Sreng 日志，高手请分析谢谢了 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛 Sreng 日志，高手请分析谢谢了

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第四十七次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

1

1 / 1 页

跳转页

[求助] Sreng 日志，高手请分析谢谢了

00000000065645 初生襁褓狮帖子:5 注册: 2010-06-16 来自:	发表于： 2010-06-16 23:53 \| 只看楼主短消息资料字号：小中大 1楼 Sreng 日志，高手请分析谢谢了 [code]2010-06-16,23:39:44 System Repair Engineer 2.8.2.1321 Smallfrogs (http://www.KZTechs.com) Windows XP Professional Service Pack 3 (Build 2600) - 管理权限用户 - 完整功能以下内容被选中：所有的启动项目（包括注册表、启动文件夹、服务等）浏览器加载项正在运行的进程（包括进程模块信息）文件关联 Winsock 提供者 Autorun.inf HOSTS 文件进程特权扫描计划任务 Windows 安全更新检查 API HOOK 隐藏进程启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [(Verified)Microsoft Windows Hardware Compatibility Publisher] <nwiz><nwiz.exe /installquiet /keeploaded /nodetect> [(Verified)NVIDIA Corporation] <NvMediaCenter><RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit> [(Verified)Microsoft Windows Hardware Compatibility Publisher] <LCONTROL><"C:\Program Files\Lenovo\ATK Hotkey\LCONTROL.exe"> [ATK0101] <LFKA><"C:\Program Files\Lenovo\ATK Hotkey\LFKA.exe"> [Lenovo] <360Safetray><"D:\Program Files\360\360Safe\safemon\360Tray.exe" /start> [(Verified)Qizhi Software (beijing) Co. Ltd] <RavTray><"C:\Program Files\Rising\Rav\RsTray.exe" -system> [(Verified)Beijing Rising Information Technology Corporation Limited] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] <KB923561><rundll32.exe apphelp.dll,ShimFlushCache> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [(Verified)Microsoft Windows Component Publisher] <Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Component Publisher] <UIHost><logonui.exe> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{AEB6717E-7E19-11d0-97EE-00C04FD91972}><shell32.dll> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] <PostBootReminder><%SystemRoot%\system32\SHELL32.dll> [(Verified)Microsoft Windows Component Publisher] <CDBurn><%SystemRoot%\system32\SHELL32.dll> [(Verified)Microsoft Windows Component Publisher] <WebCheck><%SystemRoot%\system32\webcheck.dll> [(Verified)Microsoft Windows Component Publisher] <SysTray><C:\WINDOWS\system32\stobject.dll> [(Verified)Microsoft Windows Component Publisher] <WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] <WinlogonNotify: crypt32chain><crypt32.dll> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] <WinlogonNotify: cryptnet><cryptnet.dll> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] <WinlogonNotify: cscdll><cscdll.dll> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dimsntfy] <WinlogonNotify: dimsntfy><%SystemRoot%\System32\dimsntfy.dll> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] <WinlogonNotify: ScCertProp><wlnotify.dll> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] <WinlogonNotify: Schedule><wlnotify.dll> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] <WinlogonNotify: sclgntfy><sclgntfy.dll> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] <WinlogonNotify: SensLogn><WlNotify.dll> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] <WinlogonNotify: termsrv><wlnotify.dll> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tphotkey] <WinlogonNotify: tphotkey><C:\Program Files\Lenovo\HOTKEY\tphklock.dll> [(Verified)Lenovo(Japan)Ltd.] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] <WinlogonNotify: wlballoon><wlnotify.dll> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] <{438755C2-A8BA-11D1-B96B-00A0C90312E1}><%SystemRoot%\system32\browseui.dll> [(Verified)Microsoft Windows Component Publisher] <{8C7461EF-2B13-11d2-BE35-3078302C2030}><%SystemRoot%\system32\browseui.dll> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] <Microsoft Windows Media Player><C:\WINDOWS\inf\unregmp2.exe /ShowWMP> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}] <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] <浏览器自定义组件><RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}] <Windows 桌面更新><regsvr32.exe /s /n /i:U shell32.dll> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}] <Internet Explorer 6><%SystemRoot%\system32\ie4uinit.exe> [(Verified)Microsoft Windows Component Publisher] [HKEY_CURRENT_USER\Control Panel\Desktop] <SCRNSAVE.EXE><C:\WINDOWS\System32\logon.scr> [(Verified)Microsoft Windows Component Publisher] ================================== 启动文件夹 N/A ================================== 服务 [Atheros Configuration Service / acs][Running/Auto Start] <C:\WINDOWS\system32\acs.exe><Atheros> [ATKGFNEX Service / ATKGFNEXSrv][Running/Auto Start] <C:\Program Files\Lenovo\ATK Hotkey\GFNEXSrv.exe><> [Help and Support / helpsvc][Running/Manual Start] <2 - 系统找不到指定的文件。 ><(File is missing)> [ThinkPad PM Service for SL Series / IBMPMSVC][Running/Auto Start] <C:\WINDOWS\system32\ibmpmsvc.exe><Lenovo> [Service of LFKA / LFKAS][Running/Auto Start] <C:\Program Files\Lenovo\ATK Hotkey\LFKAS.exe><> [NVIDIA Display Driver Service / NVSvc][Running/Auto Start] <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation> [Rav Service / RsRavMon][Running/Auto Start] <"C:\Program Files\Rising\Rav\RavMonD.exe"><Beijing Rising Information Technology Co., Ltd.> ================================== 驱动程序 [360SelfProtection / 360SelfProtection][Running/System Start] <system32\drivers\360SelfProtection.sys><360安全中心> [Atheros Wireless Network Adapter Service / AR5211][Stopped/Manual Start] <system32\DRIVERS\ar5211.sys><Atheros Communications, Inc.> [ASMMAP / ASMMAP][Running/Auto Start] <\??\C:\Program Files\Lenovo\ATK Hotkey\ASMMAP.sys><> [BAPIDRV / BAPIDRV][Running/System Start] <\??\C:\WINDOWS\system32\drivers\BAPIDRV.SYS><360.cn> [Conexant UAA Function Driver for High Definition Audio Service / CnxtHdAudService][Running/Manual Start] <system32\drivers\CHDAU32.sys><Conexant Systems Inc.> [EfiSystemMon / EfiMon][Running/System Start] <System32\Drivers\Efimon.sys><奇虎网> [Microsoft 用于 High Definition Audio 的 UAA 总线驱动程序 / HDAudBus][Running/Manual Start] <system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider> [hookcont / hookcont][Running/System Start] <system32\drivers\HookCont.sys><Beijing Rising Information Technology Co., Ltd.> [HookPort / HookPort][Running/Boot Start] <\SystemRoot\System32\Drivers\Hookport.sys><360安全中心> [hooksys / hooksys][Running/System Start] <system32\drivers\HookSys.sys><Beijing Rising Information Technology Co., Ltd.> [HSFHWAZL / HSFHWAZL][Running/Manual Start] <system32\DRIVERS\HSFHWAZL.sys><Conexant Systems, Inc.> [HSF_DPV / HSF_DPV][Running/Manual Start] <system32\DRIVERS\HSF_DPV.sys><Conexant Systems, Inc.> [Intel AHCI Controller / iaStor][Running/Boot Start] <\SystemRoot\system32\DRIVERS\iaStor.sys><Intel Corporation> [IBMPMDRV / IBMPMDRV][Running/Manual Start] <system32\DRIVERS\ibmpmdrv.sys><Lenovo.> [mdmxsdk / mdmxsdk][Running/Auto Start] <system32\DRIVERS\mdmxsdk.sys><Conexant> [ATK0101 ACPI UTILITY / MTsensor][Running/Manual Start] <system32\DRIVERS\A0101X32.sys><> [nv / nv][Running/Manual Start] <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation> [Service for NVIDIA High Definition Audio Driver / NVHDA][Running/Manual Start] <system32\drivers\nvhda32.sys><NVIDIA Corporation> [Direct Parallel Link Driver / Ptilink][Running/Manual Start] <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.> [Quantum DeepScanner Servers / quxxxserv][Running/System Start] <\??\C:\WINDOWS\system32\drivers\quxxxrv.sys><360安全中心> [qutmipc / qutmipc][Running/System Start] <\??\C:\WINDOWS\system32\drivers\qutmipc.sys><360安全中心> [rimmptsk / rimmptsk][Running/Auto Start] <system32\DRIVERS\rimmptsk.sys><REDC> [rimsptsk / rimsptsk][Running/Auto Start] <system32\DRIVERS\rimsptsk.sys><REDC> [Ricoh xD-Picture Card Driver / rismxdp][Running/Auto Start] <system32\DRIVERS\rixdptsk.sys><REDC> [rsassist / rsassist][Running/Auto Start] <system32\drivers\rsassist.sys><Beijing Rising Information Technology Co., Ltd.> [RsNTGDI / RsNTGDI][Running/Boot Start] <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Information Technology Co., Ltd.> [Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver / RTLE8023xp][Running/Manual Start] <system32\DRIVERS\Rtenicxp.sys><Realtek Semiconductor Corporation> [Secdrv / Secdrv][Stopped/Manual Start] <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.> [Synaptics TouchPad Driver / SynTP][Running/Manual Start] <system32\DRIVERS\SynTP.sys><Synaptics, Inc.> [TCP/IP Protocol Driver / Tcpip][Running/System Start] <system32\DRIVERS\tcpip.sys><Microsoft Corporation> [TPHKDRV / TPHKDRV][Running/System Start] <system32\DRIVERS\TPHKDRV.sys><Lenovo Group Limited> [winachsf / winachsf][Running/Manual Start] <system32\DRIVERS\HSF_CNXT.sys><Conexant Systems, Inc.> [wsimd Service / WSIMD][Running/Manual Start] <system32\DRIVERS\wsimd.sys><Atheros Communications, Inc.> [KAVBootC / KAVBootC][Stopped/Boot Start] <\SystemRoot\system32\Drivers\KAVBootC.sys><Kingsoft Corporation> [360netmon / 360netmon][Running/System Start] <\??\C:\WINDOWS\system32\drivers\360netmon.sys><360.cn> ================================== 用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; http://bsalsa.com) ; 360SE)
00000000065645 初生襁褓狮帖子:5 注册: 2010-06-16 来自:	分享到：

00000000065645 初生襁褓狮帖子:5 注册: 2010-06-16 来自:	发表于： 2010-06-16 23:53 \| 只看楼主短消息资料字号：小中大 2楼回复：Sreng 日志，高手请分析谢谢了浏览器加载项 [ThunderAtOnce Class] {01443AEC-0FD1-40fd-9C87-E93D1494C233} <C:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll, (Signed) Thunder Networking Technologies,LTD> [Thunder Browser Helper] {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll, (Signed) Thunder Networking Technologies,LTD> [] {e2e2dd38-d088-4134-82b7-f2ba38496583} <%windir%\Network Diagnostic\xpnetdiag.exe, (Signed) N/A> [ThunderAtOnce Class] {01443AEC-0FD1-40FD-9C87-E93D1494C233} <C:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll, (Signed) Thunder Networking Technologies,LTD> [Thunder Agent Class] {485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <C:\Program Files\Thunder\ComDlls\ThunderAgent_Now.dll, (Signed) Thunder Networking Technologies,LTD> [KLeakScan Class] {4BB7444F-E4DA-4E02-AAAD-505A0E9855D4} <C:\Program Files\KOS\KosClean.dll, (Signed) Kingsoft Corporation> [AtmX Class] {4CEEAF57-0208-4CA4-A473-914C2D2FFC23} <D:\李国强\trademanager\AliIMX.dll, (Signed) Alibaba software (Shanghai) Corporation.> [WangWangX Class] {5D09DD40-CDC4-4C56-B615-0D1E3B357C2B} <D:\李国强\trademanager\AliIMX.dll, (Signed) Alibaba software (Shanghai) Corporation.> [XMP Class] {6483F145-A768-4C41-AACC-52D4D7845851} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xplayer.dll_1_work, > [XDRM] {693571CB-54A3-4E90-9D52-EEAE1334E2D3} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xdrm.dll_1_work, > [360SafeLive] {87515F61-A66C-4319-A0E0-D416CB8059E3} <D:\Program Files\360\360Safe\Safelive.dll, (Signed) 360.cn> [Thunder Browser Helper] {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll, (Signed) Thunder Networking Technologies,LTD> [DapCtrl Class] {ACACC6EB-1FBA-4E13-A729-53AEB2DF54F8} <C:\Program Files\Common Files\Thunder Network\KanKan\DapCtrl.2.1.5803.60.(977).dll, ShenZhen Thunder Networking Technologies Ltd.> [KScanSpyWare Class] {C847FDE7-B612-47ED-B32C-4000C9DD26B6} <C:\Program Files\KOS\KosClean.dll, (Signed) Kingsoft Corporation> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, (Signed) Adobe Systems, Inc.> [KUpdateObj2 Class] {D82303B7-A754-4DCB-8AFC-8CF99435AACE} <C:\Program Files\KOS\UpdateOcx2.dll, (Signed) Kingsoft Corporation> [KVirusScan Class] {E176B817-4905-4CDF-8C9C-0AF3EA3B4AC7} <C:\Program Files\KOS\KosClean.dll, (Signed) Kingsoft Corporation> [KAccountManager Class] {E176B817-4905-4CDF-8C9C-0AF3EA3B4AC9} <C:\Program Files\KOS\KosClean.dll, (Signed) Kingsoft Corporation> [] {E2E2DD38-D088-4134-82B7-F2BA38496583} <, > [Thunder DapPlayer] {EEDD6FF9-13DE-496B-9A1C-D78B3215E266} <C:\Program Files\Thunder\Components\DownAndPlay\DapPlayer3.0.5712.71.977.dll, ShenZhen Thunder Networking Technologies Ltd.> [XPPlayer Class] {F3E70CEA-956E-49CC-B444-73AFE593AD7F} <C:\Program Files\Common Files\Thunder Network\KanKan\PPlayer.2.0.0.177.(977).dll, Thunder> [使用迅雷下载] <C:\Program Files\Thunder\Program\geturl.htm, N/A> [使用迅雷下载全部链接] <C:\Program Files\Thunder\Program\getallurl.htm, N/A> ================================== 正在运行的进程 [PID: 880 / SYSTEM][\SystemRoot\System32\smss.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)] [PID: 956 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)] [PID: 984 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2113)] [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [C:\Program Files\Lenovo\HOTKEY\tphklock.dll] [Lenovo Group Limited, 1.04] [PID: 1028 / SYSTEM][C:\WINDOWS\system32\services.exe] [(Verified) Microsoft Corporation, 5.1.2600.5755 (xpsp_sp3_gdr.090206-1234)] [PID: 1040 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2113)] [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [PID: 1212 / SYSTEM][C:\WINDOWS\system32\ibmpmsvc.exe] [Lenovo, 1.44] [PID: 1252 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)] [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [PID: 1336 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)] [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [PID: 1496 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)] [C:\WINDOWS\System32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [PID: 1568 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)] [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [PID: 1720 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)] [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [PID: 1816 / SYSTEM][C:\Program Files\Lenovo\ATK Hotkey\GFNEXSrv.exe] [, 1, 0, 0, 0] [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [PID: 1844 / SYSTEM][C:\Program Files\Lenovo\ATK Hotkey\LFKAS.exe] [, 1, 0, 0, 1] [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [PID: 1908 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-0852)] [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [PID: 448 / SYSTEM][C:\WINDOWS\system32\acs.exe] [Atheros, 5.2.0.117] [C:\WINDOWS\system32\athcfg20U.dll] [Atheros, 5.2.0.117] [C:\WINDOWS\system32\athcfg20ResU.dll] [Atheros Communications, Inc., 5.2.0.117] [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [C:\WINDOWS\system32\wsfwDS.dll] [Atheros Communications, Inc., 5.2.0.117] [C:\WINDOWS\system32\wsimd.dll] [Atheros Communications, Inc., 5.2.0.117] [C:\WINDOWS\system32\DSA.dll] [Devicescape, 1, 634, 9, 11] [PID: 532 / SYSTEM][C:\WINDOWS\system32\nvsvc32.exe] [NVIDIA Corporation, 6.14.11.7930] [C:\WINDOWS\system32\nvapi.dll] [NVIDIA Corporation, 6.14.11.7930] [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [PID: 1624 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-0852)] [C:\WINDOWS\System32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [PID: 2572 / Administrator][C:\Program Files\Rising\Rav\RsAgent.exe] [Beijing Rising Information Technology Co., Ltd., 21.0.0.19] [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [C:\Program Files\Rising\Rav\ProcComm.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 4] [C:\Program Files\Rising\Rav\comx3.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.37] [C:\Program Files\Rising\Rav\Syslay.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.6] [C:\Program Files\Rising\Rav\ScanPrxy.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.4] [PID: 2824 / Administrator][C:\WINDOWS\msagent\AgentSvr.exe] [(Verified) Microsoft Corporation, 2.00.0.3427] [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [D:\Program Files\360\360Safe\safemon\safemon.dll] [360.cn, 6, 5, 1, 1002] [C:\WINDOWS\system32\nview.dll] [, ] [C:\WINDOWS\system32\NVWRSZHC.DLL] [NVIDIA Corporation, 6.14.10.12081] [C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.19.5 10Apr08] [PID: 3948 / Administrator][C:\WINDOWS\system32\RUNDLL32.EXE] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2105)] [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [C:\WINDOWS\system32\NvMcTray.dll] [NVIDIA Corporation, 6.14.11.7930] [C:\WINDOWS\system32\nvapi.dll] [NVIDIA Corporation, 6.14.11.7930] [C:\WINDOWS\system32\NVRSZHC.DLL] [NVIDIA Corporation, 6.14.11.7930] [PID: 2248 / Administrator][C:\Program Files\Synaptics\SynTP\SynTPLpr.exe] [Synaptics, Inc., 7.5.19.5 10Apr08] [C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.19.5 10Apr08] [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [PID: 916 / Administrator][C:\Program Files\Synaptics\SynTP\SynTPEnh.exe] [Synaptics, Inc., 7.5.19.5 10Apr08] [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [C:\WINDOWS\system32\SynCOM.dll] [Synaptics, Inc., 7.5.19.5 10Apr08] [C:\WINDOWS\system32\SynTPAPI.dll] [Synaptics, Inc., 7.5.19.5 10Apr08] [C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.19.5 10Apr08] [PID: 2976 / Administrator][C:\Program Files\Lenovo\HOTKEY\LVOSDSVC.exe] [Lenovo Group Limited, 1.04] [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.19.5 10Apr08] [C:\Program Files\Lenovo\HOTKEY\hkvolkey.dll] [Lenovo Group Limited, 1.01] [PID: 2952 / Administrator][C:\WINDOWS\system32\rundll32.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2105)] [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [C:\WINDOWS\system32\nview.dll] [, ] [C:\WINDOWS\system32\NVWRSZHC.DLL] [NVIDIA Corporation, 6.14.10.12081] [C:\WINDOWS\system32\nvwddi.dll] [NVIDIA Corporation, 6.14.11.7930] [C:\WINDOWS\system32\nvapi.dll] [NVIDIA Corporation, 6.14.11.7930] [C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.19.5 10Apr08] [C:\WINDOWS\system32\nvshell.dll] [, ] [PID: 3256 / Administrator][C:\Program Files\Lenovo\ATK Hotkey\LCONTROL.exe] [ATK0101, 1043, 2, 31, 90] [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [C:\WINDOWS\system32\nview.dll] [, ] [C:\WINDOWS\system32\NVWRSZHC.DLL] [NVIDIA Corporation, 6.14.10.12081] [C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.19.5 10Apr08] [PID: 3476 / Administrator][C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe] [Lenovo Group Limited, 5.30] [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.19.5 10Apr08] [PID: 3868 / Administrator][C:\Program Files\Lenovo\ATK Hotkey\LFKA.exe] [Lenovo, 1.0.0.8] [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [C:\WINDOWS\system32\nview.dll] [, ] [C:\WINDOWS\system32\NVWRSZHC.DLL] [NVIDIA Corporation, 6.14.10.12081] [C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.19.5 10Apr08] [PID: 4024 / Administrator][C:\Program Files\Lenovo\Zoom\TpScrex.exe] [Lenovo Group Limited, 2.10] [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.19.5 10Apr08] [PID: 3792 / Administrator][D:\Program Files\360\360Safe\safemon\360Tray.exe] [360.CN, 7, 0, 0, 1009] [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [D:\Program Files\360\360Safe\ipc\ipcservice.dll] [360.CN, 6, 5, 2, 1003] [D:\Program Files\360\360Safe\ipc\fileMgr.dll] [360.cn, 6, 5, 2, 1002] [D:\Program Files\360\360Safe\ipc\yhregd.dll] [, 6, 5, 0, 1002] [D:\Program Files\360\360Safe\ipc\appd.dll] [360.cn, 6, 5, 1, 1006] [D:\Program Files\360\360Safe\safemon\360compro.dll] [360安全中心, 6, 2, 0, 1005] [D:\Program Files\360\360Safe\safemon\360webpro.dll] [360.CN, 1, 3, 0, 1031] [D:\Program Files\360\360Safe\safemon\360traylive.dll] [360安全中心, 6, 0, 1, 1013] [D:\Program Files\360\360Safe\safemon\360procmon.dll] [360.CN, 6, 5, 2, 1006] [D:\Program Files\360\360Safe\safemon\SelfProtectAPI2.dll] [360.CN, 1, 1, 0, 1012] [D:\Program Files\360\360Safe\safemon\netmon.tpi] [360.CN, 1, 0, 2, 1011] [D:\Program Files\360\360Safe\safemon\netm.tpi] [360.cn, 1, 0, 1, 1012] [D:\Program Files\360\360Safe\safemon\360safemonpro.tpi] [360.cn, 1, 1, 2, 1001] [D:\Program Files\360\360Safe\deepscan\qutmload.dll] [360安全中心, 6, 5, 0, 1001] [D:\Program Files\360\360Safe\ipc\qutmipc.dll] [360安全中心, 6, 2, 0, 1007] [D:\Program Files\360\360Safe\SafeLive.dll] [360.cn, 1, 0, 0, 1007] [D:\Program Files\360\360Safe\pdown.dll] [360.cn, 1, 2, 0, 1014] [D:\Program Files\360\360Safe\safemon\safemon.dll] [360.cn, 6, 5, 1, 1002] [D:\Program Files\360\360Safe\safemon\urlproc.dll] [360.cn, 1, 2, 0, 1005] [D:\Program Files\360\360Safe\netmon\360netctrl.dll] [360.CN, 1, 0, 3, 1009] [D:\Program Files\360\360Safe\360ver.dll] [奇虎网, 7, 1, 0, 1010] [D:\Program Files\360\360Safe\ipc\PatchCheck.dll] [360.cn, 1, 0, 0, 1005] [D:\Program Files\360\360Safe\efiproc.dll] [奇虎360安全卫士, 1, 0, 0, 1005] [D:\Program Files\360\360Safe\deepscan\deepscan.dll] [360.cn, 3, 2, 3, 1032] [D:\Program Files\360\360Safe\deepscan\Bapi.dll] [360.cn, 1.0.0.1010] [D:\Program Files\360\360Safe\deepscan\Cloudcom2.dll] [360.cn, 3, 2, 3, 1006] [D:\Program Files\360\360Safe\LiveUpd360.dll] [360.cn, 1, 2, 0, 1033] [D:\Program Files\360\360Safe\360net.dll] [奇虎网, 1, 1, 17, 1020] [D:\Program Files\360\360Safe\360P2SP.dll] [360.cn, 1, 1, 0, 1045] [D:\Program Files\360\360Safe\deepscan\heavygate.dll] [360.cn, 3, 6, 21, 0] [PID: 1400 / Administrator][C:\WINDOWS\system32\CTFMON.EXE] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2105)] [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [C:\WINDOWS\system32\nview.dll] [, ] [C:\WINDOWS\system32\NVWRSZHC.DLL] [NVIDIA Corporation, 6.14.10.12081] [C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.19.5 10Apr08] [PID: 1644 / SYSTEM][C:\Program Files\Rising\Rav\RavMonD.exe] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2] [C:\Program Files\Rising\Rav\combase.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 17] [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [C:\Program Files\Rising\Rav\cnt09.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 5] [C:\Program Files\Rising\Rav\moncomm.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 9] [C:\Program Files\Rising\Rav\MonBase.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3] [C:\Program Files\Rising\Rav\Rslog.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.41] [C:\Program Files\Rising\Rav\mondrv.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 6] [C:\Program Files\Rising\Rav\defmon.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 46] [C:\Program Files\Rising\Rav\moncom08.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1] [C:\Program Files\Rising\Rav\MonRule.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 10] [C:\Program Files\Rising\Rav\FileMon.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 29] [C:\Program Files\Rising\Rav\MailMon.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 22] [C:\Program Files\Rising\Rav\HookWeb.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 12] [C:\Program Files\Rising\Rav\rsindent.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 11] [C:\Program Files\Rising\Rav\Syslay.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.6] [C:\Program Files\Rising\Rav\taskplug.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 10] [C:\Program Files\Rising\Rav\scansrvp.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.7] [C:\Program Files\Rising\Rav\cnt08.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1] [C:\Program Files\Rising\Rav\proccomm.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 4] [C:\Program Files\Rising\Rav\RSAPPMGR.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.0] [C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.0]
00000000065645 初生襁褓狮帖子:5 注册: 2010-06-16 来自:

00000000065645 初生襁褓狮帖子:5 注册: 2010-06-16 来自:	发表于： 2010-06-16 23:54 \| 只看楼主短消息资料字号：小中大 3楼回复：Sreng 日志，高手请分析谢谢了 [C:\Program Files\Rising\Rav\comx3.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.37] [C:\Program Files\Rising\Rav\Hooksys.dll] [Beijing Rising Information Technology Co., Ltd., 24, 0, 0, 3] [C:\Program Files\Rising\Rav\ProcCom.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 20] [C:\Program Files\Rising\Rav\RsCommX2.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 20] [C:\Program Files\Rising\Rav\HookCont.dll] [Beijing Rising Information Technology Co., Ltd., 24, 0, 0, 1] [C:\Program Files\Rising\Rav\BACore.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 38] [C:\Program Files\Rising\Rav\recomp.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 6] [C:\Program Files\Rising\Rav\refs.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3] [C:\Program Files\Rising\Rav\viruslib.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3] [C:\Program Files\Rising\Rav\relibldr.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3] [C:\Program Files\Rising\Rav\rsnetsvr.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3] [C:\Program Files\Rising\Rav\bawhite.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3] [C:\Program Files\Rising\Rav\RSStore.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 5] [C:\Program Files\Rising\Rav\Scanner.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.22] [C:\Program Files\Rising\Rav\ScanAdd.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.4] [C:\Program Files\Rising\Rav\NComm2.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3] [C:\Program Files\Rising\Rav\rstask.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 5] [C:\Program Files\Rising\Rav\rsstub.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1] [C:\Program Files\Rising\Rav\ScanSrv.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.3] [C:\Program Files\Rising\Rav\scanpe.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 10] [C:\Program Files\Rising\Rav\pearc.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2] [C:\Program Files\Rising\Rav\ScanRavT.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.4] [C:\Program Files\Rising\Rav\ScanBT.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.21] [C:\Program Files\Rising\Rav\ScanStub.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.1] [C:\Program Files\Rising\Rav\ur000.dat] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 4] [C:\Program Files\Rising\Rav\urutils.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1] [C:\Program Files\Rising\Rav\ffr.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 4] [C:\Program Files\Rising\Rav\nvfile.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1] [C:\Program Files\Rising\Rav\scanexec.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2] [C:\Program Files\Rising\Rav\unexe.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2] [C:\Program Files\Rising\Rav\scanex.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 79] [C:\Program Files\Rising\Rav\scantj.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 4] [C:\Program Files\Rising\Rav\methodex.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3] [C:\Program Files\Rising\Rav\revm.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 6] [C:\Program Files\Rising\Rav\pecompd.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 5] [C:\Program Files\Rising\Rav\heurex.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 17] [C:\Program Files\Rising\Rav\extsfx.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 4] [C:\Program Files\Rising\Rav\extmail.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 5] [C:\Program Files\Rising\Rav\scansct.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 4] [C:\Program Files\Rising\Rav\ur001.dat] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2] [C:\Program Files\Rising\Rav\ur023.dat] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1] [C:\Program Files\Rising\Rav\ur025.dat] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2] [PID: 2368 / Administrator][C:\Program Files\Rising\Rav\rstray.exe] [Beijing Rising Information Technology Co., Ltd., 22.0.0.11] [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [C:\Program Files\Rising\Rav\comserv.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.15] [C:\Program Files\Rising\Rav\rslang.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1] [C:\Program Files\Rising\Rav\comx3.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.37] [C:\Program Files\Rising\Rav\Syslay.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.6] [C:\Program Files\Rising\Rav\ProcComm.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 4] [C:\Program Files\Rising\Rav\rsxml.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2] [C:\Program Files\Rising\Rav\MonState.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2] [C:\Program Files\Rising\Rav\ScanEvnt.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.3] [C:\Program Files\Rising\Rav\rsguilib.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 57] [C:\Program Files\Rising\Rav\rsconf.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.1] [C:\Program Files\Rising\Rav\rspalvd.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.7] [C:\Program Files\Rising\Rav\ravbintl.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 22] [C:\Program Files\Rising\Rav\mruleui.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 7] [C:\Program Files\Rising\Rav\MonTray.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.74] [C:\Program Files\Rising\Rav\RavITray.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 6] [C:\Program Files\Rising\Rav\rsmginfo.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 4] [C:\Program Files\Rising\Rav\scanleak.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 6] [C:\Program Files\Rising\Rav\ravppops.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 21] [C:\Program Files\Rising\Rav\RSAPPMGR.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.0] [C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.0] [C:\Program Files\Rising\Rav\PngDll.dll] [Beijing Rising Information Technology Co., Ltd., 21, 0, 0, 4] [C:\Program Files\Rising\Rav\ScanPrxy.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.4] [PID: 5012 / Administrator][C:\Program Files\Thunder\Program\Thunder5.exe] [Thunder Networking Technologies,LTD, 5.8.3.533] [C:\Program Files\Thunder\Program\BugReport.dll] [Thunder Networking Technologies,LTD, 1, 4, 1, 20] [C:\Program Files\Thunder\Program\ThunderEx.dll] [, 1, 2, 6, 25] [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [D:\Program Files\360\360Safe\safemon\safemon.dll] [360.cn, 6, 5, 1, 1002] [C:\WINDOWS\system32\nview.dll] [, ] [C:\WINDOWS\system32\NVWRSZHC.DLL] [NVIDIA Corporation, 6.14.10.12081] [C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.19.5 10Apr08] [C:\Program Files\Thunder\Program\TaskManager.dll] [Thunder Networking Technologies,LTD, 1, 3, 8, 68] [C:\Program Files\Thunder\Program\download_interface.dll] [Thunder Networking Technologies,LTD, 3, 1, 2, 318] [C:\Program Files\Thunder\Program\MSVCP71.dll] [Microsoft Corporation, 7.10.6030.0] [C:\Program Files\Thunder\Program\MSVCR71.dll] [Microsoft Corporation, 7.10.6030.0] [C:\Program Files\Thunder\Program\asyn_frame.dll] [Thunder Networking Technologies,LTD, 1, 1, 2, 21] [C:\Program Files\Thunder\Program\ATL71.DLL] [Microsoft Corporation, 7.10.6041.0] [C:\Program Files\Thunder\Program\fs.dll] [Thunder Networking Technologies,LTD, 1, 1, 2, 10] [C:\Program Files\Thunder\Program\XLNet.Dll] [Thunder Networking Technologies,LTD, 1, 5, 2, 25] [C:\Program Files\Thunder\Program\ptl.dll] [Thunder Networking Technologies,LTD, 3, 1, 2, 24] [C:\Program Files\Thunder\Program\backend_agent.dll] [Thunder Networking Technologies,LTD, 1, 1, 2, 20] [C:\Program Files\Thunder\Program\xl_stat.dll] [Thunder Networking Technologies,LTD, 1, 1, 2, 3] [C:\Program Files\Thunder\Program\iTargetAD.dll] [N/A, ] [C:\Program Files\Thunder\Program\BHOStub.dll] [Thunder Networking Technologies,LTD, 1, 1, 1, 10] [C:\Program Files\Thunder\Components\DownAndPlay\DownAndPlay.dll] [, 1, 0, 12, 30] [C:\WINDOWS\system32\nvwddi.dll] [NVIDIA Corporation, 6.14.11.7930] [C:\Program Files\Thunder\Program\p2p_upload.dll] [Thunder Networking Technologies,LTD, 1, 1, 2, 8] [C:\Program Files\Thunder\Program\p2p.dll] [Thunder Networking Technologies,LTD, 1,1,2,24] [C:\Program Files\Thunder\Program\xldc.dll] [Thunder Networking Technologies,LTD, 3, 6, 2, 15] [C:\Program Files\Thunder\Program\stream.dll] [Thunder Networking Technologies,LTD, 2, 1, 2, 381] [C:\Program Files\Thunder\Program\p2sp.dll] [Thunder Networking Technologies,LTD, 1, 1, 2, 25] [C:\Program Files\Thunder\Program\down_dispatcher.dll] [Thunder Networking Technologies,LTD, 1, 0, 2, 17] [C:\Program Files\Thunder\Program\p2p_local_res.dll] [Thunder Networking Technologies,LTD, 1,1,2,12] [C:\Program Files\Thunder\Program\al.dll] [Thunder Networking Technologies,LTD, 1,1,2,15] [C:\Program Files\Thunder\Components\Community\XLCommunity.dll] [Thunder Networking Technologies,LTD, 2, 4, 0, 73] [C:\Program Files\Thunder\Program\XLCommunityEx.dll] [N/A, ] [C:\Program Files\Thunder\Program\RegisterDll.dll] [Thunder Networking Technologies,LTD, 2, 17, 0, 67] [C:\Program Files\Thunder\Program\imdt.dll] [TODO: <Company name>, 1.1.2.5] [C:\Program Files\Thunder\Components\Security\ThunderSafe.dll] [深圳市迅雷网络技术有限公司, 2, 1, 1, 93] [C:\Program Files\Thunder\Components\Security\ConfigManager.dll] [深圳市迅雷网络技术有限公司, 1, 0, 0, 1] [C:\Program Files\Thunder\Components\Security\SafeManager.dll] [深圳市迅雷网络技术有限公司, 1, 0, 4, 16] [C:\Program Files\Thunder\Program\XLNetU.Dll] [Thunder Networking Technologies,LTD, 1, 5, 1, 24] [C:\Program Files\Thunder\Plugins\XLSafeHost\XLSafeHost.dll] [深圳市迅雷网络技术有限公司, 1, 2, 1, 74] [C:\Program Files\Thunder\plugins\xlsafehost\Guard.dll] [深圳市迅雷网络技术有限公司, 1, 0, 0, 4] [C:\Program Files\Thunder\Plugins\XLSafeHost\AutoHelp.dll] [Beijing Rising Technology Co., Ltd., 6.0.0.3] [C:\Program Files\Thunder\Components\Search\XLSearch.dll] [Thunder Networking Technologies,LTD, 1, 1, 6, 21] [C:\Program Files\Thunder\Program\LiveUpdate.dll] [Thunder Networking Technologies,LTD, 1, 2, 3, 25] [C:\Program Files\Thunder\Components\XLSoftBase\XLSoftwareBase.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 3] [C:\Program Files\Thunder\Plugins\GouGouTop\GouGouTop.dll] [Thunder Networking Technologies,LTD, 1, 0, 2, 5] [C:\Program Files\Thunder\Components\ExplorerHelper\ExplorerHelper.dll] [Thunder Networking Technologies,LTD, 1, 0, 4, 19] [C:\Program Files\Thunder\Components\Tips\TipsClient.dll] [Thunder Networking Technologies,LTD, 2, 2, 13, 118] [C:\Program Files\Thunder\Components\DownloadStat\DownloadStat.dll] [Thunder Networking Technologies,LTD, 1, 4, 1, 6] [C:\Program Files\Thunder\Components\Tips\XLIPC.DLL] [Thunder Networking Technologies,LTD, 1, 0, 0, 2] [C:\Program Files\Thunder\Program\emule_id.dll] [, 1, 0, 2, 8] [C:\Program Files\Thunder\Program\bd.dll] [Thunder Networking Technologies,LTD, 1, 0, 2, 17] [C:\Program Files\Thunder\Program\FloatBar.dll] [Giganology Inc., 1, 0, 0, 2] [C:\WINDOWS\system32\shdoclc.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 32] [PID: 952 / Administrator][F:\explorer.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [D:\Program Files\360\360Safe\safemon\safemon.dll] [360.cn, 6, 5, 1, 1002] [C:\WINDOWS\system32\nview.dll] [, ] [C:\WINDOWS\system32\NVWRSZHC.DLL] [NVIDIA Corporation, 6.14.10.12081] [C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.19.5 10Apr08] [C:\WINDOWS\system32\nvwddi.dll] [NVIDIA Corporation, 6.14.11.7930] [C:\WINDOWS\system32\browselc.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [C:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll] [Thunder Networking Technologies,LTD, 1.0.5.29] [C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 8, 96] [C:\WINDOWS\system32\shdoclc.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [C:\Program Files\Lenovo\HOTKEY\hkvolkey.dll] [Lenovo Group Limited, 1.01] [C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 32] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\WINDOWS\system32\nvapi.dll] [NVIDIA Corporation, 6.14.11.7930] [C:\WINDOWS\system32\nvcpl.dll] [NVIDIA Corporation, 6.14.11.7930] [C:\WINDOWS\system32\NVRSZHC.DLL] [NVIDIA Corporation, 6.14.11.7930] [C:\WINDOWS\system32\nvshell.dll] [, ] [PID: 5884 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)] [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [PID: 172 / Administrator][D:\Program Files\360\360Safe\360leakfixer.exe] [360.cn, 1, 0, 0, 1013] [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [D:\Program Files\360\360Safe\leakrepair.dll] [360.cn, 1.0.0.1013] [D:\Program Files\360\360Safe\360net.dll] [奇虎网, 1, 1, 17, 1020]
00000000065645 初生襁褓狮帖子:5 注册: 2010-06-16 来自:

00000000065645 初生襁褓狮帖子:5 注册: 2010-06-16 来自:	发表于： 2010-06-16 23:54 \| 只看楼主短消息资料字号：小中大 4楼回复：Sreng 日志，高手请分析谢谢了 [D:\Program Files\360\360Safe\pdown.dll] [360.cn, 1, 2, 0, 1014] [PID: 5916 / Administrator][D:\Program Files\360\360Safe\LiveUpdate360.exe] [360.cn, 1, 2, 0, 1020] [D:\Program Files\360\360Safe\LiveUpd360.dll] [360.cn, 1, 2, 0, 1033] [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [D:\Program Files\360\360Safe\360net.dll] [奇虎网, 1, 1, 17, 1020] [D:\Program Files\360\360Safe\360P2SP.dll] [360.cn, 1, 1, 0, 1045] [PID: 4556 / Administrator][D:\Program Files\360\360se3\360SE.exe] [360.cn, 3, 2, 0, 2] [D:\Program Files\360\360se3\Extensions\SafeCentral\SafeCentral.dll] [360.cn, 1, 3, 1, 1018] [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [D:\Program Files\360\360Safe\safemon\safemon.dll] [360.cn, 6, 5, 1, 1002] [C:\WINDOWS\system32\nview.dll] [, ] [C:\WINDOWS\system32\NVWRSZHC.DLL] [NVIDIA Corporation, 6.14.10.12081] [C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.19.5 10Apr08] [D:\Program Files\360\360se3\Extensions\Favorites\Favorites.dll] [360.cn, 2, 0, 1, 1028] [D:\Program Files\360\360se3\Extensions\LoginEnrol\LoginEnrol.dll] [360.cn, 2, 0, 1, 1028] [D:\Program Files\360\360se3\sqlite3.dll] [N/A, ] [D:\PROGRA~1\360\360se3\Extensions\UICenter\UICenter.dll] [, 1, 0, 0, 8] [D:\Program Files\360\360Safe\safemon\LoadWDUI.dll] [360.cn, 1, 0, 0, 1018] [D:\PROGRA~1\360\360se3\Extensions\ExtAddons\ExtAddons.dll] [360.cn, 1, 0, 4, 1007] [D:\PROGRA~1\360\360se3\Extensions\ExtProxy\ExtProxy.dll] [360SE, 1, 0, 2, 1001] [D:\PROGRA~1\360\360se3\Extensions\ExtVideoAnalyze\ExtVideoAnalyze.dll] [, 1, 0, 0, 7] [D:\PROGRA~1\360\360se3\Extensions\ExtSafeAddress\ExtSafeAddress.dll] [Phoenix Studio, 1, 0, 0, 3] [D:\PROGRA~1\360\360se3\Extensions\SnapPlugin\SnapPlugin.dll] [, 1, 0, 0, 2] [D:\PROGRA~1\360\360se3\Extensions\TranslatorPlugin\TranslatorPlugin.dll] [, 1, 0, 0, 2] [D:\PROGRA~1\360\360se3\Extensions\MiniSearchBar\MiniSearchBar.dll] [, 1, 0, 0, 1005] [D:\PROGRA~1\360\360se3\Extensions\onlinefav\onlinefav.dll] [, 3, 0, 0, 3] [D:\PROGRA~1\360\360se3\Extensions\ExtAdfilter\ExtAdfilter.dll] [360.cn, 1, 1, 0, 1019] [D:\PROGRA~1\360\360se3\Extensions\ExtPages\ExtPages.dll] [360.cn, 1, 0, 5, 1001] [D:\PROGRA~1\360\360se3\Extensions\ExtSuggest\ExtSuggest.dll] [360SE, 1, 0, 1, 2] [D:\PROGRA~1\360\360se3\Extensions\ExtDownload\ExtDownload.dll] [360, 1, 0, 4, 1002] [D:\Program Files\360\360Safe\safemon\urlproc.dll] [360.cn, 1, 2, 0, 1005] [C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx] [Adobe Systems, Inc., 9,0,124,0] [D:\Program Files\360\360se3\Extensions\SafeCentral\urlproc.dll] [360.cn, 1, 2, 0, 1004] [D:\Program Files\360\360se3\Extensions\SafeCentral\urlprocnet.dll] [360.cn, 1, 1, 0, 1005] [C:\WINDOWS\system32\shdoclc.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [C:\WINDOWS\system32\nvwddi.dll] [NVIDIA Corporation, 6.14.11.7930] [C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 32] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\WINDOWS\system32\SOGOUPY.IME] [Sogou.com Inc., 3.5.0.0] [C:\Program Files\SogouInput\Plugin\SgImeWord.dll] [Sogou.com Inc., 3.5.0.0] [PID: 3608 / Administrator][D:\Program Files\360\360se3\360SE.exe] [360.cn, 3, 2, 0, 2] [D:\Program Files\360\360se3\Extensions\SafeCentral\SafeCentral.dll] [360.cn, 1, 3, 1, 1018] [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [D:\Program Files\360\360Safe\safemon\safemon.dll] [360.cn, 6, 5, 1, 1002] [C:\WINDOWS\system32\nview.dll] [, ] [C:\WINDOWS\system32\NVWRSZHC.DLL] [NVIDIA Corporation, 6.14.10.12081] [C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.19.5 10Apr08] [D:\Program Files\360\360se3\Extensions\Favorites\Favorites.dll] [360.cn, 2, 0, 1, 1028] [D:\PROGRA~1\360\360se3\Extensions\ExtAdfilter\ExtAdfilter.dll] [360.cn, 1, 1, 0, 1019] [D:\PROGRA~1\360\360se3\Extensions\ExtProxy\ExtProxy.dll] [360SE, 1, 0, 2, 1001] [D:\Program Files\360\360Safe\safemon\urlproc.dll] [360.cn, 1, 2, 0, 1005] [C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx] [Adobe Systems, Inc., 9,0,124,0] [D:\Program Files\360\360se3\Extensions\SafeCentral\urlproc.dll] [360.cn, 1, 2, 0, 1004] [C:\WINDOWS\system32\shdoclc.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [D:\Program Files\360\360Safe\safemon\LoadWDUI.dll] [360.cn, 1, 0, 0, 1018] [C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 32] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\Program Files\Lenovo\HOTKEY\hkvolkey.dll] [Lenovo Group Limited, 1.01] [D:\Program Files\360\360se3\Extensions\SafeCentral\urlprocnet.dll] [360.cn, 1, 1, 0, 1005] [C:\WINDOWS\system32\SOGOUPY.IME] [Sogou.com Inc., 3.5.0.0] [C:\Program Files\SogouInput\Plugin\SgImeWord.dll] [Sogou.com Inc., 3.5.0.0] [PID: 2552 / SYSTEM][C:\WINDOWS\system32\wuauclt.exe] [(Verified) Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)] [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [PID: 4064 / Administrator][F:\sreng2\SREngLdr.EXE] [Smallfrogs Studio, 2.8.2.1321] [PID: 3128 / Administrator][F:\sreng2\SREc1fb28de.EXE] [Smallfrogs Studio, 2.8.2.1321] [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [D:\Program Files\360\360Safe\safemon\safemon.dll] [360.cn, 6, 5, 1, 1002] [C:\WINDOWS\system32\nview.dll] [, ] [C:\WINDOWS\system32\NVWRSZHC.DLL] [NVIDIA Corporation, 6.14.10.12081] [C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.19.5 10Apr08] [C:\WINDOWS\system32\nvwddi.dll] [NVIDIA Corporation, 6.14.11.7930] [F:\sreng2\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15] ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf N/A ================================== HOSTS 文件 127.0.0.1 localhost ================================== 进程特权扫描特殊特权被允许： SeLoadDriverPrivilege [PID = 448, C:\WINDOWS\SYSTEM32\ACS.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 3256, C:\PROGRAM FILES\LENOVO\ATK HOTKEY\LCONTROL.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 3868, C:\PROGRAM FILES\LENOVO\ATK HOTKEY\LFKA.EXE] 特殊特权被允许： SeDebugPrivilege [PID = 5012, C:\PROGRAM FILES\THUNDER\PROGRAM\THUNDER5.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 5012, C:\PROGRAM FILES\THUNDER\PROGRAM\THUNDER5.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 952, F:\EXPLORER.EXE] ================================== 计划任务 N/A ================================== Windows 安全更新检查 Microsoft .NET Framework 版本 1.1，简体中文版 KB940157, 用于 Windows XP 的 Windows 搜索 4.0 (KB940157) KB905474, Windows Genuine Advantage 通知 (KB905474) KB909520, Microsoft 基本智能卡加密服务提供程序包： x86 (KB909520) KB951847, Microsoft .NET Framework 3.5 Service Pack 1 和 .NET Framework 3.5 Family Update (KB951847) x86 KB956744, Windows XP 安全更新程序 (KB956744) MS09-044 KB944036, 用于 Windows XP 的 Internet Explorer 8 KB971961, 用于 Windows XP 的 Jscript 5.7 的安全更新程序 (KB971961) MS09-045 KB973687, Windows XP 更新程序 (KB973687) KB952069, Windows XP Service Pack 3 安全更新程序 (KB952069) MS08-076 KB970430, Windows XP 更新程序 (KB970430) KB971737, Windows XP 更新程序 (KB971737) KB955759, Windows XP 更新程序 (KB955759) KB971513, Windows XP 更新程序 (KB971513) KB981349, Windows XP 安全更新程序 (KB981349) MS10-022 KB931125, 根证书更新程序 [2010 年 5 月] (KB931125) KB980218, Windows XP 安全更新程序 (KB980218) MS10-037 KB979482, Windows XP 安全更新程序 (KB979482) MS10-033 KB890830, Windows 恶意软件删除工具 - 2010 年 6 月 (KB890830) KB982381, 用于 Windows XP 的 Internet Explorer 6 累积安全更新程序 (KB982381) MS10-035 ================================== API HOOK NtCreateFile (危险等级: 高, 被下面模块所HOOK: ) NtCreateKey (危险等级: 高, 被下面模块所HOOK: ) NtCreateProcess (危险等级: 一般, 被下面模块所HOOK: ) NtCreateProcessEx (危险等级: 一般, 被下面模块所HOOK: ) NtCreateThread (危险等级: 一般, 被下面模块所HOOK: ) NtDeleteFile (危险等级: 高, 被下面模块所HOOK: ) NtEnumerateKey (危险等级: 高, 被下面模块所HOOK: ) NtEnumerateValueKey (危险等级: 高, 被下面模块所HOOK: ) NtFsControlFile (危险等级: 高, 被下面模块所HOOK: ) NtLoadDriver (危险等级: 高, 被下面模块所HOOK: ) NtLoadKey2 (危险等级: 高, 被下面模块所HOOK: ) NtLoadKey (危险等级: 高, 被下面模块所HOOK: ) NtOpenKey (危险等级: 高, 被下面模块所HOOK: ) NtOpenProcess (危险等级: 高, 被下面模块所HOOK: ) NtOpenThread (危险等级: 高, 被下面模块所HOOK: ) NtQueryDirectoryFile (危险等级: 高, 被下面模块所HOOK: ) NtQueryDirectoryObject (危险等级: 高, 被下面模块所HOOK: ) NtQueryFullAttributesFile (危险等级: 高, 被下面模块所HOOK: ) NtQueryInformationFile (危险等级: 高, 被下面模块所HOOK: ) NtQueryInformationPort (危险等级: 高, 被下面模块所HOOK: ) NtQueryInformationProcess (危险等级: 高, 被下面模块所HOOK: ) NtQueryInformationThread (危险等级: 高, 被下面模块所HOOK: ) NtQuerySystemInformation (危险等级: 高, 被下面模块所HOOK: ) NtReadFile (危险等级: 一般, 被下面模块所HOOK: ) NtRenameKey (危险等级: 一般, 被下面模块所HOOK: ) NtReplaceKey (危险等级: 高, 被下面模块所HOOK: ) NtRestoreKey (危险等级: 高, 被下面模块所HOOK: ) NtSaveKey (危险等级: 高, 被下面模块所HOOK: ) NtSaveKeyEx (危险等级: 高, 被下面模块所HOOK: ) NtSetInformationFile (危险等级: 高, 被下面模块所HOOK: ) NtSetInformationKey (危险等级: 高, 被下面模块所HOOK: ) NtSetInformationProcess (危险等级: 高, 被下面模块所HOOK: ) NtSetInformationThread (危险等级: 高, 被下面模块所HOOK: ) NtSetSystemInformation (危险等级: 高, 被下面模块所HOOK: ) NtSetValueKey (危险等级: 高, 被下面模块所HOOK: ) NtTerminateProcess (危险等级: 高, 被下面模块所HOOK: ) NtTerminateThread (危险等级: 高, 被下面模块所HOOK: ) NtWriteFile (危险等级: 一般, 被下面模块所HOOK: ) ZwCreateFile (危险等级: 高, 被下面模块所HOOK: ) ZwCreateKey (危险等级: 高, 被下面模块所HOOK: ) ZwCreatePort (危险等级: 一般, 被下面模块所HOOK: ) ZwCreateProcess (危险等级: 一般, 被下面模块所HOOK: ) ZwCreateProcessEx (危险等级: 一般, 被下面模块所HOOK: ) ZwCreateThread (危险等级: 一般, 被下面模块所HOOK: ) ZwDeleteFile (危险等级: 高, 被下面模块所HOOK: ) ZwDeleteKey (危险等级: 高, 被下面模块所HOOK: ) ZwEnumerateKey (危险等级: 高, 被下面模块所HOOK: ) ZwEnumerateValueKey (危险等级: 高, 被下面模块所HOOK: ) ZwFsControlFile (危险等级: 高, 被下面模块所HOOK: ) ZwOpenFile (危险等级: 一般, 被下面模块所HOOK: ) ZwOpenProcess (危险等级: 一般, 被下面模块所HOOK: ) ZwOpenThread (危险等级: 一般, 被下面模块所HOOK: ) ZwQueryDirectoryFile (危险等级: 高, 被下面模块所HOOK: ) ZwQueryInformationFile (危险等级: 高, 被下面模块所HOOK: ) ZwQueryInformationProcess (危险等级: 高, 被下面模块所HOOK: ) ZwQueryInformationThread (危险等级: 高, 被下面模块所HOOK: ) ZwReadFile (危险等级: 一般, 被下面模块所HOOK: ) ZwRenameKey (危险等级: 一般, 被下面模块所HOOK: ) ZwReplaceKey (危险等级: 高, 被下面模块所HOOK: ) ZwRestoreKey (危险等级: 高, 被下面模块所HOOK: ) ZwSaveKey (危险等级: 高, 被下面模块所HOOK: ) ZwSaveKeyEx (危险等级: 高, 被下面模块所HOOK: ) ZwSetInformationFile (危险等级: 高, 被下面模块所HOOK: ) ZwSetInformationKey (危险等级: 高, 被下面模块所HOOK: ) ZwSetInformationProcess (危险等级: 高, 被下面模块所HOOK: ) ZwSetInformationThread (危险等级: 高, 被下面模块所HOOK: ) ZwSetSystemInformation (危险等级: 高, 被下面模块所HOOK: ) ZwSetValueKey (危险等级: 高, 被下面模块所HOOK: ) ZwSetVolumeInformationFile (危险等级: 高, 被下面模块所HOOK: ) ZwShutdownSystem (危险等级: 高, 被下面模块所HOOK: ) ZwTerminateProcess (危险等级: 高, 被下面模块所HOOK: ) ZwTerminateThread (危险等级: 高, 被下面模块所HOOK: ) ZwWriteFile (危险等级: 一般, 被下面模块所HOOK: ) GetVersion (危险等级: 一般, 被下面模块所HOOK: ) GetVersionExW (危险等级: 一般, 被下面模块所HOOK: ) DeleteFileW (危险等级: 高, 被下面模块所HOOK: ) FindFirstFileExW (危险等级: 高, 被下面模块所HOOK: ) TerminateThread (危险等级: 高, 被下面模块所HOOK: ) FindFirstChangeNotificationW (危险等级: 高, 被下面模块所HOOK: ) GetCurrentProcess (危险等级: 一般, 被下面模块所HOOK: ) GetCurrentProcessId (危险等级: 一般, 被下面模块所HOOK: ) GetCurrentThread (危险等级: 一般, 被下面模块所HOOK: ) GetCurrentThreadId (危险等级: 一般, 被下面模块所HOOK: ) GetFileSizeEx (危险等级: 一般, 被下面模块所HOOK: ) GetFileInformationByHandle (危险等级: 一般, 被下面模块所HOOK: ) GetFileAttributesW (危险等级: 一般, 被下面模块所HOOK: ) OpenProcess (危险等级: 高, 被下面模块所HOOK: ) OpenThread (危险等级: 高, 被下面模块所HOOK: ) ================================== 隐藏进程 N/A ==================================[/code]
00000000065645 初生襁褓狮帖子:5 注册: 2010-06-16 来自:

是昔流芳卡卡反病毒小组帖子:646 注册: 2009-05-10 来自:青鸾峰	发表于： 2010-06-17 06:36 \| 短消息资料字号：小中大 5楼回复：Sreng 日志，高手请分析谢谢了 F:\EXPLORER.EXE 打包传上来看一看 My Blog
是昔流芳卡卡反病毒小组帖子:646 注册: 2009-05-10 来自:青鸾峰

00000000065645 初生襁褓狮帖子:5 注册: 2010-06-16 来自:	发表于： 2010-06-17 08:52 \| 只看楼主短消息资料字号：小中大 6楼回复: Sreng 日志，高手请分析谢谢了请看，这是我电脑 C:\WINDOWS\ 路径下的 explorer。多谢了。我重装了N 次系统了，都没用。硬盘也全部格式化过了。我郁闷死了。再不行，我就把硬盘给低级格式化了。附件: 文件名:explorer.rar 下载次数:141 文件类型:application/octet-stream 文件大小: 上传时间:2010-6-17 8:52:12 描述:rar
00000000065645 初生襁褓狮帖子:5 注册: 2010-06-16 来自:

<<上一主题|下一主题>>

1

1 / 1 页

跳转页

页面顶部

Powered by Discuz!NT