【求助】电脑总是自动访问SF.SF325.COM网站 bbs.ikaka.com

csytiger - 2006-2-6 16:37:00

最近我发现我的电脑总是自动访问SF.SF325.COM网站,并尝试下载iexplore.exe文件,请帮忙解决

魔法学徒 - 2006-2-6 16:44:00

请用最新版Hijackthis1.99.1扫描一个log贴上来。

hijackThis下载地址见置顶帖
[必读]本版说明及常用小软件下载
http://forum.ikaka.com/topic.asp?board=67&artid=5188931

bettertiger - 2006-2-6 18:16:00

你先取消文件隐藏属性。然后在安全模式下搜索这个网站。找到文件删除。在注册表编辑器里查找这个网址。找到后删除。在注册表HKEY_LOCAL_MACHINE\SOFTWARE\Mic rosoft\Windows\CurrentVersion\Run，其下的字符串值表示通过注册表自启动的程序；

　　在注册表HKEY_LOCAL_MACHINE\SOFTWARE\Mic rosoft\Windows\CurrentVersion\RunOnce，其下的字符串值表示只自启动一次的程序；

　　在注册表HKEY_LOCAL_MACHINE\SOFTWARE\Mic rosoft\Windows\CurrentVersion\RunServices，其下的字符串值表示通过注册表自启动的服务程序；

　　在注册表HKEY_LOCAL_MACHINE\SOFTWARE\Mic rosoft\Windows\CurrentVersion\RunServicesOnce，其下的字符串值表示只启动一次的服务程序。

　　由此，我们可以看出上面所有的DWORD值，如果其值为“1”时表示该值有效，其值为“0”时表示该值无效；我们可以通过改变DWORD值或删除该DWORD，来轻松地使相应的限制有效或无效。

在这些地方找到这个网站后删除。重启即可。

csytiger - 2006-2-7 7:43:00

我的扫描日志:
HijackThis_zww汉化版扫描日志 V1.99.1
保存于 7:40:53, 日期 2006-2-7
操作系统： Windows 2003 (WinNT 5.02.3790)
浏览器： Internet Explorer v6.00 (6.00.3790.0000)

当前运行的进程：
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Rising\Rav\CCenter.exe
E:\Program Files\rising\rav\Ravmond.exe
E:\WINDOWS\System32\svchost.exe
e:\program files\rising\rfw\rfwproxy.exe
e:\program files\rising\rfw\rfwsrv.exe
E:\Program Files\rising\rav\RavStub.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\inetsrv\inetinfo.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\Dfssvc.exe
e:\program files\rising\rfw\RfwMain.exe
E:\WINDOWS\system32\MSTMON_N.EXE
E:\Program Files\Ringz Studio\Storm Downloader\StormDownloader.exe
F:\Program Files\D-Tools\daemon.exe
E:\WINDOWS\VM_STI.EXE
E:\Program Files\Rising\Rav\RavTask.exe
E:\Program Files\Rising\Rav\Ravmon.exe
E:\WINDOWS\system32\ctfmon.exe
F:\Program Files\CamSplitter\camsplitter.exe
E:\WINDOWS\system32\mmc.exe
E:\WINDOWS\system32\taskmgr.exe
E:\Program Files\Internet Explorer\IEXPLORE.EXE
E:\WINDOWS\explorer.exe
E:\Program Files\Hijack\HijackThis1991汉化版\HijackThis1991zww.exe

O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - E:\WINDOWS\system32\xunleibho_v4.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - E:\Program Files\Xi\NetTransport 2\NTIEHelper.dll
O3 - IE工具栏增项: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\system32\msdxm.ocx
O3 - IE工具栏增项: 完美网译通 - {F43BD772-ABDD-43b7-A96A-3E9E61946EC0} - E:\WINDOWS\WORLD2\TOOLBAR\hmtoolbar.dll
O3 - IE工具栏增项: IE伴郎 - {B225B89D-5E95-4194-98E8-149993071B31} - E:\PROGRA~1\NETMEE~1\CALLCO~1.DLL
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] "E:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] E:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] E:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [KONICA MINOLTA PagePro 1300WStatusDisplay] E:\WINDOWS\system32\MSTMON_N.EXE
O4 - 启动项HKLM\\Run: [NMGameX_AutoRun] E:\WINDOWS\system32\Rundll32.exe NMGameX.dll,LiveProcess /aa
O4 - 启动项HKLM\\Run: [StormCodec_Helper] "E:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti
O4 - 启动项HKLM\\Run: [MINI_BFYY] E:\Program Files\Ringz Studio\Storm Downloader\StormDownloader.exe
O4 - 启动项HKLM\\Run: [DAEMON Tools-2052] "F:\Program Files\D-Tools\daemon.exe" -lang 2052
O4 - 启动项HKLM\\Run: [BigDogPath] E:\WINDOWS\VM_STI.EXE ZSMC USB PC Camera
O4 - 启动项HKLM\\Run: [RavTask] "E:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [RfwMain] "E:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - 启动项HKLM\\Run: [Alitalk] E:\PROGRA~1\阿里巴巴\贸易通\AliTalk.EXE -hideframe
O4 - 启动项HKLM\\Run: [Install Alitalk] E:\WINDOWS\temp\alitalk\alitalk.exe -hideframe
O4 - HKCU\..\Run: [ctfmon.exe] E:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Camsplitter.lnk = F:\Program Files\CamSplitter\camsplitter.exe
O4 - Startup: 新浪UC.lnk = E:\Program Files\sina\UC2005III2\uc.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = E:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - IE右键菜单中的新增项目: !搜一搜 - res://E:\WINDOWS\downlo~1\CnsMinEx.dll/1003
O8 - IE右键菜单中的新增项目: &使用暴风下载器下载 - E:\Program Files\Ringz Studio\Storm Downloader\geturl.htm
O8 - IE右键菜单中的新增项目: 使用彩信超级自写发送到手机 - http://mms.sina.com.cn/mmsnews.html
O8 - IE右键菜单中的新增项目: 使用新浪下载助手下载 - F:\PROGRA~1\sina\UC2005~1\UCddt\sinadl.htm
O8 - IE右键菜单中的新增项目: 发送图片到手机(&M) - http://sms.sina.com.cn/diy/send.html?from=467
O8 - IE右键菜单中的新增项目: 在Foxmail中添加该RSS频道/频道组 - res://E:\WINDOWS\system32\fmrsslink.dll/201
O8 - IE右键菜单中的新增项目: 收藏此页到新浪ViVi - http://vivi.sina.com.cn/collect/click.php?agent=ddt
O8 - IE右键菜单中的新增项目: 新浪搜索 - http://cha.sina.com.cn/ddt.html
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - E:\Program Files\Tencent\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - E:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - E:\Program Files\Tencent\QQ\SendMMS.htm
O9 - 浏览器额外的按钮: 手机短信 - {00000000-0000-0001-0001-596BAEDD1289} - http://sms.3721.com/ie/index.htm?pid=213640_1006 (file missing)
O9 - 浏览器额外的按钮: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - 浏览器额外的“工具”菜单项: Sun Java 控制台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - 浏览器额外的按钮: 新浪UC - {2253922F-1B26-4C74-8B57-E3AEE748DBB8} - E:\Program Files\sina\UC2005III2\uc.exe
O11 - Options group: [!CNS] 上网助手-地址栏搜索
O12 - IE插件，支持文件类型.pdf: E:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {09FAF0EA-6E32-4205-9E10-FED3507C10F2} (Qkdd Control) - http://freemail.dl.net.cn/FTPClient/QuarkFTPClient.cab
O16 - DPF: {6F101641-AFFE-4E1F-9BF1-E8976A646549} (AlbumP Control) - http://album.ent.tom.com/scripts/AlbumPProj1.ocx
O16 - DPF: {BD6E5CAC-D2B7-4266-B966-521A8A8CBCF6} (MeChatC Class) - http://localhost:6000/video/MeChatClient.cab
O16 - DPF: {C5D0DFF5-6D39-4F98-88CD-12E8430A6300} (clienttime.client) - http://www.time.ac.cn/times/client.CAB
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.streamload.com/Upload/XUpload.ocx
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = tongkang.cn
O17 - HKLM\Software\..\Telephony: DomainName = tongkang.cn
O17 - HKLM\System\CCS\Services\Tcpip\..\{E7681BB5-6D79-4C86-80E0-B0600332300E}: NameServer = 192.168.1.1,202.102.137.68,202.102.152.3
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = tongkang.cn
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = tongkang.cn
O18 - 列举现有的协议: koboo - {7DEE9D05-FA0A-4416-A6F3-6537D0EAB6A6} - E:\WINDOWS\system32\mbprot.dll
O23 - NT 服务: ezProxy - Unknown owner - c:\Program Files\ezProxy\ezEngine.exe
O23 - NT 服务: iChat V3.0 Server (iChat3) - Unknown owner - f:\ichat3\iChat3.exe (file missing)
O23 - NT 服务: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - e:\program files\rising\rfw\rfwproxy.exe
O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - e:\program files\rising\rfw\rfwsrv.exe
O23 - NT 服务: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - E:\Program Files\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - E:\Program Files\rising\rav\Ravmond.exe
O23 - NT 服务: MorningSound VirtualCamera Play Service (VirtualCameraService) - Unknown owner - E:\Program Files\VirtualCamera\VCamSrv.exe (file missing)

魔法学徒 - 2006-2-7 8:15:00

建议修复
O3 - IE工具栏增项: 完美网译通 - {F43BD772-ABDD-43b7-A96A-3E9E61946EC0} - E:\WINDOWS\WORLD2\TOOLBAR\hmtoolbar.dll
O3 - IE工具栏增项: IE伴郎 - {B225B89D-5E95-4194-98E8-149993071B31} - E:\PROGRA~1\NETMEE~1\CALLCO~1.DLL

删除

E:\WINDOWS\WORLD2\
E:\PROGRA~1\NETMEE~1\CALLCO~1.DLL

csytiger - 2006-2-7 8:34:00

【回复“魔法学徒”的帖子】处理以后还是没解决.

魔法学徒 - 2006-2-7 14:13:00

请用最新版System Repair Engineer扫描一个log贴上来。

System Repair Engineer下载地址见
【推荐】System Repair Engineer 2.0.12.350 RC1版
http://forum.ikaka.com/topic.asp?board=67&artid=7540414

csytiger - 2006-2-7 15:03:00

2006-02-07,14:46:25

System Repair Engineer 2.0.12.350 (2.0 RC 1)
Windows Server 2003 Enterprise Edition - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><E:\WINDOWS\system32\ctfmon.exe>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<run><>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"E:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<PHIME2002ASync><E:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<PHIME2002A><E:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<KONICA MINOLTA PagePro 1300WStatusDisplay><E:\WINDOWS\system32\MSTMON_N.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<NMGameX_AutoRun><E:\WINDOWS\system32\Rundll32.exe NMGameX.dll,LiveProcess /aa>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<StormCodec_Helper><"E:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<MINI_BFYY><E:\Program Files\Ringz Studio\Storm Downloader\StormDownloader.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<DAEMON Tools-2052><"F:\Program Files\D-Tools\daemon.exe" -lang 2052>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<BigDogPath><E:\WINDOWS\VM_STI.EXE ZSMC USB PC Camera>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<RavTask><"E:\Program Files\Rising\Rav\RavTask.exe" -system>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<RfwMain><"E:\Program Files\Rising\Rfw\rfwmain.exe" -Startup>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Alitalk><E:\PROGRA~1\阿里巴巴\贸易通\AliTalk.EXE -hideframe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Install Alitalk><E:\WINDOWS\temp\alitalk\alitalk.exe -hideframe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Beetle><E:\Program Files\Beetle\BEETLE.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<inetsvr><E:\Program Files\ieup\inetsvr.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<Userinit><E:\WINDOWS\SYSTEM32\Userinit.exe,>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<advapi32><; RUNDLL32 E:\WINDOWS\Downlo~1\_IS_0518\_IS_ISC.DLL,isc>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<ExFilter><; Rundll32.exe "E:\PROGRA~1\CNNIC\Cdn\cdnspie.dll,ExecFilter solo">
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<helper.dll><; E:\WINDOWS\system32\rundll32.exe E:\PROGRA~1\3721\helper.dll,Rundll32>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<hzs><; c:\Program Files\meibu\watchhzs.exe>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<ISC><; >
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<ISC_UpDate><; >
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<MINI_80AGE><; E:\Program Files\Sandai\ThunderMini\ThunderMini.exe>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<MINI_BFYY><; E:\Program Files\Ringz Studio\Storm Downloader\StormDownloader.exe>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<MoveSearch><; E:\Program Files\wsearch\Search.exe>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<MyIMLite><; >
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<MyIMLite_UpDate><; >
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<NbFloatBar><; E:\Program Files\Netease\NeteaseBar\NbStart.exe>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<NicChina><; [Program Files]\nicchina.exe>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<PigLocalSearch><; f:\Program Files\网络猪\PigStart.exe>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<popo2004><; E:\Program Files\Netease\popo2004\Start.exe>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<StormCodec_Helper><; "E:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<SunJavaUpdateSched><; E:\Program Files\Java\jre1.5.0_04\bin\jusched.exe>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<Super Rabbit SRRestore><; E:\PROGRA~1\SUPERR~1\MagicSet\SRRest.exe /autosave>

==================================
启动文件夹
[Adobe Gamma Loader]
<E:\Documents and Settings\All Users.WINDOWS\「开始」菜单\程序\启动\Adobe Gamma Loader.lnk><N>
[Adobe Reader Speed Launch]
<E:\Documents and Settings\All Users.WINDOWS\「开始」菜单\程序\启动\Adobe Reader Speed Launch.lnk><N>
[Microsoft Office]
<E:\Documents and Settings\All Users.WINDOWS\「开始」菜单\程序\启动\Microsoft Office.lnk><N>
[Camsplitter]
<E:\Documents and Settings\Administrator.INFO\「开始」菜单\程序\启动\Camsplitter.lnk><N>
[新浪UC]
<E:\Documents and Settings\Administrator.INFO\「开始」菜单\程序\启动\新浪UC.lnk><N>

==================================
服务
[ezProxy / ezProxy]
<c:\Program Files\ezProxy\ezEngine.exe -r><>
[HX massacre / HXmassacre]
<E:\WINDOWS\help\HXpass.exe><N/A>
[iChat V3.0 Server / iChat3]
<f:\ichat3\iChat3.exe><N/A>
[Rising Proxy Service / RfwProxySrv]
<e:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService]
<e:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter]
<"E:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
<"E:\Program Files\rising\rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[Network System / Universal Disk Manager]
<E:\Program Files\Common Files\SAND\Network.exe><N/A>
[MorningSound VirtualCamera Play Service / VirtualCameraService]
<E:\Program Files\VirtualCamera\VCamSrv.exe><N/A>

==================================
浏览器加载项
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <E:\WINDOWS\system32\xunleibho_v4.dll, >
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[BeetleSoft]
{7D8E174C-6126-4608-A99E-4376969E105C} <E:\WINDOWS\system32\beetlelib.dll, 翱拓电脑工作室>
[NTIECatcher Class]
{C56CB6B0-0D96-11D6-8C65-B2868B609932} <E:\Program Files\Xi\NetTransport 2\NTIEHelper.dll, Xi>
[Java Plug-in 1.5.0_04]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} <E:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll, Sun Microsystems, Inc.>
[CNNIC无忧上网]
{FB5F1910-F110-11d2-BB9E-00C04F795688} <E:\Program Files\ieup\ieup.exe, CNNIC>
[无忧上网工具条]
{19780818-4B85-4D8E-B7AF-0D6C182B1516} <E:\Program Files\ieup\ieupbar.dll, 中国互联网络中心（CNNIC）>
[Qkdd Control]
{09FAF0EA-6E32-4205-9E10-FED3507C10F2} <E:\WINDOWS\DOWNLO~1\QKDDPR~1.OCX, N/A>
[AlbumP Control]
{6F101641-AFFE-4E1F-9BF1-E8976A646549} <E:\WINDOWS\DOWNLO~1\ALBUMP~1.OCX, >
[Java Plug-in 1.5.0_04]
{8AD9C840-044E-11D1-B3E9-00805F499D93} <E:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll, Sun Microsystems, Inc.>
[MeChatC Class]
{BD6E5CAC-D2B7-4266-B966-521A8A8CBCF6} <E:\WINDOWS\Downloaded Program Files\MeChatClient.dll, >
[clienttime.client]
{C5D0DFF5-6D39-4F98-88CD-12E8430A6300} <E:\WINDOWS\Downloaded Program Files\client.ocx, NTSC>
[Java Plug-in 1.5.0_04]
{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} <E:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll, Sun Microsystems, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <E:\WINDOWS\system32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[Persits Software XUpload]
{E87F6C8E-16C0-11D3-BEF7-009027438003} <E:\WINDOWS\Downloaded Program Files\XUpload.ocx, Persits Software, Inc.>
[&使用暴风下载器下载]
<E:\Program Files\Ringz Studio\Storm Downloader\geturl.htm, N/A>
[使用新浪下载助手下载]
<F:\PROGRA~1\sina\UC2005~1\UCddt\sinadl.htm, N/A>

csytiger - 2006-2-7 15:05:00

==================================
正在运行的进程
[PID: 348][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.2.3790.0 (srv03_rtm.030324-2048)>
[PID: 396][\??\E:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.2.3790.0 (srv03_rtm.030324-2048)>
[PID: 420][\??\E:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.2.3790.0 (srv03_rtm.030324-2048)>
[PID: 464][E:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.2.3790.0 (srv03_rtm.030324-2048)>
[PID: 476][E:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.2.3790.0 (srv03_rtm.030324-2048)>
[PID: 652][E:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.2.3790.0 (srv03_rtm.030324-2048)>
[PID: 700][E:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.2.3790.0 (srv03_rtm.030324-2048)>
[PID: 756][E:\Program Files\Rising\Rav\CCenter.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 800][E:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.2.3790.0 (srv03_rtm.030324-2048)>
[PID: 816][E:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.2.3790.0 (srv03_rtm.030324-2048)>
[PID: 844][E:\Program Files\rising\rav\Ravmond.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 7>
[E:\Program Files\rising\rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
[E:\Program Files\rising\rav\RsCommX.dll] <rising><18, 0, 0, 1>
[E:\Program Files\rising\rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[E:\Program Files\rising\rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[E:\Program Files\rising\rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[E:\Program Files\rising\rav\RsLog.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 18>
[E:\Program Files\rising\rav\HOOKSYS.dll] <Rising><18, 1, 0, 9>
[E:\Program Files\Rising\Rav\Scanner.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 28>
[E:\Program Files\Rising\Rav\libload.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[E:\Program Files\Rising\Rav\VirusLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[E:\Program Files\rising\rav\regmon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[E:\Program Files\rising\rav\HookWeb.dll] <rising><18, 0, 0, 1>
[E:\Program Files\rising\rav\MemMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 8>
[E:\Program Files\rising\rav\expscan.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[E:\Program Files\rising\rav\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
[E:\Program Files\rising\rav\MailMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[E:\Program Files\Rising\Rav\SpamEng.dll] <N/A><18, 0, 0, 4>
[E:\Program Files\Rising\Rav\engine.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23>
[E:\Program Files\Rising\Rav\PostTrt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[E:\Program Files\Rising\Rav\UnExe.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[E:\Program Files\Rising\Rav\ScanExec.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[E:\Program Files\Rising\Rav\ScanEx.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[E:\Program Files\Rising\Rav\NvFile.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
[E:\Program Files\Rising\Rav\ScanMac.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
[E:\Program Files\Rising\Rav\ScanSct.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[E:\Program Files\Rising\Rav\Unpacker.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[E:\Program Files\Rising\Rav\ExtOLE.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 880][E:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.2.3790.0 (srv03_rtm.030324-2048)>
[PID: 892][e:\program files\rising\rfw\rfwproxy.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 7>
[e:\program files\rising\rfw\RfwRule.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 11>
[e:\program files\rising\rfw\MonMid.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 2>
[PID: 944][e:\program files\rising\rfw\rfwsrv.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 29>
[e:\program files\rising\rfw\RfwRule.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 11>
[e:\program files\rising\rfw\rfwlog.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 6>
[e:\program files\rising\rfw\Rfwdrv.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 19>
[e:\program files\rising\rfw\MonDrv.dll] <rs><1, 0, 0, 4>
[e:\program files\rising\rfw\ProcLib.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 9>
[e:\program files\rising\rfw\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
[PID: 1060][E:\Program Files\rising\rav\RavStub.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
[E:\Program Files\rising\rav\RsCommX.dll] <rising><18, 0, 0, 1>
[E:\Program Files\rising\rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 1208][E:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.2.3790.0 (srv03_rtm.030324-2048)>
[E:\WINDOWS\system32\MLMON__N.DLL] <KONICA MINOLTA BUSINESS TECHNOLOGIES, INC.><1, 1, 1212, 0>
[E:\WINDOWS\system32\MSPOOL_N.dll] <Zenographics, Inc.><5, 51, 709, 717>
[E:\WINDOWS\system32\spool\PRTPROCS\W32X86\MIMFPR_N.DLL] <Zenographics, Inc.><5, 54, 330, 717>
[E:\WINDOWS\system32\MIMF32_N.dll] <Zenographics, Inc.><5, 51, 405, 717>
[E:\WINDOWS\system32\MTAG32_N.dll] <Zenographics, Inc.><5, 50, 1725, 717>
[E:\WINDOWS\system32\spool\PRTPROCS\W32X86\vprproc.dll] <Windows (R) 2000 DDK provider><5.00.2195.1620>
[PID: 1236][E:\WINDOWS\system32\msdtc.exe] <Microsoft Corporation><2001.12.4720.0 (srv03_rtm.030324-2048)>
[PID: 1444][E:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.2.3790.0 (srv03_rtm.030324-2048)>
[PID: 1468][E:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.2.3790.0 (srv03_rtm.030324-2048)>
[PID: 1516][E:\WINDOWS\system32\inetsrv\inetinfo.exe] <Microsoft Corporation><6.0.3790.0 (srv03_rtm.030324-2048)>
[PID: 1552][E:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.2.3790.0 (srv03_rtm.030324-2048)>
[PID: 1572][E:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.2.3790.0 (srv03_rtm.030324-2048)>
[PID: 1760][E:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.2.3790.0 (srv03_rtm.030324-2048)>
[PID: 1928][E:\WINDOWS\system32\Dfssvc.exe] <Microsoft Corporation><5.2.3790.0 (srv03_rtm.030324-2048)>
[PID: 2232][E:\WINDOWS\system32\wbem\wmiprvse.exe] <Microsoft Corporation><5.2.3790.0 (srv03_rtm.030324-2048)>
[PID: 2712][E:\WINDOWS\system32\MSTMON_N.EXE] <KONICA MINOLTA BUSINESS TECHNOLOGIES, INC.><1, 1, 1117, 0>
[E:\WINDOWS\system32\MSPOOL_N.dll] <Zenographics, Inc.><5, 51, 709, 717>
[E:\WINDOWS\system32\mstmon_N.dll] <KONICA MINOLTA BUSINESS TECHNOLOGIES, INC.><1, 0, 717, 0>
[F:\Program Files\CamSplitter\handler.dll] <N/A><N/A>
[PID: 2736][E:\Program Files\Ringz Studio\Storm Downloader\StormDownloader.exe] <深圳市三代科技开发有限公司><1, 1, 0, 4>
[E:\Program Files\Ringz Studio\Storm Downloader\boost_thread-vc6-mt-1_31.dll] <N/A><N/A>
[F:\Program Files\CamSplitter\handler.dll] <N/A><N/A>
[E:\WINDOWS\system32\beetlelib.dll] <翱拓电脑工作室><3.3.1.157>
[PID: 2744][F:\Program Files\D-Tools\daemon.exe] <DAEMON'S HOME><3.47.0.0>
[E:\WINDOWS\daemon.dll] <N/A><3.47.0.0>
[F:\Program Files\D-Tools\PFCTOC.DLL] <Padus(R), Inc.><1, 0, 0, 12>
[F:\Program Files\D-Tools\Plugins\Images\ccdmount.dll] <GENERIC><1.02.0.0>
[F:\Program Files\D-Tools\Plugins\Images\mdsmount.dll] <GENERIC><1.01.0.0>
[F:\Program Files\D-Tools\Plugins\Images\pdimount.dll] <GENERIC><1.01.0.0>
[F:\Program Files\D-Tools\Plugins\Images\nrgmount.dll] <GENERIC><1.02.0.0>
[F:\Program Files\D-Tools\Plugins\Images\bw5mount.dll] <N/A><1.0.2.0>
[F:\Program Files\CamSplitter\handler.dll] <N/A><N/A>
[PID: 2752][E:\WINDOWS\VM_STI.EXE] <BIGDOG><4, 2, 610, 4>
[E:\WINDOWS\system32\msdmo.dll] <N/A><N/A>
[PID: 2768][E:\Program Files\Rising\Rav\RavTask.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
[E:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[E:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[E:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[E:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[F:\Program Files\CamSplitter\handler.dll] <N/A><N/A>
[PID: 2804][E:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.2.3790.0 (srv03_rtm.030324-2048)>
[F:\Program Files\CamSplitter\handler.dll] <N/A><N/A>
[PID: 2828][E:\Program Files\Rising\Rav\Ravmon.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 10>
[E:\Program Files\Rising\Rav\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23>
[E:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
[E:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[E:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[E:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[E:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[E:\Program Files\Rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[F:\Program Files\CamSplitter\handler.dll] <N/A><N/A>
[E:\WINDOWS\system32\beetlelib.dll] <翱拓电脑工作室><3.3.1.157>

csytiger - 2006-2-7 15:06:00

[PID: 2968][F:\Program Files\CamSplitter\camsplitter.exe] <SoftService><1, 5, 0, 0>
[F:\Program Files\CamSplitter\handler.dll] <N/A><N/A>
[PID: 8436][E:\WINDOWS\system32\conime.exe] <Microsoft Corporation><5.2.3790.0 (srv03_rtm.030324-2048)>
[F:\Program Files\CamSplitter\handler.dll] <N/A><N/A>
[PID: 9308][E:\WINDOWS\system32\mmc.exe] <Microsoft Corporation><5.2.3790.0 (srv03_rtm.030324-2048)>
[F:\Program Files\CamSplitter\handler.dll] <N/A><N/A>
[E:\WINDOWS\system32\tssoft32.acm] <DSP GROUP, INC.><1.01>
[E:\WINDOWS\system32\tsd32.dll] <N/A><N/A>
[PID: 11572][E:\Program Files\Beetle\BEETLE.exe] <翱拓电脑工作室><4.5.0.122>
[E:\WINDOWS\system32\beetlelib.dll] <翱拓电脑工作室><3.3.1.157>
[F:\Program Files\CamSplitter\handler.dll] <N/A><N/A>
[E:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13>
[E:\Program Files\Common Files\Microsoft Shared\MSINFO\InfoMz.Ime] <N/A><N/A>
[PID: 10440][E:\WINDOWS\explorer.exe] <Microsoft Corporation><6.00.3790.0 (srv03_rtm.030324-2048)>
[F:\Program Files\CamSplitter\handler.dll] <N/A><N/A>
[F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll] <Adobe Systems Incorporated><7.0.0.2004121400>
[E:\Program Files\Tencent\qq\qdshm.dll] <><1, 0, 1, 2>
[E:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[E:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13>
[E:\PROGRA~1\VISICO~1\ACEFTP~1\FTPCntxt.dll] <Visicom Media Inc.><2.0.0.0>
[E:\Program Files\Common Files\Microsoft Shared\MSINFO\InfoMz.Ime] <N/A><N/A>
[F:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll] <Adobe Systems, Inc.><7.0.0.0>
[E:\PROGRA~1\Kodak\DC215~1\Mounter\mntres.dll] <Eastman Kodak Company><1.0.02003>
[E:\PROGRA~1\COMMON~1\Kodak\dc215\dc215crc.dll] <N/A><N/A>
[E:\PROGRA~1\COMMON~1\Kodak\dc215\f210.dll] <Eastman Kodak Company><1, 0, 1300, 0>
[E:\WINDOWS\system32\xunleibho_v4.dll] <><4, 3, 2, 29>
[E:\WINDOWS\system32\beetlelib.dll] <翱拓电脑工作室><3.3.1.157>
[E:\Program Files\Xi\NetTransport 2\NTIEHelper.dll] <Xi><1.91.12>
[E:\PROGRA~1\COMMON~1\Kodak\dc215\Dc215ctl.dll] <Eastman Kodak Company><1.0.0000>
[E:\Program Files\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[E:\WINDOWS\system32\Macromed\Flash\Flash8.ocx] <Macromedia, Inc.><8,0,22,0>
[PID: 17524][E:\Program Files\ieup\ieup.exe] <CNNIC><1, 0, 0, 7>
[F:\Program Files\CamSplitter\handler.dll] <N/A><N/A>
[E:\WINDOWS\system32\beetlelib.dll] <翱拓电脑工作室><3.3.1.157>
[PID: 21756][E:\Program Files\rising\Rfw\rfwmain.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 45>
[E:\Program Files\rising\Rfw\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23>
[E:\Program Files\rising\Rfw\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[E:\Program Files\rising\Rfw\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[F:\Program Files\CamSplitter\handler.dll] <N/A><N/A>
[E:\WINDOWS\system32\beetlelib.dll] <翱拓电脑工作室><3.3.1.157>
[PID: 20904][E:\Program Files\Internet Explorer\IEXPLORE.EXE] <Microsoft Corporation><6.00.3790.0 (srv03_rtm.030324-2048)>
[F:\Program Files\CamSplitter\handler.dll] <N/A><N/A>
[E:\Program Files\ieup\ieupbar.dll] <中国互联网络中心（CNNIC）><1.0.0.6>
[E:\WINDOWS\system32\xunleibho_v4.dll] <><4, 3, 2, 29>
[F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll] <Adobe Systems Incorporated><7.0.0.2004121400>
[E:\WINDOWS\system32\beetlelib.dll] <翱拓电脑工作室><3.3.1.157>
[E:\Program Files\Xi\NetTransport 2\NTIEHelper.dll] <Xi><1.91.12>
[E:\Program Files\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[E:\WINDOWS\system32\Macromed\Flash\Flash8.ocx] <Macromedia, Inc.><8,0,22,0>
[PID: 45100][E:\WINDOWS\system32\taskmgr.exe] <Microsoft Corporation><5.2.3790.0 (srv03_rtm.030324-2048)>
[F:\Program Files\CamSplitter\handler.dll] <N/A><N/A>
[E:\WINDOWS\system32\beetlelib.dll] <翱拓电脑工作室><3.3.1.157>
[PID: 45468][E:\Program Files\WinRAR\WinRAR.exe] <N/A><N/A>
[F:\Program Files\CamSplitter\handler.dll] <N/A><N/A>
[E:\WINDOWS\system32\beetlelib.dll] <翱拓电脑工作室><3.3.1.157>
[E:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13>
[E:\Program Files\Common Files\Microsoft Shared\MSINFO\InfoMz.Ime] <N/A><N/A>
[PID: 45620][E:\DOCUME~1\ADMINI~1.INF\LOCALS~1\Temp\Rar$EX02.813\SREng.exe] <Smallfrogs Studio><2.0.12.350>
[F:\Program Files\CamSplitter\handler.dll] <N/A><N/A>
[E:\WINDOWS\system32\beetlelib.dll] <翱拓电脑工作室><3.3.1.157>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["E:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

魔法学徒 - 2006-2-7 15:19:00

修复
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<inetsvr><E:\Program Files\ieup\inetsvr.exe>
[HX massacre / HXmassacre]
<E:\WINDOWS\help\HXpass.exe><N/A>
[Network System / Universal Disk Manager]
<E:\Program Files\Common Files\SAND\Network.exe><N/A>

删除相关文件

csytiger - 2006-2-7 16:36:00

已按照斑竹的指引进行了处理,但问题仍未解决.
为了控制下载，我采用局域网代理上网，并设置了过滤．
我分析代理服务记录发现当系统未登录时，没有试图从SF.SF325.COM下载IEXPLORER.EXE文件的现象,只有登录以后才有.
请帮忙分析原因以求解决之道.

魔法学徒 - 2006-2-7 16:46:00

当系统未登录时指的是什么？进入WINDOWS？

csytiger - 2006-2-7 16:53:00

没登录是指刚启动系统,还没输用户名和密码的状态;或者注销当前用户以后的状态.

魔法学徒 - 2006-2-7 20:07:00

建议使用icesword监控一下进程

使用IceSword杀毒的一些基本操作
http://forum.ikaka.com/topic.asp?board=28&artid=7168178

csytiger - 2006-2-7 20:56:00

下载IceSword不成功啊，你们的网络Ｕ盘都列不出文件来．

csytiger - 2006-2-7 21:13:00

下载的文件有错误啊
! \\Server\Down\IceSword1[1].12.rar: IceSword1.12\Cooperator\SCANSTAR.exe CRC 失败。文件被破坏
! \\Server\Down\IceSword1[1].12.rar: 不可预料的压缩文件末端

csytiger - 2006-2-8 10:30:00

实在没办法解决，俺只有重做系统了。谢谢版主和各位。重装系统以后问题已经解决。

不言放弃 - 2006-2-8 11:09:00

禁用如下服务：
[HX massacre / HXmassacre]
<E:\WINDOWS\help\HXpass.exe><N/A>
[Network System / Universal Disk Manager]
<E:\Program Files\Common Files\SAND\Network.exe><N/A>

进入注册表
删除
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<advapi32><; RUNDLL32 E:\WINDOWS\Downlo~1\_IS_0518\_IS_ISC.DLL,isc>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<hzs><; c:\Program Files\meibu\watchhzs.exe>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<ISC><; >
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<ISC_UpDate><; >
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<MoveSearch><; E:\Program Files\wsearch\Search.exe>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<MyIMLite><; >
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<MyIMLite_UpDate><; >
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<NicChina><; [Program Files]\nicchina.exe>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<PigLocalSearch><; f:\Program Files\网络猪\PigStart.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<inetsvr><E:\Program Files\ieup\inetsvr.exe>

卸载
c:\Program Files\meibu
f:\Program Files\网络猪
E:\Program Files\ieup
E:\Program Files\wsearch
Program Files]\nicchina.exe

删除
c:\Program Files\meibu
f:\Program Files\网络猪
E:\Program Files\ieup
E:\Program Files\wsearch
Program Files\nicchina
E:\WINDOWS\help\HXpass.exe
E:\Program Files\Common Files\SAND
E:\WINDOWS\Downlo~1\_IS_0518\_IS_ISC.DLL
MyIMLite文件夹

找不到文件或无法删除请参考http://www.xfilt.com/tech/trojan-horse.htm

瑞星卡卡安全论坛