==================================
正在运行的进程
[PID: 696 / SYSTEM][\SystemRoot\System32\smss.exe] [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 760 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 792 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 840 / SYSTEM][C:\WINDOWS\system32\services.exe] [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 852 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1012 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1068 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1360 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1404 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1500 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1980 / u2k][C:\WINDOWS\Explorer.EXE] [(Verified) Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 2, 0, 1005]
[C:\Program Files\Thunder Network\WebThunder\WebThunderBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 8, 75]
[C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.762]
[PID: 2020 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [(Verified) Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll] [Microsoft Corporation, 11.3.1897.0]
[PID: 392 / u2k][C:\WINDOWS\system32\rundll32.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 416 / u2k][C:\Program Files\Thunder Network\WebThunder\WebThunder.exe] [深圳市迅雷网络技术有限公司, 1, 13, 1, 224]
[C:\Program Files\Thunder Network\WebThunder\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 2, 0, 1005]
[C:\Program Files\Thunder Network\WebThunder\TaskManager.dll] [Thunder Networking Technologies,LTD, 1, 3, 1, 56]
[C:\Program Files\Thunder Network\WebThunder\download_interface.dll] [Thunder Networking Technologies,LTD, 2, 21, 2, 217]
[C:\Program Files\Thunder Network\WebThunder\stlport_vc646.dll] [STLport Consulting, Inc., 4.6.2003.1031]
[C:\Program Files\Thunder Network\WebThunder\asyn_dns.dll] [Thunder Networking Technologies,LTD, 2, 21, 2, 217]
[C:\Program Files\Thunder Network\WebThunder\streammedialib.dll] [, 1, 3, 2, 124]
[C:\Program Files\Thunder Network\WebThunder\al.dll] [, 1, 0, 1, 3]
[C:\Program Files\Thunder Network\WebThunder\bd.dll] [Thunder Networking Technologies,LTD, 1, 0, 2, 6]
[C:\Program Files\Thunder Network\WebThunder\RegisterDll.dll] [Thunder Networking Technologies,LTD, 2, 16, 5, 63]
[C:\Program Files\Thunder Network\WebThunder\CacheServer.dll] [, 1, 0, 0, 1]
[C:\Program Files\Thunder Network\WebThunder\XLSafe\SafeInfo.dll] [深圳市迅雷网络技术有限公司, 1, 0, 1, 2]
[C:\Program Files\Thunder Network\WebThunder\XLSafe\RMFScan.dll] [N/A, ]
[C:\Program Files\Thunder Network\WebThunder\XLNet.Dll] [Thunder Networking Technologies,LTD, 1, 3, 4, 18]
[C:\Program Files\Thunder Network\WebThunder\DownAndPlay\WebDownAndPlay.dll] [ShenZhen Thunder Networking Technologies Ltd., 1, 0, 4, 22]
[C:\Program Files\Thunder Network\WebThunder\XLStatistic\XLStatisticAddin.dll] [深圳市迅雷网络技术有限公司, 1, 4, 1, 5]
[C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx] [Adobe Systems, Inc., 9,0,124,0]
[PID: 432 / u2k][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] [RealNetworks, Inc., 0.1.0.3760]
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 2, 0, 1005]
[PID: 440 / u2k][C:\WINDOWS\system32\ctfmon.exe] [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1956 / SYSTEM][C:\WINDOWS\system32\Ati2evxx.exe] [, ]
[PID: 228 / SYSTEM][C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe] [N/A, ]
[C:\Program Files\IVT Corporation\BlueSoleil\Driver\USB\btcusb.dll] [IVT Corporation, 1, 2, 1, 0]
[PID: 592 / SYSTEM][C:\WINDOWS\system32\boboturbo\boboturbo.exe] [广州易播信息科技有限公司, 1, 8, 912, 6]
[PID: 624 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 740 / SYSTEM][C:\Program Files\StormII\stormliv.exe] [北京暴风网际科技有限公司, 3, 8, 8, 15]
[C:\Program Files\StormII\bfoptdll.dll] [北京暴风网际科技有限公司, 3, 8, 7, 16]
[C:\Program Files\StormII\box\BoxLog.dll] [北京暴风网际科技有限公司, 3, 8, 8, 21]
[PID: 1240 / u2k][C:\Program Files\StormII\box\stline.exe] [北京暴风网际科技有限公司, 3, 8, 8, 21]
[C:\Program Files\StormII\box\MovieBoxCore.dll] [北京暴风网际科技有限公司, 3, 8, 8, 21]
[C:\Program Files\StormII\box\HttpServer.dll] [北京暴风网际科技有限公司, 3, 8, 8, 21]
[C:\Program Files\StormII\box\BoxLog.dll] [北京暴风网际科技有限公司, 3, 8, 8, 21]
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 2, 0, 1005]
[C:\Program Files\StormII\Stormtra.dll] [北京暴风网际科技有限公司, 3, 8, 7, 25]
[C:\Program Files\StormII\StormtraRes.dll] [北京暴风网际科技有限公司, 3, 8, 7, 25]
[C:\Program Files\StormII\mps.dll] [北京暴风网际科技有限公司, 3, 8, 8, 15]
[C:\Program Files\StormII\bfoptdll.dll] [北京暴风网际科技有限公司, 3, 8, 7, 16]
[C:\Program Files\StormII\box\UiLib.dll] [北京暴风网际科技有限公司, 3, 8, 8, 21]
[C:\WINDOWS\system32\msdmo.dll] [, ]
[PID: 1600 / SYSTEM][C:\WINDOWS\system32\PnkBstrA.exe] [N/A, ]
[PID: 1832 / SYSTEM][d:\QvodPlayer\QvodTerminal.exe] [Shenzhen QVOD Technology Co.,Ltd, 3, 0, 0, 55]
[PID: 1848 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2060 / SYSTEM][C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe] [Ulead Systems, Inc., 1, 0, 0, 4]
[PID: 2108 / SYSTEM][E:\VMware Workstation\vmware-authd.exe] [VMware, Inc., 5.5.1 build-19175]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[PID: 2152 / SYSTEM][C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe] [VMware, Inc., 5.5.1 build-19175]
[C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmxScsiLib.dll] [VMware, Inc., 5.5.1 build-19175]
[C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[PID: 2176 / SYSTEM][C:\WINDOWS\system32\vmnat.exe] [VMware, Inc., 5.5.1 build-19175]
[PID: 2264 / SYSTEM][C:\WINDOWS\system32\vmnetdhcp.exe] [VMware, Inc., 5.5.1 build-19175]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[PID: 3228 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1680 / u2k][C:\PROGRA~1\360safe\360se\360Start.exe] [360安全中心 & 凤凰工作室, 1, 0, 1, 9]
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 2, 0, 1005]
[PID: 1688 / u2k][C:\PROGRA~1\360safe\360se\360SE.exe] [360安全中心 & 凤凰工作室, 1, 0, 3, 2]
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 2, 0, 1005]
[C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.762]
[C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx] [Adobe Systems, Inc., 9,0,124,0]
[PID: 2912 / u2k][d:\Tencent\QQ\TXPlatform.exe] [Tencent, 1, 5, 225, 0]
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 2, 0, 1005]
[PID: 2076 / u2k][C:\Documents and Settings\u2k\桌面\sreng2\SREngLdr.EXE] [Smallfrogs Studio, 2.7.0.1210]
[PID: 3464 / u2k][C:\Documents and Settings\u2k\桌面\sreng2\SREf4a00953.EXE] [Smallfrogs Studio, 2.7.0.1210]
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 2, 0, 1005]
[C:\Documents and Settings\u2k\桌面\sreng2\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1 localhost
==================================
进程特权扫描
特殊特权被允许: SeLoadDriverPrivilege [PID = 228, C:\PROGRAM FILES\IVT CORPORATION\BLUESOLEIL\BTNTSERVICE.EXE]
特殊特权被允许: SeLoadDriverPrivilege [PID = 1240, C:\PROGRAM FILES\STORMII\BOX\STLINE.EXE]
特殊特权被允许: SeLoadDriverPrivilege [PID = 2152, C:\PROGRAM FILES\COMMON FILES\VMWARE\VMWARE VIRTUAL IMAGE EDITING\VMOUNT2.EXE]
特殊特权被允许: SeLoadDriverPrivilege [PID = 2076, C:\DOCUMENTS AND SETTINGS\U2K\桌面\SRENG2\SRENGLDR.EXE]
==================================
计划任务
N/A
==================================
API HOOK
N/A
==================================
隐藏进程
N/A
==================================
[/CODE]