[CODE]

2008-08-23,19:05:19

SysLog Scanner 1.0 - build 20080726
Arswp (http://www.arswp.com)

Windows XP Professional Service Pack 2 (build 2600) - Administrators



========================================
注册项

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <\\Kim\EPSON ME 2><C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBHC.EXE /FU "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E_S16.tmp" /EF "HKCU">  [SEIKO EPSON CORPORATION, 4.02, C:2008-01-12 13:56 M:2006-09-22 22:32]
    <MsWWinLm><C:\Program Files\wrkwn80\WORKWINLM.exe>  [Nanjing WangYa Computer Co . , Ltd ., 8.01, C:2008-02-19 21:02 M:2007-12-12 08:24]
    <\\Kim\EPSON ME 2 (副本 1)><C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBHC.EXE /FU "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E_S123.tmp" /EF "HKCU">  [SEIKO EPSON CORPORATION, 4.02, C:2008-01-12 13:56 M:2006-09-22 22:32]
    <Skype><; "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized>  [(Verified)Skype Technologies S.A., 3.6.4.171, C:2008-04-25 06:09 M:2008-04-25 06:09]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <RTHDCPL><RTHDCPL.EXE>  [(Verified)Realtek Semiconductor Corp., 2.1.0.8, C:2006-10-30 19:49 M:2006-10-30 19:49]
    <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>  [(Verified)Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), C:2004-08-17 12:00 M:2004-08-17 12:00|NVIDIA Corporation, 6.14.11.6003, C:1980-01-01 00:00 M:2007-04-27 17:55]
    <Device Detector><DevDetect.exe -autorun>  [N/A, C:1601-01-01 08:00 M:1601-01-01 08:00]
    <Adobe Reader Speed Launcher><"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe">  [(Verified)Adobe Systems Incorporated, 8.0.0.0, C:2008-01-11 22:16 M:2008-01-11 22:16]
    <MsWWinLm><; C:\Program Files\wrkwn80\WorkWinLm.exe>  []
    <POPO2004><C:\Program Files\Netease\POPO2004\Start.exe>  []
    <runeip><"C:\Program Files\Rising\AntiSpyware\rstray.exe" /startup>  [(Verified)Beijing Rising Information Technology Co., Ltd., 21.0.0.15, C:2008-08-22 08:01 M:2008-08-22 08:01]
    <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system>  [(Verified)Beijing Rising Information Technology Co., Ltd., 20.0.0.24, C:2008-08-22 08:34 M:2008-08-22 08:34]
    <Alcmtr><; ALCMTR.EXE>  [N/A, C:1601-01-01 08:00 M:1601-01-01 08:00]
    <SkyTel><; SkyTel.EXE>  [N/A, C:1601-01-01 08:00 M:1601-01-01 08:00]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    <KKDelay><C:\Program Files\Rising\AntiSpyware\RunOnce.exe>  [(Verified)Beijing Rising Information Technology Co., Ltd., 19, 0, 0, 3, C:2008-08-22 08:01 M:2008-08-22 08:01]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_Dlls><kmon.dll>  [(Verified)Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 27, C:2008-08-22 08:01 M:2008-08-23 08:06]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll>  [(Verified)Beijing Rising Information Technology Co., Ltd., 20.0.0.18, C:2008-08-22 08:34 M:2008-08-22 08:33]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\使用迅雷下载]
    <><C:\Program Files\Thunder Network\Thunder\Program\geturl.htm>  [N/A, C:2008-02-27 10:03 M:2008-06-13 09:55]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\使用迅雷下载全部链接]
    <><C:\Program Files\Thunder Network\Thunder\Program\getallurl.htm>  [N/A, C:2008-02-27 10:03 M:2008-06-13 09:55]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\导出到 Microsoft Office Excel(&X)]
    <><res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000>  []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\添加到QQ表情]
    <><C:\Program Files\Tencent\QQ\AddEmotion.htm>  [N/A, C:2008-06-30 17:14 M:2008-06-30 17:14]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
    <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), C:2004-08-17 12:00 M:2004-08-17 12:00|(Verified)Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:2004-08-17 12:00 M:2004-08-17 12:00|(Verified)N/A, C:1980-01-01 00:00 M:2004-08-17 12:00]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
    <Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser>  [(Verified)Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), C:2004-08-17 12:00 M:2004-08-17 12:00|(Verified)Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:2004-08-17 12:00 M:2004-08-17 12:00|(Verified)N/A, C:1980-01-01 00:00 M:2004-08-17 12:00]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
    <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub>  [(Verified)Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), C:2004-08-17 12:00 M:2004-08-17 12:00|(Verified)Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:2004-08-17 12:00 M:2004-08-17 12:00|(Verified)N/A, C:1980-01-01 00:00 M:2006-11-02 23:38]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{09BA8F6D-CB54-424B-839C-C2A6C8E6B436}]
    <启动迅雷5><C:\Program Files\Thunder Network\Thunder\Thunder.exe>  [Thunder Networking Technologies,LTD, 5, 6, 8, 19, C:2008-02-27 10:03 M:2008-07-10 21:15]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
    <><>  []


========================================
启动项

[腾讯QQ]
    <C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\腾讯QQ.lnk --> "C:\Program Files\Tencent\QQ\QQ.exe"  > [(Verified)TENCENT, 8,0,978,1833, C:2007-07-01 08:50 M:2007-07-01 08:50]
[Adobe Gamma Loader]
    <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Gamma Loader.lnk --> "C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe"  > [Adobe Systems, Inc., 1, 0, 0, 1, C:2008-05-27 17:21 M:2002-08-06 13:37]


========================================
计划任务



========================================
组件


ShellExecuteHook
[ShlExecHack Class]
    {32CD708B-60A7-4C00-9377-D73EAA495F0F}  <C:\WINDOWS\system32\RavExt.dll>  [(Verified)Beijing Rising Information Technology Co., Ltd., 20.0.0.18, C:2008-08-22 08:34 M:2008-08-22 08:33]

Shell Extension
[Display Panning CPL Extension]
    {42071714-76d4-11d1-8b24-00a0c9068ff3}  <deskpan.dll>  []
[HyperTerminal Icon Ext]
    {88895560-9AA2-1069-930E-00AA0030EBC8}  <C:\WINDOWS\system32\hticons.dll>  [(Verified)Hilgraeve, Inc., 5.1.2600.0, C:2006-11-07 01:29 M:2004-08-17 20:00]
[网络连接]
    {7007ACC7-3202-11D1-AAD2-00805FC1270E}  <C:\WINDOWS\system32\NETSHELL.dll>  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-17 12:00]
[网络连接]
    {992CFFA0-F557-101A-88EC-00DD010CCC48}  <C:\WINDOWS\system32\NETSHELL.dll>  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-17 12:00]
[WinRAR shell extension]
    {B41DB860-8EE4-11D2-9906-E49FADC173CA}  <C:\Program Files\WinRAR\rarext.dll>  [N/A, C:2007-02-01 13:57 M:2006-12-04 18:43]
[Shell Extensions for RealOne Player]
    {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}  <C:\Program Files\Real\RealPlayer\rpshell.dll>  []
[NvCpl DesktopContext Class]
    {A70C977A-BF00-412C-90B7-034C51DA2439}  <C:\WINDOWS\system32\nvcpl.dll>  [NVIDIA Corporation, 6.14.11.6003, C:1980-01-01 00:00 M:2007-04-27 17:55]
[RISING]
    {1C7593CB-C1CC-4BA7-BE52-8EEA47F9CB1D}  <C:\WINDOWS\system32\RavExt.dll>  [(Verified)Beijing Rising Information Technology Co., Ltd., 20.0.0.18, C:2008-08-22 08:34 M:2008-08-22 08:33]

Protocols
[Microsoft Infotech Storage Protocol for IE 4.0]
    {0A9007C0-4076-11D3-8789-0000F8105754}  <C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL>  [Microsoft Corporation, 05.02.9336.01, C:2000-04-19 18:47 M:2000-04-19 18:47]
[IEProtocolHandler Class]
    {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D}  <C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL>  [(Verified)Skype Technologies, 1, 0, 27, 2, C:2008-04-25 06:09 M:2008-04-25 06:09]

BrowserHelperObject
[ThunderAtOnce Class]
    {01443AEC-0FD1-40fd-9C87-E93D1494C233}  <C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll>  [(Verified)Thunder Networking Technologies,LTD, 1.0.5.29, C:2008-02-27 10:03 M:2008-06-13 09:43]
[Adobe PDF Reader Link Helper]
    {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}  <C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll>  [(Verified)Adobe Systems Incorporated, 8.0.0.2006102200, C:2006-10-22 23:08 M:2006-10-22 23:08]
[Thunder Browser Helper]
    {889D2FEB-5411-4565-8998-1DD2C5261283}  <C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll>  [(Verified)Thunder Networking Technologies,LTD, 5, 0, 8, 96, C:2008-02-27 10:03 M:2008-06-13 09:43]
[卡卡上网安全助手]
    {98B7C13A-E9CD-4959-8B46-FBEAB41E42A8}  <C:\WINDOWS\system32\UrlFilter.dll>  [(Verified)Beijing Rising Information Technology Co., Ltd., 6, 0, 0, 15, C:2008-08-22 08:01 M:2008-08-22 08:01]

ActiveX Extension
[ThunderAtOnce Class]
    {01443AEC-0FD1-40FD-9C87-E93D1494C233}  <C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll>  [(Verified)Thunder Networking Technologies,LTD, 1.0.5.29, C:2008-02-27 10:03 M:2008-06-13 09:43]
[Adobe PDF Reader Link Helper]
    {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}  <C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll>  [(Verified)Adobe Systems Incorporated, 8.0.0.2006102200, C:2006-10-22 23:08 M:2006-10-22 23:08]
[GerneralPeerID Class]
    {0A47E819-F82E-4D5D-B806-6A9EA94D68CD}  <C:\Program Files\Thunder Network\Thunder\Components\InMedia\peerid.dll>  [Copyright 2007, 1, 0, 0, 1, C:2008-02-27 10:03 M:2008-01-24 10:22]
[InstallHelper Class]
    {1DABF8D5-8430-4985-9B7F-A30E53D709B3}  <C:\Program Files\Tencent\QQLive\QQLiveInstaller.dll>  [Copyright (C) 2005 - 2007 TENCENT Inc. All Rights Reserved. 腾讯公司 版权所有 (C) 2005 - 2007, 6.10.3612.6, C:2008-01-07 17:34 M:2008-01-07 17:34]
[iTrusPTA Class]
    {1E0DFFCF-27FF-4574-849B-55007349FEDA}  <C:\WINDOWS\system32\aliedit\pta.dll>  [(Verified)Copyright 2001, 2, 5, 1, 509, C:2008-04-29 10:36 M:2008-04-29 10:36]
[Thunder Agent Class]
    {485463B7-8FB2-4B3B-B29B-8B919B0EACCE}  <C:\Program Files\Thunder Network\Thunder\ComDlls\ThunderAgent_Now.dll>  [(Verified)Thunder Networking Technologies,LTD, 5, 0, 4, 23, C:2008-02-27 10:03 M:2008-06-13 09:43]
[EditCtrl Class]
    {488A4255-3236-44B3-8F27-FA1AECAA8844}  <C:\WINDOWS\system32\aliedit\aliedit.dll>  [(Verified)Copyright 2007, 2, 1, 2, 1, C:2008-05-20 10:51 M:2008-05-20 10:51]
[XMP Class]
    {6483F145-A768-4C41-AACC-52D4D7845851}  <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xplayer.dll_1_work>  [Copyright XunLei 2007, 2, 1, 2, 77, C:2008-02-27 10:03 M:2008-08-04 12:58]
[XDRM]
    {693571CB-54A3-4E90-9D52-EEAE1334E2D3}  <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xdrm.dll_1_work>  [Copyright XunLei 2007, 1, 0, 0, 7, C:2008-02-27 10:03 M:2008-08-04 12:58]
[MediaComm Class]
    {7670648D-461B-42AF-BDFE-46D26AF5EFF2}  <C:\Program Files\Thunder Network\Thunder\Components\InMedia\MediaAddin17.dll>  [Thunder Networking Technologies,LTD, 3, 1, 5, 78, C:2008-07-30 13:14 M:2008-07-12 09:58]
[Thunder Browser Helper]
    {889D2FEB-5411-4565-8998-1DD2C5261283}  <C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll>  [(Verified)Thunder Networking Technologies,LTD, 5, 0, 8, 96, C:2008-02-27 10:03 M:2008-06-13 09:43]
[TTPlayer ActiveX Control]
    {89AE5F82-410A-4040-9387-68D1144EFD03}  <C:\Program Files\TTPlayer\ttpctrl.dll>  [Alen Soft, 1.0.0.1, C:2007-12-19 10:54 M:2007-12-19 10:54]
[LiveMediaOcx Control]
    {9242BB35-0DB0-43AC-8DFC-8EA07E63B92A}  <C:\PROGRA~1\Tencent\QQLive\QQLive.ocx>  [Tencent, 6.10.3612.6, C:2008-01-07 17:29 M:2008-01-07 17:29]
[卡卡上网安全助手]
    {98B7C13A-E9CD-4959-8B46-FBEAB41E42A8}  <C:\WINDOWS\system32\UrlFilter.dll>  [(Verified)Beijing Rising Information Technology Co., Ltd., 6, 0, 0, 15, C:2008-08-22 08:01 M:2008-08-22 08:01]
[Submit Class]
    {A3CD7F74-93C9-4BC4-B892-CCDF1514F714}  <C:\WINDOWS\system32\safeInput4jh.dll>  [Beijing eChannels Century Technology Co.,Ltd, 3, 0, 0, 0, C:2007-08-23 10:22 M:2007-08-23 10:22]
[DapCtrl Class]
    {ACACC6EB-1FBA-4E13-A729-53AEB2DF54F8}  <C:\Program Files\Common Files\Thunder Network\KanKan\DapCtrl.2.1.5803.60.(20).dll>  [ShenZhen Thunder Networking Technologies Ltd., 2, 1, 5803, 60, C:2008-08-19 22:09 M:2008-08-04 12:58]
[Tencent Safety Online Base Module]
    {C09B522F-8AED-4E21-A65C-DC1AB652BAEE}  <C:\WINDOWS\system32\TSOBase\TSOBase.ocx>  []
[RealPlayer G2 Control]
    {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA}  <C:\Program Files\StormII\Codec\rmoc3260.dll>  []
[Shockwave Flash Object]
    {D27CDB6E-AE6D-11CF-96B8-444553540000}  <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx>  [(Verified)Adobe Systems, Inc., 9,0,124,0, C:2008-03-25 10:32 M:2008-03-25 10:32]
[PlayerCtrl Class]
    {E05BC2A3-9A46-4A32-80C9-023A473F5B23}  <C:\Program Files\Tencent\QQ\QzoneMusic.dll>  [(Verified)深圳腾讯科技, 3, 1, 163, 202, C:2007-05-20 16:38 M:2007-05-20 16:38]
[safeInput Class]
    {ECCBA956-80E5-11D3-9285-0080ADB811C9}  <C:\WINDOWS\system32\safeInput4jh.dll>  [Beijing eChannels Century Technology Co.,Ltd, 3, 0, 0, 0, C:2007-08-23 10:22 M:2007-08-23 10:22]
[Thunder DapPlayer]
    {EEDD6FF9-13DE-496B-9A1C-D78B3215E266}  <C:\Program Files\Thunder Network\Thunder\Components\DownAndPlay\DapPlayer3.0.5712.71.20.dll>  [ShenZhen Thunder Networking Technologies Ltd., 3, 0, 5712, 71, C:2008-08-19 22:09 M:2008-08-04 12:58]
[QvodCtrl Class]
    {F3D0D36F-23F8-4682-A195-74C92B03D4AF}  <C:\Program Files\QvodPlayer\QvodInsert.dll>  [Shenzhen QVOD Technology Co.,Ltd, 2, 5, 0, 53, C:2008-03-25 11:48 M:2008-03-25 11:48]
[XPPlayer Class]
    {F3E70CEA-956E-49CC-B444-73AFE593AD7F}  <C:\Program Files\Common Files\Thunder Network\KanKan\PPlayer.2.0.0.181.(20).dll>  [Xunlei Networking Technologies,LTD, 2, 0, 0, 181, C:2008-08-19 22:09 M:2008-08-04 12:58]

Context Menu
[RisingRavExt]
    {1C7593CB-C1CC-4BA7-BE52-8EEA47F9CB1D}  <C:\WINDOWS\system32\RavExt.dll>  [(Verified)Beijing Rising Information Technology Co., Ltd., 20.0.0.18, C:2008-08-22 08:34 M:2008-08-22 08:33]
[WinRAR]
    {B41DB860-8EE4-11D2-9906-E49FADC173CA}  <C:\Program Files\WinRAR\rarext.dll>  [N/A, C:2007-02-01 13:57 M:2006-12-04 18:43]


========================================
服务

[Human Interface Device Access / HidServ][Stopped/Disabled]
    <%SystemRoot%\System32\svchost.exe -k netsvcs --> "%SystemRoot%\System32\hidserv.dll">  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), C:2004-08-17 12:00 M:2004-08-17 12:00]
[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
    <%SystemRoot%\system32\nvsvc32.exe>  [NVIDIA Corporation, 6.14.11.6003, C:2007-04-27 17:55 M:2007-04-27 17:55]
[Qvod Terminal / Qvod Terminal][Running/Auto Start]
    <C:\Program Files\QvodPlayer\QvodTerminal.exe>  [Shenzhen QVOD Technology Co.,Ltd, 2, 5, 0, 53, C:2008-02-27 15:55 M:2008-02-27 15:55]

[Rising Process Communication Center / RsCCenter][Running/Auto Start]
    <"C:\Program Files\Rising\Rav\CCenter.exe">  [(Verified)Beijing Rising Information Technology Co., Ltd., 20.0.0.33, C:2008-08-22 08:34 M:2008-08-22 08:34]
[Rising RealTime Monitor / RsRavMon][Stopped/Auto Start]
    <"C:\PROGRAM FILES\RISING\RAV\Ravmond.exe">  [(Verified)Beijing Rising Information Technology Co., Ltd., 20.0.0.80, C:2008-08-22 08:34 M:2008-08-22 08:33]


========================================
驱动

[AMD K8 Processor Driver / AmdK8][Stopped/Manual Start]
    <System32\DRIVERS\amdk8.sys>  [Advanced Micro Devices, 1.1.0 (srv03_sp1_rtm.050324-1447), C:2005-08-12 09:09 M:2005-05-21 20:43]
[Cdsys / Cdsys][Stopped/Manual Start]
    <\??\C:\WINDOWS\system32\cdcd.sys>  []
[Microsoft UAA Bus Driver for High Definition Audio / HDAudBus][Running/Manual Start]
    <system32\DRIVERS\HDAudBus.sys>  [Windows (R) Server 2003 DDK provider, 5.10.01.5013 built by: WinDDK, C:2005-01-07 17:07 M:2005-01-07 17:07]
[IIS Manager  / IIS Manager ][Stopped/Manual Start]
    <\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1.tmp>  []
[lzltct / lzltct][Stopped/Manual Start]
    <\??\C:\WINDOWS\system32\drivers\lzltct.sys>  []
[npkcrypt / npkcrypt][Stopped/Manual Start]
    <\??\C:\WINDOWS\system32\npkcrypt.sys>  []
[npkycryp / npkycryp][Stopped/Manual Start]
    <\??\C:\WINDOWS\system32\npkycryp.sys>  []
[nv / nv][Running/Manual Start]
    <system32\DRIVERS\nv4_mini.sys>  [NVIDIA Corporation, 6.14.11.6003, C:2006-11-07 01:20 M:2007-04-27 17:55]
[NVIDIA nForce Networking Controller Driver / NVENETFD][Running/Manual Start]
    <system32\DRIVERS\NVENETFD.sys>  [NVIDIA Corporation, 1.00.03.06521, C:2006-07-11 21:38 M:2006-07-11 21:38]
[NVIDIA Network Bus Enumerator / nvnetbus][Running/Manual Start]
    <system32\DRIVERS\nvnetbus.sys>  [NVIDIA Corporation, 1.00.03.06521, C:2006-07-11 21:38 M:2006-07-11 21:38]
[rspp / rspp][Stopped/System Start]
    <\??\C:\WINDOWS\system32\Drivers\Rspp.sys>  [Beijing Rising Technology Co., Ltd, 23, 0, 0, 3, C:2008-08-23 18:17 M:2008-08-23 18:29]
[TCP/IP Protocol Driver / Tcpip][Running/System Start]
    <system32\DRIVERS\tcpip.sys>  [Microsoft Corporation, 5.1.2600.3394 (xpsp_sp2_gdr.080620-1245), C:2004-08-17 12:00 M:2008-06-20 18:45]
[xAntiArpSpoof Service / xAntiArp][Stopped/Manual Start]
    <system32\DRIVERS\xAntiArp.sys>  []

[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Stopped/Manual Start]
    <system32\drivers\ac97intc.sys>  [(Verified)Intel Corporation, 5.10.3523 built by: WinDDK, C:2006-11-07 01:20 M:2001-08-17 12:20]
[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Stopped/Manual Start]
    <system32\DRIVERS\fetnd5.sys>  [(Verified)VIA Technologies, Inc.              , 2.66, C:2006-11-07 01:20 M:2001-08-17 12:13]
[HookCont / HookCont][Running/System Start]
    <\SystemRoot\system32\drivers\HookCont.sys>  [(Verified)Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 7, C:2008-08-22 08:34 M:2008-08-22 08:34]
[HookNtos / HookNtos][Running/System Start]
    <\SystemRoot\system32\drivers\HookNtos.sys>  [(Verified)Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 50, C:2008-08-22 08:34 M:2008-08-22 08:33]
[HookReg / HookReg][Running/System Start]
    <\SystemRoot\system32\drivers\HookReg.sys>  [(Verified)Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 28, C:2008-08-22 08:34 M:2008-08-22 08:33]
[HookSys / HookSys][Running/System Start]
    <\SystemRoot\system32\drivers\HookSys.sys>  [(Verified)Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 54, C:2008-08-22 08:34 M:2008-08-22 08:33]
[Service for Realtek HD Audio (WDM) / IntcAzAudAddService][Running/Manual Start]
    <system32\drivers\RtkHDAud.sys>  [(Verified)Realtek Semiconductor Corp., 5.10.00.5319 built by: WinDDK, C:2006-11-03 09:32 M:2006-11-03 09:32]
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
    <system32\DRIVERS\ptilink.sys>  [(Verified)Parallel Technologies, Inc., 1.10 (XPClient.010817-1148), C:2004-08-17 12:00 M:2004-08-17 12:00]
[RsNTGDI / RsNTGDI][Running/Boot Start]
    <system32\Drivers\RsNTGdi.sys>  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 3, C:2008-08-22 08:34 M:2008-08-22 08:33]
[Secdrv / Secdrv][Stopped/Manual Start]
    <system32\DRIVERS\secdrv.sys>  [(Verified)Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., 4.03.086, C:2004-08-17 12:00 M:2007-11-13 18:25]


========================================
进程

[PID: 592 / SYSTEM]   \SystemRoot\System32\smss.exe   [(Verified)Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), C:2004-08-17 12:00 M:2004-08-17 12:00]

[PID: 664 / SYSTEM]   \??\C:\WINDOWS\system32\csrss.exe   [(Verified)Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), C:2004-08-17 12:00 M:2004-08-17 12:00]

[PID: 688 / SYSTEM]   \??\C:\WINDOWS\system32\winlogon.exe   [(Verified)Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), C:2004-08-17 12:00 M:2004-08-17 12:00]
    C:\WINDOWS\system32\kmon.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 27, C:2008-08-22 08:01 M:2008-08-23 08:06]
    C:\WINDOWS\system32\uxtheme.dll  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-07 09:37]

[PID: 732 / SYSTEM]   C:\WINDOWS\system32\services.exe   [(Verified)Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), C:2004-08-17 12:00 M:2004-08-17 12:00]

[PID: 744 / SYSTEM]   C:\WINDOWS\system32\lsass.exe   [(Verified)Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), C:2004-08-17 12:00 M:2004-08-17 12:00]
    C:\WINDOWS\system32\UxTheme.dll  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-07 09:37]

[PID: 896 / SYSTEM]   C:\WINDOWS\system32\svchost.exe   [(Verified)Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), C:2004-08-17 12:00 M:2004-08-17 12:00]
    C:\WINDOWS\system32\UxTheme.dll  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-07 09:37]

[PID: 956 / NETWORK SERVICE]   C:\WINDOWS\system32\svchost.exe   [(Verified)Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), C:2004-08-17 12:00 M:2004-08-17 12:00]
    C:\WINDOWS\system32\UxTheme.dll  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-07 09:37]

[PID: 1052 / SYSTEM]   C:\Program Files\Rising\Rav\CCenter.exe   [(Verified)Beijing Rising Information Technology Co., Ltd., 20.0.0.33, C:2008-08-22 08:34 M:2008-08-22 08:34]
    C:\WINDOWS\system32\uxtheme.dll  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-07 09:37]

[PID: 1068 / SYSTEM]   C:\WINDOWS\System32\svchost.exe   [(Verified)Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), C:2004-08-17 12:00 M:2004-08-17 12:00]
    C:\WINDOWS\System32\UxTheme.dll  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-07 09:37]
    c:\windows\system32\netshell.dll  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-17 12:00]

[PID: 1148 / NETWORK SERVICE]   C:\WINDOWS\system32\svchost.exe   [(Verified)Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), C:2004-08-17 12:00 M:2004-08-17 12:00]
    C:\WINDOWS\system32\UxTheme.dll  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-07 09:37]

[PID: 1228 / LOCAL SERVICE]   C:\WINDOWS\system32\svchost.exe   [(Verified)Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), C:2004-08-17 12:00 M:2004-08-17 12:00]
    C:\WINDOWS\system32\UxTheme.dll  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-07 09:37]

[PID: 1312 / SYSTEM]   C:\PROGRAM FILES\RISING\RAV\ravmond.exe   [(Verified)Beijing Rising Information Technology Co., Ltd., 20.0.0.80, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\BWList.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20.0.0.5, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\WINDOWS\system32\MFC71.DLL  [Microsoft Corporation, 7.10.3077.0, C:2008-02-27 09:54 M:2008-02-27 09:53]
    C:\WINDOWS\system32\MSVCR71.dll  [Microsoft Corporation, 7.10.3052.4, C:2004-04-05 10:31 M:2004-04-05 10:31]
    C:\WINDOWS\system32\MSVCP71.dll  [Microsoft Corporation, 7.10.3077.0, C:2004-04-05 10:31 M:2004-04-05 10:31]
    C:\PROGRAM FILES\RISING\RAV\RSAPPMGR.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20.0.0.1, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\CfgDll.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20.0.0.19, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\RsLog.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20.0.0.36, C:2008-08-22 08:34 M:2008-08-22 08:34]
    C:\PROGRAM FILES\RISING\RAV\ProcCom.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 20, C:2008-08-22 08:34 M:2008-08-22 08:34]
    C:\PROGRAM FILES\RISING\RAV\RsCommX2.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 20, C:2008-08-22 08:34 M:2008-08-22 08:34]
    C:\PROGRAM FILES\RISING\RAV\MonRule.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20.0.0.29, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\Hooksys.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 12, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\HookReg.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 6, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\HookNtos.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 5, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\rswalmon.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 24, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\recomp.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 41, C:2008-08-22 08:34 M:2008-08-22 08:54]
    C:\PROGRAM FILES\RISING\RAV\refs.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 18, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\ffr.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 16, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\Program Files\Rising\Rav\RsStore.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20.0.0.9, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\HookCont.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3, C:2008-08-22 08:34 M:2008-08-22 08:34]
    C:\Program Files\Rising\Rav\fakescan.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20.0.0.14, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\Program Files\Rising\Rav\Scanner.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20.0.0.39, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\viruslib.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 27, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\relibldr.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 17, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\WINDOWS\system32\uxtheme.dll  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-07 09:37]
    C:\PROGRAM FILES\RISING\RAV\HookWeb.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20.0.0.3, C:2008-08-22 08:34 M:2008-08-22 08:34]
    C:\PROGRAM FILES\RISING\RAV\nvfile.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 7, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\scanexec.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 20, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\unexe.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 6, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\scanex.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 89, C:2008-08-22 08:34 M:2008-08-22 08:54]
    C:\PROGRAM FILES\RISING\RAV\extfile.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 32, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\pearc.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 8, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\scanpack.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 10, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\revm.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 11, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\urutils.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 7, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\ur000.dat  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 19, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\scriptci.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 4, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\ur001.dat  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 4, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\extole.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 13, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\scansct.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 10, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\ur023.dat  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 3, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\uroutine.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 27, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\extmail.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 10, C:2008-08-22 08:34 M:2008-08-22 08:33]

[PID: 1540 / SYSTEM]   C:\WINDOWS\system32\spoolsv.exe   [(Verified)Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519), C:2004-08-17 12:00 M:2005-06-11 07:53]
    C:\WINDOWS\system32\UxTheme.dll  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-07 09:37]
    C:\WINDOWS\system32\kmon.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 27, C:2008-08-22 08:01 M:2008-08-23 08:06]

[PID: 1692 / SYSTEM]   C:\PROGRAM FILES\RISING\RAV\RavStub.exe   [(Verified)Beijing Rising Information Technology Co., Ltd., 20.0.0.10, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\ProcCom.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 20, C:2008-08-22 08:34 M:2008-08-22 08:34]
    C:\PROGRAM FILES\RISING\RAV\RsCommX2.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 20, C:2008-08-22 08:34 M:2008-08-22 08:34]
    C:\PROGRAM FILES\RISING\RAV\RSCOMMON.DLL  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 17, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\WINDOWS\system32\uxtheme.dll  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-07 09:37]

[PID: 1980 / Administrator]   C:\WINDOWS\Explorer.EXE   [(Verified)Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:2004-08-17 12:00 M:2004-08-17 12:00]
    C:\WINDOWS\system32\UxTheme.dll  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-07 09:37]
    C:\WINDOWS\system32\kmon.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 27, C:2008-08-22 08:01 M:2008-08-23 08:06]
    C:\WINDOWS\system32\RavExt.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20.0.0.18, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll  [Adobe Systems, Inc., 8.1.0.0, C:2007-05-10 22:54 M:2007-05-10 22:54]
    C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\MSVCR80.dll  [Microsoft Corporation, 8.00.50727.163, C:2006-06-05 14:14 M:2006-06-05 14:14]
    C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.CHS  [Adobe Systems, Inc., 8.0.0.0, C:2006-11-17 00:37 M:2006-11-17 00:37]
    C:\WINDOWS\system32\NETSHELL.dll  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-17 12:00]
    C:\WINDOWS\system32\browselc.dll  [Microsoft Corporation, 6.00.2600.0000, C:1980-01-01 00:00 M:2001-09-29 14:39]
    C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll  [(Verified)Thunder Networking Technologies,LTD, 1.0.5.29, C:2008-02-27 10:03 M:2008-06-13 09:43]
    C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll  [(Verified)Adobe Systems Incorporated, 8.0.0.2006102200, C:2006-10-22 23:08 M:2006-10-22 23:08]
    C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll  [(Verified)Thunder Networking Technologies,LTD, 5, 0, 8, 96, C:2008-02-27 10:03 M:2008-06-13 09:43]
    C:\Program Files\Thunder Network\Thunder\Components\ResWorker\DsBho_00.dll  [Thunder Networking Technologies,LTD, 1, 0, 0, 20, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Components\ResWorker\DataProcessor_00.dll  [Thunder Networking Technologies,LTD, 1, 0, 0, 16, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\Program Files\wrkwn80\windlwork.dll  [N/A, C:2008-02-19 21:02 M:2007-09-12 13:57]
    C:\Program Files\WinRAR\rarext.dll  [N/A, C:2007-02-01 13:57 M:2006-12-04 18:43]
    C:\Program Files\Rising\Rav\RSCOMMON.DLL  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 17, C:2008-08-22 08:34 M:2008-08-22 08:33]

[PID: 148 / SYSTEM]   C:\WINDOWS\system32\nvsvc32.exe   [NVIDIA Corporation, 6.14.11.6003, C:2007-04-27 17:55 M:2007-04-27 17:55]
    C:\WINDOWS\system32\kmon.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 27, C:2008-08-22 08:01 M:2008-08-23 08:06]
    C:\WINDOWS\system32\nvapi.dll  [NVIDIA Corporation, 6.14.11.6003, C:2007-04-27 17:55 M:2007-04-27 17:55]
    C:\WINDOWS\system32\uxtheme.dll  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-07 09:37]

[PID: 240 / SYSTEM]   C:\Program Files\QvodPlayer\QvodTerminal.exe   [Shenzhen QVOD Technology Co.,Ltd, 2, 5, 0, 53, C:2008-02-27 15:55 M:2008-02-27 15:55]
    C:\WINDOWS\system32\kmon.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 27, C:2008-08-22 08:01 M:2008-08-23 08:06]
    C:\WINDOWS\system32\uxtheme.dll  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-07 09:37]

[PID: 384 / SYSTEM]   C:\WINDOWS\system32\svchost.exe   [(Verified)Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), C:2004-08-17 12:00 M:2004-08-17 12:00]
    C:\WINDOWS\system32\UxTheme.dll  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-07 09:37]

[PID: 1100 / Administrator]   C:\WINDOWS\RTHDCPL.EXE   [(Verified)Realtek Semiconductor Corp., 2.1.0.8, C:2006-10-30 19:49 M:2006-10-30 19:49]
    C:\WINDOWS\system32\kmon.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 27, C:2008-08-22 08:01 M:2008-08-23 08:06]
    C:\WINDOWS\system32\uxtheme.dll  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-07 09:37]
    C:\Program Files\wrkwn80\windlwork.dll  [N/A, C:2008-02-19 21:02 M:2007-09-12 13:57]

[PID: 1208 / Administrator]   C:\PROGRAM FILES\RISING\RAV\RavMon.exe   [(Verified)Beijing Rising Information Technology Co., Ltd., 20.0.01.24, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\WINDOWS\system32\MFC71.DLL  [Microsoft Corporation, 7.10.3077.0, C:2008-02-27 09:54 M:2008-02-27 09:53]
    C:\WINDOWS\system32\MSVCR71.dll  [Microsoft Corporation, 7.10.3052.4, C:2004-04-05 10:31 M:2004-04-05 10:31]
    C:\WINDOWS\system32\MSVCP71.dll  [Microsoft Corporation, 7.10.3077.0, C:2004-04-05 10:31 M:2004-04-05 10:31]
    C:\PROGRAM FILES\RISING\RAV\ProcCom.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 20, C:2008-08-22 08:34 M:2008-08-22 08:34]
    C:\PROGRAM FILES\RISING\RAV\RsCommX2.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 20, C:2008-08-22 08:34 M:2008-08-22 08:34]
    C:\PROGRAM FILES\RISING\RAV\RSCOMMON.DLL  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 17, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\recomp.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 41, C:2008-08-22 08:34 M:2008-08-22 08:54]
    C:\PROGRAM FILES\RISING\RAV\refs.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 18, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\viruslib.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 27, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\relibldr.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 17, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\RSAPPMGR.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20.0.0.1, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\CfgDll.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20.0.0.19, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\MonRule.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20.0.0.29, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\PngDll.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 5, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\WINDOWS\system32\uxtheme.dll  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-07 09:37]
    C:\PROGRAM FILES\RISING\RAV\Rsguilib.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 90, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\PROGRAM FILES\RISING\RAV\RsXML.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 2, C:2008-08-22 08:34 M:2008-08-22 08:33]

[PID: 1296 / LOCAL SERVICE]   C:\WINDOWS\System32\alg.exe   [(Verified)Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), C:2004-08-17 12:00 M:2004-08-17 12:00]
    C:\WINDOWS\System32\UxTheme.dll  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-07 09:37]
    C:\WINDOWS\System32\kmon.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 27, C:2008-08-22 08:01 M:2008-08-23 08:06]

[PID: 1944 / Administrator]   C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe   [ACD Systems, Ltd., 3,1,31,0, C:2005-07-12 13:40 M:2005-09-08 12:36]
    C:\WINDOWS\system32\MFC71.DLL  [Microsoft Corporation, 7.10.3077.0, C:2008-02-27 09:54 M:2008-02-27 09:53]
    C:\WINDOWS\system32\MSVCR71.dll  [Microsoft Corporation, 7.10.3052.4, C:2004-04-05 10:31 M:2004-04-05 10:31]
    C:\WINDOWS\system32\MSVCP71.dll  [Microsoft Corporation, 7.10.3077.0, C:2004-04-05 10:31 M:2004-04-05 10:31]
    C:\WINDOWS\system32\kmon.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 27, C:2008-08-22 08:01 M:2008-08-23 08:06]
    C:\WINDOWS\system32\uxtheme.dll  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-07 09:37]
    C:\Program Files\wrkwn80\windlwork.dll  [N/A, C:2008-02-19 21:02 M:2007-09-12 13:57]

[PID: 2180 / Administrator]   C:\Program Files\wrkwn80\WORKWINLM.exe   [Nanjing WangYa Computer Co . , Ltd ., 8.01, C:2008-02-19 21:02 M:2007-12-12 08:24]
    C:\Program Files\wrkwn80\MSVBVM60.DLL  [Microsoft Corporation, 6.00.8964, C:2008-02-19 21:02 M:2003-08-01 11:05]
    C:\WINDOWS\system32\kmon.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 27, C:2008-08-22 08:01 M:2008-08-23 08:06]
    C:\Program Files\wrkwn80\vb6chs.dll  [Microsoft Corporation, 6.00.8988, C:2008-02-19 21:02 M:2003-07-28 12:43]
    C:\WINDOWS\system32\uxtheme.dll  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-07 09:37]
    C:\Program Files\wrkwn80\windlwork.dll  [N/A, C:2008-02-19 21:02 M:2007-09-12 13:57]

[PID: 2376 / Administrator]   C:\Program Files\Rising\AntiSpyware\rstray.exe   [(Verified)Beijing Rising Information Technology Co., Ltd., 21.0.0.15, C:2008-08-22 08:01 M:2008-08-22 08:01]
    C:\WINDOWS\system32\kmon.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 27, C:2008-08-22 08:01 M:2008-08-23 08:06]
    C:\Program Files\Rising\AntiSpyware\rsmginfo.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 21, 0, 0, 8, C:2008-08-22 08:01 M:2008-08-22 08:01]
    C:\WINDOWS\system32\uxtheme.dll  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-07 09:37]
    C:\Program Files\Rising\AntiSpyware\RsXML.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 2, C:2008-08-22 08:01 M:2008-08-22 08:01]
    C:\Program Files\Rising\AntiSpyware\MSVCP71.dll  [Microsoft Corporation, 7.10.3077.0, C:2008-08-22 08:01 M:2008-08-22 08:01]
    C:\Program Files\Rising\AntiSpyware\MSVCR71.dll  [Microsoft Corporation, 7.10.3052.4, C:2008-08-22 08:01 M:2008-08-22 08:01]
    C:\Program Files\Rising\AntiSpyware\ComServ.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 21.0.0.31, C:2008-08-22 08:01 M:2008-08-22 08:01]
    C:\Program Files\Rising\AntiSpyware\Syslay.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 21.0.0.6, C:2008-08-22 08:01 M:2008-08-22 08:01]
    C:\Program Files\Rising\AntiSpyware\rscommon.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20.0.1.1, C:2008-08-22 08:01 M:2008-08-22 08:01]
    C:\Program Files\Rising\AntiSpyware\comx3.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 21.0.0.33, C:2008-08-22 08:01 M:2008-08-22 08:01]
    C:\Program Files\Rising\AntiSpyware\pngdll.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 5, C:2008-08-22 08:01 M:2008-08-22 08:01]
    C:\Program Files\Rising\AntiSpyware\runiep.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 6.0.0.33, C:2008-08-22 08:01 M:2008-08-22 08:01]
    C:\Program Files\Rising\Rav\ProcCom.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 20, C:2008-08-22 08:34 M:2008-08-22 08:34]
    C:\Program Files\Rising\Rav\RsCommX2.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 20, C:2008-08-22 08:34 M:2008-08-22 08:34]
    C:\Program Files\wrkwn80\windlwork.dll  [N/A, C:2008-02-19 21:02 M:2007-09-12 13:57]
    C:\WINDOWS\system32\RavExt.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20.0.0.18, C:2008-08-22 08:34 M:2008-08-22 08:33]

[PID: 2412 / Administrator]   C:\Program Files\Rising\Rav\RavTask.exe   [(Verified)Beijing Rising Information Technology Co., Ltd., 20.0.0.24, C:2008-08-22 08:34 M:2008-08-22 08:34]
    C:\Program Files\Rising\Rav\RSCOMMON.DLL  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 17, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\Program Files\Rising\Rav\RSAPPMGR.DLL  [(Verified)Beijing Rising Information Technology Co., Ltd., 20.0.0.1, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\Program Files\Rising\Rav\CfgDll.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20.0.0.19, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\WINDOWS\system32\uxtheme.dll  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-07 09:37]

[PID: 2464 / Administrator]   C:\WINDOWS\system32\ctfmon.exe   [(Verified)Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), C:2004-08-17 12:00 M:2004-08-17 12:00]
    C:\WINDOWS\system32\UxTheme.dll  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-07 09:37]
    C:\WINDOWS\system32\kmon.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 27, C:2008-08-22 08:01 M:2008-08-23 08:06]
    C:\Program Files\wrkwn80\windlwork.dll  [N/A, C:2008-02-19 21:02 M:2007-09-12 13:57]

[PID: 2488 / Administrator]   C:\Program Files\wrkwn80\system.dll   [2.00, C:2008-02-19 21:02 M:2007-05-14 09:51]
    C:\Program Files\wrkwn80\MSVBVM60.DLL  [Microsoft Corporation, 6.00.8964, C:2008-02-19 21:02 M:2003-08-01 11:05]
    C:\WINDOWS\system32\kmon.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 27, C:2008-08-22 08:01 M:2008-08-23 08:06]
    C:\Program Files\wrkwn80\vb6chs.dll  [Microsoft Corporation, 6.00.8988, C:2008-02-19 21:02 M:2003-07-28 12:43]
    C:\WINDOWS\system32\uxtheme.dll  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-07 09:37]
    C:\Program Files\wrkwn80\windlwork.dll  [N/A, C:2008-02-19 21:02 M:2007-09-12 13:57]
    C:\WINDOWS\system32\NETSHELL.dll  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-17 12:00]

[PID: 2832 / Administrator]   C:\Program Files\Tencent\QQ\TXPlatform.exe   [(Verified)Tencent, 1, 5, 225, 0, C:2008-05-20 17:53 M:2008-05-20 17:53]
    C:\WINDOWS\system32\kmon.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 27, C:2008-08-22 08:01 M:2008-08-23 08:06]
    C:\Program Files\Rising\AntiSpyware\comx3.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 21.0.0.33, C:2008-08-22 08:01 M:2008-08-22 08:01]
    C:\Program Files\Rising\AntiSpyware\Syslay.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 21.0.0.6, C:2008-08-22 08:01 M:2008-08-22 08:01]
    C:\WINDOWS\system32\uxtheme.dll  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-07 09:37]
    C:\Program Files\wrkwn80\windlwork.dll  [N/A, C:2008-02-19 21:02 M:2007-09-12 13:57]

[PID: 3964 / Administrator]   C:\Program Files\Internet Explorer\iexplore.exe   [(Verified)Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:2006-11-07 01:31 M:2004-08-17 20:00]
    C:\WINDOWS\system32\kmon.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 27, C:2008-08-22 08:01 M:2008-08-23 08:06]
    C:\Program Files\Rising\AntiSpyware\comx3.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 21.0.0.33, C:2008-08-22 08:01 M:2008-08-22 08:01]
    C:\Program Files\Rising\AntiSpyware\Syslay.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 21.0.0.6, C:2008-08-22 08:01 M:2008-08-22 08:01]
    C:\WINDOWS\system32\uxtheme.dll  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-07 09:37]
    C:\WINDOWS\system32\browselc.dll  [Microsoft Corporation, 6.00.2600.0000, C:1980-01-01 00:00 M:2001-09-29 14:39]
    C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll  [(Verified)Thunder Networking Technologies,LTD, 1.0.5.29, C:2008-02-27 10:03 M:2008-06-13 09:43]
    C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll  [(Verified)Adobe Systems Incorporated, 8.0.0.2006102200, C:2006-10-22 23:08 M:2006-10-22 23:08]
    C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\MSVCR80.dll  [Microsoft Corporation, 8.00.50727.163, C:2006-06-05 14:14 M:2006-06-05 14:14]
    C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll  [(Verified)Thunder Networking Technologies,LTD, 5, 0, 8, 96, C:2008-02-27 10:03 M:2008-06-13 09:43]
    C:\Program Files\Thunder Network\Thunder\Components\ResWorker\DsBho_00.dll  [Thunder Networking Technologies,LTD, 1, 0, 0, 20, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Components\ResWorker\DataProcessor_00.dll  [Thunder Networking Technologies,LTD, 1, 0, 0, 16, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\WINDOWS\system32\UrlFilter.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 6, 0, 0, 15, C:2008-08-22 08:01 M:2008-08-22 08:01]
    C:\Program Files\Rising\AntiSpyware\UrlRule.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 1.0.0.15, C:2008-08-22 08:01 M:2008-08-22 08:01]
    C:\Program Files\wrkwn80\windlwork.dll  [N/A, C:2008-02-19 21:02 M:2007-09-12 13:57]
    C:\Program Files\Rising\Rav\RavScrCh.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 5, C:2008-08-22 08:34 M:2008-08-22 08:34]
    C:\WINDOWS\system32\JPWB.IME  [常诚研制, 4.00.950, C:2007-11-18 09:46 M:2008-04-06 08:31]
    C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx  [(Verified)Adobe Systems, Inc., 9,0,124,0, C:2008-03-25 10:32 M:2008-03-25 10:32]
    C:\Program Files\Thunder Network\Thunder\ComDlls\ThunderAgent_Now.dll  [(Verified)Thunder Networking Technologies,LTD, 5, 0, 4, 23, C:2008-02-27 10:03 M:2008-06-13 09:43]
    C:\WINDOWS\system32\RavExt.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20.0.0.18, C:2008-08-22 08:34 M:2008-08-22 08:33]
    C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll  [Adobe Systems, Inc., 8.1.0.0, C:2007-05-10 22:54 M:2007-05-10 22:54]
    C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.CHS  [Adobe Systems, Inc., 8.0.0.0, C:2006-11-17 00:37 M:2006-11-17 00:37]

[PID: 1036 / Administrator]   C:\Program Files\Thunder Network\Thunder\Program\Thunder5.exe   [Thunder Networking Technologies,LTD, 5.8.3.556, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Program\BugReport.dll  [Thunder Networking Technologies,LTD, 1, 4, 1, 20, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\WINDOWS\system32\uxtheme.dll  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-07 09:37]
    C:\Program Files\Thunder Network\Thunder\Program\TaskManager.dll  [Thunder Networking Technologies,LTD, 1, 3, 8, 68, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Program\download_interface.dll  [Thunder Networking Technologies,LTD, 3, 1, 2, 318, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\WINDOWS\system32\MSVCP71.dll  [Microsoft Corporation, 7.10.3077.0, C:2004-04-05 10:31 M:2004-04-05 10:31]
    C:\WINDOWS\system32\MSVCR71.dll  [Microsoft Corporation, 7.10.3052.4, C:2004-04-05 10:31 M:2004-04-05 10:31]
    C:\Program Files\Thunder Network\Thunder\Program\asyn_frame.dll  [Thunder Networking Technologies,LTD, 1, 1, 2, 21, C:2008-07-30 13:14 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Program\ATL71.DLL  [Microsoft Corporation, 7.10.3077.0, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Program\fs.dll  [Thunder Networking Technologies,LTD, 1, 1, 2, 10, C:2008-07-30 13:14 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Program\XLNet.Dll  [Thunder Networking Technologies,LTD, 1, 5, 2, 25, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Program\BHOStub.dll  [Thunder Networking Technologies,LTD, 1, 1, 1, 10, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Components\DownAndPlay\DownAndPlay.dll  [Copyright 2007, 1, 0, 12, 30, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Program\backend_agent.dll  [Thunder Networking Technologies,LTD, 1, 1, 2, 20, C:2008-07-30 13:14 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Program\p2sp.dll  [Thunder Networking Technologies,LTD, 1, 1, 2, 25, C:2008-07-30 13:14 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Program\down_dispatcher.dll  [Thunder Networking Technologies,LTD, 1, 0, 2, 17, C:2008-07-30 13:14 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Program\ptl.dll  [Thunder Networking Technologies,LTD, 3, 1, 2, 24, C:2008-07-30 13:14 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Program\xl_stat.dll  [Thunder Networking Technologies,LTD, 1, 1, 2, 3, C:2008-07-30 13:14 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Program\p2p_network_com.dll  [版权所有 (C) 2008, 1, 0, 2, 25, C:2008-07-30 13:14 M:2008-08-04 12:58]
    C:\Program Files\Rising\Rav\RavScrCh.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 5, C:2008-08-22 08:34 M:2008-08-22 08:34]
    C:\Program Files\Thunder Network\Thunder\Program\iTargetAD.dll  [Thunder Networking Technologies,LTD, 1, 0, 4, 35, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx  [(Verified)Adobe Systems, Inc., 9,0,124,0, C:2008-03-25 10:32 M:2008-03-25 10:32]
    C:\Program Files\Thunder Network\Thunder\Program\p2p.dll  [Thunder Networking Technologies,LTD, 1,1,2,24, C:2008-07-30 13:14 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Program\xldc.dll  [Thunder Networking Technologies,LTD, 3, 6, 2, 15, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Program\stream.dll  [Thunder Networking Technologies,LTD, 2, 1, 2, 382, C:2008-07-30 13:14 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Program\p2p_upload.dll  [Thunder Networking Technologies,LTD, 1, 1, 2, 8, C:2008-07-30 13:14 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Program\p2p_local_res.dll  [Thunder Networking Technologies,LTD, 1,1,2,12, C:2008-07-30 13:14 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Program\al.dll  [Thunder Networking Technologies,LTD, 1,1,2,15, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Components\InMedia\iEmbedShell.dll  [　, 1, 0, 2, 25, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Components\InMedia\iEmbed17.dll  [Thunder Networking Technologies,LTD, 3, 4, 8, 107, C:2008-07-30 13:14 M:2008-07-12 09:58]
    C:\Program Files\Thunder Network\Thunder\Components\InMedia\PlayerHelper.dll  [thunder, 1, 2, 7, 61, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Components\InMedia\XLIPC.DLL  [Thunder Networking Technologies,LTD, 1, 0, 0, 2, C:2008-02-27 10:03 M:2008-01-24 10:22]
    C:\Program Files\Thunder Network\Thunder\Components\P4PClient\P4PClient.dll  [Thunder Networking Technologies,LTD, 2, 2, 5, 70, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Components\Community\XLCommunity.dll  [Thunder Networking Technologies,LTD, 2, 4, 0, 77, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Program\RegisterDll.dll  [Thunder Networking Technologies,LTD, 2, 17, 0, 67, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Program\MSVCIRT.dll  [Microsoft Corporation, 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158), C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Program\imdt.dll  [TODO: <Company name>, 1.1.2.5, C:2008-07-30 13:14 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Components\InMedia\peerid.dll  [Copyright 2007, 1, 0, 0, 1, C:2008-02-27 10:03 M:2008-01-24 10:22]
    C:\Program Files\Thunder Network\Thunder\Components\Security\ThunderSafe.dll  [深圳市迅雷网络技术有限公司, 2, 1, 1, 93, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Components\Security\ConfigManager.dll  [深圳市迅雷网络技术有限公司, 1, 0, 0, 1, C:2008-07-30 13:14 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Components\Security\SafeManager.dll  [深圳市迅雷网络技术有限公司, 1, 0, 4, 16, C:2008-07-30 13:14 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Program\XLNetU.Dll  [Thunder Networking Technologies,LTD, 1, 5, 1, 24, C:2008-07-30 13:14 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Plugins\XLSafeHost\XLSafeHost.dll  [深圳市迅雷网络技术有限公司, 1, 2, 5, 81, C:2008-08-05 11:01 M:2008-08-05 11:01]
    C:\Program Files\Thunder Network\Thunder\Plugins\XLSafeHost\AutoHelp.dll  [Beijing Rising Technology Co., Ltd., 6.0.0.3, C:2008-07-30 13:14 M:2008-07-12 09:58]
    C:\Program Files\Thunder Network\Thunder\Components\Search\XLSearch.dll  [Thunder Networking Technologies,LTD, 1, 1, 6, 21, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Program\LiveUpdate.dll  [Thunder Networking Technologies,LTD, 1, 2, 3, 25, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Components\ExplorerHelper\ExplorerHelper.dll  [Thunder Networking Technologies,LTD, 1, 0, 4, 19, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\ComDlls\ThunderAgent_Now.dll  [(Verified)Thunder Networking Technologies,LTD, 5, 0, 4, 23, C:2008-02-27 10:03 M:2008-06-13 09:43]
    C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll  [(Verified)Thunder Networking Technologies,LTD, 5, 0, 8, 96, C:2008-02-27 10:03 M:2008-06-13 09:43]
    C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll  [(Verified)Thunder Networking Technologies,LTD, 1.0.5.29, C:2008-02-27 10:03 M:2008-06-13 09:43]
    C:\Program Files\Thunder Network\Thunder\Components\Tips\TipsClient.dll  [Thunder Networking Technologies,LTD, 2, 2, 13, 118, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Components\VPSHELL\VPSHELL.dll  [迅雷网络, 3, 0, 1, 33, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Components\UserExperience\UserExperience.dll  [Thunder Networking Technologies,LTD, 1, 0, 3, 5, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Components\ResWorker\DsXlCom.dll  [版权所有 (C) 2007, 1, 0, 0, 30, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Components\ResWorker\DataProcessor_00.dll  [Thunder Networking Technologies,LTD, 1, 0, 0, 16, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Components\ResWorker\MediaWorker.dll  [Thunder Networking Technologies,LTD, 1, 2, 0, 22, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Components\Tips\XLIPC.DLL  [Thunder Networking Technologies,LTD, 1, 0, 0, 2, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Components\DownloadStat\DownloadStat.dll  [Thunder Networking Technologies,LTD, 1, 4, 1, 6, C:2008-02-27 10:03 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Program\emule_id.dll  [Copyright 2007, 1, 0, 2, 8, C:2008-07-30 13:14 M:2008-08-04 12:58]
    C:\Program Files\Thunder Network\Thunder\Program\bd.dll  [Thunder Networking Technologies,LTD, 1, 0, 2, 17, C:2008-02-27 10:03 M:2008-08-04 12:58]

[PID: 1096 / Administrator]   F:\工具\杀毒软件\arswp2\arswp2\ArSwp.exe   [(Verified)ArSwp.com, 2, 8, 1, 815, C:2008-08-15 22:25 M:2008-08-15 22:25]
    C:\WINDOWS\system32\kmon.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 27, C:2008-08-22 08:01 M:2008-08-23 08:06]
    C:\Program Files\Rising\AntiSpyware\comx3.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 21.0.0.33, C:2008-08-22 08:01 M:2008-08-22 08:01]
    C:\Program Files\Rising\AntiSpyware\Syslay.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 21.0.0.6, C:2008-08-22 08:01 M:2008-08-22 08:01]
    C:\WINDOWS\system32\uxtheme.dll  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-07 09:37]
    C:\Program Files\wrkwn80\windlwork.dll  [N/A, C:2008-02-19 21:02 M:2007-09-12 13:57]
    F:\工具\杀毒软件\arswp2\arswp2\plugin\ArFix.dll  [(Verified)ArSwp.Com, 2, 5, 0, 0, C:2007-11-28 15:19 M:2007-11-28 15:19]

[PID: 3708 / Administrator]   C:\Program Files\Tencent\QQ\QzoneMusic.exe   [(Verified)深圳腾讯科技, 3, 1, 163, 202, C:2007-05-20 16:38 M:2007-05-20 16:38]
    C:\WINDOWS\system32\kmon.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 27, C:2008-08-22 08:01 M:2008-08-23 08:06]
    C:\Program Files\Rising\AntiSpyware\comx3.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 21.0.0.33, C:2008-08-22 08:01 M:2008-08-22 08:01]
    C:\Program Files\Rising\AntiSpyware\Syslay.dll  [(Verified)Beijing Rising Information Technology Co., Ltd., 21.0.0.6, C:2008-08-22 08:01 M:2008-08-22 08:01]
    C:\WINDOWS\system32\uxtheme.dll  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158), C:1980-01-01 00:00 M:2004-08-07 09:37]
    C:\Program Files\wrkwn80\windlwork.dll  [N/A, C:2008-02-19 21:02 M:2007-09-12 13:57]
    C:\Program Files\Tencent\QQ\QQMusicPlayer.dll  [(Verified)Tencent, 1, 6, 55, 207, C:2007-07-28 15:19 M:2007-07-28 15:19]
    C:\Program Files\Tencent\QQ\QQMediaPlayer.dll  [(Verified)Tencent, 1, 6, 55, 207, C:2007-07-28 15:19 M:2007-07-28 15:19]
    C:\Program Files\Tencent\QQ\msdmo.dll  [(Verified)N/A, C:2007-07-01 08:54 M:2007-07-01 08:54]
    C:\Program Files\Tencent\QQ\vqqsdl.dll  [(Verified)Tencent Technology (Shenzhen) Company Limited, 3, 15, 160, 216, C:2007-07-18 20:25 M:2007-07-18 20:25]
    C:\Program Files\Tencent\QQ\TNProxy.dll  [(Verified)Tencent Technology(Shenzhen) Company Limited, 2, 1, 101, 60, C:2008-05-21 10:30 M:2008-05-21 10:30]
    C:\Program Files\Tencent\QQ\QQPlayer.dll  [(Verified)深圳腾讯科技, 3, 1, 163, 202, C:2007-05-20 16:38 M:2007-05-20 16:38]
    C:\Program Files\Tencent\QQ\CMInternet.dll  [(Verified)TENCENT, 1, 4, 53, 205, C:2007-07-28 15:19 M:2007-07-28 15:19]


========================================
文件关联



========================================
AutoRun.INF



========================================
Winsock提供者



========================================
HOSTS

    127.0.0.1 localhost


[/CODE]