【原创】请教高手,分析下我的SREng 的LOG bbs.ikaka.com

Deakins - 2006-10-25 16:40:00

好吧..

- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
<MsnMsgr><"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background> [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Corporation]
<HControl><C:\WINDOWS\ATK0100\HControl.exe> [(Verified)]
<NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [(Verified)NVIDIA Corporation]
<nwiz><nwiz.exe /install> [N/A]
<NvMediaCenter><RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit> [(Verified)NVIDIA Corporation]
<RemoteControl><"C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe"> [Cyberlink Corp.]
<NeroFilterCheck><C:\WINDOWS\system32\NeroCheck.exe> [Ahead Software Gmbh]
<SynTPEnh><C:\Program Files\Synaptics\SynTP\SynTPEnh.exe> [(Verified)Synaptics, Inc.]
<Wireless Console 2><C:\Program Files\Wireless Console 2\wcourier.exe> [N/A]
<IntelZeroConfig><"C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"> [Intel Corporation]
<IntelWireless><"C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless> [Intel Corporation]
<EOUApp><"C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe"> [Intel Corporation]
<ATKMEDIA><C:\Program Files\ASUS\ATK Media\DMEDIA.EXE> [ASUSTeK Computer INC.]
<ASUS Live Update><C:\Program Files\ASUS\ASUS Live Update\ALU.exe> [N/A]
<Power_Gear><C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1> [N/A]
<ACMON><C:\Program Files\ASUS\Splendid\ACMON.exe> [ATK]
<ABLKSR><C:\WINDOWS\ABLKSR\ABLKSR.exe> [ASYSTeK Computer INC.]
<SMSERIAL><sm56hlpr.exe> [(Verified)Motorola Inc.]
<SoundMam><C:\WINDOWS\system32\svohost.exe> [N/A]
<IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload> [(Verified)Microsoft Corporation]
<kis><"D:\资料\卡巴斯基\kis6.sch\avp.exe"> [Kaspersky Lab]
<!ewido><"D:\资料\ewido4.0杀木马\ewido4.0\ewido anti-spyware 4.0\ewido.exe" /minimized> [Anti-Malware Development a.s.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><D:\资料\卡巴斯基\kis6.sch\adialhk.dll> [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{57B86673-276A-48B2-BAE7-C6DBB3020EB8}><D:\资料\ewido4.0杀木马\ewido4.0\ewido anti-spyware 4.0\shellexecutehook.dll> [Anti-Malware Development a.s.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
<WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll> [Kaspersky Lab]

==================================
启动文件夹
N/A

==================================
服务
[Application Management / AppMgmt]
<C:\WINDOWS\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\appmgmts.dll><N/A>
[卡巴斯基互联网安全套装 6.0 / AVP]
<D:\资料\卡巴斯基\kis6.sch\avp.exe -r><Kaspersky Lab>
[Intel(R) PROSet/Wireless Event Log / EvtEng]
<C:\Program Files\Intel\Wireless\Bin\EvtEng.exe><Intel Corporation>
[ewido anti-spyware 4.0 guard / ewido anti-spyware 4.0 guard]
<D:\资料\ewido4.0杀木马\ewido4.0\ewido anti-spyware 4.0\guard.exe><Anti-Malware Development a.s.>
[Human Interface Device Access / HidServ]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[NVIDIA Display Driver Service / NVSvc]
<C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[Intel(R) PROSet/Wireless Registry Service / RegSrvc]
<C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe><Intel Corporation>
[Intel(R) PROSet/Wireless Service / S24EventMonitor]
<C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe><Intel Corporation>

Deakins - 2006-10-25 16:41:00

==================================
驱动程序
[ADI UAA Function Driver for High Definition Audio Service / ADIHdAudAddService]
<system32\drivers\ADIHdAud.sys><Analog Devices, Inc.>
[AEGIS Protocol (IEEE 802.1x) v3.4.10.0 / AegisP]
<system32\DRIVERS\AegisP.sys><Meetinghouse Data Communications>
[EagleNT / EagleNT]
<\??\C:\WINDOWS\system32\drivers\EagleNT.sys><N/A>
[ewido anti-spyware 4.0 driver / ewido anti-spyware 4.0 driver]
<\??\D:\资料\ewido4.0杀木马\ewido4.0\ewido anti-spyware 4.0\guard.sys><N/A>
[ExpScaner / ExpScaner]
<\??\C:\Program Files\Rising\Rav\ExpScan.sys><N/A>
[Microsoft 用于 High Definition Audio 的 UAA 总线驱动程序 / HDAudBus]
<system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
[HookCont / HookCont]
<\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><N/A>
[HookReg / HookReg]
<\??\C:\Program Files\Rising\Rav\HookReg.sys><N/A>
[HookSys / HookSys]
<\??\C:\Program Files\Rising\Rav\HookSys.sys><N/A>
[ipswuio / ipswuio]
<System32\DRIVERS\ipswuio.sys><Windows (R) 2000 DDK provider>
[kl1 / kl1]
<\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif]
<\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[MEMSCAN / MEMSCAN]
<\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><N/A>
[ATK0100 ACPI UTILITY / MTsensor]
<system32\DRIVERS\ATKACPI.sys><>
[nv / nv]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[rimmptsk / rimmptsk]
<system32\DRIVERS\rimmptsk.sys><REDC>
[rimsptsk / rimsptsk]
<system32\DRIVERS\rimsptsk.sys><REDC>
[Ricoh xD-Picture Card Driver / rismxdp]
<system32\DRIVERS\rixdptsk.sys><REDC>
[Realtek 10/100/1000 NIC Family all in one NDIS XP Driver / RTL8023xp]
<system32\DRIVERS\Rtenicxp.sys><Realtek Semiconductor Corporation>
[WLAN 传输 / s24trans]
<system32\DRIVERS\s24trans.sys><Intel Corporation>
[Secdrv / Secdrv]
<system32\DRIVERS\secdrv.sys><N/A>
[SMSC IrCC Miniport Device Driver / SMCIRDA]
<system32\DRIVERS\smcirda.sys><SMSC>
[smserial / smserial]
<system32\DRIVERS\smserial.sys><Motorola Inc.>
[Synaptics TouchPad Driver / SynTP]
<system32\DRIVERS\SynTP.sys><Synaptics, Inc.>
[TSP / TSP]
<\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[Vimicro USB PC Camera (VC0321) / usbvm321]
<System32\Drivers\usbvm321.sys><Vimicro Corporation>
[Intel(R) PRO/Wireless 3945ABG Adapter Driver / w39n51]
<system32\DRIVERS\w39n51.sys><Intel? Corporation>

==================================
浏览器加载项
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <D:\资料\迅雷5\ComDlls\XunLeiBHO_002.dll, N/A>
[启动迅雷]
{0062C9BD-B349-40DE-91A0-755F37ACD559} <D:\资料\迅雷5\Thunder.exe, N/A>
[Web反病毒保护]
{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <D:\资料\卡巴斯基\kis6.sch\scieplugin.dll, Kaspersky Lab>
[信息检索(&R)]
{92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <D:\资料\迅雷5\ComDlls\XunLeiBHO_002.dll, N/A>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash.ocx, Macromedia, Inc.>
[&使用迅雷下载]
<D:\资料\迅雷5\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
<D:\资料\迅雷5\Program\GetAllUrl.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>

Deakins - 2006-10-25 16:43:00

==================================
正在运行的进程
[PID: 960][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1028][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1056][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\klogon.dll] [Kaspersky Lab, 6.0.0.299]
[PID: 1100][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1112][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1276][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1340][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1380][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\资料\卡巴斯基\kis6.sch\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[PID: 1440][C:\Program Files\Intel\Wireless\Bin\EvtEng.exe] [Intel Corporation, 10, 1, 1, 1]
[C:\Program Files\Intel\Wireless\Bin\PsRegApi.dll] [Intel Corporation, 10, 1, 1, 2]
[C:\Program Files\Intel\Wireless\Bin\TraceAPI.DLL] [Intel Corporation, 10, 1, 1, 5]
[PID: 1472][C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe] [Intel Corporation , 10, 1, 1, 34]
[C:\Program Files\Intel\Wireless\Bin\TraceAPI.DLL] [Intel Corporation, 10, 1, 1, 5]
[C:\Program Files\Intel\Wireless\Bin\PsRegApi.dll] [Intel Corporation, 10, 1, 1, 2]
[C:\Program Files\Intel\Wireless\Bin\LIBEAY32.dll] [N/A, N/A]
[C:\Program Files\Intel\Wireless\Bin\IntStngs.dll] [, 10, 1, 1, 3]
[C:\Program Files\Intel\Wireless\Bin\IWMSPROV.DLL] [N/A, N/A]
[PID: 1596][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1640][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1956][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 288][C:\WINDOWS\system32\nvsvc32.exe] [NVIDIA Corporation, 6.14.10.8426]
[PID: 352][C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe] [Intel Corporation, 10, 1, 1, 1]
[PID: 396][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2004][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\winscok.dll] [N/A, N/A]
[D:\资料\ewido4.0杀木马\ewido4.0\ewido anti-spyware 4.0\shellexecutehook.dll] [Anti-Malware Development a.s., 4, 0, 0, 172]
[c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 7.0.0.2004121400]
[c:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 7.0.0.0]
[C:\WINDOWS\system32\nvcpl.dll] [NVIDIA Corporation, 6.14.10.8426]
[C:\WINDOWS\system32\NVRSZHC.DLL] [NVIDIA Corporation, 6.14.10.8426]
[C:\WINDOWS\system32\nvshell.dll] [N/A, N/A]
[C:\Program Files\WinRAR\rarext.dll] [N/A, N/A]
[D:\资料\ewido4.0杀木马\ewido4.0\ewido anti-spyware 4.0\context.dll] [Anti-Malware Development a.s., 4, 0, 0, 172]
[D:\资料\卡巴斯基\kis6.sch\shellex.dll] [Kaspersky Lab, 6.0.0.299]
[PID: 1160][C:\WINDOWS\ATK0100\HControl.exe] [, 1043, 2, 15, 58]
[C:\WINDOWS\ATK0100\CMSSC.dll] [N/A, N/A]
[C:\WINDOWS\ATK0100\inter_f2.dll] [ATK, 1043, 2, 15, 52]
[C:\WINDOWS\ATK0100\ATKWLIOC.DLL] [ACTIONTEC Electronics,Inc, 2.01.02]
[C:\WINDOWS\ATK0100\SiSPkt.dll] [Silicon Integrated Systems Corp., 1, 0, 0, 45]
[C:\Program Files\Intel\Wireless\Bin\MurocApi.dll] [Intel Corporation, 10, 1, 1, 39]
[C:\Program Files\Intel\Wireless\Bin\S24MUDLL.dll] [Intel Corporation, 10, 1, 1, 1]
[C:\Program Files\Intel\Wireless\Bin\PsRegApi.dll] [Intel Corporation, 10, 1, 1, 2]
[C:\Program Files\Intel\Wireless\Bin\TraceAPI.DLL] [Intel Corporation, 10, 1, 1, 5]
[C:\Program Files\Intel\Wireless\Bin\IntStngs.dll] [, 10, 1, 1, 3]
[C:\Program Files\Intel\Wireless\Bin\LIBEAY32.dll] [N/A, N/A]
[C:\WINDOWS\system32\SynCOM.dll] [Synaptics, Inc., 8.2.0 21Oct05]
[C:\WINDOWS\system32\winscok.dll] [N/A, N/A]
[PID: 1540][C:\WINDOWS\system32\RUNDLL32.EXE] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\NvMcTray.dll] [NVIDIA Corporation, 6.14.10.8426]
[C:\WINDOWS\system32\NVRSZHC.DLL] [NVIDIA Corporation, 6.14.10.8426]
[C:\WINDOWS\system32\winscok.dll] [N/A, N/A]
[PID: 1560][C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe] [Cyberlink Corp., 6.00.1027]
[C:\Program Files\ASUSTeK\ASUSDVD\CLRCEngine2.dll] [CyberLink Corp., 3.2.2021 ]
[C:\WINDOWS\system32\winscok.dll] [N/A, N/A]
[PID: 1632][C:\Program Files\Synaptics\SynTP\SynTPEnh.exe] [Synaptics, Inc., 8.2.0 21Oct05]
[C:\WINDOWS\system32\SynCOM.dll] [Synaptics, Inc., 8.2.0 21Oct05]
[C:\WINDOWS\system32\SynTPAPI.dll] [Synaptics, Inc., 8.2.0 21Oct05]
[C:\WINDOWS\system32\winscok.dll] [N/A, N/A]
[PID: 2060][C:\Program Files\Wireless Console 2\wcourier.exe] [N/A, 2, 0, 2, 0]

Deakins - 2006-10-25 16:44:00

[C:\WINDOWS\system32\winscok.dll] [N/A, N/A]
[PID: 2092][C:\WINDOWS\ATK0100\ATKOSD.exe] [, 1043, 2, 15, 57]
[C:\WINDOWS\system32\winscok.dll] [N/A, N/A]
[PID: 2096][C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe] [Intel Corporation, 10, 1, 1, 45]
[C:\Program Files\Intel\Wireless\bin\PfMgrApi.dll] [Intel Corporation, 10, 1, 1, 48]
[C:\Program Files\Intel\Wireless\bin\TraceAPI.DLL] [Intel Corporation, 10, 1, 1, 5]
[C:\Program Files\Intel\Wireless\bin\PsRegApi.dll] [Intel Corporation, 10, 1, 1, 2]
[C:\Program Files\Intel\Wireless\bin\DbEngine.dll] [Intel Corporation, 10, 1, 1, 14]
[C:\Program Files\Intel\Wireless\bin\LIBEAY32.dll] [N/A, N/A]
[C:\Program Files\Intel\Wireless\bin\IntStngs.dll] [, 10, 1, 1, 3]
[C:\Program Files\Intel\Wireless\bin\MurocApi.dll] [Intel Corporation, 10, 1, 1, 39]
[C:\Program Files\Intel\Wireless\bin\S24MUDLL.dll] [Intel Corporation, 10, 1, 1, 1]
[C:\Program Files\Intel\Wireless\Bin\ZcSvcCHS.dll] [Intel Corporation, 10, 1, 1, 45]
[C:\WINDOWS\system32\winscok.dll] [N/A, N/A]
[PID: 2200][C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe] [Intel Corporation, 10, 1, 1, 19]
[C:\Program Files\Intel\Wireless\Bin\PsRegApi.dll] [Intel Corporation, 10, 1, 1, 2]
[C:\Program Files\Intel\Wireless\Bin\LIBEAY32.dll] [N/A, N/A]
[C:\Program Files\Intel\Wireless\Bin\IntStngs.dll] [, 10, 1, 1, 3]
[C:\Program Files\Intel\Wireless\Bin\TraceAPI.DLL] [Intel Corporation, 10, 1, 1, 5]
[C:\Program Files\Intel\Wireless\Bin\FrWrkCHS.dll] [Intel Corporation, 10, 1, 1, 19]
[C:\Program Files\Intel\Wireless\Bin\FrameworkPlugins\ConnMgr.dll] [Intel Corporation, 10, 1, 1, 164]
[C:\Program Files\Intel\Wireless\Bin\MurocApi.dll] [Intel Corporation, 10, 1, 1, 39]
[C:\Program Files\Intel\Wireless\Bin\S24MUDLL.dll] [Intel Corporation, 10, 1, 1, 1]
[C:\Program Files\Intel\Wireless\Bin\PfMgrApi.dll] [Intel Corporation, 10, 1, 1, 48]
[C:\Program Files\Intel\Wireless\Bin\DbEngine.dll] [Intel Corporation, 10, 1, 1, 14]
[C:\Program Files\Intel\Wireless\Bin\IntWACHS.dll] [Intel Corporation, 10, 1, 1, 164]
[C:\WINDOWS\system32\winscok.dll] [N/A, N/A]
[PID: 2244][C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe] [Intel Corporation, 10, 1, 1, 17]
[C:\Program Files\Intel\Wireless\Bin\PsRegApi.dll] [Intel Corporation, 10, 1, 1, 2]
[C:\Program Files\Intel\Wireless\Bin\MurocApi.dll] [Intel Corporation, 10, 1, 1, 39]
[C:\Program Files\Intel\Wireless\Bin\S24MUDLL.dll] [Intel Corporation, 10, 1, 1, 1]
[C:\Program Files\Intel\Wireless\Bin\TraceAPI.DLL] [Intel Corporation, 10, 1, 1, 5]
[C:\Program Files\Intel\Wireless\Bin\IntStngs.dll] [, 10, 1, 1, 3]
[C:\Program Files\Intel\Wireless\Bin\LIBEAY32.dll] [N/A, N/A]
[C:\Program Files\Intel\Wireless\Bin\PfMgrApi.dll] [Intel Corporation, 10, 1, 1, 48]
[C:\Program Files\Intel\Wireless\Bin\DbEngine.dll] [Intel Corporation, 10, 1, 1, 14]
[C:\Program Files\Intel\Wireless\Bin\EOUWzCHS.dll] [Intel Corporation, 10, 1, 1, 17]
[C:\WINDOWS\system32\winscok.dll] [N/A, N/A]
[PID: 2336][C:\Program Files\ASUS\ATK Media\DMEDIA.EXE] [ASUSTeK Computer INC., 1, 13, 0, 0]
[C:\Program Files\ASUS\ATK Media\ATKMETHOD.dll] [ASUSTeK Computer Inc., 1, 13, 0, 0]
[C:\WINDOWS\system32\winscok.dll] [N/A, N/A]
[PID: 2524][C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe] [Intel Corporation, 10, 1, 1, 84]
[C:\PROGRA~1\Intel\Wireless\Bin\acAuth.dll] [N/A, 4.0.23.0 2006-03-10 14:49:28]
[C:\PROGRA~1\Intel\Wireless\Bin\C1XStngs.dll] [Intel Corporation, 10, 1, 1, 31]
[C:\PROGRA~1\Intel\Wireless\Bin\PsRegApi.dll] [Intel Corporation, 10, 1, 1, 2]
[C:\PROGRA~1\Intel\Wireless\Bin\IntStngs.dll] [, 10, 1, 1, 3]
[C:\PROGRA~1\Intel\Wireless\Bin\TraceAPI.DLL] [Intel Corporation, 10, 1, 1, 5]
[C:\PROGRA~1\Intel\Wireless\Bin\IWMSPROV.DLL] [N/A, N/A]
[C:\Program Files\Intel\Wireless\Bin\C8021CHS.dll] [Intel Corporation, 10, 1, 1, 31]
[C:\PROGRA~1\Intel\Wireless\Bin\LSAWRAPI.dll] [Intel Corporation, 10, 1, 1, 1]
[C:\PROGRA~1\Intel\Wireless\Bin\PfMgrApi.dll] [Intel Corporation, 10, 1, 1, 48]
[C:\PROGRA~1\Intel\Wireless\Bin\DbEngine.dll] [Intel Corporation, 10, 1, 1, 14]
[C:\PROGRA~1\Intel\Wireless\Bin\LIBEAY32.dll] [N/A, N/A]
[C:\WINDOWS\system32\winscok.dll] [N/A, N/A]
[PID: 2540][C:\Program Files\ASUS\ASUS Live Update\ALU.exe] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\winscok.dll] [N/A, N/A]
[PID: 2552][C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe] [ASUSTeK Computer Inc., 1043, 6, 15, 116]
[C:\Program Files\ASUS\Power4 Gear\ATKMETHOD.dll] [ASUSTeK Computer Inc., 1043, 6, 15, 116]
[C:\WINDOWS\system32\winscok.dll] [N/A, N/A]
[PID: 2744][C:\Program Files\ASUS\Splendid\ACMON.exe] [ATK, 1, 0, 4, 221]
[C:\Program Files\ASUS\Splendid\GLCDdll.dll] [N/A, 1, 0, 0, 729]
[C:\Program Files\ASUS\Splendid\Chameleon.dll] [ASUSTeK, 1, 0, 0, 3]
[C:\WINDOWS\system32\winscok.dll] [N/A, N/A]
[PID: 2892][C:\WINDOWS\sm56hlpr.exe] [Motorola Inc., 6.11.06]
[C:\WINDOWS\sm56eng.dll] [N/A, N/A]
[C:\WINDOWS\sm56fra.dll] [N/A, N/A]
[C:\WINDOWS\sm56brz.dll] [N/A, N/A]
[C:\WINDOWS\sm56chs.dll] [N/A, N/A]
[C:\WINDOWS\sm56cht.dll] [N/A, N/A]
[C:\WINDOWS\sm56ger.dll] [N/A, N/A]
[C:\WINDOWS\sm56itl.dll] [N/A, N/A]
[C:\WINDOWS\sm56jpn.dll] [N/A, N/A]
[C:\WINDOWS\sm56spn.dll] [N/A, N/A]
[C:\WINDOWS\system32\winscok.dll] [N/A, N/A]
[PID: 2908][C:\WINDOWS\system32\ACEngSvr.exe] [ASUSTeK, 1, 0, 0, 4]
[C:\WINDOWS\system32\icm32.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2948][C:\WINDOWS\system32\svohost.exe] [N/A, N/A]
[C:\WINDOWS\system32\winscok.dll] [N/A, N/A]
[PID: 3248][D:\资料\ewido4.0杀木马\ewido4.0\ewido anti-spyware 4.0\ewido.exe] [Anti-Malware Development a.s., 4, 0, 0, 172]
[D:\资料\ewido4.0杀木马\ewido4.0\ewido anti-spyware 4.0\engine.dll] [Anti-Malware Development a.s., 4, 0, 0, 172]
[C:\WINDOWS\system32\winscok.dll] [N/A, N/A]
[PID: 3268][C:\WINDOWS\system32\CTFMON.EXE] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\winscok.dll] [N/A, N/A]
[PID: 3276][C:\Program Files\MSN Messenger\MsnMsgr.Exe] [Microsoft Corporation, 8.0.0812.00]
[C:\WINDOWS\system32\winscok.dll] [N/A, N/A]
[C:\WINDOWS\system32\msdmo.dll] [N/A, N/A]
[PID: 3516][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\winscok.dll] [N/A, N/A]
[PID: 3772][C:\WINDOWS\system32\wuauclt.exe] [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[PID: 736][C:\Program Files\GreenBrowser\GreenBrowser.exe] [MoreQuick, 1, 0, 0, 0]

Deakins - 2006-10-25 16:44:00

[C:\WINDOWS\system32\winscok.dll] [N/A, N/A]
[D:\资料\卡巴斯基\kis6.sch\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[D:\资料\卡巴斯基\kis6.sch\scr_ch_pg.dll] [Kaspersky Lab, 1.0.6.299]
[D:\资料\卡巴斯基\kis6.sch\klscav.dll] [Kaspersky Lab, 6.0.0.299]
[D:\资料\卡巴斯基\kis6.sch\pr_remote.dll] [Kaspersky Lab, 6.0.0.299]
[D:\资料\卡巴斯基\kis6.sch\prloader.dll] [Kaspersky Lab, 6.0.0.299]
[D:\资料\卡巴斯基\kis6.sch\prkernel.ppl] [Kaspersky Lab, 6.0.0.304]
[d:\资料\卡巴斯基\kis6.sch\params.ppl] [Kaspersky Lab, 6.0.0.299]
[d:\资料\卡巴斯基\kis6.sch\pxstub.ppl] [Kaspersky Lab, 6.0.0.299]
[d:\资料\卡巴斯基\kis6.sch\tempfile.ppl] [Kaspersky Lab, 6.0.0.299]
[d:\资料\卡巴斯基\kis6.sch\nfio.ppl] [Kaspersky Lab, 6.0.0.299]
[d:\资料\卡巴斯基\kis6.sch\fsdrvplgn.ppl] [Kaspersky Lab, 6.0.0.299]
[PID: 1848][C:\WINDOWS\system32\wuauclt.exe] [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[C:\WINDOWS\system32\winscok.dll] [N/A, N/A]
[PID: 3868][C:\WINDOWS\system32\NOTEPAD.EXE] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\winscok.dll] [N/A, N/A]
[PID: 2316][D:\资料\sreng2\SREng\SREng.exe] [Smallfrogs Studio, 2.2.6.605]
[C:\WINDOWS\system32\winscok.dll] [N/A, N/A]
[D:\资料\卡巴斯基\kis6.sch\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[D:\资料\sreng2\SREng\Plugins\SRECXTMG.SRE] [Smallfrogs Studio, 1, 5, 0, 55]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[D:\]
[AutoRun]
open=sxs.exe
shellexecute=sxs.exe
shell\Auto\command=sxs.exe
[E:\]
[AutoRun]
open=sxs.exe
shellexecute=sxs.exe
shell\Auto\command=sxs.exe

==================================
HOSTS 文件
127.0.0.1 localhost

==================================

瑞星卡卡安全论坛