1   1  /  1  页   跳转

完蛋了,我又中毒了

完蛋了,我又中毒了



Logfile of Kaka v2. 0. 3. 0 Scan Module v1. 0. 6. 1
Scan saved at 08:33:59, on 2007-05-15
Platform: Microsoft Windows 2000 Professional Service Pack 4 (Build 2195)
MSIE: Internet Explorer v6.00 SP1;Q832894;Q823353;Q833989;Q903235; (6.00.2800.1106)


O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Thunder Browser Helper - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll
O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINNT\system32\kakatool.dll
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [runeip] C:\Program Files\Rising\AntiSpyware\runiep.exe
O4 - HKLM\..\Run: [WangWang] "E:\jm floder\WangWang\WangWang.EXE"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [wosa] C:\WINNT\TEMP\woso.exe
O4 - HKLM\..\Run: [ztsa] C:\WINNT\TEMP\ztso.exe
O4 - HKLM\..\Run: [mhsa] C:\WINNT\TEMP\mhso.exe
O4 - HKLM\..\Run: [fysa] C:\WINNT\TEMP\fyso.exe
O4 - HKLM\..\Run: [jtsa] C:\WINNT\TEMP\jtso.exe
O4 - HKLM\..\Run: [wlsa] C:\WINNT\TEMP\wlso.exe
O4 - HKLM\..\Run: [wgsa] C:\WINNT\TEMP\wgso.exe
O4 - HKLM\..\Run: [wmsa] C:\WINNT\TEMP\wmso.exe
O4 - HKLM\..\Run: [qjsa] C:\WINNT\TEMP\qjso.exe
O4 - HKLM\..\Run: [rxsa] C:\WINNT\TEMP\rxso.exe
O4 - HKLM\..\Run: [wdsa] C:\WINNT\TEMP\wdso.exe
O8 - Extra context menu item: 上传到QQ网络硬盘 - E:\jm floder\TM\AddToNetDisk.htm
O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: 使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: 使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - E:\jm floder\TM\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - E:\jm floder\TM\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - E:\jm floder\TM\SendMMS.htm
O9 - Extra Button: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - Extra 'Tools' menuitem: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - Extra Button: @shdoclc.dll,-866 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: @shdoclc.dll,-864 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\system32\shdocvw.dll
O9 - Extra Button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - E:\jm floder\TM\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - E:\jm floder\TM\QQ.EXE
O9 - Extra Button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
O15 - Trusted Zone: mybank.icbc.com.cn
O15 - Trusted Zone: http://www.icbc.com.cn
O16 - DPF: {1E0DFFCF-27FF-4574-849B-55007349FEDA} (iTrusPTA Class) - https://img.alipay.com/download/1101/aliedit.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9C795B32-1F3B-4601-BBE0-E176920066C2}: NameServer = 211.95.193.97
O18 - Filter : application/octet-stream - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll
O18 - Filter : application/x-complus - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll
O18 - Filter : application/x-msdownload - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll
O18 - Protocol: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: ipp - (no CLSID) - (no file)
O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINNT\system32\itss.dll
O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll
O18 - Protocol: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll
O18 - Protocol: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINNT\system32\inetcomm.dll
O18 - Protocol: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINNT\system32\itss.dll
O18 - Protocol: msdaipp - (no CLSID) - (no file)
O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll
O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINNT\system32\mshtml.dll
O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll
O18 - Protocol: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINNT\system32\msdxm.ocx
O20 - Winlogon Notify: igfxcui
O20 - Winlogon Notify: wzcnotif
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\system32\dmadmin.exe /com
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - "C:\Program Files\Rising\Rav\CCenter.exe"
O23 - Service: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - "C:\PROGRAM FILES\RISING\RAV\Ravmond.exe"
最后编辑2007-05-15 09:25:51
分享到:
gototop
 

用什么软件扫描?
gototop
 

用什么软件扫描?
gototop
 

[CODE]

2007-05-15,09:09:53

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195) - 管理权限用户 - 完整功能

以下内容被选中:
    所有的启动项目(包括注册表、启动文件夹、服务等)
    浏览器加载项
    正在运行的进程(包括进程模块信息)
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <Internat.exe><internat.exe>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
    <run><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
    <runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe>  [Beijing Rising Technology Co., Ltd.]
    <WangWang><"E:\jm floder\WangWang\WangWang.EXE">  [阿里巴巴软件(上海)有限公司]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows 2000 Publisher]
    <Userinit><C:\WINNT\system32\userinit.exe,>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_CURRENT_USER\Control Panel\Desktop]
    <SCRNSAVE.EXE><C:\WINNT\system32\sstext3d.scr>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <ccApp><; "C:\Program Files\Common Files\Symantec Shared\ccApp.exe">  [N/A]
    <HotKeysCmds><; C:\WINNT\system32\hkcmd.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <IgfxTray><; C:\WINNT\system32\igfxtray.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <StormCodec_Helper><; "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti>  []
    <Synchronization Manager><; mobsync.exe /logon>  [(Verified)Microsoft Windows 2000 Publisher]
    <TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]

==================================
启动文件夹
N/A

==================================
服务
[Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
  <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
  <"C:\PROGRAM FILES\RISING\RAV\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[Visual Studio Analyzer RPC bridge / Visual Studio Analyzer RPC bridge][Stopped/Manual Start]
  <C:\Program Files\Microsoft Visual Studio\Common\Tools\VS-Ent98\Vanalyzr\varpc.exe><Microsoft Corporation>
[Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start]
  <C:\WINNT\System32\svchost.exe -k netsvcs-->C:\WINNT\system32\mspmsnsv.dll><Microsoft Corporation>

==================================
驱动程序
[BaseTDI / BaseTDI][Running/Auto Start]
  <\??\C:\WINNT\system32\drivers\basetdi.sys><Beijing Rising Technology Co., Ltd.>
[dmboot / dmboot][Stopped/Disabled]
  <System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[ExpScaner / ExpScaner][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\ExpScan.sys><>
[HookCont / HookCont][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\HookSys.sys><Rising>
[ialm / ialm][Running/Manual Start]
  <system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[MEMSCAN / MEMSCAN][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\MEMSCAN.sys><瑞星软件有限公司>
[Netgroup Packet Filter / NPF][Stopped/Manual Start]
  <system32\DRIVERS\npf.sys><CACE Technologies>
[npkcrypt / npkcrypt][Running/Auto Start]
  <\??\E:\jm floder\TM\TMDlls\npkcrypt.sys><INCA Internet Co., Ltd.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
  <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[RsNTGDI / RsNTGDI][Running/Boot Start]
  <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\RSPPSYS.sys><Rising>
[Realtek RTL8029(AS)-based PCI Ethernet Adapter NT Driver / rtl8029][Running/Manual Start]
  <system32\DRIVERS\RTL8029.SYS><REALTEK Semiconductor Corp.>
[Realtek RTL8139-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[SerMon / SerMon][Stopped/Manual Start]
  <\??\C:\Program Files\Ser232Mon\sermon.sys><N/A>
[sptd / sptd][Running/Boot Start]
  <\SystemRoot\System32\Drivers\sptd.sys><N/A>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
  <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>

==================================
浏览器加载项
[Adobe PDF Reader Link Helper]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[启动迅雷5]
  {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <C:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <E:\jm floder\TM\QQ.EXE, TENCENT>
[FlashGet]
  {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\flashget.exe, Amaze Soft>
[@msdxmLC.dll,-1@2052,电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[FlashGet Bar]
  {E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[卡卡上网安全助手]
  {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINNT\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[iTrusPTA Class]
  {1E0DFFCF-27FF-4574-849B-55007349FEDA} <C:\WINNT\system32\aliedit\pta.dll, >
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>
[WangWangObj Class]
  {6E213FC7-DD5A-4115-B7E6-D4C7838C361E} <E:\jm floder\WangWang\WangWangX4.dll, 阿里软件(中国)有限公司>
[上传到QQ网络硬盘]
  <E:\jm floder\TM\AddToNetDisk.htm, N/A>
[使用网际快车下载]
  <C:\Program Files\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
  <C:\Program Files\FlashGet\jc_all.htm, N/A>
[使用迅雷下载]
  <C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
[使用迅雷下载全部链接]
  <C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
[添加到QQ自定义面板]
  <E:\jm floder\TM\AddPanel.htm, N/A>
[添加到QQ表情]
  <E:\jm floder\TM\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <E:\jm floder\TM\SendMMS.htm, N/A>

==================================
gototop
 

正在运行的进程
[PID: 200][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 224][\??\C:\WINNT\system32\csrss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 244][\??\C:\WINNT\system32\winlogon.exe]  [Microsoft Corporation, 5.00.2195.6970]
    [C:\WINNT\system32\wdmaud.drv]  [Microsoft Corporation, 5.00.2195.6673]
[PID: 272][C:\WINNT\system32\services.exe]  [Microsoft Corporation, 5.00.2195.6700]
    [C:\WINNT\system32\dmserver.dll]  [VERITAS Software Corp., 2195.6605.297.3]
[PID: 1012][C:\WINNT\Explorer.EXE]  [Microsoft Corporation, 5.00.3700.6690]
    [C:\WINNT\AppPatch\AcLayers.DLL]  [Microsoft Corporation, 5.00.2195.6717]
    [C:\WINNT\system32\wdmaud.drv]  [Microsoft Corporation, 5.00.2195.6673]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [C:\WINNT\TEMP\woso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\ztso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\mhso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\fyso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\jtso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\wlso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\wgso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\wmso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\qjso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\rxso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\wdso0.dll]  [N/A, ]
    [C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll]  [Adobe Systems, Inc., 8.0.0.0]
    [C:\WINNT\system32\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.163]
    [C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll]  [Adobe Systems Incorporated, 8.0.0.2006102200]
    [C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 2, 17]
[PID: 1252][C:\Program Files\Rising\AntiSpyware\runiep.exe]  [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6]
    [C:\Program Files\Rising\AntiSpyware\iep_ctrl.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 1244][E:\jm floder\WangWang\WangWang.EXE]  [阿里巴巴软件(上海)有限公司, 5, 1, 0, 9]
    [E:\jm floder\WangWang\MFC80.DLL]  [Microsoft Corporation, 8.00.50727.42]
    [E:\jm floder\WangWang\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]
    [E:\jm floder\WangWang\MSVCP80.dll]  [Microsoft Corporation, 8.00.50727.42]
    [E:\jm floder\WangWang\MFC80CHS.DLL]  [Microsoft Corporation, 8.00.50727.42]
    [E:\jm floder\WangWang\AliSkin.dll]  [阿里巴巴软件(上海)有限公司, 1.0.0.1]
    [E:\jm floder\WangWang\zlib.dll]  [, 1.2.3]
    [E:\jm floder\WangWang\Ali_Res.DLL]  [N/A, ]
    [E:\jm floder\WangWang\WangWangX4.dll]  [阿里软件(中国)有限公司, 1, 0, 0, 1]
    [E:\jm floder\WangWang\RICHED32.DLL]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [E:\jm floder\WangWang\RICHED20.dll]  [Microsoft Corporation, 5.30.23.1221]
    [E:\jm floder\WangWang\RichOne.dll]  [阿里巴巴软件(上海)有限公司, 1.0.0.1]
    [E:\jm floder\WangWang\TBProgress.dll]  [阿里巴巴软件(上海)有限公司, 1.0.0.1]
    [E:\jm floder\WangWang\MessageNotify.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [E:\jm floder\WangWang\ww_network.dll]  [, 1, 0, 1, 23]
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\WINNT\system32\wdmaud.drv]  [Microsoft Corporation, 5.00.2195.6673]
    [E:\jm floder\WangWang\AliViewMedia.dll]  [阿里巴巴软件(上海)有限公司, 1, 0, 0, 2]
    [E:\jm floder\WangWang\VLNetwork.dll]  [阿里巴巴软件(上海)有限公司, 1, 0, 0, 6]
    [E:\jm floder\WangWang\VideoCap.dll]  [, 1, 0, 0, 4]
    [E:\jm floder\WangWang\VLAudio.dll]  [阿里巴巴软件(上海)有限公司, 1, 0, 0, 5]
    [E:\jm floder\WangWang\JsmShow.dll]  [阿里巴巴软件(上海)有限公司, 1, 0, 0, 4]
    [C:\WINNT\system32\msdmo.dll]  [, ]
    [C:\WINNT\TEMP\wdso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\rxso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\qjso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\wmso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\wgso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\fyso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\wlso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\jtso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\mhso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\ztso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\woso0.dll]  [N/A, ]
[PID: 1224][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3208]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 1464][C:\WINNT\system32\internat.exe]  [Microsoft Corporation, 5.00.2920.0000]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 348][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2800.1106]
    [C:\WINNT\system32\kakatool.dll]  [Beijing Rising Technology Co., Ltd., 2, 0, 3, 0]
    [C:\WINNT\system32\MSDART.DLL]  [Microsoft Corporation, 2.81.1117.0 built by: (_sqlbld)]
    [C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll]  [Adobe Systems Incorporated, 8.0.0.2006102200]
    [C:\WINNT\system32\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.163]
    [C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 2, 17]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [C:\WINNT\TEMP\wdso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\rxso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\qjso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\wmso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\wgso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\fyso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\wlso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\jtso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\mhso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\ztso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\woso0.dll]  [N/A, ]
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\WINNT\system32\Macromed\Flash\Flash9c.ocx]  [Adobe Systems, Inc., 9,0,45,0]
    [C:\WINNT\system32\wdmaud.drv]  [Microsoft Corporation, 5.00.2195.6673]
    [C:\WINNT\system32\JPWB.IME]  [常诚研制, 4.00.950]
gototop
 


[PID: 1688][C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\MSDEV.EXE]  [Microsoft Corporation, 6.00.9782.2]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\devshl.dll]  [Microsoft Corporation, 6.00.9782.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\devedit.pkg]  [Microsoft Corporation, 6.00.9782.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\devprj.pkg]  [Microsoft Corporation, 6.00.8447.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\devbld.pkg]  [Microsoft Corporation, 6.00.9782.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\devaut1.pkg]  [Microsoft Corporation, 6.00.8447.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\devbied.pkg]  [Microsoft Corporation, 6.00.8168.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\devclvw.pkg]  [Microsoft Corporation, 6.00.8447.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\devcpp.pkg]  [Microsoft Corporation, 6.00.8798.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\devdbg.pkg]  [Microsoft Corporation, 6.00.8804.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\devdtg.pkg]  [Microsoft Corporation, 6.00.8168.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\devent.pkg]  [Microsoft Corporation, 6.00.8168.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\devgal.pkg]  [Microsoft Corporation, 6.00.8168.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\devhelp.pkg]  [Microsoft Corporation, 6.00.8168.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\devhtmx.pkg]  [Microsoft Corporation, 6.00.8168.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\devncb.pkg]  [Microsoft Corporation, 6.00.8168.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\devodl.pkg]  [Microsoft Corporation, 6.00.8168.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\devres.pkg]  [Microsoft Corporation, 6.00.8168.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\devtool.pkg]  [Microsoft Corporation, 6.00.8168.0]
    [C:\Program Files\Microsoft Visual Studio\Common\VSS\win32\SSSCC.DLL]  [, 06.00.31222]
    [C:\Program Files\Microsoft Visual Studio\Common\VSS\win32\ssus.dll]  [, 06.00.31222]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [C:\WINNT\TEMP\wdso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\rxso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\qjso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\wmso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\wgso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\fyso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\wlso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\jtso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\mhso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\ztso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\woso0.dll]  [N/A, ]
    [C:\WINNT\system32\wdmaud.drv]  [Microsoft Corporation, 5.00.2195.6673]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\mfcclwz.dll]  [Microsoft Corporation, 6.00.8168.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\mspdb60.dll]  [Microsoft Corporation, 6.00.8168.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\feacp.dll]  [Microsoft Corporation, 12.00.9782.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\SHSQL.DLL]  [Microsoft Corporation, 6.00.8168.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\EESWT.DLL]  [Microsoft Corporation, 6.00.8168.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\EECXX.DLL]  [Microsoft Corporation, 6.00.9782.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\EESQL.DLL]  [Microsoft Corporation, 6.00.8982.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\TLLOC.DLL]  [Microsoft Corporation, 6.00.8168.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\EM.DLL]  [Microsoft Corporation, 6.00.8804.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\MSDIS110.DLL]  [Microsoft Corporation, 1.12.9438]
    [C:\WINNT\system32\MSVCP60.dll]  [Microsoft Corporation, 6.00.8972.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\SHCV.DLL]  [Microsoft Corporation, 6.00.8798.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\NMSQL.DLL]  [Microsoft Corporation, 6.00.8168.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\msenc10.dll]  [Microsoft Corporation, 6.00.8168.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\msobj10.dll]  [Microsoft Corporation, 6.00.8168.0]
    [C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\dm.dll]  [Microsoft Corporation, 6.00.9782.0]
[PID: 1756][C:\WINNT\system32\conime.exe]  [Microsoft Corporation, 5.00.2195.6655]
[PID: 452][C:\Program Files\WinRAR\WinRAR.exe]  [N/A, ]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [C:\WINNT\TEMP\wdso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\rxso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\qjso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\wmso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\wgso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\fyso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\wlso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\jtso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\mhso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\ztso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\woso0.dll]  [N/A, ]
[PID: 1704][C:\WINNT\TEMP\Rar$EX00.665\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [C:\WINNT\TEMP\wdso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\rxso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\qjso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\wmso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\wgso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\fyso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\wlso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\jtso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\mhso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\ztso0.dll]  [N/A, ]
    [C:\WINNT\TEMP\woso0.dll]  [N/A, ]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================


[/CODE]
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT