发现病毒，高手快来帮忙 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛发现病毒，高手快来帮忙

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

12

1 / 2 页

跳转页

发现病毒，高手快来帮忙

kfyq 快乐黄口狮帖子:168 注册: 2005-08-27 来自:	发表于： 2006-12-04 21:20 \| 只看楼主短消息资料字号：小中大 1楼发现病毒，高手快来帮忙病毒名称处理结果扫描方式路径文件病毒来源 Dropper.Agent.erg 需要解压缩后杀毒手动扫描 C:\Documents and Settings\a\Local Settings\Temp 888bar16.exe>>$TEMP\dodolook004.exe 本机 Dropper.Delf.cay 需要解压缩后杀毒手动扫描 C:\Documents and Settings\a\Local Settings\Temp 888bar16.exe>>$TEMP\OKADS002.exe>>Unpack 本机 Trojan.DL.Xuhai.a 需要解压缩后杀毒手动扫描 C:\Documents and Settings\a\Local Settings\Temp 888bar16.exe>>$TEMP\vitt.exe 本机 Trojan.Agent.yjy 需要解压缩后杀毒手动扫描 C:\Documents and Settings\a\Local Settings\Temp 0602328.exe>>€tbu00650\Miorosoft Office.dll 本机 Dropper.Agent.erg 需要解压缩后杀毒手动扫描 C:\Documents and Settings\a\Local Settings\Temp 888bar16.exe>>$TEMP\dodolook004.exe 本机 Dropper.Delf.cay 需要解压缩后杀毒手动扫描 C:\Documents and Settings\a\Local Settings\Temp 888bar16.exe>>$TEMP\OKADS002.exe>>Unpack 本机 Trojan.DL.Xuhai.a 需要解压缩后杀毒手动扫描 C:\Documents and Settings\a\Local Settings\Temp 888bar16.exe>>$TEMP\vitt.exe 本机 Trojan.Agent.yjy 需要解压缩后杀毒手动扫描 C:\Documents and Settings\a\Local Settings\Temp 0602328.exe>>€tbu00650\Miorosoft Office.dll 本机 2006-12-04 22:26:56
kfyq 快乐黄口狮帖子:168 注册: 2005-08-27 来自:	分享到：

水树雨下横据古稀狮帖子:8397 注册: 2006-07-26 来自:	发表于： 2006-12-04 21:21 \| 短消息资料字号：小中大 2楼清理IE临时文件夹，在控制面板，internet选项里
水树雨下横据古稀狮帖子:8397 注册: 2006-07-26 来自:

kfyq 快乐黄口狮帖子:168 注册: 2005-08-27 来自:	发表于： 2006-12-04 21:21 \| 只看楼主短消息资料字号：小中大 3楼 ijackThis_zww汉化版扫描日志 V1.99.1 保存于 20:56:50, 日期 2006-12-04 操作系统： Windows XP SP1 (WinNT 5.01.2600) 浏览器： Internet Explorer v6.00 SP1 (6.00.2800.1106) 当前运行的进程： C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\ctfmon.exe G:\精品软件\新建文件夹 (2)\HijackThis1991zww.exe O1 - Hosts: 预?D\|X O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - IE工具栏增项: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll O3 - IE工具栏增项: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing) O3 - IE工具栏增项: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\System32\KakaTool.dll (file missing) O4 - 启动项HKLM\\Run: [RavTask] "C:\Program Files\rising\Rav\RavTask.exe" -system O4 - 启动项HKLM\\Run: [A] C:\WINDOWS\System32\rundll32.exe q.dll s O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O8 - IE右键菜单中的新增项目: &使用迅雷下载 - G:\迅雷\Program\GetUrl.htm O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - G:\迅雷\Program\GetAllUrl.htm O8 - IE右键菜单中的新增项目: Google 搜索(&G) - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - G:\tools\qq\AddToNetDisk.htm O8 - IE右键菜单中的新增项目: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - G:\tools\qq\AddPanel.htm O8 - IE右键菜单中的新增项目: 添加到QQ表情 - G:\tools\qq\AddEmotion.htm O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - G:\tools\qq\SendMMS.htm O9 - 浏览器额外的按钮: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - G:\迅雷\Thunder.exe O9 - 浏览器额外的“工具”菜单项: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - G:\迅雷\Thunder.exe O9 - 浏览器额外的按钮: 相关站点 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - 浏览器额外的“工具”菜单项: 相关站点 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - G:\tools\qq\QQ.EXE O9 - 浏览器额外的“工具”菜单项: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - G:\tools\qq\QQ.EXE O16 - DPF: {48FE89A0-486C-48DF-9DEC-BED22BDC6057} (XIsOro Control) - http://www.sinago.com/download/OroCheck.cab O16 - DPF: {A984ED9F-E8DA-44E5-BC18-C14B9ABEF79D} (photo_uploader Control) - http://upload.photo.163.com/photoup.cab O23 - NT 服务: DetectorSvc - BENQ (IT) Co.,Ltd. - E:\电子相册\新建文件夹 (2)\DetectorSvc.exe O23 - NT 服务: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - C:\Program Files\rising\Rfw\rfwsrv.exe O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\rising\Rav\CCenter.exe O23 - NT 服务: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\rising\Rav\Ravmond.exe
kfyq 快乐黄口狮帖子:168 注册: 2005-08-27 来自:

快乐黄口狮

帖子:168
注册: 2005-08-27
来自:

发表于： 2006-12-04 21:22 | 只看楼主 短消息资料

字号：小中大 4楼

引用:

【水树雨下的贴子】清理IE临时文件夹，在控制面板，internet选项里
………………

清过了，没用

gototop

kfyq 快乐黄口狮帖子:168 注册: 2005-08-27 来自:	发表于： 2006-12-04 21:26 \| 只看楼主短消息资料字号：小中大 5楼 2006-12-04,20:55:11 System Repair Engineer 2.0.21.505 (2.0 RC 2) Smallfrogs (http://www.KZTechs.com) Windows XP Professional Service Pack 1 (Build 2600) - 管理权限用户 - 完整功能以下内容被选中：所有的启动项目（包括注册表、启动文件夹、服务等）浏览器加载项正在运行的进程（包括进程模块信息）文件关联启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [Microsoft Corporation] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <load><> [] <run><> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <RavTask><"C:\Program Files\rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.] <A><C:\WINDOWS\System32\rundll32.exe q.dll s> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [Microsoft Corporation] <Userinit><C:\WINDOWS\System32\userinit.exe,> [Microsoft Corporation] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <UIHost><logonui.exe> [Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.] [HKEY_CURRENT_USER\Control Panel\Desktop] <SCRNSAVE.EXE><; C:\WINDOWS\BUTTER~1.SCR> [] ================================== 启动文件夹服务 [DetectorSvc / DetectorSvc] <E:\电子相册\新建文件夹 (2)\DetectorSvc.exe><BENQ (IT) Co.,Ltd.> [NVIDIA Driver Helper Service / NVSvc] <C:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation> [Rising Personal Firewall Service / RfwService] <C:\Program Files\rising\Rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.> [Rising Process Communication Center / RsCCenter] <"C:\Program Files\rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.> [Rising RealTime Monitor / RsRavMon] <"C:\Program Files\rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.> ================================== 浏览器加载项 [启动迅雷] {0062C9BD-B349-40DE-91A0-755F37ACD559} <G:\迅雷\Thunder.exe, Thunder Networking Technologies,LTD> [相关站点] {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A> [QQ] {c95fe080-8f5d-11d2-a20b-00aa003c157b} <G:\tools\qq\QQ.EXE, TENCENT> [电台(&R)] {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation> [FlashGet Bar] {E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft> [&Google] {2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar1.dll, N/A> [卡卡上网安全助手] {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\System32\KakaTool.dll, N/A> [XIsOro Control] {48FE89A0-486C-48DF-9DEC-BED22BDC6057} <C:\WINDOWS\DOWNLO~1\CONFLICT.1\XISORO~1.OCX, > [Java Plug-in 1.4.2_05] {8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll, JavaSoft / Sun Microsystems, Inc.> [photo_uploader Control] {A984ED9F-E8DA-44E5-BC18-C14B9ABEF79D} <C:\WINDOWS\DOWNLO~1\PHOTO_~1.OCX, N/A> [Java Plug-in 1.4.2_05] {CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} <C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll, JavaSoft / Sun Microsystems, Inc.> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.> [&使用迅雷下载] <G:\迅雷\Program\GetUrl.htm, N/A> [&使用迅雷下载全部链接] <G:\迅雷\Program\GetAllUrl.htm, N/A> [Google 搜索(&G)] <res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html, N/A> [上传到QQ网络硬盘] <G:\tools\qq\AddToNetDisk.htm, N/A> [使用网际快车下载] <C:\Program Files\FlashGet\jc_link.htm, N/A> [使用网际快车下载全部链接] <C:\Program Files\FlashGet\jc_all.htm, N/A> [添加到QQ自定义面板] <G:\tools\qq\AddPanel.htm, N/A> [添加到QQ表情] <G:\tools\qq\AddEmotion.htm, N/A> [用QQ彩信发送该图片] <G:\tools\qq\SendMMS.htm, N/A> ================================== 正在运行的进程 [PID: 148][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)> [PID: 200][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 224][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.1557 (xpsp2_gdr.040517-1325)> [PID: 268][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 280][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)> [PID: 436][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 460][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 688][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)> [C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21> [C:\Program Files\rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\WINDOWS\System32\msdmo.dll] <N/A><N/A> [C:\WINDOWS\System32\ffdshow.ax] <N/A><1.0.2.1997> [C:\Program Files\Ringz Studio\Storm Codec\Codecs\VSFilter.dll] <Gabest><1, 0, 1, 3> [C:\Program Files\Ringz Studio\Storm Codec\Codecs\TTL2Dec.dll] <N/A><N/A> [C:\Program Files\Ringz Studio\Storm Codec\Codecs\Vid1Dec.dll] <N/A><N/A> [C:\Program Files\Ringz Studio\Storm Codec\Codecs\empgdmx.ax] <Elecard Ltd.><1, 0, 19, 51017> [PID: 1564][C:\WINDOWS\System32\ctfmon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)> [PID: 824][G:\精品软件\专杀工具\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505> ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\system32\winhlp32.exe %1] .INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 ==================================
kfyq 快乐黄口狮帖子:168 注册: 2005-08-27 来自:

水树雨下横据古稀狮帖子:8397 注册: 2006-07-26 来自:	发表于： 2006-12-04 21:29 \| 短消息资料字号：小中大 6楼知道路径就手动清理，System Repair Engineer 版本低，要扫的话用最新版扫
水树雨下横据古稀狮帖子:8397 注册: 2006-07-26 来自:

kfyq 快乐黄口狮帖子:168 注册: 2005-08-27 来自:	发表于： 2006-12-04 21:33 \| 只看楼主短消息资料字号：小中大 7楼 C:\Documents and Settings\a\Local Settings\Temp里的文件能不能直接删除
kfyq 快乐黄口狮帖子:168 注册: 2005-08-27 来自:

kfyq 快乐黄口狮帖子:168 注册: 2005-08-27 来自:	发表于： 2006-12-04 22:04 \| 只看楼主短消息资料字号：小中大 8楼重新扫了，再来看一下 2006-12-04,21:36:37 System Repair Engineer 2.2.6.605 Smallfrogs (http://www.KZTechs.com) Windows XP Professional Service Pack 1 (Build 2600) - 管理权限用户 - 完整功能以下内容被选中：所有的启动项目（包括注册表、启动文件夹、服务等）浏览器加载项正在运行的进程（包括进程模块信息）文件关联 Winsock 提供者 Autorun.inf HOSTS 文件启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [(Verified)Microsoft Corporation] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <load><> [N/A] <run><> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <RavTask><"C:\Program Files\rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [(Verified)Microsoft Corporation] <Userinit><C:\WINDOWS\System32\userinit.exe,> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <UIHost><logonui.exe> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.] [HKEY_CURRENT_USER\Control Panel\Desktop] <SCRNSAVE.EXE><; C:\WINDOWS\BUTTER~1.SCR> [N/A] ================================== 启动文件夹 N/A ================================== 服务 [DetectorSvc / DetectorSvc] <E:\电子相册\新建文件夹 (2)\DetectorSvc.exe><BENQ (IT) Co.,Ltd.> [Human Interface Device Access / HidServ] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A> [NVIDIA Driver Helper Service / NVSvc] <C:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation> [Rising Personal Firewall Service / RfwService] <C:\Program Files\rising\Rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.> [Rising Process Communication Center / RsCCenter] <"C:\Program Files\rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.> [Rising RealTime Monitor / RsRavMon] <"C:\Program Files\rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.> ================================== 驱动程序 [Service for Realtek AC97 Audio (WDM) / ALCXWDM] <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.> [Rising TDI Base Driver / BaseTDI] <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.> [ExpScaner / ExpScaner] <\??\C:\Program Files\rising\Rav\ExpScan.sys><> [GMSIPCI / GMSIPCI] <\??\H:\INSTALL\GMSIPCI.SYS><N/A> [HookCont / HookCont] <\??\C:\Program Files\rising\Rav\HOOKCONT.sys><Rising tech Co. ltd> [HookReg / HookReg] <\??\C:\Program Files\rising\Rav\HookReg.sys><> [HookSys / HookSys] <\??\C:\Program Files\rising\Rav\HookSys.sys><Rising> [HookUrl / HookUrl] <\??\C:\Program Files\rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.> [kmsinput / kmsinput] <\??\C:\WINDOWS\System32\drivers\kmsinput.sys><N/A> [MEMSCAN / MEMSCAN] <\??\C:\Program Files\rising\Rav\MEMSCAN.sys><瑞星软件有限公司> [mProcRs / mProcRs] <\??\c:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.> [npkcrypt / npkcrypt] <\??\G:\tools\qq\npkcrypt.sys><N/A> [npkycryp / npkycryp] <\??\G:\tools\新建文件夹\qq\npkycryp.sys><N/A> [nv / nv] <System32\DRIVERS\nv4_mini.sys><NVIDIA Corporation> [Direct Parallel Link Driver / Ptilink] <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.> [RsAntiSpyware / RsAntiSpyware] <\SystemRoot\System32\drivers\RsBoot.sys><Beijing Rising> [RsFwDrv / RsFwDrv] <\??\C:\Program Files\rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.> [RSPPSYS / RSPPSYS] <\??\C:\PROGRAM FILES\RISING\RAV\RSPPSYS.sys><Rising> [Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139] <System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation> [Secdrv / Secdrv] <System32\DRIVERS\secdrv.sys><N/A> [SVKP / SVKP] <\??\C:\WINDOWS\System32\SVKP.sys><N/A> [TDDI / TDDI] <\??\C:\WINDOWS\System32\drivers\tddi.sys><Rainbow China Co., Ltd.> ================================== 浏览器加载项 [启动迅雷] {0062C9BD-B349-40DE-91A0-755F37ACD559} <G:\迅雷\Thunder.exe, Thunder Networking Technologies,LTD> [相关站点] {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A> [QQ] {c95fe080-8f5d-11d2-a20b-00aa003c157b} <G:\tools\qq\QQ.EXE, TENCENT> [电台(&R)] {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation> [FlashGet Bar] {E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft> [&Google] {2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar1.dll, N/A> [卡卡上网安全助手] {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\System32\KakaTool.dll, N/A> [XIsOro Control] {48FE89A0-486C-48DF-9DEC-BED22BDC6057} <C:\WINDOWS\DOWNLO~1\CONFLICT.1\XISORO~1.OCX, > [Java Plug-in 1.4.2_05] {8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll, JavaSoft / Sun Microsystems, Inc.> [photo_uploader Control] {A984ED9F-E8DA-44E5-BC18-C14B9ABEF79D} <C:\WINDOWS\DOWNLO~1\PHOTO_~1.OCX, N/A> [Java Plug-in 1.4.2_05] {CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} <C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll, JavaSoft / Sun Microsystems, Inc.> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.> [&使用迅雷下载] <G:\迅雷\Program\GetUrl.htm, N/A> [&使用迅雷下载全部链接] <G:\迅雷\Program\GetAllUrl.htm, N/A> [Google 搜索(&G)] <res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html, N/A> [上传到QQ网络硬盘] <G:\tools\qq\AddToNetDisk.htm, N/A> [使用网际快车下载] <C:\Program Files\FlashGet\jc_link.htm, N/A> [使用网际快车下载全部链接] <C:\Program Files\FlashGet\jc_all.htm, N/A> [添加到QQ自定义面板] <G:\tools\qq\AddPanel.htm, N/A> [添加到QQ表情] <G:\tools\qq\AddEmotion.htm, N/A> [用QQ彩信发送该图片] <G:\tools\qq\SendMMS.htm, N/A>
kfyq 快乐黄口狮帖子:168 注册: 2005-08-27 来自:

kfyq 快乐黄口狮帖子:168 注册: 2005-08-27 来自:	发表于： 2006-12-04 22:08 \| 只看楼主短消息资料字号：小中大 9楼正在运行的进程 [PID: 296][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)] [PID: 352][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 376][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.1557 (xpsp2_gdr.040517-1325)] [PID: 420][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 432][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)] [PID: 584][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 620][C:\Program Files\rising\Rav\CCenter.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3] [PID: 636][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 700][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 732][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 744][C:\Program Files\rising\Rav\Ravmond.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 1, 47] [C:\Program Files\rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20] [C:\Program Files\rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1] [C:\Program Files\rising\Rav\RsPPsys.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3] [C:\Program Files\rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2] [C:\Program Files\rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11] [C:\Program Files\rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [C:\Program Files\rising\Rav\RsLog.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20] [C:\Program Files\rising\Rav\HOOKSYS.dll] [Beijing Rising Technology Co., Ltd., 18, 1, 0, 12] [C:\Program Files\rising\Rav\Scanner.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 33] [C:\Program Files\rising\Rav\libload.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10] [C:\Program Files\rising\Rav\VirusLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13] [C:\Program Files\rising\Rav\regmon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6] [C:\Program Files\rising\Rav\HookWeb.dll] [rising, 18, 0, 0, 2] [C:\Program Files\rising\Rav\MemMon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 12] [C:\Program Files\rising\Rav\expscan.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [C:\Program Files\rising\Rav\mPorts.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3] [C:\Program Files\rising\Rav\MailMon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5] [C:\Program Files\rising\Rav\SpamEng.dll] [N/A, 18, 0, 0, 6] [C:\Program Files\rising\Rav\engine.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 35] [C:\Program Files\rising\Rav\PostTrt.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 18] [C:\Program Files\rising\Rav\UnExe.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11] [C:\Program Files\rising\Rav\ScanExec.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 16] [C:\Program Files\rising\Rav\ScanEx.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 34] [C:\Program Files\rising\Rav\RSUnpack.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 21] [C:\Program Files\rising\Rav\ExtFile.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 24] [C:\Program Files\rising\Rav\NvFile.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 7] [C:\Program Files\rising\Rav\ScanMac.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10] [C:\Program Files\rising\Rav\ScanSct.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20] [C:\Program Files\rising\Rav\Unpacker.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 7] [C:\Program Files\rising\Rav\ExtMail.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13] [C:\Program Files\rising\Rav\ExtOLE.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6] [PID: 852][C:\Program Files\rising\Rfw\rfwsrv.exe] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 33] [C:\Program Files\rising\Rfw\RfwRule.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 13] [C:\Program Files\rising\Rfw\rfwlog.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 6] [C:\Program Files\rising\Rfw\Rfwdrv.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 21] [C:\Program Files\rising\Rfw\MonDrv.dll] [rs, 1, 0, 0, 4] [C:\Program Files\rising\Rfw\ProcLib.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 9] [PID: 988][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.1699 (xpsp2.050610-1533)] [PID: 1144][C:\Program Files\rising\Rav\RavStub.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 16] [C:\Program Files\rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1] [C:\Program Files\rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [PID: 1328][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)] [C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 21] [C:\WINDOWS\System32\q.dll] [N/A, N/A] [C:\Program Files\WinRAR\rarext.dll] [N/A, N/A] [C:\Program Files\rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [E:\电子相册\新建文件夹 (2)\PHCollect.dll] [, 1, 0, 0, 1]
kfyq 快乐黄口狮帖子:168 注册: 2005-08-27 来自:

kfyq 快乐黄口狮帖子:168 注册: 2005-08-27 来自:	发表于： 2006-12-04 22:09 \| 只看楼主短消息资料字号：小中大 10楼 [PID: 1420][C:\Program Files\rising\Rfw\RfwMain.exe] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 52] [C:\Program Files\rising\Rfw\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 23] [C:\Program Files\rising\Rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [C:\Program Files\rising\Rfw\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5] [C:\WINDOWS\System32\q.dll] [N/A, N/A] [PID: 1516][C:\Program Files\rising\Rav\RavTask.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 22] [C:\Program Files\rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [C:\Program Files\rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2] [C:\Program Files\rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11] [C:\Program Files\rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1] [C:\WINDOWS\System32\q.dll] [N/A, N/A] [PID: 1532][C:\Program Files\rising\Rav\Ravmon.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 1, 39] [C:\Program Files\rising\Rav\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 26] [C:\Program Files\rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20] [C:\Program Files\rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2] [C:\Program Files\rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11] [C:\Program Files\rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [C:\Program Files\rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1] [C:\Program Files\rising\Rav\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5] [C:\WINDOWS\System32\q.dll] [N/A, N/A] [PID: 1536][C:\WINDOWS\System32\rundll32.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\WINDOWS\System32\q.dll] [N/A, N/A] [PID: 1548][C:\WINDOWS\System32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)] [C:\WINDOWS\System32\q.dll] [N/A, N/A] [PID: 1732][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)] [PID: 1756][E:\电子相册\新建文件夹 (2)\DetectorSvc.exe] [BENQ (IT) Co.,Ltd., 1, 0, 0, 2] [PID: 1788][C:\WINDOWS\System32\nvsvc32.exe] [NVIDIA Corporation, 6.13.10.4072] [PID: 1820][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 1256][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)] [C:\WINDOWS\System32\q.dll] [N/A, N/A] [C:\Program Files\rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [C:\WINDOWS\System32\Macromed\Flash\Flash8.ocx] [Macromedia, Inc., 8,0,22,0] [PID: 516][G:\迅雷\Program\Thunder5.exe] [Thunder Networking Technologies,LTD, 5.3.0.220] [G:\迅雷\Program\UpdateDownload.dll] [Thunder Networking Technologies,LTD, 1, 0, 1, 8] [G:\迅雷\Program\download_interface.dll] [Thunder Networking Technologies,LTD, 1, 0, 4, 71] [G:\迅雷\Program\log4cplus.dll] [, 1, 0, 2, 1] [G:\迅雷\Program\stlport_vc646.dll] [STLport Consulting, Inc., 4.6.2003.1031] [G:\迅雷\Program\asyn_dns.dll] [N/A, N/A] [G:\迅雷\Program\msgmanage.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 15] [G:\迅雷\Program\historyinfo_manage.dll] [Thunder Networking Technologies,LTD, 5, 2, 0, 148] [C:\WINDOWS\System32\q.dll] [N/A, N/A] [G:\迅雷\Program\RegisterDll.dll] [Thunder Networking Technologies,LTD, 2, 1, 0, 18] [G:\迅雷\Program\FloatBar.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 2] [G:\迅雷\Components\InMedia\iEmbedShell.dll] [　, 1, 0, 0, 11] [G:\迅雷\Components\InMedia\iEmbed04.dll] [　, 2, 3, 0, 37] [G:\迅雷\Components\P4PClient\P4PClient.dll] [Thunder Networking Technologies,LTD, 1, 0, 3, 8] [C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 21] [G:\迅雷\Program\iTargetAd.dll] [Thunder Networking Technologies,LTD, 1, 0, 1, 55] [C:\Program Files\rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [C:\WINDOWS\System32\Macromed\Flash\Flash8.ocx] [Macromedia, Inc., 8,0,22,0] [G:\迅雷\Components\InMedia\MediaAddin07.dll] [Thunder Networking Technologies,LTD, 2, 3, 0, 49] [C:\WINDOWS\System32\msdmo.dll] [N/A, N/A] [C:\Program Files\Ringz Studio\Storm Codec\Codecs\VSFilter.dll] [Gabest, 1, 0, 1, 3] [C:\Program Files\Ringz Studio\Storm Codec\Codecs\empgdmx.ax] [Elecard Ltd., 1, 0, 19, 51017] [C:\WINDOWS\System32\ffdshow.ax] [N/A, 1.0.2.1997] [C:\Program Files\Ringz Studio\Storm Codec\Codecs\TTL2Dec.dll] [N/A, N/A] [C:\Program Files\Ringz Studio\Storm Codec\Codecs\Vid1Dec.dll] [N/A, N/A] [PID: 2284][C:\Program Files\rising\Rav\RsAgent.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 12] [C:\WINDOWS\System32\q.dll] [N/A, N/A] [C:\Program Files\rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1] [PID: 2332][C:\WINDOWS\msagent\AgentSvr.exe] [Microsoft Corporation, 2.00.0.3422] [C:\WINDOWS\System32\q.dll] [N/A, N/A] [PID: 3308][G:\精品软件\专杀工具\SREng\SREng.exe] [Smallfrogs Studio, 2.2.6.605] [C:\WINDOWS\System32\q.dll] [N/A, N/A] ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\system32\winhlp32.exe %1] .INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf N/A ================================== HOSTS 文件 N/A ==================================
kfyq 快乐黄口狮帖子:168 注册: 2005-08-27 来自:

<<上一主题|下一主题>>

12

1 / 2 页

跳转页

页面顶部

Powered by Discuz!NT