不管用IE还是OPERA上,上百度MP3老是弹广告。有时候在百度首页下面也弹。用N种杀流珉的工具查不东西来,扫了个SREng,大家看看有没有问题
- 2007-03-21,19:34:52
- System Repair Engineer 2.4.12.806
- Smallfrogs (http://www.KZTechs.com)
- Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
- 以下内容被选中:
- 所有的启动项目(包括注册表、启动文件夹、服务等)
- 浏览器加载项
- 正在运行的进程(包括进程模块信息)
- 文件关联
- Winsock 提供者
- Autorun.inf
- HOSTS 文件
- 启动项目
- 注册表
- [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
- <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
- [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
- <load><> [N/A]
- <run><> [N/A]
- [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
- <FY_FireWall><F:\Program Files\FengYun\FYFireWall.exe> [www.218.cc]
- <kav><"F:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"> [Kaspersky Lab]
- [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
- <shell><Explorer.exe> [(Verified)Microsoft Windows Publisher]
- <Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
- [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
- <AppInit_DLLs><> [N/A]
- [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
- <UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
- <WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll> [Kaspersky Lab]
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
- <IE7 Uninstall Stub><C:\WINDOWS\system32\ieudinit.exe> [(Verified)Microsoft Windows Publisher]
- ==================================
- 启动文件夹
- N/A
- ==================================
- 服务
- [Ati HotKey Poller / Ati HotKey Poller][Stopped/Disabled]
- <C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
- [AVG Anti-Spyware Guard / AVG Anti-Spyware Guard][Stopped/Manual Start]
- <f:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe><Anti-Malware Development a.s.>
- [卡巴斯基反病毒6.0 / AVP][Running/Auto Start]
- <"F:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r><Kaspersky Lab>
- [Human Interface Device Access / HidServ][Stopped/Disabled]
- <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
- ==================================
- 驱动程序
- [Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
- <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
- [ati2mtag / ati2mtag][Running/Manual Start]
- <system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
- [AVG Anti-Spyware Driver / AVG Anti-Spyware Driver][Running/System Start]
- <\??\f:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys><N/A>
- [AVG Anti-Spyware Clean Driver / AvgAsCln][Running/System Start]
- <System32\DRIVERS\AvgAsCln.sys><GRISOFT, s.r.o.>
- [ISO CD-ROM Device Driver / ISODrive][Stopped/Manual Start]
- <\??\D:\Program Files\UltraISO\drivers\ISODrive.sys><EZB Systems, Inc.>
- [kl1 / kl1][Running/Boot Start]
- <\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
- [klif / klif][Running/System Start]
- <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
- [KxTdifltDrv / KxTdifltDrv][Running/System Start]
- <\??\f:\Program Files\FengYun\KxTdiDrv.sys><N/A>
- [npkcrypt / npkcrypt][Running/Auto Start]
- <\??\D:\Program Files\Tencent\qq\npkcrypt.sys><INCA Internet Co., Ltd.>
- [PnpWmkDrv / PnpWmkDrv][Running/System Start]
- <\??\C:\WINDOWS\system32\drivers\PnpWmkDrv.sys><N/A>
- [Direct Parallel Link Driver / Ptilink][Running/Manual Start]
- <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
- [Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
- <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
- [Secdrv / Secdrv][Stopped/Manual Start]
- <system32\DRIVERS\secdrv.sys><N/A>
- [TSP / TSP][Stopped/Manual Start]
- <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
- ==================================
- 浏览器加载项
- [Thunder Browser Helper]
- {889D2FEB-5411-4565-8998-1DD2C5261283} <d:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_007.dll, Thunder Networking Technologies,LTD>
- [Office Genuine Advantage Validation Tool]
- {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} <C:\WINDOWS\system32\OGACheckControl.DLL, >
- [PowerPlr Control]
- {2354A44B-3CEB-4829-9940-545B03103538} <C:\WINDOWS\DOWNLO~1\PowerPlr.ocx, Powerise Digital>
- [Office Update Installation Engine]
- {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} <C:\WINDOWS\opuc.dll, Microsoft Corporation>
- [Windows Genuine Advantage Validation Tool]
- {17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft Corporation>
- [Windows Media Player]
- {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
- [PowerPlr Control]
- {2354A44B-3CEB-4829-9940-545B03103538} <C:\WINDOWS\DOWNLO~1\PowerPlr.ocx, Powerise Digital>
- [XML DOM Document]
- {2933BF90-7B36-11D2-B20E-00C04F983E60} <%SystemRoot%\system32\msxml3.dll, N/A>
- [XSL Template]
- {2933BF94-7B36-11D2-B20E-00C04F983E60} <%SystemRoot%\system32\msxml3.dll, N/A>
- [Microsoft Office Control]
- {4453D895-F2A1-4A38-A285-1EF9BD3F6D5D} <D:\PROGRA~1\MICROS~1\OFFICE11\AUTHZAX.DLL, Microsoft Corporation>
- [HHCtrl Object]
- {52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
- [Shell Name Space]
- {55136805-B2DE-11D1-B9F2-00A0C98BC547} <C:\WINDOWS\system32\ieframe.dll, Microsoft Corporation>
- [WUWebControl Class]
- {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
- [Windows Media Player]
- {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
- [Active Desktop Mover]
- {72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
- [MediaComm Class]
- {7670648D-461B-42AF-BDFE-46D26AF5EFF2} <d:\Program Files\Thunder Network\Thunder\Components\InMedia\MediaAddin11.dll, Thunder Networking Technologies,LTD>
- [360SafeLive]
- {87515F61-A66C-4319-A0E0-D416CB8059E3} <D:\Program Files\360safe\live.dll, 360safe.COM>
- [Thunder Browser Helper]
- {889D2FEB-5411-4565-8998-1DD2C5261283} <d:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_007.dll, Thunder Networking Technologies,LTD>
- [RMGetLicense Class]
- {A9FC132B-096D-460B-B7D5-1DB0FAE0C062} <C:\WINDOWS\system32\msnetobj.dll, Microsoft Corporation>
- [AUDIO__X_MS_WMA Moniker Class]
- {CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
- [RealPlayer G2 Control]
- {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
- [Shockwave Flash Object]
- {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
- [TimwpDll.TimwpCheck]
- {ED4CA2E5-0EEA-44C1-AD7E-74A07A7507A4} <D:\PROGRA~1\Tencent\qq\Timwp.dll, >
- [XML HTTP Request]
- {ED8C108E-4349-11D2-91A4-00C04F7969E8} <%SystemRoot%\system32\msxml3.dll, N/A>
- [Free Threaded XML DOM Document 3.0]
- {F5078F33-C551-11D3-89B9-0000F81FE221} <%SystemRoot%\system32\msxml3.dll, N/A>
- [XML DOM Document]
- {F6D90F11-9C73-11D3-B32E-00C04F990BB4} <%SystemRoot%\system32\msxml3.dll, N/A>
- [Free Threaded XML DOM Document]
- {F6D90F12-9C73-11D3-B32E-00C04F990BB4} <%SystemRoot%\system32\msxml3.dll, N/A>
- [XML HTTP]
- {F6D90F16-9C73-11D3-B32E-00C04F990BB4} <%SystemRoot%\system32\msxml3.dll, N/A>
- [&使用迅雷下载]
- <d:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
- [&使用迅雷下载全部链接]
- <d:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
- ==================================
- 正在运行的进程
- [PID: 496][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
- [PID: 556][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
- [PID: 1404][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
- [F:\Program Files\FengYun\fymon.dll] [www.218.cc, 1.2.3.1]
- [D:\Program Files\WinRAR\rarext.dll] [N/A, ]
- [D:\Program Files\工具\Unlocker1.8.5\UnlockerCOM.dll] [N/A, ]
- [F:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\shellex.dll] [Kaspersky Lab, 6.0.0.299]
- [f:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll] [Anti-Malware Development a.s., 7, 5, 0, 49]
- [D:\Program Files\工具\SPX截图\SPXInstantScreenCapture\engine.dll] [N/A, ]
- [PID: 1564][F:\Program Files\FengYun\FYFireWall.exe] [www.218.cc, 1.2.0.191]
- [F:\Program Files\FengYun\arpinfo.dll] [N/A, ]
- [F:\Program Files\FengYun\portinfo.dll] [www.218.cc, 1.2.0.5]
- [F:\Program Files\FengYun\fymon.dll] [www.218.cc, 1.2.3.1]
- [PID: 1580][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
- [F:\Program Files\FengYun\fymon.dll] [www.218.cc, 1.2.3.1]
- [PID: 1552][C:\WINDOWS\system32\taskmgr.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
- [F:\Program Files\FengYun\fymon.dll] [www.218.cc, 1.2.3.1]
- [D:\Program Files\工具\SPX截图\SPXInstantScreenCapture\engine.dll] [N/A, ]
- [PID: 1840][D:\Program Files\Tencent\qq\QQ.exe] [TENCENT, 0, 0, 0, 0]
- [D:\Program Files\Tencent\qq\QQBaseClassInDll.dll] [, 1, 0, 0, 1]
- [D:\Program Files\Tencent\qq\QQHelperDll.dll] [, 1, 0, 0, 1]
- [D:\Program Files\Tencent\qq\BasicCtrlDll.dll] [Tencent, 7, 0, 101, 80]
- [D:\Program Files\Tencent\qq\MFC42.DLL] [Microsoft Corporation, 6.00.8665.0]
- [D:\Program Files\Tencent\qq\MSVCP60.dll] [Microsoft Corporation, 6.02.3104.0]
- [D:\Program Files\Tencent\qq\PYKer.dll] [飘云 http://www.pyqq.cn, 飘云]
- [F:\Program Files\FengYun\fymon.dll] [www.218.cc, 1.2.3.1]
- [D:\Program Files\Tencent\qq\ipsearcher.dll] [, 1.0.0.3]
- [D:\Program Files\Tencent\qq\RICHED32.DLL] [Microsoft Corporation, 5.00.2134.1]
- [D:\Program Files\Tencent\qq\RICHED20.dll] [Microsoft Corporation, 5.31.23.1218]
- [D:\Program Files\Tencent\qq\QQAPI.dll] [, 1, 0, 0, 1]
- [D:\Program Files\Tencent\qq\LoginCtrl.dll] [N/A, ]
- [D:\Program Files\Tencent\qq\npkcntc.dll] [INCA Internet Co., Ltd., 2006, 6, 27, 1]
- [D:\Program Files\Tencent\qq\npkpdb.dll] [INCA Internet Co., Ltd., 2003, 10, 1, 1]
- [D:\Program Files\Tencent\qq\LoginCtrlRes.dll] [, 1, 0, 0, 1]
- [D:\Program Files\Tencent\qq\QQRes.dll] [tencent, 1, 0, 0, 1]
- [D:\Program Files\Tencent\qq\QQMainFrame.dll] [N/A, ]
- [D:\Program Files\Tencent\qq\CQQApplication.dll] [N/A, ]
- [D:\Program Files\Tencent\qq\NewSkin.dll] [, 1, 0, 0, 1]
- [D:\Program Files\Tencent\qq\HostingMgr.dll] [, 1, 0, 0, 1]
- [D:\Program Files\Tencent\qq\CameraDll.dll] [, 1, 0, 0, 1]
- [D:\Program Files\Tencent\qq\MailSummary.dll] [, 1, 0, 0, 1]
- [D:\Program Files\Tencent\qq\QQKnowledgeSearch.dll] [, 1, 0, 0, 1]
- [D:\Program Files\Tencent\qq\QQAllInOne.dll] [N/A, ]
- [D:\Program Files\Tencent\qq\GroupLive.dll] [N/A, ]
- [D:\Program Files\Tencent\qq\SCCore.dll] [TENCENT, 2, 0, 0, 1]
- [D:\Program Files\Tencent\qq\gdiplus.dll] [Microsoft Corporation, 5.1.3102.2180 (xpsp_sp2_rtm.040803-2158)]
- [D:\Program Files\Tencent\qq\QQSpace.dll] [, 1, 0, 0, 1]
- [D:\Program Files\Tencent\qq\vbscript.dll] [Microsoft Corporation, 5.6.0.7426]
- [C:\WINDOWS\system32\msdmo.dll] [, ]
- [D:\Program Files\Tencent\qq\QQGroupMng.dll] [, 1, 0, 0, 1]
- [D:\Program Files\Tencent\qq\UserDefinedHead.dll] [, 1, 0, 0, 1]
- [D:\Program Files\Tencent\qq\QQPlugin.dll] [N/A, ]
- [D:\Program Files\Tencent\qq\QQSysMsgMng.dll] [N/A, ]
- [D:\Program Files\Tencent\qq\FlashAvatarDll.dll] [, 1, 4, 0, 1]
- [D:\Program Files\Tencent\qq\QQAvatar.dll] [N/A, ]
- [D:\Program Files\Tencent\qq\QQConfigPlugin.dll] [, 1, 0, 0, 1]
- [D:\Program Files\Tencent\qq\QRingMng.dll] [N/A, ]
- [D:\Program Files\Tencent\qq\LongConnection.dll] [tencent, 5, 0, 200, 160]
- [D:\Program Files\Tencent\qq\PhoneAPI.dll] [, 1, 0, 0, 1]
- [D:\Program Files\Tencent\qq\DialerAllinOne.dll] [tencent, 1, 4, 0, 0]
- [D:\Program Files\Tencent\qq\QQPet.dll] [, 1, 0, 0, 1]
- [D:\Program Files\Tencent\qq\BQQApplication.dll] [N/A, ]
- [D:\Program Files\Tencent\qq\CommercesMng.dll] [, 1, 0, 0, 1]
- [D:\Program Files\Tencent\qq\PersonalDesktop.dll] [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2]
- [D:\Program Files\Tencent\qq\QQAddr.dll] [深圳市腾讯计算机系统有限公司, 5, 0, 101, 280]
- [D:\Program Files\Tencent\qq\QQSceneMng.dll] [N/A, ]
- [D:\Program Files\Tencent\qq\QQPhoneHelper.dll] [腾讯科技(深圳)有限公司, 2, 1, 5, 50]
- [PID: 1964][D:\Program Files\浏览器\Opera\Opera.exe] [Opera Software, 8746]
- [D:\Program Files\浏览器\Opera\Opera.dll] [Opera Software, 8746]
- [F:\Program Files\FengYun\fymon.dll] [www.218.cc, 1.2.3.1]
- [C:\WINDOWS\system32\FREEIME.IME] [Delphi Fan Studio, 4.00.950]
- [D:\Program Files\工具\SPX截图\SPXInstantScreenCapture\engine.dll] [N/A, ]
- [PID: 284][D:\Program Files\工具\扫描工具\sreng2\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
- [F:\Program Files\FengYun\fymon.dll] [www.218.cc, 1.2.3.1]
- [D:\Program Files\工具\SPX截图\SPXInstantScreenCapture\engine.dll] [N/A, ]
- [PID: 1256][D:\Program Files\工具\SPX截图\SPXInstantScreenCapture\spx.exe] [MoodySoft, 4.0.0.0]
- [D:\Program Files\工具\SPX截图\SPXInstantScreenCapture\ICQMAPI.dll] [N/A, ]
- [D:\Program Files\工具\SPX截图\SPXInstantScreenCapture\lpng.dll] [N/A, ]
- [D:\Program Files\工具\SPX截图\SPXInstantScreenCapture\freeze.dll] [N/A, ]
- [D:\Program Files\工具\SPX截图\SPXInstantScreenCapture\engine.dll] [N/A, ]
- [F:\Program Files\FengYun\fymon.dll] [www.218.cc, 1.2.3.1]
- [C:\WINDOWS\system32\FREEIME.IME] [Delphi Fan Studio, 4.00.950]
- ==================================
- 文件关联
- .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
- .EXE OK. ["%1" %*]
- .COM OK. ["%1" %*]
- .PIF OK. ["%1" %*]
- .REG OK. [regedit.exe "%1"]
- .BAT OK. ["%1" %*]
- .SCR OK. ["%1" /S]
- .CHM OK. ["C:\WINDOWS\hh.exe" %1]
- .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
- .INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
- .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
- .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
- .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
- .LNK OK. [{00021401-0000-0000-C000-000000000046}]
- ==================================
- Winsock 提供者
- N/A
- ==================================
- Autorun.inf
- N/A
- ==================================
- HOSTS 文件
- 127.0.0.1 localhost
- ==================================
- API HOOK
- RVA 错误: LoadLibraryA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xEFBB3B25)
- RVA 错误: LoadLibraryExA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xEFBB3D67)
- RVA 错误: LoadLibraryExW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xEFBB3F0B)
- RVA 错误: LoadLibraryW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xEFBB3C49)
- RVA 错误: GetProcAddress (危险等级: 高, 被下面模块所HOOK: Dest Addr: 0xEFBB3E8F)
- ==================================
- 隐藏进程
- N/A
- ==================================
复制代码 |