[CODE]
2015-09-06,17:35:02
System Repair Engineer 2.8.4.1331
Smallfrogs (http://www.KZTechs.com)
Windows 7 Ultimate Edition Service Pack 1 (Build 7601) - 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描
计划任务
Windows 安全更新检查
API HOOK
隐藏进程
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<BaiduYunGuanjia><"C:\Users\Administrator\AppData\Roaming\baidu\BaiduYunGuanjia\BaiduYunGuanjia.exe" AutoRun> [File is missing]
<BaiduYunDetect><"C:\Users\Administrator\AppData\Roaming\baidu\BaiduYunGuanjia\YunDetectService.exe"> []
<AdobeBridge><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<360Safetray><"C:\Program Files (x86)\360\360Safe\safemon\360tray.exe" /start> [(Verified)Qihoo 360 Software (Beijing) Company Limited]
<Avira SystrayStartTrigger><C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe> [(Verified)Avira Operations GmbH & Co. KG]
<Speedup_umh><C:\Program Files (x86)\Avira\AviraSpeedup\Speedup_umh.exe> [(Verified)Avira Operations GmbH & Co. KG]
<SwitchBoard><C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe> [Adobe Systems Incorporated]
<AdobeCS6ServiceManager><"C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin> [(Verified)Adobe Systems Incorporated]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><explorer.exe> [(Verified)Microsoft Windows]
<Userinit><C:\Windows\system32\UserInit.exe,> [(Verified)Microsoft Windows]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<WebCheck><> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
<Microsoft Windows Media Player><%SystemRoot%\system32\unregmp2.exe /ShowWMP> [(Verified)Microsoft Windows]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig> [(Verified)Microsoft Windows]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
<Browser Customizations><"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP> [(Verified)Microsoft Windows]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Windows><"%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><%SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI> [(Verified)Microsoft Windows]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
<Windows Desktop Update><regsvr32.exe /s /n /i:U shell32.dll> [(Verified)Microsoft Windows]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
<Web Platform Customizations><C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings> [(Verified)Microsoft Windows]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
<N/A><C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install> [(Verified)Microsoft Corporation]
==================================
启动文件夹
N/A
==================================
服务
[Adobe Flash Player Update Service / AdobeFlashPlayerUpdateSvc][Stopped/Manual Start]
<C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe><Adobe Systems Incorporated>
[Application Experience / AeLookupSvc][Running/Manual Start]
<C:\Windows\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\aelupsvc.dll><Microsoft Corporation>
[Trend Micro Solution Platform / Amsp][Running/Auto Start]
<"C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=rb -dt=60000 -ad -bt=0><Trend Micro Inc.>
[Application Identity / AppIDSvc][Stopped/Manual Start]
<C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation-->%SystemRoot%\System32\appidsvc.dll><Microsoft Corporation>
[Application Information / Appinfo][Running/Manual Start]
<C:\Windows\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\appinfo.dll><Microsoft Corporation>
[Windows Audio Endpoint Builder / AudioEndpointBuilder][Running/Auto Start]
<C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted-->%SystemRoot%\System32\Audiosrv.dll><Microsoft Corporation>
[Windows Audio / AudioSrv][Running/Auto Start]
<C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted-->%SystemRoot%\System32\Audiosrv.dll><Microsoft Corporation>
[Avira Service Host / Avira.ServiceHost][Running/Auto Start]
<"C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe"><Avira Operations GmbH & Co. KG>
[ActiveX Installer (AxInstSV) / AxInstSV][Stopped/Manual Start]
<C:\Windows\system32\svchost.exe -k AxInstSVGroup-->%SystemRoot%\System32\AxInstSV.dll><Microsoft Corporation>
[BaiduYunUtility / BaiduYunUtility][Stopped/Manual Start]
<C:\Users\Administrator\AppData\Roaming\baidu\BaiduYunGuanjia\YunUtilityService.exe><>
[BitLocker Drive Encryption Service / BDESVC][Stopped/Manual Start]
<C:\Windows\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\bdesvc.dll><Microsoft Corporation>
[暴风移动设备识别服务 / BFAssistantSvc_15612225517][Stopped/Manual Start]
<C:\Program Files (x86)\Baofeng\PhoneAssistant\BFAssistantSvc.exe><N/A>
[Base Filtering Engine / BFE][Running/Auto Start]
<C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork-->%SystemRoot%\System32\bfe.dll><Microsoft Corporation>
[Background Intelligent Transfer Service / BITS][Stopped/Manual Start]
<C:\Windows\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\qmgr.dll><Microsoft Corporation>
[Computer Browser / Browser][Stopped/Manual Start]
<C:\Windows\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\browser.dll><Microsoft Corporation>
[Bluetooth Support Service / bthserv][Running/Manual Start]
<C:\Windows\system32\svchost.exe -k bthsvcs-->%SystemRoot%\system32\bthserv.dll><Microsoft Corporation>
[Certificate Propagation / CertPropSvc][Stopped/Manual Start]
<C:\Windows\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\certprop.dll><Microsoft Corporation>
[Offline Files / CscService][Stopped/Auto Start]
<C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted-->%SystemRoot%\System32\cscsvc.dll><Microsoft Corporation>
[DCOM Server Process Launcher / DcomLaunch][Running/Auto Start]
<C:\Windows\system32\svchost.exe -k DcomLaunch-->%SystemRoot%\system32\rpcss.dll><Microsoft Corporation>
[Disk Defragmenter / defragsvc][Stopped/Manual Start]
<C:\Windows\system32\svchost.exe -k defragsvc-->%Systemroot%\System32\defragsvc.dll><Microsoft Corporation>
[DNS Client / Dnscache][Running/Auto Start]
<C:\Windows\system32\svchost.exe -k NetworkService-->%SystemRoot%\System32\dnsrslvr.dll><Microsoft Corporation>
[Wired AutoConfig / dot3svc][Stopped/Manual Start]
<C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted-->%SystemRoot%\System32\dot3svc.dll><Microsoft Corporation>
[Diagnostic Policy Service / DPS][Running/Auto Start]
<C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork-->%SystemRoot%\system32\dps.dll><Microsoft Corporation>
[Extensible Authentication Protocol / EapHost][Running/Manual Start]
<C:\Windows\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\eapsvc.dll><Microsoft Corporation>
[Foxit Cloud Safe Update Service / FoxitCloudUpdateService][Stopped/Manual Start]
<"C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe"><Foxit Software Inc.>
[Foxit Service / FxService][Stopped/Manual Start]
<"C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitProtect.exe"><福建福昕软件开发股份有限公司>
[NVIDIA GeForce Experience Service / GfExperienceService][Running/Auto Start]
<"C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe"><NVIDIA Corporation>
[Group Policy Client / gpsvc][Running/Auto Start]
<C:\Windows\system32\svchost.exe -k GPSvcGroup-->%SystemRoot%\System32\gpsvc.dll><Microsoft Corporation>
[Health Key and Certificate Management / hkmsvc][Stopped/Manual Start]
<C:\Windows\System32\svchost.exe -k netsvcs-->%SystemRoot%\system32\kmsvc.dll><Microsoft Corporation>
[HomeGroup Listener / HomeGroupListener][Stopped/Manual Start]
<C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted-->%SystemRoot%\system32\ListSvc.dll><Microsoft Corporation>
[IKE and AuthIP IPsec Keying Modules / IKEEXT][Running/Auto Start]
<C:\Windows\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\ikeext.dll><Microsoft Corporation>
[PnP-X IP Bus Enumerator / IPBusEnum][Stopped/Manual Start]
<C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted-->%SystemRoot%\system32\ipbusenum.dll><Microsoft Corporation>
[IP Helper / iphlpsvc][Running/Auto Start]
<C:\Windows\System32\svchost.exe -k NetSvcs-->%SystemRoot%\System32\iphlpsvc.dll><Microsoft Corporation>
[Intel(R) Management and Security Application Local Management Service / LMS][Running/Auto Start]
<C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe><Intel Corporation>
[Multimedia Class Scheduler / MMCSS][Stopped/Auto Start]
<C:\Windows\system32\svchost.exe -k netsvcs-->%SystemRoot%\system32\mmcss.dll><Microsoft Corporation>
[Windows Firewall / MpsSvc][Stopped/Manual Start]
<C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork-->%SystemRoot%\system32\mpssvc.dll><Microsoft Corporation>
[Norton Identity Safe / NCO][Running/Auto Start]
<"C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\NST.exe" /s "NCO" /m "C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\diMaster.dll" /prefetch:1><Symantec Corporation>
[NVIDIA Network Service / NvNetworkService][Running/Auto Start]
<"C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe"><NVIDIA Corporation>
[NVIDIA Streamer Service / NvStreamSvc][Running/Auto Start]
<"C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe"><NVIDIA Corporation>
[NVIDIA Display Driver Service / nvsvc][Running/Auto Start]
<C:\Windows\system32\nvvsvc.exe><NVIDIA Corporation>
[Peer Networking Identity Manager / p2pimsvc][Stopped/Manual Start]
<C:\Windows\System32\svchost.exe -k LocalServicePeerNet-->%SystemRoot%\system32\pnrpsvc.dll><Microsoft Corporation>
[Peer Networking Grouping / p2psvc][Stopped/Manual Start]
<C:\Windows\System32\svchost.exe -k LocalServicePeerNet-->%SystemRoot%\system32\p2psvc.dll><Microsoft Corporation>
[Program Compatibility Assistant Service / PcaSvc][Stopped/Auto Start]
<C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted-->%SystemRoot%\System32\pcasvc.dll><Microsoft Corporation>
[BranchCache / PeerDistSvc][Stopped/Manual Start]
<C:\Windows\System32\svchost.exe -k PeerDist-->%SystemRoot%\system32\peerdistsvc.dll><Microsoft Corporation>
[Platinum Host Service / Platinum Host Service][Running/Auto Start]
<"C:\Program Files\Trend Micro\Titanium\plugin\Pt\PtSvcHost.exe"><Trend Micro Inc.>
[Plug and Play / PlugPlay][Running/Auto Start]
<C:\Windows\system32\svchost.exe -k DcomLaunch-->%SystemRoot%\system32\umpnpmgr.dll><Microsoft Corporation>
[PNRP Machine Name Publication Service / PNRPAutoReg][Stopped/Manual Start]
<C:\Windows\System32\svchost.exe -k LocalServicePeerNet-->%SystemRoot%\system32\pnrpauto.dll><Microsoft Corporation>
[Peer Name Resolution Protocol / PNRPsvc][Stopped/Manual Start]
<C:\Windows\System32\svchost.exe -k LocalServicePeerNet-->%SystemRoot%\system32\pnrpsvc.dll><Microsoft Corporation>
[IPsec Policy Agent / PolicyAgent][Running/Manual Start]
<C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted-->%SystemRoot%\System32\ipsecsvc.dll><Microsoft Corporation>
[Power / Power][Running/Auto Start]
<C:\Windows\system32\svchost.exe -k DcomLaunch-->%SystemRoot%\system32\umpo.dll><Microsoft Corporation>
[User Profile Service / ProfSvc][Running/Auto Start]
计划任务
[已禁用] \\Adobe Flash Player Updater
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
[已启用] \\AdobeAAMUpdater-1.0-WRGHO-509031222-Administrator
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe -mode=scheduled
[已启用] \\AviraSpeedup
C:\Program Files (x86)\Avira\AviraSpeedup\avira_system_speedup.exe -autorun
[已禁用] \\googleupdatetaskmachinecore
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
[已禁用] \\googleupdatetaskmachineua
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
[已启用] \\Trend Micro Inspect of Platinum
"C:\Program Files\Trend Micro\Titanium\plugin\Pt\win32\Inspect\Inspect.exe" -id "16aec385-5f68-419d-ae4e-9a3c09f5692e" -usertoken "D0A69EF5903C4A63B9AF17E9AC71DC2195eb81a8f96ad468ac3a6b57fc982716b4d158d8" -runonce 0 -pid c32t3201v2.1.1152l1p5889r1o21 -lguid D0A69EF5903C4A63B9AF17E9AC71DC21 -hashedsn 95eb81a8f96ad468ac3a6b57fc982716b4d
[已启用] \Microsoft\Windows\SetupSQMTask
C:\Windows\SYSTEM32\OOBE\SETUPSQM.EXE
[已禁用] \Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Automated)
N/A
[已启用] \Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Manual)
N/A
[已禁用] \Microsoft\Windows\AppID\PolicyConverter
%windir%\system32\appidpolicyconverter.exe
[已禁用] \Microsoft\Windows\AppID\VerifiedPublisherCertStoreCheck
%windir%\system32\appidcertstorecheck.exe
[已启用] \Microsoft\Windows\Application Experience\AitAgent
aitagent
[已启用] \Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser
%windir%\system32\rundll32.exe aepdu.dll,AePduRunUpdate -nolegacy
[已启用] \Microsoft\Windows\Application Experience\ProgramDataUpdater
%windir%\system32\rundll32.exe aepdu.dll,AePduRunUpdate
[已启用] \Microsoft\Windows\Autochk\Proxy
%windir%\system32\rundll32.exe /d acproxy.dll,PerformAutochkOperations
[已启用] \Microsoft\Windows\Bluetooth\UninstallDeviceTask
BthUdTask.exe $(Arg0)
[已启用] \Microsoft\Windows\CertificateServicesClient\SystemTask
N/A
[已启用] \Microsoft\Windows\CertificateServicesClient\UserTask
N/A
[已禁用] \Microsoft\Windows\CertificateServicesClient\UserTask-Roam
N/A
[已禁用] \Microsoft\Windows\Customer Experience Improvement Program\Consolidator
%SystemRoot%\System32\wsqmcons.exe
[已禁用] \Microsoft\Windows\Defrag\ScheduledDefrag
%windir%\system32\defrag.exe -c
[已禁用] \Microsoft\Windows\Location\Notifications
%windir%\System32\LocationNotifications.exe
[已启用] \Microsoft\Windows\Maintenance\WinSAT
N/A
[已启用] \Microsoft\Windows\MUI\LPRemove
%windir%\system32\lpremove.exe
[已启用] \Microsoft\Windows\Multimedia\SystemSoundsService
N/A
[已禁用] \Microsoft\Windows\NetTrace\GatherNetworkInfo
%windir%\system32\gatherNetworkInfo.vbs
[已禁用] \Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem
%SystemRoot%\System32\powercfg.exe -energy -auto
[已启用] \Microsoft\Windows\Ras\MobilityManager
N/A
[已禁用] \Microsoft\Windows\SystemRestore\SR
%windir%\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation
[已启用] \Microsoft\Windows\Tcpip\IpAddressConflict1
%windir%\system32\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPOffendingSystem
[已启用] \Microsoft\Windows\Tcpip\IpAddressConflict2
%windir%\system32\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPDefendingSystem
[已禁用] \Microsoft\Windows\Time Synchronization\SynchronizeTime
%windir%\system32\sc.exe start w32time task_started
[已启用] \Microsoft\Windows\UPnP\UPnPHostConfig
sc.exe config upnphost start= auto
[已禁用] \Microsoft\Windows\User Profile Service\HiveUploadTask
N/A
[已启用] \Microsoft\Windows\Windows Error Reporting\QueueReporting
%windir%\system32\wermgr.exe -queuereporting
[已启用] \Microsoft\Windows\Windows Media Sharing\UpdateLibrary
"%ProgramFiles%\Windows Media Player\wmpnscfg.exe"
[已禁用] \Microsoft\Windows\WindowsBackup\ConfigNotification
%systemroot%\System32\sdclt.exe /CONFIGNOTIFICATION
[已禁用] \Microsoft\Windows\WindowsColorSystem\Calibration Loader
N/A
[已启用] \Norton Identity Safe\Norton Error Analyzer
C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\SymErr.exe /analyze
[已启用] \Norton Identity Safe\Norton Error Processor
C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\SymErr.exe /submit
==================================
Windows 安全更新检查
N/A
==================================
API HOOK
入口点错误：FindFirstFileA (危险等级: 高, 被下面模块所HOOK: 0xB9D0DD86)
==================================
隐藏进程
N/A
==================================
[/CODE]
2015-09-06,17:35:02
System Repair Engineer 2.8.4.1331
Smallfrogs (http://www.KZTechs.com)
Windows 7 Ultimate Edition Service Pack 1 (Build 7601) - 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描
计划任务
Windows 安全更新检查
API HOOK
隐藏进程
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<BaiduYunGuanjia><"C:\Users\Administrator\AppData\Roaming\baidu\BaiduYunGuanjia\BaiduYunGuanjia.exe" AutoRun> [File is missing]
<BaiduYunDetect><"C:\Users\Administrator\AppData\Roaming\baidu\BaiduYunGuanjia\YunDetectService.exe"> []
<AdobeBridge><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<360Safetray><"C:\Program Files (x86)\360\360Safe\safemon\360tray.exe" /start> [(Verified)Qihoo 360 Software (Beijing) Company Limited]
<Avira SystrayStartTrigger><C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe> [(Verified)Avira Operations GmbH & Co. KG]
<Speedup_umh><C:\Program Files (x86)\Avira\AviraSpeedup\Speedup_umh.exe> [(Verified)Avira Operations GmbH & Co. KG]
<SwitchBoard><C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe> [Adobe Systems Incorporated]
<AdobeCS6ServiceManager><"C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin> [(Verified)Adobe Systems Incorporated]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><explorer.exe> [(Verified)Microsoft Windows]
<Userinit><C:\Windows\system32\UserInit.exe,> [(Verified)Microsoft Windows]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<WebCheck><> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
<Microsoft Windows Media Player><%SystemRoot%\system32\unregmp2.exe /ShowWMP> [(Verified)Microsoft Windows]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig> [(Verified)Microsoft Windows]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
<Browser Customizations><"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP> [(Verified)Microsoft Windows]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Windows><"%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><%SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI> [(Verified)Microsoft Windows]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
<Windows Desktop Update><regsvr32.exe /s /n /i:U shell32.dll> [(Verified)Microsoft Windows]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
<Web Platform Customizations><C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings> [(Verified)Microsoft Windows]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
<N/A><C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install> [(Verified)Microsoft Corporation]
==================================
启动文件夹
N/A
==================================
服务
[Adobe Flash Player Update Service / AdobeFlashPlayerUpdateSvc][Stopped/Manual Start]
<C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe><Adobe Systems Incorporated>
[Application Experience / AeLookupSvc][Running/Manual Start]
<C:\Windows\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\aelupsvc.dll><Microsoft Corporation>
[Trend Micro Solution Platform / Amsp][Running/Auto Start]
<"C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=rb -dt=60000 -ad -bt=0><Trend Micro Inc.>
[Application Identity / AppIDSvc][Stopped/Manual Start]
<C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation-->%SystemRoot%\System32\appidsvc.dll><Microsoft Corporation>
[Application Information / Appinfo][Running/Manual Start]
<C:\Windows\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\appinfo.dll><Microsoft Corporation>
[Windows Audio Endpoint Builder / AudioEndpointBuilder][Running/Auto Start]
<C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted-->%SystemRoot%\System32\Audiosrv.dll><Microsoft Corporation>
[Windows Audio / AudioSrv][Running/Auto Start]
<C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted-->%SystemRoot%\System32\Audiosrv.dll><Microsoft Corporation>
[Avira Service Host / Avira.ServiceHost][Running/Auto Start]
<"C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe"><Avira Operations GmbH & Co. KG>
[ActiveX Installer (AxInstSV) / AxInstSV][Stopped/Manual Start]
<C:\Windows\system32\svchost.exe -k AxInstSVGroup-->%SystemRoot%\System32\AxInstSV.dll><Microsoft Corporation>
[BaiduYunUtility / BaiduYunUtility][Stopped/Manual Start]
<C:\Users\Administrator\AppData\Roaming\baidu\BaiduYunGuanjia\YunUtilityService.exe><>
[BitLocker Drive Encryption Service / BDESVC][Stopped/Manual Start]
<C:\Windows\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\bdesvc.dll><Microsoft Corporation>
[暴风移动设备识别服务 / BFAssistantSvc_15612225517][Stopped/Manual Start]
<C:\Program Files (x86)\Baofeng\PhoneAssistant\BFAssistantSvc.exe><N/A>
[Base Filtering Engine / BFE][Running/Auto Start]
<C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork-->%SystemRoot%\System32\bfe.dll><Microsoft Corporation>
[Background Intelligent Transfer Service / BITS][Stopped/Manual Start]
<C:\Windows\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\qmgr.dll><Microsoft Corporation>
[Computer Browser / Browser][Stopped/Manual Start]
<C:\Windows\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\browser.dll><Microsoft Corporation>
[Bluetooth Support Service / bthserv][Running/Manual Start]
<C:\Windows\system32\svchost.exe -k bthsvcs-->%SystemRoot%\system32\bthserv.dll><Microsoft Corporation>
[Certificate Propagation / CertPropSvc][Stopped/Manual Start]
<C:\Windows\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\certprop.dll><Microsoft Corporation>
[Offline Files / CscService][Stopped/Auto Start]
<C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted-->%SystemRoot%\System32\cscsvc.dll><Microsoft Corporation>
[DCOM Server Process Launcher / DcomLaunch][Running/Auto Start]
<C:\Windows\system32\svchost.exe -k DcomLaunch-->%SystemRoot%\system32\rpcss.dll><Microsoft Corporation>
[Disk Defragmenter / defragsvc][Stopped/Manual Start]
<C:\Windows\system32\svchost.exe -k defragsvc-->%Systemroot%\System32\defragsvc.dll><Microsoft Corporation>
[DNS Client / Dnscache][Running/Auto Start]
<C:\Windows\system32\svchost.exe -k NetworkService-->%SystemRoot%\System32\dnsrslvr.dll><Microsoft Corporation>
[Wired AutoConfig / dot3svc][Stopped/Manual Start]
<C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted-->%SystemRoot%\System32\dot3svc.dll><Microsoft Corporation>
[Diagnostic Policy Service / DPS][Running/Auto Start]
<C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork-->%SystemRoot%\system32\dps.dll><Microsoft Corporation>
[Extensible Authentication Protocol / EapHost][Running/Manual Start]
<C:\Windows\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\eapsvc.dll><Microsoft Corporation>
[Foxit Cloud Safe Update Service / FoxitCloudUpdateService][Stopped/Manual Start]
<"C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe"><Foxit Software Inc.>
[Foxit Service / FxService][Stopped/Manual Start]
<"C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitProtect.exe"><福建福昕软件开发股份有限公司>
[NVIDIA GeForce Experience Service / GfExperienceService][Running/Auto Start]
<"C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe"><NVIDIA Corporation>
[Group Policy Client / gpsvc][Running/Auto Start]
<C:\Windows\system32\svchost.exe -k GPSvcGroup-->%SystemRoot%\System32\gpsvc.dll><Microsoft Corporation>
[Health Key and Certificate Management / hkmsvc][Stopped/Manual Start]
<C:\Windows\System32\svchost.exe -k netsvcs-->%SystemRoot%\system32\kmsvc.dll><Microsoft Corporation>
[HomeGroup Listener / HomeGroupListener][Stopped/Manual Start]
<C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted-->%SystemRoot%\system32\ListSvc.dll><Microsoft Corporation>
[IKE and AuthIP IPsec Keying Modules / IKEEXT][Running/Auto Start]
<C:\Windows\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\ikeext.dll><Microsoft Corporation>
[PnP-X IP Bus Enumerator / IPBusEnum][Stopped/Manual Start]
<C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted-->%SystemRoot%\system32\ipbusenum.dll><Microsoft Corporation>
[IP Helper / iphlpsvc][Running/Auto Start]
<C:\Windows\System32\svchost.exe -k NetSvcs-->%SystemRoot%\System32\iphlpsvc.dll><Microsoft Corporation>
[Intel(R) Management and Security Application Local Management Service / LMS][Running/Auto Start]
<C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe><Intel Corporation>
[Multimedia Class Scheduler / MMCSS][Stopped/Auto Start]
<C:\Windows\system32\svchost.exe -k netsvcs-->%SystemRoot%\system32\mmcss.dll><Microsoft Corporation>
[Windows Firewall / MpsSvc][Stopped/Manual Start]
<C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork-->%SystemRoot%\system32\mpssvc.dll><Microsoft Corporation>
[Norton Identity Safe / NCO][Running/Auto Start]
<"C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\NST.exe" /s "NCO" /m "C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\diMaster.dll" /prefetch:1><Symantec Corporation>
[NVIDIA Network Service / NvNetworkService][Running/Auto Start]
<"C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe"><NVIDIA Corporation>
[NVIDIA Streamer Service / NvStreamSvc][Running/Auto Start]
<"C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe"><NVIDIA Corporation>
[NVIDIA Display Driver Service / nvsvc][Running/Auto Start]
<C:\Windows\system32\nvvsvc.exe><NVIDIA Corporation>
[Peer Networking Identity Manager / p2pimsvc][Stopped/Manual Start]
<C:\Windows\System32\svchost.exe -k LocalServicePeerNet-->%SystemRoot%\system32\pnrpsvc.dll><Microsoft Corporation>
[Peer Networking Grouping / p2psvc][Stopped/Manual Start]
<C:\Windows\System32\svchost.exe -k LocalServicePeerNet-->%SystemRoot%\system32\p2psvc.dll><Microsoft Corporation>
[Program Compatibility Assistant Service / PcaSvc][Stopped/Auto Start]
<C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted-->%SystemRoot%\System32\pcasvc.dll><Microsoft Corporation>
[BranchCache / PeerDistSvc][Stopped/Manual Start]
<C:\Windows\System32\svchost.exe -k PeerDist-->%SystemRoot%\system32\peerdistsvc.dll><Microsoft Corporation>
[Platinum Host Service / Platinum Host Service][Running/Auto Start]
<"C:\Program Files\Trend Micro\Titanium\plugin\Pt\PtSvcHost.exe"><Trend Micro Inc.>
[Plug and Play / PlugPlay][Running/Auto Start]
<C:\Windows\system32\svchost.exe -k DcomLaunch-->%SystemRoot%\system32\umpnpmgr.dll><Microsoft Corporation>
[PNRP Machine Name Publication Service / PNRPAutoReg][Stopped/Manual Start]
<C:\Windows\System32\svchost.exe -k LocalServicePeerNet-->%SystemRoot%\system32\pnrpauto.dll><Microsoft Corporation>
[Peer Name Resolution Protocol / PNRPsvc][Stopped/Manual Start]
<C:\Windows\System32\svchost.exe -k LocalServicePeerNet-->%SystemRoot%\system32\pnrpsvc.dll><Microsoft Corporation>
[IPsec Policy Agent / PolicyAgent][Running/Manual Start]
<C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted-->%SystemRoot%\System32\ipsecsvc.dll><Microsoft Corporation>
[Power / Power][Running/Auto Start]
<C:\Windows\system32\svchost.exe -k DcomLaunch-->%SystemRoot%\system32\umpo.dll><Microsoft Corporation>
[User Profile Service / ProfSvc][Running/Auto Start]
计划任务
[已禁用] \\Adobe Flash Player Updater
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
[已启用] \\AdobeAAMUpdater-1.0-WRGHO-509031222-Administrator
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe -mode=scheduled
[已启用] \\AviraSpeedup
C:\Program Files (x86)\Avira\AviraSpeedup\avira_system_speedup.exe -autorun
[已禁用] \\googleupdatetaskmachinecore
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
[已禁用] \\googleupdatetaskmachineua
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
[已启用] \\Trend Micro Inspect of Platinum
"C:\Program Files\Trend Micro\Titanium\plugin\Pt\win32\Inspect\Inspect.exe" -id "16aec385-5f68-419d-ae4e-9a3c09f5692e" -usertoken "D0A69EF5903C4A63B9AF17E9AC71DC2195eb81a8f96ad468ac3a6b57fc982716b4d158d8" -runonce 0 -pid c32t3201v2.1.1152l1p5889r1o21 -lguid D0A69EF5903C4A63B9AF17E9AC71DC21 -hashedsn 95eb81a8f96ad468ac3a6b57fc982716b4d
[已启用] \Microsoft\Windows\SetupSQMTask
C:\Windows\SYSTEM32\OOBE\SETUPSQM.EXE
[已禁用] \Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Automated)
N/A
[已启用] \Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Manual)
N/A
[已禁用] \Microsoft\Windows\AppID\PolicyConverter
%windir%\system32\appidpolicyconverter.exe
[已禁用] \Microsoft\Windows\AppID\VerifiedPublisherCertStoreCheck
%windir%\system32\appidcertstorecheck.exe
[已启用] \Microsoft\Windows\Application Experience\AitAgent
aitagent
[已启用] \Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser
%windir%\system32\rundll32.exe aepdu.dll,AePduRunUpdate -nolegacy
[已启用] \Microsoft\Windows\Application Experience\ProgramDataUpdater
%windir%\system32\rundll32.exe aepdu.dll,AePduRunUpdate
[已启用] \Microsoft\Windows\Autochk\Proxy
%windir%\system32\rundll32.exe /d acproxy.dll,PerformAutochkOperations
[已启用] \Microsoft\Windows\Bluetooth\UninstallDeviceTask
BthUdTask.exe $(Arg0)
[已启用] \Microsoft\Windows\CertificateServicesClient\SystemTask
N/A
[已启用] \Microsoft\Windows\CertificateServicesClient\UserTask
N/A
[已禁用] \Microsoft\Windows\CertificateServicesClient\UserTask-Roam
N/A
[已禁用] \Microsoft\Windows\Customer Experience Improvement Program\Consolidator
%SystemRoot%\System32\wsqmcons.exe
[已禁用] \Microsoft\Windows\Defrag\ScheduledDefrag
%windir%\system32\defrag.exe -c
[已禁用] \Microsoft\Windows\Location\Notifications
%windir%\System32\LocationNotifications.exe
[已启用] \Microsoft\Windows\Maintenance\WinSAT
N/A
[已启用] \Microsoft\Windows\MUI\LPRemove
%windir%\system32\lpremove.exe
[已启用] \Microsoft\Windows\Multimedia\SystemSoundsService
N/A
[已禁用] \Microsoft\Windows\NetTrace\GatherNetworkInfo
%windir%\system32\gatherNetworkInfo.vbs
[已禁用] \Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem
%SystemRoot%\System32\powercfg.exe -energy -auto
[已启用] \Microsoft\Windows\Ras\MobilityManager
N/A
[已禁用] \Microsoft\Windows\SystemRestore\SR
%windir%\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation
[已启用] \Microsoft\Windows\Tcpip\IpAddressConflict1
%windir%\system32\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPOffendingSystem
[已启用] \Microsoft\Windows\Tcpip\IpAddressConflict2
%windir%\system32\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPDefendingSystem
[已禁用] \Microsoft\Windows\Time Synchronization\SynchronizeTime
%windir%\system32\sc.exe start w32time task_started
[已启用] \Microsoft\Windows\UPnP\UPnPHostConfig
sc.exe config upnphost start= auto
[已禁用] \Microsoft\Windows\User Profile Service\HiveUploadTask
N/A
[已启用] \Microsoft\Windows\Windows Error Reporting\QueueReporting
%windir%\system32\wermgr.exe -queuereporting
[已启用] \Microsoft\Windows\Windows Media Sharing\UpdateLibrary
"%ProgramFiles%\Windows Media Player\wmpnscfg.exe"
[已禁用] \Microsoft\Windows\WindowsBackup\ConfigNotification
%systemroot%\System32\sdclt.exe /CONFIGNOTIFICATION
[已禁用] \Microsoft\Windows\WindowsColorSystem\Calibration Loader
N/A
[已启用] \Norton Identity Safe\Norton Error Analyzer
C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\SymErr.exe /analyze
[已启用] \Norton Identity Safe\Norton Error Processor
C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.11.42\SymErr.exe /submit
==================================
Windows 安全更新检查
N/A
==================================
API HOOK
入口点错误：FindFirstFileA (危险等级: 高, 被下面模块所HOOK: 0xB9D0DD86)
==================================
隐藏进程
N/A
==================================
[/CODE]
西瓜味的橘子
