vista 开机自动运行iexplore.exe 且显示“交互式服务对话框检测” bbs.ikaka.com

Wendy5166 - 2008-12-7 21:23:00

各位大侠，前几天卡巴报发现木马，我点击终止、隔离操作以后，电脑隔几分钟就会出现“交互式服务对话框检测”的对话框，上面说我的c:\program files\internet explore\iexplore.exe与vista不兼容，但之前从来没有出现过这个对话框。我打开任务管理器发现，里面有一个iexplore.exe开机就会自动启动，用户是system，大小在7000k左右，如果关掉就不会再出现，也不会再出现提示“交互式服务”的对话框。怀疑是木马，已经在安全模式下用多种杀毒软件和专杀工具杀过了，还是没有解决。麻烦各位大侠帮忙看看，在下感激不尽！拜谢！
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描
计划任务
API HOOK
隐藏进程

启动项目
注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Microsoft Pinyin IME Migration><C:\PROGRA~1\COMMON~1\MICROS~1\IME12\IMESC\IMSCMIG.EXE /INSTALL> [(Verified)Microsoft Corporation]
<AVP><"G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"> [(Verified)Kaspersky Lab]
<!AVG Anti-Spyware><"G:\Program Files\AVG Anti-Spyware 7.5\avgas.exe" /minimized> [(Verified)GRISOFT LTD]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><explorer.exe> [(Verified)Microsoft Windows]
<Userinit><C:\Windows\system32\userinit.exe,> [(Verified)Microsoft Windows]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{57B86673-276A-48B2-BAE7-C6DBB3020EB8}><G:\Program Files\AVG Anti-Spyware 7.5\shellexecutehook.dll> [(Verified)GRISOFT LTD]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<WebCheck><C:\Windows\system32\webcheck.dll> [(Verified)Microsoft Windows]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\DeviceNP]
<WinlogonNotify: DeviceNP><DeviceNP.dll> [Hewlett-Packard Limited]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
<WinlogonNotify: klogon><C:\Windows\system32\klogon.dll> [(Verified)Kaspersky Lab]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
<{8C7461EF-2B13-11d2-BE35-3078302C2030}><%SystemRoot%\system32\browseui.dll> [(Verified)Microsoft Windows]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
<Microsoft Windows Media Player><C:\Windows\system32\unregmp2.exe /ShowWMP> [(Verified)Microsoft Windows]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><C:\Windows\system32\ie4uinit.exe -UserIconConfig> [(Verified)Microsoft Windows]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
<Browser Customizations><RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP> [(Verified)Microsoft Windows]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
<LightScribe Control Panel><"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"> [(Verified)Hewlett-Packard Company]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Windows Mail 7><"%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><%SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI> [(Verified)Microsoft Windows]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
<Windows Desktop Update><regsvr32.exe /s /n /i:U shell32.dll> [(Verified)Microsoft Windows]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
<Internet Explorer><C:\Windows\system32\ie4uinit.exe -BaseSettings> [(Verified)Microsoft Windows]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
<N/A><C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install> [(Verified)Microsoft Windows]
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><C:\Windows\system32\ssBranded.scr> [(Verified)Microsoft Windows]

用户系统信息：Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506; .NET CLR 1.1.4322; TheWorld)

Wendy5166 - 2008-12-7 21:26:00

启动文件夹
N/A

==================================
服务
[Andrea ADI Filters Service / AEADIFilters][Running/Auto Start]
<C:\Windows\system32\AEADISRV.EXE><Andrea Electronics Corporation>
[Agere Modem Call Progress Audio / AgereModemAudio][Running/Auto Start]
<C:\Windows\system32\agrsmsvc.exe><Agere Systems>
[Application Layerg Gateway Servicet / Application Layerg Gateway Servicet][Stopped/Auto Start]
<C:\Program Files\Common Files\Routing or accesst.exe><N/A>
[Ati External Event Utility / Ati External Event Utility][Running/Auto Start]
<C:\Windows\system32\Ati2evxx.exe><ATI Technologies Inc.>
[AVG Anti-Spyware Guard / AVG Anti-Spyware Guard][Running/Auto Start]
<G:\Program Files\AVG Anti-Spyware 7.5\guard.exe><GRISOFT s.r.o.>
[Kaspersky Anti-Virus / AVP][Running/Auto Start]
<"G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" -r><Kaspersky Lab>
[Contrl Center of Storm Media / ccosm][Running/Auto Start]
<G:\Program Files\StormII\stormliv.exe /asservice><北京暴风网际科技有限公司>
[Com4Qlb / Com4Qlb][Stopped/Manual Start]
<"C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe"><Hewlett-Packard Development Company, L.P.>
[Crypkey License / Crypkey License][Running/Auto Start]
<crypserv.exe><Kenonic Controls Ltd.>
[HP ProtectTools Device Locking/Auditing / FLCDLOCK][Stopped/Manual Start]
<C:\Windows\system32\flcdlock.exe><Hewlett-Packard Ltd>
[HP Health Check Service / HP Health Check Service][Running/Auto Start]
<"c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe"><Hewlett-Packard>
[hpqwmiex / hpqwmiex][Running/Auto Start]
<C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe><Hewlett-Packard Development Company, L.P.>
[InstallDriver Table Manager / IDriverT][Stopped/Manual Start]
<"C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe"><Macrovision Corporation>
[IviRegMgr / IviRegMgr][Running/Auto Start]
<C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe><InterVideo>
[LightScribeService Direct Disc Labeling Service / LightScribeService][Running/Auto Start]
<"C:\Program Files\Common Files\LightScribe\LSSrvc.exe"><Hewlett-Packard Company>
[PDF Document Manager / pdfcDispatcher][Running/Auto Start]
<C:\Program Files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService><PDF Complete Inc>
[RoxMediaDB9 / RoxMediaDB9][Stopped/Manual Start]
<"c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe"><Sonic Solutions>
[stllssvr / stllssvr][Stopped/Manual Start]
<"c:\Program Files\Common Files\SureThing Shared\stllssvr.exe"><MicroVision Development, Inc.>
[Windows Live Setup Service / WLSetupSvc][Stopped/Manual Start]
<"C:\Program Files\Windows Live\installer\WLSetupSvc.exe"><Microsoft Corporation>

==================================
驱动程序
[ADI UAA Function Driver for High Definition Audio Service / ADIHdAudAddService][Running/Manual Start]
<system32\drivers\ADIHdAud.sys><Analog Devices, Inc.>
[adp94xx / adp94xx][Stopped/Disabled]
<\SystemRoot\system32\drivers\adp94xx.sys><Adaptec, Inc.>
[adpahci / adpahci][Stopped/Disabled]
<\SystemRoot\system32\drivers\adpahci.sys><Adaptec, Inc.>
[adpu160m / adpu160m][Stopped/Disabled]
<\SystemRoot\system32\drivers\adpu160m.sys><Adaptec, Inc.>
[adpu320 / adpu320][Stopped/Disabled]
<\SystemRoot\system32\drivers\adpu320.sys><Adaptec, Inc.>
[Agere Systems Soft Modem / AgereSoftModem][Running/Manual Start]
<system32\DRIVERS\AGRSM.sys><Agere Systems>
[aic78xx / aic78xx][Stopped/Disabled]
<\SystemRoot\system32\drivers\djsvs.sys><Adaptec, Inc.>
[aliide / aliide][Stopped/Disabled]
<\SystemRoot\system32\drivers\aliide.sys><Acer Laboratories Inc.>
[arc / arc][Stopped/Disabled]
<\SystemRoot\system32\drivers\arc.sys><Adaptec, Inc.>
[arcsas / arcsas][Stopped/Disabled]
<\SystemRoot\system32\drivers\arcsas.sys><Adaptec, Inc.>
[atikmdag / atikmdag][Running/Manual Start]
<system32\DRIVERS\atikmdag.sys><ATI Technologies Inc.>
[AVG Anti-Spyware Driver / AVG Anti-Spyware Driver][Running/System Start]
<\??\G:\Program Files\AVG Anti-Spyware 7.5\guard.sys><N/A>
[AVG Anti-Spyware Clean Driver / AvgAsCln][Running/System Start]
<System32\DRIVERS\AvgAsCln.sys><GRISOFT, s.r.o.>
[Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0 / b57nd60x][Stopped/Manual Start]
<system32\DRIVERS\b57nd60x.sys><Broadcom Corporation>
[Broadcom Extensible 802.11 网络适配器驱动程序 / BCM43XV][Stopped/Manual Start]
<system32\DRIVERS\bcmwl6.sys><Broadcom Corporation>
[blbdrive / blbdrive][Stopped/Disabled]
<\SystemRoot\system32\drivers\blbdrive.sys><N/A>
[Brother USB Mass-Storage Lower Filter Driver / BrFiltLo][Stopped/Manual Start]
<\SystemRoot\system32\drivers\brfiltlo.sys><Brother Industries, Ltd.>
[Brother USB Mass-Storage Upper Filter Driver / BrFiltUp][Stopped/Manual Start]
<\SystemRoot\system32\drivers\brfiltup.sys><Brother Industries, Ltd.>
[Brother MFC Serial Port Interface Driver (WDM) / Brserid][Stopped/Disabled]
<\SystemRoot\system32\drivers\brserid.sys><Brother Industries Ltd.>
[Brother WDM Serial driver / BrSerWdm][Stopped/Disabled]
<\SystemRoot\system32\drivers\brserwdm.sys><Brother Industries Ltd.>
[Brother MFC USB Fax Only Modem / BrUsbMdm][Stopped/Disabled]
<\SystemRoot\system32\drivers\brusbmdm.sys><Brother Industries Ltd.>
[Brother MFC USB Serial WDM Driver / BrUsbSer][Stopped/Manual Start]
<\SystemRoot\system32\drivers\brusbser.sys><Brother Industries Ltd.>
[cmdide / cmdide][Stopped/Disabled]
<\SystemRoot\system32\drivers\cmdide.sys><CMD Technology, Inc.>
[DAMDrv / DAMDrv][Stopped/Manual Start]
<system32\DRIVERS\DAMDrv.sys><Hewlett-Packard Development Company L.P.>
[Intel(R) PRO/1000 PCI Express Network Connection Driver / e1express][Running/Manual Start]
<system32\DRIVERS\e1e6032.sys><Intel Corporation>
[Intel(R) PRO/1000 NDIS 6 Adapter Driver / E1G60][Stopped/Manual Start]
<system32\DRIVERS\E1G60I32.sys><Intel Corporation>
[elxstor / elxstor][Stopped/Disabled]
<\SystemRoot\system32\drivers\elxstor.sys><Emulex>
[HBtnKey / HBtnKey][Running/Manual Start]
<system32\DRIVERS\cpqbttn.sys><Hewlett-Packard Development Company, L.P.>
[HpCISSs / HpCISSs][Stopped/Disabled]
<\SystemRoot\system32\drivers\hpcisss.sys><Hewlett-Packard Company>
[HpqKbFilter Driver / HpqKbFiltr][Running/Manual Start]
<system32\DRIVERS\HpqKbFiltr.sys><Hewlett-Packard Development Company, L.P.>
[HSFHWAZL / HSFHWAZL][Stopped/Manual Start]
<system32\DRIVERS\VSTAZL3.SYS><Conexant Systems, Inc.>
[HSF_DPV / HSF_DPV][Stopped/Manual Start]
<system32\DRIVERS\VSTDPV3.SYS><Conexant Systems, Inc.>
[Intel AHCI Controller / iaStor][Running/Boot Start]
<\SystemRoot\system32\drivers\iastor.sys><Intel Corporation>
[Intel RAID Controller Vista / iaStorV][Stopped/Disabled]
<\SystemRoot\system32\drivers\iastorv.sys><Intel Corporation>
[iirsp / iirsp][Stopped/Disabled]
<\SystemRoot\system32\drivers\iirsp.sys><Intel Corp./ICP vortex GmbH>
[IP in IP Tunnel Driver / IpInIp][Stopped/Manual Start]
<system32\DRIVERS\ipinip.sys><N/A>
[ITEATAPI_Service_Install / iteatapi][Stopped/Disabled]
<\SystemRoot\system32\drivers\iteatapi.sys><Integrated Technology Express, Inc.>
[ITERAID_Service_Install / iteraid][Stopped/Disabled]
<\SystemRoot\system32\drivers\iteraid.sys><Integrated Technology Express, Inc.>
[kl1 / kl1][Running/System Start]
<system32\DRIVERS\kl1.sys><Kaspersky Lab>
[Kaspersky Lab Boot Guard Driver / klbg][Running/Boot Start]
<\SystemRoot\system32\drivers\klbg.sys><Kaspersky Lab>
[Kaspersky Lab Driver / KLIF][Running/System Start]
<system32\DRIVERS\klif.sys><Kaspersky Lab>
[Kaspersky Anti-Virus NDIS 6 Filter / KLIM6][Running/System Start]
<system32\DRIVERS\klim6.sys><Kaspersky Lab>
[LSI_FC / LSI_FC][Stopped/Disabled]
<\SystemRoot\system32\drivers\lsi_fc.sys><LSI Logic>
[LSI_SAS / LSI_SAS][Stopped/Disabled]
<\SystemRoot\system32\drivers\lsi_sas.sys><LSI Logic>
[LSI_SCSI / LSI_SCSI][Stopped/Disabled]
<\SystemRoot\system32\drivers\lsi_scsi.sys><LSI Logic>
[megasas / megasas][Stopped/Disabled]
<\SystemRoot\system32\drivers\megasas.sys><LSI Logic Corporation>
[Mraid35x / Mraid35x][Stopped/Disabled]
<\SystemRoot\system32\drivers\mraid35x.sys><LSI Logic Corporation>
[Intel(R) Wireless WiFi Link 适配器驱动程序（适用于 Windows Vista 32 位） / NETw4v32][Running/Manual Start]
<system32\DRIVERS\NETw4v32.sys><Intel Corporation>
[NetworkX / NetworkX][Running/System Start]
<\SystemRoot\system32\ckldrv.sys><N/A>
[nfrd960 / nfrd960][Stopped/Disabled]
<\SystemRoot\system32\drivers\nfrd960.sys><IBM Corporation>
[N-trig HID Tablet Driver / ntrigdigi][Stopped/Disabled]
<\SystemRoot\system32\drivers\ntrigdigi.sys><N-trig Innovative Technologies>
[nvraid / nvraid][Stopped/Disabled]
<\SystemRoot\system32\drivers\nvraid.sys><NVIDIA Corporation>
[nvstor / nvstor][Stopped/Disabled]
<\SystemRoot\system32\drivers\nvstor.sys><NVIDIA Corporation>
[IPX Traffic Filter Driver / NwlnkFlt][Stopped/Manual Start]
<system32\DRIVERS\nwlnkflt.sys><N/A>
[IPX Traffic Forwarder Driver / NwlnkFwd][Stopped/Manual Start]
<system32\DRIVERS\nwlnkfwd.sys><N/A>
[piqoajiy / piqoajiy][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\piqoajiy.sys><Yahoo! China Corporation>
[PxHelp20 / PxHelp20][Running/Boot Start]
<\SystemRoot\System32\Drivers\PxHelp20.sys><Sonic Solutions>
[QLogic Fibre Channel Miniport Driver / ql2300][Stopped/Disabled]
<\SystemRoot\system32\drivers\ql2300.sys><QLogic Corporation>
[QLogic iSCSI Miniport Driver / ql40xx][Stopped/Disabled]
<\SystemRoot\system32\drivers\ql40xx.sys><QLogic Corporation>
[R300 / R300][Stopped/Manual Start]
<system32\DRIVERS\atikmdag.sys><ATI Technologies Inc.>
[SiSRaid2 / SiSRaid2][Stopped/Disabled]
<\SystemRoot\system32\drivers\sisraid2.sys><Silicon Integrated Systems Corp.>
[SiSRaid4 / SiSRaid4][Stopped/Disabled]
<\SystemRoot\system32\drivers\sisraid4.sys><Silicon Integrated Systems>
[Symc8xx / Symc8xx][Stopped/Disabled]
<\SystemRoot\system32\drivers\symc8xx.sys><LSI Logic>
[Sym_hi / Sym_hi][Stopped/Disabled]
<\SystemRoot\system32\drivers\sym_hi.sys><LSI Logic>
[Sym_u3 / Sym_u3][Stopped/Disabled]
<\SystemRoot\system32\drivers\sym_u3.sys><LSI Logic>
[Synaptics TouchPad Driver / SynTP][Running/Manual Start]
<system32\DRIVERS\SynTP.sys><Synaptics, Inc.>
[uliahci / uliahci][Stopped/Disabled]
<\SystemRoot\system32\drivers\uliahci.sys><ULi Electronics Inc.>
[UlSata / UlSata][Stopped/Disabled]
<\SystemRoot\system32\drivers\ulsata.sys><Promise Technology, Inc.>
[ulsata2 / ulsata2][Stopped/Disabled]
<\SystemRoot\system32\drivers\ulsata2.sys><Promise Technology, Inc.>
[viaide / viaide][Stopped/Disabled]
<\SystemRoot\system32\drivers\viaide.sys><VIA Technologies, Inc.>
[vsmraid / vsmraid][Stopped/Disabled]
<\SystemRoot\system32\drivers\vsmraid.sys><VIA Technologies Inc.,Ltd>
[winachsf / winachsf][Stopped/Manual Start]
<system32\DRIVERS\VSTCNXT3.SYS><Conexant Systems, Inc.>

==================================
浏览器加载项
[Yahoo!Photo]
{33BBE430-0E42-4f12-B075-8D21ACB10DCB} <C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll, N/A>
[IEVkbdBHO Class]
{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} <G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll, (Signed) Kaspersky Lab>
[DragSearch BHO]
{62EED7C6-9F02-42f9-B634-98E2899E147B} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL, N/A>
[SSVHelper Class]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} <C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll, (Signed) Sun Microsystems, Inc.>
[Windows Live 登录帮助程序]
{9030D464-4C02-4ABF-8ECC-5164760863C6} <C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll, (Signed) Microsoft Corporation>
[yFlashDl Class]
{F166BC04-3C84-44cc-A6E9-2315EC4844B9} <C:\Program Files\Yahoo!\Assistant\Assist\yflashdl.dll, N/A>
[assist]
{FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8} <C:\Program Files\Yahoo!\Assistant\Assist\yassist.dll, N/A>
[Java Plug-in 1.6.0_07]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll, (Signed) Sun Microsystems, Inc.>
[启动迅雷5]
{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <G:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[Web 流量保护状态]
{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll, (Signed) Kaspersky Lab>
[BitComet Button]
{461CC20B-FB6E-4f16-8FE8-C29359DB100E} <G:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll, N/A>
[雅虎助手]
{5D73EE86-05F1-49ed-B850-E423120EC338} <http://cn.zs.yahoo.com/start.htm?source=yzs_icon&btn=yassistnew, N/A>
[信息检索(&R)]
{92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL, (Signed) Microsoft Corporation>
[雅虎助手]
{406F94F0-504F-4A40-8DFD-58B0666ABEBD} <C:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll, N/A>
[Edit Class]
{0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\Windows\system32\CMBEdit.dll, >
[Java Plug-in 1.6.0_07]
{8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll, (Signed) Sun Microsystems, Inc.>
[Java Plug-in 1.6.0_01]
{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} <C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll, (Signed) Sun Microsystems, Inc.>
[Java Plug-in 1.6.0_07]
{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} <C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll, (Signed) Sun Microsystems, Inc.>
[Java Plug-in 1.6.0_07]
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll, (Signed) Sun Microsystems, Inc.>
[ThunderAtOnce Class]
{01443AEC-0FD1-40FD-9C87-E93D1494C233} <G:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll, N/A>
[]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} <, >
[]
{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <, >
[Edit Class]
{0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\Windows\system32\CMBEdit.dll, >
[]
{1E8A6170-7264-4D0F-BEAE-D42A53123C75} <, >
[]
{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <, >
[Yahoo!Photo]
{33BBE430-0E42-4F12-B075-8D21ACB10DCB} <C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll, N/A>
[Windows Live OneCare safety scanner control]
{3860DD98-0549-4D50-AA72-5D17D200EE10} <%ProgramFiles%\Windows Live Safety Center\wlscCtrl2.dll, (Signed) N/A>
[BitComet Helper]
{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} <G:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll, N/A>
[雅虎助手]
{406F94F0-504F-4A40-8DFD-58B0666ABEBD} <C:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll, N/A>
[]
{461CC20B-FB6E-4F16-8FE8-C29359DB100E} <, >
[Yahoo!Live]
{57421194-58FB-49AE-9B4F-FD48869B9AD4} <C:\Program Files\Yahoo!\Assistant\yaLive.dll, N/A>
[IEVkbdBHO Class]
{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} <G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll, (Signed) Kaspersky Lab>
[]
{5D73EE86-05F1-49ED-B850-E423120EC338} <, >
[DragSearch BHO]
{62EED7C6-9F02-42F9-B634-98E2899E147B} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL, N/A>
[XMP Class]
{6483F145-A768-4C41-AACC-52D4D7845851} <C:\ProgramData\Thunder Network\KanKan\xplayer.dll_1_work, >
[XDRM]
{693571CB-54A3-4E90-9D52-EEAE1334E2D3} <C:\ProgramData\Thunder Network\KanKan\xdrm.dll_1_work, >
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <%SystemRoot%\system32\wmp.dll, (Signed) N/A>
[SSVHelper Class]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} <C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll, (Signed) Sun Microsystems, Inc.>
[]
{7E853D72-626A-48EC-A868-BA8D5E23E045} <, >
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <G:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll, (Signed) Thunder Networking Technologies,LTD>
[Windows Live 登录帮助程序]
{9030D464-4C02-4ABF-8ECC-5164760863C6} <C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll, (Signed) Microsoft Corporation>
[]
{92780B25-18CC-41C8-B9BE-3C9C571A8263} <, >
[AUDIO__X_MS_WMA Moniker Class]
{CD3AFA84-B84F-48F0-9393-7EDC34128127} <%SystemRoot%\system32\wmp.dll, (Signed) N/A>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\Windows\system32\Macromed\Flash\Flash10a.ocx, (Signed) Adobe Systems, Inc.>
[XML HTTP Request]
{ED8C108E-4349-11D2-91A4-00C04F7969E8} <%SystemRoot%\System32\msxml3.dll, (Signed) N/A>
[yFlashDl Class]
{F166BC04-3C84-44CC-A6E9-2315EC4844B9} <C:\Program Files\Yahoo!\Assistant\Assist\yflashdl.dll, N/A>
[XML HTTP]
{F6D90F16-9C73-11D3-B32E-00C04F990BB4} <%SystemRoot%\System32\msxml3.dll, (Signed) N/A>
[assist]
{FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8} <C:\Program Files\Yahoo!\Assistant\Assist\yassist.dll, N/A>
[添加到雅虎订阅(&Y)]
<res://C:\Program Files\Yahoo!\Assistant\Assist\yrss.dll/YRSSMENUEXT, N/A>
[雅虎搜索]
<res://C:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll/203, N/A>

Wendy5166 - 2008-12-7 21:29:00

正在运行的进程
[PID: 392 / SYSTEM][\SystemRoot\System32\smss.exe] [(Verified) Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[PID: 460 / SYSTEM][C:\Windows\system32\csrss.exe] [(Verified) Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[PID: 516 / SYSTEM][C:\Windows\system32\wininit.exe] [(Verified) Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[PID: 524 / SYSTEM][C:\Windows\system32\csrss.exe] [(Verified) Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[PID: 564 / SYSTEM][C:\Windows\system32\services.exe] [(Verified) Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[PID: 576 / SYSTEM][C:\Windows\system32\lsass.exe] [(Verified) Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[PID: 584 / SYSTEM][C:\Windows\system32\lsm.exe] [(Verified) Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[PID: 652 / SYSTEM][C:\Windows\system32\winlogon.exe] [(Verified) Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[PID: 772 / SYSTEM][C:\Windows\system32\svchost.exe] [(Verified) Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[PID: 832 / NETWORK SERVICE][C:\Windows\system32\svchost.exe] [(Verified) Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[PID: 872 / SYSTEM][C:\Windows\System32\svchost.exe] [(Verified) Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[PID: 960 / SYSTEM][C:\Windows\system32\Ati2evxx.exe] [ATI Technologies Inc., 6.14.10.4174]
[PID: 988 / LOCAL SERVICE][C:\Windows\System32\svchost.exe] [(Verified) Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[PID: 1016 / SYSTEM][C:\Windows\System32\svchost.exe] [(Verified) Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[PID: 1076 / SYSTEM][C:\Windows\system32\svchost.exe] [(Verified) Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[PID: 1208 / NETWORK SERVICE][C:\Windows\system32\SLsvc.exe] [(Verified) Microsoft Corporation, 6.0.6000.16509 (vista_gdr.070620-1500)]
[PID: 1252 / LOCAL SERVICE][C:\Windows\system32\svchost.exe] [(Verified) Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[PID: 1380 / SYSTEM][C:\Windows\system32\Ati2evxx.exe] [ATI Technologies Inc., 6.14.10.4174]
[C:\Windows\system32\Ati2edxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2512]
[C:\Windows\system32\atipdlxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2522]
[C:\Windows\system32\ati2evxx.dll] [ATI Technologies Inc., 6.14.10.4163]
[PID: 1656 / Ivy][C:\Windows\system32\Dwm.exe] [(Verified) Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[C:\Windows\system32\atiumdag.dll] [ATI Technologies Inc. , 7.14.10.0517]
[C:\Windows\system32\atiumdva.dll] [ATI Technologies Inc. , 7.14.10.0163]
[PID: 1712 / Ivy][C:\Windows\Explorer.EXE] [(Verified) Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll] [, 2, 0, 0, 0]
[G:\Program Files\WinRAR\rarext.dll] [N/A, ]
[C:\Windows\system32\mp3infp.dll] [win32lab.com, 2.47.23.0]
[G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ShellEx.dll] [Kaspersky Lab, 8.0.0.454]
[C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_10b2f55f9bffb8f8\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.762]
[C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_10b2f55f9bffb8f8\MSVCP80.dll] [Microsoft Corporation, 8.00.50727.762]
[G:\Program Files\AVG Anti-Spyware 7.5\context.dll] [GRISOFT s.r.o., 7, 5, 1, 36]
[G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\prremote.dll] [Kaspersky Lab, 8.0.0.454]
[G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\prloader.dll] [Kaspersky Lab, 8.0.0.454]
[PID: 1756 / SYSTEM][C:\Windows\System32\spoolsv.exe] [(Verified) Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[C:\Windows\System32\pdfc_port.dll] [PDF Complete, Inc., 0.3.1.4]
[PID: 1788 / LOCAL SERVICE][C:\Windows\system32\svchost.exe] [(Verified) Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[PID: 1812 / Ivy][C:\Windows\system32\taskeng.exe] [(Verified) Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[C:\Windows\system32\atitmmxx.dll] [, 6, 14, 11, 17]
[C:\Windows\system32\atipdlxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2522]
[PID: 12 / SYSTEM][C:\Windows\system32\AEADISRV.EXE] [Andrea Electronics Corporation, 1.0.32.3]
[PID: 536 / SYSTEM][C:\Windows\system32\agrsmsvc.exe] [Agere Systems, 1.0.0.4]
[PID: 660 / Ivy][G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe] [Kaspersky Lab, 8.0.0.454]
[G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\prremote.dll] [Kaspersky Lab, 8.0.0.454]
[C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_10b2f55f9bffb8f8\MSVCP80.dll] [Microsoft Corporation, 8.00.50727.762]
[C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_10b2f55f9bffb8f8\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.762]
[G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\fssync.dll] [Kaspersky Lab, 8.0.5.454]
[G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\Ushata.dll] [Kaspersky Lab, 8.0.0.454]
[G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\CLLDR.DLL] [Kaspersky Lab, 8.0.0.454]
[G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\prloader.dll] [Kaspersky Lab, 8.0.0.454]
[G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\prkernel.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\pxstub.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\params.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\winreg.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\mkavio.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\tempfile.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\avpgui.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\nfio.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\fsdrvplg.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\basegui.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\thpimpl.ppl] [Kaspersky Lab, 8.0.0.454]
[PID: 1200 / Ivy][G:\Program Files\AVG Anti-Spyware 7.5\avgas.exe] [GRISOFT s.r.o., 7, 5, 1, 43]
[G:\Program Files\AVG Anti-Spyware 7.5\engine.dll] [GRISOFT s.r.o., 4, 2, 0, 19]
[PID: 920 / SYSTEM][G:\Program Files\AVG Anti-Spyware 7.5\guard.exe] [GRISOFT s.r.o., 7, 5, 1, 22]
[G:\Program Files\AVG Anti-Spyware 7.5\engine.dll] [GRISOFT s.r.o., 4, 2, 0, 19]
[PID: 892 / SYSTEM][G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe] [Kaspersky Lab, 8.0.0.454]
[G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\prremote.dll] [Kaspersky Lab, 8.0.0.454]
[C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_10b2f55f9bffb8f8\MSVCP80.dll] [Microsoft Corporation, 8.00.50727.762]
[C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_10b2f55f9bffb8f8\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.762]
[G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\fssync.dll] [Kaspersky Lab, 8.0.5.454]
[G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\Ushata.dll] [Kaspersky Lab, 8.0.0.454]
[G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\CLLDR.DLL] [Kaspersky Lab, 8.0.0.454]
[G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\prloader.dll] [Kaspersky Lab, 8.0.0.454]
[G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\prkernel.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\pxstub.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\params.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\winreg.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\mkavio.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\tempfile.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\tm.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\nfio.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\fsdrvplg.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\bl.ppl] [Kaspersky Lab, 8.0.0.459]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\wmihlpr.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\regmap.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\ndetect.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\crpthlpr.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\dtreg.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\sfdb.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\schedule.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\timer.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\thpimpl.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\lic.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\report.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\reportdb.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\hashmd5.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\avs.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\vmarea.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\avlib.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\avspm.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\qb.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\procmon.ppl] [Kaspersky Lab, 8.0.0.461]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\propmap.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\filemap.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\syswatch.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\oas.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\mc.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\sc.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\aphisht.ppl] [Kaspersky Lab, 8.0.0.454]
[C:\ProgramData\Kaspersky Lab\AVP8\Bases\kavbase.kdl] [Kaspersky Lab, 1.6.1.5]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\httpanlz.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\trafmon2.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\CKAHUM.dll] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\CKAHComm.dll] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\ckahrule.dll] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\httpscan.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\pdm2rt.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\avpgs.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\urlflt.ppl] [Kaspersky Lab, 8.0.0.454]
[C:\ProgramData\Kaspersky Lab\AVP8\Bases\klavemu.kdl] [Kaspersky Lab, 1.49.15.5]
[C:\ProgramData\Kaspersky Lab\AVP8\Bases\klark.kdl] [Kaspersky Lab, 1.5.3.1]
[C:\ProgramData\Kaspersky Lab\AVP8\Bases\vlns.kdl] [Kaspersky Lab, 1.4.3.1]
[G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avzkrnl.dll] [, 4.30.0.10]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\ichk2.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\ichksa.ppl] [Kaspersky Lab, 8.0.0.454]
[C:\ProgramData\Kaspersky Lab\AVP8\Bases\webav.kdl] [Kaspersky Lab, 1.4.3.1]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\smtpprtc.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\pop3prtc.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\imapprtc.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\nntpprtc.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\uniarc.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\minizip.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\cab.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\arj.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\rar.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\lha.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\mdb.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\msoe.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\mailmsg.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\dmap.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\prseqio.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\inflate.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\ods.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\wdiskio.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\ntfsstrm.ppl] [Kaspersky Lab, 8.0.0.454]
[PID: 928 / LOCAL SERVICE][C:\Windows\system32\svchost.exe] [(Verified) Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[PID: 2068 / SYSTEM][G:\Program Files\StormII\stormliv.exe] [北京暴风网际科技有限公司, 3, 8, 3, 15]
[G:\Program Files\StormII\MSVCP60.dll] [Microsoft Corporation, 6.02.3104.0]
[PID: 2084 / SYSTEM][C:\Windows\system32\crypserv.exe] [Kenonic Controls Ltd., 5.4.0]
[PID: 2096 / NETWORK SERVICE][C:\Windows\system32\svchost.exe] [(Verified) Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[PID: 2128 / SYSTEM][C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe] [InterVideo, 1, 0, 4, 0]
[PID: 2152 / SYSTEM][C:\Program Files\Common Files\LightScribe\LSSrvc.exe] [Hewlett-Packard Company, 1.6.43.1]
[C:\Program Files\Common Files\LightScribe\LSSProxy.dll] [Hewlett-Packard Company, 1.6.43.1]
[C:\Program Files\Common Files\LightScribe\LSLog.dll] [Hewlett-Packard Company, 1.6.43.1]
[C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_10b2f55f9bffb8f8\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.762]
[C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_10b2f55f9bffb8f8\MSVCP80.dll] [Microsoft Corporation, 8.00.50727.762]
[PID: 2224 / SYSTEM][C:\Program Files\PDF Complete\pdfsvc.exe] [PDF Complete Inc, 3.0.1.2]
[PID: 2304 / NETWORK SERVICE][C:\Windows\system32\svchost.exe] [(Verified) Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[PID: 2332 / LOCAL SERVICE][C:\Windows\system32\svchost.exe] [(Verified) Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[PID: 2392 / SYSTEM][C:\Windows\System32\svchost.exe] [(Verified) Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[PID: 2428 / SYSTEM][C:\Windows\system32\SearchIndexer.exe] [(Verified) Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[PID: 2492 / SYSTEM][C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe] [Hewlett-Packard Development Company, L.P., 2, 00, 2, 3]
[PID: 2992 / SYSTEM][C:\Windows\system32\UI0Detect.exe] [(Verified) Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[PID: 1688 / Ivy][G:\Program Files\TheWorld 2.0\TheWorld.exe] [Phoenix Studio, 2, 3, 0, 7]
[C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_10b2f55f9bffb8f8\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.762]
[G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\scrchpg.dll] [Kaspersky Lab, 8.0.0.454]
[G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\klscav.dll] [Kaspersky Lab, 8.0.0.454]
[G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\prremote.dll] [Kaspersky Lab, 8.0.0.454]

Wendy5166 - 2008-12-7 21:30:00

[C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_10b2f55f9bffb8f8\MSVCP80.dll] [Microsoft Corporation, 8.00.50727.762]
[G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\prloader.dll] [Kaspersky Lab, 8.0.0.454]
[G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\prkernel.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\params.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\pxstub.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\tempfile.ppl] [Kaspersky Lab, 8.0.0.454]
[C:\Windows\system32\atiumdag.dll] [ATI Technologies Inc. , 7.14.10.0517]
[C:\Windows\system32\atiumdva.dll] [ATI Technologies Inc. , 7.14.10.0163]
[C:\Windows\system32\Macromed\Flash\Flash10a.ocx] [Adobe Systems, Inc., 10,0,12,36]
[PID: 4088 / SYSTEM][c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe] [Hewlett-Packard, 2.0.13.1]
[C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_10b2f55f9bffb8f8\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.762]
[C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7fe79782947b85d961fd55cb5e02a129\mscorlib.ni.dll] [Microsoft Corporation, 2.0.50727.312 (rtmLHS.050727-3100)]
[C:\Windows\assembly\NativeImages_v2.0.50727_32\System\fcc712bc5da45a672e7f1ad176dbd5a5\System.ni.dll] [Microsoft Corporation, 2.0.50727.312 (rtmLHS.050727-3100)]
[C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\61b951bd03727a096c1c02cb18d5ce30\System.ServiceProcess.ni.dll] [Microsoft Corporation, 2.0.50727.312 (rtmLHS.050727-3100)]
[C:\Windows\assembly\GAC_MSIL\HP.ActiveSupportLibrary\2.0.0.1__01a974bc1760f423\HP.ActiveSupportLibrary.dll] [Hewlett-Packard, 2.0.0.2]
[PID: 3716 / Ivy][C:\Windows\system32\wuauclt.exe] [(Verified) Microsoft Corporation, 7.2.6001.788 (winmain_oob/wu_wsuswlc(wmbla).081016-1330)]
[PID: 2024 / Ivy][C:\Windows\hh.exe] [(Verified) Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_10b2f55f9bffb8f8\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.762]
[G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\scrchpg.dll] [Kaspersky Lab, 8.0.0.454]
[G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\klscav.dll] [Kaspersky Lab, 8.0.0.454]
[G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\prremote.dll] [Kaspersky Lab, 8.0.0.454]
[C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_10b2f55f9bffb8f8\MSVCP80.dll] [Microsoft Corporation, 8.00.50727.762]
[G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\prloader.dll] [Kaspersky Lab, 8.0.0.454]
[G:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\prkernel.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\params.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\pxstub.ppl] [Kaspersky Lab, 8.0.0.454]
[g:\program files\kaspersky lab\kaspersky anti-virus 2009\tempfile.ppl] [Kaspersky Lab, 8.0.0.454]
[C:\Windows\system32\atiumdag.dll] [ATI Technologies Inc. , 7.14.10.0517]
[C:\Windows\system32\atiumdva.dll] [ATI Technologies Inc. , 7.14.10.0163]
[PID: 3244 / Ivy][G:\Program Files\安装程序\sreng2\SREngLdr.EXE] [Smallfrogs Studio, 2.7.0.1210]
[PID: 3356 / Ivy][G:\Program Files\安装程序\sreng2\SRE996c4dc6.EXE] [Smallfrogs Studio, 2.7.0.1210]
[G:\Program Files\安装程序\sreng2\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]

==================================
文件关联
.TXT Error. [C:\Windows\notepad.exe %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["%SystemRoot%\hh.exe" %1]
.HLP OK. [%SystemRoot%\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. ["%SystemRoot%\System32\WScript.exe" "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[F:\]
[AUTORUN]
ShellExecute=Info.exe protect.ed 480 480

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
进程特权扫描
N/A

==================================
计划任务
[已启用] \\HP Health Check
c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe /Scan
[已启用] \\OGADaily
C:\Windows\system32\OGAVerify.exe /Scan
[已启用] \\OGALogon
C:\Windows\system32\OGAVerify.exe /Scan
[已启用] \Microsoft\Windows\Bluetooth\UninstallDeviceTask
BthUdTask.exe $(Arg0)
[已启用] \Microsoft\Windows\CertificateServicesClient\SystemTask
N/A
[已启用] \Microsoft\Windows\CertificateServicesClient\UserTask
N/A
[已启用] \Microsoft\Windows\CertificateServicesClient\UserTask-Roam
N/A
[已启用] \Microsoft\Windows\Customer Experience Improvement Program\Consolidator
%SystemRoot%\System32\wsqmcons.exe
[已启用] \Microsoft\Windows\Customer Experience Improvement Program\OptinNotification
%SystemRoot%\System32\wsqmcons.exe -n 0x1C577FA2B69CAD0
[已启用] \Microsoft\Windows\Defrag\ScheduledDefrag
%windir%\system32\defrag.exe -c -i
[已启用] \Microsoft\Windows\MobilePC\HotStart
N/A
[已启用] \Microsoft\Windows\MobilePC\TMM
N/A
[已启用] \Microsoft\Windows\MUI\LPRemove
%windir%\system32\lpremove.exe
[已启用] \Microsoft\Windows\MUI\Mcbuilder
C:\Windows\System32\mcbuilder.exe
[已启用] \Microsoft\Windows\Multimedia\SystemSoundsService
N/A
[已启用] \Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
N/A
[已启用] \Microsoft\Windows\Shell\CrawlStartPages
N/A
[已禁用] \Microsoft\Windows\SystemRestore\SR
%windir%\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation
[已启用] \Microsoft\Windows\Tcpip\IpAddressConflict1
rundll32 ndfapi.dll,NdfRunDllDuplicateIPOffendingSystem
[已启用] \Microsoft\Windows\Tcpip\IpAddressConflict2
rundll32 ndfapi.dll,NdfRunDllDuplicateIPDefendingSystem
[已启用] \Microsoft\Windows\UPnP\UPnPHostConfig
sc.exe config upnphost start= auto
[已启用] \Microsoft\Windows\Windows Error Reporting\QueueReporting
%windir%\system32\wermgr.exe -queuereporting
[已启用] \Microsoft\Windows\Wired\GatherWiredInfo
%windir%\system32\gatherWiredInfo.vbs
[已启用] \Microsoft\Windows\Wireless\GatherWirelessInfo
%windir%\system32\gatherWirelessInfo.vbs

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================

[/CODE]

瑞星卡卡安全论坛