请问大家，SREng日志能否看出是否被装了监控软件？ bbs.ikaka.com

andysk2 - 2010-12-6 16:01:00

2010-12-06,13:22:41
System Repair Engineer 2.8.2.1321
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 3 (Build 2600) - 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描
计划任务
Windows 安全更新检查
API HOOK
隐藏进程

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<kxesc><"C:\Program Files\Common Files\Kingsoft\kiscommon\kxetray.exe" -autorun> [(Verified)Zhuhai Kingsoft Software Co.,Ltd]
<KSafeTray><"C:\Program Files\Kingsoft\KSafe\KSafeTray.exe" -autorun> [(Verified)Kingsoft Security Co.,Ltd]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Component Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{AEB6717E-7E19-11d0-97EE-00C04FD91972}><shell32.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<PostBootReminder><%SystemRoot%\system32\SHELL32.dll> [(Verified)Microsoft Windows Component Publisher]
<CDBurn><%SystemRoot%\system32\SHELL32.dll> [(Verified)Microsoft Windows Component Publisher]
<WebCheck><%SystemRoot%\system32\webcheck.dll> [(Verified)Microsoft Windows Component Publisher]
<SysTray><C:\WINDOWS\system32\stobject.dll> [(Verified)Microsoft Windows Component Publisher]
<WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
<WinlogonNotify: crypt32chain><crypt32.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
<WinlogonNotify: cryptnet><cryptnet.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
<WinlogonNotify: cscdll><cscdll.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dimsntfy]
<WinlogonNotify: dimsntfy><%SystemRoot%\System32\dimsntfy.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
<WinlogonNotify: igfxcui><igfxdev.dll> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
<WinlogonNotify: ScCertProp><wlnotify.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
<WinlogonNotify: Schedule><wlnotify.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
<WinlogonNotify: sclgntfy><sclgntfy.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
<WinlogonNotify: SensLogn><WlNotify.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
<WinlogonNotify: termsrv><wlnotify.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
<WinlogonNotify: wlballoon><wlnotify.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
<{438755C2-A8BA-11D1-B96B-00A0C90312E1}><%SystemRoot%\system32\browseui.dll> [(Verified)Microsoft Windows Component Publisher]
<{8C7461EF-2B13-11d2-BE35-3078302C2030}><%SystemRoot%\system32\browseui.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
<N/A><C:\WINDOWS\inf\unregmp2.exe /ShowWMP> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
<浏览器自定义组件><RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player 10><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
<Windows 桌面更新><regsvr32.exe /s /n /i:U shell32.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
<Internet Explorer 6><%SystemRoot%\system32\ie4uinit.exe> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
<N/A><C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install> [Microsoft Corporation]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<msnmsgr><; "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background> [(Verified)Microsoft Corporation]
==================================
启动文件夹
N/A
==================================
服务
[HID Input Service / HidServ][Stopped/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Kingsoft Basic Service / kaccore][Stopped/Manual Start]
<"C:\Program Files\Kingsoft\KAC\Service\kaccore.exe"><Kingsoft Corporation>
[Kingsoft AQ100 Service / Kingsoft AQ100 Service][Running/Auto Start]
<C:\Program Files\kingsoft\AQ100\kaqsvc.exe><Kingsoft Corporation>
[KSafe service / KSafeSvc][Running/Auto Start]
<"C:\Program Files\Kingsoft\KSafe\KSafeSvc.exe" -svc><Kingsoft Corporation.>
[Kingsoft Core Defend Service / kxedefend][Running/Auto Start]
<"C:\Program Files\Common Files\Kingsoft\kiscommon\kxedefend.exe" /service kxedefend><Kingsoft Corporation>
[Kingsoft Security App Service / kxesapp][Running/Auto Start]
<"C:\Program Files\Common Files\Kingsoft\kiscommon\kxesapp.exe" /service kxesapp><Kingsoft Corporation>
[Kingsoft Core Service / kxescore][Running/Auto Start]
<"C:\Program Files\Common Files\Kingsoft\kiscommon\kxescore.exe" /service kxescore><Kingsoft Corporation>
[Kingsoft Antivirus XEngine Service(Beta) / KxEServBeta][Running/Auto Start]
<C:\Program Files\Common Files\Kingsoft\CommonService_Beta\kxeserv.exe><Kingsoft Corporation>
[Kingsoft Antivirus Update Service / KxEUpSrv][Running/Auto Start]
<"C:\Program Files\Common Files\Kingsoft\kiscommon\upsvc.exe"><Kingsoft Corporation>
[Windows Media Connect Service / WMConnectCDS][Stopped/Manual Start]
<C:\Program Files\Windows Media Connect 2\wmccds.exe><Microsoft Corporation>
==================================
驱动程序
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[Creative AudioPCI (ES1371,ES1373) (WDM) / es1371][Stopped/Manual Start]
<system32\drivers\es1371mp.sys><Creative Technology Ltd.>
[hptpro / hptpro][Stopped/Boot Start]
<\SystemRoot\system32\DRIVERS\hptpro.sys><HighPoint Technologies, Inc.>
[ialm / ialm][Running/Manual Start]
<system32\DRIVERS\igxpmp32.sys><Intel Corporation>
[KAVBootC / KAVBootC][Running/Boot Start]
<\SystemRoot\system32\drivers\KAVBootC.sys><Kingsoft Corporation>
[KAVSafe / KAVSafe][Running/Auto Start]
<\??\C:\WINDOWS\system32\Drivers\KAVSafe.sys><Kingsoft Corporation>
[ksdef / ksdef][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\ksdef.sys><Kingsoft Corporation>
[kwatch32 / kwatch32][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\kwatch32.sys><Kingsoft Corporation>
[AMD PCNET Compatable Adapter Driver / PCnet][Stopped/Manual Start]
<system32\DRIVERS\pcntpci5.sys><AMD Inc.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
[TCP/IP Protocol Driver / Tcpip][Running/System Start]
<system32\DRIVERS\tcpip.sys><Microsoft Corporation>
[NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller / yukonwxp][Running/Manual Start]
<system32\DRIVERS\yk51x86.sys><Marvell>
==================================
浏览器加载项
[迅雷流媒体探测IE支持]
{01443AEC-0FD1-40fd-9C87-E93D1494C233} <, >
[迅雷网页图片浏览器IE支持]
{2D90D33C-DE76-42D0-9040-E4466DDC24AC} <, >
[Search Helper]
{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} <C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll, (Signed) Microsoft Corp.>
[迅雷下载支持]
{889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\BHO\XunleiBHO7.1.2.2014.dll, (Signed) 深圳市迅雷网络技术有限公司>
[Windows Live 登录帮助程序]
{9030D464-4C02-4ABF-8ECC-5164760863C6} <C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll, (Signed) Microsoft Corporation>
[Windows Live Toolbar Helper]
{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} <C:\Program Files\Windows Live\Toolbar\wltcore.dll, (Signed) Microsoft Corporation>
[BlogThisToolbarButton Class]
{219C3416-8CB2-491a-A3C7-D9FCDDC9D600} <C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll, (Signed) Microsoft Corporation>
[查看网页全部图片]
{548BF84E-9665-47f9-B635-7380F8943E90} <, >
[百度一下,你就知道]
{6096E38F-5AC1-9527-8EC4-75DFA92FB32F} <, >
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, >
[&Windows Live Toolbar]
{21FA44EF-376D-4D53-9B0F-8A89D3229068} <C:\Program Files\Windows Live\Toolbar\wltcore.dll, (Signed) Microsoft Corporation>
[Alexa]
{EA582743-9076-4178-9AA6-7393FDF4D5CE} <C:\Program Files\Alexa Toolbar\AlxTB2.9.39.dll, (Signed) Alexa Internet, Inc.>
[迅雷流媒体探测IE支持]
{01443AEC-0FD1-40FD-9C87-E93D1494C233} <, >
[PD Class]
{0545143D-6947-459C-9711-75935014EA8F} <D:\慧鄞聪蟎\买蚵卖敉通↖IM\CPicDeal.dll, N/A>
[Windows Genuine Advantage Validation Tool]
{17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.dll, (Signed) Microsoft Corporation>
[InstallHelper Class]
{1DABF8D5-8430-4985-9B7F-A30E53D709B3} <C:\WINDOWS\system32\MMInstaller.dll, (Signed) Tencent>
[]
{219C3416-8CB2-491A-A3C7-D9FCDDC9D600} <, >
[&Windows Live Toolbar]
{21FA44EF-376D-4D53-9B0F-8A89D3229068} <C:\Program Files\Windows Live\Toolbar\wltcore.dll, (Signed) Microsoft Corporation>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, (Signed) Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, (Signed) N/A>
[DHTML Edit Control Safe for Scripting for IE5]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, (Signed) Microsoft Corporation>
[迅雷网页图片浏览器IE支持]
{2D90D33C-DE76-42D0-9040-E4466DDC24AC} <, >
[XML Document]
{48123BC4-99D9-11D1-A6B3-00C04FD91555} <C:\WINDOWS\system32\msxml3.dll, (Signed) Microsoft Corporation>
[Agent Class]
{485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <C:\Program Files\Thunder Network\Thunder\BHO\ThunderAgent7.1.2.2014.dll, (Signed) 深圳市迅雷网络技术有限公司>
[]
{488A4255-3236-44B3-8F27-FA1AECAA8844} <, >
[QQPYChecker Class]
{5052B4D0-9DF7-45ef-88EF-F42C0EA33A43} <D:\Program Files\Tencent\QQWubi\1.2.251.400\QQImeChecker.dll, (Signed) Tencent>
[]
{548BF84E-9665-47F9-B635-7380F8943E90} <, >
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, (Signed) N/A>
[]
{6096E38F-5AC1-9527-8EC4-75DFA92FB32F} <, >
[XMP Class]
{6483F145-A768-4C41-AACC-52D4D7845851} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xplayer.dll_1_work, Xunlei Networking Technologies,LTD>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, (Signed) Microsoft Corporation>
[MUWebControl Class]
{6E32070A-766D-4EE6-879C-DC1FA91D2FC3} <C:\WINDOWS\system32\muweb.dll, (Signed) Microsoft Corporation>
[Search Helper]
{6EBF7485-159F-4BFF-A14F-B9E3AAC4465B} <C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll, (Signed) Microsoft Corp.>
[Access UserInfo by Script]
{6EE9CD3E-A386-4DAE-9737-A759DBF927AE} <C:\Program Files\Thunder Network\Thunder\ComDlls\UserAgent.dll, N/A>
[]
{73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <, >
[MediaComm Class]
{7670648D-461B-42AF-BDFE-46D26AF5EFF2} <C:\Program Files\Thunder Network\Thunder\userdata\Components\InMedia\MediaAddin.dll, N/A>
[]
{87515F61-A66C-4319-A0E0-D416CB8059E3} <, >
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, (Signed) Microsoft Corporation>
[迅雷下载支持]
{889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\BHO\XunleiBHO7.1.2.2014.dll, (Signed) 深圳市迅雷网络技术有限公司>
[]
{8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} <, >
[Windows Live 登录帮助程序]
{9030D464-4C02-4ABF-8ECC-5164760863C6} <C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll, (Signed) Microsoft Corporation>
[OFrameObject Class]
{9701758C-4373-482E-B13C-776C048EC890} <C:\Program Files\Common Files\Thunder Network\KanKan\DapCtrl.2.3.5927.310.(206).dll, (Signed) ShenZhen Thunder Networking Technologies Ltd.>
[VersionDetector Class]
{9EFF1953-9694-47B1-AEF6-B2A3FE8BFE9B} <C:\Program Files\Common Files\Thunder Network\KanKan\vd.1.1.0.32.(206).dll, (Signed) ShenZhen Thunder Networking Technologies,Ltd.>
[HallToolkit Class]
{A24E6133-404F-4431-A296-2DE576FC5AEE} <C:\Program Files\Common Files\Thunder Network\XLGame\HallTool.1.0.0.5.(797).dll, (Signed) 深圳市迅雷网络技术有限公司>
[APlayer Control]
{A9322148-C691-4B9D-91FC-B9C461DBE9DD} <C:\Program Files\Common Files\Thunder Network\APlayer\APlayer_001.dll, (Signed) ShenZhen Thunder Networking Technologies, LTD>
[DapCtrl Class]
{ACACC6EB-1FBA-4E13-A729-53AEB2DF54F8} <C:\Program Files\Common Files\Thunder Network\KanKan\DapCtrl.2.3.5927.310.(206).dll, (Signed) ShenZhen Thunder Networking Technologies Ltd.>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, (Signed) N/A>
[]
{C95FE080-8F5D-11D2-A20B-00AA003C157A} <, >
[AUDIO__MP3 Moniker Class]
{CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, (Signed) Microsoft Corporation>
[AUDIO__WAV Moniker Class]
{CD3AFA7B-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, (Signed) Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
{CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, (Signed) Microsoft Corporation>
[Windows Live 登录控制]
{D2517915-48CE-4286-970F-921E881B8C5C} <C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll, (Signed) Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash10l.ocx, (Signed) Adobe Systems, Inc.>
[Microsoft Silverlight]
{DFEAF541-F3E1-4C24-ACAC-99C30715084A} <C:\Program Files\Microsoft Silverlight\4.0.50401.0\npctrl.dll, Microsoft Corporation>
[PlayerCtrl Class]
{E05BC2A3-9A46-4A32-80C9-023A473F5B23} <D:\Program Files\Tencent\QQMusic\QzoneMusic.dll, (Signed) Tencent>
[Windows Live Toolbar Helper]
{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} <C:\Program Files\Windows Live\Toolbar\wltcore.dll, (Signed) Microsoft Corporation>
[]
{E2E2DD38-D088-4134-82B7-F2BA38496583} <, >
[Alexa]
{EA582743-9076-4178-9AA6-7393FDF4D5CE} <C:\Program Files\Alexa Toolbar\AlxTB2.9.39.dll, (Signed) Alexa Internet, Inc.>
[XPPlayer Class]
{F3E70CEA-956E-49CC-B444-73AFE593AD7F} <C:\Program Files\Common Files\Thunder Network\KanKan\PPlayer.2.0.5835.191.(269).dll, (Signed) Xunlei Networking Technologies,LTD>
[使用迅雷下载]
<C:\Program Files\Thunder Network\Thunder\BHO\geturl.htm, N/A>
[使用迅雷下载全部链接]
<C:\Program Files\Thunder Network\Thunder\BHO\GetAllUrl.htm, N/A>
[使用迅雷查看图片]
<C:\Program Files\Thunder Network\Thunder\Program\repairimage.htm, N/A>
==================================

用户系统信息：Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)

andysk2 - 2010-12-6 16:03:00

正在运行的进程
[PID: 596 / SYSTEM][\SystemRoot\System32\smss.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[PID: 660 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[PID: 684 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2113)]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[PID: 728 / SYSTEM][C:\WINDOWS\system32\services.exe] [(Verified) Microsoft Corporation, 5.1.2600.5755 (xpsp_sp3_qfe.090206-1316)]
[PID: 740 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2113)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[PID: 924 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[PID: 992 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[PID: 1108 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[PID: 1260 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[PID: 1380 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[PID: 1672 / Administrator][C:\WINDOWS\Explorer.EXE] [(Verified) Microsoft Corporation, 6.00.2900.5634 (xpsp_sp3_qfe.080703-1303)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[C:\Program Files\Kingsoft\Kingsoft Antivirus\ktaskbar.dll] [Kingsoft Corporation, 2010,05,26,732]
[C:\Program Files\Common Files\Kingsoft\kiscommon\DetectDllHijack.dll] [Kingsoft Corporation, 2010,08,30,159]
[C:\Program Files\Kingsoft\KSafe\ksfmon.dll] [Kingsoft Corporation., 2.0.1.1199]
[C:\Program Files\Kingsoft\KSafe\kwsui.dll] [Kingsoft Corporation., 2010.10.29.1125]
[C:\Program Files\Kingsoft\KSafe\kswebshield.dll] [Kingsoft Corporation, 2010.11.20.1037]
[PID: 1696 / SYSTEM][C:\Program Files\kingsoft\AQ100\kaqsvc.exe] [Kingsoft Corporation, 2009,11,25,300]
[C:\Program Files\Common Files\Kingsoft\CommonService_Beta\kxebase.dll] [Kingsoft Corporation, 2009,09,23,61]
[C:\Program Files\Common Files\Kingsoft\CommonService_Beta\SCOM.dll] [Kingsoft Corporation, 2009,09,23,61]
[C:\Program Files\Common Files\Kingsoft\CommonService_Beta\kxecore\kxelog.dll] [Kingsoft Corporation, 2009,09,23,61]
[C:\Program Files\Common Files\Kingsoft\CommonService_Beta\kxecore\kxecore.dll] [Kingsoft Corporation, 2009,12,08,84]
[C:\Program Files\kingsoft\AQ100\jsonv6.dll] [Kingsoft Corporation, 2009,09,28,65]
[C:\Program Files\kingsoft\AQ100\kqscore.dll] [Kingsoft Corporation, 2009,11,25,300]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[C:\Program Files\kingsoft\AQ100\ksbwssp.dll] [Kingsoft Corporation, 2009,11,25,300]
[C:\Program Files\kingsoft\AQ100\ksbwdet.dll] [Kingsoft Corporation, 2009,11,25,300]
[C:\Program Files\kingsoft\AQ100\ksbwquar.dll] [N/A, ]
[C:\Program Files\kingsoft\AQ100\khandler.dll] [Kingsoft Corporation, 2009,11,03,243]
[C:\Program Files\kingsoft\AQ100\ksedetect.dll] [N/A, ]
[C:\Program Files\kingsoft\AQ100\sqlite.dll] [N/A, ]
[C:\Program Files\kingsoft\AQ100\kfic.dll] [N/A, ]
[C:\Program Files\kingsoft\AQ100\kcldrep.dll] [N/A, ]
[PID: 1724 / SYSTEM][C:\Program Files\Kingsoft\KSafe\KSafeSvc.exe] [Kingsoft Corporation., 2.0.1.1201]
[C:\Program Files\Kingsoft\KSafe\ksafeeng.dll] [Kingsoft Corporation., 2.0.1.1199]
[C:\Program Files\Kingsoft\KSafe\katrun.dll] [Kingsoft Corporation., 2.0.1.1199]
[C:\Program Files\Kingsoft\KSafe\ksafebak.dll] [Kingsoft Corporation., 2.0.1.1199]
[C:\Program Files\Kingsoft\KSafe\ksafedb.dll] [Kingsoft Corporation., 2.0.1.1199]
[C:\Program Files\Kingsoft\KSafe\kcache.dll] [Kingsoft Corporation., 2.0.1.1199]
[C:\Program Files\Kingsoft\KSafe\knescan.dll] [Kingsoft Corporation., 1.0.0.1111]
[C:\Program Files\Kingsoft\KSafe\kse\ksbwdet2.dll] [Kingsoft Corporation, 2010,11,23,1521]
[C:\Program Files\Kingsoft\KSafe\kse\sqlite.dll] [Kingsoft Corporation, 2010,03,30,781]
[C:\Program Files\Kingsoft\KSafe\KEng\ksafeave.dll] [Kingsoft Corporation., 1.0.0.1114]
[C:\Program Files\Kingsoft\KSafe\kdump.dll] [Kingsoft Corporation, 2010,10,11,1453]
[C:\Program Files\Kingsoft\KSafe\KEng\kae\kaecore.dat] [Kingsoft Corporation, 2010,06,30,436]
[C:\Program Files\Kingsoft\KSafe\kxebase.dll] [Kingsoft Corporation, 2010,5,12,402]
[C:\Program Files\Kingsoft\KSafe\scom.dll] [Kingsoft Corporation, 2010,5,12,402]
[C:\Program Files\Kingsoft\KSafe\kxecore\kxecore.dll] [Kingsoft Corporation, 2010,5,12,402]
[C:\Program Files\Kingsoft\KSafe\kexectrl.dll] [Kingsoft Corporation, 2010,09,18,1422]
[C:\Program Files\Kingsoft\KSafe\kwssp.dll] [Kingsoft Corporation., 2010.11.8.1203]
[C:\Program Files\Kingsoft\KSafe\json.dll] [N/A, ]
[C:\Program Files\Kingsoft\KSafe\ksscore.dll] [Kingsoft Corporation, 2010,10,27,33]
[C:\Program Files\Kingsoft\KSafe\kplugeng.dll] [Kingsoft Corporation., 1.5.2.1191]
[C:\Program Files\Kingsoft\KSafe\kcldrep.dll] [Kingsoft Corporation, 2010,09,06,1388]
[C:\Program Files\Kingsoft\KSafe\KSE\ksecorex.dll] [Kingsoft Corporation, 2010,09,16,1206]
[C:\Program Files\Kingsoft\KSafe\kavquara.dll] [Kingsoft Corporation, 2010,09,09,1147]
[C:\Program Files\Kingsoft\KSafe\KEng\kae\karchive.dat] [Kingsoft Corporation, 2010,06,30,436]
[C:\Program Files\Kingsoft\KSafe\KEng\kae\kaearcha.dat] [Kingsoft Corporation, 2010,06,30,436]
[C:\Program Files\Kingsoft\KSafe\KEng\kae\kaeolea.dat] [Kingsoft Corporation, 2010,06,30,436]
[C:\Program Files\Kingsoft\KSafe\KEng\kae\kaearchb.dat] [Kingsoft Corporation, 2010,06,30,436]
[C:\Program Files\Kingsoft\KSafe\KEng\kae\kaeunpak.dat] [Kingsoft Corporation, 2010,06,30,436]
[C:\Program Files\Kingsoft\KSafe\KEng\kae\kaevname.dat] [Kingsoft Corporation, 2010,06,30,436]
[C:\Program Files\Kingsoft\KSafe\KEng\kae\kaeunpack.dat] [Kingsoft Corporation, 2010,07,18,365]
[C:\Program Files\Kingsoft\KSafe\KEng\kae\kaecorea.dat] [Kingsoft Corporation, 2010,06,30,436]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[PID: 1996 / Administrator][C:\Program Files\Kingsoft\KSafe\KSafeTray.exe] [Kingsoft Corporation., 2.0.1.1199]
[C:\Program Files\Kingsoft\KSafe\ksfmon.dll] [Kingsoft Corporation., 2.0.1.1199]
[C:\Program Files\Kingsoft\KSafe\krunopt.dll] [Kingsoft Corporation., 2.0.1.1199]
[C:\Program Files\Kingsoft\KSafe\kdump.dll] [Kingsoft Corporation, 2010,10,11,1453]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[C:\Program Files\Kingsoft\KSafe\kwsctrl.dll] [Kingsoft Corporation., 2.0.1.1199]
[C:\Program Files\Kingsoft\KSafe\kwsui.dll] [Kingsoft Corporation., 2010.10.29.1125]
[C:\Program Files\Kingsoft\KSafe\kswebshield.dll] [Kingsoft Corporation, 2010.11.20.1037]
[C:\Program Files\Kingsoft\KSafe\ksafevul.dll] [Kingsoft Corporation., 2.0.1.1199]
[C:\Program Files\Kingsoft\KSafe\ksafeup.dll] [Kingsoft Corporation., 2.0.1.1199]
[C:\Program Files\Kingsoft\KSafe\zlib1.dll] [, 1.2.3]
[C:\Program Files\Kingsoft\KSafe\kplugeng.dll] [Kingsoft Corporation., 1.5.2.1191]
[C:\Program Files\Common Files\Kingsoft\kiscommon\DetectDllHijack.dll] [Kingsoft Corporation, 2010,08,30,159]
[PID: 2008 / Administrator][C:\WINDOWS\system32\ctfmon.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2105)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[PID: 1520 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [(Verified) Microsoft Corporation, 5.1.2600.6024 (xpsp_sp3_gdr.100817-1626)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[PID: 2568 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[PID: 2612 / SYSTEM][C:\Program Files\Common Files\Kingsoft\CommonService_Beta\kxeserv.exe] [Kingsoft Corporation, 2009,11,12,82]
[C:\Program Files\Common Files\Kingsoft\CommonService_Beta\jsonv6.dll] [Kingsoft Corporation, 2009,09,28,65]
[C:\Program Files\Common Files\Kingsoft\CommonService_Beta\kxedump.dll] [Kingsoft Corporation, 2009,09,23,61]
[C:\Program Files\Common Files\Kingsoft\CommonService_Beta\scom.dll] [Kingsoft Corporation, 2009,09,23,61]
[C:\Program Files\Common Files\Kingsoft\CommonService_Beta\kxebase.dll] [Kingsoft Corporation, 2009,09,23,61]
[C:\Program Files\Common Files\Kingsoft\CommonService_Beta\kxecore\kxelog.dll] [Kingsoft Corporation, 2009,09,23,61]
[C:\Program Files\Common Files\Kingsoft\CommonService_Beta\kxecore\kxecore.dll] [Kingsoft Corporation, 2009,12,08,84]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[C:\Program Files\Common Files\Kingsoft\CommonService_Beta\kxecore\kxestat.dll] [Kingsoft Corporation, 2010,01,21,452]
[PID: 2784 / SYSTEM][C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe] [Microsoft Corp., 1.2.123.0]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[PID: 3444 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-0852)]
[C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[PID: 1636 / Administrator][D:\Program Files\Tencent\QQ\Bin\QQ.exe] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Bin\Common.dll] [Tencent, 1, 40, 1390, 0]
[C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_473666fd\ATL80.DLL] [Microsoft Corporation, 8.00.50727.4053]
[D:\Program Files\Tencent\QQ\Bin\KernelUtil.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Bin\GF.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Bin\xGraphic32.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Bin\AppUtil.dll] [Tencent, 1, 40, 1390, 0]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[C:\Program Files\Common Files\Kingsoft\kiscommon\DetectDllHijack.dll] [Kingsoft Corporation, 2010,08,30,159]
[C:\Program Files\Kingsoft\KSafe\ksfmon.dll] [Kingsoft Corporation., 2.0.1.1199]
[C:\Program Files\Kingsoft\KSafe\kwsui.dll] [Kingsoft Corporation., 2010.10.29.1125]
[C:\Program Files\Kingsoft\KSafe\kswebshield.dll] [Kingsoft Corporation, 2010.11.20.1037]
[D:\Program Files\Tencent\QQ\Bin\MainFrame.dll] [Tencent, 1, 40, 1390, 0]
[C:\WINDOWS\system32\Macromed\Flash\Flash10l.ocx] [Adobe Systems, Inc., 10,1,102,64]
[D:\Program Files\Tencent\QQ\Bin\IM.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Bin\TaskTray.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Bin\TXPFProxy.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\Com.Tencent.QQShow\Bin\FlashAvatarDll.dll] [Tencent, 1.45.1.45]
[D:\Program Files\Tencent\QQ\Bin\KernelMisc.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Bin\AppMisc.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Bin\AppCtrl.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Bin\ChatFrame.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Bin\ConfigCenter.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Bin\CustomFace.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Bin\LongCnn.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Bin\ContactInfoFrame.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Bin\MsgMgr.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Bin\SkinMgr.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Bin\QInterLive.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Bin\SystemMsg.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\Com.Tencent.PaiPai\Bin\PaiPai.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\Com.Tencent.AudioVideo\Bin\AudioVideo.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\Com.Tencent.MMOG\Bin\MMOG.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\Com.Tencent.Soso\Bin\Soso.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\Com.Tencent.Qzone\Bin\Qzone.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\Com.Tencent.Weather\Bin\Weather.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\Com.Tencent.SoBar\Bin\SoBar.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\Com.Tencent.PaiPaiGift\Bin\PaiPaiGift.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\Com.Tencent.QQLive\Bin\QQLive.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\Com.Tencent.QQMusic\Bin\QQMusic.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\Com.Tencent.taotao\Bin\Taotao.dll] [Tencent, 1, 40, 1390, 0]
[C:\Program Files\Common Files\Tencent\TXSSO\Bin\SSOPlatform.dll] [Tencent, 1.2.1.6]
[C:\Program Files\Common Files\Tencent\TXSSO\Bin\SSOCommon.DLL] [Tencent, 1.2.1.5]
[C:\WINDOWS\system32\msdmo.dll] [, ]
[D:\Program Files\Tencent\QQ\Bin\GroupApp.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\com.tencent.snsapp\Bin\SNSApp.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\com.tencent.paycenter\Bin\PayCenter.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\com.tencent.qbar\Bin\QBar.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\com.tencent.qqvipmisc\Bin\QQVipMisc.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\com.tencent.wenwen\Bin\WenWen.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\com.tencent.netbar\Bin\NetBar.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\com.tencent.wireless\Bin\Wireless.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\com.tencent.qqshow\Bin\QQShow.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\com.tencent.crm\Bin\CRM.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\com.tencent.vas\Bin\VAS.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Bin\InformationBox.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\com.tencent.qqvip\Bin\QQVip.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\com.tencent.filetransfer\Bin\FileTransfer.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\com.tencent.memo\Bin\Memo.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\com.tencent.qqpet\Bin\QQPet.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\com.tencent.today\Bin\Today.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\com.tencent.qqgame\Bin\QQGame.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\com.tencent.qqring\Bin\QQRing.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\com.tencent.mail\Bin\Mail.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\com.tencent.qqwebsite\Bin\QQWebsite.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\com.tencent.gamelife\Bin\GameLife.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Plugin\com.tencent.winks\Bin\Winks.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQ\Bin\AddrSearch.dll] [Tencent, 2, 3, 12, 11]
[PID: 1424 / Administrator][D:\Program Files\Tencent\QQ\Bin\TXPlatform.exe] [Tencent, 1, 40, 1390, 0]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[C:\Program Files\Common Files\Kingsoft\kiscommon\DetectDllHijack.dll] [Kingsoft Corporation, 2010,08,30,159]
[C:\Program Files\Kingsoft\KSafe\ksfmon.dll] [Kingsoft Corporation., 2.0.1.1199]
[C:\Program Files\Kingsoft\KSafe\kwsui.dll] [Kingsoft Corporation., 2010.10.29.1125]
[C:\Program Files\Kingsoft\KSafe\kswebshield.dll] [Kingsoft Corporation, 2010.11.20.1037]
[D:\Program Files\Tencent\QQ\Bin\TXPFProxy.dll] [Tencent, 1, 40, 1390, 0]

andysk2 - 2010-12-6 16:03:00

[PID: 2776 / Administrator][D:\Program Files\Tencent\QQMusic\QQMusic.exe] [Tencent, 7.65.1339.827]
[D:\Program Files\Tencent\QQMusic\QQMusicCommon.dll] [Tencent, 7.65.1339.827]
[C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e\MFC80U.DLL] [Microsoft Corporation, 8.00.50727.4053]
[D:\Program Files\Tencent\QQMusic\QQMusicWidget_MFC.dll] [Tencent, 7.65.1339.827]
[D:\Program Files\Tencent\QQMusic\ExceptCatch.dll] [Tencent, 7.65.1339.827]
[C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c\MFC80CHS.DLL] [Microsoft Corporation, 8.00.50727.4053]
[D:\Program Files\Tencent\QQMusic\QQMusicResource.dll] [Tencent, 7.65.1339.827]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[C:\Program Files\Common Files\Kingsoft\kiscommon\DetectDllHijack.dll] [Kingsoft Corporation, 2010,08,30,159]
[C:\Program Files\Kingsoft\KSafe\ksfmon.dll] [Kingsoft Corporation., 2.0.1.1199]
[C:\Program Files\Kingsoft\KSafe\kwsui.dll] [Kingsoft Corporation., 2010.10.29.1125]
[C:\Program Files\Kingsoft\KSafe\kswebshield.dll] [Kingsoft Corporation, 2010.11.20.1037]
[D:\Program Files\Tencent\QQMusic\QQMusicApi.dll] [Tencent, 7.65.1339.827]
[C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_473666fd\ATL80.DLL] [Microsoft Corporation, 8.00.50727.4053]
[D:\Program Files\Tencent\QQMusic\QQMusic_Protocol.dll] [Tencent, 7.65.1339.827]
[D:\Program Files\Tencent\QQMusic\QQMusic_SkinMgr.dll] [Tencent, 7.65.1339.827]
[D:\Program Files\Tencent\QQMusic\QQMusic_Shell.dll] [Tencent, 7.65.1339.827]
[D:\Program Files\Tencent\QQMusic\QQMusic_Player.dll] [Tencent, 7.65.1339.827]
[D:\Program Files\Tencent\QQMusic\QQMusicSkin2.dll] [Tencent, 7.65.1339.827]
[D:\Program Files\Tencent\QQMusic\QQMusic_List.dll] [Tencent, 7.65.1339.827]
[D:\Program Files\Tencent\QQMusic\QMDataBaseMgr.dll] [Tencent, 7.65.1339.827]
[D:\Program Files\Tencent\QQMusic\VBScript.dll] [Microsoft Corporation, 5.6.0.7426]
[D:\Program Files\Tencent\QQMusic\QQMusic_Lyric.dll] [Tencent, 7.65.1339.827]
[D:\Program Files\Tencent\QQMusic\QQMusic_QMPMgr.dll] [Tencent, 7.65.1339.827]
[D:\Program Files\Tencent\QQMusic\QQMusic_Portal.dll] [Tencent, 7.65.1339.827]
[D:\Program Files\Tencent\QQMusic\QQMusic_MobileDevice.dll] [Tencent, 7.65.1339.827]
[D:\Program Files\Tencent\QQMusic\QQMusic_Login.dll] [Tencent, 7.65.1339.827]
[D:\Program Files\Tencent\QQMusic\QQMusic_Network.dll] [Tencent, 7.65.1339.827]
[D:\Program Files\Tencent\QQMusic\QQMusicPlayer.dll] [Tencent, 8, 0, 3, 505]
[D:\Program Files\Tencent\QQMusic\QQMediaPlayer.dll] [Tencent, 8, 0, 2, 1223]
[D:\Program Files\Tencent\QQMusic\msdmo.dll] [, ]
[D:\Program Files\Tencent\QQMusic\QQMusic_Tips.dll] [Tencent, 7.65.1339.827]
[D:\Program Files\Tencent\QQMusic\QQMusic_Upgrade.dll] [Tencent, 7.65.1339.827]
[D:\Program Files\Tencent\QQ\Bin\TXPFProxy.dll] [Tencent, 1, 40, 1390, 0]
[D:\Program Files\Tencent\QQMusic\p2papp.dll] [Tencent, 5.3.2110.188]
[D:\Program Files\Tencent\QQMusic\p2papi.dll] [Tencent, 5.3.2110.188]
[D:\Program Files\Tencent\QQMusic\p2pdata.dll] [Tencent, 5.3.2110.188]
[D:\Program Files\Tencent\QQMusic\p2phttp.dll] [Tencent, 5.3.2110.188]
[D:\Program Files\Tencent\QQMusic\p2pcore.dll] [Tencent, 5.3.2110.188]
[D:\Program Files\Tencent\QQMusic\tnproxy.dll] [Tencent Technology(Shenzhen) Company Limited, 2, 1, 101, 90]
[PID: 2172 / Administrator][D:\SREngLdr.EXE] [Smallfrogs Studio, 2.8.2.1321]
[PID: 2384 / Administrator][D:\SREeb646aea.EXE] [Smallfrogs Studio, 2.8.2.1321]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
[C:\Program Files\Common Files\Kingsoft\kiscommon\DetectDllHijack.dll] [Kingsoft Corporation, 2010,08,30,159]
[C:\Program Files\Kingsoft\KSafe\ksfmon.dll] [Kingsoft Corporation., 2.0.1.1199]
[C:\Program Files\Kingsoft\KSafe\kwsui.dll] [Kingsoft Corporation., 2010.10.29.1125]
[C:\Program Files\Kingsoft\KSafe\kswebshield.dll] [Kingsoft Corporation, 2010.11.20.1037]
==================================
文件关联
.TXT Error. [C:\WINDOWS\notepad.exe %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM Error. ["hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1 localhost
::1 localhost
==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 684, C:\WINDOWS\SYSTEM32\WINLOGON.EXE]
==================================
计划任务
N/A
==================================
Windows 安全更新检查
Microsoft .NET Framework 版本 1.1，简体中文版
KB829019, Microsoft .NET Framework 2.0 语言包：x86 (KB829019)
KB907417, Office 2003 更新 (KB907417)
KB943973, Microsoft Works Suite 2005 安全更新 (KB943973) MS08-011
KB925850, Windows Media Player 11
KB940157, 用于 Windows XP 的 Windows 搜索 4.0 (KB940157)
KB921598, Microsoft Office 2003 安全更新 (KB921598) MS08-044
KB955439, Access Snapshot Viewer 2003 安全更新 (KB955439) MS08-041
KB949810, Office 正版增值计划通知 (KB949810)-CHS
KB951535, Microsoft Office 2003 安全更新 (KB951535) MS08-069
KB973923, Microsoft Visual C++ 2005 Service Pack 1 Redistributable Package 的安全更新 (KB973923) MS09-035
KB973924, Microsoft Visual C++ 2008 Redistributable Package 的安全更新 (KB973924) MS09-035
KB956744, Windows XP 安全更新程序 (KB956744) MS09-044
KB973507, Windows XP 安全更新程序 (KB973507) MS09-037
KB947319, Microsoft Office Web Components 安全更新 (KB947319) MS09-043
KB975467, Windows XP 安全更新程序 (KB975467) MS09-059
KB954155, 用于 Windows XP SP 3 的 Windows Media Format Runtime 9、9.5 和 11 的安全更新程序 (KB954155) MS09-051
KB974571, Windows XP 安全更新程序 (KB974571) MS09-056
KB974554, Microsoft Office 2003 安全更新 (KB974554) MS09-060
KB972580, Microsoft Office 2003 安全更新 (KB972580) MS09-062
KB951847, Microsoft .NET Framework 3.5 Service Pack 1 和用于 .NET 版本 2.0 至 3.5 的 .NET Framework 3.5 Family Update (KB951847) x86
KB970430, Windows XP 更新程序 (KB970430)
KB971737, Windows XP 更新程序 (KB971737)
KB955759, Windows XP 更新程序 (KB955759)
KB978551, Microsoft Office 2003 更新 (KB978551)
KB973685, Microsoft XML Core Services 4.0 Service Pack 3 更新程序 (KB973685)
KB971513, Windows XP 更新程序 (KB971513)
KB979099, 用于 Windows XP 的 Rights Management Services 客户端 Service Pack 2 (KB979099)
KB978695, 用于 Windows XP SP3 的 Windows Media Format Runtime 9、9.5 和 11 的安全更新程序 (KB978695) MS10-033
KB980923, Microsoft Office InfoPath 2003 安全更新 (KB980923) MS10-039
KB982122, Microsoft Office Publisher 2003 安全更新 (KB982122) MS10-036
KB980373, Microsoft Office Outlook 2003 安全更新 (KB980373) MS10-045
KB981716, Microsoft Office Access 2003 帮助更新 (KB981716) MS10-044
KB980436, Windows XP 安全更新程序 (KB980436) MS10-049
KB2293428, Microsoft Office Outlook 2003 安全更新 (KB2293428) MS10-064
KB2416427, Microsoft Silverlight 更新 (KB2416427)
KB931125, 根证书更新 [2010 年 10 月] (KB931125)
KB2435682, Outlook 2003 垃圾邮件筛选器更新 (KB2435682)
KB890830, Windows 恶意软件删除工具 - 2010 年 11 月 (KB890830)
KB982670, 用于 Windows XP x86 的 Microsoft .NET Framework 4 Client Profile (KB982670)
KB2449674, Bing 工具栏 6.0 (KB2449674)
==================================
API HOOK
入口点错误：LoadLibraryExW (危险等级: 高, 被下面模块所HOOK: 0x014702F1)
入口点错误：CreateProcessA (危险等级: 高, 被下面模块所HOOK: 0x012F02F1)
入口点错误：CreateProcessW (危险等级: 高, 被下面模块所HOOK: 0x014402F1)
==================================
隐藏进程
N/A

瑞星卡卡安全论坛