==================================
正在运行的进程
[PID: 444 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 508 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 536 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\Ati2evxx.dll] [ATI Technologies Inc., 6.14.10.4118]
[PID: 580 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 592 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 744 / SYSTEM][C:\WINDOWS\system32\Ati2evxx.exe] [ATI Technologies Inc., 6.14.10.4118]
[C:\WINDOWS\system32\Ati2edxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2497]
[PID: 756 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 828 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 892 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 944 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1068 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1236 / SYSTEM][C:\KAV2005\KWatch.EXE] [Kingsoft Corporation, 2007, 8, 13, 78]
[C:\KAV2005\KAVIPC2.DLL] [Kingsoft Corporation, 2007, 1, 15, 30]
[C:\KAV2005\KAEPlat.DLL] [Kingsoft Corp., 2007, 2, 4, 61]
[C:\KAV2005\KAEMem.DAT] [Kingsoft, 2006, 9, 25, 16]
[C:\KAV2005\KAEUnpack.DAT] [Kingsoft Corporation, 2008,01,25,202]
[C:\KAV2005\KAVQuara.DLL] [Kingsoft Corporation, 2007, 6, 15, 4]
[PID: 1252 / ssssssss][C:\WINDOWS\system32\Ati2evxx.exe] [ATI Technologies Inc., 6.14.10.4118]
[C:\WINDOWS\system32\Ati2edxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2497]
[C:\KAV2005\KASocket.dll] [Kingsoft Corporation, 2006, 12, 21, 241]
[PID: 1308 / ssssssss][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\KAV2005\KASocket.dll] [Kingsoft Corporation, 2006, 12, 21, 241]
[C:\KAV2005\KMailOEBand.dll] [Kingsoft Corporation, 2006, 12, 1, 139]
[C:\KAV2005\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\KAV2005\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\msdmo.dll] [, ]
[D:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 2, 0, 1005]
[C:\WINDOWS\system32\nvcpl.dll] [NVIDIA Corporation, 6.14.10.7184]
[PID: 1420 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[PID: 1672 / ssssssss][C:\WINDOWS\SOUNDMAN.EXE] [Realtek Semiconductor Corp., 5.1.0.42]
[C:\KAV2005\KASocket.dll] [Kingsoft Corporation, 2006, 12, 21, 241]
[PID: 1684 / ssssssss][C:\Program Files\联想\联想标准功能键盘\SkDaemond.exe] [联想, 1, 0, 0, 1]
[C:\Program Files\联想\联想标准功能键盘\Ctrdev.dll] [-, 1, 0, 0, 0]
[C:\Program Files\联想\联想标准功能键盘\SKUtil.DLL] [Silitek Corp., 1, 0, 7, 0]
[C:\KAV2005\KASocket.dll] [Kingsoft Corporation, 2006, 12, 21, 241]
[PID: 1696 / ssssssss][C:\Program Files\lenovo\StateChange\QuakeII.exe] [联想, 1.0.0.1]
[C:\Program Files\lenovo\StateChange\QuakeII.dll] [
http://www.lenovo.com, 2.0]
[C:\WINDOWS\system32\smbus.dll] [, 1.0.5.2]
[C:\WINDOWS\system32\canio.dll] [Chris St. Amand, 1, 0, 0, 2]
[C:\KAV2005\KASocket.dll] [Kingsoft Corporation, 2006, 12, 21, 241]
[C:\KAV2005\KMailOEBand.dll] [Kingsoft Corporation, 2006, 12, 1, 139]
[C:\KAV2005\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\KAV2005\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\Flash7.ocx] [Macromedia, Inc., 7,0,14,0]
[PID: 1704 / ssssssss][C:\KAV2005\KAVStart.exe] [Kingsoft Corporation, 2007, 4, 2, 267]
[C:\KAV2005\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\KAV2005\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\KAV2005\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\KAV2005\MFC71CHS.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\KAV2005\KAVIPC2.DLL] [Kingsoft Corporation, 2007, 1, 15, 30]
[C:\KAV2005\SvcTimer.DLL] [Kingsoft Corporation, 2006.12.22.84]
[C:\KAV2005\KAVPassp.dll] [Kingsoft Corporation, 2008,01,17,183]
[C:\KAV2005\PopSprt3.dll] [Kingsoft Corporation, 2007, 1, 16, 45]
[C:\KAV2005\KASocket.dll] [Kingsoft Corporation, 2006, 12, 21, 241]
[C:\KAV2005\KMailOEBand.dll] [Kingsoft Corporation, 2006, 12, 1, 139]
[D:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 2, 0, 1005]
[PID: 1712 / ssssssss][C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe] [ATI Technologies, Inc., 6.14.10.5160]
[C:\Program Files\ATI Technologies\ATI Control Panel\atipdsxx.dll] [ATI Technologies, Inc., 6.14.10.5160]
[C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATRPUIXX.CHS] [ATI Technologies, Inc., 6.14.10.5160]
[C:\Program Files\ATI Technologies\ATI Control Panel\atipdxxx.dll] [ATI Technologies, Inc., 6.14.10.5160]
[C:\KAV2005\KASocket.dll] [Kingsoft Corporation, 2006, 12, 21, 241]
[PID: 1728 / ssssssss][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\KAV2005\KASocket.dll] [Kingsoft Corporation, 2006, 12, 21, 241]
[C:\KAV2005\KMailOEBand.dll] [Kingsoft Corporation, 2006, 12, 1, 139]
[C:\KAV2005\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\KAV2005\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[PID: 1744 / ssssssss][C:\Program Files\Messenger\msmsgs.exe] [Microsoft Corporation, 4.7.3000]
[C:\KAV2005\KASocket.dll] [Kingsoft Corporation, 2006, 12, 21, 241]
[C:\KAV2005\KMailOEBand.dll] [Kingsoft Corporation, 2006, 12, 1, 139]
[C:\KAV2005\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\KAV2005\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[PID: 1916 / ssssssss][C:\KAV2005\KMailMon.EXE] [Kingsoft Corporation, 2007, 2, 25, 948]
[C:\KAV2005\KAntiSpm.dll] [Kingsoft Corporation, 2007, 2, 25, 129]
[C:\KAV2005\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\KAV2005\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\KAV2005\KAVIPC2.DLL] [Kingsoft Corporation, 2007, 1, 15, 30]
[C:\KAV2005\KAECall2.DLL] [Kingsoft Corporation, 2004, 12, 28, 7]
[C:\KAV2005\KAEPlat.DLL] [Kingsoft Corp., 2007, 2, 4, 61]
[C:\KAV2005\KAEMem.DAT] [Kingsoft, 2006, 9, 25, 16]
[C:\KAV2005\KAEUnpack.DAT] [Kingsoft Corporation, 2008,01,25,202]
[C:\KAV2005\KAConfig.DLL] [Kingsoft Corporation, 2007, 1, 11, 41]
[C:\KAV2005\KASocket.dll] [Kingsoft Corporation, 2006, 12, 21, 241]
[C:\KAV2005\KMailOEBand.dll] [Kingsoft Corporation, 2006, 12, 1, 139]
[PID: 2060 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2788 / ssssssss][C:\KAV2005\KAV32.EXE] [Kingsoft Corporation, 2007, 11, 28, 267]
[C:\KAV2005\KMailOEBand.dll] [Kingsoft Corporation, 2006, 12, 1, 139]
[C:\KAV2005\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\KAV2005\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\KAV2005\KASocket.dll] [Kingsoft Corporation, 2006, 12, 21, 241]
[C:\KAV2005\KAV32Res.dll] [Kingsoft Corporation, 2007, 4, 28, 111]
[C:\KAV2005\KAConfig.DLL] [Kingsoft Corporation, 2007, 1, 11, 41]
[C:\KAV2005\KAEPlat.DLL] [Kingsoft Corp., 2007, 2, 4, 61]
[C:\KAV2005\KAEMem.DAT] [Kingsoft, 2006, 9, 25, 16]
[C:\KAV2005\KAEUnpack.DAT] [Kingsoft Corporation, 2008,01,25,202]
[C:\KAV2005\KAVIPC2.DLL] [Kingsoft Corporation, 2007, 1, 15, 30]
[C:\KAV2005\KAVPassp.DLL] [Kingsoft Corporation, 2008,01,17,183]
[C:\KAV2005\DBAgent.DLL] [Kingsoft Corporation, 2005, 10, 27, 9]
[C:\KAV2005\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\KAV2005\MFC71CHS.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\KAV2005\KAScript.DLL] [Kingsoft Corporation, 2007, 3, 6, 75]
[C:\Flash7.ocx] [Macromedia, Inc., 7,0,14,0]
[C:\KAV2005\KAVQuara.DLL] [Kingsoft Corporation, 2007, 6, 15, 4]
[C:\KAV2005\KWindUp.DLL] [Kingsoft Corp., 2006, 1, 10, 18]
[C:\KAV2005\KAEPrev.dll] [Kingsoft Corporation, 2007, 3, 19, 31]
[C:\KAV2005\KAEMemEx.dll] [, 2006, 10, 17, 16]
[C:\KAV2005\KAEMalDt.dll] [, 2007, 3, 26, 22]
[C:\KAV2005\KAERemov.dll] [, 2007, 2, 5, 26]
[D:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 2, 0, 1005]
[PID: 2964 / ssssssss][C:\WINDOWS\system32\wuauclt.exe] [Microsoft Corporation, 5.4.3790.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\KAV2005\KMailOEBand.dll] [Kingsoft Corporation, 2006, 12, 1, 139]
[C:\KAV2005\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\KAV2005\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\KAV2005\KASocket.dll] [Kingsoft Corporation, 2006, 12, 21, 241]
[PID: 1972 / ssssssss][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\KAV2005\KMailOEBand.dll] [Kingsoft Corporation, 2006, 12, 1, 139]
[C:\KAV2005\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\KAV2005\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\KAV2005\KASocket.dll] [Kingsoft Corporation, 2006, 12, 21, 241]
[PID: 3784 / ssssssss][D:\Program Files\360safe\safemon\360Tray.exe] [奇虎网, 4, 1, 8, 1004]
[C:\KAV2005\KMailOEBand.dll] [Kingsoft Corporation, 2006, 12, 1, 139]
[C:\KAV2005\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\KAV2005\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\KAV2005\KASocket.dll] [Kingsoft Corporation, 2006, 12, 21, 241]
[D:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 2, 0, 1005]
[D:\Program Files\360safe\safemon\SafeKrnl.dll] [奇虎网, 4, 2, 0, 1001]
[D:\Program Files\360safe\AntiAdwa.dll] [360Safe.com, 4, 2, 0, 1001]
[D:\Program Files\360safe\live.dll] [360.cn, 1, 0, 1, 1027]
[C:\KAV2005\KAScript.DLL] [Kingsoft Corporation, 2007, 3, 6, 75]
[PID: 648 / ssssssss][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 2, 0, 1005]
[C:\KAV2005\KMailOEBand.dll] [Kingsoft Corporation, 2006, 12, 1, 139]
[C:\KAV2005\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\KAV2005\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\KAV2005\KASocket.dll] [Kingsoft Corporation, 2006, 12, 21, 241]
[C:\KAV2005\KAScript.DLL] [Kingsoft Corporation, 2007, 3, 6, 75]
[C:\KAV2005\KAEPlat.DLL] [Kingsoft Corp., 2007, 2, 4, 61]
[C:\KAV2005\KAEMem.DAT] [Kingsoft, 2006, 9, 25, 16]
[C:\KAV2005\KAEUnpack.DAT] [Kingsoft Corporation, 2008,01,25,202]
[C:\Flash7.ocx] [Macromedia, Inc., 7,0,14,0]
[PID: 3196 / ssssssss][D:\Program Files\360safe\360Safe.exe] [奇虎网, 4, 2, 0, 1010]
[D:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 2, 0, 1005]
[C:\KAV2005\KMailOEBand.dll] [Kingsoft Corporation, 2006, 12, 1, 139]
[C:\KAV2005\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\KAV2005\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\KAV2005\KASocket.dll] [Kingsoft Corporation, 2006, 12, 21, 241]
[D:\Program Files\360safe\AntiAdwa.dll] [360Safe.com, 4, 2, 0, 1001]
[D:\Program Files\360safe\AntiEng.dll] [360Safe.com, 4, 2, 0, 1001]
[D:\Program Files\360safe\LeakCheck.dll] [360Safe.com, 4, 2, 0, 1004]
[D:\Program Files\360safe\CleanHis.dll] [奇虎网, 4, 2, 0, 1002]
[C:\KAV2005\KAScript.DLL] [Kingsoft Corporation, 2007, 3, 6, 75]
[PID: 3336 / ssssssss][D:\Program Files\360safe\360hotfix.exe] [奇虎网, 4, 2, 0, 1005]
[D:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 2, 0, 1005]
[C:\KAV2005\KMailOEBand.dll] [Kingsoft Corporation, 2006, 12, 1, 139]
[C:\KAV2005\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\KAV2005\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\KAV2005\KASocket.dll] [Kingsoft Corporation, 2006, 12, 21, 241]
[D:\Program Files\360safe\LeakCheck.dll] [360Safe.com, 4, 2, 0, 1004]
[C:\KAV2005\KAScript.DLL] [Kingsoft Corporation, 2007, 3, 6, 75]
[PID: 2596 / ssssssss][C:\Documents and Settings\ssssssss\桌面\已释放的2[1].6.12.1018\已释放的2.6.12.1018\SRE9d2c65c3.EXE] [Smallfrogs Studio, 2.6.12.1018]
[D:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 2, 0, 1005]
[C:\KAV2005\KMailOEBand.dll] [Kingsoft Corporation, 2006, 12, 1, 139]
[C:\KAV2005\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\KAV2005\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\KAV2005\KASocket.dll] [Kingsoft Corporation, 2006, 12, 21, 241]
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1 localhost
==================================
进程特权扫描
特殊特权被允许: SeLoadDriverPrivilege [PID = 1684, C:\PROGRAM FILES\联想\联想标准功能键盘\SKDAEMOND.EXE]
特殊特权被允许: SeLoadDriverPrivilege [PID = 1696, C:\PROGRAM FILES\LENOVO\STATECHANGE\QUAKEII.EXE]
特殊特权被允许: SeLoadDriverPrivilege [PID = 1704, C:\KAV2005\KAVSTART.EXE]
特殊特权被允许: SeLoadDriverPrivilege [PID = 1712, C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE]
特殊特权被允许: SeDebugPrivilege [PID = 1916, C:\KAV2005\KMAILMON.EXE]
特殊特权被允许: SeLoadDriverPrivilege [PID = 1916, C:\KAV2005\KMAILMON.EXE]
特殊特权被允许: SeDebugPrivilege [PID = 2788, C:\KAV2005\KAV32.EXE]
特殊特权被允许: SeLoadDriverPrivilege [PID = 2788, C:\KAV2005\KAV32.EXE]
==================================
API HOOK
入口点错误:LoadLibraryExW (危险等级: 高, 被下面模块所HOOK: C:\KAV2005\KASocket.dll)
==================================
隐藏进程
N/A
[/CODE]