瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 【原创】一上网就提示有恶意程序c:\windows\~temp**.tmp,求救,有日志。

12   2  /  2  页   跳转

【原创】一上网就提示有恶意程序c:\windows\~temp**.tmp,求救,有日志。

[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[BaseTDI / BaseTDI][Running/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\basetdi.sys><Beijing Rising Technology Co., Ltd.>
[Team MFP Comm Driver / DgiVecp][Running/Auto Start]
  <System32\Drivers\DgiVecp.sys><DeviceGuys, Inc.>
[ExpScaner / ExpScaner][Running/Auto Start]
  <\??\C:\Program Files\Rising\Rav\ExpScan.sys><>
[FXDRV / FXDRV][Stopped/Manual Start]
  <\??\F:\Fxdrv.sys><N/A>
[HookCont / HookCont][Running/Auto Start]
  <\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
  <\??\C:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
  <\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising>
[MEMSCAN / MEMSCAN][Running/Auto Start]
  <\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[ntio / ntio][Stopped/Manual Start]
  <\??\C:\Program Files\SureSense\书生电子公文浏览器\ntio.sys><N/A>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
  <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[RsNTGDI / RsNTGDI][Running/Boot Start]
  <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
  <\??\C:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[SiS315 / SiS315][Running/Manual Start]
  <system32\DRIVERS\sisgrp.sys><Silicon Integrated Systems Corporation>
[SiSkp / SiSkp][Running/System Start]
  <system32\DRIVERS\srvkp.sys><Silicon Integrated Systems Corporation>
[SiS PCI Fast Ethernet Adapter Driver / SISNIC][Running/Manual Start]
  <system32\DRIVERS\sisnic.sys><SiS Corporation>
[TDDI / TDDI][Running/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\tddi.sys><Microsoft Corporation>

==================================
浏览器加载项
[番茄花园]
  {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} <http://www.tomatolei.com, N/A>
[JoyoCtrl Class]
  {8DE0FCD4-5EB5-11D3-AD25-00002100131B} <C:\WINDOWS\system32\KAV_IE~1.dll, >
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[Microsoft Office Spreadsheet 9.0]
  {0002E510-0000-0000-C000-000000000046} <C:\PROGRA~1\MICROS~2\Office\MSOWC.DLL, >
[Tabular Data Control]
  {333C7BC4-460F-11D0-BC04-0080C7055A83} <C:\WINDOWS\system32\tdc.ocx, Microsoft Corporation>
[CellWeb5 Control]
  {3F166327-8030-4881-8BD2-EA25350E574A} <C:\PROGRA~1\Cell50\bin\CellWeb5.ocx, Cell Software, Inc.>
[HHCtrl Object]
  {41B23C28-488E-4E5C-ACE2-BB0BBABE99E8} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[InfoSecNetSign Class]
  {62B938C4-4190-4F37-8CF0-A92B0A91CC77} <C:\WINDOWS\system32\NetSign.dll, Infosec Technologies Co., Ltd.>
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[CCtInf Class]
  {6DBB2904-082D-4DB0-944A-21C22BA121F4} <C:\WINDOWS\system32\BANKCE~1.DLL, >
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[JoyoCtrl Class]
  {8DE0FCD4-5EB5-11D3-AD25-00002100131B} <C:\WINDOWS\system32\KAV_IE~1.dll, >
[Microsoft Scriptlet Component]
  {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
  {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[Microsoft Agent Control 2.0]
  {D45FD31B-5C6E-11D1-9EC1-00C04FD7081F} <C:\WINDOWS\msagent\agentctl.dll, Microsoft Corporation>

==================================
gototop
 

正在运行的进程
[PID: 456][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 528][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 552][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\PYJJ4.IME]  [加加工作组, 4, 1, 0, 48]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1328][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\PYJJ4.IME]  [加加工作组, 4, 1, 0, 48]
    [C:\WINDOWS\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
    [C:\Program Files\Internet Explorer\PLUGINS\HiJack.dll]  [Microsoft Corporation, 1. 0. 0. 1]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[PID: 2004][C:\Program Files\jj4\jiajiasr.exe]  [加加工作组, 4, 1, 0, 47]
    [C:\WINDOWS\system32\PYJJ4.IME]  [加加工作组, 4, 1, 0, 48]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 380][C:\Program Files\Rising\AntiSpyware\runiep.exe]  [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6]
    [C:\Program Files\Rising\AntiSpyware\iep_ctrl.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [C:\WINDOWS\system32\PYJJ4.IME]  [加加工作组, 4, 1, 0, 48]
[PID: 420][C:\WINDOWS\SOUNDMAN.EXE]  [Realtek Semiconductor Corp., 5.1.0.40]
    [C:\WINDOWS\system32\PYJJ4.IME]  [加加工作组, 4, 1, 0, 48]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 724][C:\WINDOWS\Twain_32\Fjscan32\SOP\FtLnSOP.exe]  [PFU LIMITED, 1, 0, 1, 2]
    [C:\WINDOWS\system32\PYJJ4.IME]  [加加工作组, 4, 1, 0, 48]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 808][C:\WINDOWS\Twain_32\fjscan32\FjtwSetup.exe]  [FUJITSU LIMITED, 1, 1, 8, 1]
    [C:\WINDOWS\system32\PYJJ4.IME]  [加加工作组, 4, 1, 0, 48]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 864][C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis1.exe]  [FinePrint Software, LLC, 1.57]
    [C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppr132.dll]  [细致打印软件公司, 1.57]
    [C:\WINDOWS\system32\PYJJ4.IME]  [加加工作组, 4, 1, 0, 48]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppint1.dll]  [FinePrint Software, LLC, 1.57]
    [C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppgraf1.dll]  [FinePrint Software, LLC, 1.57]
[PID: 1212][C:\Program Files\Netease\POPO2004\popo.exe]  [网易(163.com), 1, 0, 0, 1]
    [C:\Program Files\Netease\POPO2004\XGDI.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Netease\POPO2004\XFile.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Netease\POPO2004\P2PMgr.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Netease\POPO2004\XComm.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Netease\POPO2004\Trace.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Netease\POPO2004\Updater.dll]  [, 1, 0, 0, 1]
gototop
 

[C:\Program Files\Netease\POPO2004\UNZIP32.dll]  [Info-ZIP, 5.5]
    [C:\Program Files\Netease\POPO2004\ResLoc.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Netease\POPO2004\MailChecker.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Netease\POPO2004\ExtraEditor.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Netease\POPO2004\XMP.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Netease\POPO2004\fmod.dll]  [Firelight Technologies Pty, Ltd, 3.73]
    [C:\Program Files\Netease\POPO2004\UrlObj.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Netease\POPO2004\WebService.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Netease\POPO2004\Bobo.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Netease\POPO2004\SOX.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Netease\POPO2004\share.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Netease\POPO2004\XVideo.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Netease\POPO2004\VCodec.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Netease\POPO2004\XVoice.dll]  [, 1, 0, 0, 2]
    [C:\Program Files\Netease\POPO2004\GIPSVoiceEngineDLL.dll]  [Global IP Sound, 2, 0, 4, 0]
    [C:\Program Files\Netease\POPO2004\XEmotion.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Netease\POPO2004\MsgHis.dll]  [, 1, 0, 0, 1]
    [C:\WINDOWS\system32\PYJJ4.IME]  [加加工作组, 4, 1, 0, 48]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [C:\Program Files\Netease\POPO2004\plugins\MSN.DLL]  [, 1, 0, 0, 1]
    [C:\Program Files\Netease\POPO2004\plugins\LIBCURL.dll]  [N/A, ]
    [C:\Program Files\Netease\POPO2004\plugins\SSLEAY32.dll]  [N/A, ]
    [C:\Program Files\Netease\POPO2004\plugins\LIBEAY32.dll]  [N/A, ]
    [C:\Program Files\Netease\POPO2004\plugins\ppmakeurl.dll]  [N/A, ]
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1192][C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe]  [InstallShield Software Corporation, 3, 10, 100, 1146]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 1220][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\PYJJ4.IME]  [加加工作组, 4, 1, 0, 48]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 1572][C:\Program Files\PFU\Error Recovery Guide\FTErGuid.exe]  [PFU LIMITED, 2. 5. 0. 1]
    [C:\WINDOWS\system32\PYJJ4.IME]  [加加工作组, 4, 1, 0, 48]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 1164][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\PYJJ4.IME]  [加加工作组, 4, 1, 0, 48]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx]  [Macromedia, Inc., 8,0,22,0]
    [C:\WINDOWS\system32\JPWB.IME]  [常诚研制, 4.00.950]
[PID: 1660][C:\Documents and Settings\mxl\My Documents\sreng2\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
    [C:\WINDOWS\system32\PYJJ4.IME]  [加加工作组, 4, 1, 0, 48]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================


[/CODE]
gototop
 

还是谢谢你的帮助,loveperday.
gototop
 

[FXDRV / FXDRV][Stopped/Manual Start]
<\??\F:\Fxdrv.sys><N/A>
这个我不确定,你压缩备份后删了试试。用SREng把这个服务结束掉,文件也删了。
然后用清理助手或优化大师清理一下。
再不行就没辙了。。
gototop
 

才发的日志...........

你自己觉得还有啥问题呢?

详细说说。
gototop
 

可盼来个高人了,嘿嘿~~
gototop
 
12   2  /  2  页   跳转
页面顶部
Powered by Discuz!NT