[CODE] 2008-07-29,11:12:13 System Repair Engineer 2.6.12.1018 Smallfrogs (http://www.KZTechs.com) Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能 以下内容被选中： 所有的启动项目（包括注册表、启动文件夹、服务等） 浏览器加载项 正在运行的进程（包括进程模块信息） 文件关联 Winsock 提供者 Autorun.inf HOSTS 文件 进程特权扫描 启动项目 注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <%systemroot%\system32\dumprep 0 -k> [File is missing] [(Verified)Microsoft Windows Hardware Compatibility Publisher] [(Verified)Microsoft Windows Hardware Compatibility Publisher] [Sony Corporation] [Sony Corporation] <3PMmUpdate> [] <360Safebox><"C:\Program Files\360Safebox\safeboxTray.exe" /r> [(Verified)Qizhi Software (beijing) Co. Ltd] <360Safetray> [(Verified)Qizhi Software (beijing) Co. Ltd] <"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"> [(Verified)Kaspersky Lab] [(Verified)Microsoft Corporation] <; C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe> [ATI Technologies, Inc.] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] [(Verified)Microsoft Windows Publisher] [(Verified)Microsoft Windows Publisher] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] <%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] <%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] <"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [File is missing] ================================== 启动文件夹 N/A ================================== 服务 [Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start] <> [卡巴斯基反病毒软件 7.0 / AVP][Running/Auto Start] <"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" -r> [Human Interface Device Access / HidServ][Stopped/Disabled] %SystemRoot%\System32\hidserv.dll> [SoundMAX Agent Service / SoundMAX Agent Service (default)][Running/Auto Start] ================================== 驱动程序 [aeaudio / aeaudio][Running/Manual Start] [Alps Pointing-device Filter Driver / ApfiltrService][Running/Manual Start] [ati2mtag / ati2mtag][Running/Manual Start] [Sony DMI Call service / DMICall][Running/System Start] [Intel(R) PRO Adapter Driver / E100B][Running/Manual Start] [eth8023 / eth8023][Stopped/Manual Start] <\SystemRoot\system32\drivers\eth8023.sys> [kl1 / kl1][Running/Boot Start] <\SystemRoot\system32\drivers\kl1.sys> [klif / klif][Running/System Start] <\??\C:\WINDOWS\system32\drivers\klif.sys> [Kaspersky Anti-Virus NDIS Filter / klim5][Running/Manual Start] [Direct Parallel Link Driver / Ptilink][Running/Manual Start] [SafeBoxKrnl / SafeBoxKrnl][Running/System Start] <\??\C:\Program Files\360Safebox\SafeBoxKrnl.sys><360安全中心> [Secdrv / Secdrv][Stopped/Manual Start] [smwdm / smwdm][Running/Manual Start] [Sony Notebook Control Device / SNC][Running/Manual Start] [Sony Programmable I/O Control Device / SPI][Running/Manual Start] [Intel(R) PRO/Wireless 2200 Adapter 驱动程序 / w22n51][Running/Manual Start] ================================== 浏览器加载项 [IeCatch2 Class] {A5366673-E8CA-11D3-9CD9-0090271D075B} [SafeMon Class] {B69F34DD-F0F9-42DC-9EDD-957187DA688D} [Web 反病毒统计] {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} [番茄花园] {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} [信息检索(&R)] {92780B25-18CC-41C8-B9BE-3C9C571A8263} [FlashGet] {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} [FlashGet Bar] {E0E899AB-F487-11D5-8D29-0050BA6940E3} [] {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <, > [] {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} <, > [360SafeLive] {87515F61-A66C-4319-A0E0-D416CB8059E3} [] {92780B25-18CC-41C8-B9BE-3C9C571A8263} <, > [IeCatch2 Class] {A5366673-E8CA-11D3-9CD9-0090271D075B} [SafeMon Class] {B69F34DD-F0F9-42DC-9EDD-957187DA688D} [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} [] {D6E814A0-E0C5-11D4-8D29-0050BA6940E3} <, > [RevealTrans] {E31E87C4-86EA-4940-9B8A-5BD5D179A737} [XML HTTP Request] {ED8C108E-4349-11D2-91A4-00C04F7969E8} <%SystemRoot%\system32\msxml3.dll, (Signed) N/A> [XML HTTP] {F6D90F16-9C73-11D3-B32E-00C04F990BB4} <%SystemRoot%\system32\msxml3.dll, (Signed) N/A> [使用网际快车下载] [使用网际快车下载全部链接] [导出到 Microsoft Office Excel(&X)] ================================== 正在运行的进程 [PID: 1252 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1312 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1340 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll] [Kaspersky Lab, 7.0.1.325] [C:\WINDOWS\system32\Ati2evxx.dll] [, ] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 1388 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\AppPatch\AcAdProc.dll] [Microsoft Corporation, 5.1.2600.3008 (xpsp.061004-0027)] [PID: 1400 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\dnsq.dll] [Kaspersky Lab, 7.0.1.325] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll] [Kaspersky Lab, 7.0.1.325] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\fssync.dll] [Kaspersky Lab, 7.0.5.325] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.42] [PID: 1536 / SYSTEM][C:\WINDOWS\system32\Ati2evxx.exe] [, ] [PID: 1580 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1724 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\dnsq.dll] [Kaspersky Lab, 7.0.1.325] [PID: 1920 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll] [Kaspersky Lab, 7.0.1.325] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16674 (vista_gdr.080415-1732)] [C:\WINDOWS\system32\wups2.dll] [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)] [PID: 2008 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll] [Kaspersky Lab, 7.0.1.325] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\fssync.dll] [Kaspersky Lab, 7.0.5.325] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.42] [PID: 340 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16674 (vista_gdr.080415-1732)] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll] [Kaspersky Lab, 7.0.1.325] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\fssync.dll] [Kaspersky Lab, 7.0.5.325] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.42] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\dnsq.dll] [Kaspersky Lab, 7.0.1.325] [PID: 720 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\dnsq.dll] [Kaspersky Lab, 7.0.1.325] [C:\WINDOWS\system32\mdimon.dll] [Microsoft Corporation, 11.3.1897.0] [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll] [Microsoft Corporation, 11.3.1897.0] [PID: 924 / SYSTEM][C:\WINDOWS\system32\Ati2evxx.exe] [, ] [PID: 1044 / Administrator][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16674 (vista_gdr.080415-1732)] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll] [Kaspersky Lab, 7.0.1.325] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\fssync.dll] [Kaspersky Lab, 7.0.5.325] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.42] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\scrchpg.dll] [Kaspersky Lab, 7.0.1.325] [C:\WINDOWS\system32\ieframe.dll] [Microsoft Corporation, 7.00.6000.16674 (vista_gdr.080415-1732)] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 2, 0, 1005] [C:\PROGRA~1\FlashGet\jccatch.dll] [Amaze Soft, 1, 1, 4, 0] [C:\WINDOWS\system32\PortableDeviceApi.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)] [D:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510] [PID: 1448 / Administrator][C:\Program Files\Apoint\Apoint.exe] [Alps Electric Co., Ltd., 5.5.7.136] [C:\WINDOWS\system32\VXDIF.DLL] [Alps Electric Co., Ltd., 6.0.2.65] [C:\Program Files\Apoint\ApWheel.dll] [ALPS ELECTRIC CO., LTD., 4.2.0.9] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll] [Kaspersky Lab, 7.0.1.325] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\fssync.dll] [Kaspersky Lab, 7.0.5.325] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.42] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16674 (vista_gdr.080415-1732)] [C:\Program Files\Apoint\Apoint.DLL] [Alps Electric Co., Ltd., 5.5.6.177] [C:\Program Files\Apoint\ApRes.dll] [Alps Electric Co., Ltd., 5.5.6.17] [C:\Program Files\Apoint\EzAuto.dll] [Alps Electric Co., Ltd., 4.5.1.83] [C:\Program Files\Apoint\EzLaunch.DLL] [Alps Electric Co., Ltd., 5.5.1.59] [PID: 1632 / Administrator][C:\Program Files\Sony\VAIO Power Management\SPMgr.exe] [Sony Corporation, 1.3.01.06110] [C:\Program Files\Sony\VAIO Power Management\MFC70U.DLL] [Microsoft Corporation, 7.00.9466.0] [C:\Program Files\Sony\VAIO Power Management\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0] [C:\Program Files\Sony\VAIO Power Management\SPMDAM.dll] [Sony Corporation, 1.0.00.08250] [C:\Program Files\Sony\VAIO Power Management\MSVCP70.dll] [Microsoft Corporation, 7.00.9466.0] [C:\Program Files\Sony\VAIO Power Management\SPMRes.dll] [Sony Corporation, 1.3.01.06160] [C:\Program Files\Sony\VAIO Power Management\SPMDrv.dll] [Sony Corporation, 1.3.01.06180] [C:\Program Files\Common Files\Sony Shared\Sony Utilities\SnyUtils.dll] [Sony Corporation, 5, 1, 0, 7030] [C:\Program Files\Common Files\Sony Shared\SXBIOS\sxbios.dll] [Sony Corporation, 4.02.8170] [C:\WINDOWS\system32\Atipdlxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2488] [PID: 1640 / Administrator][C:\Program Files\Sony\HotKey Utility\HKserv.exe] [Sony Corporation, 4, 2, 0, 7090] [C:\Program Files\Common Files\Sony Shared\Sony Utilities\SnyUtils.dll] [Sony Corporation, 5, 1, 0, 7030] [C:\Program Files\Common Files\Sony Shared\SXBIOS\sxbios.dll] [Sony Corporation, 4.02.8170] [C:\WINDOWS\system32\Atipdlxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2488] [C:\Program Files\Sony\HotKey Utility\SuEvent.dll] [Sony Corporation, 1, 1, 0, 7050] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll] [Kaspersky Lab, 7.0.1.325] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\fssync.dll] [Kaspersky Lab, 7.0.5.325] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.42] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16674 (vista_gdr.080415-1732)] [PID: 1648 / Administrator][C:\WINDOWS\system32\rundll32.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\Update.dll] [N/A, ] [PID: 1872 / Administrator][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 2040 / Administrator][C:\Program Files\Apoint\Apntex.exe] [Alps Electric Co., Ltd., 5.0.1.15] [C:\WINDOWS\system32\VXDIF.DLL] [Alps Electric Co., Ltd., 6.0.2.65] [PID: 308 / Administrator][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 416 / SYSTEM][C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe] [Analog Devices, Inc., 3, 2, 6, 0] [PID: 480 / Administrator][C:\Program Files\Sony\HotKey Utility\HKWnd.exe] [Sony Corporation, 4, 2, 0, 7090] [C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 2, 0, 1005] [C:\Program Files\Sony\HotKey Utility\HKRes.dll] [Sony Corporation, 4, 2, 0, 7230] [C:\Program Files\Common Files\Sony Shared\Sony Utilities\SnyUtils.dll] [Sony Corporation, 5, 1, 0, 7030] [C:\Program Files\Common Files\Sony Shared\SXBIOS\sxbios.dll] [Sony Corporation, 4.02.8170] [C:\WINDOWS\system32\Atipdlxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2488] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 2076 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 3268 / Administrator][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 7.00.6000.16674 (vista_gdr.080415-1732)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16674 (vista_gdr.080415-1732)] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll] [Kaspersky Lab, 7.0.1.325] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\fssync.dll] [Kaspersky Lab, 7.0.5.325] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.42] [C:\WINDOWS\system32\IEFRAME.dll] [Microsoft Corporation, 7.00.6000.16674 (vista_gdr.080415-1732)] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\scrchpg.dll] [Kaspersky Lab, 7.0.1.325] [C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 2, 0, 1005] [C:\WINDOWS\system32\IEUI.dll] [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)] [C:\WINDOWS\system32\xmllite.dll] [Microsoft Corporation, 1.00.1018.0] [D:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510] [C:\Program Files\Internet Explorer\ieproxy.dll] [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\PROGRA~1\FlashGet\jccatch.dll] [Amaze Soft, 1, 1, 4, 0] [C:\WINDOWS\system32\ieapfltr.dll] [Microsoft Corporation, 7.0.6000.16461] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\dnsq.dll] [Kaspersky Lab, 7.0.1.325] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\klscav.dll] [Kaspersky Lab, 7.0.1.325] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\prremote.dll] [Kaspersky Lab, 7.0.1.325] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\MSVCP80.dll] [Microsoft Corporation, 8.00.50727.42] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\prloader.dll] [Kaspersky Lab, 7.0.1.325] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\prkernel.ppl] [Kaspersky Lab, 7.0.1.325] [c:\program files\kaspersky lab\kaspersky anti-virus 7.0\params.ppl] [Kaspersky Lab, 7.0.1.325] [c:\program files\kaspersky lab\kaspersky anti-virus 7.0\pxstub.ppl] [Kaspersky Lab, 7.0.1.325] [c:\program files\kaspersky lab\kaspersky anti-virus 7.0\tempfile.ppl] [Kaspersky Lab, 7.0.1.325] [c:\program files\kaspersky lab\kaspersky anti-virus 7.0\nfio.ppl] [Kaspersky Lab, 7.0.1.325] [c:\program files\kaspersky lab\kaspersky anti-virus 7.0\fsdrvplg.ppl] [Kaspersky Lab, 7.0.1.325] [c:\program files\kaspersky lab\kaspersky anti-virus 7.0\basegui.ppl] [Kaspersky Lab, 7.0.1.325] [c:\program files\kaspersky lab\kaspersky anti-virus 7.0\thpimpl.ppl] [Kaspersky Lab, 7.0.1.325] [c:\program files\kaspersky lab\kaspersky anti-virus 7.0\winreg.ppl] [Kaspersky Lab, 7.0.1.325] [PID: 3320 / Administrator][C:\WINDOWS\system32\wuauclt.exe] [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)] [C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 2, 0, 1005] [C:\WINDOWS\system32\wups2.dll] [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)] [PID: 3568 / Administrator][D:\软件工具\sreng2\SREngLdr.EXE] [Smallfrogs Studio, 2.6.12.1018] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll] [Kaspersky Lab, 7.0.1.325] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\fssync.dll] [Kaspersky Lab, 7.0.5.325] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.42] [PID: 2984 / Administrator][D:\软件工具\sreng2\SRE11412ea7.EXE] [Smallfrogs Studio, 2.6.12.1018] [C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)] [C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16674 (vista_gdr.080415-1732)] [C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 2, 0, 1005] [D:\软件工具\sreng2\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll] [Kaspersky Lab, 7.0.1.325] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\fssync.dll] [Kaspersky Lab, 7.0.5.325] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.42] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\dnsq.dll] [Kaspersky Lab, 7.0.1.325] [D:\PROGRA~1\MICROS~1\OFFICE11\MCPS.DLL] [Microsoft Corporation, 11.0.5510] ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %*] .COM OK. ["%1" %*] .PIF OK. ["%1" %*] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %*] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf N/A ================================== HOSTS 文件 N/A ================================== 进程特权扫描 特殊特权被允许： SeLoadDriverPrivilege [PID = 1632, C:\PROGRAM FILES\SONY\VAIO POWER MANAGEMENT\SPMGR.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 1640, C:\PROGRAM FILES\SONY\HOTKEY UTILITY\HKSERV.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 480, C:\PROGRAM FILES\SONY\HOTKEY UTILITY\HKWND.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 3568, D:\软件工具\SRENG2\SRENGLDR.EXE] ================================== API HOOK RVA 错误： LoadLibraryA (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys) RVA 错误： LoadLibraryExA (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys) RVA 错误： LoadLibraryExW (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys) RVA 错误： LoadLibraryW (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys) RVA 错误： GetProcAddress (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys) ================================== 隐藏进程 N/A ================================== [/CODE]