瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 请教各位大哥~~附日志。先说声谢谢(一直在线!!)

12   2  /  2  页   跳转

请教各位大哥~~附日志。先说声谢谢(一直在线!!)

<e5051v><C:\DOCUME~1\lenovo\LOCALS~1\Temp\c0nime.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Kvsc3><C:\WINDOWS\Kvsc3.exe> []
WSVBRS><C:\WINDOWS\WSVBRS.exe> []
<cmdbcs><C:\WINDOWS\cmdbcs.exe> []
<upxdnd><C:\WINDOWS\upxdnd.exe> []
<mppds><C:\WINDOWS\mppds.exe> []
<msccrt><C:\WINDOWS\msccrt.exe> []
<load><C:\WINDOWS\uninstall\rundl132.exe> []
MsIMMs32><C:\WINDOWS\MsIMMs32.exe
<AVPSrv><C:\WINDOWS\AVPSrv.exe> []
<twin><C:\WINDOWS\system32\ctfnom.exe
<{62A612A4-4334-4424-4234-42261A31A238}><C:\WINDOWS\system32\bbqpri.dll>
删除以上注册表和对应文件,重装QQ~~
你日志不全,最重要的服务和驱动项没有。。
修复HOST文件
gototop
 

【回复“loveperday”的帖子】
服务
[3208C8EF / 3208C8EF][Stopped/Auto Start]
  <C:\WINDOWS\system32\247DCC1E.EXE -d><Microsoft Corporation>
[Fast Client / fast][Stopped/Auto Start]
  <C:\WINDOWS\system32\966e.exe><N/A>
[Network Engine / Framework][Stopped/Auto Start]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\mmocy.dll><N/A>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Fax 2Client / ms_2fax][Stopped/Auto Start]
  <C:\WINDOWS\system32\ee351.exe><N/A>
[Indexing Data / NHLscA][Stopped/Auto Start]
  <C:\WINDOWS\SYSTEM32\RUNDLLFOROUR.EXE C:\WINDOWS\SYSTEM32\WBEM\DVVVA.DLL,Export 1087><N/A>
[Rising Proxy  Service / RfwProxySrv][Stopped/Manual Start]
  <c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService][Stopped/Auto Start]
  <c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter][Stopped/Auto Start]
  <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Stopped/Auto Start]
  <"C:\PROGRAM FILES\RISING\RAV\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[Windows rwth RunThem / rwth][Stopped/Auto Start]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\PROGRA~1\mroc\wbym.dll>< >
[SmartLinkService / SLService][Stopped/Auto Start]
  <slserv.exe><>

==================================
驱动程序
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Stopped/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[Rising TDI Base Driver / BaseTDI][Stopped/Auto Start]
  <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[Cdsys / Cdsys][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\cdcd.sys><Your Corporation>
[ExpScaner / ExpScaner][Stopped/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\ExpScan.sys><>
[HookCont / HookCont][Stopped/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\HOOKCONT.sys><Rising>
[HookReg / HookReg][Stopped/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\HookReg.sys><>
[HookSys / HookSys][Stopped/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\HookSys.sys><Rising>
[HookUrl / HookUrl][Stopped/Auto Start]
  <\??\C:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[ialm / ialm][Stopped/Manual Start]
  <system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[MEMSCAN / MEMSCAN][Stopped/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\MEMSCAN.sys><瑞星软件有限公司>
[mProcRs / mProcRs][Stopped/Auto Start]
  <\??\c:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[Mtlmnt5 / Mtlmnt5][Stopped/Manual Start]
  <system32\DRIVERS\Mtlmnt5.sys><>
[Mtlstrm / Mtlstrm][Stopped/Manual Start]
  <system32\DRIVERS\Mtlstrm.sys><>
[Netgroup Packet Filter / NPF][Stopped/Manual Start]
  <system32\drivers\npf.sys><CACE Technologies>
[npkcrypt / npkcrypt][Stopped/Auto Start]
  <\??\C:\Program Files\TencentQQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[npkycryp / npkycryp][Stopped/Manual Start]
  <\??\C:\Program Files\TencentQQ\npkycryp.sys><N/A>
[NtMtlFax / NtMtlFax][Stopped/Manual Start]
  <system32\DRIVERS\NtMtlFax.sys><>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
  <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[RsFwDrv / RsFwDrv][Stopped/Auto Start]
  <\??\C:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
  <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Stopped/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\RSPPSYS.sys><Rising>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[SmartLink AMR_PCI Driver / Slntamr][Stopped/Manual Start]
  <system32\DRIVERS\slntamr.sys><>
[SlNtHal / SlNtHal][Stopped/Manual Start]
  <system32\DRIVERS\Slnthal.sys><>
[SlWdmSup / SlWdmSup][Stopped/Manual Start]
  <system32\DRIVERS\SlWdmSup.sys><Vireo Software>
[SMC IrCC Miniport Device Driver / SMCIRDA][Stopped/Manual Start]
  <system32\DRIVERS\smcirda.sys><SMC>
[TCP/IP Protocol Driver / Tcpip][Running/System Start]
  <system32\DRIVERS\tcpip.sys><Microsoft Corporation>
[Intel(R) Graphics Platform (SoftBIOS) Driver / {6080A529-897E-4629-A488-ABA0C29B635E}][Stopped/Manual Start]
  <system32\drivers\ialmsbw.sys><Intel Corporation>
[Intel(R) Graphics Chipset (KCH) Driver / {D31A0762-0CEB-444e-ACFF-B049A1F6FE91}][Stopped/Manual Start]
  <system32\drivers\ialmkchw.sys><Intel Corporation>
gototop
 

[3208C8EF / 3208C8EF][Stopped/Auto Start]
<C:\WINDOWS\system32\247DCC1E.EXE -d><Microsoft Corporation>
[Fast Client / fast][Stopped/Auto Start]
<C:\WINDOWS\system32\966e.exe><N/A>
[Network Engine / Framework][Stopped/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\mmocy.dll><N/A>
[Fax 2Client / ms_2fax][Stopped/Auto Start]
<C:\WINDOWS\system32\ee351.exe><N/A>
[Indexing Data / NHLscA][Stopped/Auto Start]
<C:\WINDOWS\SYSTEM32\RUNDLLFOROUR.EXE C:\WINDOWS\SYSTEM32\WBEM\DVVVA.DLL,Export 1087><N/A>
以上服务删除,对应文件删除
下面这个,你看看这个mroc文件夹你认不认识,不认识就删了
[Windows rwth RunThem / rwth][Stopped/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\PROGRA~1\mroc\wbym.dll>< >

[npkycryp / npkycryp][Stopped/Manual Start]
<\??\C:\Program Files\TencentQQ\npkycryp.sys><N/A>

这个驱动也删了。文件删了。
删不掉用冰刃强制删除。
够你忙的了。
gototop
 

网上下载一个XP硬盘安装版重装吧。
gototop
 

【回复“tietai”的帖子】先说声谢谢!!
那个服务怎么删除呀??我连怎么找都不知道,SRE里面都找不到。。。对应的文件删了!!冰刃在我机子上装不了。。说什么初始化错误,郁闷!!~~~这位大哥,你有QQ ?想加你!!
gototop
 

你是网通的么?悄悄话告诉我你的QQ
gototop
 

【回复“loveperday”的帖子谢谢!!谢谢您的热心帮助!!问题已经解决了!!而且在这个过程当中我学到了不少东西,虽然只是皮毛,但对于我这个菜鸟来说已经是一个很有成就感的事!!谢谢您的指导!!
gototop
 
12   2  /  2  页   跳转
页面顶部
Powered by Discuz!NT