瑞星卡卡安全论坛
fangjie001 - 2007-8-6 2:54:00
各位高手 我的电脑中了魔域大盗了 瑞星杀不掉啊 请大家帮帮忙啊
[用户系统信息]Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; TencentTraveler )
骑着YY趟社会 - 2007-8-6 7:48:00
http://download.rising.com.cn/for_down/kakatool/kakasetupv4.exe下载卡卡上网安全助手4.0
1 运行瑞星卡卡上网安全助手
2 诊断求助=》电脑诊断日志
3
选择"文件详细信息"、"文件名相似分析"2个选项4 开始扫描＝》导出信息，导成txt格式（也可以是htm格式方便自己看，不过论坛不能上传htm格式）
5 把日志中的报告完整拷贝贴上来(附件形式发上来也可以)，不要修改（一次发不完请分次发上来）
6
扫日志的时候尽量把不必要的软件关闭 如QQ TM等7 把扫描出来的可疑文件上传给瑞星
http://up.rising.com.cn/webmail/uploadnew.htm
fangjie001 - 2007-8-6 14:18:00
+ 注册表自运行项目
+ 系统服务
+ HKLM\System\CurrentControlSet\Services
RfwProxySrv
[A ] 1. d:\新建文件夹\rising\rfw\rfwproxy.exe
Beijing Rising Technology Co., Ltd.
Rising Personal Proxy Service
.text,.rdata,.data,.rsrc,
RfwService
[A ] 2. d:\新建文件夹\rising\rfw\rfwsrv.exe
Beijing Rising Technology Co., Ltd.
Rising Personal FireWall Service
.text,.rdata,.data,.rsrc,
rpcapd
[A ] 3. c:\program files\winpcap\rpcapd.exe
.text,.rdata,.data,
RsCCenter
[A ] 4. d:\新建文件夹\rising\rav\ccenter.exe
Beijing Rising Technology Co., Ltd.
CCenter
.text,.rdata,.data,.rsrc,
RsRavMon
[A ] 5. d:\新建文件夹\rising\rav\ravmond.exe
Beijing Rising Technology Co., Ltd.
RavMond
.text,.rdata,.data,.rsrc,
+ 内核驱动
+ HKLM\System\CurrentControlSet\Services
ALCXWDM
[A ] 6. c:\windows\system32\drivers\alcxwdm.sys
Avance Logic, Inc.
Avance AC'97 Audio Driver (WDM)
.text,.rdata,.data,PAGE,INIT,.rsrc,.reloc,
BaseTDI
[A ] 7. c:\windows\system32\drivers\basetdi.sys
Beijing Rising Technology Co., Ltd.
basetdi
.text,.rdata,.data,INIT,.rsrc,.reloc,
ExpScaner
[A ] 8. d:\新建文件夹\rising\rav\expscan.sys
ExpScan.sys
.text,.rdata,.data,INIT,.rsrc,.reloc,
HookCont
[A ] 9. d:\新建文件夹\rising\rav\hookcont.sys
Rising
HookCont
.text,.rdata,.data,INIT,.rsrc,.reloc,
HookReg
[A ] 10. d:\新建文件夹\rising\rav\hookreg.sys
.text,.rdata,.data,INIT,.rsrc,.reloc,
HookSys
[A ] 11. d:\新建文件夹\rising\rav\hooksys.sys
Rising
Hooksys
.text,.rdata,.data,INIT,.rsrc,.reloc,
HookUrl
[A ] 12. d:\新建文件夹\rising\rfw\hookurl.sys
Beijing Rising Technology Co., Ltd.
HookUrl
.text,.rdata,.data,INIT,.rsrc,.reloc,
MEMSCAN
[A ] 13. d:\新建文件夹\rising\rav\memscan.sys
Beijing Rising Technology Co., Ltd.
MemScan Driver
.text,.rdata,.data,INIT,.rsrc,.reloc,
mProcRs
[A ] 14. d:\新建文件夹\rising\rfw\mprocrs.sys
Beijing Rising Technology Co., Ltd.
Rising Personal FireWall mprocrs.sys
.text,.rdata,.data,INIT,.rsrc,.reloc,
NPF
[A ] 15. c:\windows\system32\drivers\npf.sys
Politecnico di Torino
NPF Driver - TME extensions
.text,.rdata,.data,INIT,.rsrc,.reloc,
RsAntiSpyware
[A ] 16. c:\windows\system32\drivers\rsboot.sys
Beijing Rising Technology Co., Ltd.
Anti-RootKit Driver
.text,.rdata,.data,INIT,.rsrc,.reloc,
fangjie001 - 2007-8-6 14:19:00
RsFwDrv
[A ] 17. d:\新建文件夹\rising\rfw\rsfwdrv.sys
Beijing Rising Technology Co., Ltd.
nt_fwdrv
.text,.rdata,.data,INIT,.rsrc,.reloc,
RsNTGDI
[A ] 18. c:\windows\system32\drivers\rsntgdi.sys
Beijing Rising Technology Co., Ltd.
RsNTGDI
.text,.rdata,INIT,.rsrc,.reloc,
RSPPSYS
[A ] 19. d:\新建文件夹\rising\rav\rsppsys.sys
Rising
RSPPSYS.SYS
.text,.rdata,.data,INIT,.rsrc,.reloc,
Secdrv
[A ] 20. c:\windows\system32\drivers\secdrv.sys
.text,.data,INIT,.reloc,
+ 系统登陆自运行
+ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
UIHost
[A ] 21. c:\windows\resources\themes\login\logonui-3.1.exe
Microsoft Corporation
Windows Logon UI
.text,.data,.rsrc,
+ IE浏览器加载模块
+ HKCU\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks
{CFBFAE00-17A6-11D0-99CB-00C04FD64497}
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
+ HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions
Exec
[A ] 23. d:\浩方\浩方对战平台\gameclient.exe
上海浩方在线信息技术有限公司
浩方对战平台
.text,.rdata,.data,.rsrc,
+ 资源管理器加载模块
+ HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}
[A ] 24. c:\windows\system32\ieudinit.exe
Microsoft Corporation
IE Per User Active Setup Uninstall Utility
.text,.data,.rsrc,.reloc,
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
HyperTerminal Icon Ext
[A ] 25. c:\windows\system32\hticons.dll
Hilgraeve, Inc.
HyperTerminal Applet Library
.text,.data,.rsrc,.reloc,
IE Search Band
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
Shell DocObject Viewer
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
InternetShortcut
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
Microsoft Url History Service
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
fangjie001 - 2007-8-6 14:20:00
History
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
Temporary Internet Files
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
Temporary Internet Files
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
Microsoft Url Search Hook
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
The Internet
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
Internet Name Space
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
IE Microsoft BrowserBand
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
IE Fade Task
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
IE Menu Desk Bar
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
IE AutoComplete
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
IE Navigation Bar
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
IE Menu Site
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
IE Menu Band
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
IE Microsoft History AutoComplete List
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
fangjie001 - 2007-8-6 14:20:00
IE Tracking Shell Menu
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
IE IShellFolderBand
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
IE BandProxy
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
IE MRU AutoComplete List
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
IE RSS Feeder Folder
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
IE Microsoft Shell Folder AutoComplete List
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
IE Microsoft Multiple AutoComplete List Container
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
Microsoft Browser Architecture
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
IE Shell Rebar BandSite
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
IE Shell Band Site Menu
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
&Links
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
IE Registry Tree Options Utility
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
IE User Assist
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
IE Custom MRU AutoCompleted List
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
RISING
[AM] 26. c:\windows\system32\ravext.dll
Beijing Rising Technology Co., Ltd.
Rising Shell Ext Module
.text,.rdata,.data,.rsrc,.reloc,
WinRAR shell extension
[A ] 27. d:\rar\rarext.dll
.text,.data,.tls,.idata,.edata,.rsrc,.reloc,
Windows木马清道夫
[A ] 28. d:\windows_%c2%ed%c7%e5%b5%c0%b7%f2 2007 v10.0 build 0405 %c2%cc_%b0%e6\ftc\ftccommenu.dll
Fygsoft and Microsoft
Com组件菜单
CODE,DATA,BSS,.idata,.edata,.reloc,.rsrc,
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}
[AM] 29. c:\windows\system32\shlhook.dll
Beijing Rising Technology Co., Ltd.
shlhook Module
.text,.rdata,.data,.rsrc,.reloc,
{32CD708B-60A7-4C00-9377-D73EAA495F0F}
[AM] 26. c:\windows\system32\ravext.dll
Beijing Rising Technology Co., Ltd.
Rising Shell Ext Module
.text,.rdata,.data,.rsrc,.reloc,
fangjie001 - 2007-8-6 14:21:00
+ 用户登陆自运行项目
+ HKLM\Software\Microsoft\Windows\CurrentVersion\Run
SoundMan
[AM] 30. c:\windows\soundman.exe
Avance Logic, Inc.
Avance Sound Manager
.text,.rdata,.data,.rsrc,
runeip
[AM] 31. c:\program files\rising\antispyware\runiep.exe
Beijing Rising Technology Co., Ltd.
Rising AntiSpyware Monitor
.text,.rdata,.data,.rsrc,
RavTask
[A ] 32. d:\新建文件夹\rising\rav\ravtask.exe
Beijing Rising Technology Co., Ltd.
RavTimer
.text,.rdata,.data,.rsrc,
RfwMain
[AM] 33. d:\新建文件夹\rising\rfw\rfwmain.exe
Beijing Rising Technology Co., Ltd.
Rising Personal FireWall Main Program
.text,.rdata,.data,.rsrc,
Memory Saviour
[AM] 34. d:\内存\memorysaviour\memorysaviour.exe
UPX0,UPX1,.rsrc,
+ 开机执行
+ HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
BootExecute
[A ] 35. c:\windows\system32\bsmain.exe
Beijing Rising Technology Co., Ltd.
BootScan
.text,.data,.rsrc,.reloc,
+ 映像劫持
+ HKCR\.html
htmlfile\open\Command
[A ] 36. d:\tt\ttraveler.exe
Tencent
Tencent Traveler
.text,.rdata,.data,.rsrc,
htmlfile\TencentTraveler\Command
[A ] 36. d:\tt\ttraveler.exe
Tencent
Tencent Traveler
.text,.rdata,.data,.rsrc,
+ HKCR\.htm
htmlfile\open\Command
[A ] 36. d:\tt\ttraveler.exe
Tencent
Tencent Traveler
.text,.rdata,.data,.rsrc,
htmlfile\TencentTraveler\Command
[A ] 36. d:\tt\ttraveler.exe
Tencent
Tencent Traveler
.text,.rdata,.data,.rsrc,
fangjie001 - 2007-8-6 14:22:00
+ 正在运行的进程
+ 00000144(324) MemorySaviour.exe
00400000[00094000]
[AM] 34. d:\内存\memorysaviour\memorysaviour.exe
UPX0,UPX1,.rsrc,
00EF0000[00012000]
[ M] 37. d:\内存\memorysaviour\clnmem.dll
UPX0,UPX1,.rsrc,
10000000[0001B000]
[ M] 38. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,
+ 0000018c(396) ctfmon.exe
10000000[0001B000]
[ M] 38. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,
00BC0000[00012000]
[ M] 37. d:\内存\memorysaviour\clnmem.dll
UPX0,UPX1,.rsrc,
+ 000001bc(444) svchost.exe
00EA0000[00012000]
[ M] 37. d:\内存\memorysaviour\clnmem.dll
UPX0,UPX1,.rsrc,
+ 000001c8(456) smss.exe
+ 0000020c(524) csrss.exe
03770000[00012000]
[ M] 37. d:\内存\memorysaviour\clnmem.dll
UPX0,UPX1,.rsrc,
+ 00000224(548) winlogon.exe
72C80000[00008000]
[ M] 39. c:\windows\system32\msacm32.drv
Microsoft Corporation
Microsoft Sound Mapper
.text,.data,.rsrc,.reloc,
011A0000[00012000]
[ M] 37. d:\内存\memorysaviour\clnmem.dll
UPX0,UPX1,.rsrc,
+ 00000250(592) services.exe
00050000[00012000]
[ M] 37. d:\内存\memorysaviour\clnmem.dll
UPX0,UPX1,.rsrc,
+ 0000025c(604) lsass.exe
00CD0000[00012000]
[ M] 37. d:\内存\memorysaviour\clnmem.dll
UPX0,UPX1,.rsrc,
+ 000002ec(748) alg.exe
00920000[00012000]
[ M] 37. d:\内存\memorysaviour\clnmem.dll
UPX0,UPX1,.rsrc,
+ 000002f0(752) svchost.exe
00E90000[00012000]
[ M] 37. d:\内存\memorysaviour\clnmem.dll
UPX0,UPX1,.rsrc,
+ 0000032c(812) svchost.exe
00B40000[00012000]
[ M] 37. d:\内存\memorysaviour\clnmem.dll
UPX0,UPX1,.rsrc,
+ 0000038c(908) svchost.exe
00970000[00009000]
[ M] 40. c:\windows\system32\normaliz.dll
Microsoft Corporation
Unicode Normalization DLL
.text,.data,.rsrc,.reloc,
6E850000[00045000]
[ M] 41. c:\windows\system32\iertutil.dll
Microsoft Corporation
Run time utility for Internet Explorer
.text,.data,.rsrc,.reloc,
028E0000[00012000]
[ M] 37. d:\内存\memorysaviour\clnmem.dll
UPX0,UPX1,.rsrc,
50E60000[0000C000]
[ M] 42. c:\windows\system32\wups2.dll
Microsoft Corporation
Windows Update client proxy stub 2
.text,.orpc,.data,.rsrc,.reloc,
+ 000003c4(964) svchost.exe
009A0000[00012000]
[ M] 37. d:\内存\memorysaviour\clnmem.dll
UPX0,UPX1,.rsrc,
+ 0000040c(1036) svchost.exe
00800000[00009000]
[ M] 40. c:\windows\system32\normaliz.dll
Microsoft Corporation
Unicode Normalization DLL
.text,.data,.rsrc,.reloc,
6E850000[00045000]
[ M] 41. c:\windows\system32\iertutil.dll
Microsoft Corporation
Run time utility for Internet Explorer
.text,.data,.rsrc,.reloc,
01530000[00012000]
[ M] 37. d:\内存\memorysaviour\clnmem.dll
UPX0,UPX1,.rsrc,
+ 00000514(1300) spoolsv.exe
00BA0000[00012000]
[ M] 37. d:\内存\memorysaviour\clnmem.dll
UPX0,UPX1,.rsrc,
+ 000005ec(1516) Explorer.EXE
00400000[00009000]
[ M] 40. c:\windows\system32\normaliz.dll
Microsoft Corporation
Unicode Normalization DLL
.text,.data,.rsrc,.reloc,
6E850000[00045000]
[ M] 41. c:\windows\system32\iertutil.dll
Microsoft Corporation
Run time utility for Internet Explorer
.text,.data,.rsrc,.reloc,
10000000[00011000]
[AM] 29. c:\windows\system32\shlhook.dll
Beijing Rising Technology Co., Ltd.
shlhook Module
.text,.rdata,.data,.rsrc,.reloc,
00EE0000[0001B000]
[AM] 26. c:\windows\system32\ravext.dll
Beijing Rising Technology Co., Ltd.
Rising Shell Ext Module
.text,.rdata,.data,.rsrc,.reloc,
7E1E0000[005CA000]
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
01B30000[0001B000]
[ M] 38. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,
72C80000[00008000]
[ M] 39. c:\windows\system32\msacm32.drv
Microsoft Corporation
Microsoft Sound Mapper
.text,.data,.rsrc,.reloc,
019E0000[00012000]
[ M] 37. d:\内存\memorysaviour\clnmem.dll
UPX0,UPX1,.rsrc,
+ 00000628(1576) RavStub.exe
00400000[00018000]
[ M] 43. d:\新建文件夹\rising\rav\ravstub.exe
Beijing Rising Technology Co., Ltd.
Rising RavStub
.text,.rdata,.data,.rsrc,
10000000[0001B000]
[ M] 44. d:\新建文件夹\rising\rav\rscommx.dll
rising
RsCommX
.text,.rdata,.data,.rsrc,.reloc,
23700000[0001A000]
[ M] 45. d:\新建文件夹\rising\rav\rscommon.dll
Beijing Rising Technology Co., Ltd.
Rising Common Function Dynamic Link Library
.text,.rdata,.data,.rsrc,.reloc,
00C30000[00012000]
[ M] 37. d:\内存\memorysaviour\clnmem.dll
UPX0,UPX1,.rsrc,
+ 000006c4(1732) runiep.exe
00400000[00012000]
[AM] 31. c:\program files\rising\antispyware\runiep.exe
Beijing Rising Technology Co., Ltd.
Rising AntiSpyware Monitor
.text,.rdata,.data,.rsrc,
00C00000[0001B000]
[ M] 38. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,
00E30000[00012000]
[ M] 37. d:\内存\memorysaviour\clnmem.dll
UPX0,UPX1,.rsrc,
+ 000006d8(1752) SOUNDMAN.EXE
00400000[0000D000]
[AM] 30. c:\windows\soundman.exe
Avance Logic, Inc.
Avance Sound Manager
.text,.rdata,.data,.rsrc,
72C80000[00008000]
[ M] 39. c:\windows\system32\msacm32.drv
Microsoft Corporation
Microsoft Sound Mapper
.text,.data,.rsrc,.reloc,
10000000[0001B000]
[ M] 38. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,
01470000[00012000]
[ M] 37. d:\内存\memorysaviour\clnmem.dll
UPX0,UPX1,.rsrc,
+ 0000070c(1804) RfwMain.exe
00400000[00073000]
[AM] 33. d:\新建文件夹\rising\rfw\rfwmain.exe
Beijing Rising Technology Co., Ltd.
Rising Personal FireWall Main Program
.text,.rdata,.data,.rsrc,
26600000[0007D000]
[ M] 46. d:\新建文件夹\rising\rfw\rsguilib.dll
Beijing Rising Technology Co., Ltd.
Rising GUI Library Loader
.text,.rdata,.data,.rsrc,.reloc,
23700000[0001A000]
[ M] 47. d:\新建文件夹\rising\rfw\rscommon.dll
Beijing Rising Technology Co., Ltd.
Rising Common Function Dynamic Link Library
.text,.rdata,.data,.rsrc,.reloc,
10000000[0000F000]
[ M] 48. d:\新建文件夹\rising\rfw\rfwctrl.dll
Beijing Rising Technology Co., Ltd.
RfwCtrl DLL
.text,.rdata,.data,.rsrc,.reloc,
23800000[0001A000]
[ M] 49. d:\新建文件夹\rising\rfw\rsxml.dll
Beijing Rising Technology Co., Ltd.
RsXML
.text,.rdata,.data,.rsrc,.reloc,
23900000[00031000]
[ M] 50. d:\新建文件夹\rising\rfw\pngdll.dll
Beijing Rising Technology Co., Ltd.
Rising .Png File Loader Dynamic Link Library
.text,.rdata,.data,.rsrc,.reloc,
01320000[0001B000]
[ M] 38. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,
01580000[00012000]
[ M] 37. d:\内存\memorysaviour\clnmem.dll
UPX0,UPX1,.rsrc,
+ 00000c38(3128) Ras.exe
00400000[0013F000]
[ M] 51. c:\program files\rising\antispyware\ras.exe
Beijing Rising Technology Co., Ltd.
Rising AntiSpyware
.text,.rdata,.data,.rsrc,
00380000[00009000]
[ M] 40. c:\windows\system32\normaliz.dll
Microsoft Corporation
Unicode Normalization DLL
.text,.data,.rsrc,.reloc,
6E850000[00045000]
[ M] 41. c:\windows\system32\iertutil.dll
Microsoft Corporation
Run time utility for Internet Explorer
.text,.data,.rsrc,.reloc,
10000000[000A3000]
[ M] 52. c:\program files\rising\antispyware\rasgui.dll
Beijing Rising Technology Co., Ltd.
RasGUI
.text,.rdata,.data,.rsrc,.reloc,
01900000[0001B000]
[ M] 38. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,
7E1E0000[005CA000]
[AM] 22. c:\windows\system32\ieframe.dll
Microsoft Corporation
Internet Explorer
.text,.data,.rsrc,.reloc,
02400000[00012000]
[ M] 37. d:\内存\memorysaviour\clnmem.dll
UPX0,UPX1,.rsrc,
fangjie001 - 2007-8-6 14:23:00
各位大侠 很长 但是本人相当着急啊 号被盗了3次 损失了很多钱啊 拜托各位帮帮忙
1
© 2000 - 2026 Rising Corp. Ltd.