[C:\Windows\system32\vssvc.exe] [(Verified) Microsoft Corporation, 6.0.6001.18000 (longhorn_rtm.080118-1840)] [PID: 3600 / SYSTEM][C:\Windows\System32\svchost.exe] [(Verified) Microsoft Corporation, 6.0.6000.16386 (vista_rtm.061101-2205)] [PID: 5716 / SYSTEM][C:\Windows\system32\SearchProtocolHost.exe] [(Verified) Microsoft Corporation, 7.0.6001.16503 (longhorn(wmbla).080526-2159)] [PID: 2220 / SYSTEM][C:\Windows\system32\SearchFilterHost.exe] [(Verified) Microsoft Corporation, 7.0.6001.16503 (longhorn(wmbla).080526-2159)] [PID: 2456 / NETWORK SERVICE][c:\program files\windows defender\MpCmdRun.exe] [Microsoft Corporation, 1.1.1600.0] ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %*] .COM OK. ["%1" %*] .PIF OK. ["%1" %*] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %*] .SCR OK. ["%1" /S] .CHM OK. ["%SystemRoot%\hh.exe" %1] .HLP OK. [%SystemRoot%\winhlp32.exe %1] .INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .VBS OK. ["%SystemRoot%\System32\WScript.exe" "%1" %*] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf N/A ================================== HOSTS 文件 127.0.0.1 localhost ::1 localhost ================================== 进程特权扫描 N/A ================================== 计划任务 [已启用] \360safe\360DesktopMainProg C:\360\360DeskTop\Bin\360AppCore.exe [已禁用] \Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Automated) N/A [已启用] \Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Manual) N/A [已启用] \Microsoft\Windows\Bluetooth\UninstallDeviceTask BthUdTask.exe $(Arg0) [已启用] \Microsoft\Windows\CertificateServicesClient\SystemTask N/A [已启用] \Microsoft\Windows\CertificateServicesClient\UserTask N/A [已启用] \Microsoft\Windows\CertificateServicesClient\UserTask-Roam N/A [已启用] \Microsoft\Windows\Customer Experience Improvement Program\Consolidator %SystemRoot%\System32\wsqmcons.exe [已启用] \Microsoft\Windows\Customer Experience Improvement Program\OptinNotification %SystemRoot%\System32\wsqmcons.exe -n 0x1C577FA2B69CAD0 [已启用] \Microsoft\Windows\Defrag\ScheduledDefrag %windir%\system32\defrag.exe -c -i [已启用] \Microsoft\Windows\MobilePC\HotStart N/A [已启用] \Microsoft\Windows\MobilePC\TMM N/A [已启用] \Microsoft\Windows\MUI\LPRemove %windir%\system32\lpremove.exe [已启用] \Microsoft\Windows\Multimedia\SystemSoundsService N/A [已启用] \Microsoft\Windows\NetworkAccessProtection\NAPStatus UI N/A [已启用] \Microsoft\Windows\Shell\CrawlStartPages N/A [已启用] \Microsoft\Windows\SystemRestore\SR %windir%\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation [已启用] \Microsoft\Windows\Tcpip\IpAddressConflict1 rundll32 ndfapi.dll,NdfRunDllDuplicateIPOffendingSystem [已启用] \Microsoft\Windows\Tcpip\IpAddressConflict2 rundll32 ndfapi.dll,NdfRunDllDuplicateIPDefendingSystem [已启用] \Microsoft\Windows\UPnP\UPnPHostConfig sc.exe config upnphost start= auto [已启用] \Microsoft\Windows\Windows Error Reporting\QueueReporting %windir%\system32\wermgr.exe -queuereporting [已启用] \Microsoft\Windows\Wired\GatherWiredInfo %windir%\system32\gatherWiredInfo.vbs [已启用] \Microsoft\Windows\Wireless\GatherWirelessInfo %windir%\system32\gatherWirelessInfo.vbs ================================== Windows 安全更新检查 KB948465, Windows Vista Service Pack 2 (KB948465) KB2288953, Microsoft Office Outlook 2007 安全更新 (KB2288953) MS10-064 KB979688, 用于 Windows Vista 的 Windows Desktop Search 4.0 的安全更新程序 (KB979688) MS10-083 KB2416473, 用于 Windows XP、Windows Server 2003、Windows Vista 和 Windows Server 2008 x86 的 Microsoft .NET Framework 3.5 SP1 安全更新程序 (KB2416473) MS10-070 KB2443685, Windows Vista 更新程序 (KB2443685) KB2284697, Micorosft Office Publisher 2007 安全更新 (KB2284697) MS10-103 KB971029, Windows Vista 更新程序 (KB971029) KB2508958, Microsoft Office 2007 system 更新 (KB2508958) KB2388210, Windows Vista 更新程序 (KB2388210) KB968930, 用于 Windows Vista 的 Windows PowerShell 2.0 和 WinRM 2.0 (KB968930) KB2510061, Microsoft Office InfoPath 2007 安全更新 (KB2510061) MS11-049 KB2518865, 用于 Windows Vista SP1 和 Windows Server 2008 x86 的 .NET Framework 3.5 SP1 安全更新程序 (KB2518865) MS11-044 KB2538242, Microsoft Visual C++ 2005 Service Pack 1 Redistributable Package 的安全更新 (KB2538242) MS11-025 KB2538243, Microsoft Visual C++ 2008 Service Pack 1 Redistributable Package 的安全更新 (KB2538243) MS11-025 KB2541763, Windows Vista 更新程序 (KB2541763) KB2501584, Microsoft Office File Validation Add-in KB2536276, Windows Vista 安全更新程序 (KB2536276) MS11-043 KB982670, 用于 Windows Vista x86 的 Microsoft .NET Framework 4 Client Profile (KB982670) KB2583910, Microsoft Office Outlook 2007 更新 (KB2583910) KB2617986, Microsoft Silverlight 安全性更新 (KB2617986) MS11-078 KB2596560, Outlook 2007 垃圾邮件筛选器更新 (KB2596560) KB890830, Windows 恶意软件删除工具 - 2011 年 10 月 (KB890830) ================================== API HOOK 入口点错误:QueryServiceConfigW (危险等级: 高, 被下面模块所HOOK: 0x5F6D4995) ================================== 隐藏进程 N/A ================================== [/CODE]