瑞星卡卡安全论坛
zjming12 - 2007-7-27 15:05:00
昨天电脑突然中毒,网页打开不断跳出广告,瑞星不能启动,系统不能还原,安全模式进去又自动跳出。今天qq也不能上去,还能够上网,hijachthis无法启动,,我只能下载一个雅虎扫描下进程,请各位老师帮忙看看,到底是个什么东西,怎么清除了,辛苦了,谢谢!
zjming12 - 2007-7-27 15:07:00
标题:菜鸟求救!
各位大虾:
感谢您关注我的这份报告,小菜鸟急需您的帮助!
本扫描/诊断报告由 雅虎助手IE修复专家 生成
操作系统: Windows XP
IE版本号: 6.0.2900.2180
===============================================================
以下是我的扫描报告正文:
*** 扫描项列表 ***
进程中依赖的非微软模块
1.037 - 进程 explorer.exe 依赖的非微软模块 - IMSC40A.IME,(未验证)Microsoft Corporation,
相关文件:C:\WINDOWS\system32\IMSC40A.IME
2.037 - 进程 explorer.exe 依赖的非微软模块 - RavExt.dll,Beijing Rising Technology Co., Ltd.,
相关文件:C:\WINDOWS\system32\RavExt.dll
3.037 - 进程 explorer.exe 依赖的非微软模块 - SysWin64.Sys,Unknow Owner,
相关文件:(隐藏)(系统)C:\Program Files\Internet Explorer\PLUGINS\SysWin64.Sys
4.037 - 进程 explorer.exe 依赖的非微软模块 - zmqz.dll,Unknow Owner,
相关文件:c:\Program Files\mzdm\zmqz.dll
5.037 - 进程 explorer.exe 依赖的非微软模块 - erve.dll,Unknow Owner,
相关文件:c:\Program Files\mzdm\erve.dll
6.037 - 进程 explorer.exe 依赖的非微软模块 - BaiduBar.dll,Baidu.com, Inc.,
相关文件:C:\Program Files\BaiDu\bar\BaiduBar.dll
7.037 - 进程 explorer.exe 依赖的非微软模块 - VCvtShell.dll,herosoft,
相关文件:d:\HeroV8\VCvtShell.dll
8.037 - 进程 explorer.exe 依赖的非微软模块 - RarExt.dll,Unknow Owner,
相关文件:C:\Program Files\WinRAR\RarExt.dll
9.037 - 进程 explorer.exe 依赖的非微软模块 - RsCommon.dll,Beijing Rising Technology Co., Ltd.,
相关文件:C:\Program Files\Rising\Rav\RsCommon.dll
10.037 - 进程 explorer.exe 依赖的非微软模块 - msdmo.dll,Unknow Owner,
相关文件:C:\WINDOWS\system32\msdmo.dll
11.037 - 进程 explorer.exe 依赖的非微软模块 - MCPS.DLL,(未验证)Microsoft Corporation,
相关文件:C:\Program Files\Microsoft Office\OFFICE11\MCPS.DLL
IE修复专家扫描到的系统信息
12.P00 - 正在运行的服务 - Ati HotKey Poller,ATI Technologies Inc.,
相关文件:C:\WINDOWS\system32\ati2evxx.exe
内容:C:\WINDOWS\system32\Ati2evxx.exe
13.P00 - 正在运行的服务 - Windows Audio,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\audiosrv.dll
内容:C:\WINDOWS\System32\svchost.exe -k netsvcs
14.P00 - 正在运行的服务 - Cryptographic Services,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\cryptsvc.dll
内容:C:\WINDOWS\system32\svchost.exe -k netsvcs
15.P00 - 正在运行的服务 - DCOM Server Process Launcher,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\rpcss.dll
内容:C:\WINDOWS\system32\svchost -k DcomLaunch
16.P00 - 正在运行的服务 - DHCP Client,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\dhcpcsvc.dll
内容:C:\WINDOWS\system32\svchost.exe -k netsvcs
17.P00 - 正在运行的服务 - Logical Disk Manager,Microsoft Corp.,
相关文件:C:\WINDOWS\system32\dmserver.dll
内容:C:\WINDOWS\System32\svchost.exe -k netsvcs
18.P00 - 正在运行的服务 - DNS Client,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\dnsrslvr.dll
内容:C:\WINDOWS\system32\svchost.exe -k NetworkService
19.P00 - 正在运行的服务 - Error Reporting Service,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\ersvc.dll
内容:C:\WINDOWS\System32\svchost.exe -k netsvcs
20.P00 - 正在运行的服务 - Event Log,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\services.exe
内容:C:\WINDOWS\system32\services.exe
21.P00 - 正在运行的服务 - COM+ Event System,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\es.dll
内容:C:\WINDOWS\system32\svchost.exe -k netsvcs
22.P00 - 正在运行的服务 - Fast User Switching Compatibility,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\shsvcs.dll
内容:C:\WINDOWS\System32\svchost.exe -k netsvcs
23.P00 - 正在运行的服务 - Server,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\srvsvc.dll
内容:C:\WINDOWS\system32\svchost.exe -k netsvcs
24.P00 - 正在运行的服务 - Workstation,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\wkssvc.dll
内容:C:\WINDOWS\system32\svchost.exe -k netsvcs
25.P00 - 正在运行的服务 - TCP/IP NetBIOS Helper,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\lmhsvc.dll
内容:C:\WINDOWS\system32\svchost.exe -k LocalService
26.P00 - 正在运行的服务 - Network Connections,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\netman.dll
内容:C:\WINDOWS\System32\svchost.exe -k netsvcs
27.P00 - 正在运行的服务 - Network Location Awareness (NLA),Microsoft Corporation,
相关文件:C:\WINDOWS\system32\mswsock.dll
内容:C:\WINDOWS\system32\svchost.exe -k netsvcs
28.P00 - 正在运行的服务 - Plug and Play,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\services.exe
内容:C:\WINDOWS\system32\services.exe
zjming12 - 2007-7-27 15:07:00
29.P00 - 正在运行的服务 - IPSEC Services,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\lsass.exe
内容:C:\WINDOWS\system32\lsass.exe
30.P00 - 正在运行的服务 - Protected Storage,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\lsass.exe
内容:C:\WINDOWS\system32\lsass.exe
31.P00 - 正在运行的服务 - Remote Access Connection Manager,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\rasmans.dll
内容:C:\WINDOWS\system32\svchost.exe -k netsvcs
32.P00 - 正在运行的服务 - Windows reir RunThem,Unknow Owner,
相关文件:C:\Program Files\mzdm\wjnw.dll
内容:C:\WINDOWS\System32\svchost.exe -k netsvcs
33.P00 - 正在运行的服务 - Remote Registry,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\regsvc.dll
内容:C:\WINDOWS\system32\svchost.exe -k LocalService
34.P00 - 正在运行的服务 - Remote Procedure Call (RPC),Microsoft Corporation,
相关文件:C:\WINDOWS\system32\rpcss.dll
内容:C:\WINDOWS\system32\svchost -k rpcss
35.P00 - 正在运行的服务 - Security Accounts Manager,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\lsass.exe
内容:C:\WINDOWS\system32\lsass.exe
36.P00 - 正在运行的服务 - Task Scheduler,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\schedsvc.dll
内容:C:\WINDOWS\System32\svchost.exe -k netsvcs
37.P00 - 正在运行的服务 - Secondary Logon,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\seclogon.dll
内容:C:\WINDOWS\System32\svchost.exe -k netsvcs
38.P00 - 正在运行的服务 - System Event Notification,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\sens.dll
内容:C:\WINDOWS\system32\svchost.exe -k netsvcs
39.P00 - 正在运行的服务 - Shell Hardware Detection,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\shsvcs.dll
内容:C:\WINDOWS\System32\svchost.exe -k netsvcs
40.P00 - 正在运行的服务 - Print Spooler,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\spoolsv.exe
内容:C:\WINDOWS\system32\spoolsv.exe
41.P00 - 正在运行的服务 - System Restore Service,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\srsvc.dll
内容:C:\WINDOWS\system32\svchost.exe -k netsvcs
42.P00 - 正在运行的服务 - SSDP Discovery Service,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\ssdpsrv.dll
内容:C:\WINDOWS\system32\svchost.exe -k LocalService
43.P00 - 正在运行的服务 - Windows Image Acquisition (WIA),Microsoft Corporation,
相关文件:C:\WINDOWS\system32\wiaservc.dll
内容:C:\WINDOWS\system32\svchost.exe -k imgsvc
44.P00 - 正在运行的服务 - Telephony,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\tapisrv.dll
内容:C:\WINDOWS\System32\svchost.exe -k netsvcs
45.P00 - 正在运行的服务 - Terminal Services,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\termsrv.dll
内容:C:\WINDOWS\System32\svchost -k DComLaunch
46.P00 - 正在运行的服务 - Themes,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\shsvcs.dll
内容:C:\WINDOWS\System32\svchost.exe -k netsvcs
47.P00 - 正在运行的服务 - Distributed Link Tracking Client,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\trkwks.dll
内容:C:\WINDOWS\system32\svchost.exe -k netsvcs
48.P00 - 正在运行的服务 - Windows Time,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\w32time.dll
内容:C:\WINDOWS\System32\svchost.exe -k netsvcs
49.P00 - 正在运行的服务 - WebClient,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\webclnt.dll
内容:C:\WINDOWS\system32\svchost.exe -k LocalService
50.P00 - 正在运行的服务 - Windows Management Instrumentation,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\wbem\wmisvc.dll
内容:C:\WINDOWS\system32\svchost.exe -k netsvcs
51.P00 - 正在运行的服务 - Wireless Zero Configuration,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\wzcsvc.dll
内容:C:\WINDOWS\System32\svchost.exe -k netsvcs
52.R01 - IE用户指定空白页 - 空首页,Unknow Owner,
内容:C:\WINDOWS\system32\blank.htm
53.R01 - IE用户指定空白页 - 空首页,Unknow Owner,
内容:C:\WINDOWS\system32\blank.htm
54.R00 - IE自定义搜索引擎 - http://bar.baidu.com/sobar/defaultsearch.html,Unknow Owner,
内容:http://bar.baidu.com/sobar/defaultsearch.html
55.R00 - IE备用搜索引擎 - http://bar.baidu.com/sobar/defaultsearch.html,Unknow Owner,
内容:http://bar.baidu.com/sobar/defaultsearch.html
56.R03 - 搜索挂接 - 雅虎助手,yahoo! china,
CLSID:{406F94F0-504F-4a40-8DFD-58B0666ABEBD}
相关文件:C:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll
内容:coolbar
57.O02 - 浏览器辅助对象(BHO) - Yahoo!Photo,Yahoo! China,
CLSID:{33BBE430-0E42-4f12-B075-8D21ACB10DCB}
相关文件:C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll
58.O02 - 浏览器辅助对象(BHO) - (反钓鱼专家),yahoo! china,
CLSID:{38928D50-8A48-44C2-945F-D2F23F771410}
相关文件:C:\Program Files\Yahoo!\Assistant\Assist\yAngling.dll
59.O02 - 浏览器辅助对象(BHO) - DragSearch BHO,yahoo! china,
CLSID:{62EED7C6-9F02-42f9-B634-98E2899E147B}
相关文件:C:\Program Files\Yahoo!\Assistant\Assist\YDragSearch.dll
60.O02 - 浏览器辅助对象(BHO) - BandIE,Baidu.com, Inc.,
CLSID:{77FEF28E-EB96-44FF-B511-3185DEA48697}
相关文件:C:\Program Files\BaiDu\bar\BaiduBar.dll
zjming12 - 2007-7-27 15:08:00
61.O02 - 浏览器辅助对象(BHO) - assist,Yahoo! China,
CLSID:{FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8}
相关文件:C:\Program Files\Yahoo!\Assistant\Assist\yassist.dll
62.O03 - IE工具条“链接”的标题 - 链接,Unknow Owner,
内容:链接
63.O03 - IE第三方工具条 - 百度超级搜霸,Baidu.com, Inc.,
CLSID:{B580CF65-E151-49C3-B73F-70B13FCA8E86}
相关文件:C:\Program Files\BaiDu\bar\BaiduBar.dll
64.O03 - IE第三方工具条 - 雅虎助手,yahoo! china,
CLSID:{406F94F0-504F-4A40-8DFD-58B0666ABEBD}
相关文件:C:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll
内容:雅虎助手
65.O04 - 自动运行项(Run) - 微软日语输入法,Microsoft,
相关文件:(文件不存在)(隐藏)(系统)rem "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
内容:rem "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
66.O04 - 自动运行项(Run) - 微软智能输入法2002A(动态),Microsoft,
相关文件:(文件不存在)(隐藏)(系统)rem C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
内容:rem C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
67.O04 - 自动运行项(Run) - 微软智能输入法2002A(名称),Microsoft,
相关文件:(文件不存在)(隐藏)(系统)rem C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
内容:rem C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
68.O04 - 自动运行项(Run) - Windows内核检查程序,Microsoft,
相关文件:(文件不存在)(隐藏)(系统)rem rem rem rem C:\WINDOWS\system32\dumprep 0 -k
内容:rem rem rem rem C:\WINDOWS\system32\dumprep 0 -k
69.O04 - 自动运行项(Run) - YLive.exe,Unknow Owner,
相关文件:(文件不存在)(隐藏)(系统)rem rem rem rem C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
内容:rem rem rem rem C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
70.O04 - 自动运行项(Run) - yassistse,Unknow Owner,
相关文件:(文件不存在)(隐藏)(系统)rem rem rem rem C:\Program Files\Yahoo!\Assistant\yAssistSe.exe
内容:rem rem rem rem C:\Program Files\Yahoo!\Assistant\yAssistSe.exe
71.O04 - 自动运行项(Run) - rxukgcm,Unknow Owner,
相关文件:(文件不存在)(隐藏)(系统)rem rem rem rem C:\Program Files\Common Files\Microsoft Shared\uitxjwa.exe
内容:rem rem rem rem C:\Program Files\Common Files\Microsoft Shared\uitxjwa.exe
72.O04 - 自动运行项(Run) - vmhrlbm,Unknow Owner,
相关文件:(文件不存在)(隐藏)(系统)rem rem rem rem C:\Program Files\Common Files\System\vgguxso.exe
内容:rem rem rem rem C:\Program Files\Common Files\System\vgguxso.exe
73.O04 - 自动运行项(Run) - Windows Messenger即时通讯工具,Microsoft,
相关文件:(文件不存在)(隐藏)(系统)rem "C:\Program Files\Messenger\msmsgs.exe" /background
内容:rem "C:\Program Files\Messenger\msmsgs.exe" /background
74.O04 - 自动运行项(Run) - Windows多种输入技术的支持程序,Microsoft Corporation,
相关文件:C:\WINDOWS\system32\ctfmon.exe
内容:C:\WINDOWS\system32\ctfmon.exe
75.O08 - IE右键菜单 - 添加到雅虎订阅(&Y),Yahoo! China,
相关文件:C:\Program Files\Yahoo!\Assistant\Assist\yrss.dll /YRSSMENUEXT
76.O08 - IE右键菜单 - 雅虎搜索,yahoo! china,
相关文件:C:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll /203
77.O16 - 下载的ActiveX插件 - _{73E4740C-08EB-4133-896B-8D0A7C9EE3CD},Unknow Owner,
网页路径:https://mybank.icbc.com.cn/icbc/perbank/AXSafeControls.cab
78.O16 - 下载的ActiveX插件 - Flash播放器,Adobe Systems, Inc.,
CLSID:{D27CDB6E-AE6D-11CF-96B8-444553540000}
相关文件:C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx
网页路径:http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
79.O17 - 本机网络设置 NameServer - 202.102.134.68,202.102.128.68,Unknow Owner,
内容:202.102.134.68,202.102.128.68
80.O17 - 本机网络设置 NameServer - 202.102.154.3 202.102.152.3,Unknow Owner,
内容:202.102.154.3 202.102.152.3
81.O18 - 网络协议过滤器 - OFFICE 相关,Microsoft Corporation,
CLSID:{807553E5-5146-11D5-A672-00B0D022E945}
相关文件:C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
82.O18 - 网络协议处理器 - OFFICE 相关,Microsoft Corporation,
CLSID:{32505114-5902-49B2-880A-1F7738E5A384}
相关文件:C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL
83.O21 - 自启动项SSODL - 管理托盘图标对象的程序,Microsoft Corporation,
CLSID:{35CEC8A3-2BE6-11D2-8773-92E220524153}
相关文件:C:\WINDOWS\system32\stobject.dll
内容:{35CEC8A3-2BE6-11D2-8773-92E220524153}
84.O31 - 浏览栏区对象 - 每日提示,Microsoft Corporation,
CLSID:{4D5C8C25-D075-11d0-B416-00C04FB90376}
相关文件:C:\WINDOWS\system32\shdocvw.dll
85.O31 - 浏览栏区对象 - 雅虎订阅(&Y),Yahoo! China,
CLSID:{19CE93DE-8334-42C6-B2CA-BFE3DF5196A3}
相关文件:C:\Program Files\Yahoo!\Assistant\Assist\yrss.dll
86.O31 - 浏览栏区对象 - 收藏区,Microsoft Corporation,
CLSID:{EFA24E61-B078-11D0-89E4-00C04FC9E26E}
相关文件:C:\WINDOWS\system32\shdocvw.dll
Leoooo - 2007-7-27 15:20:00
http://download.rising.com.cn/for_down/kakatool/kakasetupv4.exe下载卡卡上网安全助手4.0
1 运行瑞星卡卡上网安全助手
2 诊断求助=》电脑诊断日志
3
选择"文件详细信息"、"文件名相似分析"2个选项4 开始扫描=》导出信息,导成txt格式(也可以是htm格式方便自己看,不过论坛不能上传htm格式)
5 把日志中的报告完整拷贝贴上来(附件形式发上来也可以),不要修改(一次发不完请分次发上来)
6
扫日志的时候尽量把不必要的软件关闭 如QQ TM等7 把扫描出来的可疑文件上传给瑞星
http://up.rising.com.cn/webmail/uploadnew.htm
Enao2005 - 2007-7-27 15:38:00
用XDelBox1.3删除(enao.ys168.com 下载)
C:\Program Files\Internet Explorer\PLUGINS\SysWin64.Sys
c:\Program Files\mzdm\erve.dll
c:\Program Files\mzdm\zmqz.dll
打开XDelBox1.3==>在 文件路径 填上文件具体路径==>点 添加==>选中 列表中的文件 点 右键(若要一次性删除多个文件,可以按住键盘的Ctrl,进行多选)==>立刻重启执行删除
下载Sreng(http://www.kztechs.com/sreng/download.html)
打开Sreng.exe==>智能扫描==>勾选 检查进程模块的数字签名==>点 扫描==>扫描完成后按下“保存报告”按钮保存报告日志文件(SREng.LOG),把保存的报告日志文件内容复制-粘贴上来,日志一次粘不完,分次粘完,请不要修改
要是Sreng.exe不能运行,直接重命名为123.bat运行
zjming12 - 2007-7-27 16:38:00
CODE]
2007-07-27,17:01:08
System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
以下内容被选中:
所有的启动项目(包括注册表、启动文件夹、服务等)
浏览器加载项
正在运行的进程(包括进程模块信息)
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<MSMSGS><rem "C:\Program Files\Messenger\msmsgs.exe" /background> [N/A]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><rem "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Publisher]
<PHIME2002ASync><rem C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows Publisher]
<PHIME2002A><rem C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows Publisher]
<KernelFaultCheck><rem rem rem rem %systemroot%\system32\dumprep 0 -k> [N/A]
<YLive.exe><rem rem rem rem C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe> [(Verified)"beijing yahoo consulting and service co., ltd."]
<yassistse><rem rem rem rem C:\Program Files\Yahoo!\Assistant\yAssistSe.exe> [N/A]
<rxukgcm><rem rem rem rem C:\Program Files\Common Files\Microsoft Shared\uitxjwa.exe> [N/A]
<vmhrlbm><rem rem rem rem C:\Program Files\Common Files\System\vgguxso.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Publisher]
<Userinit><C:\WINDOWS\system32\Userinit.exe,> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
<Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A]
==================================
启动文件夹
N/A
==================================
服务
[Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start]
<C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[ATI Smart / ATI Smart][Stopped/Disabled]
<C:\WINDOWS\system32\ati2sgag.exe><>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Windows reir RunThem / reir][Running/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\PROGRA~1\mzdm\wjnw.dll>< >
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
zjming12 - 2007-7-27 17:19:00
==================================
驱动程序
[8e5uycdf / 8e5uycdfj][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\8e5uycdfj.sys><N/A>
[ADProt / ADProt][Stopped/System Start]
<system32\drivers\ADProt.sys><N/A>
[ati2mtag / ati2mtag][Running/Manual Start]
<system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[boot000 / boot000][Stopped/Disabled]
<system32\drivers\boot000.sys><>
[cland / clandt][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\clandt.sys><N/A>
[cnprov / cnprov][Running/Boot Start]
<\SystemRoot\system32\drivers\cnprov.sys><中国互联网络信息中心(CNNIC)>
[Intel(R) PRO Network Connection Driver / E100B][Running/Manual Start]
<system32\DRIVERS\e100b325.sys><Intel Corporation>
[ExpScaner / ExpScaner][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\ExpScan.sys><>
[Microsoft UAA Bus Driver for High Definition Audio / HDAudBus][Running/Manual Start]
<system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
[HookCont / HookCont][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising>
[idnaux / idnaux][Running/Auto Start]
<system32\drivers\idnaux.sys><中国互联网络信息中心(CNNIC)>
[lgkioaj / lgkioaj][Running/Boot Start]
<\SystemRoot\\SystemRoot\System32\drivers\lgkioaj.sys><N/A>
[MEMSCAN / MEMSCAN][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\C:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[nxt03y5ho / nxt03y5ho][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\nxt03y5ho.sys><N/A>
[obcveb5 / obcveb50][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\obcveb50.sys><N/A>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Stopped/Disabled]
<\??\C:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[Sony USB Filter Driver (SONYPVU1) / SONYPVU1][Stopped/Manual Start]
<system32\DRIVERS\SONYPVU1.SYS><Sony Corporation>
[SAMSUNG Mobile USB Device 1.0 driver (WDM) / ss_bus][Stopped/Manual Start]
<system32\DRIVERS\ss_bus.sys><MCCI>
[SAMSUNG Mobile USB Modem 1.0 Filter / ss_mdfl][Stopped/Manual Start]
<system32\DRIVERS\ss_mdfl.sys><MCCI>
[SAMSUNG Mobile USB Modem 1.0 Drivers / ss_mdm][Stopped/Manual Start]
<system32\DRIVERS\ss_mdm.sys><MCCI>
[High Definition Audio Driver (WDM) - SigmaTel CODEC / STHDA][Running/Manual Start]
<system32\drivers\sthda.sys><SigmaTel, Inc.>
[vriscogn / vriscogn][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\vriscogn.sys><Yahoo! China Corporation>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
<system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[yaskp / yaskp][Stopped/Boot Start]
<\SystemRoot\system32\drivers\yaskp.sys><Copyright (C) yahoo Corporation.>
[VIMICRO USB PC Camera / ZSMC302][Running/Manual Start]
<System32\Drivers\usbVM31b.sys><VM>
[npkcusb / npkcusb][Running/Auto Start]
<\??\C:\Program Files\TENCENT\QQ\npkcusb.sys><INCA Internet Co., Ltd.>
==================================
浏览器加载项
[sosHlpr Class]
{00C104F7-0F5C-470C-ABCF-A5B2E70752F1} <C:\WINDOWS\system32\wbdics.dll, Microsoft Corporation>
[Yahoo!Photo]
{33BBE430-0E42-4f12-B075-8D21ACB10DCB} <C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll, Yahoo! China>
[AntiFish Class]
{38928D50-8A48-44C2-945F-D2F23F771410} <C:\Program Files\Yahoo!\Assistant\Assist\yAngling.dll, yahoo! china>
[DragSearch BHO]
{62EED7C6-9F02-42f9-B634-98E2899E147B} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL, yahoo! china>
[BandIE Class]
{77FEF28E-EB96-44FF-B511-3185DEA48697} <C:\PROGRA~1\baidu\bar\baidubar.dll, Baidu.com, Inc.>
[assist]
{FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8} <C:\Program Files\Yahoo!\Assistant\Assist\yassist.dll, Yahoo! China>
[百度超级搜霸]
{B580CF65-E151-49C3-B73F-70B13FCA8E86} <C:\PROGRA~1\baidu\bar\baidubar.dll, Baidu.com, Inc.>
[雅虎助手]
{406F94F0-504F-4A40-8DFD-58B0666ABEBD} <C:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll, yahoo! china>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>
[WebThunder Browser Helper]
{00000AAA-A363-466E-BEF5-9BB68697AA7F} <C:\Program Files\Thunder Network\WebThunder\WebThunderBHO_Now.dll, Thunder Networking Technologies,LTD>
[sosHlpr Class]
{00C104F7-0F5C-470C-ABCF-A5B2E70752F1} <C:\WINDOWS\system32\wbdics.dll, Microsoft Corporation>
[WebThunder Class]
{03507A1A-E0C5-4404-AA26-205385C0892D} <, N/A>
[ActiveMovieControl Object]
{05589FA1-C356-11CE-BF01-00AA0055595A} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[CEnroll Class]
{127698E4-E730-4E5C-A2B1-21490A70C8A1} <C:\WINDOWS\system32\xenroll.dll, Microsoft Corporation>
[iTrusPTA Class]
{1E0DFFCF-27FF-4574-849B-55007349FEDA} <C:\WINDOWS\system32\aliedit\pta.dll, >
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\Mshtml.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[Vod Class]
{2EEDA47E-8D5C-4d7e-B4B6-E16E19218555} <C:\Program Files\Thunder Network\WebThunder\DownAndPlay\DapPlayer1.1.0.46.dll, XunLei>
[Tabular Data Control]
{333C7BC4-460F-11D0-BC04-0080C7055A83} <C:\WINDOWS\system32\tdc.ocx, Microsoft Corporation>
[Yahoo!Photo]
{33BBE430-0E42-4F12-B075-8D21ACB10DCB} <C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll, Yahoo! China>
[IETag Factory]
{38481807-CA0E-42D2-BF39-B33AF135CC4D} <C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\IETAG.DLL, Microsoft Corporation>
[AntiFish Class]
{38928D50-8A48-44C2-945F-D2F23F771410} <C:\Program Files\Yahoo!\Assistant\Assist\yAngling.dll, yahoo! china>
[雅虎助手]
{406F94F0-504F-4A40-8DFD-58B0666ABEBD} <C:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll, yahoo! china>
[HHCtrl Object]
{41B23C28-488E-4E5C-ACE2-BB0BBABE99E8} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[XML Document]
{48123BC4-99D9-11D1-A6B3-00C04FD91555} <%SystemRoot%\system32\msxml3.dll, N/A>
[EditCtrl Class]
{488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\system32\aliedit\aliedit.dll, >
[HHCtrl Object]
{52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Yahoo!Live]
{57421194-58FB-49AE-9B4F-FD48869B9AD4} <C:\Program Files\Yahoo!\Assistant\yaLive.dll, yahoo! china>
[DragSearch BHO]
{62EED7C6-9F02-42F9-B634-98E2899E147B} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL, yahoo! china>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[WangWangObj Class]
{6E213FC7-DD5A-4115-B7E6-D4C7838C361E} <C:\Program Files\淘宝网\淘宝旺旺\WangWangX4.dll, 阿里软件(中国)有限公司>
[Active Desktop Mover]
{72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
[AxInputControl Class]
{73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL, >
[IEAux Class]
{7605CC7C-00FD-4A5F-BAFD-828342DE6279} <C:\PROGRA~1\OCINS\ieaux.dll, 中国互联网络信息中心(CNNIC)>
[Windows Media Services DRM Storage object]
{760C4B83-E211-11D2-BF3E-00805FBE84A6} <C:\WINDOWS\system32\drmstor.dll, Microsoft Corporation>
[SSVHelper Class]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} <C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll, N/A>
[BandIE Class]
{77FEF28E-EB96-44FF-B511-3185DEA48697} <C:\PROGRA~1\baidu\bar\baidubar.dll, Baidu.com, Inc.>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Java Plug-in 1.6.0_01]
{8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll, N/A>
[AxSubmitControl Class]
{8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} <C:\WINDOWS\DOWNLO~1\SUBMIT~1.DLL, >
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\Mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[百度超级搜霸]
zjming12 - 2007-7-27 17:24:00
==================================
驱动程序
[8e5uycdf / 8e5uycdfj][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\8e5uycdfj.sys><N/A>
[ADProt / ADProt][Stopped/System Start]
<system32\drivers\ADProt.sys><N/A>
[ati2mtag / ati2mtag][Running/Manual Start]
<system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[boot000 / boot000][Stopped/Disabled]
<system32\drivers\boot000.sys><>
[cland / clandt][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\clandt.sys><N/A>
[cnprov / cnprov][Running/Boot Start]
<\SystemRoot\system32\drivers\cnprov.sys><中国互联网络信息中心(CNNIC)>
[Intel(R) PRO Network Connection Driver / E100B][Running/Manual Start]
<system32\DRIVERS\e100b325.sys><Intel Corporation>
[ExpScaner / ExpScaner][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\ExpScan.sys><>
[Microsoft UAA Bus Driver for High Definition Audio / HDAudBus][Running/Manual Start]
<system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
[HookCont / HookCont][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising>
[idnaux / idnaux][Running/Auto Start]
<system32\drivers\idnaux.sys><中国互联网络信息中心(CNNIC)>
[lgkioaj / lgkioaj][Running/Boot Start]
<\SystemRoot\\SystemRoot\System32\drivers\lgkioaj.sys><N/A>
[MEMSCAN / MEMSCAN][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\C:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[nxt03y5ho / nxt03y5ho][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\nxt03y5ho.sys><N/A>
[obcveb5 / obcveb50][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\obcveb50.sys><N/A>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Stopped/Disabled]
<\??\C:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[Sony USB Filter Driver (SONYPVU1) / SONYPVU1][Stopped/Manual Start]
<system32\DRIVERS\SONYPVU1.SYS><Sony Corporation>
[SAMSUNG Mobile USB Device 1.0 driver (WDM) / ss_bus][Stopped/Manual Start]
<system32\DRIVERS\ss_bus.sys><MCCI>
[SAMSUNG Mobile USB Modem 1.0 Filter / ss_mdfl][Stopped/Manual Start]
<system32\DRIVERS\ss_mdfl.sys><MCCI>
[SAMSUNG Mobile USB Modem 1.0 Drivers / ss_mdm][Stopped/Manual Start]
<system32\DRIVERS\ss_mdm.sys><MCCI>
[High Definition Audio Driver (WDM) - SigmaTel CODEC / STHDA][Running/Manual Start]
<system32\drivers\sthda.sys><SigmaTel, Inc.>
[vriscogn / vriscogn][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\vriscogn.sys><Yahoo! China Corporation>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
<system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[yaskp / yaskp][Stopped/Boot Start]
<\SystemRoot\system32\drivers\yaskp.sys><Copyright (C) yahoo Corporation.>
[VIMICRO USB PC Camera / ZSMC302][Running/Manual Start]
<System32\Drivers\usbVM31b.sys><VM>
[npkcusb / npkcusb][Running/Auto Start]
<\??\C:\Program Files\TENCENT\QQ\npkcusb.sys><INCA Internet Co., Ltd.>
==================================
浏览器加载项
[sosHlpr Class]
{00C104F7-0F5C-470C-ABCF-A5B2E70752F1} <C:\WINDOWS\system32\wbdics.dll, Microsoft Corporation>
[Yahoo!Photo]
{33BBE430-0E42-4f12-B075-8D21ACB10DCB} <C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll, Yahoo! China>
[AntiFish Class]
{38928D50-8A48-44C2-945F-D2F23F771410} <C:\Program Files\Yahoo!\Assistant\Assist\yAngling.dll, yahoo! china>
[DragSearch BHO]
{62EED7C6-9F02-42f9-B634-98E2899E147B} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL, yahoo! china>
[BandIE Class]
{77FEF28E-EB96-44FF-B511-3185DEA48697} <C:\PROGRA~1\baidu\bar\baidubar.dll, Baidu.com, Inc.>
[assist]
{FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8} <C:\Program Files\Yahoo!\Assistant\Assist\yassist.dll, Yahoo! China>
[百度超级搜霸]
{B580CF65-E151-49C3-B73F-70B13FCA8E86} <C:\PROGRA~1\baidu\bar\baidubar.dll, Baidu.com, Inc.>
[雅虎助手]
{406F94F0-504F-4A40-8DFD-58B0666ABEBD} <C:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll, yahoo! china>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>
[WebThunder Browser Helper]
{00000AAA-A363-466E-BEF5-9BB68697AA7F} <C:\Program Files\Thunder Network\WebThunder\WebThunderBHO_Now.dll, Thunder Networking Technologies,LTD>
[sosHlpr Class]
{00C104F7-0F5C-470C-ABCF-A5B2E70752F1} <C:\WINDOWS\system32\wbdics.dll, Microsoft Corporation>
[WebThunder Class]
{03507A1A-E0C5-4404-AA26-205385C0892D} <, N/A>
[ActiveMovieControl Object]
{05589FA1-C356-11CE-BF01-00AA0055595A} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[CEnroll Class]
{127698E4-E730-4E5C-A2B1-21490A70C8A1} <C:\WINDOWS\system32\xenroll.dll, Microsoft Corporation>
[iTrusPTA Class]
{1E0DFFCF-27FF-4574-849B-55007349FEDA} <C:\WINDOWS\system32\aliedit\pta.dll, >
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\Mshtml.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[Vod Class]
{2EEDA47E-8D5C-4d7e-B4B6-E16E19218555} <C:\Program Files\Thunder Network\WebThunder\DownAndPlay\DapPlayer1.1.0.46.dll, XunLei>
[Tabular Data Control]
{333C7BC4-460F-11D0-BC04-0080C7055A83} <C:\WINDOWS\system32\tdc.ocx, Microsoft Corporation>
[Yahoo!Photo]
{33BBE430-0E42-4F12-B075-8D21ACB10DCB} <C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll, Yahoo! China>
[IETag Factory]
{38481807-CA0E-42D2-BF39-B33AF135CC4D} <C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\IETAG.DLL, Microsoft Corporation>
[AntiFish Class]
{38928D50-8A48-44C2-945F-D2F23F771410} <C:\Program Files\Yahoo!\Assistant\Assist\yAngling.dll, yahoo! china>
[雅虎助手]
{406F94F0-504F-4A40-8DFD-58B0666ABEBD} <C:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll, yahoo! china>
[HHCtrl Object]
{41B23C28-488E-4E5C-ACE2-BB0BBABE99E8} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[XML Document]
{48123BC4-99D9-11D1-A6B3-00C04FD91555} <%SystemRoot%\system32\msxml3.dll, N/A>
[EditCtrl Class]
{488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\system32\aliedit\aliedit.dll, >
[HHCtrl Object]
{52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Yahoo!Live]
{57421194-58FB-49AE-9B4F-FD48869B9AD4} <C:\Program Files\Yahoo!\Assistant\yaLive.dll, yahoo! china>
[DragSearch BHO]
{62EED7C6-9F02-42F9-B634-98E2899E147B} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL, yahoo! china>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[WangWangObj Class]
{6E213FC7-DD5A-4115-B7E6-D4C7838C361E} <C:\Program Files\淘宝网\淘宝旺旺\WangWangX4.dll, 阿里软件(中国)有限公司>
[Active Desktop Mover]
{72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
[AxInputControl Class]
{73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL, >
[IEAux Class]
{7605CC7C-00FD-4A5F-BAFD-828342DE6279} <C:\PROGRA~1\OCINS\ieaux.dll, 中国互联网络信息中心(CNNIC)>
[Windows Media Services DRM Storage object]
{760C4B83-E211-11D2-BF3E-00805FBE84A6} <C:\WINDOWS\system32\drmstor.dll, Microsoft Corporation>
[SSVHelper Class]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} <C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll, N/A>
[BandIE Class]
{77FEF28E-EB96-44FF-B511-3185DEA48697} <C:\PROGRA~1\baidu\bar\baidubar.dll, Baidu.com, Inc.>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Java Plug-in 1.6.0_01]
{8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll, N/A>
[AxSubmitControl Class]
{8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} <C:\WINDOWS\DOWNLO~1\SUBMIT~1.DLL, >
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\Mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
lxr123 - 2007-7-27 17:25:00
71.O04 - 自动运行项(Run) - rxukgcm,Unknow Owner,
相关文件:(文件不存在)(隐藏)(系统)rem rem rem rem C:\Program Files\Common Files\Microsoft Shared\uitxjwa.exe
内容:rem rem rem rem C:\Program Files\Common Files\Microsoft Shared\uitxjwa.exe
72.O04 - 自动运行项(Run) - vmhrlbm,Unknow Owner,
相关文件:(文件不存在)(隐藏)(系统)rem rem rem rem C:\Program Files\Common Files\System\vgguxso.exe
内容:rem rem rem rem C:\Program Files\Common Files\System\vgguxso.exe
可疑。
zjming12 - 2007-7-27 17:32:00
请问用这个查出来的进程可疑文件怎么修复
有毒必问 - 2007-7-27 17:47:00
回复9楼
查出来的,删除.
开始的距离 - 2007-7-27 21:05:00
应该不是病毒,有段时间我也这样,要修复系统,用瑞星应该没问题,反正到后面我是好了.
gwlucker - 2007-7-27 21:10:00
<rxukgcm><rem rem rem rem C:\Program Files\Common Files\Microsoft Shared\uitxjwa.exe> [N/A]
<vmhrlbm><rem rem rem rem C:\Program Files\Common Files\System\vgguxso.exe> [N/A]
7位随机码,置顶里看去吧...AV终结系列..
1
© 2000 - 2026 Rising Corp. Ltd.