System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
    <bgswitch><C:\WINDOWS\system32\bgswitch.exe>  []
    <EXPLORER><C:\Program Files\Common Files\System\wab32res.exe>  [N/A]
    <MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background>  [(Verified)Microsoft Windows Publisher]
    <2x8mizqw><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe>  []
    <mlms64hlz8><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\crasos.exe>  []
    <iw1bh><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Servera.exe>  []
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    <fy><C:\WINDOWS\Sysfy3\svchost.exe>  []
    <wm><C:\WINDOWS\Syswm7\svchost.exe>  []
    <wl><C:\WINDOWS\Syswl3\svchost.exe>  []
    <sun><C:\WINDOWS\SysSun2\svchost.exe>  []
    <JT><C:\WINDOWS\SysJT3\svchost.exe>  []
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Publisher]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Publisher]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows Publisher]
    <StormCodec_Helper><"d:\Program Files\Storm Codec\StormSet.exe" /S /opti>  []
    <svpecld><C:\WINDOWS\system32\svpecld.exe>  []
    <360tray.exe><C:\Program Files\safe360\360tray.exe>  [Microsoft Corporation]
    <Exprer><C:\WINDOWS\Exprer.exe>  []
    <Thunder><"D:\Program Files\Thunder\Thunder\ThunderShell.exe" /s>  [Thunder Networking Technologies,LTD]
    <SoundMan><SOUNDMAN.EXE>  [Avance Logic, Inc.]
    <WebThunder><D:\Program Files\Thunder\WebThunder.exe>  [(Verified)ShenZhen Thunder Networking Technologies Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]

==================================
启动文件夹
[星空极速]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\星空极速.lnk --> C:\PROGRA~1\ChinaNet\VNETCL~1.EXE []><N>

==================================
服务
[TCP/IP Check / Hello Download][Stopped/Auto Start]
  <C:\Program Files\Common Files\System\wab32res.exe><N/A>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>

==================================
驱动程序
[Service for Avance AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Avance Logic, Inc.>
[AliIde / AliIde][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\aliide.sys><Acer Laboratories Inc.>
[AMD K8 Processor Driver / AmdK8][Stopped/Manual Start]
  <System32\DRIVERS\amdk8.sys><Microsoft Corporation>
[ati2mtag / ati2mtag][Running/Manual Start]
  <system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[CmdIde / CmdIde][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\cmdide.sys><CMD Technology, Inc.>
[D-Link DFE-530TX PCI Fast Ethernet Adapter Driver / FETNDIS][Running/Manual Start]
  <system32\DRIVERS\dlkfet5b.sys><D-Link>
[iirsp / iirsp][Stopped/Boot Start]
  <\SystemRoot\system32\drivers\iirsp.sys><Intel Corp./ICP vortex GmbH>
[MegaIDE / MegaIDE][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\MegaIDE.sys><LSI Logic Corporation.>
[Intel SCSI Controller / NvAtaBus][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\NVATABUS.SYS><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[ql1080 / ql1080][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\ql1080.sys><QLogic Corporation>
[Ql10wnt / Ql10wnt][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\ql10wnt.sys><Microsoft Corporation>
[ql12160 / ql12160][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\ql12160.sys><QLogic Corporation>
[ql1280 / ql1280][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\ql1280.sys><QLogic Corporation>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[SATALink driver accelerator / SiFilter][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\SiWinAcc.sys><Silicon Image, Inc.>
[SISIDE / SISIDE][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\SISIDE.SYS><Silicon Integrated Systems Corp.>
[symc810 / symc810][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\symc810.sys><Symbios Logic Inc.>
[TosIde / TosIde][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\toside.sys><Microsoft Corporation>
[Motorola USB Modem Driver for MPT / usbsermpt][Stopped/Manual Start]
  <system32\DRIVERS\usbsermpt.sys><Microsoft Corporation>
[ViaIde / ViaIde][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\viaide.sys><Microsoft Corporation>

==================================
浏览器加载项
[WebThunder Browser Helper]
  {00000AAA-A363-466E-BEF5-9BB68697AA7F} <D:\Program Files\Thunder\WebThunderBHO_016.dll, Thunder Networking Technologies,LTD>
[ThunderIEHelper Class]
  {0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v14.dll, Thunder Networking Technologies,LTD>
[VnetCookie Class]
  {4E83D567-4697-4F7B-B1F0-A513B01DB89A} <c:\PROGRA~1\chinanet\VNETTR~1.DLL, >
[BHOHelper Class]
  {67A90DD6-128D-43AB-B97C-565D2DD42A28} <C:\Program Files\safe360\atloader.dll, 奇虎网>
[启动Web迅雷]
  {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} <http://my.xunlei.com, N/A>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[WUWebControl Class]
  {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[WebThunder Browser Helper]
  {00000AAA-A363-466E-BEF5-9BB68697AA7F} <D:\Program Files\Thunder\WebThunderBHO_016.dll, Thunder Networking Technologies,LTD>
[ThunderIEHelper Class]
  {0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v14.dll, Thunder Networking Technologies,LTD>
[WebThunder Class]
  {03507A1A-E0C5-4404-AA26-205385C0892D} <, N/A>
[VnetCookie Class]
  {4E83D567-4697-4F7B-B1F0-A513B01DB89A} <c:\PROGRA~1\chinanet\VNETTR~1.DLL, >
[BHOHelper Class]
  {67A90DD6-128D-43AB-B97C-565D2DD42A28} <C:\Program Files\safe360\atloader.dll, 奇虎网>
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[SearchAssistantOC]
  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
  {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\flash.ocx, Macromedia, Inc.>
[Rising Web Scan Object]
  {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\DOWNLO~1\OL2005.dll, Beijing Rising Technology Co., Ltd.>
[safe360AutoLive]
  {E5212438-921F-44a3-8865-11C0B9BA4AF2} <C:\Program Files\safe360\autolive.dll, Microsoft Corporation>
[使用Web迅雷下载]
  <D:\Program Files\Thunder\GetUrl.htm, N/A>
[使用Web迅雷下载全部链接]
  <D:\Program Files\Thunder\GetAllUrl.htm, N/A>
[使用迅雷下载]
  <D:\Program Files\Thunder\Thunder\geturl.htm, N/A>
[使用迅雷下载全部链接]
  <D:\Program Files\Thunder\Thunder\getallurl.htm, N/A>

正在运行的进程
[PID: 588][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 636][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 660][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 704][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 716][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 868][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 948][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1068][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 176][C:\WINDOWS\SOUNDMAN.EXE]  [Avance Logic, Inc., 5.0.10]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\SysJT3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\SysSun2\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Syswl3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Syswm7\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Sysfy3\Ghook.dll]  [N/A, ]
[PID: 144][C:\WINDOWS\Sysfy3\svchost.exe]  [N/A, ]
    [C:\WINDOWS\Sysfy3\Ghook.dll]  [N/A, ]
[PID: 368][C:\WINDOWS\Syswm7\svchost.exe]  [N/A, ]
    [C:\WINDOWS\Syswm7\Ghook.dll]  [N/A, ]
[PID: 392][C:\WINDOWS\Syswl3\svchost.exe]  [N/A, ]
    [C:\WINDOWS\Syswl3\Ghook.dll]  [N/A, ]
[PID: 416][C:\WINDOWS\SysSun2\svchost.exe]  [N/A, ]
    [C:\WINDOWS\SysSun2\Ghook.dll]  [N/A, ]
[PID: 428][C:\WINDOWS\SysJT3\svchost.exe]  [N/A, ]
    [C:\WINDOWS\SysJT3\Ghook.dll]  [N/A, ]
[PID: 452][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\SysJT3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\SysSun2\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Syswl3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Syswm7\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Sysfy3\Ghook.dll]  [N/A, ]
[PID: 612][C:\Program Files\ChinaNet\VnetClient.exe]  [, 2005, 11, 14, 1]
    [C:\Program Files\ChinaNet\Communicate.dll]  [0, 2005, 3, 3, 1]
    [C:\Program Files\ChinaNet\DialModule.dll]  [GDCN, 2005, 11, 15, 1]
    [C:\Program Files\ChinaNet\MFC42.DLL]  [Microsoft Corporation, 6.00.8665.0]
    [C:\PROGRA~1\ChinaNet\CLIENT~1.DLL]  [, 2004, 2, 28, 1]
    [C:\PROGRA~1\ChinaNet\PLUGIN~1.OCX]  [, 2005, 7, 27, 1]
    [C:\PROGRA~1\ChinaNet\sign.dll]  [0, 2004, 12, 1, 1]
    [C:\PROGRA~1\ChinaNet\PostPlug.dll]  [, 2004, 12, 16, 2]
    [C:\PROGRA~1\ChinaNet\ADVERT~1.OCX]  [, 2005, 10, 13, 1]
    [C:\PROGRA~1\ChinaNet\Gif89a.dll]  [, 2005, 6, 21, 1]
    [C:\PROGRA~1\ChinaNet\VnetBs.ocx]  [, 2004, 11, 18, 1]
    [C:\PROGRA~1\ChinaNet\ACCOUN~2.DLL]  [, 2005, 11, 14, 1]
    [C:\PROGRA~1\ChinaNet\AccountMgr.dll]  [, 2005, 11, 14, 17]
    [C:\PROGRA~1\ChinaNet\VnetSkin.ocx]  [GDDC, 2005, 11, 14, 1]
    [C:\PROGRA~1\ChinaNet\DialogStyle.dll]  [, 1, 0, 0, 1]
    [C:\PROGRA~1\ChinaNet\Timer.ocx]  [, 2005, 10, 9, 14]
    [C:\PROGRA~1\ChinaNet\PLUGIN~2.OCX]  [, 2005, 2, 24, 1]
    [C:\PROGRA~1\ChinaNet\NEWMES~1.DLL]  [, 2005, 8, 26, 1]
    [C:\PROGRA~1\ChinaNet\PassCtrl.dll]  [, 1, 0, 0, 1]
    [C:\PROGRA~1\ChinaNet\PlugPush.dll]  [, 2004, 12, 21, 1]
    [C:\PROGRA~1\ChinaNet\ALLINT~1.DLL]  [, 2004, 11, 23, 1]
    [C:\PROGRA~1\ChinaNet\VNETLO~1.OCX]  [, 2005, 10, 9, 1]
    [C:\PROGRA~1\ChinaNet\StatNum.dll]  [, 2004, 11, 18, 1]
    [C:\PROGRA~1\ChinaNet\VNETON~1.OCX]  [, 2005, 3, 2, 1]
    [C:\PROGRA~1\ChinaNet\ALLFUN~1.DLL]  [GDCN, 2005, 10, 9, 1]
    [C:\PROGRA~1\ChinaNet\VnetOptLog.dll]  [, 2005, 9, 13, 9]
    [C:\WINDOWS\SysJT3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\SysSun2\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Syswl3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Syswm7\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Sysfy3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\PROGRA~1\ChinaNet\DlgSkin.ocx]  [, 2005, 11, 14, 1]
    [C:\WINDOWS\system32\macromed\flash\flash.ocx]  [Macromedia, Inc., 6,0,79,0]
    [C:\Program Files\safe360\bhomgr.dll]  [Microsoft Corporation, 5, 1, 2607, 309]
[PID: 1632][D:\Program Files\千千\TTPlayer BY木蚂蚁古龙伯爵\TTPlayer BY 伯爵.exe]  [Alen Soft, 4, 6, 9, 0]
    [D:\Program Files\千千\TTPlayer BY木蚂蚁古龙伯爵\ttpcomm.dll]  [N/A, ]
    [D:\Program Files\千千\TTPlayer BY木蚂蚁古龙伯爵\ttpres.dll]  [Alen Soft, 4, 6, 9, 0]
    [D:\Program Files\千千\TTPlayer BY木蚂蚁古龙伯爵\msdmo.dll]  [Microsoft Corporation, 6.03.01.0400]
    [C:\WINDOWS\SysJT3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\SysSun2\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Syswl3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Syswm7\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Sysfy3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\Program Files\千千\TTPlayer BY木蚂蚁古龙伯爵\AddIn\ttp_lrcsh.dll]  [N/A, ]
    [D:\Program Files\千千\TTPlayer BY木蚂蚁古龙伯爵\AddIn\ttp_asf.dll]  [N/A, ]
    [D:\Program Files\千千\TTPlayer BY木蚂蚁古龙伯爵\AddIn\ttp_aac.dll]  [N/A, ]
    [D:\Program Files\千千\TTPlayer BY木蚂蚁古龙伯爵\AddIn\ttp_ac3dts.dll]  [N/A, ]
    [D:\Program Files\千千\TTPlayer BY木蚂蚁古龙伯爵\wmadmod.dll]  [Microsoft Corporation, 10.00.00.3646]
    [C:\Program Files\safe360\bhomgr.dll]  [Microsoft Corporation, 5, 1, 2607, 309]
[PID: 1840][D:\Program Files\Thunder\Thunder\Thunder.exe]  [Thunder Networking Technologies,LTD, 5.1.5.189]
    [D:\Program Files\Thunder\Thunder\UpdateDownload.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 2]
    [D:\Program Files\Thunder\Thunder\download_interface.dll]  [Thunder Networking Technologies,LTD, 1, 0, 2, 74]
    [D:\Program Files\Thunder\Thunder\log4cplus.dll]  [, 1, 0, 2, 1]
    [D:\Program Files\Thunder\Thunder\stlport_vc646.dll]  [STLport Consulting, Inc., 4.6.2003.1031]
    [D:\Program Files\Thunder\Thunder\msgmanage.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 15]
    [D:\Program Files\Thunder\Thunder\historyinfo_manage.dll]  [Thunder Networking Technologies,LTD, 5, 2, 0, 148]
    [D:\Program Files\Thunder\Thunder\iEmbed.dll]  [Thunder Networking Technologies,LTD, 1, 1, 0, 22]
    [D:\Program Files\Thunder\Thunder\RegisterDll.dll]  [Thunder Networking Technologies,LTD, 1, 2, 0, 7]
    [D:\Program Files\Thunder\Thunder\FloatBar.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 2]
    [C:\WINDOWS\SysJT3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\SysSun2\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Syswl3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Syswm7\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Sysfy3\Ghook.dll]  [N/A, ]
    [D:\Program Files\Thunder\Thunder\iTargetAd.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 59]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\Program Files\safe360\bhomgr.dll]  [Microsoft Corporation, 5, 1, 2607, 309]
[PID: 2528][E:\杀毒\ie\HijackThis1991汉化版\HijackThis1991zww.exe]  [Soeperman Enterprises Ltd., 1.99.0001]
    [C:\WINDOWS\system32\MSVBVM60.DLL]  [Microsoft Corporation, 6.00.9690]
    [C:\WINDOWS\SysJT3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\SysSun2\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Syswl3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Syswm7\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Sysfy3\Ghook.dll]  [N/A, ]

    [E:\杀毒\ie\HijackThis1991汉化版\PSAPI.DLL]  [Microsoft Corporation, 4.00]
[PID: 512][C:\WINDOWS\system32\NOTEPAD.EXE]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\SysJT3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\SysSun2\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Syswl3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Syswm7\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Sysfy3\Ghook.dll]  [N/A, ]
[PID: 2972][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [D:\Program Files\Thunder\WebThunderBHO_016.dll]  [Thunder Networking Technologies,LTD, 6, 0, 0, 5]
    [C:\WINDOWS\system32\xunleibho_v14.dll]  [Thunder Networking Technologies,LTD, 4, 6, 0, 62]
    [c:\PROGRA~1\chinanet\VNETTR~1.DLL]  [, 2005, 4, 6, 1]
    [c:\PROGRA~1\chinanet\Communicate.dll]  [0, 2005, 3, 3, 1]
    [C:\PROGRA~1\ChinaNet\CLIENT~1.DLL]  [, 2004, 2, 28, 1]
    [C:\Program Files\safe360\atloader.dll]  [奇虎网, 5, 1, 2607, 225]
    [C:\WINDOWS\SysJT3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\SysSun2\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Syswl3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Syswm7\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Sysfy3\Ghook.dll]  [N/A, ]
    [C:\Program Files\safe360\urlcatch.dll]  [Microsoft Corporation, 5, 1, 2607, 309]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\macromed\flash\flash.ocx]  [Macromedia, Inc., 6,0,79,0]
    [C:\Program Files\safe360\bhomgr.dll]  [Microsoft Corporation, 5, 1, 2607, 309]
    [C:\WINDOWS\system32\javacypt.dll]  [Microsoft Corporation, 5.00.3810]
    [C:\WINDOWS\system32\msjava.dll]  [Microsoft Corporation, 5.00.3810]
    [C:\WINDOWS\system32\VMHELPER.DLL]  [Microsoft Corporation, 5.00.3810]
[PID: 2868][C:\WINDOWS\explorer.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\SysJT3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\SysSun2\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Syswl3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Syswm7\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Sysfy3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\Program Files\safe360\adx.dll]  [奇虎网, 5, 1, 2607, 309]
    [C:\Program Files\safe360\autolive.dll]  [Microsoft Corporation, 5, 1, 2607, 309]
    [C:\Program Files\safe360\bhomgr.dll]  [Microsoft Corporation, 5, 1, 2607, 309]
    [C:\Program Files\safe360\urlcatch.dll]  [Microsoft Corporation, 5, 1, 2607, 309]
    [C:\Program Files\safe360\atloader.dll]  [奇虎网, 5, 1, 2607, 225]
    [D:\Program Files\Thunder\WebThunderBHO_016.dll]  [Thunder Networking Technologies,LTD, 6, 0, 0, 5]
    [C:\WINDOWS\system32\xunleibho_v14.dll]  [Thunder Networking Technologies,LTD, 4, 6, 0, 62]
[PID: 3240][D:\Program Files\Thunder\WebThunder.exe]  [深圳市迅雷网络技术有限公司, 1, 7, 2, 107]
    [D:\Program Files\Thunder\taskmanage.dll]  [Thunder Networking Technologies,LTD, 1, 7, 2, 107]
    [D:\Program Files\Thunder\download_interface.dll]  [Thunder Networking Technologies,LTD, 2, 14, 2, 79]
    [D:\Program Files\Thunder\stlport_vc646.dll]  [STLport Consulting, Inc., 4.6.2003.1031]
    [D:\Program Files\Thunder\asyn_dns.dll]  [Thunder Networking Technologies,LTD, 2, 14, 2, 79]
    [D:\Program Files\Thunder\RegisterDll.dll]  [Thunder Networking Technologies,LTD, 2, 13, 4, 58]
    [C:\Program Files\safe360\bhomgr.dll]  [Microsoft Corporation, 5, 1, 2607, 309]
    [D:\Program Files\Thunder\historyinfo_manage.dll]  [Thunder Networking Technologies,LTD, 5, 3, 0, 228]
    [D:\Program Files\Thunder\iEmbedShell.dll]  [　, 1, 0, 0, 17]
    [D:\Program Files\Thunder\iEmbed09.dll]  [　, 3, 3, 0, 78]
    [C:\WINDOWS\SysJT3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\SysSun2\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Syswl3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Syswm7\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Sysfy3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\system32\javacypt.dll]  [Microsoft Corporation, 5.00.3810]
    [C:\WINDOWS\system32\msjava.dll]  [Microsoft Corporation, 5.00.3810]
    [C:\WINDOWS\system32\VMHELPER.DLL]  [Microsoft Corporation, 5.00.3810]
    [C:\WINDOWS\system32\macromed\flash\flash.ocx]  [Macromedia, Inc., 6,0,79,0]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 556][d:\Program Files\WinRAR\WinRAR.exe]  [N/A, ]
    [C:\Program Files\safe360\bhomgr.dll]  [Microsoft Corporation, 5, 1, 2607, 309]
    [C:\WINDOWS\system32\Audiodev.dll]  [Microsoft Corporation, 5.2.3802.3802 built by: dnsrv(bld4act)]
    [C:\WINDOWS\SysJT3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\SysSun2\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Syswl3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Syswm7\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Sysfy3\Ghook.dll]  [N/A, ]
[PID: 1784][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\safe360\bhomgr.dll]  [Microsoft Corporation, 5, 1, 2607, 309]
    [D:\Program Files\Thunder\WebThunderBHO_016.dll]  [Thunder Networking Technologies,LTD, 6, 0, 0, 5]
    [C:\WINDOWS\system32\xunleibho_v14.dll]  [Thunder Networking Technologies,LTD, 4, 6, 0, 62]
    [c:\PROGRA~1\chinanet\VNETTR~1.DLL]  [, 2005, 4, 6, 1]
    [c:\PROGRA~1\chinanet\Communicate.dll]  [0, 2005, 3, 3, 1]
    [C:\PROGRA~1\ChinaNet\CLIENT~1.DLL]  [, 2004, 2, 28, 1]
    [C:\Program Files\safe360\atloader.dll]  [奇虎网, 5, 1, 2607, 225]
    [C:\WINDOWS\SysJT3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\SysSun2\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Syswl3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Syswm7\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Sysfy3\Ghook.dll]  [N/A, ]
    [C:\Program Files\safe360\urlcatch.dll]  [Microsoft Corporation, 5, 1, 2607, 309]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\macromed\flash\flash.ocx]  [Macromedia, Inc., 6,0,79,0]
[PID: 2444][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX24.375\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
    [C:\Program Files\safe360\bhomgr.dll]  [Microsoft Corporation, 5, 1, 2607, 309]
    [C:\WINDOWS\SysJT3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\SysSun2\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Syswl3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Syswm7\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\Sysfy3\Ghook.dll]  [N/A, ]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost
127.0.0.1      mmm.caifu18.net
127.0.0.1      www.18dmm.com
127.0.0.1      d.qbbd.com
127.0.0.1      www.5117music.com
127.0.0.1      www.union123.com
127.0.0.1      www.wu7x.cn
127.0.0.1      www.54699.com
127.0.0.1      www1.6tan.com
127.0.0.1      www2.6tan.com
127.0.0.1      www.97725.com
127.0.0.1      down.97725.com
127.0.0.1      ip.315hack.com
127.0.0.1      ip.54liumang.com
127.0.0.1      www.41ip.com
127.0.0.1      xulao.com
127.0.0.1      www.heixiou.com
127.0.0.1      www.9cyy.com
127.0.0.1      www.hunll.com
127.0.0.1      www.down.hunll.com
127.0.0.1      do.77276.com
127.0.0.1      www.baidulink.com
127.0.0.1      adnx.yygou.cn
127.0.0.1      222.73.220.45
127.0.0.1      www.f5game.com
127.0.0.1      www.guazhan.cn
127.0.0.1      wm,103715.com
127.0.0.1      www.my6688.cn
127.0.0.1      i.96981.com
127.0.0.1      d.77276.com
127.0.0.1      www1.cw988.cn
127.0.0.1      cool.47555.com
127.0.0.1      www.asdwc.com
127.0.0.1      55880.cn
127.0.0.1      61.152.169.234
127.0.0.1      cc.wzxqy.com
127.0.0.1      www.54699.com
127.0.0.1      t.gcuj.com
127.0.0.1      www.puma163.com
127.0.0.1      ceoww.com
127.0.0.1      boolom.com
127.0.0.1      adult-novel.cn
127.0.0.1      ll.chinasese.net
127.0.0.1      www.tellumore.com
127.0.0.1      www.o1wg.com
127.0.0.1      www.qq756.com
127.0.0.1      ll.chinasese.net

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================

安全模式下(开机后不断 按F8键  然后出来一个高级菜单 选择第一项 安全模式 进入系统)

打开sreng （就是你扫日志的软件）
操作中不要点击 除系统分区外的exe文件
启动项目  注册表 删除如下项目 (如果有哪项你认识或者确认不是病毒 请不要删除)
<mlms64hlz8><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\crasos.exe> []
<iw1bh><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Servera.exe> []
<EXPLORER><C:\Program Files\Common Files\System\wab32res.exe> [N/A]
fy><C:\WINDOWS\Sysfy3\svchost.exe> []
<wm><C:\WINDOWS\Syswm7\svchost.exe> []
<wl><C:\WINDOWS\Syswl3\svchost.exe> []
<sun><C:\WINDOWS\SysSun2\svchost.exe> []
<JT><C:\WINDOWS\SysJT3\svchost.exe> []
<svpecld><C:\WINDOWS\system32\svpecld.exe> []
<Exprer><C:\WINDOWS\Exprer.exe> []


“启动项目”-“服务”-“Win32服务应用程序”中点“隐藏经认证的微软项目”，
选中以下项目，点“删除服务”，再点“设置”，在弹出的框中点“否”：

TCP/IP Check / Hello Download



双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹" 并清除"隐藏受保护的操作系统文件（推荐）"前面的钩。在提示确定更改时，单击“是” 然后确定
然后删除
C:\Program Files\Common Files\System\wab32res.exe
清空C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
C:\WINDOWS\Sysfy3
C:\WINDOWS\Syswm7
C:\WINDOWS\Syswl3
C:\WINDOWS\SysSun2
C:\WINDOWS\SysJT3
C:\WINDOWS\system32\svpecld.exe
C:\WINDOWS\Exprer.exe
使用杀毒软件全盘杀毒

用windows 任务管理器结束不明的进程，向是HH.exe、cmdbns.com等等，然后删掉C:\Documents and Settings\****\Local Settings\Temp中的可执行文件，用SREng中的系统修复下的HOSTS 文件，检测是否有不明的网址或IP地址，删除并保存即可

引用:

【dorl的贴子】用windows 任务管理器结束不明的进程，向是HH.exe、cmdbns.com等等，然后删掉C:\Documents and Settings\****\Local Settings\Temp中的可执行文件，用SREng中的系统修复下的HOSTS 文件，检测是否有不明的网址或IP地址，删除并保存即可 ………………

hh.exe不是病毒

我说的是彻底删除

引用:

【hppk见手青的贴子】我说的是彻底删除 ………………

3楼的没看见 那个crasos.exe不是主要的 主要的是那个艾尼变种wab32res.exe 他感染文件 而且其他所有的木马都是他下载的

不知道啦，我是看不顺眼的：删！

提醒：
  hh.exe有感染病毒的可能，需用网络，运行时自动播放广播，不过用卡巴和AVG能够查杀，也可以强删。
  Appinit_dlls.称为牛皮癣病毒，建议删除。
  newcenturymoon 你太强了，什么时候教教我啊。