瑞星卡卡安全论坛
昏天黑地alpha - 2008-1-8 15:12:00
今天用正版瑞星杀出两个病毒。
Trojan.DL.Script.JS.Agent.lst
Adware.Win32.Agent.nrc
杀毒后，计算机运行缓慢。重起后提醒无法加载：m6uowlk.dll（怀疑这是病毒随机生成的文件名）。打开“我的电脑，网上邻居，IE浏览器之类windowsXP自带软件”的速度极其缓慢。
而运行autocad等软件的时候却没有任何问题。
求高手给点解决办法。公司内用的电脑，重装的话，太浪费时间。
在线等~~~~
按照天月大大的方法，又杀出两个病毒：
Dropper.Win32.Agent.zbx
Hack.Exploit.Script.JS.Small.d
最初的情况已经消失，计算机看起来是恢复正常了。
不过在启动的时候，依然会提示：无法加载：m6uowlk.dll
请问该如何处理附件中是最新的扫描日志了，请过目。
另外，在注册表里搜索不到有关：m6uowlk.dll的任何项附件:
1001452200819135342.txt
千寻旅 - 2008-1-8 15:33:00
打开注册表，把m6uowlk.dll删除掉试试。
火影忍者 - 2008-1-8 16:13:00
下载 System Repair Engineer，
http://www.kztechs.com/sreng/download.html
1 解压缩sreng2.zip
2 运行SREng.exe
3 智能扫描=》扫描=》保存报告
4 把日志中的报告完整拷贝贴上来，不要修改
日志一次发不完，请分次发上来
昏天黑地alpha - 2008-1-8 16:31:00
[CODE]
2008-01-08,16:12:07
System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 2 (Build 2600) - Administrative User - Completed Functions Allowed
Follow item(s) have been choosed:
All Boot Items (Including Registry, Startup Folders, Services and so on)
Browser Add-ons
Runing Processes (Including process model information)
File Associations
Winsock Provider
Autorun.Inf
HOSTS File
Process Privileges Scan
Boot Items
Registry
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Publisher]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows Publisher]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows Publisher]
<RTHDCPL><RTHDCPL.EXE> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<Alcmtr><ALCMTR.EXE> [(Verified)Microsoft Windows Publisher]
<RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [(Verified)Beijing Rising Science and Technology Corporation Limited]
<RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [(Verified)Beijing Rising Science and Technology Corporation Limited]
<IMJPMIG9.0><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMJP9\IMJPMIG.EXE /Preload /Migration32> [(Verified)Microsoft Corporation]
<IMSCMIG40W><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40W\IMSCMIG.EXE /SetPreload /Log> [Microsoft Corporation]
<Acrobat Assistant 8.0><"C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"> [(Verified)"Adobe Systems, Incorporated"]
<runeip><"C:\Program Files\Rising\AntiSpyware\runiep.exe" /startup> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<KKDelay><C:\Program Files\Rising\AntiSpyware\RunOnce.exe> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Component Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [(Verified)Beijing Rising Science and Technology Corporation Limited]
<{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}><C:\WINDOWS\system32\shlhook.dll> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
<Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<アドレス帳 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
<N/A><C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install> [Microsoft Corporation]
==================================
Startup Folders
[AutoCAD Startup Accelerator]
<C:\Documents and Settings\All Users\スタート メニュー\プログラム\スタートアップ\AutoCAD Startup Accelerator.lnk --> C:\PROGRA~1\COMMON~1\AUTODE~1\ACSTAR~1.EXE [Autodesk, Inc]><N>
==================================
Services
[Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start]
<C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[ATI Smart / ATI Smart][Stopped/Auto Start]
<C:\WINDOWS\system32\ati2sgag.exe><>
[Autodesk Licensing Service / Autodesk Licensing Service][Running/Manual Start]
<"C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe"><Autodesk, Inc.>
[FLEXnet Licensing Service / FLEXnet Licensing Service][Running/Manual Start]
<"C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe"><Macrovision Europe Ltd.>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Rising Proxy Service / RfwProxySrv][Running/Auto Start]
<c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService][Running/Auto Start]
<c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
<"C:\PROGRAM FILES\RISING\RAV\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
==================================
Drivers
[ati2mtag / ati2mtag][Running/Manual Start]
<system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[d347bus / d347bus][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\d347bus.sys><>
[d347prt / d347prt][Running/Boot Start]
<\SystemRoot\System32\Drivers\d347prt.sys><>
[gdrv / gdrv][Stopped/Manual Start]
<\??\C:\WINDOWS\gdrv.sys><Windows (R) 2000 DDK provider>
[ATI Function Driver for High Definition Audio Service / HdAudAddService][Running/Manual Start]
<system32\drivers\AtiHdAud.sys><ATI Research Inc.>
[Microsoft UAA Bus Driver for High Definition Audio / HDAudBus][Running/Manual Start]
<system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
[HookCont / HookCont][Running/System Start]
<\SystemRoot\system32\drivers\HookCont.sys><Beijing Rising Technology Co., Ltd>
[HookNtos / HookNtos][Running/System Start]
<\SystemRoot\system32\drivers\HookNtos.sys><Beijing Rising Technology Co., Ltd>
[HookReg / HookReg][Running/System Start]
<\SystemRoot\system32\drivers\HookReg.sys><Beijing Rising Technology Co., Ltd>
[HookSys / HookSys][Running/System Start]
<\SystemRoot\system32\drivers\HookSys.sys><Beijing Rising Technology Co., Ltd>
[HookUrl / HookUrl][Running/Auto Start]
<\??\C:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[Service for Realtek HD Audio (WDM) / IntcAzAudAddService][Running/Manual Start]
<system32\drivers\RtkHDAud.sys><Realtek Semiconductor Corp.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Rising Rfwbase Driver / RfwBase][Running/Auto Start]
<System32\DRIVERS\rfwbase.SYS><Beijing Rising Technology Co., Ltd.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
<\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising Technology Co., Ltd.>
[RsFwDrv / RsFwDrv][Running/System Start]
<\??\C:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver / RTLE8023xp][Running/Manual Start]
<system32\DRIVERS\Rtenicxp.sys><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
[tdnal0 / tdnal0e][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\tdnal0e.sys><N/A>
[thsi4q9j / thsi4q9j][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\thsi4q9j.sys><N/A>
昏天黑地alpha - 2008-1-8 16:33:00
==================================
Browser Add-ons
[Adobe PDF Reader Link Helper]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[]
{16C6167B-FED4-4CEE-8951-134C9A345DA2} <C:\WINDOWS\system32\ffpomwcjsb.dll, >
[Adobe PDF Conversion Toolbar Helper]
{AE7CD045-E861-484f-8273-0445EE161910} <C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll, Adobe Systems Incorporated>
[リサーチ(&R)]
{92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[Adobe PDF]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} <C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll, Adobe Systems Incorporated>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\Flash.ocx, Macromedia, Inc.>
[Adobe PDF Reader Link Helper]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[]
{16C6167B-FED4-4CEE-8951-134C9A345DA2} <C:\WINDOWS\system32\ffpomwcjsb.dll, >
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[DHTML Edit Control Safe for Scripting for IE5]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[Adobe PDF]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} <C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll, Adobe Systems Incorporated>
[XML Document]
{48123BC4-99D9-11D1-A6B3-00C04FD91555} <%SystemRoot%\system32\msxml3.dll, N/A>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Microsoft Web Browser]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Adobe PDF Conversion Toolbar Helper]
{AE7CD045-E861-484F-8273-0445EE161910} <C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll, Adobe Systems Incorporated>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
{CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\Flash.ocx, Macromedia, Inc.>
[Adobe PDF に変換]
<res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html, N/A>
[Microsoft Excel にエクスポート(&X)]
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[リンクの参照先を Adobe PDF に変換]
<res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html, N/A>
[リンクの参照先を既存の PDF に変換]
<res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html, N/A>
[既存の PDF に追加]
<res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html, N/A>
[選択したリンクを Adobe PDF に変換]
<res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html, N/A>
[選択したリンクを既存の PDF に変換]
<res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html, N/A>
[選択項目を Adobe PDF に変換]
<res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html, N/A>
[選択項目を既存の PDF に変換]
<res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html, N/A>
昏天黑地alpha - 2008-1-8 16:34:00
==================================
Running Processes
[PID: 644 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 708 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 736 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[C:\WINDOWS\system32\Ati2evxx.dll] [ATI Technologies Inc., 6.14.10.4163]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[C:\WINDOWS\system32\IMJP9.IME] [Microsoft Corporation, 9.0.5516.0]
[C:\WINDOWS\system32\imjp9k.dll] [Microsoft Corporation, 9.0.5510.0]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 780 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\AppPatch\AcAdProc.dll] [Microsoft Corporation, 5.1.2600.3008 (xpsp.061004-0027)]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 792 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 956 / SYSTEM][C:\WINDOWS\system32\Ati2evxx.exe] [ATI Technologies Inc., 6.14.10.4174]
[C:\WINDOWS\system32\Ati2edxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2512]
[C:\WINDOWS\system32\atipdlxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2522]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 972 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 1048 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 1160 / SYSTEM][C:\Program Files\Rising\Rav\CCenter.exe] [Beijing Rising Technology Co., Ltd., 20.0.0.28]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 1176 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[C:\WINDOWS\system32\wups2.dll] [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]
[PID: 1268 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 1372 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 1388 / SYSTEM][C:\PROGRAM FILES\RISING\RAV\Ravmond.exe] [Beijing Rising Technology Co., Ltd., 20.0.0.60]
[C:\PROGRAM FILES\RISING\RAV\BWList.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.4]
[C:\WINDOWS\system32\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MFC71JPN.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\PROGRAM FILES\RISING\RAV\RSAPPMGR.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.0]
[C:\PROGRAM FILES\RISING\RAV\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.10]
[C:\PROGRAM FILES\RISING\RAV\RsLog.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.30]
[C:\PROGRAM FILES\RISING\RAV\ProcCom.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[C:\PROGRAM FILES\RISING\RAV\RsCommX2.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[C:\PROGRAM FILES\RISING\RAV\MonRule.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.24]
[C:\PROGRAM FILES\RISING\RAV\Hooksys.dll] [Beijing Rising Technology Co., Ltd, 22, 0, 0, 7]
[C:\PROGRAM FILES\RISING\RAV\HookReg.dll] [Beijing Rising Technology Co., Ltd, 22, 0, 0, 2]
[C:\PROGRAM FILES\RISING\RAV\HookNtos.dll] [Beijing Rising Technology Co., Ltd, 22, 0, 0, 2]
[C:\PROGRAM FILES\RISING\RAV\rswalmon.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 22]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[C:\PROGRAM FILES\RISING\RAV\recomp.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 20]
[C:\PROGRAM FILES\RISING\RAV\refs.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 11]
[C:\PROGRAM FILES\RISING\RAV\ffr.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 10]
[C:\Program Files\Rising\Rav\RsStore.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.8]
[C:\PROGRAM FILES\RISING\RAV\HookCont.dll] [Beijing Rising Technology Co., Ltd, 22, 0, 0, 1]
[C:\Program Files\Rising\Rav\fakescan.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.13]
[C:\Program Files\Rising\Rav\Scanner.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.35]
[C:\PROGRAM FILES\RISING\RAV\viruslib.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16]
[C:\PROGRAM FILES\RISING\RAV\relibldr.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 13]
[C:\PROGRAM FILES\RISING\RAV\HookWeb.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.2]
[C:\WINDOWS\system32\IMJP9.IME] [Microsoft Corporation, 9.0.5516.0]
[C:\WINDOWS\system32\imjp9k.dll] [Microsoft Corporation, 9.0.5510.0]
[C:\PROGRAM FILES\RISING\RAV\extfile.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 24]
[C:\PROGRAM FILES\RISING\RAV\pearc.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 5]
[C:\PROGRAM FILES\RISING\RAV\nvfile.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 3]
[C:\PROGRAM FILES\RISING\RAV\scanexec.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 13]
[C:\PROGRAM FILES\RISING\RAV\unexe.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 4]
[C:\PROGRAM FILES\RISING\RAV\scanex.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 33]
[C:\PROGRAM FILES\RISING\RAV\scanpack.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 7]
[C:\PROGRAM FILES\RISING\RAV\revm.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 8]
[C:\PROGRAM FILES\RISING\RAV\urutils.dll] [, 20, 0, 0, 2]
[C:\PROGRAM FILES\RISING\RAV\ur000.dat] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 1]
[C:\PROGRAM FILES\RISING\RAV\scansct.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 6]
[C:\PROGRAM FILES\RISING\RAV\scriptci.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 3]
[C:\PROGRAM FILES\RISING\RAV\uroutine.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 26]
[C:\PROGRAM FILES\RISING\RAV\extmail.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 9]
昏天黑地alpha - 2008-1-8 16:34:00
[PID: 1420 / SYSTEM][c:\program files\rising\rfw\rfwsrv.exe] [Beijing Rising Technology Co., Ltd., 7.0.0.65]
[C:\WINDOWS\system32\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MFC71JPN.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\Program Files\Rising\Rfw\ProcCom.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[c:\program files\rising\rfw\RsCommX2.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[c:\program files\rising\rfw\RSAPPMGR.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.0]
[c:\program files\rising\rfw\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.10]
[c:\program files\rising\rfw\RfwRule.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.13]
[c:\program files\rising\rfw\rfwlog.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.12]
[c:\program files\rising\rfw\Rfwdrv.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.41]
[c:\program files\rising\rfw\psapi.dll] [Microsoft Corporation, 4.00]
[c:\program files\rising\rfw\ijt_ctrl.dll] [Beijing Rising Technology Co., Ltd., 7, 0, 0, 0]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[c:\program files\rising\rfw\unvdet.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.5]
[c:\program files\rising\rfw\mPorts.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.3]
[PID: 1592 / SYSTEM][C:\WINDOWS\system32\Ati2evxx.exe] [ATI Technologies Inc., 6.14.10.4174]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[C:\WINDOWS\system32\Ati2edxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2512]
[C:\WINDOWS\system32\atipdlxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2522]
[C:\WINDOWS\system32\ati2evxx.dll] [ATI Technologies Inc., 6.14.10.4163]
[PID: 1840 / SYSTEM][c:\program files\rising\rfw\rfwproxy.exe] [Beijing Rising Technology Co., Ltd., 7.0.0.29]
[C:\WINDOWS\system32\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MFC71JPN.DLL] [Microsoft Corporation, 7.10.3077.0]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[c:\program files\rising\rfw\psapi.dll] [Microsoft Corporation, 4.00]
[C:\Program Files\Rising\Rfw\ProcCom.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[c:\program files\rising\rfw\RsCommX2.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[c:\program files\rising\rfw\RfwRule.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.13]
[c:\program files\rising\rfw\MonMid.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 1864 / SYSTEM][c:\program files\rising\rfw\rfwstub.exe] [Beijing Rising Technology Co., Ltd., 7.0.0.10]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[c:\program files\rising\rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 212 / SYSTEM][C:\PROGRAM FILES\RISING\RAV\RavStub.exe] [Beijing Rising Technology Co., Ltd., 20.0.0.9]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[C:\PROGRAM FILES\RISING\RAV\ProcCom.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[C:\PROGRAM FILES\RISING\RAV\RsCommX2.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[C:\PROGRAM FILES\RISING\RAV\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16]
[PID: 360 / B21][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234)]
[C:\WINDOWS\system32\IMJP9.IME] [Microsoft Corporation, 9.0.5516.0]
[C:\WINDOWS\system32\imjp9k.dll] [Microsoft Corporation, 9.0.5510.0]
[C:\WINDOWS\system32\AcSignIcon.dll] [Autodesk, 16.1.63.0]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.17]
[C:\WINDOWS\system32\shlhook.dll] [Beijing Rising Technology Co., Ltd., 4.0.0.9]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 8.1.0.0]
[C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.JPN] [Adobe Systems, Inc., 8.0.0.0]
[C:\Program Files\Common Files\Microsoft Shared\IME\IMJP9\imjpsqm.dll] [Microsoft Corporation, 9.0.5510.0]
[C:\Program Files\Common Files\Microsoft Shared\IME\IMJP9\DICTS\IMJPCD.DIC] [Microsoft Corporation, 9.0.5510.0]
[C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll] [, 2, 0, 0, 0]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16]
[C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 3]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
[C:\Program Files\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll] [Adobe Systems Inc., 8.1.5.2007051000\0]
[C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 8.0.0.2006102200]
[C:\WINDOWS\system32\ffpomwcjsb.dll] [, 1.0.0.0]
昏天黑地alpha - 2008-1-8 16:34:00
[PID: 548 / B21][c:\program files\rising\rfw\RfwMain.exe] [Beijing Rising Technology Co., Ltd., 7.0.1.48]
[C:\WINDOWS\system32\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[c:\program files\rising\rfw\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 79]
[C:\WINDOWS\system32\MFC71JPN.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\Program Files\Rising\Rfw\ProcCom.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[c:\program files\rising\rfw\RsCommX2.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[c:\program files\rising\rfw\RSAPPMGR.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.0]
[c:\program files\rising\rfw\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.10]
[c:\program files\rising\rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16]
[c:\program files\rising\rfw\RfwCtrl.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.7]
[c:\program files\rising\rfw\RsXML.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 0]
[c:\program files\rising\rfw\PngDll.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 3]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[c:\program files\rising\rfw\RfwRule.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.13]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[PID: 628 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[C:\WINDOWS\system32\AdobePDF.dll] [Adobe Systems Incorporated., 8.0.0.00]
[C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdistRes.JPN] [, ]
[C:\WINDOWS\system32\hpbmmon.dll] [Hewlett-Packard, 10.00.14]
[C:\WINDOWS\system32\hpdomon.dll] [Hewlett-Packard, 03.42.00]
[C:\WINDOWS\system32\HPBHealr.dll] [N/A, ]
[C:\WINDOWS\system32\mdimon.dll] [Microsoft Corporation, 11.3.1897.0]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll] [Microsoft Corporation, 11.3.1897.0]
[PID: 1664 / SYSTEM][C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe] [Microsoft Corporation, 2.0.50727.832 (QFE.050727-8300)]
[C:\WINDOWS\system32\mscoree.dll] [Microsoft Corporation, 2.0.50727.832 (QFE.050727-8300)]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvc.dll] [Microsoft Corporation, 2.0.50727.832 (QFE.050727-8300)]
[PID: 2560 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3064 / B21][C:\WINDOWS\RTHDCPL.EXE] [Realtek Semiconductor Corp., 2.1.3.2]
[C:\WINDOWS\system32\IMJP9.IME] [Microsoft Corporation, 9.0.5516.0]
[C:\WINDOWS\system32\imjp9k.dll] [Microsoft Corporation, 9.0.5510.0]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[PID: 3084 / B21][C:\Program Files\Rising\Rav\RavTask.exe] [Beijing Rising Technology Co., Ltd., 20.0.0.22]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[C:\Program Files\Rising\Rav\ProcCom.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[C:\Program Files\Rising\Rav\RsCommX2.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 20.0.0.0]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.10]
[C:\WINDOWS\system32\IMJP9.IME] [Microsoft Corporation, 9.0.5516.0]
[C:\WINDOWS\system32\imjp9k.dll] [Microsoft Corporation, 9.0.5510.0]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[PID: 3152 / B21][C:\Program Files\Rising\Rav\Ravmon.exe] [Beijing Rising Technology Co., Ltd., 20.0.01.05]
[C:\WINDOWS\system32\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MFC71JPN.DLL] [Microsoft Corporation, 7.10.3077.0]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[C:\Program Files\Rising\Rav\ProcCom.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[C:\Program Files\Rising\Rav\RsCommX2.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16]
[C:\Program Files\Rising\Rav\recomp.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 20]
[C:\Program Files\Rising\Rav\refs.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 11]
[C:\Program Files\Rising\Rav\viruslib.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16]
[C:\Program Files\Rising\Rav\relibldr.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 13]
[C:\Program Files\Rising\Rav\RSAPPMGR.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.0]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.10]
[C:\Program Files\Rising\Rav\MonRule.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.24]
[C:\Program Files\Rising\Rav\PngDll.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 3]
[C:\WINDOWS\system32\IMJP9.IME] [Microsoft Corporation, 9.0.5516.0]
[C:\WINDOWS\system32\imjp9k.dll] [Microsoft Corporation, 9.0.5510.0]
[C:\Program Files\Rising\Rav\Rsguilib.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 79]
[C:\Program Files\Rising\Rav\RsXML.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 0]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[PID: 3176 / B21][C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe] [Adobe Systems Inc., 8.1.0.2007051000]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.jpn] [Adobe Systems Inc., 8.0.0.0]
[C:\Program Files\Adobe\Acrobat 8.0\Acrobat\FNP_Act_Installer.dll] [Macrovision Europe Ltd., 11.03.005]
[C:\Program Files\Adobe\Acrobat 8.0\Acrobat\asneu.dll] [Adobe Systems Inc., 1, 6, 0, 8]
[C:\Program Files\Adobe\Acrobat 8.0\Acrobat\adobe_personalization.dll] [Adobe Systems Incorporated, 2,0,0,37]
[C:\Program Files\Adobe\Acrobat 8.0\Acrobat\adobe_epic.dll] [Adobe Systems Incorporated, 2,0,0,37]
[C:\Program Files\Adobe\Acrobat 8.0\Acrobat\adobe_pcd.dll] [Adobe Systems Incorporated, 1,0,0]
[C:\WINDOWS\system32\IMJP9.IME] [Microsoft Corporation, 9.0.5516.0]
[C:\WINDOWS\system32\imjp9k.dll] [Microsoft Corporation, 9.0.5510.0]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[PID: 3192 / B21][C:\Program Files\Rising\AntiSpyware\runiep.exe] [Beijing Rising Technology Co., Ltd., 4.0.0.19]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[C:\WINDOWS\system32\IMJP9.IME] [Microsoft Corporation, 9.0.5516.0]
[C:\WINDOWS\system32\imjp9k.dll] [Microsoft Corporation, 9.0.5510.0]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
昏天黑地alpha - 2008-1-8 16:35:00
[PID: 3208 / B21][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[C:\WINDOWS\system32\IMJP9.IME] [Microsoft Corporation, 9.0.5516.0]
[C:\WINDOWS\system32\imjp9k.dll] [Microsoft Corporation, 9.0.5510.0]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[PID: 3404 / SYSTEM][C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe] [Macrovision Europe Ltd., 11.03.005]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 3304 / B21][C:\Program Files\AutoCAD 2005\acad.exe] [Autodesk, Inc., R16.1.63.0]
[C:\Program Files\Common Files\Autodesk Shared\ac1st16.dll] [Autodesk, Inc., 16.1.63.0]
[C:\Program Files\AutoCAD 2005\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0]
[C:\Program Files\AutoCAD 2005\MSVCP70.dll] [Microsoft Corporation, 7.00.9466.0]
[C:\Program Files\Common Files\Autodesk Shared\acdb16.dll] [Autodesk, Inc., 16.1.63.10]
[C:\Program Files\Common Files\Autodesk Shared\AcGe16.dll] [Autodesk, Inc., 16.1.63.0]
[C:\Program Files\AutoCAD 2005\MFC70.DLL] [Microsoft Corporation, 7.00.9466.0]
[C:\Program Files\AutoCAD 2005\acui16.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\ANav.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\adui16.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\UserData.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\dswhip.dll] [Autodesk Inc., 16.1.63.0]
[C:\Program Files\AutoCAD 2005\heidi8.dll] [Autodesk, Inc., 8.1.63.0]
[C:\Program Files\AutoCAD 2005\dlint8.dll] [Autodesk, Inc., 8.1.63.0]
[C:\Program Files\AutoCAD 2005\SFTTABAC.dll] [Softel vdm, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\adlmdll.dll] [Autodesk, Inc., 5.0.0.20]
[C:\Program Files\AutoCAD 2005\adctrls.dll] [Autodesk, Inc., 16.1.63.0]
[C:\Program Files\AutoCAD 2005\adui16res.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AnavRes.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\acui16res.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\DsWhipRes.dll] [Autodesk Inc., 16.1.63.0]
[C:\Program Files\AutoCAD 2005\sfttabacRes.dll] [Softel vdm, 16.1.63.0]
[C:\DOCUME~1\B21\LOCALS~1\Temp\AdskCleanup.0001.dir.0000\~df394b.tmp] [N/A, ]
[C:\DOCUME~1\B21\LOCALS~1\Temp\AdskCleanup.0001.dir.0000\~de87df.tmp] [, 2.51.000]
[C:\Program Files\AutoCAD 2005\ADCtrlsRes.dll] [Autodesk, Inc., 16.1.63.0]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[C:\Program Files\AutoCAD 2005\acadbtn.xmx] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\acadres.dll] [Autodesk, Inc., 16.1.63.0]
[C:\Program Files\Common Files\Autodesk Shared\acdb16enures.dll] [Autodesk, Inc., 16.1.63.0]
[C:\WINDOWS\system32\IMJP9.IME] [Microsoft Corporation, 9.0.5516.0]
[C:\WINDOWS\system32\imjp9k.dll] [Microsoft Corporation, 9.0.5510.0]
[C:\WINDOWS\system32\mscoree.dll] [Microsoft Corporation, 2.0.50727.832 (QFE.050727-8300)]
[C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll] [Microsoft Corporation, 2.0.50727.832 (QFE.050727-8300)]
[C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\e55458000435e5976f19cd48f4a50492\mscorlib.ni.dll] [Microsoft Corporation, 2.0.50727.832 (QFE.050727-8300)]
[C:\Program Files\AutoCAD 2005\adlmres.dll] [Autodesk, Inc., 5.0.0.20]
[C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll] [Microsoft Corporation, 2.0.50727.42 (RTM.050727-4200)]
[C:\Program Files\AutoCAD 2005\AcdbMgdHost.dll] [Autodesk, Inc, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\acdbmgd.dll] [Autodesk, Inc., 16.1.63.0]
[C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll] [Microsoft Corporation, 2.0.50727.832 (QFE.050727-8300)]
[C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\216fabde01f2047dabe4d3003563e7e4\System.ni.dll] [Microsoft Corporation, 2.0.50727.832 (QFE.050727-8300)]
[C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\7c0034508265bb78f0d0c176e89ca04f\System.Xml.ni.dll] [Microsoft Corporation, 2.0.50727.832 (QFE.050727-8300)]
[C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\277a654ee1b877d7aedbb1fefc4316a2\System.Drawing.ni.dll] [Microsoft Corporation, 2.0.50727.832 (QFE.050727-8300)]
[C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\bc06c827586216f8811db52f4c381489\System.Windows.Forms.ni.dll] [Microsoft Corporation, 2.0.50727.832 (QFE.050727-8300)]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\Program Files\AutoCAD 2005\PrxyInet.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\PrxyInetRes.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\oleaprot.arx] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\colorRes.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\drv\gdi8.hdi] [Autodesk, Inc., 8.1.63.0]
[C:\Program Files\AutoCAD 2005\drv\gdi8Res.dll] [Autodesk, Inc., 8.1.63.0]
[C:\Program Files\AutoCAD 2005\drv\szb8.hdi] [Autodesk, Inc., 8.1.63.0]
[C:\Program Files\AutoCAD 2005\drv\gdifont8.hdi] [Autodesk, Inc., 8.1.63.0]
[C:\Program Files\AutoCAD 2005\acgs.dll] [Autodesk Inc., 16.1.63.0]
[C:\Program Files\AutoCAD 2005\acgsRes.dll] [Autodesk Inc., 16.1.63.0]
[c:\program files\common files\autodesk shared\achapi16.dbx] [Autodesk, Inc., 16.1.63.0]
[C:\Program Files\AutoCAD 2005\hcreg8.dll] [Autodesk, Inc., 8.1.63.0]
[C:\Program Files\AutoCAD 2005\hcreg8Res.dll] [Autodesk, Inc., 8.1.63.0]
[C:\Program Files\AutoCAD 2005\vl.arx] [Autodesk Inc., 16.1.63.0]
[C:\Program Files\AutoCAD 2005\VLMSG.DLL] [Autodesk Inc., 16.1.63.0]
[C:\Program Files\AutoCAD 2005\VLLIB.DLL] [Autodesk Inc., 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcApp.arx] [Autodesk, 16.1.63.0]
昏天黑地alpha - 2008-1-8 16:35:00
[C:\Program Files\AutoCAD 2005\AcDblClkEdit.arx] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcDblClkEditPE.arx] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcDblClkEditRes.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\acdim.arx] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\ShareMFC.dll] [Autodesk, Inc, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcDimRes.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\aceplotx.arx] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcEplotXRes.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\achlnkui.arx] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\achlnkuiRes.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcIDropMgr.arx] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcIDropMgrRes.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcLayerP.arx] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcLayerPRes.dll] [Autodesk, Inc., 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcPltStamp.arx] [Autodesk, Inc., 16.1.63.0]
[C:\Program Files\AutoCAD 2005\APPERR.dll] [Autodesk, Inc., 8.1.63.0]
[C:\Program Files\AutoCAD 2005\plotcfg8.dll] [Autodesk, Inc., 8.1.63.0]
[C:\Program Files\AutoCAD 2005\pm8.dll] [Autodesk, Inc., 8.1.63.0]
[C:\Program Files\AutoCAD 2005\pctres8.dll] [Autodesk, Inc., 8.1.63.0]
[C:\Program Files\AutoCAD 2005\apperrRes.dll] [Autodesk, Inc., 8.1.63.0]
[C:\Program Files\AutoCAD 2005\pmres8.dll] [Autodesk, Inc., 8.1.63.0]
[C:\Program Files\AutoCAD 2005\AcPltStampRes.dll] [Autodesk, Inc., 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcSign.arx] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcSignRes.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcSpaceTrans.arx] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcSpaceTransRes.dll] [Autodesk, Inc., 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcStd.arx] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcStStdRes.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcStMgr.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcStRes.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcTaskBar.arx] [Autodesk, Inc., 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcTaskBarRes.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcTp.arx] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcTc.DLL] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcTcUi.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcTcRes.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcTcUiRes.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\whohas.arx] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\whohasRes.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\acetlodr.arx] [Autodesk, Inc., 16.1.63.0]
[C:\Program Files\AutoCAD 2005\acmgd.dll] [Autodesk, Inc., 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcLayer.dll] [Autodesk, Inc, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\en-US\AcLayer.resources.dll] [Autodesk, Inc., 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcSmNav.arx] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcFdEval.arx] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\axdb16.dll] [, ]
[c:\program files\common files\autodesk shared\AcSmComponents16.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcFieldRes.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcSmNavRes.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\Adobe\Acrobat 8.0\PDFMaker\AutoCAD\2005\AcrobatAcadIC.dbx] [Adobe Systems Incorporated, 8, 0, 0, 0]
[C:\Program Files\AutoCAD 2005\ATL70.DLL] [Microsoft Corporation, 7.00.9466.0]
[C:\Program Files\Adobe\Acrobat 8.0\PDFMaker\AutoCAD\2005\AcrobatAcadIC.arx] [Adobe Systems Incorporated, 8.1.0.0]
[C:\Program Files\Adobe\Acrobat 8.0\PDFMaker\AutoCAD\2005\PDFMAcad.arx] [Adobe Systems Incorporated, 8, 1, 0, 0]
[c:\program files\common files\autodesk shared\acismobj16.dbx] [Autodesk, Inc., 16.1.63.0]
[c:\program files\common files\autodesk shared\IE80.dll] [, ]
[c:\program files\common files\autodesk shared\iebmprd80.dll] [, ]
[c:\program files\common files\autodesk shared\ietiffrd80.dll] [, ]
[c:\program files\common files\autodesk shared\iejfifrd80.dll] [, ]
[c:\program files\common files\autodesk shared\iecalsrd80.dll] [, ]
[c:\program files\common files\autodesk shared\iepngrd80.dll] [, ]
[c:\program files\common files\autodesk shared\iepcxrd80.dll] [, ]
[c:\program files\common files\autodesk shared\ieflicrd80.dll] [, ]
[c:\program files\common files\autodesk shared\ietgard80.dll] [, ]
[c:\program files\common files\autodesk shared\iepictrd80.dll] [, ]
[c:\program files\common files\autodesk shared\iebmpwr80.dll] [, ]
[c:\program files\common files\autodesk shared\iecalswr80.dll] [, ]
[c:\program files\common files\autodesk shared\ieflicwr80.dll] [, ]
[c:\program files\common files\autodesk shared\iejfifwr80.dll] [, ]
[c:\program files\common files\autodesk shared\iepcxwr80.dll] [, ]
[c:\program files\common files\autodesk shared\iepngwr80.dll] [, ]
[c:\program files\common files\autodesk shared\ietgawr80.dll] [, ]
[c:\program files\common files\autodesk shared\ietiffwr80.dll] [, ]
[C:\Program Files\AutoCAD 2005\WSCommCntrAcCon.arx] [Autodesk, Inc., 16.1.63.0]
[C:\Program Files\AutoCAD 2005\WSCommCntrAcConRes.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\plcfmgr.dll] [Autodesk, Inc., 8.1.63.0]
[C:\Program Files\AutoCAD 2005\plcfmgrRes.dll] [Autodesk, Inc., 8.1.63.0]
[C:\Program Files\AutoCAD 2005\plcferr.dll] [Autodesk, Inc., 8.1.63.0]
[C:\Program Files\AutoCAD 2005\pmutil8.dll] [Autodesk, Inc., 8.1.63.0]
[C:\Program Files\AutoCAD 2005\AcProject16.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcProject16res.dll] [Autodesk, 16.1.63.0]
[C:\WINDOWS\system32\AcSignIcon.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.JPN] [Adobe Systems, Inc., 8.0.0.0]
[C:\Program Files\Common Files\Microsoft Shared\IME\IMJP9\imjpsqm.dll] [Microsoft Corporation, 9.0.5510.0]
[C:\Program Files\Common Files\Microsoft Shared\IME\IMJP9\DICTS\IMJPCD.DIC] [Microsoft Corporation, 9.0.5510.0]
[C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] [Autodesk, 16.1.63.0]
昏天黑地alpha - 2008-1-8 16:36:00
[C:\Program Files\AutoCAD 2005\light8.dll] [Autodesk, Inc., 8.1.63.0]
[C:\Program Files\AutoCAD 2005\mtl8.dll] [Autodesk, Inc., 8.1.63.0]
[C:\Program Files\AutoCAD 2005\acgsimage.dll] [Autodesk Inc., 16.1.63.0]
[c:\program files\autocad 2005\drv\paint8.hdi] [Autodesk, Inc., 8.1.63.0]
[c:\program files\autocad 2005\drv\hlr8.hdi] [Autodesk, Inc., 8.1.63.0]
[C:\Program Files\AutoCAD 2005\ShareAC.dll] [Autodesk, Inc, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\drv\rblast8.hdi] [Autodesk, Inc., 8.1.63.0]
[C:\Program Files\AutoCAD 2005\acddptype.arx] [Autodesk, Inc., 16.1.63.0]
[C:\Program Files\AutoCAD 2005\acddptypeRes.dll] [Autodesk, Inc., 16.1.63.0]
[C:\Program Files\AutoCAD 2005\acmted.arx] [Autodesk, 16.1.63.10]
[C:\Program Files\AutoCAD 2005\AcMtedRes.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\Common Files\Microsoft Shared\IME\IMSC40W\MSCAND20.DLL] [Microsoft Corporation, 9.0.5510.0]
[C:\Program Files\Common Files\Microsoft Shared\IME\Shared2.0\IMEPADSM.DLL] [Microsoft Corporation, 9.0.5510.0]
[C:\Program Files\AutoCAD 2005\AcRevcloud.arx] [Autodesk, Inc., 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcRevcloudRes.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcMatch.arx] [Autodesk, 16.1.63.0]
[C:\Program Files\AutoCAD 2005\AcMatchRes.dll] [Autodesk, 16.1.63.0]
[PID: 3372 / B21][C:\DOCUME~1\B21\LOCALS~1\Temp\AdskCleanup.0001] [Macrovision Europe Ltd., 1, 0, 0, 1]
[C:\WINDOWS\system32\IMJP9.IME] [Microsoft Corporation, 9.0.5516.0]
[C:\WINDOWS\system32\imjp9k.dll] [Microsoft Corporation, 9.0.5510.0]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[PID: 3388 / SYSTEM][C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe] [Autodesk, Inc., 2.51.000]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 3632 / B21][C:\Program Files\Common Files\Autodesk Shared\WSCommCntr1.exe] [Autodesk, Inc., 1.2.0.1]
[C:\Program Files\Common Files\Autodesk Shared\WebServices1.dll] [Autodesk, Inc., 1.2.0.1]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[PID: 1776 / B21][C:\PROGRA~1\COMMON~1\MICROS~1\IME\Shared2.0\IMEPADSV.EXE] [Microsoft Corporation, 9.0.5510.0]
[c:\program files\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.9]
[c:\program files\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[C:\PROGRA~1\COMMON~1\MICROS~1\IME\Shared2.0\1041\imepadrs.dll] [Microsoft Corporation, 9.0.5510.0]
[C:\WINDOWS\system32\IMJP9.IME] [Microsoft Corporation, 9.0.5516.0]
[C:\WINDOWS\system32\imjp9k.dll] [Microsoft Corporation, 9.0.5510.0]
[C:\PROGRA~1\COMMON~1\MICROS~1\IME\Shared2.0\imepadsm.dll] [Microsoft Corporation, 9.0.5510.0]
[C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMJP9\APPLETS\MULTIBOX.DLL] [Microsoft Corporation, 9.0.5510.0]
[C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMJP9\APPLETS\IMSKF.DLL] [Microsoft Corporation, 9.0.5510.0]
[C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMJP9\APPLETS\SOFTKEY.DLL] [Microsoft Corporation, 9.0.5510.0]
[C:\Program Files\Common Files\Microsoft Shared\IME\IMSC40W\Applets\PINTLMBX.DLL] [Microsoft Corporation, 9.0.4924.0]
[C:\Program Files\Common Files\Microsoft Shared\IME\IMSC40W\Applets\PINTLCSA.DLL] [Microsoft Corporation, 9.0.4924.0]
[C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMJP9\APPLETS\hwxjpn.dll] [Microsoft Corporation, 2.0.1038.0]
[C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMJP9\APPLETS\imskdic.dll] [Microsoft Corporation, 9.0.5510.0]
[C:\Program Files\Common Files\Microsoft Shared\Ink\hwxchs.dll] [Microsoft Corporation, 1.0.0359.0]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[PID: 3160 / B21][C:\WINDOWS\system32\taskmgr.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\IMJP9.IME] [Microsoft Corporation, 9.0.5516.0]
[C:\WINDOWS\system32\imjp9k.dll] [Microsoft Corporation, 9.0.5510.0]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\system32\AcSignIcon.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.JPN] [Adobe Systems, Inc., 8.0.0.0]
[PID: 3716 / B21][D:\sreng2\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]
[C:\WINDOWS\system32\IMJP9.IME] [Microsoft Corporation, 9.0.5516.0]
[C:\WINDOWS\system32\imjp9k.dll] [Microsoft Corporation, 9.0.5510.0]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[D:\sreng2\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]
昏天黑地alpha - 2008-1-8 16:36:00
==================================
File Associations
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock Provider
N/A
==================================
Autorun.Inf
N/A
==================================
HOSTS File
127.0.0.1 localhost
==================================
Process Privileges Scan
Special Privilege Enabled: SeDebugPrivilege [PID = 3192, C:\PROGRAM FILES\RISING\ANTISPYWARE\RUNIEP.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3192, C:\PROGRAM FILES\RISING\ANTISPYWARE\RUNIEP.EXE]
Special Privilege Enabled: SeDebugPrivilege [PID = 3372, C:\DOCUME~1\B21\LOCALS~1\TEMP\ADSKCLEANUP.0001]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3372, C:\DOCUME~1\B21\LOCALS~1\TEMP\ADSKCLEANUP.0001]
==================================
API HOOK
N/A
==================================
Hidden Process
N/A
==================================
[/CODE]
昏天黑地alpha - 2008-1-8 16:36:00
终于贴完了，自己看的都晕，就拜托各位高手了。多谢
昏天黑地alpha - 2008-1-8 18:08:00
顶一下自己
天月来了 - 2008-1-8 19:48:00
————————————————————————————————————
在扫日志的SRENG工具》启动项目》服务》驱动程序》里面找下面各项，将启动类型改为“Disabled”
==================================
Drivers
[tdnal0 / tdnal0e][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\tdnal0e.sys><N/A>
[thsi4q9j / thsi4q9j][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\thsi4q9j.sys><N/A>
—————————————————————————————
在扫日志的SRENG工具》系统修复》浏览器加载项》里面找下面删除
==================================
Browser Add-ons
[]
{16C6167B-FED4-4CEE-8951-134C9A345DA2} <C:\WINDOWS\system32\ffpomwcjsb.dll, >
[Adobe PDF Conversion Toolbar Helper]
[]
{16C6167B-FED4-4CEE-8951-134C9A345DA2} <C:\WINDOWS\system32\ffpomwcjsb.dll, >
————————————————————————————————————
再重启电脑，升级杀毒软件至最新版本，全盘杀毒。
昏天黑地alpha - 2008-1-9 11:12:00
谢谢天月大大。
还有一个问题，请看顶楼
天月来了 - 2008-1-9 11:21:00
日志不对
我需要今天最新的日志。
打开注册表搜索“m6uowlk.dll”，注意全字匹配。
搜到的都备份一下后删除。
昏天黑地alpha - 2008-1-9 14:05:00
重新扫描了，请看顶楼，谢谢
天月来了 - 2008-1-9 14:24:00
你为什么偏要将日志发顶楼呢？？
记得你原来昨天的日志里没有C:\WINDOWS\system\1sass.exe和C:\WINDOWS\system32\winnet.sys的啊！
你才一天，又弄什么了呢？
你其他盘的文件被感染了吗？还是做了什么呢？
你只有用Xdelbox这个工具去删除这些文件。
Xdelbox下载：http://www.dodudou.com/down/里面的原创软件文件夹下载那个1.6版本的。
下载后
解压所有文件到一个文件夹,（一定要解压出来运行，不要懒）运行xdelbox前请卸载所有可移动存储设备。
将下面的文件信息全部复制，然后打开Xdelbox直接使用右键菜单的“剪贴板导入不检查路径”导入，并全选文件选择右键菜单的“立刻重启删除”
C:\WINDOWS\system\1sass.exe
C:\WINDOWS\System32\DRIVERS\tdnal0e.sys
C:\WINDOWS\system32\drivers\thsi4q9j.sys
C:\WINDOWS\system32\winnet.sys
重启计算机以后 会有两个系统进入的选择的倒计时界面
第一个是你原来的windows系统
第二个是这个软件给你设定的dos系统
系统会自动选择进入第二个系统
类似dos的界面滚动完毕以后 病毒就被删除了
之后会自动重启进入正常模式
进入系统后，再做下面的：
——————————————————————————————————————————————————
在扫日志的SRENG工具》启动项目》服务》Win32服务应用程序》里面找下面项删除
==================================
Services
[Rising Protected Storage / Risieg][Running/Auto Start]
<C:\WINDOWS\system\1sass.exe><N/A>
————————————————————————————————————
在扫日志的SRENG工具》启动项目》服务》驱动程序》里面找下面项删除
==================================
Drivers
[tdnal0 / tdnal0e][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\tdnal0e.sys><N/A>
[thsi4q9j / thsi4q9j][Stopped/Disabled]
<\??\C:\WINDOWS\system32\drivers\thsi4q9j.sys><N/A>
[winnet / winnet][Running/Manual Start]
<\??\C:\WINDOWS\system32\winnet.sys><N/A>
————————————————————————————————————
再重启电脑，升级杀毒软件至最新版本全盘杀毒。
昏天黑地alpha - 2008-1-9 15:16:00
疯狂的晕，这是公司内其他员工的电脑。
马上照办。谢谢了。
onetime - 2008-1-9 15:50:00
如果你用的显卡不是ATI的,那建议你重新安装系统是最佳的选择.瑞星对C:\WINDOWS\system32\Ati2evxx.exe的病毒暂时是没有办法的.
昏天黑地alpha - 2008-1-9 18:26:00
显卡是ati的。这次查毒后没有发现病毒了
明天早上再扫描一次。
谢谢各位
1
© 2000 - 2026 Rising Corp. Ltd.