==================================
浏览器加载项
[]
{0BA96DE2-C156-43DA-B61F-3E622C5704EF} <C:\WINNT\System32\geebx.dll, N/A>
[]
{35F7813A-AF74-4474-B1DC-7EE6FB6C43C6} <C:\WINNT\System32\xfcmbcrr.dll, N/A>
[]
{46A4E9D9-B30E-452A-8157-DBBEC8573B03} <C:\Program Files\VSAdd-in\VSAdd-in.dll, N/A>
[]
{7DA39570-5FD2-4f18-94B4-20730CB3F727} <C:\WINNT\System32\yfiyucjf.dll, N/A>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[访问瑞星网站]
{FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E444} <http://www.rising.com.cn/?u=RSTB, N/A>
[访问卡卡社区]
{FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E445} <http://www.ikaka.com/?u=RSTB, N/A>
[@msdxmLC.dll,-1@2052,电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\System32\msdxm.ocx, Microsoft Corporation>
[&VSAdd-in]
{74DD705D-6834-439C-A735-A6DBE2677452} <C:\Program Files\VSAdd-in\VSAdd-in.dll, N/A>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINNT\System32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[Shockwave Flash
Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\System32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[YOKHttpFilter Class]
{686D3343-D00D-49A1-96DF-66F3AF62F348} <C:\PROGRA~1\yok\adblock.dll, N/A>
[YOKAdBlock Class]
{718F4AD3-70D4-425E-9159-5598DFC732ED} <C:\PROGRA~1\yok\adblock.dll, N/A>
[ >> 彩信发送 <<]
<res://C:\PROGRA~1\MMSASS~1\Mmsass~1.dll/mms.htm, N/A>
[ 发送图片到手机]
<C:\Program Files\Moyu\MenuSendImg.htm, N/A>
[ 经KK图铃通发送到手机]
<C:\Program Files\ZCOMPRDIY\MenuSendImg.htm, N/A>
[上传到QQ网络硬盘]
<C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
<C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[珊瑚虫超级搜索]
<C:\PROGRA~1\yok\yoksch.htm, N/A>
[用QQ彩信发送该图片]
<C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>
==================================
正在运行的进程
[PID: 228][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.00.2195.5382]
[PID: 248][\??\C:\WINNT\system32\csrss.exe] [Microsoft Corporation, 5.00.2195.5265]
[PID: 268][\??\C:\WINNT\system32\winlogon.exe] [Microsoft Corporation, 5.00.2195.5386]
[C:\WINNT\System32\geebx.dll] [N/A, N/A]
[PID: 296][C:\WINNT\system32\services.exe] [Microsoft Corporation, 5.00.2195.3940]
[C:\WINNT\system32\dmserver.dll] [VERITAS Software Corp., 2195.3649.297.3]
[PID: 308][C:\WINNT\system32\lsass.exe] [Microsoft Corporation, 5.00.2195.5430]
[PID: 472][C:\WINNT\system32\svchost.exe] [Microsoft Corporation, 5.00.2134.1]
[PID: 500][C:\Program Files\Rising\Rav\CCenter.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
[PID: 552][C:\WINNT\system32\spoolsv.exe] [Microsoft Corporation, 5.00.2195.4299]
[PID: 592][C:\Program Files\Yuguo\EAZClnt.exe] [N/A, N/A]
[C:\Program Files\Yuguo\client.dll] [, 1, 3, 0, 1]
[C:\Program Files\Yuguo\shdapi.dll] [N/A, N/A]
[C:\Program Files\Yuguo\schedule.dll] [N/A, N/A]
[C:\Program Files\Yuguo\shdservps.dll] [N/A, N/A]
[PID: 608][C:\WINNT\System32\svchost.exe] [Microsoft Corporation, 5.00.2134.1]
[c:\winnt\system32\usbpda.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 652][C:\PROGRA~1\MICROS~2\MSSQL\binn\sqlservr.exe] [Microsoft Corporation, 2000.080.0194.00]
[PID: 764][C:\WINNT\system32\regsvc.exe] [Microsoft Corporation, 5.00.2195.3649]
[PID: 784][C:\WINNT\System32\SCardSvr.exe] [Microsoft Corporation, 5.00.2195.3649]
[PID: 804][C:\WINNT\system32\MSTask.exe] [Microsoft Corporation, 4.71.2195.1]
[PID: 860][C:\Program Files\Yuguo\shdserv.exe] [南京安悦科技有限公司, 1, 3, 1, 0]
[C:\Program Files\Yuguo\shdapi.dll] [N/A, N/A]
[C:\Program Files\Yuguo\shdservps.dll] [N/A, N/A]
[PID: 908][C:\Program Files\Common Files\sinfor\logs\logs.exe] [深圳市深信服电子科技有限公司, 1, 0, 0, 0]
[PID: 932][C:\Program Files\Rising\Rav\RavStub.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 4]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[PID: 1016][C:\WINNT\System32\dllcache\tmpgenc.exe] [N/A, N/A]
[PID: 1080][C:\WINNT\System32\WBEM\WinMgmt.exe] [Microsoft Corporation, 1.50.1085.0070]
[PID: 1404][C:\WINNT\System32\svchost.exe] [Microsoft Corporation, 5.00.2134.1]
[PID: 1220][C:\WINNT\Explorer.EXE] [Microsoft Corporation, 5.00.3502.5321]
[C:\WINNT\System32\geebx.dll] [N/A, N/A]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[C:\Program Files\Yuguo\idle.dll] [N/A, N/A]
[C:\WINNT\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 7]
[C:\WINNT\System32\xfcmbcrr.dll] [N/A, N/A]
[C:\WINNT\System32\yfiyucjf.dll] [N/A, N/A]
[PID: 1512][C:\Program Files\Sinfor\NG PDLAN\NGwatch.exe] [, 1, 0, 0, 2]
[C:\Program Files\Sinfor\NG PDLAN\EP1kDL20.dll] [http://www.ftsafe.com, 3, 2, 2002, 427]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[PID: 1524][C:\Program Files\Yuguo\EAZTray.exe] [南京安悦科技有限公司, 1, 3, 1, 0]
[C:\Program Files\Yuguo\shdapi.dll] [N/A, N/A]
[C:\Program Files\Yuguo\shdservps.dll] [N/A, N/A]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[C:\Program Files\Yuguo\idle.dll] [N/A, N/A]
[PID: 1552][C:\WINNT\System32\RunDll32.exe] [Microsoft Corporation, 5.00.2134.1]
[C:\WINNT\system\cmicnfg.cpl] [C-Media Corporation, 1, 0, 0, 35]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[PID: 1492][C:\Program Files\Rising\AntiSpyware\runiep.exe] [Beijing Rising Technology Co., Ltd., 1, 0, 1, 3]
[C:\Program Files\Rising\AntiSpyware\iep_ctrl.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[PID: 1548][C:\WINNT\System32\internat.exe] [Microsoft Corporation, 5.00.2920.0000]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[PID: 1620][C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe] [Microsoft Corporation, 2000.080.0194.00]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[PID: 1212][C:\Program Files\racer-henan-cnc\racer.exe] [Putian Runway, 2, 0, 51, 92]
[C:\Program Files\racer-henan-cnc\rwxre.dll] [Mozilla Foundation, 1.7.3: 2005040616]
[C:\Program Files\racer-henan-cnc\nspr4.dll] [Netscape Communications Corporation, 4.5 Beta]
[C:\Program Files\racer-henan-cnc\xpcom.dll] [Mozilla Foundation, 1.7.3: 2005040616]
[C:\Program Files\racer-henan-cnc\nss3.dll] [Netscape Communications Corporation, 3.9.1]
[C:\Program Files\racer-henan-cnc\softokn3.dll] [Netscape Communications Corporation, 3.9.1]
[C:\Program Files\racer-henan-cnc\gkgfx.dll] [Mozilla Foundation, 1.7.3: 2005040616]
[C:\Program Files\racer-henan-cnc\js3250.dll] [Netscape Communications Corporation, 4.0]
[C:\Program Files\racer-henan-cnc\components\racer_base_comp.dll] [Putian Runway, 2,0,47,87]
[C:\Program Files\racer-henan-cnc\xpcom_compat.dll] [Mozilla Foundation, 1.7.3: 2005040616]
[C:\Program Files\racer-henan-cnc\racer_base.dll] [Putian Runway, 2,0,47,87]
[C:\Program Files\racer-henan-cnc\components\pipnss.dll] [Mozilla Foundation, 1.7.3: 2005040616]
[C:\Program Files\racer-henan-cnc\components\gklayout.dll] [Mozilla Foundation, 1.7.3: 2005040616]
[C:\Program Files\racer-henan-cnc\components\jar50.dll] [Mozilla Foundation, 1.7.3: 2005040616]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[C:\Program Files\racer-henan-cnc\components\xpcom_compat_c.dll] [Mozilla Foundation, 1.7.3: 2005040616]
[C:\Program Files\racer-henan-cnc\components\racer_ad_comp.dll] [Putian Runway, 2,0,47,87]
[C:\Program Files\Yuguo\idle.dll] [N/A, N/A]
[C:\Program Files\racer-henan-cnc\components\racer_access_dhcpplus.dll] [Putian Runway, 2,0,47,87]
[C:\Program Files\racer-henan-cnc\dhcpplus.dll] [北京润汇科技有限公司, 0, 13, 21, 45]
[C:\Program Files\racer-henan-cnc\components\racer_nss4_comp.dll] [Putian Runway, 2,0,47,87]
[C:\Program Files\racer-henan-cnc\nss4.dll] [北京普天润汇科技有限公司, 1, 0, 0, 3]
[C:\Program Files\racer-henan-cnc\wpcap.dll] [Politecnico di Torino, 3, 0, 0, 18]
[C:\Program Files\racer-henan-cnc\pthreadVC.dll] [N/A, N/A]
[C:\Program Files\racer-henan-cnc\packet.dll] [Politecnico di Torino, 3, 0, 0, 18]
[PID: 1840][C:\Program Files\racer-henan-cnc\RacerKp.exe] [北京润汇科技有限公司, 1, 0, 0, 1]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[PID: 1888][C:\WINNT\system32\dllcache\iexplore.exe] [Microsoft Corporation, 5.00.2920.0000]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[C:\WINNT\System32\geebx.dll] [N/A, N/A]
[C:\WINNT\System32\xfcmbcrr.dll] [N/A, N/A]
[C:\WINNT\System32\yfiyucjf.dll] [N/A, N/A]
[C:\WINNT\System32\kakatool.dll] [Beijing Rising Technology Co., Ltd., 2, 0, 2, 6]
[C:\Program Files\Yuguo\idle.dll] [N/A, N/A]
[C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINNT\System32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[PID: 1960][G:\SREng.exe] [Smallfrogs Studio, 2.3.13.690]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[C:\Program Files\Yuguo\idle.dll] [N/A, N/A]
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINNT\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1 localhost
==================================
API HOOK
N/A
==================================
[/CODE]
