瑞星卡卡安全论坛

弹出的页面如下:

附件: 6307752006622213520.BMP

日志：
HijackThis_815汉化版扫描日志 V1.99.1
保存于      21:21:13, 日期 2006-06-22
操作系统：  Windows XP SP2 (WinNT 5.01.2600)
浏览器：    Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程：         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
c:\program files\rising\rfw\rfwsrv.exe
C:\Program Files\Rising\Rav\Ravmond.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Sogou PXP\p2psvr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\WINDOWS\Explorer.EXE
c:\program files\rising\rfw\RfwMain.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\ALCMTR.EXE
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Rising\Rav\Ravmon.exe
D:\program\iTunes\iTunesHelper.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Tencent\RTX\rtxc.exe
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Program Files\Microsoft Office\OFFICE11\POWERPNT.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\JJOL\IME\JJSvr.EXE
D:\tool & game\tool\注册表分析HijackThis1991zww.exe

R3 - URLSearchHook: (no name) - {982CB676-38F0-4D9A-BB72-D9371ABE876E} - (no file)
R3 - URLSearchHook: SgUrlSearHook Class - {BAB1AC41-6FF7-4F2E-A04E-5C592CCFEA7D} - C:\WINDOWS\system32\socul.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: SohuDAIEHelper - {0CA51D02-7739-43EA-8D9A-1E8AD4327B03} - C:\Program Files\P4P\sodaie.dll
O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - C:\PROGRA~1\baidu\bar\baidubar.dll
O2 - BHO: (no name) - {77FEF28E-EB96-44FF-B511-3185DEA48697}? - (no file)
O2 - BHO: (no name) - {AFF6E516-CBE5-4F8A-9C2F-38A68013E766}? - (no file)
O3 - IE工具栏增项: 百度超级搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\PROGRA~1\baidu\bar\baidubar.dll
O3 - IE工具栏增项: 捜狗直通车 - {DBBB7978-AF21-4EF4-9AD1-B2F4BC75696C} - C:\Program Files\P4P\ToolBar.dll
O3 - IE工具栏增项: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - 启动项HKLM\\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - 启动项HKLM\\Run: [SoundMan] SOUNDMAN.EXE
O4 - 启动项HKLM\\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - 启动项HKLM\\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - 启动项HKLM\\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - 启动项HKLM\\Run: [High Definition Audio 属性页快捷方式] HDAShCut.exe
O4 - 启动项HKLM\\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - 启动项HKLM\\Run: [ExFilter] Rundll32.exe "C:\PROGRA~1\CNNIC\Cdn\cdnspie.dll,ExecFilter solo"
O4 - 启动项HKLM\\Run: [AlcWzrd] ALCWZRD.EXE
O4 - 启动项HKLM\\Run: [Alcmtr] ALCMTR.EXE
O4 - 启动项HKLM\\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - 启动项HKLM\\Run: [iTunesHelper] "D:\program\iTunes\iTunesHelper.exe"
O4 - 启动项HKLM\\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - IE右键菜单中的新增项目: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\geturl.htm
O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\getAllurl.htm
O8 - IE右键菜单中的新增项目: 使用搜狗直通车下载 - C:\Program Files\P4P\dl.htm
O9 - 浏览器额外的按钮: 豪杰超级解霸V8 - {367E0A21-8601-4986-9C9A-153BF5ACA118}? - C:\Herosoft\HeroV8\STHSDVD.EXE
O9 - 浏览器额外的“工具”菜单项: 豪杰超级解霸V8 - {367E0A21-8601-4986-9C9A-153BF5ACA118}? - C:\Herosoft\HeroV8\STHSDVD.EXE
O9 - 浏览器额外的按钮: 我的订阅 - {8755CE6E-0BF7-4441-8751-FB728941B0B4} - C:\Program Files\P4P\rss.dll
O9 - 浏览器额外的按钮: 我的订阅 - {8755CE6E-0BF7-4441-8751-FB728941B0B4}? - C:\Program Files\P4P\rss.dll
O9 - 浏览器额外的按钮: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71}? - http://assistant.3721.com/security1.htm?fb=Cns (file missing)
O9 - 浏览器额外的“工具”菜单项: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71}? - http://assistant.3721.com/security1.htm?fb=Cns (file missing)
O9 - 浏览器额外的按钮: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5}? - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O9 - 浏览器额外的“工具”菜单项: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5}? - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} (Edit Class) - https://www.sz1.cmbchina.com/download/CMBEdit.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9C465E67-E37F-4288-A218-36B087F70A40}: NameServer = 202.106.0.20
O17 - HKLM\System\CCS\Services\Tcpip\..\{F97EDA42-1C72-4C5A-9BC0-776457B877E2}: NameServer = 202.96.209.5,202.158.161.1
O20 - AppInit_DLLs: C:\WINDOWS\system32\SoDAHK.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - NT 服务: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - NT 服务: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - NT 服务: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - NT 服务: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - NT 服务: P4P Service - Sohu.com Inc. - C:\Program Files\Common Files\Sogou PXP\p2psvr.exe
O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe

修复

R3 - URLSearchHook: (no name) - {982CB676-38F0-4D9A-BB72-D9371ABE876E} - (no file)
O2 - BHO: (no name) - {77FEF28E-EB96-44FF-B511-3185DEA48697}? - (no file)
O2 - BHO: (no name) - {AFF6E516-CBE5-4F8A-9C2F-38A68013E766}? - (no file)

http://www.crsky.com/soft/2924.html
下载超级兔子..用超级兔子清理王卸载流氓软件...

然后再扫个日志..
http://forum.ikaka.com/topic.asp?board=28&artid=6979213第4楼下载System Repair Engineer导出全部日志

引用:

【mopery的贴子】修复 R3 - URLSearchHook: (no name) - {982CB676-38F0-4D9A-BB72-D9371ABE876E} - (no file) O2 - BHO: (no name) - {77FEF28E-EB96-44FF-B511-3185DEA48697}? - (no file) O2 - BHO: (no name) - {AFF6E516-CBE5-4F8A-9C2F-38A68013E766}? - (no file) http://www.crsky.com/soft/2924.html 下载超级兔子..用超级兔子清理王卸载流氓软件... 然后再扫个日志.. http://forum.ikaka.com/topic.asp?board=28&artid=6979213第4楼下载System Repair Engineer导出全部日志 ...........................

已按照上面的做完了，附上全部日志
2006-06-23,10:28:58

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  []
    <run><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <NeroFilterCheck><C:\WINDOWS\system32\NeroCheck.exe>  [Ahead Software Gmbh]
    <SoundMan><SOUNDMAN.EXE>  [Realtek Semiconductor Corp.]
    <RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup>  [Beijing Rising Technology Co., Ltd.]
    <Power_Gear><C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1>  []
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [Microsoft Corporation]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [Microsoft Corporation]
    <MSPY2002><C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC>  []
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [Microsoft Corporation]
    <IgfxTray><C:\WINDOWS\system32\igfxtray.exe>  [Intel Corporation]
    <HotKeysCmds><C:\WINDOWS\system32\hkcmd.exe>  [Intel Corporation]
    <High Definition Audio 属性页快捷方式><HDAShCut.exe>  [Windows (R) Server 2003 DDK provider]
    <High Definition Audio 属性页><>  []
    <HControl><C:\WINDOWS\ATK0100\HControl.exe>  []
    <AlcWzrd><ALCWZRD.EXE>  [RealTek Semicoductor Corp.]
    <Alcmtr><ALCMTR.EXE>  [Realtek Semiconductor Corp.]
    <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
    <KernelFaultCheck><%systemroot%\system32\dumprep 0 -k>  []
    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
    <iTunesHelper><"D:\program\iTunes\iTunesHelper.exe">  [Apple Computer, Inc.]
    <DataLayer><C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe>  [Nokia Mobile Phones Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    <Super Rabbit Winspeed><"C:\Program Files\Super Rabbit\MagicSet\winspeed.exe" /autokill:48>  [Super Rabbit Soft]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><EXPLORER.EXE>  [Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [Microsoft Corporation]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <Skype><; "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <yassistse><; >  []

==================================
启动文件夹
服务
[InstallDriver Table Manager / IDriverT]
  <"C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe"><Macrovision Corporation>
[iPodService / iPodService]
  <C:\Program Files\iPod\bin\iPodService.exe><Apple Computer, Inc.>
[LexBce Server / LexBceS]
  <C:\WINDOWS\system32\LEXBCES.EXE><Lexmark International, Inc.>
[Macromedia Licensing Service / Macromedia Licensing Service]
  <"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><N/A>
[P4P Service / P4P Service]
  <2 - 系统找不到指定的文件。
><N/A>
[Rising Personal Firewall Service / RfwService]
  <c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter]
  <C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
  <"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[StdService / StdService]
  <2 - 系统找不到指定的文件。
><N/A>
[wint / wint]
  <C:\WINDOWS\system32\RunDLL32.exe "C:\WINDOWS\system32\wint\wint.dll",Run -r><N/A>

==================================
浏览器加载项
[BandIE Class]
  {77FEF28E-EB96-44FF-B511-3185DEA48697} <C:\PROGRA~1\baidu\bar\baidubar.dll, Baidu.com, Inc.>
[豪杰超级解霸V8]
  {367E0A21-8601-4986-9C9A-153BF5ACA118}? <C:\Herosoft\HeroV8\STHSDVD.EXE, herosoft>
[]
  {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71}? <http://assistant.3721.com/security1.htm?fb=Cns, N/A>
[]
  {FD00D911-7529-4084-9946-A29F1BDF4FE5}? <http://assistant.3721.com/clean1.htm?fb=Cns, N/A>
[百度超级搜霸]
  {B580CF65-E151-49C3-B73F-70B13FCA8E86} <C:\PROGRA~1\baidu\bar\baidubar.dll, Baidu.com, Inc.>
[Yahoo! Toolbar]
  {EF99BD32-C1FB-11D2-892F-0090271D4F88} <C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll, N/A>
[Edit Class]
  {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\WINDOWS\system32\CMBEdit.dll, >
[Shockwave ActiveX Control]
  {166B1BCA-3F9C-11CF-8075-444553540000} <C:\WINDOWS\system32\macromed\Shockwave 10\Download.dll, Macromedia, Inc.>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\Program Files\Chinagames\iGame\flash.ocx, Macromedia, Inc.>
[Yahoo! Toolbar Helper]
  {02478D38-C3F9-4EFB-9B51-7695ECA05670} <C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll, N/A>
[Windows Media Player]
  {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[Shell Name Space]
  {55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[BandIE Class]
  {77FEF28E-EB96-44FF-B511-3185DEA48697} <C:\PROGRA~1\baidu\bar\baidubar.dll, Baidu.com, Inc.>
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Microsoft Scriptlet Component]
  {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[百度超级搜霸]
  {B580CF65-E151-49C3-B73F-70B13FCA8E86} <C:\PROGRA~1\baidu\bar\baidubar.dll, Baidu.com, Inc.>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\Program Files\Chinagames\iGame\flash.ocx, Macromedia, Inc.>
[Yahoo! Toolbar]
  {EF99BD32-C1FB-11D2-892F-0090271D4F88} <C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll, N/A>
[&使用迅雷下载]
  <C:\Program Files\Thunder Network\Thunder\geturl.htm, N/A>
[&使用迅雷下载全部链接]
  <C:\Program Files\Thunder Network\Thunder\getAllurl.htm, N/A>

【续】
==================================
正在运行的进程
[PID: 580][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 864][\??\C:\WINDOWS\system32\csrss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 888][\??\C:\WINDOWS\system32\winlogon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\igfxsrvc.dll]  <Intel Corporation><3.0.0.4277>
    [C:\WINDOWS\system32\hccutils.DLL]  <Intel Corporation><3.0.0.4277>
[PID: 932][C:\WINDOWS\system32\services.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 944][C:\WINDOWS\system32\lsass.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1080][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1152][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1188][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1240][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1384][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1408][C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 1436][c:\program files\rising\rfw\rfwsrv.exe]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 23>
    [c:\program files\rising\rfw\RfwRule.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 10>
    [c:\program files\rising\rfw\rfwlog.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 6>
    [c:\program files\rising\rfw\Rfwdrv.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 19>
    [c:\program files\rising\rfw\MonDrv.dll]  <rs><1, 0, 0, 4>
    [c:\program files\rising\rfw\ProcLib.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 9>
[PID: 1560][C:\Program Files\Rising\Rav\Ravmond.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 1, 26>
    [C:\Program Files\Rising\Rav\BWList.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [C:\Program Files\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\RsLog.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20>
    [C:\Program Files\Rising\Rav\HOOKSYS.dll]  <Rising><18, 1, 0, 9>
    [C:\Program Files\Rising\Rav\Scanner.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30>
    [C:\Program Files\Rising\Rav\libload.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\VirusLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\regmon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
    [C:\Program Files\Rising\Rav\HookWeb.dll]  <rising><18, 0, 0, 1>
    [C:\Program Files\Rising\Rav\MemMon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
    [C:\Program Files\Rising\Rav\expscan.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\mPorts.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
    [C:\Program Files\Rising\Rav\MailMon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
    [C:\Program Files\Rising\Rav\SpamEng.dll]  <N/A><18, 0, 0, 6>
    [C:\Program Files\Rising\Rav\engine.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30>
    [C:\Program Files\Rising\Rav\UnExe.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\Rising\Rav\PostTrt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
    [C:\Program Files\Rising\Rav\ScanExec.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\Rising\Rav\ScanEx.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\Rising\Rav\NvFile.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
    [C:\Program Files\Rising\Rav\ScanMac.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 8>
    [C:\Program Files\Rising\Rav\ScanSct.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 15>
    [C:\Program Files\Rising\Rav\Unpacker.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
    [C:\Program Files\Rising\Rav\ExtOLE.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[PID: 1828][C:\WINDOWS\system32\LEXBCES.EXE]  <Lexmark International, Inc.><7.4>
    [C:\WINDOWS\system32\lexp2p32.dll]  <Lexmark International, Inc.><7.4>
    [C:\WINDOWS\system32\lex2kusb.dll]  <Lexmark International, Inc.><7.4>
[PID: 1864][C:\WINDOWS\system32\LEXPPS.EXE]  <Lexmark International, Inc.><7.4>
    [C:\WINDOWS\system32\LEXBCE.DLL]  <Lexmark International, Inc.><7.4>
[PID: 1872][C:\WINDOWS\system32\spoolsv.exe]  <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)>
    [C:\WINDOWS\system32\LEXLMPM.DLL]  <Lexmark International, Inc.><7.4>
    [C:\WINDOWS\system32\LexBce.dll]  <Lexmark International, Inc.><7.4>
    [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\LGBBPP5C.dll]  <Lexmark International><1.0.2.6>
    [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\WfxPrint2000.dll]  <BVRP Software><5.05 built by: WinDDK>
    [C:\WINDOWS\system32\LGBBpwr.dll]  <Lexmark International, Inc.><1, 0, 1, 0>
[PID: 168][C:\Program Files\Common Files\Sogou PXP\p2psvr.exe]  <N/A><N/A>
    [C:\Program Files\P4P\tbupdate.dll]  <N/A><N/A>
    [C:\Program Files\P4P\p4pipc.dll]  <N/A><N/A>
[PID: 256][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 300][C:\WINDOWS\system32\RunDLL32.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\SoDAHK.DLL]  <N/A><N/A>
    [C:\WINDOWS\system32\wint\wint.dll]  <N/A><N/A>
[PID: 444][C:\Program Files\Rising\Rav\RavStub.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>

【续】
[PID: 1972][C:\WINDOWS\System32\alg.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 2176][c:\program files\rising\rfw\RfwMain.exe]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 40>
    [c:\program files\rising\rfw\RsGuiLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23>
    [c:\program files\rising\rfw\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [c:\program files\rising\rfw\PngDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
    [C:\Program Files\Tencent\RTX\BQQHook.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\RTX\RTXOLAss.dll]  <ìú??????óD?T1???><1, 0, 0, 1>
    [C:\WINDOWS\system32\wint\wint.dll]  <N/A><N/A>
[PID: 2544][C:\WINDOWS\SOUNDMAN.EXE]  <Realtek Semiconductor Corp.><1, 0, 0, 14>
[PID: 3060][C:\WINDOWS\system32\igfxtray.exe]  <Intel Corporation><3.0.0.4277>
    [C:\WINDOWS\system32\hccutils.DLL]  <Intel Corporation><3.0.0.4277>
    [C:\WINDOWS\system32\igfxdev.dll]  <Intel Corporation><3.0.0.4277>
    [C:\WINDOWS\system32\igfxsrvc.dll]  <Intel Corporation><3.0.0.4277>
    [C:\WINDOWS\system32\igfxres.dll]  <Intel Corporation><3.0.0.4277>
    [C:\WINDOWS\system32\igfxress.dll]  <Intel Corporation><3.0.0.4277>
[PID: 3076][C:\WINDOWS\system32\hkcmd.exe]  <Intel Corporation><3.0.0.4277>
    [C:\WINDOWS\system32\hccutils.DLL]  <Intel Corporation><3.0.0.4277>
    [C:\WINDOWS\system32\igfxdev.dll]  <Intel Corporation><3.0.0.4277>
    [C:\WINDOWS\system32\igfxsrvc.dll]  <Intel Corporation><3.0.0.4277>
    [C:\WINDOWS\system32\igfxhk.dll]  <Intel Corporation><3.0.0.4277>
    [C:\WINDOWS\system32\igfxres.dll]  <Intel Corporation><3.0.0.4277>
[PID: 3152][C:\WINDOWS\ATK0100\HControl.exe]  <><1043, 2, 15, 48>
    [C:\WINDOWS\ATK0100\CMSSC.dll]  <N/A><N/A>
    [C:\WINDOWS\ATK0100\inter_f2.dll]  <ATK><1043, 2, 15, 46>
    [C:\WINDOWS\ATK0100\ATKWLIOC.DLL]  <ACTIONTEC Electronics,Inc><2.01.02>
    [C:\WINDOWS\ATK0100\SiSPkt.dll]  <Silicon Integrated Systems Corp.><1, 0, 0, 45>
[PID: 3292][C:\WINDOWS\ALCMTR.EXE]  <Realtek Semiconductor Corp.><1.6>
[PID: 3336][C:\Program Files\Rising\Rav\RavTask.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [C:\Program Files\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
[PID: 3392][C:\Program Files\Rising\Rav\Ravmon.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 1, 20>
    [C:\Program Files\Rising\Rav\RsGuiLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 24>
    [C:\Program Files\Rising\Rav\BWList.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [C:\Program Files\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\Program Files\Rising\Rav\PngDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
    [C:\WINDOWS\system32\wint\wint.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\RTX\BQQHook.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\RTX\RTXOLAss.dll]  <ìú??????óD?T1???><1, 0, 0, 1>
[PID: 3444][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  <RealNetworks, Inc.><0.1.0.3427>
[PID: 3476][C:\WINDOWS\ATK0100\ATKOSD.exe]  <><1043, 2, 15, 48>
[PID: 3496][D:\program\iTunes\iTunesHelper.exe]  <Apple Computer, Inc.><6.0.2.23>
    [D:\program\iTunes\iTunesHelper.Resources\zh_CN.lproj\iTunesHelperLocalized.DLL]  <Apple Computer, Inc.><6.0.2.11>
    [D:\program\iTunes\iTunesHelper.Resources\iTunesHelper.DLL]  <Apple Computer, Inc.><6.0.2.23>
[PID: 3624][C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe]  <Nokia Mobile Phones Ltd.><6, 50, 101, 3>
    [C:\Program Files\Common Files\PCSuite\DataLayer\Lang\DataLayer_chi-sc.nlr]  <Nokia><6, 50, 8, 0>
[PID: 3632][C:\WINDOWS\system32\ctfmon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 3672][C:\Program Files\iPod\bin\iPodService.exe]  <Apple Computer, Inc.><6.0.2.23>
    [C:\Program Files\iPod\bin\iPodService.Resources\zh_CN.lproj\iPodServiceLocalized.DLL]  <Apple Computer, Inc.><6.0.2.11>
    [C:\Program Files\iPod\bin\iPodService.Resources\iPodService.DLL]  <Apple Computer, Inc.><6.0.2.23>
[PID: 3996][C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE]  <Nokia.><6, 50, 28, 2>
    [C:\WINDOWS\system32\NclTools.dll]  <Nokia.><6, 50, 9, 1>
    [C:\Program Files\Common Files\PCSuite\Transports\NCLIrDAMM.dll]  <Nokia Corp.><6, 50, 13, 0>
    [C:\Program Files\Common Files\PCSuite\Transports\NclMSBTMM.dll]  <Nokia.><6, 50, 20, 0>
    [C:\Program Files\Common Files\PCSuite\Transports\NCLRSMM.dll]  <Nokia><6, 50, 21, 1>
    [C:\Program Files\Common Files\PCSuite\Transports\NCLUSBMM.dll]  <Nokia><6, 50, 23, 1>
[PID: 2584][C:\Program Files\Thunder Network\Thunder\Thunder.exe]  <深圳市迅雷网络技术有限公司><4, 7, 1, 48>
    [C:\Program Files\Thunder Network\Thunder\log4cplus.dll]  <N/A><N/A>
    [C:\Program Files\Thunder Network\Thunder\ICF.dll]  <N/A><N/A>
    [C:\Program Files\Thunder Network\Thunder\WebBrowserEx.dll]  <N/A><N/A>
    [C:\Program Files\Thunder Network\Thunder\boost_thread-vc6-mt-1_31.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\RavExt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
    [C:\WINDOWS\system32\wint\wint.dll]  <N/A><N/A>
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
    [C:\Program Files\Chinagames\iGame\flash.ocx]  <Macromedia, Inc.><7,0,19,0>
    [C:\Program Files\Tencent\RTX\BQQHook.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\RTX\RTXOLAss.dll]  <ìú??????óD?T1???><1, 0, 0, 1>
[PID: 3004][C:\Program Files\Thunder Network\Thunder\MediaIssue\Issue.exe]  <深圳市迅雷网络技术有限公司><2, 0, 3, 19>
    [C:\Program Files\Thunder Network\Thunder\MediaIssue\log4cplus.dll]  <N/A><N/A>
    [C:\Program Files\Thunder Network\Thunder\MediaIssue\WebBrowserEx.dll]  <深圳市三代科技开发有限公司><4, 1, 0, 23>
    [C:\Program Files\Thunder Network\Thunder\MediaIssue\boost_thread-vc6-mt-1_31.dll]  <N/A><N/A>

【续】
[PID: 3460][C:\Program Files\Tencent\RTX\rtxc.exe]  <Tencent><3,4,0,32>
    [C:\Program Files\Tencent\RTX\RTXDbug.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\RTX\Utility.dll]  <Tencent><3,4,0,32>
    [C:\Program Files\Tencent\RTX\UILib.dll]  <Tencent><3,4,0,32>
    [C:\Program Files\Tencent\RTX\Crypt.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\RTX\BqqZip.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\RTX\QQRes.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\RTX\Core.dll]  <Tencent><3,4,0,32>
    [C:\Program Files\Tencent\RTX\MPBase.dll]  <Tencent><3,4,0,32>
    [C:\Program Files\Tencent\RTX\RTXProxy.dll]  <Tencent><3,4,0,32>
    [C:\Program Files\Tencent\RTX\ProxySock.dll]  <Tencent><3,4,0,32>
    [C:\Program Files\Tencent\RTX\Psr.dll]  <Tencent><3,4,0,32>
    [C:\Program Files\Tencent\RTX\MsgRec.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\RTX\MsgDb.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\RTX\libdb42.dll]  <Sleepycat Software><4.2.52>
    [C:\Program Files\Tencent\RTX\BQQApi.dll]  <Tencent><3,4,0,32>
    [C:\Program Files\Tencent\RTX\Store.dll]  <Tencent><3,4,0,32>
    [C:\Program Files\Tencent\RTX\ClientAPI.dll]  <Tencent><3,4,0,32>
    [C:\Program Files\Tencent\RTX\RtxP2pMgr.dll]  <Tencent><3,4,0,31>
    [C:\Program Files\Tencent\RTX\P2pMgr.dll]  <Tencent><3,4,0,32>
    [C:\Program Files\Tencent\RTX\QQSkin.dll]  <Tencent><3,4,0,32>
    [C:\Program Files\Tencent\RTX\NewSkin.dll]  <Tencent><3,4,0,32>
    [C:\Program Files\Tencent\RTX\RTXOLAss.dll]  <ìú??????óD?T1???><1, 0, 0, 1>
    [C:\Program Files\Tencent\RTX\BQQHook.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\RTX\DeptHideSet.dll]  <Tencent><3,4,0,32>
    [C:\Program Files\Tencent\RTX\RTCBuddy.dll]  <Tencent><3,4,0,32>
    [C:\Program Files\Tencent\RTX\MiniRTXPrj.dll]  <Tencent><3,4,0,32>
    [C:\Program Files\Tencent\RTX\RTXInfoComm.dll]  <Tencent><3,4,0,32>
    [C:\Program Files\Tencent\RTX\Mail.dll]  <Tencent><3,4,0,32>
    [C:\Program Files\Tencent\RTX\DocWatcher.dll]  <Tencent><3,4,0,32>
    [C:\Program Files\Tencent\RTX\IM.dll]  <Tencent><3,4,0,32>
    [C:\Program Files\Tencent\RTX\RecentRecord.dll]  <Tencent><3,4,0,32>
    [C:\Program Files\Tencent\RTX\BQQAVPlugin.dll]  <Tencent><3,4,0,32>
    [C:\WINDOWS\system32\wint\wint.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\RTX\SendFile.dll]  <Tencent><3,4,0,15>
[PID: 3852][C:\WINDOWS\explorer.exe]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\Program Files\Tencent\RTX\BQQHook.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\RTX\RTXOLAss.dll]  <ìú??????óD?T1???><1, 0, 0, 1>
    [C:\WINDOWS\system32\wint\wint.dll]  <N/A><N/A>
    [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll]  <Adobe Systems, Inc.><7.0.0.0>
    [C:\WINDOWS\system32\igfxpph.dll]  <Intel Corporation><3.0.0.4277>
    [C:\WINDOWS\system32\hccutils.DLL]  <Intel Corporation><3.0.0.4277>
    [C:\WINDOWS\system32\igfxres.dll]  <Intel Corporation><3.0.0.4277>
    [C:\WINDOWS\system32\igfxsrvc.dll]  <Intel Corporation><3.0.0.4277>
    [C:\WINDOWS\system32\igfxdev.dll]  <Intel Corporation><3.0.0.4277>
    [C:\PROGRA~1\baidu\bar\baidubar.dll]  <Baidu.com, Inc.><2, 0, 2, 60>
[PID: 3984][C:\Program Files\WinRAR\WinRAR.exe]  <N/A><N/A>
    [C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll]  <Nokia><6, 50, 78, 2>
    [C:\Program Files\Nokia\Nokia PC Suite 6\PCSCM.dll]  <Nokia><6, 50, 36, 2>
    [C:\Program Files\Tencent\RTX\BQQHook.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\RTX\RTXOLAss.dll]  <ìú??????óD?T1???><1, 0, 0, 1>
    [C:\WINDOWS\system32\wint\wint.dll]  <N/A><N/A>
[PID: 2972][C:\DOCUME~1\Admin\LOCALS~1\Temp\Rar$EX01.579\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>
    [C:\Program Files\Tencent\RTX\BQQHook.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\RTX\RTXOLAss.dll]  <ìú??????óD?T1???><1, 0, 0, 1>
    [C:\WINDOWS\system32\wint\wint.dll]  <N/A><N/A>

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

在IE设置里把淘宝禁掉就可以了.