瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 【求助】各位大哥大姐,我中了一个瑞星查杀不到的木马

12   2  /  2  页   跳转

【求助】各位大哥大姐,我中了一个瑞星查杀不到的木马

正在运行的进程
[PID: 496][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 596][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 620][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 668][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 680][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 832][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 880][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 952][F:\瑞星杀软\Rising\Rav\CCenter.exe]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
[PID: 972][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1056][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1076][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1088][F:\瑞星杀软\Rising\Rav\Ravmond.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 43]
    [F:\瑞星杀软\Rising\Rav\BWList.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
    [F:\瑞星杀软\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [F:\瑞星杀软\Rising\Rav\rfwctrl.dll]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]
    [F:\瑞星杀软\Rising\Rav\RsPPsys.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
    [F:\瑞星杀软\Rising\Rav\RSAPPMGR.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
    [F:\瑞星杀软\Rising\Rav\CfgDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
    [F:\瑞星杀软\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [F:\瑞星杀软\Rising\Rav\RsLog.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
    [F:\瑞星杀软\Rising\Rav\HOOKSYS.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 0]
    [F:\瑞星杀软\Rising\Rav\Scanner.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 12]
    [F:\瑞星杀软\Rising\Rav\libload.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 16]
    [F:\瑞星杀软\Rising\Rav\VirusLib.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
    [F:\瑞星杀软\Rising\Rav\regmon.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6]
    [F:\瑞星杀软\Rising\Rav\psapi.dll]  [Microsoft Corporation, 4.00]
    [F:\瑞星杀软\Rising\Rav\HookWeb.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 1]
    [F:\瑞星杀软\Rising\Rav\MemMon.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 12]
    [F:\瑞星杀软\Rising\Rav\expscan.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [F:\瑞星杀软\Rising\Rav\mPorts.dll]  [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3]
    [F:\瑞星杀软\Rising\Rav\HookCont.dll]  [Rising, 19, 0, 0, 0]
    [F:\瑞星杀软\Rising\Rav\SpamEng.dll]  [N/A, 18, 0, 0, 6]
    [F:\瑞星杀软\Rising\Rav\engine.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 26]
    [F:\瑞星杀软\Rising\Rav\PostTrt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 8]
    [F:\瑞星杀软\Rising\Rav\UnExe.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
    [F:\瑞星杀软\Rising\Rav\ScanExec.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 16]
    [F:\瑞星杀软\Rising\Rav\ScanEx.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 41]
    [F:\瑞星杀软\Rising\Rav\ExtFile.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 25]
    [F:\瑞星杀软\Rising\Rav\NvFile.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 11]
    [F:\瑞星杀软\Rising\Rav\ScanMac.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 13]
    [F:\瑞星杀软\Rising\Rav\ScanSct.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 19]
    [F:\瑞星杀软\Rising\Rav\Unpacker.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 19]
    [F:\瑞星杀软\Rising\Rav\ScanPack.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 20]
    [F:\瑞星杀软\Rising\Rav\RsVM.dll]  [N/A, 19, 0, 0, 15]
    [F:\瑞星杀软\Rising\Rav\Uroutine.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 23]
    [F:\瑞星杀软\Rising\Rav\ExtOLE.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 12]
    [F:\瑞星杀软\Rising\Rav\ScanNet.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
    [F:\瑞星杀软\Rising\Rav\ScanElf.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 11]
    [F:\瑞星杀软\Rising\Rav\Uscript.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 18]
[PID: 1196][f:\瑞星防火墙\rising\rfw\rfwsrv.exe]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 33]
    [f:\瑞星防火墙\rising\rfw\RfwRule.dll]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 3]
    [f:\瑞星防火墙\rising\rfw\rfwlog.dll]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 2]
    [f:\瑞星防火墙\rising\rfw\Rfwdrv.dll]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 10]
    [f:\瑞星防火墙\rising\rfw\psapi.dll]  [Microsoft Corporation, 4.00]
    [f:\瑞星防火墙\rising\rfw\MonDrv.dll]  [rs, 1, 0, 0, 4]
    [f:\瑞星防火墙\rising\rfw\ProcLib.dll]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 5]
    [f:\瑞星防火墙\rising\rfw\mPorts.dll]  [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3]
[PID: 1328][F:\瑞星杀软\Rising\Rav\RavStub.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 4]
    [F:\瑞星杀软\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [F:\瑞星杀软\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[PID: 1436][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[PID: 1616][C:\WINDOWS\System32\nvsvc32.exe]  [NVIDIA Corporation, 6.14.10.7184]
    [C:\WINDOWS\System32\NVRSZHC.DLL]  [NVIDIA Corporation, 6.14.10.7184]
[PID: 1644][C:\Program Files\Lenovo\联想智能控制中心\SCC\SCCMonitor.exe]  [N/A, N/A]
    [C:\Program Files\Lenovo\联想智能控制中心\SCC\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
[PID: 1704][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1960][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
    [F:\卡卡\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
    [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll]  [Adobe Systems Incorporated, 7.0.7.2006011200]
    [C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\PROGRA~1\FLASHGET\jccatch.dll]  [www.flashget.com, 1, 8, 0, 1003]
    [C:\PROGRA~1\FLASHGET\fgmgr.dll]  [www.flashget.com, 1, 8, 0, 1001]
    [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll]  [Adobe Systems, Inc., 7.0.0.0]
    [C:\WINDOWS\System32\nvcpl.dll]  [NVIDIA Corporation, 6.14.10.7184]
    [C:\WINDOWS\system32\NVRSZHC.DLL]  [NVIDIA Corporation, 6.14.10.7184]
    [C:\WINDOWS\System32\nvshell.dll]  [NVIDIA Corporation, 6.14.10.10035]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, N/A]
    [F:\瑞星杀软\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[PID: 1980][f:\瑞星防火墙\rising\rfw\RfwMain.exe]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 70]
    [f:\瑞星防火墙\rising\rfw\RsGuiLib.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33]
    [f:\瑞星防火墙\rising\rfw\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [f:\瑞星防火墙\rising\rfw\RfwCtrl.dll]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]
    [f:\瑞星防火墙\rising\rfw\RsXML.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
    [f:\瑞星防火墙\rising\rfw\PngDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
    [F:\卡卡\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 2020][C:\Program Files\Lenovo\联想智能控制中心\SCC\LenovoSmartControlCenter.exe]  [N/A, N/A]
gototop
 

[C:\Program Files\Lenovo\联想智能控制中心\SCC\LxSimpleOsd.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Lenovo\联想智能控制中心\SCC\MFC71.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\Program Files\Lenovo\联想智能控制中心\SCC\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\Program Files\Lenovo\联想智能控制中心\SCC\QuakeII.dll]  [http://www.lenovo.com, 2.0]
    [F:\卡卡\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
    [C:\Program Files\Lenovo\联想智能控制中心\SCC\Remled.dll]  [N/A, N/A]
[PID: 572][C:\Program Files\联想\联想标准键盘\skdaemon.exe]  [, 1, 0, 0, 1]
    [C:\Program Files\联想\联想标准键盘\MacFun.dll]  [Silitek, 1, 0, 0, 0]
    [C:\Program Files\联想\联想标准键盘\OpenDriver.dll]  [Silitek, 1, 0, 0, 0]
    [C:\Program Files\联想\联想标准键盘\OSD.dll]  [silitek, 1, 0, 0, 1]
    [C:\Program Files\联想\联想标准键盘\lxkeyled.dll]  [Silitek, 1, 0, 0, 1]
    [F:\卡卡\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 588][C:\Program Files\联想(Lenovo)\MUSE104\RmtService.exe]  [Bitland Information Technology Co.,Ltd, 1, 0, 0, 7]
    [F:\卡卡\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 800][C:\Program Files\联想(Lenovo)\联想天骄遥控器(Mars)\marsrmt.exe]  [N/A, N/A]
    [F:\卡卡\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 1552][C:\WINDOWS\system32\RunDll32.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system\cmcnfgu.cpl]  [C-Media Corporation, 1, 0, 41, 17]
    [C:\WINDOWS\System32\cmpropu.dll]  [C-Media Corporation, 1.0.2.3]
    [C:\WINDOWS\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
    [F:\卡卡\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 1728][C:\Program Files\Common Files\Lenovo\digitalsuit\commondll\MyDevice.exe]  [, 1, 0, 0, 1]
    [F:\卡卡\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 1612][C:\Program Files\lenovo\幸福相册\AlbumFileWatch.exe]  [N/A, N/A]
    [C:\Program Files\lenovo\幸福相册\DirectoryWatch.dll]  [, 1, 0, 0, 1]
    [F:\卡卡\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 2104][C:\Program Files\lenovo\幸福音乐\MusicMonitor.exe]  [N/A, N/A]
    [C:\Program Files\lenovo\幸福音乐\SpecialMgr.dll]  [, 1, 0, 0, 1]
    [F:\卡卡\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 2216][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2260][C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe]  [Adobe Systems Incorporated, 3.0.0.52115]
    [C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdboot.dll]  [Adobe Systems Incorporated, 3.0.0.52115]
    [C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [F:\卡卡\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 2284][F:\卡卡\runiep.exe]  [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6]
    [F:\卡卡\iep_ctrl.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]
    [F:\卡卡\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 2304][C:\WINDOWS\SOUNDMAN.EXE]  [Realtek Semiconductor Corp., 5.1.0.27]
    [F:\卡卡\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 2380][C:\WINDOWS\system32\RUNDLL32.EXE]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\System32\NvMcTray.dll]  [NVIDIA Corporation, 6.14.10.7184]
    [C:\WINDOWS\system32\NVRSZHC.DLL]  [NVIDIA Corporation, 6.14.10.7184]
    [F:\卡卡\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 2456][F:\瑞星杀软\Rising\Rav\RavTask.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 7]
    [F:\瑞星杀软\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [F:\瑞星杀软\Rising\Rav\RSAPPMGR.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
    [F:\瑞星杀软\Rising\Rav\CfgDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
    [F:\瑞星杀软\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [F:\卡卡\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 2504][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [F:\卡卡\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 2512][F:\瑞星杀软\Rising\Rav\Ravmon.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 45]
    [F:\瑞星杀软\Rising\Rav\RsGuiLib.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33]
    [F:\瑞星杀软\Rising\Rav\BWList.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
    [F:\瑞星杀软\Rising\Rav\RSAPPMGR.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
    [F:\瑞星杀软\Rising\Rav\CfgDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
    [F:\瑞星杀软\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [F:\瑞星杀软\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [F:\瑞星杀软\Rising\Rav\RsXML.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
    [F:\瑞星杀软\Rising\Rav\PngDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
    [F:\卡卡\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 3836][F:\赛车\SREng.EXE]  [Smallfrogs Studio, 2.3.13.690]
    [F:\卡卡\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]
gototop
 

Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
API HOOK
N/A

==================================


[/CODE]
gototop
 

求求大家帮帮忙,谢谢了
gototop
 

在看
gototop
 

女生宿舍病毒,进入安全模式杀毒
升级杀软。进安全模式杀毒。或者手动删除。如下
1 停止加载Navihelper.dll链接库:
在运行中键入以下命令
regsvr32 /u NaviHelper.dll
2 删除NaviHelper.dll和Host.dat这2个文件
XP其位置在c:\windows\system32
2000位置在c:\winnt\system32下
gototop
 

首先,谢谢,给我的指导祝您以及全家春节快乐,身体健康.其次,您教我的方法出现了两个问题:1.瑞星安全模式(升级后)仍无法查杀.2.手动删除,重启后又会有.能不能再指导一下.谢谢
gototop
 
12   2  /  2  页   跳转
页面顶部
Powered by Discuz!NT