电脑里的瑞星不能运行!!!!附扫描日志 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛电脑里的瑞星不能运行!!!!附扫描日志

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

1

1 / 1 页

跳转页

电脑里的瑞星不能运行!!!!附扫描日志

重新再来A 快乐黄口狮帖子:114 注册: 2004-03-24 来自:	发表于： 2008-05-06 09:57 \| 只看楼主短消息资料字号：小中大 1楼电脑里的瑞星不能运行!!!!附扫描日志附件: SREngLOG.log (2008-5-6 13:48:02, 23.83 K) 该附件被下载次数 54 现在连清理助手都被感染了,什么木马都杀不掉!!! [CODE] 2008-05-06,09:28:31 System Repair Engineer 2.6.8.980 Smallfrogs (http://www.KZTechs.com) Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能以下内容被选中：所有的启动项目（包括注册表、启动文件夹、服务等）浏览器加载项正在运行的进程（包括进程模块信息）文件关联 Winsock 提供者 Autorun.inf HOSTS 文件进程特权扫描启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <anistio><; C:\WINDOWS\anistio.exE> [File is missing] <BigDogPath><; C:\WINDOWS\VM_STI.EXE Vimicro USB PC Camera (ZC0301PL)> [File is missing] <bincdwsa><; C:\WINDOWS\bincdwsa.exe> [File is missing] <cinfonmc><; C:\WINDOWS\cinfonmc.exe> [File is missing] <dbhlp32><; C:\WINDOWS\dbhlp32.exe> [File is missing] <dionpis><; C:\WINDOWS\dionpis.exe> [File is missing] <dndsioc><; C:\WINDOWS\dndsioc.exe> [File is missing] <fiosectc><; C:\WINDOWS\fiosectc.exe> [File is missing] <fmbiost><; C:\WINDOWS\fmbiost.exe> [File is missing] <fmsbbqi><; C:\WINDOWS\fmsbbqi.exe> [File is missing] <fmsiocps><; C:\WINDOWS\fmsiocps.exe> [File is missing] <fmsjhif><; C:\WINDOWS\fmsjhif.exe> [File is missing] <hefxxxy><; C:\WINDOWS\hefxxxy.exe> [] <igfxhkcmd><; C:\WINDOWS\system32\hkcmd.exe> [(Verified)Microsoft Windows Publisher] <igfxpers><; C:\WINDOWS\system32\igfxpers.exe> [(Verified)Microsoft Windows Publisher] <igzwzslm><; C:\WINDOWS\gwsmhxuq.exe> [] <IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Publisher] <issms32><; C:\WINDOWS\issms32.exe> [File is missing] <KavStart><; "C:\KAV2007\KAVStart.exe" -startup> [File is missing] <mfchlp64><; C:\WINDOWS\mfchlp64.exe> [File is missing] <PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [File is missing] <PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [File is missing] <ptshell><; C:\WINDOWS\ptshell.exe> [File is missing] <runeip><; C:\Program Files\Rising\AntiSpyware\runiep.exe> [Beijing Rising Technology Co., Ltd.] <SoundMan><; SoundMan.exe> [N/A] <tciocp64><; C:\WINDOWS\tciocp64.exe> [File is missing] <wallxxx><; c:\windows\system32\壁纸自动换.exe> [] <WINSvr64><; C:\WINDOWS\WINSvr64.exe> [File is missing] <yuiabct><; C:\WINDOWS\yuiabct.exe> [File is missing] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] <KKDelay><C:\Program Files\Rising\AntiSpyware\RunOnce.exe> [Beijing Rising Technology Co., Ltd.] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [(Verified)Microsoft Windows Publisher] <Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher] <UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [(Verified)Beijing Rising Science and Technology Corporation Limited] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] <WinlogonNotify: igfxcui><igfxdev.dll> [(Verified)Microsoft Windows Hardware Compatibility Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}] <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] <Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path] <IFEO[Your Image File Name Here without a path]><ntsd -d> [N/A] [HKEY_CURRENT_USER\Control Panel\Desktop] <SCRNSAVE.EXE><C:\WINDOWS\梦幻水~1.SCR> [] 用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ) 重新再来A 最后编辑于 2008-05-06 13:48:02
重新再来A 快乐黄口狮帖子:114 注册: 2004-03-24 来自:	分享到：

重新再来A 快乐黄口狮帖子:114 注册: 2004-03-24 来自:	发表于： 2008-05-06 09:57 \| 只看楼主短消息资料字号：小中大 2楼回复: 电脑里的瑞星不能运行!!!!附扫描日志 ================================== 启动文件夹 N/A ================================== 服务 [Office Source Engine / ose][Stopped/Manual Start] <"C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"><Microsoft Corporation> [Rising Process Communication Center / RsCCenter][Running/Auto Start] <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.> [Rising RealTime Monitor / RsRavMon][Stopped/Auto Start] <"C:\PROGRAM FILES\RISING\RAV\Ravmond.exe"><Beijing Rising Technology Co., Ltd.> [Windows User Mode Driver Framework / UMWdf][Running/Auto Start] <C:\WINDOWS\system32\wdfmgr.exe><Microsoft Corporation> ================================== 驱动程序 [Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Stopped/Manual Start] <system32\drivers\ac97intc.sys><Intel Corporation> [Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start] <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.> [AMD K8 Processor Driver / AmdK8][Stopped/Manual Start] <System32\DRIVERS\amdk8.sys><Advanced Micro Devices> [VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Stopped/Manual Start] <system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.> [HookCont / HookCont][Running/System Start] <\SystemRoot\system32\drivers\HookCont.sys><Beijing Rising Technology Co., Ltd> [HookNtos / HookNtos][Running/System Start] <\SystemRoot\system32\drivers\HookNtos.sys><Beijing Rising Technology Co., Ltd> [HookReg / HookReg][Running/System Start] <\SystemRoot\system32\drivers\HookReg.sys><Beijing Rising Technology Co., Ltd> [HookSys / HookSys][Running/System Start] <\SystemRoot\system32\drivers\HookSys.sys><Beijing Rising Technology Co., Ltd> [ialm / ialm][Running/Manual Start] <system32\DRIVERS\ialmnt5.sys><Intel Corporation> [KWatch3 / KWatch3][Running/System Start] <\??\C:\WINDOWS\system32\drivers\KWatch3.SYS><Kingsoft Corporation> [Netgroup Packet Filter / NPF][Stopped/Manual Start] <system32\drivers\npf.sys><CACE Technologies> [npkcrypt / npkcrypt][Running/Auto Start] <\??\D:\lenovo\QQ2007\npkcrypt.sys><INCA Internet Co., Ltd.> [nv / nv][Stopped/Manual Start] <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation> [Direct Parallel Link Driver / Ptilink][Running/Manual Start] <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.> [RsAntiSpyware / RsAntiSpyware][Running/Boot Start] <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising Technology Co., Ltd.> [RsNTGDI / RsNTGDI][Running/Boot Start] <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.> [Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start] <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation> [Secdrv / Secdrv][Stopped/Manual Start] <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.> [Vimicro USB PC Camera (ZC0301PL) / ZSMC301b][Stopped/Manual Start] <System32\Drivers\usbVM31b.sys><VM> ================================== 浏览器加载项 [豪杰超级解霸V8] {367E0A21-8601-4986-9C9A-153BF5ACA118} <C:\Herosoft\HeroV8\STHSDVD.EXE, N/A> [信息检索(&R)] {92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation> [QQ] {c95fe080-8f5d-11d2-a20b-00aa003c157b} <D:\lenovo\QQ2007\QQ.EXE, TENCENT> [Windows Genuine Advantage Validation Tool] {17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft Corporation> [360SafeLive] {87515F61-A66C-4319-A0E0-D416CB8059E3} <D:\Program Files\360safe\live.dll, 360.cn> [RDS.DataSpace] {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation> [&使用迅雷下载] <C:\Program Files\Thunder Network\Thunder\geturl.htm, N/A> [&使用迅雷下载全部链接] <C:\Program Files\Thunder Network\Thunder\getallurl.htm, N/A> [导出到 Microsoft Office Excel(&X)] <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A> [添加到QQ自定义面板] <D:\lenovo\QQ2007\AddPanel.htm, N/A> [添加到QQ表情] <D:\lenovo\QQ2007\AddEmotion.htm, N/A> [用QQ彩信发送该图片] <D:\lenovo\QQ2007\SendMMS.htm, N/A> [豪杰超级解霸V8实时播放] <C:\Herosoft\HeroV8\MPURLGET.HTM, N/A> ================================== 正在运行的进程 [PID: 472 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 536 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 560 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 604 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 616 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 760 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 804 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 844 / SYSTEM][C:\Program Files\Rising\Rav\CCenter.exe] [Beijing Rising Technology Co., Ltd., 20.0.0.28] [PID: 860 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 908 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 952 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1192 / Administrator][C:\WINDOWS\svchost.exe] [Microsoft Corporation, 6, 0, 2900, 2180] [C:\Herosoft\HeroV8\VCvtShell.dll] [herosoft, 1, 0, 0, 1] [PID: 1208 / SYSTEM][C:\PROGRAM FILES\RISING\RAV\ravmond.exe] [Beijing Rising Technology Co., Ltd., 20.0.0.76] [C:\PROGRAM FILES\RISING\RAV\BWList.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.4] [C:\WINDOWS\system32\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MFC71CHS.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\PROGRAM FILES\RISING\RAV\RSAPPMGR.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.0] [C:\PROGRAM FILES\RISING\RAV\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.16] [C:\PROGRAM FILES\RISING\RAV\RsLog.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.34] [C:\PROGRAM FILES\RISING\RAV\ProcCom.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19] [C:\PROGRAM FILES\RISING\RAV\RsCommX2.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19] [C:\PROGRAM FILES\RISING\RAV\MonRule.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.29] [C:\PROGRAM FILES\RISING\RAV\Hooksys.dll] [Beijing Rising Technology Co., Ltd, 22, 0, 0, 9] [C:\PROGRAM FILES\RISING\RAV\HookReg.dll] [Beijing Rising Technology Co., Ltd, 22, 0, 0, 4] [C:\PROGRAM FILES\RISING\RAV\HookNtos.dll] [Beijing Rising Technology Co., Ltd, 22, 0, 0, 2] [C:\PROGRAM FILES\RISING\RAV\rswalmon.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 22] [C:\PROGRAM FILES\RISING\RAV\recomp.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 35] [C:\PROGRAM FILES\RISING\RAV\refs.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 15] [C:\PROGRAM FILES\RISING\RAV\ffr.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 13] [C:\Program Files\Rising\Rav\RsStore.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.8] [C:\PROGRAM FILES\RISING\RAV\HookCont.dll] [Beijing Rising Technology Co., Ltd, 22, 0, 0, 1] [C:\Program Files\Rising\Rav\fakescan.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.13] [C:\Program Files\Rising\Rav\Scanner.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.36] [C:\PROGRAM FILES\RISING\RAV\extfile.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 29] [C:\PROGRAM FILES\RISING\RAV\pearc.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 5] [C:\PROGRAM FILES\RISING\RAV\viruslib.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 26] [C:\PROGRAM FILES\RISING\RAV\relibldr.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 14] [C:\PROGRAM FILES\RISING\RAV\HookWeb.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.2] [C:\PROGRAM FILES\RISING\RAV\nvfile.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 5] [C:\PROGRAM FILES\RISING\RAV\scanexec.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 17] [C:\PROGRAM FILES\RISING\RAV\unexe.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 4] [C:\PROGRAM FILES\RISING\RAV\scanex.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 62] [C:\PROGRAM FILES\RISING\RAV\scanpack.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 9] [C:\PROGRAM FILES\RISING\RAV\revm.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 8] [C:\PROGRAM FILES\RISING\RAV\urutils.dll] [, 20, 0, 0, 5] [C:\PROGRAM FILES\RISING\RAV\ur000.dat] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 18] [C:\PROGRAM FILES\RISING\RAV\extmail.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 9] [C:\PROGRAM FILES\RISING\RAV\scansct.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 8] [PID: 1380 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)] [PID: 1528 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1588 / LOCAL SERVICE][C:\WINDOWS\system32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)] [PID: 1736 / SYSTEM][C:\PROGRAM FILES\RISING\RAV\RavStub.exe] [Beijing Rising Technology Co., Ltd., 20.0.0.9] [C:\PROGRAM FILES\RISING\RAV\ProcCom.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19] [C:\PROGRAM FILES\RISING\RAV\RsCommX2.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19] [C:\PROGRAM FILES\RISING\RAV\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16] [PID: 1864 / Administrator][C:\WINDOWS\system32\Explorer.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.17] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\Program Files\WinRAR\rarext.dll] [N/A, ] [C:\Herosoft\HeroV8\VCvtShell.dll] [herosoft, 1, 0, 0, 1] [C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16] [PID: 2004 / Administrator][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Herosoft\HeroV8\VCvtShell.dll] [herosoft, 1, 0, 0, 1] [PID: 1492 / Administrator][C:\Documents and Settings\Administrator\桌面\sreng980\SREngLdr.EXE] [Smallfrogs Studio, 2.6.8.980] [PID: 1564 / Administrator][C:\Documents and Settings\Administrator\桌面\sreng980\SRE7c456bda.EXE] [Smallfrogs Studio, 2.6.8.980] [C:\Herosoft\HeroV8\VCvtShell.dll] [herosoft, 1, 0, 0, 1]
重新再来A 快乐黄口狮帖子:114 注册: 2004-03-24 来自:

重新再来A 快乐黄口狮帖子:114 注册: 2004-03-24 来自:	发表于： 2008-05-06 09:58 \| 只看楼主短消息资料字号：小中大 3楼回复: 电脑里的瑞星不能运行!!!!附扫描日志 ================================== 文件关联 .TXT Error. [C:\WINDOWS\notepad.exe %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM Error. ["hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf N/A ================================== HOSTS 文件 127.0.0.1 localhost ================================== 进程特权扫描特殊特权被允许： SeLoadDriverPrivilege [PID = 1192, C:\WINDOWS\SVCHOST.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 1492, C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SRENG980\SRENGLDR.EXE] ================================== API HOOK N/A ================================== 隐藏进程 N/A ================================== [/CODE]
重新再来A 快乐黄口狮帖子:114 注册: 2004-03-24 来自:

重新再来A 快乐黄口狮帖子:114 注册: 2004-03-24 来自:	发表于： 2008-05-06 10:31 \| 只看楼主短消息资料字号：小中大 4楼回复: 电脑里的瑞星不能运行!!!!附扫描日志还有局域网里的第二台电脑也出现这种情况!!!日志如下!!! CODE] 2008-05-06,10:14:17 System Repair Engineer 2.6.8.980 Smallfrogs (http://www.KZTechs.com) Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能以下内容被选中：所有的启动项目（包括注册表、启动文件夹、服务等）浏览器加载项正在运行的进程（包括进程模块信息）文件关联 Winsock 提供者 Autorun.inf HOSTS 文件进程特权扫描启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <hefxxxy><C:\WINDOWS\hefxxxy.exe> [] <igzwzslm><; C:\WINDOWS\gwsmhxuq.exe> [] <tciocp64><; C:\WINDOWS\tciocp64.exe> [] <dbhlp32><; C:\WINDOWS\dbhlp32.exe> [] <ptshell><; C:\WINDOWS\ptshell.exe> [] <dionpis><; C:\WINDOWS\dionpis.exe> [] <cinfonmc><; C:\WINDOWS\cinfonmc.exe> [] <SoundMan><; SoundMan.exe> [N/A] <fiosectc><; C:\WINDOWS\fiosectc.exe> [File is missing] <fmsbbqi><; C:\WINDOWS\fmsbbqi.exe> [File is missing] <fmsiocps><; C:\WINDOWS\fmsiocps.exe> [File is missing] <fmsjhif><; C:\WINDOWS\fmsjhif.exe> [File is missing] <IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Publisher] <issms32><; C:\WINDOWS\issms32.exe> [File is missing] <mfchlp64><; C:\WINDOWS\mfchlp64.exe> [File is missing] <PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [File is missing] <PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [File is missing] <ticisms><; C:\WINDOWS\ticisms.exe> [File is missing] <wallxxx><; c:\windows\system32\壁纸自动换.exe> [] <WINSvr64><; C:\WINDOWS\WINSvr64.exe> [File is missing] <yuiabct><; C:\WINDOWS\yuiabct.exe> [File is missing] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [(Verified)Microsoft Windows Publisher] <Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [(Verified)Beijing Rising Science and Technology Corporation Limited] <{3E387664-C799-4D62-B196-25776EF35C51}><C:\WINDOWS\system32\mxavpw0.dll> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] <WinlogonNotify: igfxcui><igfxdev.dll> [(Verified)Microsoft Windows Hardware Compatibility Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}] <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] <Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe] <IFEO[360rpt.exe]><ntsd -d> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe] <IFEO[360safe.exe]><ntsd -d> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.exe] <IFEO[360safebox.exe]><ntsd -d> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe] <IFEO[360tray.exe]><ntsd -d> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe] <IFEO[CCenter.exe]><ntsd -d> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPPMain.exe] <IFEO[KPPMain.exe]><ntsd -d> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe] <IFEO[KWatch.exe]><ntsd -d> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctor.exe] <IFEO[QQDoctor.exe]><ntsd -d> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQKav.exe] <IFEO[QQKav.exe]><ntsd -d> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe] <IFEO[RavMon.exe]><ntsd -d> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe] <IFEO[RavMonD.exe]><ntsd -d> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxTray.exe] <IFEO[safeboxTray.exe]><ntsd -d> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tqat.exe] <IFEO[tqat.exe]><ntsd -d> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path] <IFEO[Your Image File Name Here without a path]><ntsd -d> [N/A] [HKEY_CURRENT_USER\Control Panel\Desktop] <SCRNSAVE.EXE><C:\WINDOWS\豪杰多~1.SCR> [] ================================== 启动文件夹 [新建文本文档] <C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\新建文本文档.bat --> [File is missing]><N> [QQ游戏启动加速程序] <C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\QQ游戏启动加速程序.lnk --> D:\QQGame\Accel.exe [深圳市腾讯计算机系统有限公司]><N> ================================== 服务 [Human Intexxxce Device Access / HidServ][Stopped/Disabled] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A> [Rising Process Communication Center / RsCCenter][Running/Auto Start] <"D:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.> [Rising RealTime Monitor / RsRavMon][Stopped/Auto Start] <"D:\PROGRAM FILES\RISING\RAV\Ravmond.exe"><Beijing Rising Technology Co., Ltd.> [Help and Support / helpsvc][Stopped/Manual Start] <2 - 系统找不到指定的文件。 ><(File is missing)>
重新再来A 快乐黄口狮帖子:114 注册: 2004-03-24 来自:

重新再来A 快乐黄口狮帖子:114 注册: 2004-03-24 来自:	发表于： 2008-05-06 10:32 \| 只看楼主短消息资料字号：小中大 5楼回复: 电脑里的瑞星不能运行!!!!附扫描日志 ================================== 驱动程序 [Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Stopped/Manual Start] <system32\drivers\ac97intc.sys><Intel Corporation> [Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start] <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.> [AMD K8 Processor Driver / AmdK8][Stopped/Manual Start] <System32\DRIVERS\amdk8.sys><Advanced Micro Devices> [cqit / cqit][Stopped/] <2 - 系统找不到指定的文件。 ><N/A> [VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Stopped/Manual Start] <system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.> [HookCont / HookCont][Running/System Start] <\SystemRoot\system32\drivers\HookCont.sys><Beijing Rising Technology Co., Ltd> [HookNtos / HookNtos][Running/System Start] <\SystemRoot\system32\drivers\HookNtos.sys><Beijing Rising Technology Co., Ltd> [HookReg / HookReg][Running/System Start] <\SystemRoot\system32\drivers\HookReg.sys><Beijing Rising Technology Co., Ltd> [HookSys / HookSys][Running/System Start] <\SystemRoot\system32\drivers\HookSys.sys><Beijing Rising Technology Co., Ltd> [ialm / ialm][Running/Manual Start] <system32\DRIVERS\ialmnt5.sys><Intel Corporation> [mhfp / mhfp][Stopped/] <2 - 系统找不到指定的文件。 ><N/A> [mnsf / mnsf][Stopped/] <2 - 系统找不到指定的文件。 ><N/A> [msfpfis64 / msfpfis64][Running/System Start] <2 - 系统找不到指定的文件。 ><N/A> [Netgroup Packet Filter / NPF][Running/Manual Start] <system32\drivers\npf.sys><CACE Technologies> [npkcrypt / npkcrypt][Running/Auto Start] <\??\D:\qq\npkcrypt.sys><INCA Internet Co., Ltd.> [nv / nv][Stopped/Manual Start] <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation> [Direct Parallel Link Driver / Ptilink][Running/Manual Start] <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.> [QKeyServiceDisplay / QKeyService][Running/Boot Start] <\SystemRoot\system32\KeyCrypt.sys><Tencent Technology (Shenzhen) Company Limited> [RsAntiSpyware / RsAntiSpyware][Running/Boot Start] <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising> [RsNTGDI / RsNTGDI][Running/Boot Start] <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.> [Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start] <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation> [Secdrv / Secdrv][Stopped/Manual Start] <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.> [msp2p32 / msp2p32][Running/Manual Start] <2 - 系统找不到指定的文件。 ><N/A> ================================== 浏览器加载项 [Thunder Browser Helper] {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD> [豪杰超级解霸V8] {367E0A21-8601-4986-9C9A-153BF5ACA118} <C:\Herosoft\HeroV8\STHSDVD.EXE, N/A> [信息检索(&R)] {92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation> [PPLive] {95B3F550-91C4-4627-BCC4-521288C52977} <D:\lenovo\PPLive\PPLive.exe, N/A> [QQ] {c95fe080-8f5d-11d2-a20b-00aa003c157b} <D:\qq\QQ.EXE, TENCENT> [Windows Genuine Advantage Validation Tool] {17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft Corporation> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.> [Windows Media Player] {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation> [DHTML Edit Control Safe for Scripting for IE5] {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation> [IETag Factory] {38481807-CA0E-42D2-BF39-B33AF135CC4D} <C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\IETAG.DLL, Microsoft Corporation> [HHCtrl Object] {52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation> [Shell Name Space] {55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A> [Windows Media Player] {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [360SafeLive] {87515F61-A66C-4319-A0E0-D416CB8059E3} <D:\Program Files\360safe\live.dll, 360.cn> [Microsoft Web 浏览器] {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation> [Thunder Browser Helper] {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD> [Microsoft Scriptlet Component] {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation> [GlobalLink Chat Control] {AE93C5DF-A990-11D1-AEBD-5254ABDD2B69} <d:\PROGRA~1\GLOBAL~1\Game\Share\GLChat.ocx, GlobalLink> [SearchAssistantOC] {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A> [RDS.DataSpace] {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation> [RealPlayer G2 Control] {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.> [上传到QQ网络硬盘] <D:\qq\AddToNetDisk.htm, N/A> [使用迅雷下载] <C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A> [使用迅雷下载全部链接] <C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A> [导出到 Microsoft Office Excel(&X)] <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A> [添加到QQ自定义面板] <D:\qq\AddPanel.htm, N/A> [添加到QQ表情] <D:\qq\AddEmotion.htm, N/A> [用QQ彩信发送该图片] <D:\qq\SendMMS.htm, N/A> [豪杰超级解霸V8实时播放] <C:\Herosoft\HeroV8\MPURLGET.HTM, N/A> ================================== 正在运行的进程 [PID: 464 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 520 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\msoscqit00.dll] [N/A, ] [C:\WINDOWS\system32\msosmnsf00.dll] [N/A, ] [C:\WINDOWS\system32\msosping00.dll] [N/A, ] [C:\WINDOWS\system32\msosptfs00.dll] [N/A, ] [C:\WINDOWS\system32\msosfmsq00.dll] [N/A, ] [C:\WINDOWS\system32\msosdrop00.dll] [N/A, ] [C:\WINDOWS\system32\msosjtio00.dll] [N/A, ] [PID: 544 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\msoscqit01.dll] [N/A, ] [C:\WINDOWS\system32\msosmnsf01.dll] [N/A, ] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\WINDOWS\system32\msoscqit00.dll] [N/A, ] [C:\WINDOWS\system32\msosmnsf00.dll] [N/A, ] [C:\WINDOWS\system32\msosping00.dll] [N/A, ] [C:\WINDOWS\system32\msosptfs00.dll] [N/A, ] [C:\WINDOWS\system32\msosfmsq00.dll] [N/A, ] [C:\WINDOWS\system32\msosdrop00.dll] [N/A, ] [C:\WINDOWS\system32\msosjtio00.dll] [N/A, ] [PID: 596 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\msoscqit00.dll] [N/A, ] [C:\WINDOWS\system32\msosmnsf00.dll] [N/A, ] [C:\WINDOWS\system32\msosping00.dll] [N/A, ] [C:\WINDOWS\system32\msosptfs00.dll] [N/A, ] [C:\WINDOWS\system32\msosfmsq00.dll] [N/A, ] [C:\WINDOWS\system32\msosdrop00.dll] [N/A, ] [C:\WINDOWS\system32\msosjtio00.dll] [N/A, ] [PID: 608 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\msoscqit00.dll] [N/A, ] [C:\WINDOWS\system32\msosmnsf00.dll] [N/A, ] [C:\WINDOWS\system32\msosping00.dll] [N/A, ] [C:\WINDOWS\system32\msosptfs00.dll] [N/A, ] [C:\WINDOWS\system32\msosfmsq00.dll] [N/A, ] [C:\WINDOWS\system32\msosdrop00.dll] [N/A, ] [C:\WINDOWS\system32\msosjtio00.dll] [N/A, ] [PID: 752 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\msoscqit00.dll] [N/A, ] [C:\WINDOWS\system32\msosmnsf00.dll] [N/A, ] [C:\WINDOWS\system32\msosping00.dll] [N/A, ] [C:\WINDOWS\system32\msosptfs00.dll] [N/A, ] [C:\WINDOWS\system32\msosfmsq00.dll] [N/A, ] [C:\WINDOWS\system32\msosdrop00.dll] [N/A, ] [C:\WINDOWS\system32\msosjtio00.dll] [N/A, ] [PID: 800 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\msoscqit00.dll] [N/A, ] [C:\WINDOWS\system32\msosmnsf00.dll] [N/A, ] [C:\WINDOWS\system32\msosping00.dll] [N/A, ] [C:\WINDOWS\system32\msosptfs00.dll] [N/A, ] [C:\WINDOWS\system32\msosfmsq00.dll] [N/A, ] [C:\WINDOWS\system32\msosdrop00.dll] [N/A, ] [C:\WINDOWS\system32\msosjtio00.dll] [N/A, ] [PID: 896 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\msoscqit00.dll] [N/A, ] [C:\WINDOWS\system32\msosmnsf00.dll] [N/A, ] [C:\WINDOWS\system32\msosping00.dll] [N/A, ] [C:\WINDOWS\system32\msosptfs00.dll] [N/A, ] [C:\WINDOWS\system32\msosfmsq00.dll] [N/A, ] [C:\WINDOWS\system32\msosdrop00.dll] [N/A, ] [C:\WINDOWS\system32\msosjtio00.dll] [N/A, ] [PID: 944 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\msoscqit00.dll] [N/A, ] [C:\WINDOWS\system32\msosmnsf00.dll] [N/A, ] [C:\WINDOWS\system32\msosping00.dll] [N/A, ] [C:\WINDOWS\system32\msosptfs00.dll] [N/A, ] [C:\WINDOWS\system32\msosfmsq00.dll] [N/A, ] [C:\WINDOWS\system32\msosdrop00.dll] [N/A, ] [C:\WINDOWS\system32\msosjtio00.dll] [N/A, ] [PID: 1004 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\msoscqit00.dll] [N/A, ] [C:\WINDOWS\system32\msosmnsf00.dll] [N/A, ] [C:\WINDOWS\system32\msosping00.dll] [N/A, ] [C:\WINDOWS\system32\msosptfs00.dll] [N/A, ] [C:\WINDOWS\system32\msosfmsq00.dll] [N/A, ] [C:\WINDOWS\system32\msosdrop00.dll] [N/A, ] [C:\WINDOWS\system32\msosjtio00.dll] [N/A, ] [PID: 1440 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)] [C:\WINDOWS\system32\msoscqit01.dll] [N/A, ] [C:\WINDOWS\system32\msosmnsf01.dll] [N/A, ] [C:\WINDOWS\system32\msoscqit00.dll] [N/A, ] [C:\WINDOWS\system32\msosmnsf00.dll] [N/A, ] [C:\WINDOWS\system32\msosping00.dll] [N/A, ] [C:\WINDOWS\system32\msosptfs00.dll] [N/A, ] [C:\WINDOWS\system32\msosfmsq00.dll] [N/A, ] [C:\WINDOWS\system32\msosdrop00.dll] [N/A, ] [C:\WINDOWS\system32\msosjtio00.dll] [N/A, ] [PID: 1604 / SYSTEM][D:\PROGRAM FILES\RISING\RAV\RavStub.exe] [Beijing Rising Technology Co., Ltd., 20.0.0.9] [D:\PROGRAM FILES\RISING\RAV\ProcCom.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19] [D:\PROGRAM FILES\RISING\RAV\RsCommX2.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19] [D:\PROGRAM FILES\RISING\RAV\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16] [C:\WINDOWS\system32\msoscqit00.dll] [N/A, ] [C:\WINDOWS\system32\msosmnsf00.dll] [N/A, ] [C:\WINDOWS\system32\msosping00.dll] [N/A, ] [C:\WINDOWS\system32\msosptfs00.dll] [N/A, ] [C:\WINDOWS\system32\msosfmsq00.dll] [N/A, ] [C:\WINDOWS\system32\msosdrop00.dll] [N/A, ] [C:\WINDOWS\system32\msosjtio00.dll] [N/A, ] [PID: 1868 / LOCAL SERVICE][C:\WINDOWS\system32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)] [C:\WINDOWS\system32\msoscqit01.dll] [N/A, ] [C:\WINDOWS\system32\msosmnsf01.dll] [N/A, ] [C:\WINDOWS\system32\msoscqit00.dll] [N/A, ] [C:\WINDOWS\system32\msosmnsf00.dll] [N/A, ] [C:\WINDOWS\system32\msosping00.dll] [N/A, ] [C:\WINDOWS\system32\msosptfs00.dll] [N/A, ] [C:\WINDOWS\system32\msosfmsq00.dll] [N/A, ] [C:\WINDOWS\system32\msosdrop00.dll] [N/A, ] [C:\WINDOWS\system32\msosjtio00.dll] [N/A, ] [PID: 16280 / Administrator][C:\WINDOWS\svchost.exe] [Microsoft Corporation, 6, 0, 2900, 2180] [C:\Herosoft\HeroV8\VCvtShell.dll] [herosoft, 1, 0, 0, 1] [PID: 8900 / Administrator][C:\WINDOWS\system32\Explorer.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 2] [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510] [C:\Program Files\WinRAR\rarext.dll] [N/A, ] [C:\Herosoft\HeroV8\VCvtShell.dll] [herosoft, 1, 0, 0, 1] [C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.17] [D:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16] [PID: 11240 / Administrator][C:\Documents and Settings\Administrator\桌面\sreng980\SREngLdr.EXE] [Smallfrogs Studio, 2.6.8.980] [PID: 11568 / Administrator][C:\Documents and Settings\Administrator\桌面\sreng980\SRE7c456bda.EXE] [Smallfrogs Studio, 2.6.8.980] [C:\Herosoft\HeroV8\VCvtShell.dll] [herosoft, 1, 0, 0, 1] ================================= 文件关联 .TXT Error. [C:\WINDOWS\notepad.exe %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM Error. [hh.exe %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI Error. [notepad.exe %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf N/A ================================== HOSTS 文件 127.0.0.1 localhost 127.0.0.1 yu.8s7.net 127.0.0.1 1.jopanqc.com 127.0.0.1 2.joppnqq.com 127.0.0.1 wg.47255.com 127.0.0.1 1.joppnqq.com 127.0.0.1 xxx.m111.biz 127.0.0.1 1.jopenqc.com 127.0.0.1 1.jopenkk.com 127.0.0.1 xxx.vh7.biz 127.0.0.1 xxx.j41m.com 127.0.0.1 3.joppnqq.com 127.0.0.1 d.93se.com 127.0.0.1 www.868wg.com 127.0.0.1 xxx.mmma.biz 127.0.0.1 ilove.com 127.0.0.1 tp.shpzhan.cn 127.0.0.1 www.tomwg.com 127.0.0.1 www.cike007.cn 127.0.0.1 www.22aaa.com 127.0.0.1 xx.exiao01.com 127.0.0.1 www.exiao01.com 127.0.0.1 www.exiao01.com 127.0.0.1 new.749571.com 127.0.0.1 xtx.kv8.info 127.0.0.1 cao.kv8.info 127.0.0.1 1.jopmmqq.com 127.0.0.1 171817.171817.com 127.0.0.1 d2.llsging.com 127.0.0.1 down.malasc.cn 127.0.0.1 llboss.com 127.0.0.1 nx.51ylb.cn 127.0.0.1 my.531jx.cn 127.0.0.1 qqq.dzydhx.com 127.0.0.1 qqq.hao1658.com 127.0.0.1 www.333292.com 127.0.0.1 down.18dd.net 127.0.0.1 up.22x44.com 127.0.0.1 aaa.faba01.com 127.0.0.1 bad.tqdlt.cn 127.0.0.1 1.chsipo.com 127.0.0.1 c3.aishangai.net 127.0.0.1 c2.aishangai.net 127.0.0.1 xxx.188dm.com 127.0.0.1 x2.1a2b3c1.com 127.0.0.1 d1.163500.net 127.0.0.1 down.google-serv.cn ================================== 进程特权扫描特殊特权被允许： SeLoadDriverPrivilege [PID = 16280, C:\WINDOWS\SVCHOST.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 11240, C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SRENG980\SRENGLDR.EXE] ================================== API HOOK N/A ================================== 隐藏进程 N/A ================================== [/CODE]
重新再来A 快乐黄口狮帖子:114 注册: 2004-03-24 来自:

<<上一主题|下一主题>>

1

1 / 1 页

跳转页

页面顶部

Powered by Discuz!NT