怎么杀这个木马-www.ip560.com？

显示全部楼层 · 发表于 2007-11-28 22:17:28

最近科室的电脑不知道被谁玩得中毒了，不管开什么网页都会先连接http：//www。ip560。com/error。htm 或者http：//www。ip560。com/error。htm 或者然后卡巴就会报警说发现恶意程序“http：//www。ip560。com/wm/xjz2007。bmp”
然后机器就变好慢

XP补丁应该都打了，不但自动更新，还用金山的和360在打补丁
杀毒也杀过，卡巴、AVG AntiSpyware、360、windows清理助手，在删除explorer临时文件后杀过，也在删除临时文件后进入安全模式杀过
IE修复的话只用360修复过
开机还蛮正常的，只要一开网页就会先转到www。ip560.com的什么网页卡巴就报警而且还只能拒绝接受那个bmp文件，本地没有木马的显示。
天啊，还要怎么做啊？各位大哥大姐支个招吧！

我晕，我的电脑好像也中了这个，一发帖就自动加了两个图片进去，卡巴报警：
2007-11-28 :22:18:07: 恶意HTTP对象 <http://www。ip560。com/wm/xjz2007。bmp>: 已检测恶意程序 'Exploit.Win32.IMG-ANI.ac'.
2007-11-28 :22:18:07: 恶意HTTP对象 <http://www。ip560。com/wm/xjz2007。bmp>: 拒绝访问.

好了，又编辑了一次，图片没有了，我自己的电脑还好只有上某些网站的时候会报警，但是科室里一上就报警，而且速度还会变很慢，都是局域网的机器，会不会是ARP的病毒呢？

[ 本帖最后由 ha6270 于 2007-11-29 19:20 编辑 ]

显示全部楼层 · 发表于 2007-11-28 23:00:50

刚才用System Repair Engineer扫描了一下系统高手看看我的系统有没有毛病，谢谢了，明天去检查科室里的电脑，谢谢大家了

[CODE]
2007-11-28,22:38:15
System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<nwiz><nwiz.exe /install>  []
<KernelFaultCheck><%systemroot%\system32\dumprep 0 -k>  [N/A]
<BigDogPath><C:\WINDOWS\VM_STI.EXE USB PC Camera 301P>  [N/A]
<IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload>  [(Verified)Microsoft Corporation]
<NvMediaCenter><RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<AVP><"D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe">  [Kaspersky Lab]
<!AVG Anti-Spyware><"D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avg.exe" /minimized>  [GRISOFT s.r.o.]
<360Safetray><d:\Program Files\360safe\safemon\360tray.exe /start>  [奇虎网]
<360Antiarp><d:\Program Files\360safe\antiarp\antiarp.exe /start>  [奇虎网]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
<UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{57B86673-276A-48B2-BAE7-C6DBB3020EB8}><d:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll>  [(Verified)GRISOFT LTD]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
<WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll>  [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
<Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><C:\WINDOWS\system32\FLURRY.SCR>  [Matt Ginzton]
==================================
启动文件夹
[H3C802.1X]
  <C:\Documents and Settings\Juan Bao Bao\「开始」菜单\程序\启动\H3C802.1X.lnk --> C:\PROGRA~1\HUAWEI~1\H3C802~1.1X\DOT1XC~1.EXE [N/A]><N>
==================================
服务
[AVG Anti-Spyware Guard / AVG Anti-Spyware Guard][Running/Auto Start]
  <d:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe><GRISOFT s.r.o.>
[卡巴斯基互联网安全套装6.0个人版 / AVP][Running/Auto Start]
  <"D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r><Kaspersky Lab>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[McAfee Framework Service / McAfeeFramework][Stopped/Disabled]
  <"D:\Program Files\McAfee\Common Framework\FrameworkService.exe" /ServiceStart><N/A>
[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
  <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
==================================
驱动程序
[360AntiArp / 360AntiArp][Running/System Start]
  <\??\C:\WINDOWS\system32\drivers\360AntiArp.sys><奇虎网>
[AVG Anti-Spyware Driver / AVG Anti-Spyware Driver][Running/System Start]
  <\??\d:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys><N/A>
[AVG Anti-Spyware Clean Driver / AvgAsCln][Running/System Start]
  <System32\DRIVERS\AvgAsCln.sys><GRISOFT, s.r.o.>
[djibbfha / djibbfha][Stopped/Boot Start]
  <\SystemRoot\system32\drivers\djibbfha.sys><N/A>
[kl1 / kl1][Running/Boot Start]
  <\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif][Running/System Start]
  <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[lxoxzc8 / lxoxzc87][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\lxoxzc87.sys><N/A>
[VSCore mferkdk / mferkdk][Stopped/System Start]
  <\??\D:\Program Files\McAfee\VirusScan Enterprise\mferkdk.sys><N/A>
[npkcrypt / npkcrypt][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\npkcrypt.sys><N/A>
[npkycryp / npkycryp][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\npkycryp.sys><N/A>
[nv / nv][Running/Manual Start]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Service for NVIDIA(R) nForce(TM) Audio Enumerator / nvax][Running/Manual Start]
  <system32\drivers\nvax.sys><NVIDIA Corporation>
[NVIDIA nForce MCP Networking Adapter Driver / NVENET][Running/Manual Start]
  <system32\DRIVERS\NVENET.sys><NVIDIA Corporation>
[Service for NVIDIA(R) nForce(TM) Audio / nvnforce][Running/Manual Start]
  <system32\drivers\nvapu.sys><NVIDIA Corporation>
[NVIDIA nForce AGP Bus Filter / nv_agp][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\nv_agp.sys><NVIDIA Corporation>
[PCAMPR5 NDIS Protocol Driver / PCAMPR5][Running/Manual Start]
  <\??\C:\WINDOWS\system32\PCAMPR5.SYS><Printing Communications Assoc., Inc. (PCAUSA)>
[PCANDIS5 NDIS Protocol Driver / PCANDIS5][Running/Manual Start]
  <\??\C:\WINDOWS\system32\PCANDIS5.SYS><Printing Communications Assoc., Inc. (PCAUSA)>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[播放机恢复设备控制驱动程序 / StMp3Rec][Stopped/Manual Start]
  <System32\Drivers\StMp3Rec.sys><Microsoft Corporation>
[TSP / TSP][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
  <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[USB PC Camera 301P / ZSMC301b][Running/Manual Start]
  <System32\Drivers\usbVM31b.sys><VM>
==================================
浏览器加载项
[ThunderAtOnce Class]
  {01443AEC-0FD1-40fd-9C87-E93D1494C233} <d:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <d:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[SafeMon Class]
  {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <d:\Program Files\360safe\safemon\safemon.dll, 奇虎网>
[启动迅雷5]
  {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <d:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[浩方对战平台]
  {0A155D3C-68E2-4215-A47A-E800A446447A} <D:\Program Files\浩方对战平台\GameClient.exe, 上海浩方在线信息技术有限公司>
[Web反病毒统计]
  {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll, Kaspersky Lab>
[番茄花园]
  {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} <http://www.tomatolei.com, N/A>
[信息检索(&R)]
  {92780B25-18CC-41C8-B9BE-3C9C571A8263} <D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[Office Genuine Advantage Validation Tool]
  {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} <C:\WINDOWS\system32\OGACheckControl.dll, >
[Edit Class]
  {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\WINDOWS\system32\CMBEdit.dll, >
[EditCtrl Class]
  {488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\system32\aliedit\aliedit.dll, >
[MSN Photo Upload Tool]
  {4F1E5B1A-2A80-42CA-8532-2D05CB959537} <C:\WINDOWS\Downloaded Program Files\CONFLICT.1\MsnPUpld.dll, Microsoft? Corporation>
[ICBC Security Ctrl]
  {5AB9367B-DD7F-411D-A030-DF7DE5E17AAE} <C:\WINDOWS\DOWNLO~1\NETBAN~1.OCX, Industrial and Commercial Bank of China>
[AxInputControl Class]
  {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL, >
[Windows Live Photo Upload Control]
  {7FC1B346-83E6-4774-8D20-1A6B09B0E737} <C:\WINDOWS\Downloaded Program Files\MsnPUpld.dll, Microsoft? Corporation>
[163Uploader Control]
  {8686F2A6-DC01-4E8F-BDE3-DCC7DBBAD6AE} <C:\WINDOWS\system32\163UPL~1.OCX, 广州网易互动娱乐有限公司>
[PowerCommit Control]
  {BEEE2807-1709-4184-A05D-1B2DE01EE4CF} <C:\WINDOWS\DOWNLO~1\POWERE~1.OCX, CSII>
[Tencent Safety Online Base Module]
  {C09B522F-8AED-4E21-A65C-DC1AB652BAEE} <C:\WINDOWS\DOWNLO~1\TSOBase.ocx, Tencent Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9d.ocx, Adobe Systems, Inc.>
[QPicControl Control]
  {E4CF9B52-A94E-4A27-AD90-904A81D0643A} <C:\WINDOWS\system32\QPic\qpic.ocx, tencent>
[PasswordEditCtrl Class]
  {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
[Microsoft Outlook 8.0 Object Library]
  {0006F033-0000-0000-C000-000000000046} <, N/A>
[Microsoft Office Outlook]
  {0006F03A-0000-0000-C000-000000000046} <, N/A>
[ThunderAtOnce Class]
  {01443AEC-0FD1-40FD-9C87-E93D1494C233} <d:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[PeerDraw Class]
  {10072CEC-8CC1-11D1-986E-00A0C955B42E} <C:\Program Files\Common Files\Microsoft Shared\VGX\vgx.dll, Microsoft Corporation>
[iTrusPTA Class]
  {1E0DFFCF-27FF-4574-849B-55007349FEDA} <C:\WINDOWS\system32\aliedit\pta.dll, >
[Windows Media Player]
  {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
  {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
  {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[Thunder Agent Class]
  {485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <d:\Program Files\Thunder Network\Thunder\ComDlls\ThunderAgent_Now.dll, Thunder Networking Technologies,LTD>
[EditCtrl Class]
  {488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\system32\aliedit\aliedit.dll, >
[HHCtrl Object]
  {52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[WUWebControl Class]
  {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[XDRM]
  {693571CB-54A3-4E90-9D52-EEAE1334E2D3} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xdrm.dll_1_work, >
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Active Desktop Mover]
  {72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
[AxInputControl Class]
  {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL, >
[MediaComm Class]
  {7670648D-461B-42AF-BDFE-46D26AF5EFF2} <d:\Program Files\Thunder Network\Thunder\Components\InMedia\MediaAddin13.dll, Thunder Networking Technologies,LTD>
[163Uploader Control]
  {8686F2A6-DC01-4E8F-BDE3-DCC7DBBAD6AE} <C:\WINDOWS\system32\163UPL~1.OCX, 广州网易互动娱乐有限公司>
[360SafeLive]
  {87515F61-A66C-4319-A0E0-D416CB8059E3} <d:\Program Files\360safe\live.dll, 360safe.com>
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <d:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[AxSubmitControl Class]
  {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} <C:\WINDOWS\DOWNLO~1\SUBMIT~1.DLL, >
[RMGetLicense Class]
  {A9FC132B-096D-460B-B7D5-1DB0FAE0C062} <C:\WINDOWS\system32\msnetobj.dll, Microsoft Corporation>
[Microsoft Scriptlet Component]
  {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[SafeMon Class]
  {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <d:\Program Files\360safe\safemon\safemon.dll, 奇虎网>
[RDS.DataSpace]
  {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[AUDIO__MID Moniker Class]
  {CD3AFA74-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__MP3 Moniker Class]
  {CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
  {CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_ASF Moniker Class]
  {CD3AFA8F-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
  {CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
  {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9d.ocx, Adobe Systems, Inc.>
[QPicControl Control]
  {E4CF9B52-A94E-4A27-AD90-904A81D0643A} <C:\WINDOWS\system32\QPic\qpic.ocx, tencent>
[PasswordEditCtrl Class]
  {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
[Thunder DapPlayer]
  {EEDD6FF9-13DE-496B-9A1C-D78B3215E266} <d:\Program Files\Thunder Network\Thunder\Components\DownAndPlay\DapPlayer3.0.36.60.dll, ShenZhen Thunder Networking Technologies Ltd.>
[XPPlayer Class]
  {F3E70CEA-956E-49CC-B444-73AFE593AD7F} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\pplayer.dll_1_work, Thunder>
[使用迅雷下载]
  <d:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
[使用迅雷下载全部链接]
  <d:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
  <res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ表情]
  <d:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[添加到反广告黑名单]
  <D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm, N/A>
==================================

显示全部楼层 · 发表于 2007-11-28 23:02:57

正在运行的进程
[PID: 648 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 720 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 744 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\klogon.dll]  [Kaspersky Lab, 6.0.2.621]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 788 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 952 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1032 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1120 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\wups2.dll]  [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scrchpg.dll]  [Kaspersky Lab, 6.0.2.621]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll]  [Kaspersky Lab, 6.0.2.621]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prremote.dll]  [Kaspersky Lab, 6.0.2.621]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\MSVCP80.dll]  [Microsoft Corporation, 8.00.50727.42]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll]  [Kaspersky Lab, 6.0.2.621]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl]  [Kaspersky Lab, 6.0.2.621]
[d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl]  [Kaspersky Lab, 6.0.2.621]
[d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl]  [Kaspersky Lab, 6.0.2.621]
[d:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl]  [Kaspersky Lab, 6.0.2.621]
[PID: 1176 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1280 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1444 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\WINDOWS\system32\mdimon.dll]  [Microsoft Corporation, 11.3.8166.2]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll]  [Microsoft Corporation, 11.3.8166.2]
[PID: 1688 / Juan Bao Bao][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234)]
[D:\Program Files\360safe\safemon\safemon.dll]  [奇虎网, 3, 6, 4, 1001]
[C:\Program Files\Common Files\Microsoft Shared\INK\PENCHS.DLL]  [Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[C:\WINDOWS\system32\WPDShServiceObj.dll]  [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\PortableDeviceTypes.dll]  [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\WINDOWS\system32\PortableDeviceApi.dll]  [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[d:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll]  [GRISOFT s.r.o., 7, 5, 1, 36]
[d:\Program Files\Thunder Network\Thunder\Components\ResWorker\DsBho_00.dll]  [, 1, 0, 0, 12]
[d:\Program Files\Thunder Network\Thunder\Components\ResWorker\DataProcessor_00.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 13]
[C:\WINDOWS\system32\msdmo.dll]  [, ]
[d:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll]  [Thunder Networking Technologies,LTD, 1.0.5.16]
[d:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 8, 42]
[D:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
[d:\Program Files\WinRAR\rarext.dll]  [N/A, ]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ShellEx.dll]  [Kaspersky Lab, 6.0.2.621]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\MSVCP80.dll]  [Microsoft Corporation, 8.00.50727.42]
[d:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll]  [GRISOFT s.r.o., 7, 5, 1, 36]
[C:\WINDOWS\system32\wpdshext.dll]  [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\WINDOWS\system32\Audiodev.dll]  [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\WINDOWS\system32\nvcpl.dll]  [NVIDIA Corporation, 6.14.10.8195]
[C:\WINDOWS\system32\nvshell.dll]  [, ]
[PID: 1948 / Juan Bao Bao][C:\WINDOWS\VM_STI.EXE]  [VM., 4.2.610.4]
[C:\WINDOWS\system32\msdmo.dll]  [, ]
[C:\WINDOWS\system32\VM31bPrp.Ax]  [VM, 4.2.711.31]
[PID: 1988 / Juan Bao Bao][D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avg.exe]  [GRISOFT s.r.o., 7, 5, 1, 43]
[D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\engine.dll]  [GRISOFT s.r.o., 4, 2, 0, 19]
[D:\Program Files\360safe\safemon\safemon.dll]  [奇虎网, 3, 6, 4, 1001]
[PID: 1996 / Juan Bao Bao][D:\Program Files\360safe\safemon\360tray.exe]  [奇虎网, 3, 6, 4, 3002]
[D:\Program Files\360safe\safemon\safemon.dll]  [奇虎网, 3, 6, 4, 1001]
[D:\Program Files\360safe\safemon\SafeKrnl.dll]  [奇虎网, 3, 6, 0, 1001]
[D:\Program Files\360safe\AntiAdwa.dll]  [360Safe.com, 3, 6, 3, 1001]
[D:\Program Files\360safe\live.dll]  [360safe.com, 1, 0, 1, 1021]
[PID: 2004 / Juan Bao Bao][D:\Program Files\360safe\antiarp\antiarp.exe]  [奇虎网, 1, 0, 0, 2001]
[PID: 2012 / Juan Bao Bao][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 272 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 304 / SYSTEM][C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE]  [Microsoft Corporation, 7.00.9466]
[C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\2052\mdmui.dll]  [Microsoft Corporation, 7.00.9466]
[PID: 388 / SYSTEM][C:\WINDOWS\system32\nvsvc32.exe]  [NVIDIA Corporation, 6.14.10.8195]
[PID: 464 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 964 / NETWORK SERVICE][C:\Program Files\Windows Media Player\WMPNetwk.exe]  [Microsoft Corporation, 11.0.5721.5145 (WMP_11.061018-2006)]
[C:\WINDOWS\system32\wmpmde.dll]  [Microsoft Corporation, 11.0.5721.5145 (WMP_11.061018-2006)]
[C:\WINDOWS\system32\MFPlat.DLL]  [Microsoft Corporation, 11.0.5721.5145 (WMP_11.061018-2006)]
[C:\WINDOWS\system32\wmpps.dll]  [Microsoft Corporation, 11.0.5721.5145 (WMP_11.061018-2006)]
[PID: 2492 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2636 / Juan Bao Bao][C:\Program Files\Huawei-3Com\H3C 802.1X 客户端\Dot1XClient.exe]  [N/A, ]
[C:\WINDOWS\system32\W32N50.dll]  [Printing Communications Assoc., Inc. (PCAUSA), 5.03.16.56]
[D:\Program Files\360safe\safemon\safemon.dll]  [奇虎网, 3, 6, 4, 1001]
[PID: 2544 / Juan Bao Bao][D:\Program Files\Tencent\QQ\QQ.exe]  [TENCENT, 7,0,431,1723]
[D:\Program Files\Tencent\QQ\QQBaseClassInDll.dll]  [TENCENT, 7,0,431,1723]
[D:\Program Files\Tencent\QQ\QQHelperDll.dll]  [TENCENT, 7,0,431,1723]
[D:\Program Files\Tencent\QQ\BasicCtrlDll.dll]  [TENCENT, 7, 0, 431, 1723]
[D:\Program Files\Tencent\QQ\MFC42.DLL]  [Microsoft Corporation, 6.00.8665.0]
[D:\Program Files\360safe\safemon\safemon.dll]  [奇虎网, 3, 6, 4, 1001]
[D:\Program Files\Tencent\QQ\RICHED32.DLL]  [Microsoft Corporation, 5.00.2134.1]
[D:\Program Files\Tencent\QQ\RICHED20.dll]  [Microsoft Corporation, 5.31.23.1218]
[D:\Program Files\Tencent\QQ\QQAPI.dll]  [TENCENT, 7,0,431,1723]
[d:\Program Files\Tencent\QQ\TIMProxy.dll]  [tencent, 0, 3, 2, 4]
[D:\Program Files\Tencent\QQ\LoginCtrl.dll]  [TENCENT, 7,0,431,1723]
[D:\Program Files\Tencent\QQ\LoginCtrlRes.dll]  [TENCENT, 7,0,431,1723]
[D:\Program Files\Tencent\QQ\QQRes.dll]  [TENCENT, 7,0,431,1723]
[D:\Program Files\Tencent\QQ\QQMainFrame.dll]  [N/A, ]
[D:\Program Files\Tencent\QQ\gdiplus.dll]  [Microsoft Corporation, 5.1.3102.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\Program Files\Tencent\QQ\UnReadMsgMgr.dll]  [N/A, ]
[D:\Program Files\Tencent\QQ\CQQApplication.dll]  [N/A, ]
[D:\Program Files\Tencent\QQ\FlashAvatarDll.dll]  [, 1, 4, 0, 1]
[D:\Program Files\Tencent\QQ\NewSkin.dll]  [TENCENT, 7,0,431,1723]
[D:\Program Files\Tencent\QQ\MailSummary.dll]  [TENCENT, 7,0,431,1723]
[D:\Program Files\Tencent\QQ\QQKnowledgeSearch.dll]  [TENCENT, 7,0,431,1723]
[D:\Program Files\Tencent\QQ\QQAllInOne.dll]  [TENCENT, 7,0,431,1723]
[D:\Program Files\Tencent\QQ\SCCore.dll]  [TENCENT, 1, 6, 0, 2]
[D:\Program Files\Tencent\QQ\CameraDll.dll]  [TENCENT, 7,0,431,1723]
[D:\Program Files\Tencent\QQ\QQSpace.dll]  [TENCENT, 7,0,431,1723]
[D:\Program Files\Tencent\QQ\vbscript.dll]  [Microsoft Corporation, 5.6.0.7426]
[C:\WINDOWS\system32\msdmo.dll]  [, ]
[D:\Program Files\Tencent\QQ\QQGroupMng.dll]  [TENCENT, 7,0,431,1723]
[D:\Program Files\Tencent\QQ\UserDefinedHead.dll]  [TENCENT, 7,0,431,1723]
[D:\Program Files\Tencent\QQ\QQPlugin.dll]  [N/A, ]
[D:\Program Files\Tencent\QQ\QQConfigPlugin.dll]  [TENCENT, 7,0,431,1723]
[D:\Program Files\Tencent\QQ\PersonalDesktop.dll]  [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2]
[D:\Program Files\Tencent\QQ\QQAddr.dll]  [深圳市腾讯计算机系统有限公司, 5, 0, 101, 310]
[D:\Program Files\Tencent\QQ\QQSceneMng.dll]  [N/A, ]
[D:\Program Files\Tencent\QQ\AddrSearch.dll]  [腾讯科技（深圳）有限公司, 2, 1, 9, 97]
[D:\Program Files\Tencent\QQ\QQSettingCtrl.dll]  [TENCENT, 7,0,431,1723]
[PID: 3304 / Juan Bao Bao][d:\Program Files\Tencent\QQ\TIMPlatform.exe]  [TENCENT, 7,0,431,1723]
[D:\Program Files\360safe\safemon\safemon.dll]  [奇虎网, 3, 6, 4, 1001]
[d:\Program Files\Tencent\QQ\TIMProxy.dll]  [tencent, 0, 3, 2, 4]
[PID: 368 / Juan Bao Bao][D:\Program Files\Maxthon2\Maxthon.exe]  [Maxthon International ltd., 2, 0, 5, 7845]
[D:\Program Files\Maxthon2\MxExt.dll]  [N/A, ]
[D:\Program Files\Maxthon2\mxpp.dll]  [Maxthon, 1, 0, 0, 61]
[D:\Program Files\Maxthon2\MxSk.dll]  [Maxthon, 1, 0, 0, 349]
[D:\Program Files\Maxthon2\MxProxy2.dll]  [Maxthon, 1, 0, 0, 3573]
[D:\Program Files\Maxthon2\IMxWebBoost.dll]  [Maxthon, 1, 0, 0, 1]
[D:\Program Files\Maxthon2\mxdb.dll]  [Max, 1, 0, 0, 1]
[D:\Program Files\Maxthon2\mxsafe.dll]  [Maxthon, 1, 0, 0, 611]
[D:\Program Files\360safe\safemon\safemon.dll]  [奇虎网, 3, 6, 4, 1001]
[D:\Program Files\Maxthon2\MxFav.dll]  [Maxthon, 1, 0, 0, 220]
[D:\Program Files\Maxthon2\maxzlib.dll]  [, 1.2.3]
[D:\Program Files\Maxthon2\mxtool.dll]  [, 1, 0, 0, 1]
[D:\Program Files\Maxthon2\mxfeedU.dll]  [, 1, 0, 45, 89]
[C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL]  [Microsoft Corporation, 11.0.8164]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scrchpg.dll]  [Kaspersky Lab, 6.0.2.621]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll]  [Kaspersky Lab, 6.0.2.621]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prremote.dll]  [Kaspersky Lab, 6.0.2.621]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\MSVCP80.dll]  [Microsoft Corporation, 8.00.50727.42]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll]  [Kaspersky Lab, 6.0.2.621]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl]  [Kaspersky Lab, 6.0.2.621]
[d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl]  [Kaspersky Lab, 6.0.2.621]
[d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl]  [Kaspersky Lab, 6.0.2.621]
[d:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl]  [Kaspersky Lab, 6.0.2.621]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\Common Files\Microsoft Shared\INK\PENCHS.DLL]  [Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[C:\WINDOWS\system32\Macromed\Flash\Flash9d.ocx]  [Adobe Systems, Inc., 9,0,47,0]
[d:\Program Files\Thunder Network\Thunder\ComDlls\ThunderAgent_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 4, 23]
[d:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll]  [GRISOFT s.r.o., 7, 5, 1, 36]
[d:\Program Files\Thunder Network\Thunder\Program\XLNet.Dll]  [Thunder Networking Technologies,LTD, 1, 2, 1, 9]
[d:\Program Files\Thunder Network\Thunder\Program\BHOStub.dll]  [Thunder Networking Technologies,LTD, 1, 1, 0, 8]
[d:\Program Files\Thunder Network\Thunder\Components\DownAndPlay\DownAndPlay.dll]  [, 1, 0, 4, 22]
[d:\Program Files\Thunder Network\Thunder\Program\iTargetAD.dll]  [Thunder Networking Technologies,LTD, 1, 0, 2, 33]
[C:\WINDOWS\system32\Macromed\Flash\Flash9d.ocx]  [Adobe Systems, Inc., 9,0,47,0]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\Common Files\Microsoft Shared\INK\PENCHS.DLL]  [Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scrchpg.dll]  [Kaspersky Lab, 6.0.2.621]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll]  [Kaspersky Lab, 6.0.2.621]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prremote.dll]  [Kaspersky Lab, 6.0.2.621]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\MSVCP80.dll]  [Microsoft Corporation, 8.00.50727.42]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll]  [Kaspersky Lab, 6.0.2.621]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl]  [Kaspersky Lab, 6.0.2.621]
[d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl]  [Kaspersky Lab, 6.0.2.621]
[d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl]  [Kaspersky Lab, 6.0.2.621]
[d:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl]  [Kaspersky Lab, 6.0.2.621]
[d:\Program Files\Thunder Network\Thunder\Components\InMedia\iEmbedShell.dll]  [　, 1, 0, 0, 22]
[d:\Program Files\Thunder Network\Thunder\Components\InMedia\iEmbed13.dll]  [Thunder Networking Technologies,LTD, 3, 4, 4, 95]
[d:\Program Files\Thunder Network\Thunder\Components\InMedia\PlayerHelper.dll]  [thunder, 1, 1, 1, 28]
[d:\Program Files\Thunder Network\Thunder\Components\InMedia\XLNet.dll]  [Thunder Networking Technologies,LTD, 1, 2, 1, 9]
[d:\Program Files\Thunder Network\Thunder\Components\InMedia\XLIPC.DLL]  [N/A, ]
[d:\Program Files\Thunder Network\Thunder\Components\P4PClient\P4PClient.dll]  [Thunder Networking Technologies,LTD, 2, 2, 5, 70]
[d:\Program Files\Thunder Network\Thunder\Components\Community\XLCommunity.dll]  [Thunder Networking Technologies,LTD, 1, 4, 0, 7]
[d:\Program Files\Thunder Network\Thunder\Program\RegisterDll.dll]  [Thunder Networking Technologies,LTD, 2, 16, 5, 61]
[d:\Program Files\Thunder Network\Thunder\Program\MSVCIRT.dll]  [Microsoft Corporation, 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[d:\Program Files\Thunder Network\Thunder\Components\Security\ThunderSafe.dll]  [深圳市迅雷网络技术有限公司, 1, 0, 7, 60]

显示全部楼层 · 发表于 2007-11-28 23:03:22

[d:\Program Files\Thunder Network\Thunder\Program\ATL71.DLL]  [Microsoft Corporation, 7.10.3077.0]
[d:\Program Files\Thunder Network\Thunder\Components\Security\XLSafeUI.dll]  [深圳市迅雷网络技术有限公司, 1, 0, 7, 59]
[d:\Program Files\Thunder Network\Thunder\Components\Search\XLSearch.dll]  [Thunder Networking Technologies,LTD, 1, 1, 5, 18]
[d:\Program Files\Thunder Network\Thunder\Program\LiveUpdate.dll]  [Thunder Networking Technologies,LTD, 1, 2, 1, 20]
[d:\Program Files\Thunder Network\Thunder\Plugins\KLScan\PluginKLScan.dll]  [Thunder Networking Technologies,LTD, 1.1.0.6]
[d:\Program Files\Thunder Network\Thunder\Plugins\GouGouTop\GouGouTop.dll]  [Thunder Networking Technologies,LTD, 1, 0, 2, 4]
[d:\Program Files\Thunder Network\Thunder\Plugins\BhoAdv\bho_adv.dll]  [深圳市迅雷网络技术有限公司, 1.0.1.0]
[d:\Program Files\Thunder Network\Thunder\Plugins\XLSafeHost\XLSafeHost.dll]  [深圳市迅雷网络技术有限公司, 1, 0, 7, 54]
[d:\Program Files\Thunder Network\Thunder\Plugins\XLSafeHost\ThunderKAV\ThunderKAV.dll]  [深圳市迅雷网络技术有限公司, 1, 0, 5, 28]
[d:\Program Files\Thunder Network\Thunder\Plugins\KanKanTop\KanKanTop.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 2]
[d:\Program Files\Thunder Network\Thunder\Components\ExplorerHelper\ExplorerHelper.dll]  [Thunder Networking Technologies,LTD, 1, 0, 4, 16]
[d:\Program Files\Thunder Network\Thunder\Components\Tips\TipsClient.dll]  [Thunder Networking Technologies,LTD, 2, 2, 9, 97]
[d:\Program Files\Thunder Network\Thunder\Components\VPSHELL\VPSHELL.dll]  [XunLei, 2, 3, 0, 26]
[d:\Program Files\Thunder Network\Thunder\Components\VPSHELL\VideoPicture.dll]  [XunLei, 2, 3, 0, 26]
[d:\Program Files\Thunder Network\Thunder\Components\UserExperience\UserExperience.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
[d:\Program Files\Thunder Network\Thunder\Components\Tips\XLIPC.DLL]  [Thunder Networking Technologies,LTD, 1, 0, 0, 2]
[d:\Program Files\Thunder Network\Thunder\Components\ResWorker\DsXlCom.dll]  [, 1, 0, 0, 26]
[d:\Program Files\Thunder Network\Thunder\Components\ResWorker\DataProcessor_00.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 13]
[d:\Program Files\Thunder Network\Thunder\Components\ResWorker\MediaWorker.dll]  [Thunder Networking Technologies,LTD, 1, 2, 0, 20]
[d:\Program Files\Thunder Network\Thunder\Components\DownloadStat\DownloadStat.dll]  [深圳市迅雷网络技术有限公司, 1, 2, 0, 4]
[C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL]  [Microsoft Corporation, 11.0.8164]
[d:\Program Files\Thunder Network\Thunder\Plugins\XLSafeHost\ThunderKAV\bin\kave.dll]  [Kaspersky Lab., 5, 0, 0, 62]
[PID: 588 / Juan Bao Bao][d:\Program Files\Thunder Network\Thunder\Plugins\XLSafeHost\ThunderKAV\bin\ScanningProcess.exe]  [N/A, ]
[d:\Program Files\Thunder Network\Thunder\Plugins\XLSafeHost\ThunderKAV\bin\prloader.dll]  [Kaspersky Lab, 6.0.1.305]
[D:\Program Files\360safe\safemon\safemon.dll]  [奇虎网, 3, 6, 4, 1001]
[d:\Program Files\Thunder Network\Thunder\Plugins\XLSafeHost\ThunderKAV\bin\prkernel.ppl]  [Kaspersky Lab, 6.0.1.305]
[d:\program files\thunder network\thunder\plugins\xlsafehost\thunderkav\bin\prefetch.ppl]  [Kaspersky Labs, 1, 0, 0, 56]
[d:\program files\thunder network\thunder\plugins\xlsafehost\thunderkav\bin\avpmgr.ppl]  [Kaspersky Lab, 6.0.1.305]
[d:\program files\thunder network\thunder\plugins\xlsafehost\thunderkav\bin\wdiskio.ppl]  [Kaspersky Lab, 6.0.0.276]
[d:\program files\thunder network\thunder\plugins\xlsafehost\thunderkav\bin\nfio.ppl]  [Kaspersky Lab, 6.0.0.276]
[d:\program files\thunder network\thunder\plugins\xlsafehost\thunderkav\bin\avlib.ppl]  [Kaspersky Lab, 6.0.0.276]
[d:\program files\thunder network\thunder\plugins\xlsafehost\thunderkav\bin\dtreg.ppl]  [Kaspersky Lab, 6.0.0.276]
[d:\program files\thunder network\thunder\plugins\xlsafehost\thunderkav\bin\prutil.ppl]  [Kaspersky Lab, 6.0.0.276]
[d:\program files\thunder network\thunder\plugins\xlsafehost\thunderkav\bin\avp1.ppl]  [Kaspersky Lab, 6.0.0.299]
[d:\program files\thunder network\thunder\plugins\xlsafehost\thunderkav\bin\l_llio.ppl]  [Kaspersky Labs, 6.0.9.75]
[d:\program files\thunder network\thunder\plugins\xlsafehost\thunderkav\bin\ichstrms.ppl]  [Kaspersky Lab, 6.0.0.276]
[d:\program files\thunder network\thunder\plugins\xlsafehost\thunderkav\bin\hashcont.ppl]  [Kaspersky Lab, 6.0.0.276]
[d:\program files\thunder network\thunder\plugins\xlsafehost\thunderkav\bin\hccmp.ppl]  [Kaspersky Lab, 6.0.0.276]
[d:\program files\thunder network\thunder\plugins\xlsafehost\thunderkav\bin\uniarc.ppl]  [Kaspersky Lab, 6.0.0.16]
[d:\program files\thunder network\thunder\plugins\xlsafehost\thunderkav\bin\minizip.ppl]  [Kaspersky Lab, 6.0.0.16]
[d:\program files\thunder network\thunder\plugins\xlsafehost\thunderkav\bin\cab.ppl]  [Kaspersky Lab, 6.0.0.16]
[d:\program files\thunder network\thunder\plugins\xlsafehost\thunderkav\bin\arj.ppl]  [Kaspersky Lab, 6.0.0.16]
[d:\program files\thunder network\thunder\plugins\xlsafehost\thunderkav\bin\rar.ppl]  [Kaspersky Lab, 6.0.0.276]
[d:\program files\thunder network\thunder\plugins\xlsafehost\thunderkav\bin\mdb.ppl]  [Kaspersky Lab, 6.0.0.300]
[C:\WINDOWS\system32\MAPI32.dll]  [Microsoft Corporation, 1.0.2536.0 (XPClient.010817-1148)]
[d:\program files\thunder network\thunder\plugins\xlsafehost\thunderkav\bin\msoe.ppl]  [Kaspersky Lab, 6.0.0.276]
[d:\program files\thunder network\thunder\plugins\xlsafehost\thunderkav\bin\tempfile.ppl]  [Kaspersky Lab, 6.0.0.276]
[d:\program files\thunder network\thunder\plugins\xlsafehost\thunderkav\bin\iwgen.ppl]  [Kaspersky Lab, 6.0.0.276]
[d:\program files\thunder network\thunder\plugins\xlsafehost\thunderkav\bin\hashmd5.ppl]  [Kaspersky Lab, 6.0.0.276]
[d:\program files\thunder network\thunder\plugins\xlsafehost\thunderkav\bin\prseqio.ppl]  [Kaspersky Lab, 6.0.0.276]
[d:\program files\thunder network\thunder\plugins\xlsafehost\thunderkav\bin\inflate.ppl]  [Kaspersky Lab, 6.0.0.16]
[PID: 4060 / Juan Bao Bao][E:\TDDOWNLOAD\sreng2\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
[D:\Program Files\360safe\safemon\safemon.dll]  [奇虎网, 3, 6, 4, 1001]
[E:\TDDOWNLOAD\sreng2\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]==================================
文件关联
.TXT  Error. [C:\WINDOWS\notepad.exe %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  Error. ["hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1    localhost
==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 1948, C:\WINDOWS\VM_STI.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1988, D:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\AVG.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 1996, D:\PROGRAM FILES\360SAFE\SAFEMON\360TRAY.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1996, D:\PROGRAM FILES\360SAFE\SAFEMON\360TRAY.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2004, D:\PROGRAM FILES\360SAFE\ANTIARP\ANTIARP.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2636, C:\PROGRAM FILES\HUAWEI-3COM\H3C 802.1X 客户端\DOT1XCLIENT.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 2664, D:\PROGRAM FILES\THUNDER NETWORK\THUNDER\PROGRAM\THUNDER5.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2664, D:\PROGRAM FILES\THUNDER NETWORK\THUNDER\PROGRAM\THUNDER5.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 588, D:\PROGRAM FILES\THUNDER NETWORK\THUNDER\PLUGINS\XLSAFEHOST\THUNDERKAV\BIN\SCANNINGPROCESS.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 588, D:\PROGRAM FILES\THUNDER NETWORK\THUNDER\PLUGINS\XLSAFEHOST\THUNDERKAV\BIN\SCANNINGPROCESS.EXE]
==================================
API HOOK
N/A
==================================
隐藏进程
N/A
==================================

[/CODE]

显示全部楼层 · 发表于 2007-11-29 08:25:32

正为这事烦愁呢，现在更个楼的机器都这样，郁闷啊，过来学习一下

显示全部楼层 · 发表于 2007-11-29 16:49:11

建议使用XDelBox删除以下文件
复制所有要删除文件的路径，在待删除文件列表里点击右键选择从剪贴板导入,重启删除

2.删除重启后使用SREng修复下面各项：

**************以上分析报告由SREngLog分析助手提供******************
分析：草莽书生
时间：2007-11-29
SREngLog分析助手 1.3 (20070808 更新 BY 草莽书生)

自动清理方案操作步骤：

1。下载通用病毒杀灭机正式版(点击下载)，请先参考软件帮助说明。

2。复制符号区域的修复指令或者下载附件中的修复指令文件*.dat 。

========指令正文，复制以下内容========
复制指令区
复制代码

========指令结束，复制以上内容========

3。打开通用病毒杀灭机（打不开的建议改名，如abc.exe，abc.bat等），复制修复指令者使用剪贴板导入；下载修复指令文件的使用文件导入
重启即可删除病毒，并帮助你删除自启动项和禁用服务。

（注：第一次重启有时候会弹出文件夹，那是由于自启动项目还没有删除，而文件已经被XDELBOX删除并用文件夹替代的结果）

显示全部楼层 · 发表于 2007-11-29 19:18:51

谢谢楼上的同志，我知道怎么做了谢谢，我自己的机器应该没有中毒，应该是局域网里某台机器发出的ARP攻击

显示全部楼层 · 发表于 2007-12-1 12:57:03

我的电脑也有一样的问题出现，就是那个可恶的IP560.com ，
不论打开什么网页都是转到那个网页，造成网页打不开。
不过我主要是用处理ARP病毒的措施来处理的。
现在好了

显示全部楼层 · 发表于 2007-12-1 18:34:39

可以用hosts来屏蔽这个网址

[已解决] 怎么杀这个木马-www.ip560.com？

浏览过的版块