==============================================================
        金山清理专家系统诊断报告

该诊断报告由金山清理专家提供 http://www.duba.net 
==============================================================

诊断时间:            2008-12-06, 09:21 
诊断平台:            Windows XP [5.1.2600] Service Pack 2 
IE版本:              Internet Explorer V7.0.13.5730 
计算机物理内存:      2046(MB) 
当前可用内存:        1539(MB) 
硬盘总大小:          67(GB) 
硬盘可用空间:        24(GB) 
清理专家版本:        2008.06.13.404 
恶意软件库版本:         0.00.00.0 
漏洞库版本:             0.00.00.0 




==============================================================
        映像劫持
==============================================================

该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

        <anti.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <antivir.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <atrack.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <avk.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <avxonsol.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <DAVPFW.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <dbg.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <debu.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <explorewclass.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <fir.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <ice.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <iom.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <Kabackreport.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <KRF.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <KVPreScan.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <lamapp.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <mcafee.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <microsoft.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <mon.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <moniker.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <ms.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <N32ACAN.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <norton.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <pcc.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <PCCClient.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <pccguide.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <PpPpWallRun.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <program.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <prot.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <rescue32.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <Rfw.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <rn.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <scam32.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <scan.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <scon.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <secu.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <sirc32.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <smtpsvc.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <spy.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <symproxysvc.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <Thunder5.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <Tmntsrv.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <TMOAgent.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <tmproxy.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <tmupdito.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <TSC.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <UlibCfg.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <vavrunr.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <vir.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <VSSCAN40>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <webtrap.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <windows优化大师.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

        <wink.exe>        <svchost.exe>
        文件路径: C:\WINDOWS\system32\svchost.exe [可疑的] [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]


==============================================================
        常规启动项
==============================================================

该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

        [hxgame-update]       <C:\Program Files\hxupdate\hxgame-update.exe>

        [vmware-tray]         <; "C:\Program Files\VMware\VMware Workstation\vmware-tray.exe">


==============================================================
        执行挂钩
==============================================================

该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

        <{EA44A26D-DDC8-46C0-AFE1-A529FE014E3F}>            <EA44A26D.dll>

--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

        <{D82C0336-583E-468B-B46A-0897FAB9D5A2}>            <D82C0336.dll>


==============================================================
        启动文件夹位置
==============================================================

Common Startup:      C:\Documents and Settings\All Users\「开始」菜单\程序\启动
Startup:             C:\Documents and Settings\123\「开始」菜单\程序\启动
Common Startup:      %ALLUSERSPROFILE%\「开始」菜单\程序\启动

==============================================================
        Host File
==============================================================

127.0.0.1 www.360.cn
127.0.0.1 www.360safe.cn
127.0.0.1 www.360safe.com
127.0.0.1 www.chinakv.com
127.0.0.1 www.rising.com.cn
127.0.0.1 rising.com.cn
127.0.0.1 dl.jiangmin.com
127.0.0.1 jiangmin.com
127.0.0.1 www.jiangmin.com
127.0.0.1 www.duba.net
127.0.0.1 www.eset.com.cn
127.0.0.1 www.nod32.com
127.0.0.1 shadu.duba.net
127.0.0.1 union.kingsoft.com
127.0.0.1 www.kaspersky.com.cn
127.0.0.1 kaspersky.com.cn
127.0.0.1 virustotal.com
127.0.0.1 www.kaspersky.com
127.0.0.1 www.cnnod32.cn
127.0.0.1 www.lanniao.org
127.0.0.1 www.nod32club.com
127.0.0.1 www.dswlab.com
127.0.0.1 bbs.sucop.com
127.0.0.1 www.virustotal.com
127.0.0.1 tool.ikaka.com
127.0.0.1 360.qihoo.com

==============================================================
        BHO
==============================================================

该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

        [urlmon Class]
        {FFFFEECE-FF18-8222-2FB0-2935B9EA0723}  <C:\WINDOWS\system32\1031\urlmon.dll>


==============================================================
        当前进程
==============================================================

名称:     SREngLdr.EXE  [已启用]
命令行:   "F:\红头发BIJI\sreng2\SREngLdr.EXE" 
文件路径: F:\红头发BIJI\sreng2\SREngLdr.EXE  [文件无法访问]
模块文件: C:\WINDOWS\system32\ntdll.dll                 (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\kernel32.dll              (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\ADVAPI32.dll              (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\RPCRT4.dll                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\Secur32.dll               (Microsoft Corporation)
模块文件: C:\Program Files\Rising\Rfw\ijt_base.dll      (Beijing Rising Information Technology Co.. Ltd.)
模块文件: C:\WINDOWS\system32\SHELL32.dll               (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\GDI32.dll                 (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\USER32.dll                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\msvcrt.dll                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\SHLWAPI.dll               (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\IMM32.DLL                 (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\LPK.DLL                   (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\USP10.dll                 (Microsoft Corporation)
模块文件: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)
模块文件: C:\Program Files\Rising\Rfw\olemon.dll        (Beijing Rising Information Technology Co.. Ltd.)
模块文件: C:\WINDOWS\system32\Apphelp.dll               (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\version.dll               (Microsoft Corporation)

名称:     金-山-诊-断及粉-碎-器.exe  [已启用]
命令行:   "F:\红头发BIJI\金山\金-山-诊-断及粉-碎-器.exe" 
文件路径: F:\红头发BIJI\金山\金-山-诊-断及粉-碎-器.exe  [未知]
模块文件: C:\WINDOWS\system32\ntdll.dll                 (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\kernel32.dll              (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\ADVAPI32.DLL              (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\RPCRT4.dll                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\Secur32.dll               (Microsoft Corporation)
模块文件: C:\WINDOWS\WinSxS\X86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\COMCTL32.DLL (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\msvcrt.dll                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\GDI32.dll                 (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\USER32.dll                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\SHLWAPI.dll               (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\COMDLG32.DLL              (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\SHELL32.dll               (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\OLE32.DLL                 (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\IMM32.DLL                 (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\LPK.DLL                   (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\USP10.dll                 (Microsoft Corporation)
模块文件: C:\Program Files\Rising\Rfw\ijt_base.dll      (Beijing Rising Information Technology Co.. Ltd.)
模块文件: C:\Program Files\Rising\Rfw\olemon.dll        (Beijing Rising Information Technology Co.. Ltd.)
模块文件: C:\WINDOWS\system32\riched32.dll              (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\RICHED20.dll              (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\uxtheme.dll               (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\MSCTF.dll                 (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\msctfime.ime              (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\netapi32.dll              (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\SETUPAPI.dll              (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\appHelp.dll               (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\CLBCATQ.DLL               (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\COMRes.dll                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\OLEAUT32.dll              (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\VERSION.dll               (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\urlmon.dll                (Microsoft Corporation)
模块文件: C:\WINDOWS\system32\iertutil.dll              (Microsoft Corporation)