==================================
正在运行的进程
[PID: 404][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[PID: 456][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[PID: 480][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2113)]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\igfxsrvc.dll] [Intel Corporation, 3.0.0.3865]
[C:\WINDOWS\system32\hccutils.DLL] [Intel Corporation, 3.0.0.3865]
[PID: 528][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[C:\WINDOWS\AppPatch\AcAdProc.dll] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2105)]
[PID: 540][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2113)]
[PID: 716][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[PID: 780][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[C:\WINDOWS\system32\imon.dll] [Eset , 2, 70, 39 ]
[C:\Program Files\ESET\pr_imon.dll] [N/A, ]
[PID: 828][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)]
[C:\WINDOWS\system32\imon.dll] [Eset , 2, 70, 39 ]
[C:\Program Files\ESET\pr_imon.dll] [N/A, ]
[PID: 904][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[C:\WINDOWS\system32\imon.dll] [Eset , 2, 70, 39 ]
[C:\Program Files\ESET\pr_imon.dll] [N/A, ]
[PID: 988][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-0852)]
[C:\WINDOWS\system32\ZLhp1020.DLL] [Zenographics, Inc., 5, 60, 425, 0]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\IMFPrint.DLL] [Zenographics, Inc., 5, 54, 330, 0]
[C:\WINDOWS\system32\Imf32.dll] [Zenographics, Inc., 5, 60, 1204, 0]
[C:\WINDOWS\system32\ZTAG32.dll] [Zenographics, Inc., 5, 60, 1210, 0]
[C:\WINDOWS\system32\ZSPOOL.dll] [Zenographics, Inc., 6, 1, 1, 0]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll] [Microsoft Corporation, 11.3.8166.2]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll] [Windows (R) 2000 DDK provider, 5.00.2195.1620]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\ZIMFPrnt.DLL] [Zenographics, Inc., 6, 1, 1, 0]
[C:\WINDOWS\system32\ZIMF.dll] [Zenographics, Inc., 5, 70, 616, 0]
[C:\WINDOWS\system32\ZTAG.dll] [Zenographics, Inc., 5, 60, 1210, 0]
[PID: 1072][C:\Program Files\ESET\nod32krn.exe] [Eset , 2, 70, 39 ]
[C:\Program Files\ESET\nod32krr.dll] [Eset , 2, 70, 39 ]
[C:\Program Files\ESET\ps_amon.dll] [Eset , 2, 70, 39 ]
[C:\Program Files\ESET\pr_amon.dll] [Eset , 2, 70, 39 ]
[C:\Program Files\ESET\ps_dmon.dll] [Eset , 2, 70, 39 ]
[C:\Program Files\ESET\pr_dmon.dll] [N/A, ]
[C:\Program Files\ESET\ps_emon.dll] [Eset , 2, 70, 39 ]
[C:\Program Files\ESET\pr_emon.dll] [N/A, ]
[C:\WINDOWS\system32\imon.dll] [Eset , 2, 70, 39 ]
[C:\Program Files\ESET\pr_imon.dll] [N/A, ]
[C:\Program Files\ESET\ps_nod32.dll] [Eset , 2, 70, 39 ]
[C:\Program Files\ESET\pr_nod32.dll] [Eset , 2, 70, 39 ]
[C:\Program Files\ESET\ps_upd.dll] [Eset , 2, 70, 39 ]
[C:\Program Files\ESET\pr_upd.dll] [N/A, ]
[PID: 1084][C:\Program Files\Kerio\Personal Firewall\persfw.exe] [Kerio Technologies, 2, 1, 5, 0]
[C:\WINDOWS\system32\imon.dll] [Eset , 2, 70, 39 ]
[C:\Program Files\ESET\pr_imon.dll] [N/A, ]
[D:\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
[PID: 864][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)]
[C:\WINDOWS\system32\ieframe.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)]
[D:\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
[C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll] [Sun Microsystems, Inc., 2.03]
[C:\Program Files\OpenOffice.org 2.4\program\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\Program Files\OpenOffice.org 2.4\program\stlport_vc7145.dll] [STLport Consulting, Inc., 4.5.2003.0120]
[C:\Program Files\OpenOffice.org 2.4\program\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\igfxpph.dll] [Intel Corporation, 3.0.0.3865]
[C:\WINDOWS\system32\hccutils.DLL] [Intel Corporation, 3.0.0.3865]
[C:\Program Files\Thunder\ComDlls\XunLeiBHO_007.dll] [Thunder Networking Technologies,LTD, 5, 0, 1, 4]
[C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
[C:\Program Files\Notepad++\nppcm.dll] [Burgaud.com, 1.2.1]
[C:\Program Files\ESET\nodshex.dll] [N/A, ]
[C:\Program Files\Vim\vim64\gvimext.dll] [Tianmiao Hu's Developer Studio, 1, 0, 0, 1]
[C:\Program Files\7-Zip\7-zip.dll] [Igor Pavlov, 4.57]
[PID: 520][C:\WINDOWS\system32\hkcmd.exe] [Intel Corporation, 3.0.0.3865]
[C:\WINDOWS\system32\hccutils.DLL] [Intel Corporation, 3.0.0.3865]
[C:\WINDOWS\system32\igfxdev.dll] [Intel Corporation, 3.0.0.3865]
[C:\WINDOWS\system32\igfxsrvc.dll] [Intel Corporation, 3.0.0.3865]
[C:\WINDOWS\system32\igfxhk.dll] [Intel Corporation, 3.0.0.3865]
[C:\WINDOWS\system32\igfxres.dll] [Intel Corporation, 3.0.0.3865]
[D:\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
[PID: 776][C:\WINDOWS\ATK0100\HControl.exe] [, 1043, 2, 15, 50]
[C:\WINDOWS\ATK0100\CMSSC.dll] [N/A, ]
[C:\WINDOWS\ATK0100\inter_f2.dll] [ATK, 1043, 2, 15, 46]
[C:\WINDOWS\ATK0100\ATKWLIOC.DLL] [ACTIONTEC Electronics,Inc, 2.01.02]
[C:\WINDOWS\ATK0100\SiSPkt.dll] [Silicon Integrated Systems Corp., 1, 0, 0, 45]
[D:\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1864][C:\WINDOWS\SOUNDMAN.EXE] [Realtek Semiconductor Corp., 5.1.0.34]
[PID: 1928][C:\Program Files\ESET\nod32kui.exe] [Eset , 2, 70, 39 ]
[C:\Program Files\ESET\nod32rui.dll] [N/A, ]
[D:\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
[C:\Program Files\ESET\pu_amon.dll] [Eset , 2, 70, 39 ]
[C:\Program Files\ESET\pr_amon.dll] [Eset , 2, 70, 39 ]
[C:\Program Files\ESET\pu_dmon.dll] [Eset , 2, 70, 39 ]
[C:\Program Files\ESET\pr_dmon.dll] [N/A, ]
[C:\Program Files\ESET\pu_emon.dll] [Eset , 2, 70, 39 ]
[C:\Program Files\ESET\pr_emon.dll] [N/A, ]
[C:\Program Files\ESET\pu_imon.dll] [Eset , 2, 70, 39 ]
[C:\Program Files\ESET\pr_imon.dll] [N/A, ]
[C:\Program Files\ESET\pu_nod32.dll] [Eset , 2, 70, 39 ]
[C:\Program Files\ESET\pr_nod32.dll] [Eset , 2, 70, 39 ]
[C:\Program Files\ESET\pu_upd.dll] [Eset , 2, 70, 39 ]
[C:\Program Files\ESET\pr_upd.dll] [N/A, ]
[PID: 1904][D:\360safe\safemon\360tray.exe] [奇虎网, 4, 1, 8, 1002]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[D:\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
[D:\360safe\safemon\SafeKrnl.dll] [奇虎网, 4, 1, 8, 1001]
[D:\360safe\AntiAdwa.dll] [360Safe.com, 4, 1, 5, 1001]
[D:\360safe\live.dll] [360.cn, 1, 0, 1, 1027]
[C:\WINDOWS\system32\imon.dll] [Eset , 2, 70, 39 ]
[C:\Program Files\ESET\pr_imon.dll] [N/A, ]
[PID: 172][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2105)]
[D:\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
[PID: 1028][C:\WINDOWS\ATK0100\ATKOSD.exe] [, 1043, 2, 15, 49]
[D:\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
[PID: 1164][C:\Program Files\TheWorld 2.0\TheWorld.exe] [Phoenix Studio, 2, 1, 2, 4]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)]
[D:\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
[C:\WINDOWS\system32\ieframe.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)]
[C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL] [Microsoft Corporation, 11.0.5510]
[C:\WINDOWS\system32\imon.dll] [Eset , 2, 70, 39 ]
[C:\Program Files\ESET\pr_imon.dll] [N/A, ]
[C:\WINDOWS\system32\SOGOUPY.IME] [Sohu.com Inc., 2, 0, 0, 1]
[C:\WINDOWS\system32\dllMergeDict.dll] [N/A, ]
[C:\Program Files\SogouInput\Plugin\SgImeWord.dll] [, 1, 0, 0, 31]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\Internet Explorer\ieproxy.dll] [Microsoft Corporation, 7.00.5730.13 (longhorn(wmbla).070711-1130)]
[C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx] [Adobe Systems, Inc., 9,0,124,0]
[C:\WINDOWS\system32\mscoree.dll] [Microsoft Corporation, 2.0.50727.42 (RTM.050727-4200)]
[C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorie.dll] [Microsoft Corporation, 2.0.50727.42 (RTM.050727-4200)]
[PID: 1396][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2105)]
[D:\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
[PID: 1240][C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE] [Microsoft Corporation, 11.0.8202]
[C:\Program Files\Common Files\Microsoft Shared\office11\mso.dll] [Microsoft Corporation, 11.0.6568]
[D:\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
[C:\Program Files\Common Files\Microsoft Shared\office11\riched20.dll] [Microsoft Corporation, 5.50.99.2010]
[C:\WINDOWS\system32\SOGOUPY.IME] [Sohu.com Inc., 2, 0, 0, 1]
[C:\WINDOWS\system32\dllMergeDict.dll] [N/A, ]
[C:\Program Files\SogouInput\Plugin\SgImeWord.dll] [, 1, 0, 0, 31]
[C:\Program Files\Microsoft Office\OFFICE11\msostyle.dll] [Microsoft Corporation, 11.0.5510]
[C:\Program Files\Microsoft Office\OFFICE11\GdiPlus.DLL] [Microsoft Corporation, 6.0.3275.0]
[C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\INTLNAME.DLL] [Microsoft Corporation, 11.0.6467]
[C:\Program Files\Common Files\Microsoft Shared\PROOF\mslid.dll] [Microsoft Corporation, 1.0.2305]
[C:\Program Files\Common Files\Microsoft Shared\Smart Tag\CHDATEST.DLL] [Microsoft Corporation, 2.00]
[C:\WINDOWS\system32\MSVBVM60.DLL] [Microsoft Corporation, 6.00.9802]
[C:\Program Files\Common Files\Microsoft Shared\Smart Tag\Chinese Measurement Converter\CHMETCNV.DLL] [Microsoft Corp., 1.00]
[C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL] [Microsoft Corporation, 11.0.5510]
[C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\2052\stintl.dll] [Microsoft Corporation, 11.0.5510]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\ZSDNT5UI.DLL] [Zenographics, Inc., 0, 3, 2911, 1]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\ZSDDM.DLL] [Zenographics, Inc., 6, 20, 1611, 0]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\ZSPOOL.dll] [Zenographics, Inc., 6, 1, 1, 0]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\ZGDI.dll] [Zenographics, Inc., 5, 60, 709, 0]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\ZTAG.dll] [Zenographics, Inc., 5, 60, 1210, 0]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\ZSDDMUI.DLL] [Zenographics, Inc., 6, 2, 411, 0]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\ZSR.dll] [Zenographics, Inc., 6, 20, 1625, 0]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\ZIMFDRV.DLL] [Zenographics, Inc., 0, 3, 5209, 0]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\ZIMF.dll] [Zenographics, Inc., 5, 70, 616, 0]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)]
[PID: 1232][C:\Program Files\WinRAR\WinRAR.exe] [N/A, ]
[D:\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
[C:\WINDOWS\system32\Audiodev.dll] [Microsoft Corporation, 5.2.3802.3802 built by: dnsrv(bld4act)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\ieframe.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)]
[PID: 1348][C:\DOCUME~1\why\LOCALS~1\Temp\Rar$EX00.813\sreng2\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)]
[D:\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
[C:\DOCUME~1\why\LOCALS~1\Temp\Rar$EX00.813\sreng2\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]
[C:\DOCUME~1\why\LOCALS~1\Temp\Rar$EX00.813\sreng2\Plugins\NTFSTREAM.SRE] [Smallfrogs Studio, 1, 0, 0, 5]
==================================
文件关联
.TXT Error. [C:\WINDOWS\notepad.exe %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM Error. ["hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
NOD32 protected [MSAFD Tcpip [TCP/IP]]
C:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning support)
NOD32 protected [MSAFD Tcpip [UDP/IP]]
C:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning support)
NOD32 protected [MSAFD Tcpip [RAW/IP]]
C:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning support)
NOD32 protected [RSVP UDP Service Provider]
C:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning support)
NOD32 protected [RSVP TCP Service Provider]
C:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning support)
NOD32
C:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning support)
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1 localhost
==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 1164, C:\PROGRAM FILES\THEWORLD 2.0\THEWORLD.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1232, C:\PROGRAM FILES\WINRAR\WINRAR.EXE]
==================================
API HOOK
N/A
==================================
隐藏进程
N/A
==================================
