2004-02-02,22:20:23 System Repair Engineer 2.6.12.1018 Smallfrogs (http://www.KZTechs.com) Windows 2000 Professional Service Pack 4 (Build 2195) - 管理权限用户 - 完整功能 以下内容被选中： 所有的启动项目（包括注册表、启动文件夹、服务等） 浏览器加载项 正在运行的进程（包括进程模块信息） 文件关联 Winsock 提供者 Autorun.inf HOSTS 文件 进程特权扫描 启动项目 注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] (Internat.exe)(Internat.exe) [(Verified)Microsoft Windows 2000 Publisher] (eMuleAutoStart)(C:\Program Files\eMule\eMule.exe -AutoStart) [(Verified)"Shanghai Source Networking Technology Co., Ltd"] (DAEMON Tools Lite)("C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun) [(Verified)DAEMON Tools Code Signing Services] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] (load)() [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] (Synchronization Manager)(mobsync.exe /logon) [(Verified)Microsoft Windows 2000 Publisher] (ATIPTA)(C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe) [ATI Technologies, Inc.] (SoundMan)(SOUNDMAN.EXE) [Realtek Semiconductor Corp.] (RavTask)("C:\Program Files\Rising\Rav\RavTask.exe" -system) [(Verified)Beijing Rising Information Technology Corporation Limited] (RfwMain)("C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup) [(Verified)Beijing Rising Information Technology Corporation Limited] (TkBellExe)("C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot) [RealNetworks, Inc.] (IdnMail)(C:\WINNT\system32\IdnMail.exe) [CNNIC] (WangWang)("C:\Program Files\Alisoft\WangWang\WangWang.EXE") [(Verified)"Alibaba Software(Shanghai)Co,. Ltd"] (QuickTime Task)("C:\Program Files\QuickTime\qttask.exe" -atboottime) [Apple Computer, Inc.] (iTunesHelper)("C:\Program Files\iTunes\iTunesHelper.exe") [(Verified)"Apple Computer, Inc."] (CertificateRegistration)(SafeSignCertReg.exe) [A.E.T. Europe B.V.] (runeip)("C:\Program Files\Rising\AntiSpyware\rstray.exe" /startup) [(Verified)Beijing Rising Information Technology Corporation Limited] (Google IME Autoupdater)("C:\Program Files\Google\Google Pinyin\GooglePinyinDaemon.exe") [(Verified)Google Inc] (checkinstall)(C:\Program Files\ICBCPe~1\ICBC\BHDC(Personal)\CheckInstall.exe) [File is missing] (MenuOrder)(C:\Program Files\ICBCPe~1\ICBC\BHDC(Personal)\MenuOrder\MenuOrder.exe) [File is missing] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] (shell)(Explorer.exe) [(Verified)Microsoft Windows 2000 Publisher] (Userinit)(C:\WINNT\system32\userinit.exe,) [(Verified)Microsoft Windows 2000 Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] (AppInit_DLLs)(kmon.dll) [(Verified)Beijing Rising Information Technology Corporation Limited] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] ({32CD708B-60A7-4C00-9377-D73EAA495F0F})(C:\WINNT\system32\RavExt.dll) [(Verified)Beijing Rising Information Technology Corporation Limited] ({AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A})() [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\){26923b43-4d38-484f-9b9e-de460746276c}] (Internet Explorer 访问)("%SystemRoot%\system32\shmgrate.exe" OCInstallUserConfigIE) [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\){881dd1c5-3dcf-431b-b061-f3f88e8be88a}] (Outlook Express 访问)("%SystemRoot%\system32\shmgrate.exe" OCInstallUserConfigOE) [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] (Microsoft Outlook Express 6)("%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install) [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] (NetMeeting 3.01)(rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT) [(Verified)Microsoft Windows 2000 Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] (Microsoft Windows Media Player)(rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\wmp.inf,PerUserStub) [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] (Address Book 5)("%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install) [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] (CRLUpdate)(%SystemRoot%\system32\updcrl.exe -e -u %SystemRoot%\system32\verisignpub1.crl) [File is missing] -------------------------------------------------------------------------------- 启动文件夹 [3JSGX] (C:\Documents and Settings\All Users\「开始」菜单\程序\启动\3JSGX.lnk --) C:\WINNT\B257MD~1.EXE [Kaspersky Lab])(H) [Adobe Gamma Loader] (C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Gamma Loader.lnk --) C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [Adobe Systems, Inc.])(N) [KZVM0] (C:\Documents and Settings\All Users\「开始」菜单\程序\启动\KZVM0.lnk --) C:\WINNT\8NAK5VS.exe [Kaspersky Lab])(H) [Q98O02VHGJK] (C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Q98O02VHGJK.lnk --) C:\WINNT\IN4R9Y~1.EXE [Kaspersky Lab])(H) [ZKR3NP] (C:\Documents and Settings\All Users\「开始」菜单\程序\启动\ZKR3NP.lnk --) C:\WINNT\DVKL76.exe [Kaspersky Lab])(H) [书报递送] (C:\Documents and Settings\All Users\「开始」菜单\程序\启动\书报递送.lnk --) D:\看电子书\Delivery.exe [上海翠珑文化传播有限公司])(N) [腾讯QQ] (C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\腾讯QQ.lnk --) C:\PROGRA~1\Tencent\qq\QQ.exe [TENCENT])(N) -------------------------------------------------------------------------------- 服务 [Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start] (C:\WINNT\system32\Ati2evxx.exe)() [ATI Smart / ATI Smart][Stopped/Auto Start] (C:\WINNT\system32\ati2sgag.exe)() [Contrl Center of Storm Media / ccosm][Running/Auto Start] (C:\Program Files\StormII\stormliv.exe /asservice)(北京暴风网际科技有限公司) [Cmb WebProtect Support / CMBWPS][Running/Auto Start] (C:\Program Files\CMBCHINA\WebProtect\WPService.exe /start)(China Merchants Bank) [Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start] (C:\WINNT\System32\dmadmin.exe /com)(VERITAS Software Corp.) [Event Lo / Event Lo][Running/Auto Start] (C:\WINNT\mstsc)(N/A) [Google Updater Service / gusvc][Stopped/Manual Start] ("C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe")(Google) [Indexings Service / Indexings Service][Stopped/Auto Start] (C:\Program Files\Common Files\Microsoft Shared\MSInfo\skynet.exe)(N/A) [iPod Service / iPod Service][Running/Manual Start] ("C:\Program Files\iPod\bin\iPodService.exe")(Apple Computer, Inc.) [Rising Proxy Service / RfwProxySrv][Running/Auto Start] (C:\Program Files\Rising\Rfw\rfwProxy.exe)(Beijing Rising Information Technology Co., Ltd.) [Rising Personal Firewall Service / RfwService][Running/Auto Start] (C:\Program Files\Rising\Rfw\rfwsrv.exe)(Beijing Rising Information Technology Co., Ltd.) [Rising Process Communication Center / RsCCenter][Running/Auto Start] ("C:\Program Files\Rising\Rav\CCenter.exe")(Beijing Rising Information Technology Co., Ltd.) [Rising RealTime Monitor / RsRavMon][Stopped/Auto Start] ("C:\PROGRAM FILES\RISING\RAV\Ravmond.exe")(Beijing Rising Information Technology Co., Ltd.) [Ent58ComBackFx / WindowsEntMianFeiV08][Stopped/Auto Start] (C:\WINNT\360tray.exe)((File is missing)) [Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start] (C:\WINNT\System32\svchost.exe -k netsvcs--)C:\WINNT\system32\mspmsnsv.dll)(Microsoft Corporation) -------------------------------------------------------------------------------- 驱动程序 [LK5T4QBL8 / 9YVUCSLV][Stopped/Manual Start] (\??\C:\WINNT\T559LIFB60S.tmp)(N/A) [Service for WDM 3D Audio Driver / ALCXSENS][Running/Manual Start] (system32\drivers\ALCXSENS.SYS)(Sensaura Ltd) [Service for Realtek AC97 Audio (WDM) / ALCXWDM][Stopped/Manual Start] (system32\drivers\ALCXWDM.SYS)(Realtek Semiconductor Corp.) [ati2mtag / ati2mtag][Running/Manual Start] (system32\DRIVERS\ati2mtag.sys)(ATI Technologies Inc.) [atksgt / atksgt][Running/Auto Start] (system32\DRIVERS\atksgt.sys)(N/A) [dmboot / dmboot][Stopped/Disabled] (System32\drivers\dmboot.sys)(VERITAS Software Corp.) [Logical Disk Manager Driver / dmio][Running/Boot Start] (\SystemRoot\System32\drivers\dmio.sys)(VERITAS Software Corp.) [dmload / dmload][Running/Boot Start] (\SystemRoot\System32\drivers\dmload.sys)(VERITAS Software Corp.) [usb Card Device / ft2kEnum][Running/Manual Start] (system32\DRIVERS\ic2kenum.sys)(OEM Corporation) [USB Chip Holder Service / GDBaseSmc][Running/Manual Start] (system32\DRIVERS\smccardb.sys)(OEM) [USB Chip Service / GD_USB][Stopped/Manual Start] (system32\DRIVERS\usbtoken.sys)() [GEARAspiWDM / GEARAspiWDM][Running/Manual Start] (System32\Drivers\GEARAspiWDM.sys)(GEAR Software Inc.) [WAN Miniport Driver For PPPoE Protocol / GNetPPPoE][Running/Manual Start] (system32\DRIVERS\PPPoE.SYS)(Guangdong Data Communications Network Co.Ltd.) [HookCont / HookCont][Running/System Start] (\SystemRoot\system32\drivers\HookCont.sys)(Beijing Rising Information Technology Co., Ltd.) [HookNtos / HookNtos][Running/System Start] (\SystemRoot\system32\drivers\HookNtos.sys)(Beijing Rising Information Technology Co., Ltd.) [HookReg / HookReg][Running/System Start] (\SystemRoot\system32\drivers\HookReg.sys)(Beijing Rising Information Technology Co., Ltd.) [HookSys / HookSys][Running/System Start] (\SystemRoot\system32\drivers\HookSys.sys)(Beijing Rising Information Technology Co., Ltd.) [HookUrl / HookUrl][Running/Auto Start] (\??\C:\Program Files\Rising\Rfw\HookUrl.sys)(Beijing Rising Information Technology Co., Ltd.) [LibUsb-Win32 - Kernel Driver 11/20/2005, 20051120 / libusb0][Stopped/Manual Start] (system32\DRIVERS\libusb0.sys)(http://libusb-win32.sourceforge.net) [lirsgt / lirsgt][Running/Auto Start] (system32\DRIVERS\lirsgt.sys)(N/A) [Netgroup Packet Filter / NPF][Stopped/Manual Start] (system32\drivers\npf.sys)(Politecnico di Torino) [nvatabus / nvatabus][Running/Boot Start] (\SystemRoot\system32\DRIVERS\nvatabus.sys)(NVIDIA Corporation) [Service for NVIDIA(R) nForce(TM) Audio Enumerator / nvax][Running/Manual Start] (system32\drivers\nvax.sys)(NVIDIA Corporation) [NVIDIA nForce MCP Networking Controller Driver / NVENET][Running/Manual Start] (system32\DRIVERS\NVENET.sys)(NVIDIA Corporation) [Service for NVIDIA(R) nForce(TM) Audio / nvnforce][Running/Manual Start] (system32\drivers\nvapu.sys)(NVIDIA Corporation) [NVIDIA nForce AGP Bus Filter / nv_agp][Running/Boot Start] (\SystemRoot\system32\DRIVERS\nv_agp.sys)(NVIDIA Corporation) [24OVEXTX1F / PIK3JLSI4L][Stopped/Manual Start] (\??\C:\WINNT\H3X29VCCMJ.tmp)(N/A) [Direct Parallel Link Driver / Ptilink][Running/Manual Start] (system32\DRIVERS\ptilink.sys)(Parallel Technologies, Inc.) [SmartCard Reader Device / Reader_Device][Running/Manual Start] (system32\DRIVERS\usbic2k.sys)(OEM) [Rising Rfwbase Driver / RfwBase][Running/Auto Start] (System32\DRIVERS\rfwbase.SYS)(Beijing Rising Information Technology Co., Ltd.) [WAN Miniport (PPP over Ethernet Protocol) / RMSPPPOE][Running/Manual Start] (system32\DRIVERS\RMSPPPOE.SYS)(Robert Schlabbach) [RsAntiSpyware / RsAntiSpyware][Running/Boot Start] (\SystemRoot\system32\drivers\RsBoot.sys)(Beijing Rising Technology Co., Ltd.) [RsFwDrv / RsFwDrv][Running/System Start] (\??\C:\Program Files\Rising\Rfw\RsFwDrv.sys)(Beijing Rising Information Technology Co., Ltd.) [RsNTGDI / RsNTGDI][Running/Boot Start] (\SystemRoot\system32\Drivers\RsNTGdi.sys)(Beijing Rising Information Technology Co., Ltd.) [SetupNT / SetupNT][Running/Auto Start] (\SystemRoot\system32\SetupNT.sys)(N/A) [sptd / sptd][Running/Boot Start] (\SystemRoot\System32\Drivers\sptd.sys)(N/A) [Z06QDRLK5COA / U9UW04][Stopped/Manual Start] (\??\C:\WINNT\Q8P5QF.tmp)(N/A) [usbvmx86 / usbvmx86][Stopped/System Start] (\??\C:\WINNT\system32drivers\usbvmx86.sys)(N/A) [G52JHFU54M / WAJ1W9J][Stopped/Manual Start] (\??\C:\WINNT\HD021VFA0TLQ.tmp)(N/A) -------------------------------------------------------------------------------- 浏览器加载项 [ThunderAtOnce Class] {01443AEC-0FD1-40fd-9C87-E93D1494C233} (C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll, (Signed) Thunder Networking Technologies,LTD) [AddTask Class] {24F06550-65E3-4D1C-8CFE-839C296B5530} (C:\Program Files\eREAD\IEeREAD.dll, ) [BitComet Helper] {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} (C:\Program Files\BitComet\tools\BitCometBHO_1.2.6.26.dll, (Signed) BitComet) [VnetCookie Class] {4E83D567-4697-4F7B-B1F0-A513B01DB89A} (c:\PROGRA~1\chinanet\VNETTR~1.DLL, ) [WebProtect] {53763D1D-9CA8-4C7C-9756-A8E6B8FC063B} (C:\Program Files\CMBCHINA\WebProtect\WebProtect.dll, (Signed) China Merchants Bank) [Thunder Browser Helper] {889D2FEB-5411-4565-8998-1DD2C5261283} (C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll, (Signed) Thunder Networking Technologies,LTD) [卡卡上网安全助手] {98B7C13A-E9CD-4959-8B46-FBEAB41E42A8} (C:\WINNT\system32\UrlFilter.dll, (Signed) Beijing Rising Information Technology Co., Ltd.) [Google Toolbar Helper] {AA58ED58-01DD-4d91-8333-CF10577473F7} (c:\program files\google\googletoolbar2.dll, (Signed) Google Inc.) [Google Toolbar Notifier BHO] {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, (Signed) Google Inc.) [启动迅雷5] {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} (C:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD) [] {35980F6E-A137-4E50-953D-813BB8556899} (, ) [@shdoclc.dll,-866] {c95fe080-8f5d-11d2-a20b-00aa003c157a} (, ) [BitComet] {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} (, ) [@msdxmLC.dll,-1@2052,电台(&R)] {8E718888-423F-11D2-876E-00A0C9082467} (C:\WINNT\system32\msdxm.ocx, (Signed) Microsoft Corporation) [DAEMON Tools Toolbar] {32099AAC-C132-4136-9E9A-4E364A424E17} (C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll, (Signed) ) [&Google] {2318C2B1-4965-11d4-9B18-009027A5CD4F} (c:\program files\google\googletoolbar2.dll, (Signed) Google Inc.) [GDGetTokenInfo Class] {3AA9CF07-DF20-48FF-98BE-DED276E40146} (C:\WINNT\system32\GDREAD~1.DLL, ) [EditCtrl Class] {488A4255-3236-44B3-8F27-FA1AECAA8844} (C:\WINNT\system32\aliedit\aliedit.dll, (Signed) ) [InfoSecNetSign Class] {5CB840B5-A94E-4AD9-B785-4866E3B04476} (C:\WINNT\DOWNLO~1\ICBCNE~1.DLL, (Signed) Infosec Technologies Co., Ltd.) [AxInputControl Class] {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (C:\WINNT\system32\INPUTC~1.DLL, ) [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} (C:\Program Files\IVMLAB\IVMDecoder\Flash9f.ocx, (Signed) Adobe Systems, Inc.) [Thunder Agent Class] {485463B7-8FB2-4B3B-B29B-8B919B0EACCE} (C:\Program Files\Thunder Network\Thunder\ComDlls\ThunderAgent_Now.dll, (Signed) Thunder Networking Technologies,LTD) [XMP Class] {6483F145-A768-4C41-AACC-52D4D7845851} (C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xplayer.dll_1_work, ) [XDRM] {693571CB-54A3-4E90-9D52-EEAE1334E2D3} (C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xdrm.dll_1_work, ) [WangWangObj Class] {6E213FC7-DD5A-4115-B7E6-D4C7838C361E} (C:\Program Files\Alisoft\WangWang\WangWangX6.dll, (Signed) 阿里巴巴软件(上海)有限公司) [MediaComm Class] {7670648D-461B-42AF-BDFE-46D26AF5EFF2} (C:\Program Files\Thunder Network\Thunder\Components\InMedia\MediaAddin17.dll, Thunder Networking Technologies,LTD) [DapCtrl Class] {ACACC6EB-1FBA-4E13-A729-53AEB2DF54F8} (C:\Program Files\Common Files\Thunder Network\KanKan\DapCtrl.2.1.5803.60.(131).dll, ShenZhen Thunder Networking Technologies Ltd.) [Thunder DapPlayer] {EEDD6FF9-13DE-496B-9A1C-D78B3215E266} (C:\Program Files\Thunder Network\Thunder\Components\DownAndPlay\DapPlayer3.0.5712.71.131.dll, ShenZhen Thunder Networking Technologies Ltd.) [XPPlayer Class] {F3E70CEA-956E-49CC-B444-73AFE593AD7F} (C:\Program Files\Common Files\Thunder Network\KanKan\PPlayer.2.0.0.181.(132).dll, Xunlei Networking Technologies,LTD) [&使用BitComet下载] (res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm, N/A) [&使用BitComet下载全部链接] (res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm, N/A) [&使用BitComet下载本页视频] (res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm, N/A) [使用迅雷下载] (C:\Program Files\Thunder Network\Thunder\Program\geturl.htm, N/A) [使用迅雷下载全部链接] (C:\Program Files\Thunder Network\Thunder\Program\getallurl.htm, N/A) [添加到QQ表情] (C:\Program Files\Tencent\qq\AddEmotion.htm, N/A) -------------------------------------------------------------------------------- 正在运行的进程 [PID: 160][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.00.2195.6601] [PID: 184][\??\C:\WINNT\system32\csrss.exe] [Microsoft Corporation, 5.00.2195.6601] [C:\Program Files\Rising\Rfw\ijt_base.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.21] [C:\Program Files\Rising\Rfw\olemon.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.9] [PID: 204][\??\C:\WINNT\system32\winlogon.exe] [Microsoft Corporation, 5.00.2195.6970] [C:\Program Files\Rising\Rfw\ijt_base.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.21] [C:\Program Files\Rising\Rfw\olemon.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.9] [C:\WINNT\system32\wdmaud.drv] [Microsoft Corporation, 5.00.2195.6673] [C:\WINNT\system32\Ati2evxx.dll] [, ] [C:\WINNT\system32\msacm32.drv] [Microsoft Corporation, 5.00.2134.1] [PID: 232][C:\WINNT\system32\services.exe] [Microsoft Corporation, 5.00.2195.6700] [C:\Program Files\Rising\Rfw\ijt_base.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.21] [C:\Program Files\Rising\Rfw\olemon.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.9] [C:\WINNT\system32\dmserver.dll] [VERITAS Software Corp., 2195.6605.297.3] [PID: 244][C:\WINNT\system32\lsass.exe] [Microsoft Corporation, 5.00.2195.6902] [C:\Program Files\Rising\Rfw\ijt_base.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.21] [C:\Program Files\Rising\Rfw\olemon.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.9] [PID: 372][C:\WINNT\System32\SCardSvr.exe] [Microsoft Corporation, 5.00.2195.6609] [C:\WINNT\System32\kmon.dll] [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 21] [C:\Program Files\Rising\Rfw\ijt_base.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.21] [C:\Program Files\Rising\Rfw\olemon.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.9] [PID: 392][C:\WINNT\system32\Ati2evxx.exe] [, ] [C:\WINNT\system32\kmon.dll] [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 21] [C:\Program Files\Rising\Rfw\ijt_base.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.21] [C:\Program Files\Rising\Rfw\olemon.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.9] [PID: 624][C:\Program Files\Rising\Rfw\rfwstub.exe] [Beijing Rising Information Technology Co., Ltd., 7.0.0.12] [C:\WINNT\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\WINNT\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\WINNT\system32\kmon.dll] [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 21] [C:\Program Files\Rising\Rfw\RSCOMMON.DLL] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 17] [C:\Program Files\Rising\Rfw\ijt_base.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.21] [C:\Program Files\Rising\Rfw\olemon.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.9] [PID: 812][C:\PROGRAM FILES\RISING\RAV\RavStub.exe] [Beijing Rising Information Technology Co., Ltd., 20.0.0.10] [C:\PROGRAM FILES\RISING\RAV\ProcCom.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 20] [C:\PROGRAM FILES\RISING\RAV\RsCommX2.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 20] [C:\PROGRAM FILES\RISING\RAV\RSCOMMON.DLL] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 17] [C:\Program Files\Rising\Rfw\ijt_base.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.21] [C:\Program Files\Rising\Rfw\olemon.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.9] [PID: 872][C:\WINNT\system32\svchost.exe] [Microsoft Corporation, 5.00.2134.1] [C:\Program Files\Rising\Rfw\ijt_base.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.21] [C:\Program Files\Rising\Rfw\olemon.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.9] [PID: 900][C:\WINNT\system32\spoolsv.exe] [Microsoft Corporation, 5.00.2195.7059] [C:\Program Files\Rising\Rfw\ijt_base.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.21] [C:\Program Files\Rising\Rfw\olemon.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.9] [PID: 952][C:\Program Files\StormII\stormliv.exe] [北京暴风网际科技有限公司, 3, 8, 6, 20] [C:\Program Files\StormII\MSVCP60.dll] [Microsoft Corporation, 6.02.3104.0] [C:\WINNT\system32\kmon.dll] [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 21] [C:\WINNT\system32\msxml3.dll] [Microsoft Corporation, 8.70.1113.0] [C:\Program Files\Rising\Rfw\ijt_base.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.21] [C:\Program Files\Rising\Rfw\olemon.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.9] [PID: 968][C:\Program Files\CMBCHINA\WebProtect\WPService.exe] [China Merchants Bank, 1, 0, 0, 1] [C:\WINNT\system32\kmon.dll] [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 21] [C:\Program Files\CMBCHINA\WebProtect\WebProtectPlus.dll] [China Merchants Bank, 1, 0, 0, 1] [C:\Program Files\Rising\Rfw\ijt_base.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.21] [C:\Program Files\Rising\Rfw\olemon.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.9] [PID: 992][C:\WINNT\mstsc] [N/A, ] [C:\WINNT\system32\kmon.dll] [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 21] [C:\WINNT\system32\wdmaud.drv] [Microsoft Corporation, 5.00.2195.6673] [C:\WINNT\system32\msacm32.drv] [Microsoft Corporation, 5.00.2134.1] [C:\Program Files\Rising\Rfw\ijt_base.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.21] [C:\Program Files\Rising\Rfw\olemon.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.9] [PID: 1004][C:\WINNT\system32\svchost.exe] [Microsoft Corporation, 5.00.2134.1] [C:\WINNT\system32\unimdm.tsp] [Microsoft Corporation, 5.00.2195.6601] [C:\WINNT\system32\kmddsp.tsp] [Microsoft Corporation, 5.00.2150.1] [C:\WINNT\system32\ndptsp.tsp] [Microsoft Corporation, 5.00.2143.1] [C:\WINNT\system32\ipconf.tsp] [Microsoft Corporation, 5.00.2143.1] [C:\WINNT\system32\h323.tsp] [Microsoft Corporation, 5.00.2195.6901] [C:\Program Files\Rising\Rfw\ijt_base.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.21] [C:\Program Files\Rising\Rfw\olemon.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.9] [PID: 1068][C:\WINNT\system32\regsvc.exe] [Microsoft Corporation, 5.00.2195.6701] [C:\Program Files\Rising\Rfw\ijt_base.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.21] [C:\WINNT\system32\kmon.dll] [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 21] [C:\Program Files\Rising\Rfw\olemon.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.9] [PID: 1108][C:\WINNT\system32\MSTask.exe] [Microsoft Corporation, 4.71.2195.6920] [C:\WINNT\system32\kmon.dll] [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 21] [C:\Program Files\Rising\Rfw\ijt_base.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.21] [C:\Program Files\Rising\Rfw\olemon.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.9] [PID: 1168][C:\WINNT\system32\stisvc.exe] [Microsoft Corporation, 5.00.2195.6656] [C:\WINNT\system32\kmon.dll] [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 21] [C:\Program Files\Rising\Rfw\ijt_base.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.21] [C:\Program Files\Rising\Rfw\olemon.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.9] [PID: 1228][C:\WINNT\System32\WBEM\WinMgmt.exe] [Microsoft Corporation, 1.50.1085.0100] [C:\WINNT\system32\kmon.dll] [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 21] [C:\Program Files\Rising\Rfw\ijt_base.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.21] [C:\Program Files\Rising\Rfw\olemon.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.9] [PID: 1240][C:\WINNT\system32\svchost.exe] [Microsoft Corporation, 5.00.2134.1] [C:\Program Files\Rising\Rfw\ijt_base.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.21] [C:\Program Files\Rising\Rfw\olemon.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.9] [PID: 1552][C:\WINNT\system32\Ati2evxx.exe] [, ] [C:\WINNT\system32\kmon.dll] [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 21] [C:\Program Files\Rising\Rfw\ijt_base.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.21] [C:\Program Files\Rising\Rfw\olemon.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.9] [PID: 1568][C:\WINNT\Explorer.EXE] [Microsoft Corporation, 5.00.3700.6690] [C:\WINNT\AppPatch\AcLayers.DLL] [Microsoft Corporation, 5.00.2195.6717] [C:\WINNT\system32\kmon.dll] [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 21] [C:\Program Files\Rising\Rfw\ijt_base.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.21] [C:\Program Files\Rising\Rfw\olemon.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.9] [C:\WINNT\system32\wdmaud.drv] [Microsoft Corporation, 5.00.2195.6673] [C:\WINNT\system32\msacm32.drv] [Microsoft Corporation, 5.00.2134.1] [C:\WINNT\system32\RavExt.dll] [Beijing Rising Information Technology Co., Ltd., 20.0.0.18] [C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll] [Thunder Networking Technologies,LTD, 1.0.5.29] [C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 8, 96] [C:\Program Files\Thunder Network\Thunder\Components\ResWorker\DsBho_01.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 20] [C:\WINNT\system32\MSVCP60.dll] [Microsoft Corporation, 6.00.8972.0] [C:\Program Files\Thunder Network\Thunder\Components\ResWorker\DataProcessor_01.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 16] [C:\Program Files\WinRAR\rarext.dll] [N/A, ] [PID: 1748][C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe] [ATI Technologies, Inc., 6.14.10.5113] [C:\WINNT\system32\kmon.dll] [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 21] [C:\Program Files\Rising\Rfw\ijt_base.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.21] [C:\Program Files\Rising\Rfw\olemon.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.9] [C:\Program Files\ATI Technologies\ATI Control Panel\atipdsxx.dll] [ATI Technologies, Inc., 6.14.10.5113] [C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATRPUIXX.CHS] [ATI Technologies, Inc., 6.14.10.5113] [C:\Program Files\ATI Technologies\ATI Control Panel\atipdxxx.dll] [ATI Technologies, Inc., 6.14.10.5113] [C:\WINNT\system32\DINPUT8.dll] [Microsoft Corporation, 5.1.2600.881 built by: Lab06_N(mmbuild) ] [PID: 1788][C:\WINNT\SOUNDMAN.EXE] [Realtek Semiconductor Corp., 5.1.0.24] [C:\WINNT\system32\kmon.dll] [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 21] [C:\Program Files\Rising\Rfw\ijt_base.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.21] [C:\Program Files\Rising\Rfw\olemon.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.9] [PID: 1792][C:\Program Files\Rising\Rav\RavTask.exe] [Beijing Rising Information Technology Co., Ltd., 20.0.0.24] [C:\Program Files\Rising\Rav\ProcCom.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 20] [C:\Program Files\Rising\Rav\RsCommX2.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 20] [C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 17] [C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Information Technology Co., Ltd., 20.0.0.1] [C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Information Technology Co., Ltd., 20.0.0.19] [PID: 1872][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] [RealNetworks, Inc., 0.1.0.1622] [C:\WINNT\system32\kmon.dll] [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 21] [C:\Program Files\Rising\Rfw\ijt_base.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.21] [C:\Program Files\Rising\Rfw\olemon.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.9] [PID: 1964][C:\Program Files\iTunes\iTunesHelper.exe] [Apple Computer, Inc., 7.0.2.16] [C:\WINNT\system32\kmon.dll] [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 21] [C:\Program Files\Rising\Rfw\ijt_base.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.21] [C:\Program Files\Rising\Rfw\olemon.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.9] [C:\Program Files\iTunes\iTunesHelper.Resources\zh_CN.lproj\iTunesHelperLocalized.DLL] [Apple Computer, Inc., 7.0.2.1] [C:\Program Files\iTunes\iTunesHelper.Resources\iTunesHelper.DLL] [Apple Computer, Inc., 7.0.2.16] [PID: 1976][C:\WINNT\system32\SafeSignCertReg.exe] [A.E.T. Europe B.V., 2.0.0.2] [C:\WINNT\system32\kmon.dll] [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 21] [C:\Program Files\Rising\Rfw\ijt_base.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.21] [C:\Program Files\Rising\Rfw\olemon.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.9] [PID: 1980][C:\Program Files\Rising\AntiSpyware\rstray.exe] [Beijing Rising Information Technology Co., Ltd., 21.0.0.15] [C:\WINNT\system32\kmon.dll] [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 21] [C:\Program Files\Rising\AntiSpyware\rsmginfo.dll] [Beijing Rising Information Technology Co., Ltd., 21, 0, 0, 8] [C:\Program Files\Rising\AntiSpyware\RsXML.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 2] [C:\Program Files\Rising\AntiSpyware\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\Program Files\Rising\AntiSpyware\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\Program Files\Rising\AntiSpyware\ComServ.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.31] [C:\Program Files\Rising\AntiSpyware\Syslay.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.6] [C:\Program Files\Rising\AntiSpyware\rscommon.dll] [Beijing Rising Information Technology Co., Ltd., 20.0.1.1] [C:\Program Files\Rising\AntiSpyware\comx3.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.24] [C:\Program Files\Rising\AntiSpyware\pngdll.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 5] [C:\Program Files\Rising\AntiSpyware\runiep.dll] [Beijing Rising Information Technology Co., Ltd., 6.0.0.32] [C:\Program Files\Rising\Rav\ProcCom.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 20] [C:\Program Files\Rising\Rav\RsCommX2.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 20] [C:\WINNT\system32\RavExt.dll] [Beijing Rising Information Technology Co., Ltd., 20.0.0.18] [PID: 2004][C:\Program Files\Google\Google Pinyin\GooglePinyinDaemon.exe] [Google Inc., 1, 0, 0, 1] [C:\WINNT\system32\kmon.dll] [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 21] [C:\Program Files\Rising\Rfw\ijt_base.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.21] [C:\Program Files\Rising\Rfw\olemon.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.9] [C:\WINNT\system32\msxml3.dll] [Microsoft Corporation, 8.70.1113.0] [PID: 2020][C:\WINNT\system32\Internat.exe] [Microsoft Corporation, 5.00.2920.0000] [C:\WINNT\system32\kmon.dll] [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 21] [C:\Program Files\Rising\Rfw\ijt_base.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.21] [C:\Program Files\Rising\Rfw\olemon.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.9] [PID: 2052][C:\Program Files\iPod\bin\iPodService.exe] [Apple Computer, Inc., 7.0.2.16] [C:\WINNT\system32\kmon.dll] [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 21] [C:\Program Files\iPod\bin\iPodService.Resources\zh_CN.lproj\iPodServiceLocalized.DLL] [Apple Computer, Inc., 7.0.2.1] [C:\Program Files\iPod\bin\iPodService.Resources\iPodService.DLL] [Apple Computer, Inc., 7.0.2.16] [PID: 2300][C:\Program Files\Internet Explorer\Down(4273623).exe] [N/A, ] [C:\Program Files\Rising\Rfw\ijt_base.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.21] [C:\WINNT\system32\kmon.dll] [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 21] [C:\Program Files\Rising\AntiSpyware\comx3.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.24] [C:\Program Files\Rising\AntiSpyware\Syslay.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.6] [C:\Program Files\Rising\Rfw\olemon.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.9] [C:\WINNT\system32\MSVBVM60.DLL] [Microsoft Corporation, 6.00.9690] [PID: 2664][C:\Program Files\Maxthon2\Maxthon.exe] [Maxthon International ltd., 2, 1, 2, 649] [C:\Program Files\Maxthon2\mxpp.dll] [Maxthon International ltd., 1, 0, 0, 117] [C:\Program Files\Maxthon2\MxSk.dll] [Maxthon, 1, 0, 0, 358] [C:\WINNT\system32\MSVCP60.dll] [Microsoft Corporation, 6.00.8972.0] [C:\WINNT\system32\gdiplus.dll] [Microsoft Corporation, 5.1.3102.1360 (xpsp2.040109-1800)] [C:\Program Files\Maxthon2\MxProxy2.dll] [Maxthon International ltd., 1, 0, 0, 4033] [C:\Program Files\Maxthon2\MxExt.dll] [N/A, ] [C:\Program Files\Maxthon2\MxUI.dll] [Maxthon International, 3, 3, 0, 3] [C:\WINNT\system32\kmon.dll] [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 21] [C:\Program Files\Rising\AntiSpyware\comx3.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.24] [C:\Program Files\Rising\AntiSpyware\Syslay.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.6] [C:\Program Files\Maxthon2\mxtool.dll] [, 1, 0, 0, 1] [C:\Program Files\Maxthon2\maxzlib.dll] [, 1.2.3] [C:\WINNT\system32\msxml3.dll] [Microsoft Corporation, 8.70.1113.0] [C:\Program Files\Maxthon2\Modules\MxPageSearch\MxPageSearch.dll] [Maxthon International ltd., 1,0,0,1330] [C:\Program Files\Maxthon2\Modules\MxWebBoost\MxWebBoost.dll] [Maxthon, 1,0,2,1259] [C:\Program Files\Maxthon2\mxdb.dll] [Max, 3, 5, 3, 125] [C:\Program Files\Maxthon2\Modules\MxHistory\MxHistory.dll] [Maxthon International ltd., 1, 0, 0, 7] [C:\WINNT\system32\wdmaud.drv] [Microsoft Corporation, 5.00.2195.6673] [C:\WINNT\system32\msacm32.drv] [Microsoft Corporation, 5.00.2134.1] [C:\WINNT\system32\msadp32.acm] [Microsoft Corporation, 5.00.2134.1] [C:\Program Files\IVMLAB\IVMDecoder\Flash9f.ocx] [Adobe Systems, Inc., 9,0,124,0] [C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 8, 96] [C:\Program Files\Thunder Network\Thunder\ComDlls\ThunderAgent_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 4, 23] [C:\WINNT\system32\RavExt.dll] [Beijing Rising Information Technology Co., Ltd., 20.0.0.18] [PID: 2292][C:\Program Files\ChinaNet\VnetClient.exe] [, 2005, 6, 1, 1] [C:\Program Files\ChinaNet\Communicate.dll] [0, 2005, 3, 3, 1] [C:\Program Files\ChinaNet\DialModule.dll] [, 2005, 3, 22, 1] [C:\Program Files\ChinaNet\MFC42.DLL] [Microsoft Corporation, 6.00.8665.0] [C:\WINNT\system32\kmon.dll] [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 21] [C:\Program Files\Rising\AntiSpyware\comx3.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.24] [C:\Program Files\Rising\AntiSpyware\Syslay.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.6] [C:\Program Files\Rising\Rfw\ijt_base.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.21] [C:\Program Files\Rising\Rfw\olemon.dll] [Beijing Rising Information Technology Co., Ltd., 7.0.0.9] [C:\PROGRA~1\ChinaNet\CLIENT~1.DLL] [, 2004, 2, 28, 1] [C:\PROGRA~1\ChinaNet\PLUGIN~2.OCX] [, 2005, 7, 27, 1] [C:\PROGRA~1\ChinaNet\sign.dll] [0, 2004, 12, 1, 1] [C:\PROGRA~1\ChinaNet\PostPlug.dll] [, 2004, 12, 16, 2] [C:\PROGRA~1\ChinaNet\ADVERT~1.OCX] [, 2005, 6, 21, 1] [C:\PROGRA~1\ChinaNet\Gif89a.dll] [, 2005, 6, 21, 1] [C:\PROGRA~1\ChinaNet\VnetBs.ocx] [, 2004, 11, 18, 1] [C:\PROGRA~1\ChinaNet\ACCOUN~1.DLL] [, 2005, 8, 11, 1] [C:\PROGRA~1\ChinaNet\AccountMgr.dll] [, 2005, 8, 16, 1] [C:\PROGRA~1\ChinaNet\VnetSkin.ocx] [GDDC, 1, 0, 0, 1] [C:\PROGRA~1\ChinaNet\DialogStyle.dll] [, 1, 0, 0, 1] [C:\PROGRA~1\ChinaNet\Timer.ocx] [, 2005, 8, 4, 1] [C:\PROGRA~1\ChinaNet\PLUGIN~1.OCX] [, 2005, 2, 24, 1] [C:\PROGRA~1\ChinaNet\NEWMES~1.DLL] [, 2005, 8, 26, 1] [C:\PROGRA~1\ChinaNet\PassCtrl.dll] [, 1, 0, 0, 1] [C:\WINNT\system32\wpcap.dll] [Politecnico di Torino, 3, 0, 0, 18] [C:\WINNT\system32\pthreadVC.dll] [N/A, ] [C:\WINNT\system32\packet.dll] [Politecnico di Torino, 3, 0, 0, 18] [C:\PROGRA~1\ChinaNet\PlugPush.dll] [, 2004, 12, 21, 1] [C:\PROGRA~1\ChinaNet\ALLINT~1.DLL] [, 2004, 11, 23, 1] [C:\PROGRA~1\ChinaNet\VNETLO~1.OCX] [, 2005, 8, 10, 1] [C:\PROGRA~1\ChinaNet\StatNum.dll] [, 2004, 11, 18, 1] [C:\PROGRA~1\ChinaNet\VNETON~1.OCX] [, 2005, 3, 2, 1] [C:\PROGRA~1\ChinaNet\ALLFUN~1.DLL] [GDCN, 2005, 8, 26, 1] [C:\PROGRA~1\ChinaNet\VnetOptLog.dll] [, 2005, 8, 23, 17] [C:\WINNT\system32\wdmaud.drv] [Microsoft Corporation, 5.00.2195.6673] [C:\WINNT\system32\msacm32.drv] [Microsoft Corporation, 5.00.2134.1] [C:\WINNT\system32\msadp32.acm] [Microsoft Corporation, 5.00.2134.1] [C:\PROGRA~1\ChinaNet\DlgSkin.ocx] [, 1, 0, 0, 1] [C:\Program Files\IVMLAB\IVMDecoder\Flash9f.ocx] [Adobe Systems, Inc., 9,0,124,0] [PID: 2956][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.813\SREngLdr.EXE] [Smallfrogs Studio, 2.6.12.1018] [PID: 308][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.813\SRE3f1f747c.EXE] [Smallfrogs Studio, 2.6.12.1018] [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.813\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15] [C:\WINNT\system32\MSISIP.DLL] [Microsoft Corporation, 2.0.2600.1183] [C:\WINNT\system32\wshCHS.DLL] [Microsoft Corporation, 5.6.0.6626] -------------------------------------------------------------------------------- 文件关联 .TXT Error. [C:\WINNT\notepad.exe %1] .EXE OK. ["%1" %*] .COM OK. ["%1" %*] .PIF OK. ["%1" %*] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %*] .SCR OK. ["%1" /S] .CHM Error. ["hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI Error. [C:\WINNT\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .LNK OK. [{00021401-0000-0000-C000-000000000046}] -------------------------------------------------------------------------------- Winsock 提供者 N/A -------------------------------------------------------------------------------- Autorun.inf N/A -------------------------------------------------------------------------------- HOSTS 文件 127.0.0.1 localhost -------------------------------------------------------------------------------- 进程特权扫描 特殊特权被允许： SeLoadDriverPrivilege [PID = 992, C:\WINNT\MSTSC] 特殊特权被允许： SeDebugPrivilege [PID = 1552, C:\WINNT\SYSTEM32\ATI2EVXX.EXE] 特殊特权被允许： SeDebugPrivilege [PID = 1748, C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 1748, C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE] 特殊特权被允许： SeDebugPrivilege [PID = 1788, C:\WINNT\SOUNDMAN.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 1788, C:\WINNT\SOUNDMAN.EXE] 特殊特权被允许： SeDebugPrivilege [PID = 1872, C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 1872, C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE] 特殊特权被允许： SeDebugPrivilege [PID = 1976, C:\WINNT\SYSTEM32\SAFESIGNCERTREG.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 1976, C:\WINNT\SYSTEM32\SAFESIGNCERTREG.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 2300, C:\PROGRAM FILES\INTERNET EXPLORER\DOWN(4273623).EXE] 特殊特权被允许： SeSystemtimePrivilege [PID = 2300, C:\PROGRAM FILES\INTERNET EXPLORER\DOWN(4273623).EXE] 特殊特权被允许： SeDebugPrivilege [PID = 2292, C:\PROGRAM FILES\CHINANET\VNETCLIENT.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 2292, C:\PROGRAM FILES\CHINANET\VNETCLIENT.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 1952, C:\PROGRAM FILES\THUNDER NETWORK\THUNDER\PROGRAM\THUNDER5.EXE] 特殊特权被允许： SeDebugPrivilege [PID = 2956, C:\DOCUME~1\ADMINI~1\LOCALS~1\TEMP\RAR$EX00.813\SRENGLDR.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 2956, C:\DOCUME~1\ADMINI~1\LOCALS~1\TEMP\RAR$EX00.813\SRENGLDR.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 3064, C:\WINNT\SYSTEM32\GGGG38.EXE] 特殊特权被允许： SeSystemtimePrivilege [PID = 3064, C:\WINNT\SYSTEM32\GGGG38.EXE] -------------------------------------------------------------------------------- API HOOK N/A -------------------------------------------------------------------------------- 隐藏进程 N/A --------------------------------------------------------------------------------