电脑上什么文件一启动就变成写字板模式!!
想扫日志也不能
该怎么做呢？
建议看置顶帖子，找汉化版hijackthis，运行后点扫描并且保存，弹出的一个文本文件里面的所有东东 ctrl c ctrl v。
查找regedit.exe改名成regedit.com
运行regedit.com 进入注册表编辑器
来到
[HKEY_CLASSES_ROOT\exefile\shell\open\command>
把默认值改成
＂%1＂ %*
这方法行不行？
或下载置顶的扫描工具 里面的 sreng扫描一个报告看看，没有报告不好说。
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe
这里Application的内容决定了用什么程序打开.exe文件
删除Application就恢复默认了
或者把Application的内容设置成＂%1＂ %* 也可以
我用了这办法,弄好了!!
我等下发日志,看看还没没有别的错误!
谢谢你了,红桃
HijackThis_815汉化版扫描日志 V1.99.1
保存于 17:24:00, 日期 2006-7-4
操作系统： Windows XP SP2 (WinNT 5.01.2600)
浏览器： Internet Explorer v6.00 SP2 (6.00.2900.2180)
当前运行的进程：
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rising\Rav\Ravmond.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Rising\Rav\RavStub.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\rising\rfw\RfwMain.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\downs.exe
C:\WINDOWS\system32\downfile.exe
C:\WINDOWS\downfile.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\AA\桌面\HijackThis1991zww.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\Timer1.exe
O2 - BHO: IE Browser Helper - {3CE496D1-1746-41CD-9489-3C0B93DF10E2} - (no file)
O2 - BHO: CdnForIE Class - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll (file missing)
O2 - BHO: MSHlper Class - {721E6521-4CAD-4A8D-A7F1-4E230B31EF19} - C:\WINDOWS\system32\mshlp.dll (file missing)
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - d:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll
O3 - IE工具栏增项: (no name) - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - (no file)
O4 - 启动项HKLM\\Run: [RfwMain> ＂C:\Program Files\Rising\Rfw\rfwmain.exe＂ -Startup
O4 - 启动项HKLM\\Run: [RavTask> ＂C:\Program Files\Rising\Rav\RavTask.exe＂ -system
O4 - 启动项HKLM\\Run: [ATIPTA> ＂C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe＂
O4 - 启动项HKLM\\Run: [popo2004> C:\Program Files\Netease\popo2004\start.exe
O4 - 启动项HKLM\\Run: [IMSCMIG40W> C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40W\IMSCMIG.EXE /SetPreload /Log
O4 - 启动项HKLM\\Run: [downs> C:\WINDOWS\system32\downs.exe
O4 - 启动项HKLM\\Run: [downfile> C:\WINDOWS\system32\downfile.exe
O4 - 启动项HKLM\\Run: [downfiles> C:\WINDOWS\downfile.exe
O4 - 启动项HKLM\\Run: [Mysee Alert> ＂C:\Program Files\GAOV\Mysee Alert\Mysee Alert.exe＂ -notray
O4 - 启动项HKLM\\RunOnce: [RavStub> ＂C:\Program Files\Rising\Rav\ravstub.exe＂ /RUNONCE
O4 - HKCU\..\Run: [ctfmon.exe> C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [sys1> Rundll32.exe C:\WINDOWS\system32\Upsrv.dll,Run
O8 - IE右键菜单中的新增项目: ＆使用迅雷下载 - d:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - IE右键菜单中的新增项目: ＆使用迅雷下载全部链接 - d:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - D:\QQ\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 导出到 Microsoft Office Excel(＆X) - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - D:\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - D:\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - D:\QQ\SendMMS.htm
O9 - 浏览器额外的按钮: 中文上网 - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll (file missing)
O9 - 浏览器额外的“工具”菜单项: 中文上网 - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll (file missing)
O17 - HKLM\System\CCS\Services\Tcpip\..\{14D4B4BF-66EF-4124-9E63-56678F400DCD}: NameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{14D4B4BF-66EF-4124-9E63-56678F400DCD}: NameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{14D4B4BF-66EF-4124-9E63-56678F400DCD}: NameServer = 192.168.1.1
O17 - HKLM\System\CS3\Services\Tcpip\..\{14D4B4BF-66EF-4124-9E63-56678F400DCD}: NameServer = 192.168.1.1
O18 - 列举现有的协议: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - 列举现有的协议: cdl - {3DD53D40-7B8B-11D0-B013-00AA0059CE02} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll
O18 - 列举现有的协议: file - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: ftp - {79EAC9E3-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: gopher - {79EAC9E4-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: http - {79EAC9E2-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: https - {79EAC9E5-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: ipp - (no CLSID) - (no file)
O18 - 列举现有的协议: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll
O18 - 列举现有的协议: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - 列举现有的协议: local - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: mailto - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - 列举现有的协议: mhtml - {05300401-BCBC-11D0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll
O18 - 列举现有的协议: mk - {79EAC9E6-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll
O18 - 列举现有的协议: msdaipp - (no CLSID) - (no file)
O18 - 列举现有的协议: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - 列举现有的协议: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll
O18 - 列举现有的协议: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll
O18 - 列举现有的协议: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - 列举现有的协议: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll
O23 - NT 服务: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - NT 服务: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - NT 服务: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe
O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
2006-07-04,17:24:47
System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (
Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run>
＜ctfmon.exe＞＜C:\WINDOWS\system32\ctfmon.exe＞ [Microsoft Corporation>
＜sys1＞＜Rundll32.exe C:\WINDOWS\system32\Upsrv.dll,Run＞ [>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows>
＜load＞＜＞ [>
＜run＞＜＞ [>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run>
＜RfwMain＞＜＂C:\Program Files\Rising\Rfw\rfwmain.exe＂ -Startup＞ [Beijing Rising Technology Co., Ltd.>
＜RavTask＞＜＂C:\Program Files\Rising\Rav\RavTask.exe＂ -system＞ [Beijing Rising Technology Co., Ltd.>
＜ATIPTA＞＜＂C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe＂＞ [ATI Technologies, Inc.>
＜popo2004＞＜C:\Program Files\Netease\popo2004\start.exe＞ [网易(163.com)>
＜IMSCMIG40W＞＜C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40W\IMSCMIG.EXE /SetPreload /Log＞ [Microsoft Corporation>
＜downs＞＜C:\WINDOWS\system32\downs.exe＞ [bcnet>
＜downfile＞＜C:\WINDOWS\system32\downfile.exe＞ [bcnet>
＜downfiles＞＜C:\WINDOWS\downfile.exe＞ [bcnet>
＜Mysee Alert＞＜＂C:\Program Files\GAOV\Mysee Alert\Mysee Alert.exe＂ -notray＞ [>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce>
＜RavStub＞＜＂C:\Program Files\Rising\Rav\ravstub.exe＂ /RUNONCE＞ [Beijing Rising Technology Co., Ltd.>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon>
＜shell＞＜Explorer.exe＞ [Microsoft Corporation>
＜Userinit＞＜C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\Timer1.exe＞ [>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows>
＜AppInit_DLLs＞＜＞ [>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon>
＜UIHost＞＜logonui.exe＞ [Microsoft Corporation>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent>
＜WinlogonNotify: AtiExtEvent＞＜Ati2evxx.dll＞ [ATI Technologies Inc.>
==================================
启动文件夹
服务
[Ati HotKey Poller / Ati HotKey Poller>
＜C:\WINDOWS\system32\Ati2evxx.exe＞＜ATI Technologies Inc.＞
[ATI Smart / ATI Smart>
＜C:\WINDOWS\system32\ati2sgag.exe＞＜＞
[Rising Proxy Service / RfwProxySrv>
＜c:\program files\rising\rfw\rfwproxy.exe＞＜Beijing Rising Technology Co., Ltd.＞
[Rising Personal Firewall Service / RfwService>
＜c:\program files\rising\rfw\rfwsrv.exe＞＜Beijing Rising Technology Co., Ltd.＞
[Rising Process Communication Center / RsCCenter>
＜＂C:\Program Files\Rising\Rav\CCenter.exe＂＞＜Beijing Rising Technology Co., Ltd.＞
[RsRavMon Service / RsRavMon>
＜＂C:\Program Files\Rising\Rav\Ravmond.exe＂＞＜Beijing Rising Technology Co., Ltd.＞
==================================
浏览器加载项
[IE Browser Helper>
{3CE496D1-1746-41CD-9489-3C0B93DF10E2} ＜, N/A＞
[CdnForIE Class>
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} ＜C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, N/A＞
[MSHlper Class>
{721E6521-4CAD-4A8D-A7F1-4E230B31EF19} ＜C:\WINDOWS\system32\mshlp.dll, N/A＞
[Thunder Browser Helper>
{889D2FEB-5411-4565-8998-1DD2C5261283} ＜d:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD＞
[CdnForIE Class>
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} ＜C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, N/A＞
[Windows Media Player>
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} ＜C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation＞
[HTML Document>
{25336920-03F9-11CF-8FD0-00AA00686F13} ＜%SystemRoot%\system32\mshtml.dll, N/A＞
[IE Browser Helper>
{3CE496D1-1746-41CD-9489-3C0B93DF10E2} ＜, N/A＞
[CdnForIE Class>
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} ＜C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, N/A＞
[Windows Media Player>
{6BF52A52-394A-11D3-B153-00C04F79FAA6} ＜C:\WINDOWS\system32\wmp.dll, Microsoft Corporation＞
[MSHlper Class>
{721E6521-4CAD-4A8D-A7F1-4E230B31EF19} ＜C:\WINDOWS\system32\mshlp.dll, N/A＞
[CpapView Class>
{77962960-536E-47EC-9DDB-52651519705F} ＜C:\WINDOWS\system32\cacb.dll, ＞
[GvcDjzul Class>
{7C4A8879-2ECE-BF68-E04B-0E0C6AB0DFD8} ＜C:\WINDOWS\DOWNLO~1\xgfkb.dll, pxtpwsoft＞
[Microsoft Web 浏览器>
{8856F961-340A-11D0-A96B-00C04FD705A2} ＜C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation＞
[Thunder Browser Helper>
{889D2FEB-5411-4565-8998-1DD2C5261283} ＜d:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD＞
[RealPlayer G2 Control>
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} ＜C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.＞
[Shockwave Flash Object>
{D27CDB6E-AE6D-11CF-96B8-444553540000} ＜C:\WINDOWS\system32\Macromed\Flash\flash.ocx, Macromedia, Inc.＞
[＆使用迅雷下载>
＜d:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A＞
[＆使用迅雷下载全部链接>
＜d:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A＞
[上传到QQ网络硬盘>
＜D:\QQ\AddToNetDisk.htm, N/A＞
[导出到 Microsoft Office Excel(＆X)>
＜res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000, N/A＞
[添加到QQ自定义面板>
＜D:\QQ\AddPanel.htm, N/A＞
[添加到QQ表情>
＜D:\QQ\AddEmotion.htm, N/A＞
[用QQ彩信发送该图片>
＜D:\QQ\SendMMS.htm, N/A＞
==================================
正在运行的进程
[PID: 448>[\SystemRoot\System32\smss.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 500>[\？？\C:\WINDOWS\system32\csrss.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 528>[\？？\C:\WINDOWS\system32\winlogon.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[C:\WINDOWS\system32\Ati2evxx.dll> ＜ATI Technologies Inc.＞＜6.14.10.4118＞
[PID: 572>[C:\WINDOWS\system32\services.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 584>[C:\WINDOWS\system32\lsass.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 752>[C:\WINDOWS\system32\Ati2evxx.exe> ＜ATI Technologies Inc.＞＜6.14.10.4118＞
[C:\WINDOWS\system32\Ati2edxx.dll> ＜ATI Technologies, Inc.＞＜6, 14, 10, 2497＞
[PID: 772>[C:\WINDOWS\system32\svchost.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 828>[C:\WINDOWS\system32\svchost.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 892>[C:\Program Files\Rising\Rav\CCenter.exe> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 3＞
[PID: 924>[C:\WINDOWS\System32\svchost.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 992>[C:\WINDOWS\system32\svchost.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 1088>[C:\WINDOWS\system32\svchost.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 1104>[C:\Program Files\Rising\Rav\Ravmond.exe> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 1, 26＞
[C:\Program Files\Rising\Rav\BWList.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 19＞
[C:\Program Files\Rising\Rav\RsCommX.dll> ＜rising＞＜18, 0, 0, 1＞
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 2＞
[C:\Program Files\Rising\Rav\CfgDll.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 10＞
[C:\Program Files\Rising\Rav\RSCOMMON.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 4＞
[C:\Program Files\Rising\Rav\RsLog.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 20＞
[C:\Program Files\Rising\Rav\HOOKSYS.dll> ＜Rising＞＜18, 1, 0, 9＞
[C:\Program Files\Rising\Rav\Scanner.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 30＞
[C:\Program Files\Rising\Rav\libload.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 10＞
[C:\Program Files\Rising\Rav\VirusLib.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 10＞
[C:\Program Files\Rising\Rav\regmon.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 6＞
[C:\Program Files\Rising\Rav\HookWeb.dll> ＜rising＞＜18, 0, 0, 1＞
[C:\Program Files\Rising\Rav\MemMon.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 9＞
[C:\Program Files\Rising\Rav\expscan.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 4＞
[C:\Program Files\Rising\Rav\mPorts.dll> ＜Beijing Rising Technology Co., Ltd.＞＜4, 0, 0, 3＞
[C:\Program Files\Rising\Rav\MailMon.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 5＞
[C:\Program Files\Rising\Rav\SpamEng.dll> ＜N/A＞＜18, 0, 0, 6＞
[C:\Program Files\Rising\Rav\engine.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 30＞
[C:\Program Files\Rising\Rav\PostTrt.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 9＞
[C:\Program Files\Rising\Rav\UnExe.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 11＞
[C:\Program Files\Rising\Rav\ScanExec.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 11＞
[C:\Program Files\Rising\Rav\ScanEx.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 11＞
[C:\Program Files\Rising\Rav\NvFile.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 7＞
[C:\Program Files\Rising\Rav\ScanMac.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 8＞
[C:\Program Files\Rising\Rav\ScanSct.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 17＞
[C:\Program Files\Rising\Rav\Unpacker.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 3＞
[PID: 1248>[c:\program files\rising\rfw\rfwsrv.exe> ＜Beijing Rising Technology Co., Ltd.＞＜4, 0, 0, 32＞
[c:\program files\rising\rfw\RfwRule.dll> ＜Beijing Rising Technology Co., Ltd.＞＜4, 0, 0, 13＞
[c:\program files\rising\rfw\rfwlog.dll> ＜Beijing Rising Technology Co., Ltd.＞＜4, 0, 0, 6＞
[c:\program files\rising\rfw\Rfwdrv.dll> ＜Beijing Rising Technology Co., Ltd.＞＜4, 0, 0, 21＞
[c:\program files\rising\rfw\MonDrv.dll> ＜rs＞＜1, 0, 0, 4＞
[c:\program files\rising\rfw\ProcLib.dll> ＜Beijing Rising Technology Co., Ltd.＞＜4, 0, 0, 9＞
[PID: 1300>[C:\WINDOWS\system32\Ati2evxx.exe> ＜ATI Technologies Inc.＞＜6.14.10.4118＞
[C:\WINDOWS\system32\Ati2edxx.dll> ＜ATI Technologies, Inc.＞＜6, 14, 10, 2497＞
[PID: 1392>[C:\WINDOWS\Explorer.EXE> ＜Microsoft Corporation＞＜6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)＞
[C:\Program Files\WinRAR\rarext.dll> ＜N/A＞＜N/A＞
[C:\WINDOWS\system32\RavExt.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 21＞
[C:\Program Files\Rising\Rav\RSCOMMON.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 4＞
[C:\WINDOWS\system32\contextmenu.dll> ＜＞＜1, 0, 0, 1＞
[PID: 1580>[C:\Program Files\Rising\Rav\RavStub.exe> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 16＞
[C:\Program Files\Rising\Rav\RsCommX.dll> ＜rising＞＜18, 0, 0, 1＞
[C:\Program Files\Rising\Rav\RSCOMMON.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 4＞
[PID: 1692>[C:\WINDOWS\system32\spoolsv.exe> ＜Microsoft Corporation＞＜5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)＞
[PID: 1700>[c:\program files\rising\rfw\RfwMain.exe> ＜Beijing Rising Technology Co., Ltd.＞＜4, 0, 0, 51＞
[c:\program files\rising\rfw\RsGuiLib.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 23＞
[c:\program files\rising\rfw\RSCOMMON.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 4＞
[c:\program files\rising\rfw\PngDll.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 5＞
[PID: 1884>[C:\Program Files\Rising\Rav\RavTask.exe> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 22＞
[C:\Program Files\Rising\Rav\RSCOMMON.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 4＞
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 2＞
[C:\Program Files\Rising\Rav\CfgDll.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 10＞
[C:\Program Files\Rising\Rav\RsCommX.dll> ＜rising＞＜18, 0, 0, 1＞
[PID: 1904>[C:\Program Files\Rising\Rav\Ravmon.exe> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 1, 28＞
[C:\Program Files\Rising\Rav\RsGuiLib.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 24＞
[C:\Program Files\Rising\Rav\BWList.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 19＞
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 2＞
[C:\Program Files\Rising\Rav\CfgDll.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 10＞
[C:\Program Files\Rising\Rav\RSCOMMON.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 4＞
[C:\Program Files\Rising\Rav\RsCommX.dll> ＜rising＞＜18, 0, 0, 1＞
[C:\Program Files\Rising\Rav\PngDll.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 5＞
[PID: 1912>[C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe> ＜ATI Technologies, Inc.＞＜6.14.10.5160＞
[C:\Program Files\ATI Technologies\ATI Control Panel\atipdsxx.dll> ＜ATI Technologies, Inc.＞＜6.14.10.5160＞
[C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATRPUIXX.CHS> ＜ATI Technologies, Inc.＞＜6.14.10.5160＞
[C:\Program Files\ATI Technologies\ATI Control Panel\atipdxxx.dll> ＜ATI Technologies, Inc.＞＜6.14.10.5160＞
[PID: 344>[C:\WINDOWS\system32\downs.exe> ＜bcnet＞＜1.00＞
[PID: 712>[C:\WINDOWS\system32\downfile.exe> ＜bcnet＞＜1.00＞
[PID: 784>[C:\WINDOWS\downfile.exe> ＜bcnet＞＜1.00＞
[PID: 988>[C:\WINDOWS\system32\ctfmon.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 1072>[C:\WINDOWS\system32\Rundll32.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[C:\WINDOWS\system32\Upsrv.dll> ＜N/A＞＜N/A＞
[C:\WINDOWS\system32\macdll.dll> ＜N/A＞＜N/A＞
[PID: 1676>[C:\WINDOWS\System32\alg.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 1732>[C:\WINDOWS\system32\wbem\wmiprvse.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 2280>[C:\WINDOWS\system32\wuauclt.exe> ＜Microsoft Corporation＞＜5.8.0.2469 built by: lab01_n(wmbla)＞
[PID: 2908>[C:\Program Files\Internet Explorer\iexplore.exe> ＜Microsoft Corporation＞＜6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)＞
[d:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll> ＜Thunder Networking Technologies,LTD＞＜5, 0, 0, 2＞
[PID: 3628>[C:\Documents and Settings\AA\桌面\SREng.exe> ＜Smallfrogs Studio＞＜2.0.21.505＞
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1>
.EXE OK. [＂%1＂ %*>
.COM OK. [＂%1＂ %*>
.PIF OK. [＂%1＂ %*>
.REG OK. [regedit.exe ＂%1＂>
.BAT OK. [＂%1＂ %*>
.SCR OK. [＂%1＂ /S>
.CHM OK. [＂C:\WINDOWS\hh.exe＂ %1>
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1>
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1>
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1>
.VBS OK. [%SystemRoot%\System32\WScript.exe ＂%1＂ %*>
.JS OK. [%SystemRoot%\System32\WScript.exe ＂%1＂ %*>
.LNK OK. [{00021401-0000-0000-C000-000000000046}>
==================================
Winsock 提供者
修复，这项目：
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\Timer1.exe
借助汉化版killbox强行删除这文件 C:\WINDOWS\system32\Timer1.exe
O4 - 启动项HKLM\\Run: [downs> C:\WINDOWS\system32\downs.exe
O4 - 启动项HKLM\\Run: [downfile> C:\WINDOWS\system32\downfile.exe
O4 - 启动项HKLM\\Run: [downfiles> C:\WINDOWS\downfile.exe
O4 - HKCU\..\Run: [sys1> Rundll32.exe C:\WINDOWS\system32\Upsrv.dll,Run
这4个启动项和文件可疑，建议摆渡一下，同时看看他们的属性/时间
我也怀疑
O4 - 启动项HKLM\\Run: [downs> C:\WINDOWS\system32\downs.exe
O4 - 启动项HKLM\\Run: [downfile> C:\WINDOWS\system32\downfile.exe
O4 - 启动项HKLM\\Run: [downfiles> C:\WINDOWS\downfile.exe
O4 - HKCU\..\Run: [sys1> Rundll32.exe C:\WINDOWS\system32\Upsrv.dll,Run
[PID: 344>[C:\WINDOWS\system32\downs.exe> ＜bcnet＞＜1.00＞ 怀疑
[PID: 712>[C:\WINDOWS\system32\downfile.exe> ＜bcnet＞＜1.00＞ 怀疑
[PID: 784>[C:\WINDOWS\downfile.exe> ＜bcnet＞＜1.00＞ 怀疑 也在启动项中
[PID: 988>[C:\WINDOWS\system32\ctfmon.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 1072>[C:\WINDOWS\system32\Rundll32.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[C:\WINDOWS\system32\Upsrv.dll> ＜N/A＞＜N/A＞ 可疑
[C:\WINDOWS\system32\macdll.dll> ＜N/A＞＜N/A＞ 可疑
sreng的报告，正在运行的进程中
[ 本帖最后由 红桃jacker 于 2006-7-4 18:24 编辑 >
[PID: 344>[C:\WINDOWS\system32\downs.exe> ＜bcnet＞＜1.00＞ 怀疑
[PID: 712>[C:\WINDOWS\system32\downfile.exe> ＜bcnet＞＜1.00＞ 怀疑
[PID: 784>[C:\WINDOWS\downfile.exe> ＜bcnet＞＜1.00＞ 怀疑 也在启动项中
[PID: 988>[C:\WINDOWS\system32\ctfmon.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 1072>[C:\WINDOWS\system32\Rundll32.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[C:\WINDOWS\system32\Upsrv.dll> ＜N/A＞＜N/A＞ 可疑
[C:\WINDOWS\system32\macdll.dll> ＜N/A＞＜N/A＞ 可疑
上面这些东西楼主删掉会影响系统吗？
回复网友：
廖仔ONLYONE
以上均非系统文件
那可以直接把它删!
免得是毒呢!! |
|
设为首页
加入收藏
联系我们
打印本文 
返回顶部 
加入收藏 
关闭窗口
