【求助】请高手帮忙看下日志 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛【求助】请高手帮忙看下日志

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

1

1 / 1 页

跳转页

【求助】请高手帮忙看下日志

真仁初生襁褓狮帖子:35 注册: 2004-06-06 来自:	发表于： 2007-05-12 19:52 \| 显示全部短消息资料字号：小中大 1楼【求助】请高手帮忙看下日志自中了"番茄花园"后一直病毒不断.请高手帮忙看下日志; 2007-05-12,19:25:08 System Repair Engineer 2.4.12.806 Smallfrogs (http://www.KZTechs.com) Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能以下内容被选中：所有的启动项目（包括注册表、启动文件夹、服务等）浏览器加载项正在运行的进程（包括进程模块信息）文件关联 Winsock 提供者 Autorun.inf HOSTS 文件启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher] <svc><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\SVCHOST.EXE> [N/A] <3dt><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Servera.exe> [N/A] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <load><> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <switch><c:\windows\system32\壁纸自动换.exe> [] <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.] <RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.] <runeip><D:\rixing\新建文件夹\runiep.exe> [Beijing Rising Technology Co., Ltd.] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] <RavStub><"C:\Program Files\Rising\Rav\ravstub.exe" /RUNONCE> [Beijing Rising Technology Co., Ltd.] <KKDelay><D:\rixing\新建文件夹\RunOnce.exe> [Beijing Rising Technology Co., Ltd.] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [(Verified)Microsoft Windows Publisher] <Userinit><C:\WINDOWS\system32\UserInit.exe,> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.] ================================== 启动文件夹 N/A ================================== 服务 [Gentad / Gentad][Stopped/Auto Start] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\struts.dll><N/A> [Human Interface Device Access / HidServ][Stopped/Disabled] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A> [idztna / idztna][Running/Auto Start] <C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\COMMON~1\vdztta\vdztta.dll,Service -s><Microsoft Corporation> [Navoct / Navoct][Running/Auto Start] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\Program Files\iesnap\navoct.dll>< > [Windows ptad RunThem / ptad][Running/Auto Start] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\PROGRA~1\kovy\uyfi.dll>< > [Rising Proxy Service / RfwProxySrv][Stopped/Manual Start] <c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.> [Rising Personal Firewall Service / RfwService][Running/Auto Start] <c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.> [Rising Process Communication Center / RsCCenter][Running/Auto Start] <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.> [Rising RealTime Monitor / RsRavMon][Running/Auto Start] <"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.> [Windows / SystemRpcs][Stopped/Auto Start] <C:\WINDOWS\system32\srpcs.exe><N/A> [Windows_SystemDown / WindowsDown][Stopped/Auto Start] <C:\WINDOWS\system32\servet.exe><N/A> [WinWLServiceNow / WinWLServiceNow][Stopped/Auto Start] <C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RAVWL.EXE><N/A> [WinWMServiceNow / WinWMServiceNow][Stopped/Auto Start] <C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RAVWM.EXE><N/A> ================================== 驱动程序 [Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Running/Manual Start] <system32\drivers\ac97intc.sys><Intel Corporation> [AliIde / AliIde][Running/Boot Start] <\SystemRoot\System32\DRIVERS\aliide.sys><Acer Laboratories Inc.> [AMD K8 Processor Driver / AmdK8][Stopped/Manual Start] <System32\DRIVERS\amdk8.sys><Advanced Micro Devices> [AVG Anti-Spyware Clean Driver / AvgAsCln][Running/System Start] <System32\DRIVERS\AvgAsCln.sys><GRISOFT, s.r.o.> [Rising TDI Base Driver / BaseTDI][Running/Auto Start] <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.> [CmdIde / CmdIde][Running/Boot Start] <\SystemRoot\System32\DRIVERS\cmdide.sys><CMD Technology, Inc.> [ExpScaner / ExpScaner][Running/Auto Start] <\??\C:\Program Files\Rising\Rav\ExpScan.sys><> [VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Stopped/Manual Start] <system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.> [HookCont / HookCont][Running/Auto Start] <\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising> [HookReg / HookReg][Running/Auto Start] <\??\C:\Program Files\Rising\Rav\HookReg.sys><> [HookSys / HookSys][Running/Auto Start] <\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising> [HookUrl / HookUrl][Running/Auto Start] <\??\C:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.> [MEMSCAN / MEMSCAN][Running/Auto Start] <\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司> [mProcRs / mProcRs][Running/Auto Start] <\??\c:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.> [Netgroup Packet Filter / NPF][Stopped/Manual Start] <system32\DRIVERS\npf.sys><CACE Technologies> [npkcrypt / npkcrypt][Stopped/Auto Start] <\??\C:\Program Files\QQ2006\npkcrypt.sys><N/A> [nv / nv][Running/Manual Start] <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation> [Direct Parallel Link Driver / Ptilink][Running/Manual Start] <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.> [RsAntiSpyware / RsAntiSpyware][Running/Boot Start] <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising> [RsFwDrv / RsFwDrv][Running/Auto Start] <\??\C:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.> [RsNTGDI / RsNTGDI][Running/Boot Start] <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.> [RSPPSYS / RSPPSYS][Running/Auto Start] <\??\C:\Program Files\Rising\Rav\RSPPSYS.sys><Rising> [Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start] <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation> [Secdrv / Secdrv][Stopped/Manual Start] <system32\DRIVERS\secdrv.sys><N/A> [Sony USB Filter Driver (SONYPVU1) / SONYPVU1][Stopped/Manual Start] <system32\DRIVERS\SONYPVU1.SYS><Sony Corporation> 2007-05-12 21:45:49
真仁初生襁褓狮帖子:35 注册: 2004-06-06 来自:	分享到：

真仁初生襁褓狮帖子:35 注册: 2004-06-06 来自:	发表于： 2007-05-12 19:54 \| 显示全部短消息资料字号：小中大 2楼 ================================== 浏览器加载项 [LocalLauncher Class] {E22BFF56-39F3-11D8-A0C7-000C6E7BB5AB} <C:\WINDOWS\system32\BROWSE~1.DLL, > [Recorder Control] {2423AB16-9F42-457B-A337-FE3B11964DB0} <F:\碧聊插件\BLUESK~1\recorder.ocx, Bluesky Studio (http://www.bluesky.cn)> [BlueskyVideo Control] {2EA6D939-4445-43F1-A12B-8CB3DDA8B855} <F:\碧聊插件\BLUESK~1\v2.ocx, 蓝天工作室(http://www.bluesky.cn)> [Ppd Control] {2F2BA87D-385E-4922-B41C-06E190B06AA9} <F:\碧聊插件\BLUESK~1\ppd.ocx, Bluesky Studio(http://www.bluesky.cn)> [Share Control] {3072B1F1-0C4D-4E76-A7C6-FBAF129DBCC9} <F:\碧聊插件\BLUESK~1\share.ocx, http://www.bluesky.cn> [Traceppd Control] {5910C66C-F9BA-4306-8175-C098B7F0ED62} <F:\碧聊插件\BLUESK~1\traceppd.ocx, BlueskyStudio(http://www.bluesky.cn)> [PP Control] {616DACC1-C5E6-4646-B36A-3FA4FC726BAD} <F:\碧聊插件\BLUESK~1\ppc.ocx, Bluesky Studio (http://www.bluesky.cn)> [Windows Media Player] {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [Videohelp Control] {75B75D86-D88B-4BEA-BC59-BFD9D7300518} <F:\碧聊插件\BLUESK~1\VIDEOH~1.OCX, Bluesky Studio(http://www.bluesky.cn)> [Microsoft Web 浏览器] {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation> [Filetran Control] {88734439-46D0-42C0-A13F-7E881EE550CF} <F:\碧聊插件\BLUESK~1\filetran.ocx, Bluesky Studio(http://www.bluesky.cn)> [Chat Control] {94EFE58C-E678-4808-AD65-24CE4B94C1FE} <F:\碧聊插件\BLUESK~1\chat.ocx, Bluesky Studio(http://www.bluesky.cn)> [Blueskyvoice Control] {991481A7-4669-4e15-8C24-100404E1F5CB} <F:\碧聊插件\BLUESK~1\BLUESK~1.OCX, 蓝天工作室(http://www.bluesky.cn)> [Display Control] {A1D97DB3-E564-4743-B2E7-6F5182CBF406} <F:\碧聊插件\BLUESK~1\display.ocx, Bluesky Studio (http://www.bluesky.cn)> [Tracechat Control] {A40335C4-D3D1-4E7B-9130-039CDA5B603C} <F:\碧聊插件\BLUESK~1\TRACEC~1.OCX, bluesky studio> [Google Toolbar Helper] {AA58ED58-01DD-4D91-8333-CF10577473F7} <c:\program files\google\googletoolbar1.dll, N/A> [PPChat Control] {AFB97F16-B7E8-4EB1-8133-FBD5AA2EBB3B} <F:\碧聊插件\BLUESK~1\ppchat.ocx, Bluesky Studio(http://www.bluesky.cn)> [SearchAssistantOC] {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A> [Blueskyvoice Control] {BA0F088C-72C1-475a-92F8-42391DEF6961} <F:\碧聊插件\BLUESK~1\BLUESK~2.OCX, 蓝天工作室(http://www.bluesky.cn)> [RDS.DataSpace] {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation> [Client Control] {C7B0C764-5D4E-433E-A854-591F28520577} <F:\碧聊插件\BLUESK~1\client.ocx, > [Play Control] {CC20DDA1-9A21-4DEC-B5BE-E61E0351FCA9} <F:\碧聊插件\BLUESK~1\play.ocx, Bluesky Studio (http://www.bluesky.cn)> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.> ================================== 正在运行的进程 [PID: 424][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 484][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 508][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 1228][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9] [D:\rixing\新建文件夹\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [C:\PROGRA~1\COMMON~1\vdztta\wbrbvz.nls] [, 3, 6, 0, 6] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [c:\progra~1\kovy\xbil.dll] [, 1, 0, 0, 6] [c:\progra~1\kovy\cgnq.dll] [ , 1, 0, 0, 6] [c:\PROGRA~1\iesnap\navstub.dll] [, 1, 0, 1, 3] [PID: 1784][D:\rixing\新建文件夹\runiep.exe] [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6] [D:\rixing\新建文件夹\iep_ctrl.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4] [D:\rixing\新建文件夹\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [C:\PROGRA~1\COMMON~1\vdztta\wbrbvz.nls] [, 3, 6, 0, 6] [c:\PROGRA~1\iesnap\navstub.dll] [, 1, 0, 1, 3] [c:\progra~1\kovy\xbil.dll] [, 1, 0, 0, 6] [c:\progra~1\kovy\cgnq.dll] [ , 1, 0, 0, 6] [PID: 1892][c:\program files\rising\rfw\RfwMain.exe] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 70] [c:\program files\rising\rfw\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33] [c:\program files\rising\rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5] [c:\program files\rising\rfw\RfwCtrl.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11] [c:\program files\rising\rfw\RsXML.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2] [c:\program files\rising\rfw\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5] [c:\PROGRA~1\iesnap\navstub.dll] [, 1, 0, 1, 3] [c:\progra~1\kovy\xbil.dll] [, 1, 0, 0, 6] [c:\progra~1\kovy\cgnq.dll] [ , 1, 0, 0, 6] [C:\PROGRA~1\COMMON~1\vdztta\wbrbvz.nls] [, 3, 6, 0, 6] [D:\rixing\新建文件夹\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [PID: 1952][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\PROGRA~1\COMMON~1\vdztta\wbrbvz.nls] [, 3, 6, 0, 6] [D:\rixing\新建文件夹\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [c:\PROGRA~1\iesnap\navstub.dll] [, 1, 0, 1, 3] [c:\progra~1\kovy\xbil.dll] [, 1, 0, 0, 6] [c:\progra~1\kovy\cgnq.dll] [ , 1, 0, 0, 6] [PID: 2772][F:\lqq\QQ2006\QQ.exe] [TENCENT, 0, 0, 0, 0] [F:\lqq\QQ2006\QQBaseClassInDll.dll] [, 1, 0, 0, 1] [F:\lqq\QQ2006\QQHelperDll.dll] [, 1, 0, 0, 1] [F:\lqq\QQ2006\BasicCtrlDll.dll] [Tencent, 5, 0, 200, 160] [F:\lqq\QQ2006\MFC42.DLL] [Microsoft Corporation, 6.00.8665.0] [F:\lqq\QQ2006\PYKer.dll] [飘云 http://www.pyqq.cn, 飘云] [F:\lqq\QQ2006\ipsearcher.dll] [, 1.0.0.3] [c:\PROGRA~1\iesnap\navstub.dll] [, 1, 0, 1, 3] [c:\progra~1\kovy\xbil.dll] [, 1, 0, 0, 6] [c:\progra~1\kovy\cgnq.dll] [ , 1, 0, 0, 6] [C:\PROGRA~1\COMMON~1\vdztta\wbrbvz.nls] [, 3, 6, 0, 6] [F:\lqq\QQ2006\RICHED32.DLL] [Microsoft Corporation, 5.00.2134.1] [F:\lqq\QQ2006\RICHED20.dll] [Microsoft Corporation, 5.31.23.1218] [F:\lqq\QQ2006\QQAPI.dll] [, 1, 0, 0, 1] [F:\lqq\QQ2006\TIMProxy.dll] [tencent, 0, 3, 2, 4] [D:\rixing\新建文件夹\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [F:\lqq\QQ2006\LoginCtrl.dll] [, 1, 0, 0, 1] [F:\lqq\QQ2006\npkcntc.dll] [INCA Internet Co., Ltd., 2006, 3, 2, 1] [F:\lqq\QQ2006\npkpdb.dll] [INCA Internet Co., Ltd., 2003, 10, 1, 1] [F:\lqq\QQ2006\QQRes.dll] [tencent, 1, 0, 0, 1] [F:\lqq\QQ2006\QQMainFrame.dll] [N/A, ] [F:\lqq\QQ2006\CQQApplication.dll] [N/A, ] [F:\lqq\QQ2006\NewSkin.dll] [, 1, 0, 0, 1] [F:\lqq\QQ2006\MSVCP60.dll] [Microsoft Corporation, 6.02.3104.0] [F:\lqq\QQ2006\HostingMgr.dll] [, 1, 0, 0, 1] [F:\lqq\QQ2006\CameraDll.dll] [, 1, 0, 0, 1] [F:\lqq\QQ2006\MailSummary.dll] [, 1, 0, 0, 1] [F:\lqq\QQ2006\QQSpace.dll] [, 1, 0, 0, 1] [F:\lqq\QQ2006\vbscript.dll] [Microsoft Corporation, 5.6.0.7426] [C:\WINDOWS\system32\msdmo.dll] [, ] [F:\lqq\QQ2006\QQGroupMng.dll] [, 1, 0, 0, 1] [F:\lqq\QQ2006\GroupLive.dll] [N/A, ] [F:\lqq\QQ2006\UserDefinedHead.dll] [, 1, 0, 0, 1] [F:\lqq\QQ2006\QQPlugin.dll] [N/A, ] [F:\lqq\QQ2006\QQConfigPlugin.dll] [, 1, 0, 0, 1] [F:\lqq\QQ2006\QRingMng.dll] [N/A, ] [F:\lqq\QQ2006\PhoneAPI.dll] [, 1, 0, 0, 1] [F:\lqq\QQ2006\DialerAllinOne.dll] [tencent, 1, 4, 0, 0] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [F:\lqq\QQ2006\QQAvatar.dll] [N/A, ] [F:\lqq\QQ2006\FlashAvatarDll.dll] [, 1, 4, 0, 1] [F:\lqq\QQ2006\LongConnection.dll] [tencent, 5, 0, 200, 160] [F:\lqq\QQ2006\QQPet.dll] [, 1, 0, 0, 1] [F:\lqq\QQ2006\QQSysMsgMng.dll] [N/A, ] [F:\lqq\QQ2006\BQQApplication.dll] [N/A, ] [F:\lqq\QQ2006\PersonalDesktop.dll] [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2] [C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9] [F:\lqq\QQ2006\CommercesMng.dll] [, 1, 0, 0, 1] [F:\lqq\QQ2006\QQUdpGetFileLib.dll] [tencent, 0, 2, 2, 3] [F:\lqq\QQ2006\QQAddr.dll] [深圳市腾讯计算机系统有限公司, 5, 0, 101, 200] [F:\lqq\QQ2006\QQSceneMng.dll] [N/A, ] [F:\lqq\QQ2006\QQPhoneHelper.dll] [腾讯科技（深圳）有限公司, 2, 1, 8, 81] [PID: 2792][F:\lqq\QQ2006\TIMPlatform.exe] [tencent, 0, 3, 1, 8] [c:\PROGRA~1\iesnap\navstub.dll] [, 1, 0, 1, 3] [c:\progra~1\kovy\xbil.dll] [, 1, 0, 0, 6] [c:\progra~1\kovy\cgnq.dll] [ , 1, 0, 0, 6] [C:\PROGRA~1\COMMON~1\vdztta\wbrbvz.nls] [, 3, 6, 0, 6] [D:\rixing\新建文件夹\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [F:\lqq\QQ2006\TIMProxy.dll] [tencent, 0, 3, 2, 4] [PID: 2928][E:\MIE\Maxthon\Maxthon.exe] [Maxthon International Ltd., 1, 5, 2, 21] [E:\MIE\Maxthon\maxzlib.dll] [ , 1, 0, 0, 2] [c:\PROGRA~1\iesnap\navstub.dll] [, 1, 0, 1, 3] [c:\progra~1\kovy\xbil.dll] [, 1, 0, 0, 6] [c:\progra~1\kovy\cgnq.dll] [ , 1, 0, 0, 6] [C:\PROGRA~1\COMMON~1\vdztta\wbrbvz.nls] [, 3, 6, 0, 6] [C:\WINDOWS\system32\odbcbcp.dll] [Microsoft Corporation, 2000.085.1117.00 (xpsp_sp2_rtm.040803-2158)] [D:\rixing\新建文件夹\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [c:\PROGRA~1\iesnap\navpref.dll] [, 1, 0, 1, 2] [c:\PROGRA~1\iesnap\navseg.dll] [, 1, 0, 1, 1] [c:\PROGRA~1\iesnap\navneg.dll] [, 1, 0, 1, 2] [E:\MIE\Maxthon\Services\RealTime\real_time.dll] [, 1, 0, 0, 1] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
真仁初生襁褓狮帖子:35 注册: 2004-06-06 来自:

真仁初生襁褓狮帖子:35 注册: 2004-06-06 来自:	发表于： 2007-05-12 19:55 \| 显示全部短消息资料字号：小中大 3楼 [PID: 3012][c:\PROGRA~1\iesnap\navplay.exe] [, 1, 0, 1, 2] [c:\PROGRA~1\iesnap\navstub.dll] [, 1, 0, 1, 3] [c:\progra~1\kovy\xbil.dll] [, 1, 0, 0, 6] [c:\progra~1\kovy\cgnq.dll] [ , 1, 0, 0, 6] [C:\PROGRA~1\COMMON~1\vdztta\wbrbvz.nls] [, 3, 6, 0, 6] [D:\rixing\新建文件夹\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [c:\PROGRA~1\iesnap\navpref.dll] [, 1, 0, 1, 2] [PID: 3040][C:\WINDOWS\system32\rundll32.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\PROGRA~1\COMMON~1\vdztta\wbrbvz.nls] [, 3, 6, 0, 6] [c:\PROGRA~1\iesnap\navstub.dll] [, 1, 0, 1, 3] [c:\progra~1\kovy\xbil.dll] [, 1, 0, 0, 6] [c:\progra~1\kovy\cgnq.dll] [ , 1, 0, 0, 6] [D:\rixing\新建文件夹\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [PID: 2476][C:\Program Files\Rising\Rav\RsAgent.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 12] [c:\PROGRA~1\iesnap\navstub.dll] [, 1, 0, 1, 3] [c:\progra~1\kovy\xbil.dll] [, 1, 0, 0, 6] [c:\progra~1\kovy\cgnq.dll] [ , 1, 0, 0, 6] [C:\PROGRA~1\COMMON~1\vdztta\wbrbvz.nls] [, 3, 6, 0, 6] [C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1] [D:\rixing\新建文件夹\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [PID: 2236][C:\WINDOWS\msagent\AgentSvr.exe] [Microsoft Corporation, 2.00.0.3424] [c:\PROGRA~1\iesnap\navstub.dll] [, 1, 0, 1, 3] [c:\progra~1\kovy\xbil.dll] [, 1, 0, 0, 6] [c:\progra~1\kovy\cgnq.dll] [ , 1, 0, 0, 6] [C:\PROGRA~1\COMMON~1\vdztta\wbrbvz.nls] [, 3, 6, 0, 6] [D:\rixing\新建文件夹\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 3356][C:\Program Files\Rising\Rav\ScanBD.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 19] [C:\Program Files\Rising\Rav\RsCommx.dll] [rising, 18, 0, 0, 1] [c:\PROGRA~1\iesnap\navstub.dll] [, 1, 0, 1, 3] [c:\progra~1\kovy\xbil.dll] [, 1, 0, 0, 6] [c:\progra~1\kovy\cgnq.dll] [ , 1, 0, 0, 6] [C:\PROGRA~1\COMMON~1\vdztta\wbrbvz.nls] [, 3, 6, 0, 6] [D:\rixing\新建文件夹\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [C:\Program Files\Rising\Rav\BDEngine.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 13] [C:\Program Files\Rising\Rav\libload.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 16] [C:\Program Files\Rising\Rav\BDEX.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 3] [C:\Program Files\Rising\Rav\BDLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 1] [PID: 3656][C:\Documents and Settings\Administrator\桌面\sreng2\SREng.EXE] [Smallfrogs Studio, 2.4.12.806] [c:\PROGRA~1\iesnap\navstub.dll] [, 1, 0, 1, 3] [c:\progra~1\kovy\xbil.dll] [, 1, 0, 0, 6] [c:\progra~1\kovy\cgnq.dll] [ , 1, 0, 0, 6] [C:\PROGRA~1\COMMON~1\vdztta\wbrbvz.nls] [, 3, 6, 0, 6] [D:\rixing\新建文件夹\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf N/A ================================== HOSTS 文件 127.0.0.1 localhost 0.0.0.0 182838.com 0.0.0.0 204.177.92.68 0.0.0.0 asiafriendfinder.com 0.0.0.0 asqin123.51.net 0.0.0.0 babe520.5188.org 0.0.0.0 music.feifa.com 0.0.0.0 music.v111.com 0.0.0.0 www.jpbeauty.com 0.0.0.0 beautishow.com 0.0.0.0 goodmovies88.com 0.0.0.0 hothack.home.chinaren.com 0.0.0.0 hualiao.net 0.0.0.0 iplus.allyes.com 0.0.0.0 jjkafei.longcity.net 0.0.0.0 kaomm.8m.cn 0.0.0.0 l3iaoliao.com 0.0.0.0 lingaonbvm.myrice.com 0.0.0.0 lovejava.boy.net.cn 0.0.0.0 love7liao.com 0.0.0.0 asqin123.51.net 0.0.0.0 babe520.5188.org 0.0.0.0 music.feifa.com 0.0.0.0 jjkafei.longcity.net 0.0.0.0 kaomm.8m.cn 0.0.0.0 l3iaoliao.com 0.0.0.0 l3iaoliao.com 0.0.0.0 lingaonbvm.myrice.com 0.0.0.0 lovejava.boy.net.cn 0.0.0.0 love7liao.com 0.0.0.0 babe520.5188.org 0.0.0.0 music.feifa.com 0.0.0.0 music.v111.com 0.0.0.0 babe520.5188.org 0.0.0.0 music.feifa.com 0.0.0.0 jjkafei.longcity.net 0.0.0.0 kaomm.8m.cn 0.0.0.0 l3iaoliao.com 0.0.0.0 l3iaoliao.com 0.0.0.0 lingaonbvm.myrice.com 0.0.0.0 lovejava.boy.net.cn 0.0.0.0 love7liao.com 0.0.0.0 babe520.5188.org 0.0.0.0 music.feifa.com 0.0.0.0 music.v111.com ================================== API HOOK N/A ================================== 隐藏进程 N/A ==================================
真仁初生襁褓狮帖子:35 注册: 2004-06-06 来自:

真仁初生襁褓狮帖子:35 注册: 2004-06-06 来自:	发表于： 2007-05-12 19:56 \| 显示全部短消息资料字号：小中大 4楼 [PID: 3012][c:\PROGRA~1\iesnap\navplay.exe] [, 1, 0, 1, 2] [c:\PROGRA~1\iesnap\navstub.dll] [, 1, 0, 1, 3] [c:\progra~1\kovy\xbil.dll] [, 1, 0, 0, 6] [c:\progra~1\kovy\cgnq.dll] [ , 1, 0, 0, 6] [C:\PROGRA~1\COMMON~1\vdztta\wbrbvz.nls] [, 3, 6, 0, 6] [D:\rixing\新建文件夹\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [c:\PROGRA~1\iesnap\navpref.dll] [, 1, 0, 1, 2] [PID: 3040][C:\WINDOWS\system32\rundll32.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\PROGRA~1\COMMON~1\vdztta\wbrbvz.nls] [, 3, 6, 0, 6] [c:\PROGRA~1\iesnap\navstub.dll] [, 1, 0, 1, 3] [c:\progra~1\kovy\xbil.dll] [, 1, 0, 0, 6] [c:\progra~1\kovy\cgnq.dll] [ , 1, 0, 0, 6] [D:\rixing\新建文件夹\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [PID: 2476][C:\Program Files\Rising\Rav\RsAgent.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 12] [c:\PROGRA~1\iesnap\navstub.dll] [, 1, 0, 1, 3] [c:\progra~1\kovy\xbil.dll] [, 1, 0, 0, 6] [c:\progra~1\kovy\cgnq.dll] [ , 1, 0, 0, 6] [C:\PROGRA~1\COMMON~1\vdztta\wbrbvz.nls] [, 3, 6, 0, 6] [C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1] [D:\rixing\新建文件夹\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [PID: 2236][C:\WINDOWS\msagent\AgentSvr.exe] [Microsoft Corporation, 2.00.0.3424] [c:\PROGRA~1\iesnap\navstub.dll] [, 1, 0, 1, 3] [c:\progra~1\kovy\xbil.dll] [, 1, 0, 0, 6] [c:\progra~1\kovy\cgnq.dll] [ , 1, 0, 0, 6] [C:\PROGRA~1\COMMON~1\vdztta\wbrbvz.nls] [, 3, 6, 0, 6] [D:\rixing\新建文件夹\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 3356][C:\Program Files\Rising\Rav\ScanBD.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 19] [C:\Program Files\Rising\Rav\RsCommx.dll] [rising, 18, 0, 0, 1] [c:\PROGRA~1\iesnap\navstub.dll] [, 1, 0, 1, 3] [c:\progra~1\kovy\xbil.dll] [, 1, 0, 0, 6] [c:\progra~1\kovy\cgnq.dll] [ , 1, 0, 0, 6] [C:\PROGRA~1\COMMON~1\vdztta\wbrbvz.nls] [, 3, 6, 0, 6] [D:\rixing\新建文件夹\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [C:\Program Files\Rising\Rav\BDEngine.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 13] [C:\Program Files\Rising\Rav\libload.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 16] [C:\Program Files\Rising\Rav\BDEX.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 3] [C:\Program Files\Rising\Rav\BDLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 1] [PID: 3656][C:\Documents and Settings\Administrator\桌面\sreng2\SREng.EXE] [Smallfrogs Studio, 2.4.12.806] [c:\PROGRA~1\iesnap\navstub.dll] [, 1, 0, 1, 3] [c:\progra~1\kovy\xbil.dll] [, 1, 0, 0, 6] [c:\progra~1\kovy\cgnq.dll] [ , 1, 0, 0, 6] [C:\PROGRA~1\COMMON~1\vdztta\wbrbvz.nls] [, 3, 6, 0, 6] [D:\rixing\新建文件夹\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf N/A ================================== HOSTS 文件 127.0.0.1 localhost 0.0.0.0 182838.com 0.0.0.0 204.177.92.68 0.0.0.0 asiafriendfinder.com 0.0.0.0 asqin123.51.net 0.0.0.0 babe520.5188.org 0.0.0.0 music.feifa.com 0.0.0.0 music.v111.com 0.0.0.0 www.jpbeauty.com 0.0.0.0 beautishow.com 0.0.0.0 goodmovies88.com 0.0.0.0 hothack.home.chinaren.com 0.0.0.0 hualiao.net 0.0.0.0 iplus.allyes.com 0.0.0.0 jjkafei.longcity.net 0.0.0.0 kaomm.8m.cn 0.0.0.0 l3iaoliao.com 0.0.0.0 lingaonbvm.myrice.com 0.0.0.0 lovejava.boy.net.cn 0.0.0.0 love7liao.com 0.0.0.0 asqin123.51.net 0.0.0.0 babe520.5188.org 0.0.0.0 music.feifa.com 0.0.0.0 jjkafei.longcity.net 0.0.0.0 kaomm.8m.cn 0.0.0.0 l3iaoliao.com 0.0.0.0 l3iaoliao.com 0.0.0.0 lingaonbvm.myrice.com 0.0.0.0 lovejava.boy.net.cn 0.0.0.0 love7liao.com 0.0.0.0 babe520.5188.org 0.0.0.0 music.feifa.com 0.0.0.0 music.v111.com 0.0.0.0 babe520.5188.org 0.0.0.0 music.feifa.com 0.0.0.0 jjkafei.longcity.net 0.0.0.0 kaomm.8m.cn 0.0.0.0 l3iaoliao.com 0.0.0.0 l3iaoliao.com 0.0.0.0 lingaonbvm.myrice.com 0.0.0.0 lovejava.boy.net.cn 0.0.0.0 love7liao.com 0.0.0.0 babe520.5188.org 0.0.0.0 music.feifa.com 0.0.0.0 music.v111.com ================================== API HOOK N/A ================================== 隐藏进程 N/A ==================================
真仁初生襁褓狮帖子:35 注册: 2004-06-06 来自:

真仁初生襁褓狮帖子:35 注册: 2004-06-06 来自:	发表于： 2007-05-12 20:33 \| 显示全部短消息资料字号：小中大 5楼谢谢两位朋友,能说的更明白些吗?偶很菜,麻烦各位了啊~
真仁初生襁褓狮帖子:35 注册: 2004-06-06 来自:

真仁初生襁褓狮帖子:35 注册: 2004-06-06 来自:	发表于： 2007-05-12 21:16 \| 显示全部短消息资料字号：小中大 6楼楼上的朋友,HOSTS 文件怎么清除?
真仁初生襁褓狮帖子:35 注册: 2004-06-06 来自:

真仁初生襁褓狮帖子:35 注册: 2004-06-06 来自:	发表于： 2007-05-12 21:21 \| 显示全部短消息资料字号：小中大 7楼清理后的日志,请高手们再帮忙看看启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <load><> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <switch><c:\windows\system32\壁纸自动换.exe> [] <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.] <RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.] <runeip><D:\rixing\新建文件夹\runiep.exe> [Beijing Rising Technology Co., Ltd.] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] <RavStub><"C:\Program Files\Rising\Rav\ravstub.exe" /RUNONCE> [Beijing Rising Technology Co., Ltd.] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [(Verified)Microsoft Windows Publisher] <Userinit><C:\WINDOWS\system32\UserInit.exe,> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.] ================================== 启动文件夹 N/A ================================== 服务 [Gentad / Gentad][Stopped/Auto Start] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\struts.dll><N/A> [Human Interface Device Access / HidServ][Stopped/Disabled] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A> [idztna / idztna][Running/Auto Start] <C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\COMMON~1\vdztta\vdztta.dll,Service -s><Microsoft Corporation> [Rising Proxy Service / RfwProxySrv][Stopped/Manual Start] <c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.> [Rising Personal Firewall Service / RfwService][Running/Auto Start] <c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.> [Rising Process Communication Center / RsCCenter][Running/Auto Start] <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.> [Rising RealTime Monitor / RsRavMon][Running/Auto Start] <"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.> ================================== 驱动程序 [Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Running/Manual Start] <system32\drivers\ac97intc.sys><Intel Corporation> [AliIde / AliIde][Running/Boot Start] <\SystemRoot\System32\DRIVERS\aliide.sys><Acer Laboratories Inc.> [AMD K8 Processor Driver / AmdK8][Stopped/Manual Start] <System32\DRIVERS\amdk8.sys><Advanced Micro Devices> [AVG Anti-Spyware Clean Driver / AvgAsCln][Running/System Start] <System32\DRIVERS\AvgAsCln.sys><GRISOFT, s.r.o.> [Rising TDI Base Driver / BaseTDI][Running/Auto Start] <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.> [CmdIde / CmdIde][Running/Boot Start] <\SystemRoot\System32\DRIVERS\cmdide.sys><CMD Technology, Inc.> [ExpScaner / ExpScaner][Running/Auto Start] <\??\C:\Program Files\Rising\Rav\ExpScan.sys><> [VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Stopped/Manual Start] <system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.> [HookCont / HookCont][Running/Auto Start] <\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising> [HookReg / HookReg][Running/Auto Start] <\??\C:\Program Files\Rising\Rav\HookReg.sys><> [HookSys / HookSys][Running/Auto Start] <\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising> [HookUrl / HookUrl][Running/Auto Start] <\??\C:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.> [MEMSCAN / MEMSCAN][Running/Auto Start] <\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司> [mProcRs / mProcRs][Running/Auto Start] <\??\c:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.> [Netgroup Packet Filter / NPF][Stopped/Manual Start] <system32\DRIVERS\npf.sys><CACE Technologies> [npkcrypt / npkcrypt][Stopped/Auto Start] <\??\C:\Program Files\QQ2006\npkcrypt.sys><N/A> [nv / nv][Running/Manual Start] <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation> [Direct Parallel Link Driver / Ptilink][Running/Manual Start] <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.> [RsAntiSpyware / RsAntiSpyware][Running/Boot Start] <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising> [RsFwDrv / RsFwDrv][Running/Auto Start] <\??\C:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.> [RsNTGDI / RsNTGDI][Running/Boot Start] <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.> [RSPPSYS / RSPPSYS][Running/Auto Start] <\??\C:\Program Files\Rising\Rav\RSPPSYS.sys><Rising> [Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start] <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation> [Secdrv / Secdrv][Stopped/Manual Start] <system32\DRIVERS\secdrv.sys><N/A> [Sony USB Filter Driver (SONYPVU1) / SONYPVU1][Stopped/Manual Start] <system32\DRIVERS\SONYPVU1.SYS><Sony Corporation> ================================== 浏览器加载项 [LocalLauncher Class] {E22BFF56-39F3-11D8-A0C7-000C6E7BB5AB} <C:\WINDOWS\system32\BROWSE~1.DLL, > [Recorder Control] {2423AB16-9F42-457B-A337-FE3B11964DB0} <F:\碧聊插件\BLUESK~1\recorder.ocx, Bluesky Studio (http://www.bluesky.cn)> [BlueskyVideo Control] {2EA6D939-4445-43F1-A12B-8CB3DDA8B855} <F:\碧聊插件\BLUESK~1\v2.ocx, 蓝天工作室(http://www.bluesky.cn)> [Ppd Control] {2F2BA87D-385E-4922-B41C-06E190B06AA9} <F:\碧聊插件\BLUESK~1\ppd.ocx, Bluesky Studio(http://www.bluesky.cn)> [Share Control] {3072B1F1-0C4D-4E76-A7C6-FBAF129DBCC9} <F:\碧聊插件\BLUESK~1\share.ocx, http://www.bluesky.cn> [Traceppd Control] {5910C66C-F9BA-4306-8175-C098B7F0ED62} <F:\碧聊插件\BLUESK~1\traceppd.ocx, BlueskyStudio(http://www.bluesky.cn)> [PP Control] {616DACC1-C5E6-4646-B36A-3FA4FC726BAD} <F:\碧聊插件\BLUESK~1\ppc.ocx, Bluesky Studio (http://www.bluesky.cn)> [Windows Media Player] {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [Videohelp Control] {75B75D86-D88B-4BEA-BC59-BFD9D7300518} <F:\碧聊插件\BLUESK~1\VIDEOH~1.OCX, Bluesky Studio(http://www.bluesky.cn)> [Microsoft Web 浏览器] {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation> [Filetran Control] {88734439-46D0-42C0-A13F-7E881EE550CF} <F:\碧聊插件\BLUESK~1\filetran.ocx, Bluesky Studio(http://www.bluesky.cn)> [Chat Control] {94EFE58C-E678-4808-AD65-24CE4B94C1FE} <F:\碧聊插件\BLUESK~1\chat.ocx, Bluesky Studio(http://www.bluesky.cn)> [Blueskyvoice Control] {991481A7-4669-4e15-8C24-100404E1F5CB} <F:\碧聊插件\BLUESK~1\BLUESK~1.OCX, 蓝天工作室(http://www.bluesky.cn)> [Display Control] {A1D97DB3-E564-4743-B2E7-6F5182CBF406} <F:\碧聊插件\BLUESK~1\display.ocx, Bluesky Studio (http://www.bluesky.cn)> [Tracechat Control] {A40335C4-D3D1-4E7B-9130-039CDA5B603C} <F:\碧聊插件\BLUESK~1\TRACEC~1.OCX, bluesky studio> [Google Toolbar Helper] {AA58ED58-01DD-4D91-8333-CF10577473F7} <c:\program files\google\googletoolbar1.dll, N/A> [PPChat Control] {AFB97F16-B7E8-4EB1-8133-FBD5AA2EBB3B} <F:\碧聊插件\BLUESK~1\ppchat.ocx, Bluesky Studio(http://www.bluesky.cn)> [SearchAssistantOC] {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A> [Blueskyvoice Control] {BA0F088C-72C1-475a-92F8-42391DEF6961} <F:\碧聊插件\BLUESK~1\BLUESK~2.OCX, 蓝天工作室(http://www.bluesky.cn)> [RDS.DataSpace] {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation> [Client Control] {C7B0C764-5D4E-433E-A854-591F28520577} <F:\碧聊插件\BLUESK~1\client.ocx, > [Play Control] {CC20DDA1-9A21-4DEC-B5BE-E61E0351FCA9} <F:\碧聊插件\BLUESK~1\play.ocx, Bluesky Studio (http://www.bluesky.cn)> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
真仁初生襁褓狮帖子:35 注册: 2004-06-06 来自:

真仁初生襁褓狮帖子:35 注册: 2004-06-06 来自:	发表于： 2007-05-12 21:22 \| 显示全部短消息资料字号：小中大 8楼正在运行的进程 [PID: 416][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 488][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 512][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 556][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 568][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 716][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 760][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 844][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 888][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 976][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1252][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9] [D:\rixing\新建文件夹\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [C:\PROGRA~1\COMMON~1\vdztta\wbrbvz.nls] [, 3, 6, 0, 6] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 1408][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)] [PID: 1516][C:\Program Files\Rising\Rav\RavStub.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 4] [C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1] [C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5] [PID: 1788][c:\program files\rising\rfw\RfwMain.exe] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 70] [c:\program files\rising\rfw\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33] [c:\program files\rising\rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5] [c:\program files\rising\rfw\RfwCtrl.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11] [c:\program files\rising\rfw\RsXML.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2] [c:\program files\rising\rfw\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5] [C:\PROGRA~1\COMMON~1\vdztta\wbrbvz.nls] [, 3, 6, 0, 6] [D:\rixing\新建文件夹\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [PID: 1804][D:\rixing\新建文件夹\runiep.exe] [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6] [D:\rixing\新建文件夹\iep_ctrl.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4] [D:\rixing\新建文件夹\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [C:\PROGRA~1\COMMON~1\vdztta\wbrbvz.nls] [, 3, 6, 0, 6] [PID: 1844][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [D:\rixing\新建文件夹\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [C:\PROGRA~1\COMMON~1\vdztta\wbrbvz.nls] [, 3, 6, 0, 6] [PID: 2168][E:\MIE\Maxthon\Maxthon.exe] [Maxthon International Ltd., 1, 5, 2, 21] [E:\MIE\Maxthon\maxzlib.dll] [ , 1, 0, 0, 2] [C:\PROGRA~1\COMMON~1\vdztta\wbrbvz.nls] [, 3, 6, 0, 6] [C:\WINDOWS\system32\odbcbcp.dll] [Microsoft Corporation, 2000.085.1117.00 (xpsp_sp2_rtm.040803-2158)] [D:\rixing\新建文件夹\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [E:\MIE\Maxthon\Services\RealTime\real_time.dll] [, 1, 0, 0, 1] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0] [PID: 2240][C:\WINDOWS\system32\rundll32.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\PROGRA~1\COMMON~1\vdztta\wbrbvz.nls] [, 3, 6, 0, 6] [D:\rixing\新建文件夹\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] [PID: 2712][C:\Documents and Settings\Administrator\桌面\sreng2\SREng.EXE] [Smallfrogs Studio, 2.4.12.806] [C:\PROGRA~1\COMMON~1\vdztta\wbrbvz.nls] [, 3, 6, 0, 6] [D:\rixing\新建文件夹\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf N/A ================================== HOSTS 文件 127.0.0.1 localhost 0.0.0.0 182838.com 0.0.0.0 204.177.92.68 0.0.0.0 asiafriendfinder.com 0.0.0.0 asqin123.51.net 0.0.0.0 babe520.5188.org 0.0.0.0 music.feifa.com 0.0.0.0 music.v111.com 0.0.0.0 www.jpbeauty.com 0.0.0.0 beautishow.com 0.0.0.0 goodmovies88.com 0.0.0.0 hothack.home.chinaren.com 0.0.0.0 hualiao.net 0.0.0.0 iplus.allyes.com 0.0.0.0 jjkafei.longcity.net 0.0.0.0 kaomm.8m.cn 0.0.0.0 l3iaoliao.com 0.0.0.0 lingaonbvm.myrice.com 0.0.0.0 lovejava.boy.net.cn 0.0.0.0 love7liao.com 0.0.0.0 asqin123.51.net 0.0.0.0 babe520.5188.org 0.0.0.0 music.feifa.com 0.0.0.0 jjkafei.longcity.net 0.0.0.0 kaomm.8m.cn 0.0.0.0 l3iaoliao.com 0.0.0.0 l3iaoliao.com 0.0.0.0 lingaonbvm.myrice.com 0.0.0.0 lovejava.boy.net.cn 0.0.0.0 love7liao.com 0.0.0.0 babe520.5188.org 0.0.0.0 music.feifa.com 0.0.0.0 music.v111.com 0.0.0.0 babe520.5188.org 0.0.0.0 music.feifa.com 0.0.0.0 jjkafei.longcity.net 0.0.0.0 kaomm.8m.cn 0.0.0.0 l3iaoliao.com 0.0.0.0 l3iaoliao.com 0.0.0.0 lingaonbvm.myrice.com 0.0.0.0 lovejava.boy.net.cn 0.0.0.0 love7liao.com 0.0.0.0 babe520.5188.org 0.0.0.0 music.feifa.com 0.0.0.0 music.v111.com ================================== API HOOK N/A ================================== 隐藏进程 N/A ================================== [/CODE]
真仁初生襁褓狮帖子:35 注册: 2004-06-06 来自:

真仁初生襁褓狮帖子:35 注册: 2004-06-06 来自:	发表于： 2007-05-12 21:35 \| 显示全部短消息资料字号：小中大 9楼谢谢火影忍者,真是个大好人,学习了!
真仁初生襁褓狮帖子:35 注册: 2004-06-06 来自:

真仁初生襁褓狮帖子:35 注册: 2004-06-06 来自:	发表于： 2007-05-12 21:55 \| 显示全部短消息资料字号：小中大 10楼谢谢ADL!我已经从新扫描了日志.在7楼
真仁初生襁褓狮帖子:35 注册: 2004-06-06 来自:

<<上一主题|下一主题>>

1

1 / 1 页

跳转页

页面顶部

Powered by Discuz!NT