请各位高手帮我分析一下哦,谢谢! bbs.ikaka.com

zhxang9790 - 2007-7-11 14:29:00

[CODE]

2007-07-11,14:07:32

System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
<USBautoinput><D:\Program Files\汇信软件\USBautoinput.exe> [浙江汇信科技]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<MemEmpty><D:\Program Files\MemEmpty\MemEmpty.exe /h> [www.jpexe.com]
<InterBaseGuardian><C:\RCI\bin\ibguard.exe -a> [Inprise Corporation]
<LClock><C:\Program Files\LClock\LClock.exe> []
<ShStatEXE><"C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE> [McAfee, Inc.]
<McAfeeUpdaterUI><"C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey> [Network Associates, Inc.]
<Network Associates Error Reporting Service><"C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"> [Network Associates, Inc.]
<KernelFaultCheck><%systemroot%\system32\dumprep 0 -k> [N/A]
<Windows木马防火墙><C:\ftc\Trojanwall.exe> [风云谷]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><vistaui.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{F3D0D422-CE6D-47B3-9CE6-C54DD63F1ADB}><C:\Program files\Internet Explorer\PLUGINS\new123.sys> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
<Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<KernelFaultCheck><; %systemroot%\system32\dumprep 0 -k> [N/A]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<updateMgr><; "D:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1> [N/A]

==================================
启动文件夹
[EPSON Status Monitor 3 Environment Check(2)]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\EPSON Status Monitor 3 Environment Check(2).lnk --> C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [SEIKO EPSON CORPORATION]><N>

==================================
服务
[ATI / ATI][Stopped/Auto Start]
<C:\WINDOWS\ATI><N/A>
[C-DillaCdaC11BA / C-DillaCdaC11BA][Running/Auto Start]
<C:\WINDOWS\system32\drivers\CDAC11BA.EXE><Macrovision>
[EPSON Printer Status Agent2 / EPSONStatusAgent2][Running/Auto Start]
<C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe><SEIKO EPSON CORPORATION>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[McAfee Framework 服务 / McAfeeFramework][Running/Auto Start]
<C:\Program Files\Network Associates\Common Framework\FrameworkService.exe /ServiceStart><Network Associates, Inc.>
[Network Associates McShield / McShield][Running/Auto Start]
<"C:\Program Files\Network Associates\VirusScan\Mcshield.exe"><McAfee, Inc.>
[Network Associates Task Manager / McTaskManager][Running/Auto Start]
<"C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe"><Network Associates, Inc.>
[O&O Defrag / O&O Defrag][Running/Auto Start]
<D:\Program Files\OO Software\oodag.exe><O&O Software GmbH>
[Remote Packet Capture Protocol v.0 (experimental) / rpcapd][Stopped/Manual Start]
<"C:\Program Files\WinPcap\rpcapd.exe" -d -f "C:\Program Files\WinPcap\rpcapd.ini"><N/A>
[Telephonyl / Windowsail][Stopped/Auto Start]
<C:\WINDOWS\system32\serwinl.exe><N/A>

==================================
驱动程序
[AliIde / AliIde][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\aliide.sys><N/A>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[bootdrv / bootdrv][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\bootdrv.sys><N/A>
[CdaC15BA / CdaC15BA][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\CDAC15BA.SYS><Macrovision Europe Ltd>
[CmdIde / CmdIde][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\cmdide.sys><CMD Technology, Inc.>
[CMNERRS / CMNERRS][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\CMNERRS.sys><N/A>
[CMNWARNS / CMNWARNS][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\CMNWARNS.sys><N/A>
[C-Media WDM Audio Interface / cmuda][Running/Manual Start]
<system32\drivers\cmuda.sys><C-Media Inc>
[ialm / ialm][Running/Manual Start]
<system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[InterDrv / InterDrv][Running/Manual Start]
<System32\DRIVERS\InterDrv.sys><N/A>
[MegaIDE / MegaIDE][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\MegaIDE.sys><LSI Logic Corporation.>
[NaiAvFilter1 / NaiAvFilter1][Running/Manual Start]
<system32\drivers\naiavf5x.sys><McAfee Inc.>
[NaiAvTdi1 / NaiAvTdi1][Running/System Start]
<system32\drivers\mvstdi5x.sys><McAfee Inc.>
[NetGroup Packet Filter Driver / NPF][Running/Manual Start]
<system32\drivers\npf.sys><Politecnico di Torino>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\d:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[nv / nv][Stopped/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Padus ASPI Shell / pfc][Running/Manual Start]
<system32\drivers\pfc.sys><Padus, Inc.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[SKNFW / SKNFW][Running/System Start]
<\??\C:\WINDOWS\system32\Drivers\SKNFW.sys><N/A>
[SkyProcs / SkyProcs][Stopped/Manual Start]
<\??\D:\PROGRA~1\SkyNet\FireWall\SkyProcs.sys><N/A>
[snavfd2k / snavfd2k][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\snavfd2k.sys><N/A>
[SSIKRNL / SSIKRNL][Stopped/Manual Start]
<\??\d:\Program Files\DFVSX\net\SSIKRNL.sys><N/A>
[ViaIde / ViaIde][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\viaide.sys><Microsoft Corporation>
[WatchKey / WatchKey][Running/Manual Start]
<System32\Drivers\wdkey.sys><Beijing WatchData System Co., Ltd.>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
<system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[Intel(R) Graphics Platform (SoftBIOS) Driver / {6080A529-897E-4629-A488-ABA0C29B635E}][Running/System Start]
<system32\drivers\ialmsbw.sys><Intel Corporation>
[Intel(R) Graphics Chipset (KCH) Driver / {D31A0762-0CEB-444e-ACFF-B049A1F6FE91}][Running/Manual Start]
<system32\drivers\ialmkchw.sys><Intel Corporation>
[EntDrv51 / EntDrv51][Running/Manual Start]
<\??\C:\WINDOWS\system32\drivers\EntDrv51.sys><McAfee, Inc>
[p2pfilter / p2pfilter][Running/Manual Start]
<\??\D:\Program Files\NetSoft\P2POver\p2pfilter.sys><N/A>

==================================
浏览器加载项
N/A

==================================

zhxang9790 - 2007-7-11 14:33:00

正在运行的进程
[PID: 512 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 576 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 600 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[C:\WINDOWS\system32\igfxsrvc.dll] [Intel Corporation, 3,0,0,2104]
[C:\WINDOWS\system32\hccutils.DLL] [Intel Corporation, 3,0,0,2104]
[PID: 644 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\EntApi.dll] [McAfee, Inc, 8.0.0.453]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 656 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\EntApi.dll] [McAfee, Inc, 8.0.0.453]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 812 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\EntApi.dll] [McAfee, Inc, 8.0.0.453]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 876 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\EntApi.dll] [McAfee, Inc, 8.0.0.453]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 936 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\EntApi.dll] [McAfee, Inc, 8.0.0.453]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 988 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\EntApi.dll] [McAfee, Inc, 8.0.0.453]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 1020 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\EntApi.dll] [McAfee, Inc, 8.0.0.453]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 1212 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\WINDOWS\system32\EBPMON2.DLL] [SEIKO EPSON CORPORATION, 2, 16, 0, 0]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll] [Windows (R) 2000 DDK provider, 5.00.2195.1620]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\SDNT5UI.DLL] [Zenographics, Inc., 5.60.709.0]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\SDDM32.DLL] [Zenographics, Inc., 5, 60, 1511, 0]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\ZSPOOL.dll] [Zenographics, Inc., 5, 51, 709, 0]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\ZGDI32.dll] [Zenographics, Inc., 5, 60, 709, 0]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\ZTAG32.dll] [Zenographics, Inc., 5, 60, 1210, 0]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\SDDMUI.DLL] [Zenographics, Inc., 5, 60, 1520, 0]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\SR32.dll] [Zenographics, Inc., 5, 60, 1407, 0]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_DU15DE.DLL] [SEIKO EPSON Corporation, 0.3.0.1]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_DMAI13.DLL] [SEIKO EPSON Corporation, 0. 3. 0. 5]
[PID: 1368 / SYSTEM][C:\WINDOWS\system32\drivers\CDAC11BA.EXE] [Macrovision, 4.20.020]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 1416 / SYSTEM][C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe] [SEIKO EPSON CORPORATION, 2, 1, 0, 0]
[C:\WINDOWS\system32\EBAPI2.DLL] [SEIKO EPSON CORPORATION, 1, 3, 0, 0]
[C:\Program Files\Common Files\EPSON\EBAPI\EBPLPT.DLL] [SEIKO EPSON CORPORATION, 2, 16, 0, 0]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 1496 / SYSTEM][C:\Program Files\Network Associates\Common Framework\FrameworkService.exe] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\nailog.dll] [Network Associates, Inc., 3.5.0.474]
[C:\Program Files\Network Associates\Common Framework\naXML.dll] [Network Associates, Inc., 3.5.0.474]
[C:\Program Files\Network Associates\Common Framework\naCmnLib.dll] [Network Associates, Inc., 3.5.0.474]
[C:\Program Files\Network Associates\Common Framework\applib.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\0804\AgentRes.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\Logging.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\InternetManager.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\naInet.dll] [Network Associates, Inc., 3.5.0.474]
[C:\Program Files\Network Associates\Common Framework\UserSpace.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\SecureFrameworkFactory.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\Management.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\cmalib.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\naPolicyManager.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\PsApi.dll] [Microsoft Corporation, 4.00]
[C:\Program Files\Network Associates\Common Framework\ScriptSubSys.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\UpdateSubSys.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\Scheduler.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\TCSubSys.dll] [Network Associates, Inc., 3.5.0.412]
[C:\WINDOWS\system32\EntApi.dll] [McAfee, Inc, 8.0.0.453]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 1532 / SYSTEM][C:\Program Files\Network Associates\VirusScan\Mcshield.exe] [McAfee, Inc., 8.0.0.336]
[C:\Program Files\Network Associates\VirusScan\Res04\McShield.DLL] [Network Associates, Inc., 8.0.0.251]
[C:\Program Files\Network Associates\VirusScan\FTL.Dll] [Network Associates, Inc., 8.0.0.135]
[C:\Program Files\Network Associates\VirusScan\naiann.dll] [Network Associates, Inc., 8.0.0.308]
[C:\Program Files\Network Associates\VirusScan\mytilus.dll] [McAfee, Inc., 8.0.0.337]
[C:\Program Files\Network Associates\Common Framework\GenEvtInf.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\VirusScan\NaEventU.DLL] [Network Associates, Inc., 8.0.0.356]
[C:\Program Files\Network Associates\VirusScan\Res04\naEvtRes.dll] [Network Associates, Inc., 8.0.0.342]
[C:\Program Files\Network Associates\VirusScan\VSIDSvr.dll] [Network Associates, Inc., 8.0.0.291]
[C:\Program Files\Common Files\Network Associates\Engine\MCSCAN32.DLL] [McAfee, Inc., 5.1.00]
[C:\Program Files\Network Associates\Common Framework\SecureFrameworkFactory.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\VirusScan\EntSrv.Dll] [McAfee, Inc, 8.0.0.453]
[C:\WINDOWS\system32\msxml4.dll] [Microsoft Corporation, 4.20.9818.0]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 1536 / SYSTEM][C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe] [Network Associates, Inc., 3.5.0.412]
[C:\PROGRA~1\NETWOR~1\COMMON~1\nailog.dll] [Network Associates, Inc., 3.5.0.474]
[C:\PROGRA~1\NETWOR~1\COMMON~1\naCmnLib.dll] [Network Associates, Inc., 3.5.0.474]
[C:\PROGRA~1\NETWOR~1\COMMON~1\naXML.dll] [Network Associates, Inc., 3.5.0.474]
[C:\PROGRA~1\NETWOR~1\COMMON~1\0804\AgentRes.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\VirusScan\VsPlugin.dll] [McAfee, Inc., 8.0.0.1039]
[C:\WINDOWS\system32\EntApi.dll] [McAfee, Inc, 8.0.0.453]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 1588 / SYSTEM][C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe] [Network Associates, Inc., 8.0.0.1004]
[C:\Program Files\Network Associates\VirusScan\SHUTIL.dll] [McAfee, Inc., 8.0.0.1036]
[C:\Program Files\Network Associates\VirusScan\naiwmain.dll] [Network Associates, Inc., 8.0.0.912]
[C:\Program Files\Network Associates\VirusScan\naicondl.dll] [Network Associates, Inc., 8.0.0.912]
[C:\Program Files\Network Associates\VirusScan\RES04\VsTskMgr.dll] [Network Associates, Inc., 8.0.0.912]
[C:\Program Files\Network Associates\VirusScan\MIDUtil.Dll] [McAfee, Inc., 8.0.0.155]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 1772 / SYSTEM][D:\Program Files\OO Software\oodag.exe] [O&O Software GmbH, 8.0.1398]
[D:\Program Files\OO Software\OODAGRS.DLL] [O&O Software GmbH, 8.0.1.1347]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 1844 / zhangxg][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86]
[C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] [Autodesk, 16.0.0.86]
[C:\Program Files\LClock\LC.dll] [N/A, ]
[C:\WINDOWS\system32\EntApi.dll] [McAfee, Inc, 8.0.0.453]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\igfxpph.dll] [Intel Corporation, 3,0,0,2104]
[C:\WINDOWS\system32\hccutils.DLL] [Intel Corporation, 3,0,0,2104]
[C:\WINDOWS\system32\igfxres.dll] [Intel Corporation, 3,0,0,2104]
[C:\WINDOWS\system32\igfxsrvc.dll] [Intel Corporation, 3,0,0,2104]
[Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 3900 / zhangxg][D:\Program Files\NetSoft\P2POver\P2POver.exe] [, 2, 0, 0, 5]
[C:\WINDOWS\system32\wpcap.dll] [Politecnico di Torino, 3, 0, 0, 18]
[C:\WINDOWS\system32\pthreadVC.dll] [N/A, ]
[C:\WINDOWS\system32\packet.dll] [Politecnico di Torino, 3, 0, 0, 18]
[D:\Program Files\NetSoft\P2POver\DBdll.dll] [, 1, 0, 0, 1]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]

zhxang9790 - 2007-7-11 14:33:00

[C:\WINDOWS\system32\igfxdev.dll] [Intel Corporation, 3,0,0,2104]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[C:\Program Files\Unlocker\UnlockerCOM.dll] [N/A, ]
[d:\Program Files\WinRAR\rarext.dll] [N/A, ]
[C:\Program Files\Network Associates\VirusScan\shext.dll] [Network Associates, Inc., 8.0.0.912]
[C:\Program Files\Network Associates\VirusScan\RES04\ShExtRes.dll] [Network Associates, Inc., 8.0.0.912]
[C:\WINDOWS\system32\icm32.dll] [Microsoft Corporation, 5.1.2600.2709 (xpsp_sp2_gdr.050628-1518)]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_DU15DE.DLL] [SEIKO EPSON Corporation, 0.3.0.1]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_DMAI13.DLL] [SEIKO EPSON Corporation, 0. 3. 0. 5]
[C:\WINDOWS\system32\msdmo.dll] [, ]
[C:\WINDOWS\system32\PYJJU.IME] [北京六合源软件技术有限公司, 2, 2, 0, 4]
[C:\WINDOWS\system32\WINWB86.IME] [Microsoft Corporation, 4.00.950]
[PID: 1900 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\EntApi.dll] [McAfee, Inc, 8.0.0.453]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 1944 / SYSTEM][C:\WINDOWS\system32\tlntsvr.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 252 / LOCAL SERVICE][C:\WINDOWS\system32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 552 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\EntApi.dll] [McAfee, Inc, 8.0.0.453]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 660 / zhangxg][D:\Program Files\MemEmpty\MemEmpty.exe] [www.jpexe.com, 1.20]
[C:\WINDOWS\system32\MSVBVM60.DLL] [Microsoft Corporation, 6.00.9782]
[C:\WINDOWS\system32\vb6chs.dll] [Microsoft Corporation, 6.00.8169]
[C:\WINDOWS\system32\comctl32.ocx] [Microsoft Corporation, 6.00.8105]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 768 / zhangxg][C:\RCI\bin\ibguard.exe] [Inprise Corporation, WI-V6.0.1.0]
[C:\WINDOWS\gds32.dll] [Inprise Corporation, WI-V6.0.1.0]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 824 / zhangxg][C:\Program Files\LClock\LClock.exe] [, 1, 0, 0, 1]
[C:\Program Files\LClock\LC.dll] [N/A, ]
[C:\Program Files\LClock\Calendar.dll] [N/A, ]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 704 / zhangxg][C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE] [McAfee, Inc., 8.0.0.1040]
[C:\Program Files\Network Associates\VirusScan\SHUTIL.dll] [McAfee, Inc., 8.0.0.1036]
[C:\Program Files\Network Associates\VirusScan\naiwmain.dll] [Network Associates, Inc., 8.0.0.912]
[C:\Program Files\Network Associates\VirusScan\RES04\shstat.dll] [Network Associates, Inc., 8.0.0.912]
[C:\Program Files\Network Associates\VirusScan\RES04\Product.dll] [Network Associates, Inc., 8.0.0.912]
[C:\Program Files\Network Associates\VirusScan\RES04\McShield.dll] [Network Associates, Inc., 8.0.0.251]
[C:\Program Files\Network Associates\VirusScan\RES04\Shutilrc.dll] [Network Associates, Inc., 8.0.0.912]
[C:\Program Files\Network Associates\VirusScan\Graphics.dll] [Network Associates, Inc., 8.0.0.912]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 920 / zhangxg][C:\RCI\bin\ibserver.exe] [Inprise Corporation, WI-V6.0.1.0]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 924 / zhangxg][C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\nailog.dll] [Network Associates, Inc., 3.5.0.474]
[C:\Program Files\Network Associates\Common Framework\naCmnLib.dll] [Network Associates, Inc., 3.5.0.474]
[C:\Program Files\Network Associates\Common Framework\naXML.dll] [Network Associates, Inc., 3.5.0.474]
[C:\Program Files\Network Associates\Common Framework\0804\UpdRes.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\0804\AgentRes.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\SecureFrameworkFactory.dll] [Network Associates, Inc., 3.5.0.412]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 960 / zhangxg][C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe] [Network Associates, Inc., 2.0.275.0]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 1112 / zhangxg][C:\ftc\Trojanwall.exe] [风云谷, 5.9.0.2183]
[C:\ftc\ftcapi.dll] [fygsoft, 1.1.0.0]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86]
[C:\WINDOWS\system32\Audiodev.dll] [Microsoft Corporation, 5.2.3802.3802 built by: dnsrv(bld4act)]
[C:\Program Files\MSN Messenger\fsshext.8.0.0812.00.dll] [Microsoft Corporation, 8.0.0812.00]
[C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] [Autodesk, 16.0.0.86]
[PID: 1044 / zhangxg][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 2300 / zhangxg][D:\Program Files\汇信软件\USBautoinput.exe] [浙江汇信科技, 1.0.0.4]
[D:\Program Files\汇信软件\kpidataman.dll] [上海格尔软件股份有限公司, 1, 0, 0, 1]
[D:\Program Files\汇信软件\kpsdk20.dll] [koal, 2, 1, 6, 3]
[C:\WINDOWS\system32\kpidevice.dll] [上海格尔软件股份有限公司, 1, 0, 0, 1]
[d:\Program Files\汇信软件\ssl.dll] [H, 2, 1, 3, 8]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 2328 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]

zhxang9790 - 2007-7-11 14:34:00

[PID: 3452 / zhangxg][D:\Program Files\Tencent\QQ\QQ.exe] [TENCENT, 0, 0, 0, 0]
[D:\Program Files\Tencent\QQ\QQBaseClassInDll.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\QQHelperDll.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\BasicCtrlDll.dll] [Tencent, 7, 0, 101, 80]
[D:\Program Files\Tencent\QQ\MFC42.DLL] [Microsoft Corporation, 6.00.8665.0]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\Program Files\Tencent\QQ\RICHED32.DLL] [Microsoft Corporation, 5.00.2134.1]
[D:\Program Files\Tencent\QQ\RICHED20.dll] [Microsoft Corporation, 5.31.23.1218]
[D:\Program Files\Tencent\QQ\QQAPI.dll] [, 1, 0, 0, 1]
[d:\Program Files\Tencent\QQ\TIMProxy.dll] [tencent, 0, 3, 2, 4]
[D:\Program Files\Tencent\QQ\LoginCtrl.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\LoginCtrlRes.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\QQRes.dll] [tencent, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\WizardCtrl.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\QQMainFrame.dll] [N/A, ]
[C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx] [Macromedia, Inc., 8,0,22,0]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[D:\Program Files\Tencent\QQ\CQQApplication.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\NewSkin.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\HostingMgr.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\CameraDll.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\MailSummary.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\QQKnowledgeSearch.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\QQAllInOne.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\GroupLive.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\SCCore.dll] [TENCENT, 2, 0, 0, 1]
[D:\Program Files\Tencent\QQ\gdiplus.dll] [Microsoft Corporation, 5.1.3102.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\Program Files\Tencent\QQ\QQSpace.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\vbscript.dll] [Microsoft Corporation, 5.6.0.7426]
[C:\WINDOWS\system32\msdmo.dll] [, ]
[D:\Program Files\Tencent\QQ\QQGroupMng.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\UserDefinedHead.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\QQPlugin.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\QQConfigPlugin.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\QRingMng.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\LongConnection.dll] [tencent, 5, 0, 200, 160]
[D:\Program Files\Tencent\QQ\QQPet.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\QQAvatar.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\FlashAvatarDll.dll] [, 1, 4, 0, 1]
[D:\Program Files\Tencent\QQ\PhoneAPI.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\DialerAllinOne.dll] [tencent, 1, 4, 0, 0]
[D:\Program Files\Tencent\QQ\QQCustomFace.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\ImageOle.dll] [TODO: <Company name>, 1.0.0.1]
[D:\Program Files\Tencent\QQ\QQSceneMng.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\QQAddr.dll] [深圳市腾讯计算机系统有限公司, 5, 0, 101, 280]
[D:\Program Files\Tencent\QQ\npkcntc.dll] [INCA Internet Co., Ltd., 2006, 6, 27, 1]
[D:\Program Files\Tencent\QQ\npkpdb.dll] [INCA Internet Co., Ltd., 2003, 10, 1, 1]
[D:\Program Files\Tencent\QQ\BQQApplication.dll] [N/A, ]
[C:\WINDOWS\system32\PYJJU.IME] [北京六合源软件技术有限公司, 2, 2, 0, 4]
[C:\WINDOWS\system32\WINWB86.IME] [Microsoft Corporation, 4.00.950]
[D:\Program Files\Tencent\QQ\CommercesMng.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\PersonalDesktop.dll] [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2]
[D:\Program Files\Tencent\QQ\QQFileTransfer.dll] [Tencent, 0, 3, 3, 5]
[D:\Program Files\Tencent\QQ\GroupConnection.dll] [Tencent, 0, 3, 3, 5]
[D:\Program Files\Tencent\QQ\QQPhoneHelper.dll] [腾讯科技（深圳）有限公司, 2, 1, 9, 93]
[D:\Program Files\Tencent\QQ\QQSysMsgMng.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\QQZip.dll] [tencent, 0, 3, 2, 4]
[D:\Program Files\Tencent\QQ\QQMagicFace.dll] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86]
[C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] [Autodesk, 16.0.0.86]
[C:\Program Files\Network Associates\VirusScan\scriptproxy.dll] [Network Associates, Inc., 8.0.0.1012]
[C:\Program Files\Network Associates\VirusScan\mytilus.dll] [McAfee, Inc., 8.0.0.337]
[C:\Program Files\Network Associates\VirusScan\Res04\McShield.dll] [Network Associates, Inc., 8.0.0.251]
[C:\Program Files\Common Files\Network Associates\Engine\mcscan32.dll] [McAfee, Inc., 5.1.00]
[PID: 2160 / zhangxg][d:\Program Files\Tencent\QQ\TIMPlatform.exe] [tencent, 0, 3, 1, 8]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[d:\Program Files\Tencent\QQ\TIMProxy.dll] [tencent, 0, 3, 2, 4]
[PID: 2672 / zhangxg][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 3468 / zhangxg][D:\Program Files\博览 Brexpo\BrexpoDisposal.exe] [N/A, ]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 2720 / zhangxg][D:\Program Files\博览 Brexpo\Brexpo.exe] [N/A, ]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86]
[D:\Program Files\Microsoft Office\Office10\msohev.dll] [Microsoft Corporation, 10.0.2609]
[C:\Program Files\Common Files\Microsoft Shared\Ink\PENCHS.DLL] [Microsoft Corporation, 1.0.1038.0]
[C:\Program Files\Network Associates\VirusScan\scriptproxy.dll] [Network Associates, Inc., 8.0.0.1012]
[C:\Program Files\Network Associates\VirusScan\mytilus.dll] [McAfee, Inc., 8.0.0.337]
[C:\Program Files\Network Associates\VirusScan\Res04\McShield.dll] [Network Associates, Inc., 8.0.0.251]
[C:\Program Files\Common Files\Network Associates\Engine\mcscan32.dll] [McAfee, Inc., 5.1.00]
[C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx] [Macromedia, Inc., 8,0,22,0]
[C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] [Autodesk, 16.0.0.86]
[C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL] [Microsoft Corporation, 11.0.5510]
[C:\WINDOWS\system32\PYJJU.IME] [北京六合源软件技术有限公司, 2, 2, 0, 4]
[C:\WINDOWS\system32\WINWB86.IME] [Microsoft Corporation, 4.00.950]
[PID: 2788 / zhangxg][D:\Program Files\foundersc\fzjdb\JD\JD.exe] [上海乾隆高科技有限公司, 5, 68, 0, 0]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[PID: 4916 / zhangxg][D:\Personal\Desktop\sreng2\11111.EXE] [Smallfrogs Studio, 2.5.16.900]
[C:\ftc\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\Personal\Desktop\sreng2\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM Error. ["hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

zhxang9790 - 2007-7-11 14:34:00

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 1368, C:\WINDOWS\SYSTEM32\DRIVERS\CDAC11BA.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 1368, C:\WINDOWS\SYSTEM32\DRIVERS\CDAC11BA.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1416, C:\PROGRAM FILES\COMMON FILES\EPSON\EBAPI\SAGENT2.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 1416, C:\PROGRAM FILES\COMMON FILES\EPSON\EBAPI\SAGENT2.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1496, C:\PROGRAM FILES\NETWORK ASSOCIATES\COMMON FRAMEWORK\FRAMEWORKSERVICE.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 1496, C:\PROGRAM FILES\NETWORK ASSOCIATES\COMMON FRAMEWORK\FRAMEWORKSERVICE.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1532, C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\MCSHIELD.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 1532, C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\MCSHIELD.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1536, C:\PROGRA~1\NETWOR~1\COMMON~1\NAPRDMGR.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 1536, C:\PROGRA~1\NETWOR~1\COMMON~1\NAPRDMGR.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1588, C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\VSTSKMGR.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 1588, C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\VSTSKMGR.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1772, D:\PROGRAM FILES\OO SOFTWARE\OODAG.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 1772, D:\PROGRAM FILES\OO SOFTWARE\OODAG.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 1844, C:\WINDOWS\EXPLORER.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 1844, C:\WINDOWS\EXPLORER.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1844, C:\WINDOWS\EXPLORER.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 660, D:\PROGRAM FILES\MEMEMPTY\MEMEMPTY.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 660, D:\PROGRAM FILES\MEMEMPTY\MEMEMPTY.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 660, D:\PROGRAM FILES\MEMEMPTY\MEMEMPTY.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 768, C:\RCI\BIN\IBGUARD.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 768, C:\RCI\BIN\IBGUARD.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 768, C:\RCI\BIN\IBGUARD.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 824, C:\PROGRAM FILES\LCLOCK\LCLOCK.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 824, C:\PROGRAM FILES\LCLOCK\LCLOCK.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 824, C:\PROGRAM FILES\LCLOCK\LCLOCK.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 704, C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\SHSTAT.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 704, C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\SHSTAT.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 704, C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\SHSTAT.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 920, C:\RCI\BIN\IBSERVER.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 920, C:\RCI\BIN\IBSERVER.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 920, C:\RCI\BIN\IBSERVER.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 924, C:\PROGRAM FILES\NETWORK ASSOCIATES\COMMON FRAMEWORK\UPDATERUI.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 924, C:\PROGRAM FILES\NETWORK ASSOCIATES\COMMON FRAMEWORK\UPDATERUI.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 924, C:\PROGRAM FILES\NETWORK ASSOCIATES\COMMON FRAMEWORK\UPDATERUI.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 960, C:\PROGRAM FILES\COMMON FILES\NETWORK ASSOCIATES\TALKBACK\TBMON.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 960, C:\PROGRAM FILES\COMMON FILES\NETWORK ASSOCIATES\TALKBACK\TBMON.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 960, C:\PROGRAM FILES\COMMON FILES\NETWORK ASSOCIATES\TALKBACK\TBMON.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 1112, C:\FTC\TROJANWALL.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 1112, C:\FTC\TROJANWALL.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1112, C:\FTC\TROJANWALL.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 2300, D:\PROGRAM FILES\汇信软件\USBAUTOINPUT.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 2300, D:\PROGRAM FILES\汇信软件\USBAUTOINPUT.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2300, D:\PROGRAM FILES\汇信软件\USBAUTOINPUT.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 3900, D:\PROGRAM FILES\NETSOFT\P2POVER\P2POVER.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 3900, D:\PROGRAM FILES\NETSOFT\P2POVER\P2POVER.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3900, D:\PROGRAM FILES\NETSOFT\P2POVER\P2POVER.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 3452, D:\PROGRAM FILES\TENCENT\QQ\QQ.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 3452, D:\PROGRAM FILES\TENCENT\QQ\QQ.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3452, D:\PROGRAM FILES\TENCENT\QQ\QQ.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 2160, D:\PROGRAM FILES\TENCENT\QQ\TIMPLATFORM.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 2160, D:\PROGRAM FILES\TENCENT\QQ\TIMPLATFORM.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2160, D:\PROGRAM FILES\TENCENT\QQ\TIMPLATFORM.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 3468, D:\PROGRAM FILES\博览 BREXPO\BREXPODISPOSAL.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 3468, D:\PROGRAM FILES\博览 BREXPO\BREXPODISPOSAL.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3468, D:\PROGRAM FILES\博览 BREXPO\BREXPODISPOSAL.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 2720, D:\PROGRAM FILES\博览 BREXPO\BREXPO.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 2720, D:\PROGRAM FILES\博览 BREXPO\BREXPO.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2720, D:\PROGRAM FILES\博览 BREXPO\BREXPO.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 2788, D:\PROGRAM FILES\FOUNDERSC\FZJDB\JD\JD.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 2788, D:\PROGRAM FILES\FOUNDERSC\FZJDB\JD\JD.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2788, D:\PROGRAM FILES\FOUNDERSC\FZJDB\JD\JD.EXE]

==================================
API HOOK
入口点错误：FreeLibrary (危险等级: 高, 被下面模块所HOOK: 0x5F00002D)

==================================
隐藏进程
N/A

==================================

[/CODE]

瑞星卡卡安全论坛