windows 7安装之初的SRENG日志 bbs.ikaka.com

baohe - 2009-10-26 21:17:00

借块地儿.

存档备查哈

[code]2009-10-26,21:12:28

System Repair Engineer 2.8.1.1279
Smallfrogs (http://www.KZTechs.com)

Windows 7 Ultimate Edition  (Build 7600) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描
计划任务
Windows 安全更新检查
API HOOK
隐藏进程

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<RisTray><"E:\Program Files\Rising\Ris\RsTray.exe" -system>  [(Verified)Beijing Rising Information Technology Corporation Limited]
<Microsoft Pinyin IME Migration><E:\PROGRA~1\COMMON~1\MICROS~1\IME12\IMESC\IMSCMIG.EXE /INSTALL>  [(Verified)Microsoft Corporation]
<GrooveMonitor><"E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe">  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><explorer.exe>  [(Verified)Microsoft Windows]
<Userinit><E:\Windows\system32\userinit.exe,>  [(Verified)Microsoft Windows]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{B5A7F190-DDA6-4420-B3BA-52453494E6CD}><E:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<WebCheck><>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
<Microsoft Windows Media Player><%SystemRoot%\system32\unregmp2.exe /ShowWMP>  [(Verified)Microsoft Windows]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><E:\Windows\System32\ie4uinit.exe -UserIconConfig>  [(Verified)Microsoft Windows]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
<Browser Customizations><"E:\Windows\System32\rundll32.exe" "E:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP>  [(Verified)Microsoft Windows]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Windows><"%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE>  [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><%SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI>  [(Verified)Microsoft Windows]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
<Windows Desktop Update><regsvr32.exe /s /n /i:U shell32.dll>  [(Verified)Microsoft Windows]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
<Web Platform Customizations><E:\Windows\System32\ie4uinit.exe -BaseSettings>  [(Verified)Microsoft Windows]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
<N/A><E:\Windows\system32\Rundll32.exe E:\Windows\system32\mscories.dll,Install>  [(Verified)Microsoft Windows]

==================================
启动文件夹
N/A

==================================
服务
[AMD External Events Utility / AMD External Events Utility][Running/Auto Start]
  <E:\Windows\system32\atiesrxx.exe><AMD>
[Ris Service / RsRisMon][Running/Auto Start]
  <"E:\Program Files\Rising\Ris\RavMonD.exe"><Beijing Rising Information Technology Co., Ltd.>
[TuneUp Drive Defrag Service / TuneUp.Defrag][Running/Manual Start]
  <E:\Windows\System32\TuneUpDefragService.exe><TuneUp Software>
[TuneUp Program Statistics Service / TuneUp.ProgramStatisticsSvc][Running/Auto Start]
  <E:\Windows\System32\TUProgSt.exe><TuneUp Software>

==================================
驱动程序
[adp94xx / adp94xx][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\adp94xx.sys><Adaptec, Inc.>
[adpahci / adpahci][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\adpahci.sys><Adaptec, Inc.>
[adpu320 / adpu320][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\adpu320.sys><Adaptec, Inc.>
[aic78xx / aic78xx][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\djsvs.sys><Adaptec, Inc.>
[aliide / aliide][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\aliide.sys><Acer Laboratories Inc.>
[amdsata / amdsata][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\amdsata.sys><Advanced Micro Devices>
[amdsbs / amdsbs][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\amdsbs.sys><AMD Technologies Inc.>
[amdxata / amdxata][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\amdxata.sys><Advanced Micro Devices>
[arc / arc][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\arc.sys><Adaptec, Inc.>
[arcsas / arcsas][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\arcsas.sys><Adaptec, Inc.>
[atikmdag / atikmdag][Running/Manual Start]
  <system32\DRIVERS\atikmdag.sys><ATI Technologies Inc.>
[Broadcom NetXtreme II VBD / b06bdrv][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\bxvbdx.sys><Broadcom Corporation>
[Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0 / b57nd60x][Stopped/Manual Start]
  <system32\DRIVERS\b57nd60x.sys><Broadcom Corporation>
[Brother USB Mass-Storage Lower Filter Driver / BrFiltLo][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\BrFiltLo.sys><Brother Industries, Ltd.>
[Brother USB Mass-Storage Upper Filter Driver / BrFiltUp][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\BrFiltUp.sys><Brother Industries, Ltd.>
[Brother MFC Serial Port Interface Driver (WDM) / Brserid][Stopped/Manual Start]
  <\SystemRoot\System32\Drivers\Brserid.sys><Brother Industries Ltd.>
[Brother WDM Serial driver / BrSerWdm][Stopped/Manual Start]
  <\SystemRoot\System32\Drivers\BrSerWdm.sys><Brother Industries Ltd.>
[Brother MFC USB Fax Only Modem / BrUsbMdm][Stopped/Manual Start]
  <\SystemRoot\System32\Drivers\BrUsbMdm.sys><Brother Industries Ltd.>
[Brother MFC USB Serial WDM Driver / BrUsbSer][Stopped/Manual Start]
  <\SystemRoot\System32\Drivers\BrUsbSer.sys><Brother Industries Ltd.>
[cmdide / cmdide][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\cmdide.sys><CMD Technology, Inc.>
[Broadcom NetXtreme II 10 GigE VBD / ebdrv][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\evbdx.sys><Broadcom Corporation>
[elxstor / elxstor][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\elxstor.sys><Emulex>
[Hauppauge Consumer Infrared Receiver / hcw85cir][Stopped/Manual Start]
  <\SystemRoot\system32\drivers\hcw85cir.sys><Hauppauge Computer Works, Inc.>
[hookcont / hookcont][Running/System Start]
  <system32\drivers\HookCont.sys><Beijing Rising Information Technology Co., Ltd.>
[hooksys / hooksys][Running/System Start]
  <system32\drivers\HookSys.sys><Beijing Rising Information Technology Co., Ltd.>
[HpSAMD / HpSAMD][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\HpSAMD.sys><Hewlett-Packard Company>
[iaStorV / iaStorV][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\iaStorV.sys><Intel Corporation>
[iirsp / iirsp][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\iirsp.sys><Intel Corp./ICP vortex GmbH>
[LSI_FC / LSI_FC][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\lsi_fc.sys><LSI Corporation>
[LSI_SAS / LSI_SAS][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\lsi_sas.sys><LSI Corporation>
[LSI_SAS2 / LSI_SAS2][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\lsi_sas2.sys><LSI Corporation>
[LSI_SCSI / LSI_SCSI][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\lsi_scsi.sys><LSI Corporation>
[megasas / megasas][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\megasas.sys><LSI Corporation>
[MegaSR / MegaSR][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\MegaSR.sys><LSI Corporation, Inc.>
[nfrd960 / nfrd960][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\nfrd960.sys><IBM Corporation>
[nvraid / nvraid][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\nvraid.sys><NVIDIA Corporation>
[nvstor / nvstor][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\nvstor.sys><NVIDIA Corporation>
[ql2300 / ql2300][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\ql2300.sys><QLogic Corporation>
[ql40xx / ql40xx][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\ql40xx.sys><QLogic Corporation>
[Rising RfwARP Driver / RFWARP][Running/Auto Start]
  <system32\DRIVERS\rfwarp.sys><Beijing Rising Information Technology Co., Ltd.>
[Rising RfwBase Driver / RfwBase9][Running/System Start]
  <system32\DRIVERS\rfwbase.sys><Beijing Rising Information Technology Co., Ltd.>
[rfwtdi / rfwtdi][Running/Auto Start]
  <\??\E:\Program Files\Rising\Ris\rfwtdi.sys><Beijing Rising Information Technology Co., Ltd.>
[rsassist / rsassist][Running/Auto Start]
  <system32\drivers\rsassist.sys><Beijing Rising Information Technology Co., Ltd.>
[rsfwdrv / rsfwdrv][Running/System Start]
  <\??\E:\Program Files\Rising\Ris\rsfwdrv.sys><Beijing Rising Information Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
  <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Information Technology Co., Ltd.>
[SiSRaid2 / SiSRaid2][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\SiSRaid2.sys><Silicon Integrated Systems Corp.>
[SiSRaid4 / SiSRaid4][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\sisraid4.sys><Silicon Integrated Systems>
[stexstor / stexstor][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\stexstor.sys><Promise Technology>
[viaide / viaide][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\viaide.sys><VIA Technologies, Inc.>
[vsmraid / vsmraid][Stopped/Manual Start]
  <\SystemRoot\system32\DRIVERS\vsmraid.sys><VIA Technologies Inc.,Ltd>
[NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller / yukonw7][Running/Manual Start]
  <system32\DRIVERS\yk62x86.sys><Marvell>

用户系统信息：Opera/9.80 (Windows NT 6.1; U; zh-cn) Presto/2.2.15 Version/10.00

baohe - 2009-10-26 21:18:00

==================================
浏览器加载项
[Groove GFS Browser Helper]
  {72853161-30C5-4D22-B7F9-0BBC1D38A37E} <E:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL, (Signed) Microsoft Corporation>
[Send to OneNote from Internet Explorer button]
  {2670000A-7350-4f3c-8081-5663EE0C6C49} <E:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll, (Signed) Microsoft Corporation>
[信息检索(&R)]
  {92780B25-18CC-41C8-B9BE-3C9C571A8263} <E:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL, (Signed) Microsoft Corporation>
[Groove GFS Browser Helper]
  {72853161-30C5-4D22-B7F9-0BBC1D38A37E} <E:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL, (Signed) Microsoft Corporation>
[导出到 Microsoft Excel(&X)]
  <res://E:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000, N/A>

==================================
正在运行的进程
[PID: 276 / SYSTEM][\SystemRoot\System32\smss.exe]  [(Verified) Microsoft Corporation, 6.1.7600.16384 (win7_rtm.090710-1945)]
[PID: 384 / SYSTEM][E:\Windows\system32\csrss.exe]  [(Verified) Microsoft Corporation, 6.1.7600.16384 (win7_rtm.090710-1945)]
[PID: 460 / SYSTEM][E:\Windows\system32\wininit.exe]  [(Verified) Microsoft Corporation, 6.1.7600.16384 (win7_rtm.090710-1945)]
[PID: 468 / SYSTEM][E:\Windows\system32\csrss.exe]  [(Verified) Microsoft Corporation, 6.1.7600.16384 (win7_rtm.090710-1945)]
[PID: 516 / SYSTEM][E:\Windows\system32\services.exe]  [(Verified) Microsoft Corporation, 6.1.7600.16384 (win7_rtm.090710-1945)]
[PID: 524 / SYSTEM][E:\Windows\system32\lsass.exe]  [(Verified) Microsoft Corporation, 6.1.7600.16384 (win7_rtm.090710-1945)]
[PID: 532 / SYSTEM][E:\Windows\system32\lsm.exe]  [(Verified) Microsoft Corporation, 6.1.7600.16384 (win7_rtm.090710-1945)]
[PID: 640 / SYSTEM][E:\Windows\system32\svchost.exe]  [(Verified) Microsoft Corporation, 6.1.7600.16384 (win7_rtm.090710-1945)]
[PID: 716 / NETWORK SERVICE][E:\Windows\system32\svchost.exe]  [(Verified) Microsoft Corporation, 6.1.7600.16384 (win7_rtm.090710-1945)]
[PID: 780 / SYSTEM][E:\Program Files\Rising\Ris\RavMonD.exe]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2]
[E:\Program Files\Rising\Ris\combase.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 16]
[E:\Program Files\Rising\Ris\cnt09.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2]
[E:\Program Files\Rising\Ris\moncomm.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 9]
[E:\Program Files\Rising\Ris\MonBase.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3]
[E:\Program Files\Rising\Ris\Rslog.dll]  [Beijing Rising Information Technology Co., Ltd., 22.0.0.40]
[E:\Program Files\Rising\Ris\mondrv.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 6]
[E:\Program Files\Rising\Ris\defmon.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 41]
[E:\Program Files\Rising\Ris\moncom08.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1]
[E:\Program Files\Rising\Ris\MonRule.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 9]
[E:\Program Files\Rising\Ris\FileMon.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 28]
[E:\Program Files\Rising\Ris\MailMon.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 22]
[E:\Program Files\Rising\Ris\HookWeb.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 12]
[E:\Program Files\Rising\Ris\rfwlog.dll]  [Beijing Rising Information Technology Co., Ltd., 22.0.0.12]
[E:\Program Files\Rising\Ris\rfwrule.dll]  [Beijing Rising Information Technology Co., Ltd., 22.0.0.1]
[E:\Windows\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
[E:\Windows\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
[E:\Program Files\Rising\Ris\rfwsrv.dll]  [Beijing Rising Information Technology Co., Ltd., 22.0.0.2]
[E:\Program Files\Rising\Ris\Syslay.dll]  [Beijing Rising Information Technology Co., Ltd., 21.0.0.6]
[E:\Program Files\Rising\Ris\mPorts.dll]  [Beijing Rising Information Technology Co., Ltd., 22.0.0.0]
[E:\Program Files\Rising\Ris\rfwdrvc.dll]  [Beijing Rising Information Technology Co., Ltd., 21.0.0.1]
[E:\Program Files\Rising\Ris\Rfwdrv.dll]  [Beijing Rising Information Technology Co., Ltd., 22.0.0.5]
[E:\Program Files\Rising\Ris\RfwArp.dll]  [Beijing Rising Information Technology Co., Ltd., 22.0.0.5]
[E:\Program Files\Rising\Ris\rsnetsvr.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2]
[E:\Program Files\Rising\Ris\urlrule.dll]  [Beijing Rising Information Technology Co., Ltd., 22.0.0.1]
[E:\Program Files\Rising\Ris\recomp.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 6]
[E:\Program Files\Rising\Ris\comx3.dll]  [Beijing Rising Information Technology Co., Ltd., 21.0.0.37]
[E:\Program Files\Rising\Ris\refs.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3]
[E:\Program Files\Rising\Ris\viruslib.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3]
[E:\Program Files\Rising\Ris\relibldr.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3]
[E:\Program Files\Rising\Ris\rfwproxy.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 40]
[E:\Program Files\Rising\Ris\rsindent.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 7]
[E:\Program Files\Rising\Ris\taskplug.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 8]
[E:\Program Files\Rising\Ris\scansrvp.dll]  [Beijing Rising Information Technology Co., Ltd., 22.0.0.7]
[E:\Program Files\Rising\Ris\cnt08.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1]
[E:\Program Files\Rising\Ris\proccomm.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 4]
[E:\Program Files\Rising\Ris\RSAPPMGR.dll]  [Beijing Rising Information Technology Co., Ltd., 22.0.0.0]
[E:\Program Files\Rising\Ris\CfgDll.dll]  [Beijing Rising Information Technology Co., Ltd., 22.0.0.0]
[E:\Program Files\Rising\Ris\Hooksys.dll]  [Beijing Rising Information Technology Co., Ltd., 24, 0, 0, 3]
[E:\Program Files\Rising\Ris\ProcCom.dll]  [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 20]
[E:\Program Files\Rising\Ris\RsCommX2.dll]  [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 20]
[E:\Program Files\Rising\Ris\HookCont.dll]  [Beijing Rising Information Technology Co., Ltd., 24, 0, 0, 1]
[E:\Program Files\Rising\Ris\BACore.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 27]
[E:\Program Files\Rising\Ris\bawhite.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1]
[E:\Program Files\Rising\Ris\RSStore.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 5]
[E:\Program Files\Rising\Ris\Scanner.dll]  [Beijing Rising Information Technology Co., Ltd., 22.0.0.17]
[E:\Program Files\Rising\Ris\ScanAdd.dll]  [Beijing Rising Information Technology Co., Ltd., 22.0.0.4]
[E:\Program Files\Rising\Ris\NComm2.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2]
[E:\Program Files\Rising\Ris\rstask.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 5]
[E:\Program Files\Rising\Ris\rsstub.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1]
[E:\Program Files\Rising\Ris\ScanSrv.dll]  [Beijing Rising Information Technology Co., Ltd., 22.0.0.3]
[E:\Program Files\Rising\Ris\scanpe.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 10]
[E:\Program Files\Rising\Ris\pearc.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2]
[E:\Program Files\Rising\Ris\ur000.dat]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3]
[E:\Program Files\Rising\Ris\urutils.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1]
[E:\Program Files\Rising\Ris\revm.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 5]
[E:\Program Files\Rising\Ris\ffr.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 4]
[E:\Program Files\Rising\Ris\nvfile.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1]
[E:\Program Files\Rising\Ris\scanexec.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2]
[E:\Program Files\Rising\Ris\unexe.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2]
[E:\Program Files\Rising\Ris\scanex.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 30]
[E:\Program Files\Rising\Ris\scantj.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 4]
[E:\Program Files\Rising\Ris\methodex.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3]
[E:\Program Files\Rising\Ris\heurex.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 9]
[E:\Program Files\Rising\Ris\pecompd.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3]
[E:\Program Files\Rising\Ris\urllib.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1]
[E:\Program Files\Rising\Ris\ur001.dat]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2]
[E:\Program Files\Rising\Ris\extmail.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 5]
[E:\Program Files\Rising\Ris\scansct.dll]  [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2]
[PID: 804 / SYSTEM][E:\Windows\system32\atiesrxx.exe]  [AMD, 6.14.11.1033]
[PID: 852 / SYSTEM][E:\Windows\system32\winlogon.exe]  [(Verified) Microsoft Corporation, 6.1.7600.16384 (win7_rtm.090710-1945)]

baohe - 2009-10-26 21:19:00

[PID: 892 / LOCAL SERVICE][E:\Windows\System32\svchost.exe] [(Verified) Microsoft Corporation, 6.1.7600.16384 (win7_rtm.090710-1945)]
[PID: 924 / SYSTEM][E:\Windows\System32\svchost.exe] [(Verified) Microsoft Corporation, 6.1.7600.16384 (win7_rtm.090710-1945)]
[PID: 956 / SYSTEM][E:\Windows\system32\svchost.exe] [(Verified) Microsoft Corporation, 6.1.7600.16384 (win7_rtm.090710-1945)]
[PID: 1152 / LOCAL SERVICE][E:\Windows\system32\svchost.exe] [(Verified) Microsoft Corporation, 6.1.7600.16384 (win7_rtm.090710-1945)]
[E:\Program Files\Rising\Ris\RavScrCh.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 9]
[E:\Windows\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[E:\Windows\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[PID: 1320 / SYSTEM][E:\Windows\system32\atieclxx.exe] [AMD, 6.14.11.1033]
[E:\Windows\system32\atiadlxx.dll] [Advanced Micro Devices, Inc., 6.14.10.1050]
[PID: 1380 / NETWORK SERVICE][E:\Windows\system32\svchost.exe] [(Verified) Microsoft Corporation, 6.1.7600.16384 (win7_rtm.090710-1945)]
[PID: 1516 / SYSTEM][E:\Windows\System32\spoolsv.exe] [(Verified) Microsoft Corporation, 6.1.7600.16384 (win7_rtm.090710-1945)]
[PID: 1568 / LOCAL SERVICE][E:\Windows\system32\svchost.exe] [(Verified) Microsoft Corporation, 6.1.7600.16384 (win7_rtm.090710-1945)]
[PID: 1684 / LOCAL SERVICE][E:\Windows\system32\svchost.exe] [(Verified) Microsoft Corporation, 6.1.7600.16384 (win7_rtm.090710-1945)]
[PID: 584 / LOCAL SERVICE][E:\Windows\system32\WUDFHost.exe] [(Verified) Microsoft Corporation, 6.1.7600.16384 (win7_rtm.090710-1945)]
[PID: 1756 / linbaohe][E:\Windows\system32\taskhost.exe] [(Verified) Microsoft Corporation, 6.1.7600.16384 (win7_rtm.090710-1945)]
[PID: 2152 / linbaohe][E:\Windows\system32\Dwm.exe] [(Verified) Microsoft Corporation, 6.1.7600.16384 (win7_rtm.090710-1945)]
[E:\Windows\system32\atidxx32.dll] [ATI Technologies Inc. , 8.15.10.0212]
[PID: 2172 / linbaohe][E:\Windows\Explorer.EXE] [(Verified) Microsoft Corporation, 6.1.7600.16384 (win7_rtm.090710-1945)]
[E:\Windows\WinSxS\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.42_none_dc990e4797f81af1\ATL80.DLL] [Microsoft Corporation, 8.00.50727.42]
[E:\Windows\system32\FXSAPI.dll] [Microsoft Corporation, 6.1.7600.16384 (win7_rtm.090710-1945)]
[E:\Program Files\WinRAR\rarext.dll] [, ]
[E:\Windows\system32\RavExt.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.1]
[E:\Program Files\TuneUp Utilities 2009\SDShelEx-win32.dll] [TuneUp Software, 8.0.2000.35]
[PID: 2596 / linbaohe][E:\Program Files\Rising\Ris\RsTray.exe] [Beijing Rising Information Technology Co., Ltd., 22.0.0.10]
[E:\Program Files\Rising\Ris\comserv.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.15]
[E:\Program Files\Rising\Ris\rslang.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1]
[E:\Program Files\Rising\Ris\comx3.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.37]
[E:\Program Files\Rising\Ris\Syslay.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.6]
[E:\Program Files\Rising\Ris\ProcComm.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 4]
[E:\Program Files\Rising\Ris\rsxml.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2]
[E:\Program Files\Rising\Ris\MonState.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2]
[E:\Program Files\Rising\Ris\ScanEvnt.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.3]
[E:\Program Files\Rising\Ris\rsguilib.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 54]
[E:\Program Files\Rising\Ris\rsconf.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.1]
[E:\Program Files\Rising\Ris\rfwrule.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.1]
[E:\Windows\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[E:\Windows\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[E:\Program Files\Rising\Ris\rspalvd.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.6]
[E:\Program Files\Rising\Ris\rsnetsvr.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2]
[E:\Program Files\Rising\Ris\ravbintl.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 21]
[E:\Program Files\Rising\Ris\mruleui.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 6]
[E:\Program Files\Rising\Ris\MonTray.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.67]
[E:\Program Files\Rising\Ris\RavITray.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 6]
[E:\Program Files\Rising\Ris\rfwtray.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 37]
[E:\Program Files\Rising\Ris\rsmginfo.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3]
[E:\Program Files\Rising\Ris\scanleak.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 5]
[E:\Program Files\Rising\Ris\ravppops.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 20]
[E:\Program Files\Rising\Ris\RSAPPMGR.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.0]
[E:\Program Files\Rising\Ris\CfgDll.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.0]
[E:\Program Files\Rising\Ris\PngDll.dll] [Beijing Rising Information Technology Co., Ltd., 21, 0, 0, 4]
[E:\Program Files\Rising\Ris\ScanPrxy.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.3]
[E:\Program Files\Rising\Ris\rfwlog.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.12]
[PID: 2672 / linbaohe][E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe] [Microsoft Corporation, 12.0.4518.1014]
[E:\Windows\WinSxS\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.42_none_dc990e4797f81af1\ATL80.DLL] [Microsoft Corporation, 8.00.50727.42]
[PID: 2856 / SYSTEM][E:\Windows\system32\SearchIndexer.exe] [(Verified) Microsoft Corporation, 7.00.7600.16384 (win7_rtm.090710-1945)]
[PID: 3112 / NETWORK SERVICE][E:\Program Files\Windows Media Player\wmpnetwk.exe] [Microsoft Corporation, 12.0.7600.16384 (win7_rtm.090710-1945)]
[PID: 3388 / LOCAL SERVICE][E:\Windows\System32\svchost.exe] [(Verified) Microsoft Corporation, 6.1.7600.16384 (win7_rtm.090710-1945)]
[PID: 2360 / SYSTEM][E:\Windows\system32\svchost.exe] [(Verified) Microsoft Corporation, 6.1.7600.16384 (win7_rtm.090710-1945)]
[PID: 2084 / SYSTEM][E:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe] [(Verified) Microsoft Corporation, 2.0.50727.4927 (NetFXspW7.050727-4900)]
[PID: 2740 / SYSTEM][E:\Windows\System32\svchost.exe] [(Verified) Microsoft Corporation, 6.1.7600.16384 (win7_rtm.090710-1945)]
[PID: 3364 / SYSTEM][E:\Windows\System32\TUProgSt.exe] [TuneUp Software, 8.0.2000.35]
[PID: 400 / linbaohe][E:\Program Files\Opera\opera.exe] [Opera Software, 1750]
[E:\Program Files\Opera\Opera.dll] [Opera Software, 1750]
[E:\Windows\WinSxS\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.42_none_dc990e4797f81af1\ATL80.DLL] [Microsoft Corporation, 8.00.50727.42]
[PID: 1004 / linbaohe][E:\Program Files\TuneUp Utilities 2009\OneClick.exe] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\rtl100.bpl] [CodeGear, 11.0.2709.7128]
[E:\Program Files\TuneUp Utilities 2009\vcl100.bpl] [CodeGear, 11.0.2709.7128]
[E:\Program Files\TuneUp Utilities 2009\AppInitialization.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\DEC.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\SmallUnits.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\TUBase.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\vcljpg100.bpl] [CodeGear, 11.0.2627.5503]
[E:\Program Files\TuneUp Utilities 2009\GR32_D6.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\RegExp.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\XMLComponents.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\MainControls.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\TUCompression.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\vclx100.bpl] [CodeGear, 11.0.2627.5503]
[E:\Program Files\TuneUp Utilities 2009\Html.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\ntrtl60.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\SchedAgent_2007.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\tulic.dll] [TuneUp Software, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\VisControls.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\dxBarD11.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\dxComnD11.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\dxThemeD11.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\cxLibraryD11.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\dxGDIPlusD11.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\CommonForms.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\SysControls.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\TUIcoEngineerDirTree.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\TUShell.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\TUBasic.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\VirtualTreesR.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\TUKernel.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\SysInfo.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\MSI_D6.bpl] [N/A, ]
[E:\Program Files\TuneUp Utilities 2009\ehs_d6.bpl] [N/A, ]
[E:\Program Files\TuneUp Utilities 2009\TUDiskCleanerClass.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\TUApps.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\TURar.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\IEControl.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\Traces.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\TUShredder.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\TUTMSComponents.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\dbrtl100.bpl] [CodeGear, 11.0.2627.5503]
[E:\Program Files\TuneUp Utilities 2009\vcldb100.bpl] [CodeGear, 11.0.2627.5503]
[E:\Program Files\TuneUp Utilities 2009\TUOperaClass.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\TUSafariClass.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\TUDefragService.dll] [TuneUp Software, 8.0.2000.35]
[E:\Windows\WinSxS\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.42_none_dc990e4797f81af1\ATL80.DLL] [Microsoft Corporation, 8.00.50727.42]
[E:\Program Files\TuneUp Utilities 2009\UNZDLL.DLL] [, 1, 6, 0]
[PID: 1208 / linbaohe][E:\Program Files\TuneUp Utilities 2009\RegistryCleaner.exe] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\rtl100.bpl] [CodeGear, 11.0.2709.7128]
[E:\Program Files\TuneUp Utilities 2009\vcl100.bpl] [CodeGear, 11.0.2709.7128]
[E:\Program Files\TuneUp Utilities 2009\AppInitialization.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\DEC.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\SmallUnits.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\TUBase.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\vcljpg100.bpl] [CodeGear, 11.0.2627.5503]
[E:\Program Files\TuneUp Utilities 2009\GR32_D6.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\RegExp.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\XMLComponents.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\MainControls.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\TUCompression.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\vclx100.bpl] [CodeGear, 11.0.2627.5503]
[E:\Program Files\TuneUp Utilities 2009\Html.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\ntrtl60.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\SchedAgent_2007.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\tulic.dll] [TuneUp Software, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\VisControls.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\dxBarD11.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\dxComnD11.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\dxThemeD11.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\cxLibraryD11.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\dxGDIPlusD11.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\SysInfo.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\TUKernel.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\TUBasic.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\MSI_D6.bpl] [N/A, ]
[E:\Program Files\TuneUp Utilities 2009\TUIcoEngineerDirTree.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\TUShell.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\SysControls.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\CommonForms.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\ehs_d6.bpl] [N/A, ]
[E:\Program Files\TuneUp Utilities 2009\dxBarExtItemsD11.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\dxSkinsCoreD11.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\Traces.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[E:\Program Files\TuneUp Utilities 2009\TUShredder.bpl] [TuneUp Software GmbH, 8.0.2000.35]
[PID: 2700 / SYSTEM][E:\Windows\System32\TuneUpDefragService.exe] [TuneUp Software, 8.0.2000.35]
[PID: 3336 / linbaohe][E:\Users\linbaohe\Desktop\SREngLdr.EXE] [Smallfrogs Studio, 2.8.1.1279]
[PID: 1848 / linbaohe][E:\Users\linbaohe\Desktop\SREf8e0a45b.EXE] [Smallfrogs Studio, 2.8.1.1279]

baohe - 2009-10-26 21:19:00

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["%SystemRoot%\hh.exe" %1]
.HLP OK. [%SystemRoot%\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. ["%SystemRoot%\System32\WScript.exe" "%1" %*]
.JS Error. [E:\Windows\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
N/A

==================================
进程特权扫描
N/A

==================================
计划任务
[已启用] \\1-Click Maintenance
E:\Program Files\TuneUp Utilities 2009\OneClickStarter.exe /schedulestart
[已启用] \\RunAsStdUser Task19914
E:\Program Files\Rising\Ris\RSTRAY.EXE /schedulestart
[已禁用] \Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Automated)
N/A
[已启用] \Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Manual)
N/A
[已禁用] \Microsoft\Windows\AppID\PolicyConverter
%windir%\system32\appidpolicyconverter.exe
[已禁用] \Microsoft\Windows\AppID\VerifiedPublisherCertStoreCheck
%windir%\system32\appidcertstorecheck.exe
[已启用] \Microsoft\Windows\Application Experience\AitAgent
aitagent
[已启用] \Microsoft\Windows\Application Experience\ProgramDataUpdater
%windir%\system32\rundll32.exe aepdu.dll,AePduRunUpdate
[已启用] \Microsoft\Windows\Autochk\Proxy
%windir%\system32\rundll32.exe /d acproxy.dll,PerformAutochkOperations
[已启用] \Microsoft\Windows\Bluetooth\UninstallDeviceTask
BthUdTask.exe $(Arg0)
[已启用] \Microsoft\Windows\CertificateServicesClient\SystemTask
N/A
[已启用] \Microsoft\Windows\CertificateServicesClient\UserTask
N/A
[已禁用] \Microsoft\Windows\CertificateServicesClient\UserTask-Roam
N/A
[已启用] \Microsoft\Windows\Customer Experience Improvement Program\Consolidator
%SystemRoot%\System32\wsqmcons.exe
[已启用] \Microsoft\Windows\Defrag\ScheduledDefrag
%windir%\system32\defrag.exe -c
[已启用] \Microsoft\Windows\Location\Notifications
%windir%\System32\LocationNotifications.exe
[已启用] \Microsoft\Windows\Maintenance\WinSAT
N/A
[已启用] \Microsoft\Windows\Media Center\ActivateWindowsSearch
%SystemRoot%\ehome\ehPrivJob.exe /DoActivateWindowsSearch
[已启用] \Microsoft\Windows\Media Center\ConfigureInternetTimeService
%SystemRoot%\ehome\ehPrivJob.exe /DoConfigureInternetTimeService
[已启用] \Microsoft\Windows\Media Center\DispatchRecoveryTasks
%SystemRoot%\ehome\ehPrivJob.exe /DoRecoveryTasks $(Arg0)
[已启用] \Microsoft\Windows\Media Center\ehDRMInit
%SystemRoot%\ehome\ehPrivJob.exe /DRMInit
[已启用] \Microsoft\Windows\Media Center\InstallPlayReady
%SystemRoot%\ehome\ehPrivJob.exe /InstallPlayReady $(Arg0)
[已启用] \Microsoft\Windows\Media Center\mcupdate
%SystemRoot%\ehome\mcupdate $(Arg0)
[已启用] \Microsoft\Windows\Media Center\MediaCenterRecoveryTask
%SystemRoot%\ehome\mcupdate.exe -MediaCenterRecoveryTask
[已启用] \Microsoft\Windows\Media Center\MediaCenterRecoveryTask
%SystemRoot%\ehome\mcupdate.exe -MediaCenterRecoveryTask
[已启用] \Microsoft\Windows\Media Center\ObjectStoreRecoveryTask
%SystemRoot%\ehome\mcupdate.exe -ObjectStoreRecoveryTask
[已启用] \Microsoft\Windows\Media Center\ObjectStoreRecoveryTask
%SystemRoot%\ehome\mcupdate.exe -ObjectStoreRecoveryTask
[已启用] \Microsoft\Windows\Media Center\OCURActivate
%SystemRoot%\ehome\ehPrivJob.exe /OCURActivate
[已启用] \Microsoft\Windows\Media Center\OCURDiscovery
%SystemRoot%\ehome\ehPrivJob.exe /OCURDiscovery $(Arg0)
[已启用] \Microsoft\Windows\Media Center\PBDADiscovery
%SystemRoot%\ehome\ehPrivJob.exe /PBDADiscovery
[已启用] \Microsoft\Windows\Media Center\PBDADiscoveryW1
%SystemRoot%\ehome\ehPrivJob.exe /wait:7 /PBDADiscovery
[已启用] \Microsoft\Windows\Media Center\PBDADiscoveryW2
%SystemRoot%\ehome\ehPrivJob.exe /wait:90 /PBDADiscovery
[已禁用] \Microsoft\Windows\Media Center\PeriodicScanRetry
%windir%\ehome\MCUpdate.exe -pscn 0
[已启用] \Microsoft\Windows\Media Center\PvrRecoveryTask
%SystemRoot%\ehome\mcupdate.exe -PvrRecoveryTask
[已启用] \Microsoft\Windows\Media Center\PvrRecoveryTask
%SystemRoot%\ehome\mcupdate.exe -PvrRecoveryTask
[已启用] \Microsoft\Windows\Media Center\PvrScheduleTask
%SystemRoot%\ehome\mcupdate.exe -PvrSchedule
[已启用] \Microsoft\Windows\Media Center\PvrScheduleTask
%SystemRoot%\ehome\mcupdate.exe -PvrSchedule
[已禁用] \Microsoft\Windows\Media Center\RecordingRestart
%SystemRoot%\ehome\ehrec /RestartRecording
[已启用] \Microsoft\Windows\Media Center\RegisterSearch
%SystemRoot%\ehome\ehPrivJob.exe /DoRegisterSearch $(Arg0)
[已启用] \Microsoft\Windows\Media Center\ReindexSearchRoot
%SystemRoot%\ehome\ehPrivJob.exe /DoReindexSearchRoot
[已启用] \Microsoft\Windows\Media Center\SqlLiteRecoveryTask
%SystemRoot%\ehome\mcupdate.exe -SqlLiteRecoveryTask
[已启用] \Microsoft\Windows\Media Center\SqlLiteRecoveryTask
%SystemRoot%\ehome\mcupdate.exe -SqlLiteRecoveryTask
[已启用] \Microsoft\Windows\Media Center\UpdateRecordPath
%SystemRoot%\ehome\ehPrivJob.exe /DoUpdateRecordPath $(Arg0)
[已启用] \Microsoft\Windows\MobilePC\HotStart
N/A
[已启用] \Microsoft\Windows\MUI\LPRemove
%windir%\system32\lpremove.exe
[已启用] \Microsoft\Windows\Multimedia\SystemSoundsService
N/A
[已启用] \Microsoft\Windows\NetTrace\GatherNetworkInfo
%windir%\system32\gatherNetworkInfo.vbs
[已禁用] \Microsoft\Windows\Offline Files\Background Synchronization
N/A
[已禁用] \Microsoft\Windows\Offline Files\Logon Synchronization
N/A
[已启用] \Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem
%SystemRoot%\System32\powercfg.exe -energy -auto
[已启用] \Microsoft\Windows\Ras\MobilityManager
N/A
[已禁用] \Microsoft\Windows\SideShow\AutoWake
N/A
[已启用] \Microsoft\Windows\SideShow\GadgetManager
N/A
[已禁用] \Microsoft\Windows\SideShow\SessionAgent
N/A
[已禁用] \Microsoft\Windows\SideShow\SystemDataProviders
N/A
[已启用] \Microsoft\Windows\SystemRestore\SR
%windir%\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation
[已启用] \Microsoft\Windows\Tcpip\IpAddressConflict1
%windir%\system32\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPOffendingSystem
[已启用] \Microsoft\Windows\Tcpip\IpAddressConflict2
%windir%\system32\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPDefendingSystem
[已启用] \Microsoft\Windows\Time Synchronization\SynchronizeTime
%windir%\system32\sc.exe start w32time task_started
[已启用] \Microsoft\Windows\UPnP\UPnPHostConfig
sc.exe config upnphost start= auto
[已禁用] \Microsoft\Windows\User Profile Service\HiveUploadTask
N/A
[已启用] \Microsoft\Windows\Windows Error Reporting\QueueReporting
%windir%\system32\wermgr.exe -queuereporting
[已启用] \Microsoft\Windows\Windows Media Sharing\UpdateLibrary
"%ProgramFiles%\Windows Media Player\wmpnscfg.exe"
[已启用] \Microsoft\Windows\WindowsBackup\ConfigNotification
%systemroot%\System32\sdclt.exe /CONFIGNOTIFICATION
[已禁用] \Microsoft\Windows\WindowsColorSystem\Calibration Loader
N/A

==================================
Windows 安全更新检查
KB972813, 西班牙语语言包 - Windows 7 (KB972813)
KB972813, 希腊语语言包 - Windows 7 (KB972813)
KB972813, 立陶宛语语言包 - Windows 7 (KB972813)
KB972813, 阿拉伯语语言包 - Windows 7 (KB972813)
KB972813, 瑞典语语言包 - Windows 7 (KB972813)
KB972813, 德语语言包 - Windows 7 (KB972813)
KB972813, 斯洛伐克语语言包 - Windows 7 (KB972813)
KB972813, 乌克兰语语言包 - Windows 7 (KB972813)
KB972813, 繁体中文语言包 - Windows 7 (KB972813)
KB972813, 挪威语语言包 - Windows 7 (KB972813)
KB972813, 爱沙尼亚语语言包 - Windows 7 (KB972813)
KB972813, 捷克语语言包 - Windows 7 (KB972813)
KB972813, 斯洛文尼亚语语言包 - Windows 7 (KB972813)
KB972813, 日语语言包 - Windows 7 (KB972813)
KB972813, 法语语言包 - Windows 7 (KB972813)
KB972813, 英语语言包 - Windows 7 (KB972813)
KB972813, 罗马尼亚语语言包 - Windows 7 (KB972813)
KB972813, 波兰语语言包 - Windows 7 (KB972813)
KB972813, 泰语语言包 - Windows 7 (KB972813)
KB972813, 保加利亚语语言包 - Windows 7 (KB972813)
KB972813, 俄语语言包 - Windows 7 (KB972813)
KB972813, 克罗地亚语语言包 - Windows 7 (KB972813)
KB972813, 塞尔维亚语（拉丁语）语言包 - Windows 7 (KB972813)
KB972813, 葡萄牙语（葡萄牙）语言包 - Windows 7 (KB972813)
KB972813, 朝鲜语语言包 - Windows 7 (KB972813)
KB972813, 意大利语语言包 - Windows 7 (KB972813)
KB972813, 匈牙利语语言包 - Windows 7 (KB972813)
KB972813, 土耳其语语言包 - Windows 7 (KB972813)
KB972813, 丹麦语语言包 - Windows 7 (KB972813)
KB972813, 芬兰语语言包 - Windows 7 (KB972813)
KB972813, 拉脱维亚语语言包 - Windows 7 (KB972813)
KB972813, 希伯来语语言包 - Windows 7 (KB972813)
KB972813, 荷兰语语言包 - Windows 7 (KB972813)
KB972813, 葡萄牙语（巴西）语言包 - Windows 7 (KB972813)
KB890830, Windows 恶意软件删除工具 - 2009 年 10 月 (KB890830)

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================

[/CODE]

瑞星卡卡安全论坛