[PID: 3688 / nyhywj][C:\WINDOWS\system32\ElkCtrl.exe]  [Logitech Inc., 8.5.0.1137]
    [C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll]  [Logitech, 9.4.4.1082]
    [C:\WINDOWS\system32\MSNCHATHOOK.DLL]  [HiTRUST, 2, 2, 0, 9]
    [C:\WINDOWS\system32\sysenv.dll]  [HiTRUST, 2, 2, 0, 44]
    [C:\WINDOWS\system32\CryptoAPI.dll]  [HiTRUST, 2, 2, 0, 11]
    [C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\WINDOWS\system32\MFC71U.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\MFC71CHS.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\Program Files\Internet Explorer\RAVQJMON.DAT]  [N/A, ]
    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
    [C:\WINDOWS\system32\zxgpri.dll]  [N/A, ]
    [C:\WINDOWS\system32\ztmpri.dll]  [N/A, ]
    [C:\WINDOWS\system32\xyipri.dll]  [N/A, ]
    [C:\WINDOWS\system32\WinFormA5.dll]  [N/A, ]
    [C:\WINDOWS\system32\myepri.dll]  [N/A, ]
    [C:\WINDOWS\system32\ElkCtlPS.dll]  [Logitech Inc., 8.5.0.1137]
    [C:\WINDOWS\system32\lvmaenum.dll]  [Logitech, 9.4.4.1082]
    [C:\WINDOWS\system32\lvcomcx.dll]  [Logitech, 9.4.4.1082]
    [C:\WINDOWS\system32\dhdpri.dll]  [N/A, ]
[PID: 3936 / nyhywj][C:\WINDOWS\system32\ztmins.exe]  [N/A, ]
    [C:\WINDOWS\system32\myepri.dll]  [N/A, ]
    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
    [C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll]  [Logitech, 9.4.4.1082]
    [C:\WINDOWS\system32\ztmpri.dll]  [N/A, ]
[PID: 160 / nyhywj][D:\Rising\Rav\RavTask.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
    [D:\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [D:\Rising\Rav\RSAPPMGR.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
    [D:\Rising\Rav\CfgDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
    [D:\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [C:\WINDOWS\system32\MSNCHATHOOK.DLL]  [HiTRUST, 2, 2, 0, 9]
    [C:\WINDOWS\system32\sysenv.dll]  [HiTRUST, 2, 2, 0, 44]
    [C:\WINDOWS\system32\CryptoAPI.dll]  [HiTRUST, 2, 2, 0, 11]
    [C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\WINDOWS\system32\MFC71U.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\MFC71CHS.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\zxgpri.dll]  [N/A, ]
    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
    [C:\WINDOWS\system32\ztmpri.dll]  [N/A, ]
    [C:\WINDOWS\system32\xyipri.dll]  [N/A, ]
    [C:\WINDOWS\system32\WinFormA5.dll]  [N/A, ]
    [C:\WINDOWS\system32\myepri.dll]  [N/A, ]
    [C:\WINDOWS\system32\dhdpri.dll]  [N/A, ]
[PID: 2156 / nyhywj][D:\Rising\Rav\Ravmon.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 45]
    [D:\Rising\Rav\RsGuiLib.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33]
    [D:\Rising\Rav\BWList.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
    [C:\WINDOWS\system32\myepri.dll]  [N/A, ]
    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
    [D:\Rising\Rav\RSAPPMGR.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
    [D:\Rising\Rav\CfgDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
    [D:\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [D:\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [D:\Rising\Rav\RsXML.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
    [D:\Rising\Rav\PngDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
    [C:\Program Files\Internet Explorer\RAVQJMON.DAT]  [N/A, ]
    [C:\WINDOWS\system32\MSNCHATHOOK.DLL]  [HiTRUST, 2, 2, 0, 9]
    [C:\WINDOWS\system32\sysenv.dll]  [HiTRUST, 2, 2, 0, 44]
    [C:\WINDOWS\system32\CryptoAPI.dll]  [HiTRUST, 2, 2, 0, 11]
    [C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\WINDOWS\system32\MFC71U.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\MFC71CHS.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\zxgpri.dll]  [N/A, ]
    [C:\WINDOWS\system32\ztmpri.dll]  [N/A, ]
    [C:\WINDOWS\system32\xyipri.dll]  [N/A, ]
    [C:\WINDOWS\system32\WinFormA5.dll]  [N/A, ]
    [C:\WINDOWS\system32\dhdpri.dll]  [N/A, ]

[PID: 3404 / nyhywj][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
    [C:\WINDOWS\system32\dhdpri.dll]  [N/A, ]
    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, ]
    [C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll]  [Logitech, 9.4.4.1082]
    [C:\WINDOWS\system32\IEFRAME.dll]  [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
    [C:\Program Files\Internet Explorer\RAVQJMON.DAT]  [N/A, ]
    [C:\WINDOWS\system32\MSNCHATHOOK.DLL]  [HiTRUST, 2, 2, 0, 9]
    [C:\WINDOWS\system32\sysenv.dll]  [HiTRUST, 2, 2, 0, 44]
    [C:\WINDOWS\system32\CryptoAPI.dll]  [HiTRUST, 2, 2, 0, 11]
    [C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\WINDOWS\system32\MFC71U.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\MFC71CHS.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\IEUI.dll]  [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
    [C:\WINDOWS\system32\xmllite.dll]  [Microsoft Corporation, 1.00.1018.0]
    [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
    [C:\Program Files\Internet Explorer\ieproxy.dll]  [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
    [C:\WINDOWS\system32\zxgpri.dll]  [N/A, ]
    [C:\WINDOWS\system32\WinFormA5.dll]  [N/A, ]
    [C:\WINDOWS\system32\myepri.dll]  [N/A, ]
    [C:\WINDOWS\system32\ztmpri.dll]  [N/A, ]
    [C:\WINDOWS\system32\xyipri.dll]  [N/A, ]
    [D:\软件\迅雷\WebThunderBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 2, 10]
    [c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll]  [Adobe Systems Incorporated, 7.0.0.2004121400]
    [C:\WINDOWS\system32\ieapfltr.dll]  [Microsoft Corporation, 7.0.6000.16461]
    [C:\Acer\Empowering Technology\ePower\SysHook.dll]  [, 0, 9, 7, 3]
    [C:\WINDOWS\system32\mscomm.dll]  [N/A, ]
    [D:\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL]  [Microsoft Corporation, 11.0.5510]
    [C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll]  [N/A, ]
[PID: 5684 / nyhywj][D:\软件\system repair\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
    [C:\WINDOWS\system32\zxgpri.dll]  [N/A, ]
    [C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll]  [Logitech, 9.4.4.1082]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, ]
    [C:\Program Files\Internet Explorer\RAVQJMON.DAT]  [N/A, ]
    [C:\WINDOWS\system32\MSNCHATHOOK.DLL]  [HiTRUST, 2, 2, 0, 9]
    [C:\WINDOWS\system32\sysenv.dll]  [HiTRUST, 2, 2, 0, 44]
    [C:\WINDOWS\system32\CryptoAPI.dll]  [HiTRUST, 2, 2, 0, 11]
    [C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\WINDOWS\system32\MFC71U.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\MFC71CHS.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\WinFormA5.dll]  [N/A, ]
    [C:\WINDOWS\system32\dhdpri.dll]  [N/A, ]
    [C:\WINDOWS\system32\myepri.dll]  [N/A, ]
    [C:\WINDOWS\system32\ztmpri.dll]  [N/A, ]
    [C:\WINDOWS\system32\xyipri.dll]  [N/A, ]
    [D:\软件\system repair\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]
    [C:\WINDOWS\system32\mscomm.dll]  [N/A, ]

文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
MSAPI Tcpip [TCP/IP]
    C:\WINDOWS\system32\mscomm.dll(, N/A)
MSAPI Tcpip [UDP/IP]
    C:\WINDOWS\system32\mscomm.dll(, N/A)

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 1508, C:\PROGRAM FILES\INTEL\WIRELESS\BIN\S24EVMON.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1876, C:\PROGRAM FILES\WIDCOMM\BLUETOOTH SOFTWARE\BIN\BTWDINS.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3432, C:\ACER\EMPOWERING TECHNOLOGY\ERECOVERY\ERAGENT.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 4024, C:\PROGRAM FILES\CYBERLINK\POWERDVD\PDVDSERV.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 4024, C:\PROGRAM FILES\CYBERLINK\POWERDVD\PDVDSERV.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 272, C:\ACER\EMPOWERING TECHNOLOGY\EDATASECURITY\EDSLOADER.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 272, C:\ACER\EMPOWERING TECHNOLOGY\EDATASECURITY\EDSLOADER.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 444, C:\ACER\EMPOWERING TECHNOLOGY\EPRESENTATION\EPRESENTATION.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 444, C:\ACER\EMPOWERING TECHNOLOGY\EPRESENTATION\EPRESENTATION.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 756, C:\DOCUME~1\NYHYWJ\LOCALS~1\TEMP\RTKBTMNT.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 756, C:\DOCUME~1\NYHYWJ\LOCALS~1\TEMP\RTKBTMNT.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 1628, C:\WINDOWS\SYSTEM32\XYIINS.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1628, C:\WINDOWS\SYSTEM32\XYIINS.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 2572, C:\ACER\EMPOWERING TECHNOLOGY\EPOWER\EPOWER_DMC.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2572, C:\ACER\EMPOWERING TECHNOLOGY\EPOWER\EPOWER_DMC.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 2820, C:\PROGRA~1\LAUNCH~1\QTZGACER.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2820, C:\PROGRA~1\LAUNCH~1\QTZGACER.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 2888, C:\WINDOWS\SYSTEM32\LVCOMSX.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2888, C:\WINDOWS\SYSTEM32\LVCOMSX.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 3268, C:\PROGRAM FILES\ACER\ORBICAM\CAMERAASSISTANT.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3268, C:\PROGRAM FILES\ACER\ORBICAM\CAMERAASSISTANT.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 3688, C:\WINDOWS\SYSTEM32\ELKCTRL.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3688, C:\WINDOWS\SYSTEM32\ELKCTRL.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 3936, C:\WINDOWS\SYSTEM32\ZTMINS.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3936, C:\WINDOWS\SYSTEM32\ZTMINS.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 160, D:\RISING\RAV\RAVTASK.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 160, D:\RISING\RAV\RAVTASK.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 2156, D:\RISING\RAV\RAVMON.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2156, D:\RISING\RAV\RAVMON.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 2436, C:\ACER\EMPOWERING TECHNOLOGY\ACER.EMPOWERING.FRAMEWORK.LAUNCHER.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2436, C:\ACER\EMPOWERING TECHNOLOGY\ACER.EMPOWERING.FRAMEWORK.LAUNCHER.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 2672, C:\PROGRAM FILES\WIDCOMM\BLUETOOTH SOFTWARE\BTTRAY.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2672, C:\PROGRAM FILES\WIDCOMM\BLUETOOTH SOFTWARE\BTTRAY.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 2720, C:\WINDOWS\SYSTEM32\MYEINS.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2720, C:\WINDOWS\SYSTEM32\MYEINS.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 3768, C:\WINDOWS\SYSTEM32\ZXGINS.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3768, C:\WINDOWS\SYSTEM32\ZXGINS.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 3396, C:\WINDOWS\SYSTEM32\DHDINS.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3396, C:\WINDOWS\SYSTEM32\DHDINS.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 4520, C:\WINDOWS\SYSTEM32\WINFORMA5.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 4520, C:\WINDOWS\SYSTEM32\WINFORMA5.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 4764, C:\DOCUME~1\NYHYWJ\LOCALS~1\TEMP\10.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 4764, C:\DOCUME~1\NYHYWJ\LOCALS~1\TEMP\10.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 2388, D:\RISING\RAV\RSAGENT.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2388, D:\RISING\RAV\RSAGENT.EXE]