打印

备份的系统都不能还原（附日志）

本主题由 Effenberg 于 2008-9-11 10:11 关闭

~流星宇~

共赏四书意

Rank: 3 Rank: 3

UID: 214692
积分: 183
活跃度: 457

发短消息
加为好友
当前离线

楼主大中小发表于 2008-8-26 11:16 只看该作者

备份的系统都不能还原（附日志）

我备份的系统不能还原，请帮忙看看这样的系统还能拯救吗？
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<SkDaemond><C:\Program Files\联想\联想标准键盘驱动\SkDaemond.exe>  []
<KavStart><"C:\kav2007\KAVStart.exe" -startup>  [Kingsoft Corporation]
<360Safetray><C:\Program Files\360safe\safemon\360tray.exe /start>  [(Verified)Qizhi Software (beijing) Co. Ltd]
<SetDefPrt><C:\Program Files\Brmfl04g\BrStDvPt.exe>  [Brother Industories, Ltd.]
<360Safebox><"C:\Program Files\360Safebox\safeboxTray.exe" /r>  [(Verified)Qizhi Software (beijing) Co. Ltd]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
<Userinit><C:\WINDOWS\system32\Userinit.exe>  [(Verified)Microsoft Windows Publisher]
<UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
<Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
<N/A><C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<Alcmtr><; ALCMTR.EXE>  [Realtek Semiconductor Corp.]
<DesktopFolderDir><; C:\Documents and Settings\All Users\桌面\>  [File is missing]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Publisher]
<MessageCenter><; C:\Program Files\Lenovo\LVT Menu\Messenger\MessageCenter.exe>  [skyware]
<multitray><; C:\Program Files\Lenovo\MultiRecover\loadtray.exe>  [(Verified)"Xi'an Saming Technology Co., Ltd."]
<PCCarer><; C:\Program Files\Lenovo\PCCarer\PCCarer_Serve.exe>  [(Verified)Lenovo (Beijing) Limited]
<PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows Publisher]
<PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Publisher]
<ProgramFolderDir><; C:\Documents and Settings\All Users\「开始」菜单\程序\Lenovo\PCCarer>  [File is missing]
<RTHDCPL><; RTHDCPL.EXE>  [Realtek Semiconductor Corp.]
<SkyTel><; SkyTel.EXE>  [Realtek Semiconductor Corp.]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<StartCCC><; C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe>  []

==================================
启动文件夹
N/A

==================================
服务
[A6B055D7 / A6B055D7][Stopped/Auto Start]
  <C:\WINDOWS\system32\3B3533FE.EXE -A6B055D7><(File is missing)>
[Application Management / AppMgmt][Stopped/Manual Start]
  <C:\WINDOWS\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\appmgmts.dll><N/A>
[Ati HotKey Poller / Ati HotKey Poller][Stopped/Disabled]
  <C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[Contrl Center of Storm Media / ccosm][Running/Auto Start]
  <C:\Program Files\StormII\stormliv.exe /asservice><北京暴风网际科技有限公司>
[drvsvc / drvsvc][Running/Auto Start]
  <C:\WINDOWS\System32\svchost.exe -k DrvSvcGroup-->C:\Program Files\Walker\DrvInst\Bin\DrvSvc.dll><北京易软健计算机技术有限公司>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[isrd / isrd][Stopped/Manual Start]
  <"c:\windows\system32\lenovo\isr\isrd.exe"><lenovo>
[Kingsoft Antivirus KWatch Service / KWatchSvc][Running/Auto Start]
  <C:\kav2007\KWatch.EXE><Kingsoft Corporation>
[system privilege agent / sysagent][Stopped/Auto Start]
  <C:\WINDOWS\system32\sysagent.exe><(File is missing)>

==================================
驱动程序
[ati2mtag / ati2mtag][Running/Manual Start]
  <system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[Lenovo USB Still Image driver / BrScnUsb][Running/Manual Start]
  <System32\Drivers\BrScnUsb.sys><Brother Industries Ltd.>
[ENUS_NDIS_DRIVER / ENUS_NDIS_DRIVER][Running/Boot Start]
  <\SystemRoot\system32\enusndis.sys><N/A>
[Microsoft UAA Bus Driver for High Definition Audio / HDAudBus][Running/Manual Start]
  <system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
[Service for Realtek HD Audio (WDM) / IntcAzAudAddService][Running/Manual Start]
  <system32\drivers\RtkHDAud.sys><Realtek Semiconductor Corp.>
[KWatch3 / KWatch3][Running/System Start]
  <\??\C:\WINDOWS\system32\drivers\KWatch3.SYS><Kingsoft Corporation>
[lenmmap / lenmmap][Running/System Start]
  <system32\DRIVERS\lenmmap.sys><N/A>
[NetGroup Packet Filter Driver / NPF][Running/Manual Start]
  <system32\drivers\npf.sys><CACE Technologies>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[SafeBoxKrnl / SafeBoxKrnl][Running/System Start]
  <\??\C:\Program Files\360Safebox\SafeBoxKrnl.sys><360安全中心>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
[TesSafe / TesSafe][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\TesSafe.sys><TENCENT>
[NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller / yukonwxp][Running/Manual Start]
  <system32\DRIVERS\yk51x86.sys><Marvell>

==================================
浏览器加载项
[ThunderAtOnce Class]
  {01443AEC-0FD1-40fd-9C87-E93D1494C233} <C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll, N/A>
[BitComet Helper]
  {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} <D:\TDDOWNLOAD\BitComet Beta\tools\BitCometBHO_1.2.2.28.dll, (Signed) BitComet>
[CBrowseStakeout Class]
  {55302805-482E-470E-8A57-6795A1487F90} <C:\kav2007\KAVAFish.DLL, Kingsoft Corporation>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll, N/A>
[SafeMon Class]
  {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, (Signed) 360.CN>
[启动迅雷5]
  {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <C:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[联想]
  {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} <http://www.lenovo.com, N/A>
[BitComet]
  {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} <, >
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[ThunderAtOnce Class]
  {01443AEC-0FD1-40FD-9C87-E93D1494C233} <C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll, N/A>
[]
  {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <, >
[Windows Media Player]
  {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, (Signed) Microsoft Corporation>
[HTML Document]
  {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
  {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[RealPlayer RAM Download Handler]
  {2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[IETag Factory]
  {38481807-CA0E-42D2-BF39-B33AF135CC4D} <C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\IETAG.DLL, (Signed) Microsoft Corporation>
[BitComet Helper]
  {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} <D:\TDDOWNLOAD\BitComet Beta\tools\BitCometBHO_1.2.2.28.dll, (Signed) BitComet>
[Thunder Agent Class]
  {485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <C:\Program Files\Thunder Network\Thunder\ComDlls\ThunderAgent_Now.dll, N/A>
[CBrowseStakeout Class]
  {55302805-482E-470E-8A57-6795A1487F90} <C:\kav2007\KAVAFish.DLL, Kingsoft Corporation>
[PowerPlayer Control]
  {5EC7C511-CD0F-42E6-830C-1BD9882F3458} <C:\PROGRA~1\PPStream\POWERP~1.DLL, (Signed) PPStream Inc.>
[]
  {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} <, >
[XMP Class]
  {6483F145-A768-4C41-AACC-52D4D7845851} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xplayer.dll_1_work, >
[XDRM]
  {693571CB-54A3-4E90-9D52-EEAE1334E2D3} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xdrm.dll_1_work, >
[StormPlayer Object]
  {6BE52E1D-E586-474F-A6E2-1A85A9B4D9FB} <C:\Program Files\StormII\mps.dll, (Signed) 北京暴风网际科技有限公司>
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[MediaComm Class]
  {7670648D-461B-42AF-BDFE-46D26AF5EFF2} <C:\Program Files\Thunder Network\Thunder\Components\InMedia\MediaAddin17.dll, Thunder Networking Technologies,LTD>
[360SafeLive]
  {87515F61-A66C-4319-A0E0-D416CB8059E3} <C:\Program Files\360safe\live.dll, (Signed) 360.cn>
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll, N/A>
[RMGetLicense Class]
  {A9FC132B-096D-460B-B7D5-1DB0FAE0C062} <C:\WINDOWS\system32\msnetobj.dll, (Signed) Microsoft Corporation>
[DapCtrl Class]
  {ACACC6EB-1FBA-4E13-A729-53AEB2DF54F8} <C:\Program Files\Common Files\Thunder Network\KanKan\DapCtrl.2.1.5803.60.(478).dll, ShenZhen Thunder Networking Technologies Ltd.>
[Microsoft Scriptlet Component]
  {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[SafeMon Class]
  {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, (Signed) 360.CN>
[RDS.DataSpace]
  {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[AUDIO__MP3 Moniker Class]
  {CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_ASF Moniker Class]
  {CD3AFA8F-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
  {CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
  {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[]
  {D18A0B52-D63C-4ED0-AFC6-C1E3DC1AF43A} <, >
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, (Signed) Adobe Systems, Inc.>
[AgControl Class]
  {DFEAF541-F3E1-4C24-ACAC-99C30715084A} <C:\Program Files\Microsoft Silverlight\npctrl.1.0.30401.0.dll, (Signed)  Microsoft Corporation>
[PasswordEditCtrl Class]
  {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, (Signed) 腾讯科技（深圳）有限公司>
[Thunder DapPlayer]
  {EEDD6FF9-13DE-496B-9A1C-D78B3215E266} <C:\Program Files\Thunder Network\Thunder\Components\DownAndPlay\DapPlayer3.0.5712.71.478.dll, ShenZhen Thunder Networking Technologies Ltd.>
[XPPlayer Class]
  {F3E70CEA-956E-49CC-B444-73AFE593AD7F} <C:\Program Files\Common Files\Thunder Network\KanKan\PPlayer.2.0.0.181.(478).dll, Xunlei Networking Technologies,LTD>
[&V使用Vagaa哇嘎下载]
  <D:\应用软件\Vagaa\Data\vg.htm, N/A>
[&使用BitComet下载]
  <res://D:\TDDOWNLOAD\BitComet Beta\BitComet.exe/AddLink.htm, N/A>
[&使用BitComet下载全部链接]
  <res://D:\TDDOWNLOAD\BitComet Beta\BitComet.exe/AddAllLink.htm, N/A>
[&使用BitComet下载本页视频]
  <res://D:\TDDOWNLOAD\BitComet Beta\BitComet.exe/AddVideo.htm, N/A>
[使用迅雷下载]
  <C:\Program Files\Thunder Network\Thunder\Program\geturl.htm, N/A>
[使用迅雷下载全部链接]
  <C:\Program Files\Thunder Network\Thunder\Program\getallurl.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
  <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ表情]
  <C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[金山毒霸反钓鱼...]
  <C:\kav2007\KAF\ShowSet.htm, N/A>

==================================
正在运行的进程
[PID: 600][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 656][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 684][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\Ati2evxx.dll]  [ATI Technologies Inc., 6.14.10.4162]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 728][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 740][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 896][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 976][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1072][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1120][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1208][C:\kav2007\KWatch.EXE]  [Kingsoft Corporation, 2007, 8, 13, 78]
[C:\kav2007\KAVIPC2.DLL]  [Kingsoft Corporation, 2007, 1, 15, 30]
[C:\kav2007\KAEPlat.DLL]  [Kingsoft Corp., 2007, 2, 4, 61]
[C:\kav2007\KAEMem.DAT]  [Kingsoft, 2006, 9, 25, 16]
[C:\kav2007\KAEUnpack.DAT]  [Kingsoft Corporation, 2008,01,25,202]
[C:\kav2007\KAVQuara.DLL]  [Kingsoft Corporation, 2007, 6, 15, 4]
[PID: 1260][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[PID: 1696][C:\Program Files\StormII\stormliv.exe]  [北京暴风网际科技有限公司, 3, 8, 6, 20]
[C:\Program Files\StormII\MSVCP60.dll]  [Microsoft Corporation, 6.02.3104.0]
[C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL]  [Microsoft Corporation, 11.0.5510]
[PID: 1720][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[c:\program files\walker\drvinst\bin\drvsvc.dll]  [北京易软健计算机技术有限公司, 1, 0, 0, 0]
[PID: 1744][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\BrWia04b.dll]  [Brother Industries, Ltd., 3.0.6.0 built by: WinDDK]
[C:\WINDOWS\system32\BrUSi04b.dll]  [Brother Industries, Ltd., 1, 0, 0, 1]
[PID: 1880][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 2, 0, 1005]
[C:\kav2007\KASocket.dll]  [Kingsoft Corporation, 2006, 12, 21, 241]
[C:\kav2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 12, 1, 139]
[C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
[C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll]  [, 2, 0, 0, 0]
[C:\WINDOWS\system32\msdmo.dll]  [, ]
[PID: 2016][C:\Program Files\联想\联想标准键盘驱动\SkDaemond.exe]  [, 1, 0, 0, 1]
[C:\Program Files\联想\联想标准键盘驱动\SKHooks.dll]  [, 1, 0, 0, 1]
[C:\Program Files\联想\联想标准键盘驱动\SKUtil.DLL]  [Silitek Corp., 1, 0, 8, 0]
[C:\kav2007\KASocket.dll]  [Kingsoft Corporation, 2006, 12, 21, 241]
[PID: 2028][C:\kav2007\KAVStart.exe]  [Kingsoft Corporation, 2007, 4, 2, 267]
[C:\WINDOWS\system32\MFC71.DLL]  [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MFC71CHS.DLL]  [Microsoft Corporation, 7.10.3077.0]
[C:\kav2007\KAVIPC2.DLL]  [Kingsoft Corporation, 2007, 1, 15, 30]
[C:\kav2007\SvcTimer.DLL]  [Kingsoft Corporation, 2006.12.22.84]
[C:\kav2007\KAVPassp.dll]  [Kingsoft Corporation, 2008,01,17,183]
[C:\kav2007\PopSprt3.dll]  [Kingsoft Corporation, 2007, 1, 16, 45]
[C:\WINDOWS\system32\odbcbcp.dll]  [Microsoft Corporation, 2000.085.1117.00 (xpsp_sp2_rtm.040803-2158)]
[C:\kav2007\KASocket.dll]  [Kingsoft Corporation, 2006, 12, 21, 241]
[PID: 120][C:\Program Files\360safe\safemon\360tray.exe]  [奇虎网, 4, 1, 8, 1004]
[C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 2, 0, 1005]
[C:\Program Files\360safe\safemon\SafeKrnl.dll]  [奇虎网, 4, 2, 0, 1001]
[C:\Program Files\360safe\AntiAdwa.dll]  [360Safe.com, 4, 2, 0, 1001]
[C:\Program Files\360safe\live.dll]  [360.cn, 1, 0, 1, 1027]
[C:\kav2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 12, 1, 139]
[C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
[C:\kav2007\KASocket.dll]  [Kingsoft Corporation, 2006, 12, 21, 241]
[PID: 216][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 2, 0, 1005]
[C:\kav2007\KASocket.dll]  [Kingsoft Corporation, 2006, 12, 21, 241]
[PID: 432][C:\kav2007\KMailMon.EXE]  [Kingsoft Corporation, 2007, 2, 25, 948]
[C:\kav2007\KAntiSpm.dll]  [Kingsoft Corporation, 2007, 2, 25, 129]
[C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
[C:\kav2007\KAVIPC2.DLL]  [Kingsoft Corporation, 2007, 1, 15, 30]
[C:\kav2007\KAECall2.DLL]  [Kingsoft Corporation, 2004, 12, 28, 7]
[C:\kav2007\KAEPlat.DLL]  [Kingsoft Corp., 2007, 2, 4, 61]
[C:\kav2007\KAEMem.DAT]  [Kingsoft, 2006, 9, 25, 16]
[C:\kav2007\KAEUnpack.DAT]  [Kingsoft Corporation, 2008,01,25,202]
[C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 2, 0, 1005]
[C:\kav2007\KAConfig.DLL]  [Kingsoft Corporation, 2007, 1, 11, 41]
[C:\kav2007\KASocket.dll]  [Kingsoft Corporation, 2006, 12, 21, 241]
[C:\kav2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 12, 1, 139]
[PID: 1028][C:\Program Files\racer-ccn-racerpc-ha\racer.exe]  [Putian Runway, 3,3,130,306]
[C:\kav2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 12, 1, 139]
[C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
[C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 2, 0, 1005]
[C:\kav2007\KASocket.dll]  [Kingsoft Corporation, 2006, 12, 21, 241]
[C:\Program Files\racer-ccn-racerpc-ha\rwxre.dll]  [Putian Runway, 3,3,130,306]
[C:\Program Files\racer-ccn-racerpc-ha\nspr4.dll]  [Netscape Communications Corporation, 4.6.1]
[C:\Program Files\racer-ccn-racerpc-ha\xpcom_core.dll]  [Mozilla Foundation, Personal]
[C:\Program Files\racer-ccn-racerpc-ha\plc4.dll]  [Netscape Communications Corporation, 4.6.1]
[C:\Program Files\racer-ccn-racerpc-ha\plds4.dll]  [Netscape Communications Corporation, 4.6.1]
[C:\Program Files\racer-ccn-racerpc-ha\nss3.dll]  [Netscape Communications Corporation, 3.10.2]
[C:\Program Files\racer-ccn-racerpc-ha\softokn3.dll]  [Netscape Communications Corporation, 3.10.2]
[C:\Program Files\racer-ccn-racerpc-ha\js3250.dll]  [Netscape Communications Corporation, 4.0]
[C:\Program Files\racer-ccn-racerpc-ha\gkgfx.dll]  [Mozilla Foundation, Personal]
[C:\Program Files\racer-ccn-racerpc-ha\xpcom_compat.dll]  [Mozilla Foundation, Personal]
[C:\Program Files\racer-ccn-racerpc-ha\smime3.dll]  [Netscape Communications Corporation, 3.10.2]
[C:\Program Files\racer-ccn-racerpc-ha\ssl3.dll]  [Netscape Communications Corporation, 3.10.2]
[C:\Program Files\racer-ccn-racerpc-ha\components\racer_base_comp.dll]  [Putian Runway, 3,3,130,306]
[C:\Program Files\racer-ccn-racerpc-ha\racer_base.dll]  [Putian Runway, 3,3,130,306]
[C:\Program Files\racer-ccn-racerpc-ha\kbdhook.dll]  [Putian Runway, 3,3,130,306]
[C:\Program Files\racer-ccn-racerpc-ha\components\jar50.dll]  [Mozilla Foundation, Personal]
[C:\Program Files\racer-ccn-racerpc-ha\components\gklayout.dll]  [Mozilla Foundation, Personal]
[C:\Program Files\racer-ccn-racerpc-ha\nssckbi.dll]  [Netscape Communications Corporation, 1.53]
[C:\Program Files\racer-ccn-racerpc-ha\components\racer_ad_comp.dll]  [Putian Runway, 3,3,130,306]
[C:\Program Files\racer-ccn-racerpc-ha\components\racer_access_dhcpplus.dll]  [Putian Runway, 3,3,130,325]
[C:\Program Files\racer-ccn-racerpc-ha\dhcpplus.dll]  [北京润汇科技有限公司, 3, 0, 0, 45]
[C:\Program Files\racer-ccn-racerpc-ha\components\racer_nss4_comp.dll]  [Putian Runway, 3,3,130,306]
[C:\Program Files\racer-ccn-racerpc-ha\nss4.dll]  [北京润汇科技有限公司, 1, 0, 0, 4]
[C:\Program Files\racer-ccn-racerpc-ha\wpcap.dll]  [CACE Technologies, 3, 2, 0, 29]
[C:\Program Files\racer-ccn-racerpc-ha\packet.dll]  [CACE Technologies, 3, 2, 0, 29]
[C:\Program Files\racer-ccn-racerpc-ha\WanPacket.dll]  [CACE Technologies, 3, 2, 0, 29]
[C:\Program Files\racer-ccn-racerpc-ha\plugins\NPSWF32.dll]  [, ]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1136][C:\Program Files\racer-ccn-racerpc-ha\RacerKp.exe]  [北京润汇科技有限公司, 1, 0, 0, 1]
[C:\kav2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 12, 1, 139]
[C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
[C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 2, 0, 1005]
[C:\kav2007\KASocket.dll]  [Kingsoft Corporation, 2006, 12, 21, 241]
[PID: 932][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\kav2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 12, 1, 139]
[C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
[C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 2, 0, 1005]
[C:\kav2007\KASocket.dll]  [Kingsoft Corporation, 2006, 12, 21, 241]
[PID: 1812][C:\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX00.250\SREngLdr.EXE]  [Smallfrogs Studio, 2.6.12.1018]
[PID: 3908][C:\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX00.250\SRE4a4a5d67.EXE]  [Smallfrogs Studio, 2.6.12.1018]
[C:\kav2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 12, 1, 139]
[C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
[C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 2, 0, 1005]
[C:\kav2007\KASocket.dll]  [Kingsoft Corporation, 2006, 12, 21, 241]
[C:\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX00.250\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1    localhost
127.0.0.1  gxgxy.net
127.0.0.1  c0mo.com
127.0.0.1 pvs360.com
127.0.0.1 sl8cjs.cn
127.0.0.1 windowsupdeta.cn
127.0.0.1 up.22x44.com
127.0.0.1 my.531jx.cn
127.0.0.1 nx.51ylb.cn
127.0.0.1 llboss.com
127.0.0.1 down.malasc.cn
127.0.0.1 d2.llsging.com
127.0.0.1 171817.171817.com
127.0.0.1 wg.47255.com
127.0.0.1 www.tomwg.com
127.0.0.1 tp.shpzhan.cn
127.0.0.1 1.joppnqq.com
127.0.0.1 xx.exiao01.com
127.0.0.1 www.22aaa.com
127.0.0.1 ilove.com
127.0.0.1 xxx.mmma.biz
127.0.0.1 www.868wg.com
127.0.0.1 2.joppnqq.com
127.0.0.1 1.jopanqc.com
127.0.0.1 yu.8s7.net
127.0.0.1 1.jopmmqq.com
127.0.0.1 cao.kv8.info
127.0.0.1 xtx.kv8.info
127.0.0.1 new.749571.com
127.0.0.1 xxx.vh7.biz
127.0.0.1 1.jopenkk.com
127.0.0.1 d.93se.com
127.0.0.1 3.joppnqq.com
127.0.0.1 xxx.j41m.com
127.0.0.1 1.jopenqc.com
127.0.0.1 xxx.m111.biz
127.0.0.1 down.18dd.net
127.0.0.1 www.333292.com
127.0.0.1 qqq.hao1658.com
127.0.0.1 qqq.dzydhx.com
127.0.0.1 www.exiao01.com
127.0.0.1 www.cike007.cn

==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 1260, C:\WINDOWS\SYSTEM32\SPOOLSV.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2016, C:\PROGRAM FILES\联想\联想标准键盘驱动\SKDAEMOND.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2028, C:\KAV2007\KAVSTART.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 432, C:\KAV2007\KMAILMON.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 432, C:\KAV2007\KMAILMON.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1028, C:\PROGRAM FILES\RACER-CCN-RACERPC-HA\RACER.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1136, C:\PROGRAM FILES\RACER-CCN-RACERPC-HA\RACERKP.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1812, C:\DOCUME~1\OWNER\LOCALS~1\TEMP\RAR$EX00.250\SRENGLDR.EXE]

==================================
API HOOK
入口点错误：LoadLibraryExW (危险等级: 高,  被下面模块所HOOK: C:\kav2007\KASocket.dll)

==================================
隐藏进程
N/A

==================================

****

[ 本帖最后由 ~流星宇~ 于 2008-8-30 11:38 编辑 ]

人人为我我为人人

TOP

yyylll66

剑盟病毒救援小组

Rank: 10

UID: 244268
积分: 265
活跃度: 652

我的中国心

发短消息
加为好友
当前离线

沙发大中小发表于 2008-8-26 12:11 只看该作者

服务
[A6B055D7 / A6B055D7][Stopped/Auto Start]
<C:\WINDOWS\system32\3B3533FE.EXE -A6B055D7><(File is missing)>
[lenmmap / lenmmap][Running/System Start]
<system32\DRIVERS\lenmmap.sys><N/A>

以上2个以及对应的文件删除试试

TOP

eyeego

剑盟病毒救援小组

Rank: 10

UID: 241761
积分: 764
活跃度: 1904

热心会员勋章我的中国心

发短消息
加为好友
当前离线

板凳大中小发表于 2008-8-26 12:21 只看该作者

又是没头的日志。。。。。

先按2楼说的做吧
顺带检查下C:\System Volume Information这个文件夹还在不在吧
再顺带。。。描述一下如何不能还原

TOP

~流星宇~

共赏四书意

Rank: 3 Rank: 3

UID: 214692
积分: 183
活跃度: 457

发短消息
加为好友
当前离线

地板大中小发表于 2008-8-26 14:33 只看该作者

回复板凳的帖子

先道谢了！C:\System Volume Information这个没找到，还原时死记，没反应。2楼的我不是很明白（我太菜）麻烦详细点好吗  我在发一次日志；****2008-08-26,11:34:24

System Repair Engineer 2.6.12.1018
Smallfrogs (http://www.KZTechs.com)

Windows XP Home Edition Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<SkDaemond><C:\Program Files\联想\联想标准键盘驱动\SkDaemond.exe>  []
<KavStart><"C:\kav2007\KAVStart.exe" -startup>  [Kingsoft Corporation]
<360Safetray><C:\Program Files\360safe\safemon\360tray.exe /start>  [(Verified)Qizhi Software (beijing) Co. Ltd]
<SetDefPrt><C:\Program Files\Brmfl04g\BrStDvPt.exe>  [Brother Industories, Ltd.]
<360Safebox><"C:\Program Files\360Safebox\safeboxTray.exe" /r>  [(Verified)Qizhi Software (beijing) Co. Ltd]
<PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows Publisher]
<PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
<Userinit><C:\WINDOWS\system32\UserInit.exe,>  [(Verified)Microsoft Windows Publisher]
<UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
<Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
<N/A><C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install>  [Microsoft Corporation]

==================================
启动文件夹
N/A

==================================
服务
[A6B055D7 / A6B055D7][Stopped/Auto Start]
  <C:\WINDOWS\system32\3B3533FE.EXE -A6B055D7><(File is missing)>
[Application Management / AppMgmt][Stopped/Manual Start]
  <C:\WINDOWS\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\appmgmts.dll><N/A>
[Ati HotKey Poller / Ati HotKey Poller][Stopped/Disabled]
  <C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[Contrl Center of Storm Media / ccosm][Running/Auto Start]
  <C:\Program Files\StormII\stormliv.exe /asservice><北京暴风网际科技有限公司>
[drvsvc / drvsvc][Running/Auto Start]
  <C:\WINDOWS\System32\svchost.exe -k DrvSvcGroup-->C:\Program Files\Walker\DrvInst\Bin\DrvSvc.dll><北京易软健计算机技术有限公司>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[isrd / isrd][Stopped/Manual Start]
  <"c:\windows\system32\lenovo\isr\isrd.exe"><lenovo>
[Kingsoft Antivirus KWatch Service / KWatchSvc][Running/Auto Start]
  <C:\kav2007\KWatch.EXE><Kingsoft Corporation>
[system privilege agent / sysagent][Stopped/Auto Start]
  <C:\WINDOWS\system32\sysagent.exe><(File is missing)>

==================================
驱动程序
[ati2mtag / ati2mtag][Running/Manual Start]
  <system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[Lenovo USB Still Image driver / BrScnUsb][Running/Manual Start]
  <System32\Drivers\BrScnUsb.sys>

[ENUS_NDIS_DRIVER / ENUS_NDIS_DRIVER][Running/Boot Start]
  <\SystemRoot\system32\enusndis.sys><N/A>
[Microsoft UAA Bus Driver for High Definition Audio / HDAudBus][Running/Manual Start]
  <system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
[Service for Realtek HD Audio (WDM) / IntcAzAudAddService][Running/Manual Start]
  <system32\drivers\RtkHDAud.sys><Realtek Semiconductor Corp.>
[KWatch3 / KWatch3][Running/System Start]
  <\??\C:\WINDOWS\system32\drivers\KWatch3.SYS><Kingsoft Corporation>
[lenmmap / lenmmap][Running/System Start]
  <system32\DRIVERS\lenmmap.sys><N/A>
[NetGroup Packet Filter Driver / NPF][Running/Manual Start]
  <system32\drivers\npf.sys><CACE Technologies>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[SafeBoxKrnl / SafeBoxKrnl][Running/System Start]
  <\??\C:\Program Files\360Safebox\SafeBoxKrnl.sys><360安全中心>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
[TesSafe / TesSafe][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\TesSafe.sys><TENCENT>
[NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller / yukonwxp][Running/Manual Start]
  <system32\DRIVERS\yk51x86.sys><Marvell>

==================================
浏览器加载项
[ThunderAtOnce Class]
  {01443AEC-0FD1-40fd-9C87-E93D1494C233} <C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll, N/A>
[BitComet Helper]
  {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} <D:\TDDOWNLOAD\BitComet Beta\tools\BitCometBHO_1.2.2.28.dll, (Signed) BitComet>
[CBrowseStakeout Class]
  {55302805-482E-470E-8A57-6795A1487F90} <C:\kav2007\KAVAFish.DLL, Kingsoft Corporation>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll, N/A>
[SafeMon Class]
  {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, (Signed) 360.CN>
[启动迅雷5]
  {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <C:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[联想]
  {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} <http://www.lenovo.com, N/A>
[BitComet]
  {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} <, >
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[ThunderAtOnce Class]
  {01443AEC-0FD1-40FD-9C87-E93D1494C233} <C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll, N/A>
[]
  {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <, >
[Windows Media Player]
  {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, (Signed) Microsoft Corporation>
[HTML Document]
  {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
  {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[RealPlayer RAM Download Handler]
  {2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[IETag Factory]
  {38481807-CA0E-42D2-BF39-B33AF135CC4D} <C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\IETAG.DLL, (Signed) Microsoft Corporation>
[BitComet Helper]
  {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} <D:\TDDOWNLOAD\BitComet Beta\tools\BitCometBHO_1.2.2.28.dll, (Signed) BitComet>
[Thunder Agent Class]
  {485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <C:\Program Files\Thunder Network\Thunder\ComDlls\ThunderAgent_Now.dll, N/A>
[CBrowseStakeout Class]
  {55302805-482E-470E-8A57-6795A1487F90} <C:\kav2007\KAVAFish.DLL, Kingsoft Corporation>
[PowerPlayer Control]
  {5EC7C511-CD0F-42E6-830C-1BD9882F3458} <C:\PROGRA~1\PPStream\POWERP~1.DLL, (Signed) PPStream Inc.>
[]
  {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} <, >
[XMP Class]
  {6483F145-A768-4C41-AACC-52D4D7845851} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xplayer.dll_1_work, >
[XDRM]
  {693571CB-54A3-4E90-9D52-EEAE1334E2D3} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xdrm.dll_1_work, >
[StormPlayer Object]
  {6BE52E1D-E586-474F-A6E2-1A85A9B4D9FB} <C:\Program Files\StormII\mps.dll, (Signed) 北京暴风网际科技有限公司>
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[MediaComm Class]
  {7670648D-461B-42AF-BDFE-46D26AF5EFF2} <C:\Program Files\Thunder Network\Thunder\Components\InMedia\MediaAddin17.dll, Thunder Networking Technologies,LTD>
[360SafeLive]
  {87515F61-A66C-4319-A0E0-D416CB8059E3} <C:\Program Files\360safe\live.dll, (Signed) 360.cn>
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll, N/A>
[RMGetLicense Class]
  {A9FC132B-096D-460B-B7D5-1DB0FAE0C062} <C:\WINDOWS\system32\msnetobj.dll, (Signed) Microsoft Corporation>
[DapCtrl Class]
  {ACACC6EB-1FBA-4E13-A729-53AEB2DF54F8} <C:\Program Files\Common Files\Thunder Network\KanKan\DapCtrl.2.1.5803.60.(478).dll, ShenZhen Thunder Networking Technologies Ltd.>
[Microsoft Scriptlet Component]
  {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[SafeMon Class]
  {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, (Signed) 360.CN>
[RDS.DataSpace]
  {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[AUDIO__MP3 Moniker Class]
  {CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_ASF Moniker Class]
  {CD3AFA8F-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
  {CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
  {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[]
  {D18A0B52-D63C-4ED0-AFC6-C1E3DC1AF43A} <, >
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, (Signed) Adobe Systems, Inc.>
[AgControl Class]
  {DFEAF541-F3E1-4C24-ACAC-99C30715084A} <C:\Program Files\Microsoft Silverlight\npctrl.1.0.30401.0.dll, (Signed)  Microsoft Corporation>
[PasswordEditCtrl Class]
  {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, (Signed) 腾讯科技（深圳）有限公司>
[Thunder DapPlayer]
  {EEDD6FF9-13DE-496B-9A1C-D78B3215E266} <C:\Program Files\Thunder Network\Thunder\Components\DownAndPlay\DapPlayer3.0.5712.71.478.dll, ShenZhen Thunder Networking Technologies Ltd.>
[XPPlayer Class]
  {F3E70CEA-956E-49CC-B444-73AFE593AD7F} <C:\Program Files\Common Files\Thunder Network\KanKan\PPlayer.2.0.0.181.(478).dll, Xunlei Networking Technologies,LTD>
[&V使用Vagaa哇嘎下载]
  <D:\应用软件\Vagaa\Data\vg.htm, N/A>
[&使用BitComet下载]
  <res://D:\TDDOWNLOAD\BitComet Beta\BitComet.exe/AddLink.htm, N/A>
[&使用BitComet下载全部链接]
  <res://D:\TDDOWNLOAD\BitComet Beta\BitComet.exe/AddAllLink.htm, N/A>
[&使用BitComet下载本页视频]
  <res://D:\TDDOWNLOAD\BitComet Beta\BitComet.exe/AddVideo.htm, N/A>
[使用迅雷下载]
  <C:\Program Files\Thunder Network\Thunder\Program\geturl.htm, N/A>
[使用迅雷下载全部链接]
  <C:\Program Files\Thunder Network\Thunder\Program\getallurl.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
  <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ表情]
  <C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[金山毒霸反钓鱼...]
  <C:\kav2007\KAF\ShowSet.htm, N/A>

==================================
正在运行的进程
[PID: 600][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 656][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 684][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\Ati2evxx.dll]  [ATI Technologies Inc., 6.14.10.4162]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 728][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 740][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 896][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 976][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1072][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1120][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1208][C:\kav2007\KWatch.EXE]  [Kingsoft Corporation, 2007, 8, 13, 78]
[C:\kav2007\KAVIPC2.DLL]  [Kingsoft Corporation, 2007, 1, 15, 30]
[C:\kav2007\KAEPlat.DLL]  [Kingsoft Corp., 2007, 2, 4, 61]
[C:\kav2007\KAEMem.DAT]  [Kingsoft, 2006, 9, 25, 16]
[C:\kav2007\KAEUnpack.DAT]  [Kingsoft Corporation, 2008,01,25,202]
[C:\kav2007\KAVQuara.DLL]  [Kingsoft Corporation, 2007, 6, 15, 4]
[PID: 1260][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[PID: 1696][C:\Program Files\StormII\stormliv.exe]  [北京暴风网际科技有限公司, 3, 8, 6, 20]
[PID: 1720][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[c:\program files\walker\drvinst\bin\drvsvc.dll]  [北京易软健计算机技术有限公司, 1, 0, 0, 0]
[PID: 1744][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\BrWia04b.dll]  [Brother Industries, Ltd., 3.0.6.0 built by: WinDDK]
[C:\WINDOWS\system32\BrUSi04b.dll]  [Brother Industries, Ltd., 1, 0, 0, 1]
[PID: 1880][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 2, 0, 1005]
[C:\kav2007\KASocket.dll]  [Kingsoft Corporation, 2006, 12, 21, 241]
[C:\kav2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 12, 1, 139]
[C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
[C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll]  [, 2, 0, 0, 0]
[C:\WINDOWS\system32\msdmo.dll]  [, ]
[C:\Program Files\StormII\spfa.dll]  [北京暴风网际科技有限公司, 2, 7, 4, 2]
[PID: 2016][C:\Program Files\联想\联想标准键盘驱动\SkDaemond.exe]  [, 1, 0, 0, 1]
[C:\Program Files\联想\联想标准键盘驱动\SKHooks.dll]  [, 1, 0, 0, 1]
[C:\Program Files\联想\联想标准键盘驱动\SKUtil.DLL]  [Silitek Corp., 1, 0, 8, 0]
[C:\kav2007\KASocket.dll]  [Kingsoft Corporation, 2006, 12, 21, 241]
[PID: 2028][C:\kav2007\KAVStart.exe]  [Kingsoft Corporation, 2007, 4, 2, 267]
[C:\WINDOWS\system32\MFC71.DLL]  [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MFC71CHS.DLL]  [Microsoft Corporation, 7.10.3077.0]
[C:\kav2007\KAVIPC2.DLL]  [Kingsoft Corporation, 2007, 1, 15, 30]
[C:\kav2007\SvcTimer.DLL]  [Kingsoft Corporation, 2006.12.22.84]
[C:\kav2007\KAVPassp.dll]  [Kingsoft Corporation, 2008,01,17,183]
[C:\kav2007\PopSprt3.dll]  [Kingsoft Corporation, 2007, 1, 16, 45]
[C:\kav2007\KASocket.dll]  [Kingsoft Corporation, 2006, 12, 21, 241]
[PID: 120][C:\Program Files\360safe\safemon\360tray.exe]  [奇虎网, 4, 1, 8, 1004]
[C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 2, 0, 1005]
[C:\Program Files\360safe\safemon\SafeKrnl.dll]  [奇虎网, 4, 2, 0, 1001]
[C:\Program Files\360safe\AntiAdwa.dll]  [360Safe.com, 4, 2, 0, 1001]
[C:\Program Files\360safe\live.dll]  [360.cn, 1, 0, 1, 1027]
[C:\kav2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 12, 1, 139]
[C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
[C:\kav2007\KASocket.dll]  [Kingsoft Corporation, 2006, 12, 21, 241]
[PID: 216][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 2, 0, 1005]
[C:\kav2007\KASocket.dll]  [Kingsoft Corporation, 2006, 12, 21, 241]
[PID: 432][C:\kav2007\KMailMon.EXE]  [Kingsoft Corporation, 2007, 2, 25, 948]
[C:\kav2007\KAntiSpm.dll]  [Kingsoft Corporation, 2007, 2, 25, 129]
[C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
[C:\kav2007\KAVIPC2.DLL]  [Kingsoft Corporation, 2007, 1, 15, 30]
[C:\kav2007\KAECall2.DLL]  [Kingsoft Corporation, 2004, 12, 28, 7]
[C:\kav2007\KAEPlat.DLL]  [Kingsoft Corp., 2007, 2, 4, 61]
[C:\kav2007\KAEMem.DAT]  [Kingsoft, 2006, 9, 25, 16]
[C:\kav2007\KAEUnpack.DAT]  [Kingsoft Corporation, 2008,01,25,202]
[C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 2, 0, 1005]
[C:\kav2007\KAConfig.DLL]  [Kingsoft Corporation, 2007, 1, 11, 41]
[C:\kav2007\KASocket.dll]  [Kingsoft Corporation, 2006, 12, 21, 241]
[C:\kav2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 12, 1, 139]
[PID: 1028][C:\Program Files\racer-ccn-racerpc-ha\racer.exe]  [Putian Runway, 3,3,130,306]
[C:\kav2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 12, 1, 139]
[C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
[C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 2, 0, 1005]
[C:\kav2007\KASocket.dll]  [Kingsoft Corporation, 2006, 12, 21, 241]
[C:\Program Files\racer-ccn-racerpc-ha\rwxre.dll]  [Putian Runway, 3,3,130,306]
[C:\Program Files\racer-ccn-racerpc-ha\nspr4.dll]  [Netscape Communications Corporation, 4.6.1]
[C:\Program Files\racer-ccn-racerpc-ha\xpcom_core.dll]  [Mozilla Foundation, Personal]
[C:\Program Files\racer-ccn-racerpc-ha\plc4.dll]  [Netscape Communications Corporation, 4.6.1]
[C:\Program Files\racer-ccn-racerpc-ha\plds4.dll]  [Netscape Communications Corporation, 4.6.1]
[C:\Program Files\racer-ccn-racerpc-ha\nss3.dll]  [Netscape Communications Corporation, 3.10.2]
[C:\Program Files\racer-ccn-racerpc-ha\softokn3.dll]  [Netscape Communications Corporation, 3.10.2]
[C:\Program Files\racer-ccn-racerpc-ha\js3250.dll]  [Netscape Communications Corporation, 4.0]
[C:\Program Files\racer-ccn-racerpc-ha\gkgfx.dll]  [Mozilla Foundation, Personal]
[C:\Program Files\racer-ccn-racerpc-ha\xpcom_compat.dll]  [Mozilla Foundation, Personal]
[C:\Program Files\racer-ccn-racerpc-ha\smime3.dll]  [Netscape Communications Corporation, 3.10.2]
[C:\Program Files\racer-ccn-racerpc-ha\ssl3.dll]  [Netscape Communications Corporation, 3.10.2]
[C:\Program Files\racer-ccn-racerpc-ha\components\racer_base_comp.dll]  [Putian Runway, 3,3,130,306]
[C:\Program Files\racer-ccn-racerpc-ha\racer_base.dll]  [Putian Runway, 3,3,130,306]
[C:\Program Files\racer-ccn-racerpc-ha\kbdhook.dll]  [Putian Runway, 3,3,130,306]
[C:\Program Files\racer-ccn-racerpc-ha\components\jar50.dll]  [Mozilla Foundation, Personal]
[C:\Program Files\racer-ccn-racerpc-ha\components\gklayout.dll]  [Mozilla Foundation, Personal]
[C:\Program Files\racer-ccn-racerpc-ha\nssckbi.dll]  [Netscape Communications Corporation, 1.53]
[C:\Program Files\racer-ccn-racerpc-ha\components\racer_ad_comp.dll]  [Putian Runway, 3,3,130,306]
[C:\Program Files\racer-ccn-racerpc-ha\components\racer_access_dhcpplus.dll]  [Putian Runway, 3,3,130,325]
[C:\Program Files\racer-ccn-racerpc-ha\dhcpplus.dll]  [北京润汇科技有限公司, 3, 0, 0, 45]
[C:\Program Files\racer-ccn-racerpc-ha\components\racer_nss4_comp.dll]  [Putian Runway, 3,3,130,306]
[C:\Program Files\racer-ccn-racerpc-ha\nss4.dll]  [北京润汇科技有限公司, 1, 0, 0, 4]
[C:\Program Files\racer-ccn-racerpc-ha\wpcap.dll]  [CACE Technologies, 3, 2, 0, 29]
[C:\Program Files\racer-ccn-racerpc-ha\packet.dll]  [CACE Technologies, 3, 2, 0, 29]
[C:\Program Files\racer-ccn-racerpc-ha\WanPacket.dll]  [CACE Technologies, 3, 2, 0, 29]
[C:\Program Files\racer-ccn-racerpc-ha\plugins\NPSWF32.dll]  [, ]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1136][C:\Program Files\racer-ccn-racerpc-ha\RacerKp.exe]  [北京润汇科技有限公司, 1, 0, 0, 1]
[C:\kav2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 12, 1, 139]
[C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
[C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 2, 0, 1005]
[C:\kav2007\KASocket.dll]  [Kingsoft Corporation, 2006, 12, 21, 241]
[PID: 932][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\kav2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 12, 1, 139]
[C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
[C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 2, 0, 1005]
[C:\kav2007\KASocket.dll]  [Kingsoft Corporation, 2006, 12, 21, 241]
[PID: 1812][C:\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX00.250\SREngLdr.EXE]  [Smallfrogs Studio, 2.6.12.1018]
[PID: 3908][C:\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX00.250\SRE4a4a5d67.EXE]  [Smallfrogs Studio, 2.6.12.1018]
[C:\kav2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 12, 1, 139]
[C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
[C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 2, 0, 1005]
[C:\kav2007\KASocket.dll]  [Kingsoft Corporation, 2006, 12, 21, 241]
[C:\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX00.250\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]
[C:\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX00.250\Plugins\NTFSTREAM.SRE]  [Smallfrogs Studio, 1, 0, 0, 5]
[PID: 552][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\kav2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 12, 1, 139]
[C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
[C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 2, 0, 1005]
[C:\kav2007\KASocket.dll]  [Kingsoft Corporation, 2006, 12, 21, 241]
[D:\TDDOWNLOAD\BitComet Beta\tools\BitCometBHO_1.2.2.28.dll]  [BitComet, 20080228]
[C:\kav2007\KAVAFish.DLL]  [Kingsoft Corporation, 2006, 10, 25, 27]
[C:\kav2007\KAScript.DLL]  [Kingsoft Corporation, 2007, 3, 6, 75]
[C:\kav2007\KAEPlat.DLL]  [Kingsoft Corp., 2007, 2, 4, 61]
[C:\kav2007\KAEMem.DAT]  [Kingsoft, 2006, 9, 25, 16]
[C:\kav2007\KAEUnpack.DAT]  [Kingsoft Corporation, 2008,01,25,202]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx]  [Adobe Systems, Inc., 9,0,124,0]
[C:\WINDOWS\system32\WINWB86.IME]  [Microsoft Corporation, 4.00.950]
[C:\WINDOWS\system32\UNISPIM5.IME]  [北京紫光华宇软件股份有限公司, 5.0.0.5091]
[C:\WINDOWS\system32\WINABCX.IME]  [PKUETI, 5.22.216]
[PID: 4036][C:\Program Files\Tencent\QQ\QQ.exe]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\QQBaseClassInDll.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\QQHelperDll.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\BasicCtrlDll.dll]  [TENCENT, 8,0,775,1803]
[C:\kav2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 12, 1, 139]
[C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
[C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 2, 0, 1005]
[C:\kav2007\KASocket.dll]  [Kingsoft Corporation, 2006, 12, 21, 241]
[C:\Program Files\Tencent\QQ\QQAPI.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\LoginCtrl.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\LoginCtrlRes.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\QQRes.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\QQMainFrame.dll]  [N/A, ]
[C:\Program Files\Tencent\QQ\QQPlugin.dll]  [N/A, ]
[C:\Program Files\Tencent\QQ\UnReadMsgMgr.dll]  [N/A, ]
[C:\Program Files\Tencent\QQ\CQQApplication.dll]  [N/A, ]
[C:\Program Files\Tencent\QQ\FlashAvatarDll.dll]  [, 1, 4, 0, 1]
[C:\Program Files\Tencent\QQ\NewSkin.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\MailSummary.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\QQSpace.dll]  [TENCENT, 8,0,775,1803]
[C:\WINDOWS\system32\msdmo.dll]  [, ]
[C:\Program Files\Tencent\QQ\QQKnowledgeSearch.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\OEMApplication.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\QQGroupMng.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\QQAllInOne.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\SCCore.dll]  [TENCENT, 1, 6, 0, 2]
[C:\Program Files\Tencent\QQ\CameraDll.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\QQSysMsgMng.dll]  [N/A, ]
[C:\Program Files\Tencent\QQ\QQPet.dll]  [TENCENT, 8,0,775,1803]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\Tencent\QQ\QRingMng.dll]  [N/A, ]
[C:\Program Files\Tencent\QQ\UserDefinedHead.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\QQConfigPlugin.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\QQCustomFace.dll]  [N/A, ]
[C:\Program Files\Tencent\QQ\QQAvatar.dll]  [N/A, ]
[C:\Program Files\Tencent\QQ\LongConnection.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\PhoneAPI.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\DialerAllinOne.dll]  [tencent, 1, 4, 0, 0]
[C:\Program Files\Tencent\QQ\BQQApplication.dll]  [N/A, ]
[C:\Program Files\Tencent\QQ\CommercesMng.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\PersonalDesktop.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\QQAddr.dll]  [深圳市腾讯计算机系统有限公司, 5, 0, 101, 330]
[C:\Program Files\Tencent\QQ\QQSceneMng.dll]  [N/A, ]
[C:\Program Files\Tencent\QQ\AddrSearch.dll]  [腾讯科技（深圳）有限公司, 2, 2, 1, 15]
[PID: 3876][C:\Program Files\Tencent\QQ\TXPlatform.exe]  [Tencent, 1, 0, 170, 0]
[C:\kav2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 12, 1, 139]
[C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
[C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 2, 0, 1005]
[C:\kav2007\KASocket.dll]  [Kingsoft Corporation, 2006, 12, 21, 241]
[PID: 196][C:\Program Files\Tencent\QQ\QQ.exe]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\QQBaseClassInDll.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\QQHelperDll.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\BasicCtrlDll.dll]  [TENCENT, 8,0,775,1803]
[C:\kav2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 12, 1, 139]
[C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
[C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 2, 0, 1005]
[C:\kav2007\KASocket.dll]  [Kingsoft Corporation, 2006, 12, 21, 241]
[C:\Program Files\Tencent\QQ\QQAPI.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\LoginCtrl.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\LoginCtrlRes.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\QQRes.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\QQMainFrame.dll]  [N/A, ]
[C:\Program Files\Tencent\QQ\QQPlugin.dll]  [N/A, ]
[C:\Program Files\Tencent\QQ\UnReadMsgMgr.dll]  [N/A, ]
[C:\Program Files\Tencent\QQ\CQQApplication.dll]  [N/A, ]
[C:\Program Files\Tencent\QQ\FlashAvatarDll.dll]  [, 1, 4, 0, 1]
[C:\Program Files\Tencent\QQ\NewSkin.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\MailSummary.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\QQSpace.dll]  [TENCENT, 8,0,775,1803]
[C:\WINDOWS\system32\msdmo.dll]  [, ]
[C:\Program Files\Tencent\QQ\QQKnowledgeSearch.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\OEMApplication.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\QQGroupMng.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\QQAllInOne.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\SCCore.dll]  [TENCENT, 1, 6, 0, 2]
[C:\Program Files\Tencent\QQ\CameraDll.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\QQPet.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\QQSysMsgMng.dll]  [N/A, ]
[C:\Program Files\Tencent\QQ\UserDefinedHead.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\QQConfigPlugin.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\QQCustomFace.dll]  [N/A, ]
[C:\Program Files\Tencent\QQ\QRingMng.dll]  [N/A, ]
[C:\Program Files\Tencent\QQ\QQAvatar.dll]  [N/A, ]
[C:\Program Files\Tencent\QQ\LongConnection.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\PhoneAPI.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\DialerAllinOne.dll]  [tencent, 1, 4, 0, 0]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\Tencent\QQ\BQQApplication.dll]  [N/A, ]
[C:\Program Files\Tencent\QQ\GroupConnection.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\CommercesMng.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\PersonalDesktop.dll]  [TENCENT, 8,0,775,1803]
[C:\Program Files\Tencent\QQ\QQAddr.dll]  [深圳市腾讯计算机系统有限公司, 5, 0, 101, 330]
[C:\Program Files\Tencent\QQ\QQSceneMng.dll]  [N/A, ]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1    localhost
127.0.0.1  gxgxy.net
127.0.0.1  c0mo.com
127.0.0.1 pvs360.com
127.0.0.1 sl8cjs.cn
127.0.0.1 windowsupdeta.cn
127.0.0.1 up.22x44.com
127.0.0.1 my.531jx.cn
127.0.0.1 nx.51ylb.cn
127.0.0.1 llboss.com
127.0.0.1 down.malasc.cn
127.0.0.1 d2.llsging.com
127.0.0.1 171817.171817.com
127.0.0.1 wg.47255.com
127.0.0.1 www.tomwg.com
127.0.0.1 tp.shpzhan.cn
127.0.0.1 1.joppnqq.com
127.0.0.1 xx.exiao01.com
127.0.0.1 www.22aaa.com
127.0.0.1 ilove.com
127.0.0.1 xxx.mmma.biz
127.0.0.1 www.868wg.com
127.0.0.1 2.joppnqq.com
127.0.0.1 1.jopanqc.com
127.0.0.1 yu.8s7.net
127.0.0.1 1.jopmmqq.com
127.0.0.1 cao.kv8.info
127.0.0.1 xtx.kv8.info
127.0.0.1 new.749571.com
127.0.0.1 xxx.vh7.biz
127.0.0.1 1.jopenkk.com
127.0.0.1 d.93se.com
127.0.0.1 3.joppnqq.com
127.0.0.1 xxx.j41m.com
127.0.0.1 1.jopenqc.com
127.0.0.1 xxx.m111.biz
127.0.0.1 down.18dd.net
127.0.0.1 www.333292.com
127.0.0.1 qqq.hao1658.com
127.0.0.1 qqq.dzydhx.com
127.0.0.1 www.exiao01.com
127.0.0.1 www.cike007.cn

==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 1260, C:\WINDOWS\SYSTEM32\SPOOLSV.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2016, C:\PROGRAM FILES\联想\联想标准键盘驱动\SKDAEMOND.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2028, C:\KAV2007\KAVSTART.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 432, C:\KAV2007\KMAILMON.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 432, C:\KAV2007\KMAILMON.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1028, C:\PROGRAM FILES\RACER-CCN-RACERPC-HA\RACER.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1136, C:\PROGRAM FILES\RACER-CCN-RACERPC-HA\RACERKP.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1812, C:\DOCUME~1\OWNER\LOCALS~1\TEMP\RAR$EX00.250\SRENGLDR.EXE]

==================================
API HOOK
入口点错误：LoadLibraryExW (危险等级: 高,  被下面模块所HOOK: C:\kav2007\KASocket.dll)

==================================
隐藏进程
N/A

==================================****

人人为我我为人人

TOP

eyeego

剑盟病毒救援小组

Rank: 10

UID: 241761
积分: 764
活跃度: 1904

热心会员勋章我的中国心

发短消息
加为好友
当前离线

5楼大中小发表于 2008-8-26 14:43 只看该作者

C:\System Volume Information这个文件夹是隐藏的。。。
用WINRAR看看有没有
2楼那个。。。。。。
我再详细写下吧
1.建议使用XDelBox删除以下文件：(XDelBox1.7下载)
help=使用说明：删除时复制所有要删除文件的路径，在待删除文件列表里点击右键选择从剪贴板导入，导入（右键不检查路径导入）后在要删除文件上点击右键，选择立刻重启删除(请勾上“抑制再生”的选项），电脑会重启进入DOS界面进行删除操作。运行xdelbox前最好卸载所有可移动存储介质（包括U盘，MP3，手机存储卡等）。
C:\WINDOWS\system32\3B3533FE.EXE
C:\WINDOWS\system32\DRIVERS\lenmmap.sys

启动项目－－服务－－驱动程序之如下项删除：
SREng-在"启动项目->服务－>驱动程序中"选中"隐藏已认证的微软项目"然后删除下面名称的驱动程序(选中有问题的驱动后，点"删除服务"，点“设置”按钮即可。注意弹出的窗口中要点 "否NO"才是确认删除服务）(不能删除的就禁用:启动类型改为disabled,点中修改启动类型，点设置):
[A6B055D7 / A6B055D7][Stopped/Auto Start]
  <C:\WINDOWS\system32\3B3533FE.EXE -A6B055D7><(File is missing)>
[lenmmap / lenmmap][Running/System Start]
  <system32\DRIVERS\lenmmap.sys><N/A>

关闭IE用下面的工具全选，清理系统临时文件和IE临时文件夹
http://www.atribune.org/public-beta/ATF-Cleaner.exe
下载windows清理助手V2.6清理一遍，记得之前更新好
http://www.arswp.com/download/arswp2/arswp2.zip

TOP

暮色横飞

初盟一笑间

UID: 264640
积分: 24
活跃度: 61

发短消息
加为好友
当前离线

6楼大中小发表于 2008-8-26 17:01 只看该作者

楼主用的什么备份软件看重装试试

TOP

备份的系统都不能还原（附日志）

备份的系统都不能还原（附日志）

回复 板凳 的帖子

回复板凳的帖子