在这里

独恋伊影

1. 
   3 k3 _  |/ \0 n4 m
2. 2008-05-22,20:37:43
   
3. System Repair Engineer 2.5.16.900
   
4. Smallfrogs (http://www.KZTechs.com)
   
5. Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
   8 i/ \- w: l6 Y. a! d& b6 P. a2 C
6. 以下内容被选中：
   / k& Z' w! s& h1 X, k, b
7.     所有的启动项目（包括注册表、启动文件夹、服务等）
   
8.     浏览器加载项
   
9.     正在运行的进程（包括进程模块信息）
   
10.     文件关联
    
11.     Winsock 提供者
    
12.     Autorun.inf
    
13.     HOSTS 文件
    5 j+ A/ ]6 R+ @6 l2 K/ `1 \0 v$ X: {
14.     进程特权扫描
    
15. 
    - B8 d( @) C3 S7 Q9 Q1 i  h
16. 启动项目
    / h9 k; o2 G( V- Y* w
17. 注册表
    4 b% t5 |6 z8 e, N
18. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    4 V2 Y6 l2 y8 Z) C1 f) T
19.     <ctfmon.exe><C:\WINDOWS\system32\CTFMON.EXE>  [(Verified)Microsoft Windows Publisher]
    / m, y7 X$ v5 `+ [
20. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    
21.     <360Safebox><"C:\Program Files\360Safebox\safeboxTray.exe" /r>  [(Verified)Qizhi Software (beijing) Co. Ltd]
    ( }% h; O" C+ c6 k
22.     <360Safetray><C:\Program Files\360safe\safemon\360tray.exe /start>  [(Verified)Qizhi Software (beijing) Co. Ltd]
    1 F3 D# z+ M  F, l7 ^
23.     <360Antiarp><C:\Program Files\360safe\AntiArp\AntiArp.exe /start>  [(Verified)Qizhi Software (beijing) Co. Ltd]
    8 L6 i$ [( _8 v$ k3 n
24.     <KavStart><"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVStart.exe" -startup>  [(Verified)KINGSOFT CORPORATION]
    + {, E8 a7 k) W2 f5 V: o( A
25.     <IMJPMIG8.1><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32>  [N/A]
    
26.     <PHIME2002A><; >  [N/A]
    
27.     <PHIME2002ASync><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32>  [N/A]
    : _5 [( V1 `4 |5 M6 N
28. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    
29.     <shell><Explorer.exe>  [(Verified)Microsoft Windows Component Publisher]
    * S$ N# S1 ~# i4 j+ @" D
30.     <Userinit><C:\WINDOWS\system32\UserInit.exe,>  [(Verified)Microsoft Windows Publisher]
    3 }+ v8 d  u+ a* ^  B1 f
31.     <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
    
32. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    
33.     <{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}><C:\WINDOWS\system32\shlhook.dll>  [Beijing Rising Technology Co., Ltd.]
    
34. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
    7 G+ m6 \; x; A3 }  Z9 v
35.     <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [N/A]
    
36. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
    
37.     <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]
    9 l4 |: v% Z5 ?
38. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
    
39.     <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]
    
40. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
    4 ?( v1 ~7 ~+ W' E2 e- H! O
41.     <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
    
42. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
    
43.     <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Remove.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
    
44. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
    
45.     <Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser>  [(Verified)Microsoft Windows Publisher]
    0 v& @: b7 c+ s* n6 i4 v
46. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
    1 n$ E3 x# H, o1 l+ m! L: g
47.     <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub>  [(Verified)Microsoft Windows Publisher]
    $ J* b8 ~$ y# ?1 q8 l  U% d
48. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
    ! Y7 @% n4 |2 z# p% F
49.     <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]
    
50. ==================================
    + F9 t: i% S: S! w( h0 M# h" m
51. 启动文件夹
    
52. N/A
    9 C+ s% z  t1 g: F& J4 @
53. ==================================
      }( A4 E# F4 R" ?! [
54. 服务
    - D! s; u  m; d" H
55. [3ware Controller Service / 3wareSrv][Stopped/Auto Start]
    : \- C) W; I6 B* U) A( u
56.   <C:\WINDOWS\System32\3wareSrv.exe><N/A>
    
57. [Google Updater Service / gusvc][Stopped/Manual Start]
      r4 D. x& u8 f; D) ^( |3 t
58.   <"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"><Google>
    - A* S( J# ]. Q0 a; \& z
59. [Help and Support / helpsvc][Stopped/Disabled]
    2 I+ k5 U8 I+ f1 n6 N# d
60.   <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll><N/A>
    5 h( h/ z+ f9 a5 z% ?, ~
61. [Human Interface Device Access / HidServ][Stopped/Boot Start]
    
62.   <\SystemRoot\C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
    + u5 \5 d* b8 X6 P% ~
63. [Kingsoft Internet Security Common Service / KISSvc][Stopped/Auto Start]
    
64.   <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KISSvc.EXE><Kingsoft Corporation>
    
65. [Kingsoft Personal Firewall Service / KPfwSvc][Running/Auto Start]
    
66.   <"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KPfwSvc.EXE"><Kingsoft Corporation>
    & Z; {  v4 o0 j' H
67. [Kingsoft Antivirus KWatch Service / KWatchSvc][Running/Auto Start]
    2 x' ]: e- l1 r( D
68.   <"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KWatch.EXE"><Kingsoft Corporation>
    
69. [NetMeeting Remote Desktop Sharing / mnmsrvc][Stopped/Manual Start]
    5 q1 T1 J9 M+ T
70.   <><N/A>
    
71. [Qvod Terminal / Qvod Terminal][Running/Auto Start]
    . v% A& a' a: X6 X
72.   <C:\Program Files\QvodPlayer\QvodTerminal.exe><Shenzhen QVOD Technology Co.,Ltd>
    2 S# p5 p6 m  D7 n6 F1 n
73. ==================================
    
74. 驱动程序
    
75. [22j / 22jn][Stopped/Boot Start]
    , z4 w( T- V  L# t8 Z5 v
76.   <\SystemRoot\System32\DRIVERS\22jn.sys><N/A>
    
77. [360AntiArp / 360AntiArp][Running/System Start]
    ' @# @: k/ @, K3 q) P) U; @- f
78.   <\??\C:\WINDOWS\system32\drivers\360AntiArp.sys><360安全中心>
    ! }5 H& X. D. c& A" ^' K
79. [43ec / 43ecu][Stopped/Boot Start]
    5 i0 b" t1 b/ g% Z; ^
80.   <\SystemRoot\System32\DRIVERS\43ecu.sys><N/A>
    
81. [Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Running/Manual Start]
    + D: s1 W% n2 e% J% D
82.   <system32\drivers\ac97intc.sys><Intel Corporation>
    
83. [Promise driver accelerator / bb-run][Running/Boot Start]
    6 E9 Q* G' B2 _3 U$ h4 n
84.   <\SystemRoot\system32\DRIVERS\bb-run.sys><Promise Technology, Inc.>
    9 s8 S# D' h6 L. a; T' T
85. [Promise Removable Disk Control Driver / dontgo][Running/Boot Start]
    . I9 S, ]& W2 h4 r
86.   <\SystemRoot\system32\DRIVERS\DontGo.sys><Promise Technology, Inc.>
    
87. [KAVBase / KAVBase][Running/Auto Start]
    , f9 c4 x: B" I* z  {
88.   <\??\C:\WINDOWS\system32\Drivers\KAVBase.sys><Kingsoft Corporation>
    
89. [KAVBootC / KAVBootC][Running/Boot Start]
    1 o% s" [! Z' p- w
90.   <\SystemRoot\system32\Drivers\KAVBootC.sys><Kingsoft Corporation>
    
91. [KAVSafe / KAVSafe][Running/Auto Start]
    % i  o5 S  `! B8 x! m% S
92.   <\??\C:\WINDOWS\system32\Drivers\KAVSafe.sys><Kingsoft Corporation>
    
93. [KNetWch / KNetWch][Running/System Start]
    : H" ~/ M) Q0 B# _. i
94.   <\??\C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KNetWch.SYS><Kingsoft Corporation>
    
95. [KWatch3 / KWatch3][Running/Auto Start]
    3 {+ Q+ r- T# b2 \8 j
96.   <\??\C:\WINDOWS\system32\drivers\KWatch3.SYS><Kingsoft Corporation>
    
97. [ntptdb / ntptdb][Stopped/Auto Start]
    % v4 Z6 t9 m4 b3 ~- i
98.   <\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys><N/A>
    ' A3 U. N7 ]* a, {5 H+ W6 k: a7 a
99. [nv / nv][Running/Manual Start]
    ! ?( M1 J9 Z; P, q" }! _
100.   <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
     3 G. W2 j8 `0 f; y
101. [NVIDIA nForce RAID Driver / nvrd32][Running/Boot Start]
     
102.   <\SystemRoot\system32\DRIVERS\nvrd32.sys><NVIDIA Corporation>
     
103. [DDK PACKET Protocol / Packet][Running/Manual Start]
     7 c  F5 ^8 T; H4 p# D5 z5 y
104.   <system32\DRIVERS\ProtoDrv.sys><360安全中心>
     - T0 u; J5 m$ o) c
105. [pnduojtwbt / pnduojtwbt][Stopped/Boot Start]
       c  m, r( F: H- |8 D6 k# B
106.   <\SystemRoot\system32\drivers\pnduojtwbt.sys><N/A>
     7 {+ [( F- q* {% k$ E; p9 ]
107. [Direct Parallel Link Driver / Ptilink][Running/Manual Start]
     
108.   <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
     * {5 J2 z9 g! H% k- I7 b
109. [RsAntiSpyware / RsAntiSpyware][Stopped/Boot Start]
     + V5 N5 I3 ~/ B$ J2 r
110.   <\SystemRoot\system32\drivers\RsBoot.sys><N/A>
     ' A1 C5 p7 r0 _: Z( d) |, B
111. [Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
       `- ^9 M+ n( v$ N& d& |1 u9 d
112.   <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
     
113. [SafeBoxKrnl / SafeBoxKrnl][Running/System Start]
     
114.   <\??\C:\Program Files\360Safebox\SafeBoxKrnl.sys><360安全中心>
     
115. [Secdrv / Secdrv][Stopped/Manual Start]
     5 o9 N3 C- E" b" P) u# Y. h
116.   <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
     $ o) j: ?2 s: g1 J
117. [SATALink External Device Filter / SiRemFil][Running/Boot Start]
     
118.   <\SystemRoot\system32\DRIVERS\SiRemFil.sys><Silicon Image, Inc.>
     # c: O  z- u$ |+ I' R; V
119. [System Restore Filter Driver / sr][Stopped/Disabled]
     
120.   <system32\DRIVERS\sr.sys><N/A>
     
121. [TesSafe / TesSafe][Stopped/Manual Start]
     - ?# I: w! v* h- l  F! {
122.   <\??\C:\WINDOWS\system32\TesSafe.sys><TENCENT>
     
123. [System Services / unzxzsrs][Stopped/Boot Start]
     
124.   <\SystemRoot\system32\drivers\unzxzsrs.sys><N/A>
     / n. e2 _& G! j5 v) C
125. [ViBus / ViBus][Stopped/Boot Start]
     ! S% k6 X0 z7 X" a+ I9 H, M
126.   <\SystemRoot\system32\DRIVERS\ViBus.sys><N/A>
     
127. [World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
     
128.   <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
     ) P( {2 r2 E( T2 X& u
129. [VIA SATA IDE Hot-plug Driver / xfilt][Running/Boot Start]
     
130.   <\SystemRoot\system32\DRIVERS\xfilt.sys><VIA Technologies,Inc>
     
131. [ATI Extend / zhibmaso][Stopped/Boot Start]
     : u5 T$ b' @9 g( S, J, Y* j" V" Z' N
132.   <\SystemRoot\system32\drivers\zhibmaso.sys><N/A>
     8 b: O# q7 ~' f0 |* w# X$ h
133. [Vimicro USB PC Camera (ZC0301PL) / ZSMC301b][Running/Manual Start]
     
134.   <System32\Drivers\usbVM31b.sys><Vimicro Corporation>
     
135. ==================================
     * z( N& _+ @' O7 y& u- y) r
136. 浏览器加载项
     6 I* \. X) T5 }
137. [Google Toolbar Helper]
     / b! P. K2 V  H- D9 {
138.   {AA58ED58-01DD-4d91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     2 ]5 M/ Y% c* U5 r
139. [Google Toolbar Notifier BHO]
     - E* A: A' B1 r2 e( k1 g
140.   {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>
     
141. [SafeMon Class]
     
142.   {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>
     
143. [kingsoft browser shield]
     
144.   {D963BE1A-6B35-47DB-B002-49FAE71D85CC} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL, Kingsoft Corporation>
     0 `3 o3 k4 d, Y. L* E9 Q
145. [IEBuddyExtControl Class]
     
146.   {3AECD3C1-7085-4731-96DC-47B6CF7EF749} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL, Kingsoft Corporation>
       y  }# {/ _5 O
147. [Zcom 杂志]
     2 A) d/ R  A" @
148.   {4045D313-1D5E-4fe4-93A0-A34630B6A00B} <C:\Zcom\E-Space.exe, N/A>
     0 z7 g! W* ~$ L1 Y% a6 W
149. [&Google]
     
150.   {2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     
151. [KooPlayer Control]
     
152.   {C728DAB8-FDF5-4CD7-89DD-879D25794C77} <C:\WINDOWS\system32\CCTVKO~1.OCX, Koos>
     
153. [Shockwave Flash Object]
     7 U8 u9 q% t3 E9 V
154.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>
     9 T7 O  A7 o  l6 T
155. [KUpdateObj2 Class]
     + N' U5 Z% H; `# [
156.   {D82303B7-A754-4DCB-8AFC-8CF99435AACE} <C:\WINDOWS\system32\KingSoft\KOS\UpdateOcx2.dll, Kingsoft Corporation>
     
157. [Google Script Object]
     
158.   {00EF2092-6AC5-47C0-BD25-CF2D5D657FEB} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     + ^5 d+ G/ M0 h! P) k
159. [EWA Control]
     
160.   {18226BF8-DC0B-4D81-80E9-A41AE37BB73A} <C:\PROGRA~1\PPLive\SYNACA~2.OCX, Synacast>
     
161. [Windows Media Player]
     
162.   {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\msdxm.ocx, Microsoft Corporation>
     
163. [&Google]
     
164.   {2318C2B1-4965-11D4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     
165. [HTML Document]
     
166.   {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
     
167. [DHTML Edit Control Safe for Scripting for IE5]
     
168.   {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
     1 l3 u! ^/ m" d7 R
169. [RealPlayer RAM Download Handler]
     6 `3 b6 o3 [- I3 v4 _1 W
170.   {2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
     # y& X; d& l& V
171. [IEBuddyExtControl Class]
     . p* c) N. ^7 Z- _
172.   {3AECD3C1-7085-4731-96DC-47B6CF7EF749} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL, Kingsoft Corporation>
     
173. [XML Document]
     
174.   {48123BC4-99D9-11D1-A6B3-00C04FD91555} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
     
175. [HHCtrl Object]
     ) v7 z+ O1 L, ^" r+ e
176.   {52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
     
177. [Windows Media Player]
     
178.   {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     4 ?3 }6 H% G, g; B" I6 i% m9 A
179. [Active Desktop Mover]
     
180.   {72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
     
181. [360SafeLive]
     ) t  y3 L$ j. i/ `5 C! J' f1 f
182.   {87515F61-A66C-4319-A0E0-D416CB8059E3} <C:\Program Files\360safe\live.dll, 360.cn>
     . i, K6 v1 k, u1 h
183. [Microsoft Web 浏览器]
     ) t2 A2 b$ W5 v* z. s# }, P1 Z
184.   {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
     8 _- Z+ E0 e8 h1 L! P8 G" D, |( H/ a
185. [Browser Enhanced Objects]
     
186.   {986488AF-13D5-9DDF-4FEF-9FB88698CFC1} <C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\USERDATA\webbrowser_2011.dll, N/A>
     % v" N# z6 g0 l; Y5 W0 w
187. [Google Toolbar Helper]
     1 {+ W; R& V: W( a: A1 E2 Q/ _
188.   {AA58ED58-01DD-4D91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     $ c7 m! A" C: r  d8 g  P
189. [Microsoft Scriptlet Component]
     0 T, \' N* w$ v9 W& b6 I: V  _
190.   {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
     
191. [Google Toolbar Notifier BHO]
     
192.   {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>
     
193. [SearchAssistantOC]
     
194.   {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
     2 V6 v+ {$ r# F- s" S$ m
195. [SafeMon Class]
     0 u: f6 ]" T; a$ D' u
196.   {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>
     ) ^6 ^0 O- a9 I; h$ w) _
197. [RDS.DataSpace]
     
198.   {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
     . B4 j9 f& S( H( G: x
199. [KooPlayer Control]
     
200.   {C728DAB8-FDF5-4CD7-89DD-879D25794C77} <C:\WINDOWS\system32\CCTVKO~1.OCX, Koos>
     
201. [AUDIO__MID Moniker Class]
     : r% n5 @& E$ H6 A9 @9 x2 U
202.   {CD3AFA74-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     
203. [AUDIO__MP3 Moniker Class]
     ( a  m7 G0 v0 E
204.   {CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     
205. [AUDIO__X_MS_WMA Moniker Class]
     
206.   {CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     5 i& v$ F3 I3 l/ n' x" @- n; e3 n
207. [VIDEO__X_MS_WMV Moniker Class]
     6 |1 j: u3 S2 K7 @" u0 I* T4 `5 `
208.   {CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
       _% \* F/ U; X7 _/ T
209. [RealPlayer G2 Control]
     # W4 R( P7 `; r% |6 w, E$ Q
210.   {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
     
211. [Shockwave Flash Object]
     9 N2 h5 v- V  I# ~
212.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>
     
213. [KUpdateObj2 Class]
     " M/ h( `  _  x" E2 `
214.   {D82303B7-A754-4DCB-8AFC-8CF99435AACE} <C:\WINDOWS\system32\KingSoft\KOS\UpdateOcx2.dll, Kingsoft Corporation>
     
215. [kingsoft browser shield]
     " ]6 y- L) t6 i3 w$ o( Y* N* L
216.   {D963BE1A-6B35-47DB-B002-49FAE71D85CC} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL, Kingsoft Corporation>
     & j' e7 {7 L5 E+ s# W3 e" D) G1 `8 }
217. [PasswordEditCtrl Class]
     % S& f- e1 U; }( v/ n4 |, t
218.   {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
     6 [+ r5 `1 k; h+ z0 m: S2 H, G
219. [QvodCtrl Class]
     
220.   {F3D0D36F-23F8-4682-A195-74C92B03D4AF} <C:\Program Files\QvodPlayer\QvodInsert.dll, Shenzhen QVOD Technology Co.,Ltd>
     2 n$ f+ v8 \" c
221. [&使用超级旋风下载]
     ( D9 k; B0 u  {: ~0 y
222.   <C:\Program Files\Tencent\QQDownload\geturl.htm, N/A>
     
223. [&使用超级旋风下载全部链接]
     
224.   <C:\Program Files\Tencent\QQDownload\getAllurl.htm, N/A>
     
225. [使用迅雷下载]
     
226.   <, N/A>
     
227. [使用迅雷下载全部链接]
     
228.   <, N/A>
     
229. [导出到 Microsoft Office Excel(&X)]
     % j& O; S9 R; {- \; b2 ], h
230.   <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
     5 B. A  m0 F5 F3 \: D
231. [添加到QQ表情]
     : O; ]. N0 [! w& {; ^" S
232.   <C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
     
233. ==================================
     - ^% b9 Y' @1 c' i* W  y
234. 正在运行的进程
     % R" c& Z/ Y% q, j
235. [PID: 444 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     / e. ~& G: L1 {6 }
236. [PID: 496 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     . N0 }  t+ J% ~6 X. ?
237. [PID: 520 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     % V1 f# p( P& e- H
238.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
     & U4 E' {( [3 ?; x0 W
239. [PID: 564 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
240. [PID: 576 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     ) U8 \' i1 o, j
241. [PID: 720 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     # o( {6 A; Z+ P, v8 G, \; ]
242. [PID: 780 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     * A8 m3 ^" ?: ?- J* D  x
243. [PID: 856 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
244. [PID: 944 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
245. [PID: 1012 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
246. [PID: 1236 / Administrator][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_qfe.070613-1311)]
     , w7 T1 ?! y& ^2 T7 P
247.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     1 H! ]- S( R/ G5 p
248.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     . ?8 P0 e' i% X) ]8 T* J
249.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
     
250.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     
251.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVEXT.DLL]  [Kingsoft Corporation, 2008,05,07,373]
     7 @& |6 \  f, o$ f8 v* l8 j
252.     [C:\Program Files\Tencent\QQ\qdshm.dll]  [, 1, 0, 101, 20]
     $ C7 U7 ?0 d0 o* }
253.     [C:\Program Files\Tencent\QQ\MFC42.DLL]  [Microsoft Corporation, 6.00.8665.0]
     ' ]* g% y) i2 Y# \
254.     [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
     
255.     [C:\WINDOWS\system32\shlhook.dll]  [Beijing Rising Technology Co., Ltd., 4.0.0.9]
     
256.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     , x, j9 X$ B6 q9 d# P5 |
257.     [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
     . B+ {2 [! C2 Y, l
258. [PID: 1332 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
     ( p, @7 P/ @/ ]" B9 w( a
259.     [C:\WINDOWS\system32\mdimon.dll]  [Microsoft Corporation, 11.3.8166.2]
     
260.     [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll]  [Microsoft Corporation, 11.3.8166.2]
     
261. [PID: 1540 / Administrator][C:\Program Files\360safe\AntiArp\AntiArp.exe]  [360安全中心, 2, 0, 0, 1008]
     
262.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     
263.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     6 q( W) W. q1 I; ]4 c! d+ b
264.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     , N3 A# J4 ]3 a4 c
265.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
266. [PID: 1560 / Administrator][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
267.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     % H  L: n1 h4 ~; c
268.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
269.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
270. [PID: 1576 / Administrator][C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe]  [Google Inc., 2, 0, 301, 1654]
     
271.     [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\gtn.dll]  [Google Inc., 2, 0, 301, 7164]
     : l( z+ q0 a: i* u- g4 {
272.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     
273.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
274.     [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\res_zh-CN.dll]  [Google Inc., 2, 0, 301, 7164]
     # L( U9 `( H" q3 p. M/ Q4 D
275.     [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll]  [Google Inc., 2, 0, 301, 7164]
     
276.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     
277.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     2 u4 s$ R; o7 j7 ~/ D5 P, |
278. [PID: 1648 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     " |' K9 S- r& C, T( C- r2 K
279. [PID: 1744 / SYSTEM][C:\Program Files\QvodPlayer\QvodTerminal.exe]  [Shenzhen QVOD Technology Co.,Ltd, 2, 5, 0, 53]
     * h' ?/ z% k, x6 O
280. [PID: 1860 / SYSTEM][C:\WINDOWS\system32\skeys.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
281. [PID: 1908 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
282. [PID: 1964 / LOCAL SERVICE][C:\WINDOWS\system32\wdfmgr.exe]  [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
     
283. [PID: 2772 / Administrator][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
     ( E6 w# g) N" _( T
284.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     - S6 t: t' U6 q& n
285.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     ; ^! J9 a, ?' K6 B2 F6 P
286.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
287.     [c:\program files\google\googletoolbar2.dll]  [Google Inc., 4, 0, 1606, 6690]
     : p, u& o: y/ \! [+ ]
288.     [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll]  [Google Inc., 2, 0, 301, 7164]
     . V0 I" t3 k0 T* F  Q+ ]- e3 C$ Q
289.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL]  [Kingsoft Corporation, 2008,04,15,2]
     0 Y, `: D  ^) W& Q7 O4 z
290.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddy.dll]  [Kingsoft Corporation, 2008,04,15,2]
     
291.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL]  [Kingsoft Corporation, 2008,05,14,83]
     
292.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KANTray.dll]  [Kingsoft Corporation, 2008,04,15,2]
     
293.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVAFish.DLL]  [Kingsoft Corporation, 2008,05,13,78]
     . x3 Q, c4 h7 G4 v# S
294.     [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
     5 Z6 a5 p2 S! v/ M
295.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
     . R- m# W& h& E0 l% A6 q7 U/ N
296.     [C:\WINDOWS\system32\WN.IME]  [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
     , c( a3 h7 a( A
297.     [C:\Program Files\ShiQiang\wnime\Dll32\wnpy_StatusWnd.dll]  [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
     7 e! y3 x* U$ S( |$ |6 Q
298.     [C:\Program Files\ShiQiang\wnime\Dll32\wnpy_CompWnd.dll]  [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
     
299.     [C:\Program Files\ShiQiang\wnime\Dll32\wnpy_Query.dll]  [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
     
300.     [C:\WINDOWS\system32\SOGOUPY.IME]  [Sogou.com Inc., 3.2.0.0]
     
301.     [C:\Documents and Settings\Administrator\My Documents\SogouInput\Plugin\SgImeWord.dll]  [Sogou.com Inc., 3.2.0.0]
     
302.     [C:\WINDOWS\system32\WINWB98.IME]  [Microsoft Corporation, 4.00.950]
     
303.     [C:\WINDOWS\system32\WINWB86.IME]  [Microsoft Corporation, 4.00.950]
     
304.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     5 i" n3 w! D/ L' b
305. [PID: 1124 / Administrator][C:\Program Files\Tencent\QQ\TXPlatform.exe]  [Tencent, 1, 0, 170, 0]
     
306.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     8 _* j. Q- }9 A
307.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     
308.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     $ W: H( D* A7 c0 M8 y
309.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     / a1 f6 \& A) r, R6 M$ Z
310. [PID: 928 / Administrator][F:\arvmon.exe]  [任软工作室, 2.2.5.201]
     
311.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     
312.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     & @# }: N2 s+ s5 z8 \
313.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
314.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
315.     [F:\Vdata.dll]  [任软工作室, 2, 2, 1, 94]
     ( ]+ q5 X9 n* @$ q
316. [PID: 2540 / Administrator][F:\AutoGuarder.exe]  [任软工作室, 2.2.5.201]
     
317.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     
318.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     5 u, Z% P# f  U8 I1 }! b
319.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
320.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     ! g5 \( G* V1 c  @0 A6 c" Z
321. [PID: 2476 / Administrator][d:\我的文档\桌面\系统检测修复\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
     
322.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     ) t4 j8 {( D* Q0 b
323.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     
324.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
325.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     ( u. s- _% A4 ^% i
326.     [d:\我的文档\桌面\系统检测修复\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]
     
327. ==================================
     
328. 文件关联
     1 l! ]' h$ t6 z& c& v
329. .TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
     
330. .EXE  OK. ["%1" %*]
     
331. .COM  OK. ["%1" %*]
     
332. .PIF  OK. ["%1" %*]
     
333. .REG  OK. [regedit.exe "%1"]
     
334. .BAT  OK. ["%1" %*]
     : s# C6 a4 v! M4 R% G  i) R& ~
335. .SCR  OK. ["%1" /S]
     
336. .CHM  OK. ["C:\WINDOWS\hh.exe" %1]
     
337. .HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
     ( G: n( K+ `5 _8 x4 c
338. .INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
     
339. .INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
     : w9 Q! l& V6 }$ s* e
340. .VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
     % }$ Q9 Z1 m5 @! C& A
341. .JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
     
342. .LNK  OK. [{00021401-0000-0000-C000-000000000046}]
     5 J( [! p$ P' k/ J6 [! @
343. ==================================
     
344. Winsock 提供者
     
345. N/A
     % `# q& ]0 c' K' p/ A+ f* C; y2 l
346. ==================================
     
347. Autorun.inf
     4 z# z7 O0 X( N( l2 \
348. N/A
     
349. ==================================
     % N* ^7 @# T4 M
350. HOSTS 文件
     0 f. u0 e& F- v$ R3 y  m
351. N/A
     
352. ==================================
     
353. 进程特权扫描
     
354. 特殊特权被允许： SeLoadDriverPrivilege [PID = 520, C:\WINDOWS\SYSTEM32\WINLOGON.EXE]
     9 t8 j+ e  \% U# ]
355. 特殊特权被允许： SeDebugPrivilege [PID = 928, F:\ARVMON.EXE]
     
356. 特殊特权被允许： SeLoadDriverPrivilege [PID = 928, F:\ARVMON.EXE]
     $ e4 d4 A; K; n) R& n# _; \# M
357. 特殊特权被允许： SeDebugPrivilege [PID = 2540, F:\AUTOGUARDER.EXE]
     , B1 [; e7 D, }6 `, u6 E0 i
358. 特殊特权被允许： SeLoadDriverPrivilege [PID = 2540, F:\AUTOGUARDER.EXE]
     # |5 r0 Y1 b" d/ B! j- G
359. ==================================
     + S% a1 v+ g* g9 o0 ?# g$ |) Y, E
360. API HOOK
     
361. N/A
     $ A' M5 v& |6 R0 W
362. ==================================
     
363. 隐藏进程
     ( U+ ?( G3 U2 R& W3 H6 ~
364. N/A
     
365. ==================================
     9 M5 s# v- _% O+ A: s* x: T! u
366. 
     

复制代码

傲天♂扬帆

跟原始说了，不知道能不能看明白。。。

傲天♂元始

[Start]
4 X- N# G  Y4 T# m' }1 e; g9 i
2008-05-22,22:24:21

SREngLOG智能分析专家 V1.2.0.125
Tored (http://hi.baidu.com/peaset)

7 ~& @6 B8 ?$ m5 t5 b' {# T# r4 T9 m) S3 a8 S======================================================
7 g, R9 L: e/ R$ m% }4 \以下过程将用到SREng、PowerRmv，如果您不熟悉这两款工具的使用方法，请参考下列链接：
9 ~, B" w" J% Z( T4 u$ ]SREng详细操作方法： http://hi.baidu.com/peaset/blog/ ... dd19224e4aeadf.html
, W4 ]/ y. i& ^6 \. t, OPowerRmv详细操作方法： http://hi.baidu.com/peaset/blog/ ... 6fb5eb77c63816.html
======================================================
: {# F) P5 u* o$ {# j. l; j. f! g
& h6 P/ l3 U$ a4 F以下是病毒清除步骤：

1、用PowerRmv删除以下文件(没有则跳过)：

; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
7 q9 S4 e8 B! J5 q;
0 ^$ r5 c9 s( o! c1 s. ]& @; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
C:\WINDOWS\System32\3wareSrv.exe
\SystemRoot\C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll
4 v  B3 ?1 g! ~9 n: R
' y2 r( k: T! e; v1 C, ?; b9 y2 E3 J\SystemRoot\System32\DRIVERS\22jn.sys
- ?8 d  z: u% G- |" L\SystemRoot\System32\DRIVERS\43ecu.sys
' D) A: v3 M8 T/ T+ }8 p2 [\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys
\SystemRoot\system32\drivers\pnduojtwbt.sys
: a% e8 I) v# `4 ~: m' t\SystemRoot\system32\drivers\RsBoot.sys
system32\DRIVERS\sr.sys
' V5 A$ P. j6 B# G. }0 |\SystemRoot\system32\drivers\unzxzsrs.sys
\SystemRoot\system32\DRIVERS\ViBus.sys
" a. Q& v: M# x% |\SystemRoot\system32\drivers\zhibmaso.sys

2、用SREng删除以下【注册表】项(没有则跳过)：

<IMJPMIG8.1>
<PHIME2002A>
<PHIME2002ASync>
2 t& V; ]$ r4 d2 S$ a: w: y$ H/ X2 M' k/ K
  P) w" S+ b8 k2 W) k! s; E3、用SREng删除【所有启动文件夹】内容(没有则跳过)
) K0 [6 `7 ]$ U4 X8 p3 U9 a
# h) z* x. \7 d" G# \4、用SREng删除以下【服务】项(没有则跳过)：

# O* ?' m. E6 t3 X* H[3ware Controller Service / 3wareSrv]
& p; q2 H. L' t1 w[NetMeeting Remote Desktop Sharing / mnmsrvc]

5、用SREng删除以下【驱动程序】项(没有则跳过)：
- g, j8 h2 H; ]2 y1 {( E& ?
( j* S2 x0 k" M6 S0 K  `6 j[22j / 22jn]
[43ec / 43ecu]
[ntptdb / ntptdb]
[pnduojtwbt / pnduojtwbt]
[RsAntiSpyware / RsAntiSpyware]
[System Restore Filter Driver / sr]
8 y7 P+ F) ]3 l0 R[System Services / unzxzsrs]
* I  b" F  z+ k2 c[ViBus / ViBus]
[ATI Extend / zhibmaso]

6、用SREng删除以下【浏览器加载项】项(没有则跳过)：
- K) P* a" @. z. j7 K+ C$ t
) g4 X) l. V7 ^/ W; r+ T: g0 W- _[Zcom 杂志]
2 W& Y% G/ D0 n# d# w8 C[Browser Enhanced Objects]
  L  r" ^+ K& J* ^5 e& V2 H
最后,重新启动计算机.Tored祝您好运!
; p! L, L1 I% f: B% V& B======================================================
[End]

傲天♂元始

你就这样弄，不行我也没办法

傲天♂扬帆

独恋有按原始说的重新操作一次吗？

独恋伊影

找不到要删的文件。。。。

傲天♂元始

有些都是隐藏起来的

傲天♂风云

& l9 V! M& w% @- g% ^6 Z我对代码 一点都不懂

傲天♂元始

。。。这不是代码只是系统的扫描日志而已

傲天♂冷漠

我汗~~~
4 n+ B& V- G9 Y( @' D2 ?" e1 _: x这么多代码~~~