1   1  /  1  页   跳转页

help help help!!!!!virus!!!!

收藏
zlpica
头像
初生襁褓狮
  • 帖子:18
  • 注册: 2006-07-20
  • 来自:
发表于： 2006-07-26 20:02 | 只看楼主 短消息 资料
字号： 小 中 大 1楼

help help help!!!!!virus!!!!

I can't execute any exe file
please look at the configuration below which came from hijackthis:

Logfile of HijackThis v1.99.1
Scan saved at 19:45:49, on 2006-7-26
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\Program Files\Rising\Rav\Ravmond.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\nvsvc32.exe
C:\Program Files\Rising\Rav\RavService.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINNT\system32\mobsync.exe
C:\SYBASE\ASE-12_5\bin\sqlsrvr.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
c:\winsock\winvnc\winvnc.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Rising\Rav\RavTray.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\CNNIC\Cdn\cdnup.exe
C:\WINNT\system32\rundll32.exe
C:\KAVPFW6\KAVPFW.EXE
C:\WINNT\system32\Internat.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINNT\sqlmanagement.exe
C:\Program Files\RhinoSoft.com\Serv-U\ServUAdmin.exe
C:\Program Files\RhinoSoft.com\Serv-U\ServUDaemon.exe
C:\WINNT\explorer.exe
C:\Program Files\baigoo\baigoo.exe
E:\pica\tools\hijackthis\HijackThis.exe

R3 - URLSearchHook: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\ifcb.exe
O2 - BHO: MonitorURL Class - {08A312BB-5409-49FC-9347-54BB7D069AC6} - C:\PROGRA~1\DESKAD~1\deskipn.dll
O2 - BHO: FltSetUp Class - {1D49D58D-5C84-4B50-8359-D9809BEB2B32} - C:\Program Files\Internet Explorer\Connection Wizard\icwnet.dll
O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll
O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll
O2 - BHO: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
O2 - BHO: CdnForIE Class - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL
O2 - BHO: ActiveBHO Class - {63C55A7F-6E29-8D4F-5C76-4F850F28D13A} - C:\Progra~1\DoDoorRSSFinder\ActiveBandObject.dll
O2 - BHO: Vision - {6671A431-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\MMSASS~1\mmsass~1.dll (file missing)
O2 - BHO: MSHlper Class - {721E6521-4CAD-4A8D-A7F1-4E230B31EF19} - C:\WINNT\system32\MSHLP.DLL
O2 - BHO: bg - {7BDAF75A-0D6F-4F50-AFE9-333D08DF4005} - C:\Program Files\baigoo\BaigooBH.dll
O2 - BHO: IEHlprObj Class - {999ADFA2-8AD1-47ff-97FC-69FB847458F4} - C:\Progra~1\NetMeeting\nmview.dll
O2 - BHO: NewWeb Controller - {9ACEEE31-1440-471B-AA46-72B061FE7D61} - C:\WINNT\system32\WinSC32.dll
O2 - BHO: (no name) - {A9930D97-9CF0-42A0-A10D-4F28836579D5} - C:\PROGRA~1\KuGoo3\KUGOO3~1.OCX
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINNT\DOWNLO~1\CnsHook.dll
O2 - BHO: (no name) - {F5824EFB-728A-4726-A5A5-85A68B20EDC3} - (no file)
O3 - Toolbar: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [RavTray] "C:\Program Files\Rising\Rav\RavTray.exe"
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [CdnCtr] C:\Program Files\CNNIC\Cdn\cdnup.exe
O4 - HKLM\..\Run: [helper.dll] C:\WINNT\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [iDuba Personal FireWall] C:\KAVPFW6\KAVPFW.EXE
O4 - HKLM\..\Run: [YLive.exe] ; C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
O4 - HKLM\..\Run: [baigoo.exe] C:\PROGRA~1\baigoo\baigoo.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\RunOnce: [InnoSetupRegFile.0000000001] "C:\WINNT\is-NSI3D.exe" /REG
O4 - HKCU\..\Run: [internat.exe] Internat.exe
O4 - HKCU\..\Run: [iDuba Personal FireWall] C:\KAVPFW6\KAVPFW.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - Global Startup: 下载程序.lnk = C:\JLEXE\DOWN\DOWN.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - Extra context menu item: 使用KuGoo3下载(&K) - C:\Program Files\KuGoo3\KuGoo3DownX.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到雅虎收藏+ - http://myweb.cn.yahoo.com/post.html?F=D2_A
O8 - Extra context menu item: 添加到雅虎订阅(&Y) - res://C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yrss.dll/YRSSMENUEXT
O8 - Extra context menu item: 访问通用网址 - C:\Program Files\CNNIC\Cdn\cnnic.htm
O8 - Extra context menu item: 雅虎搜索 - res://C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll/246
O9 - Extra button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail (file missing)
O9 - Extra button: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao (file missing)
O9 - Extra button: 中文上网 - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll
O9 - Extra 'Tools' menuitem: 中文上网 - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll
O9 - Extra button: 雅虎助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist (file missing)
O9 - Extra button: kele8 - {84920E5F-3788-49cd-A274-E365578DF174} - http://www.kele8.com/ (file missing)
O9 - Extra 'Tools' menuitem: kele8 - {84920E5F-3788-49cd-A274-E365578DF174} - http://www.kele8.com/ (file missing)
O9 - Extra button: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra 'Tools' menuitem: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: 相关站点 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: 相关站点 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: 易趣购物 - {DE607143-AC19-423e-860A-0D70ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=5 (file missing)
O9 - Extra 'Tools' menuitem: 易趣购物 - {DE607143-AC19-423e-860A-0D70ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=5 (file missing)
O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg (file missing)
O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - Extra 'Tools' menuitem: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O9 - Extra 'Tools' menuitem: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O10 - Broken Internet access because of LSP provider 'c:\winnt\system32\cdnns.dll' missing
O11 - Options group: [!CNS]  网络实名
O11 - Options group: [CDNCLIENT]  中文上网
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} - http://210.72.241.36/iNotes6.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1151981167328
O16 - DPF: {ABA7CC7F-019D-47DB-A0D2-B3C2B3AC1B44} (Fc2Boot Class) - http://210.51.5.71/onet/ActiveX/fc2boot.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6AC6E905-51BD-4588-AF58-5D99EE6404BE}: NameServer = 211.94.33.193,10.2.0.20
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Filter: text/html - {E7009873-0D40-45B1-8D59-5B9AE98C7D38} - C:\Program Files\Internet Explorer\Connection Wizard\icwnet.dll
O21 - SSODL: SysTime - {724C75F1-B757-408D-A50A-4CF99DA35D73} - C:\PROGRA~1\WinKld\WinKld.dll
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - Service: RavService - Unknown owner - C:\Program Files\Rising\Rav\RavService.exe" /service (file missing)
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: sqlmanagement - Unknown owner - C:\WINNT\sqlmanagement.exe
O23 - Service: Sybase BCKServer _ LXC_ASE_BS (SYBBCK_LXC_ASE_BS) - Unknown owner - C:\SYBASE\ASE-12_5\bin\bcksrvr.exe
O23 - Service: Sybase MONServer _ LXC_ASE_MS (SYBMON_LXC_ASE_MS) - Unknown owner - C:\SYBASE\ASE-12_5\bin\monsrvr.exe
O23 - Service: Sybase SQLServer _ LXC_ASE (SYBSQL_LXC_ASE) - Unknown owner - C:\SYBASE\ASE-12_5\bin\sqlsrvr.exe
O23 - Service: SYBSQL_ZL_ASE - Unknown owner - (no file)
O23 - Service: Sybase XPServer _ LXC_ASE_XP (SYBXPS_LXC_ASE_XP) - Unknown owner - C:\SYBASE\ASE-12_5\bin\xpserver.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - c:\winsock\winvnc\winvnc.exe" -service (file missing)

??What is the problem???
online waiting!
最后编辑2006-07-26 20:50:02
分享到：
gototop
 
mopery
头像
卡卡技术团队
  • 帖子:17737
  • 注册: 2005-12-06
  • 来自:New York
卡卡名人堂论坛9周年纪念
发表于： 2006-07-26 20:08 | 短消息 资料
字号： 小 中 大 2楼

(file missing)结尾的勾上修复..

修复
O2 - BHO: FltSetUp Class - {1D49D58D-5C84-4B50-8359-D9809BEB2B32} - C:\Program Files\Internet Explorer\Connection Wizard\icwnet.dll
O2 - BHO: Vision - {6671A431-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\MMSASS~1\mmsass~1.dll (file missing)
O2 - BHO: MSHlper Class - {721E6521-4CAD-4A8D-A7F1-4E230B31EF19} - C:\WINNT\system32\MSHLP.DLL
O2 - BHO: IEHlprObj Class - {999ADFA2-8AD1-47ff-97FC-69FB847458F4} - C:\Progra~1\NetMeeting\nmview.dll
O2 - BHO: (no name) - {F5824EFB-728A-4726-A5A5-85A68B20EDC3} - (no file)
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O18 - Filter: text/html - {E7009873-0D40-45B1-8D59-5B9AE98C7D38} - C:\Program Files\Internet Explorer\Connection Wizard\icwnet.dll
删除
C:\Program Files\Internet Explorer\Connection Wizard\icwnet.dll
C:\WINNT\system32\MSHLP.DLL
C:\Progra~1\NetMeeting\nmview.dll
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

O23 - Service: sqlmanagement - Unknown owner - C:\WINNT\sqlmanagement.exe
打开注册表编辑器，展开：HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
搜索sqlmanagement删除..
重启..删除
C:\WINNT\sqlmanagement.exe

F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\ifcb.exe

C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\ifcb.exe
打包(压缩)..发到 bin59420@yahoo.com.cn
然后修复 删除..

http://www.pctutu.com/srmsdown.asp
下载超级兔子..用超级兔子清理王卸载流氓软件...(安全模式...)
这都中国人别讲英语..
gototop
 
我无邪
头像
高贵耄耋狮
  • 帖子:20720
  • 注册: 2004-06-10
  • 来自:广西玉林
发表于： 2006-07-26 20:35 | 短消息 资料
字号： 小 中 大 3楼

楼主按以上修复后，重启。
请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。
gototop
 
zlpica
头像
初生襁褓狮
  • 帖子:18
  • 注册: 2006-07-20
  • 来自:
发表于： 2006-07-26 20:46 | 只看楼主 短消息 资料
字号： 小 中 大 4楼

2006-07-26,20:32:08

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <internat.exe><Internat.exe>  [Microsoft Corporation]
    <iDuba Personal FireWall><C:\KAVPFW6\KAVPFW.EXE>  [Kingsoft Corporation]
    <MsnMsgr><"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background>  [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <Synchronization Manager><mobsync.exe /logon>  [Microsoft Corporation]
    <RavTray><"C:\Program Files\Rising\Rav\RavTray.exe">  [Rising]
    <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
    <CdnCtr><C:\Program Files\CNNIC\Cdn\cdnup.exe>  []
    <NvCplDaemon><RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup>  [NVIDIA Corporation]
    <iDuba Personal FireWall><C:\KAVPFW6\KAVPFW.EXE>  [Kingsoft Corporation]
    <NeroFilterCheck><C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe>  [Nero AG]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    <Super Rabbit Winspeed><"C:\Program Files\Super Rabbit\MagicSet\winspeed.exe" /autokill:121,12,5>  [Super Rabbit Soft]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><explorer.exe>  [Microsoft Corporation]
    <Userinit><C:\WINNT\system32\userinit.exe,C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\ifcb.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINNT\System32\RavExt.dll>  [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    <SysTime><C:\PROGRA~1\WinKld\WinKld.dll>  [www.88dog.com]
[HKEY_CURRENT_USER\Control Panel\Desktop]
    <SCRNSAVE.EXE><(无)>  []

==================================
启动文件夹
[下载程序]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\下载程序.lnk><N>

==================================
服务
[Logical Disk Manager Administrative Service / dmadmin]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[InstallDriver Table Manager / IDriverT]
  <"C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe"><Macrovision Corporation>
[iPodService / iPodService]
  <C:\Program Files\iPod\bin\iPodService.exe><Apple Computer, Inc.>
[JMediaService / JMediaService]
  <C:\WINNT\system32\rundll32.exe C:\PROGRA~1\MMSASS~1\MMSSVER.DLL,Service><N/A>
[NVIDIA Display Driver Service / NVSvc]
  <C:\WINNT\System32\nvsvc32.exe><NVIDIA Corporation>
[RavService / RavService]
  <"C:\Program Files\Rising\Rav\RavService.exe" /service><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter]
  <C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
  <"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[SoundMAX Agent Service / SoundMAX Agent Service (default)]
  <C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.>
[sqlmanagement / sqlmanagement]
  <"C:\WINNT\sqlmanagement.exe"><N/A>
[Sybase BCKServer _ LXC_ASE_BS / SYBBCK_LXC_ASE_BS]
  <C:\SYBASE\ASE-12_5\bin\bcksrvr.exe -SLXC_ASE_BS -R><N/A>
[Sybase MONServer _ LXC_ASE_MS / SYBMON_LXC_ASE_MS]
  <C:\SYBASE\ASE-12_5\bin\monsrvr.exe -MLXC_ASE_MS -C><N/A>
[Sybase SQLServer _ LXC_ASE / SYBSQL_LXC_ASE]
  <C:\SYBASE\ASE-12_5\bin\sqlsrvr.exe -sLXC_ASE -C><N/A>
[SYBSQL_ZL_ASE / SYBSQL_ZL_ASE]
  <><N/A>
[Sybase XPServer _ LXC_ASE_XP / SYBXPS_LXC_ASE_XP]
  <C:\SYBASE\ASE-12_5\bin\xpserver.exe -SLXC_ASE_XP -C><N/A>
[VNC Server / winvnc]
  <"c:\winsock\winvnc\winvnc.exe" -service><RealVNC Ltd.>

==================================
浏览器加载项
[CdnForIE Class]
  {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[ActiveBHO Class]
  {63C55A7F-6E29-8D4F-5C76-4F850F28D13A} <C:\Progra~1\DoDoorRSSFinder\ActiveBandObject.dll, >
[MSHlper Class]
  {721E6521-4CAD-4A8D-A7F1-4E230B31EF19} <C:\WINNT\system32\mshlp.dll, >
[IEHlprObj Class]
  {999ADFA2-8AD1-47ff-97FC-69FB847458F4} <C:\Progra~1\NetMeeting\nmview.dll, Microsoft Corporation>
[CdnForIE Class]
  {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[kele8]
  {84920E5F-3788-49cd-A274-E365578DF174} <http://www.kele8.com/, N/A>
[信息检索(&R)]
  {92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[相关站点]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[WUWebControl Class]
  {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINNT\system32\wuweb.dll, Microsoft Corporation>
[Fc2Boot Class]
  {ABA7CC7F-019D-47DB-A0D2-B3C2B3AC1B44} <C:\WINNT\Downloaded Program Files\fc2boot.dll, 北京线线通科技开发有限公司>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[&使用迅雷下载]
  <C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
  <C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
[使用KuGoo3下载(&K)]
  <C:\Program Files\KuGoo3\KuGoo3DownX.htm, N/A>
[添加到雅虎收藏+]
  <http://myweb.cn.yahoo.com/post.html?F=D2_A, N/A>

==================================
gototop
 
zlpica
头像
初生襁褓狮
  • 帖子:18
  • 注册: 2006-07-20
  • 来自:
发表于： 2006-07-26 20:47 | 只看楼主 短消息 资料
字号： 小 中 大 5楼

==================================
正在运行的进程
[PID: 204][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.00.2195.6601>
[PID: 232][\??\C:\WINNT\system32\csrss.exe]  <Microsoft Corporation><5.00.2195.6601>
[PID: 228][\??\C:\WINNT\system32\winlogon.exe]  <Microsoft Corporation><5.00.2195.6898>
    [C:\WINNT\system32\SMNT40.dll]  <Analog Devices, Inc><4.02.00.0082>
    [C:\WINNT\system32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
    [C:\WINNT\system32\UNISPIM.IME]  <北京清华紫光软件股份有限公司><3.0.0.3045>
[PID: 284][C:\WINNT\system32\services.exe]  <Microsoft Corporation><5.00.2195.6700>
    [C:\WINNT\system32\dmserver.dll]  <VERITAS Software Corp.><2195.6605.297.3>
    [C:\WINNT\xboxcenter.dll]  <N/A><N/A>
[PID: 296][C:\WINNT\system32\lsass.exe]  <Microsoft Corporation><5.00.2195.6902>
    [C:\WINNT\xboxcenter.dll]  <N/A><N/A>
[PID: 476][C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 492][C:\Program Files\Rising\Rav\Ravmond.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 1, 22>
    [C:\Program Files\Rising\Rav\BWList.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 18>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [C:\Program Files\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\RsLog.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20>
    [C:\Program Files\Rising\Rav\HOOKSYS.dll]  <Rising><18, 1, 0, 9>
    [C:\Program Files\Rising\Rav\Scanner.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30>
    [C:\Program Files\Rising\Rav\libload.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\VirusLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\regmon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
    [C:\Program Files\Rising\Rav\HookWeb.dll]  <rising><18, 0, 0, 1>
    [C:\Program Files\Rising\Rav\MemMon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
    [C:\Program Files\Rising\Rav\expscan.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\mPorts.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
    [C:\Program Files\Rising\Rav\MailMon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
    [C:\Program Files\Rising\Rav\SpamEng.dll]  <N/A><18, 0, 0, 6>
    [C:\Program Files\Rising\Rav\engine.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 28>
    [C:\WINNT\xboxcenter.dll]  <N/A><N/A>
    [C:\Program Files\Rising\Rav\PostTrt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
    [C:\Program Files\Rising\Rav\UnExe.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\Rising\Rav\ScanExec.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\Rising\Rav\ScanEx.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\NvFile.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
    [C:\Program Files\Rising\Rav\ScanMac.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
    [C:\Program Files\Rising\Rav\ScanSct.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 15>
    [C:\Program Files\Rising\Rav\Unpacker.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
    [C:\Program Files\Rising\Rav\ExtOLE.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[PID: 532][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
    [C:\WINNT\xboxcenter.dll]  <N/A><N/A>
[PID: 596][C:\Program Files\Rising\Rav\RavStub.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 664][C:\WINNT\system32\spoolsv.exe]  <Microsoft Corporation><5.00.2195.6659>
    [C:\WINNT\system32\UNISPIM.IME]  <北京清华紫光软件股份有限公司><3.0.0.3045>
    [C:\WINNT\xboxcenter.dll]  <N/A><N/A>
gototop
 
zlpica
头像
初生襁褓狮
  • 帖子:18
  • 注册: 2006-07-20
  • 来自:
发表于： 2006-07-26 20:48 | 只看楼主 短消息 资料
字号： 小 中 大 6楼

[PID: 696][C:\WINNT\System32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 800][C:\WINNT\Explorer.EXE]  <Microsoft Corporation><5.00.3700.6690>
    [C:\WINNT\system32\UNISPIM.IME]  <北京清华紫光软件股份有限公司><3.0.0.3045>
    [C:\WINNT\xboxcenter.dll]  <N/A><N/A>
    [C:\WINNT\system32\SMNT40.dll]  <Analog Devices, Inc><4.02.00.0082>
    [C:\WINNT\system32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
    [C:\PROGRA~1\WinKld\Winkld.dat]  <www.88dog.com><2, 0, 0, 1>
    [C:\PROGRA~1\3721\alrex.dll]  <N/A><N/A>
    [C:\WINNT\system32\nvshell.dll]  <NVIDIA Corporation><6.14.10.5672>
    [C:\WINNT\system32\NVWRSZHC.DLL]  <NVIDIA Corporation><6.14.10.5672>
    [C:\WINNT\System32\RavExt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
    [C:\WINNT\DOWNLO~1\CnsHook.dll]  <北京三七二一科技有限公司><1, 0, 2, 7>
    [C:\Program Files\Nero\Nero 7\Nero BackItUp\NBShell.dll]  <Nero AG><2, 2, 7, 0>
    [C:\Program Files\WinRAR\rarext.dll]  <N/A><N/A>
    [C:\PROGRA~1\3721\autolive.dll]  <N/A><N/A>
    [C:\Progra~1\DoDoorRSSFinder\ActiveBandObject.dll]  <><1, 0, 0, 1>
    [C:\WINNT\system32\mshlp.dll]  <><1, 0, 0, 1>
    [C:\WINNT\system32\WinSC32.dll]  <N/A><N/A>
    [C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll]  <Nero AG><2, 0, 0, 8>
    [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll]  <Adobe Systems, Inc.><7.0.0.0>
    [C:\Program Files\IDM Computer Solutions\UltraEdit-32\ue32ctmn.dll]  <><1, 0, 0, 1>
[PID: 776][C:\WINNT\System32\nvsvc32.exe]  <NVIDIA Corporation><6.14.10.5672>
    [C:\WINNT\system32\UNISPIM.IME]  <北京清华紫光软件股份有限公司><3.0.0.3045>
[PID: 888][C:\Program Files\Rising\Rav\RavService.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 35>
    [C:\Program Files\Rising\Rav\DLCenter.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
[PID: 932][C:\WINNT\system32\MSTask.exe]  <Microsoft Corporation><4.71.2195.6704>
    [C:\WINNT\xboxcenter.dll]  <N/A><N/A>
[PID: 1044][C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe]  <Analog Devices, Inc.><3, 2, 6, 0>
[PID: 1052][C:\WINNT\sqlmanagement.exe]  <N/A><N/A>
    [C:\WINNT\xboxcenter.dll]  <N/A><N/A>
[PID: 2080][C:\WINNT\System32\WBEM\WinMgmt.exe]  <Microsoft Corporation><1.50.1085.0100>
[PID: 2096][c:\winsock\winvnc\winvnc.exe]  <RealVNC Ltd.><3, 3, 7, 0>
    [c:\winsock\winvnc\VNCHooks.dll]  <RealVNC Ltd.><3, 3, 5, 0>
    [c:\winsock\winvnc\othread2.dll]  <N/A><N/A>
    [C:\WINNT\system32\UNISPIM.IME]  <北京清华紫光软件股份有限公司><3.0.0.3045>
    [C:\WINNT\xboxcenter.dll]  <N/A><N/A>
[PID: 2108][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
    [C:\WINNT\xboxcenter.dll]  <N/A><N/A>
[PID: 2164][C:\Program Files\Rising\Rav\RavTray.exe]  <Rising><18, 0, 0, 30>
    [C:\Program Files\Rising\Rav\RavUILib.dll]  <><18, 0, 0, 1>
    [C:\Program Files\Rising\Rav\RavTray936.dll]  <Rising><18, 0, 0, 30>
    [C:\WINNT\system32\UNISPIM.IME]  <北京清华紫光软件股份有限公司><3.0.0.3045>
    [C:\Program Files\Rising\Rav\RsCommx.dll]  <rising><18, 0, 0, 1>
[PID: 2216][C:\Program Files\Rising\Rav\RavTask.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [C:\Program Files\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\WINNT\system32\UNISPIM.IME]  <北京清华紫光软件股份有限公司><3.0.0.3045>
[PID: 2228][C:\KAVPFW6\KAVPFW.EXE]  <Kingsoft Corporation><2004, 6, 25, 283>
    [C:\WINNT\system32\SMNT40.dll]  <Analog Devices, Inc><4.02.00.0082>
    [C:\WINNT\system32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
    [C:\KAVPFW6\KAVMLM.DLL]  <Kingsoft Corporation><2003.11.12.10>
    [C:\KAVPFW6\PFWScanC.dll]  <KingSoft><2002, 4, 12, 3>
    [C:\KAVPFW6\KAMsgBox.dll]  <><2002.9.27.30>
    [C:\WINNT\system32\UNISPIM.IME]  <北京清华紫光软件股份有限公司><3.0.0.3045>
    [C:\KAVPFW6\NetShare.dll]  <Kingsoft Antivirus><2004, 2, 20, 67>
    [C:\KAVPFW6\KAEQSCAN.DLL]  <Kingsoft Corp><2004, 3, 26, 69>
[PID: 2280][C:\WINNT\system32\Internat.exe]  <Microsoft Corporation><5.00.2920.0000>
    [C:\WINNT\system32\UNISPIM.IME]  <北京清华紫光软件股份有限公司><3.0.0.3045>
[PID: 2340][C:\Program Files\MSN Messenger\MsnMsgr.Exe]  <Microsoft Corporation><7.5.0322>
    [C:\WINNT\system32\SMNT40.dll]  <Analog Devices, Inc><4.02.00.0082>
    [C:\WINNT\system32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
    [C:\WINNT\system32\UNISPIM.IME]  <北京清华紫光软件股份有限公司><3.0.0.3045>
    [C:\WINNT\system32\msdmo.dll]  <N/A><N/A>
[PID: 2244][C:\WINNT\system32\conime.exe]  <Microsoft Corporation><5.00.2195.6655>
    [C:\WINNT\system32\UNISPIM.IME]  <北京清华紫光软件股份有限公司><3.0.0.3045>
[PID: 1740][C:\Program Files\Super Rabbit\MagicSet\magicset.exe]  <Super Rabbit Soft><7.67>
    [C:\WINNT\system32\UNISPIM.IME]  <北京清华紫光软件股份有限公司><3.0.0.3045>
[PID: 2360][C:\Program Files\Thunder Network\Thunder\Program\Thunder5.exe]  <Thunder Networking Technologies,LTD><5.1.6.198>
    [C:\Program Files\Thunder Network\Thunder\Program\UpdateDownload.dll]  <Thunder Networking Technologies,LTD><1, 0, 1, 3>
    [C:\Program Files\Thunder Network\Thunder\Program\download_interface.dll]  <Thunder Networking Technologies,LTD><1, 0, 2, 69>
    [C:\Program Files\Thunder Network\Thunder\Program\log4cplus.dll]  <><1, 0, 2, 1>
    [C:\Program Files\Thunder Network\Thunder\Program\stlport_vc646.dll]  <STLport Consulting, Inc.><4.6.2003.1031>
    [C:\Program Files\Thunder Network\Thunder\Program\asyn_dns.dll]  <N/A><N/A>
    [C:\Program Files\Thunder Network\Thunder\Program\msgmanage.dll]  <Thunder Networking Technologies,LTD><1, 0, 0, 15>
    [C:\Program Files\Thunder Network\Thunder\Program\historyinfo_manage.dll]  <Thunder Networking Technologies,LTD><5, 2, 0, 148>
    [C:\WINNT\system32\SMNT40.dll]  <Analog Devices, Inc><4.02.00.0082>
    [C:\WINNT\system32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
    [C:\WINNT\system32\UNISPIM.IME]  <北京清华紫光软件股份有限公司><3.0.0.3045>
    [C:\Program Files\Thunder Network\Thunder\Program\RegisterDll.dll]  <Thunder Networking Technologies,LTD><1, 2, 0, 7>
    [C:\Program Files\Thunder Network\Thunder\Program\FloatBar.dll]  <Thunder Networking Technologies,LTD><1, 0, 0, 2>
    [C:\WINNT\xboxcenter.dll]  <N/A><N/A>
    [C:\Program Files\Thunder Network\Thunder\Components\InMedia\iEmbedShell.dll]  <　><1, 0, 0, 5>
    [C:\Program Files\Thunder Network\Thunder\Components\InMedia\iEmbed.dll]  <　><2, 1, 0, 29>
    [C:\Program Files\Thunder Network\Thunder\Components\P4PClient\P4PClient.dll]  <Thunder Networking Technologies,LTD><1, 0, 0, 4>
    [C:\WINNT\System32\RavExt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
    [C:\Program Files\Thunder Network\Thunder\Program\iTargetAd.dll]  <Thunder Networking Technologies,LTD><1, 0, 0, 60>
    [C:\WINNT\system32\Macromed\Flash\Flash9.ocx]  <Adobe Systems, Inc.><9,0,16,0>
[PID: 640][C:\Program Files\Rising\Rav\RsAgent.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\WINNT\system32\UNISPIM.IME]  <北京清华紫光软件股份有限公司><3.0.0.3045>
[PID: 1060][C:\WINNT\msagent\AgentSvr.exe]  <Microsoft Corporation><2.00.0.3422>
    [C:\WINNT\system32\UNISPIM.IME]  <北京清华紫光软件股份有限公司><3.0.0.3045>
    [C:\WINNT\system32\SMNT40.dll]  <Analog Devices, Inc><4.02.00.0082>
    [C:\WINNT\system32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
[PID: 2524][C:\WINNT\system32\drwtsn32.exe]  <Microsoft Corporation><5.00.2195.6699>
    [C:\WINNT\system32\UNISPIM.IME]  <北京清华紫光软件股份有限公司><3.0.0.3045>
[PID: 496][E:\pica\tools\sreng2\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>
    [C:\WINNT\system32\UNISPIM.IME]  <北京清华紫光软件股份有限公司><3.0.0.3045>
    [C:\WINNT\xboxcenter.dll]  <N/A><N/A>

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  Error. [UltraEdit.ini]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
gototop
 
zlpica
头像
初生襁褓狮
  • 帖子:18
  • 注册: 2006-07-20
  • 来自:
发表于： 2006-07-26 20:53 | 只看楼主 短消息 资料
字号： 小 中 大 7楼

How to deal with
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\ifcb.exe

repair with hijackthis or delete it?

sorry, I am not allowed to use chinese because of the virus
gototop
 
zlpica
头像
初生襁褓狮
  • 帖子:18
  • 注册: 2006-07-20
  • 来自:
发表于： 2006-07-26 20:56 | 只看楼主 短消息 资料
字号： 小 中 大 8楼

the following is another log saved from hijackthis
please help to check if there is any other virus:

Logfile of HijackThis v1.99.1
Scan saved at 20:42:52, on 2006-7-26
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\Program Files\Rising\Rav\Ravmond.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\nvsvc32.exe
C:\Program Files\Rising\Rav\RavService.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINNT\sqlmanagement.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
c:\winsock\winvnc\winvnc.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Rising\Rav\RavTray.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\KAVPFW6\KAVPFW.EXE
C:\WINNT\system32\Internat.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINNT\system32\conime.exe
C:\Program Files\Super Rabbit\MagicSet\magicset.exe
C:\Program Files\Thunder Network\Thunder\Program\Thunder5.exe
C:\Program Files\Rising\Rav\RsAgent.exe
C:\WINNT\msagent\AgentSvr.exe
C:\Program Files\IDM Computer Solutions\UltraEdit-32\Uedit32.exe
C:\Program Files\Maxthon\Max.exe
E:\pica\tools\hijackthis\HijackThis.exe

O2 - BHO: CdnForIE Class - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll
O2 - BHO: ActiveBHO Class - {63C55A7F-6E29-8D4F-5C76-4F850F28D13A} - C:\Progra~1\DoDoorRSSFinder\ActiveBandObject.dll
O2 - BHO: MSHlper Class - {721E6521-4CAD-4A8D-A7F1-4E230B31EF19} - C:\WINNT\system32\mshlp.dll
O2 - BHO: IEHlprObj Class - {999ADFA2-8AD1-47ff-97FC-69FB847458F4} - C:\Progra~1\NetMeeting\nmview.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [RavTray] "C:\Program Files\Rising\Rav\RavTray.exe"
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [CdnCtr] C:\Program Files\CNNIC\Cdn\cdnup.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [iDuba Personal FireWall] C:\KAVPFW6\KAVPFW.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\RunOnce: [Super Rabbit Winspeed] "C:\Program Files\Super Rabbit\MagicSet\winspeed.exe" /autokill:121,12,5
O4 - HKCU\..\Run: [internat.exe] Internat.exe
O4 - HKCU\..\Run: [iDuba Personal FireWall] C:\KAVPFW6\KAVPFW.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: 下载程序.lnk = C:\JLEXE\DOWN\DOWN.exe
O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - Extra context menu item: 使用KuGoo3下载(&K) - C:\Program Files\KuGoo3\KuGoo3DownX.htm
O8 - Extra context menu item: 添加到雅虎收藏+ - http://myweb.cn.yahoo.com/post.html?F=D2_A
O9 - Extra button: 中文上网 - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll
O9 - Extra 'Tools' menuitem: 中文上网 - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll
O9 - Extra button: kele8 - {84920E5F-3788-49cd-A274-E365578DF174} - http://www.kele8.com/ (file missing)
O9 - Extra 'Tools' menuitem: kele8 - {84920E5F-3788-49cd-A274-E365578DF174} - http://www.kele8.com/ (file missing)
O9 - Extra button: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra 'Tools' menuitem: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: 相关站点 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: 相关站点 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O10 - Broken Internet access because of LSP provider 'c:\winnt\system32\cdnns.dll' missing
O11 - Options group: [CDNCLIENT]  中文上网
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} - http://210.72.241.36/iNotes6.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1151981167328
O16 - DPF: {ABA7CC7F-019D-47DB-A0D2-B3C2B3AC1B44} (Fc2Boot Class) - http://210.51.5.71/onet/ActiveX/fc2boot.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6AC6E905-51BD-4588-AF58-5D99EE6404BE}: NameServer = 211.94.33.193,10.2.0.20
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O21 - SSODL: SysTime - {724C75F1-B757-408D-A50A-4CF99DA35D73} - C:\PROGRA~1\WinKld\WinKld.dll
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - Service: RavService - Unknown owner - C:\Program Files\Rising\Rav\RavService.exe" /service (file missing)
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Sybase BCKServer _ LXC_ASE_BS (SYBBCK_LXC_ASE_BS) - Unknown owner - C:\SYBASE\ASE-12_5\bin\bcksrvr.exe
O23 - Service: Sybase MONServer _ LXC_ASE_MS (SYBMON_LXC_ASE_MS) - Unknown owner - C:\SYBASE\ASE-12_5\bin\monsrvr.exe
O23 - Service: Sybase SQLServer _ LXC_ASE (SYBSQL_LXC_ASE) - Unknown owner - C:\SYBASE\ASE-12_5\bin\sqlsrvr.exe
O23 - Service: SYBSQL_ZL_ASE - Unknown owner - (no file)
O23 - Service: Sybase XPServer _ LXC_ASE_XP (SYBXPS_LXC_ASE_XP) - Unknown owner - C:\SYBASE\ASE-12_5\bin\xpserver.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - c:\winsock\winvnc\winvnc.exe" -service (file missing)
gototop
 
我无邪
头像
高贵耄耋狮
  • 帖子:20720
  • 注册: 2004-06-10
  • 来自:广西玉林
发表于： 2006-07-26 20:57 | 短消息 资料
字号： 小 中 大 9楼

sqlmanagement / sqlmanagement]
<"C:\WINNT\sqlmanagement.exe"><N/A>
[Sybase BCKServer _ LXC_ASE_BS / SYBBCK_LXC_ASE_BS]
<C:\SYBASE\ASE-12_5\bin\bcksrvr.exe -SLXC_ASE_BS -R><N/A>
[Sybase MONServer _ LXC_ASE_MS / SYBMON_LXC_ASE_MS]
<C:\SYBASE\ASE-12_5\bin\monsrvr.exe -MLXC_ASE_MS -C><N/A>
[Sybase SQLServer _ LXC_ASE / SYBSQL_LXC_ASE]
<C:\SYBASE\ASE-12_5\bin\sqlsrvr.exe -sLXC_ASE -C><N/A>
[SYBSQL_ZL_ASE / SYBSQL_ZL_ASE]
<><N/A>
[Sybase XPServer _ LXC_ASE_XP / SYBXPS_LXC_ASE_XP]
<C:\SYBASE\ASE-12_5\bin\xpserver.exe -SLXC_ASE_XP -C><N/A>
VNC Server / winvnc]
<"c:\winsock\winvnc\winvnc.exe" -service><RealVNC Ltd.>
以上几项，如果你不知道，建议删除
以下是删除它的方法。
如果你知道，就不必修复
运行(双击)System Repair Engineer，点“启动项目，服务，点“Win32服务应用程序”勾选“隐藏微软服务”选中病毒服务sqlmanagement，Sybase BCKServer _ LXC_ASE_BS，Sybase MONServer _ LXC_ASE_MS，Sybase SQLServer _ LXC_ASE，SYBSQL_ZL_ASE ,Sybase XPServer _ LXC_ASE_XP,VNC Server,选择“删除服务”点“设置”选择“否”最后重启。（每一个逗号隔开的就是一个病毒的服务，请逐一删除）
下载超级兔子。
http://www.pctutu.com/srmsdown.asp
安装好后，打开“超级兔子清理王”“专业卸载,卸载所有提示的垃圾软件，卸载是不要打开任何浏览窗口。卸载不了可以重启后再去卸载。
卸载完后。
请到http://forum.ikaka.com/topic.asp?board=67&artid=5188931，下载，LSPFix.exe，WinsockXPFix这两个软件
重新启动电脑, 开机检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式进入Windows

运行LSPFix.exe
删除
xboxcenter.dll
附说明一份
LSPFix.exe这个软件主要用来辅助修复HijackThis扫描发现的O10项。
使用时，请关闭所有IE界面和文件夹界面后运行LSPFix，运行后，把要修复的那一个O10项从左边转到右边，点“Finish”即可。（不过这之前，需要在“I know what I`m doing”前面打勾。）
双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示确定更改时，单击“是”，清除“隐藏已知文件类型的扩展名
删除
C:\WINNT\xboxcenter.dll
c:\winsock\winvnc
C:\SYBASE\ASE-12_5
C:\WINNT\sqlmanagement.exe
C:\PROGRA~1\MMSASS~1

修复后重启，如果无法上网，请运行WinsockXPFix，让它修复一下。
回到正常模式，请再扫日志粘上来。
gototop
 
我无邪
头像
高贵耄耋狮
  • 帖子:20720
  • 注册: 2004-06-10
  • 来自:广西玉林
发表于： 2006-07-26 20:57 | 短消息 资料
字号： 小 中 大 10楼

对了
关于这一项
C:\WINNT\system32\userinit.exe,C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\ifcb.exe
看以下的帖子
http://forum.ikaka.com/topic.asp?board=28&artid=8122808
gototop
 
<<上一主题|下一主题>>
1   1  /  1  页   跳转页
页面顶部
Powered by Discuz!NT