[CODE]

2007-06-27,06:33:42

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <RavTask><"D:\蓝色网络\蓝色网络\蓝色软件\瑞星软件\瑞星杀毒\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
    <MenuOrder><C:\Program Files\ICBCPe~1\ICBC\BHDC(Personal)\MenuOrder\MenuOrder.exe>  [N/A]
    <runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe>  [Beijing Rising Technology Co., Ltd.]
    <360Safetray><D:\蓝色网络\蓝色网络\蓝色软件\360安全卫士\safemon\360Tray.exe /start>  [奇虎网]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
    <WinlogonNotify: WgaLogon><WgaLogon.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
    <IE7 Uninstall Stub><C:\WINDOWS\system32\ieudinit.exe>  [(Verified)Microsoft Windows Publisher]

==================================
启动文件夹
N/A

==================================
服务
[Ati External Event Utility / Ati External Event Utility][Running/Auto Start]
  <C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[Ati HotKey Poller / Ati HotKey Poller][Stopped/Auto Start]
  <C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
  <"D:\蓝色网络\蓝色网络\蓝色软件\瑞星软件\瑞星杀毒\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
  <"D:\蓝色网络\蓝色网络\蓝色软件\瑞星软件\瑞星杀毒\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>

==================================
驱动程序
[ADI UAA Function Driver for High Definition Audio Service / ADIHdAudAddService][Running/Manual Start]
  <system32\drivers\ADIHdAud.sys><Analog Devices, Inc.>
[ati2mtag / ati2mtag][Running/Manual Start]
  <system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[BaseTDI / BaseTDI][Running/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\basetdi.sys><Beijing Rising Technology Co., Ltd.>
[EagleNT / EagleNT][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\drivers\EagleNT.sys><N/A>
[ExpScaner / ExpScaner][Running/Auto Start]
  <\??\D:\蓝色网络\蓝色网络\蓝色软件\瑞星软件\瑞星杀毒\ExpScan.sys><>
[usb Card Device / ft2kEnum][Running/Manual Start]
  <system32\DRIVERS\ic2kenum.sys><OEM Corporation>
[USB Chip Holder Service / GDBaseSmc][Running/Manual Start]
  <system32\DRIVERS\Chip_smc.sys><OEM>
[USB Chip Service / GD_USB][Running/Manual Start]
  <system32\DRIVERS\Chip_usb.sys><>
[Microsoft 用于 High Definition Audio 服务的 UAA 功能驱动程序 / HdAudAddService][Stopped/Manual Start]
  <system32\drivers\HdAudio.sys><Windows (R) Server 2003 DDK provider>
[Microsoft 用于 High Definition Audio 的 UAA 总线驱动程序 / HDAudBus][Running/Manual Start]
  <system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
[HookCont / HookCont][Running/Auto Start]
  <\??\D:\蓝色网络\蓝色网络\蓝色软件\瑞星软件\瑞星杀毒\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
  <\??\D:\蓝色网络\蓝色网络\蓝色软件\瑞星软件\瑞星杀毒\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
  <\??\D:\蓝色网络\蓝色网络\蓝色软件\瑞星软件\瑞星杀毒\HookSys.sys><Rising>
[MEMSCAN / MEMSCAN][Running/Auto Start]
  <\??\D:\蓝色网络\蓝色网络\蓝色软件\瑞星软件\瑞星杀毒\MEMSCAN.sys><瑞星软件有限公司>
[ATK0100 ACPI UTILITY / MTsensor][Running/Manual Start]
  <system32\DRIVERS\ATKACPI.sys><ATK0100>
[用于 Windows XP 32 Bit 版的英特尔(R) PRO/无线 3945ABG 适配器驱动程序 / NETw3x32][Stopped/Manual Start]
  <system32\DRIVERS\NETw3x32.sys><N/A>
[Netgroup Packet Filter / NPF][Stopped/Manual Start]
  <system32\drivers\npf.sys><N/A>
[npkcrypt / npkcrypt][Running/Auto Start]
  <\??\D:\蓝色网络\腾讯网络\腾讯软件\腾讯QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[QKeyServiceDisplay / QKeyService][Running/Boot Start]
  <\SystemRoot\system32\KeyCrypt.sys><Tencent Technology (Shenzhen) Company Limited>
[R300 / R300][Stopped/Manual Start]
  <system32\DRIVERS\atikmdag.sys><ATI Technologies Inc.>
[SmartCard Reader Device  / Reader_Device][Running/Manual Start]
  <system32\DRIVERS\usbic2k.sys><OEM>
[rimmptsk / rimmptsk][Running/Auto Start]
  <system32\DRIVERS\rimmptsk.sys><REDC>
[rimsptsk / rimsptsk][Running/Auto Start]
  <system32\DRIVERS\rimsptsk.sys><REDC>
[Ricoh xD-Picture Card Driver / rismxdp][Running/Auto Start]
  <system32\DRIVERS\rixdptsk.sys><REDC>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
  <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
  <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
  <\??\D:\蓝色网络\蓝色网络\蓝色软件\瑞星软件\瑞星杀毒\RSPPSYS.sys><Rising>
[Realtek 10/100/1000 NIC Family all in one NDIS XP Driver / RTL8023xp][Running/Manual Start]
  <system32\DRIVERS\Rtenicxp.sys><Realtek Semiconductor Corporation>
[Realtek 8169 NT Driver / RTL8169][Stopped/Manual Start]
  <system32\DRIVERS\Rtlh86.sys><Realtek Corporation>
[Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver / RTLE8023xp][Stopped/Manual Start]
  <system32\DRIVERS\Rtenicxp.sys><Realtek Semiconductor Corporation>
[WLAN 传输 / s24trans][Stopped/Disabled]
  <system32\DRIVERS\s24trans.sys><N/A>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[SMC IrCC Miniport Device Driver / SMCIRDA][Running/Manual Start]
  <system32\DRIVERS\smcirda.sys><SMC>
[smserial / smserial][Running/Manual Start]
  <system32\DRIVERS\smserial.sys><Motorola Inc.>
[TesSafe / TesSafe][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\TesSafe.sys><N/A>
[USB2.0 0.35M WebCam / usbvm321][Running/Manual Start]
  <System32\Drivers\usbvm321.sys><Vimicro Corporation>

浏览器加载项
[QQCycloneHelper Class]
  {39F7E361-828A-4B5A-BCAF-5B79BFDFEA60} <D:\蓝色网络\腾讯网络\腾讯软件\超级旋风\QQIEHelper01.dll, 腾讯公司>
[BitComet Helper]
  {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} <D:\蓝色网络\蓝色网络\蓝色软件\BitComet\tools\BitCometBHO_1.1.6.14.dll, BitComet>
[VnetCookie Class]
  {4E83D567-4697-4F7B-B1F0-A513B01DB89A} <c:\PROGRA~1\chinanet\VNETTR~1.DLL, >
[NavigatMon Class]
  {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <D:\蓝色网络\蓝色网络\蓝色软件\360安全卫士\safemon\safemon.dll, >
[Windows Genuine Advantage Validation Tool]
  {17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft Corporation>
[PowerPlr Control]
  {2354A44B-3CEB-4829-9940-545B03103538} <C:\WINDOWS\DOWNLO~1\POWERP~1.OCX, Powerise Digital>
[EditCtrl Class]
  {488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\system32\aliedit\aliedit.dll, >
[InfoSecNetSign Class]
  {62B938C4-4190-4F37-8CF0-A92B0A91CC77} <C:\WINDOWS\system32\NetSign.dll, Infosec Technologies Co., Ltd.>
[WUWebControl Class]
  {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[AxInputControl Class]
  {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\WINDOWS\system32\INPUTC~1.DLL, >
[163Uploader Control]
  {8686F2A6-DC01-4E8F-BDE3-DCC7DBBAD6AE} <C:\WINDOWS\system32\163UPL~1.OCX, 广州网易互动娱乐有限公司>
[AxUSBKey Class]
  {DA215190-98B2-47DE-AE24-DA95481DFFBA} <C:\WINDOWS\system32\USBKey.dll, >
[PasswordEditCtrl Class]
  {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
[Windows Genuine Advantage Validation Tool]
  {17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft Corporation>
[iTrusPTA Class]
  {1E0DFFCF-27FF-4574-849B-55007349FEDA} <C:\WINDOWS\system32\aliedit\pta.dll, >
[Windows Media Player]
  {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[PowerPlr Control]
  {2354A44B-3CEB-4829-9940-545B03103538} <C:\WINDOWS\DOWNLO~1\POWERP~1.OCX, Powerise Digital>
[HTML Document]
  {25336920-03F9-11CF-8FD0-00AA00686F13} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[XML DOM Document]
  {2933BF90-7B36-11D2-B20E-00C04F983E60} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[QQCycloneHelper Class]
  {39F7E361-828A-4B5A-BCAF-5B79BFDFEA60} <D:\蓝色网络\腾讯网络\腾讯软件\超级旋风\QQIEHelper01.dll, 腾讯公司>
[BitComet Helper]
  {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} <D:\蓝色网络\蓝色网络\蓝色软件\BitComet\tools\BitCometBHO_1.1.6.14.dll, BitComet>
[QQRightClick Class]
  {4836C333-208E-4BCE-B30B-00B9545B0F6E} <D:\蓝色网络\腾讯网络\腾讯软件\超级旋风\QQIEHelper01.dll, 腾讯公司>
[EditCtrl Class]
  {488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\system32\aliedit\aliedit.dll, >
[VnetCookie Class]
  {4E83D567-4697-4F7B-B1F0-A513B01DB89A} <c:\PROGRA~1\chinanet\VNETTR~1.DLL, >
[Shell Name Space]
  {55136805-B2DE-11D1-B9F2-00A0C98BC547} <C:\WINDOWS\system32\ieframe.dll, Microsoft Corporation>
[WUWebControl Class]
  {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[WangWangObj Class]
  {6E213FC7-DD5A-4115-B7E6-D4C7838C361E} <D:\蓝色网络\蓝色网络\蓝色软件\阿里旺旺\WangWangX4.dll, 阿里软件（中国）有限公司>
[AxInputControl Class]
  {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\WINDOWS\system32\INPUTC~1.DLL, >
[163Uploader Control]
  {8686F2A6-DC01-4E8F-BDE3-DCC7DBBAD6AE} <C:\WINDOWS\system32\163UPL~1.OCX, 广州网易互动娱乐有限公司>
[Microsoft Web Browser]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\ieframe.dll, Microsoft Corporation>
[AxSubmitControl Class]
  {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} <C:\WINDOWS\system32\SUBMIT~1.DLL, >
[SearchAssistantOC]
  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[UIAssist Class]
  {B5EAB64D-F5E5-46A6-87B2-21C11EB4412B} <D:\蓝色网络\腾讯网络\腾讯软件\QQ珊瑚虫\CoralAssist.dll, Coral Team>
[NavigatMon Class]
  {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <D:\蓝色网络\蓝色网络\蓝色软件\360安全卫士\safemon\safemon.dll, >
[RDS.DataSpace]
  {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[QQPlayerSvr Proxy Control]
  {CD108273-D434-43E6-AA90-1469F97EB398} <D:\蓝色网络\腾讯网络\腾讯软件\腾讯QQ\QQPlayerProxy.dll, Tencent>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>
[PasswordEditCtrl Class]
  {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
[TimwpDll.TimwpCheck]
  {ED4CA2E5-0EEA-44C1-AD7E-74A07A7507A4} <D:\蓝色网络\腾讯网络\腾讯软件\QQ珊瑚虫\Timwp.dll, TENCENT>
[XML HTTP Request]
  {ED8C108E-4349-11D2-91A4-00C04F7969E8} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[XML DOM Document 3.0]
  {F5078F32-C551-11D3-89B9-0000F81FE221} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[Free Threaded XML DOM Document 3.0]
  {F5078F33-C551-11D3-89B9-0000F81FE221} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[XML HTTP 3.0]
  {F5078F35-C551-11D3-89B9-0000F81FE221} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[XSL Template 3.0]
  {F5078F36-C551-11D3-89B9-0000F81FE221} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[XML DOM Document]
  {F6D90F11-9C73-11D3-B32E-00C04F990BB4} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[XML HTTP]
  {F6D90F16-9C73-11D3-B32E-00C04F990BB4} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[InstallCheck Class]
  {FFB8C97E-39D4-4E8A-9FE4-B451A0D6CA65} <D:\蓝色网络\蓝色网络\蓝色软件\阿里旺旺\Ali_Check.dll, >
[收藏到QQ书签]
  <http://shuqian.qq.com/favit.html, N/A>
[添加到QQ表情]
  <D:\蓝色网络\腾讯网络\腾讯软件\腾讯QQ\AddEmotion.htm, N/A>

正在运行的进程
[PID: 700][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 764][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 796][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\WgaLogon.dll]  [Microsoft Corporation, 1.7.0018.5]
    [C:\WINDOWS\system32\aetcsss1.dll]  [A.E.T. Europe B.V., 2.0.0.23]
    [C:\WINDOWS\system32\aetdlss1.dll]  [A.E.T. Europe B.V., 2.0.0.15]
    [C:\WINDOWS\system32\aetpkss1.dll]  [A.E.T. Europe B.V., 2.0.0.21]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 844][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\AppPatch\AcAdProc.dll]  [Microsoft Corporation, 5.1.2600.3008 (xpsp.061004-0027)]
[PID: 856][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1008][C:\WINDOWS\system32\Ati2evxx.exe]  [ATI Technologies Inc., 6.14.10.4149]
    [C:\WINDOWS\system32\Ati2edxx.dll]  [ATI Technologies, Inc., 6, 14, 10, 2508]
    [C:\WINDOWS\system32\atipdlxx.dll]  [ATI Technologies, Inc., 6, 14, 10, 2513]
[PID: 1052][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1168][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1228][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
    [C:\WINDOWS\system32\wups2.dll]  [Microsoft Corporation, 7.0.6000.374 (winmain(wmbla).070416-2057)]
[PID: 580][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
    [C:\WINDOWS\system32\ieframe.dll]  [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [D:\蓝色网络\蓝色网络\蓝色软件\360安全卫士\safemon\safemon.dll]  [, 3, 2, 0, 1001]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\PortableDeviceApi.dll]  [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[PID: 904][C:\Program Files\Rising\AntiSpyware\runiep.exe]  [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6]
    [C:\Program Files\Rising\AntiSpyware\iep_ctrl.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 1804][D:\蓝色网络\蓝色网络\蓝色软件\360安全卫士\safemon\360Tray.exe]  [奇虎网, 3, 3, 0, 1005]
    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
    [D:\蓝色网络\蓝色网络\蓝色软件\360安全卫士\safemon\safemon.dll]  [, 3, 2, 0, 1001]
    [D:\蓝色网络\蓝色网络\蓝色软件\360安全卫士\safemon\SafeKrnl.dll]  [奇虎网, 3, 2, 0, 1001]
    [D:\蓝色网络\蓝色网络\蓝色软件\360安全卫士\AntiAdwa.dll]  [360Safe.com, 3, 3, 0, 1004]
    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 1812][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [D:\蓝色网络\蓝色网络\蓝色软件\360安全卫士\safemon\safemon.dll]  [, 3, 2, 0, 1001]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 2844][D:\蓝色网络\蓝色网络\蓝色软件\系统工具\系统检查\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
    [C:\WINDOWS\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
    [C:\WINDOWS\system32\iertutil.dll]  [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
    [D:\蓝色网络\蓝色网络\蓝色软件\360安全卫士\safemon\safemon.dll]  [, 3, 2, 0, 1001]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\windows\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
API HOOK
入口点错误：CreateProcessA (危险等级: 一般,  被下面模块所HOOK: D:\蓝色网络\蓝色网络\蓝色软件\360安全卫士\safemon\safemon.dll)
入口点错误：CreateProcessW (危险等级: 一般,  被下面模块所HOOK: D:\蓝色网络\蓝色网络\蓝色软件\360安全卫士\safemon\safemon.dll)

==================================
隐藏进程
N/A

==================================


[/CODE]

Logfile of HijackThis v1.99.1
Scan saved at 6:34:33, on 2007-6-27
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
D:\蓝色网络\蓝色网络\蓝色软件\瑞星软件\瑞星杀毒\CCenter.exe
C:\WINDOWS\System32\svchost.exe
D:\蓝色网络\蓝色网络\蓝色软件\瑞星软件\瑞星杀毒\Ravmond.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
D:\蓝色网络\蓝色网络\蓝色软件\瑞星软件\瑞星杀毒\RavTask.exe
D:\蓝色网络\蓝色网络\蓝色软件\瑞星软件\瑞星杀毒\Ravmon.exe
C:\Program Files\Rising\AntiSpyware\runiep.exe
D:\蓝色网络\蓝色网络\蓝色软件\360安全卫士\safemon\360Tray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
D:\蓝色网络\蓝色网络\蓝色软件\系统工具\修复工具\HijackThis.exe

O2 - BHO: QQCycloneHelper Class - {39F7E361-828A-4B5A-BCAF-5B79BFDFEA60} - D:\蓝色网络\腾讯网络\腾讯软件\超级旋风\QQIEHelper01.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\蓝色网络\蓝色网络\蓝色软件\BitComet\tools\BitCometBHO_1.1.6.14.dll
O2 - BHO: VnetCookie Class - {4E83D567-4697-4F7B-B1F0-A513B01DB89A} - c:\PROGRA~1\chinanet\VNETTR~1.DLL
O2 - BHO: NavigatMon Class - {B69F34DD-F0F9-42DC-9EDD-957187DA688D} - D:\蓝色网络\蓝色网络\蓝色软件\360安全卫士\safemon\safemon.dll
O4 - HKLM\..\Run: [RavTask] "D:\蓝色网络\蓝色网络\蓝色软件\瑞星软件\瑞星杀毒\RavTask.exe" -system
O4 - HKLM\..\Run: [MenuOrder] C:\Program Files\ICBCPe~1\ICBC\BHDC(Personal)\MenuOrder\MenuOrder.exe
O4 - HKLM\..\Run: [runeip] C:\Program Files\Rising\AntiSpyware\runiep.exe
O4 - HKLM\..\Run: [360Safetray] D:\蓝色网络\蓝色网络\蓝色软件\360安全卫士\safemon\360Tray.exe /start
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: 收藏到QQ书签 - http://shuqian.qq.com/favit.html
O8 - Extra context menu item: 添加到QQ表情 - D:\蓝色网络\腾讯网络\腾讯软件\腾讯QQ\AddEmotion.htm
O16 - DPF: {2354A44B-3CEB-4829-9940-545B03103538} (PowerPlr Control) - http://5151c.wz16300.com/plugin/PowerPlr3200.ocx
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (EditCtrl Class) - https://img.alipay.com/download/1101/aliedit.cab
O16 - DPF: {62B938C4-4190-4F37-8CF0-A92B0A91CC77} (InfoSecNetSign Class) - https://mybank.icbc.com.cn/icbc/NetSign.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1181596358718
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O16 - DPF: {8686F2A6-DC01-4E8F-BDE3-DCC7DBBAD6AE} (163Uploader Control) - http://photo.163.com/163Uploader.cab
O16 - DPF: {DA215190-98B2-47DE-AE24-DA95481DFFBA} (AxUSBKey Class) - https://mybank.icbc.com.cn/icbc/perbank/AxUSBKey.CAB
O16 - DPF: {E787FD25-8D7C-4693-AE67-9406BC6E22DF} (PasswordEditCtrl Class) - https://www.tenpay.com/download/qqedit.cab
O16 - DPF: {E847C78C-C210-4195-8799-FBF3BF89797D} - http://scan.www.duba.net/duba/download/install/onlinescan/KOSInit.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\蓝色网络\蓝色网络\蓝色软件\瑞星软件\瑞星杀毒\CCenter.exe
O23 - Service: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\蓝色网络\蓝色网络\蓝色软件\瑞星软件\瑞星杀毒\Ravmond.exe

各位高手：
非常感谢您留心我这份系统诊断报告，小菜鸟十万火急等待您的帮助！
该诊断报告由360安全卫士提供 http://www.360safe.com
诊断时间: 2007-06-27  06:35:10
诊断平台: Microsoft Windows XP  Service Pack 2
IE版本: Internet Explorer V7.0.5730.11 Build:75730
计算机物理内存:1023MB - 当前可用内存:695MB

100 - 未知 - Process: RavMonD.exe [RavMond] -
100 - 未知 - Process: RavTask.exe [RavTimer] -
100 - 未知 - Process: RavMon.exe [RavMon] -
O2 - 未知 - BHO: (QQCycloneHelper Class) - [超级旋风下载组件] - {39F7E361-828A-4B5A-BCAF-5B79BFDFEA60} - D:\蓝色网络\腾讯网络\腾讯软件\超级旋风\QQIEHelper01.dll
O8 - 未知 - Extra context menu item: 收藏到QQ书签 - http://shuqian.qq.com/favit.html
O8 - 未知 - Extra context menu item: 添加到QQ表情 - D:\蓝色网络\腾讯网络\腾讯软件\腾讯QQ\AddEmotion.htm
O16 - 未知 - DPF: {2354A44B-3CEB-4829-9940-545B03103538} (PowerPlr Control) - http://5151c.wz16300.com/plugin/PowerPlr3200.ocx
O16 - 未知 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (EditCtrl) - https://img.alipay.com/download/1101/aliedit.cab
O16 - 未知 - DPF: {8686F2A6-DC01-4E8F-BDE3-DCC7DBBAD6AE} (163Uploader Control) - http://photo.163.com/163Uploader.cab
O16 - 未知 - DPF: {DA215190-98B2-47DE-AE24-DA95481DFFBA} (AxUSBKey) - https://mybank.icbc.com.cn/icbc/perbank/AxUSBKey.CAB
O16 - 未知 - DPF: {E787FD25-8D7C-4693-AE67-9406BC6E22DF} (PasswordEditCtrl) - https://www.tenpay.com/download/qqedit.cab
O16 - 未知 - DPF: 无效的CLSID：{E847C78C-C210-4195-8799-FBF3BF89797D} ({E847C78C-C210-4195-8799-FBF3BF89797D}) - http://scan.www.duba.net/duba/download/install/onlinescan/KOSInit.cab
O23 - 未知 - Service: Ati External Event Utility [Ati External Event Utility] - C:\WINDOWS\system32\Ati2evxx.exe - (running)
O23 - 未知 - Service: RsCCenter [Rising Process Communication Center] - "D:\蓝色网络\蓝色网络\蓝色软件\瑞星软件\瑞星杀毒\CCenter.exe" - (running)
O23 - 未知 - Service: RsRavMon [Rising RealTime Monitor] - "D:\蓝色网络\蓝色网络\蓝色软件\瑞星软件\瑞星杀毒\Ravmond.exe" - (running)

=======================================

100 - 安全 - Process: smss.exe [进程为会话管理子系统用以初始化系统变量，ms-dos驱动名称类似lpt1以及com，调用win32壳子系统和运行在windows登陆过程。] - C:\WINDOWS\System32\smss.exe
100 - 安全 - Process: csrss.exe [客户端服务子系统，用以控制windows图形相关子系统。] - C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=base
100 - 安全 - Process: winlogon.exe [windows nt用户登陆程序。] - C:\WINDOWS\system32\winlogon.exe
100 - 安全 - Process: services.exe [用于管理windows服务系统进程。] - C:\WINDOWS\system32\services.exe
100 - 安全 - Process: lsass.exe [本地安全权限服务控制windows安全机制。] - C:\WINDOWS\system32\lsass.exe
100 - 安全 - Process: ati2evxx.exe [ati显卡相关后台程序。] - C:\WINDOWS\system32\Ati2evxx.exe
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost -k DcomLaunch
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost -k rpcss
100 - 安全 - Process: CCenter.exe [瑞星杀毒软件控制台相关程序。] -
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\System32\svchost.exe -k netsvcs
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost.exe -k NetworkService
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost.exe -k LocalService
100 - 安全 - Process: spoolsv.exe [windows打印任务控制程序，用以打印机就绪。] - C:\WINDOWS\system32\spoolsv.exe
100 - 安全 - Process: scardsvr.exe [对插入在计算机智能卡阅读器中的智能卡进行管理和访问控制。] - C:\WINDOWS\System32\SCardSvr.exe
100 - 安全 - Process: alg.exe [这是一个应用层网关服务用于网络共享。] - C:\WINDOWS\System32\alg.exe
100 - 安全 - Process: explorer.exe [windows program manager或者windows explorer用于控制windows图形shell，包括开始菜单、任务栏，桌面和文件管理。] - C:\WINDOWS\Explorer.EXE
100 - 安全 - Process: runiep.exe [卡卡上网安全助手IE防漏墙相关程序。] - C:\Program Files\Rising\AntiSpyware\runiep.exe
100 - 安全 - Process: 360tray.exe [360安全卫士实时保护模块] - D:\蓝色网络\蓝色网络\蓝色软件\360安全卫士\safemon\360Tray.exe
100 - 安全 - Process: ctfmon.exe [office xp输入法图标。] - C:\WINDOWS\system32\ctfmon.exe
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost.exe -k imgsvc
100 - 安全 - Process: wuauclt.exe [windows操作系统后台程序，用于系统升级。] - C:\WINDOWS\system32\wuauclt.exe
100 - 安全 - Process: 360Safe.exe [360安全卫士] - D:\蓝色网络\蓝色网络\蓝色软件\360安全卫士\360Safe.exe
R1 - 安全 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=about:blank
R1 - 安全 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\system32\blank.htm
O2 - 安全 - BHO: (BitComet Helper) - [下载软件BitComet的相关程序。] - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\蓝色网络\蓝色网络\蓝色软件\BitComet\tools\BitCometBHO_1.1.6.14.dll
O2 - 安全 - BHO: (VnetCookie Class) - [星空极速， 拨号软件。] - {4E83D567-4697-4F7B-B1F0-A513B01DB89A} - c:\PROGRA~1\chinanet\VNETTR~1.DLL
O4 - 安全 - HKLM\..\Run: [RavTask] [瑞星杀毒软件的任务计划程序。] "D:\蓝色网络\蓝色网络\蓝色软件\瑞星软件\瑞星杀毒\RavTask.exe" -system
O4 - 安全 - HKLM\..\Run: [MenuOrder] [中国工商银行emv信用卡相关程序。] C:\Program Files\ICBCPe~1\ICBC\BHDC(Personal)\MenuOrder\MenuOrder.exe
O4 - 安全 - HKLM\..\Run: [runeip] [卡卡上网安全助手相关程序。] C:\Program Files\Rising\AntiSpyware\runiep.exe
O4 - 安全 - HKLM\..\Run: [360Safetray] [360safe实时保护功能模块。] D:\蓝色网络\蓝色网络\蓝色软件\360安全卫士\safemon\360Tray.exe /start
O4 - 安全 - HKCU\..\Run: [ctfmon.exe] [office xp输入法图标。] C:\WINDOWS\system32\ctfmon.exe
O16 - 安全 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/9/b/d/9bdc68ef-6a9f-4505-8fb8-d0d2d160e512/LegitCheckControl.cab
O16 - 安全 - DPF: {62B938C4-4190-4F37-8CF0-A92B0A91CC77} (农业银行云网) - https://mybank.icbc.com.cn/icbc/NetSign.dll
O16 - 安全 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (Windows升级工具V5) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1181596358718
O16 - 安全 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (中国工商银行个人银行) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O23 - 安全 - Service: Ati HotKey Poller [ati显卡相关后台程序。] - C:\WINDOWS\system32\Ati2evxx.exe - (not running)
O25 - 安全 - ABOUT: DesktopItemNavigationFailure - res://ieframe.dll/navcancl.htm
O25 - 安全 - ABOUT: NavigationCanceled - res://ieframe.dll/navcancl.htm
O25 - 安全 - ABOUT: NavigationFailure - res://ieframe.dll/navcancl.htm
O25 - 安全 - ABOUT: OfflineInformation - res://ieframe.dll/offcancl.htm
O25 - 安全 - ABOUT: PostNotCached - res://ieframe.dll/repost.htm

O40 - winlogon.exe - A.E.T. Europe B.V. - C:\WINDOWS\system32\aetcsss1.dll - CSP Library - 479a1f2d9b021f9ad27c0bd1ce7d518c
O40 - winlogon.exe - A.E.T. Europe B.V. - C:\WINDOWS\system32\aetdlss1.dll - aetdlss1 - 9eddddd9b349b8ab43db4523477d73fc
O40 - winlogon.exe - A.E.T. Europe B.V. - C:\WINDOWS\system32\aetpkss1.dll - PKCS #11 Cryptoki Library - e7ed5dd8ac03bcc975f12e41175b7c3c
O40 - Explorer.EXE - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\AntiSpyware\ieprot.dll - IE Protector - 369c1d78953b00cf8306e7028654092d
O40 - Explorer.EXE - Beijing Rising Technology Co., Ltd. - D:\蓝色网络\蓝色网络\蓝色软件\瑞星软件\瑞星杀毒\RSCOMMON.DLL - Rising Common Function Dynamic Link Library - 58432e6c58f1b4c339adc1a79bf864b6
O40 - Explorer.EXE - Beijing Rising Technology Co., Ltd. - C:\WINDOWS\system32\RavExt.dll - Rising Shell Ext Module - fa20734a7acabcfe9d727fb343da4e8a
O40 - Explorer.EXE - Fygsoft and Microsoft - D:\蓝色网络\蓝色网络\蓝色软件\木马清~1\FTCCOM~1.DLL - Com组件菜单 - ccdf1edbe51cd961bc31ae7894d73de0

=======================================

O41 - BaseTDI - basetdi - C:\WINDOWS\system32\drivers\basetdi.sys - (running) - basetdi - Beijing Rising Technology Co., Ltd. - 0064810c1b03f2c889130b669a4ce937
O41 - ExpScaner - ExpScan.sys - D:\蓝色网络\蓝色网络\蓝色软件\瑞星软件\瑞星杀毒\ExpScan.sys - (running) - ExpScan.sys -  - 5a690926c7181d5c0b2721016442c9c3
O41 - HookCont - HookCont - D:\蓝色网络\蓝色网络\蓝色软件\瑞星软件\瑞星杀毒\HookCont.sys - (running) - HookCont - Rising - 3926cb7b005564bc77d6b40235c53817
O41 - HookReg - HookReg - D:\蓝色网络\蓝色网络\蓝色软件\瑞星软件\瑞星杀毒\HOOKREG.sys - (running) -  -  - 997c395147f8e5b3f714bdd112fe8945
O41 - HookSys - Hooksys - D:\蓝色网络\蓝色网络\蓝色软件\瑞星软件\瑞星杀毒\HookSys.sys - (running) - Hooksys - Rising - 265b67f85db6226f2439e13e7c1fa8bf
O41 - MEMSCAN - MemScan Driver - D:\蓝色网络\蓝色网络\蓝色软件\瑞星软件\瑞星杀毒\MemScan.sys - (running) - MemScan Driver - 瑞星软件有限公司 - 9811b256023dd985cbc5bad790e5bb84
O41 - MTsensor - ATK0100 ACPI Utility - C:\WINDOWS\system32\drivers\ATKACPI.sys - (running) - ATK0100 ACPI Utility - ATK0100 - 97affa9d95ffe20eee6229bc6be166cf
O41 - npkcrypt - nProtect KeyCrypt Driver - D:\蓝色网络\腾讯网络\腾讯软件\腾讯QQ\npkcrypt.sys - (running) - nProtect KeyCrypt Driver - INCA Internet Co., Ltd. - 8bcb281a2540e7aff0cd00f9878fe21f
O41 - QKeyService - KeyCrypt Device Driver - C:\WINDOWS\system32\KeyCrypt.sys - (running) - KeyCrypt Device Driver - Tencent Technology (Shenzhen) Company Limited - 86aadf81964cc6c4c8ce9d27a7a0c533
O41 - RsAntiSpyware - Anti-RootKit Driver - C:\WINDOWS\system32\drivers\RsBoot.sys - (running) - Anti-RootKit Driver - Beijing Rising Technology Co., Ltd. - cb84b955e179c6b9931803262e1f10f3
O41 - RsNTGDI - RsNTGDI - C:\WINDOWS\system32\drivers\RsNTGdi.sys - (running) - RsNTGDI - Beijing Rising Technology Co., Ltd. - 17214e7b192cb93ff014fca1484b97ad
O41 - RSPPSYS - RSPPSYS.SYS - D:\蓝色网络\蓝色网络\蓝色软件\瑞星软件\瑞星杀毒\rsppsys.sys - (running) - RSPPSYS.SYS - Rising - f38c10d8c21626a4878ea16717e971fa
O41 - EagleNT - EagleNT - C:\WINDOWS\system32\drivers\EagleNT.sys - (not running) -  -  -
O41 - NETw3x32 - NETw3x32 - C:\WINDOWS\system32\DRIVERS\NETw3x32.sys - (not running) -  -  -
O41 - NPF - NPF - C:\WINDOWS\system32\drivers\npf.sys - (not running) -  -  -
O41 - R300 - ATI Radeon Kernel Mode Driver - C:\WINDOWS\system32\drivers\atikmdag.sys - (not running) - ATI Radeon Kernel Mode Driver - ATI Technologies Inc. - 554685122b4f973e21d66c2baaf29543
O41 - RTL8169 - Realtek 8101/8168/8169 NDIS6 32-bit Driver - C:\WINDOWS\system32\drivers\Rtlh86.sys - (not running) - Realtek 8101/8168/8169 NDIS6 32-bit Driver - Realtek Corporation - 455f7f7974211ea11b81f0f4e528e258
O41 - s24trans - s24trans - C:\WINDOWS\system32\DRIVERS\s24trans.sys - (not running) -  -  -
O41 - TesSafe - TesSafe - C:\WINDOWS\system32\TesSafe.sys - (not running) -  -  - 1770d643671f932464de3a945de0f5cc

=======================================
360Safe.exe=3.3.0.1005
AntiAdwa.dll=3.3.0.1004
AntiEng.dll=3.3.0.1001
AntiActi.dll=2.0.0.3000
CleanHis.dll=3.0.2.1000
live.dll=1.0.0.1012

RS这样提示，你重启就应该没事了

哎...以后还会提示阿..你没看我提示了这么多??

在顶下咯..谁帮我看看呀

先打上ms07-027,和Ani的补丁！其他的全是脚本病毒，现把文件路径贴上来，日志理没见到！~~~~~~~~~~~~~