[C:\Program Files\sanlen\AntiUnknown\SNASafe.dll] [山丽网安, 1, 0, 0, 3]
[C:\Program Files\sanlen\AntiUnknown\SNASCKI.dll] [山丽网安, 2, 0, 0, 1]
[C:\Program Files\sanlen\AntiUnknown\SNARMW.DLL] [山丽网安, 2, 0, 0, 1]
[C:\Program Files\sanlen\AntiUnknown\SNARES.dll] [Sanlen, 1, 0, 0, 1]
[C:\Program Files\sanlen\AntiUnknown\SNAMsgBx.dll] [山丽网安, 2, 0, 0, 1]
[C:\Program Files\sanlen\AntiUnknown\SRINTER.DLL] [山丽网安, 1, 0, 0, 1]
[C:\Program Files\sanlen\AntiUnknown\snappp.dll] [N/A, ]
[PID: 3228][C:\WINDOWS\system32\rundll32.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\PROGRA~1\3721\helper.dll] [国风因特软件（北京）有限公司, 2.5.5.1008]
[C:\PROGRA~1\3721\CnsM.dll] [, 2.5.6.1009]
[C:\Program Files\sanlen\AntiUnknown\snappp.dll] [N/A, ]
[C:\PROGRA~1\3721\autolive.dll] [国风因特软件（北京）有限公司, 2.5.8.1013]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 2, 1020]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ypatch.dll] [Yahoo! China, 3, 0, 8, 1014]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 1, 5, 3, 9]
[C:\PROGRA~1\3721\alLiveEx.dll] [国风因特软件（北京）有限公司, 1.0.4.1007]
[C:\PROGRA~1\3721\notifier.dll] [国风因特软件（北京）有限公司, 2.5.2.1004]
[PID: 1392][C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe] [Yahoo! China, 3, 0, 8, 1014]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ypatch.dll] [Yahoo! China, 3, 0, 8, 1014]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 2, 1020]
[C:\PROGRA~1\3721\CnsM.dll] [, 2.5.6.1009]
[C:\PROGRA~1\3721\helper.dll] [国风因特软件（北京）有限公司, 2.5.5.1008]
[C:\Program Files\sanlen\AntiUnknown\snappp.dll] [N/A, ]
[C:\PROGRA~1\Yahoo!\ASSIST~1\yalive.dll] [yahoo! china, 3, 3, 5, 1086]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 1, 5, 3, 9]
[PID: 3480][C:\WINDOWS\system32\Rundll32.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 1, 5, 3, 9]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 2, 1020]
[C:\PROGRA~1\3721\CnsM.dll] [, 2.5.6.1009]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ypatch.dll] [Yahoo! China, 3, 0, 8, 1014]
[C:\PROGRA~1\3721\helper.dll] [国风因特软件（北京）有限公司, 2.5.5.1008]
[C:\Program Files\sanlen\AntiUnknown\snappp.dll] [N/A, ]
[C:\WINDOWS\DOWNLO~1\CnsMinIO.dll] [国风因特软件（北京）有限公司, 2.5.0.7]
[C:\WINDOWS\DOWNLO~1\cnsio.dll] [国风因特软件（北京）有限公司, 2.5.0.5]
[PID: 2316][F:\TDDOWNLOAD\sreng2\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]
[C:\PROGRA~1\3721\CnsM.dll] [, 2.5.6.1009]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 1, 5, 3, 9]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 2, 1020]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ypatch.dll] [Yahoo! China, 3, 0, 8, 1014]
[C:\PROGRA~1\3721\helper.dll] [国风因特软件（北京）有限公司, 2.5.5.1008]
[C:\Program Files\sanlen\AntiUnknown\snappp.dll] [N/A, ]
[C:\Program Files\Yuguo\idle.dll] [N/A, ]
[F:\TDDOWNLOAD\sreng2\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]
[PID: 3016][C:\Program Files\Rising\AntiSpyware\Ras.exe] [Beijing Rising Technology Co., Ltd., 4.0.0.71]
[C:\Program Files\Rising\AntiSpyware\MSVCP60.dll] [Microsoft Corporation, 6.00.8972.0]
[C:\Program Files\Rising\AntiSpyware\TopSoft.dll] [Beijing Rising Technology Co., Ltd., 4.0.0.3]
[C:\Program Files\Rising\AntiSpyware\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\Program Files\Rising\AntiSpyware\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\Program Files\Rising\AntiSpyware\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[F:\瑞星杀毒\Rising\Rav\ProcCom.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[F:\瑞星杀毒\Rising\Rav\RsCommX2.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[C:\Program Files\Rising\AntiSpyware\RasGui.dll] [Beijing Rising Technology Co., Ltd., 2, 0, 0, 15]
[C:\WINDOWS\system32\WINWB86.IME] [Microsoft Corporation, 4.00.950]
[PID: 1968][C:\WINDOWS\explorer.exe] [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234)]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 1, 5, 3, 9]
[C:\PROGRA~1\3721\CnsM.dll] [, 2.5.6.1009]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 2, 1020]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ypatch.dll] [Yahoo! China, 3, 0, 8, 1014]
[C:\PROGRA~1\3721\helper.dll] [国风因特软件（北京）有限公司, 2.5.5.1008]
[C:\PROGRA~1\3721\alrex.dll] [国风因特软件（北京）有限公司, 2.5.2.1004]
[C:\Program Files\sanlen\AntiUnknown\snappp.dll] [N/A, ]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\Yuguo\idle.dll] [N/A, ]
[PID: 3052][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 1, 5, 3, 9]
[C:\PROGRA~1\3721\CnsM.dll] [, 2.5.6.1009]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 2, 1020]
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ypatch.dll] [Yahoo! China, 3, 0, 8, 1014]
[C:\PROGRA~1\3721\helper.dll] [国风因特软件（北京）有限公司, 2.5.5.1008]
[C:\Program Files\sanlen\AntiUnknown\snappp.dll] [N/A, ]
==================================
文件关联
.TXT Error. [notepad.exe %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG Error. [regedit.exe %1]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI Error. [notepad.exe %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1 localhost
==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 2056, C:\PROGRAM FILES\SANLEN\ANTIUNKNOWN\SNATASK.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2228, C:\PROGRAM FILES\SANLEN\ANTIUNKNOWN\SYSWARN.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2328, C:\PROGRAM FILES\SANLEN\ANTIUNKNOWN\SNAREGMN.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 1392, C:\PROGRA~1\YAHOO!\ASSIST~1\YLIVE.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1392, C:\PROGRA~1\YAHOO!\ASSIST~1\YLIVE.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 3016, C:\PROGRAM FILES\RISING\ANTISPYWARE\RAS.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3016, C:\PROGRAM FILES\RISING\ANTISPYWARE\RAS.EXE]
==================================
API HOOK
N/A
==================================
隐藏进程
N/A
==================================
[/CODE]
