瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 Trojan.PSW.Lmir.ksx用瑞星杀不了啊？！

12   2  /  2  页   跳转页

Trojan.PSW.Lmir.ksx用瑞星杀不了啊？！

收藏
liuzht
头像
初生襁褓狮
  • 帖子:76
  • 注册: 2006-02-06
  • 来自:
发表于： 2006-08-04 13:50 | 显示全部 短消息 资料
字号： 小 中 大 11楼

2006-08-04,13:39:54

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 1 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe>  [Microsoft Corporation]
    <MSMSGS><; "C:\Program Files\Messenger\msmsgs.exe" /background>  [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  []
    <run><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <SoundMan><SOUNDMAN.EXE>  [Realtek Semiconductor Corp.]
    <BigDogPath><; C:\WINDOWS\VM_STI.EXE USB PC Camera 301P>  []
    <nwiz><nwiz.exe /install>  [NVIDIA Corporation]
    <NeroFilterCheck><; C:\WINDOWS\system32\NeroCheck.exe>  [Ahead Software Gmbh]
    <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
    <TProgram><; C:\WINDOWS\SMSS.EXE>  [bH7ed8SjdCw7]
    <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup>  [NVIDIA Corporation]
    <ToP><C:\WINDOWS\LSASS.exe>  [oJSni23Skjw5SD]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
    <TProgram><; C:\WINDOWS\SMSS.EXE>  [bH7ed8SjdCw7]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe 1>  []
    <Userinit><userinit.exe,>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><KB919331M.LOG>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll>  [Beijing Rising Technology Co., Ltd.]

==================================
启动文件夹
[Adobe Gamma Loader]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Gamma Loader.lnk><H>
[Adobe Gamma]
  <C:\Documents and Settings\sv\「开始」菜单\程序\启动\Adobe Gamma.lnk><N>

==================================
gototop
 
liuzht
头像
初生襁褓狮
  • 帖子:76
  • 注册: 2006-02-06
  • 来自:
发表于： 2006-08-04 13:51 | 显示全部 短消息 资料
字号： 小 中 大 12楼

==================================
服务
[Adobe LM Service / Adobe LM Service]
  <"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>
[NVIDIA Display Driver Service / NVSvc]
  <C:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation>
[Rising Process Communication Center / RsCCenter]
  <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
  <"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>

==================================
浏览器加载项
[ThunderIEHelper Class]
  {0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\System32\xunleibho_v14.dll, Thunder Networking Technologies,LTD>
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <D:\QQ已安装\qq\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[超级兔子上网精灵]
  {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} <C:\Program Files\Super Rabbit\MagicSet\haokanbar.dll, Xiang Feng Technology>
[IeCatch2 Class]
  {A5366673-E8CA-11D3-9CD9-0090271D075B} <C:\PROGRA~1\MOVIEM~1\FLASHGET\jccatch.dll, Amaze Soft>
[Google Toolbar Helper]
  {AA58ED58-01DD-4d91-8333-CF10577473F7} <c:\program files\google\googletoolbar1.dll, Google Inc.>
[讯通视频语音聊天]
  {97C0CDFA-970D-4222-ADDE-6718E89E887C} <http://www.bdsystem.com/, N/A>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <D:\QQ已安装\qq\QQ.EXE, TENCENT>
[FlashGet]
  {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\PROGRA~1\MOVIEM~1\FLASHGET\flashget.exe, Amaze Soft>
[QQIEFloatBarCfgCmd Class]
  {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <D:\QQ已安装\qq\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[卡卡上网安全助手]
  {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\System32\KakaTool.dll, Beijing Rising Technology Co., Ltd.>
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[&Google]
  {2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar1.dll, Google Inc.>
[FlashGet Bar]
  {E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\MOVIEM~1\FLASHGET\fgiebar.dll, Amaze Soft>
[超级兔子上网精灵]
  {43869BB3-22FD-4F15-9B46-238106BA2F4E} <C:\Program Files\Super Rabbit\MagicSet\haokanbar.dll, Xiang Feng Technology>
[WebActivater Control]
  {3D8F74EE-8692-4F8F-B8D2-7522E732519E} <C:\WINDOWS\System32\WEBACT~1.OCX, QQ>
[GolfInstallCheck2 Class]
  {3F618E1F-D981-4905-A757-4D237441B5B3} <C:\WINDOWS\Downloaded Program Files\CONFLICT.1\GolfInstallCheck2.dll, >
[IMCv1 Control]
  {6924091F-CD97-41E1-B1D4-D9079409D413} <, N/A>
[Filetran Control]
  {88734439-46D0-42C0-A13F-7E881EE550CF} <C:\PROGRA~1\Bluesky\BLUESK~1\filetran.ocx, Bluesky Studio(http://www.bluesky.cn)>
[Blueskyvoice Control]
  {991481A7-4669-4E15-8C24-100404E1F5CB} <C:\PROGRA~1\Bluesky\BLUESK~1\BLUESK~2.OCX, 蓝天工作室(http://www.bluesky.cn)>
[photo_uploader Control]
  {A984ED9F-E8DA-44E5-BC18-C14B9ABEF79D} <C:\WINDOWS\DOWNLO~1\PHOTO_~1.OCX, N/A>
[KSHScan Control]
  {ACFE8232-03C5-4AEC-AF5E-42B806724096} <C:\WINDOWS\System32\kingsoft\ONLINE~1\KSHScan.ocx, kingsoft>
[GLWebAvt Control]
  {C14D003A-DA41-4FEE-8204-62A94EAA29D1} <C:\WINDOWS\DOWNLO~1\GLWebAvt.ocx, >
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[SAIX]
  {DECEAAA2-370A-49BB-9362-68C3A58DDC62} <, N/A>
[&使用迅雷下载]
  <C:\Program Files\Thunder Network\Thunder\geturl.htm, N/A>
[&使用迅雷下载全部链接]
  <C:\Program Files\Thunder Network\Thunder\getallurl.htm, N/A>
[上传到QQ网络硬盘]
  <D:\QQ已安装\qq\AddToNetDisk.htm, N/A>
[使用网际快车下载]
  <C:\PROGRA~1\MOVIEM~1\FLASHGET\jc_link.htm, N/A>
[使用网际快车下载全部链接]
  <C:\PROGRA~1\MOVIEM~1\FLASHGET\jc_all.htm, N/A>
[反向链接]
  <res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html, N/A>
[添加到QQ自定义面板]
  <D:\QQ已安装\qq\AddPanel.htm, N/A>
[添加到QQ表情]
  <D:\QQ已安装\qq\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <D:\QQ已安装\qq\SendMMS.htm, N/A>
[缓存的网页快照]
  <res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html, N/A>

==================================
gototop
 
liuzht
头像
初生襁褓狮
  • 帖子:76
  • 注册: 2006-02-06
  • 来自:
发表于： 2006-08-04 13:51 | 显示全部 短消息 资料
字号： 小 中 大 13楼

正在运行的进程
[PID: 392][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 772][\??\C:\WINDOWS\system32\csrss.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 796][\??\C:\WINDOWS\system32\winlogon.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
    [C:\WINDOWS\KB919331M.LOG]  <N/A><N/A>
[PID: 888][C:\WINDOWS\system32\services.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
    [C:\WINDOWS\KB919331M.LOG]  <N/A><N/A>
[PID: 900][C:\WINDOWS\system32\lsass.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
    [C:\WINDOWS\KB919331M.LOG]  <N/A><N/A>
[PID: 1080][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
    [C:\WINDOWS\KB919331M.LOG]  <N/A><N/A>
[PID: 1204][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
    [C:\WINDOWS\KB919331M.LOG]  <N/A><N/A>
[PID: 1332][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
    [C:\WINDOWS\KB919331M.LOG]  <N/A><N/A>
[PID: 1380][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
    [C:\WINDOWS\KB919331M.LOG]  <N/A><N/A>
[PID: 1644][C:\WINDOWS\system32\spoolsv.exe]  <Microsoft Corporation><5.1.2600.0 (XPClient.010817-1148)>
    [C:\WINDOWS\KB919331M.LOG]  <N/A><N/A>
[PID: 1924][C:\WINDOWS\Explorer.exe]  <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
    [C:\WINDOWS\KB919331M.LOG]  <N/A><N/A>
    [C:\WINDOWS\system32\RavExt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
    [C:\WINDOWS\System32\xunleibho_v14.dll]  <Thunder Networking Technologies,LTD><4, 6, 0, 62>
    [C:\PROGRA~1\MOVIEM~1\FLASHGET\jccatch.dll]  <Amaze Soft><1, 1, 4, 0>
    [C:\Program Files\WinRAR\rarext.dll]  <N/A><N/A>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 248][C:\WINDOWS\System32\alg.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
    [C:\WINDOWS\KB919331M.LOG]  <N/A><N/A>
[PID: 316][C:\WINDOWS\System32\nvsvc32.exe]  <NVIDIA Corporation><6.14.10.5672>
    [C:\WINDOWS\KB919331M.LOG]  <N/A><N/A>
[PID: 460][C:\WINDOWS\System32\wdfmgr.exe]  <Microsoft Corporation><5.2.3790.1230 built by: dnsrv(bld4act)>
    [C:\WINDOWS\KB919331M.LOG]  <N/A><N/A>
[PID: 484][C:\WINDOWS\SMSS.EXE]  <bH7ed8SjdCw7><0.00.0087>
    [C:\WINDOWS\KB919331M.LOG]  <N/A><N/A>
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 664][C:\WINDOWS\SOUNDMAN.EXE]  <Realtek Semiconductor Corp.><5.1.0.35>
    [C:\WINDOWS\KB919331M.LOG]  <N/A><N/A>
[PID: 756][C:\Program Files\Rising\Rav\RavTask.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
    [C:\WINDOWS\KB919331M.LOG]  <N/A><N/A>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [C:\Program Files\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
[PID: 264][C:\WINDOWS\System32\ctfmon.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
    [C:\WINDOWS\KB919331M.LOG]  <N/A><N/A>
[PID: 1704][D:\QQ已安装\qq\QQ.exe]  <TENCENT><0, 0, 0, 0>
    [D:\QQ已安装\qq\CoralAssist.DLL]  <Coral Team><4.5.0 build 20060515>
    [D:\QQ已安装\qq\CoralQQ.DLL]  <Coral Team><4.5.1 Build 20060620>
    [D:\QQ已安装\qq\ipsearcher.dll]  <N/A><1.0.0.4>
    [D:\QQ已安装\qq\QQBaseClassInDll.dll]  <><1, 0, 0, 1>
    [D:\QQ已安装\qq\QQHelperDll.dll]  <><1, 0, 0, 1>
    [D:\QQ已安装\qq\BasicCtrlDll.dll]  <Tencent><5, 0, 200, 160>
    [C:\WINDOWS\KB919331M.LOG]  <N/A><N/A>
    [D:\QQ已安装\qq\QQAPI.dll]  <><1, 0, 0, 1>
    [D:\QQ已安装\qq\TIMProxy.dll]  <tencent><0, 3, 2, 4>
    [D:\QQ已安装\qq\LoginCtrl.dll]  <><1, 0, 0, 1>
    [D:\QQ已安装\qq\npkcntc.dll]  <INCA Internet Co., Ltd.><2006, 3, 2, 1>
    [D:\QQ已安装\qq\npkpdb.dll]  <INCA Internet Co., Ltd.><2003, 10, 1, 1>
    [D:\QQ已安装\qq\QQRes.dll]  <tencent><1, 0, 0, 1>
    [D:\QQ已安装\qq\QQMainFrame.dll]  <N/A><N/A>
    [D:\QQ已安装\qq\CQQApplication.dll]  <N/A><N/A>
    [D:\QQ已安装\qq\NewSkin.dll]  <><1, 0, 0, 1>
    [D:\QQ已安装\qq\HostingMgr.dll]  <><1, 0, 0, 1>
    [D:\QQ已安装\qq\CameraDll.dll]  <><1, 0, 0, 1>
    [D:\QQ已安装\qq\MailSummary.dll]  <><1, 0, 0, 1>
    [D:\QQ已安装\qq\QQSpace.dll]  <><1, 0, 0, 1>
    [C:\WINDOWS\System32\msdmo.dll]  <N/A><N/A>
    [D:\QQ已安装\qq\QQGroupMng.dll]  <><1, 0, 0, 1>
    [D:\QQ已安装\qq\GroupLive.dll]  <N/A><N/A>
    [D:\QQ已安装\qq\QQSysMsgMng.dll]  <N/A><N/A>
    [D:\QQ已安装\qq\UserDefinedHead.dll]  <><1, 0, 0, 1>
    [D:\QQ已安装\qq\QQPlugin.dll]  <N/A><N/A>
    [D:\QQ已安装\qq\QQConfigPlugin.dll]  <><1, 0, 0, 1>
    [D:\QQ已安装\qq\QQAllInOne.dll]  <N/A><N/A>
    [D:\QQ已安装\qq\SCCore.dll]  <N/A><N/A>
    [D:\QQ已安装\qq\QQCustomFace.dll]  <N/A><N/A>
    [D:\QQ已安装\qq\QQPet.dll]  <><1, 0, 0, 1>
    [D:\QQ已安装\qq\LongConnection.dll]  <tencent><5, 0, 200, 160>
    [D:\QQ已安装\qq\FlashAvatarDll.dll]  <><1, 4, 0, 1>
    [C:\WINDOWS\System32\Macromed\Flash\Flash9.ocx]  <Adobe Systems, Inc.><9,0,16,0>
    [D:\QQ已安装\qq\QRingMng.dll]  <N/A><N/A>
    [D:\QQ已安装\qq\QQMagicFace.dll]  <><1, 0, 0, 1>
    [D:\QQ已安装\qq\QQAvatar.dll]  <N/A><N/A>
    [D:\QQ已安装\qq\QQSceneMng.dll]  <N/A><N/A>
    [D:\QQ已安装\qq\PhoneAPI.dll]  <><1, 0, 0, 1>
    [D:\QQ已安装\qq\DialerAllinOne.dll]  <tencent><1, 4, 0, 0>
    [D:\QQ已安装\qq\ImageOle.dll]  <TODO: <Company name>><1.0.0.1>
    [D:\QQ已安装\qq\BQQApplication.dll]  <N/A><N/A>
    [D:\QQ已安装\qq\GroupConnection.dll]  <Tencent><5, 0, 202, 170>
    [D:\QQ已安装\qq\VqqModule.dll]  <><1, 0, 0, 1>
    [C:\WINDOWS\system32\RavExt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
    [D:\QQ已安装\qq\CommercesMng.dll]  <><1, 0, 0, 1>
    [D:\QQ已安装\qq\PersonalDesktop.dll]  <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2>
    [D:\QQ已安装\qq\QQUdpGetFileLib.dll]  <tencent><0, 2, 2, 3>
    [D:\QQ已安装\qq\QQAddr.dll]  <深圳市腾讯计算机系统有限公司><5, 0, 101, 200>
    [D:\QQ已安装\qq\VqqAllInOne.dll]  <Tencent><1, 5, 0, 3>
    [D:\QQ已安装\qq\tencent-proto1.dll]  <tencent><1, 5, 0, 3>
    [D:\QQ已安装\qq\tencent-comlib.dll]  <tencent><1.4.0.2>
    [D:\QQ已安装\qq\tencent-proto2.dll]  <tencent><1, 5, 0, 3>
    [D:\QQ已安装\qq\inplus.dll]  <Tencent><1.5.0.0>
    [C:\WINDOWS\System32\VM31bPrp.Ax]  <VM><4.2.711.31>
    [D:\QQ已安装\qq\audioengine.dll]  <TENCENT><1, 4, 0, 3>
    [D:\QQ已安装\qq\GIPSVoiceEngineDLL.dll]  <Global IP Sound><2, 0, 2, 1>
    [D:\QQ已安装\qq\VideoDevice.dll]  <Tencent><1.5.0.0>
    [D:\QQ已安装\qq\VCodec.dll]  <Tencent><1, 5, 0, 1>
    [D:\QQ已安装\qq\QQPhoneHelper.dll]  <腾讯科技（深圳）有限公司><2, 0, 5, 50>
    [D:\QQ已安装\qq\QQMMSender.dll]  <N/A><N/A>
[PID: 1696][D:\QQ已安装\qq\TIMPlatform.exe]  <tencent><0, 3, 1, 8>
    [C:\WINDOWS\KB919331M.LOG]  <N/A><N/A>
    [D:\QQ已安装\qq\TIMProxy.dll]  <tencent><0, 3, 2, 4>
[PID: 440][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
    [C:\WINDOWS\KB919331M.LOG]  <N/A><N/A>
    [C:\Program Files\Super Rabbit\MagicSet\haokanbar.dll]  <Xiang Feng Technology><2, 2, 0, 1587>
    [c:\program files\google\googletoolbar1.dll]  <Google Inc.><3, 0, 131, 0>
    [C:\WINDOWS\System32\xunleibho_v14.dll]  <Thunder Networking Technologies,LTD><4, 6, 0, 62>
    [D:\QQ已安装\qq\QQIEHelper.dll]  <深圳市腾讯计算机系统有限公司><1, 1, 0, 5>
    [C:\PROGRA~1\MOVIEM~1\FLASHGET\jccatch.dll]  <Amaze Soft><1, 1, 4, 0>
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\WINDOWS\System32\Macromed\Flash\Flash9.ocx]  <Adobe Systems, Inc.><9,0,16,0>
[PID: 1800][C:\WINDOWS\LSASS.exe]  <oJSni23Skjw5SD><0.00.0087>
    [C:\WINDOWS\KB919331M.LOG]  <N/A><N/A>
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 2976][C:\WINDOWS\system32\NOTEPAD.EXE]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
    [C:\WINDOWS\KB919331M.LOG]  <N/A><N/A>
[PID: 2204][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
    [C:\WINDOWS\KB919331M.LOG]  <N/A><N/A>
[PID: 2808][D:\原安装文件（勿删）\HijackThis\HijackThis1991汉化版\HijackThis1991zww.exe]  <Soeperman Enterprises Ltd.><1.99.0001>
    [C:\WINDOWS\KB919331M.LOG]  <N/A><N/A>
    [C:\WINDOWS\system32\RavExt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[PID: 3064][C:\WINDOWS\system32\NOTEPAD.EXE]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
    [C:\WINDOWS\KB919331M.LOG]  <N/A><N/A>
[PID: 4016][D:\原安装文件（勿删）\System Repair Engineer\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>
    [C:\WINDOWS\KB919331M.LOG]  <N/A><N/A>

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  Error. [WindowFiles]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================
gototop
 
liuzht
头像
初生襁褓狮
  • 帖子:76
  • 注册: 2006-02-06
  • 来自:
发表于： 2006-08-04 14:19 | 显示全部 短消息 资料
字号： 小 中 大 14楼

顶一下....
gototop
 
liuzht
头像
初生襁褓狮
  • 帖子:76
  • 注册: 2006-02-06
  • 来自:
发表于： 2006-08-04 15:34 | 显示全部 短消息 资料
字号： 小 中 大 15楼

【回复“westbeck”的帖子】
我不嫌麻烦，呵呵 只要老师你不嫌麻烦就可以啊，请赐教...
gototop
 
liuzht
头像
初生襁褓狮
  • 帖子:76
  • 注册: 2006-02-06
  • 来自:
发表于： 2006-08-04 17:48 | 显示全部 短消息 资料
字号： 小 中 大 16楼

老师：给我看看现在怎么样了啊....
HijackThis_815汉化版扫描日志 V1.99.1
保存于      17:37:38, 日期 2006-08-04
操作系统：  Windows XP SP1 (WinNT 5.01.2600)
浏览器：    Internet Explorer v6.00 SP1 (6.00.2800.1106)

当前运行的进程：         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rising\Rav\Ravmond.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\VM_STI.EXE
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\原安装文件（勿删）\HijackThis\HijackThis1991汉化版\HijackThis1991zww.exe

R3 - 默认的URLSearchHook丢失。用HijackThis修复
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: (no name) - {3ED9FFDA-79DB-4B2D-99B7-16EA3C4A3A92} - (no file)
O2 - BHO: (no name) - {616D4040-5712-4F0F-BCF1-5C6420A99E14} - (no file)
O2 - BHO: 超级兔子上网精灵 - {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} - (no file)
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O3 - IE工具栏增项: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\System32\KakaTool.dll
O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - IE工具栏增项: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - IE工具栏增项: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\MOVIEM~1\FLASHGET\fgiebar.dll
O3 - IE工具栏增项: 超级兔子上网精灵 - {43869BB3-22FD-4F15-9B46-238106BA2F4E} - C:\Program Files\Super Rabbit\MagicSet\haokanbar.dll
O4 - 启动项HKLM\\Run: [SoundMan] SOUNDMAN.EXE
O4 - 启动项HKLM\\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE USB PC Camera 301P
O4 - 启动项HKLM\\Run: [nwiz] ; nwiz.exe /install
O4 - 启动项HKLM\\Run: [NeroFilterCheck] ; C:\WINDOWS\system32\NeroCheck.exe
O4 - 启动项HKLM\\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] ; "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - IE右键菜单中的新增项目: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\geturl.htm
O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\getallurl.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载 - C:\PROGRA~1\MOVIEM~1\FLASHGET\jc_link.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链接 - C:\PROGRA~1\MOVIEM~1\FLASHGET\jc_all.htm
O8 - IE右键菜单中的新增项目: 反向链接 - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - IE右键菜单中的新增项目: 缓存的网页快照 - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - 浏览器额外的按钮: 讯通视频语音聊天 - {97C0CDFA-970D-4222-ADDE-6718E89E887C} - http://www.bdsystem.com/ (file missing)
O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\QQ已安装\qq\QQ.EXE
O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\QQ已安装\qq\QQ.EXE
O9 - 浏览器额外的按钮: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\MOVIEM~1\FLASHGET\flashget.exe
O9 - 浏览器额外的“工具”菜单项: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\MOVIEM~1\FLASHGET\flashget.exe
O16 - DPF: {3D8F74EE-8692-4F8F-B8D2-7522E732519E} (WebActivater Control) - http://game.qq.com/QQGame2.cab
O16 - DPF: {3F618E1F-D981-4905-A757-4D237441B5B3} (GolfInstallCheck2 Class) - http://download.ourgame.com/GolfInstallCheck2.cab
O16 - DPF: {6924091F-CD97-41E1-B1D4-D9079409D413} (IMCv1 Control) - http://shliao.com:1995/talk.cab
O16 - DPF: {88734439-46D0-42C0-A13F-7E881EE550CF} (Filetran Control) - http://pimg.163.com/club/vchat/filetran.cab
O16 - DPF: {991481A7-4669-4E15-8C24-100404E1F5CB} (Blueskyvoice Control) - http://www.bluesky.cn/download/blueskyvoice_60.cab
O16 - DPF: {A984ED9F-E8DA-44E5-BC18-C14B9ABEF79D} (photo_uploader Control) - http://upload.photo.163.com/photoup.cab
O16 - DPF: {ACFE8232-03C5-4AEC-AF5E-42B806724096} (KSHScan Control) - http://safe.qq.com/scan/KAllScan.CAB
O16 - DPF: {C14D003A-DA41-4FEE-8204-62A94EAA29D1} (GLWebAvt Control) - http://bbs.ourgame.com/image/GLWebAvt.cab
O16 - DPF: {DECEAAA2-370A-49BB-9362-68C3A58DDC62} (SAIX) - http://static.zangocash.com/cab/Zango/ie/bridge-c18.cab?da8058c66c08fbf6b7765fb0f3159a55044a4bf4d84035dec0a09acb6467328be4fe4bc84d7bf66a7ac19bce14966dbe7f291de8076653b0508a8f0ff65fc8a22502fdad81df4a8b:278a3d34c2078d9522cc73d7fb3f8d5b
O16 - DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} - http://ps.itv.mop.com/dn/files/pCastCtl_1.0.0.76_20051110.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{23F78393-D8FA-4165-9BD4-147A414419FE}: NameServer = 202.102.128.68
O17 - HKLM\System\CCS\Services\Tcpip\..\{771390A3-E369-43C0-8DA7-23AB9D7FC48A}: NameServer = 219.150.32.132 219.146.0.130
O17 - HKLM\System\CCS\Services\Tcpip\..\{8B4A62EE-9583-40D0-BCFD-92B5751A6176}: NameServer = 219.146.0.130
O17 - HKLM\System\CS1\Services\Tcpip\..\{23F78393-D8FA-4165-9BD4-147A414419FE}: NameServer = 202.102.128.68
O17 - HKLM\System\CS2\Services\Tcpip\..\{23F78393-D8FA-4165-9BD4-147A414419FE}: NameServer = 202.102.128.68
O23 - NT 服务: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - NT 服务: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
gototop
 
liuzht
头像
初生襁褓狮
  • 帖子:76
  • 注册: 2006-02-06
  • 来自:
发表于： 2006-08-04 17:49 | 显示全部 短消息 资料
字号： 小 中 大 17楼

2006-08-04,17:37:21

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 1 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe>  [Microsoft Corporation]
    <MSMSGS><; "C:\Program Files\Messenger\msmsgs.exe" /background>  [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  []
    <run><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <SoundMan><SOUNDMAN.EXE>  [Realtek Semiconductor Corp.]
    <BigDogPath><C:\WINDOWS\VM_STI.EXE USB PC Camera 301P>  []
    <nwiz><; nwiz.exe /install>  [NVIDIA Corporation]
    <NeroFilterCheck><; C:\WINDOWS\system32\NeroCheck.exe>  [Ahead Software Gmbh]
    <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><EXPLORER.EXE>  [Microsoft Corporation]
    <Userinit><userinit.exe,>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll>  [Beijing Rising Technology Co., Ltd.]

==================================
启动文件夹
[Adobe Gamma Loader]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Gamma Loader.lnk><H>
[Adobe Gamma]
  <C:\Documents and Settings\sv\「开始」菜单\程序\启动\Adobe Gamma.lnk><N>

==================================
服务
[Adobe LM Service / Adobe LM Service]
  <"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>
[NVIDIA Display Driver Service / NVSvc]
  <C:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation>
[Rising Process Communication Center / RsCCenter]
  <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
  <"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>

==================================
gototop
 
liuzht
头像
初生襁褓狮
  • 帖子:76
  • 注册: 2006-02-06
  • 来自:
发表于： 2006-08-04 17:50 | 显示全部 短消息 资料
字号： 小 中 大 18楼

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================
gototop
 
liuzht
头像
初生襁褓狮
  • 帖子:76
  • 注册: 2006-02-06
  • 来自:
发表于： 2006-08-05 10:06 | 显示全部 短消息 资料
字号： 小 中 大 19楼

【回复“mopery”的帖子】
老师：你是说还有没有杀干净得么？
gototop
 
liuzht
头像
初生襁褓狮
  • 帖子:76
  • 注册: 2006-02-06
  • 来自:
发表于： 2006-08-05 10:10 | 显示全部 短消息 资料
字号： 小 中 大 20楼

我现在用瑞星又杀了一遍，没有提示有病毒啊，也没有死机得现象发生了...这样就是杀干净了么？
还请各位老师指教...
谢谢了啊...
gototop
 
<<上一主题|下一主题>>
12   2  /  2  页   跳转页
页面顶部
Powered by Discuz!NT