★求助★病毒Trojan.DL.Agent.jer怎么也杀不掉,帖子里有SRENG.log. - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛 ★求助★病毒Trojan.DL.Agent.jer怎么也杀不掉,帖子里有SRENG.log.

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

1

1 / 1 页

跳转页

★求助★病毒Trojan.DL.Agent.jer怎么也杀不掉,帖子里有SRENG.log.

gongwith 初生襁褓狮帖子:48 注册: 2006-06-26 来自:	发表于： 2006-06-26 16:11 \| 只看楼主短消息资料字号：小中大 1楼 ★求助★病毒Trojan.DL.Agent.jer怎么也杀不掉,帖子里有SRENG.log. Trojan.DL.Agent.jer反复被监控发现并提示已经删除,可是还是老出，而且越来越频繁了,瑞星刚升级过,没用,安全模式下杀毒后也没用，还是有该病毒,LOG如下: 2006-06-26,15:45:56 System Repair Engineer 2.0.21.505 (2.0 RC 2) Smallfrogs (http://www.KZTechs.com) Windows XP Professional Service Pack 1 (Build 2600) - 管理权限用户 - 完整功能以下内容被选中：所有的启动项目（包括注册表、启动文件夹、服务等）浏览器加载项正在运行的进程（包括进程模块信息）文件关联启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [Microsoft Corporation] <MSMSGS><"C:\Program Files\Messenger\MSMSGS.EXE" /background> [Microsoft Corporation] <cd9729c21235ab28de41f89afa0d0461><"C:\Documents and Settings\Administrator\桌面\xl2dl.exe"> [] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <load><> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation] <PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation] <PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation] <SoundMAXPnP><C:\Program Files\Analog Devices\Core\smax4pnp.exe> [Analog Devices, Inc.] <IgfxTray><C:\WINDOWS\System32\igfxtray.exe> [Intel Corporation] <HotKeysCmds><C:\WINDOWS\System32\hkcmd.exe> [Intel Corporation] <Persistence><C:\WINDOWS\System32\igfxpers.exe> [Intel Corporation] <SunJavaUpdateSched><C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe> [] <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.] <helper.dll><C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32> [] <CnsMin><Rundll32.exe C:\WINDOWS\DOWNLO~1\CnsMin.dll,Rundll32> [北京三七二一科技有限公司] <RavTask><"d:\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.] <RfwMain><"d:\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.] <NMGameX_AutoRun><C:\WINDOWS\System32\Rundll32.exe NMGameX.dll,LiveProcess /aa> [NMGameX] <YLive.exe><C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe> [ ] <yassistse><"C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"> [Yahoo!] <KernelFaultCheck><%systemroot%\system32\dumprep 0 -k> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [Microsoft Corporation] <Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <UIHost><logonui.exe> [Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.] <{D157330A-9EF3-49F8-9A67-4141AC41ADD4}><C:\WINDOWS\DOWNLO~1\CnsHook.dll> [北京三七二一科技有限公司] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] <WinlogonNotify: igfxcui><igfxdev.dll> [Intel Corporation] 2006-06-26 18:55:02.543000000
gongwith 初生襁褓狮帖子:48 注册: 2006-06-26 来自:	分享到：

gongwith 初生襁褓狮帖子:48 注册: 2006-06-26 来自:	发表于： 2006-06-26 16:13 \| 只看楼主短消息资料字号：小中大 2楼 ================================== 启动文件夹 [IE-BAR] <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\IE-BAR.lnk><N> [Microsoft Office] <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Microsoft Office.lnk><N> [Symantec Fax Starter Edition Port] <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Symantec Fax Starter Edition Port.lnk><N> ================================== 服务 [Rising Proxy Service / RfwProxySrv] <d:\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.> [Rising Personal Firewall Service / RfwService] <d:\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.> [Rising Process Communication Center / RsCCenter] <"d:\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.> [RsRavMon Service / RsRavMon] <"d:\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.> ================================== 浏览器加载项 [Yahoo! Toolbar Helper] {02478D38-C3F9-4EFB-9B51-7695ECA05670} <C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll, Yahoo! Inc.> [BrowserHelper Class] {2D99E8F4-56B7-457B-9A92-61B5D247D263} <C:\WINDOWS\System32\WinDefendor.dll, TODO: <公司名>> [Yahoo!Photo] {33BBE430-0E42-4f12-B075-8D21ACB10DCB} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll, Yahoo! China> [AntiFish Class] {38928D50-8A48-44C2-945F-D2F23F771410} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll, Yahoo.> [雅虎助手] {406F94F0-504F-4a40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll, Yahoo!> [] {4FCE0A2B-6D48-4B22-AD7A-1ACACABC0B38} <C:\WINDOWS\system32\ODBINST.dll, N/A> [QQBrowserHelperObject Class] {54EBD53A-9BC1-480B-966A-843A333CA162} <D:\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司> [DragSearch BHO] {62EED7C6-9F02-42f9-B634-98E2899E147B} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL, > [Thunder Browser Helper] {889D2FEB-5411-4565-8998-1DD2C5261283} <d:\Thunder\ComDlls\XunLeiBHO_001.dll, Thunder Networking Technologies,LTD> [Google Toolbar Helper] {AA58ED58-01DD-4d91-8333-CF10577473F7} <c:\program files\google\googletoolbar1.dll, Google Inc.> [CnsHook Class] {D157330A-9EF3-49F8-9A67-4141AC41ADD4} <C:\WINDOWS\DOWNLO~1\CnsHook.dll, 北京三七二一科技有限公司> [免费精彩视频超流畅在线观看] {022C4009-5283-4365-97BF-144054B40E2E} <http://itv.mop.com, N/A> [Web Browser Applet Control] {08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\WINDOWS\System32\msjava.dll, Microsoft Corporation> [新浪UC] {2253922F-1B26-4C74-8B57-E3AEE748DBB8} <C:\Program Files\sina\UC\uc.exe, 北京新浪信息技术有限公司> [Yahoo 1G电邮] {507F9113-CD77-4866-BA92-0E86DA3D0B97} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail, N/A> [寻宝乐趣多] {59BC54A2-56B3-44a0-93E5-432D58746E26} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao, N/A> [雅虎助手] {5D73EE86-05F1-49ed-B850-E423120EC338} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist, N/A> [@shdoclc.dll,-866] {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A> [QQ] {c95fe080-8f5d-11d2-a20b-00aa003c157b} <D:\QQ\QQ.EXE, TENCENT> [QQIEFloatBarCfgCmd Class] {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <D:\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司> [情景聊天] {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg, N/A> [] {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair, N/A> [Messenger] {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\MSMSGS.EXE, Microsoft Corporation> [] {FD00D911-7529-4084-9946-A29F1BDF4FE5} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean, N/A> [同花顺] {39852EFE-325B-45ef-9A60-3DBECD2DDDD5} <C:\WINDOWS\System32\thsbar.dll, í??¨?3> [&Google] {2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar1.dll, Google Inc.> [卡卡上网安全助手] {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\System32\KakaTool.dll, Beijing Rising Technology Co., Ltd.> [BitComet工具栏] {3F1ABCDB-A875-46c1-8345-B72A4567E486} <d:\BitComet\BitCometBar\BitCometBar0.6.dll, N/A> [Yahoo! Toolbar] {EF99BD32-C1FB-11D2-892F-0090271D4F88} <C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll, Yahoo! Inc.> [电台(&R)] {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation> [雅虎助手] {406F94F0-504F-4a40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll, Yahoo!> [Java Plug-in 1.4.2_03] {8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll, JavaSoft / Sun Microsystems, Inc.> [Java Plug-in 1.4.2_03] {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} <C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll, JavaSoft / Sun Microsystems, Inc.> [&使用迅雷下载] <d:\Thunder\Program\GetUrl.htm, N/A> [&使用迅雷下载全部链接] <d:\Thunder\Program\GetAllUrl.htm, N/A> [Google 搜索(&G)] <res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html, N/A> [上传到QQ网络硬盘] <D:\QQ\AddToNetDisk.htm, N/A> [反向链接] <res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html, N/A> [添加到QQ自定义面板] <D:\QQ\AddPanel.htm, N/A> [添加到QQ表情] <D:\QQ\AddEmotion.htm, N/A> [添加到雅虎订阅(&Y)] <res://C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yrss.dll/YRSSMENUEXT, N/A> [用QQ彩信发送该图片] <D:\QQ\SendMMS.htm, N/A> [类似网页] <res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html, N/A> [缓存的网页快照] <res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html, N/A> [翻译英文字词(&T)] <res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html, N/A> [雅虎搜索] <res://C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll/246, N/A> ==================================
gongwith 初生襁褓狮帖子:48 注册: 2006-06-26 来自:

gongwith 初生襁褓狮帖子:48 注册: 2006-06-26 来自:	发表于： 2006-06-26 16:14 \| 只看楼主短消息资料字号：小中大 3楼【回复“gongwith”的帖子】================================== 正在运行的进程 [PID: 580][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)> [PID: 644][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 668][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)> [PID: 720][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 732][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)> [PID: 912][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 1004][d:\Rising\Rav\CCenter.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3> [PID: 1020][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 1296][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 1380][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 1452][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)> [C:\WINDOWS\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1> [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 1, 1018> [C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324> [C:\PROGRA~1\3721\alrex.dll] <><1, 0, 1, 1001> [C:\WINDOWS\DOWNLO~1\CnsHook.dll] <北京三七二一科技有限公司><1, 0, 2, 7> [C:\PROGRA~1\Yahoo!\ASSIST~1\YAlive.dll] <><2, 1, 5, 1045> [C:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll] < ><2, 0, 1, 1007> [C:\PROGRA~1\3721\autolive.dll] <><1, 1, 5, 1324> [d:\Thunder\ComDlls\XunLeiBHO_001.dll] <Thunder Networking Technologies,LTD><5, 0, 0, 1> [C:\WINDOWS\System32\divxa32.acm] <Kristal Studi><4.2.00.000> [d:\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\WINDOWS\System32\msdmo.dll] <N/A><N/A> [C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21> [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\ywiper.dll] <N/A><1, 0, 1, 1014> [C:\Program Files\WinRAR\rarext.dll] <N/A><N/A> [C:\WINDOWS\System32\igfxpph.dll] <Intel Corporation><3.0.0.4299> [C:\WINDOWS\System32\hccutils.DLL] <Intel Corporation><3.0.0.4299> [C:\WINDOWS\System32\igfxres.dll] <Intel Corporation><3.0.0.4299> [C:\WINDOWS\System32\igfxress.dll] <Intel Corporation><3.0.0.4299> [C:\WINDOWS\System32\igfxsrvc.dll] <Intel Corporation><3.0.0.4299> [C:\WINDOWS\System32\WinDefendor.dll] <TODO: <公司名>><1.0.0.2> [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll] <Yahoo! China><1, 1, 3, 1035> [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll] <Yahoo!><2, 1, 8, 1048> [C:\WINDOWS\system32\ODBINST.dll] <N/A><N/A> [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL] <><1, 2, 7, 1006> [C:\Program Files\Real\RealPlayer\rpshell.dll] <RealNetworks, Inc.><1.0.1.1980> [C:\WINDOWS\System32\PNCRT.dll] <Real Networks, Inc><6.0.0.0> [C:\Program Files\Real\RealPlayer\lang\rpext_cn.dll] <RealNetworks, Inc.><6.0.12.298> [PID: 1612][C:\WINDOWS\System32\Rundll32.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [C:\WINDOWS\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1> [C:\WINDOWS\DOWNLO~1\CnsMinIO.dll] <北京三七二一科技有限公司><1, 0, 3, 6> [C:\WINDOWS\DOWNLO~1\cnsio.dll] <北京三七二一科技有限公司><1, 0, 2, 7> [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 1, 1018> [C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324> [C:\WINDOWS\DOWNLO~1\CnsMinEx.dll] <国风因特软件(北京)有限公司><1, 0, 3, 1> [PID: 1708][d:\rising\rfw\rfwsrv.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 32> [d:\rising\rfw\RfwRule.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 13> [d:\rising\rfw\rfwlog.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 6> [d:\rising\rfw\Rfwdrv.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 21> [d:\rising\rfw\MonDrv.dll] <rs><1, 0, 0, 4> [d:\rising\rfw\ProcLib.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 9> [PID: 1740][C:\Program Files\Analog Devices\Core\smax4pnp.exe] <Analog Devices, Inc.><5, 2, 0, 5> [C:\Program Files\Analog Devices\Core\SMWDMIF.dll] <Analog Devices, Inc.><5, 2, 4, 000> [C:\WINDOWS\System32\EDCrypt.DLL] <Analog Devices Incorporated><1.0.0.8> [C:\WINDOWS\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1> [PID: 1756][C:\WINDOWS\System32\hkcmd.exe] <Intel Corporation><3.0.0.4299> [C:\WINDOWS\System32\hccutils.DLL] <Intel Corporation><3.0.0.4299> [C:\WINDOWS\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1> [C:\WINDOWS\System32\igfxsrvc.dll] <Intel Corporation><3.0.0.4299> [PID: 1764][C:\WINDOWS\System32\igfxpers.exe] <Intel Corporation><3.0.0.4299> [C:\WINDOWS\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1> [C:\WINDOWS\System32\igfxsrvc.dll] <Intel Corporation><3.0.0.4299> [PID: 1784][C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe] <N/A><N/A> [C:\WINDOWS\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1> [PID: 2004][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.1699 (xpsp2.050610-1533)> [C:\WINDOWS\system32\OLFMNT40.DLL] <Microsoft Corporation><9.0.98.0105> [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\olfpnt40.dll] <Microsoft Corporation><9.0.98.0105> [PID: 968][d:\rising\rfw\RfwMain.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 51> [d:\rising\rfw\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23> [d:\rising\rfw\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [d:\rising\rfw\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [C:\WINDOWS\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1> [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 1, 1018> [C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324> [PID: 1260][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)> [PID: 1572][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 1592][C:\WINDOWS\System32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: DNSRV(bld4act)> [PID: 1824][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] <RealNetworks, Inc.><0.1.0.3249> [C:\WINDOWS\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1> [PID: 412][C:\WINDOWS\system32\rundll32.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324> [C:\WINDOWS\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1> [C:\PROGRA~1\3721\autolive.dll] <><1, 1, 5, 1324> [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 1, 1018> [C:\PROGRA~1\3721\notifier.dll] <><1, 0, 0, 5> [PID: 1236][D:\Rising\Rav\RavTask.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22> [D:\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [D:\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [D:\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [D:\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324> [C:\WINDOWS\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1> [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 1, 1018> [PID: 1536][C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe] < ><2, 0, 0, 1002> [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 1, 1018> [C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324> [C:\WINDOWS\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1> [C:\PROGRA~1\Yahoo!\ASSIST~1\YAlive.dll] <><2, 1, 5, 1045> [C:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll] < ><2, 0, 1, 1007> [C:\PROGRA~1\Yahoo!\ASSIST~1\ynotifier.dll] <><1, 0, 0, 5> [PID: 1548][C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe] <Yahoo!><1, 0, 1, 1001> [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 1, 1018> [C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324> [C:\WINDOWS\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1> [C:\PROGRA~1\Yahoo!\Assistant\shell\yAsMenu.dll] <Yahoo><1, 0, 1, 1006> [C:\PROGRA~1\Yahoo!\Assistant\shell\yAssecblk.dll] <Yahoo><1, 0, 2, 1002> [C:\PROGRA~1\Yahoo!\Assistant\shell\yIEAngel.dll] <Yahoo><1, 0, 1, 1001> [C:\PROGRA~1\Yahoo!\Assistant\shell\yMenuInfo.dll] <Yahoo><1, 0, 0, 2> [PID: 1728][C:\WINDOWS\System32\ctfmon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)> [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 1, 1018> [C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324> [C:\WINDOWS\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1>
gongwith 初生襁褓狮帖子:48 注册: 2006-06-26 来自:

gongwith 初生襁褓狮帖子:48 注册: 2006-06-26 来自:	发表于： 2006-06-26 16:15 \| 只看楼主短消息资料字号：小中大 4楼 [PID: 2056][C:\Program Files\Messenger\MSMSGS.EXE] <Microsoft Corporation><4.7.2010> [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 1, 1018> [C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324> [C:\WINDOWS\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1> [C:\WINDOWS\System32\msdmo.dll] <N/A><N/A> [PID: 2072][C:\WINDOWS\system32\rundll32.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [C:\Progra~1\IE-BAR\Cast\dmipn.dll] <千橡互联><2, 2, 1, 0> [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 1, 1018> [C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324> [C:\WINDOWS\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1> [C:\Progra~1\IE-BAR\Cast\dmshell.dll] <千橡互联><2, 2, 1, 0> [C:\Progra~1\IE-BAR\Cast\221~1.0\dmplayer.dll] <千橡互联><2, 2, 1, 0> [PID: 4064][C:\Program Files\同花顺2006华军版\LiveUpdate.exe] <上海核新软件技术有限公司><2005, 12, 3, 0> [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 1, 1018> [C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324> [C:\WINDOWS\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1> [PID: 3416][D:\TT\TTraveler.exe] <腾讯公司><3.0.0.250> [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 1, 1018> [C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324> [C:\WINDOWS\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1> [C:\PROGRA~1\3721\autolive.dll] <><1, 1, 5, 1324> [C:\PROGRA~1\Yahoo!\ASSIST~1\YAlive.dll] <><2, 1, 5, 1045> [C:\WINDOWS\DOWNLO~1\CnsHook.dll] <北京三七二一科技有限公司><1, 0, 2, 7> [D:\TT\Plugins\QQFloatBar\QQFloatBar4TT2.dll] <腾讯公司><1, 1, 0, 5> [D:\TT\Plugins\TWeather\TWeather.dll] <><1, 0, 0, 3> [C:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll] < ><2, 0, 1, 1007> [D:\TT\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 4> [d:\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3> [C:\WINDOWS\System32\Macromed\Flash\Flash8b.ocx] <Macromedia, Inc.><8,0,24,0> [PID: 3808][C:\WINDOWS\System32\conime.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)> [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 1, 1018> [C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324> [C:\WINDOWS\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1> [PID: 2216][D:\eMule\eMule.exe] <http://www.emule.org.cn><0.46.0> [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 1, 1018> [C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324> [C:\WINDOWS\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1> [PID: 3596][d:\Rising\Rav\Ravmond.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 26> [d:\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19> [d:\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [d:\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [d:\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [d:\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [d:\Rising\Rav\RsLog.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20> [d:\Rising\Rav\HOOKSYS.dll] <Rising><18, 1, 0, 9> [d:\Rising\Rav\Scanner.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30> [d:\Rising\Rav\libload.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [d:\Rising\Rav\VirusLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [d:\Rising\Rav\regmon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6> [d:\Rising\Rav\HookWeb.dll] <rising><18, 0, 0, 1> [d:\Rising\Rav\MemMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9> [d:\Rising\Rav\expscan.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [d:\Rising\Rav\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3> [d:\Rising\Rav\MailMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [d:\Rising\Rav\SpamEng.dll] <N/A><18, 0, 0, 6> [d:\Rising\Rav\engine.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30> [d:\Rising\Rav\PostTrt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9> [d:\Rising\Rav\UnExe.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11> [d:\Rising\Rav\ScanExec.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11> [d:\Rising\Rav\ScanEx.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11> [d:\Rising\Rav\NvFile.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7> [d:\Rising\Rav\ScanMac.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 8> [d:\Rising\Rav\ScanSct.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 15> [d:\Rising\Rav\Unpacker.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3> [d:\Rising\Rav\ExtOLE.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6> [PID: 3916][d:\Rising\Rav\RAVMON.EXE] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 28> [d:\Rising\Rav\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 24> [d:\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19> [d:\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [d:\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [d:\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [d:\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [d:\Rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 1, 1018> [C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324> [C:\WINDOWS\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1> [PID: 2448][d:\Rising\Rav\RavStub.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16> [d:\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [d:\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [PID: 604][C:\WINDOWS\System32\wuauclt.exe] <Microsoft Corporation><5.8.0.2469 built by: lab01_n(wmbla)> [PID: 3004][C:\Documents and Settings\Administrator\桌面\sreng2\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505> [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 1, 1018> [C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324> [C:\WINDOWS\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1> ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ==================================
gongwith 初生襁褓狮帖子:48 注册: 2006-06-26 来自:

gongwith 初生襁褓狮帖子:48 注册: 2006-06-26 来自:	发表于： 2006-06-26 16:17 \| 只看楼主短消息资料字号：小中大 5楼瑞星监控日志如下: 病毒名称处理结果发现日期扫描方式路径文件 Trojan.PSW.Lmir.kia 重新启动计算机后删除文件2006-06-18 10:02 文件监控 C:\WINDOWS\System32 msime.exe Trojan.PSW.Lmir.kia 删除成功 2006-06-19 19:49 文件监控 C:\System Volume Information\_restore{2D4A28F5-5F46-46EF-87BD-5D975EF6D4AA}\RP103 A0009714.exe Trojan.DL.Agent.jer 删除成功 2006-06-24 11:34 文件监控 C:\WINDOWS\System32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-24 11:35 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-24 11:40 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-24 11:46 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-24 11:51 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-24 11:56 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-24 12:01 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-24 12:06 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-24 12:11 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-24 12:16 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-24 12:21 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-24 12:26 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-24 12:31 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-24 12:36 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-24 12:41 文件监控 C:\WINDOWS\system32 VIPTray.exe
gongwith 初生襁褓狮帖子:48 注册: 2006-06-26 来自:

gongwith 初生襁褓狮帖子:48 注册: 2006-06-26 来自:	发表于： 2006-06-26 16:18 \| 只看楼主短消息资料字号：小中大 6楼 Trojan.DL.Agent.jer 删除成功 2006-06-25 13:20 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-25 13:25 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-25 13:31 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-25 13:36 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-25 13:41 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-25 13:46 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-25 14:05 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-25 15:30 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-25 16:20 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-25 16:21 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-25 16:53 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-25 17:15 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-25 17:20 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-25 17:25 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-25 17:31 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-25 17:36 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-25 17:41 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-25 17:51 文件监控 C:\WINDOWS\system32 VIPTray.exe Rootkit.Vanti.gen 删除成功 2006-06-25 19:21 文件监控 C:\System Volume Information\_restore{2D4A28F5-5F46-46EF-87BD-5D975EF6D4AA}\RP108 A0012331.dll Trojan.DL.Agent.jer 删除成功 2006-06-25 21:11 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-26 10:53 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-26 10:59 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-26 11:15 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-26 11:17 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-26 11:43 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-26 15:09 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-26 15:15 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 忽略 2006-06-26 15:21 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-26 15:27 文件监控 C:\WINDOWS\System32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-26 15:33 文件监控 C:\WINDOWS\system32 VIPTray.exe Trojan.DL.Agent.jer 删除成功 2006-06-26 15:46 文件监控 C:\WINDOWS\system32 VIPTray.exe
gongwith 初生襁褓狮帖子:48 注册: 2006-06-26 来自:

gongwith 初生襁褓狮帖子:48 注册: 2006-06-26 来自:	发表于： 2006-06-26 16:34 \| 只看楼主短消息资料字号：小中大 7楼这么多出现这个病毒的,瑞星解决不了这个问题吗?
gongwith 初生襁褓狮帖子:48 注册: 2006-06-26 来自:

gongwith 初生襁褓狮帖子:48 注册: 2006-06-26 来自:	发表于： 2006-06-26 17:01 \| 只看楼主短消息资料字号：小中大 8楼上面是LOG
gongwith 初生襁褓狮帖子:48 注册: 2006-06-26 来自:

gongwith 初生襁褓狮帖子:48 注册: 2006-06-26 来自:	发表于： 2006-06-26 18:55 \| 只看楼主短消息资料字号：小中大 9楼高手来帮忙啊!!
gongwith 初生襁褓狮帖子:48 注册: 2006-06-26 来自:

<<上一主题|下一主题>>

1

1 / 1 页

跳转页

页面顶部

Powered by Discuz!NT