瑞星卡卡安全论坛
tangseng1 - 2006-9-9 15:37:00
启瑞星伞打不开 现在是瑞星主程序打不开,防火墙打不开，动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
<run><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<SoundMan><SOUNDMAN.EXE> [Realtek Semiconductor Corp.]
<桌面图标文字自动透明><D:\Program Files\优化大师\wom\WinMem.exe XP> []
<RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
<RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<木马清道夫><D:\Program Files\木马清道夫\Trojanwall.exe> []
<Windows木马防火墙><D:\Program Files\木马清道夫\Trojanwall~.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<Super Rabbit Winspeed><"D:\Program Files\Super Rabbit\MagicSet\winspeed.exe" /autokill:155,90,86,48> [Super Rabbit Soft]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]
==================================
启动文件夹
服务
[Rising Proxy Service / RfwProxySrv]
<c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService]
<c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[Update Service For Windows / SoftUpdate]
<C:\WINDOWS\SoftUpdate.exe><N/A>
[svchostt / svchostt]
<><N/A>
[Windows Management NetWork Service Extensions / Windows Management NetWork Service Extensions]
<NetManager.exe -exe_start><N/A>
==================================
tangseng1 - 2006-9-9 15:38:00
==================================
浏览器加载项
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <E:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[5chaa]
{D6E814A0-E0C5-11d4-8D29-0050BA6940E4} <http://www.5chaa.com, N/A>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <E:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Windows Genuine Advantage Validation Tool]
{17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft? Corporation>
[WebActivater Control]
{3D8F74EE-8692-4F8F-B8D2-7522E732519E} <C:\WINDOWS\system32\WEBACT~1.OCX, QQ>
[ToolBoxUpdater Control]
{0572ED60-CA5C-47BD-B3A2-57F3933D0550} <C:\PROGRA~1\TOOLBO~1\TOOLBO~2.OCX, N/A>
[Web Browser Applet Control]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\WINDOWS\system32\msjava.dll, Microsoft Corporation>
[CAdLogic Object]
{11F09AFD-75AD-4E51-AB43-E09E9351CE16} <C:\Program Files\Common Files\CPUSH\cpush.dll, N/A>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[RealPlayer RAM Download Handler]
{2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Tabular Data Control]
{333C7BC4-460F-11D0-BC04-0080C7055A83} <C:\WINDOWS\system32\tdc.ocx, Microsoft Corporation>
[WebActivater Control]
{3D8F74EE-8692-4F8F-B8D2-7522E732519E} <C:\WINDOWS\system32\WEBACT~1.OCX, QQ>
[HHCtrl Object]
{52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <e:\program files\tencent\qq\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, N/A>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Active Desktop Mover]
{72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
[实用搜索工具条V2.0]
{75D82598-4A3C-419E-99D2-3EB56D09CFD0} <, N/A>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[ToolboxActivex Control]
{A689E4A5-55EC-45DB-B8A4-36F534A9DCF6} <C:\PROGRA~1\TOOLBO~1\TOOLBO~1.OCX, N/A>
[PhotoUploadCtrl Control]
{A96C48EA-AA88-4BBD-B58C-7B41146A6EAC} <E:\PROGRA~1\Tencent\QQ\QZone\PHOTOU~1.OCX, tencent>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Sun Java2]
{C61A70F3-505E-4B90-916F-627A8706B4BC} <c:\WINDOWS\system32\COMBoHEvent.dll, N/A>
[AUDIO__MID Moniker Class]
{CD3AFA74-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__MP3 Moniker Class]
{CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
{CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__AVI Moniker Class]
{CD3AFA88-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_ASF Moniker Class]
{CD3AFA8F-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
{CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[SoDui.com Search]
{EBBC6E6D-7B65-46BE-B509-86CED2D17876} <C:\WINDOWS\system32\Inte.dll, N/A>
[上传到QQ网络硬盘]
<e:\program files\tencent\qq\AddToNetDisk.htm, N/A>
[使用影音传送带下载]
<, N/A>
[使用影音传送带下载全部链接]
<, N/A>
[使用网际快车下载]
<D:\Program Files\JetCar-v1.71\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<D:\Program Files\JetCar-v1.71\jc_all.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
<e:\program files\tencent\qq\AddPanel.htm, N/A>
[添加到QQ表情]
<e:\program files\tencent\qq\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<e:\program files\tencent\qq\SendMMS.htm, N/A>
[访问通用网址]
<, N/A>
tangseng1 - 2006-9-9 15:40:00
==================================
正在运行的进程
[PID: 600][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 664][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 696][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 740][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 752][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 908][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 972][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\cdnns.dll] <CNNIC><2, 0, 0, 0>
[PID: 1072][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\cdnns.dll] <CNNIC><2, 0, 0, 0>
[PID: 1156][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1276][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1412][c:\program files\rising\rfw\rfwsrv.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 32>
[c:\program files\rising\rfw\RfwRule.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 13>
[c:\program files\rising\rfw\rfwlog.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 6>
[c:\program files\rising\rfw\Rfwdrv.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 21>
[c:\program files\rising\rfw\MonDrv.dll] <rs><1, 0, 0, 4>
[c:\program files\rising\rfw\ProcLib.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 9>
[PID: 1620][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)>
[C:\WINDOWS\system32\cdnns.dll] <CNNIC><2, 0, 0, 0>
[PID: 1756][c:\program files\rising\rfw\RfwMain.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 52>
[c:\program files\rising\rfw\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23>
[c:\program files\rising\rfw\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[c:\program files\rising\rfw\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[e:\program files\tencent\qq\DShared.dll] <Tencent><1.5.0.0>
[PID: 1828][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\cdnns.dll] <CNNIC><2, 0, 0, 0>
[PID: 1884][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1900][C:\WINDOWS\system32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: dnsrv(bld4act)>
[PID: 716][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1432][C:\Program Files\Rising\Rav\RavTask.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[e:\program files\tencent\qq\DShared.dll] <Tencent><1.5.0.0>
[PID: 1916][c:\windows\system32\inetsrv\csrss.exe] <Microsoft><1.0.0.0>
[C:\WINDOWS\system32\cdnns.dll] <CNNIC><2, 0, 0, 0>
[PID: 1860][C:\Program Files\Rising\Rav\RavMon.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 33>
[C:\Program Files\Rising\Rav\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 26>
[C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Program Files\Rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[e:\program files\tencent\qq\DShared.dll] <Tencent><1.5.0.0>
[PID: 628][C:\WINDOWS\SOUNDMAN.EXE] <Realtek Semiconductor Corp.><5, 1, 0, 48>
[e:\program files\tencent\qq\DShared.dll] <Tencent><1.5.0.0>
[PID: 1272][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[e:\program files\tencent\qq\DShared.dll] <Tencent><1.5.0.0>
[PID: 3568][e:\program files\tencent\qq\qq.exe] <TENCENT><0, 0, 0, 0>
[e:\program files\tencent\qq\QQBaseClassInDll.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\QQHelperDll.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\BasicCtrlDll.dll] <Tencent><5, 0, 200, 160>
[e:\program files\tencent\qq\QQAPI.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\TIMProxy.dll] <tencent><0, 3, 2, 4>
[e:\program files\tencent\qq\LoginCtrl.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\npkcntc.dll] <INCA Internet Co., Ltd.><2006, 3, 2, 1>
[e:\program files\tencent\qq\npkpdb.dll] <INCA Internet Co., Ltd.><2003, 10, 1, 1>
[e:\program files\tencent\qq\QQRes.dll] <tencent><1, 0, 0, 1>
[C:\WINDOWS\system32\cdnns.dll] <CNNIC><2, 0, 0, 0>
[e:\program files\tencent\qq\QQMainFrame.dll] <N/A><N/A>
[e:\program files\tencent\qq\CQQApplication.dll] <N/A><N/A>
[e:\program files\tencent\qq\NewSkin.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\HostingMgr.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\CameraDll.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\MailSummary.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\QQSpace.dll] <><1, 0, 0, 1>
[C:\WINDOWS\system32\msdmo.dll] <N/A><N/A>
[e:\program files\tencent\qq\QQGroupMng.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\GroupLive.dll] <N/A><N/A>
[e:\program files\tencent\qq\QQSysMsgMng.dll] <N/A><N/A>
[e:\program files\tencent\qq\UserDefinedHead.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\QQPlugin.dll] <N/A><N/A>
[e:\program files\tencent\qq\QQConfigPlugin.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\QRingMng.dll] <N/A><N/A>
[e:\program files\tencent\qq\PhoneAPI.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\DialerAllinOne.dll] <tencent><1, 4, 0, 0>
[e:\program files\tencent\qq\LongConnection.dll] <tencent><5, 0, 200, 160>
[e:\program files\tencent\qq\QQPet.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\QQAvatar.dll] <N/A><N/A>
[e:\program files\tencent\qq\FlashAvatarDll.dll] <><1, 4, 0, 1>
[e:\program files\tencent\qq\BQQApplication.dll] <N/A><N/A>
[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
tangseng1 - 2006-9-9 15:42:00
[e:\program files\tencent\qq\CommercesMng.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2>
[e:\program files\tencent\qq\QQAddr.dll] <深圳市腾讯计算机系统有限公司><5, 0, 101, 200>
[e:\program files\tencent\qq\QQSceneMng.dll] <N/A><N/A>
[e:\program files\tencent\qq\QQPhoneHelper.dll] <腾讯科技（深圳）有限公司><2, 0, 6, 60>
[C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx] <Macromedia, Inc.><8,0,22,0>
[e:\program files\tencent\qq\DShared.dll] <Tencent><1.5.0.0>
[PID: 3652][E:\Program Files\Tencent\QQ\TIMPlatform.exe] <tencent><0, 3, 1, 8>
[e:\program files\tencent\qq\TIMProxy.dll] <tencent><0, 3, 2, 4>
[PID: 2388][e:\program files\tencent\qq\qq.exe] <TENCENT><0, 0, 0, 0>
[e:\program files\tencent\qq\QQBaseClassInDll.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\QQHelperDll.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\BasicCtrlDll.dll] <Tencent><5, 0, 200, 160>
[e:\program files\tencent\qq\QQAPI.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\TIMProxy.dll] <tencent><0, 3, 2, 4>
[e:\program files\tencent\qq\LoginCtrl.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\npkcntc.dll] <INCA Internet Co., Ltd.><2006, 3, 2, 1>
[e:\program files\tencent\qq\npkpdb.dll] <INCA Internet Co., Ltd.><2003, 10, 1, 1>
[e:\program files\tencent\qq\QQRes.dll] <tencent><1, 0, 0, 1>
[e:\program files\tencent\qq\QQMainFrame.dll] <N/A><N/A>
[e:\program files\tencent\qq\CQQApplication.dll] <N/A><N/A>
[e:\program files\tencent\qq\NewSkin.dll] <><1, 0, 0, 1>
[C:\WINDOWS\system32\cdnns.dll] <CNNIC><2, 0, 0, 0>
[e:\program files\tencent\qq\HostingMgr.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\CameraDll.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\MailSummary.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\QQSpace.dll] <><1, 0, 0, 1>
[C:\WINDOWS\system32\msdmo.dll] <N/A><N/A>
[e:\program files\tencent\qq\QQGroupMng.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\GroupLive.dll] <N/A><N/A>
[e:\program files\tencent\qq\QQSysMsgMng.dll] <N/A><N/A>
[e:\program files\tencent\qq\UserDefinedHead.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\QQPlugin.dll] <N/A><N/A>
[e:\program files\tencent\qq\QQConfigPlugin.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\QRingMng.dll] <N/A><N/A>
[e:\program files\tencent\qq\PhoneAPI.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\DialerAllinOne.dll] <tencent><1, 4, 0, 0>
[e:\program files\tencent\qq\QQAvatar.dll] <N/A><N/A>
[e:\program files\tencent\qq\FlashAvatarDll.dll] <><1, 4, 0, 1>
[e:\program files\tencent\qq\LongConnection.dll] <tencent><5, 0, 200, 160>
[e:\program files\tencent\qq\QQPet.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\BQQApplication.dll] <N/A><N/A>
[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[e:\program files\tencent\qq\CommercesMng.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2>
[e:\program files\tencent\qq\QQAddr.dll] <深圳市腾讯计算机系统有限公司><5, 0, 101, 200>
[e:\program files\tencent\qq\QQSceneMng.dll] <N/A><N/A>
[C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx] <Macromedia, Inc.><8,0,22,0>
[e:\program files\tencent\qq\DShared.dll] <Tencent><1.5.0.0>
[PID: 2708][e:\program files\tencent\qq\qq.exe] <TENCENT><0, 0, 0, 0>
[e:\program files\tencent\qq\QQBaseClassInDll.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\QQHelperDll.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\BasicCtrlDll.dll] <Tencent><5, 0, 200, 160>
[e:\program files\tencent\qq\QQAPI.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\TIMProxy.dll] <tencent><0, 3, 2, 4>
[e:\program files\tencent\qq\LoginCtrl.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\npkcntc.dll] <INCA Internet Co., Ltd.><2006, 3, 2, 1>
[e:\program files\tencent\qq\npkpdb.dll] <INCA Internet Co., Ltd.><2003, 10, 1, 1>
[e:\program files\tencent\qq\QQRes.dll] <tencent><1, 0, 0, 1>
[e:\program files\tencent\qq\QQMainFrame.dll] <N/A><N/A>
[e:\program files\tencent\qq\CQQApplication.dll] <N/A><N/A>
[e:\program files\tencent\qq\NewSkin.dll] <><1, 0, 0, 1>
[C:\WINDOWS\system32\cdnns.dll] <CNNIC><2, 0, 0, 0>
[e:\program files\tencent\qq\HostingMgr.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\CameraDll.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\MailSummary.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\QQSpace.dll] <><1, 0, 0, 1>
[C:\WINDOWS\system32\msdmo.dll] <N/A><N/A>
[e:\program files\tencent\qq\QQGroupMng.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\GroupLive.dll] <N/A><N/A>
[e:\program files\tencent\qq\UserDefinedHead.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\QQPlugin.dll] <N/A><N/A>
[e:\program files\tencent\qq\QQConfigPlugin.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\QRingMng.dll] <N/A><N/A>
[e:\program files\tencent\qq\PhoneAPI.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\DialerAllinOne.dll] <tencent><1, 4, 0, 0>
[e:\program files\tencent\qq\QQAvatar.dll] <N/A><N/A>
[e:\program files\tencent\qq\FlashAvatarDll.dll] <><1, 4, 0, 1>
[e:\program files\tencent\qq\LongConnection.dll] <tencent><5, 0, 200, 160>
[e:\program files\tencent\qq\QQPet.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\BQQApplication.dll] <N/A><N/A>
[e:\program files\tencent\qq\QQSysMsgMng.dll] <N/A><N/A>
[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[e:\program files\tencent\qq\CommercesMng.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2>
[e:\program files\tencent\qq\QQAddr.dll] <深圳市腾讯计算机系统有限公司><5, 0, 101, 200>
[e:\program files\tencent\qq\QQSceneMng.dll] <N/A><N/A>
[e:\program files\tencent\qq\QQPhoneHelper.dll] <腾讯科技（深圳）有限公司><2, 0, 6, 60>
[e:\program files\tencent\qq\DShared.dll] <Tencent><1.5.0.0>
[PID: 888][e:\program files\tencent\qq\qq.exe] <TENCENT><0, 0, 0, 0>
[e:\program files\tencent\qq\QQBaseClassInDll.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\QQHelperDll.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\BasicCtrlDll.dll] <Tencent><5, 0, 200, 160>
[e:\program files\tencent\qq\QQAPI.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\TIMProxy.dll] <tencent><0, 3, 2, 4>
[e:\program files\tencent\qq\LoginCtrl.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\npkcntc.dll] <INCA Internet Co., Ltd.><2006, 3, 2, 1>
[e:\program files\tencent\qq\npkpdb.dll] <INCA Internet Co., Ltd.><2003, 10, 1, 1>
[e:\program files\tencent\qq\QQRes.dll] <tencent><1, 0, 0, 1>
[e:\program files\tencent\qq\QQMainFrame.dll] <N/A><N/A>
[e:\program files\tencent\qq\CQQApplication.dll] <N/A><N/A>
[C:\WINDOWS\system32\cdnns.dll] <CNNIC><2, 0, 0, 0>
[e:\program files\tencent\qq\NewSkin.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\HostingMgr.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\CameraDll.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\MailSummary.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\QQSpace.dll] <><1, 0, 0, 1>
[C:\WINDOWS\system32\msdmo.dll] <N/A><N/A>
[e:\program files\tencent\qq\QQGroupMng.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\GroupLive.dll] <N/A><N/A>
[e:\program files\tencent\qq\QQSysMsgMng.dll] <N/A><N/A>
[e:\program files\tencent\qq\UserDefinedHead.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\QQPlugin.dll] <N/A><N/A>
[e:\program files\tencent\qq\QQConfigPlugin.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\QRingMng.dll] <N/A><N/A>
[e:\program files\tencent\qq\PhoneAPI.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\DialerAllinOne.dll] <tencent><1, 4, 0, 0>
[e:\program files\tencent\qq\QQAvatar.dll] <N/A><N/A>
[e:\program files\tencent\qq\FlashAvatarDll.dll] <><1, 4, 0, 1>
[e:\program files\tencent\qq\LongConnection.dll] <tencent><5, 0, 200, 160>
tangseng1 - 2006-9-9 15:42:00
[e:\program files\tencent\qq\QQPet.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\BQQApplication.dll] <N/A><N/A>
[e:\program files\tencent\qq\QQAllInOne.dll] <N/A><N/A>
[e:\program files\tencent\qq\SCCore.dll] <N/A><N/A>
[e:\program files\tencent\qq\QQCustomFace.dll] <N/A><N/A>
[C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx] <Macromedia, Inc.><8,0,22,0>
[e:\program files\tencent\qq\QQSceneMng.dll] <N/A><N/A>
[e:\program files\tencent\qq\ImageOle.dll] <TODO: <Company name>><1.0.0.1>
[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[e:\program files\tencent\qq\CommercesMng.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2>
[e:\program files\tencent\qq\QQAddr.dll] <深圳市腾讯计算机系统有限公司><5, 0, 101, 200>
[e:\program files\tencent\qq\QQMagicFace.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\QQPhoneHelper.dll] <腾讯科技（深圳）有限公司><2, 0, 6, 60>
[e:\program files\tencent\qq\VqqModule.dll] <><1, 0, 0, 1>
[e:\program files\tencent\qq\ShareFiles.dll] <N/A><N/A>
[e:\program files\tencent\qq\QQZip.dll] <tencent><0, 3, 2, 4>
[e:\program files\tencent\qq\VqqAllInOne.dll] <Tencent><1, 5, 0, 3>
[e:\program files\tencent\qq\tencent-proto1.dll] <tencent><1, 5, 0, 3>
[e:\program files\tencent\qq\tencent-comlib.dll] <tencent><1.4.0.2>
[e:\program files\tencent\qq\tencent-proto2.dll] <tencent><1, 5, 0, 3>
[e:\program files\tencent\qq\QQFileTransfer.dll] <Tencent><5, 0, 202, 180>
[e:\program files\tencent\qq\DShared.dll] <Tencent><1.5.0.0>
[e:\program files\tencent\qq\InPlus.dll] <Tencent><1.5.0.0>
[e:\program files\tencent\qq\GroupConnection.dll] <Tencent><5, 0, 202, 170>
[PID: 836][C:\WINDOWS\explorer.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[e:\program files\tencent\qq\DShared.dll] <Tencent><1.5.0.0>
[C:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 2108][C:\Program Files\Rising\Rav\Rav.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 75>
[C:\Program Files\Rising\Rav\PlugIn\RsPgScan.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 17>
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Program Files\Rising\Rav\RavUI.Dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 65>
[C:\Program Files\Rising\Rav\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 26>
[C:\Program Files\Rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[e:\program files\tencent\qq\DShared.dll] <Tencent><1.5.0.0>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\Scanner.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 32>
[C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[C:\Program Files\Rising\Rav\RavUIMsg.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 26>
[C:\WINDOWS\system32\cdnns.dll] <CNNIC><2, 0, 0, 0>
[C:\Program Files\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 4076][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[e:\program files\tencent\qq\DShared.dll] <Tencent><1.5.0.0>
[C:\WINDOWS\system32\cdnns.dll] <CNNIC><2, 0, 0, 0>
[C:\Program Files\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx] <Macromedia, Inc.><8,0,22,0>
[PID: 580][D:\Program Files\sreng2\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[e:\program files\tencent\qq\DShared.dll] <Tencent><1.5.0.0>
[C:\WINDOWS\system32\cdnns.dll] <CNNIC><2, 0, 0, 0>
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
我无邪 - 2006-9-9 15:46:00
关闭所有浏览窗口以及一些不必要的程序
打开System Repair Engineer（也就是你的扫描日志软件SREng.exe），使用“系统修复，浏览器加载项”来删除以下选项。
C:\WINDOWS\system32\Inte.dll
http://www.5chaa.com
c:\WINDOWS\system32\COMBoHEvent.dll
打开System Repair Engineer（也就是你的扫描日志软件SREng.exe），点“启动项目，服务，点“Win32服务应用程序”勾选“隐藏微软服务”选中病毒服务Update Service For Windows，svchostt，Windows Management NetWork Service Extensions，选择“删除服务”点“设置”选择“否”最后重启。（每一个逗号隔开的就是一个病毒的服务，请逐一删除）
重启后
请到www.27814939.ys168.com,点“我的软件”下载诺顿进程管理器，终止c:\windows\system32\inetsrv\csrss.exe的进程
删除
C:\WINDOWS\system32\Inte.dll
NetManager.exe
c:\WINDOWS\system32\COMBoHEvent.dll
c:\windows\system32\inetsrv\csrss.exe
C:\WINDOWS\SoftUpdate.exe
完后重启，再扫个日志粘上来。
tangseng1 - 2006-9-9 19:10:00
下载诺顿进程管理器是rar文件变成了RealPlayer图标，根本就打不开，解压不了
tangseng1 - 2006-9-9 20:11:00
问题没解决啊
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation]
<Super Rabbit IEPro><D:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD> [Super Rabbit Soft]
<Realplayer.exe><C:\WINDOWS\system32\Realplayer.exe> []
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
<run><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<SoundMan><SOUNDMAN.EXE> [Realtek Semiconductor Corp.]
<桌面图标文字自动透明><D:\Program Files\优化大师\wom\WinMem.exe XP> []
<RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
<RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<Tray><C:\WINDOWS\command\rundll32.exe> []
<Realplayer.exe><C:\WINDOWS\system32\Realplayer.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]
==================================
启动文件夹
服务
[MrayPigeonServer / MrayPigeonServer]
<><N/A>
[Rising Proxy Service / RfwProxySrv]
<c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService]
<c:\program files\rising\rfw\rfwsrv.exe><N/A>
[Rising Process Communication Center / RsCCenter]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
==================================
tangseng1 - 2006-9-9 20:12:00
浏览器加载项
[Sun Java2]
{C61A70F3-505E-4B90-916F-627A8706B4BC} <c:\WINDOWS\system32\COMBoHEvent.dll, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <E:\Program Files\Tencent\QQ\QQ.EXE, >
[5chaa]
{D6E814A0-E0C5-11d4-8D29-0050BA6940E4} <http://www.5chaa.com, N/A>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <E:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Windows Genuine Advantage Validation Tool]
{17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft? Corporation>
[WebActivater Control]
{3D8F74EE-8692-4F8F-B8D2-7522E732519E} <C:\WINDOWS\system32\WEBACT~1.OCX, QQ>
[ToolBoxUpdater Control]
{0572ED60-CA5C-47BD-B3A2-57F3933D0550} <C:\PROGRA~1\TOOLBO~1\TOOLBO~2.OCX, N/A>
[Web Browser Applet Control]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\WINDOWS\system32\msjava.dll, Microsoft Corporation>
[CAdLogic Object]
{11F09AFD-75AD-4E51-AB43-E09E9351CE16} <C:\Program Files\Common Files\CPUSH\cpush.dll, N/A>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[Tabular Data Control]
{333C7BC4-460F-11D0-BC04-0080C7055A83} <C:\WINDOWS\system32\tdc.ocx, Microsoft Corporation>
[WebActivater Control]
{3D8F74EE-8692-4F8F-B8D2-7522E732519E} <C:\WINDOWS\system32\WEBACT~1.OCX, QQ>
[HHCtrl Object]
{52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <e:\program files\tencent\qq\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Active Desktop Mover]
{72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
[实用搜索工具条V2.0]
{75D82598-4A3C-419E-99D2-3EB56D09CFD0} <, N/A>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[ToolboxActivex Control]
{A689E4A5-55EC-45DB-B8A4-36F534A9DCF6} <C:\PROGRA~1\TOOLBO~1\TOOLBO~1.OCX, N/A>
[PhotoUploadCtrl Control]
{A96C48EA-AA88-4BBD-B58C-7B41146A6EAC} <E:\PROGRA~1\Tencent\QQ\QZone\PHOTOU~1.OCX, tencent>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[XBTP03129 Class]
{B07D1F6B-6B8C-4904-8EE8-5E5A2B4624B3} <C:\PROGRA~1\MICRSO~1\SEARCH~1.DLL, IE Toolbar>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Sun Java2]
{C61A70F3-505E-4B90-916F-627A8706B4BC} <c:\WINDOWS\system32\COMBoHEvent.dll, N/A>
[AUDIO__MID Moniker Class]
{CD3AFA74-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__MP3 Moniker Class]
{CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
{CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__AVI Moniker Class]
{CD3AFA88-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_ASF Moniker Class]
{CD3AFA8F-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
{CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[上传到QQ网络硬盘]
<e:\program files\tencent\qq\AddToNetDisk.htm, N/A>
[使用影音传送带下载]
<, N/A>
[使用影音传送带下载全部链接]
<, N/A>
[使用网际快车下载]
<D:\Program Files\JetCar-v1.71\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<D:\Program Files\JetCar-v1.71\jc_all.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
<e:\program files\tencent\qq\AddPanel.htm, N/A>
[添加到QQ表情]
<e:\program files\tencent\qq\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<e:\program files\tencent\qq\SendMMS.htm, N/A>
tangseng1 - 2006-9-9 20:19:00
==================================
正在运行的进程
[PID: 572][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 636][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 668][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 712][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 724][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\cn_spiEx.dll] <N/A><N/A>
[PID: 876][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 940][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1020][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\cn_spiEx.dll] <N/A><N/A>
[PID: 1068][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1144][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1472][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\tdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\cn_spiEx.dll] <N/A><N/A>
[C:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\WINDOWS\system32\Rsvtub.dll] <N/A><N/A>
[PID: 1504][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)>
[PID: 1756][C:\WINDOWS\SOUNDMAN.EXE] <Realtek Semiconductor Corp.><5, 1, 0, 48>
[C:\WINDOWS\system32\tdll.dll] <N/A><N/A>
[PID: 1796][C:\Program Files\Rising\Rav\RavTask.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\WINDOWS\system32\tdll.dll] <N/A><N/A>
[PID: 1804][C:\WINDOWS\command\rundll32.exe] <N/A><N/A>
[C:\WINDOWS\system32\tdll.dll] <N/A><N/A>
[PID: 1812][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\tdll.dll] <N/A><N/A>
[PID: 1820][D:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE] <Super Rabbit Soft><7.80>
[D:\PROGRA~1\SUPERR~1\MagicSet\shlobj71.ocx] <Sky Software (http://www.ssware.com)><7, 1, 0, 0>
[C:\WINDOWS\system32\tdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\cn_spiEx.dll] <N/A><N/A>
[PID: 1896][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\cn_spiEx.dll] <N/A><N/A>
[c:\WINDOWS\system32\COMAdEvent.dll] <N/A><N/A>
[PID: 1948][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1968][C:\WINDOWS\system32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: dnsrv(bld4act)>
[PID: 1316][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1424][c:\windows\system32\inetsrv\csrss.exe] <Microsoft><1.0.0.0>
[C:\WINDOWS\system32\cn_spiEx.dll] <N/A><N/A>
[PID: 1252][C:\Program Files\Internet Explorer\IEXPLORE.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\cn_spiEx.dll] <N/A><N/A>
[c:\WINDOWS\system32\COMBoHEvent.dll] <N/A><N/A>
[C:\WINDOWS\system32\tdll.dll] <N/A><N/A>
[C:\Program Files\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[c:\WINDOWS\system32\COMAdEvent.dll] <N/A><N/A>
[C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx] <Macromedia, Inc.><8,0,22,0>
[PID: 3412][C:\WINDOWS\system32\Realplayer.exe] <N/A><N/A>
[PID: 3340][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\cn_spiEx.dll] <N/A><N/A>
[c:\WINDOWS\system32\COMBoHEvent.dll] <N/A><N/A>
[PID: 3224][D:\Program Files\sreng2\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\WINDOWS\system32\cn_spiEx.dll] <N/A><N/A>
[C:\WINDOWS\system32\tdll.dll] <N/A><N/A>
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
==================================
还出现两次蓝屏死机，开机就Explorer.exe应用程序错误，怎么办？？？？？？？？
tangseng1 - 2006-9-9 20:44:00
秋日里的蓝天 - 2006-9-9 20:49:00
C:\WINDOWS\system32\Realplayer.exe
启动项
C:\WINDOWS\system32\Realplayer.exe
C:\WINDOWS\system32\Realplayer.exe
运行中的程序
C:\WINDOWS\system32\brlmon.dll
解决方法
解决方法如下
双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示确定更改时，单击“是”，清除“隐藏已知文件类型的扩展名
ALT+CTRL+DELETE调出任务管理器,终止explorer.exe 还有Realplayer.exe的进程
点“文件”“新任务”“浏览”找到C:\WINDOWS\system32\Realplayer.exe
删除Realplayer.exe
点“文件”“新任务”“浏览”找到C:\WINDOWS\explorer.exe,双击打开
请下载SRENG2, 下载地址：http://free5.ys168.com/?ufwihgu168
运行(双击)System Repair Engineer，使用“启动项目，注册表”来删除以下选项。
C:\WINDOWS\system32\Realplayer.exe
C:\WINDOWS\system32\Realplayer.exe
删除
C:\WINDOWS\system32\brlmon.dll
C:\WINDOWS\system32\cn_spiEx.dll
C:\WINDOWS\system32\tdll.dll
请下载LSPFix和WinsockXPFix这两个软件，
小软件下载
http://free5.ys168.com/?ufwihgu168
重新启动电脑, 进入安全模式。运行LSPFix.exe，删除：
cn_spiEx.dll
tdll.dll
说明：
LSPFix这个软件主要用来辅助修复HijackThis扫描发现的O10项。
使用时，请关闭所有IE界面和文件夹界面后运行LSPFix。运行后，
把要修复的那一个O10项从左边转到右边，点“Finish”即可。
修复后重启计算机，如果无法上网，请运行WinsockXPFix，
让它修复一下。
秋日里的蓝天 - 2006-9-9 20:50:00
运行SRENG2,使用：启动项目－－注册表－－查找：C:\WINDOWS\command\rundll32.exe－－删除
删除：
C:\WINDOWS\command\rundll32.exe
修复后请重新扫描上来
tangseng1 - 2006-9-9 21:46:00
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation]
<Super Rabbit IEPro><D:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD> [Super Rabbit Soft]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
<run><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<SoundMan><SOUNDMAN.EXE> [Realtek Semiconductor Corp.]
<桌面图标文字自动透明><D:\Program Files\优化大师\wom\WinMem.exe XP> []
<RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
<RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<9><C:\WINDOWS\system32\Ravdm.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]
==================================
启动文件夹
服务
[MrayPigeonServer / MrayPigeonServer]
<><N/A>
[Rising Process Communication Center / RsCCenter]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
==================================
浏览器加载项
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <E:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <E:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Windows Genuine Advantage Validation Tool]
{17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft? Corporation>
[WebActivater Control]
{3D8F74EE-8692-4F8F-B8D2-7522E732519E} <C:\WINDOWS\system32\WEBACT~1.OCX, QQ>
[ToolBoxUpdater Control]
{0572ED60-CA5C-47BD-B3A2-57F3933D0550} <C:\PROGRA~1\TOOLBO~1\TOOLBO~2.OCX, N/A>
[Web Browser Applet Control]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\WINDOWS\system32\msjava.dll, Microsoft Corporation>
[CAdLogic
Object]
{11F09AFD-75AD-4E51-AB43-E09E9351CE16} <C:\Program Files\Common Files\CPUSH\cpush.dll, N/A>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[Tabular Data Control]
{333C7BC4-460F-11D0-BC04-0080C7055A83} <C:\WINDOWS\system32\tdc.ocx, Microsoft Corporation>
[WebActivater Control]
{3D8F74EE-8692-4F8F-B8D2-7522E732519E} <C:\WINDOWS\system32\WEBACT~1.OCX, QQ>
[HHCtrl
Object]
{52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[QQBrowserHelper
Object Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <e:\program files\tencent\qq\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Active Desktop Mover]
{72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
[实用搜索工具条V2.0]
{75D82598-4A3C-419E-99D2-3EB56D09CFD0} <, N/A>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[ToolboxActivex Control]
{A689E4A5-55EC-45DB-B8A4-36F534A9DCF6} <C:\PROGRA~1\TOOLBO~1\TOOLBO~1.OCX, N/A>
[PhotoUploadCtrl Control]
{A96C48EA-AA88-4BBD-B58C-7B41146A6EAC} <E:\PROGRA~1\Tencent\QQ\QZone\PHOTOU~1.OCX, tencent>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[XBTP03129 Class]
{B07D1F6B-6B8C-4904-8EE8-5E5A2B4624B3} <C:\PROGRA~1\MICRSO~1\SEARCH~1.DLL, IE Toolbar>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[AUDIO__MID Moniker Class]
{CD3AFA74-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__MP3 Moniker Class]
{CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
{CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__AVI Moniker Class]
{CD3AFA88-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_ASF Moniker Class]
{CD3AFA8F-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
{CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Shockwave Flash
Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[上传到QQ网络硬盘]
<E:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
tangseng1 - 2006-9-9 21:47:00
[使用影音传送带下载]
<, N/A>
[使用影音传送带下载全部链接]
<, N/A>
[使用网际快车下载]
<D:\Program Files\JetCar-v1.71\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<D:\Program Files\JetCar-v1.71\jc_all.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
<E:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<E:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<E:\Program Files\Tencent\QQ\SendMMS.htm, N/A>
==================================
正在运行的进程
[PID: 540][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 604][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 636][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 680][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 692][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 844][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 908][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1004][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1048][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1100][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1420][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\igfxpph.dll] <Intel Corporation><3.0.0.4342>
[C:\WINDOWS\system32\hccutils.DLL] <Intel Corporation><3.0.0.4342>
[C:\WINDOWS\system32\igfxres.dll] <Intel Corporation><3.0.0.4342>
[C:\WINDOWS\system32\igfxsrvc.dll] <Intel Corporation><3.0.0.4342>
[C:\WINDOWS\system32\igfxdev.dll] <Intel Corporation><3.0.0.4342>
[C:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 1488][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)>
[PID: 1660][C:\WINDOWS\SOUNDMAN.EXE] <Realtek Semiconductor Corp.><5, 1, 0, 48>
[PID: 1692][C:\Program Files\Rising\Rav\RavTask.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[PID: 1700][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1708][D:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE] <Super Rabbit Soft><7.80>
[D:\PROGRA~1\SUPERR~1\MagicSet\shlobj71.ocx] <Sky Software (http://www.ssware.com)><7, 1, 0, 0>
tangseng1 - 2006-9-9 21:49:00
[PID: 608][C:\Program Files\Internet Explorer\IEXPLORE.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1032][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[c:\WINDOWS\system32\COMAdEvent.dll] <N/A><N/A>
[PID: 1160][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1368][C:\WINDOWS\system32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: dnsrv(bld4act)>
[PID: 804][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 2464][c:\windows\system32\inetsrv\csrss.exe] <Microsoft><1.0.0.0>
[PID: 3832][C:\Program Files\Internet Explorer\IEXPLORE.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\WINDOWS\system32\msdmo.dll] <N/A><N/A>
[PID: 3880][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx] <Macromedia, Inc.><8,0,22,0>
[PID: 2424][C:\WINDOWS\system32\winasse.exe] <Microsoft Corporation><5.1.2600.0>
[PID: 1768][C:\WINDOWS\Logo1_.exe] <><1.0.0.0>
[PID: 2116][C:\WINDOWS\system32\conime.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 3620][C:\Program Files\Rising\Rfw\rfwmain.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 52>
[C:\Program Files\Rising\Rfw\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23>
[C:\Program Files\Rising\Rfw\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rfw\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 532][c:\program files\rising\rfw\rfwsrv.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 32>
[c:\program files\rising\rfw\RfwRule.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 13>
[c:\program files\rising\rfw\rfwlog.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 6>
[c:\program files\rising\rfw\Rfwdrv.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 21>
[c:\program files\rising\rfw\MonDrv.dll] <rs><1, 0, 0, 4>
[c:\program files\rising\rfw\ProcLib.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 9>
[PID: 4008][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 2880][D:\Program Files\sreng2\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
==================================
问题就是rar文件被改成Realplayer图标，无法解压文件
tangseng1 - 2006-9-9 22:12:00
笑看闲云 - 2006-9-9 22:54:00
点击压缩文件,点键点属性,在打开方式里更改,选择用winrar打开
tangseng1 - 2006-9-9 23:10:00
楼上的朋友，如果这样能解决我就不用这样辛苦来发帖了，winrar都变成Realplayer图标了，晕不晕
我无邪 - 2006-9-10 15:50:00
一定要重视这一项
C:\WINDOWS\Logo1_.exe
看以下的帖子
Logo1_.exe的专杀
http://forum.ikaka.com/topic.asp?board=28&artid=8098930
http://it.rising.com.cn/service/technology/RavVikiing.htm
建议，下载专杀，到安全模式下查杀。
C:\WINDOWS\system32\Ravdm.exe
看以下的帖子
http://forum.ikaka.com/topic.asp?board=28&artid=8156736
打开System Repair Engineer（也就是你的扫描日志软件SREng.exe），点“启动项目，服务MrayPigeonServer，点“Win32服务应用程序”勾选“隐藏微软服务”选中病毒服务，选择“删除服务”点“设置”选择“否”
ALT+CTRL+DELETE调出任务管理器,终止winasse.exe的进程
删除
C:\WINDOWS\Logo1_.exe
C:\WINDOWS\system32\winasse.exe这两个东东建议找到后先别删除，请发到twtxk@126.com
完后重启动，再扫个日志粘上来。
deadmanzj - 2006-9-10 15:53:00
威金
无邪，还是别叫他下什么专杀了，那东西版本太多，杀不干净，全盘格掉，重装吧，威金最近越来越横了，哎，。。。
deadmanzj - 2006-9-10 15:57:00
记得找到那个C:\WINDOWS\Logo1_.exe文件时，压缩加密123发送给我gudugd@yahoo.com.cn
tangseng1 - 2006-9-14 19:06:00
1
© 2000 - 2026 Rising Corp. Ltd.
帮忙啊 