【求助】高手救救我.....监控开不了了...绿伞变红伞了!!!!! bbs.ikaka.com

wbhzrh - 2006-8-1 8:33:00

监控开不出瑞星杀毒也开不出救命啊高手们...... 以下是我扫描的报告

ystem Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation]
<bgswitch><C:\WINDOWS\system32\bgswitch.exe> []
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]
<C-Media Mixer><Mixer.exe /startup> [C-Media Electronic Inc. (www.cmedia.com.tw)]
<MSPY2002><C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC> []
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
<Desktop><C:\WINDOWS\system32\rundll32.exe "C:\Program Files\DeskAdTop\Run.dll" ,Rundll> []
<helper.dll><C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32> []
<Knight V><> []
<StormCodec_Helper><"C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti> []
<MINI_BFYY><C:\Program Files\Ringz Studio\Storm Downloader\StormDownloader.exe> [深圳市三代科技开发有限公司]
<stup.exe><C:\PROGRA~1\TENCENT\Adplus\stup.exe> [Tencent]
<SoundMam><C:\WINDOWS\system32\SVOHOST.exe> []
<CnsMin><Rundll32.exe C:\WINDOWS\downlo~1\CnsMin.dll,Rundll32> [北京三七二一科技有限公司]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<CheckFaultKernel><C:\WINDOWS\system32\mswdm.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\nfned.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
<{E57F13EA-B10C-4845-B710-5B0521089AAE}><C:\WINDOWS\system32\Blmdq.dll> []
<{0B76EBFC-F439-434B-B4E5-A69965C066CC}><C:\WINDOWS\system32\Gtdvkh.dll> []
<{5A8B4355-8875-4D8E-A46D-874AA8937E11}><C:\WINDOWS\system32\Xfeir.dll> []

==================================
启动文件夹
[TL-WN320G 1.0 Utility]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\TL-WN320G 1.0 Utility.lnk><N>
[腾讯QQ]
<C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\腾讯QQ.lnk><N>

==================================
服务
[Rising Proxy Service / RfwProxySrv]
<c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService]
<c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>

wbhzrh - 2006-8-1 8:33:00

==================================
浏览器加载项
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v4.dll, >
[MonitorURL Class]
{08A312BB-5409-49FC-9347-54BB7D069AC6} <C:\PROGRA~1\DESKAD~1\deskipn.dll, >
[]
{0B76EBFC-F439-434B-B4E5-A69965C066CC} <C:\WINDOWS\system32\Gtdvkh.dll, N/A>
[Shockwave Flash Object]
{14A21378-5BB1-4BC4-95D5-5D3F51527F6F} <C:\WINDOWS\system32\smflash.ocx, Macromedia, Inc.>
[NB46 BHO Object]
{1A50BDD0-01A6-4D58-958B-B9BC66789327} <C:\PROGRA~1\nb46.com\NB46TO~1.DLL, >
[FltSetUp Class]
{1D49D58D-5C84-4B50-8359-D9809BEB2B32} <C:\Program Files\Internet Explorer\Connection Wizard\icwnet.dll, N/A>
[IeCatch5 Class]
{2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <C:\PROGRA~1\FlashGet\jccatch.dll, FlashGet>
[雅虎助手]
{406F94F0-504F-4a40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll, Yahoo!>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[]
{5A8B4355-8875-4D8E-A46D-874AA8937E11} <C:\WINDOWS\system32\Xfeir.dll, N/A>
[ActiveBHO Class]
{63C55A7F-6E29-8D4F-5C76-4F850F28D13A} <C:\Progra~1\DoDoorRSSFinder\ActiveBandObject.dll, >
[]
{669751ED-D558-49AE-B01A-3B374CC7910E} <C:\WINDOWS\system32\ssup.dll, TENCENT>
[BandIE Class]
{77FEF28E-EB96-44FF-B511-3185DEA48697} <C:\Program Files\Baidu\Bar\BaiduBar.dll, Baidu.com, Inc.>
[Status Class]
{7BDAF75A-0D6F-4F50-AFE9-333D08DF4005} <C:\Program Files\baigoo\BGooBHO.dll, >
[IEHlprObj Class]
{999ADFA2-8AD1-47ff-97FC-69FB847458F4} <C:\Progra~1\NetMeeting\nmview.dll, Microsoft Corporation>
[Google Toolbar Helper]
{AA58ED58-01DD-4d91-8333-CF10577473F7} <c:\program files\google\googletoolbar1.dll, Google Inc.>
[IEHlprObj Class]
{D424FE4E-CAF9-4fdd-BC5F-E6E6B91D53BF} <C:\Progra~1\NetMeeting\conf.dll, Microsoft Corporation>
[]
{E57F13EA-B10C-4845-B710-5B0521089AAE} <C:\WINDOWS\system32\Blmdq.dll, N/A>
[番茄花园]
{6096E38F-5AC1-4391-8EC4-75DFA92FB32F} <http://www.tomatolei.com, N/A>
[易趣购物]
{BE9C13C3-9E46-4db1-BC05-BD8DA44599F2} <http://adfarm.mediaplex.com/ad/ck/4080-22910-9640-151?cn=song;icon;hp&mpro=http://www.ebay.com.cn, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[FlashGet]
{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\PROGRA~1\FlashGet\flashget.exe, FlashGet.com>
[易趣购物]
{DE607144-AC19-424e-868A-8D70ABDF119A} <http://click2.ad4all.net/url2/urlmanage/url.asp?id=5, N/A>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[雅虎助手]
{406F94F0-504F-4a40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll, Yahoo!>
[&Google]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar1.dll, Google Inc.>
[百度超级搜霸]
{B580CF65-E151-49C3-B73F-70B13FCA8E86} <C:\Program Files\Baidu\Bar\BaiduBar.dll, Baidu.com, Inc.>
[NB46]
{56E88004-7AF8-474C-BB30-76E0B7B2B003} <C:\PROGRA~1\nb46.com\NB46TO~1.DLL, >
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FlashGet\fgiebar.dll, Amaze Soft>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[WebActivater Control]
{C661F36D-DF85-4EF4-83C7-E107B83D04B1} <C:\WINDOWS\system32\3DShowVM.ocx, QQ>
[Rising Web Scan Object]
{E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.>
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v4.dll, >
[Google Script Object]
{00EF2092-6AC5-47C0-BD25-CF2D5D657FEB} <c:\program files\google\googletoolbar1.dll, Google Inc.>
[MonitorURL Class]
{08A312BB-5409-49FC-9347-54BB7D069AC6} <C:\PROGRA~1\DESKAD~1\deskipn.dll, >
[]
{0B76EBFC-F439-434B-B4E5-A69965C066CC} <C:\WINDOWS\system32\Gtdvkh.dll, N/A>
[Tencent Browser Helper]
{0C7C23EF-A848-485B-873C-0ED954731014} <C:\Program Files\TENCENT\Adplus\SSAddr.dll, Tencent>
[Shockwave Flash Object]
{14A21378-5BB1-4BC4-95D5-5D3F51527F6F} <C:\WINDOWS\system32\smflash.ocx, Macromedia, Inc.>
[NB46 BHO Object]
{1A50BDD0-01A6-4D58-958B-B9BC66789327} <C:\PROGRA~1\nb46.com\NB46TO~1.DLL, >
[FltSetUp Class]
{1D49D58D-5C84-4B50-8359-D9809BEB2B32} <C:\Program Files\Internet Explorer\Connection Wizard\icwnet.dll, N/A>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[&Google]
{2318C2B1-4965-11D4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar1.dll, Google Inc.>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[IeCatch5 Class]
{2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <C:\PROGRA~1\FlashGet\jccatch.dll, FlashGet>
[雅虎助手]
{406F94F0-504F-4A40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll, Yahoo!>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[NB46]

wbhzrh - 2006-8-1 8:34:00

{56E88004-7AF8-474C-BB30-76E0B7B2B003} <C:\PROGRA~1\nb46.com\NB46TO~1.DLL, >
[]
{5A8B4355-8875-4D8E-A46D-874AA8937E11} <C:\WINDOWS\system32\Xfeir.dll, N/A>
[ActiveBHO Class]
{63C55A7F-6E29-8D4F-5C76-4F850F28D13A} <C:\Progra~1\DoDoorRSSFinder\ActiveBandObject.dll, >
[]
{669751ED-D558-49AE-B01A-3B374CC7910E} <C:\WINDOWS\system32\ssup.dll, TENCENT>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[BandIE Class]
{77FEF28E-EB96-44FF-B511-3185DEA48697} <C:\Program Files\Baidu\Bar\BaiduBar.dll, Baidu.com, Inc.>
[Status Class]
{7BDAF75A-0D6F-4F50-AFE9-333D08DF4005} <C:\Program Files\baigoo\BGooBHO.dll, >
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[IEHlprObj Class]
{999ADFA2-8AD1-47FF-97FC-69FB847458F4} <C:\Progra~1\NetMeeting\nmview.dll, Microsoft Corporation>
[Tool Class]
{A7F05EE4-0426-454F-8013-C41E3596E9E9} <C:\Program Files\Baidu\Bar\BaiduBar.dll, Baidu.com, Inc.>
[Google Toolbar Helper]
{AA58ED58-01DD-4D91-8333-CF10577473F7} <c:\program files\google\googletoolbar1.dll, Google Inc.>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[百度超级搜霸]
{B580CF65-E151-49C3-B73F-70B13FCA8E86} <C:\Program Files\Baidu\Bar\BaiduBar.dll, Baidu.com, Inc.>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[WebActivater Control]
{C661F36D-DF85-4EF4-83C7-E107B83D04B1} <C:\WINDOWS\system32\3DShowVM.ocx, QQ>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\Flash85.ocx, Macromedia, Inc.>
[IEHlprObj Class]
{D424FE4E-CAF9-4FDD-BC5F-E6E6B91D53BF} <C:\Progra~1\NetMeeting\conf.dll, Microsoft Corporation>
[TencentVmpCtl Class]
{D9819BD5-422B-4281-8523-726466ED692B} <C:\Program Files\Tencent\Viewpoint Media Player\AxMetaStream.dll, Viewpoint Corporation>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FlashGet\fgiebar.dll, Amaze Soft>
[Rising Web Scan Object]
{E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.>
[]
{E57F13EA-B10C-4845-B710-5B0521089AAE} <C:\WINDOWS\system32\Blmdq.dll, N/A>
[&使用暴风下载器下载]
<C:\Program Files\Ringz Studio\Storm Downloader\geturl.htm, N/A>
[上传到QQ网络硬盘]
<C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用网际快车下载]
<C:\PROGRA~1\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<C:\PROGRA~1\FlashGet\jc_all.htm, N/A>
[添加到QQ自定义面板]
<C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>
[雅虎搜索]
<res://C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll/246, N/A>

==================================
正在运行的进程
[PID: 436][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 656][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 680][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 724][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 0, 0, 0>
[PID: 736][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 884][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 932][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 0, 0, 0>
[PID: 1016][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 0, 0, 0>
[PID: 1100][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1196][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1224][c:\program files\rising\rfw\rfwsrv.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 32>
[c:\program files\rising\rfw\RfwRule.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 13>
[c:\program files\rising\rfw\rfwlog.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 6>
[c:\program files\rising\rfw\Rfwdrv.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 21>
[c:\program files\rising\rfw\MonDrv.dll] <rs><1, 0, 0, 4>
[c:\program files\rising\rfw\ProcLib.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 9>
[PID: 1556][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\KB896425.log] <N/A><N/A>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 0, 0, 0>
[C:\WINDOWS\downlo~1\Xylgt.dll] <Tencent><4, 1, 7, 72>
[C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324>
[C:\PROGRA~1\3721\alrex.dll] <><1, 0, 1, 1001>
[C:\WINDOWS\system32\winscok.dll] <N/A><N/A>
[C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 1, 5>
[C:\Program Files\baigoo\bgoohk.dll] < ><1, 0, 0, 1007>
[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[PID: 1636][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)>
[PID: 1736][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[c:\windows\system32\tasklist.dll] <N/A><N/A>
[PID: 1756][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 376][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 0, 0, 0>
[PID: 428][C:\WINDOWS\system32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: dnsrv(bld4act)>
[PID: 492][C:\WINDOWS\system32\winmer.exe] <Microsoft Corporation><5.1.2600.0>
[C:\WINDOWS\system32\KB896425.log] <N/A><N/A>
[PID: 232][C:\WINDOWS\Mixer.exe] <C-Media Electronic Inc. (www.cmedia.com.tw)><1.60>
[C:\WINDOWS\system32\KB896425.log] <N/A><N/A>
[C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324>
[C:\WINDOWS\downlo~1\Xylgt.dll] <Tencent><4, 1, 7, 72>
[C:\WINDOWS\system32\winscok.dll] <N/A><N/A>
[C:\WINDOWS\System32\cmnprop.dll] <C-Media Corporation><5.00.2195.12>
[C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 1, 5>
[PID: 648][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] <RealNetworks, Inc.><0.1.0.3208>
[C:\WINDOWS\system32\KB896425.log] <N/A><N/A>
[C:\WINDOWS\downlo~1\Xylgt.dll] <Tencent><4, 1, 7, 72>
[C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324>
[PID: 832][C:\WINDOWS\system32\rundll32.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\KB896425.log] <N/A><N/A>
[C:\Program Files\DeskAdTop\Run.dll] <><1, 0, 0, 1>
[C:\WINDOWS\downlo~1\Xylgt.dll] <Tencent><4, 1, 7, 72>
[C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324>
[C:\WINDOWS\system32\winscok.dll] <N/A><N/A>
[C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 1, 5>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 0, 0, 0>
[C:\Program Files\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\baigoo\bgoohk.dll] < ><1, 0, 0, 1007>
[PID: 784][C:\WINDOWS\system32\rundll32.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\KB896425.log] <N/A><N/A>
[C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324>
[C:\WINDOWS\downlo~1\Xylgt.dll] <Tencent><4, 1, 7, 72>
[C:\PROGRA~1\3721\autolive.dll] <><1, 1, 4, 1026>
[PID: 1044][C:\Program Files\Ringz Studio\Storm Downloader\StormDownloader.exe] <深圳市三代科技开发有限公司><1, 1, 0, 4>
[C:\Program Files\Ringz Studio\Storm Downloader\boost_thread-vc6-mt-1_31.dll] <N/A><N/A>
[C:\WINDOWS\system32\KB896425.log] <N/A><N/A>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 0, 0, 0>
[C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324>
[C:\WINDOWS\downlo~1\Xylgt.dll] <Tencent><4, 1, 7, 72>
[PID: 1420][C:\Program Files\Ringz Studio\Storm Downloader\TDUpdate.exe] <N/A><N/A>

wbhzrh - 2006-8-1 8:35:00

[C:\WINDOWS\system32\KB896425.log] <N/A><N/A>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 0, 0, 0>
[PID: 200][C:\WINDOWS\system32\SVOHOST.exe] <N/A><N/A>
[C:\WINDOWS\system32\KB896425.log] <N/A><N/A>
[C:\WINDOWS\system32\winscok.dll] <N/A><N/A>
[C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324>
[C:\WINDOWS\downlo~1\Xylgt.dll] <Tencent><4, 1, 7, 72>
[C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 1, 5>
[C:\Program Files\baigoo\bgoohk.dll] < ><1, 0, 0, 1007>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 0, 0, 0>
[PID: 1840][C:\WINDOWS\system32\Rundll32.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\KB896425.log] <N/A><N/A>
[C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 1, 5>
[C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324>
[C:\WINDOWS\downlo~1\Xylgt.dll] <Tencent><4, 1, 7, 72>
[C:\WINDOWS\system32\winscok.dll] <N/A><N/A>
[PID: 972][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\KB896425.log] <N/A><N/A>
[C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 1, 5>
[C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324>
[C:\WINDOWS\downlo~1\Xylgt.dll] <Tencent><4, 1, 7, 72>
[C:\WINDOWS\system32\winscok.dll] <N/A><N/A>
[PID: 2436][C:\Program Files\Wireless LAN Utility\SiWake.exe] <TP-LINK><1, 0, 0, 10>
[C:\Program Files\Wireless LAN Utility\SiSPkt.dll] <Silicon Integrated Systems Corp.><1, 0, 0, 45>
[C:\WINDOWS\system32\KB896425.log] <N/A><N/A>
[C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 1, 5>
[C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324>
[C:\WINDOWS\downlo~1\Xylgt.dll] <Tencent><4, 1, 7, 72>
[C:\WINDOWS\system32\winscok.dll] <N/A><N/A>
[PID: 2468][C:\WINDOWS\system32\conime.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\KB896425.log] <N/A><N/A>
[C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 1, 5>
[C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324>
[C:\WINDOWS\downlo~1\Xylgt.dll] <Tencent><4, 1, 7, 72>
[C:\WINDOWS\system32\winscok.dll] <N/A><N/A>
[PID: 2652][C:\WINDOWS\system32\wbem\wmiprvse.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 2964][c:\program files\rising\rfw\RfwMain.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 51>
[c:\program files\rising\rfw\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23>
[C:\WINDOWS\system32\KB896425.log] <N/A><N/A>
[c:\program files\rising\rfw\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[c:\program files\rising\rfw\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 1, 5>
[C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324>
[C:\WINDOWS\downlo~1\Xylgt.dll] <Tencent><4, 1, 7, 72>
[C:\WINDOWS\system32\winscok.dll] <N/A><N/A>
[PID: 3288][C:\Program Files\Wireless LAN Utility\SISCFG.exe] <TP-LINK><1, 0, 4, 22>
[C:\Program Files\Wireless LAN Utility\SiSPkt.dll] <Silicon Integrated Systems Corp.><1, 0, 0, 45>
[C:\Program Files\Wireless LAN Utility\Protect.DLL] <sis><1, 0, 0, 2>
[C:\WINDOWS\system32\KB896425.log] <N/A><N/A>
[C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 1, 5>
[C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324>
[C:\WINDOWS\downlo~1\Xylgt.dll] <Tencent><4, 1, 7, 72>
[C:\WINDOWS\system32\winscok.dll] <N/A><N/A>
[PID: 3444][C:\Program Files\baigoo\bgoomain.exe] <BGoo><1, 0, 0, 1006>
[C:\WINDOWS\system32\KB896425.log] <N/A><N/A>
[C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 1, 5>
[C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324>
[C:\WINDOWS\downlo~1\Xylgt.dll] <Tencent><4, 1, 7, 72>
[C:\WINDOWS\system32\winscok.dll] <N/A><N/A>
[C:\Program Files\baigoo\bgoohk.dll] < ><1, 0, 0, 1007>
[C:\Program Files\baigoo\bgooex.dll] <><1, 0, 0, 1007>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 0, 0, 0>
[PID: 3780][C:\Program Files\Tencent\TT\TTraveler.exe] <腾讯公司><3.0.0.250>
[C:\WINDOWS\system32\KB896425.log] <N/A><N/A>
[C:\Program Files\baigoo\bgoohk.dll] < ><1, 0, 0, 1007>
[C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 1, 5>
[C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324>
[C:\WINDOWS\downlo~1\Xylgt.dll] <Tencent><4, 1, 7, 72>
[C:\WINDOWS\system32\winscok.dll] <N/A><N/A>
[C:\PROGRA~1\3721\autolive.dll] <><1, 1, 4, 1026>
[C:\Program Files\Tencent\TT\Plugins\QQFloatBar\QQFloatBar4TT2.dll] <腾讯公司><1, 1, 0, 5>
[C:\Program Files\Tencent\TT\Plugins\TWeather\TWeather.dll] <><1, 0, 0, 3>
[C:\Program Files\Tencent\TT\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 4>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 0, 0, 0>
[C:\Program Files\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\WINDOWS\system32\macromed\flash\Flash85.ocx] <Macromedia, Inc.><8,5,0,133>
[C:\WINDOWS\system32\UNISPIM5.IME] <北京紫光华宇软件股份有限公司><5.0.0.5076>
[PID: 3948][C:\WINDOWS\system32\notepad.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\KB896425.log] <N/A><N/A>
[C:\Program Files\baigoo\bgoohk.dll] < ><1, 0, 0, 1007>
[C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 1, 5>
[C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324>
[C:\WINDOWS\downlo~1\Xylgt.dll] <Tencent><4, 1, 7, 72>
[C:\WINDOWS\system32\winscok.dll] <N/A><N/A>
[PID: 3244][D:\新建文件夹 (2)\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\WINDOWS\system32\KB896425.log] <N/A><N/A>
[C:\Program Files\baigoo\bgoohk.dll] < ><1, 0, 0, 1007>
[C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 1, 5>
[C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324>
[C:\WINDOWS\downlo~1\Xylgt.dll] <Tencent><4, 1, 7, 72>
[C:\WINDOWS\system32\winscok.dll] <N/A><N/A>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 0, 0, 0>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

wbhzrh - 2006-8-1 9:08:00

高手们帮帮我啊!!!!!!!!!!

wbhzrh - 2006-8-1 9:21:00

哇没人理啊救救我吧各位大侠!!!!

wbhzrh - 2006-8-1 9:42:00

99woa

wbhzrh - 2006-8-1 15:43:00

高手们帮帮我啊先谢了啊急死我了......

呵呵合乎 - 2006-8-1 15:55:00

说实话我眼睛都花了

wbhzrh - 2006-8-1 16:03:00

不好意思拉不过一定要救我谢谢了!!!!

呵呵合乎 - 2006-8-1 16:05:00

打开注册表将含有winmer的项目删除，再到进程中删除这个文件，重新启动计算机，一切恢复正常，防火墙自动启动了。

wbhzrh - 2006-8-1 16:07:00

谢了我去试试

wbhzrh - 2006-8-1 16:11:00

不过注册表怎么开啊? 帮人帮到底吗谢谢了

呵呵合乎 - 2006-8-1 16:17:00

开始→运行→regedit+回车
conime.exe是BFGhost 1.0远程控制后门程序的一部分。这个后门程序能够运行攻击者访问你的计算机，窃取密码和个人数据。这个进程的安全等级是建议立即进行删除。
第1步：
用Msconfig来屏蔽(点开始—运行—输入msconfig—回车，最后一项目conime.exe前的对号)，但注册表还是残留它的，建议用注册表编辑器

进入注册表编辑器(点开始—运行—输入regedit—回车)
逐项进入分支：
HKEY_LOCAL_MACHINE
-Software
--Microsoft
---Windows
----CurrentVersion
-----Run
看Run里面(右侧窗口里)有没有这个conime.exe，有就删除

另外在HKEY_CURRENT_USER的相同分支下，也有Run，必须也要看看！

第2步：
重启，搜索看有没有conime.exe这个文件，删了它

呵呵合乎 - 2006-8-1 16:25:00

别的没什么了
重新修复一下瑞星杀毒软件..
如果杀毒软件可以打开,但是伞还是红色的没有打开
进行:

开始→设置→控制面板→管理工具→服务
找到RsRavMon service这项
启动类型:自动
服务状态:启动
重起看看是不是OK了?

ccoccocco - 2006-8-1 17:35:00

我也处于红伞状态,而且用:
开始→设置→控制面板→管理工具→服务
找到RsRavMon service这项
启动类型:自动
服务状态:启动

被显示错误,无法启动...

wbhzrh - 2006-8-1 18:48:00

不行啊监控还是开不出大家救救我啊

wbhzrh - 2006-8-1 19:57:00

还有高手吗帮帮我啊急.......

没人比我菜 - 2006-8-1 20:02:00

...
你的问题太多.格了吧...

wbhzrh - 2006-8-1 20:04:00

什么呀不行的

wbhzrh - 2006-8-1 20:18:00

在线等啊大家帮帮忙

wbhzrh - 2006-8-1 20:40:00

大家帮忙啊 ......

zjjx - 2006-8-1 20:44:00

同样的绿伞变红伞问题，我用了三年多的瑞星，为这毛病我上卡卡已不知其数了。
慢性病——医不好的——可恨这几天又到了发作期。
故也帮你顶顶——还望专家来给你会诊一下，咱也得点好处，嘿嘿！！！

wbhzrh - 2006-8-1 20:58:00

e....没人理啊....急盼有大侠相救....

Art - 2006-8-1 21:17:00

先看看启动里面有没有什么可疑的启动项，有的话勾掉。重起。
然后用卸载程序修复一下瑞星，再不行把瑞星卸了重装。

li2008fan - 2006-8-1 21:25:00

汗,楼上大哥说的好像有理哦

∮轩＄风 - 2006-8-1 21:34:00

修复吧或者是重新装

wbhzrh - 2006-8-13 20:13:00

不行啊大家帮我啊
删都不能删啊!!!!!!!!!!!!!!!!!!!!!!!!!!!

zjdouya - 2006-8-13 20:35:00

我的瑞星杀毒软件18.39.42所有监控已禁用!在右下脚有个红色的小伞。我曾经卸载重装、修复过都没有用，启动后绿伞就变为红伞了。如何是好？望高人指点。

westbeck - 2006-8-13 20:38:00

请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。谢谢．．．

瑞星卡卡安全论坛