打印
[求助] 还是蓝屏啊，到底是不是病毒

君河
新兵
积分: 16
威望: 33
元宝: 0
铜钱: 23
1楼大中小发表于 2008-7-1 13:00 只看该作者
还是蓝屏啊，到底是不是病毒

顺便把蓝屏的图传上来，看看到底因为啥
复制内容到剪贴板
代码:

2008-06-30,23:33:50



System Repair Engineer 2.6.10.990

Smallfrogs (http://www.KZTechs.com)



Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能



以下内容被选中：

    所有的启动项目（包括注册表、启动文件夹、服务等）

    浏览器加载项

    正在运行的进程（包括进程模块信息）

    文件关联

    Winsock 提供者

    Autorun.inf

    HOSTS 文件

    进程特权扫描





启动项目

注册表

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]

    <speedfan><d:\SpeedFan\speedfan.exe>  [Almico Software (www.almico.com)]

    <Anders Kjersem: TransBar><C:\Program Files\Anders Kjersem\TransBar\TransBar.exe /NoConfig>  [Anders Kjersem]

    <KavPFW><"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KPFW32.EXE" -startup>  [(Verified)KINGSOFT CORPORATION]

[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]

    <load><>  [N/A]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

    <360Safebox><"C:\Program Files\360Safebox\safeboxTray.exe" /r>  [(Verified)Qizhi Software (beijing) Co. Ltd]

    <Wopti Memory Defreg><D:\Wopti\WoptiMem.exe>  [(Verified)"Chengdu Gongruan Network Technology Co.,Ltd."]

    <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]

    <nwiz><nwiz.exe /install>  []

    <Launch LGDCore><"C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE>  [Logitech Inc.]

    <Launch LCDMon><"C:\Program Files\Logitech\G-series Software\LCDMon.exe">  [Logitech Inc.]

    <SkyTel><SkyTel.EXE>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]

    <Alcmtr><ALCMTR.EXE>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]

    <NvMediaCenter><RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]

    <Windows木马防火墙><D:\ftc2008\Trojanwall.exe>  [风云谷科技]

    <KavStart><"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVStart.exe" -startup>  [(Verified)KINGSOFT CORPORATION]

    <360Safetray><D:\360safe\safemon\360tray.exe /start>  [(Verified)Qizhi Software (beijing) Co. Ltd]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

    <shell><Explorer.exe>  [(Verified)Microsoft Windows Component Publisher]

    <Userinit><C:\WINDOWS\system32\UserInit.exe,>  [(Verified)Microsoft Windows Publisher]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]

    <AppInit_DLLs><>  [N/A]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

    <WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll>  [(Verified)Microsoft Windows Component Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]

    <IE7 Uninstall Stub><C:\WINDOWS\system32\ieudinit.exe>  [(Verified)Microsoft Windows Component Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]

    <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub>  [(Verified)Microsoft Windows Component Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]

    <N/A><C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install>  [(Verified)Microsoft Corporation]



==================================

启动文件夹

[Logitech SetPoint]

  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Logitech SetPoint.lnk --> C:\PROGRA~1\Logitech\SetPoint\SetPoint.exe [Logitech Inc.]><N>

[Logitech Desktop Messenger]

  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Logitech Desktop Messenger.lnk --> C:\PROGRA~1\Logitech\DESKTO~1\8876480\Program\LOGITE~1.EXE [Logitech Inc.]><N>



==================================

服务

[3ware Controller Service / 3wareSrv][Stopped/Auto Start]

  <C:\WINDOWS\System32\3wareSrv.exe><N/A>

[HID Input Service / HidServ][Stopped/Auto Start]

  <\SystemRoot\C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><Microsoft Corporation>

[Kingsoft Internet Security Common Service / KISSvc][Running/Auto Start]

  <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KISSvc.EXE><Kingsoft Corporation>

[Kingsoft Personal Firewall Service / KPfwSvc][Running/Auto Start]

  <"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KPfwSvc.EXE"><Kingsoft Corporation>

[Kingsoft Antivirus KWatch Service / KWatchSvc][Running/Auto Start]

  <"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KWatch.EXE"><Kingsoft Corporation>

[NetMeeting Remote Desktop Sharing / mnmsrvc][Stopped/Manual Start]

  <><(File is missing)>

[File Replication Service / Ntfrs][Running/Auto Start]

  <C:\WINDOWS\system32\ntfrs.exe><Microsoft Corporation>

[Performance Service / nTuneService][Running/Auto Start]

  <C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe /StartService><NVIDIA>

[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]

  <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>

[O&O Defrag / O&O Defrag][Running/Auto Start]

  <C:\WINDOWS\system32\oodag.exe><Microsoft Corporation>

[FrontLine Drivers Auto Removal (v2) / sfrem02][Stopped/Auto Start]

  <C:\WINDOWS\system32\sfrem02.exe svc><Protection Technology (StarForce)>



==================================

驱动程序

[aaatimeo / aaatimeo][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\aaatimeo.sys><Microsoft Corporation>

[AFAMgt / AFAMgt][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\afamgt.sys><Adaptec, Inc.>

[ahcix86 / ahcix86][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\ahcix86.sys><ATI Technologies Inc.>

[AliIde / AliIde][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\aliide.sys><Acer Laboratories Inc.>

[AMD AGP Bus Filter Driver / amdagp][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\amdagp.sys><Advanced Micro Devices, Inc.>

[amdbusdr / amdbusdr][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\amdbusdr.sys><AMD>

[AMD EIDE 驱动程衼E / amdeide][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\AmdEide.sys><AMD>

[AMD K8 Processor Driver / AmdK8][Stopped/Manual Start]

  <System32\DRIVERS\amdk8.sys><Advanced Micro Devices>

[SiI-3112 SATALink  Controller / ASH1205][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\ASH1205.sys><Silicon Image, Inc.>

[ata1200a / ata1200a][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\ata1200a.sys><Adaptec, Inc.>

[atiide / atiide][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\atiide.sys><ATI Technologies Inc.>

[Promise driver accelerator / bb-run][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\bb-run.sys><Promise Technology, Inc.>

[bootdrv / bootdrv][Running/Boot Start]

  <\SystemRoot\System32\Drivers\bootdrv.sys><>

[DELL CERC SATA 1.5/6ch RAID Miniport Driver / cercsr6][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\cercsr6.sys><Adaptec, Inc.>

[CmdIde / CmdIde][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\cmdide.sys><CMD Technology, Inc.>

[Cpq32fs2 / Cpq32fs2][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\Cpq32fs2.sys><Hewlett-Packard Company>

[Promise Removable Disk Control Driver / dontgo][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\DontGo.sys><Promise Technology, Inc.>

[FTCkillfile / FTCkillfile][Stopped/Manual Start]

  <System32\Drivers\FTCkillfile.sys><N/A>

[FTCProtect / FTCProtect][Running/Manual Start]

  <System32\Drivers\FTCProtect.sys><N/A>

[FTCProTime / FTCProTime][Running/Manual Start]

  <System32\Drivers\FTCProTime.sys><N/A>

[fttxr52P / fttxr52P][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\fttxr52P.sys><Promise Technology, Inc.>

[giveio / giveio][Running/Boot Start]

  <\SystemRoot\system32\giveio.sys><N/A>

[Hamachi Network Interface / hamachi][Running/Manual Start]

  <system32\DRIVERS\hamachi.sys><LogMeIn, Inc.>

[Microsoft UAA Bus Driver for High Definition Audio / HDAudBus][Running/Manual Start]

  <system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>

[HpCISSm2 / HpCISSm2][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\HpCISSm2.sys><Hewlett-Packard Company>

[hptmv6 / hptmv6][Stopped/Boot Start]

  <\SystemRoot\system32\DRIVERS\hptmv6.sys><HighPoint Technologies, Inc.>

[Intel  RAID Controller / iaStor55][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\iaStor55.sys><Intel Corporation>

[Intel RAID  Controller / iaStor70][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\iaStor70.sys><Intel Corporation>

[Service for Realtek HD Audio (WDM) / IntcAzAudAddService][Running/Manual Start]

  <system32\drivers\RtkHDAud.sys><Realtek Semiconductor Corp.>

[KAVBase / KAVBase][Running/Auto Start]

  <\??\C:\WINDOWS\system32\Drivers\KAVBase.sys><Kingsoft Corporation>

[KAVBootC / KAVBootC][Running/Boot Start]

  <\SystemRoot\system32\Drivers\KAVBootC.sys><Kingsoft Corporation>

[KAVSafe / KAVSafe][Running/Auto Start]

  <\??\C:\WINDOWS\system32\Drivers\KAVSafe.sys><Kingsoft Corporation>

[KNetWch / KNetWch][Running/System Start]

  <\??\C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KNetWch.SYS><Kingsoft Corporation>

[KWatch3 / KWatch3][Running/Auto Start]

  <\??\C:\WINDOWS\system32\drivers\KWatch3.SYS><Kingsoft Corporation>

[Logitech SetPoint Keyboard Driver / L8042Kbd][Stopped/Manual Start]

  <system32\DRIVERS\L8042Kbd.sys><Logitech Inc.>

[Logitech SetPoint KMDF HID Filter Driver / LHidFilt][Running/Manual Start]

  <system32\DRIVERS\LHidFilt.Sys><Logitech, Inc.>

[Logitech SetPoint KMDF Mouse Filter Driver / LMouFilt][Running/Manual Start]

  <system32\DRIVERS\LMouFilt.Sys><Logitech, Inc.>

[mv61xx / mv61xx][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\mv61xx.sys><Marvell Semiconductor, Inc.>

[mvSata / mvSata][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\mvsata.sys><Marvell Semiconductors Inc.>

[nv / nv][Running/Manual Start]

  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>

[nvgts / nvgts][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\nvgts.sys><NVIDIA Corporation>

[NVR0Dev / NVR0Dev][Running/Manual Start]

  <\??\C:\WINDOWS\nvoclock.sys><NVidia Corp.>

[NVIDIA nForce RAID Driver / nvrd32][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\nvrd32.sys><NVIDIA Corporation>

[Direct Parallel Link Driver / Ptilink][Running/Manual Start]

  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>

[QKeyServiceDisplay / QKeyService][Running/Boot Start]

  <\SystemRoot\system32\KeyCrypt.sys><Tencent Technology (Shenzhen) Company Limited>

[ql2100 / ql2100][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\ql2100.sys><QLogic Corporation>

[ql2200 / ql2200][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\ql2200.sys><QLogic Corporation>

[rr172x / rr172x][Stopped/Boot Start]

  <\SystemRoot\system32\DRIVERS\rr172x.sys><HighPoint Technologies, Inc.>

[rr174x / rr174x][Stopped/Boot Start]

  <\SystemRoot\system32\DRIVERS\rr174x.sys><HighPoint Technologies, Inc.>

[rr2340 / rr2340][Stopped/Boot Start]

  <\SystemRoot\system32\DRIVERS\rr2340.sys><HighPoint Technologies, Inc.>

[Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver / RTLE8023xp][Running/Manual Start]

  <system32\DRIVERS\Rtenicxp.sys><Realtek Semiconductor Corporation>

[SafeBoxKrnl / SafeBoxKrnl][Running/System Start]

  <\??\C:\Program Files\360Safebox\SafeBoxKrnl.sys><360安全中心>

[Secdrv / Secdrv][Stopped/Manual Start]

  <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>

[FrontLine Environment Driver (v2) / sfdrv02][Running/Boot Start]

  <\SystemRoot\system32\drivers\sfdrv02.sys><Protection Technology (StarForce)>

[FrontLine Synchronization Driver (v5) / sfsync05][Running/Boot Start]

  <\SystemRoot\system32\drivers\sfsync05.sys><Protection Technology (StarForce)>

[SATALink External Device Filter / SiRemFil][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\SiRemFil.sys><Silicon Image, Inc.>

[SIS AGP Bus Filter / sisagp][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\sisagp.sys><Silicon Integrated Systems Corporation>

[sisraidx / sisraidx][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\sisraidx.sys><Silicon Integrated Systems Corp.>

[USB PC Camera (SNPSTD3) / SNPSTD3][Running/Manual Start]

  <system32\DRIVERS\snpstd3.sys><>

[speedfan / speedfan][Stopped/Boot Start]

  <\SystemRoot\system32\speedfan.sys><Windows (R) Server 2003 DDK provider>

[TesSafe / TesSafe][Stopped/Manual Start]

  <\??\C:\WINDOWS\system32\TesSafe.sys><TENCENT>

[ViBus / ViBus][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\ViBus.sys><VIA Technologies, Inc.>

[videX32 / videX32][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\videX32.sys><VIA Technologies, Inc.>

[VIA SATA IDE Device Driver / ViPrt][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\ViPrt.sys><VIA Technologies, Inc.>

[VIA SATA IDE Hot-plug Driver / xfilt][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\xfilt.sys><VIA Technologies,Inc>



==================================

浏览器加载项

[]

  {672AF8C7-19FA-485A-A82E-2642E15375B6} <D:\ftc2008\FygIEmon.dll, 木马清道夫－恶意网站屏蔽>

[Thunder Browser Helper]

  {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>

[QQHelper Class]

  {BF182DBF-1283-4BD3-86EE-D3239228770C} <D:\QQ\QQZoneHelper.dll, 深圳市腾讯计算机系统有限公司>

[kingsoft browser shield]

  {D963BE1A-6B35-47DB-B002-49FAE71D85CC} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL, Kingsoft Corporation>

[启动迅雷5]

  {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <C:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>

[浩方对战平台]

  {0A155D3C-68E2-4215-A47A-E800A446447A} <D:\浩方对战平台\GameClient.exe, 上海浩方在线信息技术有限公司>

[IEBuddyExtControl Class]

  {3AECD3C1-7085-4731-96DC-47B6CF7EF749} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL, Kingsoft Corporation>

[PhotoDraw Class]

  {2375BEE5-F175-4F1C-81EC-8E4E2E72E2DD} <D:\QQ\Qzone\QQPhotoDraw.dll, TENCENT>

[ThunderAtOnce Class]

  {01443AEC-0FD1-40FD-9C87-E93D1494C233} <C:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>

[GerneralPeerID Class]

  {0A47E819-F82E-4D5D-B806-6A9EA94D68CD} <C:\Program Files\Thunder Network\Thunder\Components\InMedia\peerid.dll, >

[ThunderServer.WebThunder]

  {1DE5794D-B609-4A3E-9E40-22594D5BEAAC} <C:\Program Files\Thunder\ComDlls\Faker.dll, >

[Windows Media Player]

  {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>

[PhotoDraw Class]

  {2375BEE5-F175-4F1C-81EC-8E4E2E72E2DD} <D:\QQ\Qzone\QQPhotoDraw.dll, TENCENT>

[HTML Document]

  {25336920-03F9-11CF-8FD0-00AA00686F13} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>

[XML DOM Document]

  {2933BF90-7B36-11D2-B20E-00C04F983E60} <%SystemRoot%\system32\msxml3.dll, N/A>

[DHTML Edit Control Safe for Scripting for IE5]

  {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>

[IEBuddyExtControl Class]

  {3AECD3C1-7085-4731-96DC-47B6CF7EF749} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL, Kingsoft Corporation>

[XML Document]

  {48123BC4-99D9-11D1-A6B3-00C04FD91555} <%SystemRoot%\system32\msxml3.dll, N/A>

[QQRightClick Class]

  {4836C333-208E-4BCE-B30B-00B9545B0F6E} <D:\QQ\QQIEHelper01.dll, 腾讯公司>

[Thunder Agent Class]

  {485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <C:\Program Files\Thunder\ComDlls\ThunderAgent_Now.dll, Thunder Networking Technologies,LTD>

[Kingsoft Trojan Webshield]

  {4E8A5278-C04E-4FE3-BF78-8A7CCD6EF333} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddy.dll, Kingsoft Corporation>

[HHCtrl Object]

  {52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>

[Shell Name Space]

  {55136805-B2DE-11D1-B9F2-00A0C98BC547} <C:\WINDOWS\system32\ieframe.dll, Microsoft Corporation>

[WUWebControl Class]

  {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>

[XMP Class]

  {6483F145-A768-4C41-AACC-52D4D7845851} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xplayer.dll_1_work, >

[]

  {672AF8C7-19FA-485A-A82E-2642E15375B6} <D:\ftc2008\FygIEmon.dll, 木马清道夫－恶意网站屏蔽>

[XDRM]

  {693571CB-54A3-4E90-9D52-EEAE1334E2D3} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xdrm.dll_1_work, >

[JetCar.Netscape]

  {69C7BEA7-0A70-4291-81ED-405D19AEE270} <C:\Program Files\Thunder\ComDlls\Faker.dll, >

[Windows Media Player]

  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>

[MediaComm Class]

  {7670648D-461B-42AF-BDFE-46D26AF5EFF2} <C:\Program Files\Thunder Network\Thunder\Components\InMedia\MediaAddin16.dll, Thunder Networking Technologies,LTD>

[360SafeLive]

  {87515F61-A66C-4319-A0E0-D416CB8059E3} <D:\360safe\live.dll, 360.cn>

[Microsoft Web Browser]

  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\ieframe.dll, Microsoft Corporation>

[Thunder Browser Helper]

  {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>

[XML DOM 文档 5.0]

  {88D969E5-F192-11D4-A65F-0040963251E5} <C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSXML5.DLL, Microsoft Corporation>

[RMGetLicense Class]

  {A9FC132B-096D-460B-B7D5-1DB0FAE0C062} <C:\WINDOWS\system32\msnetobj.dll, Microsoft Corporation>

[Thunder DapCtrl]

  {ACACC6EB-1FBA-4E13-A729-53AEB2DF54F8} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\DapCtrl1.5.578.28.40.dll, ShenZhen Thunder Networking Technologies Ltd.>

[SafeMon Class]

  {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <D:\360safe\safemon\safemon.dll, 360.CN>

[RDS.DataSpace]

  {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>

[QQHelper Class]

  {BF182DBF-1283-4BD3-86EE-D3239228770C} <D:\QQ\QQZoneHelper.dll, 深圳市腾讯计算机系统有限公司>

[QQPlayerCtrl Class]

  {CD108273-D434-43E6-AA90-1469F97EB398} <D:\QQMusic\QzoneMusic.dll, 深圳腾讯科技>

[AUDIO__MP3 Moniker Class]

  {CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>

[AUDIO__X_MS_WMA Moniker Class]

  {CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>

[VIDEO__X_MS_ASF Moniker Class]

  {CD3AFA8F-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>

[RealPlayer G2 Control]

  {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>

[Shockwave Flash Object]

  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>

[kingsoft browser shield]

  {D963BE1A-6B35-47DB-B002-49FAE71D85CC} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL, Kingsoft Corporation>

[PlayerCtrl Class]

  {E05BC2A3-9A46-4A32-80C9-023A473F5B23} <D:\QQMusic\QzoneMusic.dll, 深圳腾讯科技>

[RevealTrans]

  {E31E87C4-86EA-4940-9B8A-5BD5D179A737} <C:\WINDOWS\system32\Dxtmsft.dll, Microsoft Corporation>

[QQIEHelper.QQRightClick]

  {E654770F-10E4-47BC-A309-4CAD96A096E6} <C:\Program Files\Thunder\ComDlls\Faker.dll, >

[PasswordEditCtrl Class]

  {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>

[TimwpDll.TimwpCheck]

  {ED4CA2E5-0EEA-44C1-AD7E-74A07A7507A4} <D:\QQ\Timwp.dll, TENCENT>

[XML HTTP Request]

  {ED8C108E-4349-11D2-91A4-00C04F7969E8} <%SystemRoot%\system32\msxml3.dll, N/A>

[Thunder DapPlayer]

  {EEDD6FF9-13DE-496B-9A1C-D78B3215E266} <C:\Program Files\Thunder Network\Thunder\Components\DownAndPlay\DapPlayer3.0.578.69.40.dll, ShenZhen Thunder Networking Technologies Ltd.>

[XPPlayer Class]

  {F3E70CEA-956E-49CC-B444-73AFE593AD7F} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\pplayer.dll_1_work, Thunder>

[XML DOM Document 3.0]

  {F5078F32-C551-11D3-89B9-0000F81FE221} <%SystemRoot%\system32\msxml3.dll, N/A>

[Free Threaded XML DOM Document 3.0]

  {F5078F33-C551-11D3-89B9-0000F81FE221} <%SystemRoot%\system32\msxml3.dll, N/A>

[XML HTTP 3.0]

  {F5078F35-C551-11D3-89B9-0000F81FE221} <%SystemRoot%\system32\msxml3.dll, N/A>

[XSL Template 3.0]

  {F5078F36-C551-11D3-89B9-0000F81FE221} <%SystemRoot%\system32\msxml3.dll, N/A>

[XML DOM Document]

  {F6D90F11-9C73-11D3-B32E-00C04F990BB4} <%SystemRoot%\system32\msxml3.dll, N/A>

[XML HTTP]

  {F6D90F16-9C73-11D3-B32E-00C04F990BB4} <%SystemRoot%\system32\msxml3.dll, N/A>

[IERPCtl Class]

  {FDC7A535-4070-4B92-A0EA-D9994BCC0DC5} <C:\Program Files\Real\RealPlayer\rpplugins\ierpplug.dll, RealNetworks, Inc.>

[&使用超级旋风下载]

  <D:\QQ\geturl.htm, N/A>

[&使用超级旋风下载全部链接]

  <D:\QQ\getAllurl.htm, N/A>

[使用迅雷下载]

  <C:\Program Files\Thunder\Program\geturl.htm, N/A>

[使用迅雷下载全部链接]

  <C:\Program Files\Thunder\Program\getallurl.htm, N/A>

[添加到QQ表情]

  <D:\QQ\AddEmotion.htm, N/A>



==================================

正在运行的进程

[PID: 700][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 936][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 1032][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 1340][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 1352][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 1572][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 1664][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 2016][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 188][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 396][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 1308][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234)]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]

    [D:\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1002]

    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 4.00.121]

    [D:\ftc2008\FTCMon.dll]  [木马清道夫监控模块, 4.1.0.0]

    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 4.00.121]

[PID: 1972][D:\Wopti\WoptiMem.exe]  [SSN, 3.3.8.214]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]

    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 4.00.121]

    [D:\ftc2008\FTCMon.dll]  [木马清道夫监控模块, 4.1.0.0]

    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 4.00.121]

[PID: 2044][C:\Program Files\Logitech\G-series Software\LGDCore.exe]  [Logitech Inc., 1.02.218]

    [C:\Program Files\Logitech\G-series Software\LGDRes.dll]  [Logitech Inc., 1.02.218]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]

    [D:\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1002]

    [C:\Program Files\Logitech\G-series Software\LgLcdApi.dll]  [Logitech Inc., 1.02.218]

    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 4.00.121]

    [D:\ftc2008\FTCMon.dll]  [木马清道夫监控模块, 4.1.0.0]

    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 4.00.121]

[PID: 168][C:\Program Files\Logitech\G-series Software\LCDMon.exe]  [Logitech Inc., 1.02.218]

    [D:\ftc2008\FTCMon.dll]  [木马清道夫监控模块, 4.1.0.0]

    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 4.00.121]

    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 4.00.121]

[PID: 260][C:\WINDOWS\system32\RUNDLL32.EXE]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\NvMcTray.dll]  [NVIDIA Corporation, 6.14.11.7516]

    [C:\WINDOWS\system32\nvapi.dll]  [NVIDIA Corporation, 6.14.11.7516]

    [D:\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1002]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]

    [C:\WINDOWS\system32\NVRSZHC.DLL]  [NVIDIA Corporation, 6.14.11.7516]

    [D:\ftc2008\FTCMon.dll]  [木马清道夫监控模块, 4.1.0.0]

    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 4.00.121]

    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 4.00.121]

[PID: 580][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]

    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 4.00.121]

    [D:\ftc2008\FTCMon.dll]  [木马清道夫监控模块, 4.1.0.0]

    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 4.00.121]

[PID: 1420][C:\Program Files\Logitech\G-series Software\Applets\LCDPop3\LCDPOP3.exe]  [Logitech Inc., 1.02.218]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]

    [C:\Program Files\Logitech\G-series Software\LgLcdApi.dll]  [Logitech Inc., 1.02.218]

    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 4.00.121]

    [D:\ftc2008\FTCMon.dll]  [木马清道夫监控模块, 4.1.0.0]

    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 4.00.121]

[PID: 868][C:\Program Files\Logitech\G-series Software\Applets\LCDMedia.exe]  [Logitech Inc., 1.02.218]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]

    [C:\Program Files\Logitech\G-series Software\LgLcdApi.dll]  [Logitech Inc., 1.02.218]

    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 4.00.121]

    [D:\ftc2008\FTCMon.dll]  [木马清道夫监控模块, 4.1.0.0]

    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 4.00.121]

[PID: 888][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 896][C:\Program Files\Logitech\G-series Software\Applets\LCDCountdown\LCDCountdown.exe]  [Logitech Inc., 1.02.218]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]

    [C:\Program Files\Logitech\G-series Software\LgLcdApi.dll]  [Logitech Inc., 1.02.218]

    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 4.00.121]

    [D:\ftc2008\FTCMon.dll]  [木马清道夫监控模块, 4.1.0.0]

    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 4.00.121]

[PID: 916][C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe]  [Logitech Inc., 1.02.218]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]

    [C:\Program Files\Logitech\G-series Software\LgLcdApi.dll]  [Logitech Inc., 1.02.218]

    [D:\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1002]

    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 4.00.121]

    [D:\ftc2008\FTCMon.dll]  [木马清道夫监控模块, 4.1.0.0]

    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 4.00.121]

[PID: 1188][D:\SpeedFan\speedfan.exe]  [Almico Software (www.almico.com), 4.34.0.191]

    [C:\DOCUME~1\ADMINI~1\LOCALS~1\TEMP\MBX@4A4@12E3220.###]  [N/A, ]

    [D:\SpeedFan\soft2cn．com汉化说明.exe]  [WwW.Soft2CN.CoM, 1.0.0.1026]

    [D:\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1002]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]

    [C:\WINDOWS\system32\nvcpl.dll]  [NVIDIA Corporation, 6.14.11.7516]

    [C:\WINDOWS\system32\NVRSZHC.DLL]  [NVIDIA Corporation, 6.14.11.7516]

    [C:\WINDOWS\system32\nvapi.dll]  [NVIDIA Corporation, 6.14.11.7516]

    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 4.00.121]

    [D:\ftc2008\FTCMon.dll]  [木马清道夫监控模块, 4.1.0.0]

    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 4.00.121]

[PID: 1244][C:\WINDOWS\system32\ntfrs.exe]  [Microsoft Corporation, 5.2.0.1108]

[PID: 1492][C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe]  [NVIDIA, 6.01.12]

    [C:\WINDOWS\system32\MFC71.DLL]  [Microsoft Corporation, 7.10.3077.0]

    [C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]

    [C:\Program Files\NVIDIA Corporation\nTune\nTuneServiceENU.dll]  [NVIDIA, 6.01.12]

    [C:\Program Files\NVIDIA Corporation\nTune\nvsulib.dll]  [NVIDIA, 6.01.12]

    [C:\WINDOWS\system32\nvapi.dll]  [NVIDIA Corporation, 6.14.11.7516]

[PID: 292][C:\WINDOWS\system32\nvsvc32.exe]  [NVIDIA Corporation, 6.14.11.7516]

    [C:\WINDOWS\system32\nvapi.dll]  [NVIDIA Corporation, 6.14.11.7516]

[PID: 984][C:\WINDOWS\system32\oodag.exe]  [Microsoft Corporation, 5.2.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 1988][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 2336][C:\Program Files\Logitech\SetPoint\SetPoint.exe]  [Logitech Inc., 4.00.121]

    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 4.00.121]

    [C:\WINDOWS\system32\KemXML.dll]  [Logitech Inc., 4.00.121]

    [C:\WINDOWS\system32\kemutb.dll]  [Logitech Inc., 4.00.121]

    [C:\WINDOWS\system32\KemUtil.dll]  [Logitech Inc., 4.00.121]

    [C:\WINDOWS\system32\KemWnd.dll]  [Logitech Inc., 4.00.121]

    [C:\Program Files\Logitech\SetPoint\SetPointCOM.dll]  [Logitech Inc., 4.00.121]

    [D:\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1002]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]

    [C:\Program Files\Logitech\SetPoint\Macros\MacroCore.dll]  [Logitech Inc., 4.00.121]

    [C:\Program Files\Logitech\SetPoint\IMHook.dll]  [Logitech Inc., 4.00.121]

    [C:\Program Files\Logitech\SetPoint\WebBrowserSupport.dll]  [Logitech Inc., 4.00.121]

    [C:\Program Files\Common Files\Logitech\KhalShared\KhalApi.dll]  [Logitech Inc., 4.00.121]

    [C:\Program Files\Logitech\SetPoint\kgame.dll]  [Logitech Inc., 4.00.121]

    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 4.00.121]

    [D:\ftc2008\FTCMon.dll]  [木马清道夫监控模块, 4.1.0.0]

    [C:\Program Files\Logitech\SetPoint\LCabHandler.dll]  [Logitech Inc., 4.00.121]

[PID: 2384][C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe]  [Logitech Inc., 2.52.21.16]

    [C:\Program Files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\backWeb.dll]  [BackWeb Technologies Inc., Version 8.1.1 (Build 50R)]

    [C:\Program Files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\bwsec.dll]  [BackWeb Technologies Inc., Version 5.1.1 (Build 50R)]

    [C:\Program Files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\clntutil.dll]  [N/A, ]

    [C:\PROGRA~1\Logitech\DESKTO~1\8876480\811~1.50-\program\EN\ClientRC.dll]  [BackWeb Technologies Inc., Version 8.1.1 (Build 50R)]

    [D:\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1002]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]

    [C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWfiles-8876480.dll]  [Logitech Inc., Version 8.1.1 (Build 50R)]

    [C:\Program Files\Logitech\Desktop Messenger\8876480\8.1.1.50-8876480SL\Program\BWfiles.dll]  [BackWeb Technologies Inc., Version 8.1.1 (Build 50R)]

    [D:\ftc2008\FTCMon.dll]  [木马清道夫监控模块, 4.1.0.0]

    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 4.00.121]

    [C:\Program Files\Logitech\Desktop Messenger\8876480\Program\SyncExt.dll]  [Logitech, 2.52.21]

    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 4.00.121]

[PID: 3400][C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE]  [Logitech Inc., 4.00.101]

    [D:\ftc2008\FTCMon.dll]  [木马清道夫监控模块, 4.1.0.0]

    [C:\Program Files\Common Files\Logitech\KhalShared\KHALAPI.DLL]  [Logitech Inc., 4.00.121]

    [D:\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1002]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]

    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 4.00.121]

    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 4.00.121]

    [C:\Program Files\Common Files\Logitech\KhalShared\KHALITCH.DLL]  [Logitech Inc., 4.00.121]

    [C:\Program Files\Common Files\Logitech\KhalShared\KHALMW.DLL]  [Logitech Inc., 4.00.121]

    [C:\Program Files\Common Files\Logitech\KhalShared\KHALHPP.DLL]  [Logitech Inc., 4.00.121]

    [C:\Program Files\Common Files\Logitech\KhalShared\KHALMOU.DLL]  [Logitech Inc., 4.00.121]

    [C:\Program Files\Common Files\Logitech\KhalShared\KHALHID.DLL]  [Logitech Inc., 4.00.121]

    [C:\Program Files\Common Files\Logitech\KhalShared\KHALUSB.DLL]  [Logitech Inc., 4.00.121]

[PID: 3380][D:\QQ\QQ.exe]  [TENCENT, 8,0,830,1811]

    [D:\QQ\QQBaseClassInDll.dll]  [TENCENT, 8,0,830,1811]

    [D:\QQ\QQHelperDll.dll]  [TENCENT, 8,0,830,1811]

    [D:\QQ\BasicCtrlDll.dll]  [TENCENT, 8,0,830,1811]

    [D:\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1002]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]

    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 4.00.121]

    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 4.00.121]

    [D:\ftc2008\FTCMon.dll]  [木马清道夫监控模块, 4.1.0.0]

    [D:\QQ\QQAPI.dll]  [TENCENT, 8,0,830,1811]

    [D:\QQ\LoginCtrl.dll]  [TENCENT, 8,0,830,1811]

    [D:\QQ\LoginCtrlRes.dll]  [TENCENT, 8,0,830,1811]

    [D:\QQ\QQRes.dll]  [TENCENT, 8, 0, 830, 1811]

    [D:\QQ\QQMainFrame.dll]  [N/A, ]

    [D:\QQ\QQPlugin.dll]  [N/A, ]

    [D:\QQ\UnReadMsgMgr.dll]  [N/A, ]

    [D:\QQ\CQQApplication.dll]  [N/A, ]

    [D:\QQ\FlashAvatarDll.dll]  [, 1, 4, 0, 1]

    [D:\QQ\NewSkin.dll]  [TENCENT, 8,0,830,1811]

    [D:\QQ\MailSummary.dll]  [TENCENT, 8,0,773,1801]

    [D:\QQ\QQSpace.dll]  [TENCENT, 8,0,830,1811]

    [C:\WINDOWS\system32\msdmo.dll]  [, ]

    [D:\QQ\QQKnowledgeSearch.dll]  [TENCENT, 8,0,830,1811]

    [D:\QQ\OEMApplication.dll]  [TENCENT, 8,0,830,1811]

    [D:\QQ\QQGroupMng.dll]  [TENCENT, 8,0,830,1811]

    [D:\QQ\QQAvatar.dll]  [N/A, ]

    [C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx]  [Adobe Systems, Inc., 9,0,124,0]

    [D:\QQ\QQAllInOne.dll]  [TENCENT, 8,0,830,1811]

    [D:\QQ\SCCore.dll]  [TENCENT, 1, 6, 0, 2]

    [D:\QQ\CameraDll.dll]  [TENCENT, 8,0,830,1811]

    [D:\QQ\QQPet.dll]  [TENCENT, 8,0,830,1811]

    [D:\QQ\LongConnection.dll]  [TENCENT, 8,0,830,1811]

    [D:\QQ\QQSysMsgMng.dll]  [N/A, ]

    [D:\QQ\UserDefinedHead.dll]  [TENCENT, 8,0,830,1811]

    [D:\QQ\QQCustomFace.dll]  [N/A, ]

    [D:\QQ\QQConfigPlugin.dll]  [TENCENT, 8,0,830,1811]

    [D:\QQ\GroupConnection.dll]  [TENCENT, 8,0,830,1811]

    [D:\QQ\QRingMng.dll]  [N/A, ]

    [D:\QQ\PhoneAPI.dll]  [TENCENT, 8,0,830,1811]

    [D:\QQ\DialerAllinOne.dll]  [tencent, 1, 4, 0, 0]

    [D:\QQ\QQFileTransfer.dll]  [TENCENT, 8,0,830,1811]

    [D:\QQ\BQQApplication.dll]  [N/A, ]

    [D:\QQ\PersonalDesktop.dll]  [TENCENT, 8,0,830,1811]

    [D:\QQ\ImageOle.dll]  [TENCENT, 8,0,830,1811]

    [D:\QQ\QQSceneMng.dll]  [N/A, ]

    [D:\QQ\QQLiveQMng.dll]  [TENCENT, 8,0,830,1811]

    [D:\QQ\CommercesMng.dll]  [TENCENT, 8,0,830,1811]

    [D:\QQ\QQAddr.dll]  [深圳市腾讯计算机系统有限公司, 5, 0, 101, 330]

    [D:\QQ\AddrSearch.dll]  [腾讯科技（深圳）有限公司, 2, 2, 1, 15]

[PID: 3592][D:\QQ\TXPlatform.exe]  [Tencent, 1, 5, 225, 0]

    [D:\ftc2008\FTCMon.dll]  [木马清道夫监控模块, 4.1.0.0]

    [D:\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1002]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]

    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 4.00.121]

    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 4.00.121]

[PID: 612][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 7.00.6000.16674 (vista_gdr.080415-1732)]

    [D:\ftc2008\FTCMon.dll]  [木马清道夫监控模块, 4.1.0.0]

    [D:\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1002]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]

    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 4.00.121]

    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 4.00.121]

    [D:\ftc2008\FygIEmon.dll]  [木马清道夫－恶意网站屏蔽, 3.0.0.0]

    [C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 8, 55]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL]  [Kingsoft Corporation, 2008,04,15,2]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddy.dll]  [Kingsoft Corporation, 2008,04,15,2]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL]  [Kingsoft Corporation, 2008,06,24,415]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KANTray.dll]  [Kingsoft Corporation, 2008,06,24,415]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVAFish.DLL]  [Kingsoft Corporation, 2008,06,24,415]

    [C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx]  [Adobe Systems, Inc., 9,0,124,0]

    [C:\WINDOWS\system32\SOGOUPY.IME]  [Sogou.com Inc., 3.3.0.0]

    [C:\WINDOWS\system32\msdmo.dll]  [, ]

    [C:\Program Files\Ringz Studio\Storm Codec\Codecs\VSFilter.dll]  [Gabest, 1, 0, 1, 3]

    [C:\Program Files\Ringz Studio\Storm Codec\Codecs\PmpSplt.ax]  [cooleyes, 1, 0, 0, 8]

    [C:\Program Files\Ringz Studio\Storm Codec\Codecs\RMSplt.ax]  [Gabest, 1, 0, 1, 1]

    [C:\WINDOWS\system32\ffdshow.ax]  [, 1.0.2.2028]

    [C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]

    [C:\Program Files\Thunder\ComDlls\ThunderAgent_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 4, 23]

[PID: 2980][D:\综合图标\SREngLdr.EXE]  [Smallfrogs Studio, 2.6.10.990]

    [D:\ftc2008\FTCMon.dll]  [木马清道夫监控模块, 4.1.0.0]

[PID: 1692][D:\综合图标\SRE2521b82a.EXE]  [Smallfrogs Studio, 2.6.10.990]

    [D:\ftc2008\FTCMon.dll]  [木马清道夫监控模块, 4.1.0.0]

    [D:\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1002]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]

    [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]

    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 4.00.121]

    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 4.00.121]



==================================

文件关联

.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]

.EXE  OK. ["%1" %*]

.COM  OK. ["%1" %*]

.PIF  OK. ["%1" %*]

.REG  OK. [regedit.exe "%1"]

.BAT  OK. ["%1" %*]

.SCR  OK. ["%1" /S]

.CHM  OK. ["C:\WINDOWS\hh.exe" %1]

.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]

.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]

.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]

.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]

.JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]

.LNK  OK. [{00021401-0000-0000-C000-000000000046}]



==================================

Winsock 提供者

N/A



==================================

Autorun.inf

N/A



==================================

HOSTS 文件

127.0.0.1       localhost



==================================

进程特权扫描

特殊特权被允许： SeLoadDriverPrivilege [PID = 1032, C:\WINDOWS\SYSTEM32\WINLOGON.EXE]

特殊特权被允许： SeSystemtimePrivilege [PID = 2044, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\LGDCORE.EXE]

特殊特权被允许： SeDebugPrivilege [PID = 2044, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\LGDCORE.EXE]

特殊特权被允许： SeLoadDriverPrivilege [PID = 2044, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\LGDCORE.EXE]

特殊特权被允许： SeSystemtimePrivilege [PID = 168, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\LCDMON.EXE]

特殊特权被允许： SeDebugPrivilege [PID = 168, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\LCDMON.EXE]

特殊特权被允许： SeLoadDriverPrivilege [PID = 168, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\LCDMON.EXE]

特殊特权被允许： SeSystemtimePrivilege [PID = 1420, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\APPLETS\LCDPOP3\LCDPOP3.EXE]

特殊特权被允许： SeDebugPrivilege [PID = 1420, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\APPLETS\LCDPOP3\LCDPOP3.EXE]

特殊特权被允许： SeLoadDriverPrivilege [PID = 1420, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\APPLETS\LCDPOP3\LCDPOP3.EXE]

特殊特权被允许： SeSystemtimePrivilege [PID = 868, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\APPLETS\LCDMEDIA.EXE]

特殊特权被允许： SeDebugPrivilege [PID = 868, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\APPLETS\LCDMEDIA.EXE]

特殊特权被允许： SeLoadDriverPrivilege [PID = 868, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\APPLETS\LCDMEDIA.EXE]

特殊特权被允许： SeSystemtimePrivilege [PID = 896, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\APPLETS\LCDCOUNTDOWN\LCDCOUNTDOWN.EXE]

特殊特权被允许： SeDebugPrivilege [PID = 896, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\APPLETS\LCDCOUNTDOWN\LCDCOUNTDOWN.EXE]

特殊特权被允许： SeLoadDriverPrivilege [PID = 896, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\APPLETS\LCDCOUNTDOWN\LCDCOUNTDOWN.EXE]

特殊特权被允许： SeSystemtimePrivilege [PID = 916, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\APPLETS\LCDCLOCK.EXE]

特殊特权被允许： SeDebugPrivilege [PID = 916, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\APPLETS\LCDCLOCK.EXE]

特殊特权被允许： SeLoadDriverPrivilege [PID = 916, C:\PROGRAM FILES\LOGITECH\G-SERIES SOFTWARE\APPLETS\LCDCLOCK.EXE]

特殊特权被允许： SeSystemtimePrivilege [PID = 1188, D:\SPEEDFAN\SPEEDFAN.EXE]

特殊特权被允许： SeDebugPrivilege [PID = 1188, D:\SPEEDFAN\SPEEDFAN.EXE]

特殊特权被允许： SeLoadDriverPrivilege [PID = 1188, D:\SPEEDFAN\SPEEDFAN.EXE]

特殊特权被允许： SeSystemtimePrivilege [PID = 2336, C:\PROGRAM FILES\LOGITECH\SETPOINT\SETPOINT.EXE]

特殊特权被允许： SeDebugPrivilege [PID = 2336, C:\PROGRAM FILES\LOGITECH\SETPOINT\SETPOINT.EXE]

特殊特权被允许： SeLoadDriverPrivilege [PID = 2336, C:\PROGRAM FILES\LOGITECH\SETPOINT\SETPOINT.EXE]

特殊特权被允许： SeSystemtimePrivilege [PID = 2384, C:\PROGRAM FILES\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\LOGITECHDESKTOPMESSENGER.EXE]

特殊特权被允许： SeDebugPrivilege [PID = 2384, C:\PROGRAM FILES\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\LOGITECHDESKTOPMESSENGER.EXE]

特殊特权被允许： SeLoadDriverPrivilege [PID = 2384, C:\PROGRAM FILES\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\LOGITECHDESKTOPMESSENGER.EXE]

特殊特权被允许： SeSystemtimePrivilege [PID = 2980, D:\综合图标\SRENGLDR.EXE]

特殊特权被允许： SeDebugPrivilege [PID = 2980, D:\综合图标\SRENGLDR.EXE]

特殊特权被允许： SeLoadDriverPrivilege [PID = 2980, D:\综合图标\SRENGLDR.EXE]



==================================

API HOOK

入口点错误：FreeLibrary (危险等级: 高,  被下面模块所HOOK: 躼5F00002D)



==================================

隐藏进程

    [205] D:\ftc2008\Trojanwall.exe



==================================