[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\Rav\RsXML.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
[C:\Program Files\Rising\Rav\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[PID: 6096 / Administrator][C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe] [Microsoft Corporation, 2000.080.2039.00]
[C:\Program Files\Microsoft SQL Server\80\Tools\Binn\W95SCM.dll] [Microsoft Corporation, 2000.080.2039.00]
[C:\Program Files\Microsoft SQL Server\80\Tools\Binn\SQLSVC.dll] [Microsoft Corporation, 2000.080.2039.00]
[C:\Program Files\Microsoft SQL Server\80\Tools\Binn\SQLRESLD.dll] [Microsoft Corporation, 2000.080.2039.00]
[C:\WINDOWS\system32\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 17]
[C:\Program Files\Microsoft SQL Server\80\Tools\Binn\Resources\2052\SQLSVC.RLL] [Microsoft Corporation, 2000.080.0194.00]
[C:\Program Files\Microsoft SQL Server\80\Tools\Binn\Resources\2052\sqlmangr.RLL] [Microsoft Corporation, 2000.080.0194.00]
[PID: 5884 / Administrator][c:\windows\system32\cpqteam.exe] [Hewlett-Packard Company, 8.60.0.11]
[c:\windows\system32\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 17]
[D:\work\ast\AST.dll] [超级巡警, 1.0.2.10]
[PID: 4504 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]
[C:\WINDOWS\System32\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 17]
[PID: 4884 / SYSTEM][C:\WINDOWS\system32\cidaemon.exe] [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]
[C:\WINDOWS\system32\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 17]
[PID: 5412 / Administrator][C:\PROGRA~1\MICROS~1\MSSQL\binn\sqlservr.exe] [Microsoft Corporation, 2000.080.2039.00]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\PROGRA~1\MICROS~1\MSSQL\binn\opends60.dll] [Microsoft Corporation, 2000.080.2039.00]
[C:\PROGRA~1\MICROS~1\MSSQL\binn\sqlsort.dll] [Microsoft Corporation, 2000.080.2039.00]
[C:\PROGRA~1\MICROS~1\MSSQL\binn\ums.dll] [Microsoft Corporation, 2000.080.2039.00]
[C:\WINDOWS\system32\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 17]
[C:\PROGRA~1\MICROS~1\MSSQL\binn\Resources\2052\sqlevn70.RLL] [Microsoft Corporation, 2000.080.2039.00]
[C:\Program Files\Microsoft SQL Server\MSSQL\binn\SSNETLIB.dll] [Microsoft Corporation, 2000.080.2039.00]
[C:\PROGRA~1\MICROS~1\MSSQL\binn\SSmsLPCn.dll] [Microsoft Corporation, 2000.080.2039.00]
[C:\PROGRA~1\MICROS~1\MSSQL\binn\SSnmPN70.dll] [Microsoft Corporation, 2000.080.2039.00]
[C:\Program Files\Microsoft SQL Server\MSSQL\binn\SQLFTQRY.DLL] [Microsoft Corporation, 2000.080.2039.00]
[C:\PROGRA~1\MICROS~1\MSSQL\binn\xpsqlbot.dll] [Microsoft Corporation, 2000.080.2039.00]
[PID: 5588 / Administrator][C:\PROGRA~1\MICROS~1\MSSQL\binn\sqlagent.exe] [Microsoft Corporation, 2000.080.2039.00]
[C:\PROGRA~1\MICROS~1\MSSQL\binn\SQLRESLD.dll] [Microsoft Corporation, 2000.080.2039.00]
[C:\PROGRA~1\MICROS~1\MSSQL\binn\SQLSVC.dll] [Microsoft Corporation, 2000.080.2039.00]
[C:\PROGRA~1\MICROS~1\MSSQL\binn\W95SCM.dll] [Microsoft Corporation, 2000.080.2039.00]
[C:\PROGRA~1\MICROS~1\MSSQL\binn\SEMMAP.dll] [Microsoft Corporation, 2000.080.2039.00]
[C:\WINDOWS\system32\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 17]
[C:\PROGRA~1\MICROS~1\MSSQL\binn\Resources\2052\SQLSVC.RLL] [Microsoft Corporation, 2000.080.0194.00]
[C:\PROGRA~1\MICROS~1\MSSQL\binn\Resources\2052\SEMMAP.RLL] [Microsoft Corporation, 2000.080.0194.00]
[C:\PROGRA~1\MICROS~1\MSSQL\binn\Resources\2052\sqlagent.RLL] [Microsoft Corporation, 2000.080.2039.00]
[C:\PROGRA~1\MICROS~1\MSSQL\binn\SQLAGENT.DLL] [Microsoft Corporation, 2000.080.2039.00]
[C:\Program Files\Microsoft SQL Server\MSSQL\BINN\SQLCMDSS.DLL] [Microsoft Corporation, 2000.080.2039.00]
[C:\Program Files\Microsoft SQL Server\MSSQL\BINN\Resources\2052\SQLCMDSS.RLL] [Microsoft Corporation, 2000.080.2039.00]
[C:\Program Files\Microsoft SQL Server\MSSQL\BINN\SQLREPSS.DLL] [Microsoft Corporation, 2000.080.2039.00]
[C:\Program Files\Microsoft SQL Server\MSSQL\BINN\Resources\2052\SQLREPSS.RLL] [Microsoft Corporation, 2000.080.2039.00]
[C:\Program Files\Microsoft SQL Server\MSSQL\BINN\SQLATXSS.DLL] [Microsoft Corporation, 2000.080.2039.00]
[C:\PROGRA~1\MICROS~1\MSSQL\binn\ATXCORE.dll] [Microsoft Corporation, 2000.080.2039.00]
[C:\PROGRA~1\MICROS~1\MSSQL\binn\Resources\2052\ATXCORE.RLL] [Microsoft Corporation, 2000.080.2039.00]
[C:\Program Files\Microsoft SQL Server\MSSQL\BINN\Resources\2052\SQLATXSS.RLL] [Microsoft Corporation, 2000.080.0194.00]
[C:\Program Files\Microsoft SQL Server\80\Tools\BINN\AXSCPHST.DLL] [Microsoft Corporation, 2000.080.2039.00]
[C:\Program Files\Microsoft SQL Server\80\Tools\BINN\Resources\2052\AXSCPHST.RLL] [Microsoft Corporation, 2000.080.0194.00]
[C:\WINDOWS\system32\DBmsLPCn.dll] [Microsoft Corporation, 2000.080.2039.00]
[PID: 4492 / Administrator][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]
[C:\WINDOWS\system32\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 17]
[PID: 4304 / Administrator][D:\work\ast\ast.exe] [超级巡警, 1, 8, 6, 110]
[D:\work\ast\MFC80.DLL] [Microsoft Corporation, 8.00.50727.762]
[D:\work\ast\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.762]
[D:\work\ast\MSVCP80.dll] [Microsoft Corporation, 8.00.50727.762]
[C:\WINDOWS\system32\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 17]
[D:\work\ast\common.dll] [超级巡警, 1.4.2.27]
[D:\work\ast\EngineSDK.dll] [超级巡警, 2.2.2.56]
[D:\work\ast\aScanCom.dll] [超级巡警, 2.1.2.42]
[D:\work\ast\AST.dll] [超级巡警, 1.0.2.10]
[D:\work\ast\AutoRun.dll] [超级巡警, 2.2.2.21]
[D:\work\ast\FileAnalyser.dll] [超级巡警, 1.0.1.11]
[D:\work\ast\FileForceKiller.dll] [DSW Lab, 1.0.1.0]
[D:\work\ast\ManagerProcess.dll] [超级巡警, 1.3.4.13]
[D:\work\ast\ManagerService.dll] [超级巡警, 1.0.6.4]
[D:\work\ast\Monitor.dll] [超级巡警, 1, 7, 9, 40]
[D:\work\ast\PortAssociate.dll] [超级巡警, 1.0.3.7]
[D:\work\ast\ssdt.dll] [超级巡警, 1.0.2.4]
[D:\work\ast\StateViewer.dll] [超级巡警, 1.0.10.16]
[D:\work\ast\tIERepair.dll] [超级巡警, 1, 2, 2, 20]
[D:\work\ast\tRubbishClear.dll] [超级巡警, 1.5.2.20]
[D:\work\ast\tSecurityOptimize.dll] [超级巡警, 1.1.2.0]
[D:\work\ast\zDiagnosticTool.dll] [超级巡警, 1.2.1.3]
[D:\work\ast\KillModule.dll] [超级巡警, 1.2.2.24]
[D:\work\ast\MScaner.dll] [超级巡警, 1.0.0.26]
[D:\work\ast\ScanAd.dll] [超级巡警, 1.0.1.1]
[D:\work\ast\SKEngine.dll] [超级巡警, 1.6.5.12]
[D:\work\ast\smart.dll] [超级巡警, 1.0.0.31]
[D:\work\ast\unarc.dll] [超级巡警, 1.2.5]
[D:\work\ast\SScanner.dll] [超级巡警, 1, 0, 0, 3]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 7]
[C:\WINDOWS\system32\shlhook.dll] [Beijing Rising Technology Co., Ltd., 4.0.0.9]
[C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[D:\work\ast\ASTShellEx.dll] [超级巡警, 1.5.5.13]
[PID: 2864 / Administrator][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]
[C:\WINDOWS\system32\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 17]
[D:\work\ast\AST.dll] [超级巡警, 1.0.2.10]
[PID: 1248 / Administrator][D:\sreng2\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]
[C:\WINDOWS\system32\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 17]
[D:\work\ast\AST.dll] [超级巡警, 1.0.2.10]
[D:\sreng2\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM Error. ["hh.exe" %1]
.HLP Error. [winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1 localhost
==================================
进程特权扫描
特殊特权被允许： SeSystemtimePrivilege [PID = 5940, C:\WINDOWS\SOUNDMAN.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 4304, D:\WORK\AST\AST.EXE]
==================================
API HOOK
入口点错误：NtCreateFile (危险等级: 高, 被下面模块所HOOK: 0x003D3E5D)
入口点错误：NtWriteFile (危险等级: 高, 被下面模块所HOOK: 0x003D3EFD)
入口点错误：ZwCreateFile (危险等级: 高, 被下面模块所HOOK: 0x003D3E5D)
入口点错误：ZwWriteFile (危险等级: 高, 被下面模块所HOOK: 0x003D3EFD)
入口点错误：CreateProcessA (危险等级: 高, 被下面模块所HOOK: D:\work\ast\AST.dll)
入口点错误：CreateProcessW (危险等级: 高, 被下面模块所HOOK: D:\work\ast\AST.dll)
==================================
隐藏进程
N/A
==================================
[/CODE]
服务器2的日志为：
[CODE]
2008-05-12,10:35:00
System Repair Engineer 2.5.16.900
Smallfrogs (
http://www.KZTechs.com)
Windows Server 2003 Enterprise Edition Service Pack 2 (Build 3790) - 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Component Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Component Publisher]
<IMEKRMIG6.1><C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE> [(Verified)Microsoft Windows Component Publisher]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows Component Publisher]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows Component Publisher]
<CPQTEAM><cpqteam.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<RavTray><"C:\Program Files\Rising\Rav\RavTray.exe"> [Rising]
<SoundMan><SoundMan.exe> [1]
<RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<KKDelay><C:\Program Files\Rising\AntiSpyware\RunOnce.exe> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Component Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><%SystemRoot%\system32\logonui.exe> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
<{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}><C:\WINDOWS\system32\shlhook.dll> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
<IE7 Uninstall Stub><C:\WINDOWS\system32\ieudinit.exe> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
<N/A><C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe]
<IFEO[taskmgr.exe]><svchost.exe> [(Verified)Microsoft Windows Component Publisher]
==================================
启动文件夹
[服务管理器]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\服务管理器.lnk --> C:\PROGRA~1\MICROS~1\80\Tools\Binn\sqlmangr.exe [Microsoft Corporation]><N>
==================================
服务
[HP Insight Event Notifier / CIMnotify][Stopped/Disabled]
<C:\WINDOWS\system32\CIMntfy\cimntfy.exe><Hewlett-Packard Company>
[HP Smart Array SAS/SATA Event Notification Service / Cissesrv][Running/Auto Start]
<C:\Program Files\HP\Cissesrv\cissesrv.exe><Hewlett-Packard Company>
[HP Insight NIC Agents / CpqNicMgmt][Running/Auto Start]
<C:\WINDOWS\system32\CPQNiMgt\cpqnimgt.exe><Hewlett-Packard Company>
[HP ProLiant Remote Monitor Service / CpqRcmc][Running/Auto Start]
<C:\WINDOWS\system32\cpqrcmc.exe><Hewlett-Packard Company>
[HP Version Control Agent / cpqvcagent][Running/Auto Start]
<C:\hp\hpsmh\data\cgi-bin\vcagent\vcagent.exe><Hewlett-Packard Company>
[HP Insight Foundation Agents / CqMgHost][Running/Auto Start]
<C:\WINDOWS\system32\CpqMgmt\cqmghost\cqmghost.exe><Hewlett-Packard Company>
[HP Insight Server Agents / CqMgServ][Running/Auto Start]
<C:\WINDOWS\system32\CpqMgmt\cqmgserv\cqmgserv.exe><Hewlett-Packard Company>
[HP Insight Storage Agents / CqMgStor][Running/Auto Start]
<C:\WINDOWS\system32\CpqMgmt\cqmgstor\cqmgstor.exe><Hewlett-Packard Company>
[Human Intexxxce Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Microsoft Search / MSSEARCH][Running/Auto Start]
<"C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe"><Microsoft Corporation>
[MSSQLSERVER / MSSQLSERVER][Stopped/Manual Start]
<C:\PROGRA~1\MICROS~1\MSSQL\binn\sqlservr.exe><Microsoft Corporation>
[MSSQLServerADHelper / MSSQLServerADHelper][Stopped/Manual Start]
<C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe><Microsoft Corporation>
[RavService / RavService][Running/Auto Start]
<"C:\Program Files\Rising\Rav\RavService.exe" /service><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon][Running/Auto Start]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[SQLSERVERAGENT / SQLSERVERAGENT][Stopped/Manual Start]
<C:\PROGRA~1\MICROS~1\MSSQL\binn\sqlagent.exe><Microsoft Corporation>
[HP ProLiant System Shutdown Service / sysdown][Running/Auto Start]
<C:\WINDOWS\system32\sysdown.exe><Hewlett-Packard Company>
[HP System Management Homepage / SysMgmtHp][Running/Auto Start]
<C:\hp\hpsmh\bin\smhstart.exe><Hewlett-Packard Company>
[Help and Support / helpsvc][Stopped/Manual Start]
<2 - 系统找不到指定的文件。
><N/A>
==================================
驱动程序
[ati2mtag / ati2mtag][Running/Manual Start]
<system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[HP Virtual Bus Device / b06bdrv][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\bxvbdx.sys><Broadcom Corporation>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[HP iLO Management Channel Intexxxce Driver / CpqCiDrv][Running/Manual Start]
<system32\DRIVERS\cpqcidrv.sys><Hewlett-Packard Company>
[CPQCISSE / CPQCISSE][Running/Manual Start]
<system32\DRIVERS\CPQCISSE.sys><Hewlett-Packard Company>
[cpqcissm / cpqcissm][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\cpqcissm.sys><Hewlett-Packard Company>
[HP Network Configuration Utility / CPQTeam][Stopped/Manual Start]
<system32\DRIVERS\cpqteam.sys><Hewlett-Packard Company>
[dohs / dohs][Stopped/Auto Start]
<\??\C:\DOCUME~1\ADMINI~1.MOR\LOCALS~1\Temp\tmpF.tmp><N/A>
[drop / drop][Stopped/Auto Start]
<\??\C:\DOCUME~1\ADMINI~1.MOR\LOCALS~1\Temp\tmp19.tmp><N/A>
[ExpScaner / ExpScaner][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\ExpScan.sys><>
[fmsq / fmsq][Stopped/Auto Start]
<\??\C:\DOCUME~1\ADMINI~1.MOR\LOCALS~1\Temp\tmp17.tmp><N/A>
[HBKernel Driver / HBKernel][Stopped/Auto Start]
<\??\C:\WINDOWS\system32\drivers\HBKernel.sys><N/A>
[HookCont / HookCont][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising>
[HpCISSs2 / HpCISSs2][Running/Boot Start]
<\SystemRoot\system32\drivers\HpCISSs2.sys><Hewlett-Packard Company>
[hpqilo2 / hpqilo2][Running/Manual Start]
<system32\DRIVERS\hpqilo2.sys><Hewlett-Packard Company>
[IP in IP Tunnel Driver / IpInIp][Stopped/Manual Start]
<system32\DRIVERS\ipinip.sys><N/A>
[jtio / jtio][Stopped/Auto Start]
<\??\C:\DOCUME~1\ADMINI~1.MOR\LOCALS~1\Temp\tmp1B.tmp><N/A>
[KAVSafe / KAVSafe][Running/Auto Start]
<\??\C:\WINDOWS\system32\Drivers\KAVSafe.sys><Kingsoft Corporation>
[HP NC370 Multifunction Gigabit Server Adapter / l2nd][Running/Manual Start]