[CODE]

2007-02-09,12:19:30

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><G:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Corporation]
    <BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}><"G:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe">  [Nero AG]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"G:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Corporation]
    <PHIME2002ASync><G:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Corporation]
    <PHIME2002A><G:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Corporation]
    <IgfxTray><G:\WINDOWS\system32\igfxtray.exe>  [(Verified)Intel Corporation]
    <HotKeysCmds><G:\WINDOWS\system32\hkcmd.exe>  [(Verified)Intel Corporation]
    <SoundMan><SOUNDMAN.EXE>  [Realtek Semiconductor Corp.]
    <NeroFilterCheck><G:\WINDOWS\system32\NeroCheck.exe>  [Ahead Software Gmbh]
    <TkBellExe><"G:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [(Verified)RealNetworks, Inc.]
    <SpIDerNT><G:\PROGRA~1\DrWeb\spidernt.exe /agent>  [Doctor Web, Ltd.]
    <SpIDerMail><"G:\Program Files\DrWeb\spiderml.exe">  [(Verified)Doctor Web, Ltd.]
    <DrWebScheduler><"G:\Program Files\DrWeb\DRWEBSCD.EXE">  [Doctor Web, Ltd.]
    <360Safetray><G:\Program Files\360safe\safemon\360Tray.exe /start>  [奇虎网]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><G:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{4BAB150F-DD97-476D-9C1E-41B6CDC0CA7A}><G:\PROGRA~1\Yahoo!\ASSIST~1\yclickon.dll>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\System Safety Monitor]
    <WinlogonNotify: System Safety Monitor><SSMWinlogonEx.dll>  [(Verified)System Safety Limited]

==================================
启动文件夹
N/A

==================================
服务
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <G:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[SpIDer Guard for Windows NT / spidernt][Running/Auto Start]
  <G:\PROGRA~1\DrWeb\SpiderNT.exe><Doctor Web, Ltd.>

==================================

驱动程序
[Service for WDM 3D Audio Driver / ALCXSENS][Running/Manual Start]
  <system32\drivers\ALCXSENS.SYS><Sensaura Ltd>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[SpIDer Guard boot hook driver for Windows NT / drwebnet][Running/System Start]
  <\SystemRoot\system32\drivers\drwebnet.sys><Doctor Web, Ltd.>
[ialm / ialm][Running/Manual Start]
  <system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[InCD File System / InCDFs][Stopped/Disabled]
  <system32\drivers\InCDFs.sys><N/A>
[InCDPass / InCDPass][Stopped/System Start]
  <system32\drivers\InCDPass.sys><N/A>
[InCD Reader / InCDRm][Stopped/System Start]
  <system32\drivers\InCDRm.sys><N/A>
[kdpgqcpf / kdpgqcpf][Running/Boot Start]
  <\SystemRoot\\SystemRoot\System32\drivers\kdpgqcpf.sys><N/A>
[npkcrypt / npkcrypt][Running/Auto Start]
  <\??\F:\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[System Safety Monitor 2.0 Core Engine / safemon][Running/Boot Start]
  <\SystemRoot\system32\drivers\safemon.sys><System Safety Limited>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[SpIDer FS Monitor for Windows NT / SPIDER][Running/Auto Start]
  <\??\G:\PROGRA~1\DrWeb\spider.sys><Doctor Web, Ltd.>
[ubgdpfdc / ubgdpfdc][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\ubgdpfdc.sys><Yahoo! China Corporation>

==================================
浏览器加载项
[Thunder Browser Helper]
  {06849E9E-C8D7-4D59-B87D-784B7D6BE0B3} <G:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_007.dll, Thunder Networking Technologies,LTD>
[Adobe PDF Reader Link Helper]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <F:\Tencent\QQ\QQIEHelper.dll, N/A>
[NavigatMon Class]
  {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <G:\Program Files\360safe\safemon\safemon.dll, >
[启动迅雷5]
  {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <G:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[浩方对战平台]
  {0A155D3C-68E2-4215-A47A-E800A446447A} <E:\G\setup  网间\我接收到的文件\浩方对战平台\GameClient.exe, 上海浩方在线信息技术有限公司>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <F:\Tencent\QQ\QQ.EXE, N/A>
[QQIEFloatBarCfgCmd Class]
  {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <F:\Tencent\QQ\QQIEHelper.dll, N/A>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <G:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <G:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[Thunder Browser Helper]
  {06849E9E-C8D7-4D59-B87D-784B7D6BE0B3} <G:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_007.dll, Thunder Networking Technologies,LTD>
[Adobe PDF Reader Link Helper]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[XML DOM Document]
  {2933BF90-7B36-11D2-B20E-00C04F983E60} <%SystemRoot%\system32\msxml3.dll, N/A>
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <F:\Tencent\QQ\QQIEHelper.dll, N/A>
[DragSearch BHO]
  {62EED7C6-9F02-42F9-B634-98E2899E147B} <G:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL, N/A>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <G:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_007.dll, Thunder Networking Technologies,LTD>
[NavigatMon Class]
  {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <G:\Program Files\360safe\safemon\safemon.dll, >
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <G:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[&使用迅雷下载]
  <G:\Program Files\Thunder Network\Thunder\Program\geturl.htm, N/A>
[&使用迅雷下载全部链接]
  <G:\Program Files\Thunder Network\Thunder\Program\getallurl.htm, N/A>
[上传到QQ网络硬盘]
  <F:\QQ\AddToNetDisk.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
  <res://G:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
  <F:\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <F:\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <F:\QQ\SendMMS.htm, N/A>

==================================

正在运行的进程
[PID: 444][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 500][\??\G:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 524][\??\G:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [G:\WINDOWS\system32\SSMWinlogonEx.dll]  [System Safety Limited, 2.3.0.611]
[PID: 568][G:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 580][G:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [G:\WINDOWS\system32\DRWEBSP.DLL]  [Doctor Web, Ltd., 4.33.2.11110]
[PID: 780][G:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 824][G:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [G:\WINDOWS\system32\DRWEBSP.DLL]  [Doctor Web, Ltd., 4.33.2.11110]
[PID: 888][G:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [G:\WINDOWS\system32\DRWEBSP.DLL]  [Doctor Web, Ltd., 4.33.2.11110]
[PID: 1044][G:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [G:\WINDOWS\system32\DRWEBSP.DLL]  [Doctor Web, Ltd., 4.33.2.11110]
[PID: 1072][G:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [G:\WINDOWS\system32\DRWEBSP.DLL]  [Doctor Web, Ltd., 4.33.2.11110]
[PID: 1196][G:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1548][G:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [G:\Program Files\360safe\safemon\safemon.dll]  [, 1, 0, 0, 1002]
    [G:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll]  [Nero AG, 2, 0, 0, 7]
    [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll]  [Adobe Systems, Inc., 7.0.0.0]
    [G:\WINDOWS\system32\igfxpph.dll]  [Intel Corporation, 3.0.0.4020]
    [G:\WINDOWS\system32\hccutils.DLL]  [Intel Corporation, 3.0.0.4020]
    [G:\WINDOWS\system32\igfxres.dll]  [Intel Corporation, 3.0.0.4020]
    [G:\WINDOWS\system32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.4020]
    [G:\WINDOWS\system32\igfxdev.dll]  [Intel Corporation, 3.0.0.4020]
    [G:\Program Files\Nero\Nero 7\Nero BackItUp\NBShell.dll]  [Nero AG, 2, 0, 0, 5]
    [G:\Program Files\WinRAR\rarext.dll]  [N/A, N/A]
    [G:\Program Files\DrWeb\drwsxtn.dll]  [Doctor Web, Ltd., 4.33.0.200507180]
    [G:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_007.dll]  [Thunder Networking Technologies,LTD, 5, 0, 1, 4]
    [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll]  [Adobe Systems Incorporated, 7.0.7.2006011200]
    [G:\WINDOWS\system32\msdmo.dll]  [N/A, N/A]
[PID: 1672][g:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe]  [Microsoft Corporation, 2005.090.1399.00]
[PID: 188][G:\PROGRA~1\DrWeb\SpiderNT.exe]  [Doctor Web, Ltd., 4.33.2.04281]
[PID: 1132][G:\WINDOWS\system32\wscntfy.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [G:\Program Files\360safe\safemon\safemon.dll]  [, 1, 0, 0, 1002]
[PID: 1444][G:\WINDOWS\system32\hkcmd.exe]  [Intel Corporation, 3.0.0.4020]
    [G:\WINDOWS\system32\hccutils.DLL]  [Intel Corporation, 3.0.0.4020]
    [G:\WINDOWS\system32\igfxdev.dll]  [Intel Corporation, 3.0.0.4020]
    [G:\WINDOWS\system32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.4020]
    [G:\WINDOWS\system32\igfxhk.dll]  [Intel Corporation, 3.0.0.4020]
    [G:\WINDOWS\system32\igfxres.dll]  [Intel Corporation, 3.0.0.4020]
    [G:\Program Files\360safe\safemon\safemon.dll]  [, 1, 0, 0, 1002]
[PID: 1528][G:\WINDOWS\SOUNDMAN.EXE]  [Realtek Semiconductor Corp., 5.1.11]
    [G:\Program Files\360safe\safemon\safemon.dll]  [, 1, 0, 0, 1002]
[PID: 1764][G:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [G:\WINDOWS\system32\DRWEBSP.DLL]  [Doctor Web, Ltd., 4.33.2.11110]
[PID: 168][G:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3760]
    [G:\Program Files\360safe\safemon\safemon.dll]  [, 1, 0, 0, 1002]
[PID: 996][G:\PROGRA~1\DrWeb\spidernt.exe]  [Doctor Web, Ltd., 4.33.2.04281]
    [G:\Program Files\360safe\safemon\safemon.dll]  [, 1, 0, 0, 1002]
[PID: 1224][G:\Program Files\DrWeb\spiderml.exe]  [Doctor Web, Ltd., 4.33.2.11030]
    [G:\Program Files\DrWeb\drwspcnt.dll]  [Doctor Web, Ltd., 4.33.2.11181]
    [G:\Program Files\360safe\safemon\safemon.dll]  [, 1, 0, 0, 1002]
    [G:\WINDOWS\system32\DRWEBSP.DLL]  [Doctor Web, Ltd., 4.33.2.11110]
[PID: 1004][G:\Program Files\DrWeb\DRWEBSCD.EXE]  [Doctor Web, Ltd., 4, 33, 2, 11150]
    [G:\Program Files\360safe\safemon\safemon.dll]  [, 1, 0, 0, 1002]
[PID: 1296][G:\Program Files\360safe\safemon\360tray.exe]  [奇虎网, 1, 0, 1, 1003]
    [G:\Program Files\360safe\safemon\safemon.dll]  [, 1, 0, 0, 1002]
    [G:\Program Files\360safe\safemon\SafeKrnl.dll]  [奇虎网, 1, 0, 0, 3001]
[PID: 988][G:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [G:\Program Files\360safe\safemon\safemon.dll]  [, 1, 0, 0, 1002]
[PID: 1508][G:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe]  [Nero AG, 1, 0, 1, 5]
    [G:\Program Files\360safe\safemon\safemon.dll]  [, 1, 0, 0, 1002]
    [G:\Program Files\Common Files\Ahead\lib\NMIndexStoreSvrPS.dll]  [Nero AG, 1, 0, 1, 5]
    [G:\Program Files\Common Files\Ahead\lib\NMDataServices.dll]  [Nero AG, 1, 0, 1, 5]
[PID: 2208][F:\QQ\QQ.exe]  [TENCENT, 0, 0, 0, 0]
    [F:\QQ\CoralAssist.DLL]  [Coral Team, 5.0.0 build 20060829]
    [F:\QQ\CoralQQ.DLL]  [Coral Team, 5.0 Build 20070111]
    [F:\QQ\kql.dll]  [Coral Team, 5.0.0 build 20070111]
    [F:\QQ\ipsearcher.dll]  [N/A, 1.0.0.4]
    [F:\QQ\QQBaseClassInDll.dll]  [, 1, 0, 0, 1]
    [F:\QQ\QQHelperDll.dll]  [, 1, 0, 0, 1]
    [F:\QQ\BasicCtrlDll.dll]  [Tencent, 6, 0, 200, 320]
    [F:\QQ\NoDisturbFilter.cqx]  [Coral Team, 1.0]
    [F:\QQ\ConfigHotkey.cqx]  [Coral Team, 1.0]
    [G:\Program Files\360safe\safemon\safemon.dll]  [, 1, 0, 0, 1002]
    [F:\QQ\QQAPI.dll]  [, 1, 0, 0, 1]
    [F:\QQ\TIMProxy.dll]  [tencent, 0, 3, 2, 4]
    [F:\QQ\AutoReconnect.cqx]  [Coral Team, 1.0.0]
    [F:\QQ\LoginCtrl.dll]  [, 1, 0, 0, 1]
    [F:\QQ\npkcntc.dll]  [INCA Internet Co., Ltd., 2006, 6, 27, 1]
    [F:\QQ\npkpdb.dll]  [INCA Internet Co., Ltd., 2003, 10, 1, 1]
    [F:\QQ\QQRes.dll]  [tencent, 1, 0, 0, 1]
    [F:\QQ\QQMainFrame.dll]  [N/A, N/A]
    [F:\QQ\CQQApplication.dll]  [N/A, N/A]
    [G:\WINDOWS\system32\DRWEBSP.DLL]  [Doctor Web, Ltd., 4.33.2.11110]
    [F:\QQ\NewSkin.dll]  [, 1, 0, 0, 1]
    [F:\QQ\HostingMgr.dll]  [, 1, 0, 0, 1]
    [F:\QQ\CameraDll.dll]  [, 1, 0, 0, 1]
    [F:\QQ\MailSummary.dll]  [, 1, 0, 0, 1]
    [F:\QQ\CoralHotkey.cqx]  [Coral Team, 1.0]
    [F:\QQ\QQKnowledgeSearch.dll]  [, 1, 0, 0, 1]
    [F:\QQ\QQAllInOne.dll]  [N/A, N/A]
    [F:\QQ\GroupLive.dll]  [N/A, N/A]
    [F:\QQ\SCCore.dll]  [TENCENT, 2, 0, 0, 1]
    [F:\QQ\QQSpace.dll]  [, 1, 0, 0, 1]
    [G:\WINDOWS\system32\msdmo.dll]  [N/A, N/A]
    [F:\QQ\QQGroupMng.dll]  [, 1, 0, 0, 1]
    [F:\QQ\UserDefinedHead.dll]  [, 1, 0, 0, 1]
    [F:\QQ\QQPlugin.dll]  [N/A, N/A]
    [F:\QQ\QRingMng.dll]  [N/A, N/A]
    [F:\QQ\LongConnection.dll]  [tencent, 5, 0, 200, 160]
    [F:\QQ\QQSysMsgMng.dll]  [N/A, N/A]
    [F:\QQ\QQConfigPlugin.dll]  [, 1, 0, 0, 1]
    [F:\QQ\QQCustomFace.dll]  [N/A, N/A]
    [G:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
    [F:\QQ\QQPet.dll]  [, 1, 0, 0, 1]
    [F:\QQ\QQAvatar.dll]  [N/A, N/A]
    [F:\QQ\FlashAvatarDll.dll]  [, 1, 4, 0, 1]
    [F:\QQ\PhoneAPI.dll]  [, 1, 0, 0, 1]
    [F:\QQ\DialerAllinOne.dll]  [tencent, 1, 4, 0, 0]
    [F:\QQ\ImageOle.dll]  [TODO: <Company name>, 1.0.0.1]
    [F:\QQ\BQQApplication.dll]  [N/A, N/A]
    [F:\QQ\QQSceneMng.dll]  [N/A, N/A]
    [F:\QQ\QQZip.dll]  [tencent, 0, 3, 2, 4]
    [F:\QQ\QQAddr.dll]  [深圳市腾讯计算机系统有限公司, 5, 0, 101, 271]
    [F:\QQ\GroupConnection.dll]  [Tencent, 0, 3, 3, 5]
    [F:\QQ\CommercesMng.dll]  [, 1, 0, 0, 1]
    [F:\QQ\PersonalDesktop.dll]  [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2]
    [F:\QQ\QQPhoneHelper.dll]  [腾讯科技（深圳）有限公司, 2, 1, 4, 40]
    [F:\QQ\QQMagicFace.dll]  [, 1, 0, 0, 1]
    [F:\QQ\QQFileTransfer.dll]  [Tencent, 0, 3, 3, 5]
    [G:\WINDOWS\system32\UNISPIM5.IME]  [北京紫光华宇软件股份有限公司, 5.0.0.5091]
    [F:\QQ\qqgroupdisk.dll]  [深圳腾讯科技, 2, 1, 101, 40]

[PID: 2244][F:\QQ\TIMPlatform.exe]  [tencent, 0, 3, 1, 8]
    [G:\Program Files\360safe\safemon\safemon.dll]  [, 1, 0, 0, 1002]
    [F:\QQ\TIMProxy.dll]  [tencent, 0, 3, 2, 4]
[PID: 1524][G:\Program Files\Maxthon\maxthon.exe]  [Maxthon International Ltd., 1, 5, 9, 30]
    [G:\Program Files\Maxthon\maxzlib.dll]  [ , 1, 0, 0, 2]
    [G:\Program Files\360safe\safemon\safemon.dll]  [, 1, 0, 0, 1002]
    [G:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_007.dll]  [Thunder Networking Technologies,LTD, 5, 0, 1, 4]
    [G:\WINDOWS\system32\DRWEBSP.DLL]  [Doctor Web, Ltd., 4.33.2.11110]
    [G:\Program Files\Maxthon\Services\RealTime\real_time.dll]  [, 1, 0, 0, 1]
    [G:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
    [G:\WINDOWS\system32\msdmo.dll]  [N/A, N/A]
    [G:\WINDOWS\system32\UNISPIM5.IME]  [北京紫光华宇软件股份有限公司, 5.0.0.5091]
[PID: 380][G:\Program Files\Thunder Network\Thunder\Program\Thunder5.exe]  [Thunder Networking Technologies,LTD, 5, 5, 5, 269]
    [G:\Program Files\360safe\safemon\safemon.dll]  [, 1, 0, 0, 1002]
    [G:\Program Files\Thunder Network\Thunder\Program\TaskManager.dll]  [Thunder Networking Technologies,LTD, 1, 0, 2, 14]
    [G:\Program Files\Thunder Network\Thunder\Program\download_interface.dll]  [Thunder Networking Technologies,LTD, 2, 12, 2, 46]
    [G:\Program Files\Thunder Network\Thunder\Program\asyn_dns.dll]  [Thunder Networking Technologies,LTD, 2, 12, 2, 46]
    [G:\WINDOWS\system32\DRWEBSP.DLL]  [Doctor Web, Ltd., 4.33.2.11110]
    [G:\Program Files\Thunder Network\Thunder\Program\BHOStub.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 8]
    [G:\Program Files\Thunder Network\Thunder\Program\FloatBar.dll]  [Giganology Inc., 1, 0, 0, 2]
    [G:\Program Files\Thunder Network\Thunder\Program\iTargetAD.dll]  [Thunder Networking Technologies,LTD, 1, 0, 2, 15]
    [G:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
    [G:\Program Files\Thunder Network\Thunder\Components\DiagnoseHelper\DiagnoseHelper.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 10]
    [G:\Program Files\Thunder Network\Thunder\Program\msgmanage.dll]  [Thunder Networking Technologies,LTD, 2, 0, 1, 38]
    [G:\Program Files\Thunder Network\Thunder\Components\PortVerify\PortVerify.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
    [G:\Program Files\Thunder Network\Thunder\Components\ExplorerHelper\ExplorerHelper.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
    [G:\Program Files\Thunder Network\Thunder\Components\DTAG\DTAG.dll]  [Thunder Networking Technologies,LTD, 1, 1, 0, 2]
    [G:\Program Files\Thunder Network\Thunder\Components\DTAG\ExtractMediaTag.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
    [G:\WINDOWS\system32\msdmo.dll]  [N/A, N/A]
    [G:\Program Files\Thunder Network\Thunder\Program\LiveUpdate.dll]  [, 1, 0, 1, 17]
    [G:\Program Files\Thunder Network\Thunder\Components\InMedia\iEmbedShell.dll]  [　, 1, 0, 0, 15]
    [G:\Program Files\Thunder Network\Thunder\Components\InMedia\iEmbed08.dll]  [　, 3, 2, 0, 63]
    [G:\Program Files\Thunder Network\Thunder\Components\Community\XLCommunity.dll]  [Thunder Networking Technologies,LTD, 1, 0, 3, 14]
    [G:\Program Files\Thunder Network\Thunder\Program\RegisterDll.dll]  [Thunder Networking Technologies,LTD, 2, 2, 1, 43]
    [G:\Program Files\Thunder Network\Thunder\Components\Search\XLSearch.dll]  [Thunder Networking Technologies,LTD, 1, 0, 2, 7]
    [G:\Program Files\Thunder Network\Thunder\Components\P4PClient\P4PClient.dll]  [Thunder Networking Technologies,LTD, 1, 0, 2, 13]
    [G:\Program Files\Thunder Network\Thunder\Components\VPSHELL\VPSHELL.dll]  [, 1, 0, 0, 1]
    [G:\Program Files\Thunder Network\Thunder\Components\VPSHELL\VideoPicture.dll]  [XunLei, 1, 0, 0, 1]
    [G:\Program Files\Thunder Network\Thunder\Plugins\BhoAdv\bho_adv.dll]  [深圳市迅雷网络技术有限公司, 1.0.1.0]
[PID: 2784][D:\Radmin\radmin.exe]  [, 2, 2, 0, 0]
    [G:\Program Files\360safe\safemon\safemon.dll]  [, 1, 0, 0, 1002]
    [G:\WINDOWS\system32\DRWEBSP.DLL]  [Doctor Web, Ltd., 4.33.2.11110]
[PID: 3144][E:\G\FlashFXP\FlashFXP.exe]  [IniCom Networks, Inc., 3.4.1.1149]
    [G:\Program Files\360safe\safemon\safemon.dll]  [, 1, 0, 0, 1002]
    [G:\WINDOWS\system32\DRWEBSP.DLL]  [Doctor Web, Ltd., 4.33.2.11110]
[PID: 2832][G:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [G:\Program Files\360safe\safemon\safemon.dll]  [, 1, 0, 0, 1002]
[PID: 2860][C:\TDDOWNLOAD\sreng2_PConline\SREng.EXE]  [Smallfrogs Studio, 2.3.13.690]
    [G:\Program Files\360safe\safemon\safemon.dll]  [, 1, 0, 0, 1002]
    [G:\WINDOWS\system32\DRWEBSP.DLL]  [Doctor Web, Ltd., 4.33.2.11110]
    [C:\TDDOWNLOAD\sreng2_PConline\Plugins\SRECXTMG.SRE]  [Smallfrogs Studio, 1, 5, 0, 55]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["G:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
DrwebSP.MSAFD Tcpip [TCP/IP]
    G:\WINDOWS\system32\DRWEBSP.DLL(Doctor Web, Ltd., Dr.Web Winsock Provider Hook)
DrwebSP.MSAFD Tcpip [UDP/IP]
    G:\WINDOWS\system32\DRWEBSP.DLL(Doctor Web, Ltd., Dr.Web Winsock Provider Hook)
DrwebSP.RSVP TCP Service Provider
    G:\WINDOWS\system32\DRWEBSP.DLL(Doctor Web, Ltd., Dr.Web Winsock Provider Hook)
DrwebSP.RSVP UDP Service Provider
    G:\WINDOWS\system32\DRWEBSP.DLL(Doctor Web, Ltd., Dr.Web Winsock Provider Hook)

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
API HOOK
警告！System Repair Engineer 提醒
你下面的函数内容与预期值不符，他
们可能被一些恶意的软件所修改：
RVA  错误： GetVersion
RVA  错误： GetVersionExA
RVA  错误： GetVersionExW
RVA  错误： DeleteFileA
RVA  错误： DeleteFileW
RVA  错误： FindFirstFileA
RVA  错误： FindFirstFileExA
RVA  错误： FindFirstFileExW
RVA  错误： FindFirstFileW
RVA  错误： FindNextFileA
RVA  错误： FindNextFileW
RVA  错误： LoadLibraryW
RVA  错误： Process32First
RVA  错误： Process32FirstW
RVA  错误： Process32Next
RVA  错误： Process32NextW
RVA  错误： Module32First
RVA  错误： Module32FirstW
RVA  错误： Module32Next
RVA  错误： Module32NextW
RVA  错误： MoveFileA
RVA  错误： MoveFileExA
RVA  错误： MoveFileExW
RVA  错误： MoveFileW
RVA  错误： TerminateThread
RVA  错误： Thread32First
RVA  错误： Thread32Next
RVA  错误： CreateFileW
RVA  错误： Thread32First
RVA  错误： Thread32Next
RVA  错误： CopyFileA
RVA  错误： CopyFileExA
RVA  错误： CopyFileExW
RVA  错误： CopyFileW
RVA  错误： CreateFileMappingA
RVA  错误： CreateFileMappingW
入口点错误：CreateProcessA
入口点错误：CreateProcessW
RVA  错误： CreateRemoteThread
RVA  错误： CreateThread
RVA  错误： CreateToolhelp32Snapshot
RVA  错误： ExitProcess
RVA  错误： ExitThread
RVA  错误： FindCloseChangeNotification
RVA  错误： FindFirstChangeNotificationA
RVA  错误： FindFirstChangeNotificationW
RVA  错误： FreeLibrary
RVA  错误： GetCurrentProcess
RVA  错误： GetCurrentProcessId
RVA  错误： GetCurrentThread
RVA  错误： GetCurrentThreadId
RVA  错误： GetFileSize
RVA  错误： GetFileSizeEx
RVA  错误： GetFileInformationByHandle
RVA  错误： GetFileAttributesA
RVA  错误： GetFileAttributesExA
RVA  错误： GetFileAttributesExW
RVA  错误： GetFileAttributesW
RVA  错误： GetModuleFileNameA
RVA  错误： GetModuleFileNameW
RVA  错误： Toolhelp32ReadProcessMemory

==================================


[/CODE]