在这里

独恋伊影

1. 
   
2. 2008-05-22,20:37:43
   
3. System Repair Engineer 2.5.16.900
   0 ?6 |+ X8 f( A: [% }$ t9 Q
4. Smallfrogs (http://www.KZTechs.com)
   
5. Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
   2 t* |6 O( v5 G. d! p3 Y
6. 以下内容被选中：
   " W, u- E: J! z% m( H. o
7.     所有的启动项目（包括注册表、启动文件夹、服务等）
   ( \3 {7 k7 M, }
8.     浏览器加载项
   1 b2 m" T4 r4 z" ?1 K3 F
9.     正在运行的进程（包括进程模块信息）
   
10.     文件关联
    ( |$ m) }- r3 c: W
11.     Winsock 提供者
    
12.     Autorun.inf
    1 b/ o* r6 m0 L8 R( A1 a
13.     HOSTS 文件
    
14.     进程特权扫描
    
15. 
    4 v( ~& I: t$ w& Q% M1 I
16. 启动项目
    % d& |: X" L6 _. R
17. 注册表
    2 }8 ]) F5 e4 d/ f4 ?
18. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    
19.     <ctfmon.exe><C:\WINDOWS\system32\CTFMON.EXE>  [(Verified)Microsoft Windows Publisher]
    . d- d. A/ g6 i% P0 C
20. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    4 y% V" c5 L' k1 r: K
21.     <360Safebox><"C:\Program Files\360Safebox\safeboxTray.exe" /r>  [(Verified)Qizhi Software (beijing) Co. Ltd]
    
22.     <360Safetray><C:\Program Files\360safe\safemon\360tray.exe /start>  [(Verified)Qizhi Software (beijing) Co. Ltd]
    
23.     <360Antiarp><C:\Program Files\360safe\AntiArp\AntiArp.exe /start>  [(Verified)Qizhi Software (beijing) Co. Ltd]
    # F1 w* X; \; Q2 d) c( C' ?! A
24.     <KavStart><"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVStart.exe" -startup>  [(Verified)KINGSOFT CORPORATION]
    
25.     <IMJPMIG8.1><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32>  [N/A]
    1 y1 w# L- L7 p
26.     <PHIME2002A><; >  [N/A]
    
27.     <PHIME2002ASync><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32>  [N/A]
    
28. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    ) Q8 H. P; V+ G. c* p7 j- p2 d0 H
29.     <shell><Explorer.exe>  [(Verified)Microsoft Windows Component Publisher]
    - z* Q9 r: @" I( M% U& T
30.     <Userinit><C:\WINDOWS\system32\UserInit.exe,>  [(Verified)Microsoft Windows Publisher]
    3 D) O0 W1 X' F9 L
31.     <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
    ) i" @& ]$ i* i+ F, L
32. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    % f( Q. G+ a3 x  [# S, ~3 j* n4 \
33.     <{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}><C:\WINDOWS\system32\shlhook.dll>  [Beijing Rising Technology Co., Ltd.]
    8 L# Y# R1 ^7 n
34. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
    
35.     <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [N/A]
    
36. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
    
37.     <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]
    ) ^" e0 }: J) a, t2 X. w
38. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
      t( \: C4 h/ h0 c) @/ U7 @7 Y
39.     <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]
    
40. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
    ) \+ j1 G6 J6 N2 Z
41.     <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
    / \" ^0 R5 h6 b5 [
42. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
    
43.     <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Remove.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
    ! }8 e# ~& K6 ~6 G
44. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
    
45.     <Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser>  [(Verified)Microsoft Windows Publisher]
    
46. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
    
47.     <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub>  [(Verified)Microsoft Windows Publisher]
    
48. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
    . r& h7 x8 U2 w0 }& m0 P2 X4 E
49.     <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]
    
50. ==================================
    : n! P* I; b$ ]/ o7 n
51. 启动文件夹
    ( |6 T+ _1 j! P; ]
52. N/A
    
53. ==================================
    8 R1 f: {7 ^; V* u  L. O3 V
54. 服务
    2 d4 W, X0 d0 d& u
55. [3ware Controller Service / 3wareSrv][Stopped/Auto Start]
    - {8 x7 T: l; m  j7 q: l
56.   <C:\WINDOWS\System32\3wareSrv.exe><N/A>
    ' ?  p. F: M, E) F
57. [Google Updater Service / gusvc][Stopped/Manual Start]
    
58.   <"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"><Google>
    $ V) n" d+ Y6 w- D* s$ e3 u
59. [Help and Support / helpsvc][Stopped/Disabled]
    
60.   <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll><N/A>
    
61. [Human Interface Device Access / HidServ][Stopped/Boot Start]
    
62.   <\SystemRoot\C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
    . i- Z0 |# x, ^, o4 F* i
63. [Kingsoft Internet Security Common Service / KISSvc][Stopped/Auto Start]
    $ i+ h3 g  l3 J9 j( \# X6 ^$ E1 x) g- A
64.   <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KISSvc.EXE><Kingsoft Corporation>
    
65. [Kingsoft Personal Firewall Service / KPfwSvc][Running/Auto Start]
    $ f- K. j# f; R( `& U
66.   <"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KPfwSvc.EXE"><Kingsoft Corporation>
    9 W& Z& `. o% k- {+ {3 B8 X
67. [Kingsoft Antivirus KWatch Service / KWatchSvc][Running/Auto Start]
    ; Z/ \% h" s) \" |
68.   <"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KWatch.EXE"><Kingsoft Corporation>
    2 Q& ~4 c+ f) y7 U7 A7 e8 A" ~
69. [NetMeeting Remote Desktop Sharing / mnmsrvc][Stopped/Manual Start]
    
70.   <><N/A>
    
71. [Qvod Terminal / Qvod Terminal][Running/Auto Start]
    ) @9 E: d* r) ?& y' E: v
72.   <C:\Program Files\QvodPlayer\QvodTerminal.exe><Shenzhen QVOD Technology Co.,Ltd>
    / O; g8 i- H0 ?* z( Z
73. ==================================
    9 Q, P" o$ X& u: k1 k0 O  _" E3 l
74. 驱动程序
    % K) b. n* X: C" Q" b/ Q
75. [22j / 22jn][Stopped/Boot Start]
    
76.   <\SystemRoot\System32\DRIVERS\22jn.sys><N/A>
    & x! @4 N- s1 N
77. [360AntiArp / 360AntiArp][Running/System Start]
    
78.   <\??\C:\WINDOWS\system32\drivers\360AntiArp.sys><360安全中心>
    ' M: o7 t$ O* a
79. [43ec / 43ecu][Stopped/Boot Start]
    
80.   <\SystemRoot\System32\DRIVERS\43ecu.sys><N/A>
    5 A. t6 j* b, k/ U4 l3 ]$ d
81. [Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Running/Manual Start]
    
82.   <system32\drivers\ac97intc.sys><Intel Corporation>
    + k! N$ m! v/ w7 ^/ Y
83. [Promise driver accelerator / bb-run][Running/Boot Start]
    8 h. p; R8 M" A& d; |' h3 {7 s
84.   <\SystemRoot\system32\DRIVERS\bb-run.sys><Promise Technology, Inc.>
    4 D1 K2 F0 L- M( e! ]" k; {
85. [Promise Removable Disk Control Driver / dontgo][Running/Boot Start]
    3 q; M) @% o' ^# @% i/ N/ v
86.   <\SystemRoot\system32\DRIVERS\DontGo.sys><Promise Technology, Inc.>
    ( R. y) ~( g: w# j$ r- R& B
87. [KAVBase / KAVBase][Running/Auto Start]
    
88.   <\??\C:\WINDOWS\system32\Drivers\KAVBase.sys><Kingsoft Corporation>
    " u7 X2 A+ V# ^' t' a% j( ?4 v
89. [KAVBootC / KAVBootC][Running/Boot Start]
    7 h% V( {" r- x
90.   <\SystemRoot\system32\Drivers\KAVBootC.sys><Kingsoft Corporation>
    & `# i0 ]+ _, {3 _- n% ~8 e9 t* f
91. [KAVSafe / KAVSafe][Running/Auto Start]
    
92.   <\??\C:\WINDOWS\system32\Drivers\KAVSafe.sys><Kingsoft Corporation>
      x2 i$ x1 D8 \
93. [KNetWch / KNetWch][Running/System Start]
    
94.   <\??\C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KNetWch.SYS><Kingsoft Corporation>
    
95. [KWatch3 / KWatch3][Running/Auto Start]
    ; M; S- W8 U3 `, c- m9 m9 V' F
96.   <\??\C:\WINDOWS\system32\drivers\KWatch3.SYS><Kingsoft Corporation>
    
97. [ntptdb / ntptdb][Stopped/Auto Start]
    
98.   <\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys><N/A>
    
99. [nv / nv][Running/Manual Start]
    
100.   <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
     
101. [NVIDIA nForce RAID Driver / nvrd32][Running/Boot Start]
     * x9 Z( K  s/ A
102.   <\SystemRoot\system32\DRIVERS\nvrd32.sys><NVIDIA Corporation>
     
103. [DDK PACKET Protocol / Packet][Running/Manual Start]
     
104.   <system32\DRIVERS\ProtoDrv.sys><360安全中心>
     
105. [pnduojtwbt / pnduojtwbt][Stopped/Boot Start]
     " X6 ]  ?: X; r& ^7 [
106.   <\SystemRoot\system32\drivers\pnduojtwbt.sys><N/A>
     0 ^& H8 r* {8 V$ }
107. [Direct Parallel Link Driver / Ptilink][Running/Manual Start]
     
108.   <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
     6 L0 f6 a2 W/ Y0 l: }+ I
109. [RsAntiSpyware / RsAntiSpyware][Stopped/Boot Start]
     
110.   <\SystemRoot\system32\drivers\RsBoot.sys><N/A>
     
111. [Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
     
112.   <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
     
113. [SafeBoxKrnl / SafeBoxKrnl][Running/System Start]
     6 d  V5 G" l9 B0 h
114.   <\??\C:\Program Files\360Safebox\SafeBoxKrnl.sys><360安全中心>
     
115. [Secdrv / Secdrv][Stopped/Manual Start]
     
116.   <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
     
117. [SATALink External Device Filter / SiRemFil][Running/Boot Start]
     
118.   <\SystemRoot\system32\DRIVERS\SiRemFil.sys><Silicon Image, Inc.>
     9 v; w) F. i! B( Q3 G
119. [System Restore Filter Driver / sr][Stopped/Disabled]
     
120.   <system32\DRIVERS\sr.sys><N/A>
     
121. [TesSafe / TesSafe][Stopped/Manual Start]
     
122.   <\??\C:\WINDOWS\system32\TesSafe.sys><TENCENT>
     
123. [System Services / unzxzsrs][Stopped/Boot Start]
     % {! o1 Q9 [2 |/ S& n
124.   <\SystemRoot\system32\drivers\unzxzsrs.sys><N/A>
     
125. [ViBus / ViBus][Stopped/Boot Start]
     , ^) J. T; ~9 h
126.   <\SystemRoot\system32\DRIVERS\ViBus.sys><N/A>
     4 d+ ]6 S  F7 m4 u! @- s, t8 A' Y. |
127. [World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
     
128.   <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
     
129. [VIA SATA IDE Hot-plug Driver / xfilt][Running/Boot Start]
     
130.   <\SystemRoot\system32\DRIVERS\xfilt.sys><VIA Technologies,Inc>
     # \8 Q7 q. R$ S% @# @; v& n
131. [ATI Extend / zhibmaso][Stopped/Boot Start]
     
132.   <\SystemRoot\system32\drivers\zhibmaso.sys><N/A>
     
133. [Vimicro USB PC Camera (ZC0301PL) / ZSMC301b][Running/Manual Start]
     
134.   <System32\Drivers\usbVM31b.sys><Vimicro Corporation>
     % Q2 Z; s! M) p/ E- V" O! J
135. ==================================
     
136. 浏览器加载项
     
137. [Google Toolbar Helper]
     
138.   {AA58ED58-01DD-4d91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     : J& ~: F) i. X. L7 V
139. [Google Toolbar Notifier BHO]
     
140.   {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>
     
141. [SafeMon Class]
     8 H' D! l3 q' ]4 a; q
142.   {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>
     # v" o' x4 n1 s& _; h' y
143. [kingsoft browser shield]
     
144.   {D963BE1A-6B35-47DB-B002-49FAE71D85CC} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL, Kingsoft Corporation>
     ; W; o) |2 s- b9 h  Z' I( I
145. [IEBuddyExtControl Class]
     + C4 y( T# h# n1 s# h
146.   {3AECD3C1-7085-4731-96DC-47B6CF7EF749} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL, Kingsoft Corporation>
     
147. [Zcom 杂志]
     9 N# K+ A) `( A0 [9 I- P
148.   {4045D313-1D5E-4fe4-93A0-A34630B6A00B} <C:\Zcom\E-Space.exe, N/A>
     
149. [&Google]
     # H, h/ c0 j* S; K9 R* o
150.   {2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     3 H9 Z. p) O! z3 d' L/ C
151. [KooPlayer Control]
     + ^. f; k" q7 U! X% k
152.   {C728DAB8-FDF5-4CD7-89DD-879D25794C77} <C:\WINDOWS\system32\CCTVKO~1.OCX, Koos>
     
153. [Shockwave Flash Object]
     . J' ~% Y- x$ n3 x) b; p
154.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>
     6 Y! k2 m  W2 g8 X% ]. u
155. [KUpdateObj2 Class]
     
156.   {D82303B7-A754-4DCB-8AFC-8CF99435AACE} <C:\WINDOWS\system32\KingSoft\KOS\UpdateOcx2.dll, Kingsoft Corporation>
       M; }& a/ t- ?% O; F& }: Q
157. [Google Script Object]
     " ^6 z( @' _+ t/ B
158.   {00EF2092-6AC5-47C0-BD25-CF2D5D657FEB} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     % l6 _$ [" ^$ \5 r6 O/ A0 F- K
159. [EWA Control]
     ' o, ~: K. L0 u
160.   {18226BF8-DC0B-4D81-80E9-A41AE37BB73A} <C:\PROGRA~1\PPLive\SYNACA~2.OCX, Synacast>
       A. T8 [9 H4 P! S/ r
161. [Windows Media Player]
     
162.   {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\msdxm.ocx, Microsoft Corporation>
     5 J; f, S  S5 J6 _! _. Z3 D
163. [&Google]
     
164.   {2318C2B1-4965-11D4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     
165. [HTML Document]
     
166.   {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
     
167. [DHTML Edit Control Safe for Scripting for IE5]
     
168.   {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
     
169. [RealPlayer RAM Download Handler]
     
170.   {2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
     
171. [IEBuddyExtControl Class]
     5 t7 _3 Z2 Y, b" P
172.   {3AECD3C1-7085-4731-96DC-47B6CF7EF749} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL, Kingsoft Corporation>
     
173. [XML Document]
     5 ~, `' Z! G/ |  Q
174.   {48123BC4-99D9-11D1-A6B3-00C04FD91555} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
     - {8 \5 o/ T2 ^8 y. Y. |. d9 R
175. [HHCtrl Object]
     4 H( v! W  t' K' W; r
176.   {52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
     6 W" h( e1 `' x9 V
177. [Windows Media Player]
     
178.   {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     
179. [Active Desktop Mover]
     
180.   {72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
     
181. [360SafeLive]
     6 [' q8 i/ @: |# F, o6 F6 e
182.   {87515F61-A66C-4319-A0E0-D416CB8059E3} <C:\Program Files\360safe\live.dll, 360.cn>
     ) n: E8 r& @5 _# ~3 j! E
183. [Microsoft Web 浏览器]
     
184.   {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
     
185. [Browser Enhanced Objects]
     
186.   {986488AF-13D5-9DDF-4FEF-9FB88698CFC1} <C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\USERDATA\webbrowser_2011.dll, N/A>
     # m% `; Q$ P6 m; O- Y- u0 g: F
187. [Google Toolbar Helper]
     
188.   {AA58ED58-01DD-4D91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     . @* |% s1 N3 G- P8 v" T
189. [Microsoft Scriptlet Component]
     
190.   {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
     3 H( T; x' N- l
191. [Google Toolbar Notifier BHO]
     & D& x5 w8 Y; L$ u3 C. N/ K% R
192.   {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>
     
193. [SearchAssistantOC]
     ( }0 S& B5 v/ D4 a& y- E
194.   {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
     
195. [SafeMon Class]
     ! f4 u2 N4 W3 K8 l
196.   {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>
     : ^) F7 S* g4 @" S/ P0 u  B" D; f$ P
197. [RDS.DataSpace]
     
198.   {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
     
199. [KooPlayer Control]
     $ _  l# q6 a* q5 i& `) |/ ^
200.   {C728DAB8-FDF5-4CD7-89DD-879D25794C77} <C:\WINDOWS\system32\CCTVKO~1.OCX, Koos>
     
201. [AUDIO__MID Moniker Class]
     , v& Z( F  B' k1 p9 K
202.   {CD3AFA74-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     0 h# ^. n1 l1 v' @: D/ R
203. [AUDIO__MP3 Moniker Class]
     3 {: `, [- R% n! }
204.   {CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     . M" g: S: d% p) [& \+ r$ |; [
205. [AUDIO__X_MS_WMA Moniker Class]
     
206.   {CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     ( \9 N0 _" J6 e" a% A5 j, \
207. [VIDEO__X_MS_WMV Moniker Class]
     
208.   {CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     
209. [RealPlayer G2 Control]
     2 L) b& y5 e  R8 A
210.   {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
     , E  [  ]( t) {2 H8 V* Q
211. [Shockwave Flash Object]
     9 A9 ~, ^2 A, j9 }# k2 h3 b  b& ~
212.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>
     - h- u" ?/ y  J6 O
213. [KUpdateObj2 Class]
     
214.   {D82303B7-A754-4DCB-8AFC-8CF99435AACE} <C:\WINDOWS\system32\KingSoft\KOS\UpdateOcx2.dll, Kingsoft Corporation>
     / J) O4 g  e+ E2 C% i
215. [kingsoft browser shield]
     
216.   {D963BE1A-6B35-47DB-B002-49FAE71D85CC} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL, Kingsoft Corporation>
     
217. [PasswordEditCtrl Class]
     
218.   {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
     
219. [QvodCtrl Class]
     
220.   {F3D0D36F-23F8-4682-A195-74C92B03D4AF} <C:\Program Files\QvodPlayer\QvodInsert.dll, Shenzhen QVOD Technology Co.,Ltd>
     
221. [&使用超级旋风下载]
     1 U# t$ M6 D3 _- k5 @
222.   <C:\Program Files\Tencent\QQDownload\geturl.htm, N/A>
     
223. [&使用超级旋风下载全部链接]
     
224.   <C:\Program Files\Tencent\QQDownload\getAllurl.htm, N/A>
     & y  M! S- ~$ |% n+ K$ l4 F9 F7 Y
225. [使用迅雷下载]
     
226.   <, N/A>
     
227. [使用迅雷下载全部链接]
     
228.   <, N/A>
     
229. [导出到 Microsoft Office Excel(&X)]
     
230.   <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
     
231. [添加到QQ表情]
     
232.   <C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
     ( E5 E3 }3 F0 X2 G4 L
233. ==================================
     ! K' z- K* q: V  o% E: X1 @6 W
234. 正在运行的进程
     
235. [PID: 444 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
236. [PID: 496 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     - A. `3 D- s6 c- Y& I9 i# P! h9 N
237. [PID: 520 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     ! h* \/ O  y/ w; W
238.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
     
239. [PID: 564 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     0 z  v5 }: t* |. q
240. [PID: 576 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
241. [PID: 720 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
242. [PID: 780 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     / i1 F9 S8 m! C8 R
243. [PID: 856 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     $ [0 s# w1 L9 _6 O2 E1 G
244. [PID: 944 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     * t/ z" q6 h  s9 J+ ]1 e
245. [PID: 1012 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
246. [PID: 1236 / Administrator][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_qfe.070613-1311)]
     
247.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     * S9 w8 U& q) g1 q4 V
248.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
249.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
     " t+ x6 s1 O, |9 l
250.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     ! S0 H/ W' o5 U* H/ o+ D
251.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVEXT.DLL]  [Kingsoft Corporation, 2008,05,07,373]
       @! L$ u0 K( S0 M; P; @
252.     [C:\Program Files\Tencent\QQ\qdshm.dll]  [, 1, 0, 101, 20]
     
253.     [C:\Program Files\Tencent\QQ\MFC42.DLL]  [Microsoft Corporation, 6.00.8665.0]
     
254.     [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
     ' f  r; k3 Q" K5 W) S# Q
255.     [C:\WINDOWS\system32\shlhook.dll]  [Beijing Rising Technology Co., Ltd., 4.0.0.9]
       R' N6 R  J+ @/ W: i$ `
256.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     . i- E  {& {& I5 Z2 a
257.     [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
     - `4 D7 E2 W4 i2 d0 E+ r
258. [PID: 1332 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
     1 M) x) R  M- J; M8 m2 q
259.     [C:\WINDOWS\system32\mdimon.dll]  [Microsoft Corporation, 11.3.8166.2]
     
260.     [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll]  [Microsoft Corporation, 11.3.8166.2]
     
261. [PID: 1540 / Administrator][C:\Program Files\360safe\AntiArp\AntiArp.exe]  [360安全中心, 2, 0, 0, 1008]
     
262.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     + a& U0 U6 b" E* l) M
263.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     
264.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     7 ?7 j/ x! T- ?/ A+ ], K: R8 H
265.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
266. [PID: 1560 / Administrator][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     ) B6 W3 U) k8 G: }
267.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     
268.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     + Z% V4 a. c" Y( e/ H( N
269.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     $ f/ l: j. T+ ?3 h
270. [PID: 1576 / Administrator][C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe]  [Google Inc., 2, 0, 301, 1654]
     , n' m2 {* X: F( p& j5 o  S! m
271.     [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\gtn.dll]  [Google Inc., 2, 0, 301, 7164]
     
272.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     5 o# |; S& O& H" B/ `! Q( g
273.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
274.     [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\res_zh-CN.dll]  [Google Inc., 2, 0, 301, 7164]
     : v: F, s6 Q7 W0 [# p- m: g# G
275.     [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll]  [Google Inc., 2, 0, 301, 7164]
     " s' P4 c/ @3 O1 K9 G" L+ w
276.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     ! ~* s' |/ ]1 q! ]/ n! G$ s
277.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     ; ?; ?: Q# m: p! R9 E. x% G
278. [PID: 1648 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
279. [PID: 1744 / SYSTEM][C:\Program Files\QvodPlayer\QvodTerminal.exe]  [Shenzhen QVOD Technology Co.,Ltd, 2, 5, 0, 53]
     
280. [PID: 1860 / SYSTEM][C:\WINDOWS\system32\skeys.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
281. [PID: 1908 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     ( [4 x# F* `7 `- v6 H* j
282. [PID: 1964 / LOCAL SERVICE][C:\WINDOWS\system32\wdfmgr.exe]  [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
     
283. [PID: 2772 / Administrator][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
     
284.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     & V) _9 T% w6 P/ H( I
285.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     , \" o" a! ]& l, E  r' K
286.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     + |$ g' G* a+ t5 H8 j( H
287.     [c:\program files\google\googletoolbar2.dll]  [Google Inc., 4, 0, 1606, 6690]
     
288.     [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll]  [Google Inc., 2, 0, 301, 7164]
     
289.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL]  [Kingsoft Corporation, 2008,04,15,2]
     0 _- d" D' v% h. e9 w' p
290.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddy.dll]  [Kingsoft Corporation, 2008,04,15,2]
     
291.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL]  [Kingsoft Corporation, 2008,05,14,83]
       d6 B/ E# @  ~( X/ ]5 y! g
292.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KANTray.dll]  [Kingsoft Corporation, 2008,04,15,2]
     
293.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVAFish.DLL]  [Kingsoft Corporation, 2008,05,13,78]
     ( k8 T: G% ^/ p) b" B& @$ {3 e
294.     [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
     $ s4 T! T' g3 P( L7 X4 M) q
295.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
     ; B& T* b% y! P, L3 Z/ g
296.     [C:\WINDOWS\system32\WN.IME]  [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
     
297.     [C:\Program Files\ShiQiang\wnime\Dll32\wnpy_StatusWnd.dll]  [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
     , g+ ~3 ~! y( Q8 q* V- q" J
298.     [C:\Program Files\ShiQiang\wnime\Dll32\wnpy_CompWnd.dll]  [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
     
299.     [C:\Program Files\ShiQiang\wnime\Dll32\wnpy_Query.dll]  [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
     
300.     [C:\WINDOWS\system32\SOGOUPY.IME]  [Sogou.com Inc., 3.2.0.0]
     , A  q1 J# t& y. @. f) ~: z
301.     [C:\Documents and Settings\Administrator\My Documents\SogouInput\Plugin\SgImeWord.dll]  [Sogou.com Inc., 3.2.0.0]
     
302.     [C:\WINDOWS\system32\WINWB98.IME]  [Microsoft Corporation, 4.00.950]
     
303.     [C:\WINDOWS\system32\WINWB86.IME]  [Microsoft Corporation, 4.00.950]
     
304.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
305. [PID: 1124 / Administrator][C:\Program Files\Tencent\QQ\TXPlatform.exe]  [Tencent, 1, 0, 170, 0]
     
306.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     
307.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     
308.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     , N. C  Q. A) t5 g
309.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     ! W" d2 B( Z5 G3 A! `2 Q
310. [PID: 928 / Administrator][F:\arvmon.exe]  [任软工作室, 2.2.5.201]
     # S5 k+ ~! e+ y# F8 ?$ c5 T4 y
311.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     ) R# B% ~+ _0 ^% m3 p. f6 H% q
312.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     & U3 s7 Z& t) E
313.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
314.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
315.     [F:\Vdata.dll]  [任软工作室, 2, 2, 1, 94]
     
316. [PID: 2540 / Administrator][F:\AutoGuarder.exe]  [任软工作室, 2.2.5.201]
     
317.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     + D5 S  @5 k+ p$ O& t
318.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     / ~+ ~6 B! Q9 x! Q' ?" C+ t# [
319.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
320.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
321. [PID: 2476 / Administrator][d:\我的文档\桌面\系统检测修复\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
     7 x8 s2 ~& T7 I2 `
322.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     
323.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     : L) d6 u8 j$ H6 o* u0 S( Z
324.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
325.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     - O/ i! V# A  }% \
326.     [d:\我的文档\桌面\系统检测修复\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]
     
327. ==================================
     8 _% O" y* ~% A; S& u4 Y; C% u
328. 文件关联
     
329. .TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
     4 l: z9 R* L$ z$ H9 g* Q9 z# k
330. .EXE  OK. ["%1" %*]
     / X  G3 e4 s# k* t
331. .COM  OK. ["%1" %*]
     9 ^* q: ^) b$ r% F2 n4 y: q
332. .PIF  OK. ["%1" %*]
     / ?# Y. H6 g3 K3 U
333. .REG  OK. [regedit.exe "%1"]
     0 ?( h" d. O2 C. A% P+ y$ w5 T9 A
334. .BAT  OK. ["%1" %*]
     # F/ r* T; z3 M( c! _  H  @
335. .SCR  OK. ["%1" /S]
     
336. .CHM  OK. ["C:\WINDOWS\hh.exe" %1]
     
337. .HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
     
338. .INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
     2 E! w+ ]; F! B# l
339. .INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
     
340. .VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
     
341. .JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
     : k1 t& a( V! k/ p# w: O) D5 T
342. .LNK  OK. [{00021401-0000-0000-C000-000000000046}]
     
343. ==================================
     
344. Winsock 提供者
     
345. N/A
     2 j9 m' ~& J* o1 z
346. ==================================
     2 p* |% e/ I; e% [5 I/ |
347. Autorun.inf
     & |8 ~" _, C1 a6 x, d9 B  n, Q
348. N/A
     + F# K4 o, W( J, `
349. ==================================
     # p$ z& S  W# |; Z/ t
350. HOSTS 文件
     
351. N/A
     
352. ==================================
     3 h1 y) a/ Y4 k+ @& u3 n0 I
353. 进程特权扫描
     . v: A3 N) o; O# x7 ?2 R/ J
354. 特殊特权被允许： SeLoadDriverPrivilege [PID = 520, C:\WINDOWS\SYSTEM32\WINLOGON.EXE]
     
355. 特殊特权被允许： SeDebugPrivilege [PID = 928, F:\ARVMON.EXE]
     5 ~4 W4 _6 X4 K& F* u+ b9 S! ^
356. 特殊特权被允许： SeLoadDriverPrivilege [PID = 928, F:\ARVMON.EXE]
     
357. 特殊特权被允许： SeDebugPrivilege [PID = 2540, F:\AUTOGUARDER.EXE]
     ! L& x; y  Y' M, P+ @' R0 \
358. 特殊特权被允许： SeLoadDriverPrivilege [PID = 2540, F:\AUTOGUARDER.EXE]
     , D# ?% \) ^/ ]& \4 D$ [4 O
359. ==================================
     / U) z" |# u9 v0 b  n
360. API HOOK
     
361. N/A
     : U$ ^, p, L9 X, a9 A! @
362. ==================================
     & t1 ?/ _5 F0 \2 \
363. 隐藏进程
     - u6 L7 ?8 S( P1 F9 t
364. N/A
     
365. ==================================
     
366. 
     

复制代码

傲天♂扬帆

跟原始说了，不知道能不能看明白。。。

傲天♂元始

[Start]
& J! L; q$ ^6 Y+ T$ K
2008-05-22,22:24:21
* p5 n$ H9 I8 C/ S
SREngLOG智能分析专家 V1.2.0.125
Tored (http://hi.baidu.com/peaset)
: @# {6 i" X7 Q% a
======================================================
4 g! U, k5 n0 }以下过程将用到SREng、PowerRmv，如果您不熟悉这两款工具的使用方法，请参考下列链接：
SREng详细操作方法： http://hi.baidu.com/peaset/blog/ ... dd19224e4aeadf.html
* q5 `* B3 B0 a7 J" H6 nPowerRmv详细操作方法： http://hi.baidu.com/peaset/blog/ ... 6fb5eb77c63816.html
( U. y2 c# [& q; ?======================================================
8 w5 E0 v6 o. L" e% W* A1 X
) m$ o2 o9 G6 d2 B以下是病毒清除步骤：
4 O0 o# B9 h+ k6 G. m
1、用PowerRmv删除以下文件(没有则跳过)：
* X8 \5 `7 O8 H$ J- q/ S+ z1 h6 ]" t
4 y$ ^! h6 s2 X  ]; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
;
4 X# W4 P: k# O. a' }9 W  c; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
: g5 P  L* A. b! o& ZC:\WINDOWS\System32\3wareSrv.exe
. i0 s1 ^' y$ z9 ]/ m\SystemRoot\C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll

. u2 B6 P7 E) M7 q+ u\SystemRoot\System32\DRIVERS\22jn.sys
\SystemRoot\System32\DRIVERS\43ecu.sys
% Q2 T5 w: \! |$ L& g/ `' ^\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys
\SystemRoot\system32\drivers\pnduojtwbt.sys
\SystemRoot\system32\drivers\RsBoot.sys
+ _% H1 Y$ |0 r0 rsystem32\DRIVERS\sr.sys
5 @' Z) e# S, z9 J2 I* e5 `\SystemRoot\system32\drivers\unzxzsrs.sys
\SystemRoot\system32\DRIVERS\ViBus.sys
% K$ t: f4 {. T0 R; K0 A4 Y\SystemRoot\system32\drivers\zhibmaso.sys

0 A) N+ B. K+ C) k* \0 G1 E7 b" y. H2、用SREng删除以下【注册表】项(没有则跳过)：
- X1 X9 w  ~8 l1 \' {
. T& `* C1 o3 ?5 e<IMJPMIG8.1>
<PHIME2002A>
, ~6 B+ j, Z" n, V$ _  b3 \<PHIME2002ASync>
5 K: x, l. P8 p6 N$ |5 V" O
2 Q+ m/ x6 w& {& G' @3、用SREng删除【所有启动文件夹】内容(没有则跳过)

- h" d+ }1 o- S: L7 R( I* I4、用SREng删除以下【服务】项(没有则跳过)：

[3ware Controller Service / 3wareSrv]
# y! t) J# z, ^, W+ t$ B) m[NetMeeting Remote Desktop Sharing / mnmsrvc]

5、用SREng删除以下【驱动程序】项(没有则跳过)：
; T& x+ a6 R: a
" @0 H  G1 n3 e[22j / 22jn]
5 i8 e1 ?" p% \; m% s. j7 p* x[43ec / 43ecu]
+ i* a4 m  V( O6 i[ntptdb / ntptdb]
[pnduojtwbt / pnduojtwbt]
[RsAntiSpyware / RsAntiSpyware]
[System Restore Filter Driver / sr]
[System Services / unzxzsrs]
- i: x8 ]9 v; u. ~% y8 L  |9 M6 g. h[ViBus / ViBus]
) A4 ?  C3 [' D/ e' ^! b0 y2 Z* [[ATI Extend / zhibmaso]

6、用SREng删除以下【浏览器加载项】项(没有则跳过)：
0 w. _. S) Q0 @% `" |; B/ X( w
[Zcom 杂志]
[Browser Enhanced Objects]
6 J, G7 o7 Z  H2 v% A/ ?
* F- }! U  |/ n8 h2 v& r+ s* {最后,重新启动计算机.Tored祝您好运!
0 F0 n5 S5 @/ v, Q6 Y  i6 }======================================================
" {& J$ k# C4 @/ h% P# h. S+ [[End]

傲天♂元始

你就这样弄，不行我也没办法

傲天♂扬帆

独恋有按原始说的重新操作一次吗？

独恋伊影

找不到要删的文件。。。。

傲天♂元始

有些都是隐藏起来的

傲天♂风云

5 C7 B9 q  C& c4 m$ Z$ U: G8 w2 H
/ |. u5 [4 f: M$ N4 w- R8 k, b6 g6 ^4 M我对代码 一点都不懂

傲天♂元始

。。。这不是代码只是系统的扫描日志而已

傲天♂冷漠

我汗~~~
+ ~7 [1 c2 w& H  a6 ~, X8 f这么多代码~~~