[CODE]

2009-04-20,10:14:30

System Repair Engineer 2.7.1.1261
Smallfrogs (http://www.KZTechs.com)

Windows Server 2003 Standard Edition Service Pack 1 (Build 3790) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件
    进程特权扫描
    计划任务
    API HOOK
    隐藏进程


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Publisher]
    <IMEKRMIG6.1><C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE>  [(Verified)Microsoft Windows Publisher]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Publisher]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows Publisher]
    <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>  [NVIDIA Corporation]
    <nwiz><nwiz.exe /install>  []
    <NvMediaCenter><RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit>  [NVIDIA Corporation]
    <SoundMan><SOUNDMAN.EXE>  [Realtek Semiconductor Corp.]
    <BDAgent><"F:\Program Files\BitDefender\BitDefender 2009\bdagent.exe">  [File is missing]
    <BitDefender Antiphishing Helper><"F:\Program Files\BitDefender\BitDefender 2009\IEShow.exe">  [File is missing]
    <Refresh><E:\Program Files\i8Client\Refresh_service.exe>  [盛光科技]
    <caoni><C:\Program Files\Common Files\caoni.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><%SystemRoot%\system32\logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{AEB6717E-7E19-11d0-97EE-00C04FD91972}><shell32.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    <PostBootReminder><%SystemRoot%\system32\SHELL32.dll>  [(Verified)Microsoft Windows Publisher]
    <CDBurn><%SystemRoot%\system32\SHELL32.dll>  [(Verified)Microsoft Windows Publisher]
    <WebCheck><%SystemRoot%\system32\webcheck.dll>  [(Verified)Microsoft Windows Publisher]
    <SysTray><C:\WINDOWS\system32\stobject.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
    <WinlogonNotify: crypt32chain><crypt32.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
    <WinlogonNotify: cryptnet><cryptnet.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
    <WinlogonNotify: cscdll><cscdll.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dimsntfy]
    <WinlogonNotify: dimsntfy><dimsntfy.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
    <WinlogonNotify: ScCertProp><wlnotify.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
    <WinlogonNotify: Schedule><wlnotify.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
    <WinlogonNotify: sclgntfy><sclgntfy.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
    <WinlogonNotify: SensLogn><WlNotify.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
    <WinlogonNotify: termsrv><wlnotify.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
    <WinlogonNotify: wlballoon><wlnotify.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
    <{438755C2-A8BA-11D1-B96B-00A0C90312E1}><%SystemRoot%\system32\browseui.dll>  [(Verified)Microsoft Windows Publisher]
    <{8C7461EF-2B13-11d2-BE35-3078302C2030}><%SystemRoot%\system32\browseui.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
    <Microsoft Windows Media Player><C:\WINDOWS\inf\unregmp2.exe /ShowWMP>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
    <浏览器自定义组件><RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
    <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
    <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
    <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
    <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
    <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
    <Windows 桌面更新><regsvr32.exe /s /n /i:U shell32.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
    <Internet Explorer 6><%SystemRoot%\system32\ie4uinit.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
    <N/A><C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}]
    <%IEHARDENADMIN_BASE_DESC%><%SystemRoot%\system32\rundll32.exe iesetup.dll,IEHardenAdmin>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}]
    <%IEHARDENUSER_DESC%><%SystemRoot%\system32\rundll32.exe iesetup.dll,IEHardenUser>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360hotfix.exe]
    <IFEO[360hotfix.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe]
    <IFEO[360rpt.exe]><C:\WINDOWS\system32\svchost.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe]
    <IFEO[360Safe.exe]><C:\WINDOWS\system32\svchost.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.exe]
    <IFEO[360safebox.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe]
    <IFEO[360tray.exe]><C:\WINDOWS\system32\svchost.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adam.exe]
    <IFEO[adam.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvr.exe]
    <IFEO[AgentSvr.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntiArp.exe]
    <IFEO[AntiArp.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AppSvc32.exe]
    <IFEO[AppSvc32.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\arvmon.exe]
    <IFEO[arvmon.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoGuarder.exe]
    <IFEO[AutoGuarder.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe]
    <IFEO[autoruns.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrssvc.exe]
    <IFEO[avgrssvc.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe]
    <IFEO[AvMonitor.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com]
    <IFEO[avp.com]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe]
    <IFEO[avp.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe]
    <IFEO[CCenter.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe]
    <IFEO[ccSvcHst.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DrRtp.exe]
    <IFEO[DrRtp.exe]><C:\WINDOWS\system32\svchost.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FileDsty.exe]
    <IFEO[FileDsty.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\findt2005.exe]
    <IFEO[findt2005.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FTCleanerShell.exe]
    <IFEO[FTCleanerShell.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe]
    <IFEO[HijackThis.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe]
    <IFEO[IceSword.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmo.exe]
    <IFEO[iparmo.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe]
    <IFEO[Iparmor.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IsHelp.exe]
    <IFEO[IsHelp.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isPwdSvc.exe]
    <IFEO[isPwdSvc.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kabaload.exe]
    <IFEO[kabaload.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KaScrScn.SCR]
    <IFEO[KaScrScn.SCR]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMain.exe]
    <IFEO[KASMain.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASTask.exe]
    <IFEO[KASTask.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe]
    <IFEO[KAV32.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe]
    <IFEO[KAVDX.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.exe]
    <IFEO[KAVPFW.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSetup.exe]
    <IFEO[KAVSetup.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe]
    <IFEO[KAVStart.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\killhidepid.exe]
    <IFEO[killhidepid.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLnchr.exe]
    <IFEO[KISLnchr.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMailMon.exe]
    <IFEO[KMailMon.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMFilter.exe]
    <IFEO[KMFilter.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe]
    <IFEO[KPFW32.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32X.exe]
    <IFEO[KPFW32X.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFWSvc.exe]
    <IFEO[KPFWSvc.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe]
    <IFEO[KRegEx.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRepair.COM]
    <IFEO[KRepair.COM]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KsLoader.exe]
    <IFEO[KsLoader.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.kxp]
    <IFEO[KVCenter.kxp]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvDetect.exe]
    <IFEO[KvDetect.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvfw.exe]
    <IFEO[kvfw.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvfwMcl.exe]
    <IFEO[KvfwMcl.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp]
    <IFEO[KVMonXP.kxp]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP_1.kxp]
    <IFEO[KVMonXP_1.kxp]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvol.exe]
    <IFEO[kvol.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvolself.exe]
    <IFEO[kvolself.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvReport.kxp]
    <IFEO[KvReport.kxp]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVScan.kxp]
    <IFEO[KVScan.kxp]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe]
    <IFEO[KVSrvXP.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVStub.kxp]
    <IFEO[KVStub.kxp]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvupload.exe]
    <IFEO[kvupload.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvwsc.exe]
    <IFEO[kvwsc.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp]
    <IFEO[KvXP.kxp]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP_1.kxp]
    <IFEO[KvXP_1.kxp]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe]
    <IFEO[KWatch.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch9x.exe]
    <IFEO[KWatch9x.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchX.exe]
    <IFEO[KWatchX.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe]
    <IFEO[loaddll.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe]
    <IFEO[MagicSet.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe]
    <IFEO[mcconsol.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmqczj.exe]
    <IFEO[mmqczj.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmsk.exe]
    <IFEO[mmsk.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVSetup.exe]
    <IFEO[NAVSetup.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe]
    <IFEO[nod32krn.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe]
    <IFEO[nod32kui.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe]
    <IFEO[PFW.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe]
    <IFEO[PFWLiveUpdate.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSET.exe]
    <IFEO[QHSET.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctor.exe]
    <IFEO[QQDoctor.exe]><C:\WINDOWS\system32\svchost.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ras.exe]
    <IFEO[Ras.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe]
    <IFEO[Rav.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavCopy.exe]
    <IFEO[RavCopy.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe]
    <IFEO[RavMon.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe]
    <IFEO[RavMonD.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStore.exe]
    <IFEO[RavStore.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe]
    <IFEO[RavStub.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravt08.exe]
    <IFEO[ravt08.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe]
    <IFEO[RavTask.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegClean.exe]
    <IFEO[RegClean.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe]
    <IFEO[rfwcfg.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe]
    <IFEO[RfwMain.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwolusr.exe]
    <IFEO[rfwolusr.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwProxy.exe]
    <IFEO[rfwProxy.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe]
    <IFEO[rfwsrv.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe]
    <IFEO[RsAgent.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe]
    <IFEO[Rsaupd.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsMain.exe]
    <IFEO[RsMain.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsnetsvr.exe]
    <IFEO[rsnetsvr.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RStray.exe]
    <IFEO[RStray.exe]><C:\WINDOWS\system32\svchost.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe]
    <IFEO[runiep.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safebank.exe]
    <IFEO[safebank.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxTray.exe]
    <IFEO[safeboxTray.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safelive.exe]
    <IFEO[safelive.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe]
    <IFEO[scan32.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ScanFrm.exe]
    <IFEO[ScanFrm.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shcfg32.exe]
    <IFEO[shcfg32.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smartassistant.exe]
    <IFEO[smartassistant.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmartUp.exe]
    <IFEO[SmartUp.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREng.exe]
    <IFEO[SREng.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREngPS.exe]
    <IFEO[SREngPS.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe]
    <IFEO[symlcsvc.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\syscheck.exe]
    <IFEO[syscheck.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Syscheck2.exe]
    <IFEO[Syscheck2.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SysSafe.exe]
    <IFEO[SysSafe.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ToolsUp.exe]
    <IFEO[ToolsUp.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.exe]
    <IFEO[TrojanDetector.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trojanwall.exe]
    <IFEO[Trojanwall.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.kxp]
    <IFEO[TrojDie.kxp]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe]
    <IFEO[UIHost.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAgent.exe]
    <IFEO[UmxAgent.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAttachment.exe]
    <IFEO[UmxAttachment.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxCfg.exe]
    <IFEO[UmxCfg.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxFwHlp.exe]
    <IFEO[UmxFwHlp.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxPol.exe]
    <IFEO[UmxPol.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpLive.exe]
    <IFEO[UpLive.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WoptiClean.exe]
    <IFEO[WoptiClean.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zxsweep.exe]
    <IFEO[zxsweep.exe]><ntsd -d>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\修复工具.exe]
    <IFEO[修复工具.exe]><ntsd -d>  [N/A]

==================================
启动文件夹
[PoliceMan.exe]
  <C:\Documents and Settings\All Users.WINDOWS\「开始」菜单\程序\启动\PoliceMan.exe.lnk --> E:\PROGRA~1\NETECA~1\POLICE~1.EXE [N/A]><N>
[RsConsole.exe]
  <C:\Documents and Settings\All Users.WINDOWS\「开始」菜单\程序\启动\RsConsole.exe.lnk --> E:\PROGRA~1\NETECA~1\RSCONS~1.EXE [上海雨人软件技术开发有限公司]><N>

==================================
服务
[BitDefender Arrakis Server / Arrakis3][Stopped/Manual Start]
  <"C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe"><BitDefender S.R.L. http://www.bitdefender.com>
[Contrl Center of Storm Media / ccosm][Running/Auto Start]
  <C:\Program Files\StormII\stormliv.exe /asservice><北京暴风网际科技有限公司>
[GetCRService / GetCRService][Running/Auto Start]
  <e:\Program Files\NetecardServer\GetConsumeService.exe><N/A>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[BitDefender Desktop Update Service / LIVESRV][Running/Auto Start]
  <"C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe" /service><BitDefender SRL>
[NetMgrClient / NetMgrClient][Running/Auto Start]
  <E:\Program Files\i8Client\NetMgrClient.exe><盛光科技>
[NVIDIA Display Driver Service / NVSvc][Stopped/Disabled]
  <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[RsBackup / RsBackup][Running/Auto Start]
  <e:\Program Files\NetecardServer\backup.exe><N/A>
[RsFileServer / RsFileServer][Running/Auto Start]
  <e:\Program Files\NetecardServer\RsFileServer.exe><N/A>
[RsServer / RsServer][Running/Auto Start]
  <e:\Program Files\NetecardServer\RsServer.exe><上海雨人软件技术开发有限公司>
[RsSysServer / RsSysServer][Running/Auto Start]
  <e:\Program Files\NetecardServer\RsSysServer.exe><TODO: <公司名>>
[BitDefender Threat Scanner / scan][Stopped/Manual Start]
  <C:\WINDOWS\System32\svchost.exe -kbdx-->C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\scan.dll><S.C. BitDefender S.R.L>
[SMSCServer / SMSCServer][Running/Auto Start]
  <e:\Program Files\NetecardServer\services\SMSCServer.exe><N/A>
[SMSDownLoad / SMSDownLoad][Running/Auto Start]
  <e:\Program Files\NetecardServer\services\SMSDownLoad.exe><上海钱易网络科技有限公司>
[VideoSnapUsbCamera / VideoSnapUsbCamera][Running/Auto Start]
  <E:\Program Files\NetecardConsole\VideoSnapService_UsbCamera.exe><N/A>
[BitDefender Virus Shield / VSSERV][Stopped/Auto Start]
  <"F:\Program Files\BitDefender\BitDefender 2009\vsserv.exe" /service><(File is missing)>

==================================
驱动程序
[00127519 / 00127519][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\Drivers\00127519.sys><N/A>
[0017ffeb / 0017ffeb][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\Drivers\0017ffeb.sys><N/A>
[Service for WDM 3D Audio Driver / ALCXSENS][Running/Manual Start]
  <system32\drivers\ALCXSENS.SYS><Sensaura>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[aliimz / aliimz][Stopped/Manual Start]
  <System32\Drivers\aliimz.sys><N/A>
[bdfm / bdfm][Stopped/Manual Start]
  <system32\drivers\bdfm.sys><BitDefender S.R.L. Bucharest, ROMANIA>
[bdfsfltr / bdfsfltr][Stopped/Manual Start]
  <system32\drivers\bdfsfltr.sys><BitDefender S.R.L. Bucharest, ROMANIA>
[bdftdif / bdftdif][Running/System Start]
  <\??\C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdftdif.sys><BitDefender LLC>
[BDSelfPr / BDSelfPr][Stopped/Manual Start]
  <\??\F:\Program Files\BitDefender\BitDefender 2009\bdselfpr.sys><N/A>
[IP in IP Tunnel Driver / IpInIp][Stopped/Manual Start]
  <system32\DRIVERS\ipinip.sys><N/A>
[nv / nv][Running/Manual Start]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Profos / Profos][Stopped/Manual Start]
  <\??\C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\profos.sys><N/A>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
[Trufos / Trufos][Stopped/Manual Start]
  <\??\C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\trufos.sys><N/A>
[wxNDA / wxNDA][Running/Boot Start]
  <\SystemRoot\system32\drivers\wxNDA.sys><成都吉胜科技>
[zx / zx][Stopped/Manual Start]
  <\??\C:\DOCUME~1\ADMINI~3.LID\LOCALS~1\Temp\~d77f6.tmp><N/A>
[nwxbx / nwxbx][Stopped/Manual Start]
  <\??\C:\WINDOWS\Fonts\nwxbx.fon><N/A>

==================================
浏览器加载项
[BBNBHO Class]
  {0C696E52-BF38-49A8-9017-ACE15A794707} <E:\Program Files\i8Client\Plugin\BHO_Goyoo\BBN_Goyoo.dll, Google Inc>
[i8 Safe Plugin For IE]
  {B45336D0-B9DB-4E40-911C-C7BAF0C7AA2E} <E:\Program Files\i8Client\Plugin\BHO_Goyoo\BHO_Goyoo.dll, >
[BitDefender Toolbar]
  {381FFDE8-2394-4f90-B10D-FC6124A40F8C} <F:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll, N/A>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash10b.ocx, (Signed) Adobe Systems, Inc.>
[XML Document]
  {48123BC4-99D9-11D1-A6B3-00C04FD91555} <C:\WINDOWS\system32\msxml3.dll, (Signed) Microsoft Corporation>
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, (Signed) Microsoft Corporation>
[SearchAssistantOC]
  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, (Signed) N/A>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash10b.ocx, (Signed) Adobe Systems, Inc.>

==================================
正在运行的进程
[PID: 400 / SYSTEM][\SystemRoot\System32\smss.exe]  [(Verified) Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 460 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [(Verified) Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 740 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [(Verified) Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
    [C:\WINDOWS\system32\COMRes.dll]  [N/A, ]
[PID: 784 / SYSTEM][C:\WINDOWS\system32\services.exe]  [(Verified) Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 796 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [(Verified) Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 988 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [(Verified) Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
    [C:\WINDOWS\system32\COMRes.dll]  [N/A, ]
[PID: 1060 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [(Verified) Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
    [C:\WINDOWS\system32\COMRes.dll]  [N/A, ]
[PID: 1104 / SYSTEM][C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe]  [BitDefender SRL, 12, 0, 11, 21]
    [C:\Program Files\Common Files\BitDefender\BitDefender Update Service\txmlutil.dll]  [, 12, 0, 12, 5]
    [C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6B128700\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.762]
    [C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6B128700\MSVCP80.dll]  [Microsoft Corporation, 8.00.50727.762]
    [C:\Program Files\Common Files\BitDefender\BitDefender Update Service\WSLib.dll]  [BitDefender S.R.L. http://www.bitdefender.com, 1, 0, 82, 0]
    [C:\Program Files\Common Files\BitDefender\BitDefender Update Service\WSUtils.dll]  [BitDefender S.R.L. http://www.bitdefender.com, 1, 0, 82, 0]
    [C:\Program Files\Common Files\BitDefender\BitDefender Update Service\WSPack.dll]  [BitDefender S.R.L. http://www.bitdefender.com, 1, 0, 82, 0]
    [C:\Program Files\Common Files\BitDefender\BitDefender Update Service\npcomm.dll]  [BitDefender LLC, 2.0.1.18]
[PID: 1124 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [(Verified) Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 1152 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [(Verified) Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 1184 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [(Verified) Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
    [C:\WINDOWS\System32\COMRes.dll]  [N/A, ]
[PID: 1356 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [(Verified) Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 1380 / NETWORK SERVICE][C:\WINDOWS\system32\msdtc.exe]  [(Verified) Microsoft Corporation, 2001.12.4720.1830 (srv03_sp1_rtm.050324-1447)]
    [C:\WINDOWS\system32\COMRES.DLL]  [N/A, ]
[PID: 1496 / SYSTEM][C:\Program Files\StormII\stormliv.exe]  [北京暴风网际科技有限公司, 3, 9, 1, 15]
    [C:\Program Files\StormII\MSVCP60.dll]  [Microsoft Corporation, 6.02.3104.0]
    [C:\WINDOWS\system32\COMRes.dll]  [N/A, ]
    [C:\Program Files\StormII\bfoptdll.dll]  [北京暴风网际科技有限公司, 3, 8, 7, 16]
    [C:\Program Files\StormII\box\BoxLog.dll]  [北京暴风网际科技有限公司, 3, 9, 2, 19]
[PID: 1532 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [(Verified) Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 1564 / SYSTEM][D:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe]  [Microsoft Corporation, 2005.090.1399.00]
    [C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6B128700\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.762]
    [C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6B128700\MSVCP80.dll]  [Microsoft Corporation, 8.00.50727.762]
    [D:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\Resources\1033\sqlevn70.RLL]  [Microsoft Corporation, 2005.090.1399.00]
    [C:\WINDOWS\system32\MSCOREE.DLL]  [Microsoft Corporation, 2.0.50727.42 (RTM.050727-4200)]
[PID: 1760 / Administrator][C:\WINDOWS\Explorer.EXE]  [(Verified) Microsoft Corporation, 6.00.3790.1830 (srv03_sp1_rtm.050324-1447)]
    [C:\WINDOWS\system32\COMRes.dll]  [N/A, ]
    [C:\WINDOWS\system32\nvcpl.dll]  [NVIDIA Corporation, 6.14.10.9371]
    [C:\WINDOWS\system32\NVRSZHC.DLL]  [NVIDIA Corporation, 6.14.10.9371]
    [C:\WINDOWS\system32\nvapi.dll]  [N/A, ]
    [C:\WINDOWS\system32\nvshell.dll]  [, ]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
    [C:\WINDOWS\FoNtS\Comres.dll]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh11526.TTf]  [N/A, ]
[PID: 1860 / SYSTEM][E:\Program Files\i8Client\NetMgrClient.exe]  [盛光科技, 2009, 2, 6, 3]
    [E:\Program Files\i8Client\wxProt.dll]  [N/A, ]
    [E:\Program Files\i8Client\pliehome.dll]  [Yuhu's, 2008, 10, 16, 0]
    [E:\Program Files\i8Client\Plugin\BHO_Goyoo\BHO_Goyoo.dll]  [, 2009, 4, 9, 1]
[PID: 1964 / Administrator][C:\Program Files\StormII\stMgr.exe]  [北京暴风网际科技有限公司, 3, 9, 1, 15]
    [C:\WINDOWS\system32\COMRes.dll]  [N/A, ]
    [C:\Program Files\StormII\bfoptdll.dll]  [北京暴风网际科技有限公司, 3, 8, 7, 16]
    [C:\Program Files\StormII\MSVCP60.dll]  [Microsoft Corporation, 6.02.3104.0]
    [C:\Program Files\StormII\corelog.dll]  [北京暴风网际科技有限公司, 3, 8, 9, 27]
    [C:\WINDOWS\system32\msdmo.dll]  [, ]
    [C:\WINDOWS\FoNtS\Comres.dll]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh02525.TTf]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh11526.TTf]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh26525.TTf]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh28526.TTf]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh29525.TTf]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh30525.TTf]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh33525.TTf]  [N/A, ]
    [C:\WINDOWS\FoNtS\GTH60363.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\GTH62360.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh66360.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\GTH67367.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\GTH68362.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\GTH69366.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\GTH73366.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\GTH74366.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh80360.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\GTH83366.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\GTH86366.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh88361.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh92360.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\GTH93362.ttf]  [N/A, ]
[PID: 264 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [(Verified) Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 296 / Administrator][C:\WINDOWS\soundman.exe]  [Realtek Semiconductor Corp., 5.1.0.29]
[PID: 428 / SYSTEM][e:\Program Files\NetecardServer\RsFileServer.exe]  [N/A, ]
[PID: 508 / Administrator][C:\WINDOWS\system32\ctfmon.exe]  [(Verified) Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 520 / Administrator][E:\Program Files\NetecardConsole\PoliceMan.exe]  [N/A, ]
    [C:\WINDOWS\system32\COMRes.dll]  [N/A, ]
    [C:\WINDOWS\FoNtS\Comres.dll]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh11526.TTf]  [N/A, ]
[PID: 552 / Administrator][E:\Program Files\NetecardConsole\RsConsole.exe]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [E:\Program Files\NetecardConsole\Common.bpl]  [, 1.0.0.0]
    [E:\Program Files\NetecardConsole\RsDataCenter.bpl]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [E:\Program Files\NetecardConsole\RainSoftDes.dll]  [Rainsoft Company, 3.5.0.1]
    [E:\Program Files\NetecardConsole\MFC71U.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [E:\Program Files\NetecardConsole\Graphic.bpl]  [, 1.0.0.0]
    [E:\Program Files\NetecardConsole\RsNetwork.bpl]  [, 1.0.0.0]
    [C:\WINDOWS\system32\MFC71CHS.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\COMRes.dll]  [N/A, ]
    [E:\Program Files\NetecardConsole\RsCardApi.dll]  [Rainsoft Corporation, 3, 5, 0, 5]
    [E:\Program Files\NetecardConsole\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [E:\Program Files\NetecardConsole\SCReader.dll]  [Rainsoft Corporation, 3.5.0.6]
    [E:\Program Files\NetecardConsole\RsUser.dll]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [E:\Program Files\NetecardConsole\RsWatch.dll]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [E:\Program Files\NetecardConsole\RsStoreQuery.dll]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [E:\Program Files\NetecardConsole\RsAccount.dll]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [E:\Program Files\NetecardConsole\RsChgPwd.dll]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [E:\Program Files\NetecardConsole\RsDeposit.dll]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [E:\Program Files\NetecardConsole\RsAccountLogQuery.dll]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [E:\Program Files\NetecardConsole\RsAccountQuery.dll]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [E:\Program Files\NetecardConsole\RsBookQuery.dll]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [E:\Program Files\NetecardConsole\RsCheckStore.dll]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [E:\Program Files\NetecardConsole\RsInStore.dll]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [E:\Program Files\NetecardConsole\RsClientSetup.dll]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [E:\Program Files\NetecardConsole\RsLoss.dll]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [E:\Program Files\NetecardConsole\RsCurrentBook.dll]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [E:\Program Files\NetecardConsole\RsCurrentLog.dll]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [E:\Program Files\NetecardConsole\RsCurrentRetail.dll]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [E:\Program Files\NetecardConsole\RsOptions.dll]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [E:\Program Files\NetecardConsole\RsRepair.dll]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [E:\Program Files\NetecardConsole\RsHandOver.dll]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [E:\Program Files\NetecardConsole\RsHandOverQuery.dll]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [E:\Program Files\NetecardConsole\RsIncrease.dll]  [上海钱易网络科技有限公司, 1.0.0.0]
    [E:\Program Files\NetecardConsole\RsReport.dll]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [E:\Program Files\NetecardConsole\RsLogQuery.dll]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [E:\Program Files\NetecardConsole\RsRetail.dll]  [上海钱易网络科技有限公司, 1.0.0.0]
    [E:\Program Files\NetecardConsole\RsSpecial.dll]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [E:\Program Files\NetecardConsole\RsOutStore.dll]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [E:\Program Files\NetecardConsole\RsPrintSetup.dll]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [E:\Program Files\NetecardConsole\RsPriorBook.dll]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [E:\Program Files\NetecardConsole\RsPriorLog.dll]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [E:\Program Files\NetecardConsole\RsPriorRetail.dll]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [E:\Program Files\NetecardConsole\RsProductDefine.dll]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [C:\WINDOWS\FoNtS\Comres.dll]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh11526.TTf]  [N/A, ]
[PID: 584 / SYSTEM][e:\Program Files\NetecardServer\RsSysServer.exe]  [TODO: <公司名>, 1, 0, 2343, 63]
    [C:\WINDOWS\system32\MFC71.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\MFC71CHS.DLL]  [Microsoft Corporation, 7.10.3077.0]
[PID: 648 / SYSTEM][e:\Program Files\NetecardServer\services\SMSDownLoad.exe]  [上海钱易网络科技有限公司, 1.0.0.0]
    [C:\WINDOWS\system32\RainSoftDes.dll]  [Rainsoft Company, 3.5.0.1]
    [C:\WINDOWS\system32\MFC71U.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\MFC71CHS.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\COMRes.dll]  [N/A, ]
[PID: 1148 / SYSTEM][C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe]  [Microsoft Corporation, 2005.090.1399.00]
    [C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6B128700\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.762]
[PID: 1492 / SYSTEM][E:\Program Files\NetecardConsole\VideoSnapService_UsbCamera.exe]  [N/A, ]
    [C:\WINDOWS\system32\MFC71D.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [E:\Program Files\NetecardConsole\MSVCR71D.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\MFC71CHS.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\COMRes.dll]  [N/A, ]
    [C:\WINDOWS\system32\msdmo.dll]  [, ]
[PID: 2152 / SYSTEM][e:\Program Files\NetecardServer\GetConsumeService.exe]  [N/A, ]
    [C:\WINDOWS\system32\COMRes.dll]  [N/A, ]
[PID: 2180 / SYSTEM][e:\Program Files\NetecardServer\backup.exe]  [N/A, ]
    [C:\WINDOWS\system32\COMRes.dll]  [N/A, ]
[PID: 2220 / SYSTEM][e:\Program Files\NetecardServer\RsServer.exe]  [上海雨人软件技术开发有限公司, 7.3.2351.74]
    [C:\WINDOWS\system32\COMRes.dll]  [N/A, ]
    [E:\Program Files\NetecardConsole\RsCardApi.dll]  [Rainsoft Corporation, 3, 5, 0, 5]
    [E:\Program Files\NetecardConsole\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
[PID: 2280 / SYSTEM][e:\Program Files\NetecardServer\services\SMSCServer.exe]  [N/A, ]
    [C:\WINDOWS\system32\MFC71.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\RainSoftDes.dll]  [Rainsoft Company, 3.5.0.1]
    [C:\WINDOWS\system32\MFC71U.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\MFC71CHS.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\COMRes.dll]  [N/A, ]
[PID: 2356 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [(Verified) Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 2060 / SYSTEM][C:\WINDOWS\system32\wbem\wmiprvse.exe]  [(Verified) Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
    [C:\WINDOWS\system32\COMRes.dll]  [N/A, ]
[PID: 3960 / Administrator][D:\Program Files\TTPlayer\TTPlayer.exe]  [Alen Soft, 5, 3, 1, 0]
    [D:\Program Files\TTPlayer\ttpcomm.dll]  [N/A, ]
    [D:\Program Files\TTPlayer\ttpres.dll]  [Alen Soft, 5, 3, 1, 0]
    [C:\WINDOWS\system32\msdmo.dll]  [, ]
    [C:\WINDOWS\system32\COMRes.dll]  [N/A, ]
    [C:\WINDOWS\system32\Macromed\Flash\Flash10b.ocx]  [Adobe Systems, Inc., 10,0,22,87]
    [C:\WINDOWS\FoNtS\Comres.dll]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh11526.TTf]  [N/A, ]
    [D:\Program Files\TTPlayer\AddIn\ttp_lrcsh.dll]  [N/A, ]
    [D:\Program Files\TTPlayer\AddIn\ttp_asf.dll]  [N/A, ]
    [D:\Program Files\TTPlayer\AddIn\ttp_aac.dll]  [N/A, ]
    [D:\Program Files\TTPlayer\AddIn\ttp_ac3dts.dll]  [N/A, ]
[PID: 2352 / Administrator][C:\WINDOWS\system32\svchost.exe]  [(Verified) Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 760 / Administrator][C:\WINDOWS\system32\svchost.exe]  [(Verified) Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 3808 / Administrator][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.3790.1830 (srv03_sp1_rtm.050324-1447)]
    [C:\WINDOWS\FoNtS\Comres.dll]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh02525.TTf]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh11526.TTf]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh26525.TTf]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh28526.TTf]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh29525.TTf]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh30525.TTf]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh33525.TTf]  [N/A, ]
    [C:\WINDOWS\FoNtS\GTH60363.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\GTH62360.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh66360.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\GTH67367.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\GTH68362.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\GTH69366.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\GTH73366.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\GTH74366.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh80360.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\GTH83366.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\GTH86366.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh88361.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh92360.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\GTH93362.ttf]  [N/A, ]
    [C:\WINDOWS\system32\Macromed\Flash\Flash10b.ocx]  [Adobe Systems, Inc., 10,0,22,87]
[PID: 1976 / Administrator][F:\sreng2\SREngLdr.EXE]  [Smallfrogs Studio, 2.7.1.1261]
[PID: 2036 / Administrator][F:\sreng2\SRE417169cd.EXE]  [Smallfrogs Studio, 2.7.1.1261]
    [C:\WINDOWS\FoNtS\Comres.dll]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh02525.TTf]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh11526.TTf]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh26525.TTf]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh28526.TTf]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh29525.TTf]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh30525.TTf]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh33525.TTf]  [N/A, ]
    [C:\WINDOWS\FoNtS\GTH60363.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\GTH62360.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh66360.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\GTH67367.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\GTH68362.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\GTH69366.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\GTH73366.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\GTH74366.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh80360.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\GTH83366.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\GTH86366.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh88361.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\gTh92360.ttf]  [N/A, ]
    [C:\WINDOWS\FoNtS\GTH93362.ttf]  [N/A, ]
    [F:\sreng2\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]

==================================
文件关联
.TXT  Error. [C:\WINDOWS\notepad.exe %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  Error. ["hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[C:\]
[AutoRun]
Open=caoni.exe
Shell\Open=打开(&O)
Shell\Open\Command=caoni.exe
Shell\Open\Default=1
Shell\Explore=资源管理器(&X)
Shell\Explore\Command=caoni.exe
[D:\]
[AutoRun]
Open=caoni.exe
Shell\Open=打开(&O)
Shell\Open\Command=caoni.exe
Shell\Open\Default=1
Shell\Explore=资源管理器(&X)
Shell\Explore\Command=caoni.exe
[E:\]
[AutoRun]
Open=caoni.exe
Shell\Open=打开(&O)
Shell\Open\Command=caoni.exe
Shell\Open\Default=1
Shell\Explore=资源管理器(&X)
Shell\Explore\Command=caoni.exe
[F:\]
[AutoRun]
Open=caoni.exe
Shell\Open=打开(&O)
Shell\Open\Command=caoni.exe
Shell\Open\Default=1
Shell\Explore=资源管理器(&X)
Shell\Explore\Command=caoni.exe

==================================
HOSTS 文件
127.0.0.1       localhost

==================================
进程特权扫描
特殊特权被允许： SeDebugPrivilege [PID = 1976, F:\SRENG2\SRENGLDR.EXE]

==================================
计划任务
N/A

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================


[/CODE]