启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [(Verified)Microsoft Corporation]
<MsnMsgr><"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background> [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
<run><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation]
<PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Corporation]
<iTunesHelper><"E:\iPod\iTunesHelper.exe"> [(Verified)Apple Computer, Inc.]
<StormCodec_Helper><"E:\Storm Codec\StormSet.exe" /S /opti> [N/A]
<kis><"E:\avp.exe"> [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\System32\userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
==================================
启动文件夹
[腾讯QQ]
<C:\Documents and Settings\zn\「开始」菜单\程序\启动\腾讯QQ.lnk --> D:\qq\QQ.exe [TENCENT]><H>
==================================
服务
[卡巴斯基互联网安全套装 6.0 / AVP]
<E:\avp.exe -r><Kaspersky Lab>
[Human Interface Device Access / HidServ]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[iPod Service / iPod Service]
<"C:\Program Files\iPod\bin\iPodService.exe"><Apple Computer, Inc.>
==================================
驱动程序
N/A
==================================
浏览器加载项
[Web反病毒保护]
{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <E:\scieplugin.dll, Kaspersky Lab>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <d:\qq\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <d:\qq\QQIEHelper.dll, N/A>
[电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\System32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[ONLineKill Control]
{F227C2C3-A6AB-4E79-B911-B107C66349A3} <C:\WINDOWS\DOWNLO~1\ONLINE~1.OCX, Crystal>
[上传到QQ网络硬盘]
<D:\qq\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
<D:\qq\AddPanel.htm, N/A>
[添加到QQ表情]
<D:\qq\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<D:\qq\SendMMS.htm, N/A>
==================================
正在运行的进程
[PID: 456][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 536][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 560][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 604][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 616][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 776][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 828][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[E:\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[PID: 908][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 984][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1208][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
[PID: 1296][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[PID: 1516][E:\iPod\iTunesHelper.exe] [Apple Computer, Inc., 7.0.1.8]
[E:\iPod\iTunesHelper.Resources\zh_CN.lproj\iTunesHelperLocalized.DLL] [N/A, N/A]
[E:\iPod\iTunesHelper.Resources\iTunesHelper.DLL] [Apple Computer, Inc., 7.0.1.8]
[PID: 1544][C:\WINDOWS\System32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 1552][C:\Program Files\MSN Messenger\MsnMsgr.Exe] [Microsoft Corporation, 8.0.0812.00]
[C:\WINDOWS\System32\msdmo.dll] [N/A, N/A]
[E:\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[E:\scr_ch_pg.dll] [Kaspersky Lab, 1.0.6.299]
[E:\klscav.dll] [Kaspersky Lab, 6.0.0.299]
[E:\pr_remote.dll] [Kaspersky Lab, 6.0.0.299]
[E:\prloader.dll] [Kaspersky Lab, 6.0.0.299]
[E:\prkernel.ppl] [Kaspersky Lab, 6.0.0.304]
[e:\params.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\pxstub.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\tempfile.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\nfio.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\fsdrvplgn.ppl] [Kaspersky Lab, 6.0.0.299]
[PID: 1768][C:\WINDOWS\System32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[PID: 540][C:\Program Files\iPod\bin\iPodService.exe] [Apple Computer, Inc., 7.0.1.8]
[C:\Program Files\iPod\bin\iPodService.Resources\zh_CN.lproj\iPodServiceLocalized.DLL] [N/A, N/A]
[C:\Program Files\iPod\bin\iPodService.Resources\iPodService.DLL] [Apple Computer, Inc., 7.0.1.8]
[PID: 1032][C:\WINDOWS\System32\wuauclt.exe] [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[PID: 1060][C:\WINDOWS\System32\wuauclt.exe] [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[PID: 724][D:\qq\QQ.exe] [TENCENT, 14, 27, 0, 082]
[D:\qq\QQBaseClassInDll.dll] [, 1, 0, 0, 1]
[D:\qq\QQHelperDll.dll] [, 1, 0, 0, 1]
[D:\qq\BasicCtrlDll.dll] [Tencent, 0, 3, 3, 6]
[D:\qq\QQAPI.dll] [, 1, 0, 0, 1]
[d:\qq\TIMProxy.dll] [tencent, 0, 3, 2, 4]
[D:\qq\LoginCtrl.dll] [, 1, 0, 0, 1]
[D:\qq\npkcntc.dll] [INCA Internet Co., Ltd., 2005, 9, 1, 1]
[D:\qq\npkpdb.dll] [INCA Internet Co., Ltd., 2003, 10, 1, 1]
[D:\qq\QQRes.dll] [tencent, 1, 0, 0, 1]
[D:\qq\QQMainFrame.dll] [N/A, N/A]
[D:\qq\CQQApplication.dll] [N/A, N/A]
[D:\qq\NewSkin.dll] [, 1, 0, 0, 1]
[D:\qq\HostingMgr.dll] [, 1, 0, 0, 1]
[D:\qq\MailSummary.dll] [, 1, 0, 0, 1]
[D:\qq\QQSpace.dll] [, 1, 0, 0, 1]
[C:\WINDOWS\System32\msdmo.dll] [N/A, N/A]
[D:\qq\QQSysMsgMng.dll] [N/A, N/A]
[D:\qq\QQConfigPlugin.dll] [, 1, 0, 0, 1]
[D:\qq\UserDefinedHead.dll] [, 1, 0, 0, 1]
[D:\qq\QQPlugin.dll] [N/A, N/A]
[D:\qq\LongConnection.dll] [tencent, 0, 3, 3, 8]
[D:\qq\QQAllInOne.dll] [N/A, N/A]
[D:\qq\CameraDll.dll] [, 1, 0, 0, 1]
[D:\qq\SCCore.dll] [N/A, N/A]
[D:\qq\QRingMng.dll] [N/A, N/A]
[D:\qq\PhoneAPI.dll] [, 1, 0, 0, 1]
[D:\qq\DialerAllinOne.dll] [tencent, 1, 4, 0, 0]
[D:\qq\QQGroupMng.dll] [, 1, 0, 0, 1]
[D:\qq\QQCustomFace.dll] [N/A, N/A]
[D:\qq\GroupConnection.dll] [Tencent, 0, 3, 3, 5]
[D:\qq\QQAvatar.dll] [N/A, N/A]
[D:\qq\FlashAvatarDll.dll] [, 1, 4, 0, 1]
[D:\qq\QQAddr.dll] [深圳市腾讯计算机系统有限公司, 4, 0, 200, 32]
[D:\qq\QQFileTransfer.dll] [Tencent, 0, 3, 3, 5]
[D:\qq\QQPet.dll] [, 1, 0, 0, 1]
[E:\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[C:\WINDOWS\System32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[D:\qq\ImageOle.dll] [TODO: <Company name>, 1.0.0.1]
[D:\qq\QQZip.dll] [tencent, 0, 3, 2, 4]
[D:\qq\BQQApplication.dll] [N/A, N/A]
[D:\qq\CommercesMng.dll] [, 1, 0, 0, 1]
[D:\qq\PersonalDesktop.dll] [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2]
[D:\qq\QQUdpGetFileLib.dll] [tencent, 0, 2, 2, 3]
[D:\qq\QQPhoneHelper.dll] [腾讯科技（深圳）有限公司, 2, 0, 6, 60]
[D:\qq\QQSceneMng.dll] [N/A, N/A]
[PID: 1616][d:\qq\TIMPlatform.exe] [tencent, 0, 3, 1, 8]
[d:\qq\TIMProxy.dll] [tencent, 0, 3, 2, 4]
[PID: 3880][C:\Program Files\Mozilla Firefox\firefox.exe] [Mozilla Corporation, 1.8.0.7: 2006090918]
[C:\Program Files\Mozilla Firefox\js3250.dll] [Netscape Communications Corporation, 4.0]
[C:\Program Files\Mozilla Firefox\nspr4.dll] [Netscape Communications Corporation, 4.6.1]
[C:\Program Files\Mozilla Firefox\xpcom_core.dll] [Mozilla Foundation, 1.8.0.7: 2006090918]
[C:\Program Files\Mozilla Firefox\plc4.dll] [Netscape Communications Corporation, 4.6.1]
[C:\Program Files\Mozilla Firefox\plds4.dll] [Netscape Communications Corporation, 4.6.1]
[C:\Program Files\Mozilla Firefox\smime3.dll] [Netscape Communications Corporation, 3.10.2]
[C:\Program Files\Mozilla Firefox\nss3.dll] [Netscape Communications Corporation, 3.10.2]
[C:\Program Files\Mozilla Firefox\softokn3.dll] [Netscape Communications Corporation, 3.10.2]
[C:\Program Files\Mozilla Firefox\ssl3.dll] [Netscape Communications Corporation, 3.10.2]
[C:\Program Files\Mozilla Firefox\xpcom_compat.dll] [Mozilla Foundation, 1.8.0.7: 2006090918]
[C:\Program Files\Mozilla Firefox\components\jar50.dll] [Mozilla Foundation, 1.8.0.7: 2006090918]
[C:\Program Files\Mozilla Firefox\plugins\npnul32.dll] [mozilla.org, 1, 0, 0, 15]
[C:\Program Files\Mozilla Firefox\nssckbi.dll] [Netscape Communications Corporation, 1.53]
[C:\Program Files\Mozilla Firefox\plugins\NPSWF32.dll] [N/A, N/A]
[PID: 3092][C:\Documents and Settings\zn\桌面\SREng.exe] [Smallfrogs Studio, 2.2.6.605]
[E:\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
==================================
文件关联
.TXT Error. [notepad.exe %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG Error. [regedit.exe %1]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1 localhost
==================================
