打印

[10.20][软件问题][xp]电脑两次遭恶性病破坏

本主题由 hbyw 于 2008-11-16 19:02 关闭

lqw229

通政司参议

Rank: 9 Rank: 9 Rank: 9

UID: 127863
精华: 0
积分: 624
威望: 0
阅读权限: 10
在线时间: 196 小时

发短消息
加为好友
当前离线

1楼大中小发表于 2008-10-20 11:20 只看该作者

[10.20][软件问题][xp]电脑两次遭恶性病破坏

电脑这两天连遭两次恶性病毒破坏。
表现为瑞星监控自动失控退出，无论如何都打不开监控。瑞星杀毒软件也打不开。硬盘中的360文件夹点击打开后自动会关闭。网页搜索瑞星，IE会自动关闭。电脑运行慢。有时关不了机。
重装电脑公司GHOST8.5后，升级了瑞星杀毒软件，每个硬盘下面都杀掉了一两个病毒，病毒名字没记下。网上搜了一下，好象是“AV终结者”的特征。下载了网上说的金山“AV终结者”专杀工具，什么都没杀到。电脑没装什么软件，没上不健康网站。用了一天后又遭遇同样的问题。昨晚又重装了电脑公司GHOST8.5。这次装了卡巴7.0，晓风这里面下载的，007发布的。升级了。
不知这次能用多久。今晚回家全盘杀一下毒。

TOP

hbyw

生亦何欢&死亦何苦

超级版主

Rank: 28

【晓风】PC组

UID: 127429
精华: 3
积分: 69059
威望: 48
阅读权限: 200
在线时间: 1571 小时

三朝元老超级斑竹勋章

发短消息
加为好友
当前离线

2楼大中小发表于 2008-10-20 18:33 只看该作者

用sreng(http://download.kztechs.com/files/sreng2.zip)改名后扫描一个日志上传。

前段时间碰到过这样的病毒，无法比较容易的清除，因为系统文件已经被感染或替换，如果不删除这几个文件，是无法彻底清除的。

在重装系统后，尽量避免打开其他盘，比如D:、E:等因为会有病毒隐藏，即使后来用杀毒软件清理了，也会造成病毒感染了。

先用Autorun.inf免疫工具免疫了，在用autoruns.exe清理可疑选项。

为国家图强，生谓豪杰，死亦谓鬼雄！

TOP

lqw229

通政司参议

Rank: 9 Rank: 9 Rank: 9

UID: 127863
精华: 0
积分: 624
威望: 0
阅读权限: 10
在线时间: 196 小时

发短消息
加为好友
当前离线

3楼大中小发表于 2008-10-20 21:58 只看该作者

第一次用这样的扫描的东东。也不知道扫描得对不对。

复制内容到剪贴板

代码:

2008-10-20,21:54:10



System Repair Engineer 2.7.0.1210

Smallfrogs (http://www.KZTechs.com)



Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能



以下内容被选中：

    所有的启动项目（包括注册表、启动文件夹、服务等）

    浏览器加载项

    正在运行的进程（包括进程模块信息）

    文件关联

    Winsock 提供者

    Autorun.inf

    HOSTS 文件

    进程特权扫描

    计划任务

    API HOOK

    隐藏进程





启动项目

注册表

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

    <igfxhkcmd><C:\WINDOWS\system32\hkcmd.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]

    <igfxpers><C:\WINDOWS\system32\igfxpers.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]

    <AVP><"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe">  [(Verified)Kaspersky Lab]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

    <shell><Explorer.exe>  [(Verified)Microsoft Windows Component Publisher]

    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]

    <AppInit_DLLs><C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll>  [(Verified)Kaspersky Lab]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

    <{AEB6717E-7E19-11d0-97EE-00C04FD91972}><shell32.dll>  [(Verified)Microsoft Windows Component Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

    <PostBootReminder><%SystemRoot%\system32\SHELL32.dll>  [(Verified)Microsoft Windows Component Publisher]

    <CDBurn><%SystemRoot%\system32\SHELL32.dll>  [(Verified)Microsoft Windows Component Publisher]

    <WebCheck><%SystemRoot%\system32\webcheck.dll>  [(Verified)Microsoft Windows Publisher]

    <SysTray><C:\WINDOWS\system32\stobject.dll>  [(Verified)Microsoft Windows Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]

    <WinlogonNotify: crypt32chain><crypt32.dll>  [(Verified)Microsoft Windows Component Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]

    <WinlogonNotify: cryptnet><cryptnet.dll>  [(Verified)Microsoft Windows Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]

    <WinlogonNotify: cscdll><cscdll.dll>  [(Verified)Microsoft Windows Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]

    <WinlogonNotify: igfxcui><igfxdev.dll>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]

    <WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll>  [(Verified)Kaspersky Lab]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]

    <WinlogonNotify: ScCertProp><wlnotify.dll>  [(Verified)Microsoft Windows Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]

    <WinlogonNotify: Schedule><wlnotify.dll>  [(Verified)Microsoft Windows Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]

    <WinlogonNotify: sclgntfy><sclgntfy.dll>  [(Verified)Microsoft Windows Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]

    <WinlogonNotify: SensLogn><WlNotify.dll>  [(Verified)Microsoft Windows Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]

    <WinlogonNotify: termsrv><wlnotify.dll>  [(Verified)Microsoft Windows Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]

    <WinlogonNotify: wlballoon><wlnotify.dll>  [(Verified)Microsoft Windows Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]

    <{438755C2-A8BA-11D1-B96B-00A0C90312E1}><%SystemRoot%\system32\browseui.dll>  [(Verified)Microsoft Windows Component Publisher]

    <{8C7461EF-2B13-11d2-BE35-3078302C2030}><%SystemRoot%\system32\browseui.dll>  [(Verified)Microsoft Windows Component Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]

    <Microsoft Windows Media Player><C:\WINDOWS\inf\unregmp2.exe /ShowWMP>  [(Verified)Microsoft Windows Component Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]

    <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [File is missing]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]

    <浏览器自定义组件><RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP>  [(Verified)Microsoft Windows Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]

    <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [File is missing]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]

    <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [File is missing]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]

    <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [File is missing]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]

    <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]

    <Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser>  [(Verified)Microsoft Windows Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]

    <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub>  [(Verified)Microsoft Windows Component Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]

    <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [File is missing]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}]

    <Windows 桌面更新><regsvr32.exe /s /n /i:U shell32.dll>  [(Verified)Microsoft Windows Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]

    <Internet Explorer 6><%SystemRoot%\system32\ie4uinit.exe>  [(Verified)Microsoft Windows Publisher]

[HKEY_CURRENT_USER\Control Panel\Desktop]

    <SCRNSAVE.EXE><C:\WINDOWS\system32\ssmypics.scr>  [(Verified)Microsoft Windows Publisher]



==================================

启动文件夹

N/A



==================================

服务

[Kaspersky Internet Security 7.0 / AVP][Running/Auto Start]

  <"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" -r><Kaspersky Lab>

[Contrl Center of Storm Media / ccosm][Stopped/Disabled]

  <C:\Program Files\StormII\stormliv.exe /asservice><北京暴风网际科技有限公司>



==================================

驱动程序

[aaatimeo / aaatimeo][Stopped/Disabled]

  <\SystemRoot\system32\DRIVERS\aaatimeo.sys><Microsoft Corporation>

[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Stopped/Manual Start]

  <system32\drivers\ac97intc.sys><Intel Corporation>

[AFAMgt / AFAMgt][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\afamgt.sys><Adaptec, Inc.>

[ahcix86 / ahcix86][Stopped/Disabled]

  <\SystemRoot\system32\DRIVERS\ahcix86.sys><ATI Technologies Inc.>

[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]

  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>

[AliIde / AliIde][Stopped/Disabled]

  <\SystemRoot\system32\DRIVERS\aliide.sys><Acer Laboratories Inc.>

[AMD AGP Bus Filter Driver / amdagp][Stopped/Disabled]

  <\SystemRoot\system32\DRIVERS\amdagp.sys><Advanced Micro Devices, Inc.>

[amdbusdr / amdbusdr][Stopped/Disabled]

  <\SystemRoot\system32\DRIVERS\amdbusdr.sys><AMD>

[AMD EIDE 驱动程衼E / amdeide][Stopped/Disabled]

  <\SystemRoot\system32\DRIVERS\AmdEide.sys><AMD>

[AMD K8 Processor Driver / AmdK8][Stopped/Manual Start]

  <System32\DRIVERS\amdk8.sys><Advanced Micro Devices>

[SiI-3112 SATALink  Controller / ASH1205][Stopped/Disabled]

  <\SystemRoot\system32\DRIVERS\ASH1205.sys><Silicon Image, Inc.>

[ata1200a / ata1200a][Stopped/Disabled]

  <\SystemRoot\system32\DRIVERS\ata1200a.sys><Adaptec, Inc.>

[atiide / atiide][Stopped/Disabled]

  <\SystemRoot\system32\DRIVERS\atiide.sys><ATI Technologies Inc.>

[Promise driver accelerator / bb-run][Stopped/Disabled]

  <\SystemRoot\system32\DRIVERS\bb-run.sys><Promise Technology, Inc.>

[DELL CERC SATA 1.5/6ch RAID Miniport Driver / cercsr6][Stopped/Disabled]

  <\SystemRoot\system32\DRIVERS\cercsr6.sys><Adaptec, Inc.>

[CmdIde / CmdIde][Stopped/Disabled]

  <\SystemRoot\system32\DRIVERS\cmdide.sys><CMD Technology, Inc.>

[Cpq32fs2 / Cpq32fs2][Stopped/Disabled]

  <\SystemRoot\system32\DRIVERS\Cpq32fs2.sys><Hewlett-Packard Company>

[Promise Removable Disk Control Driver / dontgo][Stopped/Disabled]

  <\SystemRoot\system32\DRIVERS\DontGo.sys><Promise Technology, Inc.>

[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Stopped/Manual Start]

  <system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>

[fttxr52P / fttxr52P][Stopped/Disabled]

  <\SystemRoot\system32\DRIVERS\fttxr52P.sys><Promise Technology, Inc.>

[HpCISSm2 / HpCISSm2][Stopped/Disabled]

  <\SystemRoot\system32\DRIVERS\HpCISSm2.sys><Hewlett-Packard Company>

[hptmv6 / hptmv6][Stopped/Boot Start]

  <\SystemRoot\system32\DRIVERS\hptmv6.sys><HighPoint Technologies, Inc.>

[ialm / ialm][Running/Manual Start]

  <system32\DRIVERS\ialmnt5.sys><Intel Corporation>

[Intel  RAID Controller / iaStor55][Stopped/Disabled]

  <\SystemRoot\system32\DRIVERS\iaStor55.sys><Intel Corporation>

[Intel RAID  Controller / iaStor70][Stopped/Disabled]

  <\SystemRoot\system32\DRIVERS\iaStor70.sys><Intel Corporation>

[kl1 / kl1][Running/Boot Start]

  <\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>

[klif / klif][Running/System Start]

  <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>

[Kaspersky Anti-Virus NDIS Filter / klim5][Running/Manual Start]

  <system32\DRIVERS\klim5.sys><Kaspersky Lab>

[mv61xx / mv61xx][Stopped/Disabled]

  <\SystemRoot\system32\DRIVERS\mv61xx.sys><Marvell Semiconductor, Inc.>

[mvSata / mvSata][Stopped/Disabled]

  <\SystemRoot\system32\DRIVERS\mvsata.sys><Marvell Semiconductors Inc.>

[nv / nv][Running/Manual Start]

  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>

[nvgts / nvgts][Stopped/Disabled]

  <\SystemRoot\system32\DRIVERS\nvgts.sys><NVIDIA Corporation>

[NVIDIA nForce RAID Driver / nvrd32][Stopped/Disabled]

  <\SystemRoot\system32\DRIVERS\nvrd32.sys><NVIDIA Corporation>

[Direct Parallel Link Driver / Ptilink][Running/Manual Start]

  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>

[ql2100 / ql2100][Stopped/Disabled]

  <\SystemRoot\system32\DRIVERS\ql2100.sys><QLogic Corporation>

[ql2200 / ql2200][Stopped/Disabled]

  <\SystemRoot\system32\DRIVERS\ql2200.sys><QLogic Corporation>

[rr172x / rr172x][Stopped/Boot Start]

  <\SystemRoot\system32\DRIVERS\rr172x.sys><HighPoint Technologies, Inc.>

[rr174x / rr174x][Stopped/Boot Start]

  <\SystemRoot\system32\DRIVERS\rr174x.sys><HighPoint Technologies, Inc.>

[rr2340 / rr2340][Stopped/Boot Start]

  <\SystemRoot\system32\DRIVERS\rr2340.sys><HighPoint Technologies, Inc.>

[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]

  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>

[Secdrv / Secdrv][Stopped/Manual Start]

  <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>

[SATALink External Device Filter / SiRemFil][Running/Boot Start]

  <\SystemRoot\system32\DRIVERS\SiRemFil.sys><Silicon Image, Inc.>

[SIS AGP Bus Filter / sisagp][Stopped/Disabled]

  <\SystemRoot\system32\DRIVERS\sisagp.sys><Silicon Integrated Systems Corporation>

[sisraidx / sisraidx][Stopped/Disabled]

  <\SystemRoot\system32\DRIVERS\sisraidx.sys><Silicon Integrated Systems Corp.>

[TCP/IP Protocol Driver / Tcpip][Running/System Start]

  <system32\DRIVERS\tcpip.sys><N/A>

[ViBus / ViBus][Stopped/Disabled]

  <\SystemRoot\system32\DRIVERS\ViBus.sys><VIA Technologies, Inc.>

[videX32 / videX32][Stopped/Disabled]

  <\SystemRoot\system32\DRIVERS\videX32.sys><VIA Technologies, Inc.>

[VIA SATA IDE Device Driver / ViPrt][Stopped/Disabled]

  <\SystemRoot\system32\DRIVERS\ViPrt.sys><VIA Technologies, Inc.>

[VIA SATA IDE Hot-plug Driver / xfilt][Stopped/Disabled]

  <\SystemRoot\system32\DRIVERS\xfilt.sys><VIA Technologies,Inc>



==================================

浏览器加载项

[ThunderAtOnce Class]

  {01443AEC-0FD1-40fd-9C87-E93D1494C233} <C:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll, (Signed) Thunder Networking Technologies,LTD>

[Thunder Browser Helper]

  {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll, (Signed) Thunder Networking Technologies,LTD>

[网络反病毒统计信息]

  {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll, (Signed) Kaspersky Lab>

[ThunderAtOnce Class]

  {01443AEC-0FD1-40FD-9C87-E93D1494C233} <C:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll, (Signed) Thunder Networking Technologies,LTD>

[]

  {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <, >

[HTML Document]

  {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, (Signed) N/A>

[Thunder Agent Class]

  {485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <C:\Program Files\Thunder\ComDlls\ThunderAgent_Now.dll, Thunder Networking Technologies,LTD>

[360SafeLive]

  {87515F61-A66C-4319-A0E0-D416CB8059E3} <D:\360安全卫士\360safe_3.30\live.dll, (Signed) 360.cn>

[Thunder Browser Helper]

  {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll, (Signed) Thunder Networking Technologies,LTD>

[SearchAssistantOC]

  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, (Signed) N/A>

[Shockwave Flash Object]

  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash10a.ocx, (Signed) Adobe Systems, Inc.>

[]

  {FB5F1910-F110-11D2-BB9E-00C04F795683} <, >

[使用迅雷下载]

  <C:\Program Files\Thunder\Program\geturl.htm, N/A>

[使用迅雷下载全部链接]

  <C:\Program Files\Thunder\Program\getallurl.htm, N/A>

[导出到 Microsoft Office Excel(&X)]

  <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>

[添加到QQ表情]

  <C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>

[添加到反广告横幅]

  <C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm, N/A>



==================================

正在运行的进程

[PID: 736 / SYSTEM][\SystemRoot\System32\smss.exe]  [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 804 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 828 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll]  [Kaspersky Lab, 7.0.1.321]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.1.321]

    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\klogon.dll]  [Kaspersky Lab, 7.0.1.321]

[PID: 872 / SYSTEM][C:\WINDOWS\system32\services.exe]  [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll]  [Kaspersky Lab, 7.0.1.321]

[PID: 884 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll]  [Kaspersky Lab, 7.0.1.321]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll]  [Kaspersky Lab, 7.0.1.323]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.1.321]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll]  [Kaspersky Lab, 7.0.5.321]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]

[PID: 1020 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll]  [Kaspersky Lab, 7.0.1.321]

[PID: 1128 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll]  [Kaspersky Lab, 7.0.1.321]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll]  [Kaspersky Lab, 7.0.1.323]

[PID: 1264 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\System32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll]  [Kaspersky Lab, 7.0.1.321]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.1.321]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll]  [Kaspersky Lab, 7.0.1.323]

[PID: 1320 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll]  [Kaspersky Lab, 7.0.1.321]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.1.321]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll]  [Kaspersky Lab, 7.0.5.321]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]

[PID: 1468 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll]  [Kaspersky Lab, 7.0.1.321]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.1.321]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll]  [Kaspersky Lab, 7.0.5.321]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll]  [Kaspersky Lab, 7.0.1.323]

[PID: 1624 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [(Verified) Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]

    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll]  [Kaspersky Lab, 7.0.1.321]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll]  [Kaspersky Lab, 7.0.1.323]

[PID: 1720 / Administrator][C:\WINDOWS\Explorer.EXE]  [(Verified) Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234)]

    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll]  [Kaspersky Lab, 7.0.1.321]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.1.321]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll]  [Kaspersky Lab, 7.0.5.321]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\scrchpg.dll]  [Kaspersky Lab, 7.0.1.321]

    [C:\WINDOWS\system32\shdoclc.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\browselc.dll]  [Microsoft Corporation, 6.00.2600.0000]

    [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ShellEx.dll]  [Kaspersky Lab, 7.0.1.321]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\MSVCP80.dll]  [Microsoft Corporation, 8.00.50727.42]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\prremote.dll]  [Kaspersky Lab, 7.0.1.321]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\prloader.dll]  [Kaspersky Lab, 7.0.1.321]

[PID: 1924 / Administrator][C:\WINDOWS\system32\ctfmon.exe]  [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll]  [Kaspersky Lab, 7.0.1.321]

[PID: 2024 / LOCAL SERVICE][C:\WINDOWS\system32\wdfmgr.exe]  [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]

    [C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll]  [Kaspersky Lab, 7.0.1.321]

[PID: 1548 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]  [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\System32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll]  [Kaspersky Lab, 7.0.1.321]

[PID: 3064 / Administrator][C:\Program Files\Maxthon\Maxthon.exe]  [Maxthon International Ltd., 1, 6, 3, 80]

    [C:\Program Files\Maxthon\maxzlib.dll]  [ , 1, 0, 0, 2]

    [C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll]  [Kaspersky Lab, 7.0.1.321]

    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.1.321]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll]  [Kaspersky Lab, 7.0.5.321]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll]  [Kaspersky Lab, 7.0.1.323]

    [C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 8, 61]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\scrchpg.dll]  [Kaspersky Lab, 7.0.1.321]

    [C:\WINDOWS\system32\shdoclc.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\Program Files\Maxthon\Services\RealTime\real_time.dll]  [, 1, 0, 0, 1]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\klscav.dll]  [Kaspersky Lab, 7.0.1.321]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\prremote.dll]  [Kaspersky Lab, 7.0.1.321]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\MSVCP80.dll]  [Microsoft Corporation, 8.00.50727.42]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\prloader.dll]  [Kaspersky Lab, 7.0.1.321]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\prkernel.ppl]  [Kaspersky Lab, 7.0.1.321]

    [c:\program files\kaspersky lab\kaspersky internet security 7.0\params.ppl]  [Kaspersky Lab, 7.0.1.321]

    [c:\program files\kaspersky lab\kaspersky internet security 7.0\pxstub.ppl]  [Kaspersky Lab, 7.0.1.321]

    [c:\program files\kaspersky lab\kaspersky internet security 7.0\tempfile.ppl]  [Kaspersky Lab, 7.0.1.321]

    [c:\program files\kaspersky lab\kaspersky internet security 7.0\nfio.ppl]  [Kaspersky Lab, 7.0.1.321]

    [c:\program files\kaspersky lab\kaspersky internet security 7.0\fsdrvplg.ppl]  [Kaspersky Lab, 7.0.1.321]

    [c:\program files\kaspersky lab\kaspersky internet security 7.0\basegui.ppl]  [Kaspersky Lab, 7.0.1.321]

    [c:\program files\kaspersky lab\kaspersky internet security 7.0\thpimpl.ppl]  [Kaspersky Lab, 7.0.1.321]

    [c:\program files\kaspersky lab\kaspersky internet security 7.0\winreg.ppl]  [Kaspersky Lab, 7.0.1.321]

    [C:\WINDOWS\system32\Macromed\Flash\Flash10a.ocx]  [Adobe Systems, Inc., 10,0,12,36]

[PID: 1416 / Administrator][C:\Program Files\Thunder\Program\Thunder5.exe]  [Thunder Networking Technologies,LTD, 5.7.7.441]

    [C:\Program Files\Thunder\Program\BugReport.dll]  [迅雷网络, 1, 0, 1, 4]

    [C:\Program Files\Thunder\Program\ThunderEx.dll]  [, 1, 2, 3, 20]

    [C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll]  [Kaspersky Lab, 7.0.1.321]

    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\Program Files\Thunder\Program\TaskManager.dll]  [Thunder Networking Technologies,LTD, 1, 3, 1, 56]

    [C:\Program Files\Thunder\Program\download_interface.dll]  [Thunder Networking Technologies,LTD, 2, 21, 2, 217]

    [C:\Program Files\Thunder\Program\stlport_vc646.dll]  [STLport Consulting, Inc., 4.6.2003.1031]

    [C:\Program Files\Thunder\Program\asyn_dns.dll]  [Thunder Networking Technologies,LTD, 2, 21, 2, 217]

    [C:\Program Files\Thunder\Program\streammedialib.dll]  [, 1, 3, 2, 118]

    [C:\Program Files\Thunder\Program\al.dll]  [, 1, 0, 1, 3]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll]  [Kaspersky Lab, 7.0.1.323]

    [C:\Program Files\Thunder\Program\xldc.dll]  [Thunder Networking Technologies,LTD, 1, 0, 2, 14]

    [C:\Program Files\Thunder\Program\bd.dll]  [Thunder Networking Technologies,LTD, 1, 0, 2, 6]

    [C:\Program Files\Thunder\Program\XLNet.Dll]  [Thunder Networking Technologies,LTD, 1, 3, 4, 18]

    [C:\Program Files\Thunder\Program\BHOStub.dll]  [Thunder Networking Technologies,LTD, 1, 1, 0, 8]

    [C:\Program Files\Thunder\Components\DownAndPlay\DownAndPlay.dll]  [, 1, 0, 8, 26]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.1.321]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll]  [Kaspersky Lab, 7.0.5.321]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]

    [C:\Program Files\Thunder\Program\iTargetAD.dll]  [N/A, ]

    [C:\Program Files\Thunder\Components\Community\XLCommunity.dll]  [Thunder Networking Technologies,LTD, 1, 5, 0, 16]

    [C:\Program Files\Thunder\Program\XLCommunityEx.dll]  [N/A, ]

    [C:\Program Files\Thunder\Program\RegisterDll.dll]  [Thunder Networking Technologies,LTD, 2, 16, 5, 63]

    [C:\Program Files\Thunder\Program\MSVCIRT.dll]  [Microsoft Corporation, 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\scrchpg.dll]  [Kaspersky Lab, 7.0.1.321]

    [C:\Program Files\Thunder\Components\ExplorerHelper\ExplorerHelper.dll]  [Thunder Networking Technologies,LTD, 1, 0, 4, 16]

    [C:\Program Files\Thunder\Components\DownloadStat\DownloadStat.dll]  [深圳市迅雷网络技术有限公司, 1, 3, 1, 4]

    [C:\Program Files\Thunder\Program\FloatBar.dll]  [Giganology Inc., 1, 0, 0, 2]

[PID: 3728 / Administrator][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX03.578\SREngLdr.EXE]  [Smallfrogs Studio, 2.7.0.1210]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.1.321]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll]  [Kaspersky Lab, 7.0.5.321]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]

[PID: 2564 / Administrator][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX03.578\SRE9b4eb966.EXE]  [Smallfrogs Studio, 2.7.0.1210]

    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX03.578\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.1.321]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll]  [Kaspersky Lab, 7.0.5.321]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]

    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\adialhk.dll]  [Kaspersky Lab, 7.0.1.321]



==================================

文件关联

.TXT  Error. [C:\WINDOWS\notepad.exe %1]

.EXE  OK. ["%1" %*]

.COM  OK. ["%1" %*]

.PIF  OK. ["%1" %*]

.REG  OK. [regedit.exe "%1"]

.BAT  OK. ["%1" %*]

.SCR  OK. ["%1" /S]

.CHM  Error. ["hh.exe" %1]

.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]

.INI  Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]

.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]

.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]

.JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]

.LNK  OK. [{00021401-0000-0000-C000-000000000046}]



==================================

Winsock 提供者

N/A



==================================

Autorun.inf

N/A



==================================

HOSTS 文件

127.0.0.1       localhost



==================================

进程特权扫描

特殊特权被允许： SeLoadDriverPrivilege [PID = 828, C:\WINDOWS\SYSTEM32\WINLOGON.EXE]

特殊特权被允许： SeLoadDriverPrivilege [PID = 3064, C:\PROGRAM FILES\MAXTHON\MAXTHON.EXE]

特殊特权被允许： SeLoadDriverPrivilege [PID = 1416, C:\PROGRAM FILES\THUNDER\PROGRAM\THUNDER5.EXE]

特殊特权被允许： SeLoadDriverPrivilege [PID = 4004, C:\PROGRAM FILES\AUTORUNS\AUTORUNS.EXE]

特殊特权被允许： SeLoadDriverPrivilege [PID = 3728, C:\DOCUME~1\ADMINI~1\LOCALS~1\TEMP\RAR$EX03.578\SRENGLDR.EXE]



==================================

计划任务

N/A



==================================

API HOOK

RVA  错误： LoadLibraryA (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)

RVA  错误： LoadLibraryExA (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)

RVA  错误： LoadLibraryExW (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)

RVA  错误： LoadLibraryW (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)

RVA  错误： GetProcAddress (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)



==================================

隐藏进程

N/A



==================================

TOP

lqw229

通政司参议

Rank: 9 Rank: 9 Rank: 9

UID: 127863
精华: 0
积分: 624
威望: 0
阅读权限: 10
在线时间: 196 小时

发短消息
加为好友
当前离线

4楼大中小发表于 2008-10-20 22:15 只看该作者

下面是从Autoruns里面导出的：

HKLM\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\StartupPrograms
+ rdpclip RDP Clip Monitor Microsoft Corporation c:\windows\system32\rdpclip.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
+ C:\WINDOWS\system32\userinit.exe Userinit Logon Application Microsoft Corporation c:\windows\system32\userinit.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
+ Explorer.exe Windows Explorer Microsoft Corporation c:\windows\explorer.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
+ AVP Kaspersky Anti-Virus Kaspersky Lab c:\program files\kaspersky lab\kaspersky internet security 7.0\avp.exe
+ igfxhkcmd hkcmd Module Intel Corporation c:\windows\system32\hkcmd.exe
+ igfxpers persistence Module Intel Corporation c:\windows\system32\igfxpers.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
+ ctfmon.exe CTF Loader Microsoft Corporation c:\windows\system32\ctfmon.exe
HKLM\SOFTWARE\Classes\Protocols\Filter
+ Class Install Handler OLE32 Extensions for Win32 Microsoft Corporation c:\windows\system32\urlmon.dll
+ deflate OLE32 Extensions for Win32 Microsoft Corporation c:\windows\system32\urlmon.dll
+ gzip OLE32 Extensions for Win32 Microsoft Corporation c:\windows\system32\urlmon.dll
+ lzdhtml OLE32 Extensions for Win32 Microsoft Corporation c:\windows\system32\urlmon.dll
+ text/webviewhtml Windows Shell Common Dll Microsoft Corporation c:\windows\system32\shell32.dll
+ text/xml Microsoft Office XML MIME Filter Microsoft Corporation c:\program files\common files\microsoft shared\office11\msoxmlmf.dll
HKLM\SOFTWARE\Classes\Protocols\Handler
+ about Microsoft (R) HTML Viewer Microsoft Corporation c:\windows\system32\mshtml.dll
+ cdl OLE32 Extensions for Win32 Microsoft Corporation c:\windows\system32\urlmon.dll
+ dvd ActiveX control for streaming video Microsoft Corporation c:\windows\system32\msvidctl.dll
+ file OLE32 Extensions for Win32 Microsoft Corporation c:\windows\system32\urlmon.dll
+ ftp OLE32 Extensions for Win32 Microsoft Corporation c:\windows\system32\urlmon.dll
+ gopher OLE32 Extensions for Win32 Microsoft Corporation c:\windows\system32\urlmon.dll
+ http OLE32 Extensions for Win32 Microsoft Corporation c:\windows\system32\urlmon.dll
+ https OLE32 Extensions for Win32 Microsoft Corporation c:\windows\system32\urlmon.dll
+ its Microsoft? InfoTech Storage System Library Microsoft Corporation c:\windows\system32\itss.dll
+ javascript Microsoft (R) HTML Viewer Microsoft Corporation c:\windows\system32\mshtml.dll
+ local OLE32 Extensions for Win32 Microsoft Corporation c:\windows\system32\urlmon.dll
+ mailto Microsoft (R) HTML Viewer Microsoft Corporation c:\windows\system32\mshtml.dll
+ mhtml Microsoft Internet Messaging API Microsoft Corporation c:\windows\system32\inetcomm.dll
+ mk OLE32 Extensions for Win32 Microsoft Corporation c:\windows\system32\urlmon.dll
+ ms-its Microsoft? InfoTech Storage System Library Microsoft Corporation c:\windows\system32\itss.dll
+ res Microsoft (R) HTML Viewer Microsoft Corporation c:\windows\system32\mshtml.dll
+ sysimage Microsoft (R) HTML Viewer Microsoft Corporation c:\windows\system32\mshtml.dll
+ tv ActiveX control for streaming video Microsoft Corporation c:\windows\system32\msvidctl.dll
+ vbscript Microsoft (R) HTML Viewer Microsoft Corporation c:\windows\system32\mshtml.dll
+ wia WIA Scripting Layer Microsoft Corporation c:\windows\system32\wiascr.dll
HKCU\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components
+ 0 文件未找到: About:Home
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
+ Internet Explorer Windows NT User Data Migration Tool Microsoft Corporation c:\windows\system32\shmgrate.exe
+ Internet Explorer 6 IE 5.0 Per-User Install Utility Microsoft Corporation c:\windows\system32\ie4uinit.exe
+ Microsoft Outlook Express 6 Outlook Express Setup Library Microsoft Corporation c:\program files\outlook express\setup50.exe
+ Microsoft Windows Media Player Microsoft Windows Media Player 安装实用程序 Microsoft Corporation c:\windows\inf\unregmp2.exe
+ Microsoft Windows Media Player ADVPACK Microsoft Corporation c:\windows\system32\advpack.dll
+ NetMeeting 3.01 ADVPACK Microsoft Corporation c:\windows\system32\advpack.dll
+ Outlook Express Windows NT User Data Migration Tool Microsoft Corporation c:\windows\system32\shmgrate.exe
+ Themes Setup Microsoft(C) Register Server Microsoft Corporation c:\windows\system32\regsvr32.exe
+ Windows Messenger 4.7 ADVPACK Microsoft Corporation c:\windows\system32\advpack.dll
+ Windows 桌面更新 Microsoft(C) Register Server Microsoft Corporation c:\windows\system32\regsvr32.exe
+ 通讯簿 6 Outlook Express Setup Library Microsoft Corporation c:\program files\outlook express\setup50.exe
+ 浏览器自定义组件 Microsoft Internet Explorer Customization DLL Microsoft Corporation c:\windows\system32\iedkcs32.dll
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
+ Browseui 预加载程序 Shell Browser UI Library Microsoft Corporation c:\windows\system32\browseui.dll
+ 组件类别缓存程序 Shell Browser UI Library Microsoft Corporation c:\windows\system32\browseui.dll
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
+ CDBurn Windows Shell Common Dll Microsoft Corporation c:\windows\system32\shell32.dll
+ PostBootReminder Windows Shell Common Dll Microsoft Corporation c:\windows\system32\shell32.dll
+ SysTray Systray shell service object Microsoft Corporation c:\windows\system32\stobject.dll
+ WebCheck Web Site Monitor Microsoft Corporation c:\windows\system32\webcheck.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
+ URL 执行挂钩 Windows Shell Common Dll Microsoft Corporation c:\windows\system32\shell32.dll
HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers
+ Kaspersky Anti-Virus Windows Shell Extension Kaspersky Lab c:\program files\kaspersky lab\kaspersky internet security 7.0\shellex.dll
+ Offline Files Client Side Caching UI Microsoft Corporation c:\windows\system32\cscui.dll
+ Open With Windows Shell Common Dll Microsoft Corporation c:\windows\system32\shell32.dll
+ Open With EncryptionMenu Windows Shell Common Dll Microsoft Corporation c:\windows\system32\shell32.dll
+ WinRAR c:\program files\winrar\rarext.dll
+ 附到「开始」菜单 Windows Shell Common Dll Microsoft Corporation c:\windows\system32\shell32.dll
HKLM\Software\Classes\AllFileSystemObjects\ShellEx\ContextMenuHandlers
+ Send To Windows Shell Common Dll Microsoft Corporation c:\windows\system32\shell32.dll
HKLM\Software\Classes\Directory\ShellEx\ContextMenuHandlers
+ EncryptionMenu Windows Shell Common Dll Microsoft Corporation c:\windows\system32\shell32.dll
+ Offline Files Client Side Caching UI Microsoft Corporation c:\windows\system32\cscui.dll
+ Sharing Shell extensions for sharing Microsoft Corporation c:\windows\system32\ntshrui.dll
+ WinRAR c:\program files\winrar\rarext.dll
HKLM\Software\Classes\Directory\Shellex\DragDropHandlers
+ WinRAR c:\program files\winrar\rarext.dll
HKLM\Software\Classes\Directory\Shellex\PropertySheetHandlers
+ DfsShell Class Distributed File System shell extension Microsoft Corporation c:\windows\system32\dfsshlex.dll
+ Security Shell Extension Security Shell Extension Microsoft Corporation c:\windows\system32\rshx32.dll
+ Sharing Shell extensions for sharing Microsoft Corporation c:\windows\system32\ntshrui.dll
+ 以前的版本属性页 Previous Versions property page Microsoft Corporation c:\windows\system32\twext.dll
+ 自定义文件夹选项卡 Windows Shell Common Dll Microsoft Corporation c:\windows\system32\shell32.dll
HKLM\Software\Classes\Directory\Shellex\CopyHookHandlers
+ CDF Shell Doc Object and Control Library Microsoft Corporation c:\windows\system32\shdocvw.dll
+ FileSystem Windows Shell Common Dll Microsoft Corporation c:\windows\system32\shell32.dll
+ MyDocuments My Documents Folder UI Microsoft Corporation c:\windows\system32\mydocs.dll
+ Sharing Shell extensions for sharing Microsoft Corporation c:\windows\system32\ntshrui.dll
HKLM\Software\Classes\Folder\Shellex\ColumnHandlers
+ {0D2E74C4-3C34-11d2-A27E-00C04FC30871} Windows Shell Common Dll Microsoft Corporation c:\windows\system32\shell32.dll
+ {24F14F01-7B1C-11d1-838f-0000F80461CF} Windows Shell Common Dll Microsoft Corporation c:\windows\system32\shell32.dll
+ {24F14F02-7B1C-11d1-838f-0000F80461CF} Windows Shell Common Dll Microsoft Corporation c:\windows\system32\shell32.dll
+ {66742402-F9B9-11D1-A202-0000F81FEDEE} Windows Shell Common Dll Microsoft Corporation c:\windows\system32\shell32.dll
HKLM\Software\Classes\Folder\ShellEx\ContextMenuHandlers
+ Kaspersky Anti-Virus Windows Shell Extension Kaspersky Lab c:\program files\kaspersky lab\kaspersky internet security 7.0\shellex.dll
+ WinRAR c:\program files\winrar\rarext.dll
HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers
+ new Windows Shell Common Dll Microsoft Corporation c:\windows\system32\shell32.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers
+ Offline Files Client Side Caching UI Microsoft Corporation c:\windows\system32\cscui.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
+ %DESC_PublishDropTarget% Photo Printing Wizard Microsoft Corporation c:\windows\system32\photowiz.dll
+ .CAB file viewer Cabinet File Viewer Shell Extension Microsoft Corporation c:\windows\system32\cabview.dll
+ ActiveX 高速缓存文件夹 Object Control Viewer Microsoft Corporation c:\windows\system32\occache.dll
+ Audio Media Properties Handler Media File Property Extractor Shell Extension Microsoft Corporation c:\windows\system32\shmedia.dll
+ Auto Update Property Sheet Extension Automatic Updates Control Panel Microsoft Corporation c:\windows\system32\wuaucpl.cpl
+ Avi Properties Handler Media File Property Extractor Shell Extension Microsoft Corporation c:\windows\system32\shmedia.dll
+ BandProxy Shell Browser UI Library Microsoft Corporation c:\windows\system32\browseui.dll
+ CDF Extension Copy Hook Shell Doc Object and Control Library Microsoft Corporation c:\windows\system32\shdocvw.dll
+ Channel Menu Channel Definition File Viewer Microsoft Corporation c:\windows\system32\cdfview.dll
+ Channel Properties Channel Definition File Viewer Microsoft Corporation c:\windows\system32\cdfview.dll
+ Code Download Agent Web Site Monitor Microsoft Corporation c:\windows\system32\webcheck.dll
+ Compatibility Page Compatibility Tab Shell Extension DLL Microsoft Corporation c:\windows\system32\slayerxp.dll
+ ConnectionAgent Web Site Monitor Microsoft Corporation c:\windows\system32\webcheck.dll
+ Crypto PKO Extension Crypto Shell Extensions Microsoft Corporation c:\windows\system32\cryptext.dll
+ Crypto Sign Extension Crypto Shell Extensions Microsoft Corporation c:\windows\system32\cryptext.dll
+ Darwin App Publisher Shell Application Manager Microsoft Corporation c:\windows\system32\appwiz.cpl
+ DfsShell Distributed File System shell extension Microsoft Corporation c:\windows\system32\dfsshlex.dll
+ Directory Context Menu Verbs Directory Service Common UI Microsoft Corporation c:\windows\system32\dsuiext.dll
+ Directory Object Find Directory Service Find Microsoft Corporation c:\windows\system32\dsquery.dll
+ Directory Property UI Directory Service Common UI Microsoft Corporation c:\windows\system32\dsuiext.dll
+ Directory Query UI Directory Service Find Microsoft Corporation c:\windows\system32\dsquery.dll
+ Directory Start/Search Find Directory Service Find Microsoft Corporation c:\windows\system32\dsquery.dll
+ Disk Copy Extension Windows DiskCopy Microsoft Corporation c:\windows\system32\diskcopy.dll
+ Disk Quota UI Windows Shell Disk Quota UI DLL Microsoft Corporation c:\windows\system32\dskquoui.dll
+ Display Adapter CPL Extension Advanced display adapter properties Microsoft Corporation c:\windows\system32\deskadp.dll
+ Display Monitor CPL Extension Advanced display monitor properties Microsoft Corporation c:\windows\system32\deskmon.dll
+ Display Panning CPL Extension 文件未找到: deskpan.dll
+ Display TroubleShoot CPL Extension Advanced display performance properties Microsoft Corporation c:\windows\system32\deskperf.dll
+ DS Security Page Directory Service Security UI Microsoft Corporation c:\windows\system32\dssec.dll
+ Extensions Manager Folder Extensions Manager Microsoft Corporation c:\windows\system32\extmgr.dll
+ Favorites Band Shell Doc Object and Control Library Microsoft Corporation c:\windows\system32\shdocvw.dll
+ FTP Folders Webview Microsoft Internet Explorer FTP Folder Shell Extension Microsoft Corporation c:\windows\system32\msieftp.dll
+ GDI+ 文件缩略图解压缩程序 Windows 图片和传真查看器 Microsoft Corporation c:\windows\system32\shimgvw.dll
+ HTML 缩略图的解压缩程序 Windows 图片和传真查看器 Microsoft Corporation c:\windows\system32\shimgvw.dll
+ HyperTerminal Icon Ext HyperTerminal Applet Library Hilgraeve, Inc. c:\windows\system32\hticons.dll
+ ICC 配置文件 Microsoft Color Matching System User Interface DLL Microsoft Corporation c:\windows\system32\icmui.dll
+ ICM 打印机管理 Microsoft Color Matching System User Interface DLL Microsoft Corporation c:\windows\system32\icmui.dll
+ ICM 监视器管理 Microsoft Color Matching System User Interface DLL Microsoft Corporation c:\windows\system32\icmui.dll
+ ICM 扫描仪管理 Microsoft Color Matching System User Interface DLL Microsoft Corporation c:\windows\system32\icmui.dll
+ IE4 套件初始屏幕 Shell Doc Object and Control Library Microsoft Corporation c:\windows\system32\shdocvw.dll
+ Installed Apps Enumerator Shell Application Manager Microsoft Corporation c:\windows\system32\appwiz.cpl
+ Internet Shell Doc Object and Control Library Microsoft Corporation c:\windows\system32\shdocvw.dll
+ Internet Shell Doc Object and Control Library Microsoft Corporation c:\windows\system32\shdocvw.dll
+ Internet Name Space Shell Doc Object and Control Library Microsoft Corporation c:\windows\system32\shdocvw.dll
+ Internet 临时文件 Shell Doc Object and Control Library Microsoft Corporation c:\windows\system32\shdocvw.dll
+ Internet 临时文件 Shell Doc Object and Control Library Microsoft Corporation c:\windows\system32\shdocvw.dll
+ InternetShortcut Shell Doc Object and Control Library Microsoft Corporation c:\windows\system32\shdocvw.dll
+ ISFBand OC Shell Doc Object and Control Library Microsoft Corporation c:\windows\system32\shdocvw.dll
+ Microsoft Agent Character Property Sheet Handler Microsoft Agent Property Sheet Handler Microsoft Corporation c:\windows\msagent\agentpsh.dll
+ Microsoft AutoComplete Shell Browser UI Library Microsoft Corporation c:\windows\system32\browseui.dll
+ Microsoft Browser Architecture Shell Doc Object and Control Library Microsoft Corporation c:\windows\system32\shdocvw.dll
+ Microsoft BrowserBand Shell Browser UI Library Microsoft Corporation c:\windows\system32\browseui.dll
+ Microsoft DocProp Inplace Calendar Control Microsoft DocProp Shell Ext Microsoft Corporation c:\windows\system32\docprop2.dll
+ Microsoft DocProp Inplace Droplist Combo Control Microsoft DocProp Shell Ext Microsoft Corporation c:\windows\system32\docprop2.dll
+ Microsoft DocProp Inplace Edit Box Control Microsoft DocProp Shell Ext Microsoft Corporation c:\windows\system32\docprop2.dll
+ Microsoft DocProp Inplace ML Edit Box Control Microsoft DocProp Shell Ext Microsoft Corporation c:\windows\system32\docprop2.dll
+ Microsoft DocProp Inplace Time Control Microsoft DocProp Shell Ext Microsoft Corporation c:\windows\system32\docprop2.dll
+ Microsoft DocProp Shell Ext Microsoft DocProp Shell Ext Microsoft Corporation c:\windows\system32\docprop2.dll
+ Microsoft Internet 工具栏 Shell Browser UI Library Microsoft Corporation c:\windows\system32\browseui.dll
+ Microsoft Office HTML Icon Handler Microsoft Office 2003 component Microsoft Corporation c:\program files\microsoft office\office11\msohev.dll
+ Microsoft Url History 服务 Shell Doc Object and Control Library Microsoft Corporation c:\windows\system32\shdocvw.dll
+ Microsoft Url 搜索挂接 Shell Doc Object and Control Library Microsoft Corporation c:\windows\system32\shdocvw.dll
+ Microsoft 多个自动完成列表容器 Shell Browser UI Library Microsoft Corporation c:\windows\system32\browseui.dll
+ Microsoft 历史自动完成列表 Shell Browser UI Library Microsoft Corporation c:\windows\system32\browseui.dll
+ Microsoft 数据链接 Microsoft Data Access - OLE DB Core Services Microsoft Corporation c:\program files\common files\system\ole db\oledb32.dll
+ Microsoft 外壳文件夹自动完成列表 Shell Browser UI Library Microsoft Corporation c:\windows\system32\browseui.dll
+ Midi Properties Handler Media File Property Extractor Shell Extension Microsoft Corporation c:\windows\system32\shmedia.dll
+ MMC Icon Handler MMC Shell Extension DLL Microsoft Corporation c:\windows\system32\mmcshext.dll
+ MRU 自动完成列表 Shell Browser UI Library Microsoft Corporation c:\windows\system32\browseui.dll
+ Multimedia File Property Sheet Control Panel Drivers Applet Microsoft Corporation c:\windows\system32\mmsys.cpl
+ MyDocs Copy Hook My Documents Folder UI Microsoft Corporation c:\windows\system32\mydocs.dll
+ MyDocs Drop Target My Documents Folder UI Microsoft Corporation c:\windows\system32\mydocs.dll
+ MyDocs Properties My Documents Folder UI Microsoft Corporation c:\windows\system32\mydocs.dll
+ NTFS Security Page Security Shell Extension Microsoft Corporation c:\windows\system32\rshx32.dll
+ Offline Files Folder Options Client Side Caching UI Microsoft Corporation c:\windows\system32\cscui.dll
+ Offline Files Menu Client Side Caching UI Microsoft Corporation c:\windows\system32\cscui.dll
+ OLE Docfile Property Page OLE DocFile Property Page Microsoft Corporation c:\windows\system32\docprop.dll
+ PlusPack CPL Extension Windows Theme API Microsoft Corporation c:\windows\system32\themeui.dll
+ Portable Media Devices 便携媒体设备命令行解释器扩展 Microsoft Corporation c:\windows\system32\audiodev.dll
+ Portable Media Devices Menu 便携媒体设备命令行解释器扩展 Microsoft Corporation c:\windows\system32\audiodev.dll
+ PostAgent Web Site Monitor Microsoft Corporation c:\windows\system32\webcheck.dll
+ Printers Security Page Security Shell Extension Microsoft Corporation c:\windows\system32\rshx32.dll
+ Remote Sessions CPL Extension Remote Sessions CPL Extension Microsoft Corporation c:\windows\system32\remotepg.dll
+ Search Assistant OC Shell Doc Object and Control Library Microsoft Corporation c:\windows\system32\shdocvw.dll
+ Sendmail service Send Mail Microsoft Corporation c:\windows\system32\sendmail.dll
+ Sendmail service Send Mail Microsoft Corporation c:\windows\system32\sendmail.dll
+ Set Program Access and Defaults Shell Doc Object and Control Library Microsoft Corporation c:\windows\system32\shdocvw.dll
+ Shell Application Manager Shell Application Manager Microsoft Corporation c:\windows\system32\appwiz.cpl
+ Shell Automation Inproc Service Shell Doc Object and Control Library Microsoft Corporation c:\windows\system32\shdocvw.dll
+ Shell Band Site Menu Shell Browser UI Library Microsoft Corporation c:\windows\system32\browseui.dll
+ Shell DocObject Viewer Shell Doc Object and Control Library Microsoft Corporation c:\windows\system32\shdocvw.dll
+ Shell extensions for Microsoft Windows Network objects Network object shell UI Microsoft Corporation c:\windows\system32\ntlanui2.dll
+ Shell extensions for sharing Shell extensions for sharing Microsoft Corporation c:\windows\system32\ntshrui.dll
+ Shell extensions for sharing Shell extensions for sharing Microsoft Corporation c:\windows\system32\ntshrui.dll
+ Shell Image Data Factory Windows 图片和传真查看器 Microsoft Corporation c:\windows\system32\shimgvw.dll
+ Shell Image Property Handler Windows 图片和传真查看器 Microsoft Corporation c:\windows\system32\shimgvw.dll
+ Shell Image Verbs Windows 图片和传真查看器 Microsoft Corporation c:\windows\system32\shimgvw.dll
+ Shell properties for a DS object Directory Service Find Microsoft Corporation c:\windows\system32\dsquery.dll
+ Shell Scrap DataHandler Shell scrap object handler Microsoft Corporation c:\windows\system32\shscrap.dll
+ Shell Search Band Shell Browser UI Library Microsoft Corporation c:\windows\system32\browseui.dll
+ Subscription Mgr Web Site Monitor Microsoft Corporation c:\windows\system32\webcheck.dll
+ Tasks Folder Icon Handler Task Scheduler interface DLL Microsoft Corporation c:\windows\system32\mstask.dll
+ Tasks Folder Shell Extension Task Scheduler interface DLL Microsoft Corporation c:\windows\system32\mstask.dll
+ TrayAgent Web Site Monitor Microsoft Corporation c:\windows\system32\webcheck.dll
+ TridentImageExtractor Shell Browser UI Library Microsoft Corporation c:\windows\system32\browseui.dll
+ Video Media Properties Handler Media File Property Extractor Shell Extension Microsoft Corporation c:\windows\system32\shmedia.dll
+ Video Thumbnail Extractor Media File Property Extractor Shell Extension Microsoft Corporation c:\windows\system32\shmedia.dll
+ Wav Properties Handler Media File Property Extractor Shell Extension Microsoft Corporation c:\windows\system32\shmedia.dll
+ Web Folders Microsoft Web Folders Microsoft Corporation c:\program files\common files\microsoft shared\web folders\msonsext.dll
+ Web Printer Shell Extension Print UI DLL Microsoft Corporation c:\windows\system32\printui.dll
+ Web 搜索 Shell Browser UI Library Microsoft Corporation c:\windows\system32\browseui.dll
+ WebCheck Web Site Monitor Microsoft Corporation c:\windows\system32\webcheck.dll
+ WebCheck SyncMgr Handler Web Site Monitor Microsoft Corporation c:\windows\system32\webcheck.dll
+ WebCheckChannelAgent Web Site Monitor Microsoft Corporation c:\windows\system32\webcheck.dll
+ WebCheckWebCrawler Web Site Monitor Microsoft Corporation c:\windows\system32\webcheck.dll
+ Windows Media Player Add to Playlist Context Menu Handler Windows Media Player Launcher Microsoft Corporation c:\windows\system32\wmpshell.dll
+ Windows Media Player Burn Audio CD Context Menu Handler Windows Media Player Launcher Microsoft Corporation c:\windows\system32\wmpshell.dll
+ Windows Media Player Play as Playlist Context Menu Handler Windows Media Player Launcher Microsoft Corporation c:\windows\system32\wmpshell.dll
+ Windows Script Host 的 Shell extensions Microsoft (r) Shell Extension for Windows Script Host Microsoft Corporation c:\windows\system32\wshext.dll
+ WinRAR shell extension c:\program files\winrar\rarext.dll
+ 帮助和支持 Shell Doc Object and Control Library Microsoft Corporation c:\windows\system32\shdocvw.dll
+ 帮助和支持 Shell Doc Object and Control Library Microsoft Corporation c:\windows\system32\shdocvw.dll
+ 补充的外壳文件夹 Shell Browser UI Library Microsoft Corporation c:\windows\system32\browseui.dll
+ 补充的外壳文件夹 2 Shell Browser UI Library Microsoft Corporation c:\windows\system32\browseui.dll
+ 窗格中的搜索 Shell Browser UI Library Microsoft Corporation c:\windows\system32\browseui.dll
+ 地址 EditBox Shell Browser UI Library Microsoft Corporation c:\windows\system32\browseui.dll
+ 地址(&A) Shell Browser UI Library Microsoft Corporation c:\windows\system32\browseui.dll
+ 电子邮件 Shell Doc Object and Control Library Microsoft Corporation c:\windows\system32\shdocvw.dll
+ 跟踪弹出栏 Shell Browser UI Library Microsoft Corporation c:\windows\system32\browseui.dll
+ 管理工具 Shell Doc Object and Control Library Microsoft Corporation c:\windows\system32\shdocvw.dll
+ 获取 Passport 向导 Map Network Drives/Network Places Wizard Microsoft Corporation c:\windows\system32\netplwiz.dll
+ 可访问的 Shell Browser UI Library Microsoft Corporation c:\windows\system32\browseui.dll
+ 历史记录 Shell Doc Object and Control Library Microsoft Corporation c:\windows\system32\shdocvw.dll
+ 频道句柄对象 Channel Definition File Viewer Microsoft Corporation c:\windows\system32\cdfview.dll
+ 频道快捷方式 Channel Definition File Viewer Microsoft Corporation c:\windows\system32\cdfview.dll
+ 频道文件 Channel Definition File Viewer Microsoft Corporation c:\windows\system32\cdfview.dll
+ 全局文件夹设置 Shell Browser UI Library Microsoft Corporation c:\windows\system32\browseui.dll
+ 任务计划 Task Scheduler interface DLL Microsoft Corporation c:\windows\system32\mstask.dll
+ 任务栏和「开始」菜单 Windows Shell Common Dll Microsoft Corporation c:\windows\system32\shell32.dll
+ 扫描仪和照相机 Imaging Devices Shell Folder UI Microsoft Corporation c:\windows\system32\wiashext.dll
+ 扫描仪和照相机 Imaging Devices Shell Folder UI Microsoft Corporation c:\windows\system32\wiashext.dll
+ 扫描仪和照相机 Imaging Devices Shell Folder UI Microsoft Corporation c:\windows\system32\wiashext.dll
+ 扫描仪和照相机 Imaging Devices Shell Folder UI Microsoft Corporation c:\windows\system32\wiashext.dll
+ 扫描仪和照相机 Imaging Devices Shell Folder UI Microsoft Corporation c:\windows\system32\wiashext.dll
+ 搜索 Shell Doc Object and Control Library Microsoft Corporation c:\windows\system32\shdocvw.dll
+ 搜索区 Shell Browser UI Library Microsoft Corporation c:\windows\system32\browseui.dll
+ 通过 Web 订购照片 Map Network Drives/Network Places Wizard Microsoft Corporation c:\windows\system32\netplwiz.dll
+ 脱机文件夹 Client Side Caching UI Microsoft Corporation c:\windows\system32\cscui.dll
+ 外壳 DeskBar Shell Browser UI Library Microsoft Corporation c:\windows\system32\browseui.dll
+ 外壳 DeskBarApp Shell Browser UI Library Microsoft Corporation c:\windows\system32\browseui.dll
+ 外壳 Rebar BandSite Shell Browser UI Library Microsoft Corporation c:\windows\system32\browseui.dll
+ 外壳出版向导对象 Map Network Drives/Network Places Wizard Microsoft Corporation c:\windows\system32\netplwiz.dll
+ 网络出版向导 Map Network Drives/Network Places Wizard Microsoft Corporation c:\windows\system32\netplwiz.dll
+ 网络反病毒统计信息 Script Monitor Internet Explorer plugin Kaspersky Lab c:\program files\kaspersky lab\kaspersky internet security 7.0\scieplgn.dll
+ 网络连接 Network Connections Shell Microsoft Corporation c:\windows\system32\netshell.dll
+ 网络连接 Network Connections Shell Microsoft Corporation c:\windows\system32\netshell.dll
+ 下载状态 Shell Browser UI Library Microsoft Corporation c:\windows\system32\browseui.dll
+ 以前的版本 Previous Versions property page Microsoft Corporation c:\windows\system32\twext.dll
+ 以前的版本属性页 Previous Versions property page Microsoft Corporation c:\windows\system32\twext.dll
+ 用户(&P)... Find People Microsoft Corporation c:\program files\outlook express\wabfind.dll
+ 用户帮助 Shell Browser UI Library Microsoft Corporation c:\windows\system32\browseui.dll
+ 用户帐户 Map Network Drives/Network Places Wizard Microsoft Corporation c:\windows\system32\netplwiz.dll
+ 预订文件夹 Web Site Monitor Microsoft Corporation c:\windows\system32\webcheck.dll
+ 运行... Shell Doc Object and Control Library Microsoft Corporation c:\windows\system32\shdocvw.dll
+ 摘要信息缩略图处理程序(DOCFILES) Windows 图片和传真查看器 Microsoft Corporation c:\windows\system32\shimgvw.dll
+ 注册数目路选项实用程序 Shell Browser UI Library Microsoft Corporation c:\windows\system32\browseui.dll
+ 自定义 MRU 自动完成列表 Shell Browser UI Library Microsoft Corporation c:\windows\system32\browseui.dll
+ 字体 Windows Font Folder Microsoft Corporation c:\windows\system32\fontext.dll
+ 字体 Shell Doc Object and Control Library Microsoft Corporation c:\windows\system32\shdocvw.dll
+ 浏览器栏 Shell Doc Object and Control Library Microsoft Corporation c:\windows\system32\shdocvw.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
+ Thunder Browser Helper XunLeiBHO Thunder Networking Technologies,LTD c:\program files\thunder\comdlls\xunleibho_now.dll
+ ThunderAtOnce Class 迅雷浏览器高级特性支持模块 Thunder Networking Technologies,LTD c:\program files\thunder\comdlls\tdatonce_now.dll
HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks
+ Microsoft Url 搜索挂接 Shell Doc Object and Control Library Microsoft Corporation c:\windows\system32\shdocvw.dll
HKLM\System\CurrentControlSet\Services
+ AudioSrv 管理基于 Windows 的程序的音频设备。如果此服务被终止，音频设备及其音效将不能正常工作。如果此服务被禁用，任何依赖它的服务将无法启动。 Microsoft Corporation c:\windows\system32\audiosrv.dll
+ AVP 保护计算机远离病毒、间谍软件、黑客攻击、计算机犯罪和垃圾邮件。 Kaspersky Lab c:\program files\kaspersky lab\kaspersky internet security 7.0\avp.exe
+ Browser 维护网络上计算机的更新列表，并将列表提供给计算机指定浏览。如果服务停止，列表不会被更新或维护。如果服务被禁用，任何直接依赖于此服务的服务将无法启动。 Microsoft Corporation c:\windows\system32\browser.dll
+ CryptSvc 提供三种管理服务: 编录数据库服务，它确定 Windows 文件的签字; 受保护的根服务，它从此计算机添加和删除受信根证书机构的证书;和密钥(Key)服务，它帮助注册此计算机获取证书。如果此服务被终止，这些管理服务将无法正常运行。如果此服务被禁用，任何依赖它的服务将无法启动。 Microsoft Corporation c:\windows\system32\cryptsvc.dll
+ DcomLaunch 为 DCOM 服务提供加载功能。 Microsoft Corporation c:\windows\system32\rpcss.dll
+ Dhcp 通过注册和更改 IP 地址以及 DNS 名称来管理网络配置。 Microsoft Corporation c:\windows\system32\dhcpcsvc.dll
+ dmserver 监测和监视新硬盘驱动器并向逻辑磁盘管理器管理服务发送卷的信息以便配置。如果此服务被终止，动态磁盘状态和配置信息会过时。如果此服务被禁用，任何依赖它的服务将无法启动。 Microsoft Corp. c:\windows\system32\dmserver.dll
+ Dnscache 为此计算机解析和缓冲域名系统 (DNS) 名称。如果此服务被停止，计算机将不能解析 DNS 名称并定位 Active Directory 域控制器。如果此服务被禁用，任何明确依赖它的服务将不能启动。 Microsoft Corporation c:\windows\system32\dnsrslvr.dll
+ Eventlog 启用在事件查看器查看基于 Windows 的程序和组件颁发的事件日志消息。无法终止此服务。 Microsoft Corporation c:\windows\system32\services.exe
+ HidServ 启用对智能界面设备 (HID)的通用输入访问，它激活并保存键盘、远程控制和其它多媒体设备上的预先定义的热按钮。如果此服务被终止，由此服务控制的热按钮将不再运行。如果此服务被禁用，任何依赖它的服务将无法启动。 Microsoft Corporation c:\windows\system32\hidserv.dll
+ lanmanserver 支持此计算机通过网络的文件、打印、和命名管道共享。如果服务停止，这些功能不可用。如果服务被禁用，任何直接依赖于此服务的服务将无法启动。 Microsoft Corporation c:\windows\system32\srvsvc.dll
+ lanmanworkstation 创建和维护到远程服务的客户端网络连接。如果服务停止，这些连接将不可用。如果服务被禁用，任何直接依赖于此服务的服务将无法启动。 Microsoft Corporation c:\windows\system32\wkssvc.dll
+ LmHosts 允许对“TCP/IP 上 NetBIOS (NetBT)”服务以及 NetBIOS 名称解析的支持。 Microsoft Corporation c:\windows\system32\lmhsvc.dll
+ PlugPlay 使计算机在极少或没有用户输入的情况下能识别并适应硬件的更改。终止或禁用此服务会造成系统不稳定。 Microsoft Corporation c:\windows\system32\services.exe
+ PolicyAgent 管理 IP 安全策略以及启动 ISAKMP/Oakley (IKE) 和 IP 安全驱动程序。 Microsoft Corporation c:\windows\system32\lsass.exe
+ ProtectedStorage 提供对敏感数据(如私钥)的保护性存储，以便防止未授权的服务，过程或用户对其的非法访问。 Microsoft Corporation c:\windows\system32\lsass.exe
+ RpcSs 提供终结点映射程序 (endpoint mapper) 以及其它 RPC 服务。 Microsoft Corporation c:\windows\system32\rpcss.dll
+ SamSs 存储本地用户帐户的安全信息。 Microsoft Corporation c:\windows\system32\lsass.exe
+ seclogon 启用替换凭据下的启用进程。如果此服务被终止，此类型登录访问将不可用。如果此服务被禁用，任何依赖它的服务将无法启动。 Microsoft Corporation c:\windows\system32\seclogon.dll
+ SENS 跟踪系统事件，如登录 Windows，网络以及电源事件等。将这些事件通知给 COM+ 事件系统 “订阅者(subscriber)”。 Microsoft Corporation c:\windows\system32\sens.dll
+ SharedAccess 为家庭和小型办公网络提供网络地址转换、寻址、名称解析和/或入侵保护服务。 Microsoft Corporation c:\windows\system32\ipnathlp.dll
+ ShellHWDetection 为自动播放硬件事件提供通知。 Microsoft Corporation c:\windows\system32\shsvcs.dll
+ Spooler 将文件加载到内存中以便迟后打印。 Microsoft Corporation c:\windows\system32\spoolsv.exe
+ Themes 为用户提供使用主题管理的经验。 Microsoft Corporation c:\windows\system32\shsvcs.dll
+ TrkWks 在计算机内 NTFS 文件之间保持链接或在网络域中的计算机之间保持链接。 Microsoft Corporation c:\windows\system32\trkwks.dll
+ UMWdf Enables Windows user mode drivers. Microsoft Corporation c:\windows\system32\wdfmgr.exe
+ W32Time 维护在网络上的所有客户端和服务器的时间和日期同步。如果此服务被停止，时间和日期的同步将不可用。如果此服务被禁用，任何明确依赖它的服务都将不能启动。 Microsoft Corporation c:\windows\system32\w32time.dll
+ WebClient 使基于 Windows 的程序能创建、访问和修改基于 Internet 的文件。如果此服务被终止，将会失去这些功能。如果此服务被禁用，任何依赖它的服务将无法启动。 Microsoft Corporation c:\windows\system32\webclnt.dll

TOP

lqw229

通政司参议

Rank: 9 Rank: 9 Rank: 9

UID: 127863
精华: 0
积分: 624
威望: 0
阅读权限: 10
在线时间: 196 小时

发短消息
加为好友
当前离线

5楼大中小发表于 2008-10-20 22:15 只看该作者

太多了分两次发
接上面

+ winmgmt 提供共同的界面和对象模式以便访问有关操作系统、设备、应用程序和服务的管理信息。如果此服务被终止，多数基于 Windows 的软件将无法正常运行。如果此服务被禁用，任何依赖它的服务将无法启动。 Microsoft Corporation c:\windows\system32\wbem\wmisvc.dll
+ wscsvc 监视系统安全设置和配置。 Microsoft Corporation c:\windows\system32\wscsvc.dll
+ wuauserv 允许下载并安装 Windows 更新。如果此服务被禁用，计算机将不能使用 Windows Update 网站的自动更新功能。 Microsoft Corporation c:\windows\system32\wuauserv.dll
+ WZCSVC 为您的 802.11 适配器提供自动配置 Microsoft Corporation c:\windows\system32\wzcsvc.dll
HKLM\System\CurrentControlSet\Services
+ ac97intc Intel(r) Integrated Controller Hub Audio Driver Intel Corporation c:\windows\system32\drivers\ac97intc.sys
+ ACPI ACPI Driver for NT Microsoft Corporation c:\windows\system32\drivers\acpi.sys
+ aec Microsoft Acoustic Echo Canceller Microsoft Corporation c:\windows\system32\drivers\aec.sys
+ AFAMgt Dell Management Driver Adaptec, Inc. c:\windows\system32\drivers\afamgt.sys
+ AFD AFD 网络支持环境 Microsoft Corporation c:\windows\system32\drivers\afd.sys
+ ALCXWDM Realtek AC'97 Audio Driver (WDM) Realtek Semiconductor Corp. c:\windows\system32\drivers\alcxwdm.sys
+ AmdK8 AMD Processor Driver Advanced Micro Devices c:\windows\system32\drivers\amdk8.sys
+ AsyncMac RAS Asynchronous Media Driver Microsoft Corporation c:\windows\system32\drivers\asyncmac.sys
+ atapi IDE/ATAPI Port Driver Microsoft Corporation c:\windows\system32\drivers\atapi.sys
+ Atmarpc ATM ARP Client Protocol Microsoft Corporation c:\windows\system32\drivers\atmarpc.sys
+ audstub AudStub Driver Microsoft Corporation c:\windows\system32\drivers\audstub.sys
+ Beep BEEP Driver Microsoft Corporation c:\windows\system32\drivers\beep.sys
+ Cdaudio CD-ROM Audio Filter Driver Microsoft Corporation c:\windows\system32\drivers\cdaudio.sys
+ Cdrom SCSI CD-ROM Driver Microsoft Corporation c:\windows\system32\drivers\cdrom.sys
+ Changer 文件未找到: C:\WINDOWS\System32\Drivers\Changer.sys
+ Disk PnP Disk Driver Microsoft Corporation c:\windows\system32\drivers\disk.sys
+ dmio NT Disk Manager I/O Driver Microsoft Corp., Veritas Software c:\windows\system32\drivers\dmio.sys
+ dmload NT Disk Manager Startup Driver Microsoft Corp., Veritas Software. c:\windows\system32\drivers\dmload.sys
+ DMusic Microsoft Kernel DLS Synthesizer Microsoft Corporation c:\windows\system32\drivers\dmusic.sys
+ drmkaud Microsoft Kernel DRM Audio Descrambler Filter Microsoft Corporation c:\windows\system32\drivers\drmkaud.sys
+ Fdc Floppy Disk Controller Driver Microsoft Corporation c:\windows\system32\drivers\fdc.sys
+ FETNDIS NDIS 5.0 miniport driver VIA Technologies, Inc. c:\windows\system32\drivers\fetnd5.sys
+ Flpydisk Floppy Driver Microsoft Corporation c:\windows\system32\drivers\flpydisk.sys
+ FltMgr 文件系统筛选器管理器驱动程序 Microsoft Corporation c:\windows\system32\drivers\fltmgr.sys
+ FsVga Full Screen Video Driver Microsoft Corporation c:\windows\system32\drivers\fsvga.sys
+ Ftdisk FT Disk Driver Microsoft Corporation c:\windows\system32\drivers\ftdisk.sys
+ gameenum Game Port Enumerator Microsoft Corporation c:\windows\system32\drivers\gameenum.sys
+ Gpc Generic Packet Classifier Microsoft Corporation c:\windows\system32\drivers\msgpc.sys
+ HidUsb USB Miniport Driver for Input Devices Microsoft Corporation c:\windows\system32\drivers\hidusb.sys
+ hptmv6 hptmv6 Miniport Driver HighPoint Technologies, Inc. c:\windows\system32\drivers\hptmv6.sys
+ HTTP 此服务实现超文本传送协议(HTTP)。如果此服务被禁用，任何依赖它的服务将无法启动。 Microsoft Corporation c:\windows\system32\drivers\http.sys
+ i2omgmt I2O Utility Filter Microsoft Corporation c:\windows\system32\drivers\i2omgmt.sys
+ i8042prt i8042 Port Driver Microsoft Corporation c:\windows\system32\drivers\i8042prt.sys
+ ialm Intel Graphics Miniport Driver Intel Corporation c:\windows\system32\drivers\ialmnt5.sys
+ Imapi IMAPI Kernel Driver Microsoft Corporation c:\windows\system32\drivers\imapi.sys
+ IntelIde Inte