风格一派 - 2006-2-5 10:30:00
HijackThis@Qoo的扫描日志 V1.97.7
Scan saved at 10:19:42, on 2006-2-5
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\Program Files\Rising\Rav\CCenter.exe
D:\Program Files\Rising\Rav\Ravmond.exe
D:\WINNT\system32\spoolsv.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\nvsvc32.exe
D:\WINNT\system32\MSTask.exe
D:\WINNT\system32\rundll32.exe
D:\WINNT\System32\WBEM\WinMgmt.exe
D:\Program Files\Rising\Rav\RavStub.exe
D:\DOCUME~1\ADMINI~1.COM\LOCALS~1\Temp\wt\wt.exe
D:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
D:\WINNT\system32\inetsrv\inetinfo.exe
D:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
D:\WINNT\Explorer.EXE
D:\WINNT\SOUNDMAN.EXE
D:\Program Files\Rising\Rav\RavTask.exe
D:\Program Files\Rising\Rav\Ravmon.exe
D:\Program Files\Tencent\QQ\QQ.exe
E:\Program Files\ClearVision\ClearVision.exe
D:\Program Files\Rising\Rav\Rav.exe
D:\Program Files\Tencent\TT\TTraveler.exe
D:\Program Files\HbTools\Bin\4.7.0.0\HbtSrv.exe
D:\Documents and Settings\Administrator.COMMONOR-DD5D6F\桌面\HijackThis.exe
R3 - URLSearchHook:
O2 - BHO: (no name) - {0005A87D-D626-4B3A-84F9-1D9571695F55} - D:\WINNT\system32\xunleibho_v2.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Link Filter - {4022F902-ABC7-4C79-924F-BB26F1D355A2} - D:\WINNT\system32\diybar2\diybar2.dll
O2 - BHO: (no name) - {4E83D567-4697-4F7B-B1F0-A513B01DB89A} - d:\PROGRA~1\chinanet\VNETTR~1.DLL
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: MMSAssist - {6671A431-5C3D-463d-A7CF-5587F9B7E191} - D:\PROGRA~1\MMSASS~1\MMSASS~1.DLL
O2 - BHO: std software - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - D:\WINNT\SYSTEM32\stdup.dll
O2 - BHO: HbTools - {74CC49F7-EB32-4A08-B204-948962A6E3DB} - D:\Program Files\HbTools\Bin\4.7.0.0\HbtHostIE.dll
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\PROGRA~1\FLASHGET\jccatch.dll
O2 - BHO: DownloadBHO T2BHO - {B1D147E7-873E-4909-8127-695D9BB78728} - D:\WINNT\Downloaded Program Files\CONFLICT.1\barsmall24.dll
O2 - BHO: (no name) - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - D:\Program Files\Xi\NetTransport 2\NTIEHelper.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - Toolbar: ????? - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\system32\msdxm.ocx
O3 - Toolbar: H&otbar - {74CC49F7-EB32-4A08-B204-948962A6E3DB} - D:\Program Files\HbTools\Bin\4.7.0.0\HbtHostIE.dll
O3 - Toolbar: ????? - {0A00D11E-B1E7-44b5-AD88-C9190876AAC4} - D:\WINNT\system32\diybar2\diybar2.dll
O3 - Toolbar: ????? - {a8e7924f-d5ab-4e43-98ef-881ec9bf66df} - D:\Program Files\
O3 - Toolbar: ????? - {56A7DC70-E102-4408-A34A-AE06FEF01586} - D:\WINNT\Downloaded Program Files\CONFLICT.1\iesmall24.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [LANServer] rem D:\PROGRA~1\LANSER~1\CSERVER.EXE
O4 - HKLM\..\Run: [DSLAGENTEXE] rem dslagent.exe
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WeatherOnTray] D:\Program Files\HbTools\Bin\4.7.0.0\HbtWeatherOnTray.exe
O4 - HKLM\..\Run: [HbTools] D:\Program Files\HbTools\Bin\4.7.0.0\HbtOEAddOn.exe
O4 - HKLM\..\Run: [kovwsxgw] D:\WINNT\system32\nnicgmnn.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RavTask] "D:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKCU\..\Run: [eMuleAutoStart] E:\Program Files\eMule\eMule.exe -AutoStart
O4 - Startup: NTUSER.DAT
O4 - Startup: ntuser.dat.LOG
O4 - Startup: ntuser.ini
O4 - Startup: net
O4 - Startup: temp.dll
O4 - Startup: 无
O4 - Startup: 没有选择
O4 - Startup: cmd
O4 - Startup: main1
O4 - Startup: main2
O4 - Startup: mainurl
O4 - Startup: poll1
O4 - Startup: poll1url
O4 - Startup: ntuser.pol
O4 - Startup: var.htm
O4 - Global Startup: ntuser.pol
O8 - Extra context menu item: >> 彩信发送 << - res://D:\PROGRA~1\MMSASS~1\MMSASS~1.DLL/mms.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 使用影音传送带下载 - D:\Program Files\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: 使用影音传送带下载全部链接 - D:\Program Files\Xi\NetTransport 2\NTAddList.html
O8 - Extra context menu item: 使用网际快车下载 - D:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - D:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Program Files\Tencent\QQ\SendMMS.htm
O9 - Extra 'Tools' menuitem: Link Filter (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: QQ (HKLM)
O16 - DPF: {0D6709DD-4ED8-40CA-B459-2757AEEF7BEE} (Dldrv2 Control) - http://download.gigabyte.com.tw/object/Dldrv.ocx
O16 - DPF: {15DDE989-CD45-4561-BF99-D22C0D5C2B74} - http://image2.sina.com.cn/home/ddtsource/ddt.cab
O16 - DPF: {15DDE989-CD45-4561-BF99-D22C0D5C2B85} - http://image2.sina.com.cn/pfp/iweb/vivimin.cab
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540006} (CInstall Class) - http://www.errorguard.com/installation/Install.cab
O16 - DPF: {220ED87A-CB03-45A8-A81E-1C5597E11186} (GDHidCtrl Class) - http://esales.qq.com/cab/GDHidUsr.cab
O16 - DPF: {28E0FA88-ABA8-4937-A247-3031F1A11165} (Installer Class) - http://pi.51.net/download/diybar2.cab
O16 - DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} (KX-HCM10 Control) - http://203.141.196.51/kxhcm10.ocx
O16 - DPF: {3D8F74EE-8692-4F8F-B8D2-7522E732519E} (WebActivater Control) - http://game.qq.com/QQGame2.cab
O16 - DPF: {56A7DC70-E102-4408-A34A-AE06FEF01586} (
O16 - DPF: {59324688-BAB1-4EC0-999A-BFA50D3D4F1D} (FullCtrl Class) - http://chat.qq.com/activex/curver/webvqq.cab
O16 - DPF: {8C875948-9C60-4381-9248-0DF180542D53} (HbtInstObj) - http://installs.hotbar.com/installs/hbtools/programs/hbtools.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38157.0624189815
O16 - DPF: {AC3A36A8-9BFF-410A-A33D-2279FFEB69D2} (Qzone Media Tools) - http://imgcache.qq.com/music/QQMusicSetup.exe
O16 - DPF: {BC207F7D-3E63-4ACA-99B5-FB5F8428200C} - http://bar.baidu.com/update/IESearch.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash2/cabs/swflash.cab
O16 - DPF: {DA984A6D-508E-11D6-AA49-0050FF3C628D} (Ravonline) - http://download.rising.com.cn/ravkill/rsonline.cab
O16 - DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} (pCastPanel Class) - http://pcastdl.dudu.com/files/pCastCtl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{28458C4F-8C96-4BD1-954D-70440430ECB9}: NameServer = 202.99.96.68
O17 - HKLM\System\CCS\Services\Tcpip\..\{38DFD6D7-C5C7-475E-A279-18C9EAF364DB}: NameServer = 202.96.104.16,202.96.104.17
O17 - HKLM\System\CCS\Services\Tcpip\..\{C8E4818B-4AAE-4B50-B09C-0461B9533C00}: NameServer = 202.96.104.27,202.96.104.17
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - %SystemRoot%\system32\mshtml.dll
不言放弃 - 2006-2-5 10:36:00
http://forum.ikaka.com/topic.asp?board=28&artid=6979213
下载HIJACKTHIS
重新导出日志
不言放弃 - 2006-2-5 10:43:00
| 引用: |
【风格一派的贴子】我的就是刚刚才下载的`有什么不对吗 高手
........................... |
晕倒
HIJACKTHIS版本太低
http://forum.ikaka.com/topic.asp?board=28&artid=6979213
下载HIJACKTHIS＜1楼附件就是＞
重新导出日志
风格一派 - 2006-2-5 10:48:00
HijackThis_zww汉化版扫描日志 V1.99.1
保存于 10:49:22, 日期 2006-2-5
操作系统： Windows 2000 SP4 (WinNT 5.00.2195)
浏览器： Internet Explorer v6.00 SP1 (6.00.2800.1106)
当前运行的进程：
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\Program Files\Rising\Rav\CCenter.exe
D:\Program Files\Rising\Rav\Ravmond.exe
D:\WINNT\system32\spoolsv.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\nvsvc32.exe
D:\WINNT\system32\MSTask.exe
D:\WINNT\system32\rundll32.exe
D:\WINNT\System32\WBEM\WinMgmt.exe
D:\Program Files\Rising\Rav\RavStub.exe
D:\DOCUME~1\ADMINI~1.COM\LOCALS~1\Temp\wt\wt.exe
D:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
D:\WINNT\system32\inetsrv\inetinfo.exe
D:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
D:\WINNT\Explorer.EXE
D:\WINNT\SOUNDMAN.EXE
D:\Program Files\Rising\Rav\RavTask.exe
D:\Program Files\Rising\Rav\Ravmon.exe
D:\Program Files\Tencent\QQ\QQ.exe
E:\Program Files\ClearVision\ClearVision.exe
D:\Program Files\Tencent\TT\TTraveler.exe
D:\Documents and Settings\Administrator.COMMONOR-DD5D6F\桌面\HijackThis1991zww.exe
R3 - URLSearchHook: 虎翼DIY吧! - {0A00D11E-B1E7-44b5-AD88-C9190876AAC4} - D:\WINNT\system32\diybar2\diybar2.dll
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - D:\WINNT\system32\xunleibho_v2.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Link Filter - {4022F902-ABC7-4C79-924F-BB26F1D355A2} - D:\WINNT\system32\diybar2\diybar2.dll
O2 - BHO: VnetCookie Class - {4E83D567-4697-4F7B-B1F0-A513B01DB89A} - d:\PROGRA~1\chinanet\VNETTR~1.DLL
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: MMSAssist - {6671A431-5C3D-463d-A7CF-5587F9B7E191} - D:\PROGRA~1\MMSASS~1\MMSASS~1.DLL
O2 - BHO: std software - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - D:\WINNT\SYSTEM32\stdup.dll
O2 - BHO: HbTools - {74CC49F7-EB32-4A08-B204-948962A6E3DB} - D:\Program Files\HbTools\Bin\4.7.0.0\HbtHostIE.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\PROGRA~1\FLASHGET\jccatch.dll
O2 - BHO: DownloadBHO T2BHO - {B1D147E7-873E-4909-8127-695D9BB78728} - D:\WINNT\Downloaded Program Files\CONFLICT.1\barsmall24.dll
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - D:\Program Files\Xi\NetTransport 2\NTIEHelper.dll
O3 - IE工具栏增项: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\system32\msdxm.ocx
O3 - IE工具栏增项: 虎翼DIY吧! - {0A00D11E-B1E7-44b5-AD88-C9190876AAC4} - D:\WINNT\system32\diybar2\diybar2.dll
O3 - IE工具栏增项: 天印签章 - {a8e7924f-d5ab-4e43-98ef-881ec9bf66df} - D:\Program Files\汇信软件\ieband.dll
O3 - IE工具栏增项: 天下搜索 - {56A7DC70-E102-4408-A34A-AE06FEF01586} - D:\WINNT\Downloaded Program Files\CONFLICT.1\iesmall24.dll
O4 - 启动项HKLM\\Run: [Synchronization Manager] mobsync.exe /logon
O4 - 启动项HKLM\\Run: [LANServer] rem D:\PROGRA~1\LANSER~1\CSERVER.EXE
O4 - 启动项HKLM\\Run: [DSLAGENTEXE] rem dslagent.exe
O4 - 启动项HKLM\\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - 启动项HKLM\\Run: [WeatherOnTray] D:\Program Files\HbTools\Bin\4.7.0.0\HbtWeatherOnTray.exe
O4 - 启动项HKLM\\Run: [HbTools] D:\Program Files\HbTools\Bin\4.7.0.0\HbtOEAddOn.exe
O4 - 启动项HKLM\\Run: [kovwsxgw] D:\WINNT\system32\nnicgmnn.exe
O4 - 启动项HKLM\\Run: [SoundMan] SOUNDMAN.EXE
O4 - 启动项HKLM\\Run: [RavTask] "D:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKCU\..\Run: [eMuleAutoStart] E:\Program Files\eMule\eMule.exe -AutoStart
O4 - Startup: 腾讯QQ.lnk = D:\Program Files\Tencent\QQ\QQ.exe
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - D:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 使用影音传送带下载 - D:\Program Files\Xi\NetTransport 2\NTAddLink.html
O8 - IE右键菜单中的新增项目: 使用影音传送带下载全部链接 - D:\Program Files\Xi\NetTransport 2\NTAddList.html
O8 - IE右键菜单中的新增项目: 使用网际快车下载 - D:\Program Files\FlashGet\jc_link.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链接 - D:\Program Files\FlashGet\jc_all.htm
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - D:\Program Files\Tencent\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O9 - 浏览器额外的按钮: pp点点通 - {0713E8D2-850A-101B-AFC0-4210102A8DA7} - D:\WINNT\system32\shdocvw.dll
O9 - 浏览器额外的按钮: (no name) - {3F686D91-4AFA-4ed1-B43F-F1DB46ED480C} - D:\WINNT\system32\shdocvw.dll
O9 - 浏览器额外的“工具”菜单项: Link Filter - {3F686D91-4AFA-4ed1-B43F-F1DB46ED480C} - D:\WINNT\system32\shdocvw.dll
O9 - 浏览器额外的按钮: (no name) - {6671A433-5C3D-463d-A7CF-5587F9B7E191} - D:\PROGRA~1\MMSASS~1\MMSASS~1.DLL
O9 - 浏览器额外的“工具”菜单项: MMSAssist工具条设置 - {6671A433-5C3D-463d-A7CF-5587F9B7E191} - D:\PROGRA~1\MMSASS~1\MMSASS~1.DLL
O9 - 浏览器额外的按钮: 金山词霸 - {C8CE29C5-7589-11D3-B81B-0080C8DC5DC8} - D:\MYEOFF~1\CIBA\IEPlugin.dll
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINNT\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINNT\web\related.htm
O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的按钮: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - 浏览器额外的“工具”菜单项: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O16 - DPF: {0D6709DD-4ED8-40CA-B459-2757AEEF7BEE} (Dldrv2 Control) - http://download.gigabyte.com.tw/object/Dldrv.ocx
O16 - DPF: {15DDE989-CD45-4561-BF99-D22C0D5C2B74} - http://image2.sina.com.cn/home/ddtsource/ddt.cab
O16 - DPF: {15DDE989-CD45-4561-BF99-D22C0D5C2B85} - http://image2.sina.com.cn/pfp/iweb/vivimin.cab
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540006} (CInstall Class) - http://www.errorguard.com/installation/Install.cab
O16 - DPF: {220ED87A-CB03-45A8-A81E-1C5597E11186} (GDHidCtrl Class) - http://esales.qq.com/cab/GDHidUsr.cab
O16 - DPF: {28E0FA88-ABA8-4937-A247-3031F1A11165} (Installer Class) - http://pi.51.net/download/diybar2.cab
O16 - DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} (KX-HCM10 Control) - http://203.141.196.51/kxhcm10.ocx
O16 - DPF: {3D8F74EE-8692-4F8F-B8D2-7522E732519E} (WebActivater Control) - http://game.qq.com/QQGame2.cab
O16 - DPF: {56A7DC70-E102-4408-A34A-AE06FEF01586} (天下搜索) - http://iebar.t2t2.com/iebar.cab
O16 - DPF: {59324688-BAB1-4EC0-999A-BFA50D3D4F1D} (FullCtrl Class) - http://chat.qq.com/activex/curver/webvqq.cab
O16 - DPF: {8C875948-9C60-4381-9248-0DF180542D53} (HbtInstObj) - http://installs.hotbar.com/installs/hbtools/programs/hbtools.cab
O16 - DPF: {AC3A36A8-9BFF-410A-A33D-2279FFEB69D2} (Qzone Media Tools) - http://imgcache.qq.com/music/QQMusicSetup.exe
O16 - DPF: {BC207F7D-3E63-4ACA-99B5-FB5F8428200C} - http://bar.baidu.com/update/IESearch.cab
O16 - DPF: {DA984A6D-508E-11D6-AA49-0050FF3C628D} (Ravonline) - http://download.rising.com.cn/ravkill/rsonline.cab
O16 - DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} (pCastPanel Class) - http://pcastdl.dudu.com/files/pCastCtl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{28458C4F-8C96-4BD1-954D-70440430ECB9}: NameServer = 202.99.96.68
O17 - HKLM\System\CCS\Services\Tcpip\..\{38DFD6D7-C5C7-475E-A279-18C9EAF364DB}: NameServer = 202.96.104.16,202.96.104.17
O17 - HKLM\System\CCS\Services\Tcpip\..\{C8E4818B-4AAE-4B50-B09C-0461B9533C00}: NameServer = 202.96.104.27,202.96.104.17
O18 - 列举现有的协议: mbox - {7DEE9D05-FA0A-4416-A6F3-6537D0EAB6A6} - D:\WINNT\system32\mbprot.dll
O23 - NT 服务: BitDefender Scan Server (bdss) - Unknown owner - D:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - NT 服务: bgcllq - Unknown owner - (no file)
O23 - NT 服务: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - D:\WINNT\System32\dmadmin.exe
O23 - NT 服务: Macromedia Licensing Service - Unknown owner - D:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - NT 服务: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - D:\WINNT\system32\nvsvc32.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\Program Files\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\Program Files\Rising\Rav\Ravmond.exe
O23 - NT 服务: WintUPp - Unknown owner - D:\DOCUME~1\ADMINI~1.COM\LOCALS~1\Temp\wt\wt.exe
O23 - NT 服务: BitDefender Communicator (XCOMM) - Unknown owner - D:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
高手 好了`你在看看
不言放弃 - 2006-2-5 10:57:00
结束D:\DOCUME~1\ADMINI~1.COM\LOCALS~1\Temp\wt\wt.exe进程
修复
R3 - URLSearchHook: 虎翼DIY吧! - {0A00D11E-B1E7-44b5-AD88-C9190876AAC4} - D:\WINNT\system32\diybar2\diybar2.dll
O2 - BHO: Link Filter - {4022F902-ABC7-4C79-924F-BB26F1D355A2} - D:\WINNT\system32\diybar2\diybar2.dll
O2 - BHO: MMSAssist - {6671A431-5C3D-463d-A7CF-5587F9B7E191} - D:\PROGRA~1\MMSASS~1\MMSASS~1.DLL
O2 - BHO: std software - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - D:\WINNT\SYSTEM32\stdup.dll
O2 - BHO: DownloadBHO T2BHO - {B1D147E7-873E-4909-8127-695D9BB78728} - D:\WINNT\Downloaded Program Files\CONFLICT.1\barsmall24.dll
O3 - IE工具栏增项: 虎翼DIY吧! - {0A00D11E-B1E7-44b5-AD88-C9190876AAC4} - D:\WINNT\system32\diybar2\diybar2.dll
O3 - IE工具栏增项: 天下搜索 - {56A7DC70-E102-4408-A34A-AE06FEF01586} - D:\WINNT\Downloaded Program Files\CONFLICT.1\iesmall24.dll
O4 - 启动项HKLM\\Run: [kovwsxgw] D:\WINNT\system32\nnicgmnn.exe
O9 - 浏览器额外的按钮: (no name) - {6671A433-5C3D-463d-A7CF-5587F9B7E191} - D:\PROGRA~1\MMSASS~1\MMSASS~1.DLL
O9 - 浏览器额外的“工具”菜单项: MMSAssist工具条设置 - {6671A433-5C3D-463d-A7CF-5587F9B7E191} - D:\PROGRA~1\MMSASS~1\MMSASS~1.DLL
O23 - NT 服务: bgcllq - Unknown owner - (no file)
O23 - NT 服务: WintUPp - Unknown owner - D:\DOCUME~1\ADMINI~1.COM\LOCALS~1\Temp\wt\wt.exe
卸载
D:\Program Files\MMSAssist
删除
D:\Program Files\MMSAssist
D:\WINNT\SYSTEM32\stdup.dll
D:\WINNT\Downloaded Program Files\CONFLICT.1\barsmall24.dll
D:\WINNT\system32\diybar2\diybar2.dll
D:\WINNT\Downloaded Program Files\CONFLICT.1\iesmall24.dll
D:\WINNT\system32\nnicgmnn.exe
D:\DOCUME~1\ADMINI~1.COM\LOCALS~1\Temp\wt\wt.exe
D:\WINNT\system32\diybar2
以及D:\DOCUME~1\ADMINI~1.COM\LOCALS~1\Temp下的所有文件
风格一派 - 2006-2-5 11:46:00
高手 再问下 为什么我的电脑msconfig运行不出来
风格一派 - 2006-2-5 11:48:00
高手 我的电脑现在是主要word文档打不开 是中病毒了吧 因为我上几天在瑞星官网看到 有种新的病毒专门攻击word 高手 怎么解决 先谢谢咯
风格一派 - 2006-2-5 12:26:00
不言放弃 我的主要的word打不开`你帮我解决解决 我网上一查好象感觉是中了移动杀手病毒
不言放弃 - 2006-2-5 12:32:00
【回复“风格一派”的帖子】
日志中的问题现在是否已经得到解决？
问题太多
解决一个再说下一个吧
现在问题乱在一起
也不知道怎么解决
风格一派 - 2006-2-5 13:04:00
帮我解决为什么我的电脑word文档打不开 谢谢咯
提示找不到文件 我电脑里所以的word文件都是这样的 ppt excel 都可以打开的
风格一派 - 2006-2-5 13:12:00
找不到文件(然后路径) (或其他组件之一) 请确定路径或文件名是否正确,而且所需的库文件均可用
风格一派 - 2006-2-5 13:13:00
就打开word 然后word文档关闭 弹出这样一个对话框
不言放弃 - 2006-2-5 13:20:00
http://forum.ikaka.com/topic.asp?board=28&artid=6979213
下载SysInfoCollect
导出日志
风格一派 - 2006-2-5 13:37:00
System Information Collect Tool - Designed By Smallfrogs
20060205-13:32
Windows 2000 Service Pack 4
Internet Explorer: 6.0.2800.1106
*****************************************************************
Runing Processes information
*****************************************************************
=====================================================
PROCESS NAME: System
-----------------------------------------------------
Process ID = 0x00000008
Thread count= 36
Parent process ID = 0
Priority Class = 32
Modules:
------------------------------------
=====================================================
PROCESS NAME: smss.exe
-----------------------------------------------------
Process ID = 0x00000094
Thread count= 6
Parent process ID = 8
Priority Class = 32
Modules:
------------------------------------
\SystemRoot\System32\smss.exe (0x48580000)
D:\WINNT\system32\ntdll.dll (0x77F80000)
D:\WINNT\System32\sfcfiles.dll (0x67720000)
=====================================================
PROCESS NAME: csrss.exe
-----------------------------------------------------
WARNING: OpenProcess failed with error 5 ()
Process ID = 0x000000ac
Thread count= 9
Parent process ID = 148
Modules:
------------------------------------
=====================================================
PROCESS NAME: winlogon.exe
-----------------------------------------------------
Process ID = 0x000000a8
Thread count= 18
Parent process ID = 148
Priority Class = 128
Modules:
------------------------------------
\??\D:\WINNT\system32\winlogon.exe (0x01000000)
D:\WINNT\system32\ntdll.dll (0x77F80000)
D:\WINNT\system32\MSVCRT.dll (0x78000000)
D:\WINNT\system32\KERNEL32.dll (0x77E60000)
D:\WINNT\system32\ADVAPI32.dll (0x796D0000)
D:\WINNT\system32\RPCRT4.DLL (0x786F0000)
D:\WINNT\system32\GDI32.dll (0x77F40000)
D:\WINNT\system32\USER32.dll (0x77DF0000)
D:\WINNT\system32\USERENV.dll (0x794D0000)
D:\WINNT\system32\NDdeApi.dll (0x76940000)
D:\WINNT\system32\sfc.dll (0x76920000)
D:\WINNT\system32\sfcfiles.dll (0x67720000)
D:\WINNT\system32\Secur32.dll (0x797B0000)
D:\WINNT\system32\PROFMAP.dll (0x68830000)
D:\WINNT\system32\NETAPI32.dll (0x75100000)
D:\WINNT\system32\NTDSAPI.dll (0x77BD0000)
D:\WINNT\system32\DNSAPI.DLL (0x77960000)
D:\WINNT\system32\WSOCK32.DLL (0x74FD0000)
D:\WINNT\system32\WS2_32.DLL (0x74FB0000)
D:\WINNT\system32\WS2HELP.DLL (0x74FA0000)
D:\WINNT\system32\WLDAP32.DLL (0x77930000)
D:\WINNT\system32\NETRAP.dll (0x75150000)
D:\WINNT\system32\SAMLIB.dll (0x750E0000)
D:\WINNT\system32\IMM32.DLL (0x75E00000)
D:\WINNT\system32\LPK.DLL (0x6C330000)
D:\WINNT\system32\USP10.dll (0x65D20000)
D:\WINNT\system32\sockspy.dll (0x10000000)
D:\WINNT\system32\msgina.dll (0x77CA0000)
D:\WINNT\system32\SHELL32.dll (0x78F90000)
D:\WINNT\system32\SHLWAPI.dll (0x70A70000)
D:\WINNT\system32\COMCTL32.dll (0x71710000)
D:\WINNT\system32\WINSTA.dll (0x64E20000)
D:\WINNT\system32\WINMM.dll (0x77530000)
D:\WINNT\system32\setupapi.dll (0x6D990000)
D:\WINNT\system32\wdmaud.drv (0x77520000)
D:\WINNT\system32\wintrust.dll (0x768D0000)
D:\WINNT\system32\CRYPT32.dll (0x79C40000)
D:\WINNT\system32\MSASN1.DLL (0x773F0000)
D:\WINNT\system32\IMAGEHLP.dll (0x77900000)
D:\WINNT\system32\ole32.dll (0x77A30000)
D:\WINNT\system32\mscat32.dll (0x769A0000)
D:\WINNT\system32\rsaenh.dll (0x7CA00000)
D:\WINNT\system32\VERSION.dll (0x777E0000)
D:\WINNT\system32\LZ32.DLL (0x75950000)
D:\WINNT\system32\cscdll.dll (0x77080000)
D:\WINNT\system32\WlNotify.dll (0x768C0000)
D:\WINNT\system32\CERTCLI.DLL (0x75510000)
D:\WINNT\system32\ATL.DLL (0x773A0000)
D:\WINNT\system32\WINSCARD.DLL (0x76900000)
D:\WINNT\system32\WINSPOOL.DRV (0x777C0000)
D:\WINNT\system32\MPR.DLL (0x79B20000)
D:\WINNT\system32\msacm32.drv (0x773C0000)
D:\WINNT\system32\MSACM32.dll (0x773D0000)
D:\WINNT\system32\cscui.dll (0x77810000)
D:\WINNT\system32\wzcdlg.dll (0x02090000)
D:\WINNT\system32\OLEAUT32.dll (0x77990000)
D:\WINNT\system32\WZCSAPI.DLL (0x020B0000)
D:\WINNT\system32\CLBCATQ.DLL (0x72C50000)
D:\WINNT\system32\msv1_0.dll (0x782D0000)
D:\WINNT\system32\IPHLPAPI.DLL (0x77300000)
D:\WINNT\system32\ICMP.DLL (0x774E0000)
D:\WINNT\system32\MPRAPI.DLL (0x772E0000)
D:\WINNT\system32\ACTIVEDS.DLL (0x77370000)
D:\WINNT\system32\ADSLDPC.DLL (0x77340000)
D:\WINNT\system32\RTUTILS.DLL (0x777F0000)
D:\WINNT\system32\RASAPI32.DLL (0x774A0000)
D:\WINNT\system32\RASMAN.DLL (0x77480000)
D:\WINNT\system32\TAPI32.DLL (0x774F0000)
D:\WINNT\system32\DHCPCSVC.DLL (0x77320000)
=====================================================
PROCESS NAME: services.exe
-----------------------------------------------------
Process ID = 0x000000dc
Thread count= 39
Parent process ID = 168
Priority Class = 32
Modules:
------------------------------------
D:\WINNT\system32\services.exe (0x01000000)
D:\WINNT\system32\ntdll.dll (0x77F80000)
D:\WINNT\system32\RPCRT4.DLL (0x786F0000)
D:\WINNT\system32\KERNEL32.DLL (0x77E60000)
D:\WINNT\system32\ADVAPI32.DLL (0x796D0000)
D:\WINNT\system32\NETAPI32.DLL (0x75100000)
D:\WINNT\system32\MSVCRT.dll (0x78000000)
D:\WINNT\system32\Secur32.dll (0x797B0000)
D:\WINNT\system32\NTDSAPI.dll (0x77BD0000)
D:\WINNT\system32\DNSAPI.DLL (0x77960000)
D:\WINNT\system32\WSOCK32.DLL (0x74FD0000)
D:\WINNT\system32\WS2_32.DLL (0x74FB0000)
D:\WINNT\system32\WS2HELP.DLL (0x74FA0000)
D:\WINNT\system32\WLDAP32.DLL (0x77930000)
D:\WINNT\system32\NETRAP.dll (0x75150000)
D:\WINNT\system32\SAMLIB.dll (0x750E0000)
D:\WINNT\system32\USER32.DLL (0x77DF0000)
D:\WINNT\system32\GDI32.dll (0x77F40000)
D:\WINNT\system32\UMPNPMGR.DLL (0x76740000)
D:\WINNT\system32\USERENV.DLL (0x794D0000)
D:\WINNT\system32\SCESRV.DLL (0x767B0000)
D:\WINNT\system32\IMM32.DLL (0x75E00000)
D:\WINNT\system32\LPK.DLL (0x6C330000)
D:\WINNT\system32\USP10.dll (0x65D20000)
D:\WINNT\system32\sockspy.dll (0x10000000)
D:\WINNT\system32\eventlog.dll (0x76830000)
D:\WINNT\system32\dhcpcsvc.dll (0x77320000)
D:\WINNT\system32\ICMP.DLL (0x774E0000)
D:\WINNT\system32\IPHLPAPI.DLL (0x77300000)
D:\WINNT\system32\MPRAPI.DLL (0x772E0000)
D:\WINNT\system32\OLE32.DLL (0x77A30000)
D:\WINNT\system32\OLEAUT32.DLL (0x77990000)
D:\WINNT\system32\ACTIVEDS.DLL (0x77370000)
D:\WINNT\system32\ADSLDPC.DLL (0x77340000)
D:\WINNT\system32\RTUTILS.DLL (0x777F0000)
D:\WINNT\system32\SETUPAPI.DLL (0x6D990000)
D:\WINNT\system32\RASAPI32.DLL (0x774A0000)
D:\WINNT\system32\RASMAN.DLL (0x77480000)
D:\WINNT\system32\TAPI32.DLL (0x774F0000)
D:\WINNT\system32\COMCTL32.DLL (0x71710000)
D:\WINNT\system32\SHLWAPI.DLL (0x70A70000)
D:\WINNT\system32\dnsrslvr.dll (0x76840000)
D:\WINNT\system32\lmhsvc.dll (0x76820000)
D:\WINNT\system32\WINSTA.DLL (0x64E20000)
D:\WINNT\system32\dmserver.dll (0x76860000)
D:\WINNT\system32\CFGMGR32.DLL (0x77070000)
D:\WINNT\system32\Srvsvc.dll (0x76780000)
D:\WINNT\system32\WINSPOOL.DRV (0x777C0000)
D:\WINNT\system32\MPR.DLL (0x79B20000)
D:\WINNT\system32\wkssvc.dll (0x76710000)
D:\WINNT\system32\cryptdll.dll (0x76610000)
D:\WINNT\system32\cryptsvc.dll (0x76870000)
D:\WINNT\system32\psbase.dll (0x783B0000)
D:\WINNT\system32\rsaenh.dll (0x7CA00000)
D:\WINNT\system32\CRYPT32.dll (0x79C40000)
D:\WINNT\system32\MSASN1.DLL (0x773F0000)
D:\WINNT\system32\xactsrv.dll (0x75620000)
D:\WINNT\system32\browser.dll (0x79A70000)
D:\WINNT\system32\ESENT.dll (0x70070000)
D:\WINNT\system32\seclogon.dll (0x767A0000)
D:\WINNT\system32\trkwks.dll (0x76760000)
D:\WINNT\system32\msgsvc.dll (0x76810000)
D:\WINNT\system32\wmicore.dll (0x766F0000)
D:\WINNT\system32\msafd.dll (0x74F50000)
D:\WINNT\System32\wshtcpip.dll (0x74F90000)
=====================================================
PROCESS NAME: lsass.exe
-----------------------------------------------------
Process ID = 0x000000e8
Thread count= 17
Parent process ID = 168
Priority Class = 32
风格一派 - 2006-2-5 13:38:00
Modules:
------------------------------------
D:\WINNT\system32\lsass.exe (0x01000000)
D:\WINNT\system32\ntdll.dll (0x77F80000)
D:\WINNT\system32\KERNEL32.dll (0x77E60000)
D:\WINNT\system32\LSASRV.dll (0x78540000)
D:\WINNT\system32\MSVCRT.dll (0x78000000)
D:\WINNT\system32\cryptdll.dll (0x76610000)
D:\WINNT\system32\ADVAPI32.DLL (0x796D0000)
D:\WINNT\system32\RPCRT4.DLL (0x786F0000)
D:\WINNT\system32\Secur32.dll (0x797B0000)
D:\WINNT\system32\USER32.dll (0x77DF0000)
D:\WINNT\system32\GDI32.dll (0x77F40000)
D:\WINNT\system32\SAMSRV.dll (0x799D0000)
D:\WINNT\system32\DNSAPI.DLL (0x77960000)
D:\WINNT\system32\WSOCK32.DLL (0x74FD0000)
D:\WINNT\system32\WS2_32.DLL (0x74FB0000)
D:\WINNT\system32\WS2HELP.DLL (0x74FA0000)
D:\WINNT\system32\MSASN1.dll (0x773F0000)
D:\WINNT\system32\NETAPI32.dll (0x75100000)
D:\WINNT\system32\NTDSAPI.dll (0x77BD0000)
D:\WINNT\system32\WLDAP32.DLL (0x77930000)
D:\WINNT\system32\NETRAP.dll (0x75150000)
D:\WINNT\system32\SAMLIB.dll (0x750E0000)
D:\WINNT\system32\IMM32.DLL (0x75E00000)
D:\WINNT\system32\LPK.DLL (0x6C330000)
D:\WINNT\system32\USP10.dll (0x65D20000)
D:\WINNT\system32\sockspy.dll (0x10000000)
D:\WINNT\system32\msprivs.dll (0x76580000)
D:\WINNT\system32\kerberos.dll (0x78280000)
D:\WINNT\system32\msv1_0.dll (0x782D0000)
D:\WINNT\system32\CRYPT32.DLL (0x79C40000)
D:\WINNT\system32\IPHLPAPI.DLL (0x77300000)
D:\WINNT\system32\ICMP.DLL (0x774E0000)
D:\WINNT\system32\MPRAPI.DLL (0x772E0000)
D:\WINNT\system32\OLE32.DLL (0x77A30000)
D:\WINNT\system32\OLEAUT32.DLL (0x77990000)
D:\WINNT\system32\ACTIVEDS.DLL (0x77370000)
D:\WINNT\system32\ADSLDPC.DLL (0x77340000)
D:\WINNT\system32\RTUTILS.DLL (0x777F0000)
D:\WINNT\system32\SETUPAPI.DLL (0x6D990000)
D:\WINNT\system32\USERENV.DLL (0x794D0000)
D:\WINNT\system32\RASAPI32.DLL (0x774A0000)
D:\WINNT\system32\RASMAN.DLL (0x77480000)
D:\WINNT\system32\TAPI32.DLL (0x774F0000)
D:\WINNT\system32\COMCTL32.DLL (0x71710000)
D:\WINNT\system32\SHLWAPI.DLL (0x70A70000)
D:\WINNT\system32\DHCPCSVC.DLL (0x77320000)
D:\WINNT\system32\netlogon.dll (0x76520000)
D:\WINNT\system32\schannel.dll (0x78160000)
D:\WINNT\system32\rsabase.dll (0x7CA00000)
D:\WINNT\system32\mpr.dll (0x79B20000)
D:\WINNT\system32\scecli.dll (0x763D0000)
D:\WINNT\system32\polagent.dll (0x76480000)
D:\WINNT\system32\MFC42u.DLL (0x76F70000)
D:\WINNT\system32\oakley.DLL (0x79A90000)
D:\WINNT\system32\MFC42LOC.DLL (0x6BC20000)
D:\WINNT\system32\msafd.dll (0x74F50000)
D:\WINNT\System32\wshtcpip.dll (0x74F90000)
D:\WINNT\system32\rsaenh.dll (0x00CB0000)
D:\WINNT\system32\dssenh.dll (0x67400000)
=====================================================
PROCESS NAME: svchost.exe
-----------------------------------------------------
Process ID = 0x00000198
Thread count= 9
Parent process ID = 220
Priority Class = 32
Modules:
------------------------------------
D:\WINNT\system32\svchost.exe (0x01000000)
D:\WINNT\system32\ntdll.dll (0x77F80000)
D:\WINNT\system32\ADVAPI32.DLL (0x796D0000)
D:\WINNT\system32\KERNEL32.DLL (0x77E60000)
D:\WINNT\system32\RPCRT4.DLL (0x786F0000)
D:\WINNT\system32\OLE32.DLL (0x77A30000)
D:\WINNT\system32\GDI32.dll (0x77F40000)
D:\WINNT\system32\USER32.dll (0x77DF0000)
D:\WINNT\system32\IMM32.DLL (0x75E00000)
D:\WINNT\system32\LPK.DLL (0x6C330000)
D:\WINNT\system32\USP10.dll (0x65D20000)
D:\WINNT\system32\sockspy.dll (0x10000000)
d:\winnt\system32\rpcss.dll (0x7CA90000)
D:\WINNT\system32\MSVCRT.dll (0x78000000)
d:\winnt\system32\USERENV.dll (0x794D0000)
d:\winnt\system32\WS2_32.dll (0x74FB0000)
d:\winnt\system32\WS2HELP.DLL (0x74FA0000)
d:\winnt\system32\Secur32.dll (0x797B0000)
d:\winnt\system32\WINSTA.dll (0x64E20000)
D:\WINNT\system32\rsaenh.dll (0x7CA00000)
D:\WINNT\system32\CRYPT32.dll (0x79C40000)
D:\WINNT\system32\MSASN1.DLL (0x773F0000)
D:\WINNT\system32\mswsock.dll (0x74F70000)
D:\WINNT\system32\DNSAPI.DLL (0x77960000)
D:\WINNT\system32\WSOCK32.DLL (0x74FD0000)
D:\WINNT\system32\msafd.dll (0x74F50000)
D:\WINNT\System32\wshtcpip.dll (0x74F90000)
D:\WINNT\System32\rnr20.dll (0x77800000)
D:\WINNT\system32\iphlpapi.dll (0x77300000)
D:\WINNT\system32\ICMP.DLL (0x774E0000)
D:\WINNT\system32\MPRAPI.DLL (0x772E0000)
D:\WINNT\system32\SAMLIB.DLL (0x750E0000)
D:\WINNT\system32\NETAPI32.DLL (0x75100000)
D:\WINNT\system32\NTDSAPI.dll (0x77BD0000)
D:\WINNT\system32\WLDAP32.DLL (0x77930000)
D:\WINNT\system32\NETRAP.dll (0x75150000)
D:\WINNT\system32\OLEAUT32.DLL (0x77990000)
D:\WINNT\system32\ACTIVEDS.DLL (0x77370000)
D:\WINNT\system32\ADSLDPC.DLL (0x77340000)
D:\WINNT\system32\RTUTILS.DLL (0x777F0000)
D:\WINNT\system32\SETUPAPI.DLL (0x6D990000)
D:\WINNT\system32\RASAPI32.DLL (0x774A0000)
D:\WINNT\system32\RASMAN.DLL (0x77480000)
D:\WINNT\system32\TAPI32.DLL (0x774F0000)
D:\WINNT\system32\COMCTL32.DLL (0x71710000)
D:\WINNT\system32\SHLWAPI.DLL (0x70A70000)
D:\WINNT\system32\DHCPCSVC.DLL (0x77320000)
D:\WINNT\System32\winrnr.dll (0x777A0000)
D:\WINNT\system32\rasadhlp.dll (0x777B0000)
D:\WINNT\System32\wshisn.dll (0x75420000)
D:\WINNT\System32\wshnetbs.dll (0x75440000)
D:\WINNT\system32\CLBCATQ.DLL (0x72C50000)
D:\WINNT\system32\msv1_0.dll (0x782D0000)
D:\WINNT\system32\msi.dll (0x745E0000)
=====================================================
PROCESS NAME: CCenter.exe
-----------------------------------------------------
Process ID = 0x000001b0
Thread count= 3
Parent process ID = 220
Priority Class = 32
Modules:
------------------------------------
D:\Program Files\Rising\Rav\CCenter.exe (0x00400000)
D:\WINNT\system32\ntdll.dll (0x77F80000)
D:\WINNT\system32\KERNEL32.dll (0x77E60000)
D:\WINNT\system32\USER32.dll (0x77DF0000)
D:\WINNT\system32\GDI32.dll (0x77F40000)
D:\WINNT\system32\ADVAPI32.dll (0x796D0000)
D:\WINNT\system32\RPCRT4.DLL (0x786F0000)
D:\WINNT\system32\IMM32.DLL (0x75E00000)
D:\WINNT\system32\LPK.DLL (0x6C330000)
D:\WINNT\system32\USP10.dll (0x65D20000)
D:\WINNT\system32\sockspy.dll (0x10000000)
=====================================================
PROCESS NAME: Ravmond.exe
-----------------------------------------------------
Process ID = 0x000001c0
Thread count= 26
Parent process ID = 220
Priority Class = 32
Modules:
------------------------------------
D:\Program Files\Rising\Rav\Ravmond.exe (0x00400000)
D:\WINNT\system32\ntdll.dll (0x77F80000)
D:\Program Files\Rising\Rav\BWList.dll (0x10000000)
D:\WINNT\system32\MFC42.DLL (0x6BC40000)
D:\WINNT\system32\MSVCRT.dll (0x78000000)
D:\WINNT\system32\KERNEL32.dll (0x77E60000)
D:\WINNT\system32\GDI32.dll (0x77F40000)
D:\WINNT\system32\USER32.dll (0x77DF0000)
D:\WINNT\system32\ADVAPI32.dll (0x796D0000)
D:\WINNT\system32\RPCRT4.DLL (0x786F0000)
D:\WINNT\system32\SHELL32.dll (0x78F90000)
D:\WINNT\system32\SHLWAPI.dll (0x70A70000)
D:\WINNT\system32\COMCTL32.dll (0x71710000)
D:\WINNT\system32\MSVCP60.dll (0x780C0000)
D:\WINNT\system32\WSOCK32.dll (0x74FD0000)
D:\WINNT\system32\WS2_32.DLL (0x74FB0000)
D:\WINNT\system32\WS2HELP.DLL (0x74FA0000)
D:\WINNT\system32\OLEAUT32.dll (0x77990000)
D:\WINNT\system32\ole32.dll (0x77A30000)
D:\WINNT\system32\VERSION.dll (0x777E0000)
D:\WINNT\system32\LZ32.DLL (0x75950000)
D:\WINNT\system32\IMM32.DLL (0x75E00000)
D:\WINNT\system32\LPK.DLL (0x6C330000)
D:\WINNT\system32\USP10.dll (0x65D20000)
D:\WINNT\system32\sockspy.dll (0x00620000)
D:\WINNT\system32\MFC42LOC.DLL (0x6BC20000)
D:\Program Files\Rising\Rav\RsCommX.dll (0x00B90000)
D:\Program Files\Rising\Rav\RSAPPMGR.DLL (0x00FC0000)
D:\Program Files\Rising\Rav\CfgDll.dll (0x090E0000)
D:\Program Files\Rising\Rav\RSCOMMON.DLL (0x23700000)
D:\Program Files\Rising\Rav\RsLog.dll (0x09370000)
D:\Program Files\Rising\Rav\HOOKSYS.dll (0x09380000)
D:\Program Files\Rising\Rav\Scanner.dll (0x094B0000)
D:\Program Files\Rising\Rav\libload.dll (0x13100000)
D:\Program Files\Rising\Rav\VirusLib.dll (0x09610000)
D:\Program Files\Rising\Rav\regmon.dll (0x09750000)
D:\Program Files\Rising\Rav\psapi.dll (0x731B0000)
D:\WINNT\system32\IMAGEHLP.dll (0x77900000)
D:\Program Files\Rising\Rav\HookWeb.dll (0x099E0000)
D:\Program Files\Rising\Rav\MemMon.dll (0x09A00000)
D:\Program Files\Rising\Rav\expscan.dll (0x09A30000)
D:\Program Files\Rising\Rav\mPorts.dll (0x09A50000)
D:\WINNT\system32\iphlpapi.dll (0x77300000)
D:\WINNT\system32\ICMP.DLL (0x774E0000)
D:\WINNT\system32\MPRAPI.DLL (0x772E0000)
D:\WINNT\system32\SAMLIB.DLL (0x750E0000)
D:\WINNT\system32\NETAPI32.DLL (0x75100000)
D:\WINNT\system32\Secur32.dll (0x797B0000)
D:\WINNT\system32\NTDSAPI.dll (0x77BD0000)
D:\WINNT\system32\DNSAPI.DLL (0x77960000)
D:\WINNT\system32\WLDAP32.DLL (0x77930000)
D:\WINNT\system32\NETRAP.dll (0x75150000)
D:\WINNT\system32\ACTIVEDS.DLL (0x77370000)
D:\WINNT\system32\ADSLDPC.DLL (0x77340000)
D:\WINNT\system32\RTUTILS.DLL (0x777F0000)
D:\WINNT\system32\SETUPAPI.DLL (0x6D990000)
D:\WINNT\system32\USERENV.DLL (0x794D0000)
D:\WINNT\system32\RASAPI32.DLL (0x774A0000)
D:\WINNT\system32\RASMAN.DLL (0x77480000)
D:\WINNT\system32\TAPI32.DLL (0x774F0000)
D:\WINNT\system32\DHCPCSVC.DLL (0x77320000)
D:\Program Files\Rising\Rav\MailMon.dll (0x09F60000)
D:\Program Files\Rising\Rav\SpamEng.dll (0x09F90000)
D:\Program Files\Rising\Rav\engine.dll (0x13A80000)
D:\WINNT\system32\msafd.dll (0x74F50000)
D:\WINNT\System32\wshtcpip.dll (0x74F90000)
D:\Program Files\Rising\Rav\PostTrt.dll (0x0AA60000)
D:\Program Files\Rising\Rav\UnExe.dll (0x0AAA0000)
D:\Program Files\Rising\Rav\ScanExec.dll (0x13AB0000)
D:\Program Files\Rising\Rav\ScanEx.dll (0x0B310000)
D:\Program Files\Rising\Rav\NvFile.dll (0x0B620000)
D:\Program Files\Rising\Rav\ScanMac.dll (0x13AF0000)
D:\Program Files\Rising\Rav\ScanSct.dll (0x0B940000)
D:\WINNT\system32\CLBCATQ.DLL (0x72C50000)
D:\Program Files\Rising\Rav\Unpacker.dll (0x0FA50000)
D:\WINNT\system32\perfproc.dll (0x68A50000)
D:\Program Files\Rising\Rav\ExtOLE.dll (0x0C480000)
D:\Program Files\Rising\Rav\ScanNet.dll (0x11410000)
=====================================================
PROCESS NAME: spoolsv.exe
-----------------------------------------------------
Process ID = 0x000001ec
Thread count= 12
Parent process ID = 220
Priority Class = 32
不言放弃 - 2006-2-5 13:46:00
【回复“风格一派”的帖子】
只导出文件关连部分
晕倒
刚才忘了说了
风格一派 - 2006-2-5 13:53:00
Boot items in Registry
*****************************************************************
------------------------------------------------------------
0：HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
------------------------------------------------------------
eMuleAutoStart……E:\Program Files\eMule\eMule.exe -AutoStart
------------------------------------------------------------
1：HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
------------------------------------------------------------
------------------------------------------------------------
2：HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
------------------------------------------------------------
------------------------------------------------------------
3：HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices
------------------------------------------------------------
------------------------------------------------------------
4：HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
------------------------------------------------------------
------------------------------------------------------------
5：HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows 键值名称:load
------------------------------------------------------------
load……
------------------------------------------------------------
6：HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows 键值名称:run
------------------------------------------------------------
run……
------------------------------------------------------------
7：HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System 键值名称:Shell
------------------------------------------------------------
------------------------------------------------------------
8：HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
------------------------------------------------------------
------------------------------------------------------------
9：HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
------------------------------------------------------------
Synchronization Manager……mobsync.exe /logon
LANServer……rem D:\PROGRA~1\LANSER~1\CSERVER.EXE
DSLAGENTEXE……rem dslagent.exe
TkBellExe……"D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
WeatherOnTray……D:\Program Files\HbTools\Bin\4.7.0.0\HbtWeatherOnTray.exe
HbTools……D:\Program Files\HbTools\Bin\4.7.0.0\HbtOEAddOn.exe
SoundMan……SOUNDMAN.EXE
RavTask……"D:\Program Files\Rising\Rav\RavTask.exe" -system
------------------------------------------------------------
10：HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
------------------------------------------------------------
------------------------------------------------------------
11：HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
------------------------------------------------------------
------------------------------------------------------------
12：HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunService
------------------------------------------------------------
------------------------------------------------------------
13：HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServiceOnce
------------------------------------------------------------
------------------------------------------------------------
14：HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
------------------------------------------------------------
------------------------------------------------------------
15：HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon 键值名称:Shell
------------------------------------------------------------
Shell……explorer.exe
------------------------------------------------------------
16：HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon 键值名称:Userinit
------------------------------------------------------------
Userinit……D:\WINNT\system32\userinit.exe,
------------------------------------------------------------
17：HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows 键值名称:AppInit_DLLs
------------------------------------------------------------
AppInit_DLLs……sockspy.dll
*****************************************************************
File association information
*****************************************************************
------------------------------------------------------------
0：HKEY_CLASSES_ROOT\.exe
------------------------------------------------------------
<DEFAULT> = exefile, 正常！
------------------------------------------------------------
1：HKEY_CLASSES_ROOT\exefile\shell\open\command
------------------------------------------------------------
<DEFAULT> = "%1" %*, 正常！
------------------------------------------------------------
2：HKEY_CLASSES_ROOT\exefile\shell\runas\command
------------------------------------------------------------
<DEFAULT> = "%1" %*, 正常！
------------------------------------------------------------
3：HKEY_CLASSES_ROOT\.txt
------------------------------------------------------------
<DEFAULT> = txtfile, 正常！
------------------------------------------------------------
4：HKEY_CLASSES_ROOT\txtfile\shell\open\command
------------------------------------------------------------
<DEFAULT> = notepad.exe %1, 不正常！正常值：%SystemRoot%\system32\NOTEPAD.EXE %1。请使用RegFix修复关联！软件可以到 http://www.KZTechs.com 下载。
------------------------------------------------------------
5：HKEY_CLASSES_ROOT\.reg
------------------------------------------------------------
<DEFAULT> = regfile, 正常！
------------------------------------------------------------
6：HKEY_CLASSES_ROOT\regfile\shell\open\command
------------------------------------------------------------
<DEFAULT> = regedit.exe "%1", 正常！
------------------------------------------------------------
7：HKEY_CLASSES_ROOT\.bat
------------------------------------------------------------
<DEFAULT> = batfile, 正常！
------------------------------------------------------------
8：HKEY_CLASSES_ROOT\batfile\shell\open\command
------------------------------------------------------------
<DEFAULT> = "%1" %*, 正常！
------------------------------------------------------------
9：HKEY_CLASSES_ROOT\.com
------------------------------------------------------------
<DEFAULT> = comfile, 正常！
------------------------------------------------------------
10：HKEY_CLASSES_ROOT\comfile\shell\open\command
------------------------------------------------------------
<DEFAULT> = "%1" %*, 正常！
------------------------------------------------------------
11：HKEY_CLASSES_ROOT\.scr
------------------------------------------------------------
<DEFAULT> = scrfile, 正常！
------------------------------------------------------------
12：HKEY_CLASSES_ROOT\scrfile\shell\open\command
------------------------------------------------------------
<DEFAULT> = "%1" /s, 不正常！正常值："%1" /S。请使用RegFix修复关联！软件可以到 http://www.KZTechs.com 下载。
------------------------------------------------------------
13：HKEY_CLASSES_ROOT\.pif
------------------------------------------------------------
<DEFAULT> = piffile, 正常！
------------------------------------------------------------
14：HKEY_CLASSES_ROOT\piffile\shell\open\command
------------------------------------------------------------
<DEFAULT> = "%1" %*, 正常！
© 2000 - 2026 Rising Corp. Ltd.