word出现内存不足是什么病毒? bbs.ikaka.com

xhxokdn - 2007-8-2 11:21:00

我电脑的word文档打几个字就出现内存不足,请保存.但又保存不了.瑞星又查不出病毒.是什么问题?

[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Leoooo - 2007-8-2 12:09:00

http://download.rising.com.cn/for_down/kakatool/kakasetupv4.exe下载卡卡上网安全助手4.0
1 运行瑞星卡卡上网安全助手
2 诊断求助=》电脑诊断日志
3 选择"文件详细信息"、"文件名相似分析"2个选项
4 开始扫描＝》导出信息，导成txt格式（也可以是htm格式方便自己看，不过论坛不能上传htm格式）
5 把日志中的报告完整拷贝贴上来(附件形式发上来也可以)，不要修改（一次发不完请分次发上来）
6 扫日志的时候尽量把不必要的软件关闭如QQ TM等
7 把扫描出来的可疑文件上传给瑞星http://up.rising.com.cn/webmail/uploadnew.htm

xhxokdn - 2007-8-2 22:43:00

【回复“Leoooo”的帖子】
请看看是什么问题谢了
+ 注册表自运行项目
+ 系统服务
+ HKLM\System\CurrentControlSet\Services
RfwProxySrv
[A ] 1. c:\program files\rising\rfw\rfwproxy.exe
Beijing Rising Technology Co., Ltd.
Rising Personal Proxy Service
.text,.rdata,.data,.rsrc,

RfwService
[A ] 2. c:\program files\rising\rfw\rfwsrv.exe
Beijing Rising Technology Co., Ltd.
Rising Personal FireWall Service
.text,.rdata,.data,.rsrc,

RsCCenter
[A ] 3. c:\program files\rising\rav\ccenter.exe
Beijing Rising Technology Co., Ltd.
CCenter
.text,.rdata,.data,.rsrc,

RsRavMon
[A ] 4. c:\program files\rising\rav\ravmond.exe
Beijing Rising Technology Co., Ltd.
RavMond
.text,.rdata,.data,.rsrc,

UMWdf
[AM] 5. c:\windows\system32\wdfmgr.exe
Microsoft Corporation
Windows User Mode Driver Manager
.text,.data,.rsrc,

+ 内核驱动
+ HKLM\System\CurrentControlSet\Services
BaseTDI
[A ] 6. c:\windows\system32\drivers\basetdi.sys
Beijing Rising Technology Co., Ltd.
basetdi
.text,.rdata,.data,INIT,.rsrc,.reloc,

cmuda
[A ] 7. c:\windows\system32\drivers\cmuda.sys
C-Media Inc
C-Media Audio WDM Driver
.text,_LTEXT,_PTEXT,.data,_PDATA,_LDATA,.data1,PAGE,INIT,.rsrc,.reloc,

ExpScaner
[A ] 8. c:\program files\rising\rav\expscan.sys
ExpScan.sys
.text,.rdata,.data,INIT,.rsrc,.reloc,

HookCont
[A ] 9. c:\program files\rising\rav\hookcont.sys
Rising
HookCont
.text,.rdata,.data,INIT,.rsrc,.reloc,

HookReg
[A ] 10. c:\program files\rising\rav\hookreg.sys
.text,.rdata,.data,INIT,.rsrc,.reloc,

HookSys
[A ] 11. c:\program files\rising\rav\hooksys.sys
Rising
Hooksys
.text,.rdata,.data,INIT,.rsrc,.reloc,

HookUrl
[A ] 12. c:\program files\rising\rfw\hookurl.sys
Beijing Rising Technology Co., Ltd.
HookUrl
.text,.rdata,.data,INIT,.rsrc,.reloc,

MEMSCAN
[A ] 13. c:\program files\rising\rav\memscan.sys
Beijing Rising Technology Co., Ltd.
MemScan Driver
.text,.rdata,.data,INIT,.rsrc,.reloc,

mProcRs
[A ] 14. c:\program files\rising\rfw\mprocrs.sys
Beijing Rising Technology Co., Ltd.
Rising Personal FireWall mprocrs.sys
.text,.rdata,.data,INIT,.rsrc,.reloc,

RsAntiSpyware
[A ] 15. c:\windows\system32\drivers\rsboot.sys
Beijing Rising Technology Co., Ltd.
Anti-RootKit Driver
.text,.rdata,.data,INIT,.rsrc,.reloc,

RsFwDrv
[A ] 16. c:\program files\rising\rfw\rsfwdrv.sys
Beijing Rising Technology Co., Ltd.
nt_fwdrv
.text,.rdata,.data,INIT,.rsrc,.reloc,

RsNTGDI
[A ] 17. c:\windows\system32\drivers\rsntgdi.sys
Beijing Rising Technology Co., Ltd.
RsNTGDI
.text,.rdata,INIT,.rsrc,.reloc,

RSPPSYS
[A ] 18. c:\program files\rising\rav\rsppsys.sys
Rising
RSPPSYS.SYS
.text,.rdata,.data,INIT,.rsrc,.reloc,

Secdrv
[A ] 19. c:\windows\system32\drivers\secdrv.sys
.text,.data,INIT,.reloc,

sisagp
[A ] 20. c:\windows\system32\drivers\sisagpx.sys
Silicon Integrated Systems Corporation
SiS NT AGP Filter
.text,.rdata,.data,PAGE,INIT,.rsrc,.reloc,

SiSkp
[A ] 21. c:\windows\system32\drivers\srvkp.sys
Silicon Integrated Systems Corporation
SiS VGA Driver Manager
.text,.rdata,.data,INIT,.rsrc,.reloc,

+ 文件系统驱动
+ HKLM\System\CurrentControlSet\Services
tipxhqof
[A ] 22. c:\windows\system32\drivers\tipxhqof.sys
Yahoo! China Corporation
.text,.rdata,.data,INIT,.rsrc,.reloc,

yaskp
[A ] 23. c:\windows\system32\drivers\yaskp.sys
Copyright (C) yahoo Corporation.
KMD
.text,.rdata,.data,INIT,.rsrc,.reloc,

+ IE浏览器加载模块
+ HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar
{406F94F0-504F-4a40-8DFD-58B0666ABEBD}
[A ] 24. c:\program files\yahoo!\assistant\assist\yasbar.dll
yahoo! china
IE ToolBand
.text,.rdata,.data,.yAsbarS,.rsrc,.reloc,

{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C}
[A ] 25. c:\windows\system32\kakatool.dll
Beijing Rising Technology Co., Ltd.
Rising AntiSpyware Toolbar
.text,.rdata,.data,MonitorS,.rsrc,.reloc,

+ HKCU\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks
{406F94F0-504F-4a40-8DFD-58B0666ABEBD}
[A ] 24. c:\program files\yahoo!\assistant\assist\yasbar.dll
yahoo! china
IE ToolBand
.text,.rdata,.data,.yAsbarS,.rsrc,.reloc,

+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
{00000AAA-A363-466E-BEF5-9BB68697AA7F}
[A ] 26. c:\program files\thunder network\webthunder\webthunderbho_now.dll
Thunder Networking Technologies,LTD
XunLeiBHO
.text,.rdata,.data,.rsrc,.reloc,

{33BBE430-0E42-4f12-B075-8D21ACB10DCB}
[A ] 27. c:\program files\yahoo!\assistant\assist\yphtb.dll
Yahoo! China
yPhtb
.text,.rdata,.data,.yPhtbSe,.rsrc,.reloc,

{38928D50-8A48-44C2-945F-D2F23F771410}
[A ] 28. c:\program files\yahoo!\assistant\assist\yangling.dll
yahoo! china
yangling.dll
.text,.rdata,.data,.SHARED,.rsrc,.reloc,

{62EED7C6-9F02-42f9-B634-98E2899E147B}
[A ] 29. c:\program files\yahoo!\assistant\assist\ydragsearch.dll
yahoo! china
DragSearch
.text,.rdata,.data,.BhoObjS,.rsrc,.reloc,

{F166BC04-3C84-44cc-A6E9-2315EC4844B9}
[A ] 30. c:\program files\yahoo!\assistant\assist\yflashdl.dll
Yahoo! China
Flash video download
.text,.rdata,.data,.yFlashD,.rsrc,.reloc,

{FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8}
[A ] 31. c:\program files\yahoo!\assistant\assist\yassist.dll
Yahoo! China
Assist Module
.text,.rdata,.data,.rsrc,.reloc,

+ HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars
{19CE93DE-8334-42C6-B2CA-BFE3DF5196A3}
[A ] 32. c:\program files\yahoo!\assistant\assist\yrss.dll
Yahoo! China
yRss Module
.text,.rdata,.data,.rsrc,.reloc,

+ 资源管理器加载模块
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
HyperTerminal Icon Ext
[A ] 33. c:\windows\system32\hticons.dll
Hilgraeve, Inc.
HyperTerminal Applet Library
.text,.data,.rsrc,.reloc,

Portable Media Devices
[A ] 34. c:\windows\system32\audiodev.dll
Microsoft Corporation
便携媒体设备命令行解释器扩展
.text,.data,.rsrc,.reloc,

Portable Media Devices Menu
[A ] 34. c:\windows\system32\audiodev.dll
Microsoft Corporation
便携媒体设备命令行解释器扩展
.text,.data,.rsrc,.reloc,

WinRAR shell extension
[AM] 35. c:\program files\winrar\rarext.dll
.text,.data,.tls,.idata,.edata,.rsrc,.reloc,

RISING
[AM] 36. c:\windows\system32\ravext.dll
Beijing Rising Technology Co., Ltd.
Rising Shell Ext Module
.text,.rdata,.data,.rsrc,.reloc,

Yahoo!Photo
[A ] 27. c:\program files\yahoo!\assistant\assist\yphtb.dll
Yahoo! China
yPhtb
.text,.rdata,.data,.yPhtbSe,.rsrc,.reloc,

粉碎文件
[AM] 37. c:\program files\yahoo!\assistant\assist\ywiper.dll
Yahoo! China
Wiper 动态链接库
.text,.rdata,.data,.rsrc,.reloc,

+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
{32CD708B-60A7-4C00-9377-D73EAA495F0F}
[AM] 36. c:\windows\system32\ravext.dll
Beijing Rising Technology Co., Ltd.
Rising Shell Ext Module
.text,.rdata,.data,.rsrc,.reloc,

{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}
[AM] 38. c:\windows\system32\shlhook.dll
Beijing Rising Technology Co., Ltd.
shlhook Module
.text,.rdata,.data,.rsrc,.reloc,

xhxokdn - 2007-8-2 22:46:00

【回复“Leoooo”的帖子】

+ 用户登陆自运行项目
+ HKCU\Software\Microsoft\Windows\CurrentVersion\Run
bgswitch
[A ] 39. c:\windows\system32\bgswitch.exe
.text,.data,.rsrc,

+ HKLM\Software\Microsoft\Windows\CurrentVersion\Run
SiSUSBRG
[A ] 40. c:\windows\sisusbrg.exe
Silicon Integrated Systems Corp.
SiSUSBrg
.text,.rdata,.data,.rsrc,

runeip
[AM] 41. c:\program files\rising\antispyware\runiep.exe
Beijing Rising Technology Co., Ltd.
Rising AntiSpyware Monitor
.text,.rdata,.data,.rsrc,

RavTask
[A ] 42. c:\program files\rising\rav\ravtask.exe
Beijing Rising Technology Co., Ltd.
RavTimer
.text,.rdata,.data,.rsrc,

RfwMain
[AM] 43. c:\program files\rising\rfw\rfwmain.exe
Beijing Rising Technology Co., Ltd.
Rising Personal FireWall Main Program
.text,.rdata,.data,.rsrc,

+ 开机执行
+ HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
BootExecute
[A ] 44. c:\windows\system32\bsmain.exe
Beijing Rising Technology Co., Ltd.
BootScan
.text,.data,.rsrc,.reloc,

+ 映像劫持
+ HKCR\.html
htmlfile\Edit\Command
[A ] 45. c:\program files\microsoft office\office\msohtmed.exe
Microsoft Corporation
Microsoft Office 2000 component
.text,.data,.idata,.rsrc,

htmlfile\Print\Command
[A ] 45. c:\program files\microsoft office\office\msohtmed.exe
Microsoft Corporation
Microsoft Office 2000 component
.text,.data,.idata,.rsrc,

+ HKCR\.htm
htmlfile\Edit\Command
[A ] 45. c:\program files\microsoft office\office\msohtmed.exe
Microsoft Corporation
Microsoft Office 2000 component
.text,.data,.idata,.rsrc,

htmlfile\Print\Command
[A ] 45. c:\program files\microsoft office\office\msohtmed.exe
Microsoft Corporation
Microsoft Office 2000 component
.text,.data,.idata,.rsrc,

+ 其他自启动项目
+ C:\Documents and Settings\All Users\「开始」菜单\程序\启动
Microsoft Office.lnk
[A ] 46. c:\program files\microsoft office\office\osa9.exe
Microsoft Corporation
Microsoft Office 2000 component
.text,.data,.rsrc,

+ 正在运行的进程
+ 00000118(280) smss.exe

+ 00000150(336) csrss.exe

+ 00000168(360) winlogon.exe
72C80000[00008000]
[ M] 47. c:\windows\system32\msacm32.drv
Microsoft Corporation
Microsoft Sound Mapper
.text,.data,.rsrc,.reloc,

+ 00000194(404) services.exe

+ 000001a0(416) lsass.exe

+ 00000234(564) svchost.exe

+ 00000260(608) svchost.exe

+ 00000298(664) svchost.exe

+ 000002d4(724) svchost.exe

+ 0000032c(812) svchost.exe

+ 000003e0(992) Explorer.EXE
72C80000[00008000]
[ M] 47. c:\windows\system32\msacm32.drv
Microsoft Corporation
Microsoft Sound Mapper
.text,.data,.rsrc,.reloc,

01BC0000[0001B000]
[ M] 48. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,

10000000[0001B000]
[AM] 36. c:\windows\system32\ravext.dll
Beijing Rising Technology Co., Ltd.
Rising Shell Ext Module
.text,.rdata,.data,.rsrc,.reloc,

02030000[00011000]
[AM] 38. c:\windows\system32\shlhook.dll
Beijing Rising Technology Co., Ltd.
shlhook Module
.text,.rdata,.data,.rsrc,.reloc,

02060000[0004F000]
[AM] 37. c:\program files\yahoo!\assistant\assist\ywiper.dll
Yahoo! China
Wiper 动态链接库
.text,.rdata,.data,.rsrc,.reloc,

020B0000[0002B000]
[AM] 35. c:\program files\winrar\rarext.dll
.text,.data,.tls,.idata,.edata,.rsrc,.reloc,

23700000[0001A000]
[ M] 49. c:\program files\rising\rav\rscommon.dll
Beijing Rising Technology Co., Ltd.
Rising Common Function Dynamic Link Library
.text,.rdata,.data,.rsrc,.reloc,

53000000[00015000]
[ M] 50. c:\program files\yahoo!\assistant\yhelper.dll
Yahoo! China
Helper Module
.text,.rdata,.data,.cnshelp,.rsrc,.reloc,

+ 000004ac(1196) spoolsv.exe

+ 000004f8(1272) ctfmon.exe
10000000[0001B000]
[ M] 48. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,

+ 00000554(1364) wdfmgr.exe
01000000[0000C000]
[AM] 5. c:\windows\system32\wdfmgr.exe
Microsoft Corporation
Windows User Mode Driver Manager
.text,.data,.rsrc,

+ 00000638(1592) RfwMain.exe
00400000[00073000]
[AM] 43. c:\program files\rising\rfw\rfwmain.exe
Beijing Rising Technology Co., Ltd.
Rising Personal FireWall Main Program
.text,.rdata,.data,.rsrc,

26600000[0007D000]
[ M] 51. c:\program files\rising\rfw\rsguilib.dll
Beijing Rising Technology Co., Ltd.
Rising GUI Library Loader
.text,.rdata,.data,.rsrc,.reloc,

23700000[0001A000]
[ M] 52. c:\program files\rising\rfw\rscommon.dll
Beijing Rising Technology Co., Ltd.
Rising Common Function Dynamic Link Library
.text,.rdata,.data,.rsrc,.reloc,

10000000[0000F000]
[ M] 53. c:\program files\rising\rfw\rfwctrl.dll
Beijing Rising Technology Co., Ltd.
RfwCtrl DLL
.text,.rdata,.data,.rsrc,.reloc,

23800000[0001A000]
[ M] 54. c:\program files\rising\rfw\rsxml.dll
Beijing Rising Technology Co., Ltd.
RsXML
.text,.rdata,.data,.rsrc,.reloc,

23900000[00031000]
[ M] 55. c:\program files\rising\rfw\pngdll.dll
Beijing Rising Technology Co., Ltd.
Rising .Png File Loader Dynamic Link Library
.text,.rdata,.data,.rsrc,.reloc,

01310000[0001B000]
[ M] 48. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,

+ 00000780(1920) alg.exe

+ 00000c80(3200) ylive.exe
00400000[00016000]
[ M] 56. c:\program files\yahoo!\assistant\ylive.exe
Yahoo! China
YLive
.text,.rdata,.data,.rsrc,

53000000[00015000]
[ M] 50. c:\program files\yahoo!\assistant\yhelper.dll
Yahoo! China
Helper Module
.text,.rdata,.data,.cnshelp,.rsrc,.reloc,

3C400000[00039000]
[ M] 57. c:\program files\yahoo!\assistant\yalive.dll
yahoo! china
AutoLive Module
.text,.rdata,.data,.ylive_d,.rsrc,.reloc,

40000000[0002A000]
[ M] 58. c:\program files\yahoo!\assistant\yalliveex.dll
Yahoo! China
LiveEx
.text,.rdata,.data,.rsrc,.reloc,

10000000[0001B000]
[ M] 48. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,

40800000[0001A000]
[ M] 59. c:\program files\yahoo!\assistant\ynotifier.dll
yahoo! china
Notifier Module
.text,.rdata,.data,.YahooNT,.rsrc,.reloc,

+ 00000e0c(3596) runiep.exe
00400000[00012000]
[AM] 41. c:\program files\rising\antispyware\runiep.exe
Beijing Rising Technology Co., Ltd.
Rising AntiSpyware Monitor
.text,.rdata,.data,.rsrc,

53000000[00015000]
[ M] 50. c:\program files\yahoo!\assistant\yhelper.dll
Yahoo! China
Helper Module
.text,.rdata,.data,.cnshelp,.rsrc,.reloc,

00C50000[0001B000]
[ M] 48. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,

+ 00000ea0(3744) WINWORD.EXE
30000000[00836000]
[ M] 60. c:\program files\microsoft office\office\winword.exe
Microsoft Corporation
Microsoft Word for Windows
.text,.data,.tls,.CRT,.rsrc,

308C0000[00559000]
[ M] 61. c:\program files\microsoft office\office\mso9.dll
Microsoft Corporation
Microsoft Office 2000 component
.text,.data,.rsrc,.reloc,

53000000[00015000]
[ M] 50. c:\program files\yahoo!\assistant\yhelper.dll
Yahoo! China
Helper Module
.text,.rdata,.data,.cnshelp,.rsrc,.reloc,

10000000[0002D000]
[ M] 62. c:\program files\rising\rav\rsplugin.dll
Beijing Rising Technology Co., Ltd.
RsPlugIn Module
.text,.rdata,.data,.rsrc,.reloc,

01930000[0001B000]
[ M] 48. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,

507C0000[00084000]
[ M] 63. c:\program files\common files\microsoft shared\proof\mslid.dll
Microsoft Corporation
Microsoft Language Identification DLL
.text,.data,.rsrc,.reloc,

02320000[000AB000]
[ M] 64. c:\program files\common files\microsoft shared\proof\wdbrkchs.dll
Microsoft Corporation
Microsoft (R) Simplified Chinese Wordbreaker
.text,.rdata,.data,.idata,.rsrc,.reloc,

+ 00000ebc(3772) Ras.exe
00400000[0013F000]
[ M] 65. c:\program files\rising\antispyware\ras.exe
Beijing Rising Technology Co., Ltd.
Rising AntiSpyware
.text,.rdata,.data,.rsrc,

53000000[00015000]
[ M] 50. c:\program files\yahoo!\assistant\yhelper.dll
Yahoo! China
Helper Module
.text,.rdata,.data,.cnshelp,.rsrc,.reloc,

10000000[000A3000]
[ M] 66. c:\program files\rising\antispyware\rasgui.dll
Beijing Rising Technology Co., Ltd.
RasGUI
.text,.rdata,.data,.rsrc,.reloc,

015D0000[0001B000]
[ M] 48. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,

瑞星卡卡安全论坛