[C:\WINDOWS\system32\RAA_RAA_1002.dll] [N/A, ]
[PID: 1136 / Administrator][c:\temp\rar$ex00.360\srengps.exe] [Smallfrogs Studio, 2.5.16.900]
[C:\WINDOWS\system32\auhad.dll] [N/A, ]
[C:\WINDOWS\system32\gnolnait.dll] [N/A, ]
[C:\WINDOWS\system32\ijougiemnaw.dll] [N/A, ]
[C:\WINDOWS\system32\niluw.dll] [N/A, ]
[C:\WINDOWS\system32\naixuhz.dll] [N/A, ]
[C:\WINDOWS\system32\iqnauhc.dll] [N/A, ]
[C:\WINDOWS\system32\3auhad.dll] [N/A, ]
[C:\WINDOWS\system32\jsqc.dll] [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\NvSys_55.Sys] [N/A, ]
[c:\windows\system32\oztzcd.dll] [N/A, ]
[C:\WINDOWS\system32\NAVMon32.dll] [N/A, ]
[C:\WINDOWS\system32\SHAProc.dll] [N/A, ]
[C:\WINDOWS\system32\PTSShell.dll] [N/A, ]
[C:\WINDOWS\system32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\system32\LotusHlp.dll] [N/A, ]
[C:\WINDOWS\system32\upxdnd.dll] [N/A, ]
[C:\WINDOWS\saznutzf.dll] [N/A, ]
[C:\WINDOWS\xjpfanrt.dll] [N/A, ]
[C:\WINDOWS\swyzxwld.dll] [N/A, ]
[c:\temp\rar$ex00.360\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1 localhost
127.0.0.1 locator.metadata.windowsmedia.com
127.0.0.1 onlinestore.smgbb.cn
127.0.0.1 locator.metadata.windowsmedia.com
127.0.0.1 onlinestore.smgbb.cn
127.0.0.1 ads.52fb.cn
127.0.0.1 update.cpushpop.com
127.0.0.1 image.yahoo550.com
127.0.0.1 gs.chnsystem.com
127.0.0.1 msl.chnsystem.com
127.0.0.1 ssl.chnsystem.com
127.0.0.1 www.gagagaga.cn
127.0.0.1 down.1024tb.com
127.0.0.1 xconf.coopen.cn
127.0.0.1 log.xplayer.coopen.cn
127.0.0.1 xfile.coopen.cn
127.0.0.1 loader.smartpv.cn
127.0.0.1 alerts.xiaoi.com
127.0.0.1 sports.yahoo550.com
127.0.0.1 update.cnnic.cn
127.0.0.1 jump.cnnic.cn
127.0.0.1 login.zuoyoukongjian.com
127.0.0.1 adfirefox.cn
127.0.0.1 3.wornm.cn
127.0.0.1 5.haokandi.cn
127.0.0.1 b.downadown.cn
127.0.0.1 update.iesuper.com
127.0.0.1 888.843call.cn
127.0.0.1 122.770304123.cn
127.0.0.1 110.770304123.cn
127.0.0.1 343.boolans.com
127.0.0.1 update.smartpv.cn
127.0.0.1 update146.smartpv.cn
127.0.0.1 js4.all4ad.net
127.0.0.1 click2.ad4all.net
127.0.0.1 www.papaop.com
127.0.0.1 realname.webbrowser.smartpv.cn
127.0.0.1 login.webbrowser.smartpv.cn
127.0.0.1 www.133c.cn
127.0.0.1 zhoupk256.3322.org
127.0.0.1 udp.hjob123.com
127.0.0.1 d4.kkads.cn
127.0.0.1 www.zhaoyou8.com
127.0.0.1 www.kkads.cn
127.0.0.1 travel.yahoo550.com
127.0.0.1 soft.16990.com
127.0.0.1 livenews.265.com
127.0.0.1 bak.hjob123.com
127.0.0.1 www.jesuser.cn
127.0.0.1 class.caiyi8.com
127.0.0.1 ownload.baofeng.com
127.0.0.1 www.177i.com
127.0.0.1 www.81891111.com
127.0.0.1 www.our9988.cn
127.0.0.1 33.xingaide8.cn
127.0.0.1 444.916kk.com
127.0.0.1 www.916kk.com
127.0.0.1 soft2.86sifu.com
127.0.0.1 google.netcdn.com
127.0.0.1 lm.9cdn.com
127.0.0.1 www.z88.com.cn
127.0.0.1 adswin.unet.hk
127.0.0.1 www.borlander.com.cn
127.0.0.1 cab.borlander.com.cn
127.0.0.1 www.333292.com
127.0.0.1 net.jnnic.com
127.0.0.1 www.plunix.org
127.0.0.1 ip.9cdn.com
127.0.0.1 test8.b190.west263.cn
127.0.0.1 yz.jz173.com
127.0.0.1 www.yy17173.cn
127.0.0.1 www.daydayshop.cn
127.0.0.1 www.yahoo550.com
127.0.0.1 wifayy.51vip.biz
127.0.0.1 sss.969222.com
==================================
进程特权扫描
特殊特权被允许： SeDebugPrivilege [PID = 1476, C:\WINDOWS\EXPLORER.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 1640, C:\WINDOWS\PDRYZAFOU.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1640, C:\WINDOWS\PDRYZAFOU.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 808, C:\PROGRAM FILES\KINGSOFT\KSYSCLEANER\KASSTART.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 808, C:\PROGRAM FILES\KINGSOFT\KSYSCLEANER\KASSTART.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 5652, C:\PROGRAM FILES\RISING\RAV\RAVMON.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 5652, C:\PROGRAM FILES\RISING\RAV\RAVMON.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 2904, C:\PROGRAM FILES\WINRAR\WINRAR.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2904, C:\PROGRAM FILES\WINRAR\WINRAR.EXE]
==================================
API HOOK
入口点错误：CreateProcessW (危险等级: 高, 被下面模块所HOOK: C:\WINDOWS\system32\NAVMon32.dll)
==================================
隐藏进程
N/A
==================================
[/CODE]
