求助连网5分钟后，主机向外发送大量数据包，无接收数据，已停用RPCS服务 bbs.ikaka.com

hh089 - 2006-12-7 11:10:00

2006-12-06,18:39:25

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><; C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
<CashFiesta><; H:\网络赚钱文件\Cashfiesta.exe> [N/A]
<MSMSGS><; "C:\Program Files\Messenger\msmsgs.exe" /background> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<KAVPersonal50><"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize> [Kaspersky Lab]
<迅雷4><; E:\Program Files\Thunder Network\Thunder\MediaIssue\TDUpdate.exe> [N/A]
<runeip><E:\Program Files\Rising\AntiSpyware\runiep.exe> [Beijing Rising Technology Co., Ltd.]
<Acronis Scheduler2 Service><; "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"> [Acronis]
<ATIPTA><; C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe> [ATI Technologies, Inc.]
<BigDogPath><; C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera 301x> [N/A]
<IAAnotif><; C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe> [Intel]
<IMJPMIG8.1><; "C:\windows\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation]
<NeroCheck><; C:\windows\system32\NeroCheck.exe> [Ahead Software Gmbh]
<NeroFilterCheck><; C:\WINDOWS\system32\NeroCheck.exe> [Ahead Software Gmbh]
<NexusServer><; "C:\Program Files\Common Files\Canopus Shared\ProCoder 2\Kernel\PNXSERVR.exe" -SelfLaunch> [N/A]
<NWEReboot><; > [N/A]
<PHIME2002A><; C:\windows\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Corporation]
<PHIME2002ASync><; C:\windows\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation]
<PPHIDPAD><; C:\WINPENJR\Win32\pphidpad.exe> [N/A]
<PSDrvCheck><; "e:\program files\pinnacle\edition 5\program\PSDrvCheck.exe" -CheckReg> [N/A]
<QuickTime Task><; "C:\Program Files\QuickTime\qttask.exe" -atboottime> [Apple Computer, Inc.]
<RfwMain><; "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
<snpstd3><; C:\WINDOWS\vsnpstd3.exe> [Sonix]
<SoundMAX><; "C:\Program Files\Analog Devices\SoundMAX\SMax4.exe" /tray> [N/A]
<SoundMAXPnP><; C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe> [N/A]
<TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<Ulead Photo Express 5 Calendar Checker><; E:\Program Files\Ulead Systems\Ulead Photo Express 5\calcheck.exe> [N/A]
<WatchDog><; e:\Program Files\mobile PhoneTools\WatchDog.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<KKDelay><E:\Program Files\Rising\AntiSpyware\RunOnce.exe> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\windows\system32\userinit.exe,> [(Verified)Microsoft Corporation]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]

==================================
启动文件夹
N/A

hh089 - 2006-12-7 11:11:00

服务
[Acronis Scheduler2 Service / AcrSch2Svc]
<"C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe"><Acronis>
[ASP.NET State Service / aspnet_state]
<C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe><Microsoft Corporation>
[Ati HotKey Poller / Ati HotKey Poller]
<C:\WINDOWS\system32\Ati2evxx.exe><N/A>
[ATI Smart / ATI Smart]
<C:\WINDOWS\system32\ati2sgag.exe><>
[BlueSoleil Hid Service / BlueSoleil Hid Service]
<e:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe><N/A>
[Bluetooth Service / btwdins]
<C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe><WIDCOMM, Inc.>
[Crypkey License / Crypkey License]
<crypserv.exe><Kenonic Controls Ltd.>
[Human Interface Device Access / HidServ]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[IAA Event Monitor / IAANTMon]
<C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe><Intel>
[iPodService / iPodService]
<E:\Program Files\iPod\bin\iPodService.exe><N/A>
[Spectrum24 Events Monitor / IPRIP]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\acss.dll><N/A>
[kavsvc / kavsvc]
<"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe"><Kaspersky Lab>
[LightScribeService Direct Disc Labeling Service / LightScribeService]
<"C:\Program Files\Common Files\LightScribe\LSSrvc.exe"><Hewlett-Packard Company>
[Macromedia Licensing Service / Macromedia Licensing Service]
<"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><N/A>
[Medie Sariel Number Service / Medie Sariel Number Service]
<C:\WINDOWS\system32\moviemk.exe><N/A>
[Medie Sariel Number Services / Medie Sariel Number Services]
<C:\WINDOWS\system32\notaped.exe><N/A>
[Rising Proxy Service / RfwProxySrv]
<c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService]
<c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Remote Procedure Call System(RPCS) / RpcS]
<C:\WINDOWS\system32\RpcS.exe><Microsoft Corporation>
[Ulead Burning Helper / UleadBurningHelper]
<C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe><Ulead Systems, Inc.>

==================================
驱动程序
[USB 2.0 (FS) ADFU Device / AdfuUd]
<System32\Drivers\AdfuUd.sys><>
[aeaudio / aeaudio]
<system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
[Service for WDM 3D Audio Driver / ALCXSENS]
<system32\drivers\ALCXSENS.SYS><N/A>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM]
<system32\drivers\ALCXWDM.SYS><N/A>
[ASAPIW2k / ASAPIW2k]
<system32\drivers\ASAPIW2k.sys><VOB Computersysteme GmbH>
[Aspi32 / Aspi32]
<C:\WINDOWS\SYSTEM32\DRIVERS\Aspi32.SYS><Adaptec>
[ati2mtag / ati2mtag]
<system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[BaseTDI / BaseTDI]
<\??\C:\WINDOWS\system32\drivers\basetdi.sys><Rising>
[Bluetooth Audio Service / BlueletAudio]
<system32\DRIVERS\blueletaudio.sys><IVT Corporation>
[Bluetooth PAN Network Adapter / BT]
<system32\DRIVERS\btnetdrv.sys><IVT Corporation>
[Bluetooth USB For Bluetooth Service / Btcsrusb]
<System32\Drivers\btcusb.sys><IVT Corporation>
[Bluetooth HID Enumerator / BTHidEnum]
<system32\DRIVERS\vbtenum.sys><N/A>
[Bluetooth HID Manager Service / BTHidMgr]
<\SystemRoot\System32\Drivers\BTHidMgr.sys><IVT Corporation>
[Bluetooth Protocol Stack / BTKRNL]
<\SystemRoot\system32\drivers\btkrnl.sys><WIDCOMM, Inc.>
[Bluetooth Network Filter / BTNetFilter]
<\??\C:\WINDOWS\system32\drivers\BTNetFilter.sys><N/A>
[Bluetooth Serial Driver / BTSERIAL]
<\??\C:\WINDOWS\system32\drivers\btserial.sys><N/A>
[Bluetooth Port Client Driver / BTSLBCSP]
<\??\C:\WINDOWS\system32\drivers\btslbcsp.sys><WIDCOMM, Inc.>
[EIO / EIO]
<\??\C:\windows\system32\drivers\EIO.sys><ASUSTeK Computer Inc.>
[geolzlzq / geolzlzq]
<\SystemRoot\system32\drivers\geolzlzq.sys><N/A>
[hardlock / hardlock]
<\??\C:\windows\system32\drivers\hardlock.sys><Aladdin Knowledge Systems>
[Haspnt / Haspnt]
<\??\C:\windows\system32\drivers\Haspnt.sys><Aladdin Knowledge Systems>
[FAST HLP Driver / hlp]
<\SystemRoot\System32\Drivers\Hlp.Sys><N/A>
[HookUrl / HookUrl]
<\??\C:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[HpaFilt / HpaFilt]
<C:\WINDOWS\SYSTEM32\DRIVERS\HpaFilt.SYS><Litsoft Co. LTD.>
[HpaLower / HpaLower]
<C:\WINDOWS\SYSTEM32\DRIVERS\HpaLower.SYS><N/A>
[Intel Integrated RAID / iastor]
<\SystemRoot\system32\DRIVERS\iaStor.sys><Intel Corporation>
[Sony Ericsson K510 Driver driver (WDM) / k510bus]
<system32\DRIVERS\k510bus.sys><MCCI>
[Sony Ericsson K510 USB WMC Modem Filter / k510mdfl]
<system32\DRIVERS\k510mdfl.sys><MCCI>
[Sony Ericsson K510 USB WMC Modem Driver / k510mdm]
<system32\DRIVERS\k510mdm.sys><MCCI>
[Sony Ericsson K510 USB WMC Device Management Drivers (WDM) / k510mgmt]
<system32\DRIVERS\k510mgmt.sys><MCCI>
[Sony Ericsson K510 USB WMC OBEX Interface / k510obex]
<system32\DRIVERS\k510obex.sys><MCCI>
[Kl1 / Kl1]
<\SystemRoot\System32\drivers\kl1.sys><Kaspersky Lab>
[Klif / Klif]
<System32\drivers\klif.sys><Kaspersky Labs>
[Klmc / Klmc]
<System32\drivers\klmc.sys><Kaspersky Lab>
[MidiSyn / MidiSyn]
<system32\drivers\MidiSyn.sys><N/A>
[mProcRs / mProcRs]
<\??\c:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[Media Technology Kernel Driver / MTK]
<System32\Drivers\mtk.sys><N/A>
[iriver Internet Audio Player N10 / N10]
<\SystemRoot\system32\drivers\N10.sys><N/A>
[NetworkX / NetworkX]
<\SystemRoot\system32\ckldrv.sys><N/A>
[npkcrypt / npkcrypt]
<\??\E:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[npkycryp / npkycryp]
<\??\E:\Program Files\Tencent\QQ\npkycryp.sys><N/A>
[pciidey / pciidey]
<C:\WINDOWS\SYSTEM32\DRIVERS\pciidey.SYS><Windows (R) 2000 DDK provider>
[Direct Parallel Link Driver / Ptilink]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[PxHelp20 / PxHelp20]
<\SystemRoot\system32\Drivers\PxHelp20.sys><Sonic Solutions>
[RsAntiSpyware / RsAntiSpyware]
<\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[RsFwDrv / RsFwDrv]
<\??\C:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[Secdrv / Secdrv]
<system32\DRIVERS\secdrv.sys><N/A>
[smwdm / smwdm]
<system32\drivers\smwdm.sys><Analog Devices, Inc.>
[Acronis Snapshots Manager / snapman]
<\SystemRoot\system32\DRIVERS\snapman.sys><Acronis>
[USB PC Camera (SNPSTD3) / SNPSTD3]
<system32\DRIVERS\snpstd3.sys><>
[Sony Digital Imaging Base / sonyhcb]
<\SystemRoot\system32\DRIVERS\sonyhcb.sys><Sony Corporation>
[Sony Digital Imaging Video / sonyhcs]
<system32\DRIVERS\sonyhcs.sys><Sony Corporation>
[Sony USB Filter Driver (SONYPVU1) / SONYPVU1]
<system32\DRIVERS\SONYPVU1.SYS><Sony Corporation>
[Player Recovery Device Control Driver / StMp3Rec]
<System32\Drivers\StMp3Rec.sys><Generic>
[SVKP / SVKP]
<\??\C:\WINDOWS\system32\SVKP.sys><AntiCracking>
[Acronis TrueImage FS Filter / tifsfilter]
<system32\DRIVERS\tifsfilt.sys><Acronis>
[Acronis TrueImage Backup Archive Explorer / timounter]
<\SystemRoot\system32\DRIVERS\timntr.sys><Acronis>
[TVICHW32 / TVICHW32]
<\??\C:\WINDOWS\system32\DRIVERS\TVICHW32.SYS><EnTech Taiwan>
[Virtual Serial port driver / VComm]
<system32\DRIVERS\VComm.sys><IVT Corporation>
[Bluetooth VComm Manager Service / VcommMgr]
<System32\Drivers\VcommMgr.sys><IVT Corporation>
[Virtual PC Application Services / VPCAppSv]
<system32\DRIVERS\VPCAppSv.sys><Connectix Corporation>
[WIBU-KEY Kernel Driver / WIBUKEY]
<SYSTEM32\DRIVERS\Wibukey.sys><WIBU-SYSTEMS AG>
[World Standard Teletext Codec / WSTCODEC]
<system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[NDIS5.1 Miniport Driver for Marvell Yukon Gigabit Ethernet Adapter / yukonwxp]
<system32\DRIVERS\yukonwxp.sys><Marvell Semiconductor Inc.>
[VIMICRO USB PC Camera 301x / ZSMC301b]
<System32\Drivers\usbVM31b.sys><VM>

hh089 - 2006-12-7 11:11:00

浏览器加载项
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <e:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <e:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Windows Genuine Advantage Validation Tool]
{17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft Corporation>
[CEditCtrl Object]
{488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\system32\aliedit\AliEdit.dll, www.alipay.com>
[PowerPlayer Control]
{5EC7C511-CD0F-42E6-830C-1BD9882F3458} <C:\DOCUME~1\ADMINI~1\APPLIC~1\ppStream\100~1.139\POWERP~1.DLL, PPStream Inc.>
[Autodesk MapGuide ActiveX Control]
{62789780-B744-11D0-986B-00609731A21D} <C:\windows\Downloaded Program Files\MgAxCtrl.dll, Autodesk Inc.>
[AxInputControl Class]
{73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\windows\DOWNLO~1\INPUTC~1.DLL, >
[DownFile Control]
{7C79D86B-F38D-459F-9774-28763A968146} <C:\WINDOWS\DOWNLO~1\DOWNFI~1.OCX, >
[BoBo_V2 Control]
{A8C3B40D-5384-44AD-ACC4-504B4D8A85F5} <C:\windows\DOWNLO~1\ACTIVE~1.OCX, 17BoBo.com>
[w1 Control]
{B291C839-43EA-44E5-A157-1DAA6DAFE115} <C:\WINDOWS\DOWNLO~1\w1proj1.ocx, N/A>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[ActiveMovieControl Object]
{05589FA1-C356-11CE-BF01-00AA0055595A} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <e:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AxInputControl Class]
{73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\windows\DOWNLO~1\INPUTC~1.DLL, >
[AxSubmitControl Class]
{8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} <C:\windows\DOWNLO~1\SUBMIT~1.DLL, >
[BoBo_V2 Control]
{A8C3B40D-5384-44AD-ACC4-504B4D8A85F5} <C:\windows\DOWNLO~1\ACTIVE~1.OCX, 17BoBo.com>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>

==================================
正在运行的进程
[PID: 684][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 744][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 768][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\Ati2evxx.dll] [N/A, N/A]
[PID: 812][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 824][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 972][C:\WINDOWS\system32\Ati2evxx.exe] [N/A, N/A]
[PID: 1000][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1056][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1096][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1200][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1272][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1320][c:\program files\rising\rfw\rfwsrv.exe] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 33]
[c:\program files\rising\rfw\RfwRule.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 13]
[c:\program files\rising\rfw\rfwlog.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 6]
[c:\program files\rising\rfw\Rfwdrv.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 21]
[c:\program files\rising\rfw\MonDrv.dll] [rs, 1, 0, 0, 4]
[c:\program files\rising\rfw\ProcLib.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 9]
[PID: 1484][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\WINDOWS\system32\bthcrp.dll] [WIDCOMM, Inc., 1.4.2 Build 10]
[C:\WINDOWS\system32\WidcommSdk.dll] [WIDCOMM, Inc., 1.4.2 Build 10]
[C:\WINDOWS\system32\wbtapi.dll] [WIDCOMM, Inc., 1.4.2 Build 10]
[C:\WINDOWS\system32\CNMLM1Z.DLL] [CANON INC., 1.50.2.6]
[C:\WINDOWS\system32\CNMLM3y.DLL] [CANON INC., 1.52.2.0]
[C:\WINDOWS\system32\EBPMON24.DLL] [SEIKO EPSON CORPORATION, 1, 10, 0, 0]
[C:\WINDOWS\system32\hpzll3xu.dll] [Hewlett-Packard Company, 60.051.641.00]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\CNMPD1Z.DLL] [CANON INC., 1.50.2.6]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\CNMPD3y.DLL] [CANON INC., 1.52.2.0]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\hpzpp3xu.dll] [Hewlett-Packard Corporation, 60.051.641.00]
[PID: 1644][C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe] [Acronis, 1,0,0,54]
[PID: 1684][e:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe] [N/A, N/A]
[PID: 1700][C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe] [WIDCOMM, Inc., 1.4.2 Build 10]
[PID: 1716][C:\WINDOWS\system32\crypserv.exe] [Kenonic Controls Ltd., 5.4.0]
[PID: 1772][C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe] [Intel, 1, 0, 0, 2568]
[PID: 1820][C:\Program Files\Common Files\LightScribe\LSSrvc.exe] [Hewlett-Packard Company, 1.4.39.1]
[PID: 1900][C:\WINDOWS\system32\RpcS.exe] [Microsoft Corporation, 5.2.3790.1830]
[PID: 1928][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1916][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[e:\Program Files\Tencent\QQ\QQIEHelper.dll] [深圳市腾讯计算机系统有限公司, 1, 1, 0, 5]
[C:\WINDOWS\system32\RpcS.dll] [N/A, N/A]
[PID: 1952][C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe] [Ulead Systems, Inc., 1, 0, 0, 3]
[PID: 1988][C:\WINDOWS\system32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: DNSRV(bld4act)]
[PID: 588][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2376][C:\WINDOWS\system32\Ati2evxx.exe] [N/A, N/A]
[E:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 3]
[PID: 2464][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[E:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 3]
[C:\Program Files\WinRAR\rarext.dll] [N/A, N/A]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\shellex.dll] [Kaspersky Lab, 5.0.388.1]
[C:\WINDOWS\system32\OLDWB.IME] [, 1, 7, 0, 0]
[C:\WINDOWS\system32\Ime\OldWB\OldWB.dll] [^_^, 4.00.950]
[C:\WINDOWS\system32\btncopy.dll] [WIDCOMM, Inc., 3.0.0 Build 4]
[C:\Program Files\Common Files\Ahead\Lib\AdvrCntr.dll] [Ahead Software AG, 1,2,10, 2305]
[C:\WINDOWS\system32\icm32.dll] [Microsoft Corporation, 5.1.2600.2709 (xpsp_sp2_gdr.050628-1518)]
[PID: 2624][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[E:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 3]
[PID: 452][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[E:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 3]
[PID: 248][N:\软件下载\sreng2\SREng\SREng.exe] [Smallfrogs Studio, 2.2.6.605]
[E:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 3]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[F:\]
[autorun]
open=install.exe
[G:\]
[autorun]
open=install.exe
[H:\]
[autorun]
open=install.exe
[I:\]
[autorun]
open=install.exe
[J:\]
[autorun]
open=install.exe

==================================
HOSTS 文件
N/A

==================================

瑞星卡卡安全论坛