Rootkit.win32.agent.zzn怎么杀不掉？ bbs.ikaka.com

wuqing0425 - 2007-12-10 14:30:00

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<RavTask><"d:\Program Files\Rising\Rav\RavTask.exe" -system> [(Verified)Beijing Rising Science and Technology Corporation Limited]
<IdnSvr><C:\Program Files\OCINS\idnsvr.exe> [(Verified)China Internet Network Information Center]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Component Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [(Verified)Beijing Rising Science and Technology Corporation Limited]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
<WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll> [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
<Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
<N/A><C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install> [Microsoft Corporation]
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><C:\WINDOWS\system32\Coopen.scr> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><; > [N/A]
<PHIME2002A><; > [N/A]
<PHIME2002ASync><; > [N/A]
<RfwMain><; "d:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [(Verified)Beijing Rising Science and Technology Corporation Limited]
<runeip><; "C:\Program Files\Rising\AntiSpyware\runiep.exe" /startup> [Beijing Rising Technology Co., Ltd.]
<stup.exe><; Rundll32.exe C:\PROGRA~1\TENCENT\SSPlus\SPlus.dll,Rundll32 R> [N/A]
<Vmlist><; regsvr32 /s apphelps.dll> [N/A]

wuqing0425 - 2007-12-10 14:31:00

==================================
启动文件夹
[开屏桌面画报]
<C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\开屏桌面画报.lnk --> D:\PROGRA~1\Coopen\Coopen.exe [北京首都在线网络技术有限公司]><N>

==================================
服务
[Ati HotKey Poller / Ati HotKey Poller][Stopped/Disabled]
<C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[Autodesk Licensing Service / Autodesk Licensing Service][Stopped/Manual Start]
<"C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe"><Autodesk>
[Kaspersky Anti-Virus 6.0 / AVP][Stopped/Manual Start]
<"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r><Kaspersky Lab>
[Help and Support / helpsvc][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll><N/A>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Rising Proxy Service / RfwProxySrv][Running/Auto Start]
<d:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService][Running/Auto Start]
<d:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
<"d:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
<"D:\PROGRAM FILES\RISING\RAV\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[Unigraphics License Server (uglmd) / Unigraphics License Server (uglmd)][Stopped/Auto Start]
<><N/A>

wuqing0425 - 2007-12-10 14:31:00

驱动程序
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Stopped/Manual Start]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[AMD K8 Processor Driver / AmdK8][Stopped/Manual Start]
<System32\DRIVERS\amdk8.sys><Advanced Micro Devices>
[ati2mtag / ati2mtag][Stopped/Manual Start]
<system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[cnprov / cnprov][Running/Boot Start]
<\SystemRoot\system32\drivers\cnprov.sys><中国互联网络信息中心(CNNIC)>
[czinam0 / czinam08][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\czinam08.sys><N/A>
[Creative AudioPCI (ES1371,ES1373) (WDM) / es1371][Stopped/Manual Start]
<system32\drivers\es1371mp.sys><Creative Technology Ltd.>
[VIA Rhine-Family Fast Ethernet Adapter Driver Service / FETND5BV][Running/Manual Start]
<system32\DRIVERS\fetnd5bv.sys><VIA Technologies, Inc.>
[Microsoft UAA Bus Driver for High Definition Audio / HDAudBus][Running/Manual Start]
<system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
[HookCont / HookCont][Running/System Start]
<\SystemRoot\system32\drivers\HookCont.sys><Beijing Rising Technology Co., Ltd>
[HookNtos / HookNtos][Running/System Start]
<\SystemRoot\system32\drivers\HookNtos.sys><Beijing Rising Technology Co., Ltd>
[HookReg / HookReg][Running/System Start]
<\SystemRoot\system32\drivers\HookReg.sys><Beijing Rising Technology Co., Ltd>
[HookSys / HookSys][Running/System Start]
<\SystemRoot\system32\drivers\HookSys.sys><Beijing Rising Technology Co., Ltd>
[HookUrl / HookUrl][Running/Auto Start]
<\??\d:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[idnaux / idnaux][Running/Auto Start]
<system32\drivers\idnaux.sys><中国互联网络信息中心(CNNIC)>
[Service for Realtek HD Audio (WDM) / IntcAzAudAddService][Running/Manual Start]
<system32\drivers\RtkHDAud.sys><Realtek Semiconductor Corp.>
[kl1 / kl1][Running/Boot Start]
<\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif][Running/System Start]
<\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[ATK0110 ACPI UTILITY / MTsensor][Running/Manual Start]
<system32\DRIVERS\ASACPI.sys><>
[nhgucebdr1 / nhgucebdr1][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\nhgucebdr1.sys><N/A>
[nrtz / nrtzv][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\nrtzv.sys><N/A>
[AMD PCNET Compatable Adapter Driver / PCnet][Stopped/Manual Start]
<system32\DRIVERS\pcntpci5.sys><AMD Inc.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Rising Rfwbase Driver / RfwBase][Running/Auto Start]
<System32\DRIVERS\rfwbase.SYS><Beijing Rising Technology Co., Ltd.>
[ROCKEYNT / ROCKEYNT][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\Rockeynt.sys><FeiTian Tech Co.,Ltd>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
<\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising Technology Co., Ltd.>
[RsFwDrv / RsFwDrv][Running/System Start]
<\??\d:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[Realtek RTL8139/810x/8169/8110 all in one NDIS XP Driver / RTL8023xp][Stopped/Manual Start]
<system32\DRIVERS\Rtlnicxp.sys><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[Sentinel / Sentinel][Running/Auto Start]
<\SystemRoot\System32\Drivers\SENTINEL.SYS><Rainbow Technologies, Inc.>
[System Restore Filter Driver / sr][Stopped/Boot Start]
<\SystemRoot\system32\DRIVERS\sr.sys><N/A>
[Superk5 / Superk5][Running/Auto Start]
<\SystemRoot\System32\drivers\superk5.sys><Microsoft Corporation>
[VIA AGP Filter / viaagp1][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\viaagp1.sys><VIA Technologies, Inc.>
[viagfx / viagfx][Running/Manual Start]
<system32\DRIVERS\vtmini.sys><Copyright (C) VIA/S3 Graphics Co, Ltd.>
[ViaIde / ViaIde][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\viaide.sys><Microsoft Corporation>
[vmscsi / vmscsi][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\vmscsi.sys><VMware, Inc.>

wuqing0425 - 2007-12-10 14:31:00

浏览器加载项
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[IETag Factory]
{38481807-CA0E-42D2-BF39-B33AF135CC4D} <C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\IETAG.DLL, Microsoft Corporation>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Active Desktop Mover]
{72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
[IEAux Class]
{7605CC7C-00FD-4A5F-BAFD-828342DE6279} <C:\PROGRA~1\OCINS\ieaux.dll, 中国互联网络信息中心(CNNIC)>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <, N/A>
[RMGetLicense Class]
{A9FC132B-096D-460B-B7D5-1DB0FAE0C062} <C:\WINDOWS\system32\msnetobj.dll, Microsoft Corporation>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9d.ocx, Adobe Systems, Inc.>
[PasswordEditCtrl Class]
{E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>

wuqing0425 - 2007-12-10 14:35:00

正在运行的进程
[PID: 456 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 520 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[d:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[d:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 544 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\Ati2evxx.dll] [ATI Technologies Inc., 6.14.10.4119]
[C:\WINDOWS\system32\klogon.dll] [Kaspersky Lab, 6.0.2.621]
[d:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[d:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 588 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[d:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[d:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 600 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[d:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[d:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 772 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[d:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[d:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 820 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[d:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[d:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 888 / SYSTEM][d:\Program Files\Rising\Rav\CCenter.exe] [Beijing Rising Technology Co., Ltd., 20.0.0.28]
[d:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[d:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 908 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[d:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[d:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[C:\WINDOWS\system32\wups2.dll] [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]
[PID: 1008 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[d:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[d:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 1108 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[d:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[d:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]

火影忍者 - 2007-12-10 14:35:00

打开SREng-在"启动项目->服务->驱动程序"选中"隐藏已认证的微软服务" 然后将下面名称的服务删除（选中有问题的服务后，点“删除服务”，点“设置”按钮即可。注意弹出的窗口中要点 “NO 否”才是确认删除服务）(不能删除的就禁用:启动类型改为disabled,点中修改启动类型，点设置):
[cnprov / cnprov][Running/Boot Start]
<\SystemRoot\system32\drivers\cnprov.sys><中国互联网络信息中心(CNNIC)>
[czinam0 / czinam08][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\czinam08.sys><N/A>
[idnaux / idnaux][Running/Auto Start]
<system32\drivers\idnaux.sys><中国互联网络信息中心(CNNIC)>
[nhgucebdr1 / nhgucebdr1][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\nhgucebdr1.sys><N/A
[nrtz / nrtzv][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\nrtzv.sys><N/A>

重启显示隐藏文件后删除以下文件
C:\WINDOWS\system32\drivers\cnprov.sys
C:\WINDOWS\System32\DRIVERS\czinam08.sys
C:\WINDOWS\system32\drivers\idnaux.sys
C:\WINDOWS\system32\drivers\nhgucebdr1.sys
C:\WINDOWS\System32\DRIVERS\nrtzv.sys

下载arswp(Windows清理助手)
http://www.arswp.com/download/arswp/arswp.rar

wuqing0425 - 2007-12-10 14:35:00

[PID: 1124 / SYSTEM][D:\PROGRAM FILES\RISING\RAV\Ravmond.exe] [Beijing Rising Technology Co., Ltd., 20.0.0.60]
[D:\PROGRAM FILES\RISING\RAV\BWList.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.4]
[C:\WINDOWS\system32\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[D:\PROGRAM FILES\RISING\RAV\RSAPPMGR.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.0]
[D:\PROGRAM FILES\RISING\RAV\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.10]
[D:\PROGRAM FILES\RISING\RAV\RsLog.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.27]
[D:\PROGRAM FILES\RISING\RAV\ProcCom.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[D:\PROGRAM FILES\RISING\RAV\RsCommX2.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[D:\PROGRAM FILES\RISING\RAV\MonRule.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.24]
[D:\PROGRAM FILES\RISING\RAV\Hooksys.dll] [Beijing Rising Technology Co., Ltd, 22, 0, 0, 7]
[d:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[d:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[D:\PROGRAM FILES\RISING\RAV\HookReg.dll] [Beijing Rising Technology Co., Ltd, 22, 0, 0, 2]
[D:\PROGRAM FILES\RISING\RAV\HookNtos.dll] [Beijing Rising Technology Co., Ltd, 22, 0, 0, 2]
[D:\PROGRAM FILES\RISING\RAV\rswalmon.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 21]
[D:\PROGRAM FILES\RISING\RAV\recomp.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16]
[D:\PROGRAM FILES\RISING\RAV\refs.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 9]
[D:\PROGRAM FILES\RISING\RAV\ffr.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 9]
[D:\PROGRAM FILES\RISING\RAV\extfile.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 18]
[d:\Program Files\Rising\Rav\RsStore.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.8]
[D:\PROGRAM FILES\RISING\RAV\HookCont.dll] [Beijing Rising Technology Co., Ltd, 22, 0, 0, 1]
[D:\PROGRAM FILES\RISING\RAV\pearc.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 5]
[d:\Program Files\Rising\Rav\fakescan.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.13]
[d:\Program Files\Rising\Rav\Scanner.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.34]
[D:\PROGRAM FILES\RISING\RAV\viruslib.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 14]
[D:\PROGRAM FILES\RISING\RAV\relibldr.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 12]
[D:\PROGRAM FILES\RISING\RAV\HookWeb.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.2]
[D:\PROGRAM FILES\RISING\RAV\nvfile.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 3]
[D:\PROGRAM FILES\RISING\RAV\scanexec.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 11]
[D:\PROGRAM FILES\RISING\RAV\unexe.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 4]
[D:\PROGRAM FILES\RISING\RAV\scanex.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 21]
[D:\PROGRAM FILES\RISING\RAV\scanpack.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 5]
[D:\PROGRAM FILES\RISING\RAV\revm.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 8]
[D:\PROGRAM FILES\RISING\RAV\uroutine.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 22]
[D:\PROGRAM FILES\RISING\RAV\posttrt.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 8]
[D:\PROGRAM FILES\RISING\RAV\scriptci.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 2]
[D:\PROGRAM FILES\RISING\RAV\extmail.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 9]
[PID: 1164 / SYSTEM][d:\program files\rising\rfw\rfwsrv.exe] [Beijing Rising Technology Co., Ltd., 7.0.0.63]
[C:\WINDOWS\system32\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[d:\Program Files\Rising\Rfw\ProcCom.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[d:\program files\rising\rfw\RsCommX2.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[d:\program files\rising\rfw\RSAPPMGR.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.0]
[d:\program files\rising\rfw\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.10]
[d:\program files\rising\rfw\RfwRule.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.13]
[d:\program files\rising\rfw\rfwlog.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.12]
[d:\program files\rising\rfw\Rfwdrv.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.41]
[d:\program files\rising\rfw\psapi.dll] [Microsoft Corporation, 4.00]
[d:\program files\rising\rfw\ijt_ctrl.dll] [Beijing Rising Technology Co., Ltd., 7, 0, 0, 0]
[d:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[d:\program files\rising\rfw\unvdet.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.5]
[d:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[d:\program files\rising\rfw\mPorts.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.3]
[PID: 1216 / SYSTEM][d:\program files\rising\rfw\rfwproxy.exe] [Beijing Rising Technology Co., Ltd., 7.0.0.27]
[C:\WINDOWS\system32\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[d:\program files\rising\rfw\psapi.dll] [Microsoft Corporation, 4.00]
[d:\Program Files\Rising\Rfw\ProcCom.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[d:\program files\rising\rfw\RsCommX2.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[d:\program files\rising\rfw\RfwRule.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.13]
[d:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[d:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[d:\program files\rising\rfw\MonMid.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 1452 / SYSTEM][d:\program files\rising\rfw\rfwstub.exe] [Beijing Rising Technology Co., Ltd., 7.0.0.10]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[d:\program files\rising\rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16]
[PID: 1820 / Administrator][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234)]
[C:\WINDOWS\system32\AcSignIcon.dll] [Autodesk, 17.0.54.0]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.17]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scrchpg.dll] [Kaspersky Lab, 6.0.2.621]
[C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] [Autodesk, 17.0.54.110]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
[d:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\ShellEx.dll] [Kaspersky Lab, 6.0.2.621]
[C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]
[C:\WINDOWS\system32\Audiodev.dll] [Microsoft Corporation, 5.2.3802.3802 built by: dnsrv(bld4act)]
[PID: 1856 / SYSTEM][D:\PROGRAM FILES\RISING\RAV\RavStub.exe] [Beijing Rising Technology Co., Ltd., 20.0.0.9]
[d:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[d:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[D:\PROGRAM FILES\RISING\RAV\ProcCom.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[D:\PROGRAM FILES\RISING\RAV\RsCommX2.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[D:\PROGRAM FILES\RISING\RAV\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16]
[PID: 1880 / Administrator][d:\program files\rising\rfw\RfwMain.exe] [Beijing Rising Technology Co., Ltd., 7.0.1.48]
[C:\WINDOWS\system32\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[d:\program files\rising\rfw\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 79]
[d:\Program Files\Rising\Rfw\ProcCom.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[d:\program files\rising\rfw\RsCommX2.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[d:\program files\rising\rfw\RSAPPMGR.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.0]
[d:\program files\rising\rfw\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.10]
[d:\program files\rising\rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16]
[d:\program files\rising\rfw\RfwCtrl.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.7]
[d:\program files\rising\rfw\RsXML.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 0]
[d:\program files\rising\rfw\PngDll.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 3]
[d:\program files\rising\rfw\RfwRule.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.13]

wuqing0425 - 2007-12-10 14:36:00

[PID: 1908 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[d:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[d:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[C:\WINDOWS\system32\mdimon.dll] [Microsoft Corporation, 11.3.2175.0]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll] [Microsoft Corporation, 11.3.2175.0]
[PID: 2032 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2412 / Administrator][D:\Program Files\Rising\Rav\RavTask.exe] [Beijing Rising Technology Co., Ltd., 20.0.0.20]
[D:\Program Files\Rising\Rav\ProcCom.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[D:\Program Files\Rising\Rav\RsCommX2.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[D:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16]
[D:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 20.0.0.0]
[D:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.10]
[PID: 2432 / Administrator][C:\Program Files\OCINS\idnsvr.exe] [中国互联网信息中心(CNNIC), 2, 6, 0, 1]
[C:\Program Files\OCINS\idnsvr.dll] [中国互联网信息中心(CNNIC), 2, 6, 0, 2]
[PID: 2428 / Administrator][D:\Program Files\Rising\Rav\Ravmon.exe] [Beijing Rising Technology Co., Ltd., 20.0.01.05]
[C:\WINDOWS\system32\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[D:\Program Files\Rising\Rav\ProcCom.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[D:\Program Files\Rising\Rav\RsCommX2.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[D:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16]
[D:\Program Files\Rising\Rav\recomp.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16]
[D:\Program Files\Rising\Rav\refs.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 9]
[D:\Program Files\Rising\Rav\viruslib.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 14]
[D:\Program Files\Rising\Rav\relibldr.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 12]
[D:\Program Files\Rising\Rav\RSAPPMGR.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.0]
[D:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.10]
[D:\Program Files\Rising\Rav\MonRule.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.24]
[D:\Program Files\Rising\Rav\PngDll.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 3]
[D:\Program Files\Rising\Rav\Rsguilib.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 79]
[D:\Program Files\Rising\Rav\RsXML.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 0]
[PID: 2676 / Administrator][D:\Program Files\Coopen\Coopen.exe] [北京首都在线网络技术有限公司, 3, 6, 1, 60]
[D:\Program Files\Coopen\CoopenActiveControl60.dll] [北京首都在线网络技术有限公司, 3, 6, 1, 60]
[D:\Program Files\Coopen\coopendownloader.cop] [北京首都在线网络技术有限公司, 3, 6, 1, 60]
[D:\Program Files\Coopen\coopenupdate.cop] [, 3, 6, 1, 60]
[D:\Program Files\Coopen\coopenui.cop] [北京首都在线网络技术有限公司, 3, 6, 1, 60]
[D:\Program Files\Coopen\coopenclient.cop] [北京首都在线网络技术有限公司, 3, 6, 1, 60]
[D:\Program Files\Coopen\coopenplayer.cop] [北京首都在线网络技术有限公司, 3, 6, 1, 60]
[D:\Program Files\Coopen\coopendeskicon.cop] [北京首都在线网络技术有限公司, 3, 6, 1, 60]
[C:\WINDOWS\system32\AcSignIcon.dll] [Autodesk, 17.0.54.0]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scrchpg.dll] [Kaspersky Lab, 6.0.2.621]
[C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] [Autodesk, 17.0.54.110]
[C:\WINDOWS\system32\icm32.dll] [Microsoft Corporation, 5.1.2600.2709 (xpsp_sp2_gdr.050628-1518)]
[C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXEV.DLL] [Microsoft Corporation, 11.0.5510]
[D:\Program Files\Coopen\coopenmodea.cop] [北京首都在线网络技术有限公司, 3, 6, 1, 60]
[PID: 3064 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[d:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[d:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 2276 / Administrator][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3436 / Administrator][C:\Program Files\Tencent\QQ\TIMPlatform.exe] [TENCENT, 7,0,431,1723]
[C:\Program Files\Tencent\QQ\TIMProxy.dll] [tencent, 0, 3, 2, 4]

wuqing0425 - 2007-12-10 14:36:00

[PID: 3892 / Administrator][D:\AutoCAD 2007\acad.exe] [Autodesk, Inc., R17.0.54.0]
[D:\AutoCAD 2007\ac1st17.dll] [Autodesk, Inc., 17.0.54.0]
[D:\AutoCAD 2007\acdb17.dll] [Autodesk, Inc., 17.0.54.110]
[D:\AutoCAD 2007\AcGe17.dll] [Autodesk, Inc., 17.0.54.0]
[D:\AutoCAD 2007\acui17.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\anav.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\adui17.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\UserData.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\dswhip.dll] [Autodesk Inc., 17.0.54.0]
[D:\AutoCAD 2007\heidi9.dll] [Autodesk, Inc., 9.0.54.0]
[D:\AutoCAD 2007\dlint9.dll] [Autodesk, Inc., 9.0.54.0]
[D:\AutoCAD 2007\sfttabac.dll] [Softel vdm, 17.0.54.0]
[D:\AutoCAD 2007\AdImaging.dll] [Autodesk, Inc., 17.0.54.0]
[D:\AutoCAD 2007\adlmdll.dll] [N/A, ]
[D:\AutoCAD 2007\adctrls.dll] [Autodesk, Inc., 17.0.54.0]
[D:\AutoCAD 2007\adui17res.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AnavRes.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\acui17res.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\DsWhipRes.dll] [Autodesk Inc., 17.0.54.0]
[D:\AutoCAD 2007\sfttabacRes.dll] [Softel vdm, 17.0.54.0]
[D:\AutoCAD 2007\AdImagingRes.dll] [Autodesk, Inc., 17.0.54.0]
[D:\AutoCAD 2007\ADCtrlsRes.dll] [Autodesk, Inc., 17.0.54.0]
[D:\AutoCAD 2007\acadbtn.xmx] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\acadres.dll] [Autodesk, Inc., 17.0.54.0]
[D:\AutoCAD 2007\acdb17chsres.dll] [Autodesk, Inc., 17.0.54.0]
[C:\WINDOWS\system32\mscoree.dll] [Microsoft Corporation, 2.0.50727.832 (QFE.050727-8300)]
[C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll] [Microsoft Corporation, 2.0.50727.832 (QFE.050727-8300)]
[D:\AutoCAD 2007\adlmres.dll] [Autodesk, Inc., 7.0.0.24]
[D:\AutoCAD 2007\PrxyInet.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\PrxyInetRes.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\oleaprot.arx] [Autodesk, 17.0.54.0]
[C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\522148948b03169dcf7dc956777574ec\mscorlib.ni.dll] [Microsoft Corporation, 2.0.50727.832 (QFE.050727-8300)]
[D:\AutoCAD 2007\acdbmgd.dll] [Autodesk, Inc., 17.0.54.0]
[C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll] [Microsoft Corporation, 2.0.50727.42 (RTM.050727-4200)]
[D:\AutoCAD 2007\colorRes.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\drv\gdi9.hdi] [Autodesk, Inc., 9.0.54.0]
[D:\AutoCAD 2007\drv\gdi9Res.dll] [Autodesk, Inc., 9.0.54.0]
[D:\AutoCAD 2007\drv\szb9.hdi] [Autodesk, Inc., 9.0.54.0]
[D:\AutoCAD 2007\drv\rblast9.hdi] [Autodesk, Inc., 9.0.54.0]
[D:\AutoCAD 2007\drv\gdifont9.hdi] [Autodesk, Inc., 9.0.54.0]
[D:\AutoCAD 2007\acgs.dll] [Autodesk Inc., 17.0.54.0]
[D:\AutoCAD 2007\acgsRes.dll] [Autodesk Inc., 17.0.54.0]
[C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll] [Microsoft Corporation, 2.0.50727.832 (QFE.050727-8300)]
[D:\AutoCAD 2007\AcGsConfig.arx] [Autodesk Inc., 17.0.54.0]
[D:\AutoCAD 2007\ShareAC.dll] [Autodesk, Inc, 17.0.54.0]
[D:\AutoCAD 2007\AcGsConfigRes.dll] [Autodesk Inc., 17.0.54.0]
[D:\AutoCAD 2007\achapi17.dbx] [Autodesk, Inc., 17.0.54.0]
[C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\1d8494594e7b5f662f51dcf07521989a\System.ni.dll] [Microsoft Corporation, 2.0.50727.832 (QFE.050727-8300)]
[D:\AutoCAD 2007\hcreg9.dll] [Autodesk, Inc., 9.0.54.0]
[D:\AutoCAD 2007\hcreg9Res.dll] [Autodesk, Inc., 9.0.54.0]
[C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\94d3c69432102270d2fdc71ad3b0ab76\System.Xml.ni.dll] [Microsoft Corporation, 2.0.50727.832 (QFE.050727-8300)]
[C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\ca657264e48233ba0015c070ff03612e\System.Drawing.ni.dll] [Microsoft Corporation, 2.0.50727.832 (QFE.050727-8300)]
[C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\0e079d53067580a69d5383ad5db0ee33\System.Windows.Forms.ni.dll] [Microsoft Corporation, 2.0.50727.832 (QFE.050727-8300)]
[D:\AutoCAD 2007\acmgd.dll] [Autodesk, Inc., 17.0.54.0]
[D:\AutoCAD 2007\vl.arx] [Autodesk Inc., 17.0.54.0]
[D:\AutoCAD 2007\VLMSG.DLL] [Autodesk Inc., 17.0.54.0]
[D:\AutoCAD 2007\VLLIB.DLL] [Autodesk Inc., 17.0.54.0]
[D:\AutoCAD 2007\AcApp.arx] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcAppRes.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcDblClkEdit.arx] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcDblClkEditPE.arx] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcDblClkEditRes.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\acdim.arx] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\ShareMFC.dll] [Autodesk, Inc, 17.0.54.0]
[D:\AutoCAD 2007\AcDimRes.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\aceplotx.arx] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcEplotXRes.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\achlnkui.arx] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\achlnkuiRes.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcIDropMgr.arx] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcIDropMgrRes.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcLayerP.arx] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcLayerPRes.dll] [Autodesk, Inc., 17.0.54.0]
[D:\AutoCAD 2007\AcPltStamp.arx] [Autodesk, Inc., 17.0.54.0]
[D:\AutoCAD 2007\apperr.dll] [Autodesk, Inc., 9.0.54.0]
[D:\AutoCAD 2007\plotcfg9.dll] [Autodesk, Inc., 9.0.54.0]
[D:\AutoCAD 2007\pm9.dll] [Autodesk, Inc., 9.0.54.0]
[D:\AutoCAD 2007\pctres9.dll] [Autodesk, Inc., 9.0.54.0]
[D:\AutoCAD 2007\apperrRes.dll] [Autodesk, Inc., 9.0.54.0]
[D:\AutoCAD 2007\pmres9.dll] [Autodesk, Inc., 9.0.54.0]
[D:\AutoCAD 2007\AcPltStampRes.dll] [Autodesk, Inc., 17.0.54.0]
[D:\AutoCAD 2007\AcSign.arx] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcSignRes.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcSpaceTrans.arx] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcSpaceTransRes.dll] [Autodesk, Inc., 17.0.54.0]
[D:\AutoCAD 2007\AcStd.arx] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcStStdRes.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcStMgr.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcStRes.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcTaskBar.arx] [Autodesk, Inc., 17.0.54.0]
[D:\AutoCAD 2007\AcTaskBarRes.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcTp.arx] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcTc.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcUt.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcTcUi.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcTcRes.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcTcUiRes.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\whohas.arx] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\whohasRes.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcCamera.arx] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcSceneRes.dll] [Autodesk, Inc., 17.0.54.0]
[D:\AutoCAD 2007\AcDwgRecovery.arx] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcDwgRecoveryRes.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcDxUi.dll] [Autodesk, Inc, 17.0.54.0]
[D:\AutoCAD 2007\AcDx.dll] [Autodesk, Inc, 17.0.54.0]
[D:\AutoCAD 2007\zh-CN\AcDxUi.resources.dll] [Autodesk, Inc, 17.0.54.0]
[D:\AutoCAD 2007\AcDxNotify.arx] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcDxNotifyRes.dll] [Autodesk, Inc., 17.0.54.0]
[D:\AutoCAD 2007\AcMgdShared.dll] [Autodesk, Inc, 17.0.54.0]
[D:\AutoCAD 2007\acetlodr.arx] [Autodesk, Inc., 17.0.54.0]
[D:\AutoCAD 2007\AcLayer.dll] [Autodesk, Inc, 17.0.54.0]
[D:\AutoCAD 2007\zh-CN\AcLayer.resources.dll] [Autodesk, Inc, 17.0.54.0]
[D:\AutoCAD 2007\AcPrevInput.arx] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\WSCommCntrAcCon.arx] [Autodesk, Inc., 17.0.54.0]
[D:\AutoCAD 2007\WSCommCntrAcConRes.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\support\vel.arx] [, 1, 0, 0, 1]
[D:\AutoCAD 2007\AcPrevInputRes.dll] [Autodesk, Inc., 17.0.54.0]
[D:\AutoCAD 2007\plcfmgr.dll] [Autodesk, Inc., 9.0.54.0]
[D:\AutoCAD 2007\plcfmgrRes.dll] [Autodesk, Inc., 9.0.54.0]
[D:\AutoCAD 2007\plcferr.dll] [Autodesk, Inc., 9.0.54.0]
[D:\AutoCAD 2007\pmutil9.dll] [Autodesk, Inc., 9.0.54.0]
[D:\AutoCAD 2007\AcProject17.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcProject17res.dll] [Autodesk, 17.0.54.0]
[C:\WINDOWS\system32\AcSignIcon.dll] [Autodesk, 17.0.54.0]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scrchpg.dll] [Kaspersky Lab, 6.0.2.621]
[D:\AutoCAD 2007\acmgdinternal.dll] [Autodesk, Inc., 17.0.54.0]
[C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] [Autodesk, 17.0.54.110]
[D:\AutoCAD 2007\acmted.arx] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcMtedRes.dll] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcFdUi.arx] [Autodesk, 17.0.54.0]
[D:\AutoCAD 2007\AcFieldRes.dll] [Autodesk, 17.0.54.0]
[C:\WINDOWS\system32\WINWBCS.IME] [somh@email.com, 5.00.2000.3]
[C:\WINDOWS\system32\SOGOUPY.IME] [Sohu.com Inc., 3, 0, 0, 0]
[C:\WINDOWS\system32\dllMergeDict.dll] [Sogou.com Inc., 3, 0, 0, 0]
[F:\应用程序\SogouInput\Plugin\SgImeWord.dll] [, 1, 0, 0, 31]

wuqing0425 - 2007-12-10 14:38:00

[PID: 408 / Administrator][C:\Program Files\Common Files\Autodesk Shared\WSCommCntr1.exe] [Autodesk, Inc., 17.0.54.0]
[C:\Program Files\Common Files\Autodesk Shared\WebServices1.dll] [Autodesk, Inc., 17.0.54.0]
[PID: 2948 / Administrator][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scrchpg.dll] [Kaspersky Lab, 6.0.2.621]
[C:\WINDOWS\system32\AcSignIcon.dll] [Autodesk, 17.0.54.0]
[C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\klscav.dll] [Kaspersky Lab, 6.0.2.621]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll] [Kaspersky Lab, 6.0.2.621]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\WINWBCS.IME] [somh@email.com, 5.00.2000.3]
[C:\WINDOWS\system32\SOGOUPY.IME] [Sohu.com Inc., 3, 0, 0, 0]
[C:\WINDOWS\system32\dllMergeDict.dll] [Sogou.com Inc., 3, 0, 0, 0]
[F:\应用程序\SogouInput\Plugin\SgImeWord.dll] [, 1, 0, 0, 31]
[C:\WINDOWS\system32\Macromed\Flash\Flash9d.ocx] [Adobe Systems, Inc., 9,0,47,0]
[C:\WINDOWS\system32\Audiodev.dll] [Microsoft Corporation, 5.2.3802.3802 built by: dnsrv(bld4act)]
[PID: 3268 / Administrator][D:\Program Files\Rising\Rav\RsAgent.exe] [Beijing Rising Technology Co., Ltd., 20.0.0.7]
[C:\WINDOWS\system32\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[D:\Program Files\Rising\Rav\ProcCom.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[D:\Program Files\Rising\Rav\RsCommX2.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[PID: 4044 / Administrator][C:\WINDOWS\msagent\AgentSvr.exe] [Microsoft Corporation, 2.00.0.3424]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 3224 / Administrator][F:\学习\sreng2\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]
[F:\学习\sreng2\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]

==================================
文件关联
.TXT Error. [C:\WINDOWS\notepad.exe %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM Error. ["hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
N/A

==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 2676, D:\PROGRAM FILES\COOPEN\COOPEN.EXE]

==================================
API HOOK
RVA 错误： LoadLibraryA (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA 错误： LoadLibraryExA (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA 错误： LoadLibraryExW (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA 错误： LoadLibraryW (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA 错误： GetProcAddress (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)

==================================
隐藏进程
N/A

==================================

附件: 98868020071210142738.txt

瑞星卡卡安全论坛