在这里

独恋伊影 · 发表于 2008-5-22 20:53:41

+ C z, ~8 E6 B( `) N
2008-05-22,20:37:43* |. b% e% w# }7 n. F
System Repair Engineer 2.5.16.900. A6 H# u$ P, o0 T' A9 k9 N2 x* T9 U9 j
Smallfrogs (http://www.KZTechs.com)' B& M5 i' k$ Q$ u$ d& n: D
Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能$ f. n9 t/ O% N! E! g. z' E8 q
以下内容被选中：
; q% H c; E5 ~$ H1 C
所有的启动项目（包括注册表、启动文件夹、服务等）( x% k N0 W7 P; ^
浏览器加载项
; N7 e; w2 [. x) U5 ]
正在运行的进程（包括进程模块信息）
6 P* s4 ]2 E) e5 h, e7 h/ \
文件关联
/ h6 |. u% W; T% K" o
Winsock 提供者2 a: p9 v5 p, e: x
Autorun.inf
8 P W }, {; Y: C- ~ G
HOSTS 文件3 D- G$ B1 `; R1 H
进程特权扫描+ y6 F0 j4 y8 V6 k
' s- J9 n2 ~+ P* n+ N6 v4 q' k
启动项目0 |5 }' f% H; S, K# ?' D; d
注册表& w$ U! e6 t+ [; R" c, B
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
9 d9 ?& f& n8 O9 v6 h# Q# p2 W
<ctfmon.exe><C:\WINDOWS\system32\CTFMON.EXE> [(Verified)Microsoft Windows Publisher]
2 Q# c% p7 b3 X8 t4 S, i
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
; x! m6 b* [! W# F1 x
<360Safebox><"C:\Program Files\360Safebox\safeboxTray.exe" /r> [(Verified)Qizhi Software (beijing) Co. Ltd]9 \5 l4 _3 v& J2 v7 r( x8 J
<360Safetray><C:\Program Files\360safe\safemon\360tray.exe /start> [(Verified)Qizhi Software (beijing) Co. Ltd]# e7 L2 f9 s. o( |
<360Antiarp><C:\Program Files\360safe\AntiArp\AntiArp.exe /start> [(Verified)Qizhi Software (beijing) Co. Ltd]
$ z* T. N, U* B; s1 z" N+ Q: B
<KavStart><"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVStart.exe" -startup> [(Verified)KINGSOFT CORPORATION]
% K$ V* {% g, o1 O# ^% O# m
<IMJPMIG8.1><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32> [N/A]
2 V$ k6 }7 o m
<PHIME2002A><; > [N/A]
$ ?7 a- z$ k9 T3 g' y1 f) |" J, A% N
<PHIME2002ASync><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32> [N/A]# n3 K% P" X e3 a3 g9 D
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
% A$ }7 f! _0 N0 f! C- m! |
<shell><Explorer.exe> [(Verified)Microsoft Windows Component Publisher]
! h/ a* p$ {: Z n% a3 C
<Userinit><C:\WINDOWS\system32\UserInit.exe,> [(Verified)Microsoft Windows Publisher]$ `+ N$ Z% R& z, |4 Z$ I2 ~
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]. j! s$ Y+ D2 _/ m; D
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]1 Y/ B `2 _- `' L! s) P- ?
<{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}><C:\WINDOWS\system32\shlhook.dll> [Beijing Rising Technology Co., Ltd.]
5 U; v% E7 b# h; z, Y
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
* v% |% ?/ i. o3 b( O
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A]: k( F" s2 b4 ~2 o
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]* P9 f8 K; G7 c; Z1 q2 e& j! A- ]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A]
. M- W& `" T9 z7 O& P7 U
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
5 b1 k, z: j/ H& X* w! u
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A]9 |: q& x2 o v# [% k
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]7 a: d- M/ u6 u; G& ?6 N
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A]
: M- F4 A1 b8 ?: h3 A; c4 V
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
Y" R6 O% c7 X) E5 s- U4 l. N
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Remove.PerUser.NT> [(Verified)Microsoft Windows Publisher]
. g1 g8 w0 ?- u2 [' \" B
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
: E8 A# p* n* |2 K( p
<Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser> [(Verified)Microsoft Windows Publisher]+ e) @; `$ l5 p# @# _% D* G& b
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
- {4 C" h7 x8 z
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub> [(Verified)Microsoft Windows Publisher]
; i2 c+ {% W: \! a* b& `
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]% f2 C0 d' E9 k( G. y" ?7 N/ _& a
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A]8 G; ^1 |+ s; F4 _
==================================
- d$ M0 I! w: P. Q
启动文件夹
8 N: p4 z) e& U6 f% C9 c, `
N/A$ [1 {) H* Z/ _) H
==================================3 j; J& z! B* H: a3 B& E3 M
服务2 H# E" x# i: H
[3ware Controller Service / 3wareSrv][Stopped/Auto Start]
1 J, Q4 Y! `/ |
<C:\WINDOWS\System32\3wareSrv.exe><N/A>
) v. X# E4 D7 q% O
[Google Updater Service / gusvc][Stopped/Manual Start]3 g/ T4 ?( ]4 j5 ^
<"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"><Google> {! S. ?" }+ n5 ^$ G4 Z
[Help and Support / helpsvc][Stopped/Disabled]
! t' n+ M/ N% z* u0 Z( l1 f
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll><N/A>
: z3 e; D* G w; q
[Human Interface Device Access / HidServ][Stopped/Boot Start]
8 v+ r4 M, Y0 Z/ i2 Y( g: u; B
<\SystemRoot\C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>1 s9 n3 w7 @+ G& K* C
[Kingsoft Internet Security Common Service / KISSvc][Stopped/Auto Start]7 i- x4 u, {, ]5 v
<C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KISSvc.EXE><Kingsoft Corporation>
4 P6 M6 J d4 L& `
[Kingsoft Personal Firewall Service / KPfwSvc][Running/Auto Start]
. f" i0 M M5 w+ d3 b
<"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KPfwSvc.EXE"><Kingsoft Corporation>
9 Y4 u6 {( l: f5 w( X" v- h
[Kingsoft Antivirus KWatch Service / KWatchSvc][Running/Auto Start]
; Z1 |+ b+ j& Y* V+ T7 Z
<"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KWatch.EXE"><Kingsoft Corporation>
' e& |% w( h# p& x u; D
[NetMeeting Remote Desktop Sharing / mnmsrvc][Stopped/Manual Start]
: M" t. H; a0 E" P% O0 J" r$ j
<><N/A>" {8 ^5 O. f( n3 [4 D% s
[Qvod Terminal / Qvod Terminal][Running/Auto Start]
, y, I, t& Q" u
<C:\Program Files\QvodPlayer\QvodTerminal.exe><Shenzhen QVOD Technology Co.,Ltd>
+ u. a- j, [6 Z
==================================7 {2 F" X. O7 v$ h
驱动程序- ^9 w5 l# a1 w0 L
[22j / 22jn][Stopped/Boot Start]/ K x" w! C" O D$ h
<\SystemRoot\System32\DRIVERS\22jn.sys><N/A>
" J' {3 C0 O* A, }4 d' a
[360AntiArp / 360AntiArp][Running/System Start]
3 x+ r# J5 g( |. i* b9 [
<\??\C:\WINDOWS\system32\drivers\360AntiArp.sys><360安全中心>5 Q1 d9 `0 [; [" e. `
[43ec / 43ecu][Stopped/Boot Start]
2 f2 w- q, M. M! {$ d' l7 {* |
<\SystemRoot\System32\DRIVERS\43ecu.sys><N/A>
8 Z2 K# P% w$ M5 c- Y
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Running/Manual Start]# V- C' y) G3 [( k" @) ^$ ?) E
<system32\drivers\ac97intc.sys><Intel Corporation>
7 s+ u) `( {' _% K
[Promise driver accelerator / bb-run][Running/Boot Start]. g& G! ]8 t! T+ I* t/ X& N
<\SystemRoot\system32\DRIVERS\bb-run.sys><Promise Technology, Inc.>
: B x4 j, W" u% N/ Z9 _/ z
[Promise Removable Disk Control Driver / dontgo][Running/Boot Start]1 l& T0 V+ U' I5 p: P
<\SystemRoot\system32\DRIVERS\DontGo.sys><Promise Technology, Inc.>
( } G7 t( t$ z4 | }
[KAVBase / KAVBase][Running/Auto Start]
+ y( `5 Z5 P* U( I
<\??\C:\WINDOWS\system32\Drivers\KAVBase.sys><Kingsoft Corporation>$ k9 \! |6 ]/ \& g! o I
[KAVBootC / KAVBootC][Running/Boot Start]" y" H+ V% K% ?0 _) A$ U$ u: x
<\SystemRoot\system32\Drivers\KAVBootC.sys><Kingsoft Corporation>
8 U* ~& P. L' z% ~8 K; \. |
[KAVSafe / KAVSafe][Running/Auto Start]. m! m2 n0 M- P% j
<\??\C:\WINDOWS\system32\Drivers\KAVSafe.sys><Kingsoft Corporation>, D* i3 o# L% X; h2 x' H
[KNetWch / KNetWch][Running/System Start]
% ^1 T* M$ v) {
<\??\C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KNetWch.SYS><Kingsoft Corporation>5 G, L; @6 q r1 R
[KWatch3 / KWatch3][Running/Auto Start]
+ O5 n/ b8 u& J
<\??\C:\WINDOWS\system32\drivers\KWatch3.SYS><Kingsoft Corporation>
% T& [4 I' Z' v' ?6 F
[ntptdb / ntptdb][Stopped/Auto Start]* p) q3 P6 H9 e% ^, w6 b2 ^
<\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys><N/A>
3 m& G( J# e7 d& d5 @
[nv / nv][Running/Manual Start]
7 g4 w# |( Z9 }$ @, d* ]; @
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
8 b" h6 y8 V$ ^: ]; Q6 W T% z
[NVIDIA nForce RAID Driver / nvrd32][Running/Boot Start]- i) C/ P$ |" d$ G
<\SystemRoot\system32\DRIVERS\nvrd32.sys><NVIDIA Corporation>" P0 s. T5 R5 p) E
[DDK PACKET Protocol / Packet][Running/Manual Start]" s) U+ O2 ^* |( ^0 R. K4 R
<system32\DRIVERS\ProtoDrv.sys><360安全中心>
' \/ x# u+ U$ G0 @5 ]1 z
[pnduojtwbt / pnduojtwbt][Stopped/Boot Start]. d' z! w, p& e+ W
<\SystemRoot\system32\drivers\pnduojtwbt.sys><N/A>9 j, p& }% E# Z. F/ l
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]) S6 u' @# \7 D& {" @# b
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>4 w( d. Y8 }- \! F8 k4 a: r7 P
[RsAntiSpyware / RsAntiSpyware][Stopped/Boot Start]
% Z8 V1 U7 K" B2 v3 I/ I
<\SystemRoot\system32\drivers\RsBoot.sys><N/A>& [0 j9 J6 V$ r' m G/ x( }' B
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]( C4 R. u) k, g5 a) g/ Y' I
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
7 x/ ^- }$ M: _! a
[SafeBoxKrnl / SafeBoxKrnl][Running/System Start]
\( @( M) A+ b8 Z+ s* \9 b
<\??\C:\Program Files\360Safebox\SafeBoxKrnl.sys><360安全中心>
; L% b& n# t* e. G' b7 X& ?0 Q
[Secdrv / Secdrv][Stopped/Manual Start]
: z4 o6 u+ s7 U
<system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
) W% Z$ f: m. d, s( n
[SATALink External Device Filter / SiRemFil][Running/Boot Start]
6 v. h5 B% w7 W
<\SystemRoot\system32\DRIVERS\SiRemFil.sys><Silicon Image, Inc.>6 c: q$ q& f |, T
[System Restore Filter Driver / sr][Stopped/Disabled]5 O8 w% _9 i( ?4 Q
<system32\DRIVERS\sr.sys><N/A>
6 g+ a* t; y: S# ]
[TesSafe / TesSafe][Stopped/Manual Start]4 E3 Y# X/ g8 Y( l7 O( j& [0 p2 \
<\??\C:\WINDOWS\system32\TesSafe.sys><TENCENT>' q9 ]7 I+ {6 w% x, v1 k/ V
[System Services / unzxzsrs][Stopped/Boot Start]
! L: u3 F" w! ~; }
<\SystemRoot\system32\drivers\unzxzsrs.sys><N/A>/ D) ~# T& [, U0 o0 X4 a
[ViBus / ViBus][Stopped/Boot Start]5 Y; g( y( E4 a. C4 y' m- A
<\SystemRoot\system32\DRIVERS\ViBus.sys><N/A>
4 E+ B# n6 N# g* n$ E
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]. r- \5 L: m8 Z9 D
<system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>0 A0 N8 x2 J7 G9 b, B9 e; |1 m
[VIA SATA IDE Hot-plug Driver / xfilt][Running/Boot Start]1 c" Y# I, I. } J }% ]: E! Y
<\SystemRoot\system32\DRIVERS\xfilt.sys><VIA Technologies,Inc>* C" |: G; [) A" X
[ATI Extend / zhibmaso][Stopped/Boot Start]
0 c P* f/ u1 T4 V% K6 N2 k
<\SystemRoot\system32\drivers\zhibmaso.sys><N/A>
) e( z4 W# _ X2 \, o
[Vimicro USB PC Camera (ZC0301PL) / ZSMC301b][Running/Manual Start] {3 p; U; D) L n8 K
<System32\Drivers\usbVM31b.sys><Vimicro Corporation>7 j. w4 D" u# S9 w' s" P( c+ D7 K
==================================* `2 r) S! x: j; Q: { R
浏览器加载项
, B8 N* i) s% Z. r. B+ m
[Google Toolbar Helper]
6 {: z# @) d5 _/ T3 C+ M: I8 i
{AA58ED58-01DD-4d91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>1 L$ O+ p' F s6 K+ a" Q
[Google Toolbar Notifier BHO]
* s7 L' ^$ L1 K8 Z
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>
" L1 `* T- ~- J9 R9 m1 b8 |) G6 f
[SafeMon Class]+ u5 P9 d2 N/ G/ @) J) | b
{B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>
6 d7 F1 o5 o6 r- T2 t6 o, w
[kingsoft browser shield]
0 ?6 X: _$ w* O$ Z$ `6 j
{D963BE1A-6B35-47DB-B002-49FAE71D85CC} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL, Kingsoft Corporation>; A+ N' s% G# M
[IEBuddyExtControl Class]
/ k$ d% O/ a7 L' W" x
{3AECD3C1-7085-4731-96DC-47B6CF7EF749} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL, Kingsoft Corporation>6 }1 r" o: O b8 M* l+ ~" g
[Zcom 杂志]* M4 J, p% N4 l% t. P
{4045D313-1D5E-4fe4-93A0-A34630B6A00B} <C:\Zcom\E-Space.exe, N/A>
/ v& o! P! c) x8 P
[&Google]9 G4 u+ ]4 k% K4 @: w3 P
{2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>( g4 L' e! G$ W: s
[KooPlayer Control]; h! v0 U' N* p1 P
{C728DAB8-FDF5-4CD7-89DD-879D25794C77} <C:\WINDOWS\system32\CCTVKO~1.OCX, Koos>
- I$ X7 \: j7 k, D
[Shockwave Flash Object]
; B5 [5 e- Z# T2 X( j
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>
5 q6 n; L3 H; p; z
[KUpdateObj2 Class]
9 J" t/ Z5 I! _* y8 ]) \$ y2 H
{D82303B7-A754-4DCB-8AFC-8CF99435AACE} <C:\WINDOWS\system32\KingSoft\KOS\UpdateOcx2.dll, Kingsoft Corporation>5 Z( I$ i) U' s% h0 a7 h+ L/ u; Y4 d5 Q
[Google Script Object]- {- ?4 ~6 k6 P# e. Q+ P1 A+ Q
{00EF2092-6AC5-47C0-BD25-CF2D5D657FEB} <c:\program files\google\googletoolbar2.dll, Google Inc.>6 ~8 B* ]) I2 t" P- X. C( a
[EWA Control]
9 g8 a+ A) n8 y
{18226BF8-DC0B-4D81-80E9-A41AE37BB73A} <C:\PROGRA~1\PPLive\SYNACA~2.OCX, Synacast>4 H: {" Y! D: b2 ^
[Windows Media Player]$ g0 }' W. u$ V3 Z Q. X
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\msdxm.ocx, Microsoft Corporation>
/ L) e( [: d5 u I( k, ^; I6 E% b
[&Google]; Y$ ?" n5 W' ]
{2318C2B1-4965-11D4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>/ n% f/ D3 G4 @
[HTML Document]
% a L/ M4 J; H
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
- ~. P! C4 l! i3 o/ H
[DHTML Edit Control Safe for Scripting for IE5]
5 O% Z) [" }5 V' G' s4 I, j, ]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
]& E+ y: n7 Z$ @ Q; T
[RealPlayer RAM Download Handler]
0 t- W H0 t* z- r# h g
{2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>6 }2 g* L( _" s* y4 i
[IEBuddyExtControl Class]
1 |4 j2 \# \/ Y2 `) y, g2 v( f
{3AECD3C1-7085-4731-96DC-47B6CF7EF749} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL, Kingsoft Corporation> s6 {) G _0 e3 e0 q
[XML Document]+ ~4 R& { ]5 N& M7 B
{48123BC4-99D9-11D1-A6B3-00C04FD91555} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
+ ^4 S5 V: `& |6 y( L. B: V7 q
[HHCtrl Object]
2 x, Z9 m( I; P% x! @4 l+ [% ^) A
{52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
1 o' j! F- E1 r" \& J+ \$ q& S
[Windows Media Player]' j0 Q0 q$ x1 w7 D3 F* R
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>) ]4 ]/ P, l. u" [" o* Y7 B
[Active Desktop Mover]
8 B4 Y9 z ]& E' T# r) K- Q) h
{72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>* i$ D& D$ E6 _( Q2 S
[360SafeLive]
3 I/ F8 ~% o! o2 f5 M, ^
{87515F61-A66C-4319-A0E0-D416CB8059E3} <C:\Program Files\360safe\live.dll, 360.cn>
4 |) T* e9 U7 z+ G, p
[Microsoft Web 浏览器]
2 l! S4 O( J3 B4 J
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation># u/ L8 h( L8 }5 |2 H: v
[Browser Enhanced Objects]
8 F3 U4 N7 S6 }6 S# U
{986488AF-13D5-9DDF-4FEF-9FB88698CFC1} <C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\USERDATA\webbrowser_2011.dll, N/A>; W2 s) R- a- d4 X x) m
[Google Toolbar Helper]
* _, r6 z5 C7 G r
{AA58ED58-01DD-4D91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>
1 O0 _$ f" q$ ?- l1 d6 s' z
[Microsoft Scriptlet Component]2 a- ~( |6 S5 S& E, o5 q
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
9 y( Z9 Z+ O0 e2 a% c1 X: E9 }
[Google Toolbar Notifier BHO]
: ]& ^# B6 `8 U1 L
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>
0 d6 _+ d% q& f5 W
[SearchAssistantOC]5 d% K+ t8 ]& n, _
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>$ D3 ~8 z2 ~; d: g; v f @
[SafeMon Class]
+ s5 Q4 x. y! t/ G S: g
{B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>0 t# F+ z' [# O+ H$ ^, U- O
[RDS.DataSpace]
3 q0 _+ W6 g0 F7 Q# c
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>! C4 A7 s* d k
[KooPlayer Control]
. P8 z5 \1 X6 c" j
{C728DAB8-FDF5-4CD7-89DD-879D25794C77} <C:\WINDOWS\system32\CCTVKO~1.OCX, Koos>
% P! o# L3 ?3 a; V" y* b# k
[AUDIO__MID Moniker Class]
' X$ w& E! v, `7 q2 p; V1 J
{CD3AFA74-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
' ~+ U9 n- I" G( ^$ M. Y# _
[AUDIO__MP3 Moniker Class]
. N) n! ~ D& C4 X5 D
{CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
1 k) q4 n, B ?5 l6 x. x, U) S
[AUDIO__X_MS_WMA Moniker Class]; q1 t5 A6 h3 Q7 R9 K
{CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
$ }# j$ [# a5 l3 ^+ r
[VIDEO__X_MS_WMV Moniker Class]
8 X! P L" H0 Q5 q3 r
{CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
. P! D# C8 g c3 r" X2 {1 Y
[RealPlayer G2 Control]
; Q- E& T2 g$ |
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
# H( v# B6 {/ Y. c: P) v
[Shockwave Flash Object]
4 q! ^8 q7 f. \8 l3 W
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.># R. Z; Y) t! J
[KUpdateObj2 Class]
: Y1 K; L8 E% p, \* C% _- b1 C* i# F
{D82303B7-A754-4DCB-8AFC-8CF99435AACE} <C:\WINDOWS\system32\KingSoft\KOS\UpdateOcx2.dll, Kingsoft Corporation>0 `! c& Z( \2 ?7 O
[kingsoft browser shield]
* W6 K1 R2 t/ h1 `
{D963BE1A-6B35-47DB-B002-49FAE71D85CC} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL, Kingsoft Corporation>( U3 [1 ]! ]* N& `
[PasswordEditCtrl Class]
) i# w3 [' p( Q# h: J: e
{E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
* J4 m( x4 C; @4 `0 Q4 R
[QvodCtrl Class]
- q( b' ?! s* `9 v9 a9 ]- ~# Q5 {
{F3D0D36F-23F8-4682-A195-74C92B03D4AF} <C:\Program Files\QvodPlayer\QvodInsert.dll, Shenzhen QVOD Technology Co.,Ltd>2 U: s5 E) m! _8 ^
[&使用超级旋风下载]
b1 {5 W3 F; j" y8 f/ X; s
<C:\Program Files\Tencent\QQDownload\geturl.htm, N/A>6 S% z0 ^; `- z' c C. u) {
[&使用超级旋风下载全部链接]* A$ t1 ` J% M2 S! X& e' W
<C:\Program Files\Tencent\QQDownload\getAllurl.htm, N/A>
; O& ^" i3 c5 w* s1 ~
[使用迅雷下载]( G* U8 i, g6 G2 S2 B2 }9 C
<, N/A>7 D6 i8 Q) L" |, `: i' k' S) H
[使用迅雷下载全部链接]
" ? X. @/ s/ O$ X) |" |
<, N/A> S& C9 E F* W( x. K- o; w4 z
[导出到 Microsoft Office Excel(&X)]8 ^4 f* \# d# }8 L; R
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
) X3 [# d+ M' T. A+ P( u4 {4 t
[添加到QQ表情]3 P& G: S! B/ r7 S
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
! y( j" {1 l- E7 y3 r2 y2 g: t
==================================
$ c, y1 G9 s- d, s3 A+ r: ?
正在运行的进程3 I6 P( t2 F' w4 o
[PID: 444 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]% A0 ]! O$ z7 Q r
[PID: 496 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
7 L( F" j5 x1 S1 ^3 y
[PID: 520 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
, {# M; V8 E* h6 l- x
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]# b: i' K; H* `
[PID: 564 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
( I* x* \0 K' M, B: j' O& {( u& _" B
[PID: 576 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]) W3 t. o& A2 Z- ]
[PID: 720 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]' u5 ]- Q' P( ]3 k) m
[PID: 780 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
; ]. J6 ?# E3 F% M+ h3 w
[PID: 856 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
7 ^' x' g% c$ U
[PID: 944 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] s1 {& g& U! Y: k( z- }
[PID: 1012 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
* P- l% y( `- G- y2 B
[PID: 1236 / Administrator][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_qfe.070613-1311)]
4 B3 U( E8 V/ O9 j3 @, n5 C
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]9 @* s% h+ K$ D: M
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]
; o! m9 _5 o' `( W8 P" C2 L
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
2 ?/ v8 [$ c# g9 E, C
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
: _6 }# o8 \- O: z
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVEXT.DLL] [Kingsoft Corporation, 2008,05,07,373]
3 ]6 ~ b3 R( d' v1 f6 \6 W
[C:\Program Files\Tencent\QQ\qdshm.dll] [, 1, 0, 101, 20]
& q2 B2 T( u: W5 u) I- X
[C:\Program Files\Tencent\QQ\MFC42.DLL] [Microsoft Corporation, 6.00.8665.0]# L& c w) [2 D, z7 @) J
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
8 U1 ^. `7 c8 Z0 ^% `
[C:\WINDOWS\system32\shlhook.dll] [Beijing Rising Technology Co., Ltd., 4.0.0.9]
# d5 v# _3 _( T: q8 G! u
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]
: E5 J. N6 `/ ^" e# `7 T L5 i
[C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]
9 A% U' I! s' |$ J" P3 M0 r$ Q
[PID: 1332 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
) C1 Y- v6 `3 h' M3 p) d1 O
[C:\WINDOWS\system32\mdimon.dll] [Microsoft Corporation, 11.3.8166.2]
- { C4 T' Q5 R5 r- @! }
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll] [Microsoft Corporation, 11.3.8166.2]; q3 m# d" V% ~6 n9 k
[PID: 1540 / Administrator][C:\Program Files\360safe\AntiArp\AntiArp.exe] [360安全中心, 2, 0, 0, 1008]: Q. Q7 Y+ x" Y/ v" N3 e& i/ |
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
7 H- v+ ? }5 ?
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]
/ e) b" {; h m: v
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]
2 V$ v" W7 U7 O" b8 ?/ r: x/ U7 B
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]0 z! x2 m/ z$ o3 n. ^8 r1 ^: ?
[PID: 1560 / Administrator][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
. o5 X9 ~4 _# N: W0 R( S8 ]
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]# L/ _, g- t, Y0 w* Z4 s5 @
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]( e4 f0 U% U$ b. o4 l O8 p% h- s( h
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]" k$ w: y+ R, V# o7 I3 e4 x5 W
[PID: 1576 / Administrator][C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe] [Google Inc., 2, 0, 301, 1654]9 J2 N/ K' ~7 _
[C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\gtn.dll] [Google Inc., 2, 0, 301, 7164]- E8 g6 F" Y) y" L
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]
4 E7 O+ P6 l! E( A9 k" l0 Y6 w
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]* _6 I' K& ?7 E- d* H/ C% q9 ~; F; ]
[C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\res_zh-CN.dll] [Google Inc., 2, 0, 301, 7164]$ g, z! E* x+ ?8 u6 {
[C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll] [Google Inc., 2, 0, 301, 7164]
$ ]$ C1 _# t! {* h0 a2 x
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
% Z* J- r6 H% L; W2 Y& @
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]/ j' i$ B4 ^' i' G* V0 Z
[PID: 1648 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
1 h4 A4 y5 [. ]
[PID: 1744 / SYSTEM][C:\Program Files\QvodPlayer\QvodTerminal.exe] [Shenzhen QVOD Technology Co.,Ltd, 2, 5, 0, 53]
7 q# k$ P* `* f3 [* w' b& m
[PID: 1860 / SYSTEM][C:\WINDOWS\system32\skeys.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]3 {+ f; f4 D7 h2 K
[PID: 1908 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
6 k3 J7 h' z. E
[PID: 1964 / LOCAL SERVICE][C:\WINDOWS\system32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]" e( J n5 \% p9 M/ `# n
[PID: 2772 / Administrator][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
3 ^+ ^: U$ E, y- N4 O' W
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]+ \9 R; i) i9 l3 u
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]
6 l/ e5 t) {( T3 H
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]" }0 y1 r& F9 ]/ B" H5 H
[c:\program files\google\googletoolbar2.dll] [Google Inc., 4, 0, 1606, 6690]' u; |' f, [1 m. D7 x A& s0 g0 X5 J! y
[C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll] [Google Inc., 2, 0, 301, 7164]
# s$ D6 f- H8 ]
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL] [Kingsoft Corporation, 2008,04,15,2]0 {3 T- a+ F$ u5 r9 M1 n
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddy.dll] [Kingsoft Corporation, 2008,04,15,2]
7 {# K( l! z- u5 g5 [
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL] [Kingsoft Corporation, 2008,05,14,83]
- ]' m0 w' B3 D j( P& P& W9 f
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KANTray.dll] [Kingsoft Corporation, 2008,04,15,2]% H; o1 G& w. D* [# K) `# i9 c1 `
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVAFish.DLL] [Kingsoft Corporation, 2008,05,13,78]3 x! B% Y% w8 a( {& Y) F% f
[C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]7 ~2 n' @( F/ J4 C8 k% E
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]/ r0 p, R% ?2 ^; B' T" t% b; {
[C:\WINDOWS\system32\WN.IME] [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
6 |0 }2 h4 B; u) E! r/ w* U* `
[C:\Program Files\ShiQiang\wnime\Dll32\wnpy_StatusWnd.dll] [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
- D' X; d; @" j
[C:\Program Files\ShiQiang\wnime\Dll32\wnpy_CompWnd.dll] [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]' L) E+ m/ Y4 Y' g
[C:\Program Files\ShiQiang\wnime\Dll32\wnpy_Query.dll] [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]9 Z- t" c$ x2 c. M
[C:\WINDOWS\system32\SOGOUPY.IME] [Sogou.com Inc., 3.2.0.0]( q, Z* d% Q( M0 R
[C:\Documents and Settings\Administrator\My Documents\SogouInput\Plugin\SgImeWord.dll] [Sogou.com Inc., 3.2.0.0]3 o9 c4 v& m5 z9 p; n& }* Y
[C:\WINDOWS\system32\WINWB98.IME] [Microsoft Corporation, 4.00.950]- W3 {6 i! g% W0 ^+ m0 d
[C:\WINDOWS\system32\WINWB86.IME] [Microsoft Corporation, 4.00.950]2 y u3 z: j* ?8 @# E6 v& t
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]
% Z& G2 o9 s6 v. w
[PID: 1124 / Administrator][C:\Program Files\Tencent\QQ\TXPlatform.exe] [Tencent, 1, 0, 170, 0]6 l8 O' c" G5 O
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]/ i- N5 s& M6 c, R% q
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]" Z" N+ |/ F- _9 k# Z9 n; R& Z
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]
' f: I n/ X; r3 c
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]
! m3 V' P6 P/ M$ n
[PID: 928 / Administrator][F:\arvmon.exe] [任软工作室, 2.2.5.201]
; _( c0 {" e5 R0 S
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
( k9 Q" @& x1 r: ~
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]
' ~" U2 K3 X& H9 l; E
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]
- {' l: B& t. b* B2 U; i% M
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]
" l6 G4 }! `, |: O
[F:\Vdata.dll] [任软工作室, 2, 2, 1, 94]
. n. S% J: G9 Y9 {& l B- c& i
[PID: 2540 / Administrator][F:\AutoGuarder.exe] [任软工作室, 2.2.5.201]
, q7 P& N! b9 d* x v1 v( D
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
# H5 p# ~* T! Z) H* T( o
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]
* p2 ~1 M& c: r* E' E1 y+ t1 ?
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]+ j9 Z, S! A# i0 e
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]
$ |/ m J8 E- d; e. _0 r9 ^
[PID: 2476 / Administrator][d:\我的文档\桌面\系统检测修复\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]. _7 N& P* k$ v
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
) {( i# H" U2 n" b8 q) b8 H! ?
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]8 M ~$ {, f% i3 ^* a
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]
, E% T1 P. v/ c3 Q3 c) V, y
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0], x5 H" s: ]/ M m) V q
[d:\我的文档\桌面\系统检测修复\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]' e) q# s [: a& o( ~4 E% ~
==================================- v' n- f' I. I6 H" h# j
文件关联$ [, U' k. E! Z- H- w
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]9 T$ \% l0 \6 v: I( u! Y9 B
.EXE OK. ["%1" %*]
2 l/ {8 A+ t9 Y/ `3 V0 y
.COM OK. ["%1" %*]6 M& @ Y% Q. j' b# H" N" Y5 S
.PIF OK. ["%1" %*]
! `6 n' t; Z5 Y
.REG OK. [regedit.exe "%1"]
# Z& v7 K2 [+ U% d- d( f
.BAT OK. ["%1" %*]
2 I; K9 b% K" Z0 T1 K
.SCR OK. ["%1" /S]
2 h: A: g# V5 T
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
4 e1 h) {- b# ?6 w
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
) G; I+ ]: x6 s% a! S
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
( X9 q- F8 W3 F8 A
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
6 l' H) E1 l! b
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
0 i0 F* w9 T$ C) m
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
/ v) _7 v8 d0 D# l2 `7 P3 |0 M$ g
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
: q. I8 E/ }; h* s$ h4 r, a
==================================8 @; G& T9 ~; @0 ]: a' z
Winsock 提供者7 ~- o! S' x& \: L/ p9 ]* v, w
N/A
* P2 ^6 q% T& Y3 N! F- @/ |2 {7 G
==================================$ n& P; z* L: A; Q/ z
Autorun.inf% d, ~* P9 U0 l' d. ?2 M! m8 b- B
N/A
8 x6 F! Z: z1 m
==================================
8 z4 L5 V" f9 q* L& |0 o$ k8 P
HOSTS 文件, O' x. S- `6 P1 O. O4 n) z3 n) \
N/A
& Q- z" ~' S& C& K
==================================
`/ C( B& X0 j* H$ `% a
进程特权扫描) l1 v7 B3 b% U
特殊特权被允许： SeLoadDriverPrivilege [PID = 520, C:\WINDOWS\SYSTEM32\WINLOGON.EXE]4 p+ g+ v0 L! R+ w
特殊特权被允许： SeDebugPrivilege [PID = 928, F:\ARVMON.EXE]
! n9 ~7 s. O" o8 p# h- h
特殊特权被允许： SeLoadDriverPrivilege [PID = 928, F:\ARVMON.EXE]" W: X) {6 l$ _6 u7 ]4 V! @
特殊特权被允许： SeDebugPrivilege [PID = 2540, F:\AUTOGUARDER.EXE]
$ q9 l5 N0 J0 l2 E m3 K" ^- r- E
特殊特权被允许： SeLoadDriverPrivilege [PID = 2540, F:\AUTOGUARDER.EXE]5 y H$ C8 Z: F8 l8 }/ d6 G
==================================8 p' G6 g% A. q% q4 ~2 `$ p% p/ _
API HOOK
) V5 R D( J2 H! a# c
N/A
- M) }# |% S0 h; A( ^- g) o
==================================- `; J8 g8 |- G! \( U: O) I
隐藏进程
: v ?" M) G$ [
N/A" b8 E* g( u) q+ M( Y
==================================
/ U1 |# R3 c3 J, \3 {. X" b& a. V7 B- D
, \0 _2 r- V" M4 C3 _ V* \( N3 D

复制代码

傲天♂扬帆 · 发表于 2008-5-22 21:40:31

跟原始说了，不知道能不能看明白。。。

傲天♂元始 · 发表于 2008-5-22 22:23:55

[Start]

2008-05-22,22:24:21

SREngLOG智能分析专家 V1.2.0.125
Tored (http://hi.baidu.com/peaset)

======================================================
以下过程将用到SREng、PowerRmv，如果您不熟悉这两款工具的使用方法，请参考下列链接：
SREng详细操作方法： http://hi.baidu.com/peaset/blog/ ... dd19224e4aeadf.html
PowerRmv详细操作方法： http://hi.baidu.com/peaset/blog/ ... 6fb5eb77c63816.html
======================================================

以下是病毒清除步骤：

1、用PowerRmv删除以下文件(没有则跳过)：

; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
;
; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
C:\WINDOWS\System32\3wareSrv.exe
\SystemRoot\C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll

\SystemRoot\System32\DRIVERS\22jn.sys
\SystemRoot\System32\DRIVERS\43ecu.sys
\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys
\SystemRoot\system32\drivers\pnduojtwbt.sys
\SystemRoot\system32\drivers\RsBoot.sys
system32\DRIVERS\sr.sys
\SystemRoot\system32\drivers\unzxzsrs.sys
\SystemRoot\system32\DRIVERS\ViBus.sys
\SystemRoot\system32\drivers\zhibmaso.sys

2、用SREng删除以下【注册表】项(没有则跳过)：

<IMJPMIG8.1>
<PHIME2002A>
<PHIME2002ASync>

3、用SREng删除【所有启动文件夹】内容(没有则跳过)

4、用SREng删除以下【服务】项(没有则跳过)：

[3ware Controller Service / 3wareSrv]
[NetMeeting Remote Desktop Sharing / mnmsrvc]

5、用SREng删除以下【驱动程序】项(没有则跳过)：

[22j / 22jn]
[43ec / 43ecu]
[ntptdb / ntptdb]
[pnduojtwbt / pnduojtwbt]
[RsAntiSpyware / RsAntiSpyware]
[System Restore Filter Driver / sr]
[System Services / unzxzsrs]
[ViBus / ViBus]
[ATI Extend / zhibmaso]

6、用SREng删除以下【浏览器加载项】项(没有则跳过)：

[Zcom 杂志]
[Browser Enhanced Objects]

最后,重新启动计算机.Tored祝您好运!
======================================================
[End]

傲天♂元始 · 发表于 2008-5-22 22:24:30

你就这样弄，不行我也没办法

傲天♂扬帆 · 发表于 2008-5-23 13:18:44

独恋有按原始说的重新操作一次吗？

独恋伊影 · 发表于 2008-5-24 20:09:59

找不到要删的文件。。。。

傲天♂元始 · 发表于 2008-5-25 08:54:35

有些都是隐藏起来的

傲天♂风云 · 发表于 2008-6-5 03:36:36

我对代码一点都不懂

傲天♂元始 · 发表于 2008-6-5 14:21:26

。。。这不是代码只是系统的扫描日志而已

傲天♂冷漠 · 发表于 2008-6-5 18:19:32

我汗~~~
这么多代码~~~

技术部 收藏本版 今日: 0 主题: 115

在这里

技术部收藏本版今日: 0 主题: 115