请好心的人帮我看看,问题严重的不行了,好多病毒,哭:(((

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛请好心的人帮我看看,问题严重的不行了,好多病毒,哭:(((

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

1 / 2 页

跳转页

请好心的人帮我看看,问题严重的不行了,好多病毒,哭:(((

dailan 初生襁褓狮帖子:10 注册: 2006-10-14 来自:	发表于： 2006-10-18 02:35 \| 只看楼主短消息资料字号：小中大 1楼请好心的人帮我看看,问题严重的不行了,好多病毒,哭:((( 以下是今天扫描的病毒和日志,刚才我打开卡卡扫描日志的时候,居然弹出C:\WINDOWS\system32\panmap32.dll>>Unpack中了Trojan.DL.Agent.xgs病毒,难道我的卡卡有问题了?以下病毒能彻底删除有哪些还需要手动的啊?请教高手帮我看看,小女子感激不尽!!! 病毒名称处理结果扫描方式路径文件病毒来源 Trojan.Clicker.Agent.akn 重新启动计算机后删除文件手动扫描C:\Documents and Settings\All Users\Application Data\Microsoft\UserDataIE.exe本机 Trojan.Clicker.Agent.akn 删除成功手动扫描C:\System Volume Information\_restore{916BBF32-458B-4D8B-B688-6F4BF15CB36F}\RP232A0033603.exe本机 Dropper.Sbwy.h 删除成功手动扫描C:\WINDOWS1002live.exe本机 Trojan.Clicker.Agent.akl 删除成功手动扫描C:\WINDOWS\system321000viurs.exe本机 Dropper.Sbwy.h 删除成功手动扫描C:\WINDOWS\system32\A4SOFT\baisodavpd.exe本机 Trojan.DL.Agent.xgx 删除成功手动扫描C:\WINDOWS\system32\A4SOFT\baisoddllhostd.dll本机 Trojan.DL.QQHelper.ela 删除成功手动扫描C:\WINDOWS\system32lzwdlf88.dll本机 Trojan.DL.QQHelper.ekw 删除成功手动扫描C:\WINDOWS\system32mssapi.dll本机 Trojan.Clicker.Agent.akl 删除成功手动扫描C:\WINDOWS\system32\MSSOFTwinampe.exe本机 Trojan.DL.Agent.xgs 删除成功手动扫描C:\WINDOWS\system32panmap32.dll>>Unpack本机 Trojan.DL.QQHelper.ekz 删除成功手动扫描C:\WINDOWS\system32\wbemauglar45.dll本机 Trojan.DL.QQHelper.ekz 删除成功手动扫描C:\WINDOWS\system32\wbemfnsejj19.dll本机 Trojan.DL.QQHelper.ela 删除成功手动扫描C:\WINDOWS\system32zacrfp75.dll本机 2006-10-18 20:51:02
dailan 初生襁褓狮帖子:10 注册: 2006-10-14 来自:	分享到：

dailan 初生襁褓狮帖子:10 注册: 2006-10-14 来自:	发表于： 2006-10-18 02:40 \| 只看楼主短消息资料字号：小中大 2楼以下是日志～～～ Logfile of Kaka v2. 0. 0. 9 Scan Module v2. 0. 0. 1 Scan saved at 02:08:49, on 2006-10-18 Platform: Microsoft Windows XP Personal Service Pack 2 (Build 2600) MSIE: Internet Explorer v6.00 SP2; (6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)) Running processes: [smss.exe] CommandLine = [csrss.exe] CommandLine = C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 [winlogon.exe] CommandLine = winlogon.exe [services.exe] CommandLine = C:\WINDOWS\system32\services.exe [lsass.exe] CommandLine = C:\WINDOWS\system32\lsass.exe [ibmpmsvc.exe] CommandLine = C:\WINDOWS\system32\ibmpmsvc.exe [ati2evxx.exe] CommandLine = C:\WINDOWS\system32\Ati2evxx.exe [svchost.exe] CommandLine = C:\WINDOWS\system32\svchost -k DcomLaunch [svchost.exe] CommandLine = C:\WINDOWS\system32\svchost -k rpcss [CCenter.exe] CommandLine = "C:\Program Files\Rising\Rav\CCenter.exe" [svchost.exe] CommandLine = C:\WINDOWS\System32\svchost.exe -k netsvcs [svchost.exe] CommandLine = C:\WINDOWS\system32\svchost.exe -k NetworkService [svchost.exe] CommandLine = C:\WINDOWS\system32\svchost.exe -k LocalService [RavMonD.exe] CommandLine = "C:\Program Files\Rising\Rav\Ravmond.exe" [explorer.exe] CommandLine = C:\WINDOWS\Explorer.EXE [spoolsv.exe] CommandLine = C:\WINDOWS\system32\spoolsv.exe [RavStub.exe] CommandLine = "C:\Program Files\Rising\Rav\RavStub.exe" /RAVMOND [TpShocks.exe] CommandLine = "C:\WINDOWS\system32\TpShocks.exe" [TPHKMGR.exe] CommandLine = "C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe" [EZEJMNAP.EXE] CommandLine = "C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [SynTPLpr.exe] CommandLine = "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [TPONSCR.exe] CommandLine = "C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe" [SynTPEnh.exe] CommandLine = "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [TpScrex.exe] CommandLine = "C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe" [tfswctrl.exe] CommandLine = "C:\WINDOWS\system32\dla\tfswctrl.exe" [ibmmessages.exe] CommandLine = "C:\Program Files\IBM\Messages By IBM\ibmmessages.exe" [QCWLICON.EXE] CommandLine = "C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE" [RavTask.exe] CommandLine = "C:\PROGRAM FILES\RISING\RAV\RAVTASK.EXE" -SYSTEM [RavMon.exe] CommandLine = "C:\Program Files\Rising\Rav\Ravmon.exe" -SYSTEM [ctfmon.exe] CommandLine = "C:\WINDOWS\system32\ctfmon.exe" [svchost.exe] CommandLine = C:\WINDOWS\System32\svchost.exe -k AutoUpgrade [rrpcsb.exe] CommandLine = "C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe" [rundll32.exe] CommandLine = C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\MMSASS~1\MMSSVER.DLL,Service [QCONSVC.EXE] CommandLine = System32\QCONSVC.EXE [svchost.exe] CommandLine = C:\WINDOWS\System32\svchost.exe -k RpcSs32 [rundll.exe] CommandLine = C:\WINDOWS\SYSTEM32\RUNDLL.EXE C:\WINDOWS\SYSTEM32\WBEM\PLXYRI26.DLL,Export 1087 [svchost.exe] CommandLine = C:\WINDOWS\system32\svchost.exe -k imgsvc [TPHDEXLG.exe] CommandLine = System32\TPHDEXLG.EXE [TpKmpSvc.exe] CommandLine = C:\WINDOWS\system32\TpKmpSVC.exe [wdfmgr.exe] CommandLine = C:\WINDOWS\system32\wdfmgr.exe [alg.exe] CommandLine = C:\WINDOWS\System32\alg.exe [rundll32.exe] CommandLine = C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\sdmAgent22.dll,StartAgent [HNMainUI.exe] CommandLine = "C:\Program Files\ADSL拨号王\HNMainUI.exe" [IEXPLORE.EXE] CommandLine = "C:\Program Files\Internet Explorer\iexplore.exe" [RsAgent.exe] CommandLine = "C:\Program Files\Rising\Rav\RsAgent.exe" [agentsvr.exe] CommandLine = C:\WINDOWS\msagent\AgentSvr.exe -Embedding [Rav.exe] CommandLine = "C:\Program Files\Rising\Rav\Rav.exe" [QQ.exe] CommandLine = "F:\Tencent\QQ\QQ.exe" [TIMPlatform.exe] CommandLine = F:\Tencent\QQ\TIMPlatform.exe -Embedding [IEXPLORE.EXE] CommandLine = "C:\Program Files\Internet Explorer\iexplore.exe" http://www.ikaka.com/?tag=Unknown&exp=0 [RsLogVw.exe] CommandLine = "C:\Program Files\Rising\Rav\RsLogVw.exe" [KkScan.exe] CommandLine = "C:\Program Files\Rising\KakaToolBar\KkScan.exe" O1 - Hosts: 127.0.0.1 localhost O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SafeMe Internet Explorer Helper - {3AE06CEE-58A6-4F5F-AF89-6C5350842F16} - C:\WINDOWS\system32\SafeHelper12.dll O2 - BHO: QQBrowserHelperObject Class - {54EBD53A-9BC1-480B-966A-843A333CA162} - f:\Tencent\QQ\QQIEHelper.dll O2 - BHO: Vision - {6671A431-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\MMSASS~1\mmsass~1.dll O2 - BHO: (file missing) O2 - BHO: Thunder Browser Helper - {889D2FEB-5411-4565-8998-1DD2C5261283} - f:\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [TpShocks] TpShocks.exe O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe O4 - HKLM\..\Run: [TP4EX] tp4ex.exe O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [ATIPTA] rem C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system O4 - HKLM\..\RunOnce: [RavStub] "C:\Program Files\Rising\Rav\ravstub.exe" /RUNONCE O4 - Startup: desktop.ini = O4 - Global Startup: desktop.ini = O8 - Extra context menu item: &使用迅雷下载 - f:\Thunder Network\Thunder\Program\GetUrl.htm O8 - Extra context menu item: &使用迅雷下载全部链接 - f:\Thunder Network\Thunder\Program\GetAllUrl.htm O8 - Extra context menu item: >>彩信发送<< - res://C:\PROGRA~1\MMSASS~1\mmsass~1.dll/mms.htm O8 - Extra context menu item: 上传到QQ网络硬盘 - F:\Tencent\QQ\AddToNetDisk.htm O8 - Extra context menu item: 添加到QQ自定义面板 - F:\Tencent\QQ\AddPanel.htm O8 - Extra context menu item: 添加到QQ表情 - F:\Tencent\QQ\AddEmotion.htm O8 - Extra context menu item: 用QQ彩信发送该图片 - F:\Tencent\QQ\SendMMS.htm O9 - Extra Button: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - f:\Thunder Network\Thunder\Thunder.exe O9 - Extra 'Tools' menuitem: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - f:\Thunder Network\Thunder\Thunder.exe O9 - Extra Button: (no name) - {6671A433-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\MMSASS~1\mmsass~1.dll O9 - Extra 'Tools' menuitem: 彩E精灵设置 - {6671A433-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\MMSASS~1\mmsass~1.dll O9 - Extra Button: @shdoclc.dll,-866 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra 'Tools' menuitem: @shdoclc.dll,-864 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra Button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg (file missing) O9 - Extra Button: 访问瑞星网站 - {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E444} - http://www.rising.com.cn/?u=RSTB (file missing) O9 - Extra Button: 访问卡卡社区 - {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E445} - http://www.ikaka.com/?u=RSTB (file missing) O10 - Unknown file in Winsock LSP: C:\WINDOWS\system32\cdnns.dll O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} (Edit Class) - https://www.sz1.cmbchina.com/download/CMBEdit.cab O16 - DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} (AxSubmitControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{93CB7597-9060-4A18-BB71-885574B41036}: NameServer = 218.2.135.1 61.147.37.1
dailan 初生襁褓狮帖子:10 注册: 2006-10-14 来自:

dailan 初生襁褓狮帖子:10 注册: 2006-10-14 来自:	发表于： 2006-10-18 02:40 \| 只看楼主短消息资料字号：小中大 3楼 O18 - Filter : application/octet-stream - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll O18 - Filter : application/x-complus - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll O18 - Filter : application/x-msdownload - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll O18 - Protocol: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: ipp - (no CLSID) - (no file) O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll O18 - Protocol: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll O18 - Protocol: msdaipp - (no CLSID) - (no file) O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll O23 - Service: Application Management (AppMgmt) - - C:\WINDOWS\system32\svchost.exe -k netsvcs O23 - Service: Ati HotKey Poller (Ati HotKey Poller) - ATI Technologies Inc. - C:\WINDOWS\system32\ati2evxx.exe O23 - Service: AutoUpgrade (AutoUpgrade) - - C:\WINDOWS\system32\svchost.exe -k autoupgrade O23 - Service: Background Intelligent Transfer Services (BITS32) - - C:\WINDOWS\system32\svchost.exe -k bits32 O23 - Service: Human Interface Device Access (HidServ) - - C:\WINDOWS\system32\svchost.exe -k netsvcs O23 - Service: IBM Rapid Restore Ultra Service (IBM Rapid Restore Ultra Service) - - "C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe" O23 - Service: IBM PM Service (IBMPMSVC) - - C:\WINDOWS\system32\ibmpmsvc.exe O23 - Service: Spectrum24 Events Monitor (IPRIP) - LINKMEDIA Tech - C:\WINDOWS\system32\svchost.exe -k netsvcs O23 - Service: JMediaService (JMediaService) - - C:\WINDOWS\system32\rundll32.exe c:\progra~1\mmsass~1\mmssver.dll,service O23 - Service: Network Logons (NetWorkLogons) - - rundll32.exe KB27861012.log,start O23 - Service: NetMeeting Remote Desktop Agent (Nwsapagent) - LINKMEDIA Tech - C:\WINDOWS\system32\svchost.exe -k netsvcs O23 - Service: IBM PSA Access Driver Control (PsaSrv) - - C:\WINDOWS\system32\psasrv.exe O23 - Service: QCONSVC (QCONSVC) - IBM Corp. - C:\WINDOWS\system32\qconsvc.exe O23 - Service: DNS SystemServices (RpcSs32) - - C:\WINDOWS\system32\svchost.exe -k rpcss32 O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - "C:\Program Files\Rising\Rav\CCenter.exe" O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - "C:\Program Files\Rising\Rav\Ravmond.exe" O23 - Service: Network IPSEC Connections (SOCEESe) - - C:\WINDOWS\system32\rundll.exe c:\windows\system32\wbem\plxyri26.dll,export 1087 O23 - Service: IBM HDD APS Logging Service (TPHDEXLGSVC) - IBM Corporation - C:\WINDOWS\system32\tphdexlg.exe O23 - Service: IBM KCU Service (TpKmpSVC) - - C:\WINDOWS\system32\tpkmpsvc.exe
dailan 初生襁褓狮帖子:10 注册: 2006-10-14 来自:

影子110 叱咤花甲狮帖子:4210 注册: 2005-04-10 来自:怀黯	发表于： 2006-10-18 07:21 \| 短消息资料字号：小中大 4楼建议: 请先如下操作后将杀软升至最新~全盘查杀下~ 关闭系统还原我的电脑》属性》系统还原》关闭所有盘的系统还原》确定清理临时文件夹~(清理前先关闭IE) IE》属性》删除文件（包括脱机文件）》确定清空页面文件~ 开始>运行>secpos.msc>本地策略>安全选项>启用关机时清理虚拟内存页面文件~ 另,清理下面文件夹中的内容 C:\Documents and Settings\***(你的用户名)\Local Settings\Temp c:\windows\temp 上面的操作完后,再扫个日志上来!~
影子110 叱咤花甲狮帖子:4210 注册: 2005-04-10 来自:怀黯

初生襁褓狮

帖子:10
注册: 2006-10-14
来自:

发表于： 2006-10-18 12:41 | 只看楼主 短消息资料

字号：小中大 5楼

引用:

【影子110的贴子】建议:
请先如下操作后将杀软升至最新~全盘查杀下~

关闭系统还原
我的电脑》属性》系统还原》关闭所有盘的系统还原》确定
清理临时文件夹~(清理前先关闭IE)
IE》属性》删除文件（包括脱机文件）》确定

清空页面文件~
开始>运行>secpos.msc>本地策略>安全选项>启用关机时清理虚拟内存页面文件~

另,清理下面文件夹中的内容
C:\Documents and Settings\***(你的用户名)\Local Settings\Temp
c:\windows\temp

上面的操作完后,再扫个日志上来!~
………………

请问,TEMP里的内容都可以删除吗?有的好象删除不了,弹出对话框说“程序有另外一个人正在使用,不得删除”，这是怎么意思啊?很严重吗？下面是我刚扫的日志，谢谢你了：）

Logfile of Kaka v2. 0. 0. 9 Scan Module v2. 0. 0. 1
Scan saved at 12:26:49, on 2006-10-18
Platform: Microsoft Windows XP Personal Service Pack 2 (Build 2600)
MSIE: Internet Explorer v6.00 SP2; (6.00.2900.2180 (xpsp_sp2_rtm.040803-2158))

Running processes:
[smss.exe]
CommandLine =

[csrss.exe]
CommandLine = C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

[winlogon.exe]
CommandLine = winlogon.exe

[services.exe]
CommandLine = C:\WINDOWS\system32\services.exe

[lsass.exe]
CommandLine = C:\WINDOWS\system32\lsass.exe

[ibmpmsvc.exe]
CommandLine = C:\WINDOWS\system32\ibmpmsvc.exe

[ati2evxx.exe]
CommandLine = C:\WINDOWS\system32\Ati2evxx.exe

[svchost.exe]
CommandLine = C:\WINDOWS\system32\svchost -k DcomLaunch

[svchost.exe]
CommandLine = C:\WINDOWS\system32\svchost -k rpcss

[CCenter.exe]
CommandLine = "C:\Program Files\Rising\Rav\CCenter.exe"

[svchost.exe]
CommandLine = C:\WINDOWS\System32\svchost.exe -k netsvcs

[svchost.exe]
CommandLine = C:\WINDOWS\system32\svchost.exe -k NetworkService

[svchost.exe]
CommandLine = C:\WINDOWS\system32\svchost.exe -k LocalService

[RavMonD.exe]
CommandLine = "C:\Program Files\Rising\Rav\Ravmond.exe"

[explorer.exe]
CommandLine = C:\WINDOWS\Explorer.EXE

[spoolsv.exe]
CommandLine = C:\WINDOWS\system32\spoolsv.exe

[RavStub.exe]
CommandLine = "C:\Program Files\Rising\Rav\RavStub.exe" /RAVMOND

[TpShocks.exe]
CommandLine = "C:\WINDOWS\system32\TpShocks.exe"

[TPHKMGR.exe]
CommandLine = "C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe"

[EZEJMNAP.EXE]
CommandLine = "C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe"

[SynTPLpr.exe]
CommandLine = "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"

[SynTPEnh.exe]
CommandLine = "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"

[TPONSCR.exe]
CommandLine = "C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe"

[TpScrex.exe]
CommandLine = "C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe"

[tfswctrl.exe]
CommandLine = "C:\WINDOWS\system32\dla\tfswctrl.exe"

[ibmmessages.exe]
CommandLine = "C:\Program Files\IBM\Messages By IBM\ibmmessages.exe"

[QCWLICON.EXE]
CommandLine = "C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE"

[RavTask.exe]
CommandLine = "C:\PROGRAM FILES\RISING\RAV\RAVTASK.EXE" -SYSTEM

[RavMon.exe]
CommandLine = "C:\Program Files\Rising\Rav\Ravmon.exe" -SYSTEM

[ctfmon.exe]
CommandLine = "C:\WINDOWS\system32\ctfmon.exe"

[rrpcsb.exe]
CommandLine = "C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe"

[rundll32.exe]
CommandLine = C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\MMSASS~1\MMSSVER.DLL,Service

[QCONSVC.EXE]
CommandLine = System32\QCONSVC.EXE

[svchost.exe]
CommandLine = C:\WINDOWS\System32\svchost.exe -k RpcSs32

[rundll.exe]
CommandLine = C:\WINDOWS\SYSTEM32\RUNDLL.EXE C:\WINDOWS\SYSTEM32\WBEM\PLXYRI26.DLL,Export 1087

[svchost.exe]
CommandLine = C:\WINDOWS\system32\svchost.exe -k imgsvc

[TPHDEXLG.exe]
CommandLine = System32\TPHDEXLG.EXE

[TpKmpSvc.exe]
CommandLine = C:\WINDOWS\system32\TpKmpSVC.exe

[wdfmgr.exe]
CommandLine = C:\WINDOWS\system32\wdfmgr.exe

[alg.exe]
CommandLine = C:\WINDOWS\System32\alg.exe

[rundll32.exe]
CommandLine = C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\sdmAgent22.dll,StartAgent

[HNMainUI.exe]
CommandLine = "C:\Program Files\ADSL拨号王\HNMainUI.exe"

[IEXPLORE.EXE]
CommandLine = "C:\Program Files\Internet Explorer\iexplore.exe" http://www.ikaka.com/?tag=Unknown&exp=0

[realsched.exe]
CommandLine = "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -startedByApp

[KkScan.exe]
CommandLine = "C:\Program Files\Rising\KakaToolBar\KkScan.exe"

O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SafeMe Internet Explorer Helper - {3AE06CEE-58A6-4F5F-AF89-6C5350842F16} - C:\WINDOWS\system32\SafeHelper12.dll
O2 - BHO: QQBrowserHelperObject Class - {54EBD53A-9BC1-480B-966A-843A333CA162} - f:\Tencent\QQ\QQIEHelper.dll
O2 - BHO: Vision - {6671A431-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\MMSASS~1\mmsass~1.dll
O2 - BHO: (file missing)
O2 - BHO: Thunder Browser Helper - {889D2FEB-5411-4565-8998-1DD2C5261283} - f:\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll
O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIPTA] rem C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\RunOnce: [RavStub] "C:\Program Files\Rising\Rav\ravstub.exe" /RUNONCE
O4 - Startup: desktop.ini =
O4 - Global Startup: desktop.ini =
O8 - Extra context menu item: &使用迅雷下载 - f:\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - f:\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - Extra context menu item: >>彩信发送<< - res://C:\PROGRA~1\MMSASS~1\mmsass~1.dll/mms.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - F:\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - F:\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - F:\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - F:\Tencent\QQ\SendMMS.htm
O9 - Extra Button: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - f:\Thunder Network\Thunder\Thunder.exe
O9 - Extra 'Tools' menuitem: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - f:\Thunder Network\Thunder\Thunder.exe
O9 - Extra Button: (no name) - {6671A433-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\MMSASS~1\mmsass~1.dll
O9 - Extra 'Tools' menuitem: 彩E精灵设置 - {6671A433-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\MMSASS~1\mmsass~1.dll
O9 - Extra Button: @shdoclc.dll,-866 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: @shdoclc.dll,-864 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra Button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg (file missing)
O9 - Extra Button: 访问瑞星网站 - {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E444} - http://www.rising.com.cn/?u=RSTB (file missing)
O9 - Extra Button: 访问卡卡社区 - {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E445} - http://www.ikaka.com/?u=RSTB (file missing)
O10 - Unknown file in Winsock LSP: C:\WINDOWS\system32\cdnns.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} (Edit Class) - https://www.sz1.cmbchina.com/download/CMBEdit.cab
O16 - DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} (AxSubmitControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{93CB7597-9060-4A18-BB71-885574B41036}: NameServer = 218.2.135.1 61.147.37.1

dailan 初生襁褓狮帖子:10 注册: 2006-10-14 来自:	发表于： 2006-10-18 12:42 \| 只看楼主短消息资料字号：小中大 6楼 O18 - Filter : application/octet-stream - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll O18 - Filter : application/x-complus - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll O18 - Filter : application/x-msdownload - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll O18 - Protocol: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: ipp - (no CLSID) - (no file) O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll O18 - Protocol: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll O18 - Protocol: msdaipp - (no CLSID) - (no file) O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll O23 - Service: Application Management (AppMgmt) - - C:\WINDOWS\system32\svchost.exe -k netsvcs O23 - Service: Ati HotKey Poller (Ati HotKey Poller) - ATI Technologies Inc. - C:\WINDOWS\system32\ati2evxx.exe O23 - Service: AutoUpgrade (AutoUpgrade) - - C:\WINDOWS\system32\svchost.exe -k autoupgrade O23 - Service: Background Intelligent Transfer Services (BITS32) - - C:\WINDOWS\system32\svchost.exe -k bits32 O23 - Service: Human Interface Device Access (HidServ) - - C:\WINDOWS\system32\svchost.exe -k netsvcs O23 - Service: IBM Rapid Restore Ultra Service (IBM Rapid Restore Ultra Service) - - "C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe" O23 - Service: IBM PM Service (IBMPMSVC) - - C:\WINDOWS\system32\ibmpmsvc.exe O23 - Service: Spectrum24 Events Monitor (IPRIP) - LINKMEDIA Tech - C:\WINDOWS\system32\svchost.exe -k netsvcs O23 - Service: JMediaService (JMediaService) - - C:\WINDOWS\system32\rundll32.exe c:\progra~1\mmsass~1\mmssver.dll,service O23 - Service: Network Logons (NetWorkLogons) - - rundll32.exe KB27861012.log,start O23 - Service: NetMeeting Remote Desktop Agent (Nwsapagent) - LINKMEDIA Tech - C:\WINDOWS\system32\svchost.exe -k netsvcs O23 - Service: IBM PSA Access Driver Control (PsaSrv) - - C:\WINDOWS\system32\psasrv.exe O23 - Service: QCONSVC (QCONSVC) - IBM Corp. - C:\WINDOWS\system32\qconsvc.exe O23 - Service: DNS SystemServices (RpcSs32) - - C:\WINDOWS\system32\svchost.exe -k rpcss32 O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - "C:\Program Files\Rising\Rav\CCenter.exe" O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - "C:\Program Files\Rising\Rav\Ravmond.exe" O23 - Service: Network IPSEC Connections (SOCEESe) - - C:\WINDOWS\system32\rundll.exe c:\windows\system32\wbem\plxyri26.dll,export 1087 O23 - Service: IBM HDD APS Logging Service (TPHDEXLGSVC) - IBM Corporation - C:\WINDOWS\system32\tphdexlg.exe O23 - Service: IBM KCU Service (TpKmpSVC) - - C:\WINDOWS\system32\tpkmpsvc.exe
dailan 初生襁褓狮帖子:10 注册: 2006-10-14 来自:

影子110 叱咤花甲狮帖子:4210 注册: 2005-04-10 来自:怀黯	发表于： 2006-10-18 13:19 \| 短消息资料字号：小中大 7楼清空临时文件并不是根本目的,也并不能真的起到杀毒的作用, 主要是要你用杀软进行查杀~(把杀软升到最新,进入安全模式,全盘查杀) 另,请用SREng扫个日志~ http://www.kztechs.com/
影子110 叱咤花甲狮帖子:4210 注册: 2005-04-10 来自:怀黯

dailan 初生襁褓狮帖子:10 注册: 2006-10-14 来自:	发表于： 2006-10-18 20:51 \| 只看楼主短消息资料字号：小中大 8楼在安全模式下杀了一遍,有个病毒总是杀不掉,病毒名为Trojan.Clicker.Agent.akn,文件名为IE.exe,崩溃了:(以下是用SREng扫的日志: 2006-10-18,20:23:54 System Repair Engineer 2.2.6.605 Smallfrogs (http://www.KZTechs.com) Windows XP Home Edition Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能以下内容被选中：所有的启动项目（包括注册表、启动文件夹、服务等）浏览器加载项正在运行的进程（包括进程模块信息）文件关联 Winsock 提供者 Autorun.inf HOSTS 文件启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation] <ibmmessages><C:\Program Files\IBM\Messages By IBM\ibmmessages.exe> [IBM] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation] <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation] <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Corporation] <TpShocks><TpShocks.exe> [IBM Corp.] <TPHOTKEY><C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe> [N/A] <TP4EX><tp4ex.exe> [IBM Corporation] <EZEJMNAP><C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe> [IBM Corp.] <SynTPLpr><C:\Program Files\Synaptics\SynTP\SynTPLpr.exe> [Synaptics, Inc.] <SynTPEnh><C:\Program Files\Synaptics\SynTP\SynTPEnh.exe> [Synaptics, Inc.] <ATIPTA><rem C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe> [N/A] <UpdateManager><"C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r> [Sonic Solutions] <dla><C:\WINDOWS\system32\dla\tfswctrl.exe> [Sonic Solutions] <ibmmessages><C:\Program Files\IBM\Messages By IBM\ibmmessages.exe> [IBM] <QCWLICON><C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE> [IBM Corp.] <IMEKRMIG6.1><C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE> [(Verified)Microsoft Corporation] <MSPY2002><C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC> [(Verified)N/A] <KernelFaultCheck><%systemroot%\system32\dumprep 0 -k> [N/A] <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] <RavStub><"C:\Program Files\Rising\Rav\ravstub.exe" /RUNONCE> [Beijing Rising Technology Co., Ltd.] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [(Verified)Microsoft Corporation] <Userinit><C:\WINDOWS\system32\Userinit.exe,> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <UIHost><logonui.exe> [(Verified)Microsoft Corporation] [HKEY_CURRENT_USER\Control Panel\Desktop] <SCRNSAVE.EXE><C:\WINDOWS\system32\REBUSI~1.SCR> [N/A] ================================== 启动文件夹 N/A ================================== 服务 [Application Management / AppMgmt] <C:\WINDOWS\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\appmgmts.dll><N/A> [ASP.NET State Service / aspnet_state] <C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe><Microsoft Corporation> [Ati HotKey Poller / Ati HotKey Poller] <C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.> [AutoUpgrade / AutoUpgrade] <C:\WINDOWS\System32\svchost.exe -k AutoUpgrade-->C:\WINDOWS\system32\panmap32.dll><N/A> [Background Intelligent Transfer Services / BITS32] <C:\WINDOWS\System32\svchost.exe -k BITS32-->c:\windows\system32\itircl32.dll><N/A> [Human Interface Device Access / HidServ] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A> [IBM Rapid Restore Ultra Service / IBM Rapid Restore Ultra Service] <"C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe"><> [IBM PM Service / IBMPMSVC] <C:\WINDOWS\system32\ibmpmsvc.exe><N/A> [Cryptographic Machine / Investor] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\lfweia19.dll><Microsoft Corporation> [Spectrum24 Events Monitor / IPRIP] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\acss.dll><LINKMEDIA Tech> [JMediaService / JMediaService] <C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\MMSASS~1\MMSSVER.DLL,Service><Microsoft Corporation> [Network Logons / NetWorkLogons] <rundll32.exe KB27861012.log,start><Microsoft Corporation> [NetMeeting Remote Desktop Agent / Nwsapagent] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\Nwsapagent.dll><LINKMEDIA Tech> [IBM PSA Access Driver Control / PsaSrv] <C:\WINDOWS\system32\PsaSrv.exe><N/A> [QCONSVC / QCONSVC] <System32\QCONSVC.EXE><N/A> [DNS SystemServices / RpcSs32] <C:\WINDOWS\System32\svchost.exe -k RpcSs32-->c:\windows\system32\comploader32.dll><N/A> [Rising Process Communication Center / RsCCenter] <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.> [RsRavMon Service / RsRavMon] <"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.> [Network IPSEC Connections / SOCEESe] <C:\WINDOWS\SYSTEM32\RUNDLL.EXE C:\WINDOWS\SYSTEM32\WBEM\PLXYRI26.DLL,Export 1087><Microsoft Corporation> [IBM HDD APS Logging Service / TPHDEXLGSVC] <System32\TPHDEXLG.EXE><N/A> [IBM KCU Service / TpKmpSVC] <C:\WINDOWS\system32\TpKmpSVC.exe><N/A> [Windows Media Connect (WMC) / WmcCds] <c:\program files\windows media connect\mswmccds.exe><Microsoft Corporation> [Windows Media Connect (WMC) 帮助程序 / WmcCdsLs] <C:\Program Files\Windows Media Connect\mswmcls.exe><Microsoft Corporation>
dailan 初生襁褓狮帖子:10 注册: 2006-10-14 来自:

dailan 初生襁褓狮帖子:10 注册: 2006-10-14 来自:	发表于： 2006-10-18 20:53 \| 只看楼主短消息资料字号：小中大 9楼 ================================== 驱动程序 [abp480n5 / abp480n5] <\SystemRoot\system32\DRIVERS\ABP480N5.SYS><Microsoft Corporation> [Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc] <system32\drivers\ac97intc.sys><Intel Corporation> [adpu160m / adpu160m] <\SystemRoot\system32\DRIVERS\adpu160m.sys><Microsoft Corporation> [aeaudio / aeaudio] <system32\drivers\aeaudio.sys><Andrea Electronics Corporation> [Aha154x / Aha154x] <\SystemRoot\system32\DRIVERS\aha154x.sys><Microsoft Corporation> [aic78u2 / aic78u2] <\SystemRoot\system32\DRIVERS\aic78u2.sys><Microsoft Corporation> [aic78xx / aic78xx] <\SystemRoot\system32\DRIVERS\aic78xx.sys><Microsoft Corporation> [Albus / Albus] <\SystemRoot\system32\drivers\Albus.SYS><N/A> [AliIde / AliIde] <\SystemRoot\system32\DRIVERS\aliide.sys><Acer Laboratories Inc.> [AMD AGP Bus Filter Driver / amdagp] <\SystemRoot\system32\DRIVERS\amdagp.sys><Advanced Micro Devices, Inc.> [ANC / ANC] <System32\drivers\ANC.SYS><IBM Corp.> [asc / asc] <\SystemRoot\system32\DRIVERS\asc.sys><Advanced System Products, Inc.> [asc3350p / asc3350p] <\SystemRoot\system32\DRIVERS\asc3350p.sys><Microsoft Corporation> [asc3550 / asc3550] <\SystemRoot\system32\DRIVERS\asc3550.sys><Advanced System Products, Inc.> [ati2mtag / ati2mtag] <system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.> [Broadcom NetXtreme Gigabit Ethernet / b57w2k] <system32\DRIVERS\b57xp32.sys><Broadcom Corporation> [BaseTDI / BaseTDI] <\??\C:\WINDOWS\system32\drivers\basetdi.sys><Beijing Rising Technology Co., Ltd.> [HelloNet PPPoE 虚拟网卡 / BRPPPOE] <system32\DRIVERS\brpppoe.sys><N/A> [cd20xrnt / cd20xrnt] <\SystemRoot\system32\DRIVERS\cd20xrnt.sys><Microsoft Corporation> [cdnprot / cdnprot] <\SystemRoot\system32\drivers\cdnprot.sys><N/A> [CmdIde / CmdIde] <\SystemRoot\system32\DRIVERS\cmdide.sys><CMD Technology, Inc.> [dac2w2k / dac2w2k] <\SystemRoot\system32\DRIVERS\dac2w2k.sys><Mylex Corporation> [dpti2o / dpti2o] <\SystemRoot\system32\DRIVERS\dpti2o.sys><Microsoft Corporation> [drvmcdb / drvmcdb] <\SystemRoot\system32\drivers\drvmcdb.sys><Sonic Solutions> [drvnddm / drvnddm] <system32\drivers\drvnddm.sys><Sonic Solutions> [Intel(R) PRO Adapter Driver / E100B] <system32\DRIVERS\e100b325.sys><Intel Corporation> [IBM Access Support / EGATHDRV] <\??\C:\WINDOWS\SYSTEM32\EGATHDRV.SYS><IBM Corporation> [ExpScaner / ExpScaner] <\??\C:\Program Files\Rising\Rav\ExpScan.sys><> [fsprot / fsprot] <system32\drivers\fsprot.sys><N/A> [gwiopm / gwiopm] <\??\F:\优化大师\womcc\gwiopm.sys><N/A> [HookCont / HookCont] <\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising tech Co. ltd> [HookReg / HookReg] <\??\C:\Program Files\Rising\Rav\HookReg.sys><> [HookSys / HookSys] <\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising> [HSFHWICH / HSFHWICH] <system32\DRIVERS\HSFHWICH.sys><Conexant Systems, Inc.> [HSF_DP / HSF_DP] <system32\DRIVERS\HSF_DP.sys><Conexant Systems, Inc.> [ibmfilter / ibmfilter] <\??\C:\WINDOWS\system32\drivers\ibmfilter.sys><IBM> [IBMPMDRV / IBMPMDRV] <system32\DRIVERS\ibmpmdrv.sys><IBM Corp.> [IBMTPCHK / IBMTPCHK] <System32\drivers\IBMBLDID.SYS><N/A> [ini910u / ini910u] <\SystemRoot\system32\DRIVERS\ini910u.sys><Microsoft Corporation> [mdmxsdk / mdmxsdk] <system32\DRIVERS\mdmxsdk.sys><Conexant> [MEMSCAN / MEMSCAN] <\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司> [moprot / moprot] <system32\drivers\moprot.sys><N/A> [mraid35x / mraid35x] <\SystemRoot\system32\DRIVERS\mraid35x.sys><American Megatrends Inc.> [npkcrypt / npkcrypt] <\??\F:\Tencent\qq\npkcrypt.sys><INCA Internet Co., Ltd.> [NSC Infrared Device Driver / NSCIRDA] <system32\DRIVERS\nscirda.sys><National Semiconductor Corporation> [nv / nv] <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation> [nwlnksipx / nwlnksipx] <\??\C:\WINDOWS\system32\drivers\nwlnksipx.sys><Microsoft Corporation> [PMEM / PMEM] <\??\C:\WINDOWS\SYSTEM32\DRIVERS\PMEMNT.SYS><Microsoft Corporation> [TPM Service / portio] <system32\DRIVERS\NscTpmDD.sys><National Semiconductor Corp.> [IBM PSA Access Driver / psadd] <\??\C:\WINDOWS\system32\Drivers\psadd.sys><IBM Corporation> [Direct Parallel Link Driver / Ptilink] <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.> [PxHelp20 / PxHelp20] <\SystemRoot\System32\Drivers\PxHelp20.sys><Sonic Solutions> [QCNDISIF / QCNDISIF] <System32\drivers\qcndisif.SYS><IBM Corporation.> [ql1080 / ql1080] <\SystemRoot\system32\DRIVERS\ql1080.sys><QLogic Corporation> [Ql10wnt / Ql10wnt] <\SystemRoot\system32\DRIVERS\ql10wnt.sys><Microsoft Corporation> [ql12160 / ql12160] <\SystemRoot\system32\DRIVERS\ql12160.sys><QLogic Corporation> [ql1280 / ql1280] <\SystemRoot\system32\DRIVERS\ql1280.sys><QLogic Corporation> [Secdrv / Secdrv] <system32\DRIVERS\secdrv.sys><N/A> [ShockMgr / ShockMgr] <C:\WINDOWS\SYSTEM32\DRIVERS\ShockMgr.SYS><IBM Corporation> [Shockprf / Shockprf] <C:\WINDOWS\SYSTEM32\DRIVERS\Shockprf.SYS><IBM Corporation> [SIS AGP Bus Filter / sisagp] <\SystemRoot\system32\DRIVERS\sisagp.sys><Silicon Integrated Systems Corporation> [Smapint / Smapint] <System32\drivers\Smapint.sys><Microsoft Corporation> [smwdm / smwdm] <system32\drivers\smwdm.sys><Analog Devices, Inc.> [Sparrow / Sparrow] <\SystemRoot\system32\DRIVERS\sparrow.sys><Adaptec, Inc.> [sscdbhk5 / sscdbhk5] <system32\drivers\sscdbhk5.sys><Sonic Solutions> [ssrtln / ssrtln] <system32\drivers\ssrtln.sys><Sonic Solutions> [symc810 / symc810] <\SystemRoot\system32\DRIVERS\symc810.sys><Symbios Logic Inc.> [symc8xx / symc8xx] <\SystemRoot\system32\DRIVERS\symc8xx.sys><LSI Logic> [sym_hi / sym_hi] <\SystemRoot\system32\DRIVERS\sym_hi.sys><LSI Logic> [sym_u3 / sym_u3] <\SystemRoot\system32\DRIVERS\sym_u3.sys><LSI Logic> [Synaptics TouchPad Driver / SynTP] <system32\DRIVERS\SynTP.sys><Synaptics, Inc.> [TDSMAPI / TDSMAPI] <System32\drivers\TDSMAPI.SYS><N/A> [tfsnboio / tfsnboio] <system32\dla\tfsnboio.sys><Sonic Solutions> [tfsncofs / tfsncofs] <system32\dla\tfsncofs.sys><Sonic Solutions> [tfsndrct / tfsndrct] <system32\dla\tfsndrct.sys><Sonic Solutions> [tfsndres / tfsndres] <system32\dla\tfsndres.sys><Sonic Solutions> [tfsnifs / tfsnifs] <system32\dla\tfsnifs.sys><Sonic Solutions> [tfsnopio / tfsnopio] <system32\dla\tfsnopio.sys><Sonic Solutions> [tfsnpool / tfsnpool] <system32\dla\tfsnpool.sys><Sonic Solutions> [tfsnudf / tfsnudf] <system32\dla\tfsnudf.sys><Sonic Solutions> [tfsnudfa / tfsnudfa] <system32\dla\tfsnudfa.sys><Sonic Solutions> [TosIde / TosIde] <\SystemRoot\system32\DRIVERS\toside.sys><Microsoft Corporation> [TPDiskPM / TPDiskPM] <C:\WINDOWS\SYSTEM32\DRIVERS\TPDiskPM.SYS><IBM Corporation> [TPHKDRV / TPHKDRV] <C:\WINDOWS\SYSTEM32\DRIVERS\TPHKDRV.SYS><IBM Corporation> [TPInput / TPInput] <System32\DRIVERS\TPInput.sys><IBM Corporation> [TPPWRIF / TPPWRIF] <System32\drivers\Tppwrif.sys><N/A> [TSMAPIP / TSMAPIP] <System32\drivers\TSMAPIP.SYS><N/A> [ultra / ultra] <\SystemRoot\system32\DRIVERS\ultra.sys><Promise Technology, Inc.> [Motorola USB Modem Driver for MPT / usbsermpt] <system32\DRIVERS\usbsermpt.sys><Microsoft Corporation> ==================================
dailan 初生襁褓狮帖子:10 注册: 2006-10-14 来自:

dailan 初生襁褓狮帖子:10 注册: 2006-10-14 来自:	发表于： 2006-10-18 20:54 \| 只看楼主短消息资料字号：小中大 10楼浏览器加载项 [Yahoo! Toolbar Helper] {02478D38-C3F9-4EFB-9B51-7695ECA05670} <C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll, Yahoo! Inc.> [AcroIEHlprObj Class] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated> [SafeMe Internet Explorer Helper] {3AE06CEE-58A6-4F5F-AF89-6C5350842F16} <C:\WINDOWS\system32\SafeHelper12.dll, LINKMEDIA Tech> [QQBrowserHelperObject Class] {54EBD53A-9BC1-480B-966A-843A333CA162} <f:\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司> [Vision] {6671A431-5C3D-463d-A7CF-5587F9B7E191} <C:\PROGRA~1\MMSASS~1\mmsass~1.dll, > [Thunder Browser Helper] {889D2FEB-5411-4565-8998-1DD2C5261283} <f:\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD> [启动迅雷] {0062C9BD-B349-40DE-91A0-755F37ACD559} <f:\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD> [MMSAssistMenu] {6671A433-5C3D-463d-A7CF-5587F9B7E191} <C:\PROGRA~1\MMSASS~1\mmsass~1.dll, > [@shdoclc.dll,-866] {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A> [情景聊天] {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg, N/A> [访问瑞星网站] {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E444} <http://www.rising.com.cn/?u=RSTB, N/A> [访问卡卡社区] {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E445} <http://www.ikaka.com/?u=RSTB, N/A> [&Yahoo! Toolbar] {EF99BD32-C1FB-11D2-892F-0090271D4F88} <C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll, Yahoo! Inc.> [卡卡上网安全助手] {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.> [Edit Class] {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\WINDOWS\system32\CMBEdit.dll, > [AxSubmitControl Class] {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} <C:\WINDOWS\DOWNLO~1\SUBMIT~1.DLL, > [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx, Macromedia, Inc.> [Yahoo! Toolbar Helper] {02478D38-C3F9-4EFB-9B51-7695ECA05670} <C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll, Yahoo! Inc.> [ActiveMovieControl Object] {05589FA1-C356-11CE-BF01-00AA0055595A} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation> [AcroIEHlprObj Class] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated> [IEMonitor Class] {08A312BB-5409-49FC-9347-54BB7D069AC6} <C:\Program Files\DeskAdTop\deskipn.dll, N/A> [netup] {0A44CDEC-87D0-4D4D-BF97-DE9AFB9B104A} <C:\WINDOWS\system32\netidp.dll, > [BHO.clsInetSpeak] {0CD5C894-57C5-44BB-9D73-84AE18E2D938} <C:\WINDOWS\system32\msidb.dll, Microsoft Corporation> [Windows Media Player] {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation> [HTML Document] {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A> [DHTML Edit Control Safe for Scripting for IE5] {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation> [SYM] {36BF6929-DCBC-4CCD-A620-C5E3BBA77B95} <C:\WINDOWS\system32\usercrd.dll, > [SafeMe Internet Explorer Helper] {3AE06CEE-58A6-4F5F-AF89-6C5350842F16} <C:\WINDOWS\system32\SafeHelper12.dll, LINKMEDIA Tech> [CEditCtrl Object] {488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\system32\aliedit\AliEdit.dll, www.alipay.com> [QQBrowserHelperObject Class] {54EBD53A-9BC1-480B-966A-843A333CA162} <f:\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司> [Shell Name Space] {55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A> [金山毒霸在线杀毒] {577A1997-6FD0-4972-B234-885DA583F9CE} <C:\PROGRA~1\KOS\KOSClean.ocx, N/A> [CdnForIE Class] {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, N/A> [DragSearch BHO] {62EED7C6-9F02-42F9-B634-98E2899E147B} <C:\PROGRA~1\Yahoo!\ASSIST~1\assist\YDRAGS~1.DLL, N/A> [Vision] {6671A431-5C3D-463D-A7CF-5587F9B7E191} <C:\PROGRA~1\MMSASS~1\mmsass~1.dll, > [stdup] {6A512BF7-EC78-4E8D-9841-6C02E8FA9838} <C:\WINDOWS\SYSTEM32\stdup.dll, N/A> [Windows Media Player] {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [SrchHook Class] {6E1BC898-505A-44F4-BC88-BCE43016AC96} <C:\WINDOWS\system32\BarSea.dll, N/A> [Microsoft Web 浏览器] {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation> [Thunder Browser Helper] {889D2FEB-5411-4565-8998-1DD2C5261283} <f:\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD> [Microsoft Scriptlet Component] {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation> [卡卡上网安全助手] {AFF6E516-CBE5-4F8A-9C2F-38A68013E766} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.> [SearchAssistantOC] {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A> [RDS.DataSpace] {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation> [VIDEO__X_MS_ASF Moniker Class] {CD3AFA8F-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [SparKey Control] {CE5F0517-9C46-4DB1-AB5B-FC2CF3BE780D} <C:\WINDOWS\DOWNLO~1\SparKey.ocx, > [RealPlayer G2 Control] {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx, Macromedia, Inc.> [卡卡上网安全助手] {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.> [&Yahoo! Toolbar] {EF99BD32-C1FB-11D2-892F-0090271D4F88} <C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll, Yahoo! Inc.> [WMHlprObj Class] {F5824EFB-728A-4726-A5A5-85A68B20EDC3} <C:\PROGRA~1\CNNIC\Cdn\wmhlpr.dll, N/A> [Search Bar] {FBFF8F98-AE9D-4599-975E-E9B31E88EF04} <C:\WINDOWS\system32\ToolBar.dll, N/A> [] {FE32DECF-06AD-426E-9F53-3018A366B5AE} <C:\WINDOWS\system32\sys32version.dll, N/A> [&使用迅雷下载] <f:\Thunder Network\Thunder\Program\GetUrl.htm, N/A> [&使用迅雷下载全部链接] <f:\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A> [>>彩信发送<<] <res://C:\PROGRA~1\MMSASS~1\mmsass~1.dll/mms.htm, N/A> [上传到QQ网络硬盘] <F:\Tencent\QQ\AddToNetDisk.htm, N/A> [添加到QQ自定义面板] <F:\Tencent\QQ\AddPanel.htm, N/A> [添加到QQ表情] <F:\Tencent\QQ\AddEmotion.htm, N/A> [用QQ彩信发送该图片] <F:\Tencent\QQ\SendMMS.htm, N/A>
dailan 初生襁褓狮帖子:10 注册: 2006-10-14 来自:

<<上一主题|下一主题>>

1 / 2 页

跳转页

dailan 初生襁褓狮帖子:10 注册: 2006-10-14 来自:	发表于： 2006-10-18 02:35 \| 只看楼主短消息资料字号：小中大 1楼请好心的人帮我看看,问题严重的不行了,好多病毒,哭:((( 以下是今天扫描的病毒和日志,刚才我打开卡卡扫描日志的时候,居然弹出C:\WINDOWS\system32\panmap32.dll>>Unpack中了Trojan.DL.Agent.xgs病毒,难道我的卡卡有问题了?以下病毒能彻底删除有哪些还需要手动的啊?请教高手帮我看看,小女子感激不尽!!! 病毒名称处理结果扫描方式路径文件病毒来源 Trojan.Clicker.Agent.akn 重新启动计算机后删除文件手动扫描C:\Documents and Settings\All Users\Application Data\Microsoft\UserDataIE.exe本机 Trojan.Clicker.Agent.akn 删除成功手动扫描C:\System Volume Information\_restore{916BBF32-458B-4D8B-B688-6F4BF15CB36F}\RP232A0033603.exe本机 Dropper.Sbwy.h 删除成功手动扫描C:\WINDOWS1002live.exe本机 Trojan.Clicker.Agent.akl 删除成功手动扫描C:\WINDOWS\system321000viurs.exe本机 Dropper.Sbwy.h 删除成功手动扫描C:\WINDOWS\system32\A4SOFT\baisodavpd.exe本机 Trojan.DL.Agent.xgx 删除成功手动扫描C:\WINDOWS\system32\A4SOFT\baisoddllhostd.dll本机 Trojan.DL.QQHelper.ela 删除成功手动扫描C:\WINDOWS\system32lzwdlf88.dll本机 Trojan.DL.QQHelper.ekw 删除成功手动扫描C:\WINDOWS\system32mssapi.dll本机 Trojan.Clicker.Agent.akl 删除成功手动扫描C:\WINDOWS\system32\MSSOFTwinampe.exe本机 Trojan.DL.Agent.xgs 删除成功手动扫描C:\WINDOWS\system32panmap32.dll>>Unpack本机 Trojan.DL.QQHelper.ekz 删除成功手动扫描C:\WINDOWS\system32\wbemauglar45.dll本机 Trojan.DL.QQHelper.ekz 删除成功手动扫描C:\WINDOWS\system32\wbemfnsejj19.dll本机 Trojan.DL.QQHelper.ela 删除成功手动扫描C:\WINDOWS\system32zacrfp75.dll本机 2006-10-18 20:51:02
dailan 初生襁褓狮帖子:10 注册: 2006-10-14 来自:	分享到：

瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 请好心的人帮我看看,问题严重的不行了,好多病毒,哭:(((

请好心的人帮我看看,问题严重的不行了,好多病毒,哭:(((

请好心的人帮我看看,问题严重的不行了,好多病毒,哭:(((

瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛请好心的人帮我看看,问题严重的不行了,好多病毒,哭:(((