Sreng 日志，高手请分析谢谢了 bbs.ikaka.com

00000000065645 - 2010-6-16 23:53:00

[code]2010-06-16,23:39:44
System Repair Engineer 2.8.2.1321
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 3 (Build 2600) - 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描
计划任务
Windows 安全更新检查
API HOOK
隐藏进程

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<nwiz><nwiz.exe /installquiet /keeploaded /nodetect> [(Verified)NVIDIA Corporation]
<NvMediaCenter><RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<LCONTROL><"C:\Program Files\Lenovo\ATK Hotkey\LCONTROL.exe"> [ATK0101]
<LFKA><"C:\Program Files\Lenovo\ATK Hotkey\LFKA.exe"> [Lenovo]
<360Safetray><"D:\Program Files\360\360Safe\safemon\360Tray.exe" /start> [(Verified)Qizhi Software (beijing) Co. Ltd]
<RavTray><"C:\Program Files\Rising\Rav\RsTray.exe" -system> [(Verified)Beijing Rising Information Technology Corporation Limited]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<KB923561><rundll32.exe apphelp.dll,ShimFlushCache> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Component Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Component Publisher]
<UIHost><logonui.exe> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{AEB6717E-7E19-11d0-97EE-00C04FD91972}><shell32.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<PostBootReminder><%SystemRoot%\system32\SHELL32.dll> [(Verified)Microsoft Windows Component Publisher]
<CDBurn><%SystemRoot%\system32\SHELL32.dll> [(Verified)Microsoft Windows Component Publisher]
<WebCheck><%SystemRoot%\system32\webcheck.dll> [(Verified)Microsoft Windows Component Publisher]
<SysTray><C:\WINDOWS\system32\stobject.dll> [(Verified)Microsoft Windows Component Publisher]
<WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
<WinlogonNotify: crypt32chain><crypt32.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
<WinlogonNotify: cryptnet><cryptnet.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
<WinlogonNotify: cscdll><cscdll.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dimsntfy]
<WinlogonNotify: dimsntfy><%SystemRoot%\System32\dimsntfy.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
<WinlogonNotify: ScCertProp><wlnotify.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
<WinlogonNotify: Schedule><wlnotify.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
<WinlogonNotify: sclgntfy><sclgntfy.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
<WinlogonNotify: SensLogn><WlNotify.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
<WinlogonNotify: termsrv><wlnotify.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tphotkey]
<WinlogonNotify: tphotkey><C:\Program Files\Lenovo\HOTKEY\tphklock.dll> [(Verified)Lenovo(Japan)Ltd.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
<WinlogonNotify: wlballoon><wlnotify.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
<{438755C2-A8BA-11D1-B96B-00A0C90312E1}><%SystemRoot%\system32\browseui.dll> [(Verified)Microsoft Windows Component Publisher]
<{8C7461EF-2B13-11d2-BE35-3078302C2030}><%SystemRoot%\system32\browseui.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
<Microsoft Windows Media Player><C:\WINDOWS\inf\unregmp2.exe /ShowWMP> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
<浏览器自定义组件><RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
<Windows 桌面更新><regsvr32.exe /s /n /i:U shell32.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
<Internet Explorer 6><%SystemRoot%\system32\ie4uinit.exe> [(Verified)Microsoft Windows Component Publisher]
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><C:\WINDOWS\System32\logon.scr> [(Verified)Microsoft Windows Component Publisher]
==================================
启动文件夹
N/A
==================================
服务
[Atheros Configuration Service / acs][Running/Auto Start]
<C:\WINDOWS\system32\acs.exe><Atheros>
[ATKGFNEX Service / ATKGFNEXSrv][Running/Auto Start]
<C:\Program Files\Lenovo\ATK Hotkey\GFNEXSrv.exe><>
[Help and Support / helpsvc][Running/Manual Start]
<2 - 系统找不到指定的文件。
><(File is missing)>
[ThinkPad PM Service for SL Series / IBMPMSVC][Running/Auto Start]
<C:\WINDOWS\system32\ibmpmsvc.exe><Lenovo>
[Service of LFKA / LFKAS][Running/Auto Start]
<C:\Program Files\Lenovo\ATK Hotkey\LFKAS.exe><>
[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
<C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[Rav Service / RsRavMon][Running/Auto Start]
<"C:\Program Files\Rising\Rav\RavMonD.exe"><Beijing Rising Information Technology Co., Ltd.>
==================================
驱动程序
[360SelfProtection / 360SelfProtection][Running/System Start]
<system32\drivers\360SelfProtection.sys><360安全中心>
[Atheros Wireless Network Adapter Service / AR5211][Stopped/Manual Start]
<system32\DRIVERS\ar5211.sys><Atheros Communications, Inc.>
[ASMMAP / ASMMAP][Running/Auto Start]
<\??\C:\Program Files\Lenovo\ATK Hotkey\ASMMAP.sys><>
[BAPIDRV / BAPIDRV][Running/System Start]
<\??\C:\WINDOWS\system32\drivers\BAPIDRV.SYS><360.cn>
[Conexant UAA Function Driver for High Definition Audio Service / CnxtHdAudService][Running/Manual Start]
<system32\drivers\CHDAU32.sys><Conexant Systems Inc.>
[EfiSystemMon / EfiMon][Running/System Start]
<System32\Drivers\Efimon.sys><奇虎网>
[Microsoft 用于 High Definition Audio 的 UAA 总线驱动程序 / HDAudBus][Running/Manual Start]
<system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
[hookcont / hookcont][Running/System Start]
<system32\drivers\HookCont.sys><Beijing Rising Information Technology Co., Ltd.>
[HookPort / HookPort][Running/Boot Start]
<\SystemRoot\System32\Drivers\Hookport.sys><360安全中心>
[hooksys / hooksys][Running/System Start]
<system32\drivers\HookSys.sys><Beijing Rising Information Technology Co., Ltd.>
[HSFHWAZL / HSFHWAZL][Running/Manual Start]
<system32\DRIVERS\HSFHWAZL.sys><Conexant Systems, Inc.>
[HSF_DPV / HSF_DPV][Running/Manual Start]
<system32\DRIVERS\HSF_DPV.sys><Conexant Systems, Inc.>
[Intel AHCI Controller / iaStor][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\iaStor.sys><Intel Corporation>
[IBMPMDRV / IBMPMDRV][Running/Manual Start]
<system32\DRIVERS\ibmpmdrv.sys><Lenovo.>
[mdmxsdk / mdmxsdk][Running/Auto Start]
<system32\DRIVERS\mdmxsdk.sys><Conexant>
[ATK0101 ACPI UTILITY / MTsensor][Running/Manual Start]
<system32\DRIVERS\A0101X32.sys><>
[nv / nv][Running/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Service for NVIDIA High Definition Audio Driver / NVHDA][Running/Manual Start]
<system32\drivers\nvhda32.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Quantum DeepScanner Servers / quxxxserv][Running/System Start]
<\??\C:\WINDOWS\system32\drivers\quxxxrv.sys><360安全中心>
[qutmipc / qutmipc][Running/System Start]
<\??\C:\WINDOWS\system32\drivers\qutmipc.sys><360安全中心>
[rimmptsk / rimmptsk][Running/Auto Start]
<system32\DRIVERS\rimmptsk.sys><REDC>
[rimsptsk / rimsptsk][Running/Auto Start]
<system32\DRIVERS\rimsptsk.sys><REDC>
[Ricoh xD-Picture Card Driver / rismxdp][Running/Auto Start]
<system32\DRIVERS\rixdptsk.sys><REDC>
[rsassist / rsassist][Running/Auto Start]
<system32\drivers\rsassist.sys><Beijing Rising Information Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Information Technology Co., Ltd.>
[Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver / RTLE8023xp][Running/Manual Start]
<system32\DRIVERS\Rtenicxp.sys><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
[Synaptics TouchPad Driver / SynTP][Running/Manual Start]
<system32\DRIVERS\SynTP.sys><Synaptics, Inc.>
[TCP/IP Protocol Driver / Tcpip][Running/System Start]
<system32\DRIVERS\tcpip.sys><Microsoft Corporation>
[TPHKDRV / TPHKDRV][Running/System Start]
<system32\DRIVERS\TPHKDRV.sys><Lenovo Group Limited>
[winachsf / winachsf][Running/Manual Start]
<system32\DRIVERS\HSF_CNXT.sys><Conexant Systems, Inc.>
[wsimd Service / WSIMD][Running/Manual Start]
<system32\DRIVERS\wsimd.sys><Atheros Communications, Inc.>
[KAVBootC / KAVBootC][Stopped/Boot Start]
<\SystemRoot\system32\Drivers\KAVBootC.sys><Kingsoft Corporation>
[360netmon / 360netmon][Running/System Start]
<\??\C:\WINDOWS\system32\drivers\360netmon.sys><360.cn>
==================================

用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; http://bsalsa.com) ; 360SE)

00000000065645 - 2010-6-16 23:53:00

浏览器加载项
[ThunderAtOnce Class]
{01443AEC-0FD1-40fd-9C87-E93D1494C233} <C:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll, (Signed) Thunder Networking Technologies,LTD>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll, (Signed) Thunder Networking Technologies,LTD>
[]
{e2e2dd38-d088-4134-82b7-f2ba38496583} <%windir%\Network Diagnostic\xpnetdiag.exe, (Signed) N/A>
[ThunderAtOnce Class]
{01443AEC-0FD1-40FD-9C87-E93D1494C233} <C:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll, (Signed) Thunder Networking Technologies,LTD>
[Thunder Agent Class]
{485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <C:\Program Files\Thunder\ComDlls\ThunderAgent_Now.dll, (Signed) Thunder Networking Technologies,LTD>
[KLeakScan Class]
{4BB7444F-E4DA-4E02-AAAD-505A0E9855D4} <C:\Program Files\KOS\KosClean.dll, (Signed) Kingsoft Corporation>
[AtmX Class]
{4CEEAF57-0208-4CA4-A473-914C2D2FFC23} <D:\李国强\trademanager\AliIMX.dll, (Signed) Alibaba software (Shanghai) Corporation.>
[WangWangX Class]
{5D09DD40-CDC4-4C56-B615-0D1E3B357C2B} <D:\李国强\trademanager\AliIMX.dll, (Signed) Alibaba software (Shanghai) Corporation.>
[XMP Class]
{6483F145-A768-4C41-AACC-52D4D7845851} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xplayer.dll_1_work, >
[XDRM]
{693571CB-54A3-4E90-9D52-EEAE1334E2D3} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xdrm.dll_1_work, >
[360SafeLive]
{87515F61-A66C-4319-A0E0-D416CB8059E3} <D:\Program Files\360\360Safe\Safelive.dll, (Signed) 360.cn>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll, (Signed) Thunder Networking Technologies,LTD>
[DapCtrl Class]
{ACACC6EB-1FBA-4E13-A729-53AEB2DF54F8} <C:\Program Files\Common Files\Thunder Network\KanKan\DapCtrl.2.1.5803.60.(977).dll, ShenZhen Thunder Networking Technologies Ltd.>
[KScanSpyWare Class]
{C847FDE7-B612-47ED-B32C-4000C9DD26B6} <C:\Program Files\KOS\KosClean.dll, (Signed) Kingsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, (Signed) Adobe Systems, Inc.>
[KUpdateObj2 Class]
{D82303B7-A754-4DCB-8AFC-8CF99435AACE} <C:\Program Files\KOS\UpdateOcx2.dll, (Signed) Kingsoft Corporation>
[KVirusScan Class]
{E176B817-4905-4CDF-8C9C-0AF3EA3B4AC7} <C:\Program Files\KOS\KosClean.dll, (Signed) Kingsoft Corporation>
[KAccountManager Class]
{E176B817-4905-4CDF-8C9C-0AF3EA3B4AC9} <C:\Program Files\KOS\KosClean.dll, (Signed) Kingsoft Corporation>
[]
{E2E2DD38-D088-4134-82B7-F2BA38496583} <, >
[Thunder DapPlayer]
{EEDD6FF9-13DE-496B-9A1C-D78B3215E266} <C:\Program Files\Thunder\Components\DownAndPlay\DapPlayer3.0.5712.71.977.dll, ShenZhen Thunder Networking Technologies Ltd.>
[XPPlayer Class]
{F3E70CEA-956E-49CC-B444-73AFE593AD7F} <C:\Program Files\Common Files\Thunder Network\KanKan\PPlayer.2.0.0.177.(977).dll, Thunder>
[使用迅雷下载]
<C:\Program Files\Thunder\Program\geturl.htm, N/A>
[使用迅雷下载全部链接]
<C:\Program Files\Thunder\Program\getallurl.htm, N/A>
==================================
正在运行的进程
[PID: 880 / SYSTEM][\SystemRoot\System32\smss.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[PID: 956 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[PID: 984 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2113)]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[C:\Program Files\Lenovo\HOTKEY\tphklock.dll] [Lenovo Group Limited, 1.04]
[PID: 1028 / SYSTEM][C:\WINDOWS\system32\services.exe] [(Verified) Microsoft Corporation, 5.1.2600.5755 (xpsp_sp3_gdr.090206-1234)]
[PID: 1040 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2113)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[PID: 1212 / SYSTEM][C:\WINDOWS\system32\ibmpmsvc.exe] [Lenovo, 1.44]
[PID: 1252 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[PID: 1336 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[PID: 1496 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[C:\WINDOWS\System32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[PID: 1568 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[PID: 1720 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[PID: 1816 / SYSTEM][C:\Program Files\Lenovo\ATK Hotkey\GFNEXSrv.exe] [, 1, 0, 0, 0]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[PID: 1844 / SYSTEM][C:\Program Files\Lenovo\ATK Hotkey\LFKAS.exe] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[PID: 1908 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-0852)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[PID: 448 / SYSTEM][C:\WINDOWS\system32\acs.exe] [Atheros, 5.2.0.117]
[C:\WINDOWS\system32\athcfg20U.dll] [Atheros, 5.2.0.117]
[C:\WINDOWS\system32\athcfg20ResU.dll] [Atheros Communications, Inc., 5.2.0.117]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[C:\WINDOWS\system32\wsfwDS.dll] [Atheros Communications, Inc., 5.2.0.117]
[C:\WINDOWS\system32\wsimd.dll] [Atheros Communications, Inc., 5.2.0.117]
[C:\WINDOWS\system32\DSA.dll] [Devicescape, 1, 634, 9, 11]
[PID: 532 / SYSTEM][C:\WINDOWS\system32\nvsvc32.exe] [NVIDIA Corporation, 6.14.11.7930]
[C:\WINDOWS\system32\nvapi.dll] [NVIDIA Corporation, 6.14.11.7930]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[PID: 1624 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-0852)]
[C:\WINDOWS\System32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[PID: 2572 / Administrator][C:\Program Files\Rising\Rav\RsAgent.exe] [Beijing Rising Information Technology Co., Ltd., 21.0.0.19]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[C:\Program Files\Rising\Rav\ProcComm.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 4]
[C:\Program Files\Rising\Rav\comx3.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.37]
[C:\Program Files\Rising\Rav\Syslay.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.6]
[C:\Program Files\Rising\Rav\ScanPrxy.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.4]
[PID: 2824 / Administrator][C:\WINDOWS\msagent\AgentSvr.exe] [(Verified) Microsoft Corporation, 2.00.0.3427]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[D:\Program Files\360\360Safe\safemon\safemon.dll] [360.cn, 6, 5, 1, 1002]
[C:\WINDOWS\system32\nview.dll] [, ]
[C:\WINDOWS\system32\NVWRSZHC.DLL] [NVIDIA Corporation, 6.14.10.12081]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.19.5 10Apr08]
[PID: 3948 / Administrator][C:\WINDOWS\system32\RUNDLL32.EXE] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2105)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[C:\WINDOWS\system32\NvMcTray.dll] [NVIDIA Corporation, 6.14.11.7930]
[C:\WINDOWS\system32\nvapi.dll] [NVIDIA Corporation, 6.14.11.7930]
[C:\WINDOWS\system32\NVRSZHC.DLL] [NVIDIA Corporation, 6.14.11.7930]
[PID: 2248 / Administrator][C:\Program Files\Synaptics\SynTP\SynTPLpr.exe] [Synaptics, Inc., 7.5.19.5 10Apr08]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.19.5 10Apr08]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[PID: 916 / Administrator][C:\Program Files\Synaptics\SynTP\SynTPEnh.exe] [Synaptics, Inc., 7.5.19.5 10Apr08]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[C:\WINDOWS\system32\SynCOM.dll] [Synaptics, Inc., 7.5.19.5 10Apr08]
[C:\WINDOWS\system32\SynTPAPI.dll] [Synaptics, Inc., 7.5.19.5 10Apr08]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.19.5 10Apr08]
[PID: 2976 / Administrator][C:\Program Files\Lenovo\HOTKEY\LVOSDSVC.exe] [Lenovo Group Limited, 1.04]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.19.5 10Apr08]
[C:\Program Files\Lenovo\HOTKEY\hkvolkey.dll] [Lenovo Group Limited, 1.01]
[PID: 2952 / Administrator][C:\WINDOWS\system32\rundll32.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2105)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[C:\WINDOWS\system32\nview.dll] [, ]
[C:\WINDOWS\system32\NVWRSZHC.DLL] [NVIDIA Corporation, 6.14.10.12081]
[C:\WINDOWS\system32\nvwddi.dll] [NVIDIA Corporation, 6.14.11.7930]
[C:\WINDOWS\system32\nvapi.dll] [NVIDIA Corporation, 6.14.11.7930]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.19.5 10Apr08]
[C:\WINDOWS\system32\nvshell.dll] [, ]
[PID: 3256 / Administrator][C:\Program Files\Lenovo\ATK Hotkey\LCONTROL.exe] [ATK0101, 1043, 2, 31, 90]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[C:\WINDOWS\system32\nview.dll] [, ]
[C:\WINDOWS\system32\NVWRSZHC.DLL] [NVIDIA Corporation, 6.14.10.12081]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.19.5 10Apr08]
[PID: 3476 / Administrator][C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe] [Lenovo Group Limited, 5.30]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.19.5 10Apr08]
[PID: 3868 / Administrator][C:\Program Files\Lenovo\ATK Hotkey\LFKA.exe] [Lenovo, 1.0.0.8]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[C:\WINDOWS\system32\nview.dll] [, ]
[C:\WINDOWS\system32\NVWRSZHC.DLL] [NVIDIA Corporation, 6.14.10.12081]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.19.5 10Apr08]
[PID: 4024 / Administrator][C:\Program Files\Lenovo\Zoom\TpScrex.exe] [Lenovo Group Limited, 2.10]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.19.5 10Apr08]
[PID: 3792 / Administrator][D:\Program Files\360\360Safe\safemon\360Tray.exe] [360.CN, 7, 0, 0, 1009]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[D:\Program Files\360\360Safe\ipc\ipcservice.dll] [360.CN, 6, 5, 2, 1003]
[D:\Program Files\360\360Safe\ipc\fileMgr.dll] [360.cn, 6, 5, 2, 1002]
[D:\Program Files\360\360Safe\ipc\yhregd.dll] [, 6, 5, 0, 1002]
[D:\Program Files\360\360Safe\ipc\appd.dll] [360.cn, 6, 5, 1, 1006]
[D:\Program Files\360\360Safe\safemon\360compro.dll] [360安全中心, 6, 2, 0, 1005]
[D:\Program Files\360\360Safe\safemon\360webpro.dll] [360.CN, 1, 3, 0, 1031]
[D:\Program Files\360\360Safe\safemon\360traylive.dll] [360安全中心, 6, 0, 1, 1013]
[D:\Program Files\360\360Safe\safemon\360procmon.dll] [360.CN, 6, 5, 2, 1006]
[D:\Program Files\360\360Safe\safemon\SelfProtectAPI2.dll] [360.CN, 1, 1, 0, 1012]
[D:\Program Files\360\360Safe\safemon\netmon.tpi] [360.CN, 1, 0, 2, 1011]
[D:\Program Files\360\360Safe\safemon\netm.tpi] [360.cn, 1, 0, 1, 1012]
[D:\Program Files\360\360Safe\safemon\360safemonpro.tpi] [360.cn, 1, 1, 2, 1001]
[D:\Program Files\360\360Safe\deepscan\qutmload.dll] [360安全中心, 6, 5, 0, 1001]
[D:\Program Files\360\360Safe\ipc\qutmipc.dll] [360安全中心, 6, 2, 0, 1007]
[D:\Program Files\360\360Safe\SafeLive.dll] [360.cn, 1, 0, 0, 1007]
[D:\Program Files\360\360Safe\pdown.dll] [360.cn, 1, 2, 0, 1014]
[D:\Program Files\360\360Safe\safemon\safemon.dll] [360.cn, 6, 5, 1, 1002]
[D:\Program Files\360\360Safe\safemon\urlproc.dll] [360.cn, 1, 2, 0, 1005]
[D:\Program Files\360\360Safe\netmon\360netctrl.dll] [360.CN, 1, 0, 3, 1009]
[D:\Program Files\360\360Safe\360ver.dll] [奇虎网, 7, 1, 0, 1010]
[D:\Program Files\360\360Safe\ipc\PatchCheck.dll] [360.cn, 1, 0, 0, 1005]
[D:\Program Files\360\360Safe\efiproc.dll] [奇虎360安全卫士, 1, 0, 0, 1005]
[D:\Program Files\360\360Safe\deepscan\deepscan.dll] [360.cn, 3, 2, 3, 1032]
[D:\Program Files\360\360Safe\deepscan\Bapi.dll] [360.cn, 1.0.0.1010]
[D:\Program Files\360\360Safe\deepscan\Cloudcom2.dll] [360.cn, 3, 2, 3, 1006]
[D:\Program Files\360\360Safe\LiveUpd360.dll] [360.cn, 1, 2, 0, 1033]
[D:\Program Files\360\360Safe\360net.dll] [奇虎网, 1, 1, 17, 1020]
[D:\Program Files\360\360Safe\360P2SP.dll] [360.cn, 1, 1, 0, 1045]
[D:\Program Files\360\360Safe\deepscan\heavygate.dll] [360.cn, 3, 6, 21, 0]
[PID: 1400 / Administrator][C:\WINDOWS\system32\CTFMON.EXE] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2105)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[C:\WINDOWS\system32\nview.dll] [, ]
[C:\WINDOWS\system32\NVWRSZHC.DLL] [NVIDIA Corporation, 6.14.10.12081]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.19.5 10Apr08]
[PID: 1644 / SYSTEM][C:\Program Files\Rising\Rav\RavMonD.exe] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2]
[C:\Program Files\Rising\Rav\combase.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 17]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[C:\Program Files\Rising\Rav\cnt09.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 5]
[C:\Program Files\Rising\Rav\moncomm.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 9]
[C:\Program Files\Rising\Rav\MonBase.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3]
[C:\Program Files\Rising\Rav\Rslog.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.41]
[C:\Program Files\Rising\Rav\mondrv.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 6]
[C:\Program Files\Rising\Rav\defmon.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 46]
[C:\Program Files\Rising\Rav\moncom08.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1]
[C:\Program Files\Rising\Rav\MonRule.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 10]
[C:\Program Files\Rising\Rav\FileMon.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 29]
[C:\Program Files\Rising\Rav\MailMon.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 22]
[C:\Program Files\Rising\Rav\HookWeb.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 12]
[C:\Program Files\Rising\Rav\rsindent.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 11]
[C:\Program Files\Rising\Rav\Syslay.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.6]
[C:\Program Files\Rising\Rav\taskplug.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 10]
[C:\Program Files\Rising\Rav\scansrvp.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.7]
[C:\Program Files\Rising\Rav\cnt08.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1]
[C:\Program Files\Rising\Rav\proccomm.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 4]
[C:\Program Files\Rising\Rav\RSAPPMGR.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.0]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.0]

00000000065645 - 2010-6-16 23:54:00

[C:\Program Files\Rising\Rav\comx3.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.37]
[C:\Program Files\Rising\Rav\Hooksys.dll] [Beijing Rising Information Technology Co., Ltd., 24, 0, 0, 3]
[C:\Program Files\Rising\Rav\ProcCom.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 20]
[C:\Program Files\Rising\Rav\RsCommX2.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 20]
[C:\Program Files\Rising\Rav\HookCont.dll] [Beijing Rising Information Technology Co., Ltd., 24, 0, 0, 1]
[C:\Program Files\Rising\Rav\BACore.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 38]
[C:\Program Files\Rising\Rav\recomp.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 6]
[C:\Program Files\Rising\Rav\refs.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3]
[C:\Program Files\Rising\Rav\viruslib.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3]
[C:\Program Files\Rising\Rav\relibldr.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3]
[C:\Program Files\Rising\Rav\rsnetsvr.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3]
[C:\Program Files\Rising\Rav\bawhite.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3]
[C:\Program Files\Rising\Rav\RSStore.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 5]
[C:\Program Files\Rising\Rav\Scanner.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.22]
[C:\Program Files\Rising\Rav\ScanAdd.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.4]
[C:\Program Files\Rising\Rav\NComm2.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3]
[C:\Program Files\Rising\Rav\rstask.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 5]
[C:\Program Files\Rising\Rav\rsstub.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1]
[C:\Program Files\Rising\Rav\ScanSrv.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.3]
[C:\Program Files\Rising\Rav\scanpe.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 10]
[C:\Program Files\Rising\Rav\pearc.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2]
[C:\Program Files\Rising\Rav\ScanRavT.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.4]
[C:\Program Files\Rising\Rav\ScanBT.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.21]
[C:\Program Files\Rising\Rav\ScanStub.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.1]
[C:\Program Files\Rising\Rav\ur000.dat] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 4]
[C:\Program Files\Rising\Rav\urutils.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1]
[C:\Program Files\Rising\Rav\ffr.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 4]
[C:\Program Files\Rising\Rav\nvfile.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1]
[C:\Program Files\Rising\Rav\scanexec.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2]
[C:\Program Files\Rising\Rav\unexe.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2]
[C:\Program Files\Rising\Rav\scanex.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 79]
[C:\Program Files\Rising\Rav\scantj.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 4]
[C:\Program Files\Rising\Rav\methodex.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3]
[C:\Program Files\Rising\Rav\revm.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 6]
[C:\Program Files\Rising\Rav\pecompd.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 5]
[C:\Program Files\Rising\Rav\heurex.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 17]
[C:\Program Files\Rising\Rav\extsfx.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 4]
[C:\Program Files\Rising\Rav\extmail.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 5]
[C:\Program Files\Rising\Rav\scansct.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 4]
[C:\Program Files\Rising\Rav\ur001.dat] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2]
[C:\Program Files\Rising\Rav\ur023.dat] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1]
[C:\Program Files\Rising\Rav\ur025.dat] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2]
[PID: 2368 / Administrator][C:\Program Files\Rising\Rav\rstray.exe] [Beijing Rising Information Technology Co., Ltd., 22.0.0.11]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[C:\Program Files\Rising\Rav\comserv.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.15]
[C:\Program Files\Rising\Rav\rslang.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1]
[C:\Program Files\Rising\Rav\comx3.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.37]
[C:\Program Files\Rising\Rav\Syslay.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.6]
[C:\Program Files\Rising\Rav\ProcComm.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 4]
[C:\Program Files\Rising\Rav\rsxml.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2]
[C:\Program Files\Rising\Rav\MonState.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2]
[C:\Program Files\Rising\Rav\ScanEvnt.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.3]
[C:\Program Files\Rising\Rav\rsguilib.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 57]
[C:\Program Files\Rising\Rav\rsconf.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.1]
[C:\Program Files\Rising\Rav\rspalvd.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.7]
[C:\Program Files\Rising\Rav\ravbintl.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 22]
[C:\Program Files\Rising\Rav\mruleui.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 7]
[C:\Program Files\Rising\Rav\MonTray.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.74]
[C:\Program Files\Rising\Rav\RavITray.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 6]
[C:\Program Files\Rising\Rav\rsmginfo.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 4]
[C:\Program Files\Rising\Rav\scanleak.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 6]
[C:\Program Files\Rising\Rav\ravppops.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 21]
[C:\Program Files\Rising\Rav\RSAPPMGR.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.0]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.0]
[C:\Program Files\Rising\Rav\PngDll.dll] [Beijing Rising Information Technology Co., Ltd., 21, 0, 0, 4]
[C:\Program Files\Rising\Rav\ScanPrxy.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.4]
[PID: 5012 / Administrator][C:\Program Files\Thunder\Program\Thunder5.exe] [Thunder Networking Technologies,LTD, 5.8.3.533]
[C:\Program Files\Thunder\Program\BugReport.dll] [Thunder Networking Technologies,LTD, 1, 4, 1, 20]
[C:\Program Files\Thunder\Program\ThunderEx.dll] [, 1, 2, 6, 25]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[D:\Program Files\360\360Safe\safemon\safemon.dll] [360.cn, 6, 5, 1, 1002]
[C:\WINDOWS\system32\nview.dll] [, ]
[C:\WINDOWS\system32\NVWRSZHC.DLL] [NVIDIA Corporation, 6.14.10.12081]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.19.5 10Apr08]
[C:\Program Files\Thunder\Program\TaskManager.dll] [Thunder Networking Technologies,LTD, 1, 3, 8, 68]
[C:\Program Files\Thunder\Program\download_interface.dll] [Thunder Networking Technologies,LTD, 3, 1, 2, 318]
[C:\Program Files\Thunder\Program\MSVCP71.dll] [Microsoft Corporation, 7.10.6030.0]
[C:\Program Files\Thunder\Program\MSVCR71.dll] [Microsoft Corporation, 7.10.6030.0]
[C:\Program Files\Thunder\Program\asyn_frame.dll] [Thunder Networking Technologies,LTD, 1, 1, 2, 21]
[C:\Program Files\Thunder\Program\ATL71.DLL] [Microsoft Corporation, 7.10.6041.0]
[C:\Program Files\Thunder\Program\fs.dll] [Thunder Networking Technologies,LTD, 1, 1, 2, 10]
[C:\Program Files\Thunder\Program\XLNet.Dll] [Thunder Networking Technologies,LTD, 1, 5, 2, 25]
[C:\Program Files\Thunder\Program\ptl.dll] [Thunder Networking Technologies,LTD, 3, 1, 2, 24]
[C:\Program Files\Thunder\Program\backend_agent.dll] [Thunder Networking Technologies,LTD, 1, 1, 2, 20]
[C:\Program Files\Thunder\Program\xl_stat.dll] [Thunder Networking Technologies,LTD, 1, 1, 2, 3]
[C:\Program Files\Thunder\Program\iTargetAD.dll] [N/A, ]
[C:\Program Files\Thunder\Program\BHOStub.dll] [Thunder Networking Technologies,LTD, 1, 1, 1, 10]
[C:\Program Files\Thunder\Components\DownAndPlay\DownAndPlay.dll] [, 1, 0, 12, 30]
[C:\WINDOWS\system32\nvwddi.dll] [NVIDIA Corporation, 6.14.11.7930]
[C:\Program Files\Thunder\Program\p2p_upload.dll] [Thunder Networking Technologies,LTD, 1, 1, 2, 8]
[C:\Program Files\Thunder\Program\p2p.dll] [Thunder Networking Technologies,LTD, 1,1,2,24]
[C:\Program Files\Thunder\Program\xldc.dll] [Thunder Networking Technologies,LTD, 3, 6, 2, 15]
[C:\Program Files\Thunder\Program\stream.dll] [Thunder Networking Technologies,LTD, 2, 1, 2, 381]
[C:\Program Files\Thunder\Program\p2sp.dll] [Thunder Networking Technologies,LTD, 1, 1, 2, 25]
[C:\Program Files\Thunder\Program\down_dispatcher.dll] [Thunder Networking Technologies,LTD, 1, 0, 2, 17]
[C:\Program Files\Thunder\Program\p2p_local_res.dll] [Thunder Networking Technologies,LTD, 1,1,2,12]
[C:\Program Files\Thunder\Program\al.dll] [Thunder Networking Technologies,LTD, 1,1,2,15]
[C:\Program Files\Thunder\Components\Community\XLCommunity.dll] [Thunder Networking Technologies,LTD, 2, 4, 0, 73]
[C:\Program Files\Thunder\Program\XLCommunityEx.dll] [N/A, ]
[C:\Program Files\Thunder\Program\RegisterDll.dll] [Thunder Networking Technologies,LTD, 2, 17, 0, 67]
[C:\Program Files\Thunder\Program\imdt.dll] [TODO: <Company name>, 1.1.2.5]
[C:\Program Files\Thunder\Components\Security\ThunderSafe.dll] [深圳市迅雷网络技术有限公司, 2, 1, 1, 93]
[C:\Program Files\Thunder\Components\Security\ConfigManager.dll] [深圳市迅雷网络技术有限公司, 1, 0, 0, 1]
[C:\Program Files\Thunder\Components\Security\SafeManager.dll] [深圳市迅雷网络技术有限公司, 1, 0, 4, 16]
[C:\Program Files\Thunder\Program\XLNetU.Dll] [Thunder Networking Technologies,LTD, 1, 5, 1, 24]
[C:\Program Files\Thunder\Plugins\XLSafeHost\XLSafeHost.dll] [深圳市迅雷网络技术有限公司, 1, 2, 1, 74]
[C:\Program Files\Thunder\plugins\xlsafehost\Guard.dll] [深圳市迅雷网络技术有限公司, 1, 0, 0, 4]
[C:\Program Files\Thunder\Plugins\XLSafeHost\AutoHelp.dll] [Beijing Rising Technology Co., Ltd., 6.0.0.3]
[C:\Program Files\Thunder\Components\Search\XLSearch.dll] [Thunder Networking Technologies,LTD, 1, 1, 6, 21]
[C:\Program Files\Thunder\Program\LiveUpdate.dll] [Thunder Networking Technologies,LTD, 1, 2, 3, 25]
[C:\Program Files\Thunder\Components\XLSoftBase\XLSoftwareBase.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 3]
[C:\Program Files\Thunder\Plugins\GouGouTop\GouGouTop.dll] [Thunder Networking Technologies,LTD, 1, 0, 2, 5]
[C:\Program Files\Thunder\Components\ExplorerHelper\ExplorerHelper.dll] [Thunder Networking Technologies,LTD, 1, 0, 4, 19]
[C:\Program Files\Thunder\Components\Tips\TipsClient.dll] [Thunder Networking Technologies,LTD, 2, 2, 13, 118]
[C:\Program Files\Thunder\Components\DownloadStat\DownloadStat.dll] [Thunder Networking Technologies,LTD, 1, 4, 1, 6]
[C:\Program Files\Thunder\Components\Tips\XLIPC.DLL] [Thunder Networking Technologies,LTD, 1, 0, 0, 2]
[C:\Program Files\Thunder\Program\emule_id.dll] [, 1, 0, 2, 8]
[C:\Program Files\Thunder\Program\bd.dll] [Thunder Networking Technologies,LTD, 1, 0, 2, 17]
[C:\Program Files\Thunder\Program\FloatBar.dll] [Giganology Inc., 1, 0, 0, 2]
[C:\WINDOWS\system32\shdoclc.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 32]
[PID: 952 / Administrator][F:\explorer.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[D:\Program Files\360\360Safe\safemon\safemon.dll] [360.cn, 6, 5, 1, 1002]
[C:\WINDOWS\system32\nview.dll] [, ]
[C:\WINDOWS\system32\NVWRSZHC.DLL] [NVIDIA Corporation, 6.14.10.12081]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.19.5 10Apr08]
[C:\WINDOWS\system32\nvwddi.dll] [NVIDIA Corporation, 6.14.11.7930]
[C:\WINDOWS\system32\browselc.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[C:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll] [Thunder Networking Technologies,LTD, 1.0.5.29]
[C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 8, 96]
[C:\WINDOWS\system32\shdoclc.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[C:\Program Files\Lenovo\HOTKEY\hkvolkey.dll] [Lenovo Group Limited, 1.01]
[C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 32]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\nvapi.dll] [NVIDIA Corporation, 6.14.11.7930]
[C:\WINDOWS\system32\nvcpl.dll] [NVIDIA Corporation, 6.14.11.7930]
[C:\WINDOWS\system32\NVRSZHC.DLL] [NVIDIA Corporation, 6.14.11.7930]
[C:\WINDOWS\system32\nvshell.dll] [, ]
[PID: 5884 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[PID: 172 / Administrator][D:\Program Files\360\360Safe\360leakfixer.exe] [360.cn, 1, 0, 0, 1013]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[D:\Program Files\360\360Safe\leakrepair.dll] [360.cn, 1.0.0.1013]
[D:\Program Files\360\360Safe\360net.dll] [奇虎网, 1, 1, 17, 1020]

00000000065645 - 2010-6-16 23:54:00

[D:\Program Files\360\360Safe\pdown.dll] [360.cn, 1, 2, 0, 1014]
[PID: 5916 / Administrator][D:\Program Files\360\360Safe\LiveUpdate360.exe] [360.cn, 1, 2, 0, 1020]
[D:\Program Files\360\360Safe\LiveUpd360.dll] [360.cn, 1, 2, 0, 1033]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[D:\Program Files\360\360Safe\360net.dll] [奇虎网, 1, 1, 17, 1020]
[D:\Program Files\360\360Safe\360P2SP.dll] [360.cn, 1, 1, 0, 1045]
[PID: 4556 / Administrator][D:\Program Files\360\360se3\360SE.exe] [360.cn, 3, 2, 0, 2]
[D:\Program Files\360\360se3\Extensions\SafeCentral\SafeCentral.dll] [360.cn, 1, 3, 1, 1018]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[D:\Program Files\360\360Safe\safemon\safemon.dll] [360.cn, 6, 5, 1, 1002]
[C:\WINDOWS\system32\nview.dll] [, ]
[C:\WINDOWS\system32\NVWRSZHC.DLL] [NVIDIA Corporation, 6.14.10.12081]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.19.5 10Apr08]
[D:\Program Files\360\360se3\Extensions\Favorites\Favorites.dll] [360.cn, 2, 0, 1, 1028]
[D:\Program Files\360\360se3\Extensions\LoginEnrol\LoginEnrol.dll] [360.cn, 2, 0, 1, 1028]
[D:\Program Files\360\360se3\sqlite3.dll] [N/A, ]
[D:\PROGRA~1\360\360se3\Extensions\UICenter\UICenter.dll] [, 1, 0, 0, 8]
[D:\Program Files\360\360Safe\safemon\LoadWDUI.dll] [360.cn, 1, 0, 0, 1018]
[D:\PROGRA~1\360\360se3\Extensions\ExtAddons\ExtAddons.dll] [360.cn, 1, 0, 4, 1007]
[D:\PROGRA~1\360\360se3\Extensions\ExtProxy\ExtProxy.dll] [360SE, 1, 0, 2, 1001]
[D:\PROGRA~1\360\360se3\Extensions\ExtVideoAnalyze\ExtVideoAnalyze.dll] [, 1, 0, 0, 7]
[D:\PROGRA~1\360\360se3\Extensions\ExtSafeAddress\ExtSafeAddress.dll] [Phoenix Studio, 1, 0, 0, 3]
[D:\PROGRA~1\360\360se3\Extensions\SnapPlugin\SnapPlugin.dll] [, 1, 0, 0, 2]
[D:\PROGRA~1\360\360se3\Extensions\TranslatorPlugin\TranslatorPlugin.dll] [, 1, 0, 0, 2]
[D:\PROGRA~1\360\360se3\Extensions\MiniSearchBar\MiniSearchBar.dll] [, 1, 0, 0, 1005]
[D:\PROGRA~1\360\360se3\Extensions\onlinefav\onlinefav.dll] [, 3, 0, 0, 3]
[D:\PROGRA~1\360\360se3\Extensions\ExtAdfilter\ExtAdfilter.dll] [360.cn, 1, 1, 0, 1019]
[D:\PROGRA~1\360\360se3\Extensions\ExtPages\ExtPages.dll] [360.cn, 1, 0, 5, 1001]
[D:\PROGRA~1\360\360se3\Extensions\ExtSuggest\ExtSuggest.dll] [360SE, 1, 0, 1, 2]
[D:\PROGRA~1\360\360se3\Extensions\ExtDownload\ExtDownload.dll] [360, 1, 0, 4, 1002]
[D:\Program Files\360\360Safe\safemon\urlproc.dll] [360.cn, 1, 2, 0, 1005]
[C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx] [Adobe Systems, Inc., 9,0,124,0]
[D:\Program Files\360\360se3\Extensions\SafeCentral\urlproc.dll] [360.cn, 1, 2, 0, 1004]
[D:\Program Files\360\360se3\Extensions\SafeCentral\urlprocnet.dll] [360.cn, 1, 1, 0, 1005]
[C:\WINDOWS\system32\shdoclc.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[C:\WINDOWS\system32\nvwddi.dll] [NVIDIA Corporation, 6.14.11.7930]
[C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 32]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\SOGOUPY.IME] [Sogou.com Inc., 3.5.0.0]
[C:\Program Files\SogouInput\Plugin\SgImeWord.dll] [Sogou.com Inc., 3.5.0.0]
[PID: 3608 / Administrator][D:\Program Files\360\360se3\360SE.exe] [360.cn, 3, 2, 0, 2]
[D:\Program Files\360\360se3\Extensions\SafeCentral\SafeCentral.dll] [360.cn, 1, 3, 1, 1018]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[D:\Program Files\360\360Safe\safemon\safemon.dll] [360.cn, 6, 5, 1, 1002]
[C:\WINDOWS\system32\nview.dll] [, ]
[C:\WINDOWS\system32\NVWRSZHC.DLL] [NVIDIA Corporation, 6.14.10.12081]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.19.5 10Apr08]
[D:\Program Files\360\360se3\Extensions\Favorites\Favorites.dll] [360.cn, 2, 0, 1, 1028]
[D:\PROGRA~1\360\360se3\Extensions\ExtAdfilter\ExtAdfilter.dll] [360.cn, 1, 1, 0, 1019]
[D:\PROGRA~1\360\360se3\Extensions\ExtProxy\ExtProxy.dll] [360SE, 1, 0, 2, 1001]
[D:\Program Files\360\360Safe\safemon\urlproc.dll] [360.cn, 1, 2, 0, 1005]
[C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx] [Adobe Systems, Inc., 9,0,124,0]
[D:\Program Files\360\360se3\Extensions\SafeCentral\urlproc.dll] [360.cn, 1, 2, 0, 1004]
[C:\WINDOWS\system32\shdoclc.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[D:\Program Files\360\360Safe\safemon\LoadWDUI.dll] [360.cn, 1, 0, 0, 1018]
[C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 32]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\Program Files\Lenovo\HOTKEY\hkvolkey.dll] [Lenovo Group Limited, 1.01]
[D:\Program Files\360\360se3\Extensions\SafeCentral\urlprocnet.dll] [360.cn, 1, 1, 0, 1005]
[C:\WINDOWS\system32\SOGOUPY.IME] [Sogou.com Inc., 3.5.0.0]
[C:\Program Files\SogouInput\Plugin\SgImeWord.dll] [Sogou.com Inc., 3.5.0.0]
[PID: 2552 / SYSTEM][C:\WINDOWS\system32\wuauclt.exe] [(Verified) Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[PID: 4064 / Administrator][F:\sreng2\SREngLdr.EXE] [Smallfrogs Studio, 2.8.2.1321]
[PID: 3128 / Administrator][F:\sreng2\SREc1fb28de.EXE] [Smallfrogs Studio, 2.8.2.1321]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[D:\Program Files\360\360Safe\safemon\safemon.dll] [360.cn, 6, 5, 1, 1002]
[C:\WINDOWS\system32\nview.dll] [, ]
[C:\WINDOWS\system32\NVWRSZHC.DLL] [NVIDIA Corporation, 6.14.10.12081]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.5.19.5 10Apr08]
[C:\WINDOWS\system32\nvwddi.dll] [NVIDIA Corporation, 6.14.11.7930]
[F:\sreng2\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1 localhost
==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 448, C:\WINDOWS\SYSTEM32\ACS.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3256, C:\PROGRAM FILES\LENOVO\ATK HOTKEY\LCONTROL.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3868, C:\PROGRAM FILES\LENOVO\ATK HOTKEY\LFKA.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 5012, C:\PROGRAM FILES\THUNDER\PROGRAM\THUNDER5.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 5012, C:\PROGRAM FILES\THUNDER\PROGRAM\THUNDER5.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 952, F:\EXPLORER.EXE]
==================================
计划任务
N/A
==================================
Windows 安全更新检查
Microsoft .NET Framework 版本 1.1，简体中文版
KB940157, 用于 Windows XP 的 Windows 搜索 4.0 (KB940157)
KB905474, Windows Genuine Advantage 通知 (KB905474)
KB909520, Microsoft 基本智能卡加密服务提供程序包： x86 (KB909520)
KB951847, Microsoft .NET Framework 3.5 Service Pack 1 和 .NET Framework 3.5 Family Update (KB951847) x86
KB956744, Windows XP 安全更新程序 (KB956744) MS09-044
KB944036, 用于 Windows XP 的 Internet Explorer 8
KB971961, 用于 Windows XP 的 Jscript 5.7 的安全更新程序 (KB971961) MS09-045
KB973687, Windows XP 更新程序 (KB973687)
KB952069, Windows XP Service Pack 3 安全更新程序 (KB952069) MS08-076
KB970430, Windows XP 更新程序 (KB970430)
KB971737, Windows XP 更新程序 (KB971737)
KB955759, Windows XP 更新程序 (KB955759)
KB971513, Windows XP 更新程序 (KB971513)
KB981349, Windows XP 安全更新程序 (KB981349) MS10-022
KB931125, 根证书更新程序 [2010 年 5 月] (KB931125)
KB980218, Windows XP 安全更新程序 (KB980218) MS10-037
KB979482, Windows XP 安全更新程序 (KB979482) MS10-033
KB890830, Windows 恶意软件删除工具 - 2010 年 6 月 (KB890830)
KB982381, 用于 Windows XP 的 Internet Explorer 6 累积安全更新程序 (KB982381) MS10-035
==================================
API HOOK
NtCreateFile (危险等级: 高, 被下面模块所HOOK: )
NtCreateKey (危险等级: 高, 被下面模块所HOOK: )
NtCreateProcess (危险等级: 一般, 被下面模块所HOOK: )
NtCreateProcessEx (危险等级: 一般, 被下面模块所HOOK: )
NtCreateThread (危险等级: 一般, 被下面模块所HOOK: )
NtDeleteFile (危险等级: 高, 被下面模块所HOOK: )
NtEnumerateKey (危险等级: 高, 被下面模块所HOOK: )
NtEnumerateValueKey (危险等级: 高, 被下面模块所HOOK: )
NtFsControlFile (危险等级: 高, 被下面模块所HOOK: )
NtLoadDriver (危险等级: 高, 被下面模块所HOOK: )
NtLoadKey2 (危险等级: 高, 被下面模块所HOOK: )
NtLoadKey (危险等级: 高, 被下面模块所HOOK: )
NtOpenKey (危险等级: 高, 被下面模块所HOOK: )
NtOpenProcess (危险等级: 高, 被下面模块所HOOK: )
NtOpenThread (危险等级: 高, 被下面模块所HOOK: )
NtQueryDirectoryFile (危险等级: 高, 被下面模块所HOOK: )
NtQueryDirectoryObject (危险等级: 高, 被下面模块所HOOK: )
NtQueryFullAttributesFile (危险等级: 高, 被下面模块所HOOK: )
NtQueryInformationFile (危险等级: 高, 被下面模块所HOOK: )
NtQueryInformationPort (危险等级: 高, 被下面模块所HOOK: )
NtQueryInformationProcess (危险等级: 高, 被下面模块所HOOK: )
NtQueryInformationThread (危险等级: 高, 被下面模块所HOOK: )
NtQuerySystemInformation (危险等级: 高, 被下面模块所HOOK: )
NtReadFile (危险等级: 一般, 被下面模块所HOOK: )
NtRenameKey (危险等级: 一般, 被下面模块所HOOK: )
NtReplaceKey (危险等级: 高, 被下面模块所HOOK: )
NtRestoreKey (危险等级: 高, 被下面模块所HOOK: )
NtSaveKey (危险等级: 高, 被下面模块所HOOK: )
NtSaveKeyEx (危险等级: 高, 被下面模块所HOOK: )
NtSetInformationFile (危险等级: 高, 被下面模块所HOOK: )
NtSetInformationKey (危险等级: 高, 被下面模块所HOOK: )
NtSetInformationProcess (危险等级: 高, 被下面模块所HOOK: )
NtSetInformationThread (危险等级: 高, 被下面模块所HOOK: )
NtSetSystemInformation (危险等级: 高, 被下面模块所HOOK: )
NtSetValueKey (危险等级: 高, 被下面模块所HOOK: )
NtTerminateProcess (危险等级: 高, 被下面模块所HOOK: )
NtTerminateThread (危险等级: 高, 被下面模块所HOOK: )
NtWriteFile (危险等级: 一般, 被下面模块所HOOK: )
ZwCreateFile (危险等级: 高, 被下面模块所HOOK: )
ZwCreateKey (危险等级: 高, 被下面模块所HOOK: )
ZwCreatePort (危险等级: 一般, 被下面模块所HOOK: )
ZwCreateProcess (危险等级: 一般, 被下面模块所HOOK: )
ZwCreateProcessEx (危险等级: 一般, 被下面模块所HOOK: )
ZwCreateThread (危险等级: 一般, 被下面模块所HOOK: )
ZwDeleteFile (危险等级: 高, 被下面模块所HOOK: )
ZwDeleteKey (危险等级: 高, 被下面模块所HOOK: )
ZwEnumerateKey (危险等级: 高, 被下面模块所HOOK: )
ZwEnumerateValueKey (危险等级: 高, 被下面模块所HOOK: )
ZwFsControlFile (危险等级: 高, 被下面模块所HOOK: )
ZwOpenFile (危险等级: 一般, 被下面模块所HOOK: )
ZwOpenProcess (危险等级: 一般, 被下面模块所HOOK: )
ZwOpenThread (危险等级: 一般, 被下面模块所HOOK: )
ZwQueryDirectoryFile (危险等级: 高, 被下面模块所HOOK: )
ZwQueryInformationFile (危险等级: 高, 被下面模块所HOOK: )
ZwQueryInformationProcess (危险等级: 高, 被下面模块所HOOK: )
ZwQueryInformationThread (危险等级: 高, 被下面模块所HOOK: )
ZwReadFile (危险等级: 一般, 被下面模块所HOOK: )
ZwRenameKey (危险等级: 一般, 被下面模块所HOOK: )
ZwReplaceKey (危险等级: 高, 被下面模块所HOOK: )
ZwRestoreKey (危险等级: 高, 被下面模块所HOOK: )
ZwSaveKey (危险等级: 高, 被下面模块所HOOK: )
ZwSaveKeyEx (危险等级: 高, 被下面模块所HOOK: )
ZwSetInformationFile (危险等级: 高, 被下面模块所HOOK: )
ZwSetInformationKey (危险等级: 高, 被下面模块所HOOK: )
ZwSetInformationProcess (危险等级: 高, 被下面模块所HOOK: )
ZwSetInformationThread (危险等级: 高, 被下面模块所HOOK: )
ZwSetSystemInformation (危险等级: 高, 被下面模块所HOOK: )
ZwSetValueKey (危险等级: 高, 被下面模块所HOOK: )
ZwSetVolumeInformationFile (危险等级: 高, 被下面模块所HOOK: )
ZwShutdownSystem (危险等级: 高, 被下面模块所HOOK: )
ZwTerminateProcess (危险等级: 高, 被下面模块所HOOK: )
ZwTerminateThread (危险等级: 高, 被下面模块所HOOK: )
ZwWriteFile (危险等级: 一般, 被下面模块所HOOK: )
GetVersion (危险等级: 一般, 被下面模块所HOOK: )
GetVersionExW (危险等级: 一般, 被下面模块所HOOK: )
DeleteFileW (危险等级: 高, 被下面模块所HOOK: )
FindFirstFileExW (危险等级: 高, 被下面模块所HOOK: )
TerminateThread (危险等级: 高, 被下面模块所HOOK: )
FindFirstChangeNotificationW (危险等级: 高, 被下面模块所HOOK: )
GetCurrentProcess (危险等级: 一般, 被下面模块所HOOK: )
GetCurrentProcessId (危险等级: 一般, 被下面模块所HOOK: )
GetCurrentThread (危险等级: 一般, 被下面模块所HOOK: )
GetCurrentThreadId (危险等级: 一般, 被下面模块所HOOK: )
GetFileSizeEx (危险等级: 一般, 被下面模块所HOOK: )
GetFileInformationByHandle (危险等级: 一般, 被下面模块所HOOK: )
GetFileAttributesW (危险等级: 一般, 被下面模块所HOOK: )
OpenProcess (危险等级: 高, 被下面模块所HOOK: )
OpenThread (危险等级: 高, 被下面模块所HOOK: )
==================================
隐藏进程
N/A
==================================[/code]

瑞星卡卡安全论坛