在这里

独恋伊影

1. 
   0 g/ F  A4 Z3 Q! H
2. 2008-05-22,20:37:43
   8 d. x+ V4 [9 i. j- N7 S
3. System Repair Engineer 2.5.16.900
   . Z! M* b) g4 o4 H. S+ J
4. Smallfrogs (http://www.KZTechs.com)
   % ^% c! b- I- v8 U" f/ x  Q& Q
5. Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
   * ~$ y" o0 O  Y
6. 以下内容被选中：
   
7.     所有的启动项目（包括注册表、启动文件夹、服务等）
   ; L9 X: A2 x0 W, ]! R9 T- e3 W
8.     浏览器加载项
   ; J% h0 @$ p- B9 d" c3 U- L( ?" U
9.     正在运行的进程（包括进程模块信息）
   # z& U' n" S+ o" ]
10.     文件关联
    4 u& ?+ H4 M8 A/ w& k
11.     Winsock 提供者
    
12.     Autorun.inf
    7 i; z7 W% E! L+ j# U  P+ a) W0 W
13.     HOSTS 文件
    % q' x- l  N' a. g0 _
14.     进程特权扫描
    # {4 {  P: I0 J$ R# I7 o
15. 
      x/ e( ~0 t/ Z/ ^" `4 ]
16. 启动项目
    , m# R6 s9 s2 o5 F) Q
17. 注册表
    7 u+ ~9 @; V) P" c; ~: I' s4 x( |( j
18. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    4 [  N/ r; e$ @6 y4 ]
19.     <ctfmon.exe><C:\WINDOWS\system32\CTFMON.EXE>  [(Verified)Microsoft Windows Publisher]
    4 w. ^! H9 a9 n6 ?$ J& e; r7 @) i
20. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    
21.     <360Safebox><"C:\Program Files\360Safebox\safeboxTray.exe" /r>  [(Verified)Qizhi Software (beijing) Co. Ltd]
    # i1 p8 A; z+ p) V. g" X6 W9 J
22.     <360Safetray><C:\Program Files\360safe\safemon\360tray.exe /start>  [(Verified)Qizhi Software (beijing) Co. Ltd]
    
23.     <360Antiarp><C:\Program Files\360safe\AntiArp\AntiArp.exe /start>  [(Verified)Qizhi Software (beijing) Co. Ltd]
    1 O- d' c! ~3 ?0 C% E: c4 f/ a
24.     <KavStart><"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVStart.exe" -startup>  [(Verified)KINGSOFT CORPORATION]
    
25.     <IMJPMIG8.1><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32>  [N/A]
    
26.     <PHIME2002A><; >  [N/A]
    
27.     <PHIME2002ASync><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32>  [N/A]
    
28. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    + f: x4 G# `: s- b* i! y1 G$ W/ X. g6 T
29.     <shell><Explorer.exe>  [(Verified)Microsoft Windows Component Publisher]
    - a2 R- M8 s/ {3 K  R" V/ F
30.     <Userinit><C:\WINDOWS\system32\UserInit.exe,>  [(Verified)Microsoft Windows Publisher]
    + G( l7 c5 Q7 m% L% ?6 l
31.     <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
    % _+ z/ P) J0 A1 v1 |
32. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    
33.     <{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}><C:\WINDOWS\system32\shlhook.dll>  [Beijing Rising Technology Co., Ltd.]
    
34. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
    1 A# c$ ?7 Y% \* L0 @4 j2 c
35.     <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [N/A]
    + {. @3 k! h5 W! V1 [* J7 p
36. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
    
37.     <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]
    
38. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
    5 w5 @7 {; M4 H$ |- z8 a
39.     <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]
    
40. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
    2 A6 P8 f) R! Y5 f
41.     <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
    9 n1 d+ }0 [: \# R0 f
42. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
    ( W+ u! |; x5 j/ _% X
43.     <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Remove.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
    % X3 t8 M: M5 X' e9 k
44. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
    
45.     <Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser>  [(Verified)Microsoft Windows Publisher]
    
46. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
    
47.     <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub>  [(Verified)Microsoft Windows Publisher]
    
48. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
    
49.     <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]
    % B% j7 C7 H; n( ]( `' |
50. ==================================
    
51. 启动文件夹
    9 @* E9 P% z1 `
52. N/A
    ( R& v* v4 y5 v& b
53. ==================================
    7 W; _- t3 n- v! ]' Q  r, ^
54. 服务
    7 [! Z/ `3 w0 D" p3 Q! c" i6 L, @9 G
55. [3ware Controller Service / 3wareSrv][Stopped/Auto Start]
    
56.   <C:\WINDOWS\System32\3wareSrv.exe><N/A>
    2 g# E) q" o% `' |' O
57. [Google Updater Service / gusvc][Stopped/Manual Start]
    : m& H3 P8 Z( Y3 M
58.   <"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"><Google>
    
59. [Help and Support / helpsvc][Stopped/Disabled]
    
60.   <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll><N/A>
    
61. [Human Interface Device Access / HidServ][Stopped/Boot Start]
    
62.   <\SystemRoot\C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
    7 Y6 Q8 B0 O& t. M- Y+ b
63. [Kingsoft Internet Security Common Service / KISSvc][Stopped/Auto Start]
    " n1 ?, q: O$ O6 V" u, B+ m
64.   <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KISSvc.EXE><Kingsoft Corporation>
    
65. [Kingsoft Personal Firewall Service / KPfwSvc][Running/Auto Start]
      w: U9 W* J9 i( L8 T8 z
66.   <"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KPfwSvc.EXE"><Kingsoft Corporation>
    8 x" h1 R5 l4 H& ~0 u3 y
67. [Kingsoft Antivirus KWatch Service / KWatchSvc][Running/Auto Start]
    - C  c: W5 A! F; W3 I* l3 G. N8 @
68.   <"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KWatch.EXE"><Kingsoft Corporation>
    , u" c1 @, \( O: `8 H: N5 ]- s
69. [NetMeeting Remote Desktop Sharing / mnmsrvc][Stopped/Manual Start]
    
70.   <><N/A>
    
71. [Qvod Terminal / Qvod Terminal][Running/Auto Start]
    
72.   <C:\Program Files\QvodPlayer\QvodTerminal.exe><Shenzhen QVOD Technology Co.,Ltd>
    
73. ==================================
    
74. 驱动程序
    
75. [22j / 22jn][Stopped/Boot Start]
    
76.   <\SystemRoot\System32\DRIVERS\22jn.sys><N/A>
    
77. [360AntiArp / 360AntiArp][Running/System Start]
    
78.   <\??\C:\WINDOWS\system32\drivers\360AntiArp.sys><360安全中心>
    
79. [43ec / 43ecu][Stopped/Boot Start]
    
80.   <\SystemRoot\System32\DRIVERS\43ecu.sys><N/A>
    ; D. H% M; h0 y: ?0 g, u/ z, G
81. [Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Running/Manual Start]
    4 W( A# x: E" C7 S
82.   <system32\drivers\ac97intc.sys><Intel Corporation>
    
83. [Promise driver accelerator / bb-run][Running/Boot Start]
    + o% T. p! p# }5 z
84.   <\SystemRoot\system32\DRIVERS\bb-run.sys><Promise Technology, Inc.>
    
85. [Promise Removable Disk Control Driver / dontgo][Running/Boot Start]
    / j( A; M) F. P3 z3 ?5 ~) U: i
86.   <\SystemRoot\system32\DRIVERS\DontGo.sys><Promise Technology, Inc.>
    $ c& c) j5 A1 V' I
87. [KAVBase / KAVBase][Running/Auto Start]
    
88.   <\??\C:\WINDOWS\system32\Drivers\KAVBase.sys><Kingsoft Corporation>
    
89. [KAVBootC / KAVBootC][Running/Boot Start]
    + u4 b7 n' S- @& m$ k- U$ N: d& q
90.   <\SystemRoot\system32\Drivers\KAVBootC.sys><Kingsoft Corporation>
    + }: N. l& N1 z" K% K' W" I3 x
91. [KAVSafe / KAVSafe][Running/Auto Start]
    / x0 Q0 y$ q3 ]- F* O
92.   <\??\C:\WINDOWS\system32\Drivers\KAVSafe.sys><Kingsoft Corporation>
    3 e# T4 P  E! \1 q7 R
93. [KNetWch / KNetWch][Running/System Start]
    9 b+ o9 T! ]3 G: J1 j, w+ u% T( u0 y
94.   <\??\C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KNetWch.SYS><Kingsoft Corporation>
    
95. [KWatch3 / KWatch3][Running/Auto Start]
    
96.   <\??\C:\WINDOWS\system32\drivers\KWatch3.SYS><Kingsoft Corporation>
    : E0 @# Z$ g/ t7 a) l2 _
97. [ntptdb / ntptdb][Stopped/Auto Start]
    
98.   <\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys><N/A>
    ; u3 \2 u/ C! y2 @+ e4 j, c
99. [nv / nv][Running/Manual Start]
      ^7 r: J  f" ^( u
100.   <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
     / ~0 T% r' W$ P* i- R
101. [NVIDIA nForce RAID Driver / nvrd32][Running/Boot Start]
     " r5 T8 r/ E) P% r: G: a: ?
102.   <\SystemRoot\system32\DRIVERS\nvrd32.sys><NVIDIA Corporation>
     
103. [DDK PACKET Protocol / Packet][Running/Manual Start]
     - x( ^4 U7 z4 ^3 J0 V
104.   <system32\DRIVERS\ProtoDrv.sys><360安全中心>
     + F# k" N  I9 ~/ K
105. [pnduojtwbt / pnduojtwbt][Stopped/Boot Start]
     
106.   <\SystemRoot\system32\drivers\pnduojtwbt.sys><N/A>
     & W+ u$ J0 |2 j: {& N7 D
107. [Direct Parallel Link Driver / Ptilink][Running/Manual Start]
     9 `2 K) n3 n  X: ^+ X
108.   <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
     5 \. B  m) z  a( U* ^  I4 C5 S
109. [RsAntiSpyware / RsAntiSpyware][Stopped/Boot Start]
     
110.   <\SystemRoot\system32\drivers\RsBoot.sys><N/A>
     
111. [Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
     
112.   <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
     / M2 y, R5 ]# X3 H+ r
113. [SafeBoxKrnl / SafeBoxKrnl][Running/System Start]
     8 o9 f. ~& e& [& o
114.   <\??\C:\Program Files\360Safebox\SafeBoxKrnl.sys><360安全中心>
     # u" ~5 n2 H: G' g3 V% ?
115. [Secdrv / Secdrv][Stopped/Manual Start]
     + M$ Q+ K: ^6 {, }8 Y; m9 x, K
116.   <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
     
117. [SATALink External Device Filter / SiRemFil][Running/Boot Start]
     ! r. G& C* E+ u5 X
118.   <\SystemRoot\system32\DRIVERS\SiRemFil.sys><Silicon Image, Inc.>
     & S0 \; p+ U, [+ Z) G8 W6 u) G
119. [System Restore Filter Driver / sr][Stopped/Disabled]
     ; x/ W3 J4 A: n$ u: f" X
120.   <system32\DRIVERS\sr.sys><N/A>
     # {  W$ g9 j  r% D
121. [TesSafe / TesSafe][Stopped/Manual Start]
     7 x8 b/ A% ~# d2 l! W
122.   <\??\C:\WINDOWS\system32\TesSafe.sys><TENCENT>
     9 W) g  K6 r+ C! D1 _5 J
123. [System Services / unzxzsrs][Stopped/Boot Start]
     . X, P3 u; g* C; I/ v% D5 p7 ^' a* e
124.   <\SystemRoot\system32\drivers\unzxzsrs.sys><N/A>
     
125. [ViBus / ViBus][Stopped/Boot Start]
     
126.   <\SystemRoot\system32\DRIVERS\ViBus.sys><N/A>
     3 G- R/ t# |& [, U
127. [World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
     
128.   <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
     
129. [VIA SATA IDE Hot-plug Driver / xfilt][Running/Boot Start]
     4 j$ c. o4 ]) V; b5 S* @1 a3 H
130.   <\SystemRoot\system32\DRIVERS\xfilt.sys><VIA Technologies,Inc>
     * ~6 L  ]/ F  n( S0 E  l  b
131. [ATI Extend / zhibmaso][Stopped/Boot Start]
     7 a0 s5 t/ j1 x5 D0 `9 y
132.   <\SystemRoot\system32\drivers\zhibmaso.sys><N/A>
     
133. [Vimicro USB PC Camera (ZC0301PL) / ZSMC301b][Running/Manual Start]
     6 O1 _" l' _+ M% N- i
134.   <System32\Drivers\usbVM31b.sys><Vimicro Corporation>
     
135. ==================================
     6 N  L& @- b. c' C1 p! a/ B
136. 浏览器加载项
     
137. [Google Toolbar Helper]
     + \* I* Y" m, z4 N
138.   {AA58ED58-01DD-4d91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     , k9 ?1 P9 R: j) D5 h2 W
139. [Google Toolbar Notifier BHO]
     
140.   {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>
     * I" V2 A2 B" J* u) r  l
141. [SafeMon Class]
       u6 J6 l, Z7 q+ B6 x2 s( D$ Z
142.   {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>
     / X( S* M' M9 Q
143. [kingsoft browser shield]
     : c2 F; b1 F, H+ ^
144.   {D963BE1A-6B35-47DB-B002-49FAE71D85CC} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL, Kingsoft Corporation>
     + u, X  F7 p+ S+ x
145. [IEBuddyExtControl Class]
     5 t" U: N, Z; u: ?. l5 L
146.   {3AECD3C1-7085-4731-96DC-47B6CF7EF749} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL, Kingsoft Corporation>
     , P8 Y* ]2 F- E9 a7 i  h1 h" W- r0 G
147. [Zcom 杂志]
     7 [+ P0 ^6 B9 ~0 P  t+ m
148.   {4045D313-1D5E-4fe4-93A0-A34630B6A00B} <C:\Zcom\E-Space.exe, N/A>
     
149. [&Google]
     ' L& a: Y8 l8 K, B' C
150.   {2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     5 t  ?7 N% {0 m* `& w  W
151. [KooPlayer Control]
     & ^4 F/ T$ k8 U5 F/ q& ~  d
152.   {C728DAB8-FDF5-4CD7-89DD-879D25794C77} <C:\WINDOWS\system32\CCTVKO~1.OCX, Koos>
     3 k* v4 r3 r1 o  w  M; H. E
153. [Shockwave Flash Object]
     2 P" A4 ^+ G) W7 P3 F
154.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>
     
155. [KUpdateObj2 Class]
     + M+ e1 T) g( k, L/ i
156.   {D82303B7-A754-4DCB-8AFC-8CF99435AACE} <C:\WINDOWS\system32\KingSoft\KOS\UpdateOcx2.dll, Kingsoft Corporation>
     
157. [Google Script Object]
     0 Q$ Z- l4 W7 p) J: k; |) [
158.   {00EF2092-6AC5-47C0-BD25-CF2D5D657FEB} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     
159. [EWA Control]
       P( J' A% C) d9 u5 U; E
160.   {18226BF8-DC0B-4D81-80E9-A41AE37BB73A} <C:\PROGRA~1\PPLive\SYNACA~2.OCX, Synacast>
     
161. [Windows Media Player]
     
162.   {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\msdxm.ocx, Microsoft Corporation>
     : N# m0 J2 i( v* t, G% d2 j- i/ J
163. [&Google]
     3 `' B: o/ e3 i! K
164.   {2318C2B1-4965-11D4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     
165. [HTML Document]
     : Y% @, H3 V0 T0 N( G' M
166.   {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
       E/ [* I2 {. u
167. [DHTML Edit Control Safe for Scripting for IE5]
     * S8 ^) d& n! N( }* ]
168.   {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
     
169. [RealPlayer RAM Download Handler]
     
170.   {2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
     
171. [IEBuddyExtControl Class]
     8 n( K3 N. e9 `: m) L# n4 ?
172.   {3AECD3C1-7085-4731-96DC-47B6CF7EF749} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL, Kingsoft Corporation>
     
173. [XML Document]
     
174.   {48123BC4-99D9-11D1-A6B3-00C04FD91555} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
     
175. [HHCtrl Object]
     6 r! W9 i5 }  x0 K
176.   {52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
     8 ^# c1 M; f+ o& {) Q& N$ q
177. [Windows Media Player]
     1 l' k) d% `( w# b9 b
178.   {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     
179. [Active Desktop Mover]
     
180.   {72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
     ' ]2 p4 j3 y# V. ~; `" B
181. [360SafeLive]
     
182.   {87515F61-A66C-4319-A0E0-D416CB8059E3} <C:\Program Files\360safe\live.dll, 360.cn>
     # O% @' G$ C. N: u
183. [Microsoft Web 浏览器]
     ) Q( _6 |: k" C$ J8 [( h
184.   {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
     
185. [Browser Enhanced Objects]
     
186.   {986488AF-13D5-9DDF-4FEF-9FB88698CFC1} <C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\USERDATA\webbrowser_2011.dll, N/A>
     
187. [Google Toolbar Helper]
     
188.   {AA58ED58-01DD-4D91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     
189. [Microsoft Scriptlet Component]
     ; R$ f7 h+ \+ f) I' B4 O
190.   {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
     ) g9 h2 X& S* I" h. p3 D
191. [Google Toolbar Notifier BHO]
     6 e0 E, n: T' `* r3 g1 {7 u
192.   {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>
     
193. [SearchAssistantOC]
     0 i1 [3 b5 e5 M. f2 U5 M
194.   {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
     $ ^5 E" i" J1 U" g" N' z
195. [SafeMon Class]
     + k1 W" s' k1 W& X! o8 d0 \. Z
196.   {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>
     
197. [RDS.DataSpace]
     2 J' U/ r2 w0 R2 s) W) s8 [) p
198.   {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
     + {) [  f% P- e8 `' ]# {2 B
199. [KooPlayer Control]
     " Z) H' j" b+ [) \0 l- s
200.   {C728DAB8-FDF5-4CD7-89DD-879D25794C77} <C:\WINDOWS\system32\CCTVKO~1.OCX, Koos>
     . Q1 {7 }! {: r5 ]
201. [AUDIO__MID Moniker Class]
     
202.   {CD3AFA74-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     $ o+ r) v$ Z. i2 }% ^
203. [AUDIO__MP3 Moniker Class]
     ; \1 ~. k! Z+ @& k" m' ]
204.   {CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     
205. [AUDIO__X_MS_WMA Moniker Class]
     
206.   {CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     % d7 x! `, b# _1 @
207. [VIDEO__X_MS_WMV Moniker Class]
     * f! b: q. s  ?, F
208.   {CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     
209. [RealPlayer G2 Control]
     
210.   {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
     
211. [Shockwave Flash Object]
     ( j. x3 D7 x$ f
212.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>
     ; p1 w, |0 a/ _4 c& j9 u
213. [KUpdateObj2 Class]
     
214.   {D82303B7-A754-4DCB-8AFC-8CF99435AACE} <C:\WINDOWS\system32\KingSoft\KOS\UpdateOcx2.dll, Kingsoft Corporation>
     1 j5 i" I7 W; x, [/ v
215. [kingsoft browser shield]
     / ?2 l- |& D$ _9 s/ x  h6 h
216.   {D963BE1A-6B35-47DB-B002-49FAE71D85CC} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL, Kingsoft Corporation>
     6 G" C) R+ k/ a+ R
217. [PasswordEditCtrl Class]
     ( I9 a$ ]; L$ z
218.   {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
     3 l6 y1 L+ Y9 H9 M  r5 k
219. [QvodCtrl Class]
     
220.   {F3D0D36F-23F8-4682-A195-74C92B03D4AF} <C:\Program Files\QvodPlayer\QvodInsert.dll, Shenzhen QVOD Technology Co.,Ltd>
     ; A4 T. i; A: j+ |* ?
221. [&使用超级旋风下载]
     
222.   <C:\Program Files\Tencent\QQDownload\geturl.htm, N/A>
     
223. [&使用超级旋风下载全部链接]
     - ^- H% n) K  q% \
224.   <C:\Program Files\Tencent\QQDownload\getAllurl.htm, N/A>
     7 O* z4 k" |! P- s7 z# X
225. [使用迅雷下载]
     1 m0 O( l& E7 v# }2 w* D' ?
226.   <, N/A>
     8 [" u* J' S* c" B
227. [使用迅雷下载全部链接]
     : M/ N- ]$ X& O9 o  y4 q! K
228.   <, N/A>
     
229. [导出到 Microsoft Office Excel(&X)]
     1 k' L8 P+ Y1 `% N/ P# b, E0 a
230.   <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
     : T8 H/ P( k* _6 k1 ?( f- Y% b
231. [添加到QQ表情]
     
232.   <C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
     0 g+ e( t8 i1 L) z  P5 h8 D7 n
233. ==================================
     : t- `6 f  m7 X; g" [8 X/ E! I
234. 正在运行的进程
     % M9 n% L2 U+ H/ F, I
235. [PID: 444 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
236. [PID: 496 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
237. [PID: 520 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
238.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
     
239. [PID: 564 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     ' [8 t) M6 B, g# O
240. [PID: 576 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     6 r9 d" A( w- C; {* o5 g  p! Z
241. [PID: 720 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
242. [PID: 780 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     ) H- S3 U! W* F" k/ V4 C
243. [PID: 856 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     7 u/ F( y7 N8 l& o- n# a  J
244. [PID: 944 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
245. [PID: 1012 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
246. [PID: 1236 / Administrator][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_qfe.070613-1311)]
     
247.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     
248.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     + p2 h% L% T0 ]$ ]0 U
249.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
     ' s  T1 E3 A( m5 N" ^
250.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     
251.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVEXT.DLL]  [Kingsoft Corporation, 2008,05,07,373]
     ( X  M1 c1 ~( z2 o' u
252.     [C:\Program Files\Tencent\QQ\qdshm.dll]  [, 1, 0, 101, 20]
     
253.     [C:\Program Files\Tencent\QQ\MFC42.DLL]  [Microsoft Corporation, 6.00.8665.0]
     
254.     [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
     / L$ c3 l- y' [! g
255.     [C:\WINDOWS\system32\shlhook.dll]  [Beijing Rising Technology Co., Ltd., 4.0.0.9]
     
256.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     . q6 _& ~# N8 i  E% K& v1 l) T
257.     [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
     / @8 s. W* f0 e7 g
258. [PID: 1332 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
     1 H  @7 |7 i2 P; J/ u' p" n9 Q& C7 D
259.     [C:\WINDOWS\system32\mdimon.dll]  [Microsoft Corporation, 11.3.8166.2]
     * O; Z- Y$ |4 Y$ w4 J. P
260.     [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll]  [Microsoft Corporation, 11.3.8166.2]
     & ?: I7 m" ^2 t  b$ T9 H
261. [PID: 1540 / Administrator][C:\Program Files\360safe\AntiArp\AntiArp.exe]  [360安全中心, 2, 0, 0, 1008]
     
262.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     
263.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     
264.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     % {* s* S* X! p6 U0 a7 R
265.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
266. [PID: 1560 / Administrator][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     7 Y% l$ D- G6 o! L9 X
267.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     8 F1 f7 ]1 G$ {( G+ G% M  }+ _
268.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     " j/ s8 _2 W4 {' i! H5 a( f  X3 F
269.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
270. [PID: 1576 / Administrator][C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe]  [Google Inc., 2, 0, 301, 1654]
     
271.     [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\gtn.dll]  [Google Inc., 2, 0, 301, 7164]
     
272.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     
273.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     1 {5 j- V4 I. _1 B) ^* t
274.     [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\res_zh-CN.dll]  [Google Inc., 2, 0, 301, 7164]
     
275.     [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll]  [Google Inc., 2, 0, 301, 7164]
     0 t4 E" P) V5 G( F, e4 Z' p' L- c" B
276.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     " n& r1 y0 Y1 G! g9 Z: l
277.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
278. [PID: 1648 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     ' [/ F8 X. A3 e
279. [PID: 1744 / SYSTEM][C:\Program Files\QvodPlayer\QvodTerminal.exe]  [Shenzhen QVOD Technology Co.,Ltd, 2, 5, 0, 53]
     
280. [PID: 1860 / SYSTEM][C:\WINDOWS\system32\skeys.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     # y2 z& f' L# y: @  V0 j$ K
281. [PID: 1908 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
282. [PID: 1964 / LOCAL SERVICE][C:\WINDOWS\system32\wdfmgr.exe]  [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
     
283. [PID: 2772 / Administrator][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
     
284.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     
285.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     , o1 Y1 ^7 ~- M( ~, ~
286.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     ; C0 a) p2 ]7 F. S. ^9 B& ~
287.     [c:\program files\google\googletoolbar2.dll]  [Google Inc., 4, 0, 1606, 6690]
     ; \1 }2 w3 N; @' I1 o6 c
288.     [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll]  [Google Inc., 2, 0, 301, 7164]
     
289.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL]  [Kingsoft Corporation, 2008,04,15,2]
     
290.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddy.dll]  [Kingsoft Corporation, 2008,04,15,2]
     ; B" W1 q% a. }
291.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL]  [Kingsoft Corporation, 2008,05,14,83]
     # C5 u& X6 O4 b6 b; ~+ a9 u0 }
292.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KANTray.dll]  [Kingsoft Corporation, 2008,04,15,2]
     
293.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVAFish.DLL]  [Kingsoft Corporation, 2008,05,13,78]
     
294.     [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
     
295.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
     
296.     [C:\WINDOWS\system32\WN.IME]  [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
     
297.     [C:\Program Files\ShiQiang\wnime\Dll32\wnpy_StatusWnd.dll]  [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
     4 }, _# L, Z. p! K0 q
298.     [C:\Program Files\ShiQiang\wnime\Dll32\wnpy_CompWnd.dll]  [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
     / P( {" x: y; G! i3 u
299.     [C:\Program Files\ShiQiang\wnime\Dll32\wnpy_Query.dll]  [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
     
300.     [C:\WINDOWS\system32\SOGOUPY.IME]  [Sogou.com Inc., 3.2.0.0]
     $ i, P( O) x: A6 V( ?* `
301.     [C:\Documents and Settings\Administrator\My Documents\SogouInput\Plugin\SgImeWord.dll]  [Sogou.com Inc., 3.2.0.0]
     
302.     [C:\WINDOWS\system32\WINWB98.IME]  [Microsoft Corporation, 4.00.950]
     
303.     [C:\WINDOWS\system32\WINWB86.IME]  [Microsoft Corporation, 4.00.950]
     
304.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     . Y, \( T# Z7 u) S' t
305. [PID: 1124 / Administrator][C:\Program Files\Tencent\QQ\TXPlatform.exe]  [Tencent, 1, 0, 170, 0]
     
306.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     
307.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     ( i& a7 Q" D" B" }  e9 G* }; s
308.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
309.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
310. [PID: 928 / Administrator][F:\arvmon.exe]  [任软工作室, 2.2.5.201]
     
311.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     
312.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     ' x: n- ?/ I$ v8 w
313.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     . M- D4 T8 ?" F6 t$ W$ t! _
314.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
315.     [F:\Vdata.dll]  [任软工作室, 2, 2, 1, 94]
     ) P( e& D0 ]) |, |7 D
316. [PID: 2540 / Administrator][F:\AutoGuarder.exe]  [任软工作室, 2.2.5.201]
     
317.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     2 {; P9 M5 q, W& f1 p" Z! _
318.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     & O7 [2 u( T  h- h
319.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     / [" H' Y' C- [! V
320.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
321. [PID: 2476 / Administrator][d:\我的文档\桌面\系统检测修复\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
     
322.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     & d; b5 W- \7 i. D2 E+ n" l+ M
323.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     ; T# M* I. o) C8 t6 s7 X
324.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
325.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
326.     [d:\我的文档\桌面\系统检测修复\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]
     $ a# o' L- M6 W* y0 Z9 ^% C* o
327. ==================================
     ( D. U2 W0 x7 i' t$ r5 H% T& [
328. 文件关联
     
329. .TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
     ; B3 g, ]6 C$ {  h
330. .EXE  OK. ["%1" %*]
     
331. .COM  OK. ["%1" %*]
     * U, P9 }# o1 s2 @* R
332. .PIF  OK. ["%1" %*]
     
333. .REG  OK. [regedit.exe "%1"]
     
334. .BAT  OK. ["%1" %*]
     " k( Z6 d( }4 V) j* D- R
335. .SCR  OK. ["%1" /S]
     
336. .CHM  OK. ["C:\WINDOWS\hh.exe" %1]
     6 W0 U5 g+ g- H$ C- M+ R
337. .HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
     
338. .INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
     
339. .INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
     
340. .VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
     
341. .JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
     
342. .LNK  OK. [{00021401-0000-0000-C000-000000000046}]
     
343. ==================================
     7 ]3 I" {. j9 [3 i/ ~4 ~
344. Winsock 提供者
     0 w0 h! H& i) c
345. N/A
     
346. ==================================
     # T: d: r  n1 y- Y9 L( b
347. Autorun.inf
     
348. N/A
     
349. ==================================
     ' D) e# ~$ o0 }, G
350. HOSTS 文件
     0 q* ]8 z% {, E. R: U; Y* [
351. N/A
     % U. X% ~: E, M# b1 v6 r
352. ==================================
     % ^% d" @* ?% Y% e
353. 进程特权扫描
     
354. 特殊特权被允许： SeLoadDriverPrivilege [PID = 520, C:\WINDOWS\SYSTEM32\WINLOGON.EXE]
     , O7 V8 K) ?6 U2 ?0 P. V& B
355. 特殊特权被允许： SeDebugPrivilege [PID = 928, F:\ARVMON.EXE]
     
356. 特殊特权被允许： SeLoadDriverPrivilege [PID = 928, F:\ARVMON.EXE]
     
357. 特殊特权被允许： SeDebugPrivilege [PID = 2540, F:\AUTOGUARDER.EXE]
     
358. 特殊特权被允许： SeLoadDriverPrivilege [PID = 2540, F:\AUTOGUARDER.EXE]
     
359. ==================================
     
360. API HOOK
     
361. N/A
     $ b. ~$ u9 [9 u- L- `
362. ==================================
     
363. 隐藏进程
     
364. N/A
     6 B- X3 g/ T2 i5 x6 J8 ]6 H" j1 T
365. ==================================
     
366. 
     2 L! N# o6 B- k2 J8 [

复制代码

傲天♂扬帆

跟原始说了，不知道能不能看明白。。。

傲天♂元始

[Start]
; R8 H8 z2 o  ?( e1 a2 Y0 ^
: b" p1 s8 L; F. A2008-05-22,22:24:21
; h5 [( w: R5 U+ |6 _# j3 {- R8 o
& h1 ~5 t' I. J8 r  e2 C9 V9 ]SREngLOG智能分析专家 V1.2.0.125
Tored (http://hi.baidu.com/peaset)

$ X$ P: o3 W; T! ]+ |( Y======================================================
以下过程将用到SREng、PowerRmv，如果您不熟悉这两款工具的使用方法，请参考下列链接：
$ w2 {! t  ~9 Y2 r3 h. |* B4 K: w6 bSREng详细操作方法： http://hi.baidu.com/peaset/blog/ ... dd19224e4aeadf.html
PowerRmv详细操作方法： http://hi.baidu.com/peaset/blog/ ... 6fb5eb77c63816.html
4 U3 G: x% w  x! U, b( k4 z======================================================
  h8 Q, p& @, I7 z; L& d
4 f7 I3 }5 e" Z5 _以下是病毒清除步骤：

1、用PowerRmv删除以下文件(没有则跳过)：

; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
;
; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
3 S7 F& S6 q- _! P) JC:\WINDOWS\System32\3wareSrv.exe
  P' ^6 x, v0 R: g4 ^1 F: z8 y\SystemRoot\C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll
$ r; a2 d3 u9 ?# a# ^6 F
\SystemRoot\System32\DRIVERS\22jn.sys
3 g0 T# r* B. p1 A* m" Y$ }: e\SystemRoot\System32\DRIVERS\43ecu.sys
* I0 V+ u1 X/ a% w1 J, \; \\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys
\SystemRoot\system32\drivers\pnduojtwbt.sys
- B1 c# ~7 ~' |6 `9 ]$ S" H2 U3 t\SystemRoot\system32\drivers\RsBoot.sys
6 v5 B3 i1 X1 q$ h$ ]) ^system32\DRIVERS\sr.sys
\SystemRoot\system32\drivers\unzxzsrs.sys
\SystemRoot\system32\DRIVERS\ViBus.sys
4 B3 y* A7 G8 {9 v. d7 A\SystemRoot\system32\drivers\zhibmaso.sys
* ]( Z* u6 _2 s; n! s: e! w
  E. b' Q/ s5 \  C1 v2、用SREng删除以下【注册表】项(没有则跳过)：
$ }+ w6 Q+ G. b" I5 E7 y( l
<IMJPMIG8.1>
2 C3 E* U! T2 \5 o<PHIME2002A>
<PHIME2002ASync>
! R# [7 w+ ^) C& |2 _( s, T
8 n4 y) r! g! \+ _; |5 m$ F3、用SREng删除【所有启动文件夹】内容(没有则跳过)

" W; U. [& Z" b7 ^) s4 i/ u( f3 f' G4、用SREng删除以下【服务】项(没有则跳过)：

[3ware Controller Service / 3wareSrv]
) M' j# W0 T2 Z: ][NetMeeting Remote Desktop Sharing / mnmsrvc]

& W$ o% h& n5 A- R* `" b5、用SREng删除以下【驱动程序】项(没有则跳过)：
' F; h5 m  T1 J- l  u' S9 ?
[22j / 22jn]
[43ec / 43ecu]
[ntptdb / ntptdb]
* L: u8 i' {; y9 I7 V2 W[pnduojtwbt / pnduojtwbt]
[RsAntiSpyware / RsAntiSpyware]
. J+ u! ^1 p! E2 P: l- Q) M[System Restore Filter Driver / sr]
/ }' f! B. |4 t7 H% Y; }+ N[System Services / unzxzsrs]
; e+ p* Y( v, m( ^9 `" j6 |[ViBus / ViBus]
; V, B& N0 H5 z; |+ D# x! n, ~3 o, `) `% {[ATI Extend / zhibmaso]
% O4 G8 K0 h9 {0 j
6、用SREng删除以下【浏览器加载项】项(没有则跳过)：

2 Q- j5 G4 P* X* c  ~4 b" P4 k[Zcom 杂志]
[Browser Enhanced Objects]

" X7 U! k; ~2 S* L- w最后,重新启动计算机.Tored祝您好运!
: \1 w2 I/ \, Z! C& W2 o* k# i# C* c======================================================
' \! D0 O0 @* `, W2 b% r[End]

傲天♂元始

你就这样弄，不行我也没办法

傲天♂扬帆

独恋有按原始说的重新操作一次吗？

独恋伊影

找不到要删的文件。。。。

傲天♂元始

有些都是隐藏起来的

傲天♂风云

: P) G6 [* I# h
! m9 k# t5 d# S% F我对代码 一点都不懂

傲天♂元始

。。。这不是代码只是系统的扫描日志而已

傲天♂冷漠

我汗~~~
这么多代码~~~