瑞星卡卡安全论坛

首页 » 技术交流区 » 反病毒/反流氓软件论坛 » 呼叫猫哥^^我中的是变种？
郁闷的圈圈 - 2006-8-23 4:27:00
终于~终于看到前几天发现的病毒上了排行榜了~ Rootkit.CallGate.a
终于看到手工杀的帖子出来了。
可是我的似乎不一样呢，好像没有那个Ker开头的。猫哥在不？帮我看看？我是菜鸟呢。不一样不敢乱动。
图：


附件: 732570200682341944.jpg
郁闷的圈圈 - 2006-8-23 4:31:00
高手们都帮我看看哈~
自从中了这个毒，我是天天病毒杀不完~ 越杀越多，平均每天10个。
想按置顶帖里面那样删，又觉得似乎不一样。所以把图发上来了。各位高手帮小弟一把，先谢谢咯~
对了。另外附上日志，麻烦高手们帮我瞄瞄，看看有啥问题没~
小弟也跟着提高提高
郁闷的圈圈 - 2006-8-23 4:32:00
2006-08-23,04:22:46

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [Microsoft Corporation]
    <bgswitch><C:\WINDOWS\system32\bgswitch.exe>  []
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  []
    <run><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [Microsoft Corporation]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [Microsoft Corporation]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [Microsoft Corporation]
    <MSPY2002><C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC>  []
    <yassistse><"C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe">  [Yahoo! China]
    <CnsMin><Rundll32.exe C:\WINDOWS\DOWNLO~1\CnsMin.dll,Rundll32>  [北京三七二一科技有限公司]
    <intranet><C:\WINDOWS\system32\intranet.exe>  []
    <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll>  [Beijing Rising Technology Co., Ltd.]

==================================
启动文件夹
[星空极速]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\星空极速.lnk><N>
[Adobe Gamma Loader]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Gamma Loader.lnk><N>
[腾讯QQ]
  <C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\腾讯QQ.lnk><N>
郁闷的圈圈 - 2006-8-23 4:33:00
==================================
服务
[Rising Process Communication Center / RsCCenter]
  <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
  <"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[SoundMAX Agent Service / SoundMAX Agent Service (default)]
  <C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.>

==================================
浏览器加载项
[Yahoo!Photo]
  {33BBE430-0E42-4f12-B075-8D21ACB10DCB} <C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll, Yahoo! China>
[AntiFish Class]
  {38928D50-8A48-44C2-945F-D2F23F771410} <C:\Program Files\Yahoo!\Assistant\Assist\yAngling.dll, yahoo! china>
[雅虎助手]
  {406F94F0-504F-4a40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll, Yahoo!>
[VnetCookie Class]
  {4E83D567-4697-4F7B-B1F0-A513B01DB89A} <c:\PROGRA~1\chinanet\VNETTR~1.DLL, N/A>
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <E:\qq\QQIEHelper.dll, N/A>
[DragSearch BHO]
  {62EED7C6-9F02-42f9-B634-98E2899E147B} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL, yahoo! china>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <E:\xunlei\ComDlls\XUNLEIBHO_002.dll, Thunder Networking Technologies,LTD>
[Yahoo 3.5G电邮]
  {507F9113-CD77-4866-BA92-0E86DA3D0B97} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail, N/A>
[寻宝乐趣多]
  {59BC54A2-56B3-44a0-93E5-432D58746E26} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao, N/A>
[雅虎助手]
  {5D73EE86-05F1-49ed-B850-E423120EC338} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist, N/A>
[QQIEFloatBarCfgCmd Class]
  {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <E:\qq\QQIEHelper.dll, N/A>
[情景聊天]
  {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg, N/A>
[]
  {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair, N/A>
[]
  {FD00D911-7529-4084-9946-A29F1BDF4FE5} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean, N/A>
[雅虎助手]
  {406F94F0-504F-4a40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll, Yahoo!>
[MonitorURL Class]
  {08A312BB-5409-49FC-9347-54BB7D069AC6} <C:\PROGRA~1\DESKAD~1\deskipn.dll, N/A>
[Windows Media Player]
  {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
  {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[Yahoo!Photo]
  {33BBE430-0E42-4F12-B075-8D21ACB10DCB} <C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll, Yahoo! China>
[AntiFish Class]
  {38928D50-8A48-44C2-945F-D2F23F771410} <C:\Program Files\Yahoo!\Assistant\Assist\yAngling.dll, yahoo! china>
[雅虎助手]
  {406F94F0-504F-4A40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll, Yahoo!>
[VnetCookie Class]
  {4E83D567-4697-4F7B-B1F0-A513B01DB89A} <c:\PROGRA~1\chinanet\VNETTR~1.DLL, N/A>
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <E:\qq\QQIEHelper.dll, N/A>
[DragSearch BHO]
  {62EED7C6-9F02-42F9-B634-98E2899E147B} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL, yahoo! china>
[Active Desktop Mover]
  {72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
[MediaComm Class]
  {7670648D-461B-42AF-BDFE-46D26AF5EFF2} <E:\xunlei\Components\InMedia\MediaAddin07.dll, Thunder Networking Technologies,LTD>
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <E:\xunlei\ComDlls\XUNLEIBHO_002.dll, Thunder Networking Technologies,LTD>
[Microsoft Scriptlet Component]
  {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\Flash85.ocx, Macromedia, Inc.>
[assist]
  {FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yassist.dll, Yahoo! China>
[&使用迅雷下载]
  <E:\xunlei\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
  <E:\xunlei\Program\GetAllUrl.htm, N/A>
[上传到QQ网络硬盘]
  <E:\qq\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
  <E:\qq\AddPanel.htm, N/A>
[添加到QQ表情]
  <E:\qq\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <E:\qq\SendMMS.htm, N/A>
郁闷的圈圈 - 2006-8-23 4:34:00
==================================
正在运行的进程
[PID: 588][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 644][\??\C:\WINDOWS\system32\csrss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 668][\??\C:\WINDOWS\system32\winlogon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
[PID: 712][C:\WINDOWS\system32\services.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
[PID: 724][C:\WINDOWS\system32\lsass.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
[PID: 872][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
[PID: 960][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
[PID: 1060][C:\Program Files\Rising\Rav\CCenter.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 1076][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\System32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
[PID: 1172][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
[PID: 1320][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
[PID: 1444][C:\WINDOWS\Explorer.EXE]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
    [C:\WINDOWS\system32\RavExt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
    [E:\xunlei\ComDlls\XUNLEIBHO_002.dll]  <Thunder Networking Technologies,LTD><5, 0, 0, 2>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Common Files\Adobe\Shell\PSICON.DLL]  <Adobe Systems, Incorporated><7.0>
    [C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll]  <Yahoo! China><3, 0, 1, 1001>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll]  <Yahoo!><2, 1, 8, 1048>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL]  <yahoo! china><3, 0, 0, 1000>
[PID: 1616][C:\WINDOWS\system32\spoolsv.exe]  <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)>
    [C:\WINDOWS\system32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
[PID: 1984][C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe]  <Analog Devices, Inc.><3, 2, 6, 0>
[PID: 572][C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe]  <Yahoo! China><3, 0, 0, 1001>
    [C:\PROGRA~1\Yahoo!\Assistant\shell\yAssecblk.dll]  <Yahoo! China><3, 0, 0, 1002>
    [C:\PROGRA~1\Yahoo!\Assistant\shell\yMenuInfo.dll]  <Yahoo! China><3, 0, 0, 1000>
    [C:\PROGRA~1\Yahoo!\Assistant\shell\yIEAngel.dll]  <Yahoo! China><3, 0, 0, 1000>
    [C:\PROGRA~1\Yahoo!\Assistant\shell\yAsMenu.dll]  <Yahoo! China><3, 0, 0, 1001>
[PID: 608][C:\Program Files\Rising\Rav\RavTask.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [C:\Program Files\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
[PID: 356][C:\WINDOWS\system32\ctfmon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
[PID: 996][C:\Program Files\ChinaNet\VnetClient.exe]  <><2005, 11, 14, 1>
    [C:\Program Files\ChinaNet\Communicate.dll]  <0><2005, 3, 3, 1>
    [C:\Program Files\ChinaNet\DialModule.dll]  <GDCN><2005, 11, 15, 1>
    [C:\WINDOWS\system32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
    [C:\PROGRA~1\ChinaNet\CLIENT~1.DLL]  <><2004, 2, 28, 1>
    [C:\PROGRA~1\ChinaNet\PLUGIN~1.OCX]  <><2005, 7, 27, 1>
    [C:\PROGRA~1\ChinaNet\sign.dll]  <0><2004, 12, 1, 1>
    [C:\PROGRA~1\ChinaNet\PostPlug.dll]  <><2004, 12, 16, 2>
    [C:\PROGRA~1\ChinaNet\ADVERT~1.OCX]  <><2005, 10, 13, 1>
    [C:\PROGRA~1\ChinaNet\Gif89a.dll]  <><2005, 6, 21, 1>
    [C:\PROGRA~1\ChinaNet\VnetBs.ocx]  <><2004, 11, 18, 1>
    [C:\PROGRA~1\ChinaNet\ACCOUN~2.DLL]  <><2005, 11, 14, 1>
    [C:\PROGRA~1\ChinaNet\AccountMgr.dll]  <><2005, 11, 14, 17>
    [C:\PROGRA~1\ChinaNet\VnetSkin.ocx]  <GDDC><2005, 11, 14, 1>
    [C:\PROGRA~1\ChinaNet\DialogStyle.dll]  <><1, 0, 0, 1>
    [C:\PROGRA~1\ChinaNet\Timer.ocx]  <><2005, 10, 9, 14>
    [C:\PROGRA~1\ChinaNet\PLUGIN~2.OCX]  <><2005, 2, 24, 1>
    [C:\PROGRA~1\ChinaNet\NEWMES~1.DLL]  <><2005, 8, 26, 1>
    [C:\PROGRA~1\ChinaNet\PassCtrl.dll]  <><1, 0, 0, 1>
    [C:\PROGRA~1\ChinaNet\PlugPush.dll]  <><2004, 12, 21, 1>
    [C:\PROGRA~1\ChinaNet\ALLINT~1.DLL]  <><2004, 11, 23, 1>
    [C:\PROGRA~1\ChinaNet\VNetLog.ocx]  <><2005, 10, 9, 1>
    [C:\PROGRA~1\ChinaNet\StatNum.dll]  <><2004, 11, 18, 1>
    [C:\PROGRA~1\ChinaNet\VNETON~1.OCX]  <><2005, 3, 2, 1>
    [C:\PROGRA~1\ChinaNet\ALLFUN~1.DLL]  <GDCN><2005, 10, 9, 1>
    [C:\PROGRA~1\ChinaNet\VnetOptLog.dll]  <><2005, 9, 13, 9>
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\PROGRA~1\ChinaNet\DlgSkin.ocx]  <><2005, 11, 14, 1>
郁闷的圈圈 - 2006-8-23 4:35:00
[C:\WINDOWS\system32\macromed\flash\Flash85.ocx]  <Macromedia, Inc.><8,5,0,133>
[PID: 1032][C:\WINDOWS\system32\wdfmgr.exe]  <Microsoft Corporation><5.2.3790.1230 built by: dnsrv(bld4act)>
[PID: 1040][E:\qq\QQ.exe]  <TENCENT><0, 0, 0, 0>
    [E:\qq\QQBaseClassInDll.dll]  <><1, 0, 0, 1>
    [E:\qq\QQHelperDll.dll]  <><1, 0, 0, 1>
    [E:\qq\BasicCtrlDll.dll]  <Tencent><5, 0, 200, 160>
    [C:\WINDOWS\system32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
    [E:\qq\QQAPI.dll]  <><1, 0, 0, 1>
    [E:\qq\TIMProxy.dll]  <tencent><0, 3, 2, 4>
    [E:\qq\LoginCtrl.dll]  <><1, 0, 0, 1>
    [E:\qq\npkcntc.dll]  <INCA Internet Co., Ltd.><2006, 3, 2, 1>
    [E:\qq\npkpdb.dll]  <INCA Internet Co., Ltd.><2003, 10, 1, 1>
    [E:\qq\QQRes.dll]  <tencent><1, 0, 0, 1>
    [E:\qq\QQMainFrame.dll]  <N/A><N/A>
    [E:\qq\CQQApplication.dll]  <N/A><N/A>
    [E:\qq\NewSkin.dll]  <><1, 0, 0, 1>
    [E:\qq\HostingMgr.dll]  <><1, 0, 0, 1>
    [E:\qq\CameraDll.dll]  <><1, 0, 0, 1>
    [E:\qq\MailSummary.dll]  <><1, 0, 0, 1>
    [E:\qq\QQSpace.dll]  <><1, 0, 0, 1>
    [C:\WINDOWS\system32\msdmo.dll]  <N/A><N/A>
    [E:\qq\QQGroupMng.dll]  <><1, 0, 0, 1>
    [E:\qq\GroupLive.dll]  <N/A><N/A>
    [E:\qq\UserDefinedHead.dll]  <><1, 0, 0, 1>
    [E:\qq\QQPlugin.dll]  <N/A><N/A>
    [E:\qq\QQAllInOne.dll]  <N/A><N/A>
    [E:\qq\SCCore.dll]  <N/A><N/A>
    [E:\qq\QQCustomFace.dll]  <N/A><N/A>
    [E:\qq\QQPet.dll]  <><1, 0, 0, 1>
    [E:\qq\QQSysMsgMng.dll]  <N/A><N/A>
    [E:\qq\QQConfigPlugin.dll]  <><1, 0, 0, 1>
    [C:\WINDOWS\system32\RavExt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
    [E:\qq\QRingMng.dll]  <N/A><N/A>
    [E:\qq\PhoneAPI.dll]  <><1, 0, 0, 1>
    [E:\qq\DialerAllinOne.dll]  <tencent><1, 4, 0, 0>
    [E:\qq\QQAvatar.dll]  <N/A><N/A>
    [E:\qq\FlashAvatarDll.dll]  <><1, 4, 0, 1>
    [E:\qq\LongConnection.dll]  <tencent><5, 0, 200, 160>
    [C:\WINDOWS\system32\macromed\flash\Flash85.ocx]  <Macromedia, Inc.><8,5,0,133>
    [E:\qq\ImageOle.dll]  <TODO: <Company name>><1.0.0.1>
    [E:\qq\QQMagicFace.dll]  <><1, 0, 0, 1>
    [E:\qq\QQSceneMng.dll]  <N/A><N/A>
    [E:\qq\GroupConnection.dll]  <Tencent><5, 0, 202, 170>
    [E:\qq\BQQApplication.dll]  <N/A><N/A>
    [E:\qq\CommercesMng.dll]  <><1, 0, 0, 1>
    [E:\qq\PersonalDesktop.dll]  <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2>
    [E:\qq\QQAddr.dll]  <深圳市腾讯计算机系统有限公司><5, 0, 101, 200>
    [E:\qq\QQPhoneHelper.dll]  <腾讯科技（深圳）有限公司><2, 0, 6, 60>
    [E:\qq\QQZip.dll]  <tencent><0, 3, 2, 4>
    [E:\qq\QQFileTransfer.dll]  <Tencent><5, 0, 202, 180>
[PID: 1088][E:\qq\TIMPlatfrom.exe]  <tencent><0, 3, 1, 8>
    [E:\qq\TIMProxy.dll]  <tencent><0, 3, 2, 4>
[PID: 420][C:\WINDOWS\System32\alg.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\System32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
[PID: 3880][C:\Program Files\Rising\Rav\Ravmond.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 1, 33>
    [C:\Program Files\Rising\Rav\BWList.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [C:\Program Files\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\RsLog.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20>
    [C:\Program Files\Rising\Rav\HOOKSYS.dll]  <Beijing Rising Technology Co., Ltd.><18, 1, 0, 11>
    [C:\Program Files\Rising\Rav\Scanner.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30>
    [C:\Program Files\Rising\Rav\libload.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\VirusLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
    [C:\Program Files\Rising\Rav\regmon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
    [C:\Program Files\Rising\Rav\HookWeb.dll]  <rising><18, 0, 0, 2>
    [C:\Program Files\Rising\Rav\MemMon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\expscan.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\mPorts.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
    [C:\Program Files\Rising\Rav\MailMon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
    [C:\Program Files\Rising\Rav\SpamEng.dll]  <N/A><18, 0, 0, 6>
    [C:\Program Files\Rising\Rav\engine.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30>
    [C:\Program Files\Rising\Rav\PostTrt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
    [C:\Program Files\Rising\Rav\UnExe.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\Rising\Rav\ScanExec.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\Rising\Rav\ScanEx.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 14>
    [C:\Program Files\Rising\Rav\NvFile.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
    [C:\Program Files\Rising\Rav\ScanMac.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
    [C:\Program Files\Rising\Rav\ScanSct.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 18>
    [C:\Program Files\Rising\Rav\Unpacker.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
    [C:\Program Files\Rising\Rav\ExtOLE.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
    [C:\Program Files\Rising\Rav\RsStore.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 3936][C:\Program Files\Rising\Rav\RAVMON.EXE]  <Beijing Rising Technology Co., Ltd.><18, 0, 1, 32>
    [C:\Program Files\Rising\Rav\RsGuiLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 24>
    [C:\Program Files\Rising\Rav\BWList.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [C:\Program Files\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\Program Files\Rising\Rav\PngDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 3996][C:\Program Files\Rising\Rav\RavStub.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 2992][C:\Program Files\Internet Explorer\iexplore.exe]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll]  <Yahoo! China><3, 0, 1, 1001>
    [C:\Program Files\Yahoo!\Assistant\Assist\yAngling.dll]  <yahoo! china><3, 0, 1, 1002>
    [C:\WINDOWS\system32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll]  <Yahoo!><2, 1, 8, 1048>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL]  <yahoo! china><3, 0, 0, 1000>
    [E:\xunlei\ComDlls\XUNLEIBHO_002.dll]  <Thunder Networking Technologies,LTD><5, 0, 0, 2>
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\WINDOWS\system32\macromed\flash\Flash85.ocx]  <Macromedia, Inc.><8,5,0,133>
[PID: 3892][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
[PID: 1440][E:\SREng\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>
    [C:\WINDOWS\system32\SYNCOR11.DLL]  <SoundMAX><1.2.3>
郁闷的圈圈 - 2006-8-23 4:35:00

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================
郁闷的圈圈 - 2006-8-23 4:38:00
每天都看到这个毒，后面就是一堆其他毒。。。
都快晕了~

附件: 732570200682343042.jpg
郁闷的圈圈 - 2006-8-23 4:52:00
另外，不知道有喜欢火影的朋友没？
在这里发几张手工清理干净的火影小图片，
喜欢的朋友自己拿去做头像吧，蛮可爱的。


附件: 732570200682344443.jpg
郁闷的圈圈 - 2006-8-23 4:53:00
.

附件: 732570200682344520.jpg
郁闷的圈圈 - 2006-8-23 4:53:00
.

附件: 732570200682344539.jpg
郁闷的圈圈 - 2006-8-23 4:53:00
.

附件: 732570200682344600.jpg
郁闷的圈圈 - 2006-8-23 4:54:00
.

附件: 732570200682344614.jpg
郁闷的圈圈 - 2006-8-23 4:54:00
.

附件: 732570200682344649.jpg
郁闷的圈圈 - 2006-8-23 4:55:00
.

附件: 732570200682344704.jpg
郁闷的圈圈 - 2006-8-23 4:55:00
.

附件: 732570200682344724.jpg
郁闷的圈圈 - 2006-8-23 4:55:00
.

附件: 732570200682344745.jpg
郁闷的圈圈 - 2006-8-23 4:58:00
再来几张我觉得蛮好看的墙纸。
喜欢的朋友顺便帮我顶一下贴子~我需要你们的帮助

附件: 732570200682345021.jpg
郁闷的圈圈 - 2006-8-23 4:59:00
各位高手帮我看看日志哈~ 拜托拜托~谢谢谢谢

附件: 732570200682345105.jpg
秋日里的蓝天 - 2006-8-23 4:59:00
请下载Hijackthis1.99.1汉化版扫描上来

http://free5.ys168.com/?ufwihgu168

郁闷的圈圈 - 2006-8-23 5:00:00
楼下的一群烂猫使劲叫，被我一桶水淋跑了~哈哈。
最近在试图学习注册表入门，以后会经常会向各位高手请教一些无知的问题。在这里先有礼了

附件: 732570200682345301.jpg
郁闷的圈圈 - 2006-8-23 5:01:00
本人最喜欢她

附件: 732570200682345329.jpg
郁闷的圈圈 - 2006-8-23 5:02:00
不能再聊了~再聊要被当成水帖给删了.
都是病毒惹的祸~ 我容易么

附件: 732570200682345439.jpg
郁闷的圈圈 - 2006-8-23 5:06:00
引用:
【秋日里的蓝天的贴子】请下载Hijackthis1.99.1汉化版扫描上来

http://free5.ys168.com/?ufwihgu168


………………

那是啥东西？俺菜鸟。不懂。
用SRE扫的不行吗？



附件: 732570200682345803.jpg
郁闷的圈圈 - 2006-8-23 5:38:00
一不小心天亮了。睡觉鸟，各位也都睡吧，明天还忙活呢
郁闷的圈圈 - 2006-8-23 5:44:00
顺便问大伙一句，有了瑞星，还需要木马克星吗（或者其他专杀木马的工具）？
郁闷的圈圈 - 2006-8-23 6:30:00
我晕~ 搞了半天，才发现，原来图片被屏蔽了，我说咋不签名弄了半天没反应. - -||
newcenturymoon - 2006-8-23 7:53:00
木马克星不要用
郁闷的圈圈 - 2006-8-23 10:16:00
引用:
【newcenturymoon的贴子】木马克星不要用
………………

为什么呢？难道木马克星和杀毒软件有冲突吗？
还是木马克星经常被夹杂一些其他东西？
westbeck - 2006-8-23 10:27:00
请参考:http://forum.ikaka.com/topic.asp?board=28&artid=8149966
12
查看完整版本: 呼叫猫哥^^我中的是变种？
© 2000 - 2026 Rising Corp. Ltd.