【求助】电脑出问题了..高手请来帮忙解决... bbs.ikaka.com

XX号病毒 - 2006-8-18 18:11:00

我一运行迅雷.或者QQ音乐QQ直播.就发生下面这种情况..一边一直弹出对话框C:\DOCUME-1\LOCALS-1\Temp\gold.com(提示无法访问设备..没有什么合适的的访问权限),一边瑞星监控不断的发现病素.其实也就这么两种..弹来弹去...杀又杀不掉......然后我系统还原也试过..好像..连系统还原都给禁了..还原过好几个不同的还原点..不过最后都提示没还原成功...请问一下..各位高手大哥..怎么解决这个问题..
图没地方上传....郁闷.............

病毒名称处理结果发现日期扫描方式路径文件病毒来源
Trojan.Delf.azf 删除成功 2006-08-01 14:51 手动扫描 C:\Documents and Settings\Administrator\Local Settings\Application Data\3721TRQua\AdWare\AdWare.Win32.AdMoke.b Skymmstp017.exe.malicious 本机
Trojan.PSW.Lineage.wv 删除成功 2006-08-01 14:51 手动扫描 C:\Documents and Settings\Administrator\Local Settings\Application Data\3721TRQua\Trojan-PSW\Trojan-PSW.Win32.Lineage.abd_1 dllz.dll.1.malicious 本机
Trojan.PSW.Lineage.wv 删除成功 2006-08-01 14:51 手动扫描 C:\Documents and Settings\Administrator\Local Settings\Application Data\3721TRQua\Trojan-PSW\Trojan-PSW.Win32.Lineage.abd_1 dllz.dll.malicious 本机
Trojan.DL.Diyer.a 删除成功 2006-08-01 14:51 手动扫描 C:\Documents and Settings\Administrator\Local Settings\Temp 2090.exe>>tool.exe 本机
Trojan.DL.AdLoad.gw 删除成功 2006-08-01 14:51 手动扫描 C:\Documents and Settings\Administrator\Local Settings\Temp Skymmstp039.exe 本机
Dropper.Agent.bmg 删除成功 2006-08-01 14:51 手动扫描 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1QIYWUMZ bdcjins[1].exe 本机
Dropper.Agent.bmg 删除成功 2006-08-01 14:52 手动扫描 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6JUV6TUR s_bdextinsU217[1].exe 本机
Trojan.DL.Diyer.a 删除成功 2006-08-01 14:52 手动扫描 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\A9ZO1GJU 2090[1].exe>>tool.exe 本机
Trojan.DL.Delf.cbr 删除成功 2006-08-01 14:53 手动扫描 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\CXCVK38R sefInstall039[1].txt>>Setup_L0029.exe>>Unpack 本机
Trojan.DL.Agent.jpe 删除成功 2006-08-01 14:53 手动扫描 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\CXCVK38R sefInstall039[1].txt>>AutoDownTool.exe 本机
Trojan.DL.Diyer.a 删除成功 2006-08-01 14:53 手动扫描 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\CXCVK38R sefInstall039[1].txt>>caishow.exe>>tool.exe 本机
Dropper.Misc.an 删除成功 2006-08-01 14:53 手动扫描 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\CXCVK38R sefInstall039[1].txt>>WIS293.exe 本机
Trojan.DL.AdLoad.gw 删除成功 2006-08-01 14:54 手动扫描 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\QXC3YTQ5 Skymmstp039[1].exe 本机
Trojan.PSW.Lineage.wv 删除成功 2006-08-01 15:00 手动扫描 C:\WINDOWS\system32 dllz.dll.malicious 本机
Trojan.DL.QQHelper.dsb 删除成功 2006-08-01 15:01 手动扫描 C:\WINDOWS\system32 res.exe 本机
Trojan.DL.QQHelper.gen 删除成功 2006-08-01 15:01 手动扫描 C:\WINDOWS\system32 rhnk.dll 本机
Trojan.DL.QQHelper.eo 删除成功 2006-08-01 15:01 手动扫描 C:\WINDOWS\system32\wbem setup5.exe 本机
Trojan.DL.QQHelper.ep 删除成功 2006-08-01 15:07 手动扫描 E:\浩方对战平台 bind_8468.exe 本机
Trojan.DL.Agent.htu 删除成功 2006-08-01 15:07 手动扫描 E:\浩方对战平台 cgamop.exe 本机
Trojan.DL.Agent.eqv 删除成功 2006-08-01 15:07 手动扫描 E:\浩方对战平台 zt.exe 本机
Trojan.PSW.Lmir.jly 删除成功 2006-08-01 15:11 手动扫描 F:\外挂\[传奇2]及时雨PKV7.66版 JSY.ExE 本机
Trojan.Clicker.Qhost.i 删除成功 2006-08-02 11:15 定时扫描 C:\Documents and Settings\Administrator\Local Settings\Application Data\3721TRQua\AdWare\AdWare.Win32.NewWeb.e WinSC32.dll.malicious 本机
Trojan.PSW.Lmir.ksz 删除成功 2006-08-02 11:16 定时扫描 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1QIYWUMZ mir2[1].exe>>svchost.exe 本机
Trojan.PSW.Lineage.kzj 清除成功 2006-08-07 13:19 手动扫描 ctfmon.exe>>C:\WINDOWS\system32\dllz.dll 本机
Trojan.PSW.Lineage.kzj 清除成功 2006-08-07 13:19 手动扫描 Explorer.EXE>>C:\WINDOWS\system32\dllz.dll 本机
Trojan.PSW.Lineage.kzj 清除成功 2006-08-07 13:19 手动扫描 msime.exe>>C:\WINDOWS\system32\dllz.dll 本机
Trojan.PSW.Lineage.kzj 清除成功 2006-08-07 13:19 手动扫描 yassistse.exe>>C:\WINDOWS\system32\dllz.dll 本机
Trojan.PSW.Lineage.kzj 清除成功 2006-08-07 13:19 手动扫描 Rundll32.exe>>C:\WINDOWS\system32\dllz.dll 本机
Trojan.PSW.Lineage.kzj 清除成功 2006-08-07 13:19 手动扫描 Rundll32.exe>>C:\WINDOWS\system32\dllz.dll 本机
Trojan.PSW.Lineage.kzj 清除成功 2006-08-07 13:19 手动扫描 RavTask.exe>>C:\WINDOWS\system32\dllz.dll 本机
Trojan.Clicker.Agent.acp 删除成功 2006-08-07 13:25 手动扫描 C:\WINDOWS KB910436.log>>Unpack 本机
Trojan.PSW.Lmir.ktw 删除成功 2006-08-07 13:27 手动扫描 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\CH2Z4D2B wol[1].exe 本机
Trojan.DL.QQHelper.eba 删除成功 2006-08-07 13:29 手动扫描 C:\WINDOWS\system32 res.exe 本机
Trojan.PSW.Lineage.kzj 清除成功 2006-08-07 13:34 手动扫描 Rundll32.exe>>C:\WINDOWS\system32\dllz.dll 本机
Trojan.PSW.Lineage.kzj 清除成功 2006-08-07 23:30 手动扫描 DATA0002.EXE>>C:\WINDOWS\system32\dllz.dll 本机
Trojan.PSW.ZhengTu.ey 重新启动计算机后删除文件 2006-08-07 23:30 手动扫描 C:\Documents and Settings\Administrator\Local Settings\Temp DATA0000.EXE.malicious 本机
Trojan.PSW.Lineage.kxi 删除成功 2006-08-07 23:30 手动扫描 C:\Documents and Settings\Administrator\Local Settings\Temp DATA0002.EXE>>VEUnpackFile 本机
Trojan.PSW.ZhengTu.ey 删除成功 2006-08-07 23:35 手动扫描 C:\Program Files svhost32.exe 本机
Trojan.PSW.ZhengTu.ct 重新启动计算机后删除文件 2006-08-08 00:00 手动扫描 C:\WINDOWS\system32 ztdll.dll 本机
Trojan.PSW.ZhengTu.ct 重新启动计算机后删除文件 2006-08-08 00:00 手动扫描 C:\WINDOWS\system32 ztdll.dll 本机
Trojan.PSW.Lineage.kzj 清除成功 2006-08-08 00:09 手动扫描 Ati2evxx.exe>>C:\WINDOWS\system32\dllz.dll 本机
Trojan.PSW.Lineage.kzj 清除成功 2006-08-08 00:09 手动扫描 Explorer.EXE>>C:\WINDOWS\system32\dllz.dll 本机
Trojan.PSW.Lineage.kzj 清除成功 2006-08-08 00:09 手动扫描 ctfmon.exe>>C:\WINDOWS\system32\dllz.dll 本机
Trojan.PSW.Lineage.kzj 清除成功 2006-08-08 00:09 手动扫描 msime.exe>>C:\WINDOWS\system32\dllz.dll 本机
Trojan.PSW.Lineage.kzj 清除成功 2006-08-08 00:09 手动扫描 rundll32.exe>>C:\WINDOWS\system32\dllz.dll 本机
Trojan.PSW.Lineage.kzj 清除成功 2006-08-08 00:09 手动扫描 YLive.exe>>C:\WINDOWS\system32\dllz.dll 本机
Trojan.PSW.Lineage.kzj 清除成功 2006-08-08 00:09 手动扫描 yassistse.exe>>C:\WINDOWS\system32\dllz.dll 本机
Trojan.PSW.Lineage.kzj 清除成功 2006-08-08 00:09 手动扫描 Rundll32.exe>>C:\WINDOWS\system32\dllz.dll 本机
Trojan.PSW.Lineage.kzj 清除成功 2006-08-08 00:09 手动扫描 Rundll32.exe>>C:\WINDOWS\system32\dllz.dll 本机
Trojan.PSW.Lineage.kzj 清除成功 2006-08-08 00:09 手动扫描 RavTask.exe>>C:\WINDOWS\system32\dllz.dll 本机
Trojan.PSW.Lineage.kzj 清除成功 2006-08-08 00:09 手动扫描 TTPlayer.exe>>C:\WINDOWS\system32\dllz.dll 本机
Trojan.PSW.Lineage.kzp 删除成功 2006-08-12 12:15 定时扫描 C: 0.bak 本机
Trojan.PSW.ZhengTu.dk 删除成功 2006-08-12 12:15 定时扫描 C: 1.bak 本机
Trojan.DL.Inject.ph 删除成功 2006-08-12 12:18 定时扫描 C:\Program Files\Common Files\System afbci.dat 本机
Dropper.Lmir.mtr 删除成功 2006-08-12 12:23 定时扫描 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\CH2Z4D2B jwm[1].exe 本机
Trojan.PSW.Lineage.kzp 删除成功 2006-08-12 12:24 定时扫描 C:\WINDOWS\system32 dllz.dll.malicious 本机
Trojan.DL.Agent.kvl 清除成功 2006-08-18 13:33 手动扫描 pp4.exe>>C:\Program Files\Common Files\update\pp4.exe 本机
Trojan.DL.Delf.csh 删除成功 2006-08-18 13:33 手动扫描 C:\Documents and Settings\Administrator\Local Settings\Temp g0ld.com 本机
Trojan.PSW.ZhengTu.et 删除成功 2006-08-18 13:34 手动扫描 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\2M7JP8NV rx[1].exe>>VEUnpackFile 本机
Trojan.DL.Delf.csh 删除成功 2006-08-18 13:34 手动扫描 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\8JH4BGSB rpp[1].exe 本机
Trojan.DL.Agent.kvl 删除成功 2006-08-18 13:34 手动扫描 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\D0CZ64DF aichong[1].exe 本机
Trojan.PSW.WoWar.hx 删除成功 2006-08-18 13:35 手动扫描 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\D0CZ64DF cq9[1].exe 本机
Trojan.PSW.WoWar.hi 重新启动计算机后删除文件 2006-08-18 13:35 手动扫描 C: nxldr.dat 本机
Trojan.DL.Agent.kvl 删除成功 2006-08-18 13:37 手动扫描 C:\Program Files\Common Files\update pp4.exe 本机
Trojan.PSW.ZhengTu.et 删除成功 2006-08-18 13:37 手动扫描 C:\Program Files\Common Files\update pp6.exe>>VEUnpackFile 本机
Trojan.DL.Delf.csh 删除成功 2006-08-18 13:37 手动扫描 C:\Program Files\Common Files\update update.exe 本机
Trojan.Agent.drf 删除成功 2006-08-18 13:39 手动扫描 C:\WINDOWS\inet20003 Icq.exe.bak 本机
Trojan.Agent.drg 删除成功 2006-08-18 13:39 手动扫描 C:\WINDOWS\inet20003 select.exe.bak 本机
Rootkit.CallGate.a 重新启动计算机后删除文件 2006-08-18 13:42 手动扫描 C:\WINDOWS\system32\drivers ksld.sys 本机
Trojan.PSW.WoWar.hi 删除成功 2006-08-18 13:42 手动扫描 C:\WINDOWS\system32 KB8964225.log 本机
Trojan.PSW.WoWar.hx 删除成功 2006-08-18 13:43 手动扫描 C:\WINDOWS\system32 update4.exe 本机
Trojan.PSW.WoWar.hi 重新启动计算机后删除文件 2006-08-18 13:55 手动扫描 C: nxldr.dat 本机
Trojan.DL.Delf.csh 删除成功 2006-08-18 15:36 手动扫描 C:\Documents and Settings\Administrator\Local Settings\Temp g0ld.com 本机
Trojan.PSW.LMir.atc 删除成功 2006-08-18 15:36 手动扫描 C:\Documents and Settings\Administrator\Local Settings\Temp Win10.exe 本机
Trojan.PSW.LMir.atc 删除成功 2006-08-18 15:36 手动扫描 C:\Documents and Settings\Administrator\Local Settings\Temp Win16.exe 本机
Trojan.PSW.LMir.atc 删除成功 2006-08-18 15:37 手动扫描 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\D0CZ64DF c[1].gif 本机
Trojan.DL.Delf.csh 删除成功 2006-08-18 15:37 手动扫描 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\D0CZ64DF rpp[1].exe 本机
Trojan.PSW.LMir.atc 删除成功 2006-08-18 15:38 手动扫描 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ZD17IAQ9 c[1].gif 本机
Trojan.PSW.LMir.atc 删除成功 2006-08-18 15:38 手动扫描 C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\C9WHQZ8Z c[1].gif 本机
Trojan.DL.Delf.csh 删除成功 2006-08-18 16:49 手动扫描 C:\Documents and Settings\Administrator\Local Settings\Temp g0ld.com 本机
Trojan.DL.Delf.csh 删除成功 2006-08-18 16:49 手动扫描 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\2M7JP8NV rpp[1].exe 本机
Trojan.DL.Delf.csh 删除成功 2006-08-18 16:49 手动扫描 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ZD17IAQ9 rpp[1].exe 本机
这是导出的历史记录.........
没图..不好描述..各位高手大哥..这样看不出来..加我QQ80821969...帮我解决一下..不盛感激.............

附件: 7323072006818180320.jpg

XX号病毒 - 2006-8-18 18:13:00

...就是这样的..

附件: 7323072006818180503.jpg

XX号病毒 - 2006-8-18 18:14:00

..........帮忙解决一下..

附件: 7323072006818180614.jpg

mopery - 2006-8-18 18:21:00

安全模式下清空
IE临时文件夹...

回正常模式后..

http://forum.ikaka.com/topic.asp?board=28&artid=6979213第4楼下载System Repair Engineer导出全部日志

附件: 6323982006818181350.JPG

XX号病毒 - 2006-8-18 18:32:00

谢谢大哥...先去试试了..

XX号病毒 - 2006-8-18 18:53:00

2006-08-18,18:40:37

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<CnsMin><Rundll32.exe C:\WINDOWS\downlo~1\CnsMin.dll,Rundll32> [北京三七二一科技有限公司]
<Thunder><G:\Thunder\Thunder.exe /s> [Thunder Networking Technologies,LTD]
<RavTask><"G:\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<helper.dll><C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32> []
<YLive.exe><rem C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe> [Yahoo! China]
<yassistse><"C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"> [Yahoo! China]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<RavStub><"G:\Rising\Rav\ravstub.exe" /RUNONCE> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{D157330A-9EF3-49F8-9A67-4141AC41ADD4}><C:\WINDOWS\downlo~1\CnsHook.dll> [北京三七二一科技有限公司]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
<WinlogonNotify: AtiExtEvent><Ati2evxx.dll> []

==================================
启动文件夹
[腾讯QQ]
<C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\腾讯QQ.lnk><N>

==================================
服务
[Ati HotKey Poller / Ati HotKey Poller]
<C:\WINDOWS\system32\Ati2evxx.exe><N/A>
[ATI Smart / ATI Smart]
<C:\WINDOWS\system32\ati2sgag.exe><>
[Performance Moniter / DATEING]
<C:\WINDOWS\SYSTEM32\RUNDLL32.EXE C:\WINDOWS\SYSTEM32\WBEM\IRJIT.DLL,Export 1087><N/A>
[InstallDriver Table Manager / IDriverT]
<"C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe"><Macrovision Corporation>
[M2BBS_DB / M2BBS_DB]
<C:\M2BBS\MySQL\bin\mysqld-nt --defaults-file=C:\M2BBS\MYSQL\my.ini M2BBS_DB><N/A>
[M2BBS_HTTP / M2BBS_HTTP]
<"C:\M2BBS\Apache\bin\Apache.exe" -k runservice><N/A>
[Rising Process Communication Center / RsCCenter]
<G:\RISING\RAV\CCENTER.EXE><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
<"G:\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>

==================================
浏览器加载项
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v14.dll, Thunder Networking Technologies,LTD>
[Yahoo!Photo]
{33BBE430-0E42-4f12-B075-8D21ACB10DCB} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll, Yahoo! China>
[AntiFish Class]
{38928D50-8A48-44C2-945F-D2F23F771410} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll, yahoo! china>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <F:\腾讯\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[DragSearch BHO]
{62EED7C6-9F02-42f9-B634-98E2899E147B} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL, yahoo! china>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <G:\Thunder\ComDlls\XunLeiBHO_001.dll, Thunder Networking Technologies,LTD>
[Schedule Class]
{8B316DA1-9950-4926-B9EA-1AEC124AFA45} <C:\WINDOWS\system32\sscli.dll, >
[CnsHook Class]
{D157330A-9EF3-49F8-9A67-4141AC41ADD4} <C:\WINDOWS\downlo~1\CnsHook.dll, 北京三七二一科技有限公司>
[assist]
{FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yassist.dll, Yahoo! China>
[浩方对战平台]
{0A155D3C-68E2-4215-A47A-E800A446447A} <E:\浩方对战平台\GameClient.exe, 上海浩方在线信息技术有限公司>
[Yahoo 1G电邮]
{507F9113-CD77-4866-BA92-0E86DA3D0B97} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail, N/A>
[寻宝乐趣多]
{59BC54A2-56B3-44a0-93E5-432D58746E26} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao, N/A>
[雅虎助手]
{5D73EE86-05F1-49ed-B850-E423120EC338} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <F:\腾讯\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <F:\腾讯\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[情景聊天]
{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg, N/A>
[]
{ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair, N/A>
[]
{FD00D911-7529-4084-9946-A29F1BDF4FE5} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean, N/A>
[雅虎助手]
{406F94F0-504F-4a40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll, yahoo! china>
[MMCPlayer Class]
{05C1004E-2596-48E5-8E26-39362985EEB9} <C:\WINDOWS\Downloaded Program Files\MMCShell.dll, Sohu.com Inc.>
[AddSHCARoot Control]
{098A3F72-3110-4004-B954-2F9DC44934B4} <C:\WINDOWS\DOWNLO~1\ADDCAR~1.OCX, SHECA>
[PowerPlr Control]
{2354A44B-3CEB-4829-9940-545B03103538} <C:\WINDOWS\DOWNLO~1\PowerPlr.ocx, Powerise Digital>
[updatePanelX Control]
{43E839C5-E10F-443A-BC1F-F09CFD2ABC77} <G:\CCTV\updateC.ocx, uusee>
[V3PROXL Control]
{733652F9-53EF-4BF1-B391-375980675D6F} <C:\WINDOWS\DOWNLO~1\CONFLICT.1\v3proxl.ocx, Ahnlab, Inc.>
[SysMonOCX Control]
{9BDBC41E-C335-4263-83C0-ECE78EE28A33} <C:\WINDOWS\DOWNLO~1\SYSMON~1.OCX, AhnLab>
[PhotoUploadCtrl Control]
{A96C48EA-AA88-4BBD-B58C-7B41146A6EAC} <F:\腾讯\QZone\PHOTOU~1.OCX, tencent>
[photo_uploader Control]
{A984ED9F-E8DA-44E5-BC18-C14B9ABEF79D} <C:\WINDOWS\DOWNLO~1\PHOTO_~1.OCX, N/A>
[WebActivater Control]
{C661F36D-DF85-4EF4-83C7-E107B83D04B1} <C:\WINDOWS\system32\3DShowVM.ocx, QQ>
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v14.dll, Thunder Networking Technologies,LTD>
[Yahoo!Photo]
{33BBE430-0E42-4F12-B075-8D21ACB10DCB} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll, Yahoo! China>
[AntiFish Class]
{38928D50-8A48-44C2-945F-D2F23F771410} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll, yahoo! china>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <F:\腾讯\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>

XX号病毒 - 2006-8-18 18:55:00

[DragSearch BHO]
{62EED7C6-9F02-42F9-B634-98E2899E147B} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL, yahoo! china>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <G:\Thunder\ComDlls\XunLeiBHO_001.dll, Thunder Networking Technologies,LTD>
[Schedule Class]
{8B316DA1-9950-4926-B9EA-1AEC124AFA45} <C:\WINDOWS\system32\sscli.dll, >
[CnsHook Class]
{D157330A-9EF3-49F8-9A67-4141AC41ADD4} <C:\WINDOWS\downlo~1\CnsHook.dll, 北京三七二一科技有限公司>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[assist]
{FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yassist.dll, Yahoo! China>
[&使用迅雷下载]
<G:\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
<G:\Thunder\Program\GetAllUrl.htm, N/A>
[上传到QQ网络硬盘]
<F:\腾讯\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
<F:\腾讯\AddPanel.htm, N/A>
[添加到QQ表情]
<F:\腾讯\AddEmotion.htm, N/A>
[添加到雅虎订阅(&Y)]
<res://C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yrss.dll/YRSSMENUEXT, N/A>
[用QQ彩信发送该图片]
<F:\腾讯\SendMMS.htm, N/A>
[雅虎搜索]
<res://C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll/203, N/A>

==================================
正在运行的进程
[PID: 788][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 844][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 868][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\Ati2evxx.dll] <N/A><N/A>
[PID: 916][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 928][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1076][C:\WINDOWS\system32\Ati2evxx.exe] <N/A><N/A>
[PID: 1100][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1188][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1344][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1432][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1604][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1656][G:\RISING\RAV\CCENTER.EXE] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 1672][G:\Rising\Rav\Ravmond.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 33>
[G:\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[G:\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[G:\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[G:\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[G:\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[G:\Rising\Rav\RsLog.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20>
[G:\Rising\Rav\HOOKSYS.dll] <Beijing Rising Technology Co., Ltd.><18, 1, 0, 11>
[G:\Rising\Rav\Scanner.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30>
[G:\Rising\Rav\libload.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[G:\Rising\Rav\VirusLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
[G:\Rising\Rav\regmon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[G:\Rising\Rav\HookWeb.dll] <rising><18, 0, 0, 2>
[G:\Rising\Rav\MemMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[G:\Rising\Rav\expscan.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[G:\Rising\Rav\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
[G:\Rising\Rav\MailMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[G:\Rising\Rav\SpamEng.dll] <N/A><18, 0, 0, 6>
[G:\Rising\Rav\engine.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30>
[G:\Rising\Rav\PostTrt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
[G:\Rising\Rav\UnExe.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[G:\Rising\Rav\ScanExec.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[G:\Rising\Rav\ScanEx.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 14>
[G:\Rising\Rav\NvFile.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
[G:\Rising\Rav\ScanMac.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
[G:\Rising\Rav\ScanSct.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 18>
[G:\Rising\Rav\Unpacker.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[G:\Rising\Rav\ExtOLE.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[G:\Rising\Rav\ScanNet.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[G:\Rising\Rav\RsStore.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 1856][C:\WINDOWS\system32\Ati2evxx.exe] <N/A><N/A>
[C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 6>
[PID: 1908][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\downlo~1\CnsHook.dll] <北京三七二一科技有限公司><1, 0, 2, 7>
[C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 6>
[C:\PROGRA~1\3721\helper.dll] <><1, 1, 0, 1325>
[C:\PROGRA~1\3721\alrex.dll] <><1, 0, 1, 1001>
[C:\PROGRA~1\3721\AutoLive.dll] <><1, 1, 7, 1326>
[C:\WINDOWS\system32\xunleibho_v14.dll] <Thunder Networking Technologies,LTD><4, 6, 0, 62>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll] <Yahoo! China><3, 0, 1, 1001>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL] <yahoo! china><3, 0, 0, 1000>
[G:\Thunder\ComDlls\XunLeiBHO_001.dll] <Thunder Networking Technologies,LTD><5, 0, 0, 1>
[C:\WINDOWS\system32\sscli.dll] <><5, 0, 2195, 6696>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yassist.dll] <Yahoo! China><3, 0, 7, 1012>
[C:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\ywiper.dll] <Yahoo! China><3, 0, 1, 1001>
[E:\金山游侠\Tools\KVD\kscdrush.dll] <金山软件股份有限公司><5, 0, 0, 0>

XX号病毒 - 2006-8-18 18:55:00

[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[G:\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 1912][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 6>
[PID: 2008][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 184][C:\WINDOWS\system32\Rundll32.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 6>
[C:\WINDOWS\downlo~1\CnsMinIO.dll] <北京三七二一科技有限公司><1, 0, 3, 6>
[C:\WINDOWS\downlo~1\cnsio.dll] <北京三七二一科技有限公司><1, 0, 2, 7>
[C:\WINDOWS\downlo~1\CnsMinEx.dll] <国风因特软件(北京)有限公司><1, 0, 3, 1>
[PID: 364][G:\Rising\Rav\RavStub.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
[G:\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[G:\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 1788][C:\WINDOWS\SYSTEM32\RUNDLL32.EXE] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1796][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 892][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1340][G:\Rising\Rav\RavTask.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
[G:\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[G:\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[G:\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[G:\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 6>
[PID: 1384][C:\WINDOWS\system32\rundll32.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\PROGRA~1\3721\helper.dll] <><1, 1, 0, 1325>
[C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 6>
[C:\PROGRA~1\3721\AutoLive.dll] <><1, 1, 7, 1326>
[C:\Program Files\3721\Notifier.dll] <><1, 0, 0, 5>
[PID: 1440][G:\Rising\Rav\Ravmon.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 30>
[G:\Rising\Rav\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 24>
[G:\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[G:\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[G:\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[G:\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[G:\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[G:\Rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 6>
[C:\PROGRA~1\3721\helper.dll] <><1, 1, 0, 1325>
[PID: 1488][C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe] <Yahoo! China><3, 0, 0, 1001>
[C:\PROGRA~1\3721\helper.dll] <><1, 1, 0, 1325>
[C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 6>
[C:\PROGRA~1\Yahoo!\Assistant\shell\yAsMenu.dll] <Yahoo! China><3, 0, 0, 1001>
[C:\PROGRA~1\Yahoo!\Assistant\shell\yAssecblk.dll] <Yahoo! China><3, 0, 0, 1002>
[C:\PROGRA~1\Yahoo!\Assistant\shell\yIEAngel.dll] <Yahoo! China><3, 0, 0, 1000>
[C:\PROGRA~1\Yahoo!\Assistant\shell\yMenuInfo.dll] <Yahoo! China><3, 0, 0, 1000>
[PID: 2544][G:\rising\Rav\RsAgent.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
[C:\PROGRA~1\3721\helper.dll] <><1, 1, 0, 1325>
[C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 6>
[G:\rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[PID: 2564][C:\WINDOWS\msagent\AgentSvr.exe] <Microsoft Corporation><2.00.0.3422>
[C:\PROGRA~1\3721\helper.dll] <><1, 1, 0, 1325>
[C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 6>
[PID: 2740][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\PROGRA~1\3721\helper.dll] <><1, 1, 0, 1325>
[C:\PROGRA~1\3721\scrblock.dll] <3721><1, 0, 1, 1000>
[C:\PROGRA~1\3721\alrex.dll] <><1, 0, 1, 1001>
[C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 6>
[C:\WINDOWS\downlo~1\CnsHint.dll] <3721><1, 0, 0, 7>
[C:\PROGRA~1\3721\AutoLive.dll] <><1, 1, 7, 1326>
[C:\WINDOWS\downlo~1\cnsplus.dll] <3721><1, 0, 0, 2>
[C:\WINDOWS\system32\xunleibho_v14.dll] <Thunder Networking Technologies,LTD><4, 6, 0, 62>
[C:\WINDOWS\downlo~1\CnsHook.dll] <北京三七二一科技有限公司><1, 0, 2, 7>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll] <Yahoo! China><3, 0, 1, 1001>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll] <yahoo! china><3, 0, 1, 1002>
[F:\腾讯\QQIEHelper.dll] <深圳市腾讯计算机系统有限公司><1, 1, 0, 5>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL] <yahoo! china><3, 0, 0, 1000>
[G:\Thunder\ComDlls\XunLeiBHO_001.dll] <Thunder Networking Technologies,LTD><5, 0, 0, 1>
[C:\WINDOWS\system32\sscli.dll] <><5, 0, 2195, 6696>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yassist.dll] <Yahoo! China><3, 0, 7, 1012>
[C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx] <Macromedia, Inc.><8,0,22,0>
[PID: 2872][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\PROGRA~1\3721\helper.dll] <><1, 1, 0, 1325>
[C:\PROGRA~1\3721\scrblock.dll] <3721><1, 0, 1, 1000>
[C:\PROGRA~1\3721\alrex.dll] <><1, 0, 1, 1001>
[C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 6>
[C:\WINDOWS\downlo~1\CnsHint.dll] <3721><1, 0, 0, 7>
[C:\PROGRA~1\3721\AutoLive.dll] <><1, 1, 7, 1326>
[C:\WINDOWS\downlo~1\cnsplus.dll] <3721><1, 0, 0, 2>
[C:\WINDOWS\system32\xunleibho_v14.dll] <Thunder Networking Technologies,LTD><4, 6, 0, 62>
[C:\WINDOWS\downlo~1\CnsHook.dll] <北京三七二一科技有限公司><1, 0, 2, 7>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll] <Yahoo! China><3, 0, 1, 1001>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll] <yahoo! china><3, 0, 1, 1002>
[F:\腾讯\QQIEHelper.dll] <深圳市腾讯计算机系统有限公司><1, 1, 0, 5>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL] <yahoo! china><3, 0, 0, 1000>
[G:\Thunder\ComDlls\XunLeiBHO_001.dll] <Thunder Networking Technologies,LTD><5, 0, 0, 1>
[C:\WINDOWS\system32\sscli.dll] <><5, 0, 2195, 6696>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yassist.dll] <Yahoo! China><3, 0, 7, 1012>
[C:\WINDOWS\downlo~1\CnsMinIO.dll] <北京三七二一科技有限公司><1, 0, 3, 6>
[C:\WINDOWS\downlo~1\cnsio.dll] <北京三七二一科技有限公司><1, 0, 2, 7>
[C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx] <Macromedia, Inc.><8,0,22,0>
[G:\Thunder\ComDlls\ThunderAgent_001.dll] <Thunder Networking Technologies,LTD><1, 0, 0, 8>
[PID: 3612][C:\Documents and Settings\Administrator\桌面\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\PROGRA~1\3721\helper.dll] <><1, 1, 0, 1325>
[C:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 6>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

XX号病毒 - 2006-8-18 18:57:00

班竹..........瞧瞧..导出来了.........

XX号病毒 - 2006-8-18 19:32:00

......怎么就没人了...

瑞星卡卡安全论坛