[PID: 368][D:\Program Files\Tencent\QQ\QQ.exe] [TENCENT, 8,0,714,1791]
[D:\Program Files\Tencent\QQ\KfIP_2.9.1\KfApp.DLL] [, 2.9]
[D:\Program Files\Tencent\QQ\mfc42.dll] [Microsoft Corporation, 6.00.8665.0]
[D:\Program Files\Tencent\QQ\KfIP_2.9.1\ipsearcher.dll] [, 1.0.0.6]
[D:\Program Files\Tencent\QQ\QQBaseClassInDll.dll] [TENCENT, 8,0,714,1791]
[D:\Program Files\Tencent\QQ\QQHelperDll.dll] [TENCENT, 8,0,714,1791]
[D:\Program Files\Tencent\QQ\BasicCtrlDll.dll] [TENCENT, 8,0,713,1791]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)]
[D:\Program Files\Tencent\QQ\RICHED32.DLL] [Microsoft Corporation, 5.00.2134.1]
[D:\Program Files\Tencent\QQ\RICHED20.dll] [Microsoft Corporation, 5.31.23.1218]
[D:\Program Files\Tencent\QQ\QQAPI.dll] [TENCENT, 8,0,713,1791]
[D:\Program Files\Tencent\QQ2009\Bin\TXPFProxy.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\LoginCtrl.dll] [TENCENT, 8,0,714,1791]
[D:\Program Files\Tencent\QQ\LoginCtrlRes.dll] [TENCENT, 8,0,713,1791]
[D:\Program Files\Tencent\QQ\QQRes.dll] [TENCENT, 8,0,714,1791]
[D:\Program Files\Tencent\QQ\QQMainFrame.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\gdiplus.dll] [Microsoft Corporation, 5.1.3102.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\Program Files\Tencent\QQ\UnReadMsgMgr.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\QQPlugin.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\CQQApplication.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\FlashAvatarDll.dll] [, 1, 4, 0, 1]
[D:\Program Files\Tencent\QQ\NewSkin.dll] [TENCENT, 8,0,713,1791]
[D:\Program Files\Tencent\QQ\MailSummary.dll] [TENCENT, 8,0,713,1791]
[D:\Program Files\Tencent\QQ\QQSpace.dll] [TENCENT, 8,0,713,1791]
[D:\Program Files\Tencent\QQ\vbscript.dll] [Microsoft Corporation, 5.6.0.7426]
[C:\WINDOWS\system32\TcpIpDog1.dll] [N/A, ]
[C:\WINDOWS\system32\msdmo.dll] [, ]
[D:\Program Files\Tencent\QQ\QQKnowledgeSearch.dll] [TENCENT, 8,0,713,1791]
[D:\Program Files\Tencent\QQ\OEMApplication.dll] [TENCENT, 8,0,713,1791]
[C:\WINDOWS\system32\ieframe.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)]
[D:\Program Files\Tencent\QQ\QQGroupMng.dll] [TENCENT, 8,0,713,1791]
[D:\Program Files\Tencent\QQ\QQAllInOne.dll] [TENCENT, 8,0,713,1791]
[D:\Program Files\Tencent\QQ\SCCore.dll] [TENCENT, 1, 6, 0, 2]
[D:\Program Files\Tencent\QQ\CameraDll.dll] [TENCENT, 8,0,713,1791]
[D:\Program Files\Tencent\QQ\QQPet.dll] [TENCENT, 8,0,713,1791]
[D:\Program Files\Tencent\QQ\UserDefinedHead.dll] [TENCENT, 8,0,713,1791]
[D:\Program Files\Tencent\QQ\QQSettingCtrl.dll] [TENCENT, 8,0,713,1791]
[D:\Program Files\Tencent\QQ\QQConfigPlugin.dll] [TENCENT, 8,0,713,1791]
[D:\Program Files\Tencent\QQ\QQCustomFace.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\LongConnection.dll] [TENCENT, 8,0,713,1791]
[D:\Program Files\Tencent\QQ\QRingMng.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\QQAvatar.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\PhoneAPI.dll] [TENCENT, 8,0,713,1791]
[D:\Program Files\Tencent\QQ\DialerAllinOne.dll] [tencent, 1, 4, 0, 0]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[D:\Program Files\Tencent\QQ\QQSysMsgMng.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\BQQApplication.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\CommercesMng.dll] [TENCENT, 8,0,713,1791]
[D:\Program Files\Tencent\QQ\PersonalDesktop.dll] [TENCENT, 8,0,713,1791]
[D:\Program Files\Tencent\QQ\QQAddr.dll] [深圳市腾讯计算机系统有限公司, 5, 0, 101, 330]
[D:\Program Files\Tencent\QQ\QQSceneMng.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\AddrSearch.dll] [腾讯科技(深圳)有限公司, 2, 2, 1, 13]
[D:\Program Files\Tencent\QQ\QQDoctor\TSVulMdw.dat] [TENCENT, 2007, 12, 18, 3]
[C:\WINDOWS\system32\msadp32.acm] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1660][D:\Program Files\Tencent\QQ2009\Bin\txplatform.exe] [Tencent, 1, 0, 170, 0]
[D:\Program Files\Tencent\QQ2009\Bin\TXPFProxy.dll] [N/A, ]
[PID: 600][D:\Program Files\Maxthon2\Maxthon.exe] [Maxthon International ltd., 2, 0, 9, 1640]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)]
[D:\Program Files\Maxthon2\mxpp.dll] [Maxthon International ltd., 1, 0, 0, 101]
[D:\Program Files\Maxthon2\MxSk.dll] [Maxthon, 1, 0, 0, 349]
[D:\Program Files\Maxthon2\MxProxy2.dll] [Maxthon International ltd., 1, 0, 0, 3832]
[D:\Program Files\Maxthon2\MxExt.dll] [N/A, ]
[D:\Program Files\Maxthon2\mxtool.dll] [, 1, 0, 0, 1]
[D:\Program Files\Maxthon2\maxzlib.dll] [, 1.2.3]
[D:\Program Files\Maxthon2\mxfeedU.dll] [, 1, 0, 45, 92]
[D:\Program Files\Maxthon2\Modules\MxWebBoost\MxWebBoost.dll] [Maxthon, 1,0,0,2634]
[D:\Program Files\Maxthon2\mxdb.dll] [Max, 3, 5, 3, 125]
[D:\Program Files\Maxthon2\Modules\MxGuardian\MxGuardian.dll] [Maxthon International ltd., 1, 0, 0, 666]
[C:\WINDOWS\system32\ieframe.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)]
[C:\WINDOWS\system32\TcpIpDog1.dll] [N/A, ]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[D:\Program Files\Alisoft\WangWang\WangWangX6.dll] [阿里巴巴软件(上海)有限公司, 1, 0, 0, 5]
[C:\Program Files\Internet Explorer\ieproxy.dll] [Microsoft Corporation, 7.00.5730.13 (longhorn(wmbla).070711-1130)]
[C:\WINDOWS\system32\MFPlat.DLL] [Microsoft Corporation, 11.0.5721.5145 (WMP_11.061018-2006)]
[C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xmvsource.dll_1_work] [XunLei, 1, 0, 0, 5]
[C:\WINDOWS\system32\SOGOUPY.IME] [Sogou.com Inc., 3.2.0.0]
[C:\Program Files\SogouInput\Plugin\SgImeWord.dll] [Sogou.com Inc., 3.2.0.0]
[C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx] [Adobe Systems, Inc., 9,0,124,0]
[C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 8, 74]
[C:\Program Files\Thunder Network\Thunder\ComDlls\ThunderAgent_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 4, 23]
[PID: 1188][D:\Program Files\Alisoft\WangWang\WangWang.exe] [阿里巴巴软件(上海)有限公司, 5, 7, 0, 4]
[D:\Program Files\Alisoft\WangWang\AliViewCtrl.dll] [ 阿里巴巴软件(上海)有限公司, 1, 0, 0, 2]
[D:\Program Files\Alisoft\WangWang\VLNetwork.dll] [阿里巴巴软件(上海)有限公司, 1, 0, 0, 6]
[D:\Program Files\Alisoft\WangWang\AliViewMedia.dll] [ 阿里巴巴软件(上海)有限公司, 1, 0, 0, 2]
[D:\Program Files\Alisoft\WangWang\VideoCap.dll] [ 阿里巴巴软件(上海)有限公司, 1, 0, 0, 4]
[D:\Program Files\Alisoft\WangWang\VLAudio.dll] [ 阿里巴巴软件(上海)有限公司, 1, 0, 0, 5]
[D:\Program Files\Alisoft\WangWang\JsmShow.dll] [ 阿里巴巴软件(上海)有限公司, 1, 0, 0, 4]
[D:\Program Files\Alisoft\WangWang\AliSkin.dll] [阿里巴巴软件(上海)有限公司, 1.0.0.1]
[D:\Program Files\Alisoft\WangWang\PngLib.dll] [阿里巴巴软件(上海)有限公司, 1, 0, 0, 1]
[D:\Program Files\Alisoft\WangWang\zlib.dll] [, 1.2.3]
[D:\Program Files\Alisoft\WangWang\ww_network.dll] [, 2, 1, 0, 1]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)]
[D:\Program Files\Alisoft\WangWang\Ali_Res.DLL] [N/A, ]
[C:\WINDOWS\system32\ieframe.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\aliedit\aliedit.dll] [, 1, 1, 0, 1]
[D:\Program Files\Alisoft\WangWang\WangWangX6.dll] [阿里巴巴软件(上海)有限公司, 1, 0, 0, 5]
[D:\Program Files\Alisoft\WangWang\RICHED32.DLL] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[D:\Program Files\Alisoft\WangWang\RICHED20.dll] [Microsoft Corporation, 5.30.23.1221]
[D:\Program Files\Alisoft\WangWang\RichOne.dll] [阿里巴巴软件(上海)有限公司, 1.0.0.1]
[D:\Program Files\Alisoft\WangWang\TBProgress.dll] [阿里巴巴软件(上海)有限公司, 1.0.0.1]
[D:\Program Files\Alisoft\WangWang\MessageNotify.dll] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\TcpIpDog1.dll] [N/A, ]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\msdmo.dll] [, ]
[D:\Program Files\Alisoft\WangWang\Scan_Lib\DBUpdate.dll] [N/A, ]
[PID: 3368][C:\WINDOWS\explorer.exe] [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234)]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)]
[C:\WINDOWS\system32\ieframe.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)]
[C:\WINDOWS\system32\WPDShServiceObj.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\WINDOWS\system32\PortableDeviceTypes.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\WINDOWS\system32\PortableDeviceApi.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[D:\Program Files\Tencent\QQ\qdshm.dll] [, 1, 0, 101, 20]
[D:\Program Files\Tencent\QQ\MFC42.DLL] [Microsoft Corporation, 6.00.8665.0]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
[C:\Program Files\Eset\nodshex.dll] [N/A, ]
[C:\Program Files\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll] [Adobe Systems Inc., 8.1.5.2007051000\0]
[C:\Program Files\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.chs] [Adobe Systems Inc., 8.0.5.2006102200\0]
[PID: 3476][C:\Program Files\WinRAR\WinRAR.exe] [N/A, ]
[C:\Program Files\Windows Live\Messenger\fsshext.8.5.1302.1018.dll] [Microsoft Corporation, 8.5.1302.1018]
[C:\WINDOWS\system32\wpdshext.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\WINDOWS\system32\PortableDeviceApi.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\WINDOWS\system32\Audiodev.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\ieframe.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)]
[PID: 1944][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.266\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]
[C:\WINDOWS\system32\Normaliz.dll] [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
[C:\WINDOWS\system32\iertutil.dll] [Microsoft Corporation, 7.00.6000.16640 (vista_gdr.080213-1606)]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.266\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]
[C:\WINDOWS\system32\TcpIpDog1.dll] [N/A, ]
--------------------------------------------------------------------------------
文件关联
.TXT Error. [C:\WINDOWS\notepad.exe %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM Error. ["hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
--------------------------------------------------------------------------------
Winsock 提供者
MSAFD Tcpip [TCP/IP]
C:\WINDOWS\system32\TcpIpDog1.dll(, N/A)
MSAFD Tcpip [UDP/IP]
C:\WINDOWS\system32\TcpIpDog1.dll(, N/A)
MSAFD Tcpip [RAW/IP]
C:\WINDOWS\system32\TcpIpDog1.dll(, N/A)
RSVP UDP Service Provider
C:\WINDOWS\system32\TcpIpDogR0.dll(, N/A)
RSVP TCP Service Provider
C:\WINDOWS\system32\TcpIpDogR0.dll(, N/A)
--------------------------------------------------------------------------------
Autorun.inf
N/A
--------------------------------------------------------------------------------
HOSTS 文件
127.0.0.1 localhost
127.0.0.1 yu.8s7.net
127.0.0.1 1.jopanqc.com
127.0.0.1 2.joppnqq.com
127.0.0.1 wg.47255.com
127.0.0.1 1.joppnqq.com
127.0.0.1 xxx.m111.biz
127.0.0.1 1.jopenqc.com
127.0.0.1 1.jopenkk.com
127.0.0.1 xxx.vh7.biz
127.0.0.1 xxx.j41m.com
127.0.0.1 3.joppnqq.com
127.0.0.1 d.93se.com
127.0.0.1 www.868wg.com
127.0.0.1 xxx.mmma.biz
127.0.0.1 ilove.com
127.0.0.1 tp.shpzhan.cn
127.0.0.1 www.tomwg.com
127.0.0.1 www.cike007.cn
127.0.0.1 www.22aaa.com
127.0.0.1 xx.exiao01.com
127.0.0.1 www.exiao01.com
127.0.0.1 www.exiao01.com
127.0.0.1 new.749571.com
127.0.0.1 xtx.kv8.info
127.0.0.1 cao.kv8.info
127.0.0.1 1.jopmmqq.com
127.0.0.1 171817.171817.com
127.0.0.1 d2.llsging.com
127.0.0.1 down.malasc.cn
127.0.0.1 llboss.com
127.0.0.1 nx.51ylb.cn
127.0.0.1 my.531jx.cn
127.0.0.1 qqq.dzydhx.com
127.0.0.1 qqq.hao1658.com
127.0.0.1 www.333292.com
127.0.0.1 down.18dd.net
127.0.0.1 up.22x44.com
127.0.0.1 aaa.faba01.com
127.0.0.1 bad.tqdlt.cn
127.0.0.1 1.chsipo.com
127.0.0.1 c3.aishangai.net
127.0.0.1 c2.aishangai.net
127.0.0.1 xxx.188dm.com
127.0.0.1 x2.1a2b3c1.com
127.0.0.1 d1.163500.net
127.0.0.1 down.google-serv.cn
--------------------------------------------------------------------------------
进程特权扫描
特殊特权被允许: SeLoadDriverPrivilege [PID = 264, C:\PROGRA~1\QBU\QKONBTN.EXE]
特殊特权被允许: SeLoadDriverPrivilege [PID = 380, C:\PROGRAM FILES\LENOVO\ENERGYCUT\UTILTY.EXE]
特殊特权被允许: SeLoadDriverPrivilege [PID = 424, C:\PROGRAM FILES\LENOVO\ENERGYCUT\ENERGYCUT.EXE]
特殊特权被允许: SeLoadDriverPrivilege [PID = 492, C:\PROGRAM FILES\ESET\NOD32KUI.EXE]
特殊特权被允许: SeLoadDriverPrivilege [PID = 3476, C:\PROGRAM FILES\WINRAR\WINRAR.EXE]
--------------------------------------------------------------------------------
API HOOK
N/A
--------------------------------------------------------------------------------
隐藏进程
N/A
-------------------------------------------------------------------------------- |