版主救命：偶发现一个生命力强盛的病毒，杀不掉~~~~ bbs.ikaka.com

devil2006 - 2007-4-6 8:54:00

救命啊，偶用瑞星2007，病毒库升到4月2日的啊，怎么还是杀不死这家伙，每次重启还会再跑出来的？？？？
SOS~~~

Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-02-10 16:56 手动扫描 C:\WINNT\system32\drivers ypaqi.sys 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-02-10 16:57 手动扫描 C:\WINNT\system32 wxxsu.dll 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-02-13 12:11 定时扫描 C:\WINNT\system32\drivers ypaqi.sys 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-02-13 12:12 定时扫描 C:\WINNT\system32 wxxsu.dll 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-02-26 15:57 屏保扫描 C:\WINNT\system32\drivers ypaqi.sys 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-02-26 15:59 屏保扫描 C:\WINNT\system32 wxxsu.dll 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-02-28 09:41 屏保扫描 C:\WINNT\system32\drivers ypaqi.sys 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-02-28 09:42 屏保扫描 C:\WINNT\system32 wxxsu.dll 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-02-28 11:23 屏保扫描 C:\WINNT\system32\drivers ypaqi.sys 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-02-28 11:24 屏保扫描 C:\WINNT\system32 wxxsu.dll 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-02-28 13:59 屏保扫描 C:\WINNT\system32\drivers ypaqi.sys 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-02-28 14:00 屏保扫描 C:\WINNT\system32 wxxsu.dll 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-03-01 15:24 屏保扫描 C:\WINNT\system32\drivers ypaqi.sys 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-03-01 15:25 屏保扫描 C:\WINNT\system32 wxxsu.dll 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-03-02 10:43 屏保扫描 C:\WINNT\system32\drivers ypaqi.sys 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-03-02 10:44 屏保扫描 C:\WINNT\system32 wxxsu.dll 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-03-02 14:25 屏保扫描 C:\WINNT\system32\drivers ypaqi.sys 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-03-02 14:26 屏保扫描 C:\WINNT\system32 wxxsu.dll 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-03-03 10:58 屏保扫描 C:\WINNT\system32\drivers ypaqi.sys 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-03-03 10:59 屏保扫描 C:\WINNT\system32 wxxsu.dll 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-03-05 10:55 屏保扫描 C:\WINNT\system32\drivers ypaqi.sys 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-03-05 10:57 屏保扫描 C:\WINNT\system32 wxxsu.dll 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-03-05 11:26 屏保扫描 C:\WINNT\system32\drivers ypaqi.sys 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-03-05 11:27 屏保扫描 C:\WINNT\system32 wxxsu.dll 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-03-05 12:03 定时扫描 C:\WINNT\system32\drivers ypaqi.sys 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-03-05 12:04 定时扫描 C:\WINNT\system32 wxxsu.dll 本机
Worm.Pabug.co 删除成功 2007-03-05 14:10 快捷扫描 I: OSO.exe 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-03-06 10:29 屏保扫描 C:\WINNT\system32\drivers ypaqi.sys 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-03-06 10:31 屏保扫描 C:\WINNT\system32 wxxsu.dll 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-03-06 12:04 定时扫描 C:\WINNT\system32\drivers ypaqi.sys 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-03-06 12:04 定时扫描 C:\WINNT\system32 wxxsu.dll 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-03-09 17:01 手动扫描 C:\WINNT\system32\drivers ypaqi.sys 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-03-09 17:02 手动扫描 C:\WINNT\system32 wxxsu.dll 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-03-12 10:32 屏保扫描 C:\WINNT\system32\drivers ypaqi.sys 本机
Trojan.Spy.Popc.a 重新启动计算机后删除文件 2007-03-12 10:34 屏保扫描 C:\WINNT\system32 wxxsu.dll 本机

devil2006 - 2007-4-6 8:58:00

今天扫描又发现ypaqi.sys、wxxsu.dll这两个东西，应该怎么杀啊？

baohe - 2007-4-6 9:50:00

引用:

【devil2006的贴子】今天扫描又发现ypaqi.sys、wxxsu.dll这两个东西，应该怎么杀啊？
………………

用SRENG扫日志贴上来看看吧

devil2006 - 2007-4-26 9:35:00

HijackThis_815汉化版扫描日志 V1.99.1
保存于 9:23:07, 日期 2007-4-26
操作系统： Windows 2000 SP4 (WinNT 5.00.2195)
浏览器： Internet Explorer v5.00 SP4 (5.00.2920.0000)

当前运行的进程：
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
F:\Program Files\Rising\Rav\CCenter.exe
F:\Program Files\Rising\Rav\Ravmond.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\llssrv.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
F:\Program Files\Rising\Rav\RavStub.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\System32\tcpsvcs.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\Program Files\Intel\PXE\PDK\System\PxeService.exe
C:\WINNT\System32\msdtc.exe
C:\WINNT\Explorer.EXE
C:\Program files\Sunland\Easy Class\Manager\Manager.exe
F:\Program Files\Rising\Rav\RavTask.exe
F:\Program Files\Rising\Rav\Ravmon.exe
C:\WINNT\vsnpstd3.exe
F:\Program Files\Rising\AntiSpyware\runiep.exe
C:\WINNT\system32\internat.exe
C:\WINNT\system32\wuauclt.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Intel\PXE\PDK\system\PXEMTFTP.exe
C:\WINNT\system32\stisvc.exe
F:\Program Files\shiqiang\wnwb\wnwb.exe
F:\Program Files\Tencent\TT\TTraveler.exe
E:\cbak\CCProxy\CCProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINNT\system32\taskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.594\HijackThis1991zww.exe

O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file)
O3 - IE工具栏增项: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - F:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - IE工具栏增项: 金山快译(&K) - {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} - C:\PROGRA~1\Kingsoft\FastAIT\IEBand.dll
O3 - IE工具栏增项: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - 启动项HKLM\\Run: [ECManager] C:\Program files\Sunland\Easy Class\Manager\Manager.exe
O4 - 启动项HKLM\\Run: [nwiz] nwiz.exe /install
O4 - 启动项HKLM\\Run: [RavTask] "F:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [snpstd3] C:\WINNT\vsnpstd3.exe
O4 - 启动项HKLM\\Run: [runeip] F:\Program Files\Rising\AntiSpyware\runiep.exe
O4 - 启动项HKLM\\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - F:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载 - F:\Program Files\FlashGet\jc_link.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链接 - F:\Program Files\FlashGet\jc_all.htm
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - F:\Program Files\Tencent\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - F:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - F:\Program Files\Tencent\QQ\SendMMS.htm
O9 - 浏览器额外的按钮: 金山词霸 - {C8CE29C5-7589-11D3-B81B-0080C8DC5DC8} - C:\PROGRA~1\Kingsoft\XDict\IEPlugin.dll
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - F:\Program Files\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - F:\Program Files\Tencent\QQ\QQ.EXE
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O15 - “受信任的站点”中添加项: http://ucould.stedu.net
O15 - “受信任的站点”中添加项: http://zkgl.stedu.net
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1156057321718
O16 - DPF: {8686F2A6-DC01-4E8F-BDE3-DCC7DBBAD6AE} (163Uploader Control) - http://photo.163.com/163Uploader.cab
O16 - DPF: {C09B522F-8AED-4E21-A65C-DC1AB652BAEE} (Tencent Safety Online Base Module) - http://safe.qq.com/cgi-bin/tso/TSOBase.ocx
O16 - DPF: {E787FD25-8D7C-4693-AE67-9406BC6E22DF} (CPasswordEditCtrl Object) - https://password.qq.com/download/qqedit.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{04189297-2280-487C-B03E-4A81AFFDED83}: NameServer = 202.96.144.47 10.255.255.252
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF872572-D3D8-4539-A4C2-A4D6B8331A0F}: NameServer = 192.168.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{04189297-2280-487C-B03E-4A81AFFDED83}: NameServer = 202.96.144.47 10.255.255.252
O23 - NT 服务: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - NT 服务: Intel PXE MTFTP Service - Intel Corporation - C:\Program Files\Intel\PXE\PDK\system\PXEMTFTP.exe
O23 - NT 服务: Intel PXE Services - Intel Corporation - C:\Program Files\Intel\PXE\PDK\System\PxeService.exe
O23 - NT 服务: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - NT 服务: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - F:\Program Files\Rising\Rav\CCenter.exe
O23 - NT 服务: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - F:\Program Files\Rising\Rav\Ravmond.exe
O23 - NT 服务: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - NT 服务: ClipManage (WalALET) - Unknown owner - C:\WINNT\SYSTEM32\RUNDLLFROMWIN2000.EXE (file missing)

baohe - 2007-4-26 9:56:00

【回复“devil2006”的帖子】
请贴SRENG扫的日志。
对于这种既有驱动又有进程插入的病毒，HijackThis的日志意义不大。

星10000 - 2007-4-26 9:58:00

试下
http://www.skycn.com/soft/32883.html

devil2006 - 2007-4-26 18:06:00

偶下了个SRENG2，打开提示要输入注册码？
怎么回事？

汗血宝马 - 2007-4-26 18:09:00

会吗？哪下的？
请下载SREng2 ，使用“智能扫描”，按下“扫描”按钮进行扫描，
扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），
把保存的报告日志文件内容复制-粘贴上来,,日志一次粘不完，分次粘完，
下载地址
http://www.kztechs.com/sreng/sreng2.zip
(扫描之前关掉所有的程序，包括QQ再）

devil2006 - 2007-4-27 8:06:00

[CODE]

2007-04-27,07:50:50

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Server Service Pack 4 (Build 2195) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<Internat.exe><internat.exe> [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<1><C:\WINNT\system32\mxgg.exe> [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
<run><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<ECManager><C:\Program files\Sunland\Easy Class\Manager\Manager.exe> []
<nwiz><nwiz.exe /install> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<RavTask><"F:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<snpstd3><C:\WINNT\vsnpstd3.exe> []
<runeip><F:\Program Files\Rising\AntiSpyware\runiep.exe> [Beijing Rising Technology Co., Ltd.]
<NeroFilterCheck><C:\WINNT\system32\NeroCheck.exe> [Ahead Software Gmbh]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows 2000 Publisher]
<Userinit><C:\WINNT\system32\userinit.exe,> [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]

==================================
启动文件夹
N/A

==================================
服务
[Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start]
<C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[Intel PXE MTFTP Service / Intel PXE MTFTP Service][Running/Auto Start]
<"C:\Program Files\Intel\PXE\PDK\system\PXEMTFTP.exe"><Intel Corporation>
[Intel PXE Services / Intel PXE Services][Running/Auto Start]
<"C:\Program Files\Intel\PXE\PDK\System\PxeService.exe"><Intel Corporation>
[Macromedia Licensing Service / Macromedia Licensing Service][Stopped/Manual Start]
<"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><>
[NVIDIA Driver Helper Service / NVSvc][Running/Auto Start]
<C:\WINNT\system32\nvsvc32.exe><NVIDIA Corporation>
[Application Accelerator / Popular][Others/Auto Start]
<C:\WINNT\System32\svchost.exe -k netsvcs-->C:\WINNT\system32\mvcmjz25.dll><N/A>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
<"F:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
<"F:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[SoundMAX Agent Service / SoundMAX Agent Service (default)][Running/Auto Start]
<C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.>
[ClipManage / WalALET][Stopped/Auto Start]
<C:\WINNT\SYSTEM32\RUNDLLFROMWIN2000.EXE C:\WINNT\SYSTEM32\WBEM\GTWOHM50.DLL,Export 1087><N/A>
[Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start]
<C:\WINNT\System32\svchost.exe -k netsvcs-->C:\WINNT\system32\mspmsnsv.dll><Microsoft Corporation>

==================================
驱动程序
[aeaudio / aeaudio][Running/Manual Start]
<system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
[aslm75 / aslm75][Running/Auto Start]
<\??\C:\WINNT\system32\drivers\aslm75.sys><N/A>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[Ctrl2cap / Ctrl2cap][Stopped/Manual Start]
<\??\C:\WINNT\system32\drivers\Ctrl2cap.sys><N/A>
[dmboot / dmboot][Stopped/Disabled]
<System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio][Running/Boot Start]
<\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload][Running/Boot Start]
<\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[ExpScaner / ExpScaner][Running/Auto Start]
<\??\F:\Program Files\Rising\Rav\ExpScan.sys><>
[D-Link DFE-530TX PCI Fast Ethernet Adapter Driver Service / FETNDISB][Running/Manual Start]
<system32\DRIVERS\dlkfet5b.sys><D-Link>
[FKLanse / FKLanse][Stopped/Manual Start]
<\??\C:\WINNT\system32\np~tmp2.tmp><N/A>
[HookCont / HookCont][Running/Auto Start]
<\??\F:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
<\??\F:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
<\??\F:\Program Files\Rising\Rav\HookSys.sys><Rising>
[LvkeKill16 / LvkeKill16][Stopped/Manual Start]
<\??\F:\Program Files\冒险岛Online\lvke.sys><N/A>
[MEMSCAN / MEMSCAN][Running/Auto Start]
<\??\F:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[MidiSyn / MidiSyn][Stopped/Manual Start]
<system32\drivers\MidiSyn.sys><Analog Devices Inc>
[MSBios / MSBios][Running/Boot Start]
<\SystemRoot\System32\Drivers\MSBios.sys><>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\F:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[nv / nv][Running/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[nv4 / nv4][Stopped/Manual Start]
<System32\DRIVERS\nv4.sys><NVIDIA Corporation>
[oreans32 / oreans32][Running/System Start]
<\??\C:\WINNT\system32\drivers\oreans32.sys><N/A>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[WAN Miniport (PPP over Ethernet Protocol) / RMSPPPOE][Running/Manual Start]
<system32\DRIVERS\RMSPPPOE.SYS><Robert Schlabbach>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
<\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
<\??\F:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[smwdm / smwdm][Running/Manual Start]
<system32\drivers\smwdm.sys><Analog Devices, Inc.>
[USB PC Camera (SNPSTD3) / SNPSTD3][Running/Manual Start]
<system32\DRIVERS\snpstd3.sys><>
[Sony Memory Stick Driver(SONYPVM1) / SONYPVM1][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\SONYPVM1.SYS><Sony Corporation>
[Sony USB Filter Driver (SONYPVU1) / SONYPVU1][Stopped/Manual Start]
<system32\DRIVERS\SONYPVU1.SYS><Sony Corporation>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
<system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[ypaq / ypaqi][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\ypaqi.sys><N/A>
[NDIS5 Miniport Driver for Marvell Yukon Gigabit Ethernet Adapter / yukonw2k][Running/Manual Start]
<System32\DRIVERS\yukonw2k.sys><Marvell Semiconductor Inc.>
[zenx1 / zenx1][Stopped/Manual Start]
<\??\C:\Documents and Settings\Administrator\桌面\fcz1119\fcz\zenx.sys><N/A>

devil2006 - 2007-4-27 8:06:00

==================================
浏览器加载项
[JoyoCtrl Class]
{C8CE29C5-7589-11D3-B81B-0080C8DC5DC8} <C:\PROGRA~1\Kingsoft\XDict\IEPlugin.dll, >
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <F:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <F:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[金山快译(&K)]
{6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} <C:\PROGRA~1\Kingsoft\FastAIT\IEBand.dll, >
[@msdxmLC.dll,-1@2052,电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINNT\system32\wuweb.dll, Microsoft Corporation>
[163Uploader Control]
{8686F2A6-DC01-4E8F-BDE3-DCC7DBBAD6AE} <C:\WINNT\system32\163UPL~1.OCX, 广州网易互动娱乐有限公司>
[Tencent Safety Online Base Module]
{C09B522F-8AED-4E21-A65C-DC1AB652BAEE} <C:\WINNT\DOWNLO~1\TSOBase.ocx, Tencent Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[CPasswordEditCtrl Object]
{E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINNT\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
[上传到QQ网络硬盘]
<F:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用网际快车下载]
<F:\Program Files\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<F:\Program Files\FlashGet\jc_all.htm, N/A>
[添加到QQ自定义面板]
<F:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<F:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<F:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 192][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.00.2195.6601]
[PID: 224][\??\C:\WINNT\system32\csrss.exe] [Microsoft Corporation, 5.00.2195.6601]
[PID: 244][\??\C:\WINNT\system32\winlogon.exe] [Microsoft Corporation, 5.00.2195.6997]
[PID: 272][C:\WINNT\system32\services.exe] [Microsoft Corporation, 5.00.2195.7035]
[C:\WINNT\system32\dmserver.dll] [VERITAS Software Corp., 2195.6605.297.3]
[PID: 1528][C:\WINNT\Explorer.EXE] [Microsoft Corporation, 5.00.3700.6690]
[F:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
[PID: 1888][C:\Program files\Sunland\Easy Class\Manager\Manager.exe] [, 1, 0, 0, 1]
[F:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 1820][C:\WINNT\vsnpstd3.exe] [, 1, 0, 2, 2]
[F:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 1772][F:\Program Files\Rising\AntiSpyware\runiep.exe] [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6]
[F:\Program Files\Rising\AntiSpyware\iep_ctrl.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]
[F:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 1584][C:\WINNT\system32\internat.exe] [Microsoft Corporation, 5.00.2920.0000]
[F:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 1008][C:\WINNT\system32\wuauclt.exe] [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[C:\WINNT\system32\wups.dll] [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[C:\WINNT\system32\wups2.dll] [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[C:\WINNT\system32\wucltui.dll] [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[PID: 1548][F:\Program Files\Tencent\TT\TTraveler.exe] [腾讯公司, 3, 3, 200, 290]
[C:\WINNT\system32\MSVCP60.dll] [Microsoft Corporation, 6.00.8972.0]
[F:\Program Files\Tencent\TT\Plugins\QQFloatBar\QQFloatBar4TT2.dll] [腾讯公司, 1, 1, 0, 5]
[F:\Program Files\Tencent\TT\Plugins\TWeather\TWeather.dll] [, 1, 0, 0, 3]
[F:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[F:\Program Files\Tencent\TT\TTNetFavor.dll] [N/A, ]
[C:\WINNT\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[F:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[PID: 2168][C:\Program Files\WinRAR\WinRAR.exe] [N/A, ]
[F:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 2192][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.750\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
[F:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINNT\hh.exe" %1]
.HLP Error. [winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
N/A

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================

[/CODE]

瑞星卡卡安全论坛