中毒了.......高手进来帮忙下.很别人中的毒好像 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛中毒了.......高手进来帮忙下.很别人中的毒好像

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

1

1 / 1 页

跳转页

中毒了.......高手进来帮忙下.很别人中的毒好像

小乖111 初生襁褓狮帖子:24 注册: 2005-10-03 来自:	发表于： 2007-10-08 22:04 \| 只看楼主短消息资料字号：小中大 1楼中毒了.......高手进来帮忙下.很别人中的毒好像 http://forum.ikaka.com/topic.asp?board=28&artid=8377183和这个朋友情况差不多更新完瑞星最新完小伞就边红了,,然后开启监控中心以后就弹出有病毒,.....提示重启才能杀掉但是重启还是杀不掉一直弹出来重新装系统也是每个盘单击右键都有AUTO 不想格掉全部的盘.... 下了2008杀完又用卡卡把扫描出来的木马全部青掉了不知道还有没有病毒图是重装系统完的进程.......... 请版主或者高手帮忙解决下 [用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) 附件: 文件名:5919412007108215336.jpg 下载次数:129 文件类型:image/pjpeg 文件大小: 上传时间:2007-10-8 22:04:30 描述: 2007-10-08 22:05:15
小乖111 初生襁褓狮帖子:24 注册: 2005-10-03 来自:	分享到：

小乖111 初生襁褓狮帖子:24 注册: 2005-10-03 来自:	发表于： 2007-10-08 22:06 \| 只看楼主短消息资料字号：小中大 2楼 [CODE] 2007-10-08,21:35:57 System Repair Engineer 2.5.16.900 Smallfrogs (http://www.KZTechs.com) Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能以下内容被选中：所有的启动项目（包括注册表、启动文件夹、服务等）浏览器加载项正在运行的进程（包括进程模块信息）文件关联 Winsock 提供者 Autorun.inf HOSTS 文件进程特权扫描启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <load><> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Publisher] <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows Publisher] <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows Publisher] <RfwMain><"D:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.] <AVPSrv><C:\WINDOWS\AVPSrv.exe> [N/A] <GenProtect><C:\WINDOWS\zwdoms.exe> [N/A] <MsPrint32D><C:\WINDOWS\sparlz.exe> [N/A] <RavTask><"D:\Program Files\Rising\Rav\RavTask.exe" -system> [(Verified)Beijing Rising Science and Technology Corporation Limited] <runeip><"d:\Program Files\Rising\AntiSpyware\runiep.exe" /startup> [Beijing Rising Technology Co., Ltd.] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] <KKDelay><D:\Program Files\Rising\AntiSpyware\RunOnce.exe> [Beijing Rising Technology Co., Ltd.] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] <MSDCG32 ><LYLeador.exe> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [(Verified)Microsoft Windows Publisher] <Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><zinforms.dll> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{AEB6717E-7E19-11d0-97EE-00C04FD91974}><winforms.dll> [N/A] <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [(Verified)Beijing Rising Science and Technology Corporation Limited] <{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}><C:\WINDOWS\system32\shlhook.dll> [Beijing Rising Technology Co., Ltd.] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}] <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] <Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A] ================================== 启动文件夹 N/A ================================== 服务 [31937F58 / 31937F58][Stopped/Auto Start] <C:\WINDOWS\system32\E8423D24.EXE -k><Microsoft Corporation> [Human Interface Device Access / HidServ][Stopped/Disabled] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A> [Rising Proxy Service / RfwProxySrv][Stopped/Manual Start] <d:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.> [Rising Personal Firewall Service / RfwService][Running/Auto Start] <d:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.> [Rising Process Communication Center / RsCCenter][Running/Auto Start] <"D:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.> [Rising RealTime Monitor / RsRavMon][Running/Auto Start] <"D:\PROGRAM FILES\RISING\RAV\Ravmond.exe"><Beijing Rising Technology Co., Ltd.> [SoundMAX Agent Service / SoundMAX Agent Service (default)][Running/Auto Start] <C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.> ================================== 驱动程序 [aeaudio / aeaudio][Running/Manual Start] <system32\drivers\aeaudio.sys><Andrea Electronics Corporation> [Rising TDI Base Driver / BaseTDI][Running/Auto Start] <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.> [HookCont / HookCont][Running/System Start] <\SystemRoot\system32\drivers\HookCont.sys><Beijing Rising Technology Co., Ltd> [HookNtos / HookNtos][Running/System Start] <\SystemRoot\system32\drivers\HookNtos.sys><Beijing Rising Technology Co., Ltd> [HookReg / HookReg][Running/System Start] <\SystemRoot\system32\drivers\HookReg.sys><Beijing Rising Technology Co., Ltd> [HookSys / HookSys][Running/System Start] <\SystemRoot\system32\drivers\HookSys.sys><Beijing Rising Technology Co., Ltd> [HookUrl / HookUrl][Running/Auto Start] <\??\D:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.> [mProcRs / mProcRs][Running/Auto Start] <\??\d:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.> [nv / nv][Running/Manual Start] <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation> [Direct Parallel Link Driver / Ptilink][Running/Manual Start] <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.> [RsAntiSpyware / RsAntiSpyware][Running/Boot Start] <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising Technology Co., Ltd.> [RsFwDrv / RsFwDrv][Running/Auto Start] <\??\D:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.> [RsNTGDI / RsNTGDI][Running/Boot Start] <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.> [Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start] <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation> [Secdrv / Secdrv][Stopped/Manual Start] <system32\DRIVERS\secdrv.sys><N/A> [smwdm / smwdm][Running/Manual Start] <system32\drivers\smwdm.sys><Analog Devices, Inc.> ================================== 浏览器加载项 [Thunder Browser Helper] {889D2FEB-5411-4565-8998-1DD2C5261283} <D:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_007.dll, Thunder Networking Technologies,LTD> [Messenger] {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation> [访问瑞星网站] {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E444} <http://www.rising.com.cn/?u=RSTB, N/A> [访问卡卡社区] {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E445} <http://www.ikaka.com/?u=RSTB, N/A> [卡卡上网安全助手] {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.> [HtmlDlgHelper Class] {3050F4E1-98B5-11CF-BB82-00AA00BDCE0B} <C:\WINDOWS\system32\mshtmled.dll, Microsoft Corporation> [Windows Media Player] {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [Microsoft Web 浏览器] {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation> [Thunder Browser Helper] {889D2FEB-5411-4565-8998-1DD2C5261283} <D:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_007.dll, Thunder Networking Technologies,LTD> [SearchAssistantOC] {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.> [卡卡上网安全助手] {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.> [&使用迅雷下载] <D:\Program Files\Thunder Network\Thunder\Program\geturl.htm, N/A> [&使用迅雷下载全部链接] <D:\Program Files\Thunder Network\Thunder\Program\getallurl.htm, N/A>
小乖111 初生襁褓狮帖子:24 注册: 2005-10-03 来自:

小乖111 初生襁褓狮帖子:24 注册: 2005-10-03 来自:	发表于： 2007-10-08 22:10 \| 只看楼主短消息资料字号：小中大 3楼正在运行的进程 [PID: 428 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 500 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 524 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\zinforms.dll] [N/A, ] [C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 568 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\zinforms.dll] [N/A, ] [C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3] [PID: 580 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\zinforms.dll] [N/A, ] [C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3] [PID: 732 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\zinforms.dll] [N/A, ] [C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3] [PID: 788 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\zinforms.dll] [N/A, ] [C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3] [PID: 872 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\System32\zinforms.dll] [N/A, ] [C:\WINDOWS\System32\SYNCOR11.DLL] [SoundMAX, 1.2.3] [PID: 924 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\zinforms.dll] [N/A, ] [C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3] [PID: 1032 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\zinforms.dll] [N/A, ] [C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3] [PID: 1208 / 我爱昵][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\zinforms.dll] [N/A, ] [C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3] [C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.16] [C:\WINDOWS\system32\shlhook.dll] [Beijing Rising Technology Co., Ltd., 4.0.0.9] [D:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [D:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16] [PID: 1284 / SYSTEM][d:\program files\rising\rfw\rfwsrv.exe] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 35] [C:\WINDOWS\system32\zinforms.dll] [N/A, ] [d:\program files\rising\rfw\RfwRule.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 3] [d:\program files\rising\rfw\rfwlog.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 2] [d:\program files\rising\rfw\Rfwdrv.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 10] [d:\program files\rising\rfw\psapi.dll] [Microsoft Corporation, 4.00] [d:\program files\rising\rfw\MonDrv.dll] [rs, 1, 0, 0, 4] [d:\program files\rising\rfw\ProcLib.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 5] [d:\program files\rising\rfw\mPorts.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3] [PID: 1540 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\zinforms.dll] [N/A, ] [C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3] [PID: 1700 / 我爱昵][d:\program files\rising\rfw\RfwMain.exe] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 72] [d:\program files\rising\rfw\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33] [C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3] [d:\program files\rising\rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5] [d:\program files\rising\rfw\RfwCtrl.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11] [d:\program files\rising\rfw\RsXML.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2] [d:\program files\rising\rfw\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5] [D:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12] [C:\WINDOWS\system32\zinforms.dll] [N/A, ] [PID: 1852 / 我爱昵][D:\Program Files\Rising\AntiSpyware\runiep.exe] [Beijing Rising Technology Co., Ltd., 4.0.0.18] [D:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12] [C:\WINDOWS\system32\zinforms.dll] [N/A, ] [PID: 1860 / 我爱昵][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\zinforms.dll] [N/A, ] [C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3] [D:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12] [PID: 1260 / SYSTEM][C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe] [Analog Devices, Inc., 3, 2, 6, 0] [C:\WINDOWS\system32\zinforms.dll] [N/A, ] [PID: 1836 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\System32\SYNCOR11.DLL] [SoundMAX, 1.2.3] [PID: 2876 / 我爱昵][D:\Program Files\Tencent\QQ\TIMPlatform.exe] [TENCENT, 7,0,365,1701] [D:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12] [C:\WINDOWS\system32\zinforms.dll] [N/A, ] [D:\Program Files\Tencent\QQ\TIMProxy.dll] [tencent, 0, 3, 2, 4] [PID: 2484 / SYSTEM][D:\Program Files\Rising\Rav\CCenter.exe] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 26] [C:\WINDOWS\system32\zinforms.dll] [N/A, ] [PID: 1708 / 我爱昵][D:\Program Files\Rising\Rav\RAVTASK.EXE] [Beijing Rising Technology Co., Ltd., 20.0.0.19] [C:\WINDOWS\system32\zinforms.dll] [N/A, ] [D:\Program Files\Rising\Rav\ProcCom.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19] [D:\Program Files\Rising\Rav\RsCommX2.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 18] [D:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16] [D:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 20.0.0.0] [D:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.5] [D:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12] [PID: 2796 / SYSTEM][D:\PROGRAM FILES\RISING\RAV\Ravmond.exe] [Beijing Rising Technology Co., Ltd., 20.0.0.55] [D:\PROGRAM FILES\RISING\RAV\BWList.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.4] [C:\WINDOWS\system32\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [D:\PROGRAM FILES\RISING\RAV\RSAPPMGR.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.0] [D:\PROGRAM FILES\RISING\RAV\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.5] [D:\PROGRAM FILES\RISING\RAV\RsLog.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.27] [D:\PROGRAM FILES\RISING\RAV\ProcCom.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19] [D:\PROGRAM FILES\RISING\RAV\RsCommX2.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 18] [D:\PROGRAM FILES\RISING\RAV\MonRule.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.24] [D:\PROGRAM FILES\RISING\RAV\Hooksys.dll] [Beijing Rising Technology Co., Ltd, 22, 0, 0, 7] [D:\PROGRAM FILES\RISING\RAV\HookReg.dll] [Beijing Rising Technology Co., Ltd, 22, 0, 0, 2] [D:\PROGRAM FILES\RISING\RAV\HookNtos.dll] [Beijing Rising Technology Co., Ltd, 22, 0, 0, 2] [D:\PROGRAM FILES\RISING\RAV\rswalmon.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 17] [D:\Program Files\Rising\Rav\RsStore.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.8] [D:\PROGRAM FILES\RISING\RAV\HookCont.dll] [Beijing Rising Technology Co., Ltd, 22, 0, 0, 1] [D:\Program Files\Rising\Rav\fakescan.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.13] [D:\Program Files\Rising\Rav\Scanner.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.32] [D:\Program Files\Rising\Rav\recomp.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16] [D:\Program Files\Rising\Rav\refs.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 7] [D:\Program Files\Rising\Rav\viruslib.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 14] [D:\Program Files\Rising\Rav\relibldr.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 11] [D:\PROGRAM FILES\RISING\RAV\HookWeb.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.2] [D:\Program Files\Rising\Rav\ffr.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 8] [D:\Program Files\Rising\Rav\nvfile.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 3] [D:\Program Files\Rising\Rav\scanexec.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 10] [D:\Program Files\Rising\Rav\unexe.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 4] [D:\Program Files\Rising\Rav\scanex.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 11] [D:\Program Files\Rising\Rav\pearc.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 4] [D:\Program Files\Rising\Rav\scanpack.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 2] [D:\Program Files\Rising\Rav\revm.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 6] [D:\Program Files\Rising\Rav\uroutine.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 18] [D:\Program Files\Rising\Rav\scansct.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 4] [D:\Program Files\Rising\Rav\scriptci.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 2] [D:\Program Files\Rising\Rav\extmail.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 7]
小乖111 初生襁褓狮帖子:24 注册: 2005-10-03 来自:

小乖111 初生襁褓狮帖子:24 注册: 2005-10-03 来自:	发表于： 2007-10-08 22:11 \| 只看楼主短消息资料字号：小中大 4楼 [PID: 3484 / 我爱昵][D:\Program Files\Rising\Rav\RAVMON.EXE] [Beijing Rising Technology Co., Ltd., 20.0.0.98] [C:\WINDOWS\system32\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [D:\Program Files\Rising\Rav\ProcCom.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19] [D:\Program Files\Rising\Rav\RsCommX2.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 18] [D:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16] [D:\Program Files\Rising\Rav\recomp.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16] [D:\Program Files\Rising\Rav\refs.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 7] [D:\Program Files\Rising\Rav\viruslib.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 14] [D:\Program Files\Rising\Rav\relibldr.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 11] [D:\Program Files\Rising\Rav\RSAPPMGR.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.0] [D:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.5] [D:\Program Files\Rising\Rav\MonRule.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.24] [D:\Program Files\Rising\Rav\PngDll.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 3] [D:\Program Files\Rising\Rav\Rsguilib.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 79] [D:\Program Files\Rising\Rav\RsXML.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 0] [D:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12] [C:\WINDOWS\system32\zinforms.dll] [N/A, ] [PID: 3308 / SYSTEM][D:\PROGRAM FILES\RISING\RAV\RavStub.exe] [Beijing Rising Technology Co., Ltd., 20.0.0.9] [C:\WINDOWS\system32\zinforms.dll] [N/A, ] [D:\PROGRAM FILES\RISING\RAV\ProcCom.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19] [D:\PROGRAM FILES\RISING\RAV\RsCommX2.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 18] [D:\PROGRAM FILES\RISING\RAV\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16] [PID: 2604 / 我爱昵][D:\Program Files\Tencent\QQ\QZone\Qzone.exe] [腾讯公司, 1, 9, 103, 20] [D:\Program Files\Tencent\QQ\QZone\MFC42.DLL] [Microsoft Corporation, 6.00.8665.0] [C:\WINDOWS\system32\zinforms.dll] [N/A, ] [C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3] [D:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12] [PID: 3756 / 我爱昵][D:\Program Files\娱乐\QQ2\QQ\QQ.exe] [TENCENT, 7,0,365,1701] [D:\Program Files\娱乐\QQ2\QQ\QQBaseClassInDll.dll] [TENCENT, 7,0,365,1701] [D:\Program Files\娱乐\QQ2\QQ\QQHelperDll.dll] [TENCENT, 7,0,365,1701] [D:\Program Files\娱乐\QQ2\QQ\BasicCtrlDll.dll] [TENCENT, 7,0,365,1701] [D:\Program Files\娱乐\QQ2\QQ\MFC42.DLL] [Microsoft Corporation, 6.00.8665.0] [C:\WINDOWS\system32\zinforms.dll] [N/A, ] [C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3] [D:\Program Files\娱乐\QQ2\QQ\RICHED32.DLL] [Microsoft Corporation, 5.00.2134.1] [D:\Program Files\娱乐\QQ2\QQ\RICHED20.dll] [Microsoft Corporation, 5.31.23.1218] [D:\Program Files\娱乐\QQ2\QQ\QQAPI.dll] [TENCENT, 7,0,365,1701] [D:\Program Files\Tencent\QQ\TIMProxy.dll] [tencent, 0, 3, 2, 4] [D:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12] [D:\Program Files\娱乐\QQ2\QQ\LoginCtrl.dll] [TENCENT, 7,0,365,1701] [D:\Program Files\娱乐\QQ2\QQ\LoginCtrlRes.dll] [TENCENT, 7,0,365,1701] [D:\Program Files\娱乐\QQ2\QQ\QQRes.dll] [TENCENT, 7,0,365,1701] [D:\Program Files\娱乐\QQ2\QQ\QQMainFrame.dll] [N/A, ] [D:\Program Files\娱乐\QQ2\QQ\gdiplus.dll] [Microsoft Corporation, 5.1.3102.2180 (xpsp_sp2_rtm.040803-2158)] [D:\Program Files\娱乐\QQ2\QQ\CQQApplication.dll] [N/A, ] [D:\Program Files\娱乐\QQ2\QQ\FlashAvatarDll.dll] [, 1, 4, 0, 1] [D:\Program Files\娱乐\QQ2\QQ\NewSkin.dll] [TENCENT, 7,0,365,1701] [D:\Program Files\娱乐\QQ2\QQ\HostingMgr.dll] [TENCENT, 7,0,365,1701] [D:\Program Files\娱乐\QQ2\QQ\CameraDll.dll] [TENCENT, 7,0,365,1701] [D:\Program Files\娱乐\QQ2\QQ\MailSummary.dll] [TENCENT, 7,0,365,1701] [D:\Program Files\娱乐\QQ2\QQ\QQKnowledgeSearch.dll] [TENCENT, 7,0,365,1701] [D:\Program Files\娱乐\QQ2\QQ\QQAllInOne.dll] [TENCENT, 7,0,365,1701] [D:\Program Files\娱乐\QQ2\QQ\SCCore.dll] [TENCENT, 1, 6, 0, 2] [D:\Program Files\娱乐\QQ2\QQ\QQSpace.dll] [TENCENT, 7,0,365,1701] [D:\Program Files\娱乐\QQ2\QQ\vbscript.dll] [Microsoft Corporation, 5.6.0.7426] [C:\WINDOWS\system32\msdmo.dll] [, ] [D:\Program Files\娱乐\QQ2\QQ\QQGroupMng.dll] [TENCENT, 7,0,365,1701] [D:\Program Files\娱乐\QQ2\QQ\QQSysMsgMng.dll] [N/A, ] [D:\Program Files\娱乐\QQ2\QQ\UserDefinedHead.dll] [TENCENT, 7,0,365,1701] [D:\Program Files\娱乐\QQ2\QQ\QQPlugin.dll] [N/A, ] [D:\Program Files\娱乐\QQ2\QQ\QQAvatar.dll] [N/A, ] [D:\Program Files\娱乐\QQ2\QQ\QQConfigPlugin.dll] [TENCENT, 7,0,365,1701] [D:\Program Files\娱乐\QQ2\QQ\QQCustomFace.dll] [N/A, ] [D:\Program Files\娱乐\QQ2\QQ\QRingMng.dll] [N/A, ] [D:\Program Files\娱乐\QQ2\QQ\LongConnection.dll] [TENCENT, 7,0,365,1701] [D:\Program Files\娱乐\QQ2\QQ\GroupConnection.dll] [TENCENT, 7,0,365,1701] [D:\Program Files\娱乐\QQ2\QQ\QQFileTransfer.dll] [TENCENT, 7,0,365,1701] [D:\Program Files\娱乐\QQ2\QQ\PhoneAPI.dll] [TENCENT, 7,0,365,1701] [D:\Program Files\娱乐\QQ2\QQ\DialerAllinOne.dll] [tencent, 1, 4, 0, 0] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [D:\Program Files\娱乐\QQ2\QQ\QQPet.dll] [TENCENT, 7,0,365,1701] [D:\Program Files\娱乐\QQ2\QQ\BQQApplication.dll] [N/A, ] [D:\Program Files\娱乐\QQ2\QQ\CommercesMng.dll] [TENCENT, 7,0,365,1701] [D:\Program Files\娱乐\QQ2\QQ\PersonalDesktop.dll] [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2] [D:\Program Files\娱乐\QQ2\QQ\QQAddr.dll] [深圳市腾讯计算机系统有限公司, 5, 0, 101, 320] [D:\Program Files\娱乐\QQ2\QQ\ImageOle.dll] [TENCENT, 7,0,365,1701] [D:\Program Files\娱乐\QQ2\QQ\QQLiveQMng.dll] [TENCENT, 7,0,365,1701] [D:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 3] [D:\Program Files\娱乐\QQ2\QQ\QQSceneMng.dll] [N/A, ] [D:\Program Files\娱乐\QQ2\QQ\AddrSearch.dll] [腾讯科技（深圳）有限公司, 2, 1, 9, 95] [PID: 4012 / 我爱昵][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\zinforms.dll] [N/A, ] [D:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12] [C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [D:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 3] [C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,18,60] [PID: 3408 / 我爱昵][C:\Program Files\WinRAR\WinRAR.exe] [N/A, ] [C:\WINDOWS\system32\zinforms.dll] [N/A, ] [D:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12] [PID: 1816 / 我爱昵][C:\DOCUME~1\我爱昵\LOCALS~1\Temp\Rar$EX00.000\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900] [C:\WINDOWS\system32\zinforms.dll] [N/A, ] [C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3] [D:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12] [C:\DOCUME~1\我爱昵\LOCALS~1\Temp\Rar$EX00.000\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15] [PID: 2116 / 我爱昵][d:\program files\rising\rfw\RfwCfg.exe] [Beijing Rising Technology Co., Ltd., 5, 0, 1, 55] [d:\program files\rising\rfw\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33] [C:\WINDOWS\system32\zinforms.dll] [N/A, ] [d:\program files\rising\rfw\RSAPPMGR.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2] [d:\program files\rising\rfw\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13] [d:\program files\rising\rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5] [d:\program files\rising\rfw\RfwCtrl.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11] [d:\program files\rising\rfw\ProxyCtr.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 2] [d:\program files\rising\rfw\RsXML.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2] [d:\program files\rising\rfw\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5] [D:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12] [d:\program files\rising\rfw\PSAPI.DLL] [Microsoft Corporation, 4.00] [d:\program files\rising\rfw\mPorts.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3] ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf N/A ================================== HOSTS 文件 127.0.0.1 localhost ================================== 进程特权扫描特殊特权被允许： SeLoadDriverPrivilege [PID = 1852, D:\PROGRAM FILES\RISING\ANTISPYWARE\RUNIEP.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 3408, C:\PROGRAM FILES\WINRAR\WINRAR.EXE] 特殊特权被允许： SeDebugPrivilege [PID = 2116, D:\PROGRAM FILES\RISING\RFW\RFWCFG.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 2116, D:\PROGRAM FILES\RISING\RFW\RFWCFG.EXE] ================================== API HOOK N/A ================================== 隐藏进程 N/A ================================== [/CODE]
小乖111 初生襁褓狮帖子:24 注册: 2005-10-03 来自:

baohe 大版主帖子:72578 注册: 2003-04-10 来自:	发表于： 2007-10-08 22:16 \| 短消息资料字号：小中大 5楼【回复“小乖111”的帖子】 1、用XDELBOX删除下列文件： C:\WINDOWS\system32\zinforms.dll C:\WINDOWS\AVPSrv.exe C:\WINDOWS\zwdoms.exe C:\WINDOWS\sparlz.exe C:\WINDOWS\system32\LYLeador.exe C:\WINDOWS\system32\zinforms.dll C:\WINDOWS\system32\E8423D24.EXE 2、重启后，用SRENG删除下列注册表内容： [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <AVPSrv><C:\WINDOWS\AVPSrv.exe> [N/A] <GenProtect><C:\WINDOWS\zwdoms.exe> [N/A] <MsPrint32D><C:\WINDOWS\sparlz.exe> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] <MSDCG32 ><LYLeador.exe> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><zinforms.dll> [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{AEB6717E-7E19-11d0-97EE-00C04FD91974}><winforms.dll> [N/A] 服务 [31937F58 / 31937F58][Stopped/Auto Start] <C:\WINDOWS\system32\E8423D24.EXE -k><Microsoft Corporation>
baohe 大版主帖子:72578 注册: 2003-04-10 来自:

<<上一主题|下一主题>>

1

1 / 1 页

跳转页

页面顶部

Powered by Discuz!NT