瑞星删除病毒后无法进入系统,请大家帮忙解决 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛瑞星删除病毒后无法进入系统,请大家帮忙解决

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

12

2 / 2 页

跳转页

瑞星删除病毒后无法进入系统,请大家帮忙解决

NFS9MW 初生襁褓狮帖子:50 注册: 2006-07-22 来自:	发表于： 2007-03-31 21:11 \| 只看楼主短消息资料字号：小中大 11楼 [C:\WINDOWS\system32\apphelp.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\msctfime.ime] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2523 (xpsp.040919-1030)] [C:\WINDOWS\system32\CLBCATQ.DLL] [Microsoft Corporation, 2001.12.4414.308] [C:\WINDOWS\system32\COMRes.dll] [Microsoft Corporation, 2001.12.4414.258] [C:\WINDOWS\system32\shdocvw.dll] [Microsoft Corporation, 6.00.2900.3059 (xpsp_sp2_gdr.070104-0050)] [C:\WINDOWS\system32\CRYPTUI.dll] [Microsoft Corporation, 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\WINTRUST.dll] [Microsoft Corporation, 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\IMAGEHLP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\NETAPI32.dll] [Microsoft Corporation, 5.1.2600.2976 (xpsp.060817-0113)] [C:\WINDOWS\system32\WLDAP32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\Secur32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\urlmon.dll] [Microsoft Corporation, 6.00.2900.3072 (xpsp_sp2_gdr.070124-2319)] [C:\WINDOWS\system32\shdoclc.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\xpsp2res.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\mshtml.dll] [Microsoft Corporation, 6.00.2900.3059 (xpsp_sp2_gdr.070104-0050)] [C:\WINDOWS\system32\msls31.dll] [Microsoft Corporation, 3.10.349.0] [C:\WINDOWS\system32\PSAPI.DLL] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\mlang.dll] [Microsoft Corporation, 6.00.2900.2530 (xpsp.040919-1030)] [C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\PDM.DLL] [Microsoft Corporation, 7.00.9466] [C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\2052\mdmui.dll] [Microsoft Corporation, 7.00.9466] [C:\WINDOWS\system32\msimtf.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\jscript.dll] [Microsoft Corporation, 5.6.0.8831] [C:\WINDOWS\system32\SETUPAPI.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\wsock32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\System32\mswsock.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\DNSAPI.dll] [Microsoft Corporation, 5.1.2600.2938 (xpsp_sp2_gdr.060626-0020)] [C:\WINDOWS\System32\winrnr.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\rasadhlp.dll] [Microsoft Corporation, 5.1.2600.2938 (xpsp_sp2_gdr.060626-0020)] [C:\WINDOWS\system32\iphlpapi.dll] [Microsoft Corporation, 5.1.2600.2912 (xpsp_sp2_gdr.060519-0003)] [C:\WINDOWS\system32\RASAPI32.DLL] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\rasman.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\TAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\rtutils.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\WINMM.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\USERENV.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\hnetcfg.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\System32\wshtcpip.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\rsaenh.dll] [Microsoft Corporation, 5.1.2600.2161 (xpsp.040706-1629)] [PID: 1536][F:\down\sreng2\SREng.EXE] [Smallfrogs Studio, 2.4.12.806] [C:\WINDOWS\system32\ntdll.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2945 (xpsp_sp2_gdr.060704-2349)] [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)] [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.2818 (xpsp.051228-1450)] [C:\WINDOWS\system32\comdlg32.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.3059 (xpsp_sp2_gdr.070104-0050)] [C:\WINDOWS\system32\ADVAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\RPCRT4.dll] [Microsoft Corporation, 5.1.2600.2794 (xpsp_sp2_gdr.051110-1539)] [C:\WINDOWS\system32\msvcrt.dll] [Microsoft Corporation, 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\SHELL32.dll] [Microsoft Corporation, 6.00.2900.3051 (xpsp_sp2_gdr.061219-0316)] [C:\WINDOWS\system32\WINSPOOL.DRV] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\oledlg.dll] [Microsoft Corporation, 1.0 (xpsp_sp2_gdr.061016-0148)] [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528)] [C:\WINDOWS\system32\OLEAUT32.dll] [Microsoft Corporation, 5.1.2600.2180] [C:\WINDOWS\system32\VERSION.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\CRYPT32.dll] [Microsoft Corporation, 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\MSASN1.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\WINMM.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\WS2_32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\WS2HELP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\WININET.dll] [Microsoft Corporation, 6.00.2900.3059 (xpsp_sp2_gdr.070104-0050)] [C:\WINDOWS\system32\IMM32.DLL] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\LPK.DLL] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\USP10.dll] [Microsoft Corporation, 1.0420.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\RICHED20.DLL] [Microsoft Corporation, 5.30.23.1228] [C:\WINDOWS\system32\MSCTF.dll] [Microsoft Corporation, 5.1.2600.2575 (xpsp.041130-1728)] [C:\WINDOWS\system32\apphelp.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\msctfime.ime] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2523 (xpsp.040919-1030)] [C:\WINDOWS\system32\sfc.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\sfc_os.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\WINTRUST.dll] [Microsoft Corporation, 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\IMAGEHLP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\Sensapi.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\Secur32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\wsock32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\RASAPI32.DLL] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\rasman.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\NETAPI32.dll] [Microsoft Corporation, 5.1.2600.2976 (xpsp.060817-0113)] [C:\WINDOWS\system32\TAPI32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\rtutils.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\USERENV.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\System32\mswsock.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\DNSAPI.dll] [Microsoft Corporation, 5.1.2600.2938 (xpsp_sp2_gdr.060626-0020)] [C:\WINDOWS\System32\winrnr.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\WLDAP32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\rasadhlp.dll] [Microsoft Corporation, 5.1.2600.2938 (xpsp_sp2_gdr.060626-0020)] [C:\WINDOWS\system32\urlmon.dll] [Microsoft Corporation, 6.00.2900.3072 (xpsp_sp2_gdr.070124-2319)] [C:\WINDOWS\system32\iphlpapi.dll] [Microsoft Corporation, 5.1.2600.2912 (xpsp_sp2_gdr.060519-0003)] [C:\WINDOWS\system32\hnetcfg.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\System32\wshtcpip.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\xpsp2res.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\rsaenh.dll] [Microsoft Corporation, 5.1.2600.2161 (xpsp.040706-1629)] [C:\WINDOWS\system32\cryptnet.dll] [Microsoft Corporation, 5.131.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\WINHTTP.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\DHCPCSVC.DLL] [Microsoft Corporation, 5.1.2600.2912 (xpsp_sp2_gdr.060519-0003)] ==================================
NFS9MW 初生襁褓狮帖子:50 注册: 2006-07-22 来自:

NFS9MW 初生襁褓狮帖子:50 注册: 2006-07-22 来自:	发表于： 2007-03-31 21:11 \| 只看楼主短消息资料字号：小中大 12楼文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf N/A ================================== HOSTS 文件 127.0.0.1 localhost ================================== API HOOK N/A ================================== 隐藏进程 N/A ================================== [/CODE]
NFS9MW 初生襁褓狮帖子:50 注册: 2006-07-22 来自:

spiritfire 锋芒艾服狮帖子:1266 注册: 2006-10-22 来自:	发表于： 2007-03-31 21:47 \| 短消息资料字号：小中大 13楼 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <kernelmh><C:\WINDOWS\Kernelmh.exe> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] <bgkcw><%systemroot%\system32\Rundll32.exe %systemroot%\system32\bgkcw.dll,DllUnregisterServer> [] <netapi34><%systemroot%\system32\Rundll32.exe %systemroot%\system32\netapi34.dll,DllUnregisterServer> [Microsoft Corporation] [8B40E386 / 8B40E386][Stopped/Auto Start] <C:\WINDOWS\system32\8B40E386.EXE -service><Microsoft Corporation> [Std bown Service / bown][Stopped/Auto Start] <C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\wgof\gtys.dll,Service -s><Microsoft Corporation> [Distributed Application Client / BRGNS][Stopped/Auto Start] <C:\WINDOWS\SYSTEM32\RUNDLL2000.EXE C:\WINDOWS\SYSTEM32\WBEM\CJLBI.DLL,Export 1087><Microsoft Corporation> [Distributed Console Manager / ClipArt][Stopped/Auto Start] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\koasf.dll><Microsoft Corporation> [Portable Media / WmdmPWD][Stopped/Auto Start] <C:\WINDOWS\system32\Svchost.exe -k WmdmPWD-->C:\WINDOWS\system32\MDserivces\services\svchost.dll><Microsoft Corporation [acpidisk / acpidisk][Stopped/Auto Start] <\??\C:\WINDOWS\system32\drivers\acpidisk.sys><N/A> [NPPTNT2 / NPPTNT2][Stopped/Manual Start] <\??\C:\WINDOWS\system32\npptNT2.sys><INCA Internet Co., Ltd.> [sryq / sryqd][Running/Boot Start] <\SystemRoot\System32\DRIVERS\sryqd.sys><N 用SREng删除以上服务项，重启后删除如下文件： C:\WINDOWS\Kernelmh.exe C:\WINDOWS\SYSTEM32\RUNDLL2000.EXE C:\WINDOWS\SYSTEM32\WBEM\CJLBI.DLL C:\WINDOWS\system32\koasf.dll C:\WINDOWS\system32\MDserivces\services\svchost.dll C:\WINDOWS\system32\drivers\acpidisk.sys C:\WINDOWS\system32\npptNT2.sys C:\WINDOWS\System32\DRIVERS\sryqd.sys C:\WINDOWS\system32\bgkcw.dll C:\WINDOWS\system32\netapi34.dll C:\WINDOWS\system32\8B40E386.EXE 将兔子升至最新，查杀流氓wgof以及iesnap等流氓，最后完整清理系统！
spiritfire 锋芒艾服狮帖子:1266 注册: 2006-10-22 来自:

NFS9MW 初生襁褓狮帖子:50 注册: 2006-07-22 来自:	发表于： 2007-03-31 22:15 \| 只看楼主短消息资料字号：小中大 14楼 C:\WINDOWS\System32\DRIVERS\sryqd.sys 目标正在使用
NFS9MW 初生襁褓狮帖子:50 注册: 2006-07-22 来自:

NFS9MW 初生襁褓狮帖子:50 注册: 2006-07-22 来自:	发表于： 2007-03-31 22:18 \| 只看楼主短消息资料字号：小中大 15楼 C:\WINDOWS\system32\bgkcw.dll 也是正在使用我把SREng中的这2个在删除一次
NFS9MW 初生襁褓狮帖子:50 注册: 2006-07-22 来自:

NFS9MW 初生襁褓狮帖子:50 注册: 2006-07-22 来自:	发表于： 2007-03-31 22:32 \| 只看楼主短消息资料字号：小中大 16楼 C:\WINDOWS\System32\DRIVERS\sryqd.sys C:\WINDOWS\system32\bgkcw.dll 还是没有办法删除 SREng中我删了重启还有
NFS9MW 初生襁褓狮帖子:50 注册: 2006-07-22 来自:

锋芒艾服狮

帖子:1266
注册: 2006-10-22
来自:

发表于： 2007-04-01 09:12 | 短消息资料

字号：小中大 17楼

引用:

【NFS9MW的贴子】C:\WINDOWS\System32\DRIVERS\sryqd.sys
C:\WINDOWS\system32\bgkcw.dll
还是没有办法删除
SREng中我删了重启还有
………………

用SREng删除以后，置顶的工具中下载冰刃，运行后，设置，勾选，禁止进线程创建，找到这两个文件强制删除之！

gototop

NFS9MW 初生襁褓狮帖子:50 注册: 2006-07-22 来自:	发表于： 2007-04-01 09:14 \| 只看楼主短消息资料字号：小中大 18楼我把它们清除了之后开机就提示 bgkcw.dll 内存分配错误,在注册表里就找不到bgkcw了,现在该怎么办?而且正常启动只显示光的桌面,只能在任务管理器里找到exploer打开.
NFS9MW 初生襁褓狮帖子:50 注册: 2006-07-22 来自:

NFS9MW 初生襁褓狮帖子:50 注册: 2006-07-22 来自:	发表于： 2007-04-01 10:31 \| 只看楼主短消息资料字号：小中大 19楼我把所有的清理干净之后再运行SREng系统修复. 基本问题都解决了.\ 只是开机进入WINDOWS的时候会提示,bgkcw.DLL 内存分配出错.请问这个再怎么继续?? 请大家解答一下吧~!
NFS9MW 初生襁褓狮帖子:50 注册: 2006-07-22 来自:

<<上一主题|下一主题>>

12

2 / 2 页

跳转页

页面顶部

Powered by Discuz!NT