www.my123.com日志搜集贴 bbs.ikaka.com

晕哦哦哦 - 2006-11-11 14:50:00

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

+ RavTaskRavTimerBeijing Rising Technology Co., Ltd.c:\program files\rising\rav\ravtask.exe

+ yassistseAssistSettingYahoo! Chinac:\program files\yahoo!\assistant\yassistse.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

+ RavStubRising RavStubBeijing Rising Technology Co., Ltd.c:\program files\rising\rav\ravstub.exe

HKCU\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components

+ 0File not found: About:Home

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad

+ DLMonFile not found: C:\WINDOWS\system32\DLMain.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

+ Cnscheck100.dllFile not found: C:\WINDOWS\system32\Cnscheck100.dll

+ yclickon.dllClickOn ModuleYAHOO Corporation Limitedc:\program files\yahoo!\assistant\yclickon.dll

+ ypatch.dllypatchYahoo! Chinac:\program files\yahoo!\assistant\assist\ypatch.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved

+ Display Panning CPL ExtensionFile not found: deskpan.dll

+ HyperTerminal Icon ExtHyperTerminal Applet LibraryHilgraeve, Inc.c:\windows\system32\hticons.dll

+ RISINGRising Shell Ext ModuleBeijing Rising Technology Co., Ltd.c:\windows\system32\ravext.dll

+ Shell Extensions for RealOne PlayerRealPlayer Shell ExtensionsRealNetworks, Inc.c:\program files\real\realplayer\rpshell.dll

+ WinRAR shell extensionc:\program files\winrar\rarext.dll

+ Yahoo Trojan Cleannere:\ske\contmenu.dll

+ Yahoo!PhotoyPhtbYahoo! Chinac:\program files\yahoo!\assistant\assist\yphtb.dll

+ 粉碎文件Wiper 动态链接库Yahoo! Chinac:\program files\yahoo!\assistant\assist\ywiper.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

+ AntiFish Classyangling.dllyahoo! chinac:\program files\yahoo!\assistant\assist\yangling.dll

+ assistAssist ModuleYahoo! Chinac:\program files\yahoo!\assistant\assist\yassist.dll

+ DragSearch BHODragSearchyahoo! chinac:\program files\yahoo!\assistant\assist\ydragsearch.dll

+ QQBrowserHelperObject ClassQQIEHelper Module深圳市腾讯计算机系统有限公司d:\qq\qqiehelper.dll

+ Thunder Browser HelperXunLeiBHOThunder Networking Technologies,LTDd:\迅雷\comdlls\xunleibho_002.dll

+ ThunderIEHelper Classxunleibho BHOThunder Networking Technologies,LTDc:\windows\system32\xunleibho_v13.dll

+ Yahoo!PhotoyPhtbYahoo! Chinac:\program files\yahoo!\assistant\assist\yphtb.dll

HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks

+ coolbarIE ToolBandyahoo! chinac:\program files\yahoo!\assistant\assist\yasbar.dll

HKLM\Software\Microsoft\Internet Explorer\Toolbar

+ kakatool.dllBeijing Rising Technology Co., Ltd.c:\windows\system32\kakatool.dll

+ 雅虎助手IE ToolBandyahoo! chinac:\program files\yahoo!\assistant\assist\yasbar.dll

HKLM\Software\Microsoft\Internet Explorer\Extensions

+ 联想File not found: http://www.lenovo.com

+ 腾讯QQQQTENCENTd:\qq\qq.exe

HKLM\System\CurrentControlSet\Services

+ RsCCenterCCenterBeijing Rising Technology Co., Ltd.c:\program files\rising\rav\ccenter.exe

+ RsRavMonRavMondBeijing Rising Technology Co., Ltd.c:\program files\rising\rav\ravmond.exe

HKLM\System\CurrentControlSet\Services

+ ALCXWDMRealtek AC'97 Audio Driver (WDM)Realtek Semiconductor Corp.c:\windows\system32\drivers\alcxwdm.sys

+ BaseTDIbasetdiBeijing Rising Technology Co., Ltd.c:\windows\system32\drivers\basetdi.sys

+ CA561Universal Serial Bus Camera DriverSPc:\windows\system32\drivers\spca561.sys

+ dhihaggbDriver Device Driver中国互联网络信息中心(CNNIC)c:\windows\system32\drivers\dhihaggb.sys

+ ExpScanerExpScan.sysc:\program files\rising\rav\expscan.sys

+ FETNDISNDIS 5.0 miniport driverVIA Technologies, Inc. c:\windows\system32\drivers\fetnd5.sys

+ HOOKAPIFile not found: D:\PROGRAM FILES\RISING\RAV\HookApi.Sys

+ HookContTDI HOOK DriverRising tech Co. ltdc:\program files\rising\rav\hookcont.sys

+ HookRegc:\program files\rising\rav\hookreg.sys

+ HookSysHooksysRisingc:\program files\rising\rav\hooksys.sys

+ MEMSCANMemScan Driver瑞星软件有限公司c:\program files\rising\rav\memscan.sys

+ npkcryptnProtect KeyCrypt DriverINCA Internet Co., Ltd.d:\qq\npkcrypt.sys

+ PtilinkDirect Parallel Link DriverParallel Technologies, Inc.c:\windows\system32\drivers\ptilink.sys

+ PxHelp20Px Engine Device Driver for Windows 2000/XPSonic Solutionsc:\windows\system32\drivers\pxhelp20.sys

+ RSPPSYSRSPPSYSRisingc:\program files\rising\rav\rsppsys.sys

+ SecdrvSafeDisc driverc:\windows\system32\drivers\secdrv.sys

+ viagfxVIA/S3G Miniport DriverCopyright (C) VIA/S3 Graphics Co, Ltd.c:\windows\system32\drivers\vtmini.sys

FreedomStar - 2006-11-11 15:06:00

2006-11-11,14:44:35

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows XP Home Edition Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Corporation]
<SiSPower><Rundll32.exe SiSPower.dll,ModeAgent> [Silicon Integrated Systems Corporation]
<SiS Windows KeyHook><C:\WINDOWS\system32\keyhook.exe> [Silicon Integrated Systems Corporation]
<AGRSMMSG><AGRSMMSG.exe> [(Verified)Agere Systems]
<SoundMan><SOUNDMAN.EXE> [(Verified)Realtek Semiconductor Corp.]
<RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
<iuuyuj78><C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\iuuyuj78.dll,DllCanUnloadNow> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{BC207F7D-3E63-4ACA-99B5-FB5F8428200C}><C:\WINDOWS\DOWNLO~1\BDPlugin.dll> []
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll> [(Verified)Microsoft Corporation]

==================================
启动文件夹
[EmEditor]
<C:\Documents and Settings\Owner\「开始」菜单\程序\启动\EmEditor.lnk --> E:\Emeditor\emedtray.exe [N/A]><N>

==================================
服务
[Application Management / AppMgmt]
<C:\WINDOWS\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\appmgmts.dll><N/A>
[BlueSoleil Hid Service / BlueSoleil Hid Service]
<F:\BlueTooth\BTNtService.exe><N/A>
[FspadSvc / FspadSvc]
<C:\Program Files\AVC Finger-sensing Pad Driver\FspadSvr.exe><N/A>
[Human Interface Device Access / HidServ]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[MySQL / MySQL]
<"C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt" --defaults-file="C:\Program Files\MySQL\MySQL Server 5.0\my.ini" MySQL><N/A>
[OracleDBConsoledbsEdward / OracleDBConsoledbsEdward]
<F:\oracle\product\10.2.0\db_2\bin\nmesrvc.exe><Oracle Corporation>
[OracleDBConsoleorcl / OracleDBConsoleorcl]
<F:\oracle\product\10.2.0\db_2\bin\nmesrvc.exe><Oracle Corporation>
[OracleDBConsoleorclpri / OracleDBConsoleorclpri]
<F:\oracle\product\10.2.0\db_3\bin\nmesrvc.exe><Oracle Corporation>
[OracleJobSchedulerDBSEDWARD / OracleJobSchedulerDBSEDWARD]
<f:\oracle\product\10.2.0\db_2\Bin\extjob.exe DBSEDWARD><N/A>
[OracleJobSchedulerORCL / OracleJobSchedulerORCL]
<f:\oracle\product\10.2.0\db_2\Bin\extjob.exe ORCL><N/A>
[OracleJobSchedulerORCLPRI / OracleJobSchedulerORCLPRI]
<f:\oracle\product\10.2.0\db_3\Bin\extjob.exe ORCLPRI><N/A>
[OracleOraDb10g_home1iSQL*Plus / OracleOraDb10g_home1iSQL*Plus]
<F:\oracle\product\10.2.0\db_2\bin\isqlplussvc.exe><Oracle>
[OracleOraDb10g_home1TNSListener / OracleOraDb10g_home1TNSListener]
<F:\oracle\product\10.2.0\db_2\BIN\TNSLSNR ><N/A>
[OracleOraDb10g_home3iSQL*Plus / OracleOraDb10g_home3iSQL*Plus]
<F:\oracle\product\10.2.0\db_3\bin\isqlplussvc.exe><Oracle>
[OracleOraDb10g_home3TNSListener / OracleOraDb10g_home3TNSListener]
<F:\oracle\product\10.2.0\db_3\BIN\TNSLSNR ><N/A>
[OracleServiceDBSEDWARD / OracleServiceDBSEDWARD]
<f:\oracle\product\10.2.0\db_2\bin\ORACLE.EXE DBSEDWARD><Oracle Corporation>
[OracleServiceORCL / OracleServiceORCL]
<f:\oracle\product\10.2.0\db_2\bin\ORACLE.EXE ORCL><Oracle Corporation>
[OracleServiceORCLPRI / OracleServiceORCLPRI]
<f:\oracle\product\10.2.0\db_3\bin\ORACLE.EXE ORCLPRI><Oracle Corporation>
[P4P Service / P4P Service]
<C:\Program Files\Common Files\Sogou PXP\p2psvr.exe><Sohu.com Inc.>
[Rising Proxy Service / RfwProxySrv]
<c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService]
<c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[ServiceLayer / ServiceLayer]
<"C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe"><Nokia.>

FreedomStar - 2006-11-11 15:09:00

驱动程序
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc]
<system32\drivers\ac97intc.sys><Intel Corporation>
[Agere Systems Soft Modem / AgereSoftModem]
<system32\DRIVERS\AGRSM.sys><Agere Systems>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[ATI WDM Audio Video Crossbar (Microsoft) / ATIXBAR]
<system32\DRIVERS\ati1xbxx.sys><ATI Technologies Inc.>
[Rising TDI Base Driver / BaseTDI]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[BdGuard / BdGuard]
<\SystemRoot\system32\drivers\BDGuard.SYS><N/A>
[Bluetooth Audio Service / BlueletAudio]
<system32\DRIVERS\blueletaudio.sys><IVT Corporation>
[Bluetooth PAN Network Adapter / BT]
<system32\DRIVERS\btnetdrv.sys><IVT Corporation>
[Bluetooth USB For Bluetooth Service / Btcsrusb]
<System32\Drivers\btcusb.sys><IVT Corporation>
[Bluetooth HID Enumerator / BTHidEnum]
<system32\DRIVERS\vbtenum.sys><N/A>
[Bluetooth HID Manager Service / BTHidMgr]
<\SystemRoot\System32\Drivers\BTHidMgr.sys><IVT Corporation>
[Conexant Riptide WDM Audio Driver / crtaud]
<system32\drivers\crtaud.sys><Conexant Systems Inc.>
[Dritek HotKey Keyboard Filter Driver / DKbFltr]
<System32\Drivers\DKbFltr.sys><Dritek System Inc.>
[dtscsi / dtscsi]
<\SystemRoot\System32\Drivers\dtscsi.sys><N/A>
[ExpScaner / ExpScaner]
<\??\C:\Program Files\Rising\Rav\ExpScan.sys><>
[AVC Finger-sensing Pad Driver for Windows 2000/XP / fspad]
<system32\DRIVERS\fspad.sys><Asia Vital Components Co.,Ltd.>
[HookCont / HookCont]
<\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising tech Co. ltd>
[HookReg / HookReg]
<\??\C:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys]
<\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising>
[HookUrl / HookUrl]
<\??\C:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[iuuyuj7 / iuuyuj78]
<\SystemRoot\System32\DRIVERS\iuuyuj78.sys><Microsoft Corporation>
[MEMSCAN / MEMSCAN]
<\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[mProcRs / mProcRs]
<\??\c:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[Mtlmnt5 / Mtlmnt5]
<system32\DRIVERS\Mtlmnt5.sys><Smart Link>
[Mtlstrm / Mtlstrm]
<system32\DRIVERS\Mtlstrm.sys><Smart Link>
[Nokia USB Generic / Nokia USB Generic]
<system32\drivers\nmwcdc.sys><Nokia>
[Nokia USB Modem / Nokia USB Modem]
<system32\drivers\nmwcdcm.sys><Nokia>
[Nokia USB Phone Parent / Nokia USB Phone Parent]
<system32\drivers\nmwcd.sys><Nokia>
[npkcrypt / npkcrypt]
<\??\F:\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[NtMtlFax / NtMtlFax]
<system32\DRIVERS\NtMtlFax.sys><Smart Link>
[oreans32 / oreans32]
<\??\C:\WINDOWS\system32\drivers\oreans32.sys><N/A>
[Star Force copy protection driver v4 / prodrv04]
<\SystemRoot\System32\drivers\prodrv04.sys><Protection Technology Co.>
[Direct Parallel Link Driver / Ptilink]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RecAgent / RecAgent]
<\SystemRoot\system32\DRIVERS\RecAgent.sys><Smart Link>
[RsFwDrv / RsFwDrv]
<\??\C:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS]
<\??\C:\PROGRAM FILES\RISING\RAV\RSPPSYS.sys><Rising>
[Secdrv / Secdrv]
<system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
[SiS315 / SiS315]
<system32\DRIVERS\sisgrp.sys><Silicon Integrated Systems Corporation>
[Service for AC'97 Sample Driver (WDM) / SiS7018]
<system32\drivers\ac97sis.sys><Silicon Integrated Systems Corp.>
[SiSkp / SiSkp]
<system32\DRIVERS\srvkp.sys><Silicon Integrated Systems Corporation>
[SiS PCI Fast Ethernet Adapter Driver / SISNIC]
<system32\DRIVERS\sisnic.sys><SiS Corporation>
[SiS PCI Fast Ethernet Adapter Driver for NDIS51 / SISNICXP]
<system32\DRIVERS\sisnicxp.sys><SiS Corporation>
[Smart Link 56K Modem Driver / Slntamr]
<system32\DRIVERS\slntamr.sys><Smart Link>
[SlNtHal / SlNtHal]
<system32\DRIVERS\Slnthal.sys><Smart Link>
[SlWdmSup / SlWdmSup]
<system32\DRIVERS\SlWdmSup.sys><Smart Link>
[sptd / sptd]
<\SystemRoot\System32\Drivers\sptd.sys><N/A>
[Virtual Serial port driver / VComm]
<system32\DRIVERS\VComm.sys><IVT Corporation>
[Bluetooth VComm Manager Service / VcommMgr]
<System32\Drivers\VcommMgr.sys><IVT Corporation>

FreedomStar - 2006-11-11 15:10:00

浏览器加载项
[BandIE Class]
{77FEF28E-EB96-44FF-B511-3185DEA48697} <C:\Program Files\BaiDu\bar\BaiduBar.dll, Baidu.com, Inc.>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\KakaTool.dll, Beijing Rising Technology Co., Ltd.>
[百度超级搜霸]
{B580CF65-E151-49C3-B73F-70B13FCA8E86} <C:\Program Files\BaiDu\bar\BaiduBar.dll, Baidu.com, Inc.>
[MMCPlayer Class]
{05C1004E-2596-48E5-8E26-39362985EEB9} <C:\WINDOWS\Downloaded Program Files\MMCShell.dll, Sohu.com Inc.>
[MoxtvUploadX Control]
{30348281-949B-4E9F-8A99-44EC423EB66D} <C:\WINDOWS\DOWNLO~1\MOXUPL~1.OCX, >
[XIsOro Control]
{48FE89A0-486C-48DF-9DEC-BED22BDC6057} <C:\WINDOWS\DOWNLO~1\XISORO~1.OCX, >
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[MUWebControl Class]
{6E32070A-766D-4EE6-879C-DC1FA91D2FC3} <C:\WINDOWS\system32\muweb.dll, Microsoft Corporation>
[AlbumBatchUpload Control]
{72C73565-4297-4835-9306-E750A2B0DDA4} <C:\WINDOWS\DOWNLO~1\ALBUMB~1.OCX, TOM Online Inc.>
[Java Plug-in 1.4.1_01]
{8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\j2re1.4.1_01\bin\npjpi141_01.dll, JavaSoft / Sun Microsystems, Inc.>
[Java Plug-in 1.4.1_01]
{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} <C:\Program Files\Java\j2re1.4.1_01\bin\npjpi141_01.dll, JavaSoft / Sun Microsystems, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx, Macromedia, Inc.>
[pCastPanel Class]
{FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} <C:\Program Files\PCAST\pCastCtl\pCastCtl.dll, >
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[BandIE Class]
{77FEF28E-EB96-44FF-B511-3185DEA48697} <C:\Program Files\BaiDu\bar\BaiduBar.dll, Baidu.com, Inc.>
[相关搜索]
{A29F7F71-DCDB-412D-B19A-2002DC966E33} <C:\Program Files\yok\relband.dll, N/A>
[百度超级搜霸]
{B580CF65-E151-49C3-B73F-70B13FCA8E86} <C:\Program Files\BaiDu\bar\BaiduBar.dll, Baidu.com, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx, Macromedia, Inc.>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\KakaTool.dll, Beijing Rising Technology Co., Ltd.>
[上传到QQ网络硬盘]
<F:\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
<F:\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<F:\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<F:\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 576][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 632][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 656][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 708][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 720][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 872][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 936][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1024][C:\Program Files\Rising\Rav\CCenter.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
[PID: 1044][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[F:\oracle\product\10.2.0\db_3\bin\oci.dll] [Oracle Corporation, 10.2.0.1.0]
[PID: 1084][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1140][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1216][C:\Program Files\Rising\Rav\Ravmond.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 1, 47]
[C:\Program Files\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\Rav\RsPPsys.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\Rising\Rav\RsLog.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
[C:\Program Files\Rising\Rav\HOOKSYS.dll] [Beijing Rising Technology Co., Ltd., 18, 1, 0, 12]
[C:\Program Files\Rising\Rav\Scanner.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 33]
[C:\Program Files\Rising\Rav\libload.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10]
[C:\Program Files\Rising\Rav\VirusLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
[C:\Program Files\Rising\Rav\regmon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6]
[C:\Program Files\Rising\Rav\HookWeb.dll] [rising, 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\MemMon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 12]
[C:\Program Files\Rising\Rav\expscan.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\Rising\Rav\mPorts.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3]
[C:\Program Files\Rising\Rav\MailMon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\Program Files\Rising\Rav\SpamEng.dll] [N/A, 18, 0, 0, 6]
[C:\Program Files\Rising\Rav\engine.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 35]
[C:\Program Files\Rising\Rav\PostTrt.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 18]
[C:\Program Files\Rising\Rav\UnExe.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[C:\Program Files\Rising\Rav\ScanExec.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 15]
[C:\Program Files\Rising\Rav\ScanEx.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 32]
[C:\Program Files\Rising\Rav\RSUnpack.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]
[C:\Program Files\Rising\Rav\ExtFile.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 24]
[C:\Program Files\Rising\Rav\NvFile.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 7]
[C:\Program Files\Rising\Rav\ScanMac.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10]
[C:\Program Files\Rising\Rav\ScanSct.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
[C:\Program Files\Rising\Rav\Unpacker.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\Program Files\Rising\Rav\ScanNet.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\Program Files\Rising\Rav\ExtOLE.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6]
[PID: 1364][c:\program files\rising\rfw\rfwsrv.exe] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 33]
[c:\program files\rising\rfw\RfwRule.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 13]
[c:\program files\rising\rfw\rfwlog.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 6]
[c:\program files\rising\rfw\Rfwdrv.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 21]
[c:\program files\rising\rfw\MonDrv.dll] [rs, 1, 0, 0, 4]
[c:\program files\rising\rfw\ProcLib.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 9]
[c:\program files\rising\rfw\mPorts.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3]
[PID: 1476][C:\Program Files\Rising\Rav\RavStub.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 16]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[PID: 1644][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[PID: 1756][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\DOWNLO~1\BDPlugin.dll] [, 1, 0, 1, 1]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 21]
[C:\Program Files\MyTvEX\Codecs\mmfinfo.dll] [N/A, N/A]
[C:\Program Files\MyTvEX\Codecs\mkunicode.dll] [N/A, N/A]
[F:\Adobe Reader 7.0.7\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 7.0.0.0]
[F:\NOKIA\Nokia PC Suite 6\PhoneBrowser.dll] [Nokia, 6, 81, 46, 1]
[F:\NOKIA\Nokia PC Suite 6\PCSCM.dll] [Nokia, 6, 81, 68, 0]
[C:\WINDOWS\system32\ConnAPI.DLL] [Nokia., 6, 81, 62, 0]
[F:\NOKIA\Nokia PC Suite 6\Lang\PhoneBrowser_chi-sc.nlr] [Nokia, 6, 81, 29, 0]
[F:\NOKIA\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr] [Nokia, 6, 81, 11, 0]
[C:\Program Files\BaiDu\bar\BaiduBar.dll] [Baidu.com, Inc., 2, 0, 2, 99]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[PID: 1804][c:\program files\rising\rfw\RfwMain.exe] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 52]
[c:\program files\rising\rfw\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 23]
[c:\program files\rising\rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[c:\program files\rising\rfw\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\WINDOWS\DOWNLO~1\BDPlugin.dll] [, 1, 0, 1, 1]
[PID: 1876][F:\BlueTooth\BTNtService.exe] [N/A, N/A]
[PID: 1956][C:\Program Files\AVC Finger-sensing Pad Driver\FspadSvr.exe] [N/A, N/A]
[PID: 2000][C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe] [N/A, N/A]
[PID: 240][C:\Program Files\Common Files\Sogou PXP\p2psvr.exe] [Sohu.com Inc., 2, 0, 0, 25]

FreedomStar - 2006-11-11 15:10:00

[C:\Program Files\Sogou PXP\vodsvr.dll] [Sohu.com Inc., 2, 0, 0, 24]
[C:\Program Files\Sogou PXP\pxpnet.dll] [Sohu.com Inc., 1, 0, 0, 3]
[C:\Program Files\Sogou PXP\p2pclient.dll] [Sohu.com Inc., 2, 0, 0, 5]
[PID: 244][C:\WINDOWS\system32\Rundll32.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\DOWNLO~1\BDPlugin.dll] [, 1, 0, 1, 1]
[PID: 1616][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2416][C:\WINDOWS\system32\keyhook.exe] [Silicon Integrated Systems Corporation, 0.0.0.3670]
[C:\WINDOWS\system32\SiSApCom.dll] [Silicon Integrated Systems Corporation, 0.0.0.3670]
[C:\WINDOWS\system32\SiSBase.dll] [Silicon Integrated Systems Corporation, 6.14.10.3671]
[C:\WINDOWS\system32\SiSHook.dll] [Silicon Integrated Systems Corporation, 0.0.0.3670]
[C:\WINDOWS\DOWNLO~1\BDPlugin.dll] [, 1, 0, 1, 1]
[PID: 2428][C:\WINDOWS\AGRSMMSG.exe] [Agere Systems, 2.1.49 2.1.49 12/20/2004 15:10:02]
[C:\WINDOWS\DOWNLO~1\BDPlugin.dll] [, 1, 0, 1, 1]
[PID: 2440][C:\WINDOWS\SOUNDMAN.EXE] [Realtek Semiconductor Corp., 5.1.0.36]
[C:\WINDOWS\DOWNLO~1\BDPlugin.dll] [, 1, 0, 1, 1]
[PID: 2448][C:\Program Files\Rising\Rav\RavTask.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 22]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\WINDOWS\DOWNLO~1\BDPlugin.dll] [, 1, 0, 1, 1]
[PID: 2476][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\DOWNLO~1\BDPlugin.dll] [, 1, 0, 1, 1]
[PID: 2480][C:\Program Files\Rising\Rav\Ravmon.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 1, 39]
[C:\Program Files\Rising\Rav\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 26]
[C:\Program Files\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\Rav\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\WINDOWS\DOWNLO~1\BDPlugin.dll] [, 1, 0, 1, 1]
[PID: 2532][E:\Emeditor\emedtray.exe] [N/A, N/A]
[E:\Emeditor\emedres.dll] [N/A, N/A]
[E:\Emeditor\mui\1033\emedloc.dll] [N/A, N/A]
[C:\WINDOWS\DOWNLO~1\BDPlugin.dll] [, 1, 0, 1, 1]
[PID: 2568][E:\Emeditor\EMEDITOR.EXE] [Emurasoft, Inc., 6, 0, 0, 0]
[E:\Emeditor\emedres.dll] [N/A, N/A]
[E:\Emeditor\mui\1033\emedloc.dll] [N/A, N/A]
[E:\Emeditor\EMREGEXP.DLL] [N/A, N/A]
[C:\WINDOWS\DOWNLO~1\BDPlugin.dll] [, 1, 0, 1, 1]
[PID: 364][F:\千千静听\TTPlayer.exe] [Alen Soft, 4, 6, 8, 0]
[F:\千千静听\ttpcomm.dll] [N/A, N/A]
[C:\WINDOWS\DOWNLO~1\BDPlugin.dll] [, 1, 0, 1, 1]
[F:\千千静听\ttpres.dll] [Alen Soft, 4, 6, 8, 0]
[F:\千千静听\AddIn\ttp_asf.dll] [N/A, N/A]
[F:\千千静听\AddIn\ttp_lrcsh.dll] [N/A, N/A]
[PID: 4076][F:\QQ\QQ.exe] [TENCENT, 0, 0, 0, 0]
[F:\QQ\QQBaseClassInDll.dll] [, 1, 0, 0, 1]
[F:\QQ\QQHelperDll.dll] [, 1, 0, 0, 1]
[F:\QQ\BasicCtrlDll.dll] [Tencent, 5, 0, 200, 14]
[C:\WINDOWS\DOWNLO~1\BDPlugin.dll] [, 1, 0, 1, 1]
[F:\QQ\QQAPI.dll] [, 1, 0, 0, 1]
[F:\QQ\TIMProxy.dll] [tencent, 0, 3, 2, 4]
[F:\QQ\LoginCtrl.dll] [, 1, 0, 0, 1]
[F:\QQ\npkcntc.dll] [INCA Internet Co., Ltd., 2005, 9, 1, 1]
[F:\QQ\npkpdb.dll] [INCA Internet Co., Ltd., 2003, 10, 1, 1]
[F:\QQ\QQRes.dll] [tencent, 1, 0, 0, 1]
[F:\QQ\QQMainFrame.dll] [N/A, N/A]
[F:\QQ\CQQApplication.dll] [N/A, N/A]
[F:\QQ\NewSkin.dll] [, 1, 0, 0, 1]
[F:\QQ\HostingMgr.dll] [, 1, 0, 0, 1]
[F:\QQ\CameraDll.dll] [, 1, 0, 0, 1]
[F:\QQ\MailSummary.dll] [, 1, 0, 0, 1]
[F:\QQ\QQSpace.dll] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\msdmo.dll] [N/A, N/A]
[F:\QQ\QQGroupMng.dll] [, 1, 0, 0, 1]
[F:\QQ\QQConfigPlugin.dll] [, 1, 0, 0, 1]
[F:\QQ\FlashAvatarDll.dll] [, 1, 4, 0, 1]
[F:\QQ\QQAvatar.dll] [N/A, N/A]
[F:\QQ\UserDefinedHead.dll] [, 1, 0, 0, 1]
[F:\QQ\QRingMng.dll] [N/A, N/A]
[F:\QQ\PhoneAPI.dll] [, 1, 0, 0, 1]
[F:\QQ\DialerAllinOne.dll] [tencent, 1, 4, 0, 0]
[F:\QQ\LongConnection.dll] [tencent, 0, 3, 3, 8]
[F:\QQ\QQPet.dll] [, 1, 0, 0, 1]
[F:\QQ\QQAllInOne.dll] [N/A, N/A]
[F:\QQ\SCCore.dll] [N/A, N/A]
[F:\QQ\QQCustomFace.dll] [N/A, N/A]
[F:\QQ\QQSceneMng.dll] [N/A, N/A]
[F:\QQ\QQPlugin.dll] [N/A, N/A]
[F:\QQ\QQSysMsgMng.dll] [N/A, N/A]
[F:\QQ\ImageOle.dll] [TODO: <Company name>, 1.0.0.1]
[F:\QQ\BQQApplication.dll] [N/A, N/A]
[F:\QQ\PersonalDesktop.dll] [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2]
[F:\QQ\GroupConnection.dll] [Tencent, 5, 0, 202, 30]
[F:\QQ\CommercesMng.dll] [, 1, 0, 0, 1]
[F:\QQ\QQAddr.dll] [深圳市腾讯计算机系统有限公司, 5, 0, 101, 141]
[F:\QQ\QQPhoneHelper.dll] [腾讯科技（深圳）有限公司, 2, 0, 6, 60]
[F:\QQ\QQZip.dll] [tencent, 0, 3, 2, 4]
[PID: 3752][F:\QQ\TIMPlatform.exe] [tencent, 0, 3, 1, 8]
[C:\WINDOWS\DOWNLO~1\BDPlugin.dll] [, 1, 0, 1, 1]
[F:\QQ\TIMProxy.dll] [tencent, 0, 3, 2, 4]
[PID: 900][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\DOWNLO~1\BDPlugin.dll] [, 1, 0, 1, 1]
[C:\WINDOWS\system32\KakaTool.dll] [Beijing Rising Technology Co., Ltd., 2, 0, 0, 9]
[C:\Program Files\BaiDu\bar\BaiduBar.dll] [Baidu.com, Inc., 2, 0, 2, 99]
[C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\MyTvEX\Codecs\mmfinfo.dll] [N/A, N/A]
[C:\Program Files\MyTvEX\Codecs\mkunicode.dll] [N/A, N/A]
[F:\Adobe Reader 7.0.7\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 7.0.0.0]
[C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx] [Macromedia, Inc., 8,0,24,0]
[PID: 2896][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\DOWNLO~1\BDPlugin.dll] [, 1, 0, 1, 1]
[C:\WINDOWS\system32\KakaTool.dll] [Beijing Rising Technology Co., Ltd., 2, 0, 0, 9]
[C:\Program Files\BaiDu\bar\BaiduBar.dll] [Baidu.com, Inc., 2, 0, 2, 99]
[C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\system32\UNISPIM.IME] [北京清华紫光软件股份有限公司, 3.0.0.3045]
[C:\WINDOWS\system32\upengine.dll] [北京清华紫光软件股份有限公司, 3.0.0.3045]
[C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx] [Macromedia, Inc., 8,0,24,0]
[C:\Program Files\MyTvEX\Codecs\mmfinfo.dll] [N/A, N/A]
[C:\Program Files\MyTvEX\Codecs\mkunicode.dll] [N/A, N/A]
[F:\Adobe Reader 7.0.7\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 7.0.0.0]
[PID: 3308][C:\Program Files\Rising\System Repair Engineer\SREng\SREng.exe] [Smallfrogs Studio, 2.2.6.605]
[C:\WINDOWS\DOWNLO~1\BDPlugin.dll] [, 1, 0, 1, 1]

yaoezi - 2006-11-11 15:21:00

运行SREng.exe，扫描到一半就会出错
怎么办？

punkfish - 2006-11-11 15:34:00

我的也是,运行SREng.exe，扫描到一半就会出错;.说什么应用程序发生异常未知的软件异常(0xc0000409),位置0x00408c3a.
这样的．

ZGRZGR - 2006-11-11 15:55:00

注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation]
<SoundMan><SOUNDMAN.EXE> [(Verified)Realtek Semiconductor Corp.]
<StormCodec_Helper><"D:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti> [N/A]
<RavTask><"d:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<KernelFaultCheck><%systemroot%\system32\dumprep 0 -k> [N/A]
<SKYNET Personal FireWall><D:\PROGRA~1\SkyNet\FireWall\pfw.exe> [广州众达天网技术有限公司]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]

==================================
启动文件夹
[Adobe Gamma Loader]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Gamma Loader.lnk --> C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [Adobe Systems, Inc.]><N>
[Firewall Client Connectivity Monitor]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Firewall Client Connectivity Monitor.LNK --> C:\PROGRA~1\MIAF01~1\ISATRAY.EXE [Microsoft Corporation]><N>

==================================
服务
[ASP.NET State Service / aspnet_state]
<C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe><Microsoft Corporation>
[Ati HotKey Poller / Ati HotKey Poller]
<C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[Human Interface Device Access / HidServ]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Macromedia Licensing Service / Macromedia Licensing Service]
<"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><N/A>
[Machine Debug Manager / MDM]
<"C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe"><Microsoft Corporation>
[Rising Process Communication Center / RsCCenter]
<"d:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon]
<"d:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>

==================================
驱动程序
[Service for Realtek AC97 Audio (WDM) / ALCXWDM]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[AMD Processor Driver / AmdK8]
<system32\DRIVERS\AmdK8.sys><Advanced Micro Devices>
[ati2mtag / ati2mtag]
<system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[BaseTDI / BaseTDI]
<\??\C:\WINDOWS\system32\drivers\basetdi.sys><Beijing Rising Technology Co., Ltd.>
[cdawdm / cdawdm]
<system32\DRIVERS\CDAWDM.sys><N/A>
[d347bus / d347bus]
<\SystemRoot\system32\DRIVERS\d347bus.sys><>
[d347prt / d347prt]
<\SystemRoot\System32\Drivers\d347prt.sys><>
[ExpScaner / ExpScaner]
<\??\d:\Program Files\Rising\Rav\ExpScan.sys><>
[GMSIPCI / GMSIPCI]
<\??\G:\INSTALL\GMSIPCI.SYS><N/A>
[HookCont / HookCont]
<\??\d:\Program Files\Rising\Rav\HOOKCONT.sys><Rising tech Co. ltd>
[HookReg / HookReg]
<\??\d:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys]
<\??\d:\Program Files\Rising\Rav\HookSys.sys><Rising>
[HSFHWBS2 / HSFHWBS2]
<system32\DRIVERS\HSFBS2S2.sys><Conexant Systems, Inc.>
[HSF_DP / HSF_DP]
<system32\DRIVERS\HSFDPSP2.sys><Conexant Systems, Inc.>
[jsadar6 / jsadar66]
<\SystemRoot\System32\DRIVERS\jsadar66.sys><Microsoft Corporation>
[mdmxsdk / mdmxsdk]
<system32\DRIVERS\mdmxsdk.sys><Conexant>
[MEMSCAN / MEMSCAN]
<\??\d:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[npkcrypt / npkcrypt]
<\??\D:\Program Files\QQ珊瑚虫版(IP绿色版)\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[NTACCESS / NTACCESS]
<\??\G:\NTACCESS.sys><N/A>
[nvata / nvata]
<\SystemRoot\system32\DRIVERS\nvata.sys><NVIDIA Corporation>
[NVIDIA nForce Networking Controller Driver / NVENETFD]
<system32\DRIVERS\NVENETFD.sys><NVIDIA Corporation>
[NVIDIA Network Bus Enumerator / nvnetbus]
<system32\DRIVERS\nvnetbus.sys><NVIDIA Corporation>
[Padus ASPI Shell / pfc]
<system32\drivers\pfc.sys><Padus, Inc.>
[Direct Parallel Link Driver / Ptilink]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[PxHelp20 / PxHelp20]
<\SystemRoot\System32\Drivers\PxHelp20.sys><Sonic Solutions>
[RSPPSYS / RSPPSYS]
<\??\D:\PROGRAM FILES\RISING\RAV\RSPPSYS.sys><Rising>
[Secdrv / Secdrv]
<system32\DRIVERS\secdrv.sys><N/A>
[SetupNTGLM7X / SetupNTGLM7X]
<\??\G:\NTGLM7X.sys><N/A>
[SKNFW / SKNFW]
<\??\C:\WINDOWS\system32\Drivers\SKNFW.sys><N/A>
[SkyProcs / SkyProcs]
<\??\D:\PROGRA~1\SkyNet\FireWall\SkyProcs.sys><N/A>
[SmartCd / SmartCd]
<System32\Drivers\SmartCd.sys><N/A>
[VCD VNC Virtual Network Adapter / vcddev]
<system32\DRIVERS\vcdvnic.sys><VNN B.J.>

ajflajgkjalk - 2006-11-11 16:21:00

2006-11-11,16:09:51

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><; C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
<nwiz><; nwiz.exe /install> [N/A]
<UnlockerAssistant><; "C:\Program Files\Unlocker\UnlockerAssistant.exe"> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\SYSTEM32\Userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]

==================================
启动文件夹
N/A

==================================
服务
[卡巴斯基互联网安全套装 6.0 / AVP]
<"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r><Kaspersky Lab>
[Human Interface Device Access / HidServ]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[NVIDIA Display Driver Service / NVSvc]
<C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[P4P Service / P4P Service]
<C:\Program Files\Common Files\Sogou PXP\p2psvr.exe><N/A>

==================================
驱动程序
[aeaudio / aeaudio]
<system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
[d347bus / d347bus]
<\SystemRoot\system32\DRIVERS\d347bus.sys><>
[d347prt / d347prt]
<\SystemRoot\System32\Drivers\d347prt.sys><>
[Intel(R) PRO Adapter Driver / E100B]
<system32\DRIVERS\e100b325.sys><Intel Corporation>
[hmonitor / hmonitor]
<\??\C:\WINDOWS\system32\drivers\hmonitor.sys><N/A>
[kl1 / kl1]
<\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif]
<\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[npkcrypt / npkcrypt]
<\??\E:\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[nv / nv]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[rdzegg7 / rdzegg72]
<\SystemRoot\System32\DRIVERS\rdzegg72.sys><Microsoft Corporation>
[Secdrv / Secdrv]
<system32\DRIVERS\secdrv.sys><Macrovision Europe Ltd>
[smwdm / smwdm]
<system32\drivers\smwdm.sys><Analog Devices, Inc.>
[TCP/IP Protocol Driver / Tcpip]
<system32\DRIVERS\tcpip.sys><Microsoft Corporation>
[ufoolc2 / ufoolc22]
<\SystemRoot\System32\DRIVERS\ufoolc22.sys><N/A>

==================================
浏览器加载项
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\KakaTool.dll, Beijing Rising Technology Co., Ltd.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\KakaTool.dll, Beijing Rising Technology Co., Ltd.>
[&使用迅雷下载]
<C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
<C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
[上传到QQ网络硬盘]
<E:\QQ\AddToNetDisk.htm, N/A>
[使用网际快车下载]
<C:\Program Files\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<C:\Program Files\FlashGet\jc_all.htm, N/A>

==================================
正在运行的进程
[PID: 676][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 764][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 788][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 832][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 844][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 992][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1060][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1148][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[PID: 1520][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Unlocker\UnlockerCOM.dll] [N/A, N/A]
[C:\Program Files\WinRAR\rarext.dll] [N/A, N/A]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll] [Kaspersky Lab, 6.0.0.299]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll] [Kaspersky Lab, 6.0.0.299]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll] [Kaspersky Lab, 1.0.6.299]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll] [Kaspersky Lab, 6.0.0.299]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl] [Kaspersky Lab, 6.0.0.299]
[c:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl] [Kaspersky Lab, 6.0.0.299]
[c:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl] [Kaspersky Lab, 6.0.0.299]
[c:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl] [Kaspersky Lab, 6.0.0.299]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[C:\WINDOWS\system32\nvcpl.dll] [NVIDIA Corporation, 6.14.10.8195]
[C:\WINDOWS\system32\NVRSZHC.DLL] [NVIDIA Corporation, 6.14.10.8195]
[C:\WINDOWS\system32\nvshell.dll] [N/A, N/A]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\shellex.dll] [Kaspersky Lab, 6.0.0.299]
[PID: 1228][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\KakaTool.dll] [Beijing Rising Technology Co., Ltd., 2, 0, 0, 9]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll] [Kaspersky Lab, 1.0.6.299]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll] [Kaspersky Lab, 6.0.0.299]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll] [Kaspersky Lab, 6.0.0.299]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll] [Kaspersky Lab, 6.0.0.299]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl] [Kaspersky Lab, 6.0.0.299]
[c:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl] [Kaspersky Lab, 6.0.0.299]
[c:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl] [Kaspersky Lab, 6.0.0.299]
[c:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl] [Kaspersky Lab, 6.0.0.299]
[c:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl] [Kaspersky Lab, 6.0.0.299]
[c:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl] [Kaspersky Lab, 6.0.0.299]
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[PID: 552][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1464][E:\SREng\SREng.exe] [Smallfrogs Studio, 2.2.6.605]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 aifind.info
127.0.0.1 allsearcher.info
127.0.0.1 ehttp.cc
127.0.0.1 freednshost.info
127.0.0.1 i-lookup.com
127.0.0.1 www.23.la
127.0.0.1 www.9991.com
127.0.0.1 www.joyiex.com
127.0.0.1 www.mj2005.com
127.0.0.1 www.mydj2005.com
127.0.0.1 www.nkvd.us
127.0.0.1 www.smart-finder.biz
127.0.0.1 www.xfreehosting.com
127.0.0.1 www.xxx166.com
127.0.0.1 www.my123,com # 草你大爷

这是我的在host里边屏蔽了my123\
m用卡巴斯基安全套装扫描不到病毒

lazyleeking - 2006-11-11 16:22:00

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\CTFMON.EXE> [(Verified)Microsoft Corporation]
<MsnMsgr><"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background> [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
<run><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Corporation]
<SunJavaUpdateSched><"C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"> [Sun Microsystems, Inc.]
<NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [NVIDIA Corporation]
<nwiz><nwiz.exe /install> [N/A]
<NvMediaCenter><RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit> [NVIDIA Corporation]
<SoundMan><SOUNDMAN.EXE> [(Verified)Realtek Semiconductor Corp.]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload> [(Verified)Microsoft Corporation]
<pzsiks71><C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\pzsiks71.dll,DllCanUnloadNow> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{AEB6717E-7E19-11d0-97EE-00C04FD91972}><shell32.dll> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<PostBootReminder><%SystemRoot%\system32\SHELL32.dll> [(Verified)Microsoft Corporation]
<CDBurn><%SystemRoot%\system32\SHELL32.dll> [(Verified)Microsoft Corporation]
<WebCheck><C:\WINDOWS\system32\webcheck.dll> [(Verified)Microsoft Corporation]
<SysTray><C:\WINDOWS\system32\stobject.dll> [(Verified)Microsoft Corporation]
<WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
<WinlogonNotify: crypt32chain><crypt32.dll> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
<WinlogonNotify: cryptnet><cryptnet.dll> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
<WinlogonNotify: cscdll><cscdll.dll> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
<WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll> [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
<WinlogonNotify: ScCertProp><wlnotify.dll> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
<WinlogonNotify: Schedule><wlnotify.dll> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
<WinlogonNotify: sclgntfy><sclgntfy.dll> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
<WinlogonNotify: SensLogn><WlNotify.dll> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
<WinlogonNotify: termsrv><wlnotify.dll> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
<WinlogonNotify: wlballoon><wlnotify.dll> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
<{438755C2-A8BA-11D1-B96B-00A0C90312E1}><%SystemRoot%\system32\browseui.dll> [(Verified)Microsoft Corporation]
<{8C7461EF-2B13-11d2-BE35-3078302C2030}><%SystemRoot%\system32\browseui.dll> [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><C:\WINDOWS\system32\logon.scr> [(Verified)Microsoft Corporation]

==================================
启动文件夹
N/A

==================================
服务
[ASP.NET State Service / aspnet_state]
<C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe><Microsoft Corporation>
[卡巴斯基互联网安全套装 6.0 / AVP]
<"D:\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r><Kaspersky Lab>
[ewido anti-spyware 4.0 guard / ewido anti-spyware 4.0 guard]
<d:\ewido anti-spyware 4.0\guard.exe><Anti-Malware Development a.s.>
[Forceware Web Interface / ForcewareWebInterface]
<"C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice><Apache Software Foundation>
[Human Interface Device Access / HidServ]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[ForceWare IP service / nSvcIp]
<C:\NVIDIA\NetworkAccessManager\bin\nSvcIp.exe><N/A>
[ForceWare user log service / nSvcLog]
<C:\NVIDIA\NetworkAccessManager\bin\nSvcLog.exe><N/A>
[NVIDIA Display Driver Service / NVSvc]
<C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[Windows Media Connect Service / WMConnectCDS]
<C:\Program Files\Windows Media Connect 2\wmccds.exe><Microsoft Corporation>

==================================
驱动程序
[Service for WDM 3D Audio Driver / ALCXSENS]
<system32\drivers\ALCXSENS.SYS><Sensaura>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[ewido anti-spyware 4.0 driver / ewido anti-spyware 4.0 driver]
<\??\d:\ewido anti-spyware 4.0\guard.sys><N/A>
[kl1 / kl1]
<\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif]
<\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[npkcrypt / npkcrypt]
<\??\d:\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[nv / nv]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[nvatabus / nvatabus]
<\SystemRoot\system32\DRIVERS\nvatabus.sys><NVIDIA Corporation>
[NVIDIA nForce Networking Controller Driver / NVENETFD]
<system32\DRIVERS\NVENETFD.sys><NVIDIA Corporation>
[NVIDIA Network Bus Enumerator / nvnetbus]
<system32\DRIVERS\nvnetbus.sys><NVIDIA Corporation>
[NVIDIA nForce AGP Bus Filter / nv_agp]
<\SystemRoot\system32\DRIVERS\nv_agp.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[pzsiks7 / pzsiks71]
<\SystemRoot\System32\DRIVERS\pzsiks71.sys><Microsoft Corporation>
[Secdrv / Secdrv]
<system32\DRIVERS\secdrv.sys><N/A>
[TCP/IP Protocol Driver / Tcpip]
<system32\DRIVERS\tcpip.sys><Microsoft Corporation>

lazyleeking - 2006-11-11 16:23:00

==================================
浏览器加载项
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <d:\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[SSVHelper Class]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} <C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll, Sun Microsystems, Inc.>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <D:\Tencent\QQ\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <d:\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <D:\FLASHGET\fgiebar.dll, Amaze Soft>
[Microsoft Office Template and Media Control]
{02BCC737-B171-4746-94C9-0D8A0B2C0089} <C:\PROGRA~1\MICROS~1\OFFICE11\IEAWSDC.DLL, N/A>
[Java Plug-in 1.5.0_09]
{8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.5.0_06]
{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.5.0_09]
{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.5.0_09]
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll, Sun Microsystems, Inc.>
[Microsoft Office Template and Media Control]
{02BCC737-B171-4746-94C9-0D8A0B2C0089} <C:\PROGRA~1\MICROS~1\OFFICE11\IEAWSDC.DLL, N/A>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[XML DOM Document]
{2933BF90-7B36-11D2-B20E-00C04F983E60} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[IeCatch5 Class]
{2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <D:\FLASHGET\jccatch.dll, FlashGet>
[Microsoft Office Control]
{4453D895-F2A1-4A38-A285-1EF9BD3F6D5D} <C:\PROGRA~1\MICROS~1\OFFICE11\AUTHZAX.DLL, Microsoft Corporation>
[]
{4F07F79F-087F-42CF-8B36-7A88D06088E9} <C:\PROGRA~1\MSNMES~1\MSGSC8~1.DLL, Microsoft Corporation>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <d:\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[SSVHelper Class]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} <C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll, Sun Microsystems, Inc.>
[Microsoft Web Browser]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\ieframe.dll, Microsoft Corporation>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\flash.ocx, Macromedia, Inc.>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <D:\FLASHGET\fgiebar.dll, Amaze Soft>
[XML HTTP Request]
{ED8C108E-4349-11D2-91A4-00C04F7969E8} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[gFlash Class]
{F156768E-81EF-470C-9057-481BA8380DBA} <D:\FLASHGET\getflash.dll, N/A>
[XML DOM Document]
{F6D90F11-9C73-11D3-B32E-00C04F990BB4} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[上传到QQ网络硬盘]
<D:\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用网际快车下载]
<D:\FLASHGET\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<D:\FLASHGET\jc_all.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
<D:\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<D:\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<D:\Tencent\QQ\SendMMS.htm, N/A>

lazyleeking - 2006-11-11 16:25:00

==================================
正在运行的进程
[PID: 608][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 684][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 716][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\klogon.dll] [Kaspersky Lab, 6.0.0.299]
[PID: 760][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 772][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 932][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 976][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1068][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[PID: 1124][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1228][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1476][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[PID: 1748][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[d:\ewido anti-spyware 4.0\shellexecutehook.dll] [Anti-Malware Development a.s., 4, 0, 0, 172]
[D:\FLASHGET\jccatch.dll] [FlashGet, 1, 1, 5, 0]
[C:\WINDOWS\system32\nvcpl.dll] [NVIDIA Corporation, 6.14.10.7801]
[C:\WINDOWS\system32\NVRSZHC.DLL] [NVIDIA Corporation, 6.14.10.7801]
[C:\WINDOWS\system32\nvshell.dll] [N/A, N/A]
[D:\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[PID: 1912][C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\libapr.dll] [Apache Software Foundation, 0.0.0.0]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\libaprutil.dll] [Apache Software Foundation, 0.0.0.0]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\libapriconv.dll] [Apache Software Foundation, 0.0.0.0]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\libhttpd.dll] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_access.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_actions.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_alias.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_asis.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_auth.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_autoindex.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_cgi.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_dir.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_env.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_expires.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_headers.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_imap.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_include.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_isapi.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_log_config.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_mime.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_negotiation.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_rewrite.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_setenvif.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_ssl.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\SSLEAY32.dll] [N/A, N/A]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\LIBEAY32.dll] [N/A, N/A]
[PID: 1996][C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE] [Microsoft Corporation, 7.00.9466]
[PID: 2044][C:\NVIDIA\NetworkAccessManager\bin\nSvcIp.exe] [N/A, N/A]
[C:\NVIDIA\NetworkAccessManager\bin\nv_common.dll] [N/A, N/A]
[C:\NVIDIA\NetworkAccessManager\bin\nv_common_firewall.dll] [N/A, N/A]
[C:\NVIDIA\NetworkAccessManager\bin\NMI.dll] [NVIDIA Corporation, 1, 0, 2, 0]
[C:\NVIDIA\NetworkAccessManager\bin\SpecialCase.dll] [N/A, N/A]
[C:\NVIDIA\NetworkAccessManager\bin\nv_resource_L1033.dll] [NVIDIA Corporation, 1, 0, 1, 0]
[PID: 196][C:\NVIDIA\NetworkAccessManager\bin\nSvcLog.exe] [N/A, N/A]
[C:\NVIDIA\NetworkAccessManager\bin\nv_common.dll] [N/A, N/A]
[PID: 204][C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe] [Apache Software Foundation, 2.0.49]

lazyleeking - 2006-11-11 16:26:00

[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\libapr.dll] [Apache Software Foundation, 0.0.0.0]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\libaprutil.dll] [Apache Software Foundation, 0.0.0.0]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\libapriconv.dll] [Apache Software Foundation, 0.0.0.0]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\libhttpd.dll] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_access.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_actions.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_alias.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_asis.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_auth.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_autoindex.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_cgi.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_dir.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_env.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_expires.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_headers.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_imap.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_include.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_isapi.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_log_config.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_mime.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_negotiation.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_rewrite.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_setenvif.so] [Apache Software Foundation, 2.0.49]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_ssl.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\SSLEAY32.dll] [N/A, N/A]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\LIBEAY32.dll] [N/A, N/A]
[PID: 240][C:\WINDOWS\system32\nvsvc32.exe] [NVIDIA Corporation, 6.14.10.7801]
[PID: 3092][C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe] [Sun Microsystems, Inc., 5.0.90.3]
[PID: 3216][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3288][C:\WINDOWS\system32\RUNDLL32.EXE] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\NvMcTray.dll] [NVIDIA Corporation, 6.14.10.7801]
[C:\WINDOWS\system32\NVRSZHC.DLL] [NVIDIA Corporation, 6.14.10.7801]
[PID: 3372][C:\WINDOWS\SOUNDMAN.EXE] [Realtek Semiconductor Corp., 5.1.0.28]
[PID: 3576][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] [RealNetworks, Inc., 0.1.0.3208]
[PID: 3808][C:\WINDOWS\system32\CTFMON.EXE] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1656][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
[d:\Tencent\QQ\QQIEHelper.dll] [深圳市腾讯计算机系统有限公司, 1, 1, 0, 5]
[C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll] [Sun Microsystems, Inc., 5.0.90.3]
[D:\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[D:\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll] [Kaspersky Lab, 1.0.6.299]
[D:\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll] [Kaspersky Lab, 6.0.0.299]
[D:\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll] [Kaspersky Lab, 6.0.0.299]
[D:\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll] [Kaspersky Lab, 6.0.0.299]
[D:\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl] [Kaspersky Lab, 6.0.0.299]
[d:\kaspersky lab\kaspersky internet security 6.0\params.ppl] [Kaspersky Lab, 6.0.0.299]
[d:\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl] [Kaspersky Lab, 6.0.0.299]
[d:\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl] [Kaspersky Lab, 6.0.0.299]
[d:\kaspersky lab\kaspersky internet security 6.0\nfio.ppl] [Kaspersky Lab, 6.0.0.299]
[d:\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl] [Kaspersky Lab, 6.0.0.299]
[C:\WINDOWS\system32\Macromed\Flash\flash.ocx] [Macromedia, Inc., 8,0,22,0]
[PID: 2856][F:\download\sreng2\SREng\SREng.exe] [Smallfrogs Studio, 2.2.6.605]
[D:\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[F:\download\sreng2\SREng\Plugins\SRECXTMG.SRE] [Smallfrogs Studio, 1, 5, 0, 55]
[PID: 3620][C:\WINDOWS\system32\wbem\wmiprvse.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\NVIDIA\NetworkAccessManager\bin\nmp.dll] [NVIDIA Corporation, 1, 0, 0, 2]
[C:\NVIDIA\NetworkAccessManager\bin\nv_common.dll] [N/A, N/A]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

hxyjy - 2006-11-11 17:19:00

2006-11-11,17:04:25

病毒路径C:\WINDOWS\system32\drivers\fjhjss02.sys

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [N/A]
<KAVPersonal50><"f:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize> [Kaspersky Lab]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Corporation]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<BaiduInstall><C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\baidu\bar\bdbar_~1\baidubar.dll,Install> [Baidu.com, Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]

==================================
启动文件夹
[腾讯qq珊瑚虫版]
<C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\腾讯qq珊瑚虫版.lnk --> D:\PROGRA~1\Tencent\QQ\CoralQQ.exe [珊瑚虫工作室]><N>

==================================
服务
[Distributed Link Tracking Logcheck / Distributed Link Tracking Logcheck]
<C:\WINDOWS\system32\WINL0GON.exe><N/A>
[Human Interface Device Access / HidServ]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[kavsvc / kavsvc]
<"f:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe"><Kaspersky Lab>
[Windows User Mode Driver Framework / UMWdf]
<C:\WINDOWS\system32\wdfmgr.exe><N/A>

==================================
驱动程序
[2310_00 / 2310_00]
<\SystemRoot\System32\DRIVERS\2310_00.sys><HighPoint Technologies, Inc.>
[3WAREDRV / 3WAREDRV]
<\SystemRoot\System32\DRIVERS\3WAREDRV.SYS><N/A>
[3WAREGSM / 3WAREGSM]
<\SystemRoot\System32\DRIVERS\3waregsm.sys><N/A>
[3WDRV100 / 3WDRV100]
<\SystemRoot\System32\DRIVERS\3WDRV100.SYS><N/A>
[A320RAID / A320RAID]
<\SystemRoot\System32\DRIVERS\a320raid.sys><Adaptec, Inc.>
[AAATIMEO / AAATIMEO]
<\SystemRoot\System32\DRIVERS\aaatimeo.sys><Microsoft Corporation>
[AAC / AAC]
<\SystemRoot\System32\DRIVERS\aac.sys><Adaptec, Inc.>
[AACSAS / AACSAS]
<\SystemRoot\System32\DRIVERS\aacsas.sys><Adaptec, Inc.>
[AAR81XX / AAR81XX]
<\SystemRoot\System32\DRIVERS\aar81xx.sys><Adaptec, Inc.>
[AARSI3X / AARSI3X]
<\SystemRoot\System32\DRIVERS\aarsi3x.sys><Adaptec, Inc.>
[ADP94XX / ADP94XX]
<\SystemRoot\System32\DRIVERS\adp94xx.sys><Adaptec, Inc.>
[adpu160m / adpu160m]
<\SystemRoot\System32\DRIVERS\adpu160m.sys><N/A>
[ADPU320 / ADPU320]
<\SystemRoot\System32\DRIVERS\adpu320.sys><Adaptec, Inc.>
[AEC6210 / AEC6210]
<\SystemRoot\System32\DRIVERS\aec6210.sys><ACARD Technology Corp.>
[AEC6260 / AEC6260]
<\SystemRoot\System32\DRIVERS\aec6260.sys><ACARD Technology Corp.>
[AEC6280 / AEC6280]
<\SystemRoot\System32\DRIVERS\aec6280.sys><ACARD Technology Corp.>
[AEC67160 / AEC67160]
<\SystemRoot\System32\DRIVERS\aec67160.sys><ACARD Technology Corp.>
[AEC671X / AEC671X]
<\SystemRoot\System32\DRIVERS\AEC671X.sys><ACARD Technology Corp.>
[AEC68X5 / AEC68X5]
<\SystemRoot\System32\DRIVERS\aec68x5.sys><ACARD Technology Corp.>
[aic78u2 / aic78u2]
<\SystemRoot\System32\DRIVERS\aic78u2.sys><N/A>
[aic78xx / aic78xx]
<\SystemRoot\System32\DRIVERS\aic78xx.sys><N/A>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[amsint / amsint]
<\SystemRoot\System32\DRIVERS\amsint.sys><N/A>
[ARCM_X86 / ARCM_X86]
<\SystemRoot\System32\DRIVERS\arcm_x86.sys><ARECA Technology Corporation>
[asc / asc]
<\SystemRoot\System32\DRIVERS\asc.sys><N/A>
[asc3550 / asc3550]
<\SystemRoot\System32\DRIVERS\asc3550.sys><N/A>
[BB-RUN / BB-RUN]
<\SystemRoot\System32\DRIVERS\bb-run.sys><Promise Technology, Inc.>
[BCHTSW32 / BCHTSW32]
<\SystemRoot\System32\DRIVERS\bchtsw32.sys><Broadcom Corporation>
[BCRAID / BCRAID]
<\SystemRoot\System32\DRIVERS\bcraid.sys><Broadcom Corporation>
[BUSLOGIC / BUSLOGIC]
<\SystemRoot\System32\DRIVERS\buslogic.sys><Microsoft Corporation>
[CDA1000 / CDA1000]
<\SystemRoot\System32\DRIVERS\cda1000.sys><Adaptec, Inc.>
[CmdIde / CmdIde]
<\SystemRoot\System32\DRIVERS\cmdide.sys><CMD Technology, Inc.>
[CPQARRY2 / CPQARRY2]
<\SystemRoot\System32\DRIVERS\cpqarry2.sys><Compaq Computer Corporation>
[CPQCISSM / CPQCISSM]
<\SystemRoot\System32\DRIVERS\cpqcissm.sys><Hewlett-Packard Company>
[CSB6IDE / CSB6IDE]
<\SystemRoot\System32\DRIVERS\csb6ide.sys><ServerWorks Corporation>
[dac2w2k / dac2w2k]
<\SystemRoot\System32\DRIVERS\dac2w2k.sys><Mylex Corporation>
[dac960nt / dac960nt]
<\SystemRoot\System32\DRIVERS\dac960nt.sys><N/A>
[DMX3191 / DMX3191]
<\SystemRoot\System32\DRIVERS\DMX3191.sys><Microsoft Corporation>
[DMX3194 / DMX3194]
<\SystemRoot\System32\DRIVERS\dmx3194.sys><Microsoft Corporation>
[DONTGO / DONTGO]
<\SystemRoot\System32\DRIVERS\DontGo.sys><Promise Technology, Inc.>
[dpti2o / dpti2o]
<\SystemRoot\System32\DRIVERS\dpti2o.sys><Microsoft Corporation>
[DPTSCSI / DPTSCSI]
<\SystemRoot\System32\DRIVERS\dptscsi.sys><Distributed Processing Technology Corp.>
[Intel(R) PRO Adapter Driver / E100B]
<system32\DRIVERS\e100b325.sys><Intel Corporation>
[FASTSX / FASTSX]
<\SystemRoot\System32\DRIVERS\fastsx.sys><Promise Technology, Inc.>
[FASTTRAK / FASTTRAK]
<\SystemRoot\System32\DRIVERS\fasttrak.sys><Promise Technology, Inc.>
[FASTTX2K / FASTTX2K]
<\SystemRoot\System32\DRIVERS\fasttx2k.sys><Promise Technology, Inc.>
[fjhjss0 / fjhjss02]
<\SystemRoot\System32\DRIVERS\fjhjss02.sys><N/A>
[FT8300 / FT8300]
<\SystemRoot\System32\DRIVERS\ft8300.sys><Promise Technology, Inc.>
[FTTXR52P / FTTXR52P]
<\SystemRoot\System32\DRIVERS\fttxr52P.sys><Promise Technology, Inc.>
[FTTXR54P / FTTXR54P]
<\SystemRoot\System32\DRIVERS\fttxr54P.sys><Promise Technology, Inc.>
[FTTXR5_O / FTTXR5_O]
<\SystemRoot\System32\DRIVERS\fttxr5_O.sys><Promise Technology, Inc.>
[GD31244 / GD31244]
<\SystemRoot\System32\DRIVERS\gd31244.sys><Intel Corporation>
[HPCISSS2 / HPCISSS2]
<\SystemRoot\System32\DRIVERS\HpCISSs2.sys><Hewlett-Packard Company>
[HPT371 / HPT371]
<\SystemRoot\System32\DRIVERS\HPT371.sys><HighPoint Technologies, Inc.>
[HPT374 / HPT374]
<\SystemRoot\System32\DRIVERS\hpt374.sys><HighPoint Technologies, Inc.>
[HPT3XX / HPT3XX]
<\SystemRoot\System32\DRIVERS\hpt3xx.sys><HighPoint Technologies, Inc.>
[HPTPRO / HPTPRO]
<\SystemRoot\System32\DRIVERS\hptpro.sys><HighPoint Technologies, Inc.>
[ialm / ialm]
<system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[IASTOR / IASTOR]
<\SystemRoot\System32\DRIVERS\iaStor.sys><Intel Corporation>
[IFT2000 / IFT2000]
<\SystemRoot\System32\DRIVERS\ift2000.sys><Infortrend Technology, Inc.>
[ini910u / ini910u]
<\SystemRoot\System32\DRIVERS\ini910u.sys><N/A>
[INIA100 / INIA100]
<\SystemRoot\System32\DRIVERS\INIA100.sys><Initio corp.>
[IPSRAIDN / IPSRAIDN]
<\SystemRoot\System32\DRIVERS\ipsraidn.sys><IBM Corporation>
[ITERAID / ITERAID]
<\SystemRoot\System32\DRIVERS\iteraid.sys><Integrated Technology Express, Inc.>
[JAHCI / JAHCI]
<\SystemRoot\System32\DRIVERS\><N/A>
[JGOGO / JGOGO]
<\SystemRoot\System32\DRIVERS\><N/A>
[Kl1 / Kl1]
<\SystemRoot\System32\drivers\kl1.sys><Kaspersky Lab>
[Klif / Klif]
<System32\drivers\klif.sys><Kaspersky Labs>
[Klmc / Klmc]
<System32\drivers\klmc.sys><Kaspersky Lab>
[M5228 / M5228]
<\SystemRoot\System32\DRIVERS\m5228.sys><ALi Corporation.>
[M5281 / M5281]
<\SystemRoot\System32\DRIVERS\m5281.sys><ALi Corporation>
[M5287 / M5287]
<\SystemRoot\System32\DRIVERS\m5287.sys><ULi Electronics Inc.>
[M5288 / M5288]
<\SystemRoot\System32\DRIVERS\m5288.sys><ULi Electronics Inc.>
[M5289 / M5289]
<\SystemRoot\System32\DRIVERS\m5289.sys><ULi Electronics Inc.>
[MEGAIDE / MEGAIDE]
<\SystemRoot\System32\DRIVERS\MegaIDE.sys><LSI Logic Corporation.>
[mraid35x / mraid35x]
<\SystemRoot\System32\DRIVERS\Mraid35x.sys><American Megatrends Inc.>
[MSAHCI / MSAHCI]
<\SystemRoot\System32\DRIVERS\msahci.sys><Microsoft Corporation>
[NFRD960 / NFRD960]
<\SystemRoot\System32\DRIVERS\nfrd960.sys><IBM Corporation>
[npkcrypt / npkcrypt]
<\??\D:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[nv / nv]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>

hxyjy - 2006-11-11 17:21:00

[NVATABUS / NVATABUS]
<\SystemRoot\System32\DRIVERS\NVATABUS.SYS><NVIDIA Corporation>
[NVRAID / NVRAID]
<\SystemRoot\System32\DRIVERS\NVRAID.SYS><NVIDIA Corporation>
[PNP649R / PNP649R]
<\SystemRoot\System32\DRIVERS\pnp649r.sys><CMD Technology, Inc.>
[PNP680 / PNP680]
<\SystemRoot\System32\DRIVERS\pnp680.sys><Silicon Image, Inc.>
[PNP680R / PNP680R]
<\SystemRoot\System32\DRIVERS\pnp680r.sys><Silicon Image, Inc>
[Direct Parallel Link Driver / Ptilink]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[ql1080 / ql1080]
<\SystemRoot\System32\DRIVERS\ql1080.sys><N/A>
[Ql10wnt / Ql10wnt]
<\SystemRoot\System32\DRIVERS\ql10wnt.sys><N/A>
[ql12160 / ql12160]
<\SystemRoot\System32\DRIVERS\ql12160.sys><QLogic Corporation>
[ql1240 / ql1240]
<\SystemRoot\System32\DRIVERS\ql1240.sys><N/A>
[ql1280 / ql1280]
<\SystemRoot\System32\DRIVERS\ql1280.sys><QLogic Corporation>
[RAIDSRC / RAIDSRC]
<\SystemRoot\System32\DRIVERS\raidsrc.sys><Intel/ICP>
[RR232X / RR232X]
<\SystemRoot\System32\DRIVERS\rr232x.sys><HighPoint Technologies, Inc.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139]
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[S150SX8 / S150SX8]
<\SystemRoot\System32\DRIVERS\S150sx8.sys><Promise Technology, Inc.>
[Secdrv / Secdrv]
<system32\DRIVERS\secdrv.sys><N/A>
[SI3112 / SI3112]
<\SystemRoot\System32\DRIVERS\SI3112.sys><Silicon Image, Inc.>
[SI3112R / SI3112R]
<\SystemRoot\System32\DRIVERS\SI3112r.sys><Silicon Image, Inc>
[SI3114 / SI3114]
<\SystemRoot\System32\DRIVERS\SI3114.sys><Silicon Image, Inc.>
[SI3114R / SI3114R]
<\SystemRoot\System32\DRIVERS\SI3114R.sys><Silicon Image, Inc>
[SI3114R5 / SI3114R5]
<\SystemRoot\System32\DRIVERS\Si3114r5.sys><Silicon Image, Inc>
[SI3124 / SI3124]
<\SystemRoot\System32\DRIVERS\SI3124.sys><Silicon Image, Inc.>
[SI3124R / SI3124R]
<\SystemRoot\System32\DRIVERS\SI3124R.sys><Silicon Image, Inc>
[SI3124R5 / SI3124R5]
<\SystemRoot\System32\DRIVERS\Si3124r5.sys><Silicon Image, Inc>
[SI3132 / SI3132]
<\SystemRoot\System32\DRIVERS\SI3132.sys><Silicon Image, Inc.>
[SI3132R5 / SI3132R5]
<\SystemRoot\System32\DRIVERS\Si3132r5.sys><Silicon Image, Inc>
[SIFILTER / SIFILTER]
<\SystemRoot\System32\DRIVERS\SiWinAcc.sys><Silicon Image, Inc.>
[SIREMFIL / SIREMFIL]
<\SystemRoot\System32\DRIVERS\SiRemFil.sys><Silicon Image, Inc.>
[SIS AGP Bus Filter / sisagp]
<\SystemRoot\system32\DRIVERS\sisagp.sys><Silicon Integrated Systems Corporation>
[SISRAID / SISRAID]
<\SystemRoot\System32\DRIVERS\SiSRaid.sys><Silicon Integrated Systems>
[SISRAID2 / SISRAID2]
<\SystemRoot\System32\DRIVERS\SiSRaid2.sys><Silicon Integrated Systems Corp>
[SISRAID4 / SISRAID4]
<\SystemRoot\System32\DRIVERS\SiSRaid4.sys><Silicon Integrated Systems>
[Intel (R) System Management BIOS Service / SMBios]
<system32\DRIVERS\SMBios.sys><Intel Corporation>
[SPTRAK / SPTRAK]
<\SystemRoot\System32\DRIVERS\sptrak.sys><Promise Technology, Inc.>
[ST8350 / ST8350]
<\SystemRoot\System32\DRIVERS\st8350.sys><Promise Technology, Inc.>
[symc810 / symc810]
<\SystemRoot\System32\DRIVERS\symc810.sys><N/A>
[symc8xx / symc8xx]
<\SystemRoot\System32\DRIVERS\symc8xx.sys><N/A>
[SYMMPI / SYMMPI]
<\SystemRoot\System32\DRIVERS\symmpi.sys><LSI Logic>
[sym_hi / sym_hi]
<\SystemRoot\System32\DRIVERS\sym_hi.sys><LSI Logic>
[sym_u3 / sym_u3]
<\SystemRoot\System32\DRIVERS\sym_u3.sys><LSI Logic>
[TCP/IP Protocol Driver / Tcpip]
<system32\DRIVERS\tcpip.sys><Microsoft Corporation>
[TRM3X5 / TRM3X5]
<\SystemRoot\System32\DRIVERS\trm3x5.sys><Tekram Technology Co., Ltd.>
[ULSATA / ULSATA]
<\SystemRoot\System32\DRIVERS\ulsata.sys><Promise Technology, Inc.>
[ULSATA2 / ULSATA2]
<\SystemRoot\System32\DRIVERS\ulsata2.sys><Promise Technology, Inc.>
[ULTIMA / ULTIMA]
<\SystemRoot\System32\DRIVERS\Ultima.sys><Aralion INC.>
[ULTIMARX / ULTIMARX]
<\SystemRoot\System32\DRIVERS\UltimaRX.sys><Aralion INC.>
[ultra / ultra]
<\SystemRoot\System32\DRIVERS\ultra.sys><Promise Technology, Inc.>
[VIAMRAID / VIAMRAID]
<\SystemRoot\System32\DRIVERS\viamraid.sys><VIA Technologies inc,.ltd>
[W2KADV / W2KADV]
<\SystemRoot\System32\DRIVERS\w2kadv.sys><ConnectCom Solutions, Inc.>
[WD7296A / WD7296A]
<\SystemRoot\System32\DRIVERS\wd7296a.sys><Western Digital Corporation>

==================================
浏览器加载项
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v14.dll, Thunder Networking Technologies,LTD>
[BdSearchHook Class]
{02496EBD-8455-48db-B3C7-5DAC97D9F5A7} <C:\PROGRA~1\baidu\iexp\BDSrHook.dll, >
[BandIE Class]
{77FEF28E-EB96-44FF-B511-3185DEA48697} <C:\PROGRA~1\baidu\bar\BaiduBar.dll, Baidu.com, Inc.>
[]
{02496EBD-8455-48db-B3C7-5DAC97D9F5A7} <http://baidu.com/index.php?tn=znmqdg, N/A>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <F:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[百度超级搜霸]
{B580CF65-E151-49C3-B73F-70B13FCA8E86} <C:\PROGRA~1\baidu\bar\BaiduBar.dll, Baidu.com, Inc.>
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v14.dll, Thunder Networking Technologies,LTD>
[BdSearchHook Class]
{02496EBD-8455-48DB-B3C7-5DAC97D9F5A7} <C:\PROGRA~1\baidu\iexp\BDSrHook.dll, >
[BandIE Class]
{77FEF28E-EB96-44FF-B511-3185DEA48697} <C:\PROGRA~1\baidu\bar\BaiduBar.dll, Baidu.com, Inc.>
[百度超级搜霸]
{B580CF65-E151-49C3-B73F-70B13FCA8E86} <C:\PROGRA~1\baidu\bar\BaiduBar.dll, Baidu.com, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <F:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[上传到QQ网络硬盘]
<D:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用网际快车下载]
<F:\Program Files\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接

hxyjy - 2006-11-11 17:22:00

<F:\Program Files\FlashGet\jc_all.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
<D:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<D:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[珊瑚虫搜索]
<C:\Program Files\YOK.com\SuperSearch\yoksch.htm, N/A>
[用QQ彩信发送该图片]
<D:\Program Files\Tencent\QQ\SendMMS.htm, N/A>
[百度-搜索MP3]
<res://C:\PROGRA~1\baidu\bar\BaiduBar.dll/BAIDUMP3.HTM, N/A>
[百度-搜索图片]
<res://C:\PROGRA~1\baidu\bar\BaiduBar.dll/BAIDUIMG.HTM, N/A>
[百度-搜索新闻]
<res://C:\PROGRA~1\baidu\bar\BaiduBar.dll/BAIDUNEWS.HTM, N/A>
[百度-搜索歌词]
<res://C:\PROGRA~1\baidu\bar\BaiduBar.dll/BAIDULYRIC.HTM, N/A>
[百度-搜索网页]
<res://C:\PROGRA~1\baidu\bar\BaiduBar.dll/BAIDUSEARCH.HTM, N/A>
[百度-搜索贴吧]
<res://C:\PROGRA~1\baidu\bar\BaiduBar.dll/BAIDUPOST.HTM, N/A>
[百度-词典搜索]
<res://C:\PROGRA~1\baidu\bar\BaiduBar.dll/BAIDU_DIC.HTM, N/A>

==================================
正在运行的进程
[PID: 644][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 700][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 724][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 768][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 780][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 940][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1004][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1104][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1192][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1272][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1584][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\PROGRA~1\baidu\iexp\BDSrHook.dll] [, 1, 0, 0, 7]
[C:\WINDOWS\system32\xunleibho_v14.dll] [Thunder Networking Technologies,LTD, 4, 6, 0, 62]
[C:\PROGRA~1\baidu\bar\BaiduBar.dll] [Baidu.com, Inc., 2, 0, 2, 62]
[f:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\scrchpg.dll] [Kaspersky Lab, 5.0.1.18]
[f:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\scrch_ag.dll] [Kaspersky Lab, 5.0.383.1]
[f:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\FSSync.dll] [Kaspersky Lab, 5.0.383.0]
[f:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\pr_rmt.dll] [Kaspersky Lab, 5.0.383.0]
[f:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\ccclient.dll] [Kaspersky Lab, 5.0.383.1]
[f:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\klipc.dll] [Kaspersky Lab, 5.0.383.0]
[f:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\KLUtil.dll] [Kaspersky Lab, 5.0.383.1]
[f:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\rpt.dll] [Kaspersky Lab, 5.0.383.2]
[f:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\CCIFACE.dll] [Kaspersky Lab, 5.0.383.1]
[f:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\prloader.dll] [Kaspersky Lab, 5.0.383.0]
[f:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\prkernel.ppl] [Kaspersky Lab, 5.0.383.0]
[f:\program files\kaspersky lab\kaspersky anti-virus personal\prstring.ppl] [Kaspersky Lab, 5.0.383.0]
[f:\program files\kaspersky lab\kaspersky anti-virus personal\pr_srv.ppl] [Kaspersky Lab, 5.0.383.0]
[f:\program files\kaspersky lab\kaspersky anti-virus personal\pr_clnt.ppl] [Kaspersky Lab, 5.0.383.0]
[f:\program files\kaspersky lab\kaspersky anti-virus personal\tempfile.ppl] [Kaspersky Lab, 5.0.383.0]
[PID: 1924][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3744][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] [RealNetworks, Inc., 0.1.0.3208]
[PID: 3560][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[PID: 852][D:\Program Files\Tencent\TT\TTraveler.exe] [腾讯公司, 3.1.0.261]
[D:\Program Files\Tencent\TT\Plugins\QQFloatBar\QQFloatBar4TT2.dll] [腾讯公司, 1, 1, 0, 5]
[D:\Program Files\Tencent\TT\Plugins\TWeather\TWeather.dll] [, 1, 0, 0, 3]
[D:\Program Files\Tencent\TT\PersonalDesktop.dll] [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 4]
[f:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\scrchpg.dll] [Kaspersky Lab, 5.0.1.18]
[f:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\scrch_ag.dll] [Kaspersky Lab, 5.0.383.1]
[f:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\FSSync.dll] [Kaspersky Lab, 5.0.383.0]
[f:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\pr_rmt.dll] [Kaspersky Lab, 5.0.383.0]
[f:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\ccclient.dll] [Kaspersky Lab, 5.0.383.1]
[f:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\klipc.dll] [Kaspersky Lab, 5.0.383.0]
[f:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\KLUtil.dll] [Kaspersky Lab, 5.0.383.1]
[f:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\rpt.dll] [Kaspersky Lab, 5.0.383.2]
[f:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\CCIFACE.dll] [Kaspersky Lab, 5.0.383.1]
[f:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\prloader.dll] [Kaspersky Lab, 5.0.383.0]
[f:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\prkernel.ppl] [Kaspersky Lab, 5.0.383.0]
[f:\program files\kaspersky lab\kaspersky anti-virus personal\prstring.ppl] [Kaspersky Lab, 5.0.383.0]
[f:\program files\kaspersky lab\kaspersky anti-virus personal\pr_srv.ppl] [Kaspersky Lab, 5.0.383.0]
[f:\program files\kaspersky lab\kaspersky anti-virus personal\pr_clnt.ppl] [Kaspersky Lab, 5.0.383.0]
[f:\program files\kaspersky lab\kaspersky anti-virus personal\tempfile.ppl] [Kaspersky Lab, 5.0.383.0]
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[C:\PROGRA~1\baidu\iexp\BDSrHook.dll] [, 1, 0, 0, 7]
[PID: 2560][D:\Program Files\Tencent\TT\TCPlus.exe] [腾讯公司, 1, 0, 0, 5]
[D:\Program Files\Tencent\TT\QQDownload.dll] [Tencent Technology (Shenzhen) Company Limited, 1, 0, 101, 28]
[D:\Program Files\Tencent\TT\TNProxy.dll] [Tencent Technology(Shenzhen) Company Limited, 2, 1, 101, 60]
[C:\PROGRA~1\baidu\iexp\BDSrHook.dll] [, 1, 0, 0, 7]
[PID: 3084][C:\WINDOWS\system32\RUNDLL32.EXE] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\PROGRA~1\baidu\iexp\BDSrHook.dll] [, 1, 0, 0, 7]
[PID: 3116][F:\安装程序\sreng2\SREng\SREng.exe] [Smallfrogs Studio, 2.2.6.605]
[C:\PROGRA~1\baidu\iexp\BDSrHook.dll] [, 1, 0, 0, 7]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 about-blank.cc
127.0.0.1 kzxf.com
127.0.0.1 vod.mmdy.org
127.0.0.1 www.4199.com
127.0.0.1 www.71791.com
127.0.0.1 www.7939.com
127.0.0.1 www.9505.com
127.0.0.1 www.feixue.net
127.0.0.1 www.kzxf.com
127.0.0.1 www.my123.com
127.0.0.1 www.piaoxue.com
127.0.0.1 www.xfkz.com
127.0.0.1 xfkz.com

==================================

鬼童 - 2006-11-11 17:28:00

本扫描/诊断报告由雅虎助手IE修复专家生成

操作系统: Windows XP
IE版本号: 6.0.2900.2180

===============================================================

以下是我的扫描报告正文：

*** 扫描项列表 ***

下列条目被IE修复专家判断为危险：

下列条目被IE修复专家判断为有风险：

下列条目被IE修复专家判断为未知：

1.R00 - IE首页 - http://www.my123.com/，，
内容：http://www.my123.com/
安全等级：未知

2.R00 - IE首页 - http://www.my123.com/，，
内容：http://www.my123.com/
安全等级：未知

3.R03 - 搜索挂接 - 无效的CLSID : {BB936323-19FA-4521-BA29-ECA6A121BC78}，，
内容：coolbar
安全等级：未知

4.O02 - 浏览器辅助对象(BHO) - Seekmo Search Assistant Helper，，
CLSID：{5929CD6E-2062-44a4-B2C5-2C7E78FBAB38}
相关文件：(文件不存在)(隐藏)(系统)c:\program files\seekmo\seekmohook.dll
安全等级：未知

5.O02 - 浏览器辅助对象(BHO) - Vision，，
CLSID：{6671A431-5C3D-463d-A7CF-5587F9B7E191}
相关文件：C:\Program Files\MMSAssist\Mmsass~1.dll
安全等级：未知

6.O02 - 浏览器辅助对象(BHO) - Windows Live Sign-in Helper，Microsoft Corporation，
CLSID：{9030D464-4C02-4ABF-8ECC-5164760863C6}
相关文件：C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
安全等级：未知

7.O02 - 浏览器辅助对象(BHO) - ，，
CLSID：{A9930D97-9CF0-42A0-A10D-4F28836579D5}
相关文件：F:\Program Files\KuGoo3\KuGoo3DownXControl.ocx
安全等级：未知

8.O03 - IE第三方工具条 - BitComet工具栏，，
CLSID：{3F1ABCDB-A875-46c1-8345-B72A4567E486}
相关文件：C:\Program Files\BitComet\BitCometBar\BitCometBar0.6.dll
内容：BitComet工具栏
安全等级：未知

9.O04 - 自动运行项(Run) - 一款影音编码解码器软件。，，
相关文件：C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe /S /opti
内容："C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti
安全等级：未知

10.O04 - 自动运行项(Run) - 瑞星防火墙程序，抵御黑客攻击。，Beijing Rising Technology Co., Ltd.，
相关文件：C:\Program Files\Rising\Rfw\rfwmain.exe -Startup
内容："C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
安全等级：未知

11.O04 - 自动运行项(Run) - RavTask，Beijing Rising Technology Co., Ltd.，
相关文件：C:\Program Files\Rising\Rav\RavTask.exe -system
内容："C:\Program Files\Rising\Rav\RavTask.exe" -system
安全等级：未知

12.O04 - 自动运行项(Run) - seekmo，，
相关文件：(文件不存在)(隐藏)(系统)c:\program files\seekmo\seekmo.exe
内容："c:\program files\seekmo\seekmo.exe"
安全等级：未知

13.O04 - 自动运行项(Run) - PHIMETIPSYNC，Microsoft Corp.，
相关文件：C:\Program Files\Common Files\Microsoft Shared\IME\IMTC60\Phonetic\TINTLCFG.EXE /PHIMETIPSync
内容：C:\Program Files\Common Files\Microsoft Shared\IME\IMTC60\Phonetic\TINTLCFG.EXE /PHIMETIPSync
安全等级：未知

14.O04 - 自动运行项(Run) - CertificateRegistration，A.E.T. Europe B.V.，
相关文件：C:\WINDOWS\system32\SafeSignCertReg.exe
内容：SafeSignCertReg.exe
安全等级：未知

15.O08 - IE右键菜单 - >> 彩信发送 <<，，
相关文件：C:\Program Files\MMSAssist\Mmsass~1.dll /mms.htm
安全等级：未知

16.O08 - IE右键菜单 - >>彩信发送<<，，
相关文件：C:\Program Files\MMSAssist\Mmsass~1.dll /mms.htm
安全等级：未知

17.O08 - IE右键菜单 - 上传到QQ网络硬盘，，
相关文件：F:\腾讯\AddToNetDisk.htm
安全等级：未知

18.O08 - IE右键菜单 - 使用KuGoo3下载(&K)，，
相关文件：F:\Program Files\KuGoo3\KuGoo3DownX.htm
安全等级：未知

19.O08 - IE右键菜单 - 添加到QQ自定义面板，，
相关文件：F:\腾讯\AddPanel.htm
安全等级：未知

20.O08 - IE右键菜单 - 添加到QQ表情，，
相关文件：F:\腾讯\AddEmotion.htm
安全等级：未知

21.O08 - IE右键菜单 - 添加到雅虎订阅(&Y)，Yahoo! China，
相关文件：C:\Program Files\Yahoo!\Assistant\Assist\yrss.dll /YRSSMENUEXT
安全等级：未知

22.O08 - IE右键菜单 - 用QQ彩信发送该图片，，
相关文件：F:\腾讯\SendMMS.htm
安全等级：未知

23.O08 - IE右键菜单 - 豪杰超级解霸V8实时播放，，
相关文件：C:\Herosoft\HeroV8\MPUrlget.htm
安全等级：未知

24.O09 - IE工具栏按钮 - 浩方对战平台，上海浩方在线信息技术有限公司，
相关文件：F:\Program Files\浩方对战平台\GameClient.exe
安全等级：未知

25.O09 - IE菜单项和工具栏按钮 - 豪杰超级解霸V8，herosoft，
相关文件：C:\Herosoft\HeroV8\STHSDVD.exe
安全等级：未知

26.O09 - IE工具栏按钮 - 名品折扣，，
网页路径：http://adtaobao.allyes.com/main/adfclick?db=adtaobao&bid=138,140,18&cid=816,8,1&sid=5042&show=ignore&url=http://www.taobao.com/vertical/mall/pro.php?allyesPara=816
安全等级：未知

27.O09 - IE工具栏按钮 - 雅虎WIDGET，，
网页路径：http://cn.widget.yahoo.com/index.htm?source=Cns
安全等级：未知

28.O09 - IE菜单项 - 彩E精灵设置，，
相关文件：C:\Program Files\MMSAssist\Mmsass~1.dll
安全等级：未知

29.O09 - IE菜单项和工具栏按钮 - 腾讯QQ，TENCENT，
相关文件：F:\腾讯\QQ.exe
安全等级：未知

30.O09 - IE菜单项和工具栏按钮 - &FlashGet，Amaze Soft，
相关文件：C:\Program Files\FlashGet\flashget.exe
安全等级：未知

31.O09 - IE菜单项和工具栏按钮 - 易趣购物，，
网页路径：http://click2.ad4all.net/url2/urlmanage/url.asp?id=5
安全等级：未知

32.O09 - IE菜单项 - QQ炫彩工具条设置，深圳市腾讯计算机系统有限公司，
相关文件：F:\腾讯\QQIEHelper.dll
安全等级：未知

33.O16 - 下载的ActiveX插件 - VqqSpeedDlProxy，Tencent，
CLSID：{F138084D-84D7-48CD-BEA8-04772457516E}
相关文件：C:\WINDOWS\vqqsdl.dll
网页路径：http://218.85.138.27/vqqsdl1009.cab
安全等级：未知

34.O17 - 本机网络设置 NameServer - 202.96.133.134,202.96.128.68，，
内容：202.96.133.134,202.96.128.68
安全等级：未知

35.O21 - 自启动项SSODL - Direct Media Service，，
CLSID：{D1F73845-4BAB-4061-A46B-FCF7ECC19217}
相关文件：C:\Program Files\Kuree\MService.dll
内容：{D1F73845-4BAB-4061-A46B-FCF7ECC19217}
安全等级：未知

36.O27 - 文件执行挂钩 - ShlExecHack，Beijing Rising Technology Co., Ltd.，
CLSID：{32CD708B-60A7-4C00-9377-D73EAA495F0F}
相关文件：C:\WINDOWS\system32\RavExt.dll
内容：Rising Execute File Exts hook
安全等级：未知

37.O27 - 文件执行挂钩 - PatchCom，Yahoo! China，
CLSID：{E568441B-9EF3-49F8-9A67-4141AC41ADD4}
相关文件：C:\Program Files\Yahoo!\Assistant\Assist\ypatch.dll
安全等级：未知

38.O27 - 文件执行挂钩 - HookExecute，YAHOO Corporation Limited，
CLSID：{4BAB150F-DD97-476D-9C1E-41B6CDC0CA7A}
相关文件：C:\Program Files\Yahoo!\Assistant\yclickon.dll
安全等级：未知

下列条目被IE修复专家判断为安全：

39.R01 - IE用户指定空白页 - 空首页，，
内容：C:\WINDOWS\system32\blank.htm
安全等级：安全

40.R00 - IE自定义搜索引擎 - http://seek.yisou.com/srchcust.htm，，
内容：http://seek.yisou.com/srchcust.htm
安全等级：安全

41.R00 - IE备用搜索引擎 - http://seek.yisou.com/srchasst.htm，，
内容：http://seek.yisou.com/srchasst.htm
安全等级：安全

42.R03 - 搜索挂接 - 雅虎助手，Yahoo!，
CLSID：{406F94F0-504F-4a40-8DFD-58B0666ABEBD}
相关文件：C:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll
内容：coolbar
安全等级：安全

43.O02 - 浏览器辅助对象(BHO) - 迅雷下载IE相关插件，迅雷，
CLSID：{0005A87D-D626-4B3A-84F9-1D9571695F55}
相关文件：C:\WINDOWS\system32\xunleibho_v8.dll
安全等级：安全

44.O02 - 浏览器辅助对象(BHO) - Yahoo!Photo，Yahoo! China，
CLSID：{33BBE430-0E42-4f12-B075-8D21ACB10DCB}
相关文件：C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll
安全等级：安全

45.O02 - 浏览器辅助对象(BHO) - (反钓鱼专家)，Yahoo.，
CLSID：{38928D50-8A48-44C2-945F-D2F23F771410}
相关文件：C:\Program Files\Yahoo!\Assistant\Assist\yangling.dll
安全等级：安全

46.O02 - 浏览器辅助对象(BHO) - 雅虎助手，Yahoo!，
CLSID：{406F94F0-504F-4a40-8DFD-58B0666ABEBD}
相关文件：C:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll
安全等级：安全

47.O02 - 浏览器辅助对象(BHO) - QQ IE助手，深圳市腾讯计算机系统有限公司，
CLSID：{54EBD53A-9BC1-480B-966A-843A333CA162}
相关文件：F:\腾讯\QQIEHelper.dll
安全等级：安全

48.O02 - 浏览器辅助对象(BHO) - DragSearch BHO，，
CLSID：{62EED7C6-9F02-42f9-B634-98E2899E147B}
相关文件：C:\Program Files\Yahoo!\Assistant\Assist\ydragsearch.dll
安全等级：安全

49.O02 - 浏览器辅助对象(BHO) - FlashGet 监视网页点击插件，Amaze Soft，
CLSID：{A5366673-E8CA-11D3-9CD9-0090271D075B}
相关文件：C:\Program Files\FlashGet\Jccatch.dll
安全等级：安全

50.O02 - 浏览器辅助对象(BHO) - 网络实名，北京三七二一科技有限公司，
CLSID：{D157330A-9EF3-49F8-9A67-4141AC41ADD4}
相关文件：C:\WINDOWS\Downloaded Program Files\CnsHook.dll
安全等级：安全

51.O02 - 浏览器辅助对象(BHO) - 一搜工具条，雅虎公司，
CLSID：{EF1D17A9-089F-40cc-8D64-7324CDEBA0DB}
相关文件：C:\Program Files\yisou\yisoub.dll
安全等级：安全

52.O03 - IE工具条“链接”的标题 - 链接，，
内容：链接
安全等级：安全

53.O03 - IE第三方工具条 - 雅虎助手，Yahoo!，
CLSID：{406F94F0-504F-4a40-8DFD-58B0666ABEBD}
相关文件：C:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll
内容：雅虎助手
安全等级：安全

54.O03 - IE第三方工具条 - 一搜工具条，3721，
CLSID：{115F6E46-FCBC-41ed-B3B5-3BDDD4AAB5E5}
相关文件：C:\Program Files\yisou\yisou.dll
内容：一搜
安全等级：安全

鬼童 - 2006-11-11 17:30:00

【回复“鬼童”的帖子】
55.O04 - 自动运行项(Run) - RealOne Player免费版的驻留程序，RealNetworks, Inc.，
相关文件：C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
内容："C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
安全等级：安全

56.O04 - 自动运行项(Run) - NVIDIA显示卡NView向导，NVIDIA Corporation，
相关文件：C:\WINDOWS\system32\nwiz.exe /install
内容：nwiz.exe /install
安全等级：安全

57.O04 - 自动运行项(Run) - NVIDIA系列显卡媒体中心程序，NVIDIA Corporation，
相关文件：C:\WINDOWS\system32\nvmctray.dll
内容：RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
安全等级：安全

58.O04 - 自动运行项(Run) - 声卡管理优化软件，Realtek Semiconductor Corp.，
相关文件：C:\WINDOWS\SOUNDMAN.EXE
内容：SOUNDMAN.EXE
安全等级：安全

59.O04 - 自动运行项(Run) - YLive.exe，Yahoo! China，
相关文件：C:\Program Files\Yahoo!\Assistant\ylive.exe
内容：C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
安全等级：安全

60.O04 - 自动运行项(Run) - 雅虎助手，yahoo，
相关文件：C:\Program Files\3721\Helper.dll
内容：C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
安全等级：安全

61.O04 - 自动运行项(Run) - 3721 网络实名，北京三七二一科技有限公司，
相关文件：C:\WINDOWS\Downloaded Program Files\CnsMin.dll
内容：Rundll32.exe C:\WINDOWS\DOWNLO~1\CnsMin.dll,Rundll32
安全等级：安全

62.O04 - 自动运行项(Run) - yassistse，Yahoo!，
相关文件：C:\Program Files\Yahoo!\Assistant\yassistse.exe
内容："C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"
安全等级：安全

63.O04 - 自动运行项(Run) - NVIDIA系列显卡的调节工具，NVIDIA Corporation，
相关文件：C:\WINDOWS\system32\nvcpl.dll
内容：RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
安全等级：安全

64.O04 - 自动运行项(Run) - Windows多种输入技术的支持程序，Microsoft Corporation，
相关文件：C:\WINDOWS\system32\ctfmon.exe
内容：C:\WINDOWS\system32\ctfmon.exe
安全等级：安全

65.O04 - 自动运行项(Run) - Windows Messenger即时通讯工具，Microsoft，
相关文件：(文件不存在)(隐藏)(系统)C:\Program Files\MSN Messenger\MsnMsgr.Exe /background
内容："C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
安全等级：安全

66.O08 - IE右键菜单 - !搜一搜，3721，
相关文件：C:\Program Files\yisou\yisou.dll /232
安全等级：安全

67.O08 - IE右键菜单 - 使用网际快车下载，，
相关文件：C:\Program Files\FlashGet\jc_link.htm
安全等级：安全

68.O08 - IE右键菜单 - 使用网际快车下载全部链接，，
相关文件：C:\Program Files\FlashGet\jc_all.htm
安全等级：安全

69.O08 - IE右键菜单 - 导出到 Microsoft Office Excel(&X)，Microsoft Corporation，
相关文件：C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE /3000
安全等级：安全

70.O08 - IE右键菜单 - 雅虎搜索，Yahoo!，
相关文件：C:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll /246
安全等级：安全

71.O09 - IE工具栏按钮 - Yahoo 1G电邮，，
网页路径：http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail
安全等级：安全

72.O09 - IE工具栏按钮 - 雅虎助手，，
网页路径：http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist
安全等级：安全

73.O09 - IE工具栏按钮 - 情景聊天，，
网页路径：http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg
安全等级：安全

74.O09 - IE菜单项 - 修复浏览器，，
网页路径：http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair
安全等级：安全

75.O09 - IE菜单项和工具栏按钮 - Windows Messenger，Microsoft Corporation，
相关文件：C:\Program Files\Messenger\msmsgs.exe
安全等级：安全

76.O09 - IE菜单项 - 清理上网记录，，
网页路径：http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean
安全等级：安全

77.O11 - IE高级操作 - !CNS (中文上网)，，
安全等级：安全

78.O16 - 下载的ActiveX插件 - {33564D57-0000-0010-8000-00AA00389B71}，Microsoft，
网页路径：http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
安全等级：安全

79.O16 - 下载的ActiveX插件 - Windows升级工具V5，Microsoft Corporation，
CLSID：{6414512B-B978-451D-A0D8-FCFDF33E833C}
相关文件：C:\WINDOWS\system32\wuweb.dll
网页路径：http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1113365020345
安全等级：安全

80.O16 - 下载的ActiveX插件 - 中国工商银行个人银行，，
CLSID：{73E4740C-08EB-4133-896B-8D0A7C9EE3CD}
相关文件：C:\WINDOWS\system32\InputControl.dll
网页路径：https://mybank.icbc.com.cn/icbc/perbank/AXSafeControls.cab
安全等级：安全

81.O16 - 下载的ActiveX插件 - Flash播放器，Macromedia, Inc.，
CLSID：{D27CDB6E-AE6D-11CF-96B8-444553540000}
相关文件：C:\WINDOWS\system32\Macromed\Flash\Flash8a.ocx
网页路径：http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
安全等级：安全

82.O18 - 网络协议过滤器 - OFFICE 相关，Microsoft Corporation，
CLSID：{807553E5-5146-11D5-A672-00B0D022E945}
相关文件：C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
安全等级：安全

83.O21 - 自启动项SSODL - 管理托盘图标对象的程序，Microsoft Corporation，
CLSID：{35CEC8A3-2BE6-11D2-8773-92E220524153}
相关文件：C:\WINDOWS\system32\stobject.dll
内容：{35CEC8A3-2BE6-11D2-8773-92E220524153}
安全等级：安全

84.O27 - 文件执行挂钩 - 网络实名，北京三七二一科技有限公司，
CLSID：{D157330A-9EF3-49F8-9A67-4141AC41ADD4}
相关文件：C:\WINDOWS\Downloaded Program Files\CnsHook.dll
安全等级：安全

85.O31 - 浏览栏区对象 - 每日提示，Microsoft Corporation，
CLSID：{4D5C8C25-D075-11d0-B416-00C04FB90376}
相关文件：C:\WINDOWS\system32\shdocvw.dll
安全等级：安全

86.O31 - 浏览栏区对象 - 雅虎订阅(&Y)，Yahoo! China，
CLSID：{19CE93DE-8334-42C6-B2CA-BFE3DF5196A3}
相关文件：C:\Program Files\Yahoo!\Assistant\Assist\yrss.dll
安全等级：安全

87.O31 - 浏览栏区对象 - File Search Explorer Band，Microsoft Corporation，
CLSID：{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}
相关文件：C:\WINDOWS\system32\shell32.dll
安全等级：安全

88.O31 - 浏览栏区对象 - 浏览器栏，Microsoft Corporation，
CLSID：{EFA24E64-B078-11D0-89E4-00C04FC9E26E}
相关文件：C:\WINDOWS\system32\shdocvw.dll
安全等级：安全

不知道怎么搞

挚爱唯一 - 2006-11-11 17:40:00

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<NiceMs><C:\Program Files\Common Files\Microsoft Shared\MSINFO\Mymsok.exe> [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Corporation]
<VTTimer><VTTimer.exe> [(Verified)S3 Graphics, Inc.]
<S3Trayp><S3trayp.exe> [(Verified)S3 Graphics Co., Ltd.]
<SoundMan><SOUNDMAN.EXE> [(Verified)Realtek Semiconductor Corp.]
<StormCodec_Helper><"C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti> [N/A]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
<RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<RavStub><"C:\Program Files\Rising\Rav\ravstub.exe" /RUNONCE> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
<{6E44887F-5214-41F2-AB46-4728735C4CC6}><C:\Program Files\Internet Explorer\PLUGINS\system16.sys> [N/A]

==================================
启动文件夹
[Microsoft Office]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Microsoft Office.lnk --> C:\PROGRA~1\MICROS~2\Office\OSA9.EXE [Microsoft Corporation]><N>
[腾讯QQ]
<C:\Documents and Settings\vvv\「开始」菜单\程序\启动\腾讯QQ.lnk --> E:\QQ\QQ.exe [TENCENT]><N>
服务
[Human Interface Device Access / HidServ]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Local Connection Manager / MOVEESS]
<C:\WINDOWS\SYSTEM32\RUNDLLFROMWIN2000.EXE C:\WINDOWS\SYSTEM32\WBEM\DOHXOL04.DLL,Export 1087><Microsoft Corporation>
[Remote Registry Protect / NtStub]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\fscfdc37.dll><N/A>
[Rising Proxy Service / RfwProxySrv]
<c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService]
<c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
驱动程序
[Service for Realtek AC97 Audio (WDM) / ALCXWDM]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[AMD Processor Driver / AmdK8]
<system32\DRIVERS\AmdK8.sys><Advanced Micro Devices>
[Rising TDI Base Driver / BaseTDI]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[ExpScaner / ExpScaner]
<\??\C:\Program Files\Rising\Rav\ExpScan.sys><>
[HookCont / HookCont]
<\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising tech Co. ltd>
[HookReg / HookReg]
<\??\C:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys]
<\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising>
[HookUrl / HookUrl]
<\??\C:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[MEMSCAN / MEMSCAN]
<\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[mProcRs / mProcRs]
<\??\c:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[ATK0110 ACPI UTILITY / MTsensor]
<system32\DRIVERS\ASACPI.sys><>
[paraudio / paraudio]
<\??\C:\WINDOWS\system32\drivers\paraudio.sys><Microsoft Corporation>
[Direct Parallel Link Driver / Ptilink]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsFwDrv / RsFwDrv]
<\??\C:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS]
<\??\C:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139]
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[S3GIGP / S3GIGP]
<system32\DRIVERS\S3gIGPm.sys><S3 Graphics Co., Ltd.>
[Secdrv / Secdrv]
<system32\DRIVERS\secdrv.sys><N/A>
[ViaIde / ViaIde]
<\SystemRoot\system32\DRIVERS\viaide.sys><Microsoft Corporation>

==================================
浏览器加载项
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[MediaComm Class]
{7670648D-461B-42AF-BDFE-46D26AF5EFF2} <D:\gongju\xunlei\Components\InMedia\MediaAddin09.dll, Thunder Networking Technologies,LTD>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[卡卡上网安全助手]
{AFF6E516-CBE5-4F8A-9C2F-38A68013E766} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
{CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
{CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[上传到QQ网络硬盘]
<E:\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
<E:\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<E:\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<E:\QQ\SendMMS.htm, N/A>

==================================

挚爱唯一 - 2006-11-11 17:43:00

正在运行的进程
[PID: 460][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 516][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 540][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 584][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 596][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 744][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 788][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 852][C:\Program Files\Rising\Rav\CCenter.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
[PID: 880][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 924][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1008][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1064][C:\Program Files\Rising\Rav\Ravmond.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 1, 47]
[C:\Program Files\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\Rav\RsPPsys.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\Rising\Rav\RsLog.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
[C:\Program Files\Rising\Rav\HOOKSYS.dll] [Beijing Rising Technology Co., Ltd., 18, 1, 0, 12]
[C:\Program Files\Rising\Rav\Scanner.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 33]
[C:\Program Files\Rising\Rav\libload.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10]
[C:\Program Files\Rising\Rav\VirusLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
[C:\Program Files\Rising\Rav\regmon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6]
[C:\Program Files\Rising\Rav\HookWeb.dll] [rising, 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\MemMon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 12]
[C:\Program Files\Rising\Rav\expscan.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\Rising\Rav\mPorts.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3]
[C:\Program Files\Rising\Rav\MailMon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\Program Files\Rising\Rav\SpamEng.dll] [N/A, 18, 0, 0, 6]
[C:\Program Files\Rising\Rav\engine.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 35]
[C:\Program Files\Rising\Rav\PostTrt.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 18]
[C:\Program Files\Rising\Rav\UnExe.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[C:\Program Files\Rising\Rav\ScanExec.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 15]
[C:\Program Files\Rising\Rav\ScanEx.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 32]
[C:\Program Files\Rising\Rav\RSUnpack.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]
[C:\Program Files\Rising\Rav\ExtFile.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 24]
[C:\Program Files\Rising\Rav\NvFile.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 7]
[C:\Program Files\Rising\Rav\ScanMac.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10]
[C:\Program Files\Rising\Rav\ScanSct.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
[C:\Program Files\Rising\Rav\Unpacker.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\Program Files\Rising\Rav\ExtOLE.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6]
[C:\Program Files\Rising\Rav\ScanElf.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
[PID: 1248][c:\program files\rising\rfw\rfwsrv.exe] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 33]
[c:\program files\rising\rfw\RfwRule.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 13]
[c:\program files\rising\rfw\rfwlog.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 6]
[c:\program files\rising\rfw\Rfwdrv.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 21]
[c:\program files\rising\rfw\MonDrv.dll] [rs, 1, 0, 0, 4]
[c:\program files\rising\rfw\ProcLib.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 9]
[c:\program files\rising\rfw\mPorts.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3]
[PID: 1300][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 21]
[C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[PID: 1424][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1528][C:\Program Files\Rising\Rav\RavStub.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 16]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[PID: 1764][C:\WINDOWS\system32\VTTimer.exe] [S3 Graphics, Inc., 2.00.05-0616]
[PID: 1772][C:\WINDOWS\system32\S3trayp.exe] [S3 Graphics Co., Ltd., 2.00.41-1031]
[C:\WINDOWS\system32\S3Cfg3d.dll] [S3 Graphics Co., Ltd., 2.00.30-1212]
[C:\WINDOWS\system32\S3Disply.dll] [S3 Graphics Co., Ltd., 2.00.85-0421]
[C:\WINDOWS\system32\S3Gamma2.dll] [S3 Graphics Co., Ltd., 2.00.34-0504]
[C:\WINDOWS\system32\S3Info2.dll] [S3 Graphics Co., Ltd., 2.00.42-0330]
[C:\WINDOWS\system32\S3Ovrlay.dll] [S3 Graphics Co., Ltd., 2.00.39-0330]
[PID: 1784][C:\WINDOWS\SOUNDMAN.EXE] [Realtek Semiconductor Corp., 5, 1, 0, 52]
[PID: 1812][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] [RealNetworks, Inc., 0.1.0.3018]
[PID: 1820][C:\Program Files\Rising\Rfw\rfwmain.exe] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 52]
[C:\Program Files\Rising\Rfw\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 23]
[C:\Program Files\Rising\Rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\Rising\Rfw\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[PID: 1848][C:\Program Files\Rising\Rav\RavTask.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 22]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[PID: 1860][C:\Program Files\Rising\Rav\Ravmon.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 1, 39]
[C:\Program Files\Rising\Rav\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 26]
[C:\Program Files\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\Rav\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[PID: 1868][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 400][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3540][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\kakatool.dll] [Beijing Rising Technology Co., Ltd., 2, 0, 0, 9]
[C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\system32\msdmo.dll] [N/A, N/A]
[C:\WINDOWS\system32\ffdshow.ax] [N/A, 1.0.2.24]
[C:\Program Files\Ringz Studio\Storm Codec\Codecs\VSFilter.dll] [Gabest, 1, 0, 0, 9]
[PID: 440][E:\QQ\QQ.exe] [TENCENT, 0, 0, 0, 0]

挚爱唯一 - 2006-11-11 17:44:00

[E:\QQ\QQBaseClassInDll.dll] [, 1, 0, 0, 1]
[E:\QQ\QQHelperDll.dll] [, 1, 0, 0, 1]
[E:\QQ\BasicCtrlDll.dll] [Tencent, 5, 0, 200, 370]
[E:\QQ\QQAPI.dll] [, 1, 0, 0, 1]
[E:\QQ\LoginCtrl.dll] [, 1, 0, 0, 1]
[E:\QQ\npkcntc.dll] [INCA Internet Co., Ltd., 2006, 6, 27, 1]
[E:\QQ\npkpdb.dll] [INCA Internet Co., Ltd., 2003, 10, 1, 1]
[E:\QQ\QQRes.dll] [tencent, 1, 0, 0, 1]
[E:\QQ\QQMainFrame.dll] [N/A, N/A]
[E:\QQ\CQQApplication.dll] [N/A, N/A]
[E:\QQ\NewSkin.dll] [, 1, 0, 0, 1]
[E:\QQ\HostingMgr.dll] [, 1, 0, 0, 1]
[E:\QQ\CameraDll.dll] [, 1, 0, 0, 1]
[E:\QQ\MailSummary.dll] [, 1, 0, 0, 1]
[E:\QQ\QQSpace.dll] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\msdmo.dll] [N/A, N/A]
[E:\QQ\QQGroupMng.dll] [, 1, 0, 0, 1]
[E:\QQ\GroupLive.dll] [N/A, N/A]
[E:\QQ\UserDefinedHead.dll] [, 1, 0, 0, 1]
[E:\QQ\QQPlugin.dll] [N/A, N/A]
[E:\QQ\QQConfigPlugin.dll] [, 1, 0, 0, 1]
[E:\QQ\QRingMng.dll] [N/A, N/A]
[E:\QQ\PhoneAPI.dll] [, 1, 0, 0, 1]
[E:\QQ\DialerAllinOne.dll] [tencent, 1, 4, 0, 0]
[E:\QQ\VPortal.dll] [, 1, 0, 0, 4]
[E:\QQ\LongConnection.dll] [tencent, 5, 0, 200, 160]
[E:\QQ\QQAvatar.dll] [N/A, N/A]
[E:\QQ\FlashAvatarDll.dll] [, 1, 4, 0, 1]
[E:\QQ\QQAllInOne.dll] [N/A, N/A]
[E:\QQ\SCCore.dll] [TENCENT, 2, 0, 0, 1]
[E:\QQ\QQPet.dll] [, 1, 0, 0, 1]
[E:\QQ\QQCustomFace.dll] [N/A, N/A]
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[E:\QQ\QQFileTransfer.dll] [Tencent, 0, 3, 3, 5]
[E:\QQ\QQSceneMng.dll] [N/A, N/A]
[E:\QQ\GroupConnection.dll] [Tencent, 0, 3, 3, 5]
[E:\QQ\QQSysMsgMng.dll] [N/A, N/A]
[E:\QQ\BQQApplication.dll] [N/A, N/A]
[E:\QQ\QQZip.dll] [tencent, 0, 3, 2, 4]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 21]
[E:\QQ\CommercesMng.dll] [, 1, 0, 0, 1]
[E:\QQ\PersonalDesktop.dll] [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2]
[E:\QQ\QQAddr.dll] [深圳市腾讯计算机系统有限公司, 5, 0, 101, 240]
[E:\QQ\QQPhoneHelper.dll] [腾讯科技（深圳）有限公司, 2, 0, 6, 60]
[PID: 4032][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\kakatool.dll] [Beijing Rising Technology Co., Ltd., 2, 0, 0, 9]
[C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[PID: 2932][F:\系统扫描软件\SREng\SREng.exe] [Smallfrogs Studio, 2.2.6.605]

==================================
文件关联
.TXT Error. [notepad.exe %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM Error. [hh.exe %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI Error. [notepad.exe %1]
.INF Error. [notepad.exe %1]
.VBS Error. [wscript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
N/A

==================================

cyp0126 - 2006-11-11 18:13:00

2006-11-11,17:54:54

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
<MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background> [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Corporation]
<MSPY2002><C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC> [(Verified)N/A]
<DAEMON Tools-2052><"C:\Program Files\D-Tools\daemon.exe" -lang 2052> [DAEMON'S HOME]
<WinampAgent><C:\Program Files\Winamp\winampa.exe> [N/A]
<AdaptecDirectCD><C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe> [Roxio]
<ccApp><"C:\Program Files\Common Files\Symantec Shared\ccApp.exe"> [(Verified)Symantec Corporation]
<URLLSTCK.exe><C:\Program Files\Norton Internet Security\UrlLstCk.exe> [(Verified)Symantec Corporation]
<Symantec NetDriver Monitor><C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer> [(Verified)Symantec Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<C:\WINDOWS\system32\patch07.dll><regsvr32 /s C:\WINDOWS\system32\patch07.dll> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{288BD9BD-F0DC-46B1-81B5-2B61DF8077CE}><C:\WINDOWS\system32\g0ld.dll> [N/A]
<{9DE65ACD-2184-4BA2-99AC-F04B1EE03C37}><C:\WINDOWS\system32\Directxms2.dll> [N/A]

==================================
启动文件夹
[Microsoft Office]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Microsoft Office.lnk --> C:\PROGRA~1\MICROS~2\Office10\OSA.EXE [Microsoft Corporation]><N>
[Adobe Reader Speed Launch]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Reader Speed Launch.lnk --> C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE [Adobe Systems Incorporated]><N>

==================================
服务
[Symantec Event Manager / ccEvtMgr]
<"C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"><Symantec Corporation>
[Symantec Network Proxy / ccProxy]
<"C:\Program Files\Common Files\Symantec Shared\ccProxy.exe"><Symantec Corporation>
[Symantec Password Validation / ccPwdSvc]
<"C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe"><Symantec Corporation>
[Symantec Settings Manager / ccSetMgr]
<"C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"><Symantec Corporation>
[Human Interface Device Access / HidServ]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[LiveUpdate / LiveUpdate]
<"C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~2.EXE"><Symantec Corporation>
[Norton AntiVirus Auto Protect Service / navapsvc]
<"C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe"><Symantec Corporation>
[Network Logon / NetWorkLogon]
<rundll32.exe KB8964225.log,start><Microsoft Corporation>
[SAVScan / SAVScan]
<"C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe"><Symantec Corporation>
[ScriptBlocking Service / SBService]
<C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe><Symantec Corporation>
[Symantec Network Drivers Service / SNDSrvc]
<"C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe"><Symantec Corporation>

==================================
驱动程序
[Cdr4_xp / Cdr4_xp]
<C:\WINDOWS\SYSTEM32\DRIVERS\Cdr4_xp.SYS><Roxio>
[Cdralw2k / Cdralw2k]
<C:\WINDOWS\SYSTEM32\DRIVERS\Cdralw2k.SYS><Roxio>
[cdudf_xp / cdudf_xp]
<C:\WINDOWS\SYSTEM32\DRIVERS\cdudf_xp.SYS><Roxio>
[d347bus / d347bus]
<\SystemRoot\system32\DRIVERS\d347bus.sys><>
[d347prt / d347prt]
<\SystemRoot\System32\Drivers\d347prt.sys><>
[dvd_2K / dvd_2K]
<C:\WINDOWS\SYSTEM32\DRIVERS\dvd_2K.SYS><Roxio>
[Creative AudioPCI (ES1371,ES1373) (WDM) / es1371]
<system32\drivers\es1371mp.sys><Creative Technology Ltd.>
[fastlv7 / fastlv76]
<\SystemRoot\System32\DRIVERS\fastlv76.sys><Microsoft Corporation>
[mmc_2K / mmc_2K]
<C:\WINDOWS\SYSTEM32\DRIVERS\mmc_2K.SYS><Roxio>
[Myson MTD80X Based Fast Ethernet Card / MTD80X]
<System32\DRIVERS\MTD80X.SYS><Myson Technology Inc>
[NAVENG / NAVENG]
<\??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20061108.024\NAVENG.Sys><Symantec Corporation>
[NAVEX15 / NAVEX15]
<\??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20061108.024\NavEx15.Sys><Symantec Corporation>
[nv / nv]
<System32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[pwd_2k / pwd_2k]
<C:\WINDOWS\SYSTEM32\DRIVERS\pwd_2k.SYS><Roxio>
[PxHelp20 / PxHelp20]
<\SystemRoot\system32\DRIVERS\PxHelp20.sys><Sonic Solutions>
[qlthvn5 / qlthvn51]
<\SystemRoot\System32\DRIVERS\qlthvn51.sys><Microsoft Corporation>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139]
<System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[SAVRT / SAVRT]
<\??\C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVRT.SYS><Symantec Corporation>
[SAVRTPEL / SAVRTPEL]
<\??\C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVRTPEL.SYS><Symantec Corporation>
[Secdrv / Secdrv]
<System32\DRIVERS\secdrv.sys><N/A>
[SYMDNS / SYMDNS]
<\SystemRoot\System32\Drivers\SYMDNS.SYS><Symantec Corporation>
[SymEvent / SymEvent]
<\??\C:\Program Files\Symantec\SYMEVENT.SYS><Symantec Corporation>
[SYMFW / SYMFW]
<\SystemRoot\System32\Drivers\SYMFW.SYS><Symantec Corporation>
[SYMIDS / SYMIDS]
<\SystemRoot\System32\Drivers\SYMIDS.SYS><Symantec Corporation>
[SYMIDSCO / SYMIDSCO]
<\??\C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\idsdefs\20061025.029\symidsco.sys><Symantec Corporation>
[SYMNDIS / SYMNDIS]
<\SystemRoot\System32\Drivers\SYMNDIS.SYS><Symantec Corporation>
[SYMREDRV / SYMREDRV]
<\SystemRoot\System32\Drivers\SYMREDRV.SYS><Symantec Corporation>
[SYMTDI / SYMTDI]
<\SystemRoot\System32\Drivers\SYMTDI.SYS><Symantec Corporation>
[UdfReadr_xp / UdfReadr_xp]
<C:\WINDOWS\SYSTEM32\DRIVERS\UdfReadr_xp.SYS><Roxio>
[VIA AGP Filter / viaagp1]
<\SystemRoot\System32\DRIVERS\viaagp1.sys><VIA Technologies, Inc.>

cyp0126 - 2006-11-11 18:15:00

==================================
浏览器加载项
[Windows Genuine Advantage Validation Tool]
{17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft Corporation>
[SSReaderPlug Control]
{3359C0B1-2363-40B3-AFCA-1ABC799AC486} <C:\WINDOWS\system32\SSREAD~1.OCX, CX>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[Web Browser Applet Control]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\WINDOWS\System32\msjava.dll, Microsoft Corporation>
[Windows Genuine Advantage Validation Tool]
{17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft Corporation>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[HtmlDlgSafeHelper Class]
{3050F819-98B5-11CF-BB82-00AA00BDCE0B} <C:\WINDOWS\system32\mshtmled.dll, Microsoft Corporation>
[SSReaderPlug Control]
{3359C0B1-2363-40B3-AFCA-1ABC799AC486} <C:\WINDOWS\system32\SSREAD~1.OCX, CX>
[IETag Factory]
{38481807-CA0E-42D2-BF39-B33AF135CC4D} <C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\IETAG.DLL, Microsoft Corporation>
[HHCtrl Object]
{41B23C28-488E-4E5C-ACE2-BB0BBABE99E8} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[RealPlayer Stream Handler]
{A1A41E11-91DB-4461-95CD-0C02327FD934} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
{CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
{CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>

瑞星卡卡安全论坛