[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[D:\xunlei\Thunder.v5.7.1.338\Thunder.v5.7.1.338\ComDlls\TDAtOnce_Now.dll] [Thunder Networking Technologies,LTD, 1.0.2.9]
[D:\xunlei\Thunder.v5.7.1.338\Thunder.v5.7.1.338\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 5, 13]
[D:\360weishi\safemon\safemon.dll] [, 3, 4, 0, 1001]
[C:\WINDOWS\system32\ieapfltr.dll] [Microsoft Corporation, 7.0.6000.16461]
[D:\Kaspersky Anti-Virus 6.0\scr_ch_pg.dll] [Kaspersky Lab, 1.0.6.299]
[D:\Kaspersky Anti-Virus 6.0\klscav.dll] [Kaspersky Lab, 6.0.0.299]
[D:\Kaspersky Anti-Virus 6.0\prloader.dll] [Kaspersky Lab, 6.0.0.299]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\Sony Ericsson\Mobile2\File Manager\fmgrgui.dll] [Sony Ericsson Mobile Communications AB, 1, 3, 11, 0]
[C:\WINDOWS\system32\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\Program Files\Sony Ericsson\Mobile2\File Manager\fmgrguil.dll] [Sony Ericsson Mobile Communications AB, 1, 3, 4, 0]
[C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[D:\Kaspersky Anti-Virus 6.0\pr_remote.dll] [Kaspersky Lab, 6.0.0.299]
[D:\Kaspersky Anti-Virus 6.0\prkernel.ppl] [Kaspersky Lab, 6.0.0.304]
[d:\kaspersky anti-virus 6.0\params.ppl] [Kaspersky Lab, 6.0.0.299]
[d:\kaspersky anti-virus 6.0\pxstub.ppl] [Kaspersky Lab, 6.0.0.299]
[d:\kaspersky anti-virus 6.0\tempfile.ppl] [Kaspersky Lab, 6.0.0.299]
[D:\QQ\Tencent\QQ\SCCore.dll] [TENCENT, 2, 0, 0, 1]
[D:\QQ\Tencent\QQ\gdiplus.dll] [Microsoft Corporation, 5.1.3102.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\QQ\Tencent\QQ\QQSpace.dll] [, 1, 0, 0, 1]
[D:\QQ\Tencent\QQ\vbscript.dll] [Microsoft Corporation, 5.6.0.8825]
[C:\WINDOWS\system32\msdmo.dll] [, ]
[D:\QQ\Tencent\QQ\QQGroupMng.dll] [, 1, 0, 0, 1]
[D:\QQ\Tencent\QQ\UserDefinedHead.dll] [, 1, 0, 0, 1]
[D:\QQ\Tencent\QQ\QQPlugin.dll] [N/A, ]
[D:\QQ\Tencent\QQ\QQConfigPlugin.dll] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\ieframe.dll] [Microsoft Corporation, 7.00.6000.16512 (vista_gdr.070625-1522)]
[C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[D:\QQ\Tencent\QQ\QQCustomFace.dll] [N/A, ]
[D:\QQ\Tencent\QQ\QQPet.dll] [, 1, 0, 0, 1]
[D:\QQ\Tencent\QQ\QRingMng.dll] [N/A, ]
[D:\QQ\Tencent\QQ\FlashAvatarDll.dll] [, 1, 4, 0, 1]
[D:\QQ\Tencent\QQ\ImageOle.dll] [TODO: <Company name>, 1.0.0.1]
[D:\QQ\Tencent\QQ\QQMagicFace.dll] [, 1, 0, 0, 1]
[D:\QQ\Tencent\QQ\QQSceneMng.dll] [N/A, ]
[D:\QQ\Tencent\QQ\QQAvatar.dll] [N/A, ]
[D:\QQ\Tencent\QQ\LongConnection.dll] [tencent, 5, 0, 200, 160]
[D:\QQ\Tencent\QQ\GroupConnection.dll] [Tencent, 0, 3, 3, 5]
[D:\Kaspersky Anti-Virus 6.0\scr_ch_pg.dll] [Kaspersky Lab, 1.0.6.299]
[D:\Kaspersky Anti-Virus 6.0\klscav.dll] [Kaspersky Lab, 6.0.0.299]
[D:\QQ\Tencent\QQ\QQZip.dll] [tencent, 0, 3, 2, 4]
[D:\QQ\Tencent\QQ\QQSysMsgMng.dll] [N/A, ]
[D:\Kaspersky Anti-Virus 6.0\prloader.dll] [Kaspersky Lab, 6.0.0.299]
[C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL] [Microsoft Corporation, 11.0.5510]
[D:\QQ\Tencent\QQ\QQSettingCtrl.dll] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\WINABCX.IME] [PKUETI, 5.22.216]
[D:\QQ\Tencent\QQ\CommercesMng.dll] [, 1, 0, 0, 1]
[D:\QQ\Tencent\QQ\PersonalDesktop.dll] [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2]
[D:\QQ\Tencent\QQ\QQAddr.dll] [深圳市腾讯计算机系统有限公司, 5, 0, 101, 280]
[D:\QQ\Tencent\QQ\npkcntc.dll] [INCA Internet Co., Ltd., 2006, 6, 27, 1]
[D:\QQ\Tencent\QQ\npkpdb.dll] [INCA Internet Co., Ltd., 2003, 10, 1, 1]
[D:\QQ\Tencent\QQ\QQPhoneHelper.dll] [腾讯科技(深圳)有限公司, 2, 1, 9, 95]
[D:\Kaspersky Anti-Virus 6.0\pr_remote.dll] [Kaspersky Lab, 6.0.0.299]
[D:\Kaspersky Anti-Virus 6.0\prkernel.ppl] [Kaspersky Lab, 6.0.0.304]
[d:\kaspersky anti-virus 6.0\params.ppl] [Kaspersky Lab, 6.0.0.299]
[d:\kaspersky anti-virus 6.0\pxstub.ppl] [Kaspersky Lab, 6.0.0.299]
[d:\kaspersky anti-virus 6.0\tempfile.ppl] [Kaspersky Lab, 6.0.0.299]
[PID: 3476 / Owner][D:\QQ\Tencent\QQ\TIMPlatform.exe] [tencent, 0, 3, 1, 8]
[D:\QQ\Tencent\QQ\TIMProxy.dll] [tencent, 0, 3, 2, 4]
[PID: 2436 / Owner][D:\QQ\Tencent\QQ\QZone\Qzone.exe] [腾讯公司, 1, 9, 103, 20]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16512 (vista_gdr.070625-1522)]
[D:\QQ\Tencent\QQ\QZone\MFC42.DLL] [Microsoft Corporation, 6.00.8665.0]
[PID: 3196 / Owner][D:\xunlei\Thunder.v5.7.1.338\Thunder.v5.7.1.338\Program\Thunder5.exe] [Thunder Networking Technologies,LTD, 5, 7, 1, 338]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16512 (vista_gdr.070625-1522)]
[D:\xunlei\Thunder.v5.7.1.338\Thunder.v5.7.1.338\Program\ThunderEx.dll] [, 1, 1, 6, 12]
[D:\xunlei\Thunder.v5.7.1.338\Thunder.v5.7.1.338\Program\TaskManager.dll] [Thunder Networking Technologies,LTD, 1, 2, 1, 26]
[D:\xunlei\Thunder.v5.7.1.338\Thunder.v5.7.1.338\Program\download_interface.dll] [Thunder Networking Technologies,LTD, 2, 17, 2, 124]
[D:\xunlei\Thunder.v5.7.1.338\Thunder.v5.7.1.338\Program\stlport_vc646.dll] [STLport Consulting, Inc., 4.6.2003.1031]
[D:\xunlei\Thunder.v5.7.1.338\Thunder.v5.7.1.338\Program\asyn_dns.dll] [Thunder Networking Technologies,LTD, 2, 17, 2, 124]
[D:\xunlei\Thunder.v5.7.1.338\Thunder.v5.7.1.338\Program\BHOStub.dll] [Thunder Networking Technologies,LTD, 1, 1, 0, 8]
[D:\xunlei\Thunder.v5.7.1.338\Thunder.v5.7.1.338\Components\DownAndPlay\DownAndPlay.dll] [, 1, 0, 2, 20]
[D:\xunlei\Thunder.v5.7.1.338\Thunder.v5.7.1.338\Program\iTargetAD.dll] [N/A, ]
[D:\xunlei\Thunder.v5.7.1.338\Thunder.v5.7.1.338\Components\Community\XLCommunity.dll] [Thunder Networking Technologies,LTD, 1, 3, 0, 7]
[D:\xunlei\Thunder.v5.7.1.338\Thunder.v5.7.1.338\Program\RegisterDll.dll] [Thunder Networking Technologies,LTD, 2, 13, 5, 59]
[D:\xunlei\Thunder.v5.7.1.338\Thunder.v5.7.1.338\Program\MSVCIRT.dll] [Microsoft Corporation, 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\ieframe.dll] [Microsoft Corporation, 7.00.6000.16512 (vista_gdr.070625-1522)]
[D:\xunlei\Thunder.v5.7.1.338\Thunder.v5.7.1.338\Components\Security\ThunderSafe.dll] [深圳市迅雷网络技术有限公司, 1, 0, 5, 29]
[D:\xunlei\Thunder.v5.7.1.338\Thunder.v5.7.1.338\Program\XLNet.Dll] [Thunder Networking Technologies,LTD, 1, 2, 1, 9]
[D:\xunlei\Thunder.v5.7.1.338\Thunder.v5.7.1.338\Components\Search\XLSearch.dll] [Thunder Networking Technologies,LTD, 1, 1, 3, 13]
[D:\xunlei\Thunder.v5.7.1.338\Thunder.v5.7.1.338\Components\ExplorerHelper\ExplorerHelper.dll] [Thunder Networking Technologies,LTD, 1, 0, 4, 15]
[D:\xunlei\Thunder.v5.7.1.338\Thunder.v5.7.1.338\Plugins\BhoAdv\bho_adv.dll] [深圳市迅雷网络技术有限公司, 1.0.1.0]
[PID: 2164 / Owner][D:\sreng\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16512 (vista_gdr.070625-1522)]
[D:\sreng\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]
==================================
文件关联
.TXT Error. [C:\WINDOWS\notepad.exe %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT Error. []
.SCR OK. ["%1" /S]
.CHM Error. ["hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1 localhost
127.0.0.1 mmsk.cn
127.0.0.1 bbs.mmsk.cn
127.0.0.1 www.mmsk.cn
127.0.0.1 soudong.com
127.0.0.1 www.soudong.com
==================================
进程特权扫描
特殊特权被允许: SeLoadDriverPrivilege [PID = 1864, C:\PROGRAM FILES\LENOVO\ENERGYCUT\ENERGYCUT.EXE]
特殊特权被允许: SeLoadDriverPrivilege [PID = 1756, D:\QQ\TENCENT\QQ\QQ.EXE]
特殊特权被允许: SeLoadDriverPrivilege [PID = 3476, D:\QQ\TENCENT\QQ\TIMPLATFORM.EXE]
特殊特权被允许: SeLoadDriverPrivilege [PID = 3196, D:\XUNLEI\THUNDER.V5.7.1.338\THUNDER.V5.7.1.338\PROGRAM\THUNDER5.EXE]
==================================
API HOOK
RVA 错误: LoadLibraryA (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA 错误: LoadLibraryExA (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA 错误: LoadLibraryExW (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA 错误: LoadLibraryW (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA 错误: GetProcAddress (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
==================================
隐藏进程
N/A
==================================
[/CODE] |