谁能帮下我啊..各位大大啊..我的情况...哭.. - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛谁能帮下我啊..各位大大啊..我的情况...哭..

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

12 3

1 / 3 页

跳转页

谁能帮下我啊..各位大大啊..我的情况...哭..

tmipjy 初生襁褓狮帖子:27 注册: 2007-06-02 来自:	发表于： 2007-06-03 21:43 \| 只看楼主短消息资料字号：小中大 1楼谁能帮下我啊..各位大大啊..我的情况...哭.. 昨天就是这个问题,然后我格了C盘..其他没动..重装系统.. 具体是这样的..上网上到一般瑞星的监控全退了.. 我就杀毒..杀出来.. 病毒名称处理结果发现日期扫描方式路径文件病毒来源 Trojan.PSW.OnlineGames.byp 删除成功 2007-06-03 20:58 手动扫描 C:\Documents and Settings\TmIpJY\Local Settings\Temp daso.exe>>mian007 本机 Trojan.PSW.OnlineGames.byp 重新启动计算机后删除文件 2007-06-03 20:58 手动扫描 C:\Documents and Settings\TmIpJY\Local Settings\Temp daso0.dll>>mian007 本机 Trojan.PSW.OnlineGames.byp 删除成功 2007-06-03 20:59 手动扫描 C:\Documents and Settings\TmIpJY\Local Settings\Temp fyso.exe>>mian007 本机 Trojan.PSW.OnlineGames.byp 重新启动计算机后删除文件 2007-06-03 20:59 手动扫描 C:\Documents and Settings\TmIpJY\Local Settings\Temp fyso0.dll>>mian007 本机 Trojan.PSW.OnlineGames.byp 删除成功 2007-06-03 20:59 手动扫描 C:\Documents and Settings\TmIpJY\Local Settings\Temp jtso.exe>>mian007 本机 Trojan.PSW.OnlineGames.byp 重新启动计算机后删除文件 2007-06-03 20:59 手动扫描 C:\Documents and Settings\TmIpJY\Local Settings\Temp jtso0.dll>>mian007 本机 Trojan.PSW.OnlineGames.byp 删除成功 2007-06-03 20:59 手动扫描 C:\Documents and Settings\TmIpJY\Local Settings\Temp mhso.exe>>mian007 本机 Trojan.PSW.OnlineGames.bzg 重新启动计算机后删除文件 2007-06-03 20:59 手动扫描 C:\Documents and Settings\TmIpJY\Local Settings\Temp mhso0.dll>>mian007 本机 Trojan.PSW.OnlineGames.byp 删除成功 2007-06-03 20:59 手动扫描 C:\Documents and Settings\TmIpJY\Local Settings\Temp qjso.exe>>mian007 本机 Trojan.PSW.SunOnline.af 重新启动计算机后删除文件 2007-06-03 20:59 手动扫描 C:\Documents and Settings\TmIpJY\Local Settings\Temp qjso0.dll>>mian007 本机 Trojan.PSW.OnlineGames.byp 删除成功 2007-06-03 20:59 手动扫描 C:\Documents and Settings\TmIpJY\Local Settings\Temp rxso.exe>>mian007 本机 Trojan.PSW.OnlineGames.byt 重新启动计算机后删除文件 2007-06-03 20:59 手动扫描 C:\Documents and Settings\TmIpJY\Local Settings\Temp rxso0.dll>>mian007 本机 Trojan.PSW.OnlineGames.byp 删除成功 2007-06-03 20:59 手动扫描 C:\Documents and Settings\TmIpJY\Local Settings\Temp tlso.exe>>mian007 本机 Trojan.PSW.OnlineGames.byp 重新启动计算机后删除文件 2007-06-03 20:59 手动扫描 C:\Documents and Settings\TmIpJY\Local Settings\Temp tlso0.dll>>mian007 本机 Trojan.PSW.OnlineGames.byp 删除成功 2007-06-03 20:59 手动扫描 C:\Documents and Settings\TmIpJY\Local Settings\Temp wdso.exe>>mian007 本机 Trojan.PSW.OnlineGames.byp 重新启动计算机后删除文件 2007-06-03 20:59 手动扫描 C:\Documents and Settings\TmIpJY\Local Settings\Temp wdso0.dll>>mian007 本机 Trojan.PSW.OnlineGames.byp 删除成功 2007-06-03 20:59 手动扫描 C:\Documents and Settings\TmIpJY\Local Settings\Temp wgso.exe>>mian007 本机 Trojan.PSW.WorldOnline.hi 重新启动计算机后删除文件 2007-06-03 20:59 手动扫描 C:\Documents and Settings\TmIpJY\Local Settings\Temp wgso0.dll>>mian007 本机 Trojan.PSW.OnlineGames.byp 删除成功 2007-06-03 20:59 手动扫描 C:\Documents and Settings\TmIpJY\Local Settings\Temp wlso.exe>>mian007 本机 Trojan.PSW.OnlineGames.byp 重新启动计算机后删除文件 2007-06-03 20:59 手动扫描 C:\Documents and Settings\TmIpJY\Local Settings\Temp wlso0.dll>>mian007 本机 Trojan.PSW.OnlineGames.byp 删除成功 2007-06-03 20:59 手动扫描 C:\Documents and Settings\TmIpJY\Local Settings\Temp wmso.exe>>mian007 本机 Trojan.PSW.OnlineGames.byp 重新启动计算机后删除文件 2007-06-03 20:59 手动扫描 C:\Documents and Settings\TmIpJY\Local Settings\Temp wmso0.dll>>mian007 本机 Trojan.PSW.OnlineGames.byp 删除成功 2007-06-03 20:59 手动扫描 C:\Documents and Settings\TmIpJY\Local Settings\Temp woso.exe>>mian007 本机 Trojan.PSW.OnlineGames.byp 重新启动计算机后删除文件 2007-06-03 20:59 手动扫描 C:\Documents and Settings\TmIpJY\Local Settings\Temp woso0.dll>>mian007 本机然后我用HijackThis删除相应的..这是我删除后的... HijackThis_815汉化版扫描日志 V1.99.1 保存于 21:29:27, 日期 2007-6-3 操作系统： Windows XP (WinNT 5.01.2600) 浏览器： Internet Explorer v6.00 (6.00.2600.0000) 当前运行的进程： C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Rising\Rav\CCenter.exe C:\WINDOWS\System32\svchost.exe C:\PROGRAM FILES\RISING\RAV\Ravmond.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRAM FILES\RISING\RAV\RavStub.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Rising\Rav\RavTask.exe C:\Program Files\Rising\Rav\Ravmon.exe C:\WINDOWS\System32\ctfmon.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Rising\Rav\Rav.exe E:\Program Files\Maxthon\Maxthon.exe C:\DOCUME~1\TmIpJY\LOCALS~1\Temp\Rar$EX00.391\SREng.EXE C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE C:\DOCUME~1\TmIpJY\LOCALS~1\Temp\Rar$EX00.406\HijackThis1991zww.exe O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll O3 - IE工具栏增项: BitComet工具栏 - {3F1ABCDB-A875-46c1-8345-B72A4567E486} - C:\Program Files\BitComet\BitCometBar\BitCometBar0.6.dll O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - 启动项HKLM\\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32 O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - 启动项HKLM\\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe O4 - 启动项HKLM\\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - 启动项HKLM\\Run: [nwiz] nwiz.exe /install O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - 启动项HKLM\\Run: [LVCOMSX] "C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe" O4 - 启动项HKLM\\Run: [runeip] C:\Program Files\Rising\AntiSpyware\runiep.exe O4 - 启动项HKLM\\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload O4 - 启动项HKLM\\Run: [QuickTime Task] "E:\Program Files\StormPlayer\qttask.exe" -atboottime O4 - 启动项HKLM\\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - 启动项HKLM\\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system O4 - 启动项HKLM\\Run: [PCSuiteTrayApplication] E:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup O4 - 启动项HKLM\\RunOnce: [RavStub] "C:\PROGRAM FILES\RISING\RAV\ravstub.exe" /RUNONCE O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - Startup: 腾讯QQ.lnk = E:\Program Files\Tencent\QQ\QQ.exe O4 - Global Startup: E_SPSU01.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SPSU01.EXE O8 - IE右键菜单中的新增项目: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - E:\Program Files\Tencent\QQ\AddToNetDisk.htm O8 - IE右键菜单中的新增项目: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - E:\Program Files\Tencent\QQ\AddPanel.htm O8 - IE右键菜单中的新增项目: 添加到QQ表情 - E:\Program Files\Tencent\QQ\AddEmotion.htm O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - E:\Program Files\Tencent\QQ\SendMMS.htm O9 - 浏览器额外的按钮: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - C:\Program Files\Thunder Network\Thunder\Thunder.exe O9 - 浏览器额外的“工具”菜单项: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - C:\Program Files\Thunder Network\Thunder\Thunder.exe O9 - 浏览器额外的按钮: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - e:\Program Files\Tencent\QQ\QQ.EXE O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - e:\Program Files\Tencent\QQ\QQ.EXE O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab O18 - 列举现有的协议: KuGoo3 - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - E:\PROGRA~1\KuGoo3\InExtend\KUGOO3~1.OCX O23 - NT 服务: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe O23 - NT 服务: iPod 服务 (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - NT 服务: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe O23 - NT 服务: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe O23 - NT 服务: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe O23 - NT 服务: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe 2007-06-03 22:41:03
tmipjy 初生襁褓狮帖子:27 注册: 2007-06-02 来自:	分享到：

tmipjy 初生襁褓狮帖子:27 注册: 2007-06-02 来自:	发表于： 2007-06-03 21:44 \| 只看楼主短消息资料字号：小中大 2楼以下是sreng2 启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [(Verified)Microsoft Windows XP Publisher] <NvMediaCenter><RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit> [(Verified)Microsoft Windows Hardware Compatibility Publisher] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <load><> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <IMJPMIG8.1><C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows XP Publisher] <PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows XP Publisher] <PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows XP Publisher] <SoundMAXPnP><C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe> [Analog Devices, Inc.] <SoundMAX><"C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray> [Analog Devices, Inc.] <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup> [(Verified)Microsoft Windows Hardware Compatibility Publisher] <nwiz><nwiz.exe /install> [(Verified)Microsoft Windows Hardware Compatibility Publisher] <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.] <LVCOMSX><"C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe"> [(Verified)Logitech Inc] <runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe> [Beijing Rising Technology Co., Ltd.] <IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload> [(Verified)Microsoft Corporation] <QuickTime Task><"E:\Program Files\StormPlayer\qttask.exe" -atboottime> [Apple Inc.] <iTunesHelper><"C:\Program Files\iTunes\iTunesHelper.exe"> [(Verified)"Apple Computer, Inc."] <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.] <PCSuiteTrayApplication><E:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup> [Nokia] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] <RavStub><"C:\PROGRAM FILES\RISING\RAV\ravstub.exe" /RUNONCE> [Beijing Rising Technology Co., Ltd.] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [(Verified)Microsoft Windows XP Publisher] <Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows XP Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <UIHost><logonui.exe> [(Verified)Microsoft Windows XP Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.] <{0CB68AD9-FF66-3E63-636B-B693E62F6236}><C:\Program Files\Internet Explorer\romdrivers.dll> [Microsoft Corporation] ================================== 启动文件夹 [E_SPSU01] <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\E_SPSU01.lnk --> C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SPSU01.EXE [SEIKO EPSON Corporation]><N> [腾讯QQ] <C:\Documents and Settings\TmIpJY\「开始」菜单\程序\启动\腾讯QQ.lnk --> E:\PROGRA~1\Tencent\QQ\QQ.exe [TENCENT]><N> ================================== 服务 [EPSON Printer Status Agent2 / EPSONStatusAgent2][Running/Auto Start] <C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe><SEIKO EPSON CORPORATION> [Human Interface Device Access / HidServ][Stopped/Disabled] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A> [IMAPI CD-Burning COM Service / ImapiService][Stopped/Manual Start] <C:\WINDOWS\System32\imapi.exe><Microsoft Corporation> [iPod 服务 / iPod Service][Running/Manual Start] <C:\Program Files\iPod\bin\iPodService.exe><Apple Inc.> [NVIDIA Display Driver Service / NVSvc][Running/Auto Start] <C:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation> [Rising Process Communication Center / RsCCenter][Running/Auto Start] <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.> [Rising RealTime Monitor / RsRavMon][Running/Auto Start] <"C:\PROGRAM FILES\RISING\RAV\Ravmond.exe"><Beijing Rising Technology Co., Ltd.> [ServiceLayer / ServiceLayer][Stopped/Manual Start] <"C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe"><Nokia.> [SoundMAX Agent Service / SoundMAX Agent Service (default)][Running/Auto Start] <C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.> ================================== 驱动程序 [aeaudio / aeaudio][Running/Manual Start] <system32\drivers\aeaudio.sys><Andrea Electronics Corporation> [BaseTDI / BaseTDI][Running/Auto Start] <\??\C:\WINDOWS\System32\drivers\basetdi.sys><Beijing Rising Technology Co., Ltd.> [EagleNT / EagleNT][Stopped/Manual Start] <\??\C:\WINDOWS\System32\drivers\EagleNT.sys><N/A> [ExpScaner / ExpScaner][Running/Auto Start] <\??\C:\PROGRAM FILES\RISING\RAV\ExpScan.sys><> [D-Link DFE-530TX PCI Fast Ethernet Adapter Driver Service / FETNDISB][Running/Manual Start] <System32\DRIVERS\dlkfet5b.sys><D-Link> [GEARAspiWDM / GEARAspiWDM][Running/Manual Start] <System32\Drivers\GEARAspiWDM.sys><GEAR Software Inc.> [HookCont / HookCont][Running/Auto Start] <\??\C:\PROGRAM FILES\RISING\RAV\HOOKCONT.sys><Rising> [HookReg / HookReg][Running/Auto Start] <\??\C:\PROGRAM FILES\RISING\RAV\HookReg.sys><> [HookSys / HookSys][Running/Auto Start] <\??\C:\PROGRAM FILES\RISING\RAV\HookSys.sys><Rising> [Logitech USB Monitor Filter / LVUSBSta][Running/Manual Start] <System32\DRIVERS\LVUSBSta.sys><Logitech Inc.> [MEMSCAN / MEMSCAN][Running/Auto Start] <\??\C:\PROGRAM FILES\RISING\RAV\MEMSCAN.sys><瑞星软件有限公司> [MidiSyn / MidiSyn][Stopped/Manual Start] <system32\drivers\MidiSyn.sys><Analog Devices Inc> [Netgroup Packet Filter / NPF][Stopped/Manual Start] <system32\drivers\npf.sys><CACE Technologies> [npkcrypt / npkcrypt][Running/Auto Start] <\??\E:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.> [nv / nv][Running/Manual Start] <System32\DRIVERS\nv4_mini.sys><NVIDIA Corporation> [Logitech QuickCam IM(PID_PEPI) / PID_PEPI][Running/Manual Start] <System32\DRIVERS\LV302V32.SYS><Logitech Inc.> [Direct Parallel Link Driver / Ptilink][Running/Manual Start] <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.> [RsAntiSpyware / RsAntiSpyware][Running/Boot Start] <\SystemRoot\System32\drivers\RsBoot.sys><Beijing Rising> [RsNTGDI / RsNTGDI][Running/Boot Start] <\SystemRoot\System32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.> [RSPPSYS / RSPPSYS][Running/Auto Start] <\??\C:\PROGRAM FILES\RISING\RAV\RSPPSYS.sys><Rising> [Secdrv / Secdrv][Running/Auto Start] <System32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.> [SFI Service / sf][Running/System Start] <system32\drivers\sf.sys><Sonic Focus, Inc> [Intel (R) System Management BIOS Service / SMBios][Running/Manual Start] <System32\DRIVERS\SMBios.sys><Intel Corporation> [smwdm / smwdm][Running/Manual Start] <system32\drivers\smwdm.sys><Analog Devices, Inc.> [World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start] <System32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
tmipjy 初生襁褓狮帖子:27 注册: 2007-06-02 来自:

tmipjy 初生襁褓狮帖子:27 注册: 2007-06-02 来自:	发表于： 2007-06-03 21:45 \| 只看楼主短消息资料字号：小中大 3楼 ================================== 浏览器加载项 [Thunder Browser Helper] {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD> [启动迅雷] {0062C9BD-B349-40DE-91A0-755F37ACD559} <C:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD> [信息检索(&R)] {92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation> [@shdoclc.dll,-866] {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A> [QQ] {c95fe080-8f5d-11d2-a20b-00aa003c157b} <e:\Program Files\Tencent\QQ\QQ.EXE, TENCENT> [BitComet工具栏] {3F1ABCDB-A875-46c1-8345-B72A4567E486} <C:\Program Files\BitComet\BitCometBar\BitCometBar0.6.dll, > [电台(&R)] {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation> [XML DOM Document 4.0] {88D969C0-F192-11D4-A65F-0040963251E5} <%SystemRoot%\System32\msxml4.dll, N/A> [&使用迅雷下载] <C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A> [&使用迅雷下载全部链接] <C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A> [上传到QQ网络硬盘] <E:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A> [导出到 Microsoft Office Excel(&X)] <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A> [添加到QQ自定义面板] <E:\Program Files\Tencent\QQ\AddPanel.htm, N/A> [添加到QQ表情] <E:\Program Files\Tencent\QQ\AddEmotion.htm, N/A> [用QQ彩信发送该图片] <E:\Program Files\Tencent\QQ\SendMMS.htm, N/A> ================================== 正在运行的进程 [PID: 564][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 620][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 644][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\WINDOWS\system32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 688][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 700][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 888][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 1004][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 1452][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2600.0000 (xpclient.010817-1148)] [C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9] [C:\Program Files\Internet Explorer\romdrivers.dll] [Microsoft Corporation, 1. 0. 0. 1] [C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)] [C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 2] [PID: 1808][C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe] [Analog Devices, Inc., 4, 0, 4, 11] [C:\Program Files\Analog Devices\SoundMAX\SMWDMIF.dll] [Analog Device, Inc., 1, 0, 22, 26] [C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)] [C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [PID: 1816][C:\Program Files\Analog Devices\SoundMAX\Smax4.exe] [Analog Devices, Inc., 4, 0, 4, 25] [C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)] [C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [PID: 1864][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] [RealNetworks, Inc., 0.1.0.3510] [C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [PID: 1876][C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe] [Logitech Inc., 10.4.0.1401] [C:\Program Files\Common Files\Logitech\LComMgr\LVMaEnum.dll] [Logitech Inc., 10.4.0.1401] [C:\Program Files\Common Files\Logitech\LComMgr\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\Common Files\Logitech\LComMgr\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [PID: 1976][C:\Program Files\iTunes\iTunesHelper.exe] [Apple Inc., 7.2.0.34] [C:\Program Files\iTunes\iTunesHelper.Resources\zh_CN.lproj\iTunesHelperLocalized.DLL] [Apple Inc., 7.2.0.28] [C:\Program Files\iTunes\iTunesHelper.Resources\iTunesHelper.DLL] [Apple Inc., 7.2.0.34] [C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [PID: 180][C:\WINDOWS\System32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [PID: 200][C:\WINDOWS\System32\RUNDLL32.EXE] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\WINDOWS\System32\NVMCTRAY.DLL] [NVIDIA Corporation, 6.14.10.5216] [C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [PID: 2896][E:\Program Files\Maxthon\Maxthon.exe] [Maxthon International Ltd., 1, 6, 1, 22] [E:\Program Files\Maxthon\maxzlib.dll] [ , 1, 0, 0, 2] [C:\WINDOWS\System32\odbcbcp.dll] [Microsoft Corporation, 2000.081.7713.00] [C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [E:\Program Files\Maxthon\Services\RealTime\real_time.dll] [, 1, 0, 0, 1] [C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)] [C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [C:\WINDOWS\System32\Macromed\Flash\Flash9c.ocx] [Adobe Systems, Inc., 9,0,45,0] [PID: 2360][C:\DOCUME~1\TmIpJY\LOCALS~1\Temp\Rar$EX00.391\SREng.EXE] [Smallfrogs Studio, 2.4.12.806] [C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf N/A ================================== HOSTS 文件 N/A ================================== API HOOK N/A ================================== 隐藏进程 N/A ================================== [/CODE]
tmipjy 初生襁褓狮帖子:27 注册: 2007-06-02 来自:

tmipjy 初生襁褓狮帖子:27 注册: 2007-06-02 来自:	发表于： 2007-06-03 21:56 \| 只看楼主短消息资料字号：小中大 4楼正在用瑞星最新版杀毒现在杀到E盘了..没毒了.. 可怎么这么奇怪的啊...重装系统还会再出来
tmipjy 初生襁褓狮帖子:27 注册: 2007-06-02 来自:

baohe 大版主帖子:72578 注册: 2003-04-10 来自:	发表于： 2007-06-03 22:01 \| 短消息资料字号：小中大 5楼【回复“tmipjy”的帖子】重装系统后，补丁都打上没？
baohe 大版主帖子:72578 注册: 2003-04-10 来自:

tmipjy 初生襁褓狮帖子:27 注册: 2007-06-02 来自:	发表于： 2007-06-03 22:02 \| 只看楼主短消息资料字号：小中大 6楼没...可是你有发现什么不对的地方么?我盗版XP...不敢打..
tmipjy 初生襁褓狮帖子:27 注册: 2007-06-02 来自:

天月来了版主帖子:76904 注册: 2007-02-06 来自:	发表于： 2007-06-03 22:06 \| 短消息资料字号：小中大 7楼用扫日志的SRENG工具删除下面的注册表项启动项目注册表 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{0CB68AD9-FF66-3E63-636B-B693E62F6236}><C:\Program Files\Internet Explorer\romdrivers.dll> [Microsoft Corporation] ================================== 驱动程序 [Netgroup Packet Filter / NPF][Stopped/Manual Start] <system32\drivers\npf.sys><CACE Technologies> ———————————————————————————————————————————— 下面这个，我就不知是啥了，启动文件夹 [E_SPSU01] <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\E_SPSU01.lnk --> C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SPSU01.EXE [SEIKO EPSON Corporation]><N> —————————————————————————————————— 删除文件 C:\Program Files\Internet Explorer\romdrivers.dll C:\WINDOWS\system32\drivers\npf.sys 重启看看
天月来了版主帖子:76904 注册: 2007-02-06 来自:

天月来了版主帖子:76904 注册: 2007-02-06 来自:	发表于： 2007-06-03 22:06 \| 短消息资料字号：小中大 8楼用WinRAR打开 C:\Documents and Settings\TmIpJY\Local Settings\Temp 文件夹，删除里面的所有文件和文件夹。
天月来了版主帖子:76904 注册: 2007-02-06 来自:

大版主

帖子:72578
注册: 2003-04-10
来自:

年度优秀版主奖

端午辟邪香囊

卡卡名人堂

就爱不长大

论坛9周年纪念

09欢乐圣诞

十周年

年度风云人物

2012我眼中的你们

茶馆劳模

瑞星金牌用户

十一周年勋章

发表于： 2007-06-03 22:09 | 短消息资料

字号：小中大 9楼

引用:

【tmipjy的贴子】没...可是你有发现什么不对的地方么?我盗版XP...不敢打..
………………

不打上补丁，以后，恐怕会反反复复地出现那些“不对的地方”。
扬汤止沸不如釜底抽薪！！
打全补丁————系统安全的硬道理！

gototop

tmipjy 初生襁褓狮帖子:27 注册: 2007-06-02 来自:	发表于： 2007-06-03 22:13 \| 只看楼主短消息资料字号：小中大 10楼如何打?指导下吧...
tmipjy 初生襁褓狮帖子:27 注册: 2007-06-02 来自:

<<上一主题|下一主题>>

12 3

1 / 3 页

跳转页

页面顶部

Powered by Discuz!NT