现象如下，只要是USB盘，接触的有32M-1G的，插到我的电脑上就会自动产生2个文件：autorun.inf和cn911.exe,属性都为系统和隐含，用的是公司笔记本，装有企业版的Nortn，个人感觉这个Norton什么都不如，啥也查不到的，包括这个CN911。
但插的是移动硬盘的话不会产生。
在网上看过一些资料，手动删了，包括电脑硬盘里的，还有相关注册表，当时是以“cn911.exe为搜索目标的，反正现在已经搜索不到了。也用过瑞星在线杀毒杀过，以及一些专杀工具。问题依然....个把月了:(
在拔掉USB前删了那2个文件，插到别人电脑上，不会产生，但再次插回我的电脑，又有了。C盘等根目录下没有发现autorun.inf，右击各硬盘没有发现“自动播放”，用Total commander搜索也未发现。
autorun.inf文件内容如下：
[Autorun]
open=cn911.exe
shellexecute=cn911.exe
shell\auto\command=cn911.exe
我已经无力再折腾了，希望这里的高手指点下迷津，不甚感激。

没错的，就是病毒！
首先你点击菜单栏上的 工具/文件夹选项/查看 把“显示系统文件夹内容、隐藏受保护的操作系统文件（推荐）、显示所有文件夹和文件”这三项勾上，然后看看你的U盘中还隐藏了哪些东东，把隐藏了的和Cn911.exe文件全部删掉，在到开始/搜索 与Cn911.exe的相关的文件，全部删掉，最后打开 开始/运行 输入regedit 确定，在菜单栏上的 编辑/查找 Cn911.exe 的相关项全部删除 就搞定了！
PS提示一下，万一要是杀毒后，遇到U盘插入不能自动播放的问题请参见我的提问“可移动磁盘无法自动播放”

这个是网上复制的吧，中的时候就已经看过了，没有用，不过还是要谢谢。

下载 System Repair Engineer，
http://www.kztechs.com/sreng/download.html
1 解压缩sreng2.zip
2 运行SREng.exe
3 智能扫描=》扫描=》保存报告
4 把日志中的报告完整拷贝贴上来，不要修改
友情提示：
扫描前关闭所有手工打开的软件和窗口，扫描后将日志发上来。但请不要用附件形式贴。
注意在没有进一步提示前，勿要胡乱修复，否则系统可能变的情况更糟。
         
如果发现SREng.exe运行无反应或者不能运行或者扫描出错,你可以将SREng.exe重命名为SREng.com(SREng.scr\SREng.bat\SREng.pif)或者abc.exe运行.
另外那个 病毒文件麻烦发到newcenturymoon@126.com

引用:

【newcenturymoon的贴子】下载 System Repair Engineer， http://www.kztechs.com/sreng/download.html 1 解压缩sreng2.zip 2 运行SREng.exe 3 智能扫描=》扫描=》保存报告 4 把日志中的报告完整拷贝贴上来，不要修改 友情提示： 扫描前关闭所有手工打开的软件和窗口，扫描后将日志发上来。但请不要用附件形式贴。 注意在没有进一步提示前，勿要胡乱修复，否则系统可能变的情况更糟。           如果发现SREng.exe运行无反应或者不能运行或者扫描出错,你可以将SREng.exe重命名为SREng.com(SREng.scr\SREng.bat\SREng.pif)或者abc.exe运行. 另外那个 病毒文件麻烦发到newcenturymoon@126.com ………………

这段话抄下来了....好用,以后用上,哈哈

[CODE]

2007-01-30,23:59:20

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- Administrative User - Completed Functions Allowed

Follow item(s) have been choosed:
    All Boot Items (Including Registry, Startup Folders, Services and so on)
    Browser Add-ons
    Runing Processes (Including process model information)
    File Associations
    Winsock Provider
    Autorun.Inf
    HOSTS File


Boot Items
Registry
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <CTFMON.EXE><C:\WINNT\system32\ctfmon.exe>  [(Verified)Microsoft Corporation]
    <IBM RecordNow!><>  [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <BluetoothAuthenticationAgent><rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent>  [(Verified)Microsoft Corporation]
    <MNUNET><"C:\Program Files\Mobiliti\Unplugged\BIN\MNUNET.EXE">  [Mobiliti, Inc.]
    <MNUAutoSync><"C:\Program Files\Mobiliti\Unplugged\BIN\MNUNPLUG.EXE" /AutoStartUpSync>  [Mobiliti, Inc.]
    <CyberArmorHelper><C:\Program Files\CyberArmor\pcshelp.exe -check>  [InfoExpress]
    <updcauser><C:\Program Files\CyberArmor\updca.bat>  [N/A]
    <SunJavaUpdateSched><C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe>  [Sun Microsystems, Inc.]
    <TPHOTKEY><C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe>  [N/A]
    <SynTPLpr><C:\Program Files\Synaptics\SynTP\SynTPLpr.exe>  [(Verified)Synaptics, Inc.]
    <SynTPEnh><C:\Program Files\Synaptics\SynTP\SynTPEnh.exe>  [(Verified)Synaptics, Inc.]
    <BMMGAG><RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor>  [IBM Corp.]
    <BMMLREF><C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE>  [N/A]
    <BMMMONWND><rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor>  [N/A]
    <EZEJMNAP><C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe>  [IBM Corp.]
    <TPKMAPHELPER><C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper>  [IBM Corp.]
    <TrackPointSrv><tp4serv.exe>  [(Verified)IBM Corporation]
    <TP4EX><tp4ex.exe>  [IBM Corporation]
    <ZCfgSvc.exe><c:\WINNT\system32\ZCfgSvc.exe>  [Intel Corporation]
    <PRONoMgr.exe><c:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe>  [Intel(R) Corporation]
    <ControlCenter><"C:\Program Files\IBM fingerprint software\ctlcntr.exe" /startup>  [UPEK Inc.]
    <IMJPMIG8.1><"C:\WINNT\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Corporation]
    <IMEKRMIG6.1><C:\WINNT\ime\imkr6_1\IMEKRMIG.EXE>  [(Verified)Microsoft Corporation]
    <MSPY2002><C:\WINNT\system32\IME\PINTLGNT\ImScInst.exe /SYNC>  [(Verified)N/A]
    <IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload>  [(Verified)Microsoft Corporation]
    <CJIMETIPSYNC><C:\Program Files\Common Files\Microsoft Shared\IME\IMTC65\CHANGJIE\CINTLCFG.EXE /CJIMETIPSync>  [(Verified)Microsoft Corp.]
    <PHIMETIPSYNC><C:\Program Files\Common Files\Microsoft Shared\IME\IMTC65\PHONETIC\TINTLCFG.EXE /PHIMETIPSync>  [(Verified)Microsoft Corp.]
    <PCSuiteTrayApplication><C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup>  [Nokia]
    <Hot Key Kbd Daemon><SKDAEMON.EXE>  [LITE-ON TECHNOLOGY CORP.]
    <Protect Tray><"C:\Program Files\Pointsec\P95tray.exe">  [Pointsec Mobile Technologies AB]
    <lcfep><"C:\Program Files\Tivoli\lcf\bin\w32-ix86\mrt\lcfep.exe" -x>  [N/A]
    <SwdisUsrPCN.IL8450249><"C:\PROGRA~1\Tivoli\lcf\dat\1\cache\lib\w32-ix86\wdusrpcn.exe" "C:\Program Files\Tivoli\swdis\1\wdusrpcn.envIL8450249">  [N/A]
    <ccApp><"C:\Program Files\Common Files\Symantec Shared\ccApp.exe">  [(Verified)Symantec Corporation]
    <vptray><C:\PROGRA~1\Symantec\SCS3\SYMANT~1\VPTray.exe>  [(Verified)Symantec Corporation]
    <ODBCJET><C:\WINNT\system32\ODBCJET.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><C:\WINNT\system32\userinit.exe>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs>< cahooknt.dll>  [InfoExpress]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <GinaDLL><pssogina.dll>  [Pointsec Mobile Technologies AB]
    <UIHost><logonui.exe>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ckpNotify]
    <WinlogonNotify: ckpNotify><ckpNotify.dll>  [Check Point Software Technologies]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
    <WinlogonNotify: NavLogon><C:\WINNT\system32\NavLogon.dll>  [(Verified)Symantec Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\psfus]
    <WinlogonNotify: psfus><C:\Program Files\IBM fingerprint software\psfus.dll>  [UPEK Inc.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Sebring]
    <WinlogonNotify: Sebring><c:\WINNT\system32\LgNotify.dll>  [Intel Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tphotkey]
    <WinlogonNotify: tphotkey><tphklock.dll>  [N/A]
[HKEY_CURRENT_USER\Control Panel\Desktop]
    <SCRNSAVE.EXE><C:\WINNT\system32\pscr_nt.SCR>  [N/A]

==================================
Startup Folders
[BTTray]
  <C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BTTray.lnk --> C:\PROGRA~1\IBM\BLUETO~1\BTTray.exe [Broadcom Corporation]><N>

==================================
Services
[ASP.NET State Service / aspnet_state][Stopped/Manual Start]
  <C:\WINNT\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe><Microsoft Corporation>
[Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start]
  <C:\WINNT\system32\Ati2evxx.exe><ATI Technologies Inc.>
[ATI Smart / ATI Smart][Stopped/Auto Start]
  <C:\WINNT\system32\ati2sgag.exe><>
[BBDistHandler / BBDistHandler][Running/Auto Start]
  <C:\MAINT\sid\DISTH\DistH.exe><IBM>
[Bluetooth Service / btwdins][Running/Auto Start]
  <C:\Program Files\IBM\Bluetooth Software\bin\btwdins.exe><Broadcom Corporation>
[Symantec Event Manager / ccEvtMgr][Running/Auto Start]
  <"C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"><Symantec Corporation>
[Symantec Settings Manager / ccSetMgr][Running/Auto Start]
  <"C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"><Symantec Corporation>
[CyberArmor Run Service / CyberArmorRunService][Running/Auto Start]
  <C:\Program Files\CyberArmor\casvc.exe><InfoExpress>
[Symantec AntiVirus Definition Watcher / DefWatch][Running/Auto Start]
  <"C:\Program Files\Symantec\SCS3\Symantec AntiVirus\DefWatch.exe"><Symantec Corporation>
[Nokia GCS / GCSR4][Running/Auto Start]
  <"C:\Program Files\Nokia\GCS\GCSServer.exe"><Nokia>
[Nokia GCS Sync / GCSSync][Running/Auto Start]
  <"C:\Program Files\Nokia\GCS\gcssync.exe"><Nokia>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINNT\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[HTTP Poster Service / HTTP Poster][Stopped/Auto Start]
  <C:\WINNT\system32\HTTP_Poster.exe><Nokia>
[IBM PM Service / IBMPMSVC][Running/Auto Start]
  <C:\WINNT\system32\ibmpmsvc.exe><N/A>
[InstallDriver Table Manager / IDriverT][Stopped/Manual Start]
  <"C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe"><Macrovision Corporation>
[iPassConnectEngine / iPassConnectEngine][Stopped/Manual Start]
  <C:\Program Files\iPass\iPassConnect\iPassConnectEngine.exe><iPass>
[iPCAgent / iPCAgent][Running/Auto Start]
  <C:\Program Files\iPass\iPassConnect\iPCAgent.exe><iPass, Inc.>
[Tivoli Endpoint / lcfd][Running/Auto Start]
  <"C:\Program Files\Tivoli\lcf\bin\w32-ix86\mrt\lcfd.exe"><N/A>
[LiveUpdate / LiveUpdate][Stopped/Manual Start]
  <"C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE"><Symantec Corporation>
[OracleOraHome92ClientCache / OracleOraHome92ClientCache][Stopped/Manual Start]
  <C:\Apps\oracle\ora92\BIN\ONRSD.EXE><N/A>
[Pointsec / Pointsec][Running/Auto Start]
  <C:\WINNT\system32\PROT_SRV.EXE><N/A>
[Pointsec update agent / Pointsec_agent][Running/Auto Start]
  <C:\WINNT\system32\pagents.exe><N/A>
[Pointsec service start / Pointsec_start][Running/Auto Start]
  <C:\WINNT\system32\PSTARTSR.EXE><N/A>
[Spectrum24 Event Monitor / S24EventMonitor][Running/Auto Start]
  <C:\WINNT\system32\S24EvMon.exe><Intel Corporation>
[SavRoam / SavRoam][Running/Auto Start]
  <"C:\Program Files\Symantec\SCS3\Symantec AntiVirus\SavRoam.exe"><symantec>
[ServiceLayer / ServiceLayer][Running/Manual Start]
  <"C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe"><Nokia.>
[Symantec SPBBCSvc / SPBBCSvc][Stopped/Manual Start]
  <"C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe"><Symantec Corporation>
[Check Point SecuRemote Service / SR_Service][Running/Auto Start]
  <"C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe"><Check Point Software Technologies>
[Check Point SecuRemote WatchDog / SR_WatchDog][Running/Auto Start]
  <"C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe"><Check Point Software Technologies>
[Symantec AntiVirus / Symantec AntiVirus][Running/Auto Start]
  <"C:\Program Files\Symantec\SCS3\Symantec AntiVirus\Rtvscan.exe"><Symantec Corporation>
[Tivoli License Mgr Agent / Tivoli License Mgr Agent][Running/Auto Start]
  <"C:\WINNT\itlm\tlmagent.exe"><N/A>
[Tivoli Remote Control Service / TME10RC][Running/Auto Start]
  <C:\WINNT\RCSERV.EXE><IBM Corporation>
[IBM KCU Service / TpKmpSVC][Running/Auto Start]
  <C:\WINNT\system32\TpKmpSVC.exe><N/A>
[Protector Suite Virtual Token / vtserver][Running/Auto Start]
  <"C:\Program Files\Common Files\Virtual Token\vtserver.exe"><UPEK Inc.>
[Windows Security Update / WSUSrv][Stopped/Manual Start]
  <C:\WINNT\TEMP\_WSU\WSUSrv.exe><N/A>

==================================
Drivers
[aeaudio / aeaudio][Running/Manual Start]
  <system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
[AEGIS Protocol (IEEE 802.1x) v3.0.0.7 / AegisP][Running/Auto Start]
  <system32\DRIVERS\AegisP.sys><Meetinghouse Data Communications>
[ati2mtag / ati2mtag][Running/Manual Start]
  <system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[Broadcom NetXtreme Gigabit Ethernet / b57w2k][Running/Manual Start]
  <system32\DRIVERS\b57xp32.sys><Broadcom Corporation>
[Bluetooth Audio Device / btaudio][Running/Manual Start]
  <system32\drivers\btaudio.sys><Broadcom Corporation>
[Bluetooth Virtual Communications Driver / BTDriver][Running/Manual Start]
  <system32\DRIVERS\btport.sys><Broadcom Corporation>
[Bluetooth Protocol Stack / BTKRNL][Running/Boot Start]
  <\SystemRoot\system32\drivers\btkrnl.sys><Broadcom Corporation>
[Bluetooth LAN Access Server / BTWDNDIS][Stopped/Manual Start]
  <system32\DRIVERS\btwdndis.sys><Broadcom Corporation>
[WIDCOMM USB Bluetooth Driver / BTWUSB][Stopped/Manual Start]
  <System32\Drivers\btwusb.sys><Broadcom Corporation>
[CITMDRV / CITMDRV][Running/Auto Start]
  <\??\C:\WINNT\System32\drivers\CITMDRV.SYS><N/A>
[Check Point Office Mode Module / CP_OMDRV][Running/Auto Start]
  <System32\drivers\omdrv.sys><Check Point Software Technologies>
[Symantec Eraser Control driver / eeCtrl][Running/System Start]
  <\??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys><Symantec Corporation>
[Eqnmirdd / Eqnmirdd][Running/Manual Start]
  <system32\DRIVERS\Eqnmirdd.sys><IBM Corp.>
[EraserUtilRebootDrv / EraserUtilRebootDrv][Running/Manual Start]
  <\??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys><Symantec Corporation>
[SecuRemote Miniport / FW1][Running/System Start]
  <system32\DRIVERS\fw.sys><Check Point Software Technologies>
[HSFHWICH / HSFHWICH][Running/Manual Start]
  <system32\DRIVERS\HSFHWICH.sys><Conexant Systems, Inc.>
[HSF_DP / HSF_DP][Running/Manual Start]
  <system32\DRIVERS\HSF_DP.sys><Conexant Systems, Inc.>
[IBM TlmK tlmkagent-2_1_0_0 / IBM TlmK tlmkagent-2_1_0_0][Running/Manual Start]
  <\??\C:\WINNT\itlm\tlmkagent-2_1_0_0.sys><N/A>
[IBMPMDRV / IBMPMDRV][Running/Manual Start]
  <system32\DRIVERS\ibmpmdrv.sys><IBM Corp.>
[iPass Protocol (IEEE 802.1x) v3.4.9.0 / iPassP][Running/Auto Start]
  <system32\DRIVERS\iPassP.sys><Meetinghouse Data Communications>
[mdmxsdk / mdmxsdk][Running/Auto Start]
  <system32\DRIVERS\mdmxsdk.sys><Conexant>
[MNUMON / MNUMON][Running/Auto Start]
  <\SystemRoot\System32\drivers\MNUMON.sys><Mobiliti, Inc>
[MNUPFILT / MNUPFILT][Running/Auto Start]
  <\SystemRoot\System32\drivers\MNUPfilt.sys><Mobiliti, Inc>
[NAVENG / NAVENG][Running/Manual Start]
  <\??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20070127.007\naveng.sys><Symantec Corporation>
[NAVEX15 / NAVEX15][Running/Manual Start]
  <\??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20070127.007\navex15.sys><Symantec Corporation>
[npkcrypt / npkcrypt][Running/Auto Start]
  <\??\C:\Users\tencent\npkcrypt.sys><INCA Internet Co., Ltd.>
[NSC Infrared Device Driver / NSCIRDA][Running/Manual Start]
  <system32\DRIVERS\nscirda.sys><National Semiconductor Corporation>
[VPN-1 SecureClient Adapter / OMVA][Stopped/Manual Start]
  <system32\DRIVERS\OMVA.sys><Check Point Software Technologies>
[PnpWmkDrv / PnpWmkDrv][Running/System Start]
  <\??\C:\WINNT\system32\drivers\PnpWmkDrv.sys><N/A>
[TPM Service / portio][Running/Manual Start]
  <system32\DRIVERS\NscTpmDD.sys><National Semiconductor Corp.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[PxHelp20 / PxHelp20][Running/Boot Start]
  <\SystemRoot\System32\Drivers\PxHelp20.sys><Sonic Solutions>
[WLAN Transport / s24trans][Running/Auto Start]
  <system32\DRIVERS\s24trans.sys><Intel Corporation>
[SAVRT / SAVRT][Running/System Start]
  <\??\C:\Program Files\Symantec\SCS3\Symantec AntiVirus\savrt.sys><Symantec Corporation>
[SAVRTPEL / SAVRTPEL][Running/System Start]
  <\??\C:\Program Files\Symantec\SCS3\Symantec AntiVirus\Savrtpel.sys><Symantec Corporation>
[SecureClient Application Policy Module / Scap][Running/Auto Start]
  <System32\DRIVERS\Scap.sys><Check Point Software Technologies>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[Smapint / Smapint][Running/System Start]
  <System32\drivers\Smapint.sys><Microsoft Corporation>
[smwdm / smwdm][Running/Manual Start]
  <system32\drivers\smwdm.sys><Analog Devices, Inc.>
[SPBBCDrv / SPBBCDrv][Stopped/Manual Start]
  <\??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys><Symantec Corporation>
[SymEvent / SymEvent][Running/Manual Start]
  <\??\C:\Program Files\Symantec\SYMEVENT.SYS><Symantec Corporation>
[Synaptics TouchPad Driver / SynTP][Running/Manual Start]
  <system32\DRIVERS\SynTP.sys><Synaptics, Inc.>
[TC USB Kernel Driver / TcUsb][Running/Manual Start]
  <System32\Drivers\tcusb.sys><UPEK Inc.>
[TDSMAPI / TDSMAPI][Running/System Start]
  <System32\drivers\TDSMAPI.SYS><N/A>
[TPInput / TPInput][Running/Manual Start]
  <System32\DRIVERS\TPInput.sys><IBM Corporation>
[TPPWR / TPPWR][Running/System Start]
  <System32\drivers\Tppwr.sys><IBM Corp.>
[TSMAPIP / TSMAPIP][Running/System Start]
  <System32\drivers\TSMAPIP.SYS><N/A>
[CyberArmor Registry Driver / Viexca2k][Running/Auto Start]
  <system32\drivers\viexca2k.sys><InfoExpress>
[CyberArmor W2KDriver / Viexpf2k][Running/Auto Start]
  <system32\drivers\viexpf2k.sys><N/A>
[Check Point Virtual Network Adapter - SecureClient / VNASC][Running/Auto Start]
  <system32\DRIVERS\vnasc.sys><Check Point Software Technologies>
[VPN-1 Module / VPN-1][Running/Auto Start]
  <\SystemRoot\System32\drivers\vpn.sys><Check Point Software Technologies>
[Intel(R) PRO/Wireless 2200 Adapter Driver for Windows XP / w22n51][Stopped/Manual Start]
  <system32\DRIVERS\w22n51.sys><Intel? Corporation>
[winachsf / winachsf][Running/Manual Start]
  <system32\DRIVERS\HSF_CNXT.sys><Conexant Systems, Inc.>

==================================
Browser Add-ons
[HelperObject Class]
  {00C6482D-C502-44C8-8409-FCE54AD9C208} <C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll, TechSmith Corporation>
[AcroIEHlprObj Class]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[SSVHelper Class]
  {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} <C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll, Sun Microsystems, Inc.>
[Java Plug-in]
  {08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll, Sun Microsystems, Inc.>
[CibaCtrl Class]
  {8DE0FCD4-5EB5-11D3-AD25-00002100131B} <C:\PROGRA~1\Kingsoft\XDict\IEPlugin.dll, >
[&Research]
  {92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[JoyoCtrl Class]
  {C8CE29C5-7589-11D3-B81B-0080C8DC5DC8} <C:\PROGRA~1\Kingsoft\XDict\IEPlugin.dll, >
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\USERS\tencent\QQ.EXE, TENCENT>
[SnagIt]
  {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} <C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll, TechSmith Corporation>
[PjtICAHelper.ICAHelper]
  {492BB930-5C14-4DD4-BE4D-F166C12A141C} <C:\WINNT\Downloaded Program Files\ICAHelper.ocx, Citrix Consulting Services>
[Java Plug-in]
  {8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll, Sun Microsystems, Inc.>
[Tencent Safety Online Base Module]
  {C09B522F-8AED-4E21-A65C-DC1AB652BAEE} <C:\WINNT\DOWNLO~1\TSOBase.ocx, Tencent Corporation>
[Java Plug-in]
  {CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll, Sun Microsystems, Inc.>
[Java Plug-in]
  {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.5.0_06]
  {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll, Sun Microsystems, Inc.>
[Rising Web Scan Object]
  {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINNT\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.>
[CPasswordEditCtrl Object]
  {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINNT\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
[HelperObject Class]
  {00C6482D-C502-44C8-8409-FCE54AD9C208} <C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll, TechSmith Corporation>
[ActiveMovieControl Object]
  {05589FA1-C356-11CE-BF01-00AA0055595A} <C:\WINNT\system32\wmpdxm.dll, Microsoft Corporation>
[AcroIEHlprObj Class]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[Web Browser Applet Control]
  {08B0E5C0-4FCB-11CF-AAA5-00401C608501} <, N/A>
[Microsoft Hierarchical FlexGrid Control6.0 (SP4) (OLEDB)]
  {0ECD9B64-23AA-11D0-B351-00A0C9055D8E} <C:\WINNT\system32\mshflxgd.ocx, Microsoft Corporation>
[Windows Media Player]
  {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINNT\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
  {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[Microsoft Chart Control 6.0 (SP4) (OLEDB)]
  {3A2B370C-BA0A-11D1-B137-0000F8753F5D} <C:\WINNT\system32\mschrt20.ocx, Microsoft Corporation>
[PjtICAHelper.ICAHelper]
  {492BB930-5C14-4DD4-BE4D-F166C12A141C} <C:\WINNT\Downloaded Program Files\ICAHelper.ocx, Citrix Consulting Services>
[Microsoft Licensed Class Manager 1.0]
  {5220CB21-C88D-11CF-B347-00AA00A28331} <C:\WINNT\system32\licmgr10.dll, Microsoft Corporation>
[HHCtrl Object]
  {52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINNT\system32\HHCTRL.OCX, Microsoft Corporation>
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINNT\system32\wmp.dll, Microsoft Corporation>
[SSVHelper Class]
  {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} <C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll, Sun Microsystems, Inc.>
[Microsoft Web Browser]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINNT\system32\shdocvw.dll, Microsoft Corporation>
[CibaCtrl Class]
  {8DE0FCD4-5EB5-11D3-AD25-00002100131B} <C:\PROGRA~1\Kingsoft\XDict\IEPlugin.dll, >
[SnagIt]
  {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} <C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll, TechSmith Corporation>
[SearchAssistantOC]
  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
  {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[JoyoCtrl Class]
  {C8CE29C5-7589-11D3-B81B-0080C8DC5DC8} <C:\PROGRA~1\Kingsoft\XDict\IEPlugin.dll, >
[Rising Web Scan Object]
  {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINNT\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.>
[CPasswordEditCtrl Object]
  {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINNT\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
[E&xport to Microsoft Excel]
  <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[上传到QQ网络硬盘]
  <C:\USERS\tencent\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
  <C:\USERS\tencent\AddPanel.htm, N/A>
[添加到QQ表情]
  <C:\USERS\tencent\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <C:\USERS\tencent\SendMMS.htm, N/A>

==================================
Running Processes
[PID: 732][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 804][\??\C:\WINNT\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 840][\??\C:\WINNT\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINNT\system32\cahooknt.dll]  [InfoExpress, 3.0.40520]
    [C:\WINNT\system32\pssogina.dll]  [Pointsec Mobile Technologies AB, 5.2.2]
    [C:\WINNT\system32\vrlogon.dll]  [UPEK Inc., 4.5.3.167]
    [C:\Program Files\IBM fingerprint software\ExtVapi.dll]  [UPEK Inc., 4.5.3.167]
    [C:\Program Files\Common Files\Virtual Token\psutil.dll]  [UPEK Inc., 4.5.3.167]
    [C:\Program Files\Common Files\Virtual Token\resmgr.dll]  [UPEK Inc., 4.5.3.167]
    [C:\Program Files\Common Files\Virtual Token\Remote.dll]  [UPEK Inc., 4.5.3.167]
    [C:\Program Files\Common Files\Virtual Token\passport.dll]  [UPEK Inc., 4.5.3.167]
    [C:\Program Files\Common Files\Virtual Token\psdlg.dll]  [UPEK Inc., 4.5.3.167]
    [C:\WINNT\system32\Ati2evxx.dll]  [ATI Technologies Inc., 6.14.10.4149]
    [C:\Program Files\IBM fingerprint software\psfus.dll]  [UPEK Inc., 4.5.3.167]
    [C:\WINNT\system32\tphklock.dll]  [N/A, N/A]
    [C:\Program Files\Mobiliti\Unplugged\BIN\MNUNETU.DLL]  [Mobiliti, Inc., 4, 7, 0, 20 ]
    [C:\Program Files\Mobiliti\Unplugged\BIN\RSSU.DLL]  [Mobiliti, Inc., 4, 7, 0, 20 ]
    [C:\WINNT\system32\PssoCM32.dll]  [Pointsec Mobile Technologies AB, 5.2.2]
    [C:\WINNT\system32\ckpNotify.dll]  [Check Point Software Technologies, 59,8,0010,19]
    [c:\WINNT\system32\LgNotify.dll]  [Intel Corporation, 8, 1, 0, 47_ITP]
    [C:\WINNT\system32\NavLogon.dll]  [Symantec Corporation, 10.1.4.4010]
    [C:\Program Files\Common Files\Virtual Token\BGTcVer.dll]  [UPEK Inc., 4.5.3.167]
    [C:\Program Files\Common Files\Virtual Token\BTcVer.dll]  [UPEK Inc., 4.5.3.167]
[PID: 884][C:\WINNT\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINNT\system32\cahooknt.dll]  [InfoExpress, 3.0.40520]
[PID: 896][C:\WINNT\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINNT\system32\cahooknt.dll]  [InfoExpress, 3.0.40520]
    [C:\WINNT\system32\TivoliAP.dll]  [IBM Corporation, 1.27.1.0]
[PID: 1080][C:\Program Files\Common Files\Virtual Token\vtserver.exe]  [UPEK Inc., 4.5.3.167]
    [C:\Program Files\Common Files\Virtual Token\psutil.dll]  [UPEK Inc., 4.5.3.167]
    [C:\Program Files\IBM fingerprint software\psfus.dll]  [UPEK Inc., 4.5.3.167]
    [C:\Program Files\Common Files\Virtual Token\passport.dll]  [UPEK Inc., 4.5.3.167]
    [C:\Program Files\Common Files\Virtual Token\DevTc.dll]  [UPEK Inc., 4.5.3.167]
    [C:\Program Files\Common Files\Virtual Token\BTcVer.dll]  [UPEK Inc., 4.5.3.167]
    [C:\Program Files\Common Files\Virtual Token\Remote.dll]  [UPEK Inc., 4.5.3.167]
    [C:\Program Files\Common Files\Virtual Token\LocPass.dll]  [UPEK Inc., 4.5.3.167]
    [C:\Program Files\Common Files\Virtual Token\AlgVer.dll]  [UPEK Inc., 4.5.3.167]
    [C:\Program Files\Common Files\Virtual Token\resmgr.dll]  [UPEK Inc., 4.5.3.167]
    [C:\Program Files\Common Files\Virtual Token\psdlg.dll]  [UPEK Inc., 4.5.3.167]
[PID: 1100][C:\WINNT\system32\ibmpmsvc.exe]  [N/A, N/A]
[PID: 1204][C:\WINNT\system32\Ati2evxx.exe]  [ATI Technologies Inc., 6.14.10.4149]
    [C:\WINNT\system32\Ati2edxx.dll]  [ATI Technologies, Inc., 6, 14, 10, 2508]
    [C:\WINNT\system32\atipdlxx.dll]  [ATI Technologies, Inc., 6, 14, 10, 2513]
[PID: 1224][C:\WINNT\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINNT\system32\cahooknt.dll]  [InfoExpress, 3.0.40520]
[PID: 1296][C:\WINNT\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINNT\system32\cahooknt.dll]  [InfoExpress, 3.0.40520]
[PID: 1440][C:\WINNT\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINNT\System32\cahooknt.dll]  [InfoExpress, 3.0.40520]
    [C:\Apps\oracle\ora92\bin\oci.dll]  [Oracle Corporation, 9.2.0.1.0]
[PID: 1568][C:\WINNT\system32\S24EvMon.exe]  [Intel Corporation , 8, 1, 0, 47_ITP]
[PID: 1592][C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe]  [Check Point Software Technologies, 1, 0, 0, 1]
    [C:\Program Files\CheckPoint\SecuRemote\bin\OS.dll]  [Check Point Software Technologies, 59,8,000,026]
    [C:\Program Files\CheckPoint\SecuRemote\bin\FileHash_DYN.dll]  [Check Point Software Technologies, 59,8,0010,05]
    [C:\Program Files\CheckPoint\SecuRemote\bin\cpbcrypt.dll]  [Check Point Software Technologies, 59,8,000,013]
    [C:\Program Files\CheckPoint\SecuRemote\bin\DataStruct.dll]  [Check Point Software Technologies, 59,8,000,026]
    [C:\Program Files\CheckPoint\SecuRemote\bin\RunAs.dll]  [Check Point Software Technologies, 59,8,0010,05]
    [C:\Program Files\CheckPoint\SecuRemote\bin\CPDtRegSvr.dll]  [Check Point Software Technologies, 59,8,0010,19]
    [C:\Program Files\CheckPoint\SecuRemote\bin\cpprod50.dll]  [Check Point Software Technologies, 54,8,2000,05]
    [C:\Program Files\CheckPoint\SecuRemote\bin\addreg.dll]  [Check Point Software Technologies, 59,8,0010,19]
    [C:\Program Files\CheckPoint\SecuRemote\bin\dtplat.dll]  [Check Point Software Technologies, 59,8,0010,19]
    [C:\Program Files\CheckPoint\SecuRemote\bin\dtrtm.dll]  [Check Point Software Technologies, 59,8,0010,05]
    [C:\Program Files\CheckPoint\SecuRemote\bin\cpfwsys.dll]  [Check Point Software Technologies, 54,8,2000,26]
    [C:\Program Files\CheckPoint\SecuRemote\bin\cpsys.dll]  [Check Point Software Technologies, 54,8,2000,26]
    [C:\Program Files\CheckPoint\SecuRemote\bin\cvars.dll]  [Check Point Software Technologies, 54,8,2000,03]
    [C:\Program Files\CheckPoint\SecuRemote\bin\cpopenssl.dll]  [Check Point Software Technologies, 54,8,2000,06]
    [C:\Program Files\CheckPoint\SecuRemote\bin\ComUtils.dll]  [Check Point Software Technologies, 59,8,000,026]
    [C:\Program Files\CheckPoint\SecuRemote\bin\Resolve.dll]  [Check Point Software Technologies, 59,8,000,026]
    [C:\Program Files\CheckPoint\SecuRemote\bin\mastersapi.dll]  [Check Point Software Technologies, 54,8,2000,06]
    [C:\Program Files\CheckPoint\SecuRemote\bin\fwsmtpobj.dll]  [Check Point Software Technologies, 54,8,2000,06]
    [C:\Program Files\CheckPoint\SecuRemote\bin\objlib.dll]  [Check Point Software Technologies, 54,8,2000,06]
    [C:\Program Files\CheckPoint\SecuRemote\bin\CPSrvIS.dll]  [Check Point Software Technologies, 54,8,2000,03]
    [C:\Program Files\CheckPoint\SecuRemote\bin\cpcert.dll]  [Check Point Software Technologies, 59,8,000,013]
    [C:\Program Files\CheckPoint\SecuRemote\bin\Encode.dll]  [Check Point Software Technologies, 59,8,000,026]
    [C:\Program Files\CheckPoint\SecuRemote\bin\cpprng.dll]  [Check Point Software Technologies, 59,8,000,013]
    [C:\Program Files\CheckPoint\SecuRemote\bin\cpcryptutil.dll]  [Check Point Software Technologies, 59,8,000,013]
    [C:\Program Files\CheckPoint\SecuRemote\bin\ndb.dll]  [Check Point Software Technologies, 54,8,2000,03]
    [C:\Program Files\CheckPoint\SecuRemote\bin\AppUtils.dll]  [Check Point Software Technologies, 59,8,000,026]
    [C:\Program Files\CheckPoint\SecuRemote\bin\EventUtils.dll]  [Check Point Software Technologies, 59,8,000,026]
    [C:\Program Files\CheckPoint\SecuRemote\bin\fwadb.dll]  [Check Point Software Technologies, 54,8,2000,06]
    [C:\Program Files\CheckPoint\SecuRemote\bin\skey.dll]  [Check Point Software Technologies, 54,8,2000,06]
    [C:\Program Files\CheckPoint\SecuRemote\bin\fwsetdb.dll]  [Check Point Software Technologies, 54,8,2000,03]
    [C:\Program Files\CheckPoint\SecuRemote\bin\userc.dll]  [Check Point Software Technologies, 59,8,0010,05]
    [C:\Program Files\CheckPoint\SecuRemote\bin\sic.dll]  [Check Point Software Technologies, 54,8,2000,03]
    [C:\Program Files\CheckPoint\SecuRemote\bin\cp_policy.dll]  [Check Point Software Technologies, 54,8,2000,03]
    [C:\Program Files\CheckPoint\SecuRemote\bin\sicauth.dll]  [Check Point Software Technologies, 54,8,2000,03]
    [C:\Program Files\CheckPoint\SecuRemote\bin\cpca.dll]  [Check Point Software Technologies, 59,8,000,013]
    [C:\Program Files\CheckPoint\SecuRemote\bin\ckpssl.dll]  [Check Point Software Technologies, 59,8,000,013]
    [C:\Program Files\CheckPoint\SecuRemote\bin\FwBinding.dll]  [Check Point Software Technologies, 59,8,0010,05]
    [C:\Program Files\CheckPoint\SecuRemote\bin\cpii.dll]  [Check Point Software Technologies, 54,8,2000,26]
    [C:\Program Files\CheckPoint\SecuRemote\bin\CP_version_info.dll]  [Check Point Software Technologies, 59,8,000,026]
    [C:\Program Files\CheckPoint\SecuRemote\bin\dt_ie_proxy.dll]  [Check Point Software Technologies, 59,8,0010,05]
    [C:\Program Files\CheckPoint\SecuRemote\bin\VPN.DLL]  [Check Point Software Technologies, 59,8,0010,19]
    [C:\Program Files\CheckPoint\SecuRemote\bin\scvprod_lang_pack.dll]  [Check Point Software Technologies, 59,8,0010,04]
    [C:\Program Files\CheckPoint\SecuRemote\bin\LangPack.dll]  [Check Point Software Technologies, 59,8,0010,19]
    [C:\Program Files\CheckPoint\SecuRemote\bin\dtis_lang_pack.dll]  [Check Point Software Technologies, 59,8,0010,05]
    [C:\Program Files\CheckPoint\SecuRemote\bin\DBObjects.dll]  [Check Point Software Technologies, 59,8,0010,19]
    [C:\Program Files\CheckPoint\SecuRemote\bin\GuiServiceInterface.dll]  [Check Point Software Technologies, 59,8,0010,19]
    [C:\Program Files\CheckPoint\SecuRemote\bin\srcert.dll]  [Check Point Software Technologies, 59,8,0010,05]
    [C:\Program Files\CheckPoint\SecuRemote\bin\clientProviders.dll]  [Check Point Software Technologies, 59,8,000,013]
    [C:\Program Files\CheckPoint\SecuRemote\bin\p12Prov.dll]  [Check Point Software Technologies, 59,8,000,013]
    [C:\Program Files\CheckPoint\SecuRemote\bin\p11Prov.dll]  [Check Point Software Technologies, 59,8,000,013]
    [C:\Program Files\CheckPoint\SecuRemote\bin\capiProv.dll]  [Check Point Software Technologies, 59,8,000,013]
    [C:\Program Files\CheckPoint\SecuRemote\bin\entProv.dll]  [Check Point Software Technologies, 59,8,000,013]
    [C:\Program Files\CheckPoint\SecuRemote\bin\keydb_usersr.dll]  [Check Point Software Technologies, 59,8,0010,00]
    [C:\Program Files\CheckPoint\SecuRemote\bin\cpsic.dll]  [Check Point Software Technologies, 54,8,2000,03]
    [C:\Program Files\CheckPoint\SecuRemote\bin\messaging.dll]  [Check Point Software Technologies, 54,8,2000,03]
    [C:\Program Files\CheckPoint\SecuRemote\bin\sicobj.dll]  [Check Point Software Technologies, 54,8,2000,06]
    [C:\Program Files\CheckPoint\SecuRemote\bin\cpauth.dll]  [Check Point Software Technologies, 54,8,2000,26]
    [C:\Program Files\CheckPoint\SecuRemote\bin\Resolver.dll]  [Check Point Software Technologies, 59,8,000,026]
    [C:\Program Files\CheckPoint\SecuRemote\bin\bind82.dll]  [N/A, N/A]