启动项目
注册表
<UnlockerAssistant><; "D:\Unlocker\UnlockerAssistant.exe" -H> []
没有版本信息，没有公司名
==================================
服务
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\SYSTEM32\W32TIME.DLL><Microsoft Corporation>
[WP9Service / WebPlayer9][Running/Auto Start]
<D:\nh\WEBPLA~1\WP9Service.exe><WebPlayer9.com>
==================================
驱动程序
[npkycryp / npkycryp][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\npkycryp.sys><N/A>
[SafeBoxKrnl / SafeBoxKrnl][Running/System Start]
<\??\C:\WINDOWS\system32\drivers\SafeBoxKrnl.sys><360安全中心>
==================================
浏览器加载项
[]
{6AD31948-2ED9-4A2B-85EA-105DD4F656B4} <, >
[]
{33564D57-9980-0010-8000-00AA00389B71} <, >
[]
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <, >
[]
{D18A0B52-D63C-4ED0-AFC6-C1E3DC1AF43A} <, >
==================================
正在运行的进程
[PID: 1728 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-0852)]
[D:\iSpeak6.5\ComUDPPing.dll] [N/A, ]
[D:\iSpeak6.5\CComLib.dll] [N/A, ]
[D:\iSpeak6.5\RSRoomCs.dll] [N/A, ]
[D:\iSpeak6.5\D3DTest.dll] [N/A, ]
[D:\iSpeak6.5\D3D8Test.dll] [, 1, 0, 0, 1]
[PID: 3472 / s][D:\iSpeak6.5\TipWnd.exe] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 5, 0, 0, 1007]
[PID: 3588 / s][D:\QQHX\QQhxgame.exe] [, 1, 3, 9, 6]
[D:\QQHX\WndSys.dll] [Szdomain, 1, 8, 0, 2]
[D:\QQHX\ijl15.dll] [Intel Corporation, 1,5,4,36]
[D:\QQHX\iigw_client_api.dll] [N/A, ]
[D:\QQHX\avcodec.dll] [N/A, ]
[D:\QQHX\avutil.dll] [N/A, ]
[D:\QQHX\avformat.dll] [N/A, ]
[D:\QQHX\Lua51.dll] [N/A, ]
[PID: 2812 / s][C:\Program Files\TTPlayer\TTPlayer.exe] [Alen Soft, 5, 1, 0, 0]
[C:\Program Files\TTPlayer\ttpcomm.dll] [N/A, ]
[C:\Program Files\TTPlayer\AddIn\ttp_asf.dll] [N/A, ]
[C:\Program Files\TTPlayer\AddIn\ttp_aac.dll] [N/A, ]
[C:\Program Files\TTPlayer\AddIn\ttp_ac3dts.dll] [N/A, ]
==================================
文件关联
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
HOSTS 文件
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 3680, D:\ISPEAK6.5\ISPEAK.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3472, D:\ISPEAK6.5\TIPWND.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 3588, D:\QQHX\QQHXGAME.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3588, D:\QQHX\QQHXGAME.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2812, C:\PROGRAM FILES\TTPLAYER\TTPLAYER.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3576, C:\DOCUMENTS AND SETTINGS\S\桌面\SRENGLDR.EXE]
