瑞星卡卡安全论坛
apyss - 2006-10-25 2:13:00
差不多全盘格了~只留了几个东西没格到.还有是...有人救救我没有
apyss - 2006-10-25 2:14:00
威金专杀用过了.瑞星也用过了,还是不行..火啊,
終生學習 - 2006-10-25 2:23:00
| 引用: |
【apyss的贴子】差不多全盘格了~只留了几个东西没格到.还有是...有人救救我没有 ……………… |
不要在系统里格盘,用XP光盘到分区界面里格盘最好
apyss - 2006-10-25 2:27:00
我有重要的东西啊.我不想全盘格啊.
apyss - 2006-10-25 2:28:00
这个威金可能是新版的吧.好牛,集成了好多东西在里面
終生學習 - 2006-10-25 2:30:00
| 引用: |
【apyss的贴子】这个威金可能是新版的吧.好牛,集成了好多东西在里面 ……………… |
用诺吨10.来杀,不过要升级病毒库
apyss - 2006-10-25 2:32:00
那有得下呢?发个网址给我好吗?
終生學習 - 2006-10-25 2:48:00
| 引用: |
【apyss的贴子】那有得下呢?发个网址给我好吗? ……………… |
去百度搜索一下
apyss - 2006-10-25 2:54:00
晕死.刚装好就马上被病毒干掉了
終生學習 - 2006-10-25 2:57:00
| 引用: |
【apyss的贴子】晕死.刚装好就马上被病毒干掉了 ……………… |
装完什么??
apyss - 2006-10-25 3:05:00
诺顿
終生學習 - 2006-10-25 3:07:00
你任务管理器有什么进程啊,应该先吧病毒进程结束掉,然后才装诺吨
apyss - 2006-10-25 3:11:00
多咯.这次的威金好牛啊.他本来就集成了飘雪木马...加再上10多个流氓软件....我一开始中了..机子马上滩涣了.我搞了老半天.现在机子才能动起来了.
apyss - 2006-10-25 3:12:00
我把飘雪和流氓软件都杀光了.现在又跑出来了.,
apyss - 2006-10-25 3:13:00
还是我扫一个日志上来吧.
apyss - 2006-10-25 3:15:00
006-10-25,03:05:09
System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能
以下内容被选中:
所有的启动项目(包括注册表、启动文件夹、服务等)
浏览器加载项
正在运行的进程(包括进程模块信息)
文件关联
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation]
<KpopMon><C:\KAV6\KPopMon.EXE> []
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<rx><C:\WINDOWS\system32\explore.exe> []
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]
<IMEKRMIG6.1><C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE> [Microsoft Corporation]
<MSPY2002><C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC> []
<NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [NVIDIA Corporation]
<nwiz><nwiz.exe /install> [NVIDIA Corporation]
<NvMediaCenter><RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit> [NVIDIA Corporation]
<KAVRun><C:\KAV6\KAVRun.EXE> [kingsoft]
<Kulansyn><C:\KAV6\Kulansyn.EXE> [Kingsoft Corp.]
<SoundMan><SOUNDMAN.EXE> [Realtek Semiconductor Corp.]
<Services><C:\WINDOWS\Services.exe> [Microsoft Corporation]
<Torjan Program><C:\WINDOWS\WINLOGON.EXE> [GtE8w0l9NLysBCdvZTRh]
<wdfmgr32><C:\WINDOWS\system32\wdfmgr32.exe> []
<ccApp><"C:\Program Files\Common Files\Symantec Shared\ccApp.exe"> [Symantec Corporation]
<vptray><C:\PROGRA~1\SYMANT~1\VPTray.exe> [Symantec Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<KernelFaultCheck><C:\WINDOWS\winabc3.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe 1> []
<Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{ms80435c-A6FF-11E0-9A84-00C04FD8DBD8}><C:\WINDOWS\system32\h0435cfc.log> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
<WinlogonNotify: NavLogon><C:\WINDOWS\system32\NavLogon.dll> [Symantec Corporation]
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><C:\KAV6\KaScrScn.scr> []
apyss - 2006-10-25 3:15:00
=================================
启动文件夹
服务
[Adobe LM Service / Adobe LM Service]
<C:\Program Files\WinRAR\svchost.exe><N/A>
[Symantec Event Manager / ccEvtMgr]
<"C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"><Symantec Corporation>
[Symantec Password Validation / ccPwdSvc]
<"C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe"><Symantec Corporation>
[Symantec Settings Manager / ccSetMgr]
<"C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"><Symantec Corporation>
[Symantec AntiVirus Definition Watcher / DefWatch]
<"C:\Program Files\Symantec AntiVirus\DefWatch.exe"><Symantec Corporation>
[Intel PDS / Intel PDS]
<C:\WINDOWS\system32\CBA\pds.exe><LANDesk Software Ltd.>
[Kingsoft AntiVirus Service / KAVSvc]
<C:\KAV6\KAVSvc.EXE><kingsoft Antivirus>
[NVIDIA Display Driver Service / NVSvc]
<C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[Symantec SPBBCSvc / SPBBCSvc]
<"C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe"><Symantec Corporation>
[Symantec AntiVirus / Symantec AntiVirus]
<"C:\Program Files\Symantec AntiVirus\Rtvscan.exe"><Symantec Corporation>
==================================
浏览器加载项
[IeCatch2 Class]
{A5366673-E8CA-11D3-9CD9-0090271D075B} <C:\Program Files\flashget\jccatch.dll, Amaze Soft>
[联想]
{6096E38F-5AC1-4391-8EC4-75DFA92FB32F} <http://www.lenovo.com, N/A>
[金山卓越]
{8DE0FCD4-5EB5-11D3-AD25-00002100131B} <url:http://www.joyo.com, N/A>
[FlashGet]
{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\Program Files\flashget\flashget.exe, Amaze Soft>
[金山毒霸网站]
{e1fc9760-7b95-49cd-80b9-8c9e41017b93} <url:http://www.duba.net, N/A>
[在线查毒]
{f58d36c3-40be-4418-a786-d8fbe3eb3554} <C:\KAV6\kavie.htm, N/A>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[金山毒霸]
{A9BE2902-C447-420A-BB7F-A5DE921E6138} <C:\KAV6\KAIEPlus.DLL, >
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[IeCatch2 Class]
{A5366673-E8CA-11D3-9CD9-0090271D075B} <C:\Program Files\flashget\jccatch.dll, Amaze Soft>
[金山毒霸]
{A9BE2902-C447-420A-BB7F-A5DE921E6138} <C:\KAV6\KAIEPlus.DLL, >
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\flash.ocx, Macromedia, Inc.>
[]
{E1FC9760-7B95-49CD-80B9-8C9E41017B93} <C:\KAV6\KAVEXT.DLL, Kingsoft Corp.>
[使用网际快车下载]
<C:\Program Files\flashget\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<C:\Program Files\flashget\jc_all.htm, N/A>
==================================
apyss - 2006-10-25 3:20:00
==================================
文件关联
.TXT Error. [C:\WINDOWS\system32\impai.exe "%1"]
.EXE Error. [winfiles]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
==================================
終生學習 - 2006-10-25 3:23:00
<rx><C:\WINDOWS\system32\explore.exe> []
<Services><C:\WINDOWS\Services.exe> [Microsoft Corporation]
<Torjan Program><C:\WINDOWS\WINLOGON.EXE> [GtE8w0l9NLysBCdvZTRh]
<wdfmgr32><C:\WINDOWS\system32\wdfmgr32.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{ms80435c-A6FF-11E0-9A84-00C04FD8DBD8}><C:\WINDOWS\system32\h0435cfc.log> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe 1> []
下面的文件关联用瑞星修复注册表工具修复一下就可以
文件关联
.TXT Error. [C:\WINDOWS\system32\impai.exe "%1"]
.EXE Error. [winfiles]
apyss - 2006-10-25 3:24:00
没用的.删了还会出来.
終生學習 - 2006-10-25 3:24:00
而且诺吨与金山的监控不能同时打开,否则会死机
apyss - 2006-10-25 3:27:00
金山是旧的..我没用..是以前装机时别人帮我装的.
apyss - 2006-10-25 3:28:00
刚才还原了机子忘了删.
終生學習 - 2006-10-25 3:31:00
| 引用: |
【apyss的贴子】刚才还原了机子忘了删. ……………… |
还有这个服务啊,禁止和停止啊
<C:\Program Files\WinRAR\svchost.exe><N/A>
apyss - 2006-10-25 3:32:00
<rx><C:\WINDOWS\system32\explore.exe> []
<Services><C:\WINDOWS\Services.exe> [Microsoft Corporation]
<Torjan Program><C:\WINDOWS\WINLOGON.EXE> [GtE8w0l9NLysBCdvZTRh]
<wdfmgr32><C:\WINDOWS\system32\wdfmgr32.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{ms80435c-A6FF-11E0-9A84-00C04FD8DBD8}><C:\WINDOWS\system32\h0435cfc.log> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe 1> []
这些东西我手动杀过了.威金的源头杀不死还是会在的.
終生學習 - 2006-10-25 3:33:00
| 引用: |
【apyss的贴子】刚才还原了机子忘了删. ……………… |
你说格盘重装,你说的重装就是用GHOST还原啊?
apyss - 2006-10-25 3:35:00
我装了再还原.因为我还是觉得我这个系统好用.
終生學習 - 2006-10-25 3:35:00
| 引用: |
【apyss的贴子】 <rx><C:\WINDOWS\system32\explore.exe> [] <Services><C:\WINDOWS\Services.exe> [Microsoft Corporation] <Torjan Program><C:\WINDOWS\WINLOGON.EXE> [GtE8w0l9NLysBCdvZTRh] <wdfmgr32><C:\WINDOWS\system32\wdfmgr32.exe> [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{ms80435c-A6FF-11E0-9A84-00C04FD8DBD8}><C:\WINDOWS\system32\h0435cfc.log> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe 1> [] 这些东西我手动杀过了.威金的源头杀不死还是会在的. ……………… |
从你的日至上来看没有威金啊,而且你用GHOST还原,也许你的GHOST在备份的时候就已经中了毒了
apyss - 2006-10-25 3:35:00
不是...我重装完还是发现问题的存在..就再GHOST一次了.
apyss - 2006-10-25 3:36:00
我的备份是我初装机时就备份的.绝对没毒.,
© 2000 - 2026 Rising Corp. Ltd.