正在运行的进程
[PID: 1088 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1160 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1184 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\mpfans\Micropoint\mp110031.dll] [Micropoint Corporation, 1.2.10043]
[C:\WINDOWS\system32\klogon.dll] [Kaspersky Lab, 7.0.0.125]
[PID: 1228 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\mpfans\Micropoint\mp110031.dll] [Micropoint Corporation, 1.2.10043]
[PID: 1240 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\mpfans\Micropoint\mp110031.dll] [Micropoint Corporation, 1.2.10043]
[C:\WINDOWS\system32\xnetgdn.dll] [Filseclab Corporation, 3, 6, 0, 3304]
[C:\WINDOWS\system32\SPORDER.dll] [Microsoft Corporation, 5.00.1980.1]
[PID: 1420 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\mpfans\Micropoint\mp110031.dll] [Micropoint Corporation, 1.2.10043]
[PID: 1672 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\mpfans\Micropoint\mp110031.dll] [Micropoint Corporation, 1.2.10043]
[C:\WINDOWS\system32\xnetgdn.dll] [Filseclab Corporation, 3, 6, 0, 3304]
[C:\WINDOWS\system32\SPORDER.dll] [Microsoft Corporation, 5.00.1980.1]
[PID: 416 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\mpfans\Micropoint\mp110031.dll] [Micropoint Corporation, 1.2.10043]
[C:\WINDOWS\system32\xnetgdn.dll] [Filseclab Corporation, 3, 6, 0, 3304]
[C:\WINDOWS\System32\SPORDER.dll] [Microsoft Corporation, 5.00.1980.1]
[PID: 740 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\mpfans\Micropoint\mp110031.dll] [Micropoint Corporation, 1.2.10043]
[C:\WINDOWS\system32\xnetgdn.dll] [Filseclab Corporation, 3, 6, 0, 3304]
[C:\WINDOWS\system32\SPORDER.dll] [Microsoft Corporation, 5.00.1980.1]
[PID: 936 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\mpfans\Micropoint\mp110031.dll] [Micropoint Corporation, 1.2.10043]
[C:\WINDOWS\system32\xnetgdn.dll] [Filseclab Corporation, 3, 6, 0, 3304]
[C:\WINDOWS\system32\SPORDER.dll] [Microsoft Corporation, 5.00.1980.1]
[PID: 1736 / Administrator][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\mpfans\Micropoint\mp110031.dll] [Micropoint Corporation, 1.2.10043]
[D:\Kingsoft\KPP\KPPShellEx.dll] [Kingsoft Corporation, 2008,01,31,1158]
[D:\Kingsoft\KPP\KPPShell.dll] [Kingsoft Corporation, 2008,01,31,1158]
[D:\Kingsoft\KPP\MSVCP60.dll] [Microsoft Corporation, 6.02.3104.0]
[PID: 1988 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[D:\mpfans\Micropoint\mp110031.dll] [Micropoint Corporation, 1.2.10043]
[PID: 516 / Administrator][D:\VMware Workstation\vmware-tray.exe] [VMware, Inc., 6.0.0 build-45731]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[D:\VMware Workstation\vmwarebase.DLL] [VMware, Inc., 6.0.0 build-45731]
[D:\VMware Workstation\vmcryptolib.DLL] [VMware, Inc., 6.0.0 build-43577]
[D:\VMware Workstation\libxml2.dll] [N/A, ]
[D:\VMware Workstation\iconv.dll] [Free Software Foundation, 1.9]
[D:\VMware Workstation\zlib1.dll] [, 1.2.3]
[D:\VMware Workstation\vmcuiutil.dll] [VMware, Inc., 6.0.0 build-45731]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[D:\VMware Workstation\sigc-2.0.dll] [The libsigc++ development team (see AUTHORS), 2.0.17]
[D:\VMware Workstation\libeay32.dll] [Eric Young, The OpenSSL Project, VMware Inc., OpenSSL 0.9.7l (VMware build 100)]
[D:\VMware Workstation\ssleay32.dll] [Eric Young, The OpenSSL Project, VMware Inc., OpenSSL 0.9.7l (VMware build 100)]
[D:\mpfans\Micropoint\mp110031.dll] [Micropoint Corporation, 1.2.10043]
[D:\VMware Workstation\vmnetMgr.dll] [VMware, Inc., 6.0.0 build-45731]
[D:\VMware Workstation\VNETLIB.dll] [VMware, Inc., 6.0.0 build-45731]
[D:\Kingsoft\KPP\KPPShell.dll] [Kingsoft Corporation, 2008,01,31,1158]
[PID: 532 / Administrator][D:\Filseclab\xnetgdn\xnetgdn.exe] [费尔安全实验室, 3, 6, 0, 4636]
[C:\WINDOWS\system32\xnetgdn.dll] [Filseclab Corporation, 3, 6, 0, 3304]
[C:\WINDOWS\system32\SPORDER.dll] [Microsoft Corporation, 5.00.1980.1]
[D:\mpfans\Micropoint\mp110031.dll] [Micropoint Corporation, 1.2.10043]
[D:\Kingsoft\KPP\KPPShell.dll] [Kingsoft Corporation, 2008,01,31,1158]
[D:\Kingsoft\KPP\MSVCP60.dll] [Microsoft Corporation, 6.02.3104.0]
[PID: 596 / Administrator][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\Kingsoft\KPP\KPPShell.dll] [Kingsoft Corporation, 2008,01,31,1158]
[D:\Kingsoft\KPP\MSVCP60.dll] [Microsoft Corporation, 6.02.3104.0]
[PID: 620 / Administrator][D:\Kingsoft\KPP\KPPMain.exe] [Kingsoft Corporation, 2008,01,31,1158]
[D:\Kingsoft\KPP\KAccoreCtrl.dll] [TODO: <公司名>, 1.0.0.1]
[D:\Kingsoft\KPP\MSVCP60.dll] [Microsoft Corporation, 6.02.3104.0]
[D:\Kingsoft\KPP\infoc.dll] [Kingsoft Corporation, 1,0,0,19]
[D:\Kingsoft\KPP\KPPShell.dll] [Kingsoft Corporation, 2008,01,31,1158]
[D:\mpfans\Micropoint\mp110031.dll] [Micropoint Corporation, 1.2.10043]
[D:\Kingsoft\KPP\KPPShellEx.dll] [Kingsoft Corporation, 2008,01,31,1158]
[C:\WINDOWS\system32\xnetgdn.dll] [Filseclab Corporation, 3, 6, 0, 3304]
[C:\WINDOWS\system32\SPORDER.dll] [Microsoft Corporation, 5.00.1980.1]
[PID: 736 / Administrator][D:\Kingsoft\KPP\kaccore.exe] [Kingsoft Corp. Ltd., 14.0.0.0]
[D:\mpfans\Micropoint\mp110031.dll] [Micropoint Corporation, 1.2.10043]
[C:\WINDOWS\system32\xnetgdn.dll] [Filseclab Corporation, 3, 6, 0, 3304]
[C:\WINDOWS\system32\SPORDER.dll] [Microsoft Corporation, 5.00.1980.1]
[D:\Kingsoft\KPP\KPPShell.dll] [Kingsoft Corporation, 2008,01,31,1158]
[D:\Kingsoft\KPP\MSVCP60.dll] [Microsoft Corporation, 6.02.3104.0]
[D:\Kingsoft\KPP\ksrproxy.dll] [Kingsoft Corp. Ltd., 15.0.0.0]
[D:\Kingsoft\KPP\KAVRep.DLL] [Kingsoft Corporation, 2008,01,15,154]
[D:\Kingsoft\KPP\KAEAutorunEx.DLL] [Kingsoft Corporation, 2007,11,13,129]
[PID: 524 / SYSTEM][C:\WINDOWS\system32\nvsvc32.exe] [NVIDIA Corporation, 6.14.11.6501]
[D:\mpfans\Micropoint\mp110031.dll] [Micropoint Corporation, 1.2.10043]
[C:\WINDOWS\system32\nvapi.dll] [NVIDIA Corporation, 6.14.11.6501]
[PID: 2276 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\mpfans\Micropoint\mp110031.dll] [Micropoint Corporation, 1.2.10043]
[PID: 2676 / SYSTEM][C:\WINDOWS\system32\vmnat.exe] [VMware, Inc., 6.0.0 build-45731]
[D:\mpfans\Micropoint\mp110031.dll] [Micropoint Corporation, 1.2.10043]
[PID: 2960 / SYSTEM][C:\WINDOWS\system32\vmnetdhcp.exe] [VMware, Inc., 6.0.0 build-45731]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[D:\mpfans\Micropoint\mp110031.dll] [Micropoint Corporation, 1.2.10043]
[PID: 1804 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\mpfans\Micropoint\mp110031.dll] [Micropoint Corporation, 1.2.10043]
[C:\WINDOWS\system32\xnetgdn.dll] [Filseclab Corporation, 3, 6, 0, 3304]
[C:\WINDOWS\System32\SPORDER.dll] [Microsoft Corporation, 5.00.1980.1]
[PID: 3480 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\mpfans\Micropoint\mp110031.dll] [Micropoint Corporation, 1.2.10043]
[PID: 1000 / Administrator][D:\Program Files\Mozilla Firefox\firefox.exe] [Mozilla Corporation, 1.8.1.12: 2008020121]
[D:\Program Files\Mozilla Firefox\js3250.dll] [Netscape Communications Corporation, 4.0]
[D:\Program Files\Mozilla Firefox\nspr4.dll] [Netscape Communications Corporation, 4.6.8]
[D:\Program Files\Mozilla Firefox\xpcom_core.dll] [Mozilla Foundation, 1.8.1.12: 2008020121]
[D:\Program Files\Mozilla Firefox\plc4.dll] [Netscape Communications Corporation, 4.6.8]
[D:\Program Files\Mozilla Firefox\plds4.dll] [Netscape Communications Corporation, 4.6.8]
[D:\Program Files\Mozilla Firefox\smime3.dll] [Mozilla Foundation, 3.11.5 Basic ECC]
[D:\Program Files\Mozilla Firefox\nss3.dll] [Mozilla Foundation, 3.11.5 Basic ECC]
[D:\Program Files\Mozilla Firefox\softokn3.dll] [Mozilla Foundation, 3.11.4 Basic ECC]
[D:\Program Files\Mozilla Firefox\ssl3.dll] [Mozilla Foundation, 3.11.5 Basic ECC]
[D:\Program Files\Mozilla Firefox\xpcom_compat.dll] [Mozilla Foundation, 1.8.1.12: 2008020121]
[D:\mpfans\Micropoint\mp110031.dll] [Micropoint Corporation, 1.2.10043]
[D:\Program Files\Mozilla Firefox\components\myspell.dll] [Mozilla Foundation, 1.8.1.12: 2008020121]
[C:\WINDOWS\system32\xnetgdn.dll] [Filseclab Corporation, 3, 6, 0, 3304]
[C:\WINDOWS\system32\SPORDER.dll] [Microsoft Corporation, 5.00.1980.1]
[D:\Program Files\Mozilla Firefox\components\jar50.dll] [Mozilla Foundation, 1.8.1.12: 2008020121]
[D:\Kingsoft\KPP\KPPShell.dll] [Kingsoft Corporation, 2008,01,31,1158]
[D:\Kingsoft\KPP\MSVCP60.dll] [Microsoft Corporation, 6.02.3104.0]
[D:\Program Files\Mozilla Firefox\freebl3.dll] [Mozilla Foundation, 3.11.4 Basic ECC]
[D:\Program Files\Mozilla Firefox\nssckbi.dll] [Mozilla Foundation, 1.64]
[D:\Program Files\Mozilla Firefox\components\spellchk.dll] [Mozilla Foundation, 1.8.1.12: 2008020121]
[D:\Program Files\Mozilla Firefox\components\ThunderComponent.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 8]
[D:\Program Files\Mozilla Firefox\xpcom.dll] [Mozilla Foundation, 1.8.1.12: 2008020121]
[D:\Program Files\Mozilla Firefox\plugins\NPSWF32.dll] [, ]
[C:\Program Files\Thunder\ComDlls\ThunderAgent_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 3, 20]
[PID: 3392 / Administrator][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 788 / Administrator][E:\Tencent\qq\QQ.exe] [TENCENT, 7,1,638,1773]
[E:\Tencent\qq\QQBaseClassInDll.dll] [TENCENT, 7,1,638,1773]
[E:\Tencent\qq\QQHelperDll.dll] [TENCENT, 7,1,638,1773]
[E:\Tencent\qq\BasicCtrlDll.dll] [TENCENT, 7,1,638,1773]
[E:\Tencent\qq\IPPlugin.dll] [Softdiy, 飘云]
[E:\Tencent\qq\ipaddr.dll] [N/A, ]
[E:\Tencent\qq\QQAPI.dll] [TENCENT, 7,1,638,1773]
[D:\mpfans\Micropoint\mp110031.dll] [Micropoint Corporation, 1.2.10043]
[E:\Tencent\qq\LoginCtrl.dll] [TENCENT, 7,1,638,1773]
[E:\Tencent\qq\LoginCtrlRes.dll] [TENCENT, 7,1,638,1773]
[E:\Tencent\qq\QQRes.dll] [TENCENT, 7,0,431,1723]
[E:\Tencent\qq\QQMainFrame.dll] [N/A, ]
[E:\Tencent\qq\QQPlugin.dll] [N/A, ]
[D:\Kingsoft\KPP\KPPShell.dll] [Kingsoft Corporation, 2008,01,31,1158]
[E:\Tencent\qq\UnReadMsgMgr.dll] [N/A, ]
[E:\Tencent\qq\CQQApplication.dll] [N/A, ]
[E:\Tencent\qq\FlashAvatarDll.dll] [, 1, 4, 0, 1]
[E:\Tencent\qq\NewSkin.dll] [TENCENT, 7,1,638,1773]
[E:\Tencent\qq\MailSummary.dll] [TENCENT, 7,1,638,1773]
[E:\Tencent\qq\QQSpace.dll] [TENCENT, 7,1,638,1773]
[C:\WINDOWS\system32\xnetgdn.dll] [Filseclab Corporation, 3, 6, 0, 3304]
[C:\WINDOWS\system32\SPORDER.dll] [Microsoft Corporation, 5.00.1980.1]
[C:\WINDOWS\system32\msdmo.dll] [, ]
[E:\Tencent\qq\QQKnowledgeSearch.dll] [TENCENT, 7,1,638,1773]
[E:\Tencent\qq\OEMApplication.dll] [TENCENT, 7,1,638,1773]
[E:\Tencent\qq\QQGroupMng.dll] [TENCENT, 7,1,638,1773]
[E:\Tencent\qq\QQAvatar.dll] [N/A, ]
[E:\Tencent\qq\QQAllInOne.dll] [TENCENT, 7,1,638,1773]
[E:\Tencent\qq\SCCore.dll] [TENCENT, 1, 6, 0, 2]
[E:\Tencent\qq\CameraDll.dll] [TENCENT, 7,1,638,1773]
[E:\Tencent\qq\QQSysMsgMng.dll] [N/A, ]
[E:\Tencent\qq\UserDefinedHead.dll] [TENCENT, 7,1,638,1773]
[E:\Tencent\qq\QQConfigPlugin.dll] [TENCENT, 7,1,638,1773]
[E:\Tencent\qq\QQCustomFace.dll] [N/A, ]
[E:\Tencent\qq\QRingMng.dll] [N/A, ]
[E:\Tencent\qq\LongConnection.dll] [TENCENT, 7,1,638,1773]
[E:\Tencent\qq\PhoneAPI.dll] [TENCENT, 7,1,638,1773]
[E:\Tencent\qq\DialerAllinOne.dll] [tencent, 1, 4, 0, 0]
[E:\Tencent\qq\PersonalDesktop.dll] [TENCENT, 7,1,638,1773]
[E:\Tencent\qq\BQQApplication.dll] [N/A, ]
[E:\Tencent\qq\ImageOle.dll] [TENCENT, 7,1,638,1773]
[E:\Tencent\qq\QQLiveQMng.dll] [TENCENT, 7,1,638,1773]
[F:\卡巴斯基7.0\scrchpg.dll] [Kaspersky Lab, 7.0.0.125]
[F:\卡巴斯基7.0\klscav.dll] [Kaspersky Lab, 7.0.0.125]
[E:\Tencent\qq\GroupConnection.dll] [TENCENT, 7,1,638,1773]
[E:\Tencent\qq\CommercesMng.dll] [TENCENT, 7,1,638,1773]
[E:\Tencent\qq\QQAddr.dll] [深圳市腾讯计算机系统有限公司, 5, 0, 101, 330]
[E:\Tencent\qq\QQSceneMng.dll] [N/A, ]
[E:\Tencent\qq\AddrSearch.dll] [腾讯科技（深圳）有限公司, 2, 2, 1, 13]
[C:\WINDOWS\system32\SOGOUPY.IME] [Sohu.com Inc., 3, 1, 0, 0]
[D:\SogouInput\Plugin\SgImeWord.dll] [, 1, 0, 0, 31]
[D:\SogouInput\ZipLib.dll] [N/A, ]
[PID: 3296 / Administrator][C:\Documents and Settings\Administrator.ED01F301BE57450\桌面\sreng2.6\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]
[D:\Kingsoft\KPP\KPPShell.dll] [Kingsoft Corporation, 2008,01,31,1158]
[D:\Kingsoft\KPP\MSVCP60.dll] [Microsoft Corporation, 6.02.3104.0]
[C:\Documents and Settings\Administrator.ED01F301BE57450\桌面\sreng2.6\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]
[D:\mpfans\Micropoint\mp110031.dll] [Micropoint Corporation, 1.2.10043]
[C:\WINDOWS\system32\xnetgdn.dll] [Filseclab Corporation, 3, 6, 0, 3304]
[C:\WINDOWS\system32\SPORDER.dll] [Microsoft Corporation, 5.00.1980.1]
==================================
文件关联
.TXT Error. [C:\WINDOWS\notepad.exe %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM Error. ["hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
Filseclab Internet Guardian Angel LSP
C:\WINDOWS\system32\xnetgdn.dll(Filseclab Corporation, Net Guardian - Packet Filter Module)
Filseclab Internet Guardian Angel Layered TCP
C:\WINDOWS\system32\xnetgdn.dll(Filseclab Corporation, Net Guardian - Packet Filter Module)
Filseclab Internet Guardian Angel Layered UDP
C:\WINDOWS\system32\xnetgdn.dll(Filseclab Corporation, Net Guardian - Packet Filter Module)
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
N/A
==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 1184, C:\WINDOWS\SYSTEM32\WINLOGON.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 516, D:\VMWARE WORKSTATION\VMWARE-TRAY.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 736, D:\KINGSOFT\KPP\KACCORE.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 524, C:\WINDOWS\SYSTEM32\NVSVC32.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 788, E:\TENCENT\QQ\QQ.EXE]
==================================
API HOOK
N/A
==================================
隐藏进程
[437] D:\EQSysSecure\EQSysSecure.exe
[829] D:\EQSysSecure\EQService.exe
==================================
[/CODE] |
[复制链接]
发表于 2008-2-24 10:11:04
楼主
发表于 2008-2-24 13:03:52