瑞星卡卡安全论坛

首页 » 技术交流区 » 反病毒/反流氓软件论坛 » 请高手来瞅下这份日志有问题否~
b851023 - 2007-6-14 20:40:00
[CODE]

2007-06-13,22:26:42

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 1 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe>  [(Verified)Microsoft Windows XP Publisher]
    <MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background>  [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows XP Publisher]
    <PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows XP Publisher]
    <PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows XP Publisher]
    <PRONoMgr.exe><C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe>  [Intel(R) Corporation]
    <KavStart><"C:\KAV2006\KAVStart.exe" -startup>  [Kingsoft Corporation]
    <ATIPTA><C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe>  [ATI Technologies, Inc.]
    <ATIModeChange><Ati2mdxx.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
    <IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows XP Publisher]
    <Userinit><C:\WINDOWS\System32\userinit.exe,>  [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Sebring]
    <WinlogonNotify: Sebring><C:\WINDOWS\System32\LgNotify.dll>  [Intel Corporation]

==================================
启动文件夹
[Adobe Reader Speed Launch]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Reader Speed Launch.lnk --> C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE [Adobe Systems Incorporated]><N>

==================================
服务
[Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start]
  <C:\WINDOWS\System32\Ati2evxx.exe><>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Adapter Switching / IntelRoam][Running/Auto Start]
  <C:\Program Files\Intel\Switching\User\RoamSvc.exe><Intel Corporation>
[Kingsoft Antivirus KWatch Service / KWatchSvc][Running/Auto Start]
  <C:\KAV2006\KWatch.EXE><Kingsoft Corporation>
[Intel NCS NetService / NetSvc][Stopped/Manual Start]
  <C:\Program Files\Intel\NCS\Sync\NetSvc.exe><Intel(R) Corporation>
[RegSrvc / RegSrvc][Running/Auto Start]
  <C:\WINDOWS\System32\RegSrvc.exe><Intel Corporation>
[RoamMgr / RoamMgr][Running/Auto Start]
  <C:\WINDOWS\System32\RoamMgr.exe><Intel Corporation>
[Spectrum24 Event Monitor / S24EventMonitor][Running/Auto Start]
  <C:\WINDOWS\System32\S24EvMon.exe><Intel Corporation>

==================================
驱动程序
[ati2mtag / ati2mtag][Running/Manual Start]
  <System32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[Broadcom 570x Gigabit Integrated Controller / b57w2k][Running/Manual Start]
  <System32\DRIVERS\b57xp32.sys><Broadcom Corporation>
[Bluetooth Virtual Communications Driver / BTDriver][Stopped/Manual Start]
  <System32\DRIVERS\btport.sys><N/A>
[Bluetooth LAN Access Server / BTWDNDIS][Stopped/Manual Start]
  <System32\DRIVERS\btwdndis.sys><N/A>
[英特尔适配器切换驱动程序 / Intel_MIPMNMP][Running/Manual Start]
  <System32\DRIVERS\mipmnxp.sys><Intel Corporation>
[kaoamb / kaoamb][Running/Boot Start]
  <\SystemRoot\\SystemRoot\System32\drivers\kaoamb.sys><N/A>
[KWatch3 / KWatch3][Running/System Start]
  <\??\C:\WINDOWS\System32\drivers\KWatch3.SYS><Kingsoft Corporation>
[O2Micro SmartCardBus Reader / O2SCBUS][Running/Manual Start]
  <System32\DRIVERS\ozscr.sys><O2Micro>
[OMCI WDM Device Driver / OMCI][Running/System Start]
  <System32\DRIVERS\omci.sys><Dell Computer Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[WLAN Transport / s24trans][Running/Auto Start]
  <System32\DRIVERS\s24trans.sys><Intel Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
  <System32\DRIVERS\secdrv.sys><N/A>
[Audio Driver (WDM) - SigmaTel CODEC / STAC97][Running/Manual Start]
  <system32\drivers\STAC97.sys><SigmaTel, Inc.>
[Intel(R) PRO/Wireless 7100 Adapter 驱动程序 / w70n51][Running/Manual Start]
  <System32\DRIVERS\w70n51.sys><Intel? Corporation>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
  <System32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>

==================================
浏览器加载项
[WebThunder Browser Helper]
  {00000AAA-A363-466E-BEF5-9BB68697AA7F} <C:\Program Files\Thunder Network\WebThunder\WebThunderBHO_Now.dll, Thunder Networking Technologies,LTD>
[AcroIEHlprObj Class]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[CBrowseStakeout Class]
  {55302805-482E-470E-8A57-6795A1487F90} <C:\KAV2006\KAVAFish.DLL, Kingsoft Corporation>
[信息检索(&R)]
  {92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[启动Web迅雷]
  {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} <http://my.xunlei.com, N/A>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\MSMSGS.EXE, Microsoft Corporation>
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[vc Control]
  {E689D735-1487-420D-9049-16ED198FE411} <C:\WINDOWS\DOWNLO~1\vco.ocx, >
[WebThunder Class]
  {03507A1A-E0C5-4404-AA26-205385C0892D} <, N/A>
[WangWangObj Class]
  {6E213FC7-DD5A-4115-B7E6-D4C7838C361E} <C:\Program Files\Alisoft\WangWang\WangWangX4.dll, 阿里软件（中国）有限公司>
[上传到QQ网络硬盘]
  <C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用Web迅雷下载]
  <C:\Program Files\Thunder Network\WebThunder\GetUrl.htm, N/A>
[使用Web迅雷下载全部链接]
  <C:\Program Files\Thunder Network\WebThunder\GetAllUrl.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
  <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
  <C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>
[金山毒霸反钓鱼...]
  <C:\KAV2006\KAF\ShowSet.htm, N/A>

==================================
b851023 - 2007-6-14 20:43:00
正在运行的进程
[PID: 440][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 1192][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1220][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.1557 (xpsp2_gdr.040517-1325)]
    [C:\WINDOWS\System32\LgNotify.dll]  [Intel Corporation, 1, 0, 0, 1]
    [C:\WINDOWS\system32\wdmaud.drv]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1324][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1336][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 1508][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1692][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\wups.dll]  [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
    [C:\WINDOWS\System32\wups2.dll]  [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[PID: 1728][C:\WINDOWS\System32\S24EvMon.exe]  [Intel Corporation , 3.1.8.0]
[PID: 1828][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1888][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 380][C:\WINDOWS\system32\ZCfgSvc.exe]  [Intel Corporation, 1, 0, 0, 1]
    [C:\WINDOWS\system32\PfMgrApi.dll]  [Intel Corporation, 1, 0, 0, 1]
    [C:\WINDOWS\system32\PsRegApi.dll]  [Intel Corporation, 4, 0, 0, 1]
    [C:\WINDOWS\system32\WConfig.DLL]  [Intel Corporation, 1, 0, 0, 2]
    [C:\WINDOWS\system32\WiFiAdap.DLL]  [Intel Corporation, 1, 0, 0, 1]
    [C:\WINDOWS\system32\S24MUDLL.dll]  [Intel Corporation, 5.0.1.0]
    [C:\KAV2006\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [C:\KAV2006\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 12, 1, 139]
    [C:\WINDOWS\System32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\WINDOWS\System32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
[PID: 552][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [C:\KAV2006\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [C:\WINDOWS\System32\wdmaud.drv]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [C:\WINDOWS\System32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\KAV2006\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 12, 1, 139]
    [C:\WINDOWS\System32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\WINDOWS\System32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll]  [Adobe Systems Incorporated, 7.0.0.2004121400]
    [C:\KAV2006\KAScript.DLL]  [Kingsoft Corporation, 2006, 12, 11, 72]
    [C:\KAV2006\KAEPlat.DLL]  [Kingsoft Corp., 2006, 8, 29, 60]
    [C:\KAV2006\KAEMem.DAT]  [Kingsoft, 2006, 9, 25, 16]
    [C:\KAV2006\KAEUnpack.DAT]  [Kingsoft Corp., 2007, 5, 9, 120]
    [C:\WINDOWS\System32\msadp32.acm]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 840][C:\KAV2006\KWatch.EXE]  [Kingsoft Corporation, 2005, 9, 27, 51]
    [C:\KAV2006\KAVIPC2.DLL]  [Kingsoft Corporation, 2004, 12, 28, 20]
    [C:\KAV2006\KAEPlat.DLL]  [Kingsoft Corp., 2006, 8, 29, 60]
    [C:\KAV2006\KAEMem.DAT]  [Kingsoft, 2006, 9, 25, 16]
    [C:\KAV2006\KAEUnpack.DAT]  [Kingsoft Corp., 2007, 5, 9, 120]
[PID: 904][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.1699 (xpsp2.050610-1533)]
    [C:\WINDOWS\system32\mdimon.dll]  [Microsoft Corporation, 11.3.1897.0]
    [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll]  [Microsoft Corporation, 11.3.1897.0]
[PID: 1196][C:\KAV2006\KAVStart.exe]  [Kingsoft Corporation, 2007, 5, 9, 272]
    [C:\WINDOWS\System32\MFC71.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\System32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\WINDOWS\System32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\System32\MFC71CHS.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\KAV2006\KAVIPC2.DLL]  [Kingsoft Corporation, 2004, 12, 28, 20]
    [C:\KAV2006\SvcTimer.DLL]  [Kingsoft Corporation, 2006.12.22.84]
    [C:\KAV2006\KAVPassp.dll]  [Kingsoft Corporation, 2006, 9, 7, 270]
    [C:\KAV2006\PopSprt3.dll]  [Kingsoft Corporation, 2007, 1, 16, 45]
    [C:\KAV2006\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [C:\WINDOWS\System32\odbcbcp.dll]  [Microsoft Corporation, 2000.081.9030.00]
    [C:\Program Files\Common Files\Microsoft Shared\office11\mso.dll]  [Microsoft Corporation, 11.0.5606]
    [C:\KAV2006\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 12, 1, 139]
[PID: 1240][C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe]  [ATI Technologies, Inc., 6.14.10.4000]
    [C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATRPUIXX.CHS]  [ATI Technologies, Inc., 6.14.10.4000]
    [C:\Program Files\ATI Technologies\ATI Control Panel\atipdsxx.dll]  [ATI Technologies, Inc., 6.14.10.4000]
    [C:\KAV2006\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
[PID: 1264][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3427]
    [C:\KAV2006\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
[PID: 1292][C:\WINDOWS\System32\Ati2evxx.exe]  [, ]
[PID: 1552][C:\WINDOWS\System32\RegSrvc.exe]  [Intel Corporation, 4, 0, 0, 1]
[PID: 248][C:\KAV2006\KMailMon.EXE]  [Kingsoft Corporation, 2007, 2, 25, 948]
    [C:\KAV2006\KAntiSpm.dll]  [Kingsoft Corporation, 2007, 2, 25, 129]
    [C:\WINDOWS\System32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\WINDOWS\System32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\KAV2006\KAVIPC2.DLL]  [Kingsoft Corporation, 2004, 12, 28, 20]
    [C:\KAV2006\KAECall2.DLL]  [Kingsoft Corporation, 2004, 12, 28, 7]
    [C:\KAV2006\KAEPlat.DLL]  [Kingsoft Corp., 2006, 8, 29, 60]
    [C:\KAV2006\KAEMem.DAT]  [Kingsoft, 2006, 9, 25, 16]
    [C:\KAV2006\KAEUnpack.DAT]  [Kingsoft Corp., 2007, 5, 9, 120]
    [C:\KAV2006\KAConfig.DLL]  [Kingsoft Corporation, 2007, 1, 11, 41]
    [C:\KAV2006\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [C:\KAV2006\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 12, 1, 139]
[PID: 392][C:\WINDOWS\System32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\KAV2006\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 12, 1, 139]
    [C:\WINDOWS\System32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\WINDOWS\System32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\KAV2006\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
[PID: 2244][C:\WINDOWS\System32\wuauclt.exe]  [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
    [C:\WINDOWS\System32\wuaucpl.cpl]  [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
    [C:\KAV2006\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 12, 1, 139]
    [C:\WINDOWS\System32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\WINDOWS\System32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\KAV2006\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [C:\WINDOWS\System32\wups.dll]  [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
    [C:\WINDOWS\System32\wups2.dll]  [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
    [C:\WINDOWS\System32\wucltui.dll]  [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[PID: 3336][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [C:\KAV2006\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 12, 1, 139]
    [C:\WINDOWS\System32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\WINDOWS\System32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\KAV2006\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [C:\Program Files\Thunder Network\WebThunder\WebThunderBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 2, 10]
    [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll]  [Adobe Systems Incorporated, 7.0.0.2004121400]
    [C:\KAV2006\KAVAFish.DLL]  [Kingsoft Corporation, 2006, 10, 25, 27]
    [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
    [C:\WINDOWS\System32\wdmaud.drv]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [C:\WINDOWS\System32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\KAV2006\KAScript.DLL]  [Kingsoft Corporation, 2006, 12, 11, 72]
    [C:\KAV2006\KAEPlat.DLL]  [Kingsoft Corp., 2006, 8, 29, 60]
    [C:\KAV2006\KAEMem.DAT]  [Kingsoft, 2006, 9, 25, 16]
    [C:\KAV2006\KAEUnpack.DAT]  [Kingsoft Corp., 2007, 5, 9, 120]
    [C:\WINDOWS\System32\Macromed\Flash\Flash9c.ocx]  [Adobe Systems, Inc., 9,0,45,0]
[PID: 200][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
b851023 - 2007-6-14 20:43:00
[C:\KAV2006\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 12, 1, 139]
    [C:\WINDOWS\System32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\WINDOWS\System32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\KAV2006\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [C:\Program Files\Thunder Network\WebThunder\WebThunderBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 2, 10]
    [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll]  [Adobe Systems Incorporated, 7.0.0.2004121400]
    [C:\KAV2006\KAVAFish.DLL]  [Kingsoft Corporation, 2006, 10, 25, 27]
    [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
    [C:\WINDOWS\System32\wdmaud.drv]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [C:\WINDOWS\System32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\KAV2006\KAScript.DLL]  [Kingsoft Corporation, 2006, 12, 11, 72]
    [C:\KAV2006\KAEPlat.DLL]  [Kingsoft Corp., 2006, 8, 29, 60]
    [C:\KAV2006\KAEMem.DAT]  [Kingsoft, 2006, 9, 25, 16]
    [C:\KAV2006\KAEUnpack.DAT]  [Kingsoft Corp., 2007, 5, 9, 120]
    [C:\WINDOWS\System32\Macromed\Flash\Flash9c.ocx]  [Adobe Systems, Inc., 9,0,45,0]
    [C:\WINDOWS\DOWNLO~1\vco.ocx]  [, 1.0.69.0]
    [C:\WINDOWS\DOWNLO~1\ENG.DLL]  [北京日月光华软件有限责任公司, 2.0.3286.7]
[PID: 2220][C:\Program Files\Real\RealPlayer\RealPlay.exe]  [RealNetworks, Inc., 6.0.12.1348]
    [C:\WINDOWS\System32\PNCRT.dll]  [Real Networks, Inc, 6.0.0.0]
    [C:\KAV2006\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 12, 1, 139]
    [C:\WINDOWS\System32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\WINDOWS\System32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\KAV2006\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [C:\Program Files\Common Files\Real\Common\objb3201.dll]  [RealNetworks, Inc., 0.1.0.6244]
    [C:\Program Files\Real\RealPlayer\rpplugins\rpap3260.dll]  [RealNetworks, Inc., 6.0.9.2954]
    [C:\Program Files\Common Files\Real\Common\pnrs3260.dll]  [RealNetworks, Inc., 6.0.9.3985]
    [C:\Program Files\Real\RealPlayer\lang\cdplay_cn.dll]  [RealNetworks, Inc., 6.0.12.298]
    [C:\Program Files\Real\RealPlayer\lang\dbcomp_cn.dll]  [RealNetworks, Inc., 6.0.12.298]
    [C:\Program Files\Real\RealPlayer\lang\embed_cn.dll]  [RealNetworks, Inc., 6.0.12.298]
    [C:\Program Files\Real\RealPlayer\lang\gemctl_cn.dll]  [RealNetworks, Inc., 6.0.12.298]
    [C:\Program Files\Real\RealPlayer\lang\pngui_cn.dll]  [RealNetworks, Inc., 6.0.12.298]
    [C:\Program Files\Real\RealPlayer\lang\pdgenxfer_cn.dll]  [N/A, ]
    [C:\Program Files\Real\RealPlayer\lang\rjctl_cn.dll]  [RealNetworks, Inc., 6.0.12.298]
    [C:\Program Files\Real\RealPlayer\lang\rjeq_cn.dll]  [RealNetworks, Inc., 6.0.12.298]
    [C:\Program Files\Real\RealPlayer\lang\rjres_cn.dll]  [RealNetworks, Inc., 6.0.12.298]
    [C:\Program Files\Real\RealPlayer\lang\rjskin_cn.dll]  [RealNetworks, Inc., 6.0.12.298]
    [C:\Program Files\Real\RealPlayer\lang\rjviz_cn.dll]  [RealNetworks, Inc., 6.0.12.298]
    [C:\Program Files\Real\RealPlayer\lang\rjfade_cn.dll]  [RealNetworks, Inc., 6.0.12.298]
    [C:\Program Files\Real\RealPlayer\lang\rjdlg_cn.dll]  [RealNetworks, Inc., 6.0.12.298]
    [C:\Program Files\Real\RealPlayer\lang\rjmisc_cn.dll]  [RealNetworks, Inc., 6.0.12.298]
    [C:\Program Files\Real\RealPlayer\lang\rjprog_cn.dll]  [RealNetworks, Inc., 6.0.12.298]
    [C:\Program Files\Real\RealPlayer\lang\rpapp_cn.dll]  [RealNetworks, Inc., 6.0.12.298]
    [C:\Program Files\Real\RealPlayer\lang\rpclsvc_cn.dll]  [RealNetworks, Inc., 6.0.12.298]
    [C:\Program Files\Real\RealPlayer\lang\rpclutil_cn.dll]  [RealNetworks, Inc., 6.0.12.299]
    [C:\Program Files\Real\RealPlayer\lang\rpdemand_cn.dll]  [RealNetworks, Inc., 6.0.12.299]
    [C:\Program Files\Real\RealPlayer\lang\rpdsplyr_cn.dll]  [RealNetworks, Inc., 6.0.12.298]
    [C:\Program Files\Real\RealPlayer\lang\rpgutil_cn.dll]  [RealNetworks, Inc., 6.0.12.298]
    [C:\Program Files\Real\RealPlayer\lang\rpmnpane_cn.dll]  [RealNetworks, Inc., 6.0.12.298]
    [C:\Program Files\Real\RealPlayer\lang\rpplylst_cn.dll]  [RealNetworks, Inc., 6.0.12.298]
    [C:\Program Files\Real\RealPlayer\lang\rpwebctl_cn.dll]  [RealNetworks, Inc., 6.0.12.298]
    [C:\Program Files\Real\RealPlayer\lang\tcdinfo_cn.dll]  [RealNetworks, Inc., 6.0.12.298]
    [C:\Program Files\Real\RealPlayer\lang\tclsvc_cn.dll]  [RealNetworks, Inc., 6.0.12.298]
    [C:\Program Files\Real\RealPlayer\lang\tdwnmgr_cn.dll]  [RealNetworks, Inc., 6.0.12.298]
    [C:\Program Files\Real\RealPlayer\lang\tmp3_cn.dll]  [RealNetworks, Inc., 6.0.12.298]
    [C:\Program Files\Real\RealPlayer\lang\twave_cn.dll]  [RealNetworks, Inc., 6.0.12.298]
    [C:\Program Files\Real\RealPlayer\lang\teasdk_cn.dll]  [RealNetworks, Inc., 6.0.12.298]
    [C:\Program Files\Real\RealPlayer\lang\tearm_cn.dll]  [RealNetworks, Inc., 6.0.12.298]
    [C:\Program Files\Real\RealPlayer\lang\tmdedit_cn.dll]  [RealNetworks, Inc., 6.0.12.298]
    [C:\Program Files\Real\RealPlayer\lang\mydevices_cn.dll]  [RealNetworks, Inc., 6.0.12.299]
    [C:\Program Files\Real\RealPlayer\rpplugins\rpcl3260.dll]  [RealNetworks, Inc., 6.0.9.3027]
    [C:\Program Files\Common Files\Real\RCAPlugins\uisy3201.dll]  [RealNetworks, Inc., 0.1.0.3749]
    [C:\Program Files\Common Files\Real\Plugins\zipf3260.dll]  [RealNetworks, Inc., 6.0.8.2469]
    [C:\Program Files\Common Files\Real\RCAPlugins\rpcontrols1.dll]  [RealNetworks, Inc., 6.0.1.2153]
    [C:\Program Files\Common Files\Real\Plugins\pxcb3210.dll]  [RealNetworks, Inc., 1.0.0.3914]
    [C:\Program Files\Real\RealPlayer\rpplugins\rpmn3260.dll]  [RealNetworks, Inc., 6.0.9.2851]
    [C:\Program Files\Real\RealPlayer\rpplugins\rpms3260.dll]  [RealNetworks, Inc., 6.0.1.2188]
    [C:\Program Files\Real\RealPlayer\rpplugins\MPACore.dll]  [RealNetworks, Inc., 1.0.3.2207]
    [C:\Program Files\Real\RealPlayer\rpplugins\myde3260.dll]  [RealNetworks, Inc., 6.0.10.2416]
    [C:\Program Files\Common Files\Real\Common\pngu3267.dll]  [RealNetworks, Inc., 6.7.0.2629]
    [C:\Program Files\Real\RealPlayer\rjwmapln.dll]  [RealNetworks, Inc., 6.0.8.1689]
    [C:\Program Files\Common Files\Real\Common\pnen3260.dll]  [RealNetworks, Inc., 10.0.0.895]
    [C:\Program Files\Common Files\Real\Plugins\vsrlocal.dll]  [RealNetworks, Inc., 10.1.0.795]
    [C:\Program Files\Common Files\Real\Plugins\vidsite.dll]  [RealNetworks, Inc., 10.0.0.868]
    [C:\Program Files\Common Files\Real\Plugins\clntxres.dll]  [RealNetworks, Inc., 10.0.0.3446]
    [C:\Program Files\Real\RealPlayer\rpplugins\rjbe3260.dll]  [RealNetworks, Inc., 6.0.4.2191]
    [C:\Program Files\Common Files\Real\Plugins\smplfsys.dll]  [RealNetworks, Inc., 10.0.0.1654]
    [C:\Program Files\Common Files\Real\Plugins\ramfformat.dll]  [RealNetworks, Inc., 10.0.0.2111]
    [C:\Program Files\Common Files\Real\Plugins\mp3fformat.dll]  [RealNetworks, Inc., 10.0.0.2856]
    [C:\Program Files\Common Files\Real\Plugins\mp3render.dll]  [RealNetworks, Inc., 10.0.0.865]
    [C:\Program Files\Common Files\Real\Common\rjbviz.dll]  [RealNetworks, Inc., 1.0.2.3809]
    [C:\Program Files\Common Files\Real\Visualizations\Annabelle.rpv]  [RealNetworks, Inc., 1.0.0.2]
    [C:\WINDOWS\System32\wdmaud.drv]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [C:\WINDOWS\System32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\Program Files\Real\RealPlayer\rpplugins\rpwe3260.dll]  [RealNetworks, Inc., 6.0.1.2194]
    [C:\Program Files\Real\RealPlayer\rpplugprot.dll]  [RealNetworks, Inc., 6.0.10.2157]
    [C:\Program Files\Common Files\Real\Common\twebbrowse.dll]  [RealNetworks, Inc., 1.0.2.1511]
    [C:\Program Files\Real\RealPlayer\tnetdtct.dll]  [RealNetworks, Inc., 1.0.3.2157]
    [C:\Program Files\Common Files\Real\Update_OB\rnad3201.dll]  [RealNetworks, Inc., 0.1.0.3427]
    [C:\KAV2006\KAScript.DLL]  [Kingsoft Corporation, 2006, 12, 11, 72]
    [C:\Program Files\Real\RealPlayer\rpplugins\ierpplug.dll]  [RealNetworks, Inc., 1.0.1.2173]
[PID: 2464][D:\宇峻奥汀\sreng2\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
    [C:\KAV2006\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 12, 1, 139]
    [C:\WINDOWS\System32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\WINDOWS\System32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\KAV2006\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  Error. ["hh.exe" %1]
.HLP  Error. [winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
API HOOK
入口点错误：LoadLibraryExW (危险等级: 一般,  被下面模块所HOOK: C:\KAV2006\KASocket.dll)

==================================
隐藏进程
N/A

==================================


[/CODE]
b851023 - 2007-6-14 20:44:00
附加个问题，是不是有ws2_32.dll这个文件就是中病毒了？
桃子CiCi - 2007-6-14 20:45:00
日志正常
紫雪清灵 - 2007-6-14 20:50:00
在我看来,日志正常
b851023 - 2007-6-14 20:51:00
没有木马吧？
紫雪清灵 - 2007-6-14 20:53:00
我没看到,那个....金山毒霸对木马查杀最强,你不信任这点你装他干什么?
b851023 - 2007-6-14 20:58:00
因为最近我的金山只是频繁的报告木马却不杀毒，最后也不知道怎么把病毒搞死，没有报告了，我怕有后遗症= =``
1
查看完整版本: 请高手来瞅下这份日志有问题否~
© 2000 - 2026 Rising Corp. Ltd.