twagon - 2007-7-3 21:02:00
此病毒会把系统日期改为2004.12.28 ,用瑞星,咔吧,Antivir,spyemergency都查不出其它症状都不明显,求高手帮忙看一下,多谢拉
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<CTFMON.EXE><; C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<run><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<avgnt><"C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min> [Avira GmbH]
<F-Secure Manager><"d:\Program Files\F-Secure\Common\FSM32.EXE" /splash> [F-Secure Corporation]
<F-Secure TNB><"d:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL> [F-Secure Corporation]
<RunShadowTip><C:\WINDOWS\system32\shadow\ShadowTip.exe> [PowerShadow]
<SiSPower><Rundll32.exe SiSPower.dll,ModeAgent> [Silicon Integrated Systems Corporation]
<Cmaudio><; RunDll32 cmicnfg.cpl,CMICtrlWnd> [N/A]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Publisher]
<PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows Publisher]
<PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows Publisher]
<SiS Windows KeyHook><; C:\WINDOWS\system32\keyhook.exe> [N/A]
<SiSUSBRG><; C:\WINDOWS\SiSUSBrg.exe> [Silicon Integrated Systems Corp.]
<TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\System Safety Monitor]
<WinlogonNotify: System Safety Monitor><SSMWinlogonEx.dll> [(Verified)System Safety Limited]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
<IE7 Uninstall Stub><C:\WINDOWS\system32\ieudinit.exe> [(Verified)Microsoft Windows Component Publisher]
==================================
启动文件夹
N/A
==================================
服务
[AntiVir PersonalEdition Classic Scheduler / AntiVirScheduler][Running/Auto Start]
<"C:\Program Files\AntiVir PersonalEdition Classic\sched.exe"><Avira GmbH>
[AntiVir PersonalEdition Classic Guard / AntiVirService][Running/Auto Start]
<"C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe"><Avira GmbH>
[F-Secure Network Request Broker / F-Secure Network Request Broker][Running/Manual Start]
<"d:\Program Files\F-Secure\Common\FNRB32.EXE"><F-Secure Corporation>
[F-Secure Authentication Agent / FSAA][Stopped/Auto Start]
<"d:\Program Files\F-Secure\Common\FSAA.EXE"><F-Secure Corporation. All Rights Reserved.>
[F-Secure Distributed Firewall Daemon / FSDFWD][Running/Manual Start]
<"d:\Program Files\F-Secure\DFW\Program\fsdfwd.exe"><F-Secure Corporation>
[F-Secure Management Agent / FSMA][Running/Auto Start]
<"d:\Program Files\F-Secure\Common\FSMA32.EXE"><F-Secure Corporation>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\windows\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[O&O Defrag / O&O Defrag][Running/Auto Start]
<E:\DownLoads files\系统\系统维护\O&O\O&O Defrag Professional\oodag.exe><O&O Software GmbH>
[Shadow System Service / ShadowSystemService][Running/Auto Start]
<C:\WINDOWS\system32\shadow\ShadowService.exe><N/A>
twagon - 2007-7-3 21:03:00
==================================
驱动程序
[360TimeProt / 360TimeProt][Stopped/Boot Start]
<\SystemRoot\system32\drivers\360TimeProt.sys><N/A>
[avgio / avgio][Running/System Start]
<\??\C:\Program Files\AntiVir PersonalEdition Classic\avgio.sys><Avira GmbH>
[avgntflt / avgntflt][Running/Manual Start]
<\??\C:\Program Files\AntiVir PersonalEdition Classic\avgntflt.sys><Avira GmbH>
[avipbb / avipbb][Running/System Start]
<system32\DRIVERS\avipbb.sys><Avira GmbH>
[C-Media WDM Audio Interface / cmuda][Running/Manual Start]
<system32\drivers\cmuda.sys><C-Media Inc>
[F-Secure File System Filter / F-Secure Filter][Running/Auto Start]
<\??\d:\Program Files\F-Secure\Common\FSfilter.sys><F-Secure Corporation>
[F-Secure Gatekeeper / F-Secure Gatekeeper][Running/Auto Start]
<\??\d:\Program Files\F-Secure\Common\FSgk.sys><F-Secure Corporation>
[F-Secure File System Recognizer / F-Secure Recognizer][Running/Auto Start]
<\??\d:\Program Files\F-Secure\Common\FSrec.sys><F-Secure Corporation>
[F-Secure Distributed Firewall Driver / FSDFW][Running/Boot Start]
<\SystemRoot\System32\drivers\fsdfw.sys><F-Secure Corporation>
[F-Secure Policy Manager / FSpm][Running/Auto Start]
<\??\d:\Program Files\F-Secure\Common\FSPM.SYS><F-Secure Corporation>
[Netgroup Packet Filter / NPF][Stopped/Manual Start]
<system32\drivers\npf.sys><CACE Technologies>
[npkcrypt / npkcrypt][Stopped/Manual Start]
<\??\C:\windows\system32\npkcrypt.sys><N/A>
[npkycryp / npkycryp][Stopped/Manual Start]
<\??\C:\windows\system32\npkycryp.sys><N/A>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[System Safety Monitor 2.0 Core Engine / safemon][Running/Boot Start]
<\SystemRoot\system32\drivers\safemon.sys><System Safety Limited>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[SiS315 / SiS315][Running/Manual Start]
<system32\DRIVERS\sisgrp.sys><Silicon Integrated Systems Corporation>
[SiS AGP Filter / SISAGP][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\SISAGPX.sys><Silicon Integrated Systems Corporation>
[SiSkp / SiSkp][Running/System Start]
<system32\DRIVERS\srvkp.sys><Silicon Integrated Systems Corporation>
[SiS PCI Fast Ethernet Adapter Driver / SISNIC][Stopped/Manual Start]
<system32\DRIVERS\sisnic.sys><SiS Corporation>
[ssmdrv / ssmdrv][Stopped/Manual Start]
<system32\DRIVERS\ssmdrv.sys><Avira GmbH>
==================================
浏览器加载项
[ThunderAtOnce Class]
{01443AEC-0FD1-40fd-9C87-E93D1494C233} <e:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <e:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[NavigatMon Class]
{B69F34DD-F0F9-42DC-9EDD-957187DA688D} <E:\Program Files\360safe\safemon\safemon.dll, >
[启动迅雷5]
{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <e:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[]
{e2e2dd38-d088-4134-82b7-f2ba38496583} <%windir%\Network Diagnostic\xpnetdiag.exe, N/A>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\windows\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>
[ThunderAtOnce Class]
{01443AEC-0FD1-40FD-9C87-E93D1494C233} <e:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[Web Browser Applet Control]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\WINDOWS\system32\msjava.dll, Microsoft Corporation>
[PowerList Control]
{20C2C286-BDE8-441B-B73D-AFA22D914DA5} <e:\PROGRA~1\PPStream\POWERL~1.OCX, PPStream.com>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[XML DOM Document]
{2933BF90-7B36-11D2-B20E-00C04F983E60} <%SystemRoot%\system32\msxml3.dll, N/A>
[Microsoft Office Control]
{4453D895-F2A1-4A38-A285-1EF9BD3F6D5D} <E:\PROGRA~1\MICROS~1\OFFICE11\AUTHZAX.DLL, Microsoft Corporation>
[Thunder Agent Class]
{485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <e:\Program Files\Thunder Network\Thunder\ComDlls\ThunderAgent_Now.dll, Thunder Networking Technologies,LTD>
[PowerPlayer Control]
{5EC7C511-CD0F-42E6-830C-1BD9882F3458} <e:\PROGRA~1\PPStream\POWERP~1.DLL, PPStream Inc.>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[MediaComm Class]
{7670648D-461B-42AF-BDFE-46D26AF5EFF2} <e:\Program Files\Thunder Network\Thunder\Components\InMedia\MediaAddin13.dll, Thunder Networking Technologies,LTD>
[360SafeLive]
{87515F61-A66C-4319-A0E0-D416CB8059E3} <E:\Program Files\360safe\live.dll, 360safe.com>
[Microsoft Web Browser]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\ieframe.dll, Microsoft Corporation>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <e:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[XML DOM 文档 5.0]
{88D969E5-F192-11D4-A65F-0040963251E5} <C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSXML5.DLL, Microsoft Corporation>
[NavigatMon Class]
{B69F34DD-F0F9-42DC-9EDD-957187DA688D} <E:\Program Files\360safe\safemon\safemon.dll, >
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[QQPlayerSvr Proxy Control]
{CD108273-D434-43E6-AA90-1469F97EB398} <e:\Program Files\Tencent\QQ\QQPlayerProxy.dll, Tencent>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\windows\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>
[TimwpDll.TimwpCheck]
{ED4CA2E5-0EEA-44C1-AD7E-74A07A7507A4} <E:\PROGRA~1\Tencent\QQ\Timwp.dll, TENCENT>
[XML HTTP Request]
{ED8C108E-4349-11D2-91A4-00C04F7969E8} <%SystemRoot%\system32\msxml3.dll, N/A>
[Scripting.Dictionary]
{EE09B103-97E0-11CF-978F-00A02463E06F} <C:\WINDOWS\system32\scrrun.dll, Microsoft Corporation>
[Vod Class]
{EEDD6FF9-13DE-496B-9A1C-D78B3215E266} <e:\Program Files\Thunder Network\Thunder\Components\DownAndPlay\DapPlayer1.0.0.41.dll, XunLei>
[XML DOM Document 3.0]
{F5078F32-C551-11D3-89B9-0000F81FE221} <%SystemRoot%\system32\msxml3.dll, N/A>
[XML HTTP 3.0]
{F5078F35-C551-11D3-89B9-0000F81FE221} <%SystemRoot%\system32\msxml3.dll, N/A>
[XML DOM Document]
{F6D90F11-9C73-11D3-B32E-00C04F990BB4} <%SystemRoot%\system32\msxml3.dll, N/A>
[XML HTTP]
{F6D90F16-9C73-11D3-B32E-00C04F990BB4} <%SystemRoot%\system32\msxml3.dll, N/A>
[使用迅雷下载]
<e:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
[使用迅雷下载全部链接]
<e:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
[导出到 Microsoft Excel(&x)]
<res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://E:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ表情]
<e:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
twagon - 2007-7-3 21:06:00
==================================
正在运行的进程
[PID: 448][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 512][\??\C:\windows\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 536][\??\C:\windows\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\windows\system32\SSMWinlogonEx.dll] [System Safety Limited, 2.3.0.610]
[C:\windows\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1528][C:\windows\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\windows\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\windows\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
[C:\windows\system32\ieframe.dll] [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
[C:\WINDOWS\system32\WPDShServiceObj.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\WINDOWS\system32\PortableDeviceTypes.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\WINDOWS\system32\PortableDeviceApi.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[e:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll] [Thunder Networking Technologies,LTD, 1.0.2.9]
[e:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 3, 11]
[e:\Program Files\Thunder Network\Thunder\Components\ResWorker\DsBho_00.dll] [, 1, 0, 0, 4]
[e:\Program Files\Thunder Network\Thunder\Components\ResWorker\DataProcessor_00.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 6]
[E:\Program Files\360safe\safemon\safemon.dll] [, 3, 5, 0, 1001]
[PID: 2160][C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe] [Avira GmbH, 7.00.04.05]
[C:\Program Files\AntiVir PersonalEdition Classic\MFC71U.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\Program Files\AntiVir PersonalEdition Classic\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\Program Files\AntiVir PersonalEdition Classic\avgcmxp.dll] [Avira GmbH, 7.00.04.00]
[C:\Program Files\AntiVir PersonalEdition Classic\AVWINLL.DLL] [Avira GmbH, 1.0.0.7]
[PID: 2184][D:\Program Files\F-Secure\Common\FSM32.EXE] [F-Secure Corporation, 5.00.5420 ]
[D:\Program Files\F-Secure\Common\FSPMAPI.dll] [F-Secure Corporation, 5.00.5420 ]
[D:\Program Files\F-Secure\Common\FSMA32.dll] [F-Secure Corporation, 5.00.5420 ]
[D:\Program Files\F-Secure\Common\FSLD32.dll] [F-Secure Corporation, 5.00.5420 ]
[D:\Program Files\F-Secure\Common\FSABOUT.dll] [F-Secure Corporation, 5.00.5420 ]
[d:\Program Files\F-Secure\Common\fsexc.dll] [F-Secure Corporation, 5.00.5420 ]
[D:\Program Files\F-Secure\Common\fsmres.eng] [F-Secure Corporation, 5.00.5420 ]
[d:\Program Files\F-Secure\DFW\Program\fsdfwpi.dll] [F-Secure Corporation, 5.50.1080]
[d:\Program Files\F-Secure\Common\fsmaui32.dll] [F-Secure Corporation, 5.00.5420 ]
[D:\Program Files\F-Secure\Common\fsmaures.eng] [F-Secure Corporation, 5.00.5420 ]
[D:\Program Files\F-Secure\Common\fsabtres.eng] [F-Secure Corporation, 5.00.5420 ]
[D:\Program Files\F-Secure\Common\fsdfwpi.ENG] [F-Secure Corporation, 5.50.1080]
[D:\Program Files\F-Secure\Common\fsdfwpi2.eng] [F-Secure Corporation, 5.50.1080]
[d:\program files\f-secure\tnb\fstnb.dll] [F-Secure Corporation, 1.0.122 ]
[PID: 2228][C:\windows\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2576][E:\DownLoads files\Kav6\Kav6(USB).exe] [, 3, 2, 0, 1]
[C:\windows\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\windows\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
[PID: 180][C:\windows\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
twagon - 2007-7-3 21:07:00
[PID: 1508][E:\DownLoads files\Kav6\avp6\avp.exe] [Kaspersky Lab, 6.0.0.299]
[E:\DownLoads files\Kav6\avp6\pr_remote.dll] [Kaspersky Lab, 6.0.0.299]
[E:\DownLoads files\Kav6\avp6\MSVCP60.dll] [Microsoft Corporation, 6.02.3104.0]
[E:\DownLoads files\Kav6\avp6\FSSync.dll] [Kaspersky Lab, 6.0.5.0]
[E:\DownLoads files\Kav6\avp6\AVPGS.PPL] [Kaspersky Lab, 6.0.0.299]
[E:\DownLoads files\Kav6\avp6\prloader.dll] [Kaspersky Lab, 6.0.0.299]
[E:\DownLoads files\Kav6\avp6\prkernel.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\pxstub.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\params.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\winreg.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\tm.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\nfio.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\fsdrvplgn.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\bl.ppl] [Kaspersky Lab, 6.0.0.300]
[e:\downloads files\kav6\avp6\wmihlpr.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\ndetect.ppl] [Kaspersky Lab, 6.0.0.299]
[C:\windows\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\windows\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
[e:\downloads files\kav6\avp6\crpthlpr.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\schedule.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\timer.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\thpimpl.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\lic60.ppl] [Kaspersky Lab, 6.0.0.300]
[e:\downloads files\kav6\avp6\report.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\avs.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\avpmgr.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\wdiskio.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\avlib.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\avspm.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\avp3info.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\avpgui.ppl] [Kaspersky Lab, 6.0.0.300]
[E:\DownLoads files\Kav6\avp6\basegui.dll] [Kaspersky Lab, 6.0.0.300]
[e:\downloads files\kav6\avp6\qb.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\inflate.ppl] [Kaspersky Lab, 6.0.0.16]
[C:\windows\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[e:\downloads files\kav6\avp6\ods.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\dtreg.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\prutil.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\avp1.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\l_llio.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\ichk2.ppl] [Kaspersky Lab, 6.0.0.300]
[e:\downloads files\kav6\avp6\sfdb.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\icheckersa.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\hashcont.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\hccmp.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\btimages.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\ntfsstrm.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\buffer.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\hashmd5.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\uniarc.ppl] [Kaspersky Lab, 6.0.0.16]
[e:\downloads files\kav6\avp6\minizip.ppl] [Kaspersky Lab, 6.0.0.16]
[e:\downloads files\kav6\avp6\cab.ppl] [Kaspersky Lab, 6.0.0.16]
[e:\downloads files\kav6\avp6\arj.ppl] [Kaspersky Lab, 6.0.0.16]
[e:\downloads files\kav6\avp6\rar.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\lha.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\iwgen.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\tempfile.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\prseqio.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\downloads files\kav6\avp6\unlzx.ppl] [Kaspersky Lab, 6.0.0.16]
[e:\downloads files\kav6\avp6\mdmap.ppl] [Kaspersky Lab, 6.0.0.16]
[e:\downloads files\kav6\avp6\unstored.ppl] [Kaspersky Lab, 6.0.0.16]
[PID: 1460][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
[C:\windows\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
[C:\windows\system32\IEFRAME.dll] [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
[C:\windows\system32\IEUI.dll] [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
[C:\windows\system32\xmllite.dll] [Microsoft Corporation, 1.00.1018.0]
[E:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]
[C:\Program Files\Internet Explorer\ieproxy.dll] [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
[C:\windows\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[e:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll] [Thunder Networking Technologies,LTD, 1.0.2.9]
[e:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 3, 11]
[e:\Program Files\Thunder Network\Thunder\Components\ResWorker\DsBho_00.dll] [, 1, 0, 0, 4]
[e:\Program Files\Thunder Network\Thunder\Components\ResWorker\DataProcessor_00.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 6]
[E:\Program Files\360safe\safemon\safemon.dll] [, 3, 5, 0, 1001]
[C:\WINDOWS\system32\ieapfltr.dll] [Microsoft Corporation, 7.0.6000.16461]
[C:\windows\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\windows\system32\idndl.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[PID: 2916][e:\Program Files\Thunder Network\Thunder\Program\Thunder5.exe] [Thunder Networking Technologies,LTD, 5, 6, 7, 326]
[C:\windows\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\windows\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
[e:\Program Files\Thunder Network\Thunder\Program\TaskManager.dll] [Thunder Networking Technologies,LTD, 1, 1, 2, 26]
[e:\Program Files\Thunder Network\Thunder\Program\download_interface.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 46]
[e:\Program Files\Thunder Network\Thunder\Program\stlport_vc646.dll] [STLport Consulting, Inc., 4.6.2003.1031]
[e:\Program Files\Thunder Network\Thunder\Program\asyn_dns.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 46]
[e:\Program Files\Thunder Network\Thunder\Program\BHOStub.dll] [Thunder Networking Technologies,LTD, 1, 1, 0, 8]
[e:\Program Files\Thunder Network\Thunder\Program\FloatBar.dll] [Giganology Inc., 1, 0, 0, 2]
[e:\Program Files\Thunder Network\Thunder\Components\DownAndPlay\DownAndPlay.dll] [, 1, 0, 0, 18]
[e:\Program Files\Thunder Network\Thunder\Program\iTargetAD.dll] [Thunder Networking Technologies,LTD, 1, 0, 2, 28]
[C:\windows\system32\Macromed\Flash\Flash9c.ocx] [Adobe Systems, Inc., 9,0,45,0]
[C:\windows\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\windows\system32\ieframe.dll] [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
[e:\Program Files\Thunder Network\Thunder\Components\InMedia\iEmbedShell.dll] [ , 1, 0, 0, 19]
[e:\Program Files\Thunder Network\Thunder\Components\Community\XLCommunity.dll] [Thunder Networking Technologies,LTD, 1, 2, 1, 36]
[e:\Program Files\Thunder Network\Thunder\Components\Security\ThunderSafe.dll] [深圳市迅雷网络技术有限公司, 1, 0, 2, 17]
[e:\Program Files\Thunder Network\Thunder\Components\Search\XLSearch.dll] [Thunder Networking Technologies,LTD, 1, 1, 4, 15]
[e:\Program Files\Thunder Network\Thunder\Components\P4PClient\P4PClient.dll] [Thunder Networking Technologies,LTD, 2, 2, 2, 55]
[e:\Program Files\Thunder Network\Thunder\Program\LiveUpdate.dll] [Thunder Networking Technologies,LTD, 1, 2, 1, 20]
twagon - 2007-7-3 21:08:00
[e:\Program Files\Thunder Network\Thunder\Components\ExplorerHelper\ExplorerHelper.dll] [Thunder Networking Technologies,LTD, 1, 0, 4, 15]
[e:\Program Files\Thunder Network\Thunder\Components\Tips\TipsClient.dll] [Thunder Networking Technologies,LTD, 2, 1, 3, 58]
[e:\Program Files\Thunder Network\Thunder\Components\VPSHELL\VPSHELL.dll] [XunLei, 1, 2, 0, 10]
[e:\Program Files\Thunder Network\Thunder\Components\UserExperience\UserExperience.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
[e:\Program Files\Thunder Network\Thunder\Components\ResWorker\DsXlCom.dll] [, 1, 0, 0, 16]
[e:\Program Files\Thunder Network\Thunder\Components\InMedia\iEmbed10.dll] [ , 3, 3, 1, 83]
[e:\Program Files\Thunder Network\Thunder\Program\RegisterDll.dll] [Thunder Networking Technologies,LTD, 2, 13, 4, 58]
[e:\Program Files\Thunder Network\Thunder\Program\MSVCIRT.dll] [Microsoft Corporation, 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[e:\Program Files\Thunder Network\Thunder\Program\XLNet.Dll] [Thunder Networking Technologies,LTD, 1, 2, 0, 8]
[e:\Program Files\Thunder Network\Thunder\Plugins\BhoAdv\bho_adv.dll] [深圳市迅雷网络技术有限公司, 1.0.1.0]
[e:\Program Files\Thunder Network\Thunder\Components\VPSHELL\VideoPicture.dll] [XunLei, 1, 2, 0, 11]
[e:\Program Files\Thunder Network\Thunder\Components\ResWorker\DataProcessor_00.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 6]
[e:\Program Files\Thunder Network\Thunder\Components\ResWorker\MediaWorker.dll] [Thunder Networking Technologies,LTD, 1, 2, 0, 18]
[PID: 1640][d:\Program Files\WinRAR\WinRAR.exe] [N/A, ]
[C:\windows\system32\wpdshext.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\WINDOWS\system32\PortableDeviceApi.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\windows\system32\Audiodev.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\windows\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
[C:\windows\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\windows\system32\ieframe.dll] [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
[PID: 1412][C:\DOCUME~1\antonio\LOCALS~1\Temp\Rar$EX00.859\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
[C:\windows\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\windows\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
==================================
文件关联
.TXT Error. [C:\windows\notepad.exe %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM Error. ["hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI Error. [C:\windows\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1 localhost
==================================
API HOOK
N/A
==================================
隐藏进程
N/A
==================================
twagon - 2007-7-3 21:55:00
谢谢"天月来了"的提醒!!!
在不拔插头的情况下,重起,电脑时间不会改变,一切正常,但是关掉电源,第二天再开机时,时间就会变化,变成2004.10.28.
有可能是主板电池没电了,这块电池已经用了4年了.
我明天换块电池试一下,无论如何,都非常感谢"天月来了"的提醒!!!
© 2000 - 2026 Rising Corp. Ltd.