第一次发现中的时候是系统启动时提示杀毒软件的DLL文件损坏了，于是重装了一下，杀了一下毒，杀了2百多个变形虫，杀完后重启，又提示防火墙的DLL文件损坏了，重装，快装完的时候提示被用户中止，无法安装

NND，瑞星怎么这么烂的啊

引用高手的话

下载 System Repair Engineer，
http://www.kztechs.com/sreng/download.html
1 解压缩sreng2.zip
2 运行SREng.exe
3 智能扫描=》扫描=》保存报告
4 把日志中的报告完整拷贝贴上来，不要修改（日志很长，一个帖子搞不完，请手动将全部内容分多个回复帖子传上来）。

[CODE]

2007-06-27,09:38:43

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Server Service Pack 4 (Build 2195) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <Internat.exe><internat.exe>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe>  [Beijing Rising Technology Co., Ltd.]
    <SunJavaUpdateSched><C:\Program Files\Java\jre1.5.0\bin\jusched.exe>  [Sun Microsystems, Inc.]
    <RfwMain><"e:\Program Files\Rising\Rfw\rfwmain.exe" -Startup>  [Beijing Rising Technology Co., Ltd.]
    <RavTask><"e:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
    <Synchronization Manager><mobsync.exe /logon>  [(Verified)Microsoft Windows 2000 Publisher]
    <Spooler SubSystem App><C:\WINNT\system32\spoolsvc.exe>  [N/A]
    <Application Layer Gateway Service><C:\WINNT\system32\algs.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><EXPLORER.EXE>  [(Verified)Microsoft Windows 2000 Publisher]
    <Userinit><userinit.exe,>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINNT\system32\RavExt.dll>  [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\PCANotify]
    <WinlogonNotify: PCANotify><PCANotify.dll>  [Symantec Corporation]
[HKEY_CURRENT_USER\Control Panel\Desktop]
    <SCRNSAVE.EXE><(无)>  [N/A]

==================================
启动文件夹
[余额查询]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\XX查询.bat -->  [N/A]><N>
[服务管理器]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\服务管理器.lnk --> C:\PROGRA~1\MICROS~2\80\Tools\Binn\sqlmangr.exe [Microsoft Corporation]><N>
[XXXX监控]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\XXXX监控.bat -->  [N/A]><N>
[jboss4]
  <C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\jboss4.lnk --> H:\jboss4\jboss4\bin\run.bat [N/A]><N>
[快捷方式 scktsrvr.exe]
  <C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\快捷方式 scktsrvr.exe.lnk --> F:\XXX~1\scktsrvr.exe [Borland Software Corporation]><N>

==================================
服务
[Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start]
  <C:\WINNT\System32\Ati2evxx.exe><ATI Technologies Inc.>
[pcAnywhere Host Service / awhost32][Running/Auto Start]
  <E:\Program Files\Symantec\pcAnywhere\awhost32.exe><Symantec Corporation>
[Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[Microsoft Search / MSSEARCH][Running/Auto Start]
  <"C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe"><Microsoft Corporation>
[MSSQLSERVER / MSSQLSERVER][Running/Auto Start]
  <f:\PROGRA~1\MICROS~1\MSSQL\binn\sqlservr.exe><Microsoft Corporation>
[MSSQLServerADHelper / MSSQLServerADHelper][Stopped/Manual Start]
  <C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe><Microsoft Corporation>
[Rising Proxy  Service / RfwProxySrv][Stopped/Manual Start]
  <e:\program files\rising\rfw\rfwproxy.exe><N/A>
[Rising Personal Firewall Service / RfwService][Stopped/Auto Start]
  <e:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
  <"e:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
  <"E:\PROGRAM FILES\RISING\RAV\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[SQLSERVERAGENT / SQLSERVERAGENT][Running/Auto Start]
  <f:\PROGRA~1\MICROS~1\MSSQL\binn\sqlagent.exe><Microsoft Corporation>
[Apache Tomcat / Tomcat5][Running/Auto Start]
  <e:\Tomcat 5.0\bin\tomcat.exe //RS//Tomcat5><Apache Software Foundation>
[Windows系统 / Windows系统][Stopped/Auto Start]
  <C:\WINNT\system32\svchost.txt><N/A>
[Windows Management Service / wms][Running/Auto Start]
  <C:\WINNT\system32\wms.exe><N/A>

==================================
驱动程序
[AMGuard MPDriver / AMGuard][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\AMGuard.sys><N/A>
[AntiARP NDIS Protocol Driver / AntiArpNdisProt][Running/Auto Start]
  <system32\DRIVERS\AntiArpNdisProt.sys><Windows (R) 2000 DDK provider>
[ati2mtag / ati2mtag][Running/Manual Start]
  <System32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[awecho / awecho][Running/System Start]
  <system32\drivers\awechomd.sys><Symantec Corporation>
[awlegacy / awlegacy][Running/System Start]
  <\SystemRoot\System32\Drivers\awlegacy.sys><Symantec Corporation>
[AW_HOST / AW_HOST][Running/System Start]
  <system32\drivers\aw_host5.sys><Symantec Corporation>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
  <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[cocpyinf / cocpyinf][Stopped/Disabled]
  <\SystemRoot\system32\drivers\cocpyinf.dll><Windows (R) 2000 DDK provider>
[dmboot / dmboot][Stopped/Disabled]
  <System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[Intel(R) PRO/1000 Network Connection Driver / E1000][Running/Manual Start]
  <System32\DRIVERS\e1000nt5.sys><Intel Corporation>
[ExpScaner / ExpScaner][Running/Auto Start]
  <\??\E:\PROGRAM FILES\RISING\RAV\ExpScan.sys><>
[HookCont / HookCont][Running/Auto Start]
  <\??\E:\PROGRAM FILES\RISING\RAV\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
  <\??\E:\PROGRAM FILES\RISING\RAV\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
  <\??\E:\PROGRAM FILES\RISING\RAV\HookSys.sys><Rising>
[HookUrl / HookUrl][Stopped/Auto Start]
  <\??\e:\Program Files\Rising\Rfw\HookUrl.sys><N/A>
[MEMSCAN / MEMSCAN][Running/Auto Start]
  <\??\E:\PROGRAM FILES\RISING\RAV\MEMSCAN.sys><瑞星软件有限公司>
[mProcRs / mProcRs][Stopped/Auto Start]
  <\??\e:\program files\rising\rfw\mProcRs.sys><N/A>
[oreans32 / oreans32][Running/System Start]
  <\??\C:\WINNT\system32\drivers\oreans32.sys><N/A>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
  <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising Technology Co., Ltd.>
[RsFwDrv / RsFwDrv][Stopped/Auto Start]
  <\??\e:\Program Files\Rising\Rfw\RsFwDrv.sys><N/A>
[RsNTGDI / RsNTGDI][Running/Boot Start]
  <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
  <\??\E:\PROGRAM FILES\RISING\RAV\RSPPSYS.sys><Rising>
[SymEvent / SymEvent][Stopped/Manual Start]
  <\??\C:\Program Files\Symantec\SYMEVENT.SYS><Symantec Corporation>
[symmpi / symmpi][Running/Boot Start]
  <\SystemRoot\system32\drivers\symmpi.sys><LSI Logic>
[xAntiArpSpoof Service / xAntiArp][Running/Manual Start]
  <system32\DRIVERS\xAntiArp.sys><Windows (R) 2000 DDK provider>

==================================
浏览器加载项
[WebThunder Browser Helper]
  {00000AAA-A363-466E-BEF5-9BB68697AA7F} <e:\Program Files\Thunder Network\WebThunder\WebThunderBHO_016.dll, Thunder Networking Technologies,LTD>
[FGCatchUrl]
  {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <E:\Program Files\FlashGet\jccatch.dll, www.flashget.com>
[FlashGet GetFlash Class]
  {F156768E-81EF-470C-9057-481BA8380DBA} <e:\Program Files\FlashGet\getflash.dll, www.flashget.com>
[Java Plug-in 1.5.0]
  {08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll, Sun Microsystems, Inc.>
[启动Web迅雷]
  {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} <http://my.xunlei.com, N/A>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <e:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[快车]
  {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <e:\Program Files\FlashGet\FlashGet.exe, FlashGet.com>
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\System32\msdxm.ocx, Microsoft Corporation>
[Java Plug-in 1.5.0]
  {8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.5.0]
  {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll, Sun Microsystems, Inc.>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\System32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>
[FGAutoLive]
  {F90D830D-C175-4bbe-82C7-FF94669A4C42} <e:\Program Files\FlashGet\fgupdate.dll, www.flashget.com>
[FGCatchUrl]
  {FB5DA724-162B-11D3-8B9B-AA70B4B0B524} <E:\Program Files\FlashGet\jccatch.dll, www.flashget.com>
[&使用快车(FlashGet)下载]
  <E:\Program Files\FlashGet\jc_link.htm, N/A>
[&使用快车(FlashGet)下载全部链接]
  <E:\Program Files\FlashGet\jc_all.htm, N/A>
[上传到QQ网络硬盘]
  <E:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用Web迅雷下载]
  <e:\Program Files\Thunder Network\WebThunder\GetUrl.htm, N/A>
[使用Web迅雷下载全部链接]
  <e:\Program Files\Thunder Network\WebThunder\GetAllUrl.htm, N/A>
[添加到QQ自定义面板]
  <E:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <E:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <E:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 180][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 208][\??\C:\WINNT\system32\csrss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 232][\??\C:\WINNT\system32\winlogon.exe]  [Microsoft Corporation, 5.00.2195.6714]
    [C:\WINNT\system32\Ati2evxx.dll]  [ATI Technologies Inc., 6.14.10.4110]
    [C:\WINNT\system32\PCANotify.dll]  [Symantec Corporation, 11.5.0.121]
    [C:\WINNT\system32\MSVCR70.dll]  [Microsoft Corporation, 7.00.9466.0]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [E:\Program Files\Symantec\pcAnywhere\AWHK32.dll]  [Symantec Corporation, 11.5.0.121]
[PID: 260][C:\WINNT\system32\services.exe]  [Microsoft Corporation, 5.00.2195.6700]
    [C:\WINNT\system32\dmserver.dll]  [VERITAS Software Corp., 2195.6605.297.3]
[PID: 272][C:\WINNT\system32\lsass.exe]  [Microsoft Corporation, 5.00.2195.6695]
[PID: 468][C:\WINNT\Explorer.EXE]  [Microsoft Corporation, 5.00.3700.6690]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
    [C:\WINNT\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
    [E:\Program Files\Symantec\pcAnywhere\AWHK32.dll]  [Symantec Corporation, 11.5.0.121]
    [C:\WINNT\system32\MSVCR70.dll]  [Microsoft Corporation, 7.00.9466.0]
    [e:\Program Files\Thunder Network\WebThunder\WebThunderBHO_016.dll]  [Thunder Networking Technologies,LTD, 6, 0, 0, 5]
    [C:\WINNT\system32\MSVCP60.dll]  [Microsoft Corporation, 6.00.8972.0]
[PID: 2660][C:\Program Files\Rising\AntiSpyware\runiep.exe]  [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6]
    [C:\Program Files\Rising\AntiSpyware\iep_ctrl.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [E:\Program Files\Symantec\pcAnywhere\AWHK32.dll]  [Symantec Corporation, 11.5.0.121]
    [C:\WINNT\system32\MSVCR70.dll]  [Microsoft Corporation, 7.00.9466.0]
[PID: 2696][C:\Program Files\Java\jre1.5.0\bin\jusched.exe]  [Sun Microsystems, Inc., 1.5.0.0]
    [E:\Program Files\Symantec\pcAnywhere\AWHK32.dll]  [Symantec Corporation, 11.5.0.121]
    [C:\WINNT\system32\MSVCR70.dll]  [Microsoft Corporation, 7.00.9466.0]
[PID: 2720][C:\Program Files\Java\jre1.5.0\bin\jucheck.exe]  [Sun Microsystems, Inc., 1.5.0.0]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [E:\Program Files\Symantec\pcAnywhere\AWHK32.dll]  [Symantec Corporation, 11.5.0.121]
    [C:\WINNT\system32\MSVCR70.dll]  [Microsoft Corporation, 7.00.9466.0]
[PID: 2792][C:\WINNT\system32\algs.exe]  [N/A, ]
    [E:\Program Files\Symantec\pcAnywhere\AWHK32.dll]  [Symantec Corporation, 11.5.0.121]
    [C:\WINNT\system32\MSVCR70.dll]  [Microsoft Corporation, 7.00.9466.0]
[PID: 2796][C:\WINNT\system32\internat.exe]  [Microsoft Corporation, 5.00.2920.0000]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [E:\Program Files\Symantec\pcAnywhere\AWHK32.dll]  [Symantec Corporation, 11.5.0.121]
    [C:\WINNT\system32\MSVCR70.dll]  [Microsoft Corporation, 7.00.9466.0]
[PID: 2892][C:\WINNT\system32\conime.exe]  [Microsoft Corporation, 5.00.2195.6655]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [E:\Program Files\Symantec\pcAnywhere\AWHK32.dll]  [Symantec Corporation, 11.5.0.121]
    [C:\WINNT\system32\MSVCR70.dll]  [Microsoft Corporation, 7.00.9466.0]
[PID: 3024][C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe]  [Microsoft Corporation, 2000.080.0194.00]
    [C:\Program Files\Microsoft SQL Server\80\Tools\Binn\W95SCM.dll]  [Microsoft Corporation, 2000.080.0194.00]
    [C:\WINNT\system32\SQLUNIRL.dll]  [Microsoft Corporation, 2000.080.0194.00]
    [C:\Program Files\Microsoft SQL Server\80\Tools\Binn\SQLSVC.dll]  [Microsoft Corporation, 2000.080.0194.00]
    [C:\WINNT\system32\odbcbcp.dll]  [Microsoft Corporation,  2000.080.0194.00]
    [C:\Program Files\Microsoft SQL Server\80\Tools\Binn\SQLRESLD.dll]  [Microsoft Corporation, 2000.080.0194.00]
    [C:\Program Files\Microsoft SQL Server\80\Tools\Binn\Resources\2052\SQLSVC.RLL]  [Microsoft Corporation, 2000.080.0194.00]
    [C:\Program Files\Microsoft SQL Server\80\Tools\Binn\Resources\2052\sqlmangr.RLL]  [Microsoft Corporation, 2000.080.0194.00]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [E:\Program Files\Symantec\pcAnywhere\AWHK32.dll]  [Symantec Corporation, 11.5.0.121]
    [C:\WINNT\system32\MSVCR70.dll]  [Microsoft Corporation, 7.00.9466.0]
[PID: 3068][C:\WINNT\system32\cmd.exe]  [Microsoft Corporation, 5.00.2195.6656]
[PID: 2704][C:\WINNT\system32\java.exe]  [Sun Microsystems, Inc., 1.5.0.0]
    [C:\Program Files\Java\jre1.5.0\bin\client\jvm.dll]  [Sun Microsystems, Inc., 1.5.0.0]
    [C:\Program Files\Java\jre1.5.0\bin\hpi.dll]  [Sun Microsystems, Inc., 1.5.0.0]
    [C:\Program Files\Java\jre1.5.0\bin\verify.dll]  [Sun Microsystems, Inc., 1.5.0.0]
    [C:\Program Files\Java\jre1.5.0\bin\java.dll]  [Sun Microsystems, Inc., 1.5.0.0]
    [C:\Program Files\Java\jre1.5.0\bin\zip.dll]  [Sun Microsystems, Inc., 1.5.0.0]
    [C:\Program Files\Java\jre1.5.0\bin\net.dll]  [Sun Microsystems, Inc., 1.5.0.0]
[PID: 3172][F:\XXX系统服务端\scktsrvr.exe]  [Borland Software Corporation, 6.0.6.163]
    [E:\Program Files\Symantec\pcAnywhere\AWHK32.dll]  [Symantec Corporation, 11.5.0.121]
    [C:\WINNT\system32\MSVCR70.dll]  [Microsoft Corporation, 7.00.9466.0]
[PID: 1252][E:\Program Files\Rising\Rav\RsAgent.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 12]
    [E:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [E:\Program Files\Symantec\pcAnywhere\AWHK32.dll]  [Symantec Corporation, 11.5.0.121]
    [C:\WINNT\system32\MSVCR70.dll]  [Microsoft Corporation, 7.00.9466.0]
[PID: 3236][C:\WINNT\msagent\AgentSvr.exe]  [Microsoft Corporation, 2.00.0.3422]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [E:\Program Files\Symantec\pcAnywhere\AWHK32.dll]  [Symantec Corporation, 11.5.0.121]
    [C:\WINNT\system32\MSVCR70.dll]  [Microsoft Corporation, 7.00.9466.0]
[PID: 3372][C:\WINNT\system32\taskmgr.exe]  [Microsoft Corporation, 5.00.2195.6620]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [E:\Program Files\Symantec\pcAnywhere\AWHK32.dll]  [Symantec Corporation, 11.5.0.121]
    [C:\WINNT\system32\MSVCR70.dll]  [Microsoft Corporation, 7.00.9466.0]
[PID: 3224][C:\Documents and Settings\Administrator\桌面\sreng2\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
    [E:\Program Files\Symantec\pcAnywhere\AWHK32.dll]  [Symantec Corporation, 11.5.0.121]
    [C:\WINNT\system32\MSVCR70.dll]  [Microsoft Corporation, 7.00.9466.0]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]

==================================
正在运行的进程
[PID: 180][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 208][\??\C:\WINNT\system32\csrss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 232][\??\C:\WINNT\system32\winlogon.exe]  [Microsoft Corporation, 5.00.2195.6714]
    [C:\WINNT\system32\Ati2evxx.dll]  [ATI Technologies Inc., 6.14.10.4110]
    [C:\WINNT\system32\PCANotify.dll]  [Symantec Corporation, 11.5.0.121]
    [C:\WINNT\system32\MSVCR70.dll]  [Microsoft Corporation, 7.00.9466.0]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [E:\Program Files\Symantec\pcAnywhere\AWHK32.dll]  [Symantec Corporation, 11.5.0.121]
[PID: 260][C:\WINNT\system32\services.exe]  [Microsoft Corporation, 5.00.2195.6700]
    [C:\WINNT\system32\dmserver.dll]  [VERITAS Software Corp., 2195.6605.297.3]
[PID: 272][C:\WINNT\system32\lsass.exe]  [Microsoft Corporation, 5.00.2195.6695]
[PID: 468][C:\WINNT\Explorer.EXE]  [Microsoft Corporation, 5.00.3700.6690]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
    [C:\WINNT\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
    [E:\Program Files\Symantec\pcAnywhere\AWHK32.dll]  [Symantec Corporation, 11.5.0.121]
    [C:\WINNT\system32\MSVCR70.dll]  [Microsoft Corporation, 7.00.9466.0]
    [e:\Program Files\Thunder Network\WebThunder\WebThunderBHO_016.dll]  [Thunder Networking Technologies,LTD, 6, 0, 0, 5]
    [C:\WINNT\system32\MSVCP60.dll]  [Microsoft Corporation, 6.00.8972.0]
[PID: 2660][C:\Program Files\Rising\AntiSpyware\runiep.exe]  [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6]
    [C:\Program Files\Rising\AntiSpyware\iep_ctrl.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [E:\Program Files\Symantec\pcAnywhere\AWHK32.dll]  [Symantec Corporation, 11.5.0.121]
    [C:\WINNT\system32\MSVCR70.dll]  [Microsoft Corporation, 7.00.9466.0]
[PID: 2696][C:\Program Files\Java\jre1.5.0\bin\jusched.exe]  [Sun Microsystems, Inc., 1.5.0.0]
    [E:\Program Files\Symantec\pcAnywhere\AWHK32.dll]  [Symantec Corporation, 11.5.0.121]
    [C:\WINNT\system32\MSVCR70.dll]  [Microsoft Corporation, 7.00.9466.0]
[PID: 2720][C:\Program Files\Java\jre1.5.0\bin\jucheck.exe]  [Sun Microsystems, Inc., 1.5.0.0]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [E:\Program Files\Symantec\pcAnywhere\AWHK32.dll]  [Symantec Corporation, 11.5.0.121]
    [C:\WINNT\system32\MSVCR70.dll]  [Microsoft Corporation, 7.00.9466.0]
[PID: 2792][C:\WINNT\system32\algs.exe]  [N/A, ]
    [E:\Program Files\Symantec\pcAnywhere\AWHK32.dll]  [Symantec Corporation, 11.5.0.121]
    [C:\WINNT\system32\MSVCR70.dll]  [Microsoft Corporation, 7.00.9466.0]
[PID: 2796][C:\WINNT\system32\internat.exe]  [Microsoft Corporation, 5.00.2920.0000]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [E:\Program Files\Symantec\pcAnywhere\AWHK32.dll]  [Symantec Corporation, 11.5.0.121]
    [C:\WINNT\system32\MSVCR70.dll]  [Microsoft Corporation, 7.00.9466.0]
[PID: 2892][C:\WINNT\system32\conime.exe]  [Microsoft Corporation, 5.00.2195.6655]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [E:\Program Files\Symantec\pcAnywhere\AWHK32.dll]  [Symantec Corporation, 11.5.0.121]
    [C:\WINNT\system32\MSVCR70.dll]  [Microsoft Corporation, 7.00.9466.0]
[PID: 3024][C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe]  [Microsoft Corporation, 2000.080.0194.00]
    [C:\Program Files\Microsoft SQL Server\80\Tools\Binn\W95SCM.dll]  [Microsoft Corporation, 2000.080.0194.00]
    [C:\WINNT\system32\SQLUNIRL.dll]  [Microsoft Corporation, 2000.080.0194.00]
    [C:\Program Files\Microsoft SQL Server\80\Tools\Binn\SQLSVC.dll]  [Microsoft Corporation, 2000.080.0194.00]
    [C:\WINNT\system32\odbcbcp.dll]  [Microsoft Corporation,  2000.080.0194.00]
    [C:\Program Files\Microsoft SQL Server\80\Tools\Binn\SQLRESLD.dll]  [Microsoft Corporation, 2000.080.0194.00]
    [C:\Program Files\Microsoft SQL Server\80\Tools\Binn\Resources\2052\SQLSVC.RLL]  [Microsoft Corporation, 2000.080.0194.00]
    [C:\Program Files\Microsoft SQL Server\80\Tools\Binn\Resources\2052\sqlmangr.RLL]  [Microsoft Corporation, 2000.080.0194.00]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [E:\Program Files\Symantec\pcAnywhere\AWHK32.dll]  [Symantec Corporation, 11.5.0.121]
    [C:\WINNT\system32\MSVCR70.dll]  [Microsoft Corporation, 7.00.9466.0]
[PID: 3068][C:\WINNT\system32\cmd.exe]  [Microsoft Corporation, 5.00.2195.6656]
[PID: 2704][C:\WINNT\system32\java.exe]  [Sun Microsystems, Inc., 1.5.0.0]
    [C:\Program Files\Java\jre1.5.0\bin\client\jvm.dll]  [Sun Microsystems, Inc., 1.5.0.0]
    [C:\Program Files\Java\jre1.5.0\bin\hpi.dll]  [Sun Microsystems, Inc., 1.5.0.0]
    [C:\Program Files\Java\jre1.5.0\bin\verify.dll]  [Sun Microsystems, Inc., 1.5.0.0]
    [C:\Program Files\Java\jre1.5.0\bin\java.dll]  [Sun Microsystems, Inc., 1.5.0.0]
    [C:\Program Files\Java\jre1.5.0\bin\zip.dll]  [Sun Microsystems, Inc., 1.5.0.0]
    [C:\Program Files\Java\jre1.5.0\bin\net.dll]  [Sun Microsystems, Inc., 1.5.0.0]
[PID: 3172][F:\XXX系统服务端\scktsrvr.exe]  [Borland Software Corporation, 6.0.6.163]
    [E:\Program Files\Symantec\pcAnywhere\AWHK32.dll]  [Symantec Corporation, 11.5.0.121]
    [C:\WINNT\system32\MSVCR70.dll]  [Microsoft Corporation, 7.00.9466.0]
[PID: 1252][E:\Program Files\Rising\Rav\RsAgent.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 12]
    [E:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [E:\Program Files\Symantec\pcAnywhere\AWHK32.dll]  [Symantec Corporation, 11.5.0.121]
    [C:\WINNT\system32\MSVCR70.dll]  [Microsoft Corporation, 7.00.9466.0]
[PID: 3236][C:\WINNT\msagent\AgentSvr.exe]  [Microsoft Corporation, 2.00.0.3422]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [E:\Program Files\Symantec\pcAnywhere\AWHK32.dll]  [Symantec Corporation, 11.5.0.121]
    [C:\WINNT\system32\MSVCR70.dll]  [Microsoft Corporation, 7.00.9466.0]
[PID: 3372][C:\WINNT\system32\taskmgr.exe]  [Microsoft Corporation, 5.00.2195.6620]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [E:\Program Files\Symantec\pcAnywhere\AWHK32.dll]  [Symantec Corporation, 11.5.0.121]
    [C:\WINNT\system32\MSVCR70.dll]  [Microsoft Corporation, 7.00.9466.0]
[PID: 3224][C:\Documents and Settings\Administrator\桌面\sreng2\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
    [E:\Program Files\Symantec\pcAnywhere\AWHK32.dll]  [Symantec Corporation, 11.5.0.121]
    [C:\WINNT\system32\MSVCR70.dll]  [Microsoft Corporation, 7.00.9466.0]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]

文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================


[/CODE]