大家99小妹,不胜感激之致,敬礼! bbs.ikaka.com

天使楚楚1 - 2006-11-9 22:41:00

最近不知道点了哪个网站就自动下载了SKY SOFT的ActiveX控件,一个是Folder View ActiveX,一个是Shell Object ActiveX,然后就是经常在进windows桌面前和用超级兔子的时候老是弹出全英文对话框告诉我要我注册,只有30天试用期,我点弹出窗口里的网址去看,晕,注册要缴美元,晕死

请问怎么把这经常弹出骚扰我,要我注册的ActiveX的提示窗口给去掉?不胜感激之致喔......

敬礼

abcd4321 - 2006-11-10 0:18:00

发个日志上来HijackThis

epox.ys168.com

天使楚楚1 - 2006-11-10 0:26:00

2006-11-10,00:07:55

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
<Super Rabbit IEPro><C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD> [Super Rabbit Soft]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
<run><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
<RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<Super Rabbit SRRestore><C:\Program Files\Super Rabbit\MagicSet\srrest.exe /autosave> [Super Rabbit Soft]
<ThunderMini><C:\Program Files\Thunder Network\ThunderMini\ThunderMiniShell.exe> [N/A]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]

==================================
启动文件夹
[Adobe Reader Speed Launch]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Reader Speed Launch.lnk --> C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE [Adobe Systems Incorporated]><N>

==================================
服务
[Human Interface Device Access / HidServ]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Rising Proxy Service / RfwProxySrv]
<c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService]
<c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>

==================================
驱动程序
[Rising TDI Base Driver / BaseTDI]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[d347bus / d347bus]
<\SystemRoot\system32\DRIVERS\d347bus.sys><>
[d347prt / d347prt]
<\SystemRoot\System32\Drivers\d347prt.sys><>
[Yamaha DS1 Audio Driver (WDM) / ds1]
<system32\drivers\ds1wdm.sys><Yamaha Corp.>
[ExpScaner / ExpScaner]
<\??\C:\Program Files\Rising\Rav\ExpScan.sys><>
[%FLASHREADER.SvcDesc% / FLASHREADER]
<System32\Drivers\causb.sys><>
[HookCont / HookCont]
<\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising tech Co. ltd>
[HookReg / HookReg]
<\??\C:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys]
<\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising>
[HookUrl / HookUrl]
<\??\C:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[MEMSCAN / MEMSCAN]
<\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[mProcRs / mProcRs]
<\??\c:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[Toshiba FIR Port Type-DO / OBOE]
<system32\DRIVERS\tos4mo.sys><TOSHIBA Corporation>
[Padus ASPI Shell / pfc]
<system32\drivers\pfc.sys><Padus, Inc.>
[Direct Parallel Link Driver / Ptilink]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[PxHelp20 / PxHelp20]
<\SystemRoot\System32\Drivers\PxHelp20.sys><Sonic Solutions>
[RsFwDrv / RsFwDrv]
<\??\C:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS]
<\??\C:\PROGRAM FILES\RISING\RAV\RSPPSYS.sys><Rising>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139]
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv]
<system32\DRIVERS\secdrv.sys><N/A>
[Sparrow / Sparrow]
<\SystemRoot\system32\DRIVERS\sparrow.sys><Adaptec, Inc.>
[Tridkb / Tridkb]
<system32\DRIVERS\tridkbm.sys><Trident Microsystems Inc.>

天使楚楚1 - 2006-11-10 0:27:00

==================================
浏览器加载项
[Adobe PDF Reader Link Helper]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[IeCatch5 Class]
{2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <C:\PROGRA~1\FLASHGET\jccatch.dll, FlashGet>
[bho2gr Class]
{31FF080D-12A3-439A-A2EF-4BA95A3148E8} <C:\Program Files\GetRight\xx2gr.dll, Headlight Software, Inc.>
[NXIECatcher Class]
{83B80A9C-D91A-4F22-8DCF-EA7204039F79} <C:\Program Files\NetXfer\NXIEHelper.dll, Xi>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_004.dll, Thunder Networking Technologies,LTD>
[ThunderMini Browser Helper]
{8E6C1C49-F9CE-4311-9FB4-D70E8B0AEAEB} <C:\Program Files\Thunder Network\ThunderMini\ComDlls\XunLeiMiniBHO_001.dll, Thunder Networking Technologies,LTD>
[启动迅雷5]
{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <C:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[启动Web迅雷]
{962EFB8E-2683-42d4-AC74-AAA4C759B9C6} <http://my.xunlei.com, N/A>
[FlashGet]
{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\flashget.exe, FlashGet.com>
[@xpsp3res.dll,-20001]
{e2e2dd38-d088-4134-82b7-f2ba38496583} <%windir%\Network Diagnostic\xpnetdiag.exe, N/A>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[NetXfer]
{C16CBAAC-A75C-4DB5-A0DD-CDF5CAFCDD3A} <C:\Program Files\NetXfer\NXToolBar.dll, Xi>
[Office Genuine Advantage Validation Tool]
{05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} <C:\WINDOWS\system32\OGACheckControl.DLL, N/A>
[Windows Genuine Advantage Validation Tool]
{17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft Corporation>
[Office Update Installation Engine]
{C7DB51B4-BCF7-4923-8874-7F1A0DC92277} <C:\WINDOWS\opuc.dll, Microsoft Corporation>
[WebThunder Browser Helper]
{00000AAA-A363-466E-BEF5-9BB68697AA7F} <C:\Program Files\Thunder Network\WebThunder\WebThunderBHO_015.dll, Thunder Networking Technologies,LTD>
[Office Genuine Advantage Validation Tool]
{05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} <C:\WINDOWS\system32\OGACheckControl.DLL, N/A>
[Adobe PDF Reader Link Helper]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[Windows Genuine Advantage Validation Tool]
{17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[XML DOM Document]
{2933BF90-7B36-11D2-B20E-00C04F983E60} <%SystemRoot%\system32\msxml3.dll, N/A>
[IeCatch5 Class]
{2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <C:\PROGRA~1\FLASHGET\jccatch.dll, FlashGet>
[bho2gr Class]
{31FF080D-12A3-439A-A2EF-4BA95A3148E8} <C:\Program Files\GetRight\xx2gr.dll, Headlight Software, Inc.>
[Microsoft Office Control]
{4453D895-F2A1-4A38-A285-1EF9BD3F6D5D} <C:\PROGRA~1\MICROS~2\OFFICE11\AUTHZAX.DLL, Microsoft Corporation>
[]
{4F07F79F-087F-42CF-8B36-7A88D06088E9} <"C:\PROGRA~1\MSNMES~1\msgsc.dll", N/A>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <C:\WINDOWS\system32\ieframe.dll, Microsoft Corporation>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[MediaComm Class]
{7670648D-461B-42AF-BDFE-46D26AF5EFF2} <C:\Program Files\Thunder Network\Thunder\Components\InMedia\MediaAddin09.dll, Thunder Networking Technologies,LTD>
[NXIECatcher Class]
{83B80A9C-D91A-4F22-8DCF-EA7204039F79} <C:\Program Files\NetXfer\NXIEHelper.dll, Xi>
[Microsoft Web Browser]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\ieframe.dll, Microsoft Corporation>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_004.dll, Thunder Networking Technologies,LTD>
[ThunderMini Browser Helper]
{8E6C1C49-F9CE-4311-9FB4-D70E8B0AEAEB} <C:\Program Files\Thunder Network\ThunderMini\ComDlls\XunLeiMiniBHO_001.dll, Thunder Networking Technologies,LTD>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[NetXfer]
{C16CBAAC-A75C-4DB5-A0DD-CDF5CAFCDD3A} <C:\Program Files\NetXfer\NXToolBar.dll, Xi>
[Office Update Installation Engine]
{C7DB51B4-BCF7-4923-8874-7F1A0DC92277} <C:\WINDOWS\opuc.dll, Microsoft Corporation>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\Flash85.ocx, Macromedia, Inc.>
[Macromedia Flash Factory Object]
{D27CDB70-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\Flash85.ocx, Macromedia, Inc.>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[XML HTTP Request]
{ED8C108E-4349-11D2-91A4-00C04F7969E8} <%SystemRoot%\system32\msxml3.dll, N/A>
[Scripting.Dictionary]
{EE09B103-97E0-11CF-978F-00A02463E06F} <C:\WINDOWS\system32\scrrun.dll, Microsoft Corporation>
[gFlash Class]
{F156768E-81EF-470C-9057-481BA8380DBA} <C:\PROGRA~1\FLASHGET\getflash.dll, N/A>
[XML DOM Document]
{F6D90F11-9C73-11D3-B32E-00C04F990BB4} <%SystemRoot%\system32\msxml3.dll, N/A>
[XML HTTP]
{F6D90F16-9C73-11D3-B32E-00C04F990BB4} <%SystemRoot%\system32\msxml3.dll, N/A>
[&使用迅雷下载]
<C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
<C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
[&使用迷你迅雷下载]
<C:\Program Files\Thunder Network\ThunderMini\Program\GetUrl.htm, N/A>
[Download with GetRight]
<C:\Program Files\GetRight\GRdownload.htm, N/A>
[Open with GetRight Browser]
<C:\Program Files\GetRight\GRbrowse.htm, N/A>
[使用Web迅雷下载]
<C:\Program Files\Thunder Network\WebThunder\GetUrl.htm, N/A>
[使用Web迅雷下载全部链接]
<C:\Program Files\Thunder Network\WebThunder\GetAllUrl.htm, N/A>
[使用网络传送带下载]
<C:\Program Files\NetXfer\NXAddLink.html, N/A>
[使用网络传送带下载全部链接]
<C:\Program Files\NetXfer\NXAddList.html, N/A>
[使用网际快车下载]
<C:\Program Files\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<C:\Program Files\FlashGet\jc_all.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>

天使楚楚1 - 2006-11-10 0:31:00

==================================
正在运行的进程
[PID: 472][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 532][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 556][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 600][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 612][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 768][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 840][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 916][C:\Program Files\Rising\Rav\CCenter.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 960][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\System32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1024][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1140][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1272][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\PROGRA~1\FLASHGET\jccatch.dll] [FlashGet, 1, 1, 5, 0]
[C:\Program Files\GetRight\xx2gr.dll] [Headlight Software, Inc., 6.0c]
[C:\Program Files\NetXfer\NXIEHelper.dll] [Xi, 2.03.304]
[C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_004.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 3]
[C:\Program Files\Thunder Network\ThunderMini\ComDlls\XunLeiMiniBHO_001.dll] [Thunder Networking Technologies,LTD, 2, 0, 0, 1]
[C:\Program Files\WinZip\WZSHLSTB.DLL] [WinZip Computing LP, 4.1 (32-bit)]
[C:\Program Files\WinRAR\rarext.dll] [N/A, N/A]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 21]
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 7.0.0.0]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\IDM Computer Solutions\UltraEdit-32\ue32ctmn.dll] [, 1, 0, 0, 1]
[PID: 1312][c:\program files\rising\rfw\rfwsrv.exe] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 33]
[c:\program files\rising\rfw\RfwRule.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 13]
[c:\program files\rising\rfw\rfwlog.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 6]
[c:\program files\rising\rfw\Rfwdrv.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 21]
[c:\program files\rising\rfw\psapi.dll] [Microsoft Corporation, 4.00]
[c:\program files\rising\rfw\MonDrv.dll] [rs, 1, 0, 0, 4]
[c:\program files\rising\rfw\ProcLib.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 9]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[c:\program files\rising\rfw\mPorts.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3]
[PID: 1464][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1512][C:\WINDOWS\System32\SCardSvr.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\System32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1768][c:\program files\rising\rfw\RfwMain.exe] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 52]
[c:\program files\rising\rfw\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 23]
[c:\program files\rising\rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[c:\program files\rising\rfw\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 140][C:\Program Files\Rising\Rav\RavTask.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 22]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 228][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] [RealNetworks, Inc., 0.1.0.1622]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 272][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 284][C:\Program Files\Thunder Network\ThunderMini\program\ThunderMini.exe] [Thunder Networking Technologies,LTD, 2, 0, 0, 29]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Thunder Network\ThunderMini\program\download_interface.dll] [N/A, N/A]
[C:\Program Files\Thunder Network\ThunderMini\program\UpdateDownload.dll] [Thunder Networking Technologies,LTD, 1, 0, 1, 6]
[C:\Program Files\Thunder Network\ThunderMini\Components\InMedia\iEmbedShell.dll] [　, 1, 0, 0, 6]
[C:\Program Files\Thunder Network\Thunder\Components\InMedia\iEmbed06.dll] [　, 3, 0, 0, 55]
[PID: 308][C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE] [Super Rabbit Soft, 7.86]
[C:\WINDOWS\system32\vb6chs.dll] [Microsoft Corporation, 6.00.8988]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\PROGRA~1\SUPERR~1\MagicSet\shlobj71.ocx] [Sky Software (http://www.ssware.com), 7, 1, 0, 0]
[PID: 1092][C:\WINDOWS\system32\msdtc.exe] [Microsoft Corporation, 2001.12.4414.258]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1236][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\System32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1384][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\System32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1644][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1932][C:\WINDOWS\System32\dmadmin.exe] [Microsoft Corp., Veritas Software, 2600.2180.503.0]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3884][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\PROGRA~1\FLASHGET\jccatch.dll] [FlashGet, 1, 1, 5, 0]
[C:\Program Files\GetRight\xx2gr.dll] [Headlight Software, Inc., 6.0c]
[C:\Program Files\NetXfer\NXIEHelper.dll] [Xi, 2.03.304]
[C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_004.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 3]
[C:\Program Files\Thunder Network\ThunderMini\ComDlls\XunLeiMiniBHO_001.dll] [Thunder Networking Technologies,LTD, 2, 0, 0, 1]
[C:\WINDOWS\system32\macromed\flash\Flash85.ocx] [Macromedia, Inc., 8,5,0,133]
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 7.0.0.0]
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 7.0.7.2006011200]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\JPWB.IME] [常诚研制, 4.00.950]

天使楚楚1 - 2006-11-10 0:32:00

[PID: 2764][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 736][C:\Program Files\Rising\Rav\RAVMON.EXE] [Beijing Rising Technology Co., Ltd., 18, 0, 1, 39]
[C:\Program Files\Rising\Rav\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 26]
[C:\Program Files\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\Rav\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 7616][C:\Program Files\Rising\Rav\Ravmond.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 1, 47]
[C:\Program Files\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\Rav\RsPPsys.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\Rising\Rav\RsLog.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
[C:\Program Files\Rising\Rav\HOOKSYS.dll] [Beijing Rising Technology Co., Ltd., 18, 1, 0, 12]
[C:\Program Files\Rising\Rav\Scanner.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 33]
[C:\Program Files\Rising\Rav\libload.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10]
[C:\Program Files\Rising\Rav\VirusLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
[C:\Program Files\Rising\Rav\regmon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6]
[C:\Program Files\Rising\Rav\psapi.dll] [Microsoft Corporation, 4.00]
[C:\Program Files\Rising\Rav\HookWeb.dll] [rising, 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\MemMon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 12]
[C:\Program Files\Rising\Rav\expscan.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\Rising\Rav\mPorts.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3]
[C:\Program Files\Rising\Rav\MailMon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\Program Files\Rising\Rav\SpamEng.dll] [N/A, 18, 0, 0, 6]
[C:\Program Files\Rising\Rav\engine.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 35]
[C:\Program Files\Rising\Rav\PostTrt.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 18]
[C:\Program Files\Rising\Rav\UnExe.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Rising\Rav\ScanExec.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 15]
[C:\Program Files\Rising\Rav\ScanEx.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 32]
[C:\Program Files\Rising\Rav\RSUnpack.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]
[C:\Program Files\Rising\Rav\ExtFile.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 24]
[C:\Program Files\Rising\Rav\NvFile.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 7]
[C:\Program Files\Rising\Rav\ScanMac.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10]
[C:\Program Files\Rising\Rav\ScanSct.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
[C:\Program Files\Rising\Rav\Unpacker.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[PID: 4384][C:\Program Files\Rising\Rav\RavStub.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 16]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 5808][C:\Program Files\Super Rabbit\MagicSet\srgui.exe] [Super Rabbit Soft, 7.86]
[C:\WINDOWS\system32\vb6chs.dll] [Microsoft Corporation, 6.00.8988]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3160][C:\Program Files\System Repair Engineer日志专业扫描\SREng.exe] [Smallfrogs Studio, 2.2.6.605]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2764][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 736][C:\Program Files\Rising\Rav\RAVMON.EXE] [Beijing Rising Technology Co., Ltd., 18, 0, 1, 39]
[C:\Program Files\Rising\Rav\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 26]
[C:\Program Files\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\Rav\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 7616][C:\Program Files\Rising\Rav\Ravmond.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 1, 47]
[C:\Program Files\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\Rav\RsPPsys.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\Rising\Rav\RsLog.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
[C:\Program Files\Rising\Rav\HOOKSYS.dll] [Beijing Rising Technology Co., Ltd., 18, 1, 0, 12]
[C:\Program Files\Rising\Rav\Scanner.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 33]
[C:\Program Files\Rising\Rav\libload.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10]
[C:\Program Files\Rising\Rav\VirusLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
[C:\Program Files\Rising\Rav\regmon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6]
[C:\Program Files\Rising\Rav\psapi.dll] [Microsoft Corporation, 4.00]
[C:\Program Files\Rising\Rav\HookWeb.dll] [rising, 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\MemMon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 12]
[C:\Program Files\Rising\Rav\expscan.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\Rising\Rav\mPorts.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3]
[C:\Program Files\Rising\Rav\MailMon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\Program Files\Rising\Rav\SpamEng.dll] [N/A, 18, 0, 0, 6]
[C:\Program Files\Rising\Rav\engine.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 35]
[C:\Program Files\Rising\Rav\PostTrt.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 18]
[C:\Program Files\Rising\Rav\UnExe.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Rising\Rav\ScanExec.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 15]
[C:\Program Files\Rising\Rav\ScanEx.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 32]
[C:\Program Files\Rising\Rav\RSUnpack.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]
[C:\Program Files\Rising\Rav\ExtFile.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 24]
[C:\Program Files\Rising\Rav\NvFile.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 7]
[C:\Program Files\Rising\Rav\ScanMac.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10]
[C:\Program Files\Rising\Rav\ScanSct.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
[C:\Program Files\Rising\Rav\Unpacker.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[PID: 4384][C:\Program Files\Rising\Rav\RavStub.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 16]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 5808][C:\Program Files\Super Rabbit\MagicSet\srgui.exe] [Super Rabbit Soft, 7.86]
[C:\WINDOWS\system32\vb6chs.dll] [Microsoft Corporation, 6.00.8988]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3160][C:\Program Files\System Repair Engineer日志专业扫描\SREng.exe] [Smallfrogs Studio, 2.2.6.605]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]

天使楚楚1 - 2006-11-10 0:34:00

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS Error. [UltraEdit.js]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost
127.0.0.1 008.cn
127.0.0.1 ultimate-best-hgh.0my.net
127.0.0.1 www.139500.com
127.0.0.1 www.1yin.net
127.0.0.1 ****cn
127.0.0.1 www.37021.com
127.0.0.1 www.47555.net
127.0.0.1 www.511ring.com
127.0.0.1 me.5e163.com
127.0.0.1 www.777888.com
127.0.0.1 www.77ttt.com
127.0.0.1 www.9p.cn
127.0.0.1 abcdesign.ru
127.0.0.1 gutemine.wu-wien.ac.at
127.0.0.1 math.kobe-u.ac.jp
127.0.0.1 www.aifind.info
127.0.0.1 www.allyes.com
127.0.0.1 www.aogo.net
127.0.0.1 baltnet.ru
127.0.0.1 quotes.barchart.com
127.0.0.1 free.bestialityhost.com
127.0.0.1 cctv1.net
127.0.0.1 cctv8.net
127.0.0.1 www.cctv8.net
127.0.0.1 ciachoo.pl
127.0.0.1 www.play.cn.gs
127.0.0.1 www.cnqb.net
127.0.0.1 www.feixue.net
127.0.0.1 www.xiliao.com.cn
127.0.0.1 alexey.pioneers.com.ru
127.0.0.1 www.coolcdrom.com
127.0.0.1 www.coolseach.com
127.0.0.1 puldk490gj.da.ru
127.0.0.1 dicto.ru
127.0.0.1 www.dj3344.com
127.0.0.1 www.donttrip.org
127.0.0.1 www.ehomeday.com
127.0.0.1 elemental.ru
127.0.0.1 errorguard.com
127.0.0.1 friendlygreeting.com
127.0.0.1 zhp.gdynia.pl
127.0.0.1 www.gg888.net
127.0.0.1 gin.ru
127.0.0.1 www.girlchinese.com
127.0.0.1 glass-master.ru
127.0.0.1 photo.gornet.ru
127.0.0.1 relay.great.ru
127.0.0.1 hack-gegen-rechts.com
127.0.0.1 hgrstrailer.com
127.0.0.1 www.homepage.com
127.0.0.1 hotbar.com
127.0.0.1 intellect.lvc
127.0.0.1 interfoodtd.ru
127.0.0.1 jewishgen.org
127.0.0.1 www.jixian.net
127.0.0.1 k2kapital.com
127.0.0.1 security.kolla.de
127.0.0.1 www.kuliao.com
127.0.0.1 laugh-mail.net
127.0.0.1 7b.com.cn
127.0.0.1 9505.com
127.0.0.1 www.piaoxue.com
127.0.0.1 marketscore.com
127.0.0.1 www.mir0.com
127.0.0.1 momentum.ru
127.0.0.1 www.mtv51.com
127.0.0.1 www.mydj2005.com
127.0.0.1 nefkom.net
127.0.0.1 no-abi2003.de
127.0.0.1 tdi-router.opola.pl
127.0.0.1 packages.debian.or.jp
127.0.0.1 perfectgirls.net
127.0.0.1 peterstar.ru
127.0.0.1 pgipearls.com
127.0.0.1 phg.pl
127.0.0.1 vip.pnet.pl
127.0.0.1 sec.polbox.pl
127.0.0.1 polobeer.de
127.0.0.1 porno-mania.net
127.0.0.1 home.profootball.ru
127.0.0.1 qianbai.com
127.0.0.1 ad.qingyule.com
127.0.0.1 www.qq168.net
127.0.0.1 www.qq3344.com
127.0.0.1 www.qq92.com
127.0.0.1 www.qqwz.com
127.0.0.1 www.qu123.com
127.0.0.1 republika.pl
127.0.0.1 www.richfind.com
127.0.0.1 rollenspielzirkel.de
127.0.0.1 safer-networking.org
127.0.0.1 sdsauto.ru
127.0.0.1 www.searchpage.cc
127.0.0.1 www.seekeasysoft.net
127.0.0.1 shadkhan.ru
127.0.0.1 slavarik.ru
127.0.0.1 sovea.de
127.0.0.1 spybot.info
127.0.0.1 www.start-page.info
127.0.0.1 lars-s.privat.t-online.de
127.0.0.1 u.t2cn.com
127.0.0.1 www.7939.com
127.0.0.1 www.4199.com
127.0.0.1 www.3448.com
127.0.0.1 www.6781.com
127.0.0.1 it.trendmicro-europe.com
127.0.0.1 trendmicro.it
127.0.0.1 truefriends.net
127.0.0.1 www.tthao.com
127.0.0.1 www.ttrx.net
127.0.0.1 tuhart.net
127.0.0.1 www.unionsky.cn
127.0.0.1 www.unionsky.com
127.0.0.1 www.unionsky.net
127.0.0.1 vconsole.net
127.0.0.1 virtumonde.com
127.0.0.1 gamma.vyborg.ru
127.0.0.1 financial.washingtonpost.com
127.0.0.1 webpark.pl
127.0.0.1 wishken.com
127.0.0.1 www.yeapple.com
127.0.0.1 www.yibinren.com
127.0.0.1 www.youmiss.com
127.0.0.1 www.yysky.net
127.0.0.1 zelnet.ru
127.0.0.1 www.zhengdian.com
127.0.0.1 abc.265.com
127.0.0.1 555.265.com
127.0.0.1 www.baidu345.com
127.0.0.1 www.37ss.com
127.0.0.1 www.sina.com.cn
127.0.0.1 www.sxsky.net

==================================

天使楚楚1 - 2006-11-10 0:37:00

QUOTE:
原帖由单昭于 2006-11-9 22:34 发表
IE的工具-〉管理和加载
把那个禁止了

我在里面怎么没看到shell object ActiveX 和Folder View ActiveX的项啊?其它OFFICE ACTIVEX和REAL ACTIVEX和FLASH ACTIVEX和WMP ACTIVEX倒是有的

abcd4321 - 2006-11-10 0:40:00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]

这几项用SREng清除或修复一下看看

红夜鬼1 - 2006-11-10 0:44:00

引用:

【abcd4321的贴子】[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]

这几项用SREng清除或修复一下看看
………………

这些是正常的,

天使楚楚1 - 2006-11-10 1:11:00

Folder View ActiveX 和Shell Object ActiveX的自启动项和注册表项在哪儿啊?

最让人恶心的是居然是进WINDOWS桌面前经常老弹出要你去注册,只有30天试用期的窗口,不关这窗口的话后面的自启动项根本就启动不了

天使楚楚1 - 2006-11-10 1:24:00

我再用360安全卫士扫份日志上来吧,麻烦热心肠的GG们帮我瞧瞧,谢谢喔

各位高手：
非常感谢您留心我这份系统诊断报告，小菜鸟十万火急等待您的帮助！
该诊断报告由360安全卫士提供 http://www.360safe.com
诊断时间: 2006-11-10 01:07:14
诊断平台: Microsoft Windows XP Service Pack 2
IE版本: Internet Explorer V7.0.5730.11 Build:75730
计算机物理内存:319MB - 当前可用内存:60MB

O6 - 低危险 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel
O6 - 低危险 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions
100 - 未知 - Process: srgui.exe [Super Rabbit Magic Set] - C:\Program Files\Super Rabbit\MagicSet\srgui.exe
R0 - 未知 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.12345king.com/
R0 - 未知 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL=about:blank
O1 - 未知 - Host: 127.0.0.1 008.cn
O1 - 未知 - Host: 127.0.0.1 ultimate-best-hgh.0my.net
O1 - 未知 - Host: 127.0.0.1 www.139500.com
O1 - 未知 - Host: 127.0.0.1 www.1yin.net
O1 - 未知 - Host: 127.0.0.1 ****cn
O1 - 未知 - Host: 127.0.0.1 www.37021.com
O1 - 未知 - Host: 127.0.0.1 www.47555.net
O1 - 未知 - Host: 127.0.0.1 www.511ring.com
O1 - 未知 - Host: 127.0.0.1 me.5e163.com
O1 - 未知 - Host: 127.0.0.1 www.777888.com
O1 - 未知 - Host: 127.0.0.1 www.77ttt.com
O1 - 未知 - Host: 127.0.0.1 www.9p.cn
O1 - 未知 - Host: 127.0.0.1 abcdesign.ru
O1 - 未知 - Host: 127.0.0.1 gutemine.wu-wien.ac.at
O1 - 未知 - Host: 127.0.0.1 math.kobe-u.ac.jp
O1 - 未知 - Host: 127.0.0.1 www.aifind.info
O1 - 未知 - Host: 127.0.0.1 www.allyes.com
O1 - 未知 - Host: 127.0.0.1 www.aogo.net
O1 - 未知 - Host: 127.0.0.1 baltnet.ru
O1 - 未知 - Host: 127.0.0.1 quotes.barchart.com
O1 - 未知 - Host: 127.0.0.1 free.bestialityhost.com
O1 - 未知 - Host: 127.0.0.1 cctv1.net
O1 - 未知 - Host: 127.0.0.1 cctv8.net
O1 - 未知 - Host: 127.0.0.1 www.cctv8.net
O1 - 未知 - Host: 127.0.0.1 ciachoo.pl
O1 - 未知 - Host: 127.0.0.1 www.play.cn.gs
O1 - 未知 - Host: 127.0.0.1 www.cnqb.net
O1 - 未知 - Host: 127.0.0.1 www.feixue.net
O1 - 未知 - Host: 127.0.0.1 www.xiliao.com.cn
O1 - 未知 - Host: 127.0.0.1 alexey.pioneers.com.ru
O1 - 未知 - Host: 127.0.0.1 www.coolcdrom.com
O1 - 未知 - Host: 127.0.0.1 www.coolseach.com
O1 - 未知 - Host: 127.0.0.1 puldk490gj.da.ru
O1 - 未知 - Host: 127.0.0.1 dicto.ru
O1 - 未知 - Host: 127.0.0.1 www.dj3344.com
O1 - 未知 - Host: 127.0.0.1 www.donttrip.org
O1 - 未知 - Host: 127.0.0.1 www.ehomeday.com
O1 - 未知 - Host: 127.0.0.1 elemental.ru
O1 - 未知 - Host: 127.0.0.1 errorguard.com
O1 - 未知 - Host: 127.0.0.1 friendlygreeting.com
O1 - 未知 - Host: 127.0.0.1 zhp.gdynia.pl
O1 - 未知 - Host: 127.0.0.1 www.gg888.net
O1 - 未知 - Host: 127.0.0.1 gin.ru
O1 - 未知 - Host: 127.0.0.1 www.girlchinese.com
O1 - 未知 - Host: 127.0.0.1 glass-master.ru
O1 - 未知 - Host: 127.0.0.1 photo.gornet.ru
O1 - 未知 - Host: 127.0.0.1 relay.great.ru
O1 - 未知 - Host: 127.0.0.1 hack-gegen-rechts.com
O1 - 未知 - Host: 127.0.0.1 hgrstrailer.com
O1 - 未知 - Host: 127.0.0.1 www.homepage.com
O1 - 未知 - Host: 127.0.0.1 hotbar.com
O1 - 未知 - Host: 127.0.0.1 intellect.lvc
O1 - 未知 - Host: 127.0.0.1 interfoodtd.ru
O1 - 未知 - Host: 127.0.0.1 jewishgen.org
O1 - 未知 - Host: 127.0.0.1 www.jixian.net
O1 - 未知 - Host: 127.0.0.1 k2kapital.com
O1 - 未知 - Host: 127.0.0.1 security.kolla.de
O1 - 未知 - Host: 127.0.0.1 www.kuliao.com
O1 - 未知 - Host: 127.0.0.1 laugh-mail.net
O1 - 未知 - Host: 127.0.0.1 7b.com.cn
O1 - 未知 - Host: 127.0.0.1 9505.com
O1 - 未知 - Host: 127.0.0.1 www.piaoxue.com
O1 - 未知 - Host: 127.0.0.1 marketscore.com
O1 - 未知 - Host: 127.0.0.1 www.mir0.com
O1 - 未知 - Host: 127.0.0.1 momentum.ru
O1 - 未知 - Host: 127.0.0.1 www.mtv51.com
O1 - 未知 - Host: 127.0.0.1 www.mydj2005.com
O1 - 未知 - Host: 127.0.0.1 nefkom.net
O1 - 未知 - Host: 127.0.0.1 no-abi2003.de
O1 - 未知 - Host: 127.0.0.1 tdi-router.opola.pl
O1 - 未知 - Host: 127.0.0.1 packages.debian.or.jp
O1 - 未知 - Host: 127.0.0.1 perfectgirls.net
O1 - 未知 - Host: 127.0.0.1 peterstar.ru
O1 - 未知 - Host: 127.0.0.1 pgipearls.com
O1 - 未知 - Host: 127.0.0.1 phg.pl
O1 - 未知 - Host: 127.0.0.1 vip.pnet.pl
O1 - 未知 - Host: 127.0.0.1 sec.polbox.pl
O1 - 未知 - Host: 127.0.0.1 polobeer.de
O1 - 未知 - Host: 127.0.0.1 porno-mania.net
O1 - 未知 - Host: 127.0.0.1 home.profootball.ru
O1 - 未知 - Host: 127.0.0.1 qianbai.com
O1 - 未知 - Host: 127.0.0.1 ad.qingyule.com
O1 - 未知 - Host: 127.0.0.1 www.qq168.net
O1 - 未知 - Host: 127.0.0.1 www.qq3344.com
O1 - 未知 - Host: 127.0.0.1 www.qq92.com
O1 - 未知 - Host: 127.0.0.1 www.qqwz.com
O1 - 未知 - Host: 127.0.0.1 www.qu123.com
O1 - 未知 - Host: 127.0.0.1 republika.pl
O1 - 未知 - Host: 127.0.0.1 www.richfind.com
O1 - 未知 - Host: 127.0.0.1 rollenspielzirkel.de
O1 - 未知 - Host: 127.0.0.1 safer-networking.org
O1 - 未知 - Host: 127.0.0.1 sdsauto.ru
O1 - 未知 - Host: 127.0.0.1 www.searchpage.cc
O1 - 未知 - Host: 127.0.0.1 www.seekeasysoft.net
O1 - 未知 - Host: 127.0.0.1 shadkhan.ru
O1 - 未知 - Host: 127.0.0.1 slavarik.ru
O1 - 未知 - Host: 127.0.0.1 sovea.de
O1 - 未知 - Host: 127.0.0.1 spybot.info
O1 - 未知 - Host: 127.0.0.1 www.start-page.info
O1 - 未知 - Host: 127.0.0.1 lars-s.privat.t-online.de
O1 - 未知 - Host: 127.0.0.1 u.t2cn.com
O1 - 未知 - Host: 127.0.0.1 www.7939.com
O1 - 未知 - Host: 127.0.0.1 www.4199.com
O1 - 未知 - Host: 127.0.0.1 www.3448.com
O1 - 未知 - Host: 127.0.0.1 www.6781.com
O1 - 未知 - Host: 127.0.0.1 it.trendmicro-europe.com
O1 - 未知 - Host: 127.0.0.1 trendmicro.it
O1 - 未知 - Host: 127.0.0.1 truefriends.net
O1 - 未知 - Host: 127.0.0.1 www.tthao.com
O1 - 未知 - Host: 127.0.0.1 www.ttrx.net
O1 - 未知 - Host: 127.0.0.1 tuhart.net
O1 - 未知 - Host: 127.0.0.1 www.unionsky.cn
O1 - 未知 - Host: 127.0.0.1 www.unionsky.com
O1 - 未知 - Host: 127.0.0.1 www.unionsky.net
O1 - 未知 - Host: 127.0.0.1 vconsole.net
O1 - 未知 - Host: 127.0.0.1 virtumonde.com
O1 - 未知 - Host: 127.0.0.1 gamma.vyborg.ru
O1 - 未知 - Host: 127.0.0.1 financial.washingtonpost.com
O1 - 未知 - Host: 127.0.0.1 webpark.pl
O1 - 未知 - Host: 127.0.0.1 wishken.com
O1 - 未知 - Host: 127.0.0.1 www.yeapple.com
O1 - 未知 - Host: 127.0.0.1 www.yibinren.com
O1 - 未知 - Host: 127.0.0.1 www.youmiss.com
O1 - 未知 - Host: 127.0.0.1 www.yysky.net
O1 - 未知 - Host: 127.0.0.1 zelnet.ru
O1 - 未知 - Host: 127.0.0.1 www.zhengdian.com
O1 - 未知 - Host: 127.0.0.1 abc.265.com
O1 - 未知 - Host: 127.0.0.1 555.265.com
O1 - 未知 - Host: 127.0.0.1 www.baidu345.com
O1 - 未知 - Host: 127.0.0.1 www.37ss.com
O1 - 未知 - Host: 127.0.0.1 www.sina.com.cn
O1 - 未知 - Host: 127.0.0.1 www.sxsky.net
O2 - 未知 - BHO: (bho2gr Class) - [GetRight's IE & NS Click Monitoring. www.getright.com] - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O3 - 未知 - Toolbar: (第三方IE工具栏) - [无效的CLSID:{710EB7A1-45ED-11D0-924A-0020AFC7AC4D}] - {710EB7A1-45ED-11D0-924A-0020AFC7AC4D} -
O8 - 未知 - Extra context menu item: &使用迷你迅雷下载 - C:\Program Files\Thunder Network\ThunderMini\Program\GetUrl.htm
O8 - 未知 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - 未知 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O8 - 未知 - Extra context menu item: 使用Web迅雷下载 - C:\Program Files\Thunder Network\WebThunder\GetUrl.htm
O8 - 未知 - Extra context menu item: 使用Web迅雷下载全部链接 - C:\Program Files\Thunder Network\WebThunder\GetAllUrl.htm
O8 - 未知 - Extra context menu item: 使用网络传送带下载 - C:\Program Files\NetXfer\NXAddLink.html
O8 - 未知 - Extra context menu item: 使用网络传送带下载全部链接 - C:\Program Files\NetXfer\NXAddList.html
O9 - 未知 - Extra button: 启动迅雷5(HKLM) - C:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - 未知 - Extra button: 启动Web迅雷(HKLM) - http://my.xunlei.com
O9 - 未知 - Extra button: FlashGet(HKLM) - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - 未知 - Extra button: @xpsp3res.dll,-20001(HKLM) - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - 未知 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - 未知 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc4.cab
O18 - 未知 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll"

=======================================

天使楚楚1 - 2006-11-10 1:35:00

管理子系统用以初始化系统变量，ms-dos驱动名称类似lpt1以及com，调用win32壳子系统和运行在windows登陆过程。] - C:\WINDOWS\System32\smss.exe
100 - 安全 - Process: csrss.exe [客户端服务子系统，用以控制windows图形相关子系统。] - C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestT
100 - 安全 - Process: winlogon.exe [windows nt用户登陆程序。] - C:\WINDOWS\system32\winlogon.exe
100 - 安全 - Process: services.exe [用于管理windows服务系统进程。] - C:\WINDOWS\system32\services.exe
100 - 安全 - Process: lsass.exe [本地安全权限服务控制windows安全机制。] - C:\WINDOWS\system32\lsass.exe
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost -k DcomLaunch
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost -k rpcss
100 - 安全 - Process: CCenter.exe [瑞星杀毒软件控制台相关程序。] - C:\Program Files\Rising\Rav\CCenter.exe
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\System32\svchost.exe -k netsvcs
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost.exe -k NetworkService
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost.exe -k LocalService
100 - 安全 - Process: explorer.exe [windows program manager或者windows explorer用于控制windows图形shell，包括开始菜单、任务栏，桌面和文件管理。] - C:\WINDOWS\Explorer.EXE
100 - 安全 - Process: rfwsrv.exe [瑞星出品的防火墙程序，用于抵御黑客攻击。] - c:\program files\rising\rfw\rfwsrv.exe
100 - 安全 - Process: spoolsv.exe [windows打印任务控制程序，用以打印机就绪。] - C:\WINDOWS\system32\spoolsv.exe
100 - 安全 - Process: scardsvr.exe [对插入在计算机智能卡阅读器中的智能卡进行管理和访问控制。] - C:\WINDOWS\System32\SCardSvr.exe
100 - 安全 - Process: rfwmain.exe [瑞星公司出品的瑞星杀毒软件个人防火墙程序,用于抵御黑客攻击。] - c:\program files\rising\rfw\RfwMain.exe
100 - 安全 - Process: RavTask.exe [瑞星出品的杀毒软件相关程序。] - C:\Program Files\Rising\Rav\RavTask.exe
100 - 安全 - Process: realsched.exe [realone播放器安装时附带的升级提醒程序。] - C:\Program Files\Common Files\Real\Update_OB\realsched.exe
100 - 安全 - Process: ctfmon.exe [office xp输入法图标。] - C:\WINDOWS\system32\ctfmon.exe
100 - 安全 - Process: ThunderMini.exe [迅雷下载相关工具。] - C:\Program Files\Thunder Network\ThunderMini\program\ThunderMini.exe
100 - 安全 - Process: sriecli.exe [超级兔子相关程序。] - C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE
100 - 安全 - Process: msdtc.exe [microsoft distributed transaction coordinator控制多个服务器的传输，被安装在microsoft personal web server和microsoft sql server。] - C:\WINDOWS\system32\msdtc.exe
100 - 安全 - Process: alg.exe [这是一个应用层网关服务用于网络共享。] - C:\WINDOWS\System32\alg.exe
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\System32\svchost.exe -k HTTPFilter
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost.exe -k imgsvc
100 - 安全 - Process: dmadmin.exe [磁盘管理请求的系统管理服务。] - C:\WINDOWS\System32\dmadmin.exe /com
100 - 安全 - Process: iexplore.exe [microsoft internet explorer浏览器用于浏览网页。] - C:\Program Files\Internet Explorer\iexplore.exe
100 - 安全 - Process: conime.exe [console ime ime输入法控制台软件。] - C:\WINDOWS\system32\conime.exe
100 - 安全 - Process: RavMon.exe [瑞星杀毒软件防火墙。] - C:\Program Files\Rising\Rav\RAVMON.EXE
100 - 安全 - Process: RavMonD.exe [瑞星杀毒软件的一部分。] - C:\Program Files\Rising\Rav\Ravmond.exe
100 - 安全 - Process: RavStub.exe [瑞星出品的杀毒软件相关程序。] - C:\Program Files\Rising\Rav\RavStub.exe
100 - 安全 - Process: notepad.exe [notepad字符编辑器用于打开文档。在windows中附带。] - C:\WINDOWS\system32\NOTEPAD.EXE
100 - 安全 - Process: 360Safe.exe [360安全卫士相关程序。] - C:\Program Files\360safe\360Safe.exe
R1 - 安全 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=about:blank
R1 - 安全 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=about:blank
O2 - 安全 - BHO: (Adobe PDF Reader Link Helper) - [Adobe Reader，查看和打印 Adobe 便携文档格式 (PDF) 文件。] - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - 安全 - BHO: (IeCatch5 Class) - [网际快车，支持下载后的文件管理] - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FLASHGET\jccatch.dll
O2 - 安全 - BHO: (NXIECatcher Class) - [网络传送带，支持多线程断点续传] - {83B80A9C-D91A-4F22-8DCF-EA7204039F79} - C:\Program Files\NetXfer\NXIEHelper.dll
O2 - 安全 - BHO: (Thunder Browser Helper) - [迅雷附带下载监视器相关文件。] - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_004.dll
O2 - 安全 - BHO: (ThunderMini Browser Helper) - [迷你迅雷相关程序。] - {8E6C1C49-F9CE-4311-9FB4-D70E8B0AEAEB} - C:\Program Files\Thunder Network\ThunderMini\ComDlls\XunLeiMiniBHO_001.dll
O3 - 安全 - Toolbar: (FlashGet Bar) - [FlashGet IE工具条。] - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - 安全 - Toolbar: (NetXfer) - [网络传送带相关插件。] - {C16CBAAC-A75C-4DB5-A0DD-CDF5CAFCDD3A} - C:\Program Files\NetXfer\NXToolBar.dll
O4 - 安全 - HKLM\..\Run: [RfwMain] [瑞星防火墙程序，抵御黑客攻击。] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - 安全 - HKLM\..\Run: [RavTask] [瑞星杀毒软件的任务计划程序。] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - 安全 - HKLM\..\Run: [Super Rabbit SRRestore] [超级兔子：对计算机进行优化，设置的工具] C:\Program Files\Super Rabbit\MagicSet\srrest.exe /autosave
O4 - 安全 - HKLM\..\Run: [ThunderMini] [迅雷下载相关工具。] C:\Program Files\Thunder Network\ThunderMini\ThunderMiniShell.exe
O4 - 安全 - HKLM\..\Run: [TkBellExe] [是Real Networks产品定时升级检测程序。] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - 安全 - HKCU\..\Run: [ctfmon.exe] [office xp输入法图标。] C:\WINDOWS\system32\ctfmon.exe
O4 - 安全 - HKCU\..\Run: [Super Rabbit IEPro] [超级兔子ie保护专家] C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD
O4 - 安全 - Startup folder: [Adobe Reader Speed Launch.lnk] [adobe公司出品的pdf处理软件的相关程序。] C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Reader Speed Launch.lnk
O8 - 安全 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - 安全 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - 安全 - Extra context menu item: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - 安全 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O8 - 安全 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O11 - 安全 - Options Group: International*
O16 - 安全 - DPF: 无效的CLSID：{0000000A-0000-0010-8000-00AA00389B71} ({0000000A-0000-0010-8000-00AA00389B71}) - http://download.microsoft.com/download/d/4/4/d446e8a9-3a86-4b59-bb19-f5bd11b40367/wmavax.CAB
O16 - 安全 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://download.microsoft.com/download/6/7/5/675d28f5-2a8e-4bac-bd9b-ee147f352714/OGAControl.cab
O16 - 安全 - DPF: 无效的CLSID：{33564D57-0000-0010-8000-00AA00389B71} ({33564D57-0000-0010-8000-00AA00389B71}) - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O18 - 安全 - Protocol: OFFICE 相关 - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
O21 - 安全 - Protocol Icons: Software\Microsoft\Internet Explorer\View Source Editor\Editor Name - C:\Program Files\IDM Computer Solutions\UltraEdit-32\uedit32.exe
O23 - 安全 - Service: RfwProxySrv [瑞星防火墙相关程序。] - c:\program files\rising\rfw\rfwproxy.exe
O23 - 安全 - Service: RfwService [是瑞星个人防火墙相关程序。] - c:\program files\rising\rfw\rfwsrv.exe
O23 - 安全 - Service: RsCCenter [是瑞星杀毒软件控制台相关程序。] - "C:\Program Files\Rising\Rav\CCenter.exe"
O23 - 安全 - Service: RsRavMon [是瑞星杀毒软件相关监控程序。] - "C:\Program Files\Rising\Rav\Ravmond.exe"
O25 - 安全 - ABOUT: DesktopItemNavigationFailure - res://ieframe.dll/navcancl.htm
O25 - 安全 - ABOUT: NavigationCanceled - res://ieframe.dll/navcancl.htm
O25 - 安全 - ABOUT: NavigationFailure - res://ieframe.dll/navcancl.htm
O25 - 安全 - ABOUT: OfflineInformation - res://ieframe.dll/offcancl.htm
O25 - 安全 - ABOUT: PostNotCached - res://ieframe.dll/repost.htm

天使楚楚1 - 2006-11-10 1:36:00

=======================================

040 - svchost.exe - Microsoft Corporation - C:\WINDOWS\system32\Normaliz.dll - Unicode Normalization DLL
040 - svchost.exe - Microsoft Corporation - C:\WINDOWS\system32\iertutil.dll - Run time utility for Internet Explorer
040 - svchost.exe - Microsoft Corporation - c:\windows\system32\appmgmts.dll - Software installation Service
040 - svchost.exe - Microsoft Corporation - c:\windows\system32\qmgr.dll - 后台智能传送服务
040 - svchost.exe - Microsoft Corporation - c:\windows\system32\msgsvc.dll - NT Messenger Service
040 - svchost.exe - Microsoft Corporation - C:\WINDOWS\system32\Normaliz.dll - Unicode Normalization DLL
040 - svchost.exe - Microsoft Corporation - C:\WINDOWS\system32\iertutil.dll - Run time utility for Internet Explorer
040 - svchost.exe - Microsoft Corporation - c:\windows\system32\upnphost.dll - UPnP Device Host
040 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\system32\Normaliz.dll - Unicode Normalization DLL
040 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\system32\iertutil.dll - Run time utility for Internet Explorer
040 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\system32\ieframe.dll - Internet Explorer
040 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\system32\srclient.dll - SR CLIENT DLL
040 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\System32\Wbem\framedyn.dll - WMI SDK Provider Framework
040 - Explorer.EXE - Headlight Software, Inc. - C:\Program Files\GetRight\xx2gr.dll - GetRight's IE & NS Click Monitoring. www.getright.com
040 - Explorer.EXE - Xi - C:\Program Files\NetXfer\NXIEHelper.dll - NetXfer IE Helper Module
040 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\system32\MFC42u.DLL - MFCDLL Shared Library - Retail Version
040 - Explorer.EXE - Thunder Networking Technologies,LTD - C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_004.dll - XunLeiBHO
040 - Explorer.EXE - Thunder Networking Technologies,LTD - C:\Program Files\Thunder Network\ThunderMini\ComDlls\XunLeiMiniBHO_001.dll - XunLeiMiniBHO
040 - Explorer.EXE - WinZip Computing LP - C:\Program Files\WinZip\WZSHLSTB.DLL - WinZip Shell Extension DLL
040 - Explorer.EXE - Beijing Rising Technology Co., Ltd. - C:\WINDOWS\system32\RavExt.dll - Rising Shell Ext Module
040 - Explorer.EXE - Adobe Systems, Inc. - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll - PDF Shell Extension
040 - Explorer.EXE - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\RSCOMMON.DLL - Rising Common Function Dynamic Link Library
040 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\system32\mshtml.dll - Microsoft (R) HTML Viewer
040 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\system32\msls31.dll - Microsoft Line Services library file
040 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\system32\sendmail.dll - Send Mail
040 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\system32\diskcopy.dll - Windows DiskCopy
040 - svchost.exe - Microsoft Corporation - c:\windows\system32\w3ssl.dll - SSL service for HTTP
040 - svchost.exe - Microsoft Corporation - C:\WINDOWS\System32\strmfilt.dll - Stream Filter Library
040 - svchost.exe - Microsoft Corporation - C:\WINDOWS\System32\HTTPAPI.dll - HTTP Protocol Stack API
040 - svchost.exe - Microsoft Corporation - c:\windows\system32\wiaservc.dll - Still Image Devices Service
040 - svchost.exe - Microsoft Corporation - C:\WINDOWS\system32\sti.dll - Still Image Devices client DLL

=======================================

041 - BaseTDI - basetdi - C:\WINDOWS\SYSTEM32\DRIVERS\basetdi.sys
041 - d347bus - PnP BIOS Extension - C:\WINDOWS\SYSTEM32\DRIVERS\d347bus.sys
041 - d347prt - SCSI miniport - C:\WINDOWS\SYSTEM32\DRIVERS\d347prt.sys
041 - ds1 - Yamaha PCI(x) Audio System (WDM)[1013] - C:\WINDOWS\SYSTEM32\DRIVERS\ds1wdm.sys
041 - ExpScaner - ExpScan.sys - C:\Program Files\Rising\Rav\ExpScan.sys
041 - FLASHREADER - Composite USB Storage Driver - C:\WINDOWS\SYSTEM32\DRIVERS\CAUSB.SYS
041 - gameenum - Game Port Enumerator - C:\WINDOWS\SYSTEM32\DRIVERS\gameenum.sys
041 - HookCont - TDI HOOK Driver - C:\Program Files\Rising\Rav\HookCont.sys
041 - HookReg - HookReg - C:\Program Files\Rising\Rav\HOOKREG.sys
041 - HookSys - Hooksys - C:\Program Files\Rising\Rav\HookSys.sys
041 - HookUrl - HookUrl - C:\Program Files\Rising\Rfw\HookUrl.sys
041 - irda - IRDA Protocol Driver - C:\WINDOWS\SYSTEM32\DRIVERS\irda.sys
041 - MEMSCAN - MemScan Driver - C:\Program Files\Rising\Rav\MemScan.sys
041 - mProcRs - Rising Personal FireWall mprocrs.sys - c:\program files\Rising\Rfw\mProcRs.sys
041 - OBOE - TOSHIBA FIR Type-O Miniport Driver - C:\WINDOWS\SYSTEM32\DRIVERS\Tos4mo.sys
041 - P3 - Processor Device Driver - C:\WINDOWS\SYSTEM32\DRIVERS\p3.sys
041 - pfc - Padus(R) ASPI Shell - C:\WINDOWS\SYSTEM32\DRIVERS\pfc.sys
041 - PxHelp20 - Px Engine Device Driver for Windows 2000/XP - C:\WINDOWS\SYSTEM32\DRIVERS\PxHelp20.sys
041 - Rasirda - IrDA WAN Miniport Driver - C:\WINDOWS\SYSTEM32\DRIVERS\rasirda.sys
041 - RsFwDrv - nt_fwdrv - C:\Program Files\Rising\Rfw\rsfwdrv.sys
041 - RSPPSYS - RSPPSYS - C:\PROGRAM FILES\Rising\Rav\rsppsys.sys
041 - Sfloppy - SCSI Floppy Driver - C:\WINDOWS\SYSTEM32\DRIVERS\sfloppy.sys
041 - Sparrow - Adaptec AIC-6x60 series SCSI miniport - C:\WINDOWS\SYSTEM32\DRIVERS\sparrow.sys
041 - Tridkb - Trident Miniport Driver - C:\WINDOWS\SYSTEM32\DRIVERS\tridkbm.sys
041 - usbscan - USB Scanner Driver - C:\WINDOWS\SYSTEM32\DRIVERS\usbscan.sys

=======================================
360Safe.exe=2.0.1.2007
AntiAdwa.dll=2.0.1.2007
AntiEng.dll=2.0.1.2007
AntiActi.dll=2.0.0.3000
CleanHis.dll=2.0.0.1001
safelive.exe=1.0.0.2007
live.dll=1.0.0.1011

=======================================
操作历史报告：
----------查杀恶意软件历史----------

2006-11-07 12:00
查杀恶意软件 - 网际快车附带的工具栏 - 安全 -
查杀恶意软件 - 网络传送带 - 安全 -
查杀恶意软件 - 超级兔子上网精灵 - 安全 -

----------插件卸载操作历史----------

2006-11-07 01:12
插件管理 - 网际快车附带的工具栏 - C:\PROGRA~1\FLASHGET\jccatch.dll
插件管理 - 网络传送带 - C:\PROGRA~1\NetXfer\NXIEHE~1.DLL
插件管理 - 超级兔子上网精灵 - C:\PROGRA~1\SUPERR~1\MagicSet\HAOKAN~1.DLL

----------修复IE浏览器操作历史----------

2006-11-07 14:06
O27 - 危险 - 登录提示框标题 - HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
O27 - 危险 - 登录提示框文字 - HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
R0 - 危险 - IE首页 - HKCU\Software\Microsoft\Internet Explorer\Main
O14 - 危险 - Web原始设置IERESET.INF - C:\WINDOWS\inf\iereset.inf
2006-11-07 14:18
R0 - 危险 - IE首页 - HKCU\Software\Microsoft\Internet Explorer\Main
2006-11-07 14:25
R0 - 危险 - IE首页 - HKCU\Software\Microsoft\Internet Explorer\Main
2006-11-07 15:18
R0 - 危险 - IE首页 - HKCU\Software\Microsoft\Internet Explorer\Main
O28 - 危险 - IE链接的参数 - -extoff

=======================================

360安全卫士，彻底查杀各种流氓软件,全面保护系统安全,并赠送正版卡巴斯基V6.0
最新免费下载：http://www.360safe.com

天使楚楚1 - 2006-11-10 1:41:00

为了防止流氓网站修改我的IE首页,我用超级兔子把IE首页给锁死了哈

还有用超级兔子提供的屏蔽网址功能把很多流氓网站也给屏蔽掉了呢,呵呵

天使楚楚1 - 2006-11-10 3:19:00

刚才桌面上又弹出要我去注册FolderView ActiveX 和Shell Object ActiveX的窗口,注册网址是www.ssware.com/order.htm

巨烦人喔5555555555555555555555555555555

我前天好像就用360安全卫士把IE给修了一下,进桌面前那烦人窗口现在不弹出来了,但进桌面后我一用超级兔子就还是会经常弹出FolderView ActiveX 和Shell Object ActiveX的提示窗口喔

mopery - 2006-11-10 8:23:00

http://mopery.hits.io/hijackthis.zip
下载HijackThis...把日志帖上来..

瑞星卡卡安全论坛