[求助] ezcronk.exe进程!同rundll32.exe一起出现,便立即死机。

wusuian

新兵

积分: 3
威望: 5
元宝: 0
铜钱: 4

1楼大中小发表于 2008-7-20 21:31 只看该作者

ezcronk.exe进程!同rundll32.exe一起出现,便立即死机。

ezcronk.exe这个进程在baidu上都查不出来。开机后不一定什么时候就出现，但出现后伴随rundll32.exe一起出现。便立即死机（屏幕内容固定，鼠标键盘无反应），谁告诉我这是哪方面的毒啊？

搜索更多相关主题的帖子: ezcronk exe 进程

TOP

月下桂花

叫丁香的鱼

爱毒霸社区缉毒队

积分: 1883
威望: 4100
元宝: 14
铜钱: 1467

安全之星勋章周刊评论员

2楼大中小发表于 2008-7-20 22:02 只看该作者

智能扫描=》扫描=》保存报告
把日志SREngLOG.log中的报告完整复制粘贴上来，[全选(Ctrl+a) >>复制(Ctrl+c) >>粘贴(Ctrl+v)] 上来，
下载sreng：http://www.kztechs.com/sreng/sreng2.zip

我家有月亮.............
月下桂花
月下桂花的网盘
动物家园安全咨询中心

TOP

wusuian

新兵

积分: 3
威望: 5
元宝: 0
铜钱: 4

3楼大中小发表于 2008-7-21 09:06 只看该作者

复制内容到剪贴板

代码:

2008-07-21,09:02:02



System Repair Engineer 2.6.11.992

Smallfrogs (http://www.KZTechs.com)



Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能



以下内容被选中：

    所有的启动项目（包括注册表、启动文件夹、服务等）

    浏览器加载项

    正在运行的进程（包括进程模块信息）

    文件关联

    Winsock 提供者

    Autorun.inf

    HOSTS 文件

    进程特权扫描





启动项目

注册表

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

    <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]

    <Userinit><C:\WINDOWS\system32\UserInit.exe,>  [(Verified)Microsoft Windows Publisher]

    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]

    <IE7 Uninstall Stub><C:\WINDOWS\system32\ieudinit.exe>  [(Verified)Microsoft Windows Component Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]

    <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [File is missing]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]

    <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [File is missing]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]

    <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [File is missing]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]

    <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]

    <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub>  [(Verified)Microsoft Windows Component Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]

    <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [File is missing]



==================================

启动文件夹

N/A



==================================

服务

[Human Interface Device Access / HidServ][Stopped/Disabled]

  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>

[NVIDIA Display Driver Service / NVSvc][Stopped/Disabled]

  <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>



==================================

驱动程序

[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]

  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>

[npkcrypt / npkcrypt][Running/Auto Start]

  <\??\D:\Tencent\qq\npkcrypt.sys><INCA Internet Co., Ltd.>

[nv / nv][Running/Manual Start]

  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>

[Direct Parallel Link Driver / Ptilink][Running/Manual Start]

  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>

[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]

  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>

[Secdrv / Secdrv][Stopped/Manual Start]

  <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>

[SentryCard / SentryCard][Running/Boot Start]

  <\SystemRoot\System32\Drivers\xsbide.sys><Sentry Technology Co., LTD.>



==================================

浏览器加载项

[BitComet Helper]

  {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} <D:\BitComet\tools\BitCometBHO_1.2.6.26.dll, BitComet>

[番茄花园]

  {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} <http://www.tomatolei.com, N/A>

[BitComet]

  {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} <, N/A>

[EditCtrl Class]

  {488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\system32\aliedit\aliedit.dll, >

[CEnroll Class]

  {127698E4-E730-4E5C-A2B1-21490A70C8A1} <C:\WINDOWS\system32\xenroll.dll, Microsoft Corporation>

[iTrusPTA Class]

  {1E0DFFCF-27FF-4574-849B-55007349FEDA} <C:\WINDOWS\system32\aliedit\pta.dll, >

[BitComet Helper]

  {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} <D:\BitComet\tools\BitCometBHO_1.2.6.26.dll, BitComet>

[EditCtrl Class]

  {488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\system32\aliedit\aliedit.dll, >

[PowerPassword Control]

  {614E58F9-74D0-4D7B-90E3-64A0F2AA73B4} <C:\WINDOWS\system32\POWERE~1.OCX, CSII>

[PowerCommit Control]

  {BEEE2807-1709-4184-A05D-1B2DE01EE4CF} <C:\WINDOWS\system32\POWERE~1.OCX, CSII>

[Shockwave Flash Object]

  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>

[Iesign Control]

  {F3E92562-1B4D-4BFA-B2D4-E9BCABE3B5A8} <C:\WINDOWS\system32\iesign.ocx, CSII>

[XML HTTP]

  {F6D90F16-9C73-11D3-B32E-00C04F990BB4} <%SystemRoot%\system32\msxml3.dll, N/A>

[&使用BitComet下载]

  <res://D:\BitComet\BitComet.exe/AddLink.htm, N/A>

[&使用BitComet下载全部链接]

  <res://D:\BitComet\BitComet.exe/AddAllLink.htm, N/A>

[&使用BitComet下载本页视频]

  <res://D:\BitComet\BitComet.exe/AddVideo.htm, N/A>



==================================

正在运行的进程

[PID: 496][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 544][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 572][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]

[PID: 616][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 628][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 784][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 844][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 924][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]

    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16674 (vista_gdr.080415-1732)]

[PID: 968][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 1284][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]

    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16674 (vista_gdr.080415-1732)]

    [C:\WINDOWS\system32\ieframe.dll]  [Microsoft Corporation, 7.00.6000.16674 (vista_gdr.080415-1732)]

    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]

    [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]

    [C:\WINDOWS\system32\Audiodev.dll]  [Microsoft Corporation, 5.2.3802.3802 built by: dnsrv(bld4act)]

    [C:\WINDOWS\system32\nvcpl.dll]  [NVIDIA Corporation, 6.14.10.8185]

    [C:\WINDOWS\system32\NVRSZHC.DLL]  [NVIDIA Corporation, 6.14.10.8185]

    [C:\WINDOWS\system32\nvshell.dll]  [, ]

[PID: 1340][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 1564][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 1600][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 1104][C:\Program Files\Mozilla Firefox\firefox.exe]  [Mozilla Corporation, 1.9.0.1]

    [C:\Program Files\Mozilla Firefox\xul.dll]  [Mozilla Foundation, 1.9.0.1]

    [C:\Program Files\Mozilla Firefox\sqlite3.dll]  [sqlite.org, 3.5.9]

    [C:\Program Files\Mozilla Firefox\MOZCRT19.dll]  [Mozilla Foundation, 8.00.0000]

    [C:\Program Files\Mozilla Firefox\js3250.dll]  [Netscape Communications Corporation, 4.0]

    [C:\Program Files\Mozilla Firefox\nspr4.dll]  [Mozilla Foundation, 4.7.1]

    [C:\Program Files\Mozilla Firefox\smime3.dll]  [Mozilla Foundation, 3.12.0.3 Basic ECC]

    [C:\Program Files\Mozilla Firefox\nss3.dll]  [Mozilla Foundation, 3.12.0.3 Basic ECC]

    [C:\Program Files\Mozilla Firefox\nssutil3.dll]  [Mozilla Foundation, 3.12.0.3 Basic ECC]

    [C:\Program Files\Mozilla Firefox\plc4.dll]  [Mozilla Foundation, 4.7.1]

    [C:\Program Files\Mozilla Firefox\plds4.dll]  [Mozilla Foundation, 4.7.1]

    [C:\Program Files\Mozilla Firefox\ssl3.dll]  [Mozilla Foundation, 3.12.0.3 Basic ECC]

    [C:\Program Files\Mozilla Firefox\xpcom.dll]  [Mozilla Foundation, 1.9.0.1]

    [C:\Program Files\Mozilla Firefox\components\browserdirprovider.dll]  [Mozilla Foundation, 1.9.0.1]

    [C:\Program Files\Mozilla Firefox\softokn3.dll]  [Mozilla Foundation, 3.12.0.3 Basic ECC]

    [C:\Program Files\Mozilla Firefox\nssdbm3.dll]  [Mozilla Foundation, 3.12.0.3 Basic ECC]

    [C:\Program Files\Mozilla Firefox\freebl3.dll]  [Mozilla Foundation, 3.12.0.3 Basic ECC]

    [C:\Program Files\Mozilla Firefox\nssckbi.dll]  [Mozilla Foundation, 1.70]

    [C:\Program Files\Mozilla Firefox\components\brwsrcmp.dll]  [Mozilla Foundation, 1.9.0.1]

    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]

    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16674 (vista_gdr.080415-1732)]

    [C:\WINDOWS\system32\WBJJU.IME]  [北京六合源软件技术有限公司, 2, 5, 0, 0]

    [C:\WINDOWS\system32\WbCodeU.dll]  [, 2, 5, 0, 0]

    [C:\WINDOWS\system32\wbjju.dll]  [N/A, ]

    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]

    [C:\Program Files\Mozilla Firefox\plugins\NPSWF32.dll]  [, ]

[PID: 212][C:\WINDOWS\system32\taskmgr.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 1856][D:\SREng\SREngLdr.EXE]  [Smallfrogs Studio, 2.6.11.992]

[PID: 1484][D:\SREng\SREcee8da58.EXE]  [Smallfrogs Studio, 2.6.11.992]

    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]

    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16674 (vista_gdr.080415-1732)]

    [D:\SREng\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]



==================================

文件关联

.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]

.EXE  OK. ["%1" %*]

.COM  OK. ["%1" %*]

.PIF  OK. ["%1" %*]

.REG  OK. [regedit.exe "%1"]

.BAT  OK. ["%1" %*]

.SCR  OK. ["%1" /S]

.CHM  Error. ["hh.exe" %1]

.HLP  Error. [winhlp32.exe %1]

.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]

.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]

.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]

.JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]

.LNK  OK. [{00021401-0000-0000-C000-000000000046}]



==================================

Winsock 提供者

N/A



==================================

Autorun.inf

N/A



==================================

HOSTS 文件

127.0.0.1       localhost



==================================

进程特权扫描

特殊特权被允许： SeLoadDriverPrivilege [PID = 1856, D:\SRENG\SRENGLDR.EXE]



==================================

API HOOK

N/A



==================================

隐藏进程

N/A



==================================

TOP

liangruioo

新兵

积分: 1
威望: 3
元宝: 0
铜钱: 2

4楼大中小发表于 2008-7-22 07:21 只看该作者

我的机子的进程中也有个东东,救命呀

复制内容到剪贴板

代码:

2008-05-27,15:26:50



System Repair Engineer 2.5.16.900

Smallfrogs (http://www.KZTechs.com)



Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能



以下内容被选中：

    所有的启动项目（包括注册表、启动文件夹、服务等）

    浏览器加载项

    正在运行的进程（包括进程模块信息）

    文件关联

    Winsock 提供者

    Autorun.inf

    HOSTS 文件

    进程特权扫描





启动项目

注册表

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]

    <KavPFW><"C:\KAV2007\KPFW32.EXE" -startup>  [Kingsoft Corporation]

    <PhDesktop><; C:\Program Files\Oray\PeanutHull5\PhDesktop.exe>  [上海贝锐]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

    <SKYNET Personal FireWall><; C:\PROGRA~1\SKYNET\FIREWALL\pfw.exe>  [广州众达天网技术有限公司]

    <HB Kernel><RUNDLL32.EXE C:\WINDOWS\system32\HBKrnl.dll,DllRegisterServer>  [N/A]

    <!!QQKav><F:\qqkav.exe>  [Jsing.Net & QQKav.Com]

    <KavStart><"C:\KAV2007\KAVStart.exe" -startup>  [N/A]

    <MSConfig><C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto>  [(Verified)Microsoft Windows Publisher]

    <Alcmtr><; ALCMTR.EXE>  [(Verified)Microsoft Windows Publisher]

    <IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Publisher]

    <NvCplDaemon><; RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>  [NVIDIA Corporation]

    <nwiz><; nwiz.exe /install>  []

    <PHIME2002A><; >  [N/A]

    <PHIME2002ASync><; >  [N/A]

    <RTHDCPL><; RTHDCPL.EXE>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]

    <shendeng><; C:\Program Files\JUHEREN\mlb.exe>  [N/A]

    <StormCodec_Helper><; >  [N/A]

    <TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]

    <YLive.exe><; C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe>  [N/A]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

    <shell><Explorer.exe>  [(Verified)Microsoft Windows Component Publisher]

    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]

    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]

    <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [N/A]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]

    <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]

    <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]

    <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]

    <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]

    <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub>  [(Verified)Microsoft Windows Component Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]

    <N/A><C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install>  [Microsoft Corporation]



==================================

启动文件夹

N/A



==================================

服务

[ASP.NET State Service / aspnet_state][Stopped/Manual Start]

  <C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe><Microsoft Corporation>

[Autodesk Licensing Service / Autodesk Licensing Service][Stopped/Manual Start]

  <"C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe"><Autodesk>

[Contrl Center of Storm Media / ccosm][Stopped/Disabled]

  <C:\Program Files\StormII\stormliv.exe /asservice><北京暴风网际科技有限公司>

[Human Interface Device Access / HidServ][Stopped/Disabled]

  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>

[Kingsoft Personal Firewall Service / KPfwSvc][Running/Auto Start]

  <"C:\KAV2007\KPfwSvc.EXE"><Kingsoft Corporation>

[Kingsoft Antivirus KWatch Service / KWatchSvc][Running/Auto Start]

  <C:\KAV2007\KWatch.EXE><Kingsoft Corporation>

[LexBce Server / LexBceS][Running/Auto Start]

  <C:\WINDOWS\system32\LEXBCES.EXE><Lexmark International, Inc.>

[Macromedia Licensing Service / Macromedia Licensing Service][Stopped/Manual Start]

  <"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><>

[NBService / NBService][Stopped/Manual Start]

  <C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe><Nero AG>

[File Replication Service / Ntfrs][Stopped/Auto Start]

  <C:\WINDOWS\system32\ntfrs.exe><Microsoft Corporation>

[NVIDIA Display Driver Service / NVSvc][Stopped/Auto Start]

  <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>

[O&O Defrag / O&O Defrag][Stopped/Auto Start]

  <C:\WINDOWS\system32\oodag.exe><Microsoft Corporation>

[PeanutHull DDNS Service / Peanuthull5Core][Stopped/Auto Start]

  <C:\Program Files\Oray\PeanutHull5\PhCore.exe -service><上海贝锐>



==================================

驱动程序

[a320raid / a320raid][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\a320raid.sys><Adaptec, Inc.>

[AAC / AAC][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\AAC.SYS><Adaptec, Inc.>

[aar1210 / aar1210][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\aar1210.sys><Adaptec, Inc.>

[abp480n5 / abp480n5][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\abp480n5.sys><Microsoft Corporation>

[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Stopped/Manual Start]

  <system32\drivers\ac97intc.sys><Intel Corporation>

[adpu160m / adpu160m][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\adpu160m.sys><Microsoft Corporation>

[adpu320 / adpu320][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\adpu320.sys><Adaptec, Inc.>

[ACARD AEC6210UF UltraDMA33 Controller / aec6210][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\aec6210.sys><ACARD Technology Corp.>

[ACARD AEC6260 UltraDMA-66 Controller / aec6260][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\aec6260.sys><ACARD Technology Corp.>

[aec6280 / aec6280][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\aec6280.sys><ACARD Technology Corp.>

[AEC6290 / AEC6290][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\AEC6290.SYS><ACARD Technology Corp.>

[AEC67160 / AEC67160][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\AEC67160.SYS><ACARD Technology Corp.>

[AEC671X / AEC671X][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\AEC671X.SYS><ACARD Technology Corp.>

[AEC6880 / AEC6880][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\AEC6880.SYS><ACARD Technology Corp.>

[AEC6890 / AEC6890][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\AEC6890.sys><ACARD Technology Corp.>

[aec68x5 / aec68x5][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\aec68x5.sys><ACARD Technology Corp.>

[Aha154x / Aha154x][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\aha154x.sys><Microsoft Corporation>

[aic78u2 / aic78u2][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\aic78u2.sys><Microsoft Corporation>

[aic78xx / aic78xx][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\aic78xx.sys><Microsoft Corporation>

[AliIde / AliIde][Running/Boot Start]

  <\SystemRoot\System32\DRIVERS\aliide.sys><Acer Laboratories Inc.>

[AMD K8 Processor Driver / AmdK8][Stopped/Manual Start]

  <System32\DRIVERS\amdk8.sys><Microsoft Corporation>

[arc / arc][Stopped/Boot Start]

  <\SystemRoot\system32\drivers\arc.sys><Adaptec, Inc.>

[asc / asc][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\asc.sys><Advanced System Products, Inc.>

[asc3550 / asc3550][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\asc3550.sys><Advanced System Products, Inc.>

[CmdIde / CmdIde][Running/Boot Start]

  <\SystemRoot\System32\DRIVERS\cmdide.sys><CMD Technology, Inc.>

[dac2w2k / dac2w2k][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\dac2w2k.sys><Mylex Corporation>

[dohs / dohs][Stopped/Auto Start]

  <\??\C:\DOCUME~1\new\LOCALS~1\Temp\tmpC.tmp><N/A>

[dpti2o / dpti2o][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\dpti2o.sys><Microsoft Corporation>

[3Com EtherLink XL 90XB/C Adapter Driver / EL90XBC][Running/Manual Start]

  <system32\DRIVERS\el90xbc5.sys><3Com Corporation>

[elxstor / elxstor][Stopped/Boot Start]

  <\SystemRoot\system32\drivers\elxstor.sys><Emulex>

[ENTECH / ENTECH][Stopped/Manual Start]

  <\??\C:\WINDOWS\system32\DRIVERS\ENTECH.sys><EnTech Taiwan>

[FASTSX / FASTSX][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\FASTSX.SYS><Promise Technology, Inc.>

[fasttrak / fasttrak][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\fasttrak.sys><Promise Technology, Inc.>

[fasttx2k / fasttx2k][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\fasttx2k.sys><Promise Technology, Inc.>

[fasttx2k2 / fasttx2k2][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\fasttx2k2.sys><Promise Technology, Inc.>

[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Stopped/Manual Start]

  <system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>

[HBKernel Driver / HBKernel][Running/Auto Start]

  <\??\C:\WINDOWS\system32\drivers\HBKernel.sys><N/A>

[Microsoft UAA Bus Driver for High Definition Audio / HDAudBus][Running/Manual Start]

  <system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>

[HpCISSs / HpCISSs][Stopped/Boot Start]

  <\SystemRoot\system32\drivers\hpcisss.sys><Hewlett-Packard Company>

[Hpt366 / Hpt366][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\Hpt366.sys><Microsoft Corporation>

[HPT371 / HPT371][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\HPT371.sys><HighPoint Technologies, Inc.>

[hpt374 / hpt374][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\hpt374.sys><HighPoint Technologies, Inc.>

[hpt3xx / hpt3xx][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\hpt3xx.sys><HighPoint Technologies, Inc.>

[hptmv / hptmv][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\hptmv.sys><HighPoint Technologies, Inc.>

[hptpro / hptpro][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\hptpro.sys><HighPoint Technologies, Inc.>

[Intel Integrated RAID / iaStor][Stopped/Boot Start]

  <\SystemRoot\system32\drivers\iaStor.sys><Intel Corporation>

[iirsp / iirsp][Stopped/Boot Start]

  <\SystemRoot\system32\drivers\iirsp.sys><Intel Corp./ICP vortex GmbH>

[ini910u / ini910u][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\ini910u.sys><Microsoft Corporation>

[Service for Realtek HD Audio (WDM) / IntcAzAudAddService][Running/Manual Start]

  <system32\drivers\RtkHDAud.sys><Realtek Semiconductor Corp.>

[ITERAID_Service_Install / iteraid][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\iteraid.sys><Integrated Technology Express, Inc.>

[KAVBootC / KAVBootC][Stopped/Boot Start]

  <\SystemRoot\system32\Drivers\KAVBootC.sys><Kingsoft Corporation>

[KNetWch / KNetWch][Running/System Start]

  <\??\C:\KAV2007\KNetWch.SYS><Kingsoft Corporation>

[KWatch3 / KWatch3][Running/System Start]

  <\??\C:\WINDOWS\system32\drivers\KWatch3.SYS><Kingsoft Corporation>

[LSI_SAS / LSI_SAS][Stopped/Boot Start]

  <\SystemRoot\system32\drivers\lsi_sas.sys><LSI Logic>

[LSI_SCSI / LSI_SCSI][Stopped/Boot Start]

  <\SystemRoot\system32\drivers\lsi_scsi.sys><LSI Logic>

[m5228 / m5228][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\m5228.sys><ALi Corporation.>

[m5281 / m5281][Stopped/Boot Start]

  <\SystemRoot\system32\drivers\m5281.sys><ALi Corporation>

[MegaIDE / MegaIDE][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\MegaIDE.sys><LSI Logic Corporation.>

[megasas / megasas][Stopped/Boot Start]

  <\SystemRoot\system32\drivers\megasas.sys><LSI Logic Corporation>

[mraid2k / mraid2k][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\mraid2k.sys><American Megatrends, Inc.>

[mraid35x / mraid35x][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\mraid35x.sys><American Megatrends Inc.>

[msfpfis64 / msfpfis64][Stopped/Auto Start]

  <\??\C:\WINDOWS\system32\drivers\msosmsfpfis64.sys><N/A>

[nfrd960 / nfrd960][Stopped/Boot Start]

  <\SystemRoot\system32\drivers\nfrd960.sys><IBM Corporation>

[npkcrypt / npkcrypt][Stopped/Auto Start]

  <\??\C:\Program Files\QQ2005\npkcrypt.sys><N/A>

[nv / nv][Running/Manual Start]

  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>

[Intel SCSI Controller / NvAtaBus][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\NVATABUS.SYS><NVIDIA Corporation>

[NVIDIA nForce(tm) RAID Class Driver / nvraid][Stopped/Boot Start]

  <\SystemRoot\system32\DRIVERS\nvraid.sys><NVIDIA Corporation>

[PNP649R / PNP649R][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\PNP649R.SYS><CMD Technology, Inc.>

[SiI 680 ATA Controller / Pnp680][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\pnp680.sys><Silicon Image, Inc.>

[Silicon Image SiI 0680 Medley Raid Controller / Pnp680r][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\pnp680r.sys><Silicon Image, Inc>

[Direct Parallel Link Driver / Ptilink][Running/Manual Start]

  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>

[ql1080 / ql1080][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\ql1080.sys><QLogic Corporation>

[Ql10wnt / Ql10wnt][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\ql10wnt.sys><Microsoft Corporation>

[ql12160 / ql12160][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\ql12160.sys><QLogic Corporation>

[ql1280 / ql1280][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\ql1280.sys><QLogic Corporation>

[QLogic Fibre Channel SCSI Miniport Driver / ql2300][Stopped/Boot Start]

  <\SystemRoot\system32\drivers\ql2300.sys><QLogic Corporation>

[RAIDSRC / RAIDSRC][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\RAIDSRC.SYS><Intel/ICP>

[S150SX8 / S150SX8][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\S150SX8.SYS><Promise Technology, Inc.>

[Secdrv / Secdrv][Stopped/Manual Start]

  <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>

[SiI-3512 SATALink Controller / SI3112][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\SI3112.sys><Silicon Image, Inc.>

[Silicon Image SiI 3512 SATARaid Controller / SI3112r][Stopped/Boot Start]

  <\SystemRoot\system32\drivers\SI3112r.sys><Silicon Image, Inc>

[SiI-3114 SATALink Controller / SI3114][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\SI3114.sys><Silicon Image, Inc.>

[SiI-3114 SATARaid Controller / SI3114r][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\SI3114R.sys><Silicon Image, Inc>

[SiI-3124 SATALink Controller / SI3124][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\SI3124.sys><Silicon Image, Inc.>

[SiI-3124 SATARaid Controller / SI3124r][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\SI3124R.sys><Silicon Image, Inc>

[SATALink driver accelerator / SiFilter][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\SiWinAcc.sys><Silicon Image, Inc.>

[SISIDE / SISIDE][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\SISIDE.SYS><Silicon Integrated Systems Corp.>

[SiSRaid / SiSRaid][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\SiSRaid.sys><Silicon Integrated Systems>

[SiSRaid1 / SiSRaid1][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\SiSRaid1.sys><Silicon Integrated Systems>

[SISRAIDS / SISRAIDS][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\SISRAIDS.SYS><Silicon Integrated Systems Corp>

[SKNFW / SKNFW][Running/System Start]

  <\??\C:\WINDOWS\system32\Drivers\SKNFW.sys><N/A>

[SkyProcs / SkyProcs][Running/Manual Start]

  <\??\C:\PROGRA~1\SKYNET\FIREWALL\SkyProcs.sys><N/A>

[Sparrow / Sparrow][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\sparrow.sys><Adaptec, Inc.>

[sptrak / sptrak][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\sptrak.sys><Promise Technology, Inc.>

[symc810 / symc810][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\symc810.sys><Symbios Logic Inc.>

[symc8xx / symc8xx][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\symc8xx.sys><LSI Logic>

[SYMMPI / SYMMPI][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\SYMMPI.SYS><LSI Logic>

[sym_hi / sym_hi][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\sym_hi.sys><LSI Logic>

[sym_u3 / sym_u3][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\sym_u3.sys><LSI Logic>

[TosIde / TosIde][Running/Boot Start]

  <\SystemRoot\System32\DRIVERS\toside.sys><Microsoft Corporation>

[UlSata / UlSata][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\ulsata.sys><Promise Technology, Inc.>

[ULSATAS / ULSATAS][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\ULSATAS.SYS><Promise Technology, Inc.>

[ultra / ultra][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\ultra.sys><Promise Technology, Inc.>

[ViaIde / ViaIde][Running/Boot Start]

  <\SystemRoot\System32\DRIVERS\viaide.sys><Microsoft Corporation>

[viamraid / viamraid][Stopped/Boot Start]

  <\SystemRoot\system32\DRIVERS\viamraid.sys><VIA Technologies inc,.ltd>

[VIA ATA/ATAPI Host Controller / viapdsk][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\viapdsk.sys><VIA Technologies, Inc.>

[viaraid / viaraid][Stopped/Boot Start]

  <\SystemRoot\System32\DRIVERS\viaraid.sys><VIA Technologies inc,.ltd>

[viasraid / viasraid][Stopped/Boot Start]

  <\SystemRoot\system32\drivers\viasraid.sys><VIA Technologies inc,.ltd>

[vmscsi / vmscsi][Stopped/Boot Start]

  <\SystemRoot\system32\drivers\vmscsi.sys><VMware, Inc.>

[WINIO / WINIO][Stopped/Manual Start]

  <\??\G:\winio.sys><N/A>

[NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller / yukonwxp][Running/Manual Start]

  <system32\DRIVERS\yk51x86.sys><Marvell>



==================================

浏览器加载项

[ThunderAtOnce Class]

  {01443AEC-0FD1-40fd-9C87-E93D1494C233} <C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>

[CBrowseStakeout Class]

  {55302805-482E-470E-8A57-6795A1487F90} <C:\KAV2007\KAVAFish.DLL, Kingsoft Corporation>

[Thunder Browser Helper]

  {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>

[启动迅雷5]

  {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <C:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>

[微软]

  {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} <http://www.microsoft.com/china/index.htm, N/A>

[Windows Genuine Advantage Validation Tool]

  {17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft? Corporation>

[Shockwave Flash Object]

  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>

[ThunderAtOnce Class]

  {01443AEC-0FD1-40FD-9C87-E93D1494C233} <C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>

[DHTML Edit Control Safe for Scripting for IE5]

  {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>

[Thunder Agent Class]

  {485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <C:\Program Files\Thunder Network\Thunder\ComDlls\ThunderAgent_Now.dll, Thunder Networking Technologies,LTD>

[CBrowseStakeout Class]

  {55302805-482E-470E-8A57-6795A1487F90} <C:\KAV2007\KAVAFish.DLL, Kingsoft Corporation>

[Thunder Browser Helper]

  {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>

[SearchAssistantOC]

  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>

[Shockwave Flash Object]

  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>

[XPPlayer Class]

  {F3E70CEA-956E-49CC-B444-73AFE593AD7F} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\pplayer.dll_1_work, Thunder>

[使用影音传送带下载]

  <, N/A>

[使用影音传送带下载全部链接]

  <, N/A>

[使用迅雷下载]

  <C:\Program Files\Thunder Network\Thunder\Program\geturl.htm, N/A>

[使用迅雷下载全部链接]

  <C:\Program Files\Thunder Network\Thunder\Program\getallurl.htm, N/A>

[导出到 Microsoft Office Excel(&X)]

  <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>

[导出当前页到超星阅览器(&A)]

  <C:\Program Files\SSREADER36\ss_all.htm, N/A>

[导出选中部分到超星阅览器(&S)]

  <C:\Program Files\SSREADER36\ss_select.htm, N/A>

[添加到QQ表情]

  <C:\Program Files\QQ2005\AddEmotion.htm, N/A>

[金山毒霸反钓鱼...]

  <C:\KAV2007\KAF\ShowSet.htm, N/A>



==================================

正在运行的进程

[PID: 676 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 724 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 748 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]

[PID: 792 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 804 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 952 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 1000 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 1100 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\wups2.dll]  [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]

[PID: 1168 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 1268 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 1552 / new][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234)]

    [C:\WINDOWS\system32\AcSignIcon.dll]  [Autodesk, 16.2.54.0]

    [C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll]  [Autodesk, 16.2.54.0]

    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]

    [C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll]  [Nero AG, 2, 0, 0, 8]

    [C:\Program Files\Common Files\Ahead\Lib\MFC71.DLL]  [Microsoft Corporation, 7.10.3077.0]

    [C:\Program Files\Common Files\Ahead\Lib\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]

    [C:\Program Files\Common Files\Ahead\Lib\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]

    [C:\WINDOWS\system32\MFC71CHS.DLL]  [Microsoft Corporation, 7.10.3077.0]

    [C:\WINDOWS\system32\nvcpl.dll]  [NVIDIA Corporation, 6.14.11.0099]

    [C:\WINDOWS\system32\NVRSZHC.DLL]  [NVIDIA Corporation, 6.14.11.0099]

    [C:\WINDOWS\system32\nvapi.dll]  [NVIDIA Corporation, 6.14.11.0099]

    [C:\WINDOWS\system32\nvshell.dll]  [, ]

    [C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll]  [Thunder Networking Technologies,LTD, 1.0.5.29]

    [C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 8, 96]

    [C:\Program Files\Thunder Network\Thunder\Components\ResWorker\DsBho_01.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 18]

    [C:\Program Files\Thunder Network\Thunder\Components\ResWorker\DataProcessor_01.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 16]

[PID: 1572 / SYSTEM][C:\KAV2007\KWatch.EXE]  [Kingsoft Corporation, 2007, 8, 13, 78]

    [C:\KAV2007\KAVIPC2.DLL]  [Kingsoft Corporation, 2007, 1, 15, 30]

    [C:\KAV2007\KAEPlat.DLL]  [Kingsoft Corp., 2007, 6, 19, 64]

    [C:\KAV2007\KAEMem.DAT]  [Kingsoft, 2006, 9, 25, 16]

    [C:\KAV2007\KAEUnpack.DAT]  [Kingsoft Corporation, 2008,01,25,202]

    [C:\KAV2007\KAVQuara.DLL]  [Kingsoft Corporation, 2007, 12, 13, 9]

[PID: 1676 / SYSTEM][C:\WINDOWS\system32\LEXBCES.EXE]  [Lexmark International, Inc., 9.42]

    [C:\WINDOWS\system32\lexp2p32.dll]  [Lexmark International, Inc., 9.42]

    [C:\WINDOWS\system32\lex2kusb.dll]  [Lexmark International, Inc., 9.42]

[PID: 1752 / SYSTEM][C:\WINDOWS\system32\LEXPPS.EXE]  [Lexmark International, Inc., 9.42]

    [C:\WINDOWS\system32\LEXBCE.DLL]  [Lexmark International, Inc., 9.42]

[PID: 1776 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]

    [C:\WINDOWS\system32\LEXLMPM.DLL]  [Lexmark International, Inc., 96.9.42]

    [C:\WINDOWS\system32\LexBce.dll]  [Lexmark International, Inc., 9.42]

    [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\LVCMPP5C.dll]  [Lenovo (Beijing) Ltd., 1.0.1.14]

    [C:\WINDOWS\system32\LVCMpwr.dll]  [Lenovo (Beijing) Ltd., 1, 0, 1, 0]

[PID: 172 / SYSTEM][C:\KAV2007\KPfwSvc.EXE]  [Kingsoft Corporation, 2007, 8, 17, 39]

[PID: 212 / new][F:\qqkav.exe]  [Jsing.Net & QQKav.Com, 2008.5.1.3]

    [C:\WINDOWS\system32\mscoree.dll]  [Microsoft Corporation, 1.1.4322.2032]

    [C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorie.dll]  [Microsoft Corporation, 1.1.4322.573]

    [C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]

    [C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorld.dll]  [Microsoft Corporation, 1.1.4322.2032]

    [C:\KAV2007\KAScript.DLL]  [Kingsoft Corporation, 2007, 3, 6, 75]

[PID: 280 / new][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 292 / new][C:\KAV2007\KPFW32.EXE]  [Kingsoft Corporation, 2007, 10, 30, 737]

    [C:\WINDOWS\system32\MFC71.DLL]  [Microsoft Corporation, 7.10.3077.0]

    [C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]

    [C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]

    [C:\WINDOWS\system32\MFC71CHS.DLL]  [Microsoft Corporation, 7.10.3077.0]

    [C:\KAV2007\KAVIPC2.DLL]  [Kingsoft Corporation, 2007, 1, 15, 30]

    [C:\KAV2007\KAConfig.DLL]  [Kingsoft Corporation, 2007, 1, 11, 41]

    [C:\KAV2007\FiltList.dll]  [N/A, ]

    [C:\KAV2007\KAVPassp.DLL]  [Kingsoft Corporation, 2006, 9, 7, 270]

    [C:\WINDOWS\system32\AcSignIcon.dll]  [Autodesk, 16.2.54.0]

    [C:\KAV2007\KAScript.DLL]  [Kingsoft Corporation, 2007, 3, 6, 75]

    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]

[PID: 720 / new][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\AcSignIcon.dll]  [Autodesk, 16.2.54.0]

    [C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll]  [Thunder Networking Technologies,LTD, 1.0.5.29]

    [C:\KAV2007\KAVAFish.DLL]  [Kingsoft Corporation, 2006, 10, 25, 27]

    [C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 8, 96]

    [C:\Program Files\Thunder Network\Thunder\Components\ResWorker\DsBho_01.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 18]

    [C:\Program Files\Thunder Network\Thunder\Components\ResWorker\DataProcessor_01.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 16]

    [C:\Program Files\QQ2005\QQZoneHelper.dll]  [深圳市腾讯计算机系统有限公司, 1.1.0.1016]

    [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]

    [C:\KAV2007\KAScript.DLL]  [Kingsoft Corporation, 2007, 3, 6, 75]

    [C:\KAV2007\KAEPlat.DLL]  [Kingsoft Corp., 2007, 6, 19, 64]

    [C:\KAV2007\KAEMem.DAT]  [Kingsoft, 2006, 9, 25, 16]

    [C:\KAV2007\KAEUnpack.DAT]  [Kingsoft Corporation, 2008,01,25,202]

    [C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]

    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]

    [C:\WINDOWS\system32\Audiodev.dll]  [Microsoft Corporation, 5.2.3802.3802 built by: dnsrv(bld4act)]

[PID: 2308 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 2380 / new][C:\WINDOWS\system32\wscntfy.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 2708 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 2568 / new][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\AcSignIcon.dll]  [Autodesk, 16.2.54.0]

    [C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll]  [Thunder Networking Technologies,LTD, 1.0.5.29]

    [C:\KAV2007\KAVAFish.DLL]  [Kingsoft Corporation, 2006, 10, 25, 27]

    [C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 8, 96]

    [C:\Program Files\Thunder Network\Thunder\Components\ResWorker\DsBho_01.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 18]

    [C:\Program Files\Thunder Network\Thunder\Components\ResWorker\DataProcessor_01.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 16]

    [C:\Program Files\QQ2005\QQZoneHelper.dll]  [深圳市腾讯计算机系统有限公司, 1.1.0.1016]

    [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]

    [C:\KAV2007\KAScript.DLL]  [Kingsoft Corporation, 2007, 3, 6, 75]

    [C:\KAV2007\KAEPlat.DLL]  [Kingsoft Corp., 2007, 6, 19, 64]

    [C:\KAV2007\KAEMem.DAT]  [Kingsoft, 2006, 9, 25, 16]

    [C:\KAV2007\KAEUnpack.DAT]  [Kingsoft Corporation, 2008,01,25,202]

    [C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]

    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]

[PID: 3084 / new][C:\WINDOWS\system32\NOTEPAD.EXE]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 3836 / new][C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE]  [Microsoft Corporation, 11.0.6568]

    [C:\Program Files\Common Files\Microsoft Shared\office11\mso.dll]  [Microsoft Corporation, 11.0.6568]

    [C:\Program Files\Common Files\Microsoft Shared\office11\riched20.dll]  [Microsoft Corporation, 5.50.99.2010]

    [C:\KAV2007\KAOffice.DLL]  [Kingsoft Corporation, 2007, 8, 10, 38]

    [C:\WINDOWS\system32\MFC71.DLL]  [Microsoft Corporation, 7.10.3077.0]

    [C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]

    [C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]

    [C:\WINDOWS\system32\MFC71CHS.DLL]  [Microsoft Corporation, 7.10.3077.0]

    [C:\KAV2007\KAVIPC2.DLL]  [Kingsoft Corporation, 2007, 1, 15, 30]

    [C:\KAV2007\KAECall2.DLL]  [Kingsoft Corporation, 2004, 12, 28, 7]

    [C:\KAV2007\KAEPlat.DLL]  [Kingsoft Corp., 2007, 6, 19, 64]

    [C:\KAV2007\KAEMem.DAT]  [Kingsoft, 2006, 9, 25, 16]

    [C:\KAV2007\KAEUnpack.DAT]  [Kingsoft Corporation, 2008,01,25,202]

    [C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LVCMUI5C.DLL]  [Lenovo (Beijing) Ltd., 0,3,0,0]

    [C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LVCMSTRN.DLL]  [Lenovo (Beijing) Ltd., 1.0.1.14]

    [C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LVCMDR5C.DLL]  [Lenovo (Beijing) Ltd., 0,3,0,0]

    [C:\PROGRA~1\MICROS~2\OFFICE11\ADDINS\SYMINPUT.DLL]  [Microsoft Corporation, 1.02]

    [C:\WINDOWS\system32\MSVBVM60.DLL]  [Microsoft Corporation, 6.00.9690]

    [C:\WINDOWS\system32\VB6CHS.DLL]  [Microsoft Corporation, 6.00.8169]

    [C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\INTLNAME.DLL]  [Microsoft Corporation, 11.0.6467]

    [C:\Program Files\Common Files\Microsoft Shared\Smart Tag\CHDATEST.DLL]  [Microsoft Corporation, 2.00]

    [C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL]  [Microsoft Corporation, 11.0.5510]

    [C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\2052\stintl.dll]  [Microsoft Corporation, 11.0.5510]

    [C:\Program Files\Common Files\Microsoft Shared\PROOF\mslid.dll]  [Microsoft Corporation, 1.0.2305]

    [C:\Program Files\Common Files\Microsoft Shared\PROOF\1033\MSGR3EN.DLL]  [Microsoft Corporation, 3.1.7004]

    [C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FPERSON.DLL]  [Microsoft Corporation, 11.0.5510]

    [C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\MOFL.DLL]  [Microsoft Corporation, 11.0.5510]

    [C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSXML5.DLL]  [Microsoft Corporation, 5.10.2927.0]

    [C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FDATE.DLL]  [Microsoft Corporation, 11.0.5510]

    [C:\WINDOWS\system32\AcSignIcon.dll]  [Autodesk, 16.2.54.0]

    [C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll]  [Autodesk, 16.2.54.0]

[PID: 3120 / new][C:\Program Files\Thunder Network\Thunder\Program\Thunder5.exe]  [Thunder Networking Technologies,LTD, 5.7.9.472]

    [C:\Program Files\Thunder Network\Thunder\Program\BugReport.dll]  [Thunder Networking Technologies,LTD, 1, 2, 0, 15]

    [C:\Program Files\Thunder Network\Thunder\Program\TaskManager.dll]  [Thunder Networking Technologies,LTD, 1, 3, 4, 62]

    [C:\Program Files\Thunder Network\Thunder\Program\download_interface.dll]  [Thunder Networking Technologies,LTD, 3, 0, 2, 307]

    [C:\Program Files\Thunder Network\Thunder\Program\stlport_vc646.dll]  [STLport Consulting, Inc., 4.6.2003.1031]

    [C:\Program Files\Thunder Network\Thunder\Program\asyn_frame.dll]  [, 1, 0, 2, 7]

    [C:\Program Files\Thunder Network\Thunder\Program\backend_agent.dll]  [, 1, 0, 2, 11]

    [C:\Program Files\Thunder Network\Thunder\Program\ptl.dll]  [Thunder Networking Technologies, LTD, 1, 0, 2, 12]

    [C:\Program Files\Thunder Network\Thunder\Program\p2p_upload.dll]  [, 1, 0, 2, 7]

    [C:\Program Files\Thunder Network\Thunder\Program\fs.dll]  [, 1, 0, 2, 7]

    [C:\Program Files\Thunder Network\Thunder\Program\p2p.dll]  [, 1, 0, 2, 12]

    [C:\Program Files\Thunder Network\Thunder\Program\p2p_local_res.dll]  [, 1, 0, 2, 7]

    [C:\Program Files\Thunder Network\Thunder\Program\p2sp.dll]  [, 1, 0, 2, 13]

    [C:\Program Files\Thunder Network\Thunder\Program\down_dispatcher.dll]  [, 1, 0, 2, 12]

    [C:\Program Files\Thunder Network\Thunder\Program\xldc.dll]  [Thunder Networking Technologies,LTD, 1, 5, 2, 9]

    [C:\Program Files\Thunder Network\Thunder\Program\bd.dll]  [Thunder Networking Technologies,LTD, 1, 0, 2, 16]

    [C:\Program Files\Thunder Network\Thunder\Program\stream.dll]  [, 2, 0, 2, 308]

    [C:\Program Files\Thunder Network\Thunder\Program\al.dll]  [, 1, 1, 2, 9]

    [C:\Program Files\Thunder Network\Thunder\Program\emule_id.dll]  [, 1, 0, 2, 6]

    [C:\Program Files\Thunder Network\Thunder\Program\XLNet.Dll]  [Thunder Networking Technologies,LTD, 1, 4, 5, 21]

    [C:\Program Files\Thunder Network\Thunder\Program\BHOStub.dll]  [Thunder Networking Technologies,LTD, 1, 1, 1, 10]

    [C:\Program Files\Thunder Network\Thunder\Program\FloatBar.dll]  [Giganology Inc., 1, 0, 0, 2]

    [C:\Program Files\Thunder Network\Thunder\Components\DownAndPlay\DownAndPlay.dll]  [, 1, 0, 11, 29]

    [C:\KAV2007\KAScript.DLL]  [Kingsoft Corporation, 2007, 3, 6, 75]

    [C:\Program Files\Thunder Network\Thunder\Program\iTargetAD.dll]  [Thunder Networking Technologies,LTD, 1, 0, 3, 34]

    [C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]

    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]

    [C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL]  [Microsoft Corporation, 11.0.5510]

    [C:\WINDOWS\system32\AcSignIcon.dll]  [Autodesk, 16.2.54.0]

    [C:\Program Files\Thunder Network\Thunder\Components\InMedia\iEmbedShell.dll]  [　, 1, 0, 2, 24]

    [C:\Program Files\Thunder Network\Thunder\Components\InMedia\iEmbed16.dll]  [Thunder Networking Technologies,LTD, 3, 4, 7, 103]

    [C:\Program Files\Thunder Network\Thunder\Components\InMedia\PlayerHelper.dll]  [thunder, 1, 1, 5, 41]

    [C:\Program Files\Thunder Network\Thunder\Components\InMedia\XLIPC.DLL]  [Thunder Networking Technologies,LTD, 1, 0, 0, 2]

    [C:\Program Files\Thunder Network\Thunder\Components\P4PClient\P4PClient.dll]  [Thunder Networking Technologies,LTD, 2, 2, 5, 70]

    [C:\Program Files\Thunder Network\Thunder\Components\Community\XLCommunity.dll]  [Thunder Networking Technologies,LTD, 2, 0, 0, 31]

    [C:\Program Files\Thunder Network\Thunder\Program\RegisterDll.dll]  [Thunder Networking Technologies,LTD, 2, 17, 0, 67]

    [C:\Program Files\Thunder Network\Thunder\Program\MSVCIRT.dll]  [Microsoft Corporation, 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\Program Files\Thunder Network\Thunder\Components\Security\ThunderSafe.dll]  [深圳市迅雷网络技术有限公司, 1, 0, 7, 77]

    [C:\Program Files\Thunder Network\Thunder\Program\ATL71.DLL]  [Microsoft Corporation, 7.10.3077.0]

    [C:\Program Files\Thunder Network\Thunder\Components\Security\XLSafeUI.dll]  [深圳市迅雷网络技术有限公司, 1, 0, 7, 77]

    [C:\Program Files\Thunder Network\Thunder\Components\Search\XLSearch.dll]  [Thunder Networking Technologies,LTD, 1, 1, 6, 21]

    [C:\Program Files\Thunder Network\Thunder\Program\LiveUpdate.dll]  [Thunder Networking Technologies,LTD, 1, 2, 3, 25]

    [C:\Program Files\Thunder Network\Thunder\Plugins\XLSafeHost\XLSafeHost.dll]  [深圳市迅雷网络技术有限公司, 1, 0, 7, 59]

    [C:\Program Files\Thunder Network\Thunder\Plugins\XLSafeHost\ThunderKSAV\ThunderKSAV.dll]  [N/A, ]

    [C:\Program Files\Thunder Network\Thunder\Plugins\XLSafeHost\ThunderKSAV\bin\XLScan.dll]  [Kingsoft Corporation, 2007,09,27,2]

    [C:\Program Files\Thunder Network\Thunder\Plugins\BhoAdv\bho_adv.dll]  [深圳市迅雷网络技术有限公司, 1.0.1.0]

    [C:\Program Files\Thunder Network\Thunder\Plugins\KanKanTop\KanKanTop.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 4]

    [C:\Program Files\Thunder Network\Thunder\Components\ExplorerHelper\ExplorerHelper.dll]  [Thunder Networking Technologies,LTD, 1, 0, 4, 18]

    [C:\Program Files\Thunder Network\Thunder\ComDlls\ThunderAgent_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 4, 23]

    [C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 8, 96]

    [C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll]  [Thunder Networking Technologies,LTD, 1.0.5.29]

    [C:\Program Files\Thunder Network\Thunder\Components\Tips\TipsClient.dll]  [Thunder Networking Technologies,LTD, 2, 2, 11, 106]

    [C:\Program Files\Thunder Network\Thunder\Components\VPSHELL\VPSHELL.dll]  [迅雷网络, 3, 0, 1, 33]

    [C:\Program Files\Thunder Network\Thunder\Components\UserExperience\UserExperience.dll]  [Thunder Networking Technologies,LTD, 1, 0, 1, 3]

    [C:\Program Files\Thunder Network\Thunder\Components\ResWorker\DsXlCom.dll]  [, 1, 0, 0, 29]

    [C:\Program Files\Thunder Network\Thunder\Components\ResWorker\DataProcessor_01.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 16]

    [C:\Program Files\Thunder Network\Thunder\Components\ResWorker\MediaWorker.dll]  [Thunder Networking Technologies,LTD, 1, 2, 0, 22]

    [C:\Program Files\Thunder Network\Thunder\Components\DownloadStat\DownloadStat.dll]  [Thunder Networking Technologies,LTD, 1, 4, 1, 6]

    [C:\Program Files\Thunder Network\Thunder\Components\Tips\XLIPC.DLL]  [Thunder Networking Technologies,LTD, 1, 0, 0, 2]

[PID: 2832 / new][C:\Documents and Settings\new\桌面\sreng2\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]

    [C:\Documents and Settings\new\桌面\sreng2\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]



==================================

文件关联

.TXT  Error. [NOTEPAD.EXE %1]

.EXE  OK. ["%1" %*]

.COM  OK. ["%1" %*]

.PIF  OK. ["%1" %*]

.REG  OK. [regedit.exe "%1"]

.BAT  OK. ["%1" %*]

.SCR  Error. [AutoCADScriptFile]

.CHM  OK. ["C:\WINDOWS\hh.exe" %1]

.HLP  Error. [winhlp32.exe %1]

.INI  Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]

.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]

.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]

.JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]

.LNK  OK. [{00021401-0000-0000-C000-000000000046}]



==================================

Winsock 提供者

N/A



==================================

Autorun.inf

N/A



==================================

HOSTS 文件

127.0.0.1       localhost



==================================

进程特权扫描

特殊特权被允许： SeDebugPrivilege [PID = 212, F:\QQKAV.EXE]

特殊特权被允许： SeLoadDriverPrivilege [PID = 212, F:\QQKAV.EXE]

特殊特权被允许： SeLoadDriverPrivilege [PID = 292, C:\KAV2007\KPFW32.EXE]

特殊特权被允许： SeDebugPrivilege [PID = 3120, C:\PROGRAM FILES\THUNDER NETWORK\THUNDER\PROGRAM\THUNDER5.EXE]

特殊特权被允许： SeLoadDriverPrivilege [PID = 3120, C:\PROGRAM FILES\THUNDER NETWORK\THUNDER\PROGRAM\THUNDER5.EXE]



==================================

API HOOK

N/A



==================================

隐藏进程

N/A



==================================

TOP

byxxdrls

爱毒霸社区缉毒队

积分: 442
威望: 938
元宝: 5
铜钱: 620

5楼大中小发表于 2008-7-22 09:05 只看该作者

1.建议使用金山删除工具删除以下文件
ezcronk.exe（路径自己找吧）
c:\windows\system32\hbkrnl.dll
c:\windows\system32\drivers\msosmsfpfis64.sys
c:\windows\system32\drivers\hbkernel.sys
c:\docume~1\new\locals~1\temp\tmpc.tmp

2.删除重启后使用SREng修复下面各项：

启动项目－－注册表之如下项删除：
[HB Kernel] <RUNDLL32.EXE C:\WINDOWS\system32\HBKrnl.dll,DllRegisterServer>

启动项目－－服务－－驱动程序之如下项禁用：
[msfpfis64 / msfpfis64] <\??\C:\WINDOWS\system32\drivers\msosmsfpfis64.sys>
[HBKernel Driver / HBKernel] <\??\C:\WINDOWS\system32\drivers\HBKernel.sys>
[dohs / dohs] <\??\C:\DOCUME~1\new\LOCALS~1\Temp\tmpC.tmp>

**************以上分析报告由SREngLog分析助手提供******************
分析：byxxdrls
时间：2008-7-22
SREngLog分析助手 1.3 (20070808 更新 BY 草莽书生)

TOP

‹‹ 上一主题 | 下一主题 ››