[C:\Herosoft\HeroV8\VCvtShell.dll] [herosoft, 1, 0, 0, 1]
[C:\WINDOWS\DOWNLO~1\CnsMinEx.dll] [国风因特软件(北京)有限公司, 1, 0, 3, 5]
[C:\PROGRA~1\3721\helper.dll] [, 1, 1, 1, 1327]
[PID: 1640][C:\WINDOWS\SERVICES.EXE] [Bntt, 0.00.0198]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 1, 5, 3, 6]
[C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Herosoft\HeroV8\VCvtShell.dll] [herosoft, 1, 0, 0, 1]
[PID: 1656][C:\WINDOWS\System32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 1, 5, 3, 6]
[C:\Herosoft\HeroV8\VCvtShell.dll] [herosoft, 1, 0, 0, 1]
[PID: 1964][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 1, 5, 3, 6]
[C:\WINDOWS\DOWNLO~1\CnsHint.dll] [3721, 1, 0, 1, 2]
[C:\WINDOWS\DOWNLO~1\cnsplus.dll] [3721, 1, 0, 0, 2]
[C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\System32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[C:\WINDOWS\DOWNLO~1\CnsHook.dll] [北京三七二一科技有限公司, 1, 0, 4, 2]
[C:\Herosoft\HeroV8\VCvtShell.dll] [herosoft, 1, 0, 0, 1]
[C:\WINDOWS\DOWNLO~1\CnsMinIO.dll] [北京三七二一科技有限公司, 1, 0, 3, 7]
[C:\WINDOWS\DOWNLO~1\cnsio.dll] [北京三七二一科技有限公司, 1, 0, 2, 8]
[C:\PROGRA~1\3721\helper.dll] [, 1, 1, 1, 1327]
[C:\PROGRA~1\3721\scrblock.dll] [3721, 1, 0, 1, 1000]
[C:\PROGRA~1\3721\alrex.dll] [, 1, 0, 1, 1001]
[C:\WINDOWS\System32\JPWB.IME] [常诚研制, 4.00.950]
[C:\PROGRA~1\3721\autolive.dll] [, 1, 2, 0, 1330]
[C:\PROGRA~1\3721\alLiveEx.dll] [ , 1, 0, 3, 1006]
[C:\PROGRA~1\Yahoo!\ASSIST~1\yalive.dll] [yahoo! china, 3,4,9,1100]
[PID: 260][C:\Program Files\Rising\AntiSpyware\Ras.exe] [Beijing Rising Technology Co., Ltd., 1, 0, 3, 5]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 1, 5, 3, 6]
[C:\Program Files\Rising\AntiSpyware\RasGui.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]
[C:\WINDOWS\DOWNLO~1\CnsHook.dll] [北京三七二一科技有限公司, 1, 0, 4, 2]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 7]
[C:\Program Files\Rising\AntiSpyware\engine.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 18]
[C:\Program Files\Rising\AntiSpyware\zip.dll] [rising, 13, 0, 0, 1]
[C:\Herosoft\HeroV8\VCvtShell.dll] [herosoft, 1, 0, 0, 1]
[PID: 460][C:\Program Files\Rising\Rav\Rav.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 28]
[C:\Program Files\Rising\Rav\PlugIn\RsPgScan.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 17]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\Rav\RavUI.Dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 30]
[C:\Program Files\Rising\Rav\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 28]
[C:\Program Files\Rising\Rav\RsXML.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 1, 5, 3, 6]
[C:\Herosoft\HeroV8\VCvtShell.dll] [herosoft, 1, 0, 0, 1]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[C:\Program Files\Rising\Rav\Scanner.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 8]
[C:\Program Files\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 6]
[C:\Program Files\Rising\Rav\RavQu.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
[C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\Rising\Rav\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[PID: 600][C:\Program Files\Rising\Rav\CopyRun\RavCopy.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 3]
[C:\PROGRAM FILES\RISING\RAV\COPYRUN\Update.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 17]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 1, 5, 3, 6]
[C:\Herosoft\HeroV8\VCvtShell.dll] [herosoft, 1, 0, 0, 1]
[PID: 968][C:\WINDOWS\system32\rundll32.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\PROGRA~1\3721\helper.dll] [, 1, 1, 1, 1327]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 1, 5, 3, 6]
[C:\Herosoft\HeroV8\VCvtShell.dll] [herosoft, 1, 0, 0, 1]
[C:\PROGRA~1\3721\autolive.dll] [, 1, 2, 0, 1330]
[C:\PROGRA~1\3721\alLiveEx.dll] [ , 1, 0, 3, 1006]
[C:\PROGRA~1\3721\notifier.dll] [, 1, 0, 0, 5]
[PID: 1792][C:\Program Files\WinRAR\WinRAR.exe] [N/A, N/A]
[C:\PROGRA~1\3721\helper.dll] [, 1, 1, 1, 1327]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 1, 5, 3, 6]
[C:\Herosoft\HeroV8\VCvtShell.dll] [herosoft, 1, 0, 0, 1]
[PID: 1808][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.796\SREng\SREng.exe] [Smallfrogs Studio, 2.2.6.605]
[C:\PROGRA~1\3721\helper.dll] [, 1, 1, 1, 1327]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 1, 5, 3, 6]
[C:\Herosoft\HeroV8\VCvtShell.dll] [herosoft, 1, 0, 0, 1]
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
[C:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\Auto\command=setup.exe
[D:\]
[autorun]
OPEN=D:\pagefile.pif
[E:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\Auto\command=setup.exe
[F:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\Auto\command=setup.exe
==================================
HOSTS 文件
D$t9婦$鯜t#j
塭饗?剸
兞僲塎EPQ峂ㄨX
崓`鑴5婨婬M婾髦#螇昤媁墠d3鯮嬎艵?壍l壍p鑻7婡婱崟`墔tR岴▔峹P崗
u 呟t岰?3缷
f吷t V峝$
u
h
動
hW
閫
?E靿e饀
?@
竁
?R桕
V鑖
嫊镊??3蹗嵲?菂洒?D
烫蘍婦$ U媗$V嬹婰$W媩$
??媀塒媬?t+媀嬎+柿?陵?讒蚜?3荔珛蕛?螵_塣^?[?
?J咑u,呉??PR?
烫烫烫烫烫U嬱jhC
嶄?崊lQ艵?墔h計饍?侢€
€
I吷??PR??hW
]?
u兠^塢
t兤兟;饁婵
WPQ
]?
烫烫谈0
uk媱$,
億$w畫D$$?YA
(~@+?鲘<
u兣塴$3离?
,
墳,#
舞吚叿
D$_墕@#
U嬱jh攸C
?
I吷隣咑u3离嬈峆?岻
E鑳鲤艵
??J呉??PR婨鑳鲤艵
"???
烫烫烫烫U嬱jh
'
嬋R兝塃荅?
??J呉??PR岰鹎E?岺兪??J呉??PR奅飲M鬱
??PR婱鬫^2纃
鑾件f嫀*
匎婬魤叴?媶d
鑼@;脈
菃h
菃h
I吷??PR婱魦吥?d
嵆?
$(塋$,峀$塗$?墡
?孁?|t峊$R嬎璇簋孁?}媗$莾h
} _^莾h
}莾h
嬑莾h
婰$ 婽$8
峃柁-3??鑹L$塋$塅塅墕
d
塋$ 峀$塗$?墡
?|X峊$R嬎杪稔孁?}媗$莾h
婰$ 婽$8
峃棹+3??鑹L$塋$塅塅墕
d
塋$ 峀$塗$?墡
?|X峊$R嬎桠睨孁?}媗$莾h
婰$ 婽$8
峃?*3??鑹L$塋$塅塅墕
T7
刏
I吷??PR岲$ P峀$h(<D
I吷??PRQ嬏塪$h D
?J呉??PR媡$ 媈鬝塡$,鐯
j
婽$DQ嬏塪$ R枳FQ嬏塪$(hD"D
苿$`7
t兝?婦$,嬏塪$ P苿$l7
?V塂$4PD
