【回复“GYGYGY1”的帖子】
浏览器加载项
[超级兔子上网精灵]
{7369D35A-5B70-4A5B-B789-B25FE09B4AF3} <D:\Program Files\Super Rabbit\MagicSet\haokanbar.dll, Xiang Feng Technology>
[Web反病毒保护]
{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <F:\My tools\KAV\k\scieplugin.dll, Kaspersky Lab>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <F:\My tools\QQ2005\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <F:\My tools\QQ2005\QQIEHelper.dll, N/A>
[@msdxmLC.dll,-1@2052,电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <D:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[超级兔子上网精灵]
{43869BB3-22FD-4F15-9B46-238106BA2F4E} <D:\Program Files\Super Rabbit\MagicSet\haokanbar.dll, Xiang Feng Technology>
[Shockwave Flash
Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <D:\WINNT\system32\Macromed\Flash\Flash.OCX, Macromedia, Inc.>
[导出到 Microsoft Excel(&x)]
<res://E:\OFFICE~1\OFFICE\Office10\EXCEL.EXE/3000, N/A>
==================================
正在运行的进程
[PID: 220][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.00.2195.6601]
[PID: 244][\??\D:\WINNT\system32\csrss.exe] [Microsoft Corporation, 5.00.2195.6601]
[PID: 240][\??\D:\WINNT\system32\winlogon.exe] [Microsoft Corporation, 5.00.2195.6970]
[D:\WINNT\system32\wdmaud.drv] [Microsoft Corporation, 5.00.2195.6673]
[D:\WINNT\system32\klogon.dll] [Kaspersky Lab, 6.0.0.299]
[D:\WINNT\system32\msacm32.drv] [Microsoft Corporation, 5.00.2134.1]
[PID: 296][D:\WINNT\system32\services.exe] [Microsoft Corporation, 5.00.2195.6700]
[D:\WINNT\system32\dmserver.dll] [VERITAS Software Corp., 2195.6605.297.3]
[PID: 308][D:\WINNT\system32\lsass.exe] [Microsoft Corporation, 5.00.2195.6902]
[PID: 516][D:\WINNT\system32\svchost.exe] [Microsoft Corporation, 5.00.2134.1]
[PID: 564][D:\WINNT\system32\svchost.exe] [Microsoft Corporation, 5.00.2134.1]
[PID: 592][D:\WINNT\system32\svchost.exe] [Microsoft Corporation, 5.00.2134.1]
[D:\WINNT\system32\unimdm.tsp] [Microsoft Corporation, 5.00.2195.6601]
[D:\WINNT\system32\kmddsp.tsp] [Microsoft Corporation, 5.00.2150.1]
[D:\WINNT\system32\ndptsp.tsp] [Microsoft Corporation, 5.00.2143.1]
[D:\WINNT\system32\ipconf.tsp] [Microsoft Corporation, 5.00.2143.1]
[D:\WINNT\system32\h323.tsp] [Microsoft Corporation, 5.00.2195.6901]
[PID: 632][D:\WINNT\system32\MSTask.exe] [Microsoft Corporation, 4.71.2195.6920]
[PID: 988][D:\WINNT\system32\internat.exe] [Microsoft Corporation, 5.00.2920.0000]
[PID: 1308][F:\DATA\同花顺核新\LiveUpdate.exe] [上海核新软件技术有限公司, 2006, 11, 2, 0]
[F:\DATA\同花顺核新\RICHED20.dll] [Microsoft Corporation, 5.30.23.1205]
[PID: 1388][D:\WINNT\explorer.exe] [Microsoft Corporation, 5.00.3700.6690]
[D:\WINNT\AppPatch\AcLayers.DLL] [Microsoft Corporation, 5.00.2195.6717]
[D:\WINNT\system32\AcSignIcon.dll] [Autodesk, 16.1.63.0]
[D:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] [Autodesk, 16.1.63.0]
[D:\WINNT\system32\wdmaud.drv] [Microsoft Corporation, 5.00.2195.6673]
[D:\WINNT\system32\msacm32.drv] [Microsoft Corporation, 5.00.2134.1]
[F:\My tools\KAV\k\scr_ch_pg.dll] [Kaspersky Lab, 1.0.6.299]
[D:\WINNT\system32\MSVCP60.dll] [Microsoft Corporation, 6.00.8972.0]
[F:\My tools\KAV\k\klscav.dll] [Kaspersky Lab, 6.0.0.299]
[F:\My tools\KAV\k\pr_remote.dll] [Kaspersky Lab, 6.0.0.299]
[F:\My tools\KAV\k\prloader.dll] [Kaspersky Lab, 6.0.0.299]
[F:\My tools\KAV\k\prkernel.ppl] [Kaspersky Lab, 6.0.0.299]
[f:\my tools\kav\k\params.ppl] [Kaspersky Lab, 6.0.0.299]
[f:\my tools\kav\k\pxstub.ppl] [Kaspersky Lab, 6.0.0.299]
[f:\my tools\kav\k\tempfile.ppl] [Kaspersky Lab, 6.0.0.299]
[f:\my tools\kav\k\nfio.ppl] [Kaspersky Lab, 6.0.0.299]
[f:\my tools\kav\k\fsdrvplgn.ppl] [Kaspersky Lab, 6.0.0.299]
[D:\WINNT\system32\msadp32.acm] [Microsoft Corporation, 5.00.2134.1]
[D:\WINNT\system32\wmploc.dll] [Microsoft Corporation, 9.00.00.2980]
[D:\WINNT\system32\WMASF.DLL] [Microsoft Corporation, 9.00.00.2980 built by: lab03_dev(bld4act)]
[D:\WINNT\system32\wmnetmgr.dll] [Microsoft Corporation, 9.00.00.2980]
[E:\OFFICE XP SP2\OFFICE\Office10\msohev.dll] [Microsoft Corporation, 10.0.2609]
[F:\My tools\KAV\k\shellex.dll] [Kaspersky Lab, 6.0.0.299]
[PID: 336][D:\WINNT\system32\rundll32.exe] [Microsoft Corporation, 5.00.2134.1]
[D:\WINNT\system32\AcSignIcon.dll] [Autodesk, 16.1.63.0]
[PID: 1020][F:\My tools\SREN\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR Error. [AutoCADScriptFile]
.CHM Error. ["hh.exe" %1]
.HLP Error. [winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1 localhost
127.0.0.1 mmsk.cn
127.0.0.1 bbs.mmsk.cn
127.0.0.1 www.mmsk.cn
127.0.0.1 soudong.com
127.0.0.1 www.soudong.com
==================================
API HOOK
RVA 错误： LoadLibraryA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xBE944B25)
RVA 错误： LoadLibraryExA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xBE944D67)
RVA 错误： LoadLibraryExW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xBE944F0B)
RVA 错误： LoadLibraryW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xBE944C49)
RVA 错误： GetProcAddress (危险等级: 高, 被下面模块所HOOK: Dest Addr: 0xBE944E8F)
==================================
隐藏进程
N/A
