召唤看的懂日志的电脑高手........另:神仙叔叔,快近来...(页 1) - 一起来浆糊 - 浆糊论坛-RO小站

xiangjiaosa 发表于 2007-9-13 21:55

召唤看的懂日志的电脑高手........另:神仙叔叔,快近来...

[m_我不要]
[CODE]

2007-01-01,19:29:25

System Repair Engineer 2.5.16.900
Smallfrogs ([url]http://www.KZTechs.com[/url])

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<w><%SystemRoot%\WinRaR.exe>  [N/A]
<wm><%SystemRoot%\winlogor.exe>  [N/A]
<wl><%SystemRoot%\intent.exe>  [N/A]
<mm><%SystemRoot%\sourro.exe>  []
<zx><%SystemRoot%\winadr.exe>  [N/A]
<rx><%SystemRoot%\winnt.exe>  [N/A]
<aa><%SystemRoot%\SVchont.exe>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<ATIPTA><C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe>  [ATI Technologies, Inc.]
<!AVG Anti-Spyware><"F:\AVG\新建文件夹\AVG Anti-Spyware 7.5\avgas.exe" /minimized>  [(Verified)GRISOFT LTD]
<SoundMan><SoundMan.exe>  [1]
<ravmsmon><C:\Program Files\NetMeeting\ravmsmon.exe>  []
<ravgjmon><C:\Program Files\NetMeeting\ravgjmon.exe>  []
<avpzx><C:\Program Files\NetMeeting\avpzx.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><kvmxcma.dll>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{57B86673-276A-48B2-BAE7-C6DBB3020EB8}><F:\AVG\新建文件夹\AVG Anti-Spyware 7.5\shellexecutehook.dll>  [(Verified)GRISOFT LTD]
<{1960356A-458E-DE24-BD50-268F589A56A1}><C:\WINDOWS\system32\avwlamn.dll>  []
<{2C87A354-ABC3-DEDE-FF33-3213FD7447C2}><C:\WINDOWS\system32\kvdxbma.dll>  []
<{1859245F-345D-BC13-AC4F-145D47DA34F1}><C:\WINDOWS\system32\avzxamn.dll>  [N/A]
<{E3F426F6-8634-42A5-A29E-BC694A88FB7D}><C:\WINDOWS\system32\xyupri0.dll>  []
<{1E32FA58-3453-FA2D-BC49-F340348ACCE1}><C:\WINDOWS\system32\rsmyapm.dll>  []
<{12FAACDE-34DA-CCD4-AB4D-DA34485A3421}><C:\WINDOWS\system32\rsjzapm.dll>  [N/A]
<{37D81718-1314-5200-2597-587901018073}><C:\WINDOWS\system32\kaqhczy.dll>  [N/A]
<{1D561258-45F3-A451-F908-A258458226D1}><C:\WINDOWS\system32\kvdxsama.dll>  [N/A]
<{D12BC423-3713-224D-3F55-32B35C62B11D}><C:\WINDOWS\system32\WinFormA9.dll>  []
<{3D47B341-43DF-4563-753F-345FFA3157D3}><C:\WINDOWS\system32\kvmxcma.dll>  []
<{4F12545B-1212-1314-5679-4512ACEF8904}><C:\WINDOWS\system32\wddpri.dll>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<avpms><; C:\Program Files\NetMeeting\avpms.exe>  []
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<bgswitch><; C:\WINDOWS\system32\bgswitch.exe>  []
<ctfmon.exe><; C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<KVMON><; "F:\江民\JiangMin\AntiVirus\KVMonXP.kxp">  [Jiangmin Co.Ltd]
<ravztmon><; C:\Program Files\NetMeeting\ravztmon.exe>  []
<SoundMan><; SoundMan.exe>  [1]

==================================
启动文件夹
[QQ游戏启动加速程序]
  <C:\Documents and Settings\jh1jcka\「开始」菜单\程序\启动\QQ游戏启动加速程序.lnk --> F:\QQGame\Accel.exe [深圳市腾讯计算机系统有限公司]><N>

==================================
服务
[Ati HotKey Poller / Ati HotKey Poller][Stopped/Auto Start]
  <C:\WINDOWS\system32\Ati2evxx.exe><>
[ATI Smart / ATI Smart][Stopped/Auto Start]
  <C:\WINDOWS\system32\ati2sgag.exe><>
[AVG Anti-Spyware Guard / AVG Anti-Spyware Guard][Stopped/Auto Start]
  <F:\AVG\新建文件夹\AVG Anti-Spyware 7.5\guard.exe><GRISOFT s.r.o.>
[DCOM Server Process Launcher / DcomLaunch][Running/Auto Start]
  <C:\WINDOWS\system32\svchost -k DcomLaunch-->%SystemRoot%\system32\rpcss.dll><Microsoft Corporation>
[Help and Support / helpsvc][Stopped/Auto Start]
  <C:\WINDOWS\system32\ineters.exe-->%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll><Microsoft Corporation>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[KVSrvXP / KVSrvXP][Running/Auto Start]
  <F:\江民\JiangMin\AntiVirus\kvsrvxp.exe /Service><Jiangmin Co., Ltd.>
[Remote Procedure Call (RPC) / RpcSs][Running/Auto Start]
  <C:\WINDOWS\system32\svchost -k rpcss-->%SystemRoot%\system32\rpcss.dll><>
[Terminal Services / TermService][Running/Manual Start]
  <C:\WINDOWS\System32\svchost -k DComLaunch-->%SystemRoot%\System32\termsrv.dll><Microsoft Corporation>
[VisPlug and Play Removable Storage / tmsscvl][Running/Auto Start]
  <C:\WINDOWS\System32\svchost.exe -k tmsscvl-->c:\windows\system32\eventrep.dll><Microsoft Corporation>
[Windows Media Connect Service / WMConnectCDS][Stopped/Manual Start]
  <C:\Program Files\Windows Media Connect 2\wmccds.exe><Microsoft Corporation>
[Windows Driver Foundation - User-mode Driver Framework / WudfSvc][Stopped/Manual Start]
  <C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup-->%SystemRoot%\System32\WUDFSvc.dll><Microsoft Corporation>

==================================
驱动程序
[54609 / 54609][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\Drivers\54578.sys><Driver>
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Running/Manual Start]
  <system32\drivers\ac97intc.sys><Intel Corporation>
[acpidisk / acpidisk][Stopped/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\acpidisk.sys><N/A>
[ati2mtag / ati2mtag][Running/Manual Start]
  <system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[AVG Anti-Spyware Driver / AVG Anti-Spyware Driver][Running/System Start]
  <\??\F:\AVG\新建文件夹\AVG Anti-Spyware 7.5\guard.sys><N/A>
[AVG Anti-Spyware Clean Driver / AvgAsCln][Running/System Start]
  <System32\DRIVERS\AvgAsCln.sys><GRISOFT, s.r.o.>
[bipjjn6xu / bipjjn6xu][Running/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\bipjjn6xu.sys><N/A>
[ BsDeamon Application - BsDeamon Application / BsDeamon][Running/System Start]
  <\??\F:\江民\JiangMin\ANTIVI~1\BsDeamon.sys><Jiangmin Co., Ltd.>
[clmkqpxo2 / clmkqpxo24][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\clmkqpxo24.sys><N/A>
[KRegEx / KRegEx][Running/Auto Start]
  <\??\F:\江民\JiangMin\antivirus\KRegEx.sys><Jiangmin Co. Ltd.>
[Jiangmin Antivirus Software - SysCall Services / KSysCall][Running/System Start]
  <\??\F:\江民\JiangMin\common\KSysCall.sys><Jiangmin Co.,  Ltd.>
[KVFileGuard From Jiangmin / KVFileGuard][Stopped/Manual Start]
  <\??\F:\江民\JiangMin\AntiVirus\KVfg.sys><Jiangmin Co., Ltd.>
[KVRedir From Jiangmin / KVRedir][Running/System Start]
  <\??\F:\江民\JiangMin\AntiVirus\KVREDIR.SYS><Jiangmin Co., Ltd.>
[napjod / napjod][Running/Boot Start]
  <\SystemRoot\\SystemRoot\System32\drivers\napjod.sys><N/A>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8029(AS)-based PCI Ethernet Adapter NT Driver / rtl8029][Running/Manual Start]
  <system32\DRIVERS\RTL8029.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[Jiangmin AntiVirus Software - System Guard / SysGuard][Running/Boot Start]
  <\SystemRoot\system32\Drivers\SysGuard.sys><Jiangmin Co., Ltd.>
[vkhz9n96uj / vkhz9n96uj][Stopped/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\vkhz9n96uj.sys><N/A>
[Windows Driver Foundation - User-mode Driver Framework Platform Driver / WudfPf][Stopped/Manual Start]
  <system32\DRIVERS\WudfPf.sys><Microsoft Corporation>
[Windows Driver Foundation - User-mode Driver Framework Reflector / WudfRd][Stopped/Manual Start]
  <system32\DRIVERS\wudfrd.sys><Microsoft Corporation>

==================================
浏览器加载项
[ThunderAtOnce Class]
  {01443AEC-0FD1-40fd-9C87-E93D1494C233} <F:\迅雷\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[Info cache]
  {385AB8C6-FB22-4D17-8834-064E2BA0A6F0} <C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll, 金泰丰(广州)科技有限公司>
[Thunder Browser Helper]
  {80BF4636-D65B-43F3-BB60-C5DD3D5FB7B9} <F:\迅雷\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[BrowseHelper Class]
  {80BF4637-D65B-43F3-BB60-C5DD3D5FB7B9} <F:\江民\JiangMin\AntiVirus\KVshell.dll, Jiangmin Co.Ltd>
[RegisterHelper Class]
  {FF354A24-B490-4D4F-8EEC-B3ACD6E681A4} <F:\江民\JiangMin\AntiVirus\UrlGuard.dll, Jiangmin Co., Ltd.>
[启动迅雷5]
  {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <F:\迅雷\Thunder.exe, Thunder Networking Technologies,LTD>
[番茄花园]
  {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} <[url]http://www.tomatolei.com[/url], N/A>
[江民杀毒工具栏]
  {B5A34A93-D538-43A7-8371-864CB6148D12} <F:\江民\JiangMin\AntiVirus\KVshell.dll, Jiangmin Co.Ltd>
[ThunderAtOnce Class]
  {01443AEC-0FD1-40FD-9C87-E93D1494C233} <F:\迅雷\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[Info cache]
  {385AB8C6-FB22-4D17-8834-064E2BA0A6F0} <C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll, 金泰丰(广州)科技有限公司>
[Thunder Agent Class]
  {485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <F:\迅雷\ComDlls\ThunderAgent_Now.dll, Thunder Networking Technologies,LTD>
[Thunder Browser Helper]
  {80BF4636-D65B-43F3-BB60-C5DD3D5FB7B9} <F:\迅雷\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[BrowseHelper Class]
  {80BF4637-D65B-43F3-BB60-C5DD3D5FB7B9} <F:\江民\JiangMin\AntiVirus\KVshell.dll, Jiangmin Co.Ltd>
[360SafeLive]
  {87515F61-A66C-4319-A0E0-D416CB8059E3} <F:\360\360safe\live.dll, 360safe.com>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <F:\迅雷\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[江民杀毒工具栏]
  {B5A34A93-D538-43A7-8371-864CB6148D12} <F:\江民\JiangMin\AntiVirus\KVshell.dll, Jiangmin Co.Ltd>
[RegisterHelper Class]
  {FF354A24-B490-4D4F-8EEC-B3ACD6E681A4} <F:\江民\JiangMin\AntiVirus\UrlGuard.dll, Jiangmin Co., Ltd.>
[使用迅雷下载]
  <F:\迅雷\Program\geturl.htm, N/A>
[使用迅雷下载全部链接]
  <F:\迅雷\Program\getallurl.htm, N/A>

==================================
正在运行的进程
[PID: 440 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 496 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 520 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 568 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 580 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 752 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 828 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 904 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\wups2.dll]  [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]
[PID: 980 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1068 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1264 / jh1jcka][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[F:\AVG\新建文件夹\AVG Anti-Spyware 7.5\shellexecutehook.dll]  [GRISOFT s.r.o., 7, 5, 1, 36]
[C:\WINDOWS\system32\xyupri0.dll]  [N/A, ]
[C:\WINDOWS\system32\rsmyapm.dll]  [N/A, ]
[C:\WINDOWS\system32\aa0vbnfag.dll]  [N/A, ]
[C:\WINDOWS\system32\WPDShServiceObj.dll]  [Microsoft Corporation, 5.2.5358.4827 (WMP_11.060509-2009)]
[C:\WINDOWS\system32\PortableDeviceTypes.dll]  [Microsoft Corporation, 5.2.5358.4827 (WMP_11.060509-2009)]
[C:\WINDOWS\system32\PortableDeviceApi.dll]  [Microsoft Corporation, 5.2.5358.4827 (WMP_11.060509-2009)]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[F:\江民\JiangMin\AntiVirus\KVshell.dll]  [Jiangmin Co.Ltd, 2, 0, 7, 905]
[C:\WINDOWS\system32\HiveBase.dll]  [Jiangmin Co., Ltd., 1, 0, 7, 717]
[C:\WINDOWS\system32\kvinstall.dll]  [Jiangmin Co.,Ltd, 2, 0, 7, 831]
[F:\江民\JiangMin\AntiVirus\lang\kvxp0804.lng]  [N/A, ]
[C:\WINDOWS\system32\WinFormA9.dll]  [N/A, ]
[C:\Program Files\NetMeeting\ravmsmon.dat]  [N/A, ]
[C:\WINDOWS\system32\kvmxcma.dll]  [N/A, ]
[C:\Program Files\NetMeeting\ravgjmon.dat]  [N/A, ]
[C:\WINDOWS\qiji.dll]  [N/A, ]
[C:\WINDOWS\system32\avwlamn.dll]  [N/A, ]
[C:\Program Files\NetMeeting\avpzx.dat]  [N/A, ]
[C:\WINDOWS\system32\kvdxbma.dll]  [N/A, ]
[C:\WINDOWS\system32\wddpri.dll]  [N/A, ]
[F:\江民\JiangMin\common\GUIEXT.DLL]  [Jiangmin Co.Ltd, 2, 0, 7, 828]
[F:\江民\JiangMin\common\lang\guiext0804.lng]  [JiangMin Ltd., 7, 1, 0, 200]
[F:\迅雷\ComDlls\TDAtOnce_Now.dll]  [Thunder Networking Technologies,LTD, 1.0.5.15]
[F:\迅雷\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 8, 18]
[F:\迅雷\Components\ResWorker\DsBho_00.dll]  [, 1, 0, 0, 11]
[F:\迅雷\Components\ResWorker\DataProcessor_00.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 12]
[F:\rar\rarext.dll]  [N/A, ]
[F:\AVG\新建文件夹\AVG Anti-Spyware 7.5\context.dll]  [GRISOFT s.r.o., 7, 5, 1, 36]
[PID: 1308 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[PID: 1696 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\System32\rsmyapm.dll]  [N/A, ]
[c:\windows\system32\eventrep.dll]  [Microsoft Corporation, 6.6.3791.1832]
[PID: 1916 / jh1jcka][C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe]  [ATI Technologies, Inc., 6.14.10.5120]
[C:\Program Files\ATI Technologies\ATI Control Panel\atipdsxx.dll]  [ATI Technologies, Inc., 6.14.10.5120]
[C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATRPUIXX.CHS]  [ATI Technologies, Inc., 6.14.10.5120]
[C:\Program Files\ATI Technologies\ATI Control Panel\atipdxxx.dll]  [ATI Technologies, Inc., 6.14.10.5120]
[C:\WINDOWS\system32\rsmyapm.dll]  [N/A, ]
[C:\WINDOWS\system32\WinFormA9.dll]  [N/A, ]
[C:\WINDOWS\system32\kvmxcma.dll]  [N/A, ]
[C:\WINDOWS\qiji.dll]  [N/A, ]
[C:\WINDOWS\system32\avwlamn.dll]  [N/A, ]
[C:\WINDOWS\system32\kvdxbma.dll]  [N/A, ]
[C:\WINDOWS\system32\wddpri.dll]  [N/A, ]
[PID: 1424 / jh1jcka][F:\TT\TTraveler.exe]  [Tencent, 3, 7, 305, 201]
[F:\TT\Plugins\QQFloatBar\QQFloatBar4TT2.dll]  [腾讯公司, 1, 1, 0, 5]
[F:\TT\Plugins\TWeather\TWeather.dll]  [, 1, 0, 0, 3]
[C:\WINDOWS\system32\rsmyapm.dll]  [N/A, ]
[C:\WINDOWS\system32\xyupri0.dll]  [N/A, ]
[F:\TT\TTNetFavor.dll]  [N/A, ]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[F:\江民\JiangMin\AntiVirus\UrlGuard.dll]  [Jiangmin Co., Ltd., 1, 0, 7, 901]
[C:\WINDOWS\system32\HiveBase.dll]  [Jiangmin Co., Ltd., 1, 0, 7, 717]
[F:\江民\JiangMin\Kernel\EngFace.dll]  [Jiangmin Co., Ltd., 2, 0, 7, 831]
[C:\WINDOWS\system32\kvinstall.dll]  [Jiangmin Co.,Ltd, 2, 0, 7, 831]
[F:\江民\JiangMin\Kernel\UNACE.dll]  [N/A, ]
[C:\WINDOWS\system32\WinFormA9.dll]  [N/A, ]
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx]  [Adobe Systems, Inc., 9,0,16,0]
[C:\Program Files\NetMeeting\ravmsmon.dat]  [N/A, ]
[C:\WINDOWS\system32\kvmxcma.dll]  [N/A, ]
[C:\WINDOWS\qiji.dll]  [N/A, ]
[C:\WINDOWS\system32\avwlamn.dll]  [N/A, ]
[C:\Program Files\NetMeeting\avpzx.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravgjmon.dat]  [N/A, ]
[C:\WINDOWS\system32\kvdxbma.dll]  [N/A, ]
[C:\WINDOWS\system32\wddpri.dll]  [N/A, ]
[PID: 1760 / jh1jcka][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\rsmyapm.dll]  [N/A, ]
[C:\WINDOWS\system32\WinFormA9.dll]  [N/A, ]
[C:\WINDOWS\system32\kvmxcma.dll]  [N/A, ]
[C:\WINDOWS\qiji.dll]  [N/A, ]
[C:\WINDOWS\system32\avwlamn.dll]  [N/A, ]
[C:\WINDOWS\system32\kvdxbma.dll]  [N/A, ]
[C:\WINDOWS\system32\wddpri.dll]  [N/A, ]
[PID: 1904 / jh1jcka][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\rsmyapm.dll]  [N/A, ]
[C:\WINDOWS\system32\WinFormA9.dll]  [N/A, ]
[C:\WINDOWS\system32\kvmxcma.dll]  [N/A, ]
[C:\WINDOWS\system32\avwlamn.dll]  [N/A, ]
[C:\WINDOWS\system32\wddpri.dll]  [N/A, ]
[C:\WINDOWS\system32\kvdxbma.dll]  [N/A, ]
[C:\WINDOWS\qiji.dll]  [N/A, ]
[PID: 3968 / jh1jcka][F:\迅雷\Program\Thunder5.exe]  [Thunder Networking Technologies,LTD, 5.7.2.368]
[C:\WINDOWS\system32\WinFormA9.dll]  [N/A, ]
[C:\Program Files\NetMeeting\ravmsmon.dat]  [N/A, ]
[F:\迅雷\Program\TaskManager.dll]  [Thunder Networking Technologies,LTD, 1, 2, 2, 33]
[F:\迅雷\Program\download_interface.dll]  [Thunder Networking Technologies,LTD, 2, 18, 2, 151]
[F:\迅雷\Program\stlport_vc646.dll]  [STLport Consulting, Inc., 4.6.2003.1031]
[F:\迅雷\Program\asyn_dns.dll]  [Thunder Networking Technologies,LTD, 2, 18, 2, 151]
[F:\迅雷\Program\streammedialib.dll]  [, 1, 1, 2, 49]
[F:\迅雷\Program\BHOStub.dll]  [Thunder Networking Technologies,LTD, 1, 1, 0, 8]
[F:\迅雷\Components\DownAndPlay\DownAndPlay.dll]  [, 1, 0, 3, 21]
[C:\WINDOWS\system32\rsmyapm.dll]  [N/A, ]
[C:\WINDOWS\system32\xyupri0.dll]  [N/A, ]
[F:\迅雷\Program\iTargetAD.dll]  [Thunder Networking Technologies,LTD, 1, 0, 2, 33]
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx]  [Adobe Systems, Inc., 9,0,16,0]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[F:\迅雷\Program\XLNet.Dll]  [Thunder Networking Technologies,LTD, 1, 2, 1, 9]
[C:\WINDOWS\system32\PortableDeviceApi.dll]  [Microsoft Corporation, 5.2.5358.4827 (WMP_11.060509-2009)]
[C:\WINDOWS\system32\kvmxcma.dll]  [N/A, ]
[C:\Program Files\NetMeeting\ravgjmon.dat]  [N/A, ]
[C:\WINDOWS\qiji.dll]  [N/A, ]
[C:\WINDOWS\system32\avwlamn.dll]  [N/A, ]
[C:\Program Files\NetMeeting\avpzx.dat]  [N/A, ]
[C:\WINDOWS\system32\kvdxbma.dll]  [N/A, ]
[F:\迅雷\Components\InMedia\iEmbedShell.dll]  [　, 1, 0, 0, 21]
[F:\迅雷\Components\InMedia\iEmbed12.dll]  [Thunder Networking Technologies,LTD, 3, 4, 3, 93]
[F:\迅雷\Components\InMedia\PlayerHelper.dll]  [thunder, 1, 1, 0, 24]
[F:\迅雷\Components\InMedia\XLIPC.DLL]  [N/A, ]
[F:\迅雷\Components\P4PClient\P4PClient.dll]  [Thunder Networking Technologies,LTD, 2, 2, 4, 69]
[C:\WINDOWS\system32\wddpri.dll]  [N/A, ]
[F:\迅雷\Components\Community\XLCommunity.dll]  [Thunder Networking Technologies,LTD, 1, 3, 2, 8]
[F:\迅雷\Program\RegisterDll.dll]  [Thunder Networking Technologies,LTD, 2, 16, 5, 59]
[F:\迅雷\Program\MSVCIRT.dll]  [Microsoft Corporation, 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[F:\江民\JiangMin\AntiVirus\UrlGuard.dll]  [Jiangmin Co., Ltd., 1, 0, 7, 901]
[C:\WINDOWS\system32\HiveBase.dll]  [Jiangmin Co., Ltd., 1, 0, 7, 717]
[F:\江民\JiangMin\Kernel\EngFace.dll]  [Jiangmin Co., Ltd., 2, 0, 7, 831]
[C:\WINDOWS\system32\kvinstall.dll]  [Jiangmin Co.,Ltd, 2, 0, 7, 831]
[F:\江民\JiangMin\Kernel\UNACE.dll]  [N/A, ]
[F:\迅雷\Components\Security\ThunderSafe.dll]  [深圳市迅雷网络技术有限公司, 1, 0, 6, 45]
[F:\迅雷\Program\ATL71.DLL]  [Microsoft Corporation, 7.10.3077.0]
[F:\迅雷\Components\Security\XLSafeUI.dll]  [深圳市迅雷网络技术有限公司, 1, 0, 6, 45]
[F:\迅雷\Components\DownAndPlay\DapPlayer3.0.11.17.dll]  [ShenZhen Thunder Networking Technologies Ltd., 3, 0, 11, 17]
[F:\迅雷\Components\Search\XLSearch.dll]  [Thunder Networking Technologies,LTD, 1, 1, 5, 18]
[F:\迅雷\Program\LiveUpdate.dll]  [Thunder Networking Technologies,LTD, 1, 2, 1, 20]
[F:\迅雷\Plugins\XLSafeHost\XLSafeHost.dll]  [深圳市迅雷网络技术有限公司, 1, 0, 6, 45]
[F:\迅雷\Plugins\BhoAdv\bho_adv.dll]  [深圳市迅雷网络技术有限公司, 1.0.1.0]
[F:\迅雷\Components\ExplorerHelper\ExplorerHelper.dll]  [Thunder Networking Technologies,LTD, 1, 0, 4, 15]
[F:\迅雷\Components\Tips\TipsClient.dll]  [Thunder Networking Technologies,LTD, 2, 2, 6, 91]
[F:\迅雷\Components\VPSHELL\VPSHELL.dll]  [XunLei, 1, 3, 0, 18]
[F:\迅雷\Components\VPSHELL\VideoPicture.dll]  [XunLei, 1, 3, 0, 18]
[F:\迅雷\Components\UserExperience\UserExperience.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
[F:\迅雷\Components\ResWorker\DsXlCom.dll]  [, 1, 0, 0, 23]
[F:\迅雷\Components\ResWorker\DataProcessor_00.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 12]
[F:\迅雷\Components\ResWorker\MediaWorker.dll]  [Thunder Networking Technologies,LTD, 1, 2, 0, 19]
[F:\迅雷\Components\Tips\XLIPC.DLL]  [N/A, ]
[F:\迅雷\Components\DownloadStat\DownloadStat.dll]  [深圳市迅雷网络技术有限公司, 1, 1, 0, 1]
[PID: 368 / jh1jcka][C:\WINDOWS\system32\kvmxcis.exe]  [N/A, ]
[C:\WINDOWS\system32\WinFormA9.dll]  [N/A, ]
[C:\WINDOWS\system32\kvmxcma.dll]  [N/A, ]
[PID: 816 / jh1jcka][C:\WINDOWS\system32\taskmgr.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\kvdxbma.dll]  [N/A, ]
[C:\Program Files\NetMeeting\avpzx.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravgjmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravmsmon.dat]  [N/A, ]
[C:\WINDOWS\system32\wddpri.dll]  [N/A, ]
[C:\WINDOWS\system32\avwlamn.dll]  [N/A, ]
[C:\WINDOWS\system32\kvmxcma.dll]  [N/A, ]
[C:\WINDOWS\qiji.dll]  [N/A, ]
[C:\WINDOWS\system32\WinFormA9.dll]  [N/A, ]
[C:\WINDOWS\system32\rsmyapm.dll]  [N/A, ]
[C:\WINDOWS\system32\xyupri0.dll]  [N/A, ]
[PID: 260 / jh1jcka][F:\日志\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
[C:\WINDOWS\system32\WinFormA9.dll]  [N/A, ]
[C:\Program Files\NetMeeting\avpzx.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravgjmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravmsmon.dat]  [N/A, ]
[C:\WINDOWS\system32\kvmxcma.dll]  [N/A, ]
[C:\WINDOWS\system32\avwlamn.dll]  [N/A, ]
[C:\WINDOWS\system32\wddpri.dll]  [N/A, ]
[C:\WINDOWS\system32\kvdxbma.dll]  [N/A, ]
[C:\WINDOWS\qiji.dll]  [N/A, ]
[C:\WINDOWS\system32\rsmyapm.dll]  [N/A, ]
[C:\WINDOWS\system32\xyupri0.dll]  [N/A, ]
[F:\日志\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]

==================================
文件关联
.TXT  Error. [C:\WINDOWS\system32\notep.exe %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  Error. ["hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
N/A

==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 1916, C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1424, F:\TT\TTRAVELER.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3968, F:\迅雷\PROGRAM\THUNDER5.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 368, C:\WINDOWS\SYSTEM32\KVMXCIS.EXE]

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================

[/CODE]
全部日志啦...........看的懂的教教我.怎么搞掉毒

第三帝国元首 发表于 2007-9-13 22:17

太长了，不想看:ph34r:

喵喵の狗狗 发表于 2007-9-13 22:27

觉得，折腾的时间，都把系统重装晚了。

Lisa-K 发表于 2007-9-13 22:28

同LS

淡淡ｄē烟草味 发表于 2007-9-13 22:30

一看啟動
二看進程
三看服務
四看百度

你這日志這么長,估計沒人有耐心看完.(其實我已經眼花了..)

页: [1]

浆糊论坛-RO小站's Archiver

召唤看的懂日志的电脑高手........另:神仙叔叔,快近来...