瑞星杀不了毒怎么办？【求助】追加上了日志 bbs.ikaka.com

sarahbirch945 - 2006-8-10 18:59:00

我有两台电脑，一台瑞星用得好好的，但是另一台手提电脑在没装瑞星之前就中毒了，今天我把瑞星的最新版本做成安装包，想替我的手提杀个毒的，但是才开始安装，就告诉我瑞星安装包要么被病毒篡改了，要么安装信息不完全，我忽略了这个问题后继续安装，结果又告诉我病毒库也无法装上去，我再次忽略这个问题，继续安装。整个安装完成后，杀了几个内存里的病毒，之后就没办法杀毒了，杀什么地方都告诉我“用户中止”。
而且，手提里的瑞星还是一把黄伞！
想从网络上求救，但是我把网线接上去后老是“登陆超时……”，从那台电脑我无法上网了。
求救：我现在该怎么办？

日志在第二页

sarahbirch945 - 2006-8-10 19:04:00

监控也只能打开漏洞、内存、注册表三项，其他的，我尝试了启用，但是，被告知无法启用……

sarahbirch945 - 2006-8-10 19:30:00

没人知道该怎么办吗？5555……

baohe - 2006-8-10 19:35:00

【回复“sarahbirch945”的帖子】
贴SREng扫的日志看看

sarahbirch945 - 2006-8-10 19:39:00

引用:

【baohe的贴子】【回复“sarahbirch945”的帖子】
贴SREng扫的日志看看
………………

那是什么东东？汗

春流到夏爱娜 - 2006-8-10 19:46:00

我原先也和楼主差不多，我有瑞星工程师给我的解决办法，现在此处貼出来，让大家参考~！我一修好后就貼上了~~！
http://forum.ikaka.com/topic.asp?board=28&artid=8126559

修炼忍耐 - 2006-8-10 19:47:00

你可以来这个网站上下载超级兔子然后用清理王上网精灵 IE修复专家来解决 http://www.pctutu.com/

春流到夏爱娜 - 2006-8-10 19:50:00

还有一点要补充，如果你的机子不能上网，在一个能上网的机子上弄好后，复制到一张软盘里，再到中毒机中使用~~！如果还不行，就用超级兔子强力修复winsock2 不过修复完后要重装瑞星了~~！
再不行的话我只能说重装系统了，也许其他人会有办法的~~！

mopery - 2006-8-10 19:51:00

http://forum.ikaka.com/topic.asp?board=28&artid=6979213第4楼下载System Repair Engineer导出全部日志

sarahbirch945 - 2006-8-10 19:58:00

引用:

【春流到夏爱娜的贴子】我原先也和楼主差不多，我有瑞星工程师给我的解决办法，现在此处貼出来，让大家参考~！我一修好后就貼上了~~！
http://forum.ikaka.com/topic.asp?board=28&artid=8126559
………………

2、定位到以下键值：
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2
这个怎么定位呀？
那个文档数据是做什么用的？

sarahbirch945 - 2006-8-10 19:59:00

引用:

【修炼忍耐的贴子】你可以来这个网站上下载超级兔子然后用清理王上网精灵 IE修复专家来解决 http://www.pctutu.com/
………………

现在那台机子，登不了网啊……

sarahbirch945 - 2006-8-10 20:00:00

引用:

【春流到夏爱娜的贴子】还有一点要补充，如果你的机子不能上网，在一个能上网的机子上弄好后，复制到一张软盘里，再到中毒机中使用~~！如果还不行，就用超级兔子强力修复winsock2 不过修复完后要重装瑞星了~~！
再不行的话我只能说重装系统了，也许其他人会有办法的~~！
………………

我那台ibm没有软驱……狂汗
用u盘行不行？

sarahbirch945 - 2006-8-10 20:01:00

引用:

【mopery的贴子】http://forum.ikaka.com/topic.asp?board=28&artid=6979213第4楼下载System Repair Engineer导出全部日志

………………

问题就在，那台电脑现在登不了网络……55……

mopery - 2006-8-10 20:04:00

移动硬盘 MP3

sarahbirch945 - 2006-8-10 20:08:00

引用:

【mopery的贴子】移动硬盘 MP3
………………

把那个程序装到中毒的电脑上就可以了吗？
and在哪里导出日志？
那个程序和瑞星是兼容的吧？不冲突吧？

被判多妻 - 2006-8-10 20:10:00

我现在杀毒没有毒了，可是在进程里面还有svchost.exe

mopery - 2006-8-10 20:11:00

你在这机下载好然后用U盘复制到那机..打开SRE 智能扫描扫描保存日志...然后把日志再复制到U盘..发到这来..

被判多妻 - 2006-8-10 20:22:00

引用:

【被判多妻的贴子】我现在杀毒没有毒了，可是在进程里面还有svchost.exe
………………

而且我的IE浏览器打不开了，

sarahbirch945 - 2006-8-10 21:32:00

我把日志弄来了，是不是这个？
拜托高手帮忙看看，到底什么问题？
2006-08-10,21:04:40

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Home Edition Service Pack 1 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

sarahbirch945 - 2006-8-10 21:45:00

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [Microsoft Corporation]
<tgcmd><> []
<ibmmessages><C:\Program Files\IBM\Messages By IBM\ibmmessages.exe> [IBM]
<MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background> [Microsoft Corporation]
<Tok-Cirrhatus><"C:\Documents and Settings\ok\Local Settings\Application Data\smss.exe"> [ ]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
<run><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation]
<PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]
<S3TRAY2><S3Tray2.exe> [S3 Graphics, Inc.]
<ATIModeChange><Ati2mdxx.exe> [ATI Technologies, Inc.]
<BluetoothAuthenticationAgent><rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent> [Microsoft Corporation]
<TPHOTKEY><C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe> []
<BMMLREF><C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE> []
<TPKMAPMN><C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe> []
<BCONSET><regedit /s "C:\Program Files\ThinkPad\ConnectUtilities\bconprof.reg"> []
<QCWLICON><C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE> []
<EZEJMNAP><C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe> [IBM Corp.]
<AGRSMMSG><AGRSMMSG.exe> [Agere Systems]
<ATIPTA><C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe> [ATI Technologies, Inc.]
<ibmmessages><C:\Program Files\IBM\Messages By IBM\ibmmessages.exe> [IBM]
<IMEKRMIG6.1><C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE> [Microsoft Corporation]
<MSPY2002><C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC> []
<ccApp><"C:\Program Files\Common Files\Symantec Shared\ccApp.exe"> [Symantec Corporation]
<vptray><C:\PROGRA~1\SYMANT~1\VPTray.exe> [Symantec Corporation]
<BIE><Rundll32.exe C:\WINDOWS\DOWNLO~1\BDSrHook.dll,Rundll32> []
<PPHIDPAD><C:\WINPENJR\Win32\pphidpad.exe> []
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<msstart><C:\WINDOWS\System32\msstart.exe> []
<Bron-Spizaetus><"C:\WINDOWS\ShellNew\ElnorB.exe"> [ ]
<RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{BC207F7D-3E63-4ACA-99B5-FB5F8428200C}><C:\WINDOWS\DOWNLO~1\BDSrHook.dll> []
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
<WinlogonNotify: NavLogon><C:\WINDOWS\System32\NavLogon.dll> [Symantec Corporation]

==================================

sarahbirch945 - 2006-8-10 21:47:00

启动文件夹
[Microsoft Office]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Microsoft Office.lnk><N>
[Empty]
<C:\Documents and Settings\ok\「开始」菜单\程序\启动\Empty.pif><N>

==================================
服务
[Ati HotKey Poller / Ati HotKey Poller]
<C:\WINDOWS\System32\Ati2evxx.exe><N/A>
[Symantec Event Manager / ccEvtMgr]
<"C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"><Symantec Corporation>
[Symantec Password Validation / ccPwdSvc]
<"C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe"><Symantec Corporation>
[Symantec Settings Manager / ccSetMgr]
<"C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"><Symantec Corporation>
[Symantec AntiVirus Definition Watcher / DefWatch]
<"C:\Program Files\Symantec AntiVirus\DefWatch.exe"><Symantec Corporation>
[IBM PM Service / IBMPMSVC]
<C:\WINDOWS\System32\ibmpmsvc.exe><N/A>
[QCONSVC / QCONSVC]
<System32\QCONSVC.EXE><N/A>
[Rising Process Communication Center / RsCCenter]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[SavRoam / SavRoam]
<"C:\Program Files\Symantec AntiVirus\SavRoam.exe"><symantec>
[Symantec Network Drivers Service / SNDSrvc]
<"C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe"><Symantec Corporation>
[Symantec AntiVirus / Symantec AntiVirus]
<"C:\Program Files\Symantec AntiVirus\Rtvscan.exe"><Symantec Corporation>

==================================

sarahbirch945 - 2006-8-10 21:49:00

浏览器加载项
[BDSrchHook Class]
{BC207F7D-3E63-4ACA-99B5-FB5F8428200C} <C:\WINDOWS\DOWNLO~1\BDSrHook.dll, >
[BDSrchHook Class]
{BC207F7D-3E63-4ACA-99B5-FB5F8428200C} <C:\WINDOWS\DOWNLO~1\BDSrHook.dll, >
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, N/A>
[FlashGet]
{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\PROGRA~1\FlashGet\flashget.exe, Amaze Soft>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\MSMSGS.EXE, Microsoft Corporation>
[电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FlashGet\fgiebar.dll, Amaze Soft>
[SassCln Object]
{A8658086-E6AC-4957-BC8E-7D54A7E8A78E} <C:\WINDOWS\Downloaded Program Files\SassCln.dll, Microsoft Corporation>
[BDSrchHook Class]
{BC207F7D-3E63-4ACA-99B5-FB5F8428200C} <C:\WINDOWS\DOWNLO~1\BDSrHook.dll, >
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\macromed\flash\Flash.ocx, Macromedia, Inc.>
[使用网际快车下载]
<C:\Program Files\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<C:\Program Files\FlashGet\jc_all.htm, N/A>
[添加到QQ自定义面板]
<C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================

sarahbirch945 - 2006-8-10 21:50:00

正在运行的进程
[PID: 600][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 648][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 672][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[C:\WINDOWS\System32\NavLogon.dll] <Symantec Corporation><9.0.0.338>
[PID: 716][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 728][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 880][C:\WINDOWS\System32\ibmpmsvc.exe] <N/A><N/A>
[PID: 928][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 992][C:\Program Files\Rising\Rav\CCenter.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 1008][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1136][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1160][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1180][C:\Program Files\Rising\Rav\Ravmond.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 29>
[C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\RsLog.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20>
[C:\Program Files\Rising\Rav\HOOKSYS.dll] <Rising><18, 1, 0, 9>
[C:\Program Files\Rising\Rav\Scanner.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30>
[C:\Program Files\Rising\Rav\libload.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[C:\Program Files\Rising\Rav\regmon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[C:\Program Files\Rising\Rav\MemMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
[C:\Program Files\Rising\Rav\expscan.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
[C:\Program Files\Rising\Rav\PostTrt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
[PID: 1276][C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe] <Symantec Corporation><2.2.0.577>
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] <Symantec Corporation><2.2.0.577>
[PID: 1308][C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe] <Symantec Corporation><2.2.0.577>
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] <Symantec Corporation><2.2.0.577>
[C:\PROGRA~1\COMMON~1\SYMANT~1\CCSETEVT.DLL] <Symantec Corporation><2.2.0.577>
[PID: 1432][C:\Program Files\Rising\Rav\RavStub.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 1440][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.0 (XPClient.010817-1148)>
[PID: 1564][C:\WINDOWS\System32\Ati2evxx.exe] <N/A><N/A>
[PID: 1604][C:\Program Files\Symantec AntiVirus\DefWatch.exe] <Symantec Corporation><9.0.0.338>
[PID: 1652][C:\WINDOWS\System32\QCONSVC.EXE] <N/A><N/A>
[PID: 1676][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1740][C:\Program Files\Symantec AntiVirus\Rtvscan.exe] <Symantec Corporation><9.0.0.338>
[C:\WINDOWS\System32\CBA.DLL] <Intel? Corporation><6.12.0.112 E>
[C:\WINDOWS\System32\MsgSys.dll] <Intel? Corporation><6.12.0.112 E>
[C:\WINDOWS\System32\NTS.dll] <Intel? Corporation><6.12.0.112 E>
[C:\WINDOWS\System32\PDS.DLL] <Intel? Corporation><6.12.0.112 E>
[C:\Program Files\Symantec AntiVirus\NAVLU.dll] <Symantec Corporation><9.0.0.338>
[C:\Program Files\Symantec AntiVirus\I2ldvp3.dll] <Symantec Corporation><9.0.0.338>
[C:\Program Files\Symantec AntiVirus\ecmldr32.DLL] <Symantec Corp.><1.1.0.3>
[C:\Program Files\Symantec AntiVirus\SAVRT32.DLL] <Symantec Corporation><9.3.0.28>
[C:\Program Files\Symantec AntiVirus\NAVNTUTL.DLL] <Symantec Corporation><9.0.0.338>
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20040512.009\ecmsvr32.dll] <Symantec Corp.><1.1.0.3>
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20040512.009\NAVEX32a.DLL] <Symantec Corporation><2003.03.1.2>
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20040512.009\NAVENG32.DLL] <Symantec Corporation><2003.03.1.2>
[C:\Program Files\Symantec AntiVirus\IMail.dll] <Symantec Corporation><9.0.0.338>
[C:\Program Files\Symantec AntiVirus\NotesExt.dll] <Symantec Corporation><9.0.0.338>

sarahbirch945 - 2006-8-10 21:50:00

[C:\Program Files\Symantec AntiVirus\vpmsece.dll] <Symantec Corporation><9.0.0.338>
[C:\Program Files\Symantec AntiVirus\DecSDK.dll] <Symantec Corporation><3.02.11.32>
[C:\Program Files\Symantec AntiVirus\Dec2.dll] <Symantec Corporation><3.02.11.32>
[C:\Program Files\Symantec AntiVirus\Dec2ID.dll] <Symantec Corporation><3.02.11.32>
[C:\Program Files\Symantec AntiVirus\Dec2ZIP.dll] <Symantec Corporation><3.02.11.32>
[C:\Program Files\Symantec AntiVirus\Dec2SS.dll] <Symantec Corporation><3.02.11.32>
[C:\Program Files\Symantec AntiVirus\Dec2GZIP.dll] <Symantec Corporation><3.02.11.32>
[C:\Program Files\Symantec AntiVirus\Dec2CAB.dll] <Symantec Corporation><3.02.11.32>
[C:\Program Files\Symantec AntiVirus\Dec2LHA.dll] <Symantec Corporation><3.02.11.32>
[C:\Program Files\Symantec AntiVirus\Dec2ARJ.dll] <Symantec Corporation><3.02.11.32>
[C:\Program Files\Symantec AntiVirus\Dec2TNEF.dll] <Symantec Corporation><3.02.11.32>
[C:\Program Files\Symantec AntiVirus\Dec2LZ.dll] <Symantec Corporation><3.02.11.32>
[C:\Program Files\Symantec AntiVirus\Dec2AMG.dll] <Symantec Corporation><3.02.11.32>
[C:\Program Files\Symantec AntiVirus\Dec2TAR.dll] <Symantec Corporation><3.02.11.32>
[C:\Program Files\Symantec AntiVirus\Dec2RTF.dll] <Symantec Corporation><3.02.11.32>
[C:\Program Files\Symantec AntiVirus\Dec2Text.dll] <Symantec Corporation><3.02.11.32>
[C:\Program Files\Common Files\Symantec Shared\SSC\scandlgs.dll] <Symantec Corporation><9.0.0.338>
[PID: 384][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 472][C:\WINDOWS\System32\Rundll32.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 944][C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe] <N/A><N/A>
[C:\Program Files\ThinkPad\PkgMgr\HOTKEY_2\tphk_2k.dll] <N/A><N/A>
[C:\WINDOWS\System32\Oemdspif.dll] <ATI Technologies, Inc.><4.12.0007>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 960][C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe] <N/A><N/A>
[C:\Program Files\ThinkPad\Utilities\TpKmapHk.dll] <N/A><N/A>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 968][C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe] <N/A><N/A>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 1076][C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe] <IBM Corporation><1.06>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 1080][C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE] <N/A><N/A>
[C:\Program Files\ThinkPad\ConnectUtilities\QCON.dll] <N/A><N/A>
[C:\Program Files\ThinkPad\ConnectUtilities\MerlinC201.dll] <Novatel Wireless Inc.><1, 0, 0, 1>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 1056][C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe] <IBM Corp.><1, 0, 0, 0>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 1208][C:\WINDOWS\AGRSMMSG.exe] <Agere Systems><2.1.21 2.1.21 11/21/2002 14:17:53>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 1468][C:\Program Files\IBM\Messages By IBM\ibmmessages.exe] <IBM><1.058>
[C:\WINDOWS\System32\AIBMRUNL.dll] <N/A><N/A>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 1580][C:\Program Files\Common Files\Symantec Shared\ccApp.exe] <Symantec Corporation><2.2.0.577>
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] <Symantec Corporation><2.2.0.577>
[C:\Program Files\Symantec\LiveUpdate\ProductRegCom.DLL] <Symantec Corporation><2.0.39.0>
[C:\Program Files\Symantec\LiveUpdate\LuComServerPS.DLL] <Symantec Corporation><2.0.39.0>
[C:\PROGRA~1\COMMON~1\SYMANT~1\CCALERT.DLL] <Symantec Corporation><2.2.0.577>
[C:\PROGRA~1\COMMON~1\SYMANT~1\CCEMLPXY.DLL] <Symantec Corporation><2.2.0.577>
[C:\WINDOWS\System32\SYMREDIR.dll] <Symantec Corporation><5.3.0.46>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[C:\Program Files\Symantec AntiVirus\SavEmail.dll] <Symantec Corporation><9.0.0.338>
[C:\Program Files\Common Files\Symantec Shared\ccSetEvt.dll] <Symantec Corporation><2.2.0.577>
[C:\Program Files\Common Files\Symantec Shared\ccProSub.dll] <Symantec Corporation><2.2.0.577>
[PID: 1132][C:\PROGRA~1\SYMANT~1\VPTray.exe] <Symantec Corporation><9.0.0.338>
[C:\Program Files\Symantec AntiVirus\SAVRT32.DLL] <Symantec Corporation><9.3.0.28>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[C:\Program Files\Symantec AntiVirus\Cliproxy.dll] <Symantec Corporation><9.0.0.338>
[C:\PROGRA~1\SYMANT~1\NAVNTUTL.DLL] <Symantec Corporation><9.0.0.338>
[C:\Program Files\Symantec AntiVirus\Cliscan.dll] <Symantec Corporation><9.0.0.338>
[PID: 1972][C:\WINPENJR\Win32\pphidpad.exe] <N/A><N/A>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 2072][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] <RealNetworks, Inc.><0.1.0.1622>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 2144][C:\Program Files\Rising\Rav\RavTask.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 2220][C:\WINDOWS\System32\ctfmon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 2316][C:\Program Files\Messenger\msmsgs.exe] <Microsoft Corporation><4.7.2010>
[C:\WINDOWS\System32\msdmo.dll] <N/A><N/A>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 2492][C:\Program Files\Rising\Rav\Ravmon.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 30>
[C:\Program Files\Rising\Rav\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 24>
[C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Program Files\Rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 2548][C:\Documents and Settings\ok\Local Settings\Application Data\winlogon.exe] < ><1.00.0004>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 2692][C:\WINDOWS\System32\conime.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 2708][C:\Documents and Settings\ok\Local Settings\Application Data\services.exe] < ><1.00.0004>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 2720][C:\Documents and Settings\ok\Local Settings\Application Data\lsass.exe] < ><1.00.0004>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 3248][C:\Program Files\WinRAR\WinRAR.exe] <N/A><N/A>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[PID: 3296][C:\DOCUME~1\ok\LOCALS~1\Temp\Rar$EX03.393\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

sarahbirch945 - 2006-8-10 22:05:00

麻烦了，请帮帮忙了

春流到夏爱娜 - 2006-8-12 10:32:00

引用:

【sarahbirch945的贴子】
把那个程序装到中毒的电脑上就可以了吗？
and在哪里导出日志？
那个程序和瑞星是兼容的吧？不冲突吧？
………………

这个是瑞星工程师给我教的办法呀~~！不会出错的，尽管放心吧~~！

春流到夏爱娜 - 2006-8-12 10:34:00

引用:

【被判多妻的贴子】我现在杀毒没有毒了，可是在进程里面还有svchost.exe
………………

这个程序在进程里有好几个呀，只要没有毒了，那个就是安全的~~！

瑞星卡卡安全论坛