在这里

独恋伊影 · 发表于 2008-5-22 20:53:41

8 g0 F& c' a8 w0 `
2008-05-22,20:37:43) Z% |! h6 C2 i* t3 Y
System Repair Engineer 2.5.16.900
8 L: \- i2 z, I* A! o- v( y
Smallfrogs (http://www.KZTechs.com)
+ d7 J3 i- T5 J& j
Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能1 F5 b/ I+ V9 u5 ?! g
以下内容被选中：' c- U: r' ^8 N) H$ H6 B4 k" j6 v
所有的启动项目（包括注册表、启动文件夹、服务等）# u" Q% P2 H4 ?7 T/ B, u$ [
浏览器加载项
3 p" H; P& z z! H8 W
正在运行的进程（包括进程模块信息） q: e; o% N5 y- a$ F! M1 q! I
文件关联
4 Q5 H( u7 t/ G! v
Winsock 提供者1 [: _+ n1 G+ f* {! i, Q8 u) v% d8 x% o
Autorun.inf C: b# ]% n9 n# m. H3 a
HOSTS 文件+ T5 J( Q2 _1 S4 b) \% p5 G
进程特权扫描, g/ h9 Z4 ~/ }$ Z! P; x
1 N. I) ]5 u o2 H# G
启动项目
& J$ `$ g$ m8 Z; L" @3 C1 ]
注册表
6 i7 |. A0 r7 z( j* A
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
0 e! | c5 @; j# n& y
<ctfmon.exe><C:\WINDOWS\system32\CTFMON.EXE> [(Verified)Microsoft Windows Publisher]
8 V7 j( Q* v- ^* E+ @) y
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
& y3 `% B2 ]6 `1 g! d3 F
<360Safebox><"C:\Program Files\360Safebox\safeboxTray.exe" /r> [(Verified)Qizhi Software (beijing) Co. Ltd]( C( E7 @7 v" R0 o1 d+ K
<360Safetray><C:\Program Files\360safe\safemon\360tray.exe /start> [(Verified)Qizhi Software (beijing) Co. Ltd]/ e2 V/ w% a- a+ V$ G0 c+ r
<360Antiarp><C:\Program Files\360safe\AntiArp\AntiArp.exe /start> [(Verified)Qizhi Software (beijing) Co. Ltd]
% G' f O2 P4 @5 W, z. N7 h
<KavStart><"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVStart.exe" -startup> [(Verified)KINGSOFT CORPORATION]0 i3 h5 ~- T. x* d! I, y1 {
<IMJPMIG8.1><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32> [N/A]
; `. @& v9 I( K
<PHIME2002A><; > [N/A]+ `+ z: [$ W3 `2 B, ^
<PHIME2002ASync><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32> [N/A]) n; R; |/ d5 X9 b- y" z* Z
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]5 j! {( h4 C$ t1 q! D x: r
<shell><Explorer.exe> [(Verified)Microsoft Windows Component Publisher]: o/ G) H3 c) V
<Userinit><C:\WINDOWS\system32\UserInit.exe,> [(Verified)Microsoft Windows Publisher]0 w) S- U0 y" X8 U
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]* ]& ]! ]5 [' A+ G& r
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
" ]/ n6 p! ^4 _" Q
<{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}><C:\WINDOWS\system32\shlhook.dll> [Beijing Rising Technology Co., Ltd.]! T# k0 |, A7 W' z& y) w
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]5 l- r# r3 e6 K) q- Q3 z
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A]. L5 h$ t7 _1 t0 e) s' |6 R* D
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
$ [5 e/ s& I2 r: N& |# o2 {
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A]
+ y3 v2 i' K- e0 o* ?9 q' C) V
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]) h% M$ G |$ b) Z/ ^7 C- \
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A]. z9 w5 E8 T" o" s* R" ~# \) ~' `
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
- `, k# p! m$ S O: w
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A]
6 W1 V2 k5 u8 ~0 {0 p3 V
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]5 G: y9 J/ ^7 m6 U
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Remove.PerUser.NT> [(Verified)Microsoft Windows Publisher]+ \; \% Y* H7 M7 z$ L: V$ w
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]* L! L, i3 R7 g6 h7 N3 A
<Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser> [(Verified)Microsoft Windows Publisher]
) _ {/ _5 C0 F' j* B
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
; |( z" d9 D* x' U3 U+ z+ P" c
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub> [(Verified)Microsoft Windows Publisher]
0 j; u/ D) E1 w. |5 m9 o) N# M
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]: E' |* Z; C! F: c) o
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A]" p+ J. l. D a
==================================1 m8 N/ T6 M* h/ q3 p
启动文件夹) W( W3 H$ p) `
N/A$ N: M% \9 Z5 R" @/ S6 O
==================================' S- E! D, h8 I% W
服务0 {7 j' p( r" \
[3ware Controller Service / 3wareSrv][Stopped/Auto Start]- X) |5 e. A# C8 R8 @! d
<C:\WINDOWS\System32\3wareSrv.exe><N/A>
}! F& x7 v7 p8 \! q; ~
[Google Updater Service / gusvc][Stopped/Manual Start], X. B1 }- {5 j' @3 a
<"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"><Google>5 f" f: A( J+ i4 @- W4 ^( c# V
[Help and Support / helpsvc][Stopped/Disabled]5 _5 R2 ~$ [1 X" A
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll><N/A>3 T/ g- C3 ~6 f# r: |' d: y1 s
[Human Interface Device Access / HidServ][Stopped/Boot Start]
$ ]8 {+ F; {2 x" r& q+ j8 L
<\SystemRoot\C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
* ~7 B. P# i% s" u9 [* e" u
[Kingsoft Internet Security Common Service / KISSvc][Stopped/Auto Start]& ]9 M+ U9 F' S5 \
<C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KISSvc.EXE><Kingsoft Corporation>
+ D( g, Y: T5 m1 @' H! T( ^( p
[Kingsoft Personal Firewall Service / KPfwSvc][Running/Auto Start]9 ^* u' c! H W1 Y! s/ w
<"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KPfwSvc.EXE"><Kingsoft Corporation>
$ I" j* c& O# C6 `
[Kingsoft Antivirus KWatch Service / KWatchSvc][Running/Auto Start]
" X7 e3 c7 a" a/ u5 y4 m; M% H
<"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KWatch.EXE"><Kingsoft Corporation># q+ f# i! e* V6 S E7 Y
[NetMeeting Remote Desktop Sharing / mnmsrvc][Stopped/Manual Start]1 W* U% m# d6 I6 ~! Q9 d& x
<><N/A># b' i* z* a- O7 c; U3 `" j
[Qvod Terminal / Qvod Terminal][Running/Auto Start]3 V" r' Z: P* N# }
<C:\Program Files\QvodPlayer\QvodTerminal.exe><Shenzhen QVOD Technology Co.,Ltd>
/ q. h( W5 A/ y9 I% \ ?
==================================
) |: z/ V4 X4 n/ |4 l* ~' i
驱动程序
+ I5 ^' \6 k0 V. l
[22j / 22jn][Stopped/Boot Start]/ w" w" _- o) m
<\SystemRoot\System32\DRIVERS\22jn.sys><N/A>
) U, g/ ?/ P: k6 o* h
[360AntiArp / 360AntiArp][Running/System Start]8 x) w9 ?1 Z. E& k4 y$ N* D* M
<\??\C:\WINDOWS\system32\drivers\360AntiArp.sys><360安全中心>
4 Y' ] r1 A/ ^( Q9 R/ j0 n
[43ec / 43ecu][Stopped/Boot Start]8 |4 J/ {' Z1 d( k7 O! w, m7 t6 j
<\SystemRoot\System32\DRIVERS\43ecu.sys><N/A>
6 `1 O# ~6 H/ u. b d5 m' Y6 I
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Running/Manual Start]
% x& n! N2 _/ u5 |6 v3 _
<system32\drivers\ac97intc.sys><Intel Corporation>) K1 c; M6 _6 F( C8 L& e
[Promise driver accelerator / bb-run][Running/Boot Start]. r* T7 S, e2 r+ ]5 [2 l
<\SystemRoot\system32\DRIVERS\bb-run.sys><Promise Technology, Inc.>
% Q M, G: e; h& m% E1 S9 @/ o
[Promise Removable Disk Control Driver / dontgo][Running/Boot Start]
: x+ }# i. ~& x/ C1 M
<\SystemRoot\system32\DRIVERS\DontGo.sys><Promise Technology, Inc.>
3 T* ^% a) h! I4 d) i( P
[KAVBase / KAVBase][Running/Auto Start]( B2 U! t5 q9 D# o" f- F. ^0 I
<\??\C:\WINDOWS\system32\Drivers\KAVBase.sys><Kingsoft Corporation>
2 X; L0 f# X! i2 `0 K w( u
[KAVBootC / KAVBootC][Running/Boot Start]6 u. B. }9 q( j' s3 j& H
<\SystemRoot\system32\Drivers\KAVBootC.sys><Kingsoft Corporation>
* k1 t; C# q& T$ g+ R, ~+ A4 }
[KAVSafe / KAVSafe][Running/Auto Start]
+ b1 h( M& \( @6 ]% O
<\??\C:\WINDOWS\system32\Drivers\KAVSafe.sys><Kingsoft Corporation>
$ T' G6 K: x+ W6 t L
[KNetWch / KNetWch][Running/System Start]
) v6 H' _4 R4 u9 H7 G0 P* s
<\??\C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KNetWch.SYS><Kingsoft Corporation>* i# w; }# ]2 K0 h% D" n
[KWatch3 / KWatch3][Running/Auto Start]
) D: Q& R5 ]$ B* r- [; T z: V: o
<\??\C:\WINDOWS\system32\drivers\KWatch3.SYS><Kingsoft Corporation>
- L5 F8 Z3 x4 j- X4 E& d
[ntptdb / ntptdb][Stopped/Auto Start]
6 a N/ ^ j) @0 H' S
<\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys><N/A>
8 _0 E8 u3 A$ f6 u+ v* H/ d$ P6 E0 J
[nv / nv][Running/Manual Start]
6 q' ^6 Y' Y, m$ F1 f9 ~; H, {
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>) I1 v* E: u+ J; N
[NVIDIA nForce RAID Driver / nvrd32][Running/Boot Start]( {! E+ }- a% {9 g: s
<\SystemRoot\system32\DRIVERS\nvrd32.sys><NVIDIA Corporation>% o" _+ z V7 c
[DDK PACKET Protocol / Packet][Running/Manual Start], ?' U5 C0 K$ u1 X
<system32\DRIVERS\ProtoDrv.sys><360安全中心>
" \; N; z+ ^2 f
[pnduojtwbt / pnduojtwbt][Stopped/Boot Start]! ]6 D! a, ^$ F( I2 d# s
<\SystemRoot\system32\drivers\pnduojtwbt.sys><N/A>
6 g4 Z: x/ \1 U2 @! a' C5 n! G4 Y
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]( p a. E5 V8 M4 B. ?
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
$ I# k. T, r& w% Q3 ~8 I" {
[RsAntiSpyware / RsAntiSpyware][Stopped/Boot Start]9 i9 e9 A1 ] f2 k/ ] K: B
<\SystemRoot\system32\drivers\RsBoot.sys><N/A>' m' |% i# I- l$ P3 c
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
* f3 m) E1 M8 Q: |$ K
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>9 c# ]+ }) L1 L) e# w5 M/ q: ?
[SafeBoxKrnl / SafeBoxKrnl][Running/System Start]
" U/ d( N7 ~% ?: `
<\??\C:\Program Files\360Safebox\SafeBoxKrnl.sys><360安全中心>
# _- M/ B8 ^% O$ ^/ P
[Secdrv / Secdrv][Stopped/Manual Start]5 D! G6 t$ m. |( B! ~/ I
<system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
+ l: C" W* X1 k) _
[SATALink External Device Filter / SiRemFil][Running/Boot Start]: H1 P% f4 C9 f4 G3 q# h
<\SystemRoot\system32\DRIVERS\SiRemFil.sys><Silicon Image, Inc.>' B$ E' N( |; Q+ L; }& \
[System Restore Filter Driver / sr][Stopped/Disabled]
& F6 \! B% H1 m A8 a8 N
<system32\DRIVERS\sr.sys><N/A>! w" }9 q) N& x2 `/ }7 L7 L
[TesSafe / TesSafe][Stopped/Manual Start]. [% w5 t( Z. K$ i; ~4 S8 F. c
<\??\C:\WINDOWS\system32\TesSafe.sys><TENCENT>
4 f! u5 e: V, z2 Z0 {# I
[System Services / unzxzsrs][Stopped/Boot Start]$ z- d s& k$ I+ B& N- V# j/ l( ~, }
<\SystemRoot\system32\drivers\unzxzsrs.sys><N/A>
% E8 v# r" ~' p+ c, f4 x
[ViBus / ViBus][Stopped/Boot Start]2 K: R' Y8 _* V9 i# Q2 g
<\SystemRoot\system32\DRIVERS\ViBus.sys><N/A>
, [6 Z) t: j2 F8 v9 J
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]/ ^ \% |8 |7 M5 X& J1 `. \
<system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>5 v2 V. n+ m" }- T7 p7 h
[VIA SATA IDE Hot-plug Driver / xfilt][Running/Boot Start]7 `+ i8 p2 O" H$ i. a. t+ W/ c
<\SystemRoot\system32\DRIVERS\xfilt.sys><VIA Technologies,Inc>
* u4 |- M! E$ v2 W9 g
[ATI Extend / zhibmaso][Stopped/Boot Start]' P' Q" G, ~) J5 O: B
<\SystemRoot\system32\drivers\zhibmaso.sys><N/A>
9 U/ I* ]- q$ [7 n8 w6 a
[Vimicro USB PC Camera (ZC0301PL) / ZSMC301b][Running/Manual Start]7 T$ ?5 B; ?6 m# [
<System32\Drivers\usbVM31b.sys><Vimicro Corporation>
; M% ?; T% o; s# s
==================================
( G2 M: I4 z; I' K6 u3 u
浏览器加载项( n- n% I: n3 x; {
[Google Toolbar Helper]
7 k7 ^6 ]- C+ G
{AA58ED58-01DD-4d91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>
. H j" H# }1 F# F8 O4 d
[Google Toolbar Notifier BHO]4 \' d* M( n1 q8 f( Y, a
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>' k3 o$ m$ R% p7 |
[SafeMon Class]
1 b, i8 D. S, S+ m/ ?2 x9 v% A+ O2 l2 x
{B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>
+ ?7 \8 p, ]+ U6 I8 g. \
[kingsoft browser shield]% d+ p" I, _9 a3 h: O9 H7 I9 u
{D963BE1A-6B35-47DB-B002-49FAE71D85CC} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL, Kingsoft Corporation>
1 r- t8 j! C' ?$ g N+ q4 I3 B: o
[IEBuddyExtControl Class]: Q! P2 B, F: X
{3AECD3C1-7085-4731-96DC-47B6CF7EF749} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL, Kingsoft Corporation>
( n% I' Y. P" N% t
[Zcom 杂志]
, s9 |' m: W+ R
{4045D313-1D5E-4fe4-93A0-A34630B6A00B} <C:\Zcom\E-Space.exe, N/A>
2 F- ]1 Y7 ^( {% X
[&Google]2 f3 i- q! X/ @; Q0 v: t- o8 e6 D
{2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>( F/ c3 o1 R: G0 ` U
[KooPlayer Control]% n: j$ P. L p$ I8 g
{C728DAB8-FDF5-4CD7-89DD-879D25794C77} <C:\WINDOWS\system32\CCTVKO~1.OCX, Koos>
8 \1 e2 V$ x4 A* n6 A
[Shockwave Flash Object]8 E6 M, H3 G' x- v5 c
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>7 Q; n0 e3 \3 P; Q- S: X4 q( \* ?
[KUpdateObj2 Class]1 ~- {# P+ o+ `4 j) S" @1 M0 i; ]
{D82303B7-A754-4DCB-8AFC-8CF99435AACE} <C:\WINDOWS\system32\KingSoft\KOS\UpdateOcx2.dll, Kingsoft Corporation>- G3 i2 |- b( h) s
[Google Script Object]
9 _( t2 I1 F9 w& w+ w
{00EF2092-6AC5-47C0-BD25-CF2D5D657FEB} <c:\program files\google\googletoolbar2.dll, Google Inc.>
! d0 c& l# q( w6 I2 F* r6 }
[EWA Control]9 l, C1 j H: S% G) ]! h% U: Q
{18226BF8-DC0B-4D81-80E9-A41AE37BB73A} <C:\PROGRA~1\PPLive\SYNACA~2.OCX, Synacast>, f3 M, |: G% D* J
[Windows Media Player]! [6 h% {% G5 Z# t a
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\msdxm.ocx, Microsoft Corporation>
# \: W/ s7 `2 ~! Y4 d! D
[&Google]
# g: f2 O, F0 P
{2318C2B1-4965-11D4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>" a7 f& Z! M' M% O" N1 G) s
[HTML Document]) c+ c9 o9 _( `, H b
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>+ X" x6 Z8 m S0 j( q, t
[DHTML Edit Control Safe for Scripting for IE5]# U1 u6 G" v' h7 F9 h' Y
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
- J. k p! A! d% B6 r9 f
[RealPlayer RAM Download Handler]
( d3 G: B3 U& }4 c: G
{2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>" h0 B: Y7 |8 ~+ J
[IEBuddyExtControl Class]
~4 e, r5 |2 N2 r. W
{3AECD3C1-7085-4731-96DC-47B6CF7EF749} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL, Kingsoft Corporation>7 ~) t( b+ V. Q5 V8 H5 J4 i
[XML Document]
& H; {2 ~# H. j3 U: a1 q/ ?1 N
{48123BC4-99D9-11D1-A6B3-00C04FD91555} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>/ i% M* }3 k3 o; ]2 M! ^$ G" K
[HHCtrl Object]7 ?+ a& Q, Y4 L" T2 V8 W
{52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
6 Q0 @" c0 O2 n, o
[Windows Media Player]
$ T- e) k1 P/ T% R
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>: M! V" h+ Q& H9 t2 [; h! H* \1 e6 `
[Active Desktop Mover]4 {4 X R7 c0 J7 V" f
{72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>- V5 I: o1 P& y
[360SafeLive]% ~5 U3 v9 Y- v3 c% P: b' ^9 v* S
{87515F61-A66C-4319-A0E0-D416CB8059E3} <C:\Program Files\360safe\live.dll, 360.cn>
. S/ J) q/ O1 r
[Microsoft Web 浏览器]8 }, V. k2 ^/ Z: E3 q* D
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
% D1 n" o& d) h5 h1 ~8 }
[Browser Enhanced Objects]% P3 e7 K' T! W# v
{986488AF-13D5-9DDF-4FEF-9FB88698CFC1} <C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\USERDATA\webbrowser_2011.dll, N/A>
+ c4 k+ c. {2 P
[Google Toolbar Helper]
( s+ [1 Z y1 l1 d) I
{AA58ED58-01DD-4D91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>
; q7 g5 G: O' B1 g
[Microsoft Scriptlet Component]
9 m( L- A4 X$ P' g
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
8 m/ |3 k* Z6 y7 T; Z
[Google Toolbar Notifier BHO]" R& p8 m9 k9 w0 Q
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>
: I# ]9 v: M; c1 T- H6 ]
[SearchAssistantOC]
0 b& q9 U- |/ V( m w
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>( G4 W& J5 |; R! Y: I1 w, W# @
[SafeMon Class]# j3 ^/ F* I, E
{B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>3 ]+ Y- A5 k1 _0 y
[RDS.DataSpace]
% r, v9 D: b/ r- y0 r
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>$ e* B$ I' [7 W* Y3 f& l$ z$ t$ e
[KooPlayer Control]# g$ C r) O% {7 }2 `1 b. j
{C728DAB8-FDF5-4CD7-89DD-879D25794C77} <C:\WINDOWS\system32\CCTVKO~1.OCX, Koos>
* B! D: R8 H( Y, A- C, x
[AUDIO__MID Moniker Class]8 G* B0 y. w0 C6 ]6 F
{CD3AFA74-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>$ ~# N& B5 E( o
[AUDIO__MP3 Moniker Class]
P/ o" T( n1 E4 m7 {' m3 ?+ q; V
{CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
2 G' r8 Q# l8 Y! L1 K& [, h I
[AUDIO__X_MS_WMA Moniker Class]
& k3 F/ G L% o" T z2 \1 a
{CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation># {0 f2 u3 u/ f( S* W
[VIDEO__X_MS_WMV Moniker Class]
6 {* X" z6 F' _" Z: l
{CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
5 F b; w" J' m4 }' P; k
[RealPlayer G2 Control]
5 X2 w- |# J5 `5 i0 J( |! L
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
3 E; Y; U, o# F. C# j
[Shockwave Flash Object]
/ z* C% ]1 ^) Q3 X
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>
, I2 V0 V1 H" D( c: E a
[KUpdateObj2 Class]' |( ~0 J# t& Y) w
{D82303B7-A754-4DCB-8AFC-8CF99435AACE} <C:\WINDOWS\system32\KingSoft\KOS\UpdateOcx2.dll, Kingsoft Corporation> V7 G2 Y, X L
[kingsoft browser shield]
9 j! r$ b; e! h+ }* C, d4 q
{D963BE1A-6B35-47DB-B002-49FAE71D85CC} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL, Kingsoft Corporation>2 n# f# R8 `+ C/ R7 @
[PasswordEditCtrl Class]7 i' C9 {$ _. _/ i5 Q
{E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
& n5 J) B8 ~& q& Y& Z# i
[QvodCtrl Class] ]$ w- `& O: @8 |3 S) f
{F3D0D36F-23F8-4682-A195-74C92B03D4AF} <C:\Program Files\QvodPlayer\QvodInsert.dll, Shenzhen QVOD Technology Co.,Ltd>
4 `1 g& @% P9 S% s$ d5 v+ v
[&使用超级旋风下载]
! N; |0 f/ F. I( m
<C:\Program Files\Tencent\QQDownload\geturl.htm, N/A>
3 X" H. h7 l2 v
[&使用超级旋风下载全部链接]5 H9 p7 p( b7 Y3 n9 S! r( R' d
<C:\Program Files\Tencent\QQDownload\getAllurl.htm, N/A>
[使用迅雷下载]/ P% e0 S: k7 B8 K) a5 L
<, N/A>
6 z9 m& |3 G, x7 ]
[使用迅雷下载全部链接]
- j- P! P8 T7 l( D
<, N/A>: l6 E! |* _% k# }6 x
[导出到 Microsoft Office Excel(&X)]
( T* I1 a H$ c8 d* v! ?; V, R7 u% I
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>0 n8 X8 j$ i: N$ d) r( S
[添加到QQ表情]- b! m7 c6 V6 x0 f
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>- \/ i" Q; t' V) d, N) Q) Q
==================================- b6 e$ _% A- F2 r, b/ z0 T
正在运行的进程
! w3 d% u! \( x* R( C8 ^
[PID: 444 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
2 Y/ K/ S( D7 w- d0 b9 x# i0 C
[PID: 496 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
3 i! o3 B7 K% Z+ r
[PID: 520 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
s6 p; l1 ]" l9 \" j
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
3 l1 R* [9 c4 o. ~: V- \
[PID: 564 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]! P F, p9 o# F, P( x! t* M
[PID: 576 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
$ O. l$ X& y/ Q9 P
[PID: 720 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]( s' N- O6 N1 i; _& s! V* y
[PID: 780 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)], m& x0 _1 X% A; B5 h' t3 d
[PID: 856 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
- K9 r( a3 p) Z9 S5 V& y
[PID: 944 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]; {5 x' P3 q- c
[PID: 1012 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]. I/ i3 n. e% G# k
[PID: 1236 / Administrator][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_qfe.070613-1311)]3 d8 f3 N; m2 _. Y7 \
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]
( H6 t/ {! t* Y1 _
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]
- M; b* G7 T) f* J& ^2 k# K' W
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]& L5 C1 O. Y4 F
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]9 r7 \ e6 W3 p1 H5 b7 Y
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVEXT.DLL] [Kingsoft Corporation, 2008,05,07,373]
z( w8 g" C% [
[C:\Program Files\Tencent\QQ\qdshm.dll] [, 1, 0, 101, 20]2 ]. k& p0 U$ o6 n1 p& x
[C:\Program Files\Tencent\QQ\MFC42.DLL] [Microsoft Corporation, 6.00.8665.0]
2 `, D; A! v$ J$ L7 W4 h. Q
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
0 m1 H" J" e2 K
[C:\WINDOWS\system32\shlhook.dll] [Beijing Rising Technology Co., Ltd., 4.0.0.9]
3 J; P; `1 u" n, \# u9 \
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]4 s0 C4 a( h( B) ^% P0 L' `7 N+ h
[C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]
3 X2 H+ H9 B+ _$ l
[PID: 1332 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]: Q5 Q9 y* U8 Z8 I0 H
[C:\WINDOWS\system32\mdimon.dll] [Microsoft Corporation, 11.3.8166.2]
* _/ w4 a% q8 m$ k7 @3 P# H9 `4 D
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll] [Microsoft Corporation, 11.3.8166.2]* U H: C+ X9 T) J* k5 }" Y
[PID: 1540 / Administrator][C:\Program Files\360safe\AntiArp\AntiArp.exe] [360安全中心, 2, 0, 0, 1008]; d( j' O" R! Q1 c6 S- X! A
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]6 u* x# A$ ^9 H% W8 F
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]
6 X# z8 j. ?2 Q, J" d
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]
6 O5 k. B Y% X3 c: i( @5 \0 D
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]" H4 ^* f+ y# L N3 G$ A
[PID: 1560 / Administrator][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
4 Q% M, }& G, E$ R! M
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]
- `0 B& G, l9 u+ h/ {* @. ?# N
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]
2 w& w ?9 E. r* K" y& U$ E1 T
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]+ a7 v) I. Q/ Q" D
[PID: 1576 / Administrator][C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe] [Google Inc., 2, 0, 301, 1654]
5 w5 l) m0 E9 H( D+ H0 X
[C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\gtn.dll] [Google Inc., 2, 0, 301, 7164]# D+ c: f. l; ^6 C# c
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]
T8 N$ L, r. B8 _
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]5 O4 k* d6 a# q9 b8 C
[C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\res_zh-CN.dll] [Google Inc., 2, 0, 301, 7164]% `- p- g+ G5 {0 U. Y8 [% [
[C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll] [Google Inc., 2, 0, 301, 7164]
1 t0 t i- @0 e' c! z. ~) V
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
% Q5 D5 @, }: v* ]. r
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]
! M9 w/ r7 m" M+ ?) p8 U
[PID: 1648 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]" X$ l. i( L6 g. g) R( a
[PID: 1744 / SYSTEM][C:\Program Files\QvodPlayer\QvodTerminal.exe] [Shenzhen QVOD Technology Co.,Ltd, 2, 5, 0, 53]6 K4 g y& P% F2 n4 e# S
[PID: 1860 / SYSTEM][C:\WINDOWS\system32\skeys.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]. B W6 s! ~1 N0 q/ V" C, N# ]
[PID: 1908 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
5 n: ^& ?" k3 x9 o3 v
[PID: 1964 / LOCAL SERVICE][C:\WINDOWS\system32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
r }7 \4 ?3 n0 U8 R
[PID: 2772 / Administrator][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]$ J- }" z' a @7 Z% D- |
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
/ T. h' Y) a% L" S0 g
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]# z+ c5 W4 `, D4 D6 ^9 i9 \
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]
8 h$ H p; Y) h3 x
[c:\program files\google\googletoolbar2.dll] [Google Inc., 4, 0, 1606, 6690]
- D$ c4 i- v" e/ A, T& |! i. p
[C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll] [Google Inc., 2, 0, 301, 7164]$ w$ H. R5 f+ C- t$ n
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL] [Kingsoft Corporation, 2008,04,15,2]8 D+ i# C- v: W
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddy.dll] [Kingsoft Corporation, 2008,04,15,2]
( ]* r% E! G0 `
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL] [Kingsoft Corporation, 2008,05,14,83]4 F/ n7 w, q4 b9 J' ^; d" M
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KANTray.dll] [Kingsoft Corporation, 2008,04,15,2]
2 L8 i# u. l* v. c) {" F5 {
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVAFish.DLL] [Kingsoft Corporation, 2008,05,13,78]
1 G U1 @7 H; M c5 m: a- k. j
[C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]- z; ^1 L8 D0 k- |( q
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
7 Y6 x$ ^) n" ]! I9 y
[C:\WINDOWS\system32\WN.IME] [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
% K* v& z7 I% N
[C:\Program Files\ShiQiang\wnime\Dll32\wnpy_StatusWnd.dll] [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
& i2 T6 ~6 d9 ?) n$ F- b
[C:\Program Files\ShiQiang\wnime\Dll32\wnpy_CompWnd.dll] [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]! s. [4 ]8 _# n* w7 I( c! a
[C:\Program Files\ShiQiang\wnime\Dll32\wnpy_Query.dll] [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
: F4 N- B5 G4 e! J
[C:\WINDOWS\system32\SOGOUPY.IME] [Sogou.com Inc., 3.2.0.0]* Q% @8 Z3 c0 @. p$ V3 A
[C:\Documents and Settings\Administrator\My Documents\SogouInput\Plugin\SgImeWord.dll] [Sogou.com Inc., 3.2.0.0]
8 w! o( G" P8 S& K" S3 d, i
[C:\WINDOWS\system32\WINWB98.IME] [Microsoft Corporation, 4.00.950]
$ j! `2 x: J2 ?: B* y
[C:\WINDOWS\system32\WINWB86.IME] [Microsoft Corporation, 4.00.950]$ @3 s* F" T0 v: v9 H
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]
2 F; X7 m; H6 s; K, E7 W
[PID: 1124 / Administrator][C:\Program Files\Tencent\QQ\TXPlatform.exe] [Tencent, 1, 0, 170, 0]/ y3 Y/ q0 i1 M D0 K, a' P/ F
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
! g- e4 \! H. h
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]
1 o3 {5 ^+ [. H, b( m
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]
* a R( h# [. a. U. ^4 K c2 S
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]1 k- s$ S0 x* L7 V# B1 L% ]
[PID: 928 / Administrator][F:\arvmon.exe] [任软工作室, 2.2.5.201]3 e u4 _2 k k! p
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]7 _0 y7 r- E0 @
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]
# w% g( U; ^& i T/ r6 S: \4 p' T! C
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]
, d t" z+ p' B. y
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]
f1 B- y$ q- \+ C4 \, Y7 W7 b! x
[F:\Vdata.dll] [任软工作室, 2, 2, 1, 94]5 ?0 S: Q' J4 P$ y& d+ m
[PID: 2540 / Administrator][F:\AutoGuarder.exe] [任软工作室, 2.2.5.201]
$ o' K; _; V* F6 I6 B
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
2 {- x7 v4 o( g6 |2 p0 \
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5], M. u; k+ o, [# d1 b
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]8 C; V4 n4 x' s; m
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]5 t5 G* J6 W: M+ u: x4 a
[PID: 2476 / Administrator][d:\我的文档\桌面\系统检测修复\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]( H' X3 Z4 O2 E" i5 y2 s& P+ L
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]% e: `; L7 j# @
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]6 x( u0 b" ]* r) {+ |
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]
5 ?, Y( y, k( l. B( f8 D* h
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]/ x3 X6 U+ S6 W2 k+ D
[d:\我的文档\桌面\系统检测修复\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]6 O( ?8 a- O/ G+ Z" t/ T" g1 Z
==================================
; E! C1 N0 ?0 g7 Z$ a2 S" D
文件关联! o, H' m" V/ B$ E
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]- p5 g3 `2 [% ?# C1 b1 R$ a8 U: ?3 A
.EXE OK. ["%1" %*]
/ d0 j2 g1 S- z
.COM OK. ["%1" %*]
# B0 g3 ?. R: T/ h8 Q0 i% `2 o7 _
.PIF OK. ["%1" %*]
: G5 ^ x9 F+ o, k
.REG OK. [regedit.exe "%1"]# O4 m: h+ }2 {5 G* R3 X m
.BAT OK. ["%1" %*]
) D: U1 Z8 e/ G
.SCR OK. ["%1" /S]
/ V( P* t0 u7 @+ ]6 k+ b/ l2 O. u9 H
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
, t$ |, F8 f) Q! g" J
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]8 O+ h* J7 K) I! P/ Z$ T; a' q
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]! [" ~, h# }4 D$ i1 u
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]8 X+ M4 l1 f2 w% n0 s
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
6 n: k# h8 M0 K3 H
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
, Y: |% g* K+ O: i
.LNK OK. [{00021401-0000-0000-C000-000000000046}]+ f& `! C$ W) k/ } g& w) |1 ?) t
==================================- P t3 j" m6 \7 p- V2 A7 s- K
Winsock 提供者% a7 u5 I# }/ N( Z- P( q; |/ _' U7 [* Q
N/A
% B2 [: u" ^0 v- {
==================================
! E- o$ P0 Y1 {' s* r0 N
Autorun.inf! o2 J* O6 j1 _# F7 ^4 g* {! [) h. A1 \
N/A
* L. N1 i+ q) P$ I+ I
==================================
; x- E* V0 q1 Z$ L
HOSTS 文件3 \8 P* E* I$ B( |. T8 [ m: K
N/A
) R7 [% s$ Z" h8 p7 m- T7 D+ g
==================================
! z6 M% V. E; _/ h
进程特权扫描* M( Q- y! e! d9 z
特殊特权被允许： SeLoadDriverPrivilege [PID = 520, C:\WINDOWS\SYSTEM32\WINLOGON.EXE]
* N# L+ R% d5 ?- u, ?) m" B0 L
特殊特权被允许： SeDebugPrivilege [PID = 928, F:\ARVMON.EXE]) V9 x' V, U' g% u2 A9 J2 k3 v
特殊特权被允许： SeLoadDriverPrivilege [PID = 928, F:\ARVMON.EXE]
! ]1 n# S) N. j0 ~- I2 |
特殊特权被允许： SeDebugPrivilege [PID = 2540, F:\AUTOGUARDER.EXE]- a$ @- Y/ D) ? L0 Y T( h
特殊特权被允许： SeLoadDriverPrivilege [PID = 2540, F:\AUTOGUARDER.EXE]$ s( A$ L q5 Y! u2 |
==================================" o1 W) i8 M; m- g, V6 p1 {! o
API HOOK, A1 e2 w: O) y5 z. {+ b
N/A
: Z2 Z& C# L0 v6 @+ E! P4 T8 n4 e$ w+ Y
==================================) F+ E9 U' e; d& d! m
隐藏进程2 F4 s. t1 I6 s% ` [
N/A) @, }1 T9 n" |2 Y* a
==================================# N: T" h) |" H" w1 T+ Z6 N! W
# V' e& t1 j. v* S* w) Q

复制代码

傲天♂扬帆 · 发表于 2008-5-22 21:40:31

跟原始说了，不知道能不能看明白。。。

傲天♂元始 · 发表于 2008-5-22 22:23:55

[Start]

2008-05-22,22:24:21

SREngLOG智能分析专家 V1.2.0.125
Tored (http://hi.baidu.com/peaset)

======================================================
以下过程将用到SREng、PowerRmv，如果您不熟悉这两款工具的使用方法，请参考下列链接：
SREng详细操作方法： http://hi.baidu.com/peaset/blog/ ... dd19224e4aeadf.html
PowerRmv详细操作方法： http://hi.baidu.com/peaset/blog/ ... 6fb5eb77c63816.html
======================================================

以下是病毒清除步骤：

1、用PowerRmv删除以下文件(没有则跳过)：

; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
;
; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
C:\WINDOWS\System32\3wareSrv.exe
\SystemRoot\C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll

\SystemRoot\System32\DRIVERS\22jn.sys
\SystemRoot\System32\DRIVERS\43ecu.sys
\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys
\SystemRoot\system32\drivers\pnduojtwbt.sys
\SystemRoot\system32\drivers\RsBoot.sys
system32\DRIVERS\sr.sys
\SystemRoot\system32\drivers\unzxzsrs.sys
\SystemRoot\system32\DRIVERS\ViBus.sys
\SystemRoot\system32\drivers\zhibmaso.sys

2、用SREng删除以下【注册表】项(没有则跳过)：

<IMJPMIG8.1>
<PHIME2002A>
<PHIME2002ASync>

3、用SREng删除【所有启动文件夹】内容(没有则跳过)

4、用SREng删除以下【服务】项(没有则跳过)：

[3ware Controller Service / 3wareSrv]
[NetMeeting Remote Desktop Sharing / mnmsrvc]

5、用SREng删除以下【驱动程序】项(没有则跳过)：

[22j / 22jn]
[43ec / 43ecu]
[ntptdb / ntptdb]
[pnduojtwbt / pnduojtwbt]
[RsAntiSpyware / RsAntiSpyware]
[System Restore Filter Driver / sr]
[System Services / unzxzsrs]
[ViBus / ViBus]
[ATI Extend / zhibmaso]

6、用SREng删除以下【浏览器加载项】项(没有则跳过)：

[Zcom 杂志]
[Browser Enhanced Objects]

最后,重新启动计算机.Tored祝您好运!
======================================================
[End]

傲天♂元始 · 发表于 2008-5-22 22:24:30

你就这样弄，不行我也没办法

傲天♂扬帆 · 发表于 2008-5-23 13:18:44

独恋有按原始说的重新操作一次吗？

独恋伊影 · 发表于 2008-5-24 20:09:59

找不到要删的文件。。。。

傲天♂元始 · 发表于 2008-5-25 08:54:35

有些都是隐藏起来的

傲天♂风云 · 发表于 2008-6-5 03:36:36

我对代码一点都不懂

傲天♂元始 · 发表于 2008-6-5 14:21:26

。。。这不是代码只是系统的扫描日志而已

傲天♂冷漠 · 发表于 2008-6-5 18:19:32

我汗~~~
这么多代码~~~

技术部 收藏本版 今日: 0 主题: 115

在这里

技术部收藏本版今日: 0 主题: 115