» 游客:  注册 | 登录 | 帮助  微点交流论坛 » 微点主动防御软件 » 安装微点后蓝屏死机，这有SREng的扫描日志,请帮忙!   作者: 标题: 安装微点后蓝屏死机，这有SREng的扫描日志,请帮忙! zmxc 新手上路 积分 6 发帖 6 注册 2007-3-2 #1  安装微点后蓝屏死机，这有SREng的扫描日志,请帮忙! 症状：无法安装微点，安装后出现重启登陆时蓝屏死机，卸载后启动系统时弹出提示“系统至少有一个服务启动失败请查看事件查看器”，之 后只看到瑞星杀毒软件图标看不到瑞星防火墙的图标，完全启动后防火墙的服务才正常！另外发现上网时防火墙的作用很小比以往！从事件查 看器知“mProcRs服务启动失败因连到系统上的设备没发挥作用”，其后有“（瑞星个人防火墙）Rising Personal Firewall  Service启动时 暂停”等等 下面是SRE的扫描日志： [CODE] 2007-04-13,09:59:50 System Repair Engineer 2.3.13.690 Smallfrogs (http://www.KZTechs.com) Windows Server 2003 Standard Edition Service Pack 2 (Build 3790) - 管理权限用户 - 完整功能 以下内容被选中：     所有的启动项目（包括注册表、启动文件夹、服务等）     浏览器加载项     正在运行的进程（包括进程模块信息）     文件关联     Winsock 提供者     Autorun.inf     HOSTS 文件 启动项目 注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]     <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Corporation] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]     <load><>  [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]     <runeip><D:\Program Files\Rising\Ras\runiep.exe>  [Beijing Rising Technology Co., Ltd.]     <RfwMain><"D:\Program Files\Rising\Rfw\rfwmain.exe" -Startup>  [Beijing Rising Technology Co., Ltd.]     <RavTask><"D:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]     <shell><Explorer.exe>  [(Verified)Microsoft Corporation]     <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]     <AppInit_DLLs><>  [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]     <UIHost><%SystemRoot%\system32\logonui.exe>  [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]     <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll>  [Beijing Rising Technology Co., Ltd.] ================================== 启动文件夹 N/A ================================== 服务 [Human Interface Device Access / HidServ][Stopped/Disabled]   <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A> [Rising Proxy  Service / RfwProxySrv][Stopped/Manual Start]   <d:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.> [Rising Personal Firewall Service / RfwService][Running/Auto Start]   <d:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.> [Rising Process Communication Center / RsCCenter][Running/Auto Start]   <"D:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.> [Rising RealTime Monitor / RsRavMon][Running/Auto Start]   <"D:\PROGRAM FILES\RISING\RAV\Ravmond.exe"><Beijing Rising Technology Co., Ltd.> [SoundMAX Agent Service / SoundMAX Agent Service (default)][Running/Auto Start]   <C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.> ================================== 驱动程序 [a347bus / a347bus][Running/Boot Start]   <\SystemRoot\system32\DRIVERS\a347bus.sys><> [a347scsi / a347scsi][Running/Boot Start]   <\SystemRoot\System32\Drivers\a347scsi.sys><> [aeaudio / aeaudio][Running/Manual Start]   <system32\drivers\aeaudio.sys><Andrea Electronics Corporation> [Rising TDI Base Driver / BaseTDI][Running/Auto Start]   <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.> [HelloNet PPPoE 虚拟网卡 / BRPPPOE][Running/Manual Start]   <system32\DRIVERS\brpppoe.sys><N/A> [ExpScaner / ExpScaner][Running/Auto Start]   <\??\D:\PROGRAM FILES\RISING\RAV\ExpScan.sys><> [HookCont / HookCont][Running/Auto Start]   <\??\D:\PROGRAM FILES\RISING\RAV\HOOKCONT.sys><Rising> [HookReg / HookReg][Running/Auto Start]   <\??\D:\PROGRAM FILES\RISING\RAV\HookReg.sys><> [HookSys / HookSys][Running/Auto Start]   <\??\D:\PROGRAM FILES\RISING\RAV\HookSys.sys><Rising> [HookUrl / HookUrl][Running/Auto Start]   <\??\D:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.> [IP in IP Tunnel Driver / IpInIp][Stopped/Manual Start]   <system32\DRIVERS\ipinip.sys><N/A> [MEMSCAN / MEMSCAN][Running/Auto Start]   <\??\D:\PROGRAM FILES\RISING\RAV\MEMSCAN.sys><瑞星软件有限公司> [npkcrypt / npkcrypt][Running/Auto Start]   <\??\D:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.> [npkycryp / npkycryp][Stopped/Manual Start]   <\??\D:\Program Files\Tencent\QQ\npkycryp.sys><N/A> [nv / nv][Running/Manual Start]   <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation> [Direct Parallel Link Driver / Ptilink][Running/Manual Start]   <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.> [RsAntiSpyware / RsAntiSpyware][Running/Boot Start]   <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising> [RsFwDrv / RsFwDrv][Running/Auto Start]   <\??\D:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.> [RsNTGDI / RsNTGDI][Running/Boot Start]   <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.> [RSPPSYS / RSPPSYS][Running/Auto Start]   <\??\D:\PROGRAM FILES\RISING\RAV\RSPPSYS.sys><Rising> [Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]   <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation> [Secdrv / Secdrv][Stopped/Manual Start]   <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.> [smwdm / smwdm][Running/Manual Start]   <system32\drivers\smwdm.sys><Analog Devices, Inc.> [mProcRs / mProcRs][Stopped/Auto Start]   <\??\d:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.> ================================== ※ ※ ※ 本文纯属【zmxc】个人意见，与【 微点交流论坛 】立场无关※ ※ ※ 2007-4-14 11:45 zmxc 新手上路 积分 6 发帖 6 注册 2007-3-2 #2  安装微点后蓝屏死机，这有SREng的扫描日志,请帮忙!续上 浏览器加载项 [IeCatch2 Class]   {A5366673-E8CA-11D3-9CD9-0090271D075B} <D:\Program Files\FlashGet\jccatch.dll, Amaze Soft> [FlashGet]   {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <D:\Program Files\FlashGet\flashget.exe, Amaze Soft> [访问瑞星网站]   {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E444} <http://www.rising.com.cn/?u=RSTB, N/A> [访问卡卡社区]   {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E445} <http://www.ikaka.com/?u=RSTB, N/A> [卡卡上网安全助手]   {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.> [Shockwave Flash Object]   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\Flash.ocx, Macromedia, Inc.> [AcroIEHlprObj Class]   {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <D:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx, > [XML DOM Document]   {2933BF90-7B36-11D2-B20E-00C04F983E60} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation> [IeCatch2 Class]   {A5366673-E8CA-11D3-9CD9-0090271D075B} <D:\Program Files\FlashGet\jccatch.dll, Amaze Soft> [Shockwave Flash Object]   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\Flash.ocx, Macromedia, Inc.> [卡卡上网安全助手]   {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.> [XML HTTP]   {F6D90F16-9C73-11D3-B32E-00C04F990BB4} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation> [使用网际快车下载]   <D:\Program Files\FlashGet\jc_link.htm, N/A> [使用网际快车下载全部链接]   <D:\Program Files\FlashGet\jc_all.htm, N/A> ================================== 正在运行的进程 [PID: 292][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)] [PID: 348][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)] [PID: 372][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]     [C:\WINDOWS\system32\SYNCOR11.DLL]  [SoundMAX, 1.2.3] [PID: 420][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)] [PID: 432][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)] [PID: 616][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)] [PID: 688][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)] [PID: 748][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]     [C:\WINDOWS\System32\SYNCOR11.DLL]  [SoundMAX, 1.2.3] [PID: 796][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]     [C:\WINDOWS\system32\SYNCOR11.DLL]  [SoundMAX, 1.2.3] [PID: 948][D:\PROGRAM FILES\RISING\RAV\RavStub.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 4]     [D:\PROGRAM FILES\RISING\RAV\RsCommX.dll]  [rising, 18, 0, 0, 1]     [D:\PROGRAM FILES\RISING\RAV\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5] [PID: 1188][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.3790.3959 (srv03_sp2_rtm.070216-1710)]     [C:\WINDOWS\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]     [D:\Program Files\Rising\Ras\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]     [C:\WINDOWS\system32\SYNCOR11.DLL]  [SoundMAX, 1.2.3] [PID: 1380][C:\WINDOWS\system32\msdtc.exe]  [Microsoft Corporation, 2001.12.4720.3959 (srv03_sp2_rtm.070216-1710)]     [C:\WINDOWS\system32\SYNCOR11.DLL]  [SoundMAX, 1.2.3] [PID: 1528][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)] [PID: 1580][C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe]  [Analog Devices, Inc., 3, 2, 6, 0] [PID: 1740][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)] [PID: 1940][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)] [PID: 1968][C:\WINDOWS\system32\wbem\wmiprvse.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)] [PID: 1972][d:\program files\rising\rfw\RfwMain.exe]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 70]     [d:\program files\rising\rfw\RsGuiLib.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33]     [C:\WINDOWS\system32\SYNCOR11.DLL]  [SoundMAX, 1.2.3]     [d:\program files\rising\rfw\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]     [d:\program files\rising\rfw\RfwCtrl.dll]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]     [d:\program files\rising\rfw\RsXML.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]     [d:\program files\rising\rfw\PngDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]     [D:\Program Files\Rising\Ras\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [PID: 216][D:\Program Files\Rising\Ras\runiep.exe]  [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6]     [D:\Program Files\Rising\Ras\iep_ctrl.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]     [D:\Program Files\Rising\Ras\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [PID: 316][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]     [C:\WINDOWS\System32\SYNCOR11.DLL]  [SoundMAX, 1.2.3] [PID: 1052][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]     [D:\Program Files\Rising\Ras\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [PID: 2284][C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\SREng.EXE]   [Smallfrogs Studio, 2.3.13.690]     [C:\WINDOWS\system32\SYNCOR11.DLL]  [SoundMAX, 1.2.3]     [D:\Program Files\Rising\Ras\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [PID: 2328][C:\WINDOWS\explorer.exe]  [Microsoft Corporation, 6.00.3790.3959 (srv03_sp2_rtm.070216-1710)]     [D:\Program Files\FlashGet\jccatch.dll]  [Amaze Soft, 1, 1, 4, 0]     [D:\Program Files\Rising\Ras\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]     [C:\WINDOWS\system32\SYNCOR11.DLL]  [SoundMAX, 1.2.3]     [C:\WINDOWS\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9] ================================== 文件关联 .TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE  OK. ["%1" %*] .COM  OK. ["%1" %*] .PIF  OK. ["%1" %*] .REG  OK. [regedit.exe "%1"] .BAT  OK. ["%1" %*] .SCR  OK. ["%1" /S] .CHM  OK. ["C:\WINDOWS\hh.exe" %1] .HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1] .INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .LNK  OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf N/A ================================== HOSTS 文件 127.0.0.1       localhost ================================== API HOOK N/A ================================== ※ ※ ※ 本文纯属【zmxc】个人意见，与【 微点交流论坛 】立场无关※ ※ ※ 2007-4-14 11:46 zmxc 新手上路 积分 6 发帖 6 注册 2007-3-2 #3  安装微点后蓝屏死机，这有SREng的扫描日志,请帮忙!续上 浏览器加载项 [IeCatch2 Class]   {A5366673-E8CA-11D3-9CD9-0090271D075B} <D:\Program Files\FlashGet\jccatch.dll, Amaze Soft> [FlashGet]   {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <D:\Program Files\FlashGet\flashget.exe, Amaze Soft> [访问瑞星网站]   {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E444} <http://www.rising.com.cn/?u=RSTB, N/A> [访问卡卡社区]   {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E445} <http://www.ikaka.com/?u=RSTB, N/A> [卡卡上网安全助手]   {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.> [Shockwave Flash Object]   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\Flash.ocx, Macromedia, Inc.> [AcroIEHlprObj Class]   {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <D:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx, > [XML DOM Document]   {2933BF90-7B36-11D2-B20E-00C04F983E60} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation> [IeCatch2 Class]   {A5366673-E8CA-11D3-9CD9-0090271D075B} <D:\Program Files\FlashGet\jccatch.dll, Amaze Soft> [Shockwave Flash Object]   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\Flash.ocx, Macromedia, Inc.> [卡卡上网安全助手]   {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.> [XML HTTP]   {F6D90F16-9C73-11D3-B32E-00C04F990BB4} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation> [使用网际快车下载]   <D:\Program Files\FlashGet\jc_link.htm, N/A> [使用网际快车下载全部链接]   <D:\Program Files\FlashGet\jc_all.htm, N/A> ================================== 正在运行的进程 [PID: 292][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)] [PID: 348][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)] [PID: 372][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]     [C:\WINDOWS\system32\SYNCOR11.DLL]  [SoundMAX, 1.2.3] [PID: 420][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)] [PID: 432][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)] [PID: 616][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)] [PID: 688][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)] [PID: 748][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]     [C:\WINDOWS\System32\SYNCOR11.DLL]  [SoundMAX, 1.2.3] [PID: 796][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]     [C:\WINDOWS\system32\SYNCOR11.DLL]  [SoundMAX, 1.2.3] [PID: 948][D:\PROGRAM FILES\RISING\RAV\RavStub.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 4]     [D:\PROGRAM FILES\RISING\RAV\RsCommX.dll]  [rising, 18, 0, 0, 1]     [D:\PROGRAM FILES\RISING\RAV\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5] [PID: 1188][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.3790.3959 (srv03_sp2_rtm.070216-1710)]     [C:\WINDOWS\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]     [D:\Program Files\Rising\Ras\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]     [C:\WINDOWS\system32\SYNCOR11.DLL]  [SoundMAX, 1.2.3] [PID: 1380][C:\WINDOWS\system32\msdtc.exe]  [Microsoft Corporation, 2001.12.4720.3959 (srv03_sp2_rtm.070216-1710)]     [C:\WINDOWS\system32\SYNCOR11.DLL]  [SoundMAX, 1.2.3] [PID: 1528][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)] [PID: 1580][C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe]  [Analog Devices, Inc., 3, 2, 6, 0] [PID: 1740][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)] [PID: 1940][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)] [PID: 1968][C:\WINDOWS\system32\wbem\wmiprvse.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)] [PID: 1972][d:\program files\rising\rfw\RfwMain.exe]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 70]     [d:\program files\rising\rfw\RsGuiLib.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33]     [C:\WINDOWS\system32\SYNCOR11.DLL]  [SoundMAX, 1.2.3]     [d:\program files\rising\rfw\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]     [d:\program files\rising\rfw\RfwCtrl.dll]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]     [d:\program files\rising\rfw\RsXML.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]     [d:\program files\rising\rfw\PngDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]     [D:\Program Files\Rising\Ras\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [PID: 216][D:\Program Files\Rising\Ras\runiep.exe]  [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6]     [D:\Program Files\Rising\Ras\iep_ctrl.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]     [D:\Program Files\Rising\Ras\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [PID: 316][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]     [C:\WINDOWS\System32\SYNCOR11.DLL]  [SoundMAX, 1.2.3] [PID: 1052][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]     [D:\Program Files\Rising\Ras\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [PID: 2284][C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\SREng.EXE]   [Smallfrogs Studio, 2.3.13.690]     [C:\WINDOWS\system32\SYNCOR11.DLL]  [SoundMAX, 1.2.3]     [D:\Program Files\Rising\Ras\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [PID: 2328][C:\WINDOWS\explorer.exe]  [Microsoft Corporation, 6.00.3790.3959 (srv03_sp2_rtm.070216-1710)]     [D:\Program Files\FlashGet\jccatch.dll]  [Amaze Soft, 1, 1, 4, 0]     [D:\Program Files\Rising\Ras\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]     [C:\WINDOWS\system32\SYNCOR11.DLL]  [SoundMAX, 1.2.3]     [C:\WINDOWS\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9] ================================== 文件关联 .TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE  OK. ["%1" %*] .COM  OK. ["%1" %*] .PIF  OK. ["%1" %*] .REG  OK. [regedit.exe "%1"] .BAT  OK. ["%1" %*] .SCR  OK. ["%1" /S] .CHM  OK. ["C:\WINDOWS\hh.exe" %1] .HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1] .INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .LNK  OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf N/A ================================== HOSTS 文件 127.0.0.1       localhost ================================== API HOOK N/A ================================== ※ ※ ※ 本文纯属【zmxc】个人意见，与【 微点交流论坛 】立场无关※ ※ ※ 2007-4-14 11:48 Legend 超级版主 超级版主 积分 77171 发帖 70170 注册 2005-10-29 #4   请问您的系统版本、微点软件安装包版本、是否同时安装其他的安全软件？ 请把您的蓝屏文件导出压缩发给我们具体分析下原因。 蓝屏文件设置我的电脑-〉右键属性-〉高级-〉启动和故障恢复-〉写入调试信息改为完全内存转储并重启系统；待出现蓝屏后把c:\\windows\\MEMORY.DMP把这个文件导出上传就可以了；上传前可以压缩下，可以上传support@micropoint.com.cn邮箱或者与我联系具体上传途径。 ※文章所有权归【Legend】与【东方微点论坛】共同所有，转载请注明出处！※ 微点官方认证新浪微博：欢迎进入 微点新浪微博 微点技术支持邮箱: support@micropoint.com.cn 给Legend发短消息 2007-4-14 11:51 论坛跳转: 微点软件公测区 安全快报  > 病毒快报  > 漏洞快报 微点产品在线技术支持  > 微点主动防御软件  > 预升级反馈专区  > 微点杀毒软件 微点用户交流区  > 微点新闻  > 微点软件使用交流  > 微点茶室 安全技术交流区  > 主动防御  > 反病毒  > 防火墙 综合区  > 电脑&数码  > 体育&娱乐&休闲  > 灌水区 版务管理 内部使用专区  可打印版本 | 推荐 | 订阅 | 收藏 [ 联系我们 - 东方微点 ] 北京东方微点信息技术有限责任公司 福建东方微点信息安全有限责任公司 闽ICP备05030815号