[CODE] 2009-10-16,17:45:17 System Repair Engineer 2.8.1.1279 Smallfrogs (http://www.KZTechs.com) Windows XP Professional Service Pack 3 (Build 2600) - 管理权限用户 - 完整功能 以下内容被选中: 所有的启动项目(包括注册表、启动文件夹、服务等) 浏览器加载项 正在运行的进程(包括进程模块信息) 文件关联 Winsock 提供者 Autorun.inf HOSTS 文件 进程特权扫描 计划任务 Windows 安全更新检查 API HOOK 隐藏进程 启动项目 注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] [(Verified)Microsoft Windows Component Publisher] [oovista & allinsmart] <"D:\Program Files\Tencent\QQ\Bin\QQ.exe" /background> [(Verified)Tencent Technology(Shenzhen) Company Limited] <快门> [赛尔新概念] [China Mobile] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] [NVIDIA Corporation] [Putian Runway] <"D:\Program Files\Rising\AntiSpyware\rstray.exe" /startup> [(Verified)Beijing Rising Information Technology Corporation Limited] [(Verified)Microsoft Corporation] <"D:\Program Files\Rising\Ris\RsTray.exe" -system> [(Verified)Beijing Rising Information Technology Corporation Limited] <"D:\Program Files\Rising\Ris\rssafety.exe" /startup> [(Verified)Beijing Rising Information Technology Corporation Limited] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] [(Verified)Beijing Rising Information Technology Corporation Limited] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] [(Verified)Microsoft Windows Component Publisher] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{AEB6717E-7E19-11d0-97EE-00C04FD91972}> [(Verified)Microsoft Windows Component Publisher] <{32CD708B-60A7-4C00-9377-D73EAA495F0F}> [(Verified)Beijing Rising Information Technology Corporation Limited] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] <%SystemRoot%\system32\SHELL32.dll> [(Verified)Microsoft Windows Component Publisher] <%SystemRoot%\system32\SHELL32.dll> [(Verified)Microsoft Windows Component Publisher] [(Verified)Microsoft Windows] [(Verified)Microsoft Windows Component Publisher] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dimsntfy] <%SystemRoot%\System32\dimsntfy.dll> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] <{438755C2-A8BA-11D1-B96B-00A0C90312E1}><%SystemRoot%\system32\browseui.dll> [(Verified)Microsoft Windows Component Publisher] <{8C7461EF-2B13-11d2-BE35-3078302C2030}><%SystemRoot%\system32\browseui.dll> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] [(Verified)Microsoft Windows] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] <"C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] <浏览器自定义组件> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] <%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] <%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] <"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}] [(Verified)Microsoft Windows Component Publisher] [HKEY_CURRENT_USER\Control Panel\Desktop] [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <; ALCMTR.EXE> [(Verified)Microsoft Windows Hardware Compatibility Publisher] <; ALCWZRD.EXE> [(Verified)Microsoft Windows Hardware Compatibility Publisher] <; C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe> [AMD] <; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Publisher] <; > [N/A] <; C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC> [(Verified)Microsoft Windows Component Publisher] <; RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [NVIDIA Corporation] <; RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit> [NVIDIA Corporation] <; nwiz.exe /install> [] <; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows Publisher] <; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows Publisher] <; > [N/A] <; RTHDCPL.EXE> [(Verified)Microsoft Windows Hardware Compatibility Publisher] <; SkyTel.EXE> [(Verified)Microsoft Windows Hardware Compatibility Publisher] ================================== 启动文件夹 N/A ================================== 服务 [ASP.NET State Service / aspnet_state][Stopped/Manual Start] <(File is missing)> [Contrl Center of Storm Media / ccosm][Stopped/Auto Start] <><(File is missing)> [Google Updater Service / gusvc][Stopped/Auto Start] <><(File is missing)> [Human Interface Device Access / HidServ][Stopped/Disabled] %SystemRoot%\System32\hidserv.dll> [NVIDIA Display Driver Service / NVSvc][Running/Auto Start] [Ris Service / RsRisMon][Running/Auto Start] <"D:\Program Files\Rising\Ris\RavMonD.exe"> [Sandboxie Service / SbieSvc][Running/Auto Start] [Windows Driver Foundation - User-mode Driver Framework / WudfSvc][Stopped/Manual Start] %SystemRoot%\System32\WUDFSvc.dll> [主动防御 / ZhuDongFangYu][Stopped/Manual Start] <"D:\Program Files\360safe\deepscan\zhudongfangyu.exe"><360安全中心> ================================== 驱动程序 [360SelfProtection / 360SelfProtection][Running/System Start] <360安全中心> [AMD Processor Driver / AmdK8][Running/System Start] [AMD Low Level Device Driver / AmdLLD][Running/Manual Start] [BFSDRV / BFSDRV][Running/System Start] <\??\C:\WINDOWS\system32\drivers\bfsdrv.sys><360安全中心> [BREGDRV / BREGDRV][Running/System Start] <\??\C:\WINDOWS\system32\drivers\bregdrv.sys><360安全中心> [EagleNT / EagleNT][Stopped/Manual Start] <\??\C:\WINDOWS\system32\drivers\EagleNT.sys> [EfiSystemMon / EfiMon][Running/System Start] <奇虎网> [USB Serial Converter Driver / FTDIBUS][Stopped/Manual Start] [USB Serial Port Driver / FTSER2K][Stopped/Manual Start] [Microsoft 用于 High Definition Audio 的 UAA 总线驱动程序 / HDAudBus][Running/Manual Start] [hookcont / hookcont][Running/System Start] [HookPort / HookPort][Running/Boot Start] <\SystemRoot\System32\Drivers\Hookport.sys><360安全中心> [hooksys / hooksys][Running/System Start] [Service for Realtek HD Audio (WDM) / IntcAzAudAddService][Running/Manual Start] [Netgroup Packet Filter / NPF][Running/Manual Start] [nv / nv][Running/Manual Start] [Direct Parallel Link Driver / Ptilink][Running/Manual Start] [Quantum DeepScanner Servers / qutmdserv][Stopped/Manual Start] <\??\C:\WINDOWS\system32\drivers\qutmdrv.sys><360安全中心> [RapidPort2 / RapidPort2][Stopped/Auto Start] <\??\C:\WINDOWS\system32\Drivers\CAP2LPT.SYS> [Rising RfwARP Driver / RFWARP][Running/Auto Start] [Rising RfwBase Driver / RfwBase9][Running/Manual Start] [rfwtdi / rfwtdi][Running/Auto Start] <\??\D:\Program Files\Rising\Ris\rfwtdi.sys> [Feitian ROCKEY4 Device Service / ROCKEYNT][Running/Manual Start] [rsassist / rsassist][Running/Auto Start] [rsfwdrv / rsfwdrv][Running/System Start] <\??\D:\Program Files\Rising\Ris\rsfwdrv.sys> [RsNTGDI / RsNTGDI][Running/Boot Start] <\SystemRoot\system32\Drivers\RsNTGdi.sys> [RsProtect / RsProtect][Running/System Start] [Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start] [SbieDrv / SbieDrv][Running/Manual Start] <\??\D:\Program Files\360\360se3\Shield\SbieDrv.sys> [Secdrv / Secdrv][Stopped/Manual Start] [SAMSUNG Mobile USB Device 1.0 driver (WDM) / ss_bus][Stopped/Manual Start] [SAMSUNG Mobile USB Modem 1.0 Filter / ss_mdfl][Stopped/Manual Start] [SAMSUNG Mobile USB Modem 1.0 Drivers / ss_mdm][Stopped/Manual Start] [TCP/IP Protocol Driver / Tcpip][Running/System Start] [TesDrvPt / TesDrvPt][Stopped/Manual Start] <\??\C:\WINDOWS\system32\TesDrvPt.sys> [TesSafe / TesSafe][Stopped/Manual Start] <\??\C:\WINDOWS\system32\TesSafe.sys> [Windows Driver Foundation - User-mode Driver Framework Platform Driver / WudfPf][Stopped/Manual Start] [Windows Driver Foundation - User-mode Driver Framework Reflector / WudfRd][Stopped/Manual Start] [NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller / yukonwxp][Running/Manual Start] ================================== 浏览器加载项 [ThunderAtOnce Class] {01443AEC-0FD1-40fd-9C87-E93D1494C233} [Adobe PDF Link Helper] {18DF081C-E8AD-4283-A596-FA578C2EBDC3} [Thunder Browser Helper] {3049C3E8-B461-4BC5-8870-4C09146192CA} [Thunder Browser Helper] {889D2FEB-5411-4565-8998-1DD2C5261283} [卡卡上网安全助手] {98B7C13A-E9CD-4959-8B46-FBEAB41E42A8} [Mini金山词霸for IE] {B685398A-632A-47B7-86ED-910D8F15930D} [SafeMon Class] {B69F34DD-F0F9-42DC-9EDD-957187DA688D} [启动迅雷5] {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <, > [信息检索(&R)] {92780B25-18CC-41C8-B9BE-3C9C571A8263} [很快视频搜索] {998A88A0-A355-809B-831C-B83A80000991} [启动UUSee 网络电视] {998A88A0-A355-809B-831C-B83A80000992} [] {e2e2dd38-d088-4134-82b7-f2ba38496583} <%windir%\Network Diagnostic\xpnetdiag.exe, (Signed) N/A> [Messenger] {FB5F1910-F110-11d2-BB9E-00C04F795683} [金山快译(&K)] {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} [EditCtrl Class] {488A4255-3236-44B3-8F27-FA1AECAA8844} [Windows Live Safety Center Base Module] {5ED80217-570B-4DA9-BF44-BE107C0EC166} [AxInputControl Class] {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} [CertEnroll Class] {7978461C-CC22-48F2-BC69-02220D3E101D} [] {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} <, > [CCTVUpdateInstall] {AC414988-E5BB-4C2C-873B-EA53D2F3D23A} [] {00000000-0000-0000-0000-000000000000} <, > [ThunderAtOnce Class] {01443AEC-0FD1-40FD-9C87-E93D1494C233} [] {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <, > [Adobe PDF Link Helper] {18DF081C-E8AD-4283-A596-FA578C2EBDC3} [iTrusPTA Class] {1E0DFFCF-27FF-4574-849B-55007349FEDA} [HTML Document] {25336920-03F9-11CF-8FD0-00AA00686F13} [XML DOM Document] {2933BF90-7B36-11D2-B20E-00C04F983E60} [DHTML Edit Control Safe for Scripting for IE5] {2D360201-FFF5-11D1-8D03-00A0C959BC0A} [Thunder Browser Helper] {3049C3E8-B461-4BC5-8870-4C09146192CA} [IETag Factory] {38481807-CA0E-42D2-BF39-B33AF135CC4D} [XML Document] {48123BC4-99D9-11D1-A6B3-00C04FD91555} [Thunder Agent Class] {485463B7-8FB2-4B3B-B29B-8B919B0EACCE} [EditCtrl Class] {488A4255-3236-44B3-8F27-FA1AECAA8844} [Microsoft Terminal Services Client Control (redist)] {4eb89ff4-7f78-4a0f-8b8d-2bf02e94e4b2} <%systemroot%\system32\mstscax.dll, (Signed) N/A> [Microsoft Terminal Services Client Control (redist)] {4EDCB26C-D24C-4e72-AF07-B576699AC0DE} <%systemroot%\system32\mstscax.dll, (Signed) N/A> [HHCtrl Object] {52A2AAAE-085D-4187-97EA-8C30DB990436} [Shell Name Space] {55136805-B2DE-11D1-B9F2-00A0C98BC547} [WangWangX Class] {5D09DD40-CDC4-4C56-B615-0D1E3B357C2B} [Windows Live Safety Center Base Module] {5ED80217-570B-4DA9-BF44-BE107C0EC166} [WUWebControl Class] {6414512B-B978-451D-A0D8-FCFDF33E833C} [Windows Media Player] {6BF52A52-394A-11D3-B153-00C04F79FAA6} [金山快译(&K)] {6C3797D2-3FEF-4CD4-B654-D3AE55B4128C} [Windows Script Host Shell Object] {72C24DD5-D70A-438B-8A42-98424B88AFB8} [Microsoft Terminal Services Client Control (redist)] {7390f3d8-0439-4c05-91e3-cf5cb290c3d0} <%systemroot%\system32\mstscax.dll, (Signed) N/A> [AxInputControl Class] {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} [Microsoft Terminal Services Client Control (redist)] {7584c670-2274-4efb-b00b-d6aaba6d3850} <%systemroot%\system32\mstscax.dll, (Signed) N/A> [] {7670648D-461B-42AF-BDFE-46D26AF5EFF2} <, > [XDownloaddManager Class] {802F530B-A8F6-4631-AE49-6BACAAC6373E} [360SafeLive] {87515F61-A66C-4319-A0E0-D416CB8059E3} [Microsoft Web Browser] {8856F961-340A-11D0-A96B-00C04FD705A2} [Thunder Browser Helper] {889D2FEB-5411-4565-8998-1DD2C5261283} [XML DOM Document 6.0] {88D96A05-F192-11D4-A65F-0040963251E5} [XML HTTP 6.0] {88D96A0A-F192-11D4-A65F-0040963251E5} [AxSubmitControl Class] {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} [Windows Live Safety Center Control Module] {8E5C8BEE-1887-414C-8AC9-7C3951F28476} [] {8FA6910E-3ED5-4D95-86D5-761928F61910} <, > [Microsoft Terminal Services Client Control (redist)] {9059f30f-4eb1-4bd2-9fdc-36f43a218f4a} <%systemroot%\system32\mstscax.dll, (Signed) N/A> [] {92780B25-18CC-41C8-B9BE-3C9C571A8263} <, > [] {9701758C-4373-482E-B13C-776C048EC890} <, > [卡卡上网安全助手] {98B7C13A-E9CD-4959-8B46-FBEAB41E42A8} [] {998A88A0-A355-809B-831C-B83A80000991} <, > [] {998A88A0-A355-809B-831C-B83A80000992} <, > [] {9E385F0A-0BA2-430C-96AA-4399C5E40F6C} <, > [] {9EFF1953-9694-47B1-AEF6-B2A3FE8BFE9B} <, > [DapCtrl Class] {ACACC6EB-1FBA-4E13-A729-53AEB2DF54F8} [Mini金山词霸for IE] {B685398A-632A-47B7-86ED-910D8F15930D} [SafeMon Class] {B69F34DD-F0F9-42DC-9EDD-957187DA688D} [Ping An YIZHANGTONG] {B9D90AB5-F978-4041-A4D5-57607DD0430E} [Microsoft Url Search Hook] {CFBFAE00-17A6-11D0-99CB-00C04FD64497} [RealPlayer G2 Control] {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} [] {E2E2DD38-D088-4134-82B7-F2BA38496583} <, > [XML HTTP Request] {ED8C108E-4349-11D2-91A4-00C04F7969E8} [XPPlayer Class] {F3E70CEA-956E-49CC-B444-73AFE593AD7F} [XML DOM Document 3.0] {F5078F32-C551-11D3-89B9-0000F81FE221} [Free Threaded XML DOM Document 3.0] {F5078F33-C551-11D3-89B9-0000F81FE221} [XML HTTP 3.0] {F5078F35-C551-11D3-89B9-0000F81FE221} [XSL Template 3.0] {F5078F36-C551-11D3-89B9-0000F81FE221} [XML HTTP] {F6D90F16-9C73-11D3-B32E-00C04F990BB4} [] {FB5F1910-F110-11D2-BB9E-00C04F795683} <, > [webmod Class] {FEE3C8C5-9BEA-4079-AB36-63ECABFC7392} [使用UUSee下载] [使用UUSee加速播放] [使用迅雷下载] [使用迅雷下载全部链接] [导出到 Microsoft Excel(&X)] ================================== 正在运行的进程 [PID: 872 / SYSTEM][\SystemRoot\System32\smss.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)] [PID: 952 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)] [PID: 976 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2113)] [C:\WINDOWS\system32\SOGOUPY.IME] [Sogou.com Inc., 4.2.3.2813] [D:\Program Files\SogouInput\4.2.3.2813\Resource.dll] [Sogou.com Inc., 4.2.3.2813] [PID: 1020 / SYSTEM][C:\WINDOWS\system32\services.exe] [(Verified) Microsoft Corporation, 5.1.2600.5755 (xpsp_sp3_qfe.090206-1316)] [PID: 1032 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2113)] [PID: 1188 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)] [PID: 1264 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)] [C:\WINDOWS\system32\msi.dll] [Microsoft Corporation, 4.5.6001.22159] [PID: 1388 / SYSTEM][D:\Program Files\Rising\Ris\RavMonD.exe] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2] [D:\Program Files\Rising\Ris\combase.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 16] [D:\Program Files\Rising\Ris\cnt09.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2] [D:\Program Files\Rising\Ris\moncomm.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 9] [D:\Program Files\Rising\Ris\MonBase.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3] [D:\Program Files\Rising\Ris\Rslog.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.40] [D:\Program Files\Rising\Ris\mondrv.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 6] [D:\Program Files\Rising\Ris\defmon.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 41] [D:\Program Files\Rising\Ris\moncom08.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1] [D:\Program Files\Rising\Ris\MonRule.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 9] [D:\Program Files\Rising\Ris\FileMon.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 28] [D:\Program Files\Rising\Ris\MailMon.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 19] [D:\Program Files\Rising\Ris\HookWeb.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 12] [D:\Program Files\Rising\Ris\rfwlog.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.12] [D:\Program Files\Rising\Ris\rfwrule.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.1] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [D:\Program Files\Rising\Ris\rfwsrv.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.2] [D:\Program Files\Rising\Ris\Syslay.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.6] [D:\Program Files\Rising\Ris\mPorts.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.0] [D:\Program Files\Rising\Ris\rfwdrvc.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.1] [D:\Program Files\Rising\Ris\Rfwdrv.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.5] [D:\Program Files\Rising\Ris\rsnetsvr.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2] [D:\Program Files\Rising\Ris\RfwArp.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.5] [D:\Program Files\Rising\Ris\comx3.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.37] [D:\Program Files\Rising\Ris\urlrule.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.1] [D:\Program Files\Rising\Ris\recomp.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 6] [D:\Program Files\Rising\Ris\refs.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3] [D:\Program Files\Rising\Ris\viruslib.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3] [D:\Program Files\Rising\Ris\relibldr.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3] [D:\Program Files\Rising\Ris\urllib.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1] [D:\Program Files\Rising\Ris\rfwproxy.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 40] [D:\Program Files\Rising\Ris\rsindent.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 7] [D:\Program Files\Rising\Ris\taskplug.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 8] [D:\Program Files\Rising\Ris\scansrvp.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.7] [D:\Program Files\Rising\Ris\cnt08.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1] [D:\Program Files\Rising\Ris\proccomm.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 4] [D:\Program Files\Rising\Ris\RSAPPMGR.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.0] [D:\Program Files\Rising\Ris\CfgDll.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.0] [D:\Program Files\Rising\Ris\Hooksys.dll] [Beijing Rising Information Technology Co., Ltd., 24, 0, 0, 3] [D:\Program Files\Rising\Ris\ProcCom.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 20] [D:\Program Files\Rising\Ris\RsCommX2.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 20] [D:\Program Files\Rising\Ris\HookCont.dll] [Beijing Rising Information Technology Co., Ltd., 24, 0, 0, 1] [D:\Program Files\Rising\Ris\BACore.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 25] [D:\Program Files\Rising\Ris\bawhite.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1] [D:\Program Files\Rising\Ris\RSStore.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 5] [D:\Program Files\Rising\Ris\Scanner.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.16] [D:\Program Files\Rising\Ris\ScanAdd.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.4] [D:\Program Files\Rising\Ris\NComm2.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2] [D:\Program Files\Rising\Ris\rstask.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 5] [D:\Program Files\Rising\Ris\rsstub.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1] [D:\Program Files\Rising\Ris\ScanSrv.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.3] [D:\Program Files\Rising\Ris\scanpe.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 10] [D:\Program Files\Rising\Ris\pearc.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2] [D:\Program Files\Rising\Ris\ur000.dat] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3] [D:\Program Files\Rising\Ris\urutils.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1] [D:\Program Files\Rising\Ris\ffr.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 4] [D:\Program Files\Rising\Ris\nvfile.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1] [D:\Program Files\Rising\Ris\scanexec.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2] [D:\Program Files\Rising\Ris\unexe.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2] [D:\Program Files\Rising\Ris\scanex.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 27] [D:\Program Files\Rising\Ris\extmail.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 5] [D:\Program Files\Rising\Ris\scansct.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1] [D:\Program Files\Rising\Ris\scantj.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 4] [D:\Program Files\Rising\Ris\methodex.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3] [D:\Program Files\Rising\Ris\revm.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3] [D:\Program Files\Rising\Ris\heurex.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 9] [D:\Program Files\Rising\Ris\pecompd.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3] [D:\Program Files\Rising\Ris\ur001.dat] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2] [D:\Program Files\Rising\Ris\ScanRavT.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.4] [D:\Program Files\Rising\Ris\ScanBT.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.17] [D:\Program Files\Rising\Ris\ScanStub.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.1] [D:\Program Files\Rising\Ris\extsfx.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 4] [PID: 1420 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)] [c:\windows\system32\msi.dll] [Microsoft Corporation, 4.5.6001.22159] [PID: 1576 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)] [PID: 1728 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)] [PID: 1892 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-0852)] [C:\WINDOWS\system32\CAP2LMK.DLL] [CANON INC., 1.00.0.018] [C:\WINDOWS\system32\CAP2SMK.DLL] [CANON INC., 1.00.0.018] [C:\WINDOWS\system32\CAP2PTMN.DLL] [CANON INC., 1.00.0.018] [C:\WINDOWS\system32\SOGOUPY.IME] [Sogou.com Inc., 4.2.3.2813] [D:\Program Files\SogouInput\4.2.3.2813\Resource.dll] [Sogou.com Inc., 4.2.3.2813] [C:\WINDOWS\system32\CAP2EMN.DLL] [CANON INC., 1.00.0.018] [PID: 220 / Administrator][C:\WINDOWS\Explorer.EXE] [(Verified) Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)] [C:\WINDOWS\system32\SOGOUPY.IME] [Sogou.com Inc., 4.2.3.2813] [D:\Program Files\SogouInput\4.2.3.2813\Resource.dll] [Sogou.com Inc., 4.2.3.2813] [C:\WINDOWS\system32\msi.dll] [Microsoft Corporation, 4.5.6001.22159] [C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 9.1.0.2009022700] [C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.CHS] [, ] [C:\WINDOWS\system32\nvcpl.dll] [NVIDIA Corporation, 6.14.11.0099] [C:\WINDOWS\system32\NVRSZHC.DLL] [NVIDIA Corporation, 6.14.11.0099] [C:\WINDOWS\system32\nvapi.dll] [NVIDIA Corporation, 6.14.11.0099] [C:\WINDOWS\system32\nvshell.dll] [, ] [D:\Program Files\Thunder Network\Thunder6\ComDlls\TDAtOnce_Now.dll] [Xunlei Networking Technologies,LTD, 1, 2, 6, 86] [C:\WINDOWS\system32\ATL71.DLL] [Microsoft Corporation, 7.10.6041.0] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 3, 11] [D:\Program Files\Thunder Network\Thunder6\ComDlls\xunleiBHO_Now.dll] [Xunlei Networking Technologies,LTD, 5, 0, 8, 106] [D:\Program Files\WinRAR\rarext.dll] [, ] [C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.1] [C:\WINDOWS\system32\kakaext.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.1] [D:\Program Files\AliWangWang\AliIMExt.dll] [Alibaba software (Shanghai) Corporation., 1.0.0.1] [E:\Wopti\WoptiEncryptModule.dll] [Wopti, 1.0.8.1023] [PID: 672 / Administrator][C:\Program Files\racer-han-cnc\racer.exe] [Putian Runway, 3,3,130,306] [C:\Program Files\racer-han-cnc\rwxre.dll] [Putian Runway, 3,3,130,306] [C:\Program Files\racer-han-cnc\nspr4.dll] [Netscape Communications Corporation, 4.6.1] [C:\Program Files\racer-han-cnc\xpcom_core.dll] [Mozilla Foundation, Personal] [C:\Program Files\racer-han-cnc\plc4.dll] [Netscape Communications Corporation, 4.6.1] [C:\Program Files\racer-han-cnc\plds4.dll] [Netscape Communications Corporation, 4.6.1] [C:\Program Files\racer-han-cnc\nss3.dll] [Netscape Communications Corporation, 3.10.2] [C:\Program Files\racer-han-cnc\softokn3.dll] [Netscape Communications Corporation, 3.10.2] [C:\Program Files\racer-han-cnc\js3250.dll] [Netscape Communications Corporation, 4.0] [C:\Program Files\racer-han-cnc\gkgfx.dll] [Mozilla Foundation, Personal] [C:\Program Files\racer-han-cnc\xpcom_compat.dll] [Mozilla Foundation, Personal] [C:\Program Files\racer-han-cnc\smime3.dll] [Netscape Communications Corporation, 3.10.2] [C:\Program Files\racer-han-cnc\ssl3.dll] [Netscape Communications Corporation, 3.10.2] [C:\WINDOWS\system32\SOGOUPY.IME] [Sogou.com Inc., 4.2.3.2813] [D:\Program Files\SogouInput\4.2.3.2813\Resource.dll] [Sogou.com Inc., 4.2.3.2813] [C:\Program Files\racer-han-cnc\components\jar50.dll] [Mozilla Foundation, Personal] [C:\Program Files\racer-han-cnc\components\racer_base_comp.dll] [Putian Runway, 3,3,130,306] [C:\Program Files\racer-han-cnc\racer_base.dll] [Putian Runway, 3,3,130,306] [C:\Program Files\racer-han-cnc\kbdhook.dll] [Putian Runway, 3,3,130,306] [C:\Program Files\racer-han-cnc\components\gklayout.dll] [Mozilla Foundation, Personal] [C:\Program Files\racer-han-cnc\nssckbi.dll] [Netscape Communications Corporation, 1.53] [C:\Program Files\racer-han-cnc\components\racer_ad_comp.dll] [Putian Runway, 3,3,130,306] [C:\Program Files\racer-han-cnc\components\racer_access_pppoe.dll] [Putian Runway, 3,3,130,325] [C:\Program Files\racer-han-cnc\pppoe.dll] [北京润汇科技有限公司, 9, 0, 22, 50] [C:\Program Files\racer-han-cnc\components\racer_nss4_comp.dll] [Putian Runway, 3,3,130,306] [C:\Program Files\racer-han-cnc\nss4.dll] [北京润汇科技有限公司, 1, 0, 0, 4] [C:\Program Files\racer-han-cnc\wpcap.dll] [CACE Technologies, 3, 2, 0, 29] [C:\Program Files\racer-han-cnc\packet.dll] [CACE Technologies, 3, 2, 0, 29] [C:\Program Files\racer-han-cnc\WanPacket.dll] [CACE Technologies, 3, 2, 0, 29] [C:\Program Files\racer-han-cnc\plugins\NPSWF32.dll] [, ] [PID: 684 / Administrator][D:\Program Files\Rising\AntiSpyware\rstray.exe] [Beijing Rising Information Technology Co., Ltd., 21.0.0.17] [D:\Program Files\Rising\AntiSpyware\rsmginfo.dll] [Beijing Rising Information Technology Co., Ltd., 21, 0, 0, 11] [C:\WINDOWS\system32\SOGOUPY.IME] [Sogou.com Inc., 4.2.3.2813] [D:\Program Files\SogouInput\4.2.3.2813\Resource.dll] [Sogou.com Inc., 4.2.3.2813] [D:\Program Files\Rising\AntiSpyware\RsXML.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 2] [D:\Program Files\Rising\AntiSpyware\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [D:\Program Files\Rising\AntiSpyware\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [D:\Program Files\Rising\AntiSpyware\ComServ.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.31] [D:\Program Files\Rising\AntiSpyware\Syslay.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.6] [D:\Program Files\Rising\AntiSpyware\rscommon.dll] [Beijing Rising Information Technology Co., Ltd., 20.0.1.1] [D:\Program Files\Rising\AntiSpyware\comx3.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.37] [D:\Program Files\Rising\AntiSpyware\pngdll.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 5] [D:\Program Files\Rising\AntiSpyware\runiep.dll] [Beijing Rising Information Technology Co., Ltd., 6.0.0.44] [D:\Program Files\Rising\AntiSpyware\NComm.dll] [Beijing Rising Information Technology Co., Ltd., 6.0.0.11] [D:\Program Files\Rising\AntiSpyware\ProcCom.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 20] [D:\Program Files\Rising\AntiSpyware\RsCommX2.dll] [Beijing Rising Information Technology Co., Ltd., 20, 0, 0, 20] [PID: 712 / Administrator][D:\Program Files\Rising\Ris\RsTray.exe] [Beijing Rising Information Technology Co., Ltd., 22.0.0.10] [C:\WINDOWS\system32\SOGOUPY.IME] [Sogou.com Inc., 4.2.3.2813] [D:\Program Files\SogouInput\4.2.3.2813\Resource.dll] [Sogou.com Inc., 4.2.3.2813] [D:\Program Files\Rising\Ris\comserv.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.15] [D:\Program Files\Rising\Ris\rslang.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 1] [D:\Program Files\Rising\Ris\comx3.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.37] [D:\Program Files\Rising\Ris\Syslay.dll] [Beijing Rising Information Technology Co., Ltd., 21.0.0.6] [D:\Program Files\Rising\Ris\ProcComm.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 4] [D:\Program Files\Rising\Ris\rsxml.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2] [D:\Program Files\Rising\Ris\MonState.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2] [D:\Program Files\Rising\Ris\ScanEvnt.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.3] [D:\Program Files\Rising\Ris\rsguilib.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 54] [D:\Program Files\Rising\Ris\rsconf.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.1] [D:\Program Files\Rising\Ris\rfwrule.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.1] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [D:\Program Files\Rising\Ris\rspalvd.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.6] [D:\Program Files\Rising\Ris\rsnetsvr.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 2] [D:\Program Files\Rising\Ris\ravbintl.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 21] [D:\Program Files\Rising\Ris\mruleui.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 6] [D:\Program Files\Rising\Ris\MonTray.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.66] [D:\Program Files\Rising\Ris\RavITray.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 6] [D:\Program Files\Rising\Ris\rfwtray.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 37] [D:\Program Files\Rising\Ris\rsmginfo.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 3] [D:\Program Files\Rising\Ris\scanleak.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 5] [D:\Program Files\Rising\Ris\ravppops.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 20] [D:\Program Files\Rising\Ris\RSAPPMGR.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.0] [D:\Program Files\Rising\Ris\CfgDll.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.0] [D:\Program Files\Rising\Ris\PngDll.dll] [Beijing Rising Information Technology Co., Ltd., 21, 0, 0, 4] [D:\Program Files\Rising\Ris\ScanPrxy.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.3] [D:\Program Files\Rising\Ris\rfwlog.dll] [Beijing Rising Information Technology Co., Ltd., 22.0.0.12] [PID: 744 / Administrator][D:\Program Files\Rising\Ris\rssafety.exe] [Beijing Rising Information Technology Co., Ltd., 4.0.0.38] [C:\WINDOWS\system32\SOGOUPY.IME] [Sogou.com Inc., 4.2.3.2813] [D:\Program Files\SogouInput\4.2.3.2813\Resource.dll] [Sogou.com Inc., 4.2.3.2813] [PID: 760 / Administrator][C:\WINDOWS\system32\ctfmon.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2105)] [C:\WINDOWS\system32\SOGOUPY.IME] [Sogou.com Inc., 4.2.3.2813] [D:\Program Files\SogouInput\4.2.3.2813\Resource.dll] [Sogou.com Inc., 4.2.3.2813] [PID: 768 / Administrator][C:\Documents and Settings\Administrator\桌面\smartram.exe] [oovista & allinsmart, 4, 1, 0, 0] [C:\WINDOWS\system32\SOGOUPY.IME] [Sogou.com Inc., 4.2.3.2813] [D:\Program Files\SogouInput\4.2.3.2813\Resource.dll] [Sogou.com Inc., 4.2.3.2813] [PID: 844 / Administrator][D:\Program Files\China Mobile\Fetion\VmDotNet\v2.0.50727\FetionVM.exe] [China Mobile, 1.0.0.0] [D:\Program Files\China Mobile\Fetion\VmDotNet\v2.0.50727\rsdeploy.dll] [Remotesoft Inc., 1, 0, 6, 0] [D:\Program Files\China Mobile\Fetion\VmDotNet\v2.0.50727\FetionVM.rsm] [N/A, ] [D:\Program Files\China Mobile\Fetion\VmDotNet\v2.0.50727\c\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll] [Microsoft Corporation, 2.0.50727.1433 (REDBITS.050727-1400)] [D:\Program Files\China Mobile\Fetion\VmDotNet\v2.0.50727\c\windows\assembly\NativeImages_v2.0.50727_32\FetionVM\a87393057972c752eb50061d4235f9ec\FetionVM.ni.exe] [China Mobile, 1.0.0.0] [D:\Program Files\China Mobile\Fetion\VmDotNet\v2.0.50727\System\System.Windows.Forms.dll] [Microsoft Corporation, 2.0.50727.1433 (REDBITS.050727-1400)] [D:\Program Files\China Mobile\Fetion\VmDotNet\v2.0.50727\System\System.dll] [Microsoft Corporation, 2.0.50727.1433 (REDBITS.050727-1400)] [D:\Program Files\China Mobile\Fetion\ImpsControls.dll] [China Mobile, 3.0.0.0] [D:\Program Files\China Mobile\Fetion\VmDotNet\v2.0.50727\System\System.Drawing.dll] [Microsoft Corporation, 2.0.50727.1433 (REDBITS.050727-1400)] [D:\Program Files\China Mobile\Fetion\ImpsPcBase.dll] [China Mobile, 3.0.0.0] [D:\Program Files\China Mobile\Fetion\VmDotNet\v2.0.50727\System\System.Xml.dll] [Microsoft Corporation, 2.0.50727.1433 (REDBITS.050727-1400)] [D:\Program Files\China Mobile\Fetion\ImpsClientBase.dll] [China Mobile, 3.0.0.0] [D:\Program Files\China Mobile\Fetion\ImpsClientUtils.dll] [China Mobile, 3.0.0.0] [D:\Program Files\China Mobile\Fetion\ImpsClientResource.dll] [China Mobile, 3.0.0.0] [D:\Program Files\China Mobile\Fetion\ImpsClientCore.dll] [China Mobile, 3.0.0.0] [D:\Program Files\China Mobile\Fetion\ImpsBase.dll] [China Mobile, 3.0.0.0] [C:\WINDOWS\system32\SOGOUPY.IME] [Sogou.com Inc., 4.2.3.2813] [D:\Program Files\SogouInput\4.2.3.2813\Resource.dll] [Sogou.com Inc., 4.2.3.2813] [D:\Program Files\China Mobile\Fetion\VmDotNet\v2.0.50727\System\Accessibility.dll] [Microsoft Corporation, 2.0.50727.1433 (REDBITS.050727-1400)] [D:\Program Files\China Mobile\Fetion\VmDotNet\v2.0.50727\System\System.Configuration.dll] [Microsoft Corporation, 2.0.50727.1433 (REDBITS.050727-1400)] [D:\Program Files\China Mobile\Fetion\AxInterop.AvatarLib.dll] [, 1.0.0.0] [D:\PROGRA~1\CHINAM~1\Fetion\AvatarX.ocx] [China Mobile, 1.0.0.3] [d:\program files\china mobile\fetion\avatar\Avapple.dll] [China Mobile, 0, 9, 8, 6] [d:\program files\china mobile\fetion\avatar\TinyFlash.dll] [中秀明天, 1, 0, 0, 2] [D:\Program Files\China Mobile\Fetion\Interop.AvatarLib.dll] [ , 1.0.0.0] [D:\Program Files\China Mobile\Fetion\NCindy.dll] [China Mobile, 3.0.0.0] [D:\Program Files\China Mobile\Fetion\Interop.DynamicGifCtlLib.dll] [ , 1.0.0.0] [D:\Program Files\China Mobile\Fetion\ImpsPcCommLayer.dll] [China Mobile, 3.0.0.0] [D:\Program Files\China Mobile\Fetion\ImpsClientData.dll] [China Mobile, 3.0.0.0] [D:\Program Files\China Mobile\Fetion\SQLite.Interop.DLL] [, 1.0.44.0] [D:\Program Files\China Mobile\Fetion\sensmon.dll] [China Mobile, 1.0.0.1] [D:\Program Files\Rising\Ris\RavScrCh.dll] [Beijing Rising Information Technology Co., Ltd., 22, 0, 0, 9] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\WINDOWS\system32\Macromed\Flash\Flash10c.ocx] [Adobe Systems, Inc., 10,0,32,18] [D:\Program Files\China Mobile\Fetion\AxInterop.WMPLib.dll] [, 1.0.0.0] [D:\Program Files\China Mobile\Fetion\Interop.WMPLib.dll] [ , 1.0.0.0] [PID: 1344 / SYSTEM][C:\WINDOWS\system32\CAP2RSK.EXE] [CANON INC., 1.00.0.018] [PID: 836 / SYSTEM][C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\CAP2SWK.EXE] [CANON INC., 1.00.0.018] [C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\CAP2PMN.DLL] [CANON INC., 1.00.0.018] [C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\CAP2SMK.DLL] [CANON INC., 1.00.0.018] [C:\WINDOWS\system32\SOGOUPY.IME] [Sogou.com Inc., 4.2.3.2813] [D:\Program Files\SogouInput\4.2.3.2813\Resource.dll] [Sogou.com Inc., 4.2.3.2813] [PID: 624 / Administrator][D:\Program Files\Tencent\QQ\Bin\TXPlatform.exe] [Tencent, 1, 32, 1060, 0] [D:\Program Files\Tencent\QQ\Bin\TXPFProxy.dll] [Tencent, 1, 32, 1060, 0] [PID: 3784 / SYSTEM][C:\WINDOWS\system32\nvsvc32.exe] [NVIDIA Corporation, 6.14.11.0099] [C:\WINDOWS\system32\nvapi.dll] [NVIDIA Corporation, 6.14.11.0099] [C:\WINDOWS\system32\SOGOUPY.IME] [Sogou.com Inc., 4.2.3.2813] [D:\Program Files\SogouInput\4.2.3.2813\Resource.dll] [Sogou.com Inc., 4.2.3.2813] [PID: 3800 / SYSTEM][D:\Program Files\360\360se3\Shield\SbieSvc.exe] [tzuk, 3.28.04] [D:\Program Files\360\360se3\Shield\SbieDll.dll] [tzuk, 3.28.04] [PID: 3856 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)] [PID: 3012 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-0852)] [PID: 3172 / Administrator][C:\WINDOWS\system32\rundll32.exe] [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2105)] [C:\PROGRA~1\RACER-~1\pppoe.dll] [北京润汇科技有限公司, 9, 0, 22, 50] [C:\WINDOWS\system32\SOGOUPY.IME] [Sogou.com Inc., 4.2.3.2813] [D:\Program Files\SogouInput\4.2.3.2813\Resource.dll] [Sogou.com Inc., 4.2.3.2813] [PID: 3764 / Administrator][C:\PROGRA~1\COMMON~1\THUNDE~1\ThunderS\ThunderS.exe] [Xunlei Networking Technologies,LTD, 1, 0, 0, 46] [C:\PROGRA~1\COMMON~1\THUNDE~1\ThunderS\BugReportU.dll] [Thunder Networking Technologies,LTD, 1, 5, 2, 23] [C:\PROGRA~1\COMMON~1\THUNDE~1\ThunderS\download_interface.dll] [Thunder Networking Technologies,LTD, 3, 1, 2, 319] [C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\PROGRA~1\COMMON~1\THUNDE~1\ThunderS\asyn_frame.dll] [Thunder Networking Technologies,LTD, 1, 1, 2, 20] [C:\WINDOWS\system32\ATL71.DLL] [Microsoft Corporation, 7.10.6041.0] [C:\PROGRA~1\COMMON~1\THUNDE~1\ThunderS\backend_agent.dll] [Thunder Networking Technologies,LTD, 1, 1, 2, 19] [C:\PROGRA~1\COMMON~1\THUNDE~1\ThunderS\ptl.dll] [Thunder Networking Technologies,LTD, 3, 1, 2, 25] [C:\PROGRA~1\COMMON~1\THUNDE~1\ThunderS\xl_stat.dll] [Thunder Networking Technologies,LTD, 1, 1, 2, 3] [C:\PROGRA~1\COMMON~1\THUNDE~1\ThunderS\fs.dll] [Thunder Networking Technologies,LTD, 1, 1, 2, 10] [C:\PROGRA~1\COMMON~1\THUNDE~1\ThunderS\p2sp.dll] [Thunder Networking Technologies,LTD, 1, 1, 2, 31] [C:\PROGRA~1\COMMON~1\THUNDE~1\ThunderS\down_dispatcher.dll] [Thunder Networking Technologies,LTD, 1, 0, 2, 19] [C:\PROGRA~1\COMMON~1\THUNDE~1\ThunderS\p2p_upload.dll] [Thunder Networking Technologies,LTD, 1, 1, 2, 8] [C:\PROGRA~1\COMMON~1\THUNDE~1\ThunderS\p2p.dll] [Thunder Networking Technologies,LTD, 1,1,2,26] [C:\PROGRA~1\COMMON~1\THUNDE~1\ThunderS\xldc.dll] [Thunder Networking Technologies,LTD, 3, 6, 2, 15] [C:\PROGRA~1\COMMON~1\THUNDE~1\ThunderS\stream.dll] [Thunder Networking Technologies,LTD, 2, 1, 2, 382] [C:\PROGRA~1\COMMON~1\THUNDE~1\ThunderS\p2p_local_res.dll] [Thunder Networking Technologies,LTD, 1,1,2,12] [C:\PROGRA~1\COMMON~1\THUNDE~1\ThunderS\al.dll] [Thunder Networking Technologies,LTD, 1,1,2,20] [C:\PROGRA~1\COMMON~1\THUNDE~1\ThunderS\emule.dll] [, 1, 1, 2, 21] [C:\PROGRA~1\COMMON~1\THUNDE~1\ThunderS\emule_id.dll] [Thunder Networking Technologies,LTD, 1, 0, 2, 7] [C:\PROGRA~1\COMMON~1\THUNDE~1\ThunderS\bd.dll] [Thunder Networking Technologies,LTD, 1, 0, 2, 17] [PID: 1468 / Administrator][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.984\SREngLdr.EXE] [Smallfrogs Studio, 2.8.1.1279] [PID: 1092 / Administrator][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.984\SREdf1dc548.EXE] [Smallfrogs Studio, 2.8.1.1279] [C:\WINDOWS\system32\SOGOUPY.IME] [Sogou.com Inc., 4.2.3.2813] [D:\Program Files\SogouInput\4.2.3.2813\Resource.dll] [Sogou.com Inc., 4.2.3.2813] [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.984\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15] ================================== 文件关联 .TXT Error. [C:\WINDOWS\notepad.exe %1] .EXE OK. ["%1" %*] .COM OK. ["%1" %*] .PIF OK. ["%1" %*] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %*] .SCR OK. ["%1" /S] .CHM Error. ["hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf N/A ================================== HOSTS 文件 127.0.0.1 localhost ================================== 进程特权扫描 特殊特权被允许: SeLoadDriverPrivilege [PID = 672, C:\PROGRAM FILES\RACER-HAN-CNC\RACER.EXE] 特殊特权被允许: SeDebugPrivilege [PID = 768, C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SMARTRAM.EXE] 特殊特权被允许: SeLoadDriverPrivilege [PID = 768, C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SMARTRAM.EXE] 特殊特权被允许: SeDebugPrivilege [PID = 844, D:\PROGRAM FILES\CHINA MOBILE\FETION\VMDOTNET\V2.0.50727\FETIONVM.EXE] 特殊特权被允许: SeLoadDriverPrivilege [PID = 844, D:\PROGRAM FILES\CHINA MOBILE\FETION\VMDOTNET\V2.0.50727\FETIONVM.EXE] 特殊特权被允许: SeLoadDriverPrivilege [PID = 3784, C:\WINDOWS\SYSTEM32\NVSVC32.EXE] 特殊特权被允许: SeLoadDriverPrivilege [PID = 3800, D:\PROGRAM FILES\360\360SE3\SHIELD\SBIESVC.EXE] 特殊特权被允许: SeLoadDriverPrivilege [PID = 3764, C:\PROGRA~1\COMMON~1\THUNDE~1\THUNDERS\THUNDERS.EXE] 特殊特权被允许: SeLoadDriverPrivilege [PID = 1468, C:\DOCUME~1\ADMINI~1\LOCALS~1\TEMP\RAR$EX00.984\SRENGLDR.EXE] ================================== 计划任务 [已启用] SogouImeMgr.job D:\PROGRA~1\SOGOUI~1\423~1.281\PinyinRepair.exe [已启用] User_Feed_Synchronization-{68122961-553A-4A5C-98A8-7BD390809177}.job C:\WINDOWS\system32\msfeedssync.exe ================================== Windows 安全更新检查 Microsoft .NET Framework 版本 1.1,简体中文版 KB892130, Windows 正版增值验证工具 (KB892130) KB925850, Windows Media Player 11 KB940157, 用于 Windows XP 的 Windows 搜索 4.0 (KB940157) KB943729, 用于 Windows XP 的组策略首选项客户端扩展 (KB943729) KB905474, Windows Genuine Advantage 通知 (KB905474) KB909520, Microsoft 基本智能卡加密服务提供程序包: x86 (KB909520) KB951847, Microsoft .NET Framework 3.5 Service Pack 1 和 .NET Framework 3.5 Family Update (KB951847) x86 KB931125, 根证书更新 [2009 年 9 月] (KB931125) KB890830, Windows 恶意软件删除工具 - 2009 年 10 月 (KB890830) ================================== API HOOK N/A ================================== 隐藏进程 N/A ================================== [/CODE]