各位高手大虾救命！！！ bbs.ikaka.com

ventsen - 2007-4-15 11:01:00

怎么最近我的QQ老是出现重启！！还重新安装不了！！安装程序到了百份百就没了！！貌似被屏蔽了！！要用瑞星杀毒！！瑞星装上去却没办法升级！！升级程序一开就没了！！是不是哪里起冲突了还是中了什么厉害的毒啊？？QQ重启的错误提示是这样的：
目标程序发生[可持续]异常，详细信息：[异常类型] EXCEPTION_ACCESS_VIOLATION／
[异常地址] 0x01E3B8D1／
[出错原因]对地址[0x00000000]进行读操作／操作系统Microsoft Windows XP Service Pack 2 [Build 5.1.2600]
Registers
EAX=00000000 EBX=00E9F998 ECX=0012F93C EDX=00000000
ESI=00000000 EDI=01E8BC10 EBP=0012FBCC ESP=00129928
EIP=01E3B8D1
Bytes at csEip
8B 38 56 8D 8D 70 FD FF FF E8 A3 5D 04 00 8B 40 04 56 8D 8D 70 FD FF FF 89 45 C8 E8 91 5D 04 00
Call stack
0x01E20000[1B8D1] LongConnection.dll - 0x01E3B8D1(00B13EB0,00A88C10,00154B58,001546C0)
0x01E20000[D63A] LongConnection.dll - 0x01E2D63A(00E9FFC0,00B13EB0,00B127D0,00A88C10)
0x00400000[71257] QQ.exe - 0x00471257(FFFFFFC6,00000000,00A88CDC,00A88E10)
0x00400000[72D0D] QQ.exe - 0x00472D0D(00000064,00A88C9C,00A88C9C,6009B3BB)
0x60090000[B450] BasicCtrlDll.dll - 0x6009B450(00000064,00000000,60A12059,00000001)
0x60090000[B3DA] BasicCtrlDll.dll - 0x6009B3DA(00000113,00000001,600B6E18,0012FD20)
0x60A10000[1CEA] MFC42.DLL - 0x60A11CEA(00000113,00000001,00000000,0012FE34)
0x60A10000[1C73] MFC42.DLL - 0x60A11C73(00000000,002C02A0,00000113,00000001)
0x60A10000[1BFB] MFC42.DLL - 0x60A11BFB(002C02A0,00000113,00000001,00000000)
0x60A10000[1BBA] MFC42.DLL - 0x60A11BBA(002C02A0,00000113,00000001,00000000)
0x77D10000[8734] USER32.dll - 0x77D18734(60A11B81,002C02A0,00000113,00000001)
0x77D10000[8816] USER32.dll - 0x77D18816(00000000,60A11B81,002C02A0,00000113)
0x77D10000[89CD] USER32.dll - 0x77D189CD(0057B64C,00000001,0057B64C,60A111CE)
0x77D10000[96C7] USER32.dll - 0x77D196C7(0057B64C,00000000,0057B618,60A191A4)
0X60A10000[11CE] MFC42.DLL - 0x60A111CE(0057B618,0057B618,0012FFC0,FFFFFFFF)
0X60A10000[91A4] MFC42.DLL - 0x60A191A4(0057B618,60A1B4FE,7C92EE18,00151EE3)
0X60A10000[9154] MFC42.DLL - 0x60A19154(7C92EE18,00151EE3,00000000,004FCF7B)
0X60A10000[B4FE] MFC42.DLL - 0x60A1B4FE(00400000,00000000,00151EE3,0000000A)
0X00400000[FCF7B] QQ.exe - 0x004FCF7B(00400000,00000000,00151EE3,0000000A)
0X00400000[85253] QQ.exe - 0x00485253(7FFDD000,C0000005,00151EE3,00A71050)
0X7C920000[10970] ntdll.dll - 0x7C930970(7C92EE18,7C930970,7FFDD000,C0000005)
0X7C800000[16D4F] kernel32.dll - 0x7C816D4F(7FFDD000,C0000005,0012FFC8,0012954C)
0X7C920000[10970] ntdll.dll - 0x7C930970(7C816D58,00000000,00000000,00000000)
0X7C800000[399F3] kernel32.dll - 0x7C8399F3(00000000,00000000,00000000,00000000)

超级游戏迷 - 2007-4-15 11:08:00

貌似中毒。发SRE日志上来，你那系统日志无用处。

ventsen - 2007-4-15 11:29:00

什么是SRE日志？？？我是菜鸟！！！

ventsen - 2007-4-15 11:50:00

还貌似有的QQ上了没事！！有的QQ上了要重启！！！

超级游戏迷 - 2007-4-15 11:52:00

引用:

【ventsen的贴子】什么是SRE日志？？？我是菜鸟！！！
………………

SRENG扫描工具下载地址：http://www.kztechs.com/sreng/

ventsen - 2007-4-16 11:54:00

你说的日志是不是这个啊？？？游戏迷！！
2007-04-16,11:36:02

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<wxClient><C:\WINDOWS\system32\Clsmn.exe> []
<SoundMan><SOUNDMAN.EXE> [Avance Logic, Inc.]
<ZSSnp211><C:\WINDOWS\ZSSnp211.exe> [ZSMCSNAP]
<Domino><C:\WINDOWS\Domino.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows XP Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<GinaDLL><C:\WINDOWS\system32\LogUser.dll> []
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<bgswitch><; C:\WINDOWS\system32\bgswitch.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<Domino><; C:\WINDOWS\Domino.exe> []
<HF_GameClient><; d:\Program Files\浩方对战平台\gameclient.exe> []
<HotKeysCmds><; C:\WINDOWS\system32\hkcmd.exe> [(Verified)Microsoft Windows Publisher]
<IgfxTray><; C:\WINDOWS\system32\igfxtray.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Publisher]
<IMSCMig><; C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload> [(Verified)Microsoft Corporation]
<MSPY2002><; C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC> [(Verified)Microsoft Windows Publisher]
<PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows Publisher]
<PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows Publisher]
<Resume copy><; copyfstq.exe /startup> []
<SoundMan><; SOUNDMAN.EXE> [Avance Logic, Inc.]
<TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<WebThunder><; C:\Program Files\Thunder Network\WebThunder\WebThunder.exe> [N/A]
<ZSSnp211><; C:\WINDOWS\ZSSnp211.exe> [ZSMCSNAP]

==================================
启动文件夹
N/A

==================================
服务
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[万象网络文件同步客户端 / wxsyncsrv][Running/Auto Start]
<C:\WINDOWS\system32\wxsyfcli.exe><成都吉胜科技有限公司>

==================================
驱动程序
[Service for Avance AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
<system32\drivers\ALCXWDM.SYS><Avance Logic, Inc.>
[ati2mtag / ati2mtag][Stopped/Manual Start]
<system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[EagleNT / EagleNT][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\EagleNT.sys><N/A>
[ialm / ialm][Running/Manual Start]
<system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
<\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[Realtek 10/100/1000 NIC Family all in one NDIS XP Driver / RTL8023xp][Running/Manual Start]
<system32\DRIVERS\Rtlnicxp.sys><Realtek Semiconductor Corporation>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
<system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[USB PC Camera (ZS0211) / ZSMC211][Running/Manual Start]
<System32\Drivers\ZS211.sys><ZSMC Corporation>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\D:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[npkycryp / npkycryp][Stopped/Manual Start]
<\??\D:\Program Files\Tencent\QQ\npkycryp.sys><N/A>

==================================
浏览器加载项
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\flash.ocx, Macromedia, Inc.>

==================================
正在运行的进程
[PID: 424][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 480][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1212][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\igfxpph.dll] [Intel Corporation, 3.0.0.3924]
[C:\WINDOWS\system32\hccutils.DLL] [Intel Corporation, 3.0.0.3924]
[C:\WINDOWS\system32\igfxres.dll] [Intel Corporation, 3.0.0.3924]
[C:\WINDOWS\system32\igfxsrvc.dll] [Intel Corporation, 3.0.0.3924]
[C:\WINDOWS\system32\igfxdev.dll] [Intel Corporation, 3.0.0.3924]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
[PID: 1280][C:\WINDOWS\system32\Clsmn.exe] [, 16.3.12.478]
[C:\WINDOWS\system32\RegCode.dll] [N/A, ]
[PID: 1288][C:\WINDOWS\SOUNDMAN.EXE] [Avance Logic, Inc., 5.0.02]
[PID: 1300][C:\WINDOWS\ZSSnp211.exe] [ZSMCSNAP, 3, 6, 818, 7]
[C:\WINDOWS\system32\msdmo.dll] [, ]
[C:\WINDOWS\system32\ZS211Prp.Ax] [ZSMC, 3, 6, 703, 15]
[PID: 1308][C:\WINDOWS\Domino.exe] [, 3, 6, 818, 7]
[C:\WINDOWS\system32\ZS211Prp.Ax] [ZSMC, 3, 6, 703, 15]
[C:\WINDOWS\system32\msdmo.dll] [, ]
[PID: 1316][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1336][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1896][D:\新建文件夹\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================

[/CODE]

ventsen - 2007-4-16 23:54:00

没人知道吗？？？
自己顶下！！！

超级游戏迷 - 2007-4-17 0:14:00

引用:

【ventsen的贴子】没人知道吗？？？
自己顶下！！！
………………

实在不想看日志了。楼下的那位007先生的日志已经发了2个页面（30帖）了，晕死！

你的日志我看不出问题来，要等楼下高手回答。

007邦德 - 2007-4-17 0:20:00

呵呵 ,我也不知道怎么发日志啊 55555555555555!

zgr稳得起 - 2007-4-17 0:21:00

中毒了，到反毒版去求助吧，系统应该开启的服务却都没有开，这[万象网络文件同步客户端 / wxsyncsrv][Running/Auto Start]<C:\WINDOWS\system32\wxsyfcli.exe><成都吉胜科技有限公司>个服务很可疑，这<ZSSnp211><; C:\WINDOWS\ZSSnp211.exe> [ZSMCSNAP]>也可疑

ventsen - 2007-4-17 2:13:00

[万象网络文件同步客户端 / wxsyncsrv][Running/Auto Start]<C:\WINDOWS\system32\wxsyfcli.exe><成都吉胜科技有限公司>
是一个管理程序！！
<ZSSnp211><; C:\WINDOWS\ZSSnp211.exe> [ZSMCSNAP]>我从任务管理器里关了好象没什么影响！！！

QQ七夜魔君 - 2007-4-17 6:53:00

有懂修电脑的吗?++++QQ群:26266461

瑞星卡卡安全论坛