本帖最后由 woxihuan2011 于 2013-9-10 21:43 编辑
玩的是一个传奇私-Fu,这几天就下了两个软件,一个这私-Fu,另一个YY聊天,下载的时候微点都报过修改注册表。与硬件肯定无关,一般是CPU发热,以前我没开空调同时电影和游戏都没事,现在开空调了。系统是上上周重装的。下面是SRENG日志
- 2013-09-10,02:46:53
- System Repair Engineer 2.8.4.1331
- Smallfrogs (http://www.KZTechs.com)
- Windows XP Professional Service Pack 3 (Build 2600) - 管理权限用户 - 完整功能
- 以下内容被选中:
- 所有的启动项目(包括注册表、启动文件夹、服务等)
- 浏览器加载项
- 正在运行的进程(包括进程模块信息)
- 文件关联
- Winsock 提供者
- Autorun.inf
- HOSTS 文件
- 进程特权扫描
- 计划任务
- Windows 安全更新检查
- API HOOK
- 隐藏进程
- 启动项目
- 注册表
- [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
- <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Component Publisher]
- <QQDownload><; "D:\Program Files\Tencent\QQDownload\QQDownload.exe" autostart> [File is missing]
- [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
- <load><> [N/A]
- [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
- <avgnt><; "D:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min> [(Verified)Avira Operations GmbH & Co. KG]
- <KernelFaultCheck><%systemroot%\system32\dumprep 0 -k> [File is missing]
- <Adobe ARM><; "C:\Program Files\Windows Live\Messenger\msnmsgr.exe\Adobe\ARM\1.0\AdobeARM.exe"> [(Verified)Adobe Systems, Incorporated]
- <ApnUpdater><; "C:\Program Files\Ask.com\Updater\Updater.exe"> [File is missing]
- [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
- <shell><Explorer.exe> [(Verified)Microsoft Windows Component Publisher]
- <Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Component Publisher]
- [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
- <AppInit_DLLs><> [N/A]
- [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
- <UIHost><logonui.exe> [(Verified)Microsoft Windows Component Publisher]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
- <WebCheck><C:\WINDOWS\system32\webcheck.dll> [(Verified)Microsoft Windows]
- <PostBootReminder><%SystemRoot%\system32\SHELL32.dll> [(Verified)Microsoft Windows Component Publisher]
- <CDBurn><%SystemRoot%\system32\SHELL32.dll> [(Verified)Microsoft Windows Component Publisher]
- <SysTray><C:\WINDOWS\system32\stobject.dll> [(Verified)Microsoft Windows Component Publisher]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
- <WinlogonNotify: crypt32chain><crypt32.dll> [(Verified)Microsoft Windows Component Publisher]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
- <WinlogonNotify: cryptnet><cryptnet.dll> [(Verified)Microsoft Windows Component Publisher]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
- <WinlogonNotify: cscdll><cscdll.dll> [(Verified)Microsoft Windows Component Publisher]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dimsntfy]
- <WinlogonNotify: dimsntfy><%SystemRoot%\System32\dimsntfy.dll> [(Verified)Microsoft Windows Component Publisher]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
- <WinlogonNotify: ScCertProp><wlnotify.dll> [(Verified)Microsoft Windows Component Publisher]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
- <WinlogonNotify: Schedule><wlnotify.dll> [(Verified)Microsoft Windows Component Publisher]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
- <WinlogonNotify: sclgntfy><sclgntfy.dll> [(Verified)Microsoft Windows Component Publisher]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
- <WinlogonNotify: SensLogn><WlNotify.dll> [(Verified)Microsoft Windows Component Publisher]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
- <WinlogonNotify: termsrv><wlnotify.dll> [(Verified)Microsoft Windows Component Publisher]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
- <WinlogonNotify: wlballoon><wlnotify.dll> [(Verified)Microsoft Windows Component Publisher]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
- <{438755C2-A8BA-11D1-B96B-00A0C90312E1}><%SystemRoot%\system32\browseui.dll> [(Verified)Microsoft Windows Component Publisher]
- <{8C7461EF-2B13-11d2-BE35-3078302C2030}><%SystemRoot%\system32\browseui.dll> [(Verified)Microsoft Windows Component Publisher]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
- <Internet Explorer Version Update><C:\WINDOWS\system32\ieudinit.exe> [(Verified)Microsoft Windows]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
- <Windows Media Player><C:\WINDOWS\inf\unregmp2.exe /ShowWMP> [(Verified)Microsoft Windows Component Publisher]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
- <Internet Explorer><C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig> [(Verified)Microsoft Windows Component Publisher]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
- <浏览器自定义组件><RunDLL32 IEDKCS32.DLL,BrandIEActiveSetup SIGNUP> [(Verified)Microsoft Windows Component Publisher]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
- <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [File is missing]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{99820200-ECBD-11cf-8B85-00AA005B4340}]
- <Windows 桌面更新><regsvr32.exe /s /n /i:U shell32.dll> [(Verified)Microsoft Windows Component Publisher]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
- <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [File is missing]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
- <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [File is missing]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
- <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows Component Publisher]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
- <Microsoft Windows Media Player 11><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub> []
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
- <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [File is missing]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
- <Windows 桌面更新><regsvr32.exe /s /n /i:U shell32.dll> [(Verified)Microsoft Windows Component Publisher]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
- <Internet Explorer><C:\WINDOWS\system32\ie4uinit.exe -BaseSettings> [(Verified)Microsoft Windows Component Publisher]
- [HKEY_CURRENT_USER\Control Panel\Desktop]
- <SCRNSAVE.EXE><C:\WINDOWS\system32\ssmypics.scr> [(Verified)Microsoft Windows Component Publisher]
- ==================================
- 启动文件夹
- N/A
- ==================================
- 服务
- [Avira Scheduler / AntiVirSchedulerService][Running/Auto Start]
- <"D:\Program Files\Avira\AntiVir Desktop\sched.exe"><Avira Operations GmbH & Co. KG>
- [Avira Real-Time Protection / AntiVirService][Stopped/Disabled]
- <"D:\Program Files\Avira\AntiVir Desktop\avguard.exe"><Avira Operations GmbH & Co. KG>
- [Avira Web Protection / AntiVirWebService][Stopped/Disabled]
- <"D:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE"><Avira Operations GmbH & Co. KG>
- [Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start]
- <C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
- [MPSVC Service / MPSVCService][Running/Auto Start]
- <D:\Program Files\Micropoint\MPSvc.exe><Micropoint Corporation>
- [盛大在线自动更新服务 / SdDUpdService][Running/Auto Start]
- <C:\Program Files\SdDUpdService\SdDUpdService.exe><>
- [wlcommsvc / wlcommsvc][Running/Auto Start]
- <C:\Program Files\MSN\Service\wlcommsvc.exe><Just Orange>
- ==================================
- 驱动程序
- [AMD HwPState Processor Driver / AmdPPM][Running/System Start]
- <system32\DRIVERS\AmdPPM.sys><Advanced Micro Devices>
- [ati2mtag / ati2mtag][Running/Manual Start]
- <system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
- [avgntflt / avgntflt][Running/Auto Start]
- <system32\DRIVERS\avgntflt.sys><Avira Operations GmbH & Co. KG>
- [avipbb / avipbb][Running/System Start]
- <system32\DRIVERS\avipbb.sys><Avira Operations GmbH & Co. KG>
- [avkmgr / avkmgr][Running/System Start]
- <system32\DRIVERS\avkmgr.sys><Avira Operations GmbH & Co. KG>
- [Microsoft 用于 High Definition Audio 的 UAA 总线驱动程序 / HDAudBus][Running/Manual Start]
- <system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
- [Service for Realtek HD Audio (WDM) / IntcAzAudAddService][Running/Manual Start]
- <system32\drivers\RtkHDAud.sys><Realtek Semiconductor Corp.>
- [mp110001 / mp110001][Running/Auto Start]
- <system32\drivers\mp110001.sys><Micropoint Corporation>
- [mp110002 / mp110002][Running/Auto Start]
- <system32\drivers\mp110002.sys><Micropoint Corporation>
- [mp110003 / mp110003][Running/Boot Start]
- <\SystemRoot\system32\drivers\mp110003.sys><Micropoint Corporation>
- [mp110004 / mp110004][Running/Auto Start]
- <system32\drivers\mp110004.sys><Micropoint Corporation>
- [mp110005 / mp110005][Running/Manual Start]
- <system32\drivers\mp110005.sys><Micropoint Corporation>
- [mp110006 / mp110006][Running/System Start]
- <system32\DRIVERS\mp110006.sys><Micropoint Corporation>
- [mp110007 / mp110007][Running/System Start]
- <system32\drivers\mp110007.sys><Micropoint Corporation>
- [mp110008 / mp110008][Running/Auto Start]
- <system32\drivers\mp110008.sys><Micropoint Corporation>
- [mp110009 / mp110009][Running/System Start]
- <system32\drivers\mp110009.sys><Micropoint Corporation>
- [mp110010 / mp110010][Running/Boot Start]
- <\SystemRoot\system32\drivers\mp110010.sys><Micropoint Corporation>
- [mp110011 / mp110011][Running/System Start]
- <system32\drivers\mp110011.sys><Micropoint Corporation>
- [mp110012 / mp110012][Running/Boot Start]
- <\SystemRoot\system32\drivers\mp110012.sys><Micropoint Corporation>
- [mp110013 / mp110013][Running/Boot Start]
- <\SystemRoot\system32\drivers\mp110013.sys><Micropoint Corporation>
- [Micropoint Net Filter / mp110014][Running/Manual Start]
- <system32\DRIVERS\mp110014.sys><Micropoint Corporation>
- [NVIDIA nForce 10/100 Mbps Ethernet / NVENETFD][Running/Manual Start]
- <system32\DRIVERS\NVENETFD.sys><NVIDIA Corporation>
- [nvgts / nvgts][Running/Boot Start]
- <\SystemRoot\system32\drivers\nvgts.sys><NVIDIA Corporation>
- [NVIDIA Network Bus Enumerator / nvnetbus][Running/Manual Start]
- <system32\DRIVERS\nvnetbus.sys><NVIDIA Corporation>
- [Protector / Protector][Running/Auto Start]
- <\??\C:\WINDOWS\system32\drivers\Protector.sys><www.ISRA.org.cn>
- [ProtectorA / ProtectorA][Running/Auto Start]
- <\??\C:\WINDOWS\system32\drivers\ProtectorA.sys><www.ISRA.org.cn>
- [Direct Parallel Link Driver / Ptilink][Running/Manual Start]
- <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
- [QQProtect / QQProtect][Running/System Start]
- <\??\C:\WINDOWS\system32\drivers\QQProtect.sys><Tencent>
- [Secdrv / Secdrv][Stopped/Manual Start]
- <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
- [ssmdrv / ssmdrv][Running/System Start]
- <system32\DRIVERS\ssmdrv.sys><Avira GmbH>
- ==================================
- 浏览器加载项
- [QQDownload IE Left Helper]
- {00000000-12C9-4305-82F9-43058F20E8D2} <D:\Program Files\Tencent\QQDownload\QQIEHelper01.dll, (Signed) Tencent Technology (Shenzhen) Company Limited>
- []
- {776B71E1-B4CC-4C94-BC7C-09103AA690B6} <, >
- [BOC ProcessProtect Class]
- {776B71E2-B4CC-4C94-BC7C-09103AA690B6} <C:\WINDOWS\system32\ProcessProtection.dll, (Signed) www.nitsc.cn>
- [Windows Live 登录帮助程序]
- {9030D464-4C02-4ABF-8ECC-5164760863C6} <C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll, (Signed) Microsoft Corporation>
- [Ask Toolbar]
- {D4027C7F-154A-4066-A1AD-4243D8127440} <, >
- []
- {e2e2dd38-d088-4134-82b7-f2ba38496583} <%windir%\Network Diagnostic\xpnetdiag.exe, (Signed) N/A>
- [Ask Toolbar]
- {D4027C7F-154A-4066-A1AD-4243D8127440} <, >
- [QQDownload IE Left Helper]
- {00000000-12C9-4305-82F9-43058F20E8D2} <D:\Program Files\Tencent\QQDownload\QQIEHelper01.dll, (Signed) Tencent Technology (Shenzhen) Company Limited>
- []
- {02E2D748-67F8-48B4-8AB4-0A085374BB9A} <, >
- [InstallHelper Class]
- {1DABF8D5-8430-4985-9B7F-A30E53D709B3} <C:\WINDOWS\system32\MMInstaller.dll, (Signed) Tencent>
- [Agent Class]
- {485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <, >
- [QQPYChecker Class]
- {5052B4D0-9DF7-45ef-88EF-F42C0EA33A43} <D:\Program Files\Tencent\QQPinyin\1.1.1228.400\QQImeChecker.dll, (Signed) Tencent>
- []
- {5EF7B131-C278-4034-BC88-2CE28B128681} <, >
- []
- {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} <, >
- []
- {6EE9CD3E-A386-4DAE-9737-A759DBF927AE} <, >
- []
- {776B71E1-B4CC-4C94-BC7C-09103AA690B6} <, >
- [BOC ProcessProtect Class]
- {776B71E2-B4CC-4C94-BC7C-09103AA690B6} <C:\WINDOWS\system32\ProcessProtection.dll, (Signed) www.nitsc.cn>
- [yy_checker]
- {82404416-4C60-47F8-BA06-90BA7261C3AE} <C:\Program Files\Windows Live\Messenger\msnmsgr.exe\duowan\yy4.0\YYSSO\1.0.0.3\npChecker.dll, (Signed) 广州多玩信息技术有限公司>
- [Windows Live 登录帮助程序]
- {9030D464-4C02-4ABF-8ECC-5164760863C6} <C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll, (Signed) Microsoft Corporation>
- []
- {9701758C-4373-482E-B13C-776C048EC890} <, >
- [APlayer3 Control]
- {A9332148-C691-4B9D-91FC-B9C461DBE9DD} <C:\Documents and Settings\All Users\Application Data\Thunder Network\APlayer\APlayer_3.5.0.647.dll, N/A>
- []
- {ACACC6EB-1FBA-4E13-A729-53AEB2DF54F8} <, >
- []
- {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} <, >
- [Microsoft Url Search Hook]
- {CFBFAE00-17A6-11D0-99CB-00C04FD64497} <C:\WINDOWS\system32\ieframe.dll, (Signed) Microsoft Corporation>
- [Shockwave Flash Object]
- {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash32_11_7_700_169.ocx, (Signed) Adobe Systems, Inc.>
- [Ask Toolbar]
- {D4027C7F-154A-4066-A1AD-4243D8127440} <, >
- []
- {D64016F6-4D8E-4B35-AB22-9B2060800112} <, >
- []
- {D9EBCF5D-3F8F-4b6a-89BA-70577BE73C62} <, >
- [InstallHelper Class]
- {DAEB1ABC-48F1-4bb8-82E8-0DAC468F35A4} <C:\Program Files\Tencent\QQmusic\QQMusicInstall\QQMusicMMInstaller.dll, (Signed) Tencent>
- [xoliimpl Class]
- {DD5BF6D1-6663-47E0-9DFA-5C343CAF178E} <C:\WINDOWS\xinstaller.dll, (Signed) 深圳市迅雷技术有限公司>
- [PlayerCtrl Class]
- {E05BC2A3-9A46-4a32-80C9-023A473F5B23} <D:\Program Files\Tencent\QQMusic\QzoneMusic\QzoneMusic.dll, (Signed) Tencent>
- []
- {E2E2DD38-D088-4134-82B7-F2BA38496583} <, >
- [XML HTTP Request]
- {ED8C108E-4349-11D2-91A4-00C04F7969E8} <C:\WINDOWS\system32\msxml3.dll, (Signed) Microsoft Corporation>
- []
- {F3E70CEA-956E-49CC-B444-73AFE593AD7F} <, >
- [XML HTTP]
- {F6D90F16-9C73-11D3-B32E-00C04F990BB4} <C:\WINDOWS\system32\msxml3.dll, (Signed) Microsoft Corporation>
- []
- {F7E55BDF-9528-46ba-B550-777859627591} <, >
- [使用旋风下载(&X)]
- <D:\Program Files\Tencent\QQDownload\xfgeturl.htm, N/A>
- [使用旋风下载全部链接(&Q)]
- <D:\Program Files\Tencent\QQDownload\xfgetAllurl.htm, N/A>
- [使用旋风极速下载(会员特权)(&J)]
- <D:\Program Files\Tencent\QQDownload\xftopspeed.htm, N/A>
- [保存到旋风空间(会员特权)(&K)]
- <D:\Program Files\Tencent\QQDownload\xfofflineonly.htm, N/A>
- [导出到 Microsoft Office Excel(&X)]
- <res://d:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000, N/A>
- [设为 Messenger Live 头像]
- <\SetMSNDP.htm, N/A>
- ==================================
- 正在运行的进程
- [PID: 912 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
- [PID: 1096 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
- [PID: 1368 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2113)]
- [C:\WINDOWS\system32\sfc_os.dll] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
- [C:\WINDOWS\system32\msctfime.ime] [Microsoft Corporation, 5.1.2600.5768 (xpsp_sp3_gdr.090226-1442)]
- [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
- [C:\WINDOWS\system32\Ati2evxx.dll] [ATI Technologies Inc., 6.14.10.4179]
- [C:\WINDOWS\system32\atiadlxx.dll] [Advanced Micro Devices, Inc., 6.14.10.1095]
- [C:\WINDOWS\system32\freeime.ime] [极点五笔工作室, 7.1.5.0]
- [PID: 1508 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.5755 (xpsp_sp3_gdr.090206-1234)]
- [D:\Program Files\Micropoint\mp110031.dll] [Micropoint Corporation, 2.0.47.1498]
- [PID: 1520 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2113)]
- [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
- [PID: 1740 / SYSTEM][C:\WINDOWS\system32\Ati2evxx.exe] [ATI Technologies Inc., 6.14.10.4263]
- [C:\WINDOWS\system32\msctfime.ime] [Microsoft Corporation, 5.1.2600.5768 (xpsp_sp3_gdr.090226-1442)]
- [C:\WINDOWS\system32\Ati2edxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2514]
- [C:\WINDOWS\system32\atipdlxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2563]
- [D:\Program Files\Micropoint\mp110031.dll] [Micropoint Corporation, 2.0.47.1498]
- [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
- [PID: 1764 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
- [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
- [D:\Program Files\Micropoint\mp110031.dll] [Micropoint Corporation, 2.0.47.1498]
- [PID: 1836 / SYSTEM][D:\Program Files\Micropoint\MPSvc.exe] [Micropoint Corporation, 2,0,10582,32]
- [D:\Program Files\Micropoint\dbghelp.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
- [D:\Program Files\Micropoint\MSVCP60.dll] [Microsoft Corporation, 6.00.8168.0]
- [D:\Program Files\Micropoint\mp110049.dll] [Micropoint Corporation, 2,0,10582,1]
- [D:\Program Files\Micropoint\mp110078.dll] [Micropoint Corporation, 2.0.10582.3]
- [D:\Program Files\Micropoint\mp110081.dll] [Micropoint Corporation, 2,0,10582,4]
- [D:\Program Files\Micropoint\mp110036.dll] [Micropoint Corporation, 2.0.10582.33]
- [PID: 2024 / SYSTEM][D:\Program Files\Micropoint\MPSVC2.exe] [Micropoint Corporation, 2.0.10582.133]
- [D:\Program Files\Micropoint\dbghelp.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
- [D:\Program Files\Micropoint\mp110030.dll] [Micropoint Corporation, 1.2.10038]
- [D:\Program Files\Micropoint\mp110037.dll] [Micropoint Corporation, 2.0.10582.9]
- [D:\Program Files\Micropoint\mp110078.dll] [Micropoint Corporation, 2.0.10582.3]
- [D:\Program Files\Micropoint\mp110028.dll] [Micropoint Corporation, 1, 2, 10581, 4]
- [D:\Program Files\Micropoint\mp110036.dll] [Micropoint Corporation, 2.0.10582.33]
- [D:\Program Files\Micropoint\mp110033.dll] [Micropoint Corporation, 2,0,10582,21]
- [D:\Program Files\Micropoint\mp110034.dll] [Micropoint Corporation, 2.0.10145]
- [D:\Program Files\Micropoint\mp110039.dll] [Micropoint Corporation, 2,0,10582,1]
- [D:\Program Files\Micropoint\mp110042.dll] [Micropoint Corporation, 1, 2, 10053, 100]
- [D:\Program Files\Micropoint\mp110049.dll] [Micropoint Corporation, 2,0,10582,1]
- [D:\Program Files\Micropoint\mp110069.dll] [Micropoint Corporation, 1, 2, 10581, 104]
- [D:\Program Files\Micropoint\mp110071.dll] [Micropoint Corporation, 2, 0, 10582, 1]
- [D:\Program Files\Micropoint\MSVCP60.dll] [Microsoft Corporation, 6.00.8168.0]
- [D:\Program Files\Micropoint\mp110073.dll] [Micropoint Corporation, 2,0,10582,8]
- [D:\Program Files\Micropoint\mp110075.dll] [Micropoint Corporation, 2.0.10582.5]
- [D:\Program Files\Micropoint\mp110081.dll] [Micropoint Corporation, 2,0,10582,4]
- [D:\Program Files\Micropoint\mp110086.dll] [, 2, 0, 10582, 2]
- [D:\Program Files\Micropoint\mp110185.dll] [Micropoint Corporation, 2, 0, 10582, 3]
- [D:\Program Files\Micropoint\mp110186.dll] [Micropoint Corporation, 2, 0, 10582, 9]
- [D:\Program Files\Micropoint\mp110124.dll] [Micropoint Corporation, 2,0,10582,14]
- [D:\Program Files\Micropoint\mp110125.dll] [Micropoint Corporation, 1.2.10572.3]
- [D:\Program Files\Micropoint\mp110029.dll] [Micropoint Corporation, 2, 0, 10582, 1]
- [D:\Program Files\Micropoint\mp110077.dll] [Micropoint Corporation, 2,0,10582,10]
- [D:\Program Files\Micropoint\mp110100.dll] [Micropoint Corporation, 1, 2, 10581, 115]
- [D:\Program Files\Micropoint\mp110118.dll] [Micropoint Corporation, 1, 2, 10582, 86]
- [D:\Program Files\Micropoint\mp110115.dll] [Micropoint Corporation, 1, 2, 10581, 113]
- [D:\Program Files\Micropoint\mp110103.dll] [Micropoint Corporation, 1, 2, 10582, 83]
- [D:\Program Files\Micropoint\mp110116.dll] [Micropoint Corporation, 1, 2, 10581, 4]
- [D:\Program Files\Micropoint\mp110120.dll] [Micropoint Corporation, 1, 2, 10581, 10]
- [D:\Program Files\Micropoint\mp110122.dll] [Micropoint Corporation, 1.2.69.705]
- [D:\Program Files\Micropoint\mp110128.dll] [Micropoint Corporation, 1, 2, 10581, 11]
- [D:\Program Files\Micropoint\mp110130.dll] [Micropoint Corporation, 1, 2, 10581, 108]
- [D:\Program Files\Micropoint\mp110190.dll] [Micropoint Corporation, 1, 2, 10581, 30]
- [D:\Program Files\Micropoint\mp110031.dll] [Micropoint Corporation, 2.0.47.1498]
- [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
- [PID: 728 / SYSTEM][D:\Program Files\Micropoint\MPSVC1.exe] [Micropoint Corporation, 2.0.10582.26]
- [D:\Program Files\Micropoint\mp110049.dll] [Micropoint Corporation, 2,0,10582,1]
- [D:\Program Files\Micropoint\mp110078.dll] [Micropoint Corporation, 2.0.10582.3]
- [D:\Program Files\Micropoint\mp110081.dll] [Micropoint Corporation, 2,0,10582,4]
- [D:\Program Files\Micropoint\mp110072.dll] [Micropoint Corporation, 2.0.10582.2]
- [PID: 1304 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
- [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
- [D:\Program Files\Micropoint\mp110031.dll] [Micropoint Corporation, 2.0.47.1498]
- [PID: 1612 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
- [C:\WINDOWS\System32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
- [D:\Program Files\Micropoint\mp110031.dll] [Micropoint Corporation, 2.0.47.1498]
- [PID: 1868 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
- [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
- [D:\Program Files\Micropoint\mp110031.dll] [Micropoint Corporation, 2.0.47.1498]
- [PID: 208 / SYSTEM][C:\WINDOWS\system32\Ati2evxx.exe] [ATI Technologies Inc., 6.14.10.4263]
- [D:\Program Files\Micropoint\mp110031.dll] [Micropoint Corporation, 2.0.47.1498]
- [C:\WINDOWS\system32\msctfime.ime] [Microsoft Corporation, 5.1.2600.5768 (xpsp_sp3_gdr.090226-1442)]
- [C:\WINDOWS\system32\Ati2edxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2514]
- [C:\WINDOWS\system32\atipdlxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2563]
- [C:\WINDOWS\system32\ati2evxx.dll] [ATI Technologies Inc., 6.14.10.4179]
- [C:\WINDOWS\system32\atiadlxx.dll] [Advanced Micro Devices, Inc., 6.14.10.1095]
- [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
- [PID: 216 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
- [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
- [D:\Program Files\Micropoint\mp110031.dll] [Micropoint Corporation, 2.0.47.1498]
- [PID: 992 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.6024 (xpsp_sp3_gdr.100817-1626)]
- [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
- [D:\Program Files\Micropoint\mp110031.dll] [Micropoint Corporation, 2.0.47.1498]
- [C:\WINDOWS\system32\sfc_os.dll] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
- [PID: 1112 / SYSTEM][D:\Program Files\Avira\AntiVir Desktop\sched.exe] [Avira Operations GmbH & Co. KG, 13.6.20.2100]
- [D:\Program Files\Avira\AntiVir Desktop\grdcore.dll] [Avira Operations GmbH & Co. KG, 13.6.20.2174]
- [d:\program files\avira\antivir desktop\cfglib.dll] [Avira Operations GmbH & Co. KG, 13.6.20.2174]
- [d:\program files\avira\antivir desktop\gpipc.dll] [Avira Operations GmbH & Co. KG, 13.6.20.2174]
- [d:\program files\avira\antivir desktop\gpgen.dll] [Avira Operations GmbH & Co. KG, 13.6.20.2174]
- [d:\program files\avira\antivir desktop\gpschd.dll] [Avira Operations GmbH & Co. KG, 13.6.20.2204]
- [D:\Program Files\Avira\AntiVir Desktop\avevtlog.dll] [Avira Operations GmbH & Co. KG, 13.6.20.2174]
- [D:\Program Files\Avira\AntiVir Desktop\schedr.dll] [Avira Operations GmbH & Co. KG, 13.6.20.2174]
- [D:\Program Files\Avira\AntiVir Desktop\sqlite3.dll] [, 3.7.0.1]
- [PID: 1532 / Administrator][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
- [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
- [D:\Program Files\Micropoint\mp110031.dll] [Micropoint Corporation, 2.0.47.1498]
- [C:\WINDOWS\system32\msctfime.ime] [Microsoft Corporation, 5.1.2600.5768 (xpsp_sp3_gdr.090226-1442)]
- [C:\WINDOWS\system32\freeime.ime] [极点五笔工作室, 7.1.5.0]
- [C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\reghelper\xappex.1.1.1.73.(340).dll] [深圳市迅雷网络技术有限公司, 1, 1, 1, 73]
- [C:\Program Files\WinRAR\rarext.dll] [Alexander Roshal, 4.20.0]
- [D:\Program Files\Avira\AntiVir Desktop\shlext.dll] [Avira Operations GmbH & Co. KG, 13.6.20.2174]
- [D:\Program Files\Micropoint\mp110170.dll] [Micropoint Corporation, 2, 0, 10582, 9]
- [C:\WINDOWS\system32\contmenu.dll] [N/A, ]
- [PID: 1992 / Administrator][D:\Program Files\Micropoint\MPMon.exe] [Micropoint Corporation, 2,0,10582,37]
- [D:\Program Files\Micropoint\mp110036.dll] [Micropoint Corporation, 2.0.10582.33]
- [D:\Program Files\Micropoint\mp110078.dll] [Micropoint Corporation, 2.0.10582.3]
- [D:\Program Files\Micropoint\mp110049.dll] [Micropoint Corporation, 2,0,10582,1]
- [D:\Program Files\Micropoint\mp110079.dll] [Micropoint Corporation, 2,0,10582,1]
- [D:\Program Files\Micropoint\mp110081.dll] [Micropoint Corporation, 2,0,10582,4]
- [D:\Program Files\Micropoint\mp110161.dll] [Micropoint Corporation, 2,0,10582,5]
- [D:\Program Files\Micropoint\MSVCP60.dll] [Microsoft Corporation, 6.00.8168.0]
- [D:\Program Files\Micropoint\dbghelp.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
- [D:\Program Files\Micropoint\mp110051.dll] [Micropoint Corporation, 2,0,10582,24]
- [D:\Program Files\Micropoint\mp34\mp110168.03A] [Micropoint Corporation, 2,0,10582,6]
- [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
- [PID: 1856 / SYSTEM][C:\Program Files\SdDUpdService\SdDUpdService.exe] [, 1,9,0,6]
- [D:\Program Files\Micropoint\mp110031.dll] [Micropoint Corporation, 2.0.47.1498]
- [C:\Program Files\SdDUpdService\SdDUpdateService.dll] [, 1,9,0,6]
- [C:\Program Files\SdDUpdService\SdDLogSendUDP.dll] [, 1,9,0,6]
- [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
- [C:\Program Files\SdDUpdService\sddutils.dll] [, 1,8,0,1]
- [PID: 280 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
- [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
- [D:\Program Files\Micropoint\mp110031.dll] [Micropoint Corporation, 2.0.47.1498]
- [PID: 632 / SYSTEM][C:\Program Files\MSN\Service\wlcommsvc.exe] [Just Orange, 1, 0, 0, 6]
- [D:\Program Files\Micropoint\mp110031.dll] [Micropoint Corporation, 2.0.47.1498]
- [PID: 1388 / Administrator][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2105)]
- [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
- [C:\WINDOWS\system32\msctfime.ime] [Microsoft Corporation, 5.1.2600.5768 (xpsp_sp3_gdr.090226-1442)]
- [C:\WINDOWS\system32\freeime.ime] [极点五笔工作室, 7.1.5.0]
- [PID: 3020 / Administrator][D:\Program Files\SREngLdr.EXE] [Smallfrogs Studio, 2.8.4.1331]
- [D:\Program Files\Micropoint\mp110031.dll] [Micropoint Corporation, 2.0.47.1498]
- [PID: 3056 / Administrator][D:\Program Files\SRE3c0bbc73.EXE] [Smallfrogs Studio, 2.8.4.1331]
- [D:\Program Files\Micropoint\mp110031.dll] [Micropoint Corporation, 2.0.47.1498]
- [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
- [C:\WINDOWS\system32\msctfime.ime] [Microsoft Corporation, 5.1.2600.5768 (xpsp_sp3_gdr.090226-1442)]
- [C:\WINDOWS\system32\freeime.ime] [极点五笔工作室, 7.1.5.0]
- [C:\WINDOWS\system32\sfc_os.dll] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
- ==================================
- 文件关联
- .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
- .EXE OK. ["%1" %*]
- .COM OK. ["%1" %*]
- .PIF OK. ["%1" %*]
- .REG OK. [regedit.exe "%1"]
- .BAT OK. ["%1" %*]
- .SCR OK. ["%1" /S]
- .CHM OK. ["C:\WINDOWS\hh.exe" %1]
- .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
- .INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
- .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
- .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
- .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
- .LNK OK. [{00021401-0000-0000-C000-000000000046}]
- ==================================
- Winsock 提供者
- N/A
- ==================================
- Autorun.inf
- N/A
- ==================================
- HOSTS 文件
- 127.0.0.1 localhost
- ==================================
- 进程特权扫描
- 特殊特权被允许: SeLoadDriverPrivilege [PID = 1368, C:\WINDOWS\SYSTEM32\WINLOGON.EXE]
- 特殊特权被允许: SeLoadDriverPrivilege [PID = 1740, C:\WINDOWS\SYSTEM32\ATI2EVXX.EXE]
- 特殊特权被允许: SeLoadDriverPrivilege [PID = 208, C:\WINDOWS\SYSTEM32\ATI2EVXX.EXE]
- ==================================
- 计划任务
- [已启用] Scheduled Update for Ask Toolbar.job
- C:\Program Files\Ask.com\UpdateTask.exe
- ==================================
- Windows 安全更新检查
- N/A
- ==================================
- API HOOK
- N/A
- ==================================
- 隐藏进程
- N/A
- ==================================
复制代码 单独看电影或者游戏是没问题的,就是一起的时候就自动重启。不知道是下的登陆器有问题,还是装的系统有问题。对了,还下了个传奇官服 |