[CODE] 2008-04-01,23:55:02 System Repair Engineer 2.5.16.900 Smallfrogs (http://www.KZTechs.com) Windows XP Professional Service Pack 1 (Build 2600) - 管理权限用户 - 完整功能 以下内容被选中: 所有的启动项目(包括注册表、启动文件夹、服务等) 浏览器加载项 正在运行的进程(包括进程模块信息) 文件关联 Winsock 提供者 Autorun.inf HOSTS 文件 进程特权扫描 启动项目 注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <> [N/A] <> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] [(Verified)Check Point Software Technologies Inc.] <"E:\程序\聊天\淘宝旺旺\WangWang\WangWang.EXE"> [(Verified)"Alibaba Software(Shanghai)Co,. Ltd"] [(Verified)Microsoft Windows Hardware Compatibility Publisher] [Super Rabbit] <"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.] <"I:\Thunder\Thunder.exe" /s> [N/A] <"C:\Program Files\Ringz Studio\Storm Codec\qttask.exe" -atboottime> [Apple Inc.] <"E:\程序\杀毒\Rising\Rav\RavTask.exe" -system> [(Verified)Beijing Rising Science and Technology Corporation Limited] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] [(Verified)Microsoft Windows XP Publisher] [(Verified)Microsoft Windows XP Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] [(Verified)Maxthon Asia Ltd] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{50632D5C-B71B-4ba0-B012-3DC6F15C011B}> [N/A] <{32CD708B-60A7-4C00-9377-D73EAA495F0F}> [(Verified)Beijing Rising Science and Technology Corporation Limited] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}] <%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] <%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] <%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{306D6C21-C1B6-4629-986C-E59E1875B8AF}] <"C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Messenger\msgsc.dll",ShowIconsUser> [(Verified)Microsoft Windows XP Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] <"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] [(Verified)Microsoft Windows XP Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] [(Verified)Microsoft Windows XP Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <; > [N/A] <; C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe> [ATI Technologies, Inc.] <; C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera> [N/A] <; SafeSignCertReg.exe> [A.E.T. Europe B.V.] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <; C:\WINDOWS\System32\ctfmon.exe> [(Verified)Microsoft Windows XP Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <; "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033> [(Verified)DAEMON Tools Code Signing Services] <; C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload> [(Verified)Microsoft Corporation] <; "E:\程序\播放器\iTunesHelper.exe"> [(Verified)"Apple Computer, Inc."] <; %systemroot%\system32\dumprep 0 -k> [N/A] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <; > [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <; > [N/A] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <; C:\DOCUME~1\liuhui\LOCALS~1\Temp\Rav.exe> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <; > [N/A] <; RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup> [(Verified)Microsoft Windows Hardware Compatibility Publisher] <; RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit> [(Verified)Microsoft Windows Hardware Compatibility Publisher] <; nwiz.exe /install> [NVIDIA Corporation] <; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows XP Publisher] <; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows XP Publisher] <; "C:\Program Files\Ringz Studio\Storm Codec\qttask.exe" -atboottime> [Apple Inc.] <; "C:\Program Files\Rising\AntiSpyware\runiep.exe" /startup> [Beijing Rising Technology Co., Ltd.] <; SOUNDMAN.EXE> [(Verified)Microsoft Windows Hardware Compatibility Publisher] <; "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti> [] <; E:\程序\下载工具\迅雷MIni\ThunderMiniShell.exe> [] <; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.] <; > [N/A] ================================== 启动文件夹 [腾讯QQ] E:\程序\聊天\QQ\QQ.exe [TENCENT]> [QQ游戏启动加速程序] E:\程序\聊天\QQGame\Accel.exe [深圳市腾讯计算机系统有限公司]> ================================== 服务 [Ati HotKey Poller / Ati HotKey Poller][Stopped/Auto Start] <> [ATI Smart / ATI Smart][Stopped/Auto Start] <> [Canon Camera Access Library 8 / CCALib8][Stopped/Auto Start] [Human Interface Device Access / HidServ][Stopped/Disabled] %SystemRoot%\System32\hidserv.dll> [iPod 服务 / iPod Service][Stopped/Manual Start] [NVIDIA Display Driver Service / NVSvc][Running/Auto Start] [Remote Debug Service / RemoteDbg][Stopped/Auto Start] [Rising Process Communication Center / RsCCenter][Stopped/Auto Start] <"E:\程序\杀毒\Rising\Rav\CCenter.exe"> [Rising RealTime Monitor / RsRavMon][Stopped/Auto Start] <"E:\程序\杀毒\RISING\RAV\Ravmond.exe"> [TrueVector Internet Monitor / vsmon][Running/Auto Start] [Win32 Display Driver / Win32DDS][Stopped/Auto Start] [WMI Performance API / WMIApiSrv][Stopped/Auto Start] ================================== 驱动程序 [Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start] [ati2mtag / ati2mtag][Stopped/Manual Start] [BaseTDI / BaseTDI][Running/Auto Start] <\??\C:\WINDOWS\System32\drivers\basetdi.sys> [dtscsi / dtscsi][Running/Manual Start] <\SystemRoot\System32\Drivers\dtscsi.sys> [Intel(R) PRO Adapter Driver / E100B][Running/Manual Start] [ExpScaner / ExpScaner][Stopped/Auto Start] <\??\E:\程序\杀毒\RISING\RAV\ExpScan.sys> [usb Card Device / ft2kEnum][Running/Manual Start] [USB Chip Holder Service / GDBaseSmc][Running/Manual Start] [USB Chip Service / GD_USB][Running/Manual Start] <> [GEAR CDRom Filter / GEARAspiWDM][Running/Manual Start] [GMSIPCI / GMSIPCI][Stopped/Manual Start] <\??\Z:\INSTALL\GMSIPCI.SYS> [HookCont / HookCont][Running/System Start] <\SystemRoot\system32\drivers\HookCont.sys> [HookNtos / HookNtos][Running/System Start] <\SystemRoot\system32\drivers\HookNtos.sys> [HookReg / HookReg][Running/System Start] <\SystemRoot\system32\drivers\HookReg.sys> [HookSys / HookSys][Running/System Start] <\SystemRoot\system32\drivers\HookSys.sys> [IdeBusDr / IdeBusDr][Running/Boot Start] <\SystemRoot\System32\DRIVERS\IdeBusDr.sys> [Intel(R) Ultra ATA Controller / IdeChnDr][Running/Boot Start] <\SystemRoot\System32\DRIVERS\IdeChnDr.sys> [MEMSCAN / MEMSCAN][Stopped/Auto Start] <\??\E:\程序\杀毒\RISING\RAV\MEMSCAN.sys> [npkcrypt / npkcrypt][Stopped/Auto Start] <\??\C:\Program Files\Tencent\QQ\npkcrypt.sys> [nv / nv][Running/Manual Start] [Service for NVIDIA(R) nForce(TM) Audio Enumerator / nvax][Stopped/Manual Start] [NVIDIA nForce MCP Networking Controller Driver / NVENET][Stopped/Manual Start] [Service for NVIDIA(R) nForce(TM) Audio / nvnforce][Stopped/Manual Start] [NVIDIA nForce AGP Bus Filter / nv_agp][Running/Boot Start] <\SystemRoot\System32\DRIVERS\nv_agp.sys> [Direct Parallel Link Driver / Ptilink][Running/Manual Start] [SmartCard Reader Device / Reader_Device][Running/Manual Start] [RsAntiSpyware / RsAntiSpyware][Running/Boot Start] <\SystemRoot\System32\drivers\RsBoot.sys> [RsNTGDI / RsNTGDI][Running/Boot Start] <\SystemRoot\System32\Drivers\RsNTGdi.sys> [RSPPSYS / RSPPSYS][Stopped/Auto Start] <\??\E:\程序\杀毒\RISING\RAV\RSPPSYS.sys> [Secdrv / Secdrv][Running/Auto Start] [Intel (R) System Management BIOS Service / SMBios][Running/Manual Start] [Sony USB Filter Driver (SONYPVU1) / SONYPVU1][Stopped/Manual Start] [sptd / sptd][Running/Boot Start] <\SystemRoot\System32\Drivers\sptd.sys> [TSP / TSP][Stopped/Manual Start] <\??\C:\WINDOWS\system32\drivers\klif.sys> [vsdatant / vsdatant][Running/System Start] [Sony Ericsson W800 driver (WDM) / w800bus][Stopped/Manual Start] [Sony Ericsson W800 USB WMC Modem Filter / w800mdfl][Stopped/Manual Start] [Sony Ericsson W800 USB WMC Modem Drivers / w800mdm][Stopped/Manual Start] [Sony Ericsson W800 USB WMC Device Management Drivers / w800mgmt][Stopped/Manual Start] [Sony Ericsson W800 USB WMC OBEX Interface Drivers / w800obex][Stopped/Manual Start] [World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start] [Sony Ericsson Composite Device driver / zebrbus][Stopped/Manual Start] [Sony Ericsson Port (WDM) / zebrmdm][Stopped/Manual Start] [Sony Ericsson mRouter Port (WDM) / zebrmdmc][Stopped/Manual Start] [VIMICRO USB PC Camera / ZSMC302][Stopped/Manual Start] ================================== 浏览器加载项 [WebThunder Browser Helper] {00000AAA-A363-466E-BEF5-9BB68697AA7F} [ThunderAtOnce Class] {01443AEC-0FD1-40fd-9C87-E93D1494C233} [Thunder Browser Helper] {889D2FEB-5411-4565-8998-1DD2C5261283} [ThunderMini Browser Helper] {8E6C1C49-F9CE-4311-9FB4-D70E8B0AEAEB} [Google Toolbar Helper] {AA58ED58-01DD-4d91-8333-CF10577473F7} [] {C2626E66-D21B-E628-C1DF-1DACCFA36ED2} [启动迅雷5] {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} [启动WEB迅雷] {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} [&Google] {2318C2B1-4965-11d4-9B18-009027A5CD4F} [电台(&R)] {8E718888-423F-11D2-876E-00A0C9082467} [ULiveCtrl Control] {070CA17A-4BD2-4612-83B4-32B1B9159B47} [Edit Class] {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} [GDGetTokenInfo Class] {3AA9CF07-DF20-48FF-98BE-DED276E40146} [ICBC Security Ctrl] {5AB9367B-DD7F-411D-A030-DF7DE5E17AAE} [InfoSecNetSign Class] {5CB840B5-A94E-4AD9-B785-4866E3B04476} [ScreenCapture Class] {BFB79EE1-04AE-4D4A-B85E-27EE5F30C095} [Tencent Safety Online Base Module] {C09B522F-8AED-4E21-A65C-DC1AB652BAEE} [CSetLET Class] {C35D7AE1-0865-4A30-BF07-29FA29324155} [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} [Rising Web Scan Object] {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} [WebThunder Class] {03507A1A-E0C5-4404-AA26-205385C0892D} <, N/A> [GerneralPeerID Class] {0A47E819-F82E-4D5D-B806-6A9EA94D68CD} [WebThunder DapPlayer] {2EEDA47E-8D5C-4d7e-B4B6-E16E19218555} [Thunder Agent Class] {485463B7-8FB2-4B3B-B29B-8B919B0EACCE} [XMP Class] {6483F145-A768-4C41-AACC-52D4D7845851} [XDRM] {693571CB-54A3-4E90-9D52-EEAE1334E2D3} [WangWangObj Class] {6E213FC7-DD5A-4115-B7E6-D4C7838C361E} [MediaComm Class] {7670648D-461B-42AF-BDFE-46D26AF5EFF2} [RMGetLicense Class] {A9FC132B-096D-460B-B7D5-1DB0FAE0C062} [Thunder DapCtrl] {ACACC6EB-1FBA-4E13-A729-53AEB2DF54F8} [Thunder DapPlayer] {EEDD6FF9-13DE-496B-9A1C-D78B3215E266} [Thunder DapCtrl] {EF1EA76E-5428-4e40-85A1-D4DD2893183A} [XPPlayer Class] {F3E70CEA-956E-49CC-B444-73AFE593AD7F} [&使用迷你迅雷下载] [使用Web迅雷下载] [使用Web迅雷下载全部链接] [使用迅雷下载] [使用迅雷下载全部链接] [导出到 Microsoft Office Excel(&X)] [添加到QQ表情] ================================== 正在运行的进程 [PID: 624 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)] [PID: 688 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 712 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)] [C:\WINDOWS\system32\Ati2evxx.dll] [, ] [C:\WINDOWS\system32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\WINDOWS\system32\aetcsss1.dll] [A.E.T. Europe B.V., 2.0.0.23] [C:\WINDOWS\system32\aetdlss1.dll] [A.E.T. Europe B.V., 2.0.0.15] [C:\WINDOWS\system32\aetpkss1.dll] [A.E.T. Europe B.V., 2.0.0.21] [PID: 760 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 772 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)] [C:\WINDOWS\system32\xunyount.dll] [N/A, ] [PID: 948 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\WINDOWS\system32\xunyount.dll] [N/A, ] [PID: 1108 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\WINDOWS\system32\xunyount.dll] [N/A, ] [C:\WINDOWS\System32\wups2.dll] [Microsoft Corporation, 7.0.6000.374 (winmain(wmbla).070416-2057)] [PID: 1264 / NETWORK SERVICE][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\WINDOWS\system32\xunyount.dll] [N/A, ] [PID: 1296 / LOCAL SERVICE][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 1648 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.1699 (xpsp2.050610-1533)] [C:\WINDOWS\system32\mdimon.dll] [Microsoft Corporation, 11.3.2175.0] [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll] [Microsoft Corporation, 11.3.2175.0] [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll] [Windows (R) 2000 DDK provider, 5.00.2195.1620] [PID: 1752 / liuhui][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)] [C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.17] [E:\程序\播放器\iTunesMiniPlayer.dll] [Apple Inc., 7.3.2.6] [E:\程序\播放器\iTunesMiniPlayer.Resources\zh_CN.lproj\iTunesMiniPlayerLocalized.dll] [Apple Inc., 7.3.2.2] [E:\程序\播放器\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll] [Apple Inc., 7.3.2.6] [C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)] [C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\WINDOWS\System32\nvcpl.dll] [NVIDIA Corporation, 6.14.10.7645] [C:\WINDOWS\System32\NVRSZHC.DLL] [NVIDIA Corporation, 6.14.10.7645] [C:\WINDOWS\System32\nvshell.dll] [NVIDIA Corporation, 6.14.10.10518] [E:\程序\下载工具\WebThunderBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 8, 62] [E:\程序\下载工具\迅雷MIni\ComDlls\XunLeiMiniBHO_001.dll] [Thunder Networking Technologies,LTD, 2, 0, 0, 1] [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510] [E:\程序\聊天\QQ\qdshm.dll] [, 1, 0, 101, 20] [E:\程序\聊天\QQ\MFC42.DLL] [Microsoft Corporation, 6.00.8665.0] [C:\Program Files\WinRAR\rarext.dll] [N/A, ] [E:\程序\杀毒\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16] [PID: 504 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)] [C:\WINDOWS\system32\xunyount.dll] [N/A, ] [PID: 572 / SYSTEM][C:\WINDOWS\System32\nvsvc32.exe] [NVIDIA Corporation, 6.14.10.7645] [PID: 1328 / liuhui][E:\程序\杀毒\Rising\Rav\RavTask.exe] [Beijing Rising Technology Co., Ltd., 20.0.0.22] [E:\程序\杀毒\Rising\Rav\ProcCom.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19] [E:\程序\杀毒\Rising\Rav\RsCommX2.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19] [E:\程序\杀毒\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16] [E:\程序\杀毒\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 20.0.0.0] [E:\程序\杀毒\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.16] [PID: 1372 / LOCAL SERVICE][C:\WINDOWS\System32\SCardSvr.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 1408 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 1464 / LOCAL SERVICE][C:\WINDOWS\System32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)] [PID: 376 / liuhui][E:\程序\聊天\淘宝旺旺\WangWang\WangWang.EXE] [阿里巴巴软件(上海)有限公司, 5, 6, 0, 5] [E:\程序\聊天\淘宝旺旺\WangWang\AliViewCtrl.dll] [ 阿里巴巴软件(上海)有限公司, 1, 0, 0, 2] [E:\程序\聊天\淘宝旺旺\WangWang\VLNetwork.dll] [阿里巴巴软件(上海)有限公司, 1, 0, 0, 6] [E:\程序\聊天\淘宝旺旺\WangWang\MFC80.DLL] [Microsoft Corporation, 8.00.50727.762] [E:\程序\聊天\淘宝旺旺\WangWang\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.762] [E:\程序\聊天\淘宝旺旺\WangWang\MSVCP80.dll] [Microsoft Corporation, 8.00.50727.762] [E:\程序\聊天\淘宝旺旺\WangWang\AliViewMedia.dll] [ 阿里巴巴软件(上海)有限公司, 1, 0, 0, 2] [E:\程序\聊天\淘宝旺旺\WangWang\VideoCap.dll] [ 阿里巴巴软件(上海)有限公司, 1, 0, 0, 4] [E:\程序\聊天\淘宝旺旺\WangWang\VLAudio.dll] [ 阿里巴巴软件(上海)有限公司, 1, 0, 0, 5] [E:\程序\聊天\淘宝旺旺\WangWang\JsmShow.dll] [ 阿里巴巴软件(上海)有限公司, 1, 0, 0, 4] [E:\程序\聊天\淘宝旺旺\WangWang\AliSkin.dll] [阿里巴巴软件(上海)有限公司, 1.0.0.1] [E:\程序\聊天\淘宝旺旺\WangWang\PngLib.dll] [阿里巴巴软件(上海)有限公司, 1, 0, 0, 1] [E:\程序\聊天\淘宝旺旺\WangWang\zlib.dll] [, 1.2.3] [E:\程序\聊天\淘宝旺旺\WangWang\ww_network.dll] [, 2. 1.0.0] [E:\程序\聊天\淘宝旺旺\WangWang\MFC80CHS.DLL] [Microsoft Corporation, 8.00.50727.762] [E:\程序\聊天\淘宝旺旺\WangWang\Ali_Res.DLL] [N/A, ] [C:\WINDOWS\system32\aliedit\aliedit.dll] [, 1, 1, 0, 3] [E:\程序\聊天\淘宝旺旺\WangWang\WangWangX4.dll] [阿里巴巴软件(上海)有限公司, 1, 0, 0, 1] [E:\程序\聊天\淘宝旺旺\WangWang\RICHED32.DLL] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [E:\程序\聊天\淘宝旺旺\WangWang\RICHED20.dll] [Microsoft Corporation, 5.30.23.1221] [E:\程序\聊天\淘宝旺旺\WangWang\RichOne.dll] [阿里巴巴软件(上海)有限公司, 1.0.0.1] [E:\程序\聊天\淘宝旺旺\WangWang\TBProgress.dll] [阿里巴巴软件(上海)有限公司, 1.0.0.1] [E:\程序\聊天\淘宝旺旺\WangWang\MessageNotify.dll] [, 1, 0, 0, 1] [C:\WINDOWS\system32\xunyount.dll] [N/A, ] [E:\程序\杀毒\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 3] [C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)] [C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\WINDOWS\System32\msdmo.dll] [, ] [PID: 564 / liuhui][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] [RealNetworks, Inc., 0.1.0.3427] [PID: 2988 / liuhui][E:\程序\杀毒\Rising\Rav\Rav.exe] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 68] [E:\程序\杀毒\Rising\Rav\ProcCom.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19] [E:\程序\杀毒\Rising\Rav\RsCommX2.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19] [E:\程序\杀毒\Rising\Rav\Rsguilib.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 88] [C:\WINDOWS\System32\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\System32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\WINDOWS\System32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [E:\程序\杀毒\Rising\Rav\RsXML.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 0] [E:\程序\杀毒\Rising\Rav\PngDll.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 4] [E:\程序\杀毒\Rising\Rav\RsCommon.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16] [E:\程序\杀毒\Rising\Rav\ravpagem.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 1, 1] [E:\程序\杀毒\Rising\Rav\htmllib.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.16] [C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.17] [C:\WINDOWS\system32\xunyount.dll] [N/A, ] [E:\程序\杀毒\Rising\Rav\ravpagew.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 86] [E:\程序\杀毒\Rising\Rav\RSAPPMGR.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.0] [E:\程序\杀毒\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.16] [E:\程序\杀毒\Rising\Rav\fakescan.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.13] [E:\程序\杀毒\Rising\Rav\Scanner.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.36] [E:\程序\杀毒\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.4] [E:\程序\杀毒\Rising\Rav\SysMail.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.10] [E:\程序\杀毒\Rising\Rav\RsLog.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.34] [PID: 3216 / liuhui][E:\程序\杀毒\Rising\Rav\ScanBD.exe] [Beijing Rising Technology Co., Ltd., 20.0.0.9] [E:\程序\杀毒\Rising\Rav\ProcCom.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19] [E:\程序\杀毒\Rising\Rav\RsCommX2.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19] [E:\程序\杀毒\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 3] [E:\程序\杀毒\Rising\Rav\BDEngine.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.1] [E:\程序\杀毒\Rising\Rav\libload.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 16] [E:\程序\杀毒\Rising\Rav\BDEX.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.0] [E:\程序\杀毒\Rising\Rav\BDLib.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.1] [C:\WINDOWS\system32\xunyount.dll] [N/A, ] [PID: 3332 / liuhui][E:\程序\媒体浏览\^Q^安装文件\Maxthon2\Maxthon.exe] [Maxthon International ltd., 2, 0, 8, 1720] [E:\程序\媒体浏览\^Q^安装文件\Maxthon2\mxpp.dll] [Maxthon International ltd., 1, 0, 0, 74] [E:\程序\媒体浏览\^Q^安装文件\Maxthon2\MxSk.dll] [Maxthon, 1, 0, 0, 369] [E:\程序\媒体浏览\^Q^安装文件\Maxthon2\MxProxy2.dll] [Maxthon, 1, 0, 0, 3675] [E:\程序\媒体浏览\^Q^安装文件\Maxthon2\IMxWebBoost.dll] [Maxthon, 1, 0, 0, 2330] [E:\程序\媒体浏览\^Q^安装文件\Maxthon2\mxdb.dll] [Max, 3, 5, 3, 125] [E:\程序\媒体浏览\^Q^安装文件\Maxthon2\MxExt.dll] [N/A, ] [C:\WINDOWS\system32\xunyount.dll] [N/A, ] [E:\程序\媒体浏览\^Q^安装文件\Maxthon2\MxFav.dll] [Maxthon International ltd., 1, 0, 0, 220] [E:\程序\媒体浏览\^Q^安装文件\Maxthon2\maxzlib.dll] [, 1.2.3] [E:\程序\媒体浏览\^Q^安装文件\Maxthon2\mxtool.dll] [, 1, 0, 0, 1] [E:\程序\媒体浏览\^Q^安装文件\Maxthon2\mxfeedU.dll] [, 1, 0, 45, 92] [E:\程序\媒体浏览\^Q^安装文件\Maxthon2\Modules\MxGuardian\MxGuardian.dll] [Maxthon International ltd., 1, 0, 0, 666] [E:\程序\杀毒\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 3] [C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)] [C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\WINDOWS\system32\aliedit\aliedit.dll] [, 1, 1, 0, 3] [E:\程序\聊天\淘宝旺旺\WangWang\WangWangX4.dll] [阿里巴巴软件(上海)有限公司, 1, 0, 0, 1] [C:\WINDOWS\system32\aliedit\pta.dll] [, 2, 5, 1, 509] [C:\WINDOWS\System32\aetcsss1.dll] [A.E.T. Europe B.V., 2.0.0.23] [C:\WINDOWS\System32\aetdlss1.dll] [A.E.T. Europe B.V., 2.0.0.15] [C:\WINDOWS\System32\aetpkss1.dll] [A.E.T. Europe B.V., 2.0.0.21] [C:\WINDOWS\System32\Macromed\Flash\Flash9e.ocx] [Adobe Systems, Inc., 9,0,115,0] [PID: 3728 / liuhui][E:\程序\杀毒\Rising\Rav\RavMon.exe] [Beijing Rising Technology Co., Ltd., 20.0.01.14] [C:\WINDOWS\System32\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\System32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\WINDOWS\System32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [E:\程序\杀毒\Rising\Rav\ProcCom.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19] [E:\程序\杀毒\Rising\Rav\RsCommX2.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19] [E:\程序\杀毒\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16] [E:\程序\杀毒\Rising\Rav\recomp.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 34] [E:\程序\杀毒\Rising\Rav\refs.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 15] [E:\程序\杀毒\Rising\Rav\viruslib.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 21] [E:\程序\杀毒\Rising\Rav\relibldr.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 13] [E:\程序\杀毒\Rising\Rav\RSAPPMGR.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.0] [E:\程序\杀毒\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.16] [E:\程序\杀毒\Rising\Rav\MonRule.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.29] [E:\程序\杀毒\Rising\Rav\PngDll.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 4] [E:\程序\杀毒\Rising\Rav\Rsguilib.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 88] [E:\程序\杀毒\Rising\Rav\RsXML.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 0] [PID: 2580 / liuhui][E:\程序\下载工具\WebThunder.exe] [深圳市迅雷网络技术有限公司, 1, 12, 2, 210] [E:\程序\下载工具\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [E:\程序\下载工具\TaskManager.dll] [Thunder Networking Technologies,LTD, 1, 3, 0, 52] [E:\程序\下载工具\download_interface.dll] [Thunder Networking Technologies,LTD, 2, 21, 2, 204] [E:\程序\下载工具\stlport_vc646.dll] [STLport Consulting, Inc., 4.6.2003.1031] [E:\程序\下载工具\asyn_dns.dll] [Thunder Networking Technologies,LTD, 2, 21, 2, 204] [C:\WINDOWS\system32\xunyount.dll] [N/A, ] [E:\程序\下载工具\streammedialib.dll] [, 1, 3, 2, 107] [E:\程序\下载工具\al.dll] [, 1, 0, 1, 3] [E:\程序\下载工具\xldc.dll] [Thunder Networking Technologies,LTD, 1, 0, 2, 14] [E:\程序\下载工具\bd.dll] [Thunder Networking Technologies,LTD, 1, 0, 2, 6] [E:\程序\下载工具\RegisterDll.dll] [Thunder Networking Technologies,LTD, 2, 16, 5, 63] [E:\程序\下载工具\CacheServer.dll] [, 1, 0, 0, 1] [E:\程序\下载工具\XLSafe\SafeInfo.dll] [深圳市迅雷网络技术有限公司, 1, 0, 1, 2] [E:\程序\下载工具\XLSafe\RMFScan.dll] [N/A, ] [E:\程序\下载工具\XLNet.Dll] [Thunder Networking Technologies,LTD, 1, 2, 1, 9] [E:\程序\杀毒\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 3] [C:\WINDOWS\System32\Macromed\Flash\Flash9e.ocx] [Adobe Systems, Inc., 9,0,115,0] [C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)] [C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [E:\程序\下载工具\DownAndPlay\WebDownAndPlay.dll] [ShenZhen Thunder Networking Technologies Ltd., 1, 0, 3, 21] [E:\程序\下载工具\XLStatistic\XLStatisticAddin.dll] [深圳市迅雷网络技术有限公司, 1, 4, 1, 5] [PID: 3088 / liuhui][C:\Program Files\WinRAR\WinRAR.exe] [Alexander Roshal, 3.51] [C:\WINDOWS\System32\Audiodev.dll] [Microsoft Corporation, 5.2.3802.3802 built by: dnsrv(bld4act)] [PID: 872 / liuhui][C:\WINDOWS\sreng2\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900] [C:\WINDOWS\sreng2\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15] [C:\WINDOWS\system32\xunyount.dll] [N/A, ] ================================== 文件关联 .TXT Error. [C:\WINDOWS\notepad.exe %1] .EXE OK. ["%1" %*] .COM OK. ["%1" %*] .PIF OK. ["%1" %*] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %*] .SCR OK. ["%1" /S] .CHM Error. ["hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 xunyou over MSAFD Tcpip [TCP/IP] C:\WINDOWS\system32\xunyount.dll(, N/A) xunyou over MSAFD Tcpip [UDP/IP] C:\WINDOWS\system32\xunyount.dll(, N/A) xunyou over MSAFD Tcpip [RAW/IP] C:\WINDOWS\system32\xunyount.dll(, N/A) xunyou C:\WINDOWS\system32\xunyount.dll(, N/A) ================================== Autorun.inf N/A ================================== HOSTS 文件 127.0.0.1 localhost ================================== 进程特权扫描 特殊特权被允许: SeLoadDriverPrivilege [PID = 564, C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE] 特殊特权被允许: SeLoadDriverPrivilege [PID = 3088, C:\PROGRAM FILES\WINRAR\WINRAR.EXE] ================================== API HOOK N/A ================================== 隐藏进程 N/A ================================== [/CODE]