瑞星卡卡安全论坛

情况是这样的
今天朋友说我给的游戏地址不能下载游戏
我就上去看了看
结果发现，网站上居然放了毒，瑞星提示我，我就把删了，当时也没在意。

到了下午发现玩游戏的时候，经常说：XXX遇到问题需要关闭……

然后我重起电脑，一开机，就说：ASN.2 Runtime APIs遇到问题需要关闭/

ASN.2 Runtime 这个是什么东西啊？

请问怎么弄好

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
 
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [Microsoft Corporation]
 
<MSMSGS><; ; "C:\Program Files\Messenger\msmsgs.exe" /background>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
 
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [Microsoft Corporation]
 
  <SoundMan><SOUNDMAN.EXE>  [Realtek Semiconductor Corp.]
 
<MSConfig><C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto>  [Microsoft Corporation]
   
<RavTask><"G:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
 
<HotKeysCmds><; C:\WINDOWS\system32\hkcmd.exe>  [Intel Corporation]
 
<IgfxTray><; C:\WINDOWS\system32\igfxtray.exe>  [Intel Corporation]
 
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [Microsoft Corporation]
 
<PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [Microsoft Corporation]
 
<KernelFaultCheck><%systemroot%\system32\dumprep 0 -k>  []
 
<QuickTime Update Completion 0><; "C:\WINDOWS\system32\QuickTime\QuickTimeUpdateHelper.exe"         
  -uninstallwithapps -destfullpath "d:\program files\QuickTimeUpdater.exe" -sourcefullpath "d:\program files\TempUpdater.exe" -atboottime "QuickTime Update Completion 0">  []
 
<TotalRecorderScheduler><; ; ; "D:\Music\TotRecSched.exe">  [High Criteria inc.]
   
<UnlockerAssistant><; ; "D:\Program Files\Unlocker\UnlockerAssistant.exe">  []
 
<TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
 
<shell><Explorer.exe>  [Microsoft Corporation]
 
<Userinit><C:\WINDOWS\system32\Userinit.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
 
  <UIHost><LogonUI.EXE>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\System Safety Monitor]
    <WinlogonNotify: System Safety Monitor><SSMWinlogonEx.dll>  [System Safety Limited]

服务
[Rising Process Communication Center / RsCCenter]
  <"G:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
  <"G:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[Ulead Burning Helper / UleadBurningHelper]
  <C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe><Ulead Systems, Inc.>

正在运行的进程
[PID: 508][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 568][\??\C:\WINDOWS\system32\csrss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 592][\??\C:\WINDOWS\system32\winlogon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\SSMWinlogonEx.dll]  <System Safety Limited><2.2.0.583>
[PID: 640][C:\WINDOWS\system32\services.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 652][C:\WINDOWS\system32\lsass.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 804][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 860][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 928][G:\Program Files\Rising\Rav\CCenter.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 944][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1028][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1144][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1280][C:\WINDOWS\Explorer.EXE]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [D:\PROGRA~1\FLASHGET\jccatch.dll]  <FlashGet><1, 1, 5, 0>
[PID: 1288][G:\Program Files\Rising\Rav\Ravmond.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 1, 35>
    [G:\Program Files\Rising\Rav\BWList.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
    [G:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [G:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [G:\Program Files\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [G:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [G:\Program Files\Rising\Rav\RsLog.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20>
    [G:\Program Files\Rising\Rav\HOOKSYS.dll]  <Beijing Rising Technology Co., Ltd.><18, 1, 0, 11>
    [G:\Program Files\Rising\Rav\Scanner.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 32>
    [G:\Program Files\Rising\Rav\libload.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [G:\Program Files\Rising\Rav\VirusLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
    [G:\Program Files\Rising\Rav\regmon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
    [G:\Program Files\Rising\Rav\HookWeb.dll]  <rising><18, 0, 0, 2>
    [G:\Program Files\Rising\Rav\MemMon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [G:\Program Files\Rising\Rav\expscan.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [G:\Program Files\Rising\Rav\mPorts.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
    [G:\Program Files\Rising\Rav\MailMon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
    [G:\Program Files\Rising\Rav\SpamEng.dll]  <N/A><18, 0, 0, 6>
    [G:\Program Files\Rising\Rav\engine.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 34>
    [G:\Program Files\Rising\Rav\PostTrt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 15>
    [G:\Program Files\Rising\Rav\UnExe.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [G:\Program Files\Rising\Rav\RSUnpack.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 16>
    [G:\Program Files\Rising\Rav\ScanEx.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23>
    [G:\Program Files\Rising\Rav\NvFile.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
    [G:\Program Files\Rising\Rav\ScanMac.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
    [G:\Program Files\Rising\Rav\ScanSct.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 18>
    [G:\Program Files\Rising\Rav\ScanExec.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [G:\Program Files\Rising\Rav\Unpacker.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [G:\Program Files\Rising\Rav\ScanNet.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
    [G:\Program Files\Rising\Rav\RsStore.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
    [G:\Program Files\Rising\Rav\ExtOLE.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[PID: 1908][C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe]  <Ulead Systems, Inc.><1, 0, 0, 4>
[PID: 1920][C:\WINDOWS\system32\wdfmgr.exe]  <Microsoft Corporation><5.2.3790.1230 built by: dnsrv(bld4act)>
[PID: 404][C:\WINDOWS\System32\alg.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1104][C:\WINDOWS\SOUNDMAN.EXE]  <Realtek Semiconductor Corp.><5.1.0.27>
[PID: 1364][G:\Program Files\Rising\Rav\RavTask.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
    [G:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [G:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [G:\Program Files\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [G:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
[PID: 1460][G:\Program Files\Rising\Rav\Ravmon.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 1, 33>
    [G:\Program Files\Rising\Rav\RsGuiLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 26>
    [G:\Program Files\Rising\Rav\BWList.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
    [G:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [G:\Program Files\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [G:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [G:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [G:\Program Files\Rising\Rav\PngDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 1588][C:\WINDOWS\system32\ctfmon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 2084][C:\Program Files\河南铁通宽带拨号软件\HNMainUI.exe]  <N/A><2, 3, 0, 1>
    [C:\Program Files\河南铁通宽带拨号软件\HNKernel.dll]  <HelloNet><2.2.0.1>
    [C:\Program Files\河南铁通宽带拨号软件\HNUtils.dll]  <N/A><2, 2, 0, 1>
    [C:\Program Files\河南铁通宽带拨号软件\HNRes_0804.dll]  <N/A><2, 2, 0, 1>
    [C:\Program Files\河南铁通宽带拨号软件\plugins\Diagnose.dll]  <HelloNet><2.2.0.1>
[PID: 1336][C:\Program Files\Internet Explorer\iexplore.exe]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [D:\Program Files\MagicSet\haokanbar.dll]  <Xiang Feng Technology><2, 2, 0, 1612>
    [D:\PROGRA~1\FLASHGET\jccatch.dll]  <FlashGet><1, 1, 5, 0>
    [G:\Program Files\Rising\Rav\RavScrCh.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx]  <Adobe Systems, Inc.><9,0,16,0>
    [C:\WINDOWS\system32\UNISPIM.IME]  <北京清华紫光软件股份有限公司><3.0.0.3045>
[PID: 2012][G:\Program Files\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>

文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

【回复“芢歲釺歲”的帖子】
<QuickTime Update Completion 0><; "C:\WINDOWS\system32\QuickTime\QuickTimeUpdateHelper.exe"
-uninstallwithapps -destfullpath "d:\program files\QuickTimeUpdater.exe" -sourcefullpath "d:\program files\TempUpdater.exe" -atboottime "QuickTime Update Completion 0"> []
你的电脑中安装QuickTime了？

我安装会声会影时候

它给我装的

晕``有人懂吗``急

每次开机提示：Trojan.IMMSG.MsgSender.d
文件已经被删除

但还是那个问题

这么晚还没睡？你搜索一下“本论坛”的帖子，关于Quicktime，那是个比较早的病毒

没解决掉这垃圾进程
睡不着……

很多方法都试过了
没效果

只好等待斑竹来帮忙了

Quicktime？

不会吧……这个它提示我安装时候，我选的是取消，它说这样会被不正确安装，我点是。

安装1个月了，才出现问题？

我觉得是那个病毒的问题

……求助啊

这次的问题太麻烦了

网上没什么介绍啊

病毒路径..

晕，出现过2次，都是开机时候瑞星说的。

现在没出现了

但还是那个ASN.2 Runtime APIs遇到问题需要关闭/

斑竹的防毒系统和防毒知道这么强，敢试下那个网站吗。。。。

要么我再以身试度，我再点下那个网站，把路径发出来，斑竹帮我看下吧……

引用:

【芢歲釺歲的贴子】晕，出现过2次，都是开机时候瑞星说的。 现在没出现了 但还是那个ASN.2 Runtime APIs遇到问题需要关闭/ 斑竹的防毒系统和防毒知道这么强，敢试下那个网站吗。。。。 要么我再以身试度，我再点下那个网站，把路径发出来，斑竹帮我看下吧…… ………………

你的这份日志，除了这个<TotalRecorderScheduler><; ; ; "D:\Music\TotRecSched.exe"> [High Criteria inc.]以及我问的QuickTime，其它的，我看不出问题。
<TotalRecorderScheduler><; ; ; "D:\Music\TotRecSched.exe"> [High Criteria inc.]————如果是你自己装的，就没问题。

哦……是么……那些软件都是我自己装的……

我还是再去找人装次系统吧……这次一定要安个还原精灵之类的