瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 【求助】一下子中了好多病毒,瑞星无法删除,日期也改掉了,请高手帮忙

1   1  /  1  页   跳转

【求助】一下子中了好多病毒,瑞星无法删除,日期也改掉了,请高手帮忙

【求助】一下子中了好多病毒,瑞星无法删除,日期也改掉了,请高手帮忙

不知怎么搞的,一下子中了好多病毒,瑞星删都删不掉啊,监控也自动退出了,连日期也改成2005年了,请高手指教改怎么弄,小弟在线等~~~~

附件附件:

下载次数:255
文件类型:application/octet-stream
文件大小:
上传时间:2007-6-3 16:58:43
描述:



最后编辑2007-06-03 19:39:46
分享到:
gototop
 

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe>  [(Verified)Microsoft Corporation]
    <Super Rabbit IEPro><D:\超级兔子\MagicSet\SRIECLI.EXE /LOAD>  [Super Rabbit Soft]
    <0te><C:\DOCUME~1\caiyong\LOCALS~1\Temp\c0nime.exe>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Corporation]
    <PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Corporation]
    <PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Corporation]
    <RfwMain><"C:\Program Files\rising\Rfw\rfwmain.exe" -Startup>  [Beijing Rising Technology Co., Ltd.]
    <RavTask><"C:\Program Files\rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
    <KernelFaultCheck><%systemroot%\system32\dumprep 0 -k>  [N/A]
    <BigDogPath><C:\WINDOWS\VM_STI.EXE USB PC Camera 301P>  [N/A]
    <AVPSrv><C:\WINDOWS\AVPSrv.exe>  [N/A]
    <MsIMMs32><C:\WINDOWS\MsIMMs32.exe>  [N/A]
    <mppds><C:\WINDOWS\mppds.exe>  [N/A]
    <cmdbcs><C:\WINDOWS\cmdbcs.exe>  [N/A]
    <msccrt><C:\WINDOWS\msccrt.exe>  [N/A]
    <upxdnd><C:\WINDOWS\upxdnd.exe>  [N/A]
    <Kvsc3><C:\WINDOWS\Kvsc3.exe>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><C:\WINDOWS\System32\userinit.exe,>  [(Verified)Microsoft Corporation]
    <UIHost><logonui.exe>  [(Verified)Microsoft Corporation]

==================================
启动文件夹
[QQ游戏启动加速程序]
  <C:\Documents and Settings\caiyong\「开始」菜单\程序\启动\QQ游戏启动加速程序.lnk --> E:\PROGRA~1\Tencent\QQGame\Accel.exe [深圳市腾讯计算机系统有限公司]><N>

==================================
服务
[2BDF82F8 / 2BDF82F8]
  <C:\WINDOWS\System32\8057B2EC.EXE -d><Microsoft Corporation>
[Ati HotKey Poller / Ati HotKey Poller]
  <C:\WINDOWS\System32\Ati2evxx.exe><N/A>
[ATI Smart / ATI Smart]
  <C:\WINDOWS\system32\ati2sgag.exe><>
[C-DillaCdaC11BA / C-DillaCdaC11BA]
  <C:\WINDOWS\System32\drivers\CDAC11BA.EXE><Macrovision>
[F23E0A68 / F23E0A68]
  <C:\WINDOWS\System32\CADE01E0.EXE -k><Microsoft Corporation>
[Human Interface Device Access / HidServ]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Macromedia Licensing Service / Macromedia Licensing Service]
  <"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><N/A>
[Rising Personal Firewall Service / RfwService]
  <C:\Program Files\rising\Rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter]
  <"C:\Program Files\rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon]
  <"C:\Program Files\rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
gototop
 

驱动程序
[Service for WDM 3D Audio Driver / ALCXSENS]
  <system32\drivers\ALCXSENS.SYS><Sensaura Ltd>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[ati2mtag / ati2mtag]
  <System32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[Rising TDI Base Driver / BaseTDI]
  <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[CdaC15BA / CdaC15BA]
  <\??\C:\WINDOWS\System32\drivers\CDAC15BA.SYS><Macrovision Europe Ltd>
[Cdsys / Cdsys]
  <\??\C:\WINDOWS\System32\cdcd.sys><N/A>
[d347bus / d347bus]
  <\SystemRoot\System32\DRIVERS\d347bus.sys><>
[d347prt / d347prt]
  <\SystemRoot\System32\Drivers\d347prt.sys><>
[EagleNT / EagleNT]
  <\??\C:\WINDOWS\System32\drivers\EagleNT.sys><N/A>
[ExpScaner / ExpScaner]
  <\??\C:\Program Files\rising\Rav\ExpScan.sys><>
[GMSIPCI / GMSIPCI]
  <\??\G:\INSTALL\GMSIPCI.SYS><N/A>
[HookCont / HookCont]
  <\??\C:\Program Files\rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg]
  <\??\C:\Program Files\rising\Rav\HookReg.sys><>
[HookSys / HookSys]
  <\??\C:\Program Files\rising\Rav\HookSys.sys><Rising>
[HookUrl / HookUrl]
  <\??\C:\Program Files\rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[kmsinput / kmsinput]
  <\??\C:\WINDOWS\System32\drivers\kmsinput.sys><N/A>
[MEMSCAN / MEMSCAN]
  <\??\C:\Program Files\rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[mProcRs / mProcRs]
  <\??\c:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[Nokia USB Generic / Nokia USB Generic]
  <system32\drivers\nmwcdc.sys><Nokia>
[Nokia USB Modem / Nokia USB Modem]
  <system32\drivers\nmwcdcm.sys><Nokia>
[Nokia USB Phone Parent / Nokia USB Phone Parent]
  <system32\drivers\nmwcd.sys><Nokia>
[Netgroup Packet Filter / NPF]
  <system32\drivers\npf.sys><CACE Technologies>
[npkcrypt / npkcrypt]
  <\??\D:\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[npkycryp / npkycryp]
  <\??\D:\QQ\npkycryp.sys><N/A>
[Direct Parallel Link Driver / Ptilink]
  <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[PxHelp20 / PxHelp20]
  <\SystemRoot\System32\DRIVERS\PxHelp20.sys><Sonic Solutions>
[RsFwDrv / RsFwDrv]
  <\??\C:\Program Files\rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI]
  <\SystemRoot\System32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS]
  <\??\C:\Program Files\rising\Rav\RSPPSYS.sys><Rising>
[Realtek RTL8139/810x Family Fast Ethernet NIC NT Driver / rtl8139]
  <System32\DRIVERS\R8139n51.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv]
  <System32\DRIVERS\secdrv.sys><N/A>
[SVKP / SVKP]
  <\??\C:\WINDOWS\System32\SVKP.sys><N/A>
gototop
 

浏览器加载项
[浩方对战平台]
  {0A155D3C-68E2-4215-A47A-E800A446447A} <E:\浩方\GameClient.exe, 上海浩方在线信息技术有限公司>
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[超级兔子上网精灵]
  {43869BB3-22FD-4F15-9B46-238106BA2F4E} <D:\超级兔子\MAGICSET\haokanbar.dll, Xiang Feng Technology>
[PowerPlr Control]
  {2354A44B-3CEB-4829-9940-545B03103538} <C:\WINDOWS\DOWNLO~1\PowerPlr.ocx, Powerise Digital>
[Timer Object]
  {59CCB4A0-727D-11CF-AC36-00AA00A47DD2} <C:\WINDOWS\Downloaded Program Files\ietimer.ocx, Microsoft Corporation>
[V3ProX Control]
  {5DD731E6-D4F0-11D3-BE3F-00105A6FDA50} <C:\WINDOWS\DOWNLO~1\v3prox.ocx, Ahnlab, Inc.>
[BoBo_V2 Control]
  {A8C3B40D-5384-44AD-ACC4-504B4D8A85F5} <C:\WINDOWS\DOWNLO~1\BOBO_A~1.OCX, 17BoBo.com>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[&使用迅雷下载全部链接]
  <D:\迅雷\新建文件夹\Program\getallurl.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
  <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ表情]
  <D:\QQ\AddEmotion.htm, N/A>

==================================
正在运行的进程
[PID: 444][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 516][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 540][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\Ati2evxx.dll]  [N/A, N/A]
[PID: 584][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 596][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 736][C:\WINDOWS\System32\Ati2evxx.exe]  [N/A, N/A]
[PID: 784][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 824][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 904][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 928][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1224][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [C:\WINDOWS\system32\hpzsnt09.dll]  [HP, 2.236.4.0]
[PID: 1480][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 1524][C:\WINDOWS\System32\drivers\CDAC11BA.EXE]  [Macrovision, 4.20.020]
[PID: 1572][C:\Program Files\rising\Rav\RavStub.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 4]
    [C:\Program Files\rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [C:\Program Files\rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[PID: 1868][C:\WINDOWS\system32\Ati2evxx.exe]  [N/A, N/A]
[PID: 1940][C:\Program Files\rising\Rfw\RfwMain.exe]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 72]
    [C:\Program Files\rising\Rfw\RsGuiLib.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33]
    [C:\Program Files\rising\Rfw\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [C:\Program Files\rising\Rfw\RfwCtrl.dll]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]
    [C:\Program Files\rising\Rfw\RsXML.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
    [C:\Program Files\rising\Rfw\PngDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[PID: 408][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 464][C:\WINDOWS\System32\wdfmgr.exe]  [Microsoft Corporation, 5.2.3790.1230 built by: DNSRV(bld4act)]
[PID: 1952][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3208]
[PID: 2096][C:\WINDOWS\VM_STI.EXE]  [VM., 4.2.610.4]
    [C:\WINDOWS\System32\msdmo.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\VM31bPrp.Ax]  [VM, 4.2.711.31]
[PID: 2160][C:\WINDOWS\System32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 2196][D:\超级兔子\MagicSet\SRIECLI.EXE]  [Super Rabbit Soft, 7.98]
    [D:\超级兔子\MagicSet\shlobj71.ocx]  [Sky Software (http://www.ssware.com), 7, 1, 0, 0]
[PID: 2804][C:\WINDOWS\explorer.exe]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
gototop
 

[C:\WINDOWS\System32\AcSignIcon.dll]  [Autodesk, 16.0.0.86]
    [C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll]  [Autodesk, 16.0.0.86]
    [C:\WINDOWS\System32\mh103.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\moyu103.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\dh2103.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\AVPSrv.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\lzmytp.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\cmdbcs.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\ioqjpx.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\vbkwan.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\akauvw.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\vuzyhv.dll]  [N/A, N/A]
    [C:\DOCUME~1\caiyong\LOCALS~1\Temp\Gjzo1.dll]  [N/A, N/A]
[PID: 3420][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\AcSignIcon.dll]  [Autodesk, 16.0.0.86]
    [D:\超级兔子\MAGICSET\haokanbar.dll]  [Xiang Feng Technology, 2, 2, 0, 1612]
    [C:\WINDOWS\System32\Macromed\Flash\Flash8.ocx]  [Macromedia, Inc., 8,0,22,0]
    [C:\WINDOWS\System32\AVPSrv.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\cmdbcs.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\lzmytp.dll]  [N/A, N/A]
    [C:\DOCUME~1\caiyong\LOCALS~1\Temp\Gjzo1.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\vuzyhv.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\akauvw.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\vbkwan.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\ioqjpx.dll]  [N/A, N/A]
    [C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll]  [Autodesk, 16.0.0.86]
[PID: 4020][D:\下载文件‘\sreng2\SREng\SREng.exe]  [Smallfrogs Studio, 2.2.6.605]
    [C:\WINDOWS\System32\netsrvcs.dll]  [N/A, N/A]
    [C:\DOCUME~1\caiyong\LOCALS~1\Temp\Gjzo1.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\vuzyhv.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\akauvw.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\vbkwan.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\ioqjpx.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\cmdbcs.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\lzmytp.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\AVPSrv.dll]  [N/A, N/A]
[PID: 3804][C:\WINDOWS\system32\notepad.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\netsrvcs.dll]  [N/A, N/A]
    [C:\DOCUME~1\caiyong\LOCALS~1\Temp\Gjzo1.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\vuzyhv.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\akauvw.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\vbkwan.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\ioqjpx.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\cmdbcs.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\lzmytp.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\AVPSrv.dll]  [N/A, N/A]
gototop
 

文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  Error. [C:\WINDOWS\hh.exe" %1]
.HLP  Error. [C:\WINDOWS\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost
gototop
 

请高手帮帮忙啊,小弟急啊~~~~
gototop
 

请高手帮帮忙啊,小弟急啊~~~~
gototop
 

高手帮帮忙啊,小弟急啊
gototop
 

病毒好象删掉了,但是开机后瑞星监控绿色小伞显示不出来了
郁闷啊,请高手指点~~~
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT