收藏本站 |切换到宽版 | 更换论坛皮肤
 找回密码  忘记邮箱  QQ快速登录  快速登录  快速注册

卡饭»论坛 › 软件区 › 解疑答难区 › 大会诊啰！！
返回列表 发新帖
查看: 1489|回复: 8
收起左侧

[已解决] 大会诊啰！！

 关闭 [复制链接]
剑指七星
发表于 2007-4-17 14:12:17 | 显示全部楼层 |阅读模式
下面的报告是在学校的电脑扫的，大家来会诊一下，看一下这台机器的症状，我们上课的时候，这台机器老是出故障，烦死人了！老机器了，没有办法，整天插U盘，里面病毒奇多无比，毒库一个！

  1. 2007-04-10,09:40:56
  2. System Repair Engineer 2.4.12.806
  3. Smallfrogs (http://www.KZTechs.com)
  4. Windows XP Professional Service Pack 1 (Build 2600) - 管理权限用户 - 完整功能
  5. 以下内容被选中：
  6.     所有的启动项目（包括注册表、启动文件夹、服务等）
  7.     浏览器加载项
  8.     正在运行的进程（包括进程模块信息）
  9.     文件关联
  10.     Winsock 提供者
  11.     Autorun.inf
  12.     HOSTS 文件

  14. 启动项目
  15. 注册表
  16. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  17.     <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe>  [(Verified)Microsoft Windows XP Publisher]
  18.     <MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background>  [(Verified)Microsoft Windows XP Publisher]
  19.     <DrvMon.exe><C:\WINDOWS\System32\DrvMon.exe>  [Alcor Micro, Corp.]
  20.     <Ntcheck><C:\WINDOWS\mapserver.exe>  [UNDEATH]
  21. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
  22.     <Cmpnt><c:\windows\system\mainsv.exe>  [UNDEATH]
  23. [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  24.     <load><>  [N/A]
  25. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  26.     <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows XP Publisher]
  27.     <PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows XP Publisher]
  28.     <PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows XP Publisher]
  29.     <IgfxTray><C:\WINDOWS\System32\igfxtray.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
  30.     <HotKeysCmds><C:\WINDOWS\System32\hkcmd.exe>  [(Verified)Microsoft Windows XP Publisher]
  31.     <Cmaudio><RunDll32 cmicnfg.cpl,CMICtrlWnd>  [N/A]
  32.     <SysExplr><C:\Herosoft\Hero2000\SYSEXPLR.EXE>  []
  33.     <RavTimer><C:\Program Files\Rising\Rav\RavTimer.exe>  [Beijing Rising Technology Co., Ltd.]
  34.     <RavMon><C:\Program Files\Rising\Rav\RavMon.exe -system>  [Beijing Rising Technology Co., Ltd.]
  35.     <Cmpnt><C:\WINDOWS\system\cmpku.exe>  [UNDEATH]
  36. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
  37.     <Shell><c:\windows\system\mainsv.exe>  [UNDEATH]
  38. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  39.     <shell><Explorer.exe>  [(Verified)Microsoft Windows XP Publisher]
  40.     <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows XP Publisher]
  41. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  42.     <AppInit_DLLs><>  [N/A]
  43. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  44.     <UIHost><logonui.exe>  [(Verified)Microsoft Windows XP Publisher]
  45. ==================================
  46. 启动文件夹
  47. [Microsoft Office]
  48.   <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Microsoft Office.lnk --> D:\MICROS~1\Office10\OSA.EXE [Microsoft Corporation]><N>
  49. ==================================
  50. 服务
  51. [Lexar JD31 / LxrJD31s][Running/Auto Start]
  52.   <LxrJD31s.exe><N/A>
  53. [Macromedia Licensing Service / Macromedia Licensing Service][Stopped/Manual Start]
  54.   <"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><>
  55. [Rising Process Communication Center / RsCCenter][Running/Auto Start]
  56.   <C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE><rising>
  57. [RsRavMon Service / RsRavMon][Running/Auto Start]
  58.   <C:\PROGRAM FILES\RISING\RAV\Ravmond.exe><Beijing Rising Technology Co., Ltd.>
  59. [Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start]
  60.   <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\System32\mspmsnsv.dll><Microsoft Corporation>
  61. ==================================
  62. 驱动程序
  63. [BaseTDI / BaseTDI][Running/Auto Start]
  64.   <\??\C:\WINDOWS\System32\drivers\basetdi.sys><Rising>
  65. [C-Media WDM Audio Interface / cmuda][Running/Manual Start]
  66.   <system32\drivers\cmuda.sys><C-Media Inc>
  67. [Rising Exploit Scaner 1.0 / ExpScaner][Running/Manual Start]
  68.   <\??\C:\PROGRAM FILES\RISING\RAV\ExpScan.sys><>
  69. [HOOKAPI / HOOKAPI][Running/Auto Start]
  70.   <\??\C:\PROGRAM FILES\RISING\RAV\HOOKAPI.SYS><瑞星软件有限公司>
  71. [HookCont / HookCont][Running/Auto Start]
  72.   <\??\C:\PROGRAM FILES\RISING\RAV\HOOKCONT.sys><Rising tech Co. ltd>
  73. [HookReg / HookReg][Running/Auto Start]
  74.   <\??\C:\PROGRAM FILES\RISING\RAV\HOOKREG.sys><>
  75. [HookSys / HookSys][Running/Auto Start]
  76.   <\??\C:\PROGRAM FILES\RISING\RAV\hooksys.sys><瑞星>
  77. [ialm / ialm][Running/Manual Start]
  78.   <System32\DRIVERS\ialmnt5.sys><Intel Corporation>
  79. [LxrJD31d / LxrJD31d][Running/Auto Start]
  80.   <\??\C:\WINDOWS\System32\Drivers\LxrJD31d.sys><N/A>
  81. [MEMSCAN / MEMSCAN][Running/Auto Start]
  82.   <\??\C:\PROGRAM FILES\RISING\RAV\MEMSCAN.SYS><瑞星软件有限公司>
  83. [Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  84.   <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
  85. [Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
  86.   <System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
  87. [Secdrv / Secdrv][Stopped/Manual Start]
  88.   <System32\DRIVERS\secdrv.sys><N/A>
  89. [Intel(R) Graphics Platform (SoftBIOS) Driver / {6080A529-897E-4629-A488-ABA0C29B635E}][Running/System Start]
  90.   <system32\drivers\ialmsbw.sys><Intel Corporation>
  91. [Intel(R) Graphics Chipset (KCH) Driver / {D31A0762-0CEB-444e-ACFF-B049A1F6FE91}][Running/Manual Start]
  92.   <system32\drivers\ialmkchw.sys><Intel Corporation>
  93. ==================================
  94. 浏览器加载项
  95. [@shdoclc.dll,-866]
  96.   {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
  97. [电台(&R)]
  98.   {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
  99. [Shockwave Flash Object]
  100.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\macromed\flash\Flash.ocx, Macromedia, Inc.>
  101. [导出到 Microsoft Excel(&x)]
  102.   <res://D:\MICROS~1\Office10\EXCEL.EXE/3000, N/A>
  103. ==================================
  104. 正在运行的进程
  105. [PID: 536][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
  106. [PID: 616][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  107. [PID: 640][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
  108.     [C:\WINDOWS\System32\wdmaud.drv]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
  109.     [C:\WINDOWS\System32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  110. [PID: 1216][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
  111.     [C:\WINDOWS\System32\wdmaud.drv]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
  112.     [C:\WINDOWS\System32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  113.     [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
  114.     [C:\WINDOWS\System32\RavExt.DLL]  [Beijing Rising Technology Co., Ltd., 17, 0, 0, 3]
  115.     [D:\Microsoft Office\Office10\msohev.dll]  [Microsoft Corporation, 10.0.2609]
  116.     [C:\WINDOWS\System32\igfxpph.dll]  [Intel Corporation, 3,0,0,1918]
  117.     [C:\WINDOWS\System32\hccutils.DLL]  [Intel Corporation, 3,0,0,1918]
  118. [PID: 1860][C:\WINDOWS\System32\hkcmd.exe]  [Intel Corporation, 3,0,0,1918]
  119.     [C:\WINDOWS\System32\hccutils.DLL]  [Intel Corporation, 3,0,0,1918]
  120.     [C:\WINDOWS\System32\igfxdev.dll]  [Intel Corporation, 3,0,0,1918]
  121.     [C:\WINDOWS\System32\igfxsrvc.dll]  [Intel Corporation, 3,0,0,1918]
  122.     [C:\WINDOWS\System32\igfxhk.dll]  [Intel Corporation, 3,0,0,1918]
  123.     [C:\WINDOWS\System32\igfxres.dll]  [Intel Corporation, 3,0,0,1918]
  124. [PID: 1900][C:\WINDOWS\System32\RunDll32.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  125.     [C:\WINDOWS\system\cmicnfg.cpl]  [C-Media Corporation, 1, 0, 0, 35]
  126. [PID: 1936][C:\Herosoft\Hero2000\SYSEXPLR.EXE]  [N/A, ]
  127.     [C:\Herosoft\Hero2000\AVCDROM.dll]  [N/A, ]
  128. [PID: 1972][C:\Program Files\Rising\Rav\RavTimer.exe]  [Beijing Rising Technology Co., Ltd., 17, 0, 0, 32]
  129.     [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 17, 0, 0, 17]
  130.     [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  [Rising Corp., 17, 0, 0, 5]
  131.     [C:\Program Files\Rising\Rav\CfgDll.dll]  [rising, 17, 0, 0, 39]
  132.     [C:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 17, 0, 0, 3]
  133. [PID: 2016][C:\Program Files\Rising\Rav\RavMon.exe]  [Beijing Rising Technology Co., Ltd., 17, 0, 1, 0]
  134.     [C:\Program Files\Rising\Rav\RsGuiLib.dll]  [Beijing Rising Technology Co., Ltd., 17, 0, 0, 33]
  135.     [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  [Rising Corp., 17, 0, 0, 5]
  136.     [C:\Program Files\Rising\Rav\CfgDll.dll]  [rising, 17, 0, 0, 39]
  137.     [C:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 17, 0, 0, 3]
  138.     [C:\Program Files\Rising\Rav\PngDll.dll]  [Rising, 17, 0, 0, 2]
  139.     [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 17, 0, 0, 17]
  140. [PID: 2024][C:\WINDOWS\system\cmpku.exe]  [UNDEATH, 3.02]
  141.     [C:\WINDOWS\System32\MSVBVM60.DLL]  [Microsoft Corporation, 6.00.9237]
  142. [PID: 124][C:\WINDOWS\System32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
  143. [PID: 172][C:\Program Files\Messenger\msmsgs.exe]  [Microsoft Corporation, 4.7.0041]
  144.     [C:\Program Files\Messenger\MSGSLANG.DLL]  [Microsoft Corporation, 4.7.0041]
  145.     [C:\PROGRA~1\MESSEN~1\rtcimsp.dll]  [Microsoft Corporation, 4.0.3599.0 (Lab02_N(ntvbl02).020107-1351)]
  146.     [C:\WINDOWS\System32\wdmaud.drv]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
  147.     [C:\WINDOWS\System32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  148.     [C:\WINDOWS\System32\msdmo.dll]  [, ]
  149. [PID: 184][C:\WINDOWS\System32\DrvMon.exe]  [Alcor Micro, Corp., 1, 0, 0, 9]
  150. [PID: 1296][I:\Tools\sreng2\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
  151.     [I:\Tools\sreng2\Plugins\NWMON.SRE]  [Smallfrogs Studio, 1, 0, 0, 8]
  152. ==================================
  153. 文件关联
  154. .TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
  155. .EXE  OK. ["%1" %*]
  156. .COM  OK. ["%1" %*]
  157. .PIF  OK. ["%1" %*]
  158. .REG  OK. [regedit.exe "%1"]
  159. .BAT  OK. ["%1" %*]
  160. .SCR  OK. ["%1" /S]
  161. .CHM  OK. ["C:\WINDOWS\hh.exe" %1]
  162. .HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
  163. .INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
  164. .INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
  165. .VBS  Error. [超级解霸2000]
  166. .JS   Error. ["C:\Program Files\Macromedia\Dreamweaver MX 2004\Dreamweaver.exe" "%1"]
  167. .LNK  OK. [{00021401-0000-0000-C000-000000000046}]
  168. ==================================
  169. Winsock 提供者
  170. N/A
  171. ==================================
  172. Autorun.inf
  173. [D:\]
  174. [Autorun]
  175. open=Iexplores.exe
  176. [E:\]
  177. [Autorun]
  178. open=Iexplores.exe
  179. [F:\]
  180. [Autorun]
  181. open=Iexplores.exe
  182. [G:\]
  183. [Autorun]
  184. open=Iexplores.exe
  185. ==================================
  186. HOSTS 文件
  187. 127.0.0.1       localhost
  188. ==================================
  189. API HOOK
  190. N/A
  191. ==================================
  192. 隐藏进程
  193. N/A
  194. ==================================
复制代码
回复

举报

无敌敏敏
发表于 2007-4-17 14:31:57 | 显示全部楼层
<Cmpnt><c:\windows\system\mainsv.exe>  [UNDEATH]
<Ntcheck><C:\WINDOWS\mapserver.exe>  [UNDEATH]
Autorun.inf
[D:\]
[Autorun]
open=Iexplores.exe
[E:\]
[Autorun]
open=Iexplores.exe
[F:\]
[Autorun]
open=Iexplores.exe
[G:\]
[Autorun]
open=Iexplores.exe

2个文件关联错误
.VBS  Error. [超级解霸2000]
.JS   Error. ["C:\Program Files\Macromedia\Dreamweaver MX 2004\Dreamweaver.exe" "%1"]
回复

举报

剑指七星
 楼主| 发表于 2007-4-17 15:57:49 | 显示全部楼层
对了  这就
老是播放视频的时候  出乱子
回复

举报

mds
发表于 2007-4-17 16:48:51 | 显示全部楼层
经常插U盘备个这个不错!杀U盘病毒不错!七星改用瑞星啦?

本帖子中包含更多资源

您需要 登录 才可以下载或查看，没有帐号？快速注册

x
回复

举报

可樂仔
发表于 2007-4-17 17:10:08 | 显示全部楼层
<DrvMon.exe><C:\WINDOWS\System32\DrvMon.exe>  [Alcor Micro, Corp.]
    <Ntcheck><C:\WINDOWS\mapserver.exe>  [UNDEATH]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    <Cmpnt><c:\windows\system\mainsv.exe>  [UNDEATH]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
    <Shell><c:\windows\system\mainsv.exe>  [UNDEATH]

<Cmpnt><C:\WINDOWS\system\cmpku.exe>

Autorun.inf
[D:\]
[Autorun]
open=Iexplores.exe
[E:\]
[Autorun]
open=Iexplores.exe
[F:\]
[Autorun]
open=Iexplores.exe
[G:\]
[Autorun]
open=Iexplores.exe

杀吧
回复

举报

剑指七星
 楼主| 发表于 2007-4-17 18:37:47 | 显示全部楼层
原帖由 mds 于 2007-4-17 16:48 发表
经常插U盘备个这个不错!杀U盘病毒不错!七星改用瑞星啦?


这个是学校的机器   超级老的设备了
回复

举报

剑指七星
 楼主| 发表于 2007-4-17 18:39:06 | 显示全部楼层

回复 #5 可樂仔 的帖子

学校机器的杀毒杀不了    病毒库还是2006年的
什么时候搞个绿色的卡巴去耍一耍   
回复

举报

mds
发表于 2007-4-17 19:19:23 | 显示全部楼层

回复 #7 200530040058 的帖子

绿色大蜘蛛也不错哦!
回复

举报

大胖大胖
发表于 2007-4-20 13:14:59 | 显示全部楼层
请问高手你看那上面那么多乱七八糟的程序怎么看出错误来的啊．．我想学习一下．．．

我现在看那个就头疼啊
回复

举报

返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2024-11-25 05:45 , Processed in 0.132826 second(s), 18 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究，不得将上述内容用于商业或者其他非法用途，否则产生的一切后果自负，本站信息来自网络，版权争议问题与本站无关，您必须在下载后的24小时之内从您的电脑中彻底删除上述信息，如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表