瑞星卡卡安全论坛

首页 » 技术交流区 » 反病毒/反流氓软件论坛 » 每次打开浏览器 MSN网站总会弹出来 而且浏览器设置里改不掉
pbbp - 2005-12-15 18:20:00
谢谢大哥拉  还有就是老会隔段时间弹出黄色网站  然后就发现病毒拉
Logfile of HijackThis v1.99.1
Scan saved at 18:19:32, on 2005-12-15
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\Program Files\Rising\Rav\Ravmond.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\WINDOWS\System32\NMSSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Rising\Rav\RavTask.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\hexin\sslproxy\SSLCnt.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\Program Files\rising\Rav\RsAgent.exe
C:\WINDOWS\msagent\AgentSvr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
E:\shaomiao\HijackThis.exe

O2 - BHO: Yahoo!Photo - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll
O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll
O2 - BHO: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - F:\PROGRA~1\FLASHG~1.71\JCCATCH.DLL
O2 - BHO: (no name) - {A9930D97-9CF0-42A0-A10D-4F28836579D5} - E:\PROGRA~1\KuGoo3\KUGOO3~1.OCX
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINDOWS\DOWNLO~1\CnsHook.dll
O3 - Toolbar: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - F:\PROGRA~1\FLASHG~1.71\fgiebar.dll
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: 核新SSL通讯安全代理.lnk = C:\Program Files\hexin\sslproxy\SSLCnt.exe
O8 - Extra context menu item: !搜一搜 - res://C:\WINDOWS\DOWNLO~1\CnsMinEx.dll/1003
O8 - Extra context menu item: 上传到QQ网络硬盘 - E:\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 使用KuGoo3下载(&K) - E:\Program Files\KuGoo3\KuGoo3DownX.htm
O8 - Extra context menu item: 使用网际快车下载 - F:\Program Files\FlashGet1.71\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - F:\Program Files\FlashGet1.71\jc_all.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - E:\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - E:\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - E:\Tencent\QQ\SendMMS.htm
O9 - Extra button: 手机短信 - {00000000-0000-0001-0001-596BAEDD1289} - http://sms.3721.com/ie/index.htm?pid=52929_1006 (file missing)
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - E:\下载\浩方对~1\GameClient.exe (file missing)
O9 - Extra button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.mail.yahoo.com/promo/rd1 (file missing)
O9 - Extra button: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://adtaobao.allyes.com/main/adfclick?db=adtaobao&bid=138,140,18&cid=816,8,1&sid=5042&show=ignore&url=?allyesPara=816 (file missing)
O9 - Extra button: 雅虎助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://cn.zs.yahoo.com/?source=Cns (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing)
O9 - Extra 'Tools' menuitem: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing)
O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O9 - Extra 'Tools' menuitem: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O11 - Options group: [!CNS]  网络实名
O17 - HKLM\System\CCS\Services\Tcpip\..\{0A2F6FBD-B00D-48B1-9D6C-F4F87ACC3FD2}: NameServer = 61.144.56.100 61.144.56.101
O17 - HKLM\System\CS2\Services\Tcpip\..\{0A2F6FBD-B00D-48B1-9D6C-F4F87ACC3FD2}: NameServer = 61.144.56.100 61.144.56.101
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe

花落花又开 - 2005-12-15 18:23:00
帖出杀软报的病毒及路径.
pbbp - 2005-12-15 18:44:00
【回复“花落花又开”的帖子】主要是偶尔会自动进一些不知道的网站然后就发现病毒  还有就是MSN网站劫持拉浏览器每次打开浏览器就先进他的网站拉  求大哥帮帮忙
病毒名称处理结果发现日期扫描方式路径文件病毒来源
Js.hta.StartPage删除成功2005-12-10 14:07手动扫描C:\Documents and Settings\PB\Local Settings\Temporary Internet Files\Content.IE5\Q90FWTY5se[1].hta本机
Script.WebImport.b删除成功2005-12-12 10:39屏保扫描C:\Documents and Settings\PFP\Local Settings\Temporary Internet Files\Content.IE5\WD2FSHEJyxk[1].hta本机
Script.Taorao.a删除成功2005-12-12 20:01手动扫描C:\Documents and Settings\PB\Local Settings\Temporary Internet Files\Content.IE5\VY464JQ8qq[1].hta本机
HTA.Startpage删除成功2005-12-12 20:01手动扫描C:\Documents and Settings\PB\Local Settings\Temporary Internet Files\Content.IE5\VY464JQ8s[1].hta本机
Js.hta.StartPage删除成功2005-12-13 18:06屏保扫描C:\Documents and Settings\PB\Local Settings\Temporary Internet Files\Content.IE5\CT2B8XQZse[1].hta本机
飞跃迷离 - 2005-12-15 18:47:00
删除以下文件夹中的内容：
C:\Documents and Settings\PB\Local Settings\Temp\下的所有文件
C:\Documents and Settings\PB\LocalSettings\TemporaryInternet Files\下的所有文件

》》还有就是MSN网站劫持拉浏览器每次打开浏览器就先进他的网站拉
请检查您是否使用了雅虎助手等软件的ie保护功能


pbbp - 2005-12-15 18:50:00
【回复“花落花又开”的帖子】病毒名称处理结果发现日期扫描方式路径文件病毒来源
Js.hta.StartPage删除成功2005-12-10 14:07手动扫描C:\Documents and Settings\PB\Local Settings\Temporary Internet Files\Content.IE5\Q90FWTY5se[1].hta本机
Script.WebImport.b删除成功2005-12-12 10:39屏保扫描C:\Documents and Settings\PFP\Local Settings\Temporary Internet Files\Content.IE5\WD2FSHEJyxk[1].hta本机
Script.Taorao.a删除成功2005-12-12 20:01手动扫描C:\Documents and Settings\PB\Local Settings\Temporary Internet Files\Content.IE5\VY464JQ8qq[1].hta本机
HTA.Startpage删除成功2005-12-12 20:01手动扫描C:\Documents and Settings\PB\Local Settings\Temporary Internet Files\Content.IE5\VY464JQ8s[1].hta本机
Js.hta.StartPage删除成功2005-12-13 18:06屏保扫描C:\Documents and Settings\PB\Local Settings\Temporary Internet Files\Content.IE5\CT2B8XQZse[1].hta本机

进程名称路径数值名称数值数据操作日期操作方式操作结果
C:\WINDOWS\system32\dumprep.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNKernelFaultCheck2005-12-09 11:57删除拒绝修改
C:\WINDOWS\System32\svchost.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNUserFaultCheck2005-12-09 23:02修改拒绝修改
C:\WINDOWS\System32\mshta.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINStart Pagehttp://www.511y.com2005-12-10 09:35修改拒绝修改
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNMyAppC:\WINDOWS\system.exe2005-12-10 09:35修改拒绝修改
C:\WINDOWS\System32\mshta.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINStart PageHttp://www.vvfy.com/movie2005-12-10 13:36修改拒绝修改
C:\WINDOWS\System32\rundll32.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNCTFMON.EXEC:\WINDOWS\System32\CTFMON.EXE2005-12-11 10:51修改同意修改
C:\WINDOWS\System32\CTFMON.EXEHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNctfmon.exeC:\WINDOWS\System32\ctfmon.exe2005-12-11 11:04修改同意修改
G:\Nero OEM\Setup.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNNeroCheckC:\WINDOWS\system32\NeroCheck.exe2005-12-11 15:53修改同意修改
G:\InCD 4\Setup.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNInCDD:\Program Files\InCD\InCD.exe2005-12-11 16:03修改同意修改
C:\WINDOWS\System32\mshta.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINStart PageHttp://www.vvfy.com/movie2005-12-11 17:09修改拒绝修改
C:\WINDOWS\System32\mshta.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINStart Pagehttp://www.511y.com2005-12-11 17:09修改拒绝修改
C:\WINDOWS\System32\mshta.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINStart Pagehttp://www.uu500.com2005-12-11 20:45修改拒绝修改
C:\WINDOWS\system32\dumprep.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNUserFaultCheck2005-12-11 20:47删除拒绝修改
C:\WINDOWS\System32\RunDll32.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNCTFMON.EXEC:\WINDOWS\System32\CTFMON.EXE2005-12-11 20:51修改同意修改
C:\WINDOWS\System32\mshta.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINStart PageHttp://www.333tu.com2005-12-11 22:21修改同意修改
C:\WINDOWS\System32\mshta.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINStart Pagehttp://www.88997.com/efefef/inde.htmefefef/inde.ht2005-12-11 23:22修改同意修改
C:\WINDOWS\system32\dumprep.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNUserFaultCheck2005-12-12 09:14删除拒绝修改
C:\WINDOWS\System32\mshta.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINStart Pagehttp://www.88997.com/efefef/inde.htmefefef/inde.ht2005-12-12 09:46修改拒绝修改
C:\WINDOWS\System32\CTFMON.EXEHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNctfmon.exeC:\WINDOWS\System32\ctfmon.exe2005-12-12 11:46修改拒绝修改
C:\WINDOWS\system32\dumprep.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNKernelFaultCheck2005-12-12 17:57删除拒绝修改
C:\WINDOWS\system32\dumprep.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNUserFaultCheck2005-12-12 17:57删除拒绝修改
C:\WINDOWS\System32\mshta.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINStart Pagehttp://www.511y.com2005-12-12 19:41修改拒绝修改
C:\WINDOWS\system32\dumprep.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNUserFaultCheck2005-12-13 14:08删除拒绝修改
C:\WINDOWS\System32\mshta.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINStart Pagehttp://www.511y.com2005-12-13 14:41修改拒绝修改
C:\WINDOWS\System32\mshta.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINStart Pagehttp://www.511y.com2005-12-13 14:50修改拒绝修改
C:\WINDOWS\System32\mshta.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINStart Pagehttp://www.511y.com2005-12-13 14:51修改拒绝修改
C:\WINDOWS\System32\mshta.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINStart Pagehttp://www.511y.com2005-12-13 14:53修改拒绝修改
C:\WINDOWS\system32\dumprep.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNUserFaultCheck2005-12-13 14:58删除拒绝修改
C:\WINDOWS\System32\mshta.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINStart PageHttp://www.333tu.com2005-12-13 15:12修改拒绝修改
C:\WINDOWS\System32\mshta.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINStart PageHttp://www.333tu.com2005-12-13 15:13修改拒绝修改
C:\DOCUME~1\PB\LOCALS~1\Temp\NuNInst.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNNeroCheck2005-12-13 15:27删除拒绝修改
C:\WINDOWS\System32\mshta.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINStart PageHttp://www.vvfy.com/movie2005-12-13 17:02修改拒绝修改
C:\WINDOWS\System32\mshta.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINStart PageHttp://www.vvfy.com/movie2005-12-13 17:06修改拒绝修改
C:\WINDOWS\System32\mshta.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINStart PageHttp://www.vvfy.com/movie2005-12-13 17:06修改拒绝修改
C:\WINDOWS\System32\mshta.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINStart PageHttp://www.vvfy.com/movie2005-12-13 17:07修改拒绝修改
C:\WINDOWS\System32\mshta.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINStart PageHttp://www.vvfy.com/movie2005-12-13 18:25修改拒绝修改
C:\WINDOWS\System32\mshta.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINStart PageHttp://www.vvfy.com/movie2005-12-14 16:20修改拒绝修改
C:\WINDOWS\System32\svchost.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNdefault2005-12-14 20:35添加(&P)拒绝修改
C:\WINDOWS\System32\svchost.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNdefault2005-12-14 20:35添加(&P)拒绝修改
C:\WINDOWS\System32\rundll32.exeHKEY_CLASSES_ROOT\.HTM\OPENWITHLIST\MICROSOFT FRONTPAGE\SHELL\EDITdefault2005-12-14 20:38添加(&P)拒绝修改
C:\WINDOWS\System32\rundll32.exeHKEY_CLASSES_ROOT\.HTM\OPENWITHLIST\MICROSOFT FRONTPAGEdefault2005-12-14 20:38添加(&P)拒绝修改
C:\WINDOWS\System32\rundll32.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURLdefault2005-12-14 20:38添加(&P)拒绝修改
C:\WINDOWS\System32\rundll32.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURLdefault2005-12-14 20:38添加(&P)拒绝修改
C:\WINDOWS\System32\rundll32.exeHKEY_CLASSES_ROOT\.HTM\OPENWITHLIST\MICROSOFT FRONTPAGE\SHELL\EDITdefault2005-12-14 20:40添加(&P)拒绝修改
C:\WINDOWS\System32\rundll32.exeHKEY_CLASSES_ROOT\.HTM\OPENWITHLIST\MICROSOFT FRONTPAGEdefault2005-12-14 20:40添加(&P)拒绝修改
C:\WINDOWS\System32\svchost.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNdefault2005-12-15 08:21添加(&P)拒绝修改
C:\WINDOWS\System32\svchost.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNdefault2005-12-15 08:21添加(&P)拒绝修改
C:\WINDOWS\System32\svchost.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNUserFaultCheck2005-12-15 12:03修改拒绝修改
C:\WINDOWS\System32\mshta.exeHKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAINStart Pagehttp://www.511y.com2005-12-15 12:04修改拒绝修改
C:\WINDOWS\System32\svchost.exeHKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNUserFaultCheck2005-12-15 12:39修改拒绝修改
pbbp - 2005-12-15 19:04:00
【回复“飞跃迷离”的帖子】删那的没用  重起才能删掉  而且删掉以后过段时间  还会自动跳出网页  然后又在那中毒拉
pbbp - 2005-12-15 19:07:00
【回复“飞跃迷离”的帖子】刚刚和你说话又中拉一波连续跳6，7个网页  随着病毒又来拉
飞跃迷离 - 2005-12-15 19:13:00
请用System Repair Engineer 扫个日志上来

下载地址见置顶贴
[必读]本版说明及常用小软件下载
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
魔法学徒 - 2005-12-15 20:00:00
杀毒请在安全模式下进行
pbbp - 2005-12-16 8:54:00
【回复“飞跃迷离”的帖子】2005-12-16,08:52:02

System Repair Engineer 2.0.12.350 (2.0 RC 1)
    Windows XP Professional  - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe>
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <load><>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <UserFaultCheck><%systemroot%\system32\dumprep 0 -u>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <shell><Explorer.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <Userinit><C:\WINDOWS\System32\Userinit.exe,>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <AppInit_DLLs><>

==================================
启动文件夹
[核新SSL通讯安全代理]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\核新SSL通讯安全代理.lnk><N>

==================================
服务
[IMAPI CD-Burning COM Service / ImapiService]
  <C:\WINDOWS\System32\imapi.exe><Microsoft Corporation>
[Intel(R) NMS / NMSSvc]
  <C:\WINDOWS\System32\NMSSvc.exe><Intel Corporation>
[Rising Process Communication Center / RsCCenter]
  <C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
  <"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>

==================================
浏览器加载项
[Yahoo!Photo]
  {33BBE430-0E42-4f12-B075-8D21ACB10DCB} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll, Yahoo! China>
[AntiFish Class]
  {38928D50-8A48-44C2-945F-D2F23F771410} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll, Yahoo.>
[雅虎助手]
  {406F94F0-504F-4a40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll, Yahoo!>
[DragSearch BHO]
  {62EED7C6-9F02-42f9-B634-98E2899E147B} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL, >
[IeCatch2 Class]
  {A5366673-E8CA-11D3-9CD9-0090271D075B} <F:\PROGRA~1\FLASHG~1.71\JCCATCH.DLL, Amaze Soft>
[]
  {A9930D97-9CF0-42A0-A10D-4F28836579D5} <E:\PROGRA~1\KuGoo3\KUGOO3~1.OCX, N/A>
[CnsHook Class]
  {D157330A-9EF3-49F8-9A67-4141AC41ADD4} <C:\WINDOWS\DOWNLO~1\CnsHook.dll, 北京三七二一科技有限公司>
[手机短信]
  {00000000-0000-0001-0001-596BAEDD1289} <http://sms.3721.com/ie/index.htm?pid=52929_1006, N/A>
[浩方对战平台]
  {0A155D3C-68E2-4215-A47A-E800A446447A} <E:\下载\浩方对~1\GameClient.exe, N/A>
[Yahoo 1G电邮]
  {507F9113-CD77-4866-BA92-0E86DA3D0B97} <http://cn.mail.yahoo.com/promo/rd1, N/A>
[寻宝乐趣多]
  {59BC54A2-56B3-44a0-93E5-432D58746E26} <http://adtaobao.allyes.com/main/adfclick?db=adtaobao&bid=138,140,18&cid=816,8,1&sid=5042&show=ignore&url=?allyesPara=816, N/A>
[雅虎助手]
  {5D73EE86-05F1-49ed-B850-E423120EC338} <http://cn.zs.yahoo.com/?source=Cns, N/A>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[情景聊天]
  {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} <http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/, N/A>
[]
  {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} <http://assistant.3721.com/security1.htm?fb=Cns, N/A>
[]
  {FD00D911-7529-4084-9946-A29F1BDF4FE5} <http://assistant.3721.com/clean1.htm?fb=Cns, N/A>
[雅虎助手]
  {406F94F0-504F-4a40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll, Yahoo!>
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[FlashGet Bar]
  {E0E899AB-F487-11D5-8D29-0050BA6940E3} <F:\PROGRA~1\FLASHG~1.71\fgiebar.dll, Amaze Soft>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[!搜一搜]
  <res://C:\WINDOWS\DOWNLO~1\CnsMinEx.dll/1003, N/A>
[上传到QQ网络硬盘]
  <E:\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用KuGoo3下载(&K)]
  <E:\Program Files\KuGoo3\KuGoo3DownX.htm, N/A>
[使用网际快车下载]
  <F:\Program Files\FlashGet1.71\jc_link.htm, N/A>
[使用网际快车下载全部链接]
  <F:\Program Files\FlashGet1.71\jc_all.htm, N/A>
[添加到QQ自定义面板]
  <E:\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <E:\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <E:\Tencent\QQ\SendMMS.htm, N/A>
pbbp - 2005-12-16 8:57:00
==================================
正在运行的进程
[PID: 572][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 636][\??\C:\WINDOWS\system32\csrss.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 660][\??\C:\WINDOWS\system32\winlogon.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 704][C:\WINDOWS\system32\services.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 716][C:\WINDOWS\system32\lsass.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 896][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 996][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1088][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1164][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1212][C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 1308][C:\Program Files\Rising\Rav\Ravmond.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 1, 3>
    [C:\Program Files\Rising\Rav\BWList.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [C:\Program Files\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\RsLog.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 17>
    [C:\Program Files\Rising\Rav\HOOKSYS.dll]  <Rising><18, 1, 0, 9>
    [C:\Program Files\Rising\Rav\Scanner.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 28>
    [C:\Program Files\Rising\Rav\libload.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\VirusLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\regmon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
    [C:\Program Files\Rising\Rav\HookWeb.dll]  <rising><18, 0, 0, 1>
    [C:\Program Files\Rising\Rav\MemMon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 8>
    [C:\Program Files\Rising\Rav\expscan.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\mPorts.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
    [C:\Program Files\Rising\Rav\MailMon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
    [C:\Program Files\Rising\Rav\SpamEng.dll]  <N/A><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\engine.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
    [C:\Program Files\Rising\Rav\PostTrt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
    [C:\Program Files\Rising\Rav\UnExe.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
    [C:\Program Files\Rising\Rav\ScanExec.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
    [C:\Program Files\Rising\Rav\ScanEx.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
    [C:\Program Files\Rising\Rav\NvFile.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
    [C:\Program Files\Rising\Rav\ScanMac.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
    [C:\Program Files\Rising\Rav\ScanSct.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\Unpacker.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 1396][C:\WINDOWS\system32\spoolsv.exe]  <Microsoft Corporation><5.1.2600.0 (XPClient.010817-1148)>
    [C:\WINDOWS\system32\hpzsnt08.dll]  <HP><2,223,0,0>
[PID: 1480][C:\Program Files\Rising\Rav\RavStub.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 1756][C:\WINDOWS\Explorer.EXE]  <Microsoft Corporation><6.00.2600.0000 (xpclient.010817-1148)>
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 1, 9>
    [C:\WINDOWS\System32\igfxpph.dll]  <Intel Corporation><3,0,0,1918>
    [C:\WINDOWS\System32\hccutils.DLL]  <Intel Corporation><3,0,0,1918>
    [C:\WINDOWS\System32\igfxres.dll]  <Intel Corporation><3,0,0,1918>
    [C:\WINDOWS\System32\igfxsrvc.dll]  <Intel Corporation><3,0,0,1918>
    [C:\WINDOWS\System32\igfxdev.dll]  <Intel Corporation><3,0,0,1918>
    [C:\WINDOWS\DOWNLO~1\CnsHook.dll]  <北京三七二一科技有限公司><1, 0, 2, 7>
    [C:\WINDOWS\system32\RavExt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll]  <Yahoo! China><1, 0, 3, 1016>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll]  <Yahoo!><2, 0, 4, 1026>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL]  <><1, 2, 7, 1006>
    [F:\PROGRA~1\FLASHG~1.71\JCCATCH.DLL]  <Amaze Soft><1, 1, 4, 0>
    [E:\PROGRA~1\KuGoo3\KUGOO3~1.OCX]  <N/A><N/A>
[PID: 260][C:\WINDOWS\System32\Rundll32.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 1, 9>
    [C:\WINDOWS\DOWNLO~1\CnsMinIO.dll]  <北京三七二一科技有限公司><1, 0, 3, 6>
    [C:\WINDOWS\DOWNLO~1\cnsio.dll]  <北京三七二一科技有限公司><1, 0, 2, 7>
    [C:\WINDOWS\DOWNLO~1\CnsMinEx.dll]  <国风因特软件(北京)有限公司><1, 0, 2, 7>
[PID: 268][C:\Program Files\Rising\Rav\RavTask.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [C:\Program Files\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 1, 9>
[PID: 284][C:\Program Files\Rising\Rav\Ravmon.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 99>
    [C:\Program Files\Rising\Rav\RsGuiLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
    [C:\Program Files\Rising\Rav\BWList.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [C:\Program Files\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\Program Files\Rising\Rav\PngDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 1, 9>
[PID: 348][C:\WINDOWS\System32\ctfmon.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 1, 9>
[PID: 356][C:\Program Files\Messenger\msmsgs.exe]  <Microsoft Corporation><4.0.0155>
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 1, 9>
[PID: 396][C:\Program Files\hexin\sslproxy\SSLCnt.exe]  <杭州核新软件技术有限公司><1.103.2004.0218>
    [C:\Program Files\hexin\sslproxy\crypteng.dll]  <杭州核新软件技术有限公司><1.44.2003.0426>
    [C:\Program Files\hexin\sslproxy\sslproxy.dll]  <杭州核新软件技术有限公司><1.52.2002.326>
    [C:\Program Files\hexin\sslproxy\CAsAPI.dll]  <杭州核新软件技术有限公司><1.49.2002.422>
    [C:\Program Files\hexin\sslproxy\Scard.dll]  <杭州核新软件技术有限公司><1.02.2001.0529>
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 1, 9>
    [C:\Program Files\hexin\sslproxy\MapProxy.dll]  <核新软件技术有限公司><1.00.2003.0613>
pbbp - 2005-12-16 8:58:00
[PID: 556][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  <Microsoft Corporation><6.00.2600.0000 (xpclient.010817-1148)>
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 1, 9>
    [C:\WINDOWS\DOWNLO~1\CnsHint.dll]  <3721><1, 0, 0, 5>
    [C:\WINDOWS\DOWNLO~1\cnsplus.dll]  <3721><1, 0, 0, 2>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll]  <Yahoo!><2, 0, 4, 1026>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yaswiper.dll]  <Yahoo><1, 0, 1, 1004>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasiesec.dll]  <Yahoo><1, 0, 1, 1000>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasnoad.dll]  <><1, 0, 0, 9>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yzsNetProto.dll]  <Yahoo><1, 0, 0, 1>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll]  <Yahoo! China><1, 0, 3, 1016>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll]  <Yahoo.><1, 0, 1, 1001>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL]  <><1, 2, 7, 1006>
    [F:\PROGRA~1\FLASHG~1.71\JCCATCH.DLL]  <Amaze Soft><1, 1, 4, 0>
    [E:\PROGRA~1\KuGoo3\KUGOO3~1.OCX]  <N/A><N/A>
    [C:\WINDOWS\DOWNLO~1\CnsHook.dll]  <北京三七二一科技有限公司><1, 0, 2, 7>
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
    [C:\WINDOWS\DOWNLO~1\CnsMinIO.dll]  <北京三七二一科技有限公司><1, 0, 3, 6>
    [C:\WINDOWS\DOWNLO~1\cnsio.dll]  <北京三七二一科技有限公司><1, 0, 2, 7>
[PID: 980][C:\WINDOWS\System32\alg.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1028][C:\WINDOWS\System32\NMSSvc.exe]  <Intel Corporation><2.1.9.0>
[PID: 1292][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1660][C:\WINDOWS\System32\wdfmgr.exe]  <Microsoft Corporation><5.2.3790.1230 built by: DNSRV(bld4act)>
[PID: 2064][C:\Program Files\Internet Explorer\iexplore.exe]  <Microsoft Corporation><6.00.2600.0000 (xpclient.010817-1148)>
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 1, 9>
    [C:\WINDOWS\DOWNLO~1\CnsHint.dll]  <3721><1, 0, 0, 5>
    [C:\WINDOWS\DOWNLO~1\cnsplus.dll]  <3721><1, 0, 0, 2>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll]  <Yahoo!><2, 0, 4, 1026>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yaswiper.dll]  <Yahoo><1, 0, 1, 1004>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasiesec.dll]  <Yahoo><1, 0, 1, 1000>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasnoad.dll]  <><1, 0, 0, 9>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yzsNetProto.dll]  <Yahoo><1, 0, 0, 1>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll]  <Yahoo! China><1, 0, 3, 1016>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll]  <Yahoo.><1, 0, 1, 1001>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL]  <><1, 2, 7, 1006>
    [F:\PROGRA~1\FLASHG~1.71\JCCATCH.DLL]  <Amaze Soft><1, 1, 4, 0>
    [E:\PROGRA~1\KuGoo3\KUGOO3~1.OCX]  <N/A><N/A>
    [C:\WINDOWS\DOWNLO~1\CnsHook.dll]  <北京三七二一科技有限公司><1, 0, 2, 7>
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
    [C:\WINDOWS\System32\Macromed\Flash\Flash8.ocx]  <Macromedia, Inc.><8,0,22,0>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yrepair.dll]  <Yahoo><1, 0, 4, 1001>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasfsks.dll]  <3721.com><2, 1, 1, 87>
    [c:\progra~1\yahoo!\assist~1\assist\yadfil~1.dll]  < ><1, 0, 1, 6>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yoptimum.dll]  <Yahoo><1, 0, 1, 1001>
    [C:\PROGRA~1\yahoo!\assistant\Shell\yAssecblk.dll]  <Yahoo><1, 0, 1, 1001>
    [C:\WINDOWS\DOWNLO~1\CnsMinIO.dll]  <北京三七二一科技有限公司><1, 0, 3, 6>
    [C:\WINDOWS\DOWNLO~1\cnsio.dll]  <北京三七二一科技有限公司><1, 0, 2, 7>
[PID: 2716][F:\Program Files\FlashGet1.71\flashget.exe]  <Amaze Soft><1, 7, 1, 0>
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 1, 9>
[PID: 2256][E:\扫描\SREng.exe]  <Smallfrogs Studio><2.0.12.350>
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 1, 9>

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================
1
查看完整版本: 每次打开浏览器 MSN网站总会弹出来 而且浏览器设置里改不掉
© 2000 - 2026 Rising Corp. Ltd.