打开浏览器慢，还有火狐 bbs.ikaka.com

上墙头等红杏 - 2007-12-28 15:24:00

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<Internat.exe><internat.exe> [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Synchronization Manager><mobsync.exe /logon> [(Verified)Microsoft Windows 2000 Publisher]
<SoundMan><SOUNDMAN.EXE> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<IgfxTray><C:\WINNT\System32\igfxtray.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<HotKeysCmds><C:\WINNT\System32\hkcmd.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<RestoreIT!><"C:\Program Files\FarStone\RestoreIT!\RestoreIT!_2K\VBPTASK.EXE" VBStart> [N/A]
<RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [(Verified)Beijing Rising Science and Technology Corporation Limited]
<RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [(Verified)Beijing Rising Science and Technology Corporation Limited]
<WangWang><"C:\Program Files\Alisoft\WangWang\WangWang.EXE"> [(Verified)"Alibaba Software(Shanghai)Co,. Ltd"]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows 2000 Publisher]
<Userinit><C:\WINNT\system32\userinit.exe,> [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINNT\system32\RavExt.dll> [(Verified)Beijing Rising Science and Technology Corporation Limited]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer 访问><"C:\WINNT\system32\shmgrate.exe" OCInstallUserConfigIE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express 访问><"C:\WINNT\system32\shmgrate.exe" OCInstallUserConfigOE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\wmp.inf,PerUserStub> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<Address Book 5><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}]
<CRLUpdate><%SystemRoot%\System32\updcrl.exe -e -u %SystemRoot%\System32\verisignpub1.crl> [N/A]
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><(无)> [N/A]

==================================
启动文件夹
[腾讯QQ]
<C:\Documents and Settings\user\「开始」菜单\程序\启动\腾讯QQ.lnk --> C:\PROGRA~1\Tencent\QQ\QQ.exe [TENCENT]><N>

==================================
服务
[Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start]
<C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[Rising Proxy Service / RfwProxySrv][Running/Auto Start]
<c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService][Running/Auto Start]
<c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
<"C:\PROGRAM FILES\RISING\RAV\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[Windows Manager MicroSoft IMM / SogouService][Running/Auto Start]
<C:\WINNT\MicroSoftImm.exe><Sogou.com>
[Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start]
<C:\WINNT\System32\svchost.exe -k netsvcs-->C:\WINNT\system32\mspmsnsv.dll><Microsoft Corporation>

==================================
驱动程序
[Service for WDM 3D Audio Driver / ALCXSENS][Running/Manual Start]
<system32\drivers\ALCXSENS.SYS><Sensaura Ltd>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[ICatch (VI) PC Camera / CA561][Running/Manual Start]
<System32\Drivers\SPCA561.SYS><SP>
[dmboot / dmboot][Stopped/Disabled]
<System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio][Running/Boot Start]
<\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload][Running/Boot Start]
<\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[f7i0luho / f7i0luho][Running/Auto Start]
<\??\C:\WINNT\system32\drivers\f7i0luho.sys><N/A>
[HookCont / HookCont][Running/System Start]
<\SystemRoot\system32\drivers\HookCont.sys><Beijing Rising Technology Co., Ltd>
[HookNtos / HookNtos][Running/System Start]
<\SystemRoot\system32\drivers\HookNtos.sys><Beijing Rising Technology Co., Ltd>
[HookReg / HookReg][Running/System Start]
<\SystemRoot\system32\drivers\HookReg.sys><Beijing Rising Technology Co., Ltd>
[HookSys / HookSys][Running/System Start]
<\SystemRoot\system32\drivers\HookSys.sys><Beijing Rising Technology Co., Ltd>
[HookUrl / HookUrl][Running/Auto Start]
<\??\C:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[ialm / ialm][Running/Manual Start]
<System32\DRIVERS\ialmnt5.sys><Intel Corporation>
[lenr8k / lenr8kd][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\lenr8kd.sys><N/A>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\C:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Rising Rfwbase Driver / RfwBase][Running/Auto Start]
<System32\DRIVERS\rfwbase.SYS><Beijing Rising Technology Co., Ltd.>
[PPPoE Protocol / RMSPPPOE][Running/Manual Start]
<system32\DRIVERS\RMSPPPOE.SYS><Robert Schlabbach>
[RsFwDrv / RsFwDrv][Running/System Start]
<\??\C:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[Realtek RTL8139-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
<System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
<System32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[Intel(R) Graphics Platform (SoftBIOS) Driver / {6080A529-897E-4629-A488-ABA0C29B635E}][Running/Manual Start]
<system32\drivers\ialmsbw.sys><Intel Corporation>
[Intel(R) Graphics Chipset (KCH) Driver / {D31A0762-0CEB-444e-ACFF-B049A1F6FE91}][Running/Manual Start]
<system32\drivers\ialmkchw.sys><Intel Corporation>

==================================
浏览器加载项
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\System32\msdxm.ocx, Microsoft Corporation>
[QQToolbar]
{29CF293A-1E7D-4069-9E11-E39698D0AF95} <C:\Program Files\Tencent\QQToolbar\IEBar.dll, TENCENT>
[EditCtrl Class]
{488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINNT\system32\aliedit\aliedit.dll, >
[AxInputControl Class]
{73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\WINNT\DOWNLO~1\INPUTC~1.DLL, >
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash9e.ocx, Adobe Systems, Inc.>
[XMP Class]
{6483F145-A768-4C41-AACC-52D4D7845851} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xplayer.dll_1_work, >
[XDRM]
{693571CB-54A3-4E90-9D52-EEAE1334E2D3} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xdrm.dll_1_work, >
[WangWangObj Class]
{6E213FC7-DD5A-4115-B7E6-D4C7838C361E} <C:\Program Files\Alisoft\WangWang\WangWangX4.dll, 阿里巴巴软件(上海)有限公司>
[RMGetLicense Class]
{A9FC132B-096D-460B-B7D5-1DB0FAE0C062} <C:\WINNT\system32\msnetobj.dll, Microsoft Corporation>
[XPPlayer Class]
{F3E70CEA-956E-49CC-B444-73AFE593AD7F} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\pplayer.dll_1_work, Thunder>
[添加到QQ表情]

[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

上墙头等红杏 - 2007-12-28 15:25:00

<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>

==================================
正在运行的进程
[PID: 148][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.00.2195.6601]
[PID: 180][\??\C:\WINNT\system32\csrss.exe] [Microsoft Corporation, 5.00.2195.6601]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 200][\??\C:\WINNT\system32\winlogon.exe] [Microsoft Corporation, 5.00.2195.6997]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 228][C:\WINNT\system32\services.exe] [Microsoft Corporation, 5.00.2195.7035]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[C:\WINNT\system32\dmserver.dll] [VERITAS Software Corp., 2195.6605.297.3]
[PID: 240][C:\WINNT\system32\lsass.exe] [Microsoft Corporation, 5.00.2195.7011]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 504][c:\program files\rising\rfw\rfwstub.exe] [Beijing Rising Technology Co., Ltd., 7.0.0.10]
[C:\WINNT\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINNT\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[c:\program files\rising\rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16]
[PID: 716][C:\PROGRAM FILES\RISING\RAV\RavStub.exe] [Beijing Rising Technology Co., Ltd., 20.0.0.9]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[C:\PROGRAM FILES\RISING\RAV\ProcCom.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[C:\PROGRAM FILES\RISING\RAV\RsCommX2.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[C:\PROGRAM FILES\RISING\RAV\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16]
[PID: 780][C:\WINNT\system32\svchost.exe] [Microsoft Corporation, 5.00.2134.1]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 812][C:\WINNT\system32\spoolsv.exe] [Microsoft Corporation, 5.00.2195.7059]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 860][C:\WINNT\System32\svchost.exe] [Microsoft Corporation, 5.00.2134.1]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 916][C:\WINNT\system32\regsvc.exe] [Microsoft Corporation, 5.00.2195.6701]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 1016][C:\WINNT\system32\MSTask.exe] [Microsoft Corporation, 4.71.2195.6972]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 1052][C:\WINNT\MicroSoftImm.exe] [Sogou.com, 1.0.0.21]
[PID: 1096][C:\WINNT\system32\stisvc.exe] [Microsoft Corporation, 5.00.2195.6656]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 1144][C:\WINNT\System32\WBEM\WinMgmt.exe] [Microsoft Corporation, 1.50.1085.0100]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 1164][C:\WINNT\system32\svchost.exe] [Microsoft Corporation, 5.00.2134.1]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 1264][C:\WINNT\Explorer.EXE] [Microsoft Corporation, 5.00.3700.6690]
[C:\WINNT\System32\igfxpph.dll] [Intel Corporation, 3.0.0.2285]
[C:\WINNT\System32\hccutils.DLL] [Intel Corporation, 3.0.0.2285]
[C:\WINNT\system32\igfxres.dll] [Intel Corporation, 3.0.0.2285]
[C:\WINNT\System32\igfxsrvc.dll] [Intel Corporation, 3.0.0.2285]
[C:\WINNT\System32\igfxdev.dll] [Intel Corporation, 3.0.0.2285]
[C:\WINNT\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.17]
[C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 3]
[C:\WINNT\system32\igfxress.dll] [Intel Corporation, 3.0.0.2285]
[C:\WINNT\system32\ALSNDMGR.CPL] [Realtek Semiconductor Corp., 2.2.08]
[C:\WINNT\system32\igfxcpl.cpl] [Intel Corporation, 3.0.0.2285]
[PID: 1568][C:\WINNT\SOUNDMAN.EXE] [Realtek Semiconductor Corp., 5.1.11]
[PID: 1592][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] [RealNetworks, Inc., 0.1.0.3208]
[PID: 1608][C:\Program Files\FarStone\RestoreIT!\RestoreIT!_2K\VBPTASK.EXE] [FarStone Tech. Inc., 2, 0, 0, 0]
[C:\Program Files\FarStone\RestoreIT!\RestoreIT!_2K\VBCfg.dll] [N/A, ]
[C:\Program Files\FarStone\RestoreIT!\RestoreIT!_2K\MFC42.DLL] [Microsoft Corporation, 6.00.8168.0]
[C:\Program Files\FarStone\RestoreIT!\RestoreIT!_2K\FarTCP.dll] [FarStone Technology Inc., 7, 0, 0, 0]
[C:\Program Files\FarStone\RestoreIT!\RestoreIT!_2K\vbioctl.dll] [Farstote inc., 2, 0, 0, 0]
[C:\Program Files\FarStone\RestoreIT!\RestoreIT!_2K\fssti.dll] [N/A, ]
[C:\Program Files\FarStone\RestoreIT!\RestoreIT!_2K\multidsk.dll] [N/A, ]
[C:\Program Files\FarStone\RestoreIT!\RestoreIT!_2K\GBANDBIG.dll] [, 1, 0, 0, 1]
[C:\Program Files\FarStone\RestoreIT!\RestoreIT!_2K\crterp.dll] [FarStone Tech. Inc., 2, 0, 1, 0]
[PID: 1628][C:\Program Files\Rising\Rav\RavTask.exe] [Beijing Rising Technology Co., Ltd., 20.0.0.22]
[C:\Program Files\Rising\Rav\ProcCom.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[C:\Program Files\Rising\Rav\RsCommX2.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 20.0.0.0]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.10]
[PID: 1632][C:\WINNT\system32\wuauclt.exe] [Microsoft Corporation, 5.4.3630.2554 built by: lab04_n]
[PID: 1000][C:\WINNT\system32\conime.exe] [Microsoft Corporation, 5.00.2195.6655]
[PID: 2244][C:\DOCUME~1\user\LOCALS~1\Temp\Rar$EX00.922\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]
[C:\DOCUME~1\user\LOCALS~1\Temp\Rar$EX00.922\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINNT\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

上墙头等红杏 - 2007-12-28 15:25:00

N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost
127.0.0.1 update.cpushpop.com
127.0.0.1 image.yahoo550.com
127.0.0.1 gs.chnsystem.com
127.0.0.1 msl.chnsystem.com
127.0.0.1 ssl.chnsystem.com
127.0.0.1 www.gagagaga.cn
127.0.0.1 down.1024tb.com
127.0.0.1 xconf.coopen.cn
127.0.0.1 log.xplayer.coopen.cn
127.0.0.1 xfile.coopen.cn
127.0.0.1 loader.smartpv.cn
127.0.0.1 alerts.xiaoi.com
127.0.0.1 sports.yahoo550.com
127.0.0.1 update.cnnic.cn
127.0.0.1 jump.cnnic.cn
127.0.0.1 login.zuoyoukongjian.com
127.0.0.1 adfirefox.cn
127.0.0.1 3.wornm.cn
127.0.0.1 5.haokandi.cn
127.0.0.1 b.downadown.cn
127.0.0.1 update.iesuper.com
127.0.0.1 888.843call.cn
127.0.0.1 122.770304123.cn
127.0.0.1 110.770304123.cn
127.0.0.1 343.boolans.com
127.0.0.1 update.smartpv.cn
127.0.0.1 update146.smartpv.cn
127.0.0.1 js4.all4ad.net
127.0.0.1 click2.ad4all.net
127.0.0.1 www.papaop.com
127.0.0.1 realname.webbrowser.smartpv.cn
127.0.0.1 login.webbrowser.smartpv.cn
127.0.0.1 www.cnphp5.com
127.0.0.1 www.133c.cn
127.0.0.1 zhoupk256.3322.org
127.0.0.1 udp.hjob123.com
127.0.0.1 d4.kkads.cn
127.0.0.1 www.zhaoyou8.com
127.0.0.1 www.kkads.cn
127.0.0.1 travel.yahoo550.com
127.0.0.1 soft.16990.com
127.0.0.1 livenews.265.com
127.0.0.1 bak.hjob123.com
127.0.0.1 www.jesuser.cn
127.0.0.1 class.caiyi8.com
127.0.0.1 ownload.baofeng.com
127.0.0.1 www.177i.com
127.0.0.1 www.81891111.com
127.0.0.1 33.xingaide8.cn
127.0.0.1 444.916kk.com
127.0.0.1 www.916kk.com
127.0.0.1 soft2.86sifu.com
127.0.0.1 google.netcdn.com
127.0.0.1 lm.9cdn.com
127.0.0.1 www.z88.com.cn
127.0.0.1 adswin.unet.hk
127.0.0.1 www.borlander.com.cn
127.0.0.1 cab.borlander.com.cn
127.0.0.1 www.333292.com
127.0.0.1 net.jnnic.com
127.0.0.1 www.plunix.org
127.0.0.1 ip.9cdn.com
127.0.0.1 test8.b190.west263.cn
127.0.0.1 yz.jz173.com
127.0.0.1 www.yy17173.cn
127.0.0.1 www.daydayshop.cn
127.0.0.1 www.yahoo550.com
127.0.0.1 wifayy.51vip.biz
127.0.0.1 sss.969222.com

==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 1052, C:\WINNT\MICROSOFTIMM.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1592, C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1608, C:\PROGRAM FILES\FARSTONE\RESTOREIT!\RESTOREIT!_2K\VBPTASK.EXE]

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================

[/CODE]

CAPTjoe - 2007-12-28 15:36:00

不熟悉win200,但是看到两项可以驱动
[f7i0luho / f7i0luho][Running/Auto Start]
<\??\C:\WINNT\system32\drivers\f7i0luho.sys><N/A>
[lenr8k / lenr8kd][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\lenr8kd.sys><N/A>

还有这个屏保的名字也比较怪，你自己判断
注册表
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><(无)> [N/A]

上墙头等红杏 - 2007-12-28 17:05:00

我不会弄啊，菜鸟一个

CAPTjoe - 2007-12-28 18:07:00

引用:

【上墙头等红杏的贴子】我不会弄啊，菜鸟一个
………………

你是否自己安装什么屏幕保护程序？

建议
打开SREng-在"启动项目->服务->驱动程序"选中"隐藏已认证的微软服务" 然后将下面名称的服务禁用（选中有问题的服务后，点中修改启动类型，在下拉框中选择“disable",点设置):
[f7i0luho / f7i0luho][Running/Auto Start] <\??\C:\WINNT\system32\drivers\f7i0luho.sys>
[lenr8k / lenr8kd][Running/Boot Start] <\SystemRoot\System32\DRIVERS\lenr8kd.sys>

瑞星卡卡安全论坛