中了三种毒，怎么也杀不了，请帮助杀一下！ bbs.ikaka.com

xhsd2005 - 2006-5-13 16:09:00

Backdoor.Gpigeon.uvc、
Rootkit.Vanti.gen、
Trojan.RootKit.Vanti.bm

xhsd2005 - 2006-5-13 16:10:00

【回复“xhsd2005”的帖子】Logfile of HijackThis v1.99.1
Scan saved at 15:46:48, on 2006-5-13
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Rising\Rav\CCenter.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Rising\Rav\Ravmond.exe
D:\WINDOWS\system32\spoolsv.exe
F:\新建文件夹 (2)\BTNtService.exe
D:\PROGRA~1\MICROS~2\MSSQL\binn\sqlservr.exe
D:\WINDOWS\System32\igfxtray.exe
D:\Program Files\Rising\Rav\RavTask.exe
D:\Program Files\CNNIC\Cdn\cdnup.exe
D:\Program Files\Rising\Rav\Ravmon.exe
D:\WINDOWS\System32\ctfmon.exe
D:\WINDOWS\System32\conime.exe
D:\Program Files\Rising\Rav\RsAgent.exe
D:\WINDOWS\msagent\AgentSvr.exe
D:\WINDOWS\system32\slserv.exe
D:\WINDOWS\system32\ServerNT.exe
D:\WINDOWS\System32\AlertService.exe
D:\Program Files\Rising\Rav\RavStub.exe
D:\Program Files\Thunder Network\Thunder\Thunder.exe
D:\WINDOWS\explorer.exe
D:\Program Files\Rising\Rfw\rfwmain.exe
d:\program files\rising\rfw\rfwsrv.exe
D:\PROGRA~1\Yahoo!\ASSIST~1\ylive.exe
D:\Program Files\Rising\Rav\Rav.exe
D:\Program Files\Internet Explorer\iexplore.exe
C:\新建文件夹 (2)\HijackThis.exe

R3 - Default URLSearchHook is missing
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - D:\WINDOWS\System32\xunleibho_v14.dll
O2 - BHO: Yahoo!Photo - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - D:\PROGRA~1\Yahoo!\ASSIST~1\assist\yphtb.dll
O2 - BHO: AntiFish Class - {38928D50-8A48-44C2-945F-D2F23F771410} - D:\PROGRA~1\Yahoo!\ASSIST~1\assist\yangling.dll
O2 - BHO: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - D:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasbar.dll
O2 - BHO: CdnForIE Class - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - D:\PROGRA~1\CNNIC\Cdn\cdnforie.dll
O2 - BHO: DragSearch BHO - {62EED7C6-9F02-42f9-B634-98E2899E147B} - D:\PROGRA~1\Yahoo!\ASSIST~1\assist\YDRAGS~1.DLL
O2 - BHO: (no name) - {75FE2B5A-D3A4-4EFA-AC11-ADC9C9459688} - (no file)
O2 - BHO: (no name) - {CF2464EB-AE06-42A7-BFB7-A9B22344DE95} - D:\DOCUME~1\admin\APPLIC~1\GIGANO~1\IE_HEL~1.DLL
O2 - BHO: 好看123上网精灵 - {FEDF637B-F631-4583-A210-33CC828D42DB} - D:\PROGRA~1\SUPERR~1\MagicSet\HAOKAN~1.DLL
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - D:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasbar.dll
O3 - Toolbar: 好看123上网精灵 - {FEDF637B-F631-4583-A210-33CC828D42DB} - D:\PROGRA~1\SUPERR~1\MagicSet\HAOKAN~1.DLL
O3 - Toolbar: (no name) - {F869BB38-FFEF-4589-B986-610B7AD0ADA2} - (no file)
O4 - HKLM\..\Run: [IMJPMIG8.1] ; "D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] ; D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] ; D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMan] ; SOUNDMAN.EXE
O4 - HKLM\..\Run: [IgfxTray] D:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] ; D:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [TkBellExe] ; "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [RavTask] "D:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [WindowsUpdateNT] D:\WINDOWS\System\svwhost.exe /s
O4 - HKLM\..\Run: [YLive.exe] ; D:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
O4 - HKLM\..\Run: [yassistse] ; "D:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"
O4 - HKLM\..\Run: [CdnCtr] D:\Program Files\CNNIC\Cdn\cdnup.exe
O4 - HKLM\..\Run: [Thunder] "D:\Program Files\Thunder Network\Thunder\ThunderShell.exe" /s
O4 - HKLM\..\Run: [YOKAssiant] Rundll32.exe D:\PROGRA~1\YOK.com\SUPERS~1\YOK_SuperSearch.dll,YOKAssiant
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] ; "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &使用迅雷下载 - D:\Program Files\Thunder Network\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - D:\Program Files\Thunder Network\Thunder\getallurl.htm
O9 - Extra button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail (file missing)
O9 - Extra button: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao (file missing)
O9 - Extra button: 中文上网 - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - D:\PROGRA~1\CNNIC\Cdn\cdnforie.dll
O9 - Extra 'Tools' menuitem: 中文上网 - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - D:\PROGRA~1\CNNIC\Cdn\cdnforie.dll
O9 - Extra button: 雅虎助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist (file missing)
O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg (file missing)
O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - Extra 'Tools' menuitem: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O9 - Extra 'Tools' menuitem: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O10 - Unknown file in Winsock LSP: d:\windows\system32\cdnns.dll
O11 - Options group: [CDNCLIENT] 中文上网
O17 - HKLM\System\CCS\Services\Tcpip\..\{FB5B4FB4-825D-4F56-8C79-029904C8DA21}: NameServer = 202.99.160.68
O20 - Winlogon Notify: igfxcui - D:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - D:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - F:\新建文件夹 (2)\BTNtService.exe
O23 - Service: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - d:\program files\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - d:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\Program Files\Rising\Rav\Ravmond.exe
O23 - Service: SmartLinkService (SLService) - - D:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Sysm32 Event Notification - Unknown owner - D:\WINDOWS\Systen32.exe
O23 - Service: 用友U8预警调度服务 (UFALERTSERVICE) - Unknown owner - D:\WINDOWS\System32\AlertService.exe
O23 - Service: U8管理软件 (UFNet) - Unknown owner - D:\WINDOWS\system32\ServerNT.exe

阿杜QQ - 2006-5-13 16:12:00

http://blog.sina.com.cn/u/1034488164
，请下载使用 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描,完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），
把保存的报告日志文件内容复制-

大家帮你分析一下

轩辕小聪 - 2006-5-13 16:14:00

O23 - Service: Sysm32 Event Notification - Unknown owner - D:\WINDOWS\Systen32.exe
应该是灰鸽子，参考http://forum.ikaka.com/topic.asp?board=28&artid=7713905
另外两个，说清楚病毒文件名称与具体路径，http://forum.ikaka.com/topic.asp?board=28&artid=6979213第5楼下载System Repair Engineer 2.0.12.350导出全部日志。

xhsd2005 - 2006-5-13 16:23:00

【回复“轩辕小聪”的帖子】病毒名称扫描方式路径文件
Backdoor.Gpigeon.uvc手动扫描IEXPLORE.EXE>>D:\Program Files\Internet Explorer\IEXPLORE.EXE
Trojan.RootKit.Vanti.bm手动扫描D:\WINDOWS\system327ex0gw0l.sys
Trojan.RootKit.Vanti.bm手动扫描D:\WINDOWS\system321lcse5.sys
Trojan.RootKit.Vanti.bm手动扫描D:\WINDOWS\system32r0u.sys
Trojan.RootKit.Vanti.bm手动扫描D:\WINDOWS\system32mu0.sys
Trojan.RootKit.Vanti.bm手动扫描D:\WINDOWS\system32803.sys
Rootkit.Vanti.gen手动扫描D:\WINDOWS\Tempqf7j5k.dll
Trojan.RootKit.Vanti.bm手动扫描D:\System Volume Information\_restore{8563C79B-91AB-4894-8684-5ECFD5618AF1}\RP117A0046909.SYS
Trojan.RootKit.Vanti.bm手动扫描D:\System Volume Information\_restore{8563C79B-91AB-4894-8684-5ECFD5618AF1}\RP117A0046931.sys
Trojan.RootKit.Vanti.bm手动扫描D:\System Volume Information\_restore{8563C79B-91AB-4894-8684-5ECFD5618AF1}\RP117A0046932.sys
Trojan.RootKit.Vanti.bm手动扫描D:\System Volume Information\_restore{8563C79B-91AB-4894-8684-5ECFD5618AF1}\RP117A0046933.sys
Trojan.RootKit.Vanti.bm手动扫描D:\System Volume Information\_restore{8563C79B-91AB-4894-8684-5ECFD5618AF1}\RP117A0046934.sys
006-05-13,16:19:05

xhsd2005 - 2006-5-13 16:25:00

【回复“轩辕小聪”的帖子】对不起文件太大
006-05-13,16:19:05

System Repair Engineer 2.0.12.350 (2.0 RC 1)
Windows XP Professional Service Pack 1 - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><D:\WINDOWS\System32\ctfmon.exe>
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<MSMSGS><; "D:\Program Files\Messenger\msmsgs.exe" /background>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><; "D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<PHIME2002ASync><; D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<PHIME2002A><; D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<SoundMan><; SOUNDMAN.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IgfxTray><D:\WINDOWS\System32\igfxtray.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<HotKeysCmds><; D:\WINDOWS\System32\hkcmd.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<KernelFaultCheck><%systemroot%\system32\dumprep 0 -k>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<TkBellExe><; "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<RavTask><"D:\Program Files\Rising\Rav\RavTask.exe" -system>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<WindowsUpdateNT><D:\WINDOWS\System\svwhost.exe /s>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<YLive.exe><; D:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<yassistse><; "D:\PROGRA~1\Yahoo!\Assistant\yassistse.exe">
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<CdnCtr><D:\Program Files\CNNIC\Cdn\cdnup.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Thunder><"D:\Program Files\Thunder Network\Thunder\ThunderShell.exe" /s>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<YOKAssiant><Rundll32.exe D:\PROGRA~1\YOK.com\SUPERS~1\YOK_SuperSearch.dll,YOKAssiant>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<Userinit><D:\WINDOWS\System32\Userinit.exe,>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><>

xhsd2005 - 2006-5-13 16:28:00

【回复“轩辕小聪”的帖子】接上
启动文件夹
[Microsoft Office]
<D:\Documents and Settings\All Users\「开始」菜单\程序\启动\Microsoft Office.lnk><H>

==================================
服务
[pcAnywhere Host Service / awhost32]
<D:\Program Files\Symantec\pcAnywhere\awhost32.exe><Symantec Corporation>
[BlueSoleil Hid Service / BlueSoleil Hid Service]
<F:\新建文件夹 (2)\BTNtService.exe><N/A>
[Internet Protect Service / NHLscA]
<D:\WINDOWS\SYSTEM32\RUNDLL32.EXE D:\WINDOWS\SYSTEM32\WBEM\IRJIT.DLL,Export 1087><N/A>
[Rising Proxy Service / RfwProxySrv]
<d:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService]
<d:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter]
<"D:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
<"D:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[SmartLinkService / SLService]
<slserv.exe>< >
[Sysm32 Event Notification / Sysm32 Event Notification]
<D:\WINDOWS\Systen32.exe><N/A>
[用友U8预警调度服务 / UFALERTSERVICE]
<D:\WINDOWS\System32\AlertService.exe><N/A>
[U8管理软件 / UFNet]
<D:\WINDOWS\system32\ServerNT.exe><N/A>

==================================
浏览器加载项
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <D:\WINDOWS\System32\xunleibho_v14.dll, Thunder Networking Technologies,LTD>
[Yahoo!Photo]
{33BBE430-0E42-4f12-B075-8D21ACB10DCB} <D:\PROGRA~1\Yahoo!\ASSIST~1\assist\yphtb.dll, Yahoo! China>
[AntiFish Class]
{38928D50-8A48-44C2-945F-D2F23F771410} <D:\PROGRA~1\Yahoo!\ASSIST~1\assist\yangling.dll, Yahoo.>
[雅虎助手]
{406F94F0-504F-4a40-8DFD-58B0666ABEBD} <D:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasbar.dll, Yahoo!>
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <D:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[DragSearch BHO]
{62EED7C6-9F02-42f9-B634-98E2899E147B} <D:\PROGRA~1\Yahoo!\ASSIST~1\assist\YDRAGS~1.DLL, >
[]
{CF2464EB-AE06-42A7-BFB7-A9B22344DE95} <D:\DOCUME~1\admin\APPLIC~1\GIGANO~1\IE_HEL~1.DLL, N/A>
[好看123上网精灵]
{FEDF637B-F631-4583-A210-33CC828D42DB} <D:\PROGRA~1\SUPERR~1\MagicSet\HAOKAN~1.DLL, 超级兔子>
[Yahoo 1G电邮]
{507F9113-CD77-4866-BA92-0E86DA3D0B97} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail, N/A>
[寻宝乐趣多]
{59BC54A2-56B3-44a0-93E5-432D58746E26} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao, N/A>
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <D:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[雅虎助手]
{5D73EE86-05F1-49ed-B850-E423120EC338} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist, N/A>
[情景聊天]
{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg, N/A>
[]
{ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair, N/A>
[]
{FD00D911-7529-4084-9946-A29F1BDF4FE5} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean, N/A>
[电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <D:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[雅虎助手]
{406F94F0-504F-4a40-8DFD-58B0666ABEBD} <D:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasbar.dll, Yahoo!>
[好看123上网精灵]
{FEDF637B-F631-4583-A210-33CC828D42DB} <D:\PROGRA~1\SUPERR~1\MagicSet\HAOKAN~1.DLL, 超级兔子>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <D:\WINDOWS\System32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[&使用迅雷下载]
<D:\Program Files\Thunder Network\Thunder\geturl.htm, N/A>
[&使用迅雷下载全部链接]
<D:\Program Files\Thunder Network\Thunder\getallurl.htm, N/A>

==================================
正在运行的进程
[PID: 516][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 572][\??\D:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[D:\WINDOWS\TEMP\qf7j5k.dll] <N/A><N/A>
[PID: 596][\??\D:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 640][D:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 652][D:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 836][D:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[D:\WINDOWS\System32\cdnns.dll] <CNNIC><2, 0, 0, 0>
[PID: 884][D:\Program Files\Rising\Rav\CCenter.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 900][D:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1008][D:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1036][D:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1052][D:\Program Files\Rising\Rav\Ravmond.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 19>
[D:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
[D:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[D:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[D:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[D:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[D:\Program Files\Rising\Rav\RsLog.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 18>
[D:\Program Files\Rising\Rav\HOOKSYS.dll] <Rising><18, 1, 0, 9>
[D:\Program Files\Rising\Rav\Scanner.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 28>
[D:\Program Files\Rising\Rav\libload.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[D:\Program Files\Rising\Rav\VirusLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[D:\Program Files\Rising\Rav\regmon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[D:\Program Files\Rising\Rav\engine.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 26>
[D:\Program Files\Rising\Rav\UnExe.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[D:\Program Files\Rising\Rav\ScanExec.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[D:\Program Files\Rising\Rav\ScanEx.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
[D:\Program Files\Rising\Rav\PostTrt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
[D:\Program Files\Rising\Rav\NvFile.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
[D:\Program Files\Rising\Rav\ScanMac.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
[D:\Program Files\Rising\Rav\ScanSct.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13>
[D:\Program Files\Rising\Rav\Unpacker.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[D:\Program Files\Rising\Rav\RsStore.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[D:\Program Files\Rising\Rav\HookWeb.dll] <rising><18, 0, 0, 1>
[D:\Program Files\Rising\Rav\MemMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 8>
[D:\Program Files\Rising\Rav\expscan.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[D:\Program Files\Rising\Rav\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
[D:\WINDOWS\TEMP\qf7j5k.dll] <N/A><N/A>
[D:\Program Files\Rising\Rav\MailMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[D:\Program Files\Rising\Rav\SpamEng.dll] <N/A><18, 0, 0, 6>
[D:\Program Files\Rising\Rav\ExtOLE.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 1308][D:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.0 (XPClient.010817-1148)>
[D:\WINDOWS\system32\awmon.dll] <Symantec Corporation><9.2>
[D:\WINDOWS\System32\cdnns.dll] <CNNIC><2, 0, 0, 0>
[PID: 1580][D:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 1596][F:\新建文件夹 (2)\BTNtService.exe] <N/A><N/A>
[PID: 1740][D:\PROGRA~1\MICROS~2\MSSQL\binn\sqlservr.exe] <Microsoft Corporation><2000.080.0194.00>
[D:\WINDOWS\System32\cdnns.dll] <CNNIC><2, 0, 0, 0>
[PID: 1908][D:\WINDOWS\System32\igfxtray.exe] <Intel Corporation><3.0.0.2285>
[D:\WINDOWS\System32\hccutils.DLL] <Intel Corporation><3.0.0.2285>
[D:\WINDOWS\System32\igfxdev.dll] <Intel Corporation><3.0.0.2285>
[D:\WINDOWS\System32\igfxsrvc.dll] <Intel Corporation><3.0.0.2285>
[D:\WINDOWS\System32\igfxres.dll] <Intel Corporation><3.0.0.2285>
[D:\WINDOWS\System32\igfxress.dll] <Intel Corporation><3.0.0.2285>
[D:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 0, 1013>
[D:\Program Files\CNNIC\Cdn\cdnspie.dll] <><2, 1, 0, 4>
[D:\Program Files\CNNIC\Cdn\imaoe.dll] <CNNIC><2, 2, 0, 1>
[D:\Program Files\CNNIC\Cdn\cdnforie.dll] <CNNIC><1, 0, 0, 9>
[D:\Program Files\CNNIC\Cdn\cdndet.dll] <CNNIC><2, 2, 0, 3>
[PID: 1916][D:\Program Files\Rising\Rav\RavTask.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
[D:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[D:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[D:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[D:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[D:\WINDOWS\TEMP\qf7j5k.dll] <N/A><N/A>

xhsd2005 - 2006-5-13 16:29:00

【回复“轩辕小聪”的帖子】接上
[[D:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 0, 1013>
[D:\Program Files\CNNIC\Cdn\cdnspie.dll] <><2, 1, 0, 4>
[D:\Program Files\CNNIC\Cdn\imaoe.dll] <CNNIC><2, 2, 0, 1>
[D:\Program Files\CNNIC\Cdn\cdnforie.dll] <CNNIC><1, 0, 0, 9>
[D:\Program Files\CNNIC\Cdn\cdndet.dll] <CNNIC><2, 2, 0, 3>
[PID: 1928][D:\Program Files\CNNIC\Cdn\cdnup.exe] <><2, 3, 0, 7>
[D:\Program Files\CNNIC\Cdn\cdndet.dll] <CNNIC><2, 2, 0, 3>
[D:\Program Files\CNNIC\Cdn\cdnforie.dll] <CNNIC><1, 0, 0, 9>
[D:\Program Files\CNNIC\Cdn\imaoe.dll] <CNNIC><2, 2, 0, 1>
[D:\Program Files\CNNIC\Cdn\cdnspie.dll] <><2, 1, 0, 4>
[D:\Program Files\CNNIC\Cdn\cdntdns.dll] <CNNIC><2, 2, 0, 3>
[D:\WINDOWS\System32\cdnns.dll] <CNNIC><2, 0, 0, 0>
[PID: 1956][D:\Program Files\Rising\Rav\Ravmon.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 17>
[D:\Program Files\Rising\Rav\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 24>
[D:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
[D:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[D:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[D:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[D:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[D:\Program Files\Rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[D:\Program Files\CNNIC\Cdn\cdnspie.dll] <><2, 1, 0, 4>
[D:\Program Files\CNNIC\Cdn\imaoe.dll] <CNNIC><2, 2, 0, 1>
[D:\Program Files\CNNIC\Cdn\cdnforie.dll] <CNNIC><1, 0, 0, 9>
[D:\Program Files\CNNIC\Cdn\cdndet.dll] <CNNIC><2, 2, 0, 3>
[D:\WINDOWS\TEMP\qf7j5k.dll] <N/A><N/A>
[D:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 0, 1013>
[PID: 1964][D:\WINDOWS\System32\ctfmon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[D:\Program Files\CNNIC\Cdn\cdnspie.dll] <><2, 1, 0, 4>
[D:\Program Files\CNNIC\Cdn\imaoe.dll] <CNNIC><2, 2, 0, 1>
[D:\Program Files\CNNIC\Cdn\cdnforie.dll] <CNNIC><1, 0, 0, 9>
[D:\Program Files\CNNIC\Cdn\cdndet.dll] <CNNIC><2, 2, 0, 3>
[PID: 192][D:\WINDOWS\System32\conime.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[D:\Program Files\CNNIC\Cdn\cdnspie.dll] <><2, 1, 0, 4>
[D:\Program Files\CNNIC\Cdn\imaoe.dll] <CNNIC><2, 2, 0, 1>
[D:\Program Files\CNNIC\Cdn\cdnforie.dll] <CNNIC><1, 0, 0, 9>
[D:\Program Files\CNNIC\Cdn\cdndet.dll] <CNNIC><2, 2, 0, 3>
[D:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 0, 1013>
[PID: 444][D:\Program Files\Rising\Rav\RsAgent.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
[D:\Program Files\CNNIC\Cdn\cdnspie.dll] <><2, 1, 0, 4>
[D:\Program Files\CNNIC\Cdn\imaoe.dll] <CNNIC><2, 2, 0, 1>
[D:\Program Files\CNNIC\Cdn\cdnforie.dll] <CNNIC><1, 0, 0, 9>
[D:\Program Files\CNNIC\Cdn\cdndet.dll] <CNNIC><2, 2, 0, 3>
[D:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[D:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 0, 1013>
[PID: 464][D:\WINDOWS\msagent\AgentSvr.exe] <Microsoft Corporation><2.00.0.3422>
[D:\Program Files\CNNIC\Cdn\cdnspie.dll] <><2, 1, 0, 4>
[D:\Program Files\CNNIC\Cdn\imaoe.dll] <CNNIC><2, 2, 0, 1>
[D:\Program Files\CNNIC\Cdn\cdnforie.dll] <CNNIC><1, 0, 0, 9>
[D:\Program Files\CNNIC\Cdn\cdndet.dll] <CNNIC><2, 2, 0, 3>
[D:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 0, 1013>
[PID: 708][D:\WINDOWS\system32\slserv.exe] < ><2.80.00(24Apr2000)>
[PID: 968][D:\WINDOWS\system32\ServerNT.exe] <N/A><N/A>
[D:\WINDOWS\system32\UMiscell.dll] <><1, 0, 0, 1>
[D:\WINDOWS\system32\sgv.dll] <><8, 2, 0, 0>
[D:\WINDOWS\system\Sense3.dll] <N/A><N/A>
[D:\WINDOWS\system32\SecuComm.dll] <N/A><N/A>
[PID: 1424][D:\WINDOWS\System32\AlertService.exe] <N/A><N/A>
[D:\WINDOWS\System32\AlertDispatcher.dll] <><1, 0, 0, 1>
[PID: 2148][D:\Program Files\Rising\Rav\RavStub.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13>
[D:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[D:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 2292][D:\WINDOWS\explorer.exe] <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
[D:\Program Files\CNNIC\Cdn\cdnspie.dll] <><2, 1, 0, 4>
[D:\Program Files\CNNIC\Cdn\imaoe.dll] <CNNIC><2, 2, 0, 1>
[D:\Program Files\CNNIC\Cdn\cdnforie.dll] <CNNIC><1, 0, 0, 9>
[D:\Program Files\CNNIC\Cdn\cdndet.dll] <CNNIC><2, 2, 0, 3>
[D:\WINDOWS\System32\hccutils.DLL] <Intel Corporation><3.0.0.2285>
[D:\WINDOWS\System32\igfxres.dll] <Intel Corporation><3.0.0.2285>
[D:\WINDOWS\System32\igfxsrvc.dll] <Intel Corporation><3.0.0.2285>
[D:\WINDOWS\System32\igfxdev.dll] <Intel Corporation><3.0.0.2285>
[D:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 0, 1013>
[D:\PROGRA~1\Yahoo!\ASSIST~1\YAlive.dll] <><2, 1, 1, 1039>
[D:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll] < ><2, 0, 1, 1007>
[D:\WINDOWS\System32\xunleibho_v14.dll] <Thunder Networking Technologies,LTD><4, 6, 0, 62>
[D:\PROGRA~1\Yahoo!\ASSIST~1\assist\yphtb.dll] <Yahoo! China><1, 1, 2, 1034>
[D:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasbar.dll] <Yahoo!><2, 1, 7, 1047>
[D:\PROGRA~1\Yahoo!\ASSIST~1\assist\YDRAGS~1.DLL] <><1, 2, 7, 1006>
[D:\DOCUME~1\admin\APPLIC~1\GIGANO~1\IE_HEL~1.DLL] <N/A><N/A>
[D:\Program Files\WinRAR\rarext.dll] <N/A><N/A>

xhsd2005 - 2006-5-13 16:33:00

【回复“轩辕小聪”的帖子】 [D:\PROGRA~1\Yahoo!\ASSIST~1\assist\ywiper.dll] <N/A><1, 0, 1, 1014>
[D:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13>
[D:\PROGRA~1\sanlink\TRAS\contmenu.dll] <N/A><N/A>
[PID: 2816][D:\Program Files\Rising\Rfw\rfwmain.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 48>
[D:\Program Files\Rising\Rfw\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23>
[D:\Program Files\Rising\Rfw\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[D:\Program Files\Rising\Rfw\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[D:\Program Files\CNNIC\Cdn\cdnspie.dll] <><2, 1, 0, 4>
[D:\Program Files\CNNIC\Cdn\imaoe.dll] <CNNIC><2, 2, 0, 1>
[D:\Program Files\CNNIC\Cdn\cdnforie.dll] <CNNIC><1, 0, 0, 9>
[D:\Program Files\CNNIC\Cdn\cdndet.dll] <CNNIC><2, 2, 0, 3>
[D:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 0, 1013>
[PID: 2848][d:\program files\rising\rfw\rfwsrv.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 30>
[d:\program files\rising\rfw\RfwRule.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 12>
[d:\program files\rising\rfw\rfwlog.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 6>
[d:\program files\rising\rfw\Rfwdrv.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 21>
[d:\program files\rising\rfw\MonDrv.dll] <rs><1, 0, 0, 4>
[d:\program files\rising\rfw\ProcLib.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 9>
[PID: 3264][D:\PROGRA~1\Yahoo!\ASSIST~1\ylive.exe] < ><2, 0, 0, 1002>
[D:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 0, 1013>
[D:\Program Files\CNNIC\Cdn\cdnspie.dll] <><2, 1, 0, 4>
[D:\Program Files\CNNIC\Cdn\imaoe.dll] <CNNIC><2, 2, 0, 1>
[D:\Program Files\CNNIC\Cdn\cdnforie.dll] <CNNIC><1, 0, 0, 9>
[D:\Program Files\CNNIC\Cdn\cdndet.dll] <CNNIC><2, 2, 0, 3>
[D:\PROGRA~1\Yahoo!\ASSIST~1\YAlive.dll] <><2, 1, 1, 1039>
[D:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll] < ><2, 0, 1, 1007>
[D:\PROGRA~1\Yahoo!\ASSIST~1\ynotifier.dll] <><1, 0, 0, 5>
[D:\WINDOWS\System32\cdnns.dll] <CNNIC><2, 0, 0, 0>
[PID: 1232][D:\Program Files\Rising\Rav\Rav.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 61>
[D:\Program Files\Rising\Rav\PlugIn\RsPgScan.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 17>
[D:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[D:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[D:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[D:\Program Files\Rising\Rav\RavUI.Dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 57>
[D:\Program Files\Rising\Rav\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 24>
[D:\Program Files\Rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[D:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 0, 1013>
[D:\Program Files\CNNIC\Cdn\cdnspie.dll] <><2, 1, 0, 4>
[D:\Program Files\CNNIC\Cdn\imaoe.dll] <CNNIC><2, 2, 0, 1>
[D:\Program Files\CNNIC\Cdn\cdnforie.dll] <CNNIC><1, 0, 0, 9>
[D:\Program Files\CNNIC\Cdn\cdndet.dll] <CNNIC><2, 2, 0, 3>
[D:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[D:\Program Files\Rising\Rav\Scanner.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 28>
[D:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
[D:\Program Files\Rising\Rav\RavUIMsg.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23>
[D:\WINDOWS\System32\cdnns.dll] <CNNIC><2, 0, 0, 0>
[D:\Program Files\Rising\Rav\RavQu.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13>
[PID: 3504][D:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
[D:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 0, 1013>
[D:\PROGRA~1\Yahoo!\ASSIST~1\yscrblock.dll] <Yahoo><1, 0, 1, 1000>
[D:\Program Files\CNNIC\Cdn\cdnspie.dll] <><2, 1, 0, 4>
[D:\Program Files\CNNIC\Cdn\imaoe.dll] <CNNIC><2, 2, 0, 1>
[D:\Program Files\CNNIC\Cdn\cdnforie.dll] <CNNIC><1, 0, 0, 9>
[D:\Program Files\CNNIC\Cdn\cdndet.dll] <CNNIC><2, 2, 0, 3>
[D:\PROGRA~1\Yahoo!\ASSIST~1\YAlive.dll] <><2, 1, 1, 1039>
[D:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll] < ><2, 0, 1, 1007>
[D:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasbar.dll] <Yahoo!><2, 1, 7, 1047>
[D:\PROGRA~1\Yahoo!\ASSIST~1\assist\yphtb.dll] <Yahoo! China><1, 1, 2, 1034>
[D:\PROGRA~1\Yahoo!\ASSIST~1\assist\yaswiper.dll] <Yahoo><1, 0, 1, 1004>
[D:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasiesec.dll] <Yahoo><1, 0, 2, 1003>
[D:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasnoad.dll] <><1, 1, 2, 1004>
[D:\PROGRA~1\Yahoo!\ASSIST~1\assist\yzsNetProto.dll] <Yahoo><1, 0, 0, 1>
[D:\PROGRA~1\Yahoo!\ASSIST~1\assist\yrss.dll] <Yahoo! China><1, 0, 1, 1015>
[D:\WINDOWS\System32\xunleibho_v14.dll] <Thunder Networking Technologies,LTD><4, 6, 0, 62>
[D:\PROGRA~1\Yahoo!\ASSIST~1\assist\yangling.dll] <Yahoo.><1, 0, 2, 1002>
[D:\PROGRA~1\Yahoo!\ASSIST~1\assist\YDRAGS~1.DLL] <><1, 2, 7, 1006>
[D:\DOCUME~1\admin\APPLIC~1\GIGANO~1\IE_HEL~1.DLL] <N/A><N/A>
[D:\PROGRA~1\SUPERR~1\MagicSet\HAOKAN~1.DLL] <超级兔子><1.0.7.7>

xhsd2005 - 2006-5-13 16:33:00

【回复“轩辕小聪”的帖子】 [D:\WINDOWS\System32\cdnns.dll] <CNNIC><2, 0, 0, 0>
[D:\WINDOWS\System32\Macromed\Flash\Flash8.ocx] <Macromedia, Inc.><8,0,22,0>
[D:\PROGRA~1\Yahoo!\ASSIST~1\assist\yrepair.dll] <Yahoo><1, 0, 6, 1319>
[D:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasfsks.dll] <3721.com><2, 1, 1, 87>
[D:\PROGRA~1\Yahoo!\ASSIST~1\assist\yoptimum.dll] <Yahoo><1, 0, 1, 1001>
[d:\progra~1\yahoo!\assist~1\assist\yadfil~1.dll] < ><1, 0, 2, 1001>
[D:\WINDOWS\System32\PYJJ4.IME] <加加在线><4.0.0.7>
[PID: 1800][D:\Program Files\Rising\Rav\RsLogVw.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 17>
[D:\Program Files\Rising\Rav\RsCommx.dll] <rising><18, 0, 0, 1>
[D:\Program Files\Rising\Rav\rsguilib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 24>
[D:\Program Files\Rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[D:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[D:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 0, 1013>
[D:\Program Files\CNNIC\Cdn\cdnspie.dll] <><2, 1, 0, 4>
[D:\Program Files\CNNIC\Cdn\imaoe.dll] <CNNIC><2, 2, 0, 1>
[D:\Program Files\CNNIC\Cdn\cdnforie.dll] <CNNIC><1, 0, 0, 9>
[D:\Program Files\CNNIC\Cdn\cdndet.dll] <CNNIC><2, 2, 0, 3>
[D:\Program Files\Rising\Rav\libload.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[D:\Program Files\Rising\Rav\VirusLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[PID: 3976][D:\Program Files\Thunder Network\Thunder\Thunder.exe] <Thunder Networking Technologies,LTD><5.1.5.189>
[D:\Program Files\Thunder Network\Thunder\UpdateDownload.dll] <Thunder Networking Technologies,LTD><1, 0, 0, 2>
[D:\Program Files\Thunder Network\Thunder\download_interface.dll] <Thunder Networking Technologies,LTD><1, 0, 2, 74>
[D:\Program Files\Thunder Network\Thunder\log4cplus.dll] <><1, 0, 2, 1>
[D:\Program Files\Thunder Network\Thunder\stlport_vc646.dll] <STLport Consulting, Inc.><4.6.2003.1031>
[D:\Program Files\Thunder Network\Thunder\msgmanage.dll] <Thunder Networking Technologies,LTD><1, 0, 0, 15>
[D:\Program Files\Thunder Network\Thunder\historyinfo_manage.dll] <Thunder Networking Technologies,LTD><5, 2, 0, 148>
[D:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 0, 1013>
[D:\Program Files\CNNIC\Cdn\cdnspie.dll] <><2, 1, 0, 4>
[D:\Program Files\CNNIC\Cdn\imaoe.dll] <CNNIC><2, 2, 0, 1>
[D:\Program Files\CNNIC\Cdn\cdnforie.dll] <CNNIC><1, 0, 0, 9>
[D:\Program Files\CNNIC\Cdn\cdndet.dll] <CNNIC><2, 2, 0, 3>
[D:\Program Files\Thunder Network\Thunder\iEmbed.dll] <Thunder Networking Technologies,LTD><1, 1, 0, 22>
[D:\Program Files\Thunder Network\Thunder\RegisterDll.dll] <Thunder Networking Technologies,LTD><1, 2, 0, 7>
[D:\Program Files\Thunder Network\Thunder\FloatBar.dll] <Thunder Networking Technologies,LTD><1, 0, 0, 2>
[D:\WINDOWS\System32\cdnns.dll] <CNNIC><2, 0, 0, 0>
[D:\Program Files\Thunder Network\Thunder\Plugins\TingTing\TingTing.dll] <Thunder Networking Technologies,LTD><1, 1, 0, 8>
[D:\Program Files\Thunder Network\Thunder\iTargetAd.dll] <Thunder Networking Technologies,LTD><1, 0, 0, 59>
[D:\WINDOWS\System32\Macromed\Flash\Flash8.ocx] <Macromedia, Inc.><8,0,22,0>
[PID: 3324][C:\新建文件夹 (2)\sreng2\SREng.exe] <Smallfrogs Studio><2.0.12.350>
[D:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 0, 1013>
[D:\Program Files\CNNIC\Cdn\cdnspie.dll] <><2, 1, 0, 4>
[D:\Program Files\CNNIC\Cdn\imaoe.dll] <CNNIC><2, 2, 0, 1>
[D:\Program Files\CNNIC\Cdn\cdnforie.dll] <CNNIC><1, 0, 0, 9>
[D:\Program Files\CNNIC\Cdn\cdndet.dll] <CNNIC><2, 2, 0, 3>
[D:\WINDOWS\System32\cdnns.dll] <CNNIC><2, 0, 0, 0>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["D:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

轩辕小聪 - 2006-5-13 16:45:00

典型的Rootkit，插入系统核心进程。
处理方法建议：

关闭系统还原
用SSM（具体如何操作参考http://forum.ikaka.com/topic.asp?board=28&artid=8010460）添加规则禁止以下文件加载，并将SSM设为开机自动加载：
D:\WINDOWS\TEMP\qf7j5k.dll
D:\WINDOWS\system327ex0gw0l.sys
D:\WINDOWS\system321lcse5.sys
D:\WINDOWS\system32r0u.sys
D:\WINDOWS\system32mu0.sys
D:\WINDOWS\system32803.sys

用SREng在“启动项目”-“服务”中禁用以下项目：
[Sysm32 Event Notification / Sysm32 Event Notification]
<D:\WINDOWS\Systen32.exe><N/A>

在注册表中展开：
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
删除Sysm32 Event Notification项目

重启后删除：
D:\WINDOWS\TEMP\qf7j5k.dll
D:\WINDOWS\system327ex0gw0l.sys（如果还有的话）
D:\WINDOWS\system321lcse5.sys（如果还有的话）
D:\WINDOWS\system32r0u.sys（如果还有的话）
D:\WINDOWS\system32mu0.sys（如果还有的话）
D:\WINDOWS\system32803.sys（如果还有的话）
D:\WINDOWS\Systen32.exe
D:\WINDOWS\Systen32.dll（如果还有的话）
D:\WINDOWS\Systen32Key.dll（如果还有的话）
D:\WINDOWS\Systen32_hook.dll（如果还有的话）

若文件找不到或无法删除文件
打开我的电脑
在工具栏中点击－－工具－－文件夹选项－－查看
勾选“显示所有文件及文件夹”
同时把“隐藏受保护的操作系统文件（推荐）”前的勾去掉
然后再进行查找一下

sys文件如果仍无法删除：
建议重启控住F8，选择进入“带命令行的安全模式”，输入：
attrib D:\WINDOWS\system327ex0gw0l.sys -s -h -r
del D:\WINDOWS\system327ex0gw0l.sys
其他sys文件类似。

xhsd2005 - 2006-5-13 16:49:00

【回复“轩辕小聪”的帖子】对不起，请问怎样进入打开注册表编辑器，展开：HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

阿杜QQ - 2006-5-13 16:52:00

打开开始，找到运行，输入regedit

xhsd2005 - 2006-5-13 17:00:00

【回复“阿杜QQ”的帖子】对不起我不怎么会，已展开HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services需要删除什么文件

阿杜QQ - 2006-5-13 17:03:00

【回复“xhsd2005”的帖子】删除Sysm32 Event Notification项目

夜申人净 - 2006-5-13 17:43:00

最简单——但损失最大的方法——重装系统……

xhsd2005 - 2006-5-13 17:50:00

【回复“轩辕小聪”的帖子】原贴：用SSM添加规则禁止以下文件加载是什么意思

xhsd2005 - 2006-5-13 17:53:00

【回复“轩辕小聪”的帖子】原贴：用SSM添加规则禁止以下文件加载是什么意思

轩辕小聪 - 2006-5-13 17:55:00

【回复“xhsd2005”的帖子】
参考http://forum.ikaka.com/topic.asp?board=28&artid=8010460，如何添加规则里面说得很详细了，具体的自己摸索一下就会了。

雪山铁骑 - 2006-5-13 18:31:00

楼主的问题解决了吗？

xhsd2005 - 2006-5-13 18:33:00

【回复“雪山铁骑”的帖子】兄弟是新手，正在解决，谢

xhsd2005 - 2006-5-13 18:37:00

【回复“轩辕小聪”的帖子】兄弟是新手，我已经打开了ＳＳＭ可在规则下怎么也添加不了禁止规则

轩辕小聪 - 2006-5-13 19:14:00

引用:

【xhsd2005的贴子】【回复“轩辕小聪”的帖子】兄弟是新手，我已经打开了ＳＳＭ可在规则下怎么也添加不了禁止规则
...........................

不明白……是添加不了规则，还是只有阻止的规则添加不了？右击规则面板应该就可以添加规则。楼主仔细参考一下帮助文件应该可以解决的。

xhsd2005 - 2006-5-13 19:15:00

【回复“轩辕小聪”的帖子】兄弟是新手，我已经打开了ＳＳＭ可在规则菜单下怎么也添加不了禁止规则

xhsd2005 - 2006-5-13 19:39:00

【回复“轩辕小聪”的帖子】是不是把您列的D:\WINDOWS\TEMP\qf7j5k.dll
D:\WINDOWS\system327ex0gw0l.sys
D:\WINDOWS\system321lcse5.sys
D:\WINDOWS\system32r0u.sys
D:\WINDOWS\system32mu0.sys
D:\WINDOWS\system32803.sys
这几项添加到里面，不让加栽

轩辕小聪 - 2006-5-13 19:42:00

引用:

【xhsd2005的贴子】【回复“轩辕小聪”的帖子】是不是把您列的D:\WINDOWS\TEMP\qf7j5k.dll
D:\WINDOWS\system327ex0gw0l.sys
D:\WINDOWS\system321lcse5.sys
D:\WINDOWS\system32r0u.sys
D:\WINDOWS\system32mu0.sys
D:\WINDOWS\system32803.sys
这几项添加到里面，不让加栽
...........................

是。也就是对以上每个程序都分别设置规则阻止其加载。

xhsd2005 - 2006-5-13 19:59:00

【回复“轩辕小聪”的帖子】不好意思还得麻烦：用SREng在“启动项目”-“服务”中禁用以下项目：
[Sysm32 Event Notification / Sysm32 Event Notification]已完成
但找不找<D:\WINDOWS\Systen32.exe><N/A>

轩辕小聪 - 2006-5-13 20:01:00

晕倒……
<D:\WINDOWS\Systen32.exe><N/A>是指[Sysm32 Event Notification / Sysm32 Event Notification]所指向的具体文件，也就是说就是这个项而已。

菜鸟飞飞219 - 2006-5-13 20:08:00

复杂

xhsd2005 - 2006-5-13 20:10:00

【回复“轩辕小聪”的帖子】哈哈！见笑了。在注册表中展开：
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
删除Sysm32 Event Notification项目
我找到了，是把右边的项目删去，放项目的文件夹删吗？

瑞星卡卡安全论坛