瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 中毒电脑有很多不知名的进程,瑞星监控无法启动,有报告,在线等

12   1  /  2  页   跳转页

中毒电脑有很多不知名的进程,瑞星监控无法启动,有报告,在线等

收藏
dj11
头像
飘泊而立狮
  • 帖子:468
  • 注册: 2005-07-06
  • 来自:
发表于： 2007-05-27 00:14 | 只看楼主 短消息 资料
字号： 小 中 大 1楼

中毒电脑有很多不知名的进程,瑞星监控无法启动,有报告,在线等

2007-05-26,23:58:10

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 1 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe>  [(Verified)Microsoft Corporation]
    <9><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\c0nime.exe>  [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
    <run><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <KernelFaultCheck><%systemroot%\system32\dumprep 0 -k>  [N/A]
    <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
    <System><C:\Program Files\Common Files\system\Updaterun.exe>  [N/A]
    <WSVBRS><C:\WINDOWS\WSVBRS.exe>  [N/A]
    <cmdbcs><C:\WINDOWS\cmdbcs.exe>  [N/A]
    <upxdnd><C:\WINDOWS\upxdnd.exe>  [N/A]
    <mppds><C:\WINDOWS\mppds.exe>  [N/A]
    <msccrt><C:\WINDOWS\msccrt.exe>  [N/A]
    <Kvsc3><C:\WINDOWS\Kvsc3.exe>  [N/A]
    <MsIMMs32><C:\WINDOWS\MsIMMs32.exe>  [N/A]
    <AVPSrv><C:\WINDOWS\AVPSrv.exe>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    <twin><C:\WINDOWS\System32\ctfnom.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><C:\WINDOWS\System32\Userinit.exe,>  [(Verified)Microsoft Corporation]
    <UIHost><logonui.exe>  [(Verified)Microsoft Corporation]

==================================
启动文件夹
N/A

==================================
服务
[7B0F85E9 / 7B0F85E9]
  <C:\WINDOWS\System32\CBF22E3E.EXE -d><Microsoft Corporation>
[Human Interface Device Access / HidServ]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[NVIDIA Driver Helper Service / NVSvc]
  <C:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation>
[Rising Process Communication Center / RsCCenter]
  <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon]
  <"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[SoundMAX Agent Service / SoundMAX Agent Service (default)]
  <C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><N/A>
[Portable Media Serial Number Service / WmdmPmSN]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\System32\mspmsnsv.dll><Microsoft Corporation>

==================================
驱动程序
[aeaudio / aeaudio]
  <system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
[Service for WDM 3D Audio Driver / ALCXSENS]
  <system32\drivers\ALCXSENS.SYS><Sensaura>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[Aspi32 / Aspi32]
  <C:\WINDOWS\SYSTEM32\DRIVERS\Aspi32.SYS><Adaptec>
[Rising TDI Base Driver / BaseTDI]
  <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[C-Media PCI Audio Driver (WDM) / cmpci]
  <system32\drivers\cmpci.sys><C-Media Inc>
[C-Media WDM Audio Interface / cmuda]
  <system32\drivers\cmuda.sys><C-Media Inc>
[ExpScaner / ExpScaner]
  <\??\C:\Program Files\Rising\Rav\ExpScan.sys><>
[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS]
  <System32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
[HookCont / HookCont]
  <\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg]
  <\??\C:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys]
  <\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising>
[ialm / ialm]
  <System32\DRIVERS\ialmnt5.sys><Intel Corporation>
[kmsinput / kmsinput]
  <\??\C:\WINDOWS\System32\drivers\kmsinput.sys><N/A>
[livc / livcl]
  <\SystemRoot\System32\DRIVERS\livcl.sys><N/A>
[MEMSCAN / MEMSCAN]
  <\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[msqmx / msqmx]
  <\SystemRoot\system32\drivers\msqmx.sys><N/A>
[Netgroup Packet Filter / NPF]
  <System32\DRIVERS\npf.sys><CACE Technologies>
[npkcrypt / npkcrypt]
  <\??\C:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[npkycryp / npkycryp]
  <\??\C:\Program Files\Tencent\QQ\npkycryp.sys><N/A>
[nv / nv]
  <System32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink]
  <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware]
  <\SystemRoot\System32\drivers\RsBoot.sys><Beijing Rising>
[RsNTGDI / RsNTGDI]
  <\SystemRoot\System32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS]
  <\??\C:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139]
  <System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[S3Psddr / S3Psddr]
  <System32\DRIVERS\s3gnbm.sys><S3 Graphics, Inc.>
[Secdrv / Secdrv]
  <System32\DRIVERS\secdrv.sys><N/A>
[SiS315 / SiS315]
  <System32\DRIVERS\sisgrp.sys><Silicon Integrated Systems Corporation>
[SiS AGP Filter / sisagp]
  <\SystemRoot\System32\DRIVERS\SISAGPX.sys><Silicon Integrated Systems Corporation>
[SiSkp / SiSkp]
  <system32\drivers\srvkp.sys><Silicon Integrated Systems Corporation>
[SiS PCI Fast Ethernet Adapter Driver / SISNIC]
  <System32\DRIVERS\sisnic.sys><SiS Corporation>
[smwdm / smwdm]
  <system32\drivers\smwdm.sys><N/A>
[tridxp / tridxp]
  <System32\DRIVERS\tridxpm.sys><Trident Microsystems Inc.>
[tvdiqvd / tvdiqvdr]
  <\SystemRoot\System32\DRIVERS\tvdiqvdr.sys><N/A>
[VIA AC'97 Audio Controller (WDM) / VIAudio]
  <system32\drivers\viaudio.sys><VIA Technologies, Inc.>
[vrvfilemon / VRVSYS]
  <\??\c:\bxy_vrv\filemon.sys><N/A>
[World Standard Teletext Codec / WSTCODEC]
  <System32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[xyfilemon / xyantivirus]
  <\??\C:\bxy_vrv\filemon.sys><N/A>
[Intel(R) Graphics Platform (SoftBIOS) Driver / {6080A529-897E-4629-A488-ABA0C29B635E}]
  <system32\drivers\ialmsbw.sys><Intel Corporation>

==================================
浏览器加载项
[CAdLogic Object]
  {11F09AFD-75AD-4E51-AB43-E09E9351CE16} <C:\Program Files\Common Files\CPUSH\cpush.dll, N/A>
[Info cache]
  {385AB8C6-FB22-4D17-8834-064E2BA0A6F0} <C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll, 金泰丰(广州)科技有限公司>
[超级兔子上网精灵]
  {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} <C:\Program Files\Super Rabbit\IEG\haokanbar.dll, Xiang Feng Technology>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
  {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, N/A>
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[超级兔子上网精灵]
  {43869BB3-22FD-4F15-9B46-238106BA2F4E} <C:\Program Files\Super Rabbit\IEG\haokanbar.dll, Xiang Feng Technology>
[卡卡上网安全助手]
  {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\System32\KakaTool.dll, Beijing Rising Technology Co., Ltd.>
[Edit Class]
  {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\WINDOWS\System32\CMBEdit.dll, N/A>
[CEditCtrl Object]
  {488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\System32\aliedit\AliEdit.dll, www.alipay.com>
[Tencent Safety Online Base Module]
  {C09B522F-8AED-4E21-A65C-DC1AB652BAEE} <C:\WINDOWS\DOWNLO~1\TSOBase.ocx, Tencent Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[BoBo P2P多媒体网络点播/广播/直播系统 V3]
  {EC0978ED-24E3-403C-AB7A-060E388553E6} <C:\WINDOWS\DOWNLO~1\BOBO_A~1.OCX, N/A>
[上传到QQ网络硬盘]
  <C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
  <C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

最后编辑2007-05-27 21:40:00.747000000
分享到：
gototop
 
dj11
头像
飘泊而立狮
  • 帖子:468
  • 注册: 2005-07-06
  • 来自:
发表于： 2007-05-27 00:14 | 只看楼主 短消息 资料
字号： 小 中 大 2楼

==================================
正在运行的进程
[PID: 472][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 556][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 580][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 624][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 636][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 796][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\vgtiug.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\kbjqhp.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\civwof.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\ecxvrk.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\ekpmsz.dll]  [N/A, N/A]
[PID: 848][C:\Program Files\Rising\Rav\CCenter.exe]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
[PID: 876][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 996][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1024][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1040][C:\Program Files\Rising\Rav\Ravmond.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 49]
    [C:\Program Files\Rising\Rav\BWList.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
    [C:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [C:\Program Files\Rising\Rav\rfwctrl.dll]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]
    [C:\Program Files\Rising\Rav\RsPPsys.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6]
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
    [C:\Program Files\Rising\Rav\CfgDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [C:\Program Files\Rising\Rav\RsLog.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
    [C:\Program Files\Rising\Rav\HOOKSYS.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 0]
    [C:\Program Files\Rising\Rav\Scanner.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 15]
    [C:\Program Files\Rising\Rav\libload.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 16]
    [C:\Program Files\Rising\Rav\VirusLib.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 12]
    [C:\Program Files\Rising\Rav\regmon.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6]
    [C:\Program Files\Rising\Rav\HookWeb.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 1]
    [C:\Program Files\Rising\Rav\MemMon.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 14]
    [C:\Program Files\Rising\Rav\expscan.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\Program Files\Rising\Rav\mPorts.dll]  [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3]
    [C:\Program Files\Rising\Rav\HookCont.dll]  [Rising, 19, 0, 0, 0]
    [C:\Program Files\Rising\Rav\SpamEng.dll]  [N/A, 18, 0, 0, 6]
    [C:\Program Files\Rising\Rav\engine.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 27]
    [C:\Program Files\Rising\Rav\PostTrt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 14]
    [C:\Program Files\Rising\Rav\UnExe.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
    [C:\Program Files\Rising\Rav\ScanExec.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 16]
    [C:\Program Files\Rising\Rav\ScanEx.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 54]
    [C:\Program Files\Rising\Rav\ExtFile.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 28]
    [C:\Program Files\Rising\Rav\NvFile.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 11]
    [C:\Program Files\Rising\Rav\ScanMac.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 14]
    [C:\Program Files\Rising\Rav\ScanSct.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 19]
    [C:\Program Files\Rising\Rav\Unpacker.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 20]
    [C:\Program Files\Rising\Rav\ScanPack.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 23]
    [C:\Program Files\Rising\Rav\RsVM.dll]  [N/A, 19, 0, 0, 18]
    [C:\Program Files\Rising\Rav\ScanNet.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
    [C:\Program Files\Rising\Rav\Uroutine.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 30]
    [C:\Program Files\Rising\Rav\Uscript.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 19]
    [C:\Program Files\Rising\Rav\RsStore.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
    [C:\Program Files\Rising\Rav\ExtOLE.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 13]
[PID: 1248][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[PID: 1356][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\nwguf.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\moyu102.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\nwizhx2.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\igfxpph.dll]  [Intel Corporation, 3,0,0,1517]
    [C:\WINDOWS\System32\hccutils.DLL]  [Intel Corporation, 3,0,0,1517]
    [C:\WINDOWS\System32\igfxres.dll]  [Intel Corporation, 3,0,0,1517]
    [C:\WINDOWS\System32\igfxsrvc.dll]  [Intel Corporation, 3,0,0,1517]
    [C:\WINDOWS\System32\igfxdev.dll]  [Intel Corporation, 3,0,0,1517]
    [C:\PROGRA~1\WinZip\WZSHLSTB.DLL]  [WinZip Computing, Inc., 3.0 (32-bit)]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [C:\WINDOWS\System32\vgtiug.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\bwlgtd.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\kbjqhp.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\civwof.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\ecxvrk.dll]  [N/A, N/A]
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Gjzo1.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\Kvsc3.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\MsIMMs32.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\ekpmsz.dll]  [N/A, N/A]
[PID: 1580][C:\Program Files\Rising\Rav\RavTask.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
    [C:\Program Files\Rising\Rav\CfgDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
    [C:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [C:\WINDOWS\System32\vgtiug.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\kbjqhp.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\civwof.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\ecxvrk.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\ekpmsz.dll]  [N/A, N/A]
[PID: 1620][C:\WINDOWS\System32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\vgtiug.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\kbjqhp.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\civwof.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\ecxvrk.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\ekpmsz.dll]  [N/A, N/A]
[PID: 1788][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 332][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 2188][C:\WINDOWS\System32\conime.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\ekpmsz.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\ecxvrk.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\civwof.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\kbjqhp.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\vgtiug.dll]  [N/A, N/A]
[PID: 2384][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [C:\Program Files\Super Rabbit\IEG\haokanbar.dll]  [Xiang Feng Technology, 2, 2, 0, 1612]
    [C:\Program Files\Common Files\CPUSH\cpush.dll]  [N/A, 1.0.2.9]
    [C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll]  [金泰丰(广州)科技有限公司, 2, 3, 0, 0]
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\WINDOWS\System32\vgtiug.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\civwof.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\kbjqhp.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\ecxvrk.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\ekpmsz.dll]  [N/A, N/A]
[PID: 1052][C:\Documents and Settings\Administrator\Local Settings\Temp\temp.exe]  [N/A, N/A]
[PID: 2912][C:\WINDOWS\SYSTEM32\RUNDLLFOROUR.EXE]  [Microsoft Corporation, 5.00.2134.1]
[PID: 2944][C:\Program Files\WinRAR\WinRAR.exe]  [N/A, N/A]
    [C:\WINDOWS\System32\ekpmsz.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\ecxvrk.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\civwof.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\kbjqhp.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\vgtiug.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\MsIMMs32.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\Kvsc3.dll]  [N/A, N/A]
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Gjzo1.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\bwlgtd.dll]  [N/A, N/A]
[PID: 3856][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.779\SREng\SREng.exe]  [Smallfrogs Studio, 2.2.6.605]
gototop
 
dj11
头像
飘泊而立狮
  • 帖子:468
  • 注册: 2005-07-06
  • 来自:
发表于： 2007-05-27 00:14 | 只看楼主 短消息 资料
字号： 小 中 大 3楼

[C:\WINDOWS\System32\ekpmsz.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\ecxvrk.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\civwof.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\kbjqhp.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\vgtiug.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\MsIMMs32.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\Kvsc3.dll]  [N/A, N/A]
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Gjzo1.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\bwlgtd.dll]  [N/A, N/A]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1        localhost
127.0.0.1        popwin.9983.com
61.152.169.246    www.kuaiso.com
61.152.169.246    www.my6688.cn
61.152.169.246    www.union123.com
61.152.169.246    www.ktan.cn
61.152.169.246    www.2t2t.cn
61.152.169.246    www.cq530.com
61.152.169.246    www.365tc.com
61.152.169.246    ad.qucha.net
61.152.169.246    www.tan8.cn
61.152.169.246    www.itjj.net
61.152.169.246    www.start188.com
61.152.169.246    www.at58.cn
61.152.169.246    union.yxad.com
61.152.169.246    www.iptan.com
61.152.169.246    www.ip2008.net
61.152.169.246    www.yqif.com
61.152.169.246    www.2t2t.cn
61.152.169.246    www.17tan8.com
61.152.169.246    17tan8.com
61.152.169.246    www.688ip.com
61.152.169.246    www.17tc.com
61.152.169.246    www.zztan.com
61.152.169.246    www.5tanip.com
61.152.169.246    www.16tc.com
61.152.169.246    www.163se.net
61.152.169.246    www.724tc.com
61.152.169.246    www1.6tan.com
61.152.169.246    www2.6tan.com
61.152.169.246    www.6tan.com
61.152.169.246    quxiuu.com
61.152.169.246    www.quxiuu.com
61.152.169.246    www.23b.cn
61.152.169.246    www.ookkw.com
61.152.169.246    www.97725.com
61.152.169.246    down.97725.com
61.152.169.246    www.54699.com
61.152.169.246    web.77276.com
61.152.169.246    www.77276.com
61.152.169.246    d.77276.com
61.152.169.246    do.77276.com
61.152.169.246    i.96981.com
61.152.169.246    wm.103715.com
61.152.169.246    www.138505.com
61.152.169.246    cool.47555.com
61.152.169.246    www.437799.com
61.152.169.246    www.168080.com
61.152.169.246    w.168080.com
61.152.169.246    q.168080.com
61.152.169.246    www.baidu8.org
61.152.169.246    d.qbbd.com
61.152.169.246    w.qbbd.com
61.152.169.246    www.npjxjy.com
61.152.169.246    www.wwwlm.net
61.152.169.246    new2.jixie123.cn
61.152.169.246    www.18dmm.com
61.152.169.246    www.souxse.cn
61.152.169.246    dm1.yiall.com
61.152.169.246    www.nze21.com
61.152.169.246    www.puma163.com
61.152.169.246    www.hyap98.com
61.152.169.246    www.51liulan.cn
61.152.169.246    s.gcuj.com
61.152.169.246    long.down988.cn
61.152.169.246    x.vvcyin.com
61.152.169.246    w.vvcyin.com
61.152.169.246    cc.wzxqy.com
61.152.169.246    ip.315hack.com
61.152.169.246    ip.54liumang.com
61.152.169.246    www.41ip.com
61.152.169.246    xulao.com
61.152.169.246    www.xulao.com
61.152.169.246    www.heixiou.com
61.152.169.246    www.9cyy.com
61.152.169.246    adnx.yygou.cn
61.152.169.246    www1.cw988.cn
61.152.169.246    www2.cw988.cn
61.152.169.246    www.asdwc.com
61.152.169.246    ceoww.com
61.152.169.246    boolom.com
61.152.169.246    www.boolom.com
61.152.169.246    www.tellumore.com
61.152.169.246    www.o1wg.com
61.152.169.246    www.qq756.com
61.152.169.246    ll.chinasese.net
61.152.169.246    www.cnwangmeng.cn
61.152.169.246    0.82211.net
61.152.169.246    rising.whatthishome.com
61.152.169.246    www.canqiou.com
61.152.169.246    www.if56.cn
61.152.169.246    woai777.com
61.152.169.246    www.cz-kc.com
61.152.169.246    www.f1ash8.net
61.152.169.246    new.hackpp.com
61.152.169.246    ad.taoip.cn
61.152.169.246    www.game53.com
61.152.169.246    up.boolom.com
61.152.169.246    t.gcuj.com
61.152.169.246    w.zpx520.com
61.152.169.246    www.08325.cn
61.152.169.246    d.fangni.net
61.152.169.246    psxiaokan1.mei7.com
61.152.169.246    jd.54liumang.com
61.152.169.246    www.ipvip.info
61.152.169.246    www.tao168188.com
61.152.169.246    ww.qqzheng.cn
61.152.169.246    mmm.021mm8.com
61.152.169.246    www.urlad.cn
61.152.169.246    www.810810.org
61.152.169.246    my.pkgame8.com
61.152.169.246    www.chunliao.net
61.152.169.246    www.89622.com
61.152.169.246    at2.810810.org
61.152.169.246    www.qq.goto.60ad.cn
61.152.169.246    www.down988.cn
61.152.169.246    mail.8u8y.com
61.152.169.246    ad.uiiiu.com
61.152.169.246    j.56c.us
61.152.169.246    swkee.com
61.152.169.246    love.du97.cn

==================================
gototop
 
dj11
头像
飘泊而立狮
  • 帖子:468
  • 注册: 2005-07-06
  • 来自:
发表于： 2007-05-27 00:21 | 只看楼主 短消息 资料
字号： 小 中 大 4楼

[C:\WINDOWS\System32\ekpmsz.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\ecxvrk.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\civwof.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\kbjqhp.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\vgtiug.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\MsIMMs32.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\Kvsc3.dll]  [N/A, N/A]
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Gjzo1.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\bwlgtd.dll]  [N/A, N/A]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1        localhost
127.0.0.1        popwin.9983.com
61.152.169.246    www.kuaiso.com
61.152.169.246    www.my6688.cn
61.152.169.246    www.union123.com
61.152.169.246    www.ktan.cn
61.152.169.246    www.2t2t.cn
61.152.169.246    www.cq530.com
61.152.169.246    www.365tc.com
61.152.169.246    ad.qucha.net
61.152.169.246    www.tan8.cn
61.152.169.246    www.itjj.net
61.152.169.246    www.start188.com
61.152.169.246    www.at58.cn
61.152.169.246    union.yxad.com
61.152.169.246    www.iptan.com
61.152.169.246    www.ip2008.net
61.152.169.246    www.yqif.com
61.152.169.246    www.2t2t.cn
61.152.169.246    www.17tan8.com
61.152.169.246    17tan8.com
61.152.169.246    www.688ip.com
61.152.169.246    www.17tc.com
61.152.169.246    www.zztan.com
61.152.169.246    www.5tanip.com
61.152.169.246    www.16tc.com
61.152.169.246    www.163se.net
61.152.169.246    www.724tc.com
61.152.169.246    www1.6tan.com
61.152.169.246    www2.6tan.com
61.152.169.246    www.6tan.com
61.152.169.246    quxiuu.com
61.152.169.246    www.quxiuu.com
61.152.169.246    www.23b.cn
61.152.169.246    www.ookkw.com
61.152.169.246    www.97725.com
61.152.169.246    down.97725.com
61.152.169.246    www.54699.com
61.152.169.246    web.77276.com
61.152.169.246    www.77276.com
61.152.169.246    d.77276.com
61.152.169.246    do.77276.com
61.152.169.246    i.96981.com
61.152.169.246    wm.103715.com
61.152.169.246    www.138505.com
61.152.169.246    cool.47555.com
61.152.169.246    www.437799.com
61.152.169.246    www.168080.com
61.152.169.246    w.168080.com
61.152.169.246    q.168080.com
61.152.169.246    www.baidu8.org
61.152.169.246    d.qbbd.com
61.152.169.246    w.qbbd.com
61.152.169.246    www.npjxjy.com
61.152.169.246    www.wwwlm.net
61.152.169.246    new2.jixie123.cn
61.152.169.246    www.18dmm.com
61.152.169.246    www.souxse.cn
61.152.169.246    dm1.yiall.com
61.152.169.246    www.nze21.com
61.152.169.246    www.puma163.com
61.152.169.246    www.hyap98.com
61.152.169.246    www.51liulan.cn
61.152.169.246    s.gcuj.com
61.152.169.246    long.down988.cn
61.152.169.246    x.vvcyin.com
61.152.169.246    w.vvcyin.com
61.152.169.246    cc.wzxqy.com
61.152.169.246    ip.315hack.com
61.152.169.246    ip.54liumang.com
61.152.169.246    www.41ip.com
61.152.169.246    xulao.com
61.152.169.246    www.xulao.com
61.152.169.246    www.heixiou.com
61.152.169.246    www.9cyy.com
61.152.169.246    adnx.yygou.cn
61.152.169.246    www1.cw988.cn
61.152.169.246    www2.cw988.cn
61.152.169.246    www.asdwc.com
61.152.169.246    ceoww.com
61.152.169.246    boolom.com
61.152.169.246    www.boolom.com
61.152.169.246    www.tellumore.com
61.152.169.246    www.o1wg.com
61.152.169.246    www.qq756.com
61.152.169.246    ll.chinasese.net
61.152.169.246    www.cnwangmeng.cn
61.152.169.246    0.82211.net
61.152.169.246    rising.whatthishome.com
61.152.169.246    www.canqiou.com
61.152.169.246    www.if56.cn
61.152.169.246    woai777.com
61.152.169.246    www.cz-kc.com
61.152.169.246    www.f1ash8.net
61.152.169.246    new.hackpp.com
61.152.169.246    ad.taoip.cn
61.152.169.246    www.game53.com
61.152.169.246    up.boolom.com
61.152.169.246    t.gcuj.com
61.152.169.246    w.zpx520.com
61.152.169.246    www.08325.cn
61.152.169.246    d.fangni.net
61.152.169.246    psxiaokan1.mei7.com
61.152.169.246    jd.54liumang.com
61.152.169.246    www.ipvip.info
61.152.169.246    www.tao168188.com
61.152.169.246    ww.qqzheng.cn
61.152.169.246    mmm.021mm8.com
61.152.169.246    www.urlad.cn
61.152.169.246    www.810810.org
61.152.169.246    my.pkgame8.com
61.152.169.246    www.chunliao.net
61.152.169.246    www.89622.com
61.152.169.246    at2.810810.org
61.152.169.246    www.qq.goto.60ad.cn
61.152.169.246    www.down988.cn
61.152.169.246    mail.8u8y.com
61.152.169.246    ad.uiiiu.com
61.152.169.246    j.56c.us
61.152.169.246    swkee.com
61.152.169.246    love.du97.cn

==================================
gototop
 
火影忍者
头像
横据古稀狮
  • 帖子:7855
  • 注册: 2006-06-29
  • 来自:火星
发表于： 2007-05-27 00:40 | 短消息 资料
字号： 小 中 大 5楼

删除启动项
<9><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\c0nime.exe> [N/A]
<WSVBRS><C:\WINDOWS\WSVBRS.exe> [N/A]
<cmdbcs><C:\WINDOWS\cmdbcs.exe> [N/A]
<upxdnd><C:\WINDOWS\upxdnd.exe> [N/A]
<mppds><C:\WINDOWS\mppds.exe> [N/A]
<msccrt><C:\WINDOWS\msccrt.exe> [N/A]
<Kvsc3><C:\WINDOWS\Kvsc3.exe> [N/A]
<MsIMMs32><C:\WINDOWS\MsIMMs32.exe> [N/A]
<AVPSrv><C:\WINDOWS\AVPSrv.exe> [N/A]
服务项
[7B0F85E9 / 7B0F85E9]
<C:\WINDOWS\System32\CBF22E3E.EXE -d><Microsoft Corporation>
驱动项
[livc / livcl]
<\SystemRoot\System32\DRIVERS\livcl.sys><N/A>
[npkycryp / npkycryp]
<\??\C:\Program Files\Tencent\QQ\npkycryp.sys><N/A>
[tvdiqvd / tvdiqvdr]
<\SystemRoot\System32\DRIVERS\tvdiqvdr.sys><N/A>



[xyfilemon / xyantivirus]
<\??\C:\bxy_vrv\filemon.sys><N/A>
[vrvfilemon / VRVSYS]
<\??\c:\bxy_vrv\filemon.sys><N/A>这两个可疑



删除对应的文件

删除
[C:\WINDOWS\System32\vgtiug.dll] [N/A, N/A]
[C:\WINDOWS\System32\bwlgtd.dll] [N/A, N/A]
[C:\WINDOWS\System32\kbjqhp.dll] [N/A, N/A]
[C:\WINDOWS\System32\civwof.dll] [N/A, N/A]
[C:\WINDOWS\System32\ecxvrk.dll] [N/A, N/A]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Gjzo1.dll] [N/A, N/A]
[C:\WINDOWS\System32\Kvsc3.dll] [N/A, N/A]
[C:\WINDOWS\System32\MsIMMs32.dll] [N/A, N/A]
[C:\WINDOWS\System32\ekpmsz.dll] [N/A, N/A]
[C:\WINDOWS\system32\nwguf.dll] [N/A, N/A]
[C:\WINDOWS\System32\moyu102.dll] [N/A, N/A]
[C:\WINDOWS\System32\nwizhx2.dll] [N/A, N/A]


清空临时文件
关闭系统还原
修复hosts
gototop
 
loveperday
头像
初生襁褓狮
  • 帖子:824
  • 注册: 2007-05-11
  • 来自:
发表于： 2007-05-27 00:41 | 短消息 资料
字号： 小 中 大 6楼

========Content========
9><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\c0nime.exe> [N/A]
<System><C:\Program Files\Common Files\system\Updaterun.exe> [N/A]
<WSVBRS><C:\WINDOWS\WSVBRS.exe> [N/A]
<cmdbcs><C:\WINDOWS\cmdbcs.exe> [N/A]
<upxdnd><C:\WINDOWS\upxdnd.exe> [N/A]
<mppds><C:\WINDOWS\mppds.exe> [N/A]
<msccrt><C:\WINDOWS\msccrt.exe> [N/A]

<Kvsc3><C:\WINDOWS\Kvsc3.exe> [N/A]
<MsIMMs32><C:\WINDOWS\MsIMMs32.exe> [N/A]
<AVPSrv><C:\WINDOWS\AVPSrv.exe> [N/A]
<twin><C:\WINDOWS\System32\ctfnom.exe> [Microsoft Corporation]

[7B0F85E9 / 7B0F85E9]
<C:\WINDOWS\System32\CBF22E3E.EXE -d><Microsoft Corporation>


[livc / livcl]
<\SystemRoot\System32\DRIVERS\livcl.sys><N/A>
[msqmx / msqmx]
<\SystemRoot\system32\drivers\msqmx.sys><N/A>
[npkycryp / npkycryp]
<\??\C:\Program Files\Tencent\QQ\npkycryp.sys><N/A>
[tvdiqvd / tvdiqvdr]
<\SystemRoot\System32\DRIVERS\tvdiqvdr.sys><N/A>

[C:\WINDOWS\System32\vgtiug.dll] [N/A, N/A]
[C:\WINDOWS\System32\kbjqhp.dll] [N/A, N/A]
[C:\WINDOWS\System32\civwof.dll] [N/A, N/A]
[C:\WINDOWS\System32\ecxvrk.dll] [N/A, N/A]
[C:\WINDOWS\System32\ekpmsz.dll] [N/A, N/A]
C:\WINDOWS\system32\nwguf.dll] [N/A, N/A]
[C:\WINDOWS\System32\moyu102.dll] [N/A, N/A]
[C:\WINDOWS\System32\nwizhx2.dll] [N/A, N/A]
[C:\WINDOWS\System32\Kvsc3.dll] [N/A, N/A]
[C:\WINDOWS\System32\MsIMMs32.dll] [N/A, N/A]
PID: 1052][C:\Documents and Settings\Administrator\Local Settings\Temp\temp.exe] [N/A, N/A]
[PID: 2912][C:\WINDOWS\SYSTEM32\RUNDLLFOROUR.EXE] [Microsoft Corporation, 5.00.2134.1]
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Gjzo1.dll] [N/A, N/A]
[C:\WINDOWS\System32\bwlgtd.dll] [N/A, N/A]

我考~楼主，你最好还是重装吧，太多了这也~~
把这些注册表，驱动，服务都删掉，文件也删掉。
QQ重装。
HOST文件修复。。。
gototop
 
dj11
头像
飘泊而立狮
  • 帖子:468
  • 注册: 2005-07-06
  • 来自:
发表于： 2007-05-27 00:43 | 只看楼主 短消息 资料
字号： 小 中 大 7楼

host文件怎么修复
gototop
 
loveperday
头像
初生襁褓狮
  • 帖子:824
  • 注册: 2007-05-11
  • 来自:
发表于： 2007-05-27 00:46 | 短消息 资料
字号： 小 中 大 8楼

SREng就可以。。。
gototop
 
hotboy
头像
社区嘉宾
  • 帖子:27670
  • 注册: 2002-02-01
  • 来自:东厂
卡卡风雨同舟勋章论坛8周年活动礼物卡卡名人堂论坛9周年纪念冰激凌十周年
发表于： 2007-05-27 00:49 | 短消息 资料
字号： 小 中 大 9楼

引用:
【dj11的贴子】host文件怎么修复
………………

系统修复——hosts文件——重置
gototop
 
点点星星
头像
强壮不惑狮
  • 帖子:975
  • 注册: 2003-06-15
  • 来自:
发表于： 2007-05-27 00:55 | 短消息 资料
字号： 小 中 大 10楼

绝症啊！！太多啦！！
gototop
 
<<上一主题|下一主题>>
12   1  /  2  页   跳转页
页面顶部
Powered by Discuz!NT