在这里

独恋伊影 · 发表于 2008-5-22 20:53:41

" n ?, p4 @" H T* h" P- f
2008-05-22,20:37:43
* j) N0 r3 C! n3 b1 R w/ ~; g
System Repair Engineer 2.5.16.9002 w8 Z' _. x0 f9 i
Smallfrogs (http://www.KZTechs.com)! B' p( h, Y5 S: `* K, D
Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
# J! _0 ^# C, X) p" q
以下内容被选中：/ T0 [2 z; Q: f$ r- V4 D# P; H% G1 r
所有的启动项目（包括注册表、启动文件夹、服务等）
6 a! b4 u: p- ]9 j
浏览器加载项
% K3 X* [$ z2 w# d
正在运行的进程（包括进程模块信息）0 `# O' O% ]$ O* `
文件关联
2 ~1 ?' r& B _8 Q% |
Winsock 提供者5 y) U! l, a8 }) b
Autorun.inf
2 ]1 `4 t- T( ]: y6 M% |
HOSTS 文件
6 ?6 O& o4 W- ]; e" c
进程特权扫描! r5 v$ ]8 h- F- a0 L0 K( g
?" b$ b, l) o1 ]3 X( |0 ?$ N/ {( _. A
启动项目
1 |% L: G9 Q) V" T8 ^8 V
注册表3 N# j ^6 y& e( y; I2 q: C( U9 X
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
/ X% N$ Q* j" L$ u3 ~! x6 z
<ctfmon.exe><C:\WINDOWS\system32\CTFMON.EXE> [(Verified)Microsoft Windows Publisher]
: _7 i/ x5 T: s: x7 n
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]' f8 n9 x: ]( E
<360Safebox><"C:\Program Files\360Safebox\safeboxTray.exe" /r> [(Verified)Qizhi Software (beijing) Co. Ltd]1 n, {0 O a/ w2 a
<360Safetray><C:\Program Files\360safe\safemon\360tray.exe /start> [(Verified)Qizhi Software (beijing) Co. Ltd]3 \1 Q$ y0 V1 J- U- x$ p" b
<360Antiarp><C:\Program Files\360safe\AntiArp\AntiArp.exe /start> [(Verified)Qizhi Software (beijing) Co. Ltd]/ t0 x2 D. ~# S" a% H, Y( E* o
<KavStart><"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVStart.exe" -startup> [(Verified)KINGSOFT CORPORATION]
1 T* {* @+ N2 p0 J
<IMJPMIG8.1><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32> [N/A]
# R8 K# \5 l# h) L9 l! p; ^
<PHIME2002A><; > [N/A]
' {# P* K$ s8 r( @9 d9 P
<PHIME2002ASync><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32> [N/A]/ ~# w- |. k+ D
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
9 g1 ~/ W' E, b
<shell><Explorer.exe> [(Verified)Microsoft Windows Component Publisher]
8 ]/ s& ?3 L- Q1 H. s( a Y B) f
<Userinit><C:\WINDOWS\system32\UserInit.exe,> [(Verified)Microsoft Windows Publisher]
. [4 E* ?0 X1 C. B
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
5 }7 ^1 n9 \8 S
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]3 ^% V% }: P |9 a! a3 k
<{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}><C:\WINDOWS\system32\shlhook.dll> [Beijing Rising Technology Co., Ltd.]6 a- R; v% s8 N: l2 n- P' o+ p( K! z
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]1 |1 R0 Y, w! E! _ n7 e+ d1 z5 o
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A]0 C. _* e8 M& p! P$ e; c
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]5 o5 l6 _$ H+ c7 L9 A" A4 C' n
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A]
6 }7 v% ]! }2 v% C4 C
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
% V8 M s3 Z: s( k+ [3 C6 y
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A]* Q5 U6 b, o1 E
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]2 A8 ]; I6 Q; N
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A]
+ j2 n( J: w, J3 U" n! h9 C
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
$ o: W1 A) c2 Q8 V6 T
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Remove.PerUser.NT> [(Verified)Microsoft Windows Publisher]
2 k S' P+ V5 J8 U" V
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]* R7 N3 a3 A X j. V: Z: D
<Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser> [(Verified)Microsoft Windows Publisher]
) H( a; Y. K5 Q5 D1 D9 Y7 _! D
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
2 z5 ~% r. H* ]/ l6 _
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub> [(Verified)Microsoft Windows Publisher]
: J& `9 o+ f* {/ f; ^9 [7 J7 Z
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]8 n w$ Q7 p* y4 o
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A]& k6 e- t. e% }, D2 s+ \% A0 ]+ v& ]
==================================
H# \% {/ u+ D4 Y5 F- }0 [
启动文件夹
- J) f$ P* g: {
N/A$ D x7 Q9 P% \
==================================
- X1 I3 A( M- g1 ~: G: ~
服务3 K. J5 P/ `$ A! _/ f5 k
[3ware Controller Service / 3wareSrv][Stopped/Auto Start]
+ i3 m- o' |& B
<C:\WINDOWS\System32\3wareSrv.exe><N/A>
: S" ]. T+ r6 U e& U# I9 k
[Google Updater Service / gusvc][Stopped/Manual Start]8 K+ ` j& G/ J
<"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"><Google>( ~1 J$ G: K, u% C# Y+ ~+ a
[Help and Support / helpsvc][Stopped/Disabled]0 X: J8 M! E4 j+ b4 q6 L4 `2 m
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll><N/A>( C, U; A. ?! I5 X1 c4 k; T
[Human Interface Device Access / HidServ][Stopped/Boot Start]
# A* M! h) I l, V7 w: r
<\SystemRoot\C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
7 E% c( A' l. X+ i6 |" ~7 D
[Kingsoft Internet Security Common Service / KISSvc][Stopped/Auto Start]5 a) V0 b# w* h' e
<C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KISSvc.EXE><Kingsoft Corporation>6 a4 }9 E! u% L0 Y
[Kingsoft Personal Firewall Service / KPfwSvc][Running/Auto Start]
' Y; {, K9 h9 `7 I7 s/ s
<"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KPfwSvc.EXE"><Kingsoft Corporation>
+ x1 F& Y9 L/ C5 d
[Kingsoft Antivirus KWatch Service / KWatchSvc][Running/Auto Start]
& {1 U) J7 O) w( ~3 F! m0 Z. U
<"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KWatch.EXE"><Kingsoft Corporation>+ ~1 j6 Q. _( L W* ]
[NetMeeting Remote Desktop Sharing / mnmsrvc][Stopped/Manual Start]% k3 y3 W; i1 p
<><N/A>
3 o ]# V0 e9 Y4 a. h) B3 _
[Qvod Terminal / Qvod Terminal][Running/Auto Start]6 f' P0 }/ |) X. A# [% R. Q
<C:\Program Files\QvodPlayer\QvodTerminal.exe><Shenzhen QVOD Technology Co.,Ltd>
8 G6 ]. T9 h# Y8 G
==================================: ]. O$ _: N4 j; v/ E: @- ?
驱动程序
: n* M! X4 e2 y9 ^3 I: F8 w, A
[22j / 22jn][Stopped/Boot Start]) ]# b" D! k4 |) P+ {
<\SystemRoot\System32\DRIVERS\22jn.sys><N/A>: y l* D: y$ ?) z
[360AntiArp / 360AntiArp][Running/System Start]; @5 o. R% z$ @5 d" ?5 [8 E q
<\??\C:\WINDOWS\system32\drivers\360AntiArp.sys><360安全中心>: ]; p* z4 |* ]0 a* E
[43ec / 43ecu][Stopped/Boot Start]
8 M/ C1 Q3 `; E! `' [
<\SystemRoot\System32\DRIVERS\43ecu.sys><N/A>
! f3 k/ f6 f3 A7 G C+ R
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Running/Manual Start]
1 r' J+ z3 q5 e& J/ f. @
<system32\drivers\ac97intc.sys><Intel Corporation>
# z! \0 W+ e+ Y$ F1 r" t
[Promise driver accelerator / bb-run][Running/Boot Start]
/ m3 W, X4 y* t3 s
<\SystemRoot\system32\DRIVERS\bb-run.sys><Promise Technology, Inc.>$ y8 ]2 h7 a# M* Z2 {% S4 v
[Promise Removable Disk Control Driver / dontgo][Running/Boot Start]
' I3 f( D; ^* B! z# `" \
<\SystemRoot\system32\DRIVERS\DontGo.sys><Promise Technology, Inc.>: e1 J: B M! P4 g1 @9 ?; ~
[KAVBase / KAVBase][Running/Auto Start]
" q8 O1 @/ p, X/ v0 p6 h
<\??\C:\WINDOWS\system32\Drivers\KAVBase.sys><Kingsoft Corporation>7 i, R6 \1 q1 ^0 G9 J* b. Q1 O5 }2 n- P
[KAVBootC / KAVBootC][Running/Boot Start]
" |% Y! M5 n1 i- N/ V
<\SystemRoot\system32\Drivers\KAVBootC.sys><Kingsoft Corporation>0 S' i5 V+ T3 t3 z
[KAVSafe / KAVSafe][Running/Auto Start], t! w& k/ F& b1 r$ w r& o) f8 `
<\??\C:\WINDOWS\system32\Drivers\KAVSafe.sys><Kingsoft Corporation>
) }9 z2 m+ h; [. F2 f+ j
[KNetWch / KNetWch][Running/System Start]: a7 x4 K8 d/ j' c+ E9 a
<\??\C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KNetWch.SYS><Kingsoft Corporation>
1 V5 G6 \* Q) G: z7 A
[KWatch3 / KWatch3][Running/Auto Start]
9 h/ M; G5 F* B" v& V
<\??\C:\WINDOWS\system32\drivers\KWatch3.SYS><Kingsoft Corporation>' T/ L0 E$ N4 y& [
[ntptdb / ntptdb][Stopped/Auto Start]
* H" b5 _" P: @4 n) e
<\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys><N/A>
; m( E* `5 z( k8 }7 v: B+ u+ r
[nv / nv][Running/Manual Start]% ?) A1 x. R, G3 k: @
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>5 \' r; g2 U+ O& Z( \# p4 A+ A1 C
[NVIDIA nForce RAID Driver / nvrd32][Running/Boot Start]
$ Q5 W$ A! M. z; }& k' |8 l
<\SystemRoot\system32\DRIVERS\nvrd32.sys><NVIDIA Corporation>
0 o4 G& m& {5 O0 h7 g
[DDK PACKET Protocol / Packet][Running/Manual Start]
8 i+ U* y8 Q6 }" ]9 F* M1 v
<system32\DRIVERS\ProtoDrv.sys><360安全中心>4 g: i6 T5 D/ w2 i
[pnduojtwbt / pnduojtwbt][Stopped/Boot Start]& j4 S6 u4 T# [6 G4 D. s
<\SystemRoot\system32\drivers\pnduojtwbt.sys><N/A>! x' b" q$ q) }2 `/ F# I6 b
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
2 |- [' K! q/ @ w/ \
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>6 H% N$ I+ p/ u
[RsAntiSpyware / RsAntiSpyware][Stopped/Boot Start]$ C; n* {0 c* Y! y/ _. q1 m
<\SystemRoot\system32\drivers\RsBoot.sys><N/A>" L$ q2 O0 L0 ]% @
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]; O) }( ?. K. `2 O
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
6 Y4 r, U0 k( X# G
[SafeBoxKrnl / SafeBoxKrnl][Running/System Start]
0 {7 C* g* }8 _& L8 r9 m
<\??\C:\Program Files\360Safebox\SafeBoxKrnl.sys><360安全中心>3 h' i, _1 Y2 H A
[Secdrv / Secdrv][Stopped/Manual Start]! `& m( n' s+ Y7 T2 K
<system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>. s* i' r5 F- w6 N L: o/ b: a
[SATALink External Device Filter / SiRemFil][Running/Boot Start]
- N& R) F* R$ ]5 b0 I3 n& U
<\SystemRoot\system32\DRIVERS\SiRemFil.sys><Silicon Image, Inc.>: g% m" ?' ]- ~5 i
[System Restore Filter Driver / sr][Stopped/Disabled]( C3 W. F3 P; q9 E
<system32\DRIVERS\sr.sys><N/A>
/ S2 }/ S3 d+ D0 f" v7 z
[TesSafe / TesSafe][Stopped/Manual Start]
2 P5 ]7 O$ U4 ^ V
<\??\C:\WINDOWS\system32\TesSafe.sys><TENCENT>
I' P/ ^& A H/ s5 b( M5 }, L( a
[System Services / unzxzsrs][Stopped/Boot Start]2 m6 n* h" U( ~# j1 [0 b) ^
<\SystemRoot\system32\drivers\unzxzsrs.sys><N/A>7 L2 N' R% m; O2 b# U/ C% F7 }
[ViBus / ViBus][Stopped/Boot Start]
: E- S8 B* N- u5 T4 i
<\SystemRoot\system32\DRIVERS\ViBus.sys><N/A>0 ^' e/ Y$ K$ D8 E# C, s
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
: p" @. R( d8 \# x' B) N! H
<system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
2 H- v. Q+ C" F1 P& B9 C
[VIA SATA IDE Hot-plug Driver / xfilt][Running/Boot Start]/ n$ q) B9 `( ~* _4 K
<\SystemRoot\system32\DRIVERS\xfilt.sys><VIA Technologies,Inc>) {) u4 K6 ^' }+ t6 l, \7 {
[ATI Extend / zhibmaso][Stopped/Boot Start]
I( w3 t, {, H) H f- V8 o1 [
<\SystemRoot\system32\drivers\zhibmaso.sys><N/A>5 ]" |' }% F7 q9 G
[Vimicro USB PC Camera (ZC0301PL) / ZSMC301b][Running/Manual Start]1 w. ?/ }& L% d
<System32\Drivers\usbVM31b.sys><Vimicro Corporation>
5 F) Q) ~' T8 j2 l0 E
==================================
2 y1 H& a+ }5 d! @- O
浏览器加载项- D! B% _7 w$ n5 _; H" ^2 `' V
[Google Toolbar Helper]# B. \6 n& \8 r! W# V& y. N6 j
{AA58ED58-01DD-4d91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>
) T: S! |5 i. Y0 G7 Z P' _0 i$ i( ~
[Google Toolbar Notifier BHO]
. |, ~: \3 C. u3 i& X
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>
+ h9 D: ]# M, a4 h2 y
[SafeMon Class] A: g+ u$ D" G; x" N# v. Q; ?
{B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>
8 U" N. y7 v4 s; `+ P! j
[kingsoft browser shield]
- N! h7 e- h6 A2 x6 Q6 Y
{D963BE1A-6B35-47DB-B002-49FAE71D85CC} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL, Kingsoft Corporation>, {% K; i4 s6 l* z
[IEBuddyExtControl Class]
2 B' [2 z8 ?: G7 b3 V0 s! N2 _
{3AECD3C1-7085-4731-96DC-47B6CF7EF749} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL, Kingsoft Corporation>- u1 `7 \& T$ N& ^2 H
[Zcom 杂志]
) d! U" Q+ x" Z) ]4 g1 @5 ?
{4045D313-1D5E-4fe4-93A0-A34630B6A00B} <C:\Zcom\E-Space.exe, N/A>5 g3 Z0 L2 h$ h! i3 j: m
[&Google]
" q, Z% P9 w N4 k0 }0 x1 t
{2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>
; Z1 p* K+ J o# V4 l, N
[KooPlayer Control]
5 E6 k6 j& m) H# |- f
{C728DAB8-FDF5-4CD7-89DD-879D25794C77} <C:\WINDOWS\system32\CCTVKO~1.OCX, Koos>
- z* q& A3 H3 a/ v8 |$ m
[Shockwave Flash Object]
1 O7 v4 {3 I. v$ \
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.> G9 R5 L- S; U0 {
[KUpdateObj2 Class] W2 r1 C5 a8 N; _/ G7 z
{D82303B7-A754-4DCB-8AFC-8CF99435AACE} <C:\WINDOWS\system32\KingSoft\KOS\UpdateOcx2.dll, Kingsoft Corporation>
) c+ B. I; \0 Z$ N. f* {. o
[Google Script Object]5 N6 N) K1 R( K" H) q) V5 }6 O
{00EF2092-6AC5-47C0-BD25-CF2D5D657FEB} <c:\program files\google\googletoolbar2.dll, Google Inc.>
7 D; F4 P. Z) I5 B. q' F, g* _
[EWA Control]0 a1 ~* q5 K. b$ t4 K+ [
{18226BF8-DC0B-4D81-80E9-A41AE37BB73A} <C:\PROGRA~1\PPLive\SYNACA~2.OCX, Synacast>$ F G5 L2 A) u1 J- _
[Windows Media Player]. H$ ^1 {! Y9 q0 ^" [: F: i
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\msdxm.ocx, Microsoft Corporation>
+ r$ _1 s) ], Q- @5 f' v
[&Google]/ I8 l& I! [" W2 g5 I
{2318C2B1-4965-11D4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.> Q/ }0 u& L" _4 o8 r4 c( |
[HTML Document]3 H8 a# L- W* s/ s
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>) e8 f# [) b% _) M; v
[DHTML Edit Control Safe for Scripting for IE5]2 v4 X, N4 l2 C* @3 R- [- j+ x
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
- _ |0 W# h9 k4 {. e
[RealPlayer RAM Download Handler], @* S R9 V1 E& R' D
{2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>4 R' O1 x& c/ x6 U+ n
[IEBuddyExtControl Class]8 {: {$ k F! {' \
{3AECD3C1-7085-4731-96DC-47B6CF7EF749} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL, Kingsoft Corporation># C- K4 a' M) _, A
[XML Document]5 a c, b0 |7 u6 R5 E: n; f! l
{48123BC4-99D9-11D1-A6B3-00C04FD91555} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
6 g( t7 G3 n: L- e1 _" K
[HHCtrl Object]. b" d9 y5 N! h6 ~# r4 k
{52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>$ ]" m6 R8 K- Z, f* Q
[Windows Media Player]
$ N( o. d9 n o3 [) G
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>1 f7 l( M+ ~7 p" t3 E1 j
[Active Desktop Mover]
0 c- H( g$ Z4 ?/ ?( C$ @
{72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
. T* W6 I$ U0 Q. p8 I2 P
[360SafeLive]
' D# f/ I1 H# R6 O% ~- V
{87515F61-A66C-4319-A0E0-D416CB8059E3} <C:\Program Files\360safe\live.dll, 360.cn>
, ?4 ^: F, V" Z# @7 a; W2 d" u
[Microsoft Web 浏览器]* A7 T) }; a% v+ L5 Q u9 M
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation># ?5 \7 d% H3 J0 U2 x5 x3 {
[Browser Enhanced Objects]
`7 C; G, b% d# H- v. T3 M* {
{986488AF-13D5-9DDF-4FEF-9FB88698CFC1} <C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\USERDATA\webbrowser_2011.dll, N/A>4 l' N, E! B) [4 J8 D
[Google Toolbar Helper]. c) J+ [, I8 M! T: W5 r$ J! C
{AA58ED58-01DD-4D91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>& I9 U# D7 U6 J5 M* E+ d, ]# M0 O, C
[Microsoft Scriptlet Component]
$ ~, p- [2 }$ i) f5 K+ K
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>5 Z# l: B7 ~# O8 z
[Google Toolbar Notifier BHO]
4 v# i) U4 o3 d) Z2 h! ?8 h
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>
" H0 i! M/ c* @# ]( H* A; k( I
[SearchAssistantOC]4 {7 X6 K) p3 U+ `
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
5 u! p' H$ R2 U! k
[SafeMon Class]
4 U$ z# G0 V# n+ W: _ F
{B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>/ @- h8 @- M M9 `" U
[RDS.DataSpace]- L" @" @" z. c% i3 u
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
2 y! U6 ~. v3 n/ [' Z! t
[KooPlayer Control]
# `& W& ?. A& b5 z/ N, [
{C728DAB8-FDF5-4CD7-89DD-879D25794C77} <C:\WINDOWS\system32\CCTVKO~1.OCX, Koos>6 ^2 s7 z- O2 x" t
[AUDIO__MID Moniker Class]
5 i j: i9 k' c3 a# |# K
{CD3AFA74-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
5 [2 q8 p! V r( d& A% N
[AUDIO__MP3 Moniker Class]' O l6 |" E7 ?& s
{CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
2 d- i2 A9 Q3 M% D/ K5 }+ |
[AUDIO__X_MS_WMA Moniker Class]
) l% J: k" h8 y3 L
{CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
- I" f# G5 F- R$ O* M9 R. {
[VIDEO__X_MS_WMV Moniker Class]8 L# }; l w" {% C. ~) Q% c/ R+ n
{CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>' P; K; \# w: B4 x/ I: U
[RealPlayer G2 Control]
+ N& Z2 s0 |0 i }3 c
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
/ s& Q Y; q7 ^8 P% O- m9 G
[Shockwave Flash Object]+ I8 x/ j% k% j% i/ [' _
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>6 J! r8 y9 m2 Y2 h1 k' f
[KUpdateObj2 Class]0 n& j$ [. _! t( k% h
{D82303B7-A754-4DCB-8AFC-8CF99435AACE} <C:\WINDOWS\system32\KingSoft\KOS\UpdateOcx2.dll, Kingsoft Corporation># H4 q: f; O5 q6 i
[kingsoft browser shield]
8 f, \! C7 x$ [7 G
{D963BE1A-6B35-47DB-B002-49FAE71D85CC} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL, Kingsoft Corporation>
" ^3 p$ |' G( p
[PasswordEditCtrl Class]
" H6 d: o% F- L: E5 X) I: H
{E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>7 l$ {' P: D, E) f/ P$ ~
[QvodCtrl Class]
0 o0 `1 _/ z8 ]' I4 L
{F3D0D36F-23F8-4682-A195-74C92B03D4AF} <C:\Program Files\QvodPlayer\QvodInsert.dll, Shenzhen QVOD Technology Co.,Ltd>9 |- k) V% h* C3 e4 f8 W
[&使用超级旋风下载]
" I; g+ y0 ~: k D3 p
<C:\Program Files\Tencent\QQDownload\geturl.htm, N/A>
! s- j9 q( [6 }# C) `
[&使用超级旋风下载全部链接], X2 ^! Q( S) E& N* m4 r
<C:\Program Files\Tencent\QQDownload\getAllurl.htm, N/A>
4 Q6 _+ N" T" s6 r
[使用迅雷下载]
9 @6 p, p# O5 a; b0 l
<, N/A>
6 i g. I+ v+ f% `
[使用迅雷下载全部链接]
; S) m* U0 I& u0 o' T! @
<, N/A>
3 Z5 K: \: r- H+ t
[导出到 Microsoft Office Excel(&X)]
; T* B/ o! g: t4 _$ A3 G
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
5 U) d& W' k; f/ N6 L$ {8 n
[添加到QQ表情]
( B/ j: x7 m" ~" X6 J/ t; I! q
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>! s" L- u0 Q" q( P' o! H
==================================
0 N7 u0 H- A& ?+ w5 ]3 ]) o
正在运行的进程
+ l! U& N1 P' ?/ N' Q
[PID: 444 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]3 r4 ~" Q) Y$ k# @ A9 `( [
[PID: 496 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
2 V m# \' h, J- L9 ]
[PID: 520 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
! f4 S Q6 t" Q l( W$ z5 |, C
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
7 e! o' S2 Y' `" |' Q9 \6 _% Y( I
[PID: 564 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
* J6 ] }9 g5 u" |6 a
[PID: 576 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
% B6 U [$ u0 l! H: h
[PID: 720 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]! Z& u$ `( M8 _* W2 `8 x
[PID: 780 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]% s3 W1 g/ u5 L9 Z5 p$ a
[PID: 856 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]9 o( m0 V- |4 A3 c9 d" D9 ~% |6 q
[PID: 944 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]; Z8 O3 u9 [; [/ \9 z; ~( [; u- w
[PID: 1012 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]. a- _. ^1 t1 I$ n8 k; y, z7 @
[PID: 1236 / Administrator][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_qfe.070613-1311)]) |$ c4 X* J" M) K0 h: v
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]7 {$ L* h6 C1 n, I* e
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]
3 i( S; N1 p* ~, v: d# @
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
/ Z) B4 o5 F! `" \6 D7 O* I. Q* e
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
" u! i# H3 w4 T* g. S
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVEXT.DLL] [Kingsoft Corporation, 2008,05,07,373]! `4 k' e3 N: B [' C5 P
[C:\Program Files\Tencent\QQ\qdshm.dll] [, 1, 0, 101, 20]
+ @) R4 i2 e- U! c# f1 \# T' `$ a" N
[C:\Program Files\Tencent\QQ\MFC42.DLL] [Microsoft Corporation, 6.00.8665.0], [* M1 t( [5 m
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
% g8 u8 r1 o l X% [ v
[C:\WINDOWS\system32\shlhook.dll] [Beijing Rising Technology Co., Ltd., 4.0.0.9]
" E8 q. K" Y3 n+ V1 s; [( v
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]
, q# f& }$ l9 [3 f$ N
[C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]
3 P7 O$ W Q6 m8 z& D9 k% O
[PID: 1332 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
6 M `1 @, P0 Y$ x1 u @
[C:\WINDOWS\system32\mdimon.dll] [Microsoft Corporation, 11.3.8166.2]
/ D$ |5 W2 Z6 b4 U6 [3 Y0 L! y
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll] [Microsoft Corporation, 11.3.8166.2]% h4 s! t6 m4 q
[PID: 1540 / Administrator][C:\Program Files\360safe\AntiArp\AntiArp.exe] [360安全中心, 2, 0, 0, 1008]
J' I, ?* h4 T: R
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]6 \9 v: e$ k( I/ h" k
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5] _+ r; L9 \; J9 s8 s9 l* j1 S
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]; L8 y# K3 {- }* H
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]
: f3 j1 o4 t. T' K0 _% q
[PID: 1560 / Administrator][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
" l0 e3 w0 N# j2 a6 J1 k+ Z6 L
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]3 B, R! k' q# d& k) L* J
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]
- _3 s7 i2 u5 x( Q. J: t
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]
8 \: f3 s4 u4 ]0 w
[PID: 1576 / Administrator][C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe] [Google Inc., 2, 0, 301, 1654]0 Q4 x" B2 X% p# i8 i( `: R2 v. ^& T
[C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\gtn.dll] [Google Inc., 2, 0, 301, 7164]; h7 A1 o: J; V3 H9 ?; s8 v( F
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]5 C' z3 d1 T2 |+ {0 c! {/ y
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]1 g( F0 a# h1 |5 R" B
[C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\res_zh-CN.dll] [Google Inc., 2, 0, 301, 7164]1 K: F5 g/ g" A3 i/ L+ b2 {" j: V
[C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll] [Google Inc., 2, 0, 301, 7164] f( Q/ k/ `0 U/ A% c
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
) F* y9 F& i$ R% h( b+ Y
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]$ ]5 p0 l5 x1 A3 b% `
[PID: 1648 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
6 q2 K/ l' B5 X" D
[PID: 1744 / SYSTEM][C:\Program Files\QvodPlayer\QvodTerminal.exe] [Shenzhen QVOD Technology Co.,Ltd, 2, 5, 0, 53]
, d& o1 K7 a0 v7 K2 q. L/ t3 d7 F' i
[PID: 1860 / SYSTEM][C:\WINDOWS\system32\skeys.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]' b$ n- J0 G6 c$ `* ]
[PID: 1908 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
+ U8 \5 m c3 [7 H
[PID: 1964 / LOCAL SERVICE][C:\WINDOWS\system32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]2 ^- w) [$ k x3 `6 N" {4 j: ?
[PID: 2772 / Administrator][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]; n& ] `- T3 A+ h
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]1 Z. J4 X0 O5 g7 x! i
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]
' ]& S2 o" Z" o+ d9 a3 |; P2 S
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]
0 y, ]2 H( ?8 Z% k1 A C
[c:\program files\google\googletoolbar2.dll] [Google Inc., 4, 0, 1606, 6690]
0 g% g! L4 d* _$ ~# X
[C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll] [Google Inc., 2, 0, 301, 7164]
7 I6 q3 o/ w5 ]4 Y/ j
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL] [Kingsoft Corporation, 2008,04,15,2]
. E1 B$ I) [" k9 P* u
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddy.dll] [Kingsoft Corporation, 2008,04,15,2]
4 i2 b3 `; n. r0 q
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL] [Kingsoft Corporation, 2008,05,14,83]/ T4 R# Y$ q: [4 i, j8 z" d
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KANTray.dll] [Kingsoft Corporation, 2008,04,15,2]
! I9 r$ H9 m# q {! B, ?
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVAFish.DLL] [Kingsoft Corporation, 2008,05,13,78]
( F' c* J* y" z0 @+ K$ e; o) B
[C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]7 R* c* {% O: d; G& S4 Q; G0 ~
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]( M4 N$ O0 B2 c+ j
[C:\WINDOWS\system32\WN.IME] [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
7 z& I; [* x$ M6 ~" A' ?
[C:\Program Files\ShiQiang\wnime\Dll32\wnpy_StatusWnd.dll] [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
`# H' _ \6 F0 l; i" Q+ _1 M/ k
[C:\Program Files\ShiQiang\wnime\Dll32\wnpy_CompWnd.dll] [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]+ B9 {* Q: P7 N( D4 S8 F
[C:\Program Files\ShiQiang\wnime\Dll32\wnpy_Query.dll] [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]/ N5 L# Z. B( k8 I; L
[C:\WINDOWS\system32\SOGOUPY.IME] [Sogou.com Inc., 3.2.0.0]$ W" q4 W3 t, r0 V& Q
[C:\Documents and Settings\Administrator\My Documents\SogouInput\Plugin\SgImeWord.dll] [Sogou.com Inc., 3.2.0.0]
7 S2 |% t) V1 \: d# ^/ g O" Z- c
[C:\WINDOWS\system32\WINWB98.IME] [Microsoft Corporation, 4.00.950]' e8 u7 _: m0 p: x. _ U) {
[C:\WINDOWS\system32\WINWB86.IME] [Microsoft Corporation, 4.00.950]
0 h! i, ^" ]- Z5 ]
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]: E j4 {% `& p9 H' W
[PID: 1124 / Administrator][C:\Program Files\Tencent\QQ\TXPlatform.exe] [Tencent, 1, 0, 170, 0]
$ F8 F( a' B* i9 e* ~" W W
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]" V! v! U8 m `7 ^+ \
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]
7 ^: q8 }. Z/ D' v: N
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]9 l. `6 y7 r, z- y3 Q
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]
) x/ V' ]/ I# ~2 N- I3 c% F) A; Q: x
[PID: 928 / Administrator][F:\arvmon.exe] [任软工作室, 2.2.5.201]
$ R$ U. B$ [- P2 M
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
; `9 k: C2 g) q6 a# a/ W% p$ \
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]
) d! L0 b$ i. a
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]
8 i6 `! Q! _* G( i
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]
' P( \9 s: x6 O9 b
[F:\Vdata.dll] [任软工作室, 2, 2, 1, 94]
6 o1 \: [3 v" V$ n" L) a
[PID: 2540 / Administrator][F:\AutoGuarder.exe] [任软工作室, 2.2.5.201]
! z& ~ u" M9 E/ e. f
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]: _. K6 x3 b1 I
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]
& P4 Z2 q" _2 h) x
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]
8 b F& T8 \. b! d
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]
4 D, I8 r' O: g
[PID: 2476 / Administrator][d:\我的文档\桌面\系统检测修复\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]
0 k( a6 R4 g& t0 x" G6 @6 ]
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
% c- y7 j2 @% W" c* p" _, k
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL] [Kingsoft Corporation, 2008,04,02,5]
& K8 V. M) B# K3 m5 i5 H" l
[C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll] [Kingsoft Corporation, 2008,04,22,364]" p$ ^& `& e0 i1 X* G' ^; U- n7 S
[C:\Program Files\Tencent\QQ\DShared.dll] [Tencent, 2, 1, 0, 0]/ m, T5 u- m+ n( p
[d:\我的文档\桌面\系统检测修复\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]
4 x8 p( k9 ~; G4 e0 i2 J, E
==================================* c# f. f8 c2 g
文件关联
0 M2 ^9 ^8 G3 a7 _7 t7 K/ B- y
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
+ N* n w7 ?6 e6 |9 V& S
.EXE OK. ["%1" %*]; |2 s0 \9 I5 y) s
.COM OK. ["%1" %*]
w' u+ }7 F: }
.PIF OK. ["%1" %*]
2 R' g% A: m C+ k |
.REG OK. [regedit.exe "%1"]
" h _+ V. `( }9 c# v
.BAT OK. ["%1" %*]2 X4 R& q) D9 Z a$ ?5 ^: V
.SCR OK. ["%1" /S]& ^) q" l% w) s) k8 X. p9 w; _5 ]
.CHM OK. ["C:\WINDOWS\hh.exe" %1], _; V/ }6 V5 y/ I/ t, m
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
; q* r1 v5 h5 J9 ~/ Q* z
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]/ E2 G6 `" d- \5 j
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]2 x, f* ^: o# \% y. p3 k& D/ [
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
3 y1 u7 C* P- c# W
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
- r: o: r6 z% t1 X3 M7 x
.LNK OK. [{00021401-0000-0000-C000-000000000046}]7 a% [! j$ z* q
==================================0 ~( c* s j/ V2 e
Winsock 提供者) b' \7 L; Y4 ]& G |: M! r
N/A
. y+ F1 y8 ]- o5 g+ J
==================================
5 p# { C( z9 B( U& F
Autorun.inf
* S, N4 K5 w# @2 @" a
N/A
9 a% ]( k& K& N9 i1 o1 t+ R7 h
==================================
& t; @, a4 @% E
HOSTS 文件" W7 g8 R4 q" R( @( S0 c
N/A
+ Z! D& U0 P" [1 g
==================================( R* ~9 A' ?- m: L' k) q
进程特权扫描
; k0 l J* y ?( ?. v6 t
特殊特权被允许： SeLoadDriverPrivilege [PID = 520, C:\WINDOWS\SYSTEM32\WINLOGON.EXE]2 ?* ]& {7 n$ X
特殊特权被允许： SeDebugPrivilege [PID = 928, F:\ARVMON.EXE]
3 O, R3 F ~; C) u: m& p
特殊特权被允许： SeLoadDriverPrivilege [PID = 928, F:\ARVMON.EXE]
3 f& b; \5 l- J& H
特殊特权被允许： SeDebugPrivilege [PID = 2540, F:\AUTOGUARDER.EXE]
3 `6 u* E* o8 C' ~
特殊特权被允许： SeLoadDriverPrivilege [PID = 2540, F:\AUTOGUARDER.EXE]$ Q e0 Y" Q4 r: @. ~& j5 D
==================================
2 N: U/ v$ [" p" I7 U/ F$ p
API HOOK( R. u6 [( C# }
N/A( }" L2 |- V0 F
==================================' j8 G5 q J# v$ r8 B- d4 F& g
隐藏进程- V( V( u& [0 C3 L6 y
N/A y4 d5 @3 q0 ~5 `* W! [5 v
==================================
2 o: G& O$ n7 s/ T7 P$ Q( V
( `( F" T8 o: [! A+ F

复制代码

傲天♂扬帆 · 发表于 2008-5-22 21:40:31

跟原始说了，不知道能不能看明白。。。

傲天♂元始 · 发表于 2008-5-22 22:23:55

[Start]

2008-05-22,22:24:21

SREngLOG智能分析专家 V1.2.0.125
Tored (http://hi.baidu.com/peaset)

======================================================
以下过程将用到SREng、PowerRmv，如果您不熟悉这两款工具的使用方法，请参考下列链接：
SREng详细操作方法： http://hi.baidu.com/peaset/blog/ ... dd19224e4aeadf.html
PowerRmv详细操作方法： http://hi.baidu.com/peaset/blog/ ... 6fb5eb77c63816.html
======================================================

以下是病毒清除步骤：

1、用PowerRmv删除以下文件(没有则跳过)：

; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
;
; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
C:\WINDOWS\System32\3wareSrv.exe
\SystemRoot\C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll

\SystemRoot\System32\DRIVERS\22jn.sys
\SystemRoot\System32\DRIVERS\43ecu.sys
\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys
\SystemRoot\system32\drivers\pnduojtwbt.sys
\SystemRoot\system32\drivers\RsBoot.sys
system32\DRIVERS\sr.sys
\SystemRoot\system32\drivers\unzxzsrs.sys
\SystemRoot\system32\DRIVERS\ViBus.sys
\SystemRoot\system32\drivers\zhibmaso.sys

2、用SREng删除以下【注册表】项(没有则跳过)：

<IMJPMIG8.1>
<PHIME2002A>
<PHIME2002ASync>

3、用SREng删除【所有启动文件夹】内容(没有则跳过)

4、用SREng删除以下【服务】项(没有则跳过)：

[3ware Controller Service / 3wareSrv]
[NetMeeting Remote Desktop Sharing / mnmsrvc]

5、用SREng删除以下【驱动程序】项(没有则跳过)：

[22j / 22jn]
[43ec / 43ecu]
[ntptdb / ntptdb]
[pnduojtwbt / pnduojtwbt]
[RsAntiSpyware / RsAntiSpyware]
[System Restore Filter Driver / sr]
[System Services / unzxzsrs]
[ViBus / ViBus]
[ATI Extend / zhibmaso]

6、用SREng删除以下【浏览器加载项】项(没有则跳过)：

[Zcom 杂志]
[Browser Enhanced Objects]

最后,重新启动计算机.Tored祝您好运!
======================================================
[End]

傲天♂元始 · 发表于 2008-5-22 22:24:30

你就这样弄，不行我也没办法

傲天♂扬帆 · 发表于 2008-5-23 13:18:44

独恋有按原始说的重新操作一次吗？

独恋伊影 · 发表于 2008-5-24 20:09:59

找不到要删的文件。。。。

傲天♂元始 · 发表于 2008-5-25 08:54:35

有些都是隐藏起来的

傲天♂风云 · 发表于 2008-6-5 03:36:36

我对代码一点都不懂

傲天♂元始 · 发表于 2008-6-5 14:21:26

。。。这不是代码只是系统的扫描日志而已

傲天♂冷漠 · 发表于 2008-6-5 18:19:32

我汗~~~
这么多代码~~~

技术部 收藏本版 今日: 0 主题: 115

在这里

技术部收藏本版今日: 0 主题: 115