[求助求救求教]正版瑞星查了没有,专杀工具清除完还在的毒 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛 [求助求救求教]正版瑞星查了没有,专杀工具清除完还在的毒

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

12

2 / 2 页

跳转页

[求助求救求教]正版瑞星查了没有,专杀工具清除完还在的毒

中毒之月君初生襁褓狮帖子:54 注册: 2006-10-02 来自:	发表于： 2006-10-03 15:56 \| 只看楼主短消息资料字号：小中大 11楼正在运行的进程 [PID: 540][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 596][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 620][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 664][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 676][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 828][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 896][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 992][D:\文件1\防毒软件\Rising\Rav\CCenter.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3] [PID: 1036][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1128][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1196][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1256][D:\文件1\防毒软件\Rising\Rav\Ravmond.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 1, 35] [D:\文件1\防毒软件\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 19] [D:\文件1\防毒软件\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1] [D:\文件1\防毒软件\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2] [D:\文件1\防毒软件\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11] [D:\文件1\防毒软件\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [D:\文件1\防毒软件\Rising\Rav\RsLog.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20] [D:\文件1\防毒软件\Rising\Rav\HOOKSYS.dll] [Beijing Rising Technology Co., Ltd., 18, 1, 0, 11] [D:\文件1\防毒软件\Rising\Rav\Scanner.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 32] [D:\文件1\防毒软件\Rising\Rav\libload.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10] [D:\文件1\防毒软件\Rising\Rav\VirusLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 12] [D:\文件1\防毒软件\Rising\Rav\regmon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6] [D:\文件1\防毒软件\Rising\Rav\HookWeb.dll] [rising, 18, 0, 0, 2] [D:\文件1\防毒软件\Rising\Rav\MemMon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10] [D:\文件1\防毒软件\Rising\Rav\expscan.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [D:\文件1\防毒软件\Rising\Rav\mPorts.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3] [D:\文件1\防毒软件\Rising\Rav\MailMon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5] [D:\文件1\防毒软件\Rising\Rav\SpamEng.dll] [N/A, 18, 0, 0, 6] [D:\文件1\防毒软件\Rising\Rav\engine.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 34] [D:\文件1\防毒软件\Rising\Rav\PostTrt.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 16] [D:\文件1\防毒软件\Rising\Rav\UnExe.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11] [D:\文件1\防毒软件\Rising\Rav\ScanExec.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11] [D:\文件1\防毒软件\Rising\Rav\ScanEx.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 27] [D:\文件1\防毒软件\Rising\Rav\RSUnpack.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 17] [D:\文件1\防毒软件\Rising\Rav\NvFile.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 7] [D:\文件1\防毒软件\Rising\Rav\ScanMac.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10] [D:\文件1\防毒软件\Rising\Rav\ScanSct.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 19] [D:\文件1\防毒软件\Rising\Rav\Unpacker.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5] [PID: 1468][d:\文件1\防毒软件\rising\rfw\rfwsrv.exe] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 33] [d:\文件1\防毒软件\rising\rfw\RfwRule.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 13] [d:\文件1\防毒软件\rising\rfw\rfwlog.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 6] [d:\文件1\防毒软件\rising\rfw\Rfwdrv.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 21] [d:\文件1\防毒软件\rising\rfw\MonDrv.dll] [rs, 1, 0, 0, 4] [d:\文件1\防毒软件\rising\rfw\ProcLib.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 9] [PID: 1476][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [D:\文件1\防毒软件\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 21] [PID: 1656][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)] [PID: 1840][D:\文件1\防毒软件\Rising\Rav\RavStub.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 16] [D:\文件1\防毒软件\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1] [D:\文件1\防毒软件\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [PID: 1980][d:\文件1\防毒软件\rising\rfw\RfwMain.exe] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 52] [d:\文件1\防毒软件\rising\rfw\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 23] [d:\文件1\防毒软件\rising\rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [d:\文件1\防毒软件\rising\rfw\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5] [PID: 1992][D:\文件1\防毒软件\Rising\Rav\RavTask.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 22] [D:\文件1\防毒软件\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [D:\文件1\防毒软件\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2] [D:\文件1\防毒软件\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11] [D:\文件1\防毒软件\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1] [PID: 2004][D:\文件1\防毒软件\Rising\Rav\Ravmon.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 1, 33] [D:\文件1\防毒软件\Rising\Rav\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 26] [D:\文件1\防毒软件\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 19] [D:\文件1\防毒软件\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2] [D:\文件1\防毒软件\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11] [D:\文件1\防毒软件\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [D:\文件1\防毒软件\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1] [D:\文件1\防毒软件\Rising\Rav\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5] [PID: 204][C:\WINDOWS\system32\nvsvc32.exe] [NVIDIA Corporation, 6.14.10.5216] [PID: 424][C:\WINDOWS\system32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)] [PID: 2728][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [D:\文件1\防毒软件\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx] [Macromedia, Inc., 8,0,5,0] [PID: 2976][D:\文件1\防毒软件\电软\SREng\SREng.exe] [Smallfrogs Studio, 2.2.6.605] ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\system32\winhlp32.exe %1] .INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .LNK OK. [{00021401-0000-0000-C000-000000000046}]
中毒之月君初生襁褓狮帖子:54 注册: 2006-10-02 来自:

中毒之月君初生襁褓狮帖子:54 注册: 2006-10-02 来自:	发表于： 2006-10-03 16:19 \| 只看楼主短消息资料字号：小中大 12楼再呈上现在用HijackThis扫的日志 Scan saved at 16:08:47, on 2006-10-3 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe D:\文件1\防毒软件\Rising\Rav\CCenter.exe C:\WINDOWS\System32\svchost.exe D:\文件1\防毒软件\Rising\Rav\Ravmond.exe d:\文件1\防毒软件\rising\rfw\rfwsrv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe D:\文件1\防毒软件\Rising\Rav\RavStub.exe d:\文件1\防毒软件\rising\rfw\RfwMain.exe D:\文件1\防毒软件\Rising\Rav\RavTask.exe D:\文件1\防毒软件\Rising\Rav\Ravmon.exe C:\WINDOWS\system32\nvsvc32.exe D:\文件1\防毒软件\Rising\Rav\Rav.exe D:\文件1\防毒软件\Rising\Rav\RsAgent.exe C:\WINDOWS\msagent\AgentSvr.exe C:\Program Files\Internet Explorer\iexplore.exe D:\文件1\防毒软件\电软\HijackThis.exe F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll O4 - HKLM\..\Run: [RavTask] "D:\文件1\防毒软件\Rising\Rav\RavTask.exe" -system O4 - HKLM\..\Run: [PHIME2002A] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [PHIME2002ASync] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\RunOnce: [RavStub] "D:\文件1\防毒软件\Rising\Rav\ravstub.exe" /RUNONCE O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\Program Files\Tencent\QQ\AddToNetDisk.htm O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Program Files\Tencent\QQ\AddPanel.htm O8 - Extra context menu item: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Program Files\Tencent\QQ\SendMMS.htm O16 - DPF: {87CCFDB0-C4BE-4BC2-A78C-9EAA7CF96667} (pcastup Class) - http://ps.itv.mop.com/dn/files/vodupdate_1.0.0.10_20080809.cab O16 - DPF: {A8C3B40D-5384-44AD-ACC4-504B4D8A85F5} (BoBo P2P多媒体网络点播/广播/直播系统 V2) - http://www.17bobo.com/Software/BoBo_ActiveX_V2.ocx O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - d:\文件1\防毒软件\rising\rfw\rfwproxy.exe O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - d:\文件1\防毒软件\rising\rfw\rfwsrv.exe O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\文件1\防毒软件\Rising\Rav\CCenter.exe O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\文件1\防毒软件\Rising\Rav\Ravmond.exe
中毒之月君初生襁褓狮帖子:54 注册: 2006-10-02 来自:

中毒之月君初生襁褓狮帖子:54 注册: 2006-10-02 来自:	发表于： 2006-10-03 16:31 \| 只看楼主短消息资料字号：小中大 13楼每次开机都自动关了偶的[关闭高级文字服务]栏目问题还没解决 SREng.exe的启动项目的UserInit是红色的
中毒之月君初生襁褓狮帖子:54 注册: 2006-10-02 来自:

中毒之月君初生襁褓狮帖子:54 注册: 2006-10-02 来自:	发表于： 2006-10-03 18:17 \| 只看楼主短消息资料字号：小中大 14楼说C:\WINDOWS\system32\Userinit.exe 有毒怎么杀,用了瑞星杀但杀不出东西来用专杀工具杀完再杀还是存在里面高手们快出来
中毒之月君初生襁褓狮帖子:54 注册: 2006-10-02 来自:

westbeck 初生襁褓狮帖子:3572 注册: 2006-07-27 来自:	发表于： 2006-10-03 18:26 \| 短消息资料字号：小中大 15楼请放心,日志正常了 SREng.exe的启动项目的UserInit是红色的这一项正常的,可以不用理会如果你觉得碍眼,可以点编辑,在后面C:\WINDOWS\system32\Userinit.exe加个逗号其实改不改都没问题的
westbeck 初生襁褓狮帖子:3572 注册: 2006-07-27 来自:

中毒之月君初生襁褓狮帖子:54 注册: 2006-10-02 来自:	发表于： 2006-10-03 18:56 \| 只看楼主短消息资料字号：小中大 16楼那为什么点进SREng.exe的启动项目出现[警告!注册表值勤UserInit被修改为非常值......下面一排字]叫偶用杀软杀呢????
中毒之月君初生襁褓狮帖子:54 注册: 2006-10-02 来自:

中毒之月君初生襁褓狮帖子:54 注册: 2006-10-02 来自:	发表于： 2006-10-03 21:07 \| 只看楼主短消息资料字号：小中大 17楼为什么偶的瑞星个人防火墙下启动选项的HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load下面有个勾住的PW 后面路径PW?EXE 是红色的以前是没有的很干净的,如果有问题又是怎样解决?先谢谢上面的大哥
中毒之月君初生襁褓狮帖子:54 注册: 2006-10-02 来自:

中毒之月君初生襁褓狮帖子:54 注册: 2006-10-02 来自:	发表于： 2006-10-03 21:11 \| 只看楼主短消息资料字号：小中大 18楼为什么偶的瑞星个人防火墙下启动选项的HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load下面有个勾住的PW 后面路径PW?EXE 是红色的以前是没有的很干净的,如果有问题又是怎样解决?先谢谢上面的大哥
中毒之月君初生襁褓狮帖子:54 注册: 2006-10-02 来自:

我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林	发表于： 2006-10-04 00:07 \| 短消息资料字号：小中大 19楼同意十四楼的兄弟无需理会。
我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林

<<上一主题|下一主题>>

12

2 / 2 页

跳转页

页面顶部

Powered by Discuz!NT