在这里

独恋伊影

1. 
   ! `$ V4 F9 [0 W2 b$ {( x
2. 2008-05-22,20:37:43
   ; v# k: N2 R' {8 W$ d
3. System Repair Engineer 2.5.16.900
   - W6 G. R: q% F5 {+ X$ h; `
4. Smallfrogs (http://www.KZTechs.com)
   
5. Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
   8 ?' e4 ^! j5 p' }/ \
6. 以下内容被选中：
   ) ?: u4 d3 i( J( f6 {/ ~
7.     所有的启动项目（包括注册表、启动文件夹、服务等）
   $ L, y. T0 i/ i' q
8.     浏览器加载项
   
9.     正在运行的进程（包括进程模块信息）
   3 u# L3 j+ v2 t1 P" [8 ?# I
10.     文件关联
    
11.     Winsock 提供者
    
12.     Autorun.inf
    
13.     HOSTS 文件
    
14.     进程特权扫描
    7 F4 x0 B7 V" ~
15. 
    0 G8 l1 ^: h& o  y$ a# F
16. 启动项目
    
17. 注册表
    - |; }- L3 ^5 h: s. v# I1 P
18. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    8 l' w6 d1 T8 {: `7 z% V
19.     <ctfmon.exe><C:\WINDOWS\system32\CTFMON.EXE>  [(Verified)Microsoft Windows Publisher]
    
20. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    & O5 p3 @# J  f3 b% x: ?
21.     <360Safebox><"C:\Program Files\360Safebox\safeboxTray.exe" /r>  [(Verified)Qizhi Software (beijing) Co. Ltd]
    0 c: ^7 V% u3 _; A* Y; q9 t
22.     <360Safetray><C:\Program Files\360safe\safemon\360tray.exe /start>  [(Verified)Qizhi Software (beijing) Co. Ltd]
    3 ~* c$ i- w8 ~; `. O
23.     <360Antiarp><C:\Program Files\360safe\AntiArp\AntiArp.exe /start>  [(Verified)Qizhi Software (beijing) Co. Ltd]
    
24.     <KavStart><"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVStart.exe" -startup>  [(Verified)KINGSOFT CORPORATION]
    
25.     <IMJPMIG8.1><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32>  [N/A]
    6 }1 C! b. i( ]) c& Q" f6 Z
26.     <PHIME2002A><; >  [N/A]
    & }0 c' {" `2 n
27.     <PHIME2002ASync><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32>  [N/A]
    4 V' `  o0 y' x+ E3 O
28. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    , T/ ]. `+ W3 ~# m) l
29.     <shell><Explorer.exe>  [(Verified)Microsoft Windows Component Publisher]
    ( L9 g6 K9 m/ E" J4 Y, n$ X$ A7 Y
30.     <Userinit><C:\WINDOWS\system32\UserInit.exe,>  [(Verified)Microsoft Windows Publisher]
    
31.     <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
    
32. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    2 i$ a* ^- ^6 o: E, M( @/ D( u
33.     <{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}><C:\WINDOWS\system32\shlhook.dll>  [Beijing Rising Technology Co., Ltd.]
    & y; e: {& a, x* j% F% Z
34. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
    
35.     <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [N/A]
    3 B. z6 i4 a* ]% b5 D2 r+ P( M
36. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
    6 s/ J/ e7 z) V; f9 D: u: P( E
37.     <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]
    * Y9 f; N. D( W
38. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
    ( N/ @9 |$ m' D! a/ a$ `
39.     <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]
    + A& }. H* B( \/ ~4 R* q$ k
40. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
    , A9 W3 L1 L! |( ~( V
41.     <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
    
42. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
    * ]6 \% M# J2 U' A- N$ R4 \3 `
43.     <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Remove.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
    
44. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
    
45.     <Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser>  [(Verified)Microsoft Windows Publisher]
    - k$ E1 c# _2 K3 o; f. d4 D8 ]& {
46. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
    % _# A# i3 {. }  F+ u( v) M: _! q
47.     <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub>  [(Verified)Microsoft Windows Publisher]
    
48. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
    . y- u, p+ W/ k8 k* ~2 q
49.     <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]
    
50. ==================================
    # i& E" T1 [7 ^
51. 启动文件夹
    
52. N/A
    ( ^* b$ H' l  e) ^
53. ==================================
    : K9 V8 y" E) W; Q! w/ [0 p3 e$ K
54. 服务
    * `, f1 u* t( c) r
55. [3ware Controller Service / 3wareSrv][Stopped/Auto Start]
    
56.   <C:\WINDOWS\System32\3wareSrv.exe><N/A>
    ' \, y9 X+ x( w, {6 g/ A1 `
57. [Google Updater Service / gusvc][Stopped/Manual Start]
    
58.   <"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"><Google>
    
59. [Help and Support / helpsvc][Stopped/Disabled]
    $ H3 R5 {7 s! k" J
60.   <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll><N/A>
    
61. [Human Interface Device Access / HidServ][Stopped/Boot Start]
    , }7 Q) u: J) b5 m
62.   <\SystemRoot\C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
    ) z, I* a, r* N* H. v& `9 |
63. [Kingsoft Internet Security Common Service / KISSvc][Stopped/Auto Start]
    
64.   <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KISSvc.EXE><Kingsoft Corporation>
    , l! K7 A+ |  I. f7 I, g
65. [Kingsoft Personal Firewall Service / KPfwSvc][Running/Auto Start]
    0 E' a% E/ a! G6 o) p# d( e
66.   <"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KPfwSvc.EXE"><Kingsoft Corporation>
    
67. [Kingsoft Antivirus KWatch Service / KWatchSvc][Running/Auto Start]
    
68.   <"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KWatch.EXE"><Kingsoft Corporation>
    $ a% f/ v% ]) a4 f- L% [
69. [NetMeeting Remote Desktop Sharing / mnmsrvc][Stopped/Manual Start]
    
70.   <><N/A>
    : L; P; |) l% }
71. [Qvod Terminal / Qvod Terminal][Running/Auto Start]
    
72.   <C:\Program Files\QvodPlayer\QvodTerminal.exe><Shenzhen QVOD Technology Co.,Ltd>
    % i9 @9 Q; Q+ s! J9 }8 s0 {( e1 D8 `
73. ==================================
    
74. 驱动程序
    ; `; H9 P& ]# c& j5 i  A7 q  v
75. [22j / 22jn][Stopped/Boot Start]
    4 T: i3 v* S' g  [0 i# `, @
76.   <\SystemRoot\System32\DRIVERS\22jn.sys><N/A>
    ( M/ E0 u/ L1 \0 a' Q
77. [360AntiArp / 360AntiArp][Running/System Start]
    
78.   <\??\C:\WINDOWS\system32\drivers\360AntiArp.sys><360安全中心>
    * ~' T! }. P/ n' j! L
79. [43ec / 43ecu][Stopped/Boot Start]
    
80.   <\SystemRoot\System32\DRIVERS\43ecu.sys><N/A>
    
81. [Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Running/Manual Start]
    8 X6 P8 c" V4 M, m: N
82.   <system32\drivers\ac97intc.sys><Intel Corporation>
    3 r8 S! w2 E' v
83. [Promise driver accelerator / bb-run][Running/Boot Start]
    
84.   <\SystemRoot\system32\DRIVERS\bb-run.sys><Promise Technology, Inc.>
    + u0 c, ~( J# k
85. [Promise Removable Disk Control Driver / dontgo][Running/Boot Start]
    
86.   <\SystemRoot\system32\DRIVERS\DontGo.sys><Promise Technology, Inc.>
    & }5 ^+ a& p' g+ I. [( z
87. [KAVBase / KAVBase][Running/Auto Start]
    ' D4 I2 }6 I/ ]" P+ J
88.   <\??\C:\WINDOWS\system32\Drivers\KAVBase.sys><Kingsoft Corporation>
    ( j% |0 M7 ~% f. t" B* \" s& @
89. [KAVBootC / KAVBootC][Running/Boot Start]
    + q9 f" k/ W& L7 s- N* `* C
90.   <\SystemRoot\system32\Drivers\KAVBootC.sys><Kingsoft Corporation>
    5 F' e3 E5 X" t& N  ?6 H4 e( M# o$ m
91. [KAVSafe / KAVSafe][Running/Auto Start]
    % s# N5 l3 A! _4 }/ N* S
92.   <\??\C:\WINDOWS\system32\Drivers\KAVSafe.sys><Kingsoft Corporation>
    * p- H6 ~& @3 z6 O4 [1 m
93. [KNetWch / KNetWch][Running/System Start]
    
94.   <\??\C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KNetWch.SYS><Kingsoft Corporation>
    
95. [KWatch3 / KWatch3][Running/Auto Start]
    
96.   <\??\C:\WINDOWS\system32\drivers\KWatch3.SYS><Kingsoft Corporation>
    
97. [ntptdb / ntptdb][Stopped/Auto Start]
    * ~2 V" O5 h, o+ y4 G  X
98.   <\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys><N/A>
    
99. [nv / nv][Running/Manual Start]
    
100.   <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
     # e+ i2 _4 H- u
101. [NVIDIA nForce RAID Driver / nvrd32][Running/Boot Start]
     3 V4 i2 `( p& A% t4 P
102.   <\SystemRoot\system32\DRIVERS\nvrd32.sys><NVIDIA Corporation>
     $ d2 o; O: p; [2 I
103. [DDK PACKET Protocol / Packet][Running/Manual Start]
     , I+ P: p3 ^9 p
104.   <system32\DRIVERS\ProtoDrv.sys><360安全中心>
     & h. q8 ~0 |$ p7 c
105. [pnduojtwbt / pnduojtwbt][Stopped/Boot Start]
     
106.   <\SystemRoot\system32\drivers\pnduojtwbt.sys><N/A>
     3 j/ O; ~9 W7 ?1 R1 e
107. [Direct Parallel Link Driver / Ptilink][Running/Manual Start]
     
108.   <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
     ! `9 o8 K1 E8 B- c7 Q
109. [RsAntiSpyware / RsAntiSpyware][Stopped/Boot Start]
     / W3 {, W% _# A! }/ r/ r) t
110.   <\SystemRoot\system32\drivers\RsBoot.sys><N/A>
     
111. [Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
     1 w1 Z: j: P  b, j
112.   <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
       R8 O4 s8 w3 Y) e
113. [SafeBoxKrnl / SafeBoxKrnl][Running/System Start]
     
114.   <\??\C:\Program Files\360Safebox\SafeBoxKrnl.sys><360安全中心>
     
115. [Secdrv / Secdrv][Stopped/Manual Start]
     , |$ W" i3 l; f
116.   <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
     
117. [SATALink External Device Filter / SiRemFil][Running/Boot Start]
     
118.   <\SystemRoot\system32\DRIVERS\SiRemFil.sys><Silicon Image, Inc.>
     
119. [System Restore Filter Driver / sr][Stopped/Disabled]
     - t$ |) R! e0 _0 e0 p
120.   <system32\DRIVERS\sr.sys><N/A>
     6 y' F, {! W2 J. d
121. [TesSafe / TesSafe][Stopped/Manual Start]
     9 F6 s. }( Y) W; x4 T" |
122.   <\??\C:\WINDOWS\system32\TesSafe.sys><TENCENT>
     ) [2 @7 b- z1 _% j( E" o
123. [System Services / unzxzsrs][Stopped/Boot Start]
     4 l: g! {! I4 r) K
124.   <\SystemRoot\system32\drivers\unzxzsrs.sys><N/A>
     7 M: I( x) X& S5 t
125. [ViBus / ViBus][Stopped/Boot Start]
     
126.   <\SystemRoot\system32\DRIVERS\ViBus.sys><N/A>
     3 Y4 H. _6 ~' f# R
127. [World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
     , j1 b0 q( \4 F# L/ C8 f5 v7 @
128.   <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
     
129. [VIA SATA IDE Hot-plug Driver / xfilt][Running/Boot Start]
     
130.   <\SystemRoot\system32\DRIVERS\xfilt.sys><VIA Technologies,Inc>
     
131. [ATI Extend / zhibmaso][Stopped/Boot Start]
     
132.   <\SystemRoot\system32\drivers\zhibmaso.sys><N/A>
     
133. [Vimicro USB PC Camera (ZC0301PL) / ZSMC301b][Running/Manual Start]
     
134.   <System32\Drivers\usbVM31b.sys><Vimicro Corporation>
     9 V8 Y3 w) v0 _" D* l7 F5 ]: l
135. ==================================
     7 t; |$ M; C6 V, F6 P7 N& ]2 c
136. 浏览器加载项
     ) M- u( f) h7 I5 E! ?* J
137. [Google Toolbar Helper]
     4 o: w. c1 g: I2 ?( f4 V1 G
138.   {AA58ED58-01DD-4d91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     
139. [Google Toolbar Notifier BHO]
     
140.   {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>
     3 J  l! w4 I+ \. [
141. [SafeMon Class]
     & W/ l6 ]) B( d: @
142.   {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>
     # H7 G( i; s" M% ]
143. [kingsoft browser shield]
     
144.   {D963BE1A-6B35-47DB-B002-49FAE71D85CC} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL, Kingsoft Corporation>
     
145. [IEBuddyExtControl Class]
     5 f* w7 V  H' p+ J& T) X; X7 I: K
146.   {3AECD3C1-7085-4731-96DC-47B6CF7EF749} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL, Kingsoft Corporation>
     3 x2 i2 |$ U  _% n
147. [Zcom 杂志]
     
148.   {4045D313-1D5E-4fe4-93A0-A34630B6A00B} <C:\Zcom\E-Space.exe, N/A>
     
149. [&Google]
     7 S: t) D1 N% w# E! x6 g7 g) u+ B2 I
150.   {2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     
151. [KooPlayer Control]
     + |$ l2 E7 E3 e% {
152.   {C728DAB8-FDF5-4CD7-89DD-879D25794C77} <C:\WINDOWS\system32\CCTVKO~1.OCX, Koos>
     
153. [Shockwave Flash Object]
     
154.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>
     
155. [KUpdateObj2 Class]
     
156.   {D82303B7-A754-4DCB-8AFC-8CF99435AACE} <C:\WINDOWS\system32\KingSoft\KOS\UpdateOcx2.dll, Kingsoft Corporation>
     / z" U6 d& p. C3 C
157. [Google Script Object]
     9 s, H; A: j' o( G- e
158.   {00EF2092-6AC5-47C0-BD25-CF2D5D657FEB} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     
159. [EWA Control]
     
160.   {18226BF8-DC0B-4D81-80E9-A41AE37BB73A} <C:\PROGRA~1\PPLive\SYNACA~2.OCX, Synacast>
     
161. [Windows Media Player]
     
162.   {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\msdxm.ocx, Microsoft Corporation>
     ; Y- e" }+ v9 j4 L
163. [&Google]
     , S; l# }" y/ p# }& u) w
164.   {2318C2B1-4965-11D4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     
165. [HTML Document]
     
166.   {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
       ]; a# |' A# F0 k" E
167. [DHTML Edit Control Safe for Scripting for IE5]
     
168.   {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
     , G* q6 o& C( U" L- o8 p: J
169. [RealPlayer RAM Download Handler]
     
170.   {2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
     
171. [IEBuddyExtControl Class]
     , o; {% N( W+ d5 W+ K& M  Y
172.   {3AECD3C1-7085-4731-96DC-47B6CF7EF749} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL, Kingsoft Corporation>
     
173. [XML Document]
     7 W% ?, m( z3 l! a1 Y5 K+ f
174.   {48123BC4-99D9-11D1-A6B3-00C04FD91555} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
     ! z( C8 m  A( N* q+ s# P
175. [HHCtrl Object]
     
176.   {52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
     0 V0 d/ L; _5 D4 y2 L  D
177. [Windows Media Player]
     
178.   {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     % N7 l) C- ~6 g8 G
179. [Active Desktop Mover]
     
180.   {72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
     3 a& _7 E2 M% f) k+ D
181. [360SafeLive]
     
182.   {87515F61-A66C-4319-A0E0-D416CB8059E3} <C:\Program Files\360safe\live.dll, 360.cn>
     
183. [Microsoft Web 浏览器]
     2 p- G7 y$ m/ Z2 ?/ d
184.   {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
     , v" }; R$ M8 S( m  ]
185. [Browser Enhanced Objects]
     / Q' C; g* w6 F) S5 {
186.   {986488AF-13D5-9DDF-4FEF-9FB88698CFC1} <C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\USERDATA\webbrowser_2011.dll, N/A>
     
187. [Google Toolbar Helper]
     
188.   {AA58ED58-01DD-4D91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     . F/ T% v' m& H6 X7 t
189. [Microsoft Scriptlet Component]
     / \  u# e! A. P) }
190.   {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
     * {  l& q( b1 ?- V5 B
191. [Google Toolbar Notifier BHO]
     
192.   {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>
     
193. [SearchAssistantOC]
     ) c( x$ M6 p* h0 F* h( d6 M
194.   {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
     % u' |% U6 Q" Z* k3 j' R
195. [SafeMon Class]
     
196.   {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>
     
197. [RDS.DataSpace]
     9 @3 T7 k# n5 A  F7 f
198.   {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
     1 n. q3 Y6 I% {4 r$ {5 C
199. [KooPlayer Control]
     ! x% F) e1 T0 B
200.   {C728DAB8-FDF5-4CD7-89DD-879D25794C77} <C:\WINDOWS\system32\CCTVKO~1.OCX, Koos>
     
201. [AUDIO__MID Moniker Class]
     
202.   {CD3AFA74-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     
203. [AUDIO__MP3 Moniker Class]
     
204.   {CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     9 U2 _% ?# T+ E2 [, k( C
205. [AUDIO__X_MS_WMA Moniker Class]
     & s2 W3 [% ?5 w' G6 N! h; |) G
206.   {CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     * E$ b& L5 J& {' V
207. [VIDEO__X_MS_WMV Moniker Class]
     
208.   {CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     " M3 }8 A$ h: R9 [: D
209. [RealPlayer G2 Control]
     ( i' j3 z; P7 q: Y/ }4 l, X- D
210.   {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
     6 K+ [  J% n: M+ v, A1 L
211. [Shockwave Flash Object]
     
212.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>
     7 x" \" Z, r) x" R$ G0 l% j  c
213. [KUpdateObj2 Class]
     ; E. g2 M9 c2 Y
214.   {D82303B7-A754-4DCB-8AFC-8CF99435AACE} <C:\WINDOWS\system32\KingSoft\KOS\UpdateOcx2.dll, Kingsoft Corporation>
     & |  r. F2 Z# }% r" _. M' G
215. [kingsoft browser shield]
     + e" f' Q; N" J! e, K
216.   {D963BE1A-6B35-47DB-B002-49FAE71D85CC} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL, Kingsoft Corporation>
     / y. }! M4 J! [# x: h. J1 ~0 f+ @
217. [PasswordEditCtrl Class]
     8 A* p8 l1 e, @5 r
218.   {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
     
219. [QvodCtrl Class]
     
220.   {F3D0D36F-23F8-4682-A195-74C92B03D4AF} <C:\Program Files\QvodPlayer\QvodInsert.dll, Shenzhen QVOD Technology Co.,Ltd>
     . ~3 y1 r+ D3 r5 F* }& C
221. [&使用超级旋风下载]
     
222.   <C:\Program Files\Tencent\QQDownload\geturl.htm, N/A>
     , e) n4 A$ _' X! \' {0 D! D6 X+ M
223. [&使用超级旋风下载全部链接]
     
224.   <C:\Program Files\Tencent\QQDownload\getAllurl.htm, N/A>
     
225. [使用迅雷下载]
     ; N, x& T: U! X9 I$ n8 G: |* L  B
226.   <, N/A>
     0 ^4 Z: C6 I7 Y; z
227. [使用迅雷下载全部链接]
     0 h* \2 K8 t( h) E
228.   <, N/A>
     
229. [导出到 Microsoft Office Excel(&X)]
     
230.   <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
     ' N% N4 ?0 [0 \# e
231. [添加到QQ表情]
     
232.   <C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
     ! m8 U3 w- n1 {. {
233. ==================================
     $ q' F' I, q( Q" y& x" A
234. 正在运行的进程
     
235. [PID: 444 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
236. [PID: 496 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     / Z3 w# F! M4 n4 i( F. j
237. [PID: 520 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     - O* x. U+ ], @. |; a0 D
238.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
     ) }7 h# S  S( O4 \$ E% F2 ^
239. [PID: 564 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
240. [PID: 576 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
241. [PID: 720 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
242. [PID: 780 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
243. [PID: 856 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     8 p1 _6 ]( {$ G6 L) k4 D9 ^
244. [PID: 944 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
245. [PID: 1012 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
246. [PID: 1236 / Administrator][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_qfe.070613-1311)]
     1 R8 g& b% e+ @  n
247.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     
248.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     4 C) N, E: a6 ?6 W# U
249.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
     ) r3 e1 |: p6 O/ F+ |
250.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     5 i, e% [  l7 {' f# U2 _
251.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVEXT.DLL]  [Kingsoft Corporation, 2008,05,07,373]
     / a) h# b; Q( h
252.     [C:\Program Files\Tencent\QQ\qdshm.dll]  [, 1, 0, 101, 20]
     
253.     [C:\Program Files\Tencent\QQ\MFC42.DLL]  [Microsoft Corporation, 6.00.8665.0]
     ; A$ m6 ~3 e" E  R& w( w# I
254.     [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
     ) |/ V. h" k" J, T- V- L2 G' E
255.     [C:\WINDOWS\system32\shlhook.dll]  [Beijing Rising Technology Co., Ltd., 4.0.0.9]
     
256.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     " m% s' j+ o2 l* u5 _, |# z
257.     [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
     ; V$ l! i3 I6 T; U
258. [PID: 1332 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
     6 i- K4 ~3 F6 ^- f. f& v
259.     [C:\WINDOWS\system32\mdimon.dll]  [Microsoft Corporation, 11.3.8166.2]
     6 N; Z. e' ?, G( v
260.     [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll]  [Microsoft Corporation, 11.3.8166.2]
     
261. [PID: 1540 / Administrator][C:\Program Files\360safe\AntiArp\AntiArp.exe]  [360安全中心, 2, 0, 0, 1008]
     
262.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     0 r& }4 s7 B7 b5 G
263.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     5 c9 u2 E% }( L, V) j! d6 }+ m
264.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
265.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
266. [PID: 1560 / Administrator][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     . `9 c2 p8 S9 v( X0 r6 l
267.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     ' o0 ~$ Q' I5 C4 }; K% j# |( ?
268.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
269.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
       |$ \) R7 {1 g6 N% w5 L! Y
270. [PID: 1576 / Administrator][C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe]  [Google Inc., 2, 0, 301, 1654]
     
271.     [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\gtn.dll]  [Google Inc., 2, 0, 301, 7164]
     
272.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     
273.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     , o" \/ G9 I% c: B& C# N4 v8 a0 e
274.     [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\res_zh-CN.dll]  [Google Inc., 2, 0, 301, 7164]
     5 W1 S2 a" y1 ], h8 t6 S1 w/ u
275.     [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll]  [Google Inc., 2, 0, 301, 7164]
     . K% h6 ?+ P8 r3 _/ H( L# w
276.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     % M( B8 I9 J( ?" ]6 y
277.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
278. [PID: 1648 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
279. [PID: 1744 / SYSTEM][C:\Program Files\QvodPlayer\QvodTerminal.exe]  [Shenzhen QVOD Technology Co.,Ltd, 2, 5, 0, 53]
     ) e8 l' @' u1 d) n% M+ f
280. [PID: 1860 / SYSTEM][C:\WINDOWS\system32\skeys.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     % T# O6 x0 \7 H
281. [PID: 1908 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     9 ]8 Z) T9 R  _6 d% r1 @$ C1 B
282. [PID: 1964 / LOCAL SERVICE][C:\WINDOWS\system32\wdfmgr.exe]  [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
     % \7 T2 Y5 V' P+ C
283. [PID: 2772 / Administrator][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
     
284.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     
285.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     
286.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
287.     [c:\program files\google\googletoolbar2.dll]  [Google Inc., 4, 0, 1606, 6690]
     0 y' r1 r% |2 Z
288.     [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll]  [Google Inc., 2, 0, 301, 7164]
     
289.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL]  [Kingsoft Corporation, 2008,04,15,2]
       a0 W% l* z5 i1 H0 X
290.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddy.dll]  [Kingsoft Corporation, 2008,04,15,2]
     0 e" D1 c0 \! s' E3 w3 x; f
291.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL]  [Kingsoft Corporation, 2008,05,14,83]
     : a' V. R4 y, [, b
292.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KANTray.dll]  [Kingsoft Corporation, 2008,04,15,2]
     6 i4 J# n0 s' o2 X! D5 R4 K
293.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVAFish.DLL]  [Kingsoft Corporation, 2008,05,13,78]
     
294.     [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
     
295.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
     
296.     [C:\WINDOWS\system32\WN.IME]  [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
     + P! K/ f! u4 j4 P2 K! a" i
297.     [C:\Program Files\ShiQiang\wnime\Dll32\wnpy_StatusWnd.dll]  [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
     / ^# q$ `: L" Q) `2 g& f. U, v
298.     [C:\Program Files\ShiQiang\wnime\Dll32\wnpy_CompWnd.dll]  [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
     
299.     [C:\Program Files\ShiQiang\wnime\Dll32\wnpy_Query.dll]  [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
     
300.     [C:\WINDOWS\system32\SOGOUPY.IME]  [Sogou.com Inc., 3.2.0.0]
     
301.     [C:\Documents and Settings\Administrator\My Documents\SogouInput\Plugin\SgImeWord.dll]  [Sogou.com Inc., 3.2.0.0]
     9 o5 k1 F- M% y1 Z
302.     [C:\WINDOWS\system32\WINWB98.IME]  [Microsoft Corporation, 4.00.950]
     - p; P* k; d: M* k
303.     [C:\WINDOWS\system32\WINWB86.IME]  [Microsoft Corporation, 4.00.950]
     ) q: }$ J8 M* G+ E& J
304.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
305. [PID: 1124 / Administrator][C:\Program Files\Tencent\QQ\TXPlatform.exe]  [Tencent, 1, 0, 170, 0]
     2 ]3 T+ B1 Q6 \6 A
306.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     7 `" {4 Q) g& x
307.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     ! E/ v; _- g' b
308.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     5 u/ n% H. Y8 g: u5 P
309.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     6 h( H# _+ N1 p/ d. K$ b
310. [PID: 928 / Administrator][F:\arvmon.exe]  [任软工作室, 2.2.5.201]
     
311.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     & w# x" X9 W+ h* P! [& A
312.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     
313.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     ; M" @2 ^1 [8 R: _$ G: _5 m- j
314.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
315.     [F:\Vdata.dll]  [任软工作室, 2, 2, 1, 94]
     ) k% u/ m: b* j7 L! c1 ^9 H
316. [PID: 2540 / Administrator][F:\AutoGuarder.exe]  [任软工作室, 2.2.5.201]
     ( [; {* ]  R4 I, F( Y' P
317.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     ) a3 ], V$ t& _/ |& S+ |3 E
318.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     
319.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
320.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     6 ?/ r9 v* O- G0 O
321. [PID: 2476 / Administrator][d:\我的文档\桌面\系统检测修复\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
     
322.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     - u; i, R- l/ j1 t. [- L2 ~4 G3 _- z3 R
323.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     
324.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
325.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
326.     [d:\我的文档\桌面\系统检测修复\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]
     * g" t2 v% d; t3 f* s
327. ==================================
     
328. 文件关联
     " u1 g/ N* Y# n/ n" r- o4 a6 f
329. .TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
     $ |4 o, W- L& B6 x, ^$ [0 U
330. .EXE  OK. ["%1" %*]
     
331. .COM  OK. ["%1" %*]
     + s& n0 q- D- z6 U8 E1 G; g- q
332. .PIF  OK. ["%1" %*]
     8 z8 u- F; W  ?/ k- ]
333. .REG  OK. [regedit.exe "%1"]
     + W( E% E* ]) x3 C6 p: O
334. .BAT  OK. ["%1" %*]
     
335. .SCR  OK. ["%1" /S]
     
336. .CHM  OK. ["C:\WINDOWS\hh.exe" %1]
     4 d2 A( e; l( ?. @9 ?& p
337. .HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
     
338. .INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
     ) t* ]8 m7 Q! k" ]& {& A8 l& v7 s% x
339. .INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
     + c- j6 X; l' c: @
340. .VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
     
341. .JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
     
342. .LNK  OK. [{00021401-0000-0000-C000-000000000046}]
     + Q6 `" Q3 Q1 W2 L) N! Y) }
343. ==================================
     6 j! W7 a, j; w+ z' F/ u
344. Winsock 提供者
     . U. O8 d1 [, O: o6 j. {- k
345. N/A
     + Z: h; u4 R; n' ~2 a% Y
346. ==================================
     
347. Autorun.inf
     
348. N/A
     
349. ==================================
     
350. HOSTS 文件
     # x6 B8 J& d' L; X
351. N/A
     
352. ==================================
     
353. 进程特权扫描
     $ m3 m0 Y! {0 T9 {
354. 特殊特权被允许： SeLoadDriverPrivilege [PID = 520, C:\WINDOWS\SYSTEM32\WINLOGON.EXE]
       f& L8 D$ k9 [& [/ V, T
355. 特殊特权被允许： SeDebugPrivilege [PID = 928, F:\ARVMON.EXE]
     & P/ e; l8 a* I) q3 ]2 x( J2 l
356. 特殊特权被允许： SeLoadDriverPrivilege [PID = 928, F:\ARVMON.EXE]
     ( t: a( A& h; y4 A/ b9 \% Z
357. 特殊特权被允许： SeDebugPrivilege [PID = 2540, F:\AUTOGUARDER.EXE]
     6 q- V# h( ~) y3 E4 i
358. 特殊特权被允许： SeLoadDriverPrivilege [PID = 2540, F:\AUTOGUARDER.EXE]
     
359. ==================================
     
360. API HOOK
     
361. N/A
     
362. ==================================
     , J1 Q5 F4 T2 j) d
363. 隐藏进程
     
364. N/A
     
365. ==================================
     3 Y: R% Z' ^% A  W4 N8 U
366. 
     

复制代码

傲天♂扬帆

跟原始说了，不知道能不能看明白。。。

傲天♂元始

[Start]

2008-05-22,22:24:21
( L* G4 R+ s6 u- x# m* f2 {2 G$ @
SREngLOG智能分析专家 V1.2.0.125
Tored (http://hi.baidu.com/peaset)
# `. s- I  v$ S, a" K  \
" P: W8 N. @; x( M' g5 I6 @9 ]======================================================
5 p' {' R' _- R7 Q. D以下过程将用到SREng、PowerRmv，如果您不熟悉这两款工具的使用方法，请参考下列链接：
/ f, s7 l  }7 z" |1 T" _SREng详细操作方法： http://hi.baidu.com/peaset/blog/ ... dd19224e4aeadf.html
" _! z3 K' }: B; z/ e2 i! q% J0 U- nPowerRmv详细操作方法： http://hi.baidu.com/peaset/blog/ ... 6fb5eb77c63816.html
======================================================

7 U( @1 d# h) k" T5 z5 B* g5 q以下是病毒清除步骤：

1、用PowerRmv删除以下文件(没有则跳过)：

# I; ?! m2 c3 v+ c6 h  N9 i4 T; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
;
; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
$ b1 V* Q) a( I1 y$ kC:\WINDOWS\System32\3wareSrv.exe
\SystemRoot\C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll
- C1 X/ Y7 Z4 }  D; u
6 ]* ^- S# l' m4 d  o& X! N1 I2 j\SystemRoot\System32\DRIVERS\22jn.sys
\SystemRoot\System32\DRIVERS\43ecu.sys
% x" s5 ?, f5 K0 A! y0 B3 I\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys
6 b6 w, x8 d. P\SystemRoot\system32\drivers\pnduojtwbt.sys
\SystemRoot\system32\drivers\RsBoot.sys
system32\DRIVERS\sr.sys
) Q+ Q7 A3 b: |. S+ I: g\SystemRoot\system32\drivers\unzxzsrs.sys
, w, n' u, O& J3 z4 [2 ~/ h\SystemRoot\system32\DRIVERS\ViBus.sys
\SystemRoot\system32\drivers\zhibmaso.sys
0 k1 r, x& |3 D/ Q
$ ^) Z0 O6 u/ C9 h: K7 \$ W2、用SREng删除以下【注册表】项(没有则跳过)：

* [; F- t% |/ n. w' L! k: G3 _+ l# B<IMJPMIG8.1>
( i* x  N. j9 g) O( u<PHIME2002A>
: u8 x+ R! P3 q% ?( x+ h- d<PHIME2002ASync>
0 P8 b$ z, R& Q" c: o
8 a  s$ K! e. _3、用SREng删除【所有启动文件夹】内容(没有则跳过)
( ]$ f* V. g& u& H1 G! l# T$ x7 W
/ O2 B* b/ O: S8 v. C; Y4、用SREng删除以下【服务】项(没有则跳过)：
7 \2 f# Q4 z6 I  `1 z  s, ?
/ H9 p, a: a6 @4 A[3ware Controller Service / 3wareSrv]
[NetMeeting Remote Desktop Sharing / mnmsrvc]
$ a3 ?7 K1 U  y+ ]
, m/ p& M, G, u" \( _5、用SREng删除以下【驱动程序】项(没有则跳过)：
. x& v8 `9 q0 k1 k
[22j / 22jn]
- X: u9 m3 J- w9 u, b' f! [[43ec / 43ecu]
. j& m. ^$ ^& U& w' ?( Y[ntptdb / ntptdb]
[pnduojtwbt / pnduojtwbt]
" t+ G5 }( l# u( s[RsAntiSpyware / RsAntiSpyware]
[System Restore Filter Driver / sr]
[System Services / unzxzsrs]
1 K( u+ ~  t5 O+ M& Q% n4 c5 c[ViBus / ViBus]
[ATI Extend / zhibmaso]

' r0 G5 `( X8 y2 ?% A6、用SREng删除以下【浏览器加载项】项(没有则跳过)：

[Zcom 杂志]
! s4 d2 w: r4 |) I7 W! y/ p: \[Browser Enhanced Objects]
, \0 ^: K9 ^* Y& T' d
7 \5 p' R+ T# T4 {9 I" b/ u  V最后,重新启动计算机.Tored祝您好运!
9 w6 n& \. c% D/ K/ |======================================================
[End]

傲天♂元始

你就这样弄，不行我也没办法

傲天♂扬帆

独恋有按原始说的重新操作一次吗？

独恋伊影

找不到要删的文件。。。。

傲天♂元始

有些都是隐藏起来的

傲天♂风云

9 w3 [2 I8 o0 t, z: f% e我对代码 一点都不懂

傲天♂元始

。。。这不是代码只是系统的扫描日志而已

傲天♂冷漠

我汗~~~
这么多代码~~~