瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 急救！系统受功击！(日志已贴上)

1   1  /  1  页   跳转页

急救！系统受功击！(日志已贴上)

收藏
月影传说0
头像
初生襁褓狮
  • 帖子:43
  • 注册: 2004-08-14
  • 来自:
发表于： 2006-06-14 22:55 | 只看楼主 短消息 资料
字号： 小 中 大 1楼

急救！系统受功击！(日志已贴上)

MS-4011 Exploit
名称  Blaster Rpc Exploit  来源  220.249.164.203:3115  目标220.249.188.250:135

一直提示系统漏洞功击，一会就出现，一会就出现

过程：
  数天前发现有病毒，进行杀毒，成功发现三个，而后时而出现，通过DOS下查杀，又发现三个，相同的！机子速度变慢，防火墙老是提示，点击相册就重启机器，启动后显示已从一个严重的错误中复恢，按网上人介绍的方法进行查杀无果，于是把看图软件删去，结果点击WORD时重启，重装WORD后依然，同时点其它应用程序也一样，无奈重装C盘，格式化后装的，结果装好后无法登入，重启正常 ，现次出现瑞星提示有毒，查而无，看到有人说单格系统盘不行，于是全硬盘格式化，重装后就反复提示受到功击```

下面是瑞星的结果！

                 攻击名称       攻击来源        Blaster Rpc Exploit       220.250.19.234:1177        Blaster Rpc Exploit       10.13.129.118:3979        Blaster Rpc Exploit       220.250.0.156:4208        Blaster Rpc Exploit       220.250.29.15:1564        Blaster Rpc Exploit       220.250.29.12:3293        Blaster Rpc Exploit       220.249.163.179:1493        Blaster Rpc Exploit       220.250.20.147:4407        Blaster Rpc Exploit       10.13.145.181:4420           Blaster Rpc Exploit           220.250.9.27:2088 
      Blaster Rpc Exploit 
    220.250.0.116:3396        Blaster Rpc Exploit      10.13.130.70:1850        Blaster Rpc Exploit      10.13.128.79:4503 
      Blaster Rpc Exploit 
    220.250.0.107:3854        MS-4011 Exploit       220.250.0.116:4248        Blaster Rpc Exploit       220.250.10.6:3246        Blaster Rpc Exploit       220.250.29.12:1346        Blaster Rpc Exploit       220.249.162.220:4389        Blaster Rpc Exploit       220.249.169.25:2117        Blaster Rpc Exploit       10.13.128.185:4183        Blaster Rpc Exploit       220.250.9.27:4022        MS-4011 Exploit       10.13.130.70:3735        Blaster Rpc Exploit       220.249.189.200:3227        MS-4011 Exploit       220.250.10.200:2078        Blaster Rpc Exploit       220.250.0.62:1375        Blaster Rpc Exploit       220.249.168.43:3193        Blaster Rpc Exploit       220.250.9.78:3865        Blaster Rpc Exploit       10.13.17.181:2638        Blaster Rpc Exploit       10.13.17.181:3971        Blaster Rpc Exploit       220.250.0.62:1535        Blaster Rpc Exploit       220.250.5.55:4952        MS-4011 Exploit       10.13.66.147:1578         Blaster Rpc Exploit       10.13.131.12:2845  !      MS-4011 Exploit  !     220.250.5.55:3247  "      Blaster Rpc Exploit  "     10.13.130.70:2719  #      MS-4011 Exploit  #     10.13.130.70:3079  $      Blaster Rpc Exploit  $     220.249.176.11:3801  %      MS-4011 Exploit  %     220.249.176.11:2898  &      Blaster Rpc Exploit  &     220.250.9.78:1693  '      Blaster Rpc Exploit  '     220.250.2.142:1497  (      Blaster Rpc Exploit  (     220.249.176.11:2202  )      Blaster Rpc Exploit  )     10.13.66.147:2537  *      Blaster Rpc Exploit  *     220.250.16.27:2538  +      Blaster Rpc Exploit  +     220.250.18.18:2228  ,      Blaster Rpc Exploit  ,     10.13.130.13:3516  -      Blaster Rpc Exploit  -     220.249.168.182:4719  .      Blaster Rpc Exploit  .     220.249.169.240:3898  /      Blaster Rpc Exploit  /     10.13.131.69:1598  0      Blaster Rpc Exploit  0     220.250.0.13:2259  1      MS-4011 Exploit  1     220.249.186.132:1631  2      Blaster Rpc Exploit  2     220.249.169.12:3414  3      Blaster Rpc Exploit  3     220.249.169.12:3416  4      Blaster Rpc Exploit  4     220.249.169.12:3452  5      Blaster Rpc Exploit  5     220.249.186.132:1512  6      Blaster Rpc Exploit  6     220.249.169.12:1471  7      Blaster Rpc Exploit  7     10.13.2.174:2172  8      Blaster Rpc Exploit  8     220.249.169.12:2508  9      Blaster Rpc Exploit  9     10.13.2.174:3371  :      Blaster Rpc Exploit  :     220.249.169.12:2651  ;      Blaster Rpc Exploit  ;     220.249.176.108:1161  <      Blaster Rpc Exploit  <     220.249.176.108:2208  =      MS-4011 Exploit  =     220.249.186.132:3437  >      Blaster Rpc Exploit  >     220.249.164.203:3115  ?      Blaster Rpc Exploit  ?     220.249.188.13:2238  @      Blaster Rpc Exploit  @     220.249.181.161:1305  A      Blaster Rpc Exploit  A     220.249.169.12:1790  B      Blaster Rpc Exploit  B     220.249.162.221:4633  C      Blaster Rpc Exploit  C     10.13.128.79:2059  D      Blaster Rpc Exploit  D     220.249.176.11:4209  E      Blaster Rpc Exploit  E     220.249.184.54:4843  F      Blaster Rpc Exploit  F     220.249.186.122:1211
最后编辑2006-06-15 12:53:48
分享到：
gototop
 
我无邪
头像
高贵耄耋狮
  • 帖子:20720
  • 注册: 2004-06-10
  • 来自:广西玉林
发表于： 2006-06-14 23:02 | 短消息 资料
字号： 小 中 大 2楼

请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。
gototop
 
月影传说0
头像
初生襁褓狮
  • 帖子:43
  • 注册: 2004-08-14
  • 来自:
发表于： 2006-06-14 23:12 | 只看楼主 短消息 资料
字号： 小 中 大 3楼

2006-06-14,23:00:37

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 1 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe>  [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup>  [Beijing Rising Technology Corporation Limited]
    <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
    <stup.exe><C:\PROGRA~1\TENCENT\Adplus\stup.exe>  [Tencent]
    <MSConfig><C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll>  [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <AddrPlus3><; C:\PROGRA~1\TENCENT\Adplus\stup.exe C:\PROGRA~1\TENCENT\Adplus\Adplus1.dll Rundll32>  [Tencent]
    <IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [Microsoft Corporation]
    <msnappau><; "C:\Program Files\MSN Apps\Updater\01.03.0000.1005\zh-cn\msnappau.exe">  [Microsoft Corporation]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <MsnMsgr><; "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <PHIME2002A><; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [Microsoft Corporation]
    <PHIME2002ASync><; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [Microsoft Corporation]

==================================
启动文件夹
服务
[NetBTD(ntbtd) / NetBTD]
  <"C:\WINDOWS\system32\netbtd.exe"><Microsoft Corporation>
[Rising Personal Firewall Service / RfwService]
  <c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Corporation Limited>
[Rising Process Communication Center / RsCCenter]
  <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
  <"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>

==================================
浏览器加载项
[Tencent Browser Helper]
  {0C7C23EF-A848-485B-873C-0ED954731014} <C:\Program Files\TENCENT\Adplus\SSAddr1.dll, Tencent>
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <d:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[ST]
  {9394EDE7-C8B5-483E-8773-474BF36AF6E4} <C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll, Microsoft Corporation>
[MSNToolBandBHO]
  {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} <C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\zh-cn\msntb.dll, Microsoft Corporation>
[bho Class]
  {ED8DFC5C-10EF-45AB-9DC2-0639AFF5A270} <C:\PROGRA~1\COMMON~1\Wnwb\wnwbio.dll, 深圳世强软件开发部>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <d:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
  {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <d:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[CopySo拷贝搜]
  {40987A5C-6AB8-4977-8BE9-A8889DE2EDCC} <C:\Program Files\Copyso\CopysoIE.dll, 深圳世强软件开发部 www.CopySo.com >
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[MSN]
  {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} <C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\zh-cn\msntb.dll, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash8b.ocx, Macromedia, Inc.>
[上传到QQ网络硬盘]
  <D:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
  <D:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <D:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <D:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 424][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 480][\??\C:\WINDOWS\system32\csrss.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 512][\??\C:\WINDOWS\system32\winlogon.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 556][C:\WINDOWS\system32\services.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 568][C:\WINDOWS\system32\lsass.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 732][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 784][C:\Program Files\Rising\Rav\CCenter.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 800][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 900][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 988][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1004][C:\Program Files\Rising\Rav\Ravmond.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 1, 22>
    [C:\Program Files\Rising\Rav\BWList.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 18>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [C:\Program Files\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\RsLog.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20>
    [C:\Program Files\Rising\Rav\HOOKSYS.dll]  <Rising><18, 1, 0, 9>
    [C:\Program Files\Rising\Rav\Scanner.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30>
    [C:\Program Files\Rising\Rav\libload.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\VirusLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\regmon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
    [C:\Program Files\Rising\Rav\HookWeb.dll]  <rising><18, 0, 0, 1>
    [C:\Program Files\Rising\Rav\MemMon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
    [C:\Program Files\Rising\Rav\expscan.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\mPorts.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
    [C:\Program Files\Rising\Rav\MailMon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
    [C:\Program Files\Rising\Rav\SpamEng.dll]  <N/A><18, 0, 0, 6>
    [C:\Program Files\Rising\Rav\engine.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 28>
    [C:\Program Files\Rising\Rav\UnExe.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\Rising\Rav\PostTrt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
gototop
 
月影传说0
头像
初生襁褓狮
  • 帖子:43
  • 注册: 2004-08-14
  • 来自:
发表于： 2006-06-14 23:13 | 只看楼主 短消息 资料
字号： 小 中 大 4楼

[C:\Program Files\Rising\Rav\ScanExec.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\Rising\Rav\ScanEx.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\NvFile.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
    [C:\Program Files\Rising\Rav\ScanMac.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
    [C:\Program Files\Rising\Rav\ScanSct.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 15>
    [C:\Program Files\Rising\Rav\Unpacker.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
    [C:\Program Files\Rising\Rav\ExtOLE.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[PID: 1108][c:\program files\rising\rfw\rfwsrv.exe]  <Beijing Rising Technology Corporation Limited><3, 1, 0, 33>
    [c:\program files\rising\rfw\Rfwdrv.dll]  <Beijing Rising Technology Corporation Limited><3, 0, 1, 5>
    [c:\program files\rising\rfw\rfwrule.dll]  <Beijing Rising Technology Corporation Limited><3, 1, 0, 0>
    [c:\program files\rising\rfw\rfwlog.dll]  <Beijing Rising Technology Corporation Limited><3, 1, 0, 2>
[PID: 1304][C:\WINDOWS\system32\spoolsv.exe]  <Microsoft Corporation><5.1.2600.0 (XPClient.010817-1148)>
[PID: 1444][C:\WINDOWS\system32\mnsec.exe]  <Microsoft Corporation><6.0.0.1.2>
[PID: 1540][C:\Program Files\Rising\Rav\RavStub.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 1552][C:\WINDOWS\system32\netbtd.exe]  <Microsoft Corporation><5, 1 2600, 0 (windows client)>
[PID: 1884][C:\WINDOWS\System32\wdfmgr.exe]  <Microsoft Corporation><5.2.3790.1230 built by: dnsrv(bld4act)>
[PID: 184][C:\WINDOWS\Explorer.EXE]  <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
    [C:\WINDOWS\system32\RavExt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
    [C:\Program Files\TENCENT\Adplus\Adplus1.dll]  <Tencent><4, 0, 9, 90>
    [C:\Program Files\TENCENT\Adplus\SSAddr1.dll]  <Tencent><4, 0, 9, 90>
    [d:\Program Files\WinRAR\rarext.dll]  <N/A><N/A>
    [C:\Program Files\wnwb2005\WNMKEY.DLL]  <深圳世强软件开发部 www.wnwb.com ><2005, 7, 5, 1>
[PID: 604][C:\Program Files\Rising\Rav\RavTask.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [C:\Program Files\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
[PID: 1072][C:\Program Files\Rising\Rav\Ravmon.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 1, 19>
    [C:\Program Files\Rising\Rav\RsGuiLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 24>
    [C:\Program Files\Rising\Rav\BWList.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 18>
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [C:\Program Files\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\Program Files\Rising\Rav\PngDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
    [C:\Program Files\TENCENT\Adplus\Adplus1.dll]  <Tencent><4, 0, 9, 90>
[PID: 1388][C:\Program Files\MSN Apps\Updater\01.03.0000.1005\zh-cn\msnappau.exe]  <Microsoft Corporation><01.02.3000.1001>
    [C:\Program Files\MSN Apps\Updater\01.03.0000.1005\zh-cn\au_util.dll]  <Microsoft Corporation><01.02.3000.1001>
    [C:\Program Files\MSN Apps\Updater\01.03.0000.1005\zh-cn\TBDwnMgr.dll]  <Microsoft Corporation><01.02.3000.1001>
    [C:\Program Files\TENCENT\Adplus\Adplus1.dll]  <Tencent><4, 0, 9, 90>
[PID: 1612][C:\WINDOWS\System32\ctfmon.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
    [C:\Program Files\TENCENT\Adplus\Adplus1.dll]  <Tencent><4, 0, 9, 90>
[PID: 1732][D:\Program Files\Tencent\QQ\QQ.exe]  <TENCENT><0, 0, 0, 0>
    [D:\Program Files\Tencent\QQ\QQBaseClassInDll.dll]  <><1, 0, 0, 1>
    [D:\Program Files\Tencent\QQ\QQHelperDll.dll]  <><1, 0, 0, 1>
    [D:\Program Files\Tencent\QQ\BasicCtrlDll.dll]  <Tencent><5, 0, 200, 160>
    [C:\Program Files\TENCENT\Adplus\Adplus1.dll]  <Tencent><4, 0, 9, 90>
    [D:\Program Files\Tencent\QQ\QQAPI.dll]  <><1, 0, 0, 1>
    [d:\Program Files\Tencent\QQ\TIMProxy.dll]  <tencent><0, 3, 2, 4>
    [D:\Program Files\Tencent\QQ\LoginCtrl.dll]  <><1, 0, 0, 1>
    [D:\Program Files\Tencent\QQ\npkcntc.dll]  <INCA Internet Co., Ltd.><2006, 3, 2, 1>
    [D:\Program Files\Tencent\QQ\npkpdb.dll]  <INCA Internet Co., Ltd.><2003, 10, 1, 1>
    [D:\Program Files\Tencent\QQ\QQRes.dll]  <tencent><1, 0, 0, 1>
    [D:\Program Files\Tencent\QQ\QQMainFrame.dll]  <N/A><N/A>
    [D:\Program Files\Tencent\QQ\CQQApplication.dll]  <N/A><N/A>
    [D:\Program Files\Tencent\QQ\NewSkin.dll]  <><1, 0, 0, 1>
    [D:\Program Files\Tencent\QQ\HostingMgr.dll]  <><1, 0, 0, 1>
    [D:\Program Files\Tencent\QQ\CameraDll.dll]  <><1, 0, 0, 1>
    [D:\Program Files\Tencent\QQ\MailSummary.dll]  <><1, 0, 0, 1>
    [D:\Program Files\Tencent\QQ\QQSpace.dll]  <><1, 0, 0, 1>
    [C:\WINDOWS\System32\msdmo.dll]  <N/A><N/A>
    [D:\Program Files\Tencent\QQ\QQGroupMng.dll]  <><1, 0, 0, 1>
    [D:\Program Files\Tencent\QQ\GroupLive.dll]  <N/A><N/A>
    [D:\Program Files\Tencent\QQ\UserDefinedHead.dll]  <><1, 0, 0, 1>
    [D:\Program Files\Tencent\QQ\QQPlugin.dll]  <N/A><N/A>
    [D:\Program Files\Tencent\QQ\QQAllInOne.dll]  <N/A><N/A>
    [D:\Program Files\Tencent\QQ\SCCore.dll]  <N/A><N/A>
    [D:\Program Files\Tencent\QQ\QQCustomFace.dll]  <N/A><N/A>
    [D:\Program Files\Tencent\QQ\QQPet.dll]  <><1, 0, 0, 1>
    [D:\Program Files\Tencent\QQ\QQSysMsgMng.dll]  <N/A><N/A>
    [D:\Program Files\Tencent\QQ\QQConfigPlugin.dll]  <><1, 0, 0, 1>
    [D:\Program Files\Tencent\QQ\FlashAvatarDll.dll]  <><1, 4, 0, 1>
    [D:\Program Files\Tencent\QQ\QQAvatar.dll]  <N/A><N/A>
    [D:\Program Files\Tencent\QQ\QRingMng.dll]  <N/A><N/A>
    [D:\Program Files\Tencent\QQ\QQMagicFace.dll]  <><1, 0, 0, 1>
    [D:\Program Files\Tencent\QQ\QQSceneMng.dll]  <N/A><N/A>
    [D:\Program Files\Tencent\QQ\PhoneAPI.dll]  <><1, 0, 0, 1>
    [D:\Program Files\Tencent\QQ\DialerAllinOne.dll]  <tencent><1, 4, 0, 0>
    [D:\Program Files\Tencent\QQ\LongConnection.dll]  <tencent><5, 0, 200, 160>
    [C:\WINDOWS\System32\WNWBIO.IME]  <深圳世强软件开发部 www.wnwb.com ><2005, 1, 31, 1>
    [C:\Program Files\wnwb2005\WNMKEY.DLL]  <深圳世强软件开发部 www.wnwb.com ><2005, 7, 5, 1>
    [D:\Program Files\Tencent\QQ\BQQApplication.dll]  <N/A><N/A>
    [D:\Program Files\Tencent\QQ\PersonalDesktop.dll]  <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2>
    [D:\Program Files\Tencent\QQ\CommercesMng.dll]  <><1, 0, 0, 1>
    [D:\Program Files\Tencent\QQ\QQUdpGetFileLib.dll]  <tencent><0, 2, 2, 3>
    [D:\Program Files\Tencent\QQ\QQAddr.dll]  <深圳市腾讯计算机系统有限公司><5, 0, 101, 200>
    [D:\Program Files\Tencent\QQ\QQPhoneHelper.dll]  <腾讯科技（深圳）有限公司><2, 0, 4, 40>
    [D:\Program Files\Tencent\QQ\ImageOle.dll]  <TODO: <Company name>><1.0.0.1>
    [D:\Program Files\Tencent\QQ\GroupConnection.dll]  <Tencent><5, 0, 202, 170>
    [D:\Program Files\Tencent\QQ\QQZip.dll]  <tencent><0, 3, 2, 4>
[PID: 1744][D:\Program Files\Tencent\QQ\TIMPlatform.exe]  <tencent><0, 3, 1, 8>
    [C:\Program Files\TENCENT\Adplus\Adplus1.dll]  <Tencent><4, 0, 9, 90>
    [d:\Program Files\Tencent\QQ\TIMProxy.dll]  <tencent><0, 3, 2, 4>
[PID: 3192][C:\WINDOWS\System32\conime.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 3816][C:\Program Files\wnwb2005\wnwb.exe]  <深圳世强软件开发部 www.wnwb.com ><2005, 11, 19, 1>
    [C:\Program Files\TENCENT\Adplus\Adplus1.dll]  <Tencent><4, 0, 9, 90>
    [C:\Program Files\wnwb2005\WNMKEY.DLL]  <深圳世强软件开发部 www.wnwb.com ><2005, 7, 5, 1>
[PID: 4064][C:\WINDOWS\system32\nvsec.exe]  <Microsoft Corporation><6.0.0.1.2>
[PID: 4840][C:\Program Files\Rising\Rav\RsAgent.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
    [C:\Program Files\TENCENT\Adplus\Adplus1.dll]  <Tencent><4, 0, 9, 90>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
[PID: 4872][C:\WINDOWS\msagent\AgentSvr.exe]  <Microsoft Corporation><2.00.0.3422>
    [C:\Program Files\TENCENT\Adplus\Adplus1.dll]  <Tencent><4, 0, 9, 90>
[PID: 5320][C:\Program Files\Internet Explorer\iexplore.exe]  <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
    [C:\Program Files\TENCENT\Adplus\Adplus1.dll]  <Tencent><4, 0, 9, 90>
    [C:\Program Files\TENCENT\Adplus\SSAddr1.dll]  <Tencent><4, 0, 9, 90>
    [C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\zh-cn\msntb.dll]  <Microsoft Corporation><01.02.5000.1021>
    [C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\zh-cn\mtbres.dll]  <Microsoft Corporation><01.02.5000.1021>
    [d:\Program Files\Tencent\QQ\QQIEHelper.dll]  <深圳市腾讯计算机系统有限公司><1, 1, 0, 5>
    [C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll]  <Microsoft Corporation><01.02.3000.1001>
    [C:\PROGRA~1\COMMON~1\Wnwb\wnwbio.dll]  <深圳世强软件开发部><2005, 8, 30, 1>
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
    [C:\Program Files\wnwb2005\WNMKEY.DLL]  <深圳世强软件开发部 www.wnwb.com ><2005, 7, 5, 1>
    [C:\WINDOWS\System32\WNWBIO.IME]  <深圳世强软件开发部 www.wnwb.com ><2005, 1, 31, 1>
    [C:\WINDOWS\System32\Macromed\Flash\Flash8b.ocx]  <Macromedia, Inc.><8,0,24,0>
[PID: 6136][C:\DOCUME~1\HUANGJ~1\LOCALS~1\Temp\Rar$EX00.652\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>
    [C:\Program Files\TENCENT\Adplus\Adplus1.dll]  <Tencent><4, 0, 9, 90>

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
gototop
 
月影传说0
头像
初生襁褓狮
  • 帖子:43
  • 注册: 2004-08-14
  • 来自:
发表于： 2006-06-14 23:23 | 只看楼主 短消息 资料
字号： 小 中 大 5楼

这是瑞星的结果不知有没有用！

附件附件:

下载次数:219
文件类型:application/octet-stream
文件大小:
上传时间:2006-6-14 23:23:11
描述:
gototop
 
月影传说0
头像
初生襁褓狮
  • 帖子:43
  • 注册: 2004-08-14
  • 来自:
发表于： 2006-06-14 23:29 | 只看楼主 短消息 资料
字号： 小 中 大 6楼

,,

附件附件:

下载次数:217
文件类型:application/octet-stream
文件大小:
上传时间:2006-6-14 23:29:03
描述:
gototop
 
mopery
头像
卡卡技术团队
  • 帖子:17737
  • 注册: 2005-12-06
  • 来自:New York
卡卡名人堂论坛9周年纪念
发表于： 2006-06-15 00:48 | 短消息 资料
字号： 小 中 大 7楼

打全系统补丁就行了...
gototop
 
我无邪
头像
高贵耄耋狮
  • 帖子:20720
  • 注册: 2004-06-10
  • 来自:广西玉林
发表于： 2006-06-15 12:58 | 短消息 资料
字号： 小 中 大 8楼

进入控制面版的添加删除程序中卸载，搜搜地址栏搜索(QQ搜索小助手
双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示确定更改时，单击“是”，清除“隐藏已知文件类型的扩展名

运行System Repair Engineer，点“启动项目，服务，点“Win32服务应用程序”勾选“隐藏微软服务”选中病毒服务NetBTD(ntbtd)，选择“删除服务”点“设置”选择“否”最后重启
重启后删除
C:\WINDOWS\system32\netbtd.exe
C:\Program Files\TENCENT\Adplus
关系系统漏洞问题，建议你开启系统的自动更新，让系统自动安装所有关键更新补丁。
gototop
 
lansely
头像
初生襁褓狮
  • 帖子:539
  • 注册: 2006-03-24
  • 来自:
发表于： 2006-06-15 13:01 | 短消息 资料
字号： 小 中 大 9楼

还是振荡波？
gototop
 
<<上一主题|下一主题>>
1   1  /  1  页   跳转页
页面顶部
Powered by Discuz!NT