求助，一打开任意.exe程序就桌面进程explorer.exe就自动结束,然后重新加载，刚发现中毒了，后来把C和D盘根目录下面的autorun.inf和一个可执行程序删掉后重启还是不行。

下载 System Repair Engineer，
http://download.kztechs.com/files/sreng2.zip
1 解压缩sreng2.zip
2 运行SREngPS.EXE
3 智能扫描=》扫描=》保存报告
4 把日志中的报告完整拷贝贴上来，不要修改

【回复“newcenturymoon”的帖子】
[CODE]

2007-07-23,15:46:41

System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)

Windows Server 2003 Enterprise Edition Service Pack 1 (Build 3790) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件
    进程特权扫描


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <CTFMON.EXE><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
    <PhDesktop><C:\Program Files\Oray\PeanutHull5\PhDesktop.exe>  [上海贝锐]
    <msnmsgr><; "C:\Program Files\MSN Messenger\msnmsgr.exe" /background>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <SKYNET Personal FireWall><C:\PROGRA~1\SkyNet\FireWall\PFW.exe>  [广州众达天网技术有限公司]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
    <Userinit><C:\WINDOWS\system32\UserInit.exe,>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><%SystemRoot%\system32\logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{613AF41A-21B1-131B-1BFC-D2A90DF4A2B6}><C:\WINDOWS\system32\xyepri.dll>  []
    <{40117B96-998D-4D80-8F89-5E9DBD9F3460}><C:\Program Files\Internet Explorer\PLUGINS\SysWin64.Sys>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
    <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
    <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
    <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
    <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
    <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
    <N/A><C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install>  [(Verified)Microsoft Windows Publisher]

==================================
启动文件夹
[Service Manager]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Service Manager.lnk --> C:\PROGRA~1\MICROS~1\80\Tools\Binn\sqlmangr.exe [Microsoft Corporation]><N>
[天网防火墙个人版]
  <C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\天网防火墙个人版.lnk --> C:\PROGRA~1\SkyNet\FireWall\PFW.exe [广州众达天网技术有限公司]><N>

==================================
服务
[卡巴斯基控制管理工具 / CSAdminServer][Running/Auto Start]
  <"C:\Program Files\Kaspersky Lab\Kaspersky Administration Kit\klserver.exe"><Kaspersky Lab>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[卡巴斯基防病毒服务 / klfsblogic][Running/Auto Start]
  <"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for File Servers 5\kavmm.exe" -run bl -n Fileserver -v 5.0.0.0><Kaspersky Lab>
[卡巴斯基实验室网络代理 / KLNagent][Running/Auto Start]
  <"C:\Program Files\Kaspersky Lab\Kaspersky Administration Kit\Nagent\klnagent.exe"><Kaspersky Lab>
[MDaemon / MDaemon][Running/Auto Start]
  <D:\MDaemon\APP\MDAEMON.EXE><Alt-N Technologies, Ltd.>
[Microsoft Search / MSSEARCH][Running/Auto Start]
  <"C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe"><Microsoft Corporation>
[MSSQL$KAV / MSSQL$KAV][Running/Auto Start]
  <C:\Program Files\Microsoft SQL Server\MSSQL$KAV\Binn\sqlservr.exe -sKAV><Microsoft Corporation>
[MSSQLSERVER / MSSQLSERVER][Running/Auto Start]
  <C:\PROGRA~1\MICROS~1\MSSQL\binn\sqlservr.exe><Microsoft Corporation>
[MSSQLServerADHelper / MSSQLServerADHelper][Stopped/Manual Start]
  <C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe><Microsoft Corporation>
[WinFast(R) Display Driver Service / NVSvc][Stopped/Disabled]
  <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[PeanutHull DDNS Service / Peanuthull5Core][Running/Auto Start]
  <C:\Program Files\Oray\PeanutHull5\PhCore.exe -service><上海贝锐>
[SQLAgent$KAV / SQLAgent$KAV][Stopped/Manual Start]
  <C:\Program Files\Microsoft SQL Server\MSSQL$KAV\Binn\sqlagent.EXE -i KAV><Microsoft Corporation>
[SQLSERVERAGENT / SQLSERVERAGENT][Stopped/Manual Start]
  <C:\PROGRA~1\MICROS~1\MSSQL\binn\sqlagent.exe><Microsoft Corporation>
[NetworSVSA / Visual  WEB][Stopped/Auto Start]
  <C:\WINDOWS\system32\wnipsvr.exe -Run><N/A>

==================================
驱动程序
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
  <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[BIOS / BIOS][Running/System Start]
  <\??\C:\WINDOWS\system32\drivers\BIOS.sys><BIOSTAR Group>
[Cdsys / Cdsys][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\cdcd.sys><N/A>
[Microsoft 用于 High Definition Audio 的 UAA 总线驱动程序 / HDAudBus][Running/Manual Start]
  <system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
[Service for Realtek HD Audio (WDM) / IntcAzAudAddService][Running/Manual Start]
  <system32\drivers\RtkHDAud.sys><Realtek Semiconductor Corp.>
[IP in IP Tunnel Driver / IpInIp][Stopped/Manual Start]
  <system32\DRIVERS\ipinip.sys><N/A>
[Klif / Klif][Running/System Start]
  <\??\C:\WINDOWS\system32\Drivers\klif.sys><Kaspersky Labs>
[npkcrypt / npkcrypt][Running/Auto Start]
  <\??\D:\Program Files\TM\TMDlls\npkcrypt.sys><INCA Internet Co., Ltd.>
[nv / nv][Running/Manual Start]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[nvata / nvata][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\nvata.sys><NVIDIA Corporation>
[NVIDIA nForce Networking Controller Driver / NVENETFD][Running/Manual Start]
  <system32\DRIVERS\NVENETFD.sys><NVIDIA Corporation>
[NVIDIA Network Bus Enumerator / nvnetbus][Running/Manual Start]
  <system32\DRIVERS\nvnetbus.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[QKeyServiceDisplay / QKeyService][Running/Boot Start]
  <\SystemRoot\system32\KeyCrypt.sys><Tencent Technology (Shenzhen) Company Limited>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
[SKNFW / SKNFW][Running/System Start]
  <\??\C:\WINDOWS\system32\Drivers\SKNFW.sys><N/A>
[SkyProcs / SkyProcs][Running/Manual Start]
  <\??\C:\PROGRA~1\SkyNet\FireWall\SkyProcs.sys><N/A>
[TesSafe / TesSafe][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\TesSafe.sys><TENCENT>
[Sony Ericsson W700 Driver driver (WDM) / W700bus][Stopped/Manual Start]
  <system32\DRIVERS\W700bus.sys><MCCI>
[Sony Ericsson W700 USB WMC Modem Filter / W700mdfl][Stopped/Manual Start]
  <system32\DRIVERS\W700mdfl.sys><MCCI>
[Sony Ericsson W700 USB WMC Modem Driver / W700mdm][Stopped/Manual Start]
  <system32\DRIVERS\W700mdm.sys><MCCI>
[Sony Ericsson W700 USB WMC Device Management Drivers (WDM) / W700mgmt][Stopped/Manual Start]
  <system32\DRIVERS\W700mgmt.sys><MCCI>
[Sony Ericsson W700 USB WMC OBEX Interface / W700obex][Stopped/Manual Start]
  <system32\DRIVERS\W700obex.sys><MCCI>

==================================
浏览器加载项
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <F:\2005\QQ.EXE, TENCENT>
[FlashGet]
  {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\PROGRA~1\FlashGet\flashget.exe, Amaze Soft>
[FlashGet Bar]
  {E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FlashGet\fgiebar.dll, Amaze Soft>
[MMCPlayer Class]
  {05C1004E-2596-48E5-8E26-39362985EEB9} <C:\WINDOWS\Downloaded Program Files\MMCShell.dll, Sohu.com Inc.>
[InstallHelper Class]
  {1DABF8D5-8430-4985-9B7F-A30E53D709B3} <C:\Program Files\Tencent\QQLive\QQLiveInstaller.dll, >
[iTrusPTA Class]
  {1E0DFFCF-27FF-4574-849B-55007349FEDA} <C:\WINDOWS\system32\aliedit\pta.dll, >
[UploadControl Control]
  {52FF336D-A05D-4A14-A3A1-7B6B4B427F88} <C:\WINDOWS\system32\UPLOAD~1.OCX, 广州网易互动娱乐有限公司>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>
[PasswordEditCtrl Class]
  {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RDS.DataSpace]
  {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>
[PasswordEditCtrl Class]
  {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
[上传到QQ网络硬盘]
  <F:\2005\AddToNetDisk.htm, N/A>
[使用网际快车下载]
  <C:\Program Files\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
  <C:\Program Files\FlashGet\jc_all.htm, N/A>
[添加到QQ自定义面板]
  <F:\2005\AddPanel.htm, N/A>
[添加到QQ表情]
  <F:\2005\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <F:\2005\SendMMS.htm, N/A>

==================================

【回复“Oo小关oO”的帖子】
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\mdb.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\memmodsc.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\memscan.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\msoe.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\nfio.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\ntfsstrm.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\sfdb.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\tempfile.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\winreg.ppl]  [Kaspersky Lab, 5.0.50.0]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for File Servers 5\OnAccess.dll]  [Kaspersky Lab, 5.0.50.0]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for File Servers 5\OnDemand.dll]  [Kaspersky Lab, 5.0.50.0]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for File Servers 5\scrch_ag.dll]  [Kaspersky Lab, 5.0.50.0]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for File Servers 5\blproxy.dll]  [Kaspersky Lab, 5.0.50.0]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for File Servers 5\QBackup.dll]  [Kaspersky Lab, 5.0.50.0]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for File Servers 5\qbstorage.dll]  [Kaspersky Lab, 5.0.50.0]
[PID: 160 / SYSTEM][D:\MDaemon\APP\CFEngine.exe]  [Alt-N, 6.7.7]
    [D:\MDaemon\APP\cfilter.dll]  [Alt-N, 6.7.7]
    [D:\MDaemon\APP\XceedZip.dll]  [Xceed Software Inc        (450) 442-2626        support@xceedsoft.com        www.xceedsoft.com, 4.5.77.0]
    [D:\MDaemon\APP\NTUtil.dll]  [Alt-N Technologies, Ltd., 6.7.7]
    [D:\MDaemon\APP\MDList.dll]  [N/A, ]
    [D:\MDaemon\APP\MDUser.dll]  [Alt-N Technologies, Ltd., 6.7.7]
    [D:\MDaemon\APP\mdquery.dll]  [Alt-N, 6.7.7]
[PID: 980 / SYSTEM][C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for File Servers 5\kavmm.exe]  [Kaspersky Lab, 5.0.50.0]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for File Servers 5\MSVCP61.dll]  [Kaspersky Lab, 6.00.0000]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for File Servers 5\klcsc.dll]  [Kaspersky Lab, 5.0.50.0]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for File Servers 5\kltrace.dll]  [Kaspersky Lab, 5.0.50.0]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for File Servers 5\FSSync.dll]  [Kaspersky Lab, 5.0.50.0]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for File Servers 5\klsecurity.dll]  [Kaspersky Lab, 5.0.50.0]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for File Servers 5\AVS.dll]  [Kaspersky Lab, 5.0.50.0]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for File Servers 5\pr_remote.dll]  [Kaspersky Lab, 5.0.50.0]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for File Servers 5\CheckTool.DLL]  [Kaspersky Lab, 5.0.50.0]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for File Servers 5\xmlparse.dll]  [Kaspersky Lab, 5.0.50.0]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for File Servers 5\xmltok.dll]  [Kaspersky Lab, 5.0.50.0]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for File Servers 5\prloader.dll]  [Kaspersky Lab, 5.0.50.0]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for File Servers 5\prkernel.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\xorio_ex.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\startups.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\pr_server.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\pr_client.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\prstring.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\l_llio.ppl]  [Kaspersky Lab, 5.0.50.0]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for File Servers 5\avp_iont.dll]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\avp1.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\avpgs.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\cab.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\dtreg.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\ichk2.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\ichstrms.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\klonacci.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\wdiskio.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\klondemi.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\mailmsg.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\mdb.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\memmodsc.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\memscan.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\msoe.ppl]  [Kaspersky Lab, 5.0.50.0]

[c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\nfio.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\ntfsstrm.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\sfdb.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\tempfile.ppl]  [Kaspersky Lab, 5.0.50.0]
    [c:\program files\kaspersky lab\kaspersky anti-virus for file servers 5\winreg.ppl]  [Kaspersky Lab, 5.0.50.0]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for File Servers 5\OnAccess.dll]  [Kaspersky Lab, 5.0.50.0]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for File Servers 5\OnDemand.dll]  [Kaspersky Lab, 5.0.50.0]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus for File Servers 5\blproxy.dll]  [Kaspersky Lab, 5.0.50.0]
[PID: 1124 / SYSTEM][C:\Program Files\Oray\PeanutHull5\PhCore.exe]  [上海贝锐, 1, 0, 0, 21]
    [C:\Program Files\Oray\PeanutHull5\iconv.dll]  [Free Software Foundation, 1.9]
    [C:\Program Files\Oray\PeanutHull5\PhAlive.dll]  [上海贝锐, 1, 0, 0, 26]
[PID: 1340 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 1480 / SYSTEM][C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe]  [Microsoft Corporation, 9.107.8320.0]
    [C:\Program Files\Common Files\System\MSSearch\Bin\mssws.dll]  [Microsoft Corporation, 9.107.8320.0]
    [C:\PROGRA~1\COMMON~1\System\MSSearch\Bin\mssrch.dll]  [Microsoft Corporation, 9.107.8320.0]
    [C:\Program Files\Common Files\System\MSSearch\Bin\tquery.dll]  [Microsoft Corporation, 9.107.8320.0]
    [C:\PROGRA~1\COMMON~1\System\MSSearch\Bin\propdefs.dll]  [Microsoft Corporation, 9.107.8320.0]
    [C:\PROGRA~1\COMMON~1\System\MSSearch\Bin\srchidx.dll]  [Microsoft Corporation, 9.107.8320.0]
[PID: 2212 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 2224 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 2696 / SYSTEM][D:\MDaemon\WorldClient\WorldClient.exe]  [Alt-N Technologies, Ltd., 6.7.7]
    [D:\MDaemon\WorldClient\HTML\WorldClient.dll]  [Alt-N Technologies, Ltd., 6.7.7]
    [D:\MDaemon\APP\MDUser.dll]  [Alt-N Technologies, Ltd., 6.7.7]
    [D:\MDaemon\APP\MDCalendar.dll]  [N/A, ]
[PID: 3728 / SYSTEM][C:\WINDOWS\system32\wbem\wmiprvse.exe]  [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 2552 / Administrator][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 2532 / Administrator][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 3524 / Administrator][D:\Program Files\TM\TMDlls\TM.exe]  [腾讯公司, 0, 0, 0, 0]
    [D:\Program Files\TM\TMDlls\BasicCtrlDll.dll]  [Tencent, 6, 0, 200, 320]
    [D:\Program Files\TM\TMDlls\MFC42.DLL]  [Microsoft Corporation, 6.00.8665.0]
    [D:\Program Files\TM\TMDlls\QQHelperDll.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\TM\TMDlls\BaseUIClass.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\TM\TMDlls\BaseCtrlClass.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\TM\TMDlls\QQBaseClassInDll.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\TM\TMDlls\gdiplus.dll]  [Microsoft Corporation, 5.1.3102.2180 (xpsp_sp2_rtm.040803-2158)]
    [D:\Program Files\TM\TMDlls\QQZip.dll]  [tencent, 0, 3, 2, 4]
    [D:\Program Files\TM\TMDlls\ImageOle.dll]  [TODO: <Company name>, 1.0.0.1]
    [D:\Program Files\TM\TMDlls\RICHED20.DLL]  [Microsoft Corporation, 5.31.23.1218]
    [D:\Program Files\TM\TMDlls\RICHED32.DLL]  [Microsoft Corporation, 5.00.2134.1]
    [D:\Program Files\TM\TMDlls\QQAPI.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\TM\TMDlls\QQRes.dll]  [N/A, ]
    [D:\Program Files\TM\TMDlls\LoginCtrl.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\TM\TMDlls\npkcntc.dll]  [INCA Internet Co., Ltd., 2006, 6, 27, 1]
    [D:\Program Files\TM\TMDlls\npkpdb.dll]  [INCA Internet Co., Ltd., 2003, 10, 1, 1]
    [D:\Program Files\TM\TMDlls\HostingMgr.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\TM\TMDlls\WizardCtrl.dll]  [Tencent, 1, 0, 0, 1]
    [D:\Program Files\TM\TMDlls\QQMainFrame.dll]  [TENCENT, 1, 0, 0, 1]
    [D:\Program Files\TM\TMDlls\CQQApplication.dll]  [N/A, ]
    [C:\WINDOWS\system32\msdmo.dll]  [, ]
    [D:\Program Files\TM\TMDlls\NewSkin.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\TM\TMDlls\MailSummary.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\TM\TMDlls\FrameBar.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\TM\TMDlls\QQConfigPlugin.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\TM\TMDlls\CameraDll.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\TM\TMDlls\UserRelationWeight.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\TM\TMDlls\vbscript.dll]  [Microsoft Corporation, 5.6.0.7426]
    [D:\Program Files\TM\TMDlls\CommercesMng.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\TM\TMDlls\MiscCtrl.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\TM\TMDlls\InstantSession.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\TM\TMDlls\QQSpace.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\TM\TMDlls\QQAddr.dll]  [深圳市腾讯计算机系统有限公司, 0, 3, 0, 44]
    [D:\Program Files\TM\TMDlls\QQGroupMng.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\TM\TMDlls\CustomFace.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\TM\TMDlls\LongConnection.dll]  [tencent, 5, 0, 200, 160]
    [D:\Program Files\TM\TMDlls\GroupConnection.dll]  [Tencent, 0, 3, 3, 5]
[PID: 840 / Administrator][C:\WINDOWS\regedit.exe]  [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 344 / Administrator][d:\My Documents\sreng2\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
    [d:\My Documents\sreng2\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 1784, C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY ANTI-VIRUS FOR FILE SERVERS 5\KAVMM.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1836, C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY ADMINISTRATION KIT\NAGENT\KLNAGENT.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 640, C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY ANTI-VIRUS FOR FILE SERVERS 5\KAVMM.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 980, C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY ANTI-VIRUS FOR FILE SERVERS 5\KAVMM.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3524, D:\PROGRAM FILES\TM\TMDLLS\TM.EXE]

==================================
API HOOK
RVA  错误： LoadLibraryA (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\Drivers\klif.sys)
RVA  错误： LoadLibraryExA (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\Drivers\klif.sys)
RVA  错误： LoadLibraryExW (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\Drivers\klif.sys)
RVA  错误： LoadLibraryW (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\Drivers\klif.sys)

==================================
隐藏进程
N/A

==================================


[/CODE]