瑞星杀毒软件、奇虎360杀毒软件、360卫士、百度卫士联手，搞不定弹出广告 & 恶意广告图标...

最新推荐文章于 2021-01-19 23:29:44 发布
最新推荐文章于 2021-01-19 23:29:44 发布
阅读量576 收藏
点赞数
文章标签： 操作系统 网络 shell

　　一位网友说他的电脑近期出了问题：开机后桌面和任务栏上的高速启动栏会出现恶意图标。删除了下次开机又会出现；使用电脑过程中每分钟都会弹出广告。他为电脑安装了瑞星杀毒软件、奇虎360杀毒软件、360卫士、百度卫士。以及广告神盾，都不能解决这个问题。如今电脑开机时须要几分钟才干进入桌面。请求帮忙。


　　这些恶意广告图标pe_xscan扫描log中的相关项目：

 

hao123_网址导航_Internet.lnk -> http://www.hao123.com/?tn=90618383_hao_pg
Inteent Exploror.lnk -> http://www.hao123.com/?tn=98868055_hao_pg
Intronnt HaoDao.lnk -> http://www.hao123.com/?tn=98868055_hao_pg
lentent Epxlroer.lnk -> http://www.3600.com/?src=lm&ls=n525187378f
今日黄历.lnk -> C:\Documents and Settings\Administrator\Application Data\nlcal\nlcal.exe
折子购物.lnk -> C:\Program Files\zhezi\app\zhezi\zhezi.exe
极速抢票入口.lnk -> http://www.hao123.com/?tn=93947501_hao_pg
爱淘宝.lnk -> http://t.cn/Rv8Fg27

 

　在QQ上远程协助，依次用奇虎360杀毒软件、360卫士、瑞星杀毒软件、百度卫士进行扫描查杀，确认桌面和任务栏上的高速启动栏会出现恶意广告图标都删除了。

 

然后重新启动电脑一看，这些图标又出来了。

　　用pe_xscan扫描log并分析：

pe_xscan 11-03-17 by Purple Endurer
2014-7-10 9:27:11
Windows XP Service Pack 3(5.1.2600)
MSIE:8.0.6001.18702
管理员用户组
正常模式
[System Process] * 0 |$X
    C:\Program Files\Rising\RAV\rsmgr.dll |$Beijing Rising Information Technology Corporation Limited | 2014-4-17 20:7:23
    C:\Program Files\Rising\RAV\wbprotect.dll |$Beijing Rising Information Technology Corporation Limited | 2014-2-27 17:52:42
    C:\Program Files\广告神盾\0707150103\adhkdll.dll |$Guangzhou Feiwu Network Science and Technology Co., Ltd. | 2014-5-22 20:31:42
C:\Program Files\baidu\BaiduAn\2.1.0.1214\BaiduAnSvc.exe * 1200 |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:16
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\BDLogicUtils.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:17
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\BDMSkin.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:17
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\bdmantivirus\BDMAVEng.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:16
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\BDMReport.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:17
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\bdmantivirus\bduf.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:16
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\BDMNet.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:17
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\plugins\RTPPlugins\BDMSOAccServicePlugin.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:15
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\FTSOManager\BDMProcessRunningTime.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:15
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\plugins\RTPPlugins\HIPS.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-7-2 8:3:11
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\DriverManager.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:17
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\ad.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-7-2 8:3:9
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\bdmantivirus\BDKitUtils.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:16
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\bdmantivirus\TrustAndIso.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:16
    C:\Documents and Settings\All Users\Application Data\zhezi\bin2\h\ximvdemx.dll |$北京精益求德科技有限公司 | 2014-7-10 8:5:18
C:\WINDOWS\system32\svchost.exe * 1232 |$M$ | 2008-6-2 8:0:0
    C:\Documents and Settings\All Users\Application Data\zhezi\bin2\h\ximvdemx.dll |$北京精益求德科技有限公司 | 2014-7-10 8:5:18
C:\Program Files\Rising\RSD\RsMgrSvc.exe * 1476 |$Beijing Rising Information Technology Corporation Limited | 2013-11-17 22:14:37
    C:\Program Files\Rising\RSD\comx3.dll |$Beijing Rising Information Technology Corporation Limited | 2013-11-17 22:14:37
    C:\Program Files\Rising\RSD\Syslay.dll |$Beijing Rising Information Technology Corporation Limited | 2013-11-17 22:14:37
C:\Program Files\Rising\RAV\ravmond.exe * 1492 |$Beijing Rising Information Technology Corporation Limited | 2014-5-15 14:57:11
C:\WINDOWS\system32\svchost.exe * 1528 |$M$ | 2008-6-2 8:0:0
    C:\Documents and Settings\All Users\Application Data\zhezi\bin2\h\ximvdemx.dll |$北京精益求德科技有限公司 | 2014-7-10 8:5:18
    C:\Program Files\Rising\RAV\ravscrch.dll |$Beijing Rising Information Technology Corporation Limited | 2014-5-26 14:59:59
C:\WINDOWS\system32\svchost.exe * 1664 |$M$ | 2008-6-2 8:0:0
    C:\Documents and Settings\All Users\Application Data\zhezi\bin2\h\ximvdemx.dll |$北京精益求德科技有限公司 | 2014-7-10 8:5:18
C:\WINDOWS\system32\svchost.exe * 1736 |$M$ | 2008-6-2 8:0:0
    C:\Documents and Settings\All Users\Application Data\zhezi\bin2\h\ximvdemx.dll |$北京精益求德科技有限公司 | 2014-7-10 8:5:18
C:\Program Files\stickynotes\stickynotes.exe * 1776 |$Beijing Panshi Yongye Investment Co.,Ltd. | 2014-7-4 14:41:8
    C:\Program Files\stickynotes\stickynotes.dll |$Beijing Panshi Yongye Investment Co.,Ltd. | 2014-7-4 14:41:10
C:\Program Files\360\360Safe\deepscan\ZhuDongFangYu.exe * 1848 |$Qihoo 360 Software (Beijing) Company Limited | 2014-5-27 22:0:44
    C:\Program Files\360\360Safe\360base.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-4-22 11:48:30
    C:\Program Files\360\360Safe\360util.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-6-18 12:6:38
    C:\Program Files\360\360Safe\360conf.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-4-22 11:48:38
    C:\Program Files\360\360Safe\deepscan\cloudcom2.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-6-26 15:30:12
    C:\Program Files\360\360Safe\360leakfixplugin.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-4-22 11:51:0
    C:\Program Files\360\360Safe\SoftMgr\360SoftMgrS.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-4-15 9:25:38
    C:\Program Files\360\360Safe\360NetBase.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-5-28 18:22:42
    C:\Program Files\360\360Safe\deepscan\heavygate.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-4-22 11:50:6
    C:\Program Files\360\360Safe\deepscan\qutmload.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-5-6 14:22:12
    C:\Program Files\360\360Safe\deepscan\bapi.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-4-16 19:23:34
    C:\Program Files\360\360Safe\SoftMgr\360OptExt.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-4-24 10:58:46
    C:\Program Files\360\360Safe\sweeper\CleanSoft.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-6-25 16:27:44
    C:\Program Files\360\360Safe\sweeper\CleanSoftEng.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-6-12 12:50:50
C:\WINDOWS\system32\spoolsv.exe * 264 |$M$ | 2011-6-15 17:8:54
    C:\Documents and Settings\All Users\Application Data\zhezi\bin2\h\ximvdemx.dll |$北京精益求德科技有限公司 | 2014-7-10 8:5:18
C:\WINDOWS\explorer.exe * 1836 |$M$ | 2008-6-2 8:0:0
    D:\Program Files\360\360sd\ShellIco.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-2-20 20:7:5
    C:\Program Files\360\360Safe\safemon\360UDiskGuard.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-5-6 10:53:58
    C:\Program Files\Rising\RAV\rsmgr.dll |$Beijing Rising Information Technology Corporation Limited | 2014-4-17 20:7:23
    C:\Program Files\Rising\RAV\wbshld.dll |$Beijing Rising Information Technology Corporation Limited | 2014-5-30 15:7:51
    C:\Program Files\Rising\RAV\wbprotect.dll |$Beijing Rising Information Technology Corporation Limited | 2014-2-27 17:52:42
    C:\Program Files\360\360Safe\SoftMgr\SML\SMLLauncher.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-4-17 18:34:36
    C:\Program Files\360\360Safe\360Base.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-4-22 11:48:30
    C:\Program Files\360\360Safe\safemon\safemon.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-5-13 17:24:40
    C:\Program Files\360\360Safe\safemon\Safehmpg.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-4-17 14:51:8
    C:\Program Files\360\360Safe\safemon\iNetSafe.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-5-6 12:18:52
    C:\Program Files\360\360Safe\safemon\wdexhelper.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-4-17 16:23:14
    C:\Program Files\WinRAR\rarext.dll |$X | 2013-1-4 14:36:24| ?| ?

| ?| ?| ?| ?| ?| ?| ?


    d:\Program Files\360\360sd\MenuEx.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-2-20 20:7:19
    C:\Program Files\360\360Safe\Utils\shell360ext.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-5-9 18:20:6
    C:\WINDOWS\system32\ravext.dll |$Beijing Rising Information Technology Corporation Limited | 2014-1-5 9:4:41
    C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_473666fd\ATL80.DLL |$X | 2012-8-17 16:27:58 | Microsoft? Visual Studio?

2005 | 8.00.50727.4053 | ATL Module for Windows (Unicode) | ? Microsoft Corporation.  All rights reserved. | 8.00.50727.4053 | Microsoft Corporation| ? | ATL80.DLL | ATL80.DLL
    C:\Program Files\广告神盾\0707150103\adhkdll.dll |$Guangzhou Feiwu Network Science and Technology Co., Ltd. | 2014-5-22 20:31:42
    C:\WINDOWS\system32\diactkf.dll |$X | 2014-7-1 8:5:3 | TK | 1.01.0006 |   | (C) Microsoft Corporation. All rights reserved. | 1.01.0006 | TK| ? | TuKu | TuKu.dll
    C:\WINDOWS\system32\SGWPShe32.dll |$Sogou.com | 2014-5-26 17:7:30
    C:\Program Files\360\360Safe\SoftMgr\SoftMgrExt.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-5-7 11:16:36
    C:\WINDOWS\system32\shellfire.dll |$PPLive Corporation | 2014-7-2 15:29:30
    C:\Documents and Settings\Administrator\Application Data\Wandoujia2\Applications\2.67.0.4980\wandoujia_shlext_dll.dll |$Wandou Technology Ltd | 2013-11-25 20:8:12
C:\Program Files\XCFaXian\lssvr.exe * 2292 |$北京趣找电子商务有限公司 | 2014-6-26 14:5:28
C:\Program Files\SogouInput\Components\AddressSearch\OmniAddr\OmniAddrService.exe * 2500 |$Sogou.com | 2014-5-14 8:29:48
    C:\Program Files\SogouInput\Components\AddressSearch\OmniAddr\OmniAddrService.exe |$Sogou.com | 2014-5-14 8:29:48
    C:\Documents and Settings\All Users\Application Data\zhezi\bin2\h\ximvdemx.dll |$北京精益求德科技有限公司 | 2014-7-10 8:5:18
C:\Program Files\Rising\RAV\rstray.exe * 2648 |$Beijing Rising Information Technology Corporation Limited | 2014-5-15 14:57:13
C:\Program Files\广告神盾\0707150103\ADShendun32.exe * 2748 |$Guangzhou Feiwu Network Science and Technology Co., Ltd. | 2014-6-23 14:27:34
    C:\Program Files\广告神盾\0707150103\ADShendun32.exe |$Guangzhou Feiwu Network Science and Technology Co., Ltd. | 2014-6-23 14:27:34
    C:\Program Files\Rising\RAV\rsmgr.dll |$Beijing Rising Information Technology Corporation Limited | 2014-4-17 20:7:23
    C:\Program Files\Rising\RAV\wbprotect.dll |$Beijing Rising Information Technology Corporation Limited | 2014-2-27 17:52:42
    C:\Program Files\Rising\RAV\ravscrch.dll |$Beijing Rising Information Technology Corporation Limited | 2014-5-26 14:59:59
    C:\Documents and Settings\All Users\Application Data\zhezi\bin2\h\ximvdemx.dll |$北京精益求德科技有限公司 | 2014-7-10 8:5:18
    C:\Program Files\广告神盾\0707150103\adhkdll.dll |$Guangzhou Feiwu Network Science and Technology Co., Ltd. | 2014-5-22 20:31:42
C:\Program Files\yyfm0529\2014071008\yymusic05.exe * 3272 |$GuangxiNanningshi Shengjuguangzaixian Info Tech Co.,LTD. | 2014-6-6 1:53:58
    C:\Program Files\yyfm0529\2014071008\yymusic05.exe |$GuangxiNanningshi Shengjuguangzaixian Info Tech Co.,LTD. | 2014-6-6 1:53:58
    C:\Program Files\yyfm0529\2014071008\avcore.dll |$GuangxiNanningshi Shengjuguangzaixian Info Tech Co.,LTD. | 2014-6-6 1:54:0
    C:\Program Files\yyfm0529\2014071008\audio.dll |$GuangxiNanningshi Shengjuguangzaixian Info Tech Co.,LTD. | 2014-6-6 1:54:0
    C:\Program Files\yyfm0529\2014071008\libav.dll |$GuangxiNanningshi Shengjuguangzaixian Info Tech Co.,LTD. | 2014-6-6 1:54:6
    C:\Program Files\yyfm0529\2014071008\pthreadGC2.dll |$GuangxiNanningshi Shengjuguangzaixian Info Tech Co.,LTD. | 2014-6-6 1:53:54
    C:\Program Files\yyfm0529\2014071008\swresample-0.dll |$GuangxiNanningshi Shengjuguangzaixian Info Tech Co.,LTD. | 2014-6-6 1:53:56
    C:\Program Files\yyfm0529\2014071008\avutil-52.dll |$GuangxiNanningshi Shengjuguangzaixian Info Tech Co.,LTD. | 2014-6-6 1:54:4
    C:\Program Files\yyfm0529\2014071008\avformat-54.dll |$GuangxiNanningshi Shengjuguangzaixian Info Tech Co.,LTD. | 2014-6-6 1:54:2
    C:\Program Files\yyfm0529\2014071008\avcodec-54.dll |$GuangxiNanningshi Shengjuguangzaixian Info Tech Co.,LTD. | 2014-6-6 1:54:0
    C:\Program Files\yyfm0529\2014071008\source.dll |$GuangxiNanningshi Shengjuguangzaixian Info Tech Co.,LTD. | 2014-6-6 1:53:54
    C:\Program Files\yyfm0529\2014071008\DuiLib.dll |$GuangxiNanningshi Shengjuguangzaixian Info Tech Co.,LTD. | 2014-6-6 1:54:6
    C:\Program Files\Rising\RAV\rsmgr.dll |$Beijing Rising Information Technology Corporation Limited | 2014-4-17 20:7:23
    C:\Program Files\Rising\RAV\wbprotect.dll |$Beijing Rising Information Technology Corporation Limited | 2014-2-27 17:52:42
    C:\Documents and Settings\All Users\Application Data\zhezi\bin2\h\ximvdemx.dll |$北京精益求德科技有限公司 | 2014-7-10 8:5:18
    C:\Program Files\广告神盾\0707150103\adhkdll.dll |$Guangzhou Feiwu Network Science and Technology Co., Ltd. | 2014-5-22 20:31:42
C:\Program Files\XCFaXian\XCFaXian.exe * 3424 |$北京趣找电子商务有限公司 | 2014-6-26 14:5:28
    C:\Program Files\XCFaXian\XCFaXian.exe |$北京趣找电子商务有限公司 | 2014-6-26 14:5:28
    C:\Program Files\Rising\RAV\rsmgr.dll |$Beijing Rising Information Technology Corporation Limited | 2014-4-17 20:7:23
    C:\Program Files\Rising\RAV\wbprotect.dll |$Beijing Rising Information Technology Corporation Limited | 2014-2-27 17:52:42
    C:\Documents and Settings\All Users\Application Data\zhezi\bin2\h\ximvdemx.dll |$北京精益求德科技有限公司 | 2014-7-10 8:5:18
    C:\Program Files\广告神盾\0707150103\adhkdll.dll |$Guangzhou Feiwu Network Science and Technology Co., Ltd. | 2014-5-22 20:31:42
    C:\Program Files\360\360Safe\safemon\safemon.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-5-13 17:24:40
C:\Program Files\Rising\RSD\popwndexe.exe * 3448 |$Beijing Rising Information Technology Corporation Limited | 2013-11-17 22:14:37
    C:\Program Files\Rising\RSD\popwndexe.exe |$Beijing Rising Information Technology Corporation Limited | 2013-11-17 22:14:37
    C:\Program Files\Rising\RSD\rsdk.dll |$Beijing Rising Information Technology Corporation Limited | 2013-11-17 22:14:37
    C:\Program Files\Rising\RSD\rsmginfo.dll |$Beijing Rising Information Technology Corporation Limited | 2013-11-17 22:14:37
    C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL |$Microsoft Corporation | 2013-1-4 14:36:22
    C:\Program Files\广告神盾\0707150103\adhkdll.dll |$Guangzhou Feiwu Network Science and Technology Co., Ltd. | 2014-5-22 20:31:42
    C:\Program Files\Rising\RAV\rsmgr.dll |$Beijing Rising Information Technology Corporation Limited | 2014-4-17 20:7:23
    C:\Program Files\Rising\RAV\wbprotect.dll |$Beijing Rising Information Technology Corporation Limited | 2014-2-27 17:52:42
    C:\Program Files\Rising\RAV\ravscrch.dll |$Beijing Rising Information Technology Corporation Limited | 2014-5-26 14:59:59
    C:\Documents and Settings\All Users\Application Data\zhezi\bin2\h\ximvdemx.dll |$北京精益求德科技有限公司 | 2014-7-10 8:5:18
C:\Documents and Settings\Administrator\Application Data\nlcal\nlcal.exe * 3892 |$深圳亿纬科技有限公司 | 2014-7-10 8:4:58
    C:\Documents and Settings\Administrator\Application Data\nlcal\nlcal.exe |$深圳亿纬科技有限公司 | 2014-7-10 8:4:58
    C:\Program Files\Rising\RAV\rsmgr.dll |$Beijing Rising Information Technology Corporation Limited | 2014-4-17 20:7:23
    C:\Program Files\Rising\RAV\wbprotect.dll |$Beijing Rising Information Technology Corporation Limited | 2014-2-27 17:52:42
    C:\Documents and Settings\All Users\Application Data\zhezi\bin2\h\ximvdemx.dll |$北京精益求德科技有限公司 | 2014-7-10 8:5:18
    C:\Program Files\360\360Safe\safemon\safemon.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-5-13 17:24:40
    C:\Program Files\Rising\RAV\ravscrch.dll |$Beijing Rising Information Technology Corporation Limited | 2014-5-26 14:59:59
    C:\Program Files\广告神盾\0707150103\adhkdll.dll |$Guangzhou Feiwu Network Science and Technology Co., Ltd. | 2014-5-22 20:31:42
C:\WINDOWS\system32\rundll32.exe * 1956 |$M$ | 2008-6-2 8:0:0
    C:\Program Files\Rising\RAV\rsmgr.dll |$Beijing Rising Information Technology Corporation Limited | 2014-4-17 20:7:23
    C:\Program Files\Rising\RAV\wbprotect.dll |$Beijing Rising Information Technology Corporation Limited | 2014-2-27 17:52:42
    C:\Program Files\360\360Safe\safemon\safemon.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-5-13 17:24:40
    C:\Program Files\广告神盾\0707150103\adhkdll.dll |$Guangzhou Feiwu Network Science and Technology Co., Ltd. | 2014-5-22 20:31:42
C:\WINDOWS\system32\ctfmon.exe * 436 |$M$ | 2008-6-2 8:0:0
    C:\Program Files\Rising\RAV\rsmgr.dll |$Beijing Rising Information Technology Corporation Limited | 2014-4-17 20:7:23
    C:\Program Files\Rising\RAV\wbprotect.dll |$Beijing Rising Information Technology Corporation Limited | 2014-2-27 17:52:42
    C:\Program Files\广告神盾\0707150103\adhkdll.dll |$Guangzhou Feiwu Network Science and Technology Co., Ltd. | 2014-5-22 20:31:42
C:\Program Files\baidu\BaiduAn\2.1.0.1214\BaiduAnTray.exe * 976 |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:16
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\baiduanTray.exe |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:16
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\BDMSkin.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:17
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\BDLogicUtils.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:17
    C:\Program Files\Rising\RAV\rsmgr.dll |$Beijing Rising Information Technology Corporation Limited | 2014-4-17 20:7:23
    C:\Program Files\Rising\RAV\wbprotect.dll |$Beijing Rising Information Technology Corporation Limited | 2014-2-27 17:52:42
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\Plugins\BDMPatcherPlugins\BDMConnect.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-7-2 8:3:5
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\Plugins\bdmtrayplugins\BDMTrayTipsPlugin.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:15
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\Plugins\BDMTrayPlugins\BDMSusPlugin.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:15
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\plugins\bdmsusplugins\BDMSOAccSusPlugin.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:15
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\plugins\bdmsusplugins\BDMNetMonSusPlugin.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:15
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\FTSOManager\BDMSOLiveAccMgr.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:15
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\FTSOManager\BDMSOLiveAccStrategyMgr.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:15
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\FTSOManager\BDMSOLiveAccEngine.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:15
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\FTSOManager\BDMNetMonMgrDll.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:15
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\BDMReport.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:17
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\BDMNet.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:17
    C:\Documents and Settings\All Users\Application Data\zhezi\bin2\h\ximvdemx.dll |$北京精益求德科技有限公司 | 2014-7-10 8:5:18
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\Plugins\bdmtrayplugins\BDMSOAccTrayPlugin.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:15
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\FTSOManager\SysAccMgrDll.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:15
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\bdmantivirus\BDKitUtils.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:16
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\Plugins\bdmtrayplugins\BDMSOCleanerTrayPlugin.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:15
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\BDMUpdate.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:17
    C:\Program Files\360\360Safe\safemon\safemon.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-5-13 17:24:40
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\BDMDownload.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:17
    C:\Program Files\广告神盾\0707150103\adhkdll.dll |$Guangzhou Feiwu Network Science and Technology Co., Ltd. | 2014-5-22 20:31:42
C:\Documents and Settings\Administrator\Application Data\nlcal\nlcalQuick.exe * 3936 |$深圳亿纬科技有限公司 | 2014-7-10 8:4:58
    C:\Documents and Settings\Administrator\Application Data\nlcal\nlcalQuick.exe |$深圳亿纬科技有限公司 | 2014-7-10 8:4:58
    C:\Program Files\Rising\RAV\rsmgr.dll |$Beijing Rising Information Technology Corporation Limited | 2014-4-17 20:7:23
    C:\Program Files\Rising\RAV\wbprotect.dll |$Beijing Rising Information Technology Corporation Limited | 2014-2-27 17:52:42
    C:\Documents and Settings\Administrator\Application Data\nlcal\AssistModule.dll |$深圳亿纬科技有限公司 | 2014-7-10 8:4:58
    C:\Documents and Settings\All Users\Application Data\zhezi\bin2\h\ximvdemx.dll |$北京精益求德科技有限公司 | 2014-7-10 8:5:18
    C:\Program Files\360\360Safe\safemon\safemon.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-5-13 17:24:40
    C:\Program Files\Rising\RAV\ravscrch.dll |$Beijing Rising Information Technology Corporation Limited | 2014-5-26 14:59:59
    C:\Program Files\广告神盾\0707150103\adhkdll.dll |$Guangzhou Feiwu Network Science and Technology Co., Ltd. | 2014-5-22 20:31:42
C:\Program Files\Common Files\Baidu\BDDownload\107\bddownloader.exe * 3168 |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:20
    c:\program files\common files\baidu\bddownload\107\bddownloader.exe |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:20
    C:\Program Files\360\360Safe\safemon\safemon.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-5-13 17:24:40
    C:\Program Files\Rising\RAV\rsmgr.dll |$Beijing Rising Information Technology Corporation Limited | 2014-4-17 20:7:23
    C:\Program Files\Rising\RAV\wbprotect.dll |$Beijing Rising Information Technology Corporation Limited | 2014-2-27 17:52:42
    c:\program files\common files\baidu\bddownload\107\dl.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:20
    C:\Documents and Settings\All Users\Application Data\zhezi\bin2\h\ximvdemx.dll |$北京精益求德科技有限公司 | 2014-7-10 8:5:18
    C:\Program Files\广告神盾\0707150103\adhkdll.dll |$Guangzhou Feiwu Network Science and Technology Co., Ltd. | 2014-5-22 20:31:42
C:\Program Files\广告神盾\0707150103\server\ADShendunProxy32.exe * 5500 |$Guangzhou Feiwu Network Science and Technology Co., Ltd. | 2014-6-9 22:7:10
    C:\Documents and Settings\All Users\Application Data\zhezi\bin2\h\ximvdemx.dll |$北京精益求德科技有限公司 | 2014-7-10 8:5:18
C:\Program Files\baidu\BaiduAn\2.1.0.1214\BaiduAn.exe * 5896 |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:16
    C:\Program Files\360\360Safe\safemon\safemon.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-5-13 17:24:40
    C:\Program Files\Rising\RAV\rsmgr.dll |$Beijing Rising Information Technology Corporation Limited | 2014-4-17 20:7:23
    C:\Program Files\Rising\RAV\wbprotect.dll |$Beijing Rising Information Technology Corporation Limited | 2014-2-27 17:52:42
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\BDMMainframe.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:17
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\BDLogicUtils.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:17
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\BDMSkin.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:17
    C:\Program Files\广告神盾\0707150103\adhkdll.dll |$Guangzhou Feiwu Network Science and Technology Co., Ltd. | 2014-5-22 20:31:42
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\Plugins\BDMSOManagerPlugins\BDMSOCleanerPlugin.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:15
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\Plugins\BDMSOManagerPlugins\BDMSOAcceleratorPlugin.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:15
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\FTSOManager\SYSCleaner.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:15
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\BDMScriptVM.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:17
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\GCScriptBind.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:17
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\BDMWindowsLib.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:18
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\FTSOManager\SysAccMgrDll.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:15
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\bdmantivirus\BDKitUtils.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:16
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\FTSOManager\BDMSOLiveAccMgr.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:15
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\FTSOManager\BDMSOLiveAccStrategyMgr.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:15
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\FTSOManager\BDMSOLiveAccEngine.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:15
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\FTSOManager\BDMNetMonMgrDll.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:15
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\Plugins\bdmmainframeplugins\BDMSWManagerFrame.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:15
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\BDMSWNestCore.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:17
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\Plugins\bdmmainframeplugins\BDMSafePlugin.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:15
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\Plugins\bdmsafeplugins\BDMKVMainPlugin.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:15
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\Plugins\BDMSafePlugins\BDMPatcherPlugin.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-7-2 8:3:15
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\Plugins\bdmsafeplugins\BDMSysFixerPlugin.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:15
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\Plugins\BDMPatcherPlugins\BDMConnect.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-7-2 8:3:5
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\BDMReport.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:17
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\BDMNet.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:17
    C:\Documents and Settings\All Users\Application Data\zhezi\bin2\h\ximvdemx.dll |$北京精益求德科技有限公司 | 2014-7-10 8:5:18
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\FTSysFixer\SysFixer.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:16
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\BDMSWParseDetect.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:18
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\Plugins\bdmkvscanplugin\BDMKVScanPlugin.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:15
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\bdmantivirus\CompatibilityChecker.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:16
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\bdmantivirus\BDMRepMgr.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:16
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\bdmantivirus\BDMRepBase.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:16
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\bdmantivirus\BDMAVEng.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:16
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\bdmantivirus\TrustAndIso.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:16
C:\Program Files\baidu\BaiduAn\2.1.0.1214\BDALeakfixer.exe * 4608 |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:16
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\BDALeakfixer.exe |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:16
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\BDLogicUtils.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:17
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\BDMSkin.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:17
    C:\Program Files\360\360Safe\safemon\safemon.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-5-13 17:24:40
    C:\Program Files\Rising\RAV\rsmgr.dll |$Beijing Rising Information Technology Corporation Limited | 2014-4-17 20:7:23
    C:\Program Files\Rising\RAV\wbprotect.dll |$Beijing Rising Information Technology Corporation Limited | 2014-2-27 17:52:42
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\Plugins\BDMPatcherPlugins\BDMPatcher.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-7-2 8:3:13
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\Plugins\BDMPatcherPlugins\BDMConnect.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-7-2 8:3:5
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\BDMReport.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:17
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\BDMNet.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:17
    C:\Program Files\Baidu\BaiduAn\2.1.0.1214\BDMDownload.dll |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:17
    C:\Documents and Settings\All Users\Application Data\zhezi\bin2\h\ximvdemx.dll |$北京精益求德科技有限公司 | 2014-7-10 8:5:18
C:\Program Files\Rising\RAV\rsmain.exe * 340 |$Beijing Rising Information Technology Corporation Limited | 2013-11-17 22:15:1
C:\Program Files\XCFaXian\XCFaXian.exe * 4384 |$北京趣找电子商务有限公司 | 2014-6-26 14:5:28
    C:\Program Files\XCFaXian\XCFaXian.exe |$北京趣找电子商务有限公司 | 2014-6-26 14:5:28
    C:\Program Files\360\360Safe\safemon\safemon.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-5-13 17:24:40
    C:\Program Files\Rising\RAV\rsmgr.dll |$Beijing Rising Information Technology Corporation Limited | 2014-4-17 20:7:23
    C:\Program Files\Rising\RAV\wbprotect.dll |$Beijing Rising Information Technology Corporation Limited | 2014-2-27 17:52:42
    C:\Documents and Settings\All Users\Application Data\zhezi\bin2\h\ximvdemx.dll |$北京精益求德科技有限公司 | 2014-7-10 8:5:18
    C:\Program Files\Rising\RAV\ravscrch.dll |$Beijing Rising Information Technology Corporation Limited | 2014-5-26 14:59:59
    C:\Program Files\广告神盾\0707150103\adhkdll.dll |$Guangzhou Feiwu Network Science and Technology Co., Ltd. | 2014-5-22 20:31:42
    C:\WINDOWS\system32\Macromed\Flash\Flash32_14_0_0_145.ocx |$Adobe Systems Incorporated | 2014-7-9 8:2:30
O2 - IeAddOn(360sdbho Class) - {0F4BF955-A127-41B7-A998-369904AA2578}
   = D:\Program Files\360\360sd\360sdbho.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-2-20 18:29:58
O2 - IeAddOn(广告神盾IE插件) - {5AC58093-0F4D-4D65-A40B-007DDD7A79CF}
   = C:\Program Files\广告神盾\0707150103\ieplugin32.dll |$Guangzhou Feiwu Network Science and Technology Co., Ltd. | 2014-5-22 20:32:0
O2 - IeAddOn(SafeMon Class) - {B69F34DD-F0F9-42DC-9EDD-957187DA688D}
   = C:\Program Files\360\360Safe\safemon\safemon.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-5-13 17:24:40
O2 - IeAddOn(搜狗输入法地址栏搜索) - {0C3ED74B-8703-4003-A1F4-2B2A0C450DD2}
   = C:\Program Files\SogouInput\Components\AddressSearch\OmniAddr\OmniAddr.dll |$Sogou.com | 2014-5-14 8:29:47
O2 - IeAddOn(360sdbho Class) - {0F4BF955-A127-41B7-A998-369904AA2578}
   = D:\Program Files\360\360sd\360sdbho.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-2-20 18:29:58
O2 - IeAddOn(广告神盾IE插件) - {5AC58093-0F4D-4D65-A40B-007DDD7A79CF}
   = C:\Program Files\广告神盾\0707150103\ieplugin32.dll |$Guangzhou Feiwu Network Science and Technology Co., Ltd. | 2014-5-22 20:32:0
O2 - IeAddOn(360SafeLive) - {87515F61-A66C-4319-A0E0-D416CB8059E3}
   = C:\Program Files\360\360Safe\Safelive.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-5-5 18:46:50
O2 - IeAddOn(SetupCtrl Class) - {8C891026-0BE9-434E-B807-118E6E5EA3B6}
   = C:\WINDOWS\Downloaded Program Files\276828\BaiduSetupAx_0.dll |$Baidu (China) Co., Ltd. | 2012-12-26 15:34:22
O2 - IeAddOn(SafeMon Class) - {B69F34DD-F0F9-42DC-9EDD-957187DA688D}
   = C:\Program Files\360\360Safe\safemon\safemon.dll |$Qihoo 360 Software (Beijing) Company Limited | 2014-5-13 17:24:40
O2 - IeAddOn(BDBProtocolHelperImpl Class) - {E1819698-0CD0-435C-AE0D-F288924C40A1}
   = C:\Program Files\baidu\BaiduPlayer\3.9.3.12\bdbph.dll |$Baidu (China) Co., Ltd. | 2014-6-13 15:36:28
O4 - HKCU\..\run: [360sd] "D:\Program Files\360\360sd\360sd.exe" /autorun
O4 - HKCU\..\run: [XCFaXian] "C:\Program Files\XCFaXian\XCFaXian.exe" /A
O4 - HKLM\..\run: [360Safetray] "C:\Program Files\360\360Safe\safemon\360Tray.exe" /start
O4 - HKLM\..\run: [RavTRAY] "C:\Program Files\Rising\RAV\RSTRAY.EXE" -system
O4 - HKLM\..\run: [ADSD0707150103] "C:\Program Files\广告神盾\0707150103\ADShendun32.exe" tray
O4 - HKLM\..\run: [yyfm0529_2014071008] "C:\Program Files\yyfm0529\2014071008\yymusic05.exe" -mini
O4 - HKLM\..\run: [yyfm0529_News_2014071008] "C:\Program Files\yyfm0529\2014071008\YFMSever.exe" -mini
O4 - HKLM\..\run: [nlcal] C:\Documents and Settings\Administrator\Application Data\nlcal\nlcal.exe /start
O4 - HKLM\..\run: [BaiduAnTray] "C:\Program Files\Baidu\BaiduAn\2.1.0.1214\BaiduAnTray.exe"  -stmd=3
BaiduBrowserUpdater.job -> C:\Program Files\Baidu\BaiduBrowser\bdupdate.exe --check --type=auto --fromautorun
游戏盒子版本号更新检測.job -> C:\Documents and Settings\All Users\Application Data\GBX2014710\GameBox.exe /check_update
O10 - LSP: npzz over [MSAFD Tcpip [TCP/IP]] = C:\Documents and Settings\All Users\Application Data\zhezi\bin2\h\ximvdemx.dll |$北京精益求德科技有限公司 | 2014-7-10 8:5:18
O10 - LSP: npzz over [MSAFD Tcpip [UDP/IP]] = C:\Documents and Settings\All Users\Application Data\zhezi\bin2\h\ximvdemx.dll |$北京精益求德科技有限公司 | 2014-7-10 8:5:18
O10 - LSP: npzz = C:\Documents and Settings\All Users\Application Data\zhezi\bin2\h\ximvdemx.dll |$北京精益求德科技有限公司 | 2014-7-10 8:5:18
O23 - 服务: 360AntiHacker (360Safe Anti Hacker Service) - System32\Drivers\360AntiHacker.sys |$Qihoo 360 Software (Beijing) Company Limited | 2014-4-18 16:7:8(系统)
O23 - 服务: 360AvFlt (360AvFlt mini-filter driver) - system32\DRIVERS\360AvFlt.sys |$Qihoo 360 Software (Beijing) Company Limited | 2014-2-26 11:29:55(手动)
O23 - 服务: 360Box (360Box mini-filter driver) - system32\DRIVERS\360Box.sys |$Qihoo 360 Software (Beijing) Company Limited | 2014-5-27 17:3:12(系统)
O23 - 服务: 360Camera (360Safe Camera Filter Service) - System32\Drivers\360Camera.sys |$Qihoo 360 Software (Beijing) Company Limited | 2014-4-18 16:30:26(手动)
O23 - 服务: 360netmon (360netmon) - C:\WINDOWS\system32\drivers\360netmon.sys |$Qihoo 360 Software (Beijing) Company Limited | 2014-2-27 11:1:50(系统)
O23 - 服务: 360qpesv (360qpesv driver) - C:\WINDOWS\system32\drivers\360qpesv.sys |$Qihoo 360 Software (Beijing) Company Limited | 2014-6-29 20:27:0(系统)
O23 - 服务: 360rp (360 杀毒实时防护载入服务) - "D:\Program Files\360\360sd\360rps.exe" |$Qihoo 360 Software (Beijing) Company Limited | 2014-2-24 10:40:33(自己主动)
O23 - 服务: 360SelfProtection (360SelfProtection) - system32\drivers\360SelfProtection.sys |$Qihoo 360 Software (Beijing) Company Limited | 2014-4-21 21:17:58(系统)
O23 - 服务: BAPIDRV (BAPIDRV) - system32\DRIVERS\BAPIDRV.sys |$Qihoo 360 Software (Beijing) Company Limited | 2014-4-18 15:33:16(系统)
O23 - 服务: bd0001 (bd0001) - system32\DRIVERS\bd0001.sys |$Beijing baidu Netcom science and technology co.ltd | 2014-6-13 16:38:54(系统)
O23 - 服务: bd0002 (bd0002) - system32\DRIVERS\bd0002.sys |$Beijing baidu Netcom science and technology co.ltd | 2014-3-11 17:36:8(系统)
O23 - 服务: bd0004 (bd0004) - system32\DRIVERS\bd0004.sys |$Beijing baidu Netcom science and technology co.ltd | 2014-7-2 7:58:15(系统)
O23 - 服务: BDArKit (BDArKit) - system32\DRIVERS\BDArKit.sys |$Beijing baidu Netcom science and technology co.ltd | 2014-7-2 8:3:11(手动)
O23 - 服务: BDMNetMon (BDMNetMon) - system32\DRIVERS\BDMNetMon.sys |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:21(自己主动)
O23 - 服务: BDMRTP (BDMRTP Service) - "C:\Program Files\Baidu\BaiduAn\2.1.0.1214\baiduanSvc.exe" -r |$Beijing baidu Netcom science and technology co.ltd | 2014-5-4 19:59:16(自己主动)
O23 - 服务: BDMWrench (BDMWrench) - system32\DRIVERS\BDMWrench.sys |$Beijing baidu Netcom science and technology co.ltd | 2014-7-8 14:26:44(系统)
O23 - 服务: BDSGRTP (BDSGRTP Service) - "C:\Program Files\Common Files\Baidu\BaiduProtect\1.2.0.47\BaiduProtect.exe" -r |$X(自己主动)
O23 - 服务: DsArk (DsArk) - C:\WINDOWS\system32\drivers\DsArk.sys |$Qihoo 360 Software (Beijing) Company Limited | 2013-11-2 13:26:35(引导)
O23 - 服务: EfiMon (EfiSystemMon) - System32\Drivers\Efimon.sys |$Qihoo 360 Software (Beijing) Company Limited | 2014-4-21 18:45:8(系统)
O23 - 服务: HookPort (HookPort) - System32\Drivers\Hookport.sys |$Qihoo 360 Software (Beijing) Company Limited | 2014-4-21 21:22:20(引导)
O23 - 服务: HyperVM (HyperVM) - C:\WINDOWS\system32\drivers\hvm.sys |$Beijing Rising Information Technology Corporation Limited | 2013-11-17 22:15:3(系统)
O23 - 服务: kguard (kguard) - system32\DRIVERS\kguard.sys |$Beijing Rising Information Technology Corporation Limited | 2014-5-15 14:57:43(系统)
O23 - 服务: lsservice (lsservice) - C:\Program Files\XCFaXian\lssvr.exe |$北京趣找电子商务有限公司 | 2014-6-26 14:5:28(自己主动)
O23 - 服务: QQProtect (QQProtect) - C:\WINDOWS\system32\drivers\QQProtect.sys |$Tencent Technology(Shenzhen) Company Limited | 2014-5-8 17:32:44(系统)
O23 - 服务: qutmdserv (Quantum DeepScanner Servers) - system32\DRIVERS\qutmdrv.sys |$Qihoo 360 Software (Beijing) Company Limited | 2014-6-20 15:10:30(系统)
O23 - 服务: qutmipc (qutmipc) - C:\WINDOWS\system32\drivers\qutmipc.sys |$Qihoo 360 Software (Beijing) Company Limited | 2014-5-14 10:46:24(系统)
O23 - 服务: rsdsys (rsd protect) - C:\WINDOWS\system32\drivers\protreg.sys |$Beijing Rising Information Technology Corporation Limited | 2014-5-28 15:23:55(自己主动)
O23 - 服务: RsMgrSvc (Rsd Service) - "C:\Program Files\Rising\RSD\RsMgrSvc.exe" |$Beijing Rising Information Technology Corporation Limited | 2013-11-17 22:14:37(自己主动)
O23 - 服务: RsRavMon (Rav Service) - "C:\Program Files\Rising\RAV\ravmond.exe" |$Beijing Rising Information Technology Corporation Limited | 2014-5-15 14:57:11(自己主动)
O23 - 服务: rsutils (rsutils) - system32\DRIVERS\rsutils.sys |$Beijing Rising Information Technology Corporation Limited | 2013-11-27 8:0:20(系统)
O23 - 服务: stickynotes (stickynotes service) - "C:\Program Files\stickynotes\stickynotes.exe" -srv |$Beijing Panshi Yongye Investment Co.,Ltd. | 2014-7-4 14:41:8(自己主动)
O23 - 服务: sysmon (sysmon) - system32\DRIVERS\sysmon.sys |$Beijing Rising Information Technology Corporation Limited | 2014-6-23 14:53:54(引导)
O23 - 服务: ZheziSrv (Zhezi Service) - "C:\Program Files\zhezi\app\zhezi\ZheziServiceMgr.exe" /asservice |$北京精益求德科技有限公司 | 2014-7-4 18:4:12(手动)
O23 - 服务: ZhuDongFangYu (主动防御) - "C:\Program Files\360\360Safe\deepscan\zhudongfangyu.exe" |$Qihoo 360 Software (Beijing) Company Limited | 2014-5-27 22:0:44(自己主动)

O29 - HKCU-Start Page = http://www.hao123.com/?

tn=98868055_hao_pg
O29 - HKCU-Search Page = http://www.3600.com/?

src=lm&ls=n290987998a
O29 - HKCU-Default_Page_URL = http://www.3600.com/?

src=lm&ls=n290987998a
O29 - HKLM-Start Page = http://hao.360.cn/?1004
O29 - HKUS-Start Page = http://www.hao123.com/?tn=94104199_hao_pg
O34 - StartMenuInternet [2345Explorer.exe] = "C:\Program Files\2345Explorer\2345Explorer.exe" |$X
O34 - StartMenuInternet [360SE.exe] = C:\Program Files\360\360se\360SE.exe |$360.cn | 2013-1-4 14:36:5
O34 - StartMenuInternet [BaiduBrowser.EXE] = "C:\Program Files\Baidu\BaiduBrowser\BaiduBrowser.exe" |$X
C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch
    2345智能浏览器.lnk -> C:\Program Files\2345Explorer\2345Explorer.exe http://www.hao123.com/?tn=98868055_hao_pg
    360安全卫士.lnk -> C:\Program Files\360\360Safe\360Safe.exe
    hao123_网址导航_Internet.lnk -> http://www.hao123.com/?tn=90618383_hao_pg
    Inteent Exploror.lnk -> http://www.hao123.com/?

tn=98868055_hao_pg
    Intronnt HaoDao.lnk -> http://www.hao123.com/?tn=98868055_hao_pg
    lentent Epxlroer.lnk -> http://www.3600.com/?

src=lm&ls=n525187378f
    今日黄历.lnk -> C:\Documents and Settings\Administrator\Application Data\nlcal\nlcal.exe
    折子购物.lnk -> C:\Program Files\zhezi\app\zhezi\zhezi.exe
    极速抢票入口.lnk -> http://www.hao123.com/?tn=93947501_hao_pg
    爱淘宝.lnk -> http://t.cn/Rv8Fg27
C:\Documents and Settings\Administrator\桌面
    hao123_网址导航_Internet.lnk -> http://www.hao123.com/?tn=90618383_hao_pg
    Internet   Explorer.lnk -> http://www.hao123.com/?tn=97883556_hao_pg
    Internet  Explorer.lnk -> http://www.hao123.com/?tn=97883556_hao_pg
    安全上网必备.lnk -> http://www.3600.com/?

src=lm&ls=n799d887988
    极速抢票入口.lnk -> http://www.3600.com/?

src=lm&ls=n7141871b8c
    淘宝.lnk -> http://ai.taobao.com/?pid=mm_43853062_4068309_23360394
C:\Documents and Settings\All Users\「開始」菜单
    lentent Epxlroer.lnk -> http://www.3600.com/?src=lm&ls=n525187378f
    爱淘宝.lnk -> http://t.cn/Rv8Fg27
C:\Documents and Settings\All Users\桌面
    Apabi Reader 4.5.lnk -> C:\Program Files\Founder\Apabi Reader 4.0\ApaReader.exe
    Inteent Exploror.lnk -> http://www.hao123.com/?tn=98868055_hao_pg
    Intronnt HaoDao.lnk -> http://www.hao123.com/?tn=98868055_hao_pg
    lentent Epxlroer.lnk -> http://www.3600.com/?

src=lm&ls=n525187378f
.htm - "C:\Program Files\360\360se\360SE.exe" "%1"
.html - "C:\Program Files\360\360se\360SE.exe" "%1"


先把百度卫士、百度浏览器、zhezi卸载了。


打开任务管理器，终止进程：

C:\Program Files\XCFaXian\lssvr.exe
C:\Program Files\yyfm0529\2014071008\yymusic05.exe
C:\Program Files\XCFaXian\XCFaXian.exe
C:\Documents and Settings\Administrator\Application Data\nlcal\nlcal.exe
C:\Documents and Settings\Administrator\Application Data\nlcal\nlcalQuick.exe
C:\Program Files\XCFaXian\XCFaXian.exe

停止并禁用服务：

O23 - 服务: SuperApps (SuperApps service) - C:\WINDOWS\system32\svchost.exe -k SuperApps |$M$ | 2008-6-2 8:0:0(自己主动)

删除启动项：
O4 - HKCU\..\run: [XCFaXian] "C:\Program Files\XCFaXian\XCFaXian.exe" /A
O4 - HKLM\..\run: [yyfm0529_2014071008] "C:\Program Files\yyfm0529\2014071008\yymusic05.exe" -mini
O4 - HKLM\..\run: [yyfm0529_News_2014071008] "C:\Program Files\yyfm0529\2014071008\YFMSever.exe" -mini
O4 - HKLM\..\run: [nlcal] C:\Documents and Settings\Administrator\Application Data\nlcal\nlcal.exe /start

瑞星集成了系统优化功能，会检測并列出一些能够优化的项目，但不能对未检測出的项目进行操作。

比方O23 - 服务: SuperApps，瑞星没列出来，用windows系统自带的服务管理器无法禁用，用360卫士则能够禁用。

 

然后清理这些恶意广告图标及開始菜单项，重新启动电脑，最终正常了。

 

附部分文件信息：

文件说明符 : C:\Program Files\yyfm0529\2014071008\YFMSever.exe
属性 : A---
数字签名:GuangxiNanningshi Shengjuguangzaixian Info Tech Co.,LTD.
PE文件:是
语言 : 中文(中国)
文件版本号 : 20.20.20.20
说明 : 音乐软件相关
版权 : 2014年编译
产品版本号 : 20.20.20.20
产品名称 : 音乐软件相关
公司名称 : 音乐软件相关
合法商标 :
内部名称 :
源文件名称 :
创建时间 : 2014-6-6 1:53:56
改动时间 : 2014-6-6 1:53:56
大小 : 706192 字节 689.656 KB
MD5 : cc479a63384549b4727c5c261f86592a
SHA1: A3E0F2BC4C631170ED7A7E2793A3925E2F5E7320
CRC32: e0fbc0e7

文件说明符 : C:\Program Files\yyfm0529\2014071008\yymusic05.exe
属性 : A---
数字签名:GuangxiNanningshi Shengjuguangzaixian Info Tech Co.,LTD.
PE文件:是
语言 : 中文(中国)
文件版本号 : 1.14.529.1
说明 : 音乐FM
版权 : Copyright (C) 2014
产品版本号 : 1.14.529.1
产品名称 : 音乐FM
公司名称 : 音乐FM
内部名称 : MusicPla.exe
源文件名称 : MusicPla.exe
创建时间 : 2014-6-6 1:53:58
改动时间 : 2014-6-6 1:53:58
大小 : 1979536 字节 1.909 MB
MD5 : eceba96738a53afb5284ca33b049d998
SHA1: 5965CA90BAB852CF6CF03E46AB1E2CBB8743EAA0
CRC32: 3ef1ef4c

文件说明符 : C:\Documents and Settings\All Users\Application Data\GBX2014710\GameBox.exe
属性 : A---
数字签名:否
PE文件:是
语言 : 中文(中国)
文件版本号 : 1.1.14.6150
说明 : GameBox
版权 : 版权全部 (C) 2013
产品版本号 : 1.1.14.6150
产品名称 : GameBox
内部名称 : GameBox
源文件名称 : GameBox.exe
创建时间 : 2014-7-1 8:5:7
改动时间 : 2014-6-15 15:33:58
大小 : 477696 字节 466.512 KB
MD5 : 989d10106b1fd621936bde8b5160014c
SHA1: 363F54892C37D51BEA1026CD68917234409D6C73
CRC32: c042d084

 

文件说明符 : C:\Documents and Settings\Administrator\Application Data\nlcal\nlcal.exe
属性 : A---
数字签名:深圳亿纬科技有限公司
PE文件:是
语言 : 中文(中国)
文件版本号 : 1, 0, 0, 7
说明 : 今日黄历 应用程序
版权 : 版权全部 (C) 2014
产品版本号 : 1, 0, 0, 7
产品名称 : nlcal 应用程序
内部名称 : nlcal
源文件名称 : nlcal.exe
创建时间 : 2014-7-10 8:4:58
改动时间 : 2014-7-10 8:4:58
大小 : 260208 字节 254.112 KB
MD5 : e9a0e8307595d972715cff739506ea2d
SHA1: 6A54F039EED7A98AB0BB70A58F789ED75334FF1C
CRC32: a4792813

文件说明符 : C:\Program Files\XCFaXian\lssvr.exe
属性 : A---
数字签名:北京趣找电子商务有限公司
PE文件:是
获取文件版本号信息大小失败!
创建时间 : 2014-6-26 14:5:28
改动时间 : 2014-6-26 14:5:28
大小 : 766592 字节 748.640 KB
MD5 : 510ecaf617b6c71c14d9acec12007b6f
SHA1: 3EA45B408D2AE48293CB73E6D7AD45000EFFB4E8
CRC32: 61917e7f

 

weixin_33997389
关注
X64系统 注册表和文件重定向 Python
liumei90
11-16 2580
无论是Windows XP Professional X64 Edition、Windows Server2003X64 Edition还是Windows Vista X64 Edition（以下把均统称为X64系统），都引入了一项技术：注册表和文件的重定向。        由于64位Windows系统需要把32位和64位应用程序分开保存，故使用一种名曰“WOW64”的技术，因而也出现了注册表和
奇虎360状告瑞星为哪般？
congguan8051的博客
08-28 126
北京奥运大戏刚刚落下帷幕，网民的视线刚刚转回常态，奇虎360便迫不及待地把瑞星告上法庭，理由是瑞星近段时间在各大互联网媒体频频散布攻击奇虎360的言论，对奇虎360造成极其恶劣的...
瑞星杀毒软件、奇虎360杀毒软件、360卫士、百度卫士联手，搞不定弹出广告 & 恶意广告图标
热门推荐
Purpleendurer@CSDN
07-12 1万+
一位网友说他的电脑最近出了问题：开机后桌面和任务栏上的快速启动栏会出现恶意图标，删除了下次开机又会出现；使用电脑过程中每分钟都会弹出广告。他为电脑安装了瑞星杀毒软件、奇虎360杀毒软件、360卫士、百度卫士，以及广告神盾，都不能解决问题。现在电脑开机时需要几分钟才能进入桌面。请求帮忙。这些恶意广告图标pe_xscan扫描log中的相关项目：  hao123_网址导航_Internet.lnk ->
Python管理Windows进程
编程之路
12-31 1万+
Python管理Windows进程
修改主机名。vbs
01-01
修改主机名。vbs
瑞星个人杀毒软件V17 v24.17.02.24
11-28
《瑞星个人杀毒软件V17 v24.17.02.24：全方位守护电脑安全》 瑞星个人杀毒软件V17是面向广大用户的专业级安全防护软件，其最新版本v24.17.02.24在原有基础上进行了深度的优化与创新，旨在为用户提供更加高效、智能...
瑞星杀毒软件 25.00.05
10-04
《瑞星杀毒软件25.00.05：全方位安全防护的解析与探讨》 瑞星杀毒软件，作为国内知名的网络安全解决方案提供商瑞星公司的主打产品，一直以来以其强大的四核杀毒引擎赢得了广大用户的信赖。本次更新的V17版本，不仅...
瑞星杀毒软件V17 v25.00.07.30官方版
01-06
为您提供瑞星杀毒软件V17下载，基本简介据介绍，新加入的决策引擎（简称RDM）是瑞星第一款人工智能杀毒引擎，它依托海量恶意软件库，引入机器学习算法，使V16+获得类似人脑的病毒识别能力。它能够摆脱传统杀毒引擎对...
瑞星杀毒软件 V17 v25.00.06.28官方版
11-04
《瑞星杀毒软件 V17 v25.00.06.28官方版：守护您的网络安全》 瑞星杀毒软件是一款备受赞誉的电脑安全防护工具，特别是其2018年推出的V17版本，更是以其强大的功能和高效的安全性能赢得了用户的广泛认可。这款软件的...
禁止瑞星金山360百度杀毒卫士软件后台自动安装
12-26
标题和描述提到的是如何避免瑞星、金山、360以及百度等杀毒卫士软件在后台未经用户许可的情况下自动安装。 首先，我们要理解为什么这些杀毒软件会自动安装。通常，这可能是为了保持最新的病毒库，提供及时的防护，...
mysql电脑缺少dll文件下载_mysql.dll文件下载，金山毒霸dll修复工具帮您解决文件丢失导致“mysql.dll找不到”的系统问题...
weixin_39886956的博客
01-19 697
我该如何安装从金山毒霸下载的DLL文件？一：1、从金山毒霸下载压缩文件。2、将DLL文件解压到电脑上的某个地方。3、把该文件跟要求使用它的程序放在同一路径上。注意32位程序需要使用32位的DLL文件，64位程序需要使用64位的DLL文件。否则会出现0xc000007b报错。二：如果问题仍没有解决，把文件放到你的系统路径。它的替代路径是在：C:\Windows\System(Windows 95/9...
渗透测试各种扫描工具集合(好用)
鹿鸣天涯
12-01 4288
转载自security-360.cn，觉得里面一些信息收集和git的工具挺不错的，可以看看。 集合github平台上的安全行业从业者自研开源扫描器的仓库，包括子域名枚举，数据库漏洞扫描，弱口令或信息泄漏扫描，端口扫描，指纹识别以及其他大型扫描器或模块化扫描器。 项目地址：https://github.com/We5ter/Scanners-Box 子域名枚举扫描器或爆破工具 https://github.com/lijiejie/subDomainsBrute(lijiejie开发的一款使用广泛的子域名爆
解决Worm.Win32.AutoRun.soq 病毒
LaySolitary的博客
06-05 5554
X: 回车  X盘符1.搜索attrib –s –r –a –h autorun.inf2.删除del autorun.inf3.回复文件attrib -H -S X:\* /s /d
硬盘供电不足引起的系统不正常现象
weixin_33922670的博客
03-16 723
电脑硬盘无故在运行过程中消失，表现为缓存写入失败，检查盘符消失，系统运行异常，点击任何功能均报错。复位BIOS或拔插硬盘电源线后可以找回，但运行一段时间又报错。检查修复磁盘均无异常。后发现蓝屏提示为win32核心sys错误，提示关闭bios shadow之类的。复位bios并拔过电池。进入bios关闭bios映射选项。目前运行无异常。 注：在系统异常调试期间，日志里始终有一...
文件夹恶意软件WORM_AUTORUN.FIU处理
xiaoxiaodongshige的博客
05-18 2845
概述 感染现象 处理过程 善后概述这是一个很老的恶意软件。一般存在于老的校园网，打印店，通过U盘传播感染现象大多是U盘中的文件全部被隐藏了，然后变成文件夹.exe 或者链接文件。我通过360 或者脚本 去除文件夹隐藏，发现过了一会儿它又给我隐藏了。是的，就是这么坑处理过程我分析了一下，这个东东肯定是开机的时候启动了个啥进程常驻内存了。 1，我用任务管理器查看启动项，发现了个叫做 Program 的
hvm
qindwt1987的博客
11-19 261
模版引擎，模版引擎
紧急！360驱动360AntiHacker64导致系统夯机
weixin_33688840的博客
08-06 2432
最近很多客户Windows实例上发生360驱动360AntiHacker64.sys导致Windows系统non-paged pool耗尽，进而引起系统内存耗尽，系统无响应等症状的问题。这个问题影响非常广， non-paged pool过度使用 Windows上，non-paged pool是有线的资源，如果，可以使用任务管理器来查看未分页数，来看系统n...
360sd
weixin_30371875的博客
08-15 329
看上你了，呵呵 C:\Program Files\360\360sd\360AvFlt.sys C:\Program Files\360\360sd\deepscan\BAPIDRV.sys C:\Program Files\360\360sd\Hookport.sys C:\Program Files\360\360sd\qutmipc.sys C:\Program F...
瑞星杀毒软件高级企业版使用与注册指南
瑞星杀毒软件网络版高级企业版是一款专为企业设计的安全防护解决方案，旨在保护企业的计算机网络免受病毒、恶意软件和其他网络安全威胁的侵害。该手册是用户在使用这款软件前的重要参考文档，包含了关于软件安装、...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值