2007-01-06,09:04:45

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows 98 SE -

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件


启动项目


注册表

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
(ScanRegistry)(C:\WINDOWS\scanregw.exe /autorun) [Microsoft Corporation]
(internat.exe)(internat.exe) [Microsoft Corporation]
(ntaskldr)(C:\WINDOWS\system\logo_1.exe) [N/A]
(mhs2)(C:\WINDOWS\TEMP\MHS2.EXE) [N/A]
(zts2)(C:\WINDOWS\TEMP\ZTS2.EXE) [N/A]
(wlzs)(C:\WINDOWS\TEMP\WLZS.EXE) [N/A]
(InternetEx)(C:\WINDOWS\SYSTEM\1.EXE) [N/A]
(AVP)("C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\AVP.EXE") [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
(AVP)("C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\AVP.EXE" -r) [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
(ntaskldr)(C:\WINDOWS\system\logo_1.exe) [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
(shell)(Explorer.exe) [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
(AppInit_DLLs)() [N/A]




--------------------------------------------------------------------------------



启动文件夹

N/A



--------------------------------------------------------------------------------



服务

N/A



--------------------------------------------------------------------------------



驱动程序

N/A



--------------------------------------------------------------------------------

浏览器加载项

[快车]
{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} (C:\PROGRAM FILES\FLASHGET\FLASHGET.EXE, FlashGet.com)
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} (, N/A)
[Web反病]
{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} (C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\SCIEPLUGIN.DLL, Kaspersky Lab)
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} (C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH9.OCX, Adobe Systems, Inc.)
[GLWebAvt Control]
{C14D003A-DA41-4FEE-8204-62A94EAA29D1} (C:\WINDOWS\DOWNLO~1\GLWEBAVT.OCX, 4)
[IEDown Class]
{F917534D-535B-416B-8E8F-0C04756C31A8} (C:\WINDOWS\SYSTEM\GLIEDOWN2.DLL, N/A)
[7CodeX Control]
{29E609C2-9184-46F6-8BD7-432F52A1234A} (C:\WINDOWS\DOWNLO~1\7CODEX.OCX, ESCSOFT)
[VqqSpeedDlProxy Class]
{F138084D-84D7-48CD-BEA8-04772457516E} (C:\WINDOWS\VQQSDL.DLL, Tencent)
[CEditCtrl Object]
{488A4255-3236-44B3-8F27-FA1AECAA8844} (C:\WINDOWS\SYSTEM\ALIEDIT\ALIEDIT.DLL, www.alipay.com)
[添加到QQ自定义面板]
(E:\PROGRAM FILES\1\QQ\AddPanel.htm, N/A)
[添加到QQ表情]
(E:\PROGRAM FILES\1\QQ\AddEmotion.htm, N/A)
[上传到QQ网络硬盘]
(E:\PROGRAM FILES\1\QQ\AddToNetDisk.htm, N/A)
[用QQ彩信发送该图片]
(E:\PROGRAM FILES\1\QQ\SendMMS.htm, N/A)
[Get Alexa Data]
(http://client.alexa.com/holiday/script/actions/sitedata.htm, N/A)
[See Related Links]
(http://client.alexa.com/holiday/script/actions/related.htm, N/A)
[Write a Review...]
(http://client.alexa.com/holiday/script/actions/review.htm, N/A)
[Mail to a Friend...]
(http://client.alexa.com/holiday/script/actions/mailto.htm, N/A)
[Alexa Web Search]
(http://client.alexa.com/holiday/script/actions/search.htm, N/A)
[添加至卡巴反横幅广告 ]
(C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm, N/A)



--------------------------------------------------------------------------------

正在运行的进程

[PID: 4294962877][C:\WINDOWS\SYSTEM\MPREXE.EXE] [Microsoft Corporation, 4.10.1998]
[C:\WINDOWS\SYSTEM\DHCPCSVC.DLL] [N/A, N/A]
[C:\WINDOWS\SYSTEM\NETBIOS.DLL] [N/A, N/A]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\SCRCHPG.DLL] [Kaspersky Lab, 1.0.6.411]
[PID: 4294845821][C:\WINDOWS\EXPLORER.EXE] [Microsoft Corporation, 4.72.3110.1]
[PID: 4294882601][C:\WINDOWS\SYSTEM\RPCSS.EXE] [Microsoft Corporation, 4.71.2900]
[PID: 4294817801][C:\WINDOWS\SYSTEM\INTERNAT.EXE] [Microsoft Corporation, 4.10.2222]
[PID: 4294812261][C:\WINDOWS\SYSTEM\LOGO_1.EXE] [N/A, N/A]
[C:\WINDOWS\TEMP\MHS2.DLL] [N/A, N/A]
[PID: 4294807977][C:\WINDOWS\TEMP\MHS2.EXE] [N/A, N/A]
[C:\WINDOWS\TEMP\ZTS2.DLL] [N/A, N/A]
[PID: 4294833573][C:\WINDOWS\TEMP\ZTS2.EXE] [N/A, N/A]
[C:\WINDOWS\TEMP\WLZS.DLL] [N/A, N/A]
[PID: 4294835389][C:\WINDOWS\TEMP\WLZS.EXE] [N/A, N/A]
[PID: 4294807765][C:\WINDOWS\SYSTEM\1.EXE] [N/A, N/A]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\QB.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\THPIMPL.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\BASEGUI.PPL] [Crsky, 6.0.1]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\FSDRVPLGN.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\NFIO.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\AVPGUI.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\WINREG.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\PARAMS.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\PXSTUB.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\PRKERNEL.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\PRLOADER.DLL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\AVPGS.PPL] [Kaspersky Lab, 6.0.1.411]
[PID: 4294827749][C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\AVP.EXE] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\FSSYNC.DLL] [Kaspersky Lab, 6.0.5.0]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\PRREMOTE.DLL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\INFLATE.PPL] [Kaspersky Lab, 6.0.0.16]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\PRSEQIO.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\MSOE.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\MDB.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\LHA.PPL] [Kaspersky Lab, 6.0.1.411]

[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\RAR.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\ARJ.PPL] [Kaspersky Lab, 6.0.0.16]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\CAB.PPL] [Kaspersky Lab, 6.0.0.16]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\MINIZIP.PPL] [Kaspersky Lab, 6.0.0.16]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\UNIARC.PPL] [Kaspersky Lab, 6.0.0.16]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\QB.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\TEMPFILE.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\IWGEN.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\HCCMP.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\HASHCONT.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\SFDB.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\ICHK2.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\AVP_IO32.DLL] [Kaspersky Lab, 5.0.0.0]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\L_LLIO.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\AVP1.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\TRAFFICMONITOR2.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\SSLEAY32.DLL] [The OpenSSL Project, http://www.openssl.org/, 0.9.8c]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\LIBEAY32.DLL] [The OpenSSL Project, http://www.openssl.org/, 0.9.8c]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\PRUTIL.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\WINDOWS\SYSTEM\NETBIOS.DLL] [N/A, N/A]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\HTTPANLZ.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\DTREG.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\APHISHT.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\PROCMON.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\APHISH.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\HTTPSCAN.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\KLAVENG.DLL] [N/A, N/A]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\SC.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\AHIDS.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\CKAHUM.DLL] [Kaspersky Lab, 6.0.1.1]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\CKAHRULE.DLL] [Kaspersky Lab, 6.0.1.1]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\CKAHCOMM.DLL] [Kaspersky Lab, 6.0.1.1]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\OAS.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\AVP3INFO.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\AVSPM.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\AVLIB.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\WDISKIO.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\AVPMGR.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\AVS.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\HASHMD5.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\REPORT.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\LIC60.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\THPIMPL.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\TIMER.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\SCHEDULE.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\CRPTHLPR.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\NDETECT.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\BL.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\WINDOWS\SYSTEM\DHCPCSVC.DLL] [N/A, N/A]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\FSDRVPLGN.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\NFIO.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\TM.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\WINREG.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\PARAMS.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\PXSTUB.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\PRKERNEL.PPL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\PRLOADER.DLL] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\AVPGS.PPL] [Kaspersky Lab, 6.0.1.411]
[PID: 4294764965][C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\AVP.EXE] [Kaspersky Lab, 6.0.1.411]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\FSSYNC.DLL] [Kaspersky Lab, 6.0.5.0]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\PRREMOTE.DLL] [Kaspersky Lab, 6.0.1.411]
[C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH9.OCX] [Adobe Systems, Inc., 9,0,16,0]
[C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WEB 文件夹\MSONSEXT.DLL] [N/A, N/A]
[C:\WINDOWS\SYSTEM\CHENHU4.IME] [chenhu, 5.1]
[C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 6.0\SCRCHPG.DLL] [Kaspersky Lab, 1.0.6.411]
[PID: 4294603569][C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2800.1106]
[PID: 4294536765][C:\WINDOWS\SYSTEM\DDHELP.EXE] [Microsoft Corporation, 4.06.03.0518]
[PID: 4294573973][C:\WINDOWS\DESKTOP\SRENG2\SRENG.EXE] [Smallfrogs Studio, 2.3.13.690]



--------------------------------------------------------------------------------

文件关联

.TXT OK. [C:\WINDOWS\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [C:\WINDOWS\winhlp32.exe %1]
.INI OK. [C:\WINDOWS\NOTEPAD.EXE %1]
.INF OK. [C:\WINDOWS\NOTEPAD.EXE %1]
.VBS OK. [C:\WINDOWS\WScript.exe "%1" %*]
.JS OK. [C:\WINDOWS\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]



--------------------------------------------------------------------------------



Winsock 提供者

MS.w95.spi.spx
C:\WINDOWS\SYSTEM\mswsosp.dll(Microsoft Corporation, Microsoft Windows Sockets 2.0 Service Provider)
MS.w95.spi.spx/seq
C:\WINDOWS\SYSTEM\mswsosp.dll(Microsoft Corporation, Microsoft Windows Sockets 2.0 Service Provider)
MS.w95.spi.ipx
C:\WINDOWS\SYSTEM\mswsosp.dll(Microsoft Corporation, Microsoft Windows Sockets 2.0 Service Provider)
MS.w95.spi.osp
C:\WINDOWS\SYSTEM\mswsosp.dll(Microsoft Corporation, Microsoft Windows Sockets 2.0 Service Provider)
MS.w95.spi.tcp
C:\WINDOWS\SYSTEM\msafd.dll(Microsoft Corporation, Microsoft Windows Sockets 2.0 Service Provider)
MS.w95.spi.udp
C:\WINDOWS\SYSTEM\msafd.dll(Microsoft Corporation, Microsoft Windows Sockets 2.0 Service Provider)
MS.w95.spi.raw
C:\WINDOWS\SYSTEM\msafd.dll(Microsoft Corporation, Microsoft Windows Sockets 2.0 Service Provider)
MS.w95.spi.rsvptcp
C:\WINDOWS\SYSTEM\rsvpsp.dll(Microsoft Corporation, Microsoft Windows Rsvp 1.0 Service Provider)
MS.w95.spi.rsvpudp
C:\WINDOWS\SYSTEM\rsvpsp.dll(Microsoft Corporation, Microsoft Windows Rsvp 1.0 Service Provider)



--------------------------------------------------------------------------------



Autorun.inf

[D:\]
[AutoRun]
OPEN=go.exe
shellexecute=go.exe
shell\打开(&O)\command=go.exe
[E:\]
[AutoRun]
OPEN=go.exe
shellexecute=go.exe
shell\打开(&O)\command=go.exe



--------------------------------------------------------------------------------



HOSTS 文件

127.0.0.1 localhost



--------------------------------------------------------------------------------



API HOOK

N/A

C:\WINDOWS\TEMP\到安全模式下清空
C:\WINDOWS\SYSTEM\1.EXE删除：

C:\WINDOWS\system\logo_1.exe新病毒