一个星期了,难道真的没人能搞定这个病毒了吗?【求助】----附扫描日志 bbs.ikaka.com

lyj888 - 2007-2-10 18:57:00

前几天有高手帮忙了,杀了后,由于瑞星监控不了所以还是杀不尽,请高手继续帮忙呀.
现在的情况是这样的:开机到启动系统时总是自动重起,一般要启动四次或五次才能启动到桌面来.而瑞星监控图标还是黄伞,只有网页监控已启动,其它的全禁用了,启动不起来.前面按高手删掉的一些又有了.所以前两天的努力还是不行呀.请高手帮忙,把它彻底杀掉.

瑞星我也重装了,监控还是禁用,郁闷呀

(是正在准备输入操作系统密码时或者输入后(不是用户密码),变成黑屏时再变蓝屏那一瞬间就出现重起,不过还没变入蓝屏,一般要起动三次到六次才能起动到桌面来.如果进入到桌面了就不会重起了,而进入桌面后就先是红伞,然后手动能变成黄伞,也只能起动IE.)
[CODE]

2007-02-10,18:38:58

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [(Verified)Microsoft Corporation]
<Super Rabbit IEPro><; C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD> [Super Rabbit Soft]
<Super Rabbit Start Button><; C:\Program Files\Super Rabbit\MagicSet\SRSB.EXE /Load> [Super Rabbit Soft]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\System32\userinit.exe,> [(Verified)Microsoft Corporation]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]

==================================
启动文件夹
N/A

==================================
服务
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[IMAPI CD-Burning COM Service / ImapiService][Stopped/Manual Start]
<C:\WINDOWS\System32\imapi.exe><Microsoft Corporation>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon][Running/Auto Start]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>

==================================
驱动程序
[Agere Systems Soft Modem / AgereSoftModem][Running/Manual Start]
<System32\DRIVERS\AGRSM.sys><Agere Systems>
[AntiyFirewall / AntiyFirewall][Stopped/Manual Start]
<\??\C:\WINDOWS\System32\drivers\AntiyFW.sys><N/A>
[Rising TDI Base Driver / BaseTDI][Stopped/Auto Start]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[ExpScaner / ExpScaner][Stopped/Auto Start]
<\??\C:\Program Files\Rising\Rav\ExpScan.sys><>
[HookCont / HookCont][Stopped/Auto Start]
<\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Stopped/Auto Start]
<\??\C:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Stopped/Auto Start]
<\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising>
[MEMSCAN / MEMSCAN][Stopped/Auto Start]
<\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\D:\QQ-TM\qq\npkcrypt.sys><INCA Internet Co., Ltd.>
[nv4 / nv4][Running/Manual Start]
<System32\DRIVERS\nv4.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\System32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Stopped/Auto Start]
<\??\C:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
<System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<System32\DRIVERS\secdrv.sys><N/A>
[Service for AC'97 Sample Driver (WDM) / SiS7012][Running/Manual Start]
<system32\drivers\sis7012.sys><Silicon Integrated Systems Corporation>
[SIS AGP Bus Filter / sisagp][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\sisagp.sys><Silicon Integrated Systems Corporation>
[SiS PCI Fast Ethernet Adapter Driver / SISNIC][Stopped/Manual Start]
<System32\DRIVERS\sisnic.sys><SiS Corporation>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
<System32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[USB PC Camera 301P / ZSMC301b][Stopped/Manual Start]
<System32\Drivers\usbVM31b.sys><VM>

lyj888 - 2007-2-10 18:58:00

==================================
浏览器加载项
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>
[启动迅雷5]
{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <C:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\System32\KakaTool.dll, Beijing Rising Technology Co., Ltd.>
[PGEdit Class]
{2BFAA61B-5C83-4865-8281-D8BDBF863061} <C:\WINDOWS\Downloaded Program Files\PG_ATL_Edit.dll, 银联网络支付集团有限公司>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[&使用迅雷下载]
<C:\Program Files\Thunder Network\Thunder\Program\geturl.htm, N/A>

==================================
正在运行的进程
[PID: 476][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 540][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 564][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 608][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 628][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 796][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 848][C:\Program Files\Rising\Rav\CCenter.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
[PID: 864][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1028][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1068][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1080][C:\Program Files\Rising\Rav\Ravmond.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 43]
[C:\Program Files\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\Rav\rfwctrl.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[C:\Program Files\Rising\Rav\RsLog.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
[C:\Program Files\Rising\Rav\Scanner.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 12]
[C:\Program Files\Rising\Rav\libload.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 16]
[C:\Program Files\Rising\Rav\VirusLib.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
[C:\Program Files\Rising\Rav\HookWeb.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 1]
[C:\Program Files\Rising\Rav\SpamEng.dll] [N/A, 18, 0, 0, 6]
[C:\Program Files\Rising\Rav\engine.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 25]
[C:\Program Files\Rising\Rav\UnExe.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
[C:\Program Files\Rising\Rav\ExtFile.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 25]
[C:\Program Files\Rising\Rav\ScanEx.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 40]
[C:\Program Files\Rising\Rav\PostTrt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 8]
[C:\Program Files\Rising\Rav\NvFile.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 11]
[C:\Program Files\Rising\Rav\ScanMac.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 13]
[C:\Program Files\Rising\Rav\ScanSct.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 19]
[PID: 1324][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\system32\APFMON40.DLL] [TurboPower Software Company, 4.05.0.0]
[C:\WINDOWS\system32\apfaxcnv.dll] [TurboPower Software Company, 4.05.0.0]
[PID: 1632][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2600.0000 (xpclient.010817-1148)]
[C:\WINDOWS\System32\AcSignIcon.dll] [Autodesk, 16.0.0.86]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] [Autodesk, 16.0.0.86]
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 7.0.0.0]
[D:\WinRAR3.2\file\rarext.dll] [N/A, N/A]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
[C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 2]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[PID: 1680][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1776][C:\WINDOWS\System32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: DNSRV(bld4act)]
[PID: 2000][C:\Program Files\Rising\AntiSpyware\runiep.exe] [Beijing Rising Technology Co., Ltd., 1, 0, 1, 3]
[C:\Program Files\Rising\AntiSpyware\iep_ctrl.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[PID: 2024][C:\Program Files\Rising\Rav\RavTask.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 7]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[PID: 2032][C:\WINDOWS\System32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[PID: 320][C:\Program Files\Rising\Rav\Ravmon.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 45]
[C:\Program Files\Rising\Rav\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33]
[C:\Program Files\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\Rav\RsXML.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
[C:\Program Files\Rising\Rav\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[PID: 1764][C:\Program Files\Rising\Rav\RavStub.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 4]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[PID: 820][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 268][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2600.0000 (xpclient.010817-1148)]
[C:\WINDOWS\System32\AcSignIcon.dll] [Autodesk, 16.0.0.86]
[C:\WINDOWS\System32\KakaTool.dll] [Beijing Rising Technology Co., Ltd., 2, 0, 2, 6]
[C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 2]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\System32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[C:\WINDOWS\System32\JPWB.IME] [常诚研制, 4.00.950]
[C:\Program Files\Thunder Network\Thunder\ComDlls\ThunderAgent_005.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 11]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
[PID: 964][D:\病毒专杀工具\智能扫描\sreng2\SREng.EXE] [Smallfrogs Studio, 2.3.13.690]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
API HOOK
N/A

==================================

[/CODE]

newcenturymoon - 2007-2-10 19:00:00

日志没有问题瑞星卸载掉重装

newcenturymoon - 2007-2-10 19:00:00

瑞星07貌似有导致机器重启的问题

lyj888 - 2007-2-10 19:03:00

以下我昨晚用瑞星扫描所扫到的,但监控起动不了,每天都有其它病毒,我都不敢上QQ了.
Trojan.PSW.QQPass.rma 删除成功 2007-02-10 00:42 手动扫描 C:\Program Files\Internet Explorer\Connection Wizard isignup.dll>>UPX 本机
Backdoor.BAT.Agent.a 删除成功 2007-02-10 00:43 手动扫描 C:\Program Files\RedMaple\RedVIP\vipdial vipdial.exe 本机
Trojan.PSW.JHOnline.fcr 删除成功 2007-02-10 00:52 手动扫描 C:\WINDOWS\system32 LgSyl.dll 本机
Trojan.PSW.JHOnline.fcp 删除成功 2007-02-10 00:52 手动扫描 C:\WINDOWS\system32 LgSyzr.dll>>UPX 本机
Trojan.PSW.RocOnline.c 删除成功 2007-02-10 00:54 手动扫描 C:\WINDOWS\system32 wsttr.dll 本机
Trojan.PSW.XYOnline.mb 删除成功 2007-02-10 00:54 手动扫描 C:\WINDOWS\system32 wsvbs.dll 本机
Trojan.ShellHook.n 需要解压缩后杀毒2007-02-10 01:10 手动扫描 D:\System Volume Information\_restore{603B6203-5CCF-43F8-92C4-AEE1458B12C6}\RP32 A0044962.exe>>TSECUA.COM>>UPX 本机
Trojan.ShellHook.n 需要解压缩后杀毒2007-02-10 01:10 手动扫描 D:\System Volume Information\_restore{603B6203-5CCF-43F8-92C4-AEE1458B12C6}\RP32 A0044962.exe>>TSECUA.COM>>UPX 本机
Trojan.ShellHook.n 需要解压缩后杀毒2007-02-10 01:11 手动扫描 D:\System Volume Information\_restore{603B6203-5CCF-43F8-92C4-AEE1458B12C6}\RP32 A0044987.exe>>TSECUA.COM>>UPX 本机
Trojan.ShellHook.n 需要解压缩后杀毒2007-02-10 01:11 手动扫描 D:\System Volume Information\_restore{603B6203-5CCF-43F8-92C4-AEE1458B12C6}\RP32 A0044987.exe>>TSECUA.COM>>UPX 本机
Trojan.ShellHook.n 需要解压缩后杀毒2007-02-10 04:54 手动扫描 D:\System Volume Information\_restore{603B6203-5CCF-43F8-92C4-AEE1458B12C6}\RP32 A0044962.exe>>TSECUA.COM>>UPX 本机
Trojan.ShellHook.n 需要解压缩后杀毒2007-02-10 04:54 手动扫描 D:\System Volume Information\_restore{603B6203-5CCF-43F8-92C4-AEE1458B12C6}\RP32 A0044962.exe>>TSECUA.COM>>UPX 本机
Trojan.ShellHook.n 需要解压缩后杀毒2007-02-10 04:55 手动扫描 D:\System Volume Information\_restore{603B6203-5CCF-43F8-92C4-AEE1458B12C6}\RP32 A0044987.exe>>TSECUA.COM>>UPX 本机
Trojan.ShellHook.n 需要解压缩后杀毒2007-02-10 04:55 手动扫描 D:\System Volume Information\_restore{603B6203-5CCF-43F8-92C4-AEE1458B12C6}\RP32 A0044987.exe>>TSECUA.COM>>UPX 本机

lyj888 - 2007-2-10 19:05:00

瑞星我也重装了,而且是最新的版本,装之前我把与瑞星有关的都删了再装.但监控还是禁用,郁闷呀

newcenturymoon - 2007-2-10 19:05:00

所有的Trojan.ShellHook.n 都属于误报是瑞星的问题不用你管
其他的都已经删除成功了但是瑞星监控被病毒破坏了所以你必须重装瑞星

lyj888 - 2007-2-10 19:07:00

这个星期重装了三次了,都一样呀

两个铁球 - 2007-2-10 19:08:00

日志看不出问题。你又重发帖了！

瑞星的悲哀！！！！

病毒都在系统还原文件夹里。

你是否下载、用了QQ2007betal版？

lyj888 - 2007-2-10 19:08:00

而且昨晚装的,那我现在再装一次看看.

newcenturymoon - 2007-2-10 19:08:00

在重装

两个铁球 - 2007-2-10 19:19:00

引用:

【newcenturymoon的贴子】在重装
………………

病毒在破坏瑞星文件的同时，已留下了插在某些正常的系统文件中的恶意代码，每次重装瑞星或升级，系统都会调用某个正常文件，使瑞星的一些文件被改写，重装多少次瑞星都没用。
此问题去年困扰我大半年，最终只有放弃瑞星就卡巴了之。

mopery - 2007-2-10 19:22:00

我的电脑-右键-属性-系统还原-在所有磁盘上关闭系统还原
勾上...重启..把勾取消..

lyj888 - 2007-2-10 20:04:00

我重装了,没用呀.

newcenturymoon - 2007-2-10 20:08:00

没办法了

不晓得重启是什么原因

lyj888 - 2007-2-10 20:13:00

引用:

【mopery的贴子】我的电脑-右键-属性-系统还原-在所有磁盘上关闭系统还原
勾上...重启..把勾取消..
………………

按你说的方法,做了,一样,还是黄伞.只有IE可起用,其它禁用.郁闷.

lyj888 - 2007-2-10 20:15:00

引用:

【两个铁球的贴子】日志看不出问题。你又重发帖了！

瑞星的悲哀！！！！

病毒都在系统还原文件夹里。

你是否下载、用了QQ2007betal版？

………………

我没用这个QQ2007BETAL版呀.我一直用的的QQ传美版.

lyj888 - 2007-2-10 20:16:00

高手们帮我再想想办法呀.我不想重装系统呀.

lyj888 - 2007-2-10 20:23:00

顶上去

newcenturymoon - 2007-2-10 20:28:00

原因不明的重启
应该与软件系统无关

lyj888 - 2007-2-10 20:31:00

那与系统也无关,你不会是说重装系统也没用吧,那怎么办呀?

lyj888 - 2007-2-10 20:37:00

没人能帮我了吗?

姑苏残月 - 2007-2-10 20:46:00

关闭系统还原,清理系统垃圾,添加系统启动密码,彻底卸载瑞星,然后重装,就OK了

lyj888 - 2007-2-10 20:50:00

引用:

【姑苏残月的贴子】关闭系统还原,清理系统垃圾,添加系统启动密码,彻底卸载瑞星,然后重装,就OK了
………………

上述我刚才已做过了,系统密码我本来就有.

ｃ┣┫é┏┓ - 2007-2-10 20:51:00

我也是啊....19.7后的好象不用重起,也能把监控都打开

lyj888 - 2007-2-10 20:52:00

我前段时间中的是昵称为'黄金甲'的病毒,后杀了后就一直现在这样.

ｃ┣┫é┏┓ - 2007-2-10 20:52:00

用优化大师清理下注册表啊

lyj888 - 2007-2-10 21:11:00

引用:

【ｃ┣┫é┏┓的贴子】用优化大师清理下注册表啊
………………

我刚用的超级兔子,清理了,结果一样,我数了一下,再准备起动系统时,总共起动了5次才起动到桌面.而瑞星监控还是一样,黄伞.

姑苏残月 - 2007-2-10 21:14:00

下载SRENG,扫描日志发上来吧

姑苏残月 - 2007-2-10 21:14:00

发完了叫我声

瑞星卡卡安全论坛