告急 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛告急

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

12

1 / 2 页

跳转页

告急

飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:	发表于： 2006-09-14 15:34 \| 显示全部短消息资料字号：小中大 1楼告急哪个大哥请告诉个杀毒能力强的免费杀毒软件吧,我的电脑拿瑞星查有病毒,但拿金山杀又扫描不出来,告急啊.还有IE浏览器上有病毒,也有个start.exe的删不掉,还会隔段时间眺个http://tt66.2288.org/2.html这个网战出来,胆子大的兄弟可以上去看看,内容和上面那位仁兄的一模一样,请懂的高手帮忙看看,下面是日志. 2006-09-14 19:34:53
飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:	分享到：

飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:	发表于： 2006-09-14 15:53 \| 显示全部短消息资料字号：小中大 2楼 2006-09-14,15:43:07 System Repair Engineer 2.0.21.505 (2.0 RC 2) Smallfrogs (http://www.KZTechs.com) Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能以下内容被选中：所有的启动项目（包括注册表、启动文件夹、服务等）浏览器加载项正在运行的进程（包括进程模块信息）文件关联启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation] <MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background> [Microsoft Corporation] <KavPFW><"F:\金山毒霸2006\KPFW32.EXE"> [Kingsoft Corporation] <Start><Start.exe> [] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <load><> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.] <KavStart><"F:\金山毒霸2006\KAVStart.exe" -startup> [Kingsoft Corporation] <Start><Start.exe> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe ntio.exe> [] <Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <UIHost><logonui.exe> [Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:

飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:	发表于： 2006-09-14 15:53 \| 显示全部短消息资料字号：小中大 3楼 ================================== 启动文件夹 [腾讯QQ] <C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\腾讯QQ.lnk><N> ================================== 服务 [Kingsoft Personal Firewall Service / KPfwSvc] <"F:\金山毒霸2006\KPfwSvc.EXE"><Kingsoft Corporation> [Kingsoft Antivirus KWatch Service / KWatchSvc] <F:\金山毒霸2006\KWatch.EXE><Kingsoft Corporation> [Rising Proxy Service / RfwProxySrv] <c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.> [Rising Personal Firewall Service / RfwService] <c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.> [Rising Process Communication Center / RsCCenter] <"F:\Rising\Rav\CCenter.exe"><N/A> [RsRavMon Service / RsRavMon] <"F:\Rising\Rav\Ravmond.exe"><N/A> ================================== 浏览器加载项 [KAVIEHelper Class] {1B2F92A1-CDAF-4511-9382-91E3F5CE0880} <C:\PROGRA~1\KOS\KOSIEBar.dll, 金山软件股份有限公司> [雅虎助手] {406F94F0-504F-4a40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll, N/A> [QQBrowserHelperObject Class] {54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\QQ2006\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司> [雅虎助手] {406F94F0-504F-4a40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll, N/A> [金山毒霸安全助手] {EF72500A-C234-46C4-BF0A-9AA6913DDF34} <C:\PROGRA~1\KOS\KOSIEBar.dll, 金山软件股份有限公司> [卡卡上网安全助手] {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.> [金山毒霸在线产品升级] {52DF16E3-6C4F-4B22-8BAF-09263E463B48} <C:\PROGRA~1\KOS\KOSInit.ocx, 金山软件股份有限公司> [WUWebControl Class] {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.> [Rising Web Scan Object] {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.> [KAVIEHelper Class] {1B2F92A1-CDAF-4511-9382-91E3F5CE0880} <C:\PROGRA~1\KOS\KOSIEBar.dll, 金山软件股份有限公司> [Windows Media Player] {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation> [HTML Document] {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A> [雅虎助手] {406F94F0-504F-4A40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll, N/A> [金山毒霸在线产品升级] {52DF16E3-6C4F-4B22-8BAF-09263E463B48} <C:\PROGRA~1\KOS\KOSInit.ocx, 金山软件股份有限公司> [QQBrowserHelperObject Class] {54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\QQ2006\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司> [Yahoo!Live] {57421194-58FB-49AE-9B4F-FD48869B9AD4} <C:\PROGRA~1\Yahoo!\ASSIST~1\YAlive.dll, N/A> [金山毒霸在线杀毒] {577A1997-6FD0-4972-B234-885DA583F9CE} <C:\PROGRA~1\KOS\KOSClean.ocx, 金山软件股份有限公司> [Windows Media Player] {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [Microsoft Scriptlet Component] {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation> [卡卡上网安全助手] {AFF6E516-CBE5-4F8A-9C2F-38A68013E766} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.> [SearchAssistantOC] {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A> [RDS.DataSpace] {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation> [VIDEO__X_MS_WMV Moniker Class] {CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [RealPlayer G2 Control] {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.> [卡卡上网安全助手] {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.> [Rising Web Scan Object] {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.> [金山毒霸安全助手] {EF72500A-C234-46C4-BF0A-9AA6913DDF34} <C:\PROGRA~1\KOS\KOSIEBar.dll, 金山软件股份有限公司> [assist] {FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8} <C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yassist.dll, N/A> [使用网际快车下载] <C:\Program Files\FlashGet\jc_link.htm, N/A> [使用网际快车下载全部链接] <C:\Program Files\FlashGet\jc_all.htm, N/A>
飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:

飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:	发表于： 2006-09-14 15:54 \| 显示全部短消息资料字号：小中大 4楼 ================================== 正在运行的进程 [PID: 420][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 468][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 492][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 536][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 548][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 700][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 748][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 856][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 928][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1012][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1060][c:\program files\rising\rfw\rfwsrv.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 32> [c:\program files\rising\rfw\RfwRule.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 13> [c:\program files\rising\rfw\rfwlog.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 6> [c:\program files\rising\rfw\Rfwdrv.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 21> [c:\program files\rising\rfw\MonDrv.dll] <rs><1, 0, 0, 4> [c:\program files\rising\rfw\ProcLib.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 9> [PID: 1220][C:\WINDOWS\Explorer.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)> [C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21> [C:\WINDOWS\system32\ansi.dll] <N/A><N/A> [F:\金山毒霸2006\KASocket.dll] <Kingsoft Corporation><2005, 2, 22, 233> [F:\金山毒霸2006\KMailOEBand.dll] <N/A><2006, 5, 19, 118> [C:\Program Files\WinRAR\rarext.dll] <N/A><N/A> [PID: 1292][F:\金山毒霸2006\KWatch.EXE] <Kingsoft Corporation><2005, 9, 27, 51> [F:\金山毒霸2006\KAVIPC2.DLL] <Kingsoft Corporation><2004, 12, 28, 20> [F:\金山毒霸2006\KAEPlat.DLL] <Kingsoft Corp.><2005, 12, 29, 56> [F:\金山毒霸2006\KAEMem.DAT] <Kingsoft><2006, 4, 12, 13> [F:\金山毒霸2006\KAEUnpack.DAT] <Kingsoft Corp.><2006, 6, 15, 44> [PID: 1412][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)> [PID: 1488][c:\program files\rising\rfw\RfwMain.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 52> [c:\program files\rising\rfw\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23> [c:\program files\rising\rfw\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [c:\program files\rising\rfw\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [F:\金山毒霸2006\KASocket.dll] <Kingsoft Corporation><2005, 2, 22, 233> [PID: 1608][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] <RealNetworks, Inc.><0.1.0.3208> [F:\金山毒霸2006\KASocket.dll] <Kingsoft Corporation><2005, 2, 22, 233> [PID: 1624][F:\金山毒霸2006\KAVStart.exe] <Kingsoft Corporation><2006, 4, 10, 196> [F:\金山毒霸2006\KAVIPC2.DLL] <Kingsoft Corporation><2004, 12, 28, 20> [F:\金山毒霸2006\PopSprt3.dll] <Kingsoft Corporation><2005, 12, 6, 30> [F:\金山毒霸2006\KAVPassp.dll] <Kingsoft Corporation><2006, 6, 7, 252> [F:\金山毒霸2006\KASocket.dll] <Kingsoft Corporation><2005, 2, 22, 233> [F:\金山毒霸2006\KMailOEBand.dll] <N/A><2006, 5, 19, 118> [PID: 1684][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [F:\金山毒霸2006\KASocket.dll] <Kingsoft Corporation><2005, 2, 22, 233> [PID: 1720][C:\Program Files\Messenger\msmsgs.exe] <Microsoft Corporation><4.7.3001> [F:\金山毒霸2006\KMailOEBand.dll] <N/A><2006, 5, 19, 118> [F:\金山毒霸2006\KASocket.dll] <Kingsoft Corporation><2005, 2, 22, 233> [PID: 1760][F:\金山毒霸2006\KPFW32.EXE] <Kingsoft Corporation><2006, 4, 3, 611> [F:\金山毒霸2006\KAVIPC2.DLL] <Kingsoft Corporation><2004, 12, 28, 20> [F:\金山毒霸2006\KAConfig.DLL] <Kingsoft Corporation><2005, 3, 23, 30> [F:\金山毒霸2006\FiltList.dll] <N/A><N/A> [F:\金山毒霸2006\KAVPassp.DLL] <Kingsoft Corporation><2006, 6, 7, 252> [F:\金山毒霸2006\KASocket.dll] <Kingsoft Corporation><2005, 2, 22, 233> [F:\金山毒霸2006\KMailOEBand.dll] <N/A><2006, 5, 19, 118> [F:\金山毒霸2006\KAEPlat.DLL] <Kingsoft Corp.><2005, 12, 29, 56> [F:\金山毒霸2006\KAEMem.DAT] <Kingsoft><2006, 4, 12, 13> [F:\金山毒霸2006\KAEUnpack.DAT] <Kingsoft Corp.><2006, 6, 15, 44> [F:\金山毒霸2006\KAScript.DLL] <Kingsoft Corporation><2006, 2, 10, 60> [PID: 1844][F:\金山毒霸2006\KMailMon.EXE] <Kingsoft Corporation><2006, 4, 12, 106> [F:\金山毒霸2006\KAntiSpm.dll] <N/A><1, 0, 0, 2> [F:\金山毒霸2006\KAVIPC2.DLL] <Kingsoft Corporation><2004, 12, 28, 20> [F:\金山毒霸2006\KAECall2.DLL] <Kingsoft Corporation><2004, 12, 28, 7> [F:\金山毒霸2006\KAEPlat.DLL] <Kingsoft Corp.><2005, 12, 29, 56> [F:\金山毒霸2006\KAEMem.DAT] <Kingsoft><2006, 4, 12, 13> [F:\金山毒霸2006\KAEUnpack.DAT] <Kingsoft Corp.><2006, 6, 15, 44> [F:\金山毒霸2006\KAConfig.DLL] <Kingsoft Corporation><2005, 3, 23, 30> [F:\金山毒霸2006\KASocket.dll] <Kingsoft Corporation><2005, 2, 22, 233> [F:\金山毒霸2006\KMailOEBand.dll] <N/A><2006, 5, 19, 118> [PID: 1140][F:\金山毒霸2006\KPfwSvc.EXE] <Kingsoft Corporation><2005, 9, 5, 28> [PID: 1452][C:\WINDOWS\system32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: dnsrv(bld4act)> [PID: 1460][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 3596][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)> [F:\金山毒霸2006\KMailOEBand.dll] <N/A><2006, 5, 19, 118> [F:\金山毒霸2006\KASocket.dll] <Kingsoft Corporation><2005, 2, 22, 233> [C:\WINDOWS\system32\kakatool.dll] <Beijing Rising Technology Co., Ltd.><2, 0, 0, 9> [C:\PROGRA~1\KOS\KOSIEBar.dll] <金山软件股份有限公司><2006, 2, 16, 1> [C:\Program Files\QQ2006\QQIEHelper.dll] <深圳市腾讯计算机系统有限公司><1, 1, 0, 5> [F:\金山毒霸2006\KAScript.DLL] <Kingsoft Corporation><2006, 2, 10, 60> [F:\金山毒霸2006\KAEPlat.DLL] <Kingsoft Corp.><2005, 12, 29, 56> [F:\金山毒霸2006\KAEMem.DAT] <Kingsoft><2006, 4, 12, 13> [F:\金山毒霸2006\KAEUnpack.DAT] <Kingsoft Corp.><2006, 6, 15, 44> [C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] <Adobe Systems, Inc.><9,0,16,0> [C:\WINDOWS\Downloaded Program Files\OL2005.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7> [PID: 2828][F:\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505> [F:\金山毒霸2006\KMailOEBand.dll] <N/A><2006, 5, 19, 118> [F:\金山毒霸2006\KASocket.dll] <Kingsoft Corporation><2005, 2, 22, 233> ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\system32\winhlp32.exe %1] .INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 ==================================
飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:

飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:	发表于： 2006-09-14 15:57 \| 显示全部短消息资料字号：小中大 5楼上面是日志,请懂的高手都来看看,多出几个主意,我一个一个试试.在这里先谢谢,晚上来看
飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:

飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:	发表于： 2006-09-14 18:51 \| 显示全部短消息资料字号：小中大 6楼一进"启动项目"就会出现这样的话:警告!注册表值Shell被修改为非正常值(默认值是Explorer.exe).请检查你的系统中可能存在的计算机病毒.然后下面有"确定"的按钮.确定以后进去照你说的删除和编辑那2个文件,但操作完以后只要刷新或重新进入扫描修改的又变了和原来的一样了,不知道怎么会事,望及时解决.
飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:

飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:	发表于： 2006-09-14 19:05 \| 显示全部短消息资料字号：小中大 7楼这两个隐藏文件我找到啦,被我删除了,删除后我又进去编辑了1回,还是会恢复原来的值.删了可能发不了给你了吧，不好意思哈．
飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:

飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:	发表于： 2006-09-14 19:28 \| 显示全部短消息资料字号：小中大 8楼高手操作完成,那两个隐藏文件已经被我彻底删了,注册表里也删了,应该没事了吧,谢谢你了哈,下面我再把扫描的日志贴出来,你帮我看下还有没有问题. 2006-09-14,19:14:25 System Repair Engineer 2.0.21.505 (2.0 RC 2) Smallfrogs (http://www.KZTechs.com) Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能以下内容被选中：所有的启动项目（包括注册表、启动文件夹、服务等）浏览器加载项正在运行的进程（包括进程模块信息）文件关联启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation] <MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background> [Microsoft Corporation] <KavPFW><"F:\金山毒霸2006\KPFW32.EXE"> [Kingsoft Corporation] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <load><> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.] <KavStart><"F:\金山毒霸2006\KAVStart.exe" -startup> [Kingsoft Corporation] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [Microsoft Corporation] <Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <UIHost><logonui.exe> [Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:

飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:	发表于： 2006-09-14 19:28 \| 显示全部短消息资料字号：小中大 9楼 ================================== 启动文件夹 [腾讯QQ] <C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\腾讯QQ.lnk><N> ================================== 服务 [Kingsoft Personal Firewall Service / KPfwSvc] <"F:\金山毒霸2006\KPfwSvc.EXE"><Kingsoft Corporation> [Kingsoft Antivirus KWatch Service / KWatchSvc] <F:\金山毒霸2006\KWatch.EXE><Kingsoft Corporation> [Rising Proxy Service / RfwProxySrv] <c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.> [Rising Personal Firewall Service / RfwService] <c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.> [Rising Process Communication Center / RsCCenter] <"F:\Rising\Rav\CCenter.exe"><N/A> [RsRavMon Service / RsRavMon] <"F:\Rising\Rav\Ravmond.exe"><N/A> ================================== 浏览器加载项 [KAVIEHelper Class] {1B2F92A1-CDAF-4511-9382-91E3F5CE0880} <C:\PROGRA~1\KOS\KOSIEBar.dll, 金山软件股份有限公司> [雅虎助手] {406F94F0-504F-4a40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll, N/A> [QQBrowserHelperObject Class] {54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\QQ2006\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司> [雅虎助手] {406F94F0-504F-4a40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll, N/A> [金山毒霸安全助手] {EF72500A-C234-46C4-BF0A-9AA6913DDF34} <C:\PROGRA~1\KOS\KOSIEBar.dll, 金山软件股份有限公司> [卡卡上网安全助手] {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.> [金山毒霸在线产品升级] {52DF16E3-6C4F-4B22-8BAF-09263E463B48} <C:\PROGRA~1\KOS\KOSInit.ocx, 金山软件股份有限公司> [WUWebControl Class] {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.> [Rising Web Scan Object] {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.> [KAVIEHelper Class] {1B2F92A1-CDAF-4511-9382-91E3F5CE0880} <C:\PROGRA~1\KOS\KOSIEBar.dll, 金山软件股份有限公司> [Windows Media Player] {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation> [HTML Document] {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A> [雅虎助手] {406F94F0-504F-4A40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll, N/A> [金山毒霸在线产品升级] {52DF16E3-6C4F-4B22-8BAF-09263E463B48} <C:\PROGRA~1\KOS\KOSInit.ocx, 金山软件股份有限公司> [QQBrowserHelperObject Class] {54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\QQ2006\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司> [Yahoo!Live] {57421194-58FB-49AE-9B4F-FD48869B9AD4} <C:\PROGRA~1\Yahoo!\ASSIST~1\YAlive.dll, N/A> [金山毒霸在线杀毒] {577A1997-6FD0-4972-B234-885DA583F9CE} <C:\PROGRA~1\KOS\KOSClean.ocx, 金山软件股份有限公司> [Windows Media Player] {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [Microsoft Scriptlet Component] {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation> [卡卡上网安全助手] {AFF6E516-CBE5-4F8A-9C2F-38A68013E766} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.> [SearchAssistantOC] {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A> [RDS.DataSpace] {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation> [VIDEO__X_MS_WMV Moniker Class] {CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [RealPlayer G2 Control] {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.> [卡卡上网安全助手] {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.> [Rising Web Scan Object] {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.> [金山毒霸安全助手] {EF72500A-C234-46C4-BF0A-9AA6913DDF34} <C:\PROGRA~1\KOS\KOSIEBar.dll, 金山软件股份有限公司> [assist] {FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8} <C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yassist.dll, N/A> [使用网际快车下载] <C:\Program Files\FlashGet\jc_link.htm, N/A> [使用网际快车下载全部链接] <C:\Program Files\FlashGet\jc_all.htm, N/A>
飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:

飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:	发表于： 2006-09-14 19:29 \| 显示全部短消息资料字号：小中大 10楼 ================================== 正在运行的进程 [PID: 424][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 472][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 496][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 540][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 552][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 696][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 744][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 808][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 900][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 936][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 980][c:\program files\rising\rfw\rfwsrv.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 32> [c:\program files\rising\rfw\RfwRule.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 13> [c:\program files\rising\rfw\rfwlog.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 6> [c:\program files\rising\rfw\Rfwdrv.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 21> [c:\program files\rising\rfw\MonDrv.dll] <rs><1, 0, 0, 4> [c:\program files\rising\rfw\ProcLib.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 9> [PID: 1160][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)> [F:\金山毒霸2006\KASocket.dll] <Kingsoft Corporation><2005, 2, 22, 233> [F:\金山毒霸2006\KMailOEBand.dll] <N/A><2006, 5, 19, 118> [C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21> [PID: 1236][F:\金山毒霸2006\KWatch.EXE] <Kingsoft Corporation><2005, 9, 27, 51> [F:\金山毒霸2006\KAVIPC2.DLL] <Kingsoft Corporation><2004, 12, 28, 20> [F:\金山毒霸2006\KAEPlat.DLL] <Kingsoft Corp.><2005, 12, 29, 56> [F:\金山毒霸2006\KAEMem.DAT] <Kingsoft><2006, 4, 12, 13> [F:\金山毒霸2006\KAEUnpack.DAT] <Kingsoft Corp.><2006, 6, 15, 44> [PID: 1328][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)> [PID: 1484][c:\program files\rising\rfw\RfwMain.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 52> [c:\program files\rising\rfw\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23> [c:\program files\rising\rfw\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [c:\program files\rising\rfw\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [F:\金山毒霸2006\KASocket.dll] <Kingsoft Corporation><2005, 2, 22, 233> [PID: 1580][F:\金山毒霸2006\KPfwSvc.EXE] <Kingsoft Corporation><2005, 9, 5, 28> [PID: 1628][C:\WINDOWS\system32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: dnsrv(bld4act)> [PID: 1716][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] <RealNetworks, Inc.><0.1.0.3208> [F:\金山毒霸2006\KASocket.dll] <Kingsoft Corporation><2005, 2, 22, 233> [PID: 1748][F:\金山毒霸2006\KAVStart.exe] <Kingsoft Corporation><2006, 4, 10, 196> [F:\金山毒霸2006\KAVIPC2.DLL] <Kingsoft Corporation><2004, 12, 28, 20> [F:\金山毒霸2006\PopSprt3.dll] <Kingsoft Corporation><2005, 12, 6, 30> [F:\金山毒霸2006\KAVPassp.dll] <Kingsoft Corporation><2006, 6, 7, 252> [F:\金山毒霸2006\KASocket.dll] <Kingsoft Corporation><2005, 2, 22, 233> [F:\金山毒霸2006\KMailOEBand.dll] <N/A><2006, 5, 19, 118> [PID: 1888][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [F:\金山毒霸2006\KASocket.dll] <Kingsoft Corporation><2005, 2, 22, 233> [F:\金山毒霸2006\KMailOEBand.dll] <N/A><2006, 5, 19, 118> [PID: 1920][C:\Program Files\Messenger\msmsgs.exe] <Microsoft Corporation><4.7.3001> [F:\金山毒霸2006\KASocket.dll] <Kingsoft Corporation><2005, 2, 22, 233> [F:\金山毒霸2006\KMailOEBand.dll] <N/A><2006, 5, 19, 118> [PID: 1968][F:\金山毒霸2006\KMailMon.EXE] <Kingsoft Corporation><2006, 4, 12, 106> [F:\金山毒霸2006\KAntiSpm.dll] <N/A><1, 0, 0, 2> [F:\金山毒霸2006\KAVIPC2.DLL] <Kingsoft Corporation><2004, 12, 28, 20> [F:\金山毒霸2006\KAECall2.DLL] <Kingsoft Corporation><2004, 12, 28, 7> [F:\金山毒霸2006\KAEPlat.DLL] <Kingsoft Corp.><2005, 12, 29, 56> [F:\金山毒霸2006\KAEMem.DAT] <Kingsoft><2006, 4, 12, 13> [F:\金山毒霸2006\KAEUnpack.DAT] <Kingsoft Corp.><2006, 6, 15, 44> [F:\金山毒霸2006\KAConfig.DLL] <Kingsoft Corporation><2005, 3, 23, 30> [F:\金山毒霸2006\KASocket.dll] <Kingsoft Corporation><2005, 2, 22, 233> [F:\金山毒霸2006\KMailOEBand.dll] <N/A><2006, 5, 19, 118> [PID: 1980][F:\金山毒霸2006\KPFW32.EXE] <Kingsoft Corporation><2006, 4, 3, 611> [F:\金山毒霸2006\KMailOEBand.dll] <N/A><2006, 5, 19, 118> [F:\金山毒霸2006\KASocket.dll] <Kingsoft Corporation><2005, 2, 22, 233> [F:\金山毒霸2006\KAVIPC2.DLL] <Kingsoft Corporation><2004, 12, 28, 20> [F:\金山毒霸2006\KAConfig.DLL] <Kingsoft Corporation><2005, 3, 23, 30> [F:\金山毒霸2006\FiltList.dll] <N/A><N/A> [F:\金山毒霸2006\KAVPassp.DLL] <Kingsoft Corporation><2006, 6, 7, 252> [F:\金山毒霸2006\KAEPlat.DLL] <Kingsoft Corp.><2005, 12, 29, 56> [F:\金山毒霸2006\KAEMem.DAT] <Kingsoft><2006, 4, 12, 13> [F:\金山毒霸2006\KAEUnpack.DAT] <Kingsoft Corp.><2006, 6, 15, 44> [F:\金山毒霸2006\KAScript.DLL] <Kingsoft Corporation><2006, 2, 10, 60> [PID: 1472][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 3048][C:\WINDOWS\system32\wuauclt.exe] <Microsoft Corporation><5.8.0.2469 built by: lab01_n(wmbla)> [PID: 2896][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)> [F:\金山毒霸2006\KMailOEBand.dll] <N/A><2006, 5, 19, 118> [F:\金山毒霸2006\KASocket.dll] <Kingsoft Corporation><2005, 2, 22, 233> [C:\WINDOWS\system32\kakatool.dll] <Beijing Rising Technology Co., Ltd.><2, 0, 0, 9> [C:\PROGRA~1\KOS\KOSIEBar.dll] <金山软件股份有限公司><2006, 2, 16, 1> [C:\Program Files\QQ2006\QQIEHelper.dll] <深圳市腾讯计算机系统有限公司><1, 1, 0, 5> [F:\金山毒霸2006\KAScript.DLL] <Kingsoft Corporation><2006, 2, 10, 60> [F:\金山毒霸2006\KAEPlat.DLL] <Kingsoft Corp.><2005, 12, 29, 56> [F:\金山毒霸2006\KAEMem.DAT] <Kingsoft><2006, 4, 12, 13> [F:\金山毒霸2006\KAEUnpack.DAT] <Kingsoft Corp.><2006, 6, 15, 44> [C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] <Adobe Systems, Inc.><9,0,16,0> [PID: 3224][F:\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505> [F:\金山毒霸2006\KMailOEBand.dll] <N/A><2006, 5, 19, 118> [F:\金山毒霸2006\KASocket.dll] <Kingsoft Corporation><2005, 2, 22, 233> ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM Error. ["hh.exe" %1] .HLP Error. [winhlp32.exe %1] .INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 ================================== 完啦,就是这些,麻烦看下.
飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:

<<上一主题|下一主题>>

12

1 / 2 页

跳转页

页面顶部

Powered by Discuz!NT