电脑中毒，请耐心帮忙解决 bbs.ikaka.com

飘啊飘啊飘 - 2006-7-16 11:54:00

下了个病毒（本来不知道），点了后，发现瑞星的伞不在了，然后我就自己手动打开，很可惜没反映。然后我进入安全模式查杀了3个病毒，重启，发现小伞有了，可惜伞却变成了红色的，我手动打开（开启全部监控），很可惜试了没用。然后我又把瑞星卸载删除RINSING的文件夹，重新启动后又装了下瑞星升级到最新版本，，绿色的伞出来了！以为到此结束，可惜，关机变的特别慢，开机后瑞星伞又红了！！！手动仍然开启不了！麻烦解决下

我无邪 - 2006-7-16 11:59:00

请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。

飘啊飘啊飘 - 2006-7-16 12:10:00

2006-07-16,12:00:21

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<NvCplDaemon><; RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [NVIDIA Corporation]
<RavTask><"d:\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<Super Rabbit Winspeed><"D:\MagicSet\winspeed.exe" /autokill:75> [Super Rabbit Soft]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<CheckFaultKernel><C:\WINDOWS\system32\mswdm.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><KB16186M.LOG> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<DVDBurn><C:\WINDOWS\Downloaded Program Files\AfxEdit.dll> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<High Definition Audio Property Page Shortcut><; ; HDAShCut.exe> []
<IMSCMig><; ; C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload> [Microsoft Corporation]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
<Load><; C:\PROGRA~1\svhost32.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<NeroFilterCheck><; ; C:\WINDOWS\system32\NeroCheck.exe> [Ahead Software Gmbh]
<NvCplDaemon><; RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [NVIDIA Corporation]
<NvMediaCenter><; ; RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit> [NVIDIA Corporation]
<nwiz><; ; nwiz.exe /install> []
<PHIME2002A><; ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]
<PHIME2002ASync><; ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<Sony Ericsson PC Suite><; "D:\索爱\Application Launcher\Application Launcher.exe" /Minimized> [Sony Ericsson Mobile Communications AB]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<SoundMAX><; ; "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray> []
<SoundMAXPnP><; ; C:\Program Files\Analog Devices\Core\smax4pnp.exe> []
<ThunderMini><; ; C:\Program Files\Thunder Network\ThunderMini\ThunderMiniShell.exe> []

飘啊飘啊飘 - 2006-7-16 12:11:00

==================================
启动文件夹
服务
[Adobe LM Service / Adobe LM Service]
<"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>
[Autodesk Licensing Service / Autodesk Licensing Service]
<"C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe"><Autodesk>
[NVIDIA Display Driver Service / NVSvc]
<C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[StarWind iSCSI Service / StarWindService]
<D:\Alcohol 120\StarWind\StarWindService.exe><Rocket Division Software>
[Te1net / Te1net]
<><N/A>

==================================
浏览器加载项
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v14.dll, Thunder Networking Technologies,LTD>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <D:\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <d:\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>
[ThunderMini Browser Helper]
{8E6C1C49-F9CE-4311-9FB4-D70E8B0AEAEB} <C:\Program Files\Thunder Network\ThunderMini\ComDlls\XunLeiMiniBHO_002.dll, N/A>
[游一游]
{29269350-EC07-4274-821F-F2E0E2697149} <http://act.youyy.com/YoyyLink.html, N/A>
[信息检索(&R)]
{92780B25-18CC-41C8-B9BE-3C9C571A8263} <D:\MICROS~1\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <D:\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[雨林木风]
{575201F6-B957-4860-BD5C-625BB7629CE4} <http://www.ylmf.com, N/A>
[BitComet工具栏]
{3F1ABCDB-A875-46c1-8345-B72A4567E486} <d:\BitComet\BitCometBar\BitCometBar0.6.dll, N/A>
[左看时报]
{8E8234B5-3D7B-4c83-BF28-6C312044C018} <C:\Program Files\Common Files\yygamenet\IEtoolforleft.dll, >
[Edit Class]
{0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\WINDOWS\system32\CMBEdit.dll, >
[Windows Genuine Advantage Validation Tool]
{17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx, Macromedia, Inc.>
[CPasswordEditCtrl Object]
{E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
[PBActiveX40 Control]
{F2EB8999-766E-4BF6-AAAD-188D398C0D0B} <C:\WINDOWS\system32\CmbPb40.ocx, China Merchants Bank>
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v14.dll, Thunder Networking Technologies,LTD>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[NaviHelperObj Class]
{3E422F49-1566-40D3-B43D-077EF739AC32} <C:\WINDOWS\NaviHelper.dll, TODO: <公司名>>
[BitComet工具栏]
{3F1ABCDB-A875-46C1-8345-B72A4567E486} <d:\BitComet\BitCometBar\BitCometBar0.6.dll, N/A>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <D:\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[CpapView Class]
{77962960-536E-47EC-9DDB-52651519705F} <C:\WINDOWS\system32\cacb.dll, N/A>
[]
{81D1B74C-9531-4D2B-9F49-A236F4930609} <C:\Program Files\Common Files\yygamenet\showbar.dll, >
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <d:\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>
[ThunderMini Browser Helper]
{8E6C1C49-F9CE-4311-9FB4-D70E8B0AEAEB} <C:\Program Files\Thunder Network\ThunderMini\ComDlls\XunLeiMiniBHO_002.dll, N/A>
[左看时报]
{8E8234B5-3D7B-4C83-BF28-6C312044C018} <C:\Program Files\Common Files\yygamenet\IEtoolforleft.dll, >
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx, Macromedia, Inc.>
[&使用迅雷下载]
<d:\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
<d:\Thunder\Program\GetAllUrl.htm, N/A>
[上传到QQ网络硬盘]
<D:\QQ\AddToNetDisk.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://D:\MICROS~1\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
<D:\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<D:\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<D:\QQ\SendMMS.htm, N/A>

飘啊飘啊飘 - 2006-7-16 12:11:00

==================================
正在运行的进程
[PID: 680][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 748][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 772][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\KB16186M.LOG] <N/A><N/A>
[C:\DOCUME~1\朱智强\LOCALS~1\Temp\7nquq.dll] <WinRAR archiver><3, 4, 2, 0>
[PID: 828][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\KB16186M.LOG] <N/A><N/A>
[C:\DOCUME~1\朱智强\LOCALS~1\Temp\7nquq.dll] <WinRAR archiver><3, 4, 2, 0>
[PID: 840][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\KB16186M.LOG] <N/A><N/A>
[PID: 1028][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\KB16186M.LOG] <N/A><N/A>
[PID: 1112][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\KB16186M.LOG] <N/A><N/A>
[PID: 1232][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\KB16186M.LOG] <N/A><N/A>
[PID: 1320][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\KB16186M.LOG] <N/A><N/A>
[PID: 1404][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\KB16186M.LOG] <N/A><N/A>
[PID: 1644][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)>
[C:\WINDOWS\KB16186M.LOG] <N/A><N/A>
[PID: 1752][d:\Rising\Rav\RavStub.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
[C:\WINDOWS\KB16186M.LOG] <N/A><N/A>
[d:\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[d:\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 1988][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\KB16186M.LOG] <N/A><N/A>
[C:\WINDOWS\system32\AcSignIcon.dll] <Autodesk><16.2.54.0>
[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] <Autodesk><16.2.54.0>
[C:\DOCUME~1\朱智强\LOCALS~1\Temp\7nquq.dll] <WinRAR archiver><3, 4, 2, 0>
[C:\WINDOWS\Downloaded Program Files\swflash.dll] <N/A><N/A>
[C:\DOCUME~1\朱智强\LOCALS~1\Temp\gyf.dll] <WinRAR archiver><3, 4, 2, 0>
[C:\WINDOWS\system32\xunleibho_v14.dll] <Thunder Networking Technologies,LTD><4, 6, 0, 62>
[d:\Thunder\ComDlls\XunLeiBHO_002.dll] <Thunder Networking Technologies,LTD><5, 0, 0, 2>
[C:\WINDOWS\system32\msdmo.dll] <N/A><N/A>
[D:\winrar\rarext.dll] <N/A><N/A>
[d:\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 324][C:\WINDOWS\system32\nvsvc32.exe] <NVIDIA Corporation><6.14.10.8391>
[C:\WINDOWS\KB16186M.LOG] <N/A><N/A>
[PID: 384][D:\Alcohol 120\StarWind\StarWindService.exe] <Rocket Division Software><2.6.1 Build 0x20050401>
[C:\WINDOWS\KB16186M.LOG] <N/A><N/A>
[PID: 1076][C:\WINDOWS\system32\msime.exe] <Microsoft Corporation><5.1.2600.2180>
[C:\WINDOWS\KB16186M.LOG] <N/A><N/A>
[C:\DOCUME~1\朱智强\LOCALS~1\Temp\7nquq.dll] <WinRAR archiver><3, 4, 2, 0>
[PID: 1308][D:\Rising\Rav\RavTask.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
[C:\WINDOWS\KB16186M.LOG] <N/A><N/A>
[D:\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[D:\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[D:\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[D:\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\DOCUME~1\朱智强\LOCALS~1\Temp\7nquq.dll] <WinRAR archiver><3, 4, 2, 0>
[PID: 1428][D:\Rising\Rav\Ravmon.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 30>
[D:\Rising\Rav\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 24>
[D:\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[C:\WINDOWS\KB16186M.LOG] <N/A><N/A>
[D:\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[D:\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[D:\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[D:\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[D:\Rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[C:\DOCUME~1\朱智强\LOCALS~1\Temp\7nquq.dll] <WinRAR archiver><3, 4, 2, 0>
[PID: 1504][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\KB16186M.LOG] <N/A><N/A>
[C:\DOCUME~1\朱智强\LOCALS~1\Temp\7nquq.dll] <WinRAR archiver><3, 4, 2, 0>
[PID: 1584][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\KB16186M.LOG] <N/A><N/A>
[PID: 2712][D:\Rising\Rav\Rav.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 75>
[C:\WINDOWS\KB16186M.LOG] <N/A><N/A>
[D:\Rising\Rav\PlugIn\RsPgScan.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 17>
[D:\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[D:\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[D:\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[D:\Rising\Rav\RavUI.Dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 61>
[D:\Rising\Rav\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 24>
[D:\Rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[D:\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\DOCUME~1\朱智强\LOCALS~1\Temp\7nquq.dll] <WinRAR archiver><3, 4, 2, 0>
[d:\Rising\Rav\Scanner.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30>
[D:\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[C:\WINDOWS\system32\AcSignIcon.dll] <Autodesk><16.2.54.0>
[D:\Rising\Rav\RavUIMsg.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 25>
[C:\DOCUME~1\朱智强\LOCALS~1\Temp\gyf.dll] <WinRAR archiver><3, 4, 2, 0>
[d:\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 3112][d:\Maxthon\Maxthon.exe] <Maxthon International Ltd.><1, 5, 6, 42>
[d:\Maxthon\maxzlib.dll] < ><1, 0, 0, 2>
[C:\WINDOWS\KB16186M.LOG] <N/A><N/A>
[C:\WINDOWS\system32\AcSignIcon.dll] <Autodesk><16.2.54.0>
[C:\WINDOWS\system32\xunleibho_v14.dll] <Thunder Networking Technologies,LTD><4, 6, 0, 62>
[C:\DOCUME~1\朱智强\LOCALS~1\Temp\gyf.dll] <WinRAR archiver><3, 4, 2, 0>
[C:\DOCUME~1\朱智强\LOCALS~1\Temp\7nquq.dll] <WinRAR archiver><3, 4, 2, 0>
[d:\Maxthon\Services\RealTime\real_time.dll] <><1, 0, 0, 1>
[d:\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx] <Macromedia, Inc.><8,0,24,0>
[PID: 2880][D:\Thunder\Program\Thunder5.exe] <Thunder Networking Technologies,LTD><5.2.0.207>
[D:\Thunder\Program\UpdateDownload.dll] <Thunder Networking Technologies,LTD><1, 0, 1, 8>
[D:\Thunder\Program\download_interface.dll] <Thunder Networking Technologies,LTD><1, 0, 3, 70>
[D:\Thunder\Program\log4cplus.dll] <><1, 0, 2, 1>
[D:\Thunder\Program\stlport_vc646.dll] <STLport Consulting, Inc.><4.6.2003.1031>
[D:\Thunder\Program\asyn_dns.dll] <N/A><N/A>
[D:\Thunder\Program\msgmanage.dll] <Thunder Networking Technologies,LTD><1, 0, 0, 15>
[D:\Thunder\Program\historyinfo_manage.dll] <Thunder Networking Technologies,LTD><5, 2, 0, 148>
[C:\WINDOWS\KB16186M.LOG] <N/A><N/A>
[D:\Thunder\Program\RegisterDll.dll] <Thunder Networking Technologies,LTD><1, 2, 0, 7>
[D:\Thunder\Program\FloatBar.dll] <Thunder Networking Technologies,LTD><1, 0, 0, 2>
[D:\Thunder\Plugins\TingTing\TingTing.dll] <Thunder Networking Technologies,LTD><1, 1, 0, 8>
[D:\Thunder\Components\InMedia\iEmbedShell.dll] <　><1, 0, 0, 10>
[d:\Thunder\Components\InMedia\iEmbed03.dll] <　><2, 2, 1, 33>
[D:\Thunder\Components\P4PClient\P4PClient.dll] <Thunder Networking Technologies,LTD><1, 0, 1, 6>
[C:\DOCUME~1\朱智强\LOCALS~1\Temp\gyf.dll] <WinRAR archiver><3, 4, 2, 0>
[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[C:\DOCUME~1\朱智强\LOCALS~1\Temp\7nquq.dll] <WinRAR archiver><3, 4, 2, 0>
[d:\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[D:\Thunder\Program\iTargetAd.dll] <Thunder Networking Technologies,LTD><1, 0, 0, 60>
[C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx] <Macromedia, Inc.><8,0,24,0>
[C:\WINDOWS\system32\AcSignIcon.dll] <Autodesk><16.2.54.0>
[PID: 736][E:\downs\sreng2\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\WINDOWS\KB16186M.LOG] <N/A><N/A>
[C:\DOCUME~1\朱智强\LOCALS~1\Temp\7nquq.dll] <WinRAR archiver><3, 4, 2, 0>

飘啊飘啊飘 - 2006-7-16 12:12:00

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

我无邪 - 2006-7-16 12:17:00

运行(双击)System Repair Engineer，点“启动项目，服务，点“Win32服务应用程序”勾选“隐藏微软服务”选中病毒服务Te1net，选择“删除服务”点“设置”选择“否”
关闭所有浏览窗口以及一些不必要的程序
运行(双击)System Repair Engineer，使用“系统修复，浏览器加载项”来删除以下选项。
C:\WINDOWS\system32\CMBEdit.dll
C:\WINDOWS\NaviHelper.dll
C:\WINDOWS\system32\cacb.dll
运行(双击)System Repair Engineer，使用“启动项目，注册表”选中要修复的项
KB16186M.LOG
，点“编辑”在“值”里删除KB16186M.LOG
重新启动电脑, 开机检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式进入Windows
运行(双击)System Repair Engineer，使用“启动项目，注册表”来删除以下选项。
C:\WINDOWS\system32\mswdm.exe
C:\WINDOWS\Downloaded Program Files\AfxEdit.dll
C:\PROGRA~1\svhost32.exe
双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示确定更改时，单击“是”，清除“隐藏已知文件类型的扩展名
删除
C:\WINDOWS\system32\mswdm.exe
C:\WINDOWS\Downloaded Program Files\AfxEdit.dll
C:\PROGRA~1\svhost32.exe
C:\WINDOWS\system32\CMBEdit.dll
C:\WINDOWS\NaviHelper.dll
C:\WINDOWS\system32\cacb.dll
C:\WINDOWS\KB16186M.LOG
重启回到正常模式，请再扫份日志粘上来。
记得再修复你的瑞星。

飘啊飘啊飘 - 2006-7-16 12:46:00

您好！我的电脑在按你一步步的提示下做到了，重新启动进去安全模式。可是我的安全模式进不去了，具体：按了F8选择了安全模式，出现欢迎界面，选择用户登陆，我选择了自己的名字登陆，显示，加载个人设置，1秒后又显示正在注销。换个ADMIN的用户名进去，同样的显示。我重新启动继续进入安全模式，仍然这样，我又重新启动进去正常模式，很可惜跟进去安全模式一样的症状，我现在机器开不开了！一直停在欢迎使用！（我现在在用笔记本发贴的）

飘啊飘啊飘 - 2006-7-16 18:21:00

机器都开不了了怎么办啊？？

我无邪 - 2006-7-16 19:41:00

机器开不了，那只能重装系统了，如果重装也不行，那很可能就是硬件问题
这种情况你就赶紧找你的电脑经销商。

瑞星卡卡安全论坛