瑞星卡卡安全论坛
yuweiwei - 2006-9-15 11:40:00
不小心下了个软件,安装的时候感觉不对劲,马上停止安装可是已经晚了,系统已经不听指挥了.CPU占有达到100,进程数有5.60个,重启后只有光突突的桌面,只能用任务管理器打开瑞星杀毒,杀了17个,再重起,才勉强能启动,可是很卡,而且经常跳出IE窗口.哪位大哥帮看看我的扫描报告
2006-09-15,11:20:46
System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)
Windows XP Home Edition Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能
以下内容被选中:
所有的启动项目(包括注册表、启动文件夹、服务等)
浏览器加载项
正在运行的进程(包括进程模块信息)
文件关联
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]
<WebThunder><C:\Program Files\Thunder Network\WebThunder\WebThunder.exe> [深圳市迅雷网络技术有限公司]
<NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [NVIDIA Corporation]
<桌面图标文字自动透明><C:\Program Files\WoptiUtilities\WoptiMem.exe XP> []
<SoundMam><C:\WINDOWS\system32\SVOHOST.exe> []
<Torjan Program><C:\WINDOWS\WINLOGON.EXE> [rmXYFBIwlnb8O7jRG8fS]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
<Torjan Program><C:\WINDOWS\WINLOGON.EXE> [rmXYFBIwlnb8O7jRG8fS]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<9><C:\WINDOWS\system32\Ravdm.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\Userinit.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{D157330A-9EF3-49F8-9A67-4141AC41ADD4}><> []
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
<{9A0CFC58-5A6F-41ba-9FFE-4320F4F62FBA}><C:\WINDOWS\system32\cnscheck.dll> []
==================================
启动文件夹
[IE-Bar]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\IE-Bar.lnk><N>
==================================
服务
[NVIDIA Display Driver Service / NVSvc]
<C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[Rising Process Communication Center / RsCCenter]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[SVCHAST / SystemInspect]
<C:\Program Files\SystemInspect\SVCHAST.exe><N/A>
[Update Service For Windows / winupdate]
<C:\WINDOWS\winupdate.exe><N/A>
==================================
浏览器加载项
[]
{3D898C55-74CC-4B7C-B5F1-45913F368388} <C:\PROGRA~1\SYSTEM~1\SYSTEM~1.DLL, N/A>
[]
{A9930D97-9CF0-42A0-A10D-4F28836579D5} <F:\KuGoo3\KuGoo3DownXControl.ocx, N/A>
[]
{D3931E9E-AE61-46B1-99BA-91C438A2C855} <C:\WINDOWS\system32\wp237211.dll, 3721公司<推荐使用>>
[]
{E730189A-9973-4121-B046-AD1C161EC3AF} <C:\WINDOWS\system32\37211.dll, N/A>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, N/A>
[AxInputControl Class]
{73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL, >
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8a.ocx, Macromedia, Inc.>
[Rising Web Scan Object]
{E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[]
{3D898C55-74CC-4B7C-B5F1-45913F368388} <C:\PROGRA~1\SYSTEM~1\SYSTEM~1.DLL, N/A>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Active Desktop Mover]
{72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
[AxInputControl Class]
{73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL, >
[MediaComm Class]
{7670648D-461B-42AF-BDFE-46D26AF5EFF2} <F:\迅雷\Components\InMedia\MediaAddin07.dll, Thunder Networking Technologies,LTD>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[AxSubmitControl Class]
{8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} <C:\WINDOWS\DOWNLO~1\SUBMIT~1.DLL, >
[PPRich]
{9D966685-3D58-4170-B008-05BD7C1628B0} <C:\PROGRA~1\PPRich\PPRich.ocx, N/A>
[]
{A9930D97-9CF0-42A0-A10D-4F28836579D5} <F:\KuGoo3\KuGoo3DownXControl.ocx, N/A>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[卡卡上网安全助手]
{AFF6E516-CBE5-4F8A-9C2F-38A68013E766} <C:\WINDOWS\system32\kakatool.dll, N/A>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
{CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[QuickBtn]
{D1BB7CF4-4463-4E91-88D7-ECC3CE0A13B7} <C:\Program Files\CoolWebsite\QuickLink.dll, N/A>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8a.ocx, Macromedia, Inc.>
[]
{D3931E9E-AE61-46B1-99BA-91C438A2C855} <C:\WINDOWS\system32\wp237211.dll, 3721公司<推荐使用>>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, N/A>
[Rising Web Scan Object]
{E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.>
[]
{E730189A-9973-4121-B046-AD1C161EC3AF} <C:\WINDOWS\system32\37211.dll, N/A>
[上传到QQ网络硬盘]
<F:\QQ\AddToNetDisk.htm, N/A>
[使用KuGoo3下载(&K)]
<F:\KuGoo3\KuGoo3DownX.htm, N/A>
[添加到QQ自定义面板]
<F:\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<F:\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<F:\QQ\SendMMS.htm, N/A>
[访问通用网址]
<C:\Program Files\CNNIC\Cdn\cnnic.htm, N/A>
yuweiwei - 2006-9-15 11:41:00
==================================
正在运行的进程
[PID: 448][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 528][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 552][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 596][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 608][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 756][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\cnscheck.dll] <N/A><N/A>
[PID: 812][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 884][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 932][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1028][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1236][C:\WINDOWS\Explorer.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\myrx.dll] <N/A><N/A>
[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[C:\WINDOWS\system32\cnscheck.dll] <N/A><N/A>
[C:\PROGRA~1\SYSTEM~1\SYSTEM~1.DLL] <N/A><N/A>
[C:\WINDOWS\system32\wp237211.dll] <3721公司<推荐使用>><1.0.0.0>
[PID: 1708][C:\WINDOWS\system32\nvsvc32.exe] <NVIDIA Corporation><6.14.10.7184>
[C:\WINDOWS\system32\cnscheck.dll] <N/A><N/A>
[PID: 1832][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1856][C:\Program Files\SystemInspect\SVCHAST.exe] <N/A><N/A>
[C:\WINDOWS\system32\cnscheck.dll] <N/A><N/A>
[PID: 1884][C:\WINDOWS\system32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: DNSRV(bld4act)>
[PID: 1924][C:\WINDOWS\winupdate.exe] <N/A><N/A>
[C:\WINDOWS\system32\cnscheck.dll] <N/A><N/A>
[PID: 648][C:\Program Files\Thunder Network\WebThunder\WebThunder.exe] <深圳市迅雷网络技术有限公司><1, 1, 6, 41>
[C:\Program Files\Thunder Network\WebThunder\taskmanage.dll] <Thunder Networking Technologies,LTD><1, 1, 0, 42>
[C:\Program Files\Thunder Network\WebThunder\download_interface.dll] <Thunder Networking Technologies,LTD><1, 0, 3, 70>
[C:\Program Files\Thunder Network\WebThunder\asyn_dns.dll] <N/A><N/A>
[C:\Program Files\Thunder Network\WebThunder\RegisterDll.dll] <Thunder Networking Technologies,LTD><2, 0, 0, 13>
[C:\Program Files\Thunder Network\WebThunder\historyinfo_manage.dll] <Thunder Networking Technologies,LTD><5, 2, 0, 150>
[C:\Program Files\Thunder Network\WebThunder\UpdateDownload.dll] <Thunder Networking Technologies,LTD><1, 0, 1, 8>
[C:\Program Files\Thunder Network\WebThunder\UpdateExec.dll] <Thunder Networking Technologies,LTD><1, 0, 1, 5>
[C:\Program Files\Thunder Network\WebThunder\iEmbedShell.dll] < ><1, 0, 0, 10>
[F:\迅雷\Components\InMedia\iEmbed04.dll] < ><2, 3, 0, 37>
[C:\WINDOWS\system32\cnscheck.dll] <N/A><N/A>
[PID: 1204][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\cnscheck.dll] <N/A><N/A>
[PID: 1432][C:\WINDOWS\WINLOGON.EXE] <rmXYFBIwlnb8O7jRG8fS><0.00.0106>
[C:\WINDOWS\system32\cnscheck.dll] <N/A><N/A>
[PID: 2000][C:\WINDOWS\system32\rundll32.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\DOCUME~1\Owner\TEMPLA~1\4fd03ab\1.dll] <千橡互联><3, 0, 2, 0>
[C:\DOCUME~1\Owner\TEMPLA~1\4fd03ab\3.dll] <千橡互联><3, 0, 2, 8>
[C:\DOCUME~1\Owner\TEMPLA~1\4fd03ab\4.dll] <千橡互联><3, 0, 2, 8>
[C:\WINDOWS\system32\cnscheck.dll] <N/A><N/A>
[PID: 1300][C:\WINDOWS\system32\conime.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\cnscheck.dll] <N/A><N/A>
[PID: 432][C:\Documents and Settings\Owner\桌面\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\WINDOWS\system32\cnscheck.dll] <N/A><N/A>
[PID: 1332][C:\WINDOWS\system32\wuauclt.exe] <Microsoft Corporation><5.4.3790.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1116][C:\Program Files\Internet Explorer\IEXPLORE.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\PROGRA~1\SYSTEM~1\SYSTEM~1.DLL] <N/A><N/A>
[F:\KuGoo3\KuGoo3DownXControl.ocx] <N/A><N/A>
[C:\WINDOWS\system32\wp237211.dll] <3721公司<推荐使用>><1.0.0.0>
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
==================================
Flying1889 - 2006-9-15 11:41:00
C:\WINDOWS\winupdate.exe
http://forum.ikaka.com/topic.asp?board=28&artid=7713905
参照
yuweiwei - 2006-9-15 13:18:00
你是说将注册表中WINUPDATE项删除是吗?
我无邪 - 2006-9-15 14:14:00
进入控制面版的添加删除程序中卸载IE-Bar
C:\WINDOWS\system32\Ravdm.exe这一项看以下的帖子
http://forum.ikaka.com/topic.asp?board=28&artid=8156736
打开System Repair Engineer(也就是你的扫描日志软件SREng.exe),点“启动项目,服务,点“Win32服务应用程序”勾选“隐藏微软服务”选中病毒服务Update Service For Windows,SVCHAST,选择“删除服务”点“设置”选择“否”最后重启。(每一个逗号隔开的就是一个病毒的服务,请逐一删除)
关闭所有浏览窗口以及一些不必要的程序
打开System Repair Engineer(也就是你的扫描日志软件SREng.exe),使用“系统修复,浏览器加载项”来删除以下选项。
C:\PROGRA~1\SYSTEM~1\SYSTEM~1.DLL
C:\WINDOWS\system32\wp237211.dll
C:\WINDOWS\system32\37211.dll
C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL
C:\Program Files\CoolWebsite\QuickLink.dll
请到www.27814939.ys168.com,点“我的软件”下载KillBox.exe
请到http://forum.ikaka.com/topic.asp?board=67&artid=5188931,下载,LSPFix.exe,WinsockXPFix这两个软件
重新启动电脑, 开机检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式进入Windows
运行LSPFix.exe
删除
cnscheck.dll
附说明一份
LSPFix.exe这个软件主要用来辅助修复HijackThis扫描发现的O10项。
使用时,请关闭所有IE界面和文件夹界面后运行LSPFix,运行后,把要修复的那一个O10项从左边转到右边,点“Finish”即可。(不过这之前,需要在“I know what I`m doing”前面打勾。)
如果总是无法修复
看以下的帖子
解决Winsock LSP“浏览器劫持”的一些方法
http://forum.ikaka.com/topic.asp?board=67&artid=8162074
双击打开KillBox.exe,分别删除
C:\PROGRA~1\SYSTEM~1\SYSTEM~1.DLL
C:\WINDOWS\system32\wp237211.dll
C:\WINDOWS\system32\37211.dll
C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL
C:\Program Files\CoolWebsite\QuickLink.dll
C:\WINDOWS\system32\myrx.dll
C:\WINDOWS\system32\cnscheck.dll
C:\WINDOWS\winupdate.exe
C:\Program Files\SystemInspect\SVCHAST.exe
C:\WINDOWS\system32\SVOHOST.exe
C:\WINDOWS\WINLOGON.EXE
(删除时勾选“删除前先结束Explorer.EXE进程”不行再试着勾选"删除DLL文件前反注册此文件"
给菜鸟的东东—KillBox的使用技巧
http://forum.ikaka.com/topic.asp?board=28&artid=8160799
修复后重启,如果无法上网,请运行WinsockXPFix,让它修复一下。
打开System Repair Engineer(也就是你的扫描日志软件SREng.exe),使用“启动项目,注册表”来删除以下选项。
C:\WINDOWS\system32\SVOHOST.exe
C:\WINDOWS\WINLOGON.EXE
C:\WINDOWS\WINLOGON.EXE
重启。回到正常模式,请再扫日志粘上来。
yuweiwei - 2006-9-15 20:16:00
我应该是按照上面说的一步一步做的,不过在修复过程中碰到了一些问题,所以也没有修复完全,请在指教.
1.那个Rinld.sys系统提示无法删除,所以没删.
2.C:\WINDOWS\system32\37211.dll
C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL
C:\Program Files\CoolWebsite\QuickLink.dll这3个东西没找到.
3.cnscheck.dll这个文件LSPFix找不到,killbox倒是找到了,不过提示不允许删除,所以也没删.
现在我暂时发现的问题是:
1.开机后不能出现桌面的所有菜单,就是一片空白的桌面.我都是通过任务管理器打开EXPLORER,要过大概10分钟才能出现桌面的各种图标和任务栏
2.各种文件的图标颜色变的很奇怪,好象是颜色质量给人调低了造成的缺色,不过在颜色设置那里我调的颜色质量是最高.
3.整个机子哑巴了,没声音播放声音文件时提示没有安装声音设备.可是在硬件管理那里声音设备都显示安装正常.
4.部分程序,比如winRAR不能正常工作了.
扫描结果如下:
2006-09-15,19:51:55
System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)
Windows XP Home Edition Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能
以下内容被选中:
所有的启动项目(包括注册表、启动文件夹、服务等)
浏览器加载项
正在运行的进程(包括进程模块信息)
文件关联
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]
<WebThunder><C:\Program Files\Thunder Network\WebThunder\WebThunder.exe> [深圳市迅雷网络技术有限公司]
<桌面图标文字自动透明><C:\Program Files\WoptiUtilities\WoptiMem.exe XP> []
<桌面图标文字自动><> []
<NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [NVIDIA Corporation]
<ToP><C:\WINDOWS\LSASS.exe> [PysXubeGV2SkR3ncT0oE]
<TProgram><C:\WINDOWS\smss.exe> [plVWDGvkm9a6N5hPE7dQ]
<MSService_v1.0><C:\WINDOWS\system\realsched.exe> []
<RichMedia><C:\WINDOWS\system32\Rundll32.exe "C:\PROGRA~1\pcast\hbcast.dll",WaitWindows> [Shanghai Henbang Technology Co., Ltd]
<><C:\WINDOWS\system32\intenat.exe> []
<Tray><C:\WINDOWS\command\rundll32.exe> []
<ms><C:\Program Files\Microsoft\svhost32.exe> []
<zt><C:\WINDOWS\Intel\rundll32.exe> []
<Update><C:\Program Files\Common Files\UPDATE2\Update.exe> []
<spoolsv><C:\WINDOWS\system32\spoolsv\spoolsv.exe -printer> [广州傲讯信息科技有限公司]
<CdnCtr><C:\Program Files\CNNIC\Cdn\cdnup.exe> []
<Synchronization><rundll32.exe C:\WINDOWS\system32\MSCOMCT32.dll,DllUnregisterServer> []
<softbox><C:\WINDOWS\system32\softbox.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<KernelCheck><C:\WINDOWS\system32\winasse.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><explorer.exe 1> []
<Userinit><C:\WINDOWS\system32\Userinit.exe,C:\WINDOWS\system32\internst.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{D157330A-9EF3-49F8-9A67-4141AC41ADD4}><> []
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
<{9A0CFC58-5A6F-41ba-9FFE-4320F4F62FBA}><C:\WINDOWS\system32\cnscheck.dll> []
<{288BD9BD-F0DC-46B1-81B5-2B61DF8077CE}><C:\WINDOWS\system32\zt.dLL> []
<{6E44887F-5214-41F2-AB46-4728735C4CC6}><C:\Program Files\Internet Explorer\PLUGINS\system.sys> []
==================================
启动文件夹
服务
[NVIDIA Display Driver Service / NVSvc]
<C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[Rising Process Communication Center / RsCCenter]
<"C:\Program Files\Rising\Rav\CCenter.exe"><N/A>
[RsRavMon Service / RsRavMon]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><N/A>
==================================
浏览器加载项
[wmpdrm]
{0E674588-66B7-4E19-9D0E-2053B800F69F} <C:\WINDOWS\system32\wmpdrm.dll, Allsum Info. Tech. Ltd.>
[MyIEHelper Class]
{16B770A0-0E87-4278-B748-2460D64A8386} <C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\IEHelper_5072.dll, N/A>
[]
{3D898C55-74CC-4B7C-B5F1-45913F368388} <C:\PROGRA~1\SYSTEM~1\SYSTEM~1.DLL, N/A>
[raObject Class]
{46F194EB-B7DB-4B7A-BD42-5FF39FD17664} <C:\PROGRA~1\pcast\hbcast.dll, Shanghai Henbang Technology Co., Ltd>
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[实用搜索]
{6CFD436C-7AAD-4e50-992F-C0C87A94CAD2} <C:\Program Files\UtilToolBar\utilbar.dll, Shanghai Leysin Technology Co, Ltd.>
[BHOImp Class]
{70AFF2CB-9DA2-499C-8D15-900729FCE83D} <C:\WINDOWS\system32\YHBO.dll, YHBO>
[WinSC Class]
{9ACEEE31-1440-471B-AA46-72B061FE7D61} <C:\WINDOWS\system32\WinSC.dll, N/A>
[]
{A9930D97-9CF0-42A0-A10D-4F28836579D5} <F:\KuGoo3\KuGoo3DownXControl.ocx, N/A>
[QuickBtn]
{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7} <C:\Program Files\kuzhan\kuzhan.dll, >
[DuiSo.com Search]
{E2218499-2FD4-4EED-A94A-7F0B9C6E300E} <C:\WINDOWS\system32\Inte32.dll, N/A>
[QuickBtn]
{1D901067-2529-4A9B-9B6B-7A1DB3A44CB5} <C:\Program Files\kuzhan\kuzhan.dll, >
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, N/A>
[实用搜索工具条V2.0]
{75D82598-4A3C-419e-99D2-3EB56D09CFD0} <C:\Program Files\UtilToolBar\utilbar.dll, Shanghai Leysin Technology Co, Ltd.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8a.ocx, Macromedia, Inc.>
[Rising Web Scan Object]
{E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.>
[wmpdrm]
{0E674588-66B7-4E19-9D0E-2053B800F69F} <C:\WINDOWS\system32\wmpdrm.dll, Allsum Info. Tech. Ltd.>
[MyIEHelper Class]
{16B770A0-0E87-4278-B748-2460D64A8386} <C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\IEHelper_5072.dll, N/A>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[Tabular Data Control]
{333C7BC4-460F-11D0-BC04-0080C7055A83} <C:\WINDOWS\system32\tdc.ocx, Microsoft Corporation>
[]
{3D898C55-74CC-4B7C-B5F1-45913F368388} <C:\PROGRA~1\SYSTEM~1\SYSTEM~1.DLL, N/A>
[raObject Class]
{46F194EB-B7DB-4B7A-BD42-5FF39FD17664} <C:\PROGRA~1\pcast\hbcast.dll, Shanghai Henbang Technology Co., Ltd>
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[实用搜索]
{6CFD436C-7AAD-4E50-992F-C0C87A94CAD2} <C:\Program Files\UtilToolBar\utilbar.dll, Shanghai Leysin Technology Co, Ltd.>
[BHOImp Class]
{70AFF2CB-9DA2-499C-8D15-900729FCE83D} <C:\WINDOWS\system32\YHBO.dll, YHBO>
[Active Desktop Mover]
{72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
[实用搜索工具条V2.0]
{75D82598-4A3C-419E-99D2-3EB56D09CFD0} <C:\Program Files\UtilToolBar\utilbar.dll, Shanghai Leysin Technology Co, Ltd.>
[MediaComm Class]
{7670648D-461B-42AF-BDFE-46D26AF5EFF2} <F:\迅雷\Components\InMedia\MediaAddin07.dll, Thunder Networking Technologies,LTD>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[AxSubmitControl Class]
{8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} <C:\WINDOWS\DOWNLO~1\SUBMIT~1.DLL, >
[WinSC Class]
{9ACEEE31-1440-471B-AA46-72B061FE7D61} <C:\WINDOWS\system32\WinSC.dll, N/A>
[PPRich]
{9D966685-3D58-4170-B008-05BD7C1628B0} <C:\PROGRA~1\PPRich\PPRich.ocx, N/A>
[]
{A9930D97-9CF0-42A0-A10D-4F28836579D5} <F:\KuGoo3\KuGoo3DownXControl.ocx, N/A>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[卡卡上网安全助手]
{AFF6E516-CBE5-4F8A-9C2F-38A68013E766} <C:\WINDOWS\system32\kakatool.dll, N/A>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[AUDIO__MP3 Moniker Class]
{CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
{CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[QuickBtn]
{D1BB7CF4-4463-4E91-88D7-ECC3CE0A13B7} <C:\Program Files\kuzhan\kuzhan.dll, >
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8a.ocx, Macromedia, Inc.>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, N/A>
[DuiSo.com Search]
{E2218499-2FD4-4EED-A94A-7F0B9C6E300E} <C:\WINDOWS\system32\Inte32.dll, N/A>
[Rising Web Scan Object]
{E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.>
[使用KuGoo3下载(&K)]
<F:\KuGoo3\KuGoo3DownX.htm, N/A>
[添加到QQ自定义面板]
<F:\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<F:\QQ\AddEmotion.htm, N/A>
[访问通用网址]
<C:\Program Files\CNNIC\Cdn\cnnic.htm, N/A>
yuweiwei - 2006-9-15 20:23:00
==================================
正在运行的进程
[PID: 320][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 376][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 400][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 444][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\cnscheck.dll] <N/A><N/A>
[C:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[C:\WINDOWS\system32\zt.dLL] <N/A><N/A>
[C:\WINDOWS\system32\msdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\ztdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\tdll.dll] <N/A><N/A>
[PID: 456][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 596][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 644][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 728][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 776][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 992][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[C:\WINDOWS\system32\cnscheck.dll] <N/A><N/A>
[C:\WINDOWS\system32\zt.dLL] <N/A><N/A>
[C:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[C:\WINDOWS\system32\myrx.dll] <N/A><N/A>
[C:\WINDOWS\system32\msicn\msibm.dll] <广州傲讯信息科技有限公司><2, 0, 0, 1>
[C:\WINDOWS\system32\tdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\ztdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\msdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\msicn\plugins\bse.dll] <广州傲讯信息科技有限公司><2, 0, 0, 1>
[C:\WINDOWS\system32\msicn\plugins\lup.dll] <广州傲讯信息科技有限公司><2, 0, 0, 1>
[C:\WINDOWS\system32\msicn\plugins\bm.dll] <广州傲讯信息科技有限公司><2, 0, 0, 1>
[C:\WINDOWS\system32\msicn\plugins\as.dll] <广州傲讯信息科技有限公司><2, 0, 0, 1>
[C:\WINDOWS\system32\msicn\plugins\navangel.dll] <广州傲讯信息科技有限公司><2, 0, 0, 1>
[C:\WINDOWS\system32\nvcpl.dll] <NVIDIA Corporation><6.14.10.7184>
[C:\WINDOWS\system32\NVRSZHC.DLL] <NVIDIA Corporation><6.14.10.7184>
[C:\WINDOWS\system32\nvshell.dll] <NVIDIA Corporation><6.14.10.10035>
[C:\Program Files\UtilToolBar\utilbar.dll] <Shanghai Leysin Technology Co, Ltd.><2, 0, 729, 0>
[F:\KuGoo3\KuGoo3DownXControl.ocx] <N/A><N/A>
[C:\Program Files\kuzhan\kuzhan.dll] <><1, 0, 0, 1>
[PID: 1496][C:\WINDOWS\system32\nvsvc32.exe] <NVIDIA Corporation><6.14.10.7184>
[C:\WINDOWS\system32\cnscheck.dll] <N/A><N/A>
[PID: 1544][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1564][C:\WINDOWS\system32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: DNSRV(bld4act)>
[PID: 1740][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[C:\WINDOWS\system32\cnscheck.dll] <N/A><N/A>
[C:\WINDOWS\system32\zt.dLL] <N/A><N/A>
[C:\WINDOWS\system32\msicn\msibm.dll] <广州傲讯信息科技有限公司><2, 0, 0, 1>
[C:\WINDOWS\system32\tdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\ztdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\msdll.dll] <N/A><N/A>
[PID: 1832][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 148][C:\WINDOWS\system32\winasse.exe] <Microsoft Corporation><5.1.2600.0>
[C:\WINDOWS\system32\cnscheck.dll] <N/A><N/A>
[C:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[C:\WINDOWS\system32\zt.dLL] <N/A><N/A>
[C:\WINDOWS\system32\ztdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\tdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\msdll.dll] <N/A><N/A>
[PID: 208][C:\Program Files\Thunder Network\WebThunder\WebThunder.exe] <深圳市迅雷网络技术有限公司><1, 1, 6, 41>
[C:\Program Files\Thunder Network\WebThunder\taskmanage.dll] <Thunder Networking Technologies,LTD><1, 1, 0, 42>
[C:\Program Files\Thunder Network\WebThunder\download_interface.dll] <Thunder Networking Technologies,LTD><1, 0, 3, 70>
[C:\Program Files\Thunder Network\WebThunder\asyn_dns.dll] <N/A><N/A>
[C:\Program Files\Thunder Network\WebThunder\RegisterDll.dll] <Thunder Networking Technologies,LTD><2, 0, 0, 13>
[C:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[C:\Program Files\Thunder Network\WebThunder\historyinfo_manage.dll] <Thunder Networking Technologies,LTD><5, 2, 0, 150>
[C:\Program Files\Thunder Network\WebThunder\UpdateDownload.dll] <Thunder Networking Technologies,LTD><1, 0, 1, 8>
[C:\Program Files\Thunder Network\WebThunder\UpdateExec.dll] <Thunder Networking Technologies,LTD><1, 0, 1, 5>
[C:\WINDOWS\system32\cnscheck.dll] <N/A><N/A>
[C:\WINDOWS\system32\zt.dLL] <N/A><N/A>
[C:\Program Files\Thunder Network\WebThunder\iEmbedShell.dll] < ><1, 0, 0, 10>
[F:\迅雷\Components\InMedia\iEmbed04.dll] < ><2, 3, 0, 37>
[C:\WINDOWS\system32\msdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\ztdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\tdll.dll] <N/A><N/A>
yuweiwei - 2006-9-15 20:23:00
[PID: 344][C:\WINDOWS\LSASS.exe] <PysXubeGV2SkR3ncT0oE><0.00.0106>
[C:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[C:\WINDOWS\system32\cnscheck.dll] <N/A><N/A>
[C:\WINDOWS\system32\zt.dLL] <N/A><N/A>
[C:\WINDOWS\system32\msdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\ztdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\tdll.dll] <N/A><N/A>
[PID: 364][C:\WINDOWS\smss.exe] <plVWDGvkm9a6N5hPE7dQ><0.00.0106>
[C:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[C:\WINDOWS\system32\cnscheck.dll] <N/A><N/A>
[C:\WINDOWS\system32\zt.dLL] <N/A><N/A>
[C:\WINDOWS\system32\ztdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\tdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\msdll.dll] <N/A><N/A>
[PID: 804][C:\WINDOWS\system\realsched.exe] <N/A><N/A>
[C:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[C:\WINDOWS\system32\cnscheck.dll] <N/A><N/A>
[C:\WINDOWS\system32\msdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\ztdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\tdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\zt.dLL] <N/A><N/A>
[C:\WINDOWS\system32\msicn\msibm.dll] <广州傲讯信息科技有限公司><2, 0, 0, 1>
[PID: 888][C:\WINDOWS\system32\Rundll32.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\PROGRA~1\pcast\hbcast.dll] <Shanghai Henbang Technology Co., Ltd><1, 1, 3, 8>
[C:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[C:\WINDOWS\system32\cnscheck.dll] <N/A><N/A>
[C:\WINDOWS\system32\zt.dLL] <N/A><N/A>
[C:\WINDOWS\system32\msdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\ztdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\tdll.dll] <N/A><N/A>
[PID: 956][C:\WINDOWS\system32\intenat.exe] <N/A><N/A>
[C:\WINDOWS\system32\cnscheck.dll] <N/A><N/A>
[C:\WINDOWS\system32\msdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\ztdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\tdll.dll] <N/A><N/A>
[C:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[C:\WINDOWS\system32\zt.dLL] <N/A><N/A>
[PID: 1136][C:\WINDOWS\command\rundll32.exe] <N/A><N/A>
[C:\WINDOWS\system32\tdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\cnscheck.dll] <N/A><N/A>
[C:\WINDOWS\system32\msdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\ztdll.dll] <N/A><N/A>
[C:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[C:\WINDOWS\system32\zt.dLL] <N/A><N/A>
[PID: 1180][C:\Program Files\Microsoft\svhost32.exe] <N/A><N/A>
[C:\WINDOWS\system32\msdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\cnscheck.dll] <N/A><N/A>
[C:\WINDOWS\system32\ztdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\tdll.dll] <N/A><N/A>
[C:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[C:\WINDOWS\system32\zt.dLL] <N/A><N/A>
[PID: 916][C:\WINDOWS\Intel\rundll32.exe] <N/A><N/A>
[C:\WINDOWS\system32\ztdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\msdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\tdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\cnscheck.dll] <N/A><N/A>
[C:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[C:\WINDOWS\system32\zt.dLL] <N/A><N/A>
[PID: 1512][C:\Documents and Settings\Owner\桌面\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[C:\WINDOWS\system32\cnscheck.dll] <N/A><N/A>
[C:\WINDOWS\system32\msdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\ztdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\tdll.dll] <N/A><N/A>
[C:\WINDOWS\system32\zt.dLL] <N/A><N/A>
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
==================================
我无邪 - 2006-9-15 20:41:00
病毒越发的多了,我建议你不要修复这个系统了,直接重装或还原系统了事。
1
© 2000 - 2026 Rising Corp. Ltd.