只要联网，自动下载病毒库，怎么办 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛只要联网，自动下载病毒库，怎么办

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

1

1 / 1 页

跳转页

只要联网，自动下载病毒库，怎么办

sunboy2 初生襁褓狮帖子:7 注册: 2006-08-11 来自:	发表于： 2007-01-29 11:00 \| 只看楼主短消息资料字号：小中大 1楼只要联网，自动下载病毒库，怎么办一、每次联网后可用瑞星杀到以下病毒： Trojan.PSW.ZhengTu.agf 删除成功 2007-01-29 10:08 C:\Documents and Settings\yin-d\Local Settings\Temp upsy.dll 本机 Trojan.PSW.ZhengTu.agf 删除成功 2007-01-29 10:08 C:\Documents and Settings\yin-d\Local Settings\Temp upsy.exe 本机 Trojan.PSW.WLOnline.ep 删除成功 2007-01-29 10:08 C:\Documents and Settings\yin-d\Local Settings\Temporary Internet Files\Content.IE5\C96PLBRD 7[1].exe 本机 Trojan.PSW.WSgame.bf 删除成功 2007-01-29 10:08 C:\Documents and Settings\yin-d\Local Settings\Temporary Internet Files\Content.IE5\H9VICFQV 1[1].exe 本机 Trojan.PSW.ZhengTu.agf 删除成功 2007-01-29 10:08 C:\Documents and Settings\yin-d\Local Settings\Temporary Internet Files\Content.IE5\RQQ1MVKZ 2[1].exe 本机 Trojan.Agent.amr 删除成功 2007-01-29 10:08 C:\Documents and Settings\yin-d\Local Settings\Temporary Internet Files\Content.IE5\YASGYV80 4[1].exe 本机 Trojan.PSW.WLOnline.ep 删除成功 2007-01-29 10:15 C:\WINDOWS CSRSS.exe 本机 Trojan.PSW.WSgame.bf 删除成功 2007-01-29 10:16 C:\WINDOWS SMSS.EXE 本机 Trojan.PSW.WoWar.wv 删除成功 2007-01-29 10:17 C:\WINDOWS\system32 mppds.dll 本机 Trojan.PSW.Magania.mf 删除成功 2007-01-29 10:18 C:\WINDOWS\system32 wincab.sys 本机 Trojan.PSW.WLOnline.dv 删除成功 2007-01-29 10:18 C:\WINDOWS\system32 windds32.dll>>pecompact2x 本机 Trojan.Agent.amr 删除成功 2007-01-29 10:18 C:\WINDOWS WINLOGON.EXE 本机二、用流氓清理软件，扫描出以下信息： [img][/img] 附件: 文件名:7268152007129105126.jpg 下载次数:540 文件类型:image/pjpeg 文件大小: 上传时间:2007-1-29 11:00:41 描述: 2007-01-29 11:08:08
sunboy2 初生襁褓狮帖子:7 注册: 2006-08-11 来自:	分享到：

sunboy2 初生襁褓狮帖子:7 注册: 2006-08-11 来自:	发表于： 2007-01-29 11:02 \| 只看楼主短消息资料字号：小中大 2楼三、HijackThis扫描记录 Logfile of HijackThis v1.99.1 Scan saved at 10:50:06, on 2007-1-29 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Rising\Rav\CCenter.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Rising\Rav\Ravmond.exe c:\program files\rising\rfw\rfwsrv.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Wave Systems Corp\Common\DataServer.exe C:\Program Files\Rising\Rav\RavStub.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe C:\WINDOWS\Explorer.EXE c:\program files\rising\rfw\RfwMain.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe C:\Program Files\Rising\Rav\RavTask.exe C:\Program Files\Rising\Rav\Ravmon.exe C:\WINDOWS\System32\hpnra.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SecCopy\SecCopy.exe C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe E:\roguecleaner\guardio\Guardio.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Rising\Rav\Rav.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\mspaint.exe C:\WINDOWS\System32\svchost.exe C:\Documents and Settings\yin-d\桌面\HijackThis.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: (no name) - {3CEFF6CD-6F08-4e4d-BCCD-FF7415288C3B}? - (no file) O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup O4 - HKLM\..\Run: [HP Network Registry Agent] C:\WINDOWS\System32\hpnra.exe O4 - HKLM\..\Run: [wsttrs] C:\WINDOWS\SERVICES.EXE O4 - HKLM\..\Run: [syin] C:\WINDOWS\RUNDLL32.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Second Copy] "C:\Program Files\SecCopy\SecCopy.exe" O4 - Startup: 智能实验室-全能优化(Guardio).lnk = E:\roguecleaner\guardio\Guardio.exe O4 - Startup: 智能实验室－杀马(Defendio).lnk = E:\roguecleaner\guardio\Defendio.exe O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?SystemRoot%\Installer\{AC76BA86-2052-0000-7760-100000000002}\SC_Acrobat.exe O4 - Global Startup: EMBASSY Trust Suite Secure Update.lnk = C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: 转换为 Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: 转换为现有 PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: 转换选定的链接为 Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: 转换选定的链接为现有 PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: 转换选项为 Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: 转换选项为现有 PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: 转换链接目标为 Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: 转换链接目标为现有 PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O9 - Extra button: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: 快车 - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: 快车(FlashGet) - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1168561964140 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1169692220078 O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/pcver2007/OL2006.cab O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: DataSvr2 - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Common\DataServer.exe O23 - Service: 杀马清除模块 (DefendioService) - 智能实验室 - E:\roguecleaner\guardio\DefendioService.exe O23 - Service: DNS Manager (DNSver) - Application Service - C:\WINDOWS\system32\IME\DNS.exe O23 - Service: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe O23 - Service: NTRU Hybrid TSS v2.0.25 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe
sunboy2 初生襁褓狮帖子:7 注册: 2006-08-11 来自:

sunboy2 初生襁褓狮帖子:7 注册: 2006-08-11 来自:	发表于： 2007-01-29 11:06 \| 只看楼主短消息资料字号：小中大 3楼四、同时发现会自动生成并运行 C:\WINDOWS\UNINSTALL\rundl132.exe，并且删除后又会自动产生
sunboy2 初生襁褓狮帖子:7 注册: 2006-08-11 来自:

珍珠之城初生襁褓狮帖子:48 注册: 2007-01-29 来自:	发表于： 2007-01-29 11:17 \| 短消息资料字号：小中大 4楼 rundl132.exe属于威金病毒，用江民的专杀工具可以清除。
珍珠之城初生襁褓狮帖子:48 注册: 2007-01-29 来自:

<<上一主题|下一主题>>

1

1 / 1 页

跳转页

页面顶部

Powered by Discuz!NT