【求助】帮我看看是什么BD? (附日志) - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛【求助】帮我看看是什么BD? (附日志)

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

1

1 / 1 页

跳转页

【求助】帮我看看是什么BD? (附日志)

yoyaye 初生襁褓狮帖子:15 注册: 2006-08-31 来自:	发表于： 2006-09-02 22:26 \| 显示全部短消息资料字号：小中大 1楼【求助】帮我看看是什么BD? (附日志) RootKit.CnsProt.a Trojan.PSW.Misc.ds 这个竟然杀了`33个出来..555 HELP! 启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [Microsoft Corporation] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <load><> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation] <MSPY2002><; C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC> [] <PHIME2002ASync><rem C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation] <PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation] <NvCplDaemon><rem ; RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup> [NVIDIA Corporation] <nwiz><rem ; nwiz.exe /install> [] <NvMediaCenter><rem ; RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit> [NVIDIA Corporation] <TkBellExe><rem ; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [] <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.] <YLive.exe><C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe> [ ] <yassistse><"C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"> [Yahoo!] <CnsMin><Rundll32.exe C:\WINDOWS\downlo~1\CnsMin.dll,Rundll32> [北京三七二一科技有限公司] <helper.dll><C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><EXPLORER.EXE> [Microsoft Corporation] <Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <UIHost><logonui.exe> [Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.] <{D157330A-9EF3-49F8-9A67-4141AC41ADD4}><C:\WINDOWS\downlo~1\CnsHook.dll> [北京三七二一科技有限公司] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <MsnMsgr><; "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background> [Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <PHIME2002A><; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation] <PHIME2002ASync><; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation] 2006-09-02 22:48:01
yoyaye 初生襁褓狮帖子:15 注册: 2006-08-31 来自:	分享到：

yoyaye 初生襁褓狮帖子:15 注册: 2006-08-31 来自:	发表于： 2006-09-02 22:30 \| 显示全部短消息资料字号：小中大 2楼正在运行的进程 [PID: 548][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)> [PID: 628][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 652][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.1557 (xpsp2_gdr.040517-1325)> [C:\WINDOWS\System32\SYNCOR11.DLL] <SoundMAX><1.2.3> [PID: 696][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 708][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)> [PID: 872][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 996][C:\Program Files\Rising\Rav\CCenter.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3> [PID: 1012][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [C:\WINDOWS\System32\SYNCOR11.DLL] <SoundMAX><1.2.3> [PID: 1184][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 1212][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 1224][C:\Program Files\Rising\Rav\Ravmond.exe] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 24> [C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 5> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [C:\Program Files\Rising\Rav\rfwctrl.dll] <Beijing Rising Technology Co., Ltd.><5, 0, 0, 6> [C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12> [C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 2> [C:\Program Files\Rising\Rav\RsLog.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20> [C:\Program Files\Rising\Rav\HOOKSYS.dll] <Rising><18, 1, 0, 9> [C:\Program Files\Rising\Rav\Scanner.dll] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 6> [C:\Program Files\Rising\Rav\libload.dll] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 8> [C:\Program Files\Rising\Rav\VirusLib.dll] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 5> [C:\Program Files\Rising\Rav\regmon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6> [C:\Program Files\Rising\Rav\HookWeb.dll] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 1> [C:\Program Files\Rising\Rav\MemMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11> [C:\Program Files\Rising\Rav\expscan.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\Program Files\Rising\Rav\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3> [C:\Program Files\Rising\Rav\HookCont.dll] <Rising><19, 0, 0, 0> [C:\Program Files\Rising\Rav\SpamEng.dll] <N/A><18, 0, 0, 6> [C:\Program Files\Rising\Rav\engine.dll] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 14> [C:\Program Files\Rising\Rav\PostTrt.dll] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 4> [C:\Program Files\Rising\Rav\UnExe.dll] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 5> [C:\Program Files\Rising\Rav\ScanExec.dll] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 7> [C:\Program Files\Rising\Rav\ScanEx.dll] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 8> [C:\Program Files\Rising\Rav\NvFile.dll] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 7> [C:\Program Files\Rising\Rav\ScanMac.dll] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 7> [C:\Program Files\Rising\Rav\ScanSct.dll] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 8> [C:\Program Files\Rising\Rav\Unpacker.dll] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 7> [C:\Program Files\Rising\Rav\ScanPack.dll] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 9> [C:\Program Files\Rising\Rav\RsVM.dll] <N/A><19, 0, 0, 3> [C:\Program Files\Rising\Rav\Uscript.dll] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 10> [C:\Program Files\Rising\Rav\Uroutine.dll] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 8> [C:\Program Files\Rising\Rav\RsStore.dll] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 2> [C:\Program Files\Rising\Rav\posttrtx.dll] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 2> [C:\Program Files\Rising\Rav\ExtOLE.dll] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 7> [PID: 1448][C:\WINDOWS\Explorer.exe] <Microsoft Corporation><6.00.2800.1221 (xpsp2.030511-1403)> [C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 7> [C:\WINDOWS\downlo~1\CnsHook.dll] <北京三七二一科技有限公司><1, 0, 2, 8> [C:\WINDOWS\System32\SYNCOR11.DLL] <SoundMAX><1.2.3> [C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 8>
yoyaye 初生襁褓狮帖子:15 注册: 2006-08-31 来自:

yoyaye 初生襁褓狮帖子:15 注册: 2006-08-31 来自:	发表于： 2006-09-02 22:30 \| 显示全部短消息资料字号：小中大 3楼 [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 5, 1022> [C:\PROGRA~1\3721\helper.dll] <><1, 1, 0, 1325> [C:\PROGRA~1\3721\alrex.dll] <><1, 0, 1, 1001> [C:\WINDOWS\System32\nvcpl.dll] <NVIDIA Corporation><6.14.10.5672> [C:\WINDOWS\System32\nvshell.dll] <NVIDIA Corporation><6.14.10.5672> [C:\WINDOWS\System32\NVWRSZHC.DLL] <NVIDIA Corporation><6.14.10.5672> [C:\PROGRA~1\3721\autolive.dll] <><1, 1, 7, 1326> [C:\PROGRA~1\3721\alLiveEx.dll] < ><1, 0, 3, 1006> [C:\PROGRA~1\Yahoo!\ASSIST~1\yaLive.dll] <><2, 0, 2, 1025> [C:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll] < ><2, 0, 1, 1007> [C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 2> [C:\Program Files\WinRAR\rarext.dll] <N/A><N/A> [C:\PROGRA~1\3721\ske\contmenu.dll] <N/A><N/A> [C:\WINDOWS\downlo~1\CnsMinIO.dll] <北京三七二一科技有限公司><1, 0, 3, 7> [C:\WINDOWS\downlo~1\cnsio.dll] <北京三七二一科技有限公司><1, 0, 2, 8> [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll] <Yahoo! China><1, 1, 3, 1035> [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll] <Yahoo!><2, 1, 9, 1049> [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL] <><1, 2, 7, 1006> [PID: 1540][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.0 (XPClient.010817-1148)> [PID: 1832][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)> [C:\WINDOWS\System32\SYNCOR11.DLL] <SoundMAX><1.2.3> [PID: 1872][C:\WINDOWS\System32\nvsvc32.exe] <NVIDIA Corporation><6.14.10.5672> [PID: 1940][C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe] <Analog Devices, Inc.><3, 2, 6, 0> [PID: 1980][C:\WINDOWS\System32\Rundll32.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 8> [C:\WINDOWS\downlo~1\CnsMinIO.dll] <北京三七二一科技有限公司><1, 0, 3, 7> [C:\WINDOWS\downlo~1\cnsio.dll] <北京三七二一科技有限公司><1, 0, 2, 8> [C:\WINDOWS\downlo~1\CnsMinEx.dll] <国风因特软件(北京)有限公司><1, 0, 3, 3> [C:\PROGRA~1\3721\helper.dll] <><1, 1, 0, 1325> [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 5, 1022> [C:\WINDOWS\System32\SYNCOR11.DLL] <SoundMAX><1.2.3> [PID: 1060][C:\Program Files\Rising\Rav\RavTask.exe] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 5> [C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 2> [C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 8> [PID: 1040][C:\Program Files\Rising\Rav\Ravmon.exe] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 23> [C:\Program Files\Rising\Rav\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 21> [C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 5> [C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12> [C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 2> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [C:\Program Files\Rising\Rav\RsXML.dll] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 2> [C:\Program Files\Rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 5, 1022> [C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 8> [C:\PROGRA~1\3721\helper.dll] <><1, 1, 0, 1325> [PID: 1100][C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe] < ><2, 0, 0, 1001> [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 5, 1022> [C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 8> [C:\PROGRA~1\Yahoo!\ASSIST~1\yaLive.dll] <><2, 0, 2, 1025> [C:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll] < ><2, 0, 1, 1007> [C:\WINDOWS\System32\SYNCOR11.DLL] <SoundMAX><1.2.3> [C:\PROGRA~1\3721\helper.dll] <><1, 1, 0, 1325> [C:\PROGRA~1\3721\notifier.dll] <><1, 0, 0, 5> [PID: 1096][C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe] <Yahoo!><1, 0, 1, 1001> [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 5, 1022> [C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 8> [C:\PROGRA~1\Yahoo!\Assistant\shell\yAssecblk.dll] <Yahoo><1, 0, 2, 1002> [C:\PROGRA~1\Yahoo!\Assistant\shell\yAsMenu.dll] <Yahoo><1, 0, 1, 1006> [C:\PROGRA~1\Yahoo!\Assistant\shell\yIEAngel.dll] <Yahoo><1, 0, 1, 1001> [C:\PROGRA~1\Yahoo!\Assistant\shell\yMenuInfo.dll] <Yahoo><1, 0, 0, 2> [C:\PROGRA~1\3721\helper.dll] <><1, 1, 0, 1325> [PID: 1156][C:\WINDOWS\system32\rundll32.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [C:\PROGRA~1\3721\helper.dll] <><1, 1, 0, 1325> [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 5, 1022> [C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 8> [C:\PROGRA~1\3721\autolive.dll] <><1, 1, 7, 1326> [C:\PROGRA~1\3721\notifier.dll] <><1, 0, 0, 5> [C:\PROGRA~1\3721\alLiveEx.dll] < ><1, 0, 3, 1006> [C:\WINDOWS\system32\SYNCOR11.DLL] <SoundMAX><1.2.3> [PID: 1056][C:\WINDOWS\System32\ctfmon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)> [C:\PROGRA~1\3721\helper.dll] <><1, 1, 0, 1325> [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 5, 1022> [C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 8> [PID: 672][C:\Program Files\ChinaNet\VnetClient.exe] <><2006, 6, 30, 11> [C:\Program Files\ChinaNet\Communicate.dll] <GDCN><2006, 2, 15, 1> [C:\Program Files\ChinaNet\DialModule.dll] <GDCN><2006, 6, 26, 10> [C:\WINDOWS\System32\SYNCOR11.DLL] <SoundMAX><1.2.3> [C:\PROGRA~1\3721\helper.dll] <><1, 1, 0, 1325> [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 5, 1022> [C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 8> [C:\PROGRA~1\ChinaNet\CLIENT~1.DLL] <><2004, 2, 28, 1> [C:\PROGRA~1\ChinaNet\PLUGIN~1.OCX] <><2006, 6, 2, 14> [C:\PROGRA~1\ChinaNet\sign.dll] <0><2004, 12, 1, 1> [C:\PROGRA~1\ChinaNet\ADVERT~1.OCX] <><2005, 10, 13, 1>
yoyaye 初生襁褓狮帖子:15 注册: 2006-08-31 来自:

yoyaye 初生襁褓狮帖子:15 注册: 2006-08-31 来自:	发表于： 2006-09-02 22:31 \| 显示全部短消息资料字号：小中大 4楼帮我看看吧．｀．．｀
yoyaye 初生襁褓狮帖子:15 注册: 2006-08-31 来自:

yoyaye 初生襁褓狮帖子:15 注册: 2006-08-31 来自:	发表于： 2006-09-02 22:56 \| 显示全部短消息资料字号：小中大 5楼 help```````````````
yoyaye 初生襁褓狮帖子:15 注册: 2006-08-31 来自:

<<上一主题|下一主题>>

1

1 / 1 页

跳转页

页面顶部

Powered by Discuz!NT