在这里

独恋伊影

1. 
   $ G- o$ a; N: [8 S1 b7 `. X
2. 2008-05-22,20:37:43
   5 m5 _: B6 Y7 E& D' s" |" w6 R
3. System Repair Engineer 2.5.16.900
   
4. Smallfrogs (http://www.KZTechs.com)
   . `6 X; ]' g, j" b
5. Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
   
6. 以下内容被选中：
   , ?7 s# s& }2 P
7.     所有的启动项目（包括注册表、启动文件夹、服务等）
   ' L, l7 @, A) S5 U) z# C1 P8 {2 d. ~
8.     浏览器加载项
   
9.     正在运行的进程（包括进程模块信息）
   % ~* K6 e1 o$ q8 {
10.     文件关联
    / r/ \% W; t! c  z
11.     Winsock 提供者
    0 U9 s( Z+ I* [( f# x
12.     Autorun.inf
    & |3 p  D9 W3 C, b3 C8 e
13.     HOSTS 文件
    ; K2 b5 P4 k8 ]/ a& d
14.     进程特权扫描
    . ~( r9 D6 o! r. X, N+ A$ _6 o) F
15. 
      `2 o9 l5 b# q$ k
16. 启动项目
    
17. 注册表
    . e% U# D( ?0 m3 I. P
18. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    4 H& Q7 V5 Z$ F$ X- c
19.     <ctfmon.exe><C:\WINDOWS\system32\CTFMON.EXE>  [(Verified)Microsoft Windows Publisher]
    
20. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    
21.     <360Safebox><"C:\Program Files\360Safebox\safeboxTray.exe" /r>  [(Verified)Qizhi Software (beijing) Co. Ltd]
    " ?3 S# T4 Q( F/ k
22.     <360Safetray><C:\Program Files\360safe\safemon\360tray.exe /start>  [(Verified)Qizhi Software (beijing) Co. Ltd]
    2 n: ]/ @/ J% x
23.     <360Antiarp><C:\Program Files\360safe\AntiArp\AntiArp.exe /start>  [(Verified)Qizhi Software (beijing) Co. Ltd]
    
24.     <KavStart><"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVStart.exe" -startup>  [(Verified)KINGSOFT CORPORATION]
    
25.     <IMJPMIG8.1><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32>  [N/A]
    
26.     <PHIME2002A><; >  [N/A]
    
27.     <PHIME2002ASync><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32>  [N/A]
    
28. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    
29.     <shell><Explorer.exe>  [(Verified)Microsoft Windows Component Publisher]
    
30.     <Userinit><C:\WINDOWS\system32\UserInit.exe,>  [(Verified)Microsoft Windows Publisher]
    
31.     <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
    , n* Z6 F/ W( v1 H7 P# v
32. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    / n  d& l7 ], z( s6 `% f5 _9 {2 c
33.     <{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}><C:\WINDOWS\system32\shlhook.dll>  [Beijing Rising Technology Co., Ltd.]
    
34. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
    ; O) z+ ]5 b0 C6 g" x1 V9 @' |
35.     <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [N/A]
    
36. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
    ; g3 Z) H' z3 N! q) f
37.     <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]
    
38. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
    ( u  Y  a+ o6 j, l2 H9 M7 o
39.     <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]
    
40. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
    
41.     <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
    * T$ X# K( ~7 `2 t
42. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
    2 f: y) V+ d  K9 N8 U* _
43.     <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Remove.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
    
44. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
    : {* _! {) z. ?" d  M4 v
45.     <Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser>  [(Verified)Microsoft Windows Publisher]
    ; B! u# \" v  Q- L
46. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
    
47.     <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub>  [(Verified)Microsoft Windows Publisher]
    
48. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
    ! [" e# g. H! k3 v1 a1 N
49.     <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]
    ' S& _5 F. J! a" M$ Q
50. ==================================
    . ~4 x' p1 v7 h: S. ]/ A5 ?$ z
51. 启动文件夹
    
52. N/A
    
53. ==================================
    0 Q# O% M3 R' [0 }9 t; e
54. 服务
    9 N1 y3 K' O) h2 n# P( u
55. [3ware Controller Service / 3wareSrv][Stopped/Auto Start]
    7 W' m$ z0 h% m, C6 M! p6 _; o
56.   <C:\WINDOWS\System32\3wareSrv.exe><N/A>
    7 |. I5 B! l: {. X# J: K8 a
57. [Google Updater Service / gusvc][Stopped/Manual Start]
    ; `3 H9 |  x, }$ f3 }9 u  F  m( f+ s- _
58.   <"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"><Google>
    4 ]' v. a" ?- E" U3 G
59. [Help and Support / helpsvc][Stopped/Disabled]
    ; y2 `# t$ ?8 h
60.   <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll><N/A>
    
61. [Human Interface Device Access / HidServ][Stopped/Boot Start]
    
62.   <\SystemRoot\C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
    8 G# ~$ z: U9 x) K
63. [Kingsoft Internet Security Common Service / KISSvc][Stopped/Auto Start]
    
64.   <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KISSvc.EXE><Kingsoft Corporation>
    
65. [Kingsoft Personal Firewall Service / KPfwSvc][Running/Auto Start]
    
66.   <"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KPfwSvc.EXE"><Kingsoft Corporation>
    * O! o1 P) J6 w$ ^0 A
67. [Kingsoft Antivirus KWatch Service / KWatchSvc][Running/Auto Start]
    
68.   <"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KWatch.EXE"><Kingsoft Corporation>
    ! r* |7 N+ w+ X# Q0 o: [
69. [NetMeeting Remote Desktop Sharing / mnmsrvc][Stopped/Manual Start]
    
70.   <><N/A>
    
71. [Qvod Terminal / Qvod Terminal][Running/Auto Start]
    7 t# ?- ~" d  N5 b( a7 M9 N% d
72.   <C:\Program Files\QvodPlayer\QvodTerminal.exe><Shenzhen QVOD Technology Co.,Ltd>
    3 w- u. A: d% Y+ ?/ M# V
73. ==================================
    
74. 驱动程序
    
75. [22j / 22jn][Stopped/Boot Start]
    
76.   <\SystemRoot\System32\DRIVERS\22jn.sys><N/A>
    
77. [360AntiArp / 360AntiArp][Running/System Start]
    + y" r, r: u8 C3 N( n$ J
78.   <\??\C:\WINDOWS\system32\drivers\360AntiArp.sys><360安全中心>
    / X1 o. N' R3 Y. p$ B
79. [43ec / 43ecu][Stopped/Boot Start]
    : Z5 V( _. {' b/ J  ?; K9 M/ P
80.   <\SystemRoot\System32\DRIVERS\43ecu.sys><N/A>
    ) p  a7 V5 g( I" M2 I7 A: w8 a
81. [Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Running/Manual Start]
    ) R# ?7 q- X$ G& X& l8 A
82.   <system32\drivers\ac97intc.sys><Intel Corporation>
    
83. [Promise driver accelerator / bb-run][Running/Boot Start]
    
84.   <\SystemRoot\system32\DRIVERS\bb-run.sys><Promise Technology, Inc.>
    9 G8 ^8 @' N' Q: Q# H6 o: `
85. [Promise Removable Disk Control Driver / dontgo][Running/Boot Start]
    
86.   <\SystemRoot\system32\DRIVERS\DontGo.sys><Promise Technology, Inc.>
    / o% T* P! j4 }" }  }4 Y3 [$ @
87. [KAVBase / KAVBase][Running/Auto Start]
    % I  @5 i) |/ c5 q! W7 p* G  ]
88.   <\??\C:\WINDOWS\system32\Drivers\KAVBase.sys><Kingsoft Corporation>
    0 U( h  V- v! _! F) F" s+ I
89. [KAVBootC / KAVBootC][Running/Boot Start]
    
90.   <\SystemRoot\system32\Drivers\KAVBootC.sys><Kingsoft Corporation>
    4 e2 [  C8 Q. M9 S/ _3 k6 ?% \) P3 L
91. [KAVSafe / KAVSafe][Running/Auto Start]
    4 x, e, c- Q6 _& Z
92.   <\??\C:\WINDOWS\system32\Drivers\KAVSafe.sys><Kingsoft Corporation>
    
93. [KNetWch / KNetWch][Running/System Start]
    
94.   <\??\C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KNetWch.SYS><Kingsoft Corporation>
    ) V$ }4 D2 c& R
95. [KWatch3 / KWatch3][Running/Auto Start]
    
96.   <\??\C:\WINDOWS\system32\drivers\KWatch3.SYS><Kingsoft Corporation>
    - N# p! q$ }) z2 P4 J/ \0 \
97. [ntptdb / ntptdb][Stopped/Auto Start]
    
98.   <\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys><N/A>
    ( m3 A2 E* S. |8 U, q9 h# l
99. [nv / nv][Running/Manual Start]
    # s; V; |# f0 p4 M
100.   <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
     
101. [NVIDIA nForce RAID Driver / nvrd32][Running/Boot Start]
     ' e& _/ I5 t3 p! k: h
102.   <\SystemRoot\system32\DRIVERS\nvrd32.sys><NVIDIA Corporation>
     ' ]  m, I1 ?4 g8 o! m1 c4 |- G
103. [DDK PACKET Protocol / Packet][Running/Manual Start]
     
104.   <system32\DRIVERS\ProtoDrv.sys><360安全中心>
     # Y* C6 j: ?& _' q8 V/ N, H2 h0 N
105. [pnduojtwbt / pnduojtwbt][Stopped/Boot Start]
     & ~% w+ G2 u. ]5 P$ ?) b
106.   <\SystemRoot\system32\drivers\pnduojtwbt.sys><N/A>
     . ?$ e6 h6 h' L/ ]4 o5 k
107. [Direct Parallel Link Driver / Ptilink][Running/Manual Start]
     5 F3 w* g, _4 `5 e1 J  O, U
108.   <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
     - Z5 _* y) t) M+ w# l' c6 Z
109. [RsAntiSpyware / RsAntiSpyware][Stopped/Boot Start]
     ! a1 ~9 o7 c% |& O
110.   <\SystemRoot\system32\drivers\RsBoot.sys><N/A>
     
111. [Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
     , ]  t& T9 q) g, _/ O
112.   <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
     
113. [SafeBoxKrnl / SafeBoxKrnl][Running/System Start]
     ; J: @9 t7 N  l. p3 k* r5 X; E1 [
114.   <\??\C:\Program Files\360Safebox\SafeBoxKrnl.sys><360安全中心>
     
115. [Secdrv / Secdrv][Stopped/Manual Start]
     
116.   <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
     $ r- C* U4 {+ j7 M/ S; V5 c* ^/ D+ c1 `
117. [SATALink External Device Filter / SiRemFil][Running/Boot Start]
     8 `7 }4 e: `. O
118.   <\SystemRoot\system32\DRIVERS\SiRemFil.sys><Silicon Image, Inc.>
     * x$ \4 |, v6 H$ `; ]. A. X
119. [System Restore Filter Driver / sr][Stopped/Disabled]
     
120.   <system32\DRIVERS\sr.sys><N/A>
     8 `$ G. J0 |( X) x
121. [TesSafe / TesSafe][Stopped/Manual Start]
     
122.   <\??\C:\WINDOWS\system32\TesSafe.sys><TENCENT>
     
123. [System Services / unzxzsrs][Stopped/Boot Start]
     2 s1 {' |. e- s' \1 A
124.   <\SystemRoot\system32\drivers\unzxzsrs.sys><N/A>
     
125. [ViBus / ViBus][Stopped/Boot Start]
     
126.   <\SystemRoot\system32\DRIVERS\ViBus.sys><N/A>
     9 n6 k. r2 z  m0 q4 n
127. [World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
     
128.   <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
     7 ^% {: n) m1 e+ p% A0 F
129. [VIA SATA IDE Hot-plug Driver / xfilt][Running/Boot Start]
     
130.   <\SystemRoot\system32\DRIVERS\xfilt.sys><VIA Technologies,Inc>
     
131. [ATI Extend / zhibmaso][Stopped/Boot Start]
     ! Y. Y) u( z( U  ~, m! ~
132.   <\SystemRoot\system32\drivers\zhibmaso.sys><N/A>
     - \% W/ L) h7 L
133. [Vimicro USB PC Camera (ZC0301PL) / ZSMC301b][Running/Manual Start]
     , J- T0 v9 S& y$ [6 M9 P5 h8 _
134.   <System32\Drivers\usbVM31b.sys><Vimicro Corporation>
     
135. ==================================
     
136. 浏览器加载项
     " S2 E! f1 ^  c# j
137. [Google Toolbar Helper]
     
138.   {AA58ED58-01DD-4d91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     
139. [Google Toolbar Notifier BHO]
     / c2 [) E3 g8 X8 ^$ K! A
140.   {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>
     5 v) h  `- }$ H3 O
141. [SafeMon Class]
     
142.   {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>
     
143. [kingsoft browser shield]
     
144.   {D963BE1A-6B35-47DB-B002-49FAE71D85CC} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL, Kingsoft Corporation>
     ( H$ \1 P/ z+ L, `' X& L% w3 u
145. [IEBuddyExtControl Class]
     
146.   {3AECD3C1-7085-4731-96DC-47B6CF7EF749} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL, Kingsoft Corporation>
     
147. [Zcom 杂志]
     
148.   {4045D313-1D5E-4fe4-93A0-A34630B6A00B} <C:\Zcom\E-Space.exe, N/A>
     7 V8 j* T: _( y5 m6 T
149. [&Google]
     
150.   {2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     & E9 Y+ [7 ?+ N! R
151. [KooPlayer Control]
     
152.   {C728DAB8-FDF5-4CD7-89DD-879D25794C77} <C:\WINDOWS\system32\CCTVKO~1.OCX, Koos>
     
153. [Shockwave Flash Object]
     
154.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>
     ( h- I/ H, J& Q* v
155. [KUpdateObj2 Class]
     9 e5 w5 ^8 K+ O5 \, s9 v% q  P
156.   {D82303B7-A754-4DCB-8AFC-8CF99435AACE} <C:\WINDOWS\system32\KingSoft\KOS\UpdateOcx2.dll, Kingsoft Corporation>
     0 \1 L$ r+ i6 b7 |* B
157. [Google Script Object]
     " y' ^  E0 V) U; l$ p
158.   {00EF2092-6AC5-47C0-BD25-CF2D5D657FEB} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     
159. [EWA Control]
       B) N8 l5 s( P0 k9 v
160.   {18226BF8-DC0B-4D81-80E9-A41AE37BB73A} <C:\PROGRA~1\PPLive\SYNACA~2.OCX, Synacast>
     
161. [Windows Media Player]
     
162.   {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\msdxm.ocx, Microsoft Corporation>
     
163. [&Google]
     
164.   {2318C2B1-4965-11D4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     
165. [HTML Document]
     
166.   {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
     - {0 K5 X: z5 S1 s' ^
167. [DHTML Edit Control Safe for Scripting for IE5]
     * K8 H& F6 K) ]( `7 ]5 `
168.   {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
     ( M+ {# ?# O6 S' }1 K
169. [RealPlayer RAM Download Handler]
     
170.   {2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
     * ~) B6 p* `6 r5 C  l
171. [IEBuddyExtControl Class]
     ; ?, f4 H+ h5 I5 l& A, K' i
172.   {3AECD3C1-7085-4731-96DC-47B6CF7EF749} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL, Kingsoft Corporation>
     & x& q& u  B8 f( Q; n% z% {, n: }4 R
173. [XML Document]
     5 d  [5 x2 `5 M* K$ A) p
174.   {48123BC4-99D9-11D1-A6B3-00C04FD91555} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
     5 t/ d# N8 V# I
175. [HHCtrl Object]
     . `  r' |' _9 x9 A( m/ r5 C# _( O4 Y
176.   {52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
     
177. [Windows Media Player]
     
178.   {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
       ?6 c5 Z' H5 B, y( `+ }
179. [Active Desktop Mover]
     
180.   {72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
     . @/ Z) m) }" j$ B, v; N8 j/ v
181. [360SafeLive]
     
182.   {87515F61-A66C-4319-A0E0-D416CB8059E3} <C:\Program Files\360safe\live.dll, 360.cn>
     
183. [Microsoft Web 浏览器]
     0 o8 u4 ]0 J: `8 I8 Q3 R9 f7 B
184.   {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
     
185. [Browser Enhanced Objects]
     
186.   {986488AF-13D5-9DDF-4FEF-9FB88698CFC1} <C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\USERDATA\webbrowser_2011.dll, N/A>
     
187. [Google Toolbar Helper]
     ; U. ]3 \, ]3 m; \
188.   {AA58ED58-01DD-4D91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     ( F6 d" S! V( h9 v8 I. G$ c
189. [Microsoft Scriptlet Component]
     
190.   {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
     8 q  h# E! q- U7 c6 Y
191. [Google Toolbar Notifier BHO]
     % V  R4 i2 ]5 {( ]$ O
192.   {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>
     2 n2 C# P. u1 h9 P
193. [SearchAssistantOC]
     
194.   {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
     ( M, M) }( C9 \' x: g
195. [SafeMon Class]
     6 V2 F* L; B9 x: ]8 b0 C
196.   {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>
     
197. [RDS.DataSpace]
     
198.   {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
     
199. [KooPlayer Control]
     + @; L8 ~- d8 ^$ p5 O
200.   {C728DAB8-FDF5-4CD7-89DD-879D25794C77} <C:\WINDOWS\system32\CCTVKO~1.OCX, Koos>
     
201. [AUDIO__MID Moniker Class]
     + J3 s) i* Q+ T5 ]
202.   {CD3AFA74-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     
203. [AUDIO__MP3 Moniker Class]
     
204.   {CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     . L! Y- j# d5 W! x
205. [AUDIO__X_MS_WMA Moniker Class]
     + a6 w, `. Z3 Q; E; j% ?  u
206.   {CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     0 K4 m0 {3 ?4 d. M5 \: @, L) \' M
207. [VIDEO__X_MS_WMV Moniker Class]
     : E9 |! w4 j% P( t* D6 K7 K! [
208.   {CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     + i1 r: a9 {" @$ c" x
209. [RealPlayer G2 Control]
     0 j: H/ U# ~' h/ e! k
210.   {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
     5 A9 b* S8 n1 q" J- `$ X
211. [Shockwave Flash Object]
     0 b/ d  p# w: s8 M+ ]6 v
212.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>
     ; a8 b6 @' N5 M0 r" m
213. [KUpdateObj2 Class]
     - F6 y4 t0 n! {2 M0 B# T! ?
214.   {D82303B7-A754-4DCB-8AFC-8CF99435AACE} <C:\WINDOWS\system32\KingSoft\KOS\UpdateOcx2.dll, Kingsoft Corporation>
     
215. [kingsoft browser shield]
     
216.   {D963BE1A-6B35-47DB-B002-49FAE71D85CC} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL, Kingsoft Corporation>
     
217. [PasswordEditCtrl Class]
     # v( ~% v- d8 e4 N9 r7 g( v+ M
218.   {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
     
219. [QvodCtrl Class]
     
220.   {F3D0D36F-23F8-4682-A195-74C92B03D4AF} <C:\Program Files\QvodPlayer\QvodInsert.dll, Shenzhen QVOD Technology Co.,Ltd>
     6 L" ]. q7 L, h9 u8 i
221. [&使用超级旋风下载]
     
222.   <C:\Program Files\Tencent\QQDownload\geturl.htm, N/A>
     1 c5 ?/ k/ M7 c! R6 y% [; P
223. [&使用超级旋风下载全部链接]
     : ]9 }" B6 n9 F0 M. L, S& {4 |2 R
224.   <C:\Program Files\Tencent\QQDownload\getAllurl.htm, N/A>
     - B; K. L- S! N0 r- H
225. [使用迅雷下载]
     9 _( X# ^7 @- H- C3 M
226.   <, N/A>
     
227. [使用迅雷下载全部链接]
     , x4 V; |" t2 }% i
228.   <, N/A>
     
229. [导出到 Microsoft Office Excel(&X)]
     
230.   <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
     
231. [添加到QQ表情]
     
232.   <C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
     
233. ==================================
     
234. 正在运行的进程
     * ^, m) U- B- n6 t! `
235. [PID: 444 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
236. [PID: 496 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
237. [PID: 520 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
238.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
     
239. [PID: 564 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     ( _2 Z1 e! j: D4 J3 a9 k
240. [PID: 576 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     ) D, W+ S  w7 M5 _1 M% j
241. [PID: 720 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
242. [PID: 780 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     ; u! P' D) @$ Y" C, d
243. [PID: 856 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     . ~# n9 C3 s) C$ G8 T' {
244. [PID: 944 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
245. [PID: 1012 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     & G. o2 j$ x- J( v
246. [PID: 1236 / Administrator][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_qfe.070613-1311)]
       u! p& x' k. o  J5 ^
247.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     
248.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     $ e4 W+ O+ D: x9 K7 x' M- p
249.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
     ' z- o( j% d( ~) R
250.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     
251.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVEXT.DLL]  [Kingsoft Corporation, 2008,05,07,373]
     ! O0 H1 [7 o; m9 ^
252.     [C:\Program Files\Tencent\QQ\qdshm.dll]  [, 1, 0, 101, 20]
     ) Z+ q" R) k) e3 b1 a- {" U9 Y( z
253.     [C:\Program Files\Tencent\QQ\MFC42.DLL]  [Microsoft Corporation, 6.00.8665.0]
     % v% f+ ~$ M; T) b: k: S) u
254.     [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
     $ ?, C3 D0 h' c' g) v# M) I
255.     [C:\WINDOWS\system32\shlhook.dll]  [Beijing Rising Technology Co., Ltd., 4.0.0.9]
     
256.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     7 {: P6 E; y& Q- Q6 h
257.     [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
     
258. [PID: 1332 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
     " W+ e5 i3 X; v
259.     [C:\WINDOWS\system32\mdimon.dll]  [Microsoft Corporation, 11.3.8166.2]
     
260.     [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll]  [Microsoft Corporation, 11.3.8166.2]
     8 |5 h0 G0 ^; k! r# Z' I
261. [PID: 1540 / Administrator][C:\Program Files\360safe\AntiArp\AntiArp.exe]  [360安全中心, 2, 0, 0, 1008]
     ( K% v& t6 v8 ?* s' X% R- e
262.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     
263.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     
264.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
265.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
266. [PID: 1560 / Administrator][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     3 o) Q2 U0 Q8 q! X' H% g, i4 _
267.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     8 |: W2 o: j: q+ t
268.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     : K# |1 O5 r+ |& V+ q
269.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     - G, P, O* ^' N- ^$ M% N# u4 h
270. [PID: 1576 / Administrator][C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe]  [Google Inc., 2, 0, 301, 1654]
     
271.     [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\gtn.dll]  [Google Inc., 2, 0, 301, 7164]
     
272.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     
273.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     / {/ z8 j) w2 F! {' [3 a$ {
274.     [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\res_zh-CN.dll]  [Google Inc., 2, 0, 301, 7164]
     
275.     [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll]  [Google Inc., 2, 0, 301, 7164]
     
276.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     , ^% X2 E" k+ C- z" T
277.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     5 S$ @" {- u( U4 ?4 [7 l
278. [PID: 1648 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
279. [PID: 1744 / SYSTEM][C:\Program Files\QvodPlayer\QvodTerminal.exe]  [Shenzhen QVOD Technology Co.,Ltd, 2, 5, 0, 53]
     7 R9 I% o2 J% x- g. w  E# G  S
280. [PID: 1860 / SYSTEM][C:\WINDOWS\system32\skeys.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
281. [PID: 1908 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
282. [PID: 1964 / LOCAL SERVICE][C:\WINDOWS\system32\wdfmgr.exe]  [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
     5 W6 b/ b9 Z, v+ E
283. [PID: 2772 / Administrator][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
     
284.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     
285.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     9 B/ K. h" m$ w( ^" F7 l. S
286.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     4 U* D2 ^, r4 p1 ~4 _% m, x
287.     [c:\program files\google\googletoolbar2.dll]  [Google Inc., 4, 0, 1606, 6690]
     * E$ O6 [% {) Y. t* F
288.     [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll]  [Google Inc., 2, 0, 301, 7164]
     ' d* L* d1 }+ d( |* G
289.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL]  [Kingsoft Corporation, 2008,04,15,2]
     / b( D& v( [! ?# j# f
290.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddy.dll]  [Kingsoft Corporation, 2008,04,15,2]
     1 G, @' E9 Q  g" T. ~: q
291.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL]  [Kingsoft Corporation, 2008,05,14,83]
     
292.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KANTray.dll]  [Kingsoft Corporation, 2008,04,15,2]
     
293.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVAFish.DLL]  [Kingsoft Corporation, 2008,05,13,78]
     6 q" Q3 v6 j/ s! H  C4 X0 v7 i+ r
294.     [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
     5 P& B  A. W5 A: u
295.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
     
296.     [C:\WINDOWS\system32\WN.IME]  [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
     
297.     [C:\Program Files\ShiQiang\wnime\Dll32\wnpy_StatusWnd.dll]  [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
     
298.     [C:\Program Files\ShiQiang\wnime\Dll32\wnpy_CompWnd.dll]  [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
     
299.     [C:\Program Files\ShiQiang\wnime\Dll32\wnpy_Query.dll]  [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
     # g0 f7 x3 |) U' e/ }
300.     [C:\WINDOWS\system32\SOGOUPY.IME]  [Sogou.com Inc., 3.2.0.0]
     7 ?- L/ C7 o& D6 c, I. g  ]+ {
301.     [C:\Documents and Settings\Administrator\My Documents\SogouInput\Plugin\SgImeWord.dll]  [Sogou.com Inc., 3.2.0.0]
     
302.     [C:\WINDOWS\system32\WINWB98.IME]  [Microsoft Corporation, 4.00.950]
     
303.     [C:\WINDOWS\system32\WINWB86.IME]  [Microsoft Corporation, 4.00.950]
     
304.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
305. [PID: 1124 / Administrator][C:\Program Files\Tencent\QQ\TXPlatform.exe]  [Tencent, 1, 0, 170, 0]
     
306.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     
307.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     3 J$ ?  N8 H- B; g( I% s: M
308.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     6 B! g1 Z3 g% a1 h
309.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
310. [PID: 928 / Administrator][F:\arvmon.exe]  [任软工作室, 2.2.5.201]
     3 `8 A- Q5 H0 u/ @' [
311.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     3 Z/ t. s/ v! ~% m
312.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     
313.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     . E! d6 W9 P* _) A) ?- V
314.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     5 d) E: g7 I, w7 {1 E7 F( S
315.     [F:\Vdata.dll]  [任软工作室, 2, 2, 1, 94]
     
316. [PID: 2540 / Administrator][F:\AutoGuarder.exe]  [任软工作室, 2.2.5.201]
     ; d2 }1 y4 k3 l8 \# U, O
317.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     
318.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     + J8 k  k- r: {3 T6 B6 h
319.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     / Y0 ~& ?8 i- Y6 q4 C0 [
320.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
321. [PID: 2476 / Administrator][d:\我的文档\桌面\系统检测修复\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
     & J: l5 y) o, o
322.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     
323.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     & A% N! S5 m0 B8 e" l, }$ j
324.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
325.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     2 T) }8 D7 z- }9 d8 h# u# }
326.     [d:\我的文档\桌面\系统检测修复\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]
     
327. ==================================
     + H1 `, x3 i5 V- ~. c5 \0 d7 m; p
328. 文件关联
     
329. .TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
     
330. .EXE  OK. ["%1" %*]
     0 p$ S! j" z  y1 D4 Y" `
331. .COM  OK. ["%1" %*]
     6 B: d" Z# c0 a* B. y
332. .PIF  OK. ["%1" %*]
     
333. .REG  OK. [regedit.exe "%1"]
     
334. .BAT  OK. ["%1" %*]
     
335. .SCR  OK. ["%1" /S]
     5 l+ M6 w+ [! v. Y3 Q$ F) V
336. .CHM  OK. ["C:\WINDOWS\hh.exe" %1]
     3 b4 ]* _; ]7 P& {
337. .HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
     
338. .INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
     0 l9 c2 s. e# c2 [% a: Y
339. .INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
     3 d. q- }7 S$ p
340. .VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
     ; f# S, @# A1 @1 @: D) b
341. .JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
     % j/ @( j/ P* u6 Y- D
342. .LNK  OK. [{00021401-0000-0000-C000-000000000046}]
     4 ?" K8 B* X. E7 H
343. ==================================
     
344. Winsock 提供者
     2 f; {% G& E* S3 q5 z$ d1 |
345. N/A
     ' z3 ?4 U2 F5 d) o
346. ==================================
     . Q/ ?9 p/ i# r" k3 r- ~0 T- v
347. Autorun.inf
     ) K) j5 [  t8 ]+ U- c% e
348. N/A
     
349. ==================================
     + K! `4 F: e8 R3 W5 Y3 W& J
350. HOSTS 文件
     
351. N/A
     
352. ==================================
     8 ?% n/ D; {& r+ c( I, d
353. 进程特权扫描
     
354. 特殊特权被允许： SeLoadDriverPrivilege [PID = 520, C:\WINDOWS\SYSTEM32\WINLOGON.EXE]
     : f5 h9 ]' ]8 Q/ j: ~
355. 特殊特权被允许： SeDebugPrivilege [PID = 928, F:\ARVMON.EXE]
     ) }9 s: I5 _" t- M9 A) B
356. 特殊特权被允许： SeLoadDriverPrivilege [PID = 928, F:\ARVMON.EXE]
     
357. 特殊特权被允许： SeDebugPrivilege [PID = 2540, F:\AUTOGUARDER.EXE]
     / R/ b" I* u* X  \9 v4 \0 F$ ?# L
358. 特殊特权被允许： SeLoadDriverPrivilege [PID = 2540, F:\AUTOGUARDER.EXE]
     
359. ==================================
     % D1 T5 ?. e- j; P
360. API HOOK
     
361. N/A
     
362. ==================================
     
363. 隐藏进程
     , W) ~3 x" V8 G3 R7 _7 y
364. N/A
     
365. ==================================
     
366. 
     # q4 z  Z$ d# d4 y* U

复制代码

傲天♂扬帆

跟原始说了，不知道能不能看明白。。。

傲天♂元始

[Start]

2008-05-22,22:24:21

9 p4 w! X3 R" t6 [SREngLOG智能分析专家 V1.2.0.125
Tored (http://hi.baidu.com/peaset)

$ Y! K5 ^% f0 h  p" \, Z0 f======================================================
以下过程将用到SREng、PowerRmv，如果您不熟悉这两款工具的使用方法，请参考下列链接：
% w0 H6 {& ]8 P9 j+ t8 cSREng详细操作方法： http://hi.baidu.com/peaset/blog/ ... dd19224e4aeadf.html
PowerRmv详细操作方法： http://hi.baidu.com/peaset/blog/ ... 6fb5eb77c63816.html
======================================================

' y( _5 W( L7 }( {* ~以下是病毒清除步骤：

" b* C1 \. p' A7 N3 @: C1、用PowerRmv删除以下文件(没有则跳过)：

; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
;
! _! [7 L: f' \0 v- }* J, ^; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
* q, B2 \' T3 y+ q1 NC:\WINDOWS\System32\3wareSrv.exe
: D+ p, ]* j* D1 E5 f# a\SystemRoot\C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll
  b- f1 _- y* G4 }9 l  l
\SystemRoot\System32\DRIVERS\22jn.sys
\SystemRoot\System32\DRIVERS\43ecu.sys
\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys
9 o  d- f% O  s( }0 o\SystemRoot\system32\drivers\pnduojtwbt.sys
$ }9 |+ h) K# s6 e* f0 J0 Y! i\SystemRoot\system32\drivers\RsBoot.sys
8 k7 J+ P/ E! t2 T" Usystem32\DRIVERS\sr.sys
\SystemRoot\system32\drivers\unzxzsrs.sys
- ~, ^# O9 Z- N4 v5 y; M5 ^* z\SystemRoot\system32\DRIVERS\ViBus.sys
1 k# a* X# [' P  D\SystemRoot\system32\drivers\zhibmaso.sys

2、用SREng删除以下【注册表】项(没有则跳过)：
" _; l) f; R4 e
, X6 ]; v/ i/ b: f<IMJPMIG8.1>
<PHIME2002A>
' Q$ H' `) q9 I7 _<PHIME2002ASync>
- S4 b7 ]' ]2 t, J  |1 F9 |# c
9 z- N3 Z" V' e: f' _( j3、用SREng删除【所有启动文件夹】内容(没有则跳过)
5 l! p. [4 }9 q: w5 f$ |
4、用SREng删除以下【服务】项(没有则跳过)：
$ Q1 i  Z$ o1 j9 {$ \0 H1 M
[3ware Controller Service / 3wareSrv]
+ ?& Q' e1 C+ q- I! `[NetMeeting Remote Desktop Sharing / mnmsrvc]
  H& i) s# I: z. b
4 ~9 Z5 u, M/ N0 l0 V5、用SREng删除以下【驱动程序】项(没有则跳过)：
/ Q% v. L8 Q* O/ e$ m4 t2 W3 R
[22j / 22jn]
[43ec / 43ecu]
& a3 K6 c' c  B2 q+ D[ntptdb / ntptdb]
[pnduojtwbt / pnduojtwbt]
- L) s$ l' d! I' A, s[RsAntiSpyware / RsAntiSpyware]
# K6 X* c0 l0 p  S, ^: E/ _; q+ C4 G[System Restore Filter Driver / sr]
[System Services / unzxzsrs]
, N6 H( Y% D5 B2 O7 |7 D[ViBus / ViBus]
6 p4 Q. r/ [* S[ATI Extend / zhibmaso]
; B7 L1 C5 B/ Z" K- l$ @
6、用SREng删除以下【浏览器加载项】项(没有则跳过)：
+ `: d0 I' o  d+ F# v
[Zcom 杂志]
[Browser Enhanced Objects]

, z8 W! J0 X" [, w% G: C最后,重新启动计算机.Tored祝您好运!
======================================================
& l5 w2 U' i7 q- |1 X[End]

傲天♂元始

你就这样弄，不行我也没办法

傲天♂扬帆

独恋有按原始说的重新操作一次吗？

独恋伊影

找不到要删的文件。。。。

傲天♂元始

有些都是隐藏起来的

傲天♂风云

5 w' ^1 b8 n8 b; Z: x* c
我对代码 一点都不懂

傲天♂元始

。。。这不是代码只是系统的扫描日志而已

傲天♂冷漠

我汗~~~
  n. O# A$ ^! U这么多代码~~~