收藏本站 |切换到宽版 | 更换论坛皮肤
 找回密码  忘记邮箱  QQ快速登录  快速登录  快速注册

卡饭»论坛 › 安全区 › 国内杀毒软件 › 360 › 我用卡巴扫描不出病毒 但是用AVG 和360扫到一些木马 应 ...
返回列表 发新帖
查看: 2304|回复: 0
收起左侧

我用卡巴扫描不出病毒 但是用AVG 和360扫到一些木马 应该还有

[复制链接]
dudulovejiao
发表于 2007-12-29 15:32:30 | 显示全部楼层 |阅读模式
能否指点下。。。。。。有问题么？ 麻烦了


  2. 2007-12-29,15:22:07
  3. System Repair Engineer 2.5.16.900
  4. Smallfrogs (http://www.KZTechs.com)
  5. Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
  6. 以下内容被选中：
  7.     所有的启动项目（包括注册表、启动文件夹、服务等）
  8.     浏览器加载项
  9.     正在运行的进程（包括进程模块信息）
  10.     文件关联
  11.     Winsock 提供者
  12.     Autorun.inf
  13.     HOSTS 文件
  14.     进程特权扫描

  16. 启动项目
  17. 注册表
  18. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  19.     <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
  20. [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  21.     <load><>  [N/A]
  22.     <run><>  [N/A]
  23. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  24.     <NetKeeper2.5><C:\Program Files\ChinaNetSn\bin\NetKeeper.exe>  [西安信利软件有限公司]
  25.     <AVP><"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe">  [Kaspersky Lab]
  26.     <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>  [NVIDIA Corporation]
  27.     <FY_FireWall><C:\Program Files\FengYun\FYFireWall.exe>  [www.218.cc]
  28. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  29.     <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
  30.     <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
  31. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  32.     <AppInit_DLLs><>  [N/A]
  33. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  34.     <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
  35. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
  36.     <WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll>  [Kaspersky Lab]
  37. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
  38.     <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [N/A]
  39. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
  40.     <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]
  41. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
  42.     <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]
  43. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
  44.     <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
  45. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
  46.     <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
  47. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
  48.     <Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser>  [(Verified)Microsoft Windows Publisher]
  49. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
  50.     <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub>  [(Verified)Microsoft Windows Component Publisher]
  51. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
  52.     <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]
  53.     <NvCplDaemon><; RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>  [NVIDIA Corporation]
  54.     <PHIME2002A><; >  [N/A]
  55.     <PHIME2002ASync><; >  [N/A]
  56.     <StormCodec_Helper><; "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti>  []
  57.     <TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
  58. ==================================
  59. 启动文件夹
  60. N/A
  61. ==================================
  62. 服务
  63. [AVG Anti-Spyware Guard / AVG Anti-Spyware Guard][Running/Auto Start]
  64.   <C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe><GRISOFT s.r.o.>
  65. [卡巴斯基反病毒6.0个人版 / AVP][Running/Auto Start]
  66.   <"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r><Kaspersky Lab>
  67. [Contrl Center of Storm Media / ccosm][Stopped/Disabled]
  68.   <C:\Program Files\StormII\stormliv.exe /asservice><北京暴风网际科技有限公司>
  69. [Human Interface Device Access / HidServ][Stopped/Disabled]
  70.   <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
  71. [Volume Shadow Copyrezb9 / ServiceCopyrezb9][Stopped/Auto Start]
  72.   <><N/A>
  73. ==================================
  74. 驱动程序
  75. [Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Stopped/Manual Start]
  76.   <system32\drivers\ac97intc.sys><Intel Corporation>
  77. [Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  78.   <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
  79. [AMD K8 Processor Driver / AmdK8][Stopped/Manual Start]
  80.   <System32\DRIVERS\amdk8.sys><Advanced Micro Devices>
  81. [AVG Anti-Spyware Driver / AVG Anti-Spyware Driver][Running/System Start]
  82.   <\??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys><N/A>
  83. [AVG Anti-Spyware Clean Driver / AvgAsCln][Running/System Start]
  84.   <System32\DRIVERS\AvgAsCln.sys><GRISOFT, s.r.o.>
  85. [f4qjvkaqg / f4qjvkaqg6][Stopped/Boot Start]
  86.   <\SystemRoot\System32\DRIVERS\f4qjvkaqg6.sys><N/A>
  87. [VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Stopped/Manual Start]
  88.   <system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
  89. [FYTdifltDrv / FYTdifltDrv][Running/System Start]
  90.   <\??\C:\Program Files\FengYun\FYTdiDrv.sys><N/A>
  91. [kl1 / kl1][Running/Boot Start]
  92.   <\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
  93. [klif / klif][Running/System Start]
  94.   <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
  95. [Netpas Win32 Virtual Network Adapter / netpasadapter1][Stopped/Manual Start]
  96.   <system32\DRIVERS\netpas.sys><Netpas>
  97. [Netgroup Packet Filter / NPF][Running/Manual Start]
  98.   <system32\DRIVERS\npf.sys><CACE Technologies>
  99. [npkcrypt / npkcrypt][Running/Auto Start]
  100.   <\??\D:\Tencent\QQN\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
  101. [nv / nv][Running/Manual Start]
  102.   <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
  103. [Motorola USB Device / P2k][Stopped/Manual Start]
  104.   <system32\DRIVERS\P2k.sys><Motorola Inc>
  105. [pgndqf / pgndqf][Stopped/Boot Start]
  106.   <\SystemRoot\\SystemRoot\System32\drivers\pgndqf.sys><N/A>
  107. [Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  108.   <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
  109. [Realtek 10/100/1000 NIC Family all in one NDIS XP Driver / RTL8023xp][Running/Manual Start]
  110.   <system32\DRIVERS\Rtnicxp.sys><Realtek Semiconductor Corporation>
  111. [Secdrv / Secdrv][Stopped/Manual Start]
  112.   <system32\DRIVERS\secdrv.sys><N/A>
  113. [SkyProcs / SkyProcs][Stopped/Manual Start]
  114.   <\??\C:\Program Files\SkyNet\FireWall\SkyProcs.sys><N/A>
  115. [TSP / TSP][Stopped/Manual Start]
  116.   <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
  117. [Driver for XLPPoEPC Device / XLPPoEPC][Running/Manual Start]
  118.   <system32\DRIVERS\XLPPoEPC.sys><西安信利软件系统公司>
  119. [ymczo56 / ymczo56][Stopped/Auto Start]
  120.   <\??\C:\WINDOWS\system32\drivers\ymczo56.sys><N/A>
  121. ==================================
  122. 浏览器加载项
  123. [Web反病毒统计]
  124.   {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll, Kaspersky Lab>
  125. [信息检索(&R)]
  126.   {92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
  127. [Office Genuine Advantage Validation Tool]
  128.   {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} <C:\WINDOWS\system32\OGACheckControl.DLL, >
  129. [Windows Genuine Advantage Validation Tool]
  130.   {17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft Corporation>
  131. [PhotoDraw Class]
  132.   {2375BEE5-F175-4F1C-81EC-8E4E2E72E2DD} <C:\WINDOWS\system32\QQPhotoDraw.dll, TENCENT>
  133. [EditCtrl Class]
  134.   {488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\system32\aliedit\aliedit.dll, >
  135. [ScreenCapture Class]
  136.   {B4D9857D-8A55-4442-A577-6B3ED5D4E41B} <C:\WINDOWS\system32\FMO.dll, Tencent Inc.>
  137. [Shockwave Flash Object]
  138.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9d.ocx, Adobe Systems, Inc.>
  139. [PasswordEditCtrl Class]
  140.   {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
  141. [Windows Media Player]
  142.   {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
  143. [360SafeLive]
  144.   {87515F61-A66C-4319-A0E0-D416CB8059E3} <D:\360safe\live.dll, 360safe.com>
  145. [SearchAssistantOC]
  146.   {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
  147. [NavigatMon Class]
  148.   {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <D:\360safe\safemon\safemon.dll, 奇虎网>
  149. [Shockwave Flash Object]
  150.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9d.ocx, Adobe Systems, Inc.>
  151. [使用迅雷下载]
  152.   <C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
  153. [使用迅雷下载全部链接]
  154.   <C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
  155. [导出到 Microsoft Office Excel(&X)]
  156.   <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
  157. [添加到QQ表情]
  158.   <D:\Tencent\QQ\AddEmotion.htm, N/A>
  159. [用比特精灵下载(&B)]
  160.   <D:\BitSpirit\bsurl.htm, N/A>
  161. ==================================
  162. 正在运行的进程
  163. [PID: 760 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  164. [PID: 832 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  165. [PID: 856 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  166.     [C:\WINDOWS\system32\klogon.dll]  [Kaspersky Lab, 6.0.2.621]
  167.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  168. [PID: 900 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  169. [PID: 912 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  170. [PID: 1064 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  171. [PID: 1136 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  172. [PID: 1252 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  173.     [C:\WINDOWS\system32\wups2.dll]  [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]
  174. [PID: 1316 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  175. [PID: 1464 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  176. [PID: 1620 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
  177. [PID: 1836 / DSR][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
  178.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scrchpg.dll]  [Kaspersky Lab, 6.0.2.621]
  179.     [C:\Program Files\FengYun\fymon.dll]  [www.218.cc, 1.2.3.75]
  180.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  181.     [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
  182.     [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
  183.     [C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll]  [GRISOFT s.r.o., 7, 5, 1, 36]
  184.     [C:\Program Files\Unlocker\UnlockerCOM.dll]  [N/A, ]
  185.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\ShellEx.dll]  [Kaspersky Lab, 6.0.2.621]
  186.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]
  187.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\MSVCP80.dll]  [Microsoft Corporation, 8.00.50727.42]
  188.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prremote.dll]  [Kaspersky Lab, 6.0.2.621]
  189.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll]  [Kaspersky Lab, 6.0.2.621]
  190.     [C:\WINDOWS\system32\SOGOUPY.IME]  [Sohu.com Inc., 3, 0, 0, 0]
  191.     [C:\WINDOWS\system32\dllMergeDict.dll]  [Sogou.com Inc., 3, 0, 0, 0]
  192.     [D:\搜狗输入法\SogouInput\Plugin\SgImeWord.dll]  [, 1, 0, 0, 31]
  193. [PID: 1952 / SYSTEM][C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe]  [GRISOFT s.r.o., 7, 5, 1, 22]
  194.     [C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\engine.dll]  [GRISOFT s.r.o., 4, 2, 0, 19]
  195. [PID: 152 / SYSTEM][C:\WINDOWS\system32\nvsvc32.exe]  [NVIDIA Corporation, 6.14.10.8198]
  196. [PID: 240 / LOCAL SERVICE][C:\WINDOWS\system32\wdfmgr.exe]  [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
  197. [PID: 284 / DSR][C:\Program Files\ChinaNetSn\bin\NetKeeper.exe]  [西安信利软件有限公司, 0, 0, 1, 6]
  198.     [C:\Program Files\FengYun\fymon.dll]  [www.218.cc, 1.2.3.75]
  199.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scrchpg.dll]  [Kaspersky Lab, 6.0.2.621]
  200.     [C:\Program Files\ChinaNetSn\bin\detector.dll]  [西安信利软件系统有限公司, 1, 0, 0, 2]
  201.     [C:\WINDOWS\system32\wpcap.dll]  [CACE Technologies, 3, 1, 0, 27]
  202.     [C:\WINDOWS\system32\packet.dll]  [CACE Technologies, 3, 1, 0, 27]
  203.     [C:\WINDOWS\system32\WanPacket.dll]  [CACE Technologies, 3, 1, 0, 27]
  204.     [C:\Program Files\ChinaNetSn\bin\updatemode.dll]  [西安信利软件科技有限公司, 1, 0, 0, 4]
  205.     [C:\Program Files\ChinaNetSn\bin\DLmode.dll]  [, 1, 0, 0, 1]
  206.     [C:\Program Files\ChinaNetSn\bin\doload.dll]  [, 1, 0, 0, 2]
  207.     [C:\WINDOWS\system32\XLPPoEPCIoctl.dll]  [N/A, ]
  208.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\klscav.dll]  [Kaspersky Lab, 6.0.2.621]
  209.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]
  210.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prremote.dll]  [Kaspersky Lab, 6.0.2.621]
  211.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\MSVCP80.dll]  [Microsoft Corporation, 8.00.50727.42]
  212.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll]  [Kaspersky Lab, 6.0.2.621]
  213.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prkernel.ppl]  [Kaspersky Lab, 6.0.2.621]
  214.     [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\params.ppl]  [Kaspersky Lab, 6.0.2.621]
  215.     [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\pxstub.ppl]  [Kaspersky Lab, 6.0.2.621]
  216.     [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\tempfile.ppl]  [Kaspersky Lab, 6.0.2.621]
  217.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  218. [PID: 532 / DSR][C:\Program Files\FengYun\FYFireWall.exe]  [www.218.cc, 1.2.6.0]
  219.     [C:\Program Files\FengYun\arpinfo.dll]  [N/A, ]
  220.     [C:\Program Files\FengYun\fymon.dll]  [www.218.cc, 1.2.3.75]
  221. [PID: 540 / DSR][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  222.     [C:\Program Files\FengYun\fymon.dll]  [www.218.cc, 1.2.3.75]
  223. [PID: 1704 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  224. [PID: 508 / DSR][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
  225. ==================================
  226. 文件关联
  227. .TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
  228. .EXE  OK. ["%1" %*]
  229. .COM  OK. ["%1" %*]
  230. .PIF  OK. ["%1" %*]
  231. .REG  OK. [regedit.exe "%1"]
  232. .BAT  OK. ["%1" %*]
  233. .SCR  OK. ["%1" /S]
  234. .CHM  OK. ["C:\WINDOWS\hh.exe" %1]
  235. .HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
  236. .INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
  237. .INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
  238. .VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
  239. .JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
  240. .LNK  OK. [{00021401-0000-0000-C000-000000000046}]
  241. ==================================
  242. Winsock 提供者
  243. N/A
  244. ==================================
  245. Autorun.inf
  246. N/A
  247. ==================================
  248. HOSTS 文件
  249. 127.0.0.1       localhost
  250. ==================================
  251. 进程特权扫描
  252. 特殊特权被允许： SeLoadDriverPrivilege [PID = 152, C:\WINDOWS\SYSTEM32\NVSVC32.EXE]
  253. 特殊特权被允许： SeSystemtimePrivilege [PID = 284, C:\PROGRAM FILES\CHINANETSN\BIN\NETKEEPER.EXE]
  254. 特殊特权被允许： SeDebugPrivilege [PID = 284, C:\PROGRAM FILES\CHINANETSN\BIN\NETKEEPER.EXE]
  255. 特殊特权被允许： SeLoadDriverPrivilege [PID = 284, C:\PROGRAM FILES\CHINANETSN\BIN\NETKEEPER.EXE]
  256. 特殊特权被允许： SeSystemtimePrivilege [PID = 532, C:\PROGRAM FILES\FENGYUN\FYFIREWALL.EXE]
  257. 特殊特权被允许： SeDebugPrivilege [PID = 532, C:\PROGRAM FILES\FENGYUN\FYFIREWALL.EXE]
  258. 特殊特权被允许： SeLoadDriverPrivilege [PID = 532, C:\PROGRAM FILES\FENGYUN\FYFIREWALL.EXE]
  259. ==================================
  260. API HOOK
  261. RVA  错误： LoadLibraryA (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
  262. RVA  错误： LoadLibraryExA (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
  263. RVA  错误： LoadLibraryExW (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
  264. RVA  错误： LoadLibraryW (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
  265. RVA  错误： GetProcAddress (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
  266. ==================================
  267. 隐藏进程
  268. N/A
  269. ==================================
复制代码
回复

举报

返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2025-1-21 18:58 , Processed in 0.130156 second(s), 17 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究，不得将上述内容用于商业或者其他非法用途，否则产生的一切后果自负，本站信息来自网络，版权争议问题与本站无关，您必须在下载后的24小时之内从您的电脑中彻底删除上述信息，如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表