瑞星卡卡安全论坛

为什么我的瑞星安装好了但是无法启动？重新安装也一样，一重启，它又不能加载了。这是我的日志：
Logfile of HijackThis v1.99.1
Scan saved at 21:12:48, on 2006-8-25
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\VKTServ.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\alg.exe
D:\rising\Rav\RavTask.exe
C:\WINDOWS\command\rundll32.exe
C:\WINDOWS\LSASS.exe
C:\WINDOWS\SMSS.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\conime.exe
C:\DOCUME~1\caoxq\LOCALS~1\Temp\zz.exe
C:\WINDOWS\system32\conime.exe
C:\WINDOWS\system32\conime.exe
D:\Ewido security suite\SecuritySuite.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\caoxq\桌面\HijackThis.exe

O2 - BHO: IEMonitor Class - {08A312BB-5409-49FC-9347-54BB7D069AC6} - C:\Program Files\DeskAdTop\deskipn.dll
O2 - BHO: BHelper Class - {F2E37336-BFDB-409B-8D0E-6F013C438B20} - C:\WINDOWS\system\768o2560.dll
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [ToP] C:\WINDOWS\LSASS.exe
O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\RunServices: [TProgram] C:\WINDOWS\SMSS.EXE
O4 - HKLM\..\RunServices: [Torjan Program] C:\WINDOWS\WINLOGON.EXE
O4 - HKLM\..\RunOnce: [Rav] "D:\rising\Rav\Update\setup.exe" /UNINSTALL /S /ONCE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O16 - DPF: {5932517A-3326-4439-A708-1C98EDB5C549} (Downloader Class) - file://C:\Documents and Settings\All Users\Application Data\Share Helper\Cast\GGS\d154237b4\js\iMopDl.cab
O20 - AppInit_DLLs: KB896588M.LOG
O21 - SSODL: DelayRun - {5A6F2F95-3191-433B-8533-EB0B596A7BAC} - C:\WINDOWS\system\768d2560.dll
O21 - SSODL: DVDBurn - {790448C3-4239-45AF-C98B-367991A8B103} - C:\WINDOWS\Downloaded Program Files\AfxEdit.dll
O21 - SSODL: DLMon - {590498A3-4131-4D8F-BA4B-36791A0803B1} - C:\WINDOWS\system32\DLMain.dll
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Unknown owner - c:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Unknown owner - D:\rising\Rav\CCenter.exe (file missing)
O23 - Service: RsRavMon Service (RsRavMon) - Unknown owner - D:\rising\Rav\Ravmond.exe (file missing)

卸载瑞星后在线用其他杀毒软件杀毒后再装

C:\DOCUME~1\caoxq\LOCALS~1\Temp\zz.exe
很奇怪

好像那个病毒

还有你看看你的瑞星服务开了没有

在运行中输入MSCONFIG

发现落雪木马

C:\WINDOWS\LSASS.exe
C:\WINDOWS\SMSS.EXE
C:\WINDOWS\command\rundll32.exe

下载落雪专杀

http://luoyexinqing.ys168.com/

C:\WINDOWS\LSASS.exe
C:\WINDOWS\SMSS.EXE
C:\WINDOWS\command\rundll32.exe
C:\DOCUME~1\caoxq\LOCALS~1\Temp\zz.exe
O2 - BHO: BHelper Class - {F2E37336-BFDB-409B-8D0E-6F013C438B20} - C:\WINDOWS\system\768o2560.dll
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [ToP] C:\WINDOWS\LSASS.exe
O4 - HKLM\..\RunServices: [TProgram] C:\WINDOWS\SMSS.EXE
O4 - HKLM\..\RunServices: [Torjan Program] C:\WINDOWS\WINLOGON.EXE
O20 - AppInit_DLLs: KB896588M.LOG
O21 - SSODL: DelayRun - {5A6F2F95-3191-433B-8533-EB0B596A7BAC} - C:\WINDOWS\system\768d2560.dll
O21 - SSODL: DVDBurn - {790448C3-4239-45AF-C98B-367991A8B103} - C:\WINDOWS\Downloaded Program Files\AfxEdit.dll
O21 - SSODL: DLMon - {590498A3-4131-4D8F-BA4B-36791A0803B1} - C:\WINDOWS\system32\DLMain.dll
清理修复上面所有项目，
你可以到我的“网络优盘”里下载一个“LSASS专杀.RAR”文件来参见下图红框中所示
↑〖稳得起网络优盘〗↓
http://free.ys168.com/?zgrhcf



附件: 6919462006825225947.JPG

引用:

【zgr稳得起的贴子】C:\WINDOWS\LSASS.exe C:\WINDOWS\SMSS.EXE C:\WINDOWS\command\rundll32.exe C:\DOCUME~1\caoxq\LOCALS~1\Temp\zz.exe O2 - BHO: BHelper Class - {F2E37336-BFDB-409B-8D0E-6F013C438B20} - C:\WINDOWS\system\768o2560.dll O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM\..\Run: [ToP] C:\WINDOWS\LSASS.exe O4 - HKLM\..\RunServices: [TProgram] C:\WINDOWS\SMSS.EXE O4 - HKLM\..\RunServices: [Torjan Program] C:\WINDOWS\WINLOGON.EXE O20 - AppInit_DLLs: KB896588M.LOG O21 - SSODL: DelayRun - {5A6F2F95-3191-433B-8533-EB0B596A7BAC} - C:\WINDOWS\system\768d2560.dll O21 - SSODL: DVDBurn - {790448C3-4239-45AF-C98B-367991A8B103} - C:\WINDOWS\Downloaded Program Files\AfxEdit.dll O21 - SSODL: DLMon - {590498A3-4131-4D8F-BA4B-36791A0803B1} - C:\WINDOWS\system32\DLMain.dll 清理修复上面所有项目， 你可以到我的“网络优盘”里下载一个“LSASS专杀.RAR”文件来参见下图红框中所示 ↑〖稳得起网络优盘〗↓ ………………

你可以到我的“网络优盘”里在“09_专杀工具”文件夹里下载一个“WINLOGON批处理.rar”文件来参见下图红框中所示
↑〖稳得起网络优盘〗↓
http://free.ys168.com/?zgrhcf



附件: 6919462006825230757.JPG

谢谢楼上的啦！