用XDELBOX删文件老是说该文件不存在,为什么??高手帮忙!!(有日志) bbs.ikaka.com

awewef - 2007-11-25 10:38:00

2007-11-25,10:18:18

System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Publisher]
<PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows Publisher]
<PHIME2002ASync><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Publisher]
<amd_dc_opt><C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe> [AMD]
<NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [NVIDIA Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><rsztkpm.dll> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{55983698-1025-2685-5984-595778514655}><C:\WINDOWS\system32\wsjrezx.dll> []
<{58907901-1416-3389-9981-372178569985}><C:\WINDOWS\system32\kawdezy.dll> [N/A]
<{6859245F-345D-BC13-AC4F-145D47DA34F6}><C:\WINDOWS\system32\avzxfmn.dll> []
<{44783410-4F90-34A0-7820-3230ACD05F44}><C:\WINDOWS\system32\raqjdpi.dll> []
<{A6650011-3344-6688-4899-345FABCD156A}><C:\WINDOWS\system32\ratbjpi.dll> [N/A]
<{A7D81718-1314-5200-2597-58790101807A}><C:\WINDOWS\system32\kaqhjzy.dll> []
<{678A7521-FA87-34AB-34C2-4893F3AD34C6}><C:\WINDOWS\system32\swrcezc.dll> []
<{68907901-1416-3389-9981-372178569986}><C:\WINDOWS\system32\kawdfzy.dll> []
<{AD561258-45F3-A451-F908-A258458226DA}><C:\WINDOWS\system32\kvdxsjma.dll> []
<{B6650011-3344-6688-4899-345FABCD156B}><C:\WINDOWS\system32\ratbkpi.dll> []
<{592FADFA-BCDE-ACDF-CDEF-21054865CBA5}><C:\WINDOWS\system32\wsmsczx.dll> []
<{9D47B341-43DF-4563-753F-345FFA3157D9}><C:\WINDOWS\system32\kvmxima.dll> []
<{AC87A354-ABC3-DEDE-FF33-3213FD7447CA}><C:\WINDOWS\system32\kvdxjma.dll> []
<{C158698F-435B-CD34-FA34-59875412025C}><\\.\C:\WINDOWS\system32\nul\nul.dll> []
<{89FA4178-7749-A8D9-F5C8-886455257698}><C:\WINDOWS\system32\kashhzy.dll> []
<{15679330-4034-9021-7012-909856721371}><C:\WINDOWS\system32\wszjazx.dll> []
<{D158698F-435B-CD34-FA34-59875412025D}><C:\WINDOWS\Fonts\ftxzama.dll> []
<{48847374-8323-FADC-B443-4732ABCD3784}><C:\WINDOWS\system32\sidjdzy.dll> []
<{5598FF45-DA60-F48A-BC43-10AC47853D55}><C:\WINDOWS\system32\rarjepi.dll> []
<{B34345F1-DACF-3452-CB7D-4620F34A153B}><C:\WINDOWS\system32\rsztkpm.dll> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe]
<IFEO[360rpt.exe]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe]
<IFEO[360Safe.exe]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe]
<IFEO[360tray.exe]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ACKWIN32.EXE]
<IFEO[ACKWIN32.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ANTI-TROJAN.EXE]
<IFEO[ANTI-TROJAN.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\APVXDWIN.EXE]
<IFEO[APVXDWIN.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\asktao.mod]
<IFEO[asktao.mod]><C:\WINDOWS\system\wd.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AUTODOWN.EXE]
<IFEO[AUTODOWN.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCONSOL.EXE]
<IFEO[AVCONSOL.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVE32.EXE]
<IFEO[AVE32.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGCTRL.EXE]
<IFEO[AVGCTRL.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKSERV.EXE]
<IFEO[AVKSERV.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVNT.EXE]
<IFEO[AVNT.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP.EXE]
<IFEO[AVP.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP32.EXE]
<IFEO[AVP32.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPCC.EXE]
<IFEO[AVPCC.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPDOS32.EXE]
<IFEO[AVPDOS32.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPM.EXE]
<IFEO[AVPM.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPTC32.EXE]
<IFEO[AVPTC32.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPUPD.EXE]
<IFEO[AVPUPD.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVSCHED32.EXE]
<IFEO[AVSCHED32.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVWIN95.EXE]
<IFEO[AVWIN95.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVWUPD32.EXE]
<IFEO[AVWUPD32.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BLACKD.EXE]
<IFEO[BLACKD.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BLACKICE.EXE]
<IFEO[BLACKICE.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CFIADMIN.EXE]
<IFEO[CFIADMIN.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CFIAUDIT.EXE]
<IFEO[CFIAUDIT.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CFINET.EXE]
<IFEO[CFINET.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CFINET32.EXE]
<IFEO[CFINET32.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLAW95.EXE]
<IFEO[CLAW95.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLAW95CF.EXE]
<IFEO[CLAW95CF.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLEANER.EXE]
<IFEO[CLEANER.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLEANER3.EXE]
<IFEO[CLEANER3.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DVP95.EXE]
<IFEO[DVP95.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DVP95_0.EXE]
<IFEO[DVP95_0.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ECENGINE.EXE]
<IFEO[ECENGINE.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EGHOST.EXE]
<IFEO[EGHOST.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ESAFE.EXE]
<IFEO[ESAFE.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXPWATCH.EXE]
<IFEO[EXPWATCH.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\F-AGNT95.EXE]
<IFEO[F-AGNT95.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\F-PROT.EXE]
<IFEO[F-PROT.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\F-PROT95.EXE]
<IFEO[F-PROT95.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\F-STOPW.EXE]

[用户系统信息]Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Maxthon)

awewef - 2007-11-25 10:39:00

<IFEO[F-STOPW.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FESCUE.EXE]
<IFEO[FESCUE.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FINDVIRU.EXE]
<IFEO[FINDVIRU.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FP-WIN.EXE]
<IFEO[FP-WIN.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPROT.EXE]
<IFEO[FPROT.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FRW.EXE]
<IFEO[FRW.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IAMAPP.EXE]
<IFEO[IAMAPP.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IAMSERV.EXE]
<IFEO[IAMSERV.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IBMASN.EXE]
<IFEO[IBMASN.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IBMAVSP.EXE]
<IFEO[IBMAVSP.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ICLOAD95.EXE]
<IFEO[ICLOAD95.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ICLOADNT.EXE]
<IFEO[ICLOADNT.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ICMON.EXE]
<IFEO[ICMON.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ICSUPP95.EXE]
<IFEO[ICSUPP95.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ICSUPPNT.EXE]
<IFEO[ICSUPPNT.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IFACE.EXE]
<IFEO[IFACE.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IOMON98.EXE]
<IFEO[IOMON98.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe]
<IFEO[Iparmor.exe]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\JEDI.EXE]
<IFEO[JEDI.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe]
<IFEO[KAV32.exe]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.EXE]
<IFEO[KAVPFW.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVsvc.exe]
<IFEO[KAVsvc.exe]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSvcUI.exe]
<IFEO[KAVSvcUI.exe]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVFW.EXE]
<IFEO[KVFW.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.exe]
<IFEO[KVMonXP.exe]><C:\WINDOWS\system\BoBoTurbo.exe> []

awewef - 2007-11-25 10:40:00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp]
<IFEO[KVMonXP.kxp]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe]
<IFEO[KVSrvXP.exe]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVwsc.exe]
<IFEO[KVwsc.exe]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp]
<IFEO[KvXP.kxp]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchUI.EXE]
<IFEO[KWatchUI.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LOCKDOWN2000.EXE]
<IFEO[LOCKDOWN2000.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Logo1_.exe]
<IFEO[Logo1_.exe]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Logo_1.exe]
<IFEO[Logo_1.exe]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LOOKOUT.EXE]
<IFEO[LOOKOUT.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LUALL.EXE]
<IFEO[LUALL.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MAILMON.EXE]
<IFEO[MAILMON.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MOOLIVE.EXE]
<IFEO[MOOLIVE.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPFTRAY.EXE]
<IFEO[MPFTRAY.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\my.exe]
<IFEO[my.exe]><C:\WINDOWS\system\mhlm.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\N32SCANW.EXE]
<IFEO[N32SCANW.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapsvc.exe]
<IFEO[Navapsvc.exe]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapw32.exe]
<IFEO[Navapw32.exe]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVLU32.EXE]
<IFEO[NAVLU32.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVNT.EXE]
<IFEO[NAVNT.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navw32.EXE]
<IFEO[navw32.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVWNT.EXE]
<IFEO[NAVWNT.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NISUM.EXE]
<IFEO[NISUM.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NMain.exe]
<IFEO[NMain.exe]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NORMIST.EXE]
<IFEO[NORMIST.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NUPGRADE.EXE]
<IFEO[NUPGRADE.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NVC95.EXE]
<IFEO[NVC95.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PAVCL.EXE]
<IFEO[PAVCL.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PAVSCHED.EXE]
<IFEO[PAVSCHED.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PAVW.EXE]
<IFEO[PAVW.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCCWIN98.EXE]
<IFEO[PCCWIN98.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCFWALLICON.EXE]
<IFEO[PCFWALLICON.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PERSFW.EXE]
<IFEO[PERSFW.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.EXE]
<IFEO[PFW.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe]
<IFEO[Rav.exe]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAV7.EXE]
<IFEO[RAV7.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAV7WIN.EXE]
<IFEO[RAV7WIN.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAVmon.exe]
<IFEO[RAVmon.exe]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAVmonD.exe]
<IFEO[RAVmonD.exe]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAVtimer.exe]
<IFEO[RAVtimer.exe]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rising.exe]
<IFEO[Rising.exe]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SAFEWEB.EXE]
<IFEO[SAFEWEB.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCAN32.EXE]
<IFEO[SCAN32.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCAN95.EXE]
<IFEO[SCAN95.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANPM.EXE]
<IFEO[SCANPM.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCRSCAN.EXE]
<IFEO[SCRSCAN.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []

awewef - 2007-11-25 10:41:00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SERV95.EXE]
<IFEO[SERV95.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMC.EXE]
<IFEO[SMC.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\soul.exe]
<IFEO[soul.exe]><C:\WINDOWS\system\mylm.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SPHINX.EXE]
<IFEO[SPHINX.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SWEEP95.EXE]
<IFEO[SWEEP95.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TBSCAN.EXE]
<IFEO[TBSCAN.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TCA.EXE]
<IFEO[TCA.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TDS2-98.EXE]
<IFEO[TDS2-98.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TDS2-NT.EXE]
<IFEO[TDS2-NT.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\THGUARD.EXE]
<IFEO[THGUARD.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanHunter.exe]
<IFEO[TrojanHunter.exe]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VET95.EXE]
<IFEO[VET95.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VETTRAY.EXE]
<IFEO[VETTRAY.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VSCAN40.EXE]
<IFEO[VSCAN40.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VSECOMR.EXE]
<IFEO[VSECOMR.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VSHWIN32.EXE]
<IFEO[VSHWIN32.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VSSTAT.EXE]
<IFEO[VSSTAT.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WEBSCANX.EXE]
<IFEO[WEBSCANX.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WFINDV32.EXE]
<IFEO[WFINDV32.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZONEALARM.EXE]
<IFEO[ZONEALARM.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_AVP32.EXE]
<IFEO[_AVP32.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_AVPCC.EXE]
<IFEO[_AVPCC.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_AVPM.EXE]
<IFEO[_AVPM.EXE]><C:\WINDOWS\system\BoBoTurbo.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\修复工具.exe]
<IFEO[修复工具.exe]><C:\WINDOWS\system\BoBoTurbo.exe> []

==================================
启动文件夹
N/A

==================================
服务
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[kavsvc / kavsvc][Stopped/Auto Start]
<"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe"><Kaspersky Lab>
[NetMeeting Remote Desktop Sharing / mnmsrvc][Stopped/Manual Start]
<C:\WINDOWS\system32\mnmsrvc.exe><N/A>
[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
<C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[StyleXPService / StyleXPService][Running/Auto Start]
<"C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe"><>
[Windows Media Player Network Sharing Service / WMPNetworkSvc][Stopped/Manual Start]
<"C:\Program Files\Windows Media Player\WMPNetwk.exe"><Microsoft Corporation>

awewef - 2007-11-25 10:41:00

驱动程序
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Stopped/Manual Start]
<system32\drivers\ac97intc.sys><Intel Corporation>
[ADI UAA Function Driver for High Definition Audio Service / ADIHdAudAddService][Running/Manual Start]
<system32\drivers\ADIHdAud.sys><Analog Devices, Inc.>
[AE Audio Service / AEAudio][Running/Manual Start]
<system32\drivers\AEAudio.sys><Andrea Electronics Corporation>
[AMD Processor Driver / AmdK8][Running/System Start]
<system32\DRIVERS\AmdK8.sys><Advanced Micro Devices>
[AMD Low Level Device Driver / AmdLLD][Running/Manual Start]
<system32\DRIVERS\AmdLLD.sys><AMD, Inc.>
[Creative SBLive! Gameport / ctljystk][Stopped/Manual Start]
<system32\DRIVERS\ctljystk.sys><Creative Technology Ltd.>
[Microsoft UAA Bus Driver for High Definition Audio / HDAudBus][Running/Manual Start]
<system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
[Kl1 / Kl1][Running/Boot Start]
<\SystemRoot\System32\drivers\kl1.sys><Kaspersky Lab>
[Klif / Klif][Running/System Start]
<System32\drivers\klif.sys><Kaspersky Labs>
[Klmc / Klmc][Running/System Start]
<System32\drivers\klmc.sys><Kaspersky Lab>
[ATK0110 ACPI UTILITY / MTsensor][Running/Manual Start]
<system32\DRIVERS\ASACPI.sys><>
[nv / nv][Running/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[NVIDIA nForce Networking Controller Driver / NVENETFD][Running/Manual Start]
<system32\DRIVERS\NVENETFD.sys><NVIDIA Corporation>
[NVIDIA Network Bus Enumerator / nvnetbus][Running/Manual Start]
<system32\DRIVERS\nvnetbus.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[PxHelp20 / PxHelp20][Running/Boot Start]
<\SystemRoot\System32\Drivers\PxHelp20.sys><Sonic Solutions>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[SenFilt Service / SenFiltService][Running/Manual Start]
<system32\drivers\Senfilt.sys><Sensaura>
[StyleXPHelper / StyleXPHelper][Running/System Start]
<\??\C:\Program Files\TGTSoft\StyleXP\StyleXPHelper.exe><Windows (R) 2000 DDK provider>
[ufqi / ufqi][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\ufqi.sys><ARSWP>

==================================
浏览器加载项
[ThunderAtOnce Class]
{01443AEC-0FD1-40fd-9C87-E93D1494C233} <F:\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <F:\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[ThunderMini Browser Helper]
{8E6C1C49-F9CE-4311-9FB4-D70E8B0AEAEB} <F:\Thunder Network\ThunderMini\ComDlls\XunLeiMiniBHO_001.dll, Thunder Networking Technologies,LTD>
[Windows Live Sign-in Helper]
{9030D464-4C02-4ABF-8ECC-5164760863C6} <C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll, Microsoft Corporation>
[启动迅雷5]
{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <f:\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[浩方对战平台]
{0A155D3C-68E2-4215-A47A-E800A446447A} <f:\HFGameOPT\GameClient.exe, 上海浩方在线信息技术有限公司>
[快车]
{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\flashget.exe, N/A>
[StylerToolBar]
{D2F8F919-690B-4EA2-9FA7-A203D1E04F75} <C:\WINDOWS\system32\IME\Styler\TB\StylerTB.dll, StyleFantasist>
[ThunderAtOnce Class]
{01443AEC-0FD1-40FD-9C87-E93D1494C233} <F:\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[Thunder Agent Class]
{485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <F:\Thunder Network\Thunder\ComDlls\ThunderAgent_Now.dll, Thunder Networking Technologies,LTD>
[XMP Class]
{6483F145-A768-4C41-AACC-52D4D7845851} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xplayer.dll_1_work, >
[XDRM]
{693571CB-54A3-4E90-9D52-EEAE1334E2D3} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xdrm.dll_1_work, >
[Active Desktop Mover]
{72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
[MediaComm Class]
{7670648D-461B-42AF-BDFE-46D26AF5EFF2} <f:\Thunder Network\Thunder\Components\InMedia\MediaAddin14.dll, Thunder Networking Technologies,LTD>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <F:\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[ThunderMini Browser Helper]
{8E6C1C49-F9CE-4311-9FB4-D70E8B0AEAEB} <F:\Thunder Network\ThunderMini\ComDlls\XunLeiMiniBHO_001.dll, Thunder Networking Technologies,LTD>
[Windows Live Sign-in Helper]
{9030D464-4C02-4ABF-8ECC-5164760863C6} <C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll, Microsoft Corporation>
[RMGetLicense Class]
{A9FC132B-096D-460B-B7D5-1DB0FAE0C062} <C:\WINDOWS\system32\msnetobj.dll, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[StylerToolBar]
{D2F8F919-690B-4EA2-9FA7-A203D1E04F75} <C:\WINDOWS\system32\IME\Styler\TB\StylerTB.dll, StyleFantasist>
[Thunder DapPlayer]
{EEDD6FF9-13DE-496B-9A1C-D78B3215E266} <f:\Thunder Network\Thunder\Components\DownAndPlay\DapPlayer3.0.36.60.dll, ShenZhen Thunder Networking Technologies Ltd.>
[XPPlayer Class]
{F3E70CEA-956E-49CC-B444-73AFE593AD7F} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\pplayer.dll_1_work, Thunder>
[XML HTTP]
{F6D90F16-9C73-11D3-B32E-00C04F990BB4} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[&使用BitComet下载]
<res://F:\BitComet\BitComet.exe/AddLink.htm, N/A>
[&使用BitComet下载全部链接]
<res://F:\BitComet\BitComet.exe/AddAllLink.htm, N/A>
[&使用BitComet下载本页视频]
<res://F:\BitComet\BitComet.exe/AddVideo.htm, N/A>
[&使用快车(FlashGet)下载]
<C:\Program Files\FlashGet\jc_link.htm, N/A>
[&使用快车(FlashGet)下载全部链接]
<C:\Program Files\FlashGet\jc_all.htm, N/A>
[&使用迷你迅雷下载]
<F:\Thunder Network\ThunderMini\Program\GetUrl.htm, N/A>
[使用迅雷下载]
<F:\Thunder Network\Thunder\Program\geturl.htm, N/A>
[使用迅雷下载全部链接]
<F:\Thunder Network\Thunder\Program\getallurl.htm, N/A>
[导出到 Microsoft Excel(&x)]
<res://F:\MICROS~1\Office10\EXCEL.EXE/3000, N/A>
[添加到QQ表情]
<f:\Tencent\QQ\AddEmotion.htm, N/A>

awewef - 2007-11-25 10:42:00

正在运行的进程
[PID: 660 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 708 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 732 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\kvdxsjma.dll] [N/A, ]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 784 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\AppPatch\AcAdProc.dll] [Microsoft Corporation, 5.1.2600.3008 (xpsp.061004-0027)]
[C:\WINDOWS\system32\kvdxsjma.dll] [N/A, ]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
[PID: 796 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\kvdxsjma.dll] [N/A, ]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
[PID: 972 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\kvdxsjma.dll] [N/A, ]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
[PID: 1028 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\kvdxsjma.dll] [N/A, ]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
[C:\WINDOWS\system32\sqmapi32.dll] [N/A, ]
[PID: 1124 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\System32\kvdxsjma.dll] [N/A, ]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
[C:\WINDOWS\system32\sqmapi32.dll] [N/A, ]
[PID: 1156 / SYSTEM][C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe] [, 0, 20, 0, 3000]
[C:\WINDOWS\system32\kvdxsjma.dll] [N/A, ]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
[PID: 1196 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\kvdxsjma.dll] [N/A, ]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
[PID: 1396 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\kvdxsjma.dll] [N/A, ]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
[PID: 1612 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\WINDOWS\system32\kvdxsjma.dll] [N/A, ]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
[C:\WINDOWS\system32\CNBJMON2.DLL] [Microsoft Corporation, 5.1.2600.2079 built by: xpsp(skatari)]
[PID: 1844 / Administrator][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
[C:\WINDOWS\system32\kvdxsjma.dll] [N/A, ]
[C:\WINDOWS\system32\ieframe.dll] [Microsoft Corporation, 7.00.6000.16414 (vista_gdr.070108-1520)]
[C:\WINDOWS\system32\raqjdpi.dll] [N/A, ]
[C:\WINDOWS\system32\kaqhjzy.dll] [N/A, ]
[C:\WINDOWS\system32\swrcezc.dll] [N/A, ]
[C:\WINDOWS\system32\kawdfzy.dll] [N/A, ]
[C:\WINDOWS\system32\ratbkpi.dll] [N/A, ]
[C:\WINDOWS\system32\wsmsczx.dll] [N/A, ]
[C:\WINDOWS\system32\kvmxima.dll] [N/A, ]
[C:\WINDOWS\system32\kvdxjma.dll] [N/A, ]
[\\.\C:\WINDOWS\system32\nul\nul.dll] [N/A, ]
[C:\WINDOWS\system32\kashhzy.dll] [N/A, ]
[C:\WINDOWS\system32\wszjazx.dll] [N/A, ]
[C:\WINDOWS\Fonts\ftxzama.dll] [N/A, ]
[C:\WINDOWS\system32\sidjdzy.dll] [N/A, ]
[C:\WINDOWS\system32\rarjepi.dll] [N/A, ]
[C:\WINDOWS\system32\rsztkpm.dll] [N/A, ]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\shellex.dll] [Kaspersky Lab, 5.0.388.1]
[C:\WINDOWS\system32\nvcpl.dll] [NVIDIA Corporation, 6.14.10.8466]
[C:\WINDOWS\system32\NVRSZHC.DLL] [NVIDIA Corporation, 6.14.10.8466]
[C:\WINDOWS\system32\nvshell.dll] [, ]
[F:\Thunder Network\Thunder\Components\ResWorker\DsBho_00.dll] [, 1, 0, 0, 12]
[F:\Thunder Network\Thunder\Components\ResWorker\DataProcessor_00.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 13]
[F:\Thunder Network\ThunderMini\ComDlls\XunLeiMiniBHO_001.dll] [Thunder Networking Technologies,LTD, 2, 0, 0, 1]
[C:\WINDOWS\system32\PortableDeviceApi.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[F:\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll] [Thunder Networking Technologies,LTD, 1.0.5.16]
[F:\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 8, 44]
[F:\Microsoft Office\Office10\msohev.dll] [Microsoft Corporation, 10.0.2609]
[PID: 220 / Administrator][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\rsztkpm.dll] [N/A, ]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
[\\.\C:\WINDOWS\system32\nul\nul.dll] [N/A, ]
[C:\WINDOWS\Fonts\ftxzama.dll] [N/A, ]
[C:\WINDOWS\system32\kvdxsjma.dll] [N/A, ]
[PID: 352 / Administrator][C:\WINDOWS\system\BoBoTurbo.exe] [N/A, ]
[C:\WINDOWS\system32\kvdxsjma.dll] [N/A, ]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
[C:\WINDOWS\Fonts\ftxzama.dll] [N/A, ]
[\\.\C:\WINDOWS\system32\nul\nul.dll] [N/A, ]
[PID: 464 / Administrator][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\kvdxsjma.dll] [N/A, ]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
[C:\WINDOWS\Fonts\ftxzama.dll] [N/A, ]
[\\.\C:\WINDOWS\system32\nul\nul.dll] [N/A, ]
[PID: 608 / SYSTEM][C:\WINDOWS\system32\nvsvc32.exe] [NVIDIA Corporation, 6.14.10.8466]
[C:\WINDOWS\system32\kvdxsjma.dll] [N/A, ]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
[PID: 1292 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\sqmapi32.dll] [N/A, ]
[PID: 2360 / Administrator][F:\sreng2\SREng\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
[C:\WINDOWS\system32\kvdxsjma.dll] [N/A, ]
[\\.\C:\WINDOWS\system32\nul\nul.dll] [N/A, ]
[C:\WINDOWS\Fonts\ftxzama.dll] [N/A, ]
[C:\WINDOWS\system32\rsztkpm.dll] [N/A, ]
[C:\WINDOWS\system32\rarjepi.dll] [N/A, ]
[C:\WINDOWS\system32\sidjdzy.dll] [N/A, ]
[C:\WINDOWS\system32\wszjazx.dll] [N/A, ]
[C:\WINDOWS\system32\kashhzy.dll] [N/A, ]
[C:\WINDOWS\system32\kvdxjma.dll] [N/A, ]
[C:\WINDOWS\system32\kvmxima.dll] [N/A, ]
[C:\WINDOWS\system32\wsmsczx.dll] [N/A, ]
[C:\WINDOWS\system32\ratbkpi.dll] [N/A, ]
[C:\WINDOWS\system32\kawdfzy.dll] [N/A, ]
[C:\WINDOWS\system32\swrcezc.dll] [N/A, ]
[C:\WINDOWS\system32\kaqhjzy.dll] [N/A, ]
[C:\WINDOWS\system32\raqjdpi.dll] [N/A, ]
[F:\sreng2\SREng\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]

==================================
文件关联
.TXT Error. [C:\WINDOWS\notepad.exe %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM Error. ["hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
MSAPI Tcpip [TCP/IP]
C:\WINDOWS\system32\sqmapi32.dll(, N/A)
MSAPI Tcpip [UDP/IP]
C:\WINDOWS\system32\sqmapi32.dll(, N/A)

==================================
Autorun.inf
[C:\]
[AutoRun]
OPEN=XP.EXE
shellexecute=XP.EXE
shell\打开(&O)\command=XP.EXE
[D:\]
[AutoRun]
OPEN=XP.EXE
shellexecute=XP.EXE
shell\打开(&O)\command=XP.EXE
[E:\]
[AutoRun]
OPEN=XP.EXE
shellexecute=XP.EXE
shell\打开(&O)\command=XP.EXE
[F:\]
[AutoRun]
OPEN=XP.EXE
shellexecute=XP.EXE
shell\打开(&O)\command=XP.EXE

awewef - 2007-11-25 10:42:00

HOSTS 文件
***********************************
《电脑报》黑榜(R)恶意网址屏蔽文件
版本号：2007.07.30
***********************************
127.0.0.1 localhost
127.0.0.1 www.zzzz1.com
127.0.0.1 zzzz1.com
127.0.0.1 www.baidu345.com
127.0.0.1 baidu345.com
127.0.0.1 www.ttsou.cn
127.0.0.1 ttsou.cn
127.0.0.1 www.zhaomeimei.cn
127.0.0.1 www.511u.com
127.0.0.1 www.37698.com
127.0.0.1 37698.com
127.0.0.1 www.2345.com
127.0.0.1 2345.com
127.0.0.1 www.hk0707.com
127.0.0.1 www.hk0909.com
127.0.0.1 www2.99vod.net
127.0.0.1 www.99vod.net
127.0.0.1 www.51mxd.com
127.0.0.1 www.meizi7472831.com
127.0.0.1 www.game929.com
127.0.0.1 www.21cnhr.com
127.0.0.1 www.91d2d.com
127.0.0.1 91d2d.com
127.0.0.1 www.flydown.net
127.0.0.1 flydown.net
127.0.0.1 www.wangxiangad.com
127.0.0.1 music.wangxiangad.com
127.0.0.1 www.91d2d.com
127.0.0.1 www.59552.com
127.0.0.1 qq.59552.com
127.0.0.1 2007.5ixp.com
127.0.0.1 www.lmaq.com
127.0.0.1 lmaq.com
127.0.0.1 www.3yyy.cn
127.0.0.1 old.3yyy.cn
127.0.0.1 www.kkpic.net
127.0.0.1 kkpic.net
127.0.0.1 www.habao.net
127.0.0.1 habao.net
127.0.0.1 www.sms591.com
127.0.0.1 www.sms591.net
127.0.0.1 www.kx99.cn
127.0.0.1 www.odwy.com
127.0.0.1 www.99mmm.com
127.0.0.1 www.sqqd.com
127.0.0.1 www.sqqd.net
127.0.0.1 www.6781.com
127.0.0.1 www.dj015.com
127.0.0.1 www.mtvrm.com
127.0.0.1 a.d3a.us
127.0.0.1 www.69262.com
127.0.0.1 www.an188.com
127.0.0.1 www.bobcn.net
127.0.0.1 www.pkzz.net
127.0.0.1 www.pkzz.net
127.0.0.1 www.jily.net
127.0.0.1 jily.net
127.0.0.1 cn.errorsafe.com
127.0.0.1 www.errorsafe.com
127.0.0.1 www.1717kan.cn
127.0.0.1 www.verycr.com
127.0.0.1 verycr.com
127.0.0.1 www.82wg.com
127.0.0.1 www.kuaiso.com
127.0.0.1 www.64xz.com
127.0.0.1 64xz.com
127.0.0.1 www.newok.com
127.0.0.1 www.top000.com
127.0.0.1 top000.com
127.0.0.1 www.tianmp3.cn
127.0.0.1 tianmp3.cn
127.0.0.1 www.59552.com
127.0.0.1 59552.com
127.0.0.1 www.xf520.cn
127.0.0.1 www.ysbr.cn
127.0.0.1 www.lvrzj.com
127.0.0.1 lvrzj.com
127.0.0.1 www.toxx.info
127.0.0.1 www.11990.com
127.0.0.1 www.xzqx88.com
127.0.0.1 xzqx88.com
127.0.0.1 11990.com
127.0.0.1 www.qbbd.com
127.0.0.1 w.qbbd.com
127.0.0.1 www.wuyeav.com
127.0.0.1 wuyeav.com
127.0.0.1 www.87895.com
127.0.0.1 87895.com
127.0.0.1 www.henbang.net
127.0.0.1 files.henbang.net
127.0.0.1 www.yayalao.com
127.0.0.1 yayalao.com
127.0.0.1 yxgm78.com
127.0.0.1 www.88888888888888888888888888888888888888888888888888.com
127.0.0.1 www.50-8.com
127.0.0.1 www.50ge8.com
127.0.0.1 www.klyx8.com
127.0.0.1 klyx8.com
127.0.0.1 www.53yes.com
127.0.0.1 www.jk1001.com
127.0.0.1 4255.biz
127.0.0.1 www.zhaoxl.cn
127.0.0.1 zhaoxl.cn
127.0.0.1 www.0hu.net
127.0.0.1 0hu.net
127.0.0.1 www.pic00.com
127.0.0.1 pic00.com
127.0.0.1 www.17xxz.com
127.0.0.1 17xxz.com
127.0.0.1 www.900666.com
127.0.0.1 pp.900666.com
127.0.0.1 www.jetdown.com
127.0.0.1 jetdown.com
127.0.0.1 7y7.us
127.0.0.1 12rr.com
127.0.0.1 www.12rr.com
127.0.0.1 www.ycdy.com
127.0.0.1 ycdy.com
127.0.0.1 www.zqqa.com
127.0.0.1 zqqa.com
127.0.0.1 www.zpx520.com
127.0.0.1 zpx520.com
127.0.0.1 12706.com
127.0.0.1 down.12706.com
127.0.0.1 www.12706.com
127.0.0.1 www.xrlyy.com
127.0.0.1 xrlyy.com
127.0.0.1 laji.xrlyy.com
127.0.0.1 www.51meinv.cn
127.0.0.1 16a.us
127.0.0.1 www.n85853.cn
127.0.0.1 n85853.cn
127.0.0.1 www.chenxinsms.com
127.0.0.1 chenxinsms.com
127.0.0.1 www.1cdzx.cn
127.0.0.1 1cdzx.cn
127.0.0.1 www.1008y.cn
127.0.0.1 1008y.cn
127.0.0.1 www.18dmm.com
127.0.0.1 18dmm.com
127.0.0.1 www.08325.cn
127.0.0.1 08325.cn
127.0.0.1 www.vchome.net
127.0.0.1 vchome.net
127.0.0.1 www.hsstone.net
127.0.0.1 mp3.hsstone.net
127.0.0.1 hsstone.net
127.0.0.1 5y5.us
127.0.0.1 www.yyor.com
127.0.0.1 yyor.com
127.0.0.1 www.wvyi.com
127.0.0.1 wvyi.com
127.0.0.1 s.gcuj.com
127.0.0.1 www.gcuj.com
127.0.0.1 gcuj.com
127.0.0.1 www.hyap98.com
127.0.0.1 www.126621.com
127.0.0.1 126621.com
127.0.0.1 www.if56.cn
127.0.0.1 if56.cn
127.0.0.1 www.453888.com
127.0.0.1 www.uu500.com
127.0.0.1 uu500.com
127.0.0.1 www.money-you.cn
127.0.0.1 money-you.cn
127.0.0.1 9166.biz
127.0.0.1 www.2cdma.cn
127.0.0.1 2cdma.cn
127.0.0.1 www.jygame88.com
127.0.0.1 y66.us
127.0.0.1 www.qinlo.com
127.0.0.1 qinlo.com
127.0.0.1 1234.89111.cn
127.0.0.1 www.1234ya.com
127.0.0.1 1234ya.com
127.0.0.1 Ttwd.net
127.0.0.1 www.Ttwd.net
127.0.0.1 www.level-qq.cn
127.0.0.1 level-qq.cn
127.0.0.1 www.36xp.com
127.0.0.1 36xp.com
127.0.0.1 3.36xp.com
127.0.0.1 www.puma163.com
127.0.0.1 puma163.com
127.0.0.1 www.11sss.com
127.0.0.1 11sss.com
127.0.0.1 www.mty366.com
127.0.0.1 mty366.com
127.0.0.1 www.kaspersky7.com.cn
127.0.0.1 kaspersky7.com.cn
127.0.0.1 boolom.com
127.0.0.1 www.sl952571.cn
127.0.0.1 sl952571.cn
127.0.0.1 878772.cn
127.0.0.1 www.878772.cn
127.0.0.1 www.44xp.com
127.0.0.1 44xp.com
127.0.0.1 a.44xp.com
127.0.0.1 b.44xp.com
127.0.0.1 c.44xp.com
127.0.0.1 d.44xp.com
127.0.0.1 3.11xp.com
127.0.0.1 www.virusprotectpro.com
127.0.0.1 virusprotectpro.com
127.0.0.1 ck1.in
127.0.0.1 xyaq163.cn
127.0.0.1 1111.845845.cn
127.0.0.1 www.8749.com
127.0.0.1 8749.com
127.0.0.1 yinlew.com
127.0.0.1 up.yinlew.com
127.0.0.1 www.edqb.com
127.0.0.1 a.11sss.com
127.0.0.1 www.11sss.com
127.0.0.1 web.858656.com

==================================
进程特权扫描
特殊特权被允许： SeDebugPrivilege [PID = 1844, C:\WINDOWS\EXPLORER.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1844, C:\WINDOWS\EXPLORER.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 352, C:\WINDOWS\SYSTEM\BOBOTURBO.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 608, C:\WINDOWS\SYSTEM32\NVSVC32.EXE]

==================================
API HOOK
RVA 错误： LoadLibraryA (危险等级: 高, 被下面模块所HOOK: \SystemRoot\System32\drivers\klif.sys)
RVA 错误： LoadLibraryExA (危险等级: 高, 被下面模块所HOOK: \SystemRoot\System32\drivers\klif.sys)
RVA 错误： LoadLibraryExW (危险等级: 高, 被下面模块所HOOK: \SystemRoot\System32\drivers\klif.sys)
RVA 错误： LoadLibraryW (危险等级: 高, 被下面模块所HOOK: \SystemRoot\System32\drivers\klif.sys)

==================================
隐藏进程
N/A

==================================

瑞星卡卡安全论坛