2006-12-02,17:08:23

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional  (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe>  [(Verified)Microsoft Corporation]
    <KavPFW><"F:\KAV2007\KPFW32.EXE">  [Kingsoft Corporation]
    <DesktopSprite><F:\DesktopSprite2\DesktopSprite.exe>  [SnowFox Studio.]
    <msnmsgr><"C:\Program Files\MSN Messenger\msnmsgr.exe" /background>  [(Verified)Microsoft Corporation]
    <KASStart><"C:\Program Files\Kingsoft\KSysCleaner\KASStart.EXE" -Startup>  [Kingsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <KavStart><"f:\KAV2007\KAVStart.exe" -startup>  [Kingsoft Corporation]
    <RAMDrive><"F:\FarStone\VDPPro\VHD\RDTask.exe">  []
    <VirtualDrive><F:\FarStone\VDPPro\VDP\vdtask.exe /AutoRestore /Silence>  [FarStone Technology Inc.]
    <InCD><F:\nero\Nero 7\InCD\InCD.exe>  [Nero AG]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    <KKDelay><C:\Program Files\Rising\AntiSpyware\RunOnce.exe>  [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><C:\WINDOWS\System32\Userinit.exe>  [(Verified)Microsoft Corporation]
    <UIHost><logonui.exe>  [(Verified)Microsoft Corporation]

==================================
启动文件夹
[AutoCAD 启动加速器]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\AutoCAD 启动加速器.lnk --> C:\PROGRA~1\COMMON~1\AUTODE~1\ACSTAR~1.EXE [Autodesk, Inc]><N>
[EPSON Status Monitor 3 Environment Check]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\EPSON Status Monitor 3 Environment Check.lnk --> C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [SEIKO EPSON CORPORATION]><N>

==================================
服务
[ASP.NET State Service / aspnet_state]
  <C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe><Microsoft Corporation>
[Autodesk Licensing Service / Autodesk Licensing Service]
  <"C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe"><Autodesk, Inc.>
[mpcsvc / bit-media service]
  <C:\WINDOWS\mpcsvc.exe><N/A>
[Canon Camera Access Library 8 / CCALib8]
  <C:\Program Files\Canon\CAL\CALMAIN.exe><Canon Inc.>
[EpsonBidirectionalService / EpsonBidirectionalService]
  <C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe><SEIKO EPSON CORPORATION>
[Human Interface Device Access / HidServ]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[IMAPI CD-Burning COM Service / ImapiService]
  <C:\WINDOWS\System32\imapi.exe><Microsoft Corporation>
[InCD Helper / InCDsrv]
  <F:\nero\Nero 7\InCD\InCDsrv.exe><Nero AG>
[Kingsoft Personal Firewall Service / KPfwSvc]
  <"f:\KAV2007\KPfwSvc.EXE"><Kingsoft Corporation>
[Kingsoft Antivirus KWatch Service / KWatchSvc]
  <f:\KAV2007\KWatch.EXE><Kingsoft Corporation>
[Machine Debug Manager / MDM]
  <"C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe"><Microsoft Corporation>
[NBService / NBService]
  <F:\nero\Nero 7\Nero BackItUp\NBService.exe><Nero AG>
[NVIDIA Driver Helper Service / NVSvc]
  <C:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation>

==================================

驱动程序
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc]
  <system32\drivers\ac97intc.sys><Intel Corporation>
[Aspi32 / Aspi32]
  <C:\WINDOWS\SYSTEM32\DRIVERS\Aspi32.SYS><Adaptec>
[DVDRC / DVDRC]
  <System32\drivers\DVDRC.sys><N/A>
[fcdabus / fcdabus]
  <System32\DRIVERS\fcdabus.sys><FarStone Inc.>
[RamDisk Drive Service / fsRamDsk]
  <System32\Drivers\fsRamDsk.sys><FarStone>
[FsUdf / FsUdf]
  <C:\WINDOWS\SYSTEM32\DRIVERS\FsUdf.SYS><Farstone Corporation>
[FVDSCSI / FVDSCSI]
  <System32\DRIVERS\fvdscsi.sys><FarStone Inc.>
[GMSIPCI / GMSIPCI]
  <\??\L:\INSTALL\GMSIPCI.SYS><N/A>
[IdeBusDr / IdeBusDr]
  <\SystemRoot\System32\DRIVERS\IdeBusDr.sys><Intel Corporation>
[Intel(r) Ultra ATA Controller / IdeChnDr]
  <\SystemRoot\System32\DRIVERS\IdeChnDr.sys><Intel Corporation>
[InCD File System / InCDfs]
  <system32\drivers\InCDFs.sys><Nero AG>
[InCDPass / InCDPass]
  <system32\drivers\InCDPass.sys><Nero AG>
[InCD Reader / incdrm]
  <system32\drivers\InCDRm.sys><Nero AG>
[KNetWch / KNetWch]
  <\??\f:\KAV2007\KNetWch.SYS><Kingsoft Corporation>
[KWatch3 / KWatch3]
  <\??\C:\WINDOWS\System32\drivers\KWatch3.SYS><Kingsoft Corporation>
[Logitech PS/2 Mouse Filter Driver / l8042pr2]
  <System32\DRIVERS\L8042Pr2.sys><Logitech, Inc.>
[Logitech Mouse Class Filter Driver / LMouFlt2]
  <System32\DRIVERS\LMouFlt2.sys><Logitech, Inc.>
[nv / nv]
  <System32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[nv4 / nv4]
  <System32\DRIVERS\nv4.sys><NVIDIA Corporation>
[Padus ASPI Shell / pfc]
  <system32\drivers\pfc.sys><Padus, Inc.>
[Direct Parallel Link Driver / Ptilink]
  <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware]
  <\SystemRoot\System32\drivers\RsBoot.sys><Beijing Rising>
[Realtek RTL8029(AS)-based PCI Ethernet Adapter NT Driver / rtl8029]
  <System32\DRIVERS\RTL8029.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv]
  <System32\DRIVERS\secdrv.sys><N/A>
[Sentinel / Sentinel]
  <\SystemRoot\System32\Drivers\SENTINEL.SYS><N/A>
[SIEMENS Serial port driver / Ser2pl]
  <System32\DRIVERS\ser2pl.sys><Prolific Technology Inc.>
[SmartCd / SmartCd]
  <System32\Drivers\SmartCd.sys><N/A>
[SVKP / SVKP]
  <\??\C:\WINDOWS\System32\SVKP.sys><AntiCracking>
[U3sHlpDr / U3sHlpDr]
  <\??\C:\WINDOWS\System32\Drivers\U3sHlpDr.sys><N/A>

==================================
浏览器加载项
[Thunder Browser Helper]
  {06849E9E-C8D7-4D59-B87D-784B7D6BE0B3} <F:\Thunder\ComDlls\XunLeiBHO_004.dll, Thunder Networking Technologies,LTD>
[AcroIEHlprObj Class]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <F:\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[CBrowseStakeout Class]
  {55302805-482E-470E-8A57-6795A1487F90} <f:\KAV2007\KAVAFish.DLL, Kingsoft Corporation>
[启动迅雷5]
  {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <f:\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[金山词霸]
  {9A687CA6-D585-4947-9ED9-BE96071F5CD9} <, N/A>
[快车]
  {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <F:\PROGRA~1\FLASHGET\flashget.exe, FlashGet.com>
[Edit Class]
  {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\WINDOWS\System32\CMBEdit.dll, >
[MSN Photo Upload Tool]
  {4F1E5B1A-2A80-42CA-8532-2D05CB959537} <C:\WINDOWS\Downloaded Program Files\MsnPUpld.dll, Microsoft? Corporation>
[金山毒霸在线产品升级]
  {52DF16E3-6C4F-4B22-8BAF-09263E463B48} <C:\WINDOWS\System32\kingsoft\KOS\KOSInit.ocx, 金山软件股份有限公司>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[&使用快车(FlashGet)下载]
  <F:\Program Files\FlashGet\jc_link.htm, N/A>
[&使用快车(FlashGet)下载全部链接]
  <F:\Program Files\FlashGet\jc_all.htm, N/A>
[&使用迅雷下载]
  <F:\Thunder\Program\geturl.htm, N/A>
[&使用迅雷下载全部链接]
  <F:\Thunder\Program\getallurl.htm, N/A>
[使用超级解霸播放]
  <f:\Herosoft\Hero 9\MPURLGET.HTM, N/A>
[金山毒霸反钓鱼...]
  <f:\KAV2007\KAF\ShowSet.htm, N/A>

==================================
正在运行的进程
[PID: 452][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 520][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 544][\??\C:\WINDOWS\SYSTEM32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 588][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 600][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 760][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 808][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 920][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 976][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1040][f:\KAV2007\KWatch.EXE]  [Kingsoft Corporation, 2005, 9, 27, 51]
    [f:\KAV2007\KAVIPC2.DLL]  [Kingsoft Corporation, 2004, 12, 28, 20]
    [f:\KAV2007\KAEPlat.DLL]  [Kingsoft Corp., 2006, 8, 29, 60]
    [f:\KAV2007\KAEMem.DAT]  [Kingsoft, 2006, 9, 25, 16]
    [f:\KAV2007\KAEUnpack.DAT]  [Kingsoft Corp., 2006, 10, 26, 69]
[PID: 1104][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [C:\WINDOWS\System32\AdobePDF.dll]  [Adobe Systems Incorporated., 6.0.000]
    [F:\Adobe\Acrobat 6.0\Distillr\AdistRes.CHS]  [N/A, N/A]
    [C:\WINDOWS\system32\APFMON40.DLL]  [TurboPower Software Company, 4.05.0.0]
    [C:\WINDOWS\system32\apfaxcnv.dll]  [TurboPower Software Company, 4.05.0.0]
    [C:\WINDOWS\system32\E_SL2037.DLL]  [SEIKO EPSON CORPORATION, 2, 11, 0, 0]
    [C:\WINDOWS\system32\E_SL2351.DLL]  [SEIKO EPSON CORPORATION, 2, 27, 0, 0]
    [C:\WINDOWS\system32\E_SL2407.DLL]  [SEIKO EPSON CORPORATION, 3, 8, 0, 0]
[PID: 1328][C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe]  [SEIKO EPSON CORPORATION, 2.2.1.0]
    [C:\WINDOWS\SYSTEM32\eEBUtil.dll]  [SEIKO EPSON CORPORATION, 2.2.1.0]
    [C:\Program Files\Common Files\EPSON\EBAPI\eEBRSVC.dll]  [SEIKO EPSON CORPORATION, 2.2.1.0]
    [C:\Program Files\Common Files\EPSON\EBAPI\eEBLPDev.dll]  [SEIKO EPSON CORPORATION, 2.2.1.0]
    [C:\Program Files\Common Files\EPSON\EBAPI\eEBIPDev.dll]  [SEIKO EPSON CORPORATION, 2.2.1.0]
    [C:\Program Files\Common Files\EPSON\EBAPI\eEBNWDev.dll]  [SEIKO EPSON CORPORATION, 2.2.1.0]
    [C:\Program Files\Common Files\EPSON\EBAPI\eEBMSDev.dll]  [SEIKO EPSON CORPORATION, 2.2.1.0]
    [C:\Program Files\Common Files\EPSON\EBAPI\EBPLPT.DLL]  [SEIKO EPSON CORPORATION, 3, 7, 0, 0]
[PID: 1488][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1604][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2600.0000 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\AcSignIcon.dll]  [Autodesk, 16.1.63.0]
    [C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll]  [Autodesk, 16.1.63.0]
    [F:\KAV2007\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [F:\KAV2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 9, 7, 132]
    [C:\Program Files\Common Files\Ahead\Lib\AdvrCntr2.dll]  [Nero AG, 5,10,1, 8600]
    [F:\KAV2007\KAScript.DLL]  [Kingsoft Corporation, 2006, 11, 13, 70]
    [F:\KAV2007\KAEPlat.DLL]  [Kingsoft Corp., 2006, 8, 29, 60]
    [F:\KAV2007\KAEMem.DAT]  [Kingsoft, 2006, 9, 25, 16]
    [F:\KAV2007\KAEUnpack.DAT]  [Kingsoft Corp., 2006, 10, 26, 69]
    [C:\WINDOWS\System32\cspyii.ime]  [中文之星, 1, 0, 0, 1]
    [C:\WINDOWS\System32\cspyii.dll]  [N/A, N/A]
    [F:\Adobe\Acrobat 6.0\Acrobat Elements\ContextMenu.chs]  [Adobe Systems Inc., 1.0.0.2003051500]
    [F:\Thunder\ComDlls\XunLeiBHO_004.dll]  [Thunder Networking Technologies,LTD, 5, 0, 0, 3]
    [F:\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll]  [Adobe Systems Incorporated, 6.0.0.2003051500]
[PID: 1684][F:\KAV2007\KAVStart.exe]  [Kingsoft Corporation, 2006, 9, 7, 210]
    [F:\KAV2007\KAVIPC2.DLL]  [Kingsoft Corporation, 2004, 12, 28, 20]
    [F:\KAV2007\SvcTimer.DLL]  [Kingsoft Corporation, 2006.7.24.80]
    [F:\KAV2007\KAVPassp.dll]  [Kingsoft Corporation, 2006, 9, 7, 270]
    [F:\KAV2007\PopSprt3.dll]  [Kingsoft Corporation, 2006, 9, 26, 38]
    [F:\KAV2007\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [F:\KAV2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 9, 7, 132]
[PID: 1712][F:\FarStone\VDPPro\VHD\RDTask.exe]  [, 1, 0, 0, 1]
    [F:\FarStone\VDPPro\VHD\FsLodLib.dll]  [, 1, 0, 0, 1]
    [F:\FarStone\VDPPro\VHD\RDrvInterface.dll]  [, 1, 0, 0, 1]
    [F:\FarStone\VDPPro\VHD\RDTask_RC.dll]  [, 1, 0, 0, 1]
    [F:\FarStone\VDPPro\VHD\RDrv2KInterface.dll]  [, 1, 0, 0, 1]
    [F:\KAV2007\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
[PID: 1752][F:\nero\Nero 7\InCD\InCD.exe]  [Nero AG, 5, 5, 0, 5]
    [F:\nero\Nero 7\InCD\InCDgui.dll]  [Nero AG, 5, 5, 0, 5]
    [C:\Program Files\Common Files\Ahead\Lib\AdvrCntr2.dll]  [Nero AG, 5,10,1, 8600]
    [F:\KAV2007\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [F:\KAV2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 9, 7, 132]
    [F:\nero\Nero 7\InCD\InCDAPI2.dll]  [Nero AG, 5, 5, 0, 5]
[PID: 1760][C:\WINDOWS\System32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [F:\KAV2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 9, 7, 132]
    [F:\KAV2007\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
[PID: 1772][F:\KAV2007\KPFW32.EXE]  [Kingsoft Corporation, 2006, 11, 15, 659]
    [F:\KAV2007\KAVIPC2.DLL]  [Kingsoft Corporation, 2004, 12, 28, 20]
    [F:\KAV2007\KAConfig.DLL]  [Kingsoft Corporation, 2006, 10, 30, 39]
    [F:\KAV2007\FiltList.dll]  [N/A, N/A]
    [F:\KAV2007\KAVPassp.DLL]  [Kingsoft Corporation, 2006, 9, 7, 270]
    [F:\KAV2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 9, 7, 132]
    [F:\KAV2007\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [C:\WINDOWS\System32\AcSignIcon.dll]  [Autodesk, 16.1.63.0]
    [F:\KAV2007\KAScript.DLL]  [Kingsoft Corporation, 2006, 11, 13, 70]
[PID: 1816][F:\nero\Nero 7\InCD\InCDsrv.exe]  [Nero AG, 5, 5, 0, 5]
    [C:\Program Files\Common Files\Ahead\Lib\AdvrCntr2.dll]  [Nero AG, 5,10,1, 8600]
    [C:\Program Files\Common Files\Ahead\Lib\DriveLocker.dll]  [Nero AG, 1, 0, 0, 18]
    [F:\nero\Nero 7\InCD\incdshx.dll]  [Nero AG, 5, 5, 0, 5]
[PID: 1824][F:\DesktopSprite2\DesktopSprite.exe]  [SnowFox Studio., 2.7.0.54]
    [F:\KAV2007\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [F:\KAV2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 9, 7, 132]
[PID: 1848][F:\KAV2007\KMailMon.EXE]  [Kingsoft Corporation, 2006, 9, 7, 918]
    [F:\KAV2007\KAntiSpm.dll]  [Kingsoft Corporation, 2006, 8, 19, 104]
    [F:\KAV2007\KAVIPC2.DLL]  [Kingsoft Corporation, 2004, 12, 28, 20]
    [F:\KAV2007\KAECall2.DLL]  [Kingsoft Corporation, 2004, 12, 28, 7]
    [F:\KAV2007\KAEPlat.DLL]  [Kingsoft Corp., 2006, 8, 29, 60]
    [F:\KAV2007\KAEMem.DAT]  [Kingsoft, 2006, 9, 25, 16]
    [F:\KAV2007\KAEUnpack.DAT]  [Kingsoft Corp., 2006, 10, 26, 69]
    [F:\KAV2007\KAConfig.DLL]  [Kingsoft Corporation, 2006, 10, 30, 39]
    [F:\KAV2007\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [F:\KAV2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 9, 7, 132]
[PID: 1872][C:\Program Files\MSN Messenger\msnmsgr.exe]  [Microsoft Corporation, 8.0.0812.00]
    [F:\KAV2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 9, 7, 132]
    [F:\KAV2007\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [C:\WINDOWS\System32\msdmo.dll]  [N/A, N/A]
[PID: 1876][f:\KAV2007\KPfwSvc.EXE]  [Kingsoft Corporation, 2005, 9, 5, 28]
[PID: 1908][C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe]  [Microsoft Corporation, 7.00.9064.9150]
[PID: 1920][C:\Program Files\Kingsoft\KSysCleaner\KASStart.EXE]  [Kingsoft Corporation, 2006, 11, 22, 14]
    [F:\KAV2007\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [F:\KAV2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 9, 7, 132]
[PID: 2044][C:\WINDOWS\System32\nvsvc32.exe]  [NVIDIA Corporation, 6.13.10.2832]
[PID: 280][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 284][C:\WINDOWS\System32\wdfmgr.exe]  [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[PID: 1536][C:\Program Files\Canon\CAL\CALMAIN.exe]  [Canon Inc., 8, 2, 0, 1]
[PID: 2832][F:\Maxthon\Maxthon.exe]  [Maxthon International Ltd., 1, 5, 8, 120]
    [F:\Maxthon\maxzlib.dll]  [ , 1, 0, 0, 2]
    [F:\KAV2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 9, 7, 132]
    [F:\KAV2007\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [C:\WINDOWS\System32\AcSignIcon.dll]  [Autodesk, 16.1.63.0]
    [F:\Maxthon\Plugin\FloatBar\FloatBar.dll]  [, 1, 8, 0, 0]
    [f:\KAV2007\KAVAFish.DLL]  [Kingsoft Corporation, 2006, 10, 25, 27]
    [F:\Maxthon\Services\RealTime\real_time.dll]  [, 1, 0, 0, 1]
    [F:\KAV2007\KAScript.DLL]  [Kingsoft Corporation, 2006, 11, 13, 70]
    [F:\KAV2007\KAEPlat.DLL]  [Kingsoft Corp., 2006, 8, 29, 60]
    [F:\KAV2007\KAEMem.DAT]  [Kingsoft, 2006, 9, 25, 16]
    [F:\KAV2007\KAEUnpack.DAT]  [Kingsoft Corp., 2006, 10, 26, 69]
    [C:\WINDOWS\System32\cspyii.ime]  [中文之星, 1, 0, 0, 1]
    [C:\WINDOWS\System32\cspyii.dll]  [N/A, N/A]

[PID: 2684][F:\Thunder\Program\Thunder5.exe]  [Thunder Networking Technologies,LTD, 5, 5, 2, 252]
    [F:\KAV2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 9, 7, 132]
    [F:\KAV2007\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [F:\Thunder\Program\TaskManager.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 10]
    [F:\Thunder\Program\download_interface.dll]  [Thunder Networking Technologies,LTD, 2, 11, 2, 22]
    [F:\Thunder\Program\stlport_vc646.dll]  [STLport Consulting, Inc., 4.6.2003.1031]
    [F:\Thunder\Program\log4cplus.dll]  [, 1, 0, 2, 1]
    [F:\Thunder\Program\asyn_dns.dll]  [Thunder Networking Technologies,LTD, 2, 11, 2, 22]
    [F:\Thunder\Program\iTargetAD.dll]  [Thunder Networking Technologies,LTD, 1, 0, 2, 12]
    [F:\Thunder\Program\BHOStub.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 8]
    [C:\WINDOWS\System32\Macromed\Flash\Flash9.ocx]  [Adobe Systems, Inc., 9,0,16,0]
    [F:\Thunder\Components\DTAG\DTAG.dll]  [, 1, 0, 0, 1]
    [F:\Thunder\Program\LiveUpdate.dll]  [, 1, 0, 0, 9]
    [F:\Thunder\Program\UpdateDownload.dll]  [Thunder Networking Technologies,LTD, 1, 0, 1, 8]
    [F:\Thunder\Components\InMedia\iEmbedShell.dll]  [　, 1, 0, 0, 14]
    [f:\Thunder\Components\InMedia\iEmbed07.dll]  [　, 3, 1, 0, 58]
    [F:\Thunder\Components\Community\XLCommunity.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 10]
    [F:\Thunder\Program\RegisterDll.dll]  [Thunder Networking Technologies,LTD, 2, 2, 1, 42]
    [F:\Thunder\Components\Search\XLSearch.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
    [F:\Thunder\Components\P4PClient\P4PClient.dll]  [Thunder Networking Technologies,LTD, 1, 0, 2, 3]
    [F:\Thunder\Plugins\BhoAdv\bho_adv.dll]  [深圳市迅雷网络技术有限公司, 1.0.1.0]
    [F:\Thunder\Program\msgmanage.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 15]
    [C:\WINDOWS\System32\AcSignIcon.dll]  [Autodesk, 16.1.63.0]
    [F:\KAV2007\KAScript.DLL]  [Kingsoft Corporation, 2006, 11, 13, 70]
    [F:\KAV2007\KAEPlat.DLL]  [Kingsoft Corp., 2006, 8, 29, 60]
    [F:\KAV2007\KAEMem.DAT]  [Kingsoft, 2006, 9, 25, 16]
    [F:\KAV2007\KAEUnpack.DAT]  [Kingsoft Corp., 2006, 10, 26, 69]
[PID: 3028][G:\software\系统检测工具\检测工具二SREng\SREng2\SREng.exe]  [Smallfrogs Studio, 2.2.6.605]
    [F:\KAV2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 9, 7, 132]
    [F:\KAV2007\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
[PID: 2440][C:\WINDOWS\system32\mmc.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [F:\KAV2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 9, 7, 132]
    [F:\KAV2007\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [F:\KAV2007\KAScript.DLL]  [Kingsoft Corporation, 2006, 11, 13, 70]
    [F:\KAV2007\KAEPlat.DLL]  [Kingsoft Corp., 2006, 8, 29, 60]
    [F:\KAV2007\KAEMem.DAT]  [Kingsoft, 2006, 9, 25, 16]
    [F:\KAV2007\KAEUnpack.DAT]  [Kingsoft Corp., 2006, 10, 26, 69]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
N/A

==================================

运行(双击)SRENG2，点“启动项目，服务，点“Win32服务应用程序”
勾选“隐藏微软服务”选中病毒服务
mpcsvc
，选择“删除服务”
点“设置”选择“否”

运行SREng2,使用“启动项目”－－浏览器加载项－－删除
[Edit Class]
{0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\WINDOWS\System32\CMBEdit.dll, >


重启按F８进入安全模式下
显示隐藏文件
删除：   
C:\WINDOWS\mpcsvc.exe
C:\WINDOWS\System32\CMBEdit.dll