[CODE] 2008-10-19,12:31:24 System Repair Engineer 2.6.12.1018 Smallfrogs (http://www.KZTechs.com) Windows 2000 Professional Service Pack 4 (Build 2195) - 管理权限用户 - 完整功能以下内容被选中：所有的启动项目（包括注册表、启动文件夹、服务等）浏览器加载项正在运行的进程（包括进程模块信息）文件关联 Winsock 提供者 Autorun.inf HOSTS 文件进程特权扫描启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] [(Verified)Microsoft Windows 2000 Publisher] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <> [N/A] <> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] [(Verified)Microsoft Windows 2000 Publisher] [(Verified)Microsoft Windows Hardware Compatibility Publisher] [] [File is missing] [Hewlett-Packard] <"D:\Program Files\Rising\Rav\RavTask.exe" -system> [File is missing] [(Verified)Microsoft Windows Hardware Compatibility Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] [(Verified)Microsoft Windows 2000 Publisher] [(Verified)Microsoft Windows 2000 Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{32CD708B-60A7-4C00-9377-D73EAA495F0F}> [(Verified)Beijing Rising Science and Technology Corporation Limited] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}] <"C:\WINNT\system32\shmgrate.exe" OCInstallUserConfigIE> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] <"C:\WINNT\system32\shmgrate.exe" OCInstallUserConfigOE> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] <"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] [(Verified)Microsoft Windows 2000 Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]

<"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] <%SystemRoot%\system32\updcrl.exe -e -u %SystemRoot%\system32\verisignpub1.crl> [File is missing] ================================== 启动文件夹 [ADSL超频奇兵 V5.1] D:\Program Files\Worldfax\ADSL超频奇兵 V5.1\ADSLx2.exe [File is missing]> ================================== 服务 [C-DillaCdaC11BA / C-DillaCdaC11BA][Running/Auto Start] [Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start] [Kingsoft Personal Firewall Service / KPfwSvc][Stopped/Auto Start] <"e:\KAV2007\KPfwSvc.EXE"><(File is missing)> [Kingsoft Antivirus KWatch Service / KWatchSvc][Stopped/Auto Start] <><(File is missing)> [NVIDIA Display Driver Service / NVSvc][Running/Auto Start] [Rising Process Communication Center / RsCCenter][Stopped/Auto Start] <"D:\Program Files\Rising\Rav\CCenter.exe"><(File is missing)> [Rising RealTime Monitor / RsRavMon][Stopped/Auto Start] <"D:\PROGRAM FILES\RISING\RAV\Ravmond.exe"><(File is missing)> [System Recover Servic / SysreSrv][Stopped/Auto Start] <(File is missing)> [Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start] C:\WINNT\System32\mspmsnsv.dll> ================================== 驱动程序 [1313031 / 1313031][Stopped/Boot Start] <\SystemRoot\System32\drivers\1313031.sys> [17408937 / 17408937][Stopped/Boot Start] <\SystemRoot\System32\drivers\17408937.sys> [a0 / a0][Stopped/Boot Start] <\SystemRoot\\SystemRoot\System32\drivers\1151296.sys> [ADProt / ADProt][Stopped/Boot Start] <\SystemRoot\system32\drivers\ADProt.sys><腾讯科技（深圳）有限公司> [ajplyvef / ajplyvef][Stopped/Boot Start] <\SystemRoot\System32\drivers\ajplyvef.sys> [Rising TDI Base Driver / BaseTDI][Running/Auto Start] [bootdrv / bootdrv][Running/Boot Start] <\SystemRoot\System32\Drivers\bootdrv.sys> [CdaC15BA / CdaC15BA][Running/Auto Start] <\??\C:\WINNT\System32\drivers\CDAC15BA.SYS> [CDRAL Place Holder Driver / Cdrw2kDrv][Stopped/Auto Start] [dmboot / dmboot][Stopped/Disabled] [Logical Disk Manager Driver / dmio][Running/Boot Start] <\SystemRoot\System32\drivers\dmio.sys> [dmload / dmload][Running/Boot Start] <\SystemRoot\System32\drivers\dmload.sys> [WAN Miniport Driver For PPPoE Protocol / GNetPPPoE][Running/Manual Start] [HookCont / HookCont][Running/System Start] <\SystemRoot\system32\drivers\HookCont.sys> [HookNtos / HookNtos][Running/System Start] <\SystemRoot\system32\drivers\HookNtos.sys> [HookReg / HookReg][Running/System Start] <\SystemRoot\system32\drivers\HookReg.sys> [HookSys / HookSys][Running/System Start] <\SystemRoot\system32\drivers\HookSys.sys> [KNetWch / KNetWch][Stopped/System Start] <\??\e:\KAV2007\KNetWch.SYS> [KWatch3 / KWatch3][Running/System Start] <\??\C:\WINNT\System32\drivers\KWatch3.SYS> [npkcrypt / npkcrypt][Stopped/Auto Start] <\??\E:\Program Files\Tencent\QQ\npkcrypt.sys> [NTSTAP1 / NTSTAP1][Stopped/Manual Start] <\??\C:\PROGRA~1\NTS\ENTERN~1\app\NTSTAP1.SYS> [nv / nv][Running/Manual Start] [Service for NVIDIA(R) nForce(TM) Audio Enumerator / nvax][Running/Manual Start] [NVIDIA nForce MCP Networking Controller Driver / NVENET][Stopped/Manual Start] [Service for NVIDIA(R) nForce(TM) Audio / nvnforce][Running/Manual Start] [NVIDIA nForce AGP Bus Filter / nv_agp][Running/Boot Start] <\SystemRoot\System32\DRIVERS\nv_agp.sys> [Direct Parallel Link Driver / Ptilink][Running/Manual Start] [RAWESR / RAWESR][Stopped/Manual Start] <\??\C:\PROGRA~1\NTS\ENTERN~1\app\RAWESR.SYS> [ROCKEYNT / ROCKEYNT][Running/Auto Start] <\??\C:\WINNT\system32\drivers\rockeynt.sys> [RsNTGDI / RsNTGDI][Running/Boot Start] <\SystemRoot\system32\Drivers\RsNTGdi.sys> [Realtek RTL8139-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start] [SENSE3 / SENSE3][Running/Auto Start] [TAPBIND / TAPBIND][Stopped/Manual Start] <\??\C:\DOCUME~1\taotao\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\TAPBIND1.SYS> [Senselock USB Lock driver / USBLOCK][Stopped/Auto Start] [yftvxsdj / yftvxsdj][Stopped/Boot Start] <\SystemRoot\System32\DRIVERS\yftvxsdj.sys> ================================== 浏览器加载项 [ThunderAtOnce Class] {01443AEC-0FD1-40fd-9C87-E93D1494C233} [Thunder Browser Helper] {889D2FEB-5411-4565-8998-1DD2C5261283} [启动迅雷5] {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} [@shdoclc.dll,-866] {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, > [] {43869BB3-22FD-4F15-9B46-238106BA2F4E} <, > [卡卡上网安全助手] {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} [Thunder Agent Class] {485463B7-8FB2-4B3B-B29B-8B919B0EACCE} [XMP Class] {6483F145-A768-4C41-AACC-52D4D7845851} [XDRM] {693571CB-54A3-4E90-9D52-EEAE1334E2D3} [WangWangObj Class] {6E213FC7-DD5A-4115-B7E6-D4C7838C361E} [MediaComm Class] {7670648D-461B-42AF-BDFE-46D26AF5EFF2} [RMGetLicense Class] {A9FC132B-096D-460B-B7D5-1DB0FAE0C062} [Thunder DapCtrl] {ACACC6EB-1FBA-4E13-A729-53AEB2DF54F8} [Thunder DapPlayer] {EEDD6FF9-13DE-496B-9A1C-D78B3215E266} [XPPlayer Class] {F3E70CEA-956E-49CC-B444-73AFE593AD7F} [上传到QQ网络硬盘] [使用迅雷下载] [使用迅雷下载全部链接] [导出到 Microsoft Office Excel(&X)] [添加到QQ自定义面板] [添加到QQ表情] [用QQ彩信发送该图片] ================================== 正在运行的进程 [PID: 140][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.00.2195.6601] [PID: 168][\??\C:\WINNT\system32\csrss.exe] [Microsoft Corporation, 5.00.2195.6601] [PID: 164][\??\C:\WINNT\system32\winlogon.exe] [Microsoft Corporation, 5.00.2195.6997] [C:\WINNT\system32\wdmaud.drv] [Microsoft Corporation, 5.00.2195.6673] [C:\WINNT\system32\SOGOUPY.IME] [Sogou.com Inc., 3.2.0.0] [C:\WINNT\system32\msacm32.drv] [Microsoft Corporation, 5.00.2134.1] [PID: 216][C:\WINNT\system32\services.exe] [Microsoft Corporation, 5.00.2195.7035] [C:\WINNT\system32\dmserver.dll] [VERITAS Software Corp., 2195.6605.297.3] [PID: 228][C:\WINNT\system32\lsass.exe] [Microsoft Corporation, 5.00.2195.7011] [PID: 408][C:\WINNT\system32\svchost.exe] [Microsoft Corporation, 5.00.2134.1] [PID: 432][C:\WINNT\system32\spoolsv.exe] [Microsoft Corporation, 5.00.2195.7059] [C:\WINNT\system32\ZLhp1020.DLL] [Zenographics, Inc., 5, 53, 3723, 0] [C:\WINNT\system32\ZLM.dll] [Zenographics, Inc., 5, 50, 1416, 0] [C:\WINNT\system32\ZLMhp1.DLL] [Zenographics, 5, 51, 1203, 0] [C:\WINNT\system32\ZPJL.dll] [Zenographics, Inc., 1, 0, 1410, 1] [C:\WINNT\system32\ZSPOOL.dll] [Zenographics, Inc., 5, 51, 709, 0] [C:\WINNT\system32\spool\PRTPROCS\W32X86\IMFPrint.DLL] [Zenographics, Inc., 5, 54, 330, 0] [C:\WINNT\system32\Imf32.dll] [Zenographics, Inc., 5, 60, 1204, 0] [C:\WINNT\system32\ZTAG32.dll] [Zenographics, Inc., 5, 60, 1210, 0] [PID: 460][C:\WINNT\System32\drivers\CDAC11BA.EXE] [Macrovision, 4.20.020] [PID: 484][C:\WINNT\System32\svchost.exe] [Microsoft Corporation, 5.00.2134.1] [C:\WINNT\System32\unimdm.tsp] [Microsoft Corporation, 5.00.2195.6601] [C:\WINNT\System32\kmddsp.tsp] [Microsoft Corporation, 5.00.2150.1] [C:\WINNT\System32\ndptsp.tsp] [Microsoft Corporation, 5.00.2143.1] [C:\WINNT\System32\ipconf.tsp] [Microsoft Corporation, 5.00.2143.1] [C:\WINNT\System32\h323.tsp] [Microsoft Corporation, 5.00.2195.6901] [PID: 512][C:\WINNT\system32\nvsvc32.exe] [NVIDIA Corporation, 6.14.10.9424] [C:\WINNT\system32\nvapi.dll] [N/A, ] [PID: 576][C:\WINNT\system32\MSTask.exe] [Microsoft Corporation, 4.71.2195.6972] [PID: 668][C:\WINNT\System32\WBEM\WinMgmt.exe] [Microsoft Corporation, 1.50.1085.0100] [PID: 700][C:\WINNT\system32\svchost.exe] [Microsoft Corporation, 5.00.2134.1] [C:\WINNT\system32\bitsprx3.dll] [Microsoft Corporation, 6.6.2600.1596 (xpsp2.040919-1003)] [C:\WINNT\system32\bitsprx2.dll] [Microsoft Corporation, 6.6.2600.1596 (xpsp2.040919-1003)] [C:\WINNT\system32\wups2.dll] [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)] [PID: 712][C:\WINNT\System32\svchost.exe] [Microsoft Corporation, 5.00.2134.1] [C:\WINNT\system32\bitsprx3.dll] [Microsoft Corporation, 6.6.2600.1596 (xpsp2.040919-1003)] [C:\WINNT\system32\bitsprx2.dll] [Microsoft Corporation, 6.6.2600.1596 (xpsp2.040919-1003)] [PID: 876][C:\WINNT\Explorer.EXE] [Microsoft Corporation, 5.00.3700.6690] [C:\WINNT\AppPatch\AcLayers.DLL] [Microsoft Corporation, 5.00.2195.6717] [C:\WINNT\system32\SOGOUPY.IME] [Sogou.com Inc., 3.2.0.0] [f:\Program Files\SogouInput\Plugin\SgImeWord.dll] [Sogou.com Inc., 3.2.0.0] [C:\WINNT\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86] [C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] [Autodesk, 16.0.0.86] [C:\Program Files\WinRAR\rarext.dll] [N/A, ] [C:\WINNT\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.17] [F:\PROGRA~1\ftc\FTCCOM~1.DLL] [Fygsoft and Microsoft, 3.0.0.71] [F:\Program Files\Thunder Network\Thunder2\ComDlls\TDAtOnce_Now.dll] [Thunder Networking Technologies,LTD, 1.0.5.34] [C:\WINNT\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\WINNT\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [F:\Program Files\Thunder Network\Thunder2\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 8, 120] [F:\Program Files\Thunder Network\Thunder2\Components\ResWorker\DsBho_01.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 20] [C:\WINNT\system32\MSVCP60.dll] [Microsoft Corporation, 6.00.8972.0] [F:\Program Files\Thunder Network\Thunder2\Components\ResWorker\DataProcessor_01.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 16] [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510] [C:\WINNT\system32\nvshell.dll] [, ] [PID: 1020][C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe] [Hewlett-Packard, 2, 0, 1, 26] [PID: 1028][C:\WINNT\system32\RUNDLL32.EXE] [Microsoft Corporation, 5.00.2134.1] [C:\WINNT\system32\NvMcTray.dll] [NVIDIA Corporation, 6.14.10.9424] [C:\WINNT\system32\nvapi.dll] [N/A, ] [C:\WINNT\system32\SOGOUPY.IME] [Sogou.com Inc., 3.2.0.0] [f:\Program Files\SogouInput\Plugin\SgImeWord.dll] [Sogou.com Inc., 3.2.0.0] [C:\WINNT\system32\NVRSZHC.DLL] [NVIDIA Corporation, 6.14.10.9424] [PID: 1044][C:\WINNT\system32\internat.exe] [Microsoft Corporation, 5.00.2920.0000] [C:\WINNT\system32\SOGOUPY.IME] [Sogou.com Inc., 3.2.0.0] [f:\Program Files\SogouInput\Plugin\SgImeWord.dll] [Sogou.com Inc., 3.2.0.0] [PID: 680][C:\WINNT\system32\wuauclt.exe] [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)] [C:\WINNT\system32\wucltui.dll] [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)] [C:\WINNT\system32\wups2.dll] [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)] [C:\WINNT\system32\wucltui.dll.mui] [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)] [PID: 1264][F:\Program Files\Tencent\TT\TTraveler.exe] [腾讯公司, 3, 3, 200, 290] [C:\WINNT\system32\MSVCP60.dll] [Microsoft Corporation, 6.00.8972.0] [C:\WINNT\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86] [C:\WINNT\system32\SOGOUPY.IME] [Sogou.com Inc., 3.2.0.0] [f:\Program Files\SogouInput\Plugin\SgImeWord.dll] [Sogou.com Inc., 3.2.0.0] [F:\Program Files\Tencent\TT\Plugins\QQFloatBar\QQFloatBar4TT2.dll] [腾讯公司, 1, 1, 0, 5] [F:\Program Files\Tencent\TT\Plugins\TWeather\TWeather.dll] [, 1, 0, 0, 3] [F:\Program Files\Tencent\TT\TTNetFavor.dll] [N/A, ] [C:\WINNT\system32\wdmaud.drv] [Microsoft Corporation, 5.00.2195.6673] [C:\WINNT\system32\msacm32.drv] [Microsoft Corporation, 5.00.2134.1] [F:\Program Files\Tencent\TT\qqzip.dll] [tencent, 0, 3, 2, 4] [C:\WINNT\system32\Macromed\Flash\Flash9e.ocx] [Adobe Systems, Inc., 9,0,115,0] [F:\Program Files\Thunder Network\Thunder2\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 8, 120] [PID: 824][E:\rising\Rav\Rav.exe] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 72] [C:\WINNT\system32\SOGOUPY.IME] [Sogou.com Inc., 3.2.0.0] [f:\Program Files\SogouInput\Plugin\SgImeWord.dll] [Sogou.com Inc., 3.2.0.0] [E:\rising\Rav\ProcCom.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 20] [E:\rising\Rav\RsCommX2.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 20] [E:\rising\Rav\Rsguilib.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 90] [C:\WINNT\system32\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\WINNT\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\WINNT\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\WINNT\system32\MFC71CHS.DLL] [Microsoft Corporation, 7.10.3077.0] [E:\rising\Rav\RsXML.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 2] [E:\rising\Rav\PngDll.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 5] [E:\rising\Rav\RsCommon.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 17] [E:\rising\Rav\ravpagem.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 1, 9] [E:\rising\Rav\htmllib.dll] [Beijing Rising Information Technology Co., Ltd., 20.0.0.17] [C:\WINNT\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.17] [C:\WINNT\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86] [E:\rising\Rav\ravpagew.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 89] [E:\rising\Rav\RSAPPMGR.dll] [Beijing Rising Information Technology Co., Ltd., 20.0.0.1] [E:\rising\Rav\CfgDll.dll] [Beijing Rising Information Technology Co., Ltd., 20.0.0.19] [E:\rising\Rav\fakescan.dll] [Beijing Rising Information Technology Co., Ltd., 20.0.0.14] [E:\rising\Rav\Scanner.dll] [Beijing Rising Information Technology Co., Ltd., 20.0.0.39] [E:\rising\Rav\BWList.dll] [Beijing Rising Information Technology Co., Ltd., 20.0.0.5] [E:\rising\Rav\SysMail.dll] [Beijing Rising Information Technology Co., Ltd., 20.0.0.11] [E:\rising\Rav\RsLog.dll] [Beijing Rising Information Technology Co., Ltd., 20.0.0.36] [C:\WINNT\system32\wdmaud.drv] [Microsoft Corporation, 5.00.2195.6673] [C:\WINNT\system32\msacm32.drv] [Microsoft Corporation, 5.00.2134.1] [E:\rising\Rav\recomp.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 41] [E:\rising\Rav\refs.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 18] [E:\rising\Rav\viruslib.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 27] [E:\rising\Rav\relibldr.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 17] [E:\rising\Rav\mvengine.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 18] [E:\rising\Rav\posttrt.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 25] [E:\rising\Rav\ffr.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 17] [E:\rising\Rav\nvfile.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 7] [E:\rising\Rav\scanexec.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 22] [E:\rising\Rav\unexe.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 6] [E:\rising\Rav\scanex.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 96] [E:\rising\Rav\scansct.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 11] [E:\rising\Rav\extmail.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 10] [E:\rising\Rav\extole.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 13] [E:\rising\Rav\pearc.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 8] [E:\rising\Rav\scanpack.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 10] [E:\rising\Rav\revm.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 11] [E:\rising\Rav\urutils.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 7] [E:\rising\Rav\ur000.dat] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 22] [E:\rising\Rav\extfile.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 32] [PID: 1312][F:\ftc2008\FTCleaner.exe] [风.云.谷, 11.03.1027] [F:\ftc2008\MSVBVM60.DLL] [Microsoft Corporation, 6.00.9237] [F:\ftc2008\vb6chs.dll] [Microsoft Corporation, 6.00.8988] [C:\WINNT\system32\SOGOUPY.IME] [Sogou.com Inc., 3.2.0.0] [f:\Program Files\SogouInput\Plugin\SgImeWord.dll] [Sogou.com Inc., 3.2.0.0] [F:\ftc2008\ftcapi.dll] [木马清道夫组件, 1.3.0.209] [F:\ftc2008\ftcapi3.dll] [木马清道夫组件, 1.0.0.0] [F:\ftc2008\ftcapi2.dll] [, 1.0.0.280] [C:\WINNT\system32\wdmaud.drv] [Microsoft Corporation, 5.00.2195.6673] [C:\WINNT\system32\msacm32.drv] [Microsoft Corporation, 5.00.2134.1] [C:\WINNT\system32\mscomctl.ocx] [Microsoft Corporation, 6.01.9545] [PID: 1544][F:\ftc2008\Trojanwall.exe] [风云谷科技, 7.2.0.2627] [F:\ftc2008\FTCCompress.dll] [木马清道夫加密DLL, 1.0.0.0] [F:\ftc2008\ftcapi2.dll] [, 1.0.0.280] [F:\ftc2008\ftcapi3.dll] [木马清道夫组件, 1.0.0.0] [F:\ftc2008\ftcapi.dll] [木马清道夫组件, 1.3.0.209] [C:\WINNT\system32\SOGOUPY.IME] [Sogou.com Inc., 3.2.0.0] [f:\Program Files\SogouInput\Plugin\SgImeWord.dll] [Sogou.com Inc., 3.2.0.0] [C:\WINNT\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86] [PID: 1652][F:\Program Files000\SREngLdr.EXE] [Smallfrogs Studio, 2.6.12.1018] [PID: 1052][F:\Program Files000\SRE66a8d79c.EXE] [Smallfrogs Studio, 2.6.12.1018] [C:\WINNT\system32\SOGOUPY.IME] [Sogou.com Inc., 3.2.0.0] [f:\Program Files\SogouInput\Plugin\SgImeWord.dll] [Sogou.com Inc., 3.2.0.0] [F:\Program Files000\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15] [C:\WINNT\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86] [C:\WINNT\system32\MSISIP.DLL] [Microsoft Corporation, 3.1.4000.1823] [C:\WINNT\system32\wshCHS.DLL] [Microsoft Corporation, 5.6.0.6626] ================================== 文件关联 .TXT Error. [C:\WINNT\notepad.exe %1] .EXE OK. ["%1" %*] .COM OK. ["%1" %*] .PIF OK. ["%1" %*] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %*] .SCR OK. ["%1" /S] .CHM Error. ["hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI Error. [C:\WINNT\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf [F:\] [autorun] OPEN=kp-setup.exe /AUTORUN ICON=kp.ico shell\install=安装(&I)... shell\install\command=kp-setup.exe ================================== HOSTS 文件 127.0.0.1 localhost ================================== 进程特权扫描特殊特权被允许： SeLoadDriverPrivilege [PID = 460, C:\WINNT\SYSTEM32\DRIVERS\CDAC11BA.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 1020, C:\PROGRAM FILES\HEWLETT-PACKARD\ORDERREMINDER\ORDERREMINDER.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 1264, F:\PROGRAM FILES\TENCENT\TT\TTRAVELER.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 1312, F:\FTC2008\FTCLEANER.EXE] 特殊特权被允许： SeSystemtimePrivilege [PID = 1544, F:\FTC2008\TROJANWALL.EXE] 特殊特权被允许： SeDebugPrivilege [PID = 1544, F:\FTC2008\TROJANWALL.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 1544, F:\FTC2008\TROJANWALL.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 1652, F:\PROGRAM FILES000\SRENGLDR.EXE] ================================== API HOOK N/A ================================== 隐藏进程 N/A ================================== [/CODE]