打印

程虎:技术专答【1】

本主题由 ButterflyLove 于 2008-5-8 16:59 下沉

282204495

虚无人生

五级士官

风之影者

积分: 1687

41楼 大中小发表于 2008-4-10 17:02 只看该作者

学习了。

虽然我不能为灾区做些什么。但祝愿灾区人民早日脱离苦海。我为你们祈祷，为你们默哀。让自己能为灾区献上一份祝福。

TOP

13002585381

新兵

积分: 2

42楼 大中小发表于 2008-4-10 20:11 只看该作者

win32.troj.agent.i.401408 如何删除

在屏幕右下方　实时防毒．反复跳出＂病毒已经被删除．＂很是烦人　金山杀毒查也查不出来．

TOP

lssy158

一级士官

积分: 228

43楼 大中小发表于 2008-4-10 20:42 只看该作者

二位真可谓劳苦功高！受教了！谢谢！谢谢！

TOP

yyw2595952

新兵

积分: 7

44楼 大中小发表于 2008-4-10 23:16 只看该作者

是中木马了吗？

TOP

xxxhz

新兵

积分: 4

45楼 大中小发表于 2008-4-10 23:17 只看该作者

Win32.Troj.Agent.i.401408 这是什么病毒啊在线等

TOP

KSDA8456367

新兵

积分: 2

46楼 大中小发表于 2008-4-11 09:12 只看该作者

顽毒不清

==============================================================
      金山清理专家系统诊断报告

该诊断报告由金山清理专家提供 http://www.duba.net
==============================================================

诊断时间:          2001-01-01, 00:10
诊断平台:          Windows XP [5.1.2600] Service Pack 2
IE版本:             Internet Explorer V6.0.2180.2900
计算机物理内存:    255(MB)
当前可用内存:       92(MB)
硬盘总大小:       18(GB)
硬盘可用空间:       16(GB)
清理专家版本:       2008,03,27,81
恶意软件库版本:    2008.01.11.1
漏洞库版本:       2007.12.18.1

==============================================================
      执行挂钩
==============================================================

该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{28EB3777-3E23-4E72-8449-A992D09D24C3}>          <C:\WINDOWS\system32\zgfdet.dll>
      文件路径: C:\WINDOWS\system32\zgfdet.dll [分析中]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{6E6CA8A1-81BC-4707-A54C-F4903DD70BAD}>          <C:\WINDOWS\system32\zgxfdx.dll>
      文件路径: C:\WINDOWS\system32\zgxfdx.dll [分析中]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{8C41B7F7-3168-400D-A702-0E7EFE0BA304}>          <C:\WINDOWS\system32\sgrefg.dll>
      文件路径: C:\WINDOWS\system32\sgrefg.dll [分析中]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{45AADFAA-DD36-42AB-83AD-0521BBF58C24}>          <C:\WINDOWS\system32\zjydcx.dll>
      文件路径: C:\WINDOWS\system32\zjydcx.dll [分析中]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{EB71E0B3-E97D-4D30-8733-E28266467617}>          <C:\WINDOWS\system32\wyhesm.dll>
      文件路径: C:\WINDOWS\system32\wyhesm.dll [分析中]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{7914E0AA-ECCB-4311-B584-C49538227824}>          <C:\WINDOWS\system32\jhfrxz.dll>
      文件路径: C:\WINDOWS\system32\jhfrxz.dll [分析中]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{F99DEFDD-200B-4410-B572-E90883D527D2}>          <C:\WINDOWS\system32\wrqszl.dll>
      文件路径: C:\WINDOWS\system32\wrqszl.dll [分析中]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{1E51C0FD-EE36-434B-AD2A-FD1FF3731C38}>          <C:\WINDOWS\system32\wyrsdj.dll>
      文件路径: C:\WINDOWS\system32\wyrsdj.dll [分析中]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{b4d47a00-9d9c-4272-96e1-620385045b02}>          <C:\WINDOWS\system32\aySADSAD1032.dll>
      文件路径: C:\WINDOWS\system32\aySADSAD1032.dll [病毒程序]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{5ac6d3c3-f564-407e-9c4b-ce4b6cd3f9ac}>          <C:\WINDOWS\system32\ttQACQAC1032.dll>
      文件路径: C:\WINDOWS\system32\ttQACQAC1032.dll [分析中]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{c4bf46a2-1c05-427d-992f-4e24f7d57f68}>          <C:\WINDOWS\system32\ttNNBNNB1047.dll>
      文件路径: C:\WINDOWS\system32\ttNNBNNB1047.dll [分析中]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{1DB3C525-5271-46F7-887A-D4E1ADAA7632}>          <C:\WINDOWS\system32\hfrdzx.dll>
      文件路径: C:\WINDOWS\system32\hfrdzx.dll [分析中]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{17DFD111-BF3A-4CB4-ADB0-88FCBFE69821}>          <C:\WINDOWS\system32\hhrdxd.dll>
      文件路径: C:\WINDOWS\system32\hhrdxd.dll [分析中]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{fff1c771-4dc7-4c01-8be1-8495780f3f1d}>          <C:\WINDOWS\system32\txTQLTQL1039.dll>
      文件路径: C:\WINDOWS\system32\txTQLTQL1039.dll [分析中]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{841529CB-7F77-4B99-A895-B5441E0D302F}>          <C:\WINDOWS\system32\jfrwdh.dll>
      文件路径: C:\WINDOWS\system32\jfrwdh.dll [分析中]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{5E907A48-400E-4EA8-9792-FFAE052D59E9}>          <C:\WINDOWS\system32\pedadt.dll>
      文件路径: C:\WINDOWS\system32\pedadt.dll [分析中]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{27D89EDA-2197-4DFC-B3DC-AF22C6CA23BB}>          <C:\WINDOWS\system32\fedadh.dll>
      文件路径: C:\WINDOWS\system32\fedadh.dll [分析中]

==============================================================
      启动文件夹位置
==============================================================

Common Startup:    C:\Documents and Settings\All Users\「开始」菜单\程序\启动
Startup:          C:\Documents and Settings\Administrator\「开始」菜单\程序\启动
Common Startup:    %ALLUSERSPROFILE%\「开始」菜单\程序\启动

==============================================================
      Host File
==============================================================

127.0.0.1    localhost

==============================================================
      系统服务
==============================================================

该项来源: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

      [HidServ] [已禁用]          <%SystemRoot%\System32\hidserv.dll>

==============================================================
      驱动程序
==============================================================

该项来源: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

      [ATSpy] [已启用]             <\??\C:\WINDOWS\system32\ATSpy.sys>

      [fpids32] [已启用]             <\??\C:\WINDOWS\system32\drivers\msosfpids32.sys>
      文件路径: C:\WINDOWS\system32\drivers\msosfpids32.sys [分析中]

      [mhfp] [已启用]                <\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp1.tmp>

      [msfpfis64] [已启用]          <\??\C:\WINDOWS\system32\drivers\msosmsfpfis64.sys>
      文件路径: C:\WINDOWS\system32\drivers\msosmsfpfis64.sys [分析中]

      [Ntdfdisk] [已启用]          <\??\C:\WINDOWS\system32\drivers\ntdfdisk.sys>
      文件路径: C:\WINDOWS\system32\drivers\ntdfdisk.sys [分析中]

      [ping] [已启用]                <\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp56.tmp>

==============================================================
      BHO
==============================================================

该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

      [SrchHook Class]
      {F08555B0-9CC3-11D2-AA8E-000000000000}  <C:\WINDOWS\system32\IEBHO.dll>
      文件路径: C:\WINDOWS\system32\IEBHO.dll [分析中]

==============================================================
      当前进程
==============================================================

名称:    ctfmon.exe  [已启用]
命令行: "C:\WINDOWS\ctfmon.exe"
文件路径: C:\WINDOWS\ctfmon.exe  [可疑的]
模块文件: C:\WINDOWS\system32\ntdll.dll                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\kernel32.dll             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\USER32.DLL                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\GDI32.dll                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\IMM32.DLL                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\ADVAPI32.dll             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\RPCRT4.dll                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\LPK.DLL                   (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\USP10.dll                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\msvcrt.dll                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\SHELL32.DLL             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\SHLWAPI.dll             (Microsoft Corporation)
模块文件: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll  (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\comctl32.dll             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\WININET.DLL             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\CRYPT32.dll             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\MSASN1.dll                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\OLEAUT32.dll             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\ole32.dll                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\URLMON.DLL                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\VERSION.dll             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\uxtheme.dll             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\msctfime.ime             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\netapi32.dll             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\SETUPAPI.dll             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\appHelp.dll             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\CLBCATQ.DLL             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\COMRes.dll                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\WS2_32.DLL                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\WS2HELP.dll             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\aySADSAD1032.dll
模块文件: C:\WINDOWS\system32\ttQACQAC1032.dll
模块文件: C:\WINDOWS\system32\ttNNBNNB1047.dll
模块文件: C:\WINDOWS\system32\txTQLTQL1039.dll
模块文件: C:\WINDOWS\system32\Secur32.dll             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\fedadh.dll
模块文件: C:\WINDOWS\system32\hhrdxd.dll
模块文件: C:\WINDOWS\system32\wyrsdj.dll
模块文件: C:\WINDOWS\system32\hfrdzx.dll
模块文件: C:\WINDOWS\system32\pedadt.dll
模块文件: C:\WINDOWS\system32\jfrwdh.dll
模块文件: C:\WINDOWS\system32\wrqszl.dll
模块文件: C:\WINDOWS\system32\jhfrxz.dll
模块文件: C:\WINDOWS\system32\sgrefg.dll
模块文件: C:\WINDOWS\system32\zjydcx.dll
模块文件: C:\WINDOWS\system32\wyhesm.dll
模块文件: C:\WINDOWS\system32\zgxfdx.dll
模块文件: C:\WINDOWS\system32\zgfdet.dll
模块文件: C:\WINDOWS\system32\MSCTF.dll                (Microsoft Corporation)

TOP

KSDA8456367

新兵

积分: 2

47楼 大中小发表于 2008-4-11 09:40 只看该作者

顽毒不清

==============================================================
      金山清理专家系统诊断报告

该诊断报告由金山清理专家提供 http://www.duba.net
==============================================================

诊断时间:          2001-01-01, 00:10
诊断平台:          Windows XP [5.1.2600] Service Pack 2
IE版本:             Internet Explorer V6.0.2180.2900
计算机物理内存:    255(MB)
当前可用内存:       92(MB)
硬盘总大小:       18(GB)
硬盘可用空间:       16(GB)
清理专家版本:       2008,03,27,81
恶意软件库版本:    2008.01.11.1
漏洞库版本:       2007.12.18.1

==============================================================
      执行挂钩
==============================================================

该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{28EB3777-3E23-4E72-8449-A992D09D24C3}>          <C:\WINDOWS\system32\zgfdet.dll>
      文件路径: C:\WINDOWS\system32\zgfdet.dll [分析中]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{6E6CA8A1-81BC-4707-A54C-F4903DD70BAD}>          <C:\WINDOWS\system32\zgxfdx.dll>
      文件路径: C:\WINDOWS\system32\zgxfdx.dll [分析中]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{8C41B7F7-3168-400D-A702-0E7EFE0BA304}>          <C:\WINDOWS\system32\sgrefg.dll>
      文件路径: C:\WINDOWS\system32\sgrefg.dll [分析中]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{45AADFAA-DD36-42AB-83AD-0521BBF58C24}>          <C:\WINDOWS\system32\zjydcx.dll>
      文件路径: C:\WINDOWS\system32\zjydcx.dll [分析中]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{EB71E0B3-E97D-4D30-8733-E28266467617}>          <C:\WINDOWS\system32\wyhesm.dll>
      文件路径: C:\WINDOWS\system32\wyhesm.dll [分析中]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{7914E0AA-ECCB-4311-B584-C49538227824}>          <C:\WINDOWS\system32\jhfrxz.dll>
      文件路径: C:\WINDOWS\system32\jhfrxz.dll [分析中]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{F99DEFDD-200B-4410-B572-E90883D527D2}>          <C:\WINDOWS\system32\wrqszl.dll>
      文件路径: C:\WINDOWS\system32\wrqszl.dll [分析中]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{1E51C0FD-EE36-434B-AD2A-FD1FF3731C38}>          <C:\WINDOWS\system32\wyrsdj.dll>
      文件路径: C:\WINDOWS\system32\wyrsdj.dll [分析中]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{b4d47a00-9d9c-4272-96e1-620385045b02}>          <C:\WINDOWS\system32\aySADSAD1032.dll>
      文件路径: C:\WINDOWS\system32\aySADSAD1032.dll [病毒程序]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{5ac6d3c3-f564-407e-9c4b-ce4b6cd3f9ac}>          <C:\WINDOWS\system32\ttQACQAC1032.dll>
      文件路径: C:\WINDOWS\system32\ttQACQAC1032.dll [分析中]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{c4bf46a2-1c05-427d-992f-4e24f7d57f68}>          <C:\WINDOWS\system32\ttNNBNNB1047.dll>
      文件路径: C:\WINDOWS\system32\ttNNBNNB1047.dll [分析中]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{1DB3C525-5271-46F7-887A-D4E1ADAA7632}>          <C:\WINDOWS\system32\hfrdzx.dll>
      文件路径: C:\WINDOWS\system32\hfrdzx.dll [分析中]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{17DFD111-BF3A-4CB4-ADB0-88FCBFE69821}>          <C:\WINDOWS\system32\hhrdxd.dll>
      文件路径: C:\WINDOWS\system32\hhrdxd.dll [分析中]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{fff1c771-4dc7-4c01-8be1-8495780f3f1d}>          <C:\WINDOWS\system32\txTQLTQL1039.dll>
      文件路径: C:\WINDOWS\system32\txTQLTQL1039.dll [分析中]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{841529CB-7F77-4B99-A895-B5441E0D302F}>          <C:\WINDOWS\system32\jfrwdh.dll>
      文件路径: C:\WINDOWS\system32\jfrwdh.dll [分析中]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{5E907A48-400E-4EA8-9792-FFAE052D59E9}>          <C:\WINDOWS\system32\pedadt.dll>
      文件路径: C:\WINDOWS\system32\pedadt.dll [分析中]

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

      <{27D89EDA-2197-4DFC-B3DC-AF22C6CA23BB}>          <C:\WINDOWS\system32\fedadh.dll>
      文件路径: C:\WINDOWS\system32\fedadh.dll [分析中]

==============================================================
      启动文件夹位置
==============================================================

Common Startup:    C:\Documents and Settings\All Users\「开始」菜单\程序\启动
Startup:          C:\Documents and Settings\Administrator\「开始」菜单\程序\启动
Common Startup:    %ALLUSERSPROFILE%\「开始」菜单\程序\启动

==============================================================
      Host File
==============================================================

127.0.0.1    localhost

==============================================================
      系统服务
==============================================================

该项来源: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

      [HidServ] [已禁用]          <%SystemRoot%\System32\hidserv.dll>

==============================================================
      驱动程序
==============================================================

该项来源: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

      [ATSpy] [已启用]             <\??\C:\WINDOWS\system32\ATSpy.sys>

      [fpids32] [已启用]             <\??\C:\WINDOWS\system32\drivers\msosfpids32.sys>
      文件路径: C:\WINDOWS\system32\drivers\msosfpids32.sys [分析中]

      [mhfp] [已启用]                <\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp1.tmp>

      [msfpfis64] [已启用]          <\??\C:\WINDOWS\system32\drivers\msosmsfpfis64.sys>
      文件路径: C:\WINDOWS\system32\drivers\msosmsfpfis64.sys [分析中]

      [Ntdfdisk] [已启用]          <\??\C:\WINDOWS\system32\drivers\ntdfdisk.sys>
      文件路径: C:\WINDOWS\system32\drivers\ntdfdisk.sys [分析中]

      [ping] [已启用]                <\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp56.tmp>

==============================================================
      BHO
==============================================================

该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

      [SrchHook Class]
      {F08555B0-9CC3-11D2-AA8E-000000000000}  <C:\WINDOWS\system32\IEBHO.dll>
      文件路径: C:\WINDOWS\system32\IEBHO.dll [分析中]

==============================================================
      当前进程
==============================================================

名称:    ctfmon.exe  [已启用]
命令行: "C:\WINDOWS\ctfmon.exe"
文件路径: C:\WINDOWS\ctfmon.exe  [可疑的]
模块文件: C:\WINDOWS\system32\ntdll.dll                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\kernel32.dll             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\USER32.DLL                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\GDI32.dll                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\IMM32.DLL                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\ADVAPI32.dll             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\RPCRT4.dll                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\LPK.DLL                   (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\USP10.dll                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\msvcrt.dll                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\SHELL32.DLL             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\SHLWAPI.dll             (Microsoft Corporation)
模块文件: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll  (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\comctl32.dll             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\WININET.DLL             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\CRYPT32.dll             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\MSASN1.dll                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\OLEAUT32.dll             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\ole32.dll                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\URLMON.DLL                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\VERSION.dll             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\uxtheme.dll             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\msctfime.ime             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\netapi32.dll             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\SETUPAPI.dll             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\appHelp.dll             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\CLBCATQ.DLL             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\COMRes.dll                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\WS2_32.DLL                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\WS2HELP.dll             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\aySADSAD1032.dll
模块文件: C:\WINDOWS\system32\ttQACQAC1032.dll
模块文件: C:\WINDOWS\system32\ttNNBNNB1047.dll
模块文件: C:\WINDOWS\system32\txTQLTQL1039.dll
模块文件: C:\WINDOWS\system32\Secur32.dll             (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\fedadh.dll
模块文件: C:\WINDOWS\system32\hhrdxd.dll
模块文件: C:\WINDOWS\system32\wyrsdj.dll
模块文件: C:\WINDOWS\system32\hfrdzx.dll
模块文件: C:\WINDOWS\system32\pedadt.dll
模块文件: C:\WINDOWS\system32\jfrwdh.dll
模块文件: C:\WINDOWS\system32\wrqszl.dll
模块文件: C:\WINDOWS\system32\jhfrxz.dll
模块文件: C:\WINDOWS\system32\sgrefg.dll
模块文件: C:\WINDOWS\system32\zjydcx.dll
模块文件: C:\WINDOWS\system32\wyhesm.dll
模块文件: C:\WINDOWS\system32\zgxfdx.dll
模块文件: C:\WINDOWS\system32\zgfdet.dll
模块文件: C:\WINDOWS\system32\MSCTF.dll                (Microsoft Corporation)