神啊，救救我吧！！
瑞星被攻击，又瘫痪了!
[CODE]
2008-04-17,23:03:40
System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 1 (Build 2600) - 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [(Verified)Microsoft Windows XP Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows XP Publisher]
<PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows XP Publisher]
<SoundMan><SoundMan.exe> [1]
<WSockDrv32><C:\WINDOWS\WSockDrv32.exe> []
<MsIMMs32><C:\WINDOWS\MsIMMs32.exE> []
<mppds><C:\WINDOWS\mppds.EXE> []
<AVPSrv><C:\WINDOWS\AVPSrv.exE> []
<upxdnd><C:\WINDOWS\upxdnd.exe> []
<tciocp32><C:\WINDOWS\tciocp32.exe> []
<fmsbbqi><C:\WINDOWS\fmsbbqi.exe> []
<msccrt><C:\WINDOWS\msccrt.exe> []
<DbgHlp32><C:\WINDOWS\DbgHlp32.exe> []
<cmdbcs><C:\WINDOWS\cmdbcs.exe> []
<sclzslvv><C:\WINDOWS\czlvibfe.exe> []
<PTSShell><C:\WINDOWS\PTSShell.exe> []
<LotusHlp><C:\WINDOWS\LotusHlp.exe> []
<SHAProc><C:\WINDOWS\SHAProc.exe> []
<Kvsc3><C:\WINDOWS\Kvsc3.exE> []
<mfchlp32><C:\WINDOWS\mfchlp32.exe> []
<dndsioc><C:\WINDOWS\dndsioc.exe> []
<WINSvr32><C:\WINDOWS\WINSvr32.exE> []
<fmbiost><C:\WINDOWS\fmbiost.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows XP Publisher]
<Userinit><C:\WINDOWS\System32\UserInit.exe,> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><msosmhfp01.dll,msoscqit01.dll,msosdohs01.dll,msosmnsf01.dll,msosptfs01.dll,msosping01.dll,msosfmsq01.dll,msosjtio00.dll,msosdrop00.dll> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{ED561258-45F3-A451-F908-A258458226DE}><C:\WINDOWS\Fonts\kvdxsnma.dll> [N/A]
<{F34345F1-DACF-3452-CB7D-4620F34A153F}><C:\WINDOWS\Fonts\rsztopm.dll> [N/A]
<{892FADFA-BCDE-ACDF-CDEF-21054865CBA8}><C:\WINDOWS\Fonts\wsmsfzx.dll> [N/A]
<{6A57CAD1-412F-9547-713F-9641FA3FC7A6}><C:\WINDOWS\Fonts\okmhfzy.dll> [N/A]
<{57650011-3344-6688-4899-345FABCD1575}><C:\WINDOWS\Fonts\ratbtpi.dll> [N/A]
<{CB681598-AD5F-BC8C-77DC-748FAC8D3FBC}><C:\WINDOWS\Fonts\kafylzy.dll> [N/A]
<{C4783410-4F90-34A0-7820-3230ACD05F4C}><C:\WINDOWS\Fonts\raqjlpi.dll> [N/A]
<{D9FA4178-7749-A8D9-F5C8-88645525769D}><C:\WINDOWS\Fonts\kashmzy.dll> [N/A]
<{55679330-4034-9021-7012-909856721375}><C:\WINDOWS\Fonts\wszjezx.dll> [N/A]
<{A960356A-458E-DE24-BD50-268F589A56AA}><C:\WINDOWS\Fonts\avwljmn.dll> [N/A]
<{E859245F-345D-BC13-AC4F-145D47DA34FE}><C:\WINDOWS\Fonts\avzxnmn.dll> [N/A]
<{9A1247C1-53DA-FF43-ABD3-345F323A48D9}><C:\WINDOWS\Fonts\avwgimn.dll> [N/A]
<{A8907901-1416-3389-9981-37217856998A}><C:\WINDOWS\Fonts\kawdjzy.dll> [N/A]
<{4FA10261-B890-F432-A453-69F1023513F4}><C:\WINDOWS\Fonts\gjcsdyc.dll> [N/A]
<{3A098324-8631-9087-7650-8907643562A3}><C:\WINDOWS\Fonts\jsqscyc.dll> [N/A]
<{6598FF45-DA60-F48A-BC43-10AC47853D56}><C:\WINDOWS\Fonts\rarjfpi.dll> [N/A]
<{BE32FA58-3453-FA2D-BC49-F340348ACCEB}><C:\WINDOWS\Fonts\rsmykpm.dll> [N/A]
<{2D098345-9012-8750-8910-9128098134D2}><C:\WINDOWS\Fonts\jsqxbyc.dll> [N/A]
<{595fc807-9d7f-4889-8194-b0fb4af7ba4c}><C:\WINDOWS\System32\IGB_GFSJ_1001.dll> [N/A]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [(Verified)Beijing Rising Science and Technology Corporation Limited]
<{6FC63358-5E38-4583-914B-119CA485A53C}><C:\Program Files\Internet Explorer\PLUGINS\Nt_Sys32.Sys> []
<{50632D5C-B71B-4ba0-B012-3DC6F15C011B}><C:\WINDOWS\System32\msosiocp.dll> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
<Microsoft Windows Media Player 6.4><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\mplayer2.inf,PerUserStub.NT> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{306D6C21-C1B6-4629-986C-E59E1875B8AF}]
<N/A><"C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Messenger\msgsc.dll",ShowIconsUser> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
<Windows Messenger><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.Install.PerUser> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player 8><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Loader.exe]
<IFEO[360Loader.exe]><svchost.exe> [(Verified)Beijing Rising Science and Technology Corporation Limited]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe]
<IFEO[ctfmon.exe]><SoundMan.exe> [1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword]
<IFEO[IceSword]><svchost.exe> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ras]
<IFEO[ras]><svchost.exe> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep]
<IFEO[runiep]><svchost.exe> [(Verified)Microsoft Windows XP Publisher]
==================================
[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; MAXTHON 2.0)