FormVersion: 1.1
100 - Process: smss.exe - \SystemRoot\System32\smss.exe
100 - Process: csrss.exe - C:\WINDOWS\system32\csrss.exe
ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestTh??
100 - Process: winlogon.exe - winlogon.exe
100 - Process: services.exe - C:\WINDOWS\system32\services.exe
100 - Process: lsass.exe - C:\WINDOWS\system32\lsass.exe
100 - Process: svchost.exe - C:\WINDOWS\system32\svchost -k DcomLaunch
100 - Process: svchost.exe - C:\WINDOWS\system32\svchost -k rpcss
100 - Process: svchost.exe - C:\WINDOWS\System32\svchost.exe -k netsvcs
100 - Process: svchost.exe - C:\WINDOWS\system32\svchost.exe -k NetworkService
100 - Process: svchost.exe - C:\WINDOWS\system32\svchost.exe -k LocalService
100 - Process: scardsvr.exe - C:\WINDOWS\System32\SCardSvr.exe
100 - Process: explorer.exe - C:\WINDOWS\Explorer.EXE
100 - Process: shstat.exe - "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
100 - Process: UpdaterUI.exe - "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
100 - Process: UKEYMonitor.exe - "C:\WINDOWS\system32\UKEYMonitor.exe"
100 - Process: ctfmon.exe - "C:\WINDOWS\system32\ctfmon.exe"
100 - Process: XDICT.EXE - "C:\Program Files\Kingsoft\PowerWord 2006\XDICT.EXE" -s -nosplash
100 - Process: rundll32.exe - C:\WINDOWS\system32\rundll32.exe C:\DOCUME~1\k11939\LOCALS~1\APPLIC~1\03c6f2a\1.dll,Always
100 - Process: cvpnd.exe - "C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe"
100 - Process: FrameworkService.exe - "C:\Program Files\Network Associates\Common Framework\FrameworkService.exe" /ServiceStart
100 - Process: Mcshield.exe - "C:\Program Files\Network Associates\VirusScan\Mcshield.exe"
100 - Process: wdfmgr.exe - C:\WINDOWS\system32\wdfmgr.exe
100 - Process: naPrdMgr.exe - C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe -Embedding
100 - Process: alg.exe - C:\WINDOWS\System32\alg.exe
100 - Process: spoolsv.exe - C:\WINDOWS\system32\spoolsv.exe
100 - Process: acrotray.exe - "C:\Program Files\Adobe\Acrobat 7.0\Distillr\acrotray.exe"
100 - Process: WISPTIS.EXE - "C:\WINDOWS\system32\WISPTIS.EXE" -Embedding
100 - Process: Maxthon.exe - "C:\Program Files\Maxthon\Maxthon.exe"
100 - Process: 360Safe.exe - "D:\Program Files\360safe\360Safe.exe"
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=
about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=
about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Use Search Asst=no
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (HaoKanBar BrowserHelper) - {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} - E:\Tools\magicset\MagicSet\HaokanBar.dll
O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: (Image&Down) - {86232A8E-933D-40B7-AE64-4E99B778A977} - d:\Program Files\ImageDown\ImageDown.dll
O3 - Toolbar: (超级兔子上网精灵) - {43869BB3-22FD-4F15-9B46-238106BA2F4E} - E:\Tools\magicset\MagicSet\HaokanBar.dll
O3 - Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [gfaukeymonitor] C:\WINDOWS\system32\UKEYMonitor.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup folder: [Adobe Acrobat Speed Launcher.lnk] C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Acrobat Speed Launcher.lnk
O4 - Startup folder: [Cisco Systems VPN Client.lnk] C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Cisco Systems VPN Client.lnk
O4 - Startup folder: [金山词霸 2006.lnk] C:\Documents and Settings\k11939\「开始」菜单\程序\启动\金山词霸 2006.lnk
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: 使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - Extra context menu item: 导出到 Microsoft Excel(&x) - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 将转换链接目标为 Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: 将选定的内容转换为 Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: 将选定的内容转换到现有的 PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: 将选定的链接转换到现有的 PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: 将链接目标转换到现有的 PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Program Files\Tencent\QQ\SendMMS.htm
O8 - Extra context menu item: 转换为 Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: 转换为现有 PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: 转换到现有的 PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: 转换选定的链接为 Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: 转换选定的链接为 Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: 转换选定的链接为现有 PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: 转换选项为 Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: 转换选项为现有 PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: 转换链接目标为 Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: 转换链接目标为现有 PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: IBM Java 控制台(HKLM)
O9 - Extra button: ViewPage(HKLM)
O9 - Extra button: 信息检索(HKLM)
O9 - Extra button: QQ炫彩工具条设置(HKLM)
O9 - Extra button: Messenger(HKLM)
O11 - Options Group: Java (IBM)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in) - http://java.sun.com/products/plugin/1.4.2/jinstall-142-win.cab
O16 - DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} (Java Plug-in) - http://java.sun.com/products/plugin/1.4.2/jinstall-142-win.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Flash播放器) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{AAB2DF00-E483-499B-813B-9E3FAF975F73}: NameServer = 202.102.134.68,202.102.128.68
O18 - Protocol: OFFICE 相关 - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: OFFICE 相关 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
O23 - Service: CVPND - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Diskeeper - E:\Tools\diskeeperpremium-v10.0\Diskeeper\DkService.exe
O23 - Service: Dnscache - C:\WINDOWS\system32\dnsrslvr.dll
O23 - Service: EventSystem - C:\WINDOWS\system32\es.dll
O23 - Service: IPSSVC - C:\WINDOWS\system32\IPSSVC.EXE
O23 - Service: McAfeeFramework - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: McShield - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: McTaskManager - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Multi-user Cleanup Service - D:\Program Files\lotus\notes\ntmulti.exe
O23 - Service: Nla - C:\WINDOWS\system32\mswsock.dll
O23 - Service: PsaSrv - 提供对敏感数据(如私钥)的保护性存储，以便防止未授权的服务，过程或用户对其的非法访问。
O23 - Service: TSSCoreService - C:\Program Files\IBM ThinkVantage\Client Security Solution\ibmtcsd.exe
O23 - Service: TVT Backup Service - C:\Program Files\IBM ThinkVantage\Rescue and Recovery\rrservice.exe
O23 - Service: TVT Scheduler - C:\Program Files\IBM ThinkVantage\Common\Scheduler\tvtsched.exe
O23 - Service: UCLauncherService - C:\Program Files\ThinkVantage\SystemUpdate\UCLauncherService.exe
O23 - Service: WmcCds - c:\program files\windows media connect\mswmccds.exe
O23 - Service: WmcCdsLs - C:\Program Files\Windows Media Connect\mswmcls.exe
