- 2009-11-27,21:36:03
- SystemRepairEngineer2.6.11.992Smallfrogs(http://www.KZTechs.com)
- WindowsXPHomeEditionServicePack3(Build2600)-管理权限用户-完整功能
- 以下内容被选中：所有的启动项目（包括注册表、启动文件夹、服务等）浏览器加载项正在运行的进程（包括进程模块信息）文件关联Winsock提供者Autorun.infHOSTS文件进程特权扫描
- 启动项目注册表[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]ctfmon.exeC:\WINDOWS\system32\ctfmon.exe[(Verified)MicrosoftWindowsComponentPublisher][HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]IMJPMIG8.1C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE/Spoil/RemAdvDef/Migration32[(Verified)MicrosoftWindowsComponentPublisher]PHIME2002ASyncC:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE/SYNC[(Verified)MicrosoftWindowsComponentPublisher]PHIME2002AC:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE/IMEName[(Verified)MicrosoftWindowsComponentPublisher]HighDefinitionAudioPropertyPageShortcutCHDAudPropShortcut.exe[Windows(R)Server2003DDKprovider]EnergyUtilityC:\ProgramFiles\Lenovo\EnergyCut\utilty.exe[TODO:Companyname]QkOnBtnC:\PROGRA~1\QBU\QkOnBtn.EXE[DritekSystemInc.]SynTPEnhC:\ProgramFiles\Synaptics\SynTP\SynTPEnh.exe[(Verified)MicrosoftWindowsHardwareCompatibilityPublisher]AVPC:\ProgramFiles\KasperskyLab\KasperskyAnti-Virus6.0\avp.exe[KasperskyLab]MicrosoftPinyinIMEMigrationC:\PROGRA~1\COMMON~1\MICROS~1\IME12\IMESC\IMSCMIG.EXE/INSTALL[(Verified)MicrosoftCorporation]ISUSPMStartupC:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe-startup[InstallShieldSoftwareCorporation]ISUSSchedulerC:\ProgramFiles\CommonFiles\InstallShield\UpdateService\issch.exe-start[InstallShieldSoftwareCorporation]NPSStartup[N/A]MazeSvrD:\ProgramFiles\天网Maze\MazeSvr.exe[][HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon]shellExplorer.exe[(Verified)MicrosoftWindowsComponentPublisher]UserinitC:\WINDOWS\system32\userinit.exe,[(Verified)MicrosoftWindowsComponentPublisher]UIHostlogonui.exe[(Verified)MicrosoftWindowsComponentPublisher][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]WPDShServiceObjC:\WINDOWS\system32\WPDShServiceObj.dll[(Verified)MicrosoftWindowsComponentPublisher][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\Notify\klogon]WinlogonNotify:klogonC:\WINDOWS\system32\klogon.dll[KasperskyLab][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ActiveSetup\InstalledComponents\{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]IE7UninstallStubC:\WINDOWS\system32\ieudinit.exe[(Verified)MicrosoftWindowsComponentPublisher][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ActiveSetup\InstalledComponents\{26923b43-4d38-484f-9b9e-de460746276c}]InternetExplorer%systemroot%\system32\shmgrate.exeOCInstallUserConfigIE[Fileismissing][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ActiveSetup\InstalledComponents\{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]OutlookExpress%systemroot%\system32\shmgrate.exeOCInstallUserConfigOE[Fileismissing][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ActiveSetup\InstalledComponents\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]ThemesSetup%SystemRoot%\system32\regsvr32.exe/s/n/i:/UserInstall%SystemRoot%\system32\themeui.dll[Fileismissing][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ActiveSetup\InstalledComponents\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]MicrosoftOutlookExpress6%ProgramFiles%\OutlookExpress\setup50.exe/APP:OE/CALLER:WINNT/user/install[Fileismissing][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ActiveSetup\InstalledComponents\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]NetMeeting3.01rundll32.exeadvpack.dll,LaunchINFSectionC:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT[(Verified)MicrosoftWindowsComponentPublisher][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ActiveSetup\InstalledComponents\{5945c046-1e7d-11d1-bc44-00c04fd912be}]WindowsMessenger4.7rundll32.exeadvpack.dll,LaunchINFSectionC:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser[(Verified)MicrosoftWindowsComponentPublisher][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ActiveSetup\InstalledComponents\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]MicrosoftWindowsMediaPlayerrundll32.exeadvpack.dll,LaunchINFSectionC:\WINDOWS\INF\wmp11.inf,PerUserStub[(Verified)MicrosoftWindowsComponentPublisher][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ActiveSetup\InstalledComponents\{7790769C-0471-11d2-AF11-00C04FA35D02}]通讯簿6%ProgramFiles%\OutlookExpress\setup50.exe/APP:WAB/CALLER:WINNT/user/install[Fileismissing][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]AdobeReaderSpeedLauncher;D:\ProgramFiles\Adobe\Reader8.0\Reader\Reader_sl.exe[(Verified)AdobeSystems,Incorporated]EnergyCut;C:\ProgramFiles\Lenovo\EnergyCut\EnergyCut.exe[][HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]Fetion;D:\ProgramFiles\ChinaMobile\Fetion\Fetion.exe[ChinaMobile]iTudouAutoStart;[N/A][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]NetpasAcc;[N/A]NvCplDaemon;RUNDLL32.EXEC:\WINDOWS\system32\NvCpl.dll,NvStartup[(Verified)MicrosoftWindowsHardwareCompatibilityPublisher]nwiz;nwiz.exe/install[][HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]QQDownload;[N/A][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]SmartAudio;C:\ProgramFiles\CONEXANT\SmartAudio\SmartAudio.exe-c[Conexant]TkBellExe;C:\ProgramFiles\CommonFiles\Real\Update_OB\realsched.exe-osboot[(Verified)RealNetworks,Inc.]WebThunder;[N/A]
- ==================================启动文件夹[1KG_unis]C:\DocumentsandSettings\Owner\LocalSettings\ApplicationData\Start\1KG_unis.lnk--C:\dosh\ghos\1KG_unis.bat[N/A]N
- ==================================服务[ApplicationManagement/AppMgmt][Stopped/ManualStart]C:\WINDOWS\system32\svchost.exe-knetsvcs--%SystemRoot%\System32\appmgmts.dllN/A[卡巴斯基反病毒6.0个人版/AVP][Running/AutoStart]C:\ProgramFiles\KasperskyLab\KasperskyAnti-Virus6.0\avp.exe-rKasperskyLab[ContrlCenterofStormMedia/ccosm][Running/AutoStart]d:\ProgramFiles\StormII\stormliv.exe/asservice北京暴风网际科技有限公司[FsUsbExService/FsUsbExService][Running/AutoStart]C:\WINDOWS\system32\FsUsbExService.ExeTeruten[ServiceLayer/ServiceLayer][Stopped/ManualStart]C:\ProgramFiles\PCConnectivitySolution\ServiceLayer.exeNokia.
- ==================================驱动程序[LenovoVirtualPowerControllerDriver/ACPIVPC][Running/ManualStart]system32\DRIVERS\AcpiVpc.sysLenovoCorporation[BroadcomNetXtremeGigabitEthernet/b57w2k][Running/ManualStart]system32\DRIVERS\b57xp32.sysBroadcomCorporation[DritekKeyboardFilterDriver/DKbFltr][Running/ManualStart]system32\DRIVERS\DKbFltr.sysDritekSystemInc.[MicrosoftUAAFunctionDriverforHighDefinitionAudioService/HdAudAddService][Running/ManualStart]system32\drivers\CHDAud.sysConexantSystemsInc.[Microsoft用于HighDefinitionAudio的UAA总线驱动程序/HDAudBus][Running/ManualStart]system32\DRIVERS\HDAudBus.sysWindows(R)Server2003DDKprovider[HSFHWAZL/HSFHWAZL][Running/ManualStart]system32\DRIVERS\HSFHWAZL.sysConexantSystems,Inc.[HSF_DPV/HSF_DPV][Running/ManualStart]system32\DRIVERS\HSF_DPV.sysConexantSystems,Inc.[kl1/kl1][Running/BootStart]\SystemRoot\system32\drivers\kl1.sysKasperskyLab[klif/klif][Running/SystemStart]\??\C:\WINDOWS\system32\drivers\klif.sysKasperskyLab[mdmxsdk/mdmxsdk][Running/AutoStart]system32\DRIVERS\mdmxsdk.sysConexant[MotorolaUSBCDCACMDriver/motmodem][Stopped/ManualStart]system32\DRIVERS\motmodem.sysMotorola[NetpasWin32VirtualNetworkAdapter/netpasadapter1][Stopped/ManualStart]system32\DRIVERS\netpas.sysNetpas[nv/nv][Running/]2-系统找不到指定的文件。N/A[PCCSModeChangeFilterDriver/pccsmcfd][Stopped/ManualStart]system32\DRIVERS\pccsmcfd.sysNokia[DirectParallelLinkDriver/Ptilink][Running/ManualStart]system32\DRIVERS\ptilink.sysParallelTechnologies,Inc.[Secdrv/Secdrv][Stopped/ManualStart]system32\DRIVERS\secdrv.sysMacrovisionCorporation,MacrovisionEuropeLimited,andMacrovisionJapanandAsiaK.K.[SAMSUNGUSBCompositeDevicedriver(WDM)/sscdbus][Stopped/ManualStart]system32\DRIVERS\sscdbus.sysMCCICorporation[SAMSUNGMobileModemFilter/sscdmdfl][Stopped/ManualStart]system32\DRIVERS\sscdmdfl.sysMCCICorporation[SAMSUNGMobileModemDrivers/sscdmdm][Stopped/ManualStart]system32\DRIVERS\sscdmdm.sysMCCICorporation[SynapticsTouchPadDriver/SynTP][Running/ManualStart]system32\DRIVERS\SynTP.sysSynaptics,Inc.[tifm21/tifm21][Running/ManualStart]system32\drivers\tifm21.sysTexasInstruments[TSP/TSP][Stopped/ManualStart]\??\C:\WINDOWS\system32\drivers\klif.sysKasperskyLab[ConexantSetupAPI/UIUSys][Stopped/ManualStart]system32\DRIVERS\UIUSYS.SYSConexantSystems,Inc[Intel(R)PRO/Wireless3945ABGAdapterDriver/w39n51][Running/ManualStart]system32\DRIVERS\w39n51.sysIntel?Corporation[winachsf/winachsf][Running/ManualStart]system32\DRIVERS\HSF_CNXT.sysConexantSystems,Inc.[FsUsbExDisk/FsUsbExDisk][Running/ManualStart]\??\C:\WINDOWS\system32\FsUsbExDisk.SYSN/A
- ==================================浏览器加载项[WebThunderBrowserHelper]{00000AAA-A363-466E-BEF5-9BB68697AA7F}d:\ProgramFiles\ThunderNetwork\WebThunder\WebThunderBHO_Now.dll,N/A[ThunderAtOnceClass]{01443AEC-0FD1-40fd-9C87-E93D1494C233}D:\ProgramFiles\ThunderNetwork\Thunder\ComDlls\TDAtOnce_Now.dll,深圳市迅雷网络技术有限公司[AdobePDFReaderLinkHelper]{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}C:\ProgramFiles\CommonFiles\Adobe\Acrobat\ActiveX\AcroIEHelper.dll,AdobeSystemsIncorporated[ThunderBrowserHelper]{889D2FEB-5411-4565-8998-1DD2C5261283}D:\ProgramFiles\ThunderNetwork\Thunder\ComDlls\xunleiBHO_Now.dll,深圳市迅雷网络技术有限公司[]{9E7F0F05-23CF-4575-9049-7DDB9D39AA8E}C:\PROGRA~1\FX678T~1\FX678T~1.DLL,[Download_BhoClass]{A986E409-30CC-4185-89BB-AB212C104524}C:\ProgramFiles\PPLiveVA\DownloaderManager.dll,Synacast[SafeMonClass]{B69F34DD-F0F9-42DC-9EDD-957187DA688D}D:\ProgramFiles\360safe\safemon\safemon.dll,360.CN[Web反病毒统计]{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E}C:\ProgramFiles\KasperskyLab\KasperskyAnti-Virus6.0\scieplugin.dll,KasperskyLab[联想]{6096E38F-5AC1-4391-8EC4-75DFA92FB32F}http://www.lenovo.com,N/A[信息检索(R)]{92780B25-18CC-41C8-B9BE-3C9C571A8263}C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL,MicrosoftCorporation[PPLive]{95B3F550-91C4-4627-BCC4-521288C52977}D:\新建文件夹(2)\PPLive\PPLive.exe,[]{e2e2dd38-d088-4134-82b7-f2ba38496583}%windir%\NetworkDiagnostic\xpnetdiag.exe,N/A[Messenger]{FB5F1910-F110-11d2-BB9E-00C04F795683}C:\ProgramFiles\Messenger\msmsgs.exe,MicrosoftCorporation[DLoaderClass]{78ABDC59-D8E7-44D3-9A76-9A0918C52B4A}C:\WINDOWS\DownloadedProgramFiles\downloader.dll,SinaCom[JavaPlug-in1.3.1_07]{8AD9C840-044E-11D1-B3E9-00805F499D93}D:\ProgramFiles\JavaSoft\JRE\1.3.1_07\bin\npjava131_07.dll,JavaSoft/SunMicrosystems,Inc.[CCTVUpdateInstall]{AC414988-E5BB-4C2C-873B-EA53D2F3D23A}C:\DocumentsandSettings\Owner\ApplicationData\CCTV\tv\CCTVUpdateInstall.dll,CCTVInternationalNetworksCo.,Ltd[JavaPlug-in1.3.1_07]{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}D:\ProgramFiles\JavaSoft\JRE\1.3.1_07\bin\npjava131_07.dll,JavaSoft/SunMicrosystems,Inc.[ShockwaveFlashObject]{D27CDB6E-AE6D-11CF-96B8-444553540000}C:\WINDOWS\system32\Macromed\Flash\Flash10c.ocx,AdobeSystems,Inc.[WebThunderBrowserHelper]{00000AAA-A363-466E-BEF5-9BB68697AA7F}d:\ProgramFiles\ThunderNetwork\WebThunder\WebThunderBHO_Now.dll,N/A[ThunderAtOnceClass]{01443AEC-0FD1-40FD-9C87-E93D1494C233}D:\ProgramFiles\ThunderNetwork\Thunder\ComDlls\TDAtOnce_Now.dll,深圳市迅雷网络技术有限公司[AdobePDFReaderLinkHelper]{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}C:\ProgramFiles\CommonFiles\Adobe\Acrobat\ActiveX\AcroIEHelper.dll,AdobeSystemsIncorporated[ULiveCtrlControl]{070CA17A-4BD2-4612-83B4-32B1B9159B48}C:\PROGRA~1\sina\SINAWE~1\307~1.1\UCLIVE~1.OCX,北京新浪信息技术有限公司[WebBrowserAppletControl]{08B0E5C0-4FCB-11CF-AAA5-00401C608501}C:\WINDOWS\system32\msjava.dll,MicrosoftCorporation[EyeOnIEClass]{10E1725C-7237-41A9-954A-04DCCB1FD16C},N/A[NetPlayerClass]{227BE258-BF0E-4ED9-96FD-55BFF469F08C}D:\ProgramFiles\TruePlayer\xnethlpr.dll,bofulnetworks[WindowsMediaPlayer]{22D6F312-B0F6-11D0-94AB-0080C74C7E95}C:\WINDOWS\system32\wmpdxm.dll,MicrosoftCorporation[HTMLDocument]{25336920-03F9-11CF-8FD0-00AA00686F13}C:\WINDOWS\system32\mshtml.dll,MicrosoftCorporation[XMLDOMDocument]{2933BF90-7B36-11D2-B20E-00C04F983E60}C:\WINDOWS\system32\msxml3.dll,MicrosoftCorporation[FreeThreadedXMLDOMDocument]{2933BF91-7B36-11D2-B20E-00C04F983E60}C:\WINDOWS\system32\msxml3.dll,MicrosoftCorporation[UUUpgradeControl]{2CACD7BB-1C59-4BBB-8E81-6E83F82C813B}C:\PROGRA~1\COMMON~1\uusee\UUUPGR~1.OCX,UUSSE[DHTMLEditControlSafeforScriptingforIE5]{2D360201-FFF5-11D1-8D03-00A0C959BC0A}C:\ProgramFiles\CommonFiles\MicrosoftShared\Triedit\dhtmled.ocx,MicrosoftCorporation[WebThunderDapPlayer]{2EEDA47E-8D5C-4d7e-B4B6-E16E19218555}d:\ProgramFiles\ThunderNetwork\WebThunder\DownAndPlay\DapPlayer3.0.5712.71.293.dll,N/A[RealPlayerRAMDownloadHandler]{2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93}C:\WINDOWS\system32\rmoc3260.dll,RealNetworks,Inc.[HtmlDlgSafeHelperClass]{3050F819-98B5-11CF-BB82-00AA00BDCE0B}C:\WINDOWS\system32\mshtmled.dll,MicrosoftCorporation[IETagFactory]{38481807-CA0E-42D2-BF39-B33AF135CC4D}C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\IETAG.DLL,MicrosoftCorporation[ceditinputClass]{41EA9C02-8924-40D6-B253-8FF447CFBB9A},N/A[XMLDocument]{48123BC4-99D9-11D1-A6B3-00C04FD91555}C:\WINDOWS\system32\msxml3.dll,MicrosoftCorporation[ThunderAgentClass]{485463B7-8FB2-4B3B-B29B-8B919B0EACCE}D:\ProgramFiles\ThunderNetwork\Thunder\ComDlls\ThunderAgent5.9.10.1144.dll,深圳市迅雷网络技术有限公司[MicrosoftTerminalServicesClientControl(redist)]{4eb89ff4-7f78-4a0f-8b8d-2bf02e94e4b2}%systemroot%\system32\mstscax.dll,N/A[MicrosoftTerminalServicesClientControl(redist)]{4EDCB26C-D24C-4e72-AF07-B576699AC0DE}%systemroot%\system32\mstscax.dll,N/A[HHCtrlObject]{52A2AAAE-085D-4187-97EA-8C30DB990436}C:\WINDOWS\system32\hhctrl.ocx,MicrosoftCorporation[ShellNameSpace]{55136805-B2DE-11D1-B9F2-00A0C98BC547}C:\WINDOWS\system32\ieframe.dll,MicrosoftCorporation[WUWebControlClass]{6414512B-B978-451D-A0D8-FCFDF33E833C}C:\WINDOWS\system32\wuweb.dll,MicrosoftCorporation[XMPClass]{6483F145-A768-4C41-AACC-52D4D7845851}C:\DocumentsandSettings\AllUsers\ApplicationData\ThunderNetwork\KanKan\xplayer.dll_1_work,[XDRM]{693571CB-54A3-4E90-9D52-EEAE1334E2D3}C:\DocumentsandSettings\AllUsers\ApplicationData\ThunderNetwork\KanKan\xdrm.dll_1_work,[StormPlayerObject]{6BE52E1D-E586-474F-A6E2-1A85A9B4D9FB}d:\ProgramFiles\StormII\mps.dll,北京暴风网际科技有限公司[WindowsMediaPlayer]{6BF52A52-394A-11D3-B153-00C04F79FAA6}C:\WINDOWS\system32\wmp.dll,MicrosoftCorporation[ActiveDesktopMover]{72267F6A-A6F9-11D0-BC94-00C04FB67863}%SystemRoot%\system32\SHELL32.dll,N/A[MicrosoftTerminalServicesClientControl(redist)]{7390f3d8-0439-4c05-91e3-cf5cb290c3d0}%systemroot%\system32\mstscax.dll,N/A[MicrosoftTerminalServicesClientControl(redist)]{7584c670-2274-4efb-b00b-d6aaba6d3850}%systemroot%\system32\mstscax.dll,N/A[MediaCommClass]{7670648D-461B-42AF-BDFE-46D26AF5EFF2}D:\ProgramFiles\ThunderNetwork\Thunder\userdata\Components\InMedia\MediaAddin.dll,深圳市迅雷网络技术有限公司[DLoaderClass]{78ABDC59-D8E7-44D3-9A76-9A0918C52B4A}C:\WINDOWS\DownloadedProgramFiles\downloader.dll,SinaCom[360SafeLive]{87515F61-A66C-4319-A0E0-D416CB8059E3}D:\ProgramFiles\360safe\live.dll,360.cn[MicrosoftWebBrowser]{8856F961-340A-11D0-A96B-00C04FD705A2}C:\WINDOWS\system32\ieframe.dll,MicrosoftCorporation[ThunderBrowserHelper]{889D2FEB-5411-4565-8998-1DD2C5261283}D:\ProgramFiles\ThunderNetwork\Thunder\ComDlls\xunleiBHO_Now.dll,深圳市迅雷网络技术有限公司[XMLDOMDocument4.0]{88D969C0-F192-11D4-A65F-0040963251E5}C:\WINDOWS\system32\msxml4.dll,MicrosoftCorporation[XMLHTTP4.0]{88D969C5-F192-11D4-A65F-0040963251E5}C:\WINDOWS\system32\msxml4.dll,MicrosoftCorporation[XMLDOMDocument5.0]{88D969E5-F192-11D4-A65F-0040963251E5}C:\ProgramFiles\CommonFiles\MicrosoftShared\OFFICE11\msxml5.dll,MicrosoftCorporation[XMLDOMDocument6.0]{88D96A05-F192-11D4-A65F-0040963251E5}C:\WINDOWS\system32\msxml6.dll,MicrosoftCorporation[MicrosoftTerminalServicesClientControl(redist)]{9059f30f-4eb1-4bd2-9fdc-36f43a218f4a}%systemroot%\system32\mstscax.dll,N/A[OFrameObjectClass]{9701758C-4373-482E-B13C-776C048EC890}C:\ProgramFiles\CommonFiles\ThunderNetwork\KanKan\DapCtrl.2.3.5910.236.(17).dll,深圳市迅雷网络技术有限公司[]{9E7F0F05-23CF-4575-9049-7DDB9D39AA8E}C:\PROGRA~1\FX678T~1\FX678T~1.DLL,[VersionDetectorClass]{9EFF1953-9694-47B1-AEF6-B2A3FE8BFE9B}C:\ProgramFiles\CommonFiles\ThunderNetwork\KanKan\vd.1.1.0.29.(20).dll,深圳市迅雷网络技术有限公司[APlayerControl]{A9322148-C691-4B9D-91FC-B9C461DBE9DD}C:\ProgramFiles\CommonFiles\ThunderNetwork\APlayer\APlayer_001.dll,ShenZhenThunderNetworkingTechnologies,LTD[Download_BhoClass]{A986E409-30CC-4185-89BB-AB212C104524}C:\ProgramFiles\PPLiveVA\DownloaderManager.dll,Synacast[RMGetLicenseClass]{A9FC132B-096D-460B-B7D5-1DB0FAE0C062}C:\WINDOWS\system32\msnetobj.dll,MicrosoftCorporation[CCTVUpdateInstall]{AC414988-E5BB-4C2C-873B-EA53D2F3D23A}C:\DocumentsandSettings\Owner\ApplicationData\CCTV\tv\CCTVUpdateInstall.dll,CCTVInternationalNetworksCo.,Ltd[DapCtrlClass]{ACACC6EB-1FBA-4E13-A729-53AEB2DF54F8}C:\ProgramFiles\CommonFiles\ThunderNetwork\KanKan\DapCtrl.2.3.5910.236.(17).dll,深圳市迅雷网络技术有限公司[MicrosoftScriptletComponent]{AE24FDAE-03C6-11D1-8B76-0080C744F389}C:\WINDOWS\system32\mshtml.dll,MicrosoftCorporation[NetLoginClass]{B3785E38-ACE9-4002-A604-D950C413C83D}D:\ProgramFiles\TruePlayer\xnethlpr.dll,bofulnetworks[SearchAssistantOC]{B45FF030-4447-11D2-85DE-00C04FA35C89}%SystemRoot%\system32\shdocvw.dll,N/A[SafeMonClass]{B69F34DD-F0F9-42DC-9EDD-957187DA688D}D:\ProgramFiles\360safe\safemon\safemon.dll,360.CN[RDS.DataSpace]{BD96C556-65A3-11D0-983A-00C04FC29E36}C:\ProgramFiles\CommonFiles\system\msadc\msadco.dll,MicrosoftCorporation[KooPlayerControl]{C728DAB8-FDF5-4CD7-89DD-879D25794C77}C:\DOCUME~1\Owner\APPLIC~1\CCTV\tv\CCTVPL~1.OCX,CCTV.COM[AUDIO__MP3MonikerClass]{CD3AFA76-B84F-48F0-9393-7EDC34128127}C:\WINDOWS\system32\wmp.dll,MicrosoftCorporation[AUDIO__X_MS_WMAMonikerClass]{CD3AFA84-B84F-48F0-9393-7EDC34128127}C:\WINDOWS\system32\wmp.dll,MicrosoftCorporation[VIDEO__X_MS_ASFMonikerClass]{CD3AFA8F-B84F-48F0-9393-7EDC34128127}C:\WINDOWS\system32\wmp.dll,MicrosoftCorporation[VIDEO__X_MS_WMVMonikerClass]{CD3AFA94-B84F-48F0-9393-7EDC34128127}C:\WINDOWS\system32\wmp.dll,MicrosoftCorporation[RealPlayerG2Control]{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA}C:\WINDOWS\system32\rmoc3260.dll,RealNetworks,Inc.[ShockwaveFlashObject]{D27CDB6E-AE6D-11CF-96B8-444553540000}C:\WINDOWS\system32\Macromed\Flash\Flash10c.ocx,AdobeSystems,Inc.[myIEDogSita]{DE0DDC2E-E6C9-4514-A8A3-D8B335594332},N/A[QuickTimeCheckClass]{DE4AF3B0-F4D4-11D3-B41A-0050DA2E6C21}d:\ProgramFiles\StormII\Codec\QTSystem\QTCheck.ocx,AppleComputer,Inc.[UPlayerControl]{EAB7A1CC-C77B-45E5-9AC2-AD037D047BCC}C:\PROGRA~1\COMMON~1\uusee\SEEPLA~1.OCX,UUSEE[XMLHTTPRequest]{ED8C108E-4349-11D2-91A4-00C04F7969E8}C:\WINDOWS\system32\msxml3.dll,MicrosoftCorporation[ThunderDapCtrl]{EF1EA76E-5428-4e40-85A1-D4DD2893183A}d:\ProgramFiles\ThunderNetwork\WebThunder\DownAndPlay\DapCtrl1.3.17.20.996.dll,N/A[XPPlayerClass]{F3E70CEA-956E-49CC-B444-73AFE593AD7F}C:\ProgramFiles\CommonFiles\ThunderNetwork\KanKan\PPlayer.2.1.59050.255.(20).dll,深圳市迅雷网络技术有限公司[XMLDOMDocument3.0]{F5078F32-C551-11D3-89B9-0000F81FE221}C:\WINDOWS\system32\msxml3.dll,MicrosoftCorporation[XMLHTTP3.0]{F5078F35-C551-11D3-89B9-0000F81FE221}C:\WINDOWS\system32\msxml3.dll,MicrosoftCorporation[XMLDOMDocument]{F6D90F11-9C73-11D3-B32E-00C04F990BB4}C:\WINDOWS\system32\msxml3.dll,MicrosoftCorporation[XMLHTTP]{F6D90F16-9C73-11D3-B32E-00C04F990BB4}C:\WINDOWS\system32\msxml3.dll,MicrosoftCorporation[IERPCtlClass]{FDC7A535-4070-4B92-A0EA-D9994BCC0DC5}D:\ProgramFiles\rpplugins\ierpplug.dll,RealNetworks,Inc.[AddContentasNoteExpress2Note]D:\ProgramFiles\NoteExpress2\BrowserExt\IEContext_Content_Note.htm,N/A[AddContentasNoteExpress2Reference]D:\ProgramFiles\NoteExpress2\BrowserExt\IEContext_Content_Ref.htm,N/A[AddURLasNoteExpress2Reference]D:\ProgramFiles\NoteExpress2\BrowserExt\IEContext_Url_Ref.htm,N/A[使用iTudou下载节目],N/A[使用UUSee下载]d:\ProgramFiles\uusee\geturltodown.htm,N/A[使用UUSee加速播放]d:\ProgramFiles\uusee\geturltoplay.htm,N/A[使用WEB迅雷下载],N/A[使用WEB迅雷下载全部链接],N/A[使用迅雷下载]D:\ProgramFiles\ThunderNetwork\Thunder\Program\GetUrl.htm,N/A[使用迅雷下载全部链接]D:\ProgramFiles\ThunderNetwork\Thunder\Program\GetAllUrl.htm,N/A[导出到MicrosoftExcel(X)]res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000,N/A[添加为NoteExpress笔记],N/A[添加为NoteExpress题录],N/A[添加到QQ表情]d:\ProgramFiles\Tencent\QQ\AddEmotion.htm,N/A
- ==================================正在运行的进程[PID:876/SYSTEM][\SystemRoot\System32\smss.exe][MicrosoftCorporation,5.1.2600.5512(xpsp.080413-2111)][PID:932/SYSTEM][\??\C:\WINDOWS\system32\csrss.exe][MicrosoftCorporation,5.1.2600.5512(xpsp.080413-2111)][PID:960/SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe][MicrosoftCorporation,5.1.2600.5512(xpsp.080413-2113)][C:\WINDOWS\system32\klogon.dll][KasperskyLab,6.0.2.621][C:\WINDOWS\system32\SOGOUPY.IME][Sogou.comInc.,4.3.0.3315][PID:1008/SYSTEM][C:\WINDOWS\system32\services.exe][MicrosoftCorporation,5.1.2600.5755(xpsp_sp3_gdr.090206-1234)][PID:1020/SYSTEM][C:\WINDOWS\system32\lsass.exe][MicrosoftCorporation,5.1.2600.5512(xpsp.080413-2113)][PID:1188/SYSTEM][C:\WINDOWS\system32\svchost.exe][MicrosoftCorporation,5.1.2600.5512(xpsp.080413-2111)][PID:1256/NETWORKSERVICE][C:\WINDOWS\system32\svchost.exe][MicrosoftCorporation,5.1.2600.5512(xpsp.080413-2111)][PID:1408/SYSTEM][C:\WINDOWS\System32\svchost.exe][MicrosoftCorporation,5.1.2600.5512(xpsp.080413-2111)][PID:1508/NETWORKSERVICE][C:\WINDOWS\system32\svchost.exe][MicrosoftCorporation,5.1.2600.5512(xpsp.080413-2111)][PID:1608/LOCALSERVICE][C:\WINDOWS\system32\svchost.exe][MicrosoftCorporation,5.1.2600.5512(xpsp.080413-2111)][PID:1916/SYSTEM][C:\WINDOWS\system32\spoolsv.exe][MicrosoftCorporation,5.1.2600.5512(xpsp.080413-0852)][PID:560/Owner][C:\WINDOWS\Explorer.EXE][MicrosoftCorporation,6.00.2900.5512(xpsp.080413-2105)][C:\WINDOWS\system32\SOGOUPY.IME][Sogou.comInc.,4.3.0.3315][C:\ProgramFiles\KasperskyLab\KasperskyAnti-Virus6.0\scrchpg.dll][KasperskyLab,6.0.2.621][C:\ProgramFiles\CommonFiles\Adobe\Acrobat\ActiveX\PDFShell.dll][AdobeSystems,Inc.,8.1.0.0][C:\ProgramFiles\CommonFiles\Adobe\Acrobat\ActiveX\PDFShell.CHS][AdobeSystems,Inc.,8.0.0.0][C:\WINDOWS\system32\ATL71.DLL][MicrosoftCorporation,7.10.3077.0][C:\WINDOWS\system32\MSVCP71.dll][MicrosoftCorporation,7.10.3077.0][C:\WINDOWS\system32\MSVCR71.dll][MicrosoftCorporation,7.10.3052.4][D:\ProgramFiles\ThunderNetwork\Thunder\ComDlls\xunleiBHO_Now.dll][深圳市迅雷网络技术有限公司,5,9,10,1144][D:\ProgramFiles\ThunderNetwork\Thunder\userdata\Components\ResWorker\DsBho_00.dll][深圳市迅雷网络技术有限公司,1,0,0,26][D:\ProgramFiles\ThunderNetwork\Thunder\userdata\Components\ResWorker\DataProcessor_00.dll][深圳市迅雷网络技术有限公司,1,0,0,20][C:\PROGRA~1\FX678T~1\FX678T~1.DLL][,7.0.0.1][C:\WINDOWS\system32\nvcpl.dll][NVIDIACorporation,6.14.10.8466][C:\WINDOWS\system32\NVRSZHC.DLL][NVIDIACorporation,6.14.10.8466][C:\WINDOWS\system32\nvshell.dll][,][C:\ProgramFiles\KasperskyLab\KasperskyAnti-Virus6.0\prremote.dll][KasperskyLab,6.0.2.621][C:\ProgramFiles\KasperskyLab\KasperskyAnti-Virus6.0\prloader.dll][KasperskyLab,6.0.2.621][C:\ProgramFiles\WinRAR\rarext.dll][N/A,][C:\ProgramFiles\KasperskyLab\KasperskyAnti-Virus6.0\ShellEx.dll][KasperskyLab,6.0.2.621][C:\WINDOWS\system32\TudouUpload.dll][www.Tudou.com,1.1.0.0][PID:616/Owner][d:\ProgramFiles\SogouInput\4.3.0.3315\sogoupinyintray.exe][Sogou.comInc.,4.3.0.3315][PID:836/Owner][C:\ProgramFiles\Lenovo\EnergyCut\utilty.exe][TODO:Companyname,1.0.0.1][C:\WINDOWS\system32\SOGOUPY.IME][Sogou.comInc.,4.3.0.3315][PID:844/Owner][C:\PROGRA~1\QBU\QkOnBtn.EXE][DritekSystemInc.,1,0,0,421][C:\PROGRA~1\QBU\ComFnUtl.dll][DritekSystemInc.,1,0,0,605][C:\PROGRA~1\QBU\Wnd2File.dll][DritekSystemInc.,3.00][C:\PROGRA~1\QBU\SzUPFUtl.dll][DritekSystemInc.,1.00][C:\PROGRA~1\QBU\OSDUtl.dll][DritekSystemInc.,1,1,1,309][C:\PROGRA~1\QBU\RgnMaker.dll][DritekSystemInc.,12.07.1999(VC60)][C:\PROGRA~1\QBU\CDRomUtl.dll][DritekSystemInc.,1.00][C:\PROGRA~1\QBU\MixerUtl.dll][DritekSystemInc.,1.00][C:\PROGRA~1\QBU\LgKCUtl.dll][DritekSystemInc.,2,0,2,1007][C:\WINDOWS\system32\SOGOUPY.IME][Sogou.comInc.,4.3.0.3315][C:\PROGRA~1\QBU\MMDUtl.DLL][DritekSystemInc.,1,2,4,4914][C:\WINDOWS\system32\NvCpl.dll][NVIDIACorporation,6.14.10.8466][C:\WINDOWS\system32\NVRSZHC.DLL][NVIDIACorporation,6.14.10.8466][PID:856/Owner][C:\ProgramFiles\Synaptics\SynTP\SynTPEnh.exe][Synaptics,Inc.,8.3.816Jun06][C:\WINDOWS\system32\SynCOM.dll][Synaptics,Inc.,8.3.816Jun06][C:\WINDOWS\system32\SOGOUPY.IME][Sogou.comInc.,4.3.0.3315][C:\WINDOWS\system32\SynTPAPI.dll][Synaptics,Inc.,8.3.816Jun06][PID:1088/Owner][C:\ProgramFiles\CommonFiles\InstallShield\UpdateService\issch.exe][InstallShieldSoftwareCorporation,3,00,100,1161][PID:1336/Owner][C:\WINDOWS\system32\ctfmon.exe][MicrosoftCorporation,5.1.2600.5512(xpsp.080413-2105)][C:\WINDOWS\system32\SOGOUPY.IME][Sogou.comInc.,4.3.0.3315][PID:1376/LOCALSERVICE][C:\WINDOWS\system32\svchost.exe][MicrosoftCorporation,5.1.2600.5512(xpsp.080413-2111)][PID:1528/SYSTEM][d:\ProgramFiles\StormII\stormliv.exe][北京暴风网际科技有限公司,3,8,6,20][PID:1680/SYSTEM][C:\WINDOWS\system32\FsUsbExService.Exe][Teruten,1,0,0,5][PID:2844/LOCALSERVICE][C:\WINDOWS\System32\alg.exe][MicrosoftCorporation,5.1.2600.5512(xpsp.080413-0852)][PID:3560/Owner][C:\WINDOWS\system32\wuauclt.exe][MicrosoftCorporation,7.4.7600.226(winmain_wtr_wsus3sp2(wmbla).090806-1834)][PID:3608/SYSTEM][C:\WINDOWS\system32\svchost.exe][MicrosoftCorporation,5.1.2600.5512(xpsp.080413-2111)][PID:2888/Owner][D:\ProgramFiles\MozillaFirefox\firefox.exe][MozillaCorporation,1.9.0.6][D:\ProgramFiles\MozillaFirefox\xul.dll][MozillaFoundation,1.9.0.6][D:\ProgramFiles\MozillaFirefox\sqlite3.dll][sqlite.org,3.5.9][D:\ProgramFiles\MozillaFirefox\MOZCRT19.dll][MozillaFoundation,8.00.0000][D:\ProgramFiles\MozillaFirefox\js3250.dll][NetscapeCommunicationsCorporation,4.0][D:\ProgramFiles\MozillaFirefox\nspr4.dll][MozillaFoundation,4.7.3][D:\ProgramFiles\MozillaFirefox\smime3.dll][MozillaFoundation,3.12.2.0BasicECC][D:\ProgramFiles\MozillaFirefox\nss3.dll][MozillaFoundation,3.12.2.0BasicECC][D:\ProgramFiles\MozillaFirefox\nssutil3.dll][MozillaFoundation,3.12.2.0BasicECC][D:\ProgramFiles\MozillaFirefox\plc4.dll][MozillaFoundation,4.7.3][D:\ProgramFiles\MozillaFirefox\plds4.dll][MozillaFoundation,4.7.3][D:\ProgramFiles\MozillaFirefox\ssl3.dll][MozillaFoundation,3.12.2.0BasicECC][D:\ProgramFiles\MozillaFirefox\xpcom.dll][MozillaFoundation,1.9.0.6][C:\WINDOWS\system32\SOGOUPY.IME][Sogou.comInc.,4.3.0.3315][D:\ProgramFiles\MozillaFirefox\components\browserdirprovider.dll][MozillaFoundation,1.9.0.6][C:\DocumentsandSettings\Owner\ApplicationData\Mozilla\Firefox\Profiles\uj5kcc39.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metricsloader.dll][N/A,][C:\DocumentsandSettings\Owner\ApplicationData\Mozilla\Firefox\Profiles\uj5kcc39.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\metrics-ff3.dll][N/A,][C:\DocumentsandSettings\Owner\ApplicationData\Mozilla\Firefox\Profiles\uj5kcc39.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll][N/A,][C:\DocumentsandSettings\Owner\ApplicationData\Mozilla\Firefox\Profiles\uj5kcc39.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll][N/A,][D:\ProgramFiles\MozillaFirefox\softokn3.dll][MozillaFoundation,3.12.2.0BasicECC][D:\ProgramFiles\MozillaFirefox\nssdbm3.dll][MozillaFoundation,3.12.2.0BasicECC][D:\ProgramFiles\MozillaFirefox\freebl3.dll][MozillaFoundation,3.12.2.0BasicECC][D:\ProgramFiles\MozillaFirefox\nssckbi.dll][MozillaFoundation,1.73][D:\ProgramFiles\MozillaFirefox\components\brwsrcmp.dll][MozillaFoundation,1.9.0.6][C:\ProgramFiles\KasperskyLab\KasperskyAnti-Virus6.0\scrchpg.dll][KasperskyLab,6.0.2.621][C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll][,][C:\WINDOWS\system32\icm32.dll][MicrosoftCorporation,5.1.2600.5512(xpsp.080413-2105)][PID:2476/Owner][C:\WINDOWS\system32\conime.exe][MicrosoftCorporation,5.1.2600.5512(xpsp.080413-2105)][C:\WINDOWS\system32\SOGOUPY.IME][Sogou.comInc.,4.3.0.3315][PID:3396/Owner][C:\DocumentsandSettings\Owner\桌面\SReng.v2.6.Final\SREngLdr.EXE][SmallfrogsStudio,2.6.11.992][PID:3076/Owner][C:\DocumentsandSettings\Owner\桌面\SReng.v2.6.Final\SRE8a0df7fe.EXE][SmallfrogsStudio,2.6.11.992][C:\WINDOWS\system32\SOGOUPY.IME][Sogou.comInc.,4.3.0.3315][C:\DocumentsandSettings\Owner\桌面\SReng.v2.6.Final\Upload\3rdUpd.DLL][SmallfrogsStudio,2,1,0,15]
- ==================================文件关联.TXTError.[C:\WINDOWS\notepad.exe%1].EXEOK.[%1%*].COMOK.[%1%*].PIFOK.[%1%*].REGOK.[regedit.exe%1].BATOK.[%1%*].SCROK.[%1/S].CHMError.[hh.exe%1].HLPOK.[%SystemRoot%\System32\winhlp32.exe%1].INIError.[C:\WINDOWS\System32\NOTEPAD.EXE%1].INFOK.[%SystemRoot%\System32\NOTEPAD.EXE%1].VBSOK.[%SystemRoot%\System32\WScript.exe%1%*].JSOK.[%SystemRoot%\System32\WScript.exe%1%*].LNKOK.[{00021401-0000-0000-C000-000000000046}]
- ==================================Winsock提供者N/A
- ==================================Autorun.infN/A
- ==================================HOSTS文件127.0.0.1localhost
- ==================================进程特权扫描特殊特权被允许：SeLoadDriverPrivilege[PID=836,C:\PROGRAMFILES\LENOVO\ENERGYCUT\UTILTY.EXE]特殊特权被允许：SeLoadDriverPrivilege[PID=844,C:\PROGRA~1\QBU\QKONBTN.EXE]特殊特权被允许：SeLoadDriverPrivilege[PID=1088,C:\PROGRAMFILES\COMMONFILES\INSTALLSHIELD\UPDATESERVICE\ISSCH.EXE]特殊特权被允许：SeLoadDriverPrivilege[PID=3396,C:\DOCUMENTSANDSETTINGS\OWNER\桌面\SRENG.V2.6.FINAL\SRENGLDR.EXE]
- ==================================APIHOOKRVA错误：LoadLibraryA(危险等级:高,被下面模块所HOOK:\??\C:\WINDOWS\system32\drivers\klif.sys)RVA错误：LoadLibraryExA(危险等级:高,被下面模块所HOOK:\??\C:\WINDOWS\system32\drivers\klif.sys)RVA错误：LoadLibraryExW(危险等级:高,被下面模块所HOOK:\??\C:\WINDOWS\system32\drivers\klif.sys)RVA错误：LoadLibraryW(危险等级:高,被下面模块所HOOK:\??\C:\WINDOWS\system32\drivers\klif.sys)RVA错误：GetProcAddress(危险等级:高,被下面模块所HOOK:\??\C:\WINDOWS\system32\drivers\klif.sys)
- ==================================隐藏进程N/A
- ==================================
WindBellKL (WindBell-卡拉|多做总比不做好) 在 ta 的帖子中提到：IE是个特殊快捷方式，本来就没有小箭头请先参考置顶Log
|
