救命!历史上最强的浏览器劫持piaoxue.com bbs.ikaka.com

zcrobin - 2006-10-9 22:30:00

现在主页是piaoxue.com 怎么改都改不过来在注册表中每次一改就瞬间被恢复了
就是那个 startpage的键值
2006-10-09,22:16:41

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<RavTask><; "C:\Program Files\Rising\Rav\RavTask.exe" -startup> [Beijing Rising Technology Co., Ltd.]
<RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]

==================================
启动文件夹
服务
[Ati HotKey Poller / Ati HotKey Poller]
<C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[Indexing Data / MOVEESS]
<C:\WINDOWS\SYSTEM32\RUNDLL.EXE C:\WINDOWS\SYSTEM32\WBEM\SMTPCONFS.DLL,Export 1087><N/A>
[Portable Media Serial Numbe / Portable Media Serial Numbe]
<C:\WINDOWS\msn.exe><N/A>
[Rising Proxy Service / RfwProxySrv]
<c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService]
<c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[Audio Adapter / VGADown]
<C:\WINDOWS\avp.exe><N/A>

==================================
浏览器加载项
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[OWSClientMiscApis Class]
{BDEADE3F-C265-11D0-BCED-00A0C90AB50F} <C:\PROGRA~1\MICROS~2\OFFICE11\OWSCLT.DLL, Microsoft Corporation>
[OWSBrowserUI Class]
{BDEADE43-C265-11D0-BCED-00A0C90AB50F} <C:\PROGRA~1\MICROS~2\OFFICE11\OWSCLT.DLL, Microsoft Corporation>
[OWSDiscussionServers Class]
{BDEADEB7-C265-11D0-BCED-00A0C90AB50F} <C:\PROGRA~1\MICROS~2\OFFICE11\OWSCLT.DLL, Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
{CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\flash.ocx, Macromedia, Inc.>
[Search Bar]
{FBFF8F98-AE9D-4599-975E-E9B31E88EF04} <C:\WINDOWS\system32\ToolBar.dll, N/A>

==================================
正在运行的进程
[PID: 452][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 508][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 536][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 580][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 592][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 748][C:\WINDOWS\system32\Ati2evxx.exe] <ATI Technologies Inc.><6.14.10.4131>
[C:\WINDOWS\system32\Ati2edxx.dll] <ATI Technologies, Inc.><6, 14, 10, 2500>
[PID: 768][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 836][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\fd5viewer.dll] <N/A><N/A>
[PID: 896][C:\Program Files\Rising\Rav\CCenter.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 916][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\fd5viewer.dll] <N/A><N/A>
[PID: 964][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1040][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1056][C:\Program Files\Rising\Rav\Ravmond.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 35>
[C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\RsLog.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20>
[C:\Program Files\Rising\Rav\HOOKSYS.dll] <Beijing Rising Technology Co., Ltd.><18, 1, 0, 11>
[C:\Program Files\Rising\Rav\Scanner.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 32>
[C:\Program Files\Rising\Rav\libload.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[C:\Program Files\Rising\Rav\VirusLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
[C:\Program Files\Rising\Rav\regmon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[C:\Program Files\Rising\Rav\HookWeb.dll] <rising><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\MemMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[C:\Program Files\Rising\Rav\expscan.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
[C:\Program Files\Rising\Rav\MailMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[C:\Program Files\Rising\Rav\SpamEng.dll] <N/A><18, 0, 0, 6>
[C:\Program Files\Rising\Rav\engine.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 34>
[C:\WINDOWS\system32\fd5viewer.dll] <N/A><N/A>
[C:\Program Files\Rising\Rav\PostTrt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
[C:\Program Files\Rising\Rav\UnExe.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\ScanExec.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\ScanEx.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 27>
[C:\Program Files\Rising\Rav\RSUnpack.dll] <Beijing Rising Technology Co., Ltd.><1, 0, 0, 17>
[C:\Program Files\Rising\Rav\NvFile.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
[C:\Program Files\Rising\Rav\ScanMac.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[C:\Program Files\Rising\Rav\ScanSct.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[C:\Program Files\Rising\Rav\Unpacker.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[C:\Program Files\Rising\Rav\RsStore.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[PID: 1176][c:\program files\rising\rfw\rfwsrv.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 33>
[c:\program files\rising\rfw\RfwRule.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 13>
[c:\program files\rising\rfw\rfwlog.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 6>
[c:\program files\rising\rfw\Rfwdrv.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 21>
[c:\program files\rising\rfw\MonDrv.dll] <rs><1, 0, 0, 4>
[c:\program files\rising\rfw\ProcLib.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 9>
[c:\program files\rising\rfw\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>

zcrobin - 2006-10-9 22:32:00

[PID: 1316][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)>
[PID: 1524][C:\Program Files\Rising\Rav\RavStub.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 1600][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\fd5viewer.dll] <N/A><N/A>
[PID: 1648][C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE] <Microsoft Corporation><7.00.9466>
[PID: 1680][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1744][C:\WINDOWS\system32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: DNSRV(bld4act)>
[PID: 1784][C:\WINDOWS\avp.exe] <N/A><N/A>
[PID: 2016][c:\windows\system32\wbem\winlogon.exe] <Microsoft><1.0.0.0>
[PID: 256][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\fd5viewer.dll] <N/A><N/A>
[PID: 396][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll] <><1, 0, 0, 1>
[PID: 272][c:\program files\rising\rfw\RfwMain.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 52>
[c:\program files\rising\rfw\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23>
[c:\program files\rising\rfw\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[c:\program files\rising\rfw\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 2552][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\fd5viewer.dll] <N/A><N/A>
[PID: 2808][c:\program files\rising\rfw\RfwCfg.exe] <Beijing Rising Technology Corporation Limited><4, 0, 0, 96>
[c:\program files\rising\rfw\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23>
[c:\program files\rising\rfw\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[c:\program files\rising\rfw\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[C:\WINDOWS\system32\fd5viewer.dll] <N/A><N/A>
[PID: 2832][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 3080][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\fd5viewer.dll] <N/A><N/A>
[C:\WINDOWS\system32\macromed\flash\flash.ocx] <Macromedia, Inc.><6,0,79,0>
[PID: 3304][C:\Documents and Settings\Administrator\桌面\360安全卫士\360safe\360Safe.exe] <><2, 0, 0, 3003>
[C:\Documents and Settings\Administrator\桌面\360安全卫士\360safe\AntiAdwa.dll] <360Safe.com><2, 0, 0, 2002>
[C:\Documents and Settings\Administrator\桌面\360安全卫士\360safe\AntiEng.dll] <360Safe.com><2, 0, 0, 1001>
[C:\Documents and Settings\Administrator\桌面\360安全卫士\360safe\CleanHis.dll] <360Safe.com><2, 0, 0, 1001>
[C:\Documents and Settings\Administrator\桌面\360安全卫士\360safe\AntiActi.dll] <360Safe.com><2, 0, 0, 1001>
[C:\Documents and Settings\Administrator\桌面\360安全卫士\360safe\live.dll] <360safe.Com><1, 0, 0, 1007>
[C:\WINDOWS\system32\fd5viewer.dll] <N/A><N/A>
[PID: 3556][C:\Program Files\Rising\Rav\RavMon.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 33>
[C:\Program Files\Rising\Rav\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 26>
[C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Program Files\Rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 3768][C:\Documents and Settings\Administrator\桌面\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\WINDOWS\system32\fd5viewer.dll] <N/A><N/A>

==================================
文件关联
.TXT Error. [C:\WINDOWS\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM Error. [C:\WINDOWS\hh.exe %1]
.HLP Error. [C:\WINDOWS\winhlp32.exe %1]
.INI Error. [C:\WINDOWS\NOTEPAD.EXE %1]
.INF Error. [C:\WINDOWS\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

我无邪 - 2006-10-9 22:45:00

打开System Repair Engineer（也就是你的扫描日志软件SREng.exe），使用“系统修复，文件关联，勾选“全选”点“修复”使所有扩展名都恢复正常。

打开System Repair Engineer（也就是你的扫描日志软件SREng.exe），点“启动项目，服务，点“Win32服务应用程序”勾选“隐藏微软服务”选中病毒服务Indexing Data ,Portable Media Serial Numbe ,Audio Adapter，选择“删除服务”点“设置”选择“否”最后重启。（每一个逗号隔开的就是一个病毒的服务，请逐一删除）

关闭所有浏览窗口以及一些不必要的程序
打开System Repair Engineer（也就是你的扫描日志软件SREng.exe），使用“系统修复，浏览器加载项”来删除以下选项
C:\WINDOWS\system32\ToolBar.dll

请到www.27814939.ys168.com,点“我的软件”下载KillBox.exe
重新启动电脑, 开机检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式进入Windows
双击打开KillBox.exe，分别删除
C:\WINDOWS\SYSTEM32\WBEM\SMTPCONFS.DLL
C:\WINDOWS\msn.exe
C:\WINDOWS\avp.exe
C:\WINDOWS\system32\ToolBar.dll
C:\WINDOWS\system32\fd5viewer.dll
c:\windows\system32\wbem\winlogon.exe（注意这个，以删除它后重启，不再自动生成为终）
（删除时勾选“删除前先结束Explorer.EXE进程”不行再试着勾选"删除DLL文件前反注册此文件"
给菜鸟的东东—KillBox的使用技巧
http://forum.ikaka.com/topic.asp?board=28&artid=8160799

完后重启
删除现有的扫描软件
请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。

zcrobin - 2006-10-9 23:14:00

C:\WINDOWS\SYSTEM32\WBEM\SMTPCONFS.DLL
C:\WINDOWS\msn.exe
C:\WINDOWS\avp.exe
C:\WINDOWS\system32\ToolBar.dll
C:\WINDOWS\system32\fd5viewer.dll
c:\windows\system32\wbem\winlogon.exe（注意这个，以删除它后重启，不再自动生成为终）
（删除时勾选“删除前先结束Explorer.EXE进程”不行再试着勾选"删除DLL文件前反注册此文件"

最后一步那个删除WINLOGON.EXE 一删就死机啊这个一般不能删除掉啊

凤凰楼客 - 2006-10-10 0:28:00

删除WINLOGON.EXE 一删就死机啊这个一般不能删除掉啊
——这文件的路径对了没？是c:\windows\system32\wbem\winlogon.exe

用KillBox.exe删除，删不的话用Unlocker（论坛置顶贴有下，搜索一下）删除

zcrobin - 2006-10-10 8:24:00

winlogon.exe已经删除了就剩下下面这个了
c:\windows\system32\fd5viewer.dll
这个也能删除问题是一删除就不能上网了我把这个文件从新拷贝回目录下才可以上网
下面是新扫描的日志望看看
2006-10-10,08:06:26

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<RavTask><; "C:\Program Files\Rising\Rav\RavTask.exe" -startup> [Beijing Rising Technology Co., Ltd.]
<RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]

==================================
启动文件夹
服务
[Rising Proxy Service / RfwProxySrv]
<c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService]
<c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>

==================================
浏览器加载项
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[OWSClientMiscApis Class]
{BDEADE3F-C265-11D0-BCED-00A0C90AB50F} <C:\PROGRA~1\MICROS~2\OFFICE11\OWSCLT.DLL, Microsoft Corporation>
[OWSBrowserUI Class]
{BDEADE43-C265-11D0-BCED-00A0C90AB50F} <C:\PROGRA~1\MICROS~2\OFFICE11\OWSCLT.DLL, Microsoft Corporation>
[OWSDiscussionServers Class]
{BDEADEB7-C265-11D0-BCED-00A0C90AB50F} <C:\PROGRA~1\MICROS~2\OFFICE11\OWSCLT.DLL, Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
{CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\flash.ocx, Macromedia, Inc.>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>

==================================
正在运行的进程
[PID: 456][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 512][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 540][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 584][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 596][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 752][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 808][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\fd5viewer.dll] <N/A><N/A>
[PID: 864][C:\Program Files\Rising\Rav\CCenter.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 880][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 936][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1052][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1072][C:\Program Files\Rising\Rav\Ravmond.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 35>

zcrobin - 2006-10-10 8:24:00

[C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\RsLog.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20>
[C:\Program Files\Rising\Rav\HOOKSYS.dll] <Beijing Rising Technology Co., Ltd.><18, 1, 0, 11>
[C:\Program Files\Rising\Rav\Scanner.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 32>
[C:\Program Files\Rising\Rav\libload.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[C:\Program Files\Rising\Rav\VirusLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
[C:\Program Files\Rising\Rav\regmon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[C:\Program Files\Rising\Rav\HookWeb.dll] <rising><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\MemMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[C:\Program Files\Rising\Rav\expscan.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
[C:\Program Files\Rising\Rav\SpamEng.dll] <N/A><18, 0, 0, 6>
[C:\Program Files\Rising\Rav\engine.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 34>
[C:\Program Files\Rising\Rav\PostTrt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
[C:\Program Files\Rising\Rav\UnExe.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\ScanExec.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\ScanEx.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 27>
[C:\Program Files\Rising\Rav\RSUnpack.dll] <Beijing Rising Technology Co., Ltd.><1, 0, 0, 17>
[C:\Program Files\Rising\Rav\NvFile.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
[C:\Program Files\Rising\Rav\ScanMac.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[C:\Program Files\Rising\Rav\ScanSct.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[C:\Program Files\Rising\Rav\Unpacker.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[C:\Program Files\Rising\Rav\ExtOLE.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[PID: 1148][c:\program files\rising\rfw\rfwsrv.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 33>
[c:\program files\rising\rfw\RfwRule.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 13>
[c:\program files\rising\rfw\rfwlog.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 6>
[c:\program files\rising\rfw\Rfwdrv.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 21>
[c:\program files\rising\rfw\MonDrv.dll] <rs><1, 0, 0, 4>
[c:\program files\rising\rfw\ProcLib.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 9>
[PID: 1284][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)>
[PID: 1476][C:\Program Files\Rising\Rav\RavStub.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 1552][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1600][C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE] <Microsoft Corporation><7.00.9466>
[PID: 1628][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1672][C:\WINDOWS\system32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: DNSRV(bld4act)>
[PID: 204][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1080][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll] <><1, 0, 0, 1>
[PID: 1132][c:\program files\rising\rfw\RfwMain.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 52>
[c:\program files\rising\rfw\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23>
[c:\program files\rising\rfw\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[c:\program files\rising\rfw\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 328][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 2060][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 4004][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\fd5viewer.dll] <N/A><N/A>
[C:\WINDOWS\system32\macromed\flash\flash.ocx] <Macromedia, Inc.><6,0,79,0>
[PID: 3964][C:\Documents and Settings\Administrator\桌面\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\WINDOWS\system32\fd5viewer.dll] <N/A><N/A>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

zcrobin - 2006-10-10 8:25:00

[C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\RsLog.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20>
[C:\Program Files\Rising\Rav\HOOKSYS.dll] <Beijing Rising Technology Co., Ltd.><18, 1, 0, 11>
[C:\Program Files\Rising\Rav\Scanner.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 32>
[C:\Program Files\Rising\Rav\libload.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[C:\Program Files\Rising\Rav\VirusLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
[C:\Program Files\Rising\Rav\regmon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[C:\Program Files\Rising\Rav\HookWeb.dll] <rising><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\MemMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[C:\Program Files\Rising\Rav\expscan.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
[C:\Program Files\Rising\Rav\SpamEng.dll] <N/A><18, 0, 0, 6>
[C:\Program Files\Rising\Rav\engine.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 34>
[C:\Program Files\Rising\Rav\PostTrt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
[C:\Program Files\Rising\Rav\UnExe.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\ScanExec.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\ScanEx.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 27>
[C:\Program Files\Rising\Rav\RSUnpack.dll] <Beijing Rising Technology Co., Ltd.><1, 0, 0, 17>
[C:\Program Files\Rising\Rav\NvFile.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
[C:\Program Files\Rising\Rav\ScanMac.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[C:\Program Files\Rising\Rav\ScanSct.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[C:\Program Files\Rising\Rav\Unpacker.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[C:\Program Files\Rising\Rav\ExtOLE.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[PID: 1148][c:\program files\rising\rfw\rfwsrv.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 33>
[c:\program files\rising\rfw\RfwRule.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 13>
[c:\program files\rising\rfw\rfwlog.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 6>
[c:\program files\rising\rfw\Rfwdrv.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 21>
[c:\program files\rising\rfw\MonDrv.dll] <rs><1, 0, 0, 4>
[c:\program files\rising\rfw\ProcLib.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 9>
[PID: 1284][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)>
[PID: 1476][C:\Program Files\Rising\Rav\RavStub.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 1552][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1600][C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE] <Microsoft Corporation><7.00.9466>
[PID: 1628][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1672][C:\WINDOWS\system32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: DNSRV(bld4act)>
[PID: 204][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1080][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll] <><1, 0, 0, 1>
[PID: 1132][c:\program files\rising\rfw\RfwMain.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 52>
[c:\program files\rising\rfw\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23>
[c:\program files\rising\rfw\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[c:\program files\rising\rfw\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 328][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 2060][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 4004][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\fd5viewer.dll] <N/A><N/A>
[C:\WINDOWS\system32\macromed\flash\flash.ocx] <Macromedia, Inc.><6,0,79,0>
[PID: 3964][C:\Documents and Settings\Administrator\桌面\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\WINDOWS\system32\fd5viewer.dll] <N/A><N/A>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

zcrobin - 2006-10-10 8:25:00

不好意思上面多发了一个

凤凰楼客 - 2006-10-10 8:53:00

关闭所有浏览器窗口和不必要程序
打开System Repair Engineer（也就是你的扫描日志软件SREng.exe），使用“系统修复，浏览器加载项”来删除C:\WINDOWS\system32\fd5viewer.dll
重启，再删除C:\WINDOWS\system32\fd5viewer.dll

zcrobin - 2006-10-10 17:21:00

已经删除了无邪让我删除的5个DLL 晕哦用了8个工具
可是我的主页还是回不回还是那个piaoxue.com 听说这个劫持有几个工作组都没搞出来么?
下面发下最新的扫描报告 ..
2006-10-10,17:09:13

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<RavTask><; "C:\Program Files\Rising\Rav\RavTask.exe" -startup> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation]
<UIHost><logonui.exe> [Microsoft Corporation]

==================================
启动文件夹
服务
[ewido anti-spyware 4.0 guard / ewido anti-spyware 4.0 guard]
<d:\Program Files\ewido anti-spyware 4.0\guard.exe><Anti-Malware Development a.s.>
[Rising Proxy Service / RfwProxySrv]
<c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService]
<c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>

==================================
浏览器加载项
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\Mshtml.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\Mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[OWSClientMiscApis Class]
{BDEADE3F-C265-11D0-BCED-00A0C90AB50F} <C:\PROGRA~1\MICROS~2\OFFICE11\OWSCLT.DLL, Microsoft Corporation>
[OWSBrowserUI Class]
{BDEADE43-C265-11D0-BCED-00A0C90AB50F} <C:\PROGRA~1\MICROS~2\OFFICE11\OWSCLT.DLL, Microsoft Corporation>
[OWSDiscussionServers Class]
{BDEADEB7-C265-11D0-BCED-00A0C90AB50F} <C:\PROGRA~1\MICROS~2\OFFICE11\OWSCLT.DLL, Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
{CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\flash.ocx, Macromedia, Inc.>

==================================
正在运行的进程
[PID: 412][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 468][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 496][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 540][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 552][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 708][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 776][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 812][C:\Program Files\Rising\Rav\CCenter.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 832][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 936][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 980][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 996][C:\Program Files\Rising\Rav\Ravmond.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 35>
[C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\RsLog.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20>
[C:\Program Files\Rising\Rav\HOOKSYS.dll] <Beijing Rising Technology Co., Ltd.><18, 1, 0, 11>
[C:\Program Files\Rising\Rav\Scanner.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 32>
[C:\Program Files\Rising\Rav\libload.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[C:\Program Files\Rising\Rav\VirusLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
[C:\Program Files\Rising\Rav\regmon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[C:\Program Files\Rising\Rav\HookWeb.dll] <rising><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\MemMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[C:\Program Files\Rising\Rav\MailMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[C:\Program Files\Rising\Rav\SpamEng.dll] <N/A><18, 0, 0, 6>
[C:\Program Files\Rising\Rav\engine.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 34>
[C:\Program Files\Rising\Rav\PostTrt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
[C:\Program Files\Rising\Rav\UnExe.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\ScanExec.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\ScanEx.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 27>
[C:\Program Files\Rising\Rav\RSUnpack.dll] <Beijing Rising Technology Co., Ltd.><1, 0, 0, 17>
[C:\Program Files\Rising\Rav\NvFile.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
[C:\Program Files\Rising\Rav\ScanMac.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[C:\Program Files\Rising\Rav\ScanSct.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[C:\Program Files\Rising\Rav\Unpacker.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[C:\Program Files\Rising\Rav\ScanNet.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 1156][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)>
[PID: 1432][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll] <><1, 0, 0, 1>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 1536][d:\Program Files\ewido anti-spyware 4.0\guard.exe] <Anti-Malware Development a.s.><4, 0, 0, 172>
[d:\Program Files\ewido anti-spyware 4.0\engine.dll] <Anti-Malware Development a.s.><4, 0, 0, 172>
[PID: 1580][C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE] <Microsoft Corporation><7.00.9466>
[PID: 1664][C:\WINDOWS\system32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: DNSRV(bld4act)>
[PID: 1740][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 204][C:\Program Files\Rising\Rav\RavStub.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 1020][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 2144][C:\Program Files\ATI Technologies\ATI.ACE\cli.exe] <ATI Technologies Inc.><1.11.0.0>

还有一页

zcrobin - 2006-10-10 17:26:00

hun混
还有一半发不出去

zcrobin - 2006-10-10 17:28:00

[c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_961a400f\mscorlib.dll] <N/A><N/A>
[c:\windows\assembly\nativeimages1_v1.1.4322\system.windows.forms\1.0.5000.0__b77a5c561934e089_08835e7e\system.windows.forms.dll] <N/A><N/A>
[c:\program files\ati technologies\ati.ace\cli.implementation.dll] <ATI Technologies Inc.><1.2.2286.18880>
[c:\program files\ati technologies\ati.ace\log.foundation.dll] <ATI Technologies Inc.><1.2.2208.29985>
[c:\program files\ati technologies\ati.ace\cli.foundation.dll] <ATI Technologies Inc.><1.2.2208.29986>
[c:\program files\ati technologies\ati.ace\log.foundation.service.dll] <ATI Technologies Inc.><1.2.2286.19127>
[c:\program files\ati technologies\ati.ace\log.foundation.shared.dll] <ATI Technologies Inc.><1.2.2208.29991>
[c:\windows\assembly\nativeimages1_v1.1.4322\system\1.0.5000.0__b77a5c561934e089_bbb936fc\system.dll] <N/A><N/A>
[c:\program files\ati technologies\ati.ace\cli.foundation.xmanifestation.dll] <ATI Technologies Inc.><1.2.2286.19127>
[c:\windows\assembly\nativeimages1_v1.1.4322\system.xml\1.0.5000.0__b77a5c561934e089_1096b985\system.xml.dll] <N/A><N/A>
[c:\program files\ati technologies\ati.ace\cli.component.runtime.dll] <ATI Technologies Inc.><1.2.2286.19134>
[c:\program files\ati technologies\ati.ace\aticccom.dll] <ATI Technologies Inc.><1.0.0.0>
[c:\program files\ati technologies\ati.ace\aem.foundation.dll] <ATI Technologies Inc.><1.2.2208.29985>
[c:\windows\assembly\nativeimages1_v1.1.4322\system.drawing\1.0.5000.0__b03f5f7f11d50a3a_5b07a861\system.drawing.dll] <N/A><N/A>
[c:\program files\ati technologies\ati.ace\cli.caste.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.29987>
[c:\program files\ati technologies\ati.ace\cli.caste.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.19121>
[c:\program files\ati technologies\ati.ace\cli.component.runtime.shared.dll] <ATI Technologies Inc.><1.2.2208.29988>
[c:\program files\ati technologies\ati.ace\dem.foundation.dll] <ATI Technologies Inc.><1.11.0.0>
[c:\program files\ati technologies\ati.ace\dem.graphics.i0601.dll] <ATI Technologies Inc.><1.11.0.0>
[c:\program files\ati technologies\ati.ace\ace.graphics.displaysmanager.shared.dll] <ATI Technologies Inc.><1.11.0.0>
[c:\windows\system32\atidemgr.dll] <ATI Technologies Inc.><1.2.2267.28529>
[c:\program files\ati technologies\ati.ace\cli.aspect.multivpu3.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.18933>
[c:\program files\ati technologies\ati.ace\cli.aspect.multivpu3.graphics.shared.dll] <ATI Technologies Inc.><1.2.2273.28524>
[c:\program files\ati technologies\ati.ace\cli.aspect.multivpu2.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.18875>
[c:\program files\ati technologies\ati.ace\cli.aspect.multivpu2.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.29991>
[c:\program files\ati technologies\ati.ace\cli.aspect.multivpu.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.18967>
[c:\program files\ati technologies\ati.ace\cli.aspect.multivpu.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.30001>
[c:\program files\ati technologies\ati.ace\cli.aspect.verylargedesktop.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.18933>
[c:\program files\ati technologies\ati.ace\cli.aspect.verylargedesktop.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.29993>
[c:\program files\ati technologies\ati.ace\cli.aspect.radeon3d.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.18993>
[c:\program files\ati technologies\ati.ace\cli.aspect.radeon3dlegacy.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.18988>
[c:\program files\ati technologies\ati.ace\cli.aspect.displayscolour2.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.18941>
[c:\program files\ati technologies\ati.ace\cli.aspect.displayscolour2.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.30007>
[c:\program files\ati technologies\ati.ace\cli.aspect.displayscolour.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.19041>
[c:\program files\ati technologies\ati.ace\cli.aspect.displayscolour.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.29990>
[c:\program files\ati technologies\ati.ace\cli.aspect.mmvideo.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.19016>
[c:\program files\ati technologies\ati.ace\cli.aspect.mmvideo.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.30001>
[c:\program files\ati technologies\ati.ace\cli.aspect.videooverlay.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.18978>
[c:\program files\ati technologies\ati.ace\cli.aspect.videooverlay.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.29989>
[c:\program files\ati technologies\ati.ace\ace.graphics.videooverlay.shared.dll] <ATI Technologies Inc.><1.11.0.0>
[c:\program files\ati technologies\ati.ace\cli.aspect.smartgart.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.18984>
[c:\program files\ati technologies\ati.ace\cli.aspect.vpurecover.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.18975>
[c:\program files\ati technologies\ati.ace\cli.aspect.vpurecover.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.29988>
[c:\program files\ati technologies\ati.ace\cli.aspect.workstationconfig.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.18971>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicecrt.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.19075>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicecrt.graphics.shared.dll] <ATI Technologies Inc.><1.2.2236.29147>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicecrt2.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.18949>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicecrt2.graphics.shared.dll] <ATI Technologies Inc.><1.2.2236.29162>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicelcd.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.19059>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicelcd.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.29994>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicelcd2.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.18941>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicelcd2.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.29993>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicecv.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.19070>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicecv.graphics.shared.dll] <ATI Technologies Inc.><1.2.2236.29179>
[c:\program files\ati technologies\ati.ace\cli.aspect.customformats.graphics.shared.dll] <ATI Technologies Inc.><1.2.2236.29132>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicecv2.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.18953>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicecv2.graphics.shared.dll] <ATI Technologies Inc.><1.2.2236.29197>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicetv2.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.19051>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicetv.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.19045>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicedfp.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.19065>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicedfp.graphics.shared.dll] <ATI Technologies Inc.><1.2.2236.29212>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicedfp2.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.18945>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicedfp2.graphics.shared.dll] <ATI Technologies Inc.><1.2.2236.29221>
[c:\program files\ati technologies\ati.ace\cli.aspect.overdrive3.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.19003>
[c:\program files\ati technologies\ati.ace\cli.aspect.overdrive3.graphics.shared.dll] <ATI Technologies Inc.><1.2.2279.31385>
[c:\program files\ati technologies\ati.ace\cli.aspect.overdrive2.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.19011>
[c:\program files\ati technologies\ati.ace\cli.aspect.powerplay3.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.18998>
[c:\program files\ati technologies\ati.ace\cli.aspect.powerplay3.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.29989>
[c:\program files\ati technologies\ati.ace\cli.aspect.displaysoptions.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.19031>

zcrobin - 2006-10-10 17:29:00

[c:\program files\ati technologies\ati.ace\cli.aspect.integratedumaframebuffer.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.19023>
[c:\program files\ati technologies\ati.ace\cli.aspect.infocentre.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.19027>
[c:\program files\ati technologies\ati.ace\cli.aspect.infocentre.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.29990>
[c:\program files\ati technologies\ati.ace\cli.aspect.hotkeyshandling.graphics.runtime.dll] <ATI Technologies Inc.><1.2.2286.18959>
[c:\program files\ati technologies\ati.ace\cli.aspect.hotkeyshandling.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.30002>
[c:\program files\ati technologies\ati.ace\cli.aspect.radeon3d.graphics.shared.dll] <ATI Technologies Inc.><1.2.2232.28756>
[c:\program files\ati technologies\ati.ace\cli.aspect.radeon3dlegacy.graphics.shared.dll] <ATI Technologies Inc.><1.2.2232.28758>
[c:\program files\ati technologies\ati.ace\dem.graphics.i0600.dll] <ATI Technologies Inc.><1.11.0.0>
[c:\program files\ati technologies\ati.ace\cli.aspect.smartgart.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.29990>
[c:\program files\ati technologies\ati.ace\cli.aspect.workstationconfig.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.29988>
[c:\program files\ati technologies\ati.ace\cli.aspect.deviceproperty.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.29987>
[c:\program files\ati technologies\ati.ace\dem.graphics.i0602.dll] <ATI Technologies Inc.><1.11.0.0>
[c:\program files\ati technologies\ati.ace\cli.aspect.deviceproperty2.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.29986>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicetv2.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.30001>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicetv.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.29993>
[c:\program files\ati technologies\ati.ace\cli.aspect.overdrive2.graphics.shared.dll] <ATI Technologies Inc.><1.2.2279.31374>
[c:\program files\ati technologies\ati.ace\cli.aspect.displaysoptions.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.29993>
[c:\program files\ati technologies\ati.ace\cli.aspect.integratedumaframebuffer.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.29988>
[c:\program files\ati technologies\ati.ace\apm.foundation.dll] <ATI Technologies Inc.><1.2.2208.30002>
[PID: 2652][C:\Program Files\ATI Technologies\ATI.ACE\cli.exe] <ATI Technologies Inc.><1.11.0.0>
[c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_961a400f\mscorlib.dll] <N/A><N/A>
[c:\windows\assembly\nativeimages1_v1.1.4322\system.windows.forms\1.0.5000.0__b77a5c561934e089_08835e7e\system.windows.forms.dll] <N/A><N/A>
[c:\program files\ati technologies\ati.ace\cli.implementation.dll] <ATI Technologies Inc.><1.2.2286.18880>
[c:\program files\ati technologies\ati.ace\log.foundation.dll] <ATI Technologies Inc.><1.2.2208.29985>
[c:\program files\ati technologies\ati.ace\cli.foundation.dll] <ATI Technologies Inc.><1.2.2208.29986>
[c:\program files\ati technologies\ati.ace\log.foundation.service.dll] <ATI Technologies Inc.><1.2.2286.19127>
[c:\program files\ati technologies\ati.ace\log.foundation.shared.dll] <ATI Technologies Inc.><1.2.2208.29991>
[c:\windows\assembly\nativeimages1_v1.1.4322\system\1.0.5000.0__b77a5c561934e089_bbb936fc\system.dll] <N/A><N/A>
[c:\program files\ati technologies\ati.ace\cli.foundation.xmanifestation.dll] <ATI Technologies Inc.><1.2.2286.19127>
[c:\windows\assembly\nativeimages1_v1.1.4322\system.xml\1.0.5000.0__b77a5c561934e089_1096b985\system.xml.dll] <N/A><N/A>
[c:\program files\ati technologies\ati.ace\cli.component.wizard.dll] <ATI Technologies Inc.><1.2.2286.18921>
[c:\program files\ati technologies\ati.ace\cli.foundation.clients.dll] <ATI Technologies Inc.><1.2.2208.29986>
[c:\program files\ati technologies\ati.ace\cli.component.wizard.shared.dll] <ATI Technologies Inc.><1.2.2208.29987>
[c:\program files\ati technologies\ati.ace\cli.component.runtime.dll] <ATI Technologies Inc.><1.2.2286.19134>
[c:\program files\ati technologies\ati.ace\aticccom.dll] <ATI Technologies Inc.><1.0.0.0>
[c:\program files\ati technologies\ati.ace\cli.caste.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.29987>
[c:\program files\ati technologies\ati.ace\aem.foundation.dll] <ATI Technologies Inc.><1.2.2208.29985>
[c:\program files\ati technologies\ati.ace\ace.graphics.displaysmanager.shared.dll] <ATI Technologies Inc.><1.11.0.0>
[c:\program files\ati technologies\ati.ace\cli.caste.graphics.wizard.dll] <ATI Technologies Inc.><1.2.2286.18925>
[c:\program files\ati technologies\ati.ace\cli.caste.graphics.wizard.shared.dll] <ATI Technologies Inc.><1.2.2208.29990>
[c:\windows\assembly\nativeimages1_v1.1.4322\system.drawing\1.0.5000.0__b03f5f7f11d50a3a_5b07a861\system.drawing.dll] <N/A><N/A>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicecv.graphics.wizard.dll] <ATI Technologies Inc.><1.2.2286.18905>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicecv2.graphics.wizard.dll] <ATI Technologies Inc.><1.2.2286.18911>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicelcd.graphics.wizard.dll] <ATI Technologies Inc.><1.2.2286.18898>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicelcd2.graphics.wizard.dll] <ATI Technologies Inc.><1.2.2286.18933>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicetv.graphics.wizard.dll] <ATI Technologies Inc.><1.2.2286.18891>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicetv2.graphics.wizard.dll] <ATI Technologies Inc.><1.2.2286.18894>
[c:\program files\ati technologies\ati.ace\cli.aspect.displaysmanager.graphics.wizard.dll] <ATI Technologies Inc.><1.2.2286.18916>
[c:\program files\ati technologies\ati.ace\cli.aspect.radeon3d.graphics.wizard.dll] < ><1.2.2286.18880>
[c:\program files\ati technologies\ati.ace\cli.aspect.mmvideo.graphics.wizard.dll] <ATI Technologies Inc.><1.2.2286.18884>
[c:\program files\ati technologies\ati.ace\cli.aspect.transcode.local.wizard.dll] <ATI Technologies Inc.><1.2.2286.18874>
[c:\program files\ati technologies\ati.ace\cli.aspect.infocentre.graphics.wizard.dll] <ATI Technologies Inc.><1.2.2286.18887>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicecv.graphics.shared.dll] <ATI Technologies Inc.><1.2.2236.29179>
[c:\program files\ati technologies\ati.ace\cli.aspect.deviceproperty.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.29987>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicecv2.graphics.shared.dll] <ATI Technologies Inc.><1.2.2236.29197>
[c:\program files\ati technologies\ati.ace\cli.aspect.deviceproperty2.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.29986>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicelcd.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.29994>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicelcd2.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.29993>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicetv.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.29993>
[c:\program files\ati technologies\ati.ace\cli.aspect.devicetv2.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.30001>
[c:\program files\ati technologies\ati.ace\cli.aspect.radeon3d.graphics.shared.dll] <ATI Technologies Inc.><1.2.2232.28756>
[c:\program files\ati technologies\ati.ace\cli.aspect.mmvideo.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.30001>
[c:\program files\ati technologies\ati.ace\cli.aspect.transcode.local.shared.dll] <ATI Technologies Inc.><1.2.0.0>
[c:\program files\ati technologies\ati.ace\atixclib.dll] < ><1.0.0.0>

zcrobin - 2006-10-10 17:29:00

[c:\program files\ati technologies\ati.ace\cli.aspect.infocentre.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.29990>
[PID: 2660][C:\Program Files\ATI Technologies\ATI.ACE\cli.exe] <ATI Technologies Inc.><1.11.0.0>
[c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_961a400f\mscorlib.dll] <N/A><N/A>
[c:\windows\assembly\nativeimages1_v1.1.4322\system.windows.forms\1.0.5000.0__b77a5c561934e089_08835e7e\system.windows.forms.dll] <N/A><N/A>
[c:\program files\ati technologies\ati.ace\cli.implementation.dll] <ATI Technologies Inc.><1.2.2286.18880>
[c:\program files\ati technologies\ati.ace\log.foundation.dll] <ATI Technologies Inc.><1.2.2208.29985>
[c:\program files\ati technologies\ati.ace\cli.foundation.dll] <ATI Technologies Inc.><1.2.2208.29986>
[c:\program files\ati technologies\ati.ace\log.foundation.service.dll] <ATI Technologies Inc.><1.2.2286.19127>
[c:\program files\ati technologies\ati.ace\log.foundation.shared.dll] <ATI Technologies Inc.><1.2.2208.29991>
[c:\windows\assembly\nativeimages1_v1.1.4322\system\1.0.5000.0__b77a5c561934e089_bbb936fc\system.dll] <N/A><N/A>
[c:\program files\ati technologies\ati.ace\cli.foundation.xmanifestation.dll] <ATI Technologies Inc.><1.2.2286.19127>
[c:\windows\assembly\nativeimages1_v1.1.4322\system.xml\1.0.5000.0__b77a5c561934e089_1096b985\system.xml.dll] <N/A><N/A>
[c:\program files\ati technologies\ati.ace\cli.component.systemtray.dll] <ATI Technologies Inc.><1.2.2286.19094>
[c:\program files\ati technologies\ati.ace\cli.caste.graphics.shared.dll] <ATI Technologies Inc.><1.2.2208.29987>
[c:\program files\ati technologies\ati.ace\cli.component.runtime.dll] <ATI Technologies Inc.><1.2.2286.19134>
[c:\program files\ati technologies\ati.ace\aticccom.dll] <ATI Technologies Inc.><1.0.0.0>
[c:\program files\ati technologies\ati.ace\ace.graphics.displaysmanager.shared.dll] <ATI Technologies Inc.><1.11.0.0>
[c:\program files\ati technologies\ati.ace\aem.foundation.dll] <ATI Technologies Inc.><1.2.2208.29985>
[c:\program files\ati technologies\ati.ace\apm.foundation.dll] <ATI Technologies Inc.><1.2.2208.30002>
[c:\windows\assembly\nativeimages1_v1.1.4322\system.drawing\1.0.5000.0__b03f5f7f11d50a3a_5b07a861\system.drawing.dll] <N/A><N/A>
[c:\program files\ati technologies\ati.ace\zh-chs\cli.component.systemtray.resources.dll] <ATI Technologies Inc.><1.2.2286.19094>
[PID: 3784][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\macromed\flash\flash.ocx] <Macromedia, Inc.><6,0,79,0>
[PID: 3896][C:\Program Files\Rising\Rav\RavMon.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 33>
[C:\Program Files\Rising\Rav\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 26>
[C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Program Files\Rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 2520][C:\WINDOWS\system32\conime.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 3060][C:\Documents and Settings\Administrator\桌面\SREng.exe] <Smallfrogs Studio><2.0.21.505>

==================================
文件关联
.TXT Error. [C:\WINDOWS\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM Error. [C:\WINDOWS\hh.exe %1]
.HLP Error. [C:\WINDOWS\winhlp32.exe %1]
.INI Error. [C:\WINDOWS\NOTEPAD.EXE %1]
.INF Error. [C:\WINDOWS\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

zcrobin - 2006-10-10 17:30:00

昏终于发完了大家帮忙看看谢谢写写

秋风中的秋枫 - 2006-10-10 18:20:00

piaoxue确实强悍,不管是用注册表修复工具，还是直接在注册表内删除所有piaoxue键值，都能在瞬间恢复。但危害似乎不大，只是惹人讨厌罢了。
关注此问题的解决方法。

zcrobin - 2006-10-10 18:59:00

晕哦你也中了这个么 ?? piaoxue 我怀疑不是目前的任何一中启动里面的包括服务,驱动 ,各种启动的我都查过一遍因为是笔记本也好随便删除,我感觉他是插入了已经成功的服务里面有这种可能么,只有这样才查不出来偶觉得盼解决 !!

zcrobin - 2006-10-10 21:11:00

我无邪在么帮看看....

谁是毒？ - 2006-10-10 22:15:00

天啊，我这两天也都耗在这上面，要看见这个站长，真要暴打。

怎么搞都不行，最后没办法，只有先把百度打开后，发送到“桌面快捷”删除原IE图片。

不过我怀疑这个病毒是由其它的生成，因为前几天我都没上什么网，那天开机不久后突然中毒，然后主页被修改，现在一上网不久，就会自动下载一批木马，现在QQ也中了，都没有哪一个专杀能搞掉，唉。怀疑就是重装也没有用。

支持一下，寻求解决办法。

我无邪 - 2006-10-10 22:24:00

打开System Repair Engineer（也就是你的扫描日志软件SREng.exe），使用“系统修复，文件关联，勾选“全选”点“修复”使所有扩展名都恢复正常。

如果还有异常，描述一下。

zcrobin - 2006-10-11 0:18:00

打开System Repair Engineer（也就是你的扫描日志软件SREng.exe），使用“系统修复，文件关联，勾选“全选”点“修复”使所有扩展名都恢复正常。

如果还有异常，描述一下。

恩按照你的做了
目前的表现还是这样的偶的浏览器首页一直显示的是http://piaoxue.com ,主要是这个问题.今天花了一天用了十几个工具把昨天你说的5个文件删除了,然后用ewido杀了近十个程序,首页还是改不过来.
我在注册表中修改(设置首页的键值,start page)修改了后可以看到是修改成功了，我用regmon.exe监视注册表的变化可以看到修改成功了,然后我再次打开这个键值的时候发现又变回来了.可是在regmon.exe监视程序中看不到这个变回来的过程.然后我直接删除了这个start page键值,regmon.exe监视到删除成功了,然后一刷新又变回来了,监视记录中看不到是什么让他变回来的昏哦,,强烈郁闷.
偶在浏览器的工具,internet选详中也是修改,然后再打开的时候又变回来了.
偶怀疑可能有系统的服务或者驱动被渗透了.....怎么办 ???
另外我发现我以前给你的报告用的是2.0版本的,刚刚下载了最新版本的SReng 需要再给份报告你么.......

三天了偶被强暴3天了哭啊

zcrobin - 2006-10-11 0:22:00

还是再发一份偶发现用新的SRENG扫描后有点端倪了还请无邪老大指点 :
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<!ewido><"D:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized> [Anti-Malware Development a.s.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]

==================================
启动文件夹
N/A

==================================
服务
[ASP.NET State Service / aspnet_state]
<C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe><Microsoft Corporation>
[ewido anti-spyware 4.0 guard / ewido anti-spyware 4.0 guard]
<d:\Program Files\ewido anti-spyware 4.0\guard.exe><Anti-Malware Development a.s.>
[Human Interface Device Access / HidServ]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Spectrum24 Events Monitor / IPRIP]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\acss.dll><N/A>

==================================
驱动程序
[Agere Systems Soft Modem / AgereSoftModem]
<system32\DRIVERS\AGRSM.sys><Agere Systems>
[ati2mtag / ati2mtag]
<system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[auirdi6 / auirdi64]
<\SystemRoot\System32\DRIVERS\auirdi64.sys><Microsoft Corporation>
[ewido anti-spyware 4.0 driver / ewido anti-spyware 4.0 driver]
<\??\d:\Program Files\ewido anti-spyware 4.0\guard.sys><N/A>
[Microsoft UAA Bus Driver for High Definition Audio / HDAudBus]
<system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
[Service for Realtek HD Audio (WDM) / IntcAzAudAddService]
<system32\drivers\RtkHDAud.sys><Realtek Semiconductor Corp.>
[mProcRs / mProcRs]
<\??\c:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[nv / nv]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsFwDrv / RsFwDrv]
<\??\C:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139]
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv]
<system32\DRIVERS\secdrv.sys><N/A>
[Basetdi / Basetdi]
<2 - 系统找不到指定的文件。
><N/A>

==================================
浏览器加载项
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\Mshtml.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\Mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[OWSClientMiscApis Class]
{BDEADE3F-C265-11D0-BCED-00A0C90AB50F} <C:\PROGRA~1\MICROS~2\OFFICE11\OWSCLT.DLL, Microsoft Corporation>
[OWSBrowserUI Class]
{BDEADE43-C265-11D0-BCED-00A0C90AB50F} <C:\PROGRA~1\MICROS~2\OFFICE11\OWSCLT.DLL, Microsoft Corporation>
[OWSDiscussionServers Class]
{BDEADEB7-C265-11D0-BCED-00A0C90AB50F} <C:\PROGRA~1\MICROS~2\OFFICE11\OWSCLT.DLL, Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
{CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\flash.ocx, Macromedia, Inc.>

zcrobin - 2006-10-11 0:22:00

==================================
正在运行的进程
[PID: 412][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 468][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 496][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 540][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 552][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 708][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 776][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 832][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 936][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 972][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1128][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[PID: 1324][C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE] [Microsoft Corporation, 7.00.9466]
[PID: 1480][C:\WINDOWS\system32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: DNSRV(bld4act)]
[PID: 1800][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1020][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll] [, 1, 0, 0, 1]
[C:\Program Files\WinRAR\rarext.dll] [N/A, N/A]
[d:\Program Files\ewido anti-spyware 4.0\context.dll] [Anti-Malware Development a.s., 4, 0, 0, 172]
[PID: 1472][D:\Program Files\ewido anti-spyware 4.0\ewido.exe] [Anti-Malware Development a.s., 4, 0, 0, 172]
[D:\Program Files\ewido anti-spyware 4.0\engine.dll] [Anti-Malware Development a.s., 4, 0, 0, 172]
[PID: 1468][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1548][C:\Program Files\Rising\Rfw\rfwmain.exe] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 52]
[C:\Program Files\Rising\Rfw\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 23]
[C:\Program Files\Rising\Rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\Rising\Rfw\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[PID: 360][c:\program files\rising\rfw\rfwsrv.exe] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 33]
[c:\program files\rising\rfw\RfwRule.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 13]
[c:\program files\rising\rfw\rfwlog.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 6]
[c:\program files\rising\rfw\Rfwdrv.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 21]
[c:\program files\rising\rfw\MonDrv.dll] [rs, 1, 0, 0, 4]
[c:\program files\rising\rfw\ProcLib.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 9]
[c:\program files\rising\rfw\mPorts.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3]
[PID: 2036][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2588][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\macromed\flash\flash.ocx] [Macromedia, Inc., 6,0,79,0]
[PID: 2984][C:\Documents and Settings\Administrator\桌面\sreng2\SREng\SREng.exe] [Smallfrogs Studio, 2.2.6.605]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 aifind.info
127.0.0.1 allsearcher.info
127.0.0.1 ehttp.cc
127.0.0.1 freednshost.info
127.0.0.1 i-lookup.com
127.0.0.1 piaoxue.com
127.0.0.1 www.23.la
127.0.0.1 www.369.com
127.0.0.1 www.4991.com
127.0.0.1 www.71791.com
127.0.0.1 www.9991.com
127.0.0.1 www.joyiex.com
127.0.0.1 www.mj2005.com
127.0.0.1 www.mydj2005.com
127.0.0.1 www.nkvd.us
127.0.0.1 www.roogoo.com
127.0.0.1 www.xfreehosting.com
127.0.0.1 www.xxx166.com
220.181.27.48 piaoxue.com

==================================

zcrobin - 2006-10-11 0:28:00

还发现一个问题偶的电脑不能装卡卡助手我混啊每次都提示安装失败,不知道和这个劫持有关系没 ......

snliuxun - 2006-10-11 0:38:00

打开sreng2
点服务点 "win32 服务应用程序" 勾选隐藏微软服务
选分别先下列服务设置为disabled 或否
Spectrum24 Events Monitor

点系统修复点 hosts文件
删除所有项
重启后删文件
C:\WINDOWS\system32\acss.dll
有问题.扫日志上来.

ssskiss - 2006-10-11 10:50:00

找不到解决办法啊
只有在Hosts里加上192.168.0.2 piaoxue.com

....

zcrobin - 2006-10-11 13:15:00

奇怪哦目前问题如下:
按找25楼的操作 ,停止了服务后发现那个ACSS.DLL文件找不到了,我用最后用搜索功能都找了一遍还是木有, 关于HOSTS文件,这个是免疫的功能吧,我的主页应该与这个无关吧 ,最后的那个220.181.27.48 piaoxue.com 是我把他定位到了百度的页面上,其他的没什么变化 .主页在注册表中依然显示 piaoxue.com 没办法我只好用host文件先屏蔽下.
如果哪位高人有关于piaoxue.com的解决办法望告之.zhangsolomon@163.com

snliuxun - 2006-10-11 13:29:00

加我QQ147613338
远程看看.谢谢!!

我无邪 - 2006-10-11 20:59:00

打开System Repair Engineer（也就是你的扫描日志软件SREng.exe），点“启动项目，服务，点“驱动程序”勾选“隐藏以认证的微软服务”选中病毒服务Spectrum24 Events Monitor，选择“删除服务”点“设置”选择“否”

打开System Repair Engineer（也就是你的扫描日志软件SREng.exe），使用“系统修复，HOSTS 文件
127.0.0.1 aifind.info
127.0.0.1 allsearcher.info
127.0.0.1 ehttp.cc
127.0.0.1 freednshost.info
127.0.0.1 i-lookup.com
127.0.0.1 piaoxue.com
127.0.0.1 www.23.la
127.0.0.1 www.369.com
127.0.0.1 www.4991.com
127.0.0.1 www.71791.com
127.0.0.1 www.9991.com
127.0.0.1 www.joyiex.com
127.0.0.1 www.mj2005.com
127.0.0.1 www.mydj2005.com
127.0.0.1 www.nkvd.us
127.0.0.1 www.roogoo.com
127.0.0.1 www.xfreehosting.com
127.0.0.1 www.xxx166.com
220.181.27.48 piaoxue.com
打开一个IE窗口，工具，internte选项，点“删除文件”弹出一个窗口勾选“删除所有脱机内容”删除cookies,确定。
打开System Repair Engineer（也就是你的扫描日志软件SREng.exe），使用“系统修复，Internet Explorer”“全选”“修复"看看能不能解决问题。

重启后删除
C:\WINDOWS\system32\acss.dll
你看还有没有异常
如果还有，是重装系统的时候了
如果真的重装了系统
建议立即备份下系统正常的状态。
看以下的帖子
http://forum.ikaka.com/topic.asp?board=3&artid=8124643

瑞星卡卡安全论坛