【求助】网页木马```` bbs.ikaka.com

CrystalCharm - 2006-7-21 14:34:00

2006-07-20,23:25:19

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<LocalSystem><C:\WINDOWS\system\svchost.exe> []
<MyShares><c:\program Files\易虎\MyShares.exe /tray> []
<91cast><> []
<svc><C:\WINDOWS\svchost.exe> []
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<yassistse><"C:\Program Files\Yahoo!\Assistant\yAssistSe.exe"> [Yahoo!]
<Thunder><E:\迅雷\Thunder.exe /s> [Thunder Networking Technologies,LTD]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<bgoomain.exe><C:\PROGRA~1\baigoo\bgoomain.exe> [BGoo]
<CdnCtr><榁?> []
<MSService_v1.0><C:\WINDOWS\temp\realsched.exe> []
<spoolsv><C:\WINDOWS\system32\spoolsv\spoolsv.exe -printer> [广州傲讯信息科技有限公司]
<pbmini><"C:\Program Files\pcast\PodcastbarMini\PodcastBarMini.exe" -hide> [Boba Team]
<MoveSearch><C:\Program Files\HuaCi\huaci\zsearch.exe> []
<91cast><> []
<svc><C:\WINDOWS\svchost.exe> []
<o6mg389i><RunDll32 "C:\WINDOWS\Downlo~1\o6mg389i.dll",Run> [Microsoft Corporation]
<SearchNet_Up><"C:\Program Files\SearchNet\ServeUp.exe"> []
<Desktop><C:\WINDOWS\system32\rundll32.exe "C:\Program Files\DeskAdTop\Run.dll" ,Rundll> []
<adsys><"C:\WINDOWS\SVCH0ST.exe> []
<Rtvcan><C:\WINDOWS\system32\Rtvcan.exe> []
<RavTask><"C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<Vrmon><D:\新建文件夹 (2)\vrmonnt.exe Main> []
<VrSchedule><D:\新建文件夹 (2)\Vrres.exe> [(C)HAURI]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<RavStub><"C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\ravstub.exe" /RUNONCE> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<SoundMix><rundll32.exe C:\WINDOWS\system32\soundmix.dll,Load> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\kaijgg.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<SysTime><C:\PROGRA~1\WinKld\WinKld.dll> [www.88dog.com]

==================================
启动文件夹
[划词搜索]
<C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\划词搜索.lnk><N>
[腾讯QQ]
<C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\腾讯QQ.lnk><N>

==================================
服务
[JMediaService / JMediaService]
<C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\MMSASS~1\MMSSVER.DLL,Service><N/A>
[Macromedia Licensing Service / Macromedia Licensing Service]
<"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><N/A>
[NT Data Provider / MOVEESS]
<C:\WINDOWS\SYSTEM32\RUNDLL32.EXE C:\WINDOWS\SYSTEM32\WBEM\IRJIT.DLL,Export 1087><N/A>
[Remote Log / Remote Log]
<C:\WINDOWS\system32\ServeHost.exe><N/A>
[Remote Packet Capture Protocol v.0 (experimental) / rpcapd]
<"C:\Program Files\WinPcap\rpcapd.exe" -d -f "C:\Program Files\WinPcap\rpcapd.ini"><N/A>
[Rising Process Communication Center / RsCCenter]
<"C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
<"C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[ViRobot Expert Monitoring / vrmonsvc]
<D:\新建文件夹 (2)\vrmonsvc.exe><HAURI>

==================================
浏览器加载项
[MonitorURL Class]
{08A312BB-5409-49FC-9347-54BB7D069AC6} <C:\PROGRA~1\DESKAD~1\deskipn.dll, >
[wmpdrm]
{0E674588-66B7-4E19-9D0E-2053B800F69F} <C:\WINDOWS\system32\wmpdrm.dll, Allsum Info. Tech. Ltd.>
[MyIEHelper Class]
{16A770A0-0E87-4278-B748-2460D64A8386} <C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\IEHelper_4663.dll, Microsoft Corporation>
[IE Address Browser Helper]
{2A0176FE-008B-4706-90F5-BBA532A49731} <C:\Program Files\SearchNet\SNHpr.dll, N/A>
[IE Browser Helper]
{3CE496D1-1746-41CD-9489-3C0B93DF10E2} <C:\WINDOWS\Downlo~1\e6l5.dll, 中搜在线软件有限公司>
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[IEYHlprObj Class]
{5C761D09-377E-4EAC-ADA1-C9CDE39B5674} <C:\WINDOWS\IEYHelper.dll, Eastday Corporation>
[ActiveBHO Class]
{63C55A7F-6E29-8D4F-5C76-4F850F28D13A} <C:\Progra~1\DoDoorRSSFinder\ActiveBandObject.dll, >
[Vision]
{6671A431-5C3D-463d-A7CF-5587F9B7E191} <C:\PROGRA~1\MMSASS~1\mmsass~1.dll, >
[MSHlper Class]
{721E6521-4CAD-4A8D-A7F1-4E230B31EF19} <C:\WINDOWS\system32\MSHLP.DLL, >
[CpapView Class]
{77962960-536E-47EC-9DDB-52651519705F} <C:\WINDOWS\system32\Rundll32.dll, >
[Status Class]
{7BDAF75A-0D6F-4F50-AFE9-333D08DF4005} <C:\Program Files\baigoo\BGooBHO.dll, >
[IEHlprObj Class]
{999ADFA2-8AD1-47ff-97FC-69FB847458F4} <C:\Progra~1\NetMeeting\nmview.dll, Microsoft Corporation>
[WinSC Class]
{9ACEEE31-1440-471B-AA46-72B061FE7D61} <C:\WINDOWS\system32\WinSC64.dll, N/A>
[estAliveObj Class]
{A2B7A0F0-B697-4A71-8D91-43443F57D7BB} <C:\WINDOWS\estAlive.dll, Eastday Corporation>
[IeCatch2 Class]
{A5366673-E8CA-11D3-9CD9-0090271D075B} <E:\新陆建ㄎ文膥~3\FLASHGET\jccatch.dll, N/A>
[Google Toolbar Helper]
{AA58ED58-01DD-4d91-8333-CF10577473F7} <c:\program files\google\googletoolbar1.dll, N/A>
[Flash 8 ocx ]
{B8CCDD47-38E4-4CD2-B7FA-3B4B690F74BD} <C:\WINDOWS\system32\flash8.dll, MACROMEDlA>
[iehelper]
{C1DE9E98-839F-4055-AEDF-781852C25895} <C:\WINDOWS\system32\aperferer.dll, N/A>
[Webacc Class]
{CAC068F3-A608-406B-8581-458788A67694} <C:\WINDOWS\system32\svchost.dll, >
[Yahoo Bar]
{F60FAB6F-115D-4797-9ED1-89793B930876} <C:\WINDOWS\ODBINT.dll, N/A>
[google bar]
{FAD11F89-F11E-4A15-92FB-6F0EDC4C8D59} <C:\WINDOWS\vwwreg.dll, N/A>
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[MMSAssistMenu]
{6671A433-5C3D-463d-A7CF-5587F9B7E191} <C:\PROGRA~1\MMSASS~1\mmsass~1.dll, >
[比较购物搜索(&C)]
{A36ABCF0-1C8F-46e7-A67C-0489DC21B9CC} <C:\WINDOWS\YayaBands.dll, Eastday Corporation>
[时尚精品，体验快感]
{6E5EECAF-8879-4a75-8A88-B44B6382A763} <http://adfarm.mediaplex.com/ad/ck/4080-22910-9640-334?cn=chaoyue;rgbutton_120x60;hp&mpro=http://www.ebay.com.cn, N/A>
[ActiveMovieControl Object]
{05589FA1-C356-11CE-BF01-00AA0055595A} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[MonitorURL Class]
{08A312BB-5409-49FC-9347-54BB7D069AC6} <C:\PROGRA~1\DESKAD~1\deskipn.dll, >
[wmpdrm]
{0E674588-66B7-4E19-9D0E-2053B800F69F} <C:\WINDOWS\system32\wmpdrm.dll, Allsum Info. Tech. Ltd.>
[MyIEHelper Class]
{16A770A0-0E87-4278-B748-2460D64A8386} <C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\IEHelper_4663.dll, Microsoft Corporation>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[IE Address Browser Helper]
{2A0176FE-008B-4706-90F5-BBA532A49731} <C:\Program Files\SearchNet\SNHpr.dll, N/A>
[IE Browser Helper]
{3CE496D1-1746-41CD-9489-3C0B93DF10E2} <C:\WINDOWS\Downlo~1\e6l5.dll, 中搜在线软件有限公司>
[HHCtrl Object]
{52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[IEYHlprObj Class]
{5C761D09-377E-4EAC-ADA1-C9CDE39B5674} <C:\WINDOWS\IEYHelper.dll, Eastday Corporation>
[ActiveBHO Class]
{63C55A7F-6E29-8D4F-5C76-4F850F28D13A} <C:\Progra~1\DoDoorRSSFinder\ActiveBandObject.dll, >
[Vision]
{6671A431-5C3D-463D-A7CF-5587F9B7E191} <C:\PROGRA~1\MMSASS~1\mmsass~1.dll, >
[MSHlper Class]
{721E6521-4CAD-4A8D-A7F1-4E230B31EF19} <C:\WINDOWS\system32\MSHLP.DLL, >
[CpapView Class]
{77962960-536E-47EC-9DDB-52651519705F} <C:\WINDOWS\system32\Rundll32.dll, >
[Status Class]
{7BDAF75A-0D6F-4F50-AFE9-333D08DF4005} <C:\Program Files\baigoo\BGooBHO.dll, >
[IEHlprObj Class]
{999ADFA2-8AD1-47FF-97FC-69FB847458F4} <C:\Progra~1\NetMeeting\nmview.dll, Microsoft Corporation>
[WinSC Class]
{9ACEEE31-1440-471B-AA46-72B061FE7D61} <C:\WINDOWS\system32\WinSC64.dll, N/A>
[estAliveObj Class]
{A2B7A0F0-B697-4A71-8D91-43443F57D7BB} <C:\WINDOWS\estAlive.dll, Eastday Corporation>
[IeCatch2 Class]
{A5366673-E8CA-11D3-9CD9-0090271D075B} <E:\新陆建ㄎ文膥~3\FLASHGET\jccatch.dll, N/A>
[Google Toolbar Helper]
{AA58ED58-01DD-4D91-8333-CF10577473F7} <c:\program files\google\googletoolbar1.dll, N/A>
[Flash 8 ocx ]
{B8CCDD47-38E4-4CD2-B7FA-3B4B690F74BD} <C:\WINDOWS\system32\flash8.dll, MACROMEDlA>
[iehelper]
{C1DE9E98-839F-4055-AEDF-781852C25895} <C:\WINDOWS\system32\aperferer.dll, N/A>
[Webacc Class]
{CAC068F3-A608-406B-8581-458788A67694} <C:\WINDOWS\system32\svchost.dll, >
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx, Macromedia, Inc.>
[Yahoo Bar]
{F60FAB6F-115D-4797-9ED1-89793B930876} <C:\WINDOWS\ODBINT.dll, N/A>
[google bar]
{FAD11F89-F11E-4A15-92FB-6F0EDC4C8D59} <C:\WINDOWS\vwwreg.dll, N/A>
[&使用迅雷下载]
<E:\迅雷\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
<E:\迅雷\Program\GetAllUrl.htm, N/A>
[>>彩信发送<<]
<res://C:\PROGRA~1\MMSASS~1\mmsass~1.dll/mms.htm, N/A>
[上传到QQ网络硬盘]
<D:\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
<D:\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<D:\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<D:\QQ\SendMMS.htm, N/A>
[访问通用网址]
<C:\Program Files\CNNIC\Cdn\cnnic.htm, N/A>

==================================

CrystalCharm - 2006-7-21 14:35:00

正在运行的进程
[PID: 448][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 504][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 528][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 572][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 584][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 736][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 792][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 852][C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\CCenter.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 872][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 916][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1016][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1052][C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\Ravmond.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 22>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 18>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\RsLog.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\HOOKSYS.dll] <Rising><18, 1, 0, 9>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\Scanner.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\libload.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\VirusLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\regmon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\HookWeb.dll] <rising><18, 0, 0, 1>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\MemMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\expscan.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\MailMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\SpamEng.dll] <N/A><18, 0, 0, 6>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\engine.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 28>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\PostTrt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\UnExe.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\ScanExec.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\ScanEx.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\NvFile.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\ScanMac.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\ScanSct.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 15>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\Unpacker.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\ExtMail.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\ExtOLE.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[PID: 1256][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[C:\PROGRA~1\WinKld\Winkld.dat] <www.88dog.com><2, 0, 0, 1>
[C:\PROGRA~1\baigoo\bgoohk.dll] < ><1, 0, 0, 1007>
[C:\WINDOWS\system32\igfxpph.dll] <Intel Corporation><3.0.0.4342>
[C:\WINDOWS\system32\hccutils.DLL] <Intel Corporation><3.0.0.4342>
[C:\WINDOWS\system32\igfxres.dll] <Intel Corporation><3.0.0.4342>
[C:\WINDOWS\system32\igfxsrvc.dll] <Intel Corporation><3.0.0.4342>
[C:\WINDOWS\system32\igfxdev.dll] <Intel Corporation><3.0.0.4342>
[C:\WINDOWS\Downlo~1\e6l5.dll] <中搜在线软件有限公司><1, 0, 3, 2>
[C:\Progra~1\DoDoorRSSFinder\ActiveBandObject.dll] <><1, 0, 0, 1>
[C:\PROGRA~1\MMSASS~1\albus.dll] <N/A><N/A>
[C:\WINDOWS\system32\MSHLP.DLL] <><1, 0, 0, 1>
[C:\WINDOWS\system32\Rundll32.dll] <><1, 0, 1, 1>
[C:\WINDOWS\system32\msicn\msibm.dll] <广州傲讯信息科技有限公司><2, 0, 0, 1>
[C:\WINDOWS\system32\msicn\plugins\as.dll] <广州傲讯信息科技有限公司><2, 0, 0, 1>
[C:\WINDOWS\system32\msicn\plugins\bm.dll] <广州傲讯信息科技有限公司><2, 0, 0, 1>
[C:\WINDOWS\system32\msicn\plugins\bse.dll] <广州傲讯信息科技有限公司><2, 0, 0, 1>
[C:\WINDOWS\system32\msicn\plugins\lup.dll] <广州傲讯信息科技有限公司><2, 0, 0, 1>
[C:\WINDOWS\system32\svchost.dll] <><1, 0, 0, 1>
[D:\新建文件夹 (2)\vrshex.dll] <(C) HAURI><2002, 1, 14, 1>
[E:\解压工具\rarext.dll] <N/A><N/A>
[C:\PROGRA~1\MMSASS~1\mmsass~1.dll] <><1, 2, 0, 5>
[C:\Program Files\baigoo\BGooBHO.dll] <><1, 0, 0, 1>
[C:\WINDOWS\system32\WinSC64.dll] <N/A><N/A>
[C:\WINDOWS\system32\aperferer.dll] <N/A><N/A>
[C:\WINDOWS\ODBINT.dll] <N/A><N/A>
[C:\WINDOWS\vwwreg.dll] <N/A><N/A>
[PID: 1356][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)>
[C:\WINDOWS\system32\hpzsnt09.dll] <HP><2.236.4.0>
[PID: 1436][C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\RavStub.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 1632][C:\Program Files\Yahoo!\Assistant\yAssistSe.exe] <Yahoo!><1, 0, 1, 1001>
[C:\Program Files\Yahoo!\Assistant\shell\yAsMenu.dll] <Yahoo><1, 0, 1, 1006>
[C:\Program Files\Yahoo!\Assistant\shell\yAssecblk.dll] <Yahoo><1, 0, 2, 1002>
[C:\Program Files\Yahoo!\Assistant\shell\yIEAngel.dll] <Yahoo><1, 0, 1, 1001>
[C:\Program Files\Yahoo!\Assistant\shell\yMenuInfo.dll] <Yahoo><1, 0, 0, 2>
[PID: 1684][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] <RealNetworks, Inc.><0.1.0.3510>
[PID: 1784][C:\PROGRA~1\baigoo\bgoomain.exe] <BGoo><1, 0, 0, 1006>
[C:\PROGRA~1\baigoo\bgoohk.dll] < ><1, 0, 0, 1007>
[C:\PROGRA~1\baigoo\bgooex.dll] <><1, 0, 0, 1007>
[PID: 1828][C:\WINDOWS\system32\rundll32.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\PROGRA~1\MMSASS~1\MMSSVER.DLL] <><1, 2, 0, 5>
[PID: 1908][C:\WINDOWS\SYSTEM32\RUNDLL32.EXE] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1988][C:\WINDOWS\system32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: dnsrv(bld4act)>
[PID: 476][C:\WINDOWS\svchost.exe] <N/A><N/A>
[C:\PROGRA~1\baigoo\bgoohk.dll] < ><1, 0, 0, 1007>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 484][C:\WINDOWS\system32\rundll32.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\DeskAdTop\Run.dll] <><1, 0, 0, 1>
[C:\PROGRA~1\baigoo\bgoohk.dll] < ><1, 0, 0, 1007>
[PID: 508][C:\WINDOWS\system32\Rtvcan.exe] <N/A><N/A>
[PID: 300][C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\RavTask.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>

CrystalCharm - 2006-7-21 14:36:00

[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\PROGRA~1\baigoo\bgoohk.dll] < ><1, 0, 0, 1007>
[PID: 2108][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 2148][H:\病毒专杀工具\调整和修复系统的工具\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\PROGRA~1\baigoo\bgoohk.dll] < ><1, 0, 0, 1007>
[PID: 1008][E:\迅雷\Program\Thunder5.exe] <Thunder Networking Technologies,LTD><5.1.6.198>
[E:\迅雷\Program\UpdateDownload.dll] <Thunder Networking Technologies,LTD><1, 0, 1, 3>
[E:\迅雷\Program\download_interface.dll] <Thunder Networking Technologies,LTD><1, 0, 2, 69>
[E:\迅雷\Program\log4cplus.dll] <><1, 0, 2, 1>
[E:\迅雷\Program\stlport_vc646.dll] <STLport Consulting, Inc.><4.6.2003.1031>
[E:\迅雷\Program\asyn_dns.dll] <N/A><N/A>
[E:\迅雷\Program\msgmanage.dll] <Thunder Networking Technologies,LTD><1, 0, 0, 15>
[E:\迅雷\Program\historyinfo_manage.dll] <Thunder Networking Technologies,LTD><5, 2, 0, 148>
[C:\PROGRA~1\baigoo\bgoohk.dll] < ><1, 0, 0, 1007>
[E:\迅雷\Program\RegisterDll.dll] <Thunder Networking Technologies,LTD><1, 2, 0, 7>
[E:\迅雷\Program\FloatBar.dll] <Thunder Networking Technologies,LTD><1, 0, 0, 2>
[E:\迅雷\Components\InMedia\iEmbedShell.dll] <　><1, 0, 0, 10>
[E:\迅雷\Components\InMedia\iEmbed03.dll] <　><2, 2, 1, 33>
[E:\迅雷\Components\P4PClient\P4PClient.dll] <Thunder Networking Technologies,LTD><1, 0, 0, 4>
[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[E:\迅雷\Program\iTargetAd.dll] <Thunder Networking Technologies,LTD><1, 0, 0, 60>
[C:\Documents and Settings\Administrator\桌面\新建文件夹\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx] <Macromedia, Inc.><8,0,24,0>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

瑞星卡卡安全论坛