在这里

独恋伊影

1. 
   
2. 2008-05-22,20:37:43
   9 V! U9 e$ L5 ^, i6 X3 Z1 i
3. System Repair Engineer 2.5.16.900
   ! d( x" ~; ]. v8 m1 m7 F6 M8 I
4. Smallfrogs (http://www.KZTechs.com)
   
5. Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
   
6. 以下内容被选中：
   4 T, P; q- {9 D. ?/ P. N0 g/ C1 T
7.     所有的启动项目（包括注册表、启动文件夹、服务等）
   ) e3 }! F7 c8 Y, A7 c/ x+ K8 f; {
8.     浏览器加载项
   
9.     正在运行的进程（包括进程模块信息）
   1 k% G- a" L! s5 v: l- a
10.     文件关联
    
11.     Winsock 提供者
    
12.     Autorun.inf
    1 h& N( Q" c8 n" \. [  {
13.     HOSTS 文件
    % L4 r+ Q% L' Y/ E  `5 Z. M
14.     进程特权扫描
    
15. 
    
16. 启动项目
    & f$ `, C' n4 I0 R% A/ m" z
17. 注册表
    
18. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    
19.     <ctfmon.exe><C:\WINDOWS\system32\CTFMON.EXE>  [(Verified)Microsoft Windows Publisher]
    
20. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    / n5 h" ~( S9 |& C6 h) X0 z
21.     <360Safebox><"C:\Program Files\360Safebox\safeboxTray.exe" /r>  [(Verified)Qizhi Software (beijing) Co. Ltd]
    
22.     <360Safetray><C:\Program Files\360safe\safemon\360tray.exe /start>  [(Verified)Qizhi Software (beijing) Co. Ltd]
    ! @5 w/ ?3 @9 w$ N% r5 W
23.     <360Antiarp><C:\Program Files\360safe\AntiArp\AntiArp.exe /start>  [(Verified)Qizhi Software (beijing) Co. Ltd]
    & I- \, w# X4 A; p: I+ O
24.     <KavStart><"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVStart.exe" -startup>  [(Verified)KINGSOFT CORPORATION]
    
25.     <IMJPMIG8.1><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32>  [N/A]
    ) E/ v9 X9 c9 S3 k. Z6 Q; u
26.     <PHIME2002A><; >  [N/A]
    , h3 e2 `) F$ H1 Z$ Y
27.     <PHIME2002ASync><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32>  [N/A]
    + ]9 [" K2 t" {: P/ \
28. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    $ {) M7 C" A( c
29.     <shell><Explorer.exe>  [(Verified)Microsoft Windows Component Publisher]
    5 L2 b2 s( j: L; i! q$ p
30.     <Userinit><C:\WINDOWS\system32\UserInit.exe,>  [(Verified)Microsoft Windows Publisher]
    
31.     <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
    0 P) f$ K: W8 K3 I$ @4 G! r1 K5 ^
32. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    0 Q8 ^: T# G" }) ]
33.     <{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}><C:\WINDOWS\system32\shlhook.dll>  [Beijing Rising Technology Co., Ltd.]
    
34. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
    8 i; S8 i+ o. L3 X
35.     <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [N/A]
    
36. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
    6 o3 a% I3 O" N1 u& g' ]8 m7 U
37.     <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]
    3 X4 z0 Z! N7 m  V8 q
38. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
    " Y+ ^1 w7 p' w, p3 |9 O
39.     <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]
      z/ F- z! a6 E, I
40. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
    . E) [# w  V% N1 |1 R4 I1 O6 i% q
41.     <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
    7 [* Z* ?8 S8 E) b; j& [
42. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
    ( v" F$ L# A; ]( g7 N8 t& F2 P& r
43.     <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Remove.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
    ( i7 a! Q- F& S
44. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
    # ^. r  Q6 C! }
45.     <Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser>  [(Verified)Microsoft Windows Publisher]
    $ l: ^6 {9 m5 h5 `
46. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
    % `, M+ ~! _1 l; J& G
47.     <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub>  [(Verified)Microsoft Windows Publisher]
    ( [7 \/ v: q! f( H
48. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
    ; `" A2 ]& c) `3 X  ?8 w# v
49.     <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]
    $ a6 C) m: Z2 r4 h. v: I+ ?" |
50. ==================================
    
51. 启动文件夹
    7 G4 ?7 E) H3 c4 r/ i/ e
52. N/A
    & y0 C. {! J9 j* J" }' K, A" V
53. ==================================
    ! Y$ R0 d8 o* V, V
54. 服务
    
55. [3ware Controller Service / 3wareSrv][Stopped/Auto Start]
    2 t3 }/ M3 k$ Z3 [
56.   <C:\WINDOWS\System32\3wareSrv.exe><N/A>
    
57. [Google Updater Service / gusvc][Stopped/Manual Start]
    
58.   <"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"><Google>
    4 O* [2 B' g! r8 C. D1 z
59. [Help and Support / helpsvc][Stopped/Disabled]
    ; \. Y, X; r( {* ~
60.   <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll><N/A>
    
61. [Human Interface Device Access / HidServ][Stopped/Boot Start]
    
62.   <\SystemRoot\C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
    
63. [Kingsoft Internet Security Common Service / KISSvc][Stopped/Auto Start]
    
64.   <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KISSvc.EXE><Kingsoft Corporation>
    ) w# }- \3 X! f9 U; Z  J8 Y
65. [Kingsoft Personal Firewall Service / KPfwSvc][Running/Auto Start]
    5 j6 y0 {7 F6 X% I1 E. P4 f2 M
66.   <"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KPfwSvc.EXE"><Kingsoft Corporation>
    1 P3 F; J1 }6 W
67. [Kingsoft Antivirus KWatch Service / KWatchSvc][Running/Auto Start]
    : m. E: p" n: A8 z( t5 J
68.   <"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KWatch.EXE"><Kingsoft Corporation>
    
69. [NetMeeting Remote Desktop Sharing / mnmsrvc][Stopped/Manual Start]
    9 q& x8 |1 R+ [- l
70.   <><N/A>
    
71. [Qvod Terminal / Qvod Terminal][Running/Auto Start]
    2 i+ a/ g. B6 ]8 F! A5 _9 @  _: F
72.   <C:\Program Files\QvodPlayer\QvodTerminal.exe><Shenzhen QVOD Technology Co.,Ltd>
    
73. ==================================
    
74. 驱动程序
      X# q4 O6 A  }3 x( {
75. [22j / 22jn][Stopped/Boot Start]
    1 w/ B" c& @) r9 E+ t
76.   <\SystemRoot\System32\DRIVERS\22jn.sys><N/A>
    
77. [360AntiArp / 360AntiArp][Running/System Start]
    
78.   <\??\C:\WINDOWS\system32\drivers\360AntiArp.sys><360安全中心>
    6 Z$ |' h6 E: f/ @. t
79. [43ec / 43ecu][Stopped/Boot Start]
    7 U9 w* r8 [( }* Q& V2 M% |
80.   <\SystemRoot\System32\DRIVERS\43ecu.sys><N/A>
    3 C: M1 H& ^# T2 j* Y
81. [Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Running/Manual Start]
    
82.   <system32\drivers\ac97intc.sys><Intel Corporation>
    
83. [Promise driver accelerator / bb-run][Running/Boot Start]
    
84.   <\SystemRoot\system32\DRIVERS\bb-run.sys><Promise Technology, Inc.>
    
85. [Promise Removable Disk Control Driver / dontgo][Running/Boot Start]
    
86.   <\SystemRoot\system32\DRIVERS\DontGo.sys><Promise Technology, Inc.>
    4 L" J6 K! U  x1 ^9 w: B3 t4 C$ M4 o
87. [KAVBase / KAVBase][Running/Auto Start]
    * h) H# J0 c* ~$ n
88.   <\??\C:\WINDOWS\system32\Drivers\KAVBase.sys><Kingsoft Corporation>
    6 E5 G" _, Q; [- v
89. [KAVBootC / KAVBootC][Running/Boot Start]
    # p2 a& s9 i4 n. }4 r; l7 o7 A1 o
90.   <\SystemRoot\system32\Drivers\KAVBootC.sys><Kingsoft Corporation>
    8 n8 ^5 C+ s4 m' @9 k: P
91. [KAVSafe / KAVSafe][Running/Auto Start]
    
92.   <\??\C:\WINDOWS\system32\Drivers\KAVSafe.sys><Kingsoft Corporation>
    , W! g8 D8 K1 p. z
93. [KNetWch / KNetWch][Running/System Start]
    8 h/ k3 Z6 z( N
94.   <\??\C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KNetWch.SYS><Kingsoft Corporation>
    9 H" @! ]; Z2 \# T6 Z9 Y. _" E
95. [KWatch3 / KWatch3][Running/Auto Start]
    
96.   <\??\C:\WINDOWS\system32\drivers\KWatch3.SYS><Kingsoft Corporation>
    4 h$ f: }+ |# L3 F9 }7 d
97. [ntptdb / ntptdb][Stopped/Auto Start]
    
98.   <\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys><N/A>
    / y  a: `- g0 \8 ^$ Y
99. [nv / nv][Running/Manual Start]
    
100.   <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
     $ D6 [! a" z" H6 w- J6 B% U. w7 r
101. [NVIDIA nForce RAID Driver / nvrd32][Running/Boot Start]
     ! ?0 Z# I+ C0 r' U: O! `. b: O
102.   <\SystemRoot\system32\DRIVERS\nvrd32.sys><NVIDIA Corporation>
     % X% U& J& ^1 B, N) z
103. [DDK PACKET Protocol / Packet][Running/Manual Start]
     
104.   <system32\DRIVERS\ProtoDrv.sys><360安全中心>
     
105. [pnduojtwbt / pnduojtwbt][Stopped/Boot Start]
     
106.   <\SystemRoot\system32\drivers\pnduojtwbt.sys><N/A>
     
107. [Direct Parallel Link Driver / Ptilink][Running/Manual Start]
     
108.   <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
     - e7 l7 k) c5 H* u
109. [RsAntiSpyware / RsAntiSpyware][Stopped/Boot Start]
     
110.   <\SystemRoot\system32\drivers\RsBoot.sys><N/A>
     
111. [Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
     ( q2 t( s9 O. q% A1 R3 r# D- f; n
112.   <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
     5 i8 U. g1 ~" H: |, @" s
113. [SafeBoxKrnl / SafeBoxKrnl][Running/System Start]
     
114.   <\??\C:\Program Files\360Safebox\SafeBoxKrnl.sys><360安全中心>
     5 f' b0 J( r- u& }. ?' w$ ?
115. [Secdrv / Secdrv][Stopped/Manual Start]
     $ w: l- z& e8 F, d7 N$ x" I2 G
116.   <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
     ; ]0 Z4 Q9 F& ]" z3 [5 l
117. [SATALink External Device Filter / SiRemFil][Running/Boot Start]
     
118.   <\SystemRoot\system32\DRIVERS\SiRemFil.sys><Silicon Image, Inc.>
     7 V8 x" K. W& a+ g3 N! b, B5 D# j
119. [System Restore Filter Driver / sr][Stopped/Disabled]
     # ~) ^: p/ O* X0 j
120.   <system32\DRIVERS\sr.sys><N/A>
     
121. [TesSafe / TesSafe][Stopped/Manual Start]
     
122.   <\??\C:\WINDOWS\system32\TesSafe.sys><TENCENT>
     * P' v  |6 S5 h( K3 v) i
123. [System Services / unzxzsrs][Stopped/Boot Start]
     
124.   <\SystemRoot\system32\drivers\unzxzsrs.sys><N/A>
     & r+ d6 M) W0 W. u9 D7 M$ z
125. [ViBus / ViBus][Stopped/Boot Start]
     
126.   <\SystemRoot\system32\DRIVERS\ViBus.sys><N/A>
     , ?8 [" P7 L' h% [
127. [World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
     ( C  J& F/ q4 c1 @, o& i
128.   <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
     
129. [VIA SATA IDE Hot-plug Driver / xfilt][Running/Boot Start]
     - p7 _  s9 ]. t+ V
130.   <\SystemRoot\system32\DRIVERS\xfilt.sys><VIA Technologies,Inc>
     
131. [ATI Extend / zhibmaso][Stopped/Boot Start]
     & I; [$ q) U7 u* T2 K1 ~
132.   <\SystemRoot\system32\drivers\zhibmaso.sys><N/A>
     
133. [Vimicro USB PC Camera (ZC0301PL) / ZSMC301b][Running/Manual Start]
     
134.   <System32\Drivers\usbVM31b.sys><Vimicro Corporation>
     ' M$ `) u; Z/ R3 K( n1 W
135. ==================================
     ' {4 k+ B" ~/ F1 i4 W
136. 浏览器加载项
     
137. [Google Toolbar Helper]
     
138.   {AA58ED58-01DD-4d91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     + W- E  @: D9 s- V# I  z
139. [Google Toolbar Notifier BHO]
     
140.   {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>
     : k0 p# l# x( c$ ^5 t
141. [SafeMon Class]
     7 ^3 C6 j; J4 M2 Y2 E; I# w! e
142.   {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>
     
143. [kingsoft browser shield]
     7 S0 u1 }6 ]$ d. I1 N, Q+ k
144.   {D963BE1A-6B35-47DB-B002-49FAE71D85CC} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL, Kingsoft Corporation>
     9 e$ w( A7 i1 t, j
145. [IEBuddyExtControl Class]
     
146.   {3AECD3C1-7085-4731-96DC-47B6CF7EF749} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL, Kingsoft Corporation>
     . s7 i! N$ |. w, n
147. [Zcom 杂志]
     ( n6 s& p2 `3 M6 a
148.   {4045D313-1D5E-4fe4-93A0-A34630B6A00B} <C:\Zcom\E-Space.exe, N/A>
     0 u5 d3 L( i, D" I
149. [&Google]
     # E3 o% x, h: q; {/ p$ D: E
150.   {2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     
151. [KooPlayer Control]
     
152.   {C728DAB8-FDF5-4CD7-89DD-879D25794C77} <C:\WINDOWS\system32\CCTVKO~1.OCX, Koos>
     
153. [Shockwave Flash Object]
     
154.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>
     / e0 e. N4 i; e+ |. g/ h' M
155. [KUpdateObj2 Class]
     
156.   {D82303B7-A754-4DCB-8AFC-8CF99435AACE} <C:\WINDOWS\system32\KingSoft\KOS\UpdateOcx2.dll, Kingsoft Corporation>
     
157. [Google Script Object]
     ! y( j  n: {( q0 y: v4 e8 S- e
158.   {00EF2092-6AC5-47C0-BD25-CF2D5D657FEB} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     # O+ ~' N* D% a& {2 o
159. [EWA Control]
     
160.   {18226BF8-DC0B-4D81-80E9-A41AE37BB73A} <C:\PROGRA~1\PPLive\SYNACA~2.OCX, Synacast>
     8 w2 E8 _7 [3 b# O
161. [Windows Media Player]
     & S. o3 e# f# T/ I' J# G3 K
162.   {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\msdxm.ocx, Microsoft Corporation>
     1 M, O9 B; |) A
163. [&Google]
     - F- I7 V& h& f0 W% ~5 w) B# d$ G0 f
164.   {2318C2B1-4965-11D4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     
165. [HTML Document]
     
166.   {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
     
167. [DHTML Edit Control Safe for Scripting for IE5]
     
168.   {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
     
169. [RealPlayer RAM Download Handler]
     
170.   {2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
     % _; z  d- C& K" J* m  u  D
171. [IEBuddyExtControl Class]
     
172.   {3AECD3C1-7085-4731-96DC-47B6CF7EF749} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL, Kingsoft Corporation>
     
173. [XML Document]
     
174.   {48123BC4-99D9-11D1-A6B3-00C04FD91555} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
     2 f$ y. c% {. b) B% o
175. [HHCtrl Object]
     
176.   {52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
     
177. [Windows Media Player]
     ( y/ t* m4 M8 H# q
178.   {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     
179. [Active Desktop Mover]
     
180.   {72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
     ) n+ p( s: Y) k
181. [360SafeLive]
     
182.   {87515F61-A66C-4319-A0E0-D416CB8059E3} <C:\Program Files\360safe\live.dll, 360.cn>
     
183. [Microsoft Web 浏览器]
     
184.   {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
     3 L9 b! u3 E4 {1 j) w
185. [Browser Enhanced Objects]
     0 e  I6 d& e; }8 r. K
186.   {986488AF-13D5-9DDF-4FEF-9FB88698CFC1} <C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\USERDATA\webbrowser_2011.dll, N/A>
     
187. [Google Toolbar Helper]
     + A6 Q. o0 O) n
188.   {AA58ED58-01DD-4D91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     # i' `1 ]: y! b4 E
189. [Microsoft Scriptlet Component]
     
190.   {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
     2 G5 r+ d4 X+ i2 n6 y
191. [Google Toolbar Notifier BHO]
     
192.   {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>
     . A% E# c& Y3 N  y1 O+ Y2 S! H
193. [SearchAssistantOC]
     
194.   {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
     
195. [SafeMon Class]
     
196.   {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>
     
197. [RDS.DataSpace]
     $ _8 i0 `- \8 S' F$ H
198.   {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
     
199. [KooPlayer Control]
     
200.   {C728DAB8-FDF5-4CD7-89DD-879D25794C77} <C:\WINDOWS\system32\CCTVKO~1.OCX, Koos>
     
201. [AUDIO__MID Moniker Class]
     
202.   {CD3AFA74-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     
203. [AUDIO__MP3 Moniker Class]
     8 ^5 V. ^$ U8 B2 Q
204.   {CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     
205. [AUDIO__X_MS_WMA Moniker Class]
     
206.   {CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     
207. [VIDEO__X_MS_WMV Moniker Class]
     
208.   {CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     
209. [RealPlayer G2 Control]
     1 N5 E6 I- ~) u3 d" v
210.   {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
     
211. [Shockwave Flash Object]
     * a8 h! B7 w; v: [/ d
212.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>
     
213. [KUpdateObj2 Class]
     
214.   {D82303B7-A754-4DCB-8AFC-8CF99435AACE} <C:\WINDOWS\system32\KingSoft\KOS\UpdateOcx2.dll, Kingsoft Corporation>
     ; W; L% w0 x  t& s: U
215. [kingsoft browser shield]
     & J& ^, {9 X; i$ ~% u, `; U4 W
216.   {D963BE1A-6B35-47DB-B002-49FAE71D85CC} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL, Kingsoft Corporation>
     
217. [PasswordEditCtrl Class]
     * L' ]/ j7 D+ y; f& j2 A$ P
218.   {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
     # O% ^5 Z0 D( v9 b8 r5 u2 E3 j
219. [QvodCtrl Class]
     
220.   {F3D0D36F-23F8-4682-A195-74C92B03D4AF} <C:\Program Files\QvodPlayer\QvodInsert.dll, Shenzhen QVOD Technology Co.,Ltd>
     
221. [&使用超级旋风下载]
     
222.   <C:\Program Files\Tencent\QQDownload\geturl.htm, N/A>
     
223. [&使用超级旋风下载全部链接]
     8 Q. p0 r4 R6 n& g$ ~
224.   <C:\Program Files\Tencent\QQDownload\getAllurl.htm, N/A>
     8 x: J8 E: [; C  T1 T4 L- _
225. [使用迅雷下载]
     
226.   <, N/A>
     & P& L5 Q  }% b4 Z! }5 H  W
227. [使用迅雷下载全部链接]
     
228.   <, N/A>
     
229. [导出到 Microsoft Office Excel(&X)]
     
230.   <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
     
231. [添加到QQ表情]
     " O( M( \6 f; ?2 c6 T& [
232.   <C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
     
233. ==================================
     
234. 正在运行的进程
     
235. [PID: 444 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     + ?- g# X3 G4 w5 y
236. [PID: 496 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     - E& C  E" ^3 C" S( ^) H  g
237. [PID: 520 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
238.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
     & I  S& e  C6 b' P6 Y  x
239. [PID: 564 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
240. [PID: 576 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
241. [PID: 720 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     ' E$ Z" L" F6 w5 F
242. [PID: 780 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
243. [PID: 856 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     " f  s2 {- q# @# h9 t6 r
244. [PID: 944 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
245. [PID: 1012 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
246. [PID: 1236 / Administrator][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_qfe.070613-1311)]
     
247.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     5 q; i$ S6 F! [1 v
248.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
249.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
     5 w7 b% b/ R1 F2 B. p, Y* d6 j
250.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     . o# L& M6 G  c7 W
251.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVEXT.DLL]  [Kingsoft Corporation, 2008,05,07,373]
     
252.     [C:\Program Files\Tencent\QQ\qdshm.dll]  [, 1, 0, 101, 20]
     + ~5 i" I2 D' i
253.     [C:\Program Files\Tencent\QQ\MFC42.DLL]  [Microsoft Corporation, 6.00.8665.0]
     
254.     [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
     
255.     [C:\WINDOWS\system32\shlhook.dll]  [Beijing Rising Technology Co., Ltd., 4.0.0.9]
     , Y4 S3 q7 g8 {7 D& B2 A
256.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     ; k' A1 U( D, T) k2 B
257.     [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
     ( Z5 `1 s/ X) c6 J
258. [PID: 1332 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
     $ F+ |( F0 T" ^* A8 w5 P5 I
259.     [C:\WINDOWS\system32\mdimon.dll]  [Microsoft Corporation, 11.3.8166.2]
     * l/ g% I: ^/ s- m' R
260.     [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll]  [Microsoft Corporation, 11.3.8166.2]
     
261. [PID: 1540 / Administrator][C:\Program Files\360safe\AntiArp\AntiArp.exe]  [360安全中心, 2, 0, 0, 1008]
     6 z# \' T6 {; q  y1 B  \6 j
262.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     
263.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     
264.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
265.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
266. [PID: 1560 / Administrator][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
267.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     4 a* T4 s0 r8 g0 n9 V0 R: G9 Q/ Y
268.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
269.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     4 a6 v' ?3 F# f5 E# n- O
270. [PID: 1576 / Administrator][C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe]  [Google Inc., 2, 0, 301, 1654]
     
271.     [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\gtn.dll]  [Google Inc., 2, 0, 301, 7164]
     0 w* H* `2 J* V$ @7 s' s
272.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     , [$ N+ I  n2 {# y9 s2 s
273.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
274.     [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\res_zh-CN.dll]  [Google Inc., 2, 0, 301, 7164]
     $ |6 W2 c! W9 [
275.     [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll]  [Google Inc., 2, 0, 301, 7164]
     
276.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     : l9 Q) Q- a9 f7 I5 K
277.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     5 N$ f; Y. D) W+ |4 G/ H$ r
278. [PID: 1648 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     / ~* g: m, H8 J6 R' N$ {
279. [PID: 1744 / SYSTEM][C:\Program Files\QvodPlayer\QvodTerminal.exe]  [Shenzhen QVOD Technology Co.,Ltd, 2, 5, 0, 53]
     
280. [PID: 1860 / SYSTEM][C:\WINDOWS\system32\skeys.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
281. [PID: 1908 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     1 F7 C1 w9 n& V+ l9 B1 s5 [
282. [PID: 1964 / LOCAL SERVICE][C:\WINDOWS\system32\wdfmgr.exe]  [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
     0 @- m  U, J- r7 m9 e
283. [PID: 2772 / Administrator][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
     , Q1 y; h# p% s9 t% }* j& |2 O
284.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     7 S! k/ i4 [. T
285.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     
286.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
287.     [c:\program files\google\googletoolbar2.dll]  [Google Inc., 4, 0, 1606, 6690]
     
288.     [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll]  [Google Inc., 2, 0, 301, 7164]
     
289.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL]  [Kingsoft Corporation, 2008,04,15,2]
     
290.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddy.dll]  [Kingsoft Corporation, 2008,04,15,2]
     
291.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL]  [Kingsoft Corporation, 2008,05,14,83]
     ) e7 @  @6 m4 l% Y! S3 E0 w# L: T
292.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KANTray.dll]  [Kingsoft Corporation, 2008,04,15,2]
     
293.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVAFish.DLL]  [Kingsoft Corporation, 2008,05,13,78]
     
294.     [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
     
295.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
     ) A3 O& L, }- _' j3 U; v
296.     [C:\WINDOWS\system32\WN.IME]  [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
     
297.     [C:\Program Files\ShiQiang\wnime\Dll32\wnpy_StatusWnd.dll]  [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
     4 e" @; J6 u: T; N' N1 g. y
298.     [C:\Program Files\ShiQiang\wnime\Dll32\wnpy_CompWnd.dll]  [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
     
299.     [C:\Program Files\ShiQiang\wnime\Dll32\wnpy_Query.dll]  [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
     1 |" }# c. g+ i0 Z
300.     [C:\WINDOWS\system32\SOGOUPY.IME]  [Sogou.com Inc., 3.2.0.0]
     ' ^# |7 b. V, Z- v
301.     [C:\Documents and Settings\Administrator\My Documents\SogouInput\Plugin\SgImeWord.dll]  [Sogou.com Inc., 3.2.0.0]
     
302.     [C:\WINDOWS\system32\WINWB98.IME]  [Microsoft Corporation, 4.00.950]
     
303.     [C:\WINDOWS\system32\WINWB86.IME]  [Microsoft Corporation, 4.00.950]
     
304.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
305. [PID: 1124 / Administrator][C:\Program Files\Tencent\QQ\TXPlatform.exe]  [Tencent, 1, 0, 170, 0]
     $ W4 r+ ]4 ^/ g- [; h& ^
306.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     
307.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     
308.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     0 T" H! b' g$ l) {# j
309.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     4 T8 {/ u, {5 ]& J1 m0 Z
310. [PID: 928 / Administrator][F:\arvmon.exe]  [任软工作室, 2.2.5.201]
     
311.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     ) t1 O( g8 l9 X$ M' I3 L
312.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     % F4 k) x5 t$ e4 {; q. a. |* }, A
313.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     . I# u& _2 T3 E" |# {& B
314.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
315.     [F:\Vdata.dll]  [任软工作室, 2, 2, 1, 94]
     . ^) `  M/ p: X2 A3 {' C$ y* `& j
316. [PID: 2540 / Administrator][F:\AutoGuarder.exe]  [任软工作室, 2.2.5.201]
     " x4 I; }" N& X8 Q
317.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     
318.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     
319.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     ' Q0 e$ X; C! t- w% S3 w
320.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     . Q$ a! L- h+ }: a# U8 z
321. [PID: 2476 / Administrator][d:\我的文档\桌面\系统检测修复\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
     
322.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     
323.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     ! {, w# G3 c$ {( G  a
324.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
325.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
326.     [d:\我的文档\桌面\系统检测修复\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]
     ' V) ?0 F9 y5 K/ P; ~! n
327. ==================================
     
328. 文件关联
     
329. .TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
     
330. .EXE  OK. ["%1" %*]
     
331. .COM  OK. ["%1" %*]
     9 b" b  u3 |+ E% w8 @
332. .PIF  OK. ["%1" %*]
     : c" d; Q5 v( T4 {5 \  I0 l- e
333. .REG  OK. [regedit.exe "%1"]
     6 W! X9 M3 a, f- h( Z  E. h' |
334. .BAT  OK. ["%1" %*]
     
335. .SCR  OK. ["%1" /S]
     & ?& m, Y3 d5 E4 z: R4 f+ L# x0 H
336. .CHM  OK. ["C:\WINDOWS\hh.exe" %1]
     / i1 l3 ]3 z$ B
337. .HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
     , U+ c8 M  U8 {" U. _/ Y  q
338. .INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
     / j$ d" O# N) f: M( H
339. .INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
     
340. .VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
     + G4 s1 e( U' U# o3 N# }
341. .JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
     : \0 F2 E  i5 E$ P
342. .LNK  OK. [{00021401-0000-0000-C000-000000000046}]
     + `6 A, c* Y0 T  W
343. ==================================
     8 \: x8 q2 U: W8 `$ E5 \
344. Winsock 提供者
     
345. N/A
     
346. ==================================
     
347. Autorun.inf
     
348. N/A
     
349. ==================================
     6 M- m$ L, d3 t4 i; ^1 v7 J) o
350. HOSTS 文件
     
351. N/A
     ( }$ b$ ~& ^& T2 ?  ]. P
352. ==================================
     
353. 进程特权扫描
     * F, Z% T. r( K6 {1 h7 j
354. 特殊特权被允许： SeLoadDriverPrivilege [PID = 520, C:\WINDOWS\SYSTEM32\WINLOGON.EXE]
     7 Q) R9 Q/ y$ q% N% D
355. 特殊特权被允许： SeDebugPrivilege [PID = 928, F:\ARVMON.EXE]
     
356. 特殊特权被允许： SeLoadDriverPrivilege [PID = 928, F:\ARVMON.EXE]
     , n8 g  H7 K, v$ d
357. 特殊特权被允许： SeDebugPrivilege [PID = 2540, F:\AUTOGUARDER.EXE]
     
358. 特殊特权被允许： SeLoadDriverPrivilege [PID = 2540, F:\AUTOGUARDER.EXE]
     3 e# r/ x- {4 F& B
359. ==================================
     4 H/ |! a! A, P& y$ ?% ]' H  ~
360. API HOOK
     
361. N/A
     ) r- C9 {# T0 I
362. ==================================
     " d) l/ v8 q5 K
363. 隐藏进程
     . P! t/ a2 B/ r( t" G
364. N/A
     
365. ==================================
     
366. 
     9 u; o7 T$ f, ?2 s

复制代码

傲天♂扬帆

跟原始说了，不知道能不能看明白。。。

傲天♂元始

[Start]
! V7 a; k% w; }! t2 O, ~+ Q
2008-05-22,22:24:21

8 m; f) u& E7 u/ ]SREngLOG智能分析专家 V1.2.0.125
- p4 M- R4 b$ M3 sTored (http://hi.baidu.com/peaset)
- t. o/ ~2 j# D. {1 k# R7 H
======================================================
以下过程将用到SREng、PowerRmv，如果您不熟悉这两款工具的使用方法，请参考下列链接：
SREng详细操作方法： http://hi.baidu.com/peaset/blog/ ... dd19224e4aeadf.html
PowerRmv详细操作方法： http://hi.baidu.com/peaset/blog/ ... 6fb5eb77c63816.html
& b- J2 _0 ]3 S5 G# B  B======================================================

3 M0 A) ?; I, x% z: m) H  V3 q以下是病毒清除步骤：
1 }8 y; a* O, E/ J( d8 b! ]
( p6 ^9 Y4 d$ y: P' `5 J+ l1、用PowerRmv删除以下文件(没有则跳过)：
# V6 `( z, K5 Y8 f$ D- Z& h
" p& o5 H/ L5 X7 r, L# V; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
# n: h: V: \! Z+ l% j! A) J9 u;
* r" @5 c" x: w' D; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
2 u0 S, i3 P  l& y$ I5 uC:\WINDOWS\System32\3wareSrv.exe
- d: `# @3 `4 q9 V# V8 P. e- o\SystemRoot\C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll
4 f+ v/ {3 k. `- L$ V  v% w- V
0 ]9 A) N. k& i% g  E" c6 D) K" o\SystemRoot\System32\DRIVERS\22jn.sys
: o' {9 z+ m- W% d+ w" L\SystemRoot\System32\DRIVERS\43ecu.sys
\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys
. V$ e8 H- }2 J  K* }\SystemRoot\system32\drivers\pnduojtwbt.sys
5 l3 {8 r) u8 w7 _) |  \\SystemRoot\system32\drivers\RsBoot.sys
" s. e( B- y$ |' Hsystem32\DRIVERS\sr.sys
\SystemRoot\system32\drivers\unzxzsrs.sys
\SystemRoot\system32\DRIVERS\ViBus.sys
\SystemRoot\system32\drivers\zhibmaso.sys

* O0 l' H' ^7 f2、用SREng删除以下【注册表】项(没有则跳过)：

<IMJPMIG8.1>
<PHIME2002A>
: M# R! Q( D9 X  E4 j<PHIME2002ASync>
/ ?+ E% u, ^/ w
, F+ b6 k$ d" p7 G+ g: H3、用SREng删除【所有启动文件夹】内容(没有则跳过)

4、用SREng删除以下【服务】项(没有则跳过)：

4 z8 [& N" A% E+ d# ?[3ware Controller Service / 3wareSrv]
: _2 @7 ?" z+ [$ ][NetMeeting Remote Desktop Sharing / mnmsrvc]
2 n/ Z: I) `( o
; _3 j* S+ r7 b  ^7 O3 \! k5、用SREng删除以下【驱动程序】项(没有则跳过)：

[22j / 22jn]
; }% j5 N2 O) |: x& n[43ec / 43ecu]
[ntptdb / ntptdb]
[pnduojtwbt / pnduojtwbt]
# E: m7 {  @( a  |8 L/ E[RsAntiSpyware / RsAntiSpyware]
/ a* \, r; I# h& k' [- z[System Restore Filter Driver / sr]
' o, [, Q% l( {: q4 j[System Services / unzxzsrs]
1 [  N  ~) s2 w1 s. r[ViBus / ViBus]
[ATI Extend / zhibmaso]

6 |8 [0 e6 h* {5 u+ S/ p6、用SREng删除以下【浏览器加载项】项(没有则跳过)：
' g. o3 E! `/ f, v# n
[Zcom 杂志]
[Browser Enhanced Objects]
7 B4 ]# ?7 C! V3 q1 N- }( K* |
7 I% [' t& q) I最后,重新启动计算机.Tored祝您好运!
======================================================
! k& A- o$ K) f. A# X6 S% b( r[End]

傲天♂元始

你就这样弄，不行我也没办法

傲天♂扬帆

独恋有按原始说的重新操作一次吗？

独恋伊影

找不到要删的文件。。。。

傲天♂元始

有些都是隐藏起来的

傲天♂风云

, P9 d; a+ P* i) A7 N- c我对代码 一点都不懂

傲天♂元始

。。。这不是代码只是系统的扫描日志而已

傲天♂冷漠

我汗~~~
这么多代码~~~