求高手帮忙...我电脑给病毒入侵了.! bbs.ikaka.com

被病毒玩的人 - 2007-5-7 8:33:00

事情发生在昨天晚上我玩游戏..然后想下载外挂..然后就去迅雷网上找外挂下..我以为迅雷网上.没什么病毒..然后我就下载了一个外挂..外挂下载好...(我用的是迅5下好会自动查毒)下好后..查毒..发现..有病毒..然后我点了..删除病毒..然后就没当一回事..继续..安装那个文件..安装好后瑞星提示很多病毒...我一一的全点删除..然后我这才反应过来..就连忙删所有的那些外挂文件...我刚删掉..瑞星又提示..什么什么修改注册表..跳出来好多..我全部点拒绝..然后又出现什么...XXX试图连接网络..又冒出来好多..我全部点..拒绝..然后不知道怎么了..计算机就重起了..重起在进..进如XP界面时..跳出来个警告..什么XXXXX文件不能为XXXXXX...我点了确定..然后又跳出来一个..我同样点了确定..然后进入桌面的时候...只能看到桌面背景其他什么都没有..低下还提示什么XX试图连接网络....然后我就关机了..打算明天重做系统..然后今天..我起来..打开电脑...然后后狂按F8..不知道为什么F8里的选项..全部变英文了.以前还是中文的..然后我选了..倒数第1个..然后在进入XP..结果进去了...但是这次没跳出..什么XXXXX文件不能为XXXXXX...还是照样跳出来...什么试图连接网络..然后我没管了..直接开瑞星杀毒..杀毒后..发现3个病毒..要手动删除..前2个都在安全模式下删除了..但是第3个..我点查找目标...却找不到..我看那个病毒地址是在回收站里.然后我就清空了回收站...在点查找目标就什么都没出来了..我然后又点了..卡卡上网助手..把一些流氓软件删除..我现在就不知道该怎么办了...请个位高手帮忙...我这个电脑..还要给我爸爸玩股..千万不能中木马...或者给远程监控了....如果高手们要日志..我现在就发上来...我求求高手们..帮我吧..我需要你们的帮忙...我给你门跪下了.!!!

阿拉伯伯 - 2007-5-7 8:37:00

日志

被病毒玩的人 - 2007-5-7 8:37:00

为什么我点传日至的那个...提示..本版本已经过期.
主义:如果你的系统日期不正确,System Repair Engineer将不能正常工作.请检查你的系统日期是否正确并且确认你的System Repair Engineer是最新版本.

低下就是什么名字...授权号.

求你们了..帮帮我把...!!

阿拉伯伯 - 2007-5-7 8:39:00

http://forum.ikaka.com/topic.asp?board=28&artid=6979213

被病毒玩的人 - 2007-5-7 8:40:00

从哪里可以在下System Repair Engineer

阿拉伯伯 - 2007-5-7 8:40:00

http://forum.ikaka.com/topic.asp?board=28&artid=6979213

被病毒玩的人 - 2007-5-7 8:42:00

没有找到下载的地址..能不能把直接下载的地址给我.?谢谢了

阿拉伯伯 - 2007-5-7 8:44:00

不会吧,你去预置帖里下好了!

阿拉伯伯 - 2007-5-7 8:44:00

常用小工具里!

被病毒玩的人 - 2007-5-7 8:45:00

恩.我去看下

天赐我一生 - 2007-5-7 8:45:00

系统时间可能已被改了。

建议还是全格重装系统。

被病毒玩的人 - 2007-5-7 8:48:00

==========================================================================
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
==========================================================================
RavTask----------"C:\Program Files\Rising\Rav\RavTask.exe" -system

stup.exe----------C:\PROGRA~1\TENCENT\Adplus\stup.exe

runeip----------C:\Program Files\Rising\AntiSpyware\runiep.exe

==========================================================================
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonce
==========================================================================
RavStub----------"C:\Program Files\Rising\Rav\ravstub.exe" /RUNONCE

KKDelay----------C:\Program Files\Rising\AntiSpyware\RunOnce.exe

==========================================================================
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
==========================================================================

==========================================================================
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
==========================================================================
ctfmon.exe----------C:\WINDOWS\system32\ctfmon.exe

==========================================================================
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runonce
==========================================================================

==========================================================================
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices
==========================================================================

==========================================================================
常用注册表关联项目
==========================================================================
EXE文件关联----------正常
COM文件关联----------正常
BAT文件关联----------正常
PIF文件关联----------正常
SCR文件关联----------正常
REG文件关联----------正常
TXT文件关联----------C:\WINDOWS\notepad.exe %1

==========================================================================
启动组
==========================================================================
[C:\Documents and Settings\Administrator\「开始」菜单\程序\启动]

[C:\Documents and Settings\All Users\「开始」菜单\程序\启动]

==========================================================================
WIN.INI
==========================================================================
load =
run =

==========================================================================
SYSTEM.INI
==========================================================================
shell = EXPLORER.EXE

================================文档结束==================================

阿拉伯伯 - 2007-5-7 8:50:00

啊?这是什么东西?

被病毒玩的人 - 2007-5-7 8:50:00

Logfile of HijackThis v1.99.1
Scan saved at 08:37:09 , on 2005-5-7
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rising\Rav\Ravmond.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Rising\Rav\RavStub.exe
c:\program files\rising\rfw\RfwMain.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\Program Files\Rising\AntiSpyware\runiep.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Rising\Rav\Rav.exe
C:\WINDOWS\explorer.exe
D:\QQ\TT\TTraveler.exe
D:\xun\Program\Thunder5.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.859\HijackThis.exe

R3 - URLSearchHook: BDSrchHook Class - {2C5AA40E-8814-4EB6-876E-7EFB8B3F9662} - C:\WINDOWS\DOWNLO~1\BDSrHook.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: ThunderBHO - {00000000-12C8-4305-82F9-43058F20E8D2} - D:\xun\ComDlls\xunleiBHO_Now.dll
O2 - BHO: Thunder AtOnce - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - D:\xun\ComDlls\TDAtOnce_Now.dll
O2 - BHO: Tencent Browser Helper - {0C7C23EF-A848-485B-873C-0ED954731014} - C:\Program Files\TENCENT\Adplus\SSAddr.dll
O2 - BHO: DsHelper - {0D42E1BD-09DD-4873-A826-9C7E793EB7B6} - D:\xun\Components\ResWorker\DSIeHelper.dll
O2 - BHO: (no name) - {669751ED-D558-49AE-B01A-3B374CC7910E} - C:\WINDOWS\system32\ssup.dll
O2 - BHO: BDHlprObj Class - {CA92B524-BC8A-4610-BD2C-6BD3E28155D0} - C:\WINDOWS\DOWNLO~1\BDHelper.dll
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\KakaTool.dll
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [stup.exe] C:\PROGRA~1\TENCENT\Adplus\stup.exe
O4 - HKLM\..\Run: [runeip] C:\Program Files\Rising\AntiSpyware\runiep.exe
O4 - HKLM\..\RunOnce: [RavStub] "C:\Program Files\Rising\Rav\ravstub.exe" /RUNONCE
O4 - HKLM\..\RunOnce: [KKDelay] C:\Program Files\Rising\AntiSpyware\RunOnce.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\QQ\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 使用ChinaCache P2SP 加速下载(&C) - C:\Program Files\p2spcd\\P2SPDown.htm
O8 - Extra context menu item: 使用迅雷下载 - D:\xun\Program\geturl.htm
O8 - Extra context menu item: 使用迅雷下载全部链接 - D:\xun\Program\getallurl.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\QQ\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\QQ\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\QQ\QQ\SendMMS.htm
O9 - Extra button: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - D:\xun\Thunder.exe
O9 - Extra 'Tools' menuitem: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - D:\xun\Thunder.exe
O9 - Extra button: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\QQ\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\QQ\QQ\QQ.EXE
O11 - Options group: [TBH] 中文搜搜
O15 - Trusted Zone: http://www.icbc.com.cn
O16 - DPF: {0796034F-1464-4290-8822-B24BED491FF5} - http://www.t3j4.com/t3j4.cab
O16 - DPF: {0B386B45-B2CF-4525-82FE-D3489C2D26C9} (ActozWebLauncher Control) - http://www.latale.com/Launcher/ActozWebLauncher.cab
O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} (Edit Class) - https://www.sz1.cmbchina.com/download/CMBEdit.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2354A44B-3CEB-4829-9940-545B03103538} (PowerPlr Control) - http://vod.ah.cncmax.cn/EPG/plugin/PowerPlr.ocx
O16 - DPF: {2375BEE5-F175-4F1C-81EC-8E4E2E72E2DD} (PhotoDraw Class) - http://qz-photo.qq.com/qzone_v4/QzoneMediaTools.cab
O16 - DPF: {759AA6A5-76B2-43E2-B940-B0C336C69E01} (VodoneCtrl Class) - http://202.106.184.51/download/VodoneActivex.cab
O16 - DPF: {BAC112DD-C51E-4712-A622-77C1D8075072} (ChinaCache加速下载客户端) - http://p2spdownload.chinacache.com/p2spcp4ie.cab
O16 - DPF: {C09B522F-8AED-4E21-A65C-DC1AB652BAEE} (Tencent Safety Online Base Module) - http://safe.qq.com/cgi-bin/tso/TSOBase.ocx
O16 - DPF: {C661F36D-DF85-4EF4-83C7-E107B83D04B1} (WebActivater Control) - http://dl_dir.qq.com/3dshow/3DShowVM.cab
O16 - DPF: {DC7094C6-8F61-42ED-AECE-63F5EEF647C5} (UpdateC2 Control) - http://www.uusee.com/player/updateC2.cab
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/pcver2007/OL2006.cab
O16 - DPF: {E787FD25-8D7C-4693-AE67-9406BC6E22DF} (PasswordEditCtrl Class) - https://password.qq.com/download/qqedit2.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CEB6A6FD-00B8-4613-BE63-A296AAEDCBF7}: NameServer = 210.52.207.2 218.104.78.2
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Performance Moniter (8NASCAR) - Unknown owner - C:\WINDOWS\SYSTEM32\RUNDLLFROMWIN2000.EXE (file missing)
O23 - Service: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe

被病毒玩的人 - 2007-5-7 8:52:00

没有那个....只有这样的

被病毒玩的人 - 2007-5-7 8:54:00

对了..忘记和你们说了...我的瑞星也不能升级了。 .!!

被病毒玩的人 - 2007-5-7 8:57:00

别走啊帮帮我.

被病毒玩的人 - 2007-5-7 9:00:00

难道没人帮忙了?真的要重装系统?还要全格?

天赐我一生 - 2007-5-7 9:02:00

你原来下载的那个SRENG工具是可以用的，只是你的系统时间已被病毒改为2005年了。

你先改看看。

不能改，就进BIOS改。

被病毒玩的人 - 2007-5-7 9:03:00

怎么改?我看我低下的时间都是正常的

被病毒玩的人 - 2007-5-7 9:05:00

我发现了.的确被该成2005年了.我现在已经该回来了..

我现在船日至

被病毒玩的人 - 2007-5-7 9:08:00

[CODE]

2007-05-07,08:54:54

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<stup.exe><C:\PROGRA~1\TENCENT\Adplus\stup.exe> [Tencent]
<runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<RavStub><"C:\Program Files\Rising\Rav\ravstub.exe" /RUNONCE> [Beijing Rising Technology Co., Ltd.]
<KKDelay><C:\Program Files\Rising\AntiSpyware\RunOnce.exe> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><EXPLORER.EXE> [(Verified)Microsoft Windows Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
<{BC207F7D-3E63-4ACA-99B5-FB5F8428200C}><> [N/A]
<{754FB7D8-B8FE-4810-B363-A788CD060F1F}><C:\Program Files\Internet Explorer\PLUGINS\System64.sys> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
<WinlogonNotify: WgaLogon><WgaLogon.dll> [(Verified)Microsoft Corporation]

==================================
启动文件夹
N/A

==================================
服务
[Performance Moniter / 8NASCAR][Stopped/Auto Start]
<C:\WINDOWS\SYSTEM32\RUNDLLFROMWIN2000.EXE C:\WINDOWS\SYSTEM32\WBEM\ADPWZ.DLL,Export 1087><N/A>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Distributed Console Manager / Live][Running/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\sower.dll><Microsoft Corporation>
[Rising Proxy Service / RfwProxySrv][Stopped/Manual Start]
<c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService][Running/Auto Start]
<c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>

==================================
驱动程序
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Stopped/Manual Start]
<system32\drivers\ac97intc.sys><Intel Corporation>
[ADProt / ADProt][Stopped/System Start]
<\SystemRoot\system32\drivers\ADProt.sys><腾讯科技（深圳）有限公司>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[AMD K8 Processor Driver / AmdK8][Stopped/Manual Start]
<System32\DRIVERS\amdk8.sys><Advanced Micro Devices>
[AntiyFirewall / AntiyFirewall][Running/Auto Start]
<system32\drivers\AntiyFW.sys><N/A>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[d347bus / d347bus][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\d347bus.sys><>
[d347prt / d347prt][Running/Boot Start]
<\SystemRoot\System32\Drivers\d347prt.sys><>
[EagleNT / EagleNT][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\EagleNT.sys><N/A>
[ExpScaner / ExpScaner][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\ExpScan.sys><>
[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Stopped/Manual Start]
<system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
[HookCont / HookCont][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising>
[HookUrl / HookUrl][Running/Auto Start]
<\??\C:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[C:\WINDOWS\system32\drivers\IOPort.sys / IOPort][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\IOPort.sys><N/A>
[maqfkf / maqfkf][Stopped/Boot Start]
<\SystemRoot\\SystemRoot\System32\drivers\maqfkf.sys><N/A>
[MEMSCAN / MEMSCAN][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[mProcRs / mProcRs][Running/Auto Start]
<\??\c:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\D:\QQ\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[npkycryp / npkycryp][Stopped/Manual Start]
<\??\D:\QQ\QQ\npkycryp.sys><N/A>
[nv / nv][Stopped/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[puuxedi / puuxedi][Stopped/Boot Start]
<\SystemRoot\system32\drivers\puuxedi.sys><N/A>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
<\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[RsFwDrv / RsFwDrv][Running/Auto Start]
<\??\C:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[Realtek 10/100/1000 NIC Family all in one NDIS XP Driver / RTL8023xp][Running/Manual Start]
<system32\DRIVERS\Rtnicxp.sys><Realtek Semiconductor Corporation>
[Sony Ericsson Device 069 driver (WDM) / se45bus][Stopped/Manual Start]
<system32\DRIVERS\se45bus.sys><MCCI>
[Sony Ericsson Device 069 USB WMC Modem Filter / se45mdfl][Stopped/Manual Start]
<system32\DRIVERS\se45mdfl.sys><MCCI>
[Sony Ericsson Device 069 USB WMC Modem Driver / se45mdm][Stopped/Manual Start]
<system32\DRIVERS\se45mdm.sys><MCCI>
[Sony Ericsson Device 069 USB WMC Device Management Drivers (WDM) / se45mgmt][Stopped/Manual Start]
<system32\DRIVERS\se45mgmt.sys><MCCI>
[Sony Ericsson Device 069 USB Ethernet Emulation SEMC45 (NDIS) / se45nd5][Stopped/Manual Start]
<system32\DRIVERS\se45nd5.sys><MCCI>
[Sony Ericsson Device 069 USB WMC OBEX Interface / se45obex][Stopped/Manual Start]
<system32\DRIVERS\se45obex.sys><MCCI>
[Sony Ericsson Device 069 USB Ethernet Emulation SEMC45 (WDM) / se45unic][Stopped/Manual Start]
<system32\DRIVERS\se45unic.sys><MCCI>
[Secdrv / Secdrv][Running/Auto Start]
<system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
[StarForce Protection Environment Driver (version 1.x.a) / sfdrv01a][Running/Boot Start]
<\SystemRoot\System32\drivers\sfdrv01a.sys><Protection Technology (StarForce)>
[StarForce Protection Helper Driver (version 2.x) / sfhlp02][Running/Boot Start]
<\SystemRoot\System32\drivers\sfhlp02.sys><Protection Technology (StarForce)>
[StarForce Protection Synchronization Driver (version 4.x) / sfsync04][Running/Boot Start]
<\SystemRoot\System32\drivers\sfsync04.sys><Protection Technology (StarForce)>
[SiS315 / SiS315][Running/Manual Start]
<system32\DRIVERS\sisgrp.sys><Silicon Integrated Systems Corporation>
[SiSkp / SiSkp][Running/System Start]
<system32\DRIVERS\srvkp.sys><Silicon Integrated Systems Corporation>
[sptd / sptd][Running/Boot Start]
<\SystemRoot\System32\Drivers\sptd.sys><N/A>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
<system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[Vimicro USB PC Camera (ZC0301PL) / ZSMC301b][Running/Manual Start]
<System32\Drivers\usbVM31b.sys><VM>

被病毒玩的人 - 2007-5-7 9:09:00

==================================
浏览器加载项
[Thunder Browser Helper]
{00000000-12C8-4305-82F9-43058F20E8D2} <D:\xun\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[ThunderAtOnce Class]
{01443AEC-0FD1-40fd-9C87-E93D1494C233} <D:\xun\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[Tencent Browser Helper]
{0C7C23EF-A848-485B-873C-0ED954731014} <C:\Program Files\TENCENT\Adplus\SSAddr.dll, Tencent>
[IeHelper Class]
{0D42E1BD-09DD-4873-A826-9C7E793EB7B6} <D:\xun\Components\ResWorker\DSIeHelper.dll, Thunder Networking Technologies,LTD>
[]
{669751ED-D558-49AE-B01A-3B374CC7910E} <C:\WINDOWS\system32\ssup.dll, TENCENT>
[BDHlprObj Class]
{CA92B524-BC8A-4610-BD2C-6BD3E28155D0} <C:\WINDOWS\DOWNLO~1\BDHelper.dll, >
[启动迅雷5]
{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <D:\xun\Thunder.exe, Thunder Networking Technologies,LTD>
[信息检索(&R)]
{92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <D:\QQ\QQ\QQ.EXE, TENCENT>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\KakaTool.dll, Beijing Rising Technology Co., Ltd.>
[ActozWebLauncher Control]
{0B386B45-B2CF-4525-82FE-D3489C2D26C9} <C:\WINDOWS\DOWNLO~1\PACTOZ~1.OCX, >
[Edit Class]
{0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\WINDOWS\system32\CMBEdit.dll, >
[Windows Genuine Advantage Validation Tool]
{17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\legitcheckcontrol.dll, Microsoft Corporation>
[PowerPlr Control]
{2354A44B-3CEB-4829-9940-545B03103538} <C:\WINDOWS\DOWNLO~1\PowerPlr.ocx, 创智数码科技股份有限公司>
[PhotoDraw Class]
{2375BEE5-F175-4F1C-81EC-8E4E2E72E2DD} <C:\WINDOWS\system32\QQPhotoDraw.dll, TENCENT>
[VodoneCtrl Class]
{759AA6A5-76B2-43E2-B940-B0C336C69E01} <C:\WINDOWS\DOWNLO~1\VODONE~1.DLL, >
[ChinaCache加速下载客户端]
{BAC112DD-C51E-4712-A622-77C1D8075072} <C:\WINDOWS\DOWNLO~1\P2SPCP~1.DLL, >
[Tencent Safety Online Base Module]
{C09B522F-8AED-4E21-A65C-DC1AB652BAEE} <C:\WINDOWS\DOWNLO~1\TSOBase.ocx, Tencent Corporation>
[WebActivater Control]
{C661F36D-DF85-4EF4-83C7-E107B83D04B1} <C:\WINDOWS\system32\3DShowVM.ocx, QQ>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[UpdateC2 Control]
{DC7094C6-8F61-42ED-AECE-63F5EEF647C5} <C:\PROGRA~1\UUSee\updateC2.ocx, N/A>
[Rising Web Scan Object]
{E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.>
[PasswordEditCtrl Class]
{E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
[Thunder Browser Helper]
{00000000-12C8-4305-82F9-43058F20E8D2} <D:\xun\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[ThunderAtOnce Class]
{01443AEC-0FD1-40FD-9C87-E93D1494C233} <D:\xun\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[Tencent Browser Helper]
{0C7C23EF-A848-485B-873C-0ED954731014} <C:\Program Files\TENCENT\Adplus\SSAddr.dll, Tencent>
[Edit Class]
{0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\WINDOWS\system32\CMBEdit.dll, >
[IeHelper Class]
{0D42E1BD-09DD-4873-A826-9C7E793EB7B6} <D:\xun\Components\ResWorker\DSIeHelper.dll, Thunder Networking Technologies,LTD>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[WEBChatRoomOCX Control]
{448A5F6B-8C03-4B54-A338-F00237C508AD} <F:\新建文件夹\UCWEBChatRoom\UCWEBChatRoom.ocx, N/A>
[]
{669751ED-D558-49AE-B01A-3B374CC7910E} <C:\WINDOWS\system32\ssup.dll, TENCENT>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Active Desktop Mover]
{72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
[AxInputControl Class]
{73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\WINDOWS\system32\INPUTC~1.DLL, >
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <D:\xun\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[AxSubmitControl Class]
{8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} <C:\WINDOWS\system32\SUBMIT~1.DLL, >
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[WebActivater Control]
{C661F36D-DF85-4EF4-83C7-E107B83D04B1} <C:\WINDOWS\system32\3DShowVM.ocx, QQ>
[BDHlprObj Class]
{CA92B524-BC8A-4610-BD2C-6BD3E28155D0} <C:\WINDOWS\DOWNLO~1\BDHelper.dll, >
[AUDIO__MP3 Moniker Class]
{CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\KakaTool.dll, Beijing Rising Technology Co., Ltd.>
[Rising Web Scan Object]
{E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.>
[PasswordEditCtrl Class]
{E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
[上传到QQ网络硬盘]
<D:\QQ\QQ\AddToNetDisk.htm, N/A>
[使用ChinaCache P2SP 加速下载(&C)]
<C:\Program Files\p2spcd\\P2SPDown.htm, N/A>
[使用迅雷下载]
<D:\xun\Program\geturl.htm, N/A>
[使用迅雷下载全部链接]
<D:\xun\Program\getallurl.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
<D:\QQ\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<D:\QQ\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<D:\QQ\QQ\SendMMS.htm, N/A>

被病毒玩的人 - 2007-5-7 9:09:00

==================================
正在运行的进程
[PID: 512][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 584][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 608][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\WgaLogon.dll] [Microsoft Corporation, 1.7.0018.5]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 652][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 664][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1584][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
[C:\Program Files\Internet Explorer\PLUGINS\System64.sys] [N/A, ]
[C:\WINDOWS\downlo~1\Ebvs.dll] [Tencent, 4, 5, 1, 15]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[D:\xun\Components\ResWorker\DSIeHelper.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 2]
[D:\xun\Components\ResWorker\DataProcessor.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
[C:\WINDOWS\DOWNLO~1\BDHelper.dll] [, 1, 0, 0, 6]
[c:\windows\system32\sower.dll] [Microsoft Corporation, 5.1.2600.0]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
[PID: 1880][c:\program files\rising\rfw\RfwMain.exe] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 70]
[c:\program files\rising\rfw\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33]
[c:\program files\rising\rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[c:\program files\rising\rfw\RfwCtrl.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]
[c:\program files\rising\rfw\RsXML.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
[c:\program files\rising\rfw\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\Program Files\Internet Explorer\PLUGINS\System64.sys] [N/A, ]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINDOWS\downlo~1\Ebvs.dll] [Tencent, 4, 5, 1, 15]
[PID: 484][C:\Program Files\Rising\AntiSpyware\runiep.exe] [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6]
[C:\Program Files\Rising\AntiSpyware\iep_ctrl.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Program Files\Internet Explorer\PLUGINS\System64.sys] [N/A, ]
[C:\WINDOWS\downlo~1\Ebvs.dll] [Tencent, 4, 5, 1, 15]
[PID: 184][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Internet Explorer\PLUGINS\System64.sys] [N/A, ]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINDOWS\downlo~1\Ebvs.dll] [Tencent, 4, 5, 1, 15]
[PID: 1488][C:\WINDOWS\system32\WgaTray.exe] [Microsoft Corporation, 1.7.0018.5]
[C:\Program Files\Internet Explorer\PLUGINS\System64.sys] [N/A, ]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINDOWS\downlo~1\Ebvs.dll] [Tencent, 4, 5, 1, 15]
[PID: 3212][C:\WINDOWS\explorer.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\downlo~1\Ebvs.dll] [Tencent, 4, 5, 1, 15]
[C:\Program Files\Internet Explorer\PLUGINS\System64.sys] [N/A, ]
[D:\xun\Components\ResWorker\DataProcessor.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
[C:\WINDOWS\DOWNLO~1\BDHelper.dll] [, 1, 0, 0, 6]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[PID: 3244][D:\QQ\TT\TTraveler.exe] [腾讯公司, 3, 3, 200, 290]
[C:\WINDOWS\downlo~1\Ebvs.dll] [Tencent, 4, 5, 1, 15]
[C:\Program Files\Internet Explorer\PLUGINS\System64.sys] [N/A, ]
[D:\QQ\TT\Plugins\QQFloatBar\QQFloatBar4TT2.dll] [腾讯公司, 1, 1, 0, 5]
[D:\QQ\TT\Plugins\TWeather\TWeather.dll] [, 1, 0, 0, 3]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[D:\QQ\TT\TTNetFavor.dll] [N/A, ]
[C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\UNISPIM.IME] [北京清华紫光软件股份有限公司, 3.0.0.3045]
[C:\WINDOWS\system32\WINABCX.IME] [PKUETI, 5.22.216]
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] [, 1, 0, 0, 4]
[PID: 3936][D:\xun\Program\Thunder5.exe] [Thunder Networking Technologies,LTD, 5, 6, 1, 292]
[C:\WINDOWS\downlo~1\Ebvs.dll] [Tencent, 4, 5, 1, 15]
[C:\Program Files\Internet Explorer\PLUGINS\System64.sys] [N/A, ]
[D:\xun\Program\TaskManager.dll] [Thunder Networking Technologies,LTD, 1, 1, 0, 20]
[D:\xun\Program\download_interface.dll] [Thunder Networking Technologies,LTD, 2, 14, 2, 77]
[D:\xun\Program\stlport_vc646.dll] [STLport Consulting, Inc., 4.6.2003.1031]
[D:\xun\Program\asyn_dns.dll] [Thunder Networking Technologies,LTD, 2, 14, 2, 77]
[D:\xun\Program\BHOStub.dll] [Thunder Networking Technologies,LTD, 1, 1, 0, 8]
[D:\xun\Components\DownAndPlay\DownAndPlay.dll] [, 1, 0, 0, 2]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[D:\xun\Program\iTargetAD.dll] [Thunder Networking Technologies,LTD, 1, 0, 2, 26]
[C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[D:\xun\Components\InMedia\iEmbedShell.dll] [　, 1, 0, 0, 17]
[D:\xun\Components\Community\XLCommunity.dll] [Thunder Networking Technologies,LTD, 1, 0, 6, 26]
[D:\xun\Program\LiveUpdate.dll] [Thunder Networking Technologies,LTD, 1, 1, 1, 20]
[D:\xun\Components\Search\XLSearch.dll] [Thunder Networking Technologies,LTD, 1, 1, 1, 10]
[D:\xun\Components\P4PClient\P4PClient.dll] [Thunder Networking Technologies,LTD, 2, 2, 1, 46]
[D:\xun\Components\DiagnoseHelper\DiagnoseHelper.dll] [Thunder Networking Technologies,LTD, 1, 1, 1, 16]
[D:\xun\Components\ExplorerHelper\ExplorerHelper.dll] [Thunder Networking Technologies,LTD, 1, 0, 4, 15]
[D:\xun\Components\Tips\TipsClient.dll] [Thunder Networking Technologies,LTD, 2, 1, 3, 58]
[D:\xun\Components\VPSHELL\VPSHELL.dll] [XunLei, 1, 2, 0, 8]
[D:\xun\Components\UserExperience\UserExperience.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
[D:\xun\Components\ResWorker\DsXlCom.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 4]
[D:\xun\Components\InMedia\iEmbed09.dll] [　, 3, 3, 0, 80]
[D:\xun\Program\RegisterDll.dll] [Thunder Networking Technologies,LTD, 2, 13, 2, 61]
[D:\xun\Plugins\BhoAdv\bho_adv.dll] [深圳市迅雷网络技术有限公司, 1.0.1.0]
[D:\xun\Components\VPSHELL\VideoPicture.dll] [XunLei, 1, 2, 0, 9]
[C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[D:\xun\Components\ResWorker\DataProcessor.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
[D:\xun\Program\XLNet.Dll] [Thunder Networking Technologies,LTD, 1, 2, 0, 8]
[D:\xun\Components\ResWorker\MediaWorker.dll] [Thunder Networking Technologies,LTD, 1, 2, 0, 8]
[PID: 2476][F:\木马防线\Antiy Labs\AGB4\gb.exe] [Antiy Labs, 4, 2, 2, 0]
[F:\木马防线\Antiy Labs\AGB4\regsafe.dll] [TODO: <公司名>, 1.0.0.1]
[C:\WINDOWS\downlo~1\Ebvs.dll] [Tencent, 4, 5, 1, 15]
[C:\Program Files\Internet Explorer\PLUGINS\System64.sys] [N/A, ]
[F:\木马防线\Antiy Labs\AGB4\AMisc.dll] [Antiy Labs, 1, 4, 1, 0]
[F:\木马防线\Antiy Labs\AGB4\agbdb.dll] [N/A, ]
[F:\木马防线\Antiy Labs\AGB4\MSVCP60.dll] [Microsoft Corporation, 6.00.8168.0]
[F:\木马防线\Antiy Labs\AGB4\MFC42.DLL] [Microsoft Corporation, 6.00.8665.0]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[F:\木马防线\Antiy Labs\AGB4\Engine\DEngine.dll] [Antiy Labs, 1, 0, 5, 0]
[F:\木马防线\Antiy Labs\AGB4\Psapi.dll] [Microsoft Corporation, 5.00.2134.1]
[F:\木马防线\Antiy Labs\AGB4\Engine\DPack.dll] [Antiy Labs, 1, 0, 0, 2]
[F:\木马防线\Antiy Labs\AGB4\UNRAR.DLL] [N/A, ]
[F:\木马防线\Antiy Labs\AGB4\Engine\DScan.dll] [Antiy Labs, 1, 5, 1, 0]
[F:\木马防线\Antiy Labs\AGB4\Engine\tool.dll] [Antiy Labs, 1, 1, 1, 0]
[PID: 2604][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.375\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
[C:\WINDOWS\downlo~1\Ebvs.dll] [Tencent, 4, 5, 1, 15]
[C:\Program Files\Internet Explorer\PLUGINS\System64.sys] [N/A, ]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]

==================================
文件关联
.TXT Error. [C:\WINDOWS\notepad.exe %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM Error. ["hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================

[/CODE]

瑞星卡卡安全论坛