1   1  /  1  页   跳转

帮忙啊~~~~~~[face12]

帮忙啊~~~~~~[face12]

不小心下了个软件,安装的时候感觉不对劲,马上停止安装可是已经晚了,系统已经不听指挥了.CPU占有达到100,进程数有5.60个,重启后只有光突突的桌面,只能用任务管理器打开瑞星杀毒,杀了17个,再重起,才勉强能启动,可是很卡,而且经常跳出IE窗口.哪位大哥帮看看我的扫描报告
2006-09-15,11:20:46

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Home Edition Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中:
    所有的启动项目(包括注册表、启动文件夹、服务等)
    浏览器加载项
    正在运行的进程(包括进程模块信息)
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [Microsoft Corporation]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [Microsoft Corporation]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [Microsoft Corporation]
    <WebThunder><C:\Program Files\Thunder Network\WebThunder\WebThunder.exe>  [深圳市迅雷网络技术有限公司]
    <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>  [NVIDIA Corporation]
    <桌面图标文字自动透明><C:\Program Files\WoptiUtilities\WoptiMem.exe XP>  []
    <SoundMam><C:\WINDOWS\system32\SVOHOST.exe>  []
    <Torjan Program><C:\WINDOWS\WINLOGON.EXE>  [rmXYFBIwlnb8O7jRG8fS]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
    <Torjan Program><C:\WINDOWS\WINLOGON.EXE>  [rmXYFBIwlnb8O7jRG8fS]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    <9><C:\WINDOWS\system32\Ravdm.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\Userinit.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{D157330A-9EF3-49F8-9A67-4141AC41ADD4}><>  []
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll>  [Beijing Rising Technology Co., Ltd.]
    <{9A0CFC58-5A6F-41ba-9FFE-4320F4F62FBA}><C:\WINDOWS\system32\cnscheck.dll>  []

==================================
启动文件夹
[IE-Bar]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\IE-Bar.lnk><N>

==================================
服务
[NVIDIA Display Driver Service / NVSvc]
  <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[Rising Process Communication Center / RsCCenter]
  <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
  <"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[SVCHAST / SystemInspect]
  <C:\Program Files\SystemInspect\SVCHAST.exe><N/A>
[Update Service For Windows / winupdate]
  <C:\WINDOWS\winupdate.exe><N/A>

==================================
浏览器加载项
[]
  {3D898C55-74CC-4B7C-B5F1-45913F368388} <C:\PROGRA~1\SYSTEM~1\SYSTEM~1.DLL, N/A>
[]
  {A9930D97-9CF0-42A0-A10D-4F28836579D5} <F:\KuGoo3\KuGoo3DownXControl.ocx, N/A>
[]
  {D3931E9E-AE61-46B1-99BA-91C438A2C855} <C:\WINDOWS\system32\wp237211.dll, 3721公司<推荐使用>>
[]
  {E730189A-9973-4121-B046-AD1C161EC3AF} <C:\WINDOWS\system32\37211.dll, N/A>
[卡卡上网安全助手]
  {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, N/A>
[AxInputControl Class]
  {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL, >
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8a.ocx, Macromedia, Inc.>
[Rising Web Scan Object]
  {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.>
[Windows Media Player]
  {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
  {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[]
  {3D898C55-74CC-4B7C-B5F1-45913F368388} <C:\PROGRA~1\SYSTEM~1\SYSTEM~1.DLL, N/A>
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Active Desktop Mover]
  {72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
[AxInputControl Class]
  {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL, >
[MediaComm Class]
  {7670648D-461B-42AF-BDFE-46D26AF5EFF2} <F:\迅雷\Components\InMedia\MediaAddin07.dll, Thunder Networking Technologies,LTD>
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[AxSubmitControl Class]
  {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} <C:\WINDOWS\DOWNLO~1\SUBMIT~1.DLL, >
[PPRich]
  {9D966685-3D58-4170-B008-05BD7C1628B0} <C:\PROGRA~1\PPRich\PPRich.ocx, N/A>
[]
  {A9930D97-9CF0-42A0-A10D-4F28836579D5} <F:\KuGoo3\KuGoo3DownXControl.ocx, N/A>
[Microsoft Scriptlet Component]
  {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[卡卡上网安全助手]
  {AFF6E516-CBE5-4F8A-9C2F-38A68013E766} <C:\WINDOWS\system32\kakatool.dll, N/A>
[SearchAssistantOC]
  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
  {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
  {CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
  {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[QuickBtn]
  {D1BB7CF4-4463-4E91-88D7-ECC3CE0A13B7} <C:\Program Files\CoolWebsite\QuickLink.dll, N/A>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8a.ocx, Macromedia, Inc.>
[]
  {D3931E9E-AE61-46B1-99BA-91C438A2C855} <C:\WINDOWS\system32\wp237211.dll, 3721公司<推荐使用>>
[卡卡上网安全助手]
  {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, N/A>
[Rising Web Scan Object]
  {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.>
[]
  {E730189A-9973-4121-B046-AD1C161EC3AF} <C:\WINDOWS\system32\37211.dll, N/A>
[上传到QQ网络硬盘]
  <F:\QQ\AddToNetDisk.htm, N/A>
[使用KuGoo3下载(&K)]
  <F:\KuGoo3\KuGoo3DownX.htm, N/A>
[添加到QQ自定义面板]
  <F:\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <F:\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <F:\QQ\SendMMS.htm, N/A>
[访问通用网址]
  <C:\Program Files\CNNIC\Cdn\cnnic.htm, N/A>
最后编辑2006-09-15 20:33:27
分享到:
gototop
 

==================================
正在运行的进程
[PID: 448][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 528][\??\C:\WINDOWS\system32\csrss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 552][\??\C:\WINDOWS\system32\winlogon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 596][C:\WINDOWS\system32\services.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 608][C:\WINDOWS\system32\lsass.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 756][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\cnscheck.dll]  <N/A><N/A>
[PID: 812][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 884][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 932][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1028][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1236][C:\WINDOWS\Explorer.exe]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\myrx.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\RavExt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
    [C:\WINDOWS\system32\cnscheck.dll]  <N/A><N/A>
    [C:\PROGRA~1\SYSTEM~1\SYSTEM~1.DLL]  <N/A><N/A>
    [C:\WINDOWS\system32\wp237211.dll]  <3721公司<推荐使用>><1.0.0.0>
[PID: 1708][C:\WINDOWS\system32\nvsvc32.exe]  <NVIDIA Corporation><6.14.10.7184>
    [C:\WINDOWS\system32\cnscheck.dll]  <N/A><N/A>
[PID: 1832][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1856][C:\Program Files\SystemInspect\SVCHAST.exe]  <N/A><N/A>
    [C:\WINDOWS\system32\cnscheck.dll]  <N/A><N/A>
[PID: 1884][C:\WINDOWS\system32\wdfmgr.exe]  <Microsoft Corporation><5.2.3790.1230 built by: DNSRV(bld4act)>
[PID: 1924][C:\WINDOWS\winupdate.exe]  <N/A><N/A>
    [C:\WINDOWS\system32\cnscheck.dll]  <N/A><N/A>
[PID: 648][C:\Program Files\Thunder Network\WebThunder\WebThunder.exe]  <深圳市迅雷网络技术有限公司><1, 1, 6, 41>
    [C:\Program Files\Thunder Network\WebThunder\taskmanage.dll]  <Thunder Networking Technologies,LTD><1, 1, 0, 42>
    [C:\Program Files\Thunder Network\WebThunder\download_interface.dll]  <Thunder Networking Technologies,LTD><1, 0, 3, 70>
    [C:\Program Files\Thunder Network\WebThunder\asyn_dns.dll]  <N/A><N/A>
    [C:\Program Files\Thunder Network\WebThunder\RegisterDll.dll]  <Thunder Networking Technologies,LTD><2, 0, 0, 13>
    [C:\Program Files\Thunder Network\WebThunder\historyinfo_manage.dll]  <Thunder Networking Technologies,LTD><5, 2, 0, 150>
    [C:\Program Files\Thunder Network\WebThunder\UpdateDownload.dll]  <Thunder Networking Technologies,LTD><1, 0, 1, 8>
    [C:\Program Files\Thunder Network\WebThunder\UpdateExec.dll]  <Thunder Networking Technologies,LTD><1, 0, 1, 5>
    [C:\Program Files\Thunder Network\WebThunder\iEmbedShell.dll]  < ><1, 0, 0, 10>
    [F:\迅雷\Components\InMedia\iEmbed04.dll]  < ><2, 3, 0, 37>
    [C:\WINDOWS\system32\cnscheck.dll]  <N/A><N/A>
[PID: 1204][C:\WINDOWS\system32\ctfmon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\cnscheck.dll]  <N/A><N/A>
[PID: 1432][C:\WINDOWS\WINLOGON.EXE]  <rmXYFBIwlnb8O7jRG8fS><0.00.0106>
    [C:\WINDOWS\system32\cnscheck.dll]  <N/A><N/A>
[PID: 2000][C:\WINDOWS\system32\rundll32.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\DOCUME~1\Owner\TEMPLA~1\4fd03ab\1.dll]  <千橡互联><3, 0, 2, 0>
    [C:\DOCUME~1\Owner\TEMPLA~1\4fd03ab\3.dll]  <千橡互联><3, 0, 2, 8>
    [C:\DOCUME~1\Owner\TEMPLA~1\4fd03ab\4.dll]  <千橡互联><3, 0, 2, 8>
    [C:\WINDOWS\system32\cnscheck.dll]  <N/A><N/A>
[PID: 1300][C:\WINDOWS\system32\conime.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\cnscheck.dll]  <N/A><N/A>
[PID: 432][C:\Documents and Settings\Owner\桌面\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>
    [C:\WINDOWS\system32\cnscheck.dll]  <N/A><N/A>
[PID: 1332][C:\WINDOWS\system32\wuauclt.exe]  <Microsoft Corporation><5.4.3790.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1116][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\PROGRA~1\SYSTEM~1\SYSTEM~1.DLL]  <N/A><N/A>
    [F:\KuGoo3\KuGoo3DownXControl.ocx]  <N/A><N/A>
    [C:\WINDOWS\system32\wp237211.dll]  <3721公司<推荐使用>><1.0.0.0>

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================
gototop
 

C:\WINDOWS\winupdate.exe
http://forum.ikaka.com/topic.asp?board=28&artid=7713905
参照
gototop
 

你是说将注册表中WINUPDATE项删除是吗?
gototop
 

进入控制面版的添加删除程序中卸载IE-Bar

C:\WINDOWS\system32\Ravdm.exe这一项看以下的帖子
http://forum.ikaka.com/topic.asp?board=28&artid=8156736





打开System Repair Engineer(也就是你的扫描日志软件SREng.exe),点“启动项目,服务,点“Win32服务应用程序”勾选“隐藏微软服务”选中病毒服务Update Service For Windows,SVCHAST,选择“删除服务”点“设置”选择“否”最后重启。(每一个逗号隔开的就是一个病毒的服务,请逐一删除)

关闭所有浏览窗口以及一些不必要的程序
打开System Repair Engineer(也就是你的扫描日志软件SREng.exe),使用“系统修复,浏览器加载项”来删除以下选项。
C:\PROGRA~1\SYSTEM~1\SYSTEM~1.DLL
C:\WINDOWS\system32\wp237211.dll
C:\WINDOWS\system32\37211.dll
C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL
C:\Program Files\CoolWebsite\QuickLink.dll

请到www.27814939.ys168.com,点“我的软件”下载KillBox.exe
请到http://forum.ikaka.com/topic.asp?board=67&artid=5188931,下载,LSPFix.exe,WinsockXPFix这两个软件
重新启动电脑, 开机检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式进入Windows

运行LSPFix.exe
删除
cnscheck.dll
附说明一份
LSPFix.exe这个软件主要用来辅助修复HijackThis扫描发现的O10项。
使用时,请关闭所有IE界面和文件夹界面后运行LSPFix,运行后,把要修复的那一个O10项从左边转到右边,点“Finish”即可。(不过这之前,需要在“I know what I`m doing”前面打勾。)
如果总是无法修复
看以下的帖子
解决Winsock LSP“浏览器劫持”的一些方法
http://forum.ikaka.com/topic.asp?board=67&artid=8162074


双击打开KillBox.exe,分别删除
C:\PROGRA~1\SYSTEM~1\SYSTEM~1.DLL
C:\WINDOWS\system32\wp237211.dll
C:\WINDOWS\system32\37211.dll
C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL
C:\Program Files\CoolWebsite\QuickLink.dll
C:\WINDOWS\system32\myrx.dll
C:\WINDOWS\system32\cnscheck.dll
C:\WINDOWS\winupdate.exe
C:\Program Files\SystemInspect\SVCHAST.exe
C:\WINDOWS\system32\SVOHOST.exe
C:\WINDOWS\WINLOGON.EXE
(删除时勾选“删除前先结束Explorer.EXE进程”不行再试着勾选"删除DLL文件前反注册此文件"
给菜鸟的东东—KillBox的使用技巧
http://forum.ikaka.com/topic.asp?board=28&artid=8160799

修复后重启,如果无法上网,请运行WinsockXPFix,让它修复一下。

打开System Repair Engineer(也就是你的扫描日志软件SREng.exe),使用“启动项目,注册表”来删除以下选项。
C:\WINDOWS\system32\SVOHOST.exe
C:\WINDOWS\WINLOGON.EXE
C:\WINDOWS\WINLOGON.EXE
重启。回到正常模式,请再扫日志粘上来。

gototop
 

我应该是按照上面说的一步一步做的,不过在修复过程中碰到了一些问题,所以也没有修复完全,请在指教.
1.那个Rinld.sys系统提示无法删除,所以没删.
2.C:\WINDOWS\system32\37211.dll
  C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL
  C:\Program Files\CoolWebsite\QuickLink.dll这3个东西没找到.
3.cnscheck.dll这个文件LSPFix找不到,killbox倒是找到了,不过提示不允许删除,所以也没删.

现在我暂时发现的问题是:
1.开机后不能出现桌面的所有菜单,就是一片空白的桌面.我都是通过任务管理器打开EXPLORER,要过大概10分钟才能出现桌面的各种图标和任务栏
2.各种文件的图标颜色变的很奇怪,好象是颜色质量给人调低了造成的缺色,不过在颜色设置那里我调的颜色质量是最高.
3.整个机子哑巴了,没声音播放声音文件时提示没有安装声音设备.可是在硬件管理那里声音设备都显示安装正常.
4.部分程序,比如winRAR不能正常工作了.
扫描结果如下:
2006-09-15,19:51:55

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Home Edition Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中:
    所有的启动项目(包括注册表、启动文件夹、服务等)
    浏览器加载项
    正在运行的进程(包括进程模块信息)
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [Microsoft Corporation]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [Microsoft Corporation]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [Microsoft Corporation]
    <WebThunder><C:\Program Files\Thunder Network\WebThunder\WebThunder.exe>  [深圳市迅雷网络技术有限公司]
    <桌面图标文字自动透明><C:\Program Files\WoptiUtilities\WoptiMem.exe XP>  []
    <桌面图标文字自动><>  []
    <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>  [NVIDIA Corporation]
    <ToP><C:\WINDOWS\LSASS.exe>  [PysXubeGV2SkR3ncT0oE]
    <TProgram><C:\WINDOWS\smss.exe>  [plVWDGvkm9a6N5hPE7dQ]
    <MSService_v1.0><C:\WINDOWS\system\realsched.exe>  []
    <RichMedia><C:\WINDOWS\system32\Rundll32.exe  "C:\PROGRA~1\pcast\hbcast.dll",WaitWindows>  [Shanghai Henbang Technology Co., Ltd]
    <><C:\WINDOWS\system32\intenat.exe>  []
    <Tray><C:\WINDOWS\command\rundll32.exe>  []
    <ms><C:\Program Files\Microsoft\svhost32.exe>  []
    <zt><C:\WINDOWS\Intel\rundll32.exe>  []
    <Update><C:\Program Files\Common Files\UPDATE2\Update.exe>  []
    <spoolsv><C:\WINDOWS\system32\spoolsv\spoolsv.exe -printer>  [广州傲讯信息科技有限公司]
    <CdnCtr><C:\Program Files\CNNIC\Cdn\cdnup.exe>  []
    <Synchronization><rundll32.exe C:\WINDOWS\system32\MSCOMCT32.dll,DllUnregisterServer>  []
    <softbox><C:\WINDOWS\system32\softbox.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    <KernelCheck><C:\WINDOWS\system32\winasse.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><explorer.exe 1>  []
    <Userinit><C:\WINDOWS\system32\Userinit.exe,C:\WINDOWS\system32\internst.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{D157330A-9EF3-49F8-9A67-4141AC41ADD4}><>  []
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll>  [Beijing Rising Technology Co., Ltd.]
    <{9A0CFC58-5A6F-41ba-9FFE-4320F4F62FBA}><C:\WINDOWS\system32\cnscheck.dll>  []
    <{288BD9BD-F0DC-46B1-81B5-2B61DF8077CE}><C:\WINDOWS\system32\zt.dLL>  []
    <{6E44887F-5214-41F2-AB46-4728735C4CC6}><C:\Program Files\Internet Explorer\PLUGINS\system.sys>  []

==================================
启动文件夹
服务
[NVIDIA Display Driver Service / NVSvc]
  <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[Rising Process Communication Center / RsCCenter]
  <"C:\Program Files\Rising\Rav\CCenter.exe"><N/A>
[RsRavMon Service / RsRavMon]
  <"C:\Program Files\Rising\Rav\Ravmond.exe"><N/A>

==================================
浏览器加载项
[wmpdrm]
  {0E674588-66B7-4E19-9D0E-2053B800F69F} <C:\WINDOWS\system32\wmpdrm.dll, Allsum Info. Tech. Ltd.>
[MyIEHelper Class]
  {16B770A0-0E87-4278-B748-2460D64A8386} <C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\IEHelper_5072.dll, N/A>
[]
  {3D898C55-74CC-4B7C-B5F1-45913F368388} <C:\PROGRA~1\SYSTEM~1\SYSTEM~1.DLL, N/A>
[raObject Class]
  {46F194EB-B7DB-4B7A-BD42-5FF39FD17664} <C:\PROGRA~1\pcast\hbcast.dll, Shanghai Henbang Technology Co., Ltd>
[CdnForIE Class]
  {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[实用搜索]
  {6CFD436C-7AAD-4e50-992F-C0C87A94CAD2} <C:\Program Files\UtilToolBar\utilbar.dll, Shanghai Leysin Technology Co, Ltd.>
[BHOImp Class]
  {70AFF2CB-9DA2-499C-8D15-900729FCE83D} <C:\WINDOWS\system32\YHBO.dll, YHBO>
[WinSC Class]
  {9ACEEE31-1440-471B-AA46-72B061FE7D61} <C:\WINDOWS\system32\WinSC.dll, N/A>
[]
  {A9930D97-9CF0-42A0-A10D-4F28836579D5} <F:\KuGoo3\KuGoo3DownXControl.ocx, N/A>
[QuickBtn]
  {D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7} <C:\Program Files\kuzhan\kuzhan.dll, >
[DuiSo.com Search]
  {E2218499-2FD4-4EED-A94A-7F0B9C6E300E} <C:\WINDOWS\system32\Inte32.dll, N/A>
[QuickBtn]
  {1D901067-2529-4A9B-9B6B-7A1DB3A44CB5} <C:\Program Files\kuzhan\kuzhan.dll, >
[CdnForIE Class]
  {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[卡卡上网安全助手]
  {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, N/A>
[实用搜索工具条V2.0]
  {75D82598-4A3C-419e-99D2-3EB56D09CFD0} <C:\Program Files\UtilToolBar\utilbar.dll, Shanghai Leysin Technology Co, Ltd.>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8a.ocx, Macromedia, Inc.>
[Rising Web Scan Object]
  {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.>
[wmpdrm]
  {0E674588-66B7-4E19-9D0E-2053B800F69F} <C:\WINDOWS\system32\wmpdrm.dll, Allsum Info. Tech. Ltd.>
[MyIEHelper Class]
  {16B770A0-0E87-4278-B748-2460D64A8386} <C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\IEHelper_5072.dll, N/A>
[Windows Media Player]
  {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
  {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[Tabular Data Control]
  {333C7BC4-460F-11D0-BC04-0080C7055A83} <C:\WINDOWS\system32\tdc.ocx, Microsoft Corporation>
[]
  {3D898C55-74CC-4B7C-B5F1-45913F368388} <C:\PROGRA~1\SYSTEM~1\SYSTEM~1.DLL, N/A>
[raObject Class]
  {46F194EB-B7DB-4B7A-BD42-5FF39FD17664} <C:\PROGRA~1\pcast\hbcast.dll, Shanghai Henbang Technology Co., Ltd>
[CdnForIE Class]
  {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[实用搜索]
  {6CFD436C-7AAD-4E50-992F-C0C87A94CAD2} <C:\Program Files\UtilToolBar\utilbar.dll, Shanghai Leysin Technology Co, Ltd.>
[BHOImp Class]
  {70AFF2CB-9DA2-499C-8D15-900729FCE83D} <C:\WINDOWS\system32\YHBO.dll, YHBO>
[Active Desktop Mover]
  {72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
[实用搜索工具条V2.0]
  {75D82598-4A3C-419E-99D2-3EB56D09CFD0} <C:\Program Files\UtilToolBar\utilbar.dll, Shanghai Leysin Technology Co, Ltd.>
[MediaComm Class]
  {7670648D-461B-42AF-BDFE-46D26AF5EFF2} <F:\迅雷\Components\InMedia\MediaAddin07.dll, Thunder Networking Technologies,LTD>
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[AxSubmitControl Class]
  {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} <C:\WINDOWS\DOWNLO~1\SUBMIT~1.DLL, >
[WinSC Class]
  {9ACEEE31-1440-471B-AA46-72B061FE7D61} <C:\WINDOWS\system32\WinSC.dll, N/A>
[PPRich]
  {9D966685-3D58-4170-B008-05BD7C1628B0} <C:\PROGRA~1\PPRich\PPRich.ocx, N/A>
[]
  {A9930D97-9CF0-42A0-A10D-4F28836579D5} <F:\KuGoo3\KuGoo3DownXControl.ocx, N/A>
[Microsoft Scriptlet Component]
  {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[卡卡上网安全助手]
  {AFF6E516-CBE5-4F8A-9C2F-38A68013E766} <C:\WINDOWS\system32\kakatool.dll, N/A>
[SearchAssistantOC]
  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
  {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[AUDIO__MP3 Moniker Class]
  {CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
  {CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
  {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[QuickBtn]
  {D1BB7CF4-4463-4E91-88D7-ECC3CE0A13B7} <C:\Program Files\kuzhan\kuzhan.dll, >
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8a.ocx, Macromedia, Inc.>
[卡卡上网安全助手]
  {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, N/A>
[DuiSo.com Search]
  {E2218499-2FD4-4EED-A94A-7F0B9C6E300E} <C:\WINDOWS\system32\Inte32.dll, N/A>
[Rising Web Scan Object]
  {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.>
[使用KuGoo3下载(&K)]
  <F:\KuGoo3\KuGoo3DownX.htm, N/A>
[添加到QQ自定义面板]
  <F:\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <F:\QQ\AddEmotion.htm, N/A>
[访问通用网址]
  <C:\Program Files\CNNIC\Cdn\cnnic.htm, N/A>

gototop
 

==================================
正在运行的进程
[PID: 320][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 376][\??\C:\WINDOWS\system32\csrss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 400][\??\C:\WINDOWS\system32\winlogon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 444][C:\WINDOWS\system32\services.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\cnscheck.dll]  <N/A><N/A>
    [C:\Program Files\Internet Explorer\PLUGINS\system.sys]  <N/A><N/A>
    [C:\WINDOWS\system32\zt.dLL]  <N/A><N/A>
    [C:\WINDOWS\system32\msdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\ztdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\tdll.dll]  <N/A><N/A>
[PID: 456][C:\WINDOWS\system32\lsass.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 596][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 644][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 728][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 776][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 992][C:\WINDOWS\Explorer.EXE]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\RavExt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
    [C:\WINDOWS\system32\cnscheck.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\zt.dLL]  <N/A><N/A>
    [C:\Program Files\Internet Explorer\PLUGINS\system.sys]  <N/A><N/A>
    [C:\WINDOWS\system32\myrx.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\msicn\msibm.dll]  <广州傲讯信息科技有限公司><2, 0, 0, 1>
    [C:\WINDOWS\system32\tdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\ztdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\msdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\msicn\plugins\bse.dll]  <广州傲讯信息科技有限公司><2, 0, 0, 1>
    [C:\WINDOWS\system32\msicn\plugins\lup.dll]  <广州傲讯信息科技有限公司><2, 0, 0, 1>
    [C:\WINDOWS\system32\msicn\plugins\bm.dll]  <广州傲讯信息科技有限公司><2, 0, 0, 1>
    [C:\WINDOWS\system32\msicn\plugins\as.dll]  <广州傲讯信息科技有限公司><2, 0, 0, 1>
    [C:\WINDOWS\system32\msicn\plugins\navangel.dll]  <广州傲讯信息科技有限公司><2, 0, 0, 1>
    [C:\WINDOWS\system32\nvcpl.dll]  <NVIDIA Corporation><6.14.10.7184>
    [C:\WINDOWS\system32\NVRSZHC.DLL]  <NVIDIA Corporation><6.14.10.7184>
    [C:\WINDOWS\system32\nvshell.dll]  <NVIDIA Corporation><6.14.10.10035>
    [C:\Program Files\UtilToolBar\utilbar.dll]  <Shanghai Leysin Technology Co, Ltd.><2, 0, 729, 0>
    [F:\KuGoo3\KuGoo3DownXControl.ocx]  <N/A><N/A>
    [C:\Program Files\kuzhan\kuzhan.dll]  <><1, 0, 0, 1>
[PID: 1496][C:\WINDOWS\system32\nvsvc32.exe]  <NVIDIA Corporation><6.14.10.7184>
    [C:\WINDOWS\system32\cnscheck.dll]  <N/A><N/A>
[PID: 1544][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1564][C:\WINDOWS\system32\wdfmgr.exe]  <Microsoft Corporation><5.2.3790.1230 built by: DNSRV(bld4act)>
[PID: 1740][C:\WINDOWS\system32\ctfmon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\Program Files\Internet Explorer\PLUGINS\system.sys]  <N/A><N/A>
    [C:\WINDOWS\system32\cnscheck.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\zt.dLL]  <N/A><N/A>
    [C:\WINDOWS\system32\msicn\msibm.dll]  <广州傲讯信息科技有限公司><2, 0, 0, 1>
    [C:\WINDOWS\system32\tdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\ztdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\msdll.dll]  <N/A><N/A>
[PID: 1832][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 148][C:\WINDOWS\system32\winasse.exe]  <Microsoft Corporation><5.1.2600.0>
    [C:\WINDOWS\system32\cnscheck.dll]  <N/A><N/A>
    [C:\Program Files\Internet Explorer\PLUGINS\system.sys]  <N/A><N/A>
    [C:\WINDOWS\system32\zt.dLL]  <N/A><N/A>
    [C:\WINDOWS\system32\ztdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\tdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\msdll.dll]  <N/A><N/A>
[PID: 208][C:\Program Files\Thunder Network\WebThunder\WebThunder.exe]  <深圳市迅雷网络技术有限公司><1, 1, 6, 41>
    [C:\Program Files\Thunder Network\WebThunder\taskmanage.dll]  <Thunder Networking Technologies,LTD><1, 1, 0, 42>
    [C:\Program Files\Thunder Network\WebThunder\download_interface.dll]  <Thunder Networking Technologies,LTD><1, 0, 3, 70>
    [C:\Program Files\Thunder Network\WebThunder\asyn_dns.dll]  <N/A><N/A>
    [C:\Program Files\Thunder Network\WebThunder\RegisterDll.dll]  <Thunder Networking Technologies,LTD><2, 0, 0, 13>
    [C:\Program Files\Internet Explorer\PLUGINS\system.sys]  <N/A><N/A>
    [C:\Program Files\Thunder Network\WebThunder\historyinfo_manage.dll]  <Thunder Networking Technologies,LTD><5, 2, 0, 150>
    [C:\Program Files\Thunder Network\WebThunder\UpdateDownload.dll]  <Thunder Networking Technologies,LTD><1, 0, 1, 8>
    [C:\Program Files\Thunder Network\WebThunder\UpdateExec.dll]  <Thunder Networking Technologies,LTD><1, 0, 1, 5>
    [C:\WINDOWS\system32\cnscheck.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\zt.dLL]  <N/A><N/A>
    [C:\Program Files\Thunder Network\WebThunder\iEmbedShell.dll]  < ><1, 0, 0, 10>
    [F:\迅雷\Components\InMedia\iEmbed04.dll]  < ><2, 3, 0, 37>
    [C:\WINDOWS\system32\msdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\ztdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\tdll.dll]  <N/A><N/A>
gototop
 

[PID: 344][C:\WINDOWS\LSASS.exe]  <PysXubeGV2SkR3ncT0oE><0.00.0106>
    [C:\Program Files\Internet Explorer\PLUGINS\system.sys]  <N/A><N/A>
    [C:\WINDOWS\system32\cnscheck.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\zt.dLL]  <N/A><N/A>
    [C:\WINDOWS\system32\msdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\ztdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\tdll.dll]  <N/A><N/A>
[PID: 364][C:\WINDOWS\smss.exe]  <plVWDGvkm9a6N5hPE7dQ><0.00.0106>
    [C:\Program Files\Internet Explorer\PLUGINS\system.sys]  <N/A><N/A>
    [C:\WINDOWS\system32\cnscheck.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\zt.dLL]  <N/A><N/A>
    [C:\WINDOWS\system32\ztdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\tdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\msdll.dll]  <N/A><N/A>
[PID: 804][C:\WINDOWS\system\realsched.exe]  <N/A><N/A>
    [C:\Program Files\Internet Explorer\PLUGINS\system.sys]  <N/A><N/A>
    [C:\WINDOWS\system32\cnscheck.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\msdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\ztdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\tdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\zt.dLL]  <N/A><N/A>
    [C:\WINDOWS\system32\msicn\msibm.dll]  <广州傲讯信息科技有限公司><2, 0, 0, 1>
[PID: 888][C:\WINDOWS\system32\Rundll32.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\PROGRA~1\pcast\hbcast.dll]  <Shanghai Henbang Technology Co., Ltd><1, 1, 3, 8>
    [C:\Program Files\Internet Explorer\PLUGINS\system.sys]  <N/A><N/A>
    [C:\WINDOWS\system32\cnscheck.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\zt.dLL]  <N/A><N/A>
    [C:\WINDOWS\system32\msdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\ztdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\tdll.dll]  <N/A><N/A>
[PID: 956][C:\WINDOWS\system32\intenat.exe]  <N/A><N/A>
    [C:\WINDOWS\system32\cnscheck.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\msdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\ztdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\tdll.dll]  <N/A><N/A>
    [C:\Program Files\Internet Explorer\PLUGINS\system.sys]  <N/A><N/A>
    [C:\WINDOWS\system32\zt.dLL]  <N/A><N/A>
[PID: 1136][C:\WINDOWS\command\rundll32.exe]  <N/A><N/A>
    [C:\WINDOWS\system32\tdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\cnscheck.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\msdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\ztdll.dll]  <N/A><N/A>
    [C:\Program Files\Internet Explorer\PLUGINS\system.sys]  <N/A><N/A>
    [C:\WINDOWS\system32\zt.dLL]  <N/A><N/A>
[PID: 1180][C:\Program Files\Microsoft\svhost32.exe]  <N/A><N/A>
    [C:\WINDOWS\system32\msdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\cnscheck.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\ztdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\tdll.dll]  <N/A><N/A>
    [C:\Program Files\Internet Explorer\PLUGINS\system.sys]  <N/A><N/A>
    [C:\WINDOWS\system32\zt.dLL]  <N/A><N/A>
[PID: 916][C:\WINDOWS\Intel\rundll32.exe]  <N/A><N/A>
    [C:\WINDOWS\system32\ztdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\msdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\tdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\cnscheck.dll]  <N/A><N/A>
    [C:\Program Files\Internet Explorer\PLUGINS\system.sys]  <N/A><N/A>
    [C:\WINDOWS\system32\zt.dLL]  <N/A><N/A>
[PID: 1512][C:\Documents and Settings\Owner\桌面\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>
    [C:\Program Files\Internet Explorer\PLUGINS\system.sys]  <N/A><N/A>
    [C:\WINDOWS\system32\cnscheck.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\msdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\ztdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\tdll.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\zt.dLL]  <N/A><N/A>

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================
gototop
 

病毒越发的多了,我建议你不要修复这个系统了,直接重装或还原系统了事。
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT