瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 backdoor.rwx.2005.hy 发了日志了,在线等

1234   1  /  4  页   跳转

backdoor.rwx.2005.hy 发了日志了,在线等

backdoor.rwx.2005.hy 发了日志了,在线等

因为U盘带了病毒,虽然用瑞星杀了毒,但根目录下始终有一个隐藏文件夹除不了,名字是"runauto..",怎么办呢?
安全模式上杀过的,杀了病毒,但那个文件夹仍然除不了.
最后编辑2007-08-31 21:27:01
分享到:
gototop
 


下载 System Repair Engineer,
http://www.kztechs.com/sreng/download.html
1 解压缩sreng2.zip
2 运行SREng.exe
3 智能扫描=》扫描=》保存报告
4 把日志中的报告完整拷贝贴上来,不要修改
日志一次发不完,请分次发上来
gototop
 

瑞星卡卡电脑诊断日志 v1.20 (2007-6-29 22:27:1)  北京瑞星科技股份有限公司

注释:[A]表示该文件存在自启动关联;
[M]表示该文件在内存中;

+ 注册表自运行项目
  + Win32 Services
    + HKLM\System\CurrentControlSet\Services
      Adobe LM Service
        [A ] 1. c:\program files\common files\adobe systems shared\service\adobelmsvc.exe
      NVSvc
        [AM] 2. c:\windows\system32\nvsvc32.exe
      ose
        [A ] 3. c:\program files\common files\microsoft shared\source engine\ose.exe
      RfwProxySrv
        [A ] 4. c:\program files\rising\rfw\rfwproxy.exe
      RfwService
        [A ] 5. c:\program files\rising\rfw\rfwsrv.exe
      RsCCenter
        [A ] 6. c:\program files\rising\rav\ccenter.exe
      RsRavMon
        [A ] 7. c:\program files\rising\rav\ravmond.exe
      UMWdf
        [AM] 8. c:\windows\system32\wdfmgr.exe
  + Kernel Drivers
    + HKLM\System\CurrentControlSet\Services
      BaseTDI
        [A ] 9. c:\windows\system32\drivers\basetdi.sys
      cda1000
        [A ] 10. c:\windows\system32\drivers\cda1000.sys
      ExpScaner
        [A ] 11. c:\program files\rising\rav\expscan.sys
      HDAudBus
        [A ] 12. c:\windows\system32\drivers\hdaudbus.sys
      HookCont
        [A ] 13. c:\program files\rising\rav\hookcont.sys
      HookReg
        [A ] 14. c:\program files\rising\rav\hookreg.sys
      HookSys
        [A ] 15. c:\program files\rising\rav\hooksys.sys
      HookUrl
        [A ] 16. c:\program files\rising\rfw\hookurl.sys
      IntcAzAudAddService
        [A ] 17. c:\windows\system32\drivers\rtkhdaud.sys
      iteraid
        [A ] 18. c:\windows\system32\drivers\iteraid.sys
      MEMSCAN
        [A ] 19. c:\program files\rising\rav\memscan.sys
      mProcRs
        [A ] 20. c:\program files\rising\rfw\mprocrs.sys
      npkcrypt
        [A ] 21. c:\program files\tencent\qq\npkcrypt.sys
      RsAntiSpyware
        [A ] 22. c:\windows\system32\drivers\rsboot.sys
      RsFwDrv
        [A ] 23. c:\program files\rising\rfw\rsfwdrv.sys
      RsNTGDI
        [A ] 24. c:\windows\system32\drivers\rsntgdi.sys
      RSPPSYS
        [A ] 25. c:\program files\rising\rav\rsppsys.sys
      RTL8023xp
        [A ] 26. c:\windows\system32\drivers\rtnicxp.sys
      Secdrv
        [A ] 27. c:\windows\system32\drivers\secdrv.sys
gototop
 

+ Explorer
    + HKLM\SOFTWARE\Classes\PROTOCOLS\Filter
      text/xml
        [A ] 28. c:\program files\common files\microsoft shared\office11\msoxmlmf.dll
    + HKLM\SOFTWARE\Classes\PROTOCOLS\Handler
      mso-offdap
        [A ] 29. c:\program files\common files\microsoft shared\web components\10\owc10.dll
      mso-offdap11
        [A ] 30. c:\program files\common files\microsoft shared\web components\11\owc11.dll
    + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
      HyperTerminal Icon Ext
        [A ] 31. c:\windows\system32\hticons.dll
      Portable Media Devices
        [A ] 32. c:\windows\system32\audiodev.dll
      Portable Media Devices Menu
        [A ] 32. c:\windows\system32\audiodev.dll
      NvCpl DesktopContext Class
        [A ] 33. c:\windows\system32\nvcpl.dll
      Play on my TV helper
        [A ] 33. c:\windows\system32\nvcpl.dll
      Desktop Explorer
        [A ] 34. c:\windows\system32\nvshell.dll
      Desktop Explorer Menu
        [A ] 34. c:\windows\system32\nvshell.dll
      nView Desktop Context Menu
        [A ] 34. c:\windows\system32\nvshell.dll
      Microsoft Office HTML Icon Handler
        [AM] 35. c:\program files\microsoft office\office11\msohev.dll
      Web Folders
        [A ] 36. c:\program files\common files\microsoft shared\web folders\msonsext.dll
      WinRAR shell extension
        [AM] 37. c:\program files\winrar\rarext.dll
      RISING
        [AM] 38. c:\windows\system32\ravext.dll
    + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
      {32CD708B-60A7-4C00-9377-D73EAA495F0F}
        [AM] 38. c:\windows\system32\ravext.dll
      {AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}
        [AM] 39. c:\windows\system32\shlhook.dll
  + Logon
    + HKLM\Software\Microsoft\Windows\CurrentVersion\Run
      RTHDCPL
        [AM] 40. c:\windows\rthdcpl.exe
      SkyTel
        [A ] 41. c:\windows\skytel.exe
      Alcmtr
        [A ] 42. c:\windows\alcmtr.exe
      nwiz
        [A ] 43. c:\windows\system32\nwiz.exe
      IMSCMig
        [A ] 44. c:\program files\common files\microsoft shared\ime\imsc40a\imscmig.exe
      RavTask
        [A ] 45. c:\program files\rising\rav\ravtask.exe
      RfwMain
        [AM] 46. c:\program files\rising\rfw\rfwmain.exe
      runeip
        [AM] 47. c:\program files\rising\antispyware\runiep.exe
    + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
      KKDelay
        [A ] 48. c:\program files\rising\antispyware\runonce.exe
gototop
 

+ Boot Execute
    + HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
      BootExecute
        [A ] 49. c:\windows\system32\bsmain.exe
        [A ] 50. c:\windows\system32\kknative.exe
  + Image Hijacks
    + HKCR\.html
      htmlfile\Edit\Command
        [A ] 51. c:\program files\microsoft office\office11\msohtmed.exe
      htmlfile\Print\Command
        [A ] 51. c:\program files\microsoft office\office11\msohtmed.exe
    + HKCR\.htm
      htmlfile\Edit\Command
        [A ] 51. c:\program files\microsoft office\office11\msohtmed.exe
      htmlfile\Print\Command
        [A ] 51. c:\program files\microsoft office\office11\msohtmed.exe
gototop
 

+ 系统活动模块
  + 000000a8(168) wdfmgr.exe
    01000000[0000C000]
      [AM] 8. c:\windows\system32\wdfmgr.exe
  + 000001ac(428) Explorer.EXE
    10000000[0001B000]
      [AM] 38. c:\windows\system32\ravext.dll
    00B90000[0001B000]
      [ M] 52. c:\program files\rising\antispyware\ieprot.dll
    72C80000[00008000]
      [ M] 53. c:\windows\system32\msacm32.drv
    01520000[0002C000]
      [AM] 37. c:\program files\winrar\rarext.dll
    02990000[00022000]
      [ M] 54. c:\program files\thunder network\thunder\comdlls\tdatonce_now.dll
    029C0000[00019000]
      [ M] 55. c:\program files\thunder network\thunder\comdlls\xunleibho_now.dll
    222B0000[00009000]
      [ M] 56. c:\program files\thunder network\thunder\components\resworker\dsbho_00.dll
    22280000[0000C000]
      [ M] 57. c:\program files\thunder network\thunder\components\resworker\dataprocessor_00.dll
    325C0000[00012000]
      [AM] 35. c:\program files\microsoft office\office11\msohev.dll
    23700000[0001A000]
      [ M] 58. c:\program files\rising\rav\rscommon.dll
    022A0000[00019000]
      [ M] 59. c:\program files\rising\rav\ravscrch.dll
    020F0000[00011000]
      [AM] 39. c:\windows\system32\shlhook.dll
  + 00000230(560) RfwMain.exe
    00400000[00073000]
      [AM] 46. c:\program files\rising\rfw\rfwmain.exe
    26600000[0007D000]
      [ M] 60. c:\program files\rising\rfw\rsguilib.dll
    23700000[0001A000]
      [ M] 61. c:\program files\rising\rfw\rscommon.dll
    10000000[0000F000]
      [ M] 62. c:\program files\rising\rfw\rfwctrl.dll
    23800000[0001A000]
      [ M] 63. c:\program files\rising\rfw\rsxml.dll
    23900000[00031000]
      [ M] 64. c:\program files\rising\rfw\pngdll.dll
    01320000[0001B000]
      [ M] 52. c:\program files\rising\antispyware\ieprot.dll
  + 00000260(608) smss.exe
  + 000002a8(680) csrss.exe
  + 000002c0(704) winlogon.exe
    72C80000[00008000]
      [ M] 53. c:\windows\system32\msacm32.drv
  + 000002ec(748) services.exe
  + 000002f8(760) lsass.exe
  + 000003a8(936) svchost.exe
  + 000003ec(1004) svchost.exe
  + 0000045c(1116) svchost.exe
  + 0000049c(1180) svchost.exe
  + 000004f8(1272) RUNDLL32.EXE
    10000000[00016000]
      [ M] 65. c:\windows\system32\nvmctray.dll
    00AE0000[00054000]
      [ M] 66. c:\windows\system32\nvapi.dll
    00B60000[00037000]
      [ M] 67. c:\windows\system32\nvrszhc.dll
    00A60000[0001B000]
gototop
 

[ M] 52. c:\program files\rising\antispyware\ieprot.dll
  + 00000520(1312) svchost.exe
  + 00000554(1364) alg.exe
  + 00000564(1380) RTHDCPL.EXE
    00400000[01024000]
      [AM] 40. c:\windows\rthdcpl.exe
    72C80000[00008000]
      [ M] 53. c:\windows\system32\msacm32.drv
    10000000[0001B000]
      [ M] 52. c:\program files\rising\antispyware\ieprot.dll
  + 00000650(1616) spoolsv.exe
  + 000006c8(1736) RavStub.exe
    00400000[00018000]
      [ M] 68. c:\program files\rising\rav\ravstub.exe
    10000000[0001B000]
      [ M] 69. c:\program files\rising\rav\rscommx.dll
    23700000[0001A000]
      [ M] 58. c:\program files\rising\rav\rscommon.dll
  + 000007a4(1956) ctfmon.exe
    10000000[0001B000]
      [ M] 52. c:\program files\rising\antispyware\ieprot.dll
  + 000007ac(1964) wscntfy.exe
    10000000[0001B000]
      [ M] 52. c:\program files\rising\antispyware\ieprot.dll
  + 000007c8(1992) nvsvc32.exe
    00400000[0002D000]
      [AM] 2. c:\windows\system32\nvsvc32.exe
    009F0000[00054000]
      [ M] 66. c:\windows\system32\nvapi.dll
  + 0000086c(2156) WINWORD.EXE
    30000000[00BAD000]
      [ M] 70. c:\program files\microsoft office\office11\winword.exe
    30C90000[00BB2000]
      [ M] 71. c:\program files\common files\microsoft shared\office11\mso.dll
    39700000[000EB000]
      [ M] 72. c:\program files\common files\microsoft shared\office11\riched20.dll
    10000000[0002D000]
      [ M] 73. c:\program files\rising\rav\rsplugin.dll
    11000000[0003A000]
      [ M] 74. c:\program files\microsoft office\office11\addins\syminput.dll
    73390000[00154000]
      [ M] 75. c:\windows\system32\msvbvm60.dll
    021C0000[0002E000]
      [ M] 76. c:\program files\common files\microsoft shared\proof\2052\msgr3sc.dll
    3B030000[000A9000]
      [ M] 77. c:\windows\system32\imsc40a.ime
    3AD70000[0005D000]
      [ M] 78. c:\program files\common files\microsoft shared\ime\shared2.0\mscand20.dll
    087C0000[0001B000]
      [ M] 52. c:\program files\rising\antispyware\ieprot.dll
    09470000[0007D000]
      [ M] 79. c:\program files\common files\microsoft shared\smart tag\intlname.dll
    09910000[00086000]
      [ M] 80. c:\program files\common files\microsoft shared\smart tag\chdatest.dll
    099A0000[00011000]
      [ M] 81. c:\program files\common files\microsoft shared\smart tag\chinese measurement converter\chmetcnv.dll
    37320000[00021000]
      [ M] 82. c:\program files\common files\microsoft shared\smart tag\fname.dll
    374B0000[00009000]
      [ M] 83. c:\program files\common files\microsoft shared\smart tag\2052\stintl.dll
    36C30000[00009000]
      [ M] 84. c:\program files\microsoft office\office11\msostyle.dll
  + 00000988(2440) ScanBD.exe
    00400000[00065000]
gototop
 

[ M] 85. c:\program files\rising\rav\scanbd.exe
    10000000[0001B000]
      [ M] 69. c:\program files\rising\rav\rscommx.dll
    01DD0000[0001B000]
      [ M] 52. c:\program files\rising\antispyware\ieprot.dll
    01F20000[00019000]
      [ M] 59. c:\program files\rising\rav\ravscrch.dll
    02250000[0001D000]
      [ M] 86. c:\program files\rising\rav\bdengine.dll
    13100000[0002E000]
      [ M] 87. c:\program files\rising\rav\libload.dll
    02290000[00013000]
      [ M] 88. c:\program files\rising\rav\bdex.dll
    022C0000[00014000]
      [ M] 89. c:\program files\rising\rav\bdlib.dll
  + 00000a2c(2604) RsAgent.exe
    00400000[0003A000]
      [ M] 90. c:\program files\rising\rav\rsagent.exe
    10000000[0001B000]
      [ M] 69. c:\program files\rising\rav\rscommx.dll
    00E60000[0001B000]
      [ M] 52. c:\program files\rising\antispyware\ieprot.dll
  + 00000a40(2624) AgentSvr.exe
    10000000[0001B000]
      [ M] 52. c:\program files\rising\antispyware\ieprot.dll
    72C80000[00008000]
      [ M] 53. c:\windows\system32\msacm32.drv
  + 00000d00(3328) runiep.exe
    00400000[00012000]
      [AM] 47. c:\program files\rising\antispyware\runiep.exe
    00C50000[0001B000]
      [ M] 52. c:\program files\rising\antispyware\ieprot.dll
  + 00000ef0(3824) Ras.exe
    00400000[0013D000]
      [ M] 91. c:\program files\rising\antispyware\ras.exe
    10000000[000A0000]
      [ M] 92. c:\program files\rising\antispyware\rasgui.dll
    01710000[0001B000]
      [AM] 38. c:\windows\system32\ravext.dll
    01740000[00011000]
      [AM] 39. c:\windows\system32\shlhook.dll
    017D0000[0001B000]
      [ M] 52. c:\program files\rising\antispyware\ieprot.dll
    02790000[0002F000]
      [ M] 93. c:\program files\rising\antispyware\engine.dll
    02160000[00012000]
      [ M] 94. c:\program files\rising\antispyware\zip.dll
    02B20000[00019000]
      [ M] 59. c:\program files\rising\rav\ravscrch.dll
gototop
 

发送完毕
gototop
 

救救啊,那位大侠帮帮忙啊'
gototop
 
1234   1  /  4  页   跳转
页面顶部
Powered by Discuz!NT