请高手帮忙呀!! - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛请高手帮忙呀!!

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

12

1 / 2 页

跳转页

请高手帮忙呀!!

风之荣耀初生襁褓狮帖子:10 注册: 2006-02-21 来自:	发表于： 2006-02-21 05:23 \| 只看楼主短消息资料字号：小中大 1楼请高手帮忙呀!! 昨天电脑老自动跳出个网站:gz.bloglang.cn 请高手指点下. Logfile of Kaka v2. 0. 0. 8 Scan Module v2. 0. 0. 1 Scan saved at 05:13:39, on 2006-02-21 Platform: Microsoft Windows XP Professional Service Pack 2 (Build 2600) MSIE: Internet Explorer v6.00 SP2; (6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)) Running processes: [SMSS.EXE] CommandLine = [CSRSS.EXE] CommandLine = C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 [WINLOGON.EXE] CommandLine = winlogon.exe [SERVICES.EXE] CommandLine = C:\WINDOWS\system32\services.exe [LSASS.EXE] CommandLine = C:\WINDOWS\system32\lsass.exe [SVCHOST.EXE] CommandLine = C:\WINDOWS\system32\svchost -k DcomLaunch [SVCHOST.EXE] CommandLine = C:\WINDOWS\system32\svchost -k rpcss [SVCHOST.EXE] CommandLine = C:\WINDOWS\System32\svchost.exe -k netsvcs [SVCHOST.EXE] CommandLine = C:\WINDOWS\system32\svchost.exe -k NetworkService [SVCHOST.EXE] CommandLine = C:\WINDOWS\system32\svchost.exe -k LocalService [rfwsrv.exe] CommandLine = f:\瑞星\rising\rfw\rfwsrv.exe [SPOOLSV.EXE] CommandLine = C:\WINDOWS\system32\spoolsv.exe [SVCHOST.EXE] CommandLine = C:\WINDOWS\system32\svchost.exe -k imgsvc [ALG.EXE] CommandLine = C:\WINDOWS\System32\alg.exe [CTFMON.EXE] CommandLine = "C:\WINDOWS\system32\ctfmon.exe" [EXPLORER.EXE] CommandLine = C:\WINDOWS\explorer.exe [RfwMain.exe] CommandLine = -StartUp [KkScan.exe] CommandLine = "F:\kaka\KkScan.exe" R3 - Default URLSearchHook is missing O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [YLive.exe] rem C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe O4 - HKLM\..\Run: [TkBellExe] rem "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - Startup: desktop.ini = O4 - Global Startup: desktop.ini = O10 - Unknown file in Winsock LSP: C:\WINDOWS\system32\cdnns.dll O11 - Options group: [CDNCLIENT] 中文上网 O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome O17 - HKLM\System\CCS\Services\Tcpip\..\{01D7758A-31F2-4C35-B417-C707EDA21468}: NameServer = 192.168.1.1 O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll O18 - Protocol: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: ipp - (no CLSID) - (no file) O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll O18 - Protocol: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll O18 - Protocol: msdaipp - (no CLSID) - (no file) O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll O23 - Service: Human Interface Device Access (HidServ) - - C:\WINDOWS\system32\svchost.exe -k netsvcs O23 - Service: MSWebUrl (MSWebUrl) - - C:\WINDOWS\MSWebUrl.exe O23 - Service: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - f:\瑞星\rising\rfw\rfwproxy.exe O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - f:\瑞星\rising\rfw\rfwsrv.exe O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - "F:\瑞星\Rav\Ravmond.exe" 2006-03-13 08:35:12
风之荣耀初生襁褓狮帖子:10 注册: 2006-02-21 来自:	分享到：

不言放弃社区嘉宾帖子:30678 注册: 2004-09-17 来自:蓝色星球	发表于： 2006-02-21 08:37 \| 短消息资料字号：小中大 2楼禁用 O23 - Service: MSWebUrl (MSWebUrl) - - C:\WINDOWS\MSWebUrl.exe 删除 C:\WINDOWS\MSWebUrl.exe
不言放弃社区嘉宾帖子:30678 注册: 2004-09-17 来自:蓝色星球

风之荣耀初生襁褓狮帖子:10 注册: 2006-02-21 来自:	发表于： 2006-02-21 14:26 \| 只看楼主短消息资料字号：小中大 3楼你说的那个文件删除不了的. 那个禁用到哪里设置呀?
风之荣耀初生襁褓狮帖子:10 注册: 2006-02-21 来自:

ppdog 飘泊而立狮帖子:837 注册: 2005-05-31 来自:	发表于： 2006-02-21 14:45 \| 短消息资料字号：小中大 4楼控制面板－》性能和维护－》管理工具－》服务－》禁用
ppdog 飘泊而立狮帖子:837 注册: 2005-05-31 来自:

风之荣耀初生襁褓狮帖子:10 注册: 2006-02-21 来自:	发表于： 2006-02-22 17:57 \| 只看楼主短消息资料字号：小中大 5楼感谢各位大侠帮忙呀,问题已经解决. 这是我今天扫描的日记,烦劳大侠们再帮看下有没问题. Logfile of Kaka v2. 0. 0. 8 Scan Module v2. 0. 0. 1 Scan saved at 17:56:57, on 2006-02-22 Platform: Microsoft Windows XP Professional Service Pack 2 (Build 2600) MSIE: Internet Explorer v6.00 SP2; (6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)) Running processes: [SMSS.EXE] CommandLine = [CSRSS.EXE] CommandLine = C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 [WINLOGON.EXE] CommandLine = winlogon.exe [SERVICES.EXE] CommandLine = C:\WINDOWS\system32\services.exe [LSASS.EXE] CommandLine = C:\WINDOWS\system32\lsass.exe [SVCHOST.EXE] CommandLine = C:\WINDOWS\system32\svchost -k DcomLaunch [SVCHOST.EXE] CommandLine = C:\WINDOWS\system32\svchost -k rpcss [SVCHOST.EXE] CommandLine = C:\WINDOWS\System32\svchost.exe -k netsvcs [SVCHOST.EXE] CommandLine = C:\WINDOWS\system32\svchost.exe -k NetworkService [SVCHOST.EXE] CommandLine = C:\WINDOWS\system32\svchost.exe -k LocalService [EXPLORER.EXE] CommandLine = C:\WINDOWS\Explorer.EXE [rfwsrv.exe] CommandLine = f:\瑞星\rising\rfw\rfwsrv.exe [SPOOLSV.EXE] CommandLine = C:\WINDOWS\system32\spoolsv.exe [SVCHOST.EXE] CommandLine = C:\WINDOWS\system32\svchost.exe -k imgsvc [SOUNDMAN.EXE] CommandLine = "C:\WINDOWS\SOUNDMAN.EXE" [CTFMON.EXE] CommandLine = "C:\WINDOWS\system32\ctfmon.exe" [ALG.EXE] CommandLine = C:\WINDOWS\System32\alg.exe [rfwmain.exe] CommandLine = -StartUp [QQ.EXE] CommandLine = "C:\Program Files\Tencent\QQ\QQ.exe" [TIMPlatform.exe] CommandLine = "C:\Program Files\Tencent\QQ\TIMPlatform.exe" -Embedding [iexplore.exe] CommandLine = "C:\Program Files\Internet Explorer\iexplore.exe" [KkScan.exe] CommandLine = "F:\kaka\KkScan.exe" O1 - Hosts: 127.0.0.0 pagead2.googlesyndication.com O1 - Hosts: 127.0.0.0 rad.msn.com O1 - Hosts: 127.0.0.0 ads.msn.com O1 - Hosts: 127.0.0.0 class.haott.com O1 - Hosts: 127.0.0.0 class2.haott.com O1 - Hosts: 127.0.0.0 smarttrade.allyes.com O1 - Hosts: 127.0.0.0 a.keyrun.com O1 - Hosts: 127.0.0.0 union.3721.com O1 - Hosts: 127.0.0.0 union.allyes.com O1 - Hosts: 127.0.0.0 bokee.allyes.com O1 - Hosts: 127.0.0.0 union.narrowad.com O1 - Hosts: 127.0.0.0 union02.narrowad.com O1 - Hosts: 127.0.0.0 adsence.sogou.com O1 - Hosts: 127.0.0.0 links.news.sohu.com O1 - Hosts: 127.0.0.0 bar.myrice.com O1 - Hosts: 127.0.0.0 member.skycn.com O1 - Hosts: 127.0.0.0 adfarm.mediaplex.com O1 - Hosts: 127.0.0.0 partner.cpc.sohu.com O1 - Hosts: 127.0.0.0 partner.search.sohu.com O1 - Hosts: 127.0.0.0 pfp.sina.com.cn O1 - Hosts: 127.0.0.0 template.union.163.com O1 - Hosts: 127.0.0.0 cpro.baidu.com O1 - Hosts: 127.0.0.0 redirect.alexa.com O1 - Hosts: 127.0.0.0 union.kingsoft.com O1 - Hosts: 127.0.0.0 union.114.com.cn O1 - Hosts: 127.0.0.0 vip2.cnadmin.com O1 - Hosts: 127.0.0.0 scalink.sohu.com O1 - Hosts: 127.0.0.0 www.sol.sohu.com O1 - Hosts: 127.0.0.0 images.sohu.com O1 - Hosts: 127.0.0.0 adimage.bokee.com O1 - Hosts: 127.0.0.0 adimage.blogchina.com O1 - Hosts: 127.0.0.0 co.jrj.com.cn O1 - Hosts: 127.0.0.0 ad.qianlong.com O1 - Hosts: 127.0.0.0 vd.yesky.com O1 - Hosts: 127.0.0.0 adv.chinabyte.com O1 - Hosts: 127.0.0.0 adtaobao.allyes.com O1 - Hosts: 127.0.0.0 sogou.com O1 - Hosts: 127.0.0.0 mappage.go2map.com O1 - Hosts: 127.0.0.0 adclient.163.com O1 - Hosts: 127.0.0.0 adimg.163.com O1 - Hosts: 127.0.0.0 ad4.sina.com.cn O1 - Hosts: 127.0.0.0 ggmm.csdn.net O1 - Hosts: 127.0.0.0 mms2.qianlong.com O1 - Hosts: 127.0.0.0 ad2.qianlong.com O1 - Hosts: 127.0.0.0 js1.all4ad.net O1 - Hosts: 127.0.0.0 www.mydown.com O1 - Hosts: 127.0.0.0 secure-cn.imrworldwide.com O1 - Hosts: 127.0.0.0 image.7cv.com O1 - Hosts: 127.0.0.0 template.union.163.com O1 - Hosts: 127.0.0.0 image.sms265.com O1 - Hosts: 127.0.0.0 pics.skyhits.com O1 - Hosts: 127.0.0.0 img1.jeboo.com O1 - Hosts: 127.0.0.0 travel.elong.com O1 - Hosts: 127.0.0.0 www.u88.cn O1 - Hosts: 127.0.0.0 service2.xinhuanet.com O1 - Hosts: 127.0.0.0 adv.phoenixtv.com O1 - Hosts: 127.0.0.0 u.lele.com O1 - Hosts: 127.0.0.0 show.poptang.com O1 - Hosts: 127.0.0.0 beta.younote.com O1 - Hosts: 127.0.0.0 adsview.qq.com O1 - Hosts: 127.0.0.0 imguv.21cn.com O1 - Hosts: 127.0.0.0 www.9158.com O1 - Hosts: 127.0.0.0 sh.dowei.com O1 - Hosts: 127.0.0.0 www.admuncher.com O1 - Hosts: 127.0.0.0 gz.blogland.cn O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [YLive.exe] rem C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe O4 - HKLM\..\Run: [TkBellExe] rem "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - Startup: desktop.ini = O4 - Global Startup: desktop.ini = O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm O10 - Unknown file in Winsock LSP: C:\WINDOWS\system32\cdnns.dll O11 - Options group: [CDNCLIENT] 中文上网 O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome O17 - HKLM\System\CCS\Services\Tcpip\..\{01D7758A-31F2-4C35-B417-C707EDA21468}: NameServer = 192.168.1.1 O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll O18 - Protocol: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: ipp - (no CLSID) - (no file) O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll O18 - Protocol: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll O18 - Protocol: msdaipp - (no CLSID) - (no file) O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll O23 - Service: Human Interface Device Access (HidServ) - - C:\WINDOWS\system32\svchost.exe -k netsvcs O23 - Service: MSWebUrl (MSWebUrl) - - C:\WINDOWS\MSWebUrl.exe O23 - Service: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - f:\瑞星\rising\rfw\rfwproxy.exe O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - f:\瑞星\rising\rfw\rfwsrv.exe O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - "F:\瑞星\Rav\Ravmond.exe"
风之荣耀初生襁褓狮帖子:10 注册: 2006-02-21 来自:

魔法学徒卡卡技术团队帖子:11465 注册: 2004-10-03 来自:	发表于： 2006-02-22 21:19 \| 短消息资料字号：小中大 6楼 O23 - Service: MSWebUrl (MSWebUrl) - - C:\WINDOWS\MSWebUrl.exe
魔法学徒卡卡技术团队帖子:11465 注册: 2004-10-03 来自:

风之荣耀初生襁褓狮帖子:10 注册: 2006-02-21 来自:	发表于： 2006-02-23 16:46 \| 只看楼主短消息资料字号：小中大 7楼你说的我已经搞过了呀!!!
风之荣耀初生襁褓狮帖子:10 注册: 2006-02-21 来自:

风之荣耀初生襁褓狮帖子:10 注册: 2006-02-21 来自:	发表于： 2006-03-03 02:28 \| 只看楼主短消息资料字号：小中大 8楼请各位帮忙看下!!! Logfile of Kaka v2. 0. 0. 8 Scan Module v2. 0. 0. 1 Scan saved at 02:26:39, on 2006-03-03 Platform: Microsoft Windows XP Professional Service Pack 2 (Build 2600) MSIE: Internet Explorer v6.00 SP2; (6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)) Running processes: [SMSS.EXE] CommandLine = [CSRSS.EXE] CommandLine = C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 [WINLOGON.EXE] CommandLine = winlogon.exe [SERVICES.EXE] CommandLine = C:\WINDOWS\system32\services.exe [LSASS.EXE] CommandLine = C:\WINDOWS\system32\lsass.exe [SVCHOST.EXE] CommandLine = C:\WINDOWS\system32\svchost -k DcomLaunch [SVCHOST.EXE] CommandLine = C:\WINDOWS\system32\svchost -k rpcss [SVCHOST.EXE] CommandLine = C:\WINDOWS\System32\svchost.exe -k netsvcs [SVCHOST.EXE] CommandLine = C:\WINDOWS\system32\svchost.exe -k NetworkService [SVCHOST.EXE] CommandLine = C:\WINDOWS\system32\svchost.exe -k LocalService [EXPLORER.EXE] CommandLine = C:\WINDOWS\Explorer.EXE [rfwsrv.exe] CommandLine = f:\瑞星\rising\rfw\rfwsrv.exe [SPOOLSV.EXE] CommandLine = C:\WINDOWS\system32\spoolsv.exe [P2PSVR.EXE] CommandLine = "C:\Program Files\P4P\p2psvr.exe" [SVCHOST.EXE] CommandLine = C:\WINDOWS\system32\svchost.exe -k imgsvc [SOUNDMAN.EXE] CommandLine = "C:\WINDOWS\SOUNDMAN.EXE" [realsched.exe] CommandLine = "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot [CDNUP.EXE] CommandLine = "C:\Program Files\CNNIC\Cdn\cdnup.exe" [CTFMON.EXE] CommandLine = "C:\WINDOWS\system32\ctfmon.exe" [RfwMain.exe] CommandLine = -StartUp [ALG.EXE] CommandLine = C:\WINDOWS\System32\alg.exe [TrojanAssistant.exe] CommandLine = "E:\反间谍\ske\TrojanAssistant.exe" [KkScan.exe] CommandLine = "F:\kaka\KkScan.exe" [IEXPLORE.EXE] CommandLine = "C:\Program Files\Internet Explorer\iexplore.exe" O2 - BHO: CPub Object - {0CA51D02-7739-43EA-8D9A-1E8AD4327B03} - C:\Program Files\P4P\sodaie.dll O2 - BHO: CdnForIE Class - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [YLive.exe] rem C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [CdnCtr] C:\Program Files\CNNIC\Cdn\cdnup.exe O4 - HKLM\..\RunOnce: [Setup] Rundll32.exe E:\反间谍\ske\wmpnsh.dll,Rundll32 O4 - Startup: desktop.ini = O4 - Startup: 263 ET.lnk = C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{540F8C95-2C51-4188-A4C7-DFDFBFB0F802}\eph.exe1_540F8C952C514188A4C7DFDFBFB0F802_2.exe O4 - Global Startup: desktop.ini = O10 - Unknown file in Winsock LSP: C:\WINDOWS\system32\cdnns.dll O11 - Options group: [CDNCLIENT] 中文上网 O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome O16 - DPF: {98A62E3F-A8C5-4EF0-8A00-C70CF9D18A89} (LoaderCore Class) - http://tb.sogou.com/DLLoader.cab O16 - DPF: {9A578C98-3C2F-4630-890B-FC04196EF420} (CNNIC_IDN) - http://jump.cnnic.cn/stat/stat?sid=0008&debug=false&pid=c_admin88&url=http://client.jogo.cn/download/cnnic/cdn.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{01D7758A-31F2-4C35-B417-C707EDA21468}: NameServer = 192.168.1.1 O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll O18 - Protocol: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: ipp - (no CLSID) - (no file) O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll O18 - Protocol: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll O18 - Protocol: msdaipp - (no CLSID) - (no file) O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll O20 - AppInit_DLLs: C:\WINDOWS\system32\SoDAHK.DLL O23 - Service: Human Interface Device Access (HidServ) - - C:\WINDOWS\system32\svchost.exe -k netsvcs O23 - Service: P4P Service (P4P Service) - Sohu.com Inc. - C:\Program Files\P4P\p2psvr.exe O23 - Service: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - f:\瑞星\rising\rfw\rfwproxy.exe O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - f:\瑞星\rising\rfw\rfwsrv.exe O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - "F:\瑞星\Rav\Ravmond.exe"
风之荣耀初生襁褓狮帖子:10 注册: 2006-02-21 来自:

读来毒网飘泊而立狮帖子:610 注册: 2004-04-18 来自:	发表于： 2006-03-03 03:15 \| 短消息资料字号：小中大 9楼修复： O2 - BHO: CdnForIE Class - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll ================================ 删除： C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll ==================================== 把C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\desktop.ini 这个文件的属性改为隐藏
读来毒网飘泊而立狮帖子:610 注册: 2004-04-18 来自:

风之荣耀初生襁褓狮帖子:10 注册: 2006-02-21 来自:	发表于： 2006-03-03 23:32 \| 只看楼主短消息资料字号：小中大 10楼哎,真是被烦死了呀,老是搞不定啊!!请高手帮忙,最好详细说明!!! Logfile of Kaka v2. 0. 0. 8 Scan Module v2. 0. 0. 1 Scan saved at 23:30:49, on 2006-03-03 Platform: Microsoft Windows XP Professional Service Pack 2 (Build 2600) MSIE: Internet Explorer v6.00 SP2; (6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)) Running processes: [SMSS.EXE] CommandLine = [CSRSS.EXE] CommandLine = C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 [WINLOGON.EXE] CommandLine = winlogon.exe [SERVICES.EXE] CommandLine = C:\WINDOWS\system32\services.exe [LSASS.EXE] CommandLine = C:\WINDOWS\system32\lsass.exe [SVCHOST.EXE] CommandLine = C:\WINDOWS\system32\svchost -k DcomLaunch [SVCHOST.EXE] CommandLine = C:\WINDOWS\system32\svchost -k rpcss [SVCHOST.EXE] CommandLine = C:\WINDOWS\System32\svchost.exe -k netsvcs [SVCHOST.EXE] CommandLine = C:\WINDOWS\system32\svchost.exe -k NetworkService [SVCHOST.EXE] CommandLine = C:\WINDOWS\system32\svchost.exe -k LocalService [EXPLORER.EXE] CommandLine = C:\WINDOWS\Explorer.EXE [rfwsrv.exe] CommandLine = f:\瑞星\rising\rfw\rfwsrv.exe [SPOOLSV.EXE] CommandLine = C:\WINDOWS\system32\spoolsv.exe [P2PSVR.EXE] CommandLine = "C:\Program Files\P4P\p2psvr.exe" [SVCHOST.EXE] CommandLine = C:\WINDOWS\system32\svchost.exe -k imgsvc [SOUNDMAN.EXE] CommandLine = "C:\WINDOWS\SOUNDMAN.EXE" [realsched.exe] CommandLine = "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot [CTFMON.EXE] CommandLine = "C:\WINDOWS\system32\ctfmon.exe" [RfwMain.exe] CommandLine = -StartUp [ALG.EXE] CommandLine = C:\WINDOWS\System32\alg.exe [IEXPLORE.EXE] CommandLine = "C:\Program Files\Internet Explorer\iexplore.exe" [KkScan.exe] CommandLine = "F:\kaka\KkScan.exe" O2 - BHO: CPub Object - {0CA51D02-7739-43EA-8D9A-1E8AD4327B03} - C:\Program Files\P4P\sodaie.dll O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [YLive.exe] rem C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - Startup: desktop.ini = O4 - Global Startup: desktop.ini = O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm O10 - Unknown file in Winsock LSP: C:\WINDOWS\system32\cdnns.dll O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome O16 - DPF: {98A62E3F-A8C5-4EF0-8A00-C70CF9D18A89} (LoaderCore Class) - http://tb.sogou.com/DLLoader.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{01D7758A-31F2-4C35-B417-C707EDA21468}: NameServer = 192.168.1.1 O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll O18 - Protocol: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: ipp - (no CLSID) - (no file) O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll O18 - Protocol: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll O18 - Protocol: msdaipp - (no CLSID) - (no file) O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll O20 - AppInit_DLLs: C:\WINDOWS\system32\SoDAHK.DLL O23 - Service: Human Interface Device Access (HidServ) - - C:\WINDOWS\system32\svchost.exe -k netsvcs O23 - Service: P4P Service (P4P Service) - Sohu.com Inc. - C:\Program Files\P4P\p2psvr.exe O23 - Service: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - f:\瑞星\rising\rfw\rfwproxy.exe O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - f:\瑞星\rising\rfw\rfwsrv.exe O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - "F:\瑞星\Rav\Ravmond.exe"
风之荣耀初生襁褓狮帖子:10 注册: 2006-02-21 来自:

<<上一主题|下一主题>>

12

1 / 2 页

跳转页

页面顶部

Powered by Discuz!NT