瑞星卡卡安全论坛

这几天当我运行某些程序的时候突然出现runtime error（见图），以前都能用的
而且这些程序都是绿色程序，解压后的第一次可以运行，但运行一次之后就不能用了，就出现了错误，并且每运行一次该程序就自动增加0.25M的体积（即使不能运行，每点击一次也增加0.25M空间）几次之后该文件就增加了几M了，我快疯了，正版瑞星也杀不出来，是不是病毒啊，高手帮帮我啊，我就此谢过！！！！！！！

附件: 5460952005722124941.JPG

我求大家了，小弟非常着急啊，帖子不能沉啊！

不清楚  应该不是病毒吧～～

【回复“冰魄之泉”的帖子】

这不是病毒作祟,而是游戏文件本身存在的问题.

不是不是的啊，好几个程序都有这种情况，而且同样是运行一次自身体积增加0.25M

用hijackthis1.99.1把日志扫上来.

Logfile of HijackThis v1.99.1
Scan saved at 13:31:49, on 2005-7-22
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
D:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
D:\PROGRAM FILES\RISING\RAV\Ravmond.exe
D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
D:\PROGRAM FILES\RISING\RAV\RavStub.exe
C:\Program Files\Sandai\ThunderMini\ThunderMini.exe
D:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
D:\PROGRA~1\RISING\RAV\RAVMON.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\RUNDLL32.exe
D:\Program Files\Maxthon\Maxthon.exe
D:\Program Files\BitComet\BitComet.exe
C:\WINDOWS\system32\svchost.exe
d:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\苑冰泉\LOCALS~1\Temp\Rar$EX00.233\HijackThis.exe

O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v4.dll
O2 - BHO: EyeOnBrowser Class - {1272F701-349D-4DB3-BBCD-10CBDCD049FE} - C:\WINDOWS\Downlo~1\_IS_WEBH.dll
O2 - BHO: CNNIC_IDN - {35980F6E-A137-4E50-953D-813BB8556899} - C:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll
O2 - BHO: MEobjectSDT - {4136C3F6-7636-49bf-A122-D4DA53B1ADDF} - C:\WINDOWS\system32\meobjsdt.dll (file missing)
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - d:\Program Files\Tencent 2\QQIEHelper.dll
O2 - BHO: DDDMon Class - {6BDE1669-B490-48E3-B668-456314F2D6C3} - C:\Program Files\DuDu\DddClient\dddiemon.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\PROGRA~1\FLASHGET\jccatch.dll
O2 - BHO: 百度超级搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\Progra~1\Baidu\bar\BaiDuBar.dll
O3 - Toolbar: 博采 - {4DA2EE61-6399-4C39-AEB9-0D990E610D29} - C:\WINDOWS\system32\BoCaiToolbar.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - Toolbar: 完美网译通 - {F43BD772-ABDD-43b7-A96A-3E9E61946EC0} - C:\WINDOWS\WORLD2\TOOLBAR\hmtoolbar.dll
O3 - Toolbar: 百度超级搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\Progra~1\Baidu\bar\BaiDuBar.dll
O4 - HKLM\..\Run: [CdnCtr] C:\Program Files\CNNIC\Cdn\cdnup.exe
O4 - HKLM\..\Run: [BCUpdate] C:\WINDOWS\system32\BCUP.exe
O4 - HKLM\..\Run: [thunder_mini] C:\Program Files\Sandai\ThunderMini\ThunderMini.exe
O4 - HKLM\..\Run: [RavTimer] D:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [RavMon] D:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [advapi32] RUNDLL32 C:\WINDOWS\Downlo~1\_IS_ISC.dll,isc
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &使用DuDu 加速器下载 - res://C:\Program Files\DuDu\DddClient\dddmext.dll/202
O8 - Extra context menu item: &使用迷你迅雷下载 - C:\Program Files\Sandai\ThunderMini\geturl.htm
O8 - Extra context menu item: 使用网际快车下载 - D:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - D:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - d:\Program Files\Tencent 2\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - d:\Program Files\Tencent 2\AddEmotion.htm
O8 - Extra context menu item: 火狐Flash保存 - d:\Program Files\FoxFlashplayer\PlugIns\GetFlash.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - d:\Program Files\Tencent 2\SendMMS.htm
O8 - Extra context menu item: 百度-搜索MP3 - res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUMP3.HTM
O8 - Extra context menu item: 百度-搜索图片 - res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUIMG.HTM
O8 - Extra context menu item: 百度-搜索新闻 - res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUNEWS.HTM
O8 - Extra context menu item: 百度-搜索歌词 - res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDULYRIC.HTM
O8 - Extra context menu item: 百度-搜索网页 - res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUSEARCH.HTM
O8 - Extra context menu item: 百度-搜索贴吧 - res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUPOST.HTM
O8 - Extra context menu item: 百度-词典搜索 - res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDU_DIC.HTM
O9 - Extra button: 中文上网 - {35980F6E-A137-4E50-953D-813BB8556899} - C:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll
O9 - Extra 'Tools' menuitem: 中文上网 - {35980F6E-A137-4E50-953D-813BB8556899} - C:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll
O9 - Extra button: 下载管理 - {3DB9F45E-AA74-4373-A466-C18A9F1C500D} - C:\Program Files\DuDu\DddClient\DuDuAcc.exe
O9 - Extra 'Tools' menuitem: 下载管理 - {3DB9F45E-AA74-4373-A466-C18A9F1C500D} - C:\Program Files\DuDu\DddClient\DuDuAcc.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra button: 易趣购物 - {DE60714F-AC17-427e-861A-FD60CBDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=1 (file missing)
O9 - Extra 'Tools' menuitem: 易趣购物 - {DE60714F-AC17-427e-861A-FD60CBDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=1 (file missing)
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - d:\Program Files\Tencent 2\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - d:\Program Files\Tencent 2\QQIEHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: d:\program files\nec\e-border client\s5spi.dll
O10 - Unknown file in Winsock LSP: d:\program files\nec\e-border client\s5spi.dll
O10 - Unknown file in Winsock LSP: d:\program files\nec\e-border client\s5spi.dll
O10 - Unknown file in Winsock LSP: d:\program files\nec\e-border client\s5spi.dll
O10 - Unknown file in Winsock LSP: d:\program files\nec\e-border client\s5spi.dll
O10 - Unknown file in Winsock LSP: d:\program files\nec\e-border client\s5spi.dll
O10 - Unknown file in Winsock LSP: d:\program files\nec\e-border client\s5spi.dll
O11 - Options group: [CDNCLIENT]  中文上网
O16 - DPF: {20050325-D35A-4233-926E-2E801AE25949} (NMJPStarter15 Class) - http://www.netmarble.jp/_common/cab/NMStarterJP5.cab
O16 - DPF: {6FC19219-C47E-4880-9A79-D218A1C374F9} (NMJTransX Control) - http://file.netmarble.jp/Control/NMJTransX.cab
O16 - DPF: {7417F730-7BAB-409E-8BB7-6936D361B869} (MLauncher Class) - http://download.mgame.com/download/cab/MLauncher.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C902BF9F-3D9E-4051-BFC5-03AF20AB8D2F}: NameServer = 202.102.192.68 202.102.199.68
O18 - Protocol: koboo - {7DEE9D05-FA0A-4416-A6F3-6537D0EAB6A6} - C:\WINDOWS\system32\mbprot.dll
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - D:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\PROGRAM FILES\RISING\RAV\Ravmond.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

这个是日志，谢谢了，我看不出有可疑的程序啊

再顶一下，希望高手解决

建议修复（如果楼主认为安全可以不选）

O2 - BHO: EyeOnBrowser Class - {1272F701-349D-4DB3-BBCD-10CBDCD049FE} - C:\WINDOWS\Downlo~1\_IS_WEBH.dll
O2 - BHO: MEobjectSDT - {4136C3F6-7636-49bf-A122-D4DA53B1ADDF} - C:\WINDOWS\system32\meobjsdt.dll (file missing)
O4 - HKLM\..\Run: [advapi32] RUNDLL32 C:\WINDOWS\Downlo~1\_IS_ISC.dll,isc
O10 - Unknown file in Winsock LSP: d:\program files\nec\e-border client\s5spi.dll
O10 - Unknown file in Winsock LSP: d:\program files\nec\e-border client\s5spi.dll
O10 - Unknown file in Winsock LSP: d:\program files\nec\e-border client\s5spi.dll
O10 - Unknown file in Winsock LSP: d:\program files\nec\e-border client\s5spi.dll
O10 - Unknown file in Winsock LSP: d:\program files\nec\e-border client\s5spi.dll
O10 - Unknown file in Winsock LSP: d:\program files\nec\e-border client\s5spi.dll
O10 - Unknown file in Winsock LSP: d:\program files\nec\e-border client\s5spi.dll
O18 - Protocol: koboo - {7DEE9D05-FA0A-4416-A6F3-6537D0EAB6A6} - C:\WINDOWS\system32\mbprot.dll

重起进安全模式，关闭系统还原

我的电脑--工具--文件夹选项--查看--显示所有文件（如图，或参考本版基本操作说明http://forum.ikaka.com/topic.asp?board=67&artid=6789825）
查找并删除
C:\WINDOWS\system32\mbprot.dll
d:\program files\nec\e-border client\s5spi.dll
C:\WINDOWS\Downlo~1\_IS_WEBH.dll
C:\WINDOWS\Downlo~1\_IS_ISC.dll
C:\WINDOWS\system32\meobjsdt.dll

请您清空IE缓存
开始--控制面版--internet选项--删除文件--删除所有脱机内容

附件: 5221632005722151010.gif

谢谢你们，我试一下

一个个这么懂``我中病毒了。。。就不会搞~~~~急啊`

010项可以不必修复