[CODE] 2008-07-25,16:26:01 System Repair Engineer 2.6.11.992 Smallfrogs (http://www.KZTechs.com) Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能 以下内容被选中: 所有的启动项目(包括注册表、启动文件夹、服务等) 浏览器加载项 正在运行的进程(包括进程模块信息) 文件关联 Winsock 提供者 Autorun.inf HOSTS 文件 进程特权扫描 启动项目 注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"> [(Verified)Kaspersky Lab] <360Safetray> [(Verified)Qizhi Software (beijing) Co. Ltd] <360Antiarp> [(Verified)Qizhi Software (beijing) Co. Ltd] [广州众达天网技术有限公司] [(Verified)Microsoft Windows XP Publisher] <360Safebox><"C:\Program Files\360Safebox\safeboxTray.exe" /r> [(Verified)Qizhi Software (beijing) Co. Ltd] <; KHALMNPR.EXE> [(Verified)Microsoft Windows Hardware Compatibility Publisher] <"C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized> [(Verified)GRISOFT LTD] <; C:\Program Files\ProxyThorn\ProxyThorn.exe> [Huazhong University of Science and Technology] <; "D:\Program Files\Alisoft\WangWang\WangWang.EXE"> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] [(Verified)Microsoft Windows Component Publisher] [(Verified)Microsoft Windows Publisher] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{57B86673-276A-48B2-BAE7-C6DBB3020EB8}> [(Verified)GRISOFT LTD] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] [(Verified)Microsoft Windows Hardware Compatibility Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon] [(Verified)Kaspersky Lab] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] <%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] <%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] <"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [File is missing] ================================== 启动文件夹 [Logitech SetPoint] C:\PROGRA~1\Logitech\SetPoint\SetPoint.exe [Logitech Inc.]> ================================== 服务 [AddFiltr / AddFiltr][Stopped/Manual Start] <"C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe"> [AVG Anti-Spyware Guard / AVG Anti-Spyware Guard][Running/Auto Start] [卡巴斯基反病毒软件 7.0 / AVP][Running/Auto Start] <"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" -r> [Contrl Center of Storm Media / ccosm][Stopped/Disabled] <北京暴风网际科技有限公司> [hpqwmiex / hpqwmiex][Running/Auto Start] [HuntmineSvr / HuntmineSvr][Stopped/Disabled] <北京搜神网络有限责任公司> [LightScribeService Direct Disc Labeling Service / LightScribeService][Running/Auto Start] <"C:\Program Files\Common Files\LightScribe\LSSrvc.exe"> ================================== 驱动程序 [360AntiArp / 360AntiArp][Running/System Start] <\??\C:\WINDOWS\system32\drivers\360AntiArp.sys><360安全中心> [AVG Anti-Spyware Driver / AVG Anti-Spyware Driver][Running/System Start] <\??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys> [AVG Anti-Spyware Clean Driver / AvgAsCln][Running/System Start] [DS1410D / DS1410D][Stopped/Auto Start] [Intel(R) PRO Network Connection Driver / E100B][Running/Manual Start] [eabfiltr / eabfiltr][Running/System Start] [Hardlock / Hardlock][Running/Auto Start] <\??\C:\WINDOWS\system32\drivers\hardlock.sys> [HBtnKey / HBtnKey][Running/Manual Start] [Microsoft UAA Function Driver for High Definition Audio Service / HdAudAddService][Running/Manual Start] [Microsoft 用于 High Definition Audio 的 UAA 总线驱动程序 / HDAudBus][Running/Manual Start] [HSFHWAZL / HSFHWAZL][Running/Manual Start] [HSF_DPV / HSF_DPV][Running/Manual Start] [ialm / ialm][Running/Manual Start] [Intel AHCI Controller / iastor][Running/Boot Start] <\SystemRoot\system32\DRIVERS\iaStor.sys> [iocard / iocard][Running/Auto Start] <\??\C:\WINDOWS\system32\DRIVERS\iocard.sys> [kl1 / kl1][Running/Boot Start] <\SystemRoot\system32\drivers\kl1.sys> [klif / klif][Running/System Start] <\??\C:\WINDOWS\system32\drivers\klif.sys> [Kaspersky Anti-Virus NDIS Filter / klim5][Running/Manual Start] [Logitech SetPoint HID Mouse Filter Driver / LHidKe][Running/Manual Start] [Logitech SetPoint USB Receiver device driver / LHidUsbK][Running/Manual Start] [Logitech SetPoint Mouse Filter Driver / LMouKE][Running/Manual Start] [mdmxsdk / mdmxsdk][Running/Auto Start] [用于 Windows XP 32 Bit 版的英特尔(R) PRO/无线 3945ABG 适配器驱动程序 / NETw3x32][Running/Manual Start] [npkcrypt / npkcrypt][Stopped/Manual Start] <\??\C:\WINDOWS\system32\npkcrypt.sys> [npkycryp / npkycryp][Stopped/Manual Start] <\??\C:\WINDOWS\system32\npkycryp.sys> [DDK PACKET Protocol / Packet][Running/Manual Start] <360安全中心> [Direct Parallel Link Driver / Ptilink][Running/Manual Start] [rimmptsk / rimmptsk][Running/Manual Start] [rimsptsk / rimsptsk][Running/Manual Start] [Ricoh xD-Picture Card Driver / rismxdp][Running/Manual Start] [SafeBoxKrnl / SafeBoxKrnl][Running/System Start] <\??\C:\Program Files\360Safebox\SafeBoxKrnl.sys><360安全中心> [Secdrv / Secdrv][Stopped/Manual Start] [SKNFW / SKNFW][Running/System Start] <\??\C:\WINDOWS\system32\Drivers\SKNFW.sys> [SkyProcs / SkyProcs][Running/Manual Start] <\??\D:\PROGRA~1\SKYNET\FIREWALL\SkyProcs.sys> [Sony USB Filter Driver (SONYPVU1) / SONYPVU1][Stopped/Manual Start] [sptd / sptd][Running/Boot Start] <\SystemRoot\System32\Drivers\sptd.sys> [Synaptics TouchPad Driver / SynTP][Running/Manual Start] [winachsf / winachsf][Running/Manual Start] ================================== 浏览器加载项 [Thunder Browser Helper] {889D2FEB-5411-4565-8998-1DD2C5261283} [SafeMon Class] {B69F34DD-F0F9-42DC-9EDD-957187DA688D} [启动迅雷5] {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} [浩方对战平台] {0A155D3C-68E2-4215-A47A-E800A446447A} [Web 反病毒统计] {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} [Messenger] {FB5F1910-F110-11d2-BB9E-00C04F795683} [Adobe PDF] {47833539-D0C5-4125-9FA8-0819E2EAAC93} [ThunderAtOnce Class] {01443AEC-0FD1-40FD-9C87-E93D1494C233} [AcroIEHlprObj Class] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [Fade] {16B280C5-EE70-11D1-9066-00C04FD9189D} [Windows Media Player] {22D6F312-B0F6-11D0-94AB-0080C74C7E95} [XML DOM Document] {2933BF90-7B36-11D2-B20E-00C04F983E60} [DHTML Edit Control Safe for Scripting for IE5] {2D360201-FFF5-11D1-8D03-00A0C959BC0A} [HtmlDlgSafeHelper Class] {3050F819-98B5-11CF-BB82-00AA00BDCE0B} [Adobe PDF] {47833539-D0C5-4125-9FA8-0819E2EAAC93} [XML Document] {48123BC4-99D9-11D1-A6B3-00C04FD91555} [Thunder Agent Class] {485463B7-8FB2-4B3B-B29B-8B919B0EACCE} [EditCtrl Class] {488A4255-3236-44B3-8F27-FA1AECAA8844} [Shell Name Space] {55136805-B2DE-11D1-B9F2-00A0C98BC547} [XMP Class] {6483F145-A768-4C41-AACC-52D4D7845851} [XDRM] {693571CB-54A3-4E90-9D52-EEAE1334E2D3} [Windows Media Player] {6BF52A52-394A-11D3-B153-00C04F79FAA6} [WangWangObj Class] {6E213FC7-DD5A-4115-B7E6-D4C7838C361E} [MediaComm Class] {7670648D-461B-42AF-BDFE-46D26AF5EFF2} [360SafeLive] {87515F61-A66C-4319-A0E0-D416CB8059E3} [Microsoft Web Browser] {8856F961-340A-11D0-A96B-00C04FD705A2} [Thunder Browser Helper] {889D2FEB-5411-4565-8998-1DD2C5261283} [XML DOM 文档 5.0] {88D969E5-F192-11D4-A65F-0040963251E5} [XML HTTP 5.0] {88D969EA-F192-11D4-A65F-0040963251E5} [SopCore Control] {8FEFF364-6A5F-4966-A917-A3AC28411659} [RMGetLicense Class] {A9FC132B-096D-460B-B7D5-1DB0FAE0C062} [DapCtrl Class] {ACACC6EB-1FBA-4E13-A729-53AEB2DF54F8} [AcroIEToolbarHelper Class] {AE7CD045-E861-484F-8273-0445EE161910} [Wipe] {AF279B30-86EB-11D1-81BF-0000F87557DB} [SearchAssistantOC] {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A> [Messenger Object] {B69003B3-C55E-4B48-836C-BC5946FC3B28} [SafeMon Class] {B69F34DD-F0F9-42DC-9EDD-957187DA688D} [RDS.DataSpace] {BD96C556-65A3-11D0-983A-00C04FC29E36} [Adobe Acrobat Control for ActiveX] {CA8A9780-280D-11CF-A24D-444553540000} [AUDIO__MP3 Moniker Class] {CD3AFA76-B84F-48F0-9393-7EDC34128127} [AUDIO__X_MS_WMA Moniker Class] {CD3AFA84-B84F-48F0-9393-7EDC34128127} [VIDEO__MPEG Moniker Class] {CD3AFA89-B84F-48F0-9393-7EDC34128127} [VIDEO__X_MS_WMV Moniker Class] {CD3AFA94-B84F-48F0-9393-7EDC34128127} [RealPlayer G2 Control] {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} [RevealTrans] {E31E87C4-86EA-4940-9B8A-5BD5D179A737} [TimwpDll.TimwpCheck] {ED4CA2E5-0EEA-44C1-AD7E-74A07A7507A4} [XML HTTP Request] {ED8C108E-4349-11D2-91A4-00C04F7969E8} [Thunder DapPlayer] {EEDD6FF9-13DE-496B-9A1C-D78B3215E266} [XPPlayer Class] {F3E70CEA-956E-49CC-B444-73AFE593AD7F} [XML DOM Document 3.0] {F5078F32-C551-11D3-89B9-0000F81FE221} [Free Threaded XML DOM Document 3.0] {F5078F33-C551-11D3-89B9-0000F81FE221} [XML HTTP 3.0] {F5078F35-C551-11D3-89B9-0000F81FE221} [XSL Template 3.0] {F5078F36-C551-11D3-89B9-0000F81FE221} [XML DOM Document] {F6D90F11-9C73-11D3-B32E-00C04F990BB4} [XML HTTP] {F6D90F16-9C73-11D3-B32E-00C04F990BB4} [Messenger Application] {FB7199AB-79BF-11D2-8D94-0000F875C541} [使用迅雷下载] [使用迅雷下载全部链接] [导出到 Microsoft Office Excel(&X)] [添加到QQ表情] ================================== 正在运行的进程 [PID: 1160 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1260 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1288 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\WINDOWS\system32\klogon.dll] [Kaspersky Lab, 7.0.0.125] [C:\WINDOWS\system32\igfxdev.dll] [Intel Corporation, 3.0.0.4670] [PID: 1332 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1344 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\dnsq.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [PID: 1508 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1596 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\dnsq.dll] [Kaspersky Lab, 7.0.0.125] [PID: 1640 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\dnsq.dll] [Kaspersky Lab, 7.0.0.125] [PID: 1688 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [PID: 1816 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 368 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\dnsq.dll] [Kaspersky Lab, 7.0.0.125] [C:\WINDOWS\system32\AdobePDF.dll] [Adobe Systems Incorporated., 6.0.000] [C:\Program Files\Adobe\Acrobat 6.0\Distillr\AdistRes.CHS] [, ] [PID: 652 / liujie][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234)] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\scrchpg.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Logitech\SetPoint\lgscroll.dll] [Logitech Inc., 2.30.400] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\Logitech\SetPoint\GameHook.dll] [N/A, ] [C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1002] [C:\WINDOWS\system32\igfxpph.dll] [Intel Corporation, 3.0.0.4670] [C:\WINDOWS\system32\hccutils.DLL] [Intel Corporation, 3.0.0.4670] [C:\WINDOWS\system32\igfxres.dll] [Intel Corporation, 3.0.0.4670] [C:\WINDOWS\system32\igfxress.dll] [Intel Corporation, 3.0.0.4670] [C:\WINDOWS\system32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4670] [D:\迅雷5\新建文件夹\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 8, 96] [D:\迅雷5\新建文件夹\Components\ResWorker\DsBho_01.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 20] [D:\迅雷5\新建文件夹\Components\ResWorker\DataProcessor_01.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 16] [C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll] [GRISOFT s.r.o., 7, 5, 1, 36] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\dnsq.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\WinRAR\rarext.dll] [N/A, ] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\ShellEx.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.42] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\MSVCP80.dll] [Microsoft Corporation, 8.00.50727.42] [C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll] [GRISOFT s.r.o., 7, 5, 1, 36] [D:\PROGRA~1\Wopti\WOPTIE~1.DLL] [共软网络, 1.0.8.103] [C:\Program Files\Adobe\Acrobat 6.0\Acrobat Elements\ContextMenu.dll] [Adobe Systems Inc., 6.0.0.2003110300\0] [C:\Program Files\Adobe\Acrobat 6.0\Acrobat Elements\ContextMenu.chs] [Adobe Systems Inc., 6.0.0.2003110300\0] [C:\WINDOWS\system32\SOGOUPY.IME] [Sogou.com Inc., 3.5.0.0] [D:\sogo\新建文件夹\SogouInput\Plugin\SgImeWord.dll] [Sogou.com Inc., 3.5.0.0] [PID: 904 / liujie][C:\Program Files\360safe\antiarp\antiarp.exe] [360安全中心, 2, 0, 0, 1008] [C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1002] [C:\Program Files\Logitech\SetPoint\GameHook.dll] [N/A, ] [C:\Program Files\Logitech\SetPoint\lgscroll.dll] [Logitech Inc., 2.30.400] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\dnsq.dll] [Kaspersky Lab, 7.0.0.125] [PID: 992 / liujie][C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe] [GRISOFT s.r.o., 7, 5, 1, 43] [C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\engine.dll] [GRISOFT s.r.o., 4, 2, 0, 19] [C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1002] [C:\Program Files\Logitech\SetPoint\GameHook.dll] [N/A, ] [C:\Program Files\Logitech\SetPoint\lgscroll.dll] [Logitech Inc., 2.30.400] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\scrchpg.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\dnsq.dll] [Kaspersky Lab, 7.0.0.125] [PID: 1016 / liujie][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1002] [C:\Program Files\Logitech\SetPoint\lgscroll.dll] [Logitech Inc., 2.30.400] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\Logitech\SetPoint\GameHook.dll] [N/A, ] [PID: 1032 / liujie][C:\Program Files\Logitech\SetPoint\SetPoint.exe] [Logitech Inc., 2.30.400] [C:\Program Files\Logitech\SetPoint\KemUtil.dll] [Logitech Inc., 2.30.400] [C:\WINDOWS\system32\MFC71U.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\Logitech\SetPoint\SetPointCOM.dll] [Logitech Inc., 2.30.400] [C:\Program Files\Logitech\SetPoint\kemutb.dll] [Logitech Inc., 2.30.400] [C:\Program Files\Logitech\SetPoint\KGame.dll] [TODO: , 1.0.0.1] [C:\Program Files\Logitech\SetPoint\KemWnd.dll] [Logitech Inc., 2.30.400] [C:\Program Files\Logitech\SetPoint\GameHook.dll] [N/A, ] [C:\Program Files\Logitech\SetPoint\KemXML.dll] [Logitech Inc., 2.30.400] [C:\Program Files\Logitech\SetPoint\lgscroll.dll] [Logitech Inc., 2.30.400] [C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1002] [C:\Program Files\Logitech\SetPoint\Macros\MacroCore.dll] [Logitech Inc., 2.30.400] [C:\WINDOWS\system32\ATL71.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Common Files\Logitech\KHAL\KhalApi.dll] [Logitech Inc., 2.30.400] [C:\Program Files\Logitech\SetPoint\LCabHandler.dll] [Logitech Inc., 2.30.400] [PID: 1060 / liujie][C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE] [Logitech Inc., 2.30.314] [C:\Program Files\Common Files\Logitech\KHAL\KHALAPI.DLL] [Logitech Inc., 2.30.400] [C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1002] [C:\Program Files\Logitech\SetPoint\GameHook.dll] [N/A, ] [C:\Program Files\Logitech\SetPoint\lgscroll.dll] [Logitech Inc., 2.30.400] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Common Files\Logitech\KHAL\KHALITCH.DLL] [Logitech Inc., 2.30.400] [C:\Program Files\Common Files\Logitech\KHAL\KHALMW.DLL] [Logitech Inc., 2.30.400] [C:\Program Files\Common Files\Logitech\KHAL\KHALHPP.DLL] [Logitech Inc., 2.30.400] [PID: 1912 / SYSTEM][C:\Program Files\Common Files\LightScribe\LSSrvc.exe] [Hewlett-Packard Company, 1.4.97.1] [C:\Program Files\Common Files\LightScribe\LSSProxy.dll] [Hewlett-Packard Company, 1.4.97.1] [C:\Program Files\Common Files\LightScribe\LSLog.dll] [Hewlett-Packard Company, 1.4.97.1] [C:\Program Files\Common Files\LightScribe\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.42] [C:\Program Files\Common Files\LightScribe\MSVCP80.dll] [Microsoft Corporation, 8.00.50727.42] [PID: 1872 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 304 / SYSTEM][C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe] [Hewlett-Packard Development Company, L.P., 2, 0, 1, 9] [PID: 2312 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1324 / liujie][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 7.00.6000.16674 (vista_gdr.080415-1732)] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\scrchpg.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1002] [C:\Program Files\Logitech\SetPoint\GameHook.dll] [N/A, ] [C:\Program Files\Logitech\SetPoint\lgscroll.dll] [Logitech Inc., 2.30.400] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [D:\迅雷5\新建文件夹\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 8, 96] [D:\迅雷5\新建文件夹\Components\ResWorker\DsBho_01.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 20] [D:\迅雷5\新建文件夹\Components\ResWorker\DataProcessor_01.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 16] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\dnsq.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\klscav.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.42] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\prremote.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\MSVCP80.dll] [Microsoft Corporation, 8.00.50727.42] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\prloader.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\prkernel.ppl] [Kaspersky Lab, 7.0.0.125] [c:\program files\kaspersky lab\kaspersky anti-virus 7.0\params.ppl] [Kaspersky Lab, 7.0.0.125] [c:\program files\kaspersky lab\kaspersky anti-virus 7.0\pxstub.ppl] [Kaspersky Lab, 7.0.0.125] [c:\program files\kaspersky lab\kaspersky anti-virus 7.0\tempfile.ppl] [Kaspersky Lab, 7.0.0.125] [c:\program files\kaspersky lab\kaspersky anti-virus 7.0\nfio.ppl] [Kaspersky Lab, 7.0.0.125] [c:\program files\kaspersky lab\kaspersky anti-virus 7.0\fsdrvplg.ppl] [Kaspersky Lab, 7.0.0.125] [c:\program files\kaspersky lab\kaspersky anti-virus 7.0\basegui.ppl] [Kaspersky Lab, 7.0.0.125] [c:\program files\kaspersky lab\kaspersky anti-virus 7.0\thpimpl.ppl] [Kaspersky Lab, 7.0.0.125] [c:\program files\kaspersky lab\kaspersky anti-virus 7.0\FSSync.dll] [Kaspersky Lab, 7.0.5.125] [c:\program files\kaspersky lab\kaspersky anti-virus 7.0\winreg.ppl] [Kaspersky Lab, 7.0.0.125] [C:\WINDOWS\system32\SOGOUPY.IME] [Sogou.com Inc., 3.5.0.0] [D:\sogo\新建文件夹\SogouInput\Plugin\SgImeWord.dll] [Sogou.com Inc., 3.5.0.0] [PID: 4016 / liujie][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 7.00.6000.16674 (vista_gdr.080415-1732)] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\scrchpg.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1002] [C:\Program Files\Logitech\SetPoint\GameHook.dll] [N/A, ] [C:\Program Files\Logitech\SetPoint\lgscroll.dll] [Logitech Inc., 2.30.400] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [D:\迅雷5\新建文件夹\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 8, 96] [D:\迅雷5\新建文件夹\Components\ResWorker\DsBho_01.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 20] [D:\迅雷5\新建文件夹\Components\ResWorker\DataProcessor_01.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 16] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\dnsq.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\klscav.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.42] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\prremote.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\MSVCP80.dll] [Microsoft Corporation, 8.00.50727.42] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\prloader.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\prkernel.ppl] [Kaspersky Lab, 7.0.0.125] [c:\program files\kaspersky lab\kaspersky anti-virus 7.0\params.ppl] [Kaspersky Lab, 7.0.0.125] [c:\program files\kaspersky lab\kaspersky anti-virus 7.0\pxstub.ppl] [Kaspersky Lab, 7.0.0.125] [c:\program files\kaspersky lab\kaspersky anti-virus 7.0\tempfile.ppl] [Kaspersky Lab, 7.0.0.125] [C:\WINDOWS\system32\SOGOUPY.IME] [Sogou.com Inc., 3.5.0.0] [D:\sogo\新建文件夹\SogouInput\Plugin\SgImeWord.dll] [Sogou.com Inc., 3.5.0.0] [c:\program files\kaspersky lab\kaspersky anti-virus 7.0\nfio.ppl] [Kaspersky Lab, 7.0.0.125] [c:\program files\kaspersky lab\kaspersky anti-virus 7.0\fsdrvplg.ppl] [Kaspersky Lab, 7.0.0.125] [c:\program files\kaspersky lab\kaspersky anti-virus 7.0\basegui.ppl] [Kaspersky Lab, 7.0.0.125] [c:\program files\kaspersky lab\kaspersky anti-virus 7.0\thpimpl.ppl] [Kaspersky Lab, 7.0.0.125] [c:\program files\kaspersky lab\kaspersky anti-virus 7.0\FSSync.dll] [Kaspersky Lab, 7.0.5.125] [c:\program files\kaspersky lab\kaspersky anti-virus 7.0\winreg.ppl] [Kaspersky Lab, 7.0.0.125] [C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx] [Adobe Systems, Inc., 9,0,124,0] [PID: 620 / liujie][C:\dfzq\zdsj.exe] [上海核新软件技术有限公司, 2007, 3, 16, 0] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1002] [C:\Program Files\Logitech\SetPoint\GameHook.dll] [N/A, ] [C:\Program Files\Logitech\SetPoint\lgscroll.dll] [Logitech Inc., 2.30.400] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [PID: 1312 / liujie][C:\Documents and Settings\liujie\桌面\新建文件夹 (2)\SREngLdr.bat.EXE] [N/A, ] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [PID: 1620 / liujie][C:\Documents and Settings\liujie\桌面\新建文件夹 (2)\SREd358b9.EXE] [Smallfrogs Studio, 2.6.11.992] [C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1002] [C:\Program Files\Logitech\SetPoint\GameHook.dll] [N/A, ] [C:\Program Files\Logitech\SetPoint\lgscroll.dll] [Logitech Inc., 2.30.400] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\Documents and Settings\liujie\桌面\新建文件夹 (2)\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll] [Kaspersky Lab, 7.0.0.125] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\dnsq.dll] [Kaspersky Lab, 7.0.0.125] [C:\Documents and Settings\liujie\桌面\新建文件夹 (2)\Plugins\NTFSTREAM.SRE] [Smallfrogs Studio, 1, 0, 0, 5] ================================== 文件关联 .TXT Error. [NOTEPAD.EXE %1] .EXE OK. ["%1" %*] .COM OK. ["%1" %*] .PIF OK. ["%1" %*] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %*] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf N/A ================================== HOSTS 文件 127.0.0.1 localhost ================================== 进程特权扫描 特殊特权被允许: SeLoadDriverPrivilege [PID = 1032, C:\PROGRAM FILES\LOGITECH\SETPOINT\SETPOINT.EXE] 特殊特权被允许: SeLoadDriverPrivilege [PID = 620, C:\DFZQ\ZDSJ.EXE] 特殊特权被允许: SeLoadDriverPrivilege [PID = 1312, C:\DOCUMENTS AND SETTINGS\LIUJIE\桌面\新建文件夹 (2)\SRENGLDR.BAT.EXE] ================================== API HOOK RVA 错误: LoadLibraryA (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys) RVA 错误: LoadLibraryExA (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys) RVA 错误: LoadLibraryExW (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys) RVA 错误: LoadLibraryW (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys) RVA 错误: GetProcAddress (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys) ================================== 隐藏进程 N/A ================================== [/CODE]