【求助】帮忙看下!!! bbs.ikaka.com

蓝凌云菲 - 2007-9-13 2:32:00

+ 注册表自运行项目
+ 系统服务
+ HKLM\System\CurrentControlSet\Services
3B7D8D8E
[A ] 1. c:\windows\system32\54fe265b.exe
Microsoft Corporation
.text,.rdata,.data,.rsrc,.aspack,.adata,

RfwProxySrv
[A ] 2. c:\program files\rising\rfw\rfwproxy.exe
Beijing Rising Technology Co., Ltd.
Rising Personal Proxy Service
.text,.rdata,.data,.rsrc,

RfwService
[A ] 3. c:\program files\rising\rfw\rfwsrv.exe
Beijing Rising Technology Co., Ltd.
Rising Personal FireWall Service
.text,.rdata,.data,.rsrc,

RsCCenter
[A ] 4. c:\program files\rising\rav\ccenter.exe
Beijing Rising Technology Co., Ltd.
CCenter
.text,.rdata,.data,.rsrc,

RsRavMon
[A ] 5. c:\program files\rising\rav\ravmond.exe
Beijing Rising Technology Co., Ltd.
RavMond
.text,.rdata,.data,.rsrc,

+ 内核驱动
+ HKLM\System\CurrentControlSet\Services
ALCXWDM
[A ] 6. c:\windows\system32\drivers\alcxwdm.sys
Realtek Semiconductor Corp.
Realtek AC'97 Audio Driver (WDM)
.text,CODE,.rdata,.data,.data1,PAGE,INIT,.rsrc,.reloc,

BaseTDI
[A ] 7. c:\windows\system32\drivers\basetdi.sys
Beijing Rising Technology Co., Ltd.
basetdi
.text,.rdata,.data,INIT,.rsrc,.reloc,

ExpScaner
[A ] 8. c:\program files\rising\rav\expscan.sys
ExpScan.sys
.text,.rdata,.data,INIT,.rsrc,.reloc,

HookCont
[A ] 9. c:\program files\rising\rav\hookcont.sys
Rising
HookCont
.text,.rdata,.data,INIT,.rsrc,.reloc,

HookReg
[A ] 10. c:\program files\rising\rav\hookreg.sys
.text,.rdata,.data,INIT,.rsrc,.reloc,

HookSys
[A ] 11. c:\program files\rising\rav\hooksys.sys
Rising
Hooksys
.text,.rdata,.data,INIT,.rsrc,.reloc,

HookUrl
[A ] 12. c:\program files\rising\rfw\hookurl.sys
Beijing Rising Technology Co., Ltd.
HookUrl
.text,.rdata,.data,INIT,.rsrc,.reloc,

MegaIDE
[A ] 13. c:\windows\system32\drivers\megaide.sys
LSI Logic Corporation.
LSI MegaRAID IDE Driver
.text,.rdata,.data,INIT,.rsrc,.reloc,

MEMSCAN
[A ] 14. c:\program files\rising\rav\memscan.sys
Beijing Rising Technology Co., Ltd.
MemScan Driver
.text,.rdata,.data,INIT,.rsrc,.reloc,

mProcRs
[A ] 15. c:\program files\rising\rfw\mprocrs.sys
Beijing Rising Technology Co., Ltd.
Rising Personal FireWall mprocrs.sys
.text,.rdata,.data,INIT,.rsrc,.reloc,

npkcrypt
[A ] 16. c:\program files\tencent\qq\npkcrypt.sys
INCA Internet Co., Ltd.
nProtect KeyCrypt Driver
.text,.rdata,.data,INIT,.rsrc,.reloc,

ntdisk
[A ] 17. c:\windows\system32\drivers\ntdisk.sys
SAMING
SAMING PC GUARD For Winnt4.0 and win2000 Driver
.text,.rdata,.data,INIT,.rsrc,.reloc,

RsAntiSpyware
[A ] 18. c:\windows\system32\drivers\rsboot.sys
Beijing Rising Technology Co., Ltd.
Anti-RootKit Driver
.text,.rdata,.data,INIT,.rsrc,.reloc,

RsFwDrv
[A ] 19. c:\program files\rising\rfw\rsfwdrv.sys
Beijing Rising Technology Co., Ltd.
nt_fwdrv
.text,.rdata,.data,INIT,.rsrc,.reloc,

RsNTGDI
[A ] 20. c:\windows\system32\drivers\rsntgdi.sys
Beijing Rising Technology Co., Ltd.
RsNTGDI
.text,.rdata,INIT,.rsrc,.reloc,

RSPPSYS
[A ] 21. c:\program files\rising\rav\rsppsys.sys
Rising
RSPPSYS.SYS
.text,.rdata,.data,INIT,.rsrc,.reloc,

Secdrv
[A ] 22. c:\windows\system32\drivers\secdrv.sys
.text,.data,INIT,.reloc,

viagfx
[A ] 23. c:\windows\system32\drivers\vtmini.sys
Copyright (C) VIA/S3 Graphics Co, Ltd.
VIA/S3G Miniport Driver
.text,_TVBIOSD,_MISC,_FOCUSTV,.rdata,.data,PAGE,PAGE,INIT,.rsrc,.reloc,

+ 系统登陆自运行
+ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
UIHost
[A ] 24. c:\program files\logonui\royale.exe
Microsoft Corporation
Windows Logon UI
.text,.data,.rsrc,

+ IE浏览器加载模块
+ HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar
{E0E899AB-F487-11D5-8D29-0050BA6940E3}
[A ] 25. c:\program files\flashget\fgiebar.dll
Amaze Soft
FlashGet IE Bar
.text,.rdata,.data,.rsrc,.reloc,

{2318C2B1-4965-11d4-9B18-009027A5CD4F}
[AM] 26. c:\program files\google\googletoolbar2.dll
Google Inc.
Google IE 客户端工具栏
.text,.rdata,.data,shared,.rsrc,.reloc,

{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C}
[AM] 27. c:\windows\system32\kakatool.dll
Beijing Rising Technology Co., Ltd.
Rising AntiSpyware Toolbar
.text,.rdata,.data,MonitorS,.rsrc,.reloc,

+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
{889D2FEB-5411-4565-8998-1DD2C5261283}
[AM] 28. c:\program files\thunder network\thunder\comdlls\xunleibho_006.dll
Thunder Networking Technologies,LTD
XunLeiBHO
.text,.rdata,.data,.rsrc,.reloc,

{A5366673-E8CA-11D3-9CD9-0090271D075B}
[AM] 29. c:\program files\flashget\jccatch.dll
Amaze Soft
jccatch Module
.text,.rdata,.data,.rsrc,.reloc,

{AA58ED58-01DD-4d91-8333-CF10577473F7}
[AM] 26. c:\program files\google\googletoolbar2.dll
Google Inc.
Google IE 客户端工具栏
.text,.rdata,.data,shared,.rsrc,.reloc,

+ HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions
Exec
[A ] 30. c:\program files\thunder network\thunder\thunder.exe
Thunder Networking Technologies,LTD
.text,.rdata,.data,.rsrc,

Exec
[A ] 31. c:\program files\tencent\qq\qq.exe
TENCENT
QQ
.text,.rdata,.data,.rsrc,

Exec
[A ] 32. c:\program files\flashget\flashget.exe
Amaze Soft
FlashGet
.text,.rdata,.data,.rsrc,

+ 资源管理器加载模块
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
HyperTerminal Icon Ext
[A ] 33. c:\windows\system32\hticons.dll
Hilgraeve, Inc.
HyperTerminal Applet Library
.text,.data,.rsrc,.reloc,

WinRAR shell extension
[AM] 34. c:\program files\winrar\rarext.dll
.text,.data,.tls,.idata,.edata,.rsrc,.reloc,

PicaView
[AM] 35. c:\program files\acdsee\picaview.dll
ACD Systems, Ltd.
PicaView 系统扩展 DLL
.text,.rdata,.data,.tls,.rsrc,.reloc,

RISING
[AM] 36. c:\windows\system32\ravext.dll
Beijing Rising Technology Co., Ltd.
Rising Shell Ext Module
.text,.rdata,.data,.rsrc,.reloc,

Shell Extensions for RealOne Player
[A ] 37. c:\program files\real\realplayer\rpshell.dll
RealNetworks, Inc.
RealPlayer Shell Extensions
.text,.rdata,.data,.rsrc,.reloc,

+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
{32CD708B-60A7-4C00-9377-D73EAA495F0F}
[AM] 36. c:\windows\system32\ravext.dll
Beijing Rising Technology Co., Ltd.
Rising Shell Ext Module
.text,.rdata,.data,.rsrc,.reloc,

+ 用户登陆自运行项目
+ HKLM\Software\Microsoft\Windows\CurrentVersion\Run
RavTask
[A ] 38. c:\program files\rising\rav\ravtask.exe
Beijing Rising Technology Co., Ltd.
RavTimer
.text,.rdata,.data,.rsrc,

StormCodec_Helper
[A ] 39. c:\program files\ringz studio\storm codec\stormset.exe
.text,.rdata,.data,.ndata,.rsrc,

RfwMain
[AM] 40. c:\program files\rising\rfw\rfwmain.exe
Beijing Rising Technology Co., Ltd.
Rising Personal FireWall Main Program
.text,.rdata,.data,.rsrc,

runeip
[AM] 41. c:\program files\rising\antispyware\runiep.exe
Beijing Rising Technology Co., Ltd.
Rising AntiSpyware Monitor
.text,.rdata,.data,.rsrc,

+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
KKDelay
[A ] 42. c:\program files\rising\antispyware\runonce.exe
Beijing Rising Technology Co., Ltd.
RunOnce Application
.text,.rdata,.data,.rsrc,

+ 开机执行
+ HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
BootExecute
[A ] 43. c:\windows\system32\bsmain.exe
Beijing Rising Technology Co., Ltd.
BootScan
.text,.data,.rsrc,.reloc,

[A ] 44. c:\windows\system32\kknative.exe
Beijing Rising Technology Co., Ltd.
NativeAp
.text,.data,.rsrc,.reloc,

+ 映像劫持
+ HKCR\.html
htmlfile\Edit\Command
[A ] 45. c:\program files\microsoft office\office\msohtmed.exe
Microsoft Corporation
Microsoft Office 2000 component
.text,.data,.idata,.rsrc,

htmlfile\Print\Command
[A ] 45. c:\program files\microsoft office\office\msohtmed.exe
Microsoft Corporation
Microsoft Office 2000 component
.text,.data,.idata,.rsrc,

+ HKCR\.htm
htmlfile\Edit\Command
[A ] 45. c:\program files\microsoft office\office\msohtmed.exe
Microsoft Corporation
Microsoft Office 2000 component
.text,.data,.idata,.rsrc,

htmlfile\Print\Command
[A ] 45. c:\program files\microsoft office\office\msohtmed.exe
Microsoft Corporation
Microsoft Office 2000 component
.text,.data,.idata,.rsrc,

[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

蓝凌云菲 - 2007-9-13 2:32:00

+ 其他自启动项目
+ c:\autorun.inf
open
[A ] 46. c:\auto.exe
Microsoft Corporation
.text,.rdata,.data,.rsrc,.aspack,.adata,

shellexecute
[A ] 46. c:\auto.exe
Microsoft Corporation
.text,.rdata,.data,.rsrc,.aspack,.adata,

shell\Auto\command
[A ] 46. c:\auto.exe
Microsoft Corporation
.text,.rdata,.data,.rsrc,.aspack,.adata,

+ d:\autorun.inf
open
[A ] 47. d:\auto.exe
Microsoft Corporation
.text,.rdata,.data,.rsrc,.aspack,.adata,

shellexecute
[A ] 47. d:\auto.exe
Microsoft Corporation
.text,.rdata,.data,.rsrc,.aspack,.adata,

shell\Auto\command
[A ] 47. d:\auto.exe
Microsoft Corporation
.text,.rdata,.data,.rsrc,.aspack,.adata,

+ e:\autorun.inf
open
[A ] 48. e:\auto.exe
Microsoft Corporation
.text,.rdata,.data,.rsrc,.aspack,.adata,

shellexecute
[A ] 48. e:\auto.exe
Microsoft Corporation
.text,.rdata,.data,.rsrc,.aspack,.adata,

shell\Auto\command
[A ] 48. e:\auto.exe
Microsoft Corporation
.text,.rdata,.data,.rsrc,.aspack,.adata,

+ f:\autorun.inf
open
[A ] 49. f:\auto.exe
Microsoft Corporation
.text,.rdata,.data,.rsrc,.aspack,.adata,

shellexecute
[A ] 49. f:\auto.exe
Microsoft Corporation
.text,.rdata,.data,.rsrc,.aspack,.adata,

shell\Auto\command
[A ] 49. f:\auto.exe
Microsoft Corporation
.text,.rdata,.data,.rsrc,.aspack,.adata,

+ 正在运行的进程
+ 00000130(304) runiep.exe
00400000[00013000]
[AM] 41. c:\program files\rising\antispyware\runiep.exe
Beijing Rising Technology Co., Ltd.
Rising AntiSpyware Monitor
.text,.rdata,.data,.rsrc,

00BF0000[0001B000]
[ M] 50. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,

+ 00000184(388) ctfmon.exe
10000000[0000A000]
[ M] 51. c:\windows\system32\dbghlp32.dll

00A50000[00008000]
[ M] 52. c:\windows\system32\nvdispdrv.dll

00A60000[00009000]
[ M] 53. c:\windows\system32\diskman32.dll

00A70000[0001B000]
[ M] 50. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,

+ 000001b8(440) smss.exe

+ 00000208(520) csrss.exe

+ 00000220(544) winlogon.exe
72C80000[00008000]
[ M] 54. c:\windows\system32\msacm32.drv
Microsoft Corporation
Microsoft Sound Mapper
.text,.data,.rsrc,.reloc,

+ 0000024c(588) services.exe

+ 00000258(600) lsass.exe

+ 000002f0(752) svchost.exe

+ 00000328(808) iexplore.exe
10000000[00057000]
[AM] 27. c:\windows\system32\kakatool.dll
Beijing Rising Technology Co., Ltd.
Rising AntiSpyware Toolbar
.text,.rdata,.data,MonitorS,.rsrc,.reloc,

072F0000[0001D000]
[AM] 28. c:\program files\thunder network\thunder\comdlls\xunleibho_006.dll
Thunder Networking Technologies,LTD
XunLeiBHO
.text,.rdata,.data,.rsrc,.reloc,

07310000[00010000]
[AM] 29. c:\program files\flashget\jccatch.dll
Amaze Soft
jccatch Module
.text,.rdata,.data,.rsrc,.reloc,

07460000[0033A000]
[AM] 26. c:\program files\google\googletoolbar2.dll
Google Inc.
Google IE 客户端工具栏
.text,.rdata,.data,shared,.rsrc,.reloc,

078D0000[0001B000]
[ M] 50. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,

08F60000[00019000]
[ M] 55. c:\program files\rising\rav\ravscrch.dll
Beijing Rising Technology Co., Ltd.
RavScrCh Module
.text,.rdata,.data,.rsrc,.reloc,

30000000[002EF000]
[ M] 56. c:\windows\system32\macromed\flash\flash9c.ocx
Adobe Systems, Inc.
Adobe Flash Player 9.0 r45
.text,.rdata,.data,.rsrc,.reloc,

72C80000[00008000]
[ M] 54. c:\windows\system32\msacm32.drv
Microsoft Corporation
Microsoft Sound Mapper
.text,.data,.rsrc,.reloc,

+ 00000338(824) svchost.exe

+ 0000039c(924) svchost.exe

+ 000003e0(992) svchost.exe

+ 00000430(1072) svchost.exe

+ 000004d0(1232) Explorer.EXE
10000000[0001B000]
[AM] 36. c:\windows\system32\ravext.dll
Beijing Rising Technology Co., Ltd.
Rising Shell Ext Module
.text,.rdata,.data,.rsrc,.reloc,

72C80000[00008000]
[ M] 54. c:\windows\system32\msacm32.drv
Microsoft Corporation
Microsoft Sound Mapper
.text,.data,.rsrc,.reloc,

01750000[0001B000]
[ M] 50. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,

013F0000[00009000]
[ M] 53. c:\windows\system32\diskman32.dll

017E0000[00008000]
[ M] 52. c:\windows\system32\nvdispdrv.dll

01810000[0000A000]
[ M] 51. c:\windows\system32\dbghlp32.dll

01530000[0002B000]
[AM] 34. c:\program files\winrar\rarext.dll
.text,.data,.tls,.idata,.edata,.rsrc,.reloc,

23700000[0001A000]
[ M] 57. c:\program files\rising\rav\rscommon.dll
Beijing Rising Technology Co., Ltd.
Rising Common Function Dynamic Link Library
.text,.rdata,.data,.rsrc,.reloc,

028A0000[00079000]
[AM] 35. c:\program files\acdsee\picaview.dll
ACD Systems, Ltd.
PicaView 系统扩展 DLL
.text,.rdata,.data,.tls,.rsrc,.reloc,

02B70000[000FF000]
[ M] 58. c:\program files\acdsee\plugins\ide_acdstd.apl
ACD Systems, Ltd.
IDE_ACDStd
.text,.rdata,.data,.rsrc,.reloc,

+ 0000059c(1436) spoolsv.exe

+ 000006a0(1696) RfwMain.exe
00400000[00073000]
[AM] 40. c:\program files\rising\rfw\rfwmain.exe
Beijing Rising Technology Co., Ltd.
Rising Personal FireWall Main Program
.text,.rdata,.data,.rsrc,

26600000[0007D000]
[ M] 59. c:\program files\rising\rfw\rsguilib.dll
Beijing Rising Technology Co., Ltd.
Rising GUI Library Loader
.text,.rdata,.data,.rsrc,.reloc,

23700000[0001A000]
[ M] 60. c:\program files\rising\rfw\rscommon.dll
Beijing Rising Technology Co., Ltd.
Rising Common Function Dynamic Link Library
.text,.rdata,.data,.rsrc,.reloc,

10000000[0000F000]
[ M] 61. c:\program files\rising\rfw\rfwctrl.dll
Beijing Rising Technology Co., Ltd.
RfwCtrl DLL
.text,.rdata,.data,.rsrc,.reloc,

23800000[0001A000]
[ M] 62. c:\program files\rising\rfw\rsxml.dll
Beijing Rising Technology Co., Ltd.
RsXML
.text,.rdata,.data,.rsrc,.reloc,

23900000[00031000]
[ M] 63. c:\program files\rising\rfw\pngdll.dll
Beijing Rising Technology Co., Ltd.
Rising .Png File Loader Dynamic Link Library
.text,.rdata,.data,.rsrc,.reloc,

01140000[0001B000]
[ M] 50. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,

01270000[0000A000]
[ M] 51. c:\windows\system32\dbghlp32.dll

01280000[00008000]
[ M] 52. c:\windows\system32\nvdispdrv.dll

01290000[00009000]
[ M] 53. c:\windows\system32\diskman32.dll

+ 000006ac(1708) alg.exe

+ 00000788(1928) Ras.exe
00400000[0013F000]
[ M] 64. c:\program files\rising\antispyware\ras.exe
Beijing Rising Technology Co., Ltd.
Rising AntiSpyware
.text,.rdata,.data,.rsrc,

10000000[000A3000]
[ M] 65. c:\program files\rising\antispyware\rasgui.dll
Beijing Rising Technology Co., Ltd.
RasGUI
.text,.rdata,.data,.rsrc,.reloc,

01260000[0001B000]
[ M] 50. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,

02610000[0002F000]
[ M] 66. c:\program files\rising\antispyware\engine.dll
Beijing Rising Technology Co., Ltd.
kaka engine
.text,.rdata,.data,.rsrc,.reloc,

02640000[00012000]
[ M] 67. c:\program files\rising\antispyware\zip.dll
rising
zip
UPX0,UPX1,.rsrc,

蓝凌云菲 - 2007-9-13 13:11:00

帮忙看下是不是中毒了,昨天上百度后就查到几个木马.

百度是不是又抽风了,晕

瑞星卡卡安全论坛