wqnicole - 2007-7-12 22:51:00
+ 注册表自运行项目
+ Win32 Services
+ HKLM\System\CurrentControlSet\Services
9899C26C
[A ] 1. c:\windows\system32\d7dbde7a.exe
Navoct
[AM] 2. c:\program files\iesnap\navoct.dll
ose
[A ] 3. c:\program files\common files\microsoft shared\source engine\ose.exe
RfwService
[A ] 4. d:\program files\rising\rfw\rfwsrv.exe
RsCCenter
[A ] 5. d:\program files\rising\rav\ccenter.exe
RsRavMon
[A ] 6. d:\program files\rising\rav\ravmond.exe
UMWdf
[AM] 7. c:\windows\system32\wdfmgr.exe
+ Kernel Drivers
+ HKLM\System\CurrentControlSet\Services
a320raid
[A ] 8. c:\windows\system32\drivers\a320raid.sys
AAC
[A ] 9. c:\windows\system32\drivers\aac.sys
aar1210
[A ] 10. c:\windows\system32\drivers\aar1210.sys
adpu320
[A ] 11. c:\windows\system32\drivers\adpu320.sys
aec6210
[A ] 12. c:\windows\system32\drivers\aec6210.sys
aec6260
[A ] 13. c:\windows\system32\drivers\aec6260.sys
aec6280
[A ] 14. c:\windows\system32\drivers\aec6280.sys
AEC6290
[A ] 15. c:\windows\system32\drivers\aec6290.sys
AEC67160
[A ] 16. c:\windows\system32\drivers\aec67160.sys
AEC671X
[A ] 17. c:\windows\system32\drivers\aec671x.sys
AEC6880
[A ] 18. c:\windows\system32\drivers\aec6880.sys
AEC6890
[A ] 19. c:\windows\system32\drivers\aec6890.sys
aec68x5
[A ] 20. c:\windows\system32\drivers\aec68x5.sys
ALCXWDM
[A ] 21. c:\windows\system32\drivers\alcxwdm.sys
AmdK8
[A ] 22. c:\windows\system32\drivers\amdk8.sys
arc
[A ] 23. c:\windows\system32\drivers\arc.sys
BaseTDI
[A ] 24. c:\windows\system32\drivers\basetdi.sys
elxstor
[A ] 25. c:\windows\system32\drivers\elxstor.sys
ExpScaner
[A ] 26. d:\program files\rising\rav\expscan.sys
FASTSX
[A ] 27. c:\windows\system32\drivers\fastsx.sys
fasttrak
[A ] 28. c:\windows\system32\drivers\fasttrak.sys
fasttx2k
[A ] 29. c:\windows\system32\drivers\fasttx2k.sys
fasttx2k2
[A ] 30. c:\windows\system32\drivers\fasttx2k2.sys
FETNDISB
[A ] 31. c:\windows\system32\drivers\fetnd5b.sys
hldttf74
[A ] 32. c:\windows\system32\drivers\hldttf74.sys
HookCont
[A ] 33. d:\program files\rising\rav\hookcont.sys
HookReg
[A ] 34. d:\program files\rising\rav\hookreg.sys
HookSys
[A ] 35. d:\program files\rising\rav\hooksys.sys
HookUrl
[A ] 36. d:\program files\rising\rfw\hookurl.sys
HpCISSs
[A ] 37. c:\windows\system32\drivers\hpcisss.sys
Hpt366
[A ] 38. c:\windows\system32\drivers\hpt366.sys
HPT371
[A ] 39. c:\windows\system32\drivers\hpt371.sys
hpt374
[A ] 40. c:\windows\system32\drivers\hpt374.sys
hpt3xx
[A ] 41. c:\windows\system32\drivers\hpt3xx.sys
hptmv
[A ] 42. c:\windows\system32\drivers\hptmv.sys
hptpro
[A ] 43. c:\windows\system32\drivers\hptpro.sys
iaStor
[A ] 44. c:\windows\system32\drivers\iastor.sys
iirsp
[A ] 45. c:\windows\system32\drivers\iirsp.sys
iteraid
[A ] 46. c:\windows\system32\drivers\iteraid.sys
LSI_SAS
[A ] 47. c:\windows\system32\drivers\lsi_sas.sys
LSI_SCSI
[A ] 48. c:\windows\system32\drivers\lsi_scsi.sys
m5228
[A ] 49. c:\windows\system32\drivers\m5228.sys
m5281
[A ] 50. c:\windows\system32\drivers\m5281.sys
MegaIDE
[A ] 51. c:\windows\system32\drivers\megaide.sys
megasas
[A ] 52. c:\windows\system32\drivers\megasas.sys
MEMSCAN
[A ] 53. d:\program files\rising\rav\memscan.sys
mProcRs
[A ] 54. d:\program files\rising\rfw\mprocrs.sys
mraid2k
[A ] 55. c:\windows\system32\drivers\mraid2k.sys
nfrd960
[A ] 56. c:\windows\system32\drivers\nfrd960.sys
npkcrypt
[A ] 57. d:\program files\tencent\qq\npkcrypt.sys
npkycryp
[A ] 58. c:\program files\qq2005\npkycryp.sys
NvAtaBus
[A ] 59. c:\windows\system32\drivers\nvatabus.sys
nvraid
[A ] 60. c:\windows\system32\drivers\nvraid.sys
PNP649R
[A ] 61. c:\windows\system32\drivers\pnp649r.sys
Pnp680
[A ] 62. c:\windows\system32\drivers\pnp680.sys
Pnp680r
[A ] 63. c:\windows\system32\drivers\pnp680r.sys
ql2300
[A ] 64. c:\windows\system32\drivers\ql2300.sys
RAIDSRC
[A ] 65. c:\windows\system32\drivers\raidsrc.sys
RsAntiSpyware
[A ] 66. c:\windows\system32\drivers\rsboot.sys
RsFwDrv
[A ] 67. d:\program files\rising\rfw\rsfwdrv.sys
RsNTGDI
[A ] 68. c:\windows\system32\drivers\rsntgdi.sys
RSPPSYS
[A ] 69. d:\program files\rising\rav\rsppsys.sys
S150SX8
[A ] 70. c:\windows\system32\drivers\s150sx8.sys
Secdrv
[A ] 71. c:\windows\system32\drivers\secdrv.sys
SI3112
[A ] 72. c:\windows\system32\drivers\si3112.sys
SI3112r
[A ] 73. c:\windows\system32\drivers\si3112r.sys
SI3114
[A ] 74. c:\windows\system32\drivers\si3114.sys
SI3114r
[A ] 75. c:\windows\system32\drivers\si3114r.sys
SI3124
[A ] 76. c:\windows\system32\drivers\si3124.sys
SI3124r
[A ] 77. c:\windows\system32\drivers\si3124r.sys
SiFilter
[A ] 78. c:\windows\system32\drivers\siwinacc.sys
SISIDE
[A ] 79. c:\windows\system32\drivers\siside.sys
SiSRaid
[A ] 80. c:\windows\system32\drivers\sisraid.sys
SiSRaid1
[A ] 81. c:\windows\system32\drivers\sisraid1.sys
SISRAIDS
[A ] 82. c:\windows\system32\drivers\sisraids.sys
sptrak
[A ] 83. c:\windows\system32\drivers\sptrak.sys
SYMMPI
[A ] 84. c:\windows\system32\drivers\symmpi.sys
UlSata
[A ] 85. c:\windows\system32\drivers\ulsata.sys
ULSATAS
[A ] 86. c:\windows\system32\drivers\ulsatas.sys
viaagp1
[A ] 87. c:\windows\system32\drivers\viaagp1.sys
viagfx
[A ] 88. c:\windows\system32\drivers\vtmini.sys
ViaIde
[A ] 89. c:\windows\system32\drivers\viaidexp.sys
viamraid
[A ] 90. c:\windows\system32\drivers\viamraid.sys
viapdsk
[A ] 91. c:\windows\system32\drivers\viapdsk.sys
viaraid
[A ] 92. c:\windows\system32\drivers\viaraid.sys
viasraid
[A ] 93. c:\windows\system32\drivers\viasraid.sys
vmscsi
[A ] 94. c:\windows\system32\drivers\vmscsi.sys
+ File System Drivers
+ HKLM\System\CurrentControlSet\Services
TYKeeper
[A ] 95. c:\windows\system32\drivers\tykeeper.sys
+ Internet Explorer
+ HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar
{F869BB38-FFEF-4589-B986-610B7AD0ADA2}
[AM] 96. c:\program files\yok\toolbar.dll
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C}
[A ] 97. c:\windows\system32\kakatool.dll
+ HKCU\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks
{88351CEF-BAC0-4A9B-8380-31A173E2926F}
[AM] 96. c:\program files\yok\toolbar.dll
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
[A ] 98. c:\program files\adobe\acrobat 7.0\activex\acroiehelper.dll
{75FE2B5A-D3A4-4EFA-AC11-ADC9C9459688}
[AM] 96. c:\program files\yok\toolbar.dll
{889D2FEB-5411-4565-8998-1DD2C5261283}
[A ] 99. c:\program files\thunder network\thunder\comdlls\xunleibho_002.dll
+ HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions
Exec
[A ] 100. c:\program files\thunder network\thunder\thunder.exe
Exec
wqnicole - 2007-7-12 22:52:00
[A ] 101. d:\program files\tencent\qq\qq.exe
+ Explorer
+ HKLM\SOFTWARE\Classes\PROTOCOLS\Filter
text/xml
[A ] 102. c:\program files\common files\microsoft shared\office11\msoxmlmf.dll
+ HKLM\SOFTWARE\Classes\PROTOCOLS\Handler
msnim
[A ] 103. c:\program files\msn messenger\msgrapp.dll
+ HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
{81716107-A10D-11cf-64CD-11115FE1CF41}
[A ] 104. c:\windows\system32\nwizzhuxians.exe
+ HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers
{F9DB5320-233E-11D1-9F84-707F02C10627}
[AM] 105. c:\program files\adobe\acrobat 7.0\activex\pdfshell.dll
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
HyperTerminal Icon Ext
[A ] 106. c:\windows\system32\hticons.dll
Portable Media Devices
[A ] 107. c:\windows\system32\audiodev.dll
Portable Media Devices Menu
[A ] 107. c:\windows\system32\audiodev.dll
Shell Extensions for RealOne Player
[A ] 108. c:\program files\real\realplayer\rpshell.dll
Web Folders
[A ] 109. c:\program files\common files\microsoft shared\web folders\msonsext.dll
WinRAR shell extension
[AM] 110. c:\program files\winrar\rarext.dll
Microsoft Office HTML Icon Handler
[A ] 111. c:\program files\microsoft office\office11\msohev.dll
RISING
[AM] 112. c:\windows\system32\ravext.dll
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
{32CD708B-60A7-4C00-9377-D73EAA495F0F}
[AM] 112. c:\windows\system32\ravext.dll
{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}
[AM] 113. c:\windows\system32\shlhook.dll
+ Logon
+ HKLM\Software\Microsoft\Windows\CurrentVersion\Run
SoundMan
[AM] 114. c:\windows\soundman.exe
VTTimer
[AM] 115. c:\windows\system32\vttimer.exe
VTTrayp
[AM] 116. c:\windows\system32\vttrayp.exe
RavTask
[A ] 117. d:\program files\rising\rav\ravtask.exe
yok.exe
[A ] 118. c:\program files\yok\yok.exe
runeip
[A ] 119. d:\program files\rising\antispyware\runiep.exe
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
RavStub
[AM] 120. d:\program files\rising\rav\ravstub.exe
KKDelay
[A ] 121. d:\program files\rising\antispyware\runonce.exe
+ Boot Execute
+ HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
BootExecute
[A ] 122. c:\windows\system32\bsmain.exe
[A ] 123. c:\windows\system32\kknative.exe
+ Image Hijacks
+ HKCR\.html
htmlfile\Edit\Command
[A ] 124. c:\program files\microsoft office\office11\msohtmed.exe
htmlfile\Print\Command
[A ] 124. c:\program files\microsoft office\office11\msohtmed.exe
+ HKCR\.htm
htmlfile\Edit\Command
[A ] 124. c:\program files\microsoft office\office11\msohtmed.exe
htmlfile\Print\Command
[A ] 124. c:\program files\microsoft office\office11\msohtmed.exe
+ Print Monitor
+ HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors
Microsoft Document Imaging Writer Monitor
[AM] 125. c:\windows\system32\mdimon.dll
+ 其他自启动项目
+ C:\Documents and Settings\new\「开始」菜单\程序\启动
腾讯QQ.lnk
[A ] 101. d:\program files\tencent\qq\qq.exe
+ c:\autorun.inf
open
[A ] 126. c:\auto.exe
shellexecute
[A ] 126. c:\auto.exe
shell\Auto\command
[A ] 126. c:\auto.exe
+ d:\autorun.inf
open
[A ] 127. d:\auto.exe
shellexecute
[A ] 127. d:\auto.exe
shell\Auto\command
[A ] 127. d:\auto.exe
+ e:\autorun.inf
open
[A ] 128. e:\auto.exe
shellexecute
[A ] 128. e:\auto.exe
shell\Auto\command
[A ] 128. e:\auto.exe
+ f:\autorun.inf
open
[A ] 129. f:\auto.exe
shellexecute
[A ] 129. f:\auto.exe
shell\Auto\command
[A ] 129. f:\auto.exe
+ g:\autorun.inf
open
[A ] 130. g:\auto.exe
shellexecute
[A ] 130. g:\auto.exe
shell\Auto\command
[A ] 130. g:\auto.exe
+ 系统活动模块
+ 00000104(260) wdfmgr.exe
01000000[0000C000]
[AM] 7. c:\windows\system32\wdfmgr.exe
+ 0000024c(588) smss.exe
+ 00000294(660) csrss.exe
+ 000002ac(684) winlogon.exe
72C80000[00008000]
[ M] 131. c:\windows\system32\msacm32.drv
10000000[00012000]
[ M] 132. c:\windows\system32\e033a44c.dll
+ 000002d8(728) services.exe
+ 000002e4(740) lsass.exe
+ 00000380(896) svchost.exe
+ 00000388(904) ctfmon.exe
10000000[0001B000]
[ M] 133. d:\program files\rising\antispyware\ieprot.dll
00AB0000[0001C000]
[ M] 134. c:\program files\iesnap\navstub.dll
+ 000003c0(960) svchost.exe
+ 00000434(1076) svchost.exe
01890000[0002A000]
[AM] 2. c:\program files\iesnap\navoct.dll
01350000[0001C000]
[ M] 134. c:\program files\iesnap\navstub.dll
+ 00000460(1120) svchost.exe
+ 000004a4(1188) svchost.exe
+ 000005d4(1492) Explorer.EXE
10000000[0001B000]
[AM] 112. c:\windows\system32\ravext.dll
00D90000[00011000]
[AM] 113. c:\windows\system32\shlhook.dll
00E90000[00006000]
[ M] 135. c:\windows\system32\nwizzhuxians.dll
01810000[00007000]
[ M] 136. c:\program files\yok\yok.dll
01950000[00012000]
[ M] 132. c:\windows\system32\e033a44c.dll
01970000[0001B000]
[ M] 133. d:\program files\rising\antispyware\ieprot.dll
72C80000[00008000]
[ M] 131. c:\windows\system32\msacm32.drv
01FA0000[0000C000]
[ M] 137. c:\program files\yok\protect.dll
02040000[00018000]
[ M] 138. c:\program files\yok\adblock.dll
01FF0000[00014000]
[ M] 139. c:\program files\yok\relband.dll
024C0000[0001C000]
[ M] 134. c:\program files\iesnap\navstub.dll
02460000[00011000]
[ M] 140. c:\program files\yok\buttonmail.dll
024E0000[0002A000]
[AM] 96. c:\program files\yok\toolbar.dll
02540000[0001A000]
[ M] 141. c:\program files\yok\autolive.dll
00D30000[0001C000]
[AM] 105. c:\program files\adobe\acrobat 7.0\activex\pdfshell.dll
00F90000[0002B000]
[AM] 110. c:\program files\winrar\rarext.dll
23700000[0001A000]
[ M] 142. d:\program files\rising\rav\rscommon.dll
15000000[00010000]
[ M] 143. c:\windows\system32\k11842490194.dat
36D30000[0001A000]
[ M] 144. c:\program files\microsoft office\office11\mcps.dll
+ 0000064c(1612) spoolsv.exe
00AC0000[00008000]
[AM] 125. c:\windows\system32\mdimon.dll
00AD0000[00008000]
[ M] 145. c:\windows\system32\spool\prtprocs\w32x86\mdippr.dll
+ 000006c8(1736) RavStub.exe
00400000[00018000]
[AM] 120. d:\program files\rising\rav\ravstub.exe
10000000[0001B000]
[ M] 146. d:\program files\rising\rav\rscommx.dll
23700000[0001A000]
[ M] 142. d:\program files\rising\rav\rscommon.dll
00B20000[00012000]
[ M] 132. c:\windows\system32\e033a44c.dll
+ 000007a0(1952) SOUNDMAN.EXE
00400000[00018000]
[AM] 114. c:\windows\soundman.exe
00CF0000[0001B000]
[ M] 133. d:\program files\rising\antispyware\ieprot.dll
00D50000[0001C000]
[ M] 134. c:\program files\iesnap\navstub.dll
+ 000007c0(1984) VTTimer.exe
00400000[0000D000]
[AM] 115. c:\windows\system32\vttimer.exe
00940000[0001B000]
[ M] 133. d:\program files\rising\antispyware\ieprot.dll
009D0000[0001C000]
[ M] 134. c:\program files\iesnap\navstub.dll
+ 000007cc(1996) VTtrayp.exe
00400000[00026000]
[AM] 116. c:\windows\system32\vttrayp.exe
6BB00000[00079000]
[ M] 147. c:\windows\system32\vtdisply.dll
6BE00000[0005A000]
[ M] 148. c:\windows\system32\vtgamma2.dll
6C000000[00040000]
[ M] 149. c:\windows\system32\vtinfo2.dll
6C200000[00062000]
[ M] 150. c:\windows\system32\vtovrlay.dll
00CD0000[0001B000]
[ M] 133. d:\program files\rising\antispyware\ieprot.dll
00D30000[0001C000]
[ M] 134. c:\program files\iesnap\navstub.dll
+ 00000830(2096) Ras.exe
00400000[0013E000]
[ M] 151. d:\program files\rising\antispyware\ras.exe
15000000[00010000]
[ M] 143. c:\windows\system32\k11842490194.dat
10000000[0001C000]
[ M] 134. c:\program files\iesnap\navstub.dll
00ED0000[000A3000]
[ M] 152. d:\program files\rising\antispyware\rasgui.dll
016A0000[0001B000]
[ M] 133. d:\program files\rising\antispyware\ieprot.dll
+ 000008b8(2232) alg.exe
+ 00000acc(2764) navplay.exe
00400000[0001F000]
[ M] 153. c:\program files\iesnap\navplay.exe
10000000[0001C000]
[ M] 134. c:\program files\iesnap\navstub.dll
00BC0000[0001B000]
[ M] 133. d:\program files\rising\antispyware\ieprot.dll
+ 00000df4(3572) RsAgent.exe
00400000[0003A000]
[ M] 154. d:\program files\rising\rav\rsagent.exe
10000000[0001C000]
[ M] 134. c:\program files\iesnap\navstub.dll
00A30000[0001B000]
[ M] 146. d:\program files\rising\rav\rscommx.dll
00A80000[0001B000]
[ M] 133. d:\program files\rising\antispyware\ieprot.dll
+ 00000e04(3588) AgentSvr.exe
10000000[0001C000]
[ M] 134. c:\program files\iesnap\navstub.dll
00900000[0001B000]
[ M] 133. d:\program files\rising\antispyware\ieprot.dll
72C80000[00008000]
[ M] 131. c:\windows\system32\msacm32.drv
15000000[00010000]
[ M] 143. c:\windows\system32\k11842490194.dat
+ 00000ee4(3812) conime.exe
15000000[00010000]
[ M] 143. c:\windows\system32\k11842490194.dat
10000000[0001C000]
[ M] 134. c:\program files\iesnap\navstub.dll
00AC0000[0001B000]
[ M] 133. d:\program files\rising\antispyware\ieprot.dll
wqnicole - 2007-7-12 22:54:00
Trojan.PSW.Win32.OnlineGames.dct
这个病毒杀完了重启又回来啦~~~~
█ikaka█ - 2007-7-12 23:10:00
© 2000 - 2026 Rising Corp. Ltd.