首页    技术博客    PHP教程    数据库技术    前端开发   HTML5    Nginx    php论坛
新用户注册 | 会员登录
加入会员，解锁专属内容
取消
热门标签 | HotTags
当前位置:  开发笔记 > 编程语言 > 正文

winyyy.sys,hcpidesk.sys,mtlrd.sys,uldfhjfh.sys,servets.exe等1：

作者：冰点youth | 来源：互联网 | 2023-09-23 16:17
本文主要介绍关于人工智能,shell的知识点，对【winyyy.sys,hcpidesk.sys,mtlrd.sys,uldfhjfh.sys,servets.exe等1】和【】有兴趣的朋友可以看下由

本文主要介绍关于人工智能,shell的知识点，对【winyyy.sys,hcpidesk.sys,mtlrd.sys,uldfhjfh.sys,servets.exe等1】和【】有兴趣的朋友可以看下由【iteye_6637】投稿的技术文章，希望该技术和经验能帮到你解决你所遇的【】相关技术问题。

winyyy.sys,hcpidesk.sys,mtlrd.sys,uldfhjfh.sys,servets.exe等1

endurer 原创
2009-11-19 第1版

一位朋友的电脑最近开机速度很慢，而且有QQ提示框说“您的QQ号已经被系统选取为【10周年庆典】的二等奖获得者”

很多程序运行不了，请偶帮忙检修。


用 pe_xscan 扫描 log 并分析，发现如下可疑项（进程模块部分有省略）：

pe_xscan 09-06-21 by Purple Endurer
2009-11-10 19:49:16
Windows XP Service Pack 3(5.1.2600)
MSIE:6.0.2900.5512
管理员用户组
正常模式
[System Process] * 0 
　　C:/WINDOWS/system32/kb110172630.dll | 2009-11-10 17:26:30 
　　C:/WINDOWS/system32/kb210172648.dll | 2009-11-10 17:26:48 
　　C:/WINDOWS/system32/kb510172916.dll | 2009-11-10 17:29:17 
　　C:/WINDOWS/Fonts/kb28192213.dll | 2009-11-8 19:22:13 
　　C:/WINDOWS/Fonts/kb48192251.dll | 2009-11-8 19:22:51 
　　C:/WINDOWS/Fonts/kb2923529.dll | 2009-11-9 2:35:29 
　　C:/WINDOWS/Fonts/kb410172748.dll | 2009-11-10 17:27:48 
　　C:/WINDOWS/Fonts/kb5923711.dll | 2009-11-9 2:37:11 
　　C:/Program Files/Internet Explorer/sdk2.dll | 2009-11-10 11:59:20 
　　C:/Documents and Settings/Administrator/Application Data/Spy009.dll | 2009-11-9 2:41:52 
　　C:/WINDOWS/system32/JMq7bpeR4Xa8eV5ftCB.inf | 2009-11-1 23:44:52 
　　C:/WINDOWS/system32/RXNK8eR3xW8KTCWBCGTbqm.inf | 2009-11-10 11:17:32 
　　C:/WINDOWS/system32/A2CbFrBy28J6zdXNZgqCtJ6Ae.inf | 2009-10-29 2:13:52 
　　C:/WINDOWS/Downloaded Program Files/AnXnubyMnv58c9vaECWX.cur | 2009-10-29 2:14:2 
　　C:/WINDOWS/Downloaded Program Files/uBwdaS5QeRv5fUyk7etsUNqVEjT.cur | 2009-10-29 2:14:20 
　　C:/WINDOWS/Tasks/Wfayv6njQnCsg.inf | 2009-10-30 2:2:52 
　　C:/WINDOWS/Tasks/4H5HJTHFZkxrCpehBpx4TmR.inf | 2009-10-29 1:47:10 
　　C:/WINDOWS/system32/BtmBAnd89jc9PsPq5EKNj.inf | 2009-10-26 18:43:28 
　　C:/WINDOWS/system32/WQVBYhAJ6ADw5qzCY8gv84KTH.inf | 2009-10-26 18:41:40 
　　C:/WINDOWS/system32/qzp3jTZCSfSh.dll | 2009-10-26 18:41:2 
　　C:/WINDOWS/Downloaded Program Files/rJaeKv7CcbwSzhQbDu.cur | 2009-10-26 18:41:22 
　　C:/WINDOWS/Tasks/yGfdVUegEQm9fhY5rnN.inf | 2009-10-26 18:40:14 
　　C:/WINDOWS/fonts/A97CRaCB.fon | 2009-10-26 18:39:42 
　　C:/WINDOWS/system32/bWxJAeWKDxgRfhkaWEfA33C36nr.inf | 2009-10-26 18:38:54 
　　C:/WINDOWS/system32/08223B03.dll | 2009-10-26 18:38:20 
　　C:/WINDOWS/Downloaded Program Files/gxrSG8sdA4hAbGNQXnr9JGFu6nZ.cur | 2009-10-26 18:37:28 
　　C:/WINDOWS/system32/FsmBY3kmWnAG5gRbwGgU.inf | 2009-10-26 18:37:12 
　　C:/WINDOWS/Tasks/TDz5y2TEAKw2z7xkPhf9Sqj.inf | 2009-10-26 18:36:56 
　　C:/WINDOWS/system32/2exJW3dsaTgWrf5uAPadmHN.dll | 2009-10-26 18:36:4 
　　C:/WINDOWS/Downloaded Program Files/WUstNjhyfQfpv8PQbC.cur | 2009-10-26 18:36:22 
　　C:/WINDOWS/Downloaded Program Files/SjRjQgREDp3P8B4rEEg.cur | 2009-10-26 18:35:20 
　　C:/WINDOWS/Tasks/c2nH4numz9knY5zqnC.inf | 2009-10-26 18:35:34 
　　C:/WINDOWS/system32/BhfwdJchYBNmD25PSCxza.inf | 2009-10-26 18:35:6 
　　C:/WINDOWS/Downloaded Program Files/NnjrQW5EUm9zePgHXM2eB44E.cur | 2009-10-26 18:34:36 
　　C:/WINDOWS/system32/PERrGx5DkqSbQdwauCRQH.dll | 2009-10-26 18:34:52 
　　C:/WINDOWS/Tasks/zUzgU8WWpYntt6NfUWT.inf | 2009-11-10 11:30:6 
C:/WINDOWS/System32/winlogon.exe* 540 | 2007-6-1 0:0:0 | Microsoft(R) Windows(R) Operating System | 5.1.2600.5512 | Windows NT Logon Application | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.5512 (xpsp.080413-2113) | Microsoft Corporation| ? | winlogon | WINLOGON.EXE 
　　C:/WINDOWS/system32/kb11011166.dll | 2009-11-10 11:16:6 
　　C:/WINDOWS/system32/kb210111617.dll | 2009-11-10 11:16:18 
　　C:/WINDOWS/system32/kb510111719.dll | 2009-11-10 11:17:20 
　　C:/WINDOWS/Tasks/zUzgU8WWpYntt6NfUWT.inf | 2009-11-10 11:30:6 
　　C:/WINDOWS/Fonts/kb28192213.dll | 2009-11-8 19:22:13 
　　C:/WINDOWS/Fonts/kb48192251.dll | 2009-11-8 19:22:51 
　　C:/WINDOWS/Fonts/kb2923529.dll | 2009-11-9 2:35:29 
　　C:/WINDOWS/Fonts/kb410111652.dll | 2009-11-10 11:16:52 
　　C:/WINDOWS/Fonts/kb5923711.dll | 2009-11-9 2:37:11 
　　C:/WINDOWS/system32/winlib .dll
　　C:/WINDOWS/system32/COMRes.dll | 2009-11-6 20:56:2

　　C:/WINDOWS/system32/syslib .dll 
　　C:/WINDOWS/system32/kb110172630.dll | 2009-11-10 17:26:30 
　　C:/WINDOWS/system32/kb210172648.dll | 2009-11-10 17:26:48 
　　C:/WINDOWS/system32/kb510172916.dll | 2009-11-10 17:29:17 
　　C:/WINDOWS/Tasks/JJX5r8wnsqUnNxGwpwn.inf | 2009-10-26 18:34:22 
　　C:/WINDOWS/Downloaded Program Files/NnjrQW5EUm9zePgHXM2eB44E.cur | 2009-10-26 18:34:36 
　　C:/WINDOWS/system32/PERrGx5DkqSbQdwauCRQH.dll | 2009-10-26 18:34:52 
　　C:/WINDOWS/system32/BhfwdJchYBNmD25PSCxza.inf | 2009-10-26 18:35:6 
　　C:/WINDOWS/Downloaded Program Files/SjRjQgREDp3P8B4rEEg.cur | 2009-10-26 18:35:20 
　　C:/WINDOWS/Tasks/c2nH4numz9knY5zqnC.inf | 2009-10-26 18:35:34 
　　C:/WINDOWS/system32/SCEVFJRCmaB7.dll | 2009-10-26 18:35:50 
　　C:/WINDOWS/system32/2exJW3dsaTgWrf5uAPadmHN.dll | 2009-10-26 18:36:4 
　　C:/WINDOWS/Downloaded Program Files/WUstNjhyfQfpv8PQbC.cur | 2009-10-26 18:36:22 
　　C:/WINDOWS/system32/ndxq9awMc.dll | 2009-10-26 18:36:36 
　　C:/WINDOWS/Tasks/TDz5y2TEAKw2z7xkPhf9Sqj.inf | 2009-10-26 18:36:56 
　　C:/WINDOWS/system32/FsmBY3kmWnAG5gRbwGgU.inf | 2009-10-26 18:37:12 
　　C:/WINDOWS/Downloaded Program Files/gxrSG8sdA4hAbGNQXnr9JGFu6nZ.cur | 2009-10-26 18:37:28 
　　C:/WINDOWS/Downloaded Program Files/sZaeAC74EzXJeVeJu6p.cur | 2009-10-26 18:37:42 
　　C:/WINDOWS/system32/08223B03.dll | 2009-10-26 18:38:20 
　　C:/WINDOWS/system32/z6FVkEF47huPzgaXee.inf | 2009-10-26 18:38:38 
　　C:/WINDOWS/system32/bWxJAeWKDxgRfhkaWEfA33C36nr.inf | 2009-10-26 18:38:54 
　　C:/WINDOWS/system32/122B901E.dll | 2009-10-26 18:39:10 
　　C:/WINDOWS/Tasks/SbrmpxjdCrgRAFhz4gHh.inf | 2009-10-26 18:39:26 
　　C:/WINDOWS/fonts/A97CRaCB.fon | 2009-10-26 18:39:42 
　　C:/WINDOWS/fonts/SD78dgC7hD2sktQHyAu.fon | 2009-10-26 18:39:58 
　　C:/WINDOWS/Tasks/yGfdVUegEQm9fhY5rnN.inf | 2009-10-26 18:40:14 
　　C:/WINDOWS/system32/t9hdtMrwMeQcvYV3CMvhtNZpC.inf | 2009-10-26 18:40:30 
　　C:/WINDOWS/system32/qzp3jTZCSfSh.dll | 2009-10-26 18:41:2 
　　C:/WINDOWS/Downloaded Program Files/rJaeKv7CcbwSzhQbDu.cur | 2009-10-26 18:41:22 
　　C:/WINDOWS/system32/WQVBYhAJ6ADw5qzCY8gv84KTH.inf | 2009-10-26 18:41:40 
　　C:/WINDOWS/system32/BtmBAnd89jc9PsPq5EKNj.inf | 2009-10-26 18:43:28 
　　C:/WINDOWS/system32/AMNCZw74h8gwd6CpYGkrZDy8.inf | 2009-10-29 2:13:48 
　　C:/WINDOWS/Tasks/4H5HJTHFZkxrCpehBpx4TmR.inf | 2009-10-29 1:47:10 
　　C:/WINDOWS/system32/A2CbFrBy28J6zdXNZgqCtJ6Ae.inf | 2009-10-29 2:13:52 
　　C:/WINDOWS/Downloaded Program Files/AnXnubyMnv58c9vaECWX.cur | 2009-10-29 2:14:2 
　　C:/WINDOWS/Downloaded Program Files/uBwdaS5QeRv5fUyk7etsUNqVEjT.cur | 2009-10-29 2:14:20 
　　C:/WINDOWS/Tasks/Wfayv6njQnCsg.inf | 2009-10-30 2:2:52 
　　C:/WINDOWS/system32/EMQzJJURMfVkrkEx9GJ.inf | 2009-10-30 10:32:12 
　　C:/WINDOWS/system32/ujMhyGsS7tRV9gU2HHMkJcu7DPU.inf | 2009-11-2 1:10:32 
　　C:/WINDOWS/system32/JMq7bpeR4Xa8eV5ftCB.inf | 2009-11-1 23:44:52 
　　C:/WINDOWS/system32/jY8sGUnWqbZb3x2BPhY.dll | 2009-11-2 1:11:54 
　　C:/Documents and Settings/Administrator/Application Data/Spy009.dll | 2009-11-9 2:41:52 
　　C:/Program Files/Internet Explorer/sdk2.dll | 2009-11-10 11:59:20 
　　C:/WINDOWS/system32/pEcFwPj48y6DADf87r.inf | 2009-11-7 11:6:12 
　　C:/WINDOWS/Fonts/kb410172748.dll | 2009-11-10 17:27:48 
　　C:/WINDOWS/system32/RXNK8eR3xW8KTCWBCGTbqm.inf | 2009-11-10 11:17:32 
　　C:/WINDOWS/fonts/AN2Epfv2VzeHreV.fon | 2009-11-10 11:32:42 
　　C:/WINDOWS/system32/CDuAUVkGy9.dll | 2009-11-10 11:33:4 
C:/WINDOWS/System32/services.exe* 648 | 2009-2-9 19:21:0 | Microsoft(R) Windows(R) Operating System | 5.1.2600.5755 | Services and Controller app | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.5755 (xpsp_sp3_gdr.090206-1234) | Microsoft Corporation| ? | services.exe | services.exe 
　　C:/WINDOWS/system32/kb11011166.dll | 2009-11-10 11:16:6 
　　C:/WINDOWS/system32/kb210111617.dll | 2009-11-10 11:16:18 
　　C:/WINDOWS/system32/kb510111719.dll | 2009-11-10 11:17:20 
　　C:/WINDOWS/Tasks/zUzgU8WWpYntt6NfUWT.inf | 2009-11-10 11:30:6 
　　C:/WINDOWS/Fonts/kb28192213.dll | 2009-11-8 19:22:13 
　　C:/WINDOWS/Fonts/kb48192251.dll | 2009-11-8 19:22:51 
　　C:/WINDOWS/Fonts/kb2923529.dll | 2009-11-9 2:35:29 
　　C:/WINDOWS/Fonts/kb410111652.dll | 2009-11-10 11:16:52 
　　C:/WINDOWS/Fonts/kb5923711.dll | 2009-11-9 2:37:11 
　　C:/WINDOWS/system32/kb110172630.dll | 2009-11-10 17:26:30 
　　C:/WINDOWS/system32/kb210172648.dll | 2009-11-10 17:26:48 
　　C:/WINDOWS/system32/kb510172916.dll | 2009-11-10 17:29:17 
C:/WINDOWS/System32/lsass.exe * 660 | 2007-6-1 0:0:0 | Microsoft? Windows? Operating System | 5.1.2600.5512 | LSA Shell (Export Version) | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5512 (xpsp.080413-2113) | Microsoft Corporation| ? | lsass.exe | lsass.exe 
　　C:/WINDOWS/system32/kb11011166.dll | 2009-11-10 11:16:6 
　　C:/WINDOWS/system32/kb210111617.dll | 2009-11-10 11:16:18 
　　C:/WINDOWS/system32/kb510111719.dll | 2009-11-10 11:17:20 
　　C:/WINDOWS/Tasks/zUzgU8WWpYntt6NfUWT.inf | 2009-11-10 11:30:6 
　　C:/WINDOWS/Fonts/kb28192213.dll | 2009-11-8 19:22:13 
　　C:/WINDOWS/Fonts/kb48192251.dll | 2009-11-8 19:22:51 
　　C:/WINDOWS/Fonts/kb2923529.dll | 2009-11-9 2:35:29 
　　C:/WINDOWS/Fonts/kb410111652.dll | 2009-11-10 11:16:52 
　　C:/WINDOWS/Fonts/kb5923711.dll | 2009-11-9 2:37:11 
　　C:/WINDOWS/system32/kb110172630.dll | 2009-11-10 17:26:30 
　　C:/WINDOWS/system32/kb210172648.dll | 2009-11-10 17:26:48 
　　C:/WINDOWS/system32/kb510172916.dll | 2009-11-10 17:29:17 
C:/WINDOWS/System32/svchost.exe * 956 | 2007-6-1 0:0:0 | Microsoft? Windows? Operating System | 5.1.2600.5512 | Generic Host Process for Win32 Services | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5512 (xpsp.080413-2111) | Microsoft Corporation| ? | svchost.exe | svchost.exe 
　　C:/WINDOWS/system32/kb11011166.dll | 2009-11-10 11:16:6 
　　C:/WINDOWS/system32/kb210111617.dll | 2009-11-10 11:16:18 
　　C:/WINDOWS/system32/kb510111719.dll | 2009-11-10 11:17:20 
　　C:/WINDOWS/Tasks/zUzgU8WWpYntt6NfUWT.inf | 2009-11-10 11:30:6 
　　C:/WINDOWS/Fonts/kb28192213.dll | 2009-11-8 19:22:13 
　　C:/WINDOWS/Fonts/kb48192251.dll | 2009-11-8 19:22:51 
　　C:/WINDOWS/Fonts/kb2923529.dll | 2009-11-9 2:35:29 
　　C:/WINDOWS/Fonts/kb410111652.dll | 2009-11-10 11:16:52 
　　C:/WINDOWS/Fonts/kb5923711.dll | 2009-11-9 2:37:11
 　　C:/WINDOWS/system32/COMRes.dll | 2009-11-6 20:56:2
　　C:/WINDOWS/system32/kb110172630.dll | 2009-11-10 17:26:30 
　　C:/WINDOWS/system32/kb210172648.dll | 2009-11-10 17:26:48 
　　C:/WINDOWS/system32/kb510172916.dll | 2009-11-10 17:29:17 
C:/WINDOWS/System32/conime.exe * 1996 | 2007-6-1 0:0:0 | Microsoft? Windows? Operating System | 5.1.2600.5512 | Console IME | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5512 (xpsp.080413-2105) | Microsoft Corporation| ? | Console | CONIME.EXE 
　　C:/WINDOWS/Tasks/zUzgU8WWpYntt6NfUWT.inf | 2009-11-10 11:30:6 
　　C:/WINDOWS/Fonts/kb28192213.dll | 2009-11-8 19:22:13 
　　C:/WINDOWS/Fonts/kb48192251.dll | 2009-11-8 19:22:51 
　　C:/WINDOWS/Fonts/kb2923529.dll | 2009-11-9 2:35:29 
　　C:/WINDOWS/Fonts/kb410111652.dll | 2009-11-10 11:16:52 
　　C:/WINDOWS/system32/kb11011166.dll | 2009-11-10 11:16:6 
　　C:/WINDOWS/system32/kb210111617.dll | 2009-11-10 11:16:18 
　　C:/WINDOWS/system32/kb510111719.dll | 2009-11-10 11:17:20 
　　C:/WINDOWS/Fonts/kb5923711.dll | 2009-11-9 2:37:11 
　　C:/Documents and Settings/Administrator/Application Data/Spy009.dll | 2009-11-9 2:41:52 
　　C:/WINDOWS/system32/JMq7bpeR4Xa8eV5ftCB.inf | 2009-11-1 23:44:52 
　　C:/WINDOWS/system32/RXNK8eR3xW8KTCWBCGTbqm.inf | 2009-11-10 11:17:32 
　　C:/WINDOWS/system32/A2CbFrBy28J6zdXNZgqCtJ6Ae.inf | 2009-10-29 2:13:52 
　　C:/WINDOWS/Downloaded Program Files/AnXnubyMnv58c9vaECWX.cur | 2009-10-29 2:14:2 
　　C:/WINDOWS/Downloaded Program Files/uBwdaS5QeRv5fUyk7etsUNqVEjT.cur | 2009-10-29 2:14:20 
　　C:/WINDOWS/Tasks/Wfayv6njQnCsg.inf | 2009-10-30 2:2:52 
　　C:/WINDOWS/Tasks/4H5HJTHFZkxrCpehBpx4TmR.inf | 2009-10-29 1:47:10 
　　C:/WINDOWS/system32/BtmBAnd89jc9PsPq5EKNj.inf | 2009-10-26 18:43:28 
　　C:/WINDOWS/system32/WQVBYhAJ6ADw5qzCY8gv84KTH.inf | 2009-10-26 18:41:40 
　　C:/WINDOWS/system32/qzp3jTZCSfSh.dll | 2009-10-26 18:41:2 
　　C:/WINDOWS/Downloaded Program Files/rJaeKv7CcbwSzhQbDu.cur | 2009-10-26 18:41:22 
　　C:/WINDOWS/Tasks/yGfdVUegEQm9fhY5rnN.inf | 2009-10-26 18:40:14 
　　C:/WINDOWS/fonts/A97CRaCB.fon | 2009-10-26 18:39:42 
　　C:/WINDOWS/system32/bWxJAeWKDxgRfhkaWEfA33C36nr.inf | 2009-10-26 18:38:54 
　　C:/WINDOWS/system32/08223B03.dll | 2009-10-26 18:38:20 
　　C:/WINDOWS/Downloaded Program Files/gxrSG8sdA4hAbGNQXnr9JGFu6nZ.cur | 2009-10-26 18:37:28 
　　C:/WINDOWS/system32/FsmBY3kmWnAG5gRbwGgU.inf | 2009-10-26 18:37:12 
　　C:/WINDOWS/Tasks/TDz5y2TEAKw2z7xkPhf9Sqj.inf | 2009-10-26 18:36:56 
　　C:/WINDOWS/system32/2exJW3dsaTgWrf5uAPadmHN.dll | 2009-10-26 18:36:4 
　　C:/WINDOWS/Downloaded Program Files/WUstNjhyfQfpv8PQbC.cur | 2009-10-26 18:36:22 
　　C:/WINDOWS/Downloaded Program Files/SjRjQgREDp3P8B4rEEg.cur | 2009-10-26 18:35:20 
　　C:/WINDOWS/Tasks/c2nH4numz9knY5zqnC.inf | 2009-10-26 18:35:34 
　　C:/WINDOWS/system32/BhfwdJchYBNmD25PSCxza.inf | 2009-10-26 18:35:6 
　　C:/WINDOWS/Downloaded Program Files/NnjrQW5EUm9zePgHXM2eB44E.cur | 2009-10-26 18:34:36 
　　C:/WINDOWS/system32/PERrGx5DkqSbQdwauCRQH.dll | 2009-10-26 18:34:52 
　　C:/Program Files/Internet Explorer/sdk2.dll | 2009-11-10 11:59:20 
C:/WINDOWS/smss.exe * 2272 | 2009-11-10 17:23:42 | Microsoft(R) Windows(R) Operating System | 5.2.3790.1830 | Generic Host Process for Win32 Services | (C) Microsoft Corporation. All rights reserved. | 5.2.3790.1830 | Microsoft Corporation | | rpcs.exe | rpcs.exe 
　　C:/WINDOWS/system32/kb11011166.dll | 2009-11-10 11:16:6 
　　C:/WINDOWS/system32/kb210111617.dll | 2009-11-10 11:16:18 
　　C:/WINDOWS/system32/kb510111719.dll | 2009-11-10 11:17:20 
　　C:/WINDOWS/Tasks/zUzgU8WWpYntt6NfUWT.inf | 2009-11-10 11:30:6 
　　C:/WINDOWS/Fonts/kb28192213.dll | 2009-11-8 19:22:13 
　　C:/WINDOWS/Fonts/kb48192251.dll | 2009-11-8 19:22:51 
　　C:/WINDOWS/Fonts/kb2923529.dll | 2009-11-9 2:35:29 
　　C:/WINDOWS/Fonts/kb410111652.dll | 2009-11-10 11:16:52 
　　C:/WINDOWS/Fonts/kb5923711.dll | 2009-11-9 2:37:11 
　　C:/WINDOWS/system32/kb110172630.dll | 2009-11-10 17:26:30 
　　C:/WINDOWS/system32/kb210172648.dll | 2009-11-10 17:26:48 
　　C:/WINDOWS/system32/kb510172916.dll | 2009-11-10 17:29:17 
C:/WINDOWS/explorer.exe * 9884 | 2007-6-1 0:0:0 | Microsoft(R) Windows(R) Operating System | 6.00.2900.5512 | Windows Explorer | (C) Microsoft Corporation. All rights reserved. | 6.00.2900.5512 (xpsp.080413-2105) | Microsoft Corporation| ? | explorer | EXPLORER.EXE 
　　C:/WINDOWS/system32/kb110172630.dll | 2009-11-10 17:26:30 
　　C:/WINDOWS/system32/kb210172648.dll | 2009-11-10 17:26:48 
　　C:/WINDOWS/system32/kb510172916.dll | 2009-11-10 17:29:17 
　　C:/WINDOWS/Tasks/zUzgU8WWpYntt6NfUWT.inf | 2009-11-10 11:30:6 
　　C:/WINDOWS/Fonts/kb28192213.dll | 2009-11-8 19:22:13 
　　C:/WINDOWS/Fonts/kb48192251.dll | 2009-11-8 19:22:51 
　　C:/WINDOWS/Fonts/kb2923529.dll | 2009-11-9 2:35:29 
　　C:/WINDOWS/Fonts/kb410172748.dll | 2009-11-10 17:27:48 
　　C:/WINDOWS/Fonts/kb5923711.dll | 2009-11-9 2:37:11
　　C:/WINDOWS/system32/COMRes.dll | 2009-11-6 20:56:2 
　　c:/windows/system32/wmitpfs.dll | 2009-10-30 10:38:4 
　　C:/WINDOWS/Tasks/JJX5r8wnsqUnNxGwpwn.inf | 2009-10-26 18:34:22 
　　C:/WINDOWS/Downloaded Program Files/NnjrQW5EUm9zePgHXM2eB44E.cur | 2009-10-26 18:34:36 
　　C:/WINDOWS/system32/PERrGx5DkqSbQdwauCRQH.dll | 2009-10-26 18:34:52 
　　C:/WINDOWS/system32/BhfwdJchYBNmD25PSCxza.inf | 2009-10-26 18:35:6 
　　C:/WINDOWS/Downloaded Program Files/SjRjQgREDp3P8B4rEEg.cur | 2009-10-26 18:35:20 
　　C:/WINDOWS/Tasks/c2nH4numz9knY5zqnC.inf | 2009-10-26 18:35:34 
　　C:/WINDOWS/system32/SCEVFJRCmaB7.dll | 2009-10-26 18:35:50 
　　C:/WINDOWS/system32/2exJW3dsaTgWrf5uAPadmHN.dll | 2009-10-26 18:36:4 
　　C:/WINDOWS/Downloaded Program Files/WUstNjhyfQfpv8PQbC.cur | 2009-10-26 18:36:22 
　　C:/WINDOWS/system32/ndxq9awMc.dll | 2009-10-26 18:36:36 
　　C:/WINDOWS/Tasks/TDz5y2TEAKw2z7xkPhf9Sqj.inf | 2009-10-26 18:36:56 
　　C:/WINDOWS/system32/FsmBY3kmWnAG5gRbwGgU.inf | 2009-10-26 18:37:12 
　　C:/WINDOWS/Downloaded Program Files/gxrSG8sdA4hAbGNQXnr9JGFu6nZ.cur | 2009-10-26 18:37:28 
　　C:/WINDOWS/Downloaded Program Files/sZaeAC74EzXJeVeJu6p.cur | 2009-10-26 18:37:42 
　　C:/WINDOWS/system32/08223B03.dll | 2009-10-26 18:38:20 
　　C:/WINDOWS/system32/z6FVkEF47huPzgaXee.inf | 2009-10-26 18:38:38 
　　C:/WINDOWS/system32/bWxJAeWKDxgRfhkaWEfA33C36nr.inf | 2009-10-26 18:38:54 
　　C:/WINDOWS/system32/122B901E.dll | 2009-10-26 18:39:10 
　　C:/WINDOWS/Tasks/SbrmpxjdCrgRAFhz4gHh.inf | 2009-10-26 18:39:26 
　　C:/WINDOWS/fonts/A97CRaCB.fon | 2009-10-26 18:39:42 
　　C:/WINDOWS/fonts/SD78dgC7hD2sktQHyAu.fon | 2009-10-26 18:39:58 
　　C:/WINDOWS/Tasks/yGfdVUegEQm9fhY5rnN.inf | 2009-10-26 18:40:14 
　　C:/WINDOWS/system32/t9hdtMrwMeQcvYV3CMvhtNZpC.inf | 2009-10-26 18:40:30 
　　C:/WINDOWS/system32/qzp3jTZCSfSh.dll | 2009-10-26 18:41:2 
　　C:/WINDOWS/Downloaded Program Files/rJaeKv7CcbwSzhQbDu.cur | 2009-10-26 18:41:22 
　　C:/WINDOWS/system32/WQVBYhAJ6ADw5qzCY8gv84KTH.inf | 2009-10-26 18:41:40 
　　C:/WINDOWS/system32/BtmBAnd89jc9PsPq5EKNj.inf | 2009-10-26 18:43:28 
　　C:/WINDOWS/system32/AMNCZw74h8gwd6CpYGkrZDy8.inf | 2009-10-29 2:13:48 
　　C:/WINDOWS/Tasks/4H5HJTHFZkxrCpehBpx4TmR.inf | 2009-10-29 1:47:10 
　　C:/WINDOWS/system32/A2CbFrBy28J6zdXNZgqCtJ6Ae.inf | 2009-10-29 2:13:52 
　　C:/WINDOWS/Downloaded Program Files/AnXnubyMnv58c9vaECWX.cur | 2009-10-29 2:14:2 
　　C:/WINDOWS/Downloaded Program Files/uBwdaS5QeRv5fUyk7etsUNqVEjT.cur | 2009-10-29 2:14:20 
　　C:/WINDOWS/Tasks/Wfayv6njQnCsg.inf | 2009-10-30 2:2:52 
　　C:/WINDOWS/system32/EMQzJJURMfVkrkEx9GJ.inf | 2009-10-30 10:32:12 
　　C:/WINDOWS/system32/ujMhyGsS7tRV9gU2HHMkJcu7DPU.inf | 2009-11-2 1:10:32 
　　C:/WINDOWS/system32/JMq7bpeR4Xa8eV5ftCB.inf | 2009-11-1 23:44:52 
　　C:/WINDOWS/system32/jY8sGUnWqbZb3x2BPhY.dll | 2009-11-2 1:11:54 
　　C:/Documents and Settings/Administrator/Application Data/Spy009.dll | 2009-11-9 2:41:52 
　　C:/Program Files/Internet Explorer/sdk2.dll | 2009-11-10 11:59:20 
　　C:/WINDOWS/system32/pEcFwPj48y6DADf87r.inf | 2009-11-7 11:6:12 
　　C:/WINDOWS/system32/RXNK8eR3xW8KTCWBCGTbqm.inf | 2009-11-10 11:17:32 
　　C:/WINDOWS/fonts/AN2Epfv2VzeHreV.fon | 2009-11-10 11:32:42 
　　C:/WINDOWS/system32/CDuAUVkGy9.dll | 2009-11-10 11:33:4 
F2 - REG: system.ini: UserInit =＜C:/WINDOWS/system32/userinit.exe,＞| 2007-6-1 0:0:0 
O1 - Hosts: 98．126．44．146 show．qq．com
O1 - Hosts: 98．126．122．106 bbs1．qq．com
O1 - Hosts: 98．126．44．146 music．qq．com
O1 - Hosts: 98．126．44．146 minix．soso．com
O1 - Hosts: 98．126．44．146 ic．qzone．qq．com
O1 - Hosts: 98．126．44．146 adsclick．qq．com
O1 - Hosts: 98．126．122．106 adsfile．qq．com
O1 - Hosts: 98．126．122．106 adsview．qq．com
O1 - Hosts: 98．126．122．106 minigame．qq．com
O1 - Hosts: 127．1．1．1 xb520dx．kmip．net
O1 - Hosts: 127．1．1．1 dxz．974671．com
O1 - Hosts: 127．1．1．1 www．dy2004．com
O1 - Hosts: 127．1．1．1 www．114Baines．com
O1 - Hosts: 127．1．1．1 tj．3800down．com
O1 - Hosts: 127．1．1．1 a6tt4．114anhui．com
O1 - Hosts: 127．1．1．1 ak．114anhui．com
O1 - Hosts: 127．1．1．1 wwd．243542．com
O1 - Hosts: 127．1．1．1 w8．lao998．com
O1 - Hosts: 127．1．1．1 nhy7ubgv．114anhui．com
O1 - Hosts: 127．1．1．1 g6tt4．114anhui．com
O1 - Hosts: 127．1．1．1 x．qingsewuyuet．cn
O1 - Hosts: 127．1．1．1 www．114Baines．com
O1 - Hosts: 127．1．1．1 ok3．114graph．com
O1 - Hosts: 127．1．1．1 nhy7ubgv．114anhui．com
O1 - Hosts: 127．1．1．1 www．ok182．com
O1 - Hosts: 127．1．1．1 down．my227．com
O1 - Hosts: 127．1．1．1 n1xln1l1nx．3322．org
O1 - Hosts: 127．1．1．1 txt119．kmip．net
O1 - Hosts: 127．1．1．1 126．123fga．cn
O1 - Hosts: 127．1．1．1 ya．com．9d1u．cn
O1 - Hosts: 127．1．1．1 demo．jikesoft．cn
O1 - Hosts: 127．1．1．1 bmw8x．cn
O1 - Hosts: 127．1．1．1 mck．o0oq．cn
O1 - Hosts: 127．1．1．1 0．9d3f．cn
O1 - Hosts: 127．1．1．1 www．114baines．com
O1 - Hosts: 127．0．1．1 zsmdo．cn
O1 - Hosts: 127．1．1．1 wwd．976777．com
O1 - Hosts: 127．1．1．1 www．tt2sf．net
O1 - Hosts: 127．1．1．1 msn．com．9d1u．cn
O1 - Hosts: 127．1．1．1 ll．wwooaini88．com
O1 - Hosts: 127．1．1．1 jh．jhjsyehxkd．cn
O1 - Hosts: 127．1．1．1 kcs．cn
O1 - Hosts: 127．1．1．1 mck．o0oq．cn
O1 - Hosts: 127．1．1．1 x．moneyinfom．com
O1 - Hosts: 127．1．1．1 1．888888ok．com．cn
O1 - Hosts: 127．1．1．1 3w．97sesewww．cn
O1 - Hosts: 127．0．0．1 b．nmbrx．com
O1 - Hosts: 222．189．238．40 adsclick．qq．com
O1 - Hosts: 222．189．238．40 adsview．qq．com
O1 - Hosts: 222．189．238．40 bbs1．qq．com
O1 - Hosts: 222．189．238．40 ic．qzone．qq．com
O1 - Hosts: 222．189．238．40 minigame．qq．com
O1 - Hosts: 222．189．238．40 minix．soso．com
O1 - Hosts: 222．189．238．40 music．qq．com
O1 - Hosts: 222．189．238．40 show．qq．com
O1 - Hosts: 222．189．238．40 www．yxnpc．com
O1 - Hosts: 222．189．238．40 www2．im．alisoft．com
O1 - Hosts: 222．189．238．40 file．fetion．chinacache．neL
O1 - Hosts: 222．189．238．40 adsview．qq．com
O1 - Hosts: 222．189．238．40 bbs1．qq．com
O1 - Hosts: 222．189．238．40 ic．qzone．qq．com
O1 - Hosts: 222．189．238．40 minigame．qq．com
O1 - Hosts: 222．189．238．40 minix．soso．com
O1 - Hosts: 222．189．238．40 music．qq．com
O1 - Hosts: 222．189．238．40 show．qq．com
O1 - Hosts: 222．189．238．40 www．yxnpc．com
O1 - Hosts: 222．189．238．40 www2．im．alisoft．com
O1 - Hosts: 222．189．238．40 file．fetion．chinacache．net?
O1 - Hosts: 222．189．238．40 bbs1．qq．com
O1 - Hosts: 222．189．238．40 ic．qzone．qq．com
O1 - Hosts: 222．189．238．40 minigame．qq．com
O1 - Hosts: 222．189．238．40 minix．soso．com
O1 - Hosts: 222．189．238．40 music．qq．com
O1 - Hosts: 222．189．238．40 show．qq．com
O1 - Hosts: 222．189．238．40 www．yxnpc．com
O1 - Hosts: 222．189．238．40 www2．im．alisoft．com
O1 - Hosts: 222．189．238．40 file．fetion．chi
O2 - BHO CAdLogic Object - {11F09AFD-75AD-4E51-AB43-E09E9351CE16} =C:/Program Files/Common Files/PushWare/cpush.dll | 2009-11-9 14:40:52| ? | 1.1.6.2| ?| ? | 1.1.6.2| ?| ? | softpush.dll | softpush.dll 
O2 - BHO google cache - {296AB1C7-FB22-4D17-8834-064E2BA0A6F0} =C:/WINDOWS/MICROSOFT/winsys.dll | 2007-3-15 2:32:20 | | 2. 3, 0, 2 | Windows Services Module | | 2. 3, 0, 2 | Hello Loons.Fad | | | Beijing zhongguancun 
O4 - HKCU/../run: [msconfigs]C:/WINDOWS/system32/TnvTy.exe
O4 - HKLM/../run: [system]C:/WINDOWS/system32/system.exe
O4 - HKLM/../run: [Trough]C:/WINDOWS/system32/TroughClient.exe 0
O4 - HKLM/../run: [RsTray]C:/WINDOWS/system32/scvhost.exe
O4 - HKLM/../run: [msconfigs]C:/WINDOWS/system32/TnvTy.exe
O4 - HKLM/../run: [aowii_19831028_game] "c:/windows/system32/jmodirwgq.exe" -at
O4 - HKLM/../run: [aowii_19831028_sogouip] "c:/windows/system32/rqtvfpyiy.exe" -at
O4 - HKLM/../run: [autorun_19831028_kingsoftgo] "c:/windows/system32/qsrvucimrd.exe" -at
At1.job 
At2.job 
At3.job 
At4.job 
At5.job 
At6.job 
At7.job 
At8.job 
At9.job 
O20 - AppInit_DLLs =C:/WINDOWS/Tasks/zUzgU8WWpYntt6NfUWT.inf ,C:/WINDOWS/Downloaded Program Files/uBwdaS5QeRv5fUyk7etsUNqVEjT.cur,C:/WINDOWS/Downloaded Program Files/rJaeKv7CcbwSzhQbDu.cur,C:/WINDOWS/Fonts/kb28192213.dll,C:/WINDOWS/Fonts/kb48192251.dll,C:/WINDOWS/Fonts/kb2923529.dll,C:/WINDOWS/Fonts/kb5923711.dll,C:/WINDOWS/Fonts/kb410172748.dll 
O23 - 服务: AmdK8 (AmdK8 Compatible Device) - System32/drivers/amdk8.sys | 2008-1-3 17:1:23 | AMD Processor Driver | 1.3.2 | AMD Processor Driver | Copyright (C) AMD, Inc.2002-2006 | 1.3.2 (dnsrv(wmbla).060701-2226) | Advanced Micro Devices| ? | AmdK8.sys | AmdK8.sys(手动) 
O23 - 服务: AsyncMac (RAS Asynchronous Media Driver) - system32/DRIVERS/asyncmac.sys (手动) 
O23 - 服务: hcpidesk (hcpidesk) -C:/WINDOWS/system32/drivers/hcpidesk.sys | 2009-11-10 11:39:36(自动) 

O23 - 服务: mtlrd (mtlrd) -C:/Documents and Settings/All Users/Application Data/Microsoft/Media Player/wmp/mtlrd.sys | 2009-9-25 17:18:22(自动) 
O23 - 服务: MyProt (Network Monitor Protocol Driver) - system32/DRIVERS/winyyy.sys | 2009-11-9 2:57:54 | Windows (R) 2000 DDK driver | 5.1.2600.2180 | NDIS User mode I/O Driver | | 5.1.2600.2180 built by: WinDDK | Windows (R) 2000 DDK provider| ? | NDISPROT.SYS | NDISPROT.SYS(手动) 
O23 - 服务: Netlogon (Net Logon) -C:/WINDOWS/system32/lsass.exe | 2007-6-1 0:0:0 | Microsoft? Windows? Operating System | 5.1.2600.5512 | LSA Shell (Export Version) | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5512 (xpsp.080413-2113) | Microsoft Corporation| ? | lsass.exe | lsass.exe(手动) 
O23 - 服务: NtLmSsp (NT LM Security Support Provider) -C:/WINDOWS/system32/lsass.exe | 2007-6-1 0:0:0 | Microsoft? Windows? Operating System | 5.1.2600.5512 | LSA Shell (Export Version) | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5512 (xpsp.080413-2113) | Microsoft Corporation| ? | lsass.exe | lsass.exe(手动) 
O23 - 服务: pcidump (pcidump) -C:/WINDOWS/system32/drivers/pcidump.sys (禁用) 
O23 - 服务: pnpmem (pnpmem) -C:/WINDOWS/system32/drivers/pnpmem.sys | 2009-11-10 12:23:51(自动) 
O23 - 服务: PolicyAgent (IPSEC Services) -C:/WINDOWS/system32/lsass.exe | 2007-6-1 0:0:0 | Microsoft? Windows? Operating System | 5.1.2600.5512 | LSA Shell (Export Version) | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5512 (xpsp.080413-2113) | Microsoft Corporation| ? | lsass.exe | lsass.exe(自动) 
O23 - 服务: ProtectedStorage (Protected Storage) -C:/WINDOWS/system32/lsass.exe | 2007-6-1 0:0:0 | Microsoft? Windows? Operating System | 5.1.2600.5512 | LSA Shell (Export Version) | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5512 (xpsp.080413-2113) | Microsoft Corporation| ? | lsass.exe | lsass.exe(自动) 
O23 - 服务: SamSs (Security Accounts Manager) -C:/WINDOWS/system32/lsass.exe | 2007-6-1 0:0:0 | Microsoft? Windows? Operating System | 5.1.2600.5512 | LSA Shell (Export Version) | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5512 (xpsp.080413-2113) | Microsoft Corporation| ? | lsass.exe | lsass.exe(自动) 
O23 - 服务: uldfhjfh (uldfhjfh) -C:/WINDOWS/system32/drivers/uldfhjfh.sys | 2009-11-10 11:35:10(系统) 
O23 - 服务: W32Time (Windows Time) -C:/WINDOWS/System32/svchost.exe -k netsvcs| 2007-6-1 0:0:0 | Microsoft? Windows? Operating System | 5.1.2600.5512 | Generic Host Process for Win32 Services | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5512 (xpsp.080413-2111) | Microsoft Corporation| ? | svchost.exe | svchost.exe 
　　->C:/WINDOWS/system32/Lang/tmcvomuigt.dll | 2009-11-10 11:38:48 | WinSVC | 2.8 | Time Windows | Microsoft LTD | 4.2.2.327 | Microsoft Corporation. | | 4.1.1.5 | (自动) 
O23 - 服务: Windowss (Removableo) -C:/WINDOWS/system32/servets.exe | 2009-11-10 11:34:32(自动) 
O23 - 服务: winhelp (winhelp) -c:/windows/system32/winhelp.exe | 2009-11-10 17:26:40(自动) 
O23 - 服务: winhelp32 (winhelp32) -c:/windows/system32/winhelp32.exe | 2009-11-10 11:36:52(自动) 
O23 - 服务: WinSCCOM (COM+ Windows System Server) -C:/WINDOWS/winsccoo.exe | 2009-11-10 12:0:0 | Microsoft(R) Windows(R) Operating System | 5.2.3790.1830 | Generic Host Process for Win32 Services | (C) Microsoft Corporation. All rights reserved. | 5.2.3790.1830 | Microsoft Corporation | | rpcs.exe | rpcs.exe(自动) 
O23 - 服务: wmitpfs (WMITPFS Service) -C:/WINDOWS/system32/svchost.exe -k wmitpfs | 2007-6-1 0:0:0 | Microsoft? Windows? Operating System | 5.1.2600.5512 | Generic Host Process for Win32 Services | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5512 (xpsp.080413-2111) | Microsoft Corporation| ? | svchost.exe | svchost.exe 
　　->C:/WINDOWS/system32/wmitpfs.dll | 2009-10-30 10:38:4(自动) 
O23 - 服务: xx (xx) -C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/~443475.ex (手动) 
O24 - ShlExecHook: [B] - {A2BCFCEE-C939-433F-A32A-7353A6E720DB} =C:/WINDOWS/Tasks/JJX5r8wnsqUnNxGwpwn.inf | 2009-10-26 18:34:22 
O24 - ShlExecHook: [C] - {E1639D0B-CC74-4C22-B662-F2F9367CBEFC} =C:/WINDOWS/Downloaded Program Files/NnjrQW5EUm9zePgHXM2eB44E.cur | 2009-10-26 18:34:36 
O24 - ShlExecHook: [3] - {51716C09-6B08-4CCF-B526-718E912C0573} =C:/WINDOWS/system32/PERrGx5DkqSbQdwauCRQH.dll | 2009-10-26 18:34:52 
O24 - ShlExecHook: [C] - {9EB86543-64B5-4CA8-9241-D672720CB0BC} =C:/WINDOWS/system32/BhfwdJchYBNmD25PSCxza.inf | 2009-10-26 18:35:6 
O24 - ShlExecHook: [9] - {84639C2D-CD75-4081-B515-329AFCECBF19} =C:/WINDOWS/Downloaded Program Files/SjRjQgREDp3P8B4rEEg.cur | 2009-10-26 18:35:20 
O24 - ShlExecHook: [5] - {B9D0F4D7-C809-4C27-9CB4-63201DFB3D05} =C:/WINDOWS/Tasks/c2nH4numz9knY5zqnC.inf | 2009-10-26 18:35:34 
O24 - ShlExecHook: [7] - {CD478099-014D-4B3A-A4BB-B518F1019BC7} =C:/WINDOWS/system32/SCEVFJRCmaB7.dll | 2009-10-26 18:35:50 
O24 - ShlExecHook: [7] - {87DE8A1A-96C5-4420-B222-EF998F697CE7} =C:/WINDOWS/system32/2exJW3dsaTgWrf5uAPadmHN.dll | 2009-10-26 18:36:4 
O24 - ShlExecHook: [6] - {526EB425-7F56-4773-8D70-B8E45AA8E2B6} =C:/WINDOWS/Downloaded Program Files/WUstNjhyfQfpv8PQbC.cur | 2009-10-26 18:36:22 
O24 - ShlExecHook: [0] - {23DA65D2-C696-4EE4-BEE8-B4841DEC3E30} =C:/WINDOWS/system32/ndxq9awMc.dll | 2009-10-26 18:36:36 
O24 - ShlExecHook: [F] - {81EB905C-EDF8-4033-80BF-E0F4F46733DF} =C:/WINDOWS/Tasks/TDz5y2TEAKw2z7xkPhf9Sqj.inf | 2009-10-26 18:36:56 
O24 - ShlExecHook: [C] - {B7F1BFDC-4B6C-4E2F-AF7A-638D2D47802C} =C:/WINDOWS/system32/FsmBY3kmWnAG5gRbwGgU.inf | 2009-10-26 18:37:12 
O24 - ShlExecHook: [C] - {C53C1999-1B56-41BD-8F76-520D618F112C} =C:/WINDOWS/Downloaded Program Files/gxrSG8sdA4hAbGNQXnr9JGFu6nZ.cur | 2009-10-26 18:37:28 
O24 - ShlExecHook: [5] - {F181F067-7046-4DCB-993F-200990736305} =C:/WINDOWS/Downloaded Program Files/sZaeAC74EzXJeVeJu6p.cur | 2009-10-26 18:37:42 
O24 - ShlExecHook: [E] - {08223B03-1B38-4A33-A83A-A4D3CC1D6E4E} =C:/WINDOWS/system32/08223B03.dll | 2009-10-26 18:38:20 
O24 - ShlExecHook: [7] - {74DA2FEC-F68F-4DC7-9A45-9174AC044427} =C:/WINDOWS/system32/z6FVkEF47huPzgaXee.inf | 2009-10-26 18:38:38 
O24 - ShlExecHook: [2] - {05EDDA35-1E5B-4A77-8F68-99AB967CF632} =C:/WINDOWS/system32/bWxJAeWKDxgRfhkaWEfA33C36nr.inf | 2009-10-26 18:38:54 
O24 - ShlExecHook: [C] - {122B901E-493F-4AD9-BC69-7DE8C3E52FCC} =C:/WINDOWS/system32/122B901E.dll | 2009-10-26 18:39:10 
O24 - ShlExecHook: [B] - {827E2FB4-1047-43DE-848D-E12BB0C97AAB} =C:/WINDOWS/Tasks/SbrmpxjdCrgRAFhz4gHh.inf | 2009-10-26 18:39:26 
O24 - ShlExecHook: [1] - {8708994F-1758-4C2C-9A3F-FA22D6CCCB41} =C:/WINDOWS/fonts/A97CRaCB.fon | 2009-10-26 18:39:42 
O24 - ShlExecHook: [7] - {24144CB8-10ED-4BFC-843F-68A9F3369947} =C:/WINDOWS/fonts/SD78dgC7hD2sktQHyAu.fon | 2009-10-26 18:39:58 
O24 - ShlExecHook: [E] - {6049BC02-7EDA-4C41-B4AB-D5398607C39E} =C:/WINDOWS/Tasks/yGfdVUegEQm9fhY5rnN.inf | 2009-10-26 18:40:14 
O24 - ShlExecHook: [C] - {F317E464-D4A4-4C79-82E8-CABADF738C7C} =C:/WINDOWS/system32/t9hdtMrwMeQcvYV3CMvhtNZpC.inf | 2009-10-26 18:40:30 
O24 - ShlExecHook: [}] - {8A6A5B34-D995-4C5D-9338-B5E264B4A87} =C:/WINDOWS/system32/nXe2grrKNzF9dxYKmqg.inf | 2009-11-10 11:41:10 
O24 - ShlExecHook: [B] - {4F5EEDE5-1687-49D2-8A17-FF0B454FB37B} =C:/WINDOWS/system32/qzp3jTZCSfSh.dll | 2009-10-26 18:41:2 
O24 - ShlExecHook: [3] - {6B1604E2-A839-463C-906A-27A129781E93} =C:/WINDOWS/Downloaded Program Files/rJaeKv7CcbwSzhQbDu.cur | 2009-10-26 18:41:22 
O24 - ShlExecHook: [4] - {D55E3C90-C192-411F-85FC-6A8A69D0C634} =C:/WINDOWS/system32/WQVBYhAJ6ADw5qzCY8gv84KTH.inf | 2009-10-26 18:41:40 
O24 - ShlExecHook: [2] - {1719B301-B494-4185-9379-242461F9CF02} =C:/WINDOWS/system32/BtmBAnd89jc9PsPq5EKNj.inf | 2009-10-26 18:43:28 
O24 - ShlExecHook: [C] - {C4BD9D5C-04CA-45E6-8539-98B07D99B6BC} =C:/WINDOWS/system32/AMNCZw74h8gwd6CpYGkrZDy8.inf | 2009-10-29 2:13:48 
O24 - ShlExecHook: [5] - {3373CD28-8C35-4A36-8569-672D8CA197F5} =C:/WINDOWS/Tasks/4H5HJTHFZkxrCpehBpx4TmR.inf | 2009-10-29 1:47:10 
O24 - ShlExecHook: [C] - {C3634CF6-FD22-4F3D-BBB4-AE36174A868C} =C:/WINDOWS/system32/A2CbFrBy28J6zdXNZgqCtJ6Ae.inf | 2009-10-29 2:13:52 
O24 - ShlExecHook: [8] - {B59F0A61-EF3E-4A2B-9E3A-4A84EDDF2308} =C:/WINDOWS/Downloaded Program Files/AnXnubyMnv58c9vaECWX.cur | 2009-10-29 2:14:2 
O24 - ShlExecHook: [B] - {012B7C3C-53AF-424E-869C-7DB92D25C31B} =C:/WINDOWS/Downloaded Program Files/uBwdaS5QeRv5fUyk7etsUNqVEjT.cur | 2009-10-29 2:14:20 
O24 - ShlExecHook: [B] - {012AA32F-36E6-405F-9F3F-588E0AA73FBB} =C:/WINDOWS/Tasks/Wfayv6njQnCsg.inf | 2009-10-30 2:2:52 
O24 - ShlExecHook: [0] - {D36A1DF7-6582-4160-B925-59A34E39FE30} =C:/WINDOWS/system32/EMQzJJURMfVkrkEx9GJ.inf | 2009-10-30 10:32:12 
O24 - ShlExecHook: [0] - {7CC109E5-B2FC-4FEE-AF04-74B2DCBD2540} =C:/WINDOWS/system32/ujMhyGsS7tRV9gU2HHMkJcu7DPU.inf | 2009-11-2 1:10:32 
O24 - ShlExecHook: [5] - {7198F428-77AC-4837-AFBE-1E0393575935} =C:/WINDOWS/system32/JMq7bpeR4Xa8eV5ftCB.inf | 2009-11-1 23:44:52 
O24 - ShlExecHook: [A] - {8E6D4583-0FA1-41B2-BAAA-63352E6333CA} =C:/WINDOWS/system32/jY8sGUnWqbZb3x2BPhY.dll | 2009-11-2 1:11:54 
O24 - ShlExecHook: [] - {C8417122-386F-48C7-8900-C82E4694FEBC} =C:/Documents and Settings/Administrator/Application Data/Spy009.dll | 2009-11-9 2:41:52 
O24 - ShlExecHook: [] - {556F0F4D-9CD8-4C91-A95B-0F88D638406A} =C:/Program Files/Internet Explorer/sdk2.dll | 2009-11-10 11:59:20 
O24 - ShlExecHook: [2] - {81BC0740-6E31-4BA4-81C8-EFF9ECEB3BA2} =C:/WINDOWS/system32/pEcFwPj48y6DADf87r.inf | 2009-11-7 11:6:12 
O24 - ShlExecHook: [4] - {C3BDE61A-DB4C-4a68-8A01-CD4A29B88974} =C:/WINDOWS/Fonts/kb2923529.dll | 2009-11-9 2:35:29 
O24 - ShlExecHook: [3] - {F9B6B005-901D-48c8-A35D-BA745F98FBD3} =C:/WINDOWS/Fonts/kb410172748.dll | 2009-11-10 17:27:48 
O24 - ShlExecHook: [1] - {001A8F88-01D3-4a02-AA3F-B98E100176F1} =C:/WINDOWS/Fonts/kb5923711.dll | 2009-11-9 2:37:11 
O24 - ShlExecHook: [1] - {F8EC4F9D-F88B-41CF-BC8D-3DD1737B6451} =C:/WINDOWS/system32/RXNK8eR3xW8KTCWBCGTbqm.inf | 2009-11-10 11:17:32 
O24 - ShlExecHook: [F] - {DEA30687-C84E-4588-A761-5F2749455B2F} =C:/WINDOWS/Tasks/zUzgU8WWpYntt6NfUWT.inf | 2009-11-10 11:30:6 
O24 - ShlExecHook: [9] - {B8D2813F-E0ED-42C6-95DD-2969BD5DC639} =C:/WINDOWS/fonts/AN2Epfv2VzeHreV.fon | 2009-11-10 11:32:42 
O24 - ShlExecHook: [2] - {93DA1E7D-7C46-4F90-8674-EC90511FCA72} =C:/WINDOWS/system32/CDuAUVkGy9.dll | 2009-11-10 11:33:4
O26 - IFEO: 360rpt.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: 360Safe.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: 360tray.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: DrRtp.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: egui.exe -> services.exe
O26 - IFEO: QQDoctor.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: RStray.exe -> C:/WINDOWS/system32/svchost.exe
O29 - HKCU-Start Page = hxxp://www．7357．cn/#1008
O29 - HKLM-Start Page = hxxp://www．2298．cn/


（未完待续）

本文《winyyy.sys,hcpidesk.sys,mtlrd.sys,uldfhjfh.sys,servets.exe等1》版权归iteye_6637所有，引用winyyy.sys,hcpidesk.sys,mtlrd.sys,uldfhjfh.sys,servets.exe等1需遵循CC 4.0 BY-SA版权协议。


推荐阅读
  • settings

    LCUI 2.1.0 发布，确认 Android 支持计划

    LCUI 2.1.0 版本现已推出，这是一个用 C 语言编写的图形用户界面开发库，适合创建轻量级的桌面应用程序。此次更新包括多项修复和功能增强，并正式宣布将启动 Android 支持的开发计划。 ... [详细]
  • settings

    深入解析：Android 视频处理开源框架

    本文将详细介绍多个流行的 Android 视频处理开源框架，包括 ijkplayer、FFmpeg、Vitamio、ExoPlayer 等。每个框架都有其独特的优势和应用场景，帮助开发者更高效地进行视频处理和播放。 ... [详细]
  • php

    JSON 解析失败问题排查

    在PHP后端开发中遇到一个难题：通过第三方类文件发送短信功能返回的JSON字符串无法解析。本文将探讨可能的原因并提供解决方案。 ... [详细]
  • php

    三星Galaxy S8/S8+即将登场，全面解析新旗舰

    三星Galaxy S8/S8+即将登场，全面解析新旗舰
    3月29日晚11点，备受瞩目的三星Galaxy S8/S8+将正式发布。作为三星在Note 7爆炸事件后的重磅产品，S8/S8+不仅承载着恢复消费者信心的重任，其创新的设计和技术也备受期待。 ... [详细]
  • sum

    温莎大学计算机科学硕士：申请条件与优势解析

    本文将详细介绍温莎大学的计算机科学硕士项目，尤其是其应用计算机科学分支，探讨其申请条件、课程设置及为何成为国际学生的热门选择。 ... [详细]
  • sum

    AMQP协议详解：版本协商机制

    在AMQP（高级消息队列协议）2.2版本的连接建立过程中，双方需首先交换协议头部信息以确认所使用的协议版本。此协议头部不仅包含了特定的字符串标识，还详细指定了协议的主要、次要及修订版本号。 ... [详细]
  • instance

    数据同步异步加载handler Looper

    MainActivityimportandroid.app.Activity;importandroid.os.Bundle;importandroid.os.Handler;im ... [详细]
  • php

    MySQL架构在大规模应用中的进化路径

    本文探讨了随着并发需求的增长，MySQL数据库架构如何从简单的单一实例发展到复杂的分布式系统，以及每一步演进背后的原理和技术解决方案。 ... [详细]
  • php

    时间序列分析入门：平稳性与白噪声检验

    时间序列分析入门：平稳性与白噪声检验
    本文详细介绍了时间序列分析中的两个基本概念——平稳性和白噪声的检验方法，帮助读者更好地理解和应用这些技术。 ... [详细]
  • select

    在Ubuntu上快速部署GitLab

    本文详细介绍了如何在Ubuntu系统上快速安装和配置Bitnami版本的GitLab，包括下载安装文件、执行安装过程以及设置邮件服务等步骤。 ... [详细]
  • php

    Eclipse 中 Maven 的基础配置指南

    Eclipse 中 Maven 的基础配置指南
    本文详细介绍了如何在 Eclipse 环境中配置 Maven，包括环境变量的设置、Maven 插件的安装与配置等关键步骤，旨在帮助开发者顺利搭建开发环境。 ... [详细]
  • php

    Elasticsearch集群构建指南：本地环境搭建与管理

    Elasticsearch集群构建指南：本地环境搭建与管理
    本文详细介绍了如何在本地环境中搭建Elasticsearch集群，包括节点配置、主节点选举机制、以及如何通过单播和广播方式增加节点。同时，文章还探讨了集群的高可用性和扩展性，以及如何通过配置防止脑裂现象的发生。 ... [详细]
  • php

    Linux环境下Redmine快速搭建指南

    Linux环境下Redmine快速搭建指南
    本文将详细介绍如何在Linux操作系统中使用Bitnami Redmine安装包快速搭建Redmine项目管理平台，帮助读者轻松完成环境配置。 ... [详细]
  • php

    .NET Core中的一个接口多种实现的依赖注入与动态选择看这篇就够了

    .NET Core中的一个接口多种实现的依赖注入与动态选择看这篇就够了
    .NETCore中的一个接口多种实现的依赖注入与动态选择看这篇就够了最近有个需求就是一个抽象仓储层接口方法需要SqlServer以及Oracle两种实现方式，为了灵活我在依赖注入的 ... [详细]
  • instance

    使用反射创建对象

    通过使用反射创建对象，废话不多说直接上代码usingSystem.Reflection;namespaceFactory{publicclassDALFactor ... [详细]
author-avatar
冰点youth
这个家伙很懒，什么也没留下！
Tags | 热门标签
RankList | 热门文章
PHP1.CN | 中国最专业的PHP中文社区 | DevBox开发工具箱 | json解析格式化 |PHP资讯 | PHP教程 | 数据库技术 | 服务器技术 | 前端开发技术 | PHP框架 | 开发工具 | 在线工具
Copyright © 1998 - 2020 PHP1.CN. All Rights Reserved | 京公网安备 11010802041100号 | 京ICP备19059560号-4 | PHP1.CN 第一PHP社区 版权所有