==================================
正在运行的进程
[PID: 704 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[PID: 768 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[PID: 792 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2113)]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 848 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[C:\WINDOWS\AppPatch\AcAdProc.dll] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2105)]
[PID: 860 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2113)]
[PID: 1020 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[PID: 1080 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[PID: 1200 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[PID: 1256 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[PID: 1776 / Administrator][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[d:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll] [Thunder Networking Technologies,LTD, 1.0.5.29]
[d:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 8, 96]
[d:\Program Files\Thunder Network\Thunder\Components\ResWorker\DsBho_01.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 20]
[d:\Program Files\Thunder Network\Thunder\Components\ResWorker\DataProcessor_01.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 16]
[C:\WINDOWS\system32\msdmo.dll] [, ]
[D:\Program Files\Nokia\Nokia PC Suite 6\phonebrowser.dll] [Nokia, 6, 85, 89, 5]
[D:\Program Files\Nokia\Nokia PC Suite 6\PCSCM.dll] [Nokia, 6, 85, 107, 5]
[D:\Program Files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_chi-sc.nlr] [Nokia, 6, 85, 59, 0]
[D:\Program Files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr] [Nokia, 6, 85, 17, 0]
[d:\Program Files\WinRAR\rarext.dll] [N/A, ]
[C:\Program Files\Common Files\JDVTMPDX.dat] [N/A, ]
[C:\WINDOWS\system32\icm32.dll] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2105)]
[d:\PROGRA~1\StormII\3\spfa.dll] [北京暴风网际科技有限公司, 2, 7, 4, 2]
[PID: 1908 / Administrator][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2105)]
[C:\Program Files\Common Files\JDVTMPDX.dat] [N/A, ]
[PID: 1916 / Administrator][D:\Program Files\Kingsoft\Antiarp\KASArp.EXE] [Kingsoft Corporation, 2008,01,24,160]
[D:\Program Files\Kingsoft\Antiarp\kantiarpdevc.dll] [Kingsoft Corporation, 2007,12,18,123]
[D:\Program Files\Kingsoft\Antiarp\NetConfig.dll] [Kingsoft Corporation, 2007,12,18,123]
[C:\Program Files\Common Files\JDVTMPDX.dat] [N/A, ]
[PID: 1924 / Administrator][D:\Program Files\Tencent\Foxmail\Foxmail.exe] [Tencent Inc., 6, 10, 201, 20]
[C:\WINDOWS\system32\MAPI32.DLL] [Microsoft Corporation, 1.0.2536.0 (XPClient.010817-1148)]
[D:\Program Files\Tencent\Foxmail\FoxAntiSpam.dll] [N/A, ]
[D:\Program Files\Tencent\Foxmail\pcre.dll] [N/A, ]
[D:\Program Files\Tencent\Foxmail\3rdParty\punylib.dll] [CNNIC, 1, 0, 0, 3]
[C:\Program Files\Common Files\JDVTMPDX.dat] [N/A, ]
[PID: 136 / SYSTEM][C:\WINDOWS\system32\nvsvc32.exe] [NVIDIA Corporation, 6.14.11.6921]
[C:\WINDOWS\system32\nvapi.dll] [NVIDIA Corporation, 6.14.11.6921]
[C:\Program Files\Common Files\JDVTMPDX.dat] [N/A, ]
[PID: 932 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[PID: 1500 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-0852)]
[PID: 620 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[PID: 4000 / Administrator][D:\Program Files\China Mobile\Fetion\VmDotNet\v2.0.50727\FetionVM.exe] [China Mobile, 1.0.0.0]
[D:\Program Files\China Mobile\Fetion\VmDotNet\v2.0.50727\rsdeploy.dll] [Remotesoft Inc., 1, 0, 6, 0]
[D:\Program Files\China Mobile\Fetion\VmDotNet\v2.0.50727\mscoree.dll] [Microsoft Corporation, 2.0.50727.1433 (REDBITS.050727-1400)]
[D:\Program Files\China Mobile\Fetion\VmDotNet\v2.0.50727\FetionVM.rsm] [N/A, ]
[D:\Program Files\China Mobile\Fetion\VmDotNet\v2.0.50727\v2.0.50727\mscorwks.dll] [Microsoft Corporation, 2.0.50727.1433 (REDBITS.050727-1400)]
[D:\Program Files\China Mobile\Fetion\VmDotNet\v2.0.50727\c\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll] [Microsoft Corporation, 2.0.50727.1433 (REDBITS.050727-1400)]
[D:\Program Files\China Mobile\Fetion\VmDotNet\v2.0.50727\v2.0.50727\mscorjit.dll] [Microsoft Corporation, 2.0.50727.1433 (REDBITS.050727-1400)]
[D:\Program Files\China Mobile\Fetion\VmDotNet\v2.0.50727\c\windows\assembly\NativeImages_v2.0.50727_32\FetionVM\a87393057972c752eb50061d4235f9ec\FetionVM.ni.exe] [China Mobile, 1.0.0.0]
[D:\Program Files\China Mobile\Fetion\VmDotNet\v2.0.50727\System\System.Windows.Forms.dll] [Microsoft Corporation, 2.0.50727.214 (QFE.050727-2100)]
[D:\Program Files\China Mobile\Fetion\VmDotNet\v2.0.50727\System\System.dll] [Microsoft Corporation, 2.0.50727.42 (RTM.050727-4200)]
[D:\Program Files\China Mobile\Fetion\ImpsControls.dll] [China Mobile, 3.0.0.0]
[D:\Program Files\China Mobile\Fetion\VmDotNet\v2.0.50727\System\System.Drawing.dll] [Microsoft Corporation, 2.0.50727.42 (RTM.050727-4200)]
[D:\Program Files\China Mobile\Fetion\ImpsPcBase.dll] [China Mobile, 3.0.0.0]
[D:\Program Files\China Mobile\Fetion\VmDotNet\v2.0.50727\System\System.Xml.dll] [Microsoft Corporation, 2.0.50727.42 (RTM.050727-4200)]
[D:\Program Files\China Mobile\Fetion\ImpsClientBase.dll] [China Mobile, 3.0.0.0]
[D:\Program Files\China Mobile\Fetion\ImpsClientUtils.dll] [China Mobile, 3.0.0.0]
[D:\Program Files\China Mobile\Fetion\ImpsClientResource.dll] [China Mobile, 3.0.0.0]
[D:\Program Files\China Mobile\Fetion\ImpsClientCore.dll] [China Mobile, 3.0.0.0]
[D:\Program Files\China Mobile\Fetion\ImpsBase.dll] [China Mobile, 3.0.0.0]
[D:\Program Files\China Mobile\Fetion\VmDotNet\v2.0.50727\System\Accessibility.dll] [Microsoft Corporation, 2.0.50727.42 (RTM.050727-4200)]
[D:\Program Files\China Mobile\Fetion\VmDotNet\v2.0.50727\System\System.Configuration.dll] [Microsoft Corporation, 2.0.50727.42 (RTM.050727-4200)]
[D:\Program Files\China Mobile\Fetion\NCindy.dll] [China Mobile, 3.0.0.0]
[C:\Program Files\Common Files\JDVTMPDX.dat] [N/A, ]
[D:\Program Files\China Mobile\Fetion\Interop.DynamicGifCtlLib.dll] [ , 1.0.0.0]
[D:\Program Files\China Mobile\Fetion\ImpsPcCommLayer.dll] [China Mobile, 3.0.0.0]
[D:\Program Files\China Mobile\Fetion\ImpsClientData.dll] [China Mobile, 3.0.0.0]
[D:\Program Files\China Mobile\Fetion\SQLite.Interop.DLL] [, 1.0.44.0]
[D:\Program Files\China Mobile\Fetion\sensmon.dll] [China Mobile, 1.0.0.1]
[d:\Program Files\China Mobile\Fetion\DynamicGifCtl.dll] [China Mobile, 2.0.0.0]
[C:\WINDOWS\system32\SOGOUPY.IME] [Sogou.com Inc., 3.5.0.0]
[d:\Program Files\SogouInput\Plugin\SgImeWord.dll] [Sogou.com Inc., 3.5.0.0]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 2044 / Administrator][D:\Program Files\Tencent\QQ\QQ.exe] [TENCENT, 7,1,644,1777]
[D:\Program Files\Tencent\QQ\QQBaseClassInDll.dll] [TENCENT, 7,1,644,1777]
[D:\Program Files\Tencent\QQ\QQHelperDll.dll] [TENCENT, 7,1,644,1777]
[D:\Program Files\Tencent\QQ\BasicCtrlDll.dll] [TENCENT, 7,1,638,1773]
[D:\Program Files\Tencent\QQ\MFC42.DLL] [Microsoft Corporation, 6.00.8665.0]
[D:\Program Files\Tencent\QQ\RICHED32.DLL] [Microsoft Corporation, 5.00.2134.1]
[D:\Program Files\Tencent\QQ\RICHED20.dll] [Microsoft Corporation, 5.31.23.1218]
[D:\Program Files\Tencent\QQ\QQAPI.dll] [TENCENT, 7,1,638,1773]
[C:\Program Files\Common Files\JDVTMPDX.dat] [N/A, ]
[D:\Program Files\Tencent\QQ\LoginCtrl.dll] [TENCENT, 7,1,644,1777]
[D:\Program Files\Tencent\QQ\LoginCtrlRes.dll] [TENCENT, 7,1,644,1777]
[D:\Program Files\Tencent\QQ\QQRes.dll] [TENCENT, 7,1,644,1777]
[D:\Program Files\Tencent\QQ\QQMainFrame.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\gdiplus.dll] [Microsoft Corporation, 5.1.3102.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\Program Files\Tencent\QQ\QQPlugin.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\UnReadMsgMgr.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\CQQApplication.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\FlashAvatarDll.dll] [, 1, 4, 0, 1]
[D:\Program Files\Tencent\QQ\NewSkin.dll] [TENCENT, 7,1,638,1773]
[D:\Program Files\Tencent\QQ\MailSummary.dll] [TENCENT, 7,1,638,1773]
[D:\Program Files\Tencent\QQ\QQSpace.dll] [TENCENT, 7,1,638,1773]
[D:\Program Files\Tencent\QQ\vbscript.dll] [Microsoft Corporation, 5.6.0.7426]
[C:\WINDOWS\system32\msdmo.dll] [, ]
[D:\Program Files\Tencent\QQ\QQKnowledgeSearch.dll] [TENCENT, 7,1,638,1773]
[D:\Program Files\Tencent\QQ\OEMApplication.dll] [TENCENT, 7,1,638,1773]
[D:\Program Files\Tencent\QQ\QQGroupMng.dll] [TENCENT, 7,1,638,1773]
[D:\Program Files\Tencent\QQ\QQAllInOne.dll] [TENCENT, 7,1,638,1773]
[D:\Program Files\Tencent\QQ\SCCore.dll] [TENCENT, 1, 6, 0, 2]
[D:\Program Files\Tencent\QQ\CameraDll.dll] [TENCENT, 7,1,638,1773]
[D:\Program Files\Tencent\QQ\QQPet.dll] [TENCENT, 7,1,638,1773]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[D:\Program Files\Tencent\QQ\QRingMng.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\UserDefinedHead.dll] [TENCENT, 7,1,638,1773]
[D:\Program Files\Tencent\QQ\QQConfigPlugin.dll] [TENCENT, 7,1,638,1773]
[D:\Program Files\Tencent\QQ\QQCustomFace.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\LongConnection.dll] [TENCENT, 7,1,638,1773]
[D:\Program Files\Tencent\QQ\QQAvatar.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\ImageOle.dll] [TENCENT, 7,1,638,1773]
[D:\Program Files\Tencent\QQ\QQLiveQMng.dll] [TENCENT, 7,1,638,1773]
[D:\Program Files\Tencent\QQ\QQMagicFace.dll] [TENCENT, 7,1,638,1773]
[D:\Program Files\Tencent\QQ\QQSceneMng.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\PhoneAPI.dll] [TENCENT, 7,1,638,1773]
[D:\Program Files\Tencent\QQ\DialerAllinOne.dll] [tencent, 1, 4, 0, 0]
[D:\Program Files\Tencent\QQ\QQSysMsgMng.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\BQQApplication.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\GroupConnection.dll] [TENCENT, 7,1,638,1773]
[D:\Program Files\Tencent\QQ\CommercesMng.dll] [TENCENT, 7,1,638,1773]
[D:\Program Files\Tencent\QQ\PersonalDesktop.dll] [TENCENT, 7,1,638,1773]
[D:\Program Files\Tencent\QQ\QQAddr.dll] [深圳市腾讯计算机系统有限公司, 5, 0, 101, 330]
[D:\Program Files\Tencent\QQ\AddrSearch.dll] [腾讯科技(深圳)有限公司, 2, 2, 1, 16]
[C:\WINDOWS\system32\msadp32.acm] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-0845)]
[PID: 2020 / Administrator][d:\Program Files\Tencent\QQ\TXPlatform.exe] [Tencent, 1, 0, 170, 0]
[C:\Program Files\Common Files\JDVTMPDX.dat] [N/A, ]
[PID: 2508 / SYSTEM][d:\Program Files\StormII\3\stormliv.exe] [北京暴风网际科技有限公司, 3, 8, 3, 15]
[d:\Program Files\StormII\3\MSVCP60.dll] [Microsoft Corporation, 6.02.3104.0]
[PID: 1620 / Administrator][C:\Documents and Settings\Administrator\桌面\SREngLdr.EXE] [Smallfrogs Studio, 2.6.11.992]
[PID: 2424 / Administrator][C:\Documents and Settings\Administrator\桌面\SREc41ec331.EXE] [Smallfrogs Studio, 2.6.11.992]
[C:\Program Files\Common Files\JDVTMPDX.dat] [N/A, ]
==================================
文件关联
.TXT Error. [C:\WINDOWS\notepad.exe %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM Error. ["hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1 localhost
==================================
进程特权扫描
特殊特权被允许: SeDebugPrivilege [PID = 4000, D:\PROGRAM FILES\CHINA MOBILE\FETION\VMDOTNET\V2.0.50727\FETIONVM.EXE]
特殊特权被允许: SeLoadDriverPrivilege [PID = 4000, D:\PROGRAM FILES\CHINA MOBILE\FETION\VMDOTNET\V2.0.50727\FETIONVM.EXE]
特殊特权被允许: SeDebugPrivilege [PID = 1620, C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SRENGLDR.EXE]
特殊特权被允许: SeLoadDriverPrivilege [PID = 1620, C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SRENGLDR.EXE]
==================================
API HOOK
入口点错误:NtQuerySystemInformation (危险等级: 高, 被下面模块所HOOK: C:\Program Files\Common Files\JDVTMPDX.dat)
入口点错误:NtTerminateProcess (危险等级: 高, 被下面模块所HOOK: C:\Program Files\Common Files\JDVTMPDX.dat)
入口点错误:ZwTerminateProcess (危险等级: 高, 被下面模块所HOOK: C:\Program Files\Common Files\JDVTMPDX.dat)
入口点错误:RegEnumKeyExA (危险等级: 高, 被下面模块所HOOK: C:\Program Files\Common Files\JDVTMPDX.dat)
入口点错误:RegEnumKeyExW (危险等级: 高, 被下面模块所HOOK: C:\Program Files\Common Files\JDVTMPDX.dat)
入口点错误:EnumServicesStatusA (危险等级: 高, 被下面模块所HOOK: C:\Program Files\Common Files\JDVTMPDX.dat)
入口点错误:EnumServicesStatusW (危险等级: 高, 被下面模块所HOOK: C:\Program Files\Common Files\JDVTMPDX.dat)
入口点错误:FindNextFileA (危险等级: 高, 被下面模块所HOOK: C:\Program Files\Common Files\JDVTMPDX.dat)
入口点错误:FindNextFileW (危险等级: 高, 被下面模块所HOOK: C:\Program Files\Common Files\JDVTMPDX.dat)
==================================
隐藏进程
[3176] C:\WINDOWS\system32\winlogon.exe
==================================
[/CODE]