求助：中了病毒，卡巴提示：Backdoor.Win32.Agent.air,需重启 bbs.ikaka.com

laotai - 2007-2-10 10:54:00

怎么办，我下了一个sreng2，我把扫描报告贴出来吧

laotai - 2007-2-10 10:59:00

注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
<bl1k57rcgi2w88><C:\WINDOWS\iexp1ore.exe> [N/A]
<vri41k1><C:\WINDOWS\rundl132.exe> [N/A]
<4z6khdr1><C:\WINDOWS\crasos.exe> [N/A]
<0fh0lzgw8><; C:\WINDOWS\iexp1ore.exe> [N/A]
<BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}><; "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"> [Nero AG]
<il5mlqkq4uv1t><; C:\WINDOWS\crasos.exe> [N/A]
<MsnMsgr><; "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background> [(Verified)Microsoft Corporation]
<qhb3ekhjkrs><; C:\WINDOWS\rundl132.exe> [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Corporation]
<SoundMAXPnP><C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe> [Analog Devices, Inc.]
<SoundMAX><"C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray> [Analog Devices, Inc.]
<PTHOSTTR><C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start> [Hewlett-Packard Development Company, L.P.]
<AGRSMMSG><AGRSMMSG.exe> [(Verified)Agere Systems]
<SynTPLpr><C:\Program Files\Synaptics\SynTP\SynTPLpr.exe> [(Verified)Synaptics, Inc.]
<SynTPEnh><C:\Program Files\Synaptics\SynTP\SynTPEnh.exe> [(Verified)Synaptics, Inc.]
<igfxtray><C:\WINDOWS\system32\igfxtray.exe> [(Verified)Intel Corporation]
<igfxhkcmd><C:\WINDOWS\system32\hkcmd.exe> [(Verified)Intel Corporation]
<Cpqset><C:\Program Files\HPQ\Default Settings\cpqset.exe> [N/A]
<UpdateManager><"C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r> [Sonic Solutions]
<hpWirelessAssistant><C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe> [Hewlett-Packard Company]
<IntelWireless><C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless> [Intel Corporation]
<eabconfg.cpl><C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start> [Hewlett-Packard ]
<kis><"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"> [Kaspersky Lab]
<runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe> [Beijing Rising Technology Co., Ltd.]
<AddrPlus3><; C:\PROGRA~1\TENCENT\AdPlus\Runner.exe C:\PROGRA~1\TENCENT\AdPlus\QAHook.dll Rundll32> [N/A]
<CognizanceTS><; rundll32.exe C:\PROGRA~1\HPQ\IAM\Bin\AsTsVcc.dll,RegisterModule> [Cognizance Corporation]
<DAEMON Tools><; "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033> [(Verified)DT Soft Ltd.]
<dla><; C:\WINDOWS\system32\dla\tfswctrl.exe> [Sonic Solutions]
<HF_GameClient><; C:\Program Files\浩方对战平台\gameclient.exe> [上海浩方在线信息技术有限公司]
<igfxpers><; C:\WINDOWS\system32\igfxpers.exe> [(Verified)Intel Corporation]
<IMSCMig><; C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload> [(Verified)Microsoft Corporation]
<ISUSPM Startup><; C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup> [InstallShield Software Corporation]
<ISUSScheduler><; "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start> [InstallShield Software Corporation]
<NeroFilterCheck><; C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe> [Nero AG]
<StormCodec_Helper><; "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti> [N/A]
<stup.exe><; C:\PROGRA~1\TENCENT\Adplus\stup.exe> [N/A]
<SunJavaUpdateSched><; C:\Program Files\Java\jre1.5.0\bin\jusched.exe> [Sun Microsystems, Inc.]
<WatchDog><; C:\Program Files\InterVideo\DVD Check\DVDCheck.exe> [InterVideo Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<KKDelay><C:\Program Files\Rising\AntiSpyware\RunOnce.exe> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll> [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{2D49692C-A5FD-4E29-A3CD-37E9B182FCC6}><C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
<WinlogonNotify: igfxcui><igfxdev.dll> [(Verified)Intel Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\IntelWireless]
<WinlogonNotify: IntelWireless><C:\Program Files\Intel\Wireless\Bin\LgNotify.dll> [Intel Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
<WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll> [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\OneCard]
<WinlogonNotify: OneCard><C:\Program Files\HPQ\IAM\Bin\AsWlnPkg.dll> [Cognizance Corporation]

laotai - 2007-2-10 10:59:00

==================================
启动文件夹
N/A

==================================
服务
[Adobe LM Service / Adobe LM Service][Stopped/Manual Start]
<"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>
[Local Communication Channel / ASChannel][Running/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k Cognizance-->C:\Program Files\HPQ\IAM\Bin\ASChnl.dll><Cognizance Corporation>
[ASP.NET State Service / aspnet_state][Stopped/Manual Start]
<C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe><Microsoft Corporation>
[卡巴斯基互联网安全套装 6.0 / AVP][Running/Auto Start]
<"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r><Kaspersky Lab>
[Bluetooth Service / btwdins][Running/Auto Start]
<C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe><Broadcom Corporation.>
[DB2 JDBC Applet Server - Control Center / DB2ControlCenterServer][Stopped/Manual Start]
<"C:\Program Files\SQLLIB\bin\db2ccs.exe"><N/A>
[DB2 JDBC Applet Server / DB2JDS][Running/Auto Start]
<"C:\Program Files\SQLLIB\bin\db2jds.exe"><N/A>
[DB2 Security Server / DB2NTSECSERVER][Running/Auto Start]
<"C:\Program Files\SQLLIB\bin\db2sec.exe"><International Business Machines Corporation>
[EvtEng / EvtEng][Running/Auto Start]
<C:\Program Files\Intel\Wireless\Bin\EvtEng.exe><Intel Corporation>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[HP WMI Interface / hpqwmi][Running/Manual Start]
<C:\Program Files\HPQ\Shared\hpqwmi.exe><Hewlett-Packard Development Company, L.P.>
[hpqwmiex / hpqwmiex][Running/Auto Start]
<C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe><Hewlett-Packard Development Company, L.P.>
[NBService / NBService][Stopped/Manual Start]
<C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe><Nero AG>
[RegSrvc / RegSrvc][Running/Auto Start]
<C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe><Intel Corporation>
[Spectrum24 Event Monitor / S24EventMonitor][Running/Auto Start]
<C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe><Intel Corporation>
[SoundMAX Agent Service / SoundMAX Agent Service (default)][Running/Auto Start]
<C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.>
[Windows Media Connect (WMC) / WmcCds][Stopped/Manual Start]
<c:\program files\windows media connect\mswmccds.exe><Microsoft Corporation>
[Windows Media Connect (WMC) 帮助程序 / WmcCdsLs][Stopped/Manual Start]
<C:\Program Files\Windows Media Connect\mswmcls.exe><Microsoft Corporation>

laotai - 2007-2-10 11:00:00

==================================
驱动程序
[aeaudio / aeaudio][Running/Manual Start]
<system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
[AEGIS Protocol (IEEE 802.1x) v3.1.6.0 / AegisP][Running/Auto Start]
<system32\DRIVERS\AegisP.sys><Meetinghouse Data Communications>
[Agere Systems Soft Modem / AgereSoftModem][Running/Manual Start]
<system32\DRIVERS\AGRSM.sys><Agere Systems>
[Broadcom NetXtreme Gigabit Ethernet / b57w2k][Running/Manual Start]
<system32\DRIVERS\b57xp32.sys><Broadcom Corporation>
[蓝牙总线枚举器 / BTKRNL][Running/Manual Start]
<system32\DRIVERS\btkrnl.sys><Broadcom Corporation.>
[ClntMgmt.sys / ClntMgmt.sys][Running/System Start]
<\SystemRoot\System32\Drivers\ClntMgmt.sys><Hewlett-Packard>
[CMBProtector / CMBProtector][Running/Auto Start]
<\??\C:\WINDOWS\system32\Drivers\CMBProtector.dat><N/A>
[drvmcdb / drvmcdb][Running/Boot Start]
<\SystemRoot\system32\drivers\drvmcdb.sys><Sonic Solutions>
[drvnddm / drvnddm][Running/Auto Start]
<system32\drivers\drvnddm.sys><Sonic Solutions>
[dtscsi / dtscsi][Running/Manual Start]
<\SystemRoot\System32\Drivers\dtscsi.sys><N/A>
[eabfiltr / eabfiltr][Running/System Start]
<\??\C:\WINDOWS\system32\drivers\EABFiltr.sys><Hewlett-Packard Development Company, L.P.>
[eabusb / eabusb][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\eabusb.sys><Hewlett-Packard Development Company, L.P.>
[GTIPCI21 / GTIPCI21][Running/Manual Start]
<system32\DRIVERS\gtipci21.sys><Texas Instruments>
[ialm / ialm][Running/Manual Start]
<system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[Intel Wireless Connection Agent Miniport for Win XP / IWCA][Running/Manual Start]
<system32\DRIVERS\iwca.sys><Intel Corporation>
[kl1 / kl1][Running/Boot Start]
<\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif][Running/System Start]
<\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\C:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[PxHelp20 / PxHelp20][Running/Boot Start]
<\SystemRoot\System32\Drivers\PxHelp20.sys><Sonic Solutions>
[RsAntiSpyware / RsAntiSpyware][Running/Disabled]
<\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[WLAN Transport / s24trans][Running/Auto Start]
<system32\DRIVERS\s24trans.sys><Intel Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[SMSC IrCC Miniport Device Driver / SMCIRDA][Running/Manual Start]
<system32\DRIVERS\smcirda.sys><SMSC>
[smwdm / smwdm][Running/Manual Start]
<system32\drivers\smwdm.sys><Analog Devices, Inc.>
[sptd / sptd][Running/Boot Start]
<\SystemRoot\System32\Drivers\sptd.sys><N/A>
[sscdbhk5 / sscdbhk5][Running/System Start]
<system32\drivers\sscdbhk5.sys><Sonic Solutions>
[ssrtln / ssrtln][Running/System Start]
<system32\drivers\ssrtln.sys><Sonic Solutions>
[Synaptics TouchPad Driver / SynTP][Running/Manual Start]
<system32\DRIVERS\SynTP.sys><Synaptics, Inc.>
[TCP/IP Protocol Driver / Tcpip][Running/System Start]
<system32\DRIVERS\tcpip.sys><Microsoft Corporation>
[tfsnboio / tfsnboio][Running/Auto Start]
<system32\dla\tfsnboio.sys><Sonic Solutions>
[tfsncofs / tfsncofs][Running/Auto Start]
<system32\dla\tfsncofs.sys><Sonic Solutions>
[tfsndrct / tfsndrct][Running/Auto Start]
<system32\dla\tfsndrct.sys><Sonic Solutions>
[tfsndres / tfsndres][Running/Auto Start]
<system32\dla\tfsndres.sys><Sonic Solutions>
[tfsnifs / tfsnifs][Running/Auto Start]
<system32\dla\tfsnifs.sys><Sonic Solutions>
[tfsnopio / tfsnopio][Running/Auto Start]
<system32\dla\tfsnopio.sys><Sonic Solutions>
[tfsnpool / tfsnpool][Running/Auto Start]
<system32\dla\tfsnpool.sys><Sonic Solutions>
[tfsnudf / tfsnudf][Running/Auto Start]
<system32\dla\tfsnudf.sys><Sonic Solutions>
[tfsnudfa / tfsnudfa][Running/Auto Start]
<system32\dla\tfsnudfa.sys><Sonic Solutions>
[tifm21 / tifm21][Running/Manual Start]
<system32\drivers\tifm21.sys><Texas Instruments>
[VCD VNC Virtual Network Adapter / vcddev][Running/Manual Start]
<system32\DRIVERS\vcdvnic.sys><VNN B.J.>
[用于 Windows XP 的英特尔(R) PRO/无线 2200BG 网络连接驱动程序 / w29n51][Running/Manual Start]
<system32\DRIVERS\w29n51.sys><Intel? Corporation>

姑苏残月 - 2007-2-10 11:00:00

你的病毒已经被杀软干掉了.建议清理下系统垃圾

laotai - 2007-2-10 11:00:00

==================================
浏览器加载项
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx, >
[DriveLetterAccess]
{5CA3D70E-1895-11CF-8E15-001234567890} <C:\WINDOWS\system32\dla\tfswshx.dll, Sonic Solutions>
[IeCatch2 Class]
{A5366673-E8CA-11D3-9CD9-0090271D075B} <C:\PROGRA~1\FlashGet\jccatch.dll, Amaze Soft>
[HP Credential Manager for ProtectTools]
{DF21F1DB-80C6-11D3-9483-B03D0EC10000} <C:\Program Files\HPQ\IAM\Bin\ItIeAddIN.dll, Infineon Technologies AG>
[Java Plug-in 1.5.0]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll, Sun Microsystems, Inc.>
[浩方对战平台]
{0A155D3C-68E2-4215-A47A-E800A446447A} <C:\Program Files\浩方对战平台\GameClient.exe, 上海浩方在线信息技术有限公司>
[Web反病毒保护]
{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll, Kaspersky Lab>
[信息检索(&R)]
{92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[FlashGet]
{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\PROGRA~1\FlashGet\flashget.exe, Amaze Soft>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FlashGet\fgiebar.dll, Amaze Soft>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[Java Plug-in 1.5.0]
{8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll, Sun Microsystems, Inc.>
[photo_uploader Control]
{A984ED9F-E8DA-44E5-BC18-C14B9ABEF79D} <C:\WINDOWS\DOWNLO~1\PHOTO_~1.OCX, N/A>
[WebActivater Control]
{C661F36D-DF85-4EF4-83C7-E107B83D04B1} <C:\WINDOWS\system32\3DShowVM.ocx, QQ>
[Java Plug-in 1.5.0]
{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll, Sun Microsystems, Inc.>
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx, >
[DriveLetterAccess]
{5CA3D70E-1895-11CF-8E15-001234567890} <C:\WINDOWS\system32\dla\tfswshx.dll, Sonic Solutions>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[IeCatch2 Class]
{A5366673-E8CA-11D3-9CD9-0090271D075B} <C:\PROGRA~1\FlashGet\jccatch.dll, Amaze Soft>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[HP Credential Manager for ProtectTools]
{DF21F1DB-80C6-11D3-9483-B03D0EC10000} <C:\Program Files\HPQ\IAM\Bin\ItIeAddIN.dll, Infineon Technologies AG>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FlashGet\fgiebar.dll, Amaze Soft>
[上传到QQ网络硬盘]
<C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用网际快车下载]
<C:\PROGRA~1\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<C:\PROGRA~1\FlashGet\jc_all.htm, N/A>
[发送到 Bluetooth(&B)]
<C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
<C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

laotai - 2007-2-10 11:03:00

正在运行的进程
[PID: 1184][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1296][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1320][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\klogon.dll] [Kaspersky Lab, 6.0.0.299]
[C:\Program Files\HPQ\IAM\Bin\AsWlnPkg.dll] [Cognizance Corporation, 1.5.0.035]
[C:\Program Files\Intel\Wireless\Bin\LgNotify.dll] [Intel Corporation, 9, 0, 1, 0]
[C:\Program Files\HPQ\IAM\Bin\ASChnl.dll] [Cognizance Corporation, 1.23.0.122]
[C:\Program Files\HPQ\IAM\Bin\ItMsg.dll] [Cognizance Corporation, 1.18.0.265]
[PID: 1368][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1380][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\HPQ\IAM\bin\AsWlnPkg.dll] [Cognizance Corporation, 1.5.0.035]
[PID: 1552][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1640][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1780][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[PID: 1820][C:\Program Files\Intel\Wireless\Bin\EvtEng.exe] [Intel Corporation, 9, 0, 1, 12]
[C:\Program Files\Intel\Wireless\Bin\PsRegApi.dll] [Intel Corporation, 9, 0, 1, 14]
[C:\Program Files\Intel\Wireless\Bin\TraceAPI.DLL] [Intel Corporation, 9, 0, 1, 22]
[PID: 1900][C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe] [Intel Corporation , 9, 0, 1, 41]
[C:\Program Files\Intel\Wireless\Bin\TraceAPI.DLL] [Intel Corporation, 9, 0, 1, 22]
[C:\Program Files\Intel\Wireless\Bin\PsRegApi.dll] [Intel Corporation, 9, 0, 1, 14]
[PID: 1984][C:\WINDOWS\system32\DllHost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\HPQ\IAM\Bin\TrayIcon.dll] [Cognizance Corporation, 1.5.0.082]
[C:\Program Files\HPQ\IAM\Bin\ItMsg.dll] [Cognizance Corporation, 1.18.0.265]
[C:\Program Files\HPQ\IAM\bin\HPBrand.dll] [Hewlett-Packard Company, 1.01.0.020]
[C:\Program Files\HPQ\IAM\Bin\ittal.dll] [Cognizance Corporation, 1.5.0.136]
[C:\Program Files\HPQ\IAM\Bin\ItReports.DLL] [Cognizance Corporation, 1.5.0.033]
[C:\Program Files\HPQ\IAM\Bin\STEngine.dll] [Cognizance Corporation, 1.5.0.025]
[PID: 2024][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 404][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 900][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\bthcrp.dll] [Broadcom Corporation., 4.0.1.2101]
[C:\WINDOWS\system32\WidcommSdk.dll] [Broadcom Corporation., 4.0.1.2101]
[C:\WINDOWS\system32\wbtapi.dll] [Broadcom Corporation., 4.0.1.2101]
[C:\WINDOWS\system32\HPBMMON.DLL] [Hewlett-Packard, 10.00.16]
[C:\WINDOWS\system32\hpdomon.dll] [Hewlett-Packard, 03.42.00]
[C:\WINDOWS\system32\HPBHealr.dll] [N/A, N/A]
[C:\WINDOWS\system32\HPMPMW.DLL] [Hewlett-Packard, 1, 0, 0, 0]
[C:\WINDOWS\system32\HPMystPM.DLL] [Hewlett-Packard, 1, 0, 0, 0]
[C:\WINDOWS\system32\pdfports.dll] [Adobe Systems Incorporated., 5.0.000]
[C:\Program Files\Adobe\Acrobat 5.0\Distillr\ADistRes.CHS] [Adobe Systems Incorporated., 5.0.0.0]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\hpzpp35z.dll] [Hewlett-Packard Corporation, 60.041.41.00]
[PID: 948][C:\WINDOWS\System32\SCardSvr.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1808][C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe] [Intel Corporation, 9, 0, 1, 51]
[C:\Program Files\Intel\Wireless\Bin\PfMgrApi.dll] [Intel Corporation, 9, 0, 1, 45]
[C:\Program Files\Intel\Wireless\Bin\TraceAPI.DLL] [Intel Corporation, 9, 0, 1, 22]
[C:\Program Files\Intel\Wireless\Bin\PsRegApi.dll] [Intel Corporation, 9, 0, 1, 14]
[C:\Program Files\Intel\Wireless\Bin\MurocApi.dll] [Intel Corporation, 9, 0, 1, 56]
[C:\Program Files\Intel\Wireless\Bin\S24MUDLL.dll] [Intel Corporation, 9, 0, 1, 7]
[C:\Program Files\Intel\Wireless\Bin\C1XStngs.dll] [Intel Corporation, 9, 0, 1, 31]
[C:\Program Files\Intel\Wireless\Bin\C8021CHS.dll] [Intel Corporation, 9, 0, 1, 31]
[C:\Program Files\Intel\Wireless\Bin\LSAWRAPI.dll] [Intel Corporation, 9, 0, 1, 1]
[C:\Program Files\Intel\Wireless\Bin\ZcSvcCHS.dll] [Intel Corporation, 9, 0, 1, 51]
[C:\Program Files\Intel\Wireless\Bin\D8021Xps.DLL] [N/A, N/A]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.12.7 04Nov04]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 392][C:\Program Files\HPQ\IAM\bin\asghost.exe] [Cognizance Corporation, 1.5.0.033]
[C:\Program Files\HPQ\IAM\bin\ItMsg.dll] [Cognizance Corporation, 1.18.0.265]
[C:\Program Files\HPQ\IAM\Bin\ItSSO.dll] [Cognizance Corporation, 1.50.3.307]
[C:\Program Files\HPQ\IAM\Bin\RasAdmin.dll] [Cognizance Corporation, 1.5.0.023]
[C:\Program Files\HPQ\IAM\Bin\ItReports.DLL] [Cognizance Corporation, 1.5.0.033]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[C:\Program Files\HPQ\IAM\Bin\PkiAdmin.dll] [Cognizance Corporation, 1.5.0.023]
[C:\Program Files\HPQ\IAM\bin\HPBrand.dll] [Hewlett-Packard Company, 1.01.0.020]
[C:\Program Files\HPQ\IAM\Bin\ITVCClient.dll] [Cognizance Corporation, 1.5.1.109]
[C:\Program Files\HPQ\IAM\Bin\ItVCard.dll] [Cognizance Corporation, 1.01.117]
[C:\Program Files\HPQ\IAM\Bin\TrayIcon.dll] [Cognizance Corporation, 1.5.0.082]
[C:\Program Files\HPQ\IAM\Bin\NetAdmin.dll] [Cognizance Corporation, 1.5.0.105]
[C:\Program Files\HPQ\IAM\Bin\SSOMngr.dll] [Cognizance Corporation, 2.24.0.223]
[C:\Program Files\HPQ\IAM\Bin\ASChnl.dll] [Cognizance Corporation, 1.23.0.122]
[C:\Program Files\HPQ\IAM\Bin\ittal.dll] [Cognizance Corporation, 1.5.0.136]
[C:\Program Files\HPQ\IAM\Bin\STEngine.dll] [Cognizance Corporation, 1.5.0.025]
[C:\Program Files\HPQ\IAM\Bin\ItDAC.dll] [Cognizance Corporation, 1.00.156]
[C:\Program Files\HPQ\IAM\Bin\AuthWiz.dll] [Cognizance Corporation, 1.5.0.242]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]

laotai - 2007-2-10 11:03:00

[PID: 456][C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe] [Intel, 9, 0, 1, 35]
[C:\PROGRA~1\Intel\Wireless\Bin\IntelAE5.dll] [Meetinghouse Data Communications, 3, 0, 0, 44]
[C:\PROGRA~1\Intel\Wireless\Bin\TraceAPI.DLL] [Intel Corporation, 9, 0, 1, 22]
[C:\PROGRA~1\Intel\Wireless\Bin\PsRegApi.dll] [Intel Corporation, 9, 0, 1, 14]
[C:\Program Files\Intel\Wireless\Bin\D8021Xps.DLL] [N/A, N/A]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 1044][C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe] [Analog Devices, Inc., 5, 0, 2, 2]
[C:\Program Files\Analog Devices\SoundMAX\SMWDMIF.dll] [Analog Devices, Inc., 5, 0, 2, 008]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.12.7 04Nov04]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 1060][C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE] [Hewlett-Packard Development Company, L.P., 2, 0, 1, 4]
[C:\Program Files\HPQ\HP BIOS Configuration for ProtectTools\HPBiosSettings.dll] [, 1, 0, 4, 4]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 400][C:\WINDOWS\AGRSMMSG.exe] [Agere Systems, 2.1.51 2.1.51 03/04/2005 12:01:54]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 1068][C:\Program Files\Synaptics\SynTP\SynTPLpr.exe] [Synaptics, Inc., 7.12.7 04Nov04]
[C:\WINDOWS\system32\SynCOM.dll] [Synaptics, Inc., 7.12.7 04Nov04]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.12.7 04Nov04]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 1116][C:\Program Files\Synaptics\SynTP\SynTPEnh.exe] [Synaptics, Inc., 7.12.7 04Nov04]
[C:\WINDOWS\system32\SynCOM.dll] [Synaptics, Inc., 7.12.7 04Nov04]
[C:\WINDOWS\system32\SynTPAPI.dll] [Synaptics, Inc., 7.12.7 04Nov04]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.12.7 04Nov04]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[C:\WINDOWS\system32\LgSyzr.dll] [N/A, N/A]
[PID: 1144][C:\WINDOWS\system32\hkcmd.exe] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\system32\hccutils.DLL] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\system32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4410]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 652][C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe] [Hewlett-Packard Company, 1, 1, 2, 2]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.12.7 04Nov04]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 644][C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe] [Intel Corporation, 9, 0, 1, 19]
[C:\Program Files\Intel\Wireless\Bin\PsRegApi.dll] [Intel Corporation, 9, 0, 1, 14]
[C:\Program Files\Intel\Wireless\Bin\FrWrkCHS.dll] [Intel Corporation, 9, 0, 1, 19]
[C:\Program Files\Intel\Wireless\Bin\FrameworkPlugins\ConnMgr.dll] [Intel Corporation, 9, 0, 1, 59]
[C:\Program Files\Intel\Wireless\Bin\MurocApi.dll] [Intel Corporation, 9, 0, 1, 56]
[C:\Program Files\Intel\Wireless\Bin\S24MUDLL.dll] [Intel Corporation, 9, 0, 1, 7]
[C:\Program Files\Intel\Wireless\Bin\C1XStngs.dll] [Intel Corporation, 9, 0, 1, 31]
[C:\Program Files\Intel\Wireless\Bin\TraceAPI.DLL] [Intel Corporation, 9, 0, 1, 22]
[C:\Program Files\Intel\Wireless\Bin\PfMgrApi.dll] [Intel Corporation, 9, 0, 1, 45]
[C:\Program Files\Intel\Wireless\Bin\C8021CHS.dll] [Intel Corporation, 9, 0, 1, 31]
[C:\Program Files\Intel\Wireless\Bin\LSAWRAPI.dll] [Intel Corporation, 9, 0, 1, 1]
[C:\Program Files\Intel\Wireless\Bin\IntWACHS.dll] [Intel Corporation, 9, 0, 1, 59]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[C:\Program Files\Intel\Wireless\Bin\D8021Xps.DLL] [N/A, N/A]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.12.7 04Nov04]
[PID: 1204][C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe] [Hewlett-Packard , 5, 20, 7, 1]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.12.7 04Nov04]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[C:\Program Files\HPQ\Quick Launch Buttons\CPQINFO.DLL] [Hewlett-Packard , 5, 20, 6, 2]
[C:\Program Files\HPQ\Quick Launch Buttons\HPQPRES.DLL] [Hewlett-Packard , 5, 2, 7, 1]
[PID: 1416][C:\Program Files\Rising\AntiSpyware\runiep.exe] [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6]
[C:\Program Files\Rising\AntiSpyware\iep_ctrl.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 1252][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 1268][C:\WINDOWS\iexp1ore.exe] [N/A, N/A]
[C:\WINDOWS\system32\LgSyzr.dll] [N/A, N/A]
[PID: 2084][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[c:\program files\hpq\iam\bin\aschnl.dll] [Cognizance Corporation, 1.23.0.122]
[c:\program files\hpq\iam\bin\ItMsg.dll] [Cognizance Corporation, 1.18.0.265]
[PID: 2120][C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe] [Broadcom Corporation., 4.0.1.2101]
[PID: 2140][C:\Program Files\SQLLIB\bin\db2jds.exe] [N/A, N/A]
[C:\Program Files\SQLLIB\bin\DB2APP.dll] [International Business Machines Corporation, 7.1.0.65]
[C:\Program Files\SQLLIB\bin\DB2SYS.dll] [N/A, N/A]
[C:\Program Files\SQLLIB\bin\DB2WINT.dll] [N/A, N/A]
[C:\Program Files\SQLLIB\bin\DB2SYSP.dll] [International Business Machines Corporation, 7.1.0.65]
[C:\Program Files\SQLLIB\bin\DB2CLI.dll] [International Business Machines Corporation, 7.1.0.65]
[C:\Program Files\SQLLIB\bin\DB2UTIL.dll] [International Business Machines Corporation, 7.1.0.65]
[C:\Program Files\SQLLIB\bin\DB2ABIND.dll] [International Business Machines Corporation, 7.1.0.65]
[PID: 2184][C:\Program Files\SQLLIB\bin\db2sec.exe] [International Business Machines Corporation, 7.1.0.65]
[C:\Program Files\SQLLIB\bin\DB2SYS.dll] [N/A, N/A]
[C:\Program Files\SQLLIB\bin\DB2WINT.dll] [N/A, N/A]
[C:\Program Files\SQLLIB\bin\DB2SYSP.dll] [International Business Machines Corporation, 7.1.0.65]
[C:\Program Files\SQLLIB\bin\DB2APP.dll] [International Business Machines Corporation, 7.1.0.65]
[C:\Program Files\SQLLIB\bin\DB2CLI.dll] [International Business Machines Corporation, 7.1.0.65]
[C:\Program Files\SQLLIB\bin\DB2UTIL.dll] [International Business Machines Corporation, 7.1.0.65]
[C:\Program Files\SQLLIB\bin\DB2ABIND.dll] [International Business Machines Corporation, 7.1.0.65]
[C:\Program Files\SQLLIB\BIN\db2npwd.dll] [International Business Machines Corporation, 7.1.0.65]
[PID: 2252][C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe] [Intel Corporation, 9, 0, 1, 10]
[PID: 2612][C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe] [Analog Devices, Inc., 3, 2, 6, 0]
[PID: 2640][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2660][C:\WINDOWS\system32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: DNSRV(bld4act)]
[PID: 2732][C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe] [Hewlett-Packard Development Company, L.P., 2, 0, 1, 5]
[PID: 2860][C:\WINDOWS\system32\wscntfy.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.12.7 04Nov04]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 3048][C:\WINDOWS\system32\wbem\wmiprvse.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3448][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3804][C:\Program Files\HPQ\Shared\hpqwmi.exe] [Hewlett-Packard Development Company, L.P., 1, 0, 4, 4]
[PID: 2508][C:\WINDOWS\explorer.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.12.7 04Nov04]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[C:\WINDOWS\system32\LgSyzr.dll] [N/A, N/A]
[C:\WINDOWS\system32\dla\tfswshx.dll] [Sonic Solutions, 1.04.08a]
[C:\WINDOWS\system32\tfswapi.dll] [Sonic Solutions, 1.04.08a]
[C:\WINDOWS\system32\dla\tfswcres.dll] [Sonic Solutions, 1.04.08a]
[C:\PROGRA~1\FlashGet\jccatch.dll] [Amaze Soft, 1, 1, 4, 0]
[C:\Program Files\HPQ\IAM\Bin\ItIeAddIN.dll] [Infineon Technologies AG, 1.01.069]
[C:\Program Files\HPQ\Quick Launch Buttons\CPQINFO.DLL] [Hewlett-Packard , 5, 20, 6, 2]
[C:\Program Files\Nero\Nero 7\Nero BackItUp\NBShell.dll] [Nero AG, 2, 6, 5, 0]
[C:\Program Files\Tencent\RTX\RTXShl.dll] [Tencent, 1, 0, 0, 1]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\shellex.dll] [Kaspersky Lab, 6.0.0.299]
[C:\Program Files\WinRAR\rarext.dll] [N/A, N/A]
[C:\WINDOWS\system32\igfxpph.dll] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\system32\hccutils.DLL] [Intel Corporation, 3.0.0.4410]
[C:\WINDOWS\system32\btncopy.dll] [Broadcom Corporation., 4.0.1.2101]
[PID: 3192][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\SynTPFcs.dll] [Synaptics, Inc., 7.12.7 04Nov04]
[C:\WINDOWS\system32\dla\tfswshx.dll] [Sonic Solutions, 1.04.08a]
[C:\WINDOWS\system32\tfswapi.dll] [Sonic Solutions, 1.04.08a]
[C:\WINDOWS\system32\dla\tfswcres.dll] [Sonic Solutions, 1.04.08a]
[C:\PROGRA~1\FlashGet\jccatch.dll] [Amaze Soft, 1, 1, 4, 0]
[C:\Program Files\HPQ\IAM\Bin\ItIeAddIN.dll] [Infineon Technologies AG, 1.01.069]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[C:\Program Files\HPQ\IAM\Bin\ItSSO.dll] [Cognizance Corporation, 1.50.3.307]
[C:\Program Files\HPQ\IAM\Bin\ItMsg.dll] [Cognizance Corporation, 1.18.0.265]
[C:\WINDOWS\system32\LgSyzr.dll] [N/A, N/A]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll] [Kaspersky Lab, 1.0.6.299]

laotai - 2007-2-10 11:04:00

文件关联
.TXT Error. [UltraEdit.txt]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI Error. [UltraEdit.ini]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
N/A

==================================
API HOOK
警告！System Repair Engineer 提醒
你下面的函数内容与预期值不符，他
们可能被一些恶意的软件所修改：
RVA 错误： LoadLibraryA
RVA 错误： LoadLibraryExA
RVA 错误： LoadLibraryExW
RVA 错误： LoadLibraryW

==================================

laotai - 2007-2-10 11:06:00

【回复“姑苏残月”的帖子】
每次开机还是会出现说找到了这个木马程序，需重启啊，这是怎么回事？

logicl - 2007-2-10 11:20:00

1. 杀毒前关闭系统还原(Win2000系统可以忽略）：右键我的电脑，属性，系统还原，在所有驱动器上关闭系统还原打勾即可。
清除IE的临时文件：打开IE 点工具-->Internet选项 : Internet临时文件，点“删除文件”按钮，将删除所有脱机内容打勾，点确定删除。
2.打开注册表,将下面键值删除:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<bl1k57rcgi2w88><C:\WINDOWS\iexp1ore.exe>
<vri41k1><C:\WINDOWS\rundl132.exe>
<4z6khdr1><C:\WINDOWS\crasos.exe>
<0fh0lzgw8><; C:\WINDOWS\iexp1ore.exe>
<il5mlqkq4uv1t><; C:\WINDOWS\crasos.exe>
<qhb3ekhjkrs><; C:\WINDOWS\rundl132.exe>
<{2D49692C-A5FD-4E29-A3CD-37E9B182FCC6}><C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys>
3.重新启动进安全模式(开机之后按F8)用PowerRMV(勾选杀灭文件再生成)删除下面文件:
C:\WINDOWS\iexp1ore.exe]
C:\WINDOWS\system32\LgSyzr.dll]
C:\WINDOWS\rundl132.exe>
C:\WINDOWS\crasos.exe>
C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys
4.删除下面服务
[dtscsi / dtscsi][Running/Manual Start]
<\SystemRoot\System32\Drivers\dtscsi.sys>
<\SystemRoot\System32\Drivers\sptd.sys>

laotai - 2007-2-10 11:20:00

每次都是提示已被删除，但是每次启动的时候还是会提醒，这个怎么解决，如果清理系统垃圾？

logicl - 2007-2-10 11:29:00

还是没有清理干净啊.

瑞星卡卡安全论坛