[CODE]

2009-01-11,21:52:53

System Repair Engineer 2.7.0.1210
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Advanced Server Service Pack 4 (Build 2195) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件
    进程特权扫描
    计划任务
    API HOOK
    隐藏进程


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><ctfmon.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <HPDJ Taskbar Utility><E:\WINNT\system32\spool\drivers\w32x86\3\hpztsb04.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher, E=""]
    <ssMgr_ccb><E:\Program Files\StarSec\ssMgr_ccb.exe -r>  []
    <runeip><"E:\Program Files\Rising\AntiSpyware\rstray.exe" /startup>  [(Verified)Beijing Rising Information Technology Corporation Limited]
    <yfdown><I:\linshiwenjian\联合证券大智慧\internet\易发\bin\yfdown.exe>  [联合证券]
    <SysAgent><E:\WINNT\system32\SysAgent.exe>  []
    <HPUsageTracking><E:\Program Files\HP\HP UT\bin\hppusg.exe "E:\Program Files\HP\HP UT\">  [File is missing]
    <RavTray><"C:\Rising\Rav\RsTray.exe" -system>  [(Verified)Beijing Rising Information Technology Corporation Limited]
    <TkBellExe><"E:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [(Verified)"RealNetworks, Inc."]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows 2000 Publisher]
    <Userinit><E:\WINNT\system32\UserInit.exe,>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><kmon.dll>  [(Verified)Beijing Rising Information Technology Corporation Limited]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><E:\WINNT\system32\RavExt.dll>  [(Verified)Beijing Rising Information Technology Corporation Limited]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    <WebCheck><%SystemRoot%\system32\webcheck.dll>  [(Verified)Microsoft Windows Component Publisher]
    <SysTray><stobject.dll>  [(Verified)Microsoft Windows 2000 Publisher]
    <Network.ConnectionTray><E:\WINNT\system32\netshell.dll>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
    <WinlogonNotify: crypt32chain><crypt32.dll>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
    <WinlogonNotify: cryptnet><cryptnet.dll>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
    <WinlogonNotify: cscdll><cscdll.dll>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
    <WinlogonNotify: sclgntfy><sclgntfy.dll>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
    <WinlogonNotify: SensLogn><WlNotify.dll>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
    <WinlogonNotify: termsrv><wlnotify.dll>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wminotify]
    <WinlogonNotify: wminotify><wminotify.dll>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
    <WinlogonNotify: wzcnotif><wzcdlg.dll>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
    <{438755C2-A8BA-11D1-B96B-00A0C90312E1}><%SystemRoot%\system32\browseui.dll>  [(Verified)Microsoft Windows Component Publisher]
    <{8C7461EF-2B13-11d2-BE35-3078302C2030}><%SystemRoot%\system32\browseui.dll>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
    <Microsoft Windows Media Player><E:\WINNT\inf\unregmp2.exe /ShowWMP>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
    <自定义浏览器><RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
    <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
    <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection E:\WINNT\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6A5110B5-E14B-4268-A065-EF89FF33C325}]
    <EnableRevocation><regsvr32.exe /s /n /i:"S 2 true 3 true 4 true 5 true 6 true 7 true" initpki.dll>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
    <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection E:\WINNT\INF\wmp.inf,PerUserStub>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
    <Address Book 5><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
    <Windows 桌面更新><regsvr32.exe /s /n /i:U shell32.dll>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
    <Internet Explorer 6><%SystemRoot%\system32\ie4uinit.exe>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
    <N/A><E:\WINNT\system32\Rundll32.exe E:\WINNT\system32\mscories.dll,Install>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}]
    <CRLUpdate><%SystemRoot%\system32\updcrl.exe -e -u %SystemRoot%\system32\verisignpub1.crl>  [File is missing]

==================================
启动文件夹
N/A

==================================
服务
[Apache2 / Apache2][Stopped/Manual Start]
  <"D:\sersys\usr\local\apache2\bin\httpd.exe" -k runservice><Apache Software Foundation>
[Ati HotKey Poller / Ati HotKey Poller][Stopped/Auto Start]
  <E:\WINNT\system32\Ati2evxx.exe><ATI Technologies Inc.>
[ATI Smart / ATI Smart][Stopped/Auto Start]
  <E:\WINNT\system32\ati2sgag.exe><>
[AutoComplete Service / Autocomplete][Stopped/Manual Start]
  <><(File is missing)>
[Autodesk Licensing Service / Autodesk Licensing Service][Stopped/Manual Start]
  <"E:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe"><Autodesk, Inc.>
[C-DillaCdaC11BA / C-DillaCdaC11BA][Stopped/Disabled]
  <e:\WINNT\system32\drivers\CDAC11BA.EXE><Macrovision>
[C-DillaSrv / C-DillaSrv][Stopped/Auto Start]
  <><(File is missing)>
[DuDu Accelerator / DDDProxy][Stopped/Disabled]
  <><(File is missing)>
[Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start]
  <E:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[Google Updater Service / gusvc][Stopped/Manual Start]
  <"E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"><Google>
[icylur / icylur][Stopped/Disabled]
  <E:\WINNT\system32\rundll32.exe E:\PROGRA~1\COMMON~1\vcylar\vcylar.dll,Service -s><Microsoft Corporation>
[iPod 服务 / iPod Service][Stopped/Manual Start]
  <"E:\Program Files\iPod\bin\iPodService.exe"><Apple Inc.>
[Macromedia Licensing Service / Macromedia Licensing Service][Stopped/Manual Start]
  <"E:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><(File is missing)>
[MGABGEXE / MGABGEXE][Stopped/Manual Start]
  <E:\WINNT\system32\mgabg.exe><Matrox Graphics Inc.>
[Microsoft Search / MSSEARCH][Stopped/Disabled]
  <"e:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe"><Microsoft Corporation>
[MSSQLSERVER / MSSQLSERVER][Stopped/Manual Start]
  <e:\PROGRA~1\MI6841~1\MSSQL\binn\sqlservr.exe><Microsoft Corporation>
[MSSQLServerADHelper / MSSQLServerADHelper][Stopped/Manual Start]
  <e:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe><Microsoft Corporation>
[MySQL / MySQL][Stopped/Manual Start]
  <"D:\sersys\usr\local\mysql5\bin\mysqld-nt" --defaults-file="D:\sersys\usr\local\mysql5\my.ini" MySQL><(File is missing)>
[Net Driver HPZ12 / Net Driver HPZ12][Running/Auto Start]
  <E:\WINNT\System32\svchost.exe -k HPZ12-->E:\WINNT\system32\HPZinw12.dll><Hewlett-Packard>
[NVIDIA Driver Helper Service / NVSvc][Running/Auto Start]
  <E:\WINNT\system32\nvsvc32.exe><NVIDIA Corporation>
[PlugServerD / PlugServer][Running/Auto Start]
  <E:\Program Files\StarSec\PlugServer.exe><GDChina>
[Pml Driver HPZ12 / Pml Driver HPZ12][Running/Auto Start]
  <E:\WINNT\System32\svchost.exe -k HPZ12-->E:\WINNT\system32\HPZipm12.dll><Hewlett-Packard>
[Rav Process Communication Center / RavCCenter][Stopped/Auto Start]
  <C:\Rising\Rav\CCENTER.EXE><Beijing Rising Information Technology Co., Ltd.>
[Rising RavTask Manager / RavTask][Running/Auto Start]
  <"C:\Rising\Rav\RavTask.exe" RavTask><Beijing Rising Information Technology Co., Ltd.>
[RaySat_3dsmax7 Server / RaySat_3dsmax7Server][Stopped/Manual Start]
  <H:\3dmax7\mentalray\satellite\raysat_3dsmax7server.exe><N/A>
[Rising RealTime Monitor / RsRavMon][Stopped/Auto Start]
  <C:\Rising\Rav\RavMonD.exe><Beijing Rising Information Technology Co., Ltd.>
[Rising Scan Service / RsScanSrv][Stopped/Auto Start]
  <C:\Rising\Rav\ScanFrm.exe><Beijing Rising Information Technology Co., Ltd.>
[IPSEC Client / SHipING][Stopped/Auto Start]
  <E:\WINNT\SYSTEM32\RUNDLLFOROUR.EXE E:\WINNT\SYSTEM32\WBEM\QPRFK.DLL,Export 1087><(File is missing)>
[SQLSERVERAGENT / SQLSERVERAGENT][Stopped/Manual Start]
  <e:\PROGRA~1\MI6841~1\MSSQL\binn\sqlagent.exe><Microsoft Corporation>
[Te1net / Te1net][Stopped/Disabled]
  <><(File is missing)>
[Trkmaisn / Trkmaisn][Stopped/Disabled]
  <><(File is missing)>
[Ulead Burning Helper / UleadBurningHelper][Running/Auto Start]
  <E:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe><Ulead Systems, Inc.>
[User Profile Hive Cleanup / UPHClean][Running/Auto Start]
  <E:\Program Files\UPHClean\uphclean.exe><Microsoft Corporation>
[WDelMgr20 / WDelMgr20][Stopped/Disabled]
  <E:\WINNT\system32\drivers\WDelMgr20.exe><N/A>
[WinFax PRO / wfxsvc][Stopped/Disabled]
  <><(File is missing)>
[WMDM PMSP Service / WMDM PMSP Service][Stopped/Disabled]
  <><(File is missing)>
[Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start]
  <E:\WINNT\System32\svchost.exe -k netsvcs-->E:\WINNT\system32\mspmsnsv.dll><Microsoft Corporation>

==================================
驱动程序
[WDM Driver for AD1815/16 / ad1816][Stopped/Manual Start]
  <system32\drivers\15_16wdm.sys><N/A>
[ADProt / ADProt][Stopped/System Start]
  <\SystemRoot\system32\drivers\ADProt.sys><腾讯科技（深圳）有限公司>
[Apaidi / Apaidi][Running/Auto Start]
  <\??\E:\WINNT\system32\drivers\Apaidi.sys><N/A>
[ati2mtag / ati2mtag][Stopped/Manual Start]
  <system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
  <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[C-Dilla / C-Dilla][Stopped/Manual Start]
  <\??\e:\WINNT\system32\drivers\CDANT.SYS><N/A>
[CdaC15BA / CdaC15BA][Stopped/Auto Start]
  <\??\e:\WINNT\system32\drivers\CDAC15BA.SYS><Macrovision Europe Ltd>
[cdspacex / cdspacex][Stopped/Manual Start]
  <system32\DRIVERS\CDSPACEX.sys><SPACE INT'L, Inc.>
[CKHook / CKHook][Stopped/Manual Start]
  <\??\e:\WINNT\system32\Drivers\CKHook.sys><N/A>
[STAR-900 PCI Based Network Adapter NT Driver / DM9102][Running/Manual Start]
  <System32\DRIVERS\DM9PCI5.SYS><DAVICOM Semiconductor, Inc.>
[dmboot / dmboot][Stopped/Disabled]
  <System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[ferdr / ferdr][Stopped/Auto Start]
  <\??\e:\WINNT\System32\Drivers\Ferdr.sys><N/A>
[GEARAspiWDM / GEARAspiWDM][Running/Manual Start]
  <System32\Drivers\GEARAspiWDM.sys><GEAR Software Inc.>
[Network Fire Hydrant / HdFw_slot][Stopped/Auto Start]
  <System32\DRIVERS\Hdfw.sys><N/A>
[HOOKAPI / HOOKAPI][Stopped/Manual Start]
  <\??\C:\RISING\RAV\HOOKAPI.SYS><N/A>
[hookcont / hookcont][Running/System Start]
  <system32\drivers\HookCont.sys><Beijing Rising Information Technology Co., Ltd.>
[hooksys / hooksys][Running/System Start]
  <system32\drivers\HookSys.sys><Beijing Rising Information Technology Co., Ltd.>
[IEEE-1284.4 Driver HPZid412 / HPZid412][Stopped/Manual Start]
  <system32\DRIVERS\HPZid412.sys><HP>
[Print Class Driver for IEEE-1284.4 HPZipr12 / HPZipr12][Stopped/Manual Start]
  <system32\DRIVERS\HPZipr12.sys><HP>
[USB to IEEE-1284.4 Translation Driver HPZius12 / HPZius12][Stopped/Manual Start]
  <system32\DRIVERS\HPZius12.sys><HP>
[icddrv / icddrv][Stopped/Manual Start]
  <\??\E:\WINNT\system32\drivers\icddrv.sys><N/A>
[jmip / jmipi][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\jmipi.sys><N/A>
[kmsinput / kmsinput][Stopped/Manual Start]
  <\??\E:\WINNT\system32\drivers\kmsinput.sys><N/A>
[mga64 / mga64][Stopped/Manual Start]
  <System32\DRIVERS\mga64m.sys><Matrox Graphics Inc.>
[mgabg / mgabg][Stopped/Manual Start]
  <\??\E:\WINNT\system32\drivers\mgabg.sys><Matrox Graphics Inc.>
[MGAU / MGAU][Stopped/Manual Start]
  <system32\DRIVERS\MGAUm.sys><Matrox Graphics Inc.>
[Microsoft MPU-401 MIDI UART Driver (WDM) / ms_mpu401][Stopped/Manual Start]
  <system32\drivers\msmpu401.sys><N/A>
[Ncrc710 / Ncrc710][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\ncrc710.sys><N/A>
[New0 / New0][Stopped/Auto Start]
  <\??\e:\WINNT\system32\new.sys><N/A>
[NetGroup Packet Filter Driver / NPF][Stopped/Manual Start]
  <system32\drivers\npf.sys><CACE Technologies>
[npkcrypt / npkcrypt][Running/Auto Start]
  <\??\U:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[NPPTNT / NPPTNT][Stopped/System Start]
  <\??\e:\WINNT\system32\npptNT.sys><N/A>
[nv / nv][Running/Manual Start]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[NVDual / NVDual][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\nvDual.sys><N/A>
[ohollyd / ohollyd][Running/Boot Start]
  <\SystemRoot\system32\drivers\ohollyd.sys><>
[ONSIO / ONSIO][Stopped/Auto Start]
  <\??\E:\WINNT\SYSTEM32\DRIVERS\ONSIO.SYS><N/A>
[ov / ov][Stopped/Manual Start]
  <\??\E:\WINNT\system32\drivers\ov.sys><N/A>
[HP Pci Information / pciinfo][Stopped/Auto Start]
  <\??\E:\DOCUME~1\ADMINI~1.ETC\LOCALS~1\Temp\HPISPz\hpdom\pciinfo.sys><N/A>
[Padus ASPI Shell / pfc][Stopped/Manual Start]
  <system32\drivers\pfc.sys><N/A>
[PNP31323 / PNP31323][Running/Boot Start]
  <\SystemRoot\system32\Drivers\pnp31062.sys><Anti Driver>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[PxHelp20 / PxHelp20][Running/Boot Start]
  <\SystemRoot\System32\Drivers\PxHelp20.sys><Sonic Solutions>
[RGGA / RGGA][Stopped/Auto Start]
  <\??\e:\WINNT\system32\drivers\rgga.sys><N/A>
[WAN Miniport (PPP over Ethernet Protocol) / RMSPPPOE][Stopped/Manual Start]
  <system32\DRIVERS\RMSPPPOE.SYS><N/A>
[ROCKEYNT / ROCKEYNT][Stopped/Auto Start]
  <\??\E:\WINNT\System32\drivers\rockeynt.sys><N/A>
[RsNTGDI / RsNTGDI][Running/Boot Start]
  <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Information Technology Co., Ltd.>
[rwPPPOE Miniport / RWPPPOE][Running/Manual Start]
  <system32\DRIVERS\rwpppoe.sys><runway>
[Secdrv / Secdrv][Stopped/Manual Start]
  <\??\E:\WINNT\system32\drivers\SECDRV.SYS><N/A>
[Sense3 / Sense3][Stopped/Auto Start]
  <System32\Drivers\sense3.sys><N/A>
[Sentinel / Sentinel][Stopped/Auto Start]
  <\SystemRoot\System32\Drivers\SENTINEL.SYS><N/A>
[USB Filter Driver / ser2pl][Stopped/Manual Start]
  <system32\DRIVERS\ser2pl.sys><Prolific Technology Inc.>
[SMPLSCSI / SMPLSCSI][Stopped/Boot Start]
  <\SystemRoot\System32\drivers\SMPLSCSI.sys><N/A>
[Sony Memory Stick Driver(SONYPVM1) / SONYPVM1][Stopped/Boot Start]
  <\SystemRoot\system32\DRIVERS\SONYPVM1.SYS><Sony Corporation>
[Sony USB Filter Driver (SONYPVU1) / SONYPVU1][Stopped/Manual Start]
  <system32\DRIVERS\SONYPVU1.SYS><Sony Corporation>
[Sparrow / Sparrow][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\sparrow.sys><Adaptec, Inc.>
[STV0680 Camera / STV680][Stopped/Manual Start]
  <system32\drivers\STV680.sys><N/A>
[Superk53 / Superk53][Stopped/Auto Start]
  <\SystemRoot\System32\drivers\superk53.sys><N/A>
[Two Rabbits Live Bus / TwoRabts][Stopped/Manual Start]
  <system32\DRIVERS\TwoRabts.sys><Two Rabbits, Inc.>
[UtilNT / UtilNT][Stopped/Manual Start]
  <\??\E:\WINNT\system32\drivers\UtilNT.sys><Matrox Graphics Inc.>
[vbppdryu / vbppdryu][Stopped/Manual Start]
  <\??\E:\WINNT\system32\sosdrp.sys><N/A>
[XSPACEWG / XSPACEWG][Stopped/System Start]
  <\??\E:\WINNT\system32\drivers\XSpaceWg.sys><N/A>
[USB PC Camera 301P / ZSMC301b][Stopped/Manual Start]
  <System32\Drivers\usbVM31b.sys><VM>

==================================
浏览器加载项
[QQCycloneHelper Class]
  {00000000-12C9-4305-82F9-43058F20E8D2} <U:\Program Files\Tencent\QQDownload\QQIEHelper02.dll, (Signed) 腾讯公司>
[WebThunder Browser Helper]
  {00000AAA-A363-466E-BEF5-9BB68697AA7F} <E:\Program Files\Thunder Network\WebThunder\WebThunderBHO_Now.dll, (Signed) Thunder Networking Technologies,LTD>
[]
  {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <, >
[ST]
  {9394EDE7-C8B5-483E-8773-474BF36AF6E4} <E:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll, Microsoft Corporation>
[卡卡上网安全助手]
  {98B7C13A-E9CD-4959-8B46-FBEAB41E42A8} <E:\WINNT\system32\urlFilter.dll, (Signed) Beijing Rising Information Technology Co., Ltd.>
[Download_Bho Class]
  {A986E409-30CC-4185-89BB-AB212C104524} <E:\Program Files\PPLiveVA\DownloaderManager.dll, (Signed) >
[Google Toolbar Helper]
  {AA58ED58-01DD-4d91-8333-CF10577473F7} <e:\program files\google\googletoolbar1.dll, (Signed) Google Inc.>
[NavigatMon Class]
  {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <E:\Program Files\360safe\safemon\safemon.dll, (Signed) 360.CN>
[]
  {BCCCE1E1-EE05-4791-9E3F-B2ACC47CF5AD} <E:\PROGRA~1\btby\SHELLH~1.DLL, http://www.btby.cn>
[MSNToolBandBHO]
  {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} <E:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\zh-cn\msntb.dll, Microsoft Corporation>
[8009]
  {00000000-0000-0000-0000-100010001110} <http://www.8009.com/?tb, N/A>
[信息检索(&R)]
  {92780B25-18CC-41C8-B9BE-3C9C571A8263} <E:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL, (Signed) Microsoft Corporation>
[PPLive]
  {95B3F550-91C4-4627-BCC4-521288C52977} <E:\Program Files\PPLive\PPLive.exe, (Signed) N/A>
[启动WEB迅雷]
  {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} <http://my.xunlei.com, N/A>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, >
[FlashGet]
  {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <E:\PROGRA~1\FlashGet\flashget.exe, FlashGet.com>
[QQIEFloatBarCfgCmd Class]
  {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <U:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[@msdxmLC.dll,-1@2052,电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <E:\WINNT\System32\msdxm.ocx, (Signed) Microsoft Corporation>
[MSN]
  {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} <E:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\zh-cn\msntb.dll, Microsoft Corporation>
[&Google]
  {2318C2B1-4965-11d4-9B18-009027A5CD4F} <e:\program files\google\googletoolbar1.dll, (Signed) Google Inc.>
[Office Genuine Advantage Validation Tool]
  {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} <E:\WINNT\system32\OGACheckControl.DLL, (Signed) >
[Windows Genuine Advantage Validation Tool]
  {17492023-C23A-453E-A040-C7C580BBF700} <E:\WINNT\system32\LegitCheckControl.DLL, (Signed) Microsoft Corporation>
[]
  {3C38DEE8-BE1A-4DEC-B232-2C78706CC7EA} <, >
[WUWebControl Class]
  {6414512B-B978-451D-A0D8-FCFDF33E833C} <E:\WINNT\system32\wuweb.dll, (Signed) Microsoft Corporation>
[MUWebControl Class]
  {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} <E:\WINNT\system32\muweb.dll, (Signed) Microsoft Corporation>
[DLoader Class]
  {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} <E:\WINNT\Downloaded Program Files\downloader.dll, (Signed) Sina Com>
[]
  {87CCFDB0-C4BE-4BC2-A78C-9EAA7CF96667} <, >
[]
  {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} <, >
[VqqSpeedDlProxy Class]
  {9ADACAA6-533E-4383-AFA7-F0A66650B6D8} <E:\WINNT\vqqsdl10.dll, Tencent Technology (Shenzhen) Company Limited>
[ScreenCapture Class]
  {B4D9857D-8A55-4442-A577-6B3ED5D4E41B} <E:\WINNT\system32\FMO.dll, Tencent Inc.>
[ScreenCapture Class]
  {BFB79EE1-04AE-4D4A-B85E-27EE5F30C095} <E:\WINNT\system32\TXGYMailActiveX.dll, (Signed) Tencent Inc.>
[Office Update Installation Engine]
  {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} <E:\WINNT\opuc.dll, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <E:\WINNT\system32\Macromed\Flash\Flash10a.ocx, (Signed) Adobe Systems, Inc.>
[UpdateC2 Control]
  {DC7094C6-8F61-42ED-AECE-63F5EEF647C5} <E:\PROGRA~1\COMMON~1\uusee\updateC2.ocx, (Signed) uusee.com>
[CPPMediaCtrl Object]
  {FCD61199-E187-4ADD-88E5-9AF238486D11} <E:\WINNT\system32\forcetv.dll, 北京原力创新科技有限公司>
[]
  {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} <, >
[]
  {03507A1A-E0C5-4404-AA26-205385C0892D} <, >
[WebThunder DapPlayer]
  {2EEDA47E-8D5C-4d7e-B4B6-E16E19218555} <E:\Program Files\Thunder Network\WebThunder\DownAndPlay\DapPlayer3.0.41.65.686.dll, ShenZhen Thunder Networking Technologies Ltd.>
[XMP Class]
  {6483F145-A768-4C41-AACC-52D4D7845851} <E:\Documents and Settings\All Users.WINNT\Application Data\Thunder Network\KanKan\xplayer.dll_1_work, >
[XDRM]
  {693571CB-54A3-4E90-9D52-EEAE1334E2D3} <E:\Documents and Settings\All Users.WINNT\Application Data\Thunder Network\KanKan\xdrm.dll_1_work, >
[360SafeLive]
  {87515F61-A66C-4319-A0E0-D416CB8059E3} <E:\Program Files\360safe\live.dll, (Signed) 360.cn>
[RMGetLicense Class]
  {A9FC132B-096D-460B-B7D5-1DB0FAE0C062} <E:\WINNT\system32\msnetobj.dll, (Signed) Microsoft Corporation>
[Thunder DapCtrl]
  {ACACC6EB-1FBA-4E13-A729-53AEB2DF54F8} <E:\Documents and Settings\All Users.WINNT\Application Data\Thunder Network\KanKan\DapCtrl1.5.578.28.686.dll, ShenZhen Thunder Networking Technologies Ltd.>
[XPPlayer Class]
  {F3E70CEA-956E-49CC-B444-73AFE593AD7F} <E:\Documents and Settings\All Users.WINNT\Application Data\Thunder Network\KanKan\pplayer.dll_1_work, Thunder>
[&使用超级旋风下载]
  <U:\Program Files\Tencent\QQDownload\geturl.htm, N/A>
[&使用超级旋风下载全部链接]
  <U:\Program Files\Tencent\QQDownload\getAllurl.htm, N/A>
[上传到QQ网络硬盘]
  <U:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用iTudou下载节目]
  <u:\Program Files\Tudou\iTudou\iTudou_Link.HTM, N/A>
[使用WEB迅雷下载]
  <E:\Program Files\Thunder Network\WebThunder\GetUrl.htm, N/A>
[使用WEB迅雷下载全部链接]
  <E:\Program Files\Thunder Network\WebThunder\GetAllUrl.htm, N/A>
[使用网际快车下载]
  <E:\Program Files\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
  <E:\Program Files\FlashGet\jc_all.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
  <res://E:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
  <U:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <U:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <U:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 176][\SystemRoot\System32\smss.exe]  [(Verified) Microsoft Corporation, 5.00.2195.6601]
[PID: 208][\??\E:\WINNT\system32\csrss.exe]  [(Verified) Microsoft Corporation, 5.00.2195.6601]
[PID: 232][\??\E:\WINNT\system32\winlogon.exe]  [(Verified) Microsoft Corporation, 5.00.2195.6997]
    [E:\WINNT\system32\Ati2evxx.dll]  [ATI Technologies Inc., 6.14.10.4129]
[PID: 260][E:\WINNT\system32\services.exe]  [(Verified) Microsoft Corporation, 5.00.2195.7035]
    [E:\WINNT\system32\dmserver.dll]  [VERITAS Software Corp., 2195.6605.297.3]
[PID: 272][E:\WINNT\system32\lsass.exe]  [(Verified) Microsoft Corporation, 5.00.2195.7011]
[PID: 484][E:\WINNT\system32\svchost.exe]  [(Verified) Microsoft Corporation, 5.00.2134.1]
[PID: 528][E:\WINNT\system32\spoolsv.exe]  [(Verified) Microsoft Corporation, 5.00.2195.7059]
    [E:\WINNT\system32\CNMLM3C.DLL]  [CANON INC., 1.50.2.6]
    [E:\WINNT\system32\HP1006LM.DLL]  [Software 2000 Limited, 2.6]
    [E:\WINNT\system32\HpTcpMon.dll]  [Hewlett Packard, 6.01.00.009]
    [E:\WINNT\system32\hpzjrd01.dll]  [Hewlett Packard, 2.01.00.005]
    [E:\WINNT\system32\HPTcpMUI.dll]  [Microsoft Corporation, 6.01.00.009]
    [E:\WINNT\system32\hptcpmib.dll]  [Hewlett Packard, 6.01.00.009]
    [E:\WINNT\system32\hpz3l4sa.dll]  [Hewlett-Packard Company, 60.062.241.00]
    [E:\WINNT\system32\hpzlnt04.dll]  [HP, 2,80,0,0]
    [E:\WINNT\system32\mdimon.dll]  [Microsoft Corporation, 11.3.1897.0]
    [E:\WINNT\system32\spool\PRTPROCS\W32X86\CNMPD3C.DLL]  [CANON INC., 1.50.2.6]
    [E:\WINNT\system32\spool\PRTPROCS\W32X86\HP1006S.DLL]  [Hewlett-Packard , 1.0.2]
    [E:\WINNT\system32\spool\PRTPROCS\W32X86\hpzpp4sa.dll]  [Hewlett-Packard Corporation, 60.062.241.00]
    [E:\WINNT\system32\spool\PRTPROCS\W32X86\mdippr.dll]  [Microsoft Corporation, 11.3.1897.0]
    [E:\WINNT\system32\spool\PRTPROCS\W32X86\vprproc.dll]  [Windows (R) 2000 DDK provider, 5.00.2195.1620]
    [E:\WINNT\system32\spool\DRIVERS\W32X86\3\HP1006MT.DLL]  [Software 2000 Limited, 4.0.0.47]
    [E:\WINNT\system32\spool\DRIVERS\W32X86\3\HP1006MP.DLL]  [Software 2000 Limited, 4.0.0.47]
[PID: 572][C:\Rising\Rav\rsnetsvr.exe]  [Beijing Rising Information Technology Co., Ltd., 21, 0, 0, 12]
    [C:\Rising\Rav\NComm.dll]  [Beijing Rising Information Technology Co., Ltd., 6.0.0.9]
    [C:\Rising\Rav\Syslay.dll]  [Beijing Rising Information Technology Co., Ltd., 21.0.0.6]
    [C:\Rising\Rav\comx3.dll]  [Beijing Rising Information Technology Co., Ltd., 21.0.0.37]
    [C:\Rising\Rav\ProcComm.dll]  [Beijing Rising Information Technology Co., Ltd., 21, 0, 0, 46]
    [E:\WINNT\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [E:\WINNT\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
[PID: 648][E:\WINNT\System32\svchost.exe]  [(Verified) Microsoft Corporation, 5.00.2134.1]
    [E:\WINNT\system32\msjetoledb40.dll]  [, ]
[PID: 680][E:\WINNT\System32\llssrv.exe]  [(Verified) Microsoft Corporation, 5.00.2195.7021]
    [E:\WINNT\System32\kmon.dll]  [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 33]
[PID: 768][E:\WINNT\System32\svchost.exe]  [(Verified) Microsoft Corporation, 5.00.2134.1]
    [e:\winnt\system32\hpzinw12.dll]  [Hewlett-Packard, 12,1,1,52]
[PID: 864][E:\WINNT\System32\WINDOW~1\Server\nspmon.exe]  [Microsoft Corporation, 4.1.00.3934]
    [E:\WINNT\system32\kmon.dll]  [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 33]
[PID: 940][E:\WINNT\system32\nvsvc32.exe]  [NVIDIA Corporation, 6.13.10.2720]
    [E:\WINNT\system32\kmon.dll]  [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 33]
[PID: 1000][E:\Program Files\StarSec\PlugServer.exe]  [GDChina, 1, 1, 0, 2]
    [E:\WINNT\system32\kmon.dll]  [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 33]
    [E:\Program Files\StarSec\plugins\plugstarkey220.dll]  [GDChina, 1, 1, 0, 1]
[PID: 1080][E:\WINNT\System32\svchost.exe]  [(Verified) Microsoft Corporation, 5.00.2134.1]
    [e:\winnt\system32\hpzipm12.dll]  [Hewlett-Packard, 12,1,1,52]
[PID: 1108][E:\WINNT\Explorer.EXE]  [(Verified) Microsoft Corporation, 5.00.3700.6690]
    [E:\WINNT\system32\kmon.dll]  [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 33]
    [E:\WINNT\system32\qpstl.dll]  [N/A, ]
    [E:\WINNT\system32\RavExt.dll]  [Beijing Rising Information Technology Co., Ltd., 21, 0, 0, 12]
    [E:\WINNT\system32\MSCTF.dll]  [Microsoft Corporation, 1.00.2409.41 built by: Lab06_N]
    [E:\WINNT\mui\fallback\0804\msctf.dll.mui]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
    [E:\Program Files\Thunder Network\WebThunder\WebThunderBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 8, 75]
    [E:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 2, 0, 1007]
    [E:\WINNT\system32\MSIMTF.DLL]  [Microsoft Corporation, 1.00.2409.41 built by: Lab06_N]
    [E:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll]  [, 1, 0, 0, 1]
    [U:\coreldraw12\PROGRAMS\CdrIco.DLL]  [Corel Corporation, 1.0.0.458]
    [U:\coreldraw12\PROGRAMS\CRLUTL.dll]  [Corel Corporation, 1.0.0.458]
    [U:\coreldraw12\PROGRAMS\CRLI18N.dll]  [Corel Corporation, 1.0.0.458]
    [E:\WINNT\system32\MFC71U.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [E:\WINNT\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [E:\WINNT\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [E:\WINNT\system32\MFC71CHS.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [E:\Program Files\Common Files\Adobe\Shell\PSICON.DLL]  [Adobe Systems, Incorporated, 7.0]
[PID: 1256][E:\WINNT\system32\MSTask.exe]  [(Verified) Microsoft Corporation, 4.71.2195.6972]
    [E:\WINNT\system32\kmon.dll]  [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 33]
[PID: 1332][E:\WINNT\System32\tcpsvcs.exe]  [(Verified) Microsoft Corporation, 5.00.2134.1]
    [E:\WINNT\System32\kmon.dll]  [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 33]
[PID: 1356][E:\WINNT\System32\snmp.exe]  [(Verified) Microsoft Corporation, 5.00.2195.7112]
    [E:\WINNT\System32\kmon.dll]  [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 33]
[PID: 1376][E:\WINNT\system32\stisvc.exe]  [(Verified) Microsoft Corporation, 5.00.2195.6656]
    [E:\WINNT\system32\kmon.dll]  [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 33]
[PID: 1436][E:\WINNT\system32\spool\drivers\w32x86\3\hpztsb04.exe]  [HP, 2,80,0,0]
    [E:\WINNT\system32\kmon.dll]  [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 33]
    [E:\WINNT\system32\spool\drivers\w32x86\3\HPZR3204.DLL]  [HP, 2,80,0,0]
    [E:\WINNT\system32\MSCTF.dll]  [Microsoft Corporation, 1.00.2409.41 built by: Lab06_N]
[PID: 1444][E:\Program Files\StarSec\ssMgr_ccb.exe]  [, 1, 0, 5, 1026]
    [E:\WINNT\system32\kmon.dll]  [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 33]
    [E:\WINNT\system32\SSP11_CCB.dll]  [GDChina, 1, 0, 0, 2]
    [E:\WINNT\system32\MSCTF.dll]  [Microsoft Corporation, 1.00.2409.41 built by: Lab06_N]
[PID: 1452][E:\Program Files\Rising\AntiSpyware\rstray.exe]  [Beijing Rising Information Technology Co., Ltd., 21.0.0.16]
    [E:\Program Files\Rising\AntiSpyware\rsmginfo.dll]  [Beijing Rising Information Technology Co., Ltd., 21, 0, 0, 11]
    [E:\Program Files\Rising\AntiSpyware\RsXML.dll]  [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 2]
    [E:\Program Files\Rising\AntiSpyware\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [E:\Program Files\Rising\AntiSpyware\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [E:\WINNT\system32\MSCTF.dll]  [Microsoft Corporation, 1.00.2409.41 built by: Lab06_N]
    [E:\Program Files\Rising\AntiSpyware\ComServ.dll]  [Beijing Rising Information Technology Co., Ltd., 21.0.0.31]
    [E:\Program Files\Rising\AntiSpyware\Syslay.dll]  [Beijing Rising Information Technology Co., Ltd., 21.0.0.6]
    [E:\Program Files\Rising\AntiSpyware\rscommon.dll]  [Beijing Rising Information Technology Co., Ltd., 20.0.1.1]
    [E:\Program Files\Rising\AntiSpyware\comx3.dll]  [Beijing Rising Information Technology Co., Ltd., 21.0.0.37]
    [E:\Program Files\Rising\AntiSpyware\pngdll.dll]  [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 5]
    [E:\Program Files\Rising\AntiSpyware\runiep.dll]  [Beijing Rising Information Technology Co., Ltd., 6.0.0.42]
    [E:\Program Files\Rising\AntiSpyware\NComm.dll]  [Beijing Rising Information Technology Co., Ltd., 6.0.0.11]
    [C:\Rising\Rav\ProcCom.dll]  [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 20]
    [E:\Program Files\Rising\AntiSpyware\RsCommX2.dll]  [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 20]
    [E:\WINNT\mui\fallback\0804\msctf.dll.mui]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[PID: 1460][I:\linshiwenjian\联合证券大智慧\internet\易发\bin\yfdown.exe]  [联合证券, 1.0.0.710]
    [I:\linshiwenjian\联合证券大智慧\internet\易发\bin\rtl70.bpl]  [Borland Software Corporation, 7.0.4.453]
    [I:\linshiwenjian\联合证券大智慧\internet\易发\bin\vcl70.bpl]  [Borland Software Corporation, 7.0.4.453]
    [I:\linshiwenjian\联合证券大智慧\internet\易发\bin\indy70.bpl]  [N/A, ]
    [I:\linshiwenjian\联合证券大智慧\internet\易发\bin\adortl70.bpl]  [Borland Software Corporation, 7.0.4.453]
    [I:\linshiwenjian\联合证券大智慧\internet\易发\bin\dbrtl70.bpl]  [Borland Software Corporation, 7.0.4.453]
    [I:\linshiwenjian\联合证券大智慧\internet\易发\bin\vcldb70.bpl]  [Borland Software Corporation, 7.0.4.453]
    [I:\linshiwenjian\联合证券大智慧\internet\易发\bin\VclSmp70.bpl]  [Borland Software Corporation, 7.0.0.188]
    [I:\linshiwenjian\联合证券大智慧\internet\易发\bin\vclx70.bpl]  [Borland Software Corporation, 7.0.4.453]
    [I:\linshiwenjian\联合证券大智慧\internet\易发\bin\vclie70.bpl]  [Borland Software Corporation, 7.0.4.453]
    [I:\linshiwenjian\联合证券大智慧\internet\易发\bin\WinSkinD7R.bpl]  [, 1.0.0.0]
    [E:\WINNT\system32\kmon.dll]  [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 33]
    [E:\WINNT\system32\MSCTF.dll]  [Microsoft Corporation, 1.00.2409.41 built by: Lab06_N]
    [E:\WINNT\system32\msjetoledb40.dll]  [, ]
[PID: 1468][E:\WINNT\system32\SysAgent.exe]  [N/A, ]
    [E:\WINNT\system32\kmon.dll]  [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 33]
    [E:\WINNT\system32\MSCTF.dll]  [Microsoft Corporation, 1.00.2409.41 built by: Lab06_N]
[PID: 1500][E:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.4053]
    [E:\WINNT\system32\kmon.dll]  [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 33]
    [E:\WINNT\system32\MSCTF.dll]  [Microsoft Corporation, 1.00.2409.41 built by: Lab06_N]
[PID: 1512][E:\WINNT\system32\ctfmon.exe]  [Microsoft Corporation, 1.00.2409.41 built by: Lab06_N]
    [E:\WINNT\system32\MSCTF.dll]  [Microsoft Corporation, 1.00.2409.41 built by: Lab06_N]
    [E:\WINNT\system32\MSUTB.dll]  [Microsoft Corporation, 1.00.2409.41 built by: Lab06_N]
    [E:\WINNT\system32\kmon.dll]  [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 33]
    [E:\WINNT\mui\fallback\0804\msutb.dll.mui]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
    [E:\WINNT\mui\fallback\0804\msctf.dll.mui]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[PID: 1524][E:\WINNT\system32\RUNDLL32.EXE]  [Microsoft Corporation, 5.00.2134.1]
    [E:\WINNT\system32\kmon.dll]  [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 33]
    [E:\WINNT\system32\NvQTwk.dll]  [NVIDIA Corporation, 6.13.10.2720]
    [E:\WINNT\system32\MSCTF.dll]  [Microsoft Corporation, 1.00.2409.41 built by: Lab06_N]
    [E:\WINNT\system32\NVRSZHC.DLL]  [NVIDIA Corporation, 6.13.10.2720]
[PID: 1532][E:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe]  [Ulead Systems, Inc., 1, 0, 0, 4]
[PID: 1624][E:\Program Files\UPHClean\uphclean.exe]  [Microsoft Corporation, 1.6.30.0]
    [E:\WINNT\system32\MSVCP60.dll]  [Microsoft Corporation, 6.00.8972.0]
    [E:\WINNT\system32\kmon.dll]  [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 33]
[PID: 1412][E:\WINNT\system32\spool\DRIVERS\W32X86\3\HP1006MC.EXE]  [Software 2000 Limited, 4.0.0.47]
    [E:\WINNT\system32\kmon.dll]  [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 33]
    [E:\WINNT\system32\spool\DRIVERS\W32X86\3\HP1006MP.DLL]  [Software 2000 Limited, 4.0.0.47]
[PID: 1716][E:\WINNT\System32\WBEM\WinMgmt.exe]  [(Verified) Microsoft Corporation, 1.50.1085.0100]
    [E:\WINNT\system32\kmon.dll]  [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 33]
[PID: 1800][E:\WINNT\System32\msdtc.exe]  [(Verified) Microsoft Corporation, 1999.9.3421.3]
    [E:\WINNT\System32\kmon.dll]  [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 33]
    [E:\Program Files\Rising\AntiSpyware\comx3.dll]  [Beijing Rising Information Technology Co., Ltd., 21.0.0.37]
    [E:\Program Files\Rising\AntiSpyware\Syslay.dll]  [Beijing Rising Information Technology Co., Ltd., 21.0.0.6]
[PID: 1124][E:\WINNT\System32\svchost.exe]  [(Verified) Microsoft Corporation, 5.00.2134.1]
[PID: 2236][E:\WINNT\system32\conime.exe]  [(Verified) Microsoft Corporation, 5.00.2195.6655]
    [E:\WINNT\system32\kmon.dll]  [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 33]
    [E:\Program Files\Rising\AntiSpyware\comx3.dll]  [Beijing Rising Information Technology Co., Ltd., 21.0.0.37]
    [E:\Program Files\Rising\AntiSpyware\Syslay.dll]  [Beijing Rising Information Technology Co., Ltd., 21.0.0.6]
    [E:\WINNT\system32\MSCTF.dll]  [Microsoft Corporation, 1.00.2409.41 built by: Lab06_N]
[PID: 2124][E:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2800.1106]
    [E:\WINNT\system32\kmon.dll]  [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 33]
    [E:\Program Files\Rising\AntiSpyware\comx3.dll]  [Beijing Rising Information Technology Co., Ltd., 21.0.0.37]
    [E:\Program Files\Rising\AntiSpyware\Syslay.dll]  [Beijing Rising Information Technology Co., Ltd., 21.0.0.6]
    [E:\WINNT\system32\MSCTF.dll]  [Microsoft Corporation, 1.00.2409.41 built by: Lab06_N]
    [U:\Program Files\Tencent\QQDownload\QQIEHelper02.dll]  [腾讯公司, 1, 9, 252, 252]
    [E:\WINNT\system32\MSVCP60.dll]  [Microsoft Corporation, 6.00.8972.0]
    [E:\Program Files\Thunder Network\WebThunder\WebThunderBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 8, 75]
    [E:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll]  [Microsoft Corporation, 01.02.3000.1001]
    [E:\WINNT\system32\urlFilter.dll]  [Beijing Rising Information Technology Co., Ltd., 6, 0, 0, 15]
    [E:\Program Files\Rising\AntiSpyware\UrlRule.dll]  [Beijing Rising Information Technology Co., Ltd., 1.0.0.15]
    [E:\Program Files\PPLiveVA\DownloaderManager.dll]  [, 1.0.0.12]
    [e:\program files\google\googletoolbar1.dll]  [Google Inc., 4, 0, 1601, 4978]
    [E:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 2, 0, 1007]
    [E:\PROGRA~1\btby\SHELLH~1.DLL]  [http://www.btby.cn, 1.1.0.301]
    [E:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\zh-cn\msntb.dll]  [Microsoft Corporation, 01.02.5000.1021]
    [E:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\zh-cn\mtbres.dll]  [Microsoft Corporation, 01.02.5000.1021]
    [E:\WINNT\mui\fallback\0804\msctf.dll.mui]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
    [E:\WINNT\system32\MSIMTF.DLL]  [Microsoft Corporation, 1.00.2409.41 built by: Lab06_N]
    [C:\Rising\Rav\RavScrCh.dll]  [Beijing Rising Information Technology Co., Ltd., 21.0.0.56]
    [E:\WINNT\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [E:\WINNT\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [E:\WINNT\system32\Macromed\Flash\Flash10a.ocx]  [Adobe Systems, Inc., 10,0,12,36]
[PID: 2172][E:\Documents and Settings\Administrator.ETC\桌面\工具\regng\SREngLdr.EXE]  [Smallfrogs Studio, 2.7.0.1210]
    [E:\WINNT\system32\kmon.dll]  [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 33]
[PID: 2064][E:\Documents and Settings\Administrator.ETC\桌面\工具\regng\SRE7c33cae8.EXE]  [Smallfrogs Studio, 2.7.0.1210]
    [E:\WINNT\system32\kmon.dll]  [Beijing Rising Information Technology Co., Ltd., 1, 0, 0, 33]
    [E:\Program Files\Rising\AntiSpyware\comx3.dll]  [Beijing Rising Information Technology Co., Ltd., 21.0.0.37]
    [E:\Program Files\Rising\AntiSpyware\Syslay.dll]  [Beijing Rising Information Technology Co., Ltd., 21.0.0.6]
    [E:\WINNT\system32\MSCTF.dll]  [Microsoft Corporation, 1.00.2409.41 built by: Lab06_N]
    [E:\WINNT\mui\fallback\0804\msctf.dll.mui]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
    [E:\Documents and Settings\Administrator.ETC\桌面\工具\regng\Plugins\NTFSTREAM.SRE]  [Smallfrogs Studio, 1, 0, 0, 5]
    [E:\Documents and Settings\Administrator.ETC\桌面\工具\regng\Plugins\NWMON.SRE]  [Smallfrogs Studio, 1, 0, 0, 8]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["E:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost
125.65.110.186 www.yashixuan.com
125.65.110.186 yashixuan.com

==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 940, E:\WINNT\SYSTEM32\NVSVC32.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1000, E:\PROGRAM FILES\STARSEC\PLUGSERVER.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1444, E:\PROGRAM FILES\STARSEC\SSMGR_CCB.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1460, I:\LINSHIWENJIAN\联合证券大智慧\INTERNET\易发\BIN\YFDOWN.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1468, E:\WINNT\SYSTEM32\SYSAGENT.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1512, E:\WINNT\SYSTEM32\CTFMON.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1532, E:\PROGRAM FILES\COMMON FILES\ULEAD SYSTEMS\DVD\ULCDRSVR.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1624, E:\PROGRAM FILES\UPHCLEAN\UPHCLEAN.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2172, E:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.ETC\桌面\工具\REGNG\SRENGLDR.EXE]

==================================
计划任务
N/A

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================


[/CODE]