[CODE]

2007-07-11,14:07:32

System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件
    进程特权扫描


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
    <USBautoinput><D:\Program Files\汇信软件\USBautoinput.exe>  [浙江汇信科技]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <MemEmpty><D:\Program Files\MemEmpty\MemEmpty.exe /h>  [www.jpexe.com]
    <InterBaseGuardian><C:\RCI\bin\ibguard.exe -a>  [Inprise Corporation]
    <LClock><C:\Program Files\LClock\LClock.exe>  []
    <ShStatEXE><"C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE>  [McAfee, Inc.]
    <McAfeeUpdaterUI><"C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey>  [Network Associates, Inc.]
    <Network Associates Error Reporting Service><"C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe">  [Network Associates, Inc.]
    <KernelFaultCheck><%systemroot%\system32\dumprep 0 -k>  [N/A]
    <Windows木马防火墙><C:\ftc\Trojanwall.exe>  [风云谷]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><vistaui.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{F3D0D422-CE6D-47B3-9CE6-C54DD63F1ADB}><C:\Program files\Internet Explorer\PLUGINS\new123.sys>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
    <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
    <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
    <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
    <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
    <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
    <Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
    <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
    <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <KernelFaultCheck><; %systemroot%\system32\dumprep 0 -k>  [N/A]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <updateMgr><; "D:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1>  [N/A]

==================================
启动文件夹
[EPSON Status Monitor 3 Environment Check(2)]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\EPSON Status Monitor 3 Environment Check(2).lnk --> C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [SEIKO EPSON CORPORATION]><N>

==================================
服务
[ATI / ATI][Stopped/Auto Start]
  <C:\WINDOWS\ATI><N/A>
[C-DillaCdaC11BA / C-DillaCdaC11BA][Running/Auto Start]
  <C:\WINDOWS\system32\drivers\CDAC11BA.EXE><Macrovision>
[EPSON Printer Status Agent2 / EPSONStatusAgent2][Running/Auto Start]
  <C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe><SEIKO EPSON CORPORATION>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[McAfee Framework 服务 / McAfeeFramework][Running/Auto Start]
  <C:\Program Files\Network Associates\Common Framework\FrameworkService.exe /ServiceStart><Network Associates, Inc.>
[Network Associates McShield / McShield][Running/Auto Start]
  <"C:\Program Files\Network Associates\VirusScan\Mcshield.exe"><McAfee, Inc.>
[Network Associates Task Manager / McTaskManager][Running/Auto Start]
  <"C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe"><Network Associates, Inc.>
[O&O Defrag / O&O Defrag][Running/Auto Start]
  <D:\Program Files\OO Software\oodag.exe><O&O Software GmbH>
[Remote Packet Capture Protocol v.0 (experimental) / rpcapd][Stopped/Manual Start]
  <"C:\Program Files\WinPcap\rpcapd.exe" -d -f "C:\Program Files\WinPcap\rpcapd.ini"><N/A>
[Telephonyl / Windowsail][Stopped/Auto Start]
  <C:\WINDOWS\system32\serwinl.exe><N/A>

==================================
驱动程序
[AliIde / AliIde][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\aliide.sys><N/A>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
  <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[bootdrv / bootdrv][Stopped/Boot Start]
  <\SystemRoot\System32\Drivers\bootdrv.sys><N/A>
[CdaC15BA / CdaC15BA][Running/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\CDAC15BA.SYS><Macrovision Europe Ltd>
[CmdIde / CmdIde][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\cmdide.sys><CMD Technology, Inc.>
[CMNERRS / CMNERRS][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\CMNERRS.sys><N/A>
[CMNWARNS / CMNWARNS][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\CMNWARNS.sys><N/A>
[C-Media WDM Audio Interface / cmuda][Running/Manual Start]
  <system32\drivers\cmuda.sys><C-Media Inc>
[ialm / ialm][Running/Manual Start]
  <system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[InterDrv / InterDrv][Running/Manual Start]
  <System32\DRIVERS\InterDrv.sys><N/A>
[MegaIDE / MegaIDE][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\MegaIDE.sys><LSI Logic Corporation.>
[NaiAvFilter1 / NaiAvFilter1][Running/Manual Start]
  <system32\drivers\naiavf5x.sys><McAfee Inc.>
[NaiAvTdi1 / NaiAvTdi1][Running/System Start]
  <system32\drivers\mvstdi5x.sys><McAfee Inc.>
[NetGroup Packet Filter Driver / NPF][Running/Manual Start]
  <system32\drivers\npf.sys><Politecnico di Torino>
[npkcrypt / npkcrypt][Running/Auto Start]
  <\??\d:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[nv / nv][Stopped/Manual Start]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Padus ASPI Shell / pfc][Running/Manual Start]
  <system32\drivers\pfc.sys><Padus, Inc.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[SKNFW / SKNFW][Running/System Start]
  <\??\C:\WINDOWS\system32\Drivers\SKNFW.sys><N/A>
[SkyProcs / SkyProcs][Stopped/Manual Start]
  <\??\D:\PROGRA~1\SkyNet\FireWall\SkyProcs.sys><N/A>
[snavfd2k / snavfd2k][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\snavfd2k.sys><N/A>
[SSIKRNL / SSIKRNL][Stopped/Manual Start]
  <\??\d:\Program Files\DFVSX\net\SSIKRNL.sys><N/A>
[ViaIde / ViaIde][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\viaide.sys><Microsoft Corporation>
[WatchKey / WatchKey][Running/Manual Start]
  <System32\Drivers\wdkey.sys><Beijing WatchData System Co., Ltd.>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
  <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[Intel(R) Graphics Platform (SoftBIOS) Driver / {6080A529-897E-4629-A488-ABA0C29B635E}][Running/System Start]
  <system32\drivers\ialmsbw.sys><Intel Corporation>
[Intel(R) Graphics Chipset (KCH) Driver / {D31A0762-0CEB-444e-ACFF-B049A1F6FE91}][Running/Manual Start]
  <system32\drivers\ialmkchw.sys><Intel Corporation>
[EntDrv51 / EntDrv51][Running/Manual Start]
  <\??\C:\WINDOWS\system32\drivers\EntDrv51.sys><McAfee, Inc>
[p2pfilter / p2pfilter][Running/Manual Start]
  <\??\D:\Program Files\NetSoft\P2POver\p2pfilter.sys><N/A>

==================================
浏览器加载项
N/A

==================================

正在运行的进程
[PID: 512 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 576 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 600 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
    [C:\WINDOWS\system32\igfxsrvc.dll]  [Intel Corporation, 3,0,0,2104]
    [C:\WINDOWS\system32\hccutils.DLL]  [Intel Corporation, 3,0,0,2104]
[PID: 644 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\EntApi.dll]  [McAfee, Inc, 8.0.0.453]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 656 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\EntApi.dll]  [McAfee, Inc, 8.0.0.453]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 812 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\EntApi.dll]  [McAfee, Inc, 8.0.0.453]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 876 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\EntApi.dll]  [McAfee, Inc, 8.0.0.453]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 936 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\EntApi.dll]  [McAfee, Inc, 8.0.0.453]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 988 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\EntApi.dll]  [McAfee, Inc, 8.0.0.453]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 1020 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\EntApi.dll]  [McAfee, Inc, 8.0.0.453]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 1212 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
    [C:\WINDOWS\system32\EBPMON2.DLL]  [SEIKO EPSON CORPORATION, 2, 16, 0, 0]
    [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll]  [Windows (R) 2000 DDK provider, 5.00.2195.1620]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
    [C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\SDNT5UI.DLL]  [Zenographics, Inc., 5.60.709.0]
    [C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\SDDM32.DLL]  [Zenographics, Inc., 5, 60, 1511, 0]
    [C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\ZSPOOL.dll]  [Zenographics, Inc., 5, 51, 709, 0]
    [C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\ZGDI32.dll]  [Zenographics, Inc., 5, 60, 709, 0]
    [C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\ZTAG32.dll]  [Zenographics, Inc., 5, 60, 1210, 0]
    [C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\SDDMUI.DLL]  [Zenographics, Inc., 5, 60, 1520, 0]
    [C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\SR32.dll]  [Zenographics, Inc., 5, 60, 1407, 0]
    [C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_DU15DE.DLL]  [SEIKO EPSON Corporation, 0.3.0.1]
    [C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_DMAI13.DLL]  [SEIKO EPSON Corporation, 0. 3. 0. 5]
[PID: 1368 / SYSTEM][C:\WINDOWS\system32\drivers\CDAC11BA.EXE]  [Macrovision, 4.20.020]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 1416 / SYSTEM][C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe]  [SEIKO EPSON CORPORATION, 2, 1, 0, 0]
    [C:\WINDOWS\system32\EBAPI2.DLL]  [SEIKO EPSON CORPORATION, 1, 3, 0, 0]
    [C:\Program Files\Common Files\EPSON\EBAPI\EBPLPT.DLL]  [SEIKO EPSON CORPORATION, 2, 16, 0, 0]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 1496 / SYSTEM][C:\Program Files\Network Associates\Common Framework\FrameworkService.exe]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\nailog.dll]  [Network Associates, Inc., 3.5.0.474]
    [C:\Program Files\Network Associates\Common Framework\naXML.dll]  [Network Associates, Inc., 3.5.0.474]
    [C:\Program Files\Network Associates\Common Framework\naCmnLib.dll]  [Network Associates, Inc., 3.5.0.474]
    [C:\Program Files\Network Associates\Common Framework\applib.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\0804\AgentRes.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\Logging.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\InternetManager.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\naInet.dll]  [Network Associates, Inc., 3.5.0.474]
    [C:\Program Files\Network Associates\Common Framework\UserSpace.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\SecureFrameworkFactory.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\Management.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\cmalib.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\naPolicyManager.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\PsApi.dll]  [Microsoft Corporation, 4.00]
    [C:\Program Files\Network Associates\Common Framework\ScriptSubSys.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\UpdateSubSys.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\Scheduler.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\TCSubSys.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\WINDOWS\system32\EntApi.dll]  [McAfee, Inc, 8.0.0.453]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 1532 / SYSTEM][C:\Program Files\Network Associates\VirusScan\Mcshield.exe]  [McAfee, Inc., 8.0.0.336]
    [C:\Program Files\Network Associates\VirusScan\Res04\McShield.DLL]  [Network Associates, Inc., 8.0.0.251]
    [C:\Program Files\Network Associates\VirusScan\FTL.Dll]  [Network Associates, Inc., 8.0.0.135]
    [C:\Program Files\Network Associates\VirusScan\naiann.dll]  [Network Associates, Inc., 8.0.0.308]
    [C:\Program Files\Network Associates\VirusScan\mytilus.dll]  [McAfee, Inc., 8.0.0.337]
    [C:\Program Files\Network Associates\Common Framework\GenEvtInf.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\VirusScan\NaEventU.DLL]  [Network Associates, Inc., 8.0.0.356]
    [C:\Program Files\Network Associates\VirusScan\Res04\naEvtRes.dll]  [Network Associates, Inc., 8.0.0.342]
    [C:\Program Files\Network Associates\VirusScan\VSIDSvr.dll]  [Network Associates, Inc., 8.0.0.291]
    [C:\Program Files\Common Files\Network Associates\Engine\MCSCAN32.DLL]  [McAfee, Inc., 5.1.00]
    [C:\Program Files\Network Associates\Common Framework\SecureFrameworkFactory.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\VirusScan\EntSrv.Dll]  [McAfee, Inc, 8.0.0.453]
    [C:\WINDOWS\system32\msxml4.dll]  [Microsoft Corporation, 4.20.9818.0]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 1536 / SYSTEM][C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe]  [Network Associates, Inc., 3.5.0.412]
    [C:\PROGRA~1\NETWOR~1\COMMON~1\nailog.dll]  [Network Associates, Inc., 3.5.0.474]
    [C:\PROGRA~1\NETWOR~1\COMMON~1\naCmnLib.dll]  [Network Associates, Inc., 3.5.0.474]
    [C:\PROGRA~1\NETWOR~1\COMMON~1\naXML.dll]  [Network Associates, Inc., 3.5.0.474]
    [C:\PROGRA~1\NETWOR~1\COMMON~1\0804\AgentRes.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\VirusScan\VsPlugin.dll]  [McAfee, Inc., 8.0.0.1039]
    [C:\WINDOWS\system32\EntApi.dll]  [McAfee, Inc, 8.0.0.453]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 1588 / SYSTEM][C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe]  [Network Associates, Inc., 8.0.0.1004]
    [C:\Program Files\Network Associates\VirusScan\SHUTIL.dll]  [McAfee, Inc., 8.0.0.1036]
    [C:\Program Files\Network Associates\VirusScan\naiwmain.dll]  [Network Associates, Inc., 8.0.0.912]
    [C:\Program Files\Network Associates\VirusScan\naicondl.dll]  [Network Associates, Inc., 8.0.0.912]
    [C:\Program Files\Network Associates\VirusScan\RES04\VsTskMgr.dll]  [Network Associates, Inc., 8.0.0.912]
    [C:\Program Files\Network Associates\VirusScan\MIDUtil.Dll]  [McAfee, Inc., 8.0.0.155]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 1772 / SYSTEM][D:\Program Files\OO Software\oodag.exe]  [O&O Software GmbH, 8.0.1398]
    [D:\Program Files\OO Software\OODAGRS.DLL]  [O&O Software GmbH, 8.0.1.1347]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 1844 / zhangxg][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\AcSignIcon.dll]  [Autodesk, 16.0.0.86]
    [C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll]  [Autodesk, 16.0.0.86]
    [C:\Program Files\LClock\LC.dll]  [N/A, ]
    [C:\WINDOWS\system32\EntApi.dll]  [McAfee, Inc, 8.0.0.453]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\igfxpph.dll]  [Intel Corporation, 3,0,0,2104]
    [C:\WINDOWS\system32\hccutils.DLL]  [Intel Corporation, 3,0,0,2104]
    [C:\WINDOWS\system32\igfxres.dll]  [Intel Corporation, 3,0,0,2104]
    [C:\WINDOWS\system32\igfxsrvc.dll]  [Intel Corporation, 3,0,0,2104]
  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 3900 / zhangxg][D:\Program Files\NetSoft\P2POver\P2POver.exe]  [, 2, 0, 0, 5]
    [C:\WINDOWS\system32\wpcap.dll]  [Politecnico di Torino, 3, 0, 0, 18]
    [C:\WINDOWS\system32\pthreadVC.dll]  [N/A, ]
    [C:\WINDOWS\system32\packet.dll]  [Politecnico di Torino, 3, 0, 0, 18]
    [D:\Program Files\NetSoft\P2POver\DBdll.dll]  [, 1, 0, 0, 1]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]

[C:\WINDOWS\system32\igfxdev.dll]  [Intel Corporation, 3,0,0,2104]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
    [C:\Program Files\Unlocker\UnlockerCOM.dll]  [N/A, ]
    [d:\Program Files\WinRAR\rarext.dll]  [N/A, ]
    [C:\Program Files\Network Associates\VirusScan\shext.dll]  [Network Associates, Inc., 8.0.0.912]
    [C:\Program Files\Network Associates\VirusScan\RES04\ShExtRes.dll]  [Network Associates, Inc., 8.0.0.912]
    [C:\WINDOWS\system32\icm32.dll]  [Microsoft Corporation, 5.1.2600.2709 (xpsp_sp2_gdr.050628-1518)]
    [C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_DU15DE.DLL]  [SEIKO EPSON Corporation, 0.3.0.1]
    [C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_DMAI13.DLL]  [SEIKO EPSON Corporation, 0. 3. 0. 5]
    [C:\WINDOWS\system32\msdmo.dll]  [, ]
    [C:\WINDOWS\system32\PYJJU.IME]  [北京六合源软件技术有限公司, 2, 2, 0, 4]
    [C:\WINDOWS\system32\WINWB86.IME]  [Microsoft Corporation, 4.00.950]
[PID: 1900 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\EntApi.dll]  [McAfee, Inc, 8.0.0.453]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 1944 / SYSTEM][C:\WINDOWS\system32\tlntsvr.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 252 / LOCAL SERVICE][C:\WINDOWS\system32\wdfmgr.exe]  [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 552 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\EntApi.dll]  [McAfee, Inc, 8.0.0.453]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 660 / zhangxg][D:\Program Files\MemEmpty\MemEmpty.exe]  [www.jpexe.com, 1.20]
    [C:\WINDOWS\system32\MSVBVM60.DLL]  [Microsoft Corporation, 6.00.9782]
    [C:\WINDOWS\system32\vb6chs.dll]  [Microsoft Corporation, 6.00.8169]
    [C:\WINDOWS\system32\comctl32.ocx]  [Microsoft Corporation, 6.00.8105]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 768 / zhangxg][C:\RCI\bin\ibguard.exe]  [Inprise Corporation, WI-V6.0.1.0]
    [C:\WINDOWS\gds32.dll]  [Inprise Corporation, WI-V6.0.1.0]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 824 / zhangxg][C:\Program Files\LClock\LClock.exe]  [, 1, 0, 0, 1]
    [C:\Program Files\LClock\LC.dll]  [N/A, ]
    [C:\Program Files\LClock\Calendar.dll]  [N/A, ]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 704 / zhangxg][C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE]  [McAfee, Inc., 8.0.0.1040]
    [C:\Program Files\Network Associates\VirusScan\SHUTIL.dll]  [McAfee, Inc., 8.0.0.1036]
    [C:\Program Files\Network Associates\VirusScan\naiwmain.dll]  [Network Associates, Inc., 8.0.0.912]
    [C:\Program Files\Network Associates\VirusScan\RES04\shstat.dll]  [Network Associates, Inc., 8.0.0.912]
    [C:\Program Files\Network Associates\VirusScan\RES04\Product.dll]  [Network Associates, Inc., 8.0.0.912]
    [C:\Program Files\Network Associates\VirusScan\RES04\McShield.dll]  [Network Associates, Inc., 8.0.0.251]
    [C:\Program Files\Network Associates\VirusScan\RES04\Shutilrc.dll]  [Network Associates, Inc., 8.0.0.912]
    [C:\Program Files\Network Associates\VirusScan\Graphics.dll]  [Network Associates, Inc., 8.0.0.912]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 920 / zhangxg][C:\RCI\bin\ibserver.exe]  [Inprise Corporation, WI-V6.0.1.0]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 924 / zhangxg][C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\nailog.dll]  [Network Associates, Inc., 3.5.0.474]
    [C:\Program Files\Network Associates\Common Framework\naCmnLib.dll]  [Network Associates, Inc., 3.5.0.474]
    [C:\Program Files\Network Associates\Common Framework\naXML.dll]  [Network Associates, Inc., 3.5.0.474]
    [C:\Program Files\Network Associates\Common Framework\0804\UpdRes.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\0804\AgentRes.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\SecureFrameworkFactory.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 960 / zhangxg][C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe]  [Network Associates, Inc., 2.0.275.0]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 1112 / zhangxg][C:\ftc\Trojanwall.exe]  [风云谷, 5.9.0.2183]
    [C:\ftc\ftcapi.dll]  [fygsoft, 1.1.0.0]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\AcSignIcon.dll]  [Autodesk, 16.0.0.86]
    [C:\WINDOWS\system32\Audiodev.dll]  [Microsoft Corporation, 5.2.3802.3802 built by: dnsrv(bld4act)]
    [C:\Program Files\MSN Messenger\fsshext.8.0.0812.00.dll]  [Microsoft Corporation, 8.0.0812.00]
    [C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll]  [Autodesk, 16.0.0.86]
[PID: 1044 / zhangxg][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 2300 / zhangxg][D:\Program Files\汇信软件\USBautoinput.exe]  [浙江汇信科技, 1.0.0.4]
    [D:\Program Files\汇信软件\kpidataman.dll]  [上海格尔软件股份有限公司, 1, 0, 0, 1]
    [D:\Program Files\汇信软件\kpsdk20.dll]  [koal, 2, 1, 6, 3]
    [C:\WINDOWS\system32\kpidevice.dll]  [上海格尔软件股份有限公司, 1, 0, 0, 1]
    [d:\Program Files\汇信软件\ssl.dll]  [H, 2, 1, 3, 8]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 2328 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]

[PID: 3452 / zhangxg][D:\Program Files\Tencent\QQ\QQ.exe]  [TENCENT, 0, 0, 0, 0]
    [D:\Program Files\Tencent\QQ\QQBaseClassInDll.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\QQHelperDll.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\BasicCtrlDll.dll]  [Tencent, 7, 0, 101, 80]
    [D:\Program Files\Tencent\QQ\MFC42.DLL]  [Microsoft Corporation, 6.00.8665.0]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
    [D:\Program Files\Tencent\QQ\RICHED32.DLL]  [Microsoft Corporation, 5.00.2134.1]
    [D:\Program Files\Tencent\QQ\RICHED20.dll]  [Microsoft Corporation, 5.31.23.1218]
    [D:\Program Files\Tencent\QQ\QQAPI.dll]  [, 1, 0, 0, 1]
    [d:\Program Files\Tencent\QQ\TIMProxy.dll]  [tencent, 0, 3, 2, 4]
    [D:\Program Files\Tencent\QQ\LoginCtrl.dll]  [N/A, ]
    [D:\Program Files\Tencent\QQ\LoginCtrlRes.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\QQRes.dll]  [tencent, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\WizardCtrl.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\QQMainFrame.dll]  [N/A, ]
    [C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx]  [Macromedia, Inc., 8,0,22,0]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\Program Files\Tencent\QQ\CQQApplication.dll]  [N/A, ]
    [D:\Program Files\Tencent\QQ\NewSkin.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\HostingMgr.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\CameraDll.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\MailSummary.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\QQKnowledgeSearch.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\QQAllInOne.dll]  [N/A, ]
    [D:\Program Files\Tencent\QQ\GroupLive.dll]  [N/A, ]
    [D:\Program Files\Tencent\QQ\SCCore.dll]  [TENCENT, 2, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\gdiplus.dll]  [Microsoft Corporation, 5.1.3102.2180 (xpsp_sp2_rtm.040803-2158)]
    [D:\Program Files\Tencent\QQ\QQSpace.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\vbscript.dll]  [Microsoft Corporation, 5.6.0.7426]
    [C:\WINDOWS\system32\msdmo.dll]  [, ]
    [D:\Program Files\Tencent\QQ\QQGroupMng.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\UserDefinedHead.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\QQPlugin.dll]  [N/A, ]
    [D:\Program Files\Tencent\QQ\QQConfigPlugin.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\QRingMng.dll]  [N/A, ]
    [D:\Program Files\Tencent\QQ\LongConnection.dll]  [tencent, 5, 0, 200, 160]
    [D:\Program Files\Tencent\QQ\QQPet.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\QQAvatar.dll]  [N/A, ]
    [D:\Program Files\Tencent\QQ\FlashAvatarDll.dll]  [, 1, 4, 0, 1]
    [D:\Program Files\Tencent\QQ\PhoneAPI.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\DialerAllinOne.dll]  [tencent, 1, 4, 0, 0]
    [D:\Program Files\Tencent\QQ\QQCustomFace.dll]  [N/A, ]
    [D:\Program Files\Tencent\QQ\ImageOle.dll]  [TODO: <Company name>, 1.0.0.1]
    [D:\Program Files\Tencent\QQ\QQSceneMng.dll]  [N/A, ]
    [D:\Program Files\Tencent\QQ\QQAddr.dll]  [深圳市腾讯计算机系统有限公司, 5, 0, 101, 280]
    [D:\Program Files\Tencent\QQ\npkcntc.dll]  [INCA Internet Co., Ltd., 2006, 6, 27, 1]
    [D:\Program Files\Tencent\QQ\npkpdb.dll]  [INCA Internet Co., Ltd., 2003, 10, 1, 1]
    [D:\Program Files\Tencent\QQ\BQQApplication.dll]  [N/A, ]
    [C:\WINDOWS\system32\PYJJU.IME]  [北京六合源软件技术有限公司, 2, 2, 0, 4]
    [C:\WINDOWS\system32\WINWB86.IME]  [Microsoft Corporation, 4.00.950]
    [D:\Program Files\Tencent\QQ\CommercesMng.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\PersonalDesktop.dll]  [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2]
    [D:\Program Files\Tencent\QQ\QQFileTransfer.dll]  [Tencent, 0, 3, 3, 5]
    [D:\Program Files\Tencent\QQ\GroupConnection.dll]  [Tencent, 0, 3, 3, 5]
    [D:\Program Files\Tencent\QQ\QQPhoneHelper.dll]  [腾讯科技（深圳）有限公司, 2, 1, 9, 93]
    [D:\Program Files\Tencent\QQ\QQSysMsgMng.dll]  [N/A, ]
    [D:\Program Files\Tencent\QQ\QQZip.dll]  [tencent, 0, 3, 2, 4]
    [D:\Program Files\Tencent\QQ\QQMagicFace.dll]  [, 1, 0, 0, 1]
    [C:\WINDOWS\system32\AcSignIcon.dll]  [Autodesk, 16.0.0.86]
    [C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll]  [Autodesk, 16.0.0.86]
    [C:\Program Files\Network Associates\VirusScan\scriptproxy.dll]  [Network Associates, Inc., 8.0.0.1012]
    [C:\Program Files\Network Associates\VirusScan\mytilus.dll]  [McAfee, Inc., 8.0.0.337]
    [C:\Program Files\Network Associates\VirusScan\Res04\McShield.dll]  [Network Associates, Inc., 8.0.0.251]
    [C:\Program Files\Common Files\Network Associates\Engine\mcscan32.dll]  [McAfee, Inc., 5.1.00]
[PID: 2160 / zhangxg][d:\Program Files\Tencent\QQ\TIMPlatform.exe]  [tencent, 0, 3, 1, 8]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
    [d:\Program Files\Tencent\QQ\TIMProxy.dll]  [tencent, 0, 3, 2, 4]
[PID: 2672 / zhangxg][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 3468 / zhangxg][D:\Program Files\博览 Brexpo\BrexpoDisposal.exe]  [N/A, ]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 2720 / zhangxg][D:\Program Files\博览 Brexpo\Brexpo.exe]  [N/A, ]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\AcSignIcon.dll]  [Autodesk, 16.0.0.86]
    [D:\Program Files\Microsoft Office\Office10\msohev.dll]  [Microsoft Corporation, 10.0.2609]
    [C:\Program Files\Common Files\Microsoft Shared\Ink\PENCHS.DLL]  [Microsoft Corporation, 1.0.1038.0]
    [C:\Program Files\Network Associates\VirusScan\scriptproxy.dll]  [Network Associates, Inc., 8.0.0.1012]
    [C:\Program Files\Network Associates\VirusScan\mytilus.dll]  [McAfee, Inc., 8.0.0.337]
    [C:\Program Files\Network Associates\VirusScan\Res04\McShield.dll]  [Network Associates, Inc., 8.0.0.251]
    [C:\Program Files\Common Files\Network Associates\Engine\mcscan32.dll]  [McAfee, Inc., 5.1.00]
    [C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx]  [Macromedia, Inc., 8,0,22,0]
    [C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll]  [Autodesk, 16.0.0.86]
    [C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL]  [Microsoft Corporation, 11.0.5510]
    [C:\WINDOWS\system32\PYJJU.IME]  [北京六合源软件技术有限公司, 2, 2, 0, 4]
    [C:\WINDOWS\system32\WINWB86.IME]  [Microsoft Corporation, 4.00.950]
[PID: 2788 / zhangxg][D:\Program Files\foundersc\fzjdb\JD\JD.exe]  [上海乾隆高科技有限公司, 5, 68, 0, 0]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
[PID: 4916 / zhangxg][D:\Personal\Desktop\sreng2\11111.EXE]  [Smallfrogs Studio, 2.5.16.900]
    [C:\ftc\Filehook.dll]  [Fygsoft and Microsoft, 2.0.0.0]
    [D:\Personal\Desktop\sreng2\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  Error. ["hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 1368, C:\WINDOWS\SYSTEM32\DRIVERS\CDAC11BA.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 1368, C:\WINDOWS\SYSTEM32\DRIVERS\CDAC11BA.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1416, C:\PROGRAM FILES\COMMON FILES\EPSON\EBAPI\SAGENT2.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 1416, C:\PROGRAM FILES\COMMON FILES\EPSON\EBAPI\SAGENT2.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1496, C:\PROGRAM FILES\NETWORK ASSOCIATES\COMMON FRAMEWORK\FRAMEWORKSERVICE.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 1496, C:\PROGRAM FILES\NETWORK ASSOCIATES\COMMON FRAMEWORK\FRAMEWORKSERVICE.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1532, C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\MCSHIELD.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 1532, C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\MCSHIELD.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1536, C:\PROGRA~1\NETWOR~1\COMMON~1\NAPRDMGR.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 1536, C:\PROGRA~1\NETWOR~1\COMMON~1\NAPRDMGR.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1588, C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\VSTSKMGR.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 1588, C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\VSTSKMGR.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1772, D:\PROGRAM FILES\OO SOFTWARE\OODAG.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 1772, D:\PROGRAM FILES\OO SOFTWARE\OODAG.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 1844, C:\WINDOWS\EXPLORER.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 1844, C:\WINDOWS\EXPLORER.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1844, C:\WINDOWS\EXPLORER.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 660, D:\PROGRAM FILES\MEMEMPTY\MEMEMPTY.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 660, D:\PROGRAM FILES\MEMEMPTY\MEMEMPTY.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 660, D:\PROGRAM FILES\MEMEMPTY\MEMEMPTY.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 768, C:\RCI\BIN\IBGUARD.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 768, C:\RCI\BIN\IBGUARD.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 768, C:\RCI\BIN\IBGUARD.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 824, C:\PROGRAM FILES\LCLOCK\LCLOCK.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 824, C:\PROGRAM FILES\LCLOCK\LCLOCK.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 824, C:\PROGRAM FILES\LCLOCK\LCLOCK.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 704, C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\SHSTAT.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 704, C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\SHSTAT.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 704, C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\SHSTAT.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 920, C:\RCI\BIN\IBSERVER.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 920, C:\RCI\BIN\IBSERVER.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 920, C:\RCI\BIN\IBSERVER.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 924, C:\PROGRAM FILES\NETWORK ASSOCIATES\COMMON FRAMEWORK\UPDATERUI.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 924, C:\PROGRAM FILES\NETWORK ASSOCIATES\COMMON FRAMEWORK\UPDATERUI.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 924, C:\PROGRAM FILES\NETWORK ASSOCIATES\COMMON FRAMEWORK\UPDATERUI.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 960, C:\PROGRAM FILES\COMMON FILES\NETWORK ASSOCIATES\TALKBACK\TBMON.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 960, C:\PROGRAM FILES\COMMON FILES\NETWORK ASSOCIATES\TALKBACK\TBMON.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 960, C:\PROGRAM FILES\COMMON FILES\NETWORK ASSOCIATES\TALKBACK\TBMON.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 1112, C:\FTC\TROJANWALL.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 1112, C:\FTC\TROJANWALL.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1112, C:\FTC\TROJANWALL.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 2300, D:\PROGRAM FILES\汇信软件\USBAUTOINPUT.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 2300, D:\PROGRAM FILES\汇信软件\USBAUTOINPUT.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2300, D:\PROGRAM FILES\汇信软件\USBAUTOINPUT.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 3900, D:\PROGRAM FILES\NETSOFT\P2POVER\P2POVER.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 3900, D:\PROGRAM FILES\NETSOFT\P2POVER\P2POVER.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3900, D:\PROGRAM FILES\NETSOFT\P2POVER\P2POVER.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 3452, D:\PROGRAM FILES\TENCENT\QQ\QQ.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 3452, D:\PROGRAM FILES\TENCENT\QQ\QQ.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3452, D:\PROGRAM FILES\TENCENT\QQ\QQ.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 2160, D:\PROGRAM FILES\TENCENT\QQ\TIMPLATFORM.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 2160, D:\PROGRAM FILES\TENCENT\QQ\TIMPLATFORM.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2160, D:\PROGRAM FILES\TENCENT\QQ\TIMPLATFORM.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 3468, D:\PROGRAM FILES\博览 BREXPO\BREXPODISPOSAL.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 3468, D:\PROGRAM FILES\博览 BREXPO\BREXPODISPOSAL.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3468, D:\PROGRAM FILES\博览 BREXPO\BREXPODISPOSAL.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 2720, D:\PROGRAM FILES\博览 BREXPO\BREXPO.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 2720, D:\PROGRAM FILES\博览 BREXPO\BREXPO.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2720, D:\PROGRAM FILES\博览 BREXPO\BREXPO.EXE]
特殊特权被允许： SeSystemtimePrivilege [PID = 2788, D:\PROGRAM FILES\FOUNDERSC\FZJDB\JD\JD.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 2788, D:\PROGRAM FILES\FOUNDERSC\FZJDB\JD\JD.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2788, D:\PROGRAM FILES\FOUNDERSC\FZJDB\JD\JD.EXE]

==================================
API HOOK
入口点错误：FreeLibrary (危险等级: 高,  被下面模块所HOOK: 0x5F00002D)

==================================
隐藏进程
N/A

==================================


[/CODE]