瑞星工程师进来，谢谢【求助】 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛在线技术支持 在线技术支持[已关闭] 瑞星工程师进来，谢谢【求助】

	瑞星ESM助力北京石龙医院筑牢安全防线		瑞星恶意代码管理系统助金华电力提升防御能力		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		助力国家网络安全瑞星获病毒应急处理中心感谢信
	实力拉满瑞星第四十四次通过VB100测评		瑞星发布2024年六大网络安全趋势		瑞星携手中国农业大学共筑网络安全防线		人工智能在网络安全领域的风险和机遇

12

1 / 2 页

跳转页

瑞星工程师进来，谢谢【求助】

阿杜QQ 初生襁褓狮帖子:876 注册: 2006-05-11 来自:	发表于： 2006-05-18 16:17 \| 只看楼主短消息资料字号：小中大 1楼瑞星工程师进来，谢谢【求助】我电脑最近几天总发现一个未知病毒，我天天上网，每次删除，明天有来了，真的不知道怎么办，希望工程帮忙看看了病毒名称处理结果发现日期扫描方式路径文件 JS.HTADropper.x 重新启动计算机后删除文件2006-05-09 00:48 文件监控 C:\下载\Temporary Internet Files\Content.IE5\NU7XX8IM test[1].hta JS.HTADropper.x 重新启动计算机后删除文件2006-05-09 00:48 文件监控 C:\下载\Temporary Internet Files\Content.IE5\KZTFMBCW test[1].hta Harm.Reg-WebImport.g 删除成功 2006-05-09 00:48 文件监控 C:\$NtUninstallQ887678$ WINSYS.vbs Backdoor.Gpigeon.bcv 删除成功 2006-05-10 23:11 文件监控 C:\Program Files\灰鸽子远程控制[企业版] H_Client.exe Trojan.DL.Agent.hdy 删除成功 2006-05-12 07:39 文件监控 C: usgtares.dll>>Setup_L0001.exe>>Unpack Dropper.Agent.bpy 删除成功 2006-05-12 07:39 文件监控 C: usgtares.dll>>3edm009.exe Trojan.Agent.blk 删除成功 2006-05-12 07:40 文件监控 C:\Program Files\pcast\PodcastbarMini PcastUpdate.dll Trojan.DL.Agent.hoc 删除成功 2006-05-12 07:40 文件监控 C:\WINDOWS\system32 WinSC.dll Trojan.DL.Agent.hdy 删除成功 2006-05-12 07:41 文件监控 C:\Program Files\hxtyzast Setup_L0001.exe>>Unpack Dropper.Agent.bpy 删除成功 2006-05-12 07:41 文件监控 C:\Program Files\hxtyzast 3edm009.exe Trojan.DL.Agent.hdy 删除成功 2006-05-13 21:40 文件监控 C: usgtares.dll>>Setup_L0001.exe>>Unpack Dropper.Agent.bpy 删除成功 2006-05-13 21:40 文件监控 C: usgtares.dll>>3edm009.exe Trojan.DL.QQhelper.ee 删除成功 2006-05-15 12:27 文件监控 C:\DOCUME~1\Owner\LOCALS~1\Temp\fzhk qqbq.exe Trojan.DL.Agent.hdy 删除成功 2006-05-17 23:59 文件监控 C: usgtares.dll>>Setup_L0001.exe>>Unpack Trojan.DL.Agent.hdy 删除成功 2006-05-18 15:08 文件监控 C: usgtares.dll>>Setup_L0001.exe>>Unpack 最后2个，瑞星实时监控天天可以发现，删除以后，。明天又来了 2006-05-19 14:47:05
阿杜QQ 初生襁褓狮帖子:876 注册: 2006-05-11 来自:	分享到：

阿杜QQ 初生襁褓狮帖子:876 注册: 2006-05-11 来自:	发表于： 2006-05-18 16:20 \| 只看楼主短消息资料字号：小中大 2楼为你们分析我提供 SRE 瑞星听诊器 HJ 扫描日志！真心希望帮帮我 2006-05-18,16:18:19 System Repair Engineer 2.0.12.350 (2.0 RC 1) Windows XP Home Edition - 管理权限用户 - 完整功能以下内容被选中：所有的启动项目（包括注册表、启动文件夹、服务等）浏览器加载项正在运行的进程（包括进程模块信息）文件关联启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <load><> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <IMJPMIG8.1><C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <nwiz><nwiz.exe /install> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <NvMediaCenter><RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <XFILTER><"C:\Program Files\Filseclab\xfilter\xfilter.exe" -a> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] <RavStub><"C:\Program Files\Rising\Rav\ravstub.exe" /RUNONCE> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <Userinit><C:\WINDOWS\system32\userinit.exe> ================================== 启动文件夹服务 [IMAPI CD-Burning COM Service / ImapiService] <C:\WINDOWS\System32\imapi.exe><Microsoft Corporation> [NVIDIA Display Driver Service / NVSvc] <C:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation> [Rising Proxy Service / RfwProxySrv] <c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.> [Rising Personal Firewall Service / RfwService] <c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.> [Rising Process Communication Center / RsCCenter] <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.> [RsRavMon Service / RsRavMon] <"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.> ==================================
阿杜QQ 初生襁褓狮帖子:876 注册: 2006-05-11 来自:

阿杜QQ 初生襁褓狮帖子:876 注册: 2006-05-11 来自:	发表于： 2006-05-18 16:20 \| 只看楼主短消息资料字号：小中大 3楼浏览器加载项 [QQBrowserHelperObject Class] {54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司> [Thunder Browser Helper] {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_001.dll, Thunder Networking Technologies,LTD> [] {A9930D97-9CF0-42A0-A10D-4F28836579D5} <C:\PROGRA~1\KuGoo3\KUGOO3~1.OCX, N/A> [新浪UC] {2253922F-1B26-4C74-8B57-E3AEE748DBB8} <C:\Program Files\sina\UC\uc.exe, 北京新浪信息技术有限公司> [QQ] {c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT> [WUWebControl Class] {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\System32\wuweb.dll, Microsoft Corporation> [Kuaiso Toolsbar] {6D53ADB7-6AD5-4A59-BFE4-7B57D2F4AA89} <C:\WINDOWS\Downloaded Program Files\Kuaiso.dll, IE Toolbar> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash8b.ocx, Macromedia, Inc.> [&使用迅雷下载] <C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A> [&使用迅雷下载全部链接] <C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A> [上传到QQ网络硬盘] <C:\Program Files\tencent\QQ\AddToNetDisk.htm, N/A> [使用KuGoo3下载(&K)] <C:\Program Files\KuGoo3\KuGoo3DownX.htm, N/A> [添加到QQ自定义面板] <C:\Program Files\tencent\QQ\AddPanel.htm, N/A> [添加到QQ表情] <C:\Program Files\tencent\QQ\AddEmotion.htm, N/A> [用QQ彩信发送该图片] <C:\Program Files\tencent\QQ\SendMMS.htm, N/A> ================================== 正在运行的进程 [PID: 416][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 472][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 496][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [C:\WINDOWS\system32\SSMWinlogonEx.dll] <System Safety Limited><2.0.6.569> [PID: 548][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 560][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 724][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 776][C:\Program Files\Rising\Rav\CCenter.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3> [PID: 792][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 892][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 940][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 956][C:\Program Files\Rising\Rav\Ravmond.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 19> [C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\Program Files\Rising\Rav\RsLog.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 18> [C:\Program Files\Rising\Rav\HOOKSYS.dll] <Rising><18, 1, 0, 9> [C:\Program Files\Rising\Rav\Scanner.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 28> [C:\Program Files\Rising\Rav\libload.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [C:\Program Files\Rising\Rav\VirusLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [C:\Program Files\Rising\Rav\regmon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6> [C:\Program Files\Rising\Rav\HookWeb.dll] <rising><18, 0, 0, 1> [C:\Program Files\Rising\Rav\MemMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 8> [C:\Program Files\Rising\Rav\expscan.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\Program Files\Rising\Rav\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3> [C:\Program Files\Rising\Rav\MailMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [C:\Program Files\Rising\Rav\SpamEng.dll] <N/A><18, 0, 0, 6> [C:\Program Files\Rising\Rav\engine.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 26> [C:\Program Files\Rising\Rav\PostTrt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9> [C:\Program Files\Rising\Rav\UnExe.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11> [C:\Program Files\Rising\Rav\ScanExec.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [C:\Program Files\Rising\Rav\ScanEx.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7> [C:\Program Files\Rising\Rav\NvFile.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7> [C:\Program Files\Rising\Rav\ScanMac.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7> [C:\Program Files\Rising\Rav\ScanSct.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13> [C:\Program Files\Rising\Rav\Unpacker.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3> [C:\Program Files\Rising\Rav\ExtFile.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 17> [C:\Program Files\Rising\Rav\RsStore.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [C:\Program Files\Rising\Rav\ScanElf.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3> [C:\Program Files\Rising\Rav\ExtOLE.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [C:\Program Files\Rising\Rav\ScanNet.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [PID: 1152][c:\program files\rising\rfw\rfwsrv.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 32> [c:\program files\rising\rfw\RfwRule.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 13> [c:\program files\rising\rfw\rfwlog.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 6> [c:\program files\rising\rfw\Rfwdrv.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 21> [c:\program files\rising\rfw\MonDrv.dll] <rs><1, 0, 0, 4> [c:\program files\rising\rfw\ProcLib.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 9> [c:\program files\rising\rfw\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3> [PID: 1168][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2600.0000 (xpclient.010817-1148)> [C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13> [C:\Program Files\Internet Explorer\mscomapi.dll] <N/A><N/A> [C:\WINDOWS\System32\nvcpl.dll] <NVIDIA Corporation><6.14.10.8421> [C:\WINDOWS\System32\NVRSZHC.DLL] <NVIDIA Corporation><6.14.10.8421> [C:\WINDOWS\System32\nvshell.dll] <N/A><N/A>
阿杜QQ 初生襁褓狮帖子:876 注册: 2006-05-11 来自:

阿杜QQ 初生襁褓狮帖子:876 注册: 2006-05-11 来自:	发表于： 2006-05-18 16:20 \| 只看楼主短消息资料字号：小中大 4楼 [C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_001.dll] <Thunder Networking Technologies,LTD><5, 0, 0, 1> [C:\Program Files\sina\UC\UCIdleHook.dll] <北京新浪信息技术有限公司><1, 0, 1, 0> [C:\Program Files\WinRAR\rarext.dll] <N/A><N/A> [C:\WINDOWS\System32\UNISPIM.IME] <北京清华紫光软件股份有限公司><3.0.0.3045> [C:\WINDOWS\System32\upengine.dll] <北京清华紫光软件股份有限公司><3.0.0.3045> [C:\PROGRA~1\KuGoo3\KUGOO3~1.OCX] <N/A><N/A> [PID: 1364][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.0 (XPClient.010817-1148)> [PID: 1440][C:\Program Files\Rising\Rav\RavStub.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [PID: 1524][c:\program files\rising\rfw\RfwMain.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 51> [c:\program files\rising\rfw\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23> [c:\program files\rising\rfw\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [c:\program files\rising\rfw\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [C:\Program Files\sina\UC\UCIdleHook.dll] <北京新浪信息技术有限公司><1, 0, 1, 0> [PID: 1636][C:\Program Files\Rising\Rav\RavTask.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22> [C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [PID: 1656][C:\Program Files\Rising\Rav\Ravmon.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 17> [C:\Program Files\Rising\Rav\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 24> [C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16> [C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2> [C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10> [C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [C:\Program Files\Rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5> [C:\Program Files\sina\UC\UCIdleHook.dll] <北京新浪信息技术有限公司><1, 0, 1, 0> [PID: 1760][C:\WINDOWS\System32\ctfmon.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 1800][C:\Program Files\sina\UC\uc.exe] <北京新浪信息技术有限公司><4.6.0.900> [C:\Program Files\sina\UC\vcl60.bpl] <Borland Software Corporation><6.0.6.240> [C:\Program Files\sina\UC\rtl60.bpl] <Borland Software Corporation><6.0.6.243> [C:\Program Files\sina\UC\ucavatar.bpl] <Beijing Sina Information Technology Co.,Ltd><1.1.0.0> [C:\Program Files\sina\UC\BORLNDMM.DLL] <Borland Software Corporation><6.0.10.157> [C:\Program Files\sina\UC\CC3260MT.DLL] <Borland Corporation><0.0.0.0 (informal build)> [C:\Program Files\sina\UC\vclx60.bpl] <Borland Software Corporation><6.0.6.163> [C:\Program Files\sina\UC\ucchatroom.bpl] <北京新浪信息技术有限公司><1.2.1.0> [C:\Program Files\sina\UC\vclie60.bpl] <Borland Software Corporation><6.0.6.163> [C:\Program Files\sina\UC\LANGUAGERES.DLL] <北京新浪信息技术有限公司><1.1.0.0> [C:\Program Files\sina\UC\ucui.bpl] <北京新浪信息技术有限公司><1.1.1.0> [C:\Program Files\sina\UC\STLPMT45.DLL] <N/A><N/A> [C:\Program Files\sina\UC\bcbie60.bpl] <N/A><N/A> [C:\Program Files\sina\UC\uchm.bpl] <Beijing Sina Information Technology Co.,Ltd><1.2.0.0> [C:\Program Files\sina\UC\ucdcontrol.bpl] <北京新浪信息技术有限公司><1.1.0.0> [C:\Program Files\sina\UC\ucskin.bpl] <北京新浪信息技术有限公司><1.1.0.0> [C:\Program Files\sina\UC\ucres.dll] <北京新浪信息技术有限公司><1.3.0.0> [C:\Program Files\sina\UC\ucmessager.dll] <北京新浪信息技术有限公司><1.1.0.0> [C:\Program Files\sina\UC\ucdatamanager.dll] <Beijing Sina Information Technology Co.,Ltd><1.1.0.0> [C:\Program Files\sina\UC\uchall.dll] <北京新浪信息技术有限公司><3.2.1.23> [C:\Program Files\sina\UC\UCHallControl.bpl] <><1.1.1.0> [C:\Program Files\sina\UC\UCIdleHook.dll] <北京新浪信息技术有限公司><1, 0, 1, 0> [C:\Program Files\sina\UC\UCHttpDl.dll] <北京新浪信息技术有限公司><1, 1, 9, 0> [C:\Program Files\sina\UC\HelpEx.dll] <北京新浪信息技术有限公司><1.0.0.0> [C:\Program Files\sina\UC\UCEmtMgr.dll] <北京新浪信息技术有限公司><1.0.1.3> [C:\Program Files\sina\UC\UCBugCatch.dll] <北京新浪信息技术有限公司><1, 2, 8, 0> [C:\Program Files\sina\UC\UCSocket.DLL] <北京新浪信息技术有限公司><1, 1, 21, 0> [C:\Program Files\sina\UC\ActiveX\AvatarDisplay.dll] <N/A><N/A> [C:\WINDOWS\System32\msdmo.dll] <N/A><N/A> [PID: 1812][C:\Program Files\tencent\QQ\QQ.exe] <TENCENT><14, 45, 0, 110> [C:\Program Files\tencent\QQ\QQBaseClassInDll.dll] <><1, 0, 0, 1> [C:\Program Files\tencent\QQ\QQHelperDll.dll] <><1, 0, 0, 1> [C:\Program Files\tencent\QQ\BasicCtrlDll.dll] <Tencent><0, 3, 3, 6> [C:\Program Files\tencent\QQ\QQAPI.dll] <><1, 0, 0, 1> [C:\Program Files\Tencent\QQ\TIMProxy.dll] <tencent><0, 3, 2, 4> [C:\Program Files\tencent\QQ\LoginCtrl.dll] <><1, 0, 0, 1> [C:\Program Files\tencent\QQ\QQRes.dll] <tencent><1, 0, 0, 1> [C:\Program Files\tencent\QQ\QQMainFrame.dll] <N/A><N/A> [C:\Program Files\tencent\QQ\CQQApplication.dll] <N/A><N/A> [C:\Program Files\tencent\QQ\NewSkin.dll] <><1, 0, 0, 1> [C:\Program Files\tencent\QQ\HostingMgr.dll] <><1, 0, 0, 1> [C:\Program Files\tencent\QQ\MailSummary.dll] <><1, 0, 0, 1> [C:\Program Files\tencent\QQ\QQSpace.dll] <><1, 0, 0, 1> [C:\WINDOWS\System32\msdmo.dll] <N/A><N/A> [C:\Program Files\tencent\QQ\QQConfigPlugin.dll] <><1, 0, 0, 1> [C:\Program Files\tencent\QQ\QQSysMsgMng.dll] <N/A><N/A> [C:\Program Files\tencent\QQ\QRingMng.dll] <N/A><N/A> [C:\Program Files\tencent\QQ\PhoneAPI.dll] <><1, 0, 0, 1> [C:\Program Files\tencent\QQ\DialerAllinOne.dll] <tencent><1, 4, 0, 0> [C:\Program Files\tencent\QQ\UserDefinedHead.dll] <><1, 0, 0, 1> [C:\Program Files\sina\UC\UCIdleHook.dll] <北京新浪信息技术有限公司><1, 0, 1, 0> [C:\Program Files\tencent\QQ\QQAvatar.dll] <N/A><N/A> [C:\Program Files\tencent\QQ\FlashAvatarDll.dll] <><1, 4, 0, 1> [C:\Program Files\tencent\QQ\LongConnection.dll] <tencent><0, 3, 3, 8> [C:\Program Files\tencent\QQ\QQPet.dll] <><1, 0, 0, 1> [C:\Program Files\tencent\QQ\BQQApplication.dll] <N/A><N/A> [C:\Program Files\tencent\QQ\QQPlugin.dll] <N/A><N/A> [C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13> [C:\Program Files\Internet Explorer\mscomapi.dll] <N/A><N/A> [C:\Program Files\tencent\QQ\CommercesMng.dll] <><1, 0, 0, 1> [C:\Program Files\tencent\QQ\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2> [C:\Program Files\tencent\QQ\QQAddr.dll] <深圳市腾讯计算机系统有限公司><4, 0, 200, 32> [C:\Program Files\tencent\QQ\npkcntc.dll] <INCA Internet Co., Ltd.><2005, 9, 1, 1> [C:\Program Files\tencent\QQ\npkpdb.dll] <INCA Internet Co., Ltd.><2003, 10, 1, 1> [C:\Program Files\tencent\QQ\QQPhoneHelper.dll] <腾讯科技（深圳）有限公司><2, 0, 2, 21> [C:\Program Files\tencent\QQ\QQSceneMng.dll] <N/A><N/A> [PID: 2028][C:\Program Files\Tencent\QQ\TIMPlatform.exe] <tencent><0, 3, 1, 8> [C:\Program Files\Tencent\QQ\TIMProxy.dll] <tencent><0, 3, 2, 4> [PID: 1400][C:\WINDOWS\System32\nvsvc32.exe] <NVIDIA Corporation><6.14.10.8421> [PID: 2000][C:\Program Files\Internet Explorer\IEXPLORE.EXE] <Microsoft Corporation><6.00.2600.0000 (xpclient.010817-1148)> [C:\Program Files\Tencent\QQ\QQIEHelper.dll] <深圳市腾讯计算机系统有限公司><1, 1, 0, 5> [C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_001.dll] <Thunder Networking Technologies,LTD><5, 0, 0, 1> [C:\PROGRA~1\KuGoo3\KUGOO3~1.OCX] <N/A><N/A> [C:\Program Files\sina\UC\UCIdleHook.dll] <北京新浪信息技术有限公司><1, 0, 1, 0> [C:\Program Files\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3> [C:\WINDOWS\System32\Macromed\Flash\Flash8b.ocx] <Macromedia, Inc.><8,0,24,0> [C:\WINDOWS\System32\UNISPIM.IME] <北京清华紫光软件股份有限公司><3.0.0.3045> [C:\WINDOWS\System32\upengine.dll] <北京清华紫光软件股份有限公司><3.0.0.3045> [PID: 424][C:\Program Files\Rising\Rav\RsAgent.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12> [C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1> [PID: 2892][C:\WINDOWS\msagent\AgentSvr.exe] <Microsoft Corporation><2.00.0.3422> [PID: 220][C:\Program Files\Tencent\TT\TTraveler.exe] <腾讯公司><3.0.0.250> [C:\Program Files\Tencent\TT\Plugins\QQFloatBar\QQFloatBar4TT2.dll] <腾讯公司><1, 1, 0, 5> [C:\Program Files\sina\UC\UCIdleHook.dll] <北京新浪信息技术有限公司><1, 0, 1, 0> [C:\Program Files\Tencent\TT\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 4> [PID: 3252][C:\下载\SREng.exe] <Smallfrogs Studio><2.0.12.350> [C:\Program Files\sina\UC\UCIdleHook.dll] <北京新浪信息技术有限公司><1, 0, 1, 0> [PID: 2380][C:\下载\SREng.exe] <Smallfrogs Studio><2.0.12.350> [C:\Program Files\sina\UC\UCIdleHook.dll] <北京新浪信息技术有限公司><1, 0, 1, 0> ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\system32\winhlp32.exe %1] .INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者
阿杜QQ 初生襁褓狮帖子:876 注册: 2006-05-11 来自:

阿杜QQ 初生襁褓狮帖子:876 注册: 2006-05-11 来自:	发表于： 2006-05-18 16:21 \| 只看楼主短消息资料字号：小中大 5楼 HijackThis_zww汉化版扫描日志 V1.99.1 保存于 16:19:32, 日期 2006-5-18 操作系统： Windows XP (WinNT 5.01.2600) 浏览器： Internet Explorer v6.00 (6.00.2600.0000) 当前运行的进程： C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Rising\Rav\CCenter.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Rising\Rav\Ravmond.exe c:\program files\rising\rfw\rfwsrv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Rising\Rav\RavStub.exe c:\program files\rising\rfw\RfwMain.exe C:\Program Files\Rising\Rav\RavTask.exe C:\Program Files\Rising\Rav\Ravmon.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\sina\UC\uc.exe C:\Program Files\tencent\QQ\QQ.exe C:\Program Files\Tencent\QQ\TIMPlatform.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Rising\Rav\RsAgent.exe C:\WINDOWS\msagent\AgentSvr.exe C:\Program Files\Tencent\TT\TTraveler.exe C:\下载\HijackThis1991zww.exe C:\WINDOWS\system32\NOTEPAD.EXE F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\Program Files\Tencent\QQ\QQIEHelper.dll O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_001.dll O2 - BHO: (no name) - {A9930D97-9CF0-42A0-A10D-4F28836579D5} - C:\PROGRA~1\KuGoo3\KUGOO3~1.OCX O4 - 启动项HKLM\\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32 O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - 启动项HKLM\\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - 启动项HKLM\\Run: [nwiz] nwiz.exe /install O4 - 启动项HKLM\\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - 启动项HKLM\\Run: [XFILTER] "C:\Program Files\Filseclab\xfilter\xfilter.exe" -a O4 - 启动项HKLM\\RunOnce: [RavStub] "C:\Program Files\Rising\Rav\ravstub.exe" /RUNONCE O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O8 - IE右键菜单中的新增项目: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - C:\Program Files\tencent\QQ\AddToNetDisk.htm O8 - IE右键菜单中的新增项目: 使用KuGoo3下载(&K) - C:\Program Files\KuGoo3\KuGoo3DownX.htm O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - C:\Program Files\tencent\QQ\AddPanel.htm O8 - IE右键菜单中的新增项目: 添加到QQ表情 - C:\Program Files\tencent\QQ\AddEmotion.htm O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - C:\Program Files\tencent\QQ\SendMMS.htm O9 - 浏览器额外的按钮: 新浪UC - {2253922F-1B26-4C74-8B57-E3AEE748DBB8} - C:\Program Files\sina\UC\uc.exe O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1147756111620 O16 - DPF: {6D53ADB7-6AD5-4A59-BFE4-7B57D2F4AA89} (Kuaiso Toolsbar) - http://toolsbar.kuaiso.com/Kuaiso.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{9790D745-CC1B-4028-969E-FDB5AD1C3D98}: NameServer = 202.99.96.68 202.99.64.69 O20 - Winlogon Notify: System Safety Monitor - C:\WINDOWS\SYSTEM32\SSMWinlogonEx.dll O23 - NT 服务: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - NT 服务: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
阿杜QQ 初生襁褓狮帖子:876 注册: 2006-05-11 来自:

阿杜QQ 初生襁褓狮帖子:876 注册: 2006-05-11 来自:	发表于： 2006-05-18 16:21 \| 只看楼主短消息资料字号：小中大 6楼未知家族病毒分析扫描结果: 无可疑文件系统活动进程 C:\WINDOWS\SYSTEM32\SMSS.EXE C:\WINDOWS\SYSTEM32\CSRSS.EXE C:\WINDOWS\SYSTEM32\WINLOGON.EXE C:\WINDOWS\SYSTEM32\SSMWINLOGONEX.DLL C:\WINDOWS\SYSTEM32\WDMAUD.DRV C:\WINDOWS\SYSTEM32\MSACM32.DRV C:\WINDOWS\SYSTEM32\SERVICES.EXE C:\WINDOWS\SYSTEM32\LSASS.EXE C:\WINDOWS\SYSTEM32\SVCHOST.EXE C:\WINDOWS\SYSTEM32\SVCHOST.EXE C:\WINDOWS\SYSTEM32\WINHTTP.DLL C:\WINDOWS\SYSTEM32\SVCHOST.EXE C:\WINDOWS\SYSTEM32\SVCHOST.EXE C:\PROGRAM FILES\RISING\RFW\RFWSRV.EXE C:\PROGRAM FILES\RISING\RFW\RFWRULE.DLL C:\PROGRAM FILES\RISING\RFW\RFWLOG.DLL C:\PROGRAM FILES\RISING\RFW\RFWDRV.DLL C:\PROGRAM FILES\RISING\RFW\PSAPI.DLL C:\PROGRAM FILES\RISING\RFW\MONDRV.DLL C:\PROGRAM FILES\RISING\RFW\PROCLIB.DLL C:\PROGRAM FILES\RISING\RFW\MPORTS.DLL C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\SYSTEM32\RAVEXT.DLL C:\PROGRAM FILES\INTERNET EXPLORER\MSCOMAPI.DLL C:\WINDOWS\SYSTEM32\NVCPL.DLL C:\WINDOWS\SYSTEM32\NVRSZHC.DLL C:\WINDOWS\SYSTEM32\NVSHELL.DLL C:\PROGRAM FILES\THUNDER NETWORK\THUNDER\COMDLLS\XUNLEIBHO_001.DLL C:\PROGRAM FILES\SINA\UC\UCIDLEHOOK.DLL C:\PROGRAM FILES\WINRAR\RAREXT.DLL C:\WINDOWS\SYSTEM32\UNISPIM.IME C:\WINDOWS\SYSTEM32\UPENGINE.DLL C:\WINDOWS\SYSTEM32\WDMAUD.DRV C:\WINDOWS\SYSTEM32\MSACM32.DRV C:\WINDOWS\SYSTEM32\SPOOLSV.EXE C:\WINDOWS\SYSTEM32\NVSVC32.EXE C:\PROGRAM FILES\RISING\RFW\RFWMAIN.EXE C:\PROGRAM FILES\RISING\RFW\RSGUILIB.DLL C:\PROGRAM FILES\RISING\RFW\RSCOMMON.DLL C:\PROGRAM FILES\RISING\RFW\PNGDLL.DLL C:\PROGRAM FILES\SINA\UC\UCIDLEHOOK.DLL
阿杜QQ 初生襁褓狮帖子:876 注册: 2006-05-11 来自:

阿杜QQ 初生襁褓狮帖子:876 注册: 2006-05-11 来自:	发表于： 2006-05-18 16:22 \| 只看楼主短消息资料字号：小中大 7楼 C:\WINDOWS\SYSTEM32\SPOOLSV.EXE C:\WINDOWS\SYSTEM32\NVSVC32.EXE C:\PROGRAM FILES\RISING\RFW\RFWMAIN.EXE C:\PROGRAM FILES\RISING\RFW\RSGUILIB.DLL C:\PROGRAM FILES\RISING\RFW\RSCOMMON.DLL C:\PROGRAM FILES\RISING\RFW\PNGDLL.DLL C:\PROGRAM FILES\SINA\UC\UCIDLEHOOK.DLL C:\WINDOWS\SYSTEM32\CTFMON.EXE C:\PROGRAM FILES\SINA\UC\UC.EXE C:\PROGRAM FILES\SINA\UC\VCL60.BPL C:\PROGRAM FILES\SINA\UC\RTL60.BPL C:\PROGRAM FILES\SINA\UC\UCAVATAR.BPL C:\PROGRAM FILES\SINA\UC\BORLNDMM.DLL C:\PROGRAM FILES\SINA\UC\CC3260MT.DLL C:\PROGRAM FILES\SINA\UC\VCLX60.BPL C:\PROGRAM FILES\SINA\UC\UCCHATROOM.BPL C:\PROGRAM FILES\SINA\UC\VCLIE60.BPL C:\PROGRAM FILES\SINA\UC\LANGUAGERES.DLL C:\PROGRAM FILES\SINA\UC\UCUI.BPL C:\PROGRAM FILES\SINA\UC\STLPMT45.DLL C:\PROGRAM FILES\SINA\UC\BCBIE60.BPL C:\PROGRAM FILES\SINA\UC\UCHM.BPL C:\PROGRAM FILES\SINA\UC\UCDCONTROL.BPL C:\PROGRAM FILES\SINA\UC\UCSKIN.BPL C:\PROGRAM FILES\SINA\UC\UCRES.DLL C:\PROGRAM FILES\SINA\UC\UCMESSAGER.DLL C:\PROGRAM FILES\SINA\UC\UCDATAMANAGER.DLL C:\PROGRAM FILES\SINA\UC\UCHALL.DLL C:\PROGRAM FILES\SINA\UC\UCHALLCONTROL.BPL C:\PROGRAM FILES\SINA\UC\RICHED20.DLL C:\PROGRAM FILES\SINA\UC\RICHED32.DLL C:\PROGRAM FILES\SINA\UC\UCIDLEHOOK.DLL C:\PROGRAM FILES\SINA\UC\UCHTTPDL.DLL C:\PROGRAM FILES\SINA\UC\HELPEX.DLL C:\PROGRAM FILES\SINA\UC\UCEMTMGR.DLL C:\PROGRAM FILES\SINA\UC\UCBUGCATCH.DLL C:\PROGRAM FILES\SINA\UC\UCSOCKET.DLL C:\PROGRAM FILES\SINA\UC\ACTIVEX\AVATARDISPLAY.DLL C:\PROGRAM FILES\TENCENT\QQ\QQ.EXE C:\PROGRAM FILES\TENCENT\QQ\QQBASECLASSINDLL.DLL C:\PROGRAM FILES\TENCENT\QQ\QQHELPERDLL.DLL C:\PROGRAM FILES\TENCENT\QQ\BASICCTRLDLL.DLL C:\PROGRAM FILES\TENCENT\QQ\MFC42.DLL C:\PROGRAM FILES\TENCENT\QQ\RICHED32.DLL C:\PROGRAM FILES\TENCENT\QQ\RICHED20.DLL C:\PROGRAM FILES\TENCENT\QQ\QQAPI.DLL C:\PROGRAM FILES\TENCENT\QQ\TIMPROXY.DLL C:\PROGRAM FILES\TENCENT\QQ\LOGINCTRL.DLL C:\PROGRAM FILES\TENCENT\QQ\QQRES.DLL C:\PROGRAM FILES\TENCENT\QQ\QQMAINFRAME.DLL C:\PROGRAM FILES\TENCENT\QQ\CQQAPPLICATION.DLL C:\PROGRAM FILES\TENCENT\QQ\NEWSKIN.DLL C:\PROGRAM FILES\TENCENT\QQ\HOSTINGMGR.DLL C:\PROGRAM FILES\TENCENT\QQ\MAILSUMMARY.DLL C:\PROGRAM FILES\TENCENT\QQ\QQSPACE.DLL C:\PROGRAM FILES\TENCENT\QQ\VBSCRIPT.DLL C:\PROGRAM FILES\TENCENT\QQ\QQCONFIGPLUGIN.DLL C:\PROGRAM FILES\TENCENT\QQ\QQSYSMSGMNG.DLL C:\PROGRAM FILES\TENCENT\QQ\QRINGMNG.DLL C:\PROGRAM FILES\TENCENT\QQ\PHONEAPI.DLL C:\PROGRAM FILES\TENCENT\QQ\DIALERALLINONE.DLL C:\PROGRAM FILES\TENCENT\QQ\USERDEFINEDHEAD.DLL C:\PROGRAM FILES\SINA\UC\UCIDLEHOOK.DLL C:\PROGRAM FILES\TENCENT\QQ\QQAVATAR.DLL C:\PROGRAM FILES\TENCENT\QQ\FLASHAVATARDLL.DLL C:\PROGRAM FILES\TENCENT\QQ\LONGCONNECTION.DLL C:\PROGRAM FILES\TENCENT\QQ\QQPET.DLL C:\PROGRAM FILES\TENCENT\QQ\BQQAPPLICATION.DLL C:\PROGRAM FILES\TENCENT\QQ\QQPLUGIN.DLL C:\WINDOWS\SYSTEM32\RAVEXT.DLL C:\PROGRAM FILES\INTERNET EXPLORER\MSCOMAPI.DLL C:\PROGRAM FILES\TENCENT\QQ\COMMERCESMNG.DLL C:\PROGRAM FILES\TENCENT\QQ\PERSONALDESKTOP.DLL C:\PROGRAM FILES\TENCENT\QQ\QQADDR.DLL C:\PROGRAM FILES\TENCENT\QQ\NPKCNTC.DLL C:\PROGRAM FILES\TENCENT\QQ\NPKPDB.DLL C:\PROGRAM FILES\TENCENT\QQ\QQPHONEHELPER.DLL C:\PROGRAM FILES\TENCENT\QQ\QQSCENEMNG.DLL C:\WINDOWS\SYSTEM32\WDMAUD.DRV C:\WINDOWS\SYSTEM32\MSACM32.DRV C:\PROGRAM FILES\TENCENT\QQ\TIMPLATFORM.EXE C:\PROGRAM FILES\TENCENT\QQ\TIMPROXY.DLL C:\下载\RSDETECT.EXE C:\PROGRAM FILES\SINA\UC\UCIDLEHOOK.DLL C:\PROGRAM FILES\瑞星专家服务系统-标准版\RISINGMAIN.EXE C:\PROGRAM FILES\瑞星专家服务系统-标准版\GEMUI.DLL C:\WINDOWS\SYSTEM32\MFC70.DLL C:\WINDOWS\SYSTEM32\MSVCR70.DLL C:\PROGRAM FILES\瑞星专家服务系统-标准版\GEMCONTROLS.DLL C:\PROGRAM FILES\SINA\UC\UCIDLEHOOK.DLL C:\PROGRAM FILES\瑞星专家服务系统-标准版\KDTOA.DLL C:\WINDOWS\SYSTEM32\WDMAUD.DRV C:\WINDOWS\SYSTEM32\MSACM32.DRV C:\WINDOWS\SYSTEM32\UNISPIM.IME C:\WINDOWS\SYSTEM32\UPENGINE.DLL
阿杜QQ 初生襁褓狮帖子:876 注册: 2006-05-11 来自:

阿杜QQ 初生襁褓狮帖子:876 注册: 2006-05-11 来自:	发表于： 2006-05-18 16:24 \| 只看楼主短消息资料字号：小中大 8楼普通自启动项 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run IMJPMIG8.1 = C:\WINDOWS\IME\IMJP8_1\IMJPMIG.EXE /SPOIL /REMADVDEF /MIGRATION32 PHIME2002ASync = C:\WINDOWS\SYSTEM32\IME\TINTLGNT\TINTSETP.EXE /SYNC PHIME2002A = C:\WINDOWS\SYSTEM32\IME\TINTLGNT\TINTSETP.EXE /IMENAME RavTask = "C:\PROGRAM FILES\RISING\RAV\RAVTASK.EXE" -SYSTEM NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\SYSTEM32\NVCPL.DLL,NVSTARTUP nwiz = NWIZ.EXE /INSTALL NvMediaCenter = RUNDLL32.EXE C:\WINDOWS\SYSTEM32\NVMCTRAY.DLL,NVTASKBARINIT XFILTER = "C:\PROGRAM FILES\FILSECLAB\XFILTER\XFILTER.EXE" -A HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce RavStub = "C:\PROGRAM FILES\RISING\RAV\RAVSTUB.EXE" /RUNONCE HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ctfmon.exe = C:\WINDOWS\SYSTEM32\CTFMON.EXE 系统文件关联 .exe ==> exefile = "%1" %* .com ==> comfile = "%1" %* .cmd ==> cmdfile = "%1" %* .bat ==> batfile = "%1" %* .txt ==> txtfile = %SystemRoot%\system32\NOTEPAD.EXE %1 .scr ==> scrfile = "%1" /S .reg ==> regfile = regedit.exe "%1" 其它启动项 WIN.INI 无信息 SYSTEM.INI SHELL = Explorer.exe Winlogon 启动项 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify crypt32chain = CRYPT32.DLL cryptnet = CRYPTNET.DLL cscdll = CSCDLL.DLL ScCertProp = WLNOTIFY.DLL Schedule = WLNOTIFY.DLL sclgntfy = SCLGNTFY.DLL SensLogn = WLNOTIFY.DLL System Safety Monitor = SSMWINLOGONEX.DLL termsrv = WLNOTIFY.DLL wlballoon = WLNOTIFY.DLL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit = C:\WINDOWS\SYSTEM32\USERINIT.EXE shell = EXPLORER.EXE
阿杜QQ 初生襁褓狮帖子:876 注册: 2006-05-11 来自:

阿杜QQ 初生襁褓狮帖子:876 注册: 2006-05-11 来自:	发表于： 2006-05-18 16:26 \| 只看楼主短消息资料字号：小中大 9楼 IE - BHO HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects {54EBD53A-9BC1-480B-966A-843A333CA162} = C:\Program Files\Tencent\QQ\QQIEHelper.dll {889D2FEB-5411-4565-8998-1DD2C5261283} = C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_001.dll {A9930D97-9CF0-42A0-A10D-4F28836579D5} = C:\PROGRA~1\KuGoo3\KUGOO3~1.OCX Winsock SPI MSAFD Tcpip [TCP/IP] = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD Tcpip [UDP/IP] = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD Tcpip [RAW/IP] = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL RSVP UDP Service Provider = C:\WINDOWS\SYSTEM32\RSVPSP.DLL RSVP TCP Service Provider = C:\WINDOWS\SYSTEM32\RSVPSP.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{53FD63B5-C2A7-4866-A3C5-7FE27C54E1BF}] SEQPACKET 0 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{53FD63B5-C2A7-4866-A3C5-7FE27C54E1BF}] DATAGRAM 0 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{024E057F-42B8-4972-B665-0ECEC887500A}] SEQPACKET 1 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{024E057F-42B8-4972-B665-0ECEC887500A}] DATAGRAM 1 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{5ADEA6AE-7FC0-4B11-A729-F91E95902631}] SEQPACKET 2 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{5ADEA6AE-7FC0-4B11-A729-F91E95902631}] DATAGRAM 2 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{BEB55C58-7801-43AF-BC50-359316C61E46}] SEQPACKET 3 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{BEB55C58-7801-43AF-BC50-359316C61E46}] DATAGRAM 3 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{9790D745-CC1B-4028-969E-FDB5AD1C3D98}] SEQPACKET 4 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{9790D745-CC1B-4028-969E-FDB5AD1C3D98}] DATAGRAM 4 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL
阿杜QQ 初生襁褓狮帖子:876 注册: 2006-05-11 来自:

阿杜QQ 初生襁褓狮帖子:876 注册: 2006-05-11 来自:	发表于： 2006-05-18 16:27 \| 只看楼主短消息资料字号：小中大 10楼系统服务项 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services Alerter = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE ALG = C:\WINDOWS\SYSTEM32\ALG.EXE AppMgmt = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS AudioSrv = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS BITS = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS Browser = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS cisvc = C:\WINDOWS\SYSTEM32\CISVC.EXE ClipSrv = C:\WINDOWS\SYSTEM32\CLIPSRV.EXE COMSysApp = C:\WINDOWS\SYSTEM32\DLLHOST.EXE /PROCESSID:{02D4B3F1-FD88-11D1-960D-00805FC79235} CryptSvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS Dhcp = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS dmadmin = C:\WINDOWS\SYSTEM32\DMADMIN.EXE /COM dmserver = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS Dnscache = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETWORKSERVICE ERSvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS Eventlog = C:\WINDOWS\SYSTEM32\SERVICES.EXE EventSystem = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS FastUserSwitchingCompatibility = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS helpsvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS HidServ = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS ImapiService = C:\WINDOWS\SYSTEM32\IMAPI.EXE lanmanserver = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS lanmanworkstation = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS LmHosts = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE Messenger = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS mnmsrvc = C:\WINDOWS\SYSTEM32\MNMSRVC.EXE MSDTC = C:\WINDOWS\SYSTEM32\MSDTC.EXE MSIServer = C:\WINDOWS\SYSTEM32\MSIEXEC.EXE /V NetDDE = C:\WINDOWS\SYSTEM32\NETDDE.EXE NetDDEdsdm = C:\WINDOWS\SYSTEM32\NETDDE.EXE Netlogon = C:\WINDOWS\SYSTEM32\LSASS.EXE Netman = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS Nla = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS NtLmSsp = C:\WINDOWS\SYSTEM32\LSASS.EXE NtmsSvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS NVSvc = C:\WINDOWS\SYSTEM32\NVSVC32.EXE PlugPlay = C:\WINDOWS\SYSTEM32\SERVICES.EXE PolicyAgent = C:\WINDOWS\SYSTEM32\LSASS.EXE ProtectedStorage = C:\WINDOWS\SYSTEM32\LSASS.EXE RasAuto = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS RasMan = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS RDSessMgr = C:\WINDOWS\SYSTEM32\SESSMGR.EXE RemoteAccess = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS RfwProxySrv = C:\PROGRAM FILES\RISING\RFW\RFWPROXY.EXE RfwService = C:\PROGRAM FILES\RISING\RFW\RFWSRV.EXE RpcLocator = C:\WINDOWS\SYSTEM32\LOCATOR.EXE RpcSs = C:\WINDOWS\SYSTEM32\SVCHOST -K RPCSS RsCCenter = "C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE" RsRavMon = "C:\PROGRAM FILES\RISING\RAV\RAVMOND.EXE" RSVP = C:\WINDOWS\SYSTEM32\RSVP.EXE SamSs = C:\WINDOWS\SYSTEM32\LSASS.EXE SCardDrv = C:\WINDOWS\SYSTEM32\SCARDSVR.EXE SCardSvr = C:\WINDOWS\SYSTEM32\SCARDSVR.EXE Schedule = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS seclogon = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS SENS = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS SharedAccess = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS ShellHWDetection = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS Spooler = C:\WINDOWS\SYSTEM32\SPOOLSV.EXE srservice = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS SSDPSRV = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE stisvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K IMGSVC SwPrv = C:\WINDOWS\SYSTEM32\DLLHOST.EXE /PROCESSID:{A372343F-B93B-4A5F-85DF-CDDBE81DD055} SysmonLog = C:\WINDOWS\SYSTEM32\SMLOGSVC.EXE TapiSrv = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS TermService = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS Themes = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS TrkWks = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS uploadmgr = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS upnphost = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE UPS = C:\WINDOWS\SYSTEM32\UPS.EXE VSS = C:\WINDOWS\SYSTEM32\VSSVC.EXE W32Time = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS WebClient = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE winmgmt = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS WmdmPmSp = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS WmiApSrv = C:\WINDOWS\SYSTEM32\WBEM\WMIAPSRV.EXE wuauserv = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS WZCSVC = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
阿杜QQ 初生襁褓狮帖子:876 注册: 2006-05-11 来自:

<<上一主题|下一主题>>

12

1 / 2 页

跳转页

页面顶部

Powered by Discuz!NT