瑞星卡卡安全论坛

首页 » 技术交流区 » 反病毒/反流氓软件论坛 » 救命啊
10130813 - 2006-5-19 11:03:00
我的IE不知道为啥，别人攻击了，现在打开IE经常出现打开一些莫名奇妙的网站
http://www.wangyou.com/reg/index6.html?unid=5&adid=8

http://www.17sp.com.cn/hello008.htm

等等，我改如何去修正啊？
10130813 - 2006-5-19 11:11:00
2006-05-19,10:54:08

System Repair Engineer 2.0.12.350 (2.0 RC 1)
    Windows XP Professional Service Pack 2 - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <ibmmessages><C:\Program Files\IBM\Messages By IBM\ibmmessages.exe>
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <MsnMsgr><"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <load><>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <dla><C:\WINDOWS\system32\dla\tfswctrl.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <ibmmessages><C:\Program Files\IBM\Messages By IBM\\ibmmessages.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <PWRMGRTR><rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <BLOG><rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <SynTPLpr><C:\Program Files\Synaptics\SynTP\SynTPLpr.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <SynTPEnh><C:\Program Files\Synaptics\SynTP\SynTPEnh.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <TpShocks><TpShocks.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <EZEJMNAP><C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <TPHOTKEY><C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <TPKBDLED><C:\WINDOWS\system32\TpScrLk.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <TPKMAPHELPER><C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <TP4EX><tp4ex.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <SoundMAXPnP><C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <SoundMAX><C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <vptray><C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <ACTray><C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <ACWLIcon><C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <ISUSPM Startup><C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <ISUSScheduler><"C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <ATIPTA><"C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe">
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <ExFilter><Rundll32.exe "C:\PROGRA~1\CNNIC\Cdn\cdnspie.dll,ExecFilter solo">
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <res><C:\WINDOWS\system32\res.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <CnsMin><Rundll32.exe C:\WINDOWS\downlo~1\CnsMin.dll,Rundll32>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <shell><Explorer.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <Userinit><C:\WINDOWS\system32\userinit.exe,>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <AppInit_DLLs><>

10130813 - 2006-5-19 11:11:00
==================================
启动文件夹
[Digital Line Detect]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Digital Line Detect.lnk><N>
[蓝牙控制盘]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\蓝牙控制盘.lnk><N>
[服务管理器]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\服务管理器.lnk><N>

==================================
服务
[Ac Profile Manager Service / AcPrfMgrSvc]
  <C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe><N/A>
[Access Connections Main Service / AcSvc]
  <C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe><Lenovo>
[Ati HotKey Poller / Ati HotKey Poller]
  <C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[pcAnywhere Host Service / awhost32]
  <C:\Program Files\Symantec\pcAnywhere\awhost32.exe><Symantec Corporation>
[Bluetooth Service / btwdins]
  <C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe><Broadcom Corporation>
[DefWatch / DefWatch]
  <"C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe"><Symantec Corporation>
[EvtEng / EvtEng]
  <C:\Program Files\Intel\Wireless\Bin\EvtEng.exe><Intel Corporation>
[ThinkPad PM Service / IBMPMSVC]
  <C:\WINDOWS\system32\ibmpmsvc.exe><N/A>
[InstallDriver Table Manager / IDriverT]
  <"C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe"><Macrovision Corporation>
[Symantec AntiVirus Client / Norton AntiVirus Server]
  <"C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe"><Symantec Corporation>
[OracleMTSRecoveryService / OracleMTSRecoveryService]
  <d:\oracle\ora92\bin\omtsreco.exe "OracleMTSRecoveryService"><Oracle Corporation>
[Oracleora920Agent / Oracleora920Agent]
  <d:\oracle\ora92\bin\agntsrvc.exe><Oracle Corporation>
[Oracleora920ClientCache / Oracleora920ClientCache]
  <d:\oracle\ora92\BIN\ONRSD.EXE><N/A>
[Oracleora920HTTPServer / Oracleora920HTTPServer]
  <"d:\oracle\ora92\Apache\Apache\apache.exe" --ntservice><N/A>
[Oracleora920PagingServer / Oracleora920PagingServer]
  <d:\oracle\ora92/bin/pagntsrv.exe><N/A>
[Oracleora920SNMPPeerEncapsulator / Oracleora920SNMPPeerEncapsulator]
  <d:\oracle\ora92\BIN\ENCSVC.EXE><N/A>
[Oracleora920SNMPPeerMasterAgent / Oracleora920SNMPPeerMasterAgent]
  <d:\oracle\ora92\BIN\AGNTSVC.EXE><N/A>
[Oracleora920TNSListener / Oracleora920TNSListener]
  <d:\oracle\ora92\BIN\TNSLSNR ><N/A>
[OracleServiceMARK / OracleServiceMARK]
  <d:\oracle\ora92\bin\ORACLE.EXE MARK><Oracle Corporation>
[RegSrvc / RegSrvc]
  <C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe><Intel Corporation>
[Spectrum24 Event Monitor / S24EventMonitor]
  <C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe><Intel Corporation >
[Registry Protector / SOCEESe]
  <C:\WINDOWS\SYSTEM32\RUNDLL32.EXE C:\WINDOWS\SYSTEM32\WBEM\IRJIT.DLL,Export 1087><N/A>
[SoundMAX Agent Service / SoundMAX Agent Service (default)]
  <C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.>
[ThinkPad HDD APS Logging Service / TPHDEXLGSVC]
  <System32\TPHDEXLG.EXE><Lenovo.>
[IBM KCU Service / TpKmpSVC]
  <C:\WINDOWS\system32\TpKmpSVC.exe><N/A>

==================================
浏览器加载项
[CLDown Object]
  {0BECAB3A-E1F8-45E6-8332-38DD750EBA01} <C:\Program Files\Tuotu\TuoTuHelper2.dll, N/A>
[CSaveTarget Object]
  {0E7505F8-8F30-41E0-9D1E-D9DEABD36D38} <C:\Program Files\Tuotu\MiniTuoTu.dll, N/A>
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[MICROQIL2]
  {832C0563-0820-4fef-83D8-418261DBC233} <C:\WINDOWS\system32\RAdminl.dll, RAdminl>
[CnsHook Class]
  {D157330A-9EF3-49F8-9A67-4141AC41ADD4} <C:\WINDOWS\downlo~1\CnsHook.dll, 北京三七二一科技有限公司>
[Yahoo 1G电邮]
  {507F9113-CD77-4866-BA92-0E86DA3D0B97} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail, N/A>
[寻宝乐趣多]
  {59BC54A2-56B3-44a0-93E5-432D58746E26} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao, N/A>
[雅虎助手]
  {5D73EE86-05F1-49ed-B850-E423120EC338} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist, N/A>
[信息检索(&R)]
  {92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[@btrez.dll,-4015]
  {CCA281CA-C863-46ef-9331-5C8D4460577F} <, N/A>
[更新 ThinkPad 软件]
  {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} <C:\Program Files\Lenovo\PkgMgr\PkgMgr.exe, Lenovo Group Limited>
[脱兔下载]
  {D5C1CCC2-811B-4bf2-BF22-0D3B89600F5B} <C:\Program Files\Tuotu\TuoTu.exe, Tuotu.com>
[QQIEFloatBarCfgCmd Class]
  {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[情景聊天]
  {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg, N/A>
[]
  {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair, N/A>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[]
  {FD00D911-7529-4084-9946-A29F1BDF4FE5} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean, N/A>
[WUWebControl Class]
  {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[Java Plug-in 1.4.1_02]
  {8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\j2re1.4.1_02\bin\npjpi141_02.dll, JavaSoft / Sun Microsystems, Inc.>
[Java Plug-in 1.4.1_02]
  {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} <C:\Program Files\Java\j2re1.4.1_02\bin\npjpi141_02.dll, JavaSoft / Sun Microsystems, Inc.>
[CLDown Object]
  {0BECAB3A-E1F8-45E6-8332-38DD750EBA01} <C:\Program Files\Tuotu\TuoTuHelper2.dll, N/A>
[CSaveTarget Object]
  {0E7505F8-8F30-41E0-9D1E-D9DEABD36D38} <C:\Program Files\Tuotu\MiniTuoTu.dll, N/A>
[Windows Media Player]
  {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
  {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[MICROQIL2]
  {832C0563-0820-4FEF-83D8-418261DBC233} <C:\WINDOWS\system32\RAdminl.dll, RAdminl>
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Microsoft Scriptlet Component]
  {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[CnsHook Class]
  {D157330A-9EF3-49F8-9A67-4141AC41ADD4} <C:\WINDOWS\downlo~1\CnsHook.dll, 北京三七二一科技有限公司>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\Flash.ocx, Macromedia, Inc.>
[上传到QQ网络硬盘]
  <C:\Program Files\Tencent\qq\AddToNetDisk.htm, N/A>
[使用脱兔下载]
  <C:\Program Files\Tuotu\TT_one.htm, N/A>
[使用脱兔下载全部链接]
  <C:\Program Files\Tuotu\TT_all.htm, N/A>
[发送到 Bluetooth(&B)]
  <C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
  <res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
  <C:\Program Files\Tencent\qq\AddPanel.htm, N/A>
[添加到QQ表情]
  <C:\Program Files\Tencent\qq\AddEmotion.htm, N/A>
[添加到雅虎订阅(&Y)]
  <res://C:\Program Files\Yahoo!\Assistant\Assist\yrss.dll/YRSSMENUEXT, N/A>
[用QQ彩信发送该图片]
  <C:\Program Files\Tencent\qq\SendMMS.htm, N/A>
10130813 - 2006-5-19 11:12:00
==================================
正在运行的进程
[PID: 904][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 992][\??\C:\WINDOWS\system32\csrss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1020][\??\C:\WINDOWS\system32\winlogon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\Program Files\ThinkPad\ConnectUtilities\ACNotify.dll]  <Lenovo><4, 11, 0, 0>
    [C:\Program Files\ThinkPad\ConnectUtilities\AcSvcStub.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\AcLocSettings.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\ACHelper.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\Ati2evxx.dll]  <ATI Technologies Inc.><6.14.10.4118>
    [C:\WINDOWS\system32\tphklock.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\NavLogon.dll]  <N/A><N/A>
[PID: 1064][C:\WINDOWS\system32\services.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1076][C:\WINDOWS\system32\lsass.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1248][C:\WINDOWS\system32\ibmpmsvc.exe]  <N/A><N/A>
[PID: 1276][C:\WINDOWS\system32\Ati2evxx.exe]  <ATI Technologies Inc.><6.14.10.4118>
    [C:\WINDOWS\system32\Ati2edxx.dll]  <ATI Technologies, Inc.><6, 14, 10, 2497>
[PID: 1288][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1364][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1480][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [d:\oracle\ora92\bin\oci.dll]  <Oracle Corporation><9.2.0.1.0>
[PID: 1608][C:\Program Files\Intel\Wireless\Bin\EvtEng.exe]  <Intel Corporation><9, 0, 4, 0>
    [C:\Program Files\Intel\Wireless\Bin\PsRegApi.dll]  <Intel Corporation><9, 0, 4, 0>
    [C:\Program Files\Intel\Wireless\Bin\TraceAPI.DLL]  <Intel Corporation><9, 0, 4, 0>
[PID: 1680][C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe]  <Intel Corporation ><9, 0, 4, 0>
    [C:\Program Files\Intel\Wireless\Bin\TraceAPI.DLL]  <Intel Corporation><9, 0, 4, 0>
    [C:\Program Files\Intel\Wireless\Bin\PsRegApi.dll]  <Intel Corporation><9, 0, 4, 0>
[PID: 1744][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1920][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 360][C:\WINDOWS\system32\spoolsv.exe]  <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)>
    [C:\WINDOWS\system32\bthcrp.dll]  <Broadcom Corporation><3.0.1.918>
    [C:\WINDOWS\system32\WidcommSdk.dll]  <Broadcom Corporation><3.0.1.918>
    [C:\WINDOWS\system32\wbtapi.dll]  <Broadcom Corporation><3.0.1.918>
    [C:\WINDOWS\system32\awmon.dll]  <Symantec Corporation><9.2.1>
[PID: 804][C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\AcLocSettings.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgr.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\AcCryptHlpr.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\ACHelper.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\ACON.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\ACTurinSupport.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\AcAdaptersInfo.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\AcLocMigrator.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\ThinQCon.dll]  <N/A><N/A>
[PID: 828][C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe]  <Broadcom Corporation><3.0.1.918>
[PID: 856][C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe]  <Symantec Corporation><8.00.00.9374>
[PID: 932][C:\PROGRA~1\MICROS~2\MSSQL\binn\sqlservr.exe]  <Microsoft Corporation><2000.080.0194.00>
[PID: 1692][C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe]  <Symantec Corporation><8.00.00.9374>
    [C:\WINDOWS\system32\CBA.DLL]  <Intel? Corporation><6.12.0.71 E>
    [C:\WINDOWS\system32\MsgSys.dll]  <Intel? Corporation><6.12.0.71 E>
    [C:\WINDOWS\system32\NTS.dll]  <Intel? Corporation><6.12.0.71 E>
    [C:\WINDOWS\system32\PDS.DLL]  <Intel? Corporation><6.12.0.71 E>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVLU.dll]  <Symantec Corporation><8.00.00.9374>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVNTUTL.DLL]  <Symantec/Peter Norton Group><1, 0, 0, 1>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\i2ldvp3.dll]  <Symantec Corporation><8.00.00.9374>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVAPI32.DLL]  <Symantec Corp.><4.1.0.15>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20060503.018\NAVEX32a.DLL]  <Symantec Corporation><20061.1.0.14>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20060503.018\NAVENG32.DLL]  <Symantec Corporation><20061.1.0.14>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVAP32.DLL]  <Symantec Corporation><9.0.0.14>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vpmsece.dll]  <Symantec Corporation><8.00.00.9374>
[PID: 1772][C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe]  <Intel Corporation><9, 0, 4, 0>
[PID: 1880][C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe]  <Analog Devices, Inc.><3, 2, 6, 0>
[PID: 2016][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1620][C:\WINDOWS\System32\TPHDEXLG.EXE]  <Lenovo.><1.40>
[PID: 536][C:\WINDOWS\system32\TpKmpSVC.exe]  <N/A><N/A>
[PID: 580][C:\WINDOWS\system32\wdfmgr.exe]  <Microsoft Corporation><5.2.3790.1230 built by: DNSRV(bld4act)>
[PID: 636][C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe]  <Lenovo><4, 11, 0, 0>
    [C:\Program Files\ThinkPad\ConnectUtilities\AcLocSettings.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgr.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\AcCryptHlpr.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\ACHelper.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\ACON.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\ACTurinSupport.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\AcSvcHlpr.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\AcAdaptersInfo.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\ANCA.dll]  <IBM Corp.><8.3>
    [C:\Program Files\ThinkPad\ConnectUtilities\ANC.dll]  <IBM Corp.><8.3>
    [C:\Program Files\ThinkPad\ConnectUtilities\AcSvcStub.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\AcMuroc.dll]  <N/A><N/A>
[PID: 1544][C:\WINDOWS\System32\alg.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 2892][C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe]  <Lenovo><4, 11, 0, 0>
    [C:\Program Files\ThinkPad\ConnectUtilities\AcLocSettings.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgr.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\AcCryptHlpr.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\ACHelper.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\AcSvcStub.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\ACGUIHlpr.dll]  <Lenovo><4, 11, 0, 0>
    [C:\Program Files\ThinkPad\ConnectUtilities\ACON.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\ACTurinSupport.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\Res\SC\GUIHlprRes.dll]  <Lenovo><4, 0, 0, 0>
    [C:\Program Files\ThinkPad\ConnectUtilities\Res\SC\SvcHlprRes.dll]  <Lenovo><4, 0, 0, 0>
[PID: 3036][C:\WINDOWS\system32\Ati2evxx.exe]  <ATI Technologies Inc.><6.14.10.4118>
    [C:\WINDOWS\system32\Ati2edxx.dll]  <ATI Technologies, Inc.><6, 14, 10, 2497>
[PID: 3276][C:\WINDOWS\Explorer.EXE]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL]  <Lenovo Group Limited><1, 0, 0, 0>
    [C:\PROGRA~1\ThinkPad\UTILIT~1\SC\PWRMGRRT.DLL]  <N/A><N/A>
    [C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRIF.DLL]  <N/A><N/A>
    [C:\WINDOWS\system32\Sensor.dll]  <Lenovo.><1.40>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
    [C:\WINDOWS\downlo~1\CnsHook.dll]  <北京三七二一科技有限公司><1, 0, 2, 7>
    [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll]  <Adobe Systems, Inc.><7.0.0.0>
[PID: 3348][C:\WINDOWS\system32\wbem\wmiprvse.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
10130813 - 2006-5-19 11:13:00
[PID: 3540][C:\WINDOWS\system32\Rundll32.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\WINDOWS\downlo~1\CnsMinIO.dll]  <北京三七二一科技有限公司><1, 0, 3, 6>
    [C:\WINDOWS\downlo~1\cnsio.dll]  <北京三七二一科技有限公司><1, 0, 2, 7>
[PID: 3928][C:\WINDOWS\system32\dla\tfswctrl.exe]  <Sonic Solutions><1.04.08a>
    [C:\WINDOWS\system32\tfswapi.dll]  <Sonic Solutions><1.04.08a>
    [C:\WINDOWS\system32\dla\tfswcres.dll]  <Sonic Solutions><1.04.08a>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
[PID: 3944][C:\Program Files\IBM\Messages By IBM\ibmmessages.exe]  <IBM><2.101>
    [C:\WINDOWS\system32\AIBMRUNL.dll]  <N/A><N/A>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\Program Files\IBM\Messages By IBM\AcpPollingEngine.dll]  <><1, 0, 0, 4>
    [C:\WINDOWS\Downloaded Program Files\IbmEgath.dll]  <IBM Corporation><3, 0, 0, 9>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
[PID: 3980][C:\WINDOWS\system32\rundll32.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL]  <Lenovo Group Limited><1, 0, 0, 0>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\PROGRA~1\ThinkPad\UTILIT~1\SC\PWRMGRRT.DLL]  <N/A><N/A>
    [C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRIF.DLL]  <N/A><N/A>
    [C:\WINDOWS\system32\Sensor.dll]  <Lenovo.><1.40>
    [C:\WINDOWS\system32\OEMDSPIF.DLL]  <ATI Technologies, Inc.><6.14.0013>
[PID: 4076][C:\Program Files\Synaptics\SynTP\SynTPLpr.exe]  <Synaptics, Inc.><7.5.17.18 15Sep05>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
[PID: 1816][C:\Program Files\Synaptics\SynTP\SynTPEnh.exe]  <Synaptics, Inc.><7.5.17.18 15Sep05>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\WINDOWS\system32\SynCOM.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
    [C:\WINDOWS\system32\SynTPAPI.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
    [C:\WINDOWS\downlo~1\CnsHook.dll]  <北京三七二一科技有限公司><1, 0, 2, 7>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
[PID: 1068][C:\WINDOWS\system32\TpShocks.exe]  <Lenovo, Ltd. and IBM Corporation.><1, 3, 4, 0>
    [C:\Program Files\ThinkPad\TpShocks\MUI\0804\TpShocks.dll]  <Lenovo, Ltd. and IBM Corporation.><1, 3, 3, 0>
    [C:\WINDOWS\system32\Sensor.dll]  <Lenovo.><1.40>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
[PID: 1116][C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe]  <Lenovo Group Limited><1, 0, 0, 0>
    [C:\PROGRA~1\ThinkPad\UTILIT~1\SC\EzMApRes.dll]  <N/A><N/A>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
[PID: 1428][C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe]  <N/A><N/A>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\Program Files\Lenovo\PkgMgr\HOTKEY_2\tphk_2k.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\Oemdspif.dll]  <ATI Technologies, Inc.><6.14.0013>
    [C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\tpfnf7.dll]  <N/A><N/A>
[PID: 1424][C:\WINDOWS\system32\TpScrLk.exe]  <N/A><N/A>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
[PID: 1564][C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe]  <Analog Devices, Inc.><5, 0, 2, 2>
    [C:\Program Files\Analog Devices\SoundMAX\SMWDMIF.dll]  <Analog Devices, Inc.><5, 0, 2, 008>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
[PID: 1600][C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe]  <N/A><N/A>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
[PID: 1624][C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe]  <Lenovo Group Limited><1.16>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
[PID: 1632][C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe]  <Symantec Corporation><8.00.00.9374>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Cliproxy.dll]  <Symantec Corporation><8.00.00.9374>
    [C:\PROGRA~1\SYMANT~1\SYMANT~1\NAVNTUTL.DLL]  <Symantec/Peter Norton Group><1, 0, 0, 1>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Cliscan.dll]  <Symantec Corporation><8.00.00.9374>
[PID: 2068][C:\Program Files\ThinkPad\ConnectUtilities\AcMurocHlpr.exe]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\ACON.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\AcLocSettings.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgr.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\AcCryptHlpr.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\ACHelper.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\ACTurinSupport.dll]  <N/A><N/A>
    [C:\Program Files\Intel\Wireless\Bin\PfMgrApi.dll]  <Intel Corporation><9, 0, 4, 0>
    [C:\Program Files\Intel\Wireless\Bin\TraceAPI.DLL]  <Intel Corporation><9, 0, 4, 0>
    [C:\Program Files\Intel\Wireless\Bin\PsRegApi.dll]  <Intel Corporation><9, 0, 4, 0>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\Program Files\Intel\Wireless\Bin\MurocAPI.dll]  <Intel Corporation><9, 0, 4, 0>
    [C:\Program Files\Intel\Wireless\Bin\S24MUDLL.dll]  <Intel Corporation><9, 0, 4, 0>
    [C:\Program Files\Intel\Wireless\Bin\C1XStngs.dll]  <Intel Corporation><9, 0, 4, 0>
    [C:\Program Files\Intel\Wireless\Bin\LIBEAY32.dll]  <N/A><N/A>
    [C:\Program Files\Intel\Wireless\Bin\C8021CHS.dll]  <Intel Corporation><9, 0, 4, 0>
    [C:\Program Files\Intel\Wireless\Bin\LSAWRAPI.dll]  <Intel Corporation><9, 0, 4, 0>
    [C:\Program Files\Intel\Wireless\Bin\D8021Xps.DLL]  <N/A><N/A>
10130813 - 2006-5-19 11:13:00
[PID: 2080][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  <RealNetworks, Inc.><0.1.0.1622>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
[PID: 2172][C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe]  <Lenovo><4, 11, 0, 0>
    [C:\Program Files\ThinkPad\ConnectUtilities\AcLocSettings.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\ACGUIHlpr.dll]  <Lenovo><4, 11, 0, 0>
    [C:\Program Files\ThinkPad\ConnectUtilities\AcSvcStub.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\ACHelper.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgr.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\AcCryptHlpr.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\Res\SC\GUIHlprRes.dll]  <Lenovo><4, 0, 0, 0>
    [C:\Program Files\ThinkPad\ConnectUtilities\Res\SC\TrayRes.dll]  <Lenovo><4, 0, 0, 0>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
[PID: 2180][C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe]  <Lenovo><4, 11, 0, 0>
    [C:\Program Files\ThinkPad\ConnectUtilities\AcLocSettings.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\ACGUIHlpr.dll]  <Lenovo><4, 11, 0, 0>
    [C:\Program Files\ThinkPad\ConnectUtilities\AcSvcStub.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\ACHelper.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgr.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\AcCryptHlpr.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\Res\SC\GUIHlprRes.dll]  <Lenovo><4, 0, 0, 0>
    [C:\Program Files\ThinkPad\ConnectUtilities\Res\SC\IconRes.dll]  <Lenovo><4, 0, 0, 0>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
[PID: 2200][C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe]  <InstallShield Software Corporation><3, 10, 100, 1155>
[PID: 2252][C:\WINDOWS\system32\res.exe]  <N/A><N/A>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
[PID: 2380][C:\WINDOWS\system32\ctfmon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
[PID: 2376][C:\Program Files\MSN Messenger\MsnMsgr.Exe]  <Microsoft Corporation><7.5.0324>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\WINDOWS\system32\msdmo.dll]  <N/A><N/A>
[PID: 2564][C:\Program Files\Digital Line Detect\DLG.exe]  <BVRP Software><1, 0, 0, 1>
    [C:\Program Files\Digital Line Detect\BVRPDIAG.dll]  <BVRP Software><1.0>
    [C:\WINDOWS\system32\MdmXSdk.dll]  <Conexant><1.0.2.010>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
[PID: 2612][C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe]  <Broadcom Corporation><3.0.1.918>
    [C:\WINDOWS\system32\wbtapi.dll]  <Broadcom Corporation><3.0.1.918>
    [C:\WINDOWS\system32\btosif.dll]  <Broadcom Corporation><3.0.1.918>
    [C:\Program Files\ThinkPad\Bluetooth Software\BtBalloon.dll]  <Broadcom Corporation><3.0.1.918>
    [C:\WINDOWS\system32\btrez.dll]  <Broadcom Corporation><3.0.1.918>
    [C:\WINDOWS\system32\CSH.dll]  <Blue Sky Software Corporation><2.00.039>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\Program Files\ThinkPad\Bluetooth Software\btkeyind.dll]  <N/A><N/A>
[PID: 2652][C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe]  <Intel><9, 0, 4, 0>
    [C:\PROGRA~1\Intel\Wireless\Bin\IntelAE5.dll]  <Meetinghouse Data Communications><3, 0, 34, 0>
    [C:\PROGRA~1\Intel\Wireless\Bin\TraceAPI.DLL]  <Intel Corporation><9, 0, 4, 0>
    [C:\PROGRA~1\Intel\Wireless\Bin\PsRegApi.dll]  <Intel Corporation><9, 0, 4, 0>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\Program Files\Intel\Wireless\Bin\D8021Xps.DLL]  <N/A><N/A>
[PID: 2732][C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe]  <Microsoft Corporation><2000.080.0194.00>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
[PID: 3984][C:\WINDOWS\system32\wuauclt.exe]  <Microsoft Corporation><5.8.0.2469 built by: lab01_n(wmbla)>
10130813 - 2006-5-19 11:13:00
[PID: 3448][C:\Program Files\Sybase\PowerBuilder 8.0\pb80.exe]  <Sybase Inc.><8.0.00.6028>
    [C:\Program Files\Sybase\Shared\PowerBuilder\PBSYS80.dll]  <Sybase Inc.><8.0.4.10784>
    [C:\Program Files\Sybase\Shared\PowerBuilder\PBCMP80.dll]  <Sybase Inc.><8.0.4.10784>
    [C:\Program Files\Sybase\Shared\PowerBuilder\PBVM80.dll]  <Sybase Inc.><8.0.4.10784>
    [C:\Program Files\Sybase\Shared\PowerBuilder\libjcc.dll]  <N/A><N/A>
    [C:\Program Files\Sybase\Shared\PowerBuilder\PBDWE80.dll]  <Sybase Inc.><8.0.4.10784>
    [C:\Program Files\Sybase\Shared\PowerBuilder\PBDTS80.dll]  <Sybase Inc.><8.0.4.10784>
    [C:\Program Files\Sybase\Shared\PowerBuilder\PBDWP80.dll]  <Sybase Inc.><8.0.4.10784>
    [C:\Program Files\Sybase\Shared\PowerBuilder\PBSQL80.dll]  <Sybase Inc.><8.0.4.10784>
    [C:\Program Files\Sybase\Shared\PowerBuilder\PBLIB80.dll]  <Sybase Inc.><8.0.4.10784>
    [C:\Program Files\Sybase\Shared\PowerBuilder\PBDEV80.dll]  <Sybase Inc.><8.0.4.10784>
    [C:\Program Files\Sybase\Shared\PowerBuilder\PBORC80.dll]  <Sybase Inc.><8.0.4.10784>
    [C:\Program Files\Sybase\Shared\PowerBuilder\PBAPL80.dll]  <Sybase Inc.><8.0.4.10784>
    [C:\Program Files\Sybase\Shared\PowerBuilder\PBUDO80.dll]  <Sybase Inc.><8.0.4.10784>
    [C:\Program Files\Sybase\Shared\PowerBuilder\PBSCR80.dll]  <Sybase Inc.><8.0.4.10784>
    [C:\Program Files\Sybase\Shared\PowerBuilder\PBWED80.dll]  <Sybase Inc.><8.0.4.10784>
    [C:\Program Files\Sybase\Shared\PowerBuilder\PBDPP80.dll]  <Sybase Inc.><8.0.4.10784>
    [C:\Program Files\Sybase\Shared\PowerBuilder\PBEAS80.dll]  <Sybase Inc.><8.0.4.10784>
    [C:\Program Files\Sybase\Shared\PowerBuilder\pbweb80.dll]  <Sybase Inc.><8.0.4.10784>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\Program Files\Sybase\Shared\PowerBuilder\pbwep80.dll]  <Sybase Inc.><8.0.4.10784>
    [C:\Program Files\Sybase\Shared\PowerBuilder\pbwei80.dll]  <Sybase Inc.><8.0.4.10784>
[PID: 3956][C:\Program Files\Tencent\qq\QQ.exe]  <TENCENT><0, 0, 0, 0>
    [C:\Program Files\Tencent\qq\QQBaseClassInDll.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\qq\QQHelperDll.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\qq\BasicCtrlDll.dll]  <Tencent><5, 0, 200, 160>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\Program Files\Tencent\qq\QQAPI.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\qq\TIMProxy.dll]  <tencent><0, 3, 2, 4>
    [C:\Program Files\Tencent\qq\LoginCtrl.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\qq\npkcntc.dll]  <INCA Internet Co., Ltd.><2006, 3, 2, 1>
    [C:\Program Files\Tencent\qq\npkpdb.dll]  <INCA Internet Co., Ltd.><2003, 10, 1, 1>
    [C:\Program Files\ThinkPad\Bluetooth Software\btkeyind.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\qq\QQRes.dll]  <tencent><1, 0, 0, 1>
    [C:\Program Files\Tencent\qq\QQMainFrame.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\qq\CQQApplication.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\qq\NewSkin.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\qq\HostingMgr.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\qq\CameraDll.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\qq\MailSummary.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\qq\QQSpace.dll]  <><1, 0, 0, 1>
    [C:\WINDOWS\system32\msdmo.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\qq\QQGroupMng.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\qq\GroupLive.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\qq\QQSysMsgMng.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\qq\QQSettingCtrl.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\qq\UserDefinedHead.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\qq\QQPlugin.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\qq\QQConfigPlugin.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\qq\QRingMng.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\qq\PhoneAPI.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\qq\DialerAllinOne.dll]  <tencent><1, 4, 0, 0>
    [C:\Program Files\Tencent\qq\QQPet.dll]  <><1, 0, 0, 1>
    [C:\WINDOWS\downlo~1\CnsHook.dll]  <北京三七二一科技有限公司><1, 0, 2, 7>
    [C:\Program Files\Tencent\qq\QQAvatar.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\qq\FlashAvatarDll.dll]  <><1, 4, 0, 1>
    [C:\Program Files\Tencent\qq\LongConnection.dll]  <tencent><5, 0, 200, 160>
    [C:\Program Files\Tencent\qq\BQQApplication.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\qq\QQAllInOne.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\qq\SCCore.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\qq\QQCustomFace.dll]  <N/A><N/A>
[PID: 1312][C:\Program Files\Tencent\qq\TIMPlatform.exe]  <tencent><0, 3, 1, 8>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\Program Files\Tencent\qq\TIMProxy.dll]  <tencent><0, 3, 2, 4>
[PID: 3028][C:\Program Files\Tencent\qq\qqpet\qqpet.exe]  <腾讯公司><2, 38, 101, 55>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\Program Files\Tencent\qq\qqpet\QQPetResDownload.dll]  <><6, 1, 101, 55>
    [C:\Program Files\Tencent\qq\qqpet\QQPetCommunity.dll]  <><6, 1, 101, 55>
    [C:\WINDOWS\system32\macromed\flash\Flash.ocx]  <Macromedia, Inc.><7,0,19,0>
[PID: 3592][C:\Program Files\WinRAR\WinRAR.exe]  <N/A><N/A>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
[PID: 3752][C:\DOCUME~1\Mark\LOCALS~1\Temp\Rar$EX00.047\SREng.exe]  <Smallfrogs Studio><2.0.12.350>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================
10130813 - 2006-5-19 11:14:00
麻烦斑竹给看看吧
魔法学徒 - 2006-5-19 11:34:00
刚买的笔记本就中马啦？！

删除以下项目
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<res><C:\WINDOWS\system32\res.exe>
[Registry Protector / SOCEESe]
<C:\WINDOWS\SYSTEM32\RUNDLL32.EXE C:\WINDOWS\SYSTEM32\WBEM\IRJIT.DLL,Export 1087><N/A>
[MICROQIL2]
{832C0563-0820-4fef-83D8-418261DBC233} <C:\WINDOWS\system32\RAdminl.dll, RAdminl>

重启后删除

C:\WINDOWS\system32\res.exe
C:\WINDOWS\SYSTEM32\WBEM\IRJIT.DLL
C:\WINDOWS\system32\RAdminl.dll
10130813 - 2006-5-19 12:08:00
引用:
【魔法学徒的贴子】刚买的笔记本就中马啦？！

删除以下项目
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<res><C:\WINDOWS\system32\res.exe>
[Registry Protector / SOCEESe]
<C:\WINDOWS\SYSTEM32\RUNDLL32.EXE C:\WINDOWS\SYSTEM32\WBEM\IRJIT.DLL,Export 1087><N/A>
[MICROQIL2]
{832C0563-0820-4fef-83D8-418261DBC233} <C:\WINDOWS\system32\RAdminl.dll, RAdminl>

重启后删除

C:\WINDOWS\system32\res.exe
C:\WINDOWS\SYSTEM32\WBEM\IRJIT.DLL
C:\WINDOWS\system32\RAdminl.dll
...........................


是的啊，真伤心的，才装好不久就这样
谢谢老大了
10130813 - 2006-5-19 12:13:00
对了，再问一下，如何清楚那些3721的东西啊
我无邪 - 2006-5-19 14:00:00
先到添加删除程序中卸载
重启后，可以删除它的文件夹
下载超级兔子的话，可以进一步清理残留的文件。
http://dl.pconline.com.cn/html_2/1/75/id=273&pn=0.html
安装好后，打开“超级兔子优化王”“专业卸载
10130813 - 2006-5-19 15:29:00
引用:
【我无邪的贴子】先到添加删除程序中卸载
重启后，可以删除它的文件夹
下载超级兔子的话，可以进一步清理残留的文件。
http://dl.pconline.com.cn/html_2/1/75/id=273&pn=0.html
安装好后，打开“超级兔子优化王”“专业卸载
...........................


谢谢，按照你的方法处理好了
叶·幽思 - 2006-5-19 15:44:00
引用:
【10130813的贴子】对了，再问一下，如何清楚那些3721的东西啊
...........................


对于"流氓软件"到相应的版块,对付它的方法很多~
1
查看完整版本: 救命啊
© 2000 - 2026 Rising Corp. Ltd.