求教~~~~系统找不到samsun.exe bbs.ikaka.com

丹阳抗排处 - 2007-7-19 10:48:00

以下是扫描结果,请帮忙看看
007-07-19,10:25:53

System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Panasonic Device Monitor Wakeup><C:\Program Files\Panasonic\Device Monitor\dmwakeup.exe> [Panasonic Communications Co., Ltd.]
<Panasonic Device Manager for KX-FLB800/FLM650 Series><C:\Program Files\Panasonic\KX-FLB800_FLM650系列\ResPcDev.exe> [Panasonic Communications Co.,Ltd.]
<Panasonic PCFAX for KX-FLB800/FLM650 Series><C:\Program Files\Panasonic\KX-FLB800_FLM650系列\KmPcFax.exe -1> [Panasonic Communications Co.,Ltd.]
<runeip><"F:\kaka\runiep.exe" /startup> [Beijing Rising Technology Co., Ltd.]
<CnsMin><Rundll32.exe C:\WINDOWS\DOWNLO~1\CnsMin.dll,Rundll32> [(Verified)"INTER CHINA NETWORK SOFTWARE (BEIJING) CO., LTD."]
<AVP><"F:\杀毒软件\avp.exe"> [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe samsun.exe> [N/A]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><F:\杀毒软件\adialhk.dll> [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}><C:\WINDOWS\system32\shlhook.dll> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
<WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll> [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
<Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
<N/A><C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<AVP><; "F:\杀毒软件\avp.exe"> [Kaspersky Lab]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [N/A]
<PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows Publisher]
<PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows Publisher]
<SunJavaUpdateSched><; C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe> [N/A]

丹阳抗排处 - 2007-7-19 10:49:00

==================================
启动文件夹
[AutoCAD 启动加速器]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\AutoCAD 启动加速器.lnk --> C:\PROGRA~1\COMMON~1\AUTODE~1\ACSTAR~1.EXE [Autodesk, Inc]><N>

==================================
服务
[ASP.NET State Service / aspnet_state][Stopped/Manual Start]
<C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe><Microsoft Corporation>
[Autodesk Licensing Service / Autodesk Licensing Service][Stopped/Manual Start]
<"C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe"><Autodesk, Inc.>
[卡巴斯基互联网安全套装6.0个人版 / AVP][Stopped/Auto Start]
<F:\杀毒软件\avp.exe -r><Kaspersky Lab>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Panasonic Local Printer Service / Panasonic Local Printer Service][Running/Auto Start]
<C:\PROGRA~1\PANASO~1\LocalCom\lmsrvnt.exe><Panasonic Communications Co., Ltd.>
[Panasonic Trap Monitor Service / Panasonic Trap Monitor Service][Running/Auto Start]
<C:\PROGRA~1\PANASO~1\TRAPMO~1\Trapmnnt.exe><Panasonic>
[Windows Media Connect Service / WMConnectCDS][Stopped/Manual Start]
<C:\Program Files\Windows Media Connect 2\wmccds.exe><Microsoft Corporation>

==================================
驱动程序
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Stopped/Manual Start]
<system32\drivers\ac97intc.sys><Intel Corporation>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[ATSpy / ATSpy][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\ATSpy.sys><N/A>
[Creative SBLive! Gameport / ctljystk][Stopped/Manual Start]
<system32\DRIVERS\ctljystk.sys><Creative Technology Ltd.>
[GMSIPCI / GMSIPCI][Stopped/Manual Start]
<\??\G:\INSTALL\GMSIPCI.SYS><N/A>
[kl1 / kl1][Running/Boot Start]
<\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif][Running/System Start]
<\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[nv / nv][Running/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[oreans32 / oreans32][Running/System Start]
<\??\C:\WINDOWS\system32\drivers\oreans32.sys><N/A>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
<\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising Technology Co., Ltd.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[R2A / R2A][Stopped/Disabled]
<\??\C:\WINDOWS\system32a2.sys><N/A>

==================================
浏览器加载项
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>
[CnsHook Class]
{D157330A-9EF3-49F8-9A67-4141AC41ADD4} <C:\WINDOWS\DOWNLO~1\CnsHook.dll, 国风因特软件（北京）有限公司>
[Web反病毒统计]
{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <F:\杀毒软件\scieplugin.dll, Kaspersky Lab>
[Yahoo 3.5G电邮]
{507F9113-CD77-4866-BA92-0E86DA3D0B97} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail, N/A>
[名品折扣]
{59BC54A2-56B3-44a0-93E5-432D58746E26} <http://adtaobao.allyes.com/main/adfclick?db=adtaobao&bid=138,140,18&cid=816,8,1&sid=5042&show=ignore&url=http://www.taobao.com/vertical/mall/pro.php?allyesPara=816, N/A>
[雅虎助手]
{5D73EE86-05F1-49ed-B850-E423120EC338} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist, N/A>
[雅虎WIDGET]
{6354ABE6-05F1-49ed-B850-E423120EC338} <http://cn.widget.yahoo.com/index.htm?source=Cns, N/A>
[情景聊天]
{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg, N/A>
[]
{ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair, N/A>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, N/A>
[]
{FD00D911-7529-4084-9946-A29F1BDF4FE5} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean, N/A>
[金山毒霸在线产品升级]
{E847C78C-C210-4195-8799-FBF3BF89797D} <C:\PROGRA~1\KOS\KOSInit.OCX, 金山软件股份有限公司>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[Recorder Control]
{2423AB16-9F42-457B-A337-FE3B11964DB0} <F:\bluesky\BLUESK~1\recorder.ocx, Bluesky Studio (http://www.bluesky.cn)>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[BlueskyVideo Control]
{2EA6D939-4445-43F1-A12B-8CB3DDA8B855} <F:\bluesky\BLUESK~1\v2.ocx, 蓝天工作室(http://www.bluesky.cn)>
[Ppd Control]
{2F2BA87D-385E-4922-B41C-06E190B06AA9} <F:\bluesky\BLUESK~1\ppd.ocx, Bluesky Studio(http://www.bluesky.cn)>
[Share Control]
{3072B1F1-0C4D-4E76-A7C6-FBAF129DBCC9} <F:\bluesky\BLUESK~1\share.ocx, Bluesky Studio(http://www.bluesky.cn)>
[IETag Factory]
{38481807-CA0E-42D2-BF39-B33AF135CC4D} <C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\IETAG.DLL, Microsoft Corporation>
[HHCtrl Object]
{52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[金山毒霸在线杀毒]
{577A1997-6FD0-4972-B234-885DA583F9CE} <C:\PROGRA~1\KOS\KOSClean.OCX, 金山软件股份有限公司>
[Traceppd Control]
{5910C66C-F9BA-4306-8175-C098B7F0ED62} <F:\bluesky\BLUESK~1\traceppd.ocx, BlueskyStudio(http://www.bluesky.cn)>
[PP Control]
{616DACC1-C5E6-4646-B36A-3FA4FC726BAD} <F:\bluesky\BLUESK~1\ppc.ocx, Bluesky Studio (http://www.bluesky.cn)>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Videohelp Control]
{75B75D86-D88B-4BEA-BC59-BFD9D7300518} <F:\bluesky\BLUESK~1\VIDEOH~1.OCX, Bluesky Studio(http://www.bluesky.cn)>
[AutoLive]
{7CA83CF1-3AEA-42D0-A4E3-1594FC6E48B2} <C:\PROGRA~1\3721\autolive.dll, 国风因特软件（北京）有限公司>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Filetran Control]
{88734439-46D0-42C0-A13F-7E881EE550CF} <F:\bluesky\BLUESK~1\filetran.ocx, Bluesky Studio(http://www.bluesky.cn)>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>
[Chat Control]
{94EFE58C-E678-4808-AD65-24CE4B94C1FE} <F:\bluesky\BLUESK~1\chat.ocx, Bluesky Studio(http://www.bluesky.cn)>
[Blueskyvoice Control]
{991481A7-4669-4e15-8C24-100404E1F5CB} <F:\bluesky\BLUESK~1\BLUESK~1.OCX, 蓝天工作室(http://www.bluesky.cn)>
[Display Control]
{A1D97DB3-E564-4743-B2E7-6F5182CBF406} <F:\bluesky\BLUESK~1\display.ocx, Bluesky Studio (http://www.bluesky.cn)>
[Tracechat Control]
{A40335C4-D3D1-4E7B-9130-039CDA5B603C} <F:\bluesky\BLUESK~1\TRACEC~1.OCX, Bluesky Studio(http://www.bluesky.cn)>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[PPChat Control]
{AFB97F16-B7E8-4EB1-8133-FBD5AA2EBB3B} <F:\bluesky\BLUESK~1\ppchat.ocx, Bluesky Studio(http://www.bluesky.cn)>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Blueskyvoice Control]
{BA0F088C-72C1-475a-92F8-42391DEF6961} <F:\bluesky\BLUESK~1\BLUESK~2.OCX, 蓝天工作室(http://www.bluesky.cn)>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\system\msadc\msadco.dll, Microsoft Corporation>
[Client Control]
{C7B0C764-5D4E-433E-A854-591F28520577} <F:\bluesky\BLUESK~1\client.ocx, >
[Play Control]
{CC20DDA1-9A21-4DEC-B5BE-E61E0351FCA9} <F:\bluesky\BLUESK~1\play.ocx, Bluesky Studio (http://www.bluesky.cn)>
[AUDIO__X_MS_WMA Moniker Class]
{CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[CnsHook Class]
{D157330A-9EF3-49F8-9A67-4141AC41ADD4} <C:\WINDOWS\DOWNLO~1\CnsHook.dll, 国风因特软件（北京）有限公司>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[金山毒霸在线产品升级]
{E847C78C-C210-4195-8799-FBF3BF89797D} <C:\PROGRA~1\KOS\KOSInit.OCX, 金山软件股份有限公司>
[IEDown Class]
{F917534D-535B-416B-8E8F-0C04756C31A8} <C:\WINDOWS\system32\GLIEDown2.dll, 联众公司>
[使用迅雷下载]
<C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
[使用迅雷下载全部链接]
<C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ表情]
<f:\Tencent\QQ\AddEmotion.htm, N/A>

==================================

丹阳抗排处 - 2007-7-19 10:52:00

正在运行的进程
[PID: 496][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 556][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 580][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\klogon.dll] [Kaspersky Lab, 6.0.2.621]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 624][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 636][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 788][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 832][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 912][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[F:\杀毒软件\adialhk.dll] [Kaspersky Lab, 6.0.2.621]
[PID: 952][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1040][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1228][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\WINDOWS\system32\PI86FXLMON.DLL] [Panasonic Communications Co., Ltd., 5.03.1636.1]
[C:\WINDOWS\system32\T1DL2K.DLL] [pcc, 1, 0, 0, 1]
[PID: 1452][C:\WINDOWS\Explorer.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\AcSignIcon.dll] [Autodesk, 16.1.63.0]
[F:\杀毒软件\scrchpg.dll] [Kaspersky Lab, 6.0.2.621]
[C:\WINDOWS\system32\shlhook.dll] [Beijing Rising Technology Co., Ltd., 4.0.0.7]
[C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] [Autodesk, 16.1.63.0]
[F:\kaka\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [国风因特软件（北京）有限公司, 2.5.1.0]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
[F:\杀毒软件\ShellEx.dll] [Kaspersky Lab, 6.0.2.621]
[F:\杀毒软件\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.42]
[F:\杀毒软件\MSVCP80.dll] [Microsoft Corporation, 8.00.50727.42]
[F:\杀毒软件\adialhk.dll] [Kaspersky Lab, 6.0.2.621]
[C:\WINDOWS\DOWNLO~1\CnsHook.dll] [国风因特软件（北京）有限公司, 2.5.1.6]
[C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 2]
[C:\WINDOWS\system32\msadp32.acm] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]
[C:\WINDOWS\DOWNLO~1\CnsMinIO.dll] [国风因特软件（北京）有限公司, 2.5.0.5]
[C:\WINDOWS\DOWNLO~1\cnsio.dll] [国风因特软件（北京）有限公司, 2.5.0.4]
[C:\WINDOWS\system32\Audiodev.dll] [Microsoft Corporation, 5.2.3802.3802 built by: dnsrv(bld4act)]
[PID: 1580][C:\Program Files\Panasonic\Device Monitor\dmwakeup.exe] [Panasonic Communications Co., Ltd., 1.02]
[C:\Program Files\Panasonic\Device Monitor\dcpi.dll] [Panasonic Communications Co., Ltd., 1.01]
[C:\Program Files\Panasonic\Device Monitor\pccini.dll] [Panasonic Communications Co., Ltd., 1.03]
[C:\Program Files\Panasonic\Device Monitor\pccxml.dll] [Panasonic Communications Co., Ltd., 1.04]
[C:\Program Files\Panasonic\Device Monitor\stdms.dll] [Panasonic Communications Co., Ltd., 1.00]
[C:\Program Files\Panasonic\Device Monitor\stdsn.dll] [Panasonic Communications Co., Ltd., 1.02]
[C:\Program Files\Panasonic\Device Monitor\pccsnmp.dll] [Panasonic Communications Co., Ltd., 1.09]
[C:\Program Files\Panasonic\Device Monitor\kxfl86lo.dll] [Panasonic Communications Co., Ltd., 0, 2, 0, 1]
[F:\kaka\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [国风因特软件（北京）有限公司, 2.5.1.0]
[PID: 1588][C:\Program Files\Panasonic\KX-FLB800_FLM650系列\ResPcDev.exe] [Panasonic Communications Co.,Ltd., 1, 0, 3, 1]
[C:\Program Files\Panasonic\KX-FLB800_FLM650系列\fl851nwk.dll] [Panosonic Communications Co., Ltd., 1, 0, 0, 2]
[C:\Program Files\Panasonic\KX-FLB800_FLM650系列\fl851sel.dll] [Panasonic Communications Co., Ltd., 1, 0, 0, 6]
[F:\kaka\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [国风因特软件（北京）有限公司, 2.5.1.0]
[PID: 1608][F:\kaka\runiep.exe] [Beijing Rising Technology Co., Ltd., 4.0.0.15]
[F:\kaka\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [国风因特软件（北京）有限公司, 2.5.1.0]
[PID: 1624][C:\WINDOWS\system32\Rundll32.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [国风因特软件（北京）有限公司, 2.5.1.0]
[C:\WINDOWS\DOWNLO~1\CnsMinIO.dll] [国风因特软件（北京）有限公司, 2.5.0.5]
[C:\WINDOWS\DOWNLO~1\cnsio.dll] [国风因特软件（北京）有限公司, 2.5.0.4]
[C:\WINDOWS\DOWNLO~1\CnsMinEx.dll] [国风因特软件（北京）有限公司, 2.5.0.4]
[F:\kaka\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 1644][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[F:\kaka\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [国风因特软件（北京）有限公司, 2.5.1.0]
[PID: 372][C:\PROGRA~1\PANASO~1\LocalCom\lmsrvnt.exe] [Panasonic Communications Co., Ltd., 0.80]
[PID: 392][C:\PROGRA~1\PANASO~1\TRAPMO~1\Trapmnnt.exe] [Panasonic, 1.09]
[PID: 424][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 292][C:\WINDOWS\system32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[PID: 2272][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3012][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [国风因特软件（北京）有限公司, 2.5.1.0]
[C:\WINDOWS\DOWNLO~1\CnsHint.dll] [国风因特软件（北京）有限公司, 2.5.0.3]
[F:\杀毒软件\scrchpg.dll] [Kaspersky Lab, 6.0.2.621]
[C:\WINDOWS\DOWNLO~1\cnsplus.dll] [国风因特软件（北京）有限公司, 2.5.0.3]
[C:\WINDOWS\system32\AcSignIcon.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 2]
[C:\WINDOWS\DOWNLO~1\CnsHook.dll] [国风因特软件（北京）有限公司, 2.5.1.6]
[F:\杀毒软件\adialhk.dll] [Kaspersky Lab, 6.0.2.621]
[F:\kaka\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]
[F:\杀毒软件\klscav.dll] [Kaspersky Lab, 6.0.2.621]
[F:\杀毒软件\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.42]
[F:\杀毒软件\prloader.dll] [Kaspersky Lab, 6.0.2.621]

丹阳抗排处 - 2007-7-19 10:52:00

[C:\WINDOWS\DOWNLO~1\CnsMinIO.dll] [国风因特软件（北京）有限公司, 2.5.0.5]
[C:\WINDOWS\DOWNLO~1\cnsio.dll] [国风因特软件（北京）有限公司, 2.5.0.4]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\msadp32.acm] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\JPWB.IME] [常诚研制, 4.00.950]
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL] [Microsoft Corporation, 11.0.5510]
[PID: 3644][C:\Program Files\Tencent\QQGAME\QQGame.exe] [深圳市腾讯计算机系统有限公司, 2, 0, 201, 11]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [国风因特软件（北京）有限公司, 2.5.1.0]
[C:\Program Files\Tencent\QQGAME\Common\Utility.dll] [N/A, ]
[C:\Program Files\Tencent\QQGAME\HelpDll.dll] [, 1, 0, 0, 1]
[C:\Program Files\Tencent\QQGAME\ResEx.dll] [深圳市腾讯计算机系统有限公司, 0, 10, 0, 0]
[C:\Program Files\Tencent\QQGAME\factory.dll] [N/A, ]
[C:\Program Files\Tencent\QQGAME\Logic\UIStyle.dll] [N/A, ]
[C:\Program Files\Tencent\QQGAME\Logic\MainLogi.dll] [N/A, ]
[C:\Program Files\Tencent\QQGAME\Res\ErrorDes.dll] [N/A, ]
[C:\Program Files\Tencent\QQGAME\Logic\Login.dll] [N/A, ]
[C:\Program Files\Tencent\QQGAME\cximage.dll] [Pizzolato Davide - www.xdp.it, 5, 9, 9, c]
[C:\Program Files\Tencent\QQGAME\UI\CommonUI.dll] [, 1, 0, 0, 1]
[C:\Program Files\Tencent\QQGAME\UI\SocialUI.dll] [N/A, ]
[C:\Program Files\Tencent\QQGAME\Res\QGString.dll] [N/A, ]
[C:\Program Files\Tencent\QQGAME\Logic\ComAsyn.dll] [N/A, ]
[C:\Program Files\Tencent\QQGAME\Storage\MiscStor.dll] [N/A, ]
[C:\Program Files\Tencent\QQGAME\Logic\ChanAdd\DirChn.dll] [N/A, ]
[C:\Program Files\Tencent\QQGAME\Logic\DlProxy.dll] [N/A, ]
[C:\Program Files\Tencent\QQGAME\Common\ProcMsg.dll] [, 1, 0, 0, 1]
[C:\Program Files\Tencent\QQGAME\Logic\LaFDown.dll] [N/A, ]
[C:\Program Files\Tencent\QQGAME\UI\MainUI.dll] [, 1, 0, 0, 1]
[C:\Program Files\Tencent\QQGAME\Tenio\TenFact.dll] [N/A, ]
[C:\Program Files\Tencent\QQGAME\Tenio\TenHall.dll] [N/A, ]
[F:\杀毒软件\scrchpg.dll] [Kaspersky Lab, 6.0.2.621]
[C:\Program Files\Tencent\QQGAME\Common\Compress.dll] [N/A, ]
[C:\Program Files\Tencent\QQGAME\ProtHand\QQProt.dll] [N/A, ]
[C:\Program Files\Tencent\QQGAME\ProtHand\BaseProt.dll] [N/A, ]
[F:\kaka\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Program Files\Tencent\QQGAME\Socket\NetMod.dll] [N/A, ]
[C:\Program Files\Tencent\QQGAME\Logic\GAvatar.dll] [N/A, ]
[C:\Program Files\Tencent\QQGAME\python24.dll] [Python Software Foundation, 2.4.1]
[C:\Program Files\Tencent\QQGAME\Logic\ScripEng.dll] [N/A, ]
[C:\Program Files\Tencent\QQGAME\Logic\ItemShop.dll] [N/A, ]
[C:\Program Files\Tencent\QQGAME\Logic\ShopMgr.dll] [N/A, ]
[C:\Program Files\Tencent\QQGAME\Logic\MRoomMgr.dll] [N/A, ]
[C:\Program Files\Tencent\QQGAME\Logic\QQAvDld.dll] [N/A, ]
[F:\杀毒软件\adialhk.dll] [Kaspersky Lab, 6.0.2.621]
[F:\杀毒软件\klscav.dll] [Kaspersky Lab, 6.0.2.621]
[F:\杀毒软件\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.42]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\msadp32.acm] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[PID: 3672][C:\Program Files\Tencent\QQGAME\QQGameDl.exe] [N/A, ]
[C:\Program Files\Tencent\QQGAME\Common\Utility.dll] [N/A, ]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [国风因特软件（北京）有限公司, 2.5.1.0]
[C:\Program Files\Tencent\QQGAME\factory.dll] [N/A, ]
[C:\Program Files\Tencent\QQGAME\Logic\UIStyle.dll] [N/A, ]
[C:\Program Files\Tencent\QQGAME\Logic\DlImpl.dll] [N/A, ]
[C:\Program Files\Tencent\QQGAME\Logic\DlProxy.dll] [N/A, ]
[C:\Program Files\Tencent\QQGAME\Common\ProcMsg.dll] [, 1, 0, 0, 1]
[F:\kaka\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Program Files\Tencent\QQGAME\ProtHand\BaseProt.dll] [N/A, ]
[C:\Program Files\Tencent\QQGAME\Socket\NetMod.dll] [N/A, ]
[PID: 3944][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [国风因特软件（北京）有限公司, 2.5.1.0]
[C:\WINDOWS\DOWNLO~1\CnsHint.dll] [国风因特软件（北京）有限公司, 2.5.0.3]
[F:\杀毒软件\scrchpg.dll] [Kaspersky Lab, 6.0.2.621]
[C:\WINDOWS\DOWNLO~1\cnsplus.dll] [国风因特软件（北京）有限公司, 2.5.0.3]
[C:\WINDOWS\system32\AcSignIcon.dll] [Autodesk, 16.1.63.0]
[C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 2]
[C:\WINDOWS\DOWNLO~1\CnsHook.dll] [国风因特软件（北京）有限公司, 2.5.1.6]
[F:\杀毒软件\adialhk.dll] [Kaspersky Lab, 6.0.2.621]
[F:\kaka\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]
[F:\杀毒软件\klscav.dll] [Kaspersky Lab, 6.0.2.621]
[F:\杀毒软件\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.42]
[F:\杀毒软件\prloader.dll] [Kaspersky Lab, 6.0.2.621]
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\xpsp3res.dll] [Microsoft Corporation, 5.1.2600.3121 (xpsp_sp2_gdr.070418-0032)]
[C:\WINDOWS\DOWNLO~1\CnsMinIO.dll] [国风因特软件（北京）有限公司, 2.5.0.5]
[C:\WINDOWS\DOWNLO~1\cnsio.dll] [国风因特软件（北京）有限公司, 2.5.0.4]
[C:\WINDOWS\system32\msadp32.acm] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Thunder Network\Thunder\ComDlls\ThunderAgent_003.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 10]
[C:\WINDOWS\system32\shlhook.dll] [Beijing Rising Technology Co., Ltd., 4.0.0.7]
[PID: 4080][C:\Program Files\Thunder Network\Thunder\Program\Thunder5.exe] [Thunder Networking Technologies,LTD, 5.4.0.226]
[C:\Program Files\Thunder Network\Thunder\Program\UpdateDownload.dll] [Thunder Networking Technologies,LTD, 1, 0, 1, 8]
[C:\Program Files\Thunder Network\Thunder\Program\download_interface.dll] [Thunder Networking Technologies,LTD, 2, 0, 0, 1]
[C:\Program Files\Thunder Network\Thunder\Program\stlport_vc646.dll] [STLport Consulting, Inc., 4.6.2003.1031]
[C:\Program Files\Thunder Network\Thunder\Program\log4cplus.dll] [, 1, 0, 2, 1]
[C:\Program Files\Thunder Network\Thunder\Program\asyn_dns.dll] [N/A, ]
[C:\Program Files\Thunder Network\Thunder\Program\msgmanage.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 15]
[C:\Program Files\Thunder Network\Thunder\Program\historyinfo_manage.dll] [Thunder Networking Technologies,LTD, 5, 2, 0, 148]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [国风因特软件（北京）有限公司, 2.5.1.0]
[C:\Program Files\Thunder Network\Thunder\Program\RegisterDll.dll] [Thunder Networking Technologies,LTD, 2, 1, 0, 18]
[C:\WINDOWS\system32\msxml4.dll] [Microsoft Corporation, 4.20.9818.0]
[C:\Program Files\Thunder Network\Thunder\Program\FloatBar.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 2]
[F:\杀毒软件\adialhk.dll] [Kaspersky Lab, 6.0.2.621]
[C:\Program Files\Thunder Network\Thunder\Components\InMedia\iEmbedShell.dll] [　, 1, 0, 0, 11]
[C:\Program Files\Thunder Network\Thunder\Components\InMedia\iEmbed04.dll] [　, 2, 3, 0, 37]
[F:\kaka\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINDOWS\system32\shlhook.dll] [Beijing Rising Technology Co., Ltd., 4.0.0.7]
[C:\WINDOWS\system32\AcSignIcon.dll] [Autodesk, 16.1.63.0]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[F:\杀毒软件\scrchpg.dll] [Kaspersky Lab, 6.0.2.621]
[PID: 2136][E:\Html\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [国风因特软件（北京）有限公司, 2.5.1.0]
[F:\kaka\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[E:\Html\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]
[F:\杀毒软件\adialhk.dll] [Kaspersky Lab, 6.0.2.621]

==================================
文件关联
.TXT Error. [C:\WINDOWS\notepad.exe %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR Error. [AutoCADScriptFile]
.CHM Error. ["hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[F:\]
[AutoRun]
open=ntvdm.exe
shellexecute=ntvdm.exe
shell\Auto\command=ntvdm.exe
shell=Auto
[VVflagRun]
aabb=1234

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 1588, C:\PROGRAM FILES\PANASONIC\KX-FLB800_FLM650系列\RESPCDEV.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 3644, C:\PROGRAM FILES\TENCENT\QQGAME\QQGAME.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3644, C:\PROGRAM FILES\TENCENT\QQGAME\QQGAME.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 3672, C:\PROGRAM FILES\TENCENT\QQGAME\QQGAMEDL.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3672, C:\PROGRAM FILES\TENCENT\QQGAME\QQGAMEDL.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 4080, C:\PROGRAM FILES\THUNDER NETWORK\THUNDER\PROGRAM\THUNDER5.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 4080, C:\PROGRAM FILES\THUNDER NETWORK\THUNDER\PROGRAM\THUNDER5.EXE]

==================================
API HOOK
RVA 错误： LoadLibraryA (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA 错误： LoadLibraryExA (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA 错误： LoadLibraryExW (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA 错误： LoadLibraryW (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA 错误： GetProcAddress (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)

==================================
隐藏进程
N/A

瑞星卡卡安全论坛