==============================================================
金山清理专家系统诊断报告
该诊断报告由金山清理专家提供
http://www.duba.net
==============================================================
诊断时间: 2008-02-29, 09:52
诊断平台: Windows XP [5.1.2600] Service Pack 2
IE版本: Internet Explorer V6.0.2180.2900
计算机物理内存: 1022(MB)
当前可用内存: 499(MB)
硬盘总大小: 74(GB)
硬盘可用空间: 33(GB)
清理专家版本: 2008,02,28,153
恶意软件库版本: 2008.02.28.2
漏洞库版本: 2008.02.17.1
==============================================================
映像劫持
==============================================================
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
<nod32.exeNavapsvc.exe> <ntsd -d>
文件路径: C:\WINDOWS\system32\ntsd.exe [可疑的] [5.1.2600.0 (XPClient.010817-1148)]
<OllyDBG.EXE> <ntsd -d>
文件路径: C:\WINDOWS\system32\ntsd.exe [可疑的] [5.1.2600.0 (XPClient.010817-1148)]
<OllyICE.EXE> <ntsd -d>
文件路径: C:\WINDOWS\system32\ntsd.exe [可疑的] [5.1.2600.0 (XPClient.010817-1148)]
<RegTool.exe> <ntsd -d>
文件路径: C:\WINDOWS\system32\ntsd.exe [可疑的] [5.1.2600.0 (XPClient.010817-1148)]
<rfwstub.exe> <ntsd -d>
文件路径: C:\WINDOWS\system32\ntsd.exe [可疑的] [5.1.2600.0 (XPClient.010817-1148)]
==============================================================
常规启动项
==============================================================
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[IMJPMIG8.1] <; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>
[PHIME2002ASync] <; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>
[PHIME2002A] <; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>
[SynTPLpr] <; C:\Program Files\Synaptics\SynTP\SynTPLpr.exe>
[SynTPEnh] <; C:\Program Files\Synaptics\SynTP\SynTPEnh.exe>
[WebThunder] <; d:\Program Files\Thunder Network\WebThunder\WebThunder.exe>
[360Safetray] <D:\Program Files\360safe\safemon\360tray.exe /start>
文件路径: D:\Program Files\360safe\safemon\360tray.exe [分析中]
[BluetoothAuthenticationAgent] <REM ; rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent>
[SunJavaUpdateSched] <REM ; "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe">
==============================================================
启动文件夹位置
==============================================================
Common Startup: C:\Documents and Settings\All Users\「开始」菜单\程序\启动
Startup: C:\Documents and Settings\石磊\「开始」菜单\程序\启动
Common Startup: %ALLUSERSPROFILE%\「开始」菜单\程序\启动
==============================================================
系统服务
==============================================================
该项来源: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
[HidServ] [已禁用] <%SystemRoot%\System32\hidserv.dll>
==============================================================
驱动程序
==============================================================
该项来源: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
[360AntiArp] [已启用] <\??\C:\WINDOWS\system32\drivers\360AntiArp.sys>
文件路径: C:\WINDOWS\system32\drivers\360AntiArp.sys [分析中]
[ATSpy] [已启用] <\??\C:\WINDOWS\system32\ATSpy.sys>
[DeepFree Update] [已启用] <\??\C:\WINDOWS\system32\drivers\pcihdd2.sys>
[NPF] [已启用] <system32\drivers\npf.sys>
[WmRegProDrv] [已启用] <System32\Drivers\WmRegProDrv.sys>
文件路径: C:\WINDOWS\system32\Drivers\WmRegProDrv.sys [分析中]
==============================================================
当前进程
==============================================================
名称: 360tray.exe [已启用]
命令行: "D:\Program Files\360safe\safemon\360tray.exe" /start
文件路径: D:\Program Files\360safe\safemon\360tray.exe [分析中] (奇虎网)
模块文件: C:\WINDOWS\system32\ntdll.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\kernel32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\MFC42.DLL (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\msvcrt.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\GDI32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\USER32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\ADVAPI32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\RPCRT4.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\Secur32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\SHLWAPI.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\COMCTL32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\ole32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\OLEAUT32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\VERSION.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\NETAPI32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\IMM32.DLL (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\LPK.DLL (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\USP10.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\MFC42LOC.DLL (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\uxtheme.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\RICHED32.DLL (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\RICHED20.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\apphelp.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\msctfime.ime (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\winabc.ime (Microsoft Corporation)
模块文件: D:\Program Files\360safe\safemon\safemon.dll (奇虎网)
模块文件: D:\Program Files\360safe\safemon\SafeKrnl.dll (奇虎网)
模块文件: D:\Program Files\360safe\AntiAdwa.dll (360Safe.com)
模块文件: C:\WINDOWS\system32\WININET.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\CRYPT32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\MSASN1.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\WS2_32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\WS2HELP.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\psapi.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\MSCTF.dll (Microsoft Corporation)
模块文件: D:\Program Files\360safe\live.dll (360safe.com)
模块文件: C:\WINDOWS\system32\SETUPAPI.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\mlang.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\wsock32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\hnetcfg.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\System32\wshtcpip.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\RASAPI32.DLL (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\rasman.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\TAPI32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\rtutils.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\WINMM.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\msv1_0.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\iphlpapi.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\sensapi.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\USERENV.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\DNSAPI.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\rasadhlp.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\CLBCATQ.DLL (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\COMRes.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\Msxml3.dll (Microsoft Corporation)
名称: 360Safe.exe [已启用]
命令行: "D:\Program Files\360safe\360Safe.exe"
文件路径: D:\Program Files\360safe\360Safe.exe [分析中] (奇虎网)
模块文件: C:\WINDOWS\system32\ntdll.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\kernel32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\MFC42.DLL (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\msvcrt.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\GDI32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\USER32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\comdlg32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\SHLWAPI.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\ADVAPI32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\RPCRT4.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\Secur32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\COMCTL32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\ole32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\OLEPRO32.DLL (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\OLEAUT32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\VERSION.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\MSIMG32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\PSAPI.DLL (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\IMM32.DLL (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\LPK.DLL (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\USP10.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\MFC42LOC.DLL (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\uxtheme.dll (Microsoft Corporation)
模块文件: D:\Program Files\360safe\safemon\safemon.dll (奇虎网)
模块文件: C:\WINDOWS\system32\MSCTF.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\NETAPI32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\RICHED32.DLL (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\RICHED20.dll (Microsoft Corporation)
模块文件: D:\Program Files\360safe\AntiAdwa.dll (360Safe.com)
模块文件: C:\WINDOWS\system32\WININET.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\CRYPT32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\MSASN1.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\WS2_32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\WS2HELP.dll (Microsoft Corporation)
模块文件: D:\Program Files\360safe\AntiEng.dll (360Safe.com)
模块文件: C:\WINDOWS\system32\apphelp.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\msctfime.ime (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\winabc.ime (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\asycfilt.dll (Microsoft Corporation)
模块文件: D:\Program Files\360safe\LeakCheck.dll (360Safe.com)
模块文件: C:\WINDOWS\system32\CLBCATQ.DLL (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\COMRes.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\mlang.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\Msxml3.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\CRYPTUI.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\WINTRUST.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\IMAGEHLP.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\WLDAP32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\SXS.DLL (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\wsock32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\hnetcfg.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\RASAPI32.DLL (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\rasman.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\TAPI32.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\rtutils.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\WINMM.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\System32\wshtcpip.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\msv1_0.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\iphlpapi.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\sensapi.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\USERENV.dll (Microsoft Corporation)
模块文件: D:\Program Files\360safe\CleanHis.dll (奇虎网)
模块文件: C:\WINDOWS\system32\DNSAPI.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\rasadhlp.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\NTMARTA.DLL (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\SAMLIB.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\xpsp2res.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\wbem\wbemprox.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\wbem\wbemcomn.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\wbem\wbemsvc.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\wbem\fastprox.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\MSVCP60.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\NTDSAPI.dll (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\SETUPAPI.dll (Microsoft Corporation)
