瑞星卡卡安全论坛

病毒发作是这样的，所有文件夹都变成了类似没有扩展名的文件，抓图如下：

 附件: 您所在的用户组无法下载或查看附件
所有文件都是16KB大小，其实这些以前都是文件夹，里面都有很多的文件，请大家帮助分析一下，这是什么病毒啊。
用瑞星听诊器生成报告如下：
未知家族病毒分析
扫描结果:

无可疑文件

系统活动进程
C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\WINDOWS\SYSTEM32\AGMCRDRV.DLL

C:\WINDOWS\SYSTEM32\WATCHCLIENT.EXE

C:\WINDOWS\SYSTEM32\VRVHOOK.DLL

C:\WINDOWS\SYSTEM32\SMSS.EXE

C:\WINDOWS\SYSTEM32\VRVEDP_M.EXE

C:\WINDOWS\SYSTEM32\CIPHEROP.DLL

C:\WINDOWS\SYSTEM32\VRVRF_C.EXE

C:\WINDOWS\SYSTEM32\VRVPWK.DLL
C:\WINDOWS\SYSTEM32\VRVKEYBOARD.DLL
C:\WINDOWS\SYSTEM32\VRVFW_C.DLL
C:\WINDOWS\SYSTEM32\VRVRUN_C.DLL
C:\WINDOWS\SYSTEM32\VRVHOOK.DLL
C:\WINDOWS\SYSTEM32\BKFILE.DLL
C:\WINDOWS\SYSTEM32\EDPAUDFLITER.DLL

C:\WINDOWS\SYSTEM32\CSRSS.EXE

C:\WINDOWS\SYSTEM32\WINLOGON.EXE

C:\WINDOWS\SYSTEM32\MSACM32.DRV

C:\WINDOWS\SYSTEM32\SERVICES.EXE

I:\软件\安全防护\RSDETECT.EXE

C:\WINDOWS\SYSTEM32\VRVHOOK.DLL
C:\PROGRAM FILES\360SAFE\SAFEMON\SAFEMON.DLL
C:\WINDOWS\SYSTEM32\VRVKEYBOARD.DLL

C:\WINDOWS\SYSTEM32\LSASS.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\PROGRAM FILES\RISING\RAV\RAVMOND.EXE

C:\PROGRAM FILES\RISING\RAV\BWLIST.DLL
C:\WINDOWS\SYSTEM32\MFC71.DLL
C:\WINDOWS\SYSTEM32\MSVCR71.DLL
C:\WINDOWS\SYSTEM32\MSVCP71.DLL
C:\PROGRAM FILES\RISING\RAV\RSAPPMGR.DLL
C:\PROGRAM FILES\RISING\RAV\CFGDLL.DLL
C:\PROGRAM FILES\RISING\RAV\RSLOG.DLL
C:\PROGRAM FILES\RISING\RAV\PROCCOM.DLL
C:\PROGRAM FILES\RISING\RAV\RSCOMMX2.DLL
C:\PROGRAM FILES\RISING\RAV\MONRULE.DLL
C:\PROGRAM FILES\RISING\RAV\HOOKSYS.DLL
C:\PROGRAM FILES\RISING\RAV\HOOKREG.DLL
C:\PROGRAM FILES\RISING\RAV\HOOKNTOS.DLL
C:\PROGRAM FILES\RISING\RAV\RSWALMON.DLL
C:\PROGRAM FILES\RISING\RAV\RECOMP.DLL
C:\PROGRAM FILES\RISING\RAV\REFS.DLL
C:\PROGRAM FILES\RISING\RAV\FFR.DLL
C:\PROGRAM FILES\RISING\RAV\RSSTORE.DLL
C:\PROGRAM FILES\RISING\RAV\HOOKCONT.DLL
C:\PROGRAM FILES\RISING\RAV\FAKESCAN.DLL
C:\PROGRAM FILES\RISING\RAV\SCANNER.DLL
C:\PROGRAM FILES\RISING\RAV\VIRUSLIB.DLL
C:\PROGRAM FILES\RISING\RAV\RELIBLDR.DLL
C:\PROGRAM FILES\RISING\RAV\HOOKWEB.DLL
C:\PROGRAM FILES\RISING\RAV\NVFILE.DLL
C:\PROGRAM FILES\RISING\RAV\EXTFILE.DLL
C:\PROGRAM FILES\RISING\RAV\PEARC.DLL
C:\PROGRAM FILES\RISING\RAV\SCANEXEC.DLL
C:\PROGRAM FILES\RISING\RAV\UNEXE.DLL
C:\PROGRAM FILES\RISING\RAV\SCANEX.DLL
C:\PROGRAM FILES\RISING\RAV\SCANPACK.DLL
C:\PROGRAM FILES\RISING\RAV\REVM.DLL
C:\PROGRAM FILES\RISING\RAV\URUTILS.DLL
C:\PROGRAM FILES\RISING\RAV\UR000.DAT
C:\PROGRAM FILES\RISING\RAV\SCRIPTCI.DLL
C:\PROGRAM FILES\RISING\RAV\UR001.DAT

C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HP1005MC.EXE

C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HP1005MP.DLL
C:\WINDOWS\SYSTEM32\VRVHOOK.DLL

C:\WINDOWS\SYSTEM32\SPOOLSV.EXE

C:\WINDOWS\SYSTEM32\HP1005LM.DLL
C:\WINDOWS\SYSTEM32\ZLHP1020.DLL
C:\WINDOWS\SYSTEM32\ZLM.DLL
C:\WINDOWS\SYSTEM32\SSGR3MK.DLL
C:\WINDOWS\SYSTEM32\SPOOL\PRTPROCS\W32X86\HP1005S.DLL
C:\WINDOWS\SYSTEM32\SPOOL\PRTPROCS\W32X86\IMFPRINT.DLL
C:\WINDOWS\SYSTEM32\IMF32.DLL
C:\WINDOWS\SYSTEM32\ZTAG32.DLL
C:\WINDOWS\SYSTEM32\ZSPOOL.DLL
C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HP1005MT.DLL
C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HP1005MP.DLL
C:\WINDOWS\SYSTEM32\VRVHOOK.DLL

C:\WINDOWS\EXPLORER.EXE

C:\WINDOWS\SYSTEM32\MSACM32.DRV
C:\PROGRAM FILES\360SAFE\SAFEMON\SAFEMON.DLL
C:\WINDOWS\SYSTEM32\VRVHOOK.DLL
C:\WINDOWS\SYSTEM32\VRVKEYBOARD.DLL
C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE11\MSOHEV.DLL
C:\PROGRAM FILES\SOFT\WINRAR\RAREXT.DLL
C:\WINDOWS\SYSTEM32\SIMPLE~1.DLL
C:\WINDOWS\SYSTEM32\AUDIODEV.DLL
C:\WINDOWS\SYSTEM32\RAVEXT.DLL
C:\PROGRAM FILES\RISING\RAV\RSCOMMON.DLL

C:\WINDOWS\SYSTEM32\SCARDSVR.EXE

C:\WINDOWS\SYSTEM32\VRVHOOK.DLL

C:\WINDOWS\SYSTEM32\VRVSAFEC.EXE

C:\WINDOWS\SYSTEM32\VRVHOOK.DLL

C:\PROGRAM FILES\RISING\RAV\RAVSTUB.EXE

C:\PROGRAM FILES\RISING\RAV\PROCCOM.DLL
C:\PROGRAM FILES\RISING\RAV\RSCOMMX2.DLL
C:\PROGRAM FILES\RISING\RAV\RSCOMMON.DLL

C:\PROGRAM FILES\ESAFE\ESAFE_MONITOR.EXE

C:\WINDOWS\SYSTEM32\VRVHOOK.DLL

C:\PROGRAM FILES\360SAFE\SAFEMON\360TRAY.EXE

C:\PROGRAM FILES\360SAFE\SAFEMON\SAFEMON.DLL
C:\PROGRAM FILES\360SAFE\SAFEMON\SAFEKRNL.DLL
C:\PROGRAM FILES\360SAFE\ANTIADWA.DLL
C:\WINDOWS\SYSTEM32\VRVHOOK.DLL
C:\PROGRAM FILES\360SAFE\LIVE.DLL

C:\PROGRAM FILES\RISING\RAV\RAVTRAY.EXE

C:\PROGRAM FILES\RISING\RAV\RAVUILIB.DLL
C:\PROGRAM FILES\RISING\RAV\RAVTRAY936.DLL
C:\PROGRAM FILES\RISING\RAV\PROCCOM.DLL
C:\PROGRAM FILES\RISING\RAV\RSCOMMX2.DLL

C:\PROGRAM FILES\RISING\RAV\RAVTASK.EXE

C:\PROGRAM FILES\RISING\RAV\PROCCOM.DLL
C:\PROGRAM FILES\RISING\RAV\RSCOMMX2.DLL
C:\PROGRAM FILES\RISING\RAV\RSCOMMON.DLL
C:\PROGRAM FILES\RISING\RAV\RSAPPMGR.DLL
C:\PROGRAM FILES\RISING\RAV\CFGDLL.DLL

C:\WINDOWS\SYSTEM32\CTFMON.EXE

C:\WINDOWS\SYSTEM32\VRVHOOK.DLL

C:\PROGRAM FILES\RISING\RAV\RAVMON.EXE

C:\WINDOWS\SYSTEM32\MFC71.DLL
C:\WINDOWS\SYSTEM32\MSVCR71.DLL
C:\WINDOWS\SYSTEM32\MSVCP71.DLL
C:\PROGRAM FILES\RISING\RAV\PROCCOM.DLL
C:\PROGRAM FILES\RISING\RAV\RSCOMMX2.DLL
C:\PROGRAM FILES\RISING\RAV\RSCOMMON.DLL
C:\PROGRAM FILES\RISING\RAV\RECOMP.DLL
C:\PROGRAM FILES\RISING\RAV\REFS.DLL
C:\PROGRAM FILES\RISING\RAV\VIRUSLIB.DLL
C:\PROGRAM FILES\RISING\RAV\RELIBLDR.DLL
C:\PROGRAM FILES\RISING\RAV\RSAPPMGR.DLL
C:\PROGRAM FILES\RISING\RAV\CFGDLL.DLL
C:\PROGRAM FILES\RISING\RAV\MONRULE.DLL
C:\PROGRAM FILES\RISING\RAV\PNGDLL.DLL
C:\PROGRAM FILES\RISING\RAV\RSGUILIB.DLL
C:\PROGRAM FILES\RISING\RAV\RSXML.DLL

C:\WINDOWS\SYSTEM32\ESAFESERVICE.EXE

C:\WINDOWS\SYSTEM32\VRVHOOK.DLL

C:\PROGRAM FILES\RISING\RAV\RAVSERVICE.EXE

C:\PROGRAM FILES\RISING\RAV\DLCENTER.DLL
C:\PROGRAM FILES\RISING\RAV\PROCCOM.DLL
C:\PROGRAM FILES\RISING\RAV\RSCOMMX2.DLL

C:\WINDOWS\SYSTEM32\ALG.EXE

I:\软件\安全防护\文件夹类病毒专杀工具 1.9.EXE

C:\WINDOWS\SYSTEM32\VRVHOOK.DLL
C:\PROGRAM FILES\360SAFE\SAFEMON\SAFEMON.DLL
C:\WINDOWS\SYSTEM32\VRVKEYBOARD.DLL

普通自启动项
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

eSafeMon = C:\PROGRAM FILES\ESAFE\ESAFE_MONITOR.EXE
360Safetray = C:\PROGRAM FILES\360SAFE\SAFEMON\360TRAY.EXE /START
RavTray = "C:\PROGRAM FILES\RISING\RAV\RAVTRAY.EXE"
RavTask = "C:\PROGRAM FILES\RISING\RAV\RAVTASK.EXE" -SYSTEM

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

ctfmon.exe = C:\WINDOWS\SYSTEM32\CTFMON.EXE

系统文件关联
.exe ==> exefile = "%1" %*
.com ==> comfile = "%1" %*
.cmd ==> cmdfile = "%1" %*
.bat ==> batfile = "%1" %*
.txt ==> txtfile = %SystemRoot%\system32\NOTEPAD.EXE %1
.scr ==> scrfile = "%1" /S
.reg ==> regfile = regedit.exe "%1"
.doc ==> DocFile.4.8001 = C:\Program Files\KINGSOFT\WPS Office 2002\winwps.exe "%1"

其它启动项
WIN.INI

无信息

SYSTEM.INI

SHELL = Explorer.exe
SCRNSAVE.EXE = C:\WINDOWS\system32\logon.scr

Winlogon 启动项
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify

crypt32chain = CRYPT32.DLL
cryptnet = CRYPTNET.DLL
cscdll = CSCDLL.DLL
ScCertProp = WLNOTIFY.DLL
Schedule = WLNOTIFY.DLL
sclgntfy = SCLGNTFY.DLL
SensLogn = WLNOTIFY.DLL
termsrv = WLNOTIFY.DLL
wlballoon = WLNOTIFY.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Userinit = C:\WINDOWS\SYSTEM32\USERINIT.EXE,
shell = EXPLORER.EXE

IE - BHO
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} = C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
{B69F34DD-F0F9-42DC-9EDD-957187DA688D} = C:\Program Files\360safe\safemon\safemon.dll

Winsock SPI
MSAFD Tcpip [TCP/IP] = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL
MSAFD Tcpip [UDP/IP] = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL
MSAFD Tcpip [RAW/IP] = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL
RSVP UDP Service Provider = C:\WINDOWS\SYSTEM32\RSVPSP.DLL
RSVP TCP Service Provider = C:\WINDOWS\SYSTEM32\RSVPSP.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip_{42E7BF06-2896-45BC-A581-B52EEAB23104}] SEQPACKET 0 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip_{42E7BF06-2896-45BC-A581-B52EEAB23104}] DATAGRAM 0 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip_{C69C7C6B-CC38-45DE-9AB8-F9C1C661B1B4}] SEQPACKET 1 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip_{C69C7C6B-CC38-45DE-9AB8-F9C1C661B1B4}] DATAGRAM 1 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip_{67BC10A4-0902-4BEE-A01A-9FCEF5C5562D}] SEQPACKET 2 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip_{67BC10A4-0902-4BEE-A01A-9FCEF5C5562D}] DATAGRAM 2 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL

系统服务项
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Alerter = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE
ALG = C:\WINDOWS\SYSTEM32\ALG.EXE
AppMgmt = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
AudioSrv = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
BITS = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
Browser = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
CiSvc = C:\WINDOWS\SYSTEM32\CISVC.EXE
ClipSrv = C:\WINDOWS\SYSTEM32\CLIPSRV.EXE
COMSysApp = C:\WINDOWS\SYSTEM32\DLLHOST.EXE /PROCESSID:{02D4B3F1-FD88-11D1-960D-00805FC79235}
CryptSvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
DcomLaunch = C:\WINDOWS\SYSTEM32\SVCHOST -K DCOMLAUNCH
Dhcp = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
dmadmin = C:\WINDOWS\SYSTEM32\DMADMIN.EXE /COM
dmserver = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
Dnscache = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETWORKSERVICE
eSafeService = C:\WINDOWS\SYSTEM32\ESAFESERVICE.EXE
Eventlog = C:\WINDOWS\SYSTEM32\SERVICES.EXE
EventSystem = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
FastUserSwitchingCompatibility = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
helpsvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
HidServ = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
HTTPFilter = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K HTTPFILTER
ImapiService = C:\WINDOWS\SYSTEM32\IMAPI.EXE
lanmanserver = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
lanmanworkstation = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
LmHosts = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE
MDC = "C:\WINDOWS\TASKMGR.EXE" /SERVICE
Messenger = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
mnmsrvc = C:\WINDOWS\SYSTEM32\MNMSRVC.EXE
MSDTC = C:\WINDOWS\SYSTEM32\MSDTC.EXE
MSIServer = C:\WINDOWS\SYSTEM32\MSIEXEC.EXE /V
NetDDE = C:\WINDOWS\SYSTEM32\NETDDE.EXE
NetDDEdsdm = C:\WINDOWS\SYSTEM32\NETDDE.EXE
Netlogon = C:\WINDOWS\SYSTEM32\LSASS.EXE
Netman = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
Nla = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
NtLmSsp = C:\WINDOWS\SYSTEM32\LSASS.EXE
NtmsSvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
ose = "C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\SOURCE ENGINE\OSE.EXE"
PlugPlay = C:\WINDOWS\SYSTEM32\SERVICES.EXE
PolicyAgent = C:\WINDOWS\SYSTEM32\LSASS.EXE
ProtectedStorage = C:\WINDOWS\SYSTEM32\LSASS.EXE
RasAuto = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
RasMan = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
RavService = "C:\PROGRAM FILES\RISING\RAV\RAVSERVICE.EXE"
RDSessMgr = C:\WINDOWS\SYSTEM32\SESSMGR.EXE
RemoteAccess = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
RemoteRegistry = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE
RpcLocator = C:\WINDOWS\SYSTEM32\LOCATOR.EXE
RpcSs = C:\WINDOWS\SYSTEM32\SVCHOST -K RPCSS
RsCCenter = "C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE"
RsRavMon = "C:\PROGRAM FILES\RISING\RAV\RAVMOND.EXE"
RSVP = C:\WINDOWS\SYSTEM32\RSVP.EXE
SamSs = C:\WINDOWS\SYSTEM32\LSASS.EXE
SCardSvr = C:\WINDOWS\SYSTEM32\SCARDSVR.EXE
Schedule = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
seclogon = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
SENS = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
SharedAccess = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
ShellHWDetection = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
Spooler = C:\WINDOWS\SYSTEM32\SPOOLSV.EXE
srservice = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
SSDPSRV = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE
stisvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K IMGSVC
SwPrv = C:\WINDOWS\SYSTEM32\DLLHOST.EXE /PROCESSID:{B98348E6-3D4F-4881-A008-7951ED9E88A9}
SysmonLog = C:\WINDOWS\SYSTEM32\SMLOGSVC.EXE
TapiSrv = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
TermService = C:\WINDOWS\SYSTEM32\SVCHOST -K DCOMLAUNCH
Themes = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
TlntSvr = C:\WINDOWS\SYSTEM32\TLNTSVR.EXE
TrkWks = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
UMWdf = C:\WINDOWS\SYSTEM32\WDFMGR.EXE
upnphost = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE
UPS = C:\WINDOWS\SYSTEM32\UPS.EXE
VRVWatchServer = "C:\WINDOWS\SYSTEM32\WATCHCLIENT.EXE" -SERVICE
VSS = C:\WINDOWS\SYSTEM32\VSSVC.EXE
W32Time = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
WebClient = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE
winmgmt = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
WmdmPmSN = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
Wmi = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
WmiApSrv = C:\WINDOWS\SYSTEM32\WBEM\WMIAPSRV.EXE
wuauserv = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
WZCSVC = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
xmlprov = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS

文件驱动
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

FltMgr = C:\WINDOWS\SYSTEM32\DRIVERS\FLTMGR.SYS
KVFileGuard = J:\KVUSB\ANTIVIRUS\KVFG.SYS
MRxDAV = C:\WINDOWS\SYSTEM32\DRIVERS\MRXDAV.SYS
MRxSmb = C:\WINDOWS\SYSTEM32\DRIVERS\MRXSMB.SYS
NetBIOS = C:\WINDOWS\SYSTEM32\DRIVERS\NETBIOS.SYS
Rdbss = C:\WINDOWS\SYSTEM32\DRIVERS\RDBSS.SYS
sr = C:\WINDOWS\SYSTEM32\DRIVERS\SR.SYS
Srv = C:\WINDOWS\SYSTEM32\DRIVERS\SRV.SYS
vcdrom = C:\PROGRAM FILES\FREESOFT\VCDCONTROLTOOL_CDC\VCDROM.SYS

用户系统信息：Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; QQDownload 1.7; .NET CLR 1.1.4322)

系统驱动项
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

a320raid = C:\WINDOWS\SYSTEM32\DRIVERS\A320RAID.SYS
AAC = C:\WINDOWS\SYSTEM32\DRIVERS\AAC.SYS
aar1210 = C:\WINDOWS\SYSTEM32\DRIVERS\AAR1210.SYS
abp480n5 = C:\WINDOWS\SYSTEM32\DRIVERS\ABP480N5.SYS
ACPI = C:\WINDOWS\SYSTEM32\DRIVERS\ACPI.SYS
adpu160m = C:\WINDOWS\SYSTEM32\DRIVERS\ADPU160M.SYS
adpu320 = C:\WINDOWS\SYSTEM32\DRIVERS\ADPU320.SYS
aec = C:\WINDOWS\SYSTEM32\DRIVERS\AEC.SYS
aec6210 = C:\WINDOWS\SYSTEM32\DRIVERS\AEC6210.SYS
aec6260 = C:\WINDOWS\SYSTEM32\DRIVERS\AEC6260.SYS
aec6280 = C:\WINDOWS\SYSTEM32\DRIVERS\AEC6280.SYS
AEC6290 = C:\WINDOWS\SYSTEM32\DRIVERS\AEC6290.SYS
AEC67160 = C:\WINDOWS\SYSTEM32\DRIVERS\AEC67160.SYS
AEC671X = C:\WINDOWS\SYSTEM32\DRIVERS\AEC671X.SYS
AEC6880 = C:\WINDOWS\SYSTEM32\DRIVERS\AEC6880.SYS
AEC6890 = C:\WINDOWS\SYSTEM32\DRIVERS\AEC6890.SYS
aec68x5 = C:\WINDOWS\SYSTEM32\DRIVERS\AEC68X5.SYS
AFD = C:\WINDOWS\SYSTEM32\DRIVERS\AFD.SYS
agp440 = C:\WINDOWS\SYSTEM32\DRIVERS\AGP440.SYS
Aha154x = C:\WINDOWS\SYSTEM32\DRIVERS\AHA154X.SYS
aic78u2 = C:\WINDOWS\SYSTEM32\DRIVERS\AIC78U2.SYS
aic78xx = C:\WINDOWS\SYSTEM32\DRIVERS\AIC78XX.SYS
ALCXWDM = C:\WINDOWS\SYSTEM32\DRIVERS\ALCXWDM.SYS
AliIde = C:\WINDOWS\SYSTEM32\DRIVERS\ALIIDE.SYS
AmdK6 = C:\WINDOWS\SYSTEM32\DRIVERS\AMDK6.SYS
AmdK7 = C:\WINDOWS\SYSTEM32\DRIVERS\AMDK7.SYS
AmdK8 = C:\WINDOWS\SYSTEM32\DRIVERS\AMDK8.SYS
amsint = C:\WINDOWS\SYSTEM32\DRIVERS\AMSINT.SYS
arc = C:\WINDOWS\SYSTEM32\DRIVERS\ARC.SYS
asc = C:\WINDOWS\SYSTEM32\DRIVERS\ASC.SYS
asc3550 = C:\WINDOWS\SYSTEM32\DRIVERS\ASC3550.SYS
AsyncMac = C:\WINDOWS\SYSTEM32\DRIVERS\ASYNCMAC.SYS
atapi = C:\WINDOWS\SYSTEM32\DRIVERS\ATAPI.SYS
Atmarpc = C:\WINDOWS\SYSTEM32\DRIVERS\ATMARPC.SYS
audstub = C:\WINDOWS\SYSTEM32\DRIVERS\AUDSTUB.SYS
cbidf = C:\WINDOWS\SYSTEM32\DRIVERS\CBIDF2K.SYS
Cdrom = C:\WINDOWS\SYSTEM32\DRIVERS\CDROM.SYS
CmdIde = C:\WINDOWS\SYSTEM32\DRIVERS\CMDIDE.SYS
Cpqarray = C:\WINDOWS\SYSTEM32\DRIVERS\CPQARRAY.SYS
Crusoe = C:\WINDOWS\SYSTEM32\DRIVERS\CRUSOE.SYS
dac2w2k = C:\WINDOWS\SYSTEM32\DRIVERS\DAC2W2K.SYS
dac960nt = C:\WINDOWS\SYSTEM32\DRIVERS\DAC960NT.SYS
DgiVecp = C:\WINDOWS\SYSTEM32\DRIVERS\DGIVECP.SYS
Disk = C:\WINDOWS\SYSTEM32\DRIVERS\DISK.SYS
dmboot = C:\WINDOWS\SYSTEM32\DRIVERS\DMBOOT.SYS
dmio = C:\WINDOWS\SYSTEM32\DRIVERS\DMIO.SYS
dmload = C:\WINDOWS\SYSTEM32\DRIVERS\DMLOAD.SYS
DMusic = C:\WINDOWS\SYSTEM32\DRIVERS\DMUSIC.SYS
dpti2o = C:\WINDOWS\SYSTEM32\DRIVERS\DPTI2O.SYS
drmkaud = C:\WINDOWS\SYSTEM32\DRIVERS\DRMKAUD.SYS
elxstor = C:\WINDOWS\SYSTEM32\DRIVERS\ELXSTOR.SYS
ESAFE = C:\WINDOWS\SYSTEM32\DRIVERS\ESAFE.SYS
eSafeSC = C:\WINDOWS\SYSTEM32\DRIVERS\ESAFESC.SYS
FASTSX = C:\WINDOWS\SYSTEM32\DRIVERS\FASTSX.SYS
fasttrak = C:\WINDOWS\SYSTEM32\DRIVERS\FASTTRAK.SYS
fasttx2k = C:\WINDOWS\SYSTEM32\DRIVERS\FASTTX2K.SYS
fasttx2k2 = C:\WINDOWS\SYSTEM32\DRIVERS\FASTTX2K2.SYS
Fdc = C:\WINDOWS\SYSTEM32\DRIVERS\FDC.SYS
FETNDIS = C:\WINDOWS\SYSTEM32\DRIVERS\FETND5.SYS
Flpydisk = C:\WINDOWS\SYSTEM32\DRIVERS\FLPYDISK.SYS
FsVga = C:\WINDOWS\SYSTEM32\DRIVERS\FSVGA.SYS
Ftdisk = C:\WINDOWS\SYSTEM32\DRIVERS\FTDISK.SYS
gagp30kx = C:\WINDOWS\SYSTEM32\DRIVERS\GAGP30KX.SYS
gameenum = C:\WINDOWS\SYSTEM32\DRIVERS\GAMEENUM.SYS
Gpc = C:\WINDOWS\SYSTEM32\DRIVERS\MSGPC.SYS
HookCont = C:\WINDOWS\SYSTEM32\DRIVERS\HOOKCONT.SYS
HookNtos = C:\WINDOWS\SYSTEM32\DRIVERS\HOOKNTOS.SYS
HookReg = C:\WINDOWS\SYSTEM32\DRIVERS\HOOKREG.SYS
HookSys = C:\WINDOWS\SYSTEM32\DRIVERS\HOOKSYS.SYS
HpCISSs = C:\WINDOWS\SYSTEM32\DRIVERS\HPCISSS.SYS
hpn = C:\WINDOWS\SYSTEM32\DRIVERS\HPN.SYS
Hpt366 = C:\WINDOWS\SYSTEM32\DRIVERS\HPT366.SYS
HPT371 = C:\WINDOWS\SYSTEM32\DRIVERS\HPT371.SYS
hpt374 = C:\WINDOWS\SYSTEM32\DRIVERS\HPT374.SYS
hpt3xx = C:\WINDOWS\SYSTEM32\DRIVERS\HPT3XX.SYS
hptmv = C:\WINDOWS\SYSTEM32\DRIVERS\HPTMV.SYS
hptpro = C:\WINDOWS\SYSTEM32\DRIVERS\HPTPRO.SYS
HTTP = C:\WINDOWS\SYSTEM32\DRIVERS\HTTP.SYS
i2omp = C:\WINDOWS\SYSTEM32\DRIVERS\I2OMP.SYS
i8042prt = C:\WINDOWS\SYSTEM32\DRIVERS\I8042PRT.SYS
iaStor = C:\WINDOWS\SYSTEM32\DRIVERS\IASTOR.SYS
iirsp = C:\WINDOWS\SYSTEM32\DRIVERS\IIRSP.SYS
Imapi = C:\WINDOWS\SYSTEM32\DRIVERS\IMAPI.SYS
ini910u = C:\WINDOWS\SYSTEM32\DRIVERS\INI910U.SYS
IntelIde = C:\WINDOWS\SYSTEM32\DRIVERS\INTELIDE.SYS
intelppm = C:\WINDOWS\SYSTEM32\DRIVERS\INTELPPM.SYS
Ip6Fw = C:\WINDOWS\SYSTEM32\DRIVERS\IP6FW.SYS
IpFilterDriver = C:\WINDOWS\SYSTEM32\DRIVERS\IPFLTDRV.SYS
IpInIp = C:\WINDOWS\SYSTEM32\DRIVERS\IPINIP.SYS
IpNat = C:\WINDOWS\SYSTEM32\DRIVERS\IPNAT.SYS
IPSec = C:\WINDOWS\SYSTEM32\DRIVERS\IPSEC.SYS
IRENUM = C:\WINDOWS\SYSTEM32\DRIVERS\IRENUM.SYS
isapnp = C:\WINDOWS\SYSTEM32\DRIVERS\ISAPNP.SYS
iteraid = C:\WINDOWS\SYSTEM32\DRIVERS\ITERAID.SYS
Kbdclass = C:\WINDOWS\SYSTEM32\DRIVERS\KBDCLASS.SYS
kmixer = C:\WINDOWS\SYSTEM32\DRIVERS\KMIXER.SYS
LSI_SAS = C:\WINDOWS\SYSTEM32\DRIVERS\LSI_SAS.SYS
LSI_SCSI = C:\WINDOWS\SYSTEM32\DRIVERS\LSI_SCSI.SYS
m5228 = C:\WINDOWS\SYSTEM32\DRIVERS\M5228.SYS
m5281 = C:\WINDOWS\SYSTEM32\DRIVERS\M5281.SYS
MegaIDE = C:\WINDOWS\SYSTEM32\DRIVERS\MEGAIDE.SYS
megasas = C:\WINDOWS\SYSTEM32\DRIVERS\MEGASAS.SYS
Mouclass = C:\WINDOWS\SYSTEM32\DRIVERS\MOUCLASS.SYS
mraid2k = C:\WINDOWS\SYSTEM32\DRIVERS\MRAID2K.SYS
mraid35x = C:\WINDOWS\SYSTEM32\DRIVERS\MRAID35X.SYS
MSKSSRV = C:\WINDOWS\SYSTEM32\DRIVERS\MSKSSRV.SYS
MSPCLOCK = C:\WINDOWS\SYSTEM32\DRIVERS\MSPCLOCK.SYS
MSPQM = C:\WINDOWS\SYSTEM32\DRIVERS\MSPQM.SYS
mssmbios = C:\WINDOWS\SYSTEM32\DRIVERS\MSSMBIOS.SYS
NdisTapi = C:\WINDOWS\SYSTEM32\DRIVERS\NDISTAPI.SYS
Ndisuio = C:\WINDOWS\SYSTEM32\DRIVERS\NDISUIO.SYS
NdisWan = C:\WINDOWS\SYSTEM32\DRIVERS\NDISWAN.SYS
NetBT = C:\WINDOWS\SYSTEM32\DRIVERS\NETBT.SYS
nfrd960 = C:\WINDOWS\SYSTEM32\DRIVERS\NFRD960.SYS
NPF = C:\WINDOWS\SYSTEM32\DRIVERS\NPF.SYS
npkcrypt = C:\PROGRAM FILES\SOFT\TENCENT\QQ\NPKCRYPT.SYS
nv = C:\WINDOWS\SYSTEM32\DRIVERS\NV4_MINI.SYS
NvAtaBus = C:\WINDOWS\SYSTEM32\DRIVERS\NVATABUS.SYS
nvmpu401 = C:\WINDOWS\SYSTEM32\DRIVERS\NVMPU401.SYS
nvraid = C:\WINDOWS\SYSTEM32\DRIVERS\NVRAID.SYS
NwlnkFlt = C:\WINDOWS\SYSTEM32\DRIVERS\NWLNKFLT.SYS
NwlnkFwd = C:\WINDOWS\SYSTEM32\DRIVERS\NWLNKFWD.SYS
Parport = C:\WINDOWS\SYSTEM32\DRIVERS\PARPORT.SYS
PCI = C:\WINDOWS\SYSTEM32\DRIVERS\PCI.SYS
PCIIde = C:\WINDOWS\SYSTEM32\DRIVERS\PCIIDE.SYS
perc2 = C:\WINDOWS\SYSTEM32\DRIVERS\PERC2.SYS
perc2hib = C:\WINDOWS\SYSTEM32\DRIVERS\PERC2HIB.SYS
PNP649R = C:\WINDOWS\SYSTEM32\DRIVERS\PNP649R.SYS
Pnp680 = C:\WINDOWS\SYSTEM32\DRIVERS\PNP680.SYS
Pnp680r = C:\WINDOWS\SYSTEM32\DRIVERS\PNP680R.SYS
PptpMiniport = C:\WINDOWS\SYSTEM32\DRIVERS\RASPPTP.SYS
Processor = C:\WINDOWS\SYSTEM32\DRIVERS\PROCESSR.SYS
PSched = C:\WINDOWS\SYSTEM32\DRIVERS\PSCHED.SYS
Ptilink = C:\WINDOWS\SYSTEM32\DRIVERS\PTILINK.SYS
ql1080 = C:\WINDOWS\SYSTEM32\DRIVERS\QL1080.SYS
Ql10wnt = C:\WINDOWS\SYSTEM32\DRIVERS\QL10WNT.SYS
ql12160 = C:\WINDOWS\SYSTEM32\DRIVERS\QL12160.SYS
ql1240 = C:\WINDOWS\SYSTEM32\DRIVERS\QL1240.SYS
ql1280 = C:\WINDOWS\SYSTEM32\DRIVERS\QL1280.SYS
ql2300 = C:\WINDOWS\SYSTEM32\DRIVERS\QL2300.SYS
RAIDSRC = C:\WINDOWS\SYSTEM32\DRIVERS\RAIDSRC.SYS
RasAcd = C:\WINDOWS\SYSTEM32\DRIVERS\RASACD.SYS
Rasl2tp = C:\WINDOWS\SYSTEM32\DRIVERS\RASL2TP.SYS
RasPppoe = C:\WINDOWS\SYSTEM32\DRIVERS\RASPPPOE.SYS
Raspti = C:\WINDOWS\SYSTEM32\DRIVERS\RASPTI.SYS
RDPCDD = C:\WINDOWS\SYSTEM32\DRIVERS\RDPCDD.SYS
rdpdr = C:\WINDOWS\SYSTEM32\DRIVERS\RDPDR.SYS
redbook = C:\WINDOWS\SYSTEM32\DRIVERS\REDBOOK.SYS
RsNTGDI = C:\WINDOWS\SYSTEM32\DRIVERS\RSNTGDI.SYS
rtl8139 = C:\WINDOWS\SYSTEM32\DRIVERS\RTL8139.SYS
S150SX8 = C:\WINDOWS\SYSTEM32\DRIVERS\S150SX8.SYS
SafeBoxKrnl = C:\WINDOWS\SYSTEM32\DRIVERS\SAFEBOXKRNL.SYS
Secdrv = C:\WINDOWS\SYSTEM32\DRIVERS\SECDRV.SYS
serenum = C:\WINDOWS\SYSTEM32\DRIVERS\SERENUM.SYS
Serial = C:\WINDOWS\SYSTEM32\DRIVERS\SERIAL.SYS
SI3112 = C:\WINDOWS\SYSTEM32\DRIVERS\SI3112.SYS
SI3112r = C:\WINDOWS\SYSTEM32\DRIVERS\SI3112R.SYS
SI3114 = C:\WINDOWS\SYSTEM32\DRIVERS\SI3114.SYS
SI3114r = C:\WINDOWS\SYSTEM32\DRIVERS\SI3114R.SYS
SI3124 = C:\WINDOWS\SYSTEM32\DRIVERS\SI3124.SYS
SI3124r = C:\WINDOWS\SYSTEM32\DRIVERS\SI3124R.SYS
SiFilter = C:\WINDOWS\SYSTEM32\DRIVERS\SIWINACC.SYS
SISIDE = C:\WINDOWS\SYSTEM32\DRIVERS\SISIDE.SYS
SiSRaid = C:\WINDOWS\SYSTEM32\DRIVERS\SISRAID.SYS
SiSRaid1 = C:\WINDOWS\SYSTEM32\DRIVERS\SISRAID1.SYS
SISRAIDS = C:\WINDOWS\SYSTEM32\DRIVERS\SISRAIDS.SYS
Sparrow = C:\WINDOWS\SYSTEM32\DRIVERS\SPARROW.SYS
splitter = C:\WINDOWS\SYSTEM32\DRIVERS\SPLITTER.SYS
sptrak = C:\WINDOWS\SYSTEM32\DRIVERS\SPTRAK.SYS
swenum = C:\WINDOWS\SYSTEM32\DRIVERS\SWENUM.SYS
swmidi = C:\WINDOWS\SYSTEM32\DRIVERS\SWMIDI.SYS
symc810 = C:\WINDOWS\SYSTEM32\DRIVERS\SYMC810.SYS
symc8xx = C:\WINDOWS\SYSTEM32\DRIVERS\SYMC8XX.SYS
SYMMPI = C:\WINDOWS\SYSTEM32\DRIVERS\SYMMPI.SYS
sym_hi = C:\WINDOWS\SYSTEM32\DRIVERS\SYM_HI.SYS
sym_u3 = C:\WINDOWS\SYSTEM32\DRIVERS\SYM_U3.SYS
sysaudio = C:\WINDOWS\SYSTEM32\DRIVERS\SYSAUDIO.SYS
Tcpip = C:\WINDOWS\SYSTEM32\DRIVERS\TCPIP.SYS
TermDD = C:\WINDOWS\SYSTEM32\DRIVERS\TERMDD.SYS
TosIde = C:\WINDOWS\SYSTEM32\DRIVERS\TOSIDE.SYS
UlSata = C:\WINDOWS\SYSTEM32\DRIVERS\ULSATA.SYS
ULSATAS = C:\WINDOWS\SYSTEM32\DRIVERS\ULSATAS.SYS
ultra = C:\WINDOWS\SYSTEM32\DRIVERS\ULTRA.SYS
Update = C:\WINDOWS\SYSTEM32\DRIVERS\UPDATE.SYS
usbccgp = C:\WINDOWS\SYSTEM32\DRIVERS\USBCCGP.SYS
usbehci = C:\WINDOWS\SYSTEM32\DRIVERS\USBEHCI.SYS
usbhub = C:\WINDOWS\SYSTEM32\DRIVERS\USBHUB.SYS
usbohci = C:\WINDOWS\SYSTEM32\DRIVERS\USBOHCI.SYS
usbprint = C:\WINDOWS\SYSTEM32\DRIVERS\USBPRINT.SYS
usbscan = C:\WINDOWS\SYSTEM32\DRIVERS\USBSCAN.SYS
USBSTOR = C:\WINDOWS\SYSTEM32\DRIVERS\USBSTOR.SYS
usbuhci = C:\WINDOWS\SYSTEM32\DRIVERS\USBUHCI.SYS
VgaSave = C:\WINDOWS\SYSTEM32\DRIVERS\VGA.SYS
ViaIde = C:\WINDOWS\SYSTEM32\DRIVERS\VIAIDE.SYS
viamraid = C:\WINDOWS\SYSTEM32\DRIVERS\VIAMRAID.SYS
viapdsk = C:\WINDOWS\SYSTEM32\DRIVERS\VIAPDSK.SYS
viaraid = C:\WINDOWS\SYSTEM32\DRIVERS\VIARAID.SYS
viasraid = C:\WINDOWS\SYSTEM32\DRIVERS\VIASRAID.SYS
vmscsi = C:\WINDOWS\SYSTEM32\DRIVERS\VMSCSI.SYS
VRVFW = C:\WINDOWS\SYSTEM32\VRVFW.SYS
Wanarp = C:\WINDOWS\SYSTEM32\DRIVERS\WANARP.SYS
wdmaud = C:\WINDOWS\SYSTEM32\DRIVERS\WDMAUD.SYS
XPROTECTOR = C:\WINDOWS\SYSTEM32\DRIVERS\XPROTECTOR.SYS

请上传可疑文件，而不是截图。