瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 还是上次没解决的问题，tian.exe病毒！！！

1   1  /  1  页   跳转页

还是上次没解决的问题，tian.exe病毒！！！

收藏
supermancool
头像
初生襁褓狮
  • 帖子:17
  • 注册: 2007-01-01
  • 来自:
发表于： 2007-01-20 12:48 | 只看楼主 短消息 资料
字号： 小 中 大 1楼

还是上次没解决的问题，tian.exe病毒！！！

我已经用GHOST还原成干净系统了，但运行D盘下一EXE文件后，就会在WINDOWS下自动生成tian.exe病毒，搜索了一下是如下病毒：

这个病毒偷天堂游戏密码，有两部分组成：

Trojan.Legend.SuperWay.b 服务器
和Trojan.Legend.SuperWay.b.make. 病毒定制工具

1.病毒拷贝自己到windows目录，命名为tian.exe ，登记为自启动。

2.病毒隐藏在后台运行，不停的查找标题是“ Lineage Windows Client”的窗口。取得密码信息后发送到指定邮箱中。

3.病毒作者的主页为http://www.***.com

4.病毒会终止下列防火墙程序

kvapfw.exe、
kvfw.exe、
DFVSNET.EXE、
PasswordGuard.exe、
Eghost.exe、
Iparmor.exe、
pfw.exe
最后编辑2007-01-20 14:27:52
分享到：
gototop
 
supermancool
头像
初生襁褓狮
  • 帖子:17
  • 注册: 2007-01-01
  • 来自:
发表于： 2007-01-20 12:52 | 只看楼主 短消息 资料
字号： 小 中 大 2楼

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Corporation]
    <PHIME2002ASync><; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Corporation]
    <IntelliPoint><"C:\Program Files\Microsoft IntelliPoint\ipoint.exe">  [(Verified)Microsoft Corporation]
    <dr><D:\Program Files\北京城市热点资讯有限公司\Dr.COM 宽带客户端\ishare_user.exe>  [N/A]
    <kis><"D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe">  [Kaspersky Lab]
    <Anti-Spy Tools><E:\ast\ast\ast.exe -min>  [DSW Lab]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><C:\WINDOWS\System32\userinit.exe,>  [(Verified)Microsoft Corporation]
    <UIHost><logonui.exe>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
    <WinlogonNotify: klogon><C:\WINDOWS\System32\klogon.dll>  [Kaspersky Lab]

==================================
启动文件夹
N/A

==================================
服务
[卡巴斯基互联网安全套装 6.0 / AVP]
  <D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe -r><Kaspersky Lab>
[ewido anti-spyware 4.0 guard / ewido anti-spyware 4.0 guard]
  <D:\Program Files\ewido anti-spyware 4.0\ewido anti-spyware 4.0\guard.exe><Anti-Malware Development a.s.>
[Human Interface Device Access / HidServ]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[IMAPI CD-Burning COM Service / ImapiService]
  <C:\WINDOWS\System32\imapi.exe><Microsoft Corporation>
[NVIDIA Driver Helper Service / NVSvc]
  <C:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation>

==================================
驱动程序
[Anti SpyWare Toolkit Service / ASTService]
  <\??\E:\ast\ast\AST.sys><N/A>
[CMBProtector / CMBProtector]
  <\??\C:\WINDOWS\System32\Drivers\CMBProtector.dat><N/A>
[ewido anti-spyware 4.0 driver / ewido anti-spyware 4.0 driver]
  <\??\D:\Program Files\ewido anti-spyware 4.0\ewido anti-spyware 4.0\guard.sys><N/A>
[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS]
  <System32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
[kl1 / kl1]
  <\SystemRoot\System32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif]
  <\??\C:\WINDOWS\System32\drivers\klif.sys><Kaspersky Lab>
[KRegEx / KRegEx]
  <\??\D:\KV2006\KRegEx.sys><N/A>
[KSysCall Service / KSysCall]
  <\??\D:\KV2006\KSysCall.sys><N/A>
[KVDriver for NT (KVDP) / KVDP]
  <\??\D:\KV2006\KVDP.sys><N/A>
[KvMemon / KvMemon]
  <\??\D:\KV2006\KvMemon.sys><N/A>
[KVREDIR / KVREDIR]
  <\??\D:\KV2006\KVREDIR.sys><N/A>
[npkcrypt / npkcrypt]
  <\??\D:\Program Files\Tencent\npkcrypt.sys><INCA Internet Co., Ltd.>
[nv / nv]
  <System32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[nv4 / nv4]
  <System32\DRIVERS\nv4.sys><NVIDIA Corporation>
[PProtect / PProtect]
  <\??\D:\KV2006\PProtect.sys><N/A>
[PSTRIP / PSTRIP]
  <\??\C:\WINDOWS\System32\DRIVERS\PSTRIP.SYS><N/A>
[Direct Parallel Link Driver / Ptilink]
  <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware]
  <\SystemRoot\System32\drivers\RsBoot.sys><Beijing Rising>
[Secdrv / Secdrv]
  <System32\DRIVERS\secdrv.sys><N/A>
[sptd / sptd]
  <\SystemRoot\System32\Drivers\sptd.sys><N/A>

==================================
浏览器加载项
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <D:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_006.dll, Thunder Networking Technologies,LTD>
[浩方对战平台]
  {0A155D3C-68E2-4215-A47A-E800A446447A} <D:\Program Files\浩方对战平台\GameClient.exe, 上海浩方在线信息技术有限公司>
[Web反病毒保护]
  {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll, Kaspersky Lab>
[相关站点]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <D:\Program Files\Tencent\QQ.EXE, TENCENT>
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[CEditCtrl Object]
  {488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\System32\aliedit\AliEdit.dll, www.alipay.com>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[CPasswordEditCtrl Object]
  {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\System32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
[WangWangObj Class]
  {6E213FC7-DD5A-4115-B7E6-D4C7838C361E} <D:\Program Files\淘宝网\淘宝旺旺\WangWangX4.dll, 阿里软件（中国）有限公司>
[&使用迅雷下载]
  <D:\Program Files\Thunder Network\Thunder\Program\geturl.htm, N/A>
[&使用迅雷下载全部链接]
  <D:\Program Files\Thunder Network\Thunder\Program\getallurl.htm, N/A>
[使用迅雷下载]
  <, N/A>
[查看 Exif 信息(&V)]
  <res://D:\Program Files\Exif Show\ExShow.dll/EXSHOW.HTML, N/A>
[添加到QQ自定义面板]
  <D:\Program Files\Tencent\AddPanel.htm, N/A>
[添加到QQ表情]
  <D:\Program Files\Tencent\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <D:\Program Files\Tencent\SendMMS.htm, N/A>
gototop
 
supermancool
头像
初生襁褓狮
  • 帖子:17
  • 注册: 2007-01-01
  • 来自:
发表于： 2007-01-20 12:54 | 只看楼主 短消息 资料
字号： 小 中 大 3楼

==================================
正在运行的进程
[PID: 632][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 724][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 748][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\klogon.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
[PID: 792][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 804][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
[PID: 984][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
[PID: 1084][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
[PID: 1164][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
[PID: 1192][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
[PID: 1516][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
[PID: 1588][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2600.0000 (xpclient.010817-1148)]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
    [E:\ast\ast\AST.dll]  [DSW Lab, 1.0.0.1]
    [D:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_006.dll]  [Thunder Networking Technologies,LTD, 5, 0, 0, 3]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\shellex.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program Files\WinRAR\rarext.dll]  [N/A, N/A]
    [D:\Program Files\ewido anti-spyware 4.0\ewido anti-spyware 4.0\context.dll]  [Anti-Malware Development a.s., 4, 0, 0, 172]
    [C:\WINDOWS\System32\msdmo.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\l3codeca.acm]  [Fraunhofer Institut Integrierte Schaltungen IIS, 1, 9, 0, 0305]
[PID: 1704][C:\Program Files\Microsoft IntelliPoint\ipoint.exe]  [Microsoft Corporation, 5.50.662.0]
    [E:\ast\ast\AST.dll]  [DSW Lab, 1.0.0.1]
[PID: 1720][D:\Program Files\北京城市热点资讯有限公司\Dr.COM 宽带客户端\ishare_user.exe]  [N/A, N/A]
    [D:\Program Files\北京城市热点资讯有限公司\Dr.COM 宽带客户端\cw3220.DLL]  [Borland International, 2.0]
    [E:\ast\ast\AST.dll]  [DSW Lab, 1.0.0.1]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
[PID: 1760][D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\FSSync.dll]  [Kaspersky Lab, 6.0.5.0]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\AVPGS.PPL]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl]  [Kaspersky Lab, 6.0.0.304]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\winreg.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\avpgui.ppl]  [Kaspersky Lab, 6.0.0.307]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\basegui.dll]  [Kaspersky Lab, 6.0.0.307]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\thpimpl.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\qb.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\inflate.ppl]  [Kaspersky Lab, 6.0.0.16]
    [E:\ast\ast\AST.dll]  [DSW Lab, 1.0.0.1]
[PID: 1776][E:\ast\ast\ast.exe]  [DSW Lab, 1.6]
    [E:\ast\ast\aScanCom.dll]  [DSW Lab, 2. 0. 1.4]
    [E:\ast\ast\AST.dll]  [DSW Lab, 1.0.0.1]
    [E:\ast\ast\AutoRun.dll]  [ DSW Lab, 2.1]
    [E:\ast\ast\Common.dll]  [N/A, 1.4.0.0]
    [E:\ast\ast\EngineSDK.dll]  [DSW Lab, 1.9]
    [E:\ast\ast\FileAnalyser.dll]  [DSW Lab, 1.0.0.1]
    [E:\ast\ast\KillModule.dll]  [DSW Lab, 1.2.0.0]
    [E:\ast\ast\ManagerProcess.dll]  [N/A, 1.3.1.0]
    [E:\ast\ast\ManagerService.dll]  [N/A, 1.0.0.0]
    [E:\ast\ast\Monitor.dll]  [DSW Lab, 1.6]
    [E:\ast\ast\PortAssociate.dll]  [DSW Lab, 1.0.0.8]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
    [E:\ast\ast\Ring0Manager.dll]  [DSW Lab, 1.0.0.1]
    [E:\ast\ast\SSDT.dll]  [ DSW Lab, 1.0.0.1]
    [E:\ast\ast\StrongBox.dll]  [DSW Lab, 1.0.0.1]
    [E:\ast\ast\TIERepair.dll]  [N/A, 1.2.0.0]
    [E:\ast\ast\tRubbishClear.dll]  [DSW Lab, 1.5.0.0]
    [E:\ast\ast\tSecurityOptimize.dll]  [DSW Lab, 1.1.0.0]
    [E:\ast\ast\unarc.dll]  [DSW Lab, 1.2]
    [E:\ast\ast\zDiagnosticTool.dll]  [DSW Lab, 1.2.0.0]
    [E:\ast\ast\SKEngine.dll]  [DSW Lab, 1.0.0.1]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll]  [Kaspersky Lab, 1.0.6.299]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl]  [Kaspersky Lab, 6.0.0.304]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl]  [Kaspersky Lab, 6.0.0.299]
[PID: 1796][C:\WINDOWS\System32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [E:\ast\ast\AST.dll]  [DSW Lab, 1.0.0.1]
[PID: 1924][D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\FSSync.dll]  [Kaspersky Lab, 6.0.5.0]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\AVPGS.PPL]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl]  [Kaspersky Lab, 6.0.0.304]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\winreg.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\tm.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\bl.ppl]  [Kaspersky Lab, 6.0.0.300]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\wmihlpr.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\ndetect.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\crpthlpr.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\schedule.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\timer.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\thpimpl.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\lic60.ppl]  [Kaspersky Lab, 6.0.0.306]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\report.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\hashmd5.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\avs.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\avpmgr.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\wdiskio.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\avlib.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\avspm.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\avp3info.ppl]  [Kaspersky Lab, 6.0.0.299]
gototop
 
supermancool
头像
初生襁褓狮
  • 帖子:17
  • 注册: 2007-01-01
  • 来自:
发表于： 2007-01-20 12:54 | 只看楼主 短消息 资料
字号： 小 中 大 4楼

[d:\program files\kaspersky lab\kaspersky internet security 6.0\ahfw.ppl]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\CKAHUM.dll]  [Kaspersky Lab, 6.0.0.1]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\CKAHComm.dll]  [Kaspersky Lab, 6.0.0.1]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ckahrule.dll]  [Kaspersky Lab, 6.0.0.1]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\resip.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\ahids.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\aphisht.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\adialtsk.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\sc.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\httpscan.ppl]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klaveng.dll]  [N/A, N/A]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\og.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\popupchk.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\pdm.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\oas.ppl]  [Kaspersky Lab, 6.0.0.300]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\dtreg.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\httpanlz.ppl]  [Kaspersky Lab, 6.0.0.300]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\updater2005.ppl]  [Kaspersky Lab, 6.0.0.300]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\procmon.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\prutil.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\aphish.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\trafficmonitor2.ppl]  [N/A, N/A]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\avp1.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\l_llio.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\ichk2.ppl]  [Kaspersky Lab, 6.0.0.300]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\sfdb.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\icheckersa.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\hashcont.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\productinfo.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\hccmp.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\updater.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\iwgen.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\diff.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\base64p.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\updateinfo.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\netsession.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\socket.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\httpsession.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\ntlm.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\ftpsession.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\qb.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\uniarc.ppl]  [Kaspersky Lab, 6.0.0.16]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\minizip.ppl]  [Kaspersky Lab, 6.0.0.16]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\cab.ppl]  [Kaspersky Lab, 6.0.0.16]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\arj.ppl]  [Kaspersky Lab, 6.0.0.16]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\rar.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\lha.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\mdb.ppl]  [Kaspersky Lab, 6.0.0.300]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\msoe.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\updateobjectinfo.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\base64.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\updatecategory.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\updateinstaller.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\baseinstaller.ppl]  [Kaspersky Lab, 6.0.0.306]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\execinstaller.ppl]  [Kaspersky Lab, 6.0.0.306]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\prseqio.ppl]  [Kaspersky Lab, 6.0.0.299]
[PID: 1956][D:\Program Files\ewido anti-spyware 4.0\ewido anti-spyware 4.0\guard.exe]  [Anti-Malware Development a.s., 4, 0, 0, 172]
    [D:\Program Files\ewido anti-spyware 4.0\ewido anti-spyware 4.0\engine.dll]  [Anti-Malware Development a.s., 4, 0, 0, 172]
[PID: 2012][C:\WINDOWS\System32\nvsvc32.exe]  [NVIDIA Corporation, 6.13.10.3082]
[PID: 2116][D:\Program Files\Maxthon\Maxthon.exe]  [MY Soft Technology, 1, 5, 0, 95]
    [D:\Program Files\Maxthon\maxzlib.dll]  [ , 1, 0, 0, 2]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
    [E:\ast\ast\AST.dll]  [DSW Lab, 1.0.0.1]
    [D:\Program Files\Maxthon\Plugin\ViewSource\ViewSrc.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Maxthon\Services\RealTime\real_time.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll]  [Kaspersky Lab, 1.0.6.299]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl]  [Kaspersky Lab, 6.0.0.304]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl]  [Kaspersky Lab, 6.0.0.299]
    [C:\WINDOWS\System32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
[PID: 3884][D:\Program Files\BitComet\BitComet.exe]  [www.BitComet.com, 0.81]
    [E:\ast\ast\AST.dll]  [DSW Lab, 1.0.0.1]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll]  [Kaspersky Lab, 1.0.6.299]
[PID: 2636][C:\Program Files\Windows Media Player\mplayer2.exe]  [N/A, N/A]
    [E:\ast\ast\AST.dll]  [DSW Lab, 1.0.0.1]
    [D:\Program Files\Ringz Studio\Storm Codec\Codecs\VSFilter.dll]  [Gabest, 1, 0, 1, 3]
    [D:\Program Files\Ringz Studio\Storm Codec\Codecs\PmpSplt.ax]  [cooleyes, 1, 0, 0, 8]
    [D:\Program Files\Ringz Studio\Storm Codec\Codecs\RMSplt.ax]  [Gabest, 1, 0, 1, 1]
    [C:\WINDOWS\System32\ffdshow.ax]  [N/A, 1.0.2.2028]
    [D:\Program Files\Ringz Studio\Storm Codec\Codecs\TTL2Dec.dll]  [N/A, N/A]
    [D:\Program Files\Ringz Studio\Storm Codec\Codecs\Vid1Dec.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\xvid.ax]  [N/A, N/A]
    [C:\WINDOWS\System32\xvidcore.dll]  [N/A, N/A]
    [D:\Program Files\Ringz Studio\Storm Codec\Codecs\ff_liba52.dll]  [N/A, N/A]
[PID: 2784][D:\Program Files\Tencent\QQ.exe]  [TENCENT, 0, 0, 0, 0]
    [D:\Program Files\Tencent\CoralAssist.DLL]  [Coral Team, 4.5.0 build 20060515]
    [D:\Program Files\Tencent\CoralQQ.DLL]  [Coral Team, 4.5.4 Build 20061001]
    [D:\Program Files\Tencent\ipsearcher.dll]  [N/A, 1.0.0.4]
    [D:\Program Files\Tencent\QQBaseClassInDll.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQHelperDll.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\BasicCtrlDll.dll]  [Tencent, 5, 0, 200, 370]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
    [E:\ast\ast\AST.dll]  [DSW Lab, 1.0.0.1]
    [D:\Program Files\Tencent\QQAPI.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\LoginCtrl.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\npkcntc.dll]  [INCA Internet Co., Ltd., 2006, 6, 27, 1]
    [D:\Program Files\Tencent\npkpdb.dll]  [INCA Internet Co., Ltd., 2003, 10, 1, 1]
[PID: 2164][D:\sreng2\SREng\SREng.exe]  [Smallfrogs Studio, 2.2.6.605]
    [E:\ast\ast\AST.dll]  [DSW Lab, 1.0.0.1]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]

==================================
文件关联
.TXT  Error. [NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
gototop
 
老衲法号星星
头像
初生襁褓狮
  • 帖子:227
  • 注册: 2007-01-04
  • 来自:
发表于： 2007-01-20 14:37 | 短消息 资料
字号： 小 中 大 5楼

刪除
[Secdrv / Secdrv]
<System32\DRIVERS\secdrv.sys>
gototop
 
<<上一主题|下一主题>>
1   1  /  1  页   跳转页
页面顶部
Powered by Discuz!NT