启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINNT\System32\Ctfmon.exe>  []
    <Google Desktop Search><; rem "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup>  []
    <internat.exe><; internat.exe>  [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><; 廍矟?    ?矸>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <Synchronization Manager><; mobsync.exe /logon>  [Microsoft Corporation]
    <yassistse><"C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe">  [Yahoo!]
    <TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
    <assistse><; "C:\PROGRA~1\3721\assistse.exe">  [yahoo]
    <helper.dll><; C:\WINNT\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32>  []
    <MINI_BFYY><; C:\Program Files\Ringz Studio\Storm Downloader\StormDownloader.exe>  [深圳市三代科技开发有限公司]
    <SSLcnt><; rem "F:\网上下载软件\汉唐证券\sslcnt\SSLCnt.exe">  [杭州核新软件技术有限公司]
    <ThunderMini><; C:\Program Files\Thunder Network\ThunderMini\ThunderMiniShell.exe>  []
    <vptray><; C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe>  [Symantec Corporation]
    <YLive.exe><; C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe>  [ ]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [Microsoft Corporation]
    <Userinit><C:\WINNT\system32\userinit.exe,>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{D157330A-9EF3-49F8-9A67-4141AC41ADD4}><C:\WINNT\downlo~1\CnsHook.dll>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
    <WinlogonNotify: NavLogon><C:\WINNT\system32\NavLogon.dll>  []

==================================
启动文件夹
服务
[DefWatch / DefWatch]
  <C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe><Symantec Corporation>
[Logical Disk Manager Administrative Service / dmadmin]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[DameWare Mini Remote Control / DWMRCS]
  <C:\WINNT\SYSTEM32\DWRCS.EXE -service><DameWare Development LLC>
[EPSON Printer Status Agent2 / EPSONStatusAgent2]
  <C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe><SEIKO EPSON CORPORATION>
[Symantec AntiVirus Client / Norton AntiVirus Server]
  <C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe><Symantec Corporation>
[NVIDIA Driver Helper Service / NVSvc]
  <C:\WINNT\System32\nvsvc32.exe><NVIDIA Corporation>

==================================
浏览器加载项
[]
  {089FD14D-132B-48FC-8861-0048AE113215} <C:\Program Files\SiteAdvisor\saIE.dll, McAfee>
[wmicsmgr]
  {333872C4-92D6-4396-8542-64AB96518950} <C:\WINNT\system32\wmicsmgr.dll, N/A>
[IeCatch2 Class]
  {A5366673-E8CA-11D3-9CD9-0090271D075B} <C:\PROGRA~1\FlashGet\jccatch.dll, Amaze Soft>
[上网助手]
  {BB936323-19FA-4521-BA29-ECA6A121BC78} <C:\Program Files\3721\Assist\asbar.dll, 3721>
[CnsHook Class]
  {D157330A-9EF3-49F8-9A67-4141AC41ADD4} <C:\WINNT\downlo~1\CnsHook.dll, N/A>
[手机短信]
  {00000000-0000-0001-0001-596BAEDD1289} <http://sms.3721.com/ie/index.htm, N/A>
[情景聊天]
  {0F7DE07D-BD74-4991-9D5F-ECBB8391875D} <http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/, N/A>
[上网助手]
  {5D73EE86-05F1-49ed-B850-E423120EC338} <http://assistant.3721.com/index.htm?fb=Cns, N/A>
[]
  {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} <http://assistant.3721.com/security1.htm?fb=Cns, N/A>
[]
  {FD00D911-7529-4084-9946-A29F1BDF4FE5} <http://assistant.3721.com/clean1.htm?fb=Cns, N/A>
[百万图库]
  {6713E8D2-850A-101B-AFC0-4210102A8DA7} <http://www.26-3.com/star, N/A>
[铃声图片下载]
  {7713E8D2-850A-101B-AFC0-4210102A8DA7} <http://www.26-3.com/sms/index.htm, N/A>
[@msdxmLC.dll,-1@2052,电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\System32\msdxm.ocx, Microsoft Corporation>
[上网助手]
  {BB936323-19FA-4521-BA29-ECA6A121BC78} <C:\Program Files\3721\Assist\asbar.dll, 3721>
[SiteAdvisor]
  {0BF43445-2F28-4351-9252-17FE6E806AA0} <C:\Program Files\SiteAdvisor\saIE.dll, McAfee>
[趋势科技在线扫毒程序]
  {74D05D43-3236-11D4-BDCD-00C04F9A3B61} <C:\WINNT\DOWNLO~1\xscan53.ocx, Trend Micro Inc.>
[使用网际快车下载]
  <C:\Program Files\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
  <C:\Program Files\FlashGet\jc_all.htm, N/A>
[添加到QQ自定义面板]
  <F:\网上下载软件\QQ2004奥运\AddPanel.htm, N/A>
[添加到QQ表情]
  <F:\网上下载软件\QQ2004奥运\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <F:\网上下载软件\QQ2004奥运\SendMMS.htm, N/A>

正在运行的进程
[PID: 208][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.00.2195.5695>
[PID: 168][\??\C:\WINNT\system32\csrss.exe]  <Microsoft Corporation><5.00.2195.5265>
[PID: 136][\??\C:\WINNT\system32\winlogon.exe]  <Microsoft Corporation><5.00.2195.6970>
    [C:\WINNT\system32\JPWB.IME]  <常诚研制><4.00.950>
    [C:\WINNT\system32\NavLogon.dll]  <N/A><N/A>
[PID: 236][C:\WINNT\system32\services.exe]  <Microsoft Corporation><5.00.2195.3940>
    [C:\WINNT\system32\dmserver.dll]  <VERITAS Software Corp.><2195.3649.297.3>
[PID: 248][C:\WINNT\system32\lsass.exe]  <Microsoft Corporation><5.00.2195.6902>
[PID: 428][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 452][C:\WINNT\system32\spoolsv.exe]  <Microsoft Corporation><5.00.2195.4299>
    [C:\WINNT\system32\E_SL2352.DLL]  <SEIKO EPSON CORPORATION><2, 15, 0, 0>
[PID: 480][C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe]  <Symantec Corporation><8.1.0.821>
[PID: 500][C:\WINNT\SYSTEM32\DWRCS.EXE]  <DameWare Development LLC><4, 9, 2, 5>
[PID: 524][C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe]  <SEIKO EPSON CORPORATION><1, 2, 0, 0>
    [C:\WINNT\system32\EBAPI2.DLL]  <SEIKO EPSON CORPORATION><1, 1, 0, 0>
    [C:\Program Files\Common Files\EPSON\EBAPI\EBPLPT.DLL]  <SEIKO EPSON CORPORATION><2, 14, 0, 0>
[PID: 568][C:\WINNT\System32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 604][C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe]  <Symantec Corporation><8.1.0.821>
    [C:\WINNT\system32\CBA.DLL]  <Intel? Corporation><6.12.0.105 E>
    [C:\WINNT\system32\MsgSys.dll]  <Intel? Corporation><6.12.0.105 E>
    [C:\WINNT\system32\NTS.dll]  <Intel? Corporation><6.12.0.105 E>
    [C:\WINNT\system32\PDS.DLL]  <Intel? Corporation><6.12.0.105 E>
    [C:\PROGRA~1\SYMANT~1\SYMANT~1\NAVLU.dll]  <Symantec Corporation><8.1.0.821>
    [C:\PROGRA~1\SYMANT~1\SYMANT~1\NAVNTUTL.DLL]  <Symantec/Peter Norton Group><1, 0, 0, 1>
    [C:\PROGRA~1\SYMANT~1\SYMANT~1\i2ldvp3.dll]  <Symantec Corporation><8.1.0.821>
    [C:\PROGRA~1\SYMANT~1\SYMANT~1\NAVAPI32.DLL]  <Symantec Corp.><4.2.0.7>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20060803.048\NAVEX32a.DLL]  <Symantec Corporation><20061.2.0.26>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20060803.048\NAVENG32.DLL]  <Symantec Corporation><20061.2.0.26>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVAP32.DLL]  <Symantec Corporation><9.1.0.26>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\SSC\Scandlgs.dll]  <Symantec Corporation><8.1.0.821>
    [C:\Program Files\Common Files\Symantec Shared\SSC\LDVPCtls.ocx]  <Symantec Corporation><8.1.0.821>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Cliscan.dll]  <Symantec Corporation><8.1.0.821>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DecSDK.dll]  <Symantec Corporation><3.02.09.07>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2.dll]  <Symantec Corporation><3.02.09.07>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2ID.dll]  <Symantec Corporation><3.02.09.07>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2UUE.dll]  <Symantec Corporation><3.02.09.07>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2AMG.dll]  <Symantec Corporation><3.02.09.07>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2ARJ.dll]  <Symantec Corporation><3.02.09.07>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2CAB.dll]  <Symantec Corporation><3.02.09.07>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2EXE.dll]  <Symantec Corporation><3.02.09.07>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2GZIP.dll]  <Symantec Corporation><3.02.09.07>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2HQX.dll]  <Symantec Corporation><3.02.09.07>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2LHA.dll]  <Symantec Corporation><3.02.09.07>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2LZ.dll]  <Symantec Corporation><3.02.09.07>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2MIME.dll]  <Symantec Corporation><3.02.09.07>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2SS.dll]  <Symantec Corporation><3.02.09.07>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2RTF.dll]  <Symantec Corporation><3.02.09.07>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2TAR.dll]  <Symantec Corporation><3.02.09.07>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2TNEF.dll]  <Symantec Corporation><3.02.09.07>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2ZIP.dll]  <Symantec Corporation><3.02.09.07>
[PID: 684][C:\WINNT\System32\nvsvc32.exe]  <NVIDIA Corporation><6.13.10.4103>
[PID: 704][C:\WINNT\system32\regsvc.exe]  <Microsoft Corporation><5.00.2195.3649>
[PID: 400][C:\WINNT\system32\stisvc.exe]  <Microsoft Corporation><5.00.2195.3649>
[PID: 860][C:\WINNT\System32\WBEM\WinMgmt.exe]  <Microsoft Corporation><1.50.1085.0070>
[PID: 892][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 1040][C:\WINNT\Explorer.EXE]  <Microsoft Corporation><5.00.3502.5321>
    [C:\WINNT\system32\JPWB.IME]  <常诚研制><4.00.950>
    [C:\Program Files\3721\Assist\asbar.dll]  <3721><1, 0, 0, 8>
    [C:\PROGRA~1\3721\Assist\ieaUI.dll]  <yahoo!china><1, 0, 1, 1005>
    [C:\PROGRA~1\3721\Assist\TbWrap.dll]  <3721><1, 0, 0, 2>
    [C:\PROGRA~1\3721\Assist\asnoad.dll]  <><1, 0, 0, 9>
    [C:\PROGRA~1\3721\Assist\aswiper.dll]  <3721><1, 0, 0, 3>
    [C:\PROGRA~1\3721\Assist\asiesec.dll]  <yahoo><1, 0, 0, 9>
    [C:\PROGRA~1\FlashGet\jccatch.dll]  <Amaze Soft><1, 1, 4, 0>
[PID: 1060][C:\WINNT\SYSTEM32\DWRCST.exe]  <DameWare Development><4, 9, 2, 5>
    [C:\WINNT\system32\JPWB.IME]  <常诚研制><4.00.950>
[PID: 1072][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 900][C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe]  <Yahoo!><1, 0, 1, 1001>
    [C:\WINNT\system32\JPWB.IME]  <常诚研制><4.00.950>
    [C:\PROGRA~1\Yahoo!\Assistant\shell\yAsMenu.dll]  <Yahoo><1, 0, 1, 1006>
    [C:\PROGRA~1\Yahoo!\Assistant\shell\yAssecblk.dll]  <Yahoo><1, 0, 2, 1002>
    [C:\PROGRA~1\Yahoo!\Assistant\shell\yIEAngel.dll]  <Yahoo><1, 0, 1, 1001>
    [C:\PROGRA~1\Yahoo!\Assistant\shell\yMenuInfo.dll]  <Yahoo><1, 0, 0, 2>
[PID: 848][C:\Program Files\VnetClient1.6\VnetClient.exe]  <><1, 0, 0, 1>
    [C:\WINNT\system32\JPWB.IME]  <常诚研制><4.00.950>
[PID: 1412][C:\Documents and Settings\Administrator\桌面\VPTray.exe]  <Symantec Corporation><8.1.0.821>
    [C:\WINNT\system32\JPWB.IME]  <常诚研制><4.00.950>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Cliproxy.dll]  <Symantec Corporation><8.1.0.821>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVNTUTL.DLL]  <Symantec/Peter Norton Group><1, 0, 0, 1>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Cliscan.dll]  <Symantec Corporation><8.1.0.821>
[PID: 1436][C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\VPC32.EXE]  <Symantec Corporation><8.1.0.821>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\S32NAVS.DLL]  <Symantec Corporation><5.3.0.180>
    [C:\WINNT\system32\JPWB.IME]  <常诚研制><4.00.950>
    [C:\Program Files\Common Files\Symantec Shared\SSC\LDVPCtls.ocx]  <Symantec Corporation><8.1.0.821>
    [C:\Program Files\Common Files\Symantec Shared\SSC\LDVPView.ocx]  <Symantec Corporation><8.1.0.821>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\SSC\LDVPTask.ocx]  <Symantec Corporation><8.1.0.821>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Cliscan.dll]  <Symantec Corporation><8.1.0.821>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVNTUTL.DLL]  <Symantec/Peter Norton Group><1, 0, 0, 1>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Cliproxy.dll]  <Symantec Corporation><8.1.0.821>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVAP32.DLL]  <Symantec Corporation><9.1.0.26>
    [C:\Program Files\Common Files\Symantec Shared\SSC\webshell.dll]  <Symantec Corporation><8.1.0.821>
[PID: 1312][C:\KuGoo\20066121353032646\SREng\SREng.exe]  <Smallfrogs Studio><2.0.21.505>
    [C:\WINNT\system32\JPWB.IME]  <常诚研制><4.00.950>

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================