Trojan.DL.QQHelper.ee求助 bbs.ikaka.com

大大大菜鸟fff - 2007-2-20 10:38:00

[CODE]

2007-02-20,10:20:42

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background> [(Verified)Microsoft Corporation]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<HTpatch><C:\WINDOWS\htpatch.exe> [N/A]
<RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<RavStub><"C:\Program Files\Rising\Rav\ravstub.exe" /RUNONCE> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><userinit.exe,> [(Verified)Microsoft Corporation]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
<{D157330A-9EF3-49F8-9A67-4141AC41ADD4}><C:\WINDOWS\downlo~1\CnsHook.dll> [北京三七二一科技有限公司]

==================================
启动文件夹
[E_SPSU01]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\E_SPSU01.lnk --> C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SPSU01.EXE [SEIKO EPSON Corporation]><N>
[EPSON Online Register]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\EPSON Online Register.lnk --> C:\PROGRA~1\EPSON\ONLINE~1\ONLINE~1.EXE []><N>
[QQ游戏启动加速程序]
<C:\Documents and Settings\dfgd\「开始」菜单\程序\启动\QQ游戏启动加速程序.lnk --> E:\软件\QQGame\Accel.exe [深圳市腾讯计算机系统有限公司]><N>

==================================
服务
[EPSON Printer Status Agent2 / EPSONStatusAgent2][Running/Auto Start]
<C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe><SEIKO EPSON CORPORATION>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Imsvc / Imsvc][Running/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\Webmail.dll><>
[iPod Service / iPod Service][Running/Manual Start]
<"C:\Program Files\iPod\bin\iPodService.exe"><Apple Computer, Inc.>
[NVIDIA Driver Helper Service / NVSvc][Running/Auto Start]
<C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[Vsn odvh Service / odvh][Stopped/Auto Start]
<C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\COMMON~1\ujbn\yqiu.dll,Service><Microsoft Corporation>
[Rising Proxy Service / RfwProxySrv][Stopped/Manual Start]
<c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService][Stopped/Auto Start]
<C:\Program Files\Rising\Rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon][Running/Auto Start]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>

大大大菜鸟fff - 2007-2-20 10:39:00

驱动程序
[acpidisk / acpidisk][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\acpidisk.sys><N/A>
[Service for WDM 3D Audio Driver / ALCXSENS][Running/Manual Start]
<system32\drivers\ALCXSENS.SYS><Sensaura Ltd>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[bwciyblv / bwciyblv][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\bwciyblv.sys><N/A>
[CnsMinKP / CnsMinKP][Running/Boot Start]
<\SystemRoot\system32\drivers\CnsMinKP.sys><Copyright (C) 3721 Corporation.>
[d347bus / d347bus][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\d347bus.sys><>
[d347prt / d347prt][Running/Boot Start]
<\SystemRoot\System32\Drivers\d347prt.sys><>
[EagleNT / EagleNT][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\EagleNT.sys><N/A>
[ExpScaner / ExpScaner][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\ExpScan.sys><>
[GEARAspiWDM / GEARAspiWDM][Running/Manual Start]
<System32\Drivers\GEARAspiWDM.sys><GEAR Software Inc.>
[hijjbbej / hijjbbej][Stopped/System Start]
<\??\C:\WINDOWS\system32\drivers\hijjbbej.sys><中国互联网络信息中心(CNNIC)>
[HookCont / HookCont][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising>
[HookUrl / HookUrl][Running/Auto Start]
<\??\C:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[HSFHWBS2 / HSFHWBS2][Running/Manual Start]
<system32\DRIVERS\HSFHWBS2.sys><Conexant Systems>
[HSF_DP / HSF_DP][Running/Manual Start]
<system32\DRIVERS\HSF_DP.sys><Conexant Systems>
[kmsinput / kmsinput][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\kmsinput.sys><N/A>
[lgmiqf / lgmiqf][Running/Boot Start]
<\SystemRoot\\SystemRoot\System32\drivers\lgmiqf.sys><N/A>
[mdmxsdk / mdmxsdk][Running/Auto Start]
<system32\DRIVERS\mdmxsdk.sys><Conexant>
[MEMSCAN / MEMSCAN][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[mProcRs / mProcRs][Running/Auto Start]
<\??\c:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\E:\软件\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[nv / nv][Running/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
<\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[RsFwDrv / RsFwDrv][Running/Auto Start]
<\??\C:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[Realtek RTL8139/810X Family PCI Fast Ethernet NIC NT Driver / rtl8139][Running/Manual Start]
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[SiS AGP Filter / sisagp][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\SISAGPX.sys><Silicon Integrated Systems Corporation>
[SiSide / SiSide][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\siside.sys><Silicon Integrated Systems Corp.>
[sisidex / sisidex][Running/Boot Start]
<\SystemRoot\system32\drivers\sisidex.sys><Windows (R) 2000 DDK provider>
[Add Performance Filter Driver / sisperf][Running/Boot Start]
<\SystemRoot\system32\drivers\sisperf.sys><Silicon Integrated Systems Corp.>
[Samsung Mobile USB Device II 1.0 driver (WDM) / ssm_bus][Stopped/Manual Start]
<system32\DRIVERS\ssm_bus.sys><MCCI>
[Samsung Mobile USB Modem II 1.0 Filter / ssm_mdfl][Stopped/Manual Start]
<system32\DRIVERS\ssm_mdfl.sys><MCCI>
[Samsung Mobile USB Modem II 1.0 Drivers / ssm_mdm][Stopped/Manual Start]
<system32\DRIVERS\ssm_mdm.sys><MCCI>
[Conexant Setup API / UIUSys][Stopped/Manual Start]
<system32\drivers\UIUSys.sys><Conexant>
[winachsf / winachsf][Running/Manual Start]
<system32\DRIVERS\HSF_CNXT.sys><Conexant Systems>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
<system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[ZSMC USB PC Camera / ZSMC301b][Stopped/Manual Start]
<System32\Drivers\usbVM31b.sys><VM>
[R2A / R2A][Stopped/Disabled]
<\??\C:\WINDOWS\system32a2.sys><N/A>

大大大菜鸟fff - 2007-2-20 10:41:00

浏览器加载项
[WebThunder Browser Helper]
{00000AAA-A363-466E-BEF5-9BB68697AA7F} <E:\软件\迅雷\WebThunderBHO_015.dll, Thunder Networking Technologies,LTD>
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v14.dll, Thunder Networking Technologies,LTD>
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[lave]
{51A53836-086D-4412-A27F-951C3FDF9EA4} <C:\PROGRA~1\COMMON~1\ujbn\vnfr.dll, N/A>
[FkjJrfmd Class]
{59A9F4F6-A71A-72EB-6067-48590E58C736} <C:\WINDOWS\DOWNLO~1\edlkwjd.dll, jorcdsoft>
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <E:\软件\迅雷\ComDlls\XunLeiBHO_007.dll, Thunder Networking Technologies,LTD>
[CnsHook Class]
{D157330A-9EF3-49F8-9A67-4141AC41ADD4} <C:\WINDOWS\downlo~1\CnsHook.dll, 北京三七二一科技有限公司>
[WMHlprObj Class]
{F5824EFB-728A-4726-A5A5-85A68B20EDC3} <C:\PROGRA~1\CNNIC\Cdn\wmhlpr.dll, CNNIC>
[启动迅雷5]
{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <E:\软件\迅雷\Thunder.exe, Thunder Networking Technologies,LTD>
[浩方对战平台]
{0A155D3C-68E2-4215-A47A-E800A446447A} <D:\游戏\CS\CS1.5中文硬盘版\浩方对战平台\GameClient.exe, 上海浩方在线信息技术有限公司>
[Yahoo 3.5G电邮]
{507F9113-CD77-4866-BA92-0E86DA3D0B97} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail, N/A>
[名品折扣]
{59BC54A2-56B3-44a0-93E5-432D58746E26} <http://adtaobao.allyes.com/main/adfclick?db=adtaobao&bid=138,140,18&cid=816,8,1&sid=5042&show=ignore&url=http://www.taobao.com/vertical/mall/pro.php?allyesPara=816, N/A>
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[雅虎助手]
{5D73EE86-05F1-49ed-B850-E423120EC338} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist, N/A>
[雅虎WIDGET]
{6354ABE6-05F1-49ed-B850-E423120EC338} <http://cn.widget.yahoo.com/index.htm?source=Cns, N/A>
[信息检索(&R)]
{92780B25-18CC-41C8-B9BE-3C9C571A8263} <D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[启动Web迅雷]
{962EFB8E-2683-42d4-AC74-AAA4C759B9C6} <http://my.xunlei.com, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <E:\软件\QQ\QQ.EXE, TENCENT>
[情景聊天]
{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg, N/A>
[]
{ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair, N/A>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[]
{FD00D911-7529-4084-9946-A29F1BDF4FE5} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean, N/A>
[BitComet工具栏]
{3F1ABCDB-A875-46c1-8345-B72A4567E486} <C:\Program Files\BitComet\BitCometBar\BitCometBar0.4.dll, N/A>
[QuickTime Object]
{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} <C:\Program Files\QuickTime\QTPlugin.ocx, Apple Computer, Inc.>
[EWA Control]
{18226BF8-DC0B-4D81-80E9-A41AE37BB73A} <E:\软件\PPLIVE\SYNACA~2.OCX, Synacast>
[CCtInf Class]
{6DBB2904-082D-4DB0-944A-21C22BA121F4} <C:\WINDOWS\system32\BANKCE~1.DLL, >
[LoaderCore Class]
{98A62E3F-A8C5-4EF0-8A00-C70CF9D18A89} <C:\WINDOWS\Downloaded Program Files\DLLoader.dll, sohu.com>
[InfControl Class]
{F998B60A-DC86-4C56-9796-D1F89A733C89} <C:\WINDOWS\system32\BankControl.dll, >
[WebThunder Browser Helper]
{00000AAA-A363-466E-BEF5-9BB68697AA7F} <E:\软件\迅雷\WebThunderBHO_015.dll, Thunder Networking Technologies,LTD>
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v14.dll, Thunder Networking Technologies,LTD>
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[EWA Control]
{18226BF8-DC0B-4D81-80E9-A41AE37BB73A} <E:\软件\PPLIVE\SYNACA~2.OCX, Synacast>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[BitComet工具栏]
{3F1ABCDB-A875-46C1-8345-B72A4567E486} <C:\Program Files\BitComet\BitCometBar\BitCometBar0.4.dll, N/A>
[lave]
{51A53836-086D-4412-A27F-951C3FDF9EA4} <C:\PROGRA~1\COMMON~1\ujbn\vnfr.dll, N/A>
[FkjJrfmd Class]
{59A9F4F6-A71A-72EB-6067-48590E58C736} <C:\WINDOWS\DOWNLO~1\edlkwjd.dll, jorcdsoft>
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AutoLive]
{7CA83CF1-3AEA-42D0-A4E3-1594FC6E48B2} <C:\PROGRA~1\3721\autolive.dll, >
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <E:\软件\迅雷\ComDlls\XunLeiBHO_007.dll, Thunder Networking Technologies,LTD>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[CnsHook Class]
{D157330A-9EF3-49F8-9A67-4141AC41ADD4} <C:\WINDOWS\downlo~1\CnsHook.dll, 北京三七二一科技有限公司>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[WMHlprObj Class]
{F5824EFB-728A-4726-A5A5-85A68B20EDC3} <C:\PROGRA~1\CNNIC\Cdn\wmhlpr.dll, CNNIC>
[&使用迅雷下载]
<E:\软件\迅雷\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
<E:\软件\迅雷\Program\GetAllUrl.htm, N/A>
[上传到QQ网络硬盘]
<E:\软件\QQ\AddToNetDisk.htm, N/A>
[使用Web迅雷下载]
<E:\软件\迅雷\GetUrl.htm, N/A>
[使用Web迅雷下载全部链接]
<E:\软件\迅雷\GetAllUrl.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
<E:\软件\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<E:\软件\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<E:\软件\QQ\SendMMS.htm, N/A>
[用比特精灵下载(&B)]
<E:\软件\BT\BitSpirit\bsurl.htm, N/A>

大大大菜鸟fff - 2007-2-20 10:41:00

正在运行的进程
[PID: 440][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 516][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 540][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\winlib .dll] [N/A, N/A]
[C:\WINDOWS\system32\cdnns.dll] [CNNIC, 2, 0, 0, 0]
[PID: 584][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\icm32.dll] [Microsoft Corporation, 5.1.2600.2709 (xpsp_sp2_gdr.050628-1518)]
[PID: 596][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 744][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 792][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\cdnns.dll] [CNNIC, 2, 0, 0, 0]
[PID: 864][C:\Program Files\Rising\Rav\CCenter.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
[PID: 880][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[c:\windows\system32\webmail.dll] [, 1, 0, 0, 2]
[C:\WINDOWS\system32\cdnns.dll] [CNNIC, 2, 0, 0, 0]
[PID: 980][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1152][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1180][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
[C:\WINDOWS\downlo~1\CnsHook.dll] [北京三七二一科技有限公司, 2, 5, 0, 2]
[C:\WINDOWS\downlo~1\CnsMin.dll] [北京三七二一科技有限公司, 2, 5, 0, 5]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.0.1002]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[C:\PROGRA~1\3721\helper.dll] [, 2, 5, 0, 1003]
[C:\PROGRA~1\3721\alrex.dll] [, 2.5.0.1002]
[C:\PROGRA~1\3721\autolive.dll] [, 2, 5, 1, 1004]
[C:\PROGRA~1\3721\alLiveEx.dll] [ , 1, 0, 3, 1006]
[E:\软件\迅雷\WebThunderBHO_015.dll] [Thunder Networking Technologies,LTD, 6, 0, 0, 5]
[C:\WINDOWS\system32\xunleibho_v14.dll] [Thunder Networking Technologies,LTD, 4, 6, 0, 62]
[C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 6.0.1.2003110300]
[C:\Program Files\WinRAR\rarext.dll] [N/A, N/A]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[E:\软件\迅雷\ComDlls\XunLeiBHO_007.dll] [Thunder Networking Technologies,LTD, 5, 0, 1, 4]
[PID: 1196][C:\Program Files\Rising\Rav\Ravmond.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 43]
[C:\Program Files\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\Rav\rfwctrl.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]
[C:\Program Files\Rising\Rav\RsPPsys.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[C:\Program Files\Rising\Rav\RsLog.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
[C:\Program Files\Rising\Rav\HOOKSYS.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 0]
[C:\Program Files\Rising\Rav\Scanner.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 12]
[C:\Program Files\Rising\Rav\libload.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 16]
[C:\Program Files\Rising\Rav\VirusLib.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
[C:\Program Files\Rising\Rav\regmon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6]
[C:\Program Files\Rising\Rav\HookWeb.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 1]
[C:\Program Files\Rising\Rav\MemMon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 12]
[C:\Program Files\Rising\Rav\expscan.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\Rising\Rav\mPorts.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3]
[C:\Program Files\Rising\Rav\HookCont.dll] [Rising, 19, 0, 0, 0]
[C:\Program Files\Rising\Rav\SpamEng.dll] [N/A, 18, 0, 0, 6]
[C:\Program Files\Rising\Rav\engine.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 26]
[C:\Program Files\Rising\Rav\PostTrt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 8]
[C:\Program Files\Rising\Rav\UnExe.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
[C:\Program Files\Rising\Rav\ScanExec.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 16]
[C:\Program Files\Rising\Rav\ScanEx.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 41]
[C:\Program Files\Rising\Rav\ExtFile.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 25]
[C:\Program Files\Rising\Rav\NvFile.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 11]
[C:\Program Files\Rising\Rav\ScanMac.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 13]
[C:\Program Files\Rising\Rav\ScanSct.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 19]
[C:\Program Files\Rising\Rav\Unpacker.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 19]
[C:\Program Files\Rising\Rav\ExtOLE.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 12]
[PID: 1360][C:\WINDOWS\system32\Rundll32.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\downlo~1\CnsMin.dll] [北京三七二一科技有限公司, 2, 5, 0, 5]
[C:\WINDOWS\downlo~1\CnsMinIO.dll] [北京三七二一科技有限公司, 2, 5, 0, 3]
[C:\WINDOWS\downlo~1\cnsio.dll] [北京三七二一科技有限公司, 2, 5, 0, 2]
[C:\WINDOWS\system32\cdnns.dll] [CNNIC, 2, 0, 0, 0]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.0.1002]
[C:\PROGRA~1\3721\helper.dll] [, 2, 5, 0, 1003]
[C:\WINDOWS\downlo~1\CnsMinEx.dll] [国风因特软件(北京)有限公司, 2, 5, 0, 2]
[PID: 1396][C:\Program Files\Rising\Rav\RavStub.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 4]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]

大大大菜鸟fff - 2007-2-20 10:42:00

[PID: 1760][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\WINDOWS\system32\EBPMON2.DLL] [SEIKO EPSON CORPORATION, 2, 39, 0, 0]
[C:\WINDOWS\system32\cdnns.dll] [CNNIC, 2, 0, 0, 0]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_DU16BE.DLL] [SEIKO EPSON Corporation, 0. 3. 0, 51]
[C:\WINDOWS\system32\icm32.dll] [Microsoft Corporation, 5.1.2600.2709 (xpsp_sp2_gdr.050628-1518)]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_DMAI14.DLL] [SEIKO EPSON Corporation, 0. 3. 1. 15]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_DDSP13.DLL] [SEIKO EPSON Corporation, 0. 3. 0. 13]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_DJB304.DLL] [SEIKO EPSON Corporation, 0.1.2.20]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EPIPGI10.DLL] [SEIKO EPSON CORP., 1.1.2]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_DI06WE.DLL] [SEIKO EPSON CORP., 0.1.0.20]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_DCON02.DLL] [SEIKO EPSON Corporation, 2.12]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_DHMM12.DLL] [SEIKO EPSON CORP., 2.1.2]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_DHT40D.DLL] [SEIKO EPSON CORP., 1.0.0]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_DUMW02.DLL] [SEIKO EPSON CORP., 1.4.8]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_DSU0WE.DLL] [SEIKO EPSON CORP., 1.0.1]
[PID: 1808][C:\WINDOWS\System32\SCardSvr.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1972][C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe] [SEIKO EPSON CORPORATION, 2, 3, 0, 0]
[C:\WINDOWS\system32\cdnns.dll] [CNNIC, 2, 0, 0, 0]
[C:\WINDOWS\system32\EBAPI2.DLL] [SEIKO EPSON CORPORATION, 1, 4, 0, 0]
[C:\Program Files\Common Files\EPSON\EBAPI\EBPLPT.DLL] [SEIKO EPSON CORPORATION, 2, 26, 0, 0]
[PID: 128][C:\WINDOWS\system32\nvsvc32.exe] [NVIDIA Corporation, 6.14.01.4351]
[PID: 380][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1540][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1556][C:\Program Files\Rising\Rav\RavTask.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 7]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\WINDOWS\downlo~1\CnsMin.dll] [北京三七二一科技有限公司, 2, 5, 0, 5]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.0.1002]
[PID: 1100][C:\Program Files\Rising\Rav\Ravmon.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 45]
[C:\Program Files\Rising\Rav\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33]
[C:\Program Files\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\Rav\RsXML.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
[C:\Program Files\Rising\Rav\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.0.1002]
[C:\WINDOWS\downlo~1\CnsMin.dll] [北京三七二一科技有限公司, 2, 5, 0, 5]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 896][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] [RealNetworks, Inc., 0.1.0.3510]
[C:\WINDOWS\downlo~1\CnsMin.dll] [北京三七二一科技有限公司, 2, 5, 0, 5]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.0.1002]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 2040][C:\Program Files\Rising\AntiSpyware\runiep.exe] [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6]
[C:\Program Files\Rising\AntiSpyware\iep_ctrl.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.0.1002]
[C:\WINDOWS\downlo~1\CnsMin.dll] [北京三七二一科技有限公司, 2, 5, 0, 5]
[PID: 2296][C:\Program Files\iTunes\iTunesHelper.exe] [Apple Computer, Inc., 7.0.2.16]
[C:\WINDOWS\downlo~1\CnsMin.dll] [北京三七二一科技有限公司, 2, 5, 0, 5]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.0.1002]
[C:\Program Files\iTunes\iTunesHelper.Resources\zh_CN.lproj\iTunesHelperLocalized.DLL] [Apple Computer, Inc., 7.0.2.1]
[C:\Program Files\iTunes\iTunesHelper.Resources\iTunesHelper.DLL] [Apple Computer, Inc., 7.0.2.16]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 2368][C:\Program Files\95599 Certificate Tools\CIDC\RegCertTool.exe] [CIDC, 1, 0, 0, 6]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.0.1002]
[C:\WINDOWS\downlo~1\CnsMin.dll] [北京三七二一科技有限公司, 2, 5, 0, 5]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 2408][C:\WINDOWS\VM_STI.EXE] [VM., 4.2.610.4]
[C:\WINDOWS\downlo~1\CnsMin.dll] [北京三七二一科技有限公司, 2, 5, 0, 5]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.0.1002]
[C:\PROGRA~1\3721\helper.dll] [, 2, 5, 0, 1003]
[C:\WINDOWS\system32\msdmo.dll] [N/A, N/A]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 2416][C:\WINDOWS\system32\rundll32.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\PROGRA~1\3721\helper.dll] [, 2, 5, 0, 1003]
[C:\WINDOWS\downlo~1\CnsMin.dll] [北京三七二一科技有限公司, 2, 5, 0, 5]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.0.1002]
[C:\PROGRA~1\3721\autolive.dll] [, 2, 5, 1, 1004]
[C:\PROGRA~1\3721\notifier.dll] [, 1, 0, 0, 5]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[C:\WINDOWS\system32\cdnns.dll] [CNNIC, 2, 0, 0, 0]
[C:\PROGRA~1\3721\alLiveEx.dll] [ , 1, 0, 3, 1006]
[PID: 2452][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.0.1002]
[C:\PROGRA~1\3721\helper.dll] [, 2, 5, 0, 1003]
[C:\WINDOWS\downlo~1\CnsMin.dll] [北京三七二一科技有限公司, 2, 5, 0, 5]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 2600][C:\Program Files\iPod\bin\iPodService.exe] [Apple Computer, Inc., 7.0.2.16]
[C:\Program Files\iPod\bin\iPodService.Resources\zh_CN.lproj\iPodServiceLocalized.DLL] [Apple Computer, Inc., 7.0.2.1]
[C:\Program Files\iPod\bin\iPodService.Resources\iPodService.DLL] [Apple Computer, Inc., 7.0.2.16]
[PID: 3504][C:\WINDOWS\system32\wuauclt.exe] [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.0.1002]
[C:\PROGRA~1\3721\helper.dll] [, 2, 5, 0, 1003]
[C:\WINDOWS\downlo~1\CnsMin.dll] [北京三七二一科技有限公司, 2, 5, 0, 5]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]

大大大菜鸟fff - 2007-2-20 10:43:00

[PID: 3052][E:\软件\QQ\QQ.exe] [TENCENT, 0, 0, 0, 0]
[E:\软件\QQ\QQBaseClassInDll.dll] [, 1, 0, 0, 1]
[E:\软件\QQ\QQHelperDll.dll] [, 1, 0, 0, 1]
[E:\软件\QQ\BasicCtrlDll.dll] [Tencent, 5, 0, 200, 14]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.0.1002]
[C:\PROGRA~1\3721\helper.dll] [, 2, 5, 0, 1003]
[C:\WINDOWS\downlo~1\CnsMin.dll] [北京三七二一科技有限公司, 2, 5, 0, 5]
[E:\软件\QQ\QQAPI.dll] [, 1, 0, 0, 1]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[E:\软件\QQ\TIMProxy.dll] [tencent, 0, 3, 2, 4]
[E:\软件\QQ\LoginCtrl.dll] [, 1, 0, 0, 1]
[E:\软件\QQ\npkcntc.dll] [INCA Internet Co., Ltd., 2005, 9, 1, 1]
[E:\软件\QQ\npkpdb.dll] [INCA Internet Co., Ltd., 2003, 10, 1, 1]
[E:\软件\QQ\QQRes.dll] [tencent, 1, 0, 0, 1]
[E:\软件\QQ\QQMainFrame.dll] [N/A, N/A]
[E:\软件\QQ\CQQApplication.dll] [N/A, N/A]
[E:\软件\QQ\NewSkin.dll] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\cdnns.dll] [CNNIC, 2, 0, 0, 0]
[E:\软件\QQ\HostingMgr.dll] [, 1, 0, 0, 1]
[E:\软件\QQ\CameraDll.dll] [, 1, 0, 0, 1]
[E:\软件\QQ\MailSummary.dll] [, 1, 0, 0, 1]
[E:\软件\QQ\QQSpace.dll] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\msdmo.dll] [N/A, N/A]
[E:\软件\QQ\QQGroupMng.dll] [, 1, 0, 0, 1]
[E:\软件\QQ\UserDefinedHead.dll] [, 1, 0, 0, 1]
[E:\软件\QQ\QQPlugin.dll] [N/A, N/A]
[E:\软件\QQ\QQAllInOne.dll] [N/A, N/A]
[E:\软件\QQ\SCCore.dll] [N/A, N/A]
[E:\软件\QQ\QQCustomFace.dll] [N/A, N/A]
[E:\软件\QQ\QQPet.dll] [, 1, 0, 0, 1]
[E:\软件\QQ\GroupConnection.dll] [Tencent, 5, 0, 202, 30]
[E:\软件\QQ\QQConfigPlugin.dll] [, 1, 0, 0, 1]
[E:\软件\QQ\FlashAvatarDll.dll] [, 1, 4, 0, 1]
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[E:\软件\QQ\QQMagicFace.dll] [, 1, 0, 0, 1]
[E:\软件\QQ\QQAvatar.dll] [N/A, N/A]
[E:\软件\QQ\QQSceneMng.dll] [N/A, N/A]
[E:\软件\QQ\LongConnection.dll] [tencent, 0, 3, 3, 8]
[E:\软件\QQ\QRingMng.dll] [N/A, N/A]
[E:\软件\QQ\PhoneAPI.dll] [, 1, 0, 0, 1]
[E:\软件\QQ\DialerAllinOne.dll] [tencent, 1, 4, 0, 0]
[E:\软件\QQ\ImageOle.dll] [TODO: <Company name>, 1.0.0.1]
[E:\软件\QQ\QQZip.dll] [tencent, 0, 3, 2, 4]
[E:\软件\QQ\QQSysMsgMng.dll] [N/A, N/A]
[E:\软件\QQ\BQQApplication.dll] [N/A, N/A]
[E:\软件\QQ\PersonalDesktop.dll] [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
[C:\WINDOWS\downlo~1\CnsHook.dll] [北京三七二一科技有限公司, 2, 5, 0, 2]
[E:\软件\QQ\CommercesMng.dll] [, 1, 0, 0, 1]
[E:\软件\QQ\QQUdpGetFileLib.dll] [tencent, 0, 2, 2, 3]
[E:\软件\QQ\QQAddr.dll] [深圳市腾讯计算机系统有限公司, 5, 0, 101, 141]
[E:\软件\QQ\QQPhoneHelper.dll] [腾讯科技（深圳）有限公司, 2, 1, 5, 50]
[PID: 3160][E:\软件\QQ\TIMPlatform.exe] [tencent, 0, 3, 1, 8]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.0.1002]
[C:\PROGRA~1\3721\helper.dll] [, 2, 5, 0, 1003]
[C:\WINDOWS\downlo~1\CnsMin.dll] [北京三七二一科技有限公司, 2, 5, 0, 5]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[E:\软件\QQ\TIMProxy.dll] [tencent, 0, 3, 2, 4]
[PID: 3996][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.0.1002]
[C:\PROGRA~1\3721\helper.dll] [, 2, 5, 0, 1003]
[C:\PROGRA~1\3721\scrblock.dll] [3721, 2.5.0.1002]
[C:\PROGRA~1\3721\alrex.dll] [, 2.5.0.1002]
[C:\WINDOWS\downlo~1\CnsMin.dll] [北京三七二一科技有限公司, 2, 5, 0, 5]
[C:\WINDOWS\downlo~1\CnsHint.dll] [3721, 2, 5, 0, 2]
[C:\PROGRA~1\3721\autolive.dll] [, 2, 5, 1, 1004]
[C:\PROGRA~1\3721\alLiveEx.dll] [ , 1, 0, 3, 1006]
[C:\WINDOWS\downlo~1\cnsplus.dll] [3721, 2, 5, 0, 2]
[E:\软件\迅雷\WebThunderBHO_015.dll] [Thunder Networking Technologies,LTD, 6, 0, 0, 5]
[C:\WINDOWS\system32\xunleibho_v14.dll] [Thunder Networking Technologies,LTD, 4, 6, 0, 62]
[C:\WINDOWS\downlo~1\CnsHook.dll] [北京三七二一科技有限公司, 2, 5, 0, 2]
[C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 6.0.1.2003110300]
[C:\WINDOWS\DOWNLO~1\edlkwjd.dll] [jorcdsoft, 1, 0, 0, 2]
[C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 0, 0, 2]
[E:\软件\迅雷\ComDlls\XunLeiBHO_007.dll] [Thunder Networking Technologies,LTD, 5, 0, 1, 4]
[C:\PROGRA~1\CNNIC\Cdn\wmhlpr.dll] [CNNIC, 1, 1, 0, 0]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[C:\WINDOWS\system32\cdnns.dll] [CNNIC, 2, 0, 0, 0]
[C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[C:\WINDOWS\downlo~1\CnsMinIO.dll] [北京三七二一科技有限公司, 2, 5, 0, 3]
[C:\WINDOWS\downlo~1\cnsio.dll] [北京三七二一科技有限公司, 2, 5, 0, 2]
[PID: 1068][C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10MT2.EXE] [SEIKO EPSON CORPORATION, 3.04]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.0.1002]
[C:\PROGRA~1\3721\helper.dll] [, 2, 5, 0, 1003]
[C:\WINDOWS\downlo~1\CnsMin.dll] [北京三七二一科技有限公司, 2, 5, 0, 5]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S2E0W2.DLL] [N/A, N/A]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S391L2.DLL] [SEIKO EPSON CORPORATION, 3.00]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[C:\WINDOWS\system32\EBAPI2.DLL] [SEIKO EPSON CORPORATION, 1, 4, 0, 0]
[C:\Program Files\Common Files\EPSON\EBAPI\EBPLPT.DLL] [SEIKO EPSON CORPORATION, 2, 26, 0, 0]
[C:\Program Files\Common Files\EPSON\EBAPI\EBPSHRE2.DLL] [SEIKO EPSON CORPORATION, 2, 1, 0, 0]

大大大菜鸟fff - 2007-2-20 10:43:00

[PID: 2604][E:\软件\迅雷\Program\Thunder5.exe] [Thunder Networking Technologies,LTD, 5, 5, 4, 266]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.0.1002]
[C:\PROGRA~1\3721\helper.dll] [, 2, 5, 0, 1003]
[C:\WINDOWS\downlo~1\CnsMin.dll] [北京三七二一科技有限公司, 2, 5, 0, 5]
[E:\软件\迅雷\Program\TaskManager.dll] [Thunder Networking Technologies,LTD, 1, 0, 2, 14]
[E:\软件\迅雷\Program\download_interface.dll] [Thunder Networking Technologies,LTD, 2, 12, 2, 44]
[E:\软件\迅雷\Program\asyn_dns.dll] [Thunder Networking Technologies,LTD, 2, 12, 2, 44]
[C:\WINDOWS\system32\cdnns.dll] [CNNIC, 2, 0, 0, 0]
[E:\软件\迅雷\Program\BHOStub.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 8]
[E:\软件\迅雷\Program\FloatBar.dll] [Giganology Inc., 1, 0, 0, 2]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[E:\软件\迅雷\Program\iTargetAD.dll] [Thunder Networking Technologies,LTD, 1, 0, 2, 13]
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[E:\软件\迅雷\Components\DiagnoseHelper\DiagnoseHelper.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 10]
[E:\软件\迅雷\Components\PortVerify\PortVerify.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
[E:\软件\迅雷\Components\ExplorerHelper\ExplorerHelper.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
[E:\软件\迅雷\Components\DTAG\DTAG.dll] [Thunder Networking Technologies,LTD, 1, 1, 0, 2]
[E:\软件\迅雷\Components\DTAG\ExtractMediaTag.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
[C:\WINDOWS\system32\msdmo.dll] [N/A, N/A]
[E:\软件\迅雷\Program\LiveUpdate.dll] [, 1, 0, 1, 17]
[E:\软件\迅雷\Components\InMedia\iEmbedShell.dll] [　, 1, 0, 0, 15]
[E:\软件\迅雷\Components\InMedia\iEmbed08.dll] [　, 3, 2, 0, 63]
[E:\软件\迅雷\Program\msgmanage.dll] [Thunder Networking Technologies,LTD, 2, 0, 1, 38]
[E:\软件\迅雷\Components\Community\XLCommunity.dll] [Thunder Networking Technologies,LTD, 1, 0, 3, 14]
[E:\软件\迅雷\Program\RegisterDll.dll] [Thunder Networking Technologies,LTD, 2, 2, 1, 43]
[E:\软件\迅雷\Components\Search\XLSearch.dll] [Thunder Networking Technologies,LTD, 1, 0, 1, 6]
[E:\软件\迅雷\Components\P4PClient\P4PClient.dll] [Thunder Networking Technologies,LTD, 1, 0, 2, 13]
[E:\软件\迅雷\Components\VPSHELL\VPSHELL.dll] [, 1, 0, 0, 1]
[E:\软件\迅雷\Components\VPSHELL\VideoPicture.dll] [XunLei, 1, 0, 0, 1]
[C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[E:\软件\迅雷\Plugins\TingTing\TingTing.dll] [Thunder Networking Technologies,LTD, 1, 1, 1, 12]
[E:\软件\迅雷\Plugins\BhoAdv\bho_adv.dll] [深圳市迅雷网络技术有限公司, 1.0.1.0]
[PID: 2664][E:\软件\扫描\SREng.EXE] [Smallfrogs Studio, 2.3.13.690]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.0.1002]
[C:\PROGRA~1\3721\helper.dll] [, 2, 5, 0, 1003]
[C:\WINDOWS\downlo~1\CnsMin.dll] [北京三七二一科技有限公司, 2, 5, 0, 5]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[C:\WINDOWS\system32\cdnns.dll] [CNNIC, 2, 0, 0, 0]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost
210.74.232.156 www.sougua.com
210.74.232.156 mp3.baidu,com
210.74.232.156 www.sogua.com
210.74.232.156 music.yahoo.com.cn
210.74.232.156 d.sogou.com
210.74.232.156 www.qq163.com
210.74.232.156 www.haoting.com
210.74.232.156 www.nowok.net
210.74.232.156 www.yymp3.com
210.74.232.156 music.feifa.com
210.74.232.156 www.tt67.com
210.74.232.156 www.kugoo.com
210.74.232.156 www.9sky.com
210.74.232.156 www.13139.com
210.74.232.156 www.mtvtop.com
210.74.232.156 www.6621.com
210.74.232.156 www.1ting.com
210.74.232.156 www.cococ.com
210.74.232.156 www.520music.com
210.74.232.156 www.7xi.net
210.74.232.156 www.st020.cn
210.74.232.156 www.9flash.com
210.74.232.156 www.7t7t.com
210.74.232.156 www.chinamp3.com
210.74.232.156 verycd.com
210.74.232.156 www.verycd.com
210.74.232.156 movie.poco.cn
210.74.232.156 pp365.net
210.74.232.156 www.pp365.net
210.74.232.156 btchina.net
210.74.232.156 bbs.btbbt.com
210.74.232.156 btz.cn
210.74.232.156 www.btz.cn
210.74.232.156 fkee.com
210.74.232.156 www.fkee.com
210.74.232.156 bt.kaicn.com
210.74.232.156 bt.acnow.net
210.74.232.156 movie.pcpop.com
210.74.232.156 bbs.cnxp.com
210.74.232.156 bt.sogua.com
210.74.232.156 gamedown.yesky.com
210.74.232.156 games.enet.com.cn
210.74.232.156 download.pchome.net
210.74.232.156 www.yxdown.com
210.74.232.156 movie.baidu,com
210.74.232.156 vagaa.com
210.74.232.156 www.vagaa.com
210.74.232.156 hnnn.net
210.74.232.156 www.hnnn.net
210.74.232.156 cn-see.com
210.74.232.156 www.cn-see.com
210.74.232.156 100bao.com
210.74.232.156 www.100bao.com
210.74.232.156 ent.163.com

==================================
API HOOK
N/A

==================================

[/CODE]

newcenturymoon - 2007-2-20 10:51:00

http://202.38.64.10/~jfpan/download/IceSword120_cn.zip
下载icesword 解压后打开icesword.exe
找到左下角文件按钮然后找到如下文件C:\WINDOWS\system32\winlib .dll
分别右击它们选择强制删除
重启进入安全模式下(开机后不断按F8键然后出来一个高级菜单选择第一项安全模式进入系统)
打开sreng （就是你扫日志的软件）启动项目注册表删除如下项目 (如果有哪项你认识或者确认不是病毒请不要删除)
<HTpatch><C:\WINDOWS\htpatch.exe> [N/A]

“启动项目”-“服务”-“Win32服务应用程序”中点“隐藏经认证的微软项目”，
选中以下项目，点“删除服务”，再点“设置”，在弹出的框中点“否”：
Imsvc / Imsvc

在“启动项目”-“服务”-“驱动程序”中点“隐藏经认证的微软项目”，
选中以下项目，点“删除服务”，再点“设置”，在弹出的框中点“否”：

bwciyblv / bwciyblv
R2A / R2A

还是 sreng 点击左边的系统修复 HOSTS文件然后点击下面的重置

双击我的电脑－工具－文件夹选项－查看－显示所有文件和文件夹，把“隐藏受保护的系统文件”的勾去掉。
然后删除
C:\WINDOWS\system32\Webmail.dll
C:\WINDOWS\system32\drivers\bwciyblv.sys
C:\WINDOWS\system32a2.sys

UFO不幸外人 - 2007-2-20 11:06:00

打开冰刃，所有操作在冰刃下进行，不让使用我的电脑和注册表的地方千万不要使用

在冰刃的进程里面，结束如下进程：

在冰刃的服务里面，禁用下列服务：
[Vsn odvh Service / odvh][Stopped/Auto Start]
<C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\COMMON~1\ujbn\yqiu.dll,Service><Microsoft Corporation>
[Imsvc / Imsvc][Running/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\Webmail.dll><>

在冰刃的注册表中找到如下项，删除对应键值。
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
<load><> [N/A]（无项目不处理，有则清空清空，不删除）
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
<HTpatch><C:\WINDOWS\htpatch.exe> [N/A]

在冰刃的文件里面，删除如下文件，删除不了的强制删除，如果还不行给我发信息。仔细查找，如果没有就算了。
C:\WINDOWS\system32\winlib .dll
C:\WINDOWS\system32\Webmail.dll
C:\WINDOWS\system32\drivers\bwciyblv.sys
C:\WINDOWS\system32a2.sys
C:\WINDOWS\htpatch.exe
清空C:\Documents and Settings\用户名\Local Settings\Temp文件夹中所有文件及文件夹

特殊处理
处理hosts具体方法看我的置顶贴

处理流氓软件

怀疑文件

希望您可以做到：
把所有准备删除的病毒文件
Temp文件夹下面所有大小小于1MB的EXE文件和DLL文件
瑞星病毒隔离系统目录c:\ravbin\下面的所有隐藏的.bin文件
整理到一个文件夹中，用WinRAR压缩后发送到我邮箱（最大附件10MB），方便我留下病毒副本

冰刃下载地址http://www.ttian.net/website/2005/0829/391.html

瑞星卡卡安全论坛