遭遇 mssvc.exe svcUpdate.exe IESeven.dll DBSeven.dll病毒
作者：
遭遇 mssvc.exe svcUpdate.exe IESeven.dll DBSeven.dll病毒
第一从任务管理器,停掉服务,有可能是木马下载者,因为它刚下载的木马,就被杀毒软件提示了,停掉后,建议用safe360进行查杀.
这是什么病毒或恶意软件,文件名为msd.exe,卡巴斯基或360不能认定它是病毒或木马?
帖子标题:
这是什么病毒或恶意软件,文件名为msd.exe,卡巴斯基或360不能认定它是病毒或木马?
帖子内容:
现象:
历史操作:从网上下载了一些屏保软件装上了就这样了,用瑞星或江民都检测不出病毒,其不定时运行,修改注册表RUN项自动运行,修改HOST文件,使一些反病毒网站指向127.0.0.1,自动关闭任务管理器,不停向网络传输数据(adsl2m可以达到上传10几K以上
备注: 改为自动运行,修改HOST文件,自动关闭任务管理器,不停向网络传输数据(adsl2m可以达到上传10几K以上
我的诊断报告:
各位高手：
非常感谢您留心我这份系统诊断报告，小菜鸟十万火急等待您的帮助！
该诊断报告由360安全卫士提供 http://www.360safe.com
诊断时间: 2007-07-10 09:48:15
诊断平台: Microsoft Windows XP Service Pack 2
IE版本: Internet Explorer V6.0.2900.2180 Build:62900.2180
计算机物理内存:247.48MB - 当前可用内存:48.98MB
100 - 未知 - Process: TongBackupSrv.exe [] - C:\WINDOWS\system32\TongBackupSrv.exe
O2 - 未知 - BHO: (ThunderAtOnce Class) - [迅雷浏览器高级特性支持模块] - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll
O2 - 未知 - BHO: (Thunder Browser Helper) - [XunLeiBHO] - {80BF4636-D65B-43F3-BB60-C5DD3D5FB7B9} - C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll
O8 - 未知 - Extra context menu item: 使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\geturl.htm
O8 - 未知 - Extra context menu item: 使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\getallurl.htm
O8 - 未知 - Extra context menu item: 添加到QQ表情 - c:\腾讯QQ 2007 Beta1 V1.6\AddEmotion.htm
O9 - 未知 - Extra button: 启动迅雷5(HKLM) - C:\Program Files\Thunder Network\Thunder\Thunder.exe
O15 - 未知 - Trusted Zone: easyabc.95599.cn
O15 - 未知 - Trusted Zone: www.95599.cn
O16 - 未知 - DPF: {E847C78C-C210-4195-8799-FBF3BF89797D} (金山毒霸在线产品升级) - http://scan.www.duba.net/duba/download/install/onlinescan/KOSInit.cab
O23 - 未知 - Service: EnGenius Network Analysis Tool [EnGenius Network TCP analysis tool.] - "C:\WINDOWS\system32\dllcache\winegne.exe" - (not running)
O23 - 未知 - Service: MSSQLSERVER [MSSQLSERVER] - C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe -sMSSQLSERVER - (running)
O23 - 未知 - Service: SQLSERVERAGENT [SQLSERVERAGENT] - C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlagent.EXE -i MSSQLSERVER - (not running)
O23 - 未知 - Service: TongBackupSrv [Tong备份服务] - C:\WINDOWS\system32\TongBackupSrv.exe - (running)
O23 - 未知 - Service: UFNet [用友通] - C:\WINDOWS\system32\ServerNT.exe - (running)
O30 - 未知 - HKCU\..\Desktop: [Scrnsave.exe] [Mystify Screen Saver] C:\WINDOWS\system32\ssmyst.scr
=======================================
100 - 安全 - Process: smss.exe [进程为会话管理子系统用以初始化系统变量，ms-dos驱动名称类似lpt1以及com，调用win32壳子系统和运行在windows登陆过程。] - C:\WINDOWS\System32\smss.exe
100 - 安全 - Process: csrss.exe [客户端服务子系统，用以控制windows图形相关子系统。] - C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=base
100 - 安全 - Process: winlogon.exe [windows nt用户登陆程序。] - C:\WINDOWS\system32\winlogon.exe
100 - 安全 - Process: services.exe [用于管理windows服务系统进程。] - C:\WINDOWS\system32\services.exe
100 - 安全 - Process: lsass.exe [本地安全权限服务控制windows安全机制。] - C:\WINDOWS\system32\lsass.exe
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost -k DcomLaunch
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost -k rpcss
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost.exe -k NetworkService
100 - 安全 - Process: explorer.exe [windows program manager或者windows explorer用于控制windows图形shell，包括开始菜单、任务栏，桌面和文件管理。] - C:\WINDOWS\Explorer.EXE
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\System32\svchost.exe -k netsvcs
100 - 安全 - Process: spoolsv.exe [windows打印任务控制程序，用以打印机就绪。] - C:\WINDOWS\system32\spoolsv.exe
100 - 安全 - Process: 360tray.exe [360安全卫士实时监控程序。] - C:\Program Files\360safe\safemon\360tray.exe
100 - 安全 - Process: avp.exe [卡巴斯基杀毒软件相关程序。] -
100 - 安全 - Process: alg.exe [这是一个应用层网关服务用于网络共享。] - C:\WINDOWS\System32\alg.exe
100 - 安全 - Process: ctfmon.exe [office xp输入法图标。] - C:\WINDOWS\system32\ctfmon.exe
100 - 安全 - Process: daemon.exe [一款虚拟光驱软件。] - C:\Program Files\DAEMON Tools\daemon.exe
100 - 安全 - Process: avp.exe [卡巴斯基杀毒软件相关程序。] -
100 - 安全 - Process: imapi.exe [imapi cd-burning com service 用 image mastering applications programming interface (imapi) 管理 cd 录制。] - C:\WINDOWS\system32\imapi.exe
100 - 安全 - Process: sqlservr.exe [microsoft sql server用于架设sql服务。] - C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
100 - 安全 - Process: ServerNT.exe [一款财务管理软件相关程序。] - C:\WINDOWS\system32\ServerNT.exe
100 - 安全 - Process: Thunder5.exe [迅雷5，支持多资源超线程技术的下载工具] - C:\Program Files\Thunder Network\Thunder\Program\Thunder5.exe
100 - 安全 - Process: 360Safe.exe [360安全卫士相关程序。] - C:\Program Files\360safe\360safe.exe
R1 - 安全 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\system32\blank.htm
R1 - 安全 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\system32\blank.htm
O4 - 安全 - HKLM\..\Run: [360Safetray] [360safe实时保护功能模块。] C:\Program Files\360safe\safemon\360tray.exe
O4 - 安全 - HKLM\..\Run: [AVP] [卡巴斯基杀毒软件相关程序。] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - 安全 - HKCU\..\Run: [ctfmon.exe] [office xp输入法图标。] C:\WINDOWS\system32\ctfmon.exe
O4 - 安全 - HKCU\..\Run: [DAEMON Tools] [一款虚拟光驱工具。] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 2052
O8 - 安全 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - 安全 - Extra button: 卡巴斯基Web反病毒保护插件(HKLM) - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - 安全 - Extra button: Windows Messenger(HKLM) - C:\Program Files\Messenger\msmsgs.exe
O18 - 安全 - Protocol: OFFICE 相关 - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
O18 - 安全 - Protocol: OFFICE 相关 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
O23 - 安全 - Service: AVP [卡巴斯基杀毒软件相关程序。] - "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r - (running)
O23 - 安全 - Service: MSSQLServerADHelper [Mssqlserveradhelper 服务。] - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe - (not running)
=======================================
O31 - 未知 - Notify: igfxcui - C:\WINDOWS\system32\igfxsrvc.dll - Intel Corporation - igfxsrvc Module - 3.0.0.3751 - 335872 - 77b0dd12d2c2198e02ea43c807acf628
O31 - 未知 - Notify: klogon - C:\WINDOWS\system32\klogon.dll - Kaspersky Lab - Logon Visualizer - 6.0.2.621 - 200768 - 2fb94ab158eb54a2212c8087b7e72340
O31 - 未知 - SODL: {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - 未知 - SODL: {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll - Microsoft Corporation - Systray shell service object - 5.1.2600.2180 - 106496 - 49927372818d15cedeb466125b3c6bb9
O31 - 未知 - SEApproved: {176d6597-26d3-11d1-b350-080036a75b03} - C:\WINDOWS\system32\icmui.dll - Microsoft Corporation - Microsoft Color Matching System User Interface DLL - 5.1.2600.0 - 77312 - 57f2a25ac11fc58379354b472a33a6f2
O31 - 未知 - SEApproved: {41E300E0-78B6-11ce-849B-444553540000} - C:\WINDOWS\system32\themeui.dll - Microsoft Corporation - Windows Theme API - 6.0.2900.2180 - 375296 - 51bb979a160f98bcc9b8000252a8d982
O31 - 未知 - SEApproved: {42071714-76d4-11d1-8b24-00a0c9068ff3} - deskpan.dll - - - - 0 -
O31 - 未知 - SEApproved: {5DB2625A-54DF-11D0-B6C4-0800091AA605} - C:\WINDOWS\System32\icmui.dll - Microsoft Corporation - Microsoft Color Matching System User Interface DLL - 5.1.2600.0 - 77312 - 57f2a25ac11fc58379354b472a33a6f2
O31 - 未知 - SEApproved: {675F097E-4C4D-11D0-B6C1-0800091AA605} - C:\WINDOWS\system32\icmui.dll - Microsoft Corporation - Microsoft Color Matching System User Interface DLL - 5.1.2600.0 - 77312 - 57f2a25ac11fc58379354b472a33a6f2
O31 - 未知 - SEApproved: 无效的CLSID：Shell extensions for file compression - - - - - 0 -
O31 - 未知 - SEApproved: 无效的CLSID：加密上下文菜单 - - - - - 0 -
O31 - 未知 - SEApproved: {85BBD920-42A0-1069-A2E4-08002B30309D} - C:\WINDOWS\system32\syncui.dll - Microsoft Corporation - Windows Briefcase - 5.1.2600.2180 - 204288 - be51f40c779a5635f3c4b5ebdb819586
O31 - 未知 - SEApproved: {BD84B380-8CA2-1069-AB1D-08000948F534} - C:\WINDOWS\system32\fontext.dll - Microsoft Corporation - Windows Font Folder - 5.1.2600.2180 - 395776 - 8b6723513c8f3375507a6708fd3dba8a
O31 - 未知 - SEApproved: {DBCE2480-C732-101B-BE72-BA78E9AD5B27} - C:\WINDOWS\system32\icmui.dll - Microsoft Corporation - Microsoft Color Matching System User Interface DLL - 5.1.2600.0 - 77312 - 57f2a25ac11fc58379354b472a33a6f2
O31 - 未知 - SEApproved: {7007ACC7-3202-11D1-AAD2-00805FC1270E} - C:\WINDOWS\system32\NETSHELL.dll - Microsoft Corporation - Network Connections Shell - 5.1.2600.2180 - 2137088 -
O31 - 未知 - SEApproved: {992CFFA0-F557-101A-88EC-00DD010CCC48} - C:\WINDOWS\system32\NETSHELL.dll - Microsoft Corporation - Network Connections Shell - 5.1.2600.2180 - 2137088 -
O31 - 未知 - SEApproved: {E211B736-43FD-11D1-9EFB-0000F8757FCD} - C:\WINDOWS\system32\wiashext.dll - Microsoft Corporation - Imaging Devices Shell Folder UI - 5.1.2600.2180 - 751616 - 7169bd54b50911a6ce9fccaa29357ebe
O31 - 未知 - SEApproved: {FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD} - C:\WINDOWS\system32\wiashext.dll - Microsoft Corporation - Imaging Devices Shell Folder UI - 5.1.2600.2180 - 751616 - 7169bd54b50911a6ce9fccaa29357ebe
O31 - 未知 - SEApproved: {905667aa-acd6-11d2-8080-00805f6596d2} - C:\WINDOWS\system32\wiashext.dll - Microsoft Corporation - Imaging Devices Shell Folder UI - 5.1.2600.2180 - 751616 - 7169bd54b50911a6ce9fccaa29357ebe
O31 - 未知 - SEApproved: {3F953603-1008-4f6e-A73A-04AAC7A992F1} - C:\WINDOWS\system32\wiashext.dll - Microsoft Corporation - Imaging Devices Shell Folder UI - 5.1.2600.2180 - 751616 - 7169bd54b50911a6ce9fccaa29357ebe
O31 - 未知 - SEApproved: {83bbcbf3-b28a-4919-a5aa-73027445d672} - C:\WINDOWS\system32\wiashext.dll - Microsoft Corporation - Imaging Devices Shell Folder UI - 5.1.2600.2180 - 751616 - 7169bd54b50911a6ce9fccaa29357ebe
O31 - 未知 - SEApproved: {6C125022-639D-43cc-9F3D-647E6CC69EF1} - C:\WINDOWS\system32\ContextBG.dll - Grigri - Apply a background to the shell context menu - 1.0.0.1 - 368640 - edd37826a42283aa3f25a4c639d689fa
O31 - 未知 - SEApproved: {DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF} - C:\WINDOWS\system32\mstask.dll - Microsoft Corporation - Task Scheduler interface DLL - 5.1.2600.2180 - 316928 - d919668e8d62485c9834d28691761505
O31 - 未知 - SEApproved: {797F1E90-9EDD-11cf-8D8E-00AA0060F5BF} - C:\WINDOWS\system32\mstask.dll - Microsoft Corporation - Task Scheduler interface DLL - 5.1.2600.2180 - 316928 - d919668e8d62485c9834d28691761505
O31 - 未知 - SEApproved: {D6277990-4C6A-11CF-8D87-00AA0060F5BF} - C:\WINDOWS\system32\mstask.dll - Microsoft Corporation - Task Scheduler interface DLL - 5.1.2600.2180 - 316928 - d919668e8d62485c9834d28691761505
O31 - 未知 - SEApproved: {5F327514-6C5E-4d60-8F16-D07FA08A78ED} - C:\WINDOWS\system32\wuaucpl.cpl - Microsoft Corporation - Automatic Updates Control Panel - 5.8.0.2469 - 189208 - 734ee38f5eae72e48175a6976319d46d
O31 - 未知 - SEApproved: {0DF44EAA-FF21-4412-828E-260A8728E7F1} - - - - - 0 -
O31 - 未知 - SEApproved: {9E56BE60-C50F-11CF-9A2C-00A0C90A90CE} - C:\WINDOWS\system32\sendmail.dll - Microsoft Corporation - Send Mail - 6.0.2900.2180 - 58880 - 5d6e81555a9906ef7469d5d7a35e19ad
O31 - 未知 - SEApproved: {9E56BE61-C50F-11CF-9A2C-00A0C90A90CE} - C:\WINDOWS\system32\sendmail.dll - Microsoft Corporation - Send Mail - 6.0.2900.2180 - 58880 - 5d6e81555a9906ef7469d5d7a35e19ad
O31 - 未知 - SEApproved: {88C6C381-2E85-11D0-94DE-444553540000} - C:\WINDOWS\system32\occache.dll - Microsoft Corporation - Object Control Viewer - 6.0.2900.2180 - 122880 - 175736fcd1a6250b459cd2ceb1e71332
O31 - 未知 - SEApproved: {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - 未知 - SEApproved: {ABBE31D0-6DAE-11D0-BECA-00C04FD940BE} - C:\WINDOWS\system32\webcheck.dll - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - 未知 - SEApproved: {F5175861-2688-11d0-9C5E-00AA00A45957} - C:\WINDOWS\system32\webcheck.dll - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - 未知 - SEApproved: {08165EA0-E946-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - 未知 - SEApproved: {E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB} - C:\WINDOWS\system32\webcheck.dll - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - 未知 - SEApproved: {E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7} - C:\WINDOWS\system32\webcheck.dll - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - 未知 - SEApproved: {7D559C10-9FE9-11d0-93F7-00AA0059CE02} - C:\WINDOWS\system32\webcheck.dll - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - 未知 - SEApproved: {E6CC6978-6B6E-11D0-BECA-00C04FD940BE} - C:\WINDOWS\system32\webcheck.dll - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - 未知 - SEApproved: {D8BD2030-6FC9-11D0-864F-00AA006809D9} - C:\WINDOWS\system32\webcheck.dll - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - 未知 - SEApproved: {7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB} - C:\WINDOWS\system32\webcheck.dll - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - 未知 - SEApproved: {352EC2B7-8B9A-11D1-B8AE-006008059382} - C:\WINDOWS\system32\appwiz.cpl - Microsoft Corporation - Shell Application Manager - 5.1.2600.2180 - 593408 - eca487e77c813a65914d51084a591f5d
O31 - 未知 - SEApproved: {0B124F8F-91F0-11D1-B8B5-006008059382} - C:\WINDOWS\system32\appwiz.cpl - Microsoft Corporation - Shell Application Manager - 5.1.2600.2180 - 593408 - eca487e77c813a65914d51084a591f5d
O31 - 未知 - SEApproved: {CFCCC7A0-A282-11D1-9082-006008059382} - C:\WINDOWS\system32\appwiz.cpl - Microsoft Corporation - Shell Application Manager - 5.1.2600.2180 - 593408 - eca487e77c813a65914d51084a591f5d
O31 - 未知 - SEApproved: {e84fda7c-1d6a-45f6-b725-cb260c236066} - C:\WINDOWS\system32\shimgvw.dll - Microsoft Corporation - Windows 图片和传真查看器 - 6.0.2900.2180 - 516096 - 51fb20fd3d0b2edda98a2d1e94b91b9d
O31 - 未知 - SEApproved: {66e4e4fb-f385-4dd0-8d74-a2efd1bc6178} - C:\WINDOWS\system32\shimgvw.dll - Microsoft Corporation - Windows 图片和传真查看器 - 6.0.2900.2180 - 516096 - 51fb20fd3d0b2edda98a2d1e94b91b9d
O31 - 未知 - SEApproved: {00E7B358-F65B-4dcf-83DF-CD026B94BFD4} - - - - - 0 -
O31 - 未知 - SEApproved: {3F30C968-480A-4C6C-862D-EFC0897BB84B} - C:\WINDOWS\system32\shimgvw.dll - Microsoft Corporation - Windows 图片和传真查看器 - 6.0.2900.2180 - 516096 - 51fb20fd3d0b2edda98a2d1e94b91b9d
O31 - 未知 - SEApproved: {9DBD2C50-62AD-11d0-B806-00C04FD706EC} - C:\WINDOWS\system32\shimgvw.dll - Microsoft Corporation - Windows 图片和传真查看器 - 6.0.2900.2180 - 516096 - 51fb20fd3d0b2edda98a2d1e94b91b9d
O31 - 未知 - SEApproved: {EAB841A0-9550-11cf-8C16-00805F1408F3} - C:\WINDOWS\system32\shimgvw.dll - Microsoft Corporation - Windows 图片和传真查看器 - 6.0.2900.2180 - 516096 - 51fb20fd3d0b2edda98a2d1e94b91b9d
O31 - 未知 - SEApproved: {eb9b1153-3b57-4e68-959a-a3266bc3d7fe} - C:\WINDOWS\system32\shimgvw.dll - Microsoft Corporation - Windows 图片和传真查看器 - 6.0.2900.2180 - 516096 - 51fb20fd3d0b2edda98a2d1e94b91b9d
O31 - 未知 - SEApproved: {7A9D77BD-5403-11d2-8785-2E0420524153} - - - - - 0 -
O31 - 未知 - SEApproved: {E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31} - C:\WINDOWS\system32\zipfldr.dll - Microsoft Corporation - Compressed (zipped) Folders - 6.0.2900.2180 - 465408 - 08fa93556c2dcd998378f00b0ce39d2e
O31 - 未知 - SEApproved: {BD472F60-27FA-11cf-B8B4-444553540000} - C:\WINDOWS\system32\zipfldr.dll - Microsoft Corporation - Compressed (zipped) Folders - 6.0.2900.2180 - 465408 - 08fa93556c2dcd998378f00b0ce39d2e
O31 - 未知 - SEApproved: {888DCA60-FC0A-11CF-8F0F-00C04FD7D062} - C:\WINDOWS\system32\zipfldr.dll - Microsoft Corporation - Compressed (zipped) Folders - 6.0.2900.2180 - 465408 - 08fa93556c2dcd998378f00b0ce39d2e
O31 - 未知 - SEApproved: {ECF03A33-103D-11d2-854D-006008059367} - C:\WINDOWS\system32\mydocs.dll - Microsoft Corporation - My Documents Folder UI - 6.0.2900.2180 - 91136 - df133fd2fe0e38a48b626c8863022933
O31 - 未知 - SEApproved: {ECF03A32-103D-11d2-854D-006008059367} - C:\WINDOWS\system32\mydocs.dll - Microsoft Corporation - My Documents Folder UI - 6.0.2900.2180 - 91136 - df133fd2fe0e38a48b626c8863022933
O31 - 未知 - SEApproved: {4a7ded0a-ad25-11d0-98a8-0800361b1103} - C:\WINDOWS\system32\mydocs.dll - Microsoft Corporation - My Documents Folder UI - 6.0.2900.2180 - 91136 - df133fd2fe0e38a48b626c8863022933
O31 - 未知 - SEApproved: {60fd46de-f830-4894-a628-6fa81bc0190d} - C:\WINDOWS\system32\photowiz.dll - Microsoft Corporation - Photo Printing Wizard - 5.1.2600.2180 - 166912 - 6842512cb971d848ea3aba5cca9a36ed
O31 - 未知 - SEApproved: {0CD7A5C0-9F37-11CE-AE65-08002B2E1262} - C:\WINDOWS\system32\cabview.dll - Microsoft Corporation - Cabinet File Viewer Shell Extension - 6.0.2900.2180 - 90624 - ef283188c701c8bfcc5187f3b2c547b2
O31 - 未知 - SEApproved: {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} - C:\Program Files\Real\RealPlayer\rpshell.dll - RealNetworks, Inc. - RealPlayer Shell Extensions - 1.0.1.1946 - 49198 - 68718fbfe1513aaeed9bf319d912bb47
O31 - 未知 - SEApproved: {B41DB860-8EE4-11D2-9906-E49FADC173CA} - C:\Program Files\WinRAR\rarext.dll - - - - 128512 - 2b7421a2351fbfa6e29141c46aea6b57
O31 - 未知 - SEApproved: {63542C48-9552-494A-84F7-73AA6A7C99C1} - C:\Program Files\WPS Office StormBeta 1.0\program\shlxthdl.dll - - - 1.0.0.0 - 274507 - 85fed1579e83bea2169b7997a3a4a146
O31 - 未知 - SEApproved: {e82a2d71-5b2f-43a0-97b8-81be15854de8} - C:\WINDOWS\system32\dfshim.dll - Microsoft Corporation - Application Deployment Support Library - 2.0.50727.42 - 83456 - b3511383c8be3a8c5b88a78971fc1141
O31 - 未知 - SEApproved: {E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} - C:\WINDOWS\system32\dfshim.dll - Microsoft Corporation - Application Deployment Support Library - 2.0.50727.42 - 83456 - b3511383c8be3a8c5b88a78971fc1141
O31 - 未知 - Directory Menu: {B41DB860-8EE4-11D2-9906-E49FADC173CA} - C:\Program Files\WinRAR\rarext.dll - - - - 128512 - 2b7421a2351fbfa6e29141c46aea6b57
O31 - 未知 - LSA: Security Packages - sv1_0.dll - - - - 0 -
O31 - 未知 - LSA: Security Packages - channel.dll - - - - 0 -
=======================================
O40 - winlogon.exe - Kaspersky Lab - C:\WINDOWS\system32\klogon.dll - Logon Visualizer - 2fb94ab158eb54a2212c8087b7e72340
O40 - Explorer.EXE - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scrchpg.dll - Script Checker - 632a777961e99cb61b28599555a2f7a7
O40 - Explorer.EXE - Grigri - C:\WINDOWS\system32\ContextBG.dll - Apply a background to the shell context menu - edd37826a42283aa3f25a4c639d689fa
O40 - Explorer.EXE - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\ShellEx.dll - Windows Shell Extension - 0904502f01d0d2a42082f0f35b18071c
O40 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\MSVCR80.dll - Microsoft? C Runtime Library - 16d7ddf3b659f7cf1cb9f4dcff4219f0
O40 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\MSVCP80.dll - Microsoft? C++ Runtime Library - 2bc650257fb0867abd54fd460ec2bafc
O40 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\system32\sendmail.dll - Send Mail - 5d6e81555a9906ef7469d5d7a35e19ad
O40 - Explorer.EXE - Intel Corporation - C:\WINDOWS\system32\igfxres.dll - xxxxres Module - 81e6a8e02cc31e547e3eab082b1dd544
O40 - Explorer.EXE - Intel Corporation - C:\WINDOWS\system32\igfxdev.dll - igfxdev Module - eccf988ebf3ade5792915e60c3d274dc
O40 - Explorer.EXE - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\klscav.dll - Script Checker AV Plugin - d7e7992479709ff02a33669e5dacf878
O40 - Explorer.EXE - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prremote.dll - PR_REMOTE - 20be3997fe3f091a3b0d634fb9d62259
O40 - Explorer.EXE - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll - Prague Loader - 22217717571205531e517b62a54fd861
O40 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\system32\dfshim.dll - Application Deployment Support Library - b3511383c8be3a8c5b88a78971fc1141
O40 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\system32\mscoree.dll - Microsoft .NET Runtime Execution Engine - 34bc771730448718ab771255888c783d
O40 - Explorer.EXE - - C:\Program Files\Thunder Network\Thunder\Components\ResWorker\DsBho_01.dll - DsBho - e2611893ee8a1d5118149a15ee6c9669
O40 - Explorer.EXE - Thunder Networking Technologies,LTD - C:\Program Files\Thunder Network\Thunder\Components\ResWorker\DataProcessor_01.dll - DataProcessor - 7bfb3e14c7b181b47528f57855eaedc5
O40 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\system32\mstask.dll - Task Scheduler interface DLL - d919668e8d62485c9834d28691761505
O40 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Shfusion.dll - Microsoft COM Runtime Fusion Assembly Viewer - 5b746df7ff55229630fe2815b348149c
O40 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Fusion.dll - Assembly manager - ad23bb6b329c7d5ee8a43b89e2fd4fd2
O40 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\culture.dll - Microsoft Globalization Support - ad060608376e3195b4545928f43653d8
O40 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ShFusRes.dll - Microsoft COM Runtime Fusion Assembly Viewer Resources - bffb11607d65a61461ba73d9b85a62cd
=======================================
O41 - ALCXSENS - Sensaura WDM 3D Audio Driver - C:\WINDOWS\system32\drivers\ALCXSENS.SYS - (running) - Sensaura WDM 3D Audio Driver - Sensaura Ltd - a9355a51698f6901b362ef738b15631d
O41 - Apaidi - Apaidi - C:\WINDOWS\system32\drivers\Apaidi.sys - (running) - - - f60f0a380c6cf97dc05c7d01adb2c217
O41 - Eudemon - Eudemon - C:\WINDOWS\system32\drivers\Eudemon.sys - (running) - Eudemon - EUDEMON Computer Consultants Ltd - da9d1642dd9946736f11056632d71145
O41 - IdeBusDr - Intel Application Accelerator Driver - C:\WINDOWS\system32\drivers\IdeBusDr.sys - (running) - Intel Application Accelerator Driver - Intel Corporation - 791f0829de88dd0ca77192f0dfad03b6
O41 - IdeChnDr - Intel Application Accelerator Driver - C:\WINDOWS\system32\drivers\IdeChnDr.sys - (running) - Intel Application Accelerator Driver - Intel Corporation - 7d2b8be9e89628663c1fb571f7c34062
O41 - klif - spuper-ptor - C:\WINDOWS\system32\drivers\klif.sys - (running) - spuper-ptor - Kaspersky Lab - 1b28fa1580438192a14e88b5834397ca
O41 - QKeyService - KeyCrypt Device Driver - C:\WINDOWS\system32\KeyCrypt.sys - (running) - KeyCrypt Device Driver - Tencent Technology (Shenzhen) Company Limited - 184c25ef0595c06c8a3f3c2fd584d891
O41 - Sentinel - Sentinel - C:\WINDOWS\system32\drivers\SENTINEL.SYS - (running) - - - 99c81af18c0bf4d3b2ce0b36941e150f
O41 - sptd - sptd - C:\WINDOWS\system32\drivers\sptd.sys - (running) - - -
O41 - ATSpy - ATSpy - C:\WINDOWS\system32\ATSpy.sys - (not running) - - -
O41 - npkcrypt - npkcrypt - C:\WINDOWS\system32\npkcrypt.sys - (not running) - - -
O41 - npkycryp - npkycryp - C:\WINDOWS\system32\npkycryp.sys - (not running) - - -
O41 - TSP - spuper-ptor - C:\WINDOWS\system32\drivers\klif.sys - (not running) - spuper-ptor - Kaspersky Lab - 1b28fa1580438192a14e88b5834397ca
=======================================
360Safe.exe=3.5.2.1001
AntiAdwa.dll=3.5.1.1001
AntiEng.dll=3.5.1.1001
AntiActi.dll=2.0.0.3000
CleanHis.dll=3.0.2.1000
live.dll=1.0.1.1016
=======================================
操作历史报告：
----------清理恶评及系统插件历史----------
2007-06-21 11:01
清理恶评软件 - WinDHCPsvc - C:\WINDOWS\system32\windhcp.ocx
清理恶评软件 - msccrt - C:\WINDOWS\system32\msccrt.dll
清理恶评软件 - msdebug木马 - C:\WINDOWS\system32\msdebug.dll
清理恶评软件 - Gjzo0.dll - C:\DOCUME~1\张建国\LOCALS~1\Temp\Gjzo0.dll
清理恶评软件 - winform - C:\WINDOWS\system32\winform.dll
清理恶评软件 - upxdnd木马 - C:\WINDOWS\system32\upxdnd.dll
清理恶评软件 - 天龙八部盗号木马 - C:\WINDOWS\system32\AVPSrv.dll
清理恶评软件 - Kvsc3 - C:\WINDOWS\Kvsc3.exe
清理恶评软件 - c0nime.exe - C:\DOCUME~1\张建国\LOCALS~1\Temp\c0nime.exe
清理恶评软件 - 大话西游盗号木马 - C:\WINDOWS\system32\nwizdh.exe
清理恶评软件 - 问道游戏盗号木马 - C:\DOCUME~1\张建国\LOCALS~1\Temp\IEXPLO~1.EXE
清理恶评软件 - 未知自动运行程序(Autorun) - C:\autorun.inf
2007-06-21 11:03
清理恶评软件 - WinDHCPsvc -
清理恶评软件 - msccrt -
清理恶评软件 - upxdnd木马 -
清理恶评软件 - winform -
清理恶评软件 - Gjzo0.dll -
清理恶评软件 - Kvsc3 -
清理恶评软件 - 天龙八部盗号木马 -
清理恶评软件 - 问道游戏盗号木马 -
清理恶评软件 - msdebug木马 -
2007-06-21 14:18
清理恶评软件 - 未知自动运行程序(Autorun) - C:\autorun.inf
2007-06-21 15:59
清理恶评软件 - 超级旋风下载组件 -
清理恶评软件 - 中文搜搜 -
2007-07-05 16:21
清理恶评软件 - etcetera toolbar - C:\Program Files\VVSN
2007-06-21 11:53
插件管理 - 番茄吧工具条 - C:\WINDOWS\system32\HOTUNIST.EXE
插件管理 - 快车(FlashGet) -
2007-06-21 15:56
插件管理 - 中文搜搜 - C:\PROGRA~1\TENCENT\SSPlus\SAddr.dll
插件管理 - 超级旋风下载组件 - E:\张学友~1\other\腾讯QQ~1.6\QQDOWN~1\QQIEHE~1.DLL
2007-06-21 15:56
插件管理 - 中文搜搜 - C:\WINDOWS\system32\scrax.dll
2007-06-21 15:56
插件管理 - 超级旋风下载组件 - E:\张学友~1\other\腾讯QQ~1.6\QQDOWN~1\QQIEHE~1.DLL
2007-06-25 15:30
插件管理 - 超级旋风下载组件 -
2007-07-05 16:25
清理好评插件 - POCO在线杂志播放插件 - C:\Program Files\PocoZinePlayer
----------全面诊断修复历史----------
2007-06-21 11:54
O9 - 未知 - 番茄花园 - http://www.tomatolei.com
O9 - 未知 - 信息检索 - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
2007-06-25 15:31
100 - 未知 - Rar.exe - C:\Program Files\WinRAR\Rar.exe
2007-07-05 16:40
100 - 未知 - msd.exe - C:\WINDOWS\system32\msd.exe
O4 - 未知 - Microsoft Value Service - msd.exe
O4 - 未知 - Microsoft Windows - windows1.exe
O4 - 未知 - Microsoft Value Service - msd.exe
O4 - 未知 - Microsoft Value Service - msd.exe
O30 - 未知 - Scrnsave.exe - C:\WINDOWS\system32\ssmyst.scr
O23 - 未知 - EnGenius Network Analysis Tool - "C:\WINDOWS\system32\dllcache\winegne.exe"
2007-07-06 15:56
100 - 未知 - msd.exe - C:\WINDOWS\system32\msd.exe
100 - 未知 - cmd.exe - 毀
100 - 未知 - taskmgr.exe - 毀
2007-07-06 15:57
100 - 未知 - taskmgr.exe - 毀
O4 - 未知 - Microsoft Value Service - msd.exe
O4 - 未知 - Microsoft Value Service - msd.exe
2007-07-08 09:39
100 - 未知 - taskmrg.exe - C:\WINDOWS\system32\taskmrg.exe
2007-07-08 09:40
O4 - 未知 - Microsoft Value Service - taskmrg.exe
2007-07-08 09:40
O4 - 未知 - Microsoft Value Service - taskmrg.exe
2007-07-08 09:40
O23 - 未知 - EnGenius Network Analysis Tool - "C:\WINDOWS\system32\dllcache\winegne.exe"
2007-07-08 12:46
O4 - 未知 - Microsoft Value Service - msd.exe
2007-07-08 12:46
O23 - 未知 - EnGenius Network Analysis Tool - "C:\WINDOWS\system32\dllcache\winegne.exe"
O23 - 未知 - MSSQLSERVER - C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe -sMSSQLSERVER
O23 - 安全 - MSSQLServerADHelper - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe
O23 - 未知 - SQLSERVERAGENT - C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlagent.EXE -i MSSQLSERVER
O23 - 未知 - TongBackupSrv - C:\WINDOWS\system32\TongBackupSrv.exe
O23 - 未知 - UFNet - C:\WINDOWS\system32\ServerNT.exe
2007-07-08 12:46
100 - 未知 - TongBackupSrv.exe - C:\WINDOWS\system32\TongBackupSrv.exe
2007-07-08 12:46
100 - 安全 - ftp.exe - C:\WINDOWS\system32\ftp.exe
2007-07-08 12:47
O23 - 未知 - EnGenius Network Analysis Tool - "C:\WINDOWS\system32\dllcache\winegne.exe"
O23 - 未知 - MSSQLSERVER - C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe -sMSSQLSERVER
O23 - 安全 - MSSQLServerADHelper - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe
O23 - 未知 - SQLSERVERAGENT - C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlagent.EXE -i MSSQLSERVER
O23 - 未知 - TongBackupSrv - C:\WINDOWS\system32\TongBackupSrv.exe
O23 - 未知 - UFNet - C:\WINDOWS\system32\ServerNT.exe
2007-07-09 09:06
100 - 未知 - TongBackupSrv.exe - C:\WINDOWS\system32\TongBackupSrv.exe
100 - 未知 - msd.exe - C:\WINDOWS\system32\msd.exe
O4 - 未知 - Microsoft Value Service - msd.exe
O4 - 未知 - Microsoft Value Service - msd.exe
O4 - 未知 - ApabiAgent - "C:\Program Files\Founder\Apabi Reader 3.0\ApabiAgent.exe"
O30 - 未知 - Scrnsave.exe - C:\WINDOWS\system32\ssmyst.scr
O23 - 未知 - EnGenius Network Analysis Tool - "C:\WINDOWS\system32\dllcache\winegne.exe"
O23 - 未知 - MSSQLSERVER - C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe -sMSSQLSERVER
O23 - 未知 - SQLSERVERAGENT - C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlagent.EXE -i MSSQLSERVER
O23 - 未知 - TongBackupSrv - C:\WINDOWS\system32\TongBackupSrv.exe
O23 - 未知 - UFNet - C:\WINDOWS\system32\ServerNT.exe
2007-07-09 16:51
100 - 未知 - TongBackupSrv.exe - C:\WINDOWS\system32\TongBackupSrv.exe
100 - 未知 - svcUpdate.exe - C:\WINDOWS\system32\svcUpdate.exe
100 - 未知 - msd.exe - C:\WINDOWS\system32\msd.exe
O4 - 未知 - Microsoft Value Service - msd.exe
O4 - 未知 - Microsoft - svcUpdate.exe
O4 - 未知 - Microsoft Value Service - msd.exe
O30 - 未知 - Scrnsave.exe - C:\WINDOWS\system32\ssmyst.scr
O23 - 未知 - EnGenius Network Analysis Tool - "C:\WINDOWS\system32\dllcache\winegne.exe"
O23 - 未知 - MSSQLSERVER - C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe -sMSSQLSERVER
O23 - 未知 - SQLSERVERAGENT - C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlagent.EXE -i MSSQLSERVER
O23 - 未知 - TongBackupSrv - C:\WINDOWS\system32\TongBackupSrv.exe
O23 - 未知 - UFNet - C:\WINDOWS\system32\ServerNT.exe
----------修复IE浏览器操作历史----------
2007-06-21 11:04
R0 - 危险 - IE首页 - HKCU\Software\Microsoft\Internet Explorer\Main
R1 - 危险 - IE左侧搜索页 - HKLM\Software\Microsoft\Internet Explorer\Main
2007-07-05 16:44
R0 - 危险 - IE首页 - HKCU\Software\Microsoft\Internet Explorer\Main
这是什么病毒或恶意软件,文件名为msd.exe,卡巴斯基或360不能认定它是病毒或木马?
帖子标题:
这是什么病毒或恶意软件,文件名为msd.exe,卡巴斯基或360不能认定它是病毒或木马?
帖子内容:
现象:
历史操作:从网上下载了一些屏保软件装上了就这样了,用瑞星或江民都检测不出病毒,其不定时运行,修改注册表RUN项自动运行,修改HOST文件,使一些反病毒网站指向127.0.0.1,自动关闭任务管理器,不停向网络传输数据(adsl2m可以达到上传10几K以上
备注: 改为自动运行,修改HOST文件,自动关闭任务管理器,不停向网络传输数据(adsl2m可以达到上传10几K以上
我的诊断报告:
各位高手：
非常感谢您留心我这份系统诊断报告，小菜鸟十万火急等待您的帮助！
该诊断报告由360安全卫士提供 http://www.360safe.com
诊断时间: 2007-07-10 09:48:15
诊断平台: Microsoft Windows XP Service Pack 2
IE版本: Internet Explorer V6.0.2900.2180 Build:62900.2180
计算机物理内存:247.48MB - 当前可用内存:48.98MB
100 - 未知 - Process: TongBackupSrv.exe [] - C:\WINDOWS\system32\TongBackupSrv.exe
O2 - 未知 - BHO: (ThunderAtOnce Class) - [迅雷浏览器高级特性支持模块] - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll
O2 - 未知 - BHO: (Thunder Browser Helper) - [XunLeiBHO] - {80BF4636-D65B-43F3-BB60-C5DD3D5FB7B9} - C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll
O8 - 未知 - Extra context menu item: 使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\geturl.htm
O8 - 未知 - Extra context menu item: 使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\getallurl.htm
O8 - 未知 - Extra context menu item: 添加到QQ表情 - c:\腾讯QQ 2007 Beta1 V1.6\AddEmotion.htm
O9 - 未知 - Extra button: 启动迅雷5(HKLM) - C:\Program Files\Thunder Network\Thunder\Thunder.exe
O15 - 未知 - Trusted Zone: easyabc.95599.cn
O15 - 未知 - Trusted Zone: www.95599.cn
O16 - 未知 - DPF: {E847C78C-C210-4195-8799-FBF3BF89797D} (金山毒霸在线产品升级) - http://scan.www.duba.net/duba/download/install/onlinescan/KOSInit.cab
O23 - 未知 - Service: EnGenius Network Analysis Tool [EnGenius Network TCP analysis tool.] - "C:\WINDOWS\system32\dllcache\winegne.exe" - (not running)
O23 - 未知 - Service: MSSQLSERVER [MSSQLSERVER] - C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe -sMSSQLSERVER - (running)
O23 - 未知 - Service: SQLSERVERAGENT [SQLSERVERAGENT] - C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlagent.EXE -i MSSQLSERVER - (not running)
O23 - 未知 - Service: TongBackupSrv [Tong备份服务] - C:\WINDOWS\system32\TongBackupSrv.exe - (running)
O23 - 未知 - Service: UFNet [用友通] - C:\WINDOWS\system32\ServerNT.exe - (running)
O30 - 未知 - HKCU\..\Desktop: [Scrnsave.exe] [Mystify Screen Saver] C:\WINDOWS\system32\ssmyst.scr
=======================================
100 - 安全 - Process: smss.exe [进程为会话管理子系统用以初始化系统变量，ms-dos驱动名称类似lpt1以及com，调用win32壳子系统和运行在windows登陆过程。] - C:\WINDOWS\System32\smss.exe
100 - 安全 - Process: csrss.exe [客户端服务子系统，用以控制windows图形相关子系统。] - C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=base
100 - 安全 - Process: winlogon.exe [windows nt用户登陆程序。] - C:\WINDOWS\system32\winlogon.exe
100 - 安全 - Process: services.exe [用于管理windows服务系统进程。] - C:\WINDOWS\system32\services.exe
100 - 安全 - Process: lsass.exe [本地安全权限服务控制windows安全机制。] - C:\WINDOWS\system32\lsass.exe
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost -k DcomLaunch
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost -k rpcss
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost.exe -k NetworkService
100 - 安全 - Process: explorer.exe [windows program manager或者windows explorer用于控制windows图形shell，包括开始菜单、任务栏，桌面和文件管理。] - C:\WINDOWS\Explorer.EXE
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\System32\svchost.exe -k netsvcs
100 - 安全 - Process: spoolsv.exe [windows打印任务控制程序，用以打印机就绪。] - C:\WINDOWS\system32\spoolsv.exe
100 - 安全 - Process: 360tray.exe [360安全卫士实时监控程序。] - C:\Program Files\360safe\safemon\360tray.exe
100 - 安全 - Process: avp.exe [卡巴斯基杀毒软件相关程序。] -
100 - 安全 - Process: alg.exe [这是一个应用层网关服务用于网络共享。] - C:\WINDOWS\System32\alg.exe
100 - 安全 - Process: ctfmon.exe [office xp输入法图标。] - C:\WINDOWS\system32\ctfmon.exe
100 - 安全 - Process: daemon.exe [一款虚拟光驱软件。] - C:\Program Files\DAEMON Tools\daemon.exe
100 - 安全 - Process: avp.exe [卡巴斯基杀毒软件相关程序。] -
100 - 安全 - Process: imapi.exe [imapi cd-burning com service 用 image mastering applications programming interface (imapi) 管理 cd 录制。] - C:\WINDOWS\system32\imapi.exe
100 - 安全 - Process: sqlservr.exe [microsoft sql server用于架设sql服务。] - C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
100 - 安全 - Process: ServerNT.exe [一款财务管理软件相关程序。] - C:\WINDOWS\system32\ServerNT.exe
100 - 安全 - Process: Thunder5.exe [迅雷5，支持多资源超线程技术的下载工具] - C:\Program Files\Thunder Network\Thunder\Program\Thunder5.exe
100 - 安全 - Process: 360Safe.exe [360安全卫士相关程序。] - C:\Program Files\360safe\360safe.exe
R1 - 安全 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\system32\blank.htm
R1 - 安全 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\system32\blank.htm
O4 - 安全 - HKLM\..\Run: [360Safetray] [360safe实时保护功能模块。] C:\Program Files\360safe\safemon\360tray.exe
O4 - 安全 - HKLM\..\Run: [AVP] [卡巴斯基杀毒软件相关程序。] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - 安全 - HKCU\..\Run: [ctfmon.exe] [office xp输入法图标。] C:\WINDOWS\system32\ctfmon.exe
O4 - 安全 - HKCU\..\Run: [DAEMON Tools] [一款虚拟光驱工具。] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 2052
O8 - 安全 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - 安全 - Extra button: 卡巴斯基Web反病毒保护插件(HKLM) - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - 安全 - Extra button: Windows Messenger(HKLM) - C:\Program Files\Messenger\msmsgs.exe
O18 - 安全 - Protocol: OFFICE 相关 - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
O18 - 安全 - Protocol: OFFICE 相关 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
O23 - 安全 - Service: AVP [卡巴斯基杀毒软件相关程序。] - "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r - (running)
O23 - 安全 - Service: MSSQLServerADHelper [Mssqlserveradhelper 服务。] - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe - (not running)
=======================================
O31 - 未知 - Notify: igfxcui - C:\WINDOWS\system32\igfxsrvc.dll - Intel Corporation - igfxsrvc Module - 3.0.0.3751 - 335872 - 77b0dd12d2c2198e02ea43c807acf628
O31 - 未知 - Notify: klogon - C:\WINDOWS\system32\klogon.dll - Kaspersky Lab - Logon Visualizer - 6.0.2.621 - 200768 - 2fb94ab158eb54a2212c8087b7e72340
O31 - 未知 - SODL: {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - 未知 - SODL: {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll - Microsoft Corporation - Systray shell service object - 5.1.2600.2180 - 106496 - 49927372818d15cedeb466125b3c6bb9
O31 - 未知 - SEApproved: {176d6597-26d3-11d1-b350-080036a75b03} - C:\WINDOWS\system32\icmui.dll - Microsoft Corporation - Microsoft Color Matching System User Interface DLL - 5.1.2600.0 - 77312 - 57f2a25ac11fc58379354b472a33a6f2
O31 - 未知 - SEApproved: {41E300E0-78B6-11ce-849B-444553540000} - C:\WINDOWS\system32\themeui.dll - Microsoft Corporation - Windows Theme API - 6.0.2900.2180 - 375296 - 51bb979a160f98bcc9b8000252a8d982
O31 - 未知 - SEApproved: {42071714-76d4-11d1-8b24-00a0c9068ff3} - deskpan.dll - - - - 0 -
O31 - 未知 - SEApproved: {5DB2625A-54DF-11D0-B6C4-0800091AA605} - C:\WINDOWS\System32\icmui.dll - Microsoft Corporation - Microsoft Color Matching System User Interface DLL - 5.1.2600.0 - 77312 - 57f2a25ac11fc58379354b472a33a6f2
O31 - 未知 - SEApproved: {675F097E-4C4D-11D0-B6C1-0800091AA605} - C:\WINDOWS\system32\icmui.dll - Microsoft Corporation - Microsoft Color Matching System User Interface DLL - 5.1.2600.0 - 77312 - 57f2a25ac11fc58379354b472a33a6f2
O31 - 未知 - SEApproved: 无效的CLSID：Shell extensions for file compression - - - - - 0 -
O31 - 未知 - SEApproved: 无效的CLSID：加密上下文菜单 - - - - - 0 -
O31 - 未知 - SEApproved: {85BBD920-42A0-1069-A2E4-08002B30309D} - C:\WINDOWS\system32\syncui.dll - Microsoft Corporation - Windows Briefcase - 5.1.2600.2180 - 204288 - be51f40c779a5635f3c4b5ebdb819586
O31 - 未知 - SEApproved: {BD84B380-8CA2-1069-AB1D-08000948F534} - C:\WINDOWS\system32\fontext.dll - Microsoft Corporation - Windows Font Folder - 5.1.2600.2180 - 395776 - 8b6723513c8f3375507a6708fd3dba8a
O31 - 未知 - SEApproved: {DBCE2480-C732-101B-BE72-BA78E9AD5B27} - C:\WINDOWS\system32\icmui.dll - Microsoft Corporation - Microsoft Color Matching System User Interface DLL - 5.1.2600.0 - 77312 - 57f2a25ac11fc58379354b472a33a6f2
O31 - 未知 - SEApproved: {7007ACC7-3202-11D1-AAD2-00805FC1270E} - C:\WINDOWS\system32\NETSHELL.dll - Microsoft Corporation - Network Connections Shell - 5.1.2600.2180 - 2137088 -
O31 - 未知 - SEApproved: {992CFFA0-F557-101A-88EC-00DD010CCC48} - C:\WINDOWS\system32\NETSHELL.dll - Microsoft Corporation - Network Connections Shell - 5.1.2600.2180 - 2137088 -
O31 - 未知 - SEApproved: {E211B736-43FD-11D1-9EFB-0000F8757FCD} - C:\WINDOWS\system32\wiashext.dll - Microsoft Corporation - Imaging Devices Shell Folder UI - 5.1.2600.2180 - 751616 - 7169bd54b50911a6ce9fccaa29357ebe
O31 - 未知 - SEApproved: {FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD} - C:\WINDOWS\system32\wiashext.dll - Microsoft Corporation - Imaging Devices Shell Folder UI - 5.1.2600.2180 - 751616 - 7169bd54b50911a6ce9fccaa29357ebe
O31 - 未知 - SEApproved: {905667aa-acd6-11d2-8080-00805f6596d2} - C:\WINDOWS\system32\wiashext.dll - Microsoft Corporation - Imaging Devices Shell Folder UI - 5.1.2600.2180 - 751616 - 7169bd54b50911a6ce9fccaa29357ebe
O31 - 未知 - SEApproved: {3F953603-1008-4f6e-A73A-04AAC7A992F1} - C:\WINDOWS\system32\wiashext.dll - Microsoft Corporation - Imaging Devices Shell Folder UI - 5.1.2600.2180 - 751616 - 7169bd54b50911a6ce9fccaa29357ebe
O31 - 未知 - SEApproved: {83bbcbf3-b28a-4919-a5aa-73027445d672} - C:\WINDOWS\system32\wiashext.dll - Microsoft Corporation - Imaging Devices Shell Folder UI - 5.1.2600.2180 - 751616 - 7169bd54b50911a6ce9fccaa29357ebe
O31 - 未知 - SEApproved: {6C125022-639D-43cc-9F3D-647E6CC69EF1} - C:\WINDOWS\system32\ContextBG.dll - Grigri - Apply a background to the shell context menu - 1.0.0.1 - 368640 - edd37826a42283aa3f25a4c639d689fa
O31 - 未知 - SEApproved: {DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF} - C:\WINDOWS\system32\mstask.dll - Microsoft Corporation - Task Scheduler interface DLL - 5.1.2600.2180 - 316928 - d919668e8d62485c9834d28691761505
O31 - 未知 - SEApproved: {797F1E90-9EDD-11cf-8D8E-00AA0060F5BF} - C:\WINDOWS\system32\mstask.dll - Microsoft Corporation - Task Scheduler interface DLL - 5.1.2600.2180 - 316928 - d919668e8d62485c9834d28691761505
O31 - 未知 - SEApproved: {D6277990-4C6A-11CF-8D87-00AA0060F5BF} - C:\WINDOWS\system32\mstask.dll - Microsoft Corporation - Task Scheduler interface DLL - 5.1.2600.2180 - 316928 - d919668e8d62485c9834d28691761505
O31 - 未知 - SEApproved: {5F327514-6C5E-4d60-8F16-D07FA08A78ED} - C:\WINDOWS\system32\wuaucpl.cpl - Microsoft Corporation - Automatic Updates Control Panel - 5.8.0.2469 - 189208 - 734ee38f5eae72e48175a6976319d46d
O31 - 未知 - SEApproved: {0DF44EAA-FF21-4412-828E-260A8728E7F1} - - - - - 0 -
O31 - 未知 - SEApproved: {9E56BE60-C50F-11CF-9A2C-00A0C90A90CE} - C:\WINDOWS\system32\sendmail.dll - Microsoft Corporation - Send Mail - 6.0.2900.2180 - 58880 - 5d6e81555a9906ef7469d5d7a35e19ad
O31 - 未知 - SEApproved: {9E56BE61-C50F-11CF-9A2C-00A0C90A90CE} - C:\WINDOWS\system32\sendmail.dll - Microsoft Corporation - Send Mail - 6.0.2900.2180 - 58880 - 5d6e81555a9906ef7469d5d7a35e19ad
O31 - 未知 - SEApproved: {88C6C381-2E85-11D0-94DE-444553540000} - C:\WINDOWS\system32\occache.dll - Microsoft Corporation - Object Control Viewer - 6.0.2900.2180 - 122880 - 175736fcd1a6250b459cd2ceb1e71332
O31 - 未知 - SEApproved: {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - 未知 - SEApproved: {ABBE31D0-6DAE-11D0-BECA-00C04FD940BE} - C:\WINDOWS\system32\webcheck.dll - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - 未知 - SEApproved: {F5175861-2688-11d0-9C5E-00AA00A45957} - C:\WINDOWS\system32\webcheck.dll - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - 未知 - SEApproved: {08165EA0-E946-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - 未知 - SEApproved: {E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB} - C:\WINDOWS\system32\webcheck.dll - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - 未知 - SEApproved: {E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7} - C:\WINDOWS\system32\webcheck.dll - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - 未知 - SEApproved: {7D559C10-9FE9-11d0-93F7-00AA0059CE02} - C:\WINDOWS\system32\webcheck.dll - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - 未知 - SEApproved: {E6CC6978-6B6E-11D0-BECA-00C04FD940BE} - C:\WINDOWS\system32\webcheck.dll - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - 未知 - SEApproved: {D8BD2030-6FC9-11D0-864F-00AA006809D9} - C:\WINDOWS\system32\webcheck.dll - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - 未知 - SEApproved: {7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB} - C:\WINDOWS\system32\webcheck.dll - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - 未知 - SEApproved: {352EC2B7-8B9A-11D1-B8AE-006008059382} - C:\WINDOWS\system32\appwiz.cpl - Microsoft Corporation - Shell Application Manager - 5.1.2600.2180 - 593408 - eca487e77c813a65914d51084a591f5d
O31 - 未知 - SEApproved: {0B124F8F-91F0-11D1-B8B5-006008059382} - C:\WINDOWS\system32\appwiz.cpl - Microsoft Corporation - Shell Application Manager - 5.1.2600.2180 - 593408 - eca487e77c813a65914d51084a591f5d
O31 - 未知 - SEApproved: {CFCCC7A0-A282-11D1-9082-006008059382} - C:\WINDOWS\system32\appwiz.cpl - Microsoft Corporation - Shell Application Manager - 5.1.2600.2180 - 593408 - eca487e77c813a65914d51084a591f5d
O31 - 未知 - SEApproved: {e84fda7c-1d6a-45f6-b725-cb260c236066} - C:\WINDOWS\system32\shimgvw.dll - Microsoft Corporation - Windows 图片和传真查看器 - 6.0.2900.2180 - 516096 - 51fb20fd3d0b2edda98a2d1e94b91b9d
O31 - 未知 - SEApproved: {66e4e4fb-f385-4dd0-8d74-a2efd1bc6178} - C:\WINDOWS\system32\shimgvw.dll - Microsoft Corporation - Windows 图片和传真查看器 - 6.0.2900.2180 - 516096 - 51fb20fd3d0b2edda98a2d1e94b91b9d
O31 - 未知 - SEApproved: {00E7B358-F65B-4dcf-83DF-CD026B94BFD4} - - - - - 0 -
O31 - 未知 - SEApproved: {3F30C968-480A-4C6C-862D-EFC0897BB84B} - C:\WINDOWS\system32\shimgvw.dll - Microsoft Corporation - Windows 图片和传真查看器 - 6.0.2900.2180 - 516096 - 51fb20fd3d0b2edda98a2d1e94b91b9d
O31 - 未知 - SEApproved: {9DBD2C50-62AD-11d0-B806-00C04FD706EC} - C:\WINDOWS\system32\shimgvw.dll - Microsoft Corporation - Windows 图片和传真查看器 - 6.0.2900.2180 - 516096 - 51fb20fd3d0b2edda98a2d1e94b91b9d
O31 - 未知 - SEApproved: {EAB841A0-9550-11cf-8C16-00805F1408F3} - C:\WINDOWS\system32\shimgvw.dll - Microsoft Corporation - Windows 图片和传真查看器 - 6.0.2900.2180 - 516096 - 51fb20fd3d0b2edda98a2d1e94b91b9d
O31 - 未知 - SEApproved: {eb9b1153-3b57-4e68-959a-a3266bc3d7fe} - C:\WINDOWS\system32\shimgvw.dll - Microsoft Corporation - Windows 图片和传真查看器 - 6.0.2900.2180 - 516096 - 51fb20fd3d0b2edda98a2d1e94b91b9d
O31 - 未知 - SEApproved: {7A9D77BD-5403-11d2-8785-2E0420524153} - - - - - 0 -
O31 - 未知 - SEApproved: {E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31} - C:\WINDOWS\system32\zipfldr.dll - Microsoft Corporation - Compressed (zipped) Folders - 6.0.2900.2180 - 465408 - 08fa93556c2dcd998378f00b0ce39d2e
O31 - 未知 - SEApproved: {BD472F60-27FA-11cf-B8B4-444553540000} - C:\WINDOWS\system32\zipfldr.dll - Microsoft Corporation - Compressed (zipped) Folders - 6.0.2900.2180 - 465408 - 08fa93556c2dcd998378f00b0ce39d2e
O31 - 未知 - SEApproved: {888DCA60-FC0A-11CF-8F0F-00C04FD7D062} - C:\WINDOWS\system32\zipfldr.dll - Microsoft Corporation - Compressed (zipped) Folders - 6.0.2900.2180 - 465408 - 08fa93556c2dcd998378f00b0ce39d2e
O31 - 未知 - SEApproved: {ECF03A33-103D-11d2-854D-006008059367} - C:\WINDOWS\system32\mydocs.dll - Microsoft Corporation - My Documents Folder UI - 6.0.2900.2180 - 91136 - df133fd2fe0e38a48b626c8863022933
O31 - 未知 - SEApproved: {ECF03A32-103D-11d2-854D-006008059367} - C:\WINDOWS\system32\mydocs.dll - Microsoft Corporation - My Documents Folder UI - 6.0.2900.2180 - 91136 - df133fd2fe0e38a48b626c8863022933
O31 - 未知 - SEApproved: {4a7ded0a-ad25-11d0-98a8-0800361b1103} - C:\WINDOWS\system32\mydocs.dll - Microsoft Corporation - My Documents Folder UI - 6.0.2900.2180 - 91136 - df133fd2fe0e38a48b626c8863022933
O31 - 未知 - SEApproved: {60fd46de-f830-4894-a628-6fa81bc0190d} - C:\WINDOWS\system32\photowiz.dll - Microsoft Corporation - Photo Printing Wizard - 5.1.2600.2180 - 166912 - 6842512cb971d848ea3aba5cca9a36ed
O31 - 未知 - SEApproved: {0CD7A5C0-9F37-11CE-AE65-08002B2E1262} - C:\WINDOWS\system32\cabview.dll - Microsoft Corporation - Cabinet File Viewer Shell Extension - 6.0.2900.2180 - 90624 - ef283188c701c8bfcc5187f3b2c547b2
O31 - 未知 - SEApproved: {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} - C:\Program Files\Real\RealPlayer\rpshell.dll - RealNetworks, Inc. - RealPlayer Shell Extensions - 1.0.1.1946 - 49198 - 68718fbfe1513aaeed9bf319d912bb47
O31 - 未知 - SEApproved: {B41DB860-8EE4-11D2-9906-E49FADC173CA} - C:\Program Files\WinRAR\rarext.dll - - - - 128512 - 2b7421a2351fbfa6e29141c46aea6b57
O31 - 未知 - SEApproved: {63542C48-9552-494A-84F7-73AA6A7C99C1} - C:\Program Files\WPS Office StormBeta 1.0\program\shlxthdl.dll - - - 1.0.0.0 - 274507 - 85fed1579e83bea2169b7997a3a4a146
O31 - 未知 - SEApproved: {e82a2d71-5b2f-43a0-97b8-81be15854de8} - C:\WINDOWS\system32\dfshim.dll - Microsoft Corporation - Application Deployment Support Library - 2.0.50727.42 - 83456 - b3511383c8be3a8c5b88a78971fc1141
O31 - 未知 - SEApproved: {E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} - C:\WINDOWS\system32\dfshim.dll - Microsoft Corporation - Application Deployment Support Library - 2.0.50727.42 - 83456 - b3511383c8be3a8c5b88a78971fc1141
O31 - 未知 - Directory Menu: {B41DB860-8EE4-11D2-9906-E49FADC173CA} - C:\Program Files\WinRAR\rarext.dll - - - - 128512 - 2b7421a2351fbfa6e29141c46aea6b57
O31 - 未知 - LSA: Security Packages - sv1_0.dll - - - - 0 -
O31 - 未知 - LSA: Security Packages - channel.dll - - - - 0 -
=======================================
O40 - winlogon.exe - Kaspersky Lab - C:\WINDOWS\system32\klogon.dll - Logon Visualizer - 2fb94ab158eb54a2212c8087b7e72340
O40 - Explorer.EXE - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scrchpg.dll - Script Checker - 632a777961e99cb61b28599555a2f7a7
O40 - Explorer.EXE - Grigri - C:\WINDOWS\system32\ContextBG.dll - Apply a background to the shell context menu - edd37826a42283aa3f25a4c639d689fa
O40 - Explorer.EXE - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\ShellEx.dll - Windows Shell Extension - 0904502f01d0d2a42082f0f35b18071c
O40 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\MSVCR80.dll - Microsoft? C Runtime Library - 16d7ddf3b659f7cf1cb9f4dcff4219f0
O40 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\MSVCP80.dll - Microsoft? C++ Runtime Library - 2bc650257fb0867abd54fd460ec2bafc
O40 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\system32\sendmail.dll - Send Mail - 5d6e81555a9906ef7469d5d7a35e19ad
O40 - Explorer.EXE - Intel Corporation - C:\WINDOWS\system32\igfxres.dll - xxxxres Module - 81e6a8e02cc31e547e3eab082b1dd544
O40 - Explorer.EXE - Intel Corporation - C:\WINDOWS\system32\igfxdev.dll - igfxdev Module - eccf988ebf3ade5792915e60c3d274dc
O40 - Explorer.EXE - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\klscav.dll - Script Checker AV Plugin - d7e7992479709ff02a33669e5dacf878
O40 - Explorer.EXE - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prremote.dll - PR_REMOTE - 20be3997fe3f091a3b0d634fb9d62259
O40 - Explorer.EXE - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll - Prague Loader - 22217717571205531e517b62a54fd861
O40 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\system32\dfshim.dll - Application Deployment Support Library - b3511383c8be3a8c5b88a78971fc1141
O40 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\system32\mscoree.dll - Microsoft .NET Runtime Execution Engine - 34bc771730448718ab771255888c783d
O40 - Explorer.EXE - - C:\Program Files\Thunder Network\Thunder\Components\ResWorker\DsBho_01.dll - DsBho - e2611893ee8a1d5118149a15ee6c9669
O40 - Explorer.EXE - Thunder Networking Technologies,LTD - C:\Program Files\Thunder Network\Thunder\Components\ResWorker\DataProcessor_01.dll - DataProcessor - 7bfb3e14c7b181b47528f57855eaedc5
O40 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\system32\mstask.dll - Task Scheduler interface DLL - d919668e8d62485c9834d28691761505
O40 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Shfusion.dll - Microsoft COM Runtime Fusion Assembly Viewer - 5b746df7ff55229630fe2815b348149c
O40 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Fusion.dll - Assembly manager - ad23bb6b329c7d5ee8a43b89e2fd4fd2
O40 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\culture.dll - Microsoft Globalization Support - ad060608376e3195b4545928f43653d8
O40 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ShFusRes.dll - Microsoft COM Runtime Fusion Assembly Viewer Resources - bffb11607d65a61461ba73d9b85a62cd
=======================================
O41 - ALCXSENS - Sensaura WDM 3D Audio Driver - C:\WINDOWS\system32\drivers\ALCXSENS.SYS - (running) - Sensaura WDM 3D Audio Driver - Sensaura Ltd - a9355a51698f6901b362ef738b15631d
O41 - Apaidi - Apaidi - C:\WINDOWS\system32\drivers\Apaidi.sys - (running) - - - f60f0a380c6cf97dc05c7d01adb2c217
O41 - Eudemon - Eudemon - C:\WINDOWS\system32\drivers\Eudemon.sys - (running) - Eudemon - EUDEMON Computer Consultants Ltd - da9d1642dd9946736f11056632d71145
O41 - IdeBusDr - Intel Application Accelerator Driver - C:\WINDOWS\system32\drivers\IdeBusDr.sys - (running) - Intel Application Accelerator Driver - Intel Corporation - 791f0829de88dd0ca77192f0dfad03b6
O41 - IdeChnDr - Intel Application Accelerator Driver - C:\WINDOWS\system32\drivers\IdeChnDr.sys - (running) - Intel Application Accelerator Driver - Intel Corporation - 7d2b8be9e89628663c1fb571f7c34062
O41 - klif - spuper-ptor - C:\WINDOWS\system32\drivers\klif.sys - (running) - spuper-ptor - Kaspersky Lab - 1b28fa1580438192a14e88b5834397ca
O41 - QKeyService - KeyCrypt Device Driver - C:\WINDOWS\system32\KeyCrypt.sys - (running) - KeyCrypt Device Driver - Tencent Technology (Shenzhen) Company Limited - 184c25ef0595c06c8a3f3c2fd584d891
O41 - Sentinel - Sentinel - C:\WINDOWS\system32\drivers\SENTINEL.SYS - (running) - - - 99c81af18c0bf4d3b2ce0b36941e150f
O41 - sptd - sptd - C:\WINDOWS\system32\drivers\sptd.sys - (running) - - -
O41 - ATSpy - ATSpy - C:\WINDOWS\system32\ATSpy.sys - (not running) - - -
O41 - npkcrypt - npkcrypt - C:\WINDOWS\system32\npkcrypt.sys - (not running) - - -
O41 - npkycryp - npkycryp - C:\WINDOWS\system32\npkycryp.sys - (not running) - - -
O41 - TSP - spuper-ptor - C:\WINDOWS\system32\drivers\klif.sys - (not running) - spuper-ptor - Kaspersky Lab - 1b28fa1580438192a14e88b5834397ca
=======================================
360Safe.exe=3.5.2.1001
AntiAdwa.dll=3.5.1.1001
AntiEng.dll=3.5.1.1001
AntiActi.dll=2.0.0.3000
CleanHis.dll=3.0.2.1000
live.dll=1.0.1.1016
=======================================
操作历史报告：
----------清理恶评及系统插件历史----------
2007-06-21 11:01
清理恶评软件 - WinDHCPsvc - C:\WINDOWS\system32\windhcp.ocx
清理恶评软件 - msccrt - C:\WINDOWS\system32\msccrt.dll
清理恶评软件 - msdebug木马 - C:\WINDOWS\system32\msdebug.dll
清理恶评软件 - Gjzo0.dll - C:\DOCUME~1\张建国\LOCALS~1\Temp\Gjzo0.dll
清理恶评软件 - winform - C:\WINDOWS\system32\winform.dll
清理恶评软件 - upxdnd木马 - C:\WINDOWS\system32\upxdnd.dll
清理恶评软件 - 天龙八部盗号木马 - C:\WINDOWS\system32\AVPSrv.dll
清理恶评软件 - Kvsc3 - C:\WINDOWS\Kvsc3.exe
清理恶评软件 - c0nime.exe - C:\DOCUME~1\张建国\LOCALS~1\Temp\c0nime.exe
清理恶评软件 - 大话西游盗号木马 - C:\WINDOWS\system32\nwizdh.exe
清理恶评软件 - 问道游戏盗号木马 - C:\DOCUME~1\张建国\LOCALS~1\Temp\IEXPLO~1.EXE
清理恶评软件 - 未知自动运行程序(Autorun) - C:\autorun.inf
2007-06-21 11:03
清理恶评软件 - WinDHCPsvc -
清理恶评软件 - msccrt -
清理恶评软件 - upxdnd木马 -
清理恶评软件 - winform -
清理恶评软件 - Gjzo0.dll -
清理恶评软件 - Kvsc3 -
清理恶评软件 - 天龙八部盗号木马 -
清理恶评软件 - 问道游戏盗号木马 -
清理恶评软件 - msdebug木马 -
2007-06-21 14:18
清理恶评软件 - 未知自动运行程序(Autorun) - C:\autorun.inf
2007-06-21 15:59
清理恶评软件 - 超级旋风下载组件 -
清理恶评软件 - 中文搜搜 -
2007-07-05 16:21
清理恶评软件 - etcetera toolbar - C:\Program Files\VVSN
2007-06-21 11:53
插件管理 - 番茄吧工具条 - C:\WINDOWS\system32\HOTUNIST.EXE
插件管理 - 快车(FlashGet) -
2007-06-21 15:56
插件管理 - 中文搜搜 - C:\PROGRA~1\TENCENT\SSPlus\SAddr.dll
插件管理 - 超级旋风下载组件 - E:\张学友~1\other\腾讯QQ~1.6\QQDOWN~1\QQIEHE~1.DLL
2007-06-21 15:56
插件管理 - 中文搜搜 - C:\WINDOWS\system32\scrax.dll
2007-06-21 15:56
插件管理 - 超级旋风下载组件 - E:\张学友~1\other\腾讯QQ~1.6\QQDOWN~1\QQIEHE~1.DLL
2007-06-25 15:30
插件管理 - 超级旋风下载组件 -
2007-07-05 16:25
清理好评插件 - POCO在线杂志播放插件 - C:\Program Files\PocoZinePlayer
----------全面诊断修复历史----------
2007-06-21 11:54
O9 - 未知 - 番茄花园 - http://www.tomatolei.com
O9 - 未知 - 信息检索 - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
2007-06-25 15:31
100 - 未知 - Rar.exe - C:\Program Files\WinRAR\Rar.exe
2007-07-05 16:40
100 - 未知 - msd.exe - C:\WINDOWS\system32\msd.exe
O4 - 未知 - Microsoft Value Service - msd.exe
O4 - 未知 - Microsoft Windows - windows1.exe
O4 - 未知 - Microsoft Value Service - msd.exe
O4 - 未知 - Microsoft Value Service - msd.exe
O30 - 未知 - Scrnsave.exe - C:\WINDOWS\system32\ssmyst.scr
O23 - 未知 - EnGenius Network Analysis Tool - "C:\WINDOWS\system32\dllcache\winegne.exe"
2007-07-06 15:56
100 - 未知 - msd.exe - C:\WINDOWS\system32\msd.exe
100 - 未知 - cmd.exe - 毀
100 - 未知 - taskmgr.exe - 毀
2007-07-06 15:57
100 - 未知 - taskmgr.exe - 毀
O4 - 未知 - Microsoft Value Service - msd.exe
O4 - 未知 - Microsoft Value Service - msd.exe
2007-07-08 09:39
100 - 未知 - taskmrg.exe - C:\WINDOWS\system32\taskmrg.exe
2007-07-08 09:40
O4 - 未知 - Microsoft Value Service - taskmrg.exe
2007-07-08 09:40
O4 - 未知 - Microsoft Value Service - taskmrg.exe
2007-07-08 09:40
O23 - 未知 - EnGenius Network Analysis Tool - "C:\WINDOWS\system32\dllcache\winegne.exe"
2007-07-08 12:46
O4 - 未知 - Microsoft Value Service - msd.exe
2007-07-08 12:46
O23 - 未知 - EnGenius Network Analysis Tool - "C:\WINDOWS\system32\dllcache\winegne.exe"
O23 - 未知 - MSSQLSERVER - C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe -sMSSQLSERVER
O23 - 安全 - MSSQLServerADHelper - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe
O23 - 未知 - SQLSERVERAGENT - C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlagent.EXE -i MSSQLSERVER
O23 - 未知 - TongBackupSrv - C:\WINDOWS\system32\TongBackupSrv.exe
O23 - 未知 - UFNet - C:\WINDOWS\system32\ServerNT.exe
2007-07-08 12:46
100 - 未知 - TongBackupSrv.exe - C:\WINDOWS\system32\TongBackupSrv.exe
2007-07-08 12:46
100 - 安全 - ftp.exe - C:\WINDOWS\system32\ftp.exe
2007-07-08 12:47
O23 - 未知 - EnGenius Network Analysis Tool - "C:\WINDOWS\system32\dllcache\winegne.exe"
O23 - 未知 - MSSQLSERVER - C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe -sMSSQLSERVER
O23 - 安全 - MSSQLServerADHelper - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe
O23 - 未知 - SQLSERVERAGENT - C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlagent.EXE -i MSSQLSERVER
O23 - 未知 - TongBackupSrv - C:\WINDOWS\system32\TongBackupSrv.exe
O23 - 未知 - UFNet - C:\WINDOWS\system32\ServerNT.exe
2007-07-09 09:06
100 - 未知 - TongBackupSrv.exe - C:\WINDOWS\system32\TongBackupSrv.exe
100 - 未知 - msd.exe - C:\WINDOWS\system32\msd.exe
O4 - 未知 - Microsoft Value Service - msd.exe
O4 - 未知 - Microsoft Value Service - msd.exe
O4 - 未知 - ApabiAgent - "C:\Program Files\Founder\Apabi Reader 3.0\ApabiAgent.exe"
O30 - 未知 - Scrnsave.exe - C:\WINDOWS\system32\ssmyst.scr
O23 - 未知 - EnGenius Network Analysis Tool - "C:\WINDOWS\system32\dllcache\winegne.exe"
O23 - 未知 - MSSQLSERVER - C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe -sMSSQLSERVER
O23 - 未知 - SQLSERVERAGENT - C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlagent.EXE -i MSSQLSERVER
O23 - 未知 - TongBackupSrv - C:\WINDOWS\system32\TongBackupSrv.exe
O23 - 未知 - UFNet - C:\WINDOWS\system32\ServerNT.exe
2007-07-09 16:51
100 - 未知 - TongBackupSrv.exe - C:\WINDOWS\system32\TongBackupSrv.exe
100 - 未知 - svcUpdate.exe - C:\WINDOWS\system32\svcUpdate.exe
100 - 未知 - msd.exe - C:\WINDOWS\system32\msd.exe
O4 - 未知 - Microsoft Value Service - msd.exe
O4 - 未知 - Microsoft - svcUpdate.exe
O4 - 未知 - Microsoft Value Service - msd.exe
O30 - 未知 - Scrnsave.exe - C:\WINDOWS\system32\ssmyst.scr
O23 - 未知 - EnGenius Network Analysis Tool - "C:\WINDOWS\system32\dllcache\winegne.exe"
O23 - 未知 - MSSQLSERVER - C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe -sMSSQLSERVER
O23 - 未知 - SQLSERVERAGENT - C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlagent.EXE -i MSSQLSERVER
O23 - 未知 - TongBackupSrv - C:\WINDOWS\system32\TongBackupSrv.exe
O23 - 未知 - UFNet - C:\WINDOWS\system32\ServerNT.exe
----------修复IE浏览器操作历史----------
2007-06-21 11:04
R0 - 危险 - IE首页 - HKCU\Software\Microsoft\Internet Explorer\Main
R1 - 危险 - IE左侧搜索页 - HKLM\Software\Microsoft\Internet Explorer\Main
2007-07-05 16:44
R0 - 危险 - IE首页 - HKCU\Software\Microsoft\Internet Explorer\Main