如何彻底查杀Downloader木马病毒 bbs.ikaka.com

smartzzm - 2007-1-27 0:53:00

刚开始的时候norton报出感染病毒 infostealer,怎么都杀不了。后来用了"木马分析专家会"和“木马杀客2007”，没有在报告infostealer，但是每次开机之后都会报告发现downloader病毒，怎么都杀不了，请教高手帮忙！

Infostealer.Gampass
Risk Level 1: Very Low

Discovered: November 12, 2006
Updated: November 19, 2006 10:30:30 AM ZE9
Type: Trojan Horse
Infection Length: Varies
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

Infostealer.Gampass is a generic detection for a Trojan horse that steals online game accounts, such as Lineage, Ragnarok online, and Rexue Jianghu.

Note: Virus definitions dated November 17, 2006 or later may detect this threat as Bloodhound.KillAV.

ProtectionVirus Definitions (LiveUpdate™ Daily) November 12, 2006
Virus Definitions (LiveUpdate™ Weekly) November 15, 2006
Virus Definitions (Intelligent Updater) November 12, 2006
Virus Definitions (LiveUpdate™ Plus) November 12, 2006
Threat AssessmentWildWild Level: Low
Number of Infections: 0 - 49
Number of Sites: 0 - 2
Geographical Distribution: Low
Threat Containment: Easy
Removal: Easy
DamageDamage Level: Low
DistributionDistribution Level: Low

Writeup By: Kaoru Hayashi

Downloader
Risk
Level 1: Very Low

Discovered: June 8, 2001
Updated: August 17, 2006 12:34:39 PM PDT
Type: Trojan Horse
Infection Length: varies
Systems Affected: Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me

Downloader connects to the Internet and downloads other Trojan horses or components.

Note: Virus definitions dated June 1, 2006 or earlier may detect this threat as Download.Trojan.

ProtectionVirus Definitions (LiveUpdate™ Weekly) June 13, 2001
Virus Definitions (Intelligent Updater) June 11, 2001
Threat AssessmentWildWild Level: Low
Number of Infections: 0 - 49
Number of Sites: 0 - 2
Geographical Distribution: Low
Threat Containment: Easy
Removal: Easy
DamageDamage Level: Low
DistributionDistribution Level: Low

Writeup By: Gor Nazaryan

smartzzm - 2007-1-29 1:18:00

为什么没人回应呀？
请教mopery大牛！！！！！！！！！！！！！

smartzzm - 2007-1-29 1:29:00

System Repair Engineer 2.3.13.690 扫描结果
[CODE]

2007-01-29,01:14:40

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- Administrative User - Completed Functions Allowed

Follow item(s) have been choosed:
All Boot Items (Including Registry, Startup Folders, Services and so on)
Browser Add-ons
Runing Processes (Including process model information)
File Associations
Winsock Provider
Autorun.Inf
HOSTS File

Boot Items
Registry
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background> [(Verified)Microsoft Corporation]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
<Syzmy3><; C:\DOCUME~1\zzm\LOCALS~1\Temp\exp1orer.exe> [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<SynTPLpr><C:\Program Files\Synaptics\SynTP\SynTPLpr.exe> [(Verified)Synaptics, Inc.]
<SynTPEnh><C:\Program Files\Synaptics\SynTP\SynTPEnh.exe> [(Verified)Synaptics, Inc.]
<TPKMAPHELPER><C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper> [IBM Corp.]
<TpShocks><TpShocks.exe> [IBM Corp.]
<TPHOTKEY><C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe> [N/A]
<ControlCenter><"C:\Program Files\IBM fingerprint software\ctlcntr.exe" /startup> [UPEK Inc.]
<TP4EX><tp4ex.exe> [IBM Corporation]
<SoundMAXPnP><C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe> [Analog Devices, Inc.]
<SoundMAX><C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray> [Analog Devices, Inc.]
<ISUSScheduler><"C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start> [InstallShield Software Corporation]
<IBMPRC><C:\IBMTOOLS\UTILS\ibmprc.exe> [IBM Corp.]
<QCTRAY><C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE> [IBM Corp.]
<QCWLICON><C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE> [IBM Corp.]
<PWRMGRTR><rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor> [IBM Corp.]
<BLOG><rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog> [N/A]
<DAEMON Tools><"C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033> [(Verified)DT Soft Ltd.]
<Acrobat Assistant 7.0><"C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"> [Adobe Systems Inc.]
<ccApp><"C:\Program Files\Common Files\Symantec Shared\ccApp.exe"> [(Verified)Symantec Corporation]
<vptray><C:\PROGRA~1\SYMANT~1\VPTray.exe> [(Verified)Symantec Corporation]
<CJIMETIPSYNC><C:\Program Files\Common Files\Microsoft Shared\IME\IMTC65\CHANGJIE\CINTLCFG.EXE /CJIMETIPSync> [(Verified)Microsoft Corp.]
<PHIMETIPSYNC><C:\Program Files\Common Files\Microsoft Shared\IME\IMTC65\PHONETIC\TINTLCFG.EXE /PHIMETIPSync> [(Verified)Microsoft Corp.]
<IMJPMIG9.0><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMJP9\IMJPMIG.EXE /Preload /Migration32> [(Verified)Microsoft Corporation]
<YLive.exe><C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe> [(Verified)Yahoo! China]
<yassistse><"C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"> [(Verified)Yahoo! China]
<StormCodec_Helper><; "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti> [N/A]
<cxa.exe><; C:\WINDOWS\system32\cxa.exe> [N/A]
<EZEJMNAP><; C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe> [IBM Corp.]
<ibmmessages><; C:\Program Files\IBM\Messages By IBM\\ibmmessages.exe> [IBM]
<imekrmig7.0><; "C:\Program Files\Common Files\Microsoft Shared\IME\IMKR7\IMEKRMIG.EXE"> [(Verified)Microsoft Corporation]
<IMSCMig><; C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload> [(Verified)Microsoft Corporation]
<ISUSPM Startup><; C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup> [InstallShield Software Corporation]
<NeroCheck><; C:\WINDOWS\system32\\NeroCheck.exe> [Ahead Software Gmbh]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<DTService><rundll32.exe C:\WINDOWS\system32\drivers\soundmix.dll,Load> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation]
<GinaDLL><vrlogon.dll> [UPEK Inc.]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{1A404685-7563-4d02-B0F6-58B308A406A9}><c:\program files\intel\wireless\bin\rypvfdck.dll> [N/A]
<{4BAB150F-DD97-476D-9C1E-41B6CDC0CA7A}><C:\PROGRA~1\Yahoo!\Assistant\yClickOn.dll> [(Verified)YAHOO Corporation Limited]
<{E568441B-9EF3-49F8-9A67-4141AC41ADD4}><> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
<WinlogonNotify: NavLogon><C:\WINDOWS\system32\NavLogon.dll> [(Verified)Symantec Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\psfus]
<WinlogonNotify: psfus><C:\Program Files\IBM fingerprint software\psfus.dll> [UPEK Inc.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\QConGina]
<WinlogonNotify: QConGina><QConGina.dll> [IBM Corp.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tphotkey]
<WinlogonNotify: tphotkey><tphklock.dll> [N/A]

smartzzm - 2007-1-29 1:30:00

==================================
Startup Folders
N/A

==================================
Services
[ASP.NET State Service / aspnet_state][Stopped/Manual Start]
<C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe><Microsoft Corporation>
[Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start]
<C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[Symantec Event Manager / ccEvtMgr][Running/Auto Start]
<"C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"><Symantec Corporation>
[Symantec Settings Manager / ccSetMgr][Running/Auto Start]
<"C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"><Symantec Corporation>
[Symantec AntiVirus Definition Watcher / DefWatch][Running/Auto Start]
<"C:\Program Files\Symantec AntiVirus\DefWatch.exe"><Symantec Corporation>
[EvtEng / EvtEng][Running/Auto Start]
<C:\Program Files\Intel\Wireless\Bin\EvtEng.exe><Intel Corporation>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[IBM Rapid Restore Ultra Service / IBM Rapid Restore Ultra Service][Running/Auto Start]
<"C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe"><>
[IBM PM Service / IBMPMSVC][Running/Auto Start]
<C:\WINDOWS\system32\ibmpmsvc.exe><N/A>
[InstallDriver Table Manager / IDriverT][Stopped/Manual Start]
<"C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe"><Macrovision Corporation>
[LiveUpdate / LiveUpdate][Stopped/Manual Start]
<"C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE"><Symantec Corporation>
[MATLAB Server / matlabserver][Stopped/Disabled]
<C:\MATLAB6p5p1\webserver\bin\win32\matlabserver.exe><N/A>
[OracleMTSRecoveryService / OracleMTSRecoveryService][Running/Auto Start]
<E:\oracle\ora90\bin\omtsreco.exe "OracleMTSRecoveryService"><Oracle Corporation>
[OracleOraHome90ClientCache / OracleOraHome90ClientCache][Stopped/Manual Start]
<E:\oracle\ora90\BIN\ONRSD.EXE><N/A>
[IBM PSA Access Driver Control / PsaSrv][Stopped/Manual Start]
<C:\WINDOWS\system32\PsaSrv.exe><N/A>
[QCONSVC / QCONSVC][Running/Auto Start]
<System32\QCONSVC.EXE><N/A>
[RegSrvc / RegSrvc][Running/Auto Start]
<C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe><Intel Corporation>
[Remote Packet Capture Protocol v.0 (experimental) / rpcapd][Stopped/Manual Start]
<"C:\Program Files\WinPcap\rpcapd.exe" -d -f "C:\Program Files\WinPcap\rpcapd.ini"><CACE Technologies>
[Spectrum24 Event Monitor / S24EventMonitor][Running/Auto Start]
<C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe><Intel Corporation>
[SavRoam / SavRoam][Stopped/Manual Start]
<"C:\Program Files\Symantec AntiVirus\SavRoam.exe"><symantec>
[Symantec Network Drivers Service / SNDSrvc][Stopped/Manual Start]
<"C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe"><Symantec Corporation>
[SoundMAX Agent Service / SoundMAX Agent Service (default)][Running/Auto Start]
<C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.>
[Symantec SPBBCSvc / SPBBCSvc][Stopped/Manual Start]
<"C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe"><Symantec Corporation>
[Symantec AntiVirus / Symantec AntiVirus][Running/Auto Start]
<"C:\Program Files\Symantec AntiVirus\Rtvscan.exe"><Symantec Corporation>
[IBM HDD APS Logging Service / TPHDEXLGSVC][Running/Auto Start]
<System32\TPHDEXLG.EXE><N/A>
[IBM KCU Service / TpKmpSVC][Running/Auto Start]
<C:\WINDOWS\system32\TpKmpSVC.exe><N/A>
[Visual Studio Analyzer RPC bridge / Visual Studio Analyzer RPC bridge][Stopped/Manual Start]
<C:\Program Files\Microsoft Visual Studio\Common\Tools\VS-Ent98\Vanalyzr\varpc.exe><Microsoft Corporation>
[VMware Authorization Service / VMAuthdService][Stopped/Auto Start]
<C:\Program Files\VMware\VMware Workstation\vmware-authd.exe><VMware, Inc.>
[VMware DHCP Service / VMnetDHCP][Stopped/Auto Start]
<C:\WINDOWS\system32\vmnetdhcp.exe><VMware, Inc.>
[VMware Virtual Mount Manager Extended / vmount2][Running/Auto Start]
<"C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe"><VMware, Inc.>
[VMware NAT Service / VMware NAT Service][Stopped/Auto Start]
<C:\WINDOWS\system32\vmnat.exe><VMware, Inc.>
[Protector Suite Virtual Token / vtserver][Running/Auto Start]
<"C:\Program Files\Common Files\Virtual Token\vtserver.exe"><UPEK Inc.>
[Windows Media Connect (WMC) / WmcCds][Stopped/Manual Start]
<c:\program files\windows media connect\mswmccds.exe><Microsoft Corporation>
[Windows Media Connect (WMC) Helper / WmcCdsLs][Stopped/Manual Start]
<C:\Program Files\Windows Media Connect\mswmcls.exe><Microsoft Corporation>

==================================

smartzzm - 2007-1-29 1:33:00

Drivers
[abp480n5 / abp480n5][Stopped/Disabled]
<\SystemRoot\system32\DRIVERS\ABP480N5.SYS><Microsoft Corporation>
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Stopped/Manual Start]
<system32\drivers\ac97intc.sys><Intel Corporation>
[adpu160m / adpu160m][Stopped/Disabled]
<\SystemRoot\system32\DRIVERS\adpu160m.sys><Microsoft Corporation>
[aeaudio / aeaudio][Running/Manual Start]
<system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
[AEGIS Protocol (IEEE 802.1x) v3.1.6.0 / AegisP][Running/Auto Start]
<system32\DRIVERS\AegisP.sys><Meetinghouse Data Communications>
[Aha154x / Aha154x][Stopped/Disabled]
<\SystemRoot\system32\DRIVERS\aha154x.sys><Microsoft Corporation>
[aic78u2 / aic78u2][Stopped/Disabled]
<\SystemRoot\system32\DRIVERS\aic78u2.sys><Microsoft Corporation>
[aic78xx / aic78xx][Stopped/Disabled]
<\SystemRoot\system32\DRIVERS\aic78xx.sys><Microsoft Corporation>
[AliIde / AliIde][Stopped/Disabled]
<\SystemRoot\system32\DRIVERS\aliide.sys><Acer Laboratories Inc.>
[AMD AGP Bus Filter Driver / amdagp][Stopped/Disabled]
<\SystemRoot\system32\DRIVERS\amdagp.sys><Advanced Micro Devices, Inc.>
[ANC / ANC][Running/System Start]
<System32\drivers\ANC.SYS><IBM Corp.>
[asc / asc][Stopped/Disabled]
<\SystemRoot\system32\DRIVERS\asc.sys><Advanced System Products, Inc.>
[asc3350p / asc3350p][Stopped/Disabled]
<\SystemRoot\system32\DRIVERS\asc3350p.sys><Microsoft Corporation>
[asc3550 / asc3550][Stopped/Disabled]
<\SystemRoot\system32\DRIVERS\asc3550.sys><Advanced System Products, Inc.>
[ati2mtag / ati2mtag][Running/Manual Start]
<system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[Broadcom NetXtreme Gigabit Ethernet / b57w2k][Running/Manual Start]
<system32\DRIVERS\b57xp32.sys><Broadcom Corporation>
[cd20xrnt / cd20xrnt][Stopped/Disabled]
<\SystemRoot\system32\DRIVERS\cd20xrnt.sys><Microsoft Corporation>
[CmdIde / CmdIde][Stopped/Manual Start]
<\SystemRoot\system32\DRIVERS\cmdide.sys><CMD Technology, Inc.>
[dac2w2k / dac2w2k][Stopped/Disabled]
<\SystemRoot\system32\DRIVERS\dac2w2k.sys><Mylex Corporation>
[DLABOIOM / DLABOIOM][Running/Auto Start]
<System32\DLA\DLABOIOM.SYS><Sonic Solutions>
[DLACDBHM / DLACDBHM][Running/System Start]
<System32\Drivers\DLACDBHM.SYS><Sonic Solutions>
[DLADResN / DLADResN][Running/Auto Start]
<System32\DLA\DLADResN.SYS><Sonic Solutions>
[DLAIFS_M / DLAIFS_M][Running/Auto Start]
<System32\DLA\DLAIFS_M.SYS><Sonic Solutions>
[DLAOPIOM / DLAOPIOM][Running/Auto Start]
<System32\DLA\DLAOPIOM.SYS><Sonic Solutions>
[DLAPoolM / DLAPoolM][Running/Auto Start]
<System32\DLA\DLAPoolM.SYS><Sonic Solutions>
[DLARTL_N / DLARTL_N][Running/System Start]
<System32\Drivers\DLARTL_N.SYS><Sonic Solutions>
[DLAUDFAM / DLAUDFAM][Running/Auto Start]
<System32\DLA\DLAUDFAM.SYS><Sonic Solutions>
[DLAUDF_M / DLAUDF_M][Running/Auto Start]
<System32\DLA\DLAUDF_M.SYS><Sonic Solutions>
[dpti2o / dpti2o][Stopped/Disabled]
<\SystemRoot\system32\DRIVERS\dpti2o.sys><Microsoft Corporation>
[DRVMCDB / DRVMCDB][Running/Boot Start]
<\SystemRoot\System32\Drivers\DRVMCDB.SYS><Sonic Solutions>
[DRVNDDM / DRVNDDM][Running/Auto Start]
<System32\Drivers\DRVNDDM.SYS><Sonic Solutions>
[dtscsi / dtscsi][Running/Manual Start]
<\SystemRoot\System32\Drivers\dtscsi.sys><N/A>
[Intel(R) PRO Adapter Driver / E100B][Stopped/Manual Start]
<system32\DRIVERS\e100b325.sys><Intel Corporation>
[Symantec Eraser Control driver / eeCtrl][Running/System Start]
<\??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys><Symantec Corporation>
[IBM Access Support / EGATHDRV][Running/Auto Start]
<\??\C:\WINDOWS\SYSTEM32\EGATHDRV.SYS><IBM Corporation>
[EraserUtilRebootDrv / EraserUtilRebootDrv][Running/Manual Start]
<\??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys><Symantec Corporation>
[VMware hcmon / hcmon][Running/Auto Start]
<\??\C:\WINDOWS\system32\Drivers\hcmon.sys><VMware, Inc.>
[HSFHWICH / HSFHWICH][Stopped/Manual Start]
<system32\DRIVERS\HSFHWICH.sys><Conexant Systems, Inc.>
[HSF_DP / HSF_DP][Stopped/Manual Start]
<system32\DRIVERS\HSF_DP.sys><Conexant Systems, Inc.>
[ibmfilter / ibmfilter][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\ibmfilter.sys><IBM>
[IBMPMDRV / IBMPMDRV][Running/Manual Start]
<system32\DRIVERS\ibmpmdrv.sys><IBM Corp.>
[IBMTPCHK / IBMTPCHK][Running/System Start]
<System32\drivers\IBMBLDID.SYS><N/A>
[ini910u / ini910u][Stopped/Disabled]
<\SystemRoot\system32\DRIVERS\ini910u.sys><Microsoft Corporation>
[kninnlfd / kninnlfd][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\kninnlfd.sys><Yahoo! China Corporation>
[mdmxsdk / mdmxsdk][Running/Auto Start]
<system32\DRIVERS\mdmxsdk.sys><Conexant>
[mraid35x / mraid35x][Stopped/Disabled]
<\SystemRoot\system32\DRIVERS\mraid35x.sys><American Megatrends Inc.>
[NAVENG / NAVENG][Running/Manual Start]
<\??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20070122.041\naveng.sys><Symantec Corporation>
[NAVEX15 / NAVEX15][Running/Manual Start]
<\??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20070122.041\navex15.sys><Symantec Corporation>
[NetGroup Packet Filter Driver / NPF][Stopped/Manual Start]
<system32\drivers\npf.sys><CACE Technologies>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\E:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[NSC Infrared Device Driver / NSCIRDA][Stopped/Manual Start]
<system32\DRIVERS\nscirda.sys><National Semiconductor Corporation>
[nv / nv][Stopped/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[PCDRNDISUIO Usermode I/O Protocol / PcdrNdisuio][Stopped/Manual Start]
<system32\DRIVERS\pcdrndisuio.sys><Windows (R) 2000 DDK provider>
[Padus ASPI Shell / Pfc][Running/Manual Start]
<system32\drivers\pfc.sys><Padus, Inc.>
[PMEM / PMEM][Running/Auto Start]
<\??\C:\WINDOWS\SYSTEM32\Drivers\PMEMNT.SYS><Microsoft Corporation>
[IBM PSA Access Driver / psadd][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\Drivers\psadd.sys><IBM Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[PxHelp20 / PxHelp20][Running/Boot Start]
<\SystemRoot\System32\Drivers\PxHelp20.sys><Sonic Solutions>

smartzzm - 2007-1-29 1:33:00

[QCNDISIF / QCNDISIF][Stopped/Manual Start]
<System32\drivers\qcndisif.SYS><IBM Corporation.>
[ql1080 / ql1080][Stopped/Disabled]
<\SystemRoot\system32\DRIVERS\ql1080.sys><QLogic Corporation>
[Ql10wnt / Ql10wnt][Stopped/Disabled]
<\SystemRoot\system32\DRIVERS\ql10wnt.sys><Microsoft Corporation>
[ql12160 / ql12160][Stopped/Disabled]
<\SystemRoot\system32\DRIVERS\ql12160.sys><QLogic Corporation>
[ql1280 / ql1280][Stopped/Disabled]
<\SystemRoot\system32\DRIVERS\ql1280.sys><QLogic Corporation>
[WLAN Transport / s24trans][Running/Auto Start]
<system32\DRIVERS\s24trans.sys><Intel Corporation>
[SAVRT / SAVRT][Running/System Start]
<\??\C:\Program Files\Symantec AntiVirus\savrt.sys><Symantec Corporation>
[SAVRTPEL / SAVRTPEL][Running/System Start]
<\??\C:\Program Files\Symantec AntiVirus\Savrtpel.sys><Symantec Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[SIS AGP Bus Filter / sisagp][Stopped/Disabled]
<\SystemRoot\system32\DRIVERS\sisagp.sys><Silicon Integrated Systems Corporation>
[Smapint / Smapint][Running/System Start]
<System32\drivers\Smapint.sys><Microsoft Corporation>
[SMI helper driver / SmiHlp][Running/Auto Start]
<\??\C:\Program Files\IBM fingerprint software\smihlp.sys><UPEK Inc.>
[smwdm / smwdm][Running/Manual Start]
<system32\drivers\smwdm.sys><Analog Devices, Inc.>
[Sparrow / Sparrow][Stopped/Disabled]
<\SystemRoot\system32\DRIVERS\sparrow.sys><Adaptec, Inc.>
[SPBBCDrv / SPBBCDrv][Stopped/Manual Start]
<\??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys><Symantec Corporation>
[sptd / sptd][Running/Boot Start]
<\SystemRoot\System32\Drivers\sptd.sys><N/A>
[symc810 / symc810][Stopped/Disabled]
<\SystemRoot\system32\DRIVERS\symc810.sys><Symbios Logic Inc.>
[symc8xx / symc8xx][Stopped/Disabled]
<\SystemRoot\system32\DRIVERS\symc8xx.sys><LSI Logic>
[SymEvent / SymEvent][Running/Manual Start]
<\??\C:\Program Files\Symantec\SYMEVENT.SYS><Symantec Corporation>
[SYMIDSCO / SYMIDSCO][Stopped/Manual Start]
<\??\C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\IDS-DI~1\20040813.178\symidsco.sys><N/A>
[SYMREDRV / SYMREDRV][Running/Manual Start]
<\SystemRoot\System32\Drivers\SYMREDRV.SYS><Symantec Corporation>
[SYMTDI / SYMTDI][Running/System Start]
<\SystemRoot\System32\Drivers\SYMTDI.SYS><Symantec Corporation>
[sym_hi / sym_hi][Stopped/Disabled]
<\SystemRoot\system32\DRIVERS\sym_hi.sys><LSI Logic>
[sym_u3 / sym_u3][Stopped/Disabled]
<\SystemRoot\system32\DRIVERS\sym_u3.sys><LSI Logic>
[Synaptics TouchPad Driver / SynTP][Running/Manual Start]
<system32\DRIVERS\SynTP.sys><Synaptics, Inc.>
[tbmthq7 / tbmthq70][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\tbmthq70.sys><N/A>
[TC USB Kernel Driver / TcUsb][Running/Manual Start]
<System32\Drivers\tcusb.sys><UPEK Inc.>
[TDSMAPI / TDSMAPI][Running/System Start]
<System32\drivers\TDSMAPI.SYS><N/A>
[TosIde / TosIde][Stopped/Disabled]
<\SystemRoot\system32\DRIVERS\toside.sys><Microsoft Corporation>
[TPInput / TPInput][Running/Manual Start]
<System32\DRIVERS\TPInput.sys><IBM Corporation>
[NSC Integrated Trusted Platform Module 1.1 / TPM11][Running/Manual Start]
<system32\DRIVERS\nsctpm11.sys><National Semiconductor Corp.>
[TPPWRIF / TPPWRIF][Running/System Start]
<System32\drivers\Tppwrif.sys><N/A>
[TSMAPIP / TSMAPIP][Running/System Start]
<System32\drivers\TSMAPIP.SYS><N/A>
[ultra / ultra][Stopped/Disabled]
<\SystemRoot\system32\DRIVERS\ultra.sys><Promise Technology, Inc.>
[ViaIde / ViaIde][Stopped/Disabled]
<\SystemRoot\system32\DRIVERS\viaide.sys><Microsoft Corporation>
[VMware Virtual Ethernet Adapter Driver / VMnetAdapter][Running/Manual Start]
<system32\DRIVERS\vmnetadapter.sys><VMware, Inc.>
[VMware Bridge Protocol / VMnetBridge][Running/Auto Start]
<system32\DRIVERS\vmnetbridge.sys><VMware, Inc.>
[VMware Network Application Interface / VMnetuserif][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\vmnetuserif.sys><VMware, Inc.>
[VMware VMparport / VMparport][Running/Auto Start]
<\??\C:\WINDOWS\system32\Drivers\VMparport.sys><VMware, Inc.>
[VMware vmx86 / vmx86][Running/Auto Start]
<\??\C:\WINDOWS\system32\Drivers\vmx86.sys><VMware, Inc.>
[Vstor2 Virtual Storage Driver / vstor2][Running/Auto Start]
<\??\C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vstor2.sys><VMware, Inc.>
[Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows XP / w29n51][Stopped/Manual Start]
<system32\DRIVERS\w29n51.sys><Intel? Corporation>
[winachsf / winachsf][Stopped/Manual Start]
<system32\DRIVERS\HSF_CNXT.sys><Conexant Systems, Inc.>
[WINIO / WINIO][Stopped/Manual Start]
<\??\E:\IBM T43\tpfancontrol_v018b\winio.sys><N/A>
[yaskp / yaskp][Running/Boot Start]
<\SystemRoot\system32\drivers\yaskp.sys><Copyright (C) yahoo Corporation.>

smartzzm - 2007-1-29 1:33:00

==================================
Browser Add-ons
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[Yahoo!Photo]
{33BBE430-0E42-4f12-B075-8D21ACB10DCB} <C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yphtb.dll, Yahoo! China>
[AntiFish Class]
{38928D50-8A48-44C2-945F-D2F23F771410} <C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yangling.dll, yahoo! china>
[DriveLetterAccess]
{5CA3D70E-1895-11CF-8E15-001234567890} <C:\WINDOWS\System32\DLA\DLASHX_W.DLL, Sonic Solutions>
[DragSearch BHO]
{62EED7C6-9F02-42f9-B634-98E2899E147B} <C:\PROGRA~1\Yahoo!\ASSIST~1\assist\YDRAGS~1.DLL, yahoo! china>
[WinSC Class]
{9ACEEE31-1440-471B-AA46-72B061FE7D61} <C:\WINDOWS\system32\SCIntruder32.dll, N/A>
[AcroIEToolbarHelper Class]
{AE7CD045-E861-484f-8273-0445EE161910} <C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll, Adobe Systems Incorporated>
[Shockwave Flash Object]
{B88DBC3F-41FB-40AE-AFB0-4220E842B710} <C:\WINDOWS\system32\flash9.dll, Adobe System Incorporated>
[assist]
{FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8} <C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yassist.dll, Yahoo! China>
[Web Browser Applet Control]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\WINDOWS\system32\msjava.dll, Microsoft Corporation>
[雅虎助手]
{5D73EE86-05F1-49ed-B850-E423120EC338} <http://cn.zs.yahoo.com/start.htm?source=yzs_icon&btn=yassistnew, N/A>
[&Research]
{92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <E:\Program Files\Tencent\qq\QQ.EXE, TENCENT>
[Software Installer]
{D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} <C:\Program Files\Lenovo\PkgMgr\\PkgMgr.exe, Lenovo Group Limited>
[易趣购物]
{DE607144-AC19-424e-866A-6D70ABDF119A} <http://click2.ad4all.net/url2/urlmanage/url.asp?id=5, N/A>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <E:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[Adobe PDF]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} <C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll, Adobe Systems Incorporated>
[雅虎助手]
{406F94F0-504F-4A40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\Assistant\Assist\yasbar.dll, yahoo! china>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[Java Plug-in 1.4.2]
{8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\IBM\Java142\jre\bin\NPJPI142.dll, IBM.>
[Java Plug-in 1.4.2]
{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} <C:\Program Files\IBM\Java142\jre\bin\NPJPI142.dll, IBM.>
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[Web Browser Applet Control]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\WINDOWS\system32\msjava.dll, Microsoft Corporation>
[Windows Genuine Advantage Validation Tool]
{17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\legitcheckcontrol.dll, Microsoft Corporation>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[XML DOM Document]
{2933BF90-7B36-11D2-B20E-00C04F983E60} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[Yahoo!Photo]
{33BBE430-0E42-4F12-B075-8D21ACB10DCB} <C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yphtb.dll, Yahoo! China>
[AntiFish Class]
{38928D50-8A48-44C2-945F-D2F23F771410} <C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yangling.dll, yahoo! china>
[雅虎助手]
{406F94F0-504F-4A40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\Assistant\Assist\yasbar.dll, yahoo! china>
[Adobe PDF]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} <C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll, Adobe Systems Incorporated>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <E:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <C:\WINDOWS\system32\ieframe.dll, Microsoft Corporation>
[Yahoo!Live]
{57421194-58FB-49AE-9B4F-FD48869B9AD4} <C:\PROGRA~1\Yahoo!\ASSIST~1\YAlive.dll, yahoo! china>
[DriveLetterAccess]
{5CA3D70E-1895-11CF-8E15-001234567890} <C:\WINDOWS\System32\DLA\DLASHX_W.DLL, Sonic Solutions>
[DragSearch BHO]
{62EED7C6-9F02-42F9-B634-98E2899E147B} <C:\PROGRA~1\Yahoo!\ASSIST~1\assist\YDRAGS~1.DLL, yahoo! china>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[Microsoft Shell UI Helper]
{64AB4BB7-111E-11D1-8F79-00C04FC2FBE1} <C:\WINDOWS\system32\ieframe.dll, Microsoft Corporation>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[SmartXCla Control]
{85705C25-3B30-11D5-BA02-00609718CFFE} <, N/A>
[Microsoft Web Browser]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\ieframe.dll, Microsoft Corporation>
[XML DOM Document 4.0]
{88D969C0-F192-11D4-A65F-0040963251E5} <C:\WINDOWS\system32\msxml4.dll, Microsoft Corporation>
[WinSC Class]
{9ACEEE31-1440-471B-AA46-72B061FE7D61} <C:\WINDOWS\system32\SCIntruder32.dll, N/A>
[AcroIEToolbarHelper Class]
{AE7CD045-E861-484F-8273-0445EE161910} <C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll, Adobe Systems Incorporated>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Shockwave Flash Object]
{B88DBC3F-41FB-40AE-AFB0-4220E842B710} <C:\WINDOWS\system32\flash9.dll, Adobe System Incorporated>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\system\msadc\msadco.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
{CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[XML HTTP Request]
{ED8C108E-4349-11D2-91A4-00C04F7969E8} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[XML DOM Document]
{F6D90F11-9C73-11D3-B32E-00C04F990BB4} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[XML HTTP]
{F6D90F16-9C73-11D3-B32E-00C04F990BB4} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[assist]
{FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8} <C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yassist.dll, Yahoo! China>
[Convert link target to Adobe PDF]
<res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html, N/A>
[Convert link target to existing PDF]
<res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html, N/A>
[Convert selected links to Adobe PDF]
<res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html, N/A>
[Convert selected links to existing PDF]
<res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html, N/A>
[Convert selection to Adobe PDF]
<res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html, N/A>
[Convert selection to existing PDF]
<res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html, N/A>
[Convert to Adobe PDF]
<res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html, N/A>
[Convert to existing PDF]
<res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html, N/A>
[E&xport to Microsoft Excel]
<res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000, N/A>
[上传到QQ网络硬盘]
<E:\Program Files\Tencent\qq\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
<E:\Program Files\Tencent\qq\AddPanel.htm, N/A>
[添加到QQ表情]
<E:\Program Files\Tencent\qq\AddEmotion.htm, N/A>
[添加到雅虎订阅(&Y)]
<res://C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yrss.dll/YRSSMENUEXT, N/A>
[用QQ彩信发送该图片]
<E:\Program Files\Tencent\qq\SendMMS.htm, N/A>
[百度-搜索MP3]
<res://C:\WINDOWS\DOWNLO~1\BaiduBar.dll/BAIDUMP3.HTM, N/A>
[百度-搜索图片]
<res://C:\WINDOWS\DOWNLO~1\BaiduBar.dll/BAIDUIMG.HTM, N/A>
[百度-搜索新闻]
<res://C:\WINDOWS\DOWNLO~1\BaiduBar.dll/BAIDUNEWS.HTM, N/A>
[百度-搜索歌词]
<res://C:\WINDOWS\DOWNLO~1\BaiduBar.dll/BAIDULYRIC.HTM, N/A>
[百度-搜索网页]
<res://C:\WINDOWS\DOWNLO~1\BaiduBar.dll/BAIDUSEARCH.HTM, N/A>
[百度-搜索贴吧]
<res://C:\WINDOWS\DOWNLO~1\BaiduBar.dll/BAIDUPOST.HTM, N/A>
[雅虎搜索]
<res://C:\PROGRA~1\Yahoo!\Assistant\Assist\yasbar.dll/203, N/A>

满天飞雪 - 2007-1-29 1:34:00

先清理掉yahoo的东西，再杀木马吧。

smartzzm - 2007-1-29 1:35:00

Running Processes
[PID: 824][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 912][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 944][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\vrlogon.dll] [UPEK Inc., 4.5.5.1108]
[C:\Program Files\IBM fingerprint software\ExtVapi.dll] [UPEK Inc., 4.5.5.1108]
[C:\Program Files\Common Files\Virtual Token\psutil.dll] [UPEK Inc., 4.5.5.1108]
[C:\Program Files\Common Files\Virtual Token\resmgr.dll] [UPEK Inc., 4.5.5.1108]
[C:\Program Files\Common Files\Virtual Token\Remote.dll] [UPEK Inc., 4.5.5.1108]
[C:\Program Files\Common Files\Virtual Token\passport.dll] [UPEK Inc., 4.5.5.1108]
[C:\Program Files\Common Files\Virtual Token\psdlg.dll] [UPEK Inc., 4.5.5.1108]
[C:\WINDOWS\system32\Ati2evxx.dll] [ATI Technologies Inc., 6.14.10.4115]
[C:\Program Files\IBM fingerprint software\psfus.dll] [UPEK Inc., 4.5.5.1108]
[C:\WINDOWS\system32\tphklock.dll] [N/A, N/A]
[C:\WINDOWS\system32\NavLogon.dll] [Symantec Corporation, 10.1.4.4000]
[c:\program files\intel\wireless\bin\rypvfdck.dll] [, 1, 0, 0, 11]
[C:\Program Files\Common Files\Virtual Token\BGTcVer.dll] [UPEK Inc., 4.5.5.1108]
[C:\Program Files\Common Files\Virtual Token\BTcVer.dll] [UPEK Inc., 4.5.5.1108]
[PID: 992][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1004][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\pwdmon.dll] [N/A, N/A]
[PID: 1196][C:\Program Files\Common Files\Virtual Token\vtserver.exe] [UPEK Inc., 4.5.5.1108]
[C:\Program Files\Common Files\Virtual Token\psutil.dll] [UPEK Inc., 4.5.5.1108]
[C:\Program Files\IBM fingerprint software\psfus.dll] [UPEK Inc., 4.5.5.1108]
[C:\Program Files\Common Files\Virtual Token\passport.dll] [UPEK Inc., 4.5.5.1108]
[C:\Program Files\Common Files\Virtual Token\DevTc.dll] [UPEK Inc., 4.5.5.1108]
[C:\Program Files\Common Files\Virtual Token\BTcVer.dll] [UPEK Inc., 4.5.5.1108]
[C:\Program Files\Common Files\Virtual Token\Remote.dll] [UPEK Inc., 4.5.5.1108]
[C:\Program Files\Common Files\Virtual Token\LocPass.dll] [UPEK Inc., 4.5.5.1108]
[C:\Program Files\Common Files\Virtual Token\AlgVer.dll] [UPEK Inc., 4.5.5.1108]
[C:\Program Files\Common Files\Virtual Token\resmgr.dll] [UPEK Inc., 4.5.5.1108]
[PID: 1228][C:\WINDOWS\system32\ibmpmsvc.exe] [N/A, N/A]
[PID: 1276][C:\WINDOWS\system32\Ati2evxx.exe] [ATI Technologies Inc., 6.14.10.4115]
[C:\WINDOWS\system32\Ati2edxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2497]
[PID: 1300][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1364][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2012][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[E:\oracle\ora90\bin\oci.dll] [Oracle Corporation, 9.2.0.1.0]
[PID: 376][C:\Program Files\Intel\Wireless\Bin\EvtEng.exe] [Intel Corporation, 9, 0, 1, 83]
[C:\Program Files\Intel\Wireless\Bin\PsRegApi.dll] [Intel Corporation, 9, 0, 1, 83]
[C:\Program Files\Intel\Wireless\Bin\TraceAPI.DLL] [Intel Corporation, 9, 0, 1, 83]
[PID: 412][C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe] [Intel Corporation , 9, 0, 1, 83]
[C:\Program Files\Intel\Wireless\Bin\TraceAPI.DLL] [Intel Corporation, 9, 0, 1, 83]
[C:\Program Files\Intel\Wireless\Bin\PsRegApi.dll] [Intel Corporation, 9, 0, 1, 83]
[PID: 480][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 736][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1464][C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\ccL40.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] [Symantec Corporation, 104.0.8.3]
[PID: 1536][C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\ccL40.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\ccSet.dll] [Symantec Corporation, 104.0.8.3]
[C:\PROGRA~1\COMMON~1\SYMANT~1\SPBBC\SPBBCEVT.DLL] [Symantec Corporation, 2.2.0.7]
[C:\PROGRA~1\COMMON~1\SYMANT~1\CCSETEVT.DLL] [Symantec Corporation, 104.0.8.3]
[PID: 1492][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\WINDOWS\system32\AdobePDF.dll] [Adobe Systems Incorporated., 7.0.0.00]
[C:\Program Files\Adobe\Acrobat 7.0\Distillr\adistres.dll] [Adobe Systems Incorporated., 7.0.0.2004121400]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\SDNT5UI.DLL] [Zenographics, Inc., 5.60.709.0]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\SDDM32.DLL] [Zenographics, Inc., 5, 60, 1511, 0]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\ZSPOOL.dll] [Zenographics, Inc., 5, 51, 709, 0]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\ZGDI32.dll] [Zenographics, Inc., 5, 60, 709, 0]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\ZTAG32.dll] [Zenographics, Inc., 5, 60, 1210, 0]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\SDDMUI.DLL] [Zenographics, Inc., 5, 60, 1520, 0]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\SR32.dll] [Zenographics, Inc., 5, 60, 1407, 0]
[PID: 1776][C:\Program Files\Symantec AntiVirus\DefWatch.exe] [Symantec Corporation, 10.1.4.4000]
[C:\Program Files\Common Files\Symantec Shared\ccL40.dll] [Symantec Corporation, 104.0.8.3]
[PID: 1808][C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe] [, 4,1,0,4074]
[PID: 1848][C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE] [Microsoft Corporation, 7.00.9466]
[PID: 1868][E:\oracle\ora90\bin\omtsreco.exe] [Oracle Corporation, 9.2.0.1.0]
[E:\oracle\ora90\bin\OCI.dll] [Oracle Corporation, 9.2.0.1.0]
[E:\oracle\ora90\bin\OraClient9.Dll] [Oracle Corporation, 9.2.0.1.0 Production ]
[E:\oracle\ora90\bin\oracore9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[E:\oracle\ora90\bin\oranls9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[E:\oracle\ora90\bin\oraunls9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[E:\oracle\ora90\bin\oravsn9.dll] [Oracle Corporation, 9.2.0.1.0 Production ]
[E:\oracle\ora90\bin\oracommon9.dll] [Oracle Corporation, 9.2.0.1.0 Production ]
[E:\oracle\ora90\bin\orageneric9.dll] [Oracle Corporation, 9.2.0.1.0 Production ]
[E:\oracle\ora90\bin\oraxml9.dll] [Oracle Corporation, ]
[E:\oracle\ora90\bin\oraxsd9.dll] [Oracle Corporation, ]
[E:\oracle\ora90\bin\orannzsbb9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[E:\oracle\ora90\bin\oran9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[E:\oracle\ora90\bin\oranl9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[E:\oracle\ora90\bin\oranldap9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[E:\oracle\ora90\bin\oraldapclnt9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[E:\oracle\ora90\bin\orancrypt9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[E:\oracle\ora90\bin\ORATRACE9.dll] [N/A, N/A]
[E:\oracle\ora90\bin\oranro9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[E:\oracle\ora90\bin\oranhost9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[E:\oracle\ora90\bin\oranoname9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[E:\oracle\ora90\bin\orancds9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[E:\oracle\ora90\bin\orantns9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[E:\oracle\ora90\bin\oranms.dll] [Oracle Corporation, 9.2.0.0.0]
[E:\oracle\ora90\bin\oranmsp.dll] [Oracle Corporation, 9.2.0.0.0]
[E:\oracle\ora90\bin\orapls9.dll] [Oracle Corporation, 9.2.0.1.0 Production ]
[E:\oracle\ora90\bin\oraslax9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[E:\oracle\ora90\bin\orasnls9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[E:\oracle\ora90\bin\orawtc9.dll] [Oracle Corporation, 9.2.0.1.0 Production ]
[E:\oracle\ora90\bin\orasql9.dll] [Oracle Corporation, 9.2.0.1.0 Production]
[E:\oracle\ora90\bin\omtsrecomsgZHS.dll] [Oracle Corporation, 9.0.0.0.0]
[E:\oracle\ora90\bin\omtsrecomsgus.dll] [Oracle Corporation, 9.2.0.0.1]
[PID: 204][C:\WINDOWS\System32\QCONSVC.EXE] [IBM Corp., 3, 7, 1, 0]
[PID: 2044][C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe] [Intel Corporation, 9, 0, 1, 83]
[PID: 340][C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe] [Analog Devices, Inc., 3, 2, 6, 0]

smartzzm - 2007-1-29 1:36:00

[PID: 876][C:\Program Files\Symantec AntiVirus\Rtvscan.exe] [Symantec Corporation, 10.1.4.4000]
[C:\WINDOWS\system32\CBA.DLL] [LANDesk Software Ltd., 6.12.0.142 E]
[C:\WINDOWS\system32\MsgSys.dll] [LANDesk Software Ltd., 6.12.0.142 E]
[C:\WINDOWS\system32\NTS.dll] [LANDesk Software Ltd., 6.12.0.142 E]
[C:\WINDOWS\system32\PDS.DLL] [LANDesk Software Ltd., 6.12.0.142 E]
[C:\Program Files\Symantec AntiVirus\NAVLU.dll] [Symantec Corporation, 10.1.4.4000]
[C:\Program Files\Symantec AntiVirus\I2ldvp3.dll] [Symantec Corporation, 10.1.4.4000]
[C:\Program Files\Common Files\Symantec Shared\ccL40.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Symantec AntiVirus\NAVNTUTL.DLL] [Symantec Corporation, 10.1.4.4000]
[c:\program files\common files\symantec shared\ssc\ScsComms.dll] [Symantec Corporation, 10.1.4.4000]
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\ccDec.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\decsdk.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2ID.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2Zip.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2SS.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2GZIP.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2CAB.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2LHA.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2ARJ.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2TNEF.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2LZ.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2AMG.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2RAR.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2TAR.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2RTF.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2Text.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\ccScan.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\ecmldr32.DLL] [Symantec Corporation, 51.3.0.11]
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20070122.041\ccEraser.dll] [Symantec Corporation, 106.3.3.2]
[C:\Program Files\Symantec AntiVirus\DefUtDCD.dll] [Symantec Corporation, 3.1.13a.0]
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20070122.041\ecmsvr32.dll] [Symantec Corporation, 71.1.0.11]
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20070122.041\NAVEX32a.DLL] [Symantec Corporation, 20071.1.0.15]
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20070122.041\NAVENG32.DLL] [Symantec Corporation, 20071.1.0.15]
[C:\Program Files\Symantec AntiVirus\SAVRT32.DLL] [Symantec Corporation, 9.7.1.4]
[C:\Program Files\Symantec AntiVirus\IMail.dll] [Symantec Corporation, 10.1.4.4000]
[C:\Program Files\Symantec AntiVirus\NotesExt.dll] [Symantec Corporation, 10.1.4.4000]
[C:\Program Files\Symantec AntiVirus\vpmsece4.dll] [Symantec Corporation, 10.1.4.4000]
[C:\Program Files\Symantec AntiVirus\SymProtectStorage.dll] [Symantec Corporation, 10.1.4.4000]
[C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCEvt.dll] [Symantec Corporation, 2.2.0.7]
[C:\Program Files\Common Files\Symantec Shared\SSC\scandlgs.dll] [Symantec Corporation, 10.1.4.4000]
[C:\Program Files\Symantec AntiVirus\Cliscan.dll] [Symantec Corporation, 10.1.4.4000]
[PID: 564][C:\WINDOWS\System32\TPHDEXLG.EXE] [IBM Corporation, 1.0.0.1]
[PID: 804][C:\WINDOWS\system32\TpKmpSVC.exe] [N/A, N/A]
[PID: 904][C:\WINDOWS\system32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: DNSRV(bld4act)]
[PID: 1684][C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe] [VMware, Inc., 5.5.2 build-29772]
[C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmxScsiLib.dll] [VMware, Inc., 5.5.2 build-29772]
[PID: 2812][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3668][C:\WINDOWS\system32\Ati2evxx.exe] [ATI Technologies Inc., 6.14.10.4115]
[C:\WINDOWS\system32\Ati2edxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2497]
[PID: 2508][C:\Program Files\Synaptics\SynTP\SynTPLpr.exe] [Synaptics, Inc., 7.5.17.13 08Nov04]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.17.13 08Nov04]
[PID: 3124][C:\Program Files\Synaptics\SynTP\SynTPEnh.exe] [Synaptics, Inc., 7.5.17.13 08Nov04]
[C:\WINDOWS\system32\SynCOM.dll] [Synaptics, Inc., 7.5.17.13 08Nov04]
[C:\WINDOWS\system32\SynTPAPI.dll] [Synaptics, Inc., 7.5.17.13 08Nov04]
[c:\program files\intel\wireless\bin\rypvfdck.dll] [, 1, 0, 0, 11]
[C:\PROGRA~1\Yahoo!\Assistant\yClickOn.dll] [YAHOO Corporation Limited, 3, 0, 3, 1004]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.17.13 08Nov04]
[C:\Documents and Settings\zzm\Application Data\Microsoft\Word\STARTUP\EN9CWYW.WordXP.wll] [Thomson ResearchSoft, 9.0.0 (Bld 1425)]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 5, 1023]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ykern.dll] [Yahoo! China, 3, 1, 9, 1025]
[PID: 3172][C:\WINDOWS\system32\TpShocks.exe] [IBM Corp., 1, 3, 2, 0]
[C:\Program Files\ThinkPad\TpShocks\MUI\0409\TpShocks.dll] [IBM Corp., 1, 3, 2, 0]
[C:\WINDOWS\system32\Sensor.dll] [IBM Corporation, 1.30.1.0]
[PID: 3180][C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe] [N/A, N/A]
[C:\Program Files\ThinkPad\PkgMgr\HOTKEY_2\tphk_2k.dll] [N/A, N/A]
[C:\WINDOWS\system32\Oemdspif.dll] [ATI Technologies, Inc., 6.14.0012]
[C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\tpfnf7.dll] [N/A, N/A]
[PID: 3188][C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe] [N/A, N/A]
[PID: 3200][C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe] [IBM Corporation, 1.14]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.17.13 08Nov04]
[PID: 3276][C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe] [Analog Devices, Inc., 5, 0, 2, 2]
[C:\Program Files\Analog Devices\SoundMAX\SMWDMIF.dll] [Analog Devices, Inc., 5, 0, 2, 008]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.17.13 08Nov04]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 5, 1023]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ykern.dll] [Yahoo! China, 3, 1, 9, 1025]
[PID: 3312][C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe] [InstallShield Software Corporation, 3, 10, 100, 1155]
[PID: 3320][C:\IBMTOOLS\UTILS\ibmprc.exe] [IBM Corp., 1, 0, 0, 3]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.17.13 08Nov04]
[PID: 3332][C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE] [IBM Corp., 3, 7, 1, 0]
[C:\Program Files\ThinkPad\ConnectUtilities\QCON.dll] [IBM Corp., 3, 7, 1, 0]
[C:\Program Files\ThinkPad\ConnectUtilities\MerlinC201.dll] [Novatel Wireless Inc., 1, 0, 0, 1]

smartzzm - 2007-1-29 1:37:00

[C:\Program Files\ThinkPad\ConnectUtilities\Res\SC\TrayRes.dll] [N/A, N/A]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.17.13 08Nov04]
[C:\Program Files\ThinkPad\ConnectUtilities\ANCA.dll] [IBM Corp., 8.3]
[C:\Program Files\ThinkPad\ConnectUtilities\ANC.dll] [IBM Corp., 8.3]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 5, 1023]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ykern.dll] [Yahoo! China, 3, 1, 9, 1025]
[PID: 3352][C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE] [IBM Corp., 3, 7, 1, 0]
[C:\Program Files\ThinkPad\ConnectUtilities\QCON.dll] [IBM Corp., 3, 7, 1, 0]
[C:\Program Files\ThinkPad\ConnectUtilities\MerlinC201.dll] [Novatel Wireless Inc., 1, 0, 0, 1]
[C:\Program Files\ThinkPad\ConnectUtilities\Res\SC\IconRes.dll] [N/A, N/A]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.17.13 08Nov04]
[PID: 3360][C:\WINDOWS\system32\rundll32.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL] [IBM Corp., 1, 0, 0, 0]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.17.13 08Nov04]
[C:\PROGRA~1\ThinkPad\UTILIT~1\US\PWRMGRRT.DLL] [N/A, N/A]
[C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRIF.DLL] [N/A, N/A]
[C:\WINDOWS\system32\Sensor.dll] [IBM Corporation, 1.30.1.0]
[C:\WINDOWS\system32\OEMDSPIF.DLL] [ATI Technologies, Inc., 6.14.0012]
[PID: 3976][C:\Program Files\DAEMON Tools\daemon.exe] [DT Soft Ltd., 4.03.0.0]
[C:\Program Files\DAEMON Tools\daemon.dll] [DT Soft Ltd., 4.03.0.0]
[C:\Program Files\DAEMON Tools\PFCTOC.DLL] [Padus(R), Inc., 1, 0, 0, 12]
[C:\Program Files\DAEMON Tools\Plugins\Images\bw5mount.dll] [N/A, 1.0.6.0]
[C:\Program Files\DAEMON Tools\Plugins\Images\ccdmount.dll] [GENERIC, 1.10.0.0]
[C:\Program Files\DAEMON Tools\Plugins\Images\mdsmount.dll] [GENERIC, 1.12.0.0]
[C:\Program Files\DAEMON Tools\Plugins\Images\nrgmount.dll] [GENERIC, 1.11.0.0]
[C:\Program Files\DAEMON Tools\Plugins\Images\pdimount.dll] [GENERIC, 1.01.0.0]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.17.13 08Nov04]
[PID: 2172][C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe] [Adobe Systems Inc., 6.0.1.2004121400]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.17.13 08Nov04]
[PID: 3928][C:\Program Files\Common Files\Symantec Shared\ccApp.exe] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\ccL40.dll] [Symantec Corporation, 104.0.8.3]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.17.13 08Nov04]
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] [Symantec Corporation, 104.0.8.3]
[C:\PROGRA~1\COMMON~1\SYMANT~1\CCALERT.DLL] [Symantec Corporation, 104.0.8.3]
[C:\PROGRA~1\COMMON~1\SYMANT~1\CCEMLPXY.DLL] [Symantec Corporation, 104.0.8.3]
[C:\PROGRA~1\COMMON~1\SYMANT~1\rcEmlPxy.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\ccSet.dll] [Symantec Corporation, 104.0.8.3]
[C:\WINDOWS\system32\SYMREDIR.DLL] [Symantec Corporation, 6.0.2.211]
[C:\Program Files\Common Files\Symantec Shared\ccSetEvt.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\ccProSub.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Symantec AntiVirus\SavEmail.dll] [Symantec Corporation, 10.1.4.4000]
[PID: 2340][C:\PROGRA~1\SYMANT~1\VPTray.exe] [Symantec Corporation, 10.1.4.4000]
[C:\Program Files\Common Files\Symantec Shared\ccL40.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Symantec AntiVirus\SAVRT32.DLL] [Symantec Corporation, 9.7.1.4]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.17.13 08Nov04]
[C:\Program Files\Common Files\Symantec Shared\ccSetEvt.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\ccProSub.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\ccAlert.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Symantec AntiVirus\Cliproxy.dll] [Symantec Corporation, 10.1.4.4000]
[C:\Program Files\Symantec AntiVirus\NAVNTUTL.DLL] [Symantec Corporation, 10.1.4.4000]
[C:\Program Files\Common Files\Symantec Shared\ccSet.dll] [Symantec Corporation, 104.0.8.3]
[c:\program files\common files\symantec shared\ssc\ScsComms.dll] [Symantec Corporation, 10.1.4.4000]
[C:\WINDOWS\system32\nts.dll] [LANDesk Software Ltd., 6.12.0.142 E]
[C:\WINDOWS\system32\cba.dll] [LANDesk Software Ltd., 6.12.0.142 E]
[C:\WINDOWS\system32\MsgSys.dll] [LANDesk Software Ltd., 6.12.0.142 E]
[C:\WINDOWS\system32\PDS.DLL] [LANDesk Software Ltd., 6.12.0.142 E]
[PID: 712][C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe] [Yahoo! China, 3, 1, 9, 1025]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ykern.dll] [Yahoo! China, 3, 1, 9, 1025]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 5, 1023]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.17.13 08Nov04]
[C:\PROGRA~1\Yahoo!\ASSIST~1\YAlive.dll] [yahoo! china, 3, 6, 0, 1112]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll] [Yahoo! China, 3, 0, 2, 1011]
[C:\PROGRA~1\Yahoo!\ASSIST~1\ynotifier.dll] [yahoo! china, 3, 0, 2, 1002]
[PID: 2408][C:\Program Files\Messenger\msmsgs.exe] [Microsoft Corporation, 4.7.3001]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.17.13 08Nov04]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ykern.dll] [Yahoo! China, 3, 1, 9, 1025]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 5, 1023]
[PID: 2416][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.17.13 08Nov04]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 5, 1023]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ykern.dll] [Yahoo! China, 3, 1, 9, 1025]
[PID: 1140][C:\WINDOWS\system32\taskmgr.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 5, 1023]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ykern.dll] [Yahoo! China, 3, 1, 9, 1025]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.17.13 08Nov04]
[C:\Documents and Settings\zzm\Application Data\Microsoft\Word\STARTUP\EN9CWYW.WordXP.wll] [Thomson ResearchSoft, 9.0.0 (Bld 1425)]
[PID: 3888][C:\Documents and Settings\zzm\Desktop\TUNet_Version_2_03_00.exe] [, 2.03.00]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 5, 1023]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ykern.dll] [Yahoo! China, 3, 1, 9, 1025]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.17.13 08Nov04]
[PID: 3764][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3452][C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE] [Microsoft Corporation, 11.0.5604]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 5, 1023]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ykern.dll] [Yahoo! China, 3, 1, 9, 1025]

smartzzm - 2007-1-29 1:38:00

[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.17.13 08Nov04]
[C:\Program Files\Adobe\Acrobat 7.0\PDFMaker\Office\PDFMOfficeAddin.dll] [Adobe Systems Incorporated, 7, 0, 0, 0]
[C:\Program Files\Microsoft Office\OFFICE11\STARTUP\MathPage.wll] [N/A, N/A]
[C:\Documents and Settings\zzm\Application Data\Microsoft\Word\STARTUP\EN9CWYW.WordXP.wll] [Thomson ResearchSoft, 9.0.0 (Bld 1425)]
[C:\Program Files\Adobe\Acrobat 7.0\Distillr\adist32.dll] [Adobe Systems Incorporated., 7.0.0.0]
[C:\WINDOWS\system32\SOGOUPY.IME] [Sohu.com Inc., 1, 0, 2, 2]
[PID: 348][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 5, 1023]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ykern.dll] [Yahoo! China, 3, 1, 9, 1025]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.17.13 08Nov04]
[PID: 2360][C:\WINDOWS\Explorer.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 5, 1023]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ykern.dll] [Yahoo! China, 3, 1, 9, 1025]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.17.13 08Nov04]
[C:\Documents and Settings\zzm\Application Data\Microsoft\Word\STARTUP\EN9CWYW.WordXP.wll] [Thomson ResearchSoft, 9.0.0 (Bld 1425)]
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 7.0.0.0]
[c:\program files\intel\wireless\bin\rypvfdck.dll] [, 1, 0, 0, 11]
[C:\PROGRA~1\Yahoo!\ASSIST~1\YAlive.dll] [yahoo! china, 3, 6, 0, 1112]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll] [Yahoo! China, 3, 0, 2, 1011]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasnoad.dll] [yahoo! china, 3, 0, 3, 1005]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yzsNetProto.dll] [Yahoo! China, 3, 0, 2, 1003]
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 7.0.0.2004121400]
[C:\WINDOWS\system32\SOGOUPY.IME] [Sohu.com Inc., 1, 0, 2, 2]
[C:\Program Files\Adobe\Acrobat 7.0\Acrobat Elements\ContextMenu.dll] [Adobe Systems Inc., 7.0.0.2004121400\0]
[C:\Program Files\Adobe\Acrobat 7.0\Distillr\ADIST32.dll] [Adobe Systems Incorporated., 7.0.0.0]
[C:\PROGRA~1\yahoo!\assistant\Shell\yAssecblk.dll] [Yahoo! China, 3, 1, 6, 1022]
[c:\progra~1\yahoo!\assist~1\assist\yadfil~1.dll] [Yahoo! China, 3, 0, 2, 1003]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yrepair.dll] [Yahoo! China, 3, 0, 9, 1012]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasfsks.dll] [Yahoo! China, 2, 1, 3, 89]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yoptimum.dll] [Yahoo! China, 3, 0, 2, 1006]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yxpstyle.dll] [Yahoo! China, 3, 0, 1, 1001]
[C:\PROGRA~1\Yahoo!\Assistant\yClickOn.dll] [YAHOO Corporation Limited, 3, 0, 3, 1004]
[C:\Program Files\木马分析专家\hyMenu.dll] [水晶情缘工作室, 2005.00]
[C:\Program Files\WinRAR\rarext.dll] [N/A, N/A]
[C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll] [Symantec Corporation, 10.1.4.4000]
[C:\PROGRA~1\Yahoo!\Assistant\Assist\yasbar.dll] [yahoo! china, 3, 3, 2, 1093]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\ysearch.dll] [Yahoo! China, 3, 1, 6, 1016]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yphtb.dll] [Yahoo! China, 3, 0, 6, 1008]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yaswiper.dll] [Yahoo! China, 3, 0, 5, 1005]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasiesec.dll] [Yahoo! China, 3, 0, 5, 1005]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\YSETTI~1.DLL] [yahoo! china, 3, 1, 1, 1022]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ymailp.dll] [Yahoo! China, 3, 0, 4, 1010]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ymyweb.dll] [Yahoo! China, 3, 0, 2, 1004]
[C:\WINDOWS\System32\DLA\DLASHX_W.DLL] [Sonic Solutions, 5.20.09a]
[C:\WINDOWS\system32\DLAAPI_W.DLL] [Sonic Solutions, 5.20.09a]
[C:\WINDOWS\System32\DLA\DLACResW.dll] [Sonic Solutions, 5.20.09a]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\YDRAGS~1.DLL] [yahoo! china, 3, 0, 3, 1003]
[C:\WINDOWS\system32\SCIntruder32.dll] [N/A, N/A]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yassist.dll] [Yahoo! China, 3, 1, 4, 1019]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ywiper.dll] [Yahoo! China, 3, 0, 2, 1002]
[C:\Program Files\IDM Computer Solutions\UltraEdit-32\ue32ctmn.dll] [, 1, 0, 0, 1]
[PID: 5584][C:\WINDOWS\system32\wuauclt.exe] [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 5, 1023]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ykern.dll] [Yahoo! China, 3, 1, 9, 1025]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.17.13 08Nov04]
[PID: 5908][E:\Program Files\Rainlendar\Rainlendar\Rainlendar-0.22\Rainlendar.exe] [Rainy, 0, 22, 0, 0]
[E:\Program Files\Rainlendar\Rainlendar\Rainlendar-0.22\Rainlendar.dll] [N/A, N/A]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 5, 1023]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ykern.dll] [Yahoo! China, 3, 1, 9, 1025]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.17.13 08Nov04]
[E:\Program Files\Rainlendar\Rainlendar\Rainlendar-0.22\Plugins\iCalPlugin.dll] [N/A, N/A]
[E:\Program Files\Rainlendar\Rainlendar\Rainlendar-0.22\Plugins\IniFormatPlugin.dll] [N/A, N/A]
[E:\Program Files\Rainlendar\Rainlendar\Rainlendar-0.22\Plugins\OutlookPlugin.dll] [N/A, N/A]
[E:\Program Files\Rainlendar\Rainlendar\Rainlendar-0.22\Plugins\ServerPlugin.dll] [N/A, N/A]
[C:\Documents and Settings\zzm\Application Data\Microsoft\Word\STARTUP\EN9CWYW.WordXP.wll] [Thomson ResearchSoft, 9.0.0 (Bld 1425)]
[PID: 4252][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 5, 1023]
[C:\PROGRA~1\Yahoo!\ASSIST~1\yscrblock.dll] [Yahoo! China, 3, 0, 2, 1003]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ykern.dll] [Yahoo! China, 3, 1, 9, 1025]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.17.13 08Nov04]
[C:\PROGRA~1\Yahoo!\ASSIST~1\YAlive.dll] [yahoo! china, 3, 6, 0, 1112]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll] [Yahoo! China, 3, 0, 2, 1011]
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 7.0.0.2004121400]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yphtb.dll] [Yahoo! China, 3, 0, 6, 1008]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yangling.dll] [yahoo! china, 3, 0, 5, 1007]
[C:\WINDOWS\System32\DLA\DLASHX_W.DLL] [Sonic Solutions, 5.20.09a]
[C:\WINDOWS\system32\DLAAPI_W.DLL] [Sonic Solutions, 5.20.09a]
[C:\WINDOWS\System32\DLA\DLACResW.dll] [Sonic Solutions, 5.20.09a]
[C:\Documents and Settings\zzm\Application Data\Microsoft\Word\STARTUP\EN9CWYW.WordXP.wll] [Thomson ResearchSoft, 9.0.0 (Bld 1425)]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\YDRAGS~1.DLL] [yahoo! china, 3, 0, 3, 1003]

smartzzm - 2007-1-29 1:38:00

[C:\WINDOWS\system32\SCIntruder32.dll] [N/A, N/A]
[C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll] [Adobe Systems Incorporated, 7.0.0.0]
[C:\WINDOWS\system32\flash9.dll] [Adobe System Incorporated, 1, 0, 0, 1]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yassist.dll] [Yahoo! China, 3, 1, 4, 1019]
[C:\WINDOWS\system32\SOGOUPY.IME] [Sohu.com Inc., 1, 0, 2, 2]
[C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[PID: 3384][C:\WINDOWS\system32\cmd.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 6112][C:\Documents and Settings\zzm\Desktop\sreng2\SREng.EXE] [Smallfrogs Studio, 2.3.13.690]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 5, 1023]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ykern.dll] [Yahoo! China, 3, 1, 9, 1025]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.17.13 08Nov04]
[C:\Documents and Settings\zzm\Application Data\Microsoft\Word\STARTUP\EN9CWYW.WordXP.wll] [Thomson ResearchSoft, 9.0.0 (Bld 1425)]
[C:\Documents and Settings\zzm\Desktop\sreng2\Plugins\SRECXTMG.SRE] [Smallfrogs Studio, 1, 5, 0, 55]

==================================
File Associations
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock Provider
N/A

==================================
Autorun.Inf
N/A

==================================
HOSTS File
127.0.0.1 LOCALHOST

==================================
API HOOK
N/A

==================================

[/CODE]

smartzzm - 2007-1-29 1:40:00

【回复“满天飞雪”的帖子】
WHY?我是在网上搜了一下，借用yahoo地工具清理IE用的。

smartzzm - 2007-1-29 1:42:00

另外，我们的出口防火墙检测到我的机器有port scanning 和 addreee sweeping 攻击。截获得包中，端口和地址都是随机的。还有的源端口和目的端口全是0. 那位大牛帮帮忙，十分感谢！

满天飞雪 - 2007-1-29 1:45:00

你不知道yahoo的工具是流氓软件吗，自己在后台偷偷运行后门程序，下木马什么的。我已经实验过了，系统里什么都运行，安装过联众之后捆绑了YAHOO和Z娱乐，结果CPU占用在40%左右，后来我就把这俩东西给彻底清理了，不运行软件CPU占用在1%左右。

smartzzm - 2007-1-29 1:46:00

另外为杀毒，也曾经发现有一下病毒：
Backdoor.Ranky
Risk Level 1: Very Low

Discovered: August 26, 2003
Updated: February 10, 2006 02:48:53 PM ZW3
Also Known As: TrojanProxy.Win32.Ranck [Kaspersky], Proxy-FBSR [McAfee], BKDR_RANKK.A [Trend]
Type: Trojan Horse
Infection Length: Varies.
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

Backdoor.Ranky is a Trojan horse that opens a back door on the compromised computer and allows a remote attacker to perform unauthorized actions.

Note: Virus definitions dated prior to November 1, 2003 may detect this Trojan as Backdoor.Ranck.

ProtectionVirus Definitions (LiveUpdate™ Weekly) August 27, 2003
Virus Definitions (Intelligent Updater) August 27, 2003
Threat AssessmentWildWild Level: Low
Number of Infections: 0 - 49
Number of Sites: 0 - 2
Geographical Distribution: Low
Threat Containment: Easy
Removal: Easy
DamageDamage Level: Low
Payload: Opens a back door.
DistributionDistribution Level: Low
Ports: Random TCP port.

Writeup By: Scott Gettis

smartzzm - 2007-1-29 1:47:00

Adware.Borlan

Updated: July 13, 2006 02:37:17 PM PDT
Type: Adware
Risk Impact: Medium
File Names: stdup.dll
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows Server 2003, Windows XP

BehaviorAdware.Borlan acts as an Internet Explorer browser helper object which displays Chinese based advertisements while users browse the Internet.
SymptomsOne or more files detected as Adware.Borlan
TransmissionThis risk must be manually installed.
ProtectionVirus Definitions (LiveUpdate™ Weekly) November 23, 2005
Virus Definitions (Intelligent Updater) November 22, 2005

满天飞雪 - 2007-1-29 1:47:00

更正下，是系统里什么都不运行。我已经把联众也当流氓软件来看了。

smartzzm - 2007-1-29 1:47:00

W32.Pinfi
Risk Level 1: Very Low

Discovered: October 11, 2001
Updated: February 1, 2005 08:33:37 AM PST
Also Known As: Win32.Parite.a [KAV], W32/Pate.a [McAfee], Win32.Pinfi.A [CA], PE_PARITE.A [Trend], W32/Parite-A [Sophos], Win32/Parite.A [RAV]
Type: Virus
Infection Length: ~177,917 bytes
Systems Affected: Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me

W32.Pinfi is a memory-resident polymorphic virus that will infect the .EXE and .SCR files. This virus can also spread via mapped drives and network shares.

ProtectionVirus Definitions (LiveUpdate™ Weekly) October 17, 2001
Virus Definitions (Intelligent Updater) October 12, 2001
Threat AssessmentWildWild Level: Low
Number of Infections: More than 1000
Number of Sites: More than 10
Geographical Distribution: High
Threat Containment: Moderate
Removal: Moderate
DamageDamage Level: Low
DistributionDistribution Level: Medium
Shared Drives: Copies across mapped drives and network shares.

Writeup By: Douglas Knowles

smartzzm - 2007-1-29 9:55:00

【回复“满天飞雪”的帖子】

大牛们帮帮忙吧！！！！！！！！！！！！！！

smartzzm - 2007-1-29 17:34:00

HELP！！！！！！！！！！！！！

瑞星卡卡安全论坛