瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 【求助】中毒了，重做了系统还是提示有病毒！

12   1  /  2  页   跳转页

【求助】中毒了，重做了系统还是提示有病毒！

收藏
雯宝贝儿
头像
初生襁褓狮
  • 帖子:11
  • 注册: 2007-06-12
  • 来自:
发表于： 2007-06-12 18:27 | 只看楼主 短消息 资料
字号： 小 中 大 1楼

【求助】中毒了，重做了系统还是提示有病毒！

本人电脑方面特菜，现在请大家帮忙啊，只要告诉我怎么做就可以了，我看了类似的贴子，就下了智能扫描的东东，大家帮我看一下结果如下
[CODE]

2007-06-12,18:11:18

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <Internat.exe><internat.exe>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <Synchronization Manager><mobsync.exe /logon>  [(Verified)Microsoft Windows 2000 Publisher]
    <SoundMan><SOUNDMAN.EXE>  [N/A]
    <SKYNET Personal FireWall><C:\Program Files\SkyNet\FireWall\PFWmain.exe>  [sky.net.cn]
    <internat.exe><internat.exe>  [(Verified)Microsoft Windows 2000 Publisher]
    <Peanut Hull Client><C:\Program Files\PeanutHull\PHNT.exe -sa>  [N/A]
    <SyGateManager><C:\Program Files\Sygate\SON\Sygate.exe>  [Sygate Technologies, Inc.]
    <registry.exe><c:\program files\registry.exe>  [N/A]
    <WlN32><rem regedit -s c:\$ntuninstallq887678$\winsys.cer>  []
    <Microsoft Network Daemon for Win32><netd32.exe>  []
    <MS_NETD_WIN32><netd32.exe>  []
    <load><C:\WINNT\uninstall\rundl132.exe>  []
    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
    <CnxDslTaskBar><"c:\program files\conexant\accessrunner adsl usb\CnxDslTb.exe" "Conexant\AccessRunner ADSL USB">  [N/A]
    <nwnslop><C:\WINNT\SVCHOST.EXE>  []
    <upxdnd><C:\WINNT\upxdnd.exe>  []
    <runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe>  [Beijing Rising Technology Co., Ltd.]
    <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
    <Microsoft Network Daemon for Win32><netd32.exe>  []
    <MS_NETD_WIN32><netd32.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    <twin><C:\WINNT\system32\ctfnom.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows 2000 Publisher]
    <Userinit><C:\WINNT\system32\userinit.exe,>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINNT\system32\RavExt.dll>  [Beijing Rising Technology Co., Ltd.]
[HKEY_CURRENT_USER\Control Panel\Desktop]
    <SCRNSAVE.EXE><(无)>  [N/A]

==================================
启动文件夹
[MySql管理客户端]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\MySql管理客户端.lnk --> C:\MySql\BIN\WINMYS~1.EXE [MySQL AB]><N>
[腾讯QQ]
  <C:\Documents and Settings\yuying\「开始」菜单\程序\启动\腾讯QQ.lnk --> C:\PROGRA~1\Tencent\qq\QQ.exe [TENCENT]><N>

最后编辑2007-06-13 15:58:06
分享到：
gototop
 
雯宝贝儿
头像
初生襁褓狮
  • 帖子:11
  • 注册: 2007-06-12
  • 来自:
发表于： 2007-06-12 18:28 | 只看楼主 短消息 资料
字号： 小 中 大 2楼

==================================
服务
[Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[ll_reg / ll_reg][Stopped/Auto Start]
  <Rundll32.exe Task688.dll ondll_server><Microsoft Corporation>
[Microsoft NetWork FireWall Services / Microsoft NetWork FireWall Services][Stopped/Auto Start]
  <NetServices.exe><N/A>
[Win32 Debug Service / MSDebugsvc][Stopped/Auto Start]
  <C:\WINNT\system32\rundll32.exe msdebug.dll,input><Microsoft Corporation>
[MySql / MySql][Running/Auto Start]
  <C:/MySql/bin/mysqld-nt.exe><N/A>
[NetMeeting Remote Desktop (RPC) Sharing / NetMeeting Remote Desktop (RPC) Sharing][Stopped/Auto Start]
  <Rundll32.exe Task688.dll ondll_server><Microsoft Corporation>
[PSEXESVC / PSEXESVC][Stopped/Manual Start]
  <C:\WINNT\System32\PSEXESVC.EXE><Sysinternals>
[Remote Debug Service / RemoteDbg][Stopped/Auto Start]
  <C:\WINNT\system32\rundll32.exe RemoteDbg.dll,input><Microsoft Corporation>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
  <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
  <"C:\PROGRAM FILES\RISING\RAV\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[SyGateService / SaService][Running/Auto Start]
  <C:\Program Files\Sygate\SON\sgserv.exe><Sygate technologies Inc.>
[Smart Card Helper / SCardDrv][Stopped/Auto Start]
  <C:\WINNT\system32\scardsvr32.exe -v><N/A>
[Windows Management Instrumentation Driver Extension / Windows Management Instrumentation Driver Extension][Stopped/Auto Start]
  <C:\WINNT\system32\WinDriver.exe -start_server><N/A>
[Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start]
  <C:\WINNT\System32\svchost.exe -k netsvcs-->C:\WINNT\system32\mspmsnsv.dll><Microsoft Corporation>
[WMI Performance API / WMIApiSrv][Stopped/Auto Start]
  <C:\WINNT\system32\rundll32.exe WMIApiSrv.dll,input><Microsoft Corporation>

==================================
驱动程序
[Service for Avance AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[AmeAtmPc / AmeAtmPc][Stopped/Manual Start]
  <system32\DRIVERS\AmeAtmPc.sys><N/A>
[AmeLanPc / AmeLanPc][Stopped/Manual Start]
  <system32\DRIVERS\AmeLanPc.sys><N/A>
[BaseTDI / BaseTDI][Running/Auto Start]
  <\??\C:\WINNT\system32\drivers\basetdi.sys><Beijing Rising Technology Co., Ltd.>
[Cdsys / Cdsys][Stopped/Manual Start]
  <\??\C:\WINNT\system32\cdcd.sys><N/A>
[Conexant AccessRunner USB ADSL Adapter Filter Driver / CnxEtP][Running/Manual Start]
  <system32\DRIVERS\CnxEtP.sys><Conexant Systems, Inc.>
[Conexant AccessRunner USB ADSL Interface Device Driver / CnxEtU][Running/Manual Start]
  <system32\DRIVERS\CnxEtU.sys><Conexant Systems, Inc.>
[Conexant AccessRunner ADSL WAN PPPoE Adapter Driver / CnxTgNP][Running/Manual Start]
  <system32\DRIVERS\CnxTgNP.sys><Conexant Systems, Inc.>
[dmboot / dmboot][Stopped/Disabled]
  <System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[ExpScaner / ExpScaner][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\ExpScan.sys><>
[HookCont / HookCont][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\HookSys.sys><Rising>
[i81x / i81x][Running/Manual Start]
  <System32\DRIVERS\i81xnt5.sys><Intel(R) Corporation>
[MEMSCAN / MEMSCAN][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\MEMSCAN.sys><瑞星软件有限公司>
[New0 / New0][Running/Auto Start]
  <\??\C:\WINNT\system32\new.sys><N/A>
[Netgroup Packet Filter / NPF][Stopped/Manual Start]
  <system32\drivers\npf.sys><CACE Technologies>
[npkcrypt / npkcrypt][Running/Auto Start]
  <\??\C:\Program Files\Tencent\qq\npkcrypt.sys><INCA Internet Co., Ltd.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
  <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[RsNTGDI / RsNTGDI][Running/Boot Start]
  <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\RSPPSYS.sys><Rising>
[Realtek RTL8139-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
  <System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[SKNFW / SKNFW][Running/System Start]
  <\??\C:\WINNT\system32\Drivers\SKNFW.sys><N/A>
[SyGate for NT, Wg1n / Wg1n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\Wg1n.sys><Sygate Technologies, Inc.>
[SyGate for NT, Wg2n / Wg2n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\Wg2n.sys><Sygate Technologies, Inc.>
[SyGate for NT, wg4n / wg4n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\wg4n.sys><Sygate Technologies, Inc.>
[SyGate for NT, wg5n / wg5n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\wg5n.sys><Sygate Technologies, Inc.>
[SyGate for NT, wg6n / wg6n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\wg6n.sys><Sygate Technologies, Inc.>
[SyGate for NT, wg8n / wg8n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\wg8n.sys><Sygate Technologies, Inc.>
[SyGate for NT, wg9n / wg9n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\wg9n.sys><Sygate Technologies, Inc.>
[iVasion PoET Adapter / WRSWanDD][Stopped/Manual Start]
  <system32\DRIVERS\WrKPoETNic2000.sys><N/A>
[SyGate for NT, Wsdrv / Wsdrv][Running/Boot Start]
  <\SystemRoot\\SystemRoot\SYSTEM32\Drivers\Wsdrv.sys><N/A>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
  <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
gototop
 
雯宝贝儿
头像
初生襁褓狮
  • 帖子:11
  • 注册: 2007-06-12
  • 来自:
发表于： 2007-06-12 18:28 | 只看楼主 短消息 资料
字号： 小 中 大 3楼

==================================
浏览器加载项
[IeCatch2 Class]
  {A5366673-E8CA-11D3-9CD9-0090271D075B} <C:\PROGRA~1\FLASHGET\jccatch.dll, Amaze Soft>
[碧聊]
  {4B87EE01-82ED-4030-A372-B3BEF4829ED5} <http://chat.yinsha.com/, N/A>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[FlashGet]
  {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\flashget.exe, Amaze Soft>
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[金山快译(&K)]
  {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} <C:\PROGRA~1\Kingsoft\FastAIT\IEBand.dll, >
[FlashGet Bar]
  {E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[V2 Control]
  {2EA6D939-4445-43F1-A12B-8CB3DDA8B855} <C:\WINNT\DOWNLO~1\v2.ocx, 碧海银沙>
[BlueskyAudio Class]
  {BA0F088C-72C1-475A-92F8-42391DEF6961} <C:\WINNT\Downloaded Program Files\blueskyvoice.dll, 蓝天工作室(http://www.bluesky.com.cn)>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\System32\macromed\flash\Flash.ocx, Macromedia, Inc.>
[PasswordEditCtrl Class]
  {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINNT\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
[上传到QQ网络硬盘]
  <C:\Program Files\Tencent\qq\AddToNetDisk.htm, N/A>
[使用网际快车下载]
  <C:\PROGRA~1\FLASHGET\jc_link.htm, N/A>
[使用网际快车下载全部链接]
  <C:\PROGRA~1\FLASHGET\jc_all.htm, N/A>
[添加到QQ自定义面板]
  <C:\Program Files\Tencent\qq\AddPanel.htm, N/A>
[添加到QQ表情]
  <C:\Program Files\Tencent\qq\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <C:\Program Files\Tencent\qq\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 196][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 160][\??\C:\WINNT\system32\csrss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 136][\??\C:\WINNT\system32\winlogon.exe]  [Microsoft Corporation, 5.00.2195.6714]
    [C:\WINNT\system32\wdmaud.drv]  [Microsoft Corporation, 5.00.2195.6673]
    [C:\WINNT\system32\msacm32.drv]  [Microsoft Corporation, 5.00.2134.1]
[PID: 844][C:\WINNT\Explorer.EXE]  [Microsoft Corporation, 5.00.3700.6690]
    [C:\WINNT\AppPatch\AcLayers.DLL]  [Microsoft Corporation, 5.00.2195.6717]
    [C:\WINNT\system32\wdmaud.drv]  [Microsoft Corporation, 5.00.2195.6673]
    [C:\WINNT\system32\msacm32.drv]  [Microsoft Corporation, 5.00.2134.1]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [C:\WINNT\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
    [C:\PROGRA~1\FLASHGET\jccatch.dll]  [Amaze Soft, 1, 1, 4, 0]
    [C:\WINNT\system32\msadp32.acm]  [Microsoft Corporation, 5.00.2134.1]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[PID: 908][C:\Program Files\SkyNet\FireWall\PFWmain.exe]  [sky.net.cn, 2.5.0.120]
    [C:\WINNT\system32\msdebug.dll]  [N/A, ]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 928][C:\WINNT\system32\internat.exe]  [Microsoft Corporation, 5.00.2920.0000]
    [C:\WINNT\system32\msdebug.dll]  [N/A, ]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 940][C:\Program Files\Sygate\SON\Sygate.exe]  [Sygate Technologies, Inc., 4,5,851,1]
    [C:\Program Files\Sygate\SON\SaSrvAd.dll]  [Sygate Technologies, Inc., 4,5,851,1]
    [C:\Program Files\Sygate\SON\Netport.dll]  [N/A, ]
    [C:\Program Files\Sygate\SON\wsman.dll]  [SyberGen Networks, Inc., 2, 3, 3114, 0]
    [C:\Program Files\Sygate\SON\wgman.dll]  [SyberGen Networks, Inc., 1.01.1221]
    [C:\Program Files\Sygate\SON\sasrv.dll]  [N/A, ]
    [C:\Program Files\Sygate\SON\natsrv.dll]  [N/A, ]
    [C:\Program Files\Sygate\SON\salic.dll]  [N/A, ]
    [C:\Program Files\Sygate\SON\DhcpSrv.dll]  [N/A, ]
    [C:\Program Files\Sygate\SON\CorpAd.dll]  [Sygate Technologies, Inc., 4,5,851,1]
    [C:\Program Files\Sygate\SON\AREdt.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Sygate\SON\EvtLogUI.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Sygate\SON\EventLog.dll]  [N/A, ]
    [C:\Program Files\Sygate\SON\bwmedt.dll]  [Sybergen Networks, Inc., 1, 0, 0, 1]
    [C:\WINNT\system32\msdebug.dll]  [N/A, ]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 920][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3292]
    [C:\WINNT\system32\msdebug.dll]  [N/A, ]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 960][C:\program files\conexant\accessrunner adsl usb\CnxDslTb.exe]  [Conexant Systems, Inc., 040.001.018.000]
    [C:\WINNT\system32\msdebug.dll]  [N/A, ]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 992][C:\Program Files\Rising\AntiSpyware\runiep.exe]  [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6]
    [C:\WINNT\system32\msdebug.dll]  [N/A, ]
    [C:\Program Files\Rising\AntiSpyware\iep_ctrl.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 1052][C:\MySql\BIN\winmysqladmin.exe]  [MySQL AB, 1.0.0.0]
    [C:\MySql\BIN\LIBMYSQL.dll]  [N/A, ]
    [C:\WINNT\system32\msdebug.dll]  [N/A, ]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 268][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2800.1106]
    [C:\WINNT\system32\msdebug.dll]  [N/A, ]
    [C:\WINNT\system32\RemoteDbg.dll]  [N/A, ]
    [C:\WINNT\system32\WMIApiSrv.dll]  [N/A, ]
    [C:\PROGRA~1\FLASHGET\jccatch.dll]  [Amaze Soft, 1, 1, 4, 0]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [C:\WINNT\system32\wdmaud.drv]  [Microsoft Corporation, 5.00.2195.6673]
    [C:\WINNT\system32\msacm32.drv]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\msadp32.acm]  [Microsoft Corporation, 5.00.2134.1]
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\WINNT\system32\msxml3.dll]  [Microsoft Corporation, 8.30.9926.0]
    [C:\WINNT\System32\macromed\flash\Flash.ocx]  [Macromedia, Inc., 7,0,14,0]
[PID: 1584][D:\rising\新建文件夹\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
    [C:\WINNT\system32\msdebug.dll]  [N/A, ]
    [C:\WINNT\system32\RemoteDbg.dll]  [N/A, ]
    [C:\WINNT\system32\WMIApiSrv.dll]  [N/A, ]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]

==================================
文件关联
.TXT  Error. [winrpc.exe %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================


[/CODE]
gototop
 
雯宝贝儿
头像
初生襁褓狮
  • 帖子:11
  • 注册: 2007-06-12
  • 来自:
发表于： 2007-06-12 18:29 | 只看楼主 短消息 资料
字号： 小 中 大 4楼

高手帮忙告诉我怎么解决啊！！！
gototop
 
雙眼鈹的鯖鮭
头像
初生襁褓狮
  • 帖子:22
  • 注册: 2007-06-02
  • 来自:
发表于： 2007-06-12 18:34 | 短消息 资料
字号： 小 中 大 5楼

头晕！

看看这个http://forum.ikaka.com/topic.asp?board=28&artid=8322787
gototop
 
雯宝贝儿
头像
初生襁褓狮
  • 帖子:11
  • 注册: 2007-06-12
  • 来自:
发表于： 2007-06-12 18:37 | 只看楼主 短消息 资料
字号： 小 中 大 6楼

头晕？看哪个啊？
急死我了呢，这几天QQ就不正常老是有人给我发什么让我去听歌啊之类的病毒我也没点啊，怎么就成这样了呢？
gototop
 
火影忍者
头像
横据古稀狮
  • 帖子:7855
  • 注册: 2006-06-29
  • 来自:火星
发表于： 2007-06-12 18:55 | 短消息 资料
字号： 小 中 大 7楼

打开SREng-在"启动项目->注册表->删除以下启动项目
<registry.exe><c:\program files\registry.exe> [N/A]
<MS_NETD_WIN32><netd32.exe> []
<load><C:\WINNT\uninstall\rundl132.exe> []
<nwnslop><C:\WINNT\SVCHOST.EXE> []
<upxdnd><C:\WINNT\upxdnd.exe> []
<twin><C:\WINNT\system32\ctfnom.exe> []
<WlN32><rem regedit -s c:\$ntuninstallq887678$\winsys.cer> []
<Microsoft Network Daemon for Win32><netd32.exe> []

打开SREng-在"启动项目->服务->"Win32服务应用程序"选中"隐藏已认证的微软服务" 然后将下面名称的服务删除（选中有问题的服务后，点“删除服务”，点“设置”按钮即可。  注意弹出的窗口中要点 “NO 否”才是确认删除服务）(不能删除的就禁用:启动类型改为disabled,点中修改启动类型，点设置):

[ll_reg / ll_reg][Stopped/Auto Start]
<Rundll32.exe Task688.dll ondll_server><Microsoft Corporation>
[Win32 Debug Service / MSDebugsvc][Stopped/Auto Start]
<C:\WINNT\system32\rundll32.exe msdebug.dll,input><Microsoft Corporation>
[Remote Debug Service / RemoteDbg][Stopped/Auto Start]
<C:\WINNT\system32\rundll32.exe RemoteDbg.dll,input><Microsoft Corporation>
[WMI Performance API / WMIApiSrv][Stopped/Auto Start]
<C:\WINNT\system32\rundll32.exe WMIApiSrv.dll,input><Microsoft Corporation>

打开SREng-在"启动项目->服务->驱动程序"选中"隐藏已认证的微软服务" 然后将下面名称的服务删除（选中有问题的服务后，点“删除服务”，点“设置”按钮即可。  注意弹出的窗口中要点 “NO 否”才是确认删除服务）(不能删除的就禁用:启动类型改为disabled,点中修改启动类型，点设置):
[Cdsys / Cdsys][Stopped/Manual Start]
<\??\C:\WINNT\system32\cdcd.sys><N/A>
[New0 / New0][Running/Auto Start]
<\??\C:\WINNT\system32\new.sys><N/A>
[SyGate for NT, Wsdrv / Wsdrv][Running/Boot Start]
<\SystemRoot\\SystemRoot\SYSTEM32\Drivers\Wsdrv.sys><N/A>

用xdelbox(http://www.i170.com/attach/92EB2ED9-6D11-441D-8A28-2A9B08F0452E 下载)删除以下文件:
使用说明：删除时复制所有要删除文件的路径，选中抑制再生，在待删除文件列表里点击右键选择从剪贴板导入，导入后在要删除文件上点击右键，选择立刻重启删除，电脑会重启进入DOS界面进行删除操作。运行xdelbox前最好卸载所有可移动存储介质（包括U盘，MP3，手机存储卡等）。
C:\WINNT\system32\msdebug.dll
C:\WINNT\system32\RemoteDbg.dll
C:\WINNT\system32\WMIApiSrv.dll
C:\WINNT\system32\cdcd.sys
C:\WINNT\system32\new.sys
C:\WINNT\system32\Drivers\Wsdrv.sys
C:\WINNT\system32\Task688.dll
c:\program files\registry.exe
C:\WINNT\system32\netd32.exe
C:\WINNT\uninstall\rundl132.exe
C:\WINNT\SVCHOST.EXE
C:\WINNT\upxdnd.exe
C:\WINNT\system32\ctfnom.exe
c:\$ntuninstallq887678$\winsys.cer
C:\WINNT\system32\netd32.exe

下载威金专杀杀下

下载arswp(Windows清理助手)清理下
http://www.arswp.com/download/arswp/arswp.rar

升级杀软，全盘杀毒
gototop
 
天月来了
头像
版主
  • 帖子:76904
  • 注册: 2007-02-06
  • 来自:
发表于： 2007-06-12 19:26 | 短消息 资料
字号： 小 中 大 8楼

建议彻底卸载QQ的所有软件，并手工删除QQ安装目录里的所有残余文件。

在重启正常的情况下，再重装QQ
gototop
 
雯宝贝儿
头像
初生襁褓狮
  • 帖子:11
  • 注册: 2007-06-12
  • 来自:
发表于： 2007-06-12 22:57 | 只看楼主 短消息 资料
字号： 小 中 大 9楼

按照火影说的一步一步做下来，用瑞星杀了380多个病毒
我觉得应该没什么问题了吧，现在是杀毒后的扫描日志
[CODE]

2007-06-12,22:44:38

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <Internat.exe><internat.exe>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <Synchronization Manager><mobsync.exe /logon>  [(Verified)Microsoft Windows 2000 Publisher]
    <SoundMan><SOUNDMAN.EXE>  [N/A]
    <SKYNET Personal FireWall><C:\Program Files\SkyNet\FireWall\PFWmain.exe>  [sky.net.cn]
    <internat.exe><internat.exe>  [(Verified)Microsoft Windows 2000 Publisher]
    <Peanut Hull Client><C:\Program Files\PeanutHull\PHNT.exe -sa>  [N/A]
    <SyGateManager><C:\Program Files\Sygate\SON\Sygate.exe>  [Sygate Technologies, Inc.]
    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
    <CnxDslTaskBar><"c:\program files\conexant\accessrunner adsl usb\CnxDslTb.exe" "Conexant\AccessRunner ADSL USB">  [N/A]
    <runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe>  [Beijing Rising Technology Co., Ltd.]
    <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
    <MS_NETD_WIN32><netd32.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows 2000 Publisher]
    <Userinit><C:\WINNT\system32\userinit.exe,>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINNT\system32\RavExt.dll>  [Beijing Rising Technology Co., Ltd.]
[HKEY_CURRENT_USER\Control Panel\Desktop]
    <SCRNSAVE.EXE><(无)>  [N/A]

==================================
启动文件夹
[MySql管理客户端]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\MySql管理客户端.lnk --> C:\MySql\BIN\WINMYS~1.EXE [MySQL AB]><N>
[腾讯QQ]
  <C:\Documents and Settings\yuying\「开始」菜单\程序\启动\腾讯QQ.lnk --> C:\PROGRA~1\Tencent\qq\QQ.exe [TENCENT]><N>

==================================
服务
[Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[Microsoft NetWork FireWall Services / Microsoft NetWork FireWall Services][Stopped/Auto Start]
  <NetServices.exe><N/A>
[MySql / MySql][Running/Auto Start]
  <C:/MySql/bin/mysqld-nt.exe><N/A>
[NetMeeting Remote Desktop (RPC) Sharing / NetMeeting Remote Desktop (RPC) Sharing][Stopped/Auto Start]
  <Rundll32.exe Task688.dll ondll_server><Microsoft Corporation>
[PSEXESVC / PSEXESVC][Stopped/Manual Start]
  <C:\WINNT\System32\PSEXESVC.EXE><Sysinternals>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
  <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
  <"C:\PROGRAM FILES\RISING\RAV\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[SyGateService / SaService][Running/Auto Start]
  <C:\Program Files\Sygate\SON\sgserv.exe><Sygate technologies Inc.>
[Smart Card Helper / SCardDrv][Stopped/Auto Start]
  <C:\WINNT\system32\scardsvr32.exe -v><N/A>
[Windows Management Instrumentation Driver Extension / Windows Management Instrumentation Driver Extension][Stopped/Auto Start]
  <C:\WINNT\system32\WinDriver.exe -start_server><N/A>
[Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start]
  <C:\WINNT\System32\svchost.exe -k netsvcs-->C:\WINNT\system32\mspmsnsv.dll><Microsoft Corporation>
gototop
 
雯宝贝儿
头像
初生襁褓狮
  • 帖子:11
  • 注册: 2007-06-12
  • 来自:
发表于： 2007-06-12 22:58 | 只看楼主 短消息 资料
字号： 小 中 大 10楼

==================================
驱动程序
[Service for Avance AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[AmeAtmPc / AmeAtmPc][Stopped/Manual Start]
  <system32\DRIVERS\AmeAtmPc.sys><N/A>
[AmeLanPc / AmeLanPc][Stopped/Manual Start]
  <system32\DRIVERS\AmeLanPc.sys><N/A>
[BaseTDI / BaseTDI][Running/Auto Start]
  <\??\C:\WINNT\system32\drivers\basetdi.sys><Beijing Rising Technology Co., Ltd.>
[Conexant AccessRunner USB ADSL Adapter Filter Driver / CnxEtP][Running/Manual Start]
  <system32\DRIVERS\CnxEtP.sys><Conexant Systems, Inc.>
[Conexant AccessRunner USB ADSL Interface Device Driver / CnxEtU][Running/Manual Start]
  <system32\DRIVERS\CnxEtU.sys><Conexant Systems, Inc.>
[Conexant AccessRunner ADSL WAN PPPoE Adapter Driver / CnxTgNP][Running/Manual Start]
  <system32\DRIVERS\CnxTgNP.sys><Conexant Systems, Inc.>
[dmboot / dmboot][Stopped/Disabled]
  <System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[ExpScaner / ExpScaner][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\ExpScan.sys><>
[HookCont / HookCont][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\HookSys.sys><Rising>
[i81x / i81x][Running/Manual Start]
  <System32\DRIVERS\i81xnt5.sys><Intel(R) Corporation>
[MEMSCAN / MEMSCAN][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\MEMSCAN.sys><瑞星软件有限公司>
[Netgroup Packet Filter / NPF][Stopped/Manual Start]
  <system32\drivers\npf.sys><CACE Technologies>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
  <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[RsNTGDI / RsNTGDI][Running/Boot Start]
  <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\RSPPSYS.sys><Rising>
[Realtek RTL8139-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
  <System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[SKNFW / SKNFW][Running/System Start]
  <\??\C:\WINNT\system32\Drivers\SKNFW.sys><N/A>
[SyGate for NT, Wg1n / Wg1n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\Wg1n.sys><Sygate Technologies, Inc.>
[SyGate for NT, Wg2n / Wg2n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\Wg2n.sys><Sygate Technologies, Inc.>
[SyGate for NT, wg4n / wg4n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\wg4n.sys><Sygate Technologies, Inc.>
[SyGate for NT, wg5n / wg5n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\wg5n.sys><Sygate Technologies, Inc.>
[SyGate for NT, wg6n / wg6n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\wg6n.sys><Sygate Technologies, Inc.>
[SyGate for NT, wg8n / wg8n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\wg8n.sys><Sygate Technologies, Inc.>
[SyGate for NT, wg9n / wg9n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\wg9n.sys><Sygate Technologies, Inc.>
[iVasion PoET Adapter / WRSWanDD][Stopped/Manual Start]
  <system32\DRIVERS\WrKPoETNic2000.sys><N/A>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
  <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[npkycryp / npkycryp][Stopped/Manual Start]
  <\??\C:\Program Files\Tencent\qq\npkycryp.sys><N/A>
[npkcrypt / npkcrypt][Running/Auto Start]
  <\??\C:\Program Files\Tencent\qq\npkcrypt.sys><INCA Internet Co., Ltd.>

==================================
gototop
 
<<上一主题|下一主题>>
12   1  /  2  页   跳转页
页面顶部
Powered by Discuz!NT