2008-07-04,22:15:26
System Repair Engineer 2.6.11.992
Smallfrogs ([url=http://www.KZTechs.com]http://www.KZTechs.com[/url])
Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件
    进程特权扫描

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
      [N/A]
      [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
      [Kaspersky Lab]
      [Apple Inc.]
      [(Verified)Apple Inc.]
      [Avira GmbH]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
      [(Verified)Microsoft Windows Publisher]
      [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
      [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
      [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
      [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
      [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
      [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
      [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
      [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
      [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
      [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
      [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
      [File is missing]
==================================
启动文件夹
N/A
==================================
服务
[Avira AntiVir Personal – Free Antivirus Scheduler / AntiVirScheduler][Running/Auto Start]
  
[Avira AntiVir Personal – Free Antivirus Guard / AntiVirService][Running/Auto Start]
  
[Apple Mobile Device / Apple Mobile Device][Running/Auto Start]
  
[卡巴斯基反病毒6.0个人版 / AVP][Stopped/Auto Start]
  
[BoBoTurbo / BoBoTurbo][Stopped/Disabled]
  
[Bonjour 服务 / Bonjour Service][Stopped/Disabled]
  
[Human Interface Device Access / HidServ][Stopped/Disabled]
  %SystemRoot%\System32\hidserv.dll>
[InterBase Guardian / InterBaseGuardian][Stopped/Disabled]
  
[InterBase Server / InterBaseServer][Stopped/Disabled]
  
[iPod 服务 / iPod Service][Stopped/Disabled]
  
[Event Log Watch / LogWatch][Stopped/Disabled]
  
[MSSQLSERVER / MSSQLSERVER][Stopped/Manual Start]
  
[MSSQLServerADHelper / MSSQLServerADHelper][Stopped/Manual Start]
  
[Qvod Terminal / Qvod Terminal][Stopped/Disabled]
  
[Remote Packet Capture Protocol v.0 (experimental) / rpcapd][Stopped/Disabled]
  
[SQLSERVERAGENT / SQLSERVERAGENT][Stopped/Manual Start]
  
==================================
驱动程序
[标准 IDE/ESDI 硬盘控制器 / atapi][Running/Boot Start]
  
[avgio / avgio][Running/System Start]
  
[avgntflt / avgntflt][Running/Manual Start]
  
[avipbb / avipbb][Running/System Start]
  
[d346bus / d346bus][Running/Boot Start]
  
[d346prt / d346prt][Running/Boot Start]
  
[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Running/Manual Start]
  
[GEARAspiWDM / GEARAspiWDM][Running/Manual Start]
  
[kl1 / kl1][Running/Boot Start]
  
[klif / klif][Running/System Start]
  
[NetGroup Packet Filter Driver / NPF][Stopped/Manual Start]
  
[npkcrypt / npkcrypt][Running/Auto Start]
  
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  
[PxHelp20 / PxHelp20][Running/Boot Start]
  
[ROCKEYNT / ROCKEYNT][Running/Auto Start]
  
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
  
[Secdrv / Secdrv][Stopped/Manual Start]
  
[Spy Emergency Driver / SpyEmrg][Stopped/System Start]
  
[ssmdrv / ssmdrv][Running/System Start]
  
[TSP / TSP][Stopped/Manual Start]
  
[Conexant Setup API / UIUSys][Stopped/Manual Start]
  
[viagfx / viagfx][Running/Manual Start]
  
[viamraid / viamraid][Running/Boot Start]
  
[Vinyl AC'97 Audio Controller (WDM) / VIAudio][Running/Manual Start]
  
==================================
浏览器加载项
[ThunderAtOnce Class]
  {01443AEC-0FD1-40fd-9C87-E93D1494C233}
[FGCatchUrl]
  {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}
[VnetCookie Class]
  {4E83D567-4697-4F7B-B1F0-A513B01DB89A}
[超级兔子上网精灵]
  {7369D35A-5B70-4A5B-B789-B25FE09B4AF3}
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283}
[启动迅雷5]
  {09BA8F6D-CB54-424B-839C-C2A6C8E6B436}
[快车]
  {D6E814A0-E0C5-11d4-8D29-0050BA6940E3}
[超级兔子上网精灵]
  {43869BB3-22FD-4F15-9B46-238106BA2F4E}
[快车(FlashGet)]
  {E0E899AB-F487-11D5-8D29-0050BA6940E3}
[WebActivater Control]
  {3D8F74EE-8692-4F8F-B8D2-7522E732519E}
[XIsOro Control]
  {48FE89A0-486C-48DF-9DEC-BED22BDC6057}
[JavaBeansBridge.Object]
  {8AD9C840-044E-11D1-B3E9-00805F499D93}
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000}
[PasswordEditCtrl Class]
  {E787FD25-8D7C-4693-AE67-9406BC6E22DF}
[BoBoControl Class]
  {EC0978ED-24E3-403C-AB7A-060E388553E6}
[ThunderAtOnce Class]
  {01443AEC-0FD1-40FD-9C87-E93D1494C233}
[FGCatchUrl]
  {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}
[超级兔子上网精灵]
  {43869BB3-22FD-4F15-9B46-238106BA2F4E}
[XML Document]
  {48123BC4-99D9-11D1-A6B3-00C04FD91555}
[Thunder Agent Class]
  {485463B7-8FB2-4B3B-B29B-8B919B0EACCE}
[VnetCookie Class]
  {4E83D567-4697-4F7B-B1F0-A513B01DB89A}
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6}
[超级兔子上网精灵]
  {7369D35A-5B70-4A5B-B789-B25FE09B4AF3}
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2}
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283}
[SearchAssistantOC]
  {B45FF030-4447-11D2-85DE-00C04FA35C89}
[RDS.DataSpace]
  {BD96C556-65A3-11D0-983A-00C04FC29E36}
[RealPlayer G2 Control]
  {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA}
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000}
[快车(FlashGet)]
  {E0E899AB-F487-11D5-8D29-0050BA6940E3}
[FGCatchUrl]
  {FB5DA724-162B-11D3-8B9B-AA70B4B0B524}
[&使用快车(FlashGet)下载]
  
[&使用快车(FlashGet)下载全部链接]
  
[使用迅雷下载]
  
[使用迅雷下载全部链接]
  
[添加到QQ表情]
  
==================================
正在运行的进程
[PID: 632][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 708][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 732][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\klogon.dll]  [Kaspersky Lab, 6.0.2.621]
[PID: 776][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 788][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 940][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1004][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Bonjour\mdnsNSP.dll]  [Apple Inc., 1,0,4,12]
[PID: 1120][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1168][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1388][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1628][C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe]  [Avira GmbH, 8.00.00.12]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\schedr.dll]  [Avira GmbH, 8.00.03.00]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\avevtlog.dll]  [Avira GmbH, 8.00.00.11]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\sqlite3.dll]  [, 3.3.17.1]
[PID: 1920][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [F:\Kaspersky 6.0\scrchpg.dll]  [Kaspersky Lab, 6.0.2.621]
    [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll]  [Adobe Systems, Inc., 7.0.0.0]
    [F:\Thunder\Components\ResWorker\DsBho_01.dll]  [, 1, 0, 0, 12]
    [F:\Thunder\Components\ResWorker\DataProcessor_01.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 13]
    [F:\Thunder\ComDlls\TDAtOnce_Now.dll]  [Thunder Networking Technologies,LTD, 1.0.5.16]
    [F:\Thunder\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 8, 55]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll]  [Avira GmbH, 7.00.00.11]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\MFC71U.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\MFC71CHS.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [F:\Kaspersky 6.0\ShellEx.dll]  [Kaspersky Lab, 6.0.2.621]
[PID: 2016][C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe]  [Avira GmbH, 8.00.00.07]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\MFC71U.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\cclib.dll]  [Avira GmbH, 8.00.01.18]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\MFC71CHS.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [c:\program files\avira\antivir personaledition classic\ccgen.dll]  [Avira GmbH, 8.00.00.20]
    [c:\program files\avira\antivir personaledition classic\ccgenrc.dll]  [Avira GmbH, 8.00.12.00]
    [c:\program files\avira\antivir personaledition classic\ccguard.dll]  [Avira GmbH, 8.00.00.16]
    [c:\program files\avira\antivir personaledition classic\ccgrdrc.dll]  [Avira GmbH, 8.00.03.00]
    [c:\program files\avira\antivir personaledition classic\avipc.dll]  [Avira GmbH, 1.0.6.0]
    [c:\program files\avira\antivir personaledition classic\ccupdate.dll]  [Avira GmbH, 8.00.00.14]
    [c:\program files\avira\antivir personaledition classic\ccupdrc.dll]  [Avira GmbH, 8.00.03.00]
    [c:\program files\avira\antivir personaledition classic\cclic.dll]  [Avira GmbH, 8.00.00.09]
    [c:\program files\avira\antivir personaledition classic\cclicrc.dll]  [Avira GmbH, 8.00.02.00]
    [c:\program files\avira\antivir personaledition classic\ccmsg.dll]  [Avira GmbH, 8.00.00.04]
[PID: 168][C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe]  [Avira GmbH, 8.00.01.15]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\avevtlog.dll]  [Avira GmbH, 8.00.00.11]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\guardmsg.dll]  [Avira GmbH, 8.00.04.01]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\sqlite3.dll]  [, 3.3.17.1]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\AVPREF.DLL]  [Avira GmbH, 8.00.00.01]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\SMTPLIB.DLL]  [Avira GmbH, 1.02.00.19]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\AVGIO.DLL]  [Avira GmbH, 8.00.00.04]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\aecore.dll]  [Avira GmbH, 8.1.0.32]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\aevdf.dll]  [Avira GmbH, 8.1.0.5]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\aescript.dll]  [Avira GmbH, 8.1.0.46]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\aescn.dll]  [Avira GmbH, 8.1.0.22]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\aerdl.dll]  [Avira GmbH, 8.1.0.20]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\aepack.dll]  [Avira GmbH, 8.1.1.6]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\unacev2.dll]  [N/A, ]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\aeoffice.dll]  [Avira GmbH, 8.1.0.20]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\aeheur.dll]  [Avira GmbH, 8.1.0.35]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\aehelp.dll]  [Avira GmbH, 8.1.0.15]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\aegen.dll]  [Avira GmbH, 8.1.0.29]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\aeemu.dll]  [Avira GmbH, 8.1.0.6]
    [C:\Program Files\Avira\AntiVir PersonalEdition Classic\avipc.dll]  [Avira GmbH, 1.0.6.0]
[PID: 200][C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe]  [Apple, Inc., 1, 14, 0, 0]
[PID: 444][C:\WINDOWS\system32\wdfmgr.exe]  [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[PID: 1764][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1876][C:\Program Files\ChinaNet\VnetClient.exe]  [, 2005, 11, 14, 1]
    [C:\Program Files\ChinaNet\Communicate.dll]  [0, 2005, 3, 3, 1]
    [C:\Program Files\ChinaNet\DialModule.dll]  [GDCN, 2006, 6, 7, 12]
    [C:\Program Files\ChinaNet\MFC42.DLL]  [Microsoft Corporation, 6.00.8665.0]
    [C:\PROGRA~1\ChinaNet\CLIENT~1.DLL]  [, 2004, 2, 28, 1]
    [F:\Kaspersky 6.0\scrchpg.dll]  [Kaspersky Lab, 6.0.2.621]
    [C:\PROGRA~1\ChinaNet\PLUGIN~1.OCX]  [, 2005, 7, 27, 1]
    [C:\PROGRA~1\ChinaNet\sign.dll]  [0, 2004, 12, 1, 1]
    [C:\PROGRA~1\ChinaNet\WEBPLU~1.DLL]  [, 2005, 8, 18, 1]
    [C:\PROGRA~1\ChinaNet\PostPlug.dll]  [, 2004, 12, 16, 2]
    [C:\PROGRA~1\ChinaNet\ADVERT~1.OCX]  [, 2005, 10, 13, 1]
    [C:\PROGRA~1\ChinaNet\Gif89a.dll]  [, 2005, 6, 21, 1]
    [C:\PROGRA~1\ChinaNet\VnetBs.ocx]  [, 2004, 11, 18, 1]
    [C:\PROGRA~1\ChinaNet\ACCOUN~2.DLL]  [, 2005, 11, 14, 1]
    [C:\PROGRA~1\ChinaNet\AccountMgr.dll]  [, 2005, 11, 14, 17]
    [C:\PROGRA~1\ChinaNet\VnetSkin.ocx]  [GDDC, 2005, 11, 14, 1]
    [C:\PROGRA~1\ChinaNet\DialogStyle.dll]  [, 1, 0, 0, 1]
    [C:\PROGRA~1\ChinaNet\Timer.ocx]  [, 2005, 10, 9, 14]
    [C:\PROGRA~1\ChinaNet\PLUGIN~2.OCX]  [, 2005, 2, 24, 1]
    [C:\PROGRA~1\ChinaNet\NEWMES~1.DLL]  [, 2005, 8, 26, 1]
    [C:\PROGRA~1\ChinaNet\PassCtrl.dll]  [, 1, 0, 0, 1]
    [C:\WINDOWS\system32\wpcap.dll]  [Politecnico di Torino, 3, 0, 0, 18]
    [C:\WINDOWS\system32\pthreadVC.dll]  [N/A, ]
    [C:\WINDOWS\system32\packet.dll]  [Politecnico di Torino, 3, 0, 0, 18]
    [C:\PROGRA~1\ChinaNet\PlugPush.dll]  [, 2004, 12, 21, 1]
    [C:\PROGRA~1\ChinaNet\ALLINT~1.DLL]  [, 2004, 11, 23, 1]
    [C:\PROGRA~1\ChinaNet\VNetLog.ocx]  [, 2005, 10, 9, 1]
    [C:\PROGRA~1\ChinaNet\StatNum.dll]  [, 2004, 11, 18, 1]
    [C:\PROGRA~1\ChinaNet\VNETON~1.OCX]  [, 2005, 3, 2, 1]
    [C:\PROGRA~1\ChinaNet\ALLFUN~1.DLL]  [GDCN, 2005, 10, 9, 1]
    [C:\PROGRA~1\ChinaNet\VnetOptLog.dll]  [, 2005, 9, 13, 9]
    [F:\Kaspersky 6.0\klscav.dll]  [Kaspersky Lab, 6.0.2.621]
    [C:\PROGRA~1\ChinaNet\DlgSkin.ocx]  [, 2005, 11, 14, 1]
    [C:\Program Files\Bonjour\mdnsNSP.dll]  [Apple Inc., 1,0,4,12]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx]  [Adobe Systems, Inc., 9,0,124,0]
[PID: 1512][F:\Thunder\Program\Thunder5.exe]  [Thunder Networking Technologies,LTD, 5.7.6.427]
    [F:\Thunder\Program\TaskManager.dll]  [Thunder Networking Technologies,LTD, 1, 3, 0, 52]
    [F:\Thunder\Program\download_interface.dll]  [Thunder Networking Technologies,LTD, 2, 21, 2, 208]
    [F:\Thunder\Program\stlport_vc646.dll]  [STLport Consulting, Inc., 4.6.2003.1031]
    [F:\Thunder\Program\asyn_dns.dll]  [Thunder Networking Technologies,LTD, 2, 21, 2, 208]
    [F:\Thunder\Program\streammedialib.dll]  [, 1, 3, 12, 107]
    [F:\Thunder\Program\al.dll]  [, 1, 0, 1, 2]
    [C:\Program Files\Bonjour\mdnsNSP.dll]  [Apple Inc., 1,0,4,12]
    [F:\Thunder\Program\xldc.dll]  [Thunder Networking Technologies,LTD, 1, 0, 2, 12]
    [F:\Thunder\Program\bd.dll]  [Thunder Networking Technologies,LTD, 1, 0, 2, 5]
    [F:\Thunder\Program\XLNet.Dll]  [Thunder Networking Technologies,LTD, 1, 3, 2, 16]
    [F:\Thunder\Program\iTargetAD.dll]  [Thunder Networking Technologies,LTD, 1, 0, 3, 34]
    [F:\Thunder\Program\BHOStub.dll]  [Thunder Networking Technologies,LTD, 1, 1, 0, 8]
    [F:\Thunder\Components\DownAndPlay\DownAndPlay.dll]  [, 1, 0, 11, 29]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx]  [Adobe Systems, Inc., 9,0,124,0]
    [F:\Thunder\Components\InMedia\iEmbedShell.dll]  [　, 1, 0, 1, 23]
    [f:\Thunder\Components\InMedia\iEmbed14.dll]  [Thunder Networking Technologies,LTD, 3, 4, 5, 98]
    [f:\Thunder\Components\InMedia\PlayerHelper.dll]  [thunder, 1, 1, 2, 34]
    [f:\Thunder\Components\InMedia\XLNet.dll]  [Thunder Networking Technologies,LTD, 1, 3, 2, 16]
    [f:\Thunder\Components\InMedia\XLIPC.DLL]  [Thunder Networking Technologies,LTD, 1, 0, 0, 2]
    [F:\Thunder\Components\P4PClient\P4PClient.dll]  [Thunder Networking Technologies,LTD, 2, 2, 5, 70]
    [F:\Kaspersky 6.0\scrchpg.dll]  [Kaspersky Lab, 6.0.2.621]
    [F:\Thunder\Components\Community\XLCommunity.dll]  [Thunder Networking Technologies,LTD, 1, 5, 0, 15]
    [F:\Thunder\Program\RegisterDll.dll]  [Thunder Networking Technologies,LTD, 2, 16, 5, 63]
    [F:\Thunder\Program\MSVCIRT.dll]  [Microsoft Corporation, 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [F:\Thunder\Components\Security\ThunderSafe.dll]  [深圳市迅雷网络技术有限公司, 1, 0, 7, 66]
    [F:\Thunder\Program\ATL71.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [F:\Thunder\Components\Security\XLSafeUI.dll]  [深圳市迅雷网络技术有限公司, 1, 0, 7, 66]
    [F:\Thunder\Components\Search\XLSearch.dll]  [Thunder Networking Technologies,LTD, 1, 1, 6, 20]
    [F:\Kaspersky 6.0\klscav.dll]  [Kaspersky Lab, 6.0.2.621]
    [F:\Thunder\Program\LiveUpdate.dll]  [Thunder Networking Technologies,LTD, 1, 2, 2, 22]
    [F:\Thunder\Plugins\XLSafeHost\XLSafeHost.dll]  [深圳市迅雷网络技术有限公司, 1, 0, 7, 57]
    [F:\Thunder\Plugins\BhoAdv\bho_adv.dll]  [深圳市迅雷网络技术有限公司, 1.0.1.0]
    [F:\Thunder\Plugins\KanKanTop\KanKanTop.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 4]
    [F:\Thunder\Components\ExplorerHelper\ExplorerHelper.dll]  [Thunder Networking Technologies,LTD, 1, 0, 4, 16]
    [F:\Thunder\ComDlls\ThunderAgent_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 4, 23]
    [F:\Thunder\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 8, 55]
    [F:\Thunder\ComDlls\TDAtOnce_Now.dll]  [Thunder Networking Technologies,LTD, 1.0.5.16]
    [F:\Thunder\Components\Tips\TipsClient.dll]  [Thunder Networking Technologies,LTD, 2, 2, 10, 101]
    [F:\Thunder\Components\VPSHELL\VPSHELL.dll]  [XunLei, 2, 3, 0, 28]
    [F:\Thunder\Components\VPSHELL\VideoPicture.dll]  [XunLei, 2, 3, 0, 28]
    [F:\Thunder\Components\UserExperience\UserExperience.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
    [F:\Thunder\Components\ResWorker\DsXlCom.dll]  [, 1, 0, 0, 26]
    [F:\Thunder\Components\ResWorker\DataProcessor_01.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 13]
    [F:\Thunder\Components\ResWorker\MediaWorker.dll]  [Thunder Networking Technologies,LTD, 1, 2, 0, 20]
    [F:\Thunder\Components\Tips\XLIPC.DLL]  [Thunder Networking Technologies,LTD, 1, 0, 0, 2]
    [F:\Thunder\Components\DownloadStat\DownloadStat.dll]  [深圳市迅雷网络技术有限公司, 1, 3, 1, 4]
    [F:\Thunder\Program\FloatBar.dll]  [Giganology Inc., 1, 0, 0, 2]
[PID: 1688][F:\PTQQ\QQ.exe]  [TENCENT, 7,0,365,1701]
    [F:\PTQQ\QQBaseClassInDll.dll]  [TENCENT, 7,0,365,1701]
    [F:\PTQQ\QQHelperDll.dll]  [TENCENT, 7,0,365,1701]
    [F:\PTQQ\BasicCtrlDll.dll]  [TENCENT, 7,0,365,1701]
    [F:\PTQQ\MFC42.DLL]  [Microsoft Corporation, 6.00.8665.0]
    [F:\PTQQ\RICHED32.DLL]  [Microsoft Corporation, 5.00.2134.1]
    [F:\PTQQ\RICHED20.dll]  [Microsoft Corporation, 5.31.23.1218]
    [F:\PTQQ\QQAPI.dll]  [TENCENT, 7,0,365,1701]
    [f:\PTQQ\TIMProxy.dll]  [tencent, 0, 3, 2, 4]
    [F:\PTQQ\LoginCtrl.dll]  [TENCENT, 7,0,365,1701]
    [F:\PTQQ\LoginCtrlRes.dll]  [TENCENT, 7,0,365,1701]
    [F:\PTQQ\QQRes.dll]  [TENCENT, 7,0,365,1701]
    [F:\PTQQ\QQMainFrame.dll]  [N/A, ]
    [F:\PTQQ\CQQApplication.dll]  [N/A, ]
    [F:\PTQQ\FlashAvatarDll.dll]  [, 1, 4, 0, 1]
    [F:\PTQQ\NewSkin.dll]  [TENCENT, 7,0,365,1701]
    [F:\PTQQ\HostingMgr.dll]  [TENCENT, 7,0,365,1701]
    [F:\PTQQ\CameraDll.dll]  [TENCENT, 7,0,365,1701]
    [F:\PTQQ\MailSummary.dll]  [TENCENT, 7,0,365,1701]
    [F:\PTQQ\QQKnowledgeSearch.dll]  [TENCENT, 7,0,365,1701]
    [C:\Program Files\Bonjour\mdnsNSP.dll]  [Apple Inc., 1,0,4,12]
    [F:\PTQQ\QQAllInOne.dll]  [TENCENT, 7,0,365,1701]
    [F:\PTQQ\SCCore.dll]  [TENCENT, 1, 6, 0, 2]
    [F:\PTQQ\QQSpace.dll]  [TENCENT, 7,0,365,1701]
    [F:\PTQQ\vbscript.dll]  [Microsoft Corporation, 5.6.0.7426]
    [C:\WINDOWS\system32\msdmo.dll]  [, ]
    [F:\PTQQ\QQGroupMng.dll]  [TENCENT, 7,0,365,1701]
    [F:\PTQQ\QQSysMsgMng.dll]  [N/A, ]
    [F:\PTQQ\UserDefinedHead.dll]  [TENCENT, 7,0,365,1701]
    [F:\PTQQ\QQPlugin.dll]  [N/A, ]
    [F:\PTQQ\QQConfigPlugin.dll]  [TENCENT, 7,0,365,1701]
    [F:\PTQQ\QQAvatar.dll]  [N/A, ]
    [F:\Kaspersky 6.0\scrchpg.dll]  [Kaspersky Lab, 6.0.2.621]
    [F:\PTQQ\QQCustomFace.dll]  [N/A, ]
    [F:\PTQQ\QRingMng.dll]  [N/A, ]
    [F:\PTQQ\LongConnection.dll]  [TENCENT, 7,0,365,1701]
    [F:\PTQQ\QQPet.dll]  [TENCENT, 7,0,365,1701]
    [F:\PTQQ\PhoneAPI.dll]  [TENCENT, 7,0,365,1701]
    [F:\PTQQ\DialerAllinOne.dll]  [tencent, 1, 4, 0, 0]
    [F:\PTQQ\BQQApplication.dll]  [N/A, ]
    [F:\PTQQ\ImageOle.dll]  [TENCENT, 7,0,365,1701]
    [F:\PTQQ\QQLiveQMng.dll]  [TENCENT, 7,0,365,1701]
    [F:\Kaspersky 6.0\klscav.dll]  [Kaspersky Lab, 6.0.2.621]
    [F:\PTQQ\GroupConnection.dll]  [TENCENT, 7,0,365,1701]
    [F:\PTQQ\CommercesMng.dll]  [TENCENT, 7,0,365,1701]
    [F:\PTQQ\PersonalDesktop.dll]  [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2]
    [F:\PTQQ\QQAddr.dll]  [深圳市腾讯计算机系统有限公司, 5, 0, 101, 320]
    [F:\PTQQ\QQSceneMng.dll]  [N/A, ]
    [F:\PTQQ\AddrSearch.dll]  [腾讯科技（深圳）有限公司, 2, 2, 1, 15]
    [F:\PTQQ\QQZip.dll]  [TENCENT, 7,0,365,1701]
    [F:\PTQQ\QQMagicFace.dll]  [TENCENT, 7,0,365,1701]
[PID: 1520][F:\PTQQ\TIMPlatform.exe]  [TENCENT, 7,0,365,1701]
    [f:\PTQQ\TIMProxy.dll]  [tencent, 0, 3, 2, 4]
[PID: 2556][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [F:\Kaspersky 6.0\scrchpg.dll]  [Kaspersky Lab, 6.0.2.621]
    [D:\My Documents\magicset772\MagicSet\haokanbar.dll]  [Xiang Feng Technology, 2, 2, 0, 1612]
    [F:\Thunder\ComDlls\TDAtOnce_Now.dll]  [Thunder Networking Technologies,LTD, 1.0.5.16]
    [f:\FlashGet\jccatch.dll]  [www.flashget.com, 1, 8, 1, 1006]
    [c:\PROGRA~1\chinanet\VNETTR~1.DLL]  [, 2005, 4, 6, 1]
    [c:\PROGRA~1\chinanet\Communicate.dll]  [0, 2005, 3, 3, 1]
    [C:\PROGRA~1\ChinaNet\CLIENT~1.DLL]  [, 2004, 2, 28, 1]
    [F:\Thunder\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 8, 55]
    [F:\Thunder\Components\ResWorker\DsBho_01.dll]  [, 1, 0, 0, 12]
    [F:\Thunder\Components\ResWorker\DataProcessor_01.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 13]
    [C:\Program Files\Bonjour\mdnsNSP.dll]  [Apple Inc., 1,0,4,12]
    [F:\Kaspersky 6.0\klscav.dll]  [Kaspersky Lab, 6.0.2.621]
    [F:\Kaspersky 6.0\prloader.dll]  [Kaspersky Lab, 6.0.2.621]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx]  [Adobe Systems, Inc., 9,0,124,0]
[PID: 2752][E:\123\sreng2\SREngLdr.EXE]  [Smallfrogs Studio, 2.6.11.992]
[PID: 3068][E:\123\sreng2\SREd40d2e84.EXE]  [Smallfrogs Studio, 2.6.11.992]
    [E:\123\sreng2\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]
    [C:\Program Files\Bonjour\mdnsNSP.dll]  [Apple Inc., 1,0,4,12]
==================================
文件关联
.TXT  Error. [C:\WINDOWS\notepad.exe %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  Error. ["hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS   Error. []
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1       localhost
127.0.0.1  yu.8s7.net
127.0.0.1  1.jopanqc.com
127.0.0.1  2.joppnqq.com
127.0.0.1  wg.47255.com
127.0.0.1  1.joppnqq.com
127.0.0.1  xxx.m111.biz
127.0.0.1  1.jopenqc.com
127.0.0.1  1.jopenkk.com
127.0.0.1  xxx.vh7.biz
127.0.0.1  xxx.j41m.com
127.0.0.1  3.joppnqq.com
127.0.0.1  d.93se.com
127.0.0.1  [url=http://www.868wg.com]www.868wg.com[/url]
127.0.0.1  xxx.mmma.biz
127.0.0.1  ilove.com
127.0.0.1  tp.shpzhan.cn
127.0.0.1  [url=http://www.tomwg.com]www.tomwg.com[/url]
127.0.0.1  [url=http://www.cike007.cn]www.cike007.cn[/url]
127.0.0.1  [url=http://www.22aaa.com]www.22aaa.com[/url]
127.0.0.1  xx.exiao01.com
127.0.0.1  [url=http://www.exiao01.com]www.exiao01.com[/url]
127.0.0.1  [url=http://www.exiao01.com]www.exiao01.com[/url]
127.0.0.1  new.749571.com
127.0.0.1  xtx.kv8.info
127.0.0.1  cao.kv8.info
127.0.0.1  1.jopmmqq.com
127.0.0.1  171817.171817.com
127.0.0.1  d2.llsging.com
127.0.0.1  down.malasc.cn
127.0.0.1  llboss.com
127.0.0.1  nx.51ylb.cn
127.0.0.1  my.531jx.cn
127.0.0.1  qqq.dzydhx.com
127.0.0.1  qqq.hao1658.com
127.0.0.1  [url=http://www.333292.com]www.333292.com[/url]
127.0.0.1  down.18dd.net
127.0.0.1  up.22x44.com
127.0.0.1  aaa.faba01.com
127.0.0.1  bad.tqdlt.cn
127.0.0.1  1.chsipo.com
127.0.0.1  c3.aishangai.net
127.0.0.1  c2.aishangai.net
127.0.0.1  xxx.188dm.com
127.0.0.1  x2.1a2b3c1.com
127.0.0.1  d1.163500.net
127.0.0.1  down.google-serv.cn
==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 1628, C:\PROGRAM FILES\AVIRA\ANTIVIR PERSONALEDITION CLASSIC\SCHED.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 168, C:\PROGRAM FILES\AVIRA\ANTIVIR PERSONALEDITION CLASSIC\AVGUARD.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 200, C:\PROGRAM FILES\COMMON FILES\APPLE\MOBILE DEVICE SUPPORT\BIN\APPLEMOBILEDEVICESERVICE.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1876, C:\PROGRAM FILES\CHINANET\VNETCLIENT.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1512, F:\THUNDER\PROGRAM\THUNDER5.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2752, E:\123\SRENG2\SRENGLDR.EXE]
==================================
API HOOK
RVA  错误： LoadLibraryA (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys\?)
RVA  错误： LoadLibraryExA (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys\?)
RVA  错误： LoadLibraryExW (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys\?)
RVA  错误： LoadLibraryW (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys\?)
RVA  错误： GetProcAddress (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys\?)
==================================
隐藏进程
N/A
==================================