瑞星卡卡安全论坛

首页 » 技术交流区 » 反病毒/反流氓软件论坛 » QQ被盗过，请高手来帮忙看看日志，谢谢
三轮车甩尾 - 2006-9-17 16:00:00
正在运行的进程
[PID: 148][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.00.2195.6601>
[PID: 172][\??\C:\WINNT\system32\csrss.exe]  <Microsoft Corporation><5.00.2195.6601>
[PID: 192][\??\C:\WINNT\system32\winlogon.exe]  <Microsoft Corporation><5.00.2195.6970>
[PID: 220][C:\WINNT\system32\services.exe]  <Microsoft Corporation><5.00.2195.6700>
    [C:\WINNT\system32\dmserver.dll]  <VERITAS Software Corp.><2195.6605.297.3>
[PID: 232][C:\WINNT\system32\lsass.exe]  <Microsoft Corporation><5.00.2195.6902>
[PID: 396][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 424][C:\Program Files\rising\Rav\CCenter.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 440][C:\Program Files\rising\Rav\Ravmond.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 1, 35>
    [C:\Program Files\rising\Rav\BWList.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
    [C:\Program Files\rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\Program Files\rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [C:\Program Files\rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\rising\Rav\RsLog.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20>
    [C:\Program Files\rising\Rav\HOOKSYS.dll]  <Beijing Rising Technology Co., Ltd.><18, 1, 0, 11>
    [C:\Program Files\rising\Rav\Scanner.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 32>
    [C:\Program Files\rising\Rav\libload.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\rising\Rav\VirusLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
    [C:\Program Files\rising\Rav\regmon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
    [C:\Program Files\rising\Rav\HookWeb.dll]  <rising><18, 0, 0, 2>
    [C:\Program Files\rising\Rav\MemMon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\rising\Rav\expscan.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\rising\Rav\mPorts.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
    [C:\Program Files\rising\Rav\MailMon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
    [C:\Program Files\rising\Rav\SpamEng.dll]  <N/A><18, 0, 0, 6>
    [C:\Program Files\rising\Rav\engine.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 34>
    [C:\Program Files\rising\Rav\PostTrt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 15>
    [C:\Program Files\rising\Rav\UnExe.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\rising\Rav\ScanExec.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\rising\Rav\ScanEx.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
    [C:\Program Files\rising\Rav\RSUnpack.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 13>
    [C:\Program Files\rising\Rav\NvFile.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
    [C:\Program Files\rising\Rav\ScanMac.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
    [C:\Program Files\rising\Rav\ScanSct.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 18>
    [C:\Program Files\rising\Rav\Unpacker.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\rising\Rav\ExtOLE.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
    [C:\Program Files\rising\Rav\ScanElf.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
    [C:\Program Files\rising\Rav\ExtMail.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13>
[PID: 480][C:\WINNT\system32\spoolsv.exe]  <Microsoft Corporation><5.00.2195.6659>
    [C:\WINNT\system32\AdobePDF.dll]  <Adobe Systems Incorporated.><7.0.0.00>
    [C:\Program Files\Adobe\Acrobat 7.0\Distillr\AdistRes.CHS]  <N/A><N/A>
    [C:\WINNT\system32\HPBMMON.DLL]  <Hewlett-Packard><10.00.16>
    [C:\WINNT\system32\hppamon0.dll]  <HP><5, 0, 5, 0>
    [C:\WINNT\system32\hpdomon.dll]  <Hewlett-Packard><03.42.00>
    [C:\WINNT\system32\HPBHealr.dll]  <N/A><N/A>
    [C:\WINNT\system32\spool\PRTPROCS\W32X86\IMFPrint.DLL]  <Zenographics, Inc.><5, 54, 330, 0>
    [C:\WINNT\system32\Imf32.dll]  <Zenographics, Inc.><5, 60, 1204, 0>
    [C:\WINNT\system32\ZTAG32.dll]  <Zenographics, Inc.><5, 60, 1210, 0>
    [C:\WINNT\system32\ZSPOOL.dll]  <Zenographics, Inc.><5, 51, 709, 0>
    [C:\WINNT\system32\spool\PRTPROCS\W32X86\vprproc.dll]  <Windows (R) 2000 DDK provider><5.00.2195.1620>
    [C:\WINNT\system32\hppadt40.dll]  <HP><5, 0, 5, 0>
    [C:\WINNT\system32\HPZidr12.dll]  <HP><5, 0, 5, 0>
    [C:\WINNT\system32\hpbmmjno.dll]  <Hewlett-Packard><00.01.00>
[PID: 516][C:\WINNT\System32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 556][C:\WINNT\system32\regsvc.exe]  <Microsoft Corporation><5.00.2195.6701>
[PID: 588][C:\WINNT\system32\MSTask.exe]  <Microsoft Corporation><4.71.2195.6920>
[PID: 644][C:\WINNT\system32\stisvc.exe]  <Microsoft Corporation><5.00.2195.6656>
[PID: 712][C:\WINNT\System32\WBEM\WinMgmt.exe]  <Microsoft Corporation><1.50.1085.0100>
[PID: 724][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 756][C:\Program Files\rising\Rav\RavStub.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
    [C:\Program Files\rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\Program Files\rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 1152][C:\WINNT\SOUNDMAN.EXE]  <Realtek Semiconductor Corp.><5.1.0.29>
[PID: 1180][C:\WINNT\System32\hkcmd.exe]  <Intel Corporation><3.0.0.3865>
    [C:\WINNT\System32\hccutils.DLL]  <Intel Corporation><3.0.0.3865>
    [C:\WINNT\System32\igfxdev.dll]  <Intel Corporation><3.0.0.3865>
    [C:\WINNT\System32\igfxsrvc.dll]  <Intel Corporation><3.0.0.3865>
    [C:\WINNT\System32\igfxhk.dll]  <Intel Corporation><3.0.0.3865>
    [C:\WINNT\System32\igfxres.dll]  <Intel Corporation><3.0.0.3865>
[PID: 1160][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  <RealNetworks, Inc.><0.1.0.3208>
[PID: 1212][C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe]  <Adobe Systems Inc.><7.0.1.2005092300>
    [C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.chs]  <Adobe Systems Inc.><7.0.0.0>
[PID: 1116][C:\Program Files\rising\Rav\RavTask.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
    [C:\Program Files\rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [C:\Program Files\rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
[PID: 1228][C:\Program Files\QuickTime\qttask.exe]  <Apple Computer, Inc.><7.0.4>
    [C:\WINNT\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 9>
[PID: 1248][C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe]  <Hewlett-Packard><00.00.13>
    [C:\WINNT\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 9>
    [C:\WINNT\system32\hpbprops.dll]  <Hewlett-Packard Company><1, 0, 42, 0>
三轮车甩尾 - 2006-9-17 16:01:00
[PID: 1256][C:\Program Files\rising\Rav\Ravmon.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 1, 33>
    [C:\Program Files\rising\Rav\RsGuiLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 26>
    [C:\Program Files\rising\Rav\BWList.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
    [C:\Program Files\rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [C:\Program Files\rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\Program Files\rising\Rav\PngDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
    [C:\WINNT\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 9>
[PID: 484][C:\WINNT\system32\internat.exe]  <Microsoft Corporation><5.00.2920.0000>
    [C:\WINNT\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 9>
[PID: 1336][C:\Program Files\Sony Ericsson\Mobile\audevicemgr.exe]  <Teleca Software Solutions AB><1, 2, 7, 1>
    [C:\Program Files\Sony Ericsson\Mobile\DMLg.dll]  <Teleca Software Solutions AB><1, 2, 1, 1>
    [C:\PROGRA~1\SONYER~1\MOBILE\MOBILE~1\PhoneNameDB_object.dll]  <Teleca Software Solutions AB><1, 0, 0,120>
    [C:\PROGRA~1\SONYER~1\MOBILE\MOBILE~1\db_objects.dll]  <Teleca Software Solutions AB><1, 0, 0,893>
    [C:\PROGRA~1\SONYER~1\Mobile\Sync.ocx]  <Teleca Software Solutions AB><1, 1, 0, 35>
    [C:\Program Files\Sony Ericsson\Mobile\SyncLg.dll]  <Teleca Software Solutions AB><1, 1, 0, 32>
[PID: 1400][c:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\MROUTE~2.EXE]  <Intuwave Ltd.><2, 2, 0, 371>
    [c:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\mRouterGateway.DLL]  <Intuwave Ltd.><2, 2, 0, 371>
    [c:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\mRouterPropPages.DLL]  <Intuwave Ltd.><2, 2, 0, 371>
    [c:\Program Files\Intuwave Ltd\Shared\mRouterRunTime\mRouterController.dll]  <Intuwave Ltd.><2, 2, 0, 371>
    [c:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\MROUTERTCP.DLL]  <Intuwave Ltd.><2, 2, 0, 371>
    [c:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\MROUTERSERIAL.DLL]  <Intuwave Ltd.><2, 2, 0, 371>
    [c:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\MROUTERIRSOCKETS.DLL]  <Intuwave Ltd.><2, 2, 0, 371>
    [c:\Program Files\Intuwave Ltd\Shared\mRouterRunTime\mRouterBluetooth.dll]  <Intuwave Ltd.><2, 2, 0, 371>
    [c:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\MROUTERWINSOCK.DLL]  <Intuwave Ltd.><2, 2, 0, 371>
    [c:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\mRouterAccessPoint.dll]  <Intuwave Ltd.><2, 2, 0, 371>
[PID: 1440][C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe]  <N/A><N/A>
    [C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\hotspot\jvm.dll]  <N/A><N/A>
    [C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\hpi.dll]  <N/A><N/A>
    [C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\verify.dll]  <N/A><N/A>
    [C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\java.dll]  <N/A><N/A>
    [C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\zip.dll]  <N/A><N/A>
    [C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\net.dll]  <N/A><N/A>
    [C:\WINNT\system32\d4channel.dll]  <Hewlett-Packard><02.07.00>
[PID: 1488][C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\CONNMN~1.EXE]  <Symbian Ltd.><1, 0, 0, 41>
    [C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\CracDlr.dll]  <N/A><N/A>
    [C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\Wswitch.dll]  <N/A><N/A>
    [C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\ConnMngmntRes.dll]  <Symbian Ltd.><2, 0, 0, 277>
    [c:\Program Files\Intuwave Ltd\Shared\mRouterRunTime\mRouterController.dll]  <Intuwave Ltd.><2, 2, 0, 371>
[PID: 1196][C:\WINNT\system32\HPZipm12.exe]  <HP><5, 0, 5, 3>
[PID: 1548][C:\WINNT\system32\taskmgr.exe]  <Microsoft Corporation><5.00.2195.6620>
    [C:\WINNT\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 9>
[PID: 1564][C:\WINNT\explorer.exe]  <Microsoft Corporation><5.00.3700.6690>
    [C:\WINNT\downlo~1\CnsHook.dll]  <北京三七二一科技有限公司><1, 0, 3, 0>
    [C:\WINNT\system32\RavExt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
    [C:\WINNT\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 9>
    [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll]  <Adobe Systems Incorporated><7.0.5.2005092300>
    [C:\PROGRA~1\FLASHGET\jccatch.dll]  <Amaze Soft><1, 1, 4, 0>
    [C:\Program Files\rising\Rav\RavScrCh.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\WINNT\downlo~1\CnsMinIO.dll]  <北京三七二一科技有限公司><1, 0, 3, 6>
    [C:\WINNT\downlo~1\cnsio.dll]  <北京三七二一科技有限公司><1, 0, 2, 7>
    [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll]  <Adobe Systems, Inc.><7.0.0.0>
    [C:\Program Files\WinRAR\rarext.dll]  <N/A><N/A>
    [C:\Program Files\rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Sony Ericsson\Mobile\auexpext.dll]  <Teleca Software Solutions AB><1, 3, 1, 0>
    [C:\Program Files\Sony Ericsson\Mobile\FilGuiLg.dll]  <Teleca Software Solutions AB><1, 1, 2, 0>
[PID: 900][C:\WINNT\system32\Rundll32.exe]  <Microsoft Corporation><5.00.2134.1>
    [C:\WINNT\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 9>
    [C:\WINNT\downlo~1\CnsMinIO.dll]  <北京三七二一科技有限公司><1, 0, 3, 6>
    [C:\WINNT\downlo~1\cnsio.dll]  <北京三七二一科技有限公司><1, 0, 2, 7>
    [C:\WINNT\downlo~1\CnsMinEx.dll]  <国风因特软件(北京)有限公司><1, 0, 3, 3>
    [C:\Program Files\rising\Rav\RavScrCh.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 1596][C:\WINNT\system32\conime.exe]  <Microsoft Corporation><5.00.2195.6655>
    [C:\WINNT\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 9>
[PID: 872][\\sj2\e$\softbak\杀毒与安全\SREng2\SREng.exe]  <N/A><N/A>
    [C:\WINNT\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 9>
    [C:\Program Files\rising\Rav\RavScrCh.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 560][C:\WINNT\system32\HPBPRO.EXE]  <Hewlett-Packard Company><1, 0, 42, 0>
    [C:\WINNT\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 9>
    [C:\WINNT\system32\hpbprops.dll]  <Hewlett-Packard Company><1, 0, 42, 0>
三轮车甩尾 - 2006-9-17 16:01:00
浏览器加载项
[搜易网]
  {0C70DDB5-C059-4FDC-9C86-08DDB82B2056} <http://www.sooe.cn/shortcut/shortcut.asp, N/A>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[雅虎邮箱通]
  {D1B76CE4-CCCA-4B22-9ECB-09F85C140904} <yminimsgr:ClickIEBT, N/A>
[FlashGet]
  {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\flashget.exe, Amaze Soft>
[QQIEFloatBarCfgCmd Class]
  {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[@msdxmLC.dll,-1@2052,电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\System32\msdxm.ocx, Microsoft Corporation>
[FlashGet Bar]
  {E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[Adobe PDF]
  {47833539-D0C5-4125-9FA8-0819E2EAAC93} <C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll, Adobe Systems Incorporated>
[Shockwave ActiveX Control]
  {166B1BCA-3F9C-11CF-8075-444553540000} <C:\WINNT\system32\macromed\Shockwave 10\Download.dll, Adobe Systems, Inc.>
[WebActivater Control]
  {3D8F74EE-8692-4F8F-B8D2-7522E732519E} <C:\WINNT\system32\WEBACT~1.OCX, QQ>
[HCNetVideoActiveX Control]
  {AA25A56C-B654-4356-B390-DC3594B75C63} <C:\WINNT\system32\HCNETV~1.OCX, Hikvision>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash.ocx, Macromedia, Inc.>
[使用网际快车下载]
  <C:\Program Files\FlashGet\jc_link.htm, N/A>
[添加到QQ表情]
  <C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
三轮车甩尾 - 2006-9-17 16:02:00
Windows 2000 Professional Service Pack 4 (Build 2195)

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <Internat.exe><internat.exe>  [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <Synchronization Manager><mobsync.exe /logon>  [Microsoft Corporation]
    <SoundMan><SOUNDMAN.EXE>  [Realtek Semiconductor Corp.]
    <IgfxTray><C:\WINNT\System32\igfxtray.exe>  [Intel Corporation]
    <HotKeysCmds><C:\WINNT\System32\hkcmd.exe>  [Intel Corporation]
    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
    <Acrobat Assistant 7.0><"C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe">  [Adobe Systems Inc.]
    <RavTask><"C:\Program Files\rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
    <QuickTime Task><"C:\Program Files\QuickTime\qttask.exe" -atboottime>  [Apple Computer, Inc.]
    <StatusClient><C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto>  [Hewlett-Packard]
    <TomcatStartup><C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe>  [Hewlett-Packard]
    <HPLJ Config><C:\Program Files\Hewlett-Packard\hp LaserJet 1010 Series\SetConfig.exe -c Direct -p USB001 -pn "hp LaserJet 1010 Series Driver" -n 0 -l 2052 -sl 120000>  [Hewlett-Packard Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><explorer.exe>  [Microsoft Corporation]
    <Userinit><C:\WINNT\system32\userinit.exe,>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINNT\system32\RavExt.dll>  [Beijing Rising Technology Co., Ltd.]
    <{6E44887F-5214-41F2-AB46-4728735C4CC6}><C:\Program Files\Internet Explorer\PLUGINS\system.sys>  []

==================================
启动文件夹
[连接监控程序]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\连接监控程序.lnk><N>
[Adobe Acrobat Speed Launcher]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Acrobat Speed Launcher.lnk><N>
[腾讯QQ]
  <C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\腾讯QQ.lnk><N>

==================================
服务
[Logical Disk Manager Administrative Service / dmadmin]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[InstallDriver Table Manager / IDriverT]
  <C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe><Macrovision Corporation>
[Pml Driver HPZ12 / Pml Driver HPZ12]
  <C:\WINNT\system32\HPZipm12.exe><HP>
[Rising Process Communication Center / RsCCenter]
  <"C:\Program Files\rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
  <"C:\Program Files\rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
1
查看完整版本: QQ被盗过，请高手来帮忙看看日志，谢谢
© 2000 - 2026 Rising Corp. Ltd.