在这里

独恋伊影

1. 
   7 [# w6 l- b5 U0 l  B' _$ `
2. 2008-05-22,20:37:43
   7 J$ V4 y$ j0 h3 x
3. System Repair Engineer 2.5.16.900
   - z# i2 X  a: j  r0 q- z
4. Smallfrogs (http://www.KZTechs.com)
   ) R7 t% k5 N7 H& P
5. Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
   * A# U+ {, F$ m8 o7 J
6. 以下内容被选中：
   & \8 z) Q/ z8 X
7.     所有的启动项目（包括注册表、启动文件夹、服务等）
   ' r+ u1 d( e& k# z- ?# D
8.     浏览器加载项
   1 ^3 J1 ?8 K8 X) Y
9.     正在运行的进程（包括进程模块信息）
   - q9 x8 }+ |+ t1 `
10.     文件关联
    
11.     Winsock 提供者
    
12.     Autorun.inf
    1 S1 S/ T) r. ]8 y, Q' x
13.     HOSTS 文件
    
14.     进程特权扫描
    : h0 M! q- ?3 a4 h0 r8 p. j4 A, u
15. 
    9 g6 C: k7 L: ]+ s1 ~1 w8 |' ^
16. 启动项目
    
17. 注册表
    
18. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    
19.     <ctfmon.exe><C:\WINDOWS\system32\CTFMON.EXE>  [(Verified)Microsoft Windows Publisher]
    
20. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    
21.     <360Safebox><"C:\Program Files\360Safebox\safeboxTray.exe" /r>  [(Verified)Qizhi Software (beijing) Co. Ltd]
    ; Q9 f& V! S4 e2 K$ m# L
22.     <360Safetray><C:\Program Files\360safe\safemon\360tray.exe /start>  [(Verified)Qizhi Software (beijing) Co. Ltd]
    / K9 p" A- i- A0 s
23.     <360Antiarp><C:\Program Files\360safe\AntiArp\AntiArp.exe /start>  [(Verified)Qizhi Software (beijing) Co. Ltd]
    
24.     <KavStart><"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVStart.exe" -startup>  [(Verified)KINGSOFT CORPORATION]
    
25.     <IMJPMIG8.1><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32>  [N/A]
    % z0 U/ j1 Q) p9 J
26.     <PHIME2002A><; >  [N/A]
    
27.     <PHIME2002ASync><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32>  [N/A]
    
28. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    
29.     <shell><Explorer.exe>  [(Verified)Microsoft Windows Component Publisher]
    
30.     <Userinit><C:\WINDOWS\system32\UserInit.exe,>  [(Verified)Microsoft Windows Publisher]
    # C5 ^" w  p! F3 S
31.     <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
    5 F& a  j' i( `  M3 E
32. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    0 e7 M8 D+ d4 c' p5 `
33.     <{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}><C:\WINDOWS\system32\shlhook.dll>  [Beijing Rising Technology Co., Ltd.]
    $ B7 e# B; _4 K& |' ?5 _* k: W% [
34. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
    1 ]- v- t4 M( k8 U0 D
35.     <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [N/A]
    ; t* I7 C$ U+ m2 M% K7 O
36. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
    2 r" i3 I! U7 [( r4 G
37.     <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]
    
38. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
    
39.     <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]
    
40. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
    
41.     <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
    1 N) v0 P" M& o, v- |
42. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
    
43.     <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Remove.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
    : F/ Q, {7 _$ J) ], v4 D' U
44. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
    ) G: q1 }2 q8 v6 V! u3 S
45.     <Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser>  [(Verified)Microsoft Windows Publisher]
    
46. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
    . }- _# H, R, {" f
47.     <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub>  [(Verified)Microsoft Windows Publisher]
    
48. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
    . w4 Y% a2 D; G8 ~/ s! v+ I* F
49.     <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]
    % W; L5 ]8 D$ M7 A; C  j
50. ==================================
    
51. 启动文件夹
    1 n9 o% ?: u7 U# ^) P. ?
52. N/A
    
53. ==================================
    4 p5 W$ }) {! S  \: }" U
54. 服务
    
55. [3ware Controller Service / 3wareSrv][Stopped/Auto Start]
    5 T. B7 u" Z4 k1 v" J) C# M1 T
56.   <C:\WINDOWS\System32\3wareSrv.exe><N/A>
    . Q3 p8 d# i9 o" x# Z( H  p# L1 j1 s
57. [Google Updater Service / gusvc][Stopped/Manual Start]
    # W' d1 y5 \& N# T" n
58.   <"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"><Google>
    
59. [Help and Support / helpsvc][Stopped/Disabled]
    
60.   <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll><N/A>
    
61. [Human Interface Device Access / HidServ][Stopped/Boot Start]
    : N' y8 U: ?" ~8 o
62.   <\SystemRoot\C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
    
63. [Kingsoft Internet Security Common Service / KISSvc][Stopped/Auto Start]
    : u/ E: j" {. v3 N! @+ {
64.   <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KISSvc.EXE><Kingsoft Corporation>
    + h# k+ U5 Q' `  i
65. [Kingsoft Personal Firewall Service / KPfwSvc][Running/Auto Start]
    
66.   <"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KPfwSvc.EXE"><Kingsoft Corporation>
    
67. [Kingsoft Antivirus KWatch Service / KWatchSvc][Running/Auto Start]
    # y4 Y% V# q( p! a, u: D* @
68.   <"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KWatch.EXE"><Kingsoft Corporation>
    5 P8 ^, ?7 O6 |; e) v# |- e4 C9 @
69. [NetMeeting Remote Desktop Sharing / mnmsrvc][Stopped/Manual Start]
    
70.   <><N/A>
    4 X) m* u9 q: t& w
71. [Qvod Terminal / Qvod Terminal][Running/Auto Start]
    ' ^$ ^4 a. b$ u
72.   <C:\Program Files\QvodPlayer\QvodTerminal.exe><Shenzhen QVOD Technology Co.,Ltd>
    
73. ==================================
    8 }1 Z) W; d4 H% {
74. 驱动程序
    
75. [22j / 22jn][Stopped/Boot Start]
    / ~1 }& _4 R1 G
76.   <\SystemRoot\System32\DRIVERS\22jn.sys><N/A>
    
77. [360AntiArp / 360AntiArp][Running/System Start]
    4 ~4 ^" ^$ [) x1 p! {
78.   <\??\C:\WINDOWS\system32\drivers\360AntiArp.sys><360安全中心>
    
79. [43ec / 43ecu][Stopped/Boot Start]
    6 _, i% \* ]5 [1 t
80.   <\SystemRoot\System32\DRIVERS\43ecu.sys><N/A>
    ) @9 u& W3 o9 t9 h
81. [Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Running/Manual Start]
    
82.   <system32\drivers\ac97intc.sys><Intel Corporation>
    
83. [Promise driver accelerator / bb-run][Running/Boot Start]
    
84.   <\SystemRoot\system32\DRIVERS\bb-run.sys><Promise Technology, Inc.>
    
85. [Promise Removable Disk Control Driver / dontgo][Running/Boot Start]
    
86.   <\SystemRoot\system32\DRIVERS\DontGo.sys><Promise Technology, Inc.>
    
87. [KAVBase / KAVBase][Running/Auto Start]
    
88.   <\??\C:\WINDOWS\system32\Drivers\KAVBase.sys><Kingsoft Corporation>
    ' G" E- E! |7 x2 c9 O( R
89. [KAVBootC / KAVBootC][Running/Boot Start]
    ' y/ e* }, q, T' \8 q6 `
90.   <\SystemRoot\system32\Drivers\KAVBootC.sys><Kingsoft Corporation>
    ! @  X5 [1 s1 K3 z
91. [KAVSafe / KAVSafe][Running/Auto Start]
    & G1 s$ i1 C- |* {  c5 v, ^+ G
92.   <\??\C:\WINDOWS\system32\Drivers\KAVSafe.sys><Kingsoft Corporation>
    
93. [KNetWch / KNetWch][Running/System Start]
    8 ^1 h, _& J0 x; m/ P3 }0 O' F1 U
94.   <\??\C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KNetWch.SYS><Kingsoft Corporation>
    
95. [KWatch3 / KWatch3][Running/Auto Start]
    
96.   <\??\C:\WINDOWS\system32\drivers\KWatch3.SYS><Kingsoft Corporation>
    1 B! ~2 j  I( d8 f$ i
97. [ntptdb / ntptdb][Stopped/Auto Start]
    % X0 o1 n/ P2 C' d' @/ `
98.   <\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys><N/A>
    
99. [nv / nv][Running/Manual Start]
    
100.   <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
     
101. [NVIDIA nForce RAID Driver / nvrd32][Running/Boot Start]
     7 F2 ~  I% @& i1 [: j
102.   <\SystemRoot\system32\DRIVERS\nvrd32.sys><NVIDIA Corporation>
     
103. [DDK PACKET Protocol / Packet][Running/Manual Start]
     6 s9 x# F+ a& [9 G8 z
104.   <system32\DRIVERS\ProtoDrv.sys><360安全中心>
     # h( Z4 \, Z3 ^6 z& p
105. [pnduojtwbt / pnduojtwbt][Stopped/Boot Start]
     
106.   <\SystemRoot\system32\drivers\pnduojtwbt.sys><N/A>
     
107. [Direct Parallel Link Driver / Ptilink][Running/Manual Start]
     ! ~' ~. L1 Z7 q+ d
108.   <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
     
109. [RsAntiSpyware / RsAntiSpyware][Stopped/Boot Start]
     4 v- X0 c& ]( h  ^% ]
110.   <\SystemRoot\system32\drivers\RsBoot.sys><N/A>
     4 Q( J# f" p5 L9 r) f- f0 C
111. [Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
     2 e% z: I* y5 ^0 h0 c( I
112.   <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
     
113. [SafeBoxKrnl / SafeBoxKrnl][Running/System Start]
     
114.   <\??\C:\Program Files\360Safebox\SafeBoxKrnl.sys><360安全中心>
     2 Q1 U2 q$ ^7 Q0 A  }4 Q
115. [Secdrv / Secdrv][Stopped/Manual Start]
     
116.   <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
     7 I' O9 g/ Y% \2 P& H' A; M0 M
117. [SATALink External Device Filter / SiRemFil][Running/Boot Start]
     ; a% V3 @+ \) F2 D$ ]
118.   <\SystemRoot\system32\DRIVERS\SiRemFil.sys><Silicon Image, Inc.>
     $ s7 Q* e, m8 h6 L* F
119. [System Restore Filter Driver / sr][Stopped/Disabled]
       i4 i, ~2 O' x' D, B+ V5 ^
120.   <system32\DRIVERS\sr.sys><N/A>
     
121. [TesSafe / TesSafe][Stopped/Manual Start]
     
122.   <\??\C:\WINDOWS\system32\TesSafe.sys><TENCENT>
     " w1 s2 k. G+ h) }  Z8 I7 {
123. [System Services / unzxzsrs][Stopped/Boot Start]
     ( e. x" y6 O. Z
124.   <\SystemRoot\system32\drivers\unzxzsrs.sys><N/A>
     ) g8 p5 [; W6 B, u# j3 j! [" @
125. [ViBus / ViBus][Stopped/Boot Start]
     9 l$ `) ~& R! G' A9 [
126.   <\SystemRoot\system32\DRIVERS\ViBus.sys><N/A>
     ' J( F3 _" i4 g3 D+ d
127. [World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
     
128.   <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
     ! v2 X# A1 T& [# F* u. N
129. [VIA SATA IDE Hot-plug Driver / xfilt][Running/Boot Start]
     
130.   <\SystemRoot\system32\DRIVERS\xfilt.sys><VIA Technologies,Inc>
     + D. M2 E& }- m7 ~
131. [ATI Extend / zhibmaso][Stopped/Boot Start]
     
132.   <\SystemRoot\system32\drivers\zhibmaso.sys><N/A>
     % i# W& g: o% ~; A! h8 |% p/ G
133. [Vimicro USB PC Camera (ZC0301PL) / ZSMC301b][Running/Manual Start]
     
134.   <System32\Drivers\usbVM31b.sys><Vimicro Corporation>
     
135. ==================================
     1 `2 G) Z: n# ]( P2 o, q& N& Z
136. 浏览器加载项
     6 A5 ~2 J. ~! ~* A3 F
137. [Google Toolbar Helper]
     8 [/ ]1 U. s$ o9 O) g
138.   {AA58ED58-01DD-4d91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     
139. [Google Toolbar Notifier BHO]
     
140.   {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>
     
141. [SafeMon Class]
     
142.   {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>
     ! q: i% G: e7 ?, c4 [9 e- i
143. [kingsoft browser shield]
     0 {2 N3 p7 d. x$ Z5 R1 ~. F. t
144.   {D963BE1A-6B35-47DB-B002-49FAE71D85CC} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL, Kingsoft Corporation>
     
145. [IEBuddyExtControl Class]
     # z, U  @" G3 w9 O4 M' J
146.   {3AECD3C1-7085-4731-96DC-47B6CF7EF749} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL, Kingsoft Corporation>
     
147. [Zcom 杂志]
     
148.   {4045D313-1D5E-4fe4-93A0-A34630B6A00B} <C:\Zcom\E-Space.exe, N/A>
     
149. [&Google]
     
150.   {2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     - a/ N, e( S7 u4 N" G3 {
151. [KooPlayer Control]
     ' v+ p/ G1 [( |+ R; w) p! [
152.   {C728DAB8-FDF5-4CD7-89DD-879D25794C77} <C:\WINDOWS\system32\CCTVKO~1.OCX, Koos>
     ( M/ n5 e7 e+ n( g
153. [Shockwave Flash Object]
     $ b3 v; _0 U  k+ }: }9 f
154.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>
     % ~9 B# E3 g) ^; u8 F" R; q
155. [KUpdateObj2 Class]
     & |/ y4 C* o  ~+ i  Q
156.   {D82303B7-A754-4DCB-8AFC-8CF99435AACE} <C:\WINDOWS\system32\KingSoft\KOS\UpdateOcx2.dll, Kingsoft Corporation>
     
157. [Google Script Object]
     + H7 S+ [( Y3 k+ D% I! Z% G
158.   {00EF2092-6AC5-47C0-BD25-CF2D5D657FEB} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     
159. [EWA Control]
     * |0 }4 h  w2 ~8 D" `& N
160.   {18226BF8-DC0B-4D81-80E9-A41AE37BB73A} <C:\PROGRA~1\PPLive\SYNACA~2.OCX, Synacast>
     
161. [Windows Media Player]
     
162.   {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\msdxm.ocx, Microsoft Corporation>
     . p4 G7 Z$ K9 B6 J' T! w9 C) N
163. [&Google]
     
164.   {2318C2B1-4965-11D4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     / o; G9 X9 ~& x1 W, H: e
165. [HTML Document]
     
166.   {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
     
167. [DHTML Edit Control Safe for Scripting for IE5]
     
168.   {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
     ! N& A# `0 ]& j9 q& s9 ^* |
169. [RealPlayer RAM Download Handler]
     
170.   {2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
     7 j; ~3 A& r7 a+ ^5 |( C% k
171. [IEBuddyExtControl Class]
     
172.   {3AECD3C1-7085-4731-96DC-47B6CF7EF749} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL, Kingsoft Corporation>
     4 I/ U! X0 u+ m8 G7 B
173. [XML Document]
     
174.   {48123BC4-99D9-11D1-A6B3-00C04FD91555} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
     6 y2 x0 {( x' }! f
175. [HHCtrl Object]
     * `! L# b3 G- A! W$ B) @. K
176.   {52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
       T  Y8 P) X: l0 c8 |5 J
177. [Windows Media Player]
     
178.   {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     
179. [Active Desktop Mover]
     - f7 @9 C% P; x6 q9 o5 t. Y9 Q. p
180.   {72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
     
181. [360SafeLive]
     . O. N0 K9 I/ Z' T* h8 m
182.   {87515F61-A66C-4319-A0E0-D416CB8059E3} <C:\Program Files\360safe\live.dll, 360.cn>
     
183. [Microsoft Web 浏览器]
     
184.   {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
     7 [6 E: p3 K2 F0 I- q# ~8 s
185. [Browser Enhanced Objects]
     9 O( c4 N; O' |
186.   {986488AF-13D5-9DDF-4FEF-9FB88698CFC1} <C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\USERDATA\webbrowser_2011.dll, N/A>
     
187. [Google Toolbar Helper]
     
188.   {AA58ED58-01DD-4D91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>
     / ?2 I4 {  c- @/ t4 ?2 ]" |3 Z
189. [Microsoft Scriptlet Component]
     + K, l) r0 [6 P, P! T! [% @2 K
190.   {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
     
191. [Google Toolbar Notifier BHO]
     . C3 ?9 O6 |  u; A
192.   {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>
     
193. [SearchAssistantOC]
     / h- I9 K) y) n4 v- n& U, p& N: _
194.   {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
     
195. [SafeMon Class]
     
196.   {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>
     ( j- {( u8 o1 u
197. [RDS.DataSpace]
     2 k3 u' X* Q' c
198.   {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
     6 i( j$ {7 o6 L) S4 x& ]
199. [KooPlayer Control]
     : H6 m( i7 ~& S) _, N6 d
200.   {C728DAB8-FDF5-4CD7-89DD-879D25794C77} <C:\WINDOWS\system32\CCTVKO~1.OCX, Koos>
     
201. [AUDIO__MID Moniker Class]
     . V3 @0 {) s2 b# G6 p+ t
202.   {CD3AFA74-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     
203. [AUDIO__MP3 Moniker Class]
     , o. _' a( p4 ~) m/ H1 |' r4 `) k
204.   {CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     
205. [AUDIO__X_MS_WMA Moniker Class]
     . g5 b' {+ d8 O5 y
206.   {CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     % k0 D+ h! s& i) \( k' h0 q8 s8 p
207. [VIDEO__X_MS_WMV Moniker Class]
     
208.   {CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     
209. [RealPlayer G2 Control]
     
210.   {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
     - f$ {4 n7 ]8 A) _% A
211. [Shockwave Flash Object]
     
212.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>
     ; r2 ^' x( {$ ?) c  w9 H
213. [KUpdateObj2 Class]
     
214.   {D82303B7-A754-4DCB-8AFC-8CF99435AACE} <C:\WINDOWS\system32\KingSoft\KOS\UpdateOcx2.dll, Kingsoft Corporation>
     
215. [kingsoft browser shield]
     * F: D1 z5 \7 B/ S2 ]
216.   {D963BE1A-6B35-47DB-B002-49FAE71D85CC} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL, Kingsoft Corporation>
     
217. [PasswordEditCtrl Class]
     
218.   {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
     
219. [QvodCtrl Class]
     
220.   {F3D0D36F-23F8-4682-A195-74C92B03D4AF} <C:\Program Files\QvodPlayer\QvodInsert.dll, Shenzhen QVOD Technology Co.,Ltd>
     6 x. X) S$ s( [5 D( b, N2 p; F
221. [&使用超级旋风下载]
     
222.   <C:\Program Files\Tencent\QQDownload\geturl.htm, N/A>
     7 d4 Z' V0 b' F9 }% Y; H; n
223. [&使用超级旋风下载全部链接]
     ' S0 J- Z5 Q) M* m  H
224.   <C:\Program Files\Tencent\QQDownload\getAllurl.htm, N/A>
     
225. [使用迅雷下载]
     
226.   <, N/A>
     " H) K- J7 B- O8 R- D
227. [使用迅雷下载全部链接]
     / u5 @( \6 [/ g. j2 `
228.   <, N/A>
     
229. [导出到 Microsoft Office Excel(&X)]
     , s$ ?/ ]& j! Z/ {+ ^: f2 ~- P
230.   <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
     
231. [添加到QQ表情]
     9 j" ^0 Y4 j( r
232.   <C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
     7 P! ~# @( |- U6 E
233. ==================================
     ) N& D0 s6 N; c' M# v0 c
234. 正在运行的进程
     7 K+ w- ~# U2 I5 z: h; ^
235. [PID: 444 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     6 y0 Z1 D" `* g$ b4 g
236. [PID: 496 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     ' Z9 O$ V3 `4 f. ^4 D
237. [PID: 520 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     ) W; O/ O4 b' T8 ?
238.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
     " N7 {9 r" _: Y1 ~; F7 Q! N9 O
239. [PID: 564 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     5 w+ E! V0 n( D/ u$ h* M/ a
240. [PID: 576 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
241. [PID: 720 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     , w, h8 d. E. L6 }  y; Z, w! z" V
242. [PID: 780 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
243. [PID: 856 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
244. [PID: 944 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     ! v& g5 n+ U% T7 g: R
245. [PID: 1012 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
246. [PID: 1236 / Administrator][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_qfe.070613-1311)]
     + \2 d# X3 j9 S5 ^+ I; y
247.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     ; G2 [% X7 d, ?
248.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     3 _: j9 m+ w# z3 W
249.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
     
250.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     
251.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVEXT.DLL]  [Kingsoft Corporation, 2008,05,07,373]
     ) W9 M* X' p+ e1 o! U/ C8 O, {
252.     [C:\Program Files\Tencent\QQ\qdshm.dll]  [, 1, 0, 101, 20]
     
253.     [C:\Program Files\Tencent\QQ\MFC42.DLL]  [Microsoft Corporation, 6.00.8665.0]
     * J; |. ^: T( i+ U; c0 I' @
254.     [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
     
255.     [C:\WINDOWS\system32\shlhook.dll]  [Beijing Rising Technology Co., Ltd., 4.0.0.9]
     
256.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
257.     [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
     % ]( z" y% w) r0 C2 O7 I
258. [PID: 1332 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
     
259.     [C:\WINDOWS\system32\mdimon.dll]  [Microsoft Corporation, 11.3.8166.2]
     
260.     [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll]  [Microsoft Corporation, 11.3.8166.2]
     : z' d8 v6 \9 P
261. [PID: 1540 / Administrator][C:\Program Files\360safe\AntiArp\AntiArp.exe]  [360安全中心, 2, 0, 0, 1008]
     
262.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     
263.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     
264.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     % I# H7 |# S4 C" ~/ W* A) z  m. v7 R( D
265.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     4 P3 X  S1 m! x9 P4 f" S
266. [PID: 1560 / Administrator][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
267.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     
268.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
269.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
270. [PID: 1576 / Administrator][C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe]  [Google Inc., 2, 0, 301, 1654]
     : w8 H6 N) v- P- ]" ~# ^# w
271.     [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\gtn.dll]  [Google Inc., 2, 0, 301, 7164]
     7 B/ O' [2 k: @6 N2 Z
272.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     6 G* R6 v  y" ]  E) Q8 K0 l
273.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     * q# q: e( }1 {3 l# Q+ B* |) K
274.     [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\res_zh-CN.dll]  [Google Inc., 2, 0, 301, 7164]
     4 V1 {6 x) `, ]5 f
275.     [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll]  [Google Inc., 2, 0, 301, 7164]
     
276.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     
277.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
278. [PID: 1648 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     . J8 X, e4 _  F. e: I
279. [PID: 1744 / SYSTEM][C:\Program Files\QvodPlayer\QvodTerminal.exe]  [Shenzhen QVOD Technology Co.,Ltd, 2, 5, 0, 53]
     
280. [PID: 1860 / SYSTEM][C:\WINDOWS\system32\skeys.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     8 y4 q* D" o. ^; h
281. [PID: 1908 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     2 c: B3 `+ C: k6 `9 f, K& o
282. [PID: 1964 / LOCAL SERVICE][C:\WINDOWS\system32\wdfmgr.exe]  [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
     8 ~2 _* \7 k  S7 u
283. [PID: 2772 / Administrator][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
     * u/ m9 B1 _% ]6 e
284.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     8 n$ i! b" I8 p! C/ R( G8 ~
285.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     5 S2 |2 }7 y- m# j
286.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
287.     [c:\program files\google\googletoolbar2.dll]  [Google Inc., 4, 0, 1606, 6690]
     : F0 D6 O9 o8 M/ o. [. e; ~
288.     [C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll]  [Google Inc., 2, 0, 301, 7164]
     
289.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL]  [Kingsoft Corporation, 2008,04,15,2]
     
290.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddy.dll]  [Kingsoft Corporation, 2008,04,15,2]
     
291.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL]  [Kingsoft Corporation, 2008,05,14,83]
     ( y. U: L% w4 h$ N$ o2 Y% E- O
292.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KANTray.dll]  [Kingsoft Corporation, 2008,04,15,2]
     
293.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVAFish.DLL]  [Kingsoft Corporation, 2008,05,13,78]
     ) r* D, p( |5 Y5 }( Q2 n9 V
294.     [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
     5 Q( M' e1 y& Q% V4 n7 r
295.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
     
296.     [C:\WINDOWS\system32\WN.IME]  [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
     
297.     [C:\Program Files\ShiQiang\wnime\Dll32\wnpy_StatusWnd.dll]  [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
     6 z& ~) D1 R8 m7 @' V
298.     [C:\Program Files\ShiQiang\wnime\Dll32\wnpy_CompWnd.dll]  [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
     
299.     [C:\Program Files\ShiQiang\wnime\Dll32\wnpy_Query.dll]  [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
     
300.     [C:\WINDOWS\system32\SOGOUPY.IME]  [Sogou.com Inc., 3.2.0.0]
     
301.     [C:\Documents and Settings\Administrator\My Documents\SogouInput\Plugin\SgImeWord.dll]  [Sogou.com Inc., 3.2.0.0]
     
302.     [C:\WINDOWS\system32\WINWB98.IME]  [Microsoft Corporation, 4.00.950]
     
303.     [C:\WINDOWS\system32\WINWB86.IME]  [Microsoft Corporation, 4.00.950]
     
304.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
       C0 ~6 Q/ A9 C1 A
305. [PID: 1124 / Administrator][C:\Program Files\Tencent\QQ\TXPlatform.exe]  [Tencent, 1, 0, 170, 0]
     
306.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     
307.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     
308.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
309.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
310. [PID: 928 / Administrator][F:\arvmon.exe]  [任软工作室, 2.2.5.201]
     8 _$ [8 I& [/ u3 o  U( \6 o. y
311.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     
312.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     ; A# Y* x. b: X0 m5 `8 k) _
313.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     - c7 A. R/ o' O4 T8 L
314.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     9 w' Q7 {3 K5 Y2 S" p( a
315.     [F:\Vdata.dll]  [任软工作室, 2, 2, 1, 94]
     
316. [PID: 2540 / Administrator][F:\AutoGuarder.exe]  [任软工作室, 2.2.5.201]
     $ r: {5 S' z+ ^
317.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     
318.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     
319.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
320.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     
321. [PID: 2476 / Administrator][d:\我的文档\桌面\系统检测修复\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
     
322.     [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
     $ ^4 h( @1 x2 R6 W
323.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailOEBand.DLL]  [Kingsoft Corporation, 2008,04,02,5]
     6 }+ k7 U& J6 M, w0 n
324.     [C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kis.dll]  [Kingsoft Corporation, 2008,04,22,364]
     
325.     [C:\Program Files\Tencent\QQ\DShared.dll]  [Tencent, 2, 1, 0, 0]
     " x% S' A; j' F& m
326.     [d:\我的文档\桌面\系统检测修复\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]
     
327. ==================================
     & o4 u! X5 u! ?' f) l
328. 文件关联
     
329. .TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
     * {) M0 d- q  g) N" ]7 ]. m; f
330. .EXE  OK. ["%1" %*]
     
331. .COM  OK. ["%1" %*]
     
332. .PIF  OK. ["%1" %*]
     
333. .REG  OK. [regedit.exe "%1"]
       V. ]  t/ |, N! H
334. .BAT  OK. ["%1" %*]
     % l7 R9 k0 F: W( X* B* s3 ]; x
335. .SCR  OK. ["%1" /S]
     
336. .CHM  OK. ["C:\WINDOWS\hh.exe" %1]
     
337. .HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
     / K0 d( l, G& ?/ u  z. k. [/ m
338. .INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
     
339. .INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
     
340. .VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
     , s( ~7 _5 k6 z1 E
341. .JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
     ' _6 q8 [. [0 E7 ?) A
342. .LNK  OK. [{00021401-0000-0000-C000-000000000046}]
     , u) f/ X0 n8 A) K
343. ==================================
     
344. Winsock 提供者
     
345. N/A
     
346. ==================================
     
347. Autorun.inf
     ( [& f+ S, L. M4 W- v) o3 X8 D1 ?: O( g
348. N/A
     0 ~7 g7 W9 M" x1 i7 q4 c4 ^4 m- `
349. ==================================
     4 X6 w8 a# J% N5 n- A
350. HOSTS 文件
     
351. N/A
     ' }) ], I6 y# E$ `
352. ==================================
     : T5 `7 x" l4 Z+ v! U9 n; {6 P1 h5 q. k
353. 进程特权扫描
     
354. 特殊特权被允许： SeLoadDriverPrivilege [PID = 520, C:\WINDOWS\SYSTEM32\WINLOGON.EXE]
     
355. 特殊特权被允许： SeDebugPrivilege [PID = 928, F:\ARVMON.EXE]
     
356. 特殊特权被允许： SeLoadDriverPrivilege [PID = 928, F:\ARVMON.EXE]
     
357. 特殊特权被允许： SeDebugPrivilege [PID = 2540, F:\AUTOGUARDER.EXE]
     
358. 特殊特权被允许： SeLoadDriverPrivilege [PID = 2540, F:\AUTOGUARDER.EXE]
     & Y. z8 u; I4 ^
359. ==================================
     % m7 Q: S6 j' I3 b( V# f5 g- W) g
360. API HOOK
     ' h* F  ]4 T5 d6 J$ Z+ Y
361. N/A
     
362. ==================================
     
363. 隐藏进程
     % Z( `9 V9 |6 M& }6 a" f( k
364. N/A
     
365. ==================================
     
366. 
     

复制代码

傲天♂扬帆

跟原始说了，不知道能不能看明白。。。

傲天♂元始

[Start]
, z, j2 R, l0 i  o7 z
/ ^, [- O8 r8 g9 [2008-05-22,22:24:21

SREngLOG智能分析专家 V1.2.0.125
6 Q+ q1 U3 T! u$ KTored (http://hi.baidu.com/peaset)
; G# Q1 Q6 l; @" y  }' _" ^; K' A
======================================================
以下过程将用到SREng、PowerRmv，如果您不熟悉这两款工具的使用方法，请参考下列链接：
SREng详细操作方法： http://hi.baidu.com/peaset/blog/ ... dd19224e4aeadf.html
PowerRmv详细操作方法： http://hi.baidu.com/peaset/blog/ ... 6fb5eb77c63816.html
  M5 n; `$ e; _0 A) X======================================================
" e5 }  G' o4 K9 u, x5 L9 e0 s, b
6 T  ~4 M- d( r1 B& K1 N以下是病毒清除步骤：

; ~" x: F, r0 ]/ _1、用PowerRmv删除以下文件(没有则跳过)：
, ~; `. J" K2 i9 k
0 Y9 a1 w3 ]/ c- o' }. [9 R0 u( J; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
3 ~& h3 I" Q) |;
" z& G) i% _8 o  D6 i8 W; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
C:\WINDOWS\System32\3wareSrv.exe
\SystemRoot\C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll
! D( d% o  I7 Q1 R" L( V
\SystemRoot\System32\DRIVERS\22jn.sys
\SystemRoot\System32\DRIVERS\43ecu.sys
8 ^9 w( A" U3 H\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys
+ ^& [2 a9 S' k6 d\SystemRoot\system32\drivers\pnduojtwbt.sys
\SystemRoot\system32\drivers\RsBoot.sys
system32\DRIVERS\sr.sys
5 n3 h* E1 g2 l2 |, ^% b\SystemRoot\system32\drivers\unzxzsrs.sys
\SystemRoot\system32\DRIVERS\ViBus.sys
\SystemRoot\system32\drivers\zhibmaso.sys

2、用SREng删除以下【注册表】项(没有则跳过)：

<IMJPMIG8.1>
<PHIME2002A>
0 y( R: G2 `: I. {<PHIME2002ASync>

( |5 Y' F) U: \( C3、用SREng删除【所有启动文件夹】内容(没有则跳过)

4、用SREng删除以下【服务】项(没有则跳过)：

' ]8 @* o% n) z[3ware Controller Service / 3wareSrv]
2 s: E4 D8 F6 a8 b[NetMeeting Remote Desktop Sharing / mnmsrvc]
( _" z6 d9 @" o( I, D2 n; {
& D! o9 D) w  e5、用SREng删除以下【驱动程序】项(没有则跳过)：

) [' S! |1 R6 j[22j / 22jn]
  ]$ d. c% Q1 j# D[43ec / 43ecu]
[ntptdb / ntptdb]
; M4 ^5 c/ I' N9 L4 i[pnduojtwbt / pnduojtwbt]
[RsAntiSpyware / RsAntiSpyware]
[System Restore Filter Driver / sr]
[System Services / unzxzsrs]
8 R1 Z0 i" H" K[ViBus / ViBus]
" b- J5 {9 ?3 C' d& f[ATI Extend / zhibmaso]
0 Y' F7 c# {( O* Z6 X  U
6、用SREng删除以下【浏览器加载项】项(没有则跳过)：
% b1 h% ^$ {) T8 C$ S) ~
) T. b0 x' P+ U, ~* G' Z" t[Zcom 杂志]
, {: g2 _) x1 {5 u: X0 G/ Q( C[Browser Enhanced Objects]
& k+ _7 C, \- u8 t) D2 E' K
最后,重新启动计算机.Tored祝您好运!
: Y. `; F: J/ e0 Y# g& g======================================================
9 t0 y( E( N- N/ k( T6 e[End]

傲天♂元始

你就这样弄，不行我也没办法

傲天♂扬帆

独恋有按原始说的重新操作一次吗？

独恋伊影

找不到要删的文件。。。。

傲天♂元始

有些都是隐藏起来的

傲天♂风云

* z  E+ ^" _7 ~/ G- ?+ ?# ]% {
我对代码 一点都不懂

傲天♂元始

。。。这不是代码只是系统的扫描日志而已

傲天♂冷漠

我汗~~~
4 C/ b  X  C; Q8 f( z5 w/ L7 m. H这么多代码~~~