求助啊！！帮忙分析一下~~~

显示全部楼层 · 发表于 2008-5-14 14:20:39

最近老蓝屏~~~郁闷各位帮忙分析一下~~~

[CODE]
2008-05-14,14:02:57
System Repair Engineer 2.6.7.968
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\windows\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<switch><c:\windows\system32\壁纸自动换.exe>  []
<RTHDCPL><RTHDCPL.EXE>  [Realtek Semiconductor Corp.]
<amd_dc_opt><C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe>  [AMD]
<AVP><"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe">  [Kaspersky Lab]
<SunJavaUpdateSched><"C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe">  [(Verified)"Sun Microsystems, Inc."]
<Microsoft Pinyin IME Migration><C:\PROGRA~1\COMMON~1\MICROS~1\IME12\IMESC\IMSCMIG.EXE /INSTALL>  [(Verified)Microsoft Corporation]
<!AVG Anti-Spyware><"C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\CRavgas.exe" /minimized>  [GRISOFT s.r.o.]
<COMODO Firewall Pro><"C:\Program Files\COMODO\Firewall\cfp.exe" -h>  [COMODO]
<RunShadowTip><C:\WINDOWS\system32\shadow\ShadowTip.exe>  []
<MemoryIdle><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX04.422\Memory Booster.exe -PowerOn>  [File is missing]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe>  [(Verified)Microsoft Windows Component Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><  C:\WINDOWS\system32\guard32.dll>  [(Verified)Comodo CA Limited]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{57B86673-276A-48B2-BAE7-C6DBB3020EB8}><C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll>  [(Verified)GRISOFT LTD]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
<WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll>  [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
<WinlogonNotify: WgaLogon><WgaLogon.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
<IE7 Uninstall Stub><C:\WINDOWS\system32\ieudinit.exe>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
<Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path]
<IFEO[Your Image File Name Here without a path]><ntsd -d>  [N/A]
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><C:\WINDOWS\FANTAS~1.SCR>  [Laconic Software]
==================================
启动文件夹
N/A
==================================
服务
[AVG Anti-Spyware Guard / AVG Anti-Spyware Guard][Running/Auto Start]
  <C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe><GRISOFT s.r.o.>
[卡巴斯基反病毒6.0 / AVP][Running/Auto Start]
  <"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r><Kaspersky Lab>
[Contrl Center of Storm Media / ccosm][Running/Auto Start]
  <C:\Program Files\StormII\stormliv.exe /asservice><北京暴风网际科技有限公司>
[CHX Log Management Service / ChxLogsv][Running/Auto Start]
  <C:\WINDOWS\system32\ChxLogSv.exe><Third Brigade>
[CHX Remote Management Service / ChxRmtsv][Stopped/Manual Start]
  <C:\WINDOWS\system32\ChxRmtsv.exe><Third Brigade>
[COMODO Firewall Pro Helper Service / cmdAgent][Running/Auto Start]
  <"C:\Program Files\COMODO\Firewall\cmdagent.exe"><COMODO>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\windows\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Shadow System Service / ShadowSystemService][Running/Auto Start]
  <C:\WINDOWS\system32\shadow\ShadowService.exe><N/A>
[StarWind AE Service / StarWindServiceAE][Running/Auto Start]
  <C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe><Rocket Division Software>
[Apache Tomcat / Tomcat6][Stopped/Manual Start]
  <"C:\Program Files\Apache Software Foundation\Tomcat 6.0\bin\tomcat6.exe" //RS//Tomcat6><Apache Software Foundation>
[Windows Live Setup Service / WLSetupSvc][Stopped/Manual Start]
  <"C:\Program Files\Windows Live\installer\WLSetupSvc.exe"><Microsoft Corporation>
[H3C iNode service / H3C_SVR_MNG_SERVICE][Running/Auto Start]
  <C:\Program Files\Huawei\H3C Client\AuthenMngService.exe -startService ><N/A>
==================================
驱动程序
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Stopped/Manual Start]
  <system32\drivers\ac97intc.sys><Intel Corporation>
[AliIde / AliIde][Stopped/Disabled]
  <\SystemRoot\System32\DRIVERS\aliide.sys><Acer Laboratories Inc.>
[AMD Processor Driver / AmdK8][Running/System Start]
  <System32\DRIVERS\amdk8.sys><Advanced Micro Devices>
[AMD Low Level Device Driver / AmdLLD][Running/Manual Start]
  <system32\DRIVERS\AmdLLD.sys><AMD, Inc.>
[atiide / atiide][Stopped/Disabled]
  <\SystemRoot\system32\DRIVERS\atiide.sys><ATI Technologies Inc.>
[AVG Anti-Spyware Driver / AVG Anti-Spyware Driver][Running/System Start]
  <\??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys><N/A>
[AVG Anti-Spyware Clean Driver / AvgAsCln][Running/System Start]
  <System32\DRIVERS\AvgAsCln.sys><GRISOFT, s.r.o.>
[Chx-IM Filter Driver Service / Chxim][Running/Manual Start]
  <system32\DRIVERS\chxim.sys><Third Brigade>
[CHX Packet Filter Module Driver / ChxMpf][Running/Auto Start]
  <System32\DRIVERS\ChxMpf.sys><Third Brigade>
[CHX Payload Module Driver / ChxMpld][Running/Auto Start]
  <system32\drivers\chxmpld.sys><Third Brigade>
[COMODO Firewall Pro Sandbox Driver / cmdGuard][Running/System Start]
  <System32\DRIVERS\cmdguard.sys><COMODO>
[COMODO Firewall Pro Helper Driver / cmdHlp][Running/System Start]
  <System32\DRIVERS\cmdhlp.sys><COMODO>
[CmdIde / CmdIde][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\cmdide.sys><CMD Technology, Inc.>
[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Stopped/Manual Start]
  <system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
[Microsoft 用于 High Definition Audio 的 UAA 总线驱动程序 / HDAudBus][Running/Manual Start]
  <system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
[COMODO Firewall Pro Firewall Driver / Inspect][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\inspect.sys><COMODO>
[Service for Realtek HD Audio (WDM) / IntcAzAudAddService][Running/Manual Start]
  <system32\drivers\RtkHDAud.sys><Realtek Semiconductor Corp.>
[kl1 / kl1][Running/Boot Start]
  <\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif][Running/System Start]
  <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[mv61xx / mv61xx][Stopped/Disabled]
  <\SystemRoot\system32\DRIVERS\mv61xx.sys><Marvell Semiconductor, Inc.>
[nv / nv][Running/Manual Start]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[NVIDIA nForce Networking Controller Driver / NVENETFD][Running/Manual Start]
  <system32\DRIVERS\NVENETFD.sys><NVIDIA Corporation>
[NVIDIA Network Bus Enumerator / nvnetbus][Running/Manual Start]
  <system32\DRIVERS\nvnetbus.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
[sptd / sptd][Running/Boot Start]
  <\SystemRoot\System32\Drivers\sptd.sys><N/A>
[TesSafe / TesSafe][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\TesSafe.sys><TENCENT>
[PCANDIS5 NDIS Protocol Driver / PCANDIS5][Running/Auto Start]
  <\??\C:\windows\system32\PCANDIS5.SYS><Printing Communications Assoc., Inc. (PCAUSA)>
==================================
浏览器加载项
[ThunderAtOnce Class]
  {01443AEC-0FD1-40fd-9C87-E93D1494C233} <C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[SSVHelper Class]
  {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} <C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll, Sun Microsystems, Inc.>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[Windows Live 登录帮助程序]
  {9030D464-4C02-4ABF-8ECC-5164760863C6} <C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll, Microsoft Corporation>
[Java Plug-in 1.6.0_05]
  {08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll, Sun Microsystems, Inc.>
[启动迅雷5]
  {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <C:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[Web反病]
  {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll, Kaspersky Lab>
[信息检索(&R)]
  {92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL, Microsoft Corporation>
[]
  {e2e2dd38-d088-4134-82b7-f2ba38496583} <%windir%\Network Diagnostic\xpnetdiag.exe, N/A>
[快捷工具条3.21]
  {BE830FD4-E393-417F-9F4B-CC70ABB3384C} <C:\WINDOWS\system32\IETool.dll, N/A>
[Java Plug-in 1.6.0_05]
  {8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.6.0_05]
  {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.6.0_05]
  {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll, Sun Microsystems, Inc.>
[ThunderAtOnce Class]
  {01443AEC-0FD1-40FD-9C87-E93D1494C233} <C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[Web Browser Applet Control]
  {08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\WINDOWS\system32\msjava.dll, Microsoft Corporation>
[GerneralPeerID Class]
  {0A47E819-F82E-4D5D-B806-6A9EA94D68CD} <C:\Program Files\Thunder Network\Thunder\Components\InMedia\peerid.dll, >
[XML DOM Document]
  {2933BF90-7B36-11D2-B20E-00C04F983E60} <%SystemRoot%\system32\msxml3.dll, N/A>
[XML Document]
  {48123BC4-99D9-11D1-A6B3-00C04FD91555} <%SystemRoot%\system32\msxml3.dll, N/A>
[Thunder Agent Class]
  {485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <C:\Program Files\Thunder Network\Thunder\ComDlls\ThunderAgent_Now.dll, Thunder Networking Technologies,LTD>
[XMP Class]
  {6483F145-A768-4C41-AACC-52D4D7845851} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xplayer.dll_1_work, >
[XDRM]
  {693571CB-54A3-4E90-9D52-EEAE1334E2D3} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xdrm.dll_1_work, >
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[SSVHelper Class]
  {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} <C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll, Sun Microsystems, Inc.>
[MediaComm Class]
  {7670648D-461B-42AF-BDFE-46D26AF5EFF2} <C:\Program Files\Thunder Network\Thunder\Components\InMedia\MediaAddin16.dll, Thunder Networking Technologies,LTD>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[XML DOM Document 5.0]
  {88D969E5-F192-11D4-A65F-0040963251E5} <C:\Program Files\Common Files\Microsoft Shared\OFFICE11\msxml5.dll, Microsoft Corporation>
[Windows Live 登录帮助程序]
  {9030D464-4C02-4ABF-8ECC-5164760863C6} <C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll, Microsoft Corporation>
[RMGetLicense Class]
  {A9FC132B-096D-460B-B7D5-1DB0FAE0C062} <C:\WINDOWS\system32\msnetobj.dll, Microsoft Corporation>
[Thunder DapCtrl]
  {ACACC6EB-1FBA-4E13-A729-53AEB2DF54F8} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\DapCtrl1.5.578.28.784.dll, ShenZhen Thunder Networking Technologies Ltd.>
[快捷工具条3.21]
  {BE830FD4-E393-417F-9F4B-CC70ABB3384C} <C:\WINDOWS\system32\IETool.dll, N/A>
[AUDIO__X_MS_WMA Moniker Class]
  {CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>
[Thunder DapPlayer]
  {EEDD6FF9-13DE-496B-9A1C-D78B3215E266} <C:\Program Files\Thunder Network\Thunder\Components\DownAndPlay\DapPlayer3.0.578.69.784.dll, ShenZhen Thunder Networking Technologies Ltd.>
[SrchHook Class]
  {F08555B0-9CC3-11D2-AA8E-000000000000} <, N/A>
[XPPlayer Class]
  {F3E70CEA-956E-49CC-B444-73AFE593AD7F} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\pplayer.dll_1_work, Thunder>
[XML HTTP]
  {F6D90F16-9C73-11D3-B32E-00C04F990BB4} <%SystemRoot%\system32\msxml3.dll, N/A>
[使用迅雷下载]

显示全部楼层 · 发表于 2008-5-14 14:21:02

<C:\Program Files\Thunder Network\Thunder\Program\geturl.htm, N/A>
[使用迅雷下载全部链接]
  <C:\Program Files\Thunder Network\Thunder\Program\getallurl.htm, N/A>
[导出到 Microsoft Excel(&X)]
  <res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000, N/A>
[导出到 Microsoft Office Excel(&X)]
  <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ表情]
  <C:\Program Files\Tencent\qq\AddEmotion.htm, N/A>

==================================
正在运行的进程
[PID: 1160 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1228 / SYSTEM][\??\C:\windows\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1252 / SYSTEM][\??\C:\windows\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\guard32.dll]  [N/A, ]
[C:\WINDOWS\system32\klogon.dll]  [Kaspersky Lab, 6.0.1.411]
[C:\windows\system32\SOGOUPY.IME]  [Sogou.com Inc., 3.3.0.0]
[PID: 1296 / SYSTEM][C:\windows\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\guard32.dll]  [N/A, ]
[PID: 1308 / SYSTEM][C:\windows\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\guard32.dll]  [N/A, ]
[PID: 1464 / SYSTEM][C:\windows\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\guard32.dll]  [N/A, ]
[PID: 1524 / NETWORK SERVICE][C:\windows\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\guard32.dll]  [N/A, ]
[PID: 1636 / SYSTEM][C:\windows\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\guard32.dll]  [N/A, ]
[PID: 1744 / NETWORK SERVICE][C:\windows\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\guard32.dll]  [N/A, ]
[PID: 1828 / LOCAL SERVICE][C:\windows\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\guard32.dll]  [N/A, ]
[PID: 376 / SYSTEM][C:\windows\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\WINDOWS\system32\guard32.dll]  [N/A, ]
[PID: 708 / SYSTEM][C:\Program Files\StormII\stormliv.exe]  [北京暴风网际科技有限公司, 3, 8, 3, 15]
[C:\WINDOWS\system32\guard32.dll]  [N/A, ]
[PID: 752 / SYSTEM][C:\WINDOWS\system32\ChxLogSv.exe]  [Third Brigade, 3, 0, 0, 5]
[C:\WINDOWS\system32\guard32.dll]  [N/A, ]
[PID: 1012 / SYSTEM][C:\WINDOWS\system32\shadow\ShadowService.exe]  [N/A, ]
[C:\WINDOWS\system32\guard32.dll]  [N/A, ]
[PID: 1196 / SYSTEM][C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe]  [Rocket Division Software, 3.2.3 Build 20070527]
[C:\WINDOWS\system32\guard32.dll]  [N/A, ]
[PID: 492 / Administrator][C:\windows\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234)]
[C:\WINDOWS\system32\guard32.dll]  [N/A, ]
[C:\windows\system32\SOGOUPY.IME]  [Sogou.com Inc., 3.3.0.0]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scrchpg.dll]  [Kaspersky Lab, 1.0.6.411]
[C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll]  [Thunder Networking Technologies,LTD, 1.0.5.29]
[C:\Program Files\Thunder Network\Thunder\Components\ResWorker\DsBho_00.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 18]
[C:\Program Files\Thunder Network\Thunder\Components\ResWorker\DataProcessor_00.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 16]
[C:\Program Files\Unlocker\UnlockerCOM.dll]  [N/A, ]
[C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\ShellEx.dll]  [Kaspersky Lab, 6.0.1.411]
[C:\PROGRA~1\Wopti\WOPTIE~1.DLL]  [共软网络, 1.0.8.307]
[C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll]  [GRISOFT s.r.o., 7, 5, 1, 36]
[C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll]  [GRISOFT s.r.o., 7, 5, 1, 36]
[PID: 824 / Administrator][C:\windows\RTHDCPL.EXE]  [Realtek Semiconductor Corp., 2.1.6.7]
[C:\WINDOWS\system32\guard32.dll]  [N/A, ]
[C:\windows\system32\SOGOUPY.IME]  [Sogou.com Inc., 3.3.0.0]
[PID: 2084 / Administrator][C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe]  [Sun Microsystems, Inc., 6.0.50.13]
[C:\WINDOWS\system32\guard32.dll]  [N/A, ]
[PID: 2116 / Administrator][C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\CRavgas.exe]  [GRISOFT s.r.o., 7, 5, 1, 43]
[C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\engine.dll]  [GRISOFT s.r.o., 4, 2, 0, 19]
[C:\WINDOWS\system32\guard32.dll]  [N/A, ]
[C:\windows\system32\SOGOUPY.IME]  [Sogou.com Inc., 3.3.0.0]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scrchpg.dll]  [Kaspersky Lab, 1.0.6.411]
[PID: 2360 / Administrator][C:\windows\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\guard32.dll]  [N/A, ]
[C:\windows\system32\SOGOUPY.IME]  [Sogou.com Inc., 3.3.0.0]
[PID: 3244 / LOCAL SERVICE][C:\windows\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\guard32.dll]  [N/A, ]
[PID: 2904 / Administrator][E:\uulive\Software\setup.exe]  [Doctor Web, Ltd., 4, 44, 0, 0]
[C:\WINDOWS\system32\guard32.dll]  [N/A, ]
[C:\windows\system32\SOGOUPY.IME]  [Sogou.com Inc., 3.3.0.0]
[PID: 3404 / Administrator][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\_start.exe]  [Doctor Web, Ltd., 2.53]
[C:\windows\system32\SOGOUPY.IME]  [Sogou.com Inc., 3.3.0.0]
[PID: 3660 / Administrator][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exe]  [, 4, 44, 5, 5050]
[C:\WINDOWS\system32\guard32.dll]  [N/A, ]
[C:\windows\system32\SOGOUPY.IME]  [Sogou.com Inc., 3.3.0.0]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\dwebllio.dll]  [Doctor Web Ltd., 4, 32, 0, 0]
[PID: 2280 / Administrator][C:\Program Files\Huawei\H3C Client\H3C Client.exe]  [华为技术有限公司, CH V2.40-R0159]
[C:\Program Files\Huawei\H3C Client\h3c_utility.dll]  [N/A, ]
[C:\windows\system32\W32N50.dll]  [Printing Communications Assoc., Inc. (PCAUSA), 5.03.16.56]
[C:\Program Files\Huawei\H3C Client\SecurityAuth.dll]  [N/A, ]
[C:\WINDOWS\system32\guard32.dll]  [N/A, ]
[C:\windows\system32\SOGOUPY.IME]  [Sogou.com Inc., 3.3.0.0]
[C:\Program Files\Huawei\H3C Client\X1Face.dll]  [N/A, ]
[C:\Program Files\Huawei\H3C Client\PORTALFace.dll]  [, 1, 0, 0, 1]
[PID: 2440 / SYSTEM][C:\Program Files\Huawei\H3C Client\AuthenMngService.exe]  [N/A, ]
[C:\Program Files\Huawei\H3C Client\h3c_utility.dll]  [N/A, ]
[C:\windows\system32\W32N50.dll]  [Printing Communications Assoc., Inc. (PCAUSA), 5.03.16.56]
[C:\Program Files\Huawei\H3C Client\SecurityAuth.dll]  [N/A, ]
[C:\WINDOWS\system32\guard32.dll]  [N/A, ]
[C:\Program Files\Huawei\H3C Client\X1Pt.dll]  [N/A, ]
[C:\Program Files\Huawei\H3C Client\PORTALPt.dll]  [N/A, ]
[C:\Program Files\Huawei\H3C Client\LIBEAY32.dll]  [The OpenSSL Project, http://www.openssl.org/, 0.9.8]
[C:\windows\system32\msxml4.dll]  [Microsoft Corporation, 4.20.9848.0]
[PID: 296 / Administrator][E:\uulive\Software\sreng968\SREngLdr.EXE]  [Smallfrogs Studio, 2.6.7.968]
[PID: 4000 / Administrator][E:\uulive\Software\sreng968\SRE9b4eb966.EXE]  [Smallfrogs Studio, 2.6.7.968]
[C:\windows\system32\SOGOUPY.IME]  [Sogou.com Inc., 3.3.0.0]
[E:\uulive\Software\sreng968\Plugins\FILEDSV.SRE]  [Smallfrogs Studio, 1, 1, 0, 20]
[E:\uulive\Software\sreng968\Plugins\NTFSTREAM.SRE]  [Smallfrogs Studio, 1, 0, 0, 5]
[E:\uulive\Software\sreng968\Plugins\NWMON.SRE]  [Smallfrogs Studio, 1, 0, 0, 8]
[E:\uulive\Software\sreng968\Plugins\SRECXTMG.SRE]  [Smallfrogs Studio, 1, 5, 0, 55]
[PID: 2520 / Administrator][C:\Program Files\Tencent\qq\QQ.exe]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\qq\QQBaseClassInDll.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\qq\QQHelperDll.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\qq\BasicCtrlDll.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\qq\MSIMG32.dll]  [N/A, ]
[C:\WINDOWS\system32\guard32.dll]  [N/A, ]
[C:\windows\system32\SOGOUPY.IME]  [Sogou.com Inc., 3.3.0.0]
[C:\Program Files\Tencent\qq\FinePlus.dll]  [N/A, ]
[C:\Program Files\Tencent\qq\fphelper.dll]  [N/A, ]
[C:\Program Files\Tencent\qq\QQAPI.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\qq\LoginCtrl.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\qq\LoginCtrlRes.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\qq\QQRes.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\qq\QQMainFrame.dll]  [N/A, ]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scrchpg.dll]  [Kaspersky Lab, 1.0.6.411]
[C:\Program Files\Tencent\qq\UnReadMsgMgr.dll]  [N/A, ]
[C:\Program Files\Tencent\qq\QQPlugin.dll]  [N/A, ]
[C:\Program Files\Tencent\qq\CQQApplication.dll]  [N/A, ]
[C:\Program Files\Tencent\qq\FlashAvatarDll.dll]  [, 1, 4, 0, 1]
[C:\Program Files\Tencent\qq\NewSkin.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\qq\MailSummary.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\qq\QQSpace.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\qq\vbscript.dll]  [N/A, ]
[C:\Program Files\Tencent\qq\encode.dll]  [Microsoft Corporation, 5.6.0.8825]
[C:\Program Files\Tencent\qq\msdmo.dll]  [, ]
[C:\Program Files\Tencent\qq\QQKnowledgeSearch.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\qq\OEMApplication.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\qq\QQGroupMng.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\qq\QQAvatar.dll]  [N/A, ]
[C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx]  [Adobe Systems, Inc., 9,0,124,0]
[C:\Program Files\Tencent\qq\QQAllInOne.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\qq\SCCore.dll]  [TENCENT, 1, 6, 0, 2]
[C:\Program Files\Tencent\qq\CameraDll.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\qq\QQPet.dll]  [TENCENT, 8,0,775,1803]
[C:\WINDOWS\system32\l3codeca.acm]  [Fraunhofer Institut Integrierte Schaltungen IIS, 1, 9, 0, 0305]
[C:\Program Files\Tencent\qq\QRingMng.dll]  [N/A, ]
[C:\Program Files\Tencent\qq\QQSysMsgMng.dll]  [N/A, ]
[C:\Program Files\Tencent\qq\UserDefinedHead.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\qq\QQCustomFace.dll]  [N/A, ]
[C:\Program Files\Tencent\qq\QQConfigPlugin.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\qq\ImageOle.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\qq\QQLiveQMng.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\qq\QQSceneMng.dll]  [N/A, ]
[C:\Program Files\Tencent\qq\LongConnection.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\qq\PhoneAPI.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\qq\DialerAllinOne.dll]  [tencent, 1, 4, 0, 0]
[C:\Program Files\Tencent\qq\BQQApplication.dll]  [N/A, ]
[C:\Program Files\Tencent\qq\PersonalDesktop.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\qq\CommercesMng.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\qq\QQAddr.dll]  [深圳市腾讯计算机系统有限公司, 5, 0, 101, 330]
[C:\Program Files\Tencent\qq\AddrSearch.dll]  [腾讯科技（深圳）有限公司, 2, 0, 1, 10]
[C:\Program Files\Tencent\qq\GroupConnection.dll]  [TENCENT, 8,0,775,1803]
[PID: 2412 / Administrator][C:\Program Files\Tencent\qq\TXPlatform.exe]  [Tencent, 1, 0, 170, 0]
[C:\WINDOWS\system32\guard32.dll]  [N/A, ]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1    localhost
127.0.0.1 www.qq3344.com
127.0.0.1 www.dj3344.com
127.0.0.1 www.yysky.net
127.0.0.1 www.qq168.net
127.0.0.1 www.777888.com
127.0.0.1 www.5dsoft.com
127.0.0.1 www.wokoo.net
127.0.0.1 www.coolcdrom.com
127.0.0.1 www.mtv51.com
127.0.0.1 www.yibinren.com
127.0.0.1 yeapple.com
127.0.0.1 movie.sx.zj.cn
127.0.0.1 www.cctv8.net
127.0.0.1 www.kuliao.com
127.0.0.1 www.yyqy.com
127.0.0.1 www.sunvod.com
127.0.0.1 www.t168.com
127.0.0.1 www.boliwo.com
127.0.0.1 www.zhengdian.com
127.0.0.1 girlchinese.com
127.0.0.1 www.37021.com
127.0.0.1 www.cnqb.net
127.0.0.1 www.58589.com
127.0.0.1 www.pixpox.com
127.0.0.1 www.k163.com
127.0.0.1 www.pk.com
127.0.0.1 www.xxx.com
127.0.0.1 www.ehomeday.com
127.0.0.1 www.jinpin.net
127.0.0.1 www.es158.com
127.0.0.1 www.aisa-girl.net
127.0.0.1 www.boliwu.com
127.0.0.1 www.cctv1.net
127.0.0.1 www.play.cn.gs
127.0.0.1 www.nnptt.com
127.0.0.1 vod.hengshui.com
127.0.0.1 tv.megajoy.com
127.0.0.1 www.my288.com
127.0.0.1 www.youmiss.com
127.0.0.1 www.laws-online.net
127.0.0.1 www.435000.com
127.0.0.1 www.eastedu.com.cn
127.0.0.1 www.ezhgc.com
127.0.0.1 www.mmgirls.com
127.0.0.1 www.qq520.com
127.0.0.1 www.love520.net
127.0.0.1 www.hj168.net
127.0.0.1 www.wwmmww.com
127.0.0.1 www.wo265.com
127.0.0.1 www.9911.com
127.0.0.1 36920.com
127.0.0.1 www.piaoxue.com
127.0.0.1 www.47555.net
127.0.0.1 www.511ring.com
127.0.0.1 www.coolseach.com
127.0.0.1 www.9p.cn

==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 1252, C:\WINDOWS\SYSTEM32\WINLOGON.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 824, C:\WINDOWS\RTHDCPL.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 2116, C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\CRAVGAS.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2116, C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\CRAVGAS.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2280, C:\PROGRAM FILES\HUAWEI\H3C CLIENT\H3C CLIENT.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 296, E:\UULIVE\SOFTWARE\SRENG968\SRENGLDR.EXE]

==================================
API HOOK
RVA  错误： LoadLibraryA (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA  错误： LoadLibraryExA (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA  错误： LoadLibraryExW (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA  错误： LoadLibraryW (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA  错误： GetProcAddress (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)

==================================
隐藏进程
N/A

==================================

[/CODE]

显示全部楼层 · 发表于 2008-5-14 14:50:42

各位大哥大姐帮帮忙啊~~~

来人啊~~~高手都哪里去了啊!!!

显示全部楼层 · 发表于 2008-5-14 14:53:31

看着眼花没看出什么问题

显示全部楼层 · 发表于 2008-5-14 15:02:04

1、病毒，看看能不能进安全模式，下最新版本杀毒软件扫毒
2、硬件，内存条什么的，重新插拔一下，清理一下灰尘
3、驱动，想想最近有没有装一些软件或硬件，驱动可能没驱动好

显示全部楼层 · 发表于 2008-5-14 15:56:19

日志正常

启动项有点多安防工具也不少

显示全部楼层 · 发表于 2008-5-14 16:01:02

谢谢大家啊~~~

API HOOK
RVA  错误： LoadLibraryA (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA  错误： LoadLibraryExA (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA  错误： LoadLibraryExW (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA  错误： LoadLibraryW (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA  错误： GetProcAddress (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)

这个是怎么回事啊~~~

显示全部楼层 · 发表于 2008-5-14 16:02:49

不必担心卡巴的东西

显示全部楼层 · 发表于 2008-5-14 16:14:44

奥...谢谢啊

[已解决] 求助啊！！帮忙分析一下~~~

回复 7楼至尊Bug 的帖子

[已解决] 求助啊！！帮忙分析一下~~~

回复 7楼 至尊Bug 的帖子

回复 7楼至尊Bug 的帖子