我的w2k系统，开机时自动运行开机脚本，请问怎样才能找到该脚本并打开？ bbs.ikaka.com

mxhok - 2006-8-6 14:30:00

下面为日志，谢谢！

Logfile of HijackThis v1.99.1
Scan saved at 13:52:23, on 2006-8-6
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\ibmpmsvc.exe
c:\program files\rising\rfw\rfwproxy.exe
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\Program Files\Rising\Rav\Ravmond.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\Siemens\Common\sws\almsrv\almsrvx.exe
C:\WINNT\Explorer.EXE
c:\program files\rising\rfw\RfwMain.exe
C:\WINNT\SOUNDMAN.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\rising\Rav\RavTask.exe
C:\Program Files\rising\Rav\Ravmon.exe
C:\WINNT\system32\internat.exe
C:\WINNT\system32\conime.exe
C:\Program Files\Internet Explorer\iexplore.exe
F:\Rav2006\hijackthis\HijackThis.exe
C:\Program Files\rising\Rav\Smartup.exe

O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINNT\system32\xunleibho_v14.dll
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\XUNLEIBHO_002.dll
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINNT\system32\KakaTool.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [木马绝杀] C:\Program Files\木马绝杀\killer.exe -min
O4 - HKLM\..\Run: [spoolsv] C:\WINNT\system32\spoolsv.exe
O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [RavTimer] C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [RavMon] C:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Startup: net_sharedelete.bat.lnk = C:\sharedelete.bat
O4 - Global Startup: AutoCAD 启动加速器.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1125560631129
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1125670955173
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {C5D0DFF5-6D39-4F98-88CD-12E8430A6300} (clienttime.client) - http://www.time.ac.cn/times/client.CAB
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/Ver2005/OL2005.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{53D0BD71-D0AF-4F75-8125-8AA7D74D1199}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{7050387F-136D-4AC4-8346-C698658D65EE}: NameServer = 210.53.31.2,202.10.128.68
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll
O18 - Protocol: cdl - {3DD53D40-7B8B-11D0-B013-00AA0059CE02} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: file - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: ftp - {79EAC9E3-BAF9-11CE-8C82-00AA004BA90B} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: gopher - {79EAC9E4-BAF9-11CE-8C82-00AA004BA90B} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: http - {79EAC9E2-BAF9-11CE-8C82-00AA004BA90B} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: https - {79EAC9E5-BAF9-11CE-8C82-00AA004BA90B} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: ipp - (no CLSID) - (no file)
O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINNT\SYSTEM32\itss.dll
O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll
O18 - Protocol: local - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: mailto - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll
O18 - Protocol: mhtml - {05300401-BCBC-11D0-85E3-00C04FD85AB4} - C:\WINNT\system32\inetcomm.dll
O18 - Protocol: mk - {79EAC9E6-BAF9-11CE-8C82-00AA004BA90B} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINNT\SYSTEM32\itss.dll
O18 - Protocol: msdaipp - (no CLSID) - (no file)
O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll
O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINNT\system32\mshtml.dll
O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll
O18 - Protocol: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINNT\system32\msdxm.ocx
O23 - Service: ArchestrA Logger (aaLogger) - Invensys Systems, Inc. - C:\Program Files\Common Files\ArchestrA\aaLogger.exe
O23 - Service: Automation License Manager Service (almservice) - SIEMENS AG - C:\Program Files\Siemens\Common\sws\almsrv\almsrvx.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: CCAgent - SIEMENS AG - C:\Program Files\Siemens\Common\Ace\bin\CCAgent.EXE
O23 - Service: CCEClient - SIEMENS AG - C:\Program Files\Siemens\Common\ACE\bin\CCEClient.exe
O23 - Service: CCEServer - SIEMENS AG - C:\Program Files\Siemens\Common\ACE\bin\CCEServer.exe
O23 - Service: DCF77 Zeitsignal-Empfangsdienst (DCF77) - Ingenieurbüro Allmendinger
In den Ro??ckern 10
D-73084 Salach
(+49) 07162/93233-22 Telefon
(+49) 07162/93233-21 Telefax - C:\WINNT\system32\DCF77.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: FS Service Control - Wonderware Corporation - C:\Program Files\Common Files\ArchestrA\NTServApp.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINNT\system32\ibmpmsvc.exe
O23 - Service: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
O23 - Service: S7 Global Services (s7asysvx) - SIEMENS AG - C:\Program Files\Siemens\Step7\S7BIN\s7asysvx.exe
O23 - Service: SIMATIC IEPG Help Service (s7oiehsx) - SIEMENS AG - C:\Program Files\Siemens\Common\S7IEPG\s7oiehsx.exe
O23 - Service: SIMATIC NET Synchronization Service (sim9sync) - Siemens AG - C:\Program Files\SIEMENS\SIMATIC.NET\SimNetCom\sim9sync.exe
O23 - Service: SIMATIC NET Configuration Server - Siemens AG - C:\Program Files\SIEMENS\SIMATIC.NET\opc2\bincfg\scorecfg.exe
O23 - Service: SIMATIC NET Configuration Service - Siemens AG - C:\Program Files\SIEMENS\SIMATIC.NET\opc2\bincfg\SServCFG.exe
O23 - Service: SIMATIC NET Core Server DP - Siemens AG - C:\Program Files\SIEMENS\SIMATIC.NET\opc2\bindp\scoredp.exe
O23 - Service: SIMATIC NET Core Server DP2 - Siemens AG - C:\Program Files\SIEMENS\SIMATIC.NET\opc2\bindp2\scoredp2.exe
O23 - Service: SIMATIC NET Core Server FDL - Siemens AG - C:\Program Files\SIEMENS\SIMATIC.NET\opc2\binfdl\scorefdl.exe
O23 - Service: SIMATIC NET Core Server FMS - Siemens AG - C:\Program Files\SIEMENS\SIMATIC.NET\opc2\binfms\scorefms.exe
O23 - Service: SIMATIC NET Core Server PD - Siemens AG - C:\Program Files\SIEMENS\SIMATIC.NET\opc2\binpd\scorepd.exe
O23 - Service: SIMATIC NET Core Server PN - Siemens AG - C:\Program Files\SIEMENS\SIMATIC.NET\opc2\binPN\scorepn.exe
O23 - Service: SIMATIC NET Core Server S7 - Siemens AG - C:\Program Files\SIEMENS\SIMATIC.NET\opc2\binS7\SCoreS7.exe
O23 - Service: SIMATIC NET Core Server SNMP - Siemens AG - C:\Program Files\SIEMENS\SIMATIC.NET\opc2\binSNMP\scoresnmp.exe
O23 - Service: SIMATIC NET Core Server SR - Siemens AG - C:\Program Files\SIEMENS\SIMATIC.NET\opc2\binsr\scoresr.exe
O23 - Service: SIMATIC NET P&P Manager - Siemens AG - c:\Program Files\SIEMENS\SIMATIC.NET\SimNetCom\simnetpnpman.exe
O23 - Service: SIMATIC NET Route Manager (SIMATIC NET RouteManager) - SIEMENS AG - C:\Program Files\Siemens\Common\s7wnrmsx\s7wnrmsx.exe
O23 - Service: Wonderware SuiteLink (slssvc) - Invensys Systems, Inc. - C:\Program Files\Common Files\ArchestrA\slssvc.exe
O23 - Service: SIMATIC NET Station-Manager (StatMgr) - SIEMENS AG - C:\Program Files\Siemens\Common\s7wnsmsx\s7wnsmsx.exe
O23 - Service: Wonderware NetDDE Helper (WWNetDDE) - Invensys Systems, Inc. - C:\Program Files\Common Files\ArchestrA\wwnetdde.exe

我无邪 - 2006-8-6 14:36:00

O23 - Service: DCF77 Zeitsignal-Empfangsdienst (DCF77) - Ingenieurbüro Allmendinger
In den Ro??ckern 10
D-73084 Salach
(+49) 07162/93233-22 Telefon
(+49) 07162/93233-21 Telefax - C:\WINNT\system32\DCF77.exe
这一项看不懂，你知道是什么吗?
如果还没有解决问题
请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。

mxhok - 2006-8-6 15:02:00

O23 - Service: DCF77 Zeitsignal-Empfangsdienst (DCF77) - Ingenieurbüro Allmendinger
In den Ro??ckern 10
D-73084 Salach
(+49) 07162/93233-22 Telefon
(+49) 07162/93233-21 Telefax - C:\WINNT\system32\DCF77.exe
是PLC软件编程的正常服务！谢谢！！

下面为System Repair Engineer的报告日志文件内容

2006-08-06,14:40:05

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<internat.exe><internat.exe> [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
<run><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<SoundMan><SOUNDMAN.EXE> [Realtek Semiconductor Corp.]
<SynTPLpr><C:\Program Files\Synaptics\SynTP\SynTPLpr.exe> [Synaptics, Inc.]
<Synchronization Manager><mobsync.exe /logon> [Microsoft Corporation]
<RavTask><"C:\Program Files\rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<木马绝杀><C:\Program Files\木马绝杀\killer.exe -min> []
<spoolsv><C:\WINNT\system32\spoolsv.exe> [Microsoft Corporation]
<RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
<RavTimer><C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE> []
<RavMon><C:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINNT\SYSTEM32\Userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<GinaDLL><almxgina.dll> [SIEMENS AG]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINNT\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
<WinlogonNotify: AtiExtEvent><Ati2evxx.dll> [ATI Technologies Inc.]

mxhok - 2006-8-6 15:03:00

==================================
启动文件夹
[AutoCAD 启动加速器]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\AutoCAD 启动加速器.lnk><N>
[net_sharedelete.bat]
<C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\net_sharedelete.bat.lnk><N>

==================================
服务
[ArchestrA Logger / aaLogger]
<"C:\Program Files\Common Files\ArchestrA\aaLogger.exe"><Invensys Systems, Inc.>
[Automation License Manager Service / almservice]
<"C:\Program Files\Siemens\Common\sws\almsrv\almsrvx.exe"><SIEMENS AG>
[Ati HotKey Poller / Ati HotKey Poller]
<C:\WINNT\system32\Ati2evxx.exe><ATI Technologies Inc.>
[Autodesk Licensing Service / Autodesk Licensing Service]
<"C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe"><Autodesk>
[CCAgent / CCAgent]
<C:\Program Files\Siemens\Common\Ace\bin\CCAgent.EXE><SIEMENS AG>
[CCEClient / CCEClient]
<C:\Program Files\Siemens\Common\ACE\bin\CCEClient.exe><SIEMENS AG>
[CCEServer / CCEServer]
<C:\Program Files\Siemens\Common\ACE\bin\CCEServer.exe><SIEMENS AG>
[DCF77 Zeitsignal-Empfangsdienst / DCF77]
<C:\WINNT\system32\DCF77.exe><Ingenieurbüro Allmendinger
In den Ro??ckern 10
D-73084 Salach
(+49) 07162/93233-22 Telefon
(+49) 07162/93233-21 Telefax>
[Logical Disk Manager Administrative Service / dmadmin]
<C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[FS Service Control / FS Service Control]
<"C:\Program Files\Common Files\ArchestrA\NTServApp.exe"><Wonderware Corporation>
[ThinkPad PM Service / IBMPMSVC]
<C:\WINNT\system32\ibmpmsvc.exe><N/A>
[OpcEnum / OpcEnum]
<C:\WINNT\system32\OPCEnum.exe><OPC Foundation>
[Rising Proxy Service / RfwProxySrv]
<c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService]
<c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter]
<C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[S7 Global Services / s7asysvx]
<"C:\Program Files\Siemens\Step7\S7BIN\s7asysvx.exe"><SIEMENS AG>
[SIMATIC IEPG Help Service / s7oiehsx]
<C:\Program Files\Siemens\Common\S7IEPG\s7oiehsx.exe><SIEMENS AG>
[SIMATIC NET Synchronization Service / sim9sync]
<C:\Program Files\SIEMENS\SIMATIC.NET\SimNetCom\sim9sync.exe><Siemens AG>
[SIMATIC NET Configuration Server / SIMATIC NET Configuration Server]
<C:\Program Files\SIEMENS\SIMATIC.NET\opc2\bincfg\scorecfg.exe><Siemens AG>
[SIMATIC NET Configuration Service / SIMATIC NET Configuration Service]
<C:\Program Files\SIEMENS\SIMATIC.NET\opc2\bincfg\SServCFG.exe><Siemens AG>
[SIMATIC NET Core Server DP / SIMATIC NET Core Server DP]
<C:\Program Files\SIEMENS\SIMATIC.NET\opc2\bindp\scoredp.exe><Siemens AG>
[SIMATIC NET Core Server DP2 / SIMATIC NET Core Server DP2]
<C:\Program Files\SIEMENS\SIMATIC.NET\opc2\bindp2\scoredp2.exe><Siemens AG>
[SIMATIC NET Core Server FDL / SIMATIC NET Core Server FDL]
<C:\Program Files\SIEMENS\SIMATIC.NET\opc2\binfdl\scorefdl.exe><Siemens AG>
[SIMATIC NET Core Server FMS / SIMATIC NET Core Server FMS]
<C:\Program Files\SIEMENS\SIMATIC.NET\opc2\binfms\scorefms.exe><Siemens AG>
[SIMATIC NET Core Server PD / SIMATIC NET Core Server PD]
<C:\Program Files\SIEMENS\SIMATIC.NET\opc2\binpd\scorepd.exe><Siemens AG>
[SIMATIC NET Core Server PN / SIMATIC NET Core Server PN]
<C:\Program Files\SIEMENS\SIMATIC.NET\opc2\binPN\scorepn.exe><Siemens AG>
[SIMATIC NET Core Server S7 / SIMATIC NET Core Server S7]
<C:\Program Files\SIEMENS\SIMATIC.NET\opc2\binS7\SCoreS7.exe><Siemens AG>
[SIMATIC NET Core Server SNMP / SIMATIC NET Core Server SNMP]
<C:\Program Files\SIEMENS\SIMATIC.NET\opc2\binSNMP\scoresnmp.exe><Siemens AG>
[SIMATIC NET Core Server SR / SIMATIC NET Core Server SR]
<C:\Program Files\SIEMENS\SIMATIC.NET\opc2\binsr\scoresr.exe><Siemens AG>
[SIMATIC NET P&P Manager / SIMATIC NET P&P Manager]
<c:\Program Files\SIEMENS\SIMATIC.NET\SimNetCom\simnetpnpman.exe><Siemens AG>
[SIMATIC NET Route Manager / SIMATIC NET RouteManager]
<C:\Program Files\Siemens\Common\s7wnrmsx\s7wnrmsx.exe><SIEMENS AG>
[Wonderware SuiteLink / slssvc]
<"C:\Program Files\Common Files\ArchestrA\slssvc.exe"><Invensys Systems, Inc.>
[SIMATIC NET Station-Manager / StatMgr]
<C:\Program Files\Siemens\Common\s7wnsmsx\s7wnsmsx.exe><SIEMENS AG>

mxhok - 2006-8-6 15:03:00

==================================
浏览器加载项
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINNT\system32\xunleibho_v14.dll, Thunder Networking Technologies,LTD>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\XUNLEIBHO_002.dll, Thunder Networking Technologies,LTD>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINNT\system32\KakaTool.dll, Beijing Rising Technology Co., Ltd.>
[Shockwave ActiveX Control]
{166B1BCA-3F9C-11CF-8075-444553540000} <C:\WINNT\system32\macromed\Shockwave 10\Download.dll, Macromedia, Inc.>
[Windows Genuine Advantage Validation Tool]
{17492023-C23A-453E-A040-C7C580BBF700} <C:\WINNT\system32\LegitCheckControl.DLL, Microsoft? Corporation>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINNT\System32\wuweb.dll, Microsoft Corporation>
[MUWebControl Class]
{6E32070A-766D-4EE6-879C-DC1FA91D2FC3} <C:\WINNT\system32\muweb.dll, Microsoft Corporation>
[MsnMessengerSetupDownloadControl Class]
{B38870E4-7ECB-40DA-8C6A-595F0A5519FF} <C:\WINNT\Downloaded Program Files\MsnMessengerSetupDownloader.ocx, Microsoft Corporation>
[clienttime.client]
{C5D0DFF5-6D39-4F98-88CD-12E8430A6300} <C:\WINNT\Downloaded Program Files\client.ocx, NTSC>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[Rising Web Scan Object]
{E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINNT\Downloaded Program Files\OL2005.dll, Beijing Rising Tech. Co., Ltd.>
[&使用迅雷下载]
<C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
<C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>

mxhok - 2006-8-6 15:04:00

==================================
正在运行的进程
[PID: 236][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.00.2195.6601>
[PID: 200][\??\C:\WINNT\system32\csrss.exe] <Microsoft Corporation><5.00.2195.6601>
[PID: 156][\??\C:\WINNT\system32\winlogon.exe] <Microsoft Corporation><5.00.2195.6997>
[C:\WINNT\system32\almxgina.dll] <SIEMENS AG><K600.203.1301.16-Debug>
[C:\WINNT\system32\Ati2evxx.dll] <ATI Technologies Inc.><6.14.10.4110>
[PID: 132][C:\WINNT\system32\services.exe] <Microsoft Corporation><5.00.2195.7035>
[C:\WINNT\system32\dmserver.dll] <VERITAS Software Corp.><2195.6605.297.3>
[PID: 128][C:\WINNT\system32\lsass.exe] <Microsoft Corporation><5.00.2195.7011>
[PID: 360][C:\WINNT\system32\ibmpmsvc.exe] <N/A><N/A>
[PID: 444][c:\program files\rising\rfw\rfwproxy.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 14>
[c:\program files\rising\rfw\RfwRule.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 13>
[c:\program files\rising\rfw\MonMid.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 2>
[PID: 468][C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 484][C:\Program Files\Rising\Rav\Ravmond.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 33>
[C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\RsLog.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20>
[C:\Program Files\Rising\Rav\HOOKSYS.dll] <Beijing Rising Technology Co., Ltd.><18, 1, 0, 11>
[C:\Program Files\rising\Rav\Scanner.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30>
[C:\Program Files\rising\Rav\libload.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[C:\Program Files\rising\Rav\VirusLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[C:\Program Files\Rising\Rav\regmon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[C:\Program Files\Rising\Rav\HookWeb.dll] <rising><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\MemMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[C:\Program Files\Rising\Rav\expscan.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
[C:\Program Files\Rising\Rav\MailMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[C:\Program Files\rising\Rav\SpamEng.dll] <N/A><18, 0, 0, 6>
[C:\Program Files\rising\Rav\engine.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30>
[C:\Program Files\rising\Rav\PostTrt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
[C:\Program Files\rising\Rav\UnExe.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\rising\Rav\ScanExec.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\rising\Rav\ScanEx.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 14>
[C:\Program Files\rising\Rav\NvFile.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
[C:\Program Files\rising\Rav\ScanMac.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
[C:\Program Files\rising\Rav\ScanSct.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 18>
[C:\Program Files\rising\Rav\ExtOLE.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[C:\Program Files\rising\Rav\Unpacker.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[C:\Program Files\rising\Rav\ExtFile.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[C:\Program Files\rising\Rav\ScanElf.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 504][c:\program files\rising\rfw\rfwsrv.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 32>
[c:\program files\rising\rfw\RfwRule.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 13>
[c:\program files\rising\rfw\rfwlog.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 6>
[c:\program files\rising\rfw\Rfwdrv.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 21>
[c:\program files\rising\rfw\MonDrv.dll] <rs><1, 0, 0, 4>
[c:\program files\rising\rfw\ProcLib.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 9>
[PID: 604][C:\WINNT\system32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[PID: 640][C:\WINNT\system32\spoolsv.exe] <Microsoft Corporation><5.00.2195.7059>
[C:\WINNT\system32\AdobePDF.dll] <Adobe Systems Incorporated.><7.0.0.00>
[C:\Program Files\Adobe\Acrobat Pro 7.0\Distillr\AdistRes.CHS] <N/A><N/A>
[C:\WINNT\system32\DWFPortMon3.dll] <Autodesk, Inc.><3.1.0.234>
[C:\WINNT\system32\CNMLM6e.DLL] <CANON INC.><1.80.2.50>
[C:\WINNT\system32\OLFMNT40.DLL] <Microsoft Corporation><9.0.98.0105>
[C:\WINNT\system32\spool\PRTPROCS\W32X86\CNMPD6e.DLL] <CANON INC.><1.80.2.50>
[C:\WINNT\system32\spool\PRTPROCS\W32X86\olfpnt40.dll] <Microsoft Corporation><9.0.98.0105>
[C:\WINNT\system32\spool\PRTPROCS\W32X86\vprproc.dll] <Windows (R) 2000 DDK provider><5.00.2195.1620>

mxhok - 2006-8-6 15:05:00

[PID: 684][C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe] <Autodesk><2.66.000>
[PID: 748][C:\Program Files\Rising\Rav\RavStub.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 820][C:\WINNT\System32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[PID: 844][C:\WINNT\System32\WBEM\WinMgmt.exe] <Microsoft Corporation><1.50.1085.0100>
[PID: 940][C:\Program Files\Siemens\Common\sws\almsrv\almsrvx.exe] <SIEMENS AG><V02.00.00.00_01.16.00.01 release>
[C:\Program Files\Siemens\Common\SWS\PlugIns\SCP\almpgiscp2x.dll] <SIEMENS AG><V02.00.00.00_01.16.00.01 release>
[C:\Program Files\Siemens\Common\SWS\PlugIns\SCP\Scpw32.dll] <SCPW32><V1.0.1.18>
[C:\Program Files\Siemens\Common\SWS\PlugIns\SCP\ScpBw32.dll] <SCPBW32><V1.0.1.25>
[C:\Program Files\Siemens\Common\SWS\PlugIns\SCP\Rslibw32.dll] <RSLIBW32><V1.0.2.15>
[PID: 940][C:\WINNT\system32\ntvdm.exe] <Microsoft Corporation><5.00.2195.7011>
[C:\Program Files\Siemens\Common\SWS\PlugIns\SCP\almpgiscp3x.dll] <SIEMENS AG><V02.00.00.00_01.16.00.01 release>
[C:\Program Files\Siemens\Common\SWS\PlugIns\SCP\zlibwapi.dll] <N/A><1.2.1.0>
[C:\Program Files\Siemens\Common\SWS\PlugIns\SCP\Scpws3.dll] <SCPW32><V1.0.2.40>
[C:\Program Files\Siemens\Common\SWS\PlugIns\SCP\ScpBws3.dll] <SCPBW32><V1.0.2.39>
[C:\Program Files\Siemens\Common\SWS\almsrv\almpersistencemanagerx.dll] <SIEMENS AG><V02.00.00.00_01.16.00.01 release>
[PID: 1068][C:\WINNT\Explorer.EXE] <Microsoft Corporation><5.00.3700.6690>
[C:\WINNT\system32\AcSignIcon.dll] <Autodesk><16.2.54.0>
[C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] <Autodesk><16.2.54.0>
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll] <Adobe Systems, Inc.><7.0.0.0>
[C:\WINNT\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[C:\WINNT\system32\xunleibho_v14.dll] <Thunder Networking Technologies,LTD><4, 6, 0, 62>
[C:\Program Files\Thunder Network\Thunder\ComDlls\XUNLEIBHO_002.dll] <Thunder Networking Technologies,LTD><5, 0, 0, 2>
[C:\Program Files\rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Tencent\QQ\TMDlls\qdshm.dll] <><1, 0, 1, 2>
[C:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[C:\Program Files\rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Siemens\Common\ACE\Bin\CCDiagnosis.dll] <SIEMENS AG><K06.00.02.03_01.01.00.06 release>
[C:\Program Files\Common Files\Autodesk Shared\dwf Common\DWFShellExtension.dll] <Autodesk, Inc.><1.1.0.340>
[C:\Program Files\Common Files\Autodesk Shared\dwf Common\DWFShellExtensionRes.dll] <Autodesk, Inc.><1.1.0.340>
[C:\Program Files\Adobe\Acrobat Pro 7.0\Acrobat Elements\ContextMenu.dll] <Adobe Systems Inc.><7.0.0.2004121400\0>
[C:\Program Files\Adobe\Acrobat Pro 7.0\Acrobat Elements\ContextMenu.chs] <Adobe Systems Inc.><7.0.0.2004121400\0>
[PID: 1328][c:\program files\rising\rfw\RfwMain.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 51>
[c:\program files\rising\rfw\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23>
[c:\program files\rising\rfw\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[c:\program files\rising\rfw\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 1272][C:\WINNT\SOUNDMAN.EXE] <Realtek Semiconductor Corp.><5.1.0.22>
[PID: 296][C:\Program Files\Synaptics\SynTP\SynTPLpr.exe] <Synaptics, Inc.><7.2.3.10 24Jun03>
[C:\WINNT\system32\SynTPFcs.dll] <Synaptics, Inc.><7.2.3.10 24Jun03>
[PID: 1208][C:\Program Files\rising\Rav\RavTask.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
[C:\Program Files\rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Program Files\rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[PID: 1232][C:\Program Files\rising\Rav\Ravmon.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 30>
[C:\Program Files\rising\Rav\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 24>
[C:\Program Files\rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[C:\Program Files\rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Program Files\rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Program Files\rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 1236][C:\WINNT\system32\internat.exe] <Microsoft Corporation><5.00.2920.0000>
[PID: 1432][C:\WINNT\system32\conime.exe] <Microsoft Corporation><5.00.2195.6655>
[PID: 1404][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2800.1106>
[C:\WINNT\system32\KakaTool.dll] <Beijing Rising Technology Co., Ltd.><2, 0, 0, 9>
[C:\WINNT\system32\AcSignIcon.dll] <Autodesk><16.2.54.0>
[C:\WINNT\system32\xunleibho_v14.dll] <Thunder Networking Technologies,LTD><4, 6, 0, 62>
[C:\Program Files\Thunder Network\Thunder\ComDlls\XUNLEIBHO_002.dll] <Thunder Networking Technologies,LTD><5, 0, 0, 2>
[C:\Program Files\rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 620][F:\Rav2006\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINNT\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

瑞星卡卡安全论坛