瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 各位大虾,谁知道爱情后门病毒的解决方法????

1   1  /  1  页   跳转

各位大虾,谁知道爱情后门病毒的解决方法????

各位大虾,谁知道爱情后门病毒的解决方法????

哪位朋友知道拜托一定要帮帮我啊!!
最后编辑2006-07-10 22:22:40
分享到:
gototop
 

爱情后门有专杀的,你可以到瑞星主页上下载。
gototop
 

谢谢GG,可是我试了,没有查到毒!!而且下载了瑞星听诊器也没发现有病毒,这是怎么回事呢??
gototop
 

未知家族病毒分析
扫描结果:
无可疑文件


系统活动进程
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\PROGRAM FILES\RISING\RAV\RAVMON.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\RISING\RAV\RAVTASK.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRAM FILES\RACER-HENAN-CNC\RACER.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\RACER-HENAN-CNC\RACERKP.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\RISING\RAV\RAVMOND.EXE
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\RSDETECT.EXE

普通自启动项
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ScanRegistry = C:\WINDOWS\SCANREGW.EXE /AUTORUN
TaskMonitor = ; C:\WINDOWS\TASKMON.EXE
internat.exe = INTERNAT.EXE
SystemTray = SYSTRAY.EXE
LoadPowerProfile = ; RUNDLL32.EXE POWRPROF.DLL,LOADCURRENTPWRSCHEME
RavTask = "C:\PROGRAM FILES\RISING\RAV\RAVTASK.EXE" -SYSTEM
SoundMan = SOUNDMAN.EXE

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
LoadPowerProfile = ; RUNDLL32.EXE POWRPROF.DLL,LOADCURRENTPWRSCHEME
SchedulingAgent = ; C:\WINDOWS\SYSTEM\MSTASK.EXE
RsCcenter = "C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE"
RavMond = "C:\PROGRAM FILES\RISING\RAV\RAVMOND.EXE"
RavMon = "C:\PROGRAM FILES\RISING\RAV\RAVMON.EXE" -SYSTEM


AppInit_DLLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs =


系统文件关联
.exe ==> exefile = "%1" %*
.com ==> comfile = "%1" %*
.bat ==> batfile = "%1" %*
.txt ==> txtfile = NOTEPAD.EXE %1
.scr ==> scrfile = "%1" /S
.reg ==> regfile = regedit.exe "%1"
.doc ==> Wordpad.Document.1 = C:\Progra~1\Access~1\WORDPAD.EXE "%1"

其它启动项
WIN.INI
无信息

SYSTEM.INI
SHELL = Explorer.exe


Winlogon 启动项
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

IE - BHO
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
{77FEF28E-EB96-44FF-B511-3185DEA48697} = C:\PROGRAM FILES\BAIDU\BAR\BAIDUBAR.DLL
{7369D35A-5B70-4A5B-B789-B25FE09B4AF3} = C:\PROGRAM FILES\SUPER RABBIT\MAGICSET\HAOKANBAR.DLL


Winsock SPI
MS.w95.spi.osp = C:\WINDOWS\SYSTEM\MSWSOSP.DLL
MS.w95.spi.tcp = C:\WINDOWS\SYSTEM\QUARTZ32.DLL
MS.w95.spi.udp = C:\WINDOWS\SYSTEM\QUARTZ32.DLL
MS.w95.spi.raw = C:\WINDOWS\SYSTEM\QUARTZ32.DLL
MS.w95.spi.rsvptcp = C:\WINDOWS\SYSTEM\QUARTZ32.DLL
MS.w95.spi.rsvpudp = C:\WINDOWS\SYSTEM\QUARTZ32.DLL

系统服务项
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

文件驱动
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

系统驱动项
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
WDMFS = C:\WINDOWS\SYSTEM32\DRIVERS\WDMFS.SYS
wdmaud = C:\WINDOWS\SYSTEM32\DRIVERS\WDMAUD.SYS
redbook = C:\WINDOWS\SYSTEM32\DRIVERS\REDBOOK.SYS
sbemul = C:\WINDOWS\SYSTEM32\DRIVERS\SBEMUL.SYS

gototop
 

请下载 System Repair Engineer,使用“智能扫描”,按下“扫描”按钮进行扫描,扫描完成后按下“保存报告”按钮保存报告日志文件(SREng.LOG),把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完,分次粘完,请不要修改。
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT