[CODE] 2008-05-29,22:12:49 System Repair Engineer 2.5.16.900 Smallfrogs (http://www.KZTechs.com) Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能 以下内容被选中: 所有的启动项目(包括注册表、启动文件夹、服务等) 浏览器加载项 正在运行的进程(包括进程模块信息) 文件关联 Winsock 提供者 Autorun.inf HOSTS 文件 进程特权扫描 启动项目 注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] [(Verified)Microsoft Windows Publisher] [(Verified)Google Inc] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] [Realtek Semiconductor Corp.] <360Safebox><"D:\360Safebox\SafeBoxTray.exe" /r> [(Verified)Qizhi Software (beijing) Co. Ltd] <360Antiarp> [(Verified)Qizhi Software (beijing) Co. Ltd] <"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.] <360Safetray> [(Verified)Qizhi Software (beijing) Co. Ltd] [(Verified)ShenZhen Thunder Networking Technologies Ltd.] [Vimicro] [Vimicro] [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] [(Verified)Microsoft Windows Publisher] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}] <%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] <%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] <%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] <"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A] [HKEY_CURRENT_USER\Control Panel\Desktop] [Microsoft] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Component Publisher] <; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [N/A] <; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [N/A] <; "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti> [] ================================== 启动文件夹 [壁纸自动换] C:\WINDOWS\system32\bgswitch.exe [N/A]> ================================== 服务 [Google Updater Service / gusvc][Stopped/Manual Start] <"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"> [Human Interface Device Access / HidServ][Stopped/Disabled] %SystemRoot%\System32\hidserv.dll> ================================== 驱动程序 [360AntiArp / 360AntiArp][Running/System Start] <\??\C:\WINDOWS\system32\drivers\360AntiArp.sys><360安全中心> [a320raid / a320raid][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\a320raid.sys> [AAC / AAC][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\AAC.SYS> [aar1210 / aar1210][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\aar1210.sys> [abp480n5 / abp480n5][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\abp480n5.sys> [Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Stopped/Manual Start] [adpu160m / adpu160m][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\adpu160m.sys> [adpu320 / adpu320][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\adpu320.sys> [ACARD AEC6210UF UltraDMA33 Controller / aec6210][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\aec6210.sys> [ACARD AEC6260 UltraDMA-66 Controller / aec6260][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\aec6260.sys> [aec6280 / aec6280][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\aec6280.sys> [AEC6290 / AEC6290][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\AEC6290.SYS> [AEC67160 / AEC67160][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\AEC67160.SYS> [AEC671X / AEC671X][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\AEC671X.SYS> [AEC6880 / AEC6880][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\AEC6880.SYS> [AEC6890 / AEC6890][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\AEC6890.sys> [aec68x5 / aec68x5][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\aec68x5.sys> [Aha154x / Aha154x][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\aha154x.sys> [aic78u2 / aic78u2][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\aic78u2.sys> [aic78xx / aic78xx][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\aic78xx.sys> [Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start] [AliIde / AliIde][Running/Boot Start] <\SystemRoot\System32\DRIVERS\aliide.sys> [AMD K8 Processor Driver / AmdK8][Stopped/Manual Start] [arc / arc][Stopped/Boot Start] <\SystemRoot\system32\drivers\arc.sys> [asc / asc][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\asc.sys> [asc3550 / asc3550][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\asc3550.sys> [ati2mtag / ati2mtag][Running/Manual Start] [CmdIde / CmdIde][Running/Boot Start] <\SystemRoot\System32\DRIVERS\cmdide.sys> [dac2w2k / dac2w2k][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\dac2w2k.sys> [dpti2o / dpti2o][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\dpti2o.sys> [elxstor / elxstor][Stopped/Boot Start] <\SystemRoot\system32\drivers\elxstor.sys> [FASTSX / FASTSX][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\FASTSX.SYS> [fasttrak / fasttrak][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\fasttrak.sys> [fasttx2k / fasttx2k][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\fasttx2k.sys> [fasttx2k2 / fasttx2k2][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\fasttx2k2.sys> [VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Stopped/Manual Start] [HpCISSs / HpCISSs][Stopped/Boot Start] <\SystemRoot\system32\drivers\hpcisss.sys> [Hpt366 / Hpt366][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\Hpt366.sys> [HPT371 / HPT371][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\HPT371.sys> [hpt374 / hpt374][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\hpt374.sys> [hpt3xx / hpt3xx][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\hpt3xx.sys> [hptmv / hptmv][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\hptmv.sys> [hptpro / hptpro][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\hptpro.sys> [Intel Integrated RAID / iaStor][Stopped/Boot Start] <\SystemRoot\system32\drivers\iaStor.sys> [iirsp / iirsp][Stopped/Boot Start] <\SystemRoot\system32\drivers\iirsp.sys> [ini910u / ini910u][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\ini910u.sys> [ITERAID_Service_Install / iteraid][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\iteraid.sys> [LSI_SAS / LSI_SAS][Stopped/Boot Start] <\SystemRoot\system32\drivers\lsi_sas.sys> [LSI_SCSI / LSI_SCSI][Stopped/Boot Start] <\SystemRoot\system32\drivers\lsi_scsi.sys> [m5228 / m5228][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\m5228.sys> [m5281 / m5281][Stopped/Boot Start] <\SystemRoot\system32\drivers\m5281.sys> [MegaIDE / MegaIDE][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\MegaIDE.sys> [megasas / megasas][Stopped/Boot Start] <\SystemRoot\system32\drivers\megasas.sys> [mraid2k / mraid2k][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\mraid2k.sys> [mraid35x / mraid35x][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\mraid35x.sys> [nfrd960 / nfrd960][Stopped/Boot Start] <\SystemRoot\system32\drivers\nfrd960.sys> [npkcrypt / npkcrypt][Running/Auto Start] <\??\C:\Program Files\QQ2005\npkcrypt.sys> [nv / nv][Stopped/Manual Start] [Intel SCSI Controller / NvAtaBus][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\NVATABUS.SYS> [NVIDIA nForce(tm) RAID Class Driver / nvraid][Stopped/Boot Start] <\SystemRoot\system32\DRIVERS\nvraid.sys> [DDK PACKET Protocol / Packet][Running/Manual Start] <360安全中心> [PNP649R / PNP649R][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\PNP649R.SYS> [SiI 680 ATA Controller / Pnp680][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\pnp680.sys> [Silicon Image SiI 0680 Medley Raid Controller / Pnp680r][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\pnp680r.sys> [Direct Parallel Link Driver / Ptilink][Running/Manual Start] [ql1080 / ql1080][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\ql1080.sys> [Ql10wnt / Ql10wnt][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\ql10wnt.sys> [ql12160 / ql12160][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\ql12160.sys> [ql1280 / ql1280][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\ql1280.sys> [QLogic Fibre Channel SCSI Miniport Driver / ql2300][Stopped/Boot Start] <\SystemRoot\system32\drivers\ql2300.sys> [RAIDSRC / RAIDSRC][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\RAIDSRC.SYS> [Realtek 10/100/1000 NIC Family all in one NDIS XP Driver / RTL8023xp][Running/Manual Start] [S150SX8 / S150SX8][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\S150SX8.SYS> [SafeBoxKrnl / SafeBoxKrnl][Running/System Start] <\??\D:\360Safebox\SafeBoxKrnl.sys><360安全中心> [Secdrv / Secdrv][Stopped/Manual Start] [SiI-3512 SATALink Controller / SI3112][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\SI3112.sys> [Silicon Image SiI 3512 SATARaid Controller / SI3112r][Stopped/Boot Start] <\SystemRoot\system32\drivers\SI3112r.sys> [SiI-3114 SATALink Controller / SI3114][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\SI3114.sys> [SiI-3114 SATARaid Controller / SI3114r][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\SI3114R.sys> [SiI-3124 SATALink Controller / SI3124][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\SI3124.sys> [SiI-3124 SATARaid Controller / SI3124r][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\SI3124R.sys> [SATALink driver accelerator / SiFilter][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\SiWinAcc.sys> [SISIDE / SISIDE][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\SISIDE.SYS> [SiSRaid / SiSRaid][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\SiSRaid.sys> [SiSRaid1 / SiSRaid1][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\SiSRaid1.sys> [SISRAIDS / SISRAIDS][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\SISRAIDS.SYS> [Sparrow / Sparrow][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\sparrow.sys> [sptd / sptd][Running/Boot Start] <\SystemRoot\System32\Drivers\sptd.sys> [sptrak / sptrak][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\sptrak.sys> [symc810 / symc810][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\symc810.sys> [symc8xx / symc8xx][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\symc8xx.sys> [SYMMPI / SYMMPI][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\SYMMPI.SYS> [sym_hi / sym_hi][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\sym_hi.sys> [sym_u3 / sym_u3][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\sym_u3.sys> [TosIde / TosIde][Running/Boot Start] <\SystemRoot\System32\DRIVERS\toside.sys> [UlSata / UlSata][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\ulsata.sys> [ULSATAS / ULSATAS][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\ULSATAS.SYS> [ultra / ultra][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\ultra.sys> [ViaIde / ViaIde][Running/Boot Start] <\SystemRoot\System32\DRIVERS\viaide.sys> [viamraid / viamraid][Stopped/Boot Start] <\SystemRoot\system32\DRIVERS\viamraid.sys> [VIA ATA/ATAPI Host Controller / viapdsk][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\viapdsk.sys> [viaraid / viaraid][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\viaraid.sys> [viasraid / viasraid][Stopped/Boot Start] <\SystemRoot\system32\drivers\viasraid.sys> [vmscsi / vmscsi][Stopped/Boot Start] <\SystemRoot\system32\drivers\vmscsi.sys> [World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start] [Delux USB PC Camera (VC0305) / ZSMC0305][Running/Manual Start] ================================== 浏览器加载项 [WebThunder Browser Helper] {00000AAA-A363-466E-BEF5-9BB68697AA7F} [Google Toolbar Helper] {AA58ED58-01DD-4d91-8333-CF10577473F7} [Google Toolbar Notifier BHO] {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} [SafeMon Class] {B69F34DD-F0F9-42DC-9EDD-957187DA688D} [NTIECatcher Class] {C56CB6B0-0D96-11D6-8C65-B2868B609932} [微软] {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} [启动WEB迅雷] {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} [&Google] {2318C2B1-4965-11d4-9B18-009027A5CD4F} [Windows Genuine Advantage Validation Tool] {17492023-C23A-453E-A040-C7C580BBF700} [WebThunder Browser Helper] {00000AAA-A363-466E-BEF5-9BB68697AA7F} [Google Script Object] {00EF2092-6AC5-47C0-BD25-CF2D5D657FEB} [WebThunder Class] {03507A1A-E0C5-4404-AA26-205385C0892D} <, N/A> [Windows Media Player] {22D6F312-B0F6-11D0-94AB-0080C74C7E95} [&Google] {2318C2B1-4965-11D4-9B18-009027A5CD4F} [DHTML Edit Control Safe for Scripting for IE5] {2D360201-FFF5-11D1-8D03-00A0C959BC0A} [WebThunder DapPlayer] {2EEDA47E-8D5C-4d7e-B4B6-E16E19218555} [RealPlayer RAM Download Handler] {2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93} [XML Document] {48123BC4-99D9-11D1-A6B3-00C04FD91555} <%SystemRoot%\system32\msxml3.dll, N/A> [XMP Class] {6483F145-A768-4C41-AACC-52D4D7845851} [XDRM] {693571CB-54A3-4E90-9D52-EEAE1334E2D3} [Windows Media Player] {6BF52A52-394A-11D3-B153-00C04F79FAA6} [360SafeLive] {87515F61-A66C-4319-A0E0-D416CB8059E3} [RMGetLicense Class] {A9FC132B-096D-460B-B7D5-1DB0FAE0C062} [Google Toolbar Helper] {AA58ED58-01DD-4D91-8333-CF10577473F7} [Thunder DapCtrl] {ACACC6EB-1FBA-4E13-A729-53AEB2DF54F8} [Google Toolbar Notifier BHO] {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} [SearchAssistantOC] {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A> [SafeMon Class] {B69F34DD-F0F9-42DC-9EDD-957187DA688D} [RDS.DataSpace] {BD96C556-65A3-11D0-983A-00C04FC29E36} [NTIECatcher Class] {C56CB6B0-0D96-11D6-8C65-B2868B609932} [AUDIO__X_MS_WMA Moniker Class] {CD3AFA84-B84F-48F0-9393-7EDC34128127} [VIDEO__X_MS_WMV Moniker Class] {CD3AFA94-B84F-48F0-9393-7EDC34128127} [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} [XPPlayer Class] {F3E70CEA-956E-49CC-B444-73AFE593AD7F} [上传到QQ网络硬盘] [使用WEB迅雷下载] [使用WEB迅雷下载全部链接] [使用影音传送带下载] [使用影音传送带下载全部链接] [导出到 Microsoft Office Excel(&X)] [添加到QQ表情] ================================== 正在运行的进程 [PID: 564 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 620 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 644 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 688 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 700 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 852 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 916 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1052 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1128 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1188 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1436 / new][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234)] [D:\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001] [PID: 1556 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)] [PID: 1616 / new][C:\WINDOWS\SOUNDMAN.EXE] [Realtek Semiconductor Corp., 5, 1, 0, 48] [PID: 1640 / new][D:\360safe\antiarp\AntiArp.exe] [360安全中心, 2, 0, 0, 1008] [D:\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001] [PID: 1660 / new][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] [RealNetworks, Inc., 0.1.0.3427] [D:\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001] [PID: 1692 / new][C:\WINDOWS\VMSnap5.EXE] [Vimicro, 4, 2, 1124, 6] [D:\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001] [C:\WINDOWS\system32\msdmo.dll] [, ] [C:\WINDOWS\system32\VM305Prp.Ax] [Vimicro, 3.6.407. 13] [PID: 1724 / new][C:\WINDOWS\Domino.EXE] [Vimicro, 4, 2, 1124, 6] [D:\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001] [C:\WINDOWS\system32\msdmo.dll] [, ] [PID: 1744 / new][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [D:\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001] [PID: 1780 / new][C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe] [Google Inc., 2, 0, 301, 1654] [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\gtn.dll] [Google Inc., 2, 0, 301, 7164] [D:\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001] [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\res_zh-CN.dll] [Google Inc., 2, 0, 301, 7164] [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll] [Google Inc., 2, 0, 301, 7164] [PID: 1120 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1152 / LOCAL SERVICE][C:\WINDOWS\system32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)] [PID: 1204 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 2028 / new][C:\WINDOWS\system32\wuauclt.exe] [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)] [D:\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001] [PID: 2564 / new][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [D:\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001] [c:\program files\google\googletoolbar1.dll] [Google Inc., 4, 0, 1606, 6690] [d:\WebThunder\WebThunderBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 8, 75] [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll] [Google Inc., 2, 0, 301, 7164] [C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll] [Xi, 1.91.12] [C:\WINDOWS\system32\msxmlfilta.dll] [Microsoft Corporation, 1.0.0.1] [C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx] [Adobe Systems, Inc., 9,0,124,0] [C:\WINDOWS\system32\WINWB86.IME] [Microsoft Corporation, 4.00.950] [PID: 2420 / new][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [D:\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001] [c:\program files\google\googletoolbar1.dll] [Google Inc., 4, 0, 1606, 6690] [d:\WebThunder\WebThunderBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 8, 75] [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll] [Google Inc., 2, 0, 301, 7164] [C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll] [Xi, 1.91.12] [C:\WINDOWS\system32\msxmlfilta.dll] [Microsoft Corporation, 1.0.0.1] [C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx] [Adobe Systems, Inc., 9,0,124,0] [PID: 672 / new][D:\sreng2\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900] [D:\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001] [D:\sreng2\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15] [D:\sreng2\Plugins\NTFSTREAM.SRE] [Smallfrogs Studio, 1, 0, 0, 5] ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %*] .COM OK. ["%1" %*] .PIF OK. ["%1" %*] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %*] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf N/A ================================== HOSTS 文件 127.0.0.1 localhost ================================== 进程特权扫描 特殊特权被允许: SeLoadDriverPrivilege [PID = 1616, C:\WINDOWS\SOUNDMAN.EXE] 特殊特权被允许: SeLoadDriverPrivilege [PID = 1660, C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE] 特殊特权被允许: SeLoadDriverPrivilege [PID = 1692, C:\WINDOWS\VMSNAP5.EXE] 特殊特权被允许: SeLoadDriverPrivilege [PID = 1724, C:\WINDOWS\DOMINO.EXE] ================================== API HOOK N/A ================================== 隐藏进程 N/A ================================== [/CODE]