瑞星卡卡安全论坛

今天中一个个名为：Trojan.DL.Agent.jmd  的木马

现在我的诺顿也被它弄得升不了级
请问大虾门有对付这种木马的专杀工具吗？

路径..

C:\WINDOWS  下的一个应用程序

说清楚点..

http://forum.ikaka.com/topic.asp?board=28&artid=8105899
下载HijackThis...把日志帖上来..

ijackThis_815汉化版扫描日志 V1.99.1
保存于      17:15:25, 日期 2006-7-14
操作系统：  Windows XP  (WinNT 5.01.2600)
浏览器：    Internet Explorer v6.00 SP1 (6.00.2600.0000)

当前运行的进程：         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
C:\HEROSOFT\Hero3000\SYSEXPLR.EXE
C:\WINDOWS\System32\NILaunch.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\KINGSOFT\PowerWord 2005\XDICT.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe
C:\Program Files\3721\ske\TrojanAssistant.exe
C:\Program Files\VnetClient1.6\VnetClient.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\JJOL\IME\JJSvr.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\David Yau\桌面\新建文件夹\HijackThis1991zww.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yphtb.dll
O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yangling.dll
O2 - BHO: VnetCookie Class - {4E83D567-4697-4F7B-B1F0-A513B01DB89A} - c:\PROGRA~1\VNETCL~1.6\VNETTR~1.DLL
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\assist\YDRAGS~1.DLL
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: AssistHelper - {FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8} - C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yassist.dll
O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - IE工具栏增项: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - IE工具栏增项: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - IE工具栏增项: 雅虎助手 - {406F94F0-504F-4A40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\Assistant\Assist\yasbar.dll
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - 启动项HKLM\\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - 启动项HKLM\\Run: [SysExplr] C:\HEROSOFT\Hero3000\SYSEXPLR.EXE
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - 启动项HKLM\\Run: [nwiz] nwiz.exe /install
O4 - 启动项HKLM\\Run: [Net-It Launcher] C:\WINDOWS\System32\NILaunch.exe
O4 - 启动项HKLM\\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - 启动项HKLM\\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - 启动项HKLM\\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - 启动项HKLM\\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - 启动项HKLM\\Run: [YLive.exe] C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
O4 - 启动项HKLM\\Run: [yassistse] "C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - Startup: 金山词霸 2005.lnk = C:\Program Files\KINGSOFT\PowerWord 2005\XDICT.EXE
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AutoCAD 启动加速器.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
O8 - IE右键菜单中的新增项目: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - E:\游戏程序\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - E:\游戏程序\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 添加到雅虎订阅(&Y) - res://C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yrss.dll/YRSSMENUEXT
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - E:\游戏程序\QQ\SendMMS.htm
O8 - IE右键菜单中的新增项目: 解霸实时播放 - C:\HEROSOFT\Hero3000\MPURLGET.HTM
O8 - IE右键菜单中的新增项目: 雅虎搜索 - res://C:\PROGRA~1\Yahoo!\Assistant\Assist\yasbar.dll/203
O9 - 浏览器额外的按钮: 解霸 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - C:\HEROSOFT\Hero3000\MPLAYER.EXE
O9 - 浏览器额外的“工具”菜单项: 超级解霸 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - C:\HEROSOFT\Hero3000\MPLAYER.EXE
O9 - 浏览器额外的按钮: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - E:\游戏程序\QQ\QQ.EXE (file missing)
O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - E:\游戏程序\QQ\QQ.EXE (file missing)
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/pcver2006new/OL2006.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{41AF65A3-488C-4660-A846-3CC56C6556EA}: NameServer = 202.96.128.86 202.96.134.133
O23 - NT 服务: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - NT 服务: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - NT 服务: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - NT 服务: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - NT 服务: Norton AntiVirus 自动防护服务 (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - NT 服务: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - NT 服务: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - NT 服务: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - NT 服务: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - NT 服务: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - NT 服务: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - NT 服务: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - NT 服务: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - NT 服务: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZONELABS\vsmon.exe

好长哦！~
我晕死！~

O4 - 启动项HKLM\\Run: [Net-It Launcher] C:\WINDOWS\System32\NILaunch.exe

SRENG的长度是这个的好几倍啊

http://www.pctutu.com/srmsdown.asp
下载超级兔子..用超级兔子清理王卸载流氓软件...(安全模式...)

路径还是没说清楚..

要不要我导上来？我有那个软件

Autoruns 的日志一天也看不了几篇.....

2006-07-14,17:04:18

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Home Edition  (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe>  [Microsoft Corporation]
    <MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background>  [Microsoft Corporation]
    <NvMediaCenter><RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit>  [NVIDIA Corporation]
    <PcSync><C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog>  [Time Information Services Ltd.]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32>  [Microsoft Corporation]
    <PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [Microsoft Corporation]
    <PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [Microsoft Corporation]
    <WinFast Schedule><C:\Program Files\WinFast\WFTVFM\WFWIZ.exe>  [Leadtek Research Inc.]
    <IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload>  [Microsoft Corporation]
    <SysExplr><C:\HEROSOFT\Hero3000\SYSEXPLR.EXE>  []
    <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup>  [NVIDIA Corporation]
    <nwiz><nwiz.exe /install>  [NVIDIA Corporation]
    <Net-It Launcher><C:\WINDOWS\System32\NILaunch.exe>  []
    <DataLayer><C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe>  [Nokia Mobile Phones Ltd.]
    <PCSuiteTrayApplication><C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray>  [Nokia]
    <ccApp><"C:\Program Files\Common Files\Symantec Shared\ccApp.exe">  [Symantec Corporation]
    <SSC_UserPrompt><C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe>  [Symantec Corporation]
    <YLive.exe><C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe>  [Yahoo! China]
    <yassistse><"C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe">  [Yahoo! China]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx]
    <Flag><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [Microsoft Corporation]

==================================
启动文件夹
[Acrobat Assistant]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Acrobat Assistant.lnk><N>
[Adobe Gamma Loader]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Gamma Loader.lnk><N>
[AutoCAD 启动加速器]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\AutoCAD 启动加速器.lnk><N>
[ZoneAlarm]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\ZoneAlarm.lnk><N>
[金山词霸 2005]
  <C:\Documents and Settings\David Yau\「开始」菜单\程序\启动\金山词霸 2005.lnk><N>

==================================
服务
[Adobe LM Service / Adobe LM Service]
  <"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><N/A>
[Autodesk Licensing Service / Autodesk Licensing Service]
  <"C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe"><Autodesk, Inc.>
[Symantec Event Manager / ccEvtMgr]
  <"C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"><Symantec Corporation>
[Symantec Settings Manager / ccSetMgr]
  <"C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"><Symantec Corporation>
[IMAPI CD-Burning COM Service / ImapiService]
  <C:\WINDOWS\System32\imapi.exe><Microsoft Corporation>
[Norton AntiVirus 自动防护服务 / navapsvc]
  <"C:\Program Files\Norton AntiVirus\navapsvc.exe"><Symantec Corporation>
[Norton AntiVirus Firewall Monitor Service / NPFMntor]
  <"C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe"><Symantec Corporation>
[Norton Protection Center Service / NSCService]
  <"C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE"><Symantec Corporation>
[NVIDIA Driver Helper Service / NVSvc]
  <C:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation>
[Symantec AVScan / SAVScan]
  <"C:\Program Files\Norton AntiVirus\SAVScan.exe"><Symantec Corporation>
[Symantec Network Drivers Service / SNDSrvc]
  <"C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe"><Symantec Corporation>
[SoundMAX Agent Service / SoundMAX Agent Service (default)]
  <C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.>
[SPBBCSvc / SPBBCSvc]
  <"C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe"><Symantec Corporation>
[Symantec Core LC / Symantec Core LC]
  <"C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe"><Symantec Corporation>
[TrueVector Internet Monitor / vsmon]
  <C:\WINDOWS\system32\ZONELABS\vsmon.exe -service><Zone Labs Inc.>

浏览器加载项
[AcroIEHlprObj Class]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[Yahoo!Photo]
  {33BBE430-0E42-4f12-B075-8D21ACB10DCB} <C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yphtb.dll, Yahoo! China>
[AntiFish Class]
  {38928D50-8A48-44C2-945F-D2F23F771410} <C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yangling.dll, yahoo! china>
[VnetCookie Class]
  {4E83D567-4697-4F7B-B1F0-A513B01DB89A} <c:\PROGRA~1\VNETCL~1.6\VNETTR~1.DLL, >
[DragSearch BHO]
  {62EED7C6-9F02-42f9-B634-98E2899E147B} <C:\PROGRA~1\Yahoo!\ASSIST~1\assist\YDRAGS~1.DLL, yahoo! china>
[CNavExtBho Class]
  {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} <C:\Program Files\Norton AntiVirus\NavShExt.dll, Symantec Corporation>
[AcroIEToolbarHelper Class]
  {AE7CD045-E861-484f-8273-0445EE161910} <C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll, N/A>
[assist]
  {FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8} <C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yassist.dll, Yahoo! China>
[解霸]
  {367E0A21-8601-4986-9C9A-153BF5ACA118} <C:\HEROSOFT\Hero3000\MPLAYER.EXE, N/A>
[信息检索(&R)]
  {92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <E:\游戏程序\QQ\QQ.EXE, N/A>
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[Adobe PDF]
  {47833539-D0C5-4125-9FA8-0819E2EAAC93} <C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll, N/A>
[Norton AntiVirus]
  {C4069E3A-68F1-403E-B40E-20066696354B} <C:\Program Files\Norton AntiVirus\NavShExt.dll, Symantec Corporation>
[雅虎助手]
  {406F94F0-504F-4A40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\Assistant\Assist\yasbar.dll, yahoo! china>
[Rising Web Scan Object]
  {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.>
[导出到 Microsoft Office Excel(&X)]
  <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
  <E:\游戏程序\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <E:\游戏程序\QQ\AddEmotion.htm, N/A>
[添加到雅虎订阅(&Y)]
  <res://C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yrss.dll/YRSSMENUEXT, N/A>
[用QQ彩信发送该图片]
  <E:\游戏程序\QQ\SendMMS.htm, N/A>
[解霸实时播放]
  <C:\HEROSOFT\Hero3000\MPURLGET.HTM, N/A>
[雅虎搜索]
  <res://C:\PROGRA~1\Yahoo!\Assistant\Assist\yasbar.dll/203, N/A>

正在运行的进程
[PID: 532][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 596][\??\C:\WINDOWS\system32\csrss.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 620][\??\C:\WINDOWS\system32\winlogon.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
    [C:\WINDOWS\system32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
[PID: 664][C:\WINDOWS\system32\services.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 676][C:\WINDOWS\system32\lsass.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
    [C:\WINDOWS\system32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
[PID: 860][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
    [C:\WINDOWS\system32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
[PID: 960][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
    [C:\WINDOWS\System32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
[PID: 1128][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
    [C:\WINDOWS\System32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
[PID: 1144][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
    [C:\WINDOWS\System32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
[PID: 1208][C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe]  <Symantec Corporation><104.0.7.3>
    [C:\Program Files\Common Files\Symantec Shared\ccL40.dll]  <Symantec Corporation><104.0.7.3>
    [C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll]  <Symantec Corporation><104.0.7.3>
    [C:\Program Files\Common Files\Symantec Shared\ccSetEvt.dll]  <Symantec Corporation><104.0.7.3>
[PID: 1280][C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe]  <Symantec Corporation><104.0.7.3>
    [C:\Program Files\Common Files\Symantec Shared\ccL40.dll]  <Symantec Corporation><104.0.7.3>
    [C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll]  <Symantec Corporation><104.0.7.3>
    [C:\Program Files\Common Files\Symantec Shared\ccSet.dll]  <Symantec Corporation><104.0.7.3>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\SPBBC\SPBBCEVT.DLL]  <Symantec Corporation><2.1.0.4>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\CCLOGIN.DLL]  <Symantec Corporation><104.0.7.3>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\CCSETEVT.DLL]  <Symantec Corporation><104.0.7.3>
    [C:\PROGRA~1\NORTON~2\HPPEVT32.DLL]  <Symantec Corporation><12.2.0.13>
    [C:\PROGRA~1\NORTON~2\HPPRES32.loc]  <Symantec Corporation><12.2.0.13>
    [C:\PROGRA~1\NORTON~2\NAVEVENT.DLL]  <Symantec Corporation><12.2.0.13>
    [C:\WINDOWS\SYSTEM32\SYMNETI.DLL]  <Symantec Corporation><6.0.3.303>
[PID: 1364][C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe]  <Symantec Corporation><6.0.3.303>
    [C:\WINDOWS\system32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
    [C:\WINDOWS\System32\SymNeti.dll]  <Symantec Corporation><6.0.3.303>
[PID: 1384][C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe]  <Symantec Corporation><2.1.0.4>
    [C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll]  <Symantec Corporation><104.0.7.3>
    [C:\Program Files\Common Files\Symantec Shared\ccL40.dll]  <Symantec Corporation><104.0.7.3>
    [C:\Program Files\Common Files\Symantec Shared\ccSet.dll]  <Symantec Corporation><104.0.7.3>
    [C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCEvt.dll]  <Symantec Corporation><2.1.0.4>
    [C:\Program Files\Common Files\Symantec Shared\SPBBC\bbRGen.dll]  <Symantec Corporation><2.1.0.4>
[PID: 1440][C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe]  <Symantec Corporation><1.9.1.762>
    [C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcnet.dll]  <Symantec Corporation><1.9.1.762>
[PID: 1556][C:\WINDOWS\system32\spoolsv.exe]  <Microsoft Corporation><5.1.2600.0 (XPClient.010817-1148)>
    [C:\WINDOWS\system32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
    [C:\WINDOWS\System32\AdobePDF.dll]  <Adobe Systems Incorporated.><6.0.000>
    [C:\Program Files\Adobe\Acrobat 6.0\Distillr\AdistRes.CHT]  <N/A><N/A>
    [C:\WINDOWS\system32\APFMON40.DLL]  <TurboPower Software Company><4.05.0.0>
    [C:\WINDOWS\system32\apfaxcnv.dll]  <TurboPower Software Company><4.05.0.0>
    [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\jDocPrc.dll]  <N/A><N/A>
[PID: 1756][C:\WINDOWS\Explorer.EXE]  <Microsoft Corporation><6.00.2600.0000 (xpclient.010817-1148)>
    [C:\WINDOWS\System32\AcSignIcon.dll]  <Autodesk><16.1.63.0>
    [C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll]  <Autodesk><16.1.63.0>
    [C:\WINDOWS\System32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~1\NSCEXT.DLL]  <Symantec Corporation><2006.1.5.17>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~1\NSCEXT.LOC]  <Symantec Corporation><2006.1.5.17>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  <Yahoo! China><3, 0, 1, 1019>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\YAlive.dll]  <yahoo! china><3, 1, 9, 1057>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll]  <Yahoo! China><3, 0, 1, 1010>
    [C:\Program Files\WinRAR\rarext.dll]  <N/A><N/A>
    [C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll]  <Nokia><6, 60, 4, 7>
    [C:\WINDOWS\System32\ConnAPI.DLL]  <Nokia.><6, 60, 21, 1>
    [C:\Program Files\Nokia\Nokia PC Suite 6\PCSCM.dll]  <Nokia><6, 60, 45, 3>
    [C:\Program Files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_chi-sc.nlr]  <Nokia><6, 60, 5, 0>
    [C:\Program Files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr]  <Nokia><6, 60, 1, 0>
    [C:\WINDOWS\System32\JJN.IME]  <加加在线><3.11.0.0>
    [C:\Program Files\Norton AntiVirus\NavShExt.dll]  <Symantec Corporation><12.2.0.13>
    [C:\PROGRA~1\3721\ske\contmenu.dll]  <N/A><N/A>
    [C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll]  <Adobe Systems Incorporated><6.0.0.2003051500>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yphtb.dll]  <Yahoo! China><3, 0, 0, 1000>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\assist\YDRAGS~1.DLL]  <yahoo! china><3, 0, 0, 1000>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yassist.dll]  <Yahoo! China><3, 0, 7, 1012>
[PID: 1872][C:\Program Files\WinFast\WFTVFM\WFWIZ.exe]  <Leadtek Research Inc.><5.13.01.2003-1.43>
    [C:\WINDOWS\System32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
    [C:\WINDOWS\System32\msdmo.dll]  <N/A><N/A>
[PID: 1888][C:\HEROSOFT\Hero3000\SYSEXPLR.EXE]  <N/A><N/A>
    [C:\HEROSOFT\Hero3000\AVCDROM.dll]  <N/A><N/A>
    [C:\HEROSOFT\Hero3000\CoolMenu.dll]  <N/A><N/A>
    [C:\HEROSOFT\Hero3000\Sys936.DLL]  <N/A><N/A>
[PID: 1912][C:\WINDOWS\System32\NILaunch.exe]  <N/A><N/A>

[PID: 1920][C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe]  <Nokia Mobile Phones Ltd.><6, 60, 109, 2>
    [C:\Program Files\Common Files\PCSuite\DataLayer\Lang\DataLayer_chi-sc.nlr]  <Nokia><6, 60, 8, 0>
[PID: 1936][C:\Program Files\Common Files\Symantec Shared\ccApp.exe]  <Symantec Corporation><104.0.7.3>
    [C:\Program Files\Common Files\Symantec Shared\ccL40.dll]  <Symantec Corporation><104.0.7.3>
    [C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll]  <Symantec Corporation><104.0.7.3>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\CCALERT.DLL]  <Symantec Corporation><104.0.7.3>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\CCEMLPXY.DLL]  <Symantec Corporation><104.0.7.3>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~1\NSCTRAY.DLL]  <Symantec Corporation><2006.1.5.17>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~1\NSCTRAY.LOC]  <Symantec Corporation><2006.1.5.17>
    [C:\PROGRA~1\NORTON~2\CCIMSCAN.DLL]  <Symantec Corporation><104.0.5.3>
    [C:\PROGRA~1\NORTON~2\DEFALERT.DLL]  <Symantec Corporation><12.2.0.13>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\rcEmlPxy.dll]  <Symantec Corporation><104.0.7.3>
    [C:\Program Files\Common Files\Symantec Shared\ccSet.dll]  <Symantec Corporation><104.0.7.3>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~1\NSCUICOR.dll]  <Symantec Corporation><2006.1.5.17>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~1\NSCUICOR.LOC]  <Symantec Corporation><2006.1.5.17>
    [C:\PROGRA~1\NORTON~2\HPP32.DLL]  <Symantec Corporation><12.2.0.13>
    [C:\Program Files\Common Files\Symantec Shared\ccSetEvt.dll]  <Symantec Corporation><104.0.7.3>
    [C:\Program Files\Common Files\Symantec Shared\ccProSub.dll]  <Symantec Corporation><104.0.7.3>
    [C:\PROGRA~1\NORTON~2\HPPRES32.loc]  <Symantec Corporation><12.2.0.13>
    [C:\WINDOWS\System32\SYMREDIR.DLL]  <Symantec Corporation><6.0.3.303>
    [C:\Program Files\Common Files\Symantec Shared\Security Console\NSC_Hlpr.dll]  <Symantec Corporation><2006.1.5.17>
    [C:\PROGRA~1\NORTON~2\IWP\IWP.DLL]  <Symantec Corporation><12.2.0.13>
    [C:\PROGRA~1\NORTON~2\NAVAPW32.DLL]  <Symantec Corporation><12.2.0.13>
    [C:\PROGRA~1\NORTON~2\apwutil.dll]  <Symantec Corporation><12.2.0.13>
    [C:\PROGRA~1\NORTON~2\navapw32.loc]  <Symantec Corporation><12.2.0.13>
    [C:\PROGRA~1\NORTON~2\NAVOPTRF.DLL]  <Symantec Corporation><12.0.0.94>
    [C:\PROGRA~1\NORTON~2\STATUSHP.DLL]  <Symantec Corporation><12.2.0.13>
    [C:\Program Files\Norton AntiVirus\ccAVMail.dll]  <Symantec Corporation><104.0.5.3>
    [C:\Program Files\Norton AntiVirus\HPPEVT32.dll]  <Symantec Corporation><12.2.0.13>
    [C:\Program Files\Norton AntiVirus\Navlcom.dll]  <Symantec Corporation><12.2.0.13>
    [C:\Program Files\Norton AntiVirus\NAVError.dll]  <Symantec Corporation><12.2.0.13>
    [C:\PROGRA~1\NORTON~2\apwutil.loc]  <Symantec Corporation><12.2.0.13>
    [C:\Program Files\Norton AntiVirus\naverror.loc]  <Symantec Corporation><12.2.0.13>
    [C:\WINDOWS\System32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
    [C:\Program Files\Norton AntiVirus\apwcmdnt.dll]  <Symantec Corporation><12.2.0.13>
    [C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCEvt.dll]  <Symantec Corporation><2.1.0.4>
    [C:\Program Files\Norton AntiVirus\apwcmdNT.loc]  <Symantec Corporation><12.2.0.13>
    [C:\Program Files\Norton AntiVirus\NAVEvent.dll]  <Symantec Corporation><12.2.0.13>
    [C:\Program Files\Norton AntiVirus\IWP\SymFWAgt.dll]  <Symantec Corporation><104.0.1.17>
    [C:\WINDOWS\System32\SymNeti.DLL]  <Symantec Corporation><6.0.3.303>
    [C:\Program Files\Common Files\Symantec Shared\ccLogin.dll]  <Symantec Corporation><104.0.7.3>
    [C:\Program Files\Norton AntiVirus\IWP\ccFWSetg.dll]  <Symantec Corporation><104.0.1.17>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~1\NSCSRVPS.DLL]  <Symantec Corporation><2006.1.5.17>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~1\NSCUIBL.DLL]  <Symantec Corporation><2006.1.5.17>
    [C:\Program Files\Norton AntiVirus\NAVOpts.dll]  <Symantec Corporation><12.2.0.13>
    [C:\Program Files\Norton AntiVirus\navopts.loc]  <Symantec Corporation><12.2.0.13>
    [C:\Program Files\Norton AntiVirus\NAVAPSCR.dll]  <Symantec Corporation><12.2.0.13>
    [C:\Program Files\Symantec\LiveUpdate\NetDetectController_2_7.DLL]  <Symantec Corporation><2.7.39.0>
    [C:\PROGRA~1\NORTON~2\NAVTasks.dll]  <Symantec Corporation><12.2.0.13>
    [C:\PROGRA~1\NORTON~2\NAVTasks.loc]  <Symantec Corporation><12.2.0.13>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  <Yahoo! China><3, 0, 1, 1019>
[PID: 1964][C:\WINDOWS\System32\ctfmon.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 176][C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe]  <Adobe Systems Inc.><6.0.0.2003051500>
[PID: 216][C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe]  <Zone Labs Inc.><3.7.143>
    [C:\WINDOWS\System32\VSUTIL.dll]  <Zone Labs Inc.><3.7.143>
    [C:\WINDOWS\System32\VSPUBAPI.dll]  <Zone Labs Inc.><3.7.143>
    [C:\WINDOWS\System32\VSMONAPI.dll]  <Zone Labs Inc.><3.7.143>
    [C:\Program Files\Zone Labs\ZoneAlarm\framewrk.dll]  <Zone Labs Inc.><3.7.143>
    [C:\WINDOWS\System32\AcSignIcon.dll]  <Autodesk><16.1.63.0>
    [C:\WINDOWS\System32\vsdata.dll]  <Zone Labs Inc.><3.7.143>
    [C:\Program Files\Zone Labs\ZoneAlarm\programs_za.zap]  <Zone Labs Inc.><3.7.143>
    [C:\Program Files\Zone Labs\ZoneAlarm\security_za.zap]  <Zone Labs Inc.><3.7.143>
    [C:\Program Files\Zone Labs\ZoneAlarm\alert_za.zap]  <Zone Labs Inc.><3.7.143>
    [C:\Program Files\Zone Labs\ZoneAlarm\email_za.zap]  <Zone Labs Inc.><3.7.143>
    [C:\Program Files\Zone Labs\ZoneAlarm\firewall_za.zap]  <Zone Labs Inc.><3.7.143>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  <Yahoo! China><3, 0, 1, 1019>
[PID: 220][C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE]  <Nokia.><6, 60, 33, 1>
    [C:\WINDOWS\system32\NclTools.dll]  <Nokia.><6, 60, 11, 0>
    [C:\Program Files\Common Files\PCSuite\Transports\NCLIrDAMM.dll]  <Nokia Corp.><6, 60, 17, 0>
    [C:\Program Files\Common Files\PCSuite\Transports\NCLRSMM.dll]  <Nokia><6, 60, 25, 1>
    [C:\Program Files\Common Files\PCSuite\Transports\NCLUSBMM.dll]  <Nokia><6, 60, 26, 0>
    [C:\Program Files\Common Files\PCSuite\Services\NclDS.dll]  <Nokia><6, 60, 4, 0>
[PID: 284][C:\Program Files\KINGSOFT\PowerWord 2005\XDICT.EXE]  <Kingsoft Co, Ltd.><8, 5, 0, 0>
    [C:\Program Files\KINGSOFT\PowerWord 2005\DicMngr.dll]  <Kingsoft><1, 0, 0, 0>
    [C:\Program Files\KINGSOFT\PowerWord 2005\doshow.dll]  <N/A><N/A>
    [C:\Program Files\KINGSOFT\PowerWord 2005\ITextOut.dll]  <Kingsoft><1, 1, 0, 0>
    [C:\Program Files\KINGSOFT\PowerWord 2005\KPic10.dll]  <N/A><N/A>
    [C:\Program Files\KINGSOFT\PowerWord 2005\ijl11.dll]  <Intel Corporation><1.1.2>
    [C:\Program Files\KINGSOFT\PowerWord 2005\NormGrab.DLL]  <Kingsoft Co, Ltd.><6, 0, 0, 0>
    [C:\Program Files\KINGSOFT\PowerWord 2005\toTTSEngine50.dll]  <Kingsoft Corporation><1, 0, 0, 1>
    [C:\Program Files\KINGSOFT\PowerWord 2005\xfile.dll]  <N/A><N/A>
    [C:\WINDOWS\System32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
    [C:\Program Files\KINGSOFT\PowerWord 2005\DBCore10.dll]  <Kingsoft  Corp.><1, 0, 0, 0>
    [C:\Program Files\KINGSOFT\PowerWord 2005\XdictGrb.dll]  <Kingsoft Co, Ltd.><8, 5, 0, 0>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  <Yahoo! China><3, 0, 1, 1019>

[PID: 1236][C:\WINDOWS\System32\alg.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
    [C:\WINDOWS\System32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
[PID: 1428][C:\Program Files\Norton AntiVirus\navapsvc.exe]  <Symantec Corporation><12.2.0.13>
    [C:\Program Files\Common Files\Symantec Shared\ccL40.dll]  <Symantec Corporation><104.0.7.3>
    [C:\Program Files\Norton AntiVirus\SAVRT32.DLL]  <Symantec Corporation><9.7.0.10>
    [C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll]  <Symantec Corporation><104.0.7.3>
    [C:\Program Files\Norton AntiVirus\navapsvc.loc]  <Symantec Corporation><12.2.0.13>
    [C:\Program Files\Norton AntiVirus\N32Exclu.dll]  <Symantec Corporation><12.2.0.13>
    [C:\Program Files\Common Files\Symantec Shared\ccSet.dll]  <Symantec Corporation><104.0.7.3>
    [C:\Program Files\Common Files\Symantec Shared\DefUtDCD.dll]  <Symantec Corporation><3.1.30.0>
[PID: 196][C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe]  <Symantec Corporation><12.2.0.13>
    [C:\Program Files\Common Files\Symantec Shared\ccL40.dll]  <Symantec Corporation><104.0.7.3>
    [C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll]  <Symantec Corporation><104.0.7.3>
    [C:\Program Files\Norton AntiVirus\IWP\iwp.dll]  <Symantec Corporation><12.2.0.13>
[PID: 1716][C:\WINDOWS\System32\nvsvc32.exe]  <NVIDIA Corporation><6.14.10.4532>
[PID: 1712][C:\WINDOWS\System32\tcpsvcs.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
    [C:\WINDOWS\System32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
[PID: 2108][C:\WINDOWS\System32\snmp.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
    [C:\WINDOWS\System32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
[PID: 2160][C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe]  <Analog Devices, Inc.><3, 2, 6, 0>
[PID: 2344][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 2372][C:\WINDOWS\System32\wdfmgr.exe]  <Microsoft Corporation><5.2.3790.1230 built by: DNSRV(bld4act)>
[PID: 2436][C:\WINDOWS\system32\ZONELABS\vsmon.exe]  <Zone Labs Inc.><3.7.143>
    [C:\WINDOWS\system32\VSUTIL.dll]  <Zone Labs Inc.><3.7.143>
    [C:\WINDOWS\system32\ZONELABS\VSDB.dll]  <Zone Labs Inc.><3.7.143>
    [C:\WINDOWS\system32\ZONELABS\VSRULEDB.DLL]  <Zone Labs Inc.><3.7.143>
    [C:\WINDOWS\system32\ZONELABS\html.tdr]  <Zone Labs Inc.><3.7.143>
    [C:\WINDOWS\System32\vsdata.dll]  <Zone Labs Inc.><3.7.143>
    [C:\WINDOWS\system32\ZONELABS\ssleay32.dll]  <Zone Labs Inc.><3.7.143>
    [C:\WINDOWS\System32\AcSignIcon.dll]  <Autodesk><16.1.63.0>
    [C:\WINDOWS\system32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
[PID: 3252][C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE]  <Symantec Corporation><2006.1.5.17>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~1\NSCSRVPS.DLL]  <Symantec Corporation><2006.1.5.17>
    [C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll]  <Symantec Corporation><104.0.7.3>
    [C:\Program Files\Common Files\Symantec Shared\ccL40.dll]  <Symantec Corporation><104.0.7.3>
    [C:\Program Files\Common Files\Symantec Shared\ccSet.dll]  <Symantec Corporation><104.0.7.3>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~1\NSCUIBL.DLL]  <Symantec Corporation><2006.1.5.17>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~1\NSCUICOR.LOC]  <Symantec Corporation><2006.1.5.17>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~1\NSCJSBL.DLL]  <Symantec Corporation><2006.1.5.17>
    [C:\Program Files\Norton AntiVirus\avFPXY.dll]  <Symantec Corporation><2006.1.4.4>
    [C:\Program Files\Norton AntiVirus\avFMST.dll]  <Symantec Corporation><2006.1.4.4>
    [C:\Program Files\Norton AntiVirus\avNSCPlg.dll]  <Symantec Corporation><12.2.0.13>
    [C:\Program Files\Norton AntiVirus\avNSCPlg.loc]  <Symantec Corporation><12.2.0.13>
    [C:\Program Files\Common Files\Symantec Shared\Security Console\NSC_WSCR.DLL]  <Symantec Corporation><2006.1.5.17>
    [C:\Program Files\Common Files\Symantec Shared\Security Console\NSC_WSCR.LOC]  <Symantec Corporation><2006.1.5.17>
    [C:\Program Files\Common Files\Symantec Shared\Security Console\NSC_Hlpr.dll]  <Symantec Corporation><2006.1.5.17>
    [C:\Program Files\Norton AntiVirus\NAVEvent.dll]  <Symantec Corporation><12.2.0.13>
[PID: 3740][C:\WINDOWS\System32\wuauclt.exe]  <Microsoft Corporation><5.8.0.2469 built by: lab01_n(wmbla)>
[PID: 3624][C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe]  <Yahoo! China><3, 0, 1, 1007>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  <Yahoo! China><3, 0, 1, 1019>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\YAlive.dll]  <yahoo! china><3, 1, 9, 1057>
    [C:\WINDOWS\System32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\ynotifier.dll]  <yahoo! china><3, 0, 0, 1000>
[PID: 2328][C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe]  <Yahoo! China><3, 0, 0, 1001>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  <Yahoo! China><3, 0, 1, 1019>
    [C:\PROGRA~1\Yahoo!\Assistant\shell\yAssecblk.dll]  <Yahoo! China><3, 0, 0, 1002>
    [C:\PROGRA~1\Yahoo!\Assistant\shell\yMenuInfo.dll]  <Yahoo! China><3, 0, 0, 1000>
    [C:\PROGRA~1\Yahoo!\Assistant\shell\yIEAngel.dll]  <Yahoo! China><3, 0, 0, 1000>
    [C:\PROGRA~1\Yahoo!\Assistant\shell\yAsMenu.dll]  <Yahoo! China><3, 0, 0, 1001>
[PID: 4040][C:\Program Files\3721\ske\TrojanAssistant.exe]  <Yahoo! CN><2.1.2.1003>
    [C:\WINDOWS\System32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  <Yahoo! China><3, 0, 1, 1019>
    [C:\WINDOWS\System32\AcSignIcon.dll]  <Autodesk><16.1.63.0>
    [C:\Program Files\3721\ske\fsk.dll]  <3721.com><2, 1, 2, 1030>
    [C:\Program Files\3721\ske\wmpns.dll]  <---><1, 1, 8, 1324>
    [C:\Program Files\3721\ske\snpmw.dll]  <---><1, 1, 9, 1325>
[PID: 496][C:\Program Files\VnetClient1.6\VnetClient.exe]  <><2005, 11, 18, 1>
    [C:\Program Files\VnetClient1.6\Communicate.dll]  <GDCN><2005, 3, 3, 1>
    [C:\Program Files\VnetClient1.6\DialModule.dll]  <GDCN><2005, 9, 1, 1>
    [C:\WINDOWS\System32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  <Yahoo! China><3, 0, 1, 1019>
    [C:\PROGRA~1\VNETCL~1.6\CLIENT~1.DLL]  <><2004, 2, 28, 1>
    [C:\PROGRA~1\VNETCL~1.6\PLUGIN~1.OCX]  <><2005, 12, 20, 1>
    [C:\PROGRA~1\VNETCL~1.6\sign.dll]  <0><2004, 12, 1, 1>
    [C:\PROGRA~1\VNETCL~1.6\SETUPP~1.DLL]  <><1, 0, 0, 1>
    [C:\PROGRA~1\VNETCL~1.6\WEBPLU~1.DLL]  <><2005, 8, 18, 1>
    [C:\PROGRA~1\VNETCL~1.6\ADVERT~1.OCX]  <><2005, 10, 13, 1>
    [C:\PROGRA~1\VNETCL~1.6\Gif89a.dll]  <><2005, 6, 21, 1>
    [C:\PROGRA~1\VNETCL~1.6\VnetBs.ocx]  <><2004, 11, 18, 1>
    [C:\PROGRA~1\VNETCL~1.6\ACCOUN~2.DLL]  <><2005, 8, 11, 1>
    [C:\PROGRA~1\VNETCL~1.6\AccountMgr.dll]  <><2005, 8, 16, 1>
    [C:\PROGRA~1\VNETCL~1.6\VnetSkin.ocx]  <GDDC><2005, 12, 21, 1>
    [C:\PROGRA~1\VNETCL~1.6\DialogStyle.dll]  <><1, 0, 0, 1>
    [C:\PROGRA~1\VNETCL~1.6\BDSearch.ocx]  <gdcn><2005, 12, 22, 1>
    [C:\PROGRA~1\VNETCL~1.6\Timer.ocx]  <><2005, 10, 9, 14>
    [C:\PROGRA~1\VNETCL~1.6\PLUGIN~2.OCX]  <><2005, 2, 24, 1>
    [C:\PROGRA~1\VNETCL~1.6\NEWMES~1.DLL]  <><2005, 8, 26, 1>
    [C:\PROGRA~1\VNETCL~1.6\PassCtrl.dll]  <GDCN><2006, 1, 9, 10>
    [C:\WINDOWS\System32\wpcap.dll]  <Politecnico di Torino><3, 0, 0, 18>
    [C:\WINDOWS\System32\pthreadVC.dll]  <N/A><N/A>
    [C:\WINDOWS\System32\packet.dll]  <Politecnico di Torino><3, 0, 0, 18>
    [C:\PROGRA~1\VNETCL~1.6\PlugPush.dll]  <><2004, 12, 21, 1>
    [C:\PROGRA~1\VNETCL~1.6\ALLINT~1.DLL]  <><2004, 11, 23, 1>
    [C:\PROGRA~1\VNETCL~1.6\VNETLO~1.OCX]  <><2005, 4, 19, 1>
    [C:\PROGRA~1\VNETCL~1.6\StatNum.dll]  <><2004, 11, 18, 1>
    [C:\PROGRA~1\VNETCL~1.6\VNETON~1.OCX]  <><2005, 3, 2, 1>
    [C:\PROGRA~1\VNETCL~1.6\ALLFUN~1.DLL]  <GDCN><2006, 1, 13, 11>
    [C:\PROGRA~1\VNETCL~1.6\VnetOptLog.dll]  <><2005, 9, 13, 9>
    [C:\PROGRA~1\VNETCL~1.6\DlgSkin.ocx]  <><1, 0, 0, 1>
    [C:\WINDOWS\System32\macromed\flash\Flash.ocx]  <Macromedia, Inc.><7,0,19,0>

[PID: 2688][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  <Microsoft Corporation><6.00.2600.0000 (xpclient.010817-1148)>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  <Yahoo! China><3, 0, 1, 1019>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\yscrblock.dll]  <Yahoo! China><3, 0, 0, 1000>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\YAlive.dll]  <yahoo! china><3, 1, 9, 1057>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll]  <Yahoo! China><3, 0, 1, 1010>
    [C:\WINDOWS\System32\AcSignIcon.dll]  <Autodesk><16.1.63.0>
    [C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll]  <N/A><N/A>
    [C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.CHT]  <N/A><N/A>
    [C:\PROGRA~1\Yahoo!\Assistant\Assist\yasbar.dll]  <yahoo! china><3, 0, 0, 1028>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ysearch.dll]  <Yahoo! China><3, 0, 0, 1000>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasnoad.dll]  <yahoo! china><3, 0, 0, 1002>
    [C:\WINDOWS\System32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yzsNetProto.dll]  <Yahoo! China><3, 0, 0, 1000>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yphtb.dll]  <Yahoo! China><3, 0, 0, 1000>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yrss.dll]  <Yahoo! China><3, 0, 0, 1000>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yaswiper.dll]  <Yahoo! China><3, 0, 0, 1000>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasiesec.dll]  <Yahoo! China><3, 0, 0, 1000>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ysettings.dll]  <yahoo! china><3, 0, 0, 1000>
    [C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll]  <Adobe Systems Incorporated><6.0.0.2003051500>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yangling.dll]  <yahoo! china><3, 0, 0, 1001>
    [c:\PROGRA~1\VNETCL~1.6\VNETTR~1.DLL]  <><2005, 4, 6, 1>
    [c:\PROGRA~1\VNETCL~1.6\Communicate.dll]  <GDCN><2005, 3, 3, 1>
    [C:\PROGRA~1\VNETCL~1.6\CLIENT~1.DLL]  <><2004, 2, 28, 1>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\assist\YDRAGS~1.DLL]  <yahoo! china><3, 0, 0, 1000>
    [C:\Program Files\Norton AntiVirus\NavShExt.dll]  <Symantec Corporation><12.2.0.13>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yassist.dll]  <Yahoo! China><3, 0, 7, 1012>
    [C:\WINDOWS\Downloaded Program Files\OL2005.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
    [C:\WINDOWS\System32\JJN.IME]  <加加在线><3.11.0.0>
    [C:\WINDOWS\System32\macromed\flash\Flash.ocx]  <Macromedia, Inc.><7,0,19,0>
    [C:\PROGRA~1\yahoo!\assistant\Shell\yAssecblk.dll]  <Yahoo! China><3, 0, 0, 1002>
    [c:\progra~1\yahoo!\assist~1\assist\yadfil~1.dll]  <Yahoo! China><3, 0, 0, 1001>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yrepair.dll]  <Yahoo! China><3, 0, 0, 1000>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasfsks.dll]  <3721.com><2, 1, 1, 87>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yoptimum.dll]  <Yahoo! China><3, 0, 0, 1000>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yxpstyle.dll]  <Yahoo! China><3, 0, 0, 1000>
    [C:\Program Files\Rising\RavWeb\libload.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\RavWeb\VirusLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\RavWeb\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [C:\Program Files\Rising\RavWeb\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\Rising\RavWeb\Scanner.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30>
    [C:\Program Files\Rising\RavWeb\BWList.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
    [C:\Program Files\Rising\RavWeb\MVEngine.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 8>
    [C:\Program Files\Rising\RavWeb\Engine.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30>
    [C:\Program Files\Rising\RavWeb\ScanExec.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\Rising\RavWeb\Unpacker.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
    [C:\Program Files\Rising\RavWeb\UnExe.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\Rising\RavWeb\ScanEx.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\Rising\RavWeb\PostTrt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
    [C:\Program Files\Rising\RavWeb\NvFile.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
    [C:\Program Files\Rising\RavWeb\ScanMac.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 8>
    [C:\Program Files\Rising\RavWeb\ScanSct.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 17>
    [C:\Program Files\Rising\RavWeb\ExtMail.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13>
    [C:\Program Files\Rising\RavWeb\ExtFile.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
    [C:\Program Files\Rising\RavWeb\ExtOLE.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[PID: 152][C:\Program Files\JJOL\IME\JJSvr.EXE]  <加加在线><3.11.0.1>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  <Yahoo! China><3, 0, 1, 1019>
[PID: 1348][C:\Documents and Settings\David Yau\桌面\新建文件夹\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  <Yahoo! China><3, 0, 1, 1019>
    [C:\WINDOWS\System32\SYNCOR11.DLL]  <SoundMAX><1.2.3>

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================