启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
<KASStart><"C:\Program Files\Kingsoft\KSysCleaner\KASStart.EXE" -Startup> [Kingsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Publisher]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows Publisher]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows Publisher]
<NVMixerTray><"C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"> [NVIDIA Corporation]
<ATIPTA><C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe> [ATI Technologies, Inc.]
<StormCodec_Helper><"C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti> []
<popo2004><C:\Program Files\Netease\popo2004\start.exe> [网易(163.com)]
<SunJavaUpdateSched><"C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"> [Sun Microsystems, Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<KASTask><C:\Program Files\Kingsoft\KSysCleaner\KASTask.EXE> [Kingsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
==================================
启动文件夹
N/A
==================================
服务
[Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start]
<C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[ATI Smart / ATI Smart][Stopped/Auto Start]
<C:\WINDOWS\system32\ati2sgag.exe><>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[P4P Service / P4P Service][Running/Manual Start]
<2 - 系统找不到指定的文件。
><N/A>
[Terminal Services / TermService][Running/Manual Start]
<C:\WINDOWS\System32\svchost -k DComLaunch-->C:\WINDOWS\System32\termsrvhack.dll><Microsoft Corporation>
==================================
驱动程序
[AC2003 / AC2003][Stopped/Manual Start]
<System32\Drivers\AC2003.sys><ABIT Computer Corp.>
[ati2mtag / ati2mtag][Running/Manual Start]
<system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\C:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[npkycryp / npkycryp][Stopped/Manual Start]
<\??\C:\Program Files\Tencent\QQ\npkycryp.sys><N/A>
[NPPTNT2 / NPPTNT2][Running/System Start]
<\??\C:\WINDOWS\system32\npptNT2.sys><INCA Internet Co., Ltd.>
[nvatabus / nvatabus][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\nvatabus.sys><NVIDIA Corporation>
[Service for NVIDIA(R) nForce(TM) Audio Enumerator / nvax][Running/Manual Start]
<system32\drivers\nvax.sys><NVIDIA Corporation>
[NVIDIA nForce Networking Controller Driver / NVENET][Running/Manual Start]
<system32\DRIVERS\NVENET.sys><NVIDIA Corporation>
[Service for NVIDIA(R) nForce(TM) Audio / nvnforce][Running/Manual Start]
<system32\drivers\nvapu.sys><NVIDIA Corporation>
[NVIDIA nForce AGP Bus Filter / nv_agp][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\nv_agp.sys><NVIDIA Corporation>
[oreans32 / oreans32][Running/System Start]
<\??\C:\WINDOWS\system32\drivers\oreans32.sys><N/A>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[SVKP / SVKP][Running/Auto Start]
<\??\C:\WINDOWS\system32\SVKP.sys><AntiCracking>
[ATSpy / ATSpy][Others/Disabled]
<\??\C:\WINDOWS\system32\ATSpy.sys><Kingsoft Corporation>
==================================
浏览器加载项
[Java Plug-in 1.5.0_10]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll, Sun Microsystems, Inc.>
[金山毒霸在线产品升级]
{E847C78C-C210-4195-8799-FBF3BF89797D} <C:\PROGRA~1\KOS\KOSInit.OCX, 金山软件股份有限公司>
[Menu Class]
{27D784D7-9217-4227-B43B-E06E4781E0CB} <C:\WINDOWS\system32\AlxTB2.dll, Alexa Internet>
[BrowserProxy4 Class]
{69A72A8A-84ED-4A75-8CE7-263DBEF3E5D3} <C:\WINDOWS\system32\AlxTB2.dll, Alexa Internet>
[Shockwave Flash
Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
==================================
正在运行的进程
[PID: 564][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 628][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 652][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\Ati2evxx.dll] [ATI Technologies Inc., 6.14.10.4113]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 696][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 708][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1644][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\msdmo.dll] [, ]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\CmdLineExt02.dll] [N/A, ]
[PID: 1832][C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe] [NVIDIA Corporation, 1.0.444]
[C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerZHC.dll] [NVIDIA Corporation, 1.0.444]
[C:\Program Files\Common Files\NVIDIA Shared\Audio\NVAudioMod.dll] [NVIDIA Corporation, 1.0.444]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1840][C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe] [ATI Technologies, Inc., 6.14.10.5142]
[C:\Program Files\ATI Technologies\ATI Control Panel\atipdsxx.dll] [ATI Technologies, Inc., 6.14.10.5142]
[C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATRPUIXX.CHS] [ATI Technologies, Inc., 6.14.10.5142]
[C:\Program Files\ATI Technologies\ATI Control Panel\atipdxxx.dll] [ATI Technologies, Inc., 6.14.10.5142]
[PID: 1884][C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe] [Sun Microsystems, Inc., 5.0.100.3]
[PID: 1896][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1384][C:\WINDOWS\system32\wscntfy.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3508][C:\Program Files\Maxthon\Maxthon.exe] [MY Soft Technology, 1, 3, 1, 20]
[C:\Program Files\Maxthon\maxzlib.dll] [ , 1, 0, 0, 2]
[C:\WINDOWS\system32\odbcbcp.dll] [Microsoft Corporation, 2000.085.1117.00 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Maxthon\Services\RealTime\real_time.dll] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\PROGRA~1\KOS\KOSClean.OCX] [金山软件股份有限公司, 2007, 3, 14, 5]
[C:\PROGRA~1\KOS\KASEngine.dll] [Kingsoft Corporation, 2007, 2, 11, 107]
[C:\PROGRA~1\KOS\KASData.dll] [Kingsoft Corporation, 2007, 2, 11, 32]
[C:\PROGRA~1\KOS\Extend\KASExt.KAS] [Kingsoft Corporation, 2007, 3, 20, 116]
[C:\PROGRA~1\KOS\KAEScan.DLL] [Kingsoft Corp., 2006, 11, 16, 1]
[C:\PROGRA~1\KOS\KAEPlat.DLL] [Kingsoft Corp., 2007, 2, 4, 61]
[C:\PROGRA~1\KOS\KAEMem.DAT] [Kingsoft, 2006, 9, 11, 15]
[C:\PROGRA~1\KOS\KAEUnpack.DAT] [Kingsoft Corp., 2007, 3, 7, 112]
[C:\PROGRA~1\KOS\KAVIPC2.DLL] [Kingsoft Corporation, 2007, 1, 15, 30]
[C:\PROGRA~1\KOS\KAVKFile.dll] [N/A, ]
[C:\PROGRA~1\KOS\KAEMemEx.dll] [, 2006, 10, 17, 16]
[C:\PROGRA~1\KOS\KAEMalDt.dll] [, 2006, 12, 7, 20]
[C:\PROGRA~1\KOS\KAERemov.dll] [, 2007, 2, 5, 26]
[C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[PID: 3700][C:\Program Files\Kingsoft\KSysCleaner\KASMain.EXE] [Kingsoft Corporation, 2006, 12, 6, 137]
[C:\Program Files\Kingsoft\KSysCleaner\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\Program Files\Kingsoft\KSysCleaner\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\Program Files\Kingsoft\KSysCleaner\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\Program Files\Kingsoft\KSysCleaner\KAVIPC2.DLL] [Kingsoft Corporation, 2004, 12, 28, 20]
[C:\Program Files\Kingsoft\KSysCleaner\KAS\KASEngine.dll] [Kingsoft Corporation, 2007, 2, 11, 107]
[C:\Program Files\Kingsoft\KSysCleaner\KAS\KASData.dll] [Kingsoft Corporation, 2007, 2, 11, 32]
[C:\Program Files\Kingsoft\KSysCleaner\KAS\Extend\KASExt.KAS] [Kingsoft Corporation, 2007, 3, 20, 116]
[PID: 3912][E:\网络游戏\新建文件夹\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
N/A
==================================
API HOOK
入口点错误：FreeLibrary (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0x5F00002D)
==================================
隐藏进程
[3408] C:\Program Files\Kingsoft\KSysCleaner\KASStart.EXE
