正找到都删了.
风华 - 2005-11-13 19:56:00
已经把“√”去掉了~！
风华 - 2005-11-13 20:06:00
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RSVPE\0000中的图片中的2项删不掉~我去安全模式试试~！
附件:
39466320051113200612.jpg
神无 - 2005-11-13 20:07:00
也有可能是修复的时候以经把病毒程序同时删除了.还有,在扫描工具里的备份里把刚刚修复的那几项灰鸽子的文件删除了.
风华 - 2005-11-13 20:27:00
在安全模式下HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RSVPE\0000中的那2个注册项还是删不掉~~还有我只查找到一个病毒文件~大虾的帖子说一般都是一组文件~怎么回事呀？没找到啊~！不过我现在倒是没再发现病毒了~~现在扫描的日志如下：
HijackThis_zww汉化版扫描日志 V1.99.1
保存于 20:32:13, 日期 2005-11-13
操作系统： Windows 2000 (WinNT 5.00.2195)
浏览器： Internet Explorer v6.00 (6.00.2462.0000)
当前运行的进程：
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
F:\RISING\RAV\Ravmond.exe
F:\RISING\RAV\RavStub.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\nvsvc32.exe
F:\RISING\RAV\CCENTER.EXE
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.exe
F:\RISING\RAV\RAVTIMER.EXE
F:\RISING\RAV\RAVMON.EXE
C:\WINNT\System32\internat.exe
C:\Program Files\Internet Explorer\iexplore.exe
F:\Tencent\QQ\QQ.exe
F:\Tencent\QQ\TIMPlatform.exe
F:\tool.zip\瑞星\HijackThis V1.99.1 完全汉化版\HijackThis1991zww.exe
O3 - IE工具栏增项: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - 启动项HKLM\\Run: [Synchronization Manager] mobsync.exe /logon
O4 - 启动项HKLM\\Run: [SoundMan] soundman.exe
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - 启动项HKLM\\Run: [RavTimer] F:\RISING\RAV\RAVTIMER.EXE
O4 - 启动项HKLM\\Run: [RavMon] F:\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O8 - IE右键菜单中的新增项目: &Download by NetAnts - F:\NETANTS\NAGet.htm
O8 - IE右键菜单中的新增项目: Download &All by NetAnts - F:\NETANTS\NAGetAll.htm
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - F:\Tencent\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - F:\Tencent\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - F:\Tencent\QQ\SendMMS.htm
O14 - IERESET.INF: SEARCH_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=iear=iesearch(&A)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1122820147288
O23 - NT 服务: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - NT 服务: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - rising - F:\RISING\RAV\CCENTER.EXE
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - F:\RISING\RAV\Ravmond.exe
看看是否还有问题？还有我那种网络延迟到底是什么问题~能告诉我一下么？我现在回帖看帖都要刷几次才有最近的~！连我自己发的帖子也是刷几次才能看见！~我是ADSL 512K 网通宽带，走电话线那种的！
风华 - 2005-11-14 19:33:00
还有没有问题呢？还有我那种网络延迟到底是什么问题~能告诉我一下么？我现在回帖看帖都要刷几次才有最近的~！连我自己发的帖子也是刷几次才能看见！~我是ADSL 512K 网通宽带，走电话线那种的！
BlackStone - 2005-11-14 19:39:00
| 引用: |
【风华的贴子】HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RSVPE\0000中的图片中的2项删不掉~我去安全模式试试~！
........................... |
运行Regedt32,找到要删除的项，右键选择权限，设置为Everyone再删除试试
风华 - 2005-11-16 20:36:00
| 引用: |
【风华的贴子】HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RSVPE\0000中的图片中的2项删不掉~我去安全模式试试~！
........................... |
还是删不掉
风华 - 2005-11-18 21:56:00
【回复“风华”的帖子】
© 2000 - 2026 Rising Corp. Ltd.