复制内容到剪贴板
代码:
2001-01-01,03:31:27
System Repair Engineer 2.6.11.992
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Component Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,,"C:\Program Files\HFEE\SVOHOST.EXE" un userinit.exe> [File is missing]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><arjrkler.dll,yzztnmsn.dll,skqnebib.dll,tisqdtyu.dll> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{4A698102-5904-AFD0-20DF-CD1A65829CA4}><C:\WINDOWS\system32\zycbdime.dll> []
<{6C648541-1025-9650-9057-6541258720C6}><C:\WINDOWS\system32\mndhfdwd.dll> []
<{87FD640A-158F-48AC-FD14-1597F14A9778}><C:\WINDOWS\system32\mndshsrv.dll> []
<{93BA45AF-FAAA-CDDD-BEEE-BCDE1234AB39}><C:\WINDOWS\system32\yxfhdjpg.dll> []
<{5A069845-2036-6084-9054-6087502480A5}><C:\WINDOWS\system32\ozfyebyt.dll> []
<{7C954872-1230-6541-9548-6541025884C7}><C:\WINDOWS\system32\fd233ds4f3.dll> []
<{DC69134A-F15F-D14D-A31A-C31C4D124FCD}><C:\WINDOWS\system32\arjrkler.dll> []
<{7C8D1401-A58D-A81C-CD24-A5915C4517C7}><C:\WINDOWS\system32\mnmhgsrv.dll> []
<{8A041F13-A111-12A3-B0CF-F99818AA68A8}><C:\WINDOWS\system32\zxmsewin.dll> []
<{91698482-6555-3666-1222-954784129019}><C:\WINDOWS\system32\zxptejpg.dll> []
<{55694105-5108-9405-3695-954187462155}><C:\WINDOWS\system32\mpwdeapi.dll> []
<{C3D16072-2E1B-450B-B843-50EADDC8EB63}><C:\WINDOWS\system32\bnmhggo0.dll> []
<{E8A3B193-77E3-4FB3-986D-F4FA4828BAFC}><C:\WINDOWS\system32\wklsdd.dll> []
<{7C648541-1025-9650-9057-6541258720C7}><C:\WINDOWS\system32\mndhgdwd.dll> []
<{DC3D30AE-0380-4151-8934-EE98A34B0370}><C:\WINDOWS\system32\mfdesy.dll> []
<{C0595A7E-2E2F-4B34-A83A-019270A0A464}><C:\WINDOWS\system32\tdffdl.dll> []
<{189F087F-4378-405F-85FA-37D955AD7A8C}><C:\WINDOWS\system32\mtewdh.dll> []
<{8C41B7F7-3168-400D-A702-0E7EFE0BA304}><C:\WINDOWS\system32\sgdewg.dll> []
<{17DFD111-BF3A-4CB4-ADB0-88FCBFE69821}><C:\WINDOWS\system32\hhrdxd.dll> []
<{45AADFAA-DD36-42AB-83AD-0521BBF58C24}><C:\WINDOWS\system32\zycdex.dll> []
<{45671234-7890-ABCD-CDEF-567801237654}><C:\WINDOWS\system32\yxcsdhlp.dll> []
<{528DF602-9541-A985-210A-984A698C6F25}><C:\WINDOWS\system32\ptjhehlp.dll> []
<{28766E1C-74B0-4417-8C75-F12AE309EF35}><C:\WINDOWS\system32\wzcfsw.dll> []
<{CAED0F3B-DF8B-4DBF-BB20-8DFBC3199068}><C:\WINDOWS\system32\jggtsr.dll> []
<{E490415F-65F8-B5C5-D8BA-9405FB12054E}><C:\WINDOWS\system32\yzztnmsn.dll> []
<{81AF1CF6-D1C9-4C6A-AC01-EDE54E71945B}><C:\WINDOWS\system32\jfdses.dll> []
<{B29583D8-033A-4B9F-8553-7C5458F3FB8E}><C:\WINDOWS\system32\jdsaex.dll> []
<{4D165A2A-4BC1-4CA8-8299-08E05AAAB5A4}><C:\WINDOWS\system32\tdggrz.dll> []
<{25FD6584-698F-BCD2-602C-698745210352}><C:\WINDOWS\system32\rijxbkin.dll> []
<{259BF3CF-194D-4FE6-9ADB-DE6544B098B6}><C:\WINDOWS\system32\dndsaf.dll> []
<{32596546-2036-9451-6058-658402589723}><C:\WINDOWS\system32\opshcbty.dll> []
<{52023698-6984-8541-9654-698745012525}><C:\WINDOWS\system32\skqnebib.dll> []
<{48093456-9012-4568-9076-908765467184}><C:\WINDOWS\system32\tisqdtyu.dll> []
<{40618412-C528-C784-C056-C164D1F7C504}><C:\WINDOWS\system32\detxdiua.dll> []
<{A1954FAC-1023-154F-895A-1458258AD81A}><C:\WINDOWS\system32\ypdjhbmp.dll> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe]
<IFEO[360tray.exe]><ntsd -d> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntiArp.exe]
<IFEO[AntiArp.exe]><ntsd -d> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavstart.exe]
<IFEO[kavstart.exe]><ntsd -d> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.exe]
<IFEO[kissvc.exe]><ntsd -d> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp]
<IFEO[KVMonXP.kxp]><ntsd -d> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVsrvxp.exe]
<IFEO[KVsrvxp.exe]><ntsd -d> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kwatch.exe]
<IFEO[kwatch.exe]><ntsd -d> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctor.exe]
<IFEO[QQDoctor.exe]><ntsd -d> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ravmon.exe]
<IFEO[Ravmon.exe]><ntsd -d> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMond.exe]
<IFEO[RavMond.exe]><ntsd -d> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe]
<IFEO[RavTask.exe]><ntsd -d> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxtray.exe]
<IFEO[safeboxtray.exe]><ntsd -d> [N/A]
==================================
启动文件夹
[腾讯QQ]
<C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\腾讯QQ.lnk --> D:\PROGRA~1\QQ2007\QQ.exe [TENCENT]><N>
==================================
服务
[3ware Controller Service / 3wareSrv][Stopped/Auto Start]
<C:\WINDOWS\System32\3wareSrv.exe><N/A>
[Help and Support / helpsvc][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll><N/A>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<\SystemRoot\C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[NetMeeting Remote Desktop Sharing / mnmsrvc][Stopped/Manual Start]
<C:\WINDOWS\system32\mnmsrvc.exe><(File is missing)>
==================================
驱动程序
[aaatimeo / aaatimeo][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\aaatimeo.sys><Microsoft Corporation>
[AFAMgt / AFAMgt][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\afamgt.sys><Adaptec, Inc.>
[ahcix86 / ahcix86][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\ahcix86.sys><ATI Technologies Inc.>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[AliIde / AliIde][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\aliide.sys><Acer Laboratories Inc.>
[AMD AGP Bus Filter Driver / amdagp][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\amdagp.sys><Advanced Micro Devices, Inc.>
[amdbusdr / amdbusdr][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\amdbusdr.sys><AMD>
[AMD EIDE 驱动程衼E / amdeide][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\AmdEide.sys><AMD>
[AMD K8 Processor Driver / AmdK8][Stopped/Manual Start]
<System32\DRIVERS\amdk8.sys><Advanced Micro Devices>
[SiI-3112 SATALink Controller / ASH1205][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\ASH1205.sys><Silicon Image, Inc.>
[ata1200a / ata1200a][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\ata1200a.sys><Adaptec, Inc.>
[atiide / atiide][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\atiide.sys><ATI Technologies Inc.>
[Promise driver accelerator / bb-run][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\bb-run.sys><Promise Technology, Inc.>
[DELL CERC SATA 1.5/6ch RAID Miniport Driver / cercsr6][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\cercsr6.sys><Adaptec, Inc.>
[CmdIde / CmdIde][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\cmdide.sys><CMD Technology, Inc.>
[Cpq32fs2 / Cpq32fs2][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\Cpq32fs2.sys><Hewlett-Packard Company>
[Promise Removable Disk Control Driver / dontgo][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\DontGo.sys><Promise Technology, Inc.>
[fttxr52P / fttxr52P][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\fttxr52P.sys><Promise Technology, Inc.>
[HpCISSm2 / HpCISSm2][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\HpCISSm2.sys><Hewlett-Packard Company>
[hptmv6 / hptmv6][Stopped/Boot Start]
<\SystemRoot\system32\DRIVERS\hptmv6.sys><HighPoint Technologies, Inc.>
[Intel RAID Controller / iaStor55][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\iaStor55.sys><Intel Corporation>
[Intel RAID Controller / iaStor70][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\iaStor70.sys><Intel Corporation>
[mv61xx / mv61xx][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\mv61xx.sys><Marvell Semiconductor, Inc.>
[mvSata / mvSata][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\mvsata.sys><Marvell Semiconductors Inc.>
[NBA_SOFT / NBA_SOFT][Stopped/Manual Start]
<\??\C:\00C49AD9\00C49AE1><N/A>
[NT Ring0 Driver / NT Ring0 Driver][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\Ring0.sys><N/A>
[nv / nv][Running/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[nvgts / nvgts][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\nvgts.sys><NVIDIA Corporation>
[NVIDIA nForce RAID Driver / nvrd32][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\nvrd32.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[ql2100 / ql2100][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\ql2100.sys><QLogic Corporation>
[ql2200 / ql2200][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\ql2200.sys><QLogic Corporation>
[rr172x / rr172x][Stopped/Boot Start]
<\SystemRoot\system32\DRIVERS\rr172x.sys><HighPoint Technologies, Inc.>
[rr174x / rr174x][Stopped/Boot Start]
<\SystemRoot\system32\DRIVERS\rr174x.sys><HighPoint Technologies, Inc.>
[rr2340 / rr2340][Stopped/Boot Start]
<\SystemRoot\system32\DRIVERS\rr2340.sys><HighPoint Technologies, Inc.>
[Realtek 10/100/1000 PCI NIC Family NDIS XP Driver / RTL8023xp][Running/Manual Start]
<system32\DRIVERS\Rtnicxp.sys><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
[SATALink External Device Filter / SiRemFil][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\SiRemFil.sys><Silicon Image, Inc.>
[SIS AGP Bus Filter / sisagp][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\sisagp.sys><Silicon Integrated Systems Corporation>
[sisraidx / sisraidx][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\sisraidx.sys><Silicon Integrated Systems Corp.>
[VIA AGP Filter / viaagp1][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\viaagp1.sys><VIA Technologies, Inc.>
[ViBus / ViBus][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\ViBus.sys><VIA Technologies, Inc.>
[videX32 / videX32][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\videX32.sys><VIA Technologies, Inc.>
[VIA SATA IDE Device Driver / ViPrt][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\ViPrt.sys><VIA Technologies, Inc.>
[VIA SATA IDE Hot-plug Driver / xfilt][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\xfilt.sys><VIA Technologies,Inc>
==================================
浏览器加载项
[ThunderAtOnce Class]
{01443AEC-0FD1-40fd-9C87-E93D1494C233} <C:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[]
{25FD6584-698F-BCD2-602C-698745210352} <C:\WINDOWS\system32\rijxbkin.dll, N/A>
[]
{32596546-2036-9451-6058-658402589723} <C:\WINDOWS\system32\opshcbty.dll, N/A>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[SafeMon Class]
{B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>
[PowerPlr Control]
{2354A44B-3CEB-4829-9940-545B03103538} <C:\WINDOWS\DOWNLO~1\POWERP~1.OCX, Powerise Digital>
[ThunderAtOnce Class]
{01443AEC-0FD1-40FD-9C87-E93D1494C233} <C:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[PowerPlr Control]
{2354A44B-3CEB-4829-9940-545B03103538} <C:\WINDOWS\DOWNLO~1\POWERP~1.OCX, Powerise Digital>
[]
{25FD6584-698F-BCD2-602C-698745210352} <C:\WINDOWS\system32\rijxbkin.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[]
{32596546-2036-9451-6058-658402589723} <C:\WINDOWS\system32\opshcbty.dll, N/A>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[SafeMon Class]
{B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9e.ocx, Adobe Systems, Inc.>
[使用迅雷下载]
<C:\Program Files\Thunder\Program\geturl.htm, N/A>
[使用迅雷下载全部链接]
<C:\Program Files\Thunder\Program\getallurl.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ表情]
<D:\Program Files\QQ2007\AddEmotion.htm, N/A>
==================================
正在运行的进程
[PID: 452][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 512][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 536][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\arjrkler.dll] [N/A, ]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 580][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\arjrkler.dll] [N/A, ]
[PID: 592][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\arjrkler.dll] [N/A, ]
[PID: 736][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\arjrkler.dll] [N/A, ]
[PID: 796][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\arjrkler.dll] [N/A, ]
[PID: 884][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\System32\arjrkler.dll] [N/A, ]
[C:\WINDOWS\system32\wups2.dll] [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]
[PID: 932][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\arjrkler.dll] [N/A, ]
[PID: 1020][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\WINDOWS\system32\arjrkler.dll] [N/A, ]
[C:\WINDOWS\system32\CNMLM8M.DLL] [CANON INC., 2.05.2.40]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\CNMPD8M.DLL] [CANON INC., 2.05.2.40]
[PID: 1204][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234)]
[C:\WINDOWS\system32\arjrkler.dll] [N/A, ]
[C:\WINDOWS\system32\zycbdime.dll] [N/A, ]
[C:\WINDOWS\system32\mndhfdwd.dll] [N/A, ]
[C:\WINDOWS\system32\mndshsrv.dll] [N/A, ]
[C:\WINDOWS\system32\yxfhdjpg.dll] [N/A, ]
[C:\WINDOWS\system32\ozfyebyt.dll] [N/A, ]
[C:\WINDOWS\system32\fd233ds4f3.dll] [N/A, ]
[C:\WINDOWS\system32\mnmhgsrv.dll] [N/A, ]
[C:\WINDOWS\system32\zxmsewin.dll] [N/A, ]
[C:\WINDOWS\system32\zxptejpg.dll] [N/A, ]
[C:\WINDOWS\system32\mpwdeapi.dll] [N/A, ]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[D:\Program Files\QQ2007\qdshm.dll] [, 1, 0, 101, 20]
[D:\Program Files\QQ2007\MFC42.DLL] [Microsoft Corporation, 6.00.8665.0]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
[C:\WINDOWS\system32\SOGOUPY.IME] [Sogou.com Inc., 3.2.0.0]
[C:\Program Files\SogouInput\Plugin\SgImeWord.dll] [Sogou.com Inc., 3.2.0.0]
[C:\WINDOWS\system32\bnmhggo0.dll] [N/A, ]
[C:\WINDOWS\system32\wklsdd.dll] [N/A, ]
[C:\WINDOWS\system32\mndhgdwd.dll] [N/A, ]
[C:\WINDOWS\system32\mfdesy.dll] [N/A, ]
[C:\WINDOWS\system32\tdffdl.dll] [N/A, ]
[C:\WINDOWS\system32\mtewdh.dll] [N/A, ]
[C:\WINDOWS\system32\sgdewg.dll] [N/A, ]
[C:\WINDOWS\system32\hhrdxd.dll] [N/A, ]
[C:\WINDOWS\system32\zycdex.dll] [N/A, ]
[C:\WINDOWS\system32\yxcsdhlp.dll] [N/A, ]
[C:\WINDOWS\system32\ptjhehlp.dll] [N/A, ]
[C:\WINDOWS\system32\wzcfsw.dll] [N/A, ]
[C:\WINDOWS\system32\jggtsr.dll] [N/A, ]
[C:\WINDOWS\system32\yzztnmsn.dll] [N/A, ]
[C:\WINDOWS\system32\jfdses.dll] [N/A, ]
[C:\WINDOWS\system32\jdsaex.dll] [N/A, ]
[C:\WINDOWS\system32\tdggrz.dll] [N/A, ]
[C:\WINDOWS\system32\rijxbkin.dll] [N/A, ]
[C:\WINDOWS\system32\dndsaf.dll] [N/A, ]
[C:\WINDOWS\system32\opshcbty.dll] [N/A, ]
[C:\WINDOWS\system32\skqnebib.dll] [N/A, ]
[C:\WINDOWS\system32\tisqdtyu.dll] [N/A, ]
[C:\WINDOWS\system32\detxdiua.dll] [N/A, ]
[C:\WINDOWS\system32\ypdjhbmp.dll] [N/A, ]
[PID: 1332][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1408][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\arjrkler.dll] [N/A, ]
[PID: 1420][C:\WINDOWS\system32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[C:\WINDOWS\system32\arjrkler.dll] [N/A, ]
[PID: 1736][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\arjrkler.dll] [N/A, ]
[C:\WINDOWS\system32\wklsdd.dll] [N/A, ]
[C:\WINDOWS\system32\mfdesy.dll] [N/A, ]
[C:\WINDOWS\system32\tdffdl.dll] [N/A, ]
[C:\WINDOWS\system32\mtewdh.dll] [N/A, ]
[C:\WINDOWS\system32\sgdewg.dll] [N/A, ]
[C:\WINDOWS\system32\hhrdxd.dll] [N/A, ]
[C:\WINDOWS\system32\zycdex.dll] [N/A, ]
[C:\WINDOWS\system32\wzcfsw.dll] [N/A, ]
[C:\WINDOWS\system32\jggtsr.dll] [N/A, ]
[C:\WINDOWS\system32\jfdses.dll] [N/A, ]
[C:\WINDOWS\system32\jdsaex.dll] [N/A, ]
[C:\WINDOWS\system32\tdggrz.dll] [N/A, ]
[C:\WINDOWS\system32\dndsaf.dll] [N/A, ]
[C:\WINDOWS\system32\bnmhggo0.dll] [N/A, ]
[PID: 1760][D:\Program Files\QQ2007\QQ.exe] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\QQBaseClassInDll.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\QQHelperDll.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\BasicCtrlDll.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\MFC42.DLL] [Microsoft Corporation, 6.00.8665.0]
[C:\WINDOWS\system32\arjrkler.dll] [N/A, ]
[D:\Program Files\QQ2007\RICHED32.DLL] [Microsoft Corporation, 5.00.2134.1]
[D:\Program Files\QQ2007\RICHED20.dll] [Microsoft Corporation, 5.31.23.1218]
[D:\Program Files\QQ2007\QQAPI.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\LoginCtrl.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\LoginCtrlRes.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\QQRes.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\CQQApplication.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\QQMainFrame.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\gdiplus.dll] [Microsoft Corporation, 5.1.3102.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\Program Files\QQ2007\QQPlugin.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\UnReadMsgMgr.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\QQAllInOne.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\SCCore.dll] [TENCENT, 1, 6, 0, 2]
[D:\Program Files\QQ2007\CameraDll.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\FlashAvatarDll.dll] [, 1, 0, 0, 1]
[D:\Program Files\QQ2007\NewSkin.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\MailSummary.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\QQSpace.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\vbscript.dll] [Microsoft Corporation, 5.6.0.7426]
[C:\WINDOWS\system32\Macromed\Flash\Flash9e.ocx] [Adobe Systems, Inc., 9,0,115,0]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\msdmo.dll] [, ]
[D:\Program Files\QQ2007\OEMApplication.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\QQAvatar.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\QQKnowledgeSearch.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\QQGroupMng.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\QQPet.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\QQSysMsgMng.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\UserDefinedHead.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\QQConfigPlugin.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\QQCustomFace.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\QRingMng.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\LongConnection.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\PhoneAPI.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\DialerAllinOne.dll] [tencent, 1, 4, 0, 0]
[D:\Program Files\QQ2007\QQFileTransfer.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\BQQApplication.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\GroupConnection.dll] [TENCENT, 8,0,978,1833]
[C:\WINDOWS\system32\zycbdime.dll] [N/A, ]
[C:\WINDOWS\system32\mndhfdwd.dll] [N/A, ]
[C:\WINDOWS\system32\mndshsrv.dll] [N/A, ]
[C:\WINDOWS\system32\yxfhdjpg.dll] [N/A, ]
[C:\WINDOWS\system32\ozfyebyt.dll] [N/A, ]
[C:\WINDOWS\system32\fd233ds4f3.dll] [N/A, ]
[C:\WINDOWS\system32\mnmhgsrv.dll] [N/A, ]
[C:\WINDOWS\system32\zxmsewin.dll] [N/A, ]
[C:\WINDOWS\system32\zxptejpg.dll] [N/A, ]
[C:\WINDOWS\system32\mpwdeapi.dll] [N/A, ]
[D:\Program Files\QQ2007\CommercesMng.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\PersonalDesktop.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\QQAddr.dll] [深圳市腾讯计算机系统有限公司, 5, 0, 101, 330]
[D:\Program Files\QQ2007\QQSceneMng.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\AddrSearch.dll] [腾讯科技（深圳）有限公司, 2, 2, 1, 15]
[C:\WINDOWS\system32\bnmhggo0.dll] [N/A, ]
[C:\WINDOWS\system32\wklsdd.dll] [N/A, ]
[C:\WINDOWS\system32\mfdesy.dll] [N/A, ]
[C:\WINDOWS\system32\tdffdl.dll] [N/A, ]
[C:\WINDOWS\system32\mtewdh.dll] [N/A, ]
[C:\WINDOWS\system32\sgdewg.dll] [N/A, ]
[C:\WINDOWS\system32\hhrdxd.dll] [N/A, ]
[C:\WINDOWS\system32\zycdex.dll] [N/A, ]
[C:\WINDOWS\system32\wzcfsw.dll] [N/A, ]
[C:\WINDOWS\system32\jggtsr.dll] [N/A, ]
[C:\WINDOWS\system32\jfdses.dll] [N/A, ]
[C:\WINDOWS\system32\jdsaex.dll] [N/A, ]
[C:\WINDOWS\system32\tdggrz.dll] [N/A, ]
[C:\WINDOWS\system32\dndsaf.dll] [N/A, ]
[C:\WINDOWS\system32\msadp32.acm] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\Program Files\QQ2007\ImageOle.dll] [TENCENT, 8,0,978,1833]
[D:\Program Files\QQ2007\QQMagicFace.dll] [TENCENT, 8,0,978,1833]
[C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL] [Microsoft Corporation, 11.0.8164]
[D:\Program Files\QQ2007\QQLiveQMng.dll] [TENCENT, 8,0,978,1833]
[PID: 160][D:\Program Files\QQ2007\TXPlatform.exe] [Tencent, 1, 5, 225, 0]
[C:\WINDOWS\system32\jdsaex.dll] [N/A, ]
[C:\WINDOWS\system32\dndsaf.dll] [N/A, ]
[C:\WINDOWS\system32\tdggrz.dll] [N/A, ]
[C:\WINDOWS\system32\sgdewg.dll] [N/A, ]
[C:\WINDOWS\system32\mfdesy.dll] [N/A, ]
[C:\WINDOWS\system32\hhrdxd.dll] [N/A, ]
[C:\WINDOWS\system32\jfdses.dll] [N/A, ]
[C:\WINDOWS\system32\wzcfsw.dll] [N/A, ]
[C:\WINDOWS\system32\mtewdh.dll] [N/A, ]
[C:\WINDOWS\system32\zycdex.dll] [N/A, ]
[C:\WINDOWS\system32\jggtsr.dll] [N/A, ]
[C:\WINDOWS\system32\wklsdd.dll] [N/A, ]
[C:\WINDOWS\system32\tdffdl.dll] [N/A, ]
[PID: 1160][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\arjrkler.dll] [N/A, ]
[PID: 3480][C:\WINDOWS\Down_Temp\1502690.exe] [N/A, ]
[C:\WINDOWS\system32\arjrkler.dll] [N/A, ]
[PID: 3524][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\arjrkler.dll] [N/A, ]
[C:\WINDOWS\system32\yzztnmsn.dll] [N/A, ]
[C:\WINDOWS\system32\skqnebib.dll] [N/A, ]
[C:\WINDOWS\system32\tisqdtyu.dll] [N/A, ]
[C:\WINDOWS\system32\bnmhggo0.dll] [N/A, ]
[C:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll] [Thunder Networking Technologies,LTD, 1.0.5.16]
[C:\WINDOWS\system32\rijxbkin.dll] [N/A, ]
[C:\WINDOWS\system32\opshcbty.dll] [N/A, ]
[C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 8, 55]
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1002]
[C:\WINDOWS\system32\hhrdxd.dll] [N/A, ]
[C:\WINDOWS\system32\jfdses.dll] [N/A, ]
[C:\WINDOWS\system32\mtewdh.dll] [N/A, ]
[C:\WINDOWS\system32\wzcfsw.dll] [N/A, ]
[C:\WINDOWS\system32\zycdex.dll] [N/A, ]
[C:\WINDOWS\system32\wklsdd.dll] [N/A, ]
[C:\WINDOWS\system32\jggtsr.dll] [N/A, ]
[C:\WINDOWS\system32\tdffdl.dll] [N/A, ]
[C:\WINDOWS\system32\sgdewg.dll] [N/A, ]
[C:\WINDOWS\system32\tdggrz.dll] [N/A, ]
[C:\WINDOWS\system32\dndsaf.dll] [N/A, ]
[C:\WINDOWS\system32\jdsaex.dll] [N/A, ]
[C:\WINDOWS\system32\mfdesy.dll] [N/A, ]
[C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\Macromed\Flash\Flash9e.ocx] [Adobe Systems, Inc., 9,0,115,0]
[C:\WINDOWS\system32\xpsp3res.dll] [Microsoft Corporation, 5.1.2600.3268 (WinXP.071206-1251)]
[C:\WINDOWS\system32\msdmo.dll] [, ]
[C:\WINDOWS\system32\ffdshow.ax] [, 1.0.2.2028]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\Program Files\Ringz Studio\Storm Codec\Codecs\VSFilter.dll] [Gabest, 1, 0, 1, 3]
[C:\WINDOWS\system32\zycbdime.dll] [N/A, ]
[C:\WINDOWS\system32\mndhfdwd.dll] [N/A, ]
[C:\WINDOWS\system32\mndshsrv.dll] [N/A, ]
[C:\WINDOWS\system32\yxfhdjpg.dll] [N/A, ]
[C:\WINDOWS\system32\ozfyebyt.dll] [N/A, ]
[C:\WINDOWS\system32\fd233ds4f3.dll] [N/A, ]
[C:\WINDOWS\system32\mnmhgsrv.dll] [N/A, ]
[C:\WINDOWS\system32\zxmsewin.dll] [N/A, ]
[C:\WINDOWS\system32\zxptejpg.dll] [N/A, ]
[C:\WINDOWS\system32\mpwdeapi.dll] [N/A, ]
[C:\WINDOWS\system32\mndhgdwd.dll] [N/A, ]
[C:\WINDOWS\system32\yxcsdhlp.dll] [N/A, ]
[C:\WINDOWS\system32\ptjhehlp.dll] [N/A, ]
[C:\WINDOWS\system32\detxdiua.dll] [N/A, ]
[C:\WINDOWS\system32\ypdjhbmp.dll] [N/A, ]
[PID: 2988][C:\WINDOWS\system32\wuauclt.exe] [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]
[C:\WINDOWS\system32\arjrkler.dll] [N/A, ]
[C:\WINDOWS\system32\yzztnmsn.dll] [N/A, ]
[C:\WINDOWS\system32\skqnebib.dll] [N/A, ]
[C:\WINDOWS\system32\tisqdtyu.dll] [N/A, ]
[C:\WINDOWS\system32\wups2.dll] [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]
[PID: 3620][C:\Documents and Settings\Administrator\桌面\SREngLdr.EXE] [Smallfrogs Studio, 2.6.11.992]
[C:\WINDOWS\system32\skqnebib.dll] [N/A, ]
[PID: 820][C:\Documents and Settings\Administrator\桌面\SRE2521b82a.EXE] [Smallfrogs Studio, 2.6.11.992]
[C:\WINDOWS\system32\skqnebib.dll] [N/A, ]
[C:\WINDOWS\system32\bnmhggo0.dll] [N/A, ]
[C:\WINDOWS\system32\dndsaf.dll] [N/A, ]
[C:\WINDOWS\system32\jdsaex.dll] [N/A, ]
[C:\WINDOWS\system32\sgdewg.dll] [N/A, ]
[C:\WINDOWS\system32\tdggrz.dll] [N/A, ]
[C:\WINDOWS\system32\mfdesy.dll] [N/A, ]
[C:\WINDOWS\system32\hhrdxd.dll] [N/A, ]
[C:\WINDOWS\system32\wzcfsw.dll] [N/A, ]
[C:\WINDOWS\system32\tdffdl.dll] [N/A, ]
[C:\WINDOWS\system32\jfdses.dll] [N/A, ]
[C:\WINDOWS\system32\jggtsr.dll] [N/A, ]
[C:\WINDOWS\system32\mtewdh.dll] [N/A, ]
[C:\WINDOWS\system32\zycdex.dll] [N/A, ]
[C:\WINDOWS\system32\wklsdd.dll] [N/A, ]
[C:\Documents and Settings\Administrator\桌面\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]
==================================
文件关联
.TXT Error. [C:\WINDOWS\notepad.exe %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM Error. ["hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1 localhost
==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 536, C:\WINDOWS\SYSTEM32\WINLOGON.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 3480, C:\WINDOWS\DOWN_TEMP\1502690.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3480, C:\WINDOWS\DOWN_TEMP\1502690.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 3620, C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SRENGLDR.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3620, C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SRENGLDR.EXE]
==================================
API HOOK
N/A
==================================
隐藏进程
N/A
==================================
