瑞星卡卡安全论坛
nslbsun - 2007-9-22 11:49:00
电脑一开机就会有这个病毒,每次都说是清除成功,但马上有会弹出新的~~我现在用的是瑞星2007版的~~~请问怎样才能彻底清除这种病毒呢?
[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)附件:
9472062007922113910.bmp
haohe的fans - 2007-9-22 12:07:00
下载 System Repair Engineer(2.5版本），到你的“Windows”文件夹里。
http://www.kztechs.com/sreng/download.html
1 解压缩sreng2.zip
2 将SREngPs.exe运行.
3 智能扫描=》扫描=》保存报告
4 把日志中的报告文字内容完整复制分段贴上来，不要修改
nslbsun - 2007-9-22 12:43:00
[CODE]
2005-09-22,12:18:45
System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 1 (Build 2600) - 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows XP Publisher]
<PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows XP Publisher]
<PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows XP Publisher]
<QlbCtrl><%ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start> [ Hewlett-Packard Development Company, L.P.]
<igfxtray><C:\WINDOWS\System32\igfxtray.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<igfxhkcmd><C:\WINDOWS\System32\hkcmd.exe> [(Verified)Microsoft Windows XP Publisher]
<igfxpers><C:\WINDOWS\System32\igfxpers.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<SynTPEnh><C:\Program Files\Synaptics\SynTP\SynTPEnh.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<NeroFilterCheck><C:\WINDOWS\system32\NeroCheck.exe> [Ahead Software Gmbh]
<IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload> [(Verified)Microsoft Corporation]
<hpWirelessAssistant><C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe> [Hewlett-Packard Development Company, L.P.]
<RfwMain><"D:\Program Files\Rising\防火墙\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
<RavTask><"D:\Program Files\Rising\OK\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<runeip><"D:\Program Files\Rising\卡卡\runiep.exe" /startup> [Beijing Rising Technology Co., Ltd.]
<WinSysM><C:\WINDOWS\IGM.exe> []
<mppds><C:\WINDOWS\mppds.exe> []
<Kvsc3><C:\WINDOWS\Kvsc3.exe> []
<MsIMMs32><C:\WINDOWS\MsIMMs32.exe> []
<upxdnd><C:\WINDOWS\upxdnd.exe> []
<cmdbcs><C:\WINDOWS\cmdbcs.exe> []
<msccrt><C:\WINDOWS\msccrt.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows XP Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows XP Publisher]
<UIHost><logonui.exe> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
<{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}><C:\WINDOWS\System32\shlhook.dll> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
<WinlogonNotify: igfxcui><igfxdev.dll> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
<Microsoft Windows Media Player 6.4><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\mplayer2.inf,PerUserStub.NT> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{306D6C21-C1B6-4629-986C-E59E1875B8AF}]
<N/A><"C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Messenger\msgsc.dll",ShowIconsUser> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
<Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.Install.PerUser> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player 8><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A]
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><C:\Herosoft\HeroV8\豪杰多~1.SCR> [N/A]
nslbsun - 2007-9-22 12:43:00
==================================
启动文件夹
[Adobe Gamma Loader]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Gamma Loader.lnk --> C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [Adobe Systems, Inc.]><N>
==================================
服务
[78207284 / 78207284][Stopped/Auto Start]
<C:\WINDOWS\System32\5AD29DD6.EXE -k><Microsoft Corporation>
[AddFiltr / AddFiltr][Stopped/Manual Start]
<"C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe"><Hewlett-Packard Development Company, L.P.>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[hpqwmiex / hpqwmiex][Running/Auto Start]
<C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe><Hewlett-Packard Development Company, L.P.>
[Rising Personal Firewall Service / RfwService][Running/Auto Start]
<D:\Program Files\Rising\防火墙\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
<"D:\Program Files\Rising\OK\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
<"D:\PROGRAM FILES\RISING\OK\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
==================================
驱动程序
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[Conexant AMC Audio / CAMCAUD][Running/Manual Start]
<system32\drivers\camc6aud.sys><Conexant Systems Inc.>
[CAMCHALA / CAMCHALA][Running/Manual Start]
<system32\drivers\camc6hal.sys><Conexant Systems Inc.>
[Intel(R) PRO Network Connection Driver / E100B][Running/Manual Start]
<System32\DRIVERS\e100b325.sys><Intel Corporation>
[eabfiltr / eabfiltr][Running/System Start]
<System32\DRIVERS\eabfiltr.sys><Hewlett-Packard Development Company, L.P.>
[eabusb / eabusb][Stopped/Manual Start]
<System32\DRIVERS\eabusb.sys><Hewlett-Packard Development Company, L.P.>
[ExpScaner / ExpScaner][Running/Auto Start]
<\??\D:\PROGRAM FILES\RISING\OK\ExpScan.sys><>
[HBtnKey / HBtnKey][Running/Manual Start]
<System32\DRIVERS\cpqbttn.sys><Hewlett-Packard Development Company, L.P.>
[HookCont / HookCont][Running/Auto Start]
<\??\D:\PROGRAM FILES\RISING\OK\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
<\??\D:\PROGRAM FILES\RISING\OK\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
<\??\D:\PROGRAM FILES\RISING\OK\HookSys.sys><Rising>
[HookUrl / HookUrl][Running/Auto Start]
<\??\D:\Program Files\Rising\防火墙\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[HSFHWICH / HSFHWICH][Running/Manual Start]
<System32\DRIVERS\HSFHWICH.sys><Conexant Systems, Inc.>
[HSF_DPV / HSF_DPV][Running/Manual Start]
<System32\DRIVERS\HSF_DPV.sys><Conexant Systems, Inc.>
[ialm / ialm][Running/Manual Start]
<System32\DRIVERS\ialmnt5.sys><Intel Corporation>
[mdmxsdk / mdmxsdk][Running/Auto Start]
<System32\DRIVERS\mdmxsdk.sys><Conexant>
[MEMSCAN / MEMSCAN][Running/Auto Start]
<\??\D:\PROGRAM FILES\RISING\OK\MEMSCAN.sys><Beijing Rising Technology Co., Ltd.>
[mProcRs / mProcRs][Running/Auto Start]
<\??\D:\Program Files\Rising\防火墙\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
<\SystemRoot\System32\drivers\RsBoot.sys><Beijing Rising Technology Co., Ltd.>
[RsFwDrv / RsFwDrv][Running/Auto Start]
<\??\D:\Program Files\Rising\防火墙\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\System32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
<\??\D:\PROGRAM FILES\RISING\OK\RSPPSYS.sys><Rising>
[Secdrv / Secdrv][Stopped/Manual Start]
<System32\DRIVERS\secdrv.sys><N/A>
[Synaptics TouchPad Driver / SynTP][Running/Manual Start]
<System32\DRIVERS\SynTP.sys><Synaptics, Inc.>
[用于 Windows XP 的英特尔(R) PRO/无线 2200BG 网络连接驱动程序 / w29n51][Running/Manual Start]
<System32\DRIVERS\w29n51.sys><Intel? Corporation>
[winachsf / winachsf][Running/Manual Start]
<System32\DRIVERS\HSF_CNXT.sys><Conexant Systems, Inc.>
==================================
浏览器加载项
[ThunderAtOnce Class]
{01443AEC-0FD1-40fd-9C87-E93D1494C233} <D:\安装文件\thunder\thunder5\ok\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[Thunder Browser Helper]
{B580CF64-E151-49C3-B73F-70B13FCA8E86} <D:\安装文件\thunder\thunder5\ok\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[豪杰超级解霸V8]
{367E0A21-8601-4986-9C9A-153BF5ACA118} <C:\Herosoft\HeroV8\STHSDVD.EXE, N/A>
[信息检索(&R)]
{92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\System32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[Shockwave Flash
Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash9d.ocx, Adobe Systems, Inc.>
[Thunder Agent Class]
{485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <D:\安装文件\thunder\thunder5\ok\ComDlls\ThunderAgent_Now.dll, Thunder Networking Technologies,LTD>
[360SafeLive]
{87515F61-A66C-4319-A0E0-D416CB8059E3} <D:\安装文件\安全卫士360\360safe\live.dll, 360safe.com>
[使用迅雷下载]
<D:\安装文件\thunder\thunder5\ok\Program\geturl.htm, N/A>
[使用迅雷下载全部链接]
<D:\安装文件\thunder\thunder5\ok\Program\getallurl.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[豪杰超级解霸V8实时播放]
<C:\Herosoft\HeroV8\MPURLGET.HTM, N/A>
nslbsun - 2007-9-22 12:45:00
==================================
正在运行的进程
[PID: 712 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 808 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 832 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\system32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 876 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 888 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 1064 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 1228 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 1484 / NETWORK SERVICE][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 1644 / LOCAL SERVICE][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 2016 / usr][C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe] [ Hewlett-Packard Development Company, L.P., 6, 1, 1, 2]
[C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBSERVICE.dll] [Hewlett-Packard Development Company, L.P., 6, 1, 1, 2]
[C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\hpqExec.dll] [Hewlett-Packard Company, 6, 1, 1, 2]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
[C:\WINDOWS\System32\shlhook.dll] [Beijing Rising Technology Co., Ltd., 4.0.0.9]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\MsIMMs32.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\Kvsc3.dll] [N/A, ]
[C:\WINDOWS\System32\msccrt.dll] [N/A, ]
[C:\WINDOWS\System32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[PID: 2024 / usr][C:\WINDOWS\System32\igfxtray.exe] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\hccutils.DLL] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\igfxres.dll] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\igfxress.dll] [Intel Corporation, 3.0.0.4410]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[C:\WINDOWS\System32\msccrt.dll] [N/A, ]
[C:\WINDOWS\System32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\WINDOWS\System32\MsIMMs32.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\Kvsc3.dll] [N/A, ]
[PID: 2032 / usr][C:\WINDOWS\System32\hkcmd.exe] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\hccutils.DLL] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\igfxres.dll] [Intel Corporation, 3.0.0.4410]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[C:\WINDOWS\System32\msccrt.dll] [N/A, ]
[C:\WINDOWS\System32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\WINDOWS\System32\MsIMMs32.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\Kvsc3.dll] [N/A, ]
[PID: 120 / usr][C:\WINDOWS\System32\igfxpers.exe] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4410]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[C:\WINDOWS\System32\msccrt.dll] [N/A, ]
[C:\WINDOWS\System32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\WINDOWS\System32\MsIMMs32.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\Kvsc3.dll] [N/A, ]
[PID: 172 / usr][C:\WINDOWS\System32\igfxsrvc.exe] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\igfxdev.dll] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\msccrt.dll] [N/A, ]
[C:\WINDOWS\System32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\WINDOWS\System32\MsIMMs32.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\Kvsc3.dll] [N/A, ]
[PID: 184 / usr][C:\Program Files\Synaptics\SynTP\SynTPEnh.exe] [Synaptics, Inc., 8.3.8 16Jun06]
[C:\WINDOWS\System32\SynCOM.dll] [Synaptics, Inc., 8.3.8 16Jun06]
[C:\WINDOWS\System32\SynTPAPI.dll] [Synaptics, Inc., 8.3.8 16Jun06]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[C:\WINDOWS\System32\msccrt.dll] [N/A, ]
[C:\WINDOWS\System32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\WINDOWS\System32\MsIMMs32.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\Kvsc3.dll] [N/A, ]
[PID: 224 / usr][C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe] [Hewlett-Packard Development Company, L.P., 2, 0, 7, 2]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\msccrt.dll] [N/A, ]
[C:\WINDOWS\System32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\WINDOWS\System32\MsIMMs32.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\Kvsc3.dll] [N/A, ]
[PID: 272 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\system32\mdimon.dll] [Microsoft Corporation, 11.3.1897.0]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll] [Microsoft Corporation, 11.3.1897.0]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 600 / usr][D:\Program Files\Rising\卡卡\runiep.exe] [Beijing Rising Technology Co., Ltd., 4.0.0.18]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[C:\WINDOWS\System32\msccrt.dll] [N/A, ]
[C:\WINDOWS\System32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\WINDOWS\System32\MsIMMs32.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\Kvsc3.dll] [N/A, ]
[PID: 1172 / usr][C:\WINDOWS\System32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[C:\WINDOWS\System32\Kvsc3.dll] [N/A, ]
[C:\WINDOWS\System32\MsIMMs32.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\WINDOWS\System32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\System32\msccrt.dll] [N/A, ]
[PID: 1508 / SYSTEM][D:\PROGRAM FILES\RISING\OK\RavStub.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 4]
[D:\PROGRAM FILES\RISING\OK\RsCommX.dll] [rising, 18, 0, 0, 1]
[D:\PROGRAM FILES\RISING\OK\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 1760 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 156 / SYSTEM][C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe] [Hewlett-Packard Development Company, L.P., 2, 0, 1, 9]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 2248 / usr][C:\WINDOWS\explorer.exe] [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\igfxpph.dll] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\hccutils.DLL] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\igfxres.dll] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\igfxress.dll] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
[C:\WINDOWS\System32\shlhook.dll] [Beijing Rising Technology Co., Ltd., 4.0.0.9]
[C:\WINDOWS\System32\Kvsc3.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\MsIMMs32.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\WINDOWS\System32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\System32\msccrt.dll] [N/A, ]
[C:\Herosoft\HeroV8\VCvtShell.dll] [herosoft, 1, 0, 0, 1]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
nslbsun - 2007-9-22 12:46:00
==================================
正在运行的进程
[PID: 712 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 808 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 832 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\system32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 876 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 888 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 1064 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 1228 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 1484 / NETWORK SERVICE][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 1644 / LOCAL SERVICE][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 2016 / usr][C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe] [ Hewlett-Packard Development Company, L.P., 6, 1, 1, 2]
[C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBSERVICE.dll] [Hewlett-Packard Development Company, L.P., 6, 1, 1, 2]
[C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\hpqExec.dll] [Hewlett-Packard Company, 6, 1, 1, 2]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
[C:\WINDOWS\System32\shlhook.dll] [Beijing Rising Technology Co., Ltd., 4.0.0.9]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\MsIMMs32.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\Kvsc3.dll] [N/A, ]
[C:\WINDOWS\System32\msccrt.dll] [N/A, ]
[C:\WINDOWS\System32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[PID: 2024 / usr][C:\WINDOWS\System32\igfxtray.exe] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\hccutils.DLL] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\igfxres.dll] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\igfxress.dll] [Intel Corporation, 3.0.0.4410]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[C:\WINDOWS\System32\msccrt.dll] [N/A, ]
[C:\WINDOWS\System32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\WINDOWS\System32\MsIMMs32.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\Kvsc3.dll] [N/A, ]
[PID: 2032 / usr][C:\WINDOWS\System32\hkcmd.exe] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\hccutils.DLL] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\igfxres.dll] [Intel Corporation, 3.0.0.4410]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[C:\WINDOWS\System32\msccrt.dll] [N/A, ]
[C:\WINDOWS\System32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\WINDOWS\System32\MsIMMs32.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\Kvsc3.dll] [N/A, ]
[PID: 120 / usr][C:\WINDOWS\System32\igfxpers.exe] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4410]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[C:\WINDOWS\System32\msccrt.dll] [N/A, ]
[C:\WINDOWS\System32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\WINDOWS\System32\MsIMMs32.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\Kvsc3.dll] [N/A, ]
[PID: 172 / usr][C:\WINDOWS\System32\igfxsrvc.exe] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\igfxdev.dll] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\msccrt.dll] [N/A, ]
[C:\WINDOWS\System32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\WINDOWS\System32\MsIMMs32.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\Kvsc3.dll] [N/A, ]
[PID: 184 / usr][C:\Program Files\Synaptics\SynTP\SynTPEnh.exe] [Synaptics, Inc., 8.3.8 16Jun06]
[C:\WINDOWS\System32\SynCOM.dll] [Synaptics, Inc., 8.3.8 16Jun06]
[C:\WINDOWS\System32\SynTPAPI.dll] [Synaptics, Inc., 8.3.8 16Jun06]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[C:\WINDOWS\System32\msccrt.dll] [N/A, ]
[C:\WINDOWS\System32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\WINDOWS\System32\MsIMMs32.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\Kvsc3.dll] [N/A, ]
[PID: 224 / usr][C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe] [Hewlett-Packard Development Company, L.P., 2, 0, 7, 2]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\msccrt.dll] [N/A, ]
[C:\WINDOWS\System32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\WINDOWS\System32\MsIMMs32.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\Kvsc3.dll] [N/A, ]
[PID: 272 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\system32\mdimon.dll] [Microsoft Corporation, 11.3.1897.0]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll] [Microsoft Corporation, 11.3.1897.0]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 600 / usr][D:\Program Files\Rising\卡卡\runiep.exe] [Beijing Rising Technology Co., Ltd., 4.0.0.18]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[C:\WINDOWS\System32\msccrt.dll] [N/A, ]
[C:\WINDOWS\System32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\WINDOWS\System32\MsIMMs32.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\Kvsc3.dll] [N/A, ]
[PID: 1172 / usr][C:\WINDOWS\System32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[C:\WINDOWS\System32\Kvsc3.dll] [N/A, ]
[C:\WINDOWS\System32\MsIMMs32.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\WINDOWS\System32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\System32\msccrt.dll] [N/A, ]
[PID: 1508 / SYSTEM][D:\PROGRAM FILES\RISING\OK\RavStub.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 4]
[D:\PROGRAM FILES\RISING\OK\RsCommX.dll] [rising, 18, 0, 0, 1]
[D:\PROGRAM FILES\RISING\OK\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 1760 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 156 / SYSTEM][C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe] [Hewlett-Packard Development Company, L.P., 2, 0, 1, 9]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 2248 / usr][C:\WINDOWS\explorer.exe] [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\igfxpph.dll] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\hccutils.DLL] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\igfxres.dll] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\igfxress.dll] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
[C:\WINDOWS\System32\shlhook.dll] [Beijing Rising Technology Co., Ltd., 4.0.0.9]
[C:\WINDOWS\System32\Kvsc3.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\MsIMMs32.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\WINDOWS\System32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\System32\msccrt.dll] [N/A, ]
[C:\Herosoft\HeroV8\VCvtShell.dll] [herosoft, 1, 0, 0, 1]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
nslbsun - 2007-9-22 12:46:00
[D:\Program Files\Rising\OK\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]
[PID: 2388 / SYSTEM][C:\WINDOWS\System32\wbem\wmiprvse.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 2816 / usr][D:\安装文件\QQ\ok\TIMPlatform.exe] [TENCENT, 7,0,431,1723]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[D:\安装文件\QQ\ok\TIMProxy.dll] [tencent, 0, 3, 2, 4]
[C:\WINDOWS\System32\msccrt.dll] [N/A, ]
[C:\WINDOWS\System32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\WINDOWS\System32\MsIMMs32.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\Kvsc3.dll] [N/A, ]
[PID: 3428 / usr][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
[D:\安装文件\thunder\thunder5\ok\ComDlls\TDAtOnce_Now.dll] [Thunder Networking Technologies,LTD, 1.0.2.9]
[D:\安装文件\thunder\thunder5\ok\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 7, 15]
[D:\安装文件\thunder\thunder5\ok\Components\ResWorker\DsBho_00.dll] [, 1, 0, 0, 8]
[D:\安装文件\thunder\thunder5\ok\Components\ResWorker\DataProcessor_00.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 11]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]
[D:\Program Files\Rising\OK\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\System32\Macromed\Flash\Flash9d.ocx] [Adobe Systems, Inc., 9,0,47,0]
[C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\Kvsc3.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\MsIMMs32.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\WINDOWS\System32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\System32\msccrt.dll] [N/A, ]
[PID: 3860 / usr][D:\Program Files\Rising\OK\RsAgent.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 12]
[D:\Program Files\Rising\OK\RsCommX.dll] [rising, 18, 0, 0, 1]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\Kvsc3.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\MsIMMs32.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\WINDOWS\System32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\System32\msccrt.dll] [N/A, ]
[PID: 3876 / usr][C:\WINDOWS\msagent\AgentSvr.exe] [Microsoft Corporation, 2.00.0.3422]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\Kvsc3.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\MsIMMs32.dll] [N/A, ]
[C:\WINDOWS\System32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\WINDOWS\System32\msccrt.dll] [N/A, ]
[PID: 3088 / usr][C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE] [, 1, 0, 0, 7]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\msccrt.dll] [N/A, ]
[C:\WINDOWS\System32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\WINDOWS\System32\MsIMMs32.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\Kvsc3.dll] [N/A, ]
[PID: 3156 / usr][C:\WINDOWS\IGM.exe] [N/A, ]
[PID: 3192 / usr][C:\WINDOWS\System32\conime.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\System32\msccrt.dll] [N/A, ]
[C:\WINDOWS\System32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\WINDOWS\System32\MsIMMs32.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\Kvsc3.dll] [N/A, ]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[PID: 3636 / usr][D:\安装文件\GreenBrowser\GreenBrowser\GreenBrowser.exe] [MoreQuick, 1, 0, 0, 0]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\msccrt.dll] [N/A, ]
[C:\WINDOWS\System32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\WINDOWS\System32\MsIMMs32.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\Kvsc3.dll] [N/A, ]
[C:\WINDOWS\System32\IMSC40A.IME] [Microsoft Corporation, 6.0.0.2527]
[C:\PROGRA~1\COMMON~1\MICROS~1\IME\SHARED2.0\MSCAND20.DLL] [Microsoft Corporation, 9.0.5510.0]
[D:\Program Files\Rising\OK\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\Macromed\Flash\Flash9d.ocx] [Adobe Systems, Inc., 9,0,47,0]
[PID: 3272 / usr][C:\WINDOWS\sreng2\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\msccrt.dll] [N/A, ]
[C:\WINDOWS\System32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\WINDOWS\System32\MsIMMs32.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\Kvsc3.dll] [N/A, ]
[C:\WINDOWS\sreng2\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
[C:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe
[D:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe
[E:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe
[F:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe
==================================
HOSTS 文件
127.0.0.1 localhost
==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 2016, C:\PROGRAM FILES\HEWLETT-PACKARD\HP QUICK LAUNCH BUTTONS\QLBCTRL.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 224, C:\PROGRAM FILES\HPQ\HP WIRELESS ASSISTANT\HP WIRELESS ASSISTANT.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3860, D:\PROGRAM FILES\RISING\OK\RSAGENT.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3156, C:\WINDOWS\IGM.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3636, D:\安装文件\GREENBROWSER\GREENBROWSER\GREENBROWSER.EXE]
==================================
API HOOK
N/A
==================================
隐藏进程
N/A
==================================
[/CODE]
pibo - 2007-9-22 12:57:00
删除以下内容:
看你有装Microsoft Windows Hardware Compatibility Publisher吗,有以下内容可以不删除(1.<igfxtray><C:\WINDOWS\System32\igfxtray.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher],
2.<igfxpers><C:\WINDOWS\System32\igfxpers.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
3.<SynTPEnh><C:\Program Files\Synaptics\SynTP\SynTPEnh.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher])
否则删除以下内容:
1.<QlbCtrl><%ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start> [ Hewlett-Packard Development Company, L.P.]
2.<igfxtray><C:\WINDOWS\System32\igfxtray.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
3.<igfxhkcmd><C:\WINDOWS\System32\hkcmd.exe> [(Verified)Microsoft Windows XP Publisher]
4.<igfxpers><C:\WINDOWS\System32\igfxpers.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
5.<SynTPEnh><C:\Program Files\Synaptics\SynTP\SynTPEnh.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
6.<WinSysM><C:\WINDOWS\IGM.exe> []
7.<mppds><C:\WINDOWS\mppds.exe> []
8.<Kvsc3><C:\WINDOWS\Kvsc3.exe> []
9.<MsIMMs32><C:\WINDOWS\MsIMMs32.exe> []
10.<upxdnd><C:\WINDOWS\upxdnd.exe> []
11.<cmdbcs><C:\WINDOWS\cmdbcs.exe> []
<msccrt><C:\WINDOWS\msccrt.exe> []
这个发给我:5AD29DD6.EXE (邮箱anglecomcn@163.com)<C:\WINDOWS\System32\5AD29DD6.EXE -k><Microsoft Corporation>
然后也一并删除.
pibo - 2007-9-22 13:01:00
Autorun.inf
[C:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe
[D:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe
[E:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe
[F:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe
也有问题,中了autorun,打开隐藏的文件夹,删除各个盘符下的Autorun.inf,auto.exe
nslbsun - 2007-9-22 14:14:00
进行7\8楼的处理后的电脑重启重新扫描的日志
[CODE]
2005-09-22,13:57:23
System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 1 (Build 2600) - 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows XP Publisher]
<PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows XP Publisher]
<PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows XP Publisher]
<QlbCtrl><%ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start> [ Hewlett-Packard Development Company, L.P.]
<igfxtray><C:\WINDOWS\System32\igfxtray.exe> [N/A]
<igfxhkcmd><C:\WINDOWS\System32\hkcmd.exe> [N/A]
<igfxpers><C:\WINDOWS\System32\igfxpers.exe> [N/A]
<SynTPEnh><C:\Program Files\Synaptics\SynTP\SynTPEnh.exe> [N/A]
<NeroFilterCheck><C:\WINDOWS\system32\NeroCheck.exe> [Ahead Software Gmbh]
<IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload> [(Verified)Microsoft Corporation]
<hpWirelessAssistant><C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe> [Hewlett-Packard Development Company, L.P.]
<RfwMain><"D:\Program Files\Rising\防火墙\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
<RavTask><"D:\Program Files\Rising\OK\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<runeip><"D:\Program Files\Rising\卡卡\runiep.exe" /startup> [Beijing Rising Technology Co., Ltd.]
<WinSysM><C:\WINDOWS\IGM.exe> []
<mppds><C:\WINDOWS\mppds.exe> []
<Kvsc3><C:\WINDOWS\Kvsc3.exe> []
<MsIMMs32><C:\WINDOWS\MsIMMs32.exe> []
<upxdnd><C:\WINDOWS\upxdnd.exe> []
<cmdbcs><C:\WINDOWS\cmdbcs.exe> []
<msccrt><C:\WINDOWS\msccrt.exe> []
<DiskMan32><C:\WINDOWS\DiskMan32.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows XP Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows XP Publisher]
<UIHost><logonui.exe> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
<{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}><C:\WINDOWS\System32\shlhook.dll> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
<WinlogonNotify: igfxcui><igfxdev.dll> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
<Microsoft Windows Media Player 6.4><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\mplayer2.inf,PerUserStub.NT> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{306D6C21-C1B6-4629-986C-E59E1875B8AF}]
<N/A><"C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Messenger\msgsc.dll",ShowIconsUser> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
<Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.Install.PerUser> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player 8><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A]
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><C:\Herosoft\HeroV8\豪杰多~1.SCR> [N/A]
nslbsun - 2007-9-22 14:14:00
==================================
启动文件夹
[Adobe Gamma Loader]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Gamma Loader.lnk --> C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [Adobe Systems, Inc.]><N>
==================================
服务
[78207284 / 78207284][Stopped/Auto Start]
<C:\WINDOWS\System32\5AD29DD6.EXE -k><Microsoft Corporation>
[AddFiltr / AddFiltr][Stopped/Manual Start]
<"C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe"><Hewlett-Packard Development Company, L.P.>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[hpqwmiex / hpqwmiex][Running/Auto Start]
<C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe><Hewlett-Packard Development Company, L.P.>
[Rising Personal Firewall Service / RfwService][Running/Auto Start]
<D:\Program Files\Rising\防火墙\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
<"D:\Program Files\Rising\OK\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
<"D:\PROGRAM FILES\RISING\OK\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
==================================
驱动程序
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[Conexant AMC Audio / CAMCAUD][Running/Manual Start]
<system32\drivers\camc6aud.sys><Conexant Systems Inc.>
[CAMCHALA / CAMCHALA][Running/Manual Start]
<system32\drivers\camc6hal.sys><Conexant Systems Inc.>
[Intel(R) PRO Network Connection Driver / E100B][Running/Manual Start]
<System32\DRIVERS\e100b325.sys><Intel Corporation>
[eabfiltr / eabfiltr][Running/System Start]
<System32\DRIVERS\eabfiltr.sys><Hewlett-Packard Development Company, L.P.>
[eabusb / eabusb][Stopped/Manual Start]
<System32\DRIVERS\eabusb.sys><Hewlett-Packard Development Company, L.P.>
[ExpScaner / ExpScaner][Running/Auto Start]
<\??\D:\PROGRAM FILES\RISING\OK\ExpScan.sys><>
[HBtnKey / HBtnKey][Running/Manual Start]
<System32\DRIVERS\cpqbttn.sys><Hewlett-Packard Development Company, L.P.>
[HookCont / HookCont][Running/Auto Start]
<\??\D:\PROGRAM FILES\RISING\OK\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
<\??\D:\PROGRAM FILES\RISING\OK\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
<\??\D:\PROGRAM FILES\RISING\OK\HookSys.sys><Rising>
[HookUrl / HookUrl][Running/Auto Start]
<\??\D:\Program Files\Rising\防火墙\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[HSFHWICH / HSFHWICH][Running/Manual Start]
<System32\DRIVERS\HSFHWICH.sys><Conexant Systems, Inc.>
[HSF_DPV / HSF_DPV][Running/Manual Start]
<System32\DRIVERS\HSF_DPV.sys><Conexant Systems, Inc.>
[ialm / ialm][Running/Manual Start]
<System32\DRIVERS\ialmnt5.sys><Intel Corporation>
[mdmxsdk / mdmxsdk][Running/Auto Start]
<System32\DRIVERS\mdmxsdk.sys><Conexant>
[MEMSCAN / MEMSCAN][Running/Auto Start]
<\??\D:\PROGRAM FILES\RISING\OK\MEMSCAN.sys><Beijing Rising Technology Co., Ltd.>
[mProcRs / mProcRs][Running/Auto Start]
<\??\D:\Program Files\Rising\防火墙\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
<\SystemRoot\System32\drivers\RsBoot.sys><Beijing Rising Technology Co., Ltd.>
[RsFwDrv / RsFwDrv][Running/Auto Start]
<\??\D:\Program Files\Rising\防火墙\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\System32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
<\??\D:\PROGRAM FILES\RISING\OK\RSPPSYS.sys><Rising>
[Secdrv / Secdrv][Stopped/Manual Start]
<System32\DRIVERS\secdrv.sys><N/A>
[Synaptics TouchPad Driver / SynTP][Running/Manual Start]
<System32\DRIVERS\SynTP.sys><Synaptics, Inc.>
[用于 Windows XP 的英特尔(R) PRO/无线 2200BG 网络连接驱动程序 / w29n51][Running/Manual Start]
<System32\DRIVERS\w29n51.sys><Intel? Corporation>
[winachsf / winachsf][Running/Manual Start]
<System32\DRIVERS\HSF_CNXT.sys><Conexant Systems, Inc.>
nslbsun - 2007-9-22 14:15:00
==================================
浏览器加载项
[ThunderAtOnce Class]
{01443AEC-0FD1-40fd-9C87-E93D1494C233} <D:\安装文件\thunder\thunder5\ok\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[Thunder Browser Helper]
{B580CF64-E151-49C3-B73F-70B13FCA8E86} <D:\安装文件\thunder\thunder5\ok\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[豪杰超级解霸V8]
{367E0A21-8601-4986-9C9A-153BF5ACA118} <C:\Herosoft\HeroV8\STHSDVD.EXE, N/A>
[信息检索(&R)]
{92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\System32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash9d.ocx, Adobe Systems, Inc.>
[Thunder Agent Class]
{485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <D:\安装文件\thunder\thunder5\ok\ComDlls\ThunderAgent_Now.dll, Thunder Networking Technologies,LTD>
[360SafeLive]
{87515F61-A66C-4319-A0E0-D416CB8059E3} <D:\安装文件\安全卫士360\360safe\live.dll, 360safe.com>
[使用迅雷下载]
<D:\安装文件\thunder\thunder5\ok\Program\geturl.htm, N/A>
[使用迅雷下载全部链接]
<D:\安装文件\thunder\thunder5\ok\Program\getallurl.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[豪杰超级解霸V8实时播放]
<C:\Herosoft\HeroV8\MPURLGET.HTM, N/A>
==================================
正在运行的进程
[PID: 712 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 800 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 824 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\system32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 868 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 880 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 1044 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 1220 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 1360 / NETWORK SERVICE][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 1528 / LOCAL SERVICE][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 1660 / usr][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\igfxpph.dll] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\hccutils.DLL] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\igfxres.dll] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\igfxress.dll] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[C:\WINDOWS\System32\mbdgev.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\DiskMan32.dll] [N/A, ]
[C:\WINDOWS\System32\xjoybm.dll] [N/A, ]
[C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
[C:\WINDOWS\System32\shlhook.dll] [Beijing Rising Technology Co., Ltd., 4.0.0.9]
[C:\WINDOWS\System32\pdxfca.dll] [N/A, ]
[C:\WINDOWS\System32\flinjs.dll] [N/A, ]
[C:\WINDOWS\System32\unqgod.dll] [N/A, ]
[PID: 1728 / usr][C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe] [ Hewlett-Packard Development Company, L.P., 6, 1, 1, 2]
[C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBSERVICE.dll] [Hewlett-Packard Development Company, L.P., 6, 1, 1, 2]
[C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\hpqExec.dll] [Hewlett-Packard Company, 6, 1, 1, 2]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 1772 / usr][C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe] [Hewlett-Packard Development Company, L.P., 2, 0, 7, 2]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 2004 / usr][D:\Program Files\Rising\卡卡\runiep.exe] [Beijing Rising Technology Co., Ltd., 4.0.0.18]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[C:\WINDOWS\System32\mbdgev.dll] [N/A, ]
[C:\WINDOWS\System32\xjoybm.dll] [N/A, ]
[C:\WINDOWS\System32\DiskMan32.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\unqgod.dll] [N/A, ]
[C:\WINDOWS\System32\flinjs.dll] [N/A, ]
[C:\WINDOWS\System32\pdxfca.dll] [N/A, ]
[PID: 216 / usr][C:\WINDOWS\System32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[C:\WINDOWS\System32\mbdgev.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\DiskMan32.dll] [N/A, ]
[C:\WINDOWS\System32\xjoybm.dll] [N/A, ]
[C:\WINDOWS\System32\pdxfca.dll] [N/A, ]
[C:\WINDOWS\System32\flinjs.dll] [N/A, ]
[C:\WINDOWS\System32\unqgod.dll] [N/A, ]
[PID: 472 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[C:\WINDOWS\system32\mdimon.dll] [Microsoft Corporation, 11.3.1897.0]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll] [Microsoft Corporation, 11.3.1897.0]
[PID: 780 / SYSTEM][D:\PROGRAM FILES\RISING\OK\RavStub.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 4]
[D:\PROGRAM FILES\RISING\OK\RsCommX.dll] [rising, 18, 0, 0, 1]
[D:\PROGRAM FILES\RISING\OK\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 1180 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 1440 / SYSTEM][C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe] [Hewlett-Packard Development Company, L.P., 2, 0, 1, 9]
[C:\WINDOWS\System32\8BC47FBC.DLL] [Microsoft Corporation, ]
[PID: 2088 / SYSTEM][C:\WINDOWS\System32\wbem\wmiprvse.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 2428 / usr][D:\安装文件\GreenBrowser\GreenBrowser\GreenBrowser.exe] [MoreQuick, 1, 0, 0, 0]
[C:\WINDOWS\System32\xjoybm.dll] [N/A, ]
[C:\WINDOWS\System32\DiskMan32.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\mbdgev.dll] [N/A, ]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[D:\Program Files\Rising\OK\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\System32\pdxfca.dll] [N/A, ]
[C:\WINDOWS\System32\flinjs.dll] [N/A, ]
[C:\WINDOWS\System32\unqgod.dll] [N/A, ]
[PID: 2592 / usr][D:\Program Files\Rising\OK\RsAgent.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 12]
[D:\Program Files\Rising\OK\RsCommX.dll] [rising, 18, 0, 0, 1]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\xjoybm.dll] [N/A, ]
[C:\WINDOWS\System32\DiskMan32.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\mbdgev.dll] [N/A, ]
[C:\WINDOWS\System32\flinjs.dll] [N/A, ]
[C:\WINDOWS\System32\pdxfca.dll] [N/A, ]
[C:\WINDOWS\System32\unqgod.dll] [N/A, ]
[PID: 2608 / usr][C:\WINDOWS\msagent\AgentSvr.exe] [Microsoft Corporation, 2.00.0.3422]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\xjoybm.dll] [N/A, ]
[C:\WINDOWS\System32\DiskMan32.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\mbdgev.dll] [N/A, ]
[C:\WINDOWS\System32\flinjs.dll] [N/A, ]
[C:\WINDOWS\System32\pdxfca.dll] [N/A, ]
[C:\WINDOWS\System32\unqgod.dll] [N/A, ]
[PID: 3068 / usr][C:\WINDOWS\sreng2\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]
[D:\Program Files\Rising\卡卡\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\System32\xjoybm.dll] [N/A, ]
[C:\WINDOWS\System32\DiskMan32.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\mbdgev.dll] [N/A, ]
[C:\WINDOWS\sreng2\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]
[C:\WINDOWS\System32\pdxfca.dll] [N/A, ]
[C:\WINDOWS\System32\flinjs.dll] [N/A, ]
[C:\WINDOWS\System32\unqgod.dll] [N/A, ]
[PID: 3176 / usr][C:\WINDOWS\IGM.exe] [N/A, ]
nslbsun - 2007-9-22 14:16:00
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
[C:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe
[D:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe
[E:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe
[F:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe
==================================
HOSTS 文件
127.0.0.1 localhost
==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 2428, D:\安装文件\GREENBROWSER\GREENBROWSER\GREENBROWSER.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2592, D:\PROGRAM FILES\RISING\OK\RSAGENT.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3176, C:\WINDOWS\IGM.EXE]
==================================
API HOOK
N/A
==================================
隐藏进程
N/A
==================================
[/CODE]
读毒 - 2007-9-22 16:35:00
解决方法：
建议以下步骤用冰刃操作，在操作的过程中不要打开任何磁盘.....
先在冰刃中把禁止进线程创建选上....
1.先结束下面进程（已被病毒注入）
[PID: 1660 / usr][C:\WINDOWS\Explorer.EXE]
[PID: 1728 / usr][C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
[PID: 1772 / usr][C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe]
[PID: 2004 / usr][D:\Program Files\Rising\卡卡\runiep.exe]
[PID: 216 / usr][C:\WINDOWS\System32\ctfmon.exe]
[PID: 472 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]
[PID: 780 / SYSTEM][D:\PROGRAM FILES\RISING\OK\RavStub.exe]
[PID: 1440 / SYSTEM][C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe]
[PID: 2428 / usr][D:\安装文件\GreenBrowser\GreenBrowser\GreenBrowser.exe]
[PID: 2592 / usr][D:\Program Files\Rising\OK\RsAgent.exe]
[PID: 2608 / usr][C:\WINDOWS\msagent\AgentSvr.exe]
[PID: 3068 / usr][C:\WINDOWS\sreng2\SREngPS.EXE]
2.然后强行卸除下面相应进程的模块
PID: 800 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]
[C:\WINDOWS\System32\8BC47FBC.DLL]
[PID: 824 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]
C:\WINDOWS\System32\8BC47FBC.DLL
PID: 868 / SYSTEM][C:\WINDOWS\system32\services.exe
C:\WINDOWS\System32\8BC47FBC.DLL
[PID: 880 / SYSTEM][C:\WINDOWS\system32\lsass.exe]
[C:\WINDOWS\System32\8BC47FBC.DLL]
[PID: 1044 / SYSTEM][C:\WINDOWS\system32\svchost.exe]
[C:\WINDOWS\System32\8BC47FBC.DLL]
[PID: 1220 / SYSTEM][C:\WINDOWS\System32\svchost.exe]
[C:\WINDOWS\System32\8BC47FBC.DLL]
[PID: 1360 / NETWORK SERVICE][C:\WINDOWS\System32\svchost.exe]
[C:\WINDOWS\System32\8BC47FBC.DLL]
[PID: 1528 / LOCAL SERVICE][C:\WINDOWS\System32\svchost.exe]
[C:\WINDOWS\System32\8BC47FBC.DLL]
[PID: 1180 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]
[C:\WINDOWS\System32\8BC47FBC.DLL]
3.在冰刃的文件选项中找到下面的模块，强行删除
C:\WINDOWS\System32\8BC47FBC.DLL
C:\WINDOWS\System32\mbdgev.dll] [N/A, ]
[C:\WINDOWS\System32\mppds.dll] [N/A, ]
[C:\WINDOWS\System32\DiskMan32.dll] [N/A, ]
[C:\WINDOWS\System32\xjoybm.dll] [N/A, ]
[C:\WINDOWS\System32\pdxfca.dll] [N/A, ]
[C:\WINDOWS\System32\flinjs.dll] [N/A, ]
[C:\WINDOWS\System32\unqgod.dll] [N/A, ]
4.删除下面注册表的相应分支
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<WinSysM><C:\WINDOWS\IGM.exe> []
<mppds><C:\WINDOWS\mppds.exe> []
<Kvsc3><C:\WINDOWS\Kvsc3.exe> []
<MsIMMs32><C:\WINDOWS\MsIMMs32.exe> []
<upxdnd><C:\WINDOWS\upxdnd.exe> []
<cmdbcs><C:\WINDOWS\cmdbcs.exe> []
<msccrt><C:\WINDOWS\msccrt.exe> []
5.在冰刃的文件选项中找到下面每个盘下全部强制删除....
Autorun.inf
[C:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe
[D:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe
[E:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe
[F:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe
6.然后再把冰刃中的禁止进线程创建解除
7.把杀软升到最新，全盘杀毒后，重启...
还有问题的话，再帖日志..........
轩辕小聪 - 2007-9-22 17:05:00
楼上的，强行卸除winlogon.exe等系统关键进程中的模块，很容易蓝屏的……
实际上，由于那些插入进程的dll，都是exe通过创建远程线程注入的，只要删除了exe的启动项和文件，重启后那些dll自然不会再插入进程，到时候直接收尸就行了。
比较保险的方法：
首先断网
结束进程C:\WINDOWS\IGM.exe
用SREng在“启动项目”－“注册表”中删除：
<WinSysM><C:\WINDOWS\IGM.exe> []
<mppds><C:\WINDOWS\mppds.exe> []
<Kvsc3><C:\WINDOWS\Kvsc3.exe> []
<MsIMMs32><C:\WINDOWS\MsIMMs32.exe> []
<upxdnd><C:\WINDOWS\upxdnd.exe> []
<cmdbcs><C:\WINDOWS\cmdbcs.exe> []
<msccrt><C:\WINDOWS\msccrt.exe> []
<DiskMan32><C:\WINDOWS\DiskMan32.exe> []
在“启动项目”－“服务”－“Win32服务应用程序”中，选“隐藏经认证的微软项目”，选中以下项目，点“删除服务”，再点“设置”，在弹出的对话框中点“否”：
[78207284 / 78207284][Stopped/Auto Start]
<C:\WINDOWS\System32\5AD29DD6.EXE -k><Microsoft Corporation>
用资源管理器左边的树型目录进入各盘符（切记不能直接双击盘符）
删除盘符根目录下的auto.exe和autorun.inf
删除以上各项目对应的exe文件。
注意WIHDOWS文件夹或system32文件夹中还有一些exe文件，文件名为随机6位字母，依照修改时间你就可以发现它们，并一并删除
重启电脑
再次用资源管理器左边的树型目录进入各盘符
确认auto.exe及autorun.inf是否还有，有则删除
删除：
C:\WINDOWS\System32\xjoybm.dll
C:\WINDOWS\System32\DiskMan32.dll
C:\WINDOWS\System32\mppds.dll
C:\WINDOWS\System32\mbdgev.dll
C:\WINDOWS\System32\flinjs.dll
C:\WINDOWS\System32\pdxfca.dll
C:\WINDOWS\System32\unqgod.dll
C:\WINDOWS\System32\8BC47FBC.DLL
以及system32文件夹下的另外一些由随机6位字母命名的dll文件（通过修改时间确定）
读毒 - 2007-9-22 18:20:00
| 引用: |
【轩辕小聪的贴子】楼上的，强行卸除winlogon.exe等系统关键进程中的模块，很容易蓝屏的……
实际上，由于那些插入进程的dll，都是exe通过创建远程线程注入的，只要删除了exe的启动项和文件，重启后那些dll自然不会再插入进程，到时候直接收尸就行了。
....................
学习了...呵呵
谢谢，指点...........
haohe的fans - 2007-9-22 18:34:00 哈哈
1
© 2000 - 2026 Rising Corp. Ltd.
|