瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 【求助】系统状况异常，求高手诊断，注册表扫描结果已补充在第9楼

12   1  /  2  页   跳转页

【求助】系统状况异常，求高手诊断，注册表扫描结果已补充在第9楼

收藏
ccoccocco
头像
快乐黄口狮
  • 帖子:150
  • 注册: 2006-08-01
  • 来自:
发表于： 2007-08-19 17:04 | 显示全部 短消息 资料
字号： 小 中 大 1楼

【求助】系统状况异常，求高手诊断，注册表扫描结果已补充在第9楼

这两天我笔记本的速度突然变慢，怀疑病毒所致，也可能是使用迅雷下bt的缘故，比较迷茫，由于听说磁盘碎片清理会伤机器，所以没用过，拿windows优化大师代替，可能也有关系。。。高人给诊断下。。。

扫描结果：

[CODE]

2007-08-19,16:41:57

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
N/A

==================================
启动文件夹
N/A

==================================
服务
[本地信道 / ASChannel][Running/Auto Start]
  <C:\WINDOWS\System32\svchost.exe -k Cognizance-->C:\Program Files\HPQ\IAM\Bin\ASChnl.dll><Cognizance Corporation>
[Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start]
  <C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[hpqwmiex / hpqwmiex][Running/Auto Start]
  <C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe><Hewlett-Packard Development Company, L.P.>
[InstallDriver Table Manager / IDriverT][Stopped/Manual Start]
  <"C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe"><Macrovision Corporation>
[Chinese Paladin 4 CN Drivers Auto Removal (pr2ach4f) / pr2ach4f][Stopped/Auto Start]
  <C:\WINDOWS\system32\pr2ach4f.exe svc><SOFTSTAR>
[Rising Proxy  Service / RfwProxySrv][Stopped/Manual Start]
  <d:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService][Running/Auto Start]
  <d:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
  <"D:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
  <"D:\PROGRAM FILES\RISING\RAV\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>

==================================
驱动程序
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Stopped/Manual Start]
  <system32\drivers\ac97intc.sys><Intel Corporation>
[ADI UAA Function Driver for High Definition Audio Service / ADIHdAudAddService][Running/Manual Start]
  <system32\drivers\ADIHdAud.sys><Analog Devices, Inc.>
[AEAudio Service / AEAudioService][Running/Manual Start]
  <system32\drivers\AEAudio.sys><Andrea Electronics Corporation>
[AliIde / AliIde][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\aliide.sys><Acer Laboratories Inc.>
[AMD K8 Processor Driver / AmdK8][Stopped/Manual Start]
  <System32\DRIVERS\amdk8.sys><Advanced Micro Devices>
[ati2mtag / ati2mtag][Running/Manual Start]
  <system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[AuthenTec TruePrint USB Driver (AES2500) / ATSWPDRV][Running/Manual Start]
  <system32\DRIVERS\ATSwpDrv.sys><AuthenTec, Inc.>
[Broadcom NetLink (TM) Gigabit Ethernet / b57w2k][Running/Manual Start]
  <system32\DRIVERS\b57xp32.sys><Broadcom Corporation>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
  <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[Broadcom 802.11 网络适配器驱动程序 / BCM43XX][Running/Manual Start]
  <system32\DRIVERS\bcmwl5.sys><Broadcom Corporation>
[CmdIde / CmdIde][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\cmdide.sys><CMD Technology, Inc.>
[CnsMinKP / CnsMinKP][Running/Boot Start]
  <\SystemRoot\system32\drivers\CnsMinKP.sys><Copyright (C) 3721 Corporation.>
[eabfiltr / eabfiltr][Running/System Start]
  <system32\DRIVERS\eabfiltr.sys><Hewlett-Packard Development Company, L.P.>
[eabusb / eabusb][Stopped/Manual Start]
  <system32\DRIVERS\eabusb.sys><Hewlett-Packard Development Company, L.P.>
[ExpScaner / ExpScaner][Running/Auto Start]
  <\??\D:\PROGRAM FILES\RISING\RAV\ExpScan.sys><>
[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Stopped/Manual Start]
  <system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
[HBtnKey / HBtnKey][Running/Manual Start]
  <system32\DRIVERS\cpqbttn.sys><Hewlett-Packard Development Company, L.P.>
[Microsoft 用于 High Definition Audio 的 UAA 总线驱动程序 / HDAudBus][Running/Manual Start]
  <system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
[HookCont / HookCont][Running/Auto Start]
  <\??\D:\PROGRAM FILES\RISING\RAV\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
  <\??\D:\PROGRAM FILES\RISING\RAV\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
  <\??\D:\PROGRAM FILES\RISING\RAV\HookSys.sys><Rising>
[HookUrl / HookUrl][Running/Auto Start]
  <\??\D:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[HSFHWAZL / HSFHWAZL][Running/Manual Start]
  <system32\DRIVERS\HSFHWAZL.sys><Conexant Systems, Inc.>
[HSF_DPV / HSF_DPV][Running/Manual Start]
  <system32\DRIVERS\HSF_DPV.sys><Conexant Systems, Inc.>
[kdsjjbo / kdsjjbo][Running/Boot Start]
  <\SystemRoot\\SystemRoot\System32\drivers\kdsjjbo.sys><N/A>
[mdmxsdk / mdmxsdk][Running/Auto Start]
  <system32\DRIVERS\mdmxsdk.sys><Conexant>
[MEMSCAN / MEMSCAN][Running/Auto Start]
  <\??\D:\PROGRAM FILES\RISING\RAV\MEMSCAN.sys><Beijing Rising Technology Co., Ltd.>
[mProcRs / mProcRs][Running/Auto Start]
  <\??\D:\Program Files\Rising\Rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[npkcrypt / npkcrypt][Running/Auto Start]
  <\??\C:\Program Files\QQ2006\npkcrypt.sys><INCA Internet Co., Ltd.>
[nv / nv][Stopped/Manual Start]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Chinese Paladin 4 CN Environment Driver (pe3ach4f) / pe3ach4f][Running/Boot Start]
  <\SystemRoot\system32\drivers\pe3ach4f.sys><SOFTSTAR>
[Chinese Paladin 4 CN Synchronization Driver (ps6ach4f) / ps6ach4f][Running/Boot Start]
  <\SystemRoot\system32\drivers\ps6ach4f.sys><SOFTSTAR>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsFwDrv / RsFwDrv][Running/Auto Start]
  <\??\D:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
  <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
  <\??\D:\PROGRAM FILES\RISING\RAV\RSPPSYS.sys><Rising>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[StarForce Protection Environment Driver (version 1.x.a) / sfdrv01a][Running/Boot Start]
  <\SystemRoot\System32\drivers\sfdrv01a.sys><Protection Technology (StarForce)>
[StarForce Protection Helper Driver (version 2.x) / sfhlp02][Running/Boot Start]
  <\SystemRoot\System32\drivers\sfhlp02.sys><Protection Technology (StarForce)>
[StarForce Protection Synchronization Driver (version 4.x) / sfsync04][Running/Boot Start]
  <\SystemRoot\System32\drivers\sfsync04.sys><Protection Technology (StarForce)>
[sptd / sptd][Running/Boot Start]
  <\SystemRoot\System32\Drivers\sptd.sys><N/A>
[Synaptics TouchPad Driver / SynTP][Running/Manual Start]
  <system32\DRIVERS\SynTP.sys><Synaptics, Inc.>
[TCP/IP Protocol Driver / Tcpip][Running/System Start]
  <system32\DRIVERS\tcpip.sys><Microsoft Corporation>
[tifm21 / tifm21][Running/Manual Start]
  <system32\drivers\tifm21.sys><Texas Instruments>
[Conexant Setup API / UIUSys][Stopped/Manual Start]
  <system32\DRIVERS\UIUSYS.SYS><N/A>
[winachsf / winachsf][Running/Manual Start]
  <system32\DRIVERS\HSF_CNXT.sys><Conexant Systems, Inc.>
[R2A / R2A][Stopped/Disabled]
  <\??\C:\WINDOWS\system32a2.sys><N/A>
[WoptiGwiopm / WoptiGwiopm][Running/Manual Start]
  <\??\D:\Program Files\Wom\WoptiGwiopm.sys><Wopti>

[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
最后编辑2007-08-20 10:30:09
分享到：
gototop
 
ccoccocco
头像
快乐黄口狮
  • 帖子:150
  • 注册: 2006-08-01
  • 来自:
发表于： 2007-08-19 17:05 | 显示全部 短消息 资料
字号： 小 中 大 2楼


==================================
浏览器加载项
[WebThunder Browser Helper]
  {00000AAA-A363-466E-BEF5-9BB68697AA7F} <D:\Program Files\Thunder Network\WebThunder\WebThunderBHO_Now.dll, Thunder Networking Technologies,LTD>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>
[CnsHook Class]
  {D157330A-9EF3-49F8-9A67-4141AC41ADD4} <C:\WINDOWS\DOWNLO~1\CnsHook.dll, 北京三七二一科技有限公司>
[HP Credential Manager for ProtectTools]
  {DF21F1DB-80C6-11D3-9483-B03D0EC10000} <C:\Program Files\HPQ\IAM\Bin\ItIeAddIN.dll, Infineon Technologies AG>
[SrchHook Class]
  {F08555B0-9CC3-11D2-AA8E-000000000000} <C:\WINDOWS\system32\IEBHO.dll, N/A>
[Yahoo 3.5G电邮]
  {507F9113-CD77-4866-BA92-0E86DA3D0B97} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail, N/A>
[名品折扣]
  {59BC54A2-56B3-44a0-93E5-432D58746E26} <http://adtaobao.allyes.com/main/adfclick?db=adtaobao&bid=138,140,18&cid=816,8,1&sid=5042&show=ignore&url=http://www.taobao.com/vertical/mall/pro.php?allyesPara=816, N/A>
[雅虎助手]
  {5D73EE86-05F1-49ed-B850-E423120EC338} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist, N/A>
[雅虎WIDGET]
  {6354ABE6-05F1-49ed-B850-E423120EC338} <http://cn.widget.yahoo.com/index.htm?source=Cns, N/A>
[启动Web迅雷]
  {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} <http://my.xunlei.com, N/A>
[情景聊天]
  {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg, N/A>
[]
  {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair, N/A>
[]
  {FD00D911-7529-4084-9946-A29F1BDF4FE5} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean, N/A>
[IE搜索工具条]
  {BE830FD4-E393-417F-9F4B-CC70ABB3384C} <C:\WINDOWS\system32\IETool.dll, N/A>
[快捷搜索3.1]
  {11A0331C-BB1C-43BC-88B2-CA9F4ED2D64D} <C:\WINDOWS\system32\IETool.dll, N/A>
[金山毒霸在线产品升级]
  {E847C78C-C210-4195-8799-FBF3BF89797D} <C:\WINDOWS\system32\kingsoft\KOS\KOSInit.ocx, 金山软件股份有限公司>
[WebThunder Browser Helper]
  {00000AAA-A363-466E-BEF5-9BB68697AA7F} <D:\Program Files\Thunder Network\WebThunder\WebThunderBHO_Now.dll, Thunder Networking Technologies,LTD>
[WebThunder Class]
  {03507A1A-E0C5-4404-AA26-205385C0892D} <, N/A>
[快捷搜索3.1]
  {11A0331C-BB1C-43BC-88B2-CA9F4ED2D64D} <C:\WINDOWS\system32\IETool.dll, N/A>
[Windows Media Player]
  {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
  {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
  {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[Vod Class]
  {2EEDA47E-8D5C-4d7e-B4B6-E16E19218555} <D:\Program Files\Thunder Network\WebThunder\DownAndPlay\DapPlayer1.1.0.46.dll, XunLei>
[XML Document]
  {48123BC4-99D9-11D1-A6B3-00C04FD91555} <%SystemRoot%\system32\msxml3.dll, N/A>
[Shell Name Space]
  {55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[WUWebControl Class]
  {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AutoLive]
  {7CA83CF1-3AEA-42D0-A4E3-1594FC6E48B2} <C:\PROGRA~1\3721\autolive.dll, 国风因特软件（北京）有限公司>
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>
[SearchAssistantOC]
  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
  {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[IE搜索工具条]
  {BE830FD4-E393-417F-9F4B-CC70ABB3384C} <C:\WINDOWS\system32\IETool.dll, N/A>
[AUDIO__MP3 Moniker Class]
  {CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
  {CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
  {CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
  {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[CnsHook Class]
  {D157330A-9EF3-49F8-9A67-4141AC41ADD4} <C:\WINDOWS\DOWNLO~1\CnsHook.dll, 北京三七二一科技有限公司>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[HP Credential Manager for ProtectTools]
  {DF21F1DB-80C6-11D3-9483-B03D0EC10000} <C:\Program Files\HPQ\IAM\Bin\ItIeAddIN.dll, Infineon Technologies AG>
[金山毒霸在线产品升级]
  {E847C78C-C210-4195-8799-FBF3BF89797D} <C:\WINDOWS\system32\kingsoft\KOS\KOSInit.ocx, 金山软件股份有限公司>
[SrchHook Class]
  {F08555B0-9CC3-11D2-AA8E-000000000000} <C:\WINDOWS\system32\IEBHO.dll, N/A>
[使用Web迅雷下载]
  <D:\Program Files\Thunder Network\WebThunder\GetUrl.htm, N/A>
[使用Web迅雷下载全部链接]
  <D:\Program Files\Thunder Network\WebThunder\GetAllUrl.htm, N/A>
[使用迅雷下载]
  <C:\Program Files\Thunder\Program\GetUrl.htm, N/A>
[使用迅雷下载全部链接]
  <C:\Program Files\Thunder\Program\GetAllUrl.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
  <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
gototop
 
ccoccocco
头像
快乐黄口狮
  • 帖子:150
  • 注册: 2006-08-01
  • 来自:
发表于： 2007-08-19 17:06 | 显示全部 短消息 资料
字号： 小 中 大 3楼


==================================
正在运行的进程
[PID: 516][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 916][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 944][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\Ati2evxx.dll]  [ATI Technologies Inc., 6.14.10.4132]
    [C:\Program Files\HPQ\IAM\Bin\AsWlnPkg.dll]  [Cognizance Corporation, 1.5.0.037]
    [C:\Program Files\HPQ\IAM\Bin\ASChnl.dll]  [Cognizance Corporation, 1.23.0.125]
    [C:\Program Files\HPQ\IAM\Bin\ItMsg.dll]  [Cognizance Corporation, 1.18.0.305]
[PID: 988][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1000][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\HPQ\IAM\bin\AsWlnPkg.dll]  [Cognizance Corporation, 1.5.0.037]
[PID: 1152][C:\WINDOWS\system32\Ati2evxx.exe]  [ATI Technologies Inc., 6.14.10.4132]
    [C:\WINDOWS\system32\Ati2edxx.dll]  [ATI Technologies, Inc., 6, 14, 10, 2500]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1168][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1260][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1316][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\System32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1368][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1472][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1612][C:\WINDOWS\system32\DllHost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\HPQ\IAM\Bin\TrayIcon.dll]  [Cognizance Corporation, 1.5.0.102]
    [C:\Program Files\HPQ\IAM\Bin\ItMsg.dll]  [Cognizance Corporation, 1.18.0.305]
    [C:\Program Files\HPQ\IAM\bin\HPBrand.dll]  [Hewlett-Packard Company, 1.01.0.020]
    [C:\Program Files\HPQ\IAM\bin\2052\HPBrand.dll]  [Hewlett-Packard Company, 1.01.0.021]
    [C:\Program Files\HPQ\IAM\bin\2052\ItMsg.dll]  [Cognizance Corporation, 1.18.0.298]
    [C:\Program Files\HPQ\IAM\Bin\ittal.dll]  [Cognizance Corporation, 1.5.0.141]
    [C:\Program Files\HPQ\IAM\Bin\ItReports.DLL]  [Cognizance Corporation, 1.5.0.036]
    [C:\Program Files\HPQ\IAM\bin\2052\ItReports.DLL]  [Cognizance Corporation, 1.5.0.032]
    [C:\Program Files\HPQ\IAM\Bin\STEngine.dll]  [Cognizance Corporation, 1.5.0.025]
    [C:\Program Files\HPQ\IAM\Bin\AuthWiz.dll]  [Cognizance Corporation, 1.5.0.267]
    [C:\Program Files\HPQ\IAM\bin\2052\AuthWiz.dll]  [Cognizance Corporation, 1.5.0.254]
[PID: 1996][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 464][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\System32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [c:\program files\hpq\iam\bin\aschnl.dll]  [Cognizance Corporation, 1.23.0.125]
    [c:\program files\hpq\iam\bin\ItMsg.dll]  [Cognizance Corporation, 1.18.0.305]
    [C:\Program Files\HPQ\IAM\Bin\ItDAC.dll]  [Cognizance Corporation, 1.00.173w]
    [C:\Program Files\HPQ\IAM\Bin\ItAuth.dll]  [Cognizance Corporation, 1.01.168v]
    [C:\Program Files\HPQ\IAM\bin\2052\ItMsg.dll]  [Cognizance Corporation, 1.18.0.298]
    [C:\Program Files\HPQ\IAM\bin\HPBrand.dll]  [Hewlett-Packard Company, 1.01.0.020]
    [C:\Program Files\HPQ\IAM\bin\2052\HPBrand.dll]  [Hewlett-Packard Company, 1.01.0.021]
    [C:\Program Files\HPQ\IAM\bin\ITREPORTS.DLL]  [Cognizance Corporation, 1.5.0.036]
    [C:\Program Files\HPQ\IAM\bin\2052\ITREPORTS.DLL]  [Cognizance Corporation, 1.5.0.032]
    [C:\Program Files\HPQ\IAM\Bin\ITVcServer.dll]  [Cognizance Corporation, 1.00.080]
    [C:\Program Files\HPQ\IAM\Bin\ItVCard.dll]  [Cognizance Corporation, 1.01.127]
[PID: 592][C:\WINDOWS\system32\wdfmgr.exe]  [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[PID: 720][C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe]  [Hewlett-Packard Development Company, L.P., 2, 0, 1, 8]
gototop
 
ccoccocco
头像
快乐黄口狮
  • 帖子:150
  • 注册: 2006-08-01
  • 来自:
发表于： 2007-08-19 17:07 | 显示全部 短消息 资料
字号： 小 中 大 4楼


[PID: 832][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\System32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1204][C:\WINDOWS\system32\Ati2evxx.exe]  [ATI Technologies Inc., 6.14.10.4132]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\Ati2edxx.dll]  [ATI Technologies, Inc., 6, 14, 10, 2500]
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  [北京三七二一科技有限公司, 1, 5, 4, 0]
    [C:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
[PID: 1528][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\HPQ\IAM\Bin\SFSShell.dll]  [Cognizance Corporation, 1.21.0.143]
    [C:\Program Files\HPQ\IAM\bin\ItMsg.dll]  [Cognizance Corporation, 1.18.0.305]
    [C:\Program Files\HPQ\IAM\bin\2052\SFSShell.dll]  [Cognizance Corporation, 1.21.0.152]
    [C:\WINDOWS\DOWNLO~1\CnsHook.dll]  [北京三七二一科技有限公司, 1, 0, 4, 2]
    [C:\WINDOWS\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  [北京三七二一科技有限公司, 1, 5, 4, 0]
    [C:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
    [C:\PROGRA~1\3721\alrex.dll]  [国风因特软件（北京）有限公司, 2.5.1.1003]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, N/A]
    [D:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [C:\WINDOWS\system32\browselc.dll]  [Microsoft Corporation, 6.00.2600.0000]
    [C:\PROGRA~1\3721\autolive.dll]  [国风因特软件（北京）有限公司, 2.5.5.1010]
    [C:\PROGRA~1\3721\alLiveEx.dll]  [ , 1, 0, 3, 1006]
    [C:\Program Files\Thunder\ComDlls\XunLeiBHO_002.dll]  [Thunder Networking Technologies,LTD, 5, 0, 0, 2]
    [C:\WINDOWS\system32\l3codeca.acm]  [Fraunhofer Institut Integrierte Schaltungen IIS, 1, 9, 0, 0305]
    [D:\Program Files\Thunder Network\WebThunder\WebThunderBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 2, 10]
    [C:\Program Files\HPQ\IAM\Bin\ItIeAddIN.dll]  [Infineon Technologies AG, 1.01.069]
[PID: 1668][C:\WINDOWS\system32\wbem\wmiprvse.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1704][C:\Program Files\HPQ\IAM\bin\asghost.exe]  [Cognizance Corporation, 1.5.0.035]
    [C:\Program Files\HPQ\IAM\bin\ItMsg.dll]  [Cognizance Corporation, 1.18.0.305]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\HPQ\IAM\Bin\Aswallet.dll]  [Cognizance Corporation, 1.09.0.079]
    [C:\Program Files\HPQ\IAM\bin\2052\Aswallet.dll]  [Cognizance Corporation, 1.09.047]
    [C:\Program Files\HPQ\IAM\Bin\ItSSO.dll]  [Cognizance Corporation, 1.50.3.319QC]
    [C:\Program Files\HPQ\IAM\Bin\RasAdmin.dll]  [Cognizance Corporation, 1.5.0.024]
    [C:\Program Files\HPQ\IAM\Bin\ItReports.DLL]  [Cognizance Corporation, 1.5.0.036]
    [C:\Program Files\HPQ\IAM\bin\2052\ItReports.DLL]  [Cognizance Corporation, 1.5.0.032]
    [C:\Program Files\HPQ\IAM\bin\2052\RasAdmin.dll]  [Cognizance Corporation, 1.5.0.021]
    [C:\Program Files\HPQ\IAM\Bin\SFSShell.dll]  [Cognizance Corporation, 1.21.0.143]
    [C:\Program Files\HPQ\IAM\bin\2052\SFSShell.dll]  [Cognizance Corporation, 1.21.0.152]
    [C:\Program Files\HPQ\IAM\Bin\PkiAdmin.dll]  [Cognizance Corporation, 1.5.0.023]
    [C:\Program Files\HPQ\IAM\bin\HPBrand.dll]  [Hewlett-Packard Company, 1.01.0.020]
    [C:\Program Files\HPQ\IAM\bin\2052\HPBrand.dll]  [Hewlett-Packard Company, 1.01.0.021]
    [C:\Program Files\HPQ\IAM\bin\2052\ItMsg.dll]  [Cognizance Corporation, 1.18.0.298]
    [C:\Program Files\HPQ\IAM\bin\2052\PkiAdmin.dll]  [Cognizance Corporation, 1.5.0.020]
    [C:\Program Files\HPQ\IAM\Bin\ITVCClient.dll]  [Cognizance Corporation, 1.5.1.122]
    [C:\Program Files\HPQ\IAM\Bin\ItVCard.dll]  [Cognizance Corporation, 1.01.127]
    [C:\Program Files\HPQ\IAM\Bin\TrayIcon.dll]  [Cognizance Corporation, 1.5.0.102]
    [C:\Program Files\HPQ\IAM\Bin\NetAdmin.dll]  [Cognizance Corporation, 1.5.0.108]
    [C:\Program Files\HPQ\IAM\bin\2052\NetAdmin.dll]  [Cognizance Corporation, 1.5.0.108]
    [C:\Program Files\HPQ\IAM\Bin\SSOMngr.dll]  [Cognizance Corporation, 2.25.0.235b]
    [C:\Program Files\HPQ\IAM\bin\2052\SSOMngr.dll]  [Cognizance Corporation, 2.25.0.235a]
    [C:\Program Files\HPQ\IAM\Bin\ASChnl.dll]  [Cognizance Corporation, 1.23.0.125]
    [C:\Program Files\HPQ\IAM\Bin\ittal.dll]  [Cognizance Corporation, 1.5.0.141]
    [C:\Program Files\HPQ\IAM\Bin\STEngine.dll]  [Cognizance Corporation, 1.5.0.025]
    [C:\Program Files\HPQ\IAM\Bin\ItDAC.dll]  [Cognizance Corporation, 1.00.173w]
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  [北京三七二一科技有限公司, 1, 5, 4, 0]
    [C:\Program Files\HPQ\IAM\Bin\AuthWiz.dll]  [Cognizance Corporation, 1.5.0.267]
    [C:\Program Files\HPQ\IAM\bin\2052\AuthWiz.dll]  [Cognizance Corporation, 1.5.0.254]
    [C:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
[PID: 824][C:\WINDOWS\system32\Rundll32.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  [北京三七二一科技有限公司, 1, 5, 4, 0]
    [C:\WINDOWS\DOWNLO~1\CnsMinIO.dll]  [北京三七二一科技有限公司, 1, 0, 3, 7]
    [C:\WINDOWS\DOWNLO~1\cnsio.dll]  [北京三七二一科技有限公司, 1, 0, 2, 8]
    [C:\WINDOWS\DOWNLO~1\CnsMinEx.dll]  [国风因特软件(北京)有限公司, 1, 0, 3, 5]
    [C:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
[PID: 2188][d:\program files\rising\rfw\RfwMain.exe]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 72]
    [d:\program files\rising\rfw\RsGuiLib.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33]
    [d:\program files\rising\rfw\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [d:\program files\rising\rfw\RfwCtrl.dll]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]
    [d:\program files\rising\rfw\RsXML.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
    [d:\program files\rising\rfw\PngDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  [北京三七二一科技有限公司, 1, 5, 4, 0]
    [C:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
[PID: 2264][C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE]  [Hewlett-Packard Development Company, L.P., 2, 0, 3, 3]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  [北京三七二一科技有限公司, 1, 5, 4, 0]
[PID: 2284][C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe]  [ Hewlett-Packard Development Company, L.P., 6, 0, 5, 1]
    [C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBSERVICE.dll]  [Hewlett-Packard Development Company, L.P., 6, 0, 5, 1]
    [C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\hpqExec.dll]  [Hewlett-Packard Company, 6, 0, 5, 1]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  [北京三七二一科技有限公司, 1, 5, 4, 0]
    [C:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
    [C:\WINDOWS\DOWNLO~1\CnsHook.dll]  [北京三七二一科技有限公司, 1, 0, 4, 2]
    [C:\WINDOWS\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
[PID: 2320][C:\Program Files\Analog Devices\Core\smax4pnp.exe]  [Analog Devices, Inc., 6, 0, 0, 20]
    [C:\Program Files\Analog Devices\Core\SMWDMIF.dll]  [Analog Devices, Inc., 6, 0, 4200, 014]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  [北京三七二一科技有限公司, 1, 5, 4, 0]
    [C:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
[PID: 2356][C:\Program Files\Synaptics\SynTP\SynTPEnh.exe]  [Synaptics, Inc., 8.2.23 31Mar06]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  [北京三七二一科技有限公司, 1, 5, 4, 0]
    [C:\WINDOWS\system32\SynCOM.dll]  [Synaptics, Inc., 8.2.23 31Mar06]
    [C:\WINDOWS\system32\SynTPAPI.dll]  [Synaptics, Inc., 8.2.23 31Mar06]
    [C:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
[PID: 2384][C:\WINDOWS\system32\rundll32.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
gototop
 
ccoccocco
头像
快乐黄口狮
  • 帖子:150
  • 注册: 2006-08-01
  • 来自:
发表于： 2007-08-19 17:07 | 显示全部 短消息 资料
字号： 小 中 大 5楼


    [C:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  [北京三七二一科技有限公司, 1, 5, 4, 0]
    [C:\PROGRA~1\3721\autolive.dll]  [国风因特软件（北京）有限公司, 2.5.5.1010]
    [C:\PROGRA~1\3721\alLiveEx.dll]  [ , 1, 0, 3, 1006]
[PID: 2428][D:\Program Files\Thunder Network\WebThunder\WebThunder.exe]  [深圳市迅雷网络技术有限公司, 1, 9, 3, 150]
    [D:\Program Files\Thunder Network\WebThunder\RegisterDll.dll]  [Thunder Networking Technologies,LTD, 2, 13, 4, 58]
    [D:\Program Files\Thunder Network\WebThunder\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  [北京三七二一科技有限公司, 1, 5, 4, 0]
    [D:\Program Files\Thunder Network\WebThunder\TaskManager.dll]  [Thunder Networking Technologies,LTD, 1, 1, 2, 26]
    [D:\Program Files\Thunder Network\WebThunder\download_interface.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 46]
    [D:\Program Files\Thunder Network\WebThunder\stlport_vc646.dll]  [STLport Consulting, Inc., 4.6.2003.1031]
    [D:\Program Files\Thunder Network\WebThunder\asyn_dns.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 46]
    [D:\Program Files\Thunder Network\WebThunder\Inmedia\iEmbedShell.dll]  [　, 1, 0, 0, 19]
    [D:\Program Files\Thunder Network\WebThunder\InMedia\iEmbed10.dll]  [　, 3, 3, 1, 82]
    [D:\Program Files\Thunder Network\WebThunder\DownAndPlay\WebDownAndPlay.dll]  [xl, 1, 0, 0, 18]
    [D:\Program Files\Thunder Network\WebThunder\CacheServer.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\Program Files\HPQ\IAM\Bin\SFSShell.dll]  [Cognizance Corporation, 1.21.0.143]
    [C:\Program Files\HPQ\IAM\bin\ItMsg.dll]  [Cognizance Corporation, 1.18.0.305]
    [C:\Program Files\HPQ\IAM\bin\2052\SFSShell.dll]  [Cognizance Corporation, 1.21.0.152]
[PID: 2464][C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe]  [InstallShield Software Corporation, 3, 20, 100, 1123]
[PID: 2576][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  [北京三七二一科技有限公司, 1, 5, 4, 0]
[PID: 3928][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
    [C:\PROGRA~1\3721\scrblock.dll]  [3721, 1, 0, 1, 1000]
    [C:\PROGRA~1\3721\alrex.dll]  [国风因特软件（北京）有限公司, 2.5.1.1003]
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  [北京三七二一科技有限公司, 1, 5, 4, 0]
    [C:\WINDOWS\DOWNLO~1\CnsHint.dll]  [3721, 1, 0, 1, 2]
    [C:\WINDOWS\system32\browselc.dll]  [Microsoft Corporation, 6.00.2600.0000]
    [C:\PROGRA~1\3721\autolive.dll]  [国风因特软件（北京）有限公司, 2.5.5.1010]
    [C:\PROGRA~1\3721\alLiveEx.dll]  [ , 1, 0, 3, 1006]
    [C:\WINDOWS\DOWNLO~1\cnsplus.dll]  [3721, 1, 0, 0, 2]
    [C:\Program Files\HPQ\IAM\Bin\SFSShell.dll]  [Cognizance Corporation, 1.21.0.143]
    [C:\Program Files\HPQ\IAM\bin\ItMsg.dll]  [Cognizance Corporation, 1.18.0.305]
    [C:\Program Files\HPQ\IAM\bin\2052\SFSShell.dll]  [Cognizance Corporation, 1.21.0.152]
    [D:\Program Files\Thunder Network\WebThunder\WebThunderBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 2, 10]
    [C:\Program Files\Thunder\ComDlls\XunLeiBHO_002.dll]  [Thunder Networking Technologies,LTD, 5, 0, 0, 2]
    [C:\WINDOWS\DOWNLO~1\CnsHook.dll]  [北京三七二一科技有限公司, 1, 0, 4, 2]
    [C:\Program Files\HPQ\IAM\Bin\ItIeAddIN.dll]  [Infineon Technologies AG, 1.01.069]
    [C:\Program Files\HPQ\IAM\Bin\ItSSO.dll]  [Cognizance Corporation, 1.50.3.319QC]
    [C:\Program Files\HPQ\IAM\Bin\Aswallet.dll]  [Cognizance Corporation, 1.09.0.079]
    [C:\Program Files\HPQ\IAM\bin\2052\Aswallet.dll]  [Cognizance Corporation, 1.09.047]
    [D:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[PID: 2624][D:\PROGRAM FILES\RISING\RAV\RavStub.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 4]
    [D:\PROGRAM FILES\RISING\RAV\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [D:\PROGRAM FILES\RISING\RAV\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2964][D:\Program Files\Wom\WoptiUtilities.exe]  [共软网络, 7.73.7.618]
    [D:\Program Files\Wom\WoptiP2P.dll]  [共软网络, 1.4.7.613]
    [D:\Program Files\Wom\D3DX81ab.dll]  [鲁锦, 1.0.0.0]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  [北京三七二一科技有限公司, 1, 5, 4, 0]
    [C:\Program Files\HPQ\IAM\Bin\SFSShell.dll]  [Cognizance Corporation, 1.21.0.143]
    [C:\Program Files\HPQ\IAM\bin\ItMsg.dll]  [Cognizance Corporation, 1.18.0.305]
    [C:\Program Files\HPQ\IAM\bin\2052\SFSShell.dll]  [Cognizance Corporation, 1.21.0.152]
    [D:\Program Files\Wom\Woptidefrag.dll]  [鲁锦, 1.0.6.826]
[PID: 2040][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  [北京三七二一科技有限公司, 1, 5, 4, 0]
    [C:\WINDOWS\DOWNLO~1\CnsHint.dll]  [3721, 1, 0, 1, 2]
    [C:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
    [C:\PROGRA~1\3721\scrblock.dll]  [3721, 1, 0, 1, 1000]
    [C:\PROGRA~1\3721\alrex.dll]  [国风因特软件（北京）有限公司, 2.5.1.1003]
    [C:\WINDOWS\system32\browselc.dll]  [Microsoft Corporation, 6.00.2600.0000]
    [C:\PROGRA~1\3721\autolive.dll]  [国风因特软件（北京）有限公司, 2.5.5.1010]
    [C:\PROGRA~1\3721\alLiveEx.dll]  [ , 1, 0, 3, 1006]
    [C:\WINDOWS\DOWNLO~1\cnsplus.dll]  [3721, 1, 0, 0, 2]
    [C:\Program Files\HPQ\IAM\Bin\SFSShell.dll]  [Cognizance Corporation, 1.21.0.143]
    [C:\Program Files\HPQ\IAM\bin\ItMsg.dll]  [Cognizance Corporation, 1.18.0.305]
    [C:\Program Files\HPQ\IAM\bin\2052\SFSShell.dll]  [Cognizance Corporation, 1.21.0.152]
    [D:\Program Files\Thunder Network\WebThunder\WebThunderBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 2, 10]
    [C:\Program Files\Thunder\ComDlls\XunLeiBHO_002.dll]  [Thunder Networking Technologies,LTD, 5, 0, 0, 2]
    [C:\WINDOWS\DOWNLO~1\CnsHook.dll]  [北京三七二一科技有限公司, 1, 0, 4, 2]
    [C:\Program Files\HPQ\IAM\Bin\ItIeAddIN.dll]  [Infineon Technologies AG, 1.01.069]
    [C:\Program Files\HPQ\IAM\Bin\ItSSO.dll]  [Cognizance Corporation, 1.50.3.319QC]
    [D:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\Program Files\HPQ\IAM\Bin\Aswallet.dll]  [Cognizance Corporation, 1.09.0.079]
    [C:\Program Files\HPQ\IAM\bin\2052\Aswallet.dll]  [Cognizance Corporation, 1.09.047]
[PID: 3864][D:\Program Files\sreng23\SREng.EXE]  [Smallfrogs Studio, 2.3.13.690]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  [北京三七二一科技有限公司, 1, 5, 4, 0]
    [C:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
    [D:\Program Files\sreng23\Plugins\SRECXTMG.SRE]  [Smallfrogs Studio, 1, 5, 0, 55]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost
0.0.0.0 182838.com
0.0.0.0 204.177.92.68
0.0.0.0 asiafriendfinder.com
0.0.0.0 asqin123.51.net
0.0.0.0 babe520.5188.org
0.0.0.0 music.feifa.com
0.0.0.0 music.v111.com
0.0.0.0 www.jpbeauty.com
0.0.0.0 beautishow.com
0.0.0.0 goodmovies88.com
0.0.0.0 hothack.home.chinaren.com
0.0.0.0 hualiao.net
0.0.0.0 iplus.allyes.com
0.0.0.0 jjkafei.longcity.net
0.0.0.0 kaomm.8m.cn
0.0.0.0 l3iaoliao.com
0.0.0.0 lingaonbvm.myrice.com
0.0.0.0 lovejava.boy.net.cn
0.0.0.0 love7liao.com
0.0.0.0 asqin123.51.net
0.0.0.0 babe520.5188.org
0.0.0.0 music.feifa.com
0.0.0.0 jjkafei.longcity.net
0.0.0.0 kaomm.8m.cn
0.0.0.0 l3iaoliao.com
0.0.0.0 l3iaoliao.com
0.0.0.0 lingaonbvm.myrice.com
0.0.0.0 lovejava.boy.net.cn
0.0.0.0 love7liao.com
0.0.0.0 babe520.5188.org
0.0.0.0 music.feifa.com
0.0.0.0 music.v111.com
0.0.0.0 babe520.5188.org
0.0.0.0 music.feifa.com
0.0.0.0 jjkafei.longcity.net
0.0.0.0 kaomm.8m.cn
0.0.0.0 l3iaoliao.com
0.0.0.0 l3iaoliao.com
0.0.0.0 lingaonbvm.myrice.com
0.0.0.0 lovejava.boy.net.cn
0.0.0.0 love7liao.com
0.0.0.0 babe520.5188.org
0.0.0.0 music.feifa.com
0.0.0.0 music.v111.com

==================================
API HOOK
N/A

==================================


[/CODE]
gototop
 
ccoccocco
头像
快乐黄口狮
  • 帖子:150
  • 注册: 2006-08-01
  • 来自:
发表于： 2007-08-19 17:55 | 显示全部 短消息 资料
字号： 小 中 大 6楼

顶上去，我机器现在没按一键恢复，出一点事就草木皆兵。。。
gototop
 
ccoccocco
头像
快乐黄口狮
  • 帖子:150
  • 注册: 2006-08-01
  • 来自:
发表于： 2007-08-19 20:18 | 显示全部 短消息 资料
字号： 小 中 大 7楼

不是吧。。。才发现。。。然后又扫了一便。。还是n/a，妈呀。。。我要晕倒了，谁来救救我的机器呀！！！
gototop
 
ccoccocco
头像
快乐黄口狮
  • 帖子:150
  • 注册: 2006-08-01
  • 来自:
发表于： 2007-08-19 20:47 | 显示全部 短消息 资料
字号： 小 中 大 8楼

刚把SREng升级到2.5，原来用的2.3的，注册表出来了，启动文件夹还是n/a。。。

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <CnsMin><Rundll32.exe C:\WINDOWS\DOWNLO~1\CnsMin.dll,Rundll32>  [北京三七二一科技有限公司]
    <PTHOSTTR><C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start>  [Hewlett-Packard Development Company, L.P.]
    <CognizanceTS><rundll32.exe C:\PROGRA~1\HPQ\IAM\Bin\AsTsVcc.dll,RegisterModule>  [Cognizance Corporation]
    <QlbCtrl><%ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start>  [ Hewlett-Packard Development Company, L.P.]
    <SoundMAXPnP><C:\Program Files\Analog Devices\Core\smax4pnp.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <SoundMAX><C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray>  [Analog Devices, Inc.]
    <SynTPEnh><C:\Program Files\Synaptics\SynTP\SynTPEnh.exe>  [(Verified)Microsoft Windows Component Publisher]
    <RavTask><"D:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
    <RfwMain><"D:\Program Files\Rising\Rfw\rfwmain.exe" -Startup>  [Beijing Rising Technology Co., Ltd.]
    <helper.dll><C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32>  [(Verified)"INTER CHINA NETWORK SOFTWARE (BEIJING) CO., LTD."]
    <WebThunder><D:\Program Files\Thunder Network\WebThunder\WebThunder.exe>  [(Verified)ShenZhen Thunder Networking Technologies Ltd.]
    <ISUSPM Startup><C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup>  [InstallShield Software Corporation]
    <ISUSScheduler><"C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start>  [InstallShield Software Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
    <Userinit><userinit.exe,>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{D157330A-9EF3-49F8-9A67-4141AC41ADD4}><C:\WINDOWS\DOWNLO~1\CnsHook.dll>  [北京三七二一科技有限公司]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll>  [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\OneCard]
    <WinlogonNotify: OneCard><C:\Program Files\HPQ\IAM\Bin\AsWlnPkg.dll>  [Cognizance Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
    <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
    <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
    <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
    <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
    <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
    <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
    <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]
[HKEY_CURRENT_USER\Control Panel\Desktop]
    <SCRNSAVE.EXE><C:\WINDOWS\system32\夜光时钟.SCR>  []

==================================
启动文件夹
N/A
gototop
 
ccoccocco
头像
快乐黄口狮
  • 帖子:150
  • 注册: 2006-08-01
  • 来自:
发表于： 2007-08-19 20:55 | 显示全部 短消息 资料
字号： 小 中 大 9楼

饿。。。。10楼的大虾能不能说具体点，删哪个文件夹下哪个文件，尤其是重启前那几个步骤，我的经验很不足呀。。。要恶补安全知识了。。。另外注册表我发在你楼上了，估计我发的时候你正打字呢，咱俩就差2分钟。。。
gototop
 
ccoccocco
头像
快乐黄口狮
  • 帖子:150
  • 注册: 2006-08-01
  • 来自:
发表于： 2007-08-19 21:30 | 显示全部 短消息 资料
字号： 小 中 大 10楼

已完成10楼指点的步骤，但是：

删除驱动服务

[kdsjjbo / kdsjjbo][Running/Boot Start]
<\SystemRoot\\SystemRoot\System32\drivers\kdsjjbo.sys><N/A>

之后

[R2A / R2A][Stopped/Disabled]
<\??\C:\WINDOWS\system32a2.sys><N/A>

被告知已被标记为删除，怀疑为连带删除。

以及：

C:\WINDOWS\system32\IEBHO.dll
C:\WINDOWS\system32a2.sys

2个文件未能在其路径下找到，怀疑也为连带删除。
另外那个文件找到了，删掉了已经。

注册表已发在前面某楼，等待大虾进一步诊断。
万分感谢~~~
gototop
 
<<上一主题|下一主题>>
12   1  /  2  页   跳转页
页面顶部
Powered by Discuz!NT