〖求助〗mswdm.exe的问题，论坛里的专题贴无效啊

芢歲釺歲初生襁褓狮帖子:68 注册: 2006-08-21 来自:	发表于： 2006-09-16 19:31 \| 只看楼主短消息资料字号：小中大 11楼服务 [Rising Process Communication Center / RsCCenter] <"G:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.> [RsRavMon Service / RsRavMon] <"G:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.> [StarWind iSCSI Service / StarWindService] <D:\Program Files\120%\Alcohol 120\StarWind\StarWindService.exe><Rocket Division Software> [Ulead Burning Helper / UleadBurningHelper] <C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe><Ulead Systems, Inc.>
芢歲釺歲初生襁褓狮帖子:68 注册: 2006-08-21 来自:

芢歲釺歲初生襁褓狮帖子:68 注册: 2006-08-21 来自:	发表于： 2006-09-16 19:32 \| 只看楼主短消息资料字号：小中大 12楼浏览器加载项 [IeCatch5 Class] {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <D:\PROGRA~1\FLASHGET\jccatch.dll, FlashGet> [超级兔子上网精灵] {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} <D:\Program Files\MagicSet\haokanbar.dll, Xiang Feng Technology> [QQ] {c95fe080-8f5d-11d2-a20b-00aa003c157b} <G:\qq\QQ.EXE, TENCENT> [FlashGet] {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <D:\PROGRA~1\FLASHGET\flashget.exe, FlashGet.com> [Messenger] {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation> [FlashGet Bar] {E0E899AB-F487-11D5-8D29-0050BA6940E3} <D:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft> [超级兔子上网精灵] {43869BB3-22FD-4F15-9B46-238106BA2F4E} <D:\Program Files\MagicSet\haokanbar.dll, Xiang Feng Technology> [MoxtvUploadX Control] {30348281-949B-4E9F-8A99-44EC423EB66D} <C:\WINDOWS\DOWNLO~1\MOXUPL~1.OCX, > [photo_uploader Control] {A984ED9F-E8DA-44E5-BC18-C14B9ABEF79D} <C:\WINDOWS\DOWNLO~1\PHOTO_~1.OCX, N/A> [Windows Media Player] {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\msdxm.ocx, Microsoft Corporation> [HTML Document] {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A> [DHTML Edit Control Safe for Scripting for IE5] {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation> [IeCatch5 Class] {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <D:\PROGRA~1\FLASHGET\jccatch.dll, FlashGet> [MoxtvUploadX Control] {30348281-949B-4E9F-8A99-44EC423EB66D} <C:\WINDOWS\DOWNLO~1\MOXUPL~1.OCX, > [Tabular Data Control] {333C7BC4-460F-11D0-BC04-0080C7055A83} <C:\WINDOWS\system32\tdc.ocx, Microsoft Corporation> [HHCtrl Object] {41B23C28-488E-4E5C-ACE2-BB0BBABE99E8} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation> [超级兔子上网精灵] {43869BB3-22FD-4F15-9B46-238106BA2F4E} <D:\Program Files\MagicSet\haokanbar.dll, Xiang Feng Technology> [Shell Name Space] {55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A> [AdPutHelper.AdHelper] {631EDC67-F035-49BA-B8BC-983B474E9BB4} <C:\WINDOWS\system32\AdPutHelper.dll, chuangya> [Windows Media Player] {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [Active Desktop Mover] {72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A> [超级兔子上网精灵] {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} <D:\Program Files\MagicSet\haokanbar.dll, Xiang Feng Technology> [Microsoft Web 浏览器] {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation> [IeCatch2 Class] {A5366673-E8CA-11D3-9CD9-0090271D075B} <D:\PROGRA~1\FLASHGET\jccatch.dll, FlashGet> [photo_uploader Control] {A984ED9F-E8DA-44E5-BC18-C14B9ABEF79D} <C:\WINDOWS\DOWNLO~1\PHOTO_~1.OCX, N/A> [Microsoft Scriptlet Component] {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation> [SearchAssistantOC] {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A> [RDS.DataSpace] {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation> [AUDIO__MP3 Moniker Class] {CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [VIDEO__X_MS_WMV Moniker Class] {CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [RealPlayer G2 Control] {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.> [FlashGet Bar] {E0E899AB-F487-11D5-8D29-0050BA6940E3} <D:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft> [BHelper Class] {F2E37336-BFDB-409B-8D0E-6F013C438B20} <C:\WINDOWS\761o6bc0.dll, N/A> [上传到QQ网络硬盘] <G:\qq\AddToNetDisk.htm, N/A> [使用网际快车下载] <D:\PROGRA~1\FLASHGET\jc_link.htm, N/A> [使用网际快车下载全部链接] <D:\PROGRA~1\FLASHGET\jc_all.htm, N/A> [导出到 Microsoft Office Excel(&X)] <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A> [添加到QQ自定义面板] <G:\qq\AddPanel.htm, N/A> [添加到QQ表情] <G:\qq\AddEmotion.htm, N/A> [用QQ彩信发送该图片] <G:\qq\SendMMS.htm, N/A> [用比特精灵下载(&B)] <G:\BitSpirit\bsurl.htm, N/A>
芢歲釺歲初生襁褓狮帖子:68 注册: 2006-08-21 来自:

芢歲釺歲初生襁褓狮帖子:68 注册: 2006-08-21 来自:	发表于： 2006-09-16 19:33 \| 只看楼主短消息资料字号：小中大 13楼正在运行的进程 [PID: 508][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 568][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 592][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [C:\WINDOWS\system32\SSMWinlogonEx.dll] <System Safety Limited><2.2.0.583> [PID: 640][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 652][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 804][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 848][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 916][G:\Program Files\Rising\Rav\CCenter.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3> [PID: 932][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 972][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1096][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1176][G:\Program Files\Rising\Rav\Ravmond.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 35> [G:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19> [G:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [G:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [G:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11> [G:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [G:\Program Files\Rising\Rav\RsLog.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20> [G:\Program Files\Rising\Rav\HOOKSYS.dll] <Beijing Rising Technology Co., Ltd.><18, 1, 0, 11> [G:\Program Files\Rising\Rav\Scanner.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 32> [G:\Program Files\Rising\Rav\libload.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [G:\Program Files\Rising\Rav\VirusLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12> [G:\Program Files\Rising\Rav\regmon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6> [G:\Program Files\Rising\Rav\HookWeb.dll] <rising><18, 0, 0, 2> [G:\Program Files\Rising\Rav\MemMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [G:\Program Files\Rising\Rav\expscan.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [G:\Program Files\Rising\Rav\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3> [G:\Program Files\Rising\Rav\MailMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [G:\Program Files\Rising\Rav\SpamEng.dll] <N/A><18, 0, 0, 6> [G:\Program Files\Rising\Rav\engine.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 34> [G:\Program Files\Rising\Rav\PostTrt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 15> [G:\Program Files\Rising\Rav\UnExe.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11> [G:\Program Files\Rising\Rav\ScanExec.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11> [G:\Program Files\Rising\Rav\ScanEx.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21> [G:\Program Files\Rising\Rav\RSUnpack.dll] <Beijing Rising Technology Co., Ltd.><1, 0, 0, 13> [G:\Program Files\Rising\Rav\NvFile.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7> [G:\Program Files\Rising\Rav\ScanMac.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9> [G:\Program Files\Rising\Rav\ScanSct.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 18> [G:\Program Files\Rising\Rav\Unpacker.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [G:\Program Files\Rising\Rav\ExtOLE.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6> [G:\Program Files\Rising\Rav\ScanNet.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [PID: 1288][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)> [D:\PROGRA~1\FLASHGET\jccatch.dll] <FlashGet><1, 1, 5, 0> [G:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\WINDOWS\system32\l3codeca.acm] <Fraunhofer Institut Integrierte Schaltungen IIS><1, 9, 0, 0305> [C:\WINDOWS\system32\msdmo.dll] <N/A><N/A> [PID: 1496][C:\WINDOWS\SOUNDMAN.EXE] <Realtek Semiconductor Corp.><5.1.0.27> [PID: 1516][G:\Program Files\Rising\Rav\RavTask.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22> [G:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [G:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [G:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11> [G:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [PID: 1540][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1652][G:\Program Files\Rising\Rav\Ravmon.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 33> [G:\Program Files\Rising\Rav\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 26> [G:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19> [G:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [G:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11> [G:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [G:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [G:\Program Files\Rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [PID: 1668][C:\Program Files\河南铁通宽带拨号软件\HNMainUI.exe] <N/A><2, 3, 0, 1> [C:\Program Files\河南铁通宽带拨号软件\HNKernel.dll] <HelloNet><2.2.0.1> [C:\Program Files\河南铁通宽带拨号软件\HNUtils.dll] <N/A><2, 2, 0, 1> [C:\Program Files\河南铁通宽带拨号软件\HNRes_0804.dll] <N/A><2, 2, 0, 1> [C:\Program Files\河南铁通宽带拨号软件\plugins\Diagnose.dll] <HelloNet><2.2.0.1> [PID: 1752][G:\Program Files\Rising\Rav\RavStub.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16> [G:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [G:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [PID: 264][D:\Program Files\120%\Alcohol 120\StarWind\StarWindService.exe] <Rocket Division Software><2.6.1 Build 0x20050401> [PID: 420][C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe] <Ulead Systems, Inc.><1, 0, 0, 4> [PID: 496][C:\WINDOWS\system32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: dnsrv(bld4act)> [PID: 1104][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 2384][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)> [D:\Program Files\MagicSet\haokanbar.dll] <Xiang Feng Technology><2, 2, 0, 1612> [D:\PROGRA~1\FLASHGET\jccatch.dll] <FlashGet><1, 1, 5, 0> [G:\Program Files\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\WINDOWS\system32\UNISPIM.IME] <北京清华紫光软件股份有限公司><3.0.0.3045> [C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] <Adobe Systems, Inc.><9,0,16,0> [PID: 3672][D:\PROGRA~1\FLASHGET\flashget.exe] <FlashGet.com><1, 7, 2, 0> [PID: 2836][C:\Program Files\Windows Media Player\wmplayer.exe] <Microsoft Corporation><10.00.00.3802> [G:\Program Files\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\WINDOWS\system32\msdmo.dll] <N/A><N/A> [C:\WINDOWS\system32\l3codeca.acm] <Fraunhofer Institut Integrierte Schaltungen IIS><1, 9, 0, 0305> [C:\WINDOWS\system32\ffdshow.ax] <N/A><1, 0, 0, 1> [PID: 3560][G:\Program Files\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
芢歲釺歲初生襁褓狮帖子:68 注册: 2006-08-21 来自:

芢歲釺歲初生襁褓狮帖子:68 注册: 2006-08-21 来自:	发表于： 2006-09-16 19:34 \| 只看楼主短消息资料字号：小中大 14楼文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .LNK OK. [{00021401-0000-0000-C000-000000000046}]
芢歲釺歲初生襁褓狮帖子:68 注册: 2006-08-21 来自:

卡卡技术团队

帖子:8368
注册: 2006-01-09
来自:

发表于： 2006-09-16 19:35 | 短消息资料

字号：小中大 15楼

引用:

【芢歲釺歲的贴子】晕``谁能帮忙想想问题出在哪里啊？

注册表里的LOAD已经完全删除（应该删了，WINDOWS里没）
启动里的那个9也完全删除（应该删了，SREng启动里已经没了）
QQ完全卸了！
也重起了，隐藏文件显示之类的也都设置了。

为什么最后回收站里没病毒文件啊？

拜托。。。。急啊

………………

你的意思是：
注册表里的LOAD已经完全删除（应该删了，WINDOWS里没）
启动里的那个9也完全删除（应该删了，SREng启动里已经没了）
QQ完全卸了！
也重起了，隐藏文件显示之类的也都设置了。
然后你就期待着这样回收站就会自动出现那个文件？！
如果这样想就错了，做完了这些，文件要你自己去删到回收站，而不是说它自己就跑到回收站了。

大版主

帖子:72578
注册: 2003-04-10
来自:

发表于： 2006-09-16 20:23 | 短消息资料

字号：小中大 16楼

引用:

【芢歲釺歲的贴子】斑竹啊

我是完全按照这个贴子做的

http://forum.ikaka.com/topic.asp?board=28&artid=8156736&page=7

能帮忙想想问题出在哪里吗？

………………

你的问题是“mswdm.exe”如何查杀。

http://forum.ikaka.com/topic.asp?board=28&artid=8156736&page=1————这个帖子是讲“ Ravdm.exe的查杀”

蛮拧！！

baohe 大版主帖子:72578 注册: 2003-04-10 来自:	发表于： 2006-09-16 20:32 \| 短消息资料字号：小中大 17楼【回复“芢歲釺歲”的帖子】你可以看看这个帖子： http://forum.ikaka.com/topic.asp?board=28&artid=8154055
baohe 大版主帖子:72578 注册: 2003-04-10 来自:

卡卡技术团队

帖子:8368
注册: 2006-01-09
来自:

发表于： 2006-09-16 20:34 | 短消息资料

字号：小中大 18楼

引用:

【baohe的贴子】

你的问题是“mswdm.exe”如何查杀。

http://forum.ikaka.com/topic.asp?board=28&artid=8156736&page=1————这个帖子是讲“ Ravdm.exe的查杀”

蛮拧！！
………………

没想到楼主会搞错成这种地步，所以没有注意这个链接。我汗了。

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 〖求助〗mswdm.exe的问题，论坛里的专题贴无效啊

〖求助〗mswdm.exe的问题，论坛里的专题贴无效啊

瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛〖求助〗mswdm.exe的问题，论坛里的专题贴无效啊