完蛋了,我又中毒了 bbs.ikaka.com

Jawin - 2007-5-15 8:48:00

Logfile of Kaka v2. 0. 3. 0 Scan Module v1. 0. 6. 1
Scan saved at 08:33:59, on 2007-05-15
Platform: Microsoft Windows 2000 Professional Service Pack 4 (Build 2195)
MSIE: Internet Explorer v6.00 SP1;Q832894;Q823353;Q833989;Q903235; (6.00.2800.1106)

O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Thunder Browser Helper - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll
O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINNT\system32\kakatool.dll
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [runeip] C:\Program Files\Rising\AntiSpyware\runiep.exe
O4 - HKLM\..\Run: [WangWang] "E:\jm floder\WangWang\WangWang.EXE"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [wosa] C:\WINNT\TEMP\woso.exe
O4 - HKLM\..\Run: [ztsa] C:\WINNT\TEMP\ztso.exe
O4 - HKLM\..\Run: [mhsa] C:\WINNT\TEMP\mhso.exe
O4 - HKLM\..\Run: [fysa] C:\WINNT\TEMP\fyso.exe
O4 - HKLM\..\Run: [jtsa] C:\WINNT\TEMP\jtso.exe
O4 - HKLM\..\Run: [wlsa] C:\WINNT\TEMP\wlso.exe
O4 - HKLM\..\Run: [wgsa] C:\WINNT\TEMP\wgso.exe
O4 - HKLM\..\Run: [wmsa] C:\WINNT\TEMP\wmso.exe
O4 - HKLM\..\Run: [qjsa] C:\WINNT\TEMP\qjso.exe
O4 - HKLM\..\Run: [rxsa] C:\WINNT\TEMP\rxso.exe
O4 - HKLM\..\Run: [wdsa] C:\WINNT\TEMP\wdso.exe
O8 - Extra context menu item: 上传到QQ网络硬盘 - E:\jm floder\TM\AddToNetDisk.htm
O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: 使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: 使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - E:\jm floder\TM\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - E:\jm floder\TM\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - E:\jm floder\TM\SendMMS.htm
O9 - Extra Button: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - Extra 'Tools' menuitem: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - Extra Button: @shdoclc.dll,-866 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: @shdoclc.dll,-864 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\system32\shdocvw.dll
O9 - Extra Button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - E:\jm floder\TM\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - E:\jm floder\TM\QQ.EXE
O9 - Extra Button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
O15 - Trusted Zone: mybank.icbc.com.cn
O15 - Trusted Zone: http://www.icbc.com.cn
O16 - DPF: {1E0DFFCF-27FF-4574-849B-55007349FEDA} (iTrusPTA Class) - https://img.alipay.com/download/1101/aliedit.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9C795B32-1F3B-4601-BBE0-E176920066C2}: NameServer = 211.95.193.97
O18 - Filter : application/octet-stream - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll
O18 - Filter : application/x-complus - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll
O18 - Filter : application/x-msdownload - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll
O18 - Protocol: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: ipp - (no CLSID) - (no file)
O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINNT\system32\itss.dll
O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll
O18 - Protocol: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll
O18 - Protocol: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINNT\system32\inetcomm.dll
O18 - Protocol: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINNT\system32\itss.dll
O18 - Protocol: msdaipp - (no CLSID) - (no file)
O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll
O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINNT\system32\mshtml.dll
O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll
O18 - Protocol: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINNT\system32\msdxm.ocx
O20 - Winlogon Notify: igfxcui
O20 - Winlogon Notify: wzcnotif
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\system32\dmadmin.exe /com
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - "C:\Program Files\Rising\Rav\CCenter.exe"
O23 - Service: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - "C:\PROGRAM FILES\RISING\RAV\Ravmond.exe"

姑苏残月 - 2007-5-15 8:53:00

问题严重.换SRENG日志

lansely - 2007-5-15 9:00:00

问题很严重么？
把TEMP删了注册表里删了还有什么问题？

姑苏残月 - 2007-5-15 9:04:00

换日志

Jawin - 2007-5-15 9:06:00

用什么软件扫描?

Jawin - 2007-5-15 9:07:00

用什么软件扫描?

lee523 - 2007-5-15 9:11:00

替高手回复一下^_^

下载 System Repair Engineer，
http://www.kztechs.com/sreng/download.html
1 解压缩sreng2.zip
2 运行SREng.exe
3 智能扫描=》扫描=》保存报告
4 把日志中的报告完整拷贝贴上来，不要修改
日志一次发不完，请分次发上来

Jawin - 2007-5-15 9:28:00

[CODE]

2007-05-15,09:09:53

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<Internat.exe><internat.exe> [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
<run><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe> [Beijing Rising Technology Co., Ltd.]
<WangWang><"E:\jm floder\WangWang\WangWang.EXE"> [阿里巴巴软件（上海）有限公司]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows 2000 Publisher]
<Userinit><C:\WINNT\system32\userinit.exe,> [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><C:\WINNT\system32\sstext3d.scr> [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<ccApp><; "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"> [N/A]
<HotKeysCmds><; C:\WINNT\system32\hkcmd.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<IgfxTray><; C:\WINNT\system32\igfxtray.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<StormCodec_Helper><; "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti> []
<Synchronization Manager><; mobsync.exe /logon> [(Verified)Microsoft Windows 2000 Publisher]
<TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]

==================================
启动文件夹
N/A

==================================
服务
[Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start]
<C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
<"C:\PROGRAM FILES\RISING\RAV\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[Visual Studio Analyzer RPC bridge / Visual Studio Analyzer RPC bridge][Stopped/Manual Start]
<C:\Program Files\Microsoft Visual Studio\Common\Tools\VS-Ent98\Vanalyzr\varpc.exe><Microsoft Corporation>
[Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start]
<C:\WINNT\System32\svchost.exe -k netsvcs-->C:\WINNT\system32\mspmsnsv.dll><Microsoft Corporation>

==================================
驱动程序
[BaseTDI / BaseTDI][Running/Auto Start]
<\??\C:\WINNT\system32\drivers\basetdi.sys><Beijing Rising Technology Co., Ltd.>
[dmboot / dmboot][Stopped/Disabled]
<System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio][Running/Boot Start]
<\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload][Running/Boot Start]
<\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[ExpScaner / ExpScaner][Running/Auto Start]
<\??\C:\PROGRAM FILES\RISING\RAV\ExpScan.sys><>
[HookCont / HookCont][Running/Auto Start]
<\??\C:\PROGRAM FILES\RISING\RAV\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
<\??\C:\PROGRAM FILES\RISING\RAV\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
<\??\C:\PROGRAM FILES\RISING\RAV\HookSys.sys><Rising>
[ialm / ialm][Running/Manual Start]
<system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[MEMSCAN / MEMSCAN][Running/Auto Start]
<\??\C:\PROGRAM FILES\RISING\RAV\MEMSCAN.sys><瑞星软件有限公司>
[Netgroup Packet Filter / NPF][Stopped/Manual Start]
<system32\DRIVERS\npf.sys><CACE Technologies>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\E:\jm floder\TM\TMDlls\npkcrypt.sys><INCA Internet Co., Ltd.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
<\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
<\??\C:\PROGRAM FILES\RISING\RAV\RSPPSYS.sys><Rising>
[Realtek RTL8029(AS)-based PCI Ethernet Adapter NT Driver / rtl8029][Running/Manual Start]
<system32\DRIVERS\RTL8029.SYS><REALTEK Semiconductor Corp.>
[Realtek RTL8139-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[SerMon / SerMon][Stopped/Manual Start]
<\??\C:\Program Files\Ser232Mon\sermon.sys><N/A>
[sptd / sptd][Running/Boot Start]
<\SystemRoot\System32\Drivers\sptd.sys><N/A>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
<system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>

==================================
浏览器加载项
[Adobe PDF Reader Link Helper]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[启动迅雷5]
{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <C:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <E:\jm floder\TM\QQ.EXE, TENCENT>
[FlashGet]
{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\flashget.exe, Amaze Soft>
[@msdxmLC.dll,-1@2052,电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINNT\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[iTrusPTA Class]
{1E0DFFCF-27FF-4574-849B-55007349FEDA} <C:\WINNT\system32\aliedit\pta.dll, >
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>
[WangWangObj Class]
{6E213FC7-DD5A-4115-B7E6-D4C7838C361E} <E:\jm floder\WangWang\WangWangX4.dll, 阿里软件（中国）有限公司>
[上传到QQ网络硬盘]
<E:\jm floder\TM\AddToNetDisk.htm, N/A>
[使用网际快车下载]
<C:\Program Files\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<C:\Program Files\FlashGet\jc_all.htm, N/A>
[使用迅雷下载]
<C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
[使用迅雷下载全部链接]
<C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
[添加到QQ自定义面板]
<E:\jm floder\TM\AddPanel.htm, N/A>
[添加到QQ表情]
<E:\jm floder\TM\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<E:\jm floder\TM\SendMMS.htm, N/A>

==================================

Jawin - 2007-5-15 9:30:00

正在运行的进程
[PID: 200][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.00.2195.6601]
[PID: 224][\??\C:\WINNT\system32\csrss.exe] [Microsoft Corporation, 5.00.2195.6601]
[PID: 244][\??\C:\WINNT\system32\winlogon.exe] [Microsoft Corporation, 5.00.2195.6970]
[C:\WINNT\system32\wdmaud.drv] [Microsoft Corporation, 5.00.2195.6673]
[PID: 272][C:\WINNT\system32\services.exe] [Microsoft Corporation, 5.00.2195.6700]
[C:\WINNT\system32\dmserver.dll] [VERITAS Software Corp., 2195.6605.297.3]
[PID: 1012][C:\WINNT\Explorer.EXE] [Microsoft Corporation, 5.00.3700.6690]
[C:\WINNT\AppPatch\AcLayers.DLL] [Microsoft Corporation, 5.00.2195.6717]
[C:\WINNT\system32\wdmaud.drv] [Microsoft Corporation, 5.00.2195.6673]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINNT\TEMP\woso0.dll] [N/A, ]
[C:\WINNT\TEMP\ztso0.dll] [N/A, ]
[C:\WINNT\TEMP\mhso0.dll] [N/A, ]
[C:\WINNT\TEMP\fyso0.dll] [N/A, ]
[C:\WINNT\TEMP\jtso0.dll] [N/A, ]
[C:\WINNT\TEMP\wlso0.dll] [N/A, ]
[C:\WINNT\TEMP\wgso0.dll] [N/A, ]
[C:\WINNT\TEMP\wmso0.dll] [N/A, ]
[C:\WINNT\TEMP\qjso0.dll] [N/A, ]
[C:\WINNT\TEMP\rxso0.dll] [N/A, ]
[C:\WINNT\TEMP\wdso0.dll] [N/A, ]
[C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 8.0.0.0]
[C:\WINNT\system32\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.163]
[C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 8.0.0.2006102200]
[C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 2, 17]
[PID: 1252][C:\Program Files\Rising\AntiSpyware\runiep.exe] [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6]
[C:\Program Files\Rising\AntiSpyware\iep_ctrl.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 1244][E:\jm floder\WangWang\WangWang.EXE] [阿里巴巴软件（上海）有限公司, 5, 1, 0, 9]
[E:\jm floder\WangWang\MFC80.DLL] [Microsoft Corporation, 8.00.50727.42]
[E:\jm floder\WangWang\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.42]
[E:\jm floder\WangWang\MSVCP80.dll] [Microsoft Corporation, 8.00.50727.42]
[E:\jm floder\WangWang\MFC80CHS.DLL] [Microsoft Corporation, 8.00.50727.42]
[E:\jm floder\WangWang\AliSkin.dll] [阿里巴巴软件（上海）有限公司, 1.0.0.1]
[E:\jm floder\WangWang\zlib.dll] [, 1.2.3]
[E:\jm floder\WangWang\Ali_Res.DLL] [N/A, ]
[E:\jm floder\WangWang\WangWangX4.dll] [阿里软件（中国）有限公司, 1, 0, 0, 1]
[E:\jm floder\WangWang\RICHED32.DLL] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[E:\jm floder\WangWang\RICHED20.dll] [Microsoft Corporation, 5.30.23.1221]
[E:\jm floder\WangWang\RichOne.dll] [阿里巴巴软件（上海）有限公司, 1.0.0.1]
[E:\jm floder\WangWang\TBProgress.dll] [阿里巴巴软件（上海）有限公司, 1.0.0.1]
[E:\jm floder\WangWang\MessageNotify.dll] [, 1, 0, 0, 1]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[E:\jm floder\WangWang\ww_network.dll] [, 1, 0, 1, 23]
[C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINNT\system32\wdmaud.drv] [Microsoft Corporation, 5.00.2195.6673]
[E:\jm floder\WangWang\AliViewMedia.dll] [阿里巴巴软件（上海）有限公司, 1, 0, 0, 2]
[E:\jm floder\WangWang\VLNetwork.dll] [阿里巴巴软件（上海）有限公司, 1, 0, 0, 6]
[E:\jm floder\WangWang\VideoCap.dll] [, 1, 0, 0, 4]
[E:\jm floder\WangWang\VLAudio.dll] [阿里巴巴软件（上海）有限公司, 1, 0, 0, 5]
[E:\jm floder\WangWang\JsmShow.dll] [阿里巴巴软件（上海）有限公司, 1, 0, 0, 4]
[C:\WINNT\system32\msdmo.dll] [, ]
[C:\WINNT\TEMP\wdso0.dll] [N/A, ]
[C:\WINNT\TEMP\rxso0.dll] [N/A, ]
[C:\WINNT\TEMP\qjso0.dll] [N/A, ]
[C:\WINNT\TEMP\wmso0.dll] [N/A, ]
[C:\WINNT\TEMP\wgso0.dll] [N/A, ]
[C:\WINNT\TEMP\fyso0.dll] [N/A, ]
[C:\WINNT\TEMP\wlso0.dll] [N/A, ]
[C:\WINNT\TEMP\jtso0.dll] [N/A, ]
[C:\WINNT\TEMP\mhso0.dll] [N/A, ]
[C:\WINNT\TEMP\ztso0.dll] [N/A, ]
[C:\WINNT\TEMP\woso0.dll] [N/A, ]
[PID: 1224][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] [RealNetworks, Inc., 0.1.0.3208]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 1464][C:\WINNT\system32\internat.exe] [Microsoft Corporation, 5.00.2920.0000]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 348][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2800.1106]
[C:\WINNT\system32\kakatool.dll] [Beijing Rising Technology Co., Ltd., 2, 0, 3, 0]
[C:\WINNT\system32\MSDART.DLL] [Microsoft Corporation, 2.81.1117.0 built by: (_sqlbld)]
[C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 8.0.0.2006102200]
[C:\WINNT\system32\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.163]
[C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 2, 17]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINNT\TEMP\wdso0.dll] [N/A, ]
[C:\WINNT\TEMP\rxso0.dll] [N/A, ]
[C:\WINNT\TEMP\qjso0.dll] [N/A, ]
[C:\WINNT\TEMP\wmso0.dll] [N/A, ]
[C:\WINNT\TEMP\wgso0.dll] [N/A, ]
[C:\WINNT\TEMP\fyso0.dll] [N/A, ]
[C:\WINNT\TEMP\wlso0.dll] [N/A, ]
[C:\WINNT\TEMP\jtso0.dll] [N/A, ]
[C:\WINNT\TEMP\mhso0.dll] [N/A, ]
[C:\WINNT\TEMP\ztso0.dll] [N/A, ]
[C:\WINNT\TEMP\woso0.dll] [N/A, ]
[C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINNT\system32\Macromed\Flash\Flash9c.ocx] [Adobe Systems, Inc., 9,0,45,0]
[C:\WINNT\system32\wdmaud.drv] [Microsoft Corporation, 5.00.2195.6673]
[C:\WINNT\system32\JPWB.IME] [常诚研制, 4.00.950]

Jawin - 2007-5-15 9:31:00

[PID: 1688][C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\MSDEV.EXE] [Microsoft Corporation, 6.00.9782.2]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\devshl.dll] [Microsoft Corporation, 6.00.9782.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\devedit.pkg] [Microsoft Corporation, 6.00.9782.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\devprj.pkg] [Microsoft Corporation, 6.00.8447.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\devbld.pkg] [Microsoft Corporation, 6.00.9782.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\devaut1.pkg] [Microsoft Corporation, 6.00.8447.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\devbied.pkg] [Microsoft Corporation, 6.00.8168.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\devclvw.pkg] [Microsoft Corporation, 6.00.8447.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\devcpp.pkg] [Microsoft Corporation, 6.00.8798.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\devdbg.pkg] [Microsoft Corporation, 6.00.8804.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\devdtg.pkg] [Microsoft Corporation, 6.00.8168.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\devent.pkg] [Microsoft Corporation, 6.00.8168.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\devgal.pkg] [Microsoft Corporation, 6.00.8168.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\devhelp.pkg] [Microsoft Corporation, 6.00.8168.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\devhtmx.pkg] [Microsoft Corporation, 6.00.8168.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\devncb.pkg] [Microsoft Corporation, 6.00.8168.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\devodl.pkg] [Microsoft Corporation, 6.00.8168.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\devres.pkg] [Microsoft Corporation, 6.00.8168.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\devtool.pkg] [Microsoft Corporation, 6.00.8168.0]
[C:\Program Files\Microsoft Visual Studio\Common\VSS\win32\SSSCC.DLL] [, 06.00.31222]
[C:\Program Files\Microsoft Visual Studio\Common\VSS\win32\ssus.dll] [, 06.00.31222]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINNT\TEMP\wdso0.dll] [N/A, ]
[C:\WINNT\TEMP\rxso0.dll] [N/A, ]
[C:\WINNT\TEMP\qjso0.dll] [N/A, ]
[C:\WINNT\TEMP\wmso0.dll] [N/A, ]
[C:\WINNT\TEMP\wgso0.dll] [N/A, ]
[C:\WINNT\TEMP\fyso0.dll] [N/A, ]
[C:\WINNT\TEMP\wlso0.dll] [N/A, ]
[C:\WINNT\TEMP\jtso0.dll] [N/A, ]
[C:\WINNT\TEMP\mhso0.dll] [N/A, ]
[C:\WINNT\TEMP\ztso0.dll] [N/A, ]
[C:\WINNT\TEMP\woso0.dll] [N/A, ]
[C:\WINNT\system32\wdmaud.drv] [Microsoft Corporation, 5.00.2195.6673]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\mfcclwz.dll] [Microsoft Corporation, 6.00.8168.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\mspdb60.dll] [Microsoft Corporation, 6.00.8168.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\feacp.dll] [Microsoft Corporation, 12.00.9782.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\SHSQL.DLL] [Microsoft Corporation, 6.00.8168.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\EESWT.DLL] [Microsoft Corporation, 6.00.8168.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\EECXX.DLL] [Microsoft Corporation, 6.00.9782.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\EESQL.DLL] [Microsoft Corporation, 6.00.8982.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\TLLOC.DLL] [Microsoft Corporation, 6.00.8168.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\EM.DLL] [Microsoft Corporation, 6.00.8804.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\MSDIS110.DLL] [Microsoft Corporation, 1.12.9438]
[C:\WINNT\system32\MSVCP60.dll] [Microsoft Corporation, 6.00.8972.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\SHCV.DLL] [Microsoft Corporation, 6.00.8798.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\NMSQL.DLL] [Microsoft Corporation, 6.00.8168.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\msenc10.dll] [Microsoft Corporation, 6.00.8168.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\msobj10.dll] [Microsoft Corporation, 6.00.8168.0]
[C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\dm.dll] [Microsoft Corporation, 6.00.9782.0]
[PID: 1756][C:\WINNT\system32\conime.exe] [Microsoft Corporation, 5.00.2195.6655]
[PID: 452][C:\Program Files\WinRAR\WinRAR.exe] [N/A, ]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINNT\TEMP\wdso0.dll] [N/A, ]
[C:\WINNT\TEMP\rxso0.dll] [N/A, ]
[C:\WINNT\TEMP\qjso0.dll] [N/A, ]
[C:\WINNT\TEMP\wmso0.dll] [N/A, ]
[C:\WINNT\TEMP\wgso0.dll] [N/A, ]
[C:\WINNT\TEMP\fyso0.dll] [N/A, ]
[C:\WINNT\TEMP\wlso0.dll] [N/A, ]
[C:\WINNT\TEMP\jtso0.dll] [N/A, ]
[C:\WINNT\TEMP\mhso0.dll] [N/A, ]
[C:\WINNT\TEMP\ztso0.dll] [N/A, ]
[C:\WINNT\TEMP\woso0.dll] [N/A, ]
[PID: 1704][C:\WINNT\TEMP\Rar$EX00.665\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINNT\TEMP\wdso0.dll] [N/A, ]
[C:\WINNT\TEMP\rxso0.dll] [N/A, ]
[C:\WINNT\TEMP\qjso0.dll] [N/A, ]
[C:\WINNT\TEMP\wmso0.dll] [N/A, ]
[C:\WINNT\TEMP\wgso0.dll] [N/A, ]
[C:\WINNT\TEMP\fyso0.dll] [N/A, ]
[C:\WINNT\TEMP\wlso0.dll] [N/A, ]
[C:\WINNT\TEMP\jtso0.dll] [N/A, ]
[C:\WINNT\TEMP\mhso0.dll] [N/A, ]
[C:\WINNT\TEMP\ztso0.dll] [N/A, ]
[C:\WINNT\TEMP\woso0.dll] [N/A, ]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINNT\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================

[/CODE]

瑞星卡卡安全论坛