我中了木马,但杀不死,,查不出.【原创】 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛我中了木马,但杀不死,,查不出.【原创】

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

12

1 / 2 页

跳转页

我中了木马,但杀不死,,查不出.【原创】

ackzka 初生襁褓狮帖子:8 注册: 2006-06-02 来自:	发表于： 2006-06-04 23:04 \| 只看楼主短消息资料字号：小中大 1楼我中了木马,但杀不死,,查不出.【原创】我中了木马.木马文件名:C:\WINDOWS\SYSTEM\SVCHOST.EXE 木马名 Trojan.DL.Agent.alb 只有在木马克星中才可以查到,在瑞星2006,18.29.40中查不到,也无法杀死.你们有法子吗? 在DOS中也一样无法杀死, 下线也一样 2006-06-05 00:08:04
ackzka 初生襁褓狮帖子:8 注册: 2006-06-02 来自:	分享到：

我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林	发表于： 2006-06-04 23:03 \| 短消息资料字号：小中大 2楼请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来下载网址 http://www.kztechs.com/sreng/sreng2.zip http://forum.ikaka.com/topic.asp?board=67&artid=5188931 日志一次粘不完，分次粘完，请不要修改。
我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林

ackzka 初生襁褓狮帖子:8 注册: 2006-06-02 来自:	发表于： 2006-06-04 23:20 \| 只看楼主短消息资料字号：小中大 3楼启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <cd9729c21235ab28de41f89afa0d0461><"E:\剑侣奇缘2\xl2dl.exe"> [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <load><> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <CdnCtr><C:\Program Files\CNNIC\Cdn\cdnup.exe> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <IESAddr><> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <KernelFaultCheck><%systemroot%\system32\dumprep 0 -k> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] <RavStub><"C:\Program Files\Rising\Rav\ravstub.exe" /RUNONCE> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <Userinit><C:\WINDOWS\system32\userinit.exe,> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><APIHookDll.dll>
ackzka 初生襁褓狮帖子:8 注册: 2006-06-02 来自:

ackzka 初生襁褓狮帖子:8 注册: 2006-06-02 来自:	发表于： 2006-06-04 23:21 \| 只看楼主短消息资料字号：小中大 4楼启动文件夹 [河南网通宽带用户客户端] <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\河南网通宽带用户客户端.lnk><N> ================================== 服务 [Ati HotKey Poller / Ati HotKey Poller] <C:\WINDOWS\system32\Ati2evxx.exe><N/A> [ATI Smart / ATI Smart] <C:\WINDOWS\system32\ati2sgag.exe><> [Rising Process Communication Center / RsCCenter] <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.> [RsRavMon Service / RsRavMon] <"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
ackzka 初生襁褓狮帖子:8 注册: 2006-06-02 来自:

ackzka 初生襁褓狮帖子:8 注册: 2006-06-02 来自:	发表于： 2006-06-04 23:21 \| 只看楼主短消息资料字号：小中大 5楼浏览器加载项 [CaiShowBH Class] {3AF40CB8-B3BA-4E2D-8968-4BF8DB172997} <C:\Program Files\CaiShow Tech\CaiShow\BrowerHelper.dll, N/A> [雅虎助手] {406F94F0-504F-4a40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll, Yahoo!> [QQBrowserHelperObject Class] {54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司> [CdnForIE Class] {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC> [] {A9930D97-9CF0-42A0-A10D-4F28836579D5} <F:\酷狗\KuGoo3DownXControl.ocx, N/A> [Java Plug-in 1.5.0] {08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll, JavaSoft / Sun Microsystems, Inc.> [CdnForIE Class] {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC> [JUJU猫宽带宝藏论坛] {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} <http://www.jujumao.net, N/A> [易趣购物] {DE607142-AC19-422e-863A-3D70ABDF119A} <http://click2.ad4all.net/url2/urlmanage/url.asp?id=5, N/A> [QQIEFloatBarCfgCmd Class] {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司> [Messenger] {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation> [雅虎助手] {406F94F0-504F-4a40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll, Yahoo!> [系统标准按钮(&E)] {6B2455FD-3669-4555-8DF8-69FD5BC846F8} <C:\WINDOWS\system32\SystemToolbar.dll, N/A> [WUWebControl Class] {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation> [Java Plug-in 1.5.0] {8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll, JavaSoft / Sun Microsystems, Inc.> [Java Plug-in 1.5.0] {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll, JavaSoft / Sun Microsystems, Inc.> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx, Macromedia, Inc.> [Windows Media Player] {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation> [HTML Document] {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A> [CaiShowBH Class] {3AF40CB8-B3BA-4E2D-8968-4BF8DB172997} <C:\Program Files\CaiShow Tech\CaiShow\BrowerHelper.dll, N/A>
ackzka 初生襁褓狮帖子:8 注册: 2006-06-02 来自:

ackzka 初生襁褓狮帖子:8 注册: 2006-06-02 来自:	发表于： 2006-06-04 23:21 \| 只看楼主短消息资料字号：小中大 6楼 [雅虎助手] {406F94F0-504F-4A40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll, Yahoo!> [QQBrowserHelperObject Class] {54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司> [Shell Name Space] {55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A> [CdnForIE Class] {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC> [系统标准按钮(&E)] {6B2455FD-3669-4555-8DF8-69FD5BC846F8} <C:\WINDOWS\system32\SystemToolbar.dll, N/A> [Windows Media Player] {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [MediaComm Class] {7670648D-461B-42AF-BDFE-46D26AF5EFF2} <C:\Program Files\Thunder Network\Thunder\MediaAddin03.dll, Thunder Networking Technologies,LTD> [Microsoft Web 浏览器] {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation> [] {A9930D97-9CF0-42A0-A10D-4F28836579D5} <F:\酷狗\KuGoo3DownXControl.ocx, N/A> [SearchAssistantOC] {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A> [AUDIO__WAV Moniker Class] {CD3AFA7B-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [RealPlayer G2 Control] {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx, Macromedia, Inc.> [ >> 彩信发送 <<] <res://C:\PROGRA~1\MMSASS~1\Mmsass~1.dll/mms.htm, N/A> [&使用迅雷下载] <C:\Program Files\Thunder Network\Thunder\geturl.htm, N/A> [&使用迅雷下载全部链接] <C:\Program Files\Thunder Network\Thunder\getallurl.htm, N/A> [上传到QQ网络硬盘] <F:\QQ\AddToNetDisk.htm, N/A> [使用KuGoo3下载(&K)] <F:\酷狗\KuGoo3DownX.htm, N/A> [添加到QQ自定义面板] <F:\QQ\AddPanel.htm, N/A> [添加到QQ表情] <F:\QQ\AddEmotion.htm, N/A> [用QQ彩信发送该图片] <F:\QQ\SendMMS.htm, N/A> [用炫彩图铃发送该图片] <C:\Program Files\CaiShow Tech\CaiShow\SendMMS.htm, N/A> [雅虎搜索] <res://C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll/246, N/A>
ackzka 初生襁褓狮帖子:8 注册: 2006-06-02 来自:

ackzka 初生襁褓狮帖子:8 注册: 2006-06-02 来自:	发表于： 2006-06-04 23:22 \| 只看楼主短消息资料字号：小中大 7楼正在运行的进程 [PID: 496][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 596][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 628][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 680][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 692][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 876][C:\WINDOWS\system32\Ati2evxx.exe] <N/A><N/A> [C:\WINDOWS\system32\Ati2edxx.dll] <ATI Technologies, Inc.><6, 14, 10, 2494> [PID: 892][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 956][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1024][C:\Program Files\Rising\Rav\CCenter.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3> [PID: 1040][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1172][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1408][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1424][C:\Program Files\Rising\Rav\Ravmond.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 22> [C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 18> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\Program Files\Rising\Rav\RsLog.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20> [C:\Program Files\Rising\Rav\HOOKSYS.dll] <Rising><18, 1, 0, 9> [C:\Program Files\Rising\Rav\Scanner.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30> [C:\Program Files\Rising\Rav\libload.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [C:\Program Files\Rising\Rav\VirusLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [C:\Program Files\Rising\Rav\regmon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6> [C:\Program Files\Rising\Rav\HookWeb.dll] <rising><18, 0, 0, 1> [C:\Program Files\Rising\Rav\MemMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9> [C:\Program Files\Rising\Rav\expscan.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\Program Files\Rising\Rav\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3> [C:\Program Files\Rising\Rav\MailMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [C:\Program Files\Rising\Rav\SpamEng.dll] <N/A><18, 0, 0, 6> [C:\Program Files\Rising\Rav\engine.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 28> [C:\Program Files\Rising\Rav\PostTrt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9> [C:\Program Files\Rising\Rav\UnExe.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11> [C:\Program Files\Rising\Rav\ScanExec.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11> [C:\Program Files\Rising\Rav\ScanEx.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [C:\Program Files\Rising\Rav\NvFile.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7> [C:\Program Files\Rising\Rav\ScanMac.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7> [C:\Program Files\Rising\Rav\ScanSct.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 15> [C:\Program Files\Rising\Rav\Unpacker.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3> [PID: 1436][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)> [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll] <Yahoo!><2, 0, 3, 1023> [F:\酷狗\KuGoo3DownXControl.ocx] <N/A><N/A> [C:\Program Files\CNNIC\Cdn\cdndet.dll] <CNNIC><2, 2, 0, 4> [C:\Program Files\CNNIC\Cdn\cdnspie.dll] <><2, 1, 0, 4> [C:\Program Files\CNNIC\Cdn\imaoe.dll] <CNNIC><2, 2, 0, 1> [C:\Program Files\CNNIC\Cdn\cdnforie.dll] <CNNIC><1, 0, 0, 11> [C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19> [PID: 1648][C:\Program Files\Rising\Rav\RavStub.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [PID: 1792][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)> [PID: 2028][C:\Program Files\CNNIC\Cdn\cdnup.exe] <><2, 3, 0, 8> [C:\Program Files\CNNIC\Cdn\cdndet.dll] <CNNIC><2, 2, 0, 4> [C:\Program Files\CNNIC\Cdn\cdnforie.dll] <CNNIC><1, 0, 0, 11> [C:\Program Files\CNNIC\Cdn\imaoe.dll] <CNNIC><2, 2, 0, 1> [C:\Program Files\CNNIC\Cdn\cdnspie.dll] <><2, 1, 0, 4> [C:\Program Files\CNNIC\Cdn\cdntdns.dll] <CNNIC><2, 2, 0, 3> [PID: 2044][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] <RealNetworks, Inc.><0.1.0.3510> [PID: 120][C:\Program Files\Rising\Rav\RavTask.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22> [C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [PID: 208][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 232][C:\Program Files\Rising\Rav\Ravmon.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 19> [C:\Program Files\Rising\Rav\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 24>
ackzka 初生襁褓狮帖子:8 注册: 2006-06-02 来自:

ackzka 初生襁褓狮帖子:8 注册: 2006-06-02 来自:	发表于： 2006-06-04 23:22 \| 只看楼主短消息资料字号：小中大 8楼 [C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 18> [C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [C:\Program Files\Rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [PID: 484][C:\Program Files\racer-henan-cnc\racer.exe] <Putian Runway><2, 0, 51, 92> [C:\Program Files\CNNIC\Cdn\cdnspie.dll] <><2, 1, 0, 4> [C:\Program Files\CNNIC\Cdn\imaoe.dll] <CNNIC><2, 2, 0, 1> [C:\Program Files\CNNIC\Cdn\cdnforie.dll] <CNNIC><1, 0, 0, 11> [C:\Program Files\CNNIC\Cdn\cdndet.dll] <CNNIC><2, 2, 0, 4> [C:\Program Files\racer-henan-cnc\rwxre.dll] <Mozilla Foundation><1.7.3: 2005040616> [C:\Program Files\racer-henan-cnc\nspr4.dll] <Netscape Communications Corporation><4.5 Beta> [C:\Program Files\racer-henan-cnc\xpcom.dll] <Mozilla Foundation><1.7.3: 2005040616> [C:\Program Files\racer-henan-cnc\nss3.dll] <Netscape Communications Corporation><3.9.1> [C:\Program Files\racer-henan-cnc\softokn3.dll] <Netscape Communications Corporation><3.9.1> [C:\Program Files\racer-henan-cnc\gkgfx.dll] <Mozilla Foundation><1.7.3: 2005040616> [C:\Program Files\racer-henan-cnc\js3250.dll] <Netscape Communications Corporation><4.0> [C:\Program Files\racer-henan-cnc\components\racer_base_comp.dll] <Putian Runway><2,0,47,87> [C:\Program Files\racer-henan-cnc\xpcom_compat.dll] <Mozilla Foundation><1.7.3: 2005040616> [C:\Program Files\racer-henan-cnc\racer_base.dll] <Putian Runway><2,0,47,87> [C:\Program Files\racer-henan-cnc\components\pipnss.dll] <Mozilla Foundation><1.7.3: 2005040616> [C:\Program Files\racer-henan-cnc\components\gklayout.dll] <Mozilla Foundation><1.7.3: 2005040616> [C:\Program Files\racer-henan-cnc\components\jar50.dll] <Mozilla Foundation><1.7.3: 2005040616> [C:\Program Files\racer-henan-cnc\components\xpcom_compat_c.dll] <Mozilla Foundation><1.7.3: 2005040616> [C:\Program Files\racer-henan-cnc\components\racer_ad_comp.dll] <Putian Runway><2,0,47,87> [C:\Program Files\racer-henan-cnc\components\racer_access_dhcpplus.dll] <Putian Runway><2,0,47,87> [C:\Program Files\racer-henan-cnc\dhcpplus.dll] <北京润汇科技有限公司><0, 13, 21, 45> [C:\Program Files\racer-henan-cnc\components\racer_nss4_comp.dll] <Putian Runway><2,0,47,87> [C:\Program Files\racer-henan-cnc\nss4.dll] <北京普天润汇科技有限公司><1, 0, 0, 3> [C:\Program Files\racer-henan-cnc\wpcap.dll] <Politecnico di Torino><3, 0, 0, 18> [C:\Program Files\racer-henan-cnc\pthreadVC.dll] <N/A><N/A> [C:\Program Files\racer-henan-cnc\packet.dll] <Politecnico di Torino><3, 0, 0, 18> [PID: 904][C:\WINDOWS\system32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: dnsrv(bld4act)> [PID: 1232][C:\WINDOWS\system32\conime.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [C:\Program Files\CNNIC\Cdn\cdnspie.dll] <><2, 1, 0, 4> [C:\Program Files\CNNIC\Cdn\imaoe.dll] <CNNIC><2, 2, 0, 1> [C:\Program Files\CNNIC\Cdn\cdnforie.dll] <CNNIC><1, 0, 0, 11> [C:\Program Files\CNNIC\Cdn\cdndet.dll] <CNNIC><2, 2, 0, 4> [PID: 432][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 2940][C:\Program Files\racer-henan-cnc\RacerKp.exe] <北京润汇科技有限公司><1, 0, 0, 1> [C:\Program Files\CNNIC\Cdn\cdnspie.dll] <><2, 1, 0, 4> [C:\Program Files\CNNIC\Cdn\imaoe.dll] <CNNIC><2, 2, 0, 1> [C:\Program Files\CNNIC\Cdn\cdnforie.dll] <CNNIC><1, 0, 0, 11> [C:\Program Files\CNNIC\Cdn\cdndet.dll] <CNNIC><2, 2, 0, 4> [PID: 3284][E:\sreng2\SREng.exe] <Smallfrogs Studio><2.0.12.350> [C:\Program Files\CNNIC\Cdn\cdnspie.dll] <><2, 1, 0, 4> [C:\Program Files\CNNIC\Cdn\imaoe.dll] <CNNIC><2, 2, 0, 1> [C:\Program Files\CNNIC\Cdn\cdnforie.dll] <CNNIC><1, 0, 0, 11> [C:\Program Files\CNNIC\Cdn\cdndet.dll] <CNNIC><2, 2, 0, 4> ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 RSVP UDP Service Provider c:\windows\rsvpsp.dll(N/A, N/A) RSVP TCP Service Provider c:\windows\rsvpsp.dll(N/A, N/A)
ackzka 初生襁褓狮帖子:8 注册: 2006-06-02 来自:

我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林	发表于： 2006-06-04 23:36 \| 短消息资料字号：小中大 9楼关闭所有浏览窗口以及一些不必要的程序运行System Repair Engineer，使用“系统修复，浏览器加载项”来删除以下选项。 [系统标准按钮(&E)] {6B2455FD-3669-4555-8DF8-69FD5BC846F8} <C:\WINDOWS\system32\SystemToolbar.dll, N/A> 删除 C:\WINDOWS\system32\SystemToolbar.dll 你能到C:\WINDOWS\SYSTEM\SVCHOST.EXE找到它吗？ c:\windows\rsvpsp.dll我认为也是有问题的。你这日志有些奇怪你重启后，不要运行木马克星请再扫份报告粘上来。
我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林

ackzka 初生襁褓狮帖子:8 注册: 2006-06-02 来自:	发表于： 2006-06-04 23:40 \| 只看楼主短消息资料字号：小中大 10楼以下是2006中注册表操作中的历史记载: 进程名称路径数值名称数值数据操作日期操作方式操作结果 C:\WINDOWS\system32\rundll32.exe HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE GrpConv grpconv -o 2006-06-01 12:39 修改拒绝修改 C:\Program Files\CNNIC\Cdn\cdnup.exe HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN LocalSystem C:\WINDOWS\system\svchost.exe 2006-06-01 13:14 修改同意修改 C:\Program Files\Iparmor\Iparmor.exe HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN LocalSystem 2006-06-02 12:10 删除同意修改 C:\Program Files\Iparmor\Iparmor.exe HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN LocalSystem 2006-06-02 12:24 删除同意修改 C:\Program Files\CNNIC\Cdn\cdnup.exe HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN LocalSystem C:\WINDOWS\system\svchost.exe 2006-06-02 12:24 修改拒绝修改 C:\Program Files\CNNIC\Cdn\cdnup.exe HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN LocalSystem C:\WINDOWS\system\svchost.exe 2006-06-02 12:24 修改拒绝修改 C:\WINDOWS\system32\msxml4r.exe HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN LoadEWXD C:\WINDOWS\system32\msxml4r.exe 2006-06-02 12:25 修改拒绝修改 C:\Program Files\Common Files\Synacast\SynaLive\PE.exe HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN LocalSystem C:\WINDOWS\system\svchost.exe 2006-06-02 14:44 修改拒绝修改 C:\Program Files\PPLive TV\PPPlayer.exe HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN LocalSystem C:\WINDOWS\system\svchost.exe 2006-06-02 14:50 修改拒绝修改 C:\Program Files\Real\RealPlayer\RealPlay.exe HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN LocalSystem C:\WINDOWS\system\svchost.exe 2006-06-03 00:23 修改同意修改 C:\Program Files\Internet Explorer\IEXPLORE.EXE HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN LocalSystem C:\WINDOWS\system\svchost.exe 2006-06-03 23:11 修改拒绝修改 C:\Program Files\Internet Explorer\iexplore.exe HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN LocalSystem C:\WINDOWS\system\svchost.exe 2006-06-03 23:46 修改拒绝修改 F:\QQGame\QQGame.exe HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN LocalSystem C:\WINDOWS\system\svchost.exe 2006-06-04 00:29 修改同意修改 C:\Program Files\Internet Explorer\IEXPLORE.EXE HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN LocalSystem C:\WINDOWS\system\svchost.exe 2006-06-04 12:25 修改拒绝修改 C:\Program Files\Thunder Network\Thunder\Thunder.exe HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN LocalSystem C:\WINDOWS\system\svchost.exe 2006-06-04 14:38 修改拒绝修改 E:\跑跑卡丁车\M01\NMService.exe HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN LocalSystem C:\WINDOWS\system\svchost.exe 2006-06-04 14:54 修改拒绝修改 F:\qqtv\qqlive.exe HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN LocalSystem C:\WINDOWS\system\svchost.exe 2006-06-04 14:58 修改拒绝修改 F:\qqtv\TVLoge.exe HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN LocalSystem C:\WINDOWS\system\svchost.exe 2006-06-04 14:58 修改拒绝修改 HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN LocalSystem C:\WINDOWS\system\svchost.exe 2006-06-04 15:01 修改拒绝修改 E:\跑跑卡丁车\M01\KartRider.exe HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN LocalSystem C:\WINDOWS\system\svchost.exe 2006-06-04 15:01 修改拒绝修改 HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN LocalSystem C:\WINDOWS\system\svchost.exe 2006-06-04 15:03 修改拒绝修改 HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN LocalSystem C:\WINDOWS\system\svchost.exe 2006-06-04 15:06 修改拒绝修改 HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN LocalSystem C:\WINDOWS\system\svchost.exe 2006-06-04 15:11 修改拒绝修改 C:\Program Files\TianCity\PopKart\M01\NMService.exe HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN LocalSystem C:\WINDOWS\system\svchost.exe 2006-06-04 15:28 修改拒绝修改 C:\Program Files\TianCity\PopKart\M01\NMService.exe HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN LocalSystem C:\WINDOWS\system\svchost.exe 2006-06-04 15:30 修改拒绝修改 F:\qqtv\QQLive.exe HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN LocalSystem C:\WINDOWS\system\svchost.exe 2006-06-04 16:03 修改拒绝修改
ackzka 初生襁褓狮帖子:8 注册: 2006-06-02 来自:

<<上一主题|下一主题>>

12

1 / 2 页

跳转页

页面顶部

Powered by Discuz!NT