被www.7939.com劫持了 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛被www.7939.com劫持了

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

12

1 / 2 页

跳转页

被www.7939.com劫持了

呆头鹅加大菜鸟强壮不惑狮帖子:712 注册: 2004-07-13 来自:	发表于： 2006-08-25 21:29 \| 只看楼主短消息资料字号：小中大 1楼被www.7939.com劫持了开机就弹出来／／打开ＩＥ　就有这个杀毒也杀不了这是日志 HijackThis_zww汉化版扫描日志 V1.99.1 保存于 21:17:33, 日期 2006-8-25 操作系统： Windows XP SP2 (WinNT 5.01.2600) 浏览器： Internet Explorer v6.00 SP2 (6.00.2900.2180) 当前运行的进程： C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe C:\WINDOWS\SOUNDMAN.EXE D:\Thunder\Thunder.exe C:\WINDOWS\system32\Realplayer.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\VPC32.EXE C:\Program Files\Internet Explorer\iexplore.exe D:\日志扫描\HijackThis1991zww.exe O2 - BHO: ThunderIEHelper - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v11.dll O2 - BHO: wmpdrm - {0E674588-66B7-4E19-9D0E-2053B800F69F} - C:\WINDOWS\system32\wmpdrm.dll (file missing) O2 - BHO: MyIEHelper Class - {16B770A0-0E87-4278-B748-2460D64A8386} - C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\IEHelper_5001.dll (file missing) O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\Program Files\Tencent\QQ\QQIEHelper.dll O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - D:\Thunder\ComDlls\XunLeiBHO_002.dll O2 - BHO: NewWeb Controller - {9ACEEE31-1440-471B-AA46-72B061FE7D61} - C:\WINDOWS\system32\WinSC.dll O2 - BHO: Spoolsv Class - {9C363D55-07D7-433d-A13E-D9C105202F6F} - C:\WINDOWS\system32\drivers\spoolsv.dll O2 - BHO: Yahoo Bar - {A697BC46-BC93-4833-93F5-1E365011E88A} - C:\WINDOWS\ODBINT.dll O2 - BHO: Webacc - {CAC068F3-A608-406B-8581-458788A67694} - C:\WINDOWS\system32\svchost.dll O2 - BHO: 51导航 - {D271A289-57EB-4D0E-9131-A0CD25D4D1F8} - C:\WINDOWS\system32\browsewmzero.dll O2 - BHO: Shell name - {D682D42E-BE2C-4758-AB18-926D2E7553B8} - C:\DOCUME~1\春禾天斓的膥~1\LOCALS~1\Temp\vmmreg32.dll (file missing) O2 - BHO: Subconscious Intruder - {E2218499-2FD4-4EED-A94A-7F0B9C6E300E} - C:\WINDOWS\system32\Inte32.dll O3 - IE工具栏增项: BitComet工具栏 - {3F1ABCDB-A875-46c1-8345-B72A4567E486} - D:\BitComet\BitCometBar\BitCometBar0.6.dll O4 - 启动项HKLM\\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - 启动项HKLM\\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe O4 - 启动项HKLM\\Run: [SoundMan] SOUNDMAN.EXE O4 - 启动项HKLM\\Run: [Thunder] "D:\Thunder\Thunder.exe" /s O4 - 启动项HKLM\\Run: [svc] C:\WINDOWS\svchost.exe O4 - 启动项HKLM\\Run: [Hupoo] C:\WINDOWS\system32\Hupoo.exe O4 - 启动项HKLM\\Run: [Realplayer.exe] C:\WINDOWS\system32\Realplayer.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [svc] C:\WINDOWS\svchost.exe O4 - HKCU\..\Run: [Realplayer.exe] C:\WINDOWS\system32\Realplayer.exe O4 - Startup: 腾讯QQ.lnk = C:\Program Files\Tencent\QQ\QQ.exe O8 - IE右键菜单中的新增项目: &使用迅雷下载 - D:\Thunder\Program\GetUrl.htm O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - D:\Thunder\Program\GetAllUrl.htm O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm O8 - IE右键菜单中的新增项目: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm O9 - 浏览器额外的按钮: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - D:\Thunder\Thunder.exe O9 - 浏览器额外的“工具”菜单项: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - D:\Thunder\Thunder.exe O9 - 浏览器额外的按钮: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.tomatolei.com (file missing) O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE O9 - 浏览器额外的按钮: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll O9 - 浏览器额外的“工具”菜单项: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll O14 - IERESET.INF: START_PAGE_URL=about:blank O16 - DPF: {A8C3B40D-5384-44AD-ACC4-504B4D8A85F5} (BoBo_V2 Control) - http://www.euucn.com/p2pplay/ActiveX_V2.ocx O17 - HKLM\System\CCS\Services\Tcpip\..\{E3A58E95-557E-482C-A685-FCD920000C55}: NameServer = 202.102.192.68 202.102.199.68 O20 - AppInit_DLLs: KB496973M.LOG O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll O23 - NT 服务: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe O23 - NT 服务: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - NT 服务: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe O23 - NT 服务: Pigeon_Server03 (PigeonServer.03) - Unknown owner - C:\WINDOWS\Server03.exe 2006-08-27 11:37:41
呆头鹅加大菜鸟强壮不惑狮帖子:712 注册: 2004-07-13 来自:	分享到：

秋日里的蓝天卡卡技术团队帖子:7349 注册: 2004-09-30 来自:	发表于： 2006-08-25 21:36 \| 短消息资料字号：小中大 2楼控制面板－－管理工具－－服务－－查找Pigeon_Server03 禁止这个服务运行Hijackthis，把下面的选中打上钩，修复 O2 - BHO: wmpdrm - {0E674588-66B7-4E19-9D0E-2053B800F69F} - C:\WINDOWS\system32\wmpdrm.dll (file missing) O2 - BHO: MyIEHelper Class - {16B770A0-0E87-4278-B748-2460D64A8386} - C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\IEHelper_5001.dll (file missing) O2 - BHO: NewWeb Controller - {9ACEEE31-1440-471B-AA46-72B061FE7D61} - C:\WINDOWS\system32\WinSC.dll O2 - BHO: Spoolsv Class - {9C363D55-07D7-433d-A13E-D9C105202F6F} - C:\WINDOWS\system32\drivers\spoolsv.dll O2 - BHO: Yahoo Bar - {A697BC46-BC93-4833-93F5-1E365011E88A} - C:\WINDOWS\ODBINT.dll O2 - BHO: Webacc - {CAC068F3-A608-406B-8581-458788A67694} - C:\WINDOWS\system32\svchost.dll O2 - BHO: 51导航 - {D271A289-57EB-4D0E-9131-A0CD25D4D1F8} - C:\WINDOWS\system32\browsewmzero.dll O4 - 启动项HKLM\\Run: [svc] C:\WINDOWS\svchost.exe O4 - 启动项HKLM\\Run: [Hupoo] C:\WINDOWS\system32\Hupoo.exe O20 - AppInit_DLLs: KB496973M.LOG O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll O23 - NT 服务: Pigeon_Server03 (PigeonServer.03) - Unknown owner - C:\WINDOWS\Server03.exe
秋日里的蓝天卡卡技术团队帖子:7349 注册: 2004-09-30 来自:

我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林	发表于： 2006-08-25 22:09 \| 短消息资料字号：小中大 3楼楼主按楼上说的修复后，重启。请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来下载网址 http://www.kztechs.com/sreng/sreng2.zip http://forum.ikaka.com/topic.asp?board=67&artid=5188931 日志一次粘不完，分次粘完，请不要修改。
我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林

硫酸羹双氧水初生襁褓狮帖子:8 注册: 2006-08-26 来自:	发表于： 2006-08-26 11:25 \| 短消息资料字号：小中大 4楼我的浏览器也被它劫持了！
硫酸羹双氧水初生襁褓狮帖子:8 注册: 2006-08-26 来自:

硫酸羹双氧水初生襁褓狮帖子:8 注册: 2006-08-26 来自:	发表于： 2006-08-26 11:30 \| 短消息资料字号：小中大 5楼我也贴上日志，请高手帮我看一下，谢谢了！ HijackThis_815汉化版扫描日志 V1.99.1 保存于 10:58:20, 日期 2006-8-26 操作系统： Windows 2000 SP4 (WinNT 5.00.2195) 浏览器： Internet Explorer v6.00 SP1 (6.00.2800.1106) 当前运行的进程： C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\svchost.exe C:\Program Files\Rising\Rav\CCenter.exe C:\Program Files\Rising\Rav\Ravmond.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\system32\nvsvc32.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\Program Files\Rising\Rav\RavStub.exe C:\WINNT\Explorer.EXE C:\Program Files\Rising\Rav\RavTask.exe C:\Program Files\Rising\Rav\Ravmon.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINNT\system32\Realplayer.exe C:\WINNT\system32\internat.exe E:\下载材料\内存扫把\ram.exe C:\WINNT\system32\conime.exe C:\Program Files\Maxthon\Maxthon.exe C:\Program Files\Thunder Network\Thunder\Program\Thunder5.exe C:\Program Files\Rising\Rav\RsAgent.exe C:\WINNT\msagent\AgentSvr.exe E:\下载材料\Hijackthis1991zww\HijackThis1991zww.exe O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll O3 - IE工具栏增项: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup O4 - 启动项HKLM\\Run: [nwiz] nwiz.exe /install O4 - 启动项HKLM\\Run: [Synchronization Manager] mobsync.exe /logon O4 - 启动项HKLM\\Run: [NvMixerTray] C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe O4 - 启动项HKLM\\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - 启动项HKLM\\Run: [Realplayer.exe] C:\WINNT\system32\Realplayer.exe O4 - HKCU\..\Run: [Internat.exe] internat.exe O4 - HKCU\..\Run: [Realplayer.exe] C:\WINNT\system32\Realplayer.exe O8 - IE右键菜单中的新增项目: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm O8 - IE右键菜单中的新增项目: 用比特精灵下载(&B) - E:\下载材料\BitSpirit\bsurl.htm O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O23 - NT 服务: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - NT 服务: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
硫酸羹双氧水初生襁褓狮帖子:8 注册: 2006-08-26 来自:

我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林	发表于： 2006-08-26 12:37 \| 短消息资料字号：小中大 6楼【回复“硫酸羹双氧水”的帖子】 ALT+CTRL+DELETE调出任务管理器,终止所有Realplayer.exe 的进程关闭所有浏览窗口以及一些不必要的程序运行Hijackthis，扫描结束后在下列选项前打上勾，然后选"修复 O4 - 启动项HKLM\\Run: [Realplayer.exe] C:\WINNT\system32\Realplayer.exe O4 - HKCU\..\Run: [Realplayer.exe] C:\WINNT\system32\Realplayer.exe 双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示确定更改时，单击“是”，清除“隐藏已知文件类型的扩展名删除 C:\WINNT\system32\Realplayer.exe 修复后重启请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来下载网址 http://www.kztechs.com/sreng/sreng2.zip http://forum.ikaka.com/topic.asp?board=67&artid=5188931 日志一次粘不完，分次粘完，请不要修改。自己立个帖子。
我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林

硫酸羹双氧水初生襁褓狮帖子:8 注册: 2006-08-26 来自:	发表于： 2006-08-26 13:19 \| 短消息资料字号：小中大 7楼非常感谢“我无邪”的答复但是我按照你的操作，终止所有Realplayer.exe 的进程还是无法删除C:\WINNT\system32\Realplayer.exe！我把Hijackthis的扫描日志和System Repair Engineer的日志在贴上： HijackThis_815汉化版扫描日志 V1.99.1 保存于 13:11:47, 日期 2006-8-26 操作系统： Windows 2000 SP4 (WinNT 5.00.2195) 浏览器： Internet Explorer v6.00 SP1 (6.00.2800.1106) 当前运行的进程： C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\svchost.exe C:\Program Files\Rising\Rav\CCenter.exe C:\Program Files\Rising\Rav\Ravmond.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\system32\nvsvc32.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\Program Files\Rising\Rav\RavStub.exe C:\WINNT\Explorer.EXE C:\Program Files\Rising\Rav\RavTask.exe C:\WINNT\system32\Realplayer.exe C:\WINNT\system32\internat.exe C:\Program Files\Rising\Rav\RavMon.exe C:\Program Files\Maxthon\Maxthon.exe E:\下载材料\Hijackthis1991zww\HijackThis1991zww.exe O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll O3 - IE工具栏增项: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup O4 - 启动项HKLM\\Run: [nwiz] nwiz.exe /install O4 - 启动项HKLM\\Run: [Synchronization Manager] mobsync.exe /logon O4 - 启动项HKLM\\Run: [NvMixerTray] C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe O4 - 启动项HKLM\\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system O4 - 启动项HKLM\\Run: [Realplayer.exe] C:\WINNT\system32\Realplayer.exe O4 - HKCU\..\Run: [Internat.exe] internat.exe O4 - HKCU\..\Run: [Realplayer.exe] C:\WINNT\system32\Realplayer.exe O8 - IE右键菜单中的新增项目: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm O8 - IE右键菜单中的新增项目: 用比特精灵下载(&B) - E:\下载材料\BitSpirit\bsurl.htm O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O23 - NT 服务: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - NT 服务: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
硫酸羹双氧水初生襁褓狮帖子:8 注册: 2006-08-26 来自:

硫酸羹双氧水初生襁褓狮帖子:8 注册: 2006-08-26 来自:	发表于： 2006-08-26 13:22 \| 短消息资料字号：小中大 8楼 2006-08-26,13:12:44 System Repair Engineer 2.0.21.505 (2.0 RC 2) Smallfrogs (http://www.KZTechs.com) Windows 2000 Professional Service Pack 4 (Build 2195) - 管理权限用户 - 完整功能以下内容被选中：所有的启动项目（包括注册表、启动文件夹、服务等）浏览器加载项正在运行的进程（包括进程模块信息）文件关联启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <Internat.exe><internat.exe> [Microsoft Corporation] <Realplayer.exe><C:\WINNT\system32\Realplayer.exe> [] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <load><> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <NvCplDaemon><RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup> [NVIDIA Corporation] <nwiz><nwiz.exe /install> [NVIDIA Corporation] <Synchronization Manager><mobsync.exe /logon> [Microsoft Corporation] <NvMixerTray><C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe> [NVIDIA Corporation] <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.] <Realplayer.exe><C:\WINNT\system32\Realplayer.exe> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [Microsoft Corporation] <Userinit><C:\WINNT\system32\userinit.exe,> [Microsoft Corporation] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><> [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINNT\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.] ================================== 启动文件夹服务 [Logical Disk Manager Administrative Service / dmadmin] <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.> [NVIDIA Driver Helper Service / NVSvc] <C:\WINNT\system32\nvsvc32.exe><NVIDIA Corporation> [Rising Process Communication Center / RsCCenter] <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.> [RsRavMon Service / RsRavMon] <"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.> ================================== 浏览器加载项 [Thunder Browser Helper] {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD> [@shdoclc.dll,-866] {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A> [@msdxmLC.dll,-1@2052,电台(&R)] {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.> [&使用迅雷下载] <C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A> [&使用迅雷下载全部链接] <C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A> [用比特精灵下载(&B)] <E:\下载材料\BitSpirit\bsurl.htm, N/A>
硫酸羹双氧水初生襁褓狮帖子:8 注册: 2006-08-26 来自:

硫酸羹双氧水初生襁褓狮帖子:8 注册: 2006-08-26 来自:	发表于： 2006-08-26 13:22 \| 短消息资料字号：小中大 9楼 ================================== 正在运行的进程 [PID: 156][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.00.2195.6601> [PID: 180][\??\C:\WINNT\system32\csrss.exe] <Microsoft Corporation><5.00.2195.6601> [PID: 176][\??\C:\WINNT\system32\winlogon.exe] <Microsoft Corporation><5.00.2195.6714> [PID: 228][C:\WINNT\system32\services.exe] <Microsoft Corporation><5.00.2195.6700> [C:\WINNT\system32\dmserver.dll] <VERITAS Software Corp.><2195.6605.297.3> [PID: 240][C:\WINNT\system32\lsass.exe] <Microsoft Corporation><5.00.2195.6695> [PID: 396][C:\WINNT\system32\svchost.exe] <Microsoft Corporation><5.00.2134.1> [PID: 440][C:\WINNT\system32\svchost.exe] <Microsoft Corporation><5.00.2134.1> [PID: 456][C:\Program Files\Rising\Rav\CCenter.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3> [PID: 488][C:\Program Files\Rising\Rav\Ravmond.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 33> [C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11> [C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\Program Files\Rising\Rav\RsLog.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20> [C:\Program Files\Rising\Rav\HOOKSYS.dll] <Beijing Rising Technology Co., Ltd.><18, 1, 0, 11> [C:\Program Files\Rising\Rav\Scanner.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30> [C:\Program Files\Rising\Rav\libload.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [C:\Program Files\Rising\Rav\VirusLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12> [C:\Program Files\Rising\Rav\regmon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6> [C:\Program Files\Rising\Rav\HookWeb.dll] <rising><18, 0, 0, 2> [C:\Program Files\Rising\Rav\MemMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [C:\Program Files\Rising\Rav\expscan.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\Program Files\Rising\Rav\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3> [C:\Program Files\Rising\Rav\MailMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [C:\Program Files\Rising\Rav\SpamEng.dll] <N/A><18, 0, 0, 6> [C:\Program Files\Rising\Rav\engine.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30> [C:\Program Files\Rising\Rav\PostTrt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12> [C:\Program Files\Rising\Rav\UnExe.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11> [C:\Program Files\Rising\Rav\ScanExec.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11> [C:\Program Files\Rising\Rav\ScanEx.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 14> [C:\Program Files\Rising\Rav\NvFile.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7> [C:\Program Files\Rising\Rav\ScanMac.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9> [C:\Program Files\Rising\Rav\ScanSct.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 18> [C:\Program Files\Rising\Rav\Unpacker.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3> [PID: 540][C:\WINNT\system32\spoolsv.exe] <Microsoft Corporation><5.00.2195.6659> [PID: 592][C:\WINNT\system32\nvsvc32.exe] <NVIDIA Corporation><6.14.10.4467> [PID: 632][C:\WINNT\system32\regsvc.exe] <Microsoft Corporation><5.00.2195.6701> [PID: 668][C:\WINNT\system32\MSTask.exe] <Microsoft Corporation><4.71.2195.6704> [PID: 764][C:\WINNT\System32\WBEM\WinMgmt.exe] <Microsoft Corporation><1.50.1085.0100> [PID: 880][C:\Program Files\Rising\Rav\RavStub.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [PID: 1008][C:\WINNT\Explorer.EXE] <Microsoft Corporation><5.00.3700.6690> [C:\WINNT\system32\brlmon.dll] <N/A><N/A> [C:\WINNT\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21> [C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll] <Thunder Networking Technologies,LTD><5, 0, 0, 2> [C:\Program Files\WinRAR\rarext.dll] <N/A><N/A> [PID: 1204][C:\Program Files\Rising\Rav\RavTask.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22> [C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [PID: 1228][C:\WINNT\system32\Realplayer.exe] <N/A><N/A> [PID: 1248][C:\WINNT\system32\internat.exe] <Microsoft Corporation><5.00.2920.0000> [PID: 1212][C:\Program Files\Rising\Rav\RavMon.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 32> [C:\Program Files\Rising\Rav\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 24> [C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19> [C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11> [C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [C:\Program Files\Rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [PID: 336][C:\Program Files\Maxthon\Maxthon.exe] <MY Soft Technology><1, 1, 0, 67> [C:\Program Files\Maxthon\zlib.dll] <N/A><N/A> [C:\Program Files\Maxthon\Services\RealTime\real_time.dll] <><1, 0, 0, 1> [C:\Program Files\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\WINNT\system32\Macromed\Flash\Flash9.ocx] <Adobe Systems, Inc.><9,0,16,0> [C:\WINNT\system32\UNISPIM.IME] <北京清华紫光软件股份有限公司><3.0.0.3045> [C:\WINNT\system32\upengine.dll] <北京清华紫光软件股份有限公司><3.0.0.3045> [PID: 1000][C:\WINNT\system32\NOTEPAD.EXE] <Microsoft Corporation><5.00.2140.1> [PID: 676][C:\Program Files\WinRAR\WinRAR.exe] <N/A><N/A> [PID: 1120][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.297\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505> ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINNT\hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 ==================================
硫酸羹双氧水初生襁褓狮帖子:8 注册: 2006-08-26 来自:

我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林	发表于： 2006-08-26 13:31 \| 短消息资料字号：小中大 10楼把Realplayer.exe发到我的邮箱里来吧twtxk@126.com 你这样试试请到www.27814939.ys168.com,点“我的软件”下载KillBox.exe 重新启动电脑, 开机检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式进入Windows 双击打开KillBox.exe，分别删除 C:\DOCUME~1\user\APPLIC~1\safehelp\global pop.exe c:\docume~1\user\applic~1\objins~1\defaul~1.exe （删除时勾选“删除前先结束Explorer.EXE进程”不行再试着勾选"删除DLL文件前反注册此文件" 运行Hijackthis，扫描结束后在下列选项前打上勾，然后选"修复 O4 - 启动项HKLM\\Run: [Realplayer.exe] C:\WINNT\system32\Realplayer.exe O4 - HKCU\..\Run: [Realplayer.exe] C:\WINNT\system32\Realplayer.exe 修复后重启，再扫份日志粘上来。
我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林

<<上一主题|下一主题>>

12

1 / 2 页

跳转页

页面顶部

Powered by Discuz!NT