在这里

独恋伊影 · 发表于 2008-5-22 20:53:41

4 Y! D$ Z* r" R
2008-05-22,20:37:43
7 O9 D5 E1 d5 _7 p$ b9 u; m7 j
System Repair Engineer 2.5.16.900% J; x1 k+ @6 S9 e/ ^* L
Smallfrogs (http://www.KZTechs.com)
- ?+ U% A+ H5 s2 } k
Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
$ t9 a) S9 z2 g" B8 |* x
以下内容被选中：3 W/ E$ y! x$ V
所有的启动项目（包括注册表、启动文件夹、服务等）; F7 m1 Q' P5 E1 Z) k& [7 e- z+ k
浏览器加载项
1 c& a+ M- u; @5 z+ L" z
正在运行的进程（包括进程模块信息）
7 r# U' C. @8 g O# r: X
文件关联
# o+ r) M; T% X( s5 y- M- c# }6 A& m
Winsock 提供者( {( a0 B8 I. ~$ ]2 _/ v4 }* e
Autorun.inf$ D6 V, r; `! q' I! Y& U
HOSTS 文件- k( c5 P/ ?! k! A: j# ]
进程特权扫描, L! I0 _) t( r& o0 }) s, \
& ^+ B9 E$ Q( y4 N
启动项目
+ A3 \( M1 f4 I; n
注册表
8 K; B/ |2 M, h: t( M
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
9 g# s+ O g4 z$ G
<ctfmon.exe><C:\WINDOWS\system32\CTFMON.EXE> [(Verified)Microsoft Windows Publisher]$ C! G3 a2 t0 T& C" ~8 d: N
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
; w6 O& [4 @% Z0 W& k
<360Safebox><"C:\Program Files\360Safebox\safeboxTray.exe" /r> [(Verified)Qizhi Software (beijing) Co. Ltd]
1 I- q( |" o% a y2 Y
<360Safetray><C:\Program Files\360safe\safemon\360tray.exe /start> [(Verified)Qizhi Software (beijing) Co. Ltd]
: i# v, G* p: a9 U6 q% [) \. h1 z
<360Antiarp><C:\Program Files\360safe\AntiArp\AntiArp.exe /start> [(Verified)Qizhi Software (beijing) Co. Ltd]
6 d6 n, O% | l- s0 X+ K. y% Y8 W* t
<KavStart><"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVStart.exe" -startup> [(Verified)KINGSOFT CORPORATION]- [4 p6 i0 G* K* ~/ { O- P7 T
<IMJPMIG8.1><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32> [N/A]
+ f( [ g+ _$ |( C6 G3 C
<PHIME2002A><; > [N/A]- a$ W+ z; A& d& r# W2 H9 l5 b# q3 |
<PHIME2002ASync><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32> [N/A]. Y6 U1 c! [/ r6 J- ]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]) A7 N" t" T O. j% _0 @8 u- H
<shell><Explorer.exe> [(Verified)Microsoft Windows Component Publisher]
6 m) |! Y3 m; X
<Userinit><C:\WINDOWS\system32\UserInit.exe,> [(Verified)Microsoft Windows Publisher]# x$ R9 t* A/ }/ l: i: S# [/ ~
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
3 \7 Y4 K/ o) k# {
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
6 f7 a9 ~" u& D( m7 P
<{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}><C:\WINDOWS\system32\shlhook.dll> [Beijing Rising Technology Co., Ltd.]( D4 ?' L- M0 d9 ] V4 _# p' X
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]. m2 Z: F3 u/ V. s. N
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A]
6 A; l# h+ X- ~9 }
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]1 M% H$ c* n V9 [, s: ^# L
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A]
& e3 K1 v+ E' p6 k% I5 s( Z
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]* z( T4 y. @" L% T3 @1 @9 q! N
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A]
8 _% S4 z- p2 _) l! R8 B
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]2 X! x# s2 `. C9 W2 V
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A], {: R+ G/ f; |
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]9 V3 I; U+ J9 S6 W
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Remove.PerUser.NT> [(Verified)Microsoft Windows Publisher]
0 ?' A0 Y- L/ A9 D- Y* n# c
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
' }( J( O$ z, t5 L0 A$ y
<Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser> [(Verified)Microsoft Windows Publisher]* F. Y! ?/ v+ S% V( u t- o/ s
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
9 h; S7 ~# ]2 D$ g. M w0 b2 h
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub> [(Verified)Microsoft Windows Publisher]& @. ^3 r; I5 d5 d! {5 k
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
& z( Z4 e( p$ H1 U$ y; S" w
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A]1 f( u5 H: h9 M+ T& }6 t! s. w
==================================8 b& d2 M' o+ Y/ \: m3 V5 x
启动文件夹# v: v0 b. s& c7 i2 L
N/A
2 z7 o! d1 h3 ~ s1 y- f0 N7 X
==================================
% O( h" n' o& W) i7 ^
服务5 T& \4 S5 e$ j. t& b. L- ]
[3ware Controller Service / 3wareSrv][Stopped/Auto Start]
! G+ u4 g& f N
<C:\WINDOWS\System32\3wareSrv.exe><N/A>9 _$ F( T- W; A
[Google Updater Service / gusvc][Stopped/Manual Start]" p: A3 g. p$ z9 ~
<"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"><Google>
+ A. J D. W" s& m
[Help and Support / helpsvc][Stopped/Disabled]
+ k( \! D, H7 A% Y z
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll><N/A>
2 k$ ?' e+ q7 a7 p8 P6 [- i
[Human Interface Device Access / HidServ][Stopped/Boot Start]
6 N" q+ a2 e7 f2 o' L
<\SystemRoot\C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
. _4 ~) g; X2 Q$ D5 a
[Kingsoft Internet Security Common Service / KISSvc][Stopped/Auto Start]
7 Y+ z/ ~& l7 p* k
<C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KISSvc.EXE><Kingsoft Corporation>
- c! S" f2 z% X; f, d) P" J
[Kingsoft Personal Firewall Service / KPfwSvc][Running/Auto Start]
J8 ?( m1 y) x l
<"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KPfwSvc.EXE"><Kingsoft Corporation>$ L) t% E" h2 T: {% Q; i* }
[Kingsoft Antivirus KWatch Service / KWatchSvc][Running/Auto Start]( o) L3 x1 ~# K& |/ ~/ X
<"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KWatch.EXE"><Kingsoft Corporation>. Z3 t, R9 _4 P
[NetMeeting Remote Desktop Sharing / mnmsrvc][Stopped/Manual Start]4 M" ]/ z1 s, q) f' w. q c
<><N/A>
2 S1 G/ E1 I' s6 \ {' n3 q# @
[Qvod Terminal / Qvod Terminal][Running/Auto Start]! `0 S, z! T, d/ q Q& f
<C:\Program Files\QvodPlayer\QvodTerminal.exe><Shenzhen QVOD Technology Co.,Ltd>+ M% I3 \, B _ {+ \" W$ ?& b
==================================6 H3 n4 X, P1 C( }' L/ A
驱动程序0 e% m$ K5 b) O/ a- J0 _7 Q
[22j / 22jn][Stopped/Boot Start]
3 E# H; U% Q3 ]; N
<\SystemRoot\System32\DRIVERS\22jn.sys><N/A># ? `' d9 I1 ~
[360AntiArp / 360AntiArp][Running/System Start], [- w/ v, t& Y9 U- ^, r
<\??\C:\WINDOWS\system32\drivers\360AntiArp.sys><360安全中心>, u9 `" t% D8 \9 F
[43ec / 43ecu][Stopped/Boot Start]5 _# x% j0 B9 \+ f3 L
<\SystemRoot\System32\DRIVERS\43ecu.sys><N/A>8 f' X7 Q2 x# k
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Running/Manual Start]
$ l3 z4 _# t& P4 v a
<system32\drivers\ac97intc.sys><Intel Corporation>
) D/ o; L6 {3 ^! q% c
[Promise driver accelerator / bb-run][Running/Boot Start]
8 p- l) H9 C& y4 \6 _5 h
<\SystemRoot\system32\DRIVERS\bb-run.sys><Promise Technology, Inc.>
7 [6 b }3 b0 l
[Promise Removable Disk Control Driver / dontgo][Running/Boot Start]2 U! D. Z' g1 [( L( P0 ] U1 w
<\SystemRoot\system32\DRIVERS\DontGo.sys><Promise Technology, Inc.>
* ?5 v% W; l% j
[KAVBase / KAVBase][Running/Auto Start]
; m9 N2 u2 s# E
<\??\C:\WINDOWS\system32\Drivers\KAVBase.sys><Kingsoft Corporation>4 `% [# W( [8 ]5 x9 W2 l
[KAVBootC / KAVBootC][Running/Boot Start]
C n; D# i% x2 D! c
<\SystemRoot\system32\Drivers\KAVBootC.sys><Kingsoft Corporation>
& ~4 t' K! p1 J$ u. v. ?6 f* c
[KAVSafe / KAVSafe][Running/Auto Start]
0 S% T& b# t# h0 A: \
<\??\C:\WINDOWS\system32\Drivers\KAVSafe.sys><Kingsoft Corporation>
3 w2 C! q) J$ u& `
[KNetWch / KNetWch][Running/System Start]1 m, b* G, p9 U( I. W
<\??\C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KNetWch.SYS><Kingsoft Corporation>
$ B6 M# C( D3 \& H1 S0 g
[KWatch3 / KWatch3][Running/Auto Start] S* y, T$ h$ c# S- [
<\??\C:\WINDOWS\system32\drivers\KWatch3.SYS><Kingsoft Corporation>
( L6 |% [) n0 c4 {: K
[ntptdb / ntptdb][Stopped/Auto Start]$ r4 ^% K4 @# `9 X" R
<\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys><N/A>( K2 W$ c9 s+ c. L4 u$ P$ Z( g
[nv / nv][Running/Manual Start]0 ?" k$ e/ l& K# i6 Q+ j
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
" P; x4 {3 F0 m
[NVIDIA nForce RAID Driver / nvrd32][Running/Boot Start]
6 o0 E5 r, v8 k( {1 H
<\SystemRoot\system32\DRIVERS\nvrd32.sys><NVIDIA Corporation>8 Q; z S- l: N; C0 X" |
[DDK PACKET Protocol / Packet][Running/Manual Start]9 ]4 L& ?9 l, l# |7 z
<system32\DRIVERS\ProtoDrv.sys><360安全中心>1 i/ d7 P. M( R v
[pnduojtwbt / pnduojtwbt][Stopped/Boot Start]
' P' ]! ^4 e% S9 Y, c# ?: T
<\SystemRoot\system32\drivers\pnduojtwbt.sys><N/A>, ^1 P! v/ ]1 Z: C7 P& H& J
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]; B9 i: _! Q5 A8 d. X& k# g8 p$ p. [. G
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>; b0 V+ k5 q9 W" @: w4 v y
[RsAntiSpyware / RsAntiSpyware][Stopped/Boot Start]( F! E. O+ b J2 C& N; Q0 l& Q
<\SystemRoot\system32\drivers\RsBoot.sys><N/A>, C" J) P$ P$ S+ }; p- t7 i
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]! o! C5 ~" G6 T. o) ?! [# ]
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>* a: N+ {% m" a& t0 v; a
[SafeBoxKrnl / SafeBoxKrnl][Running/System Start]4 X3 k( ~/ A6 V2 t' B
<\??\C:\Program Files\360Safebox\SafeBoxKrnl.sys><360安全中心>! O0 w% t" H( i+ {* w+ S
[Secdrv / Secdrv][Stopped/Manual Start]7 E: j& x- C* Y( {9 g# B% [
<system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>8 F. f8 C, @6 k# ]5 h, p8 D8 R( I
[SATALink External Device Filter / SiRemFil][Running/Boot Start]& X# b6 ^2 R7 H2 N j; V
<\SystemRoot\system32\DRIVERS\SiRemFil.sys><Silicon Image, Inc.> T4 Z T7 u2 _3 O
[System Restore Filter Driver / sr][Stopped/Disabled]
8 `6 E, d( n, w7 \' }
<system32\DRIVERS\sr.sys><N/A>
2 O+ W! b& k. S9 V0 ?6 b5 E
[TesSafe / TesSafe][Stopped/Manual Start]/ }6 A+ Z# f. I0 f* v4 d5 Z
<\??\C:\WINDOWS\system32\TesSafe.sys><TENCENT>
* C$ O4 d: ^$ k6 G# N
[System Services / unzxzsrs][Stopped/Boot Start]% d4 _8 ~0 {# r$ v
<\SystemRoot\system32\drivers\unzxzsrs.sys><N/A>
4 d. H. l$ m- I$ z
[ViBus / ViBus][Stopped/Boot Start]* z; |- s J2 p& |% T0 R. O3 F
<\SystemRoot\system32\DRIVERS\ViBus.sys><N/A>
8 S! u7 v1 t6 x
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]# w q4 U2 f Y3 V' U3 h X, J9 d
<system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>! ]: V" \/ _% E% z& x/ w' u. a1 S
[VIA SATA IDE Hot-plug Driver / xfilt][Running/Boot Start]7 x3 U7 B' w/ e; w
<\SystemRoot\system32\DRIVERS\xfilt.sys><VIA Technologies,Inc>- E t" }) V! W, n& d
[ATI Extend / zhibmaso][Stopped/Boot Start]* l8 X2 o( w" s
<\SystemRoot\system32\drivers\zhibmaso.sys><N/A>+ z% x2 T w+ K, s
[Vimicro USB PC Camera (ZC0301PL) / ZSMC301b][Running/Manual Start]
3 P c6 D, }5 D2 v9 x; J( W
<System32\Drivers\usbVM31b.sys><Vimicro Corporation>
9 c8 c/ Y3 Q! b* b) u
==================================% G/ e- Y0 D* l) Q+ [4 N4 Y
浏览器加载项
, m1 H- S" b0 `+ R' W+ K
[Google Toolbar Helper]& e5 j( z7 [0 q6 |9 K
{AA58ED58-01DD-4d91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>
! E( m( I% x+ @2 z
[Google Toolbar Notifier BHO]
+ s! t- F0 [1 N
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>& {+ Y% B$ i z( w4 c
[SafeMon Class]/ z# W1 K/ K( y3 A, S. M2 i3 z
{B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>
2 R+ G) n- V6 y" p% d
[kingsoft browser shield]) o( Q+ }( b0 q7 L. J4 P* \
{D963BE1A-6B35-47DB-B002-49FAE71D85CC} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL, Kingsoft Corporation>5 y8 F4 K9 m z5 ^- w. Y0 c
[IEBuddyExtControl Class]
/ B z1 d: ~/ O
{3AECD3C1-7085-4731-96DC-47B6CF7EF749} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL, Kingsoft Corporation>$ v7 p5 {2 X: n- S- k/ X% W
[Zcom 杂志]" c4 H& R3 G9 f& K! {
{4045D313-1D5E-4fe4-93A0-A34630B6A00B} <C:\Zcom\E-Space.exe, N/A>
) _; |& j9 |# f
[&Google]
! u1 R7 |4 Q( P( C6 {/ L4 \% v
{2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>
: s8 X4 d& z2 b* q1 Y# e
[KooPlayer Control]
2 R# h8 M2 O e# @! b$ d6 t
{C728DAB8-FDF5-4CD7-89DD-879D25794C77} <C:\WINDOWS\system32\CCTVKO~1.OCX, Koos>
3 W# T' O" r" S; F2 }
[Shockwave Flash Object]6 ?( H9 J9 A/ S8 a3 i8 U d
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>
' {$ c( i2 O Z$ W9 H" ^
[KUpdateObj2 Class]3 D" e4 P9 { {4 M t' A* C" Y
{D82303B7-A754-4DCB-8AFC-8CF99435AACE} <C:\WINDOWS\system32\KingSoft\KOS\UpdateOcx2.dll, Kingsoft Corporation>
1 M5 y* u# U. `/ L1 l" L8 ]
[Google Script Object] s4 c3 J& A) g
{00EF2092-6AC5-47C0-BD25-CF2D5D657FEB} <c:\program files\google\googletoolbar2.dll, Google Inc.>
" n7 N2 h( |, P5 g8 w* c' t
[EWA Control]8 L& R; U3 P1 a5 S3 [3 C
{18226BF8-DC0B-4D81-80E9-A41AE37BB73A} <C:\PROGRA~1\PPLive\SYNACA~2.OCX, Synacast>; V ?) ^& v- s4 u
[Windows Media Player]
0 C3 a3 ? N- H1 D4 F8 J0 p
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\msdxm.ocx, Microsoft Corporation>6 T8 E) W4 }) k# y5 L/ W
[&Google]
5 y! n" K/ J/ q% c6 b
{2318C2B1-4965-11D4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>- J7 z) i$ C% m
[HTML Document]8 U0 a9 t; D5 d
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>; B! @" [! b4 y8 q& x( Q0 s4 `7 q
[DHTML Edit Control Safe for Scripting for IE5]7 f/ \3 ^0 G& i8 U. U
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>1 J' N& ~ m n/ H- D8 @! B
[RealPlayer RAM Download Handler]
0 c# q; T% q6 A, B+ q: q' M) y
{2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
4 m$ L$ k5 U, r0 t N$ c8 d
[IEBuddyExtControl Class]
' j3 X: w/ ]3 T2 T' X4 X. \
{3AECD3C1-7085-4731-96DC-47B6CF7EF749} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL, Kingsoft Corporation>
" y& y. e5 t3 M
[XML Document]& y; z4 r y: j: Q1 u+ j" L
{48123BC4-99D9-11D1-A6B3-00C04FD91555} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>2 T$ G. O9 j0 I; i) D
[HHCtrl Object]
5 p& Y( ]1 q0 Y, B. h
{52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
0 F. H( s) S q0 H+ N' e# O
[Windows Media Player]
; |6 W; D1 O% |
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>: Y. [# E: o# i# @/ D s5 f
[Active Desktop Mover]' x8 v7 \" j, W+ K
{72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
8 l# b6 y' R/ F4 e+ f9 f% L
[360SafeLive], e2 ~ T3 p3 P) A- e6 i
{87515F61-A66C-4319-A0E0-D416CB8059E3} <C:\Program Files\360safe\live.dll, 360.cn># P$ f1 k- J% K7 y, x, S: t( P
[Microsoft Web 浏览器]& y; W! G1 K _8 y
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation> t! }4 A; W" W& _- l
[Browser Enhanced Objects]
( Y9 j7 @* c. `1 [& ]
{986488AF-13D5-9DDF-4FEF-9FB88698CFC1} <C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\USERDATA\webbrowser_2011.dll, N/A>
; O i5 a# i, R' A
[Google Toolbar Helper]
4 g4 M8 z# c9 p! x; a% [: R
{AA58ED58-01DD-4D91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>
9 {: o* x# Z; Z& Z
[Microsoft Scriptlet Component]
% I9 B# a5 U4 {( j, c
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>: T: s2 P1 C! u/ _- c4 o" W Y, ^
[Google Toolbar Notifier BHO]2 h8 d, L1 W) v; I3 y0 e! H* e8 S% v
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>
& J, F; m3 k7 N( F( b! b& ^- B
[SearchAssistantOC]% S: J+ x7 y% {! b) J+ n, Y: j) y
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
/ j7 D1 g" ^8 x5 b2 i
[SafeMon Class]
3 i( E) ]2 h8 }! i; v* M
{B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>" n& u0 u5 \1 ]: W5 W1 L7 }
[RDS.DataSpace]( W B }7 |( x5 e8 K# n% j
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
' C) d, x" [. t% b, r* {
[KooPlayer Control]! N1 Y8 z( v. c# o4 k: \+ k
{C728DAB8-FDF5-4CD7-89DD-879D25794C77} <C:\WINDOWS\system32\CCTVKO~1.OCX, Koos>
3 z* _- Z# l) {% W0 a+ T. W3 G6 S( t
[AUDIO__MID Moniker Class]- K0 Z3 a0 G) a8 i$ _$ m
{CD3AFA74-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>2 r8 e# q t2 u# l
[AUDIO__MP3 Moniker Class]4 u& K- T4 |, m! D! U" d9 l) Q
{CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>; ~1 X0 a' h* P' V) i6 \
[AUDIO__X_MS_WMA Moniker Class]
) t! F* ^( b( z9 s+ K
{CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
( j( F. y3 f3 Y* O- L! e
[VIDEO__X_MS_WMV Moniker Class]) s* F( B) @/ K! p! h% R
{CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>- m/ ]- @* g- o* l7 _" a$ x* F
[RealPlayer G2 Control]
" g. _# u; e7 |" M) X% V5 s. y
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>% k. G% v: y0 |1 `
[Shockwave Flash Object] a* W( m3 P* V8 U/ ^ [( U2 @
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>
% a; P) e* i: @0 {5 K
[KUpdateObj2 Class]
4 [) X5 T, `$ s2 D+ K
{D82303B7-A754-4DCB-8AFC-8CF99435AACE} <C:\WINDOWS\system32\KingSoft\KOS\UpdateOcx2.dll, Kingsoft Corporation>
! T' p- a' ]* O: ~- U2 _
[kingsoft browser shield]; b5 p- P, n; [) q
{D963BE1A-6B35-47DB-B002-49FAE71D85CC} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL, Kingsoft Corporation>
T2 Y4 h! L" l& c F
[PasswordEditCtrl Class]0 ~- f @1 w- I2 z1 c1 c6 ?7 W2 H
{E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
6 T; J1 u$ ?" U+ r1 f/ }' Q. y& o
[QvodCtrl Class]$ z, b! y" X7 l6 j2 j$ U
{F3D0D36F-23F8-4682-A195-74C92B03D4AF} <C:\Program Files\QvodPlayer\QvodInsert.dll, Shenzhen QVOD Technology Co.,Ltd>* l# }2 z- }# Y# K, P, P! h
[&使用超级旋风下载]
. A \6 G& `$ B( t7 r
<C:\Program Files\Tencent\QQDownload\geturl.htm, N/A>
% b1 w; b# D# \( H
[&使用超级旋风下载全部链接]
) w( y R( f0 F. g. G4 a Z- z6 h
<C:\Program Files\Tencent\QQDownload\getAllurl.htm, N/A>
. y3 ?* T% e+ m- M
[使用迅雷下载]
; l4 T' C$ l1 ]
<, N/A>
5 B3 g7 i1 [ ^! k
[使用迅雷下载全部链接]# m- }1 I5 S3 n
<, N/A>
; H9 l5 O9 Z' j; m; G5 }
[导出到 Microsoft Office Excel(&X)]. O; y( M3 F3 o4 `9 {
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>, B$ k6 n. c) m
[添加到QQ表情]6 S6 m: @9 q. I. {. P7 ^
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
( K" B2 \$ q$ T1 \" _; I
==================================8 f8 p- G% y: V/ J3 D* d% ^
正在运行的进程
1 o) P8 j+ D; P) l h1 w; W
[PID: 444 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]" q# T8 X2 n# N3 V& u; L! u6 E( x
[PID: 496 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
, O; ]9 u! S" U6 j" a4 J' Z
[PID: 520 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]# x7 D+ t5 B6 M1 e6 G# Z. o4 E3 J
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]) B5 I N! |* A8 k3 D( Z" Z
[PID: 564 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]* ~8 y, J. K: M
[PID: 576 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
: K* }/ L0 G/ M# V$ u
[PID: 720 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
* S, @& L) W& }( B7 [ J3 B
[PID: 780 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
' L% \2 s" G( k3 K- c: n* j
[PID: 856 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]5 \; H8 d$ K" K3 w
[PID: 944 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]( G$ D3 Q1 ?2 o0 f9 e
[PID: 1012 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
8 P/ v# U$ E$ F. v( I
[PID: 1236 / Administrator][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_qfe.070613-1311)]
# ~6 h! M! T& U( t
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]
7 {) j/ `. R- y& K3 C# p
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]
, }$ H9 t6 [! d$ Y' R
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
# ?! P3 f( A; W; Z# g
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
5 A3 B$ |7 y* @2 ?2 h4 J* e1 V
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVEXT.DLL] [Kingsoft Corporation, 2008,05,07,373] d5 f. I) \. o3 V
[C:\Program Files\Tencent\QQ\qdshm.dll] [, 1, 0, 101, 20]
, u0 Z2 q% w7 }1 n/ S8 L! r
[C:\Program Files\Tencent\QQ\MFC42.DLL] [Microsoft Corporation, 6.00.8665.0]
; ~1 v$ O3 d; {
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
5 k& b0 E9 H5 F |( w
[C:\WINDOWS\system32\shlhook.dll] [Beijing Rising Technology Co., Ltd., 4.0.0.9]
C% }/ G; j; o& n# k' G
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]( h6 q( I: E# p3 V+ b! V1 ?0 W5 l- g
[C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]! ]- y6 U! T* s/ y0 r; ?0 Q1 \1 ^
[PID: 1332 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
, Q7 x: M- @7 o) V8 E: h
[C:\WINDOWS\system32\mdimon.dll] [Microsoft Corporation, 11.3.8166.2]3 ?+ ]! N" V0 P, b/ B, p9 f) t
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll] [Microsoft Corporation, 11.3.8166.2]
* j2 D( J2 `) K6 M- u/ N
[PID: 1540 / Administrator][C:\Program Files\360safe\AntiArp\AntiArp.exe] [360安全中心, 2, 0, 0, 1008]0 A1 y5 m0 X/ ]; p+ h
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]: [7 ^, L5 w5 v( X
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]% `5 m# [- c- Z& x% a$ S
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]
( o; j8 d c* P6 h& V/ T
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]
, [& V6 i% S. q( V, T
[PID: 1560 / Administrator][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
4 i; v. J+ [/ `7 E0 z9 ^& @
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]& Y5 e. p' ?2 {
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]( A- r M+ a. Y2 n+ z& L8 V1 z3 G+ f
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]- S b4 \* G1 K/ e$ T. a
[PID: 1576 / Administrator][C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe] [Google Inc., 2, 0, 301, 1654]1 F3 U) n; G h" j/ g
[C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\gtn.dll] [Google Inc., 2, 0, 301, 7164]
3 s* S- H0 F e/ Z. ?- d5 s5 Q; E
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]' L# V4 \' e" B2 H+ L8 h& J9 {
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]
' d0 [6 D% Z. X- ^6 n, V: Y' w
[C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\res_zh-CN.dll] [Google Inc., 2, 0, 301, 7164]
$ C g( u$ x' e1 w' _. B
[C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll] [Google Inc., 2, 0, 301, 7164]- ~7 ]6 y9 Q6 ?! j8 ] U
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
. h" \/ e b- ]; U& b% t ?
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]3 |) ]) Z/ o* \* X* i
[PID: 1648 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
* J& h5 O& X5 }2 e6 j
[PID: 1744 / SYSTEM][C:\Program Files\QvodPlayer\QvodTerminal.exe] [Shenzhen QVOD Technology Co.,Ltd, 2, 5, 0, 53]
4 ]0 T0 }) {! B8 H* q
[PID: 1860 / SYSTEM][C:\WINDOWS\system32\skeys.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
- t" h: }* \2 g, Y' F
[PID: 1908 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
5 ], {- t c$ U. F3 ]
[PID: 1964 / LOCAL SERVICE][C:\WINDOWS\system32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
0 p2 L" W# U% W$ u( h
[PID: 2772 / Administrator][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
" ^6 r6 h0 I ]( C% Q# F, T
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
1 z- k* v1 g( d _8 o$ ?, _
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]
- d" i [7 |1 O' Z2 {
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]
1 y& c$ ?, a: P# D3 @5 T+ m/ C
[c:\program files\google\googletoolbar2.dll] [Google Inc., 4, 0, 1606, 6690]- S/ ?$ u" O) B& W7 v* |
[C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll] [Google Inc., 2, 0, 301, 7164]3 N! Z; D5 ?% D. }
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL] [Kingsoft Corporation, 2008,04,15,2]
# \8 G& y+ j% o) ~. B7 r
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddy.dll] [Kingsoft Corporation, 2008,04,15,2]6 r- h2 ~. h4 Y* s! [% n! E
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL] [Kingsoft Corporation, 2008,05,14,83]! ]9 r0 A2 L. M& O
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KANTray.dll] [Kingsoft Corporation, 2008,04,15,2]) M% K8 L* N, w$ y6 Z# O
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVAFish.DLL] [Kingsoft Corporation, 2008,05,13,78]& Z$ p0 Y% I* ~8 w6 H& j) R
[C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]( [, R; x# R: } N6 Q+ |& O
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]; X. z1 j" x. @* @' ?
[C:\WINDOWS\system32\WN.IME] [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]6 E3 A s9 X0 f3 {/ m
[C:\Program Files\ShiQiang\wnime\Dll32\wnpy_StatusWnd.dll] [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
( z5 w$ b6 L( {/ W5 ?
[C:\Program Files\ShiQiang\wnime\Dll32\wnpy_CompWnd.dll] [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
, ]2 Q( p' T! O2 D$ {/ N3 i! S4 v
[C:\Program Files\ShiQiang\wnime\Dll32\wnpy_Query.dll] [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]% [! i) l% R1 h$ s% u, G
[C:\WINDOWS\system32\SOGOUPY.IME] [Sogou.com Inc., 3.2.0.0]
7 Z% g1 \. L+ D9 h( l3 m4 N
[C:\Documents and Settings\Administrator\My Documents\SogouInput\Plugin\SgImeWord.dll] [Sogou.com Inc., 3.2.0.0]# f; k5 o. `! V4 }3 M
[C:\WINDOWS\system32\WINWB98.IME] [Microsoft Corporation, 4.00.950]7 U* h4 K3 J+ Q, y4 t8 X
[C:\WINDOWS\system32\WINWB86.IME] [Microsoft Corporation, 4.00.950]
6 \6 g- E! u& _& M/ d9 A: v% U
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]- D4 s- f, {& S* ~0 N( K4 E% a
[PID: 1124 / Administrator][C:\Program Files\Tencent\QQ\TXPlatform.exe] [Tencent, 1, 0, 170, 0]% {3 M! e) o* N" H* {: O, D
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
6 D; w0 |8 k1 J- O
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]
# J; J& u' m) v; p
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]
, l9 q& z3 ? u2 a' q& L' v
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]
# I. q7 V+ t9 _8 {9 Q/ ^
[PID: 928 / Administrator][F:\arvmon.exe] [任软工作室, 2.2.5.201]
6 F: }- `3 m6 B4 c l
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]- _: i0 p0 P7 a; k
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]
8 {. _# ^: ~3 c6 Q( Z
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]
8 t% w0 z/ z5 g0 y4 X: D
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]
# a; r# w7 }! r
[F:\Vdata.dll] [任软工作室, 2, 2, 1, 94]8 S7 ^" |5 ?4 X" T# y
[PID: 2540 / Administrator][F:\AutoGuarder.exe] [任软工作室, 2.2.5.201]
3 P9 n8 D( [9 L9 _4 o0 Y0 Y/ k" o
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
/ Q6 N% N" S7 H; U$ J L. e4 U+ I
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]
( @# m! x8 s# f
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364], V. B% i: Z( I0 z
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]
1 k* M0 e% j7 J8 n9 M) r
[PID: 2476 / Administrator][d:\我的文档\桌面\系统检测修复\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]4 V+ e: q5 i* f1 z* I
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
' Z1 S/ k0 E- q7 I0 |$ N
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]
) b( D# y1 s- G+ B( Z5 g
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]$ T! @6 p3 v' ]2 V7 s9 K: o0 i
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]" Y: v! O% [, Y$ } G
[d:\我的文档\桌面\系统检测修复\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]
7 }3 r( H5 h ?! e( O
==================================# T$ y* [1 n& ^, u: R
文件关联
2 w+ N0 B2 K, o$ V
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
9 ^1 g/ V X* H* D2 }& Z* a# u
.EXE OK. ["%1" %*]
- @2 ^# C' D0 e! i1 C( k
.COM OK. ["%1" %*]
( a. J/ T; q( f9 |1 N
.PIF OK. ["%1" %*]
9 g& X+ H# h6 d, [$ o3 I1 L' O
.REG OK. [regedit.exe "%1"]
2 t6 N6 O+ i, @7 e! a8 J9 }
.BAT OK. ["%1" %*] e" p0 k: ^. f# L& B3 E
.SCR OK. ["%1" /S]
! ^; ]5 ]& f1 b3 Z+ P
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
. u) a1 }5 \% z0 T4 i2 i
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
' |/ u: f9 r& q4 U
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
+ b- C' U* f& k; W6 ~3 o
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]. k# q4 {+ @; P, H( `" C
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
$ P+ ?0 q: m: h* }% X" H/ S, p! @
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
0 h9 p. m8 V' L' L+ `
.LNK OK. [{00021401-0000-0000-C000-000000000046}]/ U! N9 T! Q% s# k; t& X( c
==================================: p* T$ m. M" @2 a- S
Winsock 提供者6 A5 n1 B& _. O) U
N/A
) @5 n: K$ A9 I! G/ y- Y+ c
================================== B- T% X4 `) @
Autorun.inf) j! P9 d' Q6 R. t) j4 S+ i, J
N/A6 ^& E- J8 _ n3 Y$ [3 H
==================================
3 h7 ?4 c: e2 {
HOSTS 文件
0 }& Q) q) z& X5 c5 R0 s/ u; x
N/A' |6 T, l. r2 W+ l1 @: K7 F/ b& I
==================================
V$ Y* X& i9 |
进程特权扫描6 i7 `4 ^1 D4 y
特殊特权被允许： SeLoadDriverPrivilege [PID = 520, C:\WINDOWS\SYSTEM32\WINLOGON.EXE]+ N5 r$ L/ y! z
特殊特权被允许： SeDebugPrivilege [PID = 928, F:\ARVMON.EXE]# j( i4 y* B' f0 ]4 Q
特殊特权被允许： SeLoadDriverPrivilege [PID = 928, F:\ARVMON.EXE]
8 q) v( ~0 }" E6 `: Q% K. W- ?3 ]
特殊特权被允许： SeDebugPrivilege [PID = 2540, F:\AUTOGUARDER.EXE]
' L# t' I, c$ o
特殊特权被允许： SeLoadDriverPrivilege [PID = 2540, F:\AUTOGUARDER.EXE], p% ^3 R7 k/ Y. e `/ v
==================================/ M' A& r( ^1 ^6 C( C" t
API HOOK+ j0 T: R/ i. q' x( X
N/A0 ?) H# W+ L( ]% n5 q. ?4 h1 f" r
================================== h( G$ }( L3 T/ z- N
隐藏进程
7 }! U. _- U5 Y2 v
N/A6 L; p1 Q: U7 J# K1 Y% _2 Q
================================== m: O7 ?6 g% R2 s$ F9 X
: e0 J7 }' m8 w. X7 r- |( {9 C

复制代码

傲天♂扬帆 · 发表于 2008-5-22 21:40:31

跟原始说了，不知道能不能看明白。。。

傲天♂元始 · 发表于 2008-5-22 22:23:55

[Start]

2008-05-22,22:24:21

SREngLOG智能分析专家 V1.2.0.125
Tored (http://hi.baidu.com/peaset)

======================================================
以下过程将用到SREng、PowerRmv，如果您不熟悉这两款工具的使用方法，请参考下列链接：
SREng详细操作方法： http://hi.baidu.com/peaset/blog/ ... dd19224e4aeadf.html
PowerRmv详细操作方法： http://hi.baidu.com/peaset/blog/ ... 6fb5eb77c63816.html
======================================================

以下是病毒清除步骤：

1、用PowerRmv删除以下文件(没有则跳过)：

; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
;
; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
C:\WINDOWS\System32\3wareSrv.exe
\SystemRoot\C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll

\SystemRoot\System32\DRIVERS\22jn.sys
\SystemRoot\System32\DRIVERS\43ecu.sys
\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys
\SystemRoot\system32\drivers\pnduojtwbt.sys
\SystemRoot\system32\drivers\RsBoot.sys
system32\DRIVERS\sr.sys
\SystemRoot\system32\drivers\unzxzsrs.sys
\SystemRoot\system32\DRIVERS\ViBus.sys
\SystemRoot\system32\drivers\zhibmaso.sys

2、用SREng删除以下【注册表】项(没有则跳过)：

<IMJPMIG8.1>
<PHIME2002A>
<PHIME2002ASync>

3、用SREng删除【所有启动文件夹】内容(没有则跳过)

4、用SREng删除以下【服务】项(没有则跳过)：

[3ware Controller Service / 3wareSrv]
[NetMeeting Remote Desktop Sharing / mnmsrvc]

5、用SREng删除以下【驱动程序】项(没有则跳过)：

[22j / 22jn]
[43ec / 43ecu]
[ntptdb / ntptdb]
[pnduojtwbt / pnduojtwbt]
[RsAntiSpyware / RsAntiSpyware]
[System Restore Filter Driver / sr]
[System Services / unzxzsrs]
[ViBus / ViBus]
[ATI Extend / zhibmaso]

6、用SREng删除以下【浏览器加载项】项(没有则跳过)：

[Zcom 杂志]
[Browser Enhanced Objects]

最后,重新启动计算机.Tored祝您好运!
======================================================
[End]

傲天♂元始 · 发表于 2008-5-22 22:24:30

你就这样弄，不行我也没办法

傲天♂扬帆 · 发表于 2008-5-23 13:18:44

独恋有按原始说的重新操作一次吗？

独恋伊影 · 发表于 2008-5-24 20:09:59

找不到要删的文件。。。。

傲天♂元始 · 发表于 2008-5-25 08:54:35

有些都是隐藏起来的

傲天♂风云 · 发表于 2008-6-5 03:36:36

我对代码一点都不懂

傲天♂元始 · 发表于 2008-6-5 14:21:26

。。。这不是代码只是系统的扫描日志而已

傲天♂冷漠 · 发表于 2008-6-5 18:19:32

我汗~~~
这么多代码~~~

技术部 收藏本版 今日: 0 主题: 115

在这里

技术部收藏本版今日: 0 主题: 115