kunbu - 2007-5-9 23:18:00
07 05 11 晚
问题应该已经结决了,电脑的时间没有再改,不过早上杀毒的时候,还是发现很多病毒,放在7楼了.晚上在杀的时候,只有刚下的软件里发现病毒,幸福中……
呃……感谢 桃子CiCi 都是按你教的方法现在已经搞定了，爽歪歪呀……, 还要感谢:春天的小水竹 后面给我的提示。
呃，还有件事，不要在百度软件上下东西，下个超级免子，结果还赠送后门病毒，太过份了！！
五一前,电脑中的.Trojan.onlinegames 后来听建议把电脑重装了,可能是之前文件又拷回来的原因,电脑又一堆一堆的病毒,太恐怖了.现在卡巴的保护盾都打不开了,瑞星的监控也不自己启动了.
现在的电脑,我自己都看不了,在重装一次我也没意见,不过这刚重装了两天就这样了.真是没办法了.
附扫描:
2007-05-09,22:37:50
System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)
Windows XP Home Edition (Build 2600)
- 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [(Verified)Microsoft Corporation]
<g7w><C:\DOCUME~1\kunbu\LOCALS~1\Temp\c0nime.exe> [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation]
<PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Corporation]
<RavTask><"E:\程序\瑞星\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<RfwMain><"E:\程序\瑞星\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
<testrun><C:\WINDOWS\testexe.exe> [N/A]
<!AVG Anti-Spyware><"E:\程序\杀毒程序\卡巴斯基\AVG Anti-Spyware 7.5\avgas.exe" /minimized> [Anti-Malware Development a.s.]
<mppds><C:\WINDOWS\mppds.exe> [N/A]
<CdnCtr><C:\Program Files\CNNIC\Cdn\cdnup.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<twin><C:\WINDOWS\System32\ctfnom.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
<{A6011F8F-A7F8-49AA-9ADA-49127D43138F}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmp> [N/A]
<{57B86673-276A-48B2-BAE7-C6DBB3020EB8}><E:\程序\杀毒\卡巴斯基\AVG Anti-Spyware 7.5\shellexecutehook.dll> [N/A]
==================================
启动文件夹
[Microsoft Office]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Microsoft Office.lnk --> C:\PROGRA~1\MICROS~2\Office\OSA9.EXE [Microsoft Corporation]><N>
[Adobe Gamma Loader]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Gamma Loader.lnk --> C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [Adobe Systems, Inc.]><N>
==================================
服务
[Application Management / AppMgmt]
<C:\WINDOWS\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\appmgmts.dll><N/A>
[AVG Anti-Spyware Guard / AVG Anti-Spyware Guard]
<E:\程序\杀毒\卡巴斯基\AVG Anti-Spyware 7.5\guard.exe><N/A>
[F7F7FAFF / F7F7FAFF]
<C:\WINDOWS\System32\53F61708.EXE -d><Microsoft Corporation>
[Human Interface Device Access / HidServ]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[IMAPI CD-Burning COM Service / ImapiService]
<C:\WINDOWS\System32\imapi.exe><Microsoft Corporation>
[Windows ivxs RunThem / ivxs]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\PROGRA~1\dqsn\nacx.dll><N/A>
[Rising Proxy Service / RfwProxySrv]
<e:\程序\瑞星\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService]
<e:\程序\瑞星\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter]
<"E:\程序\瑞星\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon]
<"E:\程序\瑞星\RISING\RAV\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[WinWLServiceNow / WinWLServiceNow]
<C:\DOCUME~1\kunbu\LOCALS~1\Temp\RAVWL.EXE><N/A>
问题应该已经结决了,电脑的时间没有再改,不过早上杀毒的时候,还是发现很多病毒,放在7楼了.晚上在杀的时候,只有刚下的软件里发现病毒,幸福中……
呃……感谢 桃子CiCi 都是按你教的方法现在已经搞定了，爽歪歪呀……, 还要感谢:春天的小水竹 后面给我的提示。呃，还有件事，不要在百度软件上下东西，下个超级免子，结果还赠送后门病毒，太过份了！！
五一前,电脑中的.Trojan.onlinegames 后来听建议把电脑重装了,可能是之前文件又拷回来的原因,电脑又一堆一堆的病毒,太恐怖了.现在卡巴的保护盾都打不开了,瑞星的监控也不自己启动了.
现在的电脑,我自己都看不了,在重装一次我也没意见,不过这刚重装了两天就这样了.真是没办法了.
附扫描:
2007-05-09,22:37:50
System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)
Windows XP Home Edition (Build 2600)
- 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [(Verified)Microsoft Corporation]
<g7w><C:\DOCUME~1\kunbu\LOCALS~1\Temp\c0nime.exe> [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation]
<PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Corporation]
<RavTask><"E:\程序\瑞星\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<RfwMain><"E:\程序\瑞星\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
<testrun><C:\WINDOWS\testexe.exe> [N/A]
<!AVG Anti-Spyware><"E:\程序\杀毒程序\卡巴斯基\AVG Anti-Spyware 7.5\avgas.exe" /minimized> [Anti-Malware Development a.s.]
<mppds><C:\WINDOWS\mppds.exe> [N/A]
<CdnCtr><C:\Program Files\CNNIC\Cdn\cdnup.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<twin><C:\WINDOWS\System32\ctfnom.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
<{A6011F8F-A7F8-49AA-9ADA-49127D43138F}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmp> [N/A]
<{57B86673-276A-48B2-BAE7-C6DBB3020EB8}><E:\程序\杀毒\卡巴斯基\AVG Anti-Spyware 7.5\shellexecutehook.dll> [N/A]
==================================
启动文件夹
[Microsoft Office]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Microsoft Office.lnk --> C:\PROGRA~1\MICROS~2\Office\OSA9.EXE [Microsoft Corporation]><N>
[Adobe Gamma Loader]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Gamma Loader.lnk --> C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [Adobe Systems, Inc.]><N>
==================================
服务
[Application Management / AppMgmt]
<C:\WINDOWS\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\appmgmts.dll><N/A>
[AVG Anti-Spyware Guard / AVG Anti-Spyware Guard]
<E:\程序\杀毒\卡巴斯基\AVG Anti-Spyware 7.5\guard.exe><N/A>
[F7F7FAFF / F7F7FAFF]
<C:\WINDOWS\System32\53F61708.EXE -d><Microsoft Corporation>
[Human Interface Device Access / HidServ]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[IMAPI CD-Burning COM Service / ImapiService]
<C:\WINDOWS\System32\imapi.exe><Microsoft Corporation>
[Windows ivxs RunThem / ivxs]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\PROGRA~1\dqsn\nacx.dll><N/A>
[Rising Proxy Service / RfwProxySrv]
<e:\程序\瑞星\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService]
<e:\程序\瑞星\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter]
<"E:\程序\瑞星\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon]
<"E:\程序\瑞星\RISING\RAV\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[WinWLServiceNow / WinWLServiceNow]
<C:\DOCUME~1\kunbu\LOCALS~1\Temp\RAVWL.EXE><N/A>