瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 [已上传日志,帮我看看]顶住,不要沉

1234   3  /  4  页   跳转

[已上传日志,帮我看看]顶住,不要沉

[PID: 1028][D:\PROGRAM FILES\RISING\RAV\CCENTER.EXE]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 1044][d:\program files\rising\rfw\rfwsrv.exe]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 33>
    [d:\program files\rising\rfw\RfwRule.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 13>
    [d:\program files\rising\rfw\rfwlog.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 6>
    [d:\program files\rising\rfw\Rfwdrv.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 21>
    [d:\program files\rising\rfw\MonDrv.dll]  <rs><1, 0, 0, 4>
    [d:\program files\rising\rfw\ProcLib.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 9>
    [d:\program files\rising\rfw\mPorts.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
[PID: 1056][D:\Program Files\Rising\Rav\Ravmond.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 1, 35>
    [D:\Program Files\Rising\Rav\BWList.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
    [D:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [D:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [D:\Program Files\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [D:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [D:\Program Files\Rising\Rav\RsLog.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20>
    [D:\Program Files\Rising\Rav\HOOKSYS.dll]  <Beijing Rising Technology Co., Ltd.><18, 1, 0, 11>
    [D:\Program Files\Rising\Rav\Scanner.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 32>
    [D:\Program Files\Rising\Rav\libload.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [D:\Program Files\Rising\Rav\VirusLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
    [D:\Program Files\Rising\Rav\regmon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
    [D:\Program Files\Rising\Rav\HookWeb.dll]  <rising><18, 0, 0, 2>
    [D:\Program Files\Rising\Rav\MemMon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [D:\Program Files\Rising\Rav\expscan.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [D:\Program Files\Rising\Rav\mPorts.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
    [D:\Program Files\Rising\Rav\MailMon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
    [D:\Program Files\Rising\Rav\SpamEng.dll]  <N/A><18, 0, 0, 6>
    [D:\Program Files\Rising\Rav\engine.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 34>
    [C:\WINDOWS\system32\wshcon32.dll]  <><4, 1, 0, 0>
    [D:\Program Files\Rising\Rav\PostTrt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 15>
    [D:\Program Files\Rising\Rav\UnExe.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [D:\Program Files\Rising\Rav\ScanExec.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [D:\Program Files\Rising\Rav\ScanEx.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
    [D:\Program Files\Rising\Rav\RSUnpack.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 13>
    [D:\Program Files\Rising\Rav\NvFile.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
    [D:\Program Files\Rising\Rav\ScanMac.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
    [D:\Program Files\Rising\Rav\ScanSct.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 18>
    [D:\Program Files\Rising\Rav\Unpacker.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [D:\Program Files\Rising\Rav\ScanNet.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
    [D:\Program Files\Rising\Rav\ExtOLE.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
    [D:\Program Files\Rising\Rav\ScanElf.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 1332][C:\WINDOWS\system32\spoolsv.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\CNMLM3y.DLL]  <CANON INC.><1.52.2.0>
    [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\CNMPD3y.DLL]  <CANON INC.><1.52.2.0>
    [C:\WINDOWS\system32\cdnns.dll]  <CNNIC><2, 0, 0, 0>
[PID: 1452][D:\Program Files\Rising\Rav\RavStub.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
    [D:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [D:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 1788][C:\WINDOWS\Explorer.EXE]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\AcSignIcon.dll]  <Autodesk><16.0.0.86>
    [C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll]  <Autodesk><16.0.0.86>
    [C:\WINDOWS\system32\nvcpl.dll]  <NVIDIA Corporation><6.14.10.8040>
    [C:\WINDOWS\system32\nvshell.dll]  <NVIDIA Corporation><6.14.10.10525>
    [C:\Program Files\Common Files\Adobe\Shell\PSICON.DLL]  <Adobe Systems, Incorporated><7.0>
    [C:\Program Files\WinRAR\rarext.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\RavExt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
    [D:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [D:\Program Files\QQ2005\qdshm.dll]  <><1, 0, 101, 20>
    [D:\Program Files\QQ2005\TIMProxy.dll]  <tencent><0, 3, 2, 4>
    [C:\WINDOWS\system32\winmsd.dll]  <Microsoft Corporation><2, 0, 0, 1>
[PID: 1948][C:\WINDOWS\system32\nvsvc32.exe]  <NVIDIA Corporation><6.14.10.8040>
[PID: 1976][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 2012][C:\WINDOWS\system32\wdfmgr.exe]  <Microsoft Corporation><5.2.3790.1230 built by: dnsrv(bld4act)>
[PID: 696][D:\Program Files\Rising\Rav\RavTask.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
    [D:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [D:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [D:\Program Files\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [D:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
[PID: 764][D:\Program Files\Rising\Rav\Ravmon.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 1, 33>
    [D:\Program Files\Rising\Rav\RsGuiLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 26>
gototop
 

[D:\Program Files\Rising\Rav\BWList.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
    [D:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [D:\Program Files\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [D:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [D:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [D:\Program Files\Rising\Rav\PngDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 832][C:\WINDOWS\system32\ctfmon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 392][d:\program files\rising\rfw\RfwMain.exe]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 52>
    [d:\program files\rising\rfw\RsGuiLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23>
    [d:\program files\rising\rfw\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [d:\program files\rising\rfw\PngDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 1560][C:\WINDOWS\System32\alg.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\wshcon32.dll]  <><4, 1, 0, 0>
[PID: 3908][D:\Program Files\QQ2005\QQ.exe]  <TENCENT><0, 0, 0, 0>
    [D:\Program Files\QQ2005\QQBaseClassInDll.dll]  <><1, 0, 0, 1>
    [D:\Program Files\QQ2005\QQHelperDll.dll]  <><1, 0, 0, 1>
    [D:\Program Files\QQ2005\BasicCtrlDll.dll]  <Tencent><5, 0, 200, 370>
    [D:\Program Files\QQ2005\QQAPI.dll]  <><1, 0, 0, 1>
    [D:\Program Files\QQ2005\TIMProxy.dll]  <tencent><0, 3, 2, 4>
    [D:\Program Files\QQ2005\LoginCtrl.dll]  <><1, 0, 0, 1>
    [D:\Program Files\QQ2005\npkcntc.dll]  <INCA Internet Co., Ltd.><2006, 6, 27, 1>
    [D:\Program Files\QQ2005\npkpdb.dll]  <INCA Internet Co., Ltd.><2003, 10, 1, 1>
    [D:\Program Files\QQ2005\QQRes.dll]  <tencent><1, 0, 0, 1>
    [D:\Program Files\QQ2005\QQMainFrame.dll]  <N/A><N/A>
    [D:\Program Files\QQ2005\CQQApplication.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\cdnns.dll]  <CNNIC><2, 0, 0, 0>
    [C:\WINDOWS\system32\wshcon32.dll]  <><4, 1, 0, 0>
    [D:\Program Files\QQ2005\NewSkin.dll]  <><1, 0, 0, 1>
    [D:\Program Files\QQ2005\HostingMgr.dll]  <><1, 0, 0, 1>
    [D:\Program Files\QQ2005\CameraDll.dll]  <><1, 0, 0, 1>
    [D:\Program Files\QQ2005\MailSummary.dll]  <><1, 0, 0, 1>
    [D:\Program Files\QQ2005\QQSpace.dll]  <><1, 0, 0, 1>
    [C:\WINDOWS\system32\msdmo.dll]  <N/A><N/A>
    [D:\Program Files\QQ2005\QQGroupMng.dll]  <><1, 0, 0, 1>
    [D:\Program Files\QQ2005\GroupLive.dll]  <N/A><N/A>
    [D:\Program Files\QQ2005\UserDefinedHead.dll]  <><1, 0, 0, 1>
    [D:\Program Files\QQ2005\QQPlugin.dll]  <N/A><N/A>
    [D:\Program Files\QQ2005\QQConfigPlugin.dll]  <><1, 0, 0, 1>
    [D:\Program Files\QQ2005\QRingMng.dll]  <N/A><N/A>
    [D:\Program Files\QQ2005\PhoneAPI.dll]  <><1, 0, 0, 1>
    [D:\Program Files\QQ2005\DialerAllinOne.dll]  <tencent><1, 4, 0, 0>
    [D:\Program Files\QQ2005\VPortal.dll]  <><1, 0, 0, 4>
    [D:\Program Files\QQ2005\QQAvatar.dll]  <N/A><N/A>
    [D:\Program Files\QQ2005\FlashAvatarDll.dll]  <><1, 4, 0, 1>
    [D:\Program Files\QQ2005\LongConnection.dll]  <tencent><5, 0, 200, 160>
    [D:\Program Files\QQ2005\QQPet.dll]  <><1, 0, 0, 1>
    [D:\Program Files\QQ2005\QQSysMsgMng.dll]  <N/A><N/A>
    [D:\Program Files\QQ2005\BQQApplication.dll]  <N/A><N/A>
    [D:\Program Files\QQ2005\QQAllInOne.dll]  <N/A><N/A>
    [D:\Program Files\QQ2005\SCCore.dll]  <TENCENT><2, 0, 0, 1>
    [D:\Program Files\QQ2005\QQCustomFace.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx]  <Adobe Systems, Inc.><9,0,16,0>
    [D:\Program Files\QQ2005\QQSceneMng.dll]  <N/A><N/A>
    [D:\Program Files\QQ2005\ImageOle.dll]  <TODO: <Company name>><1.0.0.1>
    [D:\Program Files\QQ2005\GroupConnection.dll]  <Tencent><0, 3, 3, 5>
    [D:\Program Files\QQ2005\CommercesMng.dll]  <><1, 0, 0, 1>
    [D:\Program Files\QQ2005\PersonalDesktop.dll]  <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2>
    [D:\Program Files\QQ2005\QQAddr.dll]  <深圳市腾讯计算机系统有限公司><5, 0, 101, 240>
    [D:\Program Files\QQ2005\QQNetDisk.dll]  <深圳腾讯科技><8, 0, 101, 14>
    [C:\WINDOWS\system32\AcSignIcon.dll]  <Autodesk><16.0.0.86>
    [D:\Program Files\QQ2005\QQSettingCtrl.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll]  <Autodesk><16.0.0.86>
    [D:\Program Files\QQ2005\qdshm.dll]  <><1, 0, 101, 20>
    [C:\Program Files\WinRAR\rarext.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\RavExt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
    [D:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\WINDOWS\system32\nvcpl.dll]  <NVIDIA Corporation><6.14.10.8040>
    [C:\WINDOWS\system32\nvshell.dll]  <NVIDIA Corporation><6.14.10.10525>
[PID: 3980][D:\Program Files\QQ2005\TIMPlatform.exe]  <tencent><0, 3, 1, 8>
    [D:\Program Files\QQ2005\TIMProxy.dll]  <tencent><0, 3, 2, 4>
[PID: 3880][C:\WINDOWS\system32\conime.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 3916][C:\PROGRA~1\INTERN~1\iexplore.exe]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\kakatool.dll]  <Beijing Rising Technology Co., Ltd.><2, 0, 0, 9>
    [C:\WINDOWS\system32\AcSignIcon.dll]  <Autodesk><16.0.0.86>
    [C:\WINDOWS\system32\cdnns.dll]  <CNNIC><2, 0, 0, 0>
    [C:\WINDOWS\system32\wshcon32.dll]  <><4, 1, 0, 0>
    [C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll]  <Autodesk><16.0.0.86>
    [C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx]  <Adobe Systems, Inc.><9,0,16,0>
    [C:\WINDOWS\system32\winmsd.dll]  <Microsoft Corporation><2, 0, 0, 1>
    [D:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [D:\Program Files\QQ2005\TIMProxy.dll]  <tencent><0, 3, 2, 4>
[PID: 2052][C:\Documents and Settings\new\桌面\sreng2\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>
    [C:\WINDOWS\system32\cdnns.dll]  <CNNIC><2, 0, 0, 0>
    [C:\WINDOWS\system32\wshcon32.dll]  <><4, 1, 0, 0>

==================================
文件关联
.TXT  Error. [notepad.exe %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  Error. [hh.exe %1]
.HLP  Error. [winhlp32.exe %1]
.INI  Error. [notepad.exe %1]
.INF  Error. [notepad.exe %1]
.VBS  Error. [wscript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================
gototop
 

网速也很慢很慢,,,帮我看看,系统是不是要重新安装啊...
gototop
 

O2 - BHO: MyIEHelper Class - {16B770A0-0E87-4278-B748-2460D64A8386} - C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\IEHelper_5025.dll (file missing)
参考:http://csc.rising.com.cn/KnowledgeBase/detailInfo.aspx?Action=ViewInfo&InfoID=718&Channel=RSV

修复
O2 - BHO: Microsoft Solo Browser Helper Object - {E3DB85B5-C559-4894-B474-42E89FAA1EFD} - C:\WINDOWS\system32\winmsd.dll
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
删除
C:\WINDOWS\system32\winmsd.dll

O10 - 未知的文件在 Winsock LSP: c:\windows\system32\wshcon32.dll
O10 - 未知的文件在 Winsock LSP: c:\windows\system32\wshcon32.dll
需要用LSPFix 来修复..
LSPFix(汉化版) 下载地址:http://forum.ikaka.com/topic.asp?board=67&artid=5188931
(8楼...)
同时下载WinsockXPFix.exe...(2楼...)
----------------------------------------------------------------
先运行LSPFix ... 勾上 我确定要进行修复操作 ...
然后将wshcon32.dll移到右边...点下完成...
----------------------------------------------------------------
如果在操作之后不能上网...请用WinsockXPFix.exe 修复一下即可...安全模式下..
gototop
 

打开SRE 系统修复 修复文件关联..

<Torjan Program><; C:\WINDOWS\WINLOGON.EXE> []
参考:http://forum.ikaka.com/topic.asp?board=28&artid=8141143
下载幸福的狮子 编写的专杀查杀..

打开SRE 启动项目 注册表 删除
<iDuba Personal FireWall><; > []
<Kavrun><; > []

<Load>编辑改成 空值

http://www.pctutu.com/srmsdown.asp (安装版)
http://download5.pctutu.com/soft/magicset78.zip (免安装版)
下载超级兔子..用超级兔子清理王在安全模式下卸载流氓软件...
gototop
 

这哥们电脑里好多游戏啊
gototop
 

用超级兔子清理王在安全模式下卸载流氓软件后,打开网络,还是会弹出其他网页来,http://click.uoolink.com/*
http://tv.mofile.com/*
http://www.371.com/*
等等,,,卡卡一定要手动添加,自动添加到黑名单根本添加不进去,每次弹出来的页面都不一样,,郁闷,
gototop
 

刚才升级了下瑞星,现在瑞星的版本是18.44.40.就杀到4个毒,等杀完再传上来看看,
gototop
 

病毒名称处理结果扫描方式路径文件病毒来源
Backdoor.Agent.ecm删除成功手动扫描C:\WINDOWS\system32\inetsrvcsrss.exe>>Unpack本机
Trojan.DL.Agent.apf删除成功手动扫描C:\WINDOWS\system32winmsd.dll本机
Trojan.DL.Agent.apf删除成功手动扫描C:\WINDOWS\system32wlbs.dll本机
Trojan.Clicker.Delf.dk删除成功手动扫描C:\WINDOWS\system325002ad.exe>>Unpack本机
gototop
 

顶下 不要沉
gototop
 
1234   3  /  4  页   跳转
页面顶部
Powered by Discuz!NT