hijackthis的前两项，第一项修复后仍存在，第二项无法修复。 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛 hijackthis的前两项，第一项修复后仍存在，第二项无法修复。

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

12

1 / 2 页

跳转页

hijackthis的前两项，第一项修复后仍存在，第二项无法修复。

海潮探长初生襁褓狮帖子:121 注册: 2005-02-03 来自:	发表于： 2006-08-27 14:32 \| 显示全部短消息资料字号：小中大 1楼 hijackthis的前两项，第一项修复后仍存在，第二项无法修复。 Logfile of HijackThis v1.99.1 Scan saved at 14:35:16, on 2006-8-27 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\ibmpmsvc.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Rising\Rav\CCenter.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Rising\Rav\Ravmond.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Rising\Rav\RavStub.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\QCONSVC.EXE C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\TpKmpSVC.exe C:\WINDOWS\System32\taskmgr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE C:\Program Files\Rising\Rav\RavTask.exe C:\Program Files\Rising\Rav\Ravmon.exe C:\Program Files\Tencent\TT\TTraveler.exe C:\Program Files\Tencent\QQ\TIMPlatfrom.exe C:\Program Files\Rising\Rav\Rav.exe C:\Program Files\Rising\Rav\RsAgent.exe C:\WINDOWS\msagent\AgentSvr.exe C:\Program Files\Internet Explorer\iexplore.exe F:\Downloads\ha_hijackthis_1991\HijackThis.exe F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,C:\WINDOWS\System32\updown11.exe O2 - BHO: (no name) - {16B770A0-0E87-4278-B748-2460D64A8386} - (no file) O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [TPKMAPHELPER] ; C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper O4 - HKLM\..\Run: [EZEJMNAP] ; C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe O4 - HKLM\..\Run: [ibmmessages] ; C:\Program Files\IBM\Messages By IBM\\ibmmessages.exe O4 - HKLM\..\Run: [IBMPRC] ; C:\IBMTOOLS\UTILS\ibmprc.exe O4 - HKLM\..\Run: [IMEKRMIG6.1] ; C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE O4 - HKLM\..\Run: [MSPY2002] ; C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [DataLayer] ; C:\Program Files\Nokia\Nokia PC Suite 5\DataLayer.exe O4 - HKLM\..\Run: [Nokia Tray Application] ; C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] ; "C:\Program Files\D-Tools\daemon.exe" -lang 2052 O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system O4 - HKLM\..\Run: [TkBellExe] ; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [ibmmessages] ; C:\Program Files\IBM\Messages By IBM\ibmmessages.exe O4 - HKCU\..\Run: [Windows Tagmsnger] ; tagmr.exe O4 - HKCU\..\Run: [MSMSGS] ; "C:\Program Files\Messenger\msmsgs.exe" /background O8 - Extra context menu item: 使用影音传送带下载 - C:\Program Files\Xi\NetTransport 2\NTAddLink.html O8 - Extra context menu item: 使用影音传送带下载全部链接 - C:\Program Files\Xi\NetTransport 2\NTAddList.html O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm O11 - Options group: [JAVA_IBM] Java (IBM) O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Basic) - http://service.beisen.com.cn/ScriptX.cab O16 - DPF: {3D8F74EE-8692-4F8F-B8D2-7522E732519E} (WebActivater Control) - http://game.qq.com/QQGame2.cab O16 - DPF: {7260569F-1D40-4E7F-B95B-2E68D35668B9} (MofileUploadX Control) - http://www.mofile.com/activex/UploadFX.CAB O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab O16 - DPF: {A984ED9F-E8DA-44E5-BC18-C14B9ABEF79D} (photo_uploader Control) - http://upload.photo.163.com/photoup.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{762F721C-CA85-41DE-AAF6-B5681E29EBA6}: NameServer = 192.168.1.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{762F721C-CA85-41DE-AAF6-B5681E29EBA6}: NameServer = 192.168.1.1 O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll O18 - Protocol: cdl - {3DD53D40-7B8B-11D0-B013-00AA0059CE02} - C:\WINDOWS\System32\urlmon.dll O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL O18 - Protocol: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\System32\msvidctl.dll O18 - Protocol: file - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\System32\urlmon.dll O18 - Protocol: ftp - {79EAC9E3-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\System32\urlmon.dll O18 - Protocol: gopher - {79EAC9E4-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\System32\urlmon.dll O18 - Protocol: http - {79EAC9E2-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\System32\urlmon.dll O18 - Protocol: https - {79EAC9E5-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\System32\urlmon.dll O18 - Protocol: ipp - (no CLSID) - (no file) O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll O18 - Protocol: local - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\System32\urlmon.dll O18 - Protocol: mailto - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll O18 - Protocol: mhtml - {05300401-BCBC-11D0-85E3-00C04FD85AB4} - C:\WINDOWS\System32\inetcomm.dll O18 - Protocol: mk - {79EAC9E6-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\System32\urlmon.dll O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll O18 - Protocol: msdaipp - (no CLSID) - (no file) O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\System32\mshtml.dll O18 - Protocol: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\System32\msvidctl.dll O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll O18 - Protocol: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINDOWS\System32\msdxm.ocx O18 - Protocol: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\System32\wiascr.dll O20 - Winlogon Notify: QConGina - C:\WINDOWS\SYSTEM32\QConGina.dll O20 - Winlogon Notify: tpfnf2 - C:\WINDOWS\SYSTEM32\notifyf2.dll O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll O21 - SSODL: DVDBurn - {790448C3-4239-45AF-C98B-367991A8B103} - C:\WINDOWS\Downloaded Program Files\AfxEdit.dll (file missing) O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - (no file) O23 - Service: QCONSVC - Lenovo - C:\WINDOWS\System32\QCONSVC.EXE O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe 目前srchasst.inf文件丢失，搜索助手被迫禁用。 IE在编辑——查找功能中，“查找下一项”为灰色。还想请教如何杀死updown11.exe文件 2006-08-27 15:47:10
海潮探长初生襁褓狮帖子:121 注册: 2005-02-03 来自:	分享到：

海潮探长初生襁褓狮帖子:121 注册: 2005-02-03 来自:	发表于： 2006-08-27 14:50 \| 显示全部短消息资料字号：小中大 2楼【回复“我无邪”的帖子】已发送，查收。搜遍全网未找到有关updown11.exe的资讯
海潮探长初生襁褓狮帖子:121 注册: 2005-02-03 来自:

海潮探长初生襁褓狮帖子:121 注册: 2005-02-03 来自:	发表于： 2006-08-27 14:54 \| 显示全部短消息资料字号：小中大 3楼最严重时候，系统还原之前所设的还原点全部被删除，无法上网，无法还原系统到较早时刻（否则就没有这么严重后果了）恶意软件清理大师一开启即被关闭（非法操作）进程管理器内出现cdnup，以及一些数字.exe的进程。选择重新启动关机时，蓝屏，蓝屏内容闪过未能详细查看。用超级兔子IE修复多次修理，修复winsock后重新启动，终于可以上网。但其他问题还在。安全模式下也无法删除updown11.exe
海潮探长初生襁褓狮帖子:121 注册: 2005-02-03 来自:

海潮探长初生襁褓狮帖子:121 注册: 2005-02-03 来自:	发表于： 2006-08-27 14:59 \| 显示全部短消息资料字号：小中大 4楼【回复“我无邪”的帖子】以下是SREng生成的log文件。 2006-08-27,15:03:08 System Repair Engineer 2.0.21.505 (2.0 RC 2) Smallfrogs (http://www.KZTechs.com) Windows XP Home Edition Service Pack 1 (Build 2600) - 管理权限用户 - 完整功能以下内容被选中：所有的启动项目（包括注册表、启动文件夹、服务等）浏览器加载项正在运行的进程（包括进程模块信息）文件关联启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ibmmessages><; C:\Program Files\IBM\Messages By IBM\ibmmessages.exe> [IBM] <MSMSGS><; ; "C:\Program Files\Messenger\msmsgs.exe" /background> [] <IBM RecordNow!><; ; > [] <MsnMsgr><; ; "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background> [] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <load><> [] <run><> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <SynTPEnh><C:\Program Files\Synaptics\SynTP\SynTPEnh.exe> [Synaptics, Inc.] <TPKMAPHELPER><; C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper> [IBM Corp.] <EZEJMNAP><; C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe> [IBM Corp.] <ibmmessages><; C:\Program Files\IBM\Messages By IBM\\ibmmessages.exe> [IBM] <IBMPRC><; C:\IBMTOOLS\UTILS\ibmprc.exe> [IBM Corp.] <IMEKRMIG6.1><; C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE> [Microsoft Corporation] <MSPY2002><; C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC> [] <DataLayer><; C:\Program Files\Nokia\Nokia PC Suite 5\DataLayer.exe> [Nokia Mobile Phone Ltd.] <Nokia Tray Application><; C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe> [Nokia] <DAEMON Tools-1033><; "C:\Program Files\D-Tools\daemon.exe" -lang 2052> [DAEMON'S HOME] <QCWLICON><C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE> [Lenovo] <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.] <TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.] <KernelFaultCheck><%systemroot%\system32\dumprep 0 -k> [] <KnightIII><; ; > [] <TP4EX><; ; tp4ex.exe> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] <9><C:\WINDOWS\System32\Ravdm.exe> [Microsoft Corporation] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [Microsoft Corporation] <Userinit><C:\WINDOWS\System32\userinit.exe,C:\WINDOWS\System32\updown11.exe> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <UIHost><logonui.exe> [Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent] <WinlogonNotify: AtiExtEvent><Ati2evxx.dll> [ATI Technologies Inc.] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\QConGina] <WinlogonNotify: QConGina><QConGina.dll> [Lenovo] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tpfnf2] <WinlogonNotify: tpfnf2><notifyf2.dll> [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tphotkey] <WinlogonNotify: tphotkey><tphklock.dll> [] ================================== 启动文件夹服务 [Ati HotKey Poller / Ati HotKey Poller] <C:\WINDOWS\System32\Ati2evxx.exe><ATI Technologies Inc.> [C-DillaCdaC11BA / C-DillaCdaC11BA] <C:\WINDOWS\System32\drivers\CDAC11BA.EXE><N/A> [windows dll service / dll service] <><N/A> [EvtEng / EvtEng] <C:\Program Files\Intel\Wireless\Bin\EvtEng.exe><Intel Corporation> [IBM Rapid Restore Ultra Service / IBM Rapid Restore Ultra Service] <C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe><> [IBM PM Service / IBMPMSVC] <C:\WINDOWS\System32\ibmpmsvc.exe><N/A> [IBM PSA Access Driver Control / PsaSrv] <><N/A> [QCONSVC / QCONSVC] <System32\QCONSVC.EXE><Lenovo> [RegSrvc / RegSrvc]
海潮探长初生襁褓狮帖子:121 注册: 2005-02-03 来自:

海潮探长初生襁褓狮帖子:121 注册: 2005-02-03 来自:	发表于： 2006-08-27 15:00 \| 显示全部短消息资料字号：小中大 5楼【回复“海潮探长”的帖子】 [C:\Program Files\Rising\Rav\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 24> [C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19> [C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11> [C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [C:\Program Files\Rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [C:\WINDOWS\System32\SynTPFcs.dll] <Synaptics, Inc.><7.5.17.8 19Nov03> [PID: 1816][C:\Program Files\Tencent\TT\TTraveler.exe] <腾讯公司><2, 2, 0, 224> [C:\WINDOWS\System32\SynTPFcs.dll] <Synaptics, Inc.><7.5.17.8 19Nov03> [C:\WINDOWS\System32\AcSignIcon.dll] <Autodesk><16.0.0.86> [C:\Program Files\Tencent\TT\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 4> [C:\Program Files\Tencent\QQ\QQHook.dll] <N/A><N/A> [C:\WINDOWS\System32\Macromed\Flash\Flash8b.ocx] <Macromedia, Inc.><8,0,24,0> [C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] <Autodesk><16.0.0.86> [PID: 3728][C:\Program Files\Tencent\QQ\QQ.exe] <TENCENT><12, 75, 0, 8045> [C:\Program Files\Tencent\QQ\QQBaseClassInDll.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\QQHelperDll.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\BasicCtrlDll.dll] <Tencent><0, 2, 2, 2> [C:\Program Files\Tencent\QQ\QQZip.dll] <tencent><2.05> [C:\Program Files\Tencent\QQ\ImagePro.dll] <Tencent><1.3.8.4> [C:\Program Files\Tencent\QQ\InPlus.dll] <Tencent><1.3.8.4> [C:\WINDOWS\System32\SynTPFcs.dll] <Synaptics, Inc.><7.5.17.8 19Nov03> [C:\Program Files\Tencent\QQ\QQAPI.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\TIMProxy.dll] <tencent><2.05> [C:\Program Files\Tencent\QQ\HostingMgr.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\LoginCtrl.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\QQRes.dll] <tencent><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\QQMainFrame.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\CQQApplication.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\QQSysMsgMng.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\LongConnection.dll] <tencent><0, 2, 2, 2> [C:\Program Files\Tencent\QQ\QQConfigPlugin.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\CameraDll.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\QQGroupMng.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\QQPlugin.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\UserDefinedHead.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\QQCustomFace.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\QQAllInOne.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\SCCore.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\GroupConnection.dll] <Tencent><0, 3, 1, 14> [C:\Program Files\Tencent\QQ\NewSkin.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2> [C:\Program Files\Tencent\QQ\BQQApplication.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\QQMMSender.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\QQAvatar.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\QRingMng.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\videodevice.dll] <Tencent><1.3.8.4> [C:\Program Files\Tencent\QQ\QQSceneMng.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\QQHook.dll] <N/A><N/A> [C:\Program Files\Tencent\QQGame\GameLogCore.Dll] <><0, 10, 106, 13> [C:\Program Files\Tencent\QQGame\Core.dll] <é??úêDìú???????ú?μí3óD?T1???><0, 10, 0, 0> [C:\Program Files\Tencent\QQGame\NetCenter.dll] <é??úêDìú???????ú?μí3óD?T1???><0, 10, 0, 0> [C:\Program Files\Tencent\QQGame\CmdCenter.dll] <深圳市腾讯计算机系统有限公司><0, 10, 0, 0> [C:\Program Files\Tencent\QQGame\HelpDll.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQGame\ResEx.dll] <深圳市腾讯计算机系统有限公司><0, 10, 0, 0> [C:\Program Files\Tencent\QQGame\GameLogAidMgr.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQGame\COMToolKit.dll] <><1, 0, 0, 3> [C:\Program Files\Tencent\QQGame\QQGameAvatar.dll] <深圳市腾讯计算机系统有限公司 Tencent Computer System Ltd.><0, 10, 0, 0> [C:\Program Files\Tencent\QQ\QQUdpGetFileLib.dll] <tencent><2.05> [PID: 3780][C:\Program Files\Tencent\QQ\TIMPlatfrom.exe] <tencent><2.05> [C:\WINDOWS\System32\SynTPFcs.dll] <Synaptics, Inc.><7.5.17.8 19Nov03> [C:\Program Files\Tencent\QQ\TIMProxy.dll] <tencent><2.05> [PID: 3860][C:\Program Files\Tencent\QQ\QQ.exe] <TENCENT><12, 75, 0, 8045> [C:\Program Files\Tencent\QQ\QQBaseClassInDll.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\QQHelperDll.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\BasicCtrlDll.dll] <Tencent><0, 2, 2, 2> [C:\Program Files\Tencent\QQ\QQZip.dll] <tencent><2.05> [C:\Program Files\Tencent\QQ\ImagePro.dll] <Tencent><1.3.8.4> [C:\Program Files\Tencent\QQ\InPlus.dll] <Tencent><1.3.8.4> [C:\WINDOWS\System32\SynTPFcs.dll] <Synaptics, Inc.><7.5.17.8 19Nov03> [C:\Program Files\Tencent\QQ\QQAPI.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\TIMProxy.dll] <tencent><2.05> [C:\Program Files\Tencent\QQ\HostingMgr.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\LoginCtrl.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\QQHook.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\QQRes.dll] <tencent><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\QQMainFrame.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\CQQApplication.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\QQSysMsgMng.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\LongConnection.dll] <tencent><0, 2, 2, 2> [C:\Program Files\Tencent\QQ\QQConfigPlugin.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\CameraDll.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\QQGroupMng.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\QQPlugin.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\UserDefinedHead.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\QQCustomFace.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\QQAllInOne.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\SCCore.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\GroupConnection.dll] <Tencent><0, 3, 1, 14> [C:\Program Files\Tencent\QQ\NewSkin.dll] <><1, 0, 0, 1>
海潮探长初生襁褓狮帖子:121 注册: 2005-02-03 来自:

海潮探长初生襁褓狮帖子:121 注册: 2005-02-03 来自:	发表于： 2006-08-27 15:00 \| 显示全部短消息资料字号：小中大 6楼 [C:\Program Files\Tencent\QQ\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2> [C:\Program Files\Tencent\QQ\BQQApplication.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\QQMMSender.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\QQAvatar.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\QRingMng.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\videodevice.dll] <Tencent><1.3.8.4> [C:\Program Files\Tencent\QQ\QQSceneMng.dll] <N/A><N/A> [C:\WINDOWS\System32\msdmo.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\ShareFiles.dll] <N/A><N/A> [C:\Program Files\Tencent\QQGame\GameLogCore.Dll] <><0, 10, 106, 13> [C:\Program Files\Tencent\QQGame\Core.dll] <é??úêDìú???????ú?μí3óD?T1???><0, 10, 0, 0> [C:\Program Files\Tencent\QQGame\NetCenter.dll] <é??úêDìú???????ú?μí3óD?T1???><0, 10, 0, 0> [C:\Program Files\Tencent\QQGame\CmdCenter.dll] <深圳市腾讯计算机系统有限公司><0, 10, 0, 0> [C:\Program Files\Tencent\QQGame\HelpDll.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQGame\ResEx.dll] <深圳市腾讯计算机系统有限公司><0, 10, 0, 0> [C:\Program Files\Tencent\QQGame\GameLogAidMgr.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQGame\COMToolKit.dll] <><1, 0, 0, 3> [C:\Program Files\Tencent\QQGame\QQGameAvatar.dll] <深圳市腾讯计算机系统有限公司 Tencent Computer System Ltd.><0, 10, 0, 0> [C:\Program Files\Tencent\QQ\ImageOle.dll] <TODO: <Company name>><1.0.0.1> [PID: 3884][C:\Program Files\Tencent\QQ\QQ.exe] <TENCENT><12, 75, 0, 8045> [C:\Program Files\Tencent\QQ\QQBaseClassInDll.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\QQHelperDll.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\BasicCtrlDll.dll] <Tencent><0, 2, 2, 2> [C:\Program Files\Tencent\QQ\QQZip.dll] <tencent><2.05> [C:\Program Files\Tencent\QQ\ImagePro.dll] <Tencent><1.3.8.4> [C:\Program Files\Tencent\QQ\InPlus.dll] <Tencent><1.3.8.4> [C:\WINDOWS\System32\SynTPFcs.dll] <Synaptics, Inc.><7.5.17.8 19Nov03> [C:\Program Files\Tencent\QQ\QQAPI.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\TIMProxy.dll] <tencent><2.05> [C:\Program Files\Tencent\QQ\HostingMgr.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\LoginCtrl.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\QQRes.dll] <tencent><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\QQMainFrame.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\CQQApplication.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\QQSysMsgMng.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\LongConnection.dll] <tencent><0, 2, 2, 2> [C:\Program Files\Tencent\QQ\QQConfigPlugin.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\CameraDll.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\QQGroupMng.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\QQPlugin.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\UserDefinedHead.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\QQCustomFace.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\QQAllInOne.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\SCCore.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\GroupConnection.dll] <Tencent><0, 3, 1, 14> [C:\Program Files\Tencent\QQ\NewSkin.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2> [C:\Program Files\Tencent\QQ\BQQApplication.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\QQMMSender.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\QQAvatar.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\QRingMng.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\videodevice.dll] <Tencent><1.3.8.4> [C:\Program Files\Tencent\QQ\QQSceneMng.dll] <N/A><N/A> [C:\Program Files\Tencent\QQ\QQHook.dll] <N/A><N/A> [C:\Program Files\Tencent\QQGame\GameLogCore.Dll] <><0, 10, 106, 13> [C:\Program Files\Tencent\QQGame\Core.dll] <é??úêDìú???????ú?μí3óD?T1???><0, 10, 0, 0> [C:\Program Files\Tencent\QQGame\NetCenter.dll] <é??úêDìú???????ú?μí3óD?T1???><0, 10, 0, 0> [C:\Program Files\Tencent\QQGame\CmdCenter.dll] <深圳市腾讯计算机系统有限公司><0, 10, 0, 0> [C:\Program Files\Tencent\QQGame\HelpDll.dll] <><1, 0, 0, 1>
海潮探长初生襁褓狮帖子:121 注册: 2005-02-03 来自:

海潮探长初生襁褓狮帖子:121 注册: 2005-02-03 来自:	发表于： 2006-08-27 15:00 \| 显示全部短消息资料字号：小中大 7楼 [C:\Program Files\Tencent\QQGame\ResEx.dll] <深圳市腾讯计算机系统有限公司><0, 10, 0, 0> [C:\Program Files\Tencent\QQGame\GameLogAidMgr.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQGame\COMToolKit.dll] <><1, 0, 0, 3> [C:\Program Files\Tencent\QQGame\QQGameAvatar.dll] <深圳市腾讯计算机系统有限公司 Tencent Computer System Ltd.><0, 10, 0, 0> [PID: 2264][C:\Program Files\Rising\Rav\Rav.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 75> [C:\Program Files\Rising\Rav\PlugIn\RsPgScan.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 17> [C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [C:\Program Files\Rising\Rav\RavUI.Dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 61> [C:\Program Files\Rising\Rav\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 24> [C:\Program Files\Rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [C:\WINDOWS\System32\SynTPFcs.dll] <Synaptics, Inc.><7.5.17.8 19Nov03> [C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\Program Files\Rising\Rav\Scanner.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30> [C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19> [C:\WINDOWS\System32\AcSignIcon.dll] <Autodesk><16.0.0.86> [C:\Program Files\Rising\Rav\RavUIMsg.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 25> [C:\Program Files\Tencent\QQ\QQHook.dll] <N/A><N/A> [C:\Program Files\Rising\Rav\libload.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [C:\Program Files\Rising\Rav\VirusLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12> [C:\Program Files\Rising\Rav\MVEngine.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 14> [C:\Program Files\Rising\Rav\Engine.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30> [C:\Program Files\Rising\Rav\ScanExec.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11> [C:\Program Files\Rising\Rav\Unpacker.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3> [C:\Program Files\Rising\Rav\UnExe.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11> [C:\Program Files\Rising\Rav\ScanEx.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 14> [C:\Program Files\Rising\Rav\PostTrt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12> [C:\Program Files\Rising\Rav\RsLog.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20> [C:\Program Files\Rising\Rav\NvFile.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7> [C:\Program Files\Rising\Rav\ScanMac.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9> [C:\Program Files\Rising\Rav\ScanSct.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 18> [C:\Program Files\Rising\Rav\ExtMail.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13> [C:\Program Files\Rising\Rav\ExtOLE.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6> [C:\Program Files\Rising\Rav\ExtFile.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21> [C:\Program Files\Rising\Rav\ScanNet.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [PID: 2820][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)> [C:\WINDOWS\System32\SynTPFcs.dll] <Synaptics, Inc.><7.5.17.8 19Nov03> [C:\WINDOWS\System32\AcSignIcon.dll] <Autodesk><16.0.0.86> [C:\Program Files\Tencent\QQ\QQHook.dll] <N/A><N/A> [C:\WINDOWS\System32\Macromed\Flash\Flash8b.ocx] <Macromedia, Inc.><8,0,24,0> [PID: 1664][F:\Downloads\ha_hijackthis_1991\HijackThis.exe] <Soeperman Enterprises Ltd.><1.99.0001> [C:\WINDOWS\System32\SynTPFcs.dll] <Synaptics, Inc.><7.5.17.8 19Nov03> [C:\Program Files\Tencent\QQ\QQHook.dll] <N/A><N/A> [C:\WINDOWS\System32\AcSignIcon.dll] <Autodesk><16.0.0.86> [C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] <Autodesk><16.0.0.86> [PID: 1468][C:\Program Files\Xi\NetTransport 2\NetTransport.exe] <Xi><1.92.273> [C:\WINDOWS\System32\SynTPFcs.dll] <Synaptics, Inc.><7.5.17.8 19Nov03> [C:\WINDOWS\System32\AcSignIcon.dll] <Autodesk><16.0.0.86> [C:\Program Files\Xi\NetTransport 2\libssl.dll] <Xi><0.97d.17> [C:\Program Files\Xi\NetTransport 2\libssh.dll] <Xi><3.1.009> [C:\Program Files\Tencent\QQ\QQHook.dll] <N/A><N/A> [PID: 2572][C:\Program Files\WinRAR\WinRAR.exe] <N/A><N/A> [C:\WINDOWS\System32\SynTPFcs.dll] <Synaptics, Inc.><7.5.17.8 19Nov03> [C:\WINDOWS\System32\AcSignIcon.dll] <Autodesk><16.0.0.86> [C:\Program Files\Nokia\Nokia PC Suite 5\NokiaPhoneBrowser.dll] <Nokia><5, 0, 0, 39> [C:\Program Files\Tencent\QQ\QQHook.dll] <N/A><N/A> [PID: 2784][C:\DOCUME~1\LRF\LOCALS~1\Temp\Rar$EX00.058\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505> [C:\WINDOWS\System32\SynTPFcs.dll] <Synaptics, Inc.><7.5.17.8 19Nov03> [C:\Program Files\Tencent\QQ\QQHook.dll] <N/A><N/A> ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\system32\winhlp32.exe %1] .INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 ==================================
海潮探长初生襁褓狮帖子:121 注册: 2005-02-03 来自:

海潮探长初生襁褓狮帖子:121 注册: 2005-02-03 来自:	发表于： 2006-08-27 15:05 \| 显示全部短消息资料字号：小中大 8楼最新发现，瑞星扫毒，内存Services.exe进程发现两个Trojan.PSW.QQGame.v
海潮探长初生襁褓狮帖子:121 注册: 2005-02-03 来自:

海潮探长初生襁褓狮帖子:121 注册: 2005-02-03 来自:	发表于： 2006-08-27 15:24 \| 显示全部短消息资料字号：小中大 9楼修复不了，修复完以后再扫描，那一项还是没变化。连SREng也修复不了，把勾去掉，过一会再去看，它自己又加回来了。
海潮探长初生襁褓狮帖子:121 注册: 2005-02-03 来自:

海潮探长初生襁褓狮帖子:121 注册: 2005-02-03 来自:	发表于： 2006-08-27 15:26 \| 显示全部短消息资料字号：小中大 10楼在SREng里，呈红色，点选编辑，改动键值，去掉逗号以后所有内容。换栏，然后再切换回来时，全部又变回原来的样子了。直接用regedit修改该值也是一样，修改后关闭，再打开，自己又加回去了。
海潮探长初生襁褓狮帖子:121 注册: 2005-02-03 来自:

<<上一主题|下一主题>>

12

1 / 2 页

跳转页

页面顶部

Powered by Discuz!NT