启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><; C:\WINDOWS\System32\ctfmon.exe> [Microsoft Corporation]
<hws><; C:\WINDOWS\hws.exe> []
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><; ?矵婰
?矵??矵媘
婸
?
菫熚??> []
<run><; ?矵婰
?矵??矵媘
婸
?
菫熚??> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<360Main.exe><; C:\PROGRA~1\360so\360Main.exe> []
<AddrPlus3><; RUNDLL32.EXE C:\PROGRA~1\TENCENT\AddrPlus\QAHook2.dll,Rundll32> []
<Alitalk><; C:\PROGRA~1\阿里巴巴\贸易通\AliTalk.EXE -hideframe> []
<assistse><; "C:\PROGRA~1\3721\assistse.exe"> []
<BaiduX><; C:\Program Files\BaiduX\BaiduX.exe -min> []
<BIE><; Rundll32.exe C:\WINDOWS\DOWNLO~1\BDSrHook.dll,Rundll32> []
<CnsMin><; Rundll32.exe C:\WINDOWS\downlo~1\CnsMin.dll,Rundll32> []
<GW Port Controller><; c:\progra~1\samsung\smarthru\PORTCTRL.EXE> []
<helper.dll><; C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32> []
<IMJPMIG8.1><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32> [Microsoft Corporation]
<Install Alitalk><; rem C:\WINDOWS\temp\alitalk\alitalk.exe -hideframe> []
<internat.exe><; internat.exe> []
<LogFeil><; regedit -s C:\$NtUninstallQ8875736$\WINSYS.cer> []
<MS-4011 Memory Patch><; E:\BAK\RavSasser.exe -Patch> []
<NTdhcp><; C:\WINDOWS\System32\NTdhcp.exe> []
<PHIME2002A><; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]
<PHIME2002ASync><; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation]
<stup.exe><; C:\PROGRA~1\TENCENT\Adplus\stup.exe> []
<WangWang><; "C:\Program Files\淘宝网\淘宝旺旺\WangWang.EXE"> []
<win32><; winhost.exe> []
<YLive.exe><; C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe> []
<_KAVImmuniteSasser><; LsassPatch.EXE> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><explorer.exe> [Microsoft Corporation]
<Userinit><userinit.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><APIHookDll.dll> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{CCC65BC1-4F0C-4120-9B20-9D423A59E49C}><> []
<{3396BA2C-ED4C-4C1C-9E68-0A405772AEED}><> []
<{8774A5DB-1F6E-468A-A646-F447CB10DAAB}><> []
==================================
启动文件夹
[腾讯QQ珊瑚虫版]
<C:\Documents and Settings\gxy\「开始」菜单\程序\启动\腾讯QQ珊瑚虫版.lnk><N>
==================================
服务
[IMAPI CD-Burning COM Service / ImapiService]
<C:\WINDOWS\System32\imapi.exe><Microsoft Corporation>
[MSIServer / MSIServer]
<C:\DOCUME~1\gxy\LOCALS~1\Temp\IXP000.TMP\MsiExec.exe /V><N/A>
==================================
浏览器加载项
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <D:\QQ 2006\QQ.EXE, N/A>
[FlashGet]
{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <D:\xitong\FLASHGET\flashget.exe, FlashGet.com>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\MSMSGS.EXE, N/A>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\System32\wuweb.dll, Microsoft Corporation>
[Shockwave Flash
Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\macromed\flash\Flash.ocx, Macromedia, Inc.>
[上传到QQ网络硬盘]
<D:\QQ 2006\AddToNetDisk.htm, N/A>
[使用网际快车下载]
<D:\xitong\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<D:\xitong\FlashGet\jc_all.htm, N/A>
[添加到QQ自定义面板]
<D:\QQ 2006\AddPanel.htm, N/A>
[添加到QQ表情]
<D:\QQ 2006\AddEmotion.htm, N/A>
[珊瑚虫搜索]
<C:\Program Files\YOK.com\SuperSearch\yoksch.htm, N/A>
[用QQ彩信发送该图片]
<D:\QQ 2006\SendMMS.htm, N/A>
==================================
正在运行的进程
[PID: 436][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 500][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 524][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 568][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 580][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 752][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 800][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 920][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 968][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1108][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.0 (XPClient.010817-1148)>
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll] <Windows (R) 2000 DDK provider><5.00.2195.1620>
[PID: 1476][C:\WINDOWS\System32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: DNSRV(bld4act)>
[PID: 1700][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2600.0000 (xpclient.010817-1148)>
[PID: 1840][C:\WINDOWS\System32\ctfmon.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1860][D:\xitong\QQ\QQ.exe] <TENCENT><0, 0, 0, 0>
[D:\xitong\QQ\CoralAssist.DLL] <Coral Team><4.5.0 build 20060515>
[D:\xitong\QQ\CoralQQ.DLL] <Coral Team><4.5 Build 20060515>
[D:\xitong\QQ\ipsearcher.dll] <N/A><1.0.0.4>
[D:\xitong\QQ\QQBaseClassInDll.dll] <><1, 0, 0, 1>
[D:\xitong\QQ\QQHelperDll.dll] <><1, 0, 0, 1>
[D:\xitong\QQ\BasicCtrlDll.dll] <Tencent><5, 0, 200, 160>
[D:\xitong\QQ\QQAPI.dll] <><1, 0, 0, 1>
[D:\xitong\QQ\TIMProxy.dll] <tencent><0, 3, 2, 4>
[D:\xitong\QQ\LoginCtrl.dll] <><1, 0, 0, 1>
[D:\xitong\QQ\npkcntc.dll] <INCA Internet Co., Ltd.><2006, 3, 2, 1>
[D:\xitong\QQ\npkpdb.dll] <INCA Internet Co., Ltd.><2003, 10, 1, 1>
[D:\xitong\QQ\QQRes.dll] <tencent><1, 0, 0, 1>
[D:\xitong\QQ\QQMainFrame.dll] <N/A><N/A>
[D:\xitong\QQ\CQQApplication.dll] <N/A><N/A>
[D:\xitong\QQ\NewSkin.dll] <><1, 0, 0, 1>
[D:\xitong\QQ\HostingMgr.dll] <><1, 0, 0, 1>
[D:\xitong\QQ\CameraDll.dll] <><1, 0, 0, 1>
[D:\xitong\QQ\MailSummary.dll] <><1, 0, 0, 1>
[D:\xitong\QQ\QQSpace.dll] <><1, 0, 0, 1>
[C:\WINDOWS\System32\msdmo.dll] <N/A><N/A>
[D:\xitong\QQ\QQGroupMng.dll] <><1, 0, 0, 1>
[D:\xitong\QQ\GroupLive.dll] <N/A><N/A>
[D:\xitong\QQ\QQSysMsgMng.dll] <N/A><N/A>
[D:\xitong\QQ\UserDefinedHead.dll] <><1, 0, 0, 1>
[D:\xitong\QQ\QQPlugin.dll] <N/A><N/A>
[D:\xitong\QQ\QQConfigPlugin.dll] <><1, 0, 0, 1>
[D:\xitong\QQ\LongConnection.dll] <tencent><5, 0, 200, 160>
[D:\xitong\QQ\QRingMng.dll] <N/A><N/A>
[D:\xitong\QQ\PhoneAPI.dll] <><1, 0, 0, 1>
[D:\xitong\QQ\DialerAllinOne.dll] <tencent><1, 4, 0, 0>
[D:\xitong\QQ\QQAvatar.dll] <N/A><N/A>
[D:\xitong\QQ\FlashAvatarDll.dll] <><1, 4, 0, 1>
[D:\xitong\QQ\QQPet.dll] <><1, 0, 0, 1>
[D:\xitong\QQ\BQQApplication.dll] <N/A><N/A>
[D:\xitong\QQ\CommercesMng.dll] <><1, 0, 0, 1>
[D:\xitong\QQ\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2>
[D:\xitong\QQ\QQUdpGetFileLib.dll] <tencent><0, 2, 2, 3>
[D:\xitong\QQ\QQAddr.dll] <深圳市腾讯计算机系统有限公司><5, 0, 101, 200>
[D:\xitong\QQ\QQSceneMng.dll] <N/A><N/A>
[D:\xitong\QQ\QQPhoneHelper.dll] <腾讯科技（深圳）有限公司><2, 0, 4, 40>
[D:\xitong\QQ\ShareFiles.dll] <N/A><N/A>
[D:\xitong\QQ\QQZip.dll] <tencent><0, 3, 2, 4>
[D:\xitong\QQ\QQAllInOne.dll] <N/A><N/A>
[D:\xitong\QQ\SCCore.dll] <N/A><N/A>
[D:\xitong\QQ\QQCustomFace.dll] <N/A><N/A>
[D:\xitong\QQ\ImageOle.dll] <TODO: <Company name>><1.0.0.1>
[C:\WINDOWS\System32\macromed\flash\Flash.ocx] <Macromedia, Inc.><7,0,19,0>
[D:\xitong\QQ\GroupConnection.dll] <Tencent><5, 0, 202, 170>
[D:\xitong\QQ\qqgroupdisk.dll] <深圳腾讯科技><2, 1, 101, 40>
[PID: 1952][D:\xitong\QQ\TIMPlatform.exe] <tencent><0, 3, 1, 8>
[D:\xitong\QQ\TIMProxy.dll] <tencent><0, 3, 2, 4>
[PID: 1616][D:\xitong\FIREWALL\PFW.exe] <广州众达天网技术有限公司><2.7.7.1004>
[D:\xitong\FIREWALL\SKYMISC.DLL] <N/A><N/A>
[D:\xitong\FIREWALL\COMPRESSWRAP.DLL] <N/A><N/A>
[PID: 444][D:\xitong\Iparmor\Iparmor.exe] <luosoft.com><5.5.0.0>
[D:\xitong\Iparmor\getportlistxp.dll] <><1, 0, 0, 1>
[D:\xitong\Iparmor\hookhookdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\macromed\flash\Flash.ocx] <Macromedia, Inc.><7,0,19,0>
[PID: 1196][C:\Program Files\Internet Explorer\IEXPLORE.EXE] <Microsoft Corporation><6.00.2600.0000 (xpclient.010817-1148)>
[C:\WINDOWS\System32\macromed\flash\Flash.ocx] <Macromedia, Inc.><7,0,19,0>
[PID: 900][C:\Program Files\WinRAR\WinRAR.exe] <N/A><N/A>
[PID: 1332][D:\xitong\sreng2\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
