一开机瑞星监控就被禁用。

天使来了初生襁褓狮帖子:195 注册: 2006-09-04 来自:	发表于： 2006-10-09 13:46 \| 只看楼主短消息资料字号：小中大 21楼正在运行的进程 [PID: 404][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 468][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 492][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 540][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 552][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 692][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 760][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 796][C:\Program Files\Rising\Rav\CCenter.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3] [PID: 816][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 860][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 884][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 936][C:\Program Files\Rising\Rav\Ravmond.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 1, 35] [C:\Program Files\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 19] [C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1] [C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2] [C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11] [C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [C:\Program Files\Rising\Rav\RsLog.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20] [C:\Program Files\Rising\Rav\HOOKSYS.dll] [Beijing Rising Technology Co., Ltd., 18, 1, 0, 11] [C:\Program Files\Rising\Rav\Scanner.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 32] [C:\Program Files\Rising\Rav\libload.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10] [C:\Program Files\Rising\Rav\VirusLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 12] [C:\Program Files\Rising\Rav\regmon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6] [C:\Program Files\Rising\Rav\HookWeb.dll] [rising, 18, 0, 0, 2] [C:\Program Files\Rising\Rav\MemMon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10] [C:\Program Files\Rising\Rav\expscan.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [C:\Program Files\Rising\Rav\mPorts.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3] [C:\Program Files\Rising\Rav\MailMon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5] [C:\Program Files\Rising\Rav\SpamEng.dll] [N/A, 18, 0, 0, 6] [C:\Program Files\Rising\Rav\engine.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 34] [C:\Program Files\Rising\Rav\PostTrt.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 16] [C:\Program Files\Rising\Rav\UnExe.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11] [C:\Program Files\Rising\Rav\ScanExec.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11] [C:\Program Files\Rising\Rav\ScanEx.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 27] [C:\Program Files\Rising\Rav\RSUnpack.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 17] [C:\Program Files\Rising\Rav\NvFile.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 7] [C:\Program Files\Rising\Rav\ScanMac.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10] [C:\Program Files\Rising\Rav\ScanSct.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 19] [C:\Program Files\Rising\Rav\Unpacker.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5] [C:\Program Files\Rising\Rav\ExtOLE.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6] [PID: 1108][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 21] [C:\Program Files\WinRAR\rarext.dll] [N/A, N/A] [C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [PID: 1128][c:\program files\rising\rfw\rfwproxy.exe] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 14] [c:\program files\rising\rfw\RfwRule.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 13] [c:\program files\rising\rfw\MonMid.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 2] [PID: 1180][c:\program files\rising\rfw\rfwsrv.exe] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 33] [c:\program files\rising\rfw\RfwRule.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 13] [c:\program files\rising\rfw\rfwlog.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 6] [c:\program files\rising\rfw\Rfwdrv.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 21] [c:\program files\rising\rfw\MonDrv.dll] [rs, 1, 0, 0, 4] [c:\program files\rising\rfw\ProcLib.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 9] [PID: 1380][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)] [C:\WINDOWS\system32\CNMLM20.DLL] [CANON INC., 1.32.2.2] [PID: 1488][C:\Program Files\Rising\Rav\RavStub.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 16] [C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1] [C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [PID: 1760][C:\WINDOWS\System32\nvsvc32.exe] [NVIDIA Corporation, 6.13.10.2832] [PID: 1832][C:\Program Files\Rising\Rfw\rfwmain.exe] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 52] [C:\Program Files\Rising\Rfw\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 23] [C:\Program Files\Rising\Rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [C:\Program Files\Rising\Rfw\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5] [PID: 1856][C:\Documents and Settings\All Users\Documents\新建文件夹\Thunder\Thunder.exe] [Thunder Networking Technologies,LTD, 5.1.6.192]
天使来了初生襁褓狮帖子:195 注册: 2006-09-04 来自:

天使来了初生襁褓狮帖子:195 注册: 2006-09-04 来自:	发表于： 2006-10-09 13:46 \| 只看楼主短消息资料字号：小中大 22楼 [C:\Documents and Settings\All Users\Documents\新建文件夹\Thunder\Program\UpdateExec.Dll] [N/A, N/A] [PID: 1864][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 160][C:\Program Files\racer-henan-cnc\racer.exe] [Putian Runway, 2, 0, 51, 92] [C:\Program Files\racer-henan-cnc\rwxre.dll] [Mozilla Foundation, 1.7.3: 2005040616] [C:\Program Files\racer-henan-cnc\nspr4.dll] [Netscape Communications Corporation, 4.5 Beta] [C:\Program Files\racer-henan-cnc\xpcom.dll] [Mozilla Foundation, 1.7.3: 2005040616] [C:\Program Files\racer-henan-cnc\nss3.dll] [Netscape Communications Corporation, 3.9.1] [C:\Program Files\racer-henan-cnc\softokn3.dll] [Netscape Communications Corporation, 3.9.1] [C:\Program Files\racer-henan-cnc\gkgfx.dll] [Mozilla Foundation, 1.7.3: 2005040616] [C:\Program Files\racer-henan-cnc\js3250.dll] [Netscape Communications Corporation, 4.0] [C:\Program Files\racer-henan-cnc\components\racer_base_comp.dll] [Putian Runway, 2,0,47,87] [C:\Program Files\racer-henan-cnc\xpcom_compat.dll] [Mozilla Foundation, 1.7.3: 2005040616] [C:\Program Files\racer-henan-cnc\racer_base.dll] [Putian Runway, 2,0,47,87] [C:\Program Files\racer-henan-cnc\components\pipnss.dll] [Mozilla Foundation, 1.7.3: 2005040616] [C:\Program Files\racer-henan-cnc\components\gklayout.dll] [Mozilla Foundation, 1.7.3: 2005040616] [C:\Program Files\racer-henan-cnc\components\jar50.dll] [Mozilla Foundation, 1.7.3: 2005040616] [C:\Program Files\racer-henan-cnc\components\xpcom_compat_c.dll] [Mozilla Foundation, 1.7.3: 2005040616] [C:\Program Files\racer-henan-cnc\components\racer_ad_comp.dll] [Putian Runway, 2,0,47,87] [C:\Program Files\racer-henan-cnc\components\racer_access_dhcpplus.dll] [Putian Runway, 2,0,47,87] [C:\Program Files\racer-henan-cnc\dhcpplus.dll] [北京润汇科技有限公司, 0, 13, 21, 45] [C:\Program Files\racer-henan-cnc\components\racer_nss4_comp.dll] [Putian Runway, 2,0,47,87] [C:\Program Files\racer-henan-cnc\nss4.dll] [北京普天润汇科技有限公司, 1, 0, 0, 3] [C:\Program Files\racer-henan-cnc\wpcap.dll] [NetGroup - Politecnico di Torino, 3, 1, 0, 24] [C:\Program Files\racer-henan-cnc\packet.dll] [NetGroup - Politecnico di Torino, 3, 1, 0, 24] [C:\Program Files\racer-henan-cnc\WanPacket.dll] [NetGroup - Politecnico di Torino, 3, 1, 0, 24] [PID: 968][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 2120][C:\Program Files\racer-henan-cnc\RacerKp.exe] [北京润汇科技有限公司, 1, 0, 0, 1] [PID: 2332][C:\WINDOWS\system32\wuauclt.exe] [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)] [PID: 2568][C:\Program Files\Rising\Rav\RavMon.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 1, 33] [C:\Program Files\Rising\Rav\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 26] [C:\Program Files\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 19] [C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2] [C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11] [C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1] [C:\Program Files\Rising\Rav\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5] [PID: 2916][C:\Program Files\Rising\Rav\RsAgent.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 12] [C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1] [PID: 2936][C:\WINDOWS\msagent\AgentSvr.exe] [Microsoft Corporation, 2.00.0.3422] [PID: 3088][C:\Documents and Settings\zzp\桌面\SREng\SREng.exe] [Smallfrogs Studio, 2.2.6.605] ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\system32\winhlp32.exe %1] .INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf [D:\] [AutoRun] open=sxs.exe shellexecute=sxs.exe shell\Auto\command=sxs.exe [E:\] [AutoRun] open=sxs.exe shellexecute=sxs.exe shell\Auto\command=sxs.exe [F:\] [AutoRun] open=sxs.exe shellexecute=sxs.exe shell\Auto\command=sxs.exe ================================== HOSTS 文件 127.0.0.1 localhost ==================================
天使来了初生襁褓狮帖子:195 注册: 2006-09-04 来自:

我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林	发表于： 2006-10-09 13:52 \| 短消息资料字号：小中大 23楼注意，你要注意，不要双击打开DEF分区要不然，病毒永远无法杀净。先看一下这个帖子 http://forum.ikaka.com/topic.asp?board=3&artid=8130575 用WINRAR删除 DEF分区，根目录下的sxs.exe，Autorun.inf 打开System Repair Engineer（也就是你的扫描日志软件SREng.exe），点“启动项目，服务，点“驱动程序”勾选“隐藏以认证的微软服务”选中病毒服务NetGroup Packet Filter Driver，选择“删除服务”点“设置”选择“否” 重启后删除 C:\WINDOWS\system32\drivers\npf.sys 如果方便，把sxs.exe发到我的邮箱twtxk@126.com
我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林

天使来了初生襁褓狮帖子:195 注册: 2006-09-04 来自:	发表于： 2006-10-09 14:22 \| 只看楼主短消息资料字号：小中大 24楼出现下面这个提示，可以删吗？附件: 文件名:7439822006109141439.JPG 下载次数:163 文件类型:image/pjpeg 文件大小: 上传时间:2006-10-9 14:22:55 描述:
天使来了初生襁褓狮帖子:195 注册: 2006-09-04 来自:

天使来了初生襁褓狮帖子:195 注册: 2006-09-04 来自:	发表于： 2006-10-09 14:39 \| 只看楼主短消息资料字号：小中大 25楼【回复“我无邪”的帖子】我无邪：请看我23楼的贴子
天使来了初生襁褓狮帖子:195 注册: 2006-09-04 来自:

天使来了初生襁褓狮帖子:195 注册: 2006-09-04 来自:	发表于： 2006-10-09 14:58 \| 只看楼主短消息资料字号：小中大 26楼我无邪，你上班了？你不知道你多少人在等你。
天使来了初生襁褓狮帖子:195 注册: 2006-09-04 来自:

初生襁褓狮

帖子:195
注册: 2006-09-04
来自:

发表于： 2006-10-09 16:00 | 只看楼主 短消息资料

字号：小中大 27楼

引用:

【我无邪的贴子】注意，你要注意，不要双击打开DEF分区
要不然，病毒永远无法杀净。
先看一下这个帖子
http://forum.ikaka.com/topic.asp?board=3&artid=8130575
用WINRAR删除
DEF分区，根目录下的sxs.exe，Autorun.inf
打开System Repair Engineer（也就是你的扫描日志软件SREng.exe），点“启动项目，服务，点“驱动程序”勾选“隐藏以认证的微软服务”选中病毒服务NetGroup Packet Filter Driver，选择“删除服务”点“设置”选择“否”
重启后删除
C:\WINDOWS\system32\drivers\npf.sys
如果方便，把sxs.exe发到我的邮箱twtxk@126.com
………………

我已照您说的做了，重扫了日志，请看下。还有什么需要做的。请指教。
2006-10-09,15:42:50

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
<run><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
<Thunder><"C:\Documents and Settings\All Users\Documents\新建文件夹\Thunder\Thunder.exe" /s> [Thunder Networking Technologies,LTD]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<RavStub><"C:\Program Files\Rising\Rav\ravstub.exe" /RUNONCE> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<Ver><2006.07.20> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\System32\userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]

==================================
启动文件夹
[microsoft office]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\microsoft office.lnk --> C:\PROGRA~1\MICROS~2\Office\OSA9.EXE [Microsoft Corporation]><H>
[联想键盘驱动程序]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\联想键盘驱动程序.lnk --> C:\PROGRA~1\LEGEND\联想标~1\Skdaemon.exe []><H>
[河南网通宽带用户客户端]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\河南网通宽带用户客户端.lnk --> C:\PROGRA~1\RACER-~1\racer.exe [Putian Runway]><N>

==================================
服务
[Human Interface Device Access / HidServ]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[NVIDIA Driver Helper Service / NVSvc]
<C:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation>
[Rising Proxy Service / RfwProxySrv]
<c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService]
<c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>

==================================
驱动程序
[Service for Avance AC97 Audio (WDM) / ALCXWDM]
<system32\drivers\ALCXWDM.SYS><Avance Logic, Inc.>
[Rising TDI Base Driver / BaseTDI]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[basic2 / basic2]
<System32\DRIVERS\HSF_BSC2.sys><Conexant>
[ExpScaner / ExpScaner]
<\??\C:\Program Files\Rising\Rav\ExpScan.sys><>
[HookCont / HookCont]
<\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising tech Co. ltd>
[HookReg / HookReg]
<\??\C:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys]
<\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising>
[HookUrl / HookUrl]
<\??\C:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[HSFHWBS2 / HSFHWBS2]
<System32\DRIVERS\HSFHWBS2.sys><Conexant Systems>
[HSF_DP / HSF_DP]
<System32\DRIVERS\HSF_DP.sys><Conexant Systems>
[hsf_msft / hsf_msft]
<System32\DRIVERS\HSF_MSFT.sys><Conexant>
[MASPINT / MASPINT]
<C:\WINDOWS\SYSTEM32\DRIVERS\MASPINT.SYS><MicroStaff Co.,Ltd.>
[mdmxsdk / mdmxsdk]
<System32\DRIVERS\mdmxsdk.sys><Conexant>
[MEMSCAN / MEMSCAN]
<\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[mProcRs / mProcRs]
<\??\c:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[nv / nv]
<System32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Rksample / Rksample]
<System32\DRIVERS\HSF_SAMP.sys><Conexant>
[RsFwDrv / RsFwDrv]
<\??\C:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[Realtek RTL8139/810X Family PCI Fast Ethernet NIC NT Driver / rtl8139]
<System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv]
<System32\DRIVERS\secdrv.sys><N/A>
[PS/2 Keyboard Filter Driver for WinXp / Skkbdf]
<System32\DRIVERS\Skkbdf.sys><Silitek Corp.>
[Sony USB Filter Driver (SONYPVU1) / SONYPVU1]
<System32\DRIVERS\SONYPVU1.SYS><Sony Corporation>
[Conexant Setup API / UIUSys]
<system32\drivers\UIUSys.sys><Conexant>

==================================
浏览器加载项
[解霸]
{367E0A21-8601-4986-9C9A-153BF5ACA118}? <C:\HEROSOFT\Hero3000\MPLAYER.EXE, N/A>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[上传到QQ网络硬盘]
<D:\软件包\QQ2006\AddToNetDisk.htm, N/A>
[使用迅雷下载]
<C:\Documents and Settings\All Users\Documents\新建文件夹\Thunder\Program\GetUrl.htm, N/A>
[使用迅雷下载全部链接]
<C:\Documents and Settings\All Users\Documents\新建文件夹\Thunder\Program\GetAllUrl.htm, N/A>
[添加到QQ自定义面板]
<D:\软件包\QQ2006\AddPanel.htm, N/A>
[添加到QQ表情]
<D:\软件包\QQ2006\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<D:\软件包\QQ2006\SendMMS.htm, N/A>

==================================

天使来了初生襁褓狮帖子:195 注册: 2006-09-04 来自:	发表于： 2006-10-09 16:01 \| 只看楼主短消息资料字号：小中大 28楼正在运行的进程 [PID: 404][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 460][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 484][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 532][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 544][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 684][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 752][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 788][C:\Program Files\Rising\Rav\CCenter.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3] [PID: 808][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 848][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 888][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 916][C:\Program Files\Rising\Rav\Ravmond.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 1, 35] [C:\Program Files\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 19] [C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1] [C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2] [C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11] [C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [C:\Program Files\Rising\Rav\RsLog.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20] [C:\Program Files\Rising\Rav\HOOKSYS.dll] [Beijing Rising Technology Co., Ltd., 18, 1, 0, 11] [C:\Program Files\Rising\Rav\Scanner.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 32] [C:\Program Files\Rising\Rav\libload.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10] [C:\Program Files\Rising\Rav\VirusLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 12] [C:\Program Files\Rising\Rav\regmon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6] [C:\Program Files\Rising\Rav\HookWeb.dll] [rising, 18, 0, 0, 2] [C:\Program Files\Rising\Rav\MemMon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10] [C:\Program Files\Rising\Rav\expscan.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [C:\Program Files\Rising\Rav\mPorts.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3] [C:\Program Files\Rising\Rav\MailMon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5] [C:\Program Files\Rising\Rav\SpamEng.dll] [N/A, 18, 0, 0, 6] [C:\Program Files\Rising\Rav\engine.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 34] [C:\Program Files\Rising\Rav\PostTrt.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 16] [C:\Program Files\Rising\Rav\UnExe.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11] [C:\Program Files\Rising\Rav\ScanExec.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11] [C:\Program Files\Rising\Rav\ScanEx.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 27] [C:\Program Files\Rising\Rav\RSUnpack.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 17] [C:\Program Files\Rising\Rav\NvFile.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 7] [C:\Program Files\Rising\Rav\ScanMac.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10] [C:\Program Files\Rising\Rav\ScanSct.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 19] [C:\Program Files\Rising\Rav\Unpacker.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5] [C:\Program Files\Rising\Rav\ExtOLE.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6] [C:\Program Files\Rising\Rav\ExtMail.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13] [PID: 980][c:\program files\rising\rfw\rfwproxy.exe] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 14] [c:\program files\rising\rfw\RfwRule.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 13] [c:\program files\rising\rfw\MonMid.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 2] [PID: 1068][c:\program files\rising\rfw\rfwsrv.exe] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 33] [c:\program files\rising\rfw\RfwRule.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 13] [c:\program files\rising\rfw\rfwlog.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 6] [c:\program files\rising\rfw\Rfwdrv.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 21] [c:\program files\rising\rfw\MonDrv.dll] [rs, 1, 0, 0, 4] [c:\program files\rising\rfw\ProcLib.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 9] [PID: 1204][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 21] [C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [C:\Program Files\WinRAR\rarext.dll] [N/A, N/A] [PID: 1368][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)] [C:\WINDOWS\system32\CNMLM20.DLL] [CANON INC., 1.32.2.2] [PID: 1468][C:\Program Files\Rising\Rav\RavStub.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 16] [C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1] [C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [PID: 1656][c:\program files\rising\rfw\RfwMain.exe] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 52] [c:\program files\rising\rfw\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 23] [c:\program files\rising\rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [c:\program files\rising\rfw\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5] [PID: 1728][C:\WINDOWS\System32\nvsvc32.exe] [NVIDIA Corporation, 6.13.10.2832] [PID: 1896][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1168][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 2524][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 2816][C:\Program Files\Rising\Rav\RavMon.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 1, 33] [C:\Program Files\Rising\Rav\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 26]
天使来了初生襁褓狮帖子:195 注册: 2006-09-04 来自:

天使来了初生襁褓狮帖子:195 注册: 2006-09-04 来自:	发表于： 2006-10-09 16:02 \| 只看楼主短消息资料字号：小中大 29楼 [C:\Program Files\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 19] [C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2] [C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11] [C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1] [C:\Program Files\Rising\Rav\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5] [PID: 3412][C:\Documents and Settings\All Users\Documents\新建文件夹\Thunder\Program\Thunder5.exe] [Thunder Networking Technologies,LTD, 5.4.0.226] [C:\Documents and Settings\All Users\Documents\新建文件夹\Thunder\Program\UpdateDownload.dll] [N/A, N/A] [C:\Documents and Settings\All Users\Documents\新建文件夹\Thunder\Program\msgmanage.dll] [N/A, N/A] [C:\Documents and Settings\All Users\Documents\新建文件夹\Thunder\Program\historyinfo_manage.dll] [Thunder Networking Technologies,LTD, 5, 2, 0, 148] [C:\Documents and Settings\All Users\Documents\新建文件夹\Thunder\Program\download_interface.dll] [Thunder Networking Technologies,LTD, 2, 0, 0, 1] [C:\Documents and Settings\All Users\Documents\新建文件夹\Thunder\Program\stlport_vc646.dll] [STLport Consulting, Inc., 4.6.2003.1031] [C:\Documents and Settings\All Users\Documents\新建文件夹\Thunder\Program\log4cplus.dll] [, 1, 0, 2, 1] [C:\Documents and Settings\All Users\Documents\新建文件夹\Thunder\Program\asyn_dns.dll] [N/A, N/A] [C:\Documents and Settings\All Users\Documents\新建文件夹\Thunder\Program\RegisterDll.dll] [Thunder Networking Technologies,LTD, 2, 1, 0, 18] [C:\Documents and Settings\All Users\Documents\新建文件夹\Thunder\Program\FloatBar.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 2] [C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 21] [C:\Documents and Settings\All Users\Documents\新建文件夹\Thunder\Program\iTargetAd.dll] [N/A, N/A] [PID: 1632][C:\Program Files\racer-henan-cnc\racer.exe] [Putian Runway, 2, 0, 51, 92] [C:\Program Files\racer-henan-cnc\rwxre.dll] [Mozilla Foundation, 1.7.3: 2005040616] [C:\Program Files\racer-henan-cnc\nspr4.dll] [Netscape Communications Corporation, 4.5 Beta] [C:\Program Files\racer-henan-cnc\xpcom.dll] [Mozilla Foundation, 1.7.3: 2005040616] [C:\Program Files\racer-henan-cnc\nss3.dll] [Netscape Communications Corporation, 3.9.1] [C:\Program Files\racer-henan-cnc\softokn3.dll] [Netscape Communications Corporation, 3.9.1] [C:\Program Files\racer-henan-cnc\gkgfx.dll] [Mozilla Foundation, 1.7.3: 2005040616] [C:\Program Files\racer-henan-cnc\js3250.dll] [Netscape Communications Corporation, 4.0] [C:\Program Files\racer-henan-cnc\components\racer_base_comp.dll] [Putian Runway, 2,0,47,87] [C:\Program Files\racer-henan-cnc\xpcom_compat.dll] [Mozilla Foundation, 1.7.3: 2005040616] [C:\Program Files\racer-henan-cnc\racer_base.dll] [Putian Runway, 2,0,47,87] [C:\Program Files\racer-henan-cnc\components\pipnss.dll] [Mozilla Foundation, 1.7.3: 2005040616] [C:\Program Files\racer-henan-cnc\components\jar50.dll] [Mozilla Foundation, 1.7.3: 2005040616] [C:\Program Files\racer-henan-cnc\components\gklayout.dll] [Mozilla Foundation, 1.7.3: 2005040616] [C:\Program Files\racer-henan-cnc\components\xpcom_compat_c.dll] [Mozilla Foundation, 1.7.3: 2005040616] [C:\Program Files\racer-henan-cnc\components\racer_ad_comp.dll] [Putian Runway, 2,0,47,87] [C:\Program Files\racer-henan-cnc\components\racer_access_dhcpplus.dll] [Putian Runway, 2,0,47,87] [C:\Program Files\racer-henan-cnc\dhcpplus.dll] [北京润汇科技有限公司, 0, 13, 21, 45] [C:\Program Files\racer-henan-cnc\components\racer_nss4_comp.dll] [Putian Runway, 2,0,47,87] [C:\Program Files\racer-henan-cnc\nss4.dll] [北京普天润汇科技有限公司, 1, 0, 0, 3] [C:\Program Files\racer-henan-cnc\wpcap.dll] [NetGroup - Politecnico di Torino, 3, 1, 0, 24] [C:\Program Files\racer-henan-cnc\packet.dll] [NetGroup - Politecnico di Torino, 3, 1, 0, 24] [C:\Program Files\racer-henan-cnc\WanPacket.dll] [NetGroup - Politecnico di Torino, 3, 1, 0, 24] [C:\Program Files\racer-henan-cnc\components\xpinstal.dll] [Mozilla Foundation, 1.7.3: 2005040616] [PID: 2168][C:\Program Files\racer-henan-cnc\RacerKp.exe] [北京润汇科技有限公司, 1, 0, 0, 1] [PID: 2152][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [C:\WINDOWS\System32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0] [PID: 2764][C:\Documents and Settings\zzp\桌面\SREng\SREng.exe] [Smallfrogs Studio, 2.2.6.605] ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\system32\winhlp32.exe %1] .INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf N/A ================================== HOSTS 文件 127.0.0.1 localhost ==================================
天使来了初生襁褓狮帖子:195 注册: 2006-09-04 来自:

天使来了初生襁褓狮帖子:195 注册: 2006-09-04 来自:	发表于： 2006-10-09 16:05 \| 只看楼主短消息资料字号：小中大 30楼【回复“我无邪”的帖子】我无邪，你什么时候在线了，千万要给我回贴子！！！！！！
天使来了初生襁褓狮帖子:195 注册: 2006-09-04 来自:

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 一开机瑞星监控就被禁用。

附件:

文件名:7439822006109141439.JPG 下载次数:163 文件类型:image/pjpeg 文件大小: ShowFormatBytesStr(79298); 上传时间:2006-10-9 14:22:55 描述:

瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛一开机瑞星监控就被禁用。

文件名:7439822006109141439.JPG

下载次数:163

文件类型:image/pjpeg

文件大小:

上传时间:2006-10-9 14:22:55

描述: