==============================================================
金山清理专家系统诊断报告
该诊断报告由金山清理专家提供
http://www.duba.net ==============================================================
诊断时间: 2008-06-05, 20:26
诊断平台: Windows XP [5.1.2600] Service Pack 2
IE版本: Internet Explorer V6.0.2180.2900
计算机物理内存: 959(MB)
当前可用内存: 550(MB)
硬盘总大小: 135(GB)
硬盘可用空间: 124(GB)
清理专家版本: 2007,12,03,328
恶意软件库版本: 2007.11.26.2
漏洞库版本: 2007.11.21.1
==============================================================
App Init DLLs
==============================================================
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
[AppInit_DLLs] <dchbnq.dll,wipicdec.dll,wrhfov.dll,fmsiocps.dll,asvvkt.dll,nfbizd.dll,vuynes.dll,gxqnsz.dll,lzjlaz.dll,naarzw.dll,kyhrsd.dll,quwfan.dll,ogsari.dll,qlxvzd.dll,vjulmx.dll>
==============================================================
常规启动项
==============================================================
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[anistio] <C:\WINDOWS\anistio.exE>
[dionpis] <C:\WINDOWS\dionpis.exe>
[mfchlp64] <C:\WINDOWS\mfchlp64.exe>
[ebmqitkn] <C:\WINDOWS\bqtnylpf.exe>
[fmsjhif] <C:\WINDOWS\fmsjhif.exe>
[dbhlp32] <C:\WINDOWS\dbhlp32.exe>
[hefcndy] <C:\WINDOWS\hefcndy.exe>
[huifitc] <C:\WINDOWS\huifitc.exe>
[bincdwsa] <C:\WINDOWS\bincdwsa.exe>
[fmbiost] <C:\WINDOWS\fmbiost.exe>
[dndsioc] <C:\WINDOWS\dndsioc.exe>
[kvonreboot] <C:\WINDOWS\system32\360Kill.bat>
[lenovostudyhelp] < >
==============================================================
延迟加载
==============================================================
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
[midimapms] <C:\WINDOWS\system32\midimapms.dll>
[midimapzx] <C:\WINDOWS\system32\midimapzx.dll>
文件路径: C:\WINDOWS\system32\midimapzx.dll [病毒程序]
[midimapqn3] <C:\WINDOWS\system32\midimapqn3.dll>
[midimapgj] <C:\WINDOWS\system32\midimapgj.dll>
[midimapwl] <C:\WINDOWS\system32\midimapwl.dll>
[midimapjr] <C:\WINDOWS\system32\midimapjr.dll>
文件路径: C:\WINDOWS\system32\midimapjr.dll [未知]
==============================================================
执行挂钩
==============================================================
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{398C9B84-4EF7-47B5-9862-DE29543B3C42}> <C:\Program Files\Internet Explorer\PLUGINS\DosSys16.Sys>
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{17DFD111-BF3A-4CB4-ADB0-88FCBFE69821}> <C:\WINDOWS\system32\hhrdxd.dll>
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{33512378-9874-5641-1025-985420368733}> <C:\WINDOWS\system32\oswxcttb.dll>
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{1DB3C525-5271-46F7-887A-D4E1ADAA7632}> <C:\WINDOWS\system32\hfrdzx.dll>
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{28EB3777-3E23-4E72-8449-A992D09D24C3}> <C:\WINDOWS\system32\zgfdet.dll>
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{7C8D1401-A58D-A81C-CD24-A5915C4517C7}> <C:\WINDOWS\system32\mnmhgsrv.dll>
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{DC3D30AE-0380-4151-8934-EE98A34B0370}> <C:\WINDOWS\system32\mfdesy.dll>
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{4F4F0064-71E0-4f0d-0014-708476C7815F}> <C:\WINDOWS\system32\midimapms.dll>
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{C0595A7E-2E2F-4B34-A83A-019270A0A464}> <C:\WINDOWS\system32\tdffdl.dll>
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{E8A3B193-77E3-4FB3-986D-F4FA4828BAFC}> <C:\WINDOWS\system32\wklsdd.dll>
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{4F4F0064-71E0-4f0d-0022-708476C7815F}> <C:\WINDOWS\system32\midimapqn3.dll>
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{81954FAC-1023-154F-895A-1458258AD818}> <C:\WINDOWS\system32\ypdjfbmp.dll>
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{2D698451-2015-6358-9871-2015987452D2}> <C:\WINDOWS\system32\apzhbtde.dll>
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{4F4F0064-71E0-4f0d-0003-708476C7815F}> <C:\WINDOWS\system32\midimapgj.dll>
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{841529CB-7F77-4B99-A895-B5441E0D302F}> <C:\WINDOWS\system32\jfrwdh.dll>
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{4F4F0064-71E0-4f0d-0004-708476C7815F}> <C:\WINDOWS\system32\midimapwl.dll>
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{35671234-7890-ABCD-CDEF-567801237653}> <C:\WINDOWS\system32\yxcschlp.dll>
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{84143967-B645-4BFF-B873-DA1DC886E9A7}> <C:\WINDOWS\system32\cedafb.dll>
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{461D2AB4-29A5-45C2-9134-D52272D3DE38}> <C:\WINDOWS\system32\rfdswc.dll>
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{4F4F0064-71E0-4f0d-0012-708476C7815F}> <C:\WINDOWS\system32\midimapjr.dll>
文件路径: C:\WINDOWS\system32\midimapjr.dll [未知]
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{8C41B7F7-3168-400D-A702-0E7EFE0BA304}> <C:\WINDOWS\system32\sgrefg.dll>
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{18093456-9012-4568-9076-908765467181}> <C:\WINDOWS\system32\tisqatyu.dll>
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{B29583D8-033A-4B9F-8553-7C5458F3FB8E}> <C:\WINDOWS\system32\jdsaex.dll>
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{1E51C0FD-EE36-434B-AD2A-FD1FF3731C38}> <C:\WINDOWS\system32\wyrsdj.dll>
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{EA5D4B0E-B8CE-4761-8C7E-5D26369F0EC6}> <C:\WINDOWS\system32\fsrgeb.dll>
==============================================================
启动文件夹位置
==============================================================
Common Startup: C:\Documents and Settings\All Users\「开始」菜单\程序\启动
Startup: C:\Documents and Settings\Administrator\「开始」菜单\程序\启动
Common Startup: %ALLUSERSPROFILE%\「开始」菜单\程序\启动
==============================================================
系统服务
==============================================================
该项来源: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
[HidServ] [已禁用] <%SystemRoot%\System32\hidserv.dll>
[KWatchSvc] [已启用] <"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KWatch.EXE">
==============================================================
驱动程序
==============================================================
该项来源: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
[00039b37] [已启用] <\??\C:\WINDOWS\system32\Drivers\00039b37.sys>
[cqit] [已启用] <\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp26D.tmp>
[dohs] [已启用] <\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp284.tmp>
[drop] [已启用] <\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp27B.tmp>
[fmsq] [已启用] <\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp26F.tmp>
[IIS Manager ] [已启用] <\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1.tmp>
[jtio] [已启用] <\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp273.tmp>
[mhfp] [已启用] <\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp27E.tmp>
[mnsf] [已启用] <\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp28E.tmp>
[msfpfis64] [已启用] <\??\C:\WINDOWS\system32\drivers\msosmsfpfis64.sys>
[msp2p32] [已禁用] <\??\C:\WINDOWS\system32\drivers\msosmsp2p32.sys>
文件路径: C:\WINDOWS\system32\drivers\msosmsp2p32.sys [可疑的]
[npkcrypt] [已启用] <\??\C:\WINDOWS\system32\npkcrypt.sys>
[npkycryp] [已启用] <\??\C:\WINDOWS\system32\npkycryp.sys>
[ping] [已启用] <\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp271.tmp>
[ptfs] [已启用] <\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp277.tmp>
[zftp] [已启用] <\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp269.tmp>
==============================================================
BHO
==============================================================
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
[{18093456-9012-4568-9076-908765467181}]
{18093456-9012-4568-9076-908765467181} <C:\WINDOWS\system32\tisqatyu.dll>
[{2D698451-2015-6358-9871-2015987452D2}]
{2D698451-2015-6358-9871-2015987452D2} <C:\WINDOWS\system32\apzhbtde.dll>
[{33512378-9874-5641-1025-985420368733}]
{33512378-9874-5641-1025-985420368733} <C:\WINDOWS\system32\oswxcttb.dll>
[{35671234-7890-ABCD-CDEF-567801237653}]
{35671234-7890-ABCD-CDEF-567801237653} <C:\WINDOWS\system32\yxcschlp.dll>
[{398C9B84-4EF7-47B5-9862-DE29543B3C42}]
{398C9B84-4EF7-47B5-9862-DE29543B3C42} <C:\Program Files\Internet Explorer\PLUGINS\DosSys16.Sys>
[{7C8D1401-A58D-A81C-CD24-A5915C4517C7}]
{7C8D1401-A58D-A81C-CD24-A5915C4517C7} <C:\WINDOWS\system32\mnmhgsrv.dll>
[{81954FAC-1023-154F-895A-1458258AD818}]
{81954FAC-1023-154F-895A-1458258AD818} <C:\WINDOWS\system32\ypdjfbmp.dll>
==============================================================
AcitveX控件
==============================================================
该项来源: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
[{18093456-9012-4568-9076-908765467181}]
<{18093456-9012-4568-9076-908765467181}> <C:\WINDOWS\system32\tisqatyu.dll>
[{2D698451-2015-6358-9871-2015987452D2}]
<{2D698451-2015-6358-9871-2015987452D2}> <C:\WINDOWS\system32\apzhbtde.dll>
[{33512378-9874-5641-1025-985420368733}]
<{33512378-9874-5641-1025-985420368733}> <C:\WINDOWS\system32\oswxcttb.dll>
[{35671234-7890-ABCD-CDEF-567801237653}]
<{35671234-7890-ABCD-CDEF-567801237653}> <C:\WINDOWS\system32\yxcschlp.dll>
[{398C9B84-4EF7-47B5-9862-DE29543B3C42}]
<{398C9B84-4EF7-47B5-9862-DE29543B3C42}> <C:\Program Files\Internet Explorer\PLUGINS\DosSys16.Sys>
[{7C8D1401-A58D-A81C-CD24-A5915C4517C7}]
<{7C8D1401-A58D-A81C-CD24-A5915C4517C7}> <C:\WINDOWS\system32\mnmhgsrv.dll>
[{81954FAC-1023-154F-895A-1458258AD818}]
<{81954FAC-1023-154F-895A-1458258AD818}> <C:\WINDOWS\system32\ypdjfbmp.dll>
==============================================================
其他安全区域
==============================================================
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
[显示摇曳 CPL 扩展] <deskpan.dll>
用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
