中了变形虫病毒，杀不干净 bbs.ikaka.com

风过无声001 - 2007-6-27 8:51:00

第一次发现中的时候是系统启动时提示杀毒软件的DLL文件损坏了，于是重装了一下，杀了一下毒，杀了2百多个变形虫，杀完后重启，又提示防火墙的DLL文件损坏了，重装，快装完的时候提示被用户中止，无法安装

NND，瑞星怎么这么烂的啊

湘m浪子 - 2007-6-27 9:15:00

引用高手的话

下载 System Repair Engineer，
http://www.kztechs.com/sreng/download.html
1 解压缩sreng2.zip
2 运行SREng.exe
3 智能扫描=》扫描=》保存报告
4 把日志中的报告完整拷贝贴上来，不要修改（日志很长，一个帖子搞不完，请手动将全部内容分多个回复帖子传上来）。

风过无声001 - 2007-6-27 9:55:00

[CODE]

2007-06-27,09:38:43

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Server Service Pack 4 (Build 2195) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<Internat.exe><internat.exe> [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe> [Beijing Rising Technology Co., Ltd.]
<SunJavaUpdateSched><C:\Program Files\Java\jre1.5.0\bin\jusched.exe> [Sun Microsystems, Inc.]
<RfwMain><"e:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
<RavTask><"e:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<Synchronization Manager><mobsync.exe /logon> [(Verified)Microsoft Windows 2000 Publisher]
<Spooler SubSystem App><C:\WINNT\system32\spoolsvc.exe> [N/A]
<Application Layer Gateway Service><C:\WINNT\system32\algs.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><EXPLORER.EXE> [(Verified)Microsoft Windows 2000 Publisher]
<Userinit><userinit.exe,> [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINNT\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\PCANotify]
<WinlogonNotify: PCANotify><PCANotify.dll> [Symantec Corporation]
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><(无)> [N/A]

==================================
启动文件夹
[余额查询]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\XX查询.bat --> [N/A]><N>
[服务管理器]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\服务管理器.lnk --> C:\PROGRA~1\MICROS~2\80\Tools\Binn\sqlmangr.exe [Microsoft Corporation]><N>
[XXXX监控]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\XXXX监控.bat --> [N/A]><N>
[jboss4]
<C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\jboss4.lnk --> H:\jboss4\jboss4\bin\run.bat [N/A]><N>
[快捷方式 scktsrvr.exe]
<C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\快捷方式 scktsrvr.exe.lnk --> F:\XXX~1\scktsrvr.exe [Borland Software Corporation]><N>

风过无声001 - 2007-6-27 9:55:00

==================================
服务
[Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start]
<C:\WINNT\System32\Ati2evxx.exe><ATI Technologies Inc.>
[pcAnywhere Host Service / awhost32][Running/Auto Start]
<E:\Program Files\Symantec\pcAnywhere\awhost32.exe><Symantec Corporation>
[Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start]
<C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[Microsoft Search / MSSEARCH][Running/Auto Start]
<"C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe"><Microsoft Corporation>
[MSSQLSERVER / MSSQLSERVER][Running/Auto Start]
<f:\PROGRA~1\MICROS~1\MSSQL\binn\sqlservr.exe><Microsoft Corporation>
[MSSQLServerADHelper / MSSQLServerADHelper][Stopped/Manual Start]
<C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe><Microsoft Corporation>
[Rising Proxy Service / RfwProxySrv][Stopped/Manual Start]
<e:\program files\rising\rfw\rfwproxy.exe><N/A>
[Rising Personal Firewall Service / RfwService][Stopped/Auto Start]
<e:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
<"e:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
<"E:\PROGRAM FILES\RISING\RAV\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[SQLSERVERAGENT / SQLSERVERAGENT][Running/Auto Start]
<f:\PROGRA~1\MICROS~1\MSSQL\binn\sqlagent.exe><Microsoft Corporation>
[Apache Tomcat / Tomcat5][Running/Auto Start]
<e:\Tomcat 5.0\bin\tomcat.exe //RS//Tomcat5><Apache Software Foundation>
[Windows系统 / Windows系统][Stopped/Auto Start]
<C:\WINNT\system32\svchost.txt><N/A>
[Windows Management Service / wms][Running/Auto Start]
<C:\WINNT\system32\wms.exe><N/A>

==================================
驱动程序
[AMGuard MPDriver / AMGuard][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\AMGuard.sys><N/A>
[AntiARP NDIS Protocol Driver / AntiArpNdisProt][Running/Auto Start]
<system32\DRIVERS\AntiArpNdisProt.sys><Windows (R) 2000 DDK provider>
[ati2mtag / ati2mtag][Running/Manual Start]
<System32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[awecho / awecho][Running/System Start]
<system32\drivers\awechomd.sys><Symantec Corporation>
[awlegacy / awlegacy][Running/System Start]
<\SystemRoot\System32\Drivers\awlegacy.sys><Symantec Corporation>
[AW_HOST / AW_HOST][Running/System Start]
<system32\drivers\aw_host5.sys><Symantec Corporation>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[cocpyinf / cocpyinf][Stopped/Disabled]
<\SystemRoot\system32\drivers\cocpyinf.dll><Windows (R) 2000 DDK provider>
[dmboot / dmboot][Stopped/Disabled]
<System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio][Running/Boot Start]
<\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload][Running/Boot Start]
<\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[Intel(R) PRO/1000 Network Connection Driver / E1000][Running/Manual Start]
<System32\DRIVERS\e1000nt5.sys><Intel Corporation>
[ExpScaner / ExpScaner][Running/Auto Start]
<\??\E:\PROGRAM FILES\RISING\RAV\ExpScan.sys><>
[HookCont / HookCont][Running/Auto Start]
<\??\E:\PROGRAM FILES\RISING\RAV\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
<\??\E:\PROGRAM FILES\RISING\RAV\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
<\??\E:\PROGRAM FILES\RISING\RAV\HookSys.sys><Rising>
[HookUrl / HookUrl][Stopped/Auto Start]
<\??\e:\Program Files\Rising\Rfw\HookUrl.sys><N/A>
[MEMSCAN / MEMSCAN][Running/Auto Start]
<\??\E:\PROGRAM FILES\RISING\RAV\MEMSCAN.sys><瑞星软件有限公司>
[mProcRs / mProcRs][Stopped/Auto Start]
<\??\e:\program files\rising\rfw\mProcRs.sys><N/A>
[oreans32 / oreans32][Running/System Start]
<\??\C:\WINNT\system32\drivers\oreans32.sys><N/A>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
<\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising Technology Co., Ltd.>
[RsFwDrv / RsFwDrv][Stopped/Auto Start]
<\??\e:\Program Files\Rising\Rfw\RsFwDrv.sys><N/A>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
<\??\E:\PROGRAM FILES\RISING\RAV\RSPPSYS.sys><Rising>
[SymEvent / SymEvent][Stopped/Manual Start]
<\??\C:\Program Files\Symantec\SYMEVENT.SYS><Symantec Corporation>
[symmpi / symmpi][Running/Boot Start]
<\SystemRoot\system32\drivers\symmpi.sys><LSI Logic>
[xAntiArpSpoof Service / xAntiArp][Running/Manual Start]
<system32\DRIVERS\xAntiArp.sys><Windows (R) 2000 DDK provider>

风过无声001 - 2007-6-27 9:56:00

==================================
浏览器加载项
[WebThunder Browser Helper]
{00000AAA-A363-466E-BEF5-9BB68697AA7F} <e:\Program Files\Thunder Network\WebThunder\WebThunderBHO_016.dll, Thunder Networking Technologies,LTD>
[FGCatchUrl]
{2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <E:\Program Files\FlashGet\jccatch.dll, www.flashget.com>
[FlashGet GetFlash Class]
{F156768E-81EF-470C-9057-481BA8380DBA} <e:\Program Files\FlashGet\getflash.dll, www.flashget.com>
[Java Plug-in 1.5.0]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll, Sun Microsystems, Inc.>
[启动Web迅雷]
{962EFB8E-2683-42d4-AC74-AAA4C759B9C6} <http://my.xunlei.com, N/A>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <e:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[快车]
{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <e:\Program Files\FlashGet\FlashGet.exe, FlashGet.com>
[电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\System32\msdxm.ocx, Microsoft Corporation>
[Java Plug-in 1.5.0]
{8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.5.0]
{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll, Sun Microsystems, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\System32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>
[FGAutoLive]
{F90D830D-C175-4bbe-82C7-FF94669A4C42} <e:\Program Files\FlashGet\fgupdate.dll, www.flashget.com>
[FGCatchUrl]
{FB5DA724-162B-11D3-8B9B-AA70B4B0B524} <E:\Program Files\FlashGet\jccatch.dll, www.flashget.com>
[&使用快车(FlashGet)下载]
<E:\Program Files\FlashGet\jc_link.htm, N/A>
[&使用快车(FlashGet)下载全部链接]
<E:\Program Files\FlashGet\jc_all.htm, N/A>
[上传到QQ网络硬盘]
<E:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用Web迅雷下载]
<e:\Program Files\Thunder Network\WebThunder\GetUrl.htm, N/A>
[使用Web迅雷下载全部链接]
<e:\Program Files\Thunder Network\WebThunder\GetAllUrl.htm, N/A>
[添加到QQ自定义面板]
<E:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<E:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<E:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

风过无声001 - 2007-6-27 9:57:00

==================================
正在运行的进程
[PID: 180][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.00.2195.6601]
[PID: 208][\??\C:\WINNT\system32\csrss.exe] [Microsoft Corporation, 5.00.2195.6601]
[PID: 232][\??\C:\WINNT\system32\winlogon.exe] [Microsoft Corporation, 5.00.2195.6714]
[C:\WINNT\system32\Ati2evxx.dll] [ATI Technologies Inc., 6.14.10.4110]
[C:\WINNT\system32\PCANotify.dll] [Symantec Corporation, 11.5.0.121]
[C:\WINNT\system32\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[E:\Program Files\Symantec\pcAnywhere\AWHK32.dll] [Symantec Corporation, 11.5.0.121]
[PID: 260][C:\WINNT\system32\services.exe] [Microsoft Corporation, 5.00.2195.6700]
[C:\WINNT\system32\dmserver.dll] [VERITAS Software Corp., 2195.6605.297.3]
[PID: 272][C:\WINNT\system32\lsass.exe] [Microsoft Corporation, 5.00.2195.6695]
[PID: 468][C:\WINNT\Explorer.EXE] [Microsoft Corporation, 5.00.3700.6690]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
[C:\WINNT\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
[E:\Program Files\Symantec\pcAnywhere\AWHK32.dll] [Symantec Corporation, 11.5.0.121]
[C:\WINNT\system32\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0]
[e:\Program Files\Thunder Network\WebThunder\WebThunderBHO_016.dll] [Thunder Networking Technologies,LTD, 6, 0, 0, 5]
[C:\WINNT\system32\MSVCP60.dll] [Microsoft Corporation, 6.00.8972.0]
[PID: 2660][C:\Program Files\Rising\AntiSpyware\runiep.exe] [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6]
[C:\Program Files\Rising\AntiSpyware\iep_ctrl.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[E:\Program Files\Symantec\pcAnywhere\AWHK32.dll] [Symantec Corporation, 11.5.0.121]
[C:\WINNT\system32\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0]
[PID: 2696][C:\Program Files\Java\jre1.5.0\bin\jusched.exe] [Sun Microsystems, Inc., 1.5.0.0]
[E:\Program Files\Symantec\pcAnywhere\AWHK32.dll] [Symantec Corporation, 11.5.0.121]
[C:\WINNT\system32\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0]
[PID: 2720][C:\Program Files\Java\jre1.5.0\bin\jucheck.exe] [Sun Microsystems, Inc., 1.5.0.0]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[E:\Program Files\Symantec\pcAnywhere\AWHK32.dll] [Symantec Corporation, 11.5.0.121]
[C:\WINNT\system32\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0]
[PID: 2792][C:\WINNT\system32\algs.exe] [N/A, ]
[E:\Program Files\Symantec\pcAnywhere\AWHK32.dll] [Symantec Corporation, 11.5.0.121]
[C:\WINNT\system32\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0]
[PID: 2796][C:\WINNT\system32\internat.exe] [Microsoft Corporation, 5.00.2920.0000]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[E:\Program Files\Symantec\pcAnywhere\AWHK32.dll] [Symantec Corporation, 11.5.0.121]
[C:\WINNT\system32\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0]
[PID: 2892][C:\WINNT\system32\conime.exe] [Microsoft Corporation, 5.00.2195.6655]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[E:\Program Files\Symantec\pcAnywhere\AWHK32.dll] [Symantec Corporation, 11.5.0.121]
[C:\WINNT\system32\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0]
[PID: 3024][C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe] [Microsoft Corporation, 2000.080.0194.00]
[C:\Program Files\Microsoft SQL Server\80\Tools\Binn\W95SCM.dll] [Microsoft Corporation, 2000.080.0194.00]
[C:\WINNT\system32\SQLUNIRL.dll] [Microsoft Corporation, 2000.080.0194.00]
[C:\Program Files\Microsoft SQL Server\80\Tools\Binn\SQLSVC.dll] [Microsoft Corporation, 2000.080.0194.00]
[C:\WINNT\system32\odbcbcp.dll] [Microsoft Corporation, 2000.080.0194.00]
[C:\Program Files\Microsoft SQL Server\80\Tools\Binn\SQLRESLD.dll] [Microsoft Corporation, 2000.080.0194.00]
[C:\Program Files\Microsoft SQL Server\80\Tools\Binn\Resources\2052\SQLSVC.RLL] [Microsoft Corporation, 2000.080.0194.00]
[C:\Program Files\Microsoft SQL Server\80\Tools\Binn\Resources\2052\sqlmangr.RLL] [Microsoft Corporation, 2000.080.0194.00]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[E:\Program Files\Symantec\pcAnywhere\AWHK32.dll] [Symantec Corporation, 11.5.0.121]
[C:\WINNT\system32\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0]
[PID: 3068][C:\WINNT\system32\cmd.exe] [Microsoft Corporation, 5.00.2195.6656]
[PID: 2704][C:\WINNT\system32\java.exe] [Sun Microsystems, Inc., 1.5.0.0]
[C:\Program Files\Java\jre1.5.0\bin\client\jvm.dll] [Sun Microsystems, Inc., 1.5.0.0]
[C:\Program Files\Java\jre1.5.0\bin\hpi.dll] [Sun Microsystems, Inc., 1.5.0.0]
[C:\Program Files\Java\jre1.5.0\bin\verify.dll] [Sun Microsystems, Inc., 1.5.0.0]
[C:\Program Files\Java\jre1.5.0\bin\java.dll] [Sun Microsystems, Inc., 1.5.0.0]
[C:\Program Files\Java\jre1.5.0\bin\zip.dll] [Sun Microsystems, Inc., 1.5.0.0]
[C:\Program Files\Java\jre1.5.0\bin\net.dll] [Sun Microsystems, Inc., 1.5.0.0]
[PID: 3172][F:\XXX系统服务端\scktsrvr.exe] [Borland Software Corporation, 6.0.6.163]
[E:\Program Files\Symantec\pcAnywhere\AWHK32.dll] [Symantec Corporation, 11.5.0.121]
[C:\WINNT\system32\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0]
[PID: 1252][E:\Program Files\Rising\Rav\RsAgent.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 12]
[E:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[E:\Program Files\Symantec\pcAnywhere\AWHK32.dll] [Symantec Corporation, 11.5.0.121]
[C:\WINNT\system32\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0]
[PID: 3236][C:\WINNT\msagent\AgentSvr.exe] [Microsoft Corporation, 2.00.0.3422]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[E:\Program Files\Symantec\pcAnywhere\AWHK32.dll] [Symantec Corporation, 11.5.0.121]
[C:\WINNT\system32\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0]
[PID: 3372][C:\WINNT\system32\taskmgr.exe] [Microsoft Corporation, 5.00.2195.6620]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[E:\Program Files\Symantec\pcAnywhere\AWHK32.dll] [Symantec Corporation, 11.5.0.121]
[C:\WINNT\system32\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0]
[PID: 3224][C:\Documents and Settings\Administrator\桌面\sreng2\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
[E:\Program Files\Symantec\pcAnywhere\AWHK32.dll] [Symantec Corporation, 11.5.0.121]
[C:\WINNT\system32\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]

风过无声001 - 2007-6-27 9:59:00

==================================
正在运行的进程
[PID: 180][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.00.2195.6601]
[PID: 208][\??\C:\WINNT\system32\csrss.exe] [Microsoft Corporation, 5.00.2195.6601]
[PID: 232][\??\C:\WINNT\system32\winlogon.exe] [Microsoft Corporation, 5.00.2195.6714]
[C:\WINNT\system32\Ati2evxx.dll] [ATI Technologies Inc., 6.14.10.4110]
[C:\WINNT\system32\PCANotify.dll] [Symantec Corporation, 11.5.0.121]
[C:\WINNT\system32\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[E:\Program Files\Symantec\pcAnywhere\AWHK32.dll] [Symantec Corporation, 11.5.0.121]
[PID: 260][C:\WINNT\system32\services.exe] [Microsoft Corporation, 5.00.2195.6700]
[C:\WINNT\system32\dmserver.dll] [VERITAS Software Corp., 2195.6605.297.3]
[PID: 272][C:\WINNT\system32\lsass.exe] [Microsoft Corporation, 5.00.2195.6695]
[PID: 468][C:\WINNT\Explorer.EXE] [Microsoft Corporation, 5.00.3700.6690]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
[C:\WINNT\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
[E:\Program Files\Symantec\pcAnywhere\AWHK32.dll] [Symantec Corporation, 11.5.0.121]
[C:\WINNT\system32\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0]
[e:\Program Files\Thunder Network\WebThunder\WebThunderBHO_016.dll] [Thunder Networking Technologies,LTD, 6, 0, 0, 5]
[C:\WINNT\system32\MSVCP60.dll] [Microsoft Corporation, 6.00.8972.0]
[PID: 2660][C:\Program Files\Rising\AntiSpyware\runiep.exe] [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6]
[C:\Program Files\Rising\AntiSpyware\iep_ctrl.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[E:\Program Files\Symantec\pcAnywhere\AWHK32.dll] [Symantec Corporation, 11.5.0.121]
[C:\WINNT\system32\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0]
[PID: 2696][C:\Program Files\Java\jre1.5.0\bin\jusched.exe] [Sun Microsystems, Inc., 1.5.0.0]
[E:\Program Files\Symantec\pcAnywhere\AWHK32.dll] [Symantec Corporation, 11.5.0.121]
[C:\WINNT\system32\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0]
[PID: 2720][C:\Program Files\Java\jre1.5.0\bin\jucheck.exe] [Sun Microsystems, Inc., 1.5.0.0]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[E:\Program Files\Symantec\pcAnywhere\AWHK32.dll] [Symantec Corporation, 11.5.0.121]
[C:\WINNT\system32\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0]
[PID: 2792][C:\WINNT\system32\algs.exe] [N/A, ]
[E:\Program Files\Symantec\pcAnywhere\AWHK32.dll] [Symantec Corporation, 11.5.0.121]
[C:\WINNT\system32\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0]
[PID: 2796][C:\WINNT\system32\internat.exe] [Microsoft Corporation, 5.00.2920.0000]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[E:\Program Files\Symantec\pcAnywhere\AWHK32.dll] [Symantec Corporation, 11.5.0.121]
[C:\WINNT\system32\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0]
[PID: 2892][C:\WINNT\system32\conime.exe] [Microsoft Corporation, 5.00.2195.6655]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[E:\Program Files\Symantec\pcAnywhere\AWHK32.dll] [Symantec Corporation, 11.5.0.121]
[C:\WINNT\system32\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0]
[PID: 3024][C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe] [Microsoft Corporation, 2000.080.0194.00]
[C:\Program Files\Microsoft SQL Server\80\Tools\Binn\W95SCM.dll] [Microsoft Corporation, 2000.080.0194.00]
[C:\WINNT\system32\SQLUNIRL.dll] [Microsoft Corporation, 2000.080.0194.00]
[C:\Program Files\Microsoft SQL Server\80\Tools\Binn\SQLSVC.dll] [Microsoft Corporation, 2000.080.0194.00]
[C:\WINNT\system32\odbcbcp.dll] [Microsoft Corporation, 2000.080.0194.00]
[C:\Program Files\Microsoft SQL Server\80\Tools\Binn\SQLRESLD.dll] [Microsoft Corporation, 2000.080.0194.00]
[C:\Program Files\Microsoft SQL Server\80\Tools\Binn\Resources\2052\SQLSVC.RLL] [Microsoft Corporation, 2000.080.0194.00]
[C:\Program Files\Microsoft SQL Server\80\Tools\Binn\Resources\2052\sqlmangr.RLL] [Microsoft Corporation, 2000.080.0194.00]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[E:\Program Files\Symantec\pcAnywhere\AWHK32.dll] [Symantec Corporation, 11.5.0.121]
[C:\WINNT\system32\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0]
[PID: 3068][C:\WINNT\system32\cmd.exe] [Microsoft Corporation, 5.00.2195.6656]
[PID: 2704][C:\WINNT\system32\java.exe] [Sun Microsystems, Inc., 1.5.0.0]
[C:\Program Files\Java\jre1.5.0\bin\client\jvm.dll] [Sun Microsystems, Inc., 1.5.0.0]
[C:\Program Files\Java\jre1.5.0\bin\hpi.dll] [Sun Microsystems, Inc., 1.5.0.0]
[C:\Program Files\Java\jre1.5.0\bin\verify.dll] [Sun Microsystems, Inc., 1.5.0.0]
[C:\Program Files\Java\jre1.5.0\bin\java.dll] [Sun Microsystems, Inc., 1.5.0.0]
[C:\Program Files\Java\jre1.5.0\bin\zip.dll] [Sun Microsystems, Inc., 1.5.0.0]
[C:\Program Files\Java\jre1.5.0\bin\net.dll] [Sun Microsystems, Inc., 1.5.0.0]
[PID: 3172][F:\XXX系统服务端\scktsrvr.exe] [Borland Software Corporation, 6.0.6.163]
[E:\Program Files\Symantec\pcAnywhere\AWHK32.dll] [Symantec Corporation, 11.5.0.121]
[C:\WINNT\system32\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0]
[PID: 1252][E:\Program Files\Rising\Rav\RsAgent.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 12]
[E:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[E:\Program Files\Symantec\pcAnywhere\AWHK32.dll] [Symantec Corporation, 11.5.0.121]
[C:\WINNT\system32\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0]
[PID: 3236][C:\WINNT\msagent\AgentSvr.exe] [Microsoft Corporation, 2.00.0.3422]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[E:\Program Files\Symantec\pcAnywhere\AWHK32.dll] [Symantec Corporation, 11.5.0.121]
[C:\WINNT\system32\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0]
[PID: 3372][C:\WINNT\system32\taskmgr.exe] [Microsoft Corporation, 5.00.2195.6620]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[E:\Program Files\Symantec\pcAnywhere\AWHK32.dll] [Symantec Corporation, 11.5.0.121]
[C:\WINNT\system32\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0]
[PID: 3224][C:\Documents and Settings\Administrator\桌面\sreng2\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
[E:\Program Files\Symantec\pcAnywhere\AWHK32.dll] [Symantec Corporation, 11.5.0.121]
[C:\WINNT\system32\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]

风过无声001 - 2007-6-27 9:59:00

文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINNT\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================

[/CODE]

瑞星卡卡安全论坛