【求助】电脑启动后就会自动跳一个网页 bbs.ikaka.com

li_li - 2007-7-26 10:14:00

最近新装了系统，还是XP P2的版本，而且还加了512的内存条，但是启动却非常的慢。
每次关机再开机后都要系统自动扫描网络端口。
进入桌面时也很慢，桌面的画面出来了，但是桌面上的图标
跟开始任务栏却又要很长时间才可以显示出来。

今天开机（等5分钟左右）后又自动跳出一个网页，C:\WINDOWS\system32\@$##.htm
用最新版本的瑞星杀毒但有个Backdoor.BlackHole.2005.gf病毒杀了又有，怎么也杀不彻底。找到这个文件也删除了，但重启后还是有。wuauclt.exe(C:\WINDOWS\WUAUCLT.EXE)

请大家帮忙如何解决这些问题。谢谢啦！

scriptman - 2007-7-26 11:19:00

到这里下载SREng
http://dl.9ipc.net/SoftView/SoftView_11.html
SREng的基本操作：
http://forum.ikaka.com/topic.asp?board=36&artid=8341507
解压,关闭所有应用程序,打开SREng,点"智能扫描"-"扫描",完成后,点"保存日志",将日志内容帖上来.

li_li - 2007-7-26 11:36:00

瑞星卡卡电脑诊断日志 v1.30 (2007-7-26 11:20:7) 北京瑞星科技股份有限公司

注释:[A]表示该文件存在自启动关联;
[M]表示该文件在内存中;

+ 注册表自运行项目
+ 系统服务
+ HKLM\System\CurrentControlSet\Services
Macromedia Licensing Service
[A ] 1. c:\program files\common files\macromedia shared\service\macromedia licensing.exe

ose
[A ] 2. c:\program files\common files\microsoft shared\source engine\ose.exe

RsCCenter
[A ] 3. d:\program files\rising\rav\ccenter.exe

RsRavMon
[A ] 4. d:\program files\rising\rav\ravmond.exe

+ 内核驱动
+ HKLM\System\CurrentControlSet\Services
ALCXWDM
[A ] 5. c:\windows\system32\drivers\alcxwdm.sys

BaseTDI
[A ] 6. c:\windows\system32\drivers\basetdi.sys

ExpScaner
[A ] 7. d:\program files\rising\rav\expscan.sys

HookCont
[A ] 8. d:\program files\rising\rav\hookcont.sys

HookReg
[A ] 9. d:\program files\rising\rav\hookreg.sys

HookSys
[A ] 10. d:\program files\rising\rav\hooksys.sys

ialm
[A ] 11. c:\windows\system32\drivers\ialmnt5.sys

MEMSCAN
[A ] 12. d:\program files\rising\rav\memscan.sys

npkcrypt
[A ] 13. c:\program files\tencent\qq\npkcrypt.sys

nvmpu401
[A ] 14. c:\windows\system32\drivers\nvmpu401.sys

ROCKEYNT
[A ] 15. c:\windows\system32\drivers\rockeynt.sys

RsAntiSpyware
[A ] 16. c:\windows\system32\drivers\rsboot.sys

RsNTGDI
[A ] 17. c:\windows\system32\drivers\rsntgdi.sys

RSPPSYS
[A ] 18. d:\program files\rising\rav\rsppsys.sys

RTL8023xp
[A ] 19. c:\windows\system32\drivers\rtnicxp.sys

Secdrv
[A ] 20. c:\windows\system32\drivers\secdrv.sys

Sense3
[A ] 21. c:\windows\system32\drivers\sense3.sys

+ 系统登陆自运行
+ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
igfxcui
[AM] 22. c:\windows\system32\igfxsrvc.dll

WBSrv
[AM] 23. c:\windows\system32\drivers\windowblinds\wbsrv.dll

+ HKCU\Control Panel\Desktop
Scrnsave.exe
[A ] 24. c:\windows\system32\七彩泡泡.scr

+ IE浏览器加载模块
+ HKCU\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks
{CFBFAE00-17A6-11D0-99CB-00C04FD64497}
[AM] 25. c:\windows\system32\ieframe.dll

+ 资源管理器加载模块
+ HKLM\SOFTWARE\Classes\PROTOCOLS\Filter
text/xml
[AM] 26. c:\program files\common files\microsoft shared\office11\msoxmlmf.dll

+ HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}
[A ] 27. c:\windows\system32\ieudinit.exe

+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
HyperTerminal Icon Ext
[A ] 28. c:\windows\system32\hticons.dll

IE Search Band
[AM] 25. c:\windows\system32\ieframe.dll

Shell DocObject Viewer
[AM] 25. c:\windows\system32\ieframe.dll

InternetShortcut
[AM] 25. c:\windows\system32\ieframe.dll

Microsoft Url History Service
[AM] 25. c:\windows\system32\ieframe.dll

History
[AM] 25. c:\windows\system32\ieframe.dll

Temporary Internet Files
[AM] 25. c:\windows\system32\ieframe.dll

Temporary Internet Files
[AM] 25. c:\windows\system32\ieframe.dll

Microsoft Url Search Hook
[AM] 25. c:\windows\system32\ieframe.dll

The Internet
[AM] 25. c:\windows\system32\ieframe.dll

Internet Name Space
[AM] 25. c:\windows\system32\ieframe.dll

PicaView
[A ] 29. c:\program files\acdsee\picaview.dll

IE Microsoft BrowserBand
[AM] 25. c:\windows\system32\ieframe.dll

IE Fade Task
[AM] 25. c:\windows\system32\ieframe.dll

IE Menu Desk Bar
[AM] 25. c:\windows\system32\ieframe.dll

IE AutoComplete
[AM] 25. c:\windows\system32\ieframe.dll

IE Navigation Bar
[AM] 25. c:\windows\system32\ieframe.dll

IE Menu Site
[AM] 25. c:\windows\system32\ieframe.dll

IE Menu Band
[AM] 25. c:\windows\system32\ieframe.dll

IE Microsoft History AutoComplete List
[AM] 25. c:\windows\system32\ieframe.dll

IE Tracking Shell Menu
[AM] 25. c:\windows\system32\ieframe.dll

IE IShellFolderBand
[AM] 25. c:\windows\system32\ieframe.dll

IE BandProxy
[AM] 25. c:\windows\system32\ieframe.dll

IE MRU AutoComplete List
[AM] 25. c:\windows\system32\ieframe.dll

IE RSS Feeder Folder
[AM] 25. c:\windows\system32\ieframe.dll

IE Microsoft Shell Folder AutoComplete List
[AM] 25. c:\windows\system32\ieframe.dll

IE Microsoft Multiple AutoComplete List Container
[AM] 25. c:\windows\system32\ieframe.dll

Microsoft Browser Architecture
[AM] 25. c:\windows\system32\ieframe.dll

IE Shell Rebar BandSite
[AM] 25. c:\windows\system32\ieframe.dll

IE Shell Band Site Menu
[AM] 25. c:\windows\system32\ieframe.dll

&Links
[AM] 25. c:\windows\system32\ieframe.dll

IE Registry Tree Options Utility
[AM] 25. c:\windows\system32\ieframe.dll

IE User Assist
[AM] 25. c:\windows\system32\ieframe.dll

IE Custom MRU AutoCompleted List
[AM] 25. c:\windows\system32\ieframe.dll

Web Folders
[A ] 30. c:\program files\common files\microsoft shared\web folders\msonsext.dll

Microsoft Office HTML Icon Handler
[AM] 31. c:\program files\microsoft office\office11\msohev.dll

Microsoft Office Metadata Handler
[A ] 32. c:\program files\common files\microsoft shared\office12\msoshext.dll

Microsoft Office Thumbnail Handler
[A ] 32. c:\program files\common files\microsoft shared\office12\msoshext.dll

RISING
[AM] 33. c:\windows\system32\ravext.dll

WinRAR shell extension
[AM] 34. c:\program files\winrar\rarext.dll

+ 用户登陆自运行项目
+ HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Microsoft
[A ] 35. c:\windows\wuauclt.exe

RavTask
[A ] 36. d:\program files\rising\rav\ravtask.exe

Alitalk
[AM] 37. d:\program files\贸易通\alitalk.exe

+ 开机执行
+ HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
BootExecute
[A ] 38. c:\windows\system32\bsmain.exe

+ 映像劫持
+ HKCR\.html
htmlfile\Edit\Command
[A ] 39. c:\program files\microsoft office\office11\msohtmed.exe

htmlfile\Print\Command
[A ] 39. c:\program files\microsoft office\office11\msohtmed.exe

+ HKCR\.htm
htmlfile\Edit\Command
[A ] 39. c:\program files\microsoft office\office11\msohtmed.exe

htmlfile\Print\Command
[A ] 39. c:\program files\microsoft office\office11\msohtmed.exe

+ 其他自启动项目
+ d:\autorun.inf
open
[A ] 40. d:\sxs.exe

shellexecute
[A ] 40. d:\sxs.exe

shell\Auto\command
[A ] 40. d:\sxs.exe

+ e:\autorun.inf
open
[A ] 41. e:\sxs.exe

shellexecute
[A ] 41. e:\sxs.exe

shell\Auto\command
[A ] 41. e:\sxs.exe

+ f:\autorun.inf
open
[A ] 42. f:\sxs.exe

shellexecute
[A ] 42. f:\sxs.exe

shell\Auto\command
[A ] 42. f:\sxs.exe

+ 正在运行的进程
+ 00000118(280) AliTalk.exe
00400000[0035C000]
[AM] 37. d:\program files\贸易通\alitalk.exe

10000000[0001E000]
[ M] 43. d:\program files\贸易通\sysidle.dll

41D50000[00045000]
[ M] 44. c:\windows\system32\iertutil.dll

00370000[00009000]
[ M] 45. c:\windows\system32\normaliz.dll

00380000[0003C000]
[ M] 46. d:\program files\贸易通\aliviewerapi.dll

66000000[0008F000]
[ M] 47. c:\windows\system32\drivers\windowblinds\wblind.dll

66600000[00017000]
[ M] 48. c:\windows\system32\drivers\windowblinds\wbhelp.dll

01500000[000A7000]
[ M] 49. d:\program files\贸易通\alimail\maildll.dll

73250000[00005000]
[ M] 50. d:\program files\贸易通\riched32.dll

74D90000[0006B000]
[ M] 51. d:\program files\贸易通\riched20.dll

01910000[00054000]
[ M] 52. d:\program files\贸易通\messagenotify.dll

02120000[0007B000]
[ M] 53. c:\windows\system32\freeime.ime

02410000[0002D000]
[ M] 54. c:\windows\system32\aliedit\aliedit.dll

7C340000[00056000]
[ M] 55. c:\windows\system32\aliedit\msvcr71.dll

7C3A0000[0007B000]
[ M] 56. c:\windows\system32\aliedit\msvcp71.dll

01830000[0009C000]
[ M] 57. d:\program files\贸易通\atabcontrol2.ocx

422B0000[005CB000]
[AM] 25. c:\windows\system32\ieframe.dll

017D0000[00019000]
[ M] 58. d:\program files\rising\rav\ravscrch.dll

72C80000[00008000]
[ M] 59. c:\windows\system32\msacm32.drv

+ 000001c4(452) smss.exe

+ 00000208(520) csrss.exe

+ 00000220(544) winlogon.exe
10000000[0007B000]
[ M] 53. c:\windows\system32\freeime.ime

01570000[00034000]
[AM] 23. c:\windows\system32\drivers\windowblinds\wbsrv.dll

66000000[0008F000]
[ M] 47. c:\windows\system32\drivers\windowblinds\wblind.dll

66600000[00017000]
[ M] 48. c:\windows\system32\drivers\windowblinds\wbhelp.dll

72C80000[00008000]
[ M] 59. c:\windows\system32\msacm32.drv

li_li - 2007-7-26 11:36:00

+ 0000024c(588) services.exe

+ 00000258(600) lsass.exe
66000000[0008F000]
[ M] 47. c:\windows\system32\drivers\windowblinds\wblind.dll

66600000[00017000]
[ M] 48. c:\windows\system32\drivers\windowblinds\wbhelp.dll

+ 000002ec(748) svchost.exe

+ 0000032c(812) svchost.exe

+ 000003dc(988) conime.exe
66000000[0008F000]
[ M] 47. c:\windows\system32\drivers\windowblinds\wblind.dll

66600000[00017000]
[ M] 48. c:\windows\system32\drivers\windowblinds\wbhelp.dll

10000000[0007B000]
[ M] 53. c:\windows\system32\freeime.ime

+ 000003e0(992) svchost.exe
00870000[00009000]
[ M] 45. c:\windows\system32\normaliz.dll

41D50000[00045000]
[ M] 44. c:\windows\system32\iertutil.dll

66000000[0008F000]
[ M] 47. c:\windows\system32\drivers\windowblinds\wblind.dll

66600000[00017000]
[ M] 48. c:\windows\system32\drivers\windowblinds\wbhelp.dll

50E60000[0000C000]
[ M] 60. c:\windows\system32\wups2.dll

+ 000003fc(1020) Ras.exe
00400000[0013F000]
[ M] 61. c:\program files\rising\antispyware\ras.exe

00370000[00009000]
[ M] 45. c:\windows\system32\normaliz.dll

41D50000[00045000]
[ M] 44. c:\windows\system32\iertutil.dll

66000000[0008F000]
[ M] 47. c:\windows\system32\drivers\windowblinds\wblind.dll

66600000[00017000]
[ M] 48. c:\windows\system32\drivers\windowblinds\wbhelp.dll

10000000[000A3000]
[ M] 62. c:\program files\rising\antispyware\rasgui.dll

01840000[0007B000]
[ M] 53. c:\windows\system32\freeime.ime

422B0000[005CB000]
[AM] 25. c:\windows\system32\ieframe.dll

+ 00000408(1032) svchost.exe

+ 0000043c(1084) svchost.exe
00800000[00009000]
[ M] 45. c:\windows\system32\normaliz.dll

41D50000[00045000]
[ M] 44. c:\windows\system32\iertutil.dll

+ 00000564(1380) Explorer.EXE
00400000[00009000]
[ M] 45. c:\windows\system32\normaliz.dll

41D50000[00045000]
[ M] 44. c:\windows\system32\iertutil.dll

66000000[0008F000]
[ M] 47. c:\windows\system32\drivers\windowblinds\wblind.dll

66600000[00017000]
[ M] 48. c:\windows\system32\drivers\windowblinds\wbhelp.dll

10000000[0007B000]
[ M] 53. c:\windows\system32\freeime.ime

422B0000[005CB000]
[AM] 25. c:\windows\system32\ieframe.dll

72C80000[00008000]
[ M] 59. c:\windows\system32\msacm32.drv

03620000[0002C000]
[AM] 34. c:\program files\winrar\rarext.dll

036E0000[0001B000]
[AM] 33. c:\windows\system32\ravext.dll

23700000[0001A000]
[ M] 63. d:\program files\rising\rav\rscommon.dll

03110000[0003C000]
[ M] 64. c:\windows\system32\igfxpph.dll

030A0000[0001E000]
[ M] 65. c:\windows\system32\hccutils.dll

03490000[00024000]
[ M] 66. c:\windows\system32\igfxres.dll

042E0000[00058000]
[AM] 22. c:\windows\system32\igfxsrvc.dll

034C0000[00024000]
[ M] 67. c:\windows\system32\igfxdev.dll

02580000[00009000]
[ M] 68. c:\windows\system32\idndl.dll

+ 00000570(1392) ctfmon.exe
66000000[0008F000]
[ M] 47. c:\windows\system32\drivers\windowblinds\wblind.dll

66600000[00017000]
[ M] 48. c:\windows\system32\drivers\windowblinds\wbhelp.dll

10000000[0007B000]
[ M] 53. c:\windows\system32\freeime.ime

+ 000005e8(1512) spoolsv.exe
682F0000[0002E000]
[ M] 69. c:\windows\system32\spool\prtprocs\w32x86\g21bws.dll

68200000[0009A000]
[ M] 70. c:\windows\system32\spool\drivers\w32x86\3\g21bwu.dll

68330000[008CC000]
[ M] 71. c:\windows\system32\spool\drivers\w32x86\3\g21bwk.dll

68DC0000[0000C000]
[ M] 72. c:\windows\system32\spool\drivers\w32x86\3\g21bwl.dll

682A0000[00035000]
[ M] 73. c:\windows\system32\spool\drivers\w32x86\3\g21bwc.dll

68320000[00010000]
[ M] 74. c:\windows\system32\spool\drivers\w32x86\3\g21bwj.dll

66000000[0008F000]
[ M] 47. c:\windows\system32\drivers\windowblinds\wblind.dll

66600000[00017000]
[ M] 48. c:\windows\system32\drivers\windowblinds\wbhelp.dll

+ 00000844(2116) QQ.exe
00400000[00187000]
[ M] 75. c:\program files\tencent\qq\qq.exe

10000000[00236000]
[ M] 76. c:\program files\tencent\qq\qqbaseclassindll.dll

616B0000[00099000]
[ M] 77. c:\program files\tencent\qq\qqhelperdll.dll

60090000[00040000]
[ M] 78. c:\program files\tencent\qq\basicctrldll.dll

60A10000[000F2000]
[ M] 79. c:\program files\tencent\qq\mfc42.dll

00380000[00009000]
[ M] 45. c:\windows\system32\normaliz.dll

41D50000[00045000]
[ M] 44. c:\windows\system32\iertutil.dll

66000000[0008F000]
[ M] 47. c:\windows\system32\drivers\windowblinds\wblind.dll

66600000[00017000]
[ M] 48. c:\windows\system32\drivers\windowblinds\wbhelp.dll

00EF0000[0007B000]
[ M] 53. c:\windows\system32\freeime.ime

620B0000[00005000]
[ M] 80. c:\program files\tencent\qq\riched32.dll

62040000[00068000]
[ M] 81. c:\program files\tencent\qq\riched20.dll

612E0000[00038000]
[ M] 82. c:\program files\tencent\qq\qqapi.dll

621F0000[00007000]
[ M] 83. c:\program files\tencent\qq\timproxy.dll

018C0000[00033000]
[ M] 84. c:\program files\tencent\qq\loginctrl.dll

01900000[00044000]
[ M] 85. c:\program files\tencent\qq\npkcntc.dll

01950000[0000E000]
[ M] 86. c:\program files\tencent\qq\npkpdb.dll

608B0000[00054000]
[ M] 87. c:\program files\tencent\qq\loginctrlres.dll

02390000[0041A000]
[ M] 88. c:\program files\tencent\qq\qqres.dll

61780000[0008A000]
[ M] 89. c:\program files\tencent\qq\qqmainframe.dll

601A0000[00119000]
[ M] 90. c:\program files\tencent\qq\cqqapplication.dll

60BB0000[0005D000]
[ M] 91. c:\program files\tencent\qq\newskin.dll

60680000[000B0000]
[ M] 92. c:\program files\tencent\qq\hostingmgr.dll

600F0000[00022000]
[ M] 93. c:\program files\tencent\qq\cameradll.dll

609E0000[0002F000]
[ M] 94. c:\program files\tencent\qq\mailsummary.dll

61750000[00015000]
[ M] 95. c:\program files\tencent\qq\qqknowledgesearch.dll

61100000[001D3000]
[ M] 96. c:\program files\tencent\qq\qqallinone.dll

60640000[00034000]
[ M] 97. c:\program files\tencent\qq\grouplive.dll

620D0000[0002A000]
[ M] 98. c:\program files\tencent\qq\sccore.dll

60350000[001A3000]
[ M] 99. c:\program files\tencent\qq\gdiplus.dll

61EF0000[0001E000]
[ M] 100. c:\program files\tencent\qq\qqspace.dll

62240000[00071000]
[ M] 101. c:\program files\tencent\qq\vbscript.dll

61640000[0006B000]
[ M] 102. c:\program files\tencent\qq\qqgroupmng.dll

02DF0000[00041000]
[ M] 103. c:\program files\tencent\qq\qqsysmsgmng.dll

62220000[00017000]
[ M] 104. c:\program files\tencent\qq\userdefinedhead.dll

61950000[000CE000]
[ M] 105. c:\program files\tencent\qq\qqplugin.dll

615A0000[0000C000]
[ M] 106. c:\program files\tencent\qq\qqconfigplugin.dll

422B0000[005CB000]
[AM] 25. c:\windows\system32\ieframe.dll

72C80000[00008000]
[ M] 59. c:\windows\system32\msacm32.drv

62020000[00016000]
[ M] 107. c:\program files\tencent\qq\qringmng.dll

61320000[00032000]
[ M] 108. c:\program files\tencent\qq\qqavatar.dll

60310000[0003E000]
[ M] 109. c:\program files\tencent\qq\flashavatardll.dll

05070000[000A6000]
[ M] 110. c:\program files\tencent\qq\longconnection.dll

60D10000[00026000]
[ M] 111. c:\program files\tencent\qq\phoneapi.dll

602C0000[0000D000]
[ M] 112. c:\program files\tencent\qq\dialerallinone.dll

61910000[0002A000]
[ M] 113. c:\program files\tencent\qq\qqpet.dll

600D0000[0001F000]
[ M] 114. c:\program files\tencent\qq\bqqapplication.dll

60120000[0004F000]
[ M] 115. c:\program files\tencent\qq\commercesmng.dll

60C90000[0000F000]
[ M] 116. c:\program files\tencent\qq\personaldesktop.dll

055E0000[0028B000]
[ M] 117. c:\program files\tencent\qq\qqaddr.dll

61E40000[0002D000]
[ M] 118. c:\program files\tencent\qq\qqscenemng.dll

014B0000[0002B000]
[ M] 119. c:\program files\tencent\qq\qqphonehelper.dll

+ 00000924(2340) WINWORD.EXE
30000000[00BE9000]
[ M] 120. c:\program files\microsoft office\office11\winword.exe

30C90000[00BBD000]
[ M] 121. c:\program files\common files\microsoft shared\office11\mso.dll

66000000[0008F000]
[ M] 47. c:\windows\system32\drivers\windowblinds\wblind.dll

66600000[00017000]
[ M] 48. c:\windows\system32\drivers\windowblinds\wbhelp.dll

10000000[0007B000]
[ M] 53. c:\windows\system32\freeime.ime

39700000[000EB000]
[ M] 122. c:\program files\common files\microsoft shared\office11\riched20.dll

01590000[0002D000]
[ M] 123. d:\program files\rising\rav\rsplugin.dll

11000000[0003A000]
[ M] 124. c:\program files\microsoft office\office11\addins\syminput.dll

73390000[00154000]
[ M] 125. c:\windows\system32\msvbvm60.dll

06E40000[00009000]
[ M] 45. c:\windows\system32\normaliz.dll

41D50000[00045000]
[ M] 44. c:\windows\system32\iertutil.dll

68200000[0009A000]
[ M] 70. c:\windows\system32\spool\drivers\w32x86\3\g21bwu.dll

li_li - 2007-7-26 11:38:00

68DC0000[0000C000]
[ M] 72. c:\windows\system32\spool\drivers\w32x86\3\g21bwl.dll

682A0000[00035000]
[ M] 73. c:\windows\system32\spool\drivers\w32x86\3\g21bwc.dll

68330000[008CC000]
[ M] 71. c:\windows\system32\spool\drivers\w32x86\3\g21bwk.dll

68320000[00010000]
[ M] 74. c:\windows\system32\spool\drivers\w32x86\3\g21bwj.dll

39800000[001B2000]
[ M] 126. c:\program files\microsoft office\office11\gdiplus.dll

68C00000[0003B000]
[ M] 127. c:\windows\system32\spool\drivers\w32x86\3\g21bwp.dll

36C30000[00009000]
[ M] 128. c:\program files\microsoft office\office11\msostyle.dll

+ 00000948(2376) TIMPlatform.exe
00400000[00013000]
[ M] 129. c:\program files\tencent\qq\timplatform.exe

66000000[0008F000]
[ M] 47. c:\windows\system32\drivers\windowblinds\wblind.dll

66600000[00017000]
[ M] 48. c:\windows\system32\drivers\windowblinds\wbhelp.dll

621F0000[00007000]
[ M] 83. c:\program files\tencent\qq\timproxy.dll

+ 00000a90(2704) IEXPLORE.EXE
41D50000[00045000]
[ M] 44. c:\windows\system32\iertutil.dll

422B0000[005CB000]
[AM] 25. c:\windows\system32\ieframe.dll

66000000[0008F000]
[ M] 47. c:\windows\system32\drivers\windowblinds\wblind.dll

66600000[00017000]
[ M] 48. c:\windows\system32\drivers\windowblinds\wbhelp.dll

10000000[0007B000]
[ M] 53. c:\windows\system32\freeime.ime

5DFF0000[0002F000]
[ M] 130. c:\windows\system32\ieui.dll

47060000[00021000]
[ M] 131. c:\windows\system32\xmllite.dll

325C0000[00012000]
[AM] 31. c:\program files\microsoft office\office11\msohev.dll

61930000[0004A000]
[ M] 132. c:\program files\internet explorer\ieproxy.dll

018A0000[00009000]
[ M] 45. c:\windows\system32\normaliz.dll

42920000[00060000]
[ M] 133. c:\windows\system32\ieapfltr.dll

03990000[00019000]
[ M] 58. d:\program files\rising\rav\ravscrch.dll

30000000[002EE000]
[ M] 134. c:\windows\system32\macromed\flash\flash9b.ocx

72C80000[00008000]
[ M] 59. c:\windows\system32\msacm32.drv

01650000[0000B000]
[AM] 26. c:\program files\common files\microsoft shared\office11\msoxmlmf.dll

+ 00000aec(2796) QQ.exe
00400000[00187000]
[ M] 75. c:\program files\tencent\qq\qq.exe

10000000[00236000]
[ M] 76. c:\program files\tencent\qq\qqbaseclassindll.dll

616B0000[00099000]
[ M] 77. c:\program files\tencent\qq\qqhelperdll.dll

60090000[00040000]
[ M] 78. c:\program files\tencent\qq\basicctrldll.dll

60A10000[000F2000]
[ M] 79. c:\program files\tencent\qq\mfc42.dll

00380000[00009000]
[ M] 45. c:\windows\system32\normaliz.dll

41D50000[00045000]
[ M] 44. c:\windows\system32\iertutil.dll

66000000[0008F000]
[ M] 47. c:\windows\system32\drivers\windowblinds\wblind.dll

66600000[00017000]
[ M] 48. c:\windows\system32\drivers\windowblinds\wbhelp.dll

00EF0000[0007B000]
[ M] 53. c:\windows\system32\freeime.ime

620B0000[00005000]
[ M] 80. c:\program files\tencent\qq\riched32.dll

62040000[00068000]
[ M] 81. c:\program files\tencent\qq\riched20.dll

612E0000[00038000]
[ M] 82. c:\program files\tencent\qq\qqapi.dll

621F0000[00007000]
[ M] 83. c:\program files\tencent\qq\timproxy.dll

019C0000[00033000]
[ M] 84. c:\program files\tencent\qq\loginctrl.dll

01A00000[00044000]
[ M] 85. c:\program files\tencent\qq\npkcntc.dll

01A50000[0000E000]
[ M] 86. c:\program files\tencent\qq\npkpdb.dll

608B0000[00054000]
[ M] 87. c:\program files\tencent\qq\loginctrlres.dll

024A0000[0041A000]
[ M] 88. c:\program files\tencent\qq\qqres.dll

61780000[0008A000]
[ M] 89. c:\program files\tencent\qq\qqmainframe.dll

601A0000[00119000]
[ M] 90. c:\program files\tencent\qq\cqqapplication.dll

60BB0000[0005D000]
[ M] 91. c:\program files\tencent\qq\newskin.dll

60680000[000B0000]
[ M] 92. c:\program files\tencent\qq\hostingmgr.dll

600F0000[00022000]
[ M] 93. c:\program files\tencent\qq\cameradll.dll

609E0000[0002F000]
[ M] 94. c:\program files\tencent\qq\mailsummary.dll

61750000[00015000]
[ M] 95. c:\program files\tencent\qq\qqknowledgesearch.dll

61100000[001D3000]
[ M] 96. c:\program files\tencent\qq\qqallinone.dll

60640000[00034000]
[ M] 97. c:\program files\tencent\qq\grouplive.dll

620D0000[0002A000]
[ M] 98. c:\program files\tencent\qq\sccore.dll

60350000[001A3000]
[ M] 99. c:\program files\tencent\qq\gdiplus.dll

61EF0000[0001E000]
[ M] 100. c:\program files\tencent\qq\qqspace.dll

62240000[00071000]
[ M] 101. c:\program files\tencent\qq\vbscript.dll

61640000[0006B000]
[ M] 102. c:\program files\tencent\qq\qqgroupmng.dll

02F30000[00041000]
[ M] 103. c:\program files\tencent\qq\qqsysmsgmng.dll

62220000[00017000]
[ M] 104. c:\program files\tencent\qq\userdefinedhead.dll

61950000[000CE000]
[ M] 105. c:\program files\tencent\qq\qqplugin.dll

615A0000[0000C000]
[ M] 106. c:\program files\tencent\qq\qqconfigplugin.dll

422B0000[005CB000]
[AM] 25. c:\windows\system32\ieframe.dll

30000000[002EE000]
[ M] 134. c:\windows\system32\macromed\flash\flash9b.ocx

72C80000[00008000]
[ M] 59. c:\windows\system32\msacm32.drv

62020000[00016000]
[ M] 107. c:\program files\tencent\qq\qringmng.dll

61320000[00032000]
[ M] 108. c:\program files\tencent\qq\qqavatar.dll

60310000[0003E000]
[ M] 109. c:\program files\tencent\qq\flashavatardll.dll

028D0000[000A6000]
[ M] 110. c:\program files\tencent\qq\longconnection.dll

60D10000[00026000]
[ M] 111. c:\program files\tencent\qq\phoneapi.dll

602C0000[0000D000]
[ M] 112. c:\program files\tencent\qq\dialerallinone.dll

61910000[0002A000]
[ M] 113. c:\program files\tencent\qq\qqpet.dll

600D0000[0001F000]
[ M] 114. c:\program files\tencent\qq\bqqapplication.dll

60120000[0004F000]
[ M] 115. c:\program files\tencent\qq\commercesmng.dll

60C90000[0000F000]
[ M] 116. c:\program files\tencent\qq\personaldesktop.dll

05200000[0028B000]
[ M] 117. c:\program files\tencent\qq\qqaddr.dll

61810000[0006C000]
[ M] 135. c:\program files\tencent\qq\qqmmsender.dll

615B0000[00032000]
[ M] 136. c:\program files\tencent\qq\qqcustomface.dll

60730000[0001A000]
[ M] 137. c:\program files\tencent\qq\imageole.dll

01550000[0002A000]
[ M] 138. c:\program files\tencent\qq\qqfiletransfer.dll

61E40000[0002D000]
[ M] 118. c:\program files\tencent\qq\qqscenemng.dll

01590000[0000B000]
[ M] 139. c:\program files\tencent\qqgame\gamepublic.dll

016C0000[0002A000]
[ M] 140. c:\program files\tencent\qqgame\common\utility.dll

016F0000[00009000]
[ M] 141. c:\program files\tencent\qqgame\factory.dll

01700000[0001C000]
[ M] 142. c:\program files\tencent\qqgame\logic\uistyle.dll

01720000[00009000]
[ M] 143. c:\program files\tencent\qqgame\prothand\qqprot.dll

01730000[0000D000]
[ M] 144. c:\program files\tencent\qqgame\socket\netmod.dll

05FF0000[00075000]
[ M] 145. c:\program files\tencent\qqgame\prothand\baseprot.dll

01740000[0000F000]
[ M] 146. c:\program files\tencent\qqgame\prothand\scatprot.dll

01750000[00025000]
[ M] 147. c:\program files\tencent\qqgame\common\compress.dll

60610000[00024000]
[ M] 148. c:\program files\tencent\qq\groupconnection.dll

+ 00000bc0(3008) iexplore.exe
41D50000[00045000]
[ M] 44. c:\windows\system32\iertutil.dll

422B0000[005CB000]
[AM] 25. c:\windows\system32\ieframe.dll

66000000[0008F000]
[ M] 47. c:\windows\system32\drivers\windowblinds\wblind.dll

66600000[00017000]
[ M] 48. c:\windows\system32\drivers\windowblinds\wbhelp.dll

10000000[0007B000]
[ M] 53. c:\windows\system32\freeime.ime

5DFF0000[0002F000]
[ M] 130. c:\windows\system32\ieui.dll

47060000[00021000]
[ M] 131. c:\windows\system32\xmllite.dll

325C0000[00012000]
[AM] 31. c:\program files\microsoft office\office11\msohev.dll

61930000[0004A000]
[ M] 132. c:\program files\internet explorer\ieproxy.dll

018A0000[00009000]
[ M] 45. c:\windows\system32\normaliz.dll

42920000[00060000]
[ M] 133. c:\windows\system32\ieapfltr.dll

72C80000[00008000]
[ M] 59. c:\windows\system32\msacm32.drv

03C80000[00019000]
[ M] 58. d:\program files\rising\rav\ravscrch.dll

+ 00000d34(3380) Qzone.exe
00400000[00044000]
[ M] 149. c:\program files\tencent\qq\qzone\qzone.exe

00380000[00009000]
[ M] 45. c:\windows\system32\normaliz.dll

41D50000[00045000]
[ M] 44. c:\windows\system32\iertutil.dll

60A10000[000F2000]
[ M] 150. c:\program files\tencent\qq\qzone\mfc42.dll

66000000[0008F000]
[ M] 47. c:\windows\system32\drivers\windowblinds\wblind.dll

66600000[00017000]
[ M] 48. c:\windows\system32\drivers\windowblinds\wbhelp.dll

10000000[0007B000]
[ M] 53. c:\windows\system32\freeime.ime

li_li - 2007-7-27 9:16:00

怎么没人帮忙看看呀

冷雨夜阑 - 2007-7-27 9:26:00

建议你去安全模式杀,这种情况你最好hijackthis修复.最完全的办法你去百度搜索,黄山IE修复专家,下栽完以后然后直接在而已网液筐里面输入C:\WINDOWS\system32\@$##.htm,然后点修复,再从新启动一次机子就可以了

li_li - 2007-7-27 10:53:00

我重新把日志内容传上来

[CODE]

2007-07-27,10:28:13

System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Microsoft><C:\WINDOWS\wuauclt.exe> []
<RavTask><"D:\Program Files\rising\rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<Alitalk><D:\PROGRA~1\贸易通\AliTalk.EXE> [阿里软件（中国）有限公司]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><wbsys.dll> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WBSrv]
<WinlogonNotify: WBSrv><C:\WINDOWS\system32\drivers\WindowBlinds\wbsrv.dll> [Stardock]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
<IE7 Uninstall Stub><C:\WINDOWS\system32\ieudinit.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Remove.PerUser.NT> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A]
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><C:\WINDOWS\system32\七彩泡泡.SCR> [Microsoft Corporation]

==================================
启动文件夹
N/A

==================================
服务
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Macromedia Licensing Service / Macromedia Licensing Service][Stopped/Manual Start]
<"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><>
[NetMeeting Remote Desktop Sharing / mnmsrvc][Stopped/Disabled]
<C:\WINDOWS\system32\mnmsrvc.exe><N/A>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
<"D:\Program Files\rising\rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
<"D:\PROGRAM FILES\RISING\RAV\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>

==================================
驱动程序
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Stopped/Manual Start]
<system32\drivers\ac97intc.sys><Intel Corporation>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[BaseTDI / BaseTDI][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\basetdi.sys><Beijing Rising Technology Co., Ltd.>
[Creative SBLive! Gameport / ctljystk][Stopped/Manual Start]
<system32\DRIVERS\ctljystk.sys><Creative Technology Ltd.>
[ExpScaner / ExpScaner][Running/Auto Start]
<\??\D:\PROGRAM FILES\RISING\RAV\ExpScan.sys><>
[HookCont / HookCont][Running/Auto Start]
<\??\D:\PROGRAM FILES\RISING\RAV\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
<\??\D:\PROGRAM FILES\RISING\RAV\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
<\??\D:\PROGRAM FILES\RISING\RAV\HookSys.sys><Rising>
[ialm / ialm][Running/Manual Start]
<system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[MEMSCAN / MEMSCAN][Running/Auto Start]
<\??\D:\PROGRAM FILES\RISING\RAV\MEMSCAN.sys><瑞星软件有限公司>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\C:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[nv / nv][Stopped/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Service for NVIDIA(R) nForce(TM) MIDI UART / nvmpu401][Running/Manual Start]
<system32\drivers\nvmpu401.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[ROCKEYNT / ROCKEYNT][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\Rockeynt.sys><FeiTian Tech Co.,Ltd>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
<\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
<\??\D:\PROGRAM FILES\RISING\RAV\RSPPSYS.sys><Rising>
[Realtek 10/100/1000 PCI NIC Family NDIS XP Driver / RTL8023xp][Stopped/Manual Start]
<system32\DRIVERS\Rtnicxp.sys><Realtek Semiconductor Corporation>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[Sense3 / Sense3][Running/Auto Start]
<System32\Drivers\sense3.sys><Beijing Senselock>

li_li - 2007-7-27 10:56:00

==================================
浏览器加载项
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[XML DOM Document]
{2933BF90-7B36-11D2-B20E-00C04F983E60} <%SystemRoot%\system32\msxml3.dll, N/A>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <C:\WINDOWS\system32\ieframe.dll, Microsoft Corporation>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Microsoft Web Browser]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\ieframe.dll, Microsoft Corporation>
[XML DOM Document 5.0]
{88D969E5-F192-11D4-A65F-0040963251E5} <C:\Program Files\Common Files\Microsoft Shared\OFFICE11\msxml5.dll, Microsoft Corporation>
[RMGetLicense Class]
{A9FC132B-096D-460B-B7D5-1DB0FAE0C062} <C:\WINDOWS\system32\msnetobj.dll, Microsoft Corporation>
[QQPlayerSvr Proxy Control]
{CD108273-D434-43E6-AA90-1469F97EB398} <C:\Program Files\Tencent\QQ\QQPlayerProxy.dll, Tencent>
[AUDIO__MP3 Moniker Class]
{CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[XML HTTP Request]
{ED8C108E-4349-11D2-91A4-00C04F7969E8} <%SystemRoot%\system32\msxml3.dll, N/A>
[XML DOM Document 3.0]
{F5078F32-C551-11D3-89B9-0000F81FE221} <%SystemRoot%\system32\msxml3.dll, N/A>
[Free Threaded XML DOM Document 3.0]
{F5078F33-C551-11D3-89B9-0000F81FE221} <%SystemRoot%\system32\msxml3.dll, N/A>
[XML HTTP 3.0]
{F5078F35-C551-11D3-89B9-0000F81FE221} <%SystemRoot%\system32\msxml3.dll, N/A>
[XSL Template 3.0]
{F5078F36-C551-11D3-89B9-0000F81FE221} <%SystemRoot%\system32\msxml3.dll, N/A>
[XML HTTP]
{F6D90F16-9C73-11D3-B32E-00C04F990BB4} <%SystemRoot%\system32\msxml3.dll, N/A>
[InfoCheck Class]
{F91BA567-79B9-467E-BC97-5DBA01BBC5EE} <D:\PROGRA~1\贸易通\Ali_Check.dll, >
[InstallCheck Class]
{FFB8C97E-39D4-4E8A-9FE4-B451A0D6CA65} <D:\PROGRA~1\贸易通\Ali_Check.dll, >

==================================
正在运行的进程
[PID: 452 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 524 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 548 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\FREEIME.IME] [Delphi Fan Studio, 4.00.950]
[C:\WINDOWS\system32\drivers\WindowBlinds\wbsrv.dll] [Stardock, 5, 0, 0, 1]
[C:\WINDOWS\system32\drivers\WindowBlinds\wblind.dll] [Stardock Corporation, 5.02]
[C:\WINDOWS\system32\drivers\WindowBlinds\wbhelp.dll] [Stardock.Net, Inc, 4.01]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 592 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 604 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\drivers\WindowBlinds\wblind.dll] [Stardock Corporation, 5.02]
[C:\WINDOWS\system32\drivers\WindowBlinds\wbhelp.dll] [Stardock.Net, Inc, 4.01]
[PID: 756 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 820 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 900 / SYSTEM][D:\Program Files\rising\rav\CCenter.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
[C:\WINDOWS\system32\drivers\WindowBlinds\wblind.dll] [Stardock Corporation, 5.02]
[C:\WINDOWS\system32\drivers\WindowBlinds\wbhelp.dll] [Stardock.Net, Inc, 4.01]
[PID: 936 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
[C:\WINDOWS\system32\drivers\WindowBlinds\wblind.dll] [Stardock Corporation, 5.02]
[C:\WINDOWS\system32\drivers\WindowBlinds\wbhelp.dll] [Stardock.Net, Inc, 4.01]
[C:\WINDOWS\system32\wups2.dll] [Microsoft Corporation, 7.0.6000.374 (winmain(wmbla).070416-2057)]
[PID: 1024 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1096 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
[PID: 1120 / SYSTEM][D:\PROGRAM FILES\RISING\RAV\Ravmond.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 49]

li_li - 2007-7-27 10:57:00

[D:\PROGRAM FILES\RISING\RAV\BWList.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
[D:\PROGRAM FILES\RISING\RAV\RsCommX.dll] [rising, 18, 0, 0, 1]
[D:\PROGRAM FILES\RISING\RAV\rfwctrl.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]
[D:\PROGRAM FILES\RISING\RAV\RsPPsys.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6]
[D:\PROGRAM FILES\RISING\RAV\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[D:\PROGRAM FILES\RISING\RAV\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
[D:\PROGRAM FILES\RISING\RAV\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[D:\PROGRAM FILES\RISING\RAV\RsLog.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
[D:\PROGRAM FILES\RISING\RAV\HOOKSYS.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 0]
[D:\Program Files\rising\rav\Scanner.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 15]
[D:\Program Files\rising\rav\libload.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 16]
[D:\Program Files\rising\rav\VirusLib.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 15]
[D:\PROGRAM FILES\RISING\RAV\regmon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6]
[D:\PROGRAM FILES\RISING\RAV\psapi.dll] [Microsoft Corporation, 4.00]
[D:\PROGRAM FILES\RISING\RAV\HookWeb.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 1]
[D:\PROGRAM FILES\RISING\RAV\MemMon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 14]
[D:\PROGRAM FILES\RISING\RAV\expscan.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[D:\PROGRAM FILES\RISING\RAV\mPorts.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3]
[D:\PROGRAM FILES\RISING\RAV\HookCont.dll] [Rising, 19, 0, 0, 0]
[D:\Program Files\rising\rav\SpamEng.dll] [, 18, 0, 0, 6]
[D:\Program Files\rising\rav\engine.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 30]
[C:\WINDOWS\system32\drivers\WindowBlinds\wblind.dll] [Stardock Corporation, 5.02]
[C:\WINDOWS\system32\drivers\WindowBlinds\wbhelp.dll] [Stardock.Net, Inc, 4.01]
[D:\Program Files\rising\rav\PostTrt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 16]
[D:\Program Files\rising\rav\UnExe.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
[D:\Program Files\rising\rav\ScanExec.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 19]
[D:\Program Files\rising\rav\ExtFile.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 36]
[D:\Program Files\rising\rav\ScanEx.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 71]
[D:\Program Files\rising\rav\NvFile.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 11]
[D:\Program Files\rising\rav\ScanMac.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 14]
[D:\Program Files\rising\rav\ScanSct.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 20]
[D:\Program Files\rising\rav\ScanPack.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 24]
[D:\Program Files\rising\rav\RsVM.dll] [, 19, 0, 0, 20]
[D:\Program Files\rising\rav\Uroutine.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 47]
[D:\Program Files\rising\rav\Uscript.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 19]
[PID: 1392 / Administrator][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
[C:\WINDOWS\system32\drivers\WindowBlinds\wblind.dll] [Stardock Corporation, 5.02]
[C:\WINDOWS\system32\drivers\WindowBlinds\wbhelp.dll] [Stardock.Net, Inc, 4.01]
[C:\WINDOWS\system32\FREEIME.IME] [Delphi Fan Studio, 4.00.950]
[C:\WINDOWS\system32\ieframe.dll] [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1504 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\G21BWS.DLL] [Generic, 1.01]
[PID: 964 / Administrator][C:\WINDOWS\wuauclt.exe] [N/A, ]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
[C:\WINDOWS\system32\drivers\WindowBlinds\wblind.dll] [Stardock Corporation, 5.02]
[C:\WINDOWS\system32\drivers\WindowBlinds\wbhelp.dll] [Stardock.Net, Inc, 4.01]
[C:\WINDOWS\system32\FREEIME.IME] [Delphi Fan Studio, 4.00.950]
[PID: 980 / Administrator][D:\Program Files\rising\rav\RavTask.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
[D:\Program Files\rising\rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[D:\Program Files\rising\rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[D:\Program Files\rising\rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
[D:\Program Files\rising\rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\WINDOWS\system32\drivers\WindowBlinds\wblind.dll] [Stardock Corporation, 5.02]
[C:\WINDOWS\system32\drivers\WindowBlinds\wbhelp.dll] [Stardock.Net, Inc, 4.01]
[C:\WINDOWS\system32\FREEIME.IME] [Delphi Fan Studio, 4.00.950]
[PID: 1036 / Administrator][D:\Program Files\rising\rav\Ravmon.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 45]
[D:\Program Files\rising\rav\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33]
[D:\Program Files\rising\rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
[D:\Program Files\rising\rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[D:\Program Files\rising\rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
[D:\Program Files\rising\rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[D:\Program Files\rising\rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[D:\Program Files\rising\rav\RsXML.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
[D:\Program Files\rising\rav\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\WINDOWS\system32\drivers\WindowBlinds\wblind.dll] [Stardock Corporation, 5.02]
[C:\WINDOWS\system32\drivers\WindowBlinds\wbhelp.dll] [Stardock.Net, Inc, 4.01]
[C:\WINDOWS\system32\FREEIME.IME] [Delphi Fan Studio, 4.00.950]
[PID: 928 / Administrator][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\drivers\WindowBlinds\wblind.dll] [Stardock Corporation, 5.02]
[C:\WINDOWS\system32\drivers\WindowBlinds\wbhelp.dll] [Stardock.Net, Inc, 4.01]
[C:\WINDOWS\system32\FREEIME.IME] [Delphi Fan Studio, 4.00.950]
[PID: 2284 / SYSTEM][C:\WINDOWS\system32\wuauclt.exe] [Microsoft Corporation, 7.0.6000.374 (winmain(wmbla).070416-2057)]
[C:\WINDOWS\system32\drivers\WindowBlinds\wblind.dll] [Stardock Corporation, 5.02]
[C:\WINDOWS\system32\drivers\WindowBlinds\wbhelp.dll] [Stardock.Net, Inc, 4.01]
[C:\WINDOWS\system32\wups2.dll] [Microsoft Corporation, 7.0.6000.374 (winmain(wmbla).070416-2057)]
[PID: 2384 / Administrator][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\drivers\WindowBlinds\wblind.dll] [Stardock Corporation, 5.02]
[C:\WINDOWS\system32\drivers\WindowBlinds\wbhelp.dll] [Stardock.Net, Inc, 4.01]
[C:\WINDOWS\system32\FREEIME.IME] [Delphi Fan Studio, 4.00.950]
[PID: 2616 / NETWORK SERVICE][C:\WINDOWS\system32\wbem\wmiprvse.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\drivers\WindowBlinds\wblind.dll] [Stardock Corporation, 5.02]
[C:\WINDOWS\system32\drivers\WindowBlinds\wbhelp.dll] [Stardock.Net, Inc, 4.01]
[PID: 2660 / Administrator][C:\Downloads\sreng2\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
[C:\WINDOWS\system32\drivers\WindowBlinds\wblind.dll] [Stardock Corporation, 5.02]
[C:\WINDOWS\system32\drivers\WindowBlinds\wbhelp.dll] [Stardock.Net, Inc, 4.01]
[C:\WINDOWS\system32\FREEIME.IME] [Delphi Fan Studio, 4.00.950]
[C:\Downloads\sreng2\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[D:\]
[AutoRun]
open=sxs.exe
shellexecute=sxs.exe
shell\Auto\command=sxs.exe
[E:\]
[AutoRun]
open=sxs.exe
shellexecute=sxs.exe
shell\Auto\command=sxs.exe
[F:\]
[AutoRun]
open=sxs.exe
shellexecute=sxs.exe
shell\Auto\command=sxs.exe

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 1392, C:\WINDOWS\EXPLORER.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 964, C:\WINDOWS\WUAUCLT.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 980, D:\PROGRAM FILES\RISING\RAV\RAVTASK.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1036, D:\PROGRAM FILES\RISING\RAV\RAVMON.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2724, D:\PROGRAM FILES\RISING\RAV\SMARTUP.EXE]

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================

[/CODE]

飞天揽月 - 2007-7-27 11:04:00

有点乱，不过还是提几个建议：
1、开始-运行-MSCONFIG-关闭可以启动项
2、将瑞星杀毒软件升级到最新版本，在安全模式下查杀病毒。
3、用360安全卫士查杀恶意插件！

baohe - 2007-7-27 11:25:00

【回复“li_li”的帖子】
可以尝试用IceSword手工查杀。
1、禁止进程创建。
2、结束进程：[PID: 964 / Administrator][C:\WINDOWS\wuauclt.exe] [N/A, ]
3、强制卸除下列进程中的病毒模块：
[PID: 548 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\FREEIME.IME] [Delphi Fan Studio, 4.00.950]
[C:\WINDOWS\system32\drivers\WindowBlinds\wbsrv.dll] [Stardock, 5, 0, 0, 1]
[C:\WINDOWS\system32\drivers\WindowBlinds\wblind.dll] [Stardock Corporation, 5.02]
[C:\WINDOWS\system32\drivers\WindowBlinds\wbhelp.dll] [Stardock.Net, Inc, 4.01]
[PID: 604 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\drivers\WindowBlinds\wblind.dll] [Stardock Corporation, 5.02]
[C:\WINDOWS\system32\drivers\WindowBlinds\wbhelp.dll] [Stardock.Net, Inc, 4.01]
[PID: 1096 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0
[C:\WINDOWS\system32\drivers\WindowBlinds\wblind.dll] [Stardock Corporation, 5.02]
[C:\WINDOWS\system32\drivers\WindowBlinds\wbhelp.dll] [Stardock.Net, Inc, 4.01]
[PID: 1096 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
4、结束系统核心进程（smss、lsass、csrss、services、winlogon、svchost、system、system idle process）以外的所有进程。
5、删除下列文件：
C:\WINDOWS\wuauclt.exe
wbsys.dll
C:\WINDOWS\system32\drivers\WindowBlinds\wbsrv.dll
C:\WINDOWS\system32\mnmsrvc.exe
C:\WINDOWS\system32\Normaliz.dll
C:\WINDOWS\system32\drivers\WindowBlinds\wblind.dll
C:\WINDOWS\system32\drivers\WindowBlinds\wbhelp.dll
D、E、F盘根目录下的Autorun.inf和sxs.exe
6、取消IceSword的禁止进程创建。
7、用SRENG删除下列启动项、服务项：

启动项目
注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Microsoft><C:\WINDOWS\wuauclt.exe> []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WBSrv]
<WinlogonNotify: WBSrv><C:\WINDOWS\system32\drivers\WindowBlinds\wbsrv.dll> [Stardock]
服务
[NetMeeting Remote Desktop Sharing / mnmsrvc][Stopped/Disabled]
<C:\WINDOWS\system32\mnmsrvc.exe><N/A>
8、用SRENG编辑
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs>项（删除其中的wbsys.dll）。

Leoooo - 2007-7-27 11:52:00

c:\windows\system32\drivers\windowblinds\wbsrv.dll
c:\windows\system32\ieudinit.exe
c:\windows\wuauclt.exe
d:\sxs.exe
d:\autorun.inf

e:\sxs.exe
e:\autorun.inf

f:\sxs.exe
f:\autorun.inf

把这些可疑文件打包上传给瑞星http://up.rising.com.cn/webmail/uploadnew.htm

li_li - 2007-7-27 16:03:00

【回复“baohe”的帖子】
不好意思，我不晓得怎样按照你说的那样做。

IceSword手工查杀和禁止进程创建。
结束进程：[PID: 964 / Administrator][C:\WINDOWS\wuauclt.exe] [N/A, ]
强制卸除下列进程，这些怎么弄啊。

我不会啊。

li_li - 2007-7-27 16:05:00

【回复“Leoooo”的帖子】
d:\sxs.exe
d:\autorun.inf

e:\sxs.exe
e:\autorun.inf

f:\sxs.exe
f:\autorun.inf

这两个文件都在电脑里看不到。
其中sxs.exe这个文件被瑞星杀毒给删除了，但还没重启，不知道还会不会再出现。

lxr123 - 2007-7-27 17:29:00

右键－资源管理器打开试试能不能找到他！难道icesword也找不到吗？

lxr123 - 2007-7-27 17:41:00

1，打开IceSword
2，左上角“文件”处可以点击“禁止进程创建”
3，点击进程，对准“C:\WINDOWS\wuauclt.exe] [N/A, ”点击右键，可见“结束进程”点击
4，点击进程：按10楼的。右键点击相应的exe，可见“模块信息”，然后点击10楼对应的东东

lxr123 - 2007-7-27 17:42:00

1，打开IceSword
2，左上角“文件”处可以点击“禁止进程创建”
3，点击进程，对准“C:\WINDOWS\wuauclt.exe] [N/A, ”点击右键，可见“结束进程”点击
4，点击进程：按10楼的。右键点击相应的exe，可见“模块信息”，然后点击10楼对应的东东

瑞星卡卡安全论坛