瑞星卡卡安全论坛

首页 » 技术交流区 » 反病毒/反流氓软件论坛 » 【求助】不知什么原因，开机运行任务程序，都会自动关机
圣手空空 - 2006-10-6 16:43:00
如题，而且 瑞星程序也被破坏，无法启动。。偶都快要崩溃了
有没人能帮忙
2006-10-06,16:04:11

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 1 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe>  [Microsoft Corporation]
    <stonedrv><c:\windows\system32\stonedrv.exe>  []
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  []
    <run><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <KernelFaultCheck><%systemroot%\system32\dumprep 0 -k>  []
    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot>  [RealNetworks, Inc.]
    <DAEMON Tools-1033><"C:\Program Files\D-Tools\daemon.exe"  -lang 1033>  [DAEMON'S HOME]
    <stonedrv><c:\windows\system32\stonedrv.exe>  []
    <SvcManager><winlogon4.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
    <stonedrv><c:\windows\system32\stonedrv.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><explorer.exe                                                                                                    "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00013.exe">  []
    <Userinit><C:\WINDOWS\System32\userinit.exe,>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{BD3706CB-06CB-D376-CBD3-6CB376CBD376}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\06CBD376.dll>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
    <WinlogonNotify: AtiExtEvent><Ati2evxx.dll>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\rpcc]
    <WinlogonNotify: rpcc><C:\WINDOWS\System32\rpcc.dll>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Uninstall]
    <WinlogonNotify: Uninstall><C:\WINDOWS\system32\o0lu0a39ed.dll>  []

==================================
启动文件夹
服务
[Ati HotKey Poller / Ati HotKey Poller]
  <C:\WINDOWS\System32\Ati2evxx.exe><N/A>
[ATI Smart / ATI Smart]
  <C:\WINDOWS\system32\ati2sgag.exe><>
[Command Service / cmdService]
  <C:\WINDOWS\TUFY\command.exe><N/A>
[InstallDriver Service / ISDS]
  <"C:\WINDOWS\system32\csscv.exe"><Microsoft Corporation>
[Remote Map Manager / Remote Map Manager]
  <"C:\WINDOWS\system32\lssc.exe"><N/A>
[Remote Plugin Service / Remote Plugin Service]
  <"C:\WINDOWS\system32\lsyss.exe"><N/A>

==================================
浏览器加载项
[启动迅雷]
  {0062C9BD-B349-40DE-91A0-755F37ACD559} <g:\hk\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[QQIEFloatBarCfgCmd Class]
  {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <G:\HK\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[搜虎]
  {7A38130D-BEB7-4d60-BE7A-4C4AB6A85CD1} <C:\WINDOWS\vcbar11.dll, N/A>
[ToolBar888]
  {C004DEC2-2623-438e-9CA2-C9043AB28508} <C:\Program Files\Common Files\{36CBD376-0AF0-2052-1226-030309260056}\MyToolBar.dll, N/A>
[超级兔子上网精灵]
  {43869BB3-22FD-4F15-9B46-238106BA2F4E} <G:\MagicSet\haokanbar.dll, Xiang Feng Technology>
[MMCPlayer Class]
  {05C1004E-2596-48E5-8E26-39362985EEB9} <C:\Program Files\Sogou PXP\MMCShell.dll, Sohu.com Inc.>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[Rising Web Scan Object]
  {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.>
[&使用迅雷下载]
  <g:\hk\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
  <g:\hk\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
[上传到QQ网络硬盘]
  <G:\HK\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
  <G:\HK\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <G:\HK\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <G:\HK\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 1048][C:\WINDOWS\system32\rundll32.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
    [C:\WINDOWS\system32\uypnpmgr.dll]  <N/A><N/A>
    [C:\WINDOWS\System32\wnwbio.ime]  <深圳世强软件开发部 www.wnwb.com ><2005, 1, 31, 1>
圣手空空 - 2006-10-6 16:46:00
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\06CBD376.dll]  <N/A><N/A>
    [C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00014.dll]  <N/A><N/A>
[PID: 1328][C:\WINDOWS\explorer.exe]  <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
    [C:\WINDOWS\System32\wnwbio.ime]  <深圳世强软件开发部 www.wnwb.com ><2005, 1, 31, 1>
    [C:\WINDOWS\system32\uypnpmgr.dll]  <N/A><N/A>
    [C:\Program Files\Common Files\Microsoft Shared\MSINFO\06CBD376.dll]  <N/A><N/A>
    [C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00013.dll]  <N/A><N/A>
    [C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00014.dll]  <N/A><N/A>
[PID: 1452][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  <RealNetworks, Inc.><0.1.0.1622>
    [C:\Program Files\Common Files\Microsoft Shared\MSINFO\06CBD376.dll]  <N/A><N/A>
    [C:\WINDOWS\System32\wnwbio.ime]  <深圳世强软件开发部 www.wnwb.com ><2005, 1, 31, 1>
    [C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00014.dll]  <N/A><N/A>
[PID: 1468][C:\Program Files\D-Tools\daemon.exe]  <DAEMON'S HOME><3.47.0.0>
    [C:\WINDOWS\daemon.dll]  <N/A><3.47.0.0>
    [C:\Program Files\D-Tools\PFCTOC.DLL]  <Padus(R), Inc.><1, 0, 0, 12>
    [C:\Program Files\D-Tools\Plugins\Images\ccdmount.dll]  <GENERIC><1.02.0.0>
    [C:\Program Files\D-Tools\Plugins\Images\mdsmount.dll]  <GENERIC><1.01.0.0>
    [C:\Program Files\D-Tools\Plugins\Images\pdimount.dll]  <GENERIC><1.01.0.0>
    [C:\Program Files\D-Tools\Plugins\Images\nrgmount.dll]  <GENERIC><1.02.0.0>
    [C:\Program Files\D-Tools\Plugins\Images\bw5mount.dll]  <N/A><1.0.2.0>
    [C:\Program Files\Common Files\Microsoft Shared\MSINFO\06CBD376.dll]  <N/A><N/A>
    [C:\WINDOWS\System32\wnwbio.ime]  <深圳世强软件开发部 www.wnwb.com ><2005, 1, 31, 1>
    [C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00014.dll]  <N/A><N/A>
[PID: 1476][C:\windows\system32\stonedrv.exe]  <N/A><N/A>
[PID: 1520][C:\WINDOWS\System32\winlogon4.exe]  <N/A><N/A>
    [C:\Program Files\Common Files\Microsoft Shared\MSINFO\06CBD376.dll]  <N/A><N/A>
    [C:\WINDOWS\System32\wnwbio.ime]  <深圳世强软件开发部 www.wnwb.com ><2005, 1, 31, 1>
    [C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00014.dll]  <N/A><N/A>
[PID: 1528][C:\WINDOWS\System32\ctfmon.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
    [C:\Program Files\Common Files\Microsoft Shared\MSINFO\06CBD376.dll]  <N/A><N/A>
    [C:\WINDOWS\System32\wnwbio.ime]  <深圳世强软件开发部 www.wnwb.com ><2005, 1, 31, 1>
    [C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00014.dll]  <N/A><N/A>
[PID: 1284][C:\Program Files\ChinaNet\VnetClient.exe]  <><2005, 11, 14, 1>
    [C:\Program Files\ChinaNet\Communicate.dll]  <0><2005, 3, 3, 1>
    [C:\Program Files\ChinaNet\DialModule.dll]  <GDCN><2006, 6, 26, 1>
    [C:\Program Files\Common Files\Microsoft Shared\MSINFO\06CBD376.dll]  <N/A><N/A>
    [C:\PROGRA~1\ChinaNet\CLIENT~1.DLL]  <><2004, 2, 28, 1>
    [C:\WINDOWS\System32\wnwbio.ime]  <深圳世强软件开发部 www.wnwb.com ><2005, 1, 31, 1>
    [C:\PROGRA~1\ChinaNet\PLUGIN~1.OCX]  <><2005, 7, 27, 1>
    [C:\PROGRA~1\ChinaNet\sign.dll]  <0><2004, 12, 1, 1>
    [C:\Program Files\ChinaNet\SysPlug\4f14c0bd-1c30-4251-bcff-946b4fec7946\GLWorldPlug.dll]  <Ourgame><1, 0, 0, 1>
    [C:\PROGRA~1\ChinaNet\WEBPLU~1.DLL]  <><2005, 8, 18, 1>
    [C:\PROGRA~1\ChinaNet\PostPlug.dll]  <><2004, 12, 16, 2>
    [C:\PROGRA~1\ChinaNet\ADVERT~1.OCX]  <><2005, 10, 13, 1>
    [C:\PROGRA~1\ChinaNet\Gif89a.dll]  <><2005, 6, 21, 1>
    [C:\PROGRA~1\ChinaNet\VnetBs.ocx]  <><2004, 11, 18, 1>
    [C:\PROGRA~1\ChinaNet\ACCOUN~2.DLL]  <><2005, 11, 14, 1>
    [C:\PROGRA~1\ChinaNet\AccountMgr.dll]  <><2005, 11, 14, 17>
    [C:\PROGRA~1\ChinaNet\VnetSkin.ocx]  <GDDC><2005, 11, 14, 1>
    [C:\PROGRA~1\ChinaNet\DialogStyle.dll]  <><1, 0, 0, 1>
    [C:\PROGRA~1\ChinaNet\Timer.ocx]  <><2005, 10, 9, 14>
    [C:\PROGRA~1\ChinaNet\PLUGIN~2.OCX]  <><2005, 2, 24, 1>
    [C:\PROGRA~1\ChinaNet\NEWMES~1.DLL]  <><2005, 8, 26, 1>
    [C:\PROGRA~1\ChinaNet\PassCtrl.dll]  <><1, 0, 0, 1>
    [C:\PROGRA~1\ChinaNet\PlugPush.dll]  <><2004, 12, 21, 1>
    [C:\PROGRA~1\ChinaNet\ALLINT~1.DLL]  <><2004, 11, 23, 1>
    [C:\PROGRA~1\ChinaNet\VNetLog.ocx]  <><2005, 10, 9, 1>
    [C:\PROGRA~1\ChinaNet\StatNum.dll]  <><2004, 11, 18, 1>
    [C:\PROGRA~1\ChinaNet\VNETON~1.OCX]  <><2005, 3, 2, 1>
    [C:\PROGRA~1\ChinaNet\ALLFUN~1.DLL]  <GDCN><2005, 10, 9, 1>
    [C:\PROGRA~1\ChinaNet\VnetOptLog.dll]  <><2005, 9, 13, 9>
    [C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00014.dll]  <N/A><N/A>
[PID: 1152][G:\HK\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>
    [C:\Program Files\Common Files\Microsoft Shared\MSINFO\06CBD376.dll]  <N/A><N/A>
    [C:\WINDOWS\System32\wnwbio.ime]  <深圳世强软件开发部 www.wnwb.com ><2005, 1, 31, 1>
    [C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00014.dll]  <N/A><N/A>

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================
mxdg - 2006-10-6 16:57:00
同志
病毒好多~~


取消以下服务并重启删除原文件

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<stonedrv><c:\windows\system32\stonedrv.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<stonedrv><c:\windows\system32\stonedrv.exe> []
<SvcManager><winlogon4.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
<stonedrv><c:\windows\system32\stonedrv.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00013.exe"> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\rpcc]
<WinlogonNotify: rpcc><C:\WINDOWS\System32\rpcc.dll> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Uninstall]
<WinlogonNotify: Uninstall><C:\WINDOWS\system32\o0lu0a39ed.dll> []

==================================

取消以下服务并重启删除原文件

启动文件夹
服务
[Command Service / cmdService]
<C:\WINDOWS\TUFY\command.exe><N/A>
[Remote Map Manager / Remote Map Manager]
<"C:\WINDOWS\system32\lssc.exe"><N/A>
[Remote Plugin Service / Remote Plugin Service]
<"C:\WINDOWS\system32\lsyss.exe"><N/A>

圣手空空 - 2006-10-6 17:01:00
取消以下服务并重启删除原文件

这个能说得详细点么,不明白

现在瑞星重装也安装不了...
1
查看完整版本: 【求助】不知什么原因，开机运行任务程序，都会自动关机
© 2000 - 2026 Rising Corp. Ltd.