【求助】这个病毒为什么杀了还有,每次重启系统自动查杀都有?(附图)

电脑侠客社区嘉宾帖子:10136 注册: 2004-01-09 来自:北京	发表于： 2006-09-15 14:35 \| 短消息资料字号：小中大 11楼进入安全模式，开始－运行－REGEDIT，打开注册表编辑器，展开 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services分支删除[win32 / win32]。将C:\WINDOWS\win32文件夹删除。展开HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run，删除Start; 全盘搜索Start.exe并删除用SRENG修复以下文件关联 .TXT Error. [notepad.exe %1] .CHM Error. [hh.exe %1] .INI Error. [notepad.exe %1] .INF Error. [notepad.exe %1] .VBS Error. [wscript.exe "%1" %*] SRENG用法到ljs3509.ys168.com反病毒及安全工具区下载SREngHelp2.rar（ System Repair Engineer2.0.21.505用户手册）将图中染毒文件删除
电脑侠客社区嘉宾帖子:10136 注册: 2004-01-09 来自:北京

HathenSU 初生襁褓狮帖子:23 注册: 2006-09-15 来自:	发表于： 2006-09-15 14:40 \| 只看楼主短消息资料字号：小中大 12楼【回复“电脑侠客”的帖子】楼上非常感谢啊! 我之前曾经发现是start.exe捣的鬼,但是我在system32文件夹下面同时发现4个start.exe,删了马上又显示出来,很奇怪啊,现在找它又不见了! 不过我还是先按照上面的操作1下,有问题在上来请教!
HathenSU 初生襁褓狮帖子:23 注册: 2006-09-15 来自:

初生襁褓狮

帖子:23
注册: 2006-09-15
来自:

发表于： 2006-09-15 14:51 | 只看楼主 短消息资料

字号：小中大 13楼

引用:

【电脑侠客的贴子】进入安全模式，开始－运行－REGEDIT，打开注册表编辑器，展开
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services分支
删除[win32 / win32]。将C:\WINDOWS\win32文件夹删除。
展开HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run，删除Start; 全盘搜索Start.exe并删除

用SRENG修复以下文件关联

.TXT Error. [notepad.exe %1]
.CHM Error. [hh.exe %1]
.INI Error. [notepad.exe %1]
.INF Error. [notepad.exe %1]
.VBS Error. [wscript.exe "%1" %*]

SRENG用法
到ljs3509.ys168.com反病毒及安全工具区下载SREngHelp2.rar（ System Repair Engineer2.0.21.505用户手册）

将图中染毒文件删除

………………

还有点疑问就是这个为什么瑞星不能'搞定' 它呢?

无情的梦拙长孩提狮帖子:102 注册: 2005-01-30 来自:	发表于： 2006-09-15 14:53 \| 短消息资料字号：小中大 14楼电脑侠客帮我搞下啊~!~!~ 我时间不多了~!~
无情的梦拙长孩提狮帖子:102 注册: 2005-01-30 来自:

HathenSU 初生襁褓狮帖子:23 注册: 2006-09-15 来自:	发表于： 2006-09-15 19:52 \| 只看楼主短消息资料字号：小中大 15楼问题应该已经解决,非常感谢侠客!! 顺便附上修复之后的log文件
HathenSU 初生襁褓狮帖子:23 注册: 2006-09-15 来自:

HathenSU 初生襁褓狮帖子:23 注册: 2006-09-15 来自:	发表于： 2006-09-15 19:52 \| 只看楼主短消息资料字号：小中大 16楼 2006-09-15,19:36:19 System Repair Engineer 2.0.21.505 (2.0 RC 2) Smallfrogs (http://www.KZTechs.com) Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能以下内容被选中：所有的启动项目（包括注册表、启动文件夹、服务等）浏览器加载项正在运行的进程（包括进程模块信息）文件关联启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <load><> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation] <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation] <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation] <HControl><C:\WINDOWS\ATK0100\HControl.exe> [] <SynTPEnh><C:\Program Files\Synaptics\SynTP\SynTPEnh.exe> [Synaptics, Inc.] <DAEMON Tools><"C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033> [DT Soft Ltd.] <NeroFilterCheck><C:\WINDOWS\system32\NeroCheck.exe> [Ahead Software Gmbh] <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.] <IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload> [Microsoft Corporation] <Wireless Console 2><C:\Program Files\Wireless Console 2\wcourier.exe> [] <ATKMEDIA><C:\Program Files\ASUS\ATK Media\DMEDIA.EXE> [ASUSTeK Computer INC.] <Power_Gear><C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1> [] <ACMON><C:\Program Files\ASUS\Splendid\ACMON.exe> [ATK] <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><EXPLORER.EXE> [Microsoft Corporation] <Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <UIHost><logonui.exe> [Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.] ================================== 启动文件夹服务 [Ati HotKey Poller / Ati HotKey Poller] <C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.> [C-DillaCdaC11BA / C-DillaCdaC11BA] <C:\WINDOWS\system32\drivers\CDAC11BA.EXE><Macrovision> [Intel(R) PROSet/Wireless Event Log / EvtEng] <C:\Program Files\Intel\Wireless\Bin\EvtEng.exe><Intel Corporation> [LightScribeService Direct Disc Labeling Service / LightScribeService] <"C:\Program Files\Common Files\LightScribe\LSSrvc.exe"><Hewlett-Packard Company> [Intel(R) PROSet/Wireless Registry Service / RegSrvc] <C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe><Intel Corporation> [Rising Proxy Service / RfwProxySrv] <c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.> [Rising Personal Firewall Service / RfwService] <c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.> [Rising Process Communication Center / RsCCenter] <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.> [RsRavMon Service / RsRavMon] <"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.> [Intel(R) PROSet/Wireless Service / S24EventMonitor] <C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe><Intel Corporation> ================================== 浏览器加载项 [卡卡上网安全助手] {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.> [Edit Class] {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\WINDOWS\system32\CMBEdit.dll, > [WUWebControl Class] {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation> [Java Plug-in 1.4.2] {8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll, JavaSoft / Sun Microsystems, Inc.> [Edit Class] {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\WINDOWS\system32\CMBEdit.dll, > [Windows Media Player] {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation> [HTML Document] {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A> [WEBChatRoomOCX Control] {448A5F6B-8C03-4B54-A338-F00237C508AD} <C:\PROGRA~1\sina\UCWEBC~1\UCWEBC~1.OCX, N/A> [WUWebControl Class] {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation> [Windows Media Player] {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [Microsoft Web 浏览器] {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation> [Thunder Browser Helper] {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD> [Microsoft Scriptlet Component] {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation> [卡卡上网安全助手] {AFF6E516-CBE5-4F8A-9C2F-38A68013E766} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.> [SearchAssistantOC] {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A> [RDS.DataSpace] {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation> [RealPlayer G2 Control] {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx, Macromedia, Inc.> [卡卡上网安全助手] {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
HathenSU 初生襁褓狮帖子:23 注册: 2006-09-15 来自:

HathenSU 初生襁褓狮帖子:23 注册: 2006-09-15 来自:	发表于： 2006-09-15 19:53 \| 只看楼主短消息资料字号：小中大 17楼 ================================== 正在运行的进程 [PID: 928][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 984][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1012][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1064][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1076][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1244][C:\WINDOWS\system32\Ati2evxx.exe] <ATI Technologies Inc.><6.14.10.4129> [C:\WINDOWS\system32\Ati2edxx.dll] <ATI Technologies, Inc.><6, 14, 10, 2500> [PID: 1260][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1340][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1380][C:\Program Files\Rising\Rav\CCenter.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3> [PID: 1396][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1464][C:\Program Files\Intel\Wireless\Bin\EvtEng.exe] <Intel Corporation><10, 1, 0, 1> [C:\Program Files\Intel\Wireless\Bin\PsRegApi.dll] <Intel Corporation><10, 1, 0, 2> [C:\Program Files\Intel\Wireless\Bin\TraceAPI.DLL] <Intel Corporation><10, 1, 0, 5> [PID: 1492][C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe] <Intel Corporation ><10, 1, 0, 33> [C:\Program Files\Intel\Wireless\Bin\TraceAPI.DLL] <Intel Corporation><10, 1, 0, 5> [C:\Program Files\Intel\Wireless\Bin\PsRegApi.dll] <Intel Corporation><10, 1, 0, 2> [C:\Program Files\Intel\Wireless\Bin\LIBEAY32.dll] <N/A><N/A> [C:\Program Files\Intel\Wireless\Bin\IntStngs.dll] <><10, 1, 0, 3> [C:\Program Files\Intel\Wireless\Bin\IWMSPROV.DLL] <N/A><N/A> [PID: 1680][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1728][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1744][C:\Program Files\Rising\Rav\Ravmond.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 33> [C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11> [C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\Program Files\Rising\Rav\RsLog.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20> [C:\Program Files\Rising\Rav\HOOKSYS.dll] <Beijing Rising Technology Co., Ltd.><18, 1, 0, 11> [C:\Program Files\Rising\Rav\Scanner.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30> [C:\Program Files\Rising\Rav\libload.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [C:\Program Files\Rising\Rav\VirusLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12> [C:\Program Files\Rising\Rav\regmon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6> [C:\Program Files\Rising\Rav\HookWeb.dll] <rising><18, 0, 0, 2> [C:\Program Files\Rising\Rav\MemMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [C:\Program Files\Rising\Rav\expscan.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\Program Files\Rising\Rav\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3> [C:\Program Files\Rising\Rav\MailMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [C:\Program Files\Rising\Rav\SpamEng.dll] <N/A><18, 0, 0, 6> [C:\Program Files\Rising\Rav\engine.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30> [C:\Program Files\Rising\Rav\PostTrt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12> [C:\Program Files\Rising\Rav\UnExe.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11> [C:\Program Files\Rising\Rav\ScanExec.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11> [C:\Program Files\Rising\Rav\ScanEx.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 14> [C:\Program Files\Rising\Rav\NvFile.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7> [C:\Program Files\Rising\Rav\ScanMac.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9> [C:\Program Files\Rising\Rav\ScanSct.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 18> [C:\Program Files\Rising\Rav\Unpacker.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3> [C:\Program Files\Rising\Rav\ExtOLE.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6> [PID: 1932][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)> [C:\WINDOWS\system32\AcSignIcon.dll] <Autodesk><16.0.0.86> [C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] <Autodesk><16.0.0.86> [C:\Program Files\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll] <Adobe Systems, Inc.><7.0.0.0> [C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21> [PID: 1968][c:\program files\rising\rfw\rfwsrv.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 32> [c:\program files\rising\rfw\RfwRule.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 13> [c:\program files\rising\rfw\rfwlog.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 6> [c:\program files\rising\rfw\Rfwdrv.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 21> [c:\program files\rising\rfw\MonDrv.dll] <rs><1, 0, 0, 4> [c:\program files\rising\rfw\ProcLib.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 9> [PID: 544][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 636][C:\WINDOWS\system32\drivers\CDAC11BA.EXE] <Macrovision><4.20.020> [PID: 740][C:\Program Files\Common Files\LightScribe\LSSrvc.exe] <Hewlett-Packard Company><1.4.31.1> [PID: 808][C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE] <Microsoft Corporation><7.00.9466> [PID: 852][C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe] <Intel Corporation><10, 1, 0, 1> [PID: 1292][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 248][C:\Program Files\Rising\Rav\RavStub.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [PID: 416][c:\program files\rising\rfw\RfwMain.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 52> [c:\program files\rising\rfw\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23> [c:\program files\rising\rfw\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [c:\program files\rising\rfw\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [PID: 420][C:\WINDOWS\system32\wscntfy.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 584][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1220][C:\WINDOWS\ATK0100\HControl.exe] <><1043, 2, 15, 58> [C:\WINDOWS\ATK0100\CMSSC.dll] <N/A><N/A> [C:\WINDOWS\ATK0100\inter_f2.dll] <ATK><1043, 2, 15, 52> [C:\WINDOWS\ATK0100\ATKWLIOC.DLL] <ACTIONTEC Electronics,Inc><2.01.02>
HathenSU 初生襁褓狮帖子:23 注册: 2006-09-15 来自:

HathenSU 初生襁褓狮帖子:23 注册: 2006-09-15 来自:	发表于： 2006-09-15 19:54 \| 只看楼主短消息资料字号：小中大 18楼 [C:\WINDOWS\ATK0100\SiSPkt.dll] <Silicon Integrated Systems Corp.><1, 0, 0, 45> [C:\Program Files\Intel\Wireless\Bin\MurocApi.dll] <Intel Corporation><10, 1, 0, 37> [C:\Program Files\Intel\Wireless\Bin\S24MUDLL.dll] <Intel Corporation><10, 1, 0, 1> [C:\Program Files\Intel\Wireless\Bin\PsRegApi.dll] <Intel Corporation><10, 1, 0, 2> [C:\Program Files\Intel\Wireless\Bin\TraceAPI.DLL] <Intel Corporation><10, 1, 0, 5> [C:\Program Files\Intel\Wireless\Bin\IntStngs.dll] <><10, 1, 0, 3> [C:\Program Files\Intel\Wireless\Bin\LIBEAY32.dll] <N/A><N/A> [C:\WINDOWS\system32\SynCOM.dll] <Synaptics, Inc.><8.2.0 21Oct05> [PID: 1068][C:\Program Files\Synaptics\SynTP\SynTPEnh.exe] <Synaptics, Inc.><8.2.0 21Oct05> [C:\WINDOWS\system32\SynCOM.dll] <Synaptics, Inc.><8.2.0 21Oct05> [C:\WINDOWS\system32\SynTPAPI.dll] <Synaptics, Inc.><8.2.0 21Oct05> [PID: 336][C:\Program Files\DAEMON Tools\daemon.exe] <DT Soft Ltd.><4.00.0.0> [C:\Program Files\DAEMON Tools\daemon.dll] <DT Soft Ltd.><4.00.0.0> [C:\Program Files\DAEMON Tools\PFCTOC.DLL] <Padus(R), Inc.><1, 0, 0, 12> [C:\Program Files\DAEMON Tools\Plugins\Images\bw5mount.dll] <N/A><1.0.6.0> [C:\Program Files\DAEMON Tools\Plugins\Images\ccdmount.dll] <GENERIC><1.10.0.0> [C:\Program Files\DAEMON Tools\Plugins\Images\mdsmount.dll] <GENERIC><1.12.0.0> [C:\Program Files\DAEMON Tools\Plugins\Images\nrgmount.dll] <GENERIC><1.11.0.0> [C:\Program Files\DAEMON Tools\Plugins\Images\pdimount.dll] <GENERIC><1.01.0.0> [PID: 2080][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] <RealNetworks, Inc.><0.1.0.3512> [PID: 2128][C:\Program Files\Wireless Console 2\wcourier.exe] <N/A><2, 0, 2, 0> [PID: 2140][C:\Program Files\ASUS\ATK Media\DMEDIA.EXE] <ASUSTeK Computer INC.><1, 11, 0, 0> [C:\Program Files\ASUS\ATK Media\ATKMETHOD.dll] <ASUSTeK Computer Inc.><1, 11, 0, 0> [PID: 2148][C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe] <ASUSTeK Computer Inc.><1043, 6, 15, 116> [C:\Program Files\ASUS\Power4 Gear\ATKMETHOD.dll] <ASUSTeK Computer Inc.><1043, 6, 15, 116> [PID: 2164][C:\Program Files\ASUS\Splendid\ACMON.exe] <ATK><1, 0, 4, 221> [C:\Program Files\ASUS\Splendid\GLCDdll.dll] <N/A><1, 0, 0, 729> [C:\Program Files\ASUS\Splendid\Chameleon.dll] <ASUSTeK><1, 0, 0, 3> [PID: 2180][C:\Program Files\Rising\Rav\RavTask.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22> [C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [PID: 2208][C:\Program Files\Rising\Rav\Ravmon.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 32> [C:\Program Files\Rising\Rav\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 24> [C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19> [C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11> [C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [C:\Program Files\Rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [PID: 2216][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 2272][C:\WINDOWS\system32\ACEngSvr.exe] <ASUSTeK><1, 0, 0, 4> [C:\WINDOWS\system32\icm32.dll] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 2320][C:\WINDOWS\ATK0100\ATKOSD.exe] <><1043, 2, 15, 57> [PID: 2664][C:\Program Files\Rising\Rav\RsAgent.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [PID: 2684][C:\WINDOWS\msagent\AgentSvr.exe] <Microsoft Corporation><2.00.0.3422> [PID: 3364][C:\WINDOWS\system32\NOTEPAD.EXE] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 3980][C:\Documents and Settings\Suhaizhun\桌面\sreng2\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505> ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 ==================================
HathenSU 初生襁褓狮帖子:23 注册: 2006-09-15 来自:

电脑侠客社区嘉宾帖子:10136 注册: 2004-01-09 来自:北京	发表于： 2006-09-15 20:12 \| 短消息资料字号：小中大 19楼你看一下这个文件是否为正常文件 C:\Program Files\Wireless Console 2\wcourier.exe 其他的没什么问题
电脑侠客社区嘉宾帖子:10136 注册: 2004-01-09 来自:北京

初生襁褓狮

帖子:23
注册: 2006-09-15
来自:

发表于： 2006-09-16 14:19 | 只看楼主 短消息资料

字号：小中大 20楼

引用:

【电脑侠客的贴子】你看一下这个文件是否为正常文件
C:\Program Files\Wireless Console 2\wcourier.exe

其他的没什么问题
………………

这个是W-LAN的一个管理软件,没什么问题,就是在操作的时候没有发现win32的文件夹,但揪出了Start.exe

谢谢侠客了!

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

瑞星卡卡安全论坛在线技术支持在线技术支持[已关闭] 【求助】这个病毒为什么杀了还有,每次重启系统自动查杀都有?(附图)

【求助】这个病毒为什么杀了还有,每次重启系统自动查杀都有?(附图)