[C:\WINDOWS\system32\AcSignIcon.dll] [Autodesk, 16.2.54.0]
[C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] [Autodesk, 16.2.54.0]
[C:\Program Files\Media Player Classic\Codecs\mmfinfo.dll] [N/A, ]
[C:\Program Files\Media Player Classic\Codecs\mkunicode.dll] [N/A, ]
[PID: 4084 / Administrator][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\kvmxcma.dll] [N/A, ]
[C:\Program Files\NetMeeting\ravdh3mon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravytmon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravwdmon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravmsmon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravgjmon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravdhmon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravztmon.dat] [N/A, ]
[C:\WINDOWS\system32\ravgjmon.dll] [N/A, ]
[C:\WINDOWS\system32\AcSignIcon.dll] [Autodesk, 16.2.54.0]
[C:\Program Files\Tencent\QQ\QQIEHelper.dll] [深圳市腾讯计算机系统有限公司, 1, 1, 0, 5]
[C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_001.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 1]
[C:\WINDOWS\system32\avwlamn.dll] [N/A, ]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\qiji.dll] [N/A, ]
[C:\WINDOWS\system32\rarjbpi.dll] [N/A, ]
[C:\WINDOWS\system32\kaqhdzy.dll] [N/A, ]
[C:\WINDOWS\system32\Kvsc3.dll] [N/A, ]
[C:\WINDOWS\system32\mscomm.dll] [N/A, ]
[E:\MY程序\瑞星\RX\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx] [Macromedia, Inc., 8,0,24,0]
[C:\WINDOWS\system32\WINWB86.IME] [Microsoft Corporation, 4.00.950]
[C:\WINDOWS\system32\UNISPIM.IME] [北京清华紫光软件股份有限公司, 3.0.0.3045]
[C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] [Autodesk, 16.2.54.0]
[PID: 1012 / Administrator][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\avwlamn.dll] [N/A, ]
[C:\Program Files\NetMeeting\ravdh3mon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravytmon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravwdmon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravmsmon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravgjmon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravdhmon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravztmon.dat] [N/A, ]
[C:\WINDOWS\system32\ravgjmon.dll] [N/A, ]
[C:\WINDOWS\system32\AcSignIcon.dll] [Autodesk, 16.2.54.0]
[C:\Program Files\Tencent\QQ\QQIEHelper.dll] [深圳市腾讯计算机系统有限公司, 1, 1, 0, 5]
[C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_001.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 1]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\system32\kvmxcma.dll] [N/A, ]
[C:\WINDOWS\qiji.dll] [N/A, ]
[C:\WINDOWS\system32\rarjbpi.dll] [N/A, ]
[C:\WINDOWS\system32\kaqhdzy.dll] [N/A, ]
[C:\WINDOWS\system32\Kvsc3.dll] [N/A, ]
[E:\MY程序\瑞星\RX\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\system32\mscomm.dll] [N/A, ]
[C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx] [Macromedia, Inc., 8,0,24,0]
[PID: 3748 / Administrator][C:\Program Files\WinRAR\WinRAR.exe] [N/A, ]
[C:\WINDOWS\system32\kvmxcma.dll] [N/A, ]
[C:\Program Files\NetMeeting\ravdh3mon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravytmon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravwdmon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravmsmon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravgjmon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravdhmon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravztmon.dat] [N/A, ]
[C:\WINDOWS\system32\ravgjmon.dll] [N/A, ]
[C:\WINDOWS\system32\AcSignIcon.dll] [Autodesk, 16.2.54.0]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\system32\avwlamn.dll] [N/A, ]
[C:\WINDOWS\qiji.dll] [N/A, ]
[C:\WINDOWS\system32\rarjbpi.dll] [N/A, ]
[C:\WINDOWS\system32\kaqhdzy.dll] [N/A, ]
[PID: 3284 / Administrator][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.204\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]
[C:\WINDOWS\system32\kaqhdzy.dll] [N/A, ]
[C:\Program Files\NetMeeting\ravdh3mon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravytmon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravwdmon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravmsmon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravgjmon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravdhmon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravztmon.dat] [N/A, ]
[C:\WINDOWS\system32\ravgjmon.dll] [N/A, ]
[C:\WINDOWS\system32\avwlamn.dll] [N/A, ]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[C:\WINDOWS\system32\kvmxcma.dll] [N/A, ]
[C:\WINDOWS\qiji.dll] [N/A, ]
[C:\WINDOWS\system32\rarjbpi.dll] [N/A, ]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.204\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]
[C:\WINDOWS\system32\mscomm.dll] [N/A, ]
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
MSAPI Tcpip [TCP/IP]
C:\WINDOWS\system32\mscomm.dll(, N/A)
MSAPI Tcpip [UDP/IP]
C:\WINDOWS\system32\mscomm.dll(, N/A)
==================================
Autorun.inf
[C:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\打开(&O)\command=setup.exe
[D:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\打开(&O)\command=setup.exe
[E:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\打开(&O)\command=setup.exe
[F:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\打开(&O)\command=setup.exe
==================================
HOSTS 文件
127.0.0.1 localhost
==================================
进程特权扫描
特殊特权被允许： SeDebugPrivilege [PID = 1564, C:\WINDOWS\SYSTEM\LOGOGO.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2628, C:\PROGRAM FILES\RISING\ANTISPYWARE\RUNIEP.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2640, E:\MY程序\瑞星\RX\RISING\RAV\RAVTASK.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2688, E:\MY程序\瑞星\RX\RISING\RAV\RAVMON.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 3656, C:\PROGRAM FILES\RISING\ANTISPYWARE\RAS.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3656, C:\PROGRAM FILES\RISING\ANTISPYWARE\RAS.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3748, C:\PROGRAM FILES\WINRAR\WINRAR.EXE]
==================================
API HOOK
N/A
==================================
隐藏进程
N/A
==================================
[/CODE]
