2007-04-15,14:11:04
System Repair Engineer 2.2.6.605
Smallfrogs (
http://www.KZTechs.com)
Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能
以下内容被选中:
所有的启动项目(包括注册表、启动文件夹、服务等)
浏览器加载项
正在运行的进程(包括进程模块信息)
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\Ctfmon.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<KavStart><"C:\kav2005\KAVStart.exe" -startup> [Kingsoft Corporation]
<CnsMin><Rundll32.exe C:\WINDOWS\DOWNLO~1\CnsMin.dll,Rundll32> [北京三七二一科技有限公司]
<MSConfig><C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<azcfg><%systemroot%\system32\Rundll32.exe %systemroot%\system32\azcfg.dll,DllUnregisterServer> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{AEB6717E-7E19-11d0-97EE-00C04FD91972}><shell32.dll> [(Verified)Microsoft Corporation]
<{D157330A-9EF3-49F8-9A67-4141AC41ADD4}><C:\WINDOWS\DOWNLO~1\cnshook.dll> [北京三七二一科技有限公司]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<PostBootReminder><%SystemRoot%\system32\SHELL32.dll> [(Verified)Microsoft Corporation]
<CDBurn><%SystemRoot%\system32\SHELL32.dll> [(Verified)Microsoft Corporation]
<WebCheck><%SystemRoot%\system32\webcheck.dll> [(Verified)Microsoft Corporation]
<SysTray><C:\WINDOWS\system32\stobject.dll> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
<WinlogonNotify: crypt32chain><crypt32.dll> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
<WinlogonNotify: cryptnet><cryptnet.dll> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
<WinlogonNotify: cscdll><cscdll.dll> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
<WinlogonNotify: igfxcui><igfxdev.dll> [(Verified)Intel Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
<WinlogonNotify: ScCertProp><wlnotify.dll> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
<WinlogonNotify: Schedule><wlnotify.dll> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
<WinlogonNotify: sclgntfy><sclgntfy.dll> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
<WinlogonNotify: SensLogn><WlNotify.dll> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
<WinlogonNotify: termsrv><wlnotify.dll> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
<WinlogonNotify: wlballoon><wlnotify.dll> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
<{438755C2-A8BA-11D1-B96B-00A0C90312E1}><%SystemRoot%\system32\browseui.dll> [(Verified)Microsoft Corporation]
<{8C7461EF-2B13-11d2-BE35-3078302C2030}><%SystemRoot%\system32\browseui.dll> [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><C:\WINDOWS\system32\ssstars.scr> [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<0w9g6><; C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\c0nime.exe> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<Alcmtr><; ALCMTR.EXE> [(Verified)Realtek Semiconductor Corp.]
<Anti-Spy Tools><; D:\bhcc\ast\AST.exe -min> [DSW Lab]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<blin><; "C:\Documents and Settings\Administrator\blin\blin.exe" -background> [(Verified)BLin Inc.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<CnsM.dll><; Rundll32.exe C:\PROGRA~1\3721\CnsM.dll,Rundll32> [N/A]
<CnsMin><; Rundll32.exe C:\WINDOWS\DOWNLO~1\CnsMin.dll,Rundll32> [北京三七二一科技有限公司]
<EnergyCut><; C:\Program Files\Lenovo\EnergyCut\EnergyCut.exe> [N/A]
<EnergyUtility><; C:\Program Files\Lenovo\EnergyCut\utilty.exe> [TODO: <Company name>]
<High Definition Audio Property Page Shortcut><; CHDAudPropShortcut.exe> [(Verified)Windows (R) Server 2003 DDK provider]
<iDuba Personal FireWall><; > [N/A]
<igfxhkcmd><; C:\WINDOWS\system32\hkcmd.exe> [N/A]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation]
<IMSCMig><; C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload> [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<KavPFW><; "C:\kav2005\KPFW32.EXE"> [Kingsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<Kavrun><; > [N/A]
<miniqqlive><; "C:\Program Files\Tencent\QQLive\MiniQQLive.exe"> [Tencent]
<PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<Power2GoExpress><; ???> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<RemoteControl><; "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"> [Cyberlink Corp.]
<RTHDCPL><; RTHDCPL.EXE> [(Verified)Realtek Semiconductor Corp.]
<shualai><; C:\WINDOWS\shualai.exe /i> [N/A]
<SkyTel><; SkyTel.EXE> [(Verified)Realtek Semiconductor Corp.]
<SmartAudio><; C:\Program Files\CONEXANT\SmartAudio\SmartAudio.exe -c> [Conexant]
<SMSERIAL><; C:\WINDOWS\sm56hlpr.exe> [(Verified)Motorola Inc.]
<StormCodec_Helper><; "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti> [N/A]
<SynTPEnh><; C:\Program Files\Synaptics\SynTP\SynTPEnh.exe> [(Verified)Synaptics, Inc.]
==================================
启动文件夹
N/A
==================================
服务
[18A30C0A / 18A30C0A]
<C:\WINDOWS\system32\18A30C0A.EXE -d><Microsoft Corporation>
[ASP.NET State Service / aspnet_state]
<C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe><Microsoft Corporation>
[Windows buis RunThem / buis]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\PROGRA~1\wmak\gwnx.dll>< >
[error monitor / EmonSrv]
<C:\WINDOWS\system32\lfrmewrk.exe><N/A>
[General Updater/AutoUpdater Service / GUA]
<"C:\Program Files\lenovo\GUA\GUA.exe"><lenovo>
[Human Interface Device Access / HidServ]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[IGRS / IGRS]
<C:\Program Files\Lenovo\IGRS\IGRS.exe><联想集团有限公司>
[IGRSFILE / IGRSFILE]
<C:\Program Files\lenovo\IGRS Profiles\File Profile\IgrsFile.exe><Lenovo Group Limited>
[IgrsMonitor / IgrsMonitor]
<C:\WINDOWS\System32\IgrsSvcs.exe -k IgrsSvcs-->C:\Program Files\Lenovo\IGRS\Ext\IgrsMonitor.dll><联想集团有限公司>
[Intelligent Network Config / IncSvc]
<C:\WINDOWS\System32\IgrsSvcs.exe -k IgrsSvcs-->C:\Program Files\Lenovo\IGRS\Ext\IncSvc.dll><联想集团有限公司>
[Kerberos Key Distribution Centers / kkdc]
<C:\WINDOWS\lsass.exe -netsvcs><N/A>
[Kingsoft Personal Firewall Service / KPfwSvc]
<"C:\kav2005\KPfwSvc.EXE"><Kingsoft Corporation>
[Kingsoft Antivirus KWatch Service / KWatchSvc]
<C:\kav2005\KWatch.EXE><Kingsoft Corporation>
[MicroGrid DirectRouter / MicroGrid.DirectRouter]
<C:\WINDOWS\System32\IgrsSvcs.exe -k IgrsSvcs-->C:\Program Files\Lenovo\IGRS\Ext\router.dll><联想集团有限公司>
[Remote / Remote]
<C:\WINDOWS\system32\kaspersky.exe><N/A>
[Remote Packet Capture Protocol v.0 (experimental) / rpcapd]
<"C:\Program Files\WinPcap\rpcapd.exe" -d -f "C:\Program Files\WinPcap\rpcapd.ini"><N/A>
[Network Security / Templates]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\xpmyz.dll><Microsoft Corporation>
[WinWMService / WinWMService]
<C:\WINDOWS\system32\RAVWM.EXE><N/A>
==================================
驱动程序
[Lenovo Virtual Power Controller Driver / ACPIVPC]
<system32\DRIVERS\AcpiVpc.sys><Lenovo Corporation>
[Broadcom 440x 10/100 Integrated Controller XP Driver / bcm4sbxp]
<system32\DRIVERS\bcm4sbxp.sys><Broadcom Corporation>
[CnsMinKP / CnsMinKP]
<\SystemRoot\system32\drivers\CnsMinKP.sys><Copyright (C) 3721 Corporation.>
[FrzSys / FrzSys]
<C:\WINDOWS\SYSTEM32\DRIVERS\FrzSys.SYS><PowerShadow>
[Microsoft UAA Function Driver for High Definition Audio Service / HdAudAddService]
<system32\drivers\CHDAud.sys><Conexant Systems Inc.>
[Microsoft UAA Bus Driver for High Definition Audio / HDAudBus]
<system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
[HSFHWAZL / HSFHWAZL]
<system32\DRIVERS\HSFHWAZL.sys><Conexant Systems, Inc.>
[HSF_DPV / HSF_DPV]
<system32\DRIVERS\HSF_DPV.sys><Conexant Systems, Inc.>
[ialm / ialm]
<system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[Service for Realtek HD Audio (WDM) / IntcAzAudAddService]
<system32\drivers\RtkHDAud.sys><Realtek Semiconductor Corp.>
[KNetWch / KNetWch]
<\??\C:\kav2005\KNetWch.SYS><Kingsoft Corporation>
[KWatch3 / KWatch3]
<\??\C:\WINDOWS\system32\drivers\KWatch3.SYS><Kingsoft Corporation>
[mdmxsdk / mdmxsdk]
<system32\DRIVERS\mdmxsdk.sys><Conexant>
[NetGroup Packet Filter Driver / NPF]
<system32\drivers\npf.sys><N/A>
[npkcrypt / npkcrypt]
<\??\C:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[Padus ASPI Shell / pfc]
<system32\drivers\pfc.sys><Padus, Inc.>
[Direct Parallel Link Driver / Ptilink]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Secdrv / Secdrv]
<system32\DRIVERS\secdrv.sys><N/A>
[sjsck / sjsck]
<\SystemRoot\\SystemRoot\System32\drivers\sjsck.sys><N/A>
[smserial / smserial]
<system32\DRIVERS\smserial.sys><Motorola Inc.>
[Synaptics TouchPad Driver / SynTP]
<system32\DRIVERS\SynTP.sys><Synaptics, Inc.>
[tifm21 / tifm21]
<system32\drivers\tifm21.sys><Texas Instruments>
[Conexant Setup API / UIUSys]
<system32\DRIVERS\UIUSYS.SYS><Conexant Systems, Inc>
[usb8028x / usb8028x]
<system32\drivers\usb8028x.sys><Windows System Internal>
[Intel(R) PRO/Wireless 3945ABG Adapter Driver / w39n51]
<system32\DRIVERS\w39n51.sys><Intel? Corporation>
[winachsf / winachsf]
<system32\DRIVERS\HSF_CNXT.sys><Conexant Systems, Inc.>
==================================
浏览器加载项
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[CBrowseStakeout Class]
{55302805-482E-470E-8A57-6795A1487F90} <C:\kav2005\KAVAFish.DLL, Kingsoft Corporation>
[CPPIE Class]
{C6844939-C324-41E0-84D0-D42F8DA5EBAD} <C:\WINDOWS\system32\hbcmd.dll, TODO: <公司名>>
[CnsHook Class]
{D157330A-9EF3-49F8-9A67-4141AC41ADD4} <C:\WINDOWS\DOWNLO~1\cnshook.dll, 北京三七二一科技有限公司>
[Yahoo 3.5G电邮]
{507F9113-CD77-4866-BA92-0E86DA3D0B97} <
http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail, N/A>
[名品折扣]
{59BC54A2-56B3-44a0-93E5-432D58746E26} <
http://adtaobao.allyes.com/main/adfclick?db=adtaobao&bid=138,140,18&cid=816,8,1&sid=5042&show=ignore&url=http://www.taobao.com/vertical/mall/pro.php?allyesPara=816, N/A>
[雅虎助手]
{5D73EE86-05F1-49ed-B850-E423120EC338} <
http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist, N/A>
[雅虎WIDGET]
{6354ABE6-05F1-49ed-B850-E423120EC338} <
http://cn.widget.yahoo.com/index.htm?source=Cns, N/A>
[情景聊天]
{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} <
http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg, N/A>
[]
{ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} <
http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair, N/A>
[]
{FD00D911-7529-4084-9946-A29F1BDF4FE5} <
http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean, N/A>
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[Menu Class]
{27D784D7-9217-4227-B43B-E06E4781E0CB} <C:\WINDOWS\system32\AlxTB1.dll, N/A>
[CBrowseStakeout Class]
{55302805-482E-470E-8A57-6795A1487F90} <C:\kav2005\KAVAFish.DLL, Kingsoft Corporation>
[BrowserProxy4 Class]
{69A72A8A-84ED-4A75-8CE7-263DBEF3E5D3} <C:\WINDOWS\system32\AlxTB1.dll, N/A>
[AutoLive]
{7CA83CF1-3AEA-42D0-A4E3-1594FC6E48B2} <C:\PROGRA~1\3721\autolive.dll, >
[IETimeBehaviorFactory Class]
{A4639D29-774E-11D3-A490-00C04F6843FB} <C:\PROGRA~1\COMMON~1\MICROS~1\MSORUN\MSORUN.DLL, Microsoft Corporation>
[IEAnimBehaviorFactory Class]
{A4639D2F-774E-11D3-A490-00C04F6843FB} <C:\PROGRA~1\COMMON~1\MICROS~1\MSORUN\MSORUN.DLL, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[CPPIE Class]
{C6844939-C324-41E0-84D0-D42F8DA5EBAD} <C:\WINDOWS\system32\hbcmd.dll, TODO: <公司名>>
[CnsHook Class]
{D157330A-9EF3-49F8-9A67-4141AC41ADD4} <C:\WINDOWS\DOWNLO~1\cnshook.dll, 北京三七二一科技有限公司>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[CPasswordEditCtrl Object]
{E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技(深圳)有限公司>
[VqqSpeedDlProxy Class]
{F138084D-84D7-48CD-BEA8-04772457516E} <C:\WINDOWS\vqqsdl.dll, N/A>
[金山毒霸反钓鱼...]
<C:\kav2005\KAF\ShowSet.htm, N/A>
==================================
正在运行的进程
[PID: 160][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 208][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 232][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 276][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 288][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 440][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 500][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\TcpIpDog0.dll] [N/A, N/A]
[PID: 560][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1004][C:\WINDOWS\system32\igfxsrvc.exe] [Intel Corporation, 3.0.0.4543]
[C:\WINDOWS\system32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4543]
[C:\WINDOWS\system32\igfxdev.dll] [Intel Corporation, 3.0.0.4543]
[PID: 1172][C:\WINDOWS\system32\Rundll32.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 2, 5, 0, 5]
[C:\WINDOWS\DOWNLO~1\CnsMinIO.dll] [北京三七二一科技有限公司, 2, 5, 0, 3]
[C:\WINDOWS\DOWNLO~1\cnsio.dll] [北京三七二一科技有限公司, 2, 5, 0, 2]
[C:\WINDOWS\DOWNLO~1\CnsMinEx.dll] [国风因特软件(北京)有限公司, 2, 5, 0, 2]
[PID: 1228][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 2, 5, 0, 5]
[PID: 1768][G:\Dr.Web\drweb32w.exe] [Doctor Web, Ltd., 4, 33, 2, 10067]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 2, 5, 0, 5]
[G:\Dr.Web\dwebllio.dll] [Doctor Web Ltd., 4, 32, 0, 0]
[PID: 1868][C:\WINDOWS\explorer.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 2, 5, 0, 5]
[C:\WINDOWS\DOWNLO~1\cnshook.dll] [北京三七二一科技有限公司, 2.5.0.3]
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 7.0.0.0]
[C:\WINDOWS\system32\igfxpph.dll] [Intel Corporation, 3.0.0.4543]
[C:\WINDOWS\system32\hccutils.DLL] [Intel Corporation, 3.0.0.4543]
[C:\WINDOWS\system32\igfxres.dll] [Intel Corporation, 3.0.0.4543]
[C:\WINDOWS\system32\igfxress.dll] [Intel Corporation, 3.0.0.4543]
[C:\WINDOWS\system32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4543]
[C:\kav2005\KAVEXT.DLL] [Kingsoft Corporation, 2005, 8, 5, 16]
[C:\Program Files\WinRAR\rarext.dll] [N/A, N/A]
[C:\WINDOWS\system32\msdmo.dll] [N/A, N/A]
[PID: 1688][G:\我的软件\木马杀客\mmsk.exe] [N/A, N/A]
[G:\我的软件\木马杀客\krnln.fnr] [, 1, 0, 0, 1]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 2, 5, 0, 5]
[G:\我的软件\木马杀客\iext.fne] [, 1, 0, 0, 1]
[G:\我的软件\木马杀客\HtmlView.fne] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\TcpIpDog0.dll] [N/A, N/A]
[G:\我的软件\木马杀客\TrayIcon.fne] [, 1, 0, 0, 1]
[G:\我的软件\木马杀客\iext2.fne] [, 1, 0, 0, 1]
[G:\我的软件\木马杀客\HYExtLib.fne] [N/A, N/A]
[G:\我的软件\木马杀客\xplib.fne] [N/A, N/A]
[G:\我的软件\木马杀客\shell.fne] [N/A, N/A]
[G:\我的软件\木马杀客\eAPI.fne] [, 1, 0, 0, 1]
[G:\我的软件\木马杀客\EThread.fne] [N/A, N/A]
[G:\我的软件\木马杀客\dp1.fne] [N/A, N/A]
[PID: 1744][C:\Program Files\WinRAR\WinRAR.exe] [N/A, N/A]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 2, 5, 0, 5]
[C:\WINDOWS\DOWNLO~1\cnshook.dll] [北京三七二一科技有限公司, 2.5.0.3]
[PID: 1800][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX01.609\sreng2\SREng\SREng.exe] [Smallfrogs Studio, 2.2.6.605]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 2, 5, 0, 5]
[C:\WINDOWS\system32\TcpIpDog0.dll] [N/A, N/A]
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
MSAFD Tcpip [TCP/IP]
C:\WINDOWS\system32\TcpIpDog0.dll(N/A, N/A)
MSAFD Tcpip [UDP/IP]
C:\WINDOWS\system32\TcpIpDog0.dll(N/A, N/A)
MSAFD Tcpip [RAW/IP]
C:\WINDOWS\system32\TcpIpDog0.dll(N/A, N/A)
RSVP UDP Service Provider
C:\WINDOWS\system32\TcpIpDogR0.dll(N/A, N/A)
RSVP TCP Service Provider
C:\WINDOWS\system32\TcpIpDogR0.dll(N/A, N/A)
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1 localhost
127.0.0.1 popwin.9983.com
219.129.239.223
www.npjxjy.com219.129.239.223 quxiuu.com
219.129.239.223
www.23b.cn219.129.239.223
www.baidulink.com219.129.239.223
www.ookkw.com219.129.239.223
www.97725.com219.129.239.223
www.54699.com219.129.239.223
www.wu7x.cn219.129.239.223 d.qbbd.com
219.129.239.223 w.qbbd.com
219.129.239.223 web.77276.com
219.129.239.223
www.77276.com219.129.239.223
www.npjxjy.com219.129.239.223
www.baidulink.com219.129.239.223
www.ookkw.com219.129.239.223
www.wu7x.cn219.129.239.223
www.wwwlm.net219.129.239.223 dm1.yiall.com
219.129.239.223
www.my6688.cn219.129.239.223
www.union123.com219.129.239.223
www.ktan.cn219.129.239.223
www.2t2t.cn219.129.239.223
www.cq530.com219.129.239.223
www.365tc.com219.129.239.223 ad.qucha.net
219.129.239.223
www.tan8.cn219.129.239.223
www.itjj.net219.129.239.223
www.start188.com219.129.239.223
www.at58.cn219.129.239.223 union.yxad.com
219.129.239.223
www.iptan.com219.129.239.223
www.ip2008.net219.129.239.223
www.yqif.com219.129.239.223
www.2t2t.cn219.129.239.223
www.688ip.com219.129.239.223
www.17tc.com219.129.239.223 www1.6tan.com
219.129.239.223 www2.6tan.com
219.129.239.223
www.6tan.com219.129.239.223
www.zztan.com219.129.239.223
www.5tanip.com219.129.239.223
www.16tc.com219.129.239.223
www.163se.net219.129.239.223
www.168080.com219.129.239.223
www.baidu8.org219.129.239.223
www.qqwei.com219.129.239.223 10.166.cn
219.129.239.223 9.166.cn
219.129.239.223 8.166.cn
219.129.239.223 7.166.cn
219.129.239.223 6.166.cn
219.129.239.223 5.166.cn
219.129.239.223 4.166.cn
219.129.239.223 3.166.cn
219.129.239.223 2.166.cn
219.129.239.223 1.166.cn
219.129.239.223 0.166.cn
219.129.239.223 pro.89178.com
219.129.239.223
www.89178.com219.129.239.223 666.89178.com
219.129.239.223 888.89178.com
219.129.239.223 999.89178.com
219.129.239.223 net888.89178.com
219.129.239.223 net888.89178.com
219.129.239.223 89178.com
219.129.239.223
www.166.cn219.129.239.223
www.so1.cn219.129.239.223 new.jixie123.cn
219.129.239.223
www.x.com.cn219.129.239.223 qz.magforum.net
219.129.239.223 cnnew.zcom.com
219.129.239.223 flash.btbbt.com
219.129.239.223
www.joyo.com219.129.239.223
www.nze21.com219.129.239.223
www.437799.com219.129.239.223
www.168080.com219.129.239.223 new2.jixie123.cn
219.129.239.223 info.souvv.cn
219.129.239.223
www.18dmm.com219.129.239.223
www.souxse.cn219.129.239.223 x.vvcyin.com
219.129.239.223 dm1.yiall.com
219.129.239.223
www.168080.com219.129.239.223
www.nze21.com219.129.239.223
www.puma163.com219.129.239.223
www.138505.com==================================