瑞星卡卡安全论坛

首页 » 技术交流区 » 反病毒/反流氓软件论坛 » 急救:中毒了,杀毒软件全退出.
只限捞仁客 - 2007-5-3 12:50:00
正版瑞星杀毒及防火墙退出.
浏览器遇杀毒软件字体就全部退出.比如输入瑞星,木马杀客,病毒等,浏览器自动退出.
什么毒啊,找都没法找,
换个电脑上来求助.
只限捞仁客 - 2007-5-3 12:55:00
瑞星杀毒和防火墙都无法进入.
飞尔斯06 - 2007-5-3 12:59:00
安全模式下查查，或者正常启动后结束有问题的进程马上杀。
只限捞仁客 - 2007-5-3 13:00:00
还有一点,安全模式进不去,
机子运行速度不受影响,反而比原来快了.
不是怕其他病毒中招还真不在乎.
只限捞仁客 - 2007-5-3 13:09:00
这个病毒真他娘的历害,凡有名的杀毒软件一是网上登不了,二是用不了.连优化大师的流氓软件清理也进不去,跟瑞星用不了一个样.
等两天,不行只好重格了.
迈克·杨 - 2007-5-3 13:43:00
兄弟啊,偶中的病毒和你中的差不多.中了之后,什么著名的杀毒软件都他娘的打不开,好弹出垃圾网业.对了,你那IE主也是不被改成了3w.7255.com 列，这网业和 hao123的一个样.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~//你是怎么中的??
只限捞仁客 - 2007-5-3 20:55:00
怎么中的我也不知道.
呼救……
光的影子 - 2007-5-3 21:18:00
兄弟，我也是中这个东东！大家一起来呼救吧，希望能引起大师们的关注！我可不想格了重装，因为我没有做GHO备份！！
桃子CiCi - 2007-5-3 21:27:00
使用SREng扫描工具点这里下载http://www.kztechs.com/sreng/download.html
1 解压缩sreng2.zip
2 运行SREng2.exe
3 按智能扫描，然后勾选检查进程模块的签名，然后再按扫描，最后保存结果
4 把结果SREngLOG.log里面的内容一字不漏的发上来

运行该软件后可以先修复安全模式....
qak27 - 2007-5-3 21:50:00
情况大致相同,还有就是无法显示隐藏文件,工具/文件夹选项按纽失效,用regedit修改showall的cheakvalue键值无效.运行services进行手动启用,一到瑞星的文件马上自动退出.
此病毒厉害,用今天升级的瑞星(另一台机器)查昨晚中毒的硬盘,结果两台都中标了
只限捞仁客 - 2007-5-3 21:58:00
SREng2.exe也不能用。这个表子养的把相关有名杀毒软件全封了。
好象还有个症状，ADSL好象被劫持，我开一个新的联结才能用。
进网页搜杀毒软件会短暂出现，一秒后退出浏览器。
瑞星的杀毒中心和防火墙已从右下角托盘退出，开机后未启，查开机无此项。我的MSCONFIG能用。


有没有兄弟介绍个不起眼的杀毒软件，先干掉他娘的。
qak27 - 2007-5-3 21:59:00
是前天玩QQ游戏时中的什么online的毒,产生nospri.dll和pdkpri.dll两个钩子,在查找清除它们的方法的时候,在另一个网站中的.今天在中毒盘中(在另一台电脑)竟然还看见隐藏格式的rising和rfw文件,标记了番茄花园的信息
桃子CiCi - 2007-5-3 22:02:00
显示所有文件功能最有效的方法是：
新建一个文本文件（就是*.txt文件），打开，把下面的代码拷进去：

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN]
"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
"Text"="@shell32.dll,-30501"
"Type"="radio"
"CheckedValue"=dword:00000002
"ValueName"="Hidden"
"DefaultValue"=dword:00000002
"HKeyRoot"=dword:80000001
"HelpID"="shell.hlp#51104"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
"Text"="@shell32.dll,-30500"
"Type"="radio"
"CheckedValue"=dword:00000001
"ValueName"="Hidden"
"DefaultValue"=dword:00000002
"HKeyRoot"=dword:80000001
"HelpID"="shell.hlp#51105"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden]
"Type"="checkbox"
"Text"="@shell32.dll,-30508"
"WarningIfNotDefault"="@shell32.dll,-28964"
"HKeyRoot"=dword:80000001
"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
"ValueName"="ShowSuperHidden"
"CheckedValue"=dword:00000000
"UncheckedValue"=dword:00000001
"DefaultValue"=dword:00000000
"HelpID"="shell.hlp#51103"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
@=""


把文件名改为：showall.reg
然后双击，点确定就ok了！

友情提示：如果新建的文本文件没有扩展名，改文件名的时候会有一点问题，这是因为windows默认是隐藏扩展名的，要再文件夹选项里更改一下。否则，你最后改的文件名不是showall.reg，而是showall.reg.txt
qak27 - 2007-5-3 22:02:00
启动几次后msconfig也被修改,有关杀毒软件和防火墙的软件启动加载都会被删除
桃子CiCi - 2007-5-3 22:03:00
日志扫描软件无法启用的情况,可以试试更改软件名和后缀名
如将其改成  111.com然后再运行
只限捞仁客 - 2007-5-3 22:06:00
我的SP2系统应该是最安全的了。瑞星防火墙查过，有漏洞的全补上。估计是网页毒。
改名，我怎么没想到，还是你历害。
这狗日的真够流的，改了前后缀，在SREng2目录里还是不能用，改了目录名才能用。
扫描中……
qak27 - 2007-5-3 22:06:00
引用:
【桃子CiCi的贴子】显示所有文件功能最有效的方法是：
新建一个文本文件（就是*.txt文件），打开，把下面的代码拷进去：

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN]
"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
"Text"="@shell32.dll,-30501"
"Type"="radio"
"CheckedValue"=dword:00000002
"ValueName"="Hidden"
"DefaultValue"=dword:00000002
"HKeyRoot"=dword:80000001
"HelpID"="shell.hlp#51104"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
"Text"="@shell32.dll,-30500"
"Type"="radio"
"CheckedValue"=dword:00000001
"ValueName"="Hidden"
"DefaultValue"=dword:00000002
"HKeyRoot"=dword:80000001
"HelpID"="shell.hlp#51105"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden]
"Type"="checkbox"
"Text"="@shell32.dll,-30508"
"WarningIfNotDefault"="@shell32.dll,-28964"
"HKeyRoot"=dword:80000001
"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
"ValueName"="ShowSuperHidden"
"CheckedValue"=dword:00000000
"UncheckedValue"=dword:00000001
"DefaultValue"=dword:00000000
"HelpID"="shell.hlp#51103"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
@=""


把文件名改为：showall.reg
然后双击，点确定就ok了！

友情提示：如果新建的文本文件没有扩展名，改文件名的时候会有一点问题，这是因为windows默认是隐藏扩展名的，要再文件夹选项里更改一下。否则，你最后改的文件名不是showall.reg，而是showall.reg.txt

………………

这招我试过了,刚改动好象是成功的,可打开注册表一看,showall\cheakvalue的值还是0
qak27 - 2007-5-3 22:12:00
下午用瑞星光盘启动查毒(29日的病毒库),什么也没查出来,急盼解决方案,
对了,中毒后XP显示新安装了多个软件,基本都是需要密码运行的软件
桃子CiCi - 2007-5-3 22:12:00
Icesword v1.20
最新版本下载地址：
中文：http://202.38.64.10/~jfpan/download/IceSword120_cn.zip
下载冰刃之后,设置--禁止进程创建.然后再对注册表进行修复...
将SRENG改名后,还原冰刃设置,再马上扫日志上来请高手给你分析一下
mimi23 - 2007-5-3 22:12:00
我也是中的这个毒,在我去www.55tao.com中的 ,现在是重装的系统!
只限捞仁客 - 2007-5-3 22:34:00
这么快装系统，没崩嘛，要相信瑞星有能力解决的。
复桃子，报告来了。太长了，分开发。
qak27 - 2007-5-3 22:34:00
引用:
【桃子CiCi的贴子】Icesword v1.20
最新版本下载地址：
中文：http://202.38.64.10/~jfpan/download/IceSword120_cn.zip
下载冰刃之后,设置--禁止进程创建.然后再对注册表进行修复...
将SRENG改名后,还原冰刃设置,再马上扫日志上来请高手给你分析一下
………………

冰刃根本运行不了呀
只限捞仁客 - 2007-5-3 22:36:00
[CODE]

2007-05-03,22:05:51

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
    <XDeskShow><C:\PROGRAM FILES\鱼鱼软件\鱼鱼桌面秀\XDeskShow.exe>  [鱼鱼软件]
    <H/PC Connection Agent><"C:\Program Files\Microsoft ActiveSync\wcescomm.exe">  [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
    <run><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <MSConfig><C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto>  [(Verified)Microsoft Windows Publisher]
    <Logitech Utility><Logi_MwX.Exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows Component Publisher]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{1DDE4171-4171-DDE1-71DD-171DE171DDE1}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\4171DDE1.dll>  []
[HKEY_CURRENT_USER\Control Panel\Desktop]
    <SCRNSAVE.EXE><C:\WINDOWS\system32\夜光时~1.SCR>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <ISUSScheduler><; "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start>  [InstallShield Software Corporation]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <MSMSGS><; "C:\Program Files\Messenger\msmsgs.exe" /background>  [(Verified)Microsoft Windows Publisher]
    <msnmsgr><; "C:\Program Files\MSN Messenger\msnmsgr.exe" /background>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <TPP Auto Loader><; C:\WINDOWS\tppaldr.exe>  [Cypress Semiconductor]
    <UnlockerAssistant><; "C:\Program Files\Unlocker\UnlockerAssistant.exe">  []

==================================
启动文件夹
N/A

==================================
服务
[495037D2 / 495037D2][Stopped/Auto Start]
  <><N/A>
[AC8DE6B4 / AC8DE6B4][Stopped/Auto Start]
  <><N/A>
[Adobe LM Service / Adobe LM Service][Stopped/Manual Start]
  <"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>
[CoolWare / CoolWare][Running/Auto Start]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\qkno.dll><>
[Gentad / Gentad][Stopped/Auto Start]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\struts.dll><N/A>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Navoct / Navoct][Running/Auto Start]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\Program Files\iesnap\navoct.dll>< >
[Windows pjmn RunThem / pjmn][Running/Auto Start]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\PROGRA~1\kehi\uors.dll>< >
[Rising Proxy  Service / RfwProxySrv][Stopped/Disabled]
  <c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService][Stopped/Disabled]
  <c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter][Stopped/Disabled]
  <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Stopped/Disabled]
  <"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[StyleXPService / StyleXPService][Running/Auto Start]
  <"C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe"><>
[Windows_rejoice / Windows_rejoice][Stopped/Auto Start]
  <C:\WINDOWS\Server.exe><N/A>
[Windows Media Player Network Sharing Service / WMPNetworkSvc][Stopped/Manual Start]
  <C:\Program Files\Windows Media Player\WMPNetwk.exe><Microsoft Corporation>
[Windows Driver Foundation - User-mode Driver Framework / WudfSvc][Stopped/Manual Start]
  <C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup-->%SystemRoot%\System32\WUDFSvc.dll><Microsoft Corporation>
只限捞仁客 - 2007-5-3 22:36:00
==================================
驱动程序
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Running/Manual Start]
  <system32\drivers\ac97intc.sys><Intel Corporation>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
  <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[dajfeceh / dajfeceh][Stopped/Boot Start]
  <\SystemRoot\system32\drivers\dajfeceh.sys><N/A>
[ehbhgfej / ehbhgfej][Stopped/System Start]
  <\??\C:\WINDOWS\system32\drivers\ehbhgfej.sys><N/A>
[ExpScaner / ExpScaner][Stopped/Disabled]
  <\??\C:\Program Files\Rising\Rav\ExpScan.sys><>
[fctmor / fctmor][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\drivers\fctmor.sys><CNNIC>
[fdfdibie / fdfdibie][Stopped/System Start]
  <\??\C:\WINDOWS\system32\drivers\fdfdibie.sys><N/A>
[glhuwf / glhuwf][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\drivers\glhuwf.sys><N/A>
[HOOKAPI / HOOKAPI][Stopped/Disabled]
  <\??\C:\PROGRAM FILES\RISING\RAV\HOOKAPI.SYS><瑞星软件有限公司>
[HookCont / HookCont][Stopped/Disabled]
  <\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Stopped/Disabled]
  <\??\C:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Stopped/Disabled]
  <\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising>
[HookUrl / HookUrl][Stopped/Disabled]
  <\??\C:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[i81x / i81x][Stopped/Manual Start]
  <system32\DRIVERS\i81xnt5.sys><Intel(R) Corporation>
[iAimFP0 / iAimFP0][Stopped/Manual Start]
  <system32\DRIVERS\wADV01nt.sys><Intel(R) Corporation>
[iAimFP1 / iAimFP1][Stopped/Manual Start]
  <system32\DRIVERS\wADV02NT.sys><Intel(R) Corporation>
[iAimFP2 / iAimFP2][Stopped/Manual Start]
  <system32\DRIVERS\wADV05NT.sys><Intel(R) Corporation>
[iAimFP3 / iAimFP3][Stopped/Manual Start]
  <system32\DRIVERS\wSiINTxx.sys><Intel(R) Corporation>
[iAimFP4 / iAimFP4][Stopped/Manual Start]
  <system32\DRIVERS\wVchNTxx.sys><Intel(R) Corporation>
[iAimFP5 / iAimFP5][Stopped/Manual Start]
  <system32\DRIVERS\wADV07nt.sys><Intel(R) Corporation>
[iAimFP6 / iAimFP6][Stopped/Manual Start]
  <system32\DRIVERS\wADV08nt.sys><Intel(R) Corporation>
[iAimFP7 / iAimFP7][Stopped/Manual Start]
  <system32\DRIVERS\wADV09nt.sys><Intel(R) Corporation>
[iAimTV0 / iAimTV0][Stopped/Manual Start]
  <system32\DRIVERS\wATV01nt.sys><Intel(R) Corporation>
[iAimTV1 / iAimTV1][Stopped/Manual Start]
  <system32\DRIVERS\wATV02NT.sys><Intel(R) Corporation>
[iAimTV3 / iAimTV3][Stopped/Manual Start]
  <system32\DRIVERS\wATV04nt.sys><Intel(R) Corporation>
[iAimTV4 / iAimTV4][Stopped/Manual Start]
  <system32\DRIVERS\wCh7xxNT.sys><Intel(R) Corporation>
[iAimTV5 / iAimTV5][Stopped/Manual Start]
  <system32\DRIVERS\wATV10nt.sys><Intel(R) Corporation>
[iAimTV6 / iAimTV6][Stopped/Manual Start]
  <system32\DRIVERS\wATV06nt.sys><Intel(R) Corporation>
[ifjgcahe / ifjgcahe][Stopped/Boot Start]
  <\SystemRoot\system32\drivers\ifjgcahe.sys><N/A>
[kato / kato][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\drivers\kato.sys><CNNIC>
[Logitech PS/2 Mouse Filter Driver / L8042pr2][Running/Manual Start]
  <system32\DRIVERS\L8042pr2.Sys><Logitech, Inc.>
[Logitech Mouse Class Filter Driver / LMouFlt2][Running/Manual Start]
  <system32\DRIVERS\LMouFlt2.Sys><Logitech, Inc.>
[MEMSCAN / MEMSCAN][Stopped/Disabled]
  <\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[mProcRs / mProcRs][Stopped/Disabled]
  <\??\c:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[no / no][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\drivers\no.sys><N/A>
[Netgroup Packet Filter / NPF][Stopped/Manual Start]
  <system32\DRIVERS\npf.sys><CACE Technologies>
[npkcrypt / npkcrypt][Running/Auto Start]
  <\??\C:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[NTSIM / NTSIM][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\ntsim.sys><VIA Networking Technologies, Inc.>
[nv / nv][Running/Manual Start]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[opoleqj / opoleqj][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\drivers\opoleqj.sys><N/A>
[StarForce Protection Environment Driver v6 / prodrv06][Running/System Start]
  <\SystemRoot\System32\drivers\prodrv06.sys><Protection Technology>
[StarForce Protection Helper Driver v2 / prohlp02][Running/Boot Start]
  <\SystemRoot\System32\drivers\prohlp02.sys><Protection Technology>
[StarForce Protection Synchronization Driver v1 / prosync1][Running/Boot Start]
  <\SystemRoot\System32\drivers\prosync1.sys><Protection Technology>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[PxHelp20 / PxHelp20][Running/Boot Start]
  <\SystemRoot\System32\Drivers\PxHelp20.sys><Sonic Solutions>
[rimj / rimj][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\drivers\rimj.sys><N/A>
[WAN 微型端口 (PPP over Ethernet 协议) / RMSPPPOE][Running/Manual Start]
  <system32\DRIVERS\RMSPPPOE.SYS><Robert Schlabbach>
[RsFwDrv / RsFwDrv][Stopped/Disabled]
  <\??\C:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
  <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Stopped/Disabled]
  <\??\C:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[Realtek 10/100/1000 PCI NIC Family NDIS XP Driver / RTL8023xp][Running/Manual Start]
  <system32\DRIVERS\Rtnicxp.sys><Realtek Semiconductor Corporation>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
  <system32\DRIVERS\RTL8139.SYS><N/A>
[rvgqnv / rvgqnv][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\drivers\rvgqnv.sys><CNNIC>
[scog / scogk][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\scogk.sys><N/A>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[StarForce Protection Helper Driver / sfhlp01][Running/Boot Start]
  <\SystemRoot\System32\drivers\sfhlp01.sys><Protection Technology>
[Samsung Mobile USB Device II 1.0 driver (WDM) / ssm_bus][Stopped/Manual Start]
  <system32\DRIVERS\ssm_bus.sys><MCCI>
[Samsung Mobile USB Modem II 1.0 Filter / ssm_mdfl][Stopped/Manual Start]
  <system32\DRIVERS\ssm_mdfl.sys><MCCI>
[Samsung Mobile USB Modem II 1.0 Drivers / ssm_mdm][Stopped/Manual Start]
  <system32\DRIVERS\ssm_mdm.sys><MCCI>
[StyleXPHelper / StyleXPHelper][Running/System Start]
  <\??\C:\Program Files\TGTSoft\StyleXP\STYLEXPHELPER.EXE><Windows (R) 2000 DDK provider>
[USB Storage Adapter FX (TPP) / TPPFX][Stopped/Manual Start]
  <system32\DRIVERS\TPPFX.SYS><Cypress Semiconductor>
[txijph / txijph][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\drivers\txijph.sys><N/A>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
  <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[Windows Driver Foundation - User-mode Driver Framework Platform Driver / WudfPf][Stopped/Manual Start]
  <system32\DRIVERS\WudfPf.sys><Microsoft Corporation>
[Windows Driver Foundation - User-mode Driver Framework Reflector / WudfRd][Stopped/Manual Start]
  <system32\DRIVERS\wudfrd.sys><Microsoft Corporation>
[VIMICRO USB PC Camera (ZC0301PLH) / ZSMC303][Stopped/Manual Start]
  <System32\Drivers\usbVM303.sys><Vimicro Corporation>
只限捞仁客 - 2007-5-3 22:37:00
==================================
浏览器加载项
[]
  {105E4D0C-5E21-41ED-90F9-013EEF271BD6} <C:\WINDOWS\system32\widgetdownload.dll, 鱼鱼桌面秀widget插件下载工具>
[Create Mobile Favorite]
  {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} <C:\PROGRA~1\MICROS~4\INetRepl.dll, Microsoft Corporation>
[Create Mobile Favorite]
  {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} <C:\PROGRA~1\MICROS~4\INetRepl.dll, Microsoft Corporation>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
  {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, N/A>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[Windows Genuine Advantage Validation Tool]
  {17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\legitcheckcontrol.dll, Microsoft Corporation>
[WebActivater Control]
  {3D8F74EE-8692-4F8F-B8D2-7522E732519E} <C:\WINDOWS\system32\WEBACT~1.OCX, QQ>
[Office Update Installation Engine]
  {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} <C:\WINDOWS\opuc.dll, Microsoft Corporation>
[EditCtrl Class]
  {488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\system32\aliedit\aliedit.dll, >
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[]
  {105E4D0C-5E21-41ED-90F9-013EEF271BD6} <C:\WINDOWS\system32\widgetdownload.dll, 鱼鱼桌面秀widget插件下载工具>
[WangWangObj Class]
  {6E213FC7-DD5A-4115-B7E6-D4C7838C361E} <C:\Program Files\Alisoft\WangWang\WangWangX4.dll, 阿里软件（中国）有限公司>
[Windows Live Sign-in Helper]
  {9030D464-4C02-4ABF-8ECC-5164760863C6} <C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll, N/A>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[&Net Search]
  <res://C:\WINDOWS\system32\sporder.dll/MENUSEARCH.HTM, N/A>
[上传到QQ网络硬盘]
  <C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
  <C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 472][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 528][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1292][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [c:\progra~1\kehi\xruv.dll]  [, 1, 0, 0, 6]
    [c:\progra~1\kehi\cwza.dll]  [ , 1, 0, 0, 6]
    [c:\PROGRA~1\iesnap\navstub.dll]  [, 1, 0, 1, 2]
    [C:\Program Files\Common Files\Microsoft Shared\MSINFO\4171DDE1.dll]  [N/A, ]
    [C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll]  [Logitech Inc., 1.1.0]
    [C:\Program Files\Logitech\MouseWare\System\LgWndHk.dll]  [Logitech Inc., 9.79.025]
    [C:\WINDOWS\system32\widgetdownload.dll]  [鱼鱼桌面秀widget插件下载工具, 1.3.0.0]
    [C:\WINDOWS\system32\PortableDeviceApi.dll]  [Microsoft Corporation, 5.2.5358.4827 (WMP_11.060509-2009)]
    [C:\Program Files\Unlocker\UnlockerCOM.dll]  [N/A, ]
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
    [C:\WINDOWS\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
[PID: 1972][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Common Files\Microsoft Shared\MSINFO\4171DDE1.dll]  [N/A, ]
    [c:\PROGRA~1\iesnap\navstub.dll]  [, 1, 0, 1, 2]
    [c:\progra~1\kehi\xruv.dll]  [, 1, 0, 0, 6]
    [c:\progra~1\kehi\cwza.dll]  [ , 1, 0, 0, 6]
    [C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll]  [Logitech Inc., 1.1.0]
[PID: 2032][C:\PROGRAM FILES\鱼鱼软件\鱼鱼桌面秀\XDeskShow.exe]  [鱼鱼软件, 1.8.2.903]
    [C:\Program Files\Logitech\MouseWare\System\LgWndHk.dll]  [Logitech Inc., 9.79.025]
    [C:\Program Files\Common Files\Microsoft Shared\MSINFO\4171DDE1.dll]  [N/A, ]
    [c:\PROGRA~1\iesnap\navstub.dll]  [, 1, 0, 1, 2]
    [c:\progra~1\kehi\xruv.dll]  [, 1, 0, 0, 6]
    [c:\progra~1\kehi\cwza.dll]  [ , 1, 0, 0, 6]
    [C:\PROGRAM FILES\鱼鱼软件\鱼鱼桌面秀\Res\Dll\calendar100.dll]  [, 1.2.0.317]
    [C:\PROGRAM FILES\鱼鱼软件\鱼鱼桌面秀\Res\Dll\weather100.dll]  [, 1.3.0.428]
    [C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll]  [Logitech Inc., 1.1.0]
    [C:\WINDOWS\system32\msxml4.dll]  [Microsoft Corporation, 4.10.9404.0]
[PID: 124][C:\Program Files\Logitech\MouseWare\system\em_exec.exe]  [Logitech Inc., 9.79.025]
    [C:\Program Files\Logitech\MouseWare\system\EVENTEX.dll]  [Logitech Inc., 9.79.025]
    [C:\WINDOWS\system32\COMNCTR.dll]  [Logitech Inc., 9.79.025]
    [C:\Program Files\Logitech\MouseWare\system\MFC42.DLL]  [Microsoft Corporation, 6.00.8665.0]
    [C:\Program Files\Common Files\Microsoft Shared\MSINFO\4171DDE1.dll]  [N/A, ]
    [c:\PROGRA~1\iesnap\navstub.dll]  [, 1, 0, 1, 2]
    [c:\progra~1\kehi\xruv.dll]  [, 1, 0, 0, 6]
    [c:\progra~1\kehi\cwza.dll]  [ , 1, 0, 0, 6]
    [C:\Program Files\Logitech\MouseWare\system\ccresrce.dll]  [Logitech Inc., 9.79.025]
    [C:\Program Files\Logitech\MouseWare\system\GlbResLt.dll]  [Logitech Inc., 9.79.025]
    [C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll]  [Logitech Inc., 1.1.0]
    [C:\Program Files\Logitech\MouseWare\System\devices.dll]  [Logitech Inc., 9.79.025]
    [C:\Program Files\Logitech\MouseWare\system\ccstmglb.dll]  [Logitech Inc., 9.79.025]
    [C:\Program Files\Logitech\MouseWare\system\ccustom.dll]  [Logitech Inc., 9.79.025]
    [C:\Program Files\Logitech\MouseWare\system\ccmsghk.dll]  [Logitech Inc., 9.79.025]
    [C:\Program Files\Logitech\MouseWare\System\LgWndHk.dll]  [Logitech Inc., 9.79.025]
[PID: 120][C:\Program Files\Microsoft ActiveSync\wcescomm.exe]  [Microsoft Corporation, 4.5.5096.0]
    [C:\Program Files\Logitech\MouseWare\System\LgWndHk.dll]  [Logitech Inc., 9.79.025]
    [C:\Program Files\Common Files\Microsoft Shared\MSINFO\4171DDE1.dll]  [N/A, ]
    [c:\PROGRA~1\iesnap\navstub.dll]  [, 1, 0, 1, 2]
    [c:\progra~1\kehi\xruv.dll]  [, 1, 0, 0, 6]
    [c:\progra~1\kehi\cwza.dll]  [ , 1, 0, 0, 6]
    [C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll]  [Logitech Inc., 1.1.0]
[PID: 192][C:\PROGRA~1\MICROS~4\rapimgr.exe]  [Microsoft Corporation, 4.5.5096.0]
    [C:\Program Files\Logitech\MouseWare\System\LgWndHk.dll]  [Logitech Inc., 9.79.025]
    [C:\Program Files\Common Files\Microsoft Shared\MSINFO\4171DDE1.dll]  [N/A, ]
    [c:\PROGRA~1\iesnap\navstub.dll]  [, 1, 0, 1, 2]
    [c:\progra~1\kehi\xruv.dll]  [, 1, 0, 0, 6]
    [c:\progra~1\kehi\cwza.dll]  [ , 1, 0, 0, 6]
    [C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll]  [Logitech Inc., 1.1.0]
    [G:\2\111.com]  [Smallfrogs Studio, 2.4.12.806]
    [C:\Program Files\Common Files\Microsoft Shared\MSINFO\4171DDE1.dll]  [N/A, ]
    [C:\Program Files\Logitech\MouseWare\System\LgWndHk.dll]  [Logitech Inc., 9.79.025]
    [c:\PROGRA~1\iesnap\navstub.dll]  [, 1, 0, 1, 2]
    [c:\progra~1\kehi\xruv.dll]  [, 1, 0, 0, 6]
    [c:\progra~1\kehi\cwza.dll]  [ , 1, 0, 0, 6]
    [C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll]  [Logitech Inc., 1.1.0]
[PID: 1988][C:\WINDOWS\notepad.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Logitech\MouseWare\System\LgWndHk.dll]  [Logitech Inc., 9.79.025]
    [C:\Program Files\Common Files\Microsoft Shared\MSINFO\4171DDE1.dll]  [N/A, ]
    [c:\PROGRA~1\iesnap\navstub.dll]  [, 1, 0, 1, 2]
    [c:\progra~1\kehi\xruv.dll]  [, 1, 0, 0, 6]
    [c:\progra~1\kehi\cwza.dll]  [ , 1, 0, 0, 6]
    [C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll]  [Logitech Inc., 1.1.0]
只限捞仁客 - 2007-5-3 22:37:00
==================================
文件关联
.TXT  Error. [C:\WINDOWS\notepad.exe %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  Error. ["hh.exe" %1]
.HLP  Error. [winhlp32.exe %1]
.INI  Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[D:\]
[AutoRun]
open=4171DDE1.exe
shellexecute=4171DDE1.exe
shell\Auto\command=4171DDE1.exe
[E:\]
[AutoRun]
open=4171DDE1.exe
shellexecute=4171DDE1.exe
shell\Auto\command=4171DDE1.exe

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
API HOOK
N/A

==================================
隐藏进程
    [1576] C:\program files\internet explorer\IEXPLORE.EXE
    [1832] C:\WINDOWS\system32\calc.exe

==================================


[/CODE]
只限捞仁客 - 2007-5-3 22:38:00
发完了。
qak27 - 2007-5-3 22:50:00
我的
[CODE]

2007-05-03,22:33:59

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <MSConfig><C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto>  [(Verified)Microsoft Windows Publisher]
    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
    <Userinit><C:\WINDOWS\system32\Userinit.exe,>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><>  [N/A]
    <{37B100A3-00A3-7B10-A37B-0A3B10A37B10}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\00A37B10.dll>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ImpsSensor]
    <WinlogonNotify: ImpsSensor><ImpsSensor.dll>  [China Mobile]

==================================
启动文件夹
N/A

==================================
服务
[7886CED2 / 7886CED2][Stopped/Auto Start]
  <C:\WINDOWS\system32\7886CED2.EXE -k><Microsoft Corporation>
[Ati HotKey Poller / Ati HotKey Poller][Stopped/Auto Start]
  <C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[InstallDriver Table Manager / IDriverT][Stopped/Manual Start]
  <"C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe"><Macrovision Corporation>
[Rising Proxy  Service / RfwProxySrv][Stopped/Disabled]
  <c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService][Stopped/Disabled]
  <c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter][Stopped/Disabled]
  <"D:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Stopped/Disabled]
  <"D:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>

==================================
驱动程序
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[AliIde / AliIde][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\aliide.sys><N/A>
[ati2mtag / ati2mtag][Stopped/Manual Start]
  <system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[AV_U240 VOICE REOCRDER DRIVER / AV_U240][Stopped/Auto Start]
  <System32\Drivers\AV_U240.sys><Your Corporation>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
  <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[CmdIde / CmdIde][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\cmdide.sys><CMD Technology, Inc.>
[C-Media PCI Audio Driver (WDM) / cmpci][Stopped/Manual Start]
  <system32\drivers\cmaudio.sys><C-Media Inc>
[ExpScaner / ExpScaner][Stopped/Disabled]
  <\??\D:\Program Files\Rising\Rav\ExpScan.sys><>
[usb Card Device 1000 / ft1kEnum][Running/Manual Start]
  <system32\DRIVERS\ic1kenum.sys><OEM Corporation>
[GMSIPCI / GMSIPCI][Stopped/Manual Start]
  <\??\F:\INSTALL\GMSIPCI.SYS><N/A>
[HookCont / HookCont][Stopped/Disabled]
  <\??\D:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Stopped/Disabled]
  <\??\D:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Stopped/Disabled]
  <\??\D:\Program Files\Rising\Rav\HookSys.sys><Rising>
[HookUrl / HookUrl][Stopped/Disabled]
  <\??\C:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[IdeBusDr / IdeBusDr][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\IdeBusDr.sys><Intel Corporation>
[Intel(r) Ultra ATA Controller / IdeChnDr][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\IdeChnDr.sys><Intel Corporation>
[IPHOOK / IPHOOK][Stopped/Disabled]
  <\??\H:\Program Files\rising\rfw\IPHOOK.sys><N/A>
[MegaIDE / MegaIDE][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\MegaIDE.sys><LSI Logic Corporation.>
[MEMSCAN / MEMSCAN][Stopped/Disabled]
  <\??\D:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[mProcRs / mProcRs][Stopped/Disabled]
  <\??\c:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[npkcrypt / npkcrypt][Stopped/Auto Start]
  <\??\D:\Program Files\Tencent\qq\npkcrypt.sys><N/A>
[npkycryp / npkycryp][Stopped/Manual Start]
  <\??\D:\Program Files\Tencent\qq\npkycryp.sys><N/A>
[nv / nv][Running/Manual Start]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[USB SmartCard Reader Device 1000  / Reader_1000][Running/Manual Start]
  <system32\DRIVERS\usbic1k.sys><OEM>
[RsFwDrv / RsFwDrv][Stopped/Disabled]
  <\??\C:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
  <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Stopped/Disabled]
  <\??\D:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[Sentinel / Sentinel][Running/Auto Start]
  <\SystemRoot\System32\Drivers\SENTINEL.SYS><>
[TDIHOOK / TDIHOOK][Stopped/Disabled]
  <\??\H:\Program Files\rising\rfw\TDIHOOK.sys><N/A>
[VCD VNC Virtual Network Adapter / vcddev][Running/Manual Start]
  <system32\DRIVERS\vcdvnic.sys><VNN B.J.>
[ViaIde / ViaIde][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\viaide.sys><Microsoft Corporation>
qak27 - 2007-5-3 22:51:00
==================================
浏览器加载项
[Adobe PDF Reader Link Helper]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <d:\Program Files\Tencent\qq\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[启动迅雷]
  {0062C9BD-B349-40DE-91A0-755F37ACD559}? <d:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[新浪UC]
  {2253922F-1B26-4C74-8B57-E3AEE748DBB8}? <d:\Program Files\sina\UC\uc.exe, 北京新浪信息技术有限公司>
[NetAnts]
  {57E91B47-F40A-11D1-B792-444553540000}? <D:\PROGRA~1\NETANTS\NetAnts.exe,  >
[JUJU猫]
  {6096E38F-5AC1-4391-8EC4-75DFA92FB32F}? <http://www.jujumao.net, N/A>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <D:\Program Files\Tencent\qq\QQ.EXE, TENCENT>
[FlashGet]
  {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\PROGRA~1\绿色软件\网际快~1.65\flashget.exe, Amaze Soft>
[QQIEFloatBarCfgCmd Class]
  {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <d:\Program Files\Tencent\qq\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Macromedia Authorware Web Player Control]
  {15B782AF-55D8-11D1-B477-006097098764} <C:\WINDOWS\system32\macromed\authorwa\awswax.ocx, Macromedia, Inc.>
[CSProxy Class]
  {53EC2F48-968E-4A42-B99B-9F657147919D} <C:\WINDOWS\Downloaded Program Files\CONFLICT.1\ProxyIE.dll, Sinfor>
[WhatyChat Control
网梯语音控件]
  {91D0759C-39D9-474B-AD74-50158F0A7951} <C:\WINDOWS\DOWNLO~1\WHATYC~1.OCX, Whaty Info&Tech, LTD >
[MsnMessengerSetupDownloadControl Class]
  {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} <C:\WINDOWS\Downloaded Program Files\MsnMessengerSetupDownloader.ocx, Microsoft Corporation>
[Detect Control]
  {BA0017E1-4CF9-4677-9F54-871BDA455960} <C:\WINDOWS\DOWNLO~1\Detect.ocx, ft>
[ThunderIEHelper Class]
  {0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v14.dll, Thunder Networking Technologies,LTD>
[ActiveMovieControl Object]
  {05589FA1-C356-11CE-BF01-00AA0055595A} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[Adobe PDF Reader Link Helper]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[Windows Media Player]
  {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
  {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
  {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[Alexa]
  {3CEFF6CD-6F08-4E4D-BCCD-FF7415288C3B} <C:\WINDOWS\system32\SHDOCVW.DLL, Microsoft Corporation>
[HHCtrl Object]
  {41B23C28-488E-4E5C-ACE2-BB0BBABE99E8} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <d:\Program Files\Tencent\qq\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <d:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>
[IeCatch2 Class]
  {A5366673-E8CA-11D3-9CD9-0090271D075B} <C:\PROGRA~1\绿躺色软砑件\网际士快靱~1.65\jccatch.dll, N/A>
[Microsoft Scriptlet Component]
  {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[卡卡上网安全助手]
  {AFF6E516-CBE5-4F8A-9C2F-38A68013E766} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[SearchAssistantOC]
  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
  {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[RealPlayer G2 Control]
  {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[卡卡上网安全助手]
  {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[FlashGet Bar]
  {E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\绿躺色软砑件\网际士快靱~1.65\fgiebar.dll, N/A>
[&Download by NetAnts]
  <D:\PROGRA~1\NETANTS\NAGet.htm, N/A>
[&使用迅雷下载]
  <d:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
  <d:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
[Get Alexa Data]
  <http://client.alexa.com/holiday/script/actions/sitedata.htm, N/A>
[上传到QQ网络硬盘]
  <D:\Program Files\Tencent\qq\AddToNetDisk.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
  <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
  <D:\Program Files\Tencent\qq\AddPanel.htm, N/A>
[添加到QQ表情]
  <D:\Program Files\Tencent\qq\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <D:\Program Files\Tencent\qq\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 636][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 688][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\7886CED2.DLL]  [Microsoft Corporation, ]
[PID: 1260][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\7886CED2.DLL]  [Microsoft Corporation, ]
    [C:\Program Files\Common Files\Microsoft Shared\MSINFO\00A37B10.dll]  [N/A, ]
    [D:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
    [C:\WINDOWS\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
    [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll]  [Adobe Systems Incorporated, 7.0.7.2006011200]
    [C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [D:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[PID: 1856][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3427]
[PID: 2380][D:\bbb\sg2\Sg.EXE]  [Smallfrogs Studio, 2.4.12.806]
    [C:\Program Files\Common Files\Microsoft Shared\MSINFO\00A37B10.dll]  [N/A, ]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[C:\]
[AutoRun]
open=rising.exe
shellexecute=rising.exe
shell\Auto\command=rising.exe
[D:\]
[AutoRun]
open=00A37B10.exe
shellexecute=00A37B10.exe
shell\Auto\command=00A37B10.exe
[E:\]
[AutoRun]
open=00A37B10.exe
shellexecute=00A37B10.exe
shell\Auto\command=00A37B10.exe

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================


[/CODE]
jiangrn - 2007-5-3 22:53:00
有谁可以帮我看看我的帖，我朋友的电脑开不了网页，上网速度慢1！~~发了帖没人看啊，瑞星的人都干什么去了```！~呼救啊



顶下！~~
123
查看完整版本: 急救:中毒了,杀毒软件全退出.
© 2000 - 2026 Rising Corp. Ltd.