恳求各位强人救命，小弟患的不会是绝症吧 bbs.ikaka.com

falcom931 - 2006-9-10 19:58:00

我以前的操作系统很稳定，自从9月2日中了7939病毒以来，再也没有正常过
新安装的系统只要一上网立刻被攻击导致系统瘫痪
安装系统前硬盘都重新格式化了，一周来平均每天要装3-4次系统，今天实在没招连低格都试了
防火墙卡巴斯击试过，正版瑞星安装过，听介绍加载过瑞星规则包，都没有用
硬件上，网卡更换过，电信猫更换过，换了别人的电脑主机都试过，还是没有用

今天偶尔发现了一个现象，我在2000系统刚安装好时（连驱动都还没来得及装）打开进程列表看了一下，有一个叫msiexec.exe的进程，这好象是之前从没见过；还有一个叫做userinit.exe的进程，每次开机都会自动运行，若干秒后自动关闭；出现以上情况但系统能正常使用，我报着侥幸心理上了网，谁知道就下载了一个QQ，电脑就再次中毒，中了一个好象是后门病毒，我已经给删了；另一个病毒只是在进程里添加了dihf.exe，暂时还没有导致什么严重的系统问题，只是瑞星防火墙不能升级了。

恳求各位达人尽快回复告诉小弟是怎么回事，我实在撑不住了

才发现，想用hijackthis调用日志发上来，居然打不开来拉

不知道，下面的有没有用

未知家族病毒分析
扫描结果:
无可疑文件

系统活动进程
C:\WINNT\SYSTEM32\SMSS.EXE
C:\WINNT\SYSTEM32\WINLOGON.EXE
C:\WINNT\SYSTEM32\WDMAUD.DRV
C:\WINNT\SYSTEM32\MSACM32.DRV

C:\WINNT\SYSTEM32\CSRSS.EXE
C:\WINNT\SYSTEM32\SERVICES.EXE
C:\WINNT\SYSTEM32\LSASS.EXE
D:\PROGRAM FILES\RISING\RFW\RFWSRV.EXE
D:\PROGRAM FILES\RISING\RFW\RFWRULE.DLL
D:\PROGRAM FILES\RISING\RFW\RFWLOG.DLL
D:\PROGRAM FILES\RISING\RFW\RFWDRV.DLL
D:\PROGRAM FILES\RISING\RFW\PSAPI.DLL
D:\PROGRAM FILES\RISING\RFW\MONDRV.DLL
D:\PROGRAM FILES\RISING\RFW\PROCLIB.DLL

C:\WINNT\SYSTEM32\SVCHOST.EXE
C:\WINNT\SYSTEM32\SPOOLSV.EXE
C:\WINNT\SYSTEM32\SVCHOST.EXE
C:\WINNT\SYSTEM32\UNIMDM.TSP
C:\WINNT\SYSTEM32\KMDDSP.TSP
C:\WINNT\SYSTEM32\NDPTSP.TSP
C:\WINNT\SYSTEM32\IPCONF.TSP
C:\WINNT\SYSTEM32\H323.TSP

C:\WINNT\SYSTEM32\REGSVC.EXE
C:\WINNT\SYSTEM32\MSTASK.EXE
C:\DIHF.EXE
D:\PROGRAM FILES\TENCENT\TT\TTRAVELER.EXE
C:\WINNT\SYSTEM32\MSVCP60.DLL
D:\PROGRAM FILES\TENCENT\TT\PLUGINS\QQFLOATBAR\QQFLOATBAR4TT2.DLL
D:\PROGRAM FILES\TENCENT\TT\PLUGINS\TWEATHER\TWEATHER.DLL
D:\PROGRAM FILES\TENCENT\TT\PERSONALDESKTOP.DLL
C:\WINNT\SYSTEM32\WDMAUD.DRV
C:\WINNT\SYSTEM32\MSACM32.DRV
C:\WINNT\SYSTEM32\MSADP32.ACM
C:\WINNT\SYSTEM32\MSRATELC.DLL
C:\WINNT\SYSTEM32\MACROMED\FLASH\FLASH9.OCX

C:\WINNT\SYSTEM32\WBEM\WINMGMT.EXE
C:\WINNT\SYSTEM32\SVCHOST.EXE
C:\WINNT\EXPLORER.EXE
C:\WINNT\APPPATCH\ACLAYERS.DLL
D:\PROGRAM FILES\THUNDER NETWORK\THUNDER\COMDLLS\XUNLEIBHO_002.DLL
C:\WINNT\SYSTEM32\MSVCP60.DLL
C:\WINNT\SYSTEM32\WDMAUD.DRV
C:\WINNT\SYSTEM32\MSACM32.DRV
C:\WINNT\SYSTEM32\MSADP32.ACM

E:\ZHUANSHA\瑞星听诊器\RSDETECT.EXE
D:\PROGRAM FILES\RISING\RFW\RFWMAIN.EXE
C:\WINNT\SYSTEM32\MSVCP60.DLL
D:\PROGRAM FILES\RISING\RFW\RSGUILIB.DLL
D:\PROGRAM FILES\RISING\RFW\RSCOMMON.DLL
D:\PROGRAM FILES\RISING\RFW\PNGDLL.DLL

C:\PROGRAM FILES\CHINANET\VNETCLIENT.EXE
C:\WINNT\SYSTEM32\MACROMED\FLASH\FLASH9.OCX
C:\WINNT\SYSTEM32\WDMAUD.DRV
C:\WINNT\SYSTEM32\MSACM32.DRV
C:\WINNT\SYSTEM32\MSADP32.ACM

C:\WINNT\SYSTEM32\CONIME.EXE

普通自启动项
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Synchronization Manager = MOBSYNC.EXE /LOGON
NvCplDaemon = RUNDLL32.EXE NVQTWK,NVCPLDAEMON INITIALIZE
RemoteControl = "D:\PROGRAM FILES\CYBERLINK\POWERDVD\PDVDSERV.EXE"
Spooler SubSystem App = C:\WINNT\SYSTEM32\SPOOISV.EXE
Microsoft (R) Windows Update Manager = C:\DIHF.EXE
RfwMain = "D:\PROGRAM FILES\RISING\RFW\RFWMAIN.EXE" -STARTUP

AppInit_DLLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs =

系统文件关联
.exe ==> exefile = "%1" %*
.com ==> comfile = "%1" %*
.cmd ==> cmdfile = "%1" %*
.bat ==> batfile = "%1" %*
.txt ==> txtfile = %SystemRoot%\system32\NOTEPAD.EXE %1
.scr ==> scrfile = "%1" /S
.reg ==> regfile = regedit.exe "%1"
.doc ==> Word.Document.8 = "C:\Program Files\Microsoft Office\Office\WINWORD.EXE" /n

其它启动项
WIN.INI
无信息

SYSTEM.INI
SHELL = Explorer.exe
SCRNSAVE.EXE = (无)

Winlogon 启动项
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
crypt32chain = CRYPT32.DLL
cryptnet = CRYPTNET.DLL
cscdll = CSCDLL.DLL
sclgntfy = SCLGNTFY.DLL
SensLogn = WLNOTIFY.DLL
wzcnotif = WZCDLG.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Userinit = C:\WINNT\SYSTEM32\USERINIT.EXE,
shell = EXPLORER.EXE

IE - BHO
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
{54EBD53A-9BC1-480B-966A-843A333CA162} = d:\Program Files\Tencent\QQ\QQIEHelper.dll
{889D2FEB-5411-4565-8998-1DD2C5261283} = d:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll

falcom931 - 2006-9-10 20:26:00

Winsock SPI
MSAFD Tcpip [TCP/IP] = C:\WINNT\SYSTEM32\MSAFD.DLL
MSAFD Tcpip [UDP/IP] = C:\WINNT\SYSTEM32\MSAFD.DLL
MSAFD Tcpip [RAW/IP] = C:\WINNT\SYSTEM32\MSAFD.DLL
RSVP UDP Service Provider = C:\WINNT\SYSTEM32\RSVPSP.DLL
RSVP TCP Service Provider = C:\WINNT\SYSTEM32\RSVPSP.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip_{5B138A86-2B1F-41E6-849D-D1BA99CA722D}] SEQPACKET 0 = C:\WINNT\SYSTEM32\MSAFD.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip_{5B138A86-2B1F-41E6-849D-D1BA99CA722D}] DATAGRAM 0 = C:\WINNT\SYSTEM32\MSAFD.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip_{6F8093BF-8308-491B-966B-EB061949C335}] SEQPACKET 1 = C:\WINNT\SYSTEM32\MSAFD.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip_{6F8093BF-8308-491B-966B-EB061949C335}] DATAGRAM 1 = C:\WINNT\SYSTEM32\MSAFD.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip_{99D93057-3AB5-4C09-9909-11F5B6A9149C}] SEQPACKET 2 = C:\WINNT\SYSTEM32\MSAFD.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip_{99D93057-3AB5-4C09-9909-11F5B6A9149C}] DATAGRAM 2 = C:\WINNT\SYSTEM32\MSAFD.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip_{12A83053-B438-4771-AF5F-3F24C9C479D1}] SEQPACKET 3 = C:\WINNT\SYSTEM32\MSAFD.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip_{12A83053-B438-4771-AF5F-3F24C9C479D1}] DATAGRAM 3 = C:\WINNT\SYSTEM32\MSAFD.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip_{0115F00A-08C3-4D24-A50C-BBDA1660C5B9}] SEQPACKET 4 = C:\WINNT\SYSTEM32\MSAFD.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip_{0115F00A-08C3-4D24-A50C-BBDA1660C5B9}] DATAGRAM 4 = C:\WINNT\SYSTEM32\MSAFD.DLL

系统服务项
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
Alerter = C:\WINNT\SYSTEM32\SERVICES.EXE
AppMgmt = C:\WINNT\SYSTEM32\SERVICES.EXE
BITS = C:\WINNT\SYSTEM32\SVCHOST.EXE -K BITSGROUP
Browser = C:\WINNT\SYSTEM32\SERVICES.EXE
cisvc = C:\WINNT\SYSTEM32\CISVC.EXE
ClipSrv = C:\WINNT\SYSTEM32\CLIPSRV.EXE
Dhcp = C:\WINNT\SYSTEM32\SERVICES.EXE
dmadmin = C:\WINNT\SYSTEM32\DMADMIN.EXE /COM
dmserver = C:\WINNT\SYSTEM32\SERVICES.EXE
Dnscache = C:\WINNT\SYSTEM32\SERVICES.EXE
Eventlog = C:\WINNT\SYSTEM32\SERVICES.EXE
EventSystem = C:\WINNT\SYSTEM32\SVCHOST.EXE -K NETSVCS
Fax = C:\WINNT\SYSTEM32\FAXSVC.EXE
lanmanserver = C:\WINNT\SYSTEM32\SERVICES.EXE
lanmanworkstation = C:\WINNT\SYSTEM32\SERVICES.EXE
LmHosts = C:\WINNT\SYSTEM32\SERVICES.EXE
Messenger = C:\WINNT\SYSTEM32\SERVICES.EXE
mnmsrvc = C:\WINNT\SYSTEM32\MNMSRVC.EXE
MSDTC = C:\WINNT\SYSTEM32\MSDTC.EXE
MSIServer = C:\WINNT\SYSTEM32\MSIEXEC.EXE /V
NetDDE = C:\WINNT\SYSTEM32\NETDDE.EXE
NetDDEdsdm = C:\WINNT\SYSTEM32\NETDDE.EXE
Netlogon = C:\WINNT\SYSTEM32\LSASS.EXE
Netman = C:\WINNT\SYSTEM32\SVCHOST.EXE -K NETSVCS
NtLmSsp = C:\WINNT\SYSTEM32\LSASS.EXE
NtmsSvc = C:\WINNT\SYSTEM32\SVCHOST.EXE -K NETSVCS
PlugPlay = C:\WINNT\SYSTEM32\SERVICES.EXE
PolicyAgent = C:\WINNT\SYSTEM32\LSASS.EXE
ProtectedStorage = C:\WINNT\SYSTEM32\SERVICES.EXE
RasAuto = C:\WINNT\SYSTEM32\SVCHOST.EXE -K NETSVCS
RasMan = C:\WINNT\SYSTEM32\SVCHOST.EXE -K NETSVCS
RemoteAccess = C:\WINNT\SYSTEM32\SVCHOST.EXE -K NETSVCS
RemoteRegistry = C:\WINNT\SYSTEM32\REGSVC.EXE
RfwService = D:\PROGRAM FILES\RISING\RFW\RFWSRV.EXE
RpcLocator = C:\WINNT\SYSTEM32\LOCATOR.EXE
RpcSs = C:\WINNT\SYSTEM32\SVCHOST -K RPCSS
RSVP = C:\WINNT\SYSTEM32\RSVP.EXE -S
SamSs = C:\WINNT\SYSTEM32\LSASS.EXE
SCardDrv = C:\WINNT\SYSTEM32\SCARDSVR.EXE
SCardSvr = C:\WINNT\SYSTEM32\SCARDSVR.EXE
Schedule = C:\WINNT\SYSTEM32\MSTASK.EXE
seclogon = C:\WINNT\SYSTEM32\SERVICES.EXE
SENS = C:\WINNT\SYSTEM32\SVCHOST.EXE -K NETSVCS
SharedAccess = C:\WINNT\SYSTEM32\SVCHOST.EXE -K NETSVCS
Spooler = C:\WINNT\SYSTEM32\SPOOLSV.EXE
SysmonLog = C:\WINNT\SYSTEM32\SMLOGSVC.EXE
TapiSrv = C:\WINNT\SYSTEM32\SVCHOST.EXE -K NETSVCS
TlntSvr = C:\WINNT\SYSTEM32\TLNTSVR.EXE
TrkWks = C:\WINNT\SYSTEM32\SERVICES.EXE
UpdateManager = C:\DIHF.EXE /UPDATEMGR
UPS = C:\WINNT\SYSTEM32\UPS.EXE
UtilMan = C:\WINNT\SYSTEM32\UTILMAN.EXE
W32Time = C:\WINNT\SYSTEM32\SERVICES.EXE
WinMgmt = C:\WINNT\SYSTEM32\WBEM\WINMGMT.EXE
Wmi = C:\WINNT\SYSTEM32\SERVICES.EXE
wuauserv = C:\WINNT\SYSTEM32\SVCHOST.EXE -K WUGROUP
WZCSVC = C:\WINNT\SYSTEM32\SVCHOST.EXE -K NETSVCS

文件驱动
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
MRxSmb = C:\WINNT\SYSTEM32\DRIVERS\MRXSMB.SYS
NetBIOS = C:\WINNT\SYSTEM32\DRIVERS\NETBIOS.SYS
Rdbss = C:\WINNT\SYSTEM32\DRIVERS\RDBSS.SYS
Srv = C:\WINNT\SYSTEM32\DRIVERS\SRV.SYS

系统驱动项
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
ACPI = C:\WINNT\SYSTEM32\DRIVERS\ACPI.SYS
AFD = C:\WINNT\SYSTEM32\DRIVERS\AFD.SYS
AsyncMac = C:\WINNT\SYSTEM32\DRIVERS\ASYNCMAC.SYS
atapi = C:\WINNT\SYSTEM32\DRIVERS\ATAPI.SYS
Atmarpc = C:\WINNT\SYSTEM32\DRIVERS\ATMARPC.SYS
audstub = C:\WINNT\SYSTEM32\DRIVERS\AUDSTUB.SYS
BaseTDI = C:\WINNT\SYSTEM32\DRIVERS\BASETDI.SYS
CCDECODE = C:\WINNT\SYSTEM32\DRIVERS\CCDECODE.SYS
Cdrom = C:\WINNT\SYSTEM32\DRIVERS\CDROM.SYS
cmpci = C:\WINNT\SYSTEM32\DRIVERS\CMAUDIO.SYS
Disk = C:\WINNT\SYSTEM32\DRIVERS\DISK.SYS
dmboot = C:\WINNT\SYSTEM32\DRIVERS\DMBOOT.SYS
dmio = C:\WINNT\SYSTEM32\DRIVERS\DMIO.SYS
dmload = C:\WINNT\SYSTEM32\DRIVERS\DMLOAD.SYS
DMusic = C:\WINNT\SYSTEM32\DRIVERS\DMUSIC.SYS
Fdc = C:\WINNT\SYSTEM32\DRIVERS\FDC.SYS
Flpydisk = C:\WINNT\SYSTEM32\DRIVERS\FLPYDISK.SYS
FsVga = C:\WINNT\SYSTEM32\DRIVERS\FSVGA.SYS
Ftdisk = C:\WINNT\SYSTEM32\DRIVERS\FTDISK.SYS
gameenum = C:\WINNT\SYSTEM32\DRIVERS\GAMEENUM.SYS
GNetPPPoE = C:\WINNT\SYSTEM32\DRIVERS\PPPOE.SYS
Gpc = C:\WINNT\SYSTEM32\DRIVERS\MSGPC.SYS
i8042prt = C:\WINNT\SYSTEM32\DRIVERS\I8042PRT.SYS
IpFilterDriver = C:\WINNT\SYSTEM32\DRIVERS\IPFLTDRV.SYS
IpInIp = C:\WINNT\SYSTEM32\DRIVERS\IPINIP.SYS
IpNat = C:\WINNT\SYSTEM32\DRIVERS\IPNAT.SYS
IPSEC = C:\WINNT\SYSTEM32\DRIVERS\IPSEC.SYS
IRENUM = C:\WINNT\SYSTEM32\DRIVERS\IRENUM.SYS
isapnp = C:\WINNT\SYSTEM32\DRIVERS\ISAPNP.SYS
Kbdclass = C:\WINNT\SYSTEM32\DRIVERS\KBDCLASS.SYS
kmixer = C:\WINNT\SYSTEM32\DRIVERS\KMIXER.SYS
Mouclass = C:\WINNT\SYSTEM32\DRIVERS\MOUCLASS.SYS
MPE = C:\WINNT\SYSTEM32\DRIVERS\MPE.SYS
mProcRs = D:\PROGRAM FILES\RISING\RFW\MPROCRS.SYS
MSKSSRV = C:\WINNT\SYSTEM32\DRIVERS\MSKSSRV.SYS
MSPCLOCK = C:\WINNT\SYSTEM32\DRIVERS\MSPCLOCK.SYS
MSPQM = C:\WINNT\SYSTEM32\DRIVERS\MSPQM.SYS
MSTEE = C:\WINNT\SYSTEM32\DRIVERS\MSTEE.SYS
ms_mpu401 = C:\WINNT\SYSTEM32\DRIVERS\MSMPU401.SYS
NABTSFEC = C:\WINNT\SYSTEM32\DRIVERS\NABTSFEC.SYS
NdisTapi = C:\WINNT\SYSTEM32\DRIVERS\NDISTAPI.SYS
Ndisuio = C:\WINNT\SYSTEM32\DRIVERS\NDISUIO.SYS
NdisWan = C:\WINNT\SYSTEM32\DRIVERS\NDISWAN.SYS
NetBT = C:\WINNT\SYSTEM32\DRIVERS\NETBT.SYS
NetDetect = C:\WINNT\SYSTEM32\DRIVERS\NETDTECT.SYS
npkcrypt = D:\PROGRAM FILES\TENCENT\QQ\NPKCRYPT.SYS
nv4 = C:\WINNT\SYSTEM32\DRIVERS\NV4_MINI.SYS
NwlnkFlt = C:\WINNT\SYSTEM32\DRIVERS\NWLNKFLT.SYS
NwlnkFwd = C:\WINNT\SYSTEM32\DRIVERS\NWLNKFWD.SYS
openhci = C:\WINNT\SYSTEM32\DRIVERS\OPENHCI.SYS
Parallel = C:\WINNT\SYSTEM32\DRIVERS\PARALLEL.SYS
Parport = C:\WINNT\SYSTEM32\DRIVERS\PARPORT.SYS
PCI = C:\WINNT\SYSTEM32\DRIVERS\PCI.SYS
PCIIde = C:\WINNT\SYSTEM32\DRIVERS\PCIIDE.SYS
PptpMiniport = C:\WINNT\SYSTEM32\DRIVERS\RASPPTP.SYS
Ptilink = C:\WINNT\SYSTEM32\DRIVERS\PTILINK.SYS
RasAcd = C:\WINNT\SYSTEM32\DRIVERS\RASACD.SYS
Rasl2tp = C:\WINNT\SYSTEM32\DRIVERS\RASL2TP.SYS
Raspti = C:\WINNT\SYSTEM32\DRIVERS\RASPTI.SYS
RCA = C:\WINNT\SYSTEM32\DRIVERS\RCA.SYS
redbook = C:\WINNT\SYSTEM32\DRIVERS\REDBOOK.SYS
RsFwDrv = D:\PROGRAM FILES\RISING\RFW\RSFWDRV.SYS
rtl8139 = C:\WINNT\SYSTEM32\DRIVERS\RTL8139.SYS
serenum = C:\WINNT\SYSTEM32\DRIVERS\SERENUM.SYS
Serial = C:\WINNT\SYSTEM32\DRIVERS\SERIAL.SYS
SLIP = C:\WINNT\SYSTEM32\DRIVERS\SLIP.SYS
streamip = C:\WINNT\SYSTEM32\DRIVERS\STREAMIP.SYS
swenum = C:\WINNT\SYSTEM32\DRIVERS\SWENUM.SYS
swmidi = C:\WINNT\SYSTEM32\DRIVERS\SWMIDI.SYS
sysaudio = C:\WINNT\SYSTEM32\DRIVERS\SYSAUDIO.SYS
Tcpip = C:\WINNT\SYSTEM32\DRIVERS\TCPIP.SYS
Update = C:\WINNT\SYSTEM32\DRIVERS\UPDATE.SYS
usbehci = C:\WINNT\SYSTEM32\DRIVERS\USBEHCI.SYS
usbhub = C:\WINNT\SYSTEM32\DRIVERS\USBHUB.SYS
usbhub20 = C:\WINNT\SYSTEM32\DRIVERS\USBHUB20.SYS
VgaSave = C:\WINNT\SYSTEM32\DRIVERS\VGA.SYS
Wanarp = C:\WINNT\SYSTEM32\DRIVERS\WANARP.SYS
wdmaud = C:\WINNT\SYSTEM32\DRIVERS\WDMAUD.SYS
WSTCODEC = C:\WINNT\SYSTEM32\DRIVERS\WSTCODEC.SYS

我无邪 - 2006-9-10 20:50:00

请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。

我无邪 - 2006-9-10 20:52:00

你所说的两个进程都是正常的
如果你不放心，可以扫个日志粘上来。

falcom931 - 2006-9-10 23:26:00

拜托楼上帮忙看看拉

2006-09-10,23:07:50

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Synchronization Manager><mobsync.exe /logon> [Microsoft Corporation]
<NvCplDaemon><RUNDLL32.EXE NvQTwk,NvCplDaemon initialize> []
<RemoteControl><"d:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"> [Cyberlink Corp.]
<Spooler SubSystem App><C:\WINNT\system32\spooIsv.exe> []
<Microsoft (R) Windows Update Manager><C:\dihf.exe> []
<RfwMain><"d:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINNT\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []

==================================
启动文件夹
服务
[Logical Disk Manager Administrative Service / dmadmin]
<C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[Rising Personal Firewall Service / RfwService]
<d:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Windows Update Manager / UpdateManager]
<C:\dihf.exe /updatemgr><N/A>

==================================
浏览器加载项
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <d:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <d:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>
[启动迅雷]
{0062C9BD-B349-40DE-91A0-755F37ACD559} <d:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <d:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <d:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[@msdxmLC.dll,-1@2052,电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[&使用迅雷下载]
<d:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
<d:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
[添加到QQ自定义面板]
<d:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<d:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<d:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 140][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.00.2195.6601>
[PID: 164][\??\C:\WINNT\system32\csrss.exe] <Microsoft Corporation><5.00.2195.6601>
[PID: 160][\??\C:\WINNT\system32\winlogon.exe] <Microsoft Corporation><5.00.2195.6714>
[PID: 212][C:\WINNT\system32\services.exe] <Microsoft Corporation><5.00.2195.6700>
[C:\WINNT\system32\dmserver.dll] <VERITAS Software Corp.><2195.6605.297.3>
[PID: 224][C:\WINNT\system32\lsass.exe] <Microsoft Corporation><5.00.2195.6695>
[PID: 384][d:\program files\rising\rfw\rfwsrv.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 25>
[d:\program files\rising\rfw\RfwRule.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 10>
[d:\program files\rising\rfw\rfwlog.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 6>
[d:\program files\rising\rfw\Rfwdrv.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 19>
[d:\program files\rising\rfw\MonDrv.dll] <rs><1, 0, 0, 4>
[d:\program files\rising\rfw\ProcLib.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 9>
[d:\program files\rising\rfw\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
[PID: 452][C:\WINNT\system32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[PID: 480][C:\WINNT\system32\spoolsv.exe] <Microsoft Corporation><5.00.2195.6659>
[PID: 512][C:\WINNT\system32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[PID: 552][C:\WINNT\system32\regsvc.exe] <Microsoft Corporation><5.00.2195.6701>
[PID: 588][C:\WINNT\system32\MSTask.exe] <Microsoft Corporation><4.71.2195.6704>
[PID: 644][C:\dihf.exe] <N/A><N/A>
[PID: 684][C:\WINNT\System32\WBEM\WinMgmt.exe] <Microsoft Corporation><1.50.1085.0100>
[PID: 716][C:\WINNT\system32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[PID: 828][C:\WINNT\Explorer.EXE] <Microsoft Corporation><5.00.3700.6690>
[d:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll] <Thunder Networking Technologies,LTD><5, 0, 0, 2>
[C:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[PID: 892][d:\program files\rising\rfw\RfwMain.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 40>
[d:\program files\rising\rfw\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23>
[d:\program files\rising\rfw\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[d:\program files\rising\rfw\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 796][C:\Program Files\Chinanet\VnetClient.exe] <><1, 0, 0, 1>
[C:\WINNT\system32\Macromed\Flash\Flash9.ocx] <Adobe Systems, Inc.><9,0,16,0>
[PID: 1108][D:\Program Files\Tencent\TT\TTraveler.exe] <腾讯公司><3.1.0.259>
[D:\Program Files\Tencent\TT\Plugins\QQFloatBar\QQFloatBar4TT2.dll] <腾讯公司><1, 1, 0, 5>
[D:\Program Files\Tencent\TT\Plugins\TWeather\TWeather.dll] <><1, 0, 0, 3>
[D:\Program Files\Tencent\TT\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 4>
[C:\WINNT\system32\Macromed\Flash\Flash9.ocx] <Adobe Systems, Inc.><9,0,16,0>
[PID: 1272][C:\TDdownload\sreng2\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINNT\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

瑞星卡卡安全论坛