我QQ老被盗,请高手来帮看下,有日志 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛我QQ老被盗,请高手来帮看下,有日志

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

1

1 / 1 页

跳转页

我QQ老被盗,请高手来帮看下,有日志

飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:	发表于： 2007-08-08 22:25 \| 显示全部短消息资料字号：小中大 1楼我QQ老被盗,请高手来帮看下,有日志我QQ老被盗,毒也杀了很多次了,每次过后密码都改了,但下次上去系统还是提示别人登陆过.我扫了日志,请高手来帮我看下. 各位高手：非常感谢您留心我这份系统诊断报告，小菜鸟十万火急等待您的帮助！该诊断报告由360安全卫士提供 http://www.360safe.com 诊断时间: 2007-08-08 22:04:34 诊断平台: Microsoft Windows XP Service Pack 2 IE版本: Internet Explorer V6.0.2900.2180 Build:62900.2180 计算机物理内存:1023.48MB - 当前可用内存:633.52MB 100 - 未知 - Process: guard.exe [AVG Anti-Spyware guard] - D:\木马专杀工具\guard.exe O3 - 未知 - Toolbar: (快捷工具条3.1.5) - [无效的CLSID:{BE830FD4-E393-417F-9F4B-CC70ABB3384C}] - {BE830FD4-E393-417F-9F4B-CC70ABB3384C} - O3 - 未知 - Toolbar: (第三方IE工具栏) - [无效的CLSID:{710EB7A1-45ED-11D0-924A-0020AFC7AC4D}] - {710EB7A1-45ED-11D0-924A-0020AFC7AC4D} - O3 - 未知 - Toolbar: (第三方IE工具栏) - [无效的CLSID:{1E796980-9CC5-11D1-A83F-00C04FC99D61}] - {1E796980-9CC5-11D1-A83F-00C04FC99D61} - O4 - 未知 - HKLM\..\Run: [SkyTel] [Realtek Voice Manager] SkyTel.EXE O4 - 未知 - HKLM\..\RunOnce: [KKDelay] [RunOnce Application] C:\Program Files\Rising\AntiSpyware\RunOnce.exe O8 - 未知 - Extra context menu item: &使用快车(FlashGet)下载 - C:\Program Files\FlashGet\jc_link.htm O8 - 未知 - Extra context menu item: &使用快车(FlashGet)下载全部链接 - C:\Program Files\FlashGet\jc_all.htm O8 - 未知 - Extra context menu item: 上传到QQ网络硬盘 - O8 - 未知 - Extra context menu item: 使用迅雷下载 - C:\Program Files\Thunder\Program\geturl.htm O8 - 未知 - Extra context menu item: 使用迅雷下载全部链接 - C:\Program Files\Thunder\Program\getallurl.htm O8 - 未知 - Extra context menu item: 导出到 Microsoft Excel(&X) - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - 未知 - Extra context menu item: 添加到QQ自定义面板 - O8 - 未知 - Extra context menu item: 添加到QQ表情 - O8 - 未知 - Extra context menu item: 用QQ彩信发送该图片 - O9 - 未知 - Extra button: 浩方对战平台(HKLM) - D:\浩方对战平台\浩方对战平台\GameClient.exe O9 - 未知 - Extra button: Research(HKLM) - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - 未知 - Extra button: 讯通视频语音聊天(HKLM) - http://www.bdsystem.com/ O18 - 未知 - Protocol: Microsoft Office InfoPath XML Mime Filter - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O23 - 未知 - Service: AVG Anti-Spyware Guard [AVG Anti-Spyware Guard] - D:\木马专杀工具\guard.exe - (running) O23 - 未知 - Service: Hello World [局域网通讯协议] - - (not running) O23 - 未知 - Service: odserv [运行部分 Microsoft Office 诊断。] - "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE" - (not running) ======================================= 100 - 安全 - Process: smss.exe [进程为会话管理子系统用以初始化系统变量，ms-dos驱动名称类似lpt1以及com，调用win32壳子系统和运行在windows登陆过程。] - C:\WINDOWS\System32\smss.exe 100 - 安全 - Process: csrss.exe [客户端服务子系统，用以控制windows图形相关子系统。] - C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=base 100 - 安全 - Process: winlogon.exe [windows nt用户登陆程序。] - C:\WINDOWS\system32\winlogon.exe 100 - 安全 - Process: services.exe [用于管理windows服务系统进程。] - C:\WINDOWS\system32\services.exe 100 - 安全 - Process: lsass.exe [本地安全权限服务控制windows安全机制。] - C:\WINDOWS\system32\lsass.exe 100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost -k DcomLaunch 100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost -k rpcss 100 - 安全 - Process: CCenter.exe [瑞星杀毒软件控制台相关程序。] - 100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\System32\svchost.exe -k netsvcs 100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost.exe -k NetworkService 100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost.exe -k LocalService 100 - 安全 - Process: RavMonD.exe [瑞星杀毒软件的一部分。] - 100 - 安全 - Process: rfwsrv.exe [瑞星出品的防火墙程序，用于抵御黑客攻击。] - 100 - 安全 - Process: explorer.exe [windows program manager或者windows explorer用于控制windows图形shell，包括开始菜单、任务栏，桌面和文件管理。] - C:\WINDOWS\Explorer.EXE 100 - 安全 - Process: spoolsv.exe [windows打印任务控制程序，用以打印机就绪。] - C:\WINDOWS\system32\spoolsv.exe 100 - 安全 - Process: rfwmain.exe [瑞星公司出品的瑞星杀毒软件个人防火墙程序,用于抵御黑客攻击。] - c:\rising\rfw\RfwMain.exe 100 - 安全 - Process: RavTask.exe [瑞星出品的杀毒软件相关程序。] - 100 - 安全 - Process: RavMon.exe [瑞星杀毒软件防火墙。] - 100 - 安全 - Process: 360tray.exe [360安全卫士实时保护模块] - D:\360safe\safemon\360Tray.exe 100 - 安全 - Process: ctfmon.exe [office xp输入法图标。] - C:\WINDOWS\system32\ctfmon.exe 100 - 安全 - Process: LSSrvc.exe [一款名为LightScribe(光雕技术)的刻录机，可以在光盘上光雕个性化图案。] - C:\Program Files\Common Files\LightScribe\LSSrvc.exe 100 - 安全 - Process: nvsvc32.exe [nvidia driver helper service在nvida显卡驱动中被安装。] - C:\WINDOWS\system32\nvsvc32.exe 100 - 安全 - Process: alg.exe [这是一个应用层网关服务用于网络共享。] - C:\WINDOWS\System32\alg.exe 100 - 安全 - Process: Rav.exe [瑞星杀毒软件。] - 100 - 安全 - Process: IEXPLORE.EXE [microsoft internet explorer浏览器用于浏览网页。] - C:\Program Files\Internet Explorer\iexplore.exe 100 - 安全 - Process: 360Safe.exe [360安全卫士] - D:\360safe\360safe.exe R1 - 安全 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\system32\blank.htm O3 - 安全 - Toolbar: (超级兔子上网精灵) - [超级兔子上网精灵工具条,随超级兔子软件捆绑安装。] - {43869BB3-22FD-4F15-9B46-238106BA2F4E} - D:\Super Rabbit\MagicSet\haokanbar.dll O4 - 安全 - HKLM\..\Run: [Alcmtr] [一款声卡相关程序。] ALCMTR.EXE O4 - 安全 - HKLM\..\Run: [NvCplDaemon] [是NVIDIA显示卡相关动态链接库文件。] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - 安全 - HKLM\..\Run: [RavTask] [瑞星杀毒软件的任务计划程序。] "C:\Rising\Rav\RavTask.exe" -system O4 - 安全 - HKLM\..\Run: [nwiz] [是NVidia的Nview特性相关程序。该程序用于用户对其特性进行配置，将桌面扩展到多台显示器上。 ] nwiz.exe /install O4 - 安全 - HKLM\..\Run: [runeip] [卡卡上网安全助手相关程序。] ; "C:\Program Files\Rising\AntiSpyware\runiep.exe" /startup O4 - 安全 - HKLM\..\Run: [360Safetray] [360safe实时保护功能模块。] D:\360safe\safemon\360Tray.exe /start O4 - 安全 - HKLM\..\Run: [RfwMain] [瑞星防火墙程序，抵御黑客攻击。] "C:\Rising\Rfw\rfwmain.exe" -Startup O4 - 安全 - HKCU\..\Run: [ctfmon.exe] [office xp输入法图标。] C:\WINDOWS\system32\ctfmon.exe O4 - 安全 - Startup folder: [QQ游戏启动加速程序.lnk] [qq游戏启动加速相关程序。] C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\QQ游戏启动加速程序.lnk O8 - 安全 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O16 - 安全 - DPF: {098A3F72-3110-4004-B954-2F9DC44934B4} (上海银行企业网上银行) - http://www.xinailiao.com/BDC_Root_CA.cab O23 - 安全 - Service: LightScribeService [一个来自dvd刻录机\\\"光雕\\\"软件的相关程序,通过用户许可协议安装。] - "C:\Program Files\Common Files\LightScribe\LSSrvc.exe" - (running) O23 - 安全 - Service: NBService [刻录软件包Nero内置的备份工具nero backitup相关服务。] - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe - (not running) O23 - 安全 - Service: NVSvc [是NVIDIA显示卡相关程序。] - C:\WINDOWS\system32\nvsvc32.exe - (running) O23 - 安全 - Service: RfwProxySrv [瑞星防火墙相关程序。] - c:\rising\rfw\rfwproxy.exe - (not running) O23 - 安全 - Service: RfwService [是瑞星个人防火墙相关程序。] - c:\rising\rfw\rfwsrv.exe - (running) O23 - 安全 - Service: RsCCenter [是瑞星杀毒软件控制台相关程序。] - "C:\Rising\Rav\CCenter.exe" - (running) O23 - 安全 - Service: RsRavMon [是瑞星杀毒软件相关监控程序。] - "C:\RISING\RAV\Ravmond.exe" - (running) [用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.2) 2007-08-08 22:37:42
飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:	分享到：

飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:	发表于： 2007-08-08 22:26 \| 显示全部短消息资料字号：小中大 2楼 ======================================= O31 - 未知 - Folder Menu: {7D4D6379-F301-4311-BEBA-E26EB0561882} - C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll - Nero AG - Nero Digital Shell Extension - 2.0.0.8 - 1802240 - 2891b62b2a8181d827add753dccdce7f O31 - 未知 - SEApproved: {42071714-76d4-11d1-8b24-00a0c9068ff3} - deskpan.dll - - - - 0 - O31 - 未知 - SEApproved: 无效的CLSID：Shell extensions for file compression - - - - - 0 - O31 - 未知 - SEApproved: 无效的CLSID：加密上下文菜单 - - - - - 0 - O31 - 未知 - SEApproved: {0DF44EAA-FF21-4412-828E-260A8728E7F1} - - - - - 0 - O31 - 未知 - SEApproved: 无效的CLSID：Avi Properties Handler - - - - - 0 - O31 - 未知 - SEApproved: {00E7B358-F65B-4dcf-83DF-CD026B94BFD4} - - - - - 0 - O31 - 未知 - SEApproved: {7A9D77BD-5403-11d2-8785-2E0420524153} - - - - - 0 - O31 - 未知 - SEApproved: {B41DB860-8EE4-11D2-9906-E49FADC173CA} - C:\Program Files\WinRAR\rarext.dll - - - - 125440 - 41bb01bd6b374ce13c98493ab4c1ad66 O31 - 未知 - SEApproved: {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} - C:\Program Files\Real\RealPlayer\rpshell.dll - RealNetworks, Inc. - RealPlayer Shell Extensions - 1.0.1.2156 - 49198 - 9ac5a66c293fef3858f442589e4b33eb O31 - 未知 - SEApproved: {B327765E-D724-4347-8B16-78AE18552FC3} - C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll - Nero AG - Nero Digital Shell Extension - 2.0.0.8 - 1802240 - 2891b62b2a8181d827add753dccdce7f O31 - 未知 - SEApproved: {7F1CF152-04F8-453A-B34C-E609530A9DC8} - C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll - Nero AG - Nero Digital Shell Extension - 2.0.0.8 - 1802240 - 2891b62b2a8181d827add753dccdce7f O31 - 未知 - SEApproved: {A70C977A-BF00-412C-90B7-034C51DA2439} - C:\WINDOWS\system32\nvcpl.dll - NVIDIA Corporation - NVIDIA Display Properties Extension - 6.14.11.102 - 8425472 - O31 - 未知 - SEApproved: {FFB699E0-306A-11d3-8BD1-00104B6F7516} - C:\WINDOWS\system32\nvcpl.dll - NVIDIA Corporation - NVIDIA Display Properties Extension - 6.14.11.102 - 8425472 - O31 - 未知 - SEApproved: {1CDB2949-8F65-4355-8456-263E7C208A5D} - C:\WINDOWS\system32\nvshell.dll - - - 6.14.10.11085 - 466944 - 74cdcf4ebc07b10505e9e133e34fa97e O31 - 未知 - SEApproved: {1E9B04FB-F9E5-4718-997B-B8DA88302A47} - C:\WINDOWS\system32\nvshell.dll - - - 6.14.10.11085 - 466944 - 74cdcf4ebc07b10505e9e133e34fa97e O31 - 未知 - SEApproved: {1E9B04FB-F9E5-4718-997B-B8DA88302A48} - C:\WINDOWS\system32\nvshell.dll - - - 6.14.10.11085 - 466944 - 74cdcf4ebc07b10505e9e133e34fa97e O31 - 未知 - SEApproved: {1C7593CB-C1CC-4BA7-BE52-8EEA47F9CB1D} - C:\WINDOWS\system32\RavExt.dll - Beijing Rising Technology Co., Ltd. - Rising Shell Ext Module - 19.0.0.9 - 106496 - fa20734a7acabcfe9d727fb343da4e8a O31 - 未知 - Directory Menu: {1C7593CB-C1CC-4BA7-BE52-8EEA47F9CB1D} - C:\WINDOWS\system32\RavExt.dll - Beijing Rising Technology Co., Ltd. - Rising Shell Ext Module - 19.0.0.9 - 106496 - fa20734a7acabcfe9d727fb343da4e8a O31 - 未知 - Directory Menu: {B41DB860-8EE4-11D2-9906-E49FADC173CA} - C:\Program Files\WinRAR\rarext.dll - - - - 125440 - 41bb01bd6b374ce13c98493ab4c1ad66 O31 - 未知 - BootExecute: bsmain - - - - 0 - O31 - 未知 - BootExecute: KNative.exe - - - - 0 - O31 - 未知 - LSA: Security Packages - sv1_0.dll - - - - 0 - O31 - 未知 - LSA: Security Packages - channel.dll - - - - 0 - ======================================= O40 - Explorer.EXE - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll - Nero Digital Shell Extension - 2891b62b2a8181d827add753dccdce7f O40 - Explorer.EXE - Microsoft Corporation - C:\Program Files\Common Files\Ahead\Lib\MFC71.DLL - MFCDLL Shared Library - Retail Version - f35a584e947a5b401feb0fe01db4a0d7 O40 - Explorer.EXE - Microsoft Corporation - C:\Program Files\Common Files\Ahead\Lib\MSVCR71.dll - Microsoft? C Runtime Library - 86f1895ae8c5e8b17d99ece768a70732 O40 - Explorer.EXE - Microsoft Corporation - C:\Program Files\Common Files\Ahead\Lib\MSVCP71.dll - Microsoft? C++ Runtime Library - 561fa2abb31dfa8fab762145f81667c2 O40 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\system32\MFC71CHS.DLL - MFC Language Specific Resources - ecfff2dffbb1cae3a00cb2ab9bff8cef O40 - Explorer.EXE - NVIDIA Corporation - C:\WINDOWS\system32\nvcpl.dll - NVIDIA Display Properties Extension - O40 - Explorer.EXE - NVIDIA Corporation - C:\WINDOWS\system32\NVRSZHC.DLL - NVIDIA Simplified Chinese language resource library - 9c03cafe81a15e74391fb3bd020e83c4 O40 - Explorer.EXE - NVIDIA Corporation - C:\WINDOWS\system32\nvapi.dll - NVIDIA NVAPI Library, Version 101.02 - 729458857935e263f9838cc907e5f89e O40 - Explorer.EXE - - C:\WINDOWS\system32\nvshell.dll - - 74cdcf4ebc07b10505e9e133e34fa97e ======================================= O41 - BaseTDI - basetdi - C:\WINDOWS\system32\drivers\basetdi.sys - (running) - basetdi - Beijing Rising Technology Co., Ltd. - 0064810c1b03f2c889130b669a4ce937 O41 - ExpScaner - ExpScan.sys - C:\Rising\Rav\ExpScan.sys - (running) - ExpScan.sys - - 5a690926c7181d5c0b2721016442c9c3 O41 - HookCont - HookCont - C:\Rising\Rav\HookCont.sys - (running) - HookCont - Rising - 3926cb7b005564bc77d6b40235c53817 O41 - HookReg - HookReg - C:\Rising\Rav\HOOKREG.sys - (running) - - - 997c395147f8e5b3f714bdd112fe8945 O41 - HookSys - Hooksys - C:\Rising\Rav\HookSys.sys - (running) - Hooksys - Rising - 265b67f85db6226f2439e13e7c1fa8bf O41 - HookUrl - HookUrl - C:\Rising\Rfw\HookUrl.sys - (running) - HookUrl - Beijing Rising Technology Co., Ltd. - 93768ab1e576eef2de107eddbc586e9b O41 - MEMSCAN - MemScan Driver - C:\Rising\Rav\MemScan.sys - (running) - MemScan Driver - Beijing Rising Technology Co., Ltd. - a909256ef59a987fda249aa3ded01e76 O41 - mProcRs - Rising Personal FireWall mprocrs.sys - c:\Rising\Rfw\mProcRs.sys - (running) - Rising Personal FireWall mprocrs.sys - Beijing Rising Technology Co., Ltd. - f19fe6ccade903d285208247056daf6a O41 - RsAntiSpyware - Anti-RootKit Driver - C:\WINDOWS\system32\drivers\RsBoot.sys - (running) - Anti-RootKit Driver - Beijing Rising Technology Co., Ltd. - f9edc97f228c046832a24b5a76017912 O41 - RsFwDrv - nt_fwdrv - C:\Rising\Rfw\rsfwdrv.sys - (running) - nt_fwdrv - Beijing Rising Technology Co., Ltd. - 1869e55cfacff0ff786d4ba6d2340ee2 O41 - RsNTGDI - RsNTGDI - C:\WINDOWS\system32\drivers\RsNTGdi.sys - (running) - RsNTGDI - Beijing Rising Technology Co., Ltd. - 17214e7b192cb93ff014fca1484b97ad O41 - RSPPSYS - RSPPSYS.SYS - C:\Rising\Rav\rsppsys.sys - (running) - RSPPSYS.SYS - Rising - f38c10d8c21626a4878ea16717e971fa O41 - sptd - sptd - C:\WINDOWS\system32\drivers\sptd.sys - (running) - - - O41 - aahchfdj - aahchfdj - C:\WINDOWS\system32\drivers\aahchfdj.sys - (not running) - - - O41 - mssock - mssock - C:\WINDOWS\system32\mssock.sys - (not running) - - - 75c8e3118a6be319a6207a27e2742786 O41 - npkcrypt - npkcrypt - E:\QQ2007\npkcrypt.sys - (not running) - - -
飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:

飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:	发表于： 2007-08-08 22:26 \| 显示全部短消息资料字号：小中大 3楼 ======================================= 360Safe.exe=3.5.2.1005 AntiAdwa.dll=3.5.1.1001 AntiEng.dll=3.5.2.1002 AntiActi.dll=2.0.0.3000 CleanHis.dll=3.0.2.1000 safelive.exe=1.0.0.2007 live.dll=1.0.1.1018 ======================================= 操作历史报告： ----------清理恶评及系统插件历史---------- 2007-07-09 23:22 查杀恶意软件 - 江民杀毒软件附带的工具栏 - 安全 - 2007-07-30 16:57 查杀恶意软件 - 很棒小秘书 - 危险 - C:\WINDOWS\UNWISE.INI 2007-06-09 15:11 插件管理 - 易趣购物按钮 - C:\WINDOWS\system32\ebay.ico 2007-06-09 15:11 插件管理 - 网际快车附带的工具栏 - C:\PROGRA~1\FlashGet\fgiebar.dll 2007-07-09 23:19 插件管理 - Yayad - 插件管理 - 网际快车附带的工具栏 - C:\PROGRA~1\FlashGet\fgiebar.dll 插件管理 - 超级兔子上网精灵 - 2007-07-09 23:19 插件管理 - 江民杀毒软件附带的工具栏 - C:\PROGRA~1\JiangMin\ANTIVI~1\KVshell.dll 2007-07-10 22:31 插件管理 - 金山毒霸2007反钓鱼插件 - 2007-07-10 22:32 插件管理 - 网际快车附带的工具栏 - C:\PROGRA~1\FlashGet\fgiebar.dll 2007-07-30 16:53 插件管理 - OKTE搜索工具条 - C:\WINDOWS\system32\YingInstall ----------全面诊断修复历史---------- 2007-05-30 21:50 O6 - 危险 - 禁止IE首页相关设置 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel O6 - 危险 - 禁止IE相关功能 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions 2007-06-19 22:32 O6 - 危险 - 禁止IE首页相关设置 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel O6 - 危险 - 禁止IE相关功能 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions 2007-07-09 23:20 O6 - 危险 - 禁止IE首页相关设置 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel O6 - 危险 - 禁止IE相关功能 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions 2007-07-10 22:31 O6 - 危险 - 禁止IE首页相关设置 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel O6 - 危险 - 禁止IE相关功能 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions 2007-07-30 16:57 O6 - 危险 - 禁止IE相关功能 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions ----------修复IE浏览器操作历史---------- 2007-05-30 21:52 R0 - 危险 - IE首页 - HKCU\Software\Microsoft\Internet Explorer\Main R0 - 危险 - IE搜索页 - HKLM\Software\Microsoft\Internet Explorer\Main R0 - 危险 - IE搜索页 - HKCU\Software\Microsoft\Internet Explorer\Main R0 - 危险 - IE起始页的默认页 - HKLM\Software\Microsoft\Internet Explorer\Main R0 - 危险 - IE默认搜索页 - HKLM\Software\Microsoft\Internet Explorer\Main R1 - 危险 - IE用户指定空白页 - HKCU\Software\Microsoft\Internet Explorer\Main O21 - 危险 - http协议缺省启动程序 - D:\MOZILL~1\FIREFOX.EXE -url "%1" -requestPending O21 - 危险 - ftp协议缺省启动程序 - D:\MOZILL~1\FIREFOX.EXE -url "%1" -requestPending O21 - 危险 - https协议缺省启动程序 - D:\MOZILL~1\FIREFOX.EXE -url "%1" -requestPending O21 - 危险 - http缺省图标 - D:\MOZILL~1\FIREFOX.EXE,0 O21 - 危险 - ftp缺省图标 - D:\MOZILL~1\FIREFOX.EXE,0 O21 - 危险 - https缺省图标 - D:\MOZILL~1\FIREFOX.EXE,0 O22 - 危险 - .COM文件关联 - %1 %* O22 - 危险 - .BAT文件关联 - %1 %* O22 - 危险 - .SCR文件关联 - %1 /S O22 - 危险 - .HLP文件关联 - winhlp32.exe %1 O28 - 危险 - IE链接的参数 - C:\DOCUME~1\ADMINI~1\APPLIC~1\MICROS~1\INTERN~1\QUICKL~1\启动IN~1.LNK 2007-06-19 21:24 R0 - 危险 - IE首页 - HKCU\Software\Microsoft\Internet Explorer\Main R0 - 危险 - IE搜索页 - HKLM\Software\Microsoft\Internet Explorer\Main R0 - 危险 - IE搜索页 - HKCU\Software\Microsoft\Internet Explorer\Main R0 - 危险 - IE起始页的默认页 - HKLM\Software\Microsoft\Internet Explorer\Main R0 - 危险 - IE默认搜索页 - HKLM\Software\Microsoft\Internet Explorer\Main R1 - 危险 - IE用户指定空白页 - HKCU\Software\Microsoft\Internet Explorer\Main R0 - 危险 - IE自定义搜索引擎 - HKLM\Software\Microsoft\Internet Explorer\Search R0 - 危险 - IE备用搜索引擎 - HKLM\Software\Microsoft\Internet Explorer\Search O6 - 危险 - 禁止IE首页相关设置 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel O6 - 危险 - 禁止IE相关功能 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions O20 - 危险 - 自启动项AppInit_DLLs - D:\卡巴斯基\adialhk.dll O21 - 危险 - http协议缺省启动程序 - D:\MOZILL~1\FIREFOX.EXE -url "%1" -requestPending O21 - 危险 - ftp协议缺省启动程序 - D:\MOZILL~1\FIREFOX.EXE -url "%1" -requestPending O21 - 危险 - https协议缺省启动程序 - D:\MOZILL~1\FIREFOX.EXE -url "%1" -requestPending O21 - 危险 - http缺省图标 - D:\MOZILL~1\FIREFOX.EXE,0 O21 - 危险 - ftp缺省图标 - D:\MOZILL~1\FIREFOX.EXE,0 O21 - 危险 - https缺省图标 - D:\MOZILL~1\FIREFOX.EXE,0 O22 - 危险 - .HLP文件关联 - winhlp32.exe %1 O28 - 危险 - IE链接的参数 - C:\DOCUME~1\ADMINI~1\APPLIC~1\MICROS~1\INTERN~1\QUICKL~1\启动IN~1.LNK 2007-06-25 19:51 R0 - 危险 - IE搜索页 - HKLM\Software\Microsoft\Internet Explorer\Main R0 - 危险 - IE起始页的默认页 - HKLM\Software\Microsoft\Internet Explorer\Main R0 - 危险 - IE默认搜索页 - HKLM\Software\Microsoft\Internet Explorer\Main R1 - 危险 - IE用户指定空白页 - HKCU\Software\Microsoft\Internet Explorer\Main O6 - 危险 - 禁止IE首页相关设置 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel O6 - 危险 - 禁止IE相关功能 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions O21 - 危险 - http协议缺省启动程序 - D:\MOZILL~1\FIREFOX.EXE -url "%1" -requestPending O21 - 危险 - ftp协议缺省启动程序 - D:\MOZILL~1\FIREFOX.EXE -url "%1" -requestPending O21 - 危险 - https协议缺省启动程序 - D:\MOZILL~1\FIREFOX.EXE -url "%1" -requestPending O21 - 危险 - http缺省图标 - D:\MOZILL~1\FIREFOX.EXE,0 O21 - 危险 - ftp缺省图标 - D:\MOZILL~1\FIREFOX.EXE,0 O21 - 危险 - https缺省图标 - D:\MOZILL~1\FIREFOX.EXE,0 O22 - 危险 - .HLP文件关联 - winhlp32.exe %1 2007-07-10 22:32 R0 - 危险 - IE搜索页 - HKLM\Software\Microsoft\Internet Explorer\Main R0 - 危险 - IE搜索页 - HKCU\Software\Microsoft\Internet Explorer\Main R0 - 危险 - IE起始页的默认页 - HKLM\Software\Microsoft\Internet Explorer\Main R0 - 危险 - IE默认搜索页 - HKLM\Software\Microsoft\Internet Explorer\Main R1 - 危险 - IE用户指定空白页 - HKCU\Software\Microsoft\Internet Explorer\Main O21 - 危险 - http协议缺省启动程序 - D:\MOZILL~1\FIREFOX.EXE -url "%1" -requestPending O21 - 危险 - ftp协议缺省启动程序 - D:\MOZILL~1\FIREFOX.EXE -url "%1" -requestPending O21 - 危险 - https协议缺省启动程序 - D:\MOZILL~1\FIREFOX.EXE -url "%1" -requestPending O21 - 危险 - http缺省图标 - D:\MOZILL~1\FIREFOX.EXE,0 O21 - 危险 - ftp缺省图标 - D:\MOZILL~1\FIREFOX.EXE,0 O21 - 危险 - https缺省图标 - D:\MOZILL~1\FIREFOX.EXE,0 O22 - 危险 - .HLP文件关联 - winhlp32.exe %1 O28 - 危险 - IE链接的参数 - C:\DOCUME~1\ADMINI~1\APPLIC~1\MICROS~1\INTERN~1\QUICKL~1\启动IN~1.LNK 2007-07-30 18:16 O28 - 危险 - IE链接的参数 - C:\DOCUME~1\ADMINI~1\APPLIC~1\MICROS~1\INTERN~1\QUICKL~1\启动IN~1.LNK 2007-07-31 15:41 O28 - 危险 - IE链接的参数 - C:\DOCUME~1\ADMINI~1\APPLIC~1\MICROS~1\INTERN~1\QUICKL~1\启动IN~1.LNK 2007-08-08 21:39 O22 - 危险 - .HLP文件关联 - winhlp32.exe %1 O28 - 危险 - IE链接的参数 - C:\DOCUME~1\ADMINI~1\APPLIC~1\MICROS~1\INTERN~1\QUICKL~1\启动IN~1.LNK =======================================
飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:

飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:	发表于： 2007-08-08 22:44 \| 显示全部短消息资料字号：小中大 4楼那个不好看的话,看这个,用SREng扫描出来的 [CODE] 2007-08-08,22:26:45 System Repair Engineer 2.5.16.900 Smallfrogs (http://www.KZTechs.com) Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能以下内容被选中：所有的启动项目（包括注册表、启动文件夹、服务等）浏览器加载项正在运行的进程（包括进程模块信息）文件关联 Winsock 提供者 Autorun.inf HOSTS 文件进程特权扫描启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <load><> [N/A] <run><> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <SkyTel><SkyTel.EXE> [(Verified)Microsoft Windows Hardware Compatibility Publisher] <Alcmtr><ALCMTR.EXE> [(Verified)Microsoft Windows Hardware Compatibility Publisher] <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [NVIDIA Corporation] <RavTask><"C:\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.] <nwiz><nwiz.exe /install> [] <runeip><; "C:\Program Files\Rising\AntiSpyware\runiep.exe" /startup> [Beijing Rising Technology Co., Ltd.] <360Safetray><D:\360safe\safemon\360Tray.exe /start> [奇虎网] <RfwMain><"C:\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.] <AVP><; > [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] <KKDelay><C:\Program Files\Rising\AntiSpyware\RunOnce.exe> [Beijing Rising Technology Co., Ltd.] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [(Verified)Microsoft Windows Publisher] <Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}] <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] <Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A] ================================== 启动文件夹 [QQ游戏启动加速程序] <C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\QQ游戏启动加速程序.lnk --> E:\QQ2007\QQGAME\Accel.exe [N/A]><N> ================================== 服务 [AVG Anti-Spyware Guard / AVG Anti-Spyware Guard][Running/Auto Start] <D:\木马专杀工具\guard.exe><GRISOFT s.r.o.> [局域网通讯协议 / Hello World][Stopped/Auto Start] <><N/A> [Human Interface Device Access / HidServ][Stopped/Disabled] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A> [LightScribeService Direct Disc Labeling Service / LightScribeService][Running/Auto Start] <"C:\Program Files\Common Files\LightScribe\LSSrvc.exe"><Hewlett-Packard Company> [NBService / NBService][Stopped/Manual Start] <C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe><Nero AG> [NVIDIA Display Driver Service / NVSvc][Running/Auto Start] <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation> [Rising Proxy Service / RfwProxySrv][Stopped/Manual Start] <c:\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.> [Rising Personal Firewall Service / RfwService][Running/Auto Start] <c:\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.> [Rising Process Communication Center / RsCCenter][Running/Auto Start] <"C:\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.> [Rising RealTime Monitor / RsRavMon][Running/Auto Start] <"C:\RISING\RAV\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:

飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:	发表于： 2007-08-08 22:44 \| 显示全部短消息资料字号：小中大 5楼 ================================== 驱动程序 [aahchfdj / aahchfdj][Stopped/Boot Start] <\SystemRoot\system32\drivers\aahchfdj.sys><N/A> [Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Stopped/Manual Start] <system32\drivers\ac97intc.sys><Intel Corporation> [AliIde / AliIde][Running/Boot Start] <\SystemRoot\System32\DRIVERS\aliide.sys><Acer Laboratories Inc.> [AMD K8 Processor Driver / AmdK8][Stopped/Manual Start] <System32\DRIVERS\amdk8.sys><Advanced Micro Devices> [AVG Anti-Spyware Driver / AVG Anti-Spyware Driver][Running/System Start] <\??\D:\木马专杀工具\guard.sys><N/A> [AVG Anti-Spyware Clean Driver / AvgAsCln][Running/System Start] <System32\DRIVERS\AvgAsCln.sys><GRISOFT, s.r.o.> [Rising TDI Base Driver / BaseTDI][Running/Auto Start] <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.> [CmdIde / CmdIde][Running/Boot Start] <\SystemRoot\System32\DRIVERS\cmdide.sys><CMD Technology, Inc.> [ExpScaner / ExpScaner][Running/Auto Start] <\??\C:\RISING\RAV\ExpScan.sys><> [VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Stopped/Manual Start] <system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.> [Microsoft UAA Bus Driver for High Definition Audio / HDAudBus][Running/Manual Start] <system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider> [HookCont / HookCont][Running/Auto Start] <\??\C:\RISING\RAV\HOOKCONT.sys><Rising> [HookReg / HookReg][Running/Auto Start] <\??\C:\RISING\RAV\HookReg.sys><> [HookSys / HookSys][Running/Auto Start] <\??\C:\Rising\Rav\HookSys.sys><Rising> [HookUrl / HookUrl][Running/Auto Start] <\??\C:\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.> [Service for Realtek HD Audio (WDM) / IntcAzAudAddService][Running/Manual Start] <system32\drivers\RtkHDAud.sys><Realtek Semiconductor Corp.> [MEMSCAN / MEMSCAN][Running/Auto Start] <\??\C:\RISING\RAV\MEMSCAN.sys><Beijing Rising Technology Co., Ltd.> [mProcRs / mProcRs][Running/Auto Start] <\??\c:\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.> [mssock / mssock][Stopped/Manual Start] <\??\C:\WINDOWS\system32\mssock.sys><N/A> [npkcrypt / npkcrypt][Stopped/Auto Start] <\??\E:\QQ2007\npkcrypt.sys><N/A> [nv / nv][Running/Manual Start] <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation> [nvata / nvata][Running/Boot Start] <\SystemRoot\system32\DRIVERS\nvata.sys><NVIDIA Corporation> [NVIDIA nForce Networking Controller Driver / NVENETFD][Running/Manual Start] <system32\DRIVERS\NVENETFD.sys><NVIDIA Corporation> [NVIDIA Network Bus Enumerator / nvnetbus][Running/Manual Start] <system32\DRIVERS\nvnetbus.sys><NVIDIA Corporation> [Direct Parallel Link Driver / Ptilink][Running/Manual Start] <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.> [RsAntiSpyware / RsAntiSpyware][Running/Boot Start] <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising Technology Co., Ltd.> [RsFwDrv / RsFwDrv][Running/Auto Start] <\??\C:\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.> [RsNTGDI / RsNTGDI][Running/Boot Start] <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.> [RSPPSYS / RSPPSYS][Running/Auto Start] <\??\C:\RISING\RAV\RSPPSYS.sys><Rising> [Secdrv / Secdrv][Stopped/Manual Start] <system32\DRIVERS\secdrv.sys><N/A> [sptd / sptd][Running/Boot Start] <\SystemRoot\System32\Drivers\sptd.sys><N/A> ================================== 浏览器加载项 [ThunderAtOnce Class] {01443AEC-0FD1-40fd-9C87-E93D1494C233} <C:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD> [NavigatMon Class] {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <D:\360safe\safemon\safemon.dll, > [浩方对战平台] {0A155D3C-68E2-4215-A47A-E800A446447A} <D:\浩方对战平台\浩方对战平台\GameClient.exe, 上海浩方在线信息技术有限公司> [信息检索(&R)] {92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL, Microsoft Corporation> [讯通视频语音聊天] {97C0CDFA-970D-4222-ADDE-6718E89E887C} <http://www.bdsystem.com/, N/A> [快捷工具条3.1.5] {BE830FD4-E393-417F-9F4B-CC70ABB3384C} <, N/A> [超级兔子上网精灵] {43869BB3-22FD-4F15-9B46-238106BA2F4E} <D:\Super Rabbit\MagicSet\haokanbar.dll, Xiang Feng Technology> [AddSHCARoot Control] {098A3F72-3110-4004-B954-2F9DC44934B4} <C:\WINDOWS\DOWNLO~1\ADDCAR~1.OCX, SHECA> [ThunderAtOnce Class] {01443AEC-0FD1-40FD-9C87-E93D1494C233} <C:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD> [Web Browser Applet Control] {08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\WINDOWS\system32\Msjava.dll, Microsoft Corporation> [AddSHCARoot Control] {098A3F72-3110-4004-B954-2F9DC44934B4} <C:\WINDOWS\DOWNLO~1\ADDCAR~1.OCX, SHECA> [ThunderServer.WebThunder] {1DE5794D-B609-4A3E-9E40-22594D5BEAAC} <C:\Program Files\Thunder\ComDlls\Faker.dll, > [Windows Media Player] {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation> [HTML Document] {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\Mshtml.dll, N/A> [SuperStream Control] {285C55C4-B32C-4EC0-8539-BBCE97FDF380} <D:\浩方对~1\浩方对~1\SUPERS~1.OCX, 盛大网络> [DHTML Edit Control Safe for Scripting for IE5] {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation> [超级兔子上网精灵] {43869BB3-22FD-4F15-9B46-238106BA2F4E} <D:\Super Rabbit\MagicSet\haokanbar.dll, Xiang Feng Technology> [Thunder Agent Class] {485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <C:\Program Files\Thunder\ComDlls\ThunderAgent_Now.dll, Thunder Networking Technologies,LTD> [JetCar.Netscape] {69C7BEA7-0A70-4291-81ED-405D19AEE270} <C:\Program Files\Thunder\ComDlls\Faker.dll, > [Windows Media Player] {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [Active Desktop Mover] {72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A> [BDC Control] {7253A666-8D4A-11D7-A4DC-00E04C504779} <D:\BDC\Bdc.ocx, BLUE> [Thunder Browser Helper] {7369D359-5B70-4A5B-B789-B25FE09B4AF3} <, N/A> [超级兔子上网精灵] {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} <D:\Super Rabbit\MagicSet\haokanbar.dll, Xiang Feng Technology> [360SafeLive] {87515F61-A66C-4319-A0E0-D416CB8059E3} <D:\360safe\live.dll, 360safe.com> [Microsoft Web 浏览器] {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation> [Thunder Browser Helper] {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD> [SearchAssistantOC] {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A> [Thunder Browser Helper] {B69F34DC-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD> [NavigatMon Class] {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <D:\360safe\safemon\safemon.dll, > [RDS.DataSpace] {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation> [快捷工具条3.1.5] {BE830FD4-E393-417F-9F4B-CC70ABB3384C} <, N/A> [Tencent Safety Online Base Module] {C09B522F-8AED-4E21-A65C-DC1AB652BAEE} <C:\WINDOWS\system32\TSOBase\TSOBase.ocx, Tencent Corporation> [AUDIO__MP3 Moniker Class] {CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [AUDIO__X_MS_WMA Moniker Class] {CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [VIDEO__X_MS_ASF Moniker Class] {CD3AFA8F-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [VIDEO__X_MS_WMV Moniker Class] {CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.> [QQIEHelper.QQRightClick] {E654770F-10E4-47BC-A309-4CAD96A096E6} <C:\Program Files\Thunder\ComDlls\Faker.dll, > [PasswordEditCtrl Class] {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <E:\QQ2007\QQ\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司> [&使用快车(FlashGet)下载] <C:\Program Files\FlashGet\jc_link.htm, N/A> [&使用快车(FlashGet)下载全部链接] <C:\Program Files\FlashGet\jc_all.htm, N/A> [上传到QQ网络硬盘] <, N/A> [使用迅雷下载] <C:\Program Files\Thunder\Program\geturl.htm, N/A> [使用迅雷下载全部链接] <C:\Program Files\Thunder\Program\getallurl.htm, N/A> [导出到 Microsoft Excel(&X)] <res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000, N/A> [导出到 Microsoft Office Excel(&X)] <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A> [添加到QQ自定义面板] <, N/A> [添加到QQ表情] <, N/A> [用QQ彩信发送该图片] <, N/A>
飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:

飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:	发表于： 2007-08-08 22:47 \| 显示全部短消息资料字号：小中大 6楼 ================================== 正在运行的进程 [PID: 700 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 768 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 792 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 836 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\AppPatch\AcAdProc.dll] [Microsoft Corporation, 5.1.2600.3008 (xpsp.061004-0027)] [PID: 848 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1012 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1072 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1160 / SYSTEM][C:\Rising\Rav\CCenter.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3] [PID: 1176 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\wups2.dll] [Microsoft Corporation, 7.0.6000.374 (winmain(wmbla).070416-2057)] [PID: 1264 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1332 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1344 / SYSTEM][C:\RISING\RAV\Ravmond.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 49] [C:\RISING\RAV\BWList.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10] [C:\RISING\RAV\RsCommX.dll] [rising, 18, 0, 0, 1] [C:\RISING\RAV\rfwctrl.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11] [C:\RISING\RAV\RsPPsys.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6] [C:\RISING\RAV\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2] [C:\RISING\RAV\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13] [C:\RISING\RAV\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5] [C:\RISING\RAV\RsLog.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20] [C:\RISING\RAV\HOOKSYS.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 0] [C:\Rising\Rav\Scanner.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 15] [C:\Rising\Rav\libload.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 19] [C:\Rising\Rav\VirusLib.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 15] [C:\RISING\RAV\regmon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6] [C:\RISING\RAV\psapi.dll] [Microsoft Corporation, 4.00] [C:\RISING\RAV\HookWeb.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 1] [C:\RISING\RAV\MemMon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 14] [C:\RISING\RAV\expscan.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4] [C:\RISING\RAV\mPorts.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3] [C:\RISING\RAV\HookCont.dll] [Rising, 19, 0, 0, 0] [C:\Rising\Rav\SpamEng.dll] [, 18, 0, 0, 6] [C:\Rising\Rav\engine.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 30] [C:\Rising\Rav\UnExe.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10] [C:\Rising\Rav\ExtFile.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 36] [C:\Rising\Rav\ScanEx.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 74] [C:\Rising\Rav\PostTrt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 16] [C:\Rising\Rav\NvFile.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 11] [C:\Rising\Rav\ScanMac.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 15] [C:\Rising\Rav\ScanSct.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 20] [C:\Rising\Rav\ScanExec.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 19] [C:\Rising\Rav\ScanPack.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 24] [C:\Rising\Rav\RsVM.dll] [, 19, 0, 0, 20] [C:\Rising\Rav\Uroutine.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 48] [C:\Rising\Rav\Uscript.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 19] [C:\Rising\Rav\ExtOLE.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 14] [C:\Rising\Rav\ScanNet.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5] [C:\Rising\Rav\ExtMail.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 14] [PID: 1492 / SYSTEM][c:\rising\rfw\rfwsrv.exe] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 30] [c:\rising\rfw\RfwRule.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 3] [c:\rising\rfw\rfwlog.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 2] [c:\rising\rfw\Rfwdrv.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 9] [c:\rising\rfw\psapi.dll] [Microsoft Corporation, 4.00] [c:\rising\rfw\MonDrv.dll] [rs, 1, 0, 0, 4] [c:\rising\rfw\ProcLib.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 5] [c:\rising\rfw\mPorts.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3] [PID: 1728 / Administrator][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [D:\360safe\safemon\safemon.dll] [, 3, 5, 0, 1001] [C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll] [Nero AG, 2, 0, 0, 8] [C:\Program Files\Common Files\Ahead\Lib\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\Common Files\Ahead\Lib\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\Program Files\Common Files\Ahead\Lib\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MFC71CHS.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\nvcpl.dll] [NVIDIA Corporation, 6.14.11.0102] [C:\WINDOWS\system32\NVRSZHC.DLL] [NVIDIA Corporation, 6.14.11.0102] [C:\WINDOWS\system32\nvapi.dll] [NVIDIA Corporation, 6.14.11.0102] [C:\WINDOWS\system32\nvshell.dll] [, ] [C:\WINDOWS\system32\PortableDeviceApi.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:

飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:	发表于： 2007-08-08 22:48 \| 显示全部短消息资料字号：小中大 7楼 [C:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll] [Thunder Networking Technologies,LTD, 1.0.2.9] [C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 5, 13] [C:\Program Files\Microsoft Office\Office12\msohevi.dll] [Microsoft Corporation, 12.0.4518.1014] [C:\Program Files\Nero\Nero 7\Nero BackItUp\NBShell.dll] [Nero AG, 2, 7, 2, 0] [C:\Program Files\Nero\Nero 7\Nero BackItUp\MFC71U.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\WinRAR\rarext.dll] [N/A, ] [C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9] [C:\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5] [D:\木马专杀工具\context.dll] [GRISOFT s.r.o., 7, 5, 1, 36] [C:\Program Files\Common Files\Ahead\Lib\MediaLibraryNSE.dll] [Nero AG, 1, 5, 3, 0] [C:\WINDOWS\system32\wpdshext.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)] [C:\WINDOWS\system32\Audiodev.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)] [C:\WINDOWS\system32\WINWB86.IME] [Microsoft Corporation, 4.00.950] [C:\WINDOWS\system32\IMSC12.IME] [Microsoft Corporation, 12.0.4518.1014] [C:\PROGRA~1\COMMON~1\MICROS~1\IME12\IMESC\IMSCCORE.DLL] [Microsoft Corporation, 12.0.4518.1014] [C:\PROGRA~1\COMMON~1\MICROS~1\IME12\IMESC\IMSCCFG.DLL] [Microsoft Corporation, 12.0.4518.1014] [C:\Program Files\Common Files\Microsoft Shared\ime12\Imesc\IMSCUI.DLL] [Microsoft Corporation, 12.0.4518.1014] [C:\PROGRA~1\COMMON~1\MICROS~1\IME12\SHARED\IMELM.DLL] [Microsoft Corporation, 12.0.4518.1014] [PID: 1768 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)] [PID: 208 / Administrator][c:\rising\rfw\RfwMain.exe] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 47] [c:\rising\rfw\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33] [c:\rising\rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5] [c:\rising\rfw\RfwCtrl.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11] [c:\rising\rfw\RsXML.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2] [c:\rising\rfw\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5] [D:\360safe\safemon\safemon.dll] [, 3, 5, 0, 1001] [PID: 252 / SYSTEM][D:\木马专杀工具\guard.exe] [GRISOFT s.r.o., 7, 5, 1, 22] [D:\木马专杀工具\engine.dll] [GRISOFT s.r.o., 4, 2, 0, 19] [PID: 292 / Administrator][C:\Rising\Rav\RavTask.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9] [C:\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5] [C:\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2] [C:\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13] [C:\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1] [PID: 304 / Administrator][C:\Rising\Rav\Ravmon.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 45] [C:\Rising\Rav\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33] [C:\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10] [C:\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2] [C:\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13] [C:\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5] [C:\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1] [C:\Rising\Rav\RsXML.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2] [C:\Rising\Rav\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5] [D:\360safe\safemon\safemon.dll] [, 3, 5, 0, 1001] [PID: 400 / Administrator][D:\360safe\safemon\360Tray.exe] [奇虎网, 3, 5, 2, 1001] [D:\360safe\safemon\safemon.dll] [, 3, 5, 0, 1001] [D:\360safe\safemon\SafeKrnl.dll] [奇虎网, 3, 5, 0, 1001] [D:\360safe\AntiAdwa.dll] [360Safe.com, 3, 5, 1, 1001] [PID: 488 / Administrator][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1108 / SYSTEM][C:\Program Files\Common Files\LightScribe\LSSrvc.exe] [Hewlett-Packard Company, 1.4.124.1] [C:\Program Files\Common Files\LightScribe\LSSProxy.dll] [Hewlett-Packard Company, 1.4.124.1] [C:\Program Files\Common Files\LightScribe\LSLog.dll] [Hewlett-Packard Company, 1.4.124.1] [PID: 1248 / SYSTEM][C:\WINDOWS\system32\nvsvc32.exe] [NVIDIA Corporation, 6.14.11.0102] [C:\WINDOWS\system32\nvapi.dll] [NVIDIA Corporation, 6.14.11.0102] [PID: 772 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1444 / Administrator][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [D:\360safe\safemon\safemon.dll] [, 3, 5, 0, 1001] [D:\Super Rabbit\MagicSet\haokanbar.dll] [Xiang Feng Technology, 2, 2, 0, 1612] [C:\Program Files\Microsoft Office\Office12\msohevi.dll] [Microsoft Corporation, 12.0.4518.1014] [C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 2180 / Administrator][D:\日志扫描工具\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900] [D:\360safe\safemon\safemon.dll] [, 3, 5, 0, 1001] [D:\日志扫描工具\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15] ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\system32\winhlp32.exe %1] .INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf N/A ================================== HOSTS 文件 N/A ================================== 进程特权扫描特殊特权被允许： SeDebugPrivilege [PID = 400, D:\360SAFE\SAFEMON\360TRAY.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 1248, C:\WINDOWS\SYSTEM32\NVSVC32.EXE] ================================== API HOOK N/A ================================== 隐藏进程 N/A ================================== [/CODE]
飘飘风筝初生襁褓狮帖子:76 注册: 2006-09-12 来自:

<<上一主题|下一主题>>

1

1 / 1 页

跳转页

页面顶部

Powered by Discuz!NT