[求助］中毒了，日志和症状已上，请高手帮帮我！ bbs.ikaka.com

wsm涂涂 - 2006-9-26 9:45:00

一、病毒
　1、Trojan.DL.Agent.lwz　文件名dmsched.exe　
路径 C:\Program Files\Common Files\IE-Bar 杀掉后还会不断出现
　2、Trojan.DL.QQHelper.egp 文件名Update.exe
路径 C:\Program Files\UPDATE2\Update.exe　　
二、症状
　　开机好像有点慢但不知是不是病毒引起的，并且常跳出来一些奇怪的网站
　　今天开机后还跳出来一个框框内容为“加载　C:\WINDOWS\DOWNLO~1\CnMin.dll
时出错，找不到指定的模块”
三、扫描日志

HijackThis_815汉化版扫描日志 V1.99.1
保存于 9:34:53, 日期 2006-9-26
操作系统： Windows XP SP2 (WinNT 5.01.2600)
浏览器： Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程：
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
F:\错误报告\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
F:\错误报告\Rising\Rav\Ravmond.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ACS.exe
C:\Program Files\Warranty\warranty.exe
C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe
C:\Program Files\Fujitsu\DispSwitch\DispSwitchLauncher.exe
C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe
C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Fujitsu\updnavi\updnavi.exe
C:\Program Files\Atheros\ACU.exe
F:\错误报告\Rising\Rav\RavTask.exe
F:\软件下载\陈桥五~1\chenqxms.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\CTFMON.EXE
F:\错误报告\Rising\Rav\Ravmon.exe
C:\WINDOWS\system32\o2flash.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Apoint2K\HidFind.exe
C:\WINDOWS\system32\conime.exe
F:\错误报告\Rising\Rav\RavStub.exe
C:\WINDOWS\system32\svchost.exe
F:\错误报告\Rising\Rav\RsAgent.exe
C:\WINDOWS\msagent\AgentSvr.exe
C:\Program Files\Internet Explorer\iexplore.exe
F:\软件下载\Hijackthis\HijackThis1991zww.exe

O2 - BHO: 超级兔子上网精灵 - {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} - F:\超级兔子\MAGICSET\haokanbar.dll
O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - C:\PROGRA~1\baidu\bar\baidubar.dll
O3 - IE工具栏增项: 百度超级搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\PROGRA~1\baidu\bar\baidubar.dll
O3 - IE工具栏增项: 超级兔子上网精灵 - {43869BB3-22FD-4F15-9B46-238106BA2F4E} - F:\超级兔子\MAGICSET\haokanbar.dll
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [WarrantyReg] Program Files\Warranty\warranty.exe
O4 - 启动项HKLM\\Run: [LoadFUJ02E3] C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe
O4 - 启动项HKLM\\Run: [DispSwitchLauncher] C:\Program Files\Fujitsu\DispSwitch\DispSwitchLauncher.exe
O4 - 启动项HKLM\\Run: [IndicatorUtility] C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
O4 - 启动项HKLM\\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - 启动项HKLM\\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - 启动项HKLM\\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - 启动项HKLM\\Run: [LoadFujitsuQuickTouch] C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe
O4 - 启动项HKLM\\Run: [LoadBtnHnd] C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe
O4 - 启动项HKLM\\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - 启动项HKLM\\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - 启动项HKLM\\Run: [FJUPDNV_Chitose] C:\Program Files\Fujitsu\updnavi\updnavi.exe
O4 - 启动项HKLM\\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - 启动项HKLM\\Run: [StormCodec_Helper] "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti
O4 - 启动项HKLM\\Run: [RavTask] "F:\错误报告\Rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [qcsszjcz] f:\软件下载\陈桥五~1\chenqxms.exe
O4 - 启动项HKLM\\Run: [YLive.exe] ; C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
O4 - 启动项HKLM\\Run: [CnsMin] Rundll32.exe C:\WINDOWS\DOWNLO~1\CnsMin.dll,Rundll32
O4 - 启动项HKLM\\Run: [WangWang] ; "F:\软件下载\淘宝\淘宝旺旺\WangWang.EXE"
O4 - 启动项HKLM\\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - 启动项HKLM\\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - 启动项HKLM\\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: 腾讯QQ.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - IE右键菜单中的新增项目: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\geturl.htm
O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\getallurl.htm
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - F:\软件下载\qq\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 使用Web迅雷下载 - F:\软件下载\迅雷\GetUrl.htm
O8 - IE右键菜单中的新增项目: 使用Web迅雷下载全部链接 - F:\软件下载\迅雷\GetAllUrl.htm
O8 - IE右键菜单中的新增项目: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - F:\软件下载\qq\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - F:\软件下载\qq\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - F:\软件下载\qq\SendMMS.htm
O9 - 浏览器额外的按钮: 启动Web迅雷 - {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} - http://my.xunlei.com (file missing)
O9 - 浏览器额外的“工具”菜单项: 启动Web迅雷 - {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} - http://my.xunlei.com (file missing)
O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - F:\qq\QQ.EXE (file missing)
O9 - 浏览器额外的“工具”菜单项: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - F:\qq\QQ.EXE (file missing)
O9 - 浏览器额外的按钮: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - F:\qq\QQIEHelper.dll (file missing)
O9 - 浏览器额外的“工具”菜单项: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - F:\qq\QQIEHelper.dll (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://www.pc-ap.fujitsu.com/
O16 - DPF: {5932517A-3326-4439-A708-1C98EDB5C549} (Downloader Class) - file://C:\Documents and Settings\All Users\Application Data\clubmember\Cast\GGS\d51480b7b3\js\iMopDl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5E90CCAF-CA85-4481-8BA6-303021893B5A}: NameServer = 61.137.94.195 61.137.94.196
O17 - HKLM\System\CCS\Services\Tcpip\..\{837CD74D-BFCC-44F4-813C-44ACA401AFE1}: NameServer = 202.103.96.112,192.168.168.1
O23 - NT 服务: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\ACS.exe
O23 - NT 服务: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - NT 服务: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - NT 服务: O2Micro Flash Memory (O2Flash) - Unknown owner - C:\WINDOWS\system32\o2flash.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - F:\错误报告\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - F:\错误报告\Rising\Rav\Ravmond.exe

wsm涂涂 - 2006-9-26 10:08:00

顶一下先

wsm涂涂 - 2006-9-26 10:36:00

唉，还是再顶着吧

wsm涂涂 - 2006-9-26 11:15:00

再顶一下先

wsm涂涂 - 2006-9-26 11:18:00

高手高手在哪里啊，我已经等了三天了，都没人理

wsm涂涂 - 2006-9-26 11:21:00

wsm涂涂 - 2006-9-26 11:42:00

唉，真是悲哀啊，从早到晚的等，都没有高手经过

wsm涂涂 - 2006-9-26 11:54:00

wsm涂涂 - 2006-9-26 12:05:00

真的快疯了

无比上上狼 - 2006-9-26 12:33:00

有点耐心嘛,偶帮你顶~

deadmanzj - 2006-9-26 12:35:00

C:\Program Files\Common Files\IE-Bar里面有个卸载程序的，卸掉
下面那个你扫SREng日志上来

楼上的别灌水

wsm涂涂 - 2006-9-26 14:03:00

不好意思，我不明白，“下面那个是”什么啊，SREng的日志是
什么？跟我以上的日志有什么不同吗？

wsm涂涂 - 2006-9-26 14:06:00

那个IE－Bar什么的我好像在兔子里看到过把它卸了，但没什么用啊，再杀毒还是会出来

wsm涂涂 - 2006-9-26 14:10:00

westbeck - 2006-9-26 14:26:00

请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。谢谢．．．

wsm涂涂 - 2006-9-26 14:29:00

好的，马上去下，应该我谢谢你才对！

wsm涂涂 - 2006-9-26 14:34:00

2006-09-26,14:23:40

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Home Edition Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
<run><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation]
<PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation]
<PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]
<WarrantyReg><Program Files\Warranty\warranty.exe> []
<LoadFUJ02E3><C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe> [FUJITSU LIMITED]
<DispSwitchLauncher><C:\Program Files\Fujitsu\DispSwitch\DispSwitchLauncher.exe> [FUJITSU LIMITED]
<IndicatorUtility><C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe> [FUJITSU LIMITED]
<AGRSMMSG><AGRSMMSG.exe> [Agere Systems]
<LtMoh><C:\Program Files\ltmoh\Ltmoh.exe> [Agere Systems]
<Apoint><C:\Program Files\Apoint2K\Apoint.exe> [Alps Electric Co., Ltd.]
<LoadFujitsuQuickTouch><C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe> [FUJITSU LIMITED]
<LoadBtnHnd><C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe> [FUJITSU LIMITED]
<ATIPTA><C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe> [ATI Technologies, Inc.]
<dla><C:\WINDOWS\system32\dla\tfswctrl.exe> [Sonic Solutions]
<FJUPDNV_Chitose><C:\Program Files\Fujitsu\updnavi\updnavi.exe> [FUJITSU LIMITED]
<ACU><"C:\Program Files\Atheros\ACU.exe" -nogui> [Atheros Communications, Inc.]
<StormCodec_Helper><"C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti> []
<RavTask><"F:\错误报告\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<qcsszjcz><f:\软件下载\陈桥五~1\chenqxms.exe> [陈虎]
<YLive.exe><; C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe> []
<CnsMin><Rundll32.exe C:\WINDOWS\DOWNLO~1\CnsMin.dll,Rundll32> []
<WangWang><; "F:\软件下载\淘宝\淘宝旺旺\WangWang.EXE"> [淘宝（中国）软件有限公司]
<KernelFaultCheck><%systemroot%\system32\dumprep 0 -k> []
<ISUSPM Startup><C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup> [InstallShield Software Corporation]
<ISUSScheduler><"C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start> [InstallShield Software Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<RavStub><"F:\错误报告\Rising\Rav\ravstub.exe" /RUNONCE> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
<WinlogonNotify: AtiExtEvent><Ati2evxx.dll> [ATI Technologies Inc.]

wsm涂涂 - 2006-9-26 14:35:00

==================================
启动文件夹
[Adobe Gamma Loader]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Gamma Loader.lnk><H>
[腾讯QQ]
<C:\Documents and Settings\wsf\「开始」菜单\程序\启动\腾讯QQ.lnk><H>

==================================
服务
[Atheros Configuration Service / ACS]
<C:\WINDOWS\system32\ACS.exe><N/A>
[Ati HotKey Poller / Ati HotKey Poller]
<C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[InstallDriver Table Manager / IDriverT]
<"C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe"><Macrovision Corporation>
[O2Micro Flash Memory / O2Flash]
<C:\WINDOWS\system32\o2flash.exe><N/A>
[Rising Process Communication Center / RsCCenter]
<"F:\错误报告\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
<"F:\错误报告\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>

==================================
浏览器加载项
[超级兔子上网精灵]
{7369D35A-5B70-4A5B-B789-B25FE09B4AF3} <F:\超级兔子\MAGICSET\haokanbar.dll, Xiang Feng Technology>
[启动Web迅雷]
{962EFB8E-2683-42d4-AC74-AAA4C759B9C6} <http://my.xunlei.com, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <F:\qq\QQ.EXE, N/A>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <F:\qq\QQIEHelper.dll, N/A>
[超级兔子上网精灵]
{43869BB3-22FD-4F15-9B46-238106BA2F4E} <F:\超级兔子\MAGICSET\haokanbar.dll, Xiang Feng Technology>
[Downloader Class]
{5932517A-3326-4439-A708-1C98EDB5C549} <C:\WINDOWS\system32\iMopDl.dll, >
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[超级兔子上网精灵]
{43869BB3-22FD-4F15-9B46-238106BA2F4E} <F:\超级兔子\MAGICSET\haokanbar.dll, Xiang Feng Technology>
[超级兔子上网精灵]
{7369D35A-5B70-4A5B-B789-B25FE09B4AF3} <F:\超级兔子\MAGICSET\haokanbar.dll, Xiang Feng Technology>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[&使用迅雷下载]
<C:\Program Files\Thunder Network\Thunder\geturl.htm, N/A>
[&使用迅雷下载全部链接]
<C:\Program Files\Thunder Network\Thunder\getallurl.htm, N/A>
[上传到QQ网络硬盘]
<F:\软件下载\qq\AddToNetDisk.htm, N/A>
[使用Web迅雷下载]
<F:\软件下载\迅雷\GetUrl.htm, N/A>
[使用Web迅雷下载全部链接]
<F:\软件下载\迅雷\GetAllUrl.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
<F:\软件下载\qq\AddPanel.htm, N/A>
[添加到QQ表情]
<F:\软件下载\qq\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<F:\软件下载\qq\SendMMS.htm, N/A>

wsm涂涂 - 2006-9-26 14:37:00

==================================
正在运行的进程
[PID: 664][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 728][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 752][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\Ati2evxx.dll] <ATI Technologies Inc.><6.14.10.4110>
[PID: 796][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 808][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 980][C:\WINDOWS\system32\Ati2evxx.exe] <ATI Technologies Inc.><6.14.10.4110>
[C:\WINDOWS\system32\Ati2edxx.dll] <ATI Technologies, Inc.><6, 14, 10, 2495>
[PID: 992][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1084][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1204][F:\错误报告\Rising\Rav\CCenter.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 1220][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1292][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1552][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1572][C:\WINDOWS\system32\Ati2evxx.exe] <ATI Technologies Inc.><6.14.10.4110>
[C:\WINDOWS\system32\Ati2edxx.dll] <ATI Technologies, Inc.><6, 14, 10, 2495>
[PID: 1636][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[F:\软件下载\陈桥五~1\cqxms.dll] <N/A><N/A>
[C:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[F:\错误报告\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Common Files\Adobe\Shell\PSICON.DLL] <Adobe Systems, Incorporated><7.0>
[C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\VFuj02b1.dll] <FUJITSU LIMITED><2, 5, 0, 0>
[PID: 1660][F:\错误报告\Rising\Rav\Ravmond.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 35>
[F:\错误报告\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[F:\错误报告\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[F:\错误报告\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[F:\错误报告\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[F:\错误报告\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[F:\错误报告\Rising\Rav\RsLog.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20>
[F:\错误报告\Rising\Rav\HOOKSYS.dll] <Beijing Rising Technology Co., Ltd.><18, 1, 0, 11>
[F:\错误报告\Rising\Rav\Scanner.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 32>
[F:\错误报告\Rising\Rav\libload.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[F:\错误报告\Rising\Rav\VirusLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
[F:\错误报告\Rising\Rav\regmon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[F:\错误报告\Rising\Rav\HookWeb.dll] <rising><18, 0, 0, 2>
[F:\错误报告\Rising\Rav\MemMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[F:\错误报告\Rising\Rav\expscan.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[F:\错误报告\Rising\Rav\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
[F:\错误报告\Rising\Rav\MailMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[F:\错误报告\Rising\Rav\SpamEng.dll] <N/A><18, 0, 0, 6>
[F:\错误报告\Rising\Rav\engine.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 34>
[F:\错误报告\Rising\Rav\PostTrt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 15>
[F:\错误报告\Rising\Rav\UnExe.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[F:\错误报告\Rising\Rav\ScanExec.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[F:\错误报告\Rising\Rav\ScanEx.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 24>
[F:\错误报告\Rising\Rav\RSUnpack.dll] <Beijing Rising Technology Co., Ltd.><1, 0, 0, 17>
[F:\错误报告\Rising\Rav\NvFile.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
[F:\错误报告\Rising\Rav\ScanMac.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
[F:\错误报告\Rising\Rav\ScanSct.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 18>
[F:\错误报告\Rising\Rav\Unpacker.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>

wsm涂涂 - 2006-9-26 14:37:00

[PID: 1976][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)>
[PID: 2028][C:\WINDOWS\system32\ACS.exe] <N/A><N/A>
[C:\WINDOWS\system32\athcfg11.dll] <Atheros><4.1.1.211>
[C:\WINDOWS\system32\athcfg11Res.dll] <Atheros Communications, Inc.><4.1.1.211>
[C:\WINDOWS\system32\AegisE5.dll] <Meetinghouse Data Communications><3, 0, 16, 0>
[PID: 344][F:\错误报告\Rising\Rav\RavStub.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
[F:\错误报告\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[F:\错误报告\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 1312][C:\WINDOWS\system32\o2flash.exe] <N/A><N/A>
[PID: 1372][C:\WINDOWS\system32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: DNSRV(bld4act)>
[PID: 620][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1360][C:\Program Files\Warranty\warranty.exe] <Fujitsu PC Asia Pacific><2.00>
[PID: 428][C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe] <FUJITSU LIMITED><1, 1, 0, 0>
[PID: 440][C:\Program Files\Fujitsu\DispSwitch\DispSwitchLauncher.exe] <FUJITSU LIMITED><30, 0, 0, 0>
[PID: 540][C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe] <FUJITSU LIMITED><2, 5, 0, 0>
[C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\VFuj02b1.dll] <FUJITSU LIMITED><2, 5, 0, 0>
[C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\BrightMgr.dll] <FUJITSU LIMITED><2, 5, 0, 0>
[PID: 700][C:\WINDOWS\AGRSMMSG.exe] <Agere Systems><2.1.49 2.1.49 12/20/2004 15:10:02>
[PID: 2056][C:\Program Files\ltmoh\Ltmoh.exe] <Agere Systems><1.75>
[C:\Program Files\ltmoh\MOHAPI.dll] <Agere Systems><1.75>
[PID: 2064][C:\Program Files\Apoint2K\Apoint.exe] <Alps Electric Co., Ltd.><5.3.10.174>
[C:\WINDOWS\system32\VXDIF.DLL] <Alps Electric Co., Ltd.><6.0.2.66>
[C:\Program Files\Apoint2K\Apoint.DLL] <Alps Electric Co., Ltd.><5.3.8.233>
[C:\Program Files\Apoint2K\EzAuto.dll] <Alps Electric Co., Ltd.><4.5.1.83>
[C:\Program Files\Apoint2K\ApRotion.dll] <ALPS><5, 4, 1, 2>
[C:\Program Files\Apoint2K\EzLaunch.DLL] <Alps Electric Co., Ltd.><5.1.0.50>
[PID: 2084][C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe] <FUJITSU LIMITED><4, 4, 0, 0>
[C:\Program Files\Fujitsu\Application Panel\QuickMail.dll] <FUJITSU LIMITED><4, 4, 0, 0>
[C:\Program Files\Fujitsu\Application Panel\CDPlayer.dll] <FUJITSU LIMITED><4, 4, 0, 0>
[C:\Program Files\Fujitsu\Application Panel\ScrollButton.dll] <FUJITSU LIMITED><4, 4, 0, 0>
[PID: 2256][C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe] <FUJITSU LIMITED><2, 5, 0, 1>
[C:\Program Files\Fujitsu\BtnHnd\BtnHnd.dll] <FUJITSU LIMITED><2, 5, 2, 0>
[PID: 2308][C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe] <ATI Technologies, Inc.><6.14.10.5134>
[C:\Program Files\ATI Technologies\ATI Control Panel\atipdsxx.dll] <ATI Technologies, Inc.><6.14.10.5134>
[C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATRPUIXX.CHS] <ATI Technologies, Inc.><6.14.10.5134>
[C:\Program Files\ATI Technologies\ATI Control Panel\atipdxxx.dll] <ATI Technologies, Inc.><6.14.10.5134>
[PID: 2324][C:\WINDOWS\system32\dla\tfswctrl.exe] <Sonic Solutions><1.04.08a>
[C:\WINDOWS\system32\tfswapi.dll] <Sonic Solutions><1.04.08a>
[C:\WINDOWS\system32\dla\tfswcres.dll] <Sonic Solutions><1.04.08a>
[PID: 2348][C:\Program Files\Fujitsu\updnavi\updnavi.exe] <FUJITSU LIMITED><1, 1, 4, 6>
[C:\Program Files\Fujitsu\updnavi\DUM_DOWNLOAD.dll] <FUJITSU LIMITED><1, 0, 0, 0>
[C:\Program Files\Fujitsu\updnavi\DUM_CHECKFILE.dll] <FUJITSU LIMITED><1, 0, 0, 0>
[C:\Program Files\Fujitsu\updnavi\DUM_INSTALL.dll] <FUJITSU LIMITED><1, 0, 0, 1>
[PID: 2356][C:\Program Files\Apoint2K\Apntex.exe] <Alps Electric Co., Ltd.><5.0.1.15>
[C:\WINDOWS\system32\VXDIF.DLL] <Alps Electric Co., Ltd.><6.0.2.66>
[PID: 2376][C:\Program Files\Apoint2K\HidFind.exe] <Alps Electric Co., Ltd.><1.1.0.20>
[PID: 2380][C:\Program Files\Atheros\ACU.exe] <Atheros Communications, Inc.><4.1.1.211>
[C:\WINDOWS\system32\wcapi.dll] <Atheros><4.1.1.211>
[C:\WINDOWS\system32\athcfg11.dll] <Atheros><4.1.1.211>
[C:\WINDOWS\system32\athcfg11Res.dll] <Atheros Communications, Inc.><4.1.1.211>
[C:\WINDOWS\system32\wgapi.dll] <Atheros><4.1.1.211>
[C:\Program Files\Atheros\oemres.dll] <Atheros Communications, Inc.><4.1.1.211>
[PID: 2384][C:\WINDOWS\system32\conime.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 2448][F:\错误报告\Rising\Rav\RavTask.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
[F:\错误报告\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[F:\错误报告\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[F:\错误报告\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[F:\错误报告\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[PID: 2564][F:\错误报告\Rising\Rav\Ravmon.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 33>
[F:\错误报告\Rising\Rav\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 26>
[F:\错误报告\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[F:\错误报告\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[F:\错误报告\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[F:\错误报告\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[F:\错误报告\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[F:\错误报告\Rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 2568][F:\软件下载\陈桥五~1\chenqxms.exe] <陈虎><1.000>
[F:\软件下载\陈桥五~1\cqxms.dll] <N/A><N/A>
[PID: 2608][C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe] <InstallShield Software Corporation><3, 10, 100, 1143>
[PID: 2664][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 3852][F:\错误报告\Rising\Rav\RsAgent.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
[F:\错误报告\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[PID: 3908][C:\WINDOWS\msagent\AgentSvr.exe] <Microsoft Corporation><2.00.0.3422>
[F:\软件下载\陈桥五~1\cqxms.dll] <N/A><N/A>
[PID: 2280][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[F:\超级兔子\MAGICSET\haokanbar.dll] <Xiang Feng Technology><2, 2, 0, 1612>
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] <Adobe Systems, Inc.><9,0,16,0>
[C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\VFuj02b1.dll] <FUJITSU LIMITED><2, 5, 0, 0>
[F:\软件下载\陈桥五~1\cqxms.dll] <N/A><N/A>
[C:\WINDOWS\system32\CHENHU4.IME] <chenhu><5.8>
[PID: 2592][F:\软件下载\迅雷\WebThunder.exe] <深圳市迅雷网络技术有限公司><1, 2, 3, 53>
[F:\软件下载\迅雷\taskmanage.dll] <Thunder Networking Technologies,LTD><1, 1, 0, 45>
[F:\软件下载\迅雷\download_interface.dll] <Thunder Networking Technologies,LTD><1, 0, 4, 71>
[F:\软件下载\迅雷\asyn_dns.dll] <N/A><N/A>
[F:\软件下载\迅雷\RegisterDll.dll] <Thunder Networking Technologies,LTD><2, 1, 0, 24>
[F:\软件下载\迅雷\historyinfo_manage.dll] <Thunder Networking Technologies,LTD><5, 2, 0, 150>
[F:\软件下载\迅雷\UpdateDownload.dll] <Thunder Networking Technologies,LTD><1, 0, 1, 8>
[F:\软件下载\迅雷\UpdateExec.dll] <Thunder Networking Technologies,LTD><1, 0, 1, 5>
[F:\软件下载\迅雷\iEmbedShell.dll] <　><1, 0, 0, 12>
[F:\软件下载\迅雷\iEmbed05.dll] <　><2, 3, 1, 41>
[F:\软件下载\陈桥五~1\cqxms.dll] <N/A><N/A>
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] <Adobe Systems, Inc.><9,0,16,0>
[PID: 3196][F:\软件下载\sreng2\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[F:\软件下载\陈桥五~1\cqxms.dll] <N/A><N/A>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

瑞星卡卡安全论坛