瑞星卡卡安全论坛

首页 » 技术交流区 » 反病毒/反流氓软件论坛 » 文件消失,俯日志
xiaotedted - 2008-3-6 10:12:00
System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件
    进程特权扫描


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
    <swg><C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe>  [(Verified)Google Inc]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <RTHDCPL><RTHDCPL.EXE>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <Alcmtr><ALCMTR.EXE>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <amd_dc_opt><C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe>  [AMD]
    <360Safetray><F:\电爱\shadu\360safe\safemon\360Tray.exe /start>  [奇虎网]
    <AVP><"F:\新建\avp.exe">  [(Verified)Kaspersky Lab]
    <360Antiarp><F:\电爱\shadu\360safe\antiarp\AntiArp.exe /start>  [奇虎网]
    <!!QQKav><F:\木马专杀U盘\qqkav.exe>  [Jsing.Net & QQKav.Com]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows Component Publisher]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    <WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
    <WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll>  [(Verified)Kaspersky Lab]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
    <IE7 Uninstall Stub><C:\WINDOWS\system32\ieudinit.exe>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
    <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub>  [(Verified)Microsoft Windows Component Publisher]

==================================
启动文件夹
[腾讯QQ]
  <C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\腾讯QQ.lnk --> F:\QQ2007\QQ.exe [TENCENT]><N>

==================================
服务
[卡巴斯基反病毒软件 7.0 / AVP][Running/Auto Start]
  <F:\新建\avp.exe -r><Kaspersky Lab>
[Google Updater Service / gusvc][Stopped/Manual Start]
  <"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"><Google>
[Help and Support / helpsvc][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll><N/A>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[NetMeeting Remote Desktop Sharing / mnmsrvc][Stopped/Manual Start]
  <C:\WINDOWS\system32\mnmsrvc.exe><N/A>
[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
  <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[Remote Packet Capture Protocol v.0 (experimental) / rpcapd][Stopped/Manual Start]
  <"C:\Program Files\WinPcap\rpcapd.exe" -d -f "C:\Program Files\WinPcap\rpcapd.ini"><CACE Technologies>
[System Restore Service / srservice][Stopped/Disabled]
  <C:\WINDOWS\system32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\srsvc.dll><N/A>

==================================
驱动程序
[360AntiArp / 360AntiArp][Running/System Start]
  <\??\C:\WINDOWS\system32\drivers\360AntiArp.sys><奇虎网>
[AMD Processor Driver / AmdK8][Running/System Start]
  <System32\drivers\amdk8.sys><Advanced Micro Devices>
[AMD Low Level Device Driver / AmdLLD][Running/Manual Start]
  <system32\DRIVERS\AmdLLD.sys><AMD, Inc.>
[Microsoft UAA Bus Driver for High Definition Audio / HDAudBus][Running/Manual Start]
  <system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
[Service for Realtek HD Audio (WDM) / IntcAzAudAddService][Running/Manual Start]
  <system32\drivers\RtkHDAud.sys><Realtek Semiconductor Corp.>
[KAVBootC / KAVBootC][Running/Boot Start]
  <\SystemRoot\system32\Drivers\KAVBootC.sys><Kingsoft Corporation>
[KAVSafe / KAVSafe][Running/Auto Start]
  <\??\C:\WINDOWS\system32\Drivers\KAVSafe.sys><Kingsoft Corporation>
[kl1 / kl1][Running/Boot Start]
  <\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif][Running/System Start]
  <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[Kaspersky Anti-Virus NDIS Filter / klim5][Running/Manual Start]
  <system32\DRIVERS\klim5.sys><Kaspersky Lab>
[NetGroup Packet Filter Driver / NPF][Running/Manual Start]
  <system32\drivers\npf.sys><CACE Technologies>
[nv / nv][Running/Manual Start]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[nvata / nvata][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\nvata.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek 10/100/1000 PCI NIC Family NDIS XP Driver / RTL8023xp][Running/Manual Start]
  <system32\DRIVERS\Rtnicxp.sys><Realtek Semiconductor Corporation>
[Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver / RTLE8023xp][Stopped/Manual Start]
  <system32\DRIVERS\Rtenicxp.sys><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
[System Restore Filter Driver / sr][Stopped/Disabled]
  <\SystemRoot\system32\DRIVERS\sr.sys><N/A>
[WINIO / WINIO][Stopped/Manual Start]
  <\??\G:\winio.sys><N/A>
[xFileMgr / xFileMgr][Running/System Start]
  <\??\C:\WINDOWS\system32\Drivers

[用户系统信息]Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; QQDownload 1.7)
xiaotedted - 2008-3-6 10:13:00
==================================
浏览器加载项
[Windows Genuine Advantage Validation Tool]
  {17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft Corporation>
[Windows Media Player]
  {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[XML DOM Document]
  {2933BF90-7B36-11D2-B20E-00C04F983E60} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[WUWebControl Class]
  {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[XMP Class]
  {6483F145-A768-4C41-AACC-52D4D7845851} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xplayer.dll_1_work, N/A>
[XDRM]
  {693571CB-54A3-4E90-9D52-EEAE1334E2D3} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xdrm.dll_1_work, N/A>
[Microsoft Web Browser]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\ieframe.dll, Microsoft Corporation>
[RMGetLicense Class]
  {A9FC132B-096D-460B-B7D5-1DB0FAE0C062} <C:\WINDOWS\system32\msnetobj.dll, Microsoft Corporation>
[VIDEO__X_MS_ASF Moniker Class]
  {CD3AFA8F-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9e.ocx, Adobe Systems, Inc.>
[XML HTTP Request]
  {ED8C108E-4349-11D2-91A4-00C04F7969E8} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[XPPlayer Class]
  {F3E70CEA-956E-49CC-B444-73AFE593AD7F} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\pplayer.dll_1_work, N/A>
[XML DOM Document]
  {F6D90F11-9C73-11D3-B32E-00C04F990BB4} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[XML HTTP]
  {F6D90F16-9C73-11D3-B32E-00C04F990BB4} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>

==================================
正在运行的进程
[PID: 1068 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1132 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1156 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [F:\新建\miscr3.dll]  [Kaspersky Lab, 7.0.0.125]
    [C:\WINDOWS\system32\klogon.dll]  [Kaspersky Lab, 7.0.0.125]
    [C:\WINDOWS\system32\WgaLogon.dll]  [Microsoft Corporation, 1.7.0018.7]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1200 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\AppPatch\AcAdProc.dll]  [Microsoft Corporation, 5.1.2600.3008 (xpsp.061004-0027)]
[PID: 1212 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [F:\新建\dnsq.dll]  [Kaspersky Lab, 7.0.0.125]
    [F:\新建\miscr3.dll]  [Kaspersky Lab, 7.0.0.125]
[PID: 1388 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1492 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\TcpIpDog0.dll]  [N/A, ]
    [F:\新建\dnsq.dll]  [Kaspersky Lab, 7.0.0.125]
[PID: 1620 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [F:\新建\miscr3.dll]  [Kaspersky Lab, 7.0.0.125]
    [C:\WINDOWS\system32\TcpIpDog0.dll]  [N/A, ]
    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16608 (vista_gdr.071204-1500)]
    [C:\WINDOWS\System32\mscftp.dll]  [N/A, ]
    [C:\WINDOWS\system32\wups2.dll]  [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]
    [F:\新建\dnsq.dll]  [Kaspersky Lab, 7.0.0.125]
[PID: 1688 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\TcpIpDog0.dll]  [N/A, ]
[PID: 1768 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [F:\新建\dnsq.dll]  [Kaspersky Lab, 7.0.0.125]
[PID: 1924 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp.050610-1527)]
    [F:\新建\dnsq.dll]  [Kaspersky Lab, 7.0.0.125]
[PID: 280 / Administrator][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_qfe.070613-1311)]
    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16608 (vista_gdr.071204-1500)]
    [F:\新建\miscr3.dll]  [Kaspersky Lab, 7.0.0.125]
    [F:\新建\scrchpg.dll]  [Kaspersky Lab, 7.0.0.125]
    [C:\WINDOWS\system32\ieframe.dll]  [Microsoft Corporation, 7.00.6000.16608 (vista_gdr.071204-1500)]
    [F:\电爱\shadu\360safe\safemon\safemon.dll]  [奇虎网, 4, 0, 3, 1002]
    [C:\WINDOWS\system32\WPDShServiceObj.dll]  [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\PortableDeviceTypes.dll]  [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
    [C:\WINDOWS\system32\nvcpl.dll]  [NVIDIA Corporation, 6.14.11.6375]
    [C:\WINDOWS\system32\PortableDeviceApi.dll]  [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
    [C:\WINDOWS\system32\nvapi.dll]  [NVIDIA Corporation, 6.14.11.6375]
    [C:\WINDOWS\system32\SOGOUPY.IME]  [Sohu.com Inc., 3, 1, 0, 0]
    [C:\Program Files\SogouInput\Plugin\SgImeWord.dll]  [, 1, 0, 0, 31]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
    [F:\新建\ShellEx.dll]  [Kaspersky Lab, 7.0.0.125]
    [F:\新建\MSV
xiaotedted - 2008-3-6 10:13:00
[PID: 440 / Administrator][F:\电爱\shadu\360safe\antiarp\AntiArp.exe]  [奇虎网, 2, 0, 0, 1004]
    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16608 (vista_gdr.071204-1500)]
    [F:\电爱\shadu\360safe\safemon\safemon.dll]  [奇虎网, 4, 0, 3, 1002]
    [F:\新建\miscr3.dll]  [Kaspersky Lab, 7.0.0.125]
    [F:\新建\dnsq.dll]  [Kaspersky Lab, 7.0.0.125]
    [C:\WINDOWS\system32\TcpIpDog0.dll]  [N/A, ]
[PID: 464 / Administrator][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [F:\电爱\shadu\360safe\safemon\safemon.dll]  [奇虎网, 4, 0, 3, 1002]
[PID: 492 / Administrator][C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe]  [Google Inc., 2, 0, 301, 1654]
    [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\gtn.dll]  [Google Inc., 2, 0, 301, 7164]
    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16608 (vista_gdr.071204-1500)]
    [F:\电爱\shadu\360safe\safemon\safemon.dll]  [奇虎网, 4, 0, 3, 1002]
    [F:\新建\miscr3.dll]  [Kaspersky Lab, 7.0.0.125]
    [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\res_zh-CN.dll]  [Google Inc., 2, 0, 301, 7164]
    [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll]  [N/A, ]
[PID: 564 / SYSTEM][C:\WINDOWS\system32\nvsvc32.exe]  [NVIDIA Corporation, 6.14.11.6375]
    [C:\WINDOWS\system32\nvapi.dll]  [NVIDIA Corporation, 6.14.11.6375]
[PID: 1832 / Administrator][F:\Dr.COM 宽带认证客户端\ishare_user.exe]  [城市热点有限公司, 3, 484, 2, 1337]
    [C:\WINDOWS\system32\packet.dll]  [CACE Technologies, 4.0.0.755]
    [C:\WINDOWS\system32\WanPacket.dll]  [CACE Technologies, 4.0.0.755]
    [F:\电爱\shadu\360safe\safemon\safemon.dll]  [奇虎网, 4, 0, 3, 1002]
    [C:\WINDOWS\system32\TcpIpDog0.dll]  [N/A, ]
    [F:\新建\miscr3.dll]  [Kaspersky Lab, 7.0.0.125]
    [F:\新建\dnsq.dll]  [Kaspersky Lab, 7.0.0.125]
    [C:\WINDOWS\system32\ieframe.dll]  [Microsoft Corporation, 7.00.6000.16608 (vista_gdr.071204-1500)]
    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16608 (vista_gdr.071204-1500)]
    [F:\新建\scrchpg.dll]  [Kaspersky Lab, 7.0.0.125]
    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[PID: 980 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\TcpIpDog0.dll]  [N/A, ]
[PID: 3452 / Administrator][F:\QQ2007\QQ.exe]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\QQBaseClassInDll.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\QQHelperDll.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\BasicCtrlDll.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\MFC42.DLL]  [Microsoft Corporation, 6.00.8665.0]
    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16608 (vista_gdr.071204-1500)]
    [F:\电爱\shadu\360safe\safemon\safemon.dll]  [奇虎网, 4, 0, 3, 1002]
    [F:\QQ2007\RICHED32.DLL]  [Microsoft Corporation, 5.00.2134.1]
    [F:\QQ2007\RICHED20.dll]  [Microsoft Corporation, 5.31.23.1218]
    [F:\QQ2007\QQAPI.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\LoginCtrl.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\LoginCtrlRes.dll]  [TENCENT, 7,1,638,1773]
    [F:\新建\miscr3.dll]  [Kaspersky Lab, 7.0.0.125]
    [F:\QQ2007\QQRes.dll]  [TENCENT, 7,0,431,1723]
    [F:\QQ2007\QQMainFrame.dll]  [N/A, ]
    [F:\QQ2007\gdiplus.dll]  [Microsoft Corporation, 5.1.3102.2180 (xpsp_sp2_rtm.040803-2158)]
    [F:\QQ2007\UnReadMsgMgr.dll]  [N/A, ]
    [F:\QQ2007\QQPlugin.dll]  [N/A, ]
    [F:\QQ2007\CQQApplication.dll]  [N/A, ]
    [F:\QQ2007\FlashAvatarDll.dll]  [, 1, 4, 0, 1]
    [F:\QQ2007\NewSkin.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\MailSummary.dll]  [TENCENT, 7,1,638,1773]
    [F:\新建\dnsq.dll]  [Kaspersky Lab, 7.0.0.125]
    [F:\QQ2007\QQSpace.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\vbscript.dll]  [Microsoft Corporation, 5.6.0.7426]
    [C:\WINDOWS\system32\TcpIpDog0.dll]  [N/A, ]
    [C:\WINDOWS\system32\msdmo.dll]  [, ]
    [F:\QQ2007\QQKnowledgeSearch.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\OEMApplication.dll]  [TENCENT, 7,1,638,1773]
    [C:\WINDOWS\system32\ieframe.dll]  [Microsoft Corporation, 7.00.6000.16608 (vista_gdr.071204-1500)]
    [F:\新建\scrchpg.dll]  [Kaspersky Lab, 7.0.0.125]
    [F:\QQ2007\QQGroupMng.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\QQAllInOne.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\SCCore.dll]  [TENCENT, 1, 6, 0, 2]
    [F:\QQ2007\CameraDll.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\QQPet.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\QQSysMsgMng.dll]  [N/A, ]
    [F:\QQ2007\QQCustomFace.dll]  [N/A, ]
    [F:\QQ2007\UserDefinedHead.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\QQConfigPlugin.dll]  [TENCENT, 7,1,638,1773]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\msadp32.acm]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [F:\QQ2007\QRingMng.dll]  [N/A, ]
    [F:\QQ2007\ImageOle.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\QQLiveQMng.dll]  [TENCENT, 7,1,638,1773]
    [F:\新建\klscav.dll]  [Kaspersky Lab, 7.0.0.125]
    [F:\新建\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]
    [F:\新建\prremote.dll]  [Kaspersky Lab, 7.0.0.125]
    [F:\新建\MSVCP80.dll]  [Microsoft Corporation, 8.00.50727.42]
    [F:\新建\prloader.dll]  [Kaspersky Lab, 7.0.0.125]
    [F:\新建\prkernel.ppl]  [Kaspersky Lab, 7.0.0.125]
    [f:\新建\params.ppl]  [Kaspersky Lab, 7.0.0.125]
    [f:\新建\pxstub.ppl]  [Kaspersky Lab, 7.0.0.125]
    [f:\新建\tempfile.ppl]  [Kaspersky Lab, 7.0.0.125]
    [F:\QQ2007\LongConnectio
xiaotedted - 2008-3-6 10:15:00
[CODE]

2008-03-06,09:53:58

System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件
    进程特权扫描


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
    <swg><C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe>  [(Verified)Google Inc]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <RTHDCPL><RTHDCPL.EXE>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <Alcmtr><ALCMTR.EXE>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <amd_dc_opt><C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe>  [AMD]
    <360Safetray><F:\电爱\shadu\360safe\safemon\360Tray.exe /start>  [奇虎网]
    <AVP><"F:\新建\avp.exe">  [(Verified)Kaspersky Lab]
    <360Antiarp><F:\电爱\shadu\360safe\antiarp\AntiArp.exe /start>  [奇虎网]
    <!!QQKav><F:\木马专杀U盘\qqkav.exe>  [Jsing.Net & QQKav.Com]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows Component Publisher]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    <WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
    <WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll>  [(Verified)Kaspersky Lab]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
    <IE7 Uninstall Stub><C:\WINDOWS\system32\ieudinit.exe>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
    <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub>  [(Verified)Microsoft Windows Component Publisher]

==================================
启动文件夹
[腾讯QQ]
  <C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\腾讯QQ.lnk --> F:\QQ2007\QQ.exe [TENCENT]><N>

==================================
服务
[卡巴斯基反病毒软件 7.0 / AVP][Running/Auto Start]
  <F:\新建\avp.exe -r><Kaspersky Lab>
[Google Updater Service / gusvc][Stopped/Manual Start]
  <"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"><Google>
[Help and Support / helpsvc][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll><N/A>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[NetMeeting Remote Desktop Sharing / mnmsrvc][Stopped/Manual Start]
  <C:\WINDOWS\system32\mnmsrvc.exe><N/A>
[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
  <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[Remote Packet Capture Protocol v.0 (experimental) / rpcapd][Stopped/Manual Start]
  <"C:\Program Files\WinPcap\rpcapd.exe" -d -f "C:\Program Files\WinPcap\rpcapd.ini"><CACE Technologies>
[System Restore Service / srservice][Stopped/Disabled]
  <C:\WINDOWS\system32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\srsvc.dll><N/A>
xiaotedted - 2008-3-6 10:16:00
==================================
驱动程序
[360AntiArp / 360AntiArp][Running/System Start]
  <\??\C:\WINDOWS\system32\drivers\360AntiArp.sys><奇虎网>
[AMD Processor Driver / AmdK8][Running/System Start]
  <System32\drivers\amdk8.sys><Advanced Micro Devices>
[AMD Low Level Device Driver / AmdLLD][Running/Manual Start]
  <system32\DRIVERS\AmdLLD.sys><AMD, Inc.>
[Microsoft UAA Bus Driver for High Definition Audio / HDAudBus][Running/Manual Start]
  <system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
[Service for Realtek HD Audio (WDM) / IntcAzAudAddService][Running/Manual Start]
  <system32\drivers\RtkHDAud.sys><Realtek Semiconductor Corp.>
[KAVBootC / KAVBootC][Running/Boot Start]
  <\SystemRoot\system32\Drivers\KAVBootC.sys><Kingsoft Corporation>
[KAVSafe / KAVSafe][Running/Auto Start]
  <\??\C:\WINDOWS\system32\Drivers\KAVSafe.sys><Kingsoft Corporation>
[kl1 / kl1][Running/Boot Start]
  <\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif][Running/System Start]
  <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[Kaspersky Anti-Virus NDIS Filter / klim5][Running/Manual Start]
  <system32\DRIVERS\klim5.sys><Kaspersky Lab>
[NetGroup Packet Filter Driver / NPF][Running/Manual Start]
  <system32\drivers\npf.sys><CACE Technologies>
[nv / nv][Running/Manual Start]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[nvata / nvata][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\nvata.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek 10/100/1000 PCI NIC Family NDIS XP Driver / RTL8023xp][Running/Manual Start]
  <system32\DRIVERS\Rtnicxp.sys><Realtek Semiconductor Corporation>
[Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver / RTLE8023xp][Stopped/Manual Start]
  <system32\DRIVERS\Rtenicxp.sys><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
[System Restore Filter Driver / sr][Stopped/Disabled]
  <\SystemRoot\system32\DRIVERS\sr.sys><N/A>
[WINIO / WINIO][Stopped/Manual Start]
  <\??\G:\winio.sys><N/A>
[xFileMgr / xFileMgr][Running/System Start]
  <\??\C:\WINDOWS\system32\Drivers\xFileMgr.sys><MS User>

==================================
浏览器加载项
[Windows Genuine Advantage Validation Tool]
  {17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft Corporation>
[Windows Media Player]
  {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[XML DOM Document]
  {2933BF90-7B36-11D2-B20E-00C04F983E60} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[WUWebControl Class]
  {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[XMP Class]
  {6483F145-A768-4C41-AACC-52D4D7845851} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xplayer.dll_1_work, N/A>
[XDRM]
  {693571CB-54A3-4E90-9D52-EEAE1334E2D3} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xdrm.dll_1_work, N/A>
[Microsoft Web Browser]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\ieframe.dll, Microsoft Corporation>
[RMGetLicense Class]
  {A9FC132B-096D-460B-B7D5-1DB0FAE0C062} <C:\WINDOWS\system32\msnetobj.dll, Microsoft Corporation>
[VIDEO__X_MS_ASF Moniker Class]
  {CD3AFA8F-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9e.ocx, Adobe Systems, Inc.>
[XML HTTP Request]
  {ED8C108E-4349-11D2-91A4-00C04F7969E8} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[XPPlayer Class]
  {F3E70CEA-956E-49CC-B444-73AFE593AD7F} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\pplayer.dll_1_work, N/A>
[XML DOM Document]
  {F6D90F11-9C73-11D3-B32E-00C04F990BB4} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[XML HTTP]
  {F6D90F16-9C73-11D3-B32E-00C04F990BB4} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
xiaotedted - 2008-3-6 10:16:00
==================================
正在运行的进程
[PID: 1068 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1132 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1156 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [F:\新建\miscr3.dll]  [Kaspersky Lab, 7.0.0.125]
    [C:\WINDOWS\system32\klogon.dll]  [Kaspersky Lab, 7.0.0.125]
    [C:\WINDOWS\system32\WgaLogon.dll]  [Microsoft Corporation, 1.7.0018.7]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1200 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\AppPatch\AcAdProc.dll]  [Microsoft Corporation, 5.1.2600.3008 (xpsp.061004-0027)]
[PID: 1212 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [F:\新建\dnsq.dll]  [Kaspersky Lab, 7.0.0.125]
    [F:\新建\miscr3.dll]  [Kaspersky Lab, 7.0.0.125]
[PID: 1388 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1492 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\TcpIpDog0.dll]  [N/A, ]
    [F:\新建\dnsq.dll]  [Kaspersky Lab, 7.0.0.125]
[PID: 1620 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [F:\新建\miscr3.dll]  [Kaspersky Lab, 7.0.0.125]
    [C:\WINDOWS\system32\TcpIpDog0.dll]  [N/A, ]
    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16608 (vista_gdr.071204-1500)]
    [C:\WINDOWS\System32\mscftp.dll]  [N/A, ]
    [C:\WINDOWS\system32\wups2.dll]  [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]
    [F:\新建\dnsq.dll]  [Kaspersky Lab, 7.0.0.125]
[PID: 1688 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\TcpIpDog0.dll]  [N/A, ]
[PID: 1768 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [F:\新建\dnsq.dll]  [Kaspersky Lab, 7.0.0.125]
[PID: 1924 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp.050610-1527)]
    [F:\新建\dnsq.dll]  [Kaspersky Lab, 7.0.0.125]
[PID: 280 / Administrator][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_qfe.070613-1311)]
    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16608 (vista_gdr.071204-1500)]
    [F:\新建\miscr3.dll]  [Kaspersky Lab, 7.0.0.125]
    [F:\新建\scrchpg.dll]  [Kaspersky Lab, 7.0.0.125]
    [C:\WINDOWS\system32\ieframe.dll]  [Microsoft Corporation, 7.00.6000.16608 (vista_gdr.071204-1500)]
    [F:\电爱\shadu\360safe\safemon\safemon.dll]  [奇虎网, 4, 0, 3, 1002]
    [C:\WINDOWS\system32\WPDShServiceObj.dll]  [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\PortableDeviceTypes.dll]  [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
    [C:\WINDOWS\system32\nvcpl.dll]  [NVIDIA Corporation, 6.14.11.6375]
    [C:\WINDOWS\system32\PortableDeviceApi.dll]  [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
    [C:\WINDOWS\system32\nvapi.dll]  [NVIDIA Corporation, 6.14.11.6375]
    [C:\WINDOWS\system32\SOGOUPY.IME]  [Sohu.com Inc., 3, 1, 0, 0]
    [C:\Program Files\SogouInput\Plugin\SgImeWord.dll]  [, 1, 0, 0, 31]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
    [F:\新建\ShellEx.dll]  [Kaspersky Lab, 7.0.0.125]
    [F:\新建\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]
    [F:\新建\MSVCP80.dll]  [Microsoft Corporation, 8.00.50727.42]
    [C:\WINDOWS\system32\icm32.dll]  [Microsoft Corporation, 5.1.2600.2709 (xpsp.050628-1523)]
    [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
[PID: 360 / Administrator][C:\WINDOWS\RTHDCPL.EXE]  [Realtek Semiconductor Corp., 2.1.8.2]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 412 / Administrator][F:\电爱\shadu\360safe\safemon\360Tray.exe]  [奇虎网, 4, 0, 3, 1002]
    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16608 (vista_gdr.071204-1500)]
    [F:\电爱\shadu\360safe\safemon\safemon.dll]  [奇虎网, 4, 0, 3, 1002]
    [F:\电爱\shadu\360safe\safemon\SafeKrnl.dll]  [奇虎网, 4, 0, 3, 1001]
    [F:\电爱\shadu\360safe\AntiAdwa.dll]  [360Safe.com, 4, 0, 0, 1002]
    [F:\电爱\shadu\360safe\live.dll]  [N/A, ]
    [F:\新建\miscr3.dll]  [Kaspersky Lab, 7.0.0.125]
    [F:\新建\dnsq.dll]  [Kaspersky Lab, 7.0.0.125]
    [C:\WINDOWS\system32\TcpIpDog0.dll]  [N/A, ]
[PID: 440 / Administrator][F:\电爱\shadu\360safe\antiarp\AntiArp.exe]  [奇虎网, 2, 0, 0, 100
xiaotedted - 2008-3-6 10:18:00
[C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16608 (vista_gdr.071204-1500)]
    [F:\电爱\shadu\360safe\safemon\safemon.dll]  [奇虎网, 4, 0, 3, 1002]
    [F:\新建\miscr3.dll]  [Kaspersky Lab, 7.0.0.125]
    [F:\新建\dnsq.dll]  [Kaspersky Lab, 7.0.0.125]
    [C:\WINDOWS\system32\TcpIpDog0.dll]  [N/A, ]
[PID: 464 / Administrator][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [F:\电爱\shadu\360safe\safemon\safemon.dll]  [奇虎网, 4, 0, 3, 1002]
[PID: 492 / Administrator][C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe]  [Google Inc., 2, 0, 301, 1654]
    [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\gtn.dll]  [Google Inc., 2, 0, 301, 7164]
    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16608 (vista_gdr.071204-1500)]
    [F:\电爱\shadu\360safe\safemon\safemon.dll]  [奇虎网, 4, 0, 3, 1002]
    [F:\新建\miscr3.dll]  [Kaspersky Lab, 7.0.0.125]
    [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\res_zh-CN.dll]  [Google Inc., 2, 0, 301, 7164]
    [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll]  [N/A, ]
[PID: 564 / SYSTEM][C:\WINDOWS\system32\nvsvc32.exe]  [NVIDIA Corporation, 6.14.11.6375]
    [C:\WINDOWS\system32\nvapi.dll]  [NVIDIA Corporation, 6.14.11.6375]
[PID: 1832 / Administrator][F:\Dr.COM 宽带认证客户端\ishare_user.exe]  [城市热点有限公司, 3, 484, 2, 1337]
    [C:\WINDOWS\system32\packet.dll]  [CACE Technologies, 4.0.0.755]
    [C:\WINDOWS\system32\WanPacket.dll]  [CACE Technologies, 4.0.0.755]
    [F:\电爱\shadu\360safe\safemon\safemon.dll]  [奇虎网, 4, 0, 3, 1002]
    [C:\WINDOWS\system32\TcpIpDog0.dll]  [N/A, ]
    [F:\新建\miscr3.dll]  [Kaspersky Lab, 7.0.0.125]
    [F:\新建\dnsq.dll]  [Kaspersky Lab, 7.0.0.125]
    [C:\WINDOWS\system32\ieframe.dll]  [Microsoft Corporation, 7.00.6000.16608 (vista_gdr.071204-1500)]
    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16608 (vista_gdr.071204-1500)]
    [F:\新建\scrchpg.dll]  [Kaspersky Lab, 7.0.0.125]
    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[PID: 980 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\TcpIpDog0.dll]  [N/A, ]
[PID: 3452 / Administrator][F:\QQ2007\QQ.exe]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\QQBaseClassInDll.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\QQHelperDll.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\BasicCtrlDll.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\MFC42.DLL]  [Microsoft Corporation, 6.00.8665.0]
    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16608 (vista_gdr.071204-1500)]
    [F:\电爱\shadu\360safe\safemon\safemon.dll]  [奇虎网, 4, 0, 3, 1002]
    [F:\QQ2007\RICHED32.DLL]  [Microsoft Corporation, 5.00.2134.1]
    [F:\QQ2007\RICHED20.dll]  [Microsoft Corporation, 5.31.23.1218]
    [F:\QQ2007\QQAPI.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\LoginCtrl.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\LoginCtrlRes.dll]  [TENCENT, 7,1,638,1773]
    [F:\新建\miscr3.dll]  [Kaspersky Lab, 7.0.0.125]
    [F:\QQ2007\QQRes.dll]  [TENCENT, 7,0,431,1723]
    [F:\QQ2007\QQMainFrame.dll]  [N/A, ]
    [F:\QQ2007\gdiplus.dll]  [Microsoft Corporation, 5.1.3102.2180 (xpsp_sp2_rtm.040803-2158)]
    [F:\QQ2007\UnReadMsgMgr.dll]  [N/A, ]
    [F:\QQ2007\QQPlugin.dll]  [N/A, ]
    [F:\QQ2007\CQQApplication.dll]  [N/A, ]
    [F:\QQ2007\FlashAvatarDll.dll]  [, 1, 4, 0, 1]
    [F:\QQ2007\NewSkin.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\MailSummary.dll]  [TENCENT, 7,1,638,1773]
xiaotedted - 2008-3-6 10:18:00
[F:\新建\dnsq.dll]  [Kaspersky Lab, 7.0.0.125]
    [F:\QQ2007\QQSpace.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\vbscript.dll]  [Microsoft Corporation, 5.6.0.7426]
    [C:\WINDOWS\system32\TcpIpDog0.dll]  [N/A, ]
    [C:\WINDOWS\system32\msdmo.dll]  [, ]
    [F:\QQ2007\QQKnowledgeSearch.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\OEMApplication.dll]  [TENCENT, 7,1,638,1773]
    [C:\WINDOWS\system32\ieframe.dll]  [Microsoft Corporation, 7.00.6000.16608 (vista_gdr.071204-1500)]
    [F:\新建\scrchpg.dll]  [Kaspersky Lab, 7.0.0.125]
    [F:\QQ2007\QQGroupMng.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\QQAllInOne.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\SCCore.dll]  [TENCENT, 1, 6, 0, 2]
    [F:\QQ2007\CameraDll.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\QQPet.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\QQSysMsgMng.dll]  [N/A, ]
    [F:\QQ2007\QQCustomFace.dll]  [N/A, ]
    [F:\QQ2007\UserDefinedHead.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\QQConfigPlugin.dll]  [TENCENT, 7,1,638,1773]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\msadp32.acm]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [F:\QQ2007\QRingMng.dll]  [N/A, ]
    [F:\QQ2007\ImageOle.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\QQLiveQMng.dll]  [TENCENT, 7,1,638,1773]
    [F:\新建\klscav.dll]  [Kaspersky Lab, 7.0.0.125]
    [F:\新建\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]
    [F:\新建\prremote.dll]  [Kaspersky Lab, 7.0.0.125]
    [F:\新建\MSVCP80.dll]  [Microsoft Corporation, 8.00.50727.42]
    [F:\新建\prloader.dll]  [Kaspersky Lab, 7.0.0.125]
    [F:\新建\prkernel.ppl]  [Kaspersky Lab, 7.0.0.125]
    [f:\新建\params.ppl]  [Kaspersky Lab, 7.0.0.125]
    [f:\新建\pxstub.ppl]  [Kaspersky Lab, 7.0.0.125]
    [f:\新建\tempfile.ppl]  [Kaspersky Lab, 7.0.0.125]
    [F:\QQ2007\LongConnection.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\QQAvatar.dll]  [N/A, ]
    [F:\QQ2007\PhoneAPI.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\DialerAllinOne.dll]  [tencent, 1, 4, 0, 0]
    [F:\QQ2007\BQQApplication.dll]  [N/A, ]
    [F:\QQ2007\GroupConnection.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\QQSceneMng.dll]  [N/A, ]
    [F:\QQ2007\CommercesMng.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\PersonalDesktop.dll]  [TENCENT, 7,1,638,1773]
    [F:\QQ2007\QQAddr.dll]  [深圳市腾讯计算机系统有限公司, 5, 0, 101, 330]
    [F:\QQ2007\AddrSearch.dll]  [腾讯科技（深圳）有限公司, 2, 2, 1, 13]
    [F:\QQ2007\QQDoctor\TSVulMdw.dat]  [TENCENT, 2007, 4, 26, 2]
    [F:\QQ2007\QQMagicFace.dll]  [TENCENT, 7,1,638,1773]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9e.ocx]  [Adobe Systems, Inc., 9,0,115,0]
    [C:\WINDOWS\system32\SOGOUPY.IME]  [Sohu.com Inc., 3, 1, 0, 0]
    [C:\Program Files\SogouInput\Plugin\SgImeWord.dll]  [, 1, 0, 0, 31]
    [F:\QQ2007\QQFileTransfer.dll]  [TENCENT, 7,1,638,1773]
[PID: 3516 / Administrator][F:\QQ2007\TXPlatform.exe]  [Tencent, 1, 0, 170, 0]
    [F:\电爱\shadu\360safe\safemon\safemon.dll]  [奇虎网, 4, 0, 3, 1002]
[PID: 2620 / Administrator][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [F:\电爱\shadu\360safe\safemon\safemon.dll]  [奇虎网, 4, 0, 3, 1002]
[PID: 2524 / Administrator][D:\千千静听\TTPlayer.exe]  [Alen Soft, 5, 0, 0, 0]
    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16608 (vista_gdr.071204-1500)]
    [D:\千千静听\ttpcomm.dll]  [N/A, ]
    [F:\电爱\shadu\360safe\safemon\safemon.dll]  [奇虎网, 4, 0, 3, 1002]
    [D:\千千静听\ttpres.dll]  [Alen Soft, 5, 0, 0, 0]
    [D:\千千静听\msdmo.dll]  [Microsoft Corporation, 6.03.01.0400]
    [F:\新建\miscr3.dll]  [Kaspersky Lab, 7.0.0.125]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\千千静听\mp3PRO.dll]  [Coding Technologies GmbH, 1, 1, 0, 0]
    [D:\千千静听\AddIn\ttp_lrcsh.dll]  [N/A, ]
    [F:\新建\dnsq.dll]  [Kaspersky Lab, 7.0.0.125]
    [C:\WINDOWS\system32\TcpIpDog0.dll]  [N/A, ]
    [D:\千千静听\AddIn\ttp_asf.dll]  [N/A, ]
    [D:\千千静听\AddIn\ttp_rm.dll]  [N/A, ]
[PID: 2104 / Administrator][G:\金山词霸2007\xdict.exe]  [Kingsoft Co, Ltd., 10, 0, 0, 1]
    [G:\金山词霸2007\ITEXTOUT.DLL]  [Kingsoft, 1, 1, 0, 1]
    [G:\金山词霸2007\XFILE.DLL]  [N/A, ]
    [G:\金山词霸2007\KPIC10.DLL]  [N/A, ]
    [G:\金山词霸2007\ijl11.dll]  [Intel Corporation, 1.1.2]
    [G:\金山词霸2007\TOTTSENGINE50.DLL]  [Kingsoft Corporation, 1, 0, 0, 1]
    [G:\金山词霸2007\NORMGRAB.DLL]  [Kingsoft Co, Ltd., 9, 0, 0, 1]
    [G:\金山词霸2007\ACCOUNTACTIVATE.DLL]  [N/A, ]
    [G:\金山词霸2007\STATISTICS.DLL]  [N/A, ]
    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16608 (vista_gdr.071204-1500)]
    [F:\新建\miscr3.dll]  [Kaspersky Lab, 7.0.0.125]
    [F:\电爱\shadu\360safe\safemon\safemon.dll]  [奇虎网, 4, 0, 3, 1002]
    [G:\金山词霸2007\DBCore10.dll]  [Kingsoft  Corp., 1, 5, 0, 1]
    [G:\金山词霸2007\XdictGrb.dll]  [Kingsoft Co, Ltd., 9, 0, 0, 2]
    [G:\金山词霸2007\DictionaryManager.dll]  [, 1, 0, 0, 1]
    [G:\金山词霸2007\Xml2Xdata.dll]  [, 1, 0, 0, 1]
xiaotedted - 2008-3-6 10:19:00

    [C:\PROGRA~1\COMMON~1\MICROS~1\Speech\sapi.dll]  [Microsoft Corporation, 5.1.4111.00  (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\PROGRA~1\COMMON~1\SPEECH~1\MICROS~1\TTS\1033\spttseng.dll]  [Microsoft Corporation, 5.1.4111.00  (XPClient.010817-1148)]
    [C:\PROGRA~1\COMMON~1\SPEECH~1\MICROS~1\spcommon.dll]  [Microsoft Corporation, 5.1.4111.00  (XPClient.010817-1148)]
    [G:\金山词霸2007\KAVPassport.DLL]  [Kingsoft Corporation, 2005, 9, 27, 0]
    [C:\WINDOWS\system32\ieframe.dll]  [Microsoft Corporation, 7.00.6000.16608 (vista_gdr.071204-1500)]
    [F:\新建\scrchpg.dll]  [Kaspersky Lab, 7.0.0.125]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9e.ocx]  [Adobe Systems, Inc., 9,0,115,0]
    [C:\WINDOWS\system32\TcpIpDog0.dll]  [N/A, ]
    [F:\新建\dnsq.dll]  [Kaspersky Lab, 7.0.0.125]
[PID: 3272 / Administrator][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 7.00.6000.16608 (vista_gdr.071204-1500)]
    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16608 (vista_gdr.071204-1500)]
    [F:\新建\miscr3.dll]  [Kaspersky Lab, 7.0.0.125]
    [C:\WINDOWS\system32\IEFRAME.dll]  [Microsoft Corporation, 7.00.6000.16608 (vista_gdr.071204-1500)]
    [F:\新建\scrchpg.dll]  [Kaspersky Lab, 7.0.0.125]
    [F:\电爱\shadu\360safe\safemon\safemon.dll]  [奇虎网, 4, 0, 3, 1002]
    [C:\WINDOWS\system32\IEUI.dll]  [Microsoft Corporation, 7.00.5730.13 (longhorn(wmbla).070711-1130)]
    [C:\WINDOWS\system32\xmllite.dll]  [Microsoft Corporation, 1.00.1018.0]
    [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
    [C:\Program Files\Internet Explorer\ieproxy.dll]  [Microsoft Corporation, 7.00.5730.13 (longhorn(wmbla).070711-1130)]
    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
    [C:\WINDOWS\system32\TcpIpDog0.dll]  [N/A, ]
    [F:\新建\dnsq.dll]  [Kaspersky Lab, 7.0.0.125]
    [C:\WINDOWS\system32\ieapfltr.dll]  [Microsoft Corporation, 7.0.6000.16461]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9e.ocx]  [Adobe Systems, Inc., 9,0,115,0]
    [C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL]  [Microsoft Corporation, 11.0.8164]
    [F:\新建\klscav.dll]  [Kaspersky Lab, 7.0.0.125]
    [F:\新建\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]
    [F:\新建\prremote.dll]  [Kaspersky Lab, 7.0.0.125]
    [F:\新建\MSVCP80.dll]  [Microsoft Corporation, 8.00.50727.42]
    [F:\新建\prloader.dll]  [Kaspersky Lab, 7.0.0.125]
    [F:\新建\prkernel.ppl]  [Kaspersky Lab, 7.0.0.125]
    [f:\新建\params.ppl]  [Kaspersky Lab, 7.0.0.125]
    [f:\新建\pxstub.ppl]  [Kaspersky Lab, 7.0.0.125]
    [f:\新建\tempfile.ppl]  [Kaspersky Lab, 7.0.0.125]
    [f:\新建\nfio.ppl]  [Kaspersky Lab, 7.0.0.125]
    [f:\新建\fsdrvplg.ppl]  [Kaspersky Lab, 7.0.0.125]
    [f:\新建\basegui.ppl]  [Kaspersky Lab, 7.0.0.125]
    [f:\新建\thpimpl.ppl]  [Kaspersky Lab, 7.0.0.125]
    [f:\新建\FSSync.dll]  [Kaspersky Lab, 7.0.5.125]
    [f:\新建\winreg.ppl]  [Kaspersky Lab, 7.0.0.125]
    [C:\WINDOWS\system32\freeime.ime]  [极点五笔工作室, 6.10.950]
[PID: 3404 / Administrator][C:\Documents and Settings\Administrator\桌面\sreng2\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16608 (vista_gdr.071204-1500)]
    [F:\电爱\shadu\360safe\safemon\safemon.dll]  [奇虎网, 4, 0, 3, 1002]
    [C:\Documents and Settings\Administrator\桌面\sreng2\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]
    [F:\新建\miscr3.dll]  [Kaspersky Lab, 7.0.0.125]
    [F:\新建\dnsq.dll]  [Kaspersky Lab, 7.0.0.125]
    [C:\WINDOWS\system32\TcpIpDog0.dll]  [N/A, ]
xiaotedted - 2008-3-6 10:19:00
==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
MSAFD Tcpip [TCP/IP]
    C:\WINDOWS\system32\TcpIpDog0.dll(, N/A)
MSAFD Tcpip [UDP/IP]
    C:\WINDOWS\system32\TcpIpDog0.dll(, N/A)
MSAFD Tcpip [RAW/IP]
    C:\WINDOWS\system32\TcpIpDog0.dll(, N/A)
RSVP UDP Service Provider
    C:\WINDOWS\system32\TcpIpDogR0.dll(, N/A)
RSVP TCP Service Provider
    C:\WINDOWS\system32\TcpIpDogR0.dll(, N/A)

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
N/A

==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 1156, C:\WINDOWS\SYSTEM32\WINLOGON.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 412, F:\电爱\SHADU\360SAFE\SAFEMON\360TRAY.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 412, F:\电爱\SHADU\360SAFE\SAFEMON\360TRAY.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 440, F:\电爱\SHADU\360SAFE\ANTIARP\ANTIARP.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 564, C:\WINDOWS\SYSTEM32\NVSVC32.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1832, F:\DR.COM 宽带认证客户端\ISHARE_USER.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2524, D:\千千静听\TTPLAYER.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2104, G:\金山词霸2007\XDICT.EXE]

==================================
API HOOK
RVA  错误： LoadLibraryA (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA  错误： LoadLibraryExA (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA  错误： LoadLibraryExW (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA  错误： LoadLibraryW (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA  错误： GetProcAddress (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)

==================================
隐藏进程
N/A

==================================


[/CODE]
天月来了 - 2008-3-6 10:48:00
详细描述怎样个文件消失？？？？

xiaotedted - 2008-3-6 12:46:00
就是我盘的文件都看不见,但是它依然占用我的空间,而且空间还被一些我不知道的东西占用了很多~
1
查看完整版本: 文件消失,俯日志
© 2000 - 2026 Rising Corp. Ltd.