[CODE]

2007-03-02,13:33:15

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows Server 2003 Enterprise Edition  (Build 3790)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Corporation]
    <g3kl><C:\WINDOWS\servicer.exe>  [N/A]
    <mdb2jl2g><C:\WINDOWS\c0nima.exe>  [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Corporation]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Corporation]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Corporation]
    <MSPY2002><C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC>  [(Verified)N/A]
    <InternetEx><C:\WINDOWS\system\inetinf.exe>  [N/A]
    <upxdnd><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\upxdnd.exe>  [N/A]
    <cmdbcs><C:\WINDOWS\cmdbcs.exe>  [N/A]
    <Internet><C:\WINDOWS\system\svchosi.exe>  [N/A]
    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot>  [RealNetworks, Inc.]
    <ShStatEXE><"C:\Program Files\ePOPlice\SHSTAT.EXE" /STANDALONE>  [(Verified)McAfee, Inc.]
    <McAfeeUpdaterUI><"C:\Program Files\Common Framework\UdaterUI.exe" /StartedFromRunKey>  [(Verified)McAfee, Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    <internet><C:\WINDOWS\system\taskmgr.exe /scan>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><%SystemRoot%\system32\logonui.exe>  [(Verified)Microsoft Corporation]

==================================
服务
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[McAfee Framework Service / McAfeeFramework][Running/Auto Start]
  <"C:\Program Files\Common Framework\FrameworkService.exe" /ServiceStart><McAfee, Inc.>
[McAfee McShield / McShield][Running/Auto Start]
  <"C:\Program Files\ePOPlice\Mcshield.exe"><McAfee, Inc.>
[McAfee Task Manager / McTaskManager][Running/Auto Start]
  <"C:\Program Files\ePOPlice\VsTskMgr.exe"><McAfee, Inc.>

==================================
驱动程序
[AliIde / AliIde][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\aliide.sys><Acer Laboratories Inc.>
[CmdIde / CmdIde][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\cmdide.sys><CMD Technology, Inc.>
[IP in IP Tunnel Driver / IpInIp][Stopped/Manual Start]
  <system32\DRIVERS\ipinip.sys><N/A>
[MegaIDE / MegaIDE][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\MegaIDE.sys><LSI Logic Corporation.>
[McAfee Inc. / mfeapfk][Running/Manual Start]
  <system32\drivers\mfeapfk.sys><McAfee, Inc.>
[McAfee Inc. / mfeavfk][Running/Manual Start]
  <system32\drivers\mfeavfk.sys><McAfee, Inc.>
[McAfee Inc. / mfebopk][Running/Manual Start]
  <system32\drivers\mfebopk.sys><McAfee, Inc.>
[McAfee Inc. / mfehidk][Running/Manual Start]
  <system32\drivers\mfehidk.sys><McAfee, Inc.>
[VSCore mferkdk / mferkdk][Running/System Start]
  <\??\C:\Program Files\ePOPlice\mferkdk.sys><McAfee, Inc.>
[McAfee Inc. / mfetdik][Running/System Start]
  <system32\drivers\mfetdik.sys><McAfee, Inc.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>

==================================
浏览器加载项
[Flash 9b]
  {492B8F66-B8CF-4F7A-B0EE-B7383B92F5BA} <C:\WINDOWS\system\IceHBO.dll, N/A>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[Update Class]
  {9F1C11AA-197B-4942-BA54-47A8489BB47F} <C:\WINDOWS\system32\iuctl.dll, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>

=================================
正在运行的进程
[PID: 376][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 432][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 456][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 500][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 512][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 644][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 708][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 848][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 880][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 892][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1028][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1056][C:\WINDOWS\system32\msdtc.exe]  [Microsoft Corporation, 2001.12.4720.0 (srv03_rtm.030324-2048)]
[PID: 1184][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1208][C:\Program Files\Common Framework\FrameworkService.exe]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\nailog.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\naXML71.dll]  [N/A, N/A]
    [C:\Program Files\Common Framework\NaiSign.DLL]  [N/A, N/A]
    [C:\WINDOWS\system32\epoPGPSDK.dll]  [PGP Corporation, 3.5.3]
    [C:\Program Files\Common Framework\naCmnLib71.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\applib.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\0409\AgentRes.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\Logging.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\InternetManager.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\naInet.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\UserSpace.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\SecureFrameworkFactory.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\Management.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\cmalib.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\naPolicyManager.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\ScriptSubSys.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\UpdateSubSys.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\Scheduler.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\TCSubSys.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\GenEvtInf.dll]  [McAfee, Inc., 3.6.0.453]
[PID: 1292][C:\Program Files\ePOPlice\Mcshield.exe]  [McAfee, Inc., VSCORE.13.3.1.100.x86]
    [C:\Program Files\ePOPlice\LockDown.dll]  [McAfee, Inc., VSCORE.13.3.1.100.x86]
    [C:\Program Files\ePOPlice\mytilus.dll]  [McAfee, Inc., VSCORE.13.3.1.100.x86]
    [C:\Program Files\ePOPlice\mytilus2.dll]  [McAfee, Inc., VSCORE.13.3.1.100.x86]
    [C:\Program Files\ePOPlice\RES0402\McShield.dll]  [McAfee, Inc., VSCORE.13.3.1.100]
    [C:\Program Files\ePOPlice\FTL.Dll]  [McAfee, Inc., VSCORE.13.3.1.100.x86]
    [C:\Program Files\ePOPlice\naiann.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\VsEvntUI.dll]  [N/A, N/A]
    [C:\Program Files\ePOPlice\NAEvent.dll]  [McAfee, Inc., VSCORE.13.3.1.100.x86]
    [C:\Program Files\ePOPlice\shutil.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\wmain.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\Common Framework\GenEvtInf.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\SecureFrameworkFactory.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\ePOPlice\scriptsv.dll]  [McAfee, Inc., VSCORE.13.3.1.100.x86]
    [C:\Program Files\ePOPlice\mfebopa.dll]  [McAfee, Inc., SYSCORE.13.3.0.116.x86]
    [C:\Program Files\ePOPlice\mfehida.dll]  [McAfee, Inc., SYSCORE.13.3.0.116.x86]
    [C:\Program Files\ePOPlice\mfeapfa.dll]  [McAfee, Inc., SYSCORE.13.3.0.116.x86]
    [C:\Program Files\ePOPlice\mfeavfa.dll]  [McAfee, Inc., SYSCORE.13.3.0.116.x86]
    [C:\Program Files\Common Files\McAfee\Engine\mcscan32.dll]  [McAfee, Inc., 5.1.00]

[PID: 1320][C:\Program Files\ePOPlice\VsTskMgr.exe]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\LockDown.dll]  [McAfee, Inc., VSCORE.13.3.1.100.x86]
    [C:\Program Files\ePOPlice\mytilus2.dll]  [McAfee, Inc., VSCORE.13.3.1.100.x86]
    [C:\Program Files\ePOPlice\mytilus.dll]  [McAfee, Inc., VSCORE.13.3.1.100.x86]
    [C:\Program Files\ePOPlice\shutil.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\wmain.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\condl.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\RES0402\McShield.dll]  [McAfee, Inc., VSCORE.13.3.1.100]
    [C:\Program Files\ePOPlice\MIDUtil.Dll]  [McAfee, Inc., 8.5.0.148]
    [C:\Program Files\ePOPlice\BBCpl.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\coptcpl.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\EmCfgCpl.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\nvpcpl.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\ftcfg.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\OASCpl.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\QuarCpl.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\vsodscpl.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\VsEvntUI.dll]  [N/A, N/A]
    [C:\Program Files\ePOPlice\NAEvent.dll]  [McAfee, Inc., VSCORE.13.3.1.100.x86]
    [C:\Program Files\ePOPlice\ftl.dll]  [McAfee, Inc., VSCORE.13.3.1.100.x86]
    [C:\Program Files\ePOPlice\vsupdcpl.dll]  [McAfee, Inc., 8.5.0.781]
[PID: 1408][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1404][C:\Program Files\Common Framework\naPrdMgr.exe]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\NaiSign.DLL]  [N/A, N/A]
    [C:\WINDOWS\system32\epoPGPSDK.dll]  [PGP Corporation, 3.5.3]
    [C:\Program Files\Common Framework\naXML71.dll]  [N/A, N/A]
    [C:\Program Files\Common Framework\nailog.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\naCmnLib71.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\applib.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\0409\AgentRes.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\ePOPlice\VsPlugin.dll]  [McAfee, Inc., 8.5.0.781]
[PID: 1448][C:\WINDOWS\system32\Dfssvc.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1756][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.3790.0 (srv03_rtm.030324-2048)]
    [C:\WINDOWS\system32\cmdbcs.dll]  [N/A, N/A]
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\upxdnd.dll]  [N/A, N/A]
    [C:\SysDayN\Ghook.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\Gjzos.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\Qqzos.dll]  [N/A, N/A]
    [C:\SysWsj\Ghook.dll]  [N/A, N/A]
    [C:\Program Files\Common Framework\JrMac.dll]  [McAfee, Inc., 1.0.0.125]
    [C:\Program Files\ePOPlice\shext.dll]  [McAfee, Inc., 8.5.0.781]
[PID: 1812][C:\WINDOWS\system\taskmgr.exe]  [N/A, N/A]
    [C:\SysWsj\Ghook.dll]  [N/A, N/A]
    [C:\SysDayN\Ghook.dll]  [N/A, N/A]
[PID: 1856][C:\WINDOWS\system\inetinf.exe]  [N/A, N/A]
    [C:\SysWsj\Ghook.dll]  [N/A, N/A]
    [C:\SysDayN\Ghook.dll]  [N/A, N/A]
[PID: 1900][C:\WINDOWS\system\svchosi.exe]  [N/A, N/A]
    [C:\SysDayN\Ghook.dll]  [N/A, N/A]
    [C:\SysWsj\Ghook.dll]  [N/A, N/A]
[PID: 1908][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.1622]
    [C:\SysWsj\Ghook.dll]  [N/A, N/A]
    [C:\SysDayN\Ghook.dll]  [N/A, N/A]

[PID: 1932][C:\Program Files\ePOPlice\SHSTAT.EXE]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\LockDown.dll]  [McAfee, Inc., VSCORE.13.3.1.100.x86]
    [C:\Program Files\ePOPlice\ftcfg.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\mytilus2.dll]  [McAfee, Inc., VSCORE.13.3.1.100.x86]
    [C:\Program Files\ePOPlice\mytilus.dll]  [McAfee, Inc., VSCORE.13.3.1.100.x86]
    [C:\Program Files\ePOPlice\wmain.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\shutil.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\Program Files\ePOPlice\RES0402\McShield.dll]  [McAfee, Inc., VSCORE.13.3.1.100]
    [C:\Program Files\ePOPlice\Graphics.dll]  [McAfee, Inc., 8.5.0.781]
    [C:\SysWsj\Ghook.dll]  [N/A, N/A]
    [C:\SysDayN\Ghook.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\Gjzos.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\Qqzos.dll]  [N/A, N/A]
[PID: 1948][C:\Program Files\Common Framework\UdaterUI.exe]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\nailog.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\naCmnLib71.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\naXML71.dll]  [N/A, N/A]
    [C:\Program Files\Common Framework\NaiSign.DLL]  [N/A, N/A]
    [C:\WINDOWS\system32\epoPGPSDK.dll]  [PGP Corporation, 3.5.3]
    [C:\Program Files\Common Framework\applib.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\cmalib.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\0409\UpdRes.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\0409\AgentRes.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\Program Files\Common Framework\SecureFrameworkFactory.dll]  [McAfee, Inc., 3.6.0.453]
    [C:\SysWsj\Ghook.dll]  [N/A, N/A]
    [C:\SysDayN\Ghook.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\Gjzos.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\Qqzos.dll]  [N/A, N/A]
[PID: 1956][C:\SysWsj\svchost.exe]  [N/A, N/A]
    [C:\SysWsj\Ghook.dll]  [N/A, N/A]
[PID: 1968][C:\SysDayN\svchost.exe]  [N/A, N/A]
    [C:\SysDayN\Ghook.dll]  [N/A, N/A]
[PID: 1992][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
    [C:\SysWsj\Ghook.dll]  [N/A, N/A]
    [C:\SysDayN\Ghook.dll]  [N/A, N/A]
[PID: 2000][C:\Program Files\Common Framework\McTray.exe]  [McAfee, Inc., 1.0.0.125]
    [C:\Program Files\Common Framework\JrMac.dll]  [McAfee, Inc., 1.0.0.125]
    [C:\SysWsj\Ghook.dll]  [N/A, N/A]
    [C:\SysDayN\Ghook.dll]  [N/A, N/A]
[PID: 188][C:\WINDOWS\servicer.exe]  [N/A, N/A]
    [C:\WINDOWS\system32\Qqzos.dll]  [N/A, N/A]
[PID: 252][C:\WINDOWS\c0nime.exe]  [N/A, N/A]
    [C:\WINDOWS\system32\Gjzos.dll]  [N/A, N/A]
[PID: 1836][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
    [C:\SysWsj\Ghook.dll]  [N/A, N/A]
    [C:\SysDayN\Ghook.dll]  [N/A, N/A]
[PID: 2568][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 2996][C:\WINDOWS\system32\wbem\wmiprvse.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 3024][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.3790.0 (srv03_rtm.030324-2048)]
    [C:\SysWsj\Ghook.dll]  [N/A, N/A]
    [C:\SysDayN\Ghook.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\Gjzos.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\Qqzos.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
[PID: 3640][C:\Documents and Settings\Administrator\Local Settings\Temp\sreng2.zip 的临时目录 2\SREng.EXE]  [Smallfrogs Studio, 2.3.13.690]
    [C:\SysWsj\Ghook.dll]  [N/A, N/A]
    [C:\SysDayN\Ghook.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\Gjzos.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\Qqzos.dll]  [N/A, N/A]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[C:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\打开(&O)\command=setup.exe
[D:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\打开(&O)\command=setup.exe
[F:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\打开(&O)\command=setup.exe
[G:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\打开(&O)\command=setup.exe

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
API HOOK
N/A

==================================


[/CODE]

顶顶

没人懂吗?

重启至安全模式：

删除：
启动项：
<g3kl><C:\WINDOWS\servicer.exe> [N/A]
<mdb2jl2g><C:\WINDOWS\c0nima.exe> [N/A]
<InternetEx><C:\WINDOWS\system\inetinf.exe> [N/A]
<upxdnd><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\upxdnd.exe> [N/A]
<cmdbcs><C:\WINDOWS\cmdbcs.exe> [N/A]
<Internet><C:\WINDOWS\system\svchosi.exe> [N/A]

删除文件：
C:\WINDOWS\servicer.exe
C:\WINDOWS\c0nima.exe
C:\WINDOWS\system\inetinf.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\upxdnd.exe]
C:\WINDOWS\cmdbcs.exe
C:\WINDOWS\system\svchosi.exe
C:\WINDOWS\system32\Gjzos.dll
C:\WINDOWS\system32\Qqzos.dll
每个盘符下的setup.exe和antorun.inf文件
文件夹：C:\SysDayN\和C:\SysWsj\

还有，请贴全日志

安全模式下(开机后不断 按F8键  然后出来一个高级菜单 选择第一项 安全模式 进入系统)
打开sreng （就是你扫日志的软件）启动项目  注册表 删除如下项目 (如果有哪项你认识或者确认不是病毒 请不要删除)
<g3kl><C:\WINDOWS\servicer.exe> [N/A]
<mdb2jl2g><C:\WINDOWS\c0nima.exe> [N/A]
<InternetEx><C:\WINDOWS\system\inetinf.exe> [N/A]
<upxdnd><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\upxdnd.exe> [N/A]
<cmdbcs><C:\WINDOWS\cmdbcs.exe> [N/A]
<Internet><C:\WINDOWS\system\svchosi.exe> [N/A]
<internet><C:\WINDOWS\system\taskmgr.exe /scan> [N/A]


“启动项目”-“服务”-“Win32服务应用程序”中点“隐藏经认证的微软项目”，
选中以下项目，点“删除服务”，再点“设置”，在弹出的框中点“否”：

DE91E301 / DE91E301
Updater Server / Updater Server

在“启动项目”-“服务”-“驱动程序”中点“隐藏经认证的微软项目”，
选中以下项目，点“删除服务”，再点“设置”，在弹出的框中点“否”：


把下面的 代码拷入记事本中然后另存为1.reg文件
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
"Text"="@shell32.dll,-30500"
"Type"="radio"
"CheckedValue"=dword:00000001
"ValueName"="Hidden"
"DefaultValue"=dword:00000002
"HKeyRoot"=dword:80000001
"HelpID"="shell.hlp#51105"

双击1.reg把这个注册表项导入

双击我的电脑－工具－文件夹选项－查看－显示所有文件和文件夹，把“隐藏受保护的系统文件”的勾去掉。
右击打开C: D:  F:  G:  删除autorun.inf然后删除
C:\WINDOWS\system32\cmdbcs.dll
C:\WINDOWS\system32\Gjzos.dll
C:\WINDOWS\system32\Qqzos.dll
C:\WINDOWS\servicer.exe
C:\WINDOWS\c0nima.exe
C:\WINDOWS\system\inetinf.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp下面所有文件
C:\WINDOWS\cmdbcs.exe
C:\WINDOWS\system\svchosi.exe
C:\WINDOWS\system\taskmgr.exe