Backdoor.Gpigeon.uql .杀不干净 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛 Backdoor.Gpigeon.uql .杀不干净

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

1

1 / 1 页

跳转页

Backdoor.Gpigeon.uql .杀不干净

申苓白术初生襁褓狮帖子:37 注册: 2006-04-07 来自:	发表于： 2006-04-29 19:47 \| 显示全部短消息资料字号：小中大 1楼 Backdoor.Gpigeon.uql .杀不干净我是个菜鸟，有许多东西我不懂　，请大虾能详细说说，怎样才能杀掉这个病毒吗？ 2006-04-30 20:35:27
申苓白术初生襁褓狮帖子:37 注册: 2006-04-07 来自:	分享到：

申苓白术初生襁褓狮帖子:37 注册: 2006-04-07 来自:	发表于： 2006-04-29 19:55 \| 显示全部短消息资料字号：小中大 2楼进程名称路径数值名称数值数据操作方式操作结果 D:\Windows 流氓软件清理大师\srieg.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINStart Pagehttp://www.haokan123.com/修改同意修改 D:\Windows 流氓软件清理大师\IEG\winspeed.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNTkBellExe; "C:\Program Files\Common Files\Real\Update_OB\re修改同意修改 D:\Windows 流氓软件清理大师\IEG\winspeed.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNthunder_mini; F:\Maxthon\Thundermini\ThunderMini.exe修改同意修改 D:\Windows 流氓软件清理大师\IEG\iepro.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNSuper Rabbit IEProD:\Windows 流氓软件清理大师\IEG\SRIECLI.EXE /LOAD修改同意修改 D:\Windows 流氓软件清理大师\IEG\SRIECLI.EXEHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINStart Pageabout:blank修改同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINdefault_page_urlhttp://www.microsoft.com/windows/ie_intl/cn/start/修改同意修改 D:\Windows 流氓软件清理大师\IEG\winspeed.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCESuper Rabbit Winspeed"D:\Windows 流氓软件清理大师\IEG\winspeed.exe" /au修改同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINStart Pagehttp://www.haokan123.com/修改同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSearchAssistant修改同意修改 D:\Windows 流氓软件清理大师\IEG\SRIECLI.EXEHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINStart Pageabout:blank修改同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHCustomizeSearch修改同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSearchAssistant修改同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHCustomizeSearch修改同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSearchAssistanthttp://ie.search.msn.com/{SUB_RFC1766}/srchasst/sr修改同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHCustomizeSearchhttp://ie.search.msn.com/{SUB_RFC1766}/srchasst/sr修改同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWSLOAD删除同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWSload修改同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWSrun修改同意修改 D:\Windows 流氓软件清理大师\IEG\winspeed.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCESuper Rabbit Winspeed"D:\Windows 流氓软件清理大师\IEG\winspeed.exe" /au修改同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINStart Pagehttp://www.haokan123.com/修改同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSearchAssistant修改同意修改 D:\Windows 流氓软件清理大师\IEG\SRIECLI.EXEHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINStart Pageabout:blank修改同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHCustomizeSearch修改同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSearchAssistant修改同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHCustomizeSearch修改同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSearchAssistanthttp://ie.search.msn.com/{SUB_RFC1766}/srchasst/sr修改同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHCustomizeSearchhttp://ie.search.msn.com/{SUB_RFC1766}/srchasst/sr修改同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWSLOAD删除同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWSload修改同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWSrun修改同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_CLASSES_ROOT\CHM.FILE\SHELL\OPEN\COMMAND"C:\WINDOWS\hh.exe" %1修改同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINStart Pagehttp://www.haokan123.com/修改同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSearchAssistant修改同意修改 D:\Windows 流氓软件清理大师\IEG\SRIECLI.EXEHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINStart Pageabout:blank修改同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHCustomizeSearch修改同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSearchAssistant修改同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHCustomizeSearch修改同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSearchAssistanthttp://ie.search.msn.com/{SUB_RFC1766}/srchasst/sr修改同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHCustomizeSearchhttp://ie.search.msn.com/{SUB_RFC1766}/srchasst/sr修改同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWSLOAD删除同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWSload修改同意修改 D:\Windows 流氓软件清理大师\IEG\iehelp.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWSrun修改同意修改 C:\WINDOWS\Explorer.EXEHKEY_CLASSES_ROOT\.HTM\OPENWITHLIST\MICROSOFT OFFICE WORD\SHELL\EDITdefault添加(&P)拒绝修改 C:\WINDOWS\Explorer.EXEHKEY_CLASSES_ROOT\.HTM\OPENWITHLIST\MICROSOFT OFFICE WORDdefault添加(&P)拒绝修改
申苓白术初生襁褓狮帖子:37 注册: 2006-04-07 来自:

申苓白术初生襁褓狮帖子:37 注册: 2006-04-07 来自:	发表于： 2006-04-29 20:15 \| 显示全部短消息资料字号：小中大 3楼 HijackThis@Qoo的扫描日志 V1.97.7 Scan saved at 20:13:54, on 2006-4-29 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe D:\瑞兴杀毒\Rising\Rav\CCenter.exe C:\WINDOWS\System32\svchost.exe D:\瑞兴杀毒\Rising\Rav\Ravmond.exe C:\WINDOWS\Explorer.EXE d:\瑞兴杀毒\rising\rfw\rfwsrv.exe C:\WINDOWS\system32\spoolsv.exe D:\瑞兴杀毒\Rising\Rav\RavStub.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE d:\瑞兴杀毒\rising\rfw\RfwMain.exe F:\Maxthon\Max.exe D:\xunlei\Thunder.exe D:\新建文件夹\HijackThis.exe O2 - BHO: (no name) - {FEDF637B-F631-4583-A210-33CC828D42DB} - D:\WINDOW~1\IEG\HAOKAN~2.DLL O3 - Toolbar: ????? - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll O3 - Toolbar: ????? - {FEDF637B-F631-4583-A210-33CC828D42DB} - D:\WINDOW~1\IEG\HAOKAN~2.DLL O4 - HKLM\..\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [RfwMain] ; "D:\ O4 - HKLM\..\Run: [RavTask] "D:\ O4 - HKLM\..\Run: [SoundMan] ; SOUNDMAN.EXE O4 - HKLM\..\Run: [TkBellExe] ; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [IMSCMig] ; C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload O4 - HKLM\..\Run: [17lelestart] C:\WINDOWS\windcheck2.exe COPYVNETEXE;d:\Program Files\VisionNet\17lele\system\17lele.exe O4 - HKLM\..\Run: [thunder_mini] ; F:\Maxthon\Thundermini\ThunderMini.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [Thunder] "D:\xunlei\ThunderShell.exe" /s O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Super Rabbit IEPro] D:\Windows O4 - Startup: NTUSER.DAT O4 - Startup: ntuser.dat.LOG O4 - Startup: ntuser.ini O4 - Global Startup: ntuser.dat O4 - Global Startup: ntuser.dat.LOG O10 - Broken Internet access because of LSP provider 'c:\windows\system32\nsp.dll' missing O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1143209241827 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{4BA3932C-973B-4121-8899-4C3FCF4E76EA}: NameServer = 202.106.46.151 202.106.0.20 O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - %SystemRoot%\system32\mshtml.dll
申苓白术初生襁褓狮帖子:37 注册: 2006-04-07 来自:

申苓白术初生襁褓狮帖子:37 注册: 2006-04-07 来自:	发表于： 2006-04-29 20:33 \| 显示全部短消息资料字号：小中大 4楼 HijackThis@Qoo的扫描日志 V1.97.7 Scan saved at 20:13:54, on 2006-4-29 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe D:\瑞兴杀毒\Rising\Rav\CCenter.exe C:\WINDOWS\System32\svchost.exe D:\瑞兴杀毒\Rising\Rav\Ravmond.exe C:\WINDOWS\Explorer.EXE d:\瑞兴杀毒\rising\rfw\rfwsrv.exe C:\WINDOWS\system32\spoolsv.exe D:\瑞兴杀毒\Rising\Rav\RavStub.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE d:\瑞兴杀毒\rising\rfw\RfwMain.exe F:\Maxthon\Max.exe D:\xunlei\Thunder.exe D:\新建文件夹\HijackThis.exe O2 - BHO: (no name) - {FEDF637B-F631-4583-A210-33CC828D42DB} - D:\WINDOW~1\IEG\HAOKAN~2.DLL O3 - Toolbar: ????? - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll O3 - Toolbar: ????? - {FEDF637B-F631-4583-A210-33CC828D42DB} - D:\WINDOW~1\IEG\HAOKAN~2.DLL O4 - HKLM\..\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [RfwMain] ; "D:\ O4 - HKLM\..\Run: [RavTask] "D:\ O4 - HKLM\..\Run: [SoundMan] ; SOUNDMAN.EXE O4 - HKLM\..\Run: [TkBellExe] ; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [IMSCMig] ; C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload O4 - HKLM\..\Run: [17lelestart] C:\WINDOWS\windcheck2.exe COPYVNETEXE;d:\Program Files\VisionNet\17lele\system\17lele.exe O4 - HKLM\..\Run: [thunder_mini] ; F:\Maxthon\Thundermini\ThunderMini.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [Thunder] "D:\xunlei\ThunderShell.exe" /s O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Super Rabbit IEPro] D:\Windows O4 - Startup: NTUSER.DAT O4 - Startup: ntuser.dat.LOG O4 - Startup: ntuser.ini O4 - Global Startup: ntuser.dat O4 - Global Startup: ntuser.dat.LOG O10 - Broken Internet access because of LSP provider 'c:\windows\system32\nsp.dll' missing O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1143209241827 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{4BA3932C-973B-4121-8899-4C3FCF4E76EA}: NameServer = 202.106.46.151 202.106.0.20 O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - %SystemRoot%\system32\mshtml.dll
申苓白术初生襁褓狮帖子:37 注册: 2006-04-07 来自:

申苓白术初生襁褓狮帖子:37 注册: 2006-04-07 来自:	发表于： 2006-04-30 11:59 \| 显示全部短消息资料字号：小中大 5楼 Logfile of HijackThis v1.99.1 Scan saved at 11:57:03, on 2006-4-30 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe D:\瑞兴杀毒\Rising\Rav\CCenter.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE D:\瑞兴杀毒\Rising\Rav\Ravmond.exe d:\瑞兴杀毒\rising\rfw\rfwsrv.exe C:\WINDOWS\system32\spoolsv.exe D:\瑞兴杀毒\Rising\Rav\RavStub.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE d:\瑞兴杀毒\rising\rfw\RfwMain.exe F:\Maxthon\Max.exe D:\xunlei\Thunder.exe D:\新建文件夹\HijackThis.exe R3 - Default URLSearchHook is missing O2 - BHO: 好看123上网精灵 - {FEDF637B-F631-4583-A210-33CC828D42DB} - D:\WINDOW~1\IEG\HAOKAN~2.DLL O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll O3 - Toolbar: 好看123上网精灵 - {FEDF637B-F631-4583-A210-33CC828D42DB} - D:\WINDOW~1\IEG\HAOKAN~2.DLL O4 - HKLM\..\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [RfwMain] ; "D:\瑞兴杀毒\Rising\Rfw\rfwmain.exe" -Startup O4 - HKLM\..\Run: [RavTask] "D:\瑞兴杀毒\Rising\Rav\RavTask.exe" -system O4 - HKLM\..\Run: [SoundMan] ; SOUNDMAN.EXE O4 - HKLM\..\Run: [TkBellExe] ; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [IMSCMig] ; C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload O4 - HKLM\..\Run: [17lelestart] C:\WINDOWS\windcheck2.exe COPYVNETEXE;d:\Program Files\VisionNet\17lele\system\17lele.exe O4 - HKLM\..\Run: [thunder_mini] ; F:\Maxthon\Thundermini\ThunderMini.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [Thunder] "D:\xunlei\ThunderShell.exe" /s O4 - HKLM\..\RunOnce: [RavStub] "D:\瑞兴杀毒\Rising\Rav\ravstub.exe" /RUNONCE O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Super Rabbit IEPro] D:\Windows 流氓软件清理大师\IEG\SRIECLI.EXE /LOAD O8 - Extra context menu item: 用比特精灵下载(&B) - E:\BitSpirit\bsurl.htm O10 - Broken Internet access because of LSP provider 'c:\windows\system32\nsp.dll' missing O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1143209241827 O17 - HKLM\System\CCS\Services\Tcpip\..\{4BA3932C-973B-4121-8899-4C3FCF4E76EA}: NameServer = 202.106.46.151 202.106.0.20 O23 - Service: Plaug and Play (Retrieves the serial number ) - Unknown owner - C:\WINDOWS\msconfig.exe O23 - Service: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - d:\瑞兴杀毒\rising\rfw\rfwproxy.exe O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - d:\瑞兴杀毒\rising\rfw\rfwsrv.exe O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\瑞兴杀毒\Rising\Rav\CCenter.exe O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\瑞兴杀毒\Rising\Rav\Ravmond.exe
申苓白术初生襁褓狮帖子:37 注册: 2006-04-07 来自:

申苓白术初生襁褓狮帖子:37 注册: 2006-04-07 来自:	发表于： 2006-04-30 12:00 \| 显示全部短消息资料字号：小中大 6楼这个版本行吗?
申苓白术初生襁褓狮帖子:37 注册: 2006-04-07 来自:

申苓白术初生襁褓狮帖子:37 注册: 2006-04-07 来自:	发表于： 2006-04-30 12:35 \| 显示全部短消息资料字号：小中大 7楼我在从新开机，再把日志发上来
申苓白术初生襁褓狮帖子:37 注册: 2006-04-07 来自:

申苓白术初生襁褓狮帖子:37 注册: 2006-04-07 来自:	发表于： 2006-04-30 12:43 \| 显示全部短消息资料字号：小中大 8楼 Logfile of HijackThis v1.99.1 Scan saved at 12:42:04, on 2006-4-30 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe D:\瑞兴杀毒\Rising\Rav\CCenter.exe C:\WINDOWS\System32\svchost.exe D:\瑞兴杀毒\Rising\Rav\Ravmond.exe C:\WINDOWS\Explorer.EXE d:\瑞兴杀毒\rising\rfw\rfwsrv.exe C:\WINDOWS\system32\spoolsv.exe D:\瑞兴杀毒\Rising\Rav\RavStub.exe d:\瑞兴杀毒\rising\rfw\RfwMain.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE D:\瑞兴杀毒\Rising\Rav\RavTask.exe D:\瑞兴杀毒\Rising\Rav\Ravmon.exe D:\xunlei\ThunderShell.exe C:\WINDOWS\system32\ctfmon.exe D:\Windows 流氓软件清理大师\IEG\SRIECLI.EXE F:\Maxthon\Max.exe E:\BitSpirit\BitSpirit.exe D:\新建文件夹\HijackThis.exe R3 - Default URLSearchHook is missing O2 - BHO: 好看123上网精灵 - {FEDF637B-F631-4583-A210-33CC828D42DB} - D:\WINDOW~1\IEG\HAOKAN~2.DLL O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll O3 - Toolbar: 好看123上网精灵 - {FEDF637B-F631-4583-A210-33CC828D42DB} - D:\WINDOW~1\IEG\HAOKAN~2.DLL O4 - HKLM\..\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [RfwMain] ; "D:\瑞兴杀毒\Rising\Rfw\rfwmain.exe" -Startup O4 - HKLM\..\Run: [RavTask] "D:\瑞兴杀毒\Rising\Rav\RavTask.exe" -system O4 - HKLM\..\Run: [SoundMan] ; SOUNDMAN.EXE O4 - HKLM\..\Run: [TkBellExe] ; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [IMSCMig] ; C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload O4 - HKLM\..\Run: [17lelestart] C:\WINDOWS\windcheck2.exe COPYVNETEXE;d:\Program Files\VisionNet\17lele\system\17lele.exe O4 - HKLM\..\Run: [thunder_mini] ; F:\Maxthon\Thundermini\ThunderMini.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [Thunder] "D:\xunlei\ThunderShell.exe" /s O4 - HKLM\..\RunOnce: [RavStub] "D:\瑞兴杀毒\Rising\Rav\ravstub.exe" /RUNONCE O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Super Rabbit IEPro] D:\Windows 流氓软件清理大师\IEG\SRIECLI.EXE /LOAD O8 - Extra context menu item: 用比特精灵下载(&B) - E:\BitSpirit\bsurl.htm O10 - Broken Internet access because of LSP provider 'c:\windows\system32\nsp.dll' missing O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1143209241827 O17 - HKLM\System\CCS\Services\Tcpip\..\{4BA3932C-973B-4121-8899-4C3FCF4E76EA}: NameServer = 202.106.46.151 202.106.0.20 O23 - Service: Plaug and Play (Retrieves the serial number ) - Unknown owner - C:\WINDOWS\msconfig.exe O23 - Service: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - d:\瑞兴杀毒\rising\rfw\rfwproxy.exe O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - d:\瑞兴杀毒\rising\rfw\rfwsrv.exe O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\瑞兴杀毒\Rising\Rav\CCenter.exe O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\瑞兴杀毒\Rising\Rav\Ravmond.exe
申苓白术初生襁褓狮帖子:37 注册: 2006-04-07 来自:

申苓白术初生襁褓狮帖子:37 注册: 2006-04-07 来自:	发表于： 2006-04-30 12:49 \| 显示全部短消息资料字号：小中大 9楼请在帮我看看.我每次开机杀毒都能杀掉他.但在下一次开机杀毒,他又出现了.在 C:\Program Files\Internet Explorer下.
申苓白术初生襁褓狮帖子:37 注册: 2006-04-07 来自:

申苓白术初生襁褓狮帖子:37 注册: 2006-04-07 来自:	发表于： 2006-04-30 12:55 \| 显示全部短消息资料字号：小中大 10楼 Logfile of HijackThis v1.99.1 Scan saved at 12:53:38, on 2006-4-30 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe D:\瑞兴杀毒\Rising\Rav\CCenter.exe C:\WINDOWS\System32\svchost.exe D:\瑞兴杀毒\Rising\Rav\Ravmond.exe C:\WINDOWS\Explorer.EXE d:\瑞兴杀毒\rising\rfw\rfwsrv.exe C:\WINDOWS\system32\spoolsv.exe D:\瑞兴杀毒\Rising\Rav\RavStub.exe d:\瑞兴杀毒\rising\rfw\RfwMain.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE D:\瑞兴杀毒\Rising\Rav\RavTask.exe D:\瑞兴杀毒\Rising\Rav\Ravmon.exe C:\WINDOWS\system32\ctfmon.exe D:\Windows 流氓软件清理大师\IEG\SRIECLI.EXE F:\Maxthon\Max.exe E:\BitSpirit\BitSpirit.exe D:\xunlei\Thunder.exe D:\新建文件夹\HijackThis.exe R3 - Default URLSearchHook is missing O2 - BHO: 好看123上网精灵 - {FEDF637B-F631-4583-A210-33CC828D42DB} - D:\WINDOW~1\IEG\HAOKAN~2.DLL O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll O3 - Toolbar: 好看123上网精灵 - {FEDF637B-F631-4583-A210-33CC828D42DB} - D:\WINDOW~1\IEG\HAOKAN~2.DLL O4 - HKLM\..\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [RfwMain] ; "D:\瑞兴杀毒\Rising\Rfw\rfwmain.exe" -Startup O4 - HKLM\..\Run: [RavTask] "D:\瑞兴杀毒\Rising\Rav\RavTask.exe" -system O4 - HKLM\..\Run: [SoundMan] ; SOUNDMAN.EXE O4 - HKLM\..\Run: [TkBellExe] ; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [IMSCMig] ; C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload O4 - HKLM\..\Run: [17lelestart] C:\WINDOWS\windcheck2.exe COPYVNETEXE;d:\Program Files\VisionNet\17lele\system\17lele.exe O4 - HKLM\..\Run: [thunder_mini] ; F:\Maxthon\Thundermini\ThunderMini.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [Thunder] "D:\xunlei\ThunderShell.exe" /s O4 - HKLM\..\RunOnce: [RavStub] "D:\瑞兴杀毒\Rising\Rav\ravstub.exe" /RUNONCE O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Super Rabbit IEPro] D:\Windows 流氓软件清理大师\IEG\SRIECLI.EXE /LOAD O8 - Extra context menu item: 用比特精灵下载(&B) - E:\BitSpirit\bsurl.htm O10 - Broken Internet access because of LSP provider 'c:\windows\system32\nsp.dll' missing O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1143209241827 O17 - HKLM\System\CCS\Services\Tcpip\..\{4BA3932C-973B-4121-8899-4C3FCF4E76EA}: NameServer = 202.106.46.151 202.106.0.20 O23 - Service: Plaug and Play (Retrieves the serial number ) - Unknown owner - C:\WINDOWS\msconfig.exe O23 - Service: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - d:\瑞兴杀毒\rising\rfw\rfwproxy.exe O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - d:\瑞兴杀毒\rising\rfw\rfwsrv.exe O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\瑞兴杀毒\Rising\Rav\CCenter.exe O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\瑞兴杀毒\Rising\Rav\Ravmond.exe
申苓白术初生襁褓狮帖子:37 注册: 2006-04-07 来自:

<<上一主题|下一主题>>

1

1 / 1 页

跳转页

页面顶部

Powered by Discuz!NT