启动项目
注册表
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{56BC86C7-0692-4F94-A2C1-6CF1DBF8096C}><C:\WINDOWS\system32\56BC86C7.dll> []
<{6B74576A-BB20-47B3-AE0A-046B062897D0}><C:\WINDOWS\system32\ACg9ycsarj8y.dll> []
<{E88AE11C-26DF-4F4D-8726-C043F513990E}><C:\WINDOWS\system32\yp77Tt3UCG74J.dll> []
<{A23CA53C-731F-4033-92E8-C1DFB4E71D34}><C:\WINDOWS\system32\JBn2ypqY23vWX.dll> []
<{704C3595-DB85-40F6-A601-8D6F346907BD}><C:\WINDOWS\system32\704C3595.dll> []
<{08223B03-1B38-4A33-A83A-A4D3CC1D6E4E}><C:\WINDOWS\system32\08223B03.dll> []
<{0D267113-499A-4EEF-998D-C45731C1B313}><C:\WINDOWS\system32\VnTU2WAqUcZA6.dll> []
<{CCCA2FB9-2D5D-4481-8BFE-1CDDC458A3F4}><C:\WINDOWS\system32\CCCA2FB9.dll> []
<{028A997C-4262-4107-BD46-2ABBC6143E8C}><C:\WINDOWS\system32\efc0c52cc1.dll> []
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [File is missing]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [File is missing]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [File is missing]
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [File is missing]
<PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [File is missing]
<PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [File is missing]
服务
[KVSrvXP / KVSrvXP][Stopped/Auto Start]
<C:\Program Files\JiangMin\AntiVirus\kvsrvxp.exe /Service><(File is missing)>
==================================
驱动程序
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[AmdK8 Compatible Device / AmdK8][Stopped/Manual Start]
<System32\drivers\amdk8.sys><Advanced Micro Devices>
[CSB6IDE / CSB6IDE][Running/Boot Start]
<\SystemRoot\System32\Drivers\csb6ide.sys><ServerWorks Corporation>
[FASTTRAK / FASTTRAK][Running/Boot Start]
<\SystemRoot\System32\Drivers\fasttrak.sys><Promise Technology, Inc.>
[VIA Rhine Family Fast Ethernet Adapter Driver Service / FETNDISB][Stopped/Manual Start]
<system32\DRIVERS\fetnd5b.sys><VIA Technologies, Inc.>
[FTSATA2 / FTSATA2][Running/Boot Start]
<\SystemRoot\System32\Drivers\ftsata2.sys><Promise Technology, Inc.>
[IASTOR / IASTOR][Running/Boot Start]
<\SystemRoot\System32\Drivers\iaStor.sys><Intel Corporation>
[ITERAID / ITERAID][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\iteraid.sys><Integrated Technology Express, Inc.>
[JRAID / JRAID][Running/Boot Start]
<\SystemRoot\System32\Drivers\JRAID.SYS><JMicron Technology Corp.>
[KAnalyser / KAnalyser][Stopped/System Start]
<\??\C:\PROGRA~1\JiangMin\ANTIVI~1\KANALY~1.SYS><Jiangmin Co.,Ltd.>
[KPGuard / KPGuard][Running/System Start]
<\??\C:\PROGRA~1\JiangMin\ANTIVI~1\KPGuard.sys><Jiangmin Co., Ltd.>
[KRegEx / KRegEx][Running/System Start]
<\??\C:\PROGRA~1\JiangMin\ANTIVI~1\KRegEx.sys><Jiangmin Co. Ltd.>
[Jiangmin Antivirus Software / KSysCall][Running/System Start]
<\??\C:\PROGRA~1\JiangMin\common\KSysCall.sys><Jiangmin Co., Ltd.>
[KSysFilter / KSysFilter][Running/Boot Start]
<\SystemRoot\System32\Drivers\KSysFilt.sys><Jiangmin Co. Ltd.>
[KSysMon / KSysMon][Running/System Start]
<\??\C:\PROGRA~1\JiangMin\ANTIVI~1\KSysMon.sys><Jiangmin Co. Ltd.>
[KVDP / KVDP][Stopped/Manual Start]
<\??\C:\Program Files\JiangMin\AntiVirus\KVDP.sys><Jiangmin Co., Ltd.>
[KVRedir / KVRedir][Running/System Start]
<\??\C:\Program Files\JiangMin\AntiVirus\KVREDIR.SYS><Jiangmin Co., Ltd.>
[M5228 / M5228][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\m5228.sys><ALi Corporation.>
[M5281 / M5281][Running/Boot Start]
<\SystemRoot\System32\Drivers\m5281.sys><ALi Corporation>
[M5289 / M5289][Running/Boot Start]
<\SystemRoot\System32\Drivers\m5289.sys><ULi Electronics Inc.>
[npkcrypt / npkcrypt][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\npkcrypt.sys><INCA Internet Co., Ltd.>
[nv / nv][Running/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[NVATABUS / NVATABUS][Running/Boot Start]
<\SystemRoot\System32\Drivers\NVATABUS.SYS><NVIDIA Corporation>
[NVRAID / NVRAID][Running/Boot Start]
<\SystemRoot\System32\Drivers\NVRAID.SYS><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek 10/100/1000 PCI NIC Family NDIS XP Driver / RTL8023xp][Running/Manual Start]
<system32\DRIVERS\Rtnicxp.sys><Realtek Semiconductor Corporation>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[SafeBoxKrnl / SafeBoxKrnl][Running/System Start]
<\??\C:\WINDOWS\system32\Drivers\safeboxkrnl.sys><360安全中心>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
[SI3112R / SI3112R][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\SI3112r.sys><Silicon Image, Inc>
[SI3114R / SI3114R][Stopped/Boot Start]
<\SystemRoot\SYSTEM32\Drivers\SI3114R.sys><Silicon Image, Inc>
[SI3114R5 / SI3114R5][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\Si3114r5.sys><Silicon Image, Inc>
[SI3124 / SI3124][Stopped/Boot Start]
<\SystemRoot\SYSTEM32\Drivers\SI3124.sys><Silicon Image, Inc.>
[SI3124R / SI3124R][Stopped/Boot Start]
<\SystemRoot\SYSTEM32\Drivers\SI3124R.sys><Silicon Image, Inc>
[SI3124R5 / SI3124R5][Stopped/Boot Start]
<\SystemRoot\SYSTEM32\Drivers\Si3124r5.sys><Silicon Image, Inc>
[SI3132 / SI3132][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\SI3132.sys><Silicon Image, Inc.>
[SI3132R5 / SI3132R5][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\Si3132r5.sys><Silicon Image, Inc>
[SISRAID2 / SISRAID2][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\SiSRaid2.sys><Silicon Integrated Systems Corp>
[SISRAID4 / SISRAID4][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\SiSRaid4.sys><Silicon Integrated Systems>
[SYMMPI / SYMMPI][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\symmpi.sys><LSI Logic>
[sym_hi / sym_hi][Running/Boot Start]
<\SystemRoot\System32\Drivers\sym_hi.sys><LSI Logic>
[sym_u3 / sym_u3][Running/Boot Start]
<\SystemRoot\System32\Drivers\sym_u3.sys><LSI Logic>
[TCP/IP Protocol Driver / Tcpip][Running/System Start]
<system32\DRIVERS\tcpip.sys><Microsoft Corporation>
[ULSATA / ULSATA][Running/Boot Start]
<\SystemRoot\System32\Drivers\ulsata.sys><Promise Technology, Inc.>
[ULSATA2 / ULSATA2][Running/Boot Start]
<\SystemRoot\System32\Drivers\ulsata2.sys><Promise Technology, Inc.>
[VIAMRAID / VIAMRAID][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\viamraid.sys><VIA Technologies inc,.ltd>
[VMware Pointing Device / vmmouse][Running/Manual Start]
<system32\DRIVERS\vmmouse.sys><VMware, Inc.>
[vmscsi / vmscsi][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\vmscsi.sys><VMware, Inc.>
==================================
浏览器加载项
>
[]
{06A70D58-8D40-49DD-B46B-DC00AA3ADCA4} <, >
[]
{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <, >
[]
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} <, >
[]
{8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} <, >
[]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <, >
[]
{FB5F1910-F110-11D2-BB9E-00C04F795683} <, >没有公司信息 没有加载项名称 感觉还是存在问题
==================================
正在运行的进程
[
[PID: 588 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\COMRes.dll] [N/A, ]
[C:\WINDOWS\fonts\GTH01535.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH02535.TTf] [N/A, ]
[E:\迅雷\Thunder\Program\TaskManager.dll] [Thunder Networking Technologies,LTD, 1, 3, 9, 71]
[E:\迅雷\Thunder\Program\download_interface.dll] [Thunder Networking Technologies,LTD, 3, 100, 2, 322]
[E:\迅雷\Thunder\Program\mp.dll] [Thunder Networking Technologies,LTD, 1, 0, 2, 2]
[E:\迅雷\Thunder\Program\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[E:\迅雷\Thunder\Program\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[E:\迅雷\Thunder\Program\asyn_frame.dll] [Thunder Networking Technologies,LTD, 1, 2, 2, 25]
[E:\迅雷\Thunder\Program\ATL71.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\fonts\GTH01535.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH02535.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH12541.TTF] [N/A, ]
[C:\WINDOWS\fonts\GTH19535.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH26535.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH30541.TTF] [N/A, ]
[C:\WINDOWS\fonts\GTH33541.TTF] [N/A, ]
[C:\WINDOWS\fonts\GTH36526.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH39541.TTF] [N/A, ]
[C:\WINDOWS\fonts\GTH61386.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH63380.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH64380.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH67380.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH72386.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH78380.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH90373.ttf] [N/A, ]
[E:\迅雷\Thunder\Program\fs.dll] [Thunder Networking Technologies,LTD, 1, 1, 2, 12]
[E:\迅雷\Thunder\Program\XLNet.Dll] [Thunder Networking Technologies,LTD, 1, 5, 2, 25]
[E:\迅雷\Thunder\Program\BHOStub.dll] [Thunder Networking Technologies,LTD, 1, 1, 1, 10]
[E:\迅雷\Thunder\Components\DownAndPlay\DownAndPlay.dll] [, 1, 0, 12, 30]
[E:\迅雷\Thunder\Program\backend_agent.dll] [Thunder Networking Technologies,LTD, 1, 2, 2, 24]
[E:\迅雷\Thunder\Program\zlib1.dll] [, 1.2.3]
[C:\WINDOWS\system32\efc0c52cc1.dll] [N/A, ]
[C:\WINDOWS\system32\CCCA2FB9.dll] [N/A, ]
[C:\WINDOWS\system32\08223B03.dll] [N/A, ]
[C:\WINDOWS\system32\704C3595.dll] [N/A, ]
[C:\WINDOWS\system32\JBn2ypqY23vWX.dll] [N/A, ]
[C:\WINDOWS\system32\yp77Tt3UCG74J.dll] [N/A, ]
[C:\WINDOWS\system32\56BC86C7.dll] [N/A, ]
[C:\WINDOWS\system32\ACg9ycsarj8y.dll] [N/A, ]
[PID: 2340 / Administrator][I:\安装包\SREng\SREngLdr.EXE] [Smallfrogs Studio, 2.7.1.1261]
[PID: 3520 / Administrator][I:\安装包\SREng\SRE46903132.EXE] [Smallfrogs Studio, 2.7.1.1261]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\COMRes.dll] [N/A, ]
[C:\WINDOWS\system32\efc0c52cc1.dll] [N/A, ]
[C:\WINDOWS\system32\CCCA2FB9.dll] [N/A, ]
[C:\WINDOWS\system32\08223B03.dll] [N/A, ]
[C:\WINDOWS\system32\704C3595.dll] [N/A, ]
[C:\WINDOWS\system32\JBn2ypqY23vWX.dll] [N/A, ]
[C:\WINDOWS\system32\yp77Tt3UCG74J.dll] [N/A, ]
[C:\WINDOWS\system32\56BC86C7.dll] [N/A, ]
[C:\WINDOWS\system32\ACg9ycsarj8y.dll] [N/A, ]
[C:\WINDOWS\fonts\GTH01535.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH02535.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH12541.TTF] [N/A, ]
[C:\WINDOWS\fonts\GTH19535.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH26535.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH30541.TTF] [N/A, ]
[C:\WINDOWS\fonts\GTH33541.TTF] [N/A, ]
[C:\WINDOWS\fonts\GTH36526.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH39541.TTF] [N/A, ]
[C:\WINDOWS\fonts\GTH61386.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH63380.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH64380.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH67380.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH72386.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH78380.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH90373.ttf] [N/A, ]
进程特权扫描
特殊特权被允许： SeDebugPrivilege [PID = 2340, I:\安装包\SRENG\SRENGLDR.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2340, I:\安装包\SRENG\SRENGLDR.EXE]
