今天开机,不能用Ctrl+Alt+Del打开任务管理器,但是通过右键点任务栏空白处可打开,在尝试了杀毒,修改组策略中的Ctrl+Alt+Del项,AV终结者专杀,以及修改注册表后问题依然存在,并且按照论坛上某帖子的说法寻找system32\dllchce文件夹下寻找taskmgr.exe,没有system32\dllchce文件夹这个文件夹.

还请各位高人指点,因为没在染毒前做备份,一旦还原,某些重要文件将丢失,不要重装

  附上扫描的日志

[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)

2007-08-11,13:36:06

System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描


启动项目


注册表

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
(ctfmon.exe)(C:\WINDOWS\system32\ctfmon.exe) [(Verified)Microsoft Windows Publisher]
(UberIcon)("C:\WINDOWS\Vista\Spctool\UberIcon\UberIcon Manager.exe") []
(bgswitch)(; C:\WINDOWS\system32\bgswitch.exe) []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
(ATIPTA)(C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe) [ATI Technologies, Inc.]
(RavTask)("C:\Program Files\Rising\Rav\RavTask.exe" -system) [Beijing Rising Technology Co., Ltd.]
(RfwMain)("C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup) [Beijing Rising Technology Co., Ltd.]
(svpecld)(C:\WINDOWS\system32\svpecld.exe) []
(POINTER)(point32.exe) [N/A]
(RAVTLMON)(C:\WINDOWS\system32\RAVTLMON.exe) [N/A]
(RAVWLMON)(C:\WINDOWS\system32\RAVWLMON.exe) []
(upxdnd)(C:\WINDOWS\upxdnd.exe) [N/A]
(IMJPMIG8.1)(; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32) [(Verified)Microsoft Windows Publisher]
(MSPY2002)(; C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC) [(Verified)Microsoft Windows Publisher]
(PHIME2002A)(; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName) [(Verified)Microsoft Windows Publisher]
(PHIME2002ASync)(; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC) [(Verified)Microsoft Windows Publisher]
(SoundMan)(; SOUNDMAN.EXE) [(Verified)Microsoft Windows Hardware Compatibility Publisher]
(TkBellExe)(; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot) [N/A]
(zzGBK)(; G:\setup.exe) [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
(visin)(C:\WINDOWS\system32\visin.exe) [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
(shell)(Explorer.exe) [(Verified)]
(Userinit)(C:\WINDOWS\system32\userinit.exe,) [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
(AppInit_DLLs)(wdcpri.dll) []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
(UIHost)(logonui.exe) []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
({AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A})(C:\WINDOWS\system32\shlhook.dll) [Beijing Rising Technology Co., Ltd.]
({32CD708B-60A7-4C00-9377-D73EAA495F0F})(C:\WINDOWS\system32\RavExt.dll) [Beijing Rising Technology Co., Ltd.]
({4562452F-FA36-BA4F-892A-FF5FBBAC5314})(C:\WINDOWS\system32\mydpri.dll) [N/A]
({913AF41A-21B1-131B-1BFC-D2A90DF4A2B9})(C:\WINDOWS\system32\xyhpri.dll) [N/A]
({54123FF1-8371-9834-9021-184518451FA5})(C:\WINDOWS\system32\qjepri.dll) [N/A]
({252D2432-37A2-324F-2A54-21BF5CF2F1A2})(c:\windows\system32\jhapri.dll) [N/A]
({3F12545B-1212-1314-5679-4512ACEF8903})(C:\WINDOWS\system32\wdcpri.dll) []
({0E853A9A-1D47-4434-A1A3-F1C17F849A27})(C:\WINDOWS\system32\wintyu.dll) []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\){26923b43-4d38-484f-9b9e-de460746276c}]
(Internet Explorer)(%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE) [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\){881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
(Outlook Express)(%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE) [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
(Themes Setup)(%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll) [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
(Microsoft Outlook Express 6)("%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install) [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
(NetMeeting 3.01)(rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT) [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
(Microsoft Windows Media Player)(rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub) [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
(通讯簿 6)("%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install) [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
(N/A)(C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install) [Microsoft Corporation]




--------------------------------------------------------------------------------



启动文件夹

[星空极速]
(C:\Documents and Settings\All Users\「开始」菜单\程序\启动\星空极速.lnk --) C:\PROGRA~1\ChinaNet\VNETCL~1.EXE [])(N)

服务

[Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start]
(C:\WINDOWS\system32\Ati2evxx.exe)(ATI Technologies Inc.)
[ATI Smart / ATI Smart][Stopped/Auto Start]
(C:\WINDOWS\system32\ati2sgag.exe)()
[Google Updater Service / gusvc][Stopped/Manual Start]
("C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe")(N/A)
[Human Interface Device Access / HidServ][Stopped/Manual Start]
(C:\WINDOWS\System32\svchost.exe -k netsvcs--)%SystemRoot%\System32\hidserv.dll)(N/A)
[P4P Service / P4P Service][Running/Auto Start]
(C:\Program Files\Common Files\Sogou PXP\p2psvr.exe)(Sohu.com Inc.)
[Rising Proxy Service / RfwProxySrv][Stopped/Manual Start]
(c:\program files\rising\rfw\rfwproxy.exe)(Beijing Rising Technology Co., Ltd.)
[Rising Personal Firewall Service / RfwService][Running/Auto Start]
(c:\program files\rising\rfw\rfwsrv.exe)(Beijing Rising Technology Co., Ltd.)
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
("C:\Program Files\Rising\Rav\CCenter.exe")(Beijing Rising Technology Co., Ltd.)



--------------------------------------------------------------------------------



驱动程序

[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
(system32\drivers\ALCXWDM.SYS)(Realtek Semiconductor Corp.)
[ati2mtag / ati2mtag][Running/Manual Start]
(system32\DRIVERS\ati2mtag.sys)(ATI Technologies Inc.)
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
(System32\DRIVERS\BaseTDI.SYS)(Beijing Rising Technology Co., Ltd.)
[HookUrl / HookUrl][Running/Auto Start]
(\??\C:\Program Files\Rising\Rfw\HookUrl.sys)(Beijing Rising Technology Co., Ltd.)
[MagicTune / MagicTune][Stopped/Manual Start]
(system32\drivers\MTiCtwl.sys)(N/A)
[mProcRs / mProcRs][Running/Auto Start]
(\??\c:\program files\rising\rfw\mProcRs.sys)(Beijing Rising Technology Co., Ltd.)
[mssock / mssock][Stopped/Manual Start]
(\??\C:\WINDOWS\system32\mssock.sys)(N/A)
[npkcrypt / npkcrypt][Stopped/Manual Start]
(\??\C:\WINDOWS\system32\npkcrypt.sys)(N/A)
[npkycryp / npkycryp][Stopped/Manual Start]
(\??\C:\WINDOWS\system32\npkycryp.sys)(N/A)
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
(system32\DRIVERS\ptilink.sys)(Parallel Technologies, Inc.)
[PxHelp20 / PxHelp20][Running/Boot Start]
(\SystemRoot\System32\Drivers\PxHelp20.sys)(Sonic Solutions)
[QKeyServiceDisplay / QKeyService][Running/Boot Start]
(\SystemRoot\system32\KeyCrypt.sys)(Tencent Technology (Shenzhen) Company Limited)
[RsAntiSpyware / RsAntiSpyware][Stopped/Disabled]
(\SystemRoot\system32\drivers\RsBoot.sys)(Beijing Rising Technology Co., Ltd.)
[RsFwDrv / RsFwDrv][Running/Auto Start]
(\??\C:\Program Files\Rising\Rfw\RsFwDrv.sys)(Beijing Rising Technology Co., Ltd.)
[RsNTGDI / RsNTGDI][Running/Boot Start]
(\SystemRoot\system32\Drivers\RsNTGdi.sys)(Beijing Rising Technology Co., Ltd.)
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
(system32\DRIVERS\RTL8139.SYS)(Realtek Semiconductor Corporation)
[Secdrv / Secdrv][Running/Auto Start]
(system32\DRIVERS\secdrv.sys)(Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
[sptd / sptd][Running/Boot Start]
(\SystemRoot\System32\Drivers\sptd.sys)(N/A)
[TesSafe / TesSafe][Stopped/Manual Start]
(\??\C:\WINDOWS\system32\TesSafe.sys)(TENCENT)
[Sony Ericsson W700 Driver driver (WDM) / W700bus][Stopped/Manual Start]
(system32\DRIVERS\W700bus.sys)(MCCI)
[Sony Ericsson W700 USB WMC Modem Filter / W700mdfl][Stopped/Manual Start]
(system32\DRIVERS\W700mdfl.sys)(MCCI)
[Sony Ericsson W700 USB WMC Modem Driver / W700mdm][Stopped/Manual Start]
(system32\DRIVERS\W700mdm.sys)(MCCI)
[Sony Ericsson W700 USB WMC Device Management Drivers (WDM) / W700mgmt][Stopped/Manual Start]
(system32\DRIVERS\W700mgmt.sys)(MCCI)
[Sony Ericsson W700 USB WMC OBEX Interface / W700obex][Stopped/Manual Start]
(system32\DRIVERS\W700obex.sys)(MCCI)
[NDIS5.1 Miniport Driver for Marvell Yukon Gigabit Ethernet Adapter / yukonwxp][Running/Manual Start]
(system32\DRIVERS\yukonwxp.sys)(Marvell Semiconductor Inc.)



--------------------------------------------------------------------------------

浏览器加载项

[WebThunder Browser Helper]
{00000AAA-A363-466E-BEF5-9BB68697AA7F} (F:\WebThunder\WebThunderBHO_Now.dll, Thunder Networking Technologies,LTD)
[ThunderAtOnce Class]
{01443AEC-0FD1-40fd-9C87-E93D1494C233} (F:\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD)
[Thunder Browser Helper]
{06849E9E-C8D7-4D59-B87D-784B7D6BE0B3} (F:\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD)
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx, )
[]
{371BBC41-97DB-47B9-8893-D24E09328E39} (C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\APPLIC~1\dx4vb.dll, N/A)
[VnetCookie Class]
{4E83D567-4697-4F7B-B1F0-A513B01DB89A} (c:\PROGRA~1\chinanet\VNETTR~1.DLL, )
[千千静听]
{34FB5E38-E0C5-11D4-8D29-0050BA6940E3} (f:\TTPlayer\ttplayer.exe, Alen Soft)
[番茄花园]
{6096E38F-5AC1-4391-8EC4-75DFA92FB32F} (http://www.tomatolei.com, N/A)
[启动Web迅雷]
{962EFB8E-2683-42d4-AC74-AAA4C759B9C6} (http://my.xunlei.com, N/A)
[访问瑞星网站]
{FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E444} (http://www.rising.com.cn/?u=RSTB, N/A)
[访问卡卡社区]
{FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E445} (http://www.ikaka.com/?u=RSTB, N/A)
[ULiveCtrl Control]
{070CA17A-4BD2-4612-83B4-32B1B9159B47} (C:\WINDOWS\system32\UCLIVE~1.OCX, 北京新浪信息技术有限公司)
[Uploader Class]
{7B744C64-15D6-4DAC-BB13-5BC3E6ED503A} (C:\WINDOWS\Downloaded Program Files\IEFavUploader.dll, 腾讯（TENCENT）)
[BoBoControl Class]
{EC0978ED-24E3-403C-AB7A-060E388553E6} (C:\WINDOWS\Downloaded Program Files\BoBo_ActiveX_V3.ocx, 广州易播信息科技有限公司)
[WebThunder Browser Helper]
{00000AAA-A363-466E-BEF5-9BB68697AA7F} (F:\WebThunder\WebThunderBHO_Now.dll, Thunder Networking Technologies,LTD)
[ThunderAtOnce Class]
{01443AEC-0FD1-40FD-9C87-E93D1494C233} (F:\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD)
[WebThunder Class]
{03507A1A-E0C5-4404-AA26-205385C0892D} (, N/A)
[Thunder Browser Helper]
{06849E9E-C8D7-4D59-B87D-784B7D6BE0B3} (F:\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD)
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx, )
[PhotoDraw Class]
{2375BEE5-F175-4F1C-81EC-8E4E2E72E2DD} (C:\WINDOWS\system32\QQPhotoDraw.dll, TENCENT)
[]
{371BBC41-97DB-47B9-8893-D24E09328E39} (C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\APPLIC~1\dx4vb.dll, N/A)
[VnetCookie Class]
{4E83D567-4697-4F7B-B1F0-A513B01DB89A} (c:\PROGRA~1\chinanet\VNETTR~1.DLL, )
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} (%SystemRoot%\system32\shdocvw.dll, N/A)
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} (C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.)
[使用Web迅雷下载]
(F:\WebThunder\GetUrl.htm, N/A)
[使用Web迅雷下载全部链接]
(F:\WebThunder\GetAllUrl.htm, N/A)
[使用迅雷下载]
(F:\Thunder\Program\geturl.htm, N/A)
[使用迅雷下载全部链接]
(F:\Thunder\Program\getallurl.htm, N/A)
[收藏到QQ书签]
(http://shuqian.qq.com/favit.html, N/A)
[添加到QQ表情]
(d:\QQ\AddEmotion.htm, N/A)



--------------------------------------------------------------------------------

正在运行的进程

[PID: 628 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 704 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 728 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\wdcpri.dll] [N/A, ]
[C:\WINDOWS\system32\Ati2evxx.dll] [ATI Technologies Inc., 6.14.10.4113]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 776 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\wdcpri.dll] [N/A, ]
[PID: 788 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\wdcpri.dll] [N/A, ]
[PID: 940 / SYSTEM][C:\WINDOWS\system32\Ati2evxx.exe] [ATI Technologies Inc., 6.14.10.4113]
[C:\WINDOWS\system32\Ati2edxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2496]
[PID: 952 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\wdcpri.dll] [N/A, ]
[C:\WINDOWS\system32\heqyd.dll] [N/A, ]
[C:\WINDOWS\system32\hdada.dll] [N/A, ]
[C:\WINDOWS\system32\zkjhx.dll] [N/A, ]
[C:\WINDOWS\system32\wtrwd.dll] [N/A, ]
[C:\WINDOWS\system32\wkjhj.dll] [N/A, ]
[C:\WINDOWS\system32\wgfsm.dll] [N/A, ]
[C:\WINDOWS\system32\wjhgl.dll] [N/A, ]
[C:\WINDOWS\system32\fhfdy.dll] [N/A, ]
[PID: 1028 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\wdcpri.dll] [N/A, ]
[C:\WINDOWS\system32\mscomm.dll] [N/A, ]
[PID: 1172 / SYSTEM][C:\Program Files\Rising\Rav\CCenter.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
[PID: 1188 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\System32\wdcpri.dll] [N/A, ]
[C:\WINDOWS\system32\mscomm.dll] [N/A, ]
[PID: 1276 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\wdcpri.dll] [N/A, ]
[PID: 1408 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\wdcpri.dll] [N/A, ]
[PID: 1484 / SYSTEM][c:\program files\rising\rfw\rfwsrv.exe] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 35]
[C:\WINDOWS\system32\wdcpri.dll] [N/A, ]
[c:\program files\rising\rfw\RfwRule.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 3]
[c:\program files\rising\rfw\rfwlog.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 2]
[c:\program files\rising\rfw\Rfwdrv.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 10]
[c:\program files\rising\rfw\psapi.dll] [Microsoft Corporation, 4.00]
[c:\program files\rising\rfw\MonDrv.dll] [rs, 1, 0, 0, 4]
[c:\program files\rising\rfw\ProcLib.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 5]
[c:\program files\rising\rfw\mPorts.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3]
[PID: 1528 / Administrator][C:\WINDOWS\system32\Ati2evxx.exe] [ATI Technologies Inc., 6.14.10.4113]
[C:\WINDOWS\system32\Ati2edxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2496]
[C:\WINDOWS\system32\heqyd.dll] [N/A, ]
[C:\WINDOWS\system32\hdada.dll] [N/A, ]
[C:\WINDOWS\system32\zkjhx.dll] [N/A, ]
[C:\WINDOWS\system32\wtrwd.dll] [N/A, ]
[C:\WINDOWS\system32\wkjhj.dll] [N/A, ]
[C:\WINDOWS\system32\wgfsm.dll] [N/A, ]
[C:\WINDOWS\system32\wjhgl.dll] [N/A, ]
[C:\WINDOWS\system32\fhfdy.dll] [N/A, ]
[C:\WINDOWS\Vista\Spctool\UberIcon\UberIcon.dll] [N/A, ]
[PID: 1624 / Administrator][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\wdcpri.dll] [N/A, ]
[C:\PROGRA~1\WINDOW~2\wmpband.dll] [Microsoft Corporation, 10.00.00.3802]
[C:\WINDOWS\system32\mscomm.dll] [N/A, ]
[C:\WINDOWS\system32\winlpyfa.dll] [N/A, ]
[C:\WINDOWS\system32\fhfdy.dll] [N/A, ]
[C:\WINDOWS\system32\wjhgl.dll] [N/A, ]
[C:\WINDOWS\system32\wgfsm.dll] [N/A, ]
[C:\WINDOWS\system32\wkjhj.dll] [N/A, ]
[C:\WINDOWS\system32\wtrwd.dll] [N/A, ]
[C:\WINDOWS\system32\zkjhx.dll] [N/A, ]
[C:\WINDOWS\system32\hdada.dll] [N/A, ]
[C:\WINDOWS\system32\heqyd.dll] [N/A, ]
[C:\WINDOWS\system32\cpasevcl1.dll] [, 1, 0, 0, 4]
[C:\WINDOWS\Vista\Spctool\UberIcon\UberIcon.dll] [N/A, ]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[C:\WINDOWS\system32\shlhook.dll] [Beijing Rising Technology Co., Ltd., 4.0.0.7]
[C:\WINDOWS\system32\wintyu.dll] [N/A, ]
[F:\Thunder\ComDlls\TDAtOnce_Now.dll] [Thunder Networking Technologies,LTD, 1.0.0.7]
[PID: 1800 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\WINDOWS\system32\wdcpri.dll] [N/A, ]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll] [Windows (R) 2000 DDK provider, 5.00.2195.1620]
[PID: 1960 / SYSTEM][C:\Program Files\Common Files\Sogou PXP\p2psvr.exe] [Sohu.com Inc., 2, 0, 0, 32]
[C:\WINDOWS\system32\mscomm.dll] [N/A, ]
[C:\Program Files\Sogou PXP\vodsvr.dll] [Sohu.com Inc., 3, 0, 0, 35]
[C:\Program Files\Sogou PXP\pxpnet.dll] [Sohu.com Inc., 2, 0, 0, 18]
[C:\Program Files\Sogou PXP\p2pclient.dll] [Sohu.com Inc., 2, 9, 1, 20]
[PID: 324 / LOCAL SERVICE][C:\WINDOWS\system32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[C:\WINDOWS\system32\wdcpri.dll] [N/A, ]
[PID: 548 / Administrator][c:\program files\rising\rfw\RfwMain.exe] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 72]
[c:\program files\rising\rfw\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33]
[c:\program files\rising\rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[c:\program files\rising\rfw\RfwCtrl.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]
[c:\program files\rising\rfw\RsXML.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
[c:\program files\rising\rfw\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\WINDOWS\Vista\Spctool\UberIcon\UberIcon.dll] [N/A, ]
[C:\WINDOWS\system32\heqyd.dll] [N/A, ]
[C:\WINDOWS\system32\hdada.dll] [N/A, ]
[C:\WINDOWS\system32\zkjhx.dll] [N/A, ]
[C:\WINDOWS\system32\wtrwd.dll] [N/A, ]
[C:\WINDOWS\system32\wkjhj.dll] [N/A, ]
[C:\WINDOWS\system32\wgfsm.dll] [N/A, ]
[C:\WINDOWS\system32\wjhgl.dll] [N/A, ]
[C:\WINDOWS\system32\fhfdy.dll] [N/A, ]
[PID: 676 / Administrator][C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe] [ATI Technologies, Inc., 6.14.10.5142]
[C:\Program Files\ATI Technologies\ATI Control Panel\atipdsxx.dll] [ATI Technologies, Inc., 6.14.10.5142]
[C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATRPUIXX.CHS] [ATI Technologies, Inc., 6.14.10.5142]
[C:\WINDOWS\Vista\Spctool\UberIcon\UberIcon.dll] [N/A, ]
[C:\Program Files\ATI Technologies\ATI Control Panel\atipdxxx.dll] [ATI Technologies, Inc., 6.14.10.5142]
[C:\WINDOWS\system32\heqyd.dll] [N/A, ]
[C:\WINDOWS\system32\hdada.dll] [N/A, ]
[C:\WINDOWS\system32\zkjhx.dll] [N/A, ]
[C:\WINDOWS\system32\wtrwd.dll] [N/A, ]
[C:\WINDOWS\system32\wkjhj.dll] [N/A, ]
[C:\WINDOWS\system32\wgfsm.dll] [N/A, ]
[C:\WINDOWS\system32\wjhgl.dll] [N/A, ]
[C:\WINDOWS\system32\fhfdy.dll] [N/A, ]
[PID: 700 / Administrator][C:\Program Files\Rising\Rav\RavTask.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]

[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\WINDOWS\system32\heqyd.dll] [N/A, ]
[C:\WINDOWS\system32\hdada.dll] [N/A, ]
[C:\WINDOWS\system32\zkjhx.dll] [N/A, ]
[C:\WINDOWS\system32\wtrwd.dll] [N/A, ]
[C:\WINDOWS\system32\wkjhj.dll] [N/A, ]
[C:\WINDOWS\system32\wgfsm.dll] [N/A, ]
[C:\WINDOWS\system32\wjhgl.dll] [N/A, ]
[C:\WINDOWS\system32\fhfdy.dll] [N/A, ]
[C:\WINDOWS\Vista\Spctool\UberIcon\UberIcon.dll] [N/A, ]
[PID: 1144 / Administrator][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\wdcpri.dll] [N/A, ]
[C:\WINDOWS\Vista\Spctool\UberIcon\UberIcon.dll] [N/A, ]
[C:\WINDOWS\system32\heqyd.dll] [N/A, ]
[C:\WINDOWS\system32\hdada.dll] [N/A, ]
[C:\WINDOWS\system32\zkjhx.dll] [N/A, ]
[C:\WINDOWS\system32\wtrwd.dll] [N/A, ]
[C:\WINDOWS\system32\wkjhj.dll] [N/A, ]
[C:\WINDOWS\system32\wgfsm.dll] [N/A, ]
[C:\WINDOWS\system32\wjhgl.dll] [N/A, ]
[C:\WINDOWS\system32\fhfdy.dll] [N/A, ]
[PID: 1152 / Administrator][C:\WINDOWS\Vista\Spctool\UberIcon\UberIcon Manager.exe] [N/A, ]
[C:\WINDOWS\Vista\Spctool\UberIcon\UberIcon.dll] [N/A, ]
[C:\WINDOWS\Vista\Spctool\UberIcon\Plugins\iBounce\fx.dll] [N/A, ]
[C:\WINDOWS\system32\heqyd.dll] [N/A, ]
[C:\WINDOWS\system32\hdada.dll] [N/A, ]
[C:\WINDOWS\system32\zkjhx.dll] [N/A, ]
[C:\WINDOWS\system32\wtrwd.dll] [N/A, ]
[C:\WINDOWS\system32\wkjhj.dll] [N/A, ]
[C:\WINDOWS\system32\wgfsm.dll] [N/A, ]
[C:\WINDOWS\system32\wjhgl.dll] [N/A, ]
[C:\WINDOWS\system32\fhfdy.dll] [N/A, ]
[PID: 1220 / Administrator][C:\Program Files\ChinaNet\VnetClient.exe] [, 2005, 1, 18, 1]
[C:\Program Files\ChinaNet\Communicate.dll] [0, 1, 0, 0, 1]
[C:\Program Files\ChinaNet\DialModule.dll] [, 2005, 1, 18, 1]
[C:\Program Files\ChinaNet\MFC42.DLL] [Microsoft Corporation, 6.00.8665.0]
[C:\WINDOWS\Vista\Spctool\UberIcon\UberIcon.dll] [N/A, ]
[C:\PROGRA~1\ChinaNet\CLIENT~1.DLL] [, 2004, 1, 10, 1]
[C:\PROGRA~1\ChinaNet\PLUGIN~1.OCX] [, 2005, 1, 18, 1]
[C:\PROGRA~1\ChinaNet\sign.dll] [0, 2004, 12, 1, 1]
[C:\PROGRA~1\ChinaNet\SETUPP~1.DLL] [, 1, 0, 0, 1]
[C:\PROGRA~1\ChinaNet\SysPlug\206301~1\PICPUZ~1.DLL] [, 2004, 12, 3, 0]
[C:\PROGRA~1\ChinaNet\PostPlug.dll] [, 2004, 12, 16, 2]
[C:\PROGRA~1\ChinaNet\ADVERT~1.OCX] [, 2004, 12, 30, 0]
[C:\PROGRA~1\ChinaNet\VnetBs.ocx] [, 2004, 11, 18, 1]
[C:\PROGRA~1\ChinaNet\ACCOUN~2.DLL] [, 2005, 1, 18, 1]
[C:\PROGRA~1\ChinaNet\AccountMgr.dll] [, 2004, 12, 8, 2]
[C:\PROGRA~1\ChinaNet\PLUGIN~2.OCX] [, 2004, 11, 19, 2]
[C:\PROGRA~1\ChinaNet\NEWMES~1.DLL] [, 2004, 11, 25, 0]
[C:\PROGRA~1\ChinaNet\PassCtrl.dll] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\wpcap.dll] [Politecnico di Torino, 3, 0, 0, 18]
[C:\WINDOWS\system32\pthreadVC.dll] [N/A, ]
[C:\WINDOWS\system32\packet.dll] [Politecnico di Torino, 3, 0, 0, 18]
[C:\PROGRA~1\ChinaNet\PlugPush.dll] [, 2004, 12, 9, 1]
[C:\PROGRA~1\ChinaNet\ALLINT~1.DLL] [, 2004, 11, 23, 1]
[C:\PROGRA~1\ChinaNet\VNETLO~1.OCX] [, 2005, 1, 20, 1]
[C:\PROGRA~1\ChinaNet\StatNum.dll] [, 2004, 11, 18, 1]
[C:\PROGRA~1\ChinaNet\VNETON~1.OCX] [, 2004, 11, 23, 1]
[C:\PROGRA~1\ChinaNet\ALLFUN~1.DLL] [, 2005, 1, 15, 1]
[C:\PROGRA~1\ChinaNet\VnetOptLog.dll] [, 2004, 11, 23, 1]
[C:\PROGRA~1\ChinaNet\DialogStyle.dll] [, 1, 0, 0, 1]
[C:\PROGRA~1\ChinaNet\Timer.ocx] [, 2004, 11, 25, 1]
[C:\PROGRA~1\ChinaNet\VnetSkin.ocx] [GDDC, 1, 0, 0, 1]
[C:\PROGRA~1\ChinaNet\PlugIns\sms\SMSCON~1.DLL] [, 1, 0, 0, 1]
[C:\PROGRA~1\ChinaNet\PlugIns\sms\smsctl.dll] [, 1, 0, 0, 1]
[C:\PROGRA~1\ChinaNet\PlugIns\sms\MsgEg_DLL.dll] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\heqyd.dll] [N/A, ]
[C:\WINDOWS\system32\hdada.dll] [N/A, ]
[C:\WINDOWS\system32\zkjhx.dll] [N/A, ]
[C:\WINDOWS\system32\wtrwd.dll] [N/A, ]
[C:\WINDOWS\system32\wkjhj.dll] [N/A, ]
[C:\WINDOWS\system32\wgfsm.dll] [N/A, ]
[C:\WINDOWS\system32\wjhgl.dll] [N/A, ]
[C:\WINDOWS\system32\fhfdy.dll] [N/A, ]
[C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\PROGRA~1\ChinaNet\DlgSkin.ocx] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\wdcpri.dll] [N/A, ]
[C:\WINDOWS\system32\mscomm.dll] [N/A, ]
[PID: 236 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\mscomm.dll] [N/A, ]
[PID: 2588 / Administrator][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\wdcpri.dll] [N/A, ]
[C:\WINDOWS\Vista\Spctool\UberIcon\UberIcon.dll] [N/A, ]
[F:\WebThunder\WebThunderBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 2, 10]
[F:\Thunder\ComDlls\TDAtOnce_Now.dll] [Thunder Networking Technologies,LTD, 1.0.0.7]
[F:\Thunder\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 2, 10]
[F:\Thunder\Components\ResWorker\DsBho_00.dll] [, 1, 0, 0, 4]
[F:\Thunder\Components\ResWorker\DataProcessor_00.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 6]
[C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx] [, 1, 0, 0, 1]
[c:\PROGRA~1\chinanet\VNETTR~1.DLL] [, 2004, 1, 14, 1]
[c:\PROGRA~1\chinanet\Communicate.dll] [0, 1, 0, 0, 1]
[C:\PROGRA~1\ChinaNet\CLIENT~1.DLL] [, 2004, 1, 10, 1]
[C:\WINDOWS\system32\heqyd.dll] [N/A, ]
[C:\WINDOWS\system32\hdada.dll] [N/A, ]
[C:\WINDOWS\system32\zkjhx.dll] [N/A, ]
[C:\WINDOWS\system32\wtrwd.dll] [N/A, ]
[C:\WINDOWS\system32\wkjhj.dll] [N/A, ]
[C:\WINDOWS\system32\wgfsm.dll] [N/A, ]
[C:\WINDOWS\system32\wjhgl.dll] [N/A, ]
[C:\WINDOWS\system32\fhfdy.dll] [N/A, ]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\mscomm.dll] [N/A, ]
[C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[C:\WINDOWS\system32\UNISPIM5.IME] [北京紫光华宇软件股份有限公司, 5.0.0.5076]
[C:\WINDOWS\system32\shlhook.dll] [Beijing Rising Technology Co., Ltd., 4.0.0.7]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
[C:\WINDOWS\system32\wintyu.dll] [N/A, ]
[PID: 3204 / Administrator][C:\WINDOWS\system32\taskmgr.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\Vista\Spctool\UberIcon\UberIcon.dll] [N/A, ]
[C:\WINDOWS\system32\heqyd.dll] [N/A, ]
[C:\WINDOWS\system32\hdada.dll] [N/A, ]
[C:\WINDOWS\system32\zkjhx.dll] [N/A, ]
[C:\WINDOWS\system32\wtrwd.dll] [N/A, ]
[C:\WINDOWS\system32\wkjhj.dll] [N/A, ]
[C:\WINDOWS\system32\wgfsm.dll] [N/A, ]
[C:\WINDOWS\system32\wjhgl.dll] [N/A, ]
[C:\WINDOWS\system32\fhfdy.dll] [N/A, ]
[C:\WINDOWS\system32\wdcpri.dll] [N/A, ]
[PID: 2364 / Administrator][C:\Documents and Settings\Administrator\桌面\新建文件夹\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]
[C:\WINDOWS\system32\wdcpri.dll] [N/A, ]
[C:\WINDOWS\Vista\Spctool\UberIcon\UberIcon.dll] [N/A, ]
[C:\WINDOWS\system32\heqyd.dll] [N/A, ]
[C:\WINDOWS\system32\hdada.dll] [N/A, ]
[C:\WINDOWS\system32\zkjhx.dll] [N/A, ]
[C:\WINDOWS\system32\wtrwd.dll] [N/A, ]
[C:\WINDOWS\system32\wkjhj.dll] [N/A, ]
[C:\WINDOWS\system32\wgfsm.dll] [N/A, ]
[C:\WINDOWS\system32\wjhgl.dll] [N/A, ]
[C:\WINDOWS\system32\fhfdy.dll] [N/A, ]
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]
[C:\WINDOWS\system32\mscomm.dll] [N/A, ]



--------------------------------------------------------------------------------



文件关联

.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]



--------------------------------------------------------------------------------



Winsock 提供者

MSAPI Tcpip [TCP/IP]
C:\WINDOWS\system32\mscomm.dll(, N/A)
MSAPI Tcpip [UDP/IP]
C:\WINDOWS\system32\mscomm.dll(, N/A)



--------------------------------------------------------------------------------



Autorun.inf

N/A



--------------------------------------------------------------------------------



HOSTS 文件

127.0.0.1 localhost



--------------------------------------------------------------------------------



进程特权扫描

特殊特权被允许： SeLoadDriverPrivilege [PID = 1624, C:\WINDOWS\EXPLORER.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 548, C:\PROGRAM FILES\RISING\RFW\RFWMAIN.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 548, C:\PROGRAM FILES\RISING\RFW\RFWMAIN.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 676, C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 676, C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 700, C:\PROGRAM FILES\RISING\RAV\RAVTASK.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 700, C:\PROGRAM FILES\RISING\RAV\RAVTASK.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 1152, C:\WINDOWS\VISTA\SPCTOOL\UBERICON\UBERICON MANAGER.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1152, C:\WINDOWS\VISTA\SPCTOOL\UBERICON\UBERICON MANAGER.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 1220, C:\PROGRAM FILES\CHINANET\VNETCLIENT.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1220, C:\PROGRAM FILES\CHINANET\VNETCLIENT.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 2588, C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2588, C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3204, C:\WINDOWS\SYSTEM32\TASKMGR.EXE]



--------------------------------------------------------------------------------



API HOOK

N/A



--------------------------------------------------------------------------------



隐藏进程

N/A



--------------------------------------------------------------------------------