【求助】这病毒真要命,请高手帮我! - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛【求助】这病毒真要命,请高手帮我!

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

12

2 / 2 页

跳转页

【求助】这病毒真要命,请高手帮我!

921119 初生襁褓狮帖子:25 注册: 2005-08-04 来自:	发表于： 2006-06-01 08:53 \| 短消息资料字号：小中大 11楼这是我的所有服务，老大帮帮忙。已启动服务：服务名：Ati HotKey Poller 显示名：Ati HotKey Poller 服务名：RsCCenter 显示名：Rising Process Communication Center 服务名：RsRavMon 显示名：RsRavMon Service 服务名：RfwService 显示名：Rising Personal Firewall Service 服务名：cFosSpeedS 显示名：cFosSpeed System Service 服务名：lanmanworkstation 显示名：Workstation 服务名：RasMan 显示名：Remote Access Connection Manager 服务名：SamSs 显示名：Security Accounts Manager 服务名：SENS 显示名：System Event Notification 服务名：PolicyAgent 显示名：IPSEC Services 服务名：Netman 显示名：Network Connections 服务名：AudioSrv 显示名：Windows Audio 服务名：dmserver 显示名：Logical Disk Manager 服务名：wscsvc 显示名：Security Center 服务名：Spooler 显示名：Print Spooler 服务名：UMWdf 显示名：Windows User Mode Driver Framework 服务名：seclogon 显示名：Secondary Logon 服务名：helpsvc 显示名：Help and Support 服务名：Eventlog 显示名：Event Log 服务名：WebClient 显示名：WebClient 服务名：PlugPlay 显示名：Plug and Play 服务名：Schedule 显示名：Task Scheduler 服务名：Nla 显示名：Network Location Awareness (NLA) 服务名：TapiSrv 显示名：Telephony 服务名：ProtectedStorage 显示名：Protected Storage 服务名：winmgmt 显示名：Windows Management Instrumentation 服务名：CryptSvc 显示名：Cryptographic Services 服务名：RpcSs 显示名：Remote Procedure Call (RPC) 服务名：Dhcp 显示名：DHCP Client 服务名：Alerter 显示名：Alerter 服务名：DcomLaunch 显示名：DCOM Server Process Launcher 服务名：ALG 显示名：Application Layer Gateway Service 服务名：Dnscache 显示名：DNS Client 服务名：SharedAccess 显示名：Windows Firewall/Internet Connection Sharing (ICS) 服务名：WZCSVC 显示名：Wireless Zero Configuration 服务名：Themes 显示名：Themes 服务名：FastUserSwitchingCompatibility 显示名：Fast User Switching Compatibility 服务名：ShellHWDetection 显示名：Shell Hardware Detection 服务名：Browser 显示名：Computer Browser 服务名：W32Time 显示名：Windows Time 服务名：LmHosts 显示名：TCP/IP NetBIOS Helper 服务名：TermService 显示名：Terminal Services 服务名：wuauserv 显示名：Automatic Updates 服务名：TrkWks 显示名：Distributed Link Tracking Client 服务名：lanmanserver 显示名：Server 服务名：EventSystem 显示名：COM+ Event System
921119 初生襁褓狮帖子:25 注册: 2005-08-04 来自:

921119 初生襁褓狮帖子:25 注册: 2005-08-04 来自:	发表于： 2006-06-01 09:02 \| 短消息资料字号：小中大 12楼启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <load><> [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <run><> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <Cmaudio><RunDll32 cmicnfg.cpl,CMICtrlWnd> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <DAEMON Tools-1033><"D:\D-Tools\daemon.exe" -lang 1033> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <cFosSpeed><D:\cFosSpeed.exe> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <KernelFaultCheck><%systemroot%\system32\dumprep 0 -k> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <ATIPTA><C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] <RavStub><"C:\Program Files\Rising\Rav\ravstub.exe" /RUNONCE> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <Userinit><C:\WINDOWS\system32\userinit.exe,> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><> ================================== 启动文件夹服务 [Ati HotKey Poller / Ati HotKey Poller] <C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.> [ATI Smart / ATI Smart] <C:\WINDOWS\system32\ati2sgag.exe><> [cFosSpeed System Service / cFosSpeedS] <"D:\spd.exe" -service><cFos Software GmbH> [Rising Proxy Service / RfwProxySrv] <c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.> [Rising Personal Firewall Service / RfwService] <c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.> [Rising Process Communication Center / RsCCenter] <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.> [RsRavMon Service / RsRavMon] <"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
921119 初生襁褓狮帖子:25 注册: 2005-08-04 来自:

921119 初生襁褓狮帖子:25 注册: 2005-08-04 来自:	发表于： 2006-06-01 09:11 \| 短消息资料字号：小中大 13楼正在运行的进程 [PID: 680][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 740][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 764][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [C:\WINDOWS\system32\Ati2evxx.dll] <ATI Technologies Inc.><6.14.10.4114> [PID: 808][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 820][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 984][C:\WINDOWS\system32\Ati2evxx.exe] <ATI Technologies Inc.><6.14.10.4114> [C:\WINDOWS\system32\Ati2edxx.dll] <ATI Technologies, Inc.><6, 14, 10, 2496> [PID: 996][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1116][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1212][C:\Program Files\Rising\Rav\CCenter.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3> [PID: 1228][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1280][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1344][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1384][C:\Program Files\Rising\Rav\Ravmond.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 19> [C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\Program Files\Rising\Rav\RsLog.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 18> [C:\Program Files\Rising\Rav\HOOKSYS.dll] <Rising><18, 1, 0, 9> [C:\Program Files\Rising\Rav\Scanner.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 28> [C:\Program Files\Rising\Rav\libload.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [C:\Program Files\Rising\Rav\VirusLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [C:\Program Files\Rising\Rav\regmon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6> [C:\Program Files\Rising\Rav\HookWeb.dll] <rising><18, 0, 0, 1> [C:\Program Files\Rising\Rav\MemMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 8> [C:\Program Files\Rising\Rav\expscan.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\Program Files\Rising\Rav\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3> [C:\Program Files\Rising\Rav\MailMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [C:\Program Files\Rising\Rav\SpamEng.dll] <N/A><18, 0, 0, 6> [C:\Program Files\Rising\Rav\engine.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 26> [C:\Program Files\Rising\Rav\PostTrt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9> [C:\Program Files\Rising\Rav\UnExe.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11> [C:\Program Files\Rising\Rav\ScanExec.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [C:\Program Files\Rising\Rav\ScanEx.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7> [C:\Program Files\Rising\Rav\NvFile.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7> [C:\Program Files\Rising\Rav\ScanMac.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7> [C:\Program Files\Rising\Rav\ScanSct.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13> [C:\Program Files\Rising\Rav\Unpacker.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3> [C:\Program Files\Rising\Rav\ExtOLE.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [PID: 1588][C:\WINDOWS\system32\Ati2evxx.exe] <ATI Technologies Inc.><6.14.10.4114> [C:\WINDOWS\system32\Ati2edxx.dll] <ATI Technologies, Inc.><6, 14, 10, 2496> [PID: 1656][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)> [C:\Program Files\WinRAR\rarext.dll] <N/A><N/A> [C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13> [PID: 1728][c:\program files\rising\rfw\rfwsrv.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 32> [c:\program files\rising\rfw\RfwRule.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 13> [c:\program files\rising\rfw\rfwlog.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 6> [c:\program files\rising\rfw\Rfwdrv.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 21> [c:\program files\rising\rfw\MonDrv.dll] <rs><1, 0, 0, 4> [c:\program files\rising\rfw\ProcLib.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 9> [c:\program files\rising\rfw\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3> [PID: 1896][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1996][C:\Program Files\Rising\Rav\RavStub.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [PID: 360][c:\program files\rising\rfw\RfwMain.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 51> [c:\program files\rising\rfw\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23> [c:\program files\rising\rfw\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [c:\program files\rising\rfw\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [PID: 372][C:\Program Files\Rising\Rav\RavTask.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22> [C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [PID: 392][D:\D-Tools\daemon.exe] <DAEMON'S HOME><3.47.0.0> [C:\WINDOWS\daemon.dll] <N/A><3.47.0.0> [D:\D-Tools\PFCTOC.DLL] <Padus(R), Inc.><1, 0, 0, 12> [D:\D-Tools\Plugins\Images\bw5mount.dll] <N/A><1.0.2.0> [D:\D-Tools\Plugins\Images\ccdmount.dll] <GENERIC><1.02.0.0> [D:\D-Tools\Plugins\Images\mdsmount.dll] <GENERIC><1.01.0.0> [D:\D-Tools\Plugins\Images\nrgmount.dll] <GENERIC><1.02.0.0> [D:\D-Tools\Plugins\Images\pdimount.dll] <GENERIC><1.01.0.0> [PID: 400][C:\Program Files\Rising\Rav\Ravmon.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 17> [C:\Program Files\Rising\Rav\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 24> [C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16> [C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [C:\Program Files\Rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [PID: 416][D:\cFosSpeed.exe] <cFos Software GmbH><2.12.1034> [PID: 484][C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe] <ATI Technologies, Inc.><6.14.10.5145> [C:\Program Files\ATI Technologies\ATI Control Panel\atipdsxx.dll] <ATI Technologies, Inc.><6.14.10.5145> [C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATRPUIXX.CHS] <ATI Technologies, Inc.><6.14.10.5145> [C:\Program Files\ATI Technologies\ATI Control Panel\atipdxxx.dll] <ATI Technologies, Inc.><6.14.10.5145> [PID: 516][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1388][D:\spd.exe] <cFos Software GmbH><2.12.1034> [PID: 548][C:\WINDOWS\system32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: dnsrv(bld4act)> [PID: 2260][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 464][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)> [C:\WINDOWS\system32\xunleibho_v11.dll] <Thunder Networking Technologies,LTD><4, 6, 0, 48> [C:\Program Files\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3> [C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx] <Macromedia, Inc.><8,0,22,0> [PID: 3756][C:\Program Files\Rising\Rav\RsAgent.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [PID: 1612][C:\WINDOWS\msagent\AgentSvr.exe] <Microsoft Corporation><2.00.0.3422> [PID: 3696][C:\Documents and Settings\new\桌面\sreng2\SREng.exe] <Smallfrogs Studio><2.0.12.350>
921119 初生襁褓狮帖子:25 注册: 2005-08-04 来自:

叱咤花甲狮

帖子:5788
注册: 2003-11-15
来自:

发表于： 2006-06-01 09:11 | 只看楼主 短消息资料

字号：小中大 14楼

引用:

【不言放弃的贴子】【回复“921119”的帖子】
查系统服务啊

你与天仙子是同个人吧？
...........................

不是!只不过中了同样的病毒!

你可以查IP地址看看!

gototop

921119 初生襁褓狮帖子:25 注册: 2005-08-04 来自:	发表于： 2006-06-01 09:21 \| 短消息资料字号：小中大 15楼老大你快帮帮我啊，我在不停的刷新等你的回复，急啊
921119 初生襁褓狮帖子:25 注册: 2005-08-04 来自:

921119 初生襁褓狮帖子:25 注册: 2005-08-04 来自:	发表于： 2006-06-01 10:36 \| 短消息资料字号：小中大 16楼老大们就不能帮帮我么？另外再问下，如果实在不行，我只格掉c盘中心装系统可以去掉灰鸽子病毒么？我一共4个盘，请答复，谢谢
921119 初生襁褓狮帖子:25 注册: 2005-08-04 来自:

天仙子叱咤花甲狮帖子:5788 注册: 2003-11-15 来自:	发表于： 2006-06-01 13:06 \| 只看楼主短消息资料字号：小中大 17楼问题还未解决呀,大家帮帮忙啊!
天仙子叱咤花甲狮帖子:5788 注册: 2003-11-15 来自:

<<上一主题|下一主题>>

12

2 / 2 页

跳转页

页面顶部

Powered by Discuz!NT