启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<Internat.exe><internat.exe> [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
<RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows 2000 Publisher]
<Userinit><C:\WINNT\system32\userinit.exe,> [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><(无)> [N/A]

==================================
启动文件夹
[快捷方式 winvnc]
<C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\快捷方式 winvnc.lnk --> C:\PROGRA~1\RealVNC\WinVNC\winvnc.exe [RealVNC Ltd.]><N>

==================================
服务
[Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start]
<C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[TCP/IP NetBI0S Helper. / LMH0STS.][Stopped/Auto Start]
<C:\WINNT\Electic.exe><N/A>
[OracleMTSRecoveryService / OracleMTSRecoveryService][Running/Auto Start]
<D:\oracle\ora92\bin\omtsreco.exe "OracleMTSRecoveryService"><Oracle Corporation>
[OracleOraHome92Agent / OracleOraHome92Agent][Running/Auto Start]
<D:\oracle\ora92\bin\agntsrvc.exe><Oracle Corporation>
[OracleOraHome92ClientCache / OracleOraHome92ClientCache][Stopped/Manual Start]
<D:\oracle\ora92\BIN\ONRSD.EXE><N/A>
[OracleOraHome92HTTPServer / OracleOraHome92HTTPServer][Running/Auto Start]
<"D:\oracle\ora92\Apache\Apache\apache.exe" --ntservice><N/A>
[OracleOraHome92PagingServer / OracleOraHome92PagingServer][Stopped/Manual Start]
<D:\oracle\ora92/bin/pagntsrv.exe><N/A>
[OracleOraHome92SNMPPeerEncapsulator / OracleOraHome92SNMPPeerEncapsulator][Stopped/Manual Start]
<D:\oracle\ora92\BIN\ENCSVC.EXE><N/A>
[OracleOraHome92SNMPPeerMasterAgent / OracleOraHome92SNMPPeerMasterAgent][Stopped/Manual Start]
<D:\oracle\ora92\BIN\AGNTSVC.EXE><N/A>
[OracleOraHome92TNSListener / OracleOraHome92TNSListener][Running/Auto Start]
<D:\oracle\ora92\BIN\TNSLSNR ><N/A>
[OracleServiceZZGJWEB / OracleServiceZZGJWEB][Running/Auto Start]
<d:\oracle\ora92\bin\ORACLE.EXE ZZGJWEB><Oracle Corporation>
[Rising Proxy Service / RfwProxySrv][Stopped/Manual Start]
<c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService][Running/Auto Start]
<c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[VRVWatchServer / VRVWatchServer][Running/Auto Start]
<"C:\WINNT\system32\WatchClient.exe" -service><>

==================================
驱动程序
[a320raid / a320raid][Running/Boot Start]
<\SystemRoot\system32\drivers\a320raid.sys><Adaptec, Inc.>
[adpu320 / adpu320][Running/Boot Start]
<\SystemRoot\system32\drivers\adpu320.sys><Adaptec, Inc.>
[ati2mtag / ati2mtag][Running/Manual Start]
<System32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[Broadcom NetXtreme Gigabit Ethernet / b57w2k][Running/Manual Start]
<System32\DRIVERS\b57w2k.sys><Broadcom Corporation>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[dmboot / dmboot][Stopped/Disabled]
<System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio][Running/Boot Start]
<\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload][Running/Boot Start]
<\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[ExpScaner / ExpScaner][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\ExpScan.sys><>
[HookCont / HookCont][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising>
[HookUrl / HookUrl][Running/Auto Start]
<\??\C:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[MEMSCAN / MEMSCAN][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[mProcRs / mProcRs][Running/Auto Start]
<\??\c:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsFwDrv / RsFwDrv][Running/Auto Start]
<\??\C:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\System32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[VRVFW / VRVFW][Running/Boot Start]
<\SystemRoot\system32\VrvFw.sys><北信源>

浏览器加载项
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>

==================================
正在运行的进程
[PID: 176][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.00.2195.6601]
[PID: 200][\??\C:\WINNT\system32\csrss.exe] [Microsoft Corporation, 5.00.2195.6601]
[C:\WINNT\system32\VrvHook.dll] [edp, 6, 4, 19, 15]
[PID: 220][\??\C:\WINNT\system32\winlogon.exe] [Microsoft Corporation, 5.00.2195.6997]
[C:\WINNT\system32\vrvhook.dll] [edp, 6, 4, 19, 15]
[PID: 248][C:\WINNT\system32\services.exe] [Microsoft Corporation, 5.00.2195.7035]
[C:\WINNT\system32\dmserver.dll] [VERITAS Software Corp., 2195.6605.297.3]
[C:\WINNT\system32\VrvHook.dll] [edp, 6, 4, 19, 15]
[PID: 260][C:\WINNT\system32\lsass.exe] [Microsoft Corporation, 5.00.2195.7011]
[C:\WINNT\system32\VrvHook.dll] [edp, 6, 4, 19, 15]
[PID: 444][C:\WINNT\system32\svchost.exe] [Microsoft Corporation, 5.00.2134.1]
[C:\WINNT\system32\vrvhook.dll] [edp, 6, 4, 19, 15]
[PID: 580][C:\WINNT\system32\spoolsv.exe] [Microsoft Corporation, 5.00.2195.7059]
[C:\WINNT\system32\vrvhook.dll] [edp, 6, 4, 19, 15]
[PID: 904][d:\oracle\ora92\bin\ORACLE.EXE] [Oracle Corporation, 9.2.0.1.0 Production ]
[d:\oracle\ora92\bin\oraclient9.dll] [Oracle Corporation, 9.2.0.1.0 Production ]
[d:\oracle\ora92\bin\oracore9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[d:\oracle\ora92\bin\oranls9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[d:\oracle\ora92\bin\oraunls9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[d:\oracle\ora92\bin\oravsn9.dll] [Oracle Corporation, 9.2.0.1.0 Production ]
[d:\oracle\ora92\bin\oracommon9.dll] [Oracle Corporation, 9.2.0.1.0 Production ]
[d:\oracle\ora92\bin\orageneric9.dll] [Oracle Corporation, 9.2.0.1.0 Production ]
[d:\oracle\ora92\bin\oraxml9.dll] [Oracle Corporation, ]
[d:\oracle\ora92\bin\oraxsd9.dll] [Oracle Corporation, ]
[d:\oracle\ora92\bin\orannzsbb9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[d:\oracle\ora92\bin\oran9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[d:\oracle\ora92\bin\oranl9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[d:\oracle\ora92\bin\oranldap9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[d:\oracle\ora92\bin\oraldapclnt9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[d:\oracle\ora92\bin\orancrypt9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[d:\oracle\ora92\bin\ORATRACE9.dll] [N/A, ]
[d:\oracle\ora92\bin\oranro9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[d:\oracle\ora92\bin\oranhost9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[d:\oracle\ora92\bin\oranoname9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[d:\oracle\ora92\bin\orancds9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[d:\oracle\ora92\bin\orantns9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[d:\oracle\ora92\bin\oranms.dll] [Oracle Corporation, 9.2.0.0.0]
[d:\oracle\ora92\bin\oranmsp.dll] [Oracle Corporation, 9.2.0.0.0]
[d:\oracle\ora92\bin\orapls9.dll] [Oracle Corporation, 9.2.0.1.0 Production ]
[d:\oracle\ora92\bin\oraslax9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[d:\oracle\ora92\bin\orasnls9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[d:\oracle\ora92\bin\orawtc9.dll] [Oracle Corporation, 9.2.0.1.0 Production ]
[d:\oracle\ora92\bin\orasql9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[d:\oracle\ora92\bin\oraodm9.dll] [Oracle Corporation, 9.2.0.1.0 Production ]
[d:\oracle\ora92\bin\oraplp9.dll] [Oracle Corporation, 9.2.0.1.0 Production ]
[d:\oracle\ora92\bin\orajox9.dll] [N/A, ]
[d:\oracle\ora92\bin\oransgr9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[d:\oracle\ora92\bin\orawwg9.dll] [Oracle Corporation, 8.1.7.0.0]
[d:\oracle\ora92\bin\ocijdbc9.dll] [N/A, ]
[D:\oracle\ora92\BIN\ORAIMR9.Dll] [Oracle Corporation, 9.2.0.1.0]
[D:\oracle\ora92\bin\oranbeq9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[D:\oracle\ora92\bin\orannts9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[D:\oracle\ora92\bin\orantcp9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[C:\WINNT\system32\vrvhook.dll] [edp, 6, 4, 19, 15]
[D:\ORACLE\ORA92\JAVAVM\ADMIN\orajox9oracle_aurora_rdbms.dll] [N/A, ]
[D:\ORACLE\ORA92\JAVAVM\ADMIN\orajox9java_lang.dll] [N/A, ]
[D:\ORACLE\ORA92\JAVAVM\ADMIN\orajox9java_util.dll] [N/A, ]
[D:\ORACLE\ORA92\JAVAVM\ADMIN\orajox9oracle_aurora_vm.dll] [N/A, ]
[D:\ORACLE\ORA92\JAVAVM\ADMIN\orajox9java_io.dll] [N/A, ]
[D:\ORACLE\ORA92\JAVAVM\ADMIN\orajox9java_lang_ref.dll] [N/A, ]
[D:\ORACLE\ORA92\JAVAVM\ADMIN\orajox9java_lang_reflect.dll] [N/A, ]
[D:\ORACLE\ORA92\JAVAVM\ADMIN\orajox9oracle_gss_util.dll] [N/A, ]
[D:\ORACLE\ORA92\JAVAVM\ADMIN\orajox9sun_io.dll] [N/A, ]
[D:\ORACLE\ORA92\JAVAVM\ADMIN\orajox9sun_security_action.dll] [N/A, ]
[D:\ORACLE\ORA92\JAVAVM\ADMIN\orajox9java_security.dll] [N/A, ]
[D:\ORACLE\ORA92\JAVAVM\ADMIN\orajox9oracle_aurora_memoryManager.dll] [N/A, ]
[D:\ORACLE\ORA92\JAVAVM\ADMIN\orajox9oracle_sql.dll] [N/A, ]
[D:\ORACLE\ORA92\JAVAVM\ADMIN\orajox9java_sql.dll] [N/A, ]
[D:\ORACLE\ORA92\JAVAVM\ADMIN\orajox9oracle_jdbc_driver.dll] [N/A, ]
[D:\ORACLE\ORA92\JAVAVM\ADMIN\orajox9oracle_aurora_java_io.dll] [N/A, ]
[D:\oracle\ora92\bin\COREJAVA.DLL] [N/A, ]
[D:\ORACLE\ORA92\JAVAVM\ADMIN\orajox9java_math.dll] [N/A, ]
[D:\ORACLE\ORA92\JAVAVM\ADMIN\orajox9oracle_aurora_rdbms_security.dll] [N/A, ]
[D:\ORACLE\ORA92\JAVAVM\ADMIN\orajox9oracle_aurora_realm.dll] [N/A, ]
[D:\ORACLE\ORA92\JAVAVM\ADMIN\orajox9oracle_jdbc_kprb.dll] [N/A, ]
[D:\ORACLE\ORA92\JAVAVM\ADMIN\orajox9oracle_jdbc_dbaccess.dll] [N/A, ]
[D:\ORACLE\ORA92\JAVAVM\ADMIN\orajox9oracle_jdbc_util.dll] [N/A, ]
[D:\ORACLE\ORA92\JAVAVM\ADMIN\orajox9oracle_aurora_net.dll] [N/A, ]
[PID: 1944][C:\WINNT\Explorer.EXE] [Microsoft Corporation, 5.00.3700.6690]
[C:\WINNT\system32\VrvHook.dll] [edp, 6, 4, 19, 15]
[C:\WINNT\system32\VrvKeyBoard.dll] [, 1, 0, 0, 1]
[C:\WINNT\system32\LICCPA.CPL] [Microsoft Corporation, 5.00.2195.6601]
[C:\WINNT\system32\powercfg.cpl] [Microsoft Corporation, 5.00.3502.6601]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
[PID: 2232][C:\WINNT\system32\internat.exe] [Microsoft Corporation, 5.00.2920.0000]
[C:\WINNT\system32\VrvHook.dll] [edp, 6, 4, 19, 15]
[PID: 2248][C:\Program Files\RealVNC\WinVNC\winvnc.exe] [RealVNC Ltd., 3, 3, 7, 0]
[C:\Program Files\RealVNC\WinVNC\VNCHooks.dll] [RealVNC Ltd., 3, 3, 7, 0]
[C:\Program Files\RealVNC\WinVNC\othread2.dll] [N/A, ]
[C:\WINNT\system32\VrvHook.dll] [edp, 6, 4, 19, 15]
[PID: 1676][C:\WINNT\system32\conime.exe] [Microsoft Corporation, 5.00.2195.6655]
[C:\WINNT\system32\VrvHook.dll] [edp, 6, 4, 19, 15]
[PID: 2852][C:\WINNT\System32\mdm.exe] [Microsoft Corporation, 6.00.8424]
[C:\WINNT\system32\VrvHook.dll] [edp, 6, 4, 19, 15]
[C:\WINNT\System32\msdbg.dll] [Microsoft Corporation, 6.00.8424]
[PID: 1024][C:\WINNT\system32\cmd.exe] [Microsoft Corporation, 5.00.2195.6995]
[C:\WINNT\system32\VrvHook.dll] [edp, 6, 4, 19, 15]
[PID: 1456][D:\jdk1.4\bin\java.exe] [N/A, ]
[C:\WINNT\system32\VrvHook.dll] [edp, 6, 4, 19, 15]
[D:\jdk1.4\jre\bin\client\jvm.dll] [N/A, ]
[D:\jdk1.4\jre\bin\hpi.dll] [N/A, ]
[D:\jdk1.4\jre\bin\verify.dll] [N/A, ]
[D:\jdk1.4\jre\bin\java.dll] [N/A, ]
[D:\jdk1.4\jre\bin\zip.dll] [N/A, ]
[D:\jdk1.4\jre\bin\net.dll] [N/A, ]
[D:\jdk1.4\jre\bin\ioser12.dll] [N/A, ]
[D:\jdk1.4\jre\bin\rmi.dll] [N/A, ]
[PID: 3232][D:\ftp\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
[C:\WINNT\system32\VrvHook.dll] [edp, 6, 4, 19, 15]
[C:\WINNT\system32\VrvKeyBoard.dll] [, 1, 0, 0, 1]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINNT\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
API HOOK
入口点错误：NtOpenProcess (危险等级: 高, 被下面模块所HOOK: C:\WINNT\system32\VrvHook.dll)
入口点错误：NtTerminateProcess (危险等级: 高, 被下面模块所HOOK: C:\WINNT\system32\VrvHook.dll)
入口点错误：ZwOpenProcess (危险等级: 一般, 被下面模块所HOOK: C:\WINNT\system32\VrvHook.dll)
入口点错误：ZwTerminateProcess (危险等级: 高, 被下面模块所HOOK: C:\WINNT\system32\VrvHook.dll)
入口点错误：RegOpenKeyExW (危险等级: 高, 被下面模块所HOOK: C:\WINNT\system32\VrvHook.dll)
入口点错误：RegDeleteKeyW (危险等级: 高, 被下面模块所HOOK: C:\WINNT\system32\VrvHook.dll)
入口点错误：FindFirstFileExW (危险等级: 高, 被下面模块所HOOK: C:\WINNT\system32\VrvHook.dll)
入口点错误：FindFirstFileW (危险等级: 高, 被下面模块所HOOK: C:\WINNT\system32\VrvHook.dll)
入口点错误：FindNextFileW (危险等级: 高, 被下面模块所HOOK: C:\WINNT\system32\VrvHook.dll)

==================================
隐藏进程
N/A

怎么系统进程都加载的有这个dll文件
而且
入口点错误：FindFirstFileW (危险等级: 高, 被下面模块所HOOK: C:\WINNT\system32\VrvHook.dll)
是什么意思啊

看着我就晕了，不好意思，我不会啦

置顶的小工具帖子中下载killbox，运行，填入C:\WINNT\system32\VrvHook.dll，勾选“替换后重启”！