瑞星卡卡安全论坛

系统活动进程
C:\WINDOWS\SYSTEM32\HKCMD.EXE
C:\WINDOWS\SYSTEM32\HCCUTILS.DLL
C:\WINDOWS\SYSTEM32\IGFXDEV.DLL
C:\WINDOWS\SYSTEM32\IGFXSRVC.DLL
C:\REALONEPLAYER\RISING\IEPROT.DLL
C:\WINDOWS\SYSTEM32\IGFXHK.DLL
C:\WINDOWS\SYSTEM32\IGFXRES.DLL
C:\WINDOWS\SYSTEM32\SMSS.EXE
C:\WINDOWS\SYSTEM32\CSRSS.EXE
C:\WINDOWS\SYSTEM32\WINLOGON.EXE
C:\WINDOWS\SYSTEM32\WDMAUD.DRV
C:\WINDOWS\SYSTEM32\MSACM32.DRV
C:\WINDOWS\SYSTEM32\SERVICES.EXE
C:\WINDOWS\SYSTEM32\LSASS.EXE
C:\REALONEPLAYER\RISING\RUNIEP.EXE
C:\REALONEPLAYER\RISING\IEP_CTRL.DLL
C:\REALONEPLAYER\RISING\IEPROT.DLL
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\REALONEPLAYER\RISING\RFW\RFWSRV.EXE
C:\REALONEPLAYER\RISING\RFW\RFWRULE.DLL
C:\REALONEPLAYER\RISING\RFW\RFWLOG.DLL
C:\REALONEPLAYER\RISING\RFW\RFWDRV.DLL
C:\REALONEPLAYER\RISING\RFW\PSAPI.DLL
C:\REALONEPLAYER\RISING\RFW\MONDRV.DLL
C:\REALONEPLAYER\RISING\RFW\PROCLIB.DLL
C:\REALONEPLAYER\RISING\RFW\MPORTS.DLL
C:\WINDOWS\SYSTEM32\SPOOLSV.EXE
C:\WINDOWS\SYSTEM32\MDIMON.DLL
C:\WINDOWS\SYSTEM32\SPOOL\PRTPROCS\W32X86\MDIPPR.DLL
C:\WINDOWS\SYSTEM32\ALG.EXE
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\SYSTEM32\WDFMGR.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\RISING\MAGICSET\HAOKANBAR.DLL
C:\REALONEPLAYER\RISING\IEPROT.DLL
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE11\MSOHEV.DLL
C:\WINDOWS\SYSTEM32\MACROMED\FLASH\FLASH9B.OCX
C:\WINDOWS\SYSTEM32\WDMAUD.DRV
C:\WINDOWS\SYSTEM32\MSACM32.DRV

C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM32\WDMAUD.DRV
C:\WINDOWS\SYSTEM32\MSACM32.DRV
C:\REALONEPLAYER\RISING\IEPROT.DLL
C:\WINDOWS\SYSTEM32\IGFXPPH.DLL
C:\WINDOWS\SYSTEM32\HCCUTILS.DLL
C:\WINDOWS\SYSTEM32\IGFXRES.DLL
C:\WINDOWS\SYSTEM32\IGFXSRVC.DLL
C:\WINDOWS\SYSTEM32\IGFXDEV.DLL
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE11\MSOHEV.DLL
C:\PROGRAM FILES\WINRAR\RAREXT.DLL
C:\WINDOWS\SYSTEM32\RAVEXT.DLL
C:\PROGRAM FILES\RISING\RAV\RSCOMMON.DLL

C:\WINDOWS\SYSTEM32\CTFMON.EXE
C:\REALONEPLAYER\RISING\IEPROT.DLL

C:\REALONEPLAYER\RISING\RFW\RFWMAIN.EXE
C:\REALONEPLAYER\RISING\RFW\RSGUILIB.DLL
C:\REALONEPLAYER\RISING\RFW\RSCOMMON.DLL
C:\REALONEPLAYER\RISING\RFW\RFWCTRL.DLL
C:\REALONEPLAYER\RISING\RFW\RSXML.DLL
C:\REALONEPLAYER\RISING\RFW\PNGDLL.DLL
C:\REALONEPLAYER\RISING\IEPROT.DLL

F:\RSDETECT.EXE
C:\REALONEPLAYER\RISING\IEPROT.DLL
C:\DOCUME~1\USER\LOCALS~1\TEMP\RAR$EX00.546\QQPETNURSE.EXE
C:\REALONEPLAYER\RISING\IEPROT.DLL
C:\WINDOWS\SYSTEM32\WMPDXM.DLL
C:\WINDOWS\SYSTEM32\WMP.DLL
C:\WINDOWS\SYSTEM32\MACROMED\FLASH\FLASH9B.OCX
C:\WINDOWS\SYSTEM32\WDMAUD.DRV
C:\WINDOWS\SYSTEM32\MSACM32.DRV
C:\WINDOWS\SYSTEM32\FFDSHOW.AX
C:\WINDOWS\SYSTEM32\MSVCR71.DLL
C:\REALONEPLAYER\STORM CODEC\CODECS\VSFILTER.DLL
普通自启动项
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
PHIME2002ASync = C:\WINDOWS\SYSTEM32\IME\TINTLGNT\TINTSETP.EXE /SYNC
RfwMain = "C:\REALONEPLAYER\RISING\RFW\RFWMAIN.EXE" -STARTUP
HotKeysCmds = C:\WINDOWS\SYSTEM32\HKCMD.EXE
Super Rabbit SafeEdit = C:\RISING\MAGICSET\SRFC.EXE /LOAD
ISUSPM Startup = ; C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.EXE -STARTUP
ISUSScheduler = ; "C:\PROGRAM FILES\COMMON FILES\INSTALLSHIELD\UPDATESERVICE\ISSCH.EXE" -START
StormCodec_Helper = "C:\REALONEPLAYER\STORM CODEC\STORMSET.EXE" /S /OPTI
runeip = C:\REALONEPLAYER\RISING\RUNIEP.EXE

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
KKDelay = C:\REALONEPLAYER\RISING\RUNONCE.EXE

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ctfmon.exe = C:\WINDOWS\SYSTEM32\CTFMON.EXE
Super Rabbit IEPro = C:\RISING\MAGICSET\SRIECLI.EXE /LOAD
AppInit_DLLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs =

系统文件关联
.exe ==> exefile = "%1" %*
.com ==> comfile = "%1" %*
.cmd ==> cmdfile = "%1" %*
.bat ==> batfile = "%1" %*
.txt ==> txtfile = C:\WINDOWS\NOTEPAD.EXE "%1"
.scr ==> scrfile = "%1" /S
.reg ==> regfile = regedit.exe "%1"
.doc ==> Word.Document.8 = "C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE" /n /dde

这是拿什么扫的啊

应该有木马，用瑞星的最新版本杀毒看看
ISUSPM Startup = ; C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.EXE -STARTUP
C:\DOCUME~1\USER\LOCALS~1\TEMP\RAR$EX00.546\QQPETNURSE.EXE

ISUSPM Startup = ; C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.EXE -STARTUP
ISUSScheduler = ; "C:\PROGRAM FILES\COMMON FILES\INSTALLSHIELD\UPDATESERVICE\ISSCH.EXE" -START
可以归为流氓软件,但应该是可卸载的.
C:\DOCUME~1\USER\LOCALS~1\TEMP\RAR$EX00.546\QQPETNURSE.EXE
这个应该是QQ的Q宠保姆.不过还是建议直接清空TEMP文件夹.^^