[CODE]

2007-05-19,13:16:40

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
    <BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}><; "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe">  [Nero AG]
    <bgswitch><; C:\WINDOWS\system32\bgswitch.exe>  []
    <H/PC Connection Agent><; "C:\Program Files\Microsoft ActiveSync\wcescomm.exe">  [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
    <run><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Publisher]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Publisher]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows Publisher]
    <ShellVoip><>  [N/A]
    <Cmaudio><; RunDll32 cmicnfg.cpl,CMICtrlWnd>  [N/A]
    <DAEMON Tools-2052><; "C:\Program Files\D-Tools\daemon.exe"  -lang 2052>  [DAEMON'S HOME]
    <NeroFilterCheck><; C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe>  [Nero AG]
    <NexusServer><; "C:\Program Files\Common Files\Canopus Shared\ProCoder 2\Kernel\PNXSERVR.exe" -SelfLaunch>  []
    <NvCplDaemon><; RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>  [(Verified)Microsoft Windows Publisher]
    <NvMediaCenter><; RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <nwiz><; nwiz.exe /install>  [N/A]
    <QuickTime Task><; "C:\Program Files\Ringz Studio\Storm Codec\qttask.exe" -atboottime>  [Apple Computer, Inc.]
    <SOUNDM><; win32smd.exe>  [N/A]
    <StormCodec_Helper><; "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    <KKDelay><C:\Program Files\Rising\KakaToolBar\RunOnce.exe>  [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe asp.exe>  []
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
    <WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll>  [Kaspersky Lab]

==================================
启动文件夹
N/A

==================================
服务
[107B4A8 / 107B4A8][Stopped/Auto Start]
  <C:\WINDOWS\system32\82C57C40.EXE -g><N/A>
[Adobe LM Service / Adobe LM Service][Stopped/Disabled]
  <"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>
[卡巴斯基互联网安全套装 6.0 / AVP][Stopped/Manual Start]
  <"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r><Kaspersky Lab>
[NetMeeting Remote Desktop Sharing / mnmsrvc][Stopped/Disabled]
  <><N/A>
[NVIDIA Display Driver Service / NVSvc][Stopped/Disabled]
  <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[Portable Equipment Service / Relations][Running/Auto Start]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\ekkgr.dll><Microsoft Corporation>

==================================
驱动程序
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Stopped/Manual Start]
  <system32\drivers\ac97intc.sys><Intel Corporation>
[athena / athena][Running/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\athena.sys><Microsoft Corporation>
[AVG Anti-Spyware Clean Driver / AvgAsCln][Running/System Start]
  <System32\DRIVERS\AvgAsCln.sys><GRISOFT, s.r.o.>
[cdrblock / cdrblock][Running/System Start]
  <system32\DRIVERS\cdrblock.sys><Canopus Co,. Ltd.>
[cdrport / cdrport][Running/System Start]
  <system32\DRIVERS\cdrport.sys><Canopus Co,. Ltd.>
[C-Media WDM Audio Interface / cmuda][Running/Manual Start]
  <system32\drivers\cmuda.sys><C-Media Inc>
[d347bus / d347bus][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\d347bus.sys><>
[d347prt / d347prt][Running/Boot Start]
  <\SystemRoot\System32\Drivers\d347prt.sys><>
[darycq2 / darycq22][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\darycq22.sys><N/A>
[Sundance ST201 based Adapter NT Driver / DLH5X][Running/Manual Start]
  <system32\DRIVERS\DLH5XND5.sys><D-Link Corporation>
[efgpzf0 / efgpzf03][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\efgpzf03.sys><N/A>
[ElbyCDFL / ElbyCDFL][Running/Manual Start]
  <System32\Drivers\ElbyCDFL.sys><SlySoft, Inc.>
[ElbyCDIO Driver / ElbyCDIO][Running/Auto Start]
  <System32\Drivers\ElbyCDIO.sys><Elaborate Bytes AG>
[fvwelk8 / fvwelk81][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\fvwelk81.sys><N/A>
[gacdjadg / gacdjadg][Stopped/Boot Start]
  <\SystemRoot\system32\drivers\gacdjadg.sys><N/A>
[Hardlock / Hardlock][Running/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\hardlock.sys><Aladdin Knowledge Systems Ltd.>
[Haspnt / Haspnt][Running/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\Haspnt.sys><Aladdin Knowledge Systems>
[kl1 / kl1][Running/Boot Start]
  <\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif][Running/System Start]
  <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[mlxgsw1 / mlxgsw17][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\mlxgsw17.sys><N/A>
[mrdjtz47 / mrdjtz47][Stopped/Boot Start]
  <\SystemRoot\system32\\drivers\\system32\\drivers\\%s.sys.sys><N/A>
[NetGroup Packet Filter Driver / Npf][Running/Auto Start]
  <system32\drivers\npf.sys><CACE Technologies>
[npkcrypt / npkcrypt][Running/Auto Start]
  <\??\C:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[nv / nv][Running/Manual Start]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[ofyrez8 / ofyrez81][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\ofyrez81.sys><N/A>
[Padus ASPI Shell / pfc][Running/Manual Start]
  <system32\drivers\pfc.sys><Padus, Inc.>
[predn / prednn][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\prednn.sys><N/A>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[PxHelp20 / PxHelp20][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\PxHelp20.sys><Sonic Solutions>
[qbvw / qbvwk][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\qbvwk.sys><N/A>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
  <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[shiji / shiji][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\wincab.sys><N/A>
[Sony USB Filter Driver (SONYPVU1) / SONYPVU1][Stopped/Manual Start]
  <system32\DRIVERS\SONYPVU1.SYS><Sony Corporation>
[TSP / TSP][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[vbmcrd / vbmcrd][Running/Boot Start]
  <\SystemRoot\system32\drivers\vbmcrd.sys><N/A>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
  <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[USB PC Camera 301P / ZSMC301b][Stopped/Manual Start]
  <System32\Drivers\usbVM31b.sys><VM>

==================================
浏览器加载项
[]
  {238f4c78-21fe-4ae9-ae2b-1b294ae19f4f} <C:\WINDOWS\system32\4ae9ntos.dll, N/A>
[21fe]
  {DFCB34B6-902D-426E-AE2B-1B294AE19F4F} <C:\WINDOWS\system32\4ae9ntos.dll, N/A>
[iTrusPTA Class]
  {1E0DFFCF-27FF-4574-849B-55007349FEDA} <C:\WINDOWS\system32\aliedit\pta.dll, >
[EditCtrl Class]
  {488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\system32\aliedit\aliedit.dll, >
[AxInputControl Class]
  {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL, >
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>
[KvScanOnline Control]
  {EF6205C1-3F17-4829-BCB5-1336ED89E356} <C:\WINDOWS\system32\KvDown.ocx, dreamersoft>
[iTrusPTA Class]
  {1E0DFFCF-27FF-4574-849B-55007349FEDA} <C:\WINDOWS\system32\aliedit\pta.dll, >
[]
  {238F4C78-21FE-4AE9-AE2B-1B294AE19F4F} <C:\WINDOWS\system32\4ae9ntos.dll, N/A>
[EditCtrl Class]
  {488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\system32\aliedit\aliedit.dll, >
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[WangWangObj Class]
  {6E213FC7-DD5A-4115-B7E6-D4C7838C361E} <C:\Program Files\淘宝网\淘宝旺旺\WangWangX4.dll, 阿里软件（中国）有限公司>
[AxInputControl Class]
  {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL, >
[RDS.DataSpace]
  {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>
[21fe]
  {DFCB34B6-902D-426E-AE2B-1B294AE19F4F} <C:\WINDOWS\system32\4ae9ntos.dll, N/A>
[&使用迅雷下载]
  <C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
  <C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
[上传到QQ网络硬盘]
  <C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
  <C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 564][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 652][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1516][C:\WINDOWS\Explorer.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\ie.DLL]  [N/A, ]
    [C:\WINDOWS\system32\vxxcq.dll]  [N/A, ]
    [C:\WINDOWS\system32\prednn.dll]  [N/A, ]
    [C:\WINDOWS\system32\javascript.dll]  [, 1.1.1.245]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll]  [Kaspersky Lab, 1.0.6.299]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll]  [Kaspersky Lab, 6.0.0.299]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll]  [Kaspersky Lab, 6.0.0.299]
    [c:\windows\system32\ekkgr.dll]  [Microsoft Corporation, 5.1.2600.0]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\shellex.dll]  [Kaspersky Lab, 6.0.0.299]
    [C:\Program Files\GlobalSCAPE\CuteFTP ZH\Cuteshell.dll]  [GlobalSCAPE, Inc., 50, 6, 3, 2]
    [C:\Program Files\Common Files\Ahead\lib\MediaLibraryNSE.dll]  [Nero AG, 1, 0, 2, 12]
    [C:\Program Files\Common Files\Ahead\lib\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\Program Files\Common Files\Ahead\lib\MFC71U.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\Program Files\Common Files\Ahead\lib\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\MFC71CHS.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\PROGRA~1\MICROS~2\Wcesview.dll]  [Microsoft Corporation, 4.1.4841.0]
    [C:\PROGRA~1\MICROS~2\pegconv.dll]  [Microsoft Corporation, 4.1.4841.0]
    [C:\WINDOWS\system32\CEUTIL.dll]  [Microsoft Corporation, 4.1.4841.0]
    [C:\WINDOWS\system32\RAPI.dll]  [Microsoft Corporation, 4.1.4841.0]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll]  [Kaspersky Lab, 6.0.0.299]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl]  [Kaspersky Lab, 6.0.0.304]
    [c:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl]  [Kaspersky Lab, 6.0.0.299]
    [c:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl]  [Kaspersky Lab, 6.0.0.299]
    [c:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl]  [Kaspersky Lab, 6.0.0.299]
    [C:\WINDOWS\system32\nvcpl.dll]  [NVIDIA Corporation, 6.14.10.8198]
[PID: 1700][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\ie.DLL]  [N/A, ]
[PID: 1792][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\ie.DLL]  [N/A, ]
[PID: 4092][E:\下载文件汇总\sreng2\SRE.EXE]  [Smallfrogs Studio, 2.4.12.806]
    [C:\WINDOWS\system32\ie.DLL]  [N/A, ]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
    [E:\下载文件汇总\sreng2\Plugins\NWMON.SRE]  [Smallfrogs Studio, 1, 0, 0, 8]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
N/A

==================================
API HOOK
RVA  错误： LoadLibraryA (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xF582FB25)
RVA  错误： LoadLibraryExA (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xF582FD67)
RVA  错误： LoadLibraryExW (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xF582FF0B)
RVA  错误： LoadLibraryW (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xF582FC49)
RVA  错误： GetProcAddress (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0xF582FE8F)

==================================
隐藏进程
N/A

==================================


[/CODE]

还有个冰刃的解图

以下启动项有问题
<shell><Explorer.exe asp.exe> []删除后面那个asp.exe
<SOUNDM><; win32smd.exe> [N/A]删除
删除以下服务
[107B4A8 / 107B4A8][Stopped/Auto Start]
<C:\WINDOWS\system32\82C57C40.EXE -g><N/A>
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\ekkgr.dll><Microsoft Corporation>
删除以下驱动
[efgpzf0 / efgpzf03][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\efgpzf03.sys><N/A>
[fvwelk8 / fvwelk81][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\fvwelk81.sys><N/A>
[gacdjadg / gacdjadg][Stopped/Boot Start]
<\SystemRoot\system32\drivers\gacdjadg.sys><N/A>
[mlxgsw1 / mlxgsw17][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\mlxgsw17.sys><N/A>
[mrdjtz47 / mrdjtz47][Stopped/Boot Start]
<\SystemRoot\system32\\drivers\\system32\\drivers\\%s.sys.sys><N/A>
[ofyrez8 / ofyrez81][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\ofyrez81.sys><N/A>
[predn / prednn][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\prednn.sys><N/A>
[qbvw / qbvwk][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\qbvwk.sys><N/A>
[shiji / shiji][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\wincab.sys><N/A>
[vbmcrd / vbmcrd][Running/Boot Start]
<\SystemRoot\system32\drivers\vbmcrd.sys><N/A>
进程中调用的以下文件可疑，重启后删除
[C:\WINDOWS\system32\ie.DLL] [N/A, ]
[C:\WINDOWS\system32\vxxcq.dll] [N/A, ]
[C:\WINDOWS\system32\prednn.dll] [N/A, ]
[c:\windows\system32\ekkgr.dll] [Microsoft Corporation, 5.1.2600.0]

以下启动项有问题
<shell><Explorer.exe asp.exe> []删除后面那个asp.exe  该项禁止修改
<SOUNDM><; win32smd.exe> [N/A]删除  未找到
删除以下服务
[107B4A8 / 107B4A8][Stopped/Auto Start]
<C:\WINDOWS\system32\82C57C40.EXE -g><N/A>
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\ekkgr.dll><Microsoft Corporation>   
删除以下驱动
[efgpzf0 / efgpzf03][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\efgpzf03.sys><N/A>
[fvwelk8 / fvwelk81][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\fvwelk81.sys><N/A>
[gacdjadg / gacdjadg][Stopped/Boot Start]
<\SystemRoot\system32\drivers\gacdjadg.sys><N/A>
[mlxgsw1 / mlxgsw17][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\mlxgsw17.sys><N/A>
[mrdjtz47 / mrdjtz47][Stopped/Boot Start]
<\SystemRoot\system32\\drivers\\system32\\drivers\\%s.sys.sys><N/A>
[ofyrez8 / ofyrez81][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\ofyrez81.sys><N/A>
[predn / prednn][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\prednn.sys><N/A>
[qbvw / qbvwk][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\qbvwk.sys><N/A>
[shiji / shiji][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\wincab.sys><N/A>
[vbmcrd / vbmcrd][Running/Boot Start]
<\SystemRoot\system32\drivers\vbmcrd.sys><N/A>
进程中调用的以下文件可疑，重启后删除
[C:\WINDOWS\system32\ie.DLL] [N/A, ]
[C:\WINDOWS\system32\vxxcq.dll] [N/A, ]
[C:\WINDOWS\system32\prednn.dll] [N/A, ]
[c:\windows\system32\ekkgr.dll] [Microsoft Corporation, 5.1.2600.0]


上边提到的driver下的*.sys，在打开系统所有隐藏文件前提下，找不到。

用冰刃也找不到么？那就算了，把驱动删掉。
然后重新启动，再扫一份看看。自己对照着看