[求助]任务栏无法显示!瑞星无法打开!日志无法上传 bbs.ikaka.com

kakashi - 2008-5-28 9:14:00

刚刚中毒了...

任务栏上无法显示
瑞星无法打开
日志扫描后无法上传!

help~~

我将其贴上来...

我要疯了...

[CODE]

2008-05-27,14:11:52

System Repair Engineer 2.5.16.900 Emergency Scan Mode
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<SoundMan><SOUNDMAN.EXE> [Realtek Semiconductor Corp.]
<IgfxTray><C:\WINDOWS\system32\igfxtray.exe> [Intel Corporation]
<HotKeysCmds><C:\WINDOWS\system32\hkcmd.exe> [Intel Corporation]
<RavTask><"d:\Program Files\Rising\Rav\RavTask.exe" -system> [(Verified)Beijing Rising Science and Technology Corporation Limited]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><lxzxxy.dll> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [(Verified)Beijing Rising Science and Technology Corporation Limited]
<{528DF602-9541-A985-210A-984A698C6F25}><C:\WINDOWS\system32\ptjhehlp.dll> [N/A]
<{70AF1289-F140-A140-D012-C1458759FC07}><C:\WINDOWS\system32\ypcqfhlp.dll> [N/A]
<{6A041F13-A111-12A3-B0CF-F99818AA68A6}><C:\WINDOWS\system32\zxmscwin.dll> [N/A]
<{3C648541-1025-9650-9057-6541258720C3}><C:\WINDOWS\system32\mndhcdwd.dll> [N/A]
<{4A069845-2036-6084-9054-6087502480A4}><C:\WINDOWS\system32\ozfydbyt.dll> [N/A]
<{13FD5987-65D2-C58D-D87E-987451F12531}><C:\WINDOWS\system32\swsxachu.dll> [N/A]
<{1FD45A54-9875-698F-E56E-65102358FDF1}><C:\WINDOWS\system32\apsgajba.dll> [N/A]
<{35671234-7890-ABCD-CDEF-567801237653}><C:\WINDOWS\system32\yxcschlp.dll> [N/A]
<{37FD640A-158F-48AC-FD14-1597F14A9773}><C:\WINDOWS\system32\mndscsrv.dll> [N/A]
<{22023698-6984-8541-9654-698745012522}><C:\WINDOWS\system32\skqnbbib.dll> [N/A]
<{370165F1-9F65-569F-F895-F14F58F41073}><C:\WINDOWS\system32\lofscjbo.dll> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
<Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe]
<IFEO[360rpt.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe]
<IFEO[360safe.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.exe]
<IFEO[360safebox.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe]
<IFEO[360tray.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adam.exe]
<IFEO[adam.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvr.exe]
<IFEO[AgentSvr.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AppSvc32.exe]
<IFEO[AppSvc32.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ati2evxx.exe]
<IFEO[ati2evxx.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe]
<IFEO[autoruns.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconsol.exe]
<IFEO[avconsol.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrssvc.exe]
<IFEO[avgrssvc.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe]
<IFEO[AvMonitor.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com]
<IFEO[avp.com]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe]
<IFEO[avp.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe]
<IFEO[CCenter.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe]
<IFEO[ccSvcHst.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe]
<IFEO[egui.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\esafe.exe]
<IFEO[esafe.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]

用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; QQDownload 1.7; Maxthon; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; MEGAUPLOAD 2.0)

kakashi - 2008-5-28 9:14:00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FileDsty.exe]
<IFEO[FileDsty.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FTCleanerShell.exe]
<IFEO[FTCleanerShell.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe]
<IFEO[HijackThis.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe]
<IFEO[IceSword.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\idag.exe]
<IFEO[idag.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe]
<IFEO[Iparmor.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isPwdSvc.exe]
<IFEO[isPwdSvc.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kabaload.exe]
<IFEO[kabaload.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kaccore.exe]
<IFEO[kaccore.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KaScrScn.SCR]
<IFEO[KaScrScn.SCR]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMain.exe]
<IFEO[KASMain.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASTask.exe]
<IFEO[KASTask.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe]
<IFEO[KAV32.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe]
<IFEO[KAVDX.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPF.exe]
<IFEO[KAVPF.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.exe]
<IFEO[KAVPFW.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSetup.exe]
<IFEO[KAVSetup.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe]
<IFEO[KAVStart.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavsvc.exe]
<IFEO[kavsvc.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVsvcUI.exe]
<IFEO[KAVsvcUI.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLnchr.exe]
<IFEO[KISLnchr.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.exe]
<IFEO[kissvc.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMailMon.exe]
<IFEO[KMailMon.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMFilter.exe]
<IFEO[KMFilter.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe]
<IFEO[KPFW32.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfwsvc.exe]
<IFEO[kpfwsvc.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPPMain.exe]
<IFEO[KPPMain.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe]
<IFEO[KRegEx.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRepair.com]
<IFEO[KRepair.com]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KsLoader.exe]
<IFEO[KsLoader.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.kxp]
<IFEO[KVCenter.kxp]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvDetect.exe]
<IFEO[KvDetect.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVFW.EXE]
<IFEO[KVFW.EXE]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvfwMcl.exe]
<IFEO[KvfwMcl.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP_1.kxp]
<IFEO[KVMonXP_1.kxp]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvol.exe]
<IFEO[kvol.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvolself.exe]
<IFEO[kvolself.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvReport.kxp]
<IFEO[KvReport.kxp]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVScan.kxp]
<IFEO[KVScan.kxp]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVsrvXP.exe]
<IFEO[KVsrvXP.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVStub.kxp]
<IFEO[KVStub.kxp]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvupload.exe]
<IFEO[kvupload.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVwsc.exe]
<IFEO[KVwsc.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kwatch.exe]
<IFEO[kwatch.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch9x.exe]
<IFEO[KWatch9x.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchX.exe]
<IFEO[KWatchX.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe]
<IFEO[MagicSet.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe]
<IFEO[mcconsol.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmqczj.exe]
<IFEO[mmqczj.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmsk.exe]
<IFEO[mmsk.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navapsvc.exe]
<IFEO[navapsvc.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapw32.exe]
<IFEO[Navapw32.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe]
<IFEO[nod32krn.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NPFMntor.exe]
<IFEO[NPFMntor.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OllyDBG.EXE]
<IFEO[OllyDBG.EXE]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OllyICE.EXE]
<IFEO[OllyICE.EXE]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe]
<IFEO[PFW.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe]
<IFEO[PFWLiveUpdate.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe]
<IFEO[procexp.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSET.exe]
<IFEO[QHSET.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qqdoctor.exe]
<IFEO[qqdoctor.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qqkav.exe]
<IFEO[qqkav.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qqsc.exe]
<IFEO[qqsc.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ras.exe]
<IFEO[Ras.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav.exe]
<IFEO[rav.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAVmon.exe]
<IFEO[RAVmon.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAVmonD.exe]
<IFEO[RAVmonD.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravstub.exe]
<IFEO[ravstub.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravtask.exe]
<IFEO[ravtask.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravtimer.exe]
<IFEO[ravtimer.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravtool.exe]
<IFEO[ravtool.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegClean.exe]
<IFEO[RegClean.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regtool.exe]
<IFEO[regtool.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe]
<IFEO[rfwmain.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwproxy.exeFYFireWall.exe]

kakashi - 2008-5-28 9:15:00

<IFEO[rfwproxy.exeFYFireWall.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe]
<IFEO[rfwsrv.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwstub.exe]
<IFEO[rfwstub.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rising.exe]
<IFEO[rising.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe]
<IFEO[Rsaupd.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe]
<IFEO[runiep.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safebank.exe]
<IFEO[safebank.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxtray.exe]
<IFEO[safeboxtray.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safelive.exe]
<IFEO[safelive.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe]
<IFEO[scan32.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shcfg32.exe]
<IFEO[shcfg32.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmartUp.exe]
<IFEO[SmartUp.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREng.EXE]
<IFEO[SREng.EXE]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe]
<IFEO[symlcsvc.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SysSafe.exe]
<IFEO[SysSafe.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.exe]
<IFEO[TrojanDetector.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trojanwall.exe]
<IFEO[Trojanwall.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.kxp]
<IFEO[TrojDie.kxp]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe]
<IFEO[UIHost.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAgent.exe]
<IFEO[UmxAgent.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAttachment.exe]
<IFEO[UmxAttachment.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxCfg.exe]
<IFEO[UmxCfg.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxFwHlp.exe]
<IFEO[UmxFwHlp.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxPol.exe]
<IFEO[UmxPol.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpLive.exe]
<IFEO[UpLive.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsstat.exe]
<IFEO[vsstat.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webscanx.exe]
<IFEO[webscanx.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinDbg.exe]
<IFEO[WinDbg.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WoptiClean.exe]
<IFEO[WoptiClean.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)]

==================================
启动文件夹
N/A

==================================
服务
[E01FA41F / E01FA41F][Stopped/Auto Start]
<C:\WINDOWS\system32\8A4CD76B.EXE -d><>
[Rising Process Communication Center / RsCCenter][Stopped/Auto Start]
<"d:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Stopped/Auto Start]
<"D:\PROGRAM FILES\RISING\RAV\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[Windows User Mode Driver Framework / UMWdf][Stopped/Disabled]
<C:\WINDOWS\system32\wdfmgr.exe><Microsoft Corporation>

kakashi - 2008-5-28 9:15:00

==================================
驱动程序
[3367b4e4219fb856 / 3367b4e4219fb856][Stopped/Manual Start]
<\??\C:\3367b4e4219fb856.dat><N/A>
[61blh / 61blh5][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\61blh5.sys><N/A>
[75fd0a4029dace84 / 75fd0a4029dace84][Stopped/Manual Start]
<\??\C:\75fd0a4029dace84.dat><N/A>
[A320RAID / A320RAID][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\a320raid.sys><Adaptec, Inc.>
[acpidisk / acpidisk][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\acpidisk.sys><N/A>
[adpu160m / adpu160m][Running/Boot Start]
<\SystemRoot\System32\Drivers\adpu160m.sys><Microsoft Corporation>
[ADPU320 / ADPU320][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\adpu320.sys><Adaptec, Inc.>
[ahci8086 / ahci8086][Running/Boot Start]
<\SystemRoot\System32\Drivers\ahci8086.sys><ATI Technologies Inc.>
[aic78u2 / aic78u2][Running/Boot Start]
<\SystemRoot\System32\Drivers\aic78u2.sys><Microsoft Corporation>
[aic78xx / aic78xx][Running/Boot Start]
<\SystemRoot\System32\Drivers\aic78xx.sys><Microsoft Corporation>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[AmdK8 Compatible Device / AmdK8][Stopped/Manual Start]
<System32\drivers\amdk8.sys><Advanced Micro Devices>
[apcdli / apcdli][Running/Auto Start]
<\??\C:\Program Files\Microsoft Office\SYSTEM\apcdli.sys><N/A>
[Atixeve2531 / Atixeve2531][Stopped/Manual Start]
<\??\C:\WINDOWS\TEMP\~wxp2ins.375.tmp><N/A>
[Atixeve2593 / Atixeve2593][Stopped/Manual Start]
<\??\C:\WINDOWS\TEMP\~wxp2ins.453.tmp><N/A>
[Atixeve2609 / Atixeve2609][Stopped/Manual Start]
<\??\C:\WINDOWS\TEMP\~wxp2ins.453.tmp><N/A>
[Atixeve262 / Atixeve262][Stopped/Manual Start]
<\??\C:\WINDOWS\TEMP\~wxp2ins.687.tmp><N/A>
[Atixeve2859 / Atixeve2859][Stopped/Manual Start]
<\??\C:\WINDOWS\TEMP\~wxp2ins.703.tmp><N/A>
[b28jrp / b28jrp][Stopped/Boot Start]
<\SystemRoot\system32\drivers\b28jrp.sys><N/A>
[cqit / cqit][Stopped/Auto Start]
<\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp1F.tmp><N/A>
[CSB6IDE / CSB6IDE][Running/Boot Start]
<\SystemRoot\System32\Drivers\csb6ide.sys><ServerWorks Corporation>
[dohs / dohs][Stopped/Auto Start]
<\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp23.tmp><N/A>
[FASTTRAK / FASTTRAK][Running/Boot Start]
<\SystemRoot\System32\Drivers\fasttrak.sys><Promise Technology, Inc.>
[VIA Rhine Family Fast Ethernet Adapter Driver Service / FETNDISB][Stopped/Manual Start]
<system32\DRIVERS\fetnd5b.sys><VIA Technologies, Inc.>
[fmsq / fmsq][Stopped/Auto Start]
<\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp21.tmp><N/A>
[FTSATA2 / FTSATA2][Running/Boot Start]
<\SystemRoot\System32\Drivers\ftsata2.sys><Promise Technology, Inc.>
[HookCont / HookCont][Running/System Start]
<\SystemRoot\system32\drivers\HookCont.sys><Beijing Rising Technology Co., Ltd>
[HookNtos / HookNtos][Running/System Start]
<\SystemRoot\system32\drivers\HookNtos.sys><Beijing Rising Technology Co., Ltd>
[HookReg / HookReg][Running/System Start]
<\SystemRoot\system32\drivers\HookReg.sys><Beijing Rising Technology Co., Ltd>
[HookSys / HookSys][Running/System Start]
<\SystemRoot\system32\drivers\HookSys.sys><Beijing Rising Technology Co., Ltd>
[ialm / ialm][Running/Manual Start]
<system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[IASTOR / IASTOR][Running/Boot Start]
<\SystemRoot\System32\Drivers\iaStor.sys><Intel Corporation>
[ITERAID / ITERAID][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\iteraid.sys><Integrated Technology Express, Inc.>
[JRAID / JRAID][Running/Boot Start]
<\SystemRoot\System32\Drivers\JRAID.SYS><JMicron Technology Corp.>
[jtio / jtio][Stopped/Auto Start]
<\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp27.tmp><N/A>
[M5228 / M5228][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\m5228.sys><ALi Corporation.>
[M5281 / M5281][Running/Boot Start]
<\SystemRoot\System32\Drivers\m5281.sys><ALi Corporation>
[M5289 / M5289][Running/Boot Start]
<\SystemRoot\System32\Drivers\m5289.sys><ULi Electronics Inc.>
[mhfp / mhfp][Stopped/Auto Start]
<\??\C:\WINDOWS\TEMP\tmp1.tmp><N/A>
[mnsf / mnsf][Stopped/Auto Start]
<\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp25.tmp><N/A>
[msfpfis64 / msfpfis64][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\msosmsfpfis64.sys><N/A>
[msp2p32 / msp2p32][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\msosmsp2p32.sys><N/A>
[ntptdb / ntptdb][Running/Auto Start]
<\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys><N/A>
[NVATABUS / NVATABUS][Running/Boot Start]
<\SystemRoot\System32\Drivers\NVATABUS.SYS><NVIDIA Corporation>
[Service for NVIDIA(R) nForce(TM) MIDI UART / nvmpu401][Running/Manual Start]
<system32\drivers\nvmpu401.sys><NVIDIA Corporation>
[NVRAID / NVRAID][Running/Boot Start]
<\SystemRoot\System32\Drivers\NVRAID.SYS><NVIDIA Corporation>
[ping / ping][Stopped/Auto Start]
<\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp2B.tmp><N/A>
[ptfs / ptfs][Stopped/Auto Start]
<\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp29.tmp><N/A>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[Realtek 10/100/1000 PCI NIC Family NDIS XP Driver / RTL8023xp][Running/Manual Start]
<system32\DRIVERS\Rtnicxp.sys><Realtek Semiconductor Corporation>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[SI3112R / SI3112R][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\SI3112r.sys><Silicon Image, Inc>
[SI3114R / SI3114R][Stopped/Boot Start]
<\SystemRoot\SYSTEM32\Drivers\SI3114R.sys><Silicon Image, Inc>
[SI3114R5 / SI3114R5][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\Si3114r5.sys><Silicon Image, Inc>
[SI3124 / SI3124][Stopped/Boot Start]
<\SystemRoot\SYSTEM32\Drivers\SI3124.sys><Silicon Image, Inc.>
[SI3124R / SI3124R][Stopped/Boot Start]
<\SystemRoot\SYSTEM32\Drivers\SI3124R.sys><Silicon Image, Inc>
[SI3124R5 / SI3124R5][Stopped/Boot Start]
<\SystemRoot\SYSTEM32\Drivers\Si3124r5.sys><Silicon Image, Inc>
[SI3132 / SI3132][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\SI3132.sys><Silicon Image, Inc.>
[SI3132R5 / SI3132R5][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\Si3132r5.sys><Silicon Image, Inc>
[SISRAID2 / SISRAID2][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\SiSRaid2.sys><Silicon Integrated Systems Corp>
[SISRAID4 / SISRAID4][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\SiSRaid4.sys><Silicon Integrated Systems>
[SYMMPI / SYMMPI][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\symmpi.sys><LSI Logic>
[sym_hi / sym_hi][Running/Boot Start]
<\SystemRoot\System32\Drivers\sym_hi.sys><LSI Logic>
[sym_u3 / sym_u3][Running/Boot Start]
<\SystemRoot\System32\Drivers\sym_u3.sys><LSI Logic>
[ULSATA / ULSATA][Running/Boot Start]
<\SystemRoot\System32\Drivers\ulsata.sys><Promise Technology, Inc.>
[ULSATA2 / ULSATA2][Running/Boot Start]
<\SystemRoot\System32\Drivers\ulsata2.sys><Promise Technology, Inc.>
[VIAMRAID / VIAMRAID][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\viamraid.sys><VIA Technologies inc,.ltd>
[vmscsi / vmscsi][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\vmscsi.sys><VMware, Inc.>
[zftp / zftp][Stopped/Auto Start]
<\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp1B.tmp><N/A>

kakashi - 2008-5-28 9:16:00

==================================
浏览器加载项
[ThunderAtOnce Class]
{01443AEC-0FD1-40fd-9C87-E93D1494C233} <D:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[CAdLogic Object]
{11F09AFD-75AD-4E51-AB43-E09E9351CE16} <C:\Program Files\Common Files\CPUSH\cpush.dll, >
[]
{13FD5987-65D2-C58D-D87E-987451F12531} <C:\WINDOWS\system32\swsxachu.dll, N/A>
[]
{1FD45A54-9875-698F-E56E-65102358FDF1} <C:\WINDOWS\system32\apsgajba.dll, N/A>
[]
{22023698-6984-8541-9654-698745012522} <C:\WINDOWS\system32\skqnbbib.dll, N/A>
[FGCatchUrl]
{2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <C:\Program Files\FlashGet\jccatch.dll, www.flashget.com>
[]
{35671234-7890-ABCD-CDEF-567801237653} <C:\WINDOWS\system32\yxcschlp.dll, N/A>
[]
{370165F1-9F65-569F-F895-F14F58F41073} <C:\WINDOWS\system32\lofscjbo.dll, N/A>
[]
{37FD640A-158F-48AC-FD14-1597F14A9773} <C:\WINDOWS\system32\mndscsrv.dll, N/A>
[Info cache]
{385AB8C6-FB22-4D17-8834-064E2BA0A6F0} <C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll, 明勋科技有限公司>
[]
{3C648541-1025-9650-9057-6541258720C3} <C:\WINDOWS\system32\mndhcdwd.dll, N/A>
[]
{4A069845-2036-6084-9054-6087502480A4} <C:\WINDOWS\system32\ozfydbyt.dll, N/A>
[]
{528DF602-9541-A985-210A-984A698C6F25} <C:\WINDOWS\system32\ptjhehlp.dll, N/A>
[]
{6A041F13-A111-12A3-B0CF-F99818AA68A6} <C:\WINDOWS\system32\zxmscwin.dll, N/A>
[]
{70AF1289-F140-A140-D012-C1458759FC07} <C:\WINDOWS\system32\ypcqfhlp.dll, N/A>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <D:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[Web Viewer Objects]
{986488AF-13D5-9DDF-4FEF-9FB88698CFC1} <C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\USERDATA\webbrowser_2036.dll, >
[FlashGet GetFlash Class]
{F156768E-81EF-470C-9057-481BA8380DBA} <C:\Program Files\FlashGet\getflash.dll, www.flashget.com>
[启动迅雷5]
{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <D:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[快车]
{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\Program Files\FlashGet\flashget.exe, FlashGet.com>
[雨林木风]
{7550D5D5-D85C-414F-B623-0AD223AEC216} <http://www.ylmf.com, N/A>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[ThunderAtOnce Class]
{01443AEC-0FD1-40FD-9C87-E93D1494C233} <D:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[GerneralPeerID Class]
{0A47E819-F82E-4D5D-B806-6A9EA94D68CD} <D:\Program Files\Thunder Network\Thunder\Components\InMedia\peerid.dll, >
[CAdLogic Object]
{11F09AFD-75AD-4E51-AB43-E09E9351CE16} <C:\Program Files\Common Files\CPUSH\cpush.dll, >
[]
{13FD5987-65D2-C58D-D87E-987451F12531} <C:\WINDOWS\system32\swsxachu.dll, N/A>
[Windows Genuine Advantage Validation Tool]
{17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\legitcheckcontrol.dll, Microsoft Corporation>
[]
{1FD45A54-9875-698F-E56E-65102358FDF1} <C:\WINDOWS\system32\apsgajba.dll, N/A>
[]
{22023698-6984-8541-9654-698745012522} <C:\WINDOWS\system32\skqnbbib.dll, N/A>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[FGCatchUrl]
{2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <C:\Program Files\FlashGet\jccatch.dll, www.flashget.com>
[]
{35671234-7890-ABCD-CDEF-567801237653} <C:\WINDOWS\system32\yxcschlp.dll, N/A>
[]
{370165F1-9F65-569F-F895-F14F58F41073} <C:\WINDOWS\system32\lofscjbo.dll, N/A>
[]
{37FD640A-158F-48AC-FD14-1597F14A9773} <C:\WINDOWS\system32\mndscsrv.dll, N/A>
[Info cache]
{385AB8C6-FB22-4D17-8834-064E2BA0A6F0} <C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll, 明勋科技有限公司>
[]
{3C648541-1025-9650-9057-6541258720C3} <C:\WINDOWS\system32\mndhcdwd.dll, N/A>
[Thunder Agent Class]
{485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <D:\Program Files\Thunder Network\Thunder\ComDlls\ThunderAgent_Now.dll, Thunder Networking Technologies,LTD>
[]
{4A069845-2036-6084-9054-6087502480A4} <C:\WINDOWS\system32\ozfydbyt.dll, N/A>
[]
{528DF602-9541-A985-210A-984A698C6F25} <C:\WINDOWS\system32\ptjhehlp.dll, N/A>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[XMP Class]
{6483F145-A768-4C41-AACC-52D4D7845851} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xplayer.dll_1_work, >
[XDRM]
{693571CB-54A3-4E90-9D52-EEAE1334E2D3} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xdrm.dll_1_work, >
[]
{6A041F13-A111-12A3-B0CF-F99818AA68A6} <C:\WINDOWS\system32\zxmscwin.dll, N/A>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[]
{70AF1289-F140-A140-D012-C1458759FC07} <C:\WINDOWS\system32\ypcqfhlp.dll, N/A>
[Active Desktop Mover]
{72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
[MediaComm Class]
{7670648D-461B-42AF-BDFE-46D26AF5EFF2} <D:\Program Files\Thunder Network\Thunder\Components\InMedia\MediaAddin16.dll, Thunder Networking Technologies,LTD>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <D:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[Web Viewer Objects]
{986488AF-13D5-9DDF-4FEF-9FB88698CFC1} <C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\USERDATA\webbrowser_2036.dll, >
[RMGetLicense Class]
{A9FC132B-096D-460B-B7D5-1DB0FAE0C062} <C:\WINDOWS\system32\msnetobj.dll, Microsoft Corporation>
[DapCtrl COM Module]
{ACACC6EB-1FBA-4E13-A729-53AEB2DF54F8} <C:\Program Files\Common Files\Thunder Network\KanKan\DapCtrl.1.6.5711.41.945.dll, ShenZhen Thunder Networking Technologies Ltd.>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[Thunder DapPlayer]
{EEDD6FF9-13DE-496B-9A1C-D78B3215E266} <D:\Program Files\Thunder Network\Thunder\Components\DownAndPlay\DapPlayer3.0.5712.71.945.dll, ShenZhen Thunder Networking Technologies Ltd.>
[FlashGet GetFlash Class]
{F156768E-81EF-470C-9057-481BA8380DBA} <C:\Program Files\FlashGet\getflash.dll, www.flashget.com>
[XPPlayer Class]
{F3E70CEA-956E-49CC-B444-73AFE593AD7F} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\pplayer.dll_1_work, Thunder>
[FGCatchUrl]
{FB5DA724-162B-11D3-8B9B-AA70B4B0B524} <C:\Program Files\FlashGet\jccatch.dll, www.flashget.com>
[&使用快车(FlashGet)下载]
<C:\Program Files\FlashGet\jc_link.htm, N/A>
[&使用快车(FlashGet)下载全部链接]
<C:\Program Files\FlashGet\jc_all.htm, N/A>
[使用迅雷下载]
<D:\Program Files\Thunder Network\Thunder\Program\geturl.htm, N/A>
[使用迅雷下载全部链接]
<D:\Program Files\Thunder Network\Thunder\Program\getallurl.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ表情]
<D:\QQ\AddEmotion.htm, N/A>

kakashi - 2008-5-28 9:16:00

==================================
正在运行的进程
[PID: 468][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 536][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\94879A32.DLL] [, ]
[C:\WINDOWS\system32\msosdohs00.dll] [N/A, ]
[C:\WINDOWS\system32\msoscqit00.dll] [N/A, ]
[C:\WINDOWS\system32\msosfmsq00.dll] [N/A, ]
[C:\WINDOWS\system32\msosdohs02.dll] [N/A, ]
[C:\WINDOWS\system32\msosmnsf00.dll] [N/A, ]
[C:\WINDOWS\system32\msosjtio00.dll] [N/A, ]
[C:\WINDOWS\system32\msosptfs00.dll] [N/A, ]
[C:\WINDOWS\system32\msosping00.dll] [N/A, ]
[PID: 560][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\SysCbCg.dll] [Microsoft Corporation, 5.1.2600.3099]
[C:\WINDOWS\system32\msosptfs01.dll] [N/A, ]
[C:\WINDOWS\system32\msosdohs01.dll] [N/A, ]
[C:\WINDOWS\system32\fmsiocps.dll] [N/A, ]
[C:\WINDOWS\system32\nmkbsk.dll] [N/A, ]
[C:\WINDOWS\system32\plrhsj.dll] [N/A, ]
[C:\WINDOWS\system32\msosmnsf01.dll] [N/A, ]
[C:\WINDOWS\system32\msosfmsq01.dll] [N/A, ]
[C:\WINDOWS\system32\msosjtio01.dll] [N/A, ]
[C:\WINDOWS\system32\msosping01.dll] [N/A, ]
[C:\WINDOWS\system32\msoscqit02.dll] [N/A, ]
[C:\WINDOWS\system32\winlib .dll] [N/A, ]
[C:\WINDOWS\system32\94879A32.DLL] [, ]
[C:\WINDOWS\system32\msosdohs00.dll] [N/A, ]
[C:\WINDOWS\system32\msoscqit00.dll] [N/A, ]
[C:\WINDOWS\system32\msosfmsq00.dll] [N/A, ]
[C:\WINDOWS\system32\msosdohs02.dll] [N/A, ]
[C:\WINDOWS\system32\msosmnsf00.dll] [N/A, ]
[C:\WINDOWS\system32\msosjtio00.dll] [N/A, ]
[C:\WINDOWS\system32\msosptfs00.dll] [N/A, ]
[C:\WINDOWS\system32\msosping00.dll] [N/A, ]
[PID: 652][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\94879A32.DLL] [, ]
[C:\WINDOWS\system32\msosdohs00.dll] [N/A, ]
[C:\WINDOWS\system32\msoscqit00.dll] [N/A, ]
[C:\WINDOWS\system32\msosfmsq00.dll] [N/A, ]
[C:\WINDOWS\system32\msosdohs02.dll] [N/A, ]
[C:\WINDOWS\system32\msosmnsf00.dll] [N/A, ]
[C:\WINDOWS\system32\msosjtio00.dll] [N/A, ]
[C:\WINDOWS\system32\msosptfs00.dll] [N/A, ]
[C:\WINDOWS\system32\msosping00.dll] [N/A, ]
[PID: 664][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\mfc40u.dll] [N/A, ]
[C:\WINDOWS\system32\94879A32.DLL] [, ]
[C:\WINDOWS\system32\msosdohs00.dll] [N/A, ]
[C:\WINDOWS\system32\msoscqit00.dll] [N/A, ]
[C:\WINDOWS\system32\msosfmsq00.dll] [N/A, ]
[C:\WINDOWS\system32\msosdohs02.dll] [N/A, ]
[C:\WINDOWS\system32\msosmnsf00.dll] [N/A, ]
[C:\WINDOWS\system32\msosjtio00.dll] [N/A, ]
[C:\WINDOWS\system32\msosptfs00.dll] [N/A, ]
[C:\WINDOWS\system32\msosping00.dll] [N/A, ]
[PID: 1316][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\msosdohs00.dll] [N/A, ]
[C:\WINDOWS\system32\msoscqit00.dll] [N/A, ]
[C:\WINDOWS\system32\msosfmsq00.dll] [N/A, ]
[C:\WINDOWS\system32\msosdohs02.dll] [N/A, ]
[C:\WINDOWS\system32\msosmnsf00.dll] [N/A, ]
[C:\WINDOWS\system32\msosjtio00.dll] [N/A, ]
[C:\WINDOWS\system32\msosptfs00.dll] [N/A, ]
[C:\WINDOWS\system32\msosping00.dll] [N/A, ]
[PID: 1836][C:\WINDOWS\TEMP\_qosec2.msi] [N/A, ]
[C:\WINDOWS\system32\SysCbCg.dll] [Microsoft Corporation, 5.1.2600.3099]
[C:\WINDOWS\system32\msosptfs01.dll] [N/A, ]
[C:\WINDOWS\system32\msosdohs01.dll] [N/A, ]
[C:\WINDOWS\system32\fmsiocps.dll] [N/A, ]
[C:\WINDOWS\system32\nmkbsk.dll] [N/A, ]
[C:\WINDOWS\system32\plrhsj.dll] [N/A, ]
[C:\WINDOWS\system32\msosmnsf01.dll] [N/A, ]
[C:\WINDOWS\system32\msosfmsq01.dll] [N/A, ]
[C:\WINDOWS\system32\msosjtio01.dll] [N/A, ]
[C:\WINDOWS\system32\msosping01.dll] [N/A, ]
[C:\WINDOWS\system32\msoscqit02.dll] [N/A, ]
[C:\WINDOWS\system32\msosdohs00.dll] [N/A, ]
[C:\WINDOWS\system32\msoscqit00.dll] [N/A, ]
[C:\WINDOWS\system32\msosfmsq00.dll] [N/A, ]
[C:\WINDOWS\system32\msosdohs02.dll] [N/A, ]
[C:\WINDOWS\system32\msosmnsf00.dll] [N/A, ]
[C:\WINDOWS\system32\msosjtio00.dll] [N/A, ]
[C:\WINDOWS\system32\msosptfs00.dll] [N/A, ]
[C:\WINDOWS\system32\msosping00.dll] [N/A, ]
[PID: 336][C:\WINDOWS\TEMP\_qosec6.msi] [N/A, ]
[C:\WINDOWS\system32\SysWoWCt.dll] [Microsoft Corporation, 5.1.2600.3099]
[C:\WINDOWS\system32\msosdohs00.dll] [N/A, ]
[C:\WINDOWS\system32\msoscqit00.dll] [N/A, ]
[C:\WINDOWS\system32\msosfmsq00.dll] [N/A, ]
[C:\WINDOWS\system32\msosdohs02.dll] [N/A, ]
[C:\WINDOWS\system32\msosmnsf00.dll] [N/A, ]
[C:\WINDOWS\system32\msosjtio00.dll] [N/A, ]
[C:\WINDOWS\system32\msosptfs00.dll] [N/A, ]
[C:\WINDOWS\system32\msosping00.dll] [N/A, ]
[PID: 352][C:\WINDOWS\TEMP\_qosec7.msi] [N/A, ]
[C:\WINDOWS\system32\SysWoWCt.dll] [Microsoft Corporation, 5.1.2600.3099]
[C:\WINDOWS\system32\msosdohs00.dll] [N/A, ]
[C:\WINDOWS\system32\msoscqit00.dll] [N/A, ]
[C:\WINDOWS\system32\msosfmsq00.dll] [N/A, ]
[C:\WINDOWS\system32\msosdohs02.dll] [N/A, ]
[C:\WINDOWS\system32\msosmnsf00.dll] [N/A, ]
[C:\WINDOWS\system32\msosjtio00.dll] [N/A, ]
[C:\WINDOWS\system32\msosptfs00.dll] [N/A, ]
[C:\WINDOWS\system32\msosping00.dll] [N/A, ]
[PID: 364][C:\WINDOWS\TEMP\_qosec8.msi] [N/A, ]
[C:\WINDOWS\system32\SysWoWCt.dll] [Microsoft Corporation, 5.1.2600.3099]
[C:\WINDOWS\system32\msosdohs00.dll] [N/A, ]
[C:\WINDOWS\system32\msoscqit00.dll] [N/A, ]
[C:\WINDOWS\system32\msosfmsq00.dll] [N/A, ]
[C:\WINDOWS\system32\msosdohs02.dll] [N/A, ]
[C:\WINDOWS\system32\msosmnsf00.dll] [N/A, ]
[C:\WINDOWS\system32\msosjtio00.dll] [N/A, ]
[C:\WINDOWS\system32\msosptfs00.dll] [N/A, ]
[C:\WINDOWS\system32\msosping00.dll] [N/A, ]
[PID: 676][C:\WINDOWS\TEMP\_qosec17.msi] [N/A, ]
[C:\WINDOWS\system32\SysWoWCt.dll] [Microsoft Corporation, 5.1.2600.3099]
[C:\WINDOWS\system32\msosdohs00.dll] [N/A, ]
[C:\WINDOWS\system32\msoscqit00.dll] [N/A, ]
[C:\WINDOWS\system32\msosfmsq00.dll] [N/A, ]
[C:\WINDOWS\system32\msosdohs02.dll] [N/A, ]
[C:\WINDOWS\system32\msosmnsf00.dll] [N/A, ]
[C:\WINDOWS\system32\msosjtio00.dll] [N/A, ]
[C:\WINDOWS\system32\msosptfs00.dll] [N/A, ]
[C:\WINDOWS\system32\msosping00.dll] [N/A, ]
[PID: 1612][C:\WINDOWS\TEMP\_qosec20.msi] [N/A, ]
[C:\WINDOWS\system32\SysDaJHv.dll] [Microsoft Corporation, 5.1.2600.3099]
[C:\WINDOWS\system32\msosfmsq00.dll] [N/A, ]
[C:\WINDOWS\system32\msosdohs02.dll] [N/A, ]
[C:\WINDOWS\system32\msosmnsf00.dll] [N/A, ]
[C:\WINDOWS\system32\msosjtio00.dll] [N/A, ]
[C:\WINDOWS\system32\msosptfs00.dll] [N/A, ]
[C:\WINDOWS\system32\msosping00.dll] [N/A, ]
[PID: 1632][C:\WINDOWS\TEMP\_qosec21.msi] [N/A, ]
[C:\WINDOWS\system32\SysDaJHv.dll] [Microsoft Corporation, 5.1.2600.3099]
[C:\WINDOWS\system32\msosfmsq00.dll] [N/A, ]
[C:\WINDOWS\system32\msosdohs02.dll] [N/A, ]
[C:\WINDOWS\system32\msosmnsf00.dll] [N/A, ]
[C:\WINDOWS\system32\msosjtio00.dll] [N/A, ]
[C:\WINDOWS\system32\msosptfs00.dll] [N/A, ]
[C:\WINDOWS\system32\msosping00.dll] [N/A, ]
[PID: 1716][C:\WINDOWS\TEMP\_qosec22.msi] [N/A, ]
[C:\WINDOWS\system32\SysDaJHv.dll] [Microsoft Corporation, 5.1.2600.3099]
[C:\WINDOWS\system32\msosfmsq00.dll] [N/A, ]
[C:\WINDOWS\system32\msosdohs02.dll] [N/A, ]
[C:\WINDOWS\system32\msosmnsf00.dll] [N/A, ]
[C:\WINDOWS\system32\msosjtio00.dll] [N/A, ]
[C:\WINDOWS\system32\msosptfs00.dll] [N/A, ]
[C:\WINDOWS\system32\msosping00.dll] [N/A, ]
[PID: 764][C:\WINDOWS\TEMP\_qosec25.msi] [N/A, ]
[C:\WINDOWS\system32\SysDaJHv.dll] [Microsoft Corporation, 5.1.2600.3099]
[C:\WINDOWS\system32\msosfmsq00.dll] [N/A, ]
[C:\WINDOWS\system32\msosdohs02.dll] [N/A, ]
[C:\WINDOWS\system32\msosmnsf00.dll] [N/A, ]
[C:\WINDOWS\system32\msosjtio00.dll] [N/A, ]
[C:\WINDOWS\system32\msosptfs00.dll] [N/A, ]
[C:\WINDOWS\system32\msosping00.dll] [N/A, ]
[PID: 2112][C:\WINDOWS\TEMP\_qosec27.msi] [N/A, ]
[C:\WINDOWS\system32\SysDaJHv.dll] [Microsoft Corporation, 5.1.2600.3099]
[C:\WINDOWS\system32\msosfmsq00.dll] [N/A, ]
[C:\WINDOWS\system32\msosdohs02.dll] [N/A, ]
[C:\WINDOWS\system32\msosmnsf00.dll] [N/A, ]
[C:\WINDOWS\system32\msosjtio00.dll] [N/A, ]
[C:\WINDOWS\system32\msosptfs00.dll] [N/A, ]
[C:\WINDOWS\system32\msosping00.dll] [N/A, ]
[PID: 2720][C:\WINDOWS\TEMP\_qosec31.msi] [N/A, ]
[C:\WINDOWS\system32\SysCbCg.dll] [Microsoft Corporation, 5.1.2600.3099]
[PID: 2868][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\SysCbCg.dll] [Microsoft Corporation, 5.1.2600.3099]
[C:\WINDOWS\system32\94879A32.DLL] [, ]
[C:\WINDOWS\system32\sysloader.dll] [, 3, 2, 8, 0]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.17]
[C:\WINDOWS\system32\a62fbt.dll] [N/A, ]
[C:\WINDOWS\system32\lxzxxy.dll] [N/A, ]
[C:\WINDOWS\system32\anistio.dll] [N/A, ]
[C:\WINDOWS\system32\isndntio.dll] [N/A, ]
[C:\WINDOWS\system32\dionpis.dll] [N/A, ]
[C:\WINDOWS\system32\mfchlp64.dll] [N/A, ]
[C:\WINDOWS\system32\fmsjhif.dll] [N/A, ]
[C:\WINDOWS\system32\fmsbbqi.dll] [N/A, ]
[C:\WINDOWS\system32\dbhlp32.dlL] [N/A, ]
[C:\WINDOWS\system32\ptshell.dll] [N/A, ]
[C:\WINDOWS\system32\huifitc.dll] [N/A, ]
[C:\WINDOWS\system32\bincdwsa.dll] [N/A, ]
[C:\WINDOWS\system32\fmbiost.dll] [N/A, ]
[C:\WINDOWS\system32\dndsioc.dll] [N/A, ]
[C:\WINDOWS\system32\yuiabct.dll] [N/A, ]
[C:\WINDOWS\system32\WINSvr64.dll] [N/A, ]
[C:\WINDOWS\system32\yuwvcmoh.dll] [N/A, ]
[C:\WINDOWS\system32\tciocp64.dll] [N/A, ]
[C:\WINDOWS\system32\hefcndy.dll] [N/A, ]
[C:\WINDOWS\system32\ticisms.dll] [N/A, ]
[C:\WINDOWS\system32\wipicdec.dll] [N/A, ]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
[D:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll] [Thunder Networking Technologies,LTD, 1.0.5.29]
[D:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 8, 96]
[D:\Program Files\Thunder Network\Thunder\Components\ResWorker\DsBho_00.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 19]
[D:\Program Files\Thunder Network\Thunder\Components\ResWorker\DataProcessor_00.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 16]
[C:\WINDOWS\system32\Audiodev.dll] [Microsoft Corporation, 5.2.3790.3646 built by: DNSRV(bld4act)]
[d:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16]
[PID: 3116][C:\WINDOWS\TEMP\_qosec34.msi] [N/A, ]
[C:\WINDOWS\system32\SysCbCg.dll] [Microsoft Corporation, 5.1.2600.3099]
[C:\Program Files\Internet Explorer\PLUGINS\DosSys16.Sys] [N/A, ]
[PID: 3284][C:\WINDOWS\SOUNDMAN.EXE] [Realtek Semiconductor Corp., 5, 1, 0, 56]
[C:\WINDOWS\system32\SysCbCg.dll] [Microsoft Corporation, 5.1.2600.3099]
[PID: 3296][C:\WINDOWS\system32\igfxtray.exe] [Intel Corporation, 3.0.0.4342]
[C:\WINDOWS\system32\hccutils.DLL] [Intel Corporation, 3.0.0.4342]
[C:\WINDOWS\system32\SysCbCg.dll] [Microsoft Corporation, 5.1.2600.3099]
[C:\WINDOWS\system32\igfxdev.dll] [Intel Corporation, 3.0.0.4342]
[C:\WINDOWS\system32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4342]
[C:\WINDOWS\system32\igfxres.dll] [Intel Corporation, 3.0.0.4342]
[C:\WINDOWS\system32\igfxress.dll] [Intel Corporation, 3.0.0.4342]
[PID: 3304][C:\WINDOWS\system32\hkcmd.exe] [Intel Corporation, 3.0.0.4342]
[C:\WINDOWS\system32\hccutils.DLL] [Intel Corporation, 3.0.0.4342]
[C:\WINDOWS\system32\SysCbCg.dll] [Microsoft Corporation, 5.1.2600.3099]
[C:\WINDOWS\system32\igfxdev.dll] [Intel Corporation, 3.0.0.4342]
[C:\WINDOWS\system32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4342]
[C:\WINDOWS\system32\igfxhk.dll] [Intel Corporation, 3.0.0.4342]
[C:\WINDOWS\system32\igfxres.dll] [Intel Corporation, 3.0.0.4342]
[PID: 3684][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\SysCbCg.dll] [Microsoft Corporation, 5.1.2600.3099]
[C:\WINDOWS\system32\lxzxxy.dll] [N/A, ]
[C:\WINDOWS\system32\wipicdec.dll] [N/A, ]
[C:\WINDOWS\system32\ticisms.dll] [N/A, ]
[C:\WINDOWS\system32\hefcndy.dll] [N/A, ]
[C:\WINDOWS\system32\tciocp64.dll] [N/A, ]
[C:\WINDOWS\system32\yuwvcmoh.dll] [N/A, ]
[C:\WINDOWS\system32\WINSvr64.dll] [N/A, ]
[C:\WINDOWS\system32\yuiabct.dll] [N/A, ]
[C:\WINDOWS\system32\dndsioc.dll] [N/A, ]
[C:\WINDOWS\system32\fmbiost.dll] [N/A, ]
[C:\WINDOWS\system32\bincdwsa.dll] [N/A, ]
[C:\WINDOWS\system32\huifitc.dll] [N/A, ]
[C:\WINDOWS\system32\dbhlp32.dlL] [N/A, ]
[C:\WINDOWS\system32\ptshell.dll] [N/A, ]
[C:\WINDOWS\system32\fmsbbqi.dll] [N/A, ]
[C:\WINDOWS\system32\fmsjhif.dll] [N/A, ]
[C:\WINDOWS\system32\mfchlp64.dll] [N/A, ]
[C:\WINDOWS\system32\isndntio.dll] [N/A, ]
[C:\WINDOWS\system32\anistio.dll] [N/A, ]
[C:\WINDOWS\system32\dionpis.dll] [N/A, ]
[PID: 1228][C:\WINDOWS\regedit.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\SysCbCg.dll] [Microsoft Corporation, 5.1.2600.3099]
[C:\WINDOWS\system32\lxzxxy.dll] [N/A, ]
[C:\WINDOWS\system32\wipicdec.dll] [N/A, ]
[C:\WINDOWS\system32\ticisms.dll] [N/A, ]
[C:\WINDOWS\system32\hefcndy.dll] [N/A, ]
[C:\WINDOWS\system32\tciocp64.dll] [N/A, ]
[C:\WINDOWS\system32\yuwvcmoh.dll] [N/A, ]
[C:\WINDOWS\system32\WINSvr64.dll] [N/A, ]
[C:\WINDOWS\system32\yuiabct.dll] [N/A, ]
[C:\WINDOWS\system32\dndsioc.dll] [N/A, ]
[C:\WINDOWS\system32\fmbiost.dll] [N/A, ]
[C:\WINDOWS\system32\bincdwsa.dll] [N/A, ]
[C:\WINDOWS\system32\huifitc.dll] [N/A, ]
[C:\WINDOWS\system32\dbhlp32.dlL] [N/A, ]
[C:\WINDOWS\system32\ptshell.dll] [N/A, ]
[C:\WINDOWS\system32\fmsbbqi.dll] [N/A, ]
[C:\WINDOWS\system32\fmsjhif.dll] [N/A, ]
[C:\WINDOWS\system32\mfchlp64.dll] [N/A, ]
[C:\WINDOWS\system32\isndntio.dll] [N/A, ]
[C:\WINDOWS\system32\anistio.dll] [N/A, ]
[C:\WINDOWS\system32\dionpis.dll] [N/A, ]
[PID: 2440][D:\Tool\sreng2\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]
[C:\WINDOWS\system32\lxzxxy.dll] [N/A, ]
[C:\WINDOWS\system32\SysCbCg.dll] [Microsoft Corporation, 5.1.2600.3099]
[C:\WINDOWS\system32\wipicdec.dll] [N/A, ]
[C:\WINDOWS\system32\ticisms.dll] [N/A, ]
[C:\WINDOWS\system32\hefcndy.dll] [N/A, ]
[C:\WINDOWS\system32\tciocp64.dll] [N/A, ]
[C:\WINDOWS\system32\yuwvcmoh.dll] [N/A, ]
[C:\WINDOWS\system32\WINSvr64.dll] [N/A, ]
[C:\WINDOWS\system32\yuiabct.dll] [N/A, ]
[C:\WINDOWS\system32\dndsioc.dll] [N/A, ]
[C:\WINDOWS\system32\fmbiost.dll] [N/A, ]
[C:\WINDOWS\system32\bincdwsa.dll] [N/A, ]
[C:\WINDOWS\system32\huifitc.dll] [N/A, ]
[C:\WINDOWS\system32\dbhlp32.dlL] [N/A, ]
[C:\WINDOWS\system32\ptshell.dll] [N/A, ]
[C:\WINDOWS\system32\fmsbbqi.dll] [N/A, ]
[C:\WINDOWS\system32\fmsjhif.dll] [N/A, ]
[C:\WINDOWS\system32\mfchlp64.dll] [N/A, ]
[C:\WINDOWS\system32\isndntio.dll] [N/A, ]
[C:\WINDOWS\system32\anistio.dll] [N/A, ]
[C:\WINDOWS\system32\dionpis.dll] [N/A, ]

==================================
文件关联
.TXT Error. [C:\WINDOWS\notepad.exe %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM Error. ["hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

kakashi - 2008-5-28 9:16:00

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 560, C:\WINDOWS\SYSTEM32\WINLOGON.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 664, C:\WINDOWS\SYSTEM32\LSASS.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1316, C:\WINDOWS\SYSTEM32\SVCHOST.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1836, C:\WINDOWS\TEMP\_QOSEC2.MSI]
特殊特权被允许： SeLoadDriverPrivilege [PID = 336, C:\WINDOWS\TEMP\_QOSEC6.MSI]
特殊特权被允许： SeLoadDriverPrivilege [PID = 352, C:\WINDOWS\TEMP\_QOSEC7.MSI]
特殊特权被允许： SeLoadDriverPrivilege [PID = 364, C:\WINDOWS\TEMP\_QOSEC8.MSI]
特殊特权被允许： SeLoadDriverPrivilege [PID = 412, C:\WINDOWS\TEMP\_QOSEC10.MSI]
特殊特权被允许： SeLoadDriverPrivilege [PID = 932, C:\WINDOWS\TEMP\_QOSEC13.MSI]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1300, C:\WINDOWS\TEMP\_QOSEC16.MSI]
特殊特权被允许： SeLoadDriverPrivilege [PID = 676, C:\WINDOWS\TEMP\_QOSEC17.MSI]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1612, C:\WINDOWS\TEMP\_QOSEC20.MSI]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1632, C:\WINDOWS\TEMP\_QOSEC21.MSI]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1716, C:\WINDOWS\TEMP\_QOSEC22.MSI]
特殊特权被允许： SeLoadDriverPrivilege [PID = 764, C:\WINDOWS\TEMP\_QOSEC25.MSI]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2112, C:\WINDOWS\TEMP\_QOSEC27.MSI]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2720, C:\WINDOWS\TEMP\_QOSEC31.MSI]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2868, C:\WINDOWS\EXPLORER.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3116, C:\WINDOWS\TEMP\_QOSEC34.MSI]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3284, C:\WINDOWS\SOUNDMAN.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3296, C:\WINDOWS\SYSTEM32\IGFXTRAY.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3304, C:\WINDOWS\SYSTEM32\HKCMD.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3684, C:\WINDOWS\SYSTEM32\CTFMON.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1228, C:\WINDOWS\REGEDIT.EXE]

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

[/CODE]

天月来了 - 2008-5-28 9:26:00

:default2: 我也要疯了。

所有求助者都不愿意多看一会怎么发SRENG日志:default3:

tjcum210210 - 2008-5-28 9:30:00

我也快要疯了，这是木马几？

kakashi - 2008-5-28 9:38:00

版主...不是我不知道怎么发...

是我上传附件那里没有选择框,我逼不得已才粘贴出来...

网络延时很严重,旁边的表情之类的也无法显示...

望版主帮帮忙...谢谢了!! m(-_-)m

tjcum210210 - 2008-5-28 9:47:00

去看天月老大写的这个
http://bbs.ikaka.com/showtopic-8504511.aspx

[PID: 664][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\mfc40u.dll] [N/A, ]
这次我就看出来了，谢谢天月老大:default5:

天月来了 - 2008-5-28 9:51:00

直接将日志文件以附件的形式发这论坛来。

一定以附件形式发这论坛来。
点击你自己的主题贴右下角的“引用”或最右下角的那个较大的“回复”然后就应该知道怎么发了。

tjcum210210 - 2008-5-28 9:56:00

引用:

原帖由 kakashi 于 2008-5-28 9:38:00 发表
版主...不是我不知道怎么发...

是我上传附件那里没有选择框,我逼不得已才粘贴出来...

网络延时很严重,旁边的表情之类的也无法显示...

望版主帮帮忙...谢谢了!! m(-_-)m

用IE

kakashi - 2008-5-28 10:30:00

老大我知道啊...

我发过哪么多求助帖我不知道怎么上传吗?

问题是平时上传附件那里有个
上传附件-浏览...那个框...

但是我现在电脑中毒,
浏览那个框看不到

网络有问题!!我也很想上传!

我也没有办法啊!!!

所以我才全贴了出来....

kakashi - 2008-5-28 10:31:00

我用的就是IE...

网络被劫持...任务栏无法显示...

而且用ssr扫描的时候都无法显示..
都是SSR用的紧急扫描...

我也没有办法了...才来求助的...

天月来了 - 2008-5-28 11:18:00

我将你日志整理合在一起上传一下，等他们给你看吧。

附件: 1.txt

kakashi - 2008-5-28 11:55:00

谢谢版主!~~

瑞星卡卡安全论坛