»
游客:
注册
|
登录
|
帮助
微点交流论坛
»
微点主动防御软件
» 791224.com的NB毒,呼唤legend
作者:
标题: 791224.com的NB毒,呼唤legend
qx1984
新手上路
积分 26
发帖 26
注册 2006-9-29
#1
791224.com的NB毒,呼唤legend
周5的时候我发过一帖子说这个站的毒(详见
http://bbs.micropoint.com.cn/sho ... =30256&fpage=1)
，这毒访问其他网站不发作，只访问*.sgcc.com.cn为后缀的内网就会自动链接到791224.com。导致局域网OA无法打开。我用sreng2查看似乎并无异常进程。卡巴、微点、诺顿、均无法查出。重装系统格式化C盘亦无效。此毒绝非ARP应该。因为中毒的几台电脑都装有antiarp的企业版，未收到被攻击提示。局域网网站应该亦无中毒，应为其他未中毒电脑打开正常。
****
2008-03-24,09:06:37
System Repair Engineer 2.5.16.900
Smallfrogs (
http://www.KZTechs.com)
Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描
启动项目
注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32> [N/A]
<PHIME2002A><; > [N/A]
<PHIME2002ASync><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Component Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
<WinlogonNotify: NavLogon><C:\WINDOWS\system32\NavLogon.dll> [(Verified)Symantec Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Remove.PerUser.NT> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
<Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A]
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><C:\WINDOWS\system32\七彩泡泡.SCR> [Microsoft Corporation]
==================================
启动文件夹
N/A
==================================
※ ※ ※ 本文纯属【qx1984】个人意见，与【 微点交流论坛 】立场无关※ ※ ※
2008-3-24 09:37
qx1984
新手上路
积分 26
发帖 26
注册 2006-9-29
#2
服务
[3ware Controller Service / 3wareSrv][Stopped/Auto Start]
<C:\WINDOWS\System32\3wareSrv.exe><N/A>
[Symantec Event Manager / ccEvtMgr][Running/Auto Start]
<"C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"><Symantec Corporation>
[Contrl Center of Storm Media / ccosm][Running/Auto Start]
<C:\Program Files\StormII\stormliv.exe /asservice><北京暴风网际科技有限公司>
[Symantec Network Proxy / ccProxy][Running/Auto Start]
<"C:\Program Files\Common Files\Symantec Shared\ccProxy.exe"><Symantec Corporation>
[Symantec Settings Manager / ccSetMgr][Running/Auto Start]
<"C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"><Symantec Corporation>
[Symantec AntiVirus Definition Watcher / DefWatch][Running/Auto Start]
<"C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe"><Symantec Corporation>
[Google Updater Service / gusvc][Stopped/Manual Start]
<"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"><Google>
[Help and Support / helpsvc][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll><N/A>
[Human Interface Device Access / HidServ][Stopped/Boot Start]
<\SystemRoot\C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[IS Service / ISSVC][Running/Auto Start]
<"C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe"><Symantec Corporation>
[LiveUpdate / LiveUpdate][Stopped/Manual Start]
<"C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE"><Symantec Corporation>
[NetMeeting Remote Desktop Sharing / mnmsrvc][Stopped/Manual Start]
<><N/A>
[SavRoam / SavRoam][Running/Auto Start]
<"C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe"><symantec>
[Symantec Network Drivers Service / SNDSrvc][Running/Manual Start]
<"C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe"><Symantec Corporation>
[Symantec SPBBCSvc / SPBBCSvc][Running/Auto Start]
<"C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe"><Symantec Corporation>
[Symantec AntiVirus / Symantec AntiVirus][Running/Auto Start]
<"C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe"><Symantec Corporation>
[Symantec SecurePort / SymSecurePort][Running/Auto Start]
<"C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe"><Symantec Corporation>
==================================
驱动程序
[AMD Processor Driver / AmdK8][Running/System Start]
<System32\DRIVERS\amdk8.sys><Advanced Micro Devices>
[AMD Low Level Device Driver / AmdLLD][Running/Manual Start]
<system32\DRIVERS\AmdLLD.sys><AMD, Inc.>
[AntiARP NDIS Protocol Driver / AntiArpNdisProt][Running/Auto Start]
<system32\DRIVERS\AntiArpNdisProt.sys><Windows (R) 2000 DDK provider>
[Promise driver accelerator / bb-run][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\bb-run.sys><Promise Technology, Inc.>
[Broadcom 440x 10/100 Integrated Controller XP Driver / bcm4sbxp][Running/Manual Start]
<system32\DRIVERS\bcm4sbxp.sys><Broadcom Corporation>
[Dritek Keyboard Filter Driver / DKbFltr][Running/Manual Start]
<system32\DRIVERS\DKbFltr.sys><Dritek System Inc.>
[Promise Removable Disk Control Driver / dontgo][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\DontGo.sys><Promise Technology, Inc.>
[Symantec Eraser Control driver / eeCtrl][Running/System Start]
<\??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys><Symantec Corporation>
[EraserUtilRebootDrv / EraserUtilRebootDrv][Running/Manual Start]
<\??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys><Symantec Corporation>
[Microsoft UAA Function Driver for High Definition Audio Service / HdAudAddService][Running/Manual Start]
<system32\drivers\HdAudio.sys><Windows (R) Server 2003 DDK provider>
[Microsoft UAA Bus Driver for High Definition Audio / HDAudBus][Running/Manual Start]
<system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
[IEEE-1284.4 Driver HPZid412 / HPZid412][Running/Manual Start]
<system32\DRIVERS\HPZid412.sys><HP>
[Print Class Driver for IEEE-1284.4 HPZipr12 / HPZipr12][Running/Manual Start]
<system32\DRIVERS\HPZipr12.sys><HP>
[USB to IEEE-1284.4 Translation Driver HPZius12 / HPZius12][Running/Manual Start]
<system32\DRIVERS\HPZius12.sys><HP>
[HSFHWBS2 / HSFHWBS2][Running/Manual Start]
<system32\DRIVERS\HSFBS2S2.sys><Conexant Systems, Inc.>
[HSF_DP / HSF_DP][Running/Manual Start]
<system32\DRIVERS\HSFDPSP2.sys><Conexant Systems, Inc.>
[mdmxsdk / mdmxsdk][Running/Auto Start]
<system32\DRIVERS\mdmxsdk.sys><Conexant>
[NAVENG / NAVENG][Running/Manual Start]
<\??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20080320.009\naveng.sys><Symantec Corporation>
[NAVEX15 / NAVEX15][Running/Manual Start]
<\??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20080320.009\navex15.sys><Symantec Corporation>
[nv / nv][Running/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[NVIDIA nForce RAID Driver / nvrd32][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\nvrd32.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[SAVRT / SAVRT][Running/System Start]
<\??\C:\Program Files\Symantec Client Security\Symantec AntiVirus\savrt.sys><Symantec Corporation>
[SAVRTPEL / SAVRTPEL][Running/System Start]
<\??\C:\Program Files\Symantec Client Security\Symantec AntiVirus\Savrtpel.sys><Symantec Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
[SATALink External Device Filter / SiRemFil][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\SiRemFil.sys><Silicon Image, Inc.>
[SPBBCDrv / SPBBCDrv][Running/System Start]
<\??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys><Symantec Corporation>
[System Restore Filter Driver / sr][Stopped/Disabled]
<system32\DRIVERS\sr.sys><N/A>
[SYMDNS / SYMDNS][Stopped/Manual Start]
<\SystemRoot\System32\Drivers\SYMDNS.SYS><Symantec Corporation>
[SymEvent / SymEvent][Running/Manual Start]
<\??\C:\Program Files\Symantec\SYMEVENT.SYS><Symantec Corporation>
[SYMFW / SYMFW][Stopped/Manual Start]
<\SystemRoot\System32\Drivers\SYMFW.SYS><Symantec Corporation>
[SYMIDS / SYMIDS][Stopped/Manual Start]
<\SystemRoot\System32\Drivers\SYMIDS.SYS><Symantec Corporation>
[SYMIDSCO / SYMIDSCO][Stopped/Manual Start]
<\??\C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\SCFIDS~1\20060807.097\symidsco.sys><Symantec Corporation>
[SYMNDIS / SYMNDIS][Stopped/Manual Start]
<\SystemRoot\System32\Drivers\SYMNDIS.SYS><Symantec Corporation>
[SYMREDRV / SYMREDRV][Running/Manual Start]
<\SystemRoot\System32\Drivers\SYMREDRV.SYS><Symantec Corporation>
[SYMTDI / SYMTDI][Running/System Start]
<\SystemRoot\System32\Drivers\SYMTDI.SYS><Symantec Corporation>
[VIA AGP Filter / viaagp1][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\viaagp1.sys><VIA Technologies, Inc.>
[ViBus / ViBus][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\ViBus.sys><VIA Technologies, Inc.>
[videX32 / videX32][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\videX32.sys><VIA Technologies, Inc.>
[VIA SATA IDE Device Driver / ViPrt][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\ViPrt.sys><VIA Technologies, Inc.>
[winachsf / winachsf][Running/Manual Start]
<system32\DRIVERS\HSFCXTS2.sys><Conexant Systems, Inc.>
[xAntiArpSpoof Service / xAntiArp][Running/Manual Start]
<system32\DRIVERS\xAntiArp.sys><Windows (R) 2000 DDK provider>
[VIA SATA IDE Hot-plug Driver / xfilt][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\xfilt.sys><VIA Technologies,Inc>
[23843 / 23843][Running/]
<2 - 系统找不到指定的文件。
><N/A>
==================================
※ ※ ※ 本文纯属【qx1984】个人意见，与【 微点交流论坛 】立场无关※ ※ ※
2008-3-24 09:37
qx1984
新手上路
积分 26
发帖 26
注册 2006-9-29
#3
浏览器加载项
[ThunderAtOnce Class]
{01443AEC-0FD1-40fd-9C87-E93D1494C233} <C:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[Google Toolbar Helper]
{AA58ED58-01DD-4d91-8333-CF10577473F7} <c:\program files\google\googletoolbar1.dll, Google Inc.>
[Google Toolbar Notifier BHO]
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>
[SafeMon Class]
{B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>
[&Google]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar1.dll, Google Inc.>
[WebdesignerCtrl Class]
{A114758F-7FD6-4918-8464-77342686817E} <C:\WINDOWS\Downloaded Program Files\WebdesignerControl.dll, 锐祺软件>
[ThunderAtOnce Class]
{01443AEC-0FD1-40FD-9C87-E93D1494C233} <C:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[&Google]
{2318C2B1-4965-11D4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar1.dll, Google Inc.>
[Thunder Agent Class]
{485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <C:\Program Files\Thunder\ComDlls\ThunderAgent_Now.dll, Thunder Networking Technologies,LTD>
[360SafeLive]
{87515F61-A66C-4319-A0E0-D416CB8059E3} <C:\Program Files\360safe\live.dll, 360.cn>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[WebdesignerCtrl Class]
{A114758F-7FD6-4918-8464-77342686817E} <C:\WINDOWS\Downloaded Program Files\WebdesignerControl.dll, 锐祺软件>
[Google Toolbar Helper]
{AA58ED58-01DD-4D91-8333-CF10577473F7} <c:\program files\google\googletoolbar1.dll, Google Inc.>
[Google Toolbar Notifier BHO]
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>
[SafeMon Class]
{B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9e.ocx, Adobe Systems, Inc.>
[使用迅雷下载]
<C:\Program Files\Thunder\Program\geturl.htm, N/A>
[使用迅雷下载全部链接]
<C:\Program Files\Thunder\Program\getallurl.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
==================================
正在运行的进程
[PID: 888 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 940 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 964 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\NavLogon.dll] [Symantec Corporation, 10.1.5.5000]
[PID: 1008 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1020 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1184 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1280 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1404 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1556 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1656 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1756 / SYSTEM][C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe] [Symantec Corporation, 104.0.11.1]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\Program Files\Common Files\Symantec Shared\ccL40.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\ccSetEvt.dll] [Symantec Corporation, 104.0.11.1]
[PID: 1980 / SYSTEM][C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe] [Symantec Corporation, 104.0.11.1]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\Program Files\Common Files\Symantec Shared\ccL40.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\ccSet.dll] [Symantec Corporation, 104.0.11.1]
[C:\PROGRA~1\COMMON~1\SYMANT~1\SPBBC\SPBBCEVT.DLL] [Symantec Corporation, 2.2.0.7]
[C:\PROGRA~1\COMMON~1\SYMANT~1\CCLOGIN.DLL] [Symantec Corporation, 104.0.11.1]
[C:\PROGRA~1\COMMON~1\SYMANT~1\CCPXYEVT.DLL] [Symantec Corporation, 104.0.11.1]
[C:\PROGRA~1\COMMON~1\SYMANT~1\CCSETEVT.DLL] [Symantec Corporation, 104.0.11.1]
[C:\PROGRA~1\SYMANT~1\SYMANT~1\LOGFWDER.DLL] [Symantec Corporation, 8.7.4.97]
[C:\WINDOWS\system32\SymNeti.DLL] [Symantec Corporation, 6.0.4.402]
[C:\Program Files\Symantec Client Security\Symantec Client Firewall\NisEvt.dll] [Symantec Corporation, 8.7.4.97]
[C:\Program Files\Symantec Client Security\Symantec AntiVirus\Cliproxy.dll] [Symantec Corporation, 10.1.5.5000]
[C:\Program Files\Symantec Client Security\Symantec AntiVirus\NAVNTUTL.DLL] [Symantec Corporation, 10.1.5.5000]
[c:\program files\common files\symantec shared\ssc\ScsComms.dll] [Symantec Corporation, 10.1.5.5000]
[C:\WINDOWS\system32\nts.dll] [LANDesk Software Ltd., 6.12.0.142 E]
[C:\WINDOWS\system32\cba.dll] [LANDesk Software Ltd., 6.12.0.142 E]
[C:\WINDOWS\system32\MsgSys.dll] [LANDesk Software Ltd., 6.12.0.142 E]
[C:\WINDOWS\system32\PDS.DLL] [LANDesk Software Ltd., 6.12.0.142 E]
※ ※ ※ 本文纯属【qx1984】个人意见，与【 微点交流论坛 】立场无关※ ※ ※
2008-3-24 09:38
qx1984
新手上路
积分 26
发帖 26
注册 2006-9-29
#4
[PID: 1988 / Administrator][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_qfe.070613-1311)]
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 0, 3, 1011]
[C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll] [Symantec Corporation, 10.1.5.5000]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
[C:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll] [Thunder Networking Technologies,LTD, 1.0.5.16]
[C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 8, 44]
[PID: 240 / SYSTEM][C:\Program Files\Common Files\Symantec Shared\ccProxy.exe] [Symantec Corporation, 104.0.11.1]
[C:\WINDOWS\system32\SYMREDIR.dll] [Symantec Corporation, 6.0.4.402]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\SymNeti.DLL] [Symantec Corporation, 6.0.4.402]
[C:\Program Files\Common Files\Symantec Shared\ccL40.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\DPHTML.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\DPJS.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\DPVBS.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\PFMisc.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\PFPriv.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\PFSec.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\PxyHTTP.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\DPHTTP.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\PxyIM.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\ccProSub.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\ccPxyEvt.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\ccLogin.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\ccSetEvt.dll] [Symantec Corporation, 104.0.11.1]
[PID: 284 / SYSTEM][C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe] [Symantec Corporation, 8.7.4.97]
[C:\WINDOWS\system32\SymNeti.DLL] [Symantec Corporation, 6.0.4.402]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\Program Files\Common Files\Symantec Shared\ccL40.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\ccSet.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\ccSetEvt.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\ccProSub.dll] [Symantec Corporation, 104.0.11.1]
※ ※ ※ 本文纯属【qx1984】个人意见，与【 微点交流论坛 】立场无关※ ※ ※
2008-3-24 09:40
qx1984
新手上路
积分 26
发帖 26
注册 2006-9-29
#5
[PID: 336 / SYSTEM][C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe] [Symantec Corporation, 2.2.0.7]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\ccL40.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\ccSet.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCEvt.dll] [Symantec Corporation, 2.2.0.7]
[C:\Program Files\Common Files\Symantec Shared\SPBBC\bbRGen.dll] [Symantec Corporation, 2.2.0.7]
[PID: 500 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\WINDOWS\system32\hpz3l4sa.dll] [Hewlett-Packard Company, 60.062.241.00]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\hpzpp4sa.dll] [Hewlett-Packard Corporation, 60.062.241.00]
[PID: 1360 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1380 / SYSTEM][C:\Program Files\StormII\stormliv.exe] [北京暴风网际科技有限公司, 3, 7, 11, 16]
[PID: 1396 / SYSTEM][C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe] [Symantec Corporation, 10.1.5.5000]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\Program Files\Common Files\Symantec Shared\ccL40.dll] [Symantec Corporation, 104.0.11.1]
[PID: 1492 / SYSTEM][C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe] [symantec, 10.1.5.5000]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\Program Files\Common Files\Symantec Shared\SSC\Transman.dll] [Symantec Corporation, 10.1.5.5000]
[C:\WINDOWS\system32\CBA.DLL] [LANDesk Software Ltd., 6.12.0.142 E]
[C:\WINDOWS\system32\MsgSys.dll] [LANDesk Software Ltd., 6.12.0.142 E]
[C:\WINDOWS\system32\NTS.dll] [LANDesk Software Ltd., 6.12.0.142 E]
[C:\WINDOWS\system32\PDS.DLL] [LANDesk Software Ltd., 6.12.0.142 E]
[c:\program files\common files\symantec shared\ssc\ScsComms.dll] [Symantec Corporation, 10.1.5.5000]
[PID: 1548 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\hpwwiax1.dll] [Hewlett-Packard, 0.0.0.216]
[PID: 1676 / SYSTEM][C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe] [Symantec Corporation, 10.1.5.5000]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\CBA.DLL] [LANDesk Software Ltd., 6.12.0.142 E]
[C:\WINDOWS\system32\MsgSys.dll] [LANDesk Software Ltd., 6.12.0.142 E]
[C:\WINDOWS\system32\NTS.dll] [LANDesk Software Ltd., 6.12.0.142 E]
[C:\WINDOWS\system32\PDS.DLL] [LANDesk Software Ltd., 6.12.0.142 E]
[C:\Program Files\Symantec Client Security\Symantec AntiVirus\NAVLU.dll] [Symantec Corporation, 10.1.5.5000]
[C:\WINDOWS\system32\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\Program Files\Symantec Client Security\Symantec AntiVirus\I2ldvp3.dll] [Symantec Corporation, 10.1.5.5000]
[C:\Program Files\Common Files\Symantec Shared\ccL40.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Symantec Client Security\Symantec AntiVirus\NAVNTUTL.DLL] [Symantec Corporation, 10.1.5.5000]
[c:\program files\common files\symantec shared\ssc\ScsComms.dll] [Symantec Corporation, 10.1.5.5000]
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\ccDec.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\decsdk.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2ID.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2Zip.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2SS.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2GZIP.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2CAB.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2LHA.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2ARJ.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2TNEF.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2LZ.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2AMG.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2RAR.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2TAR.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2RTF.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2Text.dll] [Symantec Corporation, 3.02.14.10]
[C:\Program Files\Common Files\Symantec Shared\ccScan.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\ecmldr32.DLL] [Symantec Corporation, 51.3.0.11]
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20080320.009\ccEraser.dll] [Symantec Corporation, 107.4.1.2]
[C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefUtDCD.dll] [Symantec Corporation, 3.1.13a.0]
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20080320.009\ecmsvr32.dll] [Symantec Corporation, 71.4.0.15]
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20080320.009\NAVEX32a.DLL] [Symantec Corporation, 20071.4.3.10]
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20080320.009\NAVENG32.DLL] [Symantec Corporation, 20071.4.3.10]
[C:\Program Files\Symantec Client Security\Symantec AntiVirus\SAVRT32.DLL] [Symantec Corporation, 9.7.2.3]
[C:\Program Files\Symantec Client Security\Symantec AntiVirus\IMail.dll] [Symantec Corporation, 10.1.5.5000]
[C:\Program Files\Symantec Client Security\Symantec AntiVirus\NotesExt.dll] [Symantec Corporation, 10.1.5.5000]
[C:\Program Files\Symantec Client Security\Symantec AntiVirus\vpmsece4.dll] [Symantec Corporation, 10.1.5.5000]
[C:\Program Files\Symantec Client Security\Symantec AntiVirus\SymProtectStorage.dll] [Symantec Corporation, 10.1.5.5000]
[C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCEvt.dll] [Symantec Corporation, 2.2.0.7]
[PID: 736 / SYSTEM][C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe] [Symantec Corporation, 8.7.4.97]
[C:\WINDOWS\system32\SymNeti.DLL] [Symantec Corporation, 6.0.4.402]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\Program Files\Common Files\Symantec Shared\ccL40.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\ccSetEvt.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Symantec Client Security\Symantec Client Firewall\NisEvt.dll] [Symantec Corporation, 8.7.4.97]
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\ccProSub.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\ccSet.dll] [Symantec Corporation, 104.0.11.1]
※ ※ ※ 本文纯属【qx1984】个人意见，与【 微点交流论坛 】立场无关※ ※ ※
2008-3-24 09:41
qx1984
新手上路
积分 26
发帖 26
注册 2006-9-29
#6
[PID: 788 / LOCAL SERVICE][C:\WINDOWS\system32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[PID: 1324 / SYSTEM][C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe] [Symantec Corporation, 6.0.4.402]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\SymNeti.dll] [Symantec Corporation, 6.0.4.402]
[PID: 2176 / Administrator][C:\Program Files\Common Files\Symantec Shared\ccApp.exe] [Symantec Corporation, 104.0.11.1]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\Program Files\Common Files\Symantec Shared\ccL40.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\ccSet.dll] [Symantec Corporation, 104.0.11.1]
[C:\PROGRA~1\COMMON~1\SYMANT~1\CCALERT.DLL] [Symantec Corporation, 104.0.11.1]
[C:\PROGRA~1\COMMON~1\SYMANT~1\CCEMLPXY.DLL] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 0, 3, 1011]
[C:\PROGRA~1\SYMANT~1\SYMANT~1\NISPROD.DLL] [Symantec Corporation, 8.7.4.97]
[C:\PROGRA~1\SYMANT~1\SYMANT~1\NISTRAY.DLL] [Symantec Corporation, 8.7.4.97]
[C:\WINDOWS\system32\SymNeti.DLL] [Symantec Corporation, 6.0.4.402]
[C:\PROGRA~1\SYMANT~1\SYMANT~1\NISALERT.DLL] [Symantec Corporation, 8.7.4.97]
[C:\Program Files\Symantec Client Security\Symantec Client Firewall\NISRes.dll] [Symantec Corporation, 8.7.4.97]
[C:\Program Files\Common Files\Symantec Shared\ccSetEvt.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\ccProSub.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\ccLogin.dll] [Symantec Corporation, 104.0.11.1]
[C:\WINDOWS\system32\SYMREDIR.DLL] [Symantec Corporation, 6.0.4.402]
[C:\Program Files\Symantec Client Security\Symantec Client Firewall\ccEmlflt.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Symantec Client Security\Symantec Client Firewall\NISLCOM.dll] [Symantec Corporation, 8.7.4.97]
[C:\Program Files\Common Files\Symantec Shared\ccPxyEvt.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavEmail.dll] [Symantec Corporation, 10.1.5.5000]
[C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymFWAgt.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Symantec Client Security\Symantec Client Firewall\SFWAlert.dll] [Symantec Corporation, 8.7.4.97]
[C:\Program Files\Symantec Client Security\Symantec Client Firewall\ccFWSetg.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Symantec Client Security\Symantec Client Firewall\pRSettg.dll] [N/A, ]
[C:\Program Files\Common Files\Symantec Shared\Options\VTCache.dll] [Symantec Corporation, 2005.3.0.58]
[C:\Program Files\Symantec Client Security\Symantec Client Firewall\TLevel.dll] [Symantec Corporation, 104.0.11.1]
[PID: 2220 / Administrator][C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe] [Symantec Corporation, 10.1.5.5000]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\Program Files\Common Files\Symantec Shared\ccL40.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Symantec Client Security\Symantec AntiVirus\SAVRT32.DLL] [Symantec Corporation, 9.7.2.3]
[C:\Program Files\Common Files\Symantec Shared\ccSetEvt.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\ccProSub.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Common Files\Symantec Shared\ccAlert.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\Symantec Client Security\Symantec AntiVirus\Cliscan.dll] [Symantec Corporation, 10.1.5.5000]
[C:\Program Files\Symantec Client Security\Symantec AntiVirus\NAVNTUTL.DLL] [Symantec Corporation, 10.1.5.5000]
[C:\Program Files\Common Files\Symantec Shared\ccSet.dll] [Symantec Corporation, 104.0.11.1]
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 0, 3, 1011]
[C:\Program Files\Symantec Client Security\Symantec AntiVirus\Cliproxy.dll] [Symantec Corporation, 10.1.5.5000]
[PID: 2232 / Administrator][C:\Program Files\AntiARP\AntiARP.exe] [N/A, ]
[C:\Program Files\AntiARP\xantiarp.dll] [N/A, ]
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 0, 3, 1011]
[PID: 2268 / Administrator][C:\Program Files\360safe\safemon\360tray.exe] [奇虎网, 4, 0, 3, 1011]
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 0, 3, 1011]
[C:\Program Files\360safe\safemon\SafeKrnl.dll] [奇虎网, 4, 0, 3, 1008]
[C:\Program Files\360safe\AntiAdwa.dll] [360Safe.com, 4, 0, 3, 1009]
[C:\Program Files\360safe\live.dll] [360.cn, 1, 0, 1, 1025]
[PID: 2280 / Administrator][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 0, 3, 1011]
[PID: 2300 / Administrator][C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe] [Google Inc., 2, 0, 301, 1654]
[C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\gtn.dll] [Google Inc., 2, 0, 301, 7164]
[C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\res_zh-CN.dll] [Google Inc., 2, 0, 301, 7164]
[C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll] [Google Inc., 2, 0, 301, 7164]
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 0, 3, 1011]
[PID: 3688 / Administrator][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 0, 3, 1011]
[c:\program files\google\googletoolbar1.dll] [Google Inc., 4, 0, 1606, 6690]
[C:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll] [Thunder Networking Technologies,LTD, 1.0.5.16]
[C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 8, 44]
[C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll] [Google Inc., 2, 0, 301, 7164]
[C:\WINDOWS\system32\Macromed\Flash\Flash9e.ocx] [Adobe Systems, Inc., 9,0,115,0]
※ ※ ※ 本文纯属【qx1984】个人意见，与【 微点交流论坛 】立场无关※ ※ ※
2008-3-24 09:42
qx1984
新手上路
积分 26
发帖 26
注册 2006-9-29
#7
[PID: 4088 / Administrator][C:\Program Files\Thunder\Program\Thunder5.exe] [Thunder Networking Technologies,LTD, 5.7.5.421]
[C:\Program Files\Thunder\Program\ThunderEx.dll] [, 1, 2, 2, 18]
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 0, 3, 1011]
[C:\Program Files\Thunder\Program\TaskManager.dll] [Thunder Networking Technologies,LTD, 1, 3, 0, 52]
[C:\Program Files\Thunder\Program\download_interface.dll] [Thunder Networking Technologies,LTD, 2, 20, 2, 200]
[C:\Program Files\Thunder\Program\stlport_vc646.dll] [STLport Consulting, Inc., 4.6.2003.1031]
[C:\Program Files\Thunder\Program\asyn_dns.dll] [Thunder Networking Technologies,LTD, 2, 20, 2, 200]
[C:\Program Files\Thunder\Program\streammedialib.dll] [, 1, 3, 2, 100]
[C:\Program Files\Thunder\Program\al.dll] [, 1, 0, 1, 2]
[C:\Program Files\Thunder\Program\xldc.dll] [Thunder Networking Technologies,LTD, 1, 0, 2, 11]
[C:\Program Files\Thunder\Program\bd.dll] [Thunder Networking Technologies,LTD, 1, 0, 2, 3]
[C:\Program Files\Thunder\Program\XLNet.Dll] [Thunder Networking Technologies,LTD, 1, 3, 2, 16]
[C:\Program Files\Thunder\Program\BHOStub.dll] [Thunder Networking Technologies,LTD, 1, 1, 0, 8]
[C:\Program Files\Thunder\Components\DownAndPlay\DownAndPlay.dll] [, 1, 0, 8, 26]
[C:\Program Files\Thunder\Program\iTargetAD.dll] [N/A, ]
[C:\Program Files\Thunder\Components\Community\XLCommunity.dll] [Thunder Networking Technologies,LTD, 1, 4, 2, 0]
[C:\Program Files\Thunder\Program\XLCommunityEx.dll] [N/A, ]
[C:\Program Files\Thunder\Program\RegisterDll.dll] [Thunder Networking Technologies,LTD, 2, 16, 5, 63]
[C:\Program Files\Thunder\Program\MSVCIRT.dll] [Microsoft Corporation, 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Thunder\Components\Search\XLSearch.dll] [Thunder Networking Technologies,LTD, 1, 1, 6, 20]
[C:\Program Files\Thunder\Program\LiveUpdate.dll] [Thunder Networking Technologies,LTD, 1, 2, 1, 20]
[C:\Program Files\Thunder\Plugins\GouGouTop\GouGouTop.dll] [Thunder Networking Technologies,LTD, 1, 0, 2, 4]
[C:\Program Files\Thunder\Plugins\BhoAdv\bho_adv.dll] [深圳市迅雷网络技术有限公司, 1.0.1.0]
[C:\Program Files\Thunder\Components\ExplorerHelper\ExplorerHelper.dll] [Thunder Networking Technologies,LTD, 1, 0, 4, 16]
[C:\Program Files\Thunder\Components\Tips\TipsClient.dll] [Thunder Networking Technologies,LTD, 2, 2, 9, 97]
[C:\Program Files\Thunder\Components\DownloadStat\DownloadStat.dll] [深圳市迅雷网络技术有限公司, 1, 3, 1, 4]
[C:\Program Files\Thunder\Components\Tips\XLIPC.DLL] [Thunder Networking Technologies,LTD, 1, 0, 0, 2]
[PID: 1608 / Administrator][d:\我的文档\桌面\sreng2\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 0, 3, 1011]
[d:\我的文档\桌面\sreng2\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1 localhost
==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 964, C:\WINDOWS\SYSTEM32\WINLOGON.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 2232, C:\PROGRAM FILES\ANTIARP\ANTIARP.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2232, C:\PROGRAM FILES\ANTIARP\ANTIARP.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 2268, C:\PROGRAM FILES\360SAFE\SAFEMON\360TRAY.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 4088, C:\PROGRAM FILES\THUNDER\PROGRAM\THUNDER5.EXE]
==================================
API HOOK
N/A
==================================
隐藏进程
N/A
==================================
****
※ ※ ※ 本文纯属【qx1984】个人意见，与【 微点交流论坛 】立场无关※ ※ ※
2008-3-24 09:42
images
银牌会员
积分 1429
发帖 1376
注册 2007-11-17
#8
访问内网网页后查看下源文件，看看是否存在可以代码；
看看中毒的主机与其他主机是否系统版本相同且同时修补了最新的系统补丁；
暂时在hosts文件里面屏蔽掉这个域名
127.0.0.1 可疑网址
※ ※ ※ 本文纯属【images】个人意见，与【 微点交流论坛 】立场无关※ ※ ※
All accepted English
For a slim figure, share your food with the hungry.
给images发短消息
2008-3-24 10:12
Legend
超级版主
超级版主
积分 77171
发帖 70170
注册 2005-10-29
#9
由于没有收到楼主进一步的反馈信息，本主题暂作关闭处理，如有问题，请另开新帖讨论。
※文章所有权归【Legend】与【东方微点论坛】共同所有，转载请注明出处！※
微点官方认证新浪微博：欢迎进入
微点新浪微博
微点技术支持邮箱:
support@micropoint.com.cn
给Legend发短消息
2008-4-3 11:55
论坛跳转:
微点软件公测区
安全快报
> 病毒快报
> 漏洞快报
微点产品在线技术支持
> 微点主动防御软件
> 预升级反馈专区
> 微点杀毒软件
微点用户交流区
> 微点新闻
> 微点软件使用交流
> 微点茶室
安全技术交流区
> 主动防御
> 反病毒
> 防火墙
综合区
> 电脑&数码
> 体育&娱乐&休闲
> 灌水区
版务管理
内部使用专区
可打印版本
|
推荐
|
订阅
|
收藏
[
联系我们
-
东方微点
]
北京东方微点信息技术有限责任公司 福建东方微点信息安全有限责任公司
闽ICP备05030815号
