��Զ��BT1.exe BT2.exe ��?

��, 19 ʮ�� 2007 15:56:17 GMT

[ �� lhw5585055 �� 2007-6-7 10:54 �༭ ]

��ִ��System Repair Engineer (SREng)

��ɨ��ٰ��ɨ��
��󣬰��汨��浽��
�� SREngLOG.log ��ĸ��ճ��Ҫ��κ��޸ġ�
��޷��У��޸��չ��xic.exe/xic.com/xic.bat/xic.scr��

��ݵ��

��:

2007-06-05,15:51:08



System Repair Engineer 2.4.12.806

Smallfrogs ([url]http://www.KZTechs.com[/url])



Windows XP Professional Service Pack 2 (Build 2600) - ����Ȩ���û� - ��������



�������ݱ�ѡ�У�

    ���е�������Ŀ������ע����������ļ��С�����ȣ�

    �����������

    �������еĽ��̣���������ģ����Ϣ��

    �ļ�����

    Winsock �ṩ��

    Autorun.inf

    HOSTS �ļ�





������Ŀ

ע���

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

    <eKeyDaemon><"C:\Program Files\UNION Technology\�������氲ȫ�׼�  V2.5.10-S\eKeyDaemon.exe">  [���ݿ��ѿƼ��ɷ����޹�˾]

    <LANDeskInventoryClient><"C:\Program Files\LANDesk\LDClient\LDIScn32.exe" /NTT=SERVER_MANAGER:5007 /S=SERVER_MANAGER  /I=HTTP://SERVER_MANAGER/ldlogon/ldappl3.ldz /NOUI>  [LANDesk Software Ltd.]

    <Super Rabbit SRRestore><C:\PROGRA~1\SUPERR~1\MAGICSET\SRRest.exe /autosave>  [Super Rabbit Soft]

    <!AVG Anti-Spyware><"C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized>  [Anti-Malware Development a.s.]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]

    <MSDEG32><LYLoader.exe>  []

    <MSDWG32><LYLoadbr.exe>  [N/A]

    <MSDCG32    ><LYLeador.exe>  [N/A]

    <MSDOG32><LYLoador.exe>  [N/A]

    <MSDSG32><LYLoadar.exe>  [N/A]

    <MSDMG32><LYLoadmr.exe>  [N/A]

    <MSDHG32><LYLoadhr.exe>  [N/A]

    <MSDQG32><LYLoadqr.exe>  [N/A]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

    <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]

    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]

    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

    <{1496D5ED-7A09-46D0-8C92-B8E71A4304DF}><C:\WINDOWS\system32\msacn.dll>  []

    <{57B86673-276A-48B2-BAE7-C6DBB3020EB8}><C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll>  [Anti-Malware Development a.s.]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]

    <WinlogonNotify: NavLogon><C:\WINDOWS\System32\NavLogon.dll>  []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    <DAEMON Tools-2052><; "C:\Program Files\D-Tools\daemon.exe"  -lang 2052>  [DAEMON'S HOME]

    <dasa><; C:\DOCUME~1\by08099\LOCALS~1\Temp\daso.exe>  []

    <IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Publisher]

    <IntelAPMClient><; "C:\Program Files\LANDesk\LDClient\amclient.exe" /apm /s /ro>  [LANDesk Software Ltd.]

    <msstart><; C:\WINDOWS\System32\msstart.exe>  [N/A]

    <NvCplDaemon><; RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]

    <nwiz><; nwiz.exe /install>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]

    <PCSuiteTrayApplication><; C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup>  [Nokia]

    <PHIME2002A><; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows Publisher]

    <PHIME2002ASync><; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Publisher]

    <SDClientMonitor><; "C:\Program Files\LANDesk\LDClient\webportal\sdclientmonitor.exe">  [LANDesk Software Ltd.]

    <SoundMan><; SOUNDMAN.EXE>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]

    <StormCodec_Helper><; "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti>  []

    <svrhost><; C:\WINDOWS\System32\svrhost.exe>  [N/A]

    <vptray><; C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe>  [Symantec Corporation]

    <WinampAgent><; "C:\Program Files\Winamp\Winampa.exe">  []

    <YLive.exe><; C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe>  [N/A]



==================================

�����ļ���

[������Կ���鹤��]

  <C:\Documents and Settings\All Users\����ʼ���˵�\����\����\������Կ���鹤��.lnk --> C:\PROGRA~1\GZGS\������~1\eKey.exe []><N>



==================================

����

[AVG Anti-Spyware Guard / AVG Anti-Spyware Guard][Running/Auto Start]

  <C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe><Anti-Malware Development a.s.>

[LANDesk(R) Management Agent / CBA8][Running/Auto Start]

  <"C:\Program Files\LANDesk\Shared Files\residentagent.exe"><LANDesk Software, Ltd.>

[DefWatch / DefWatch][Running/Auto Start]

  <C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe><Symantec Corporation>

[Human Interface Device Access / HidServ][Stopped/Disabled]

  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>

[Intel Local Scheduler Service / Intel Local Scheduler Service][Running/Auto Start]

  <C:\Program Files\LANDesk\LDClient\LocalSch.EXE><LANDesk Software Ltd.>

[Intel PDS / Intel PDS][Running/Auto Start]

  <C:\WINDOWS\System32\CBA\pds.exe><LANDesk Software Ltd.>

[Intel QIP Client Service / Intel QIP Client Service][Running/Auto Start]

  <C:\Program Files\LANDesk\LDClient\qipclnt.exe><LANDesk Software Ltd.>

[LANDesk ����ಥ / Intel Targeted Multicast][Running/Auto Start]

  <C:\Program Files\LANDesk\LDClient\tmcsvc.exe><LANDesk Software Ltd.>

[LANDesk Զ�̿��Ʒ��� / ISSUSER][Running/Auto Start]

  <C:\PROGRA~1\LANDesk\LDClient\issuser.exe /SERVICE><LANDesk Software, Ltd.>

[Machine Debug Manager / MDM][Running/Auto Start]

  <"C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe"><Microsoft Corporation>

[Win32 Debug Service / MSDebugsvc][Stopped/Auto Start]

  <C:\WINDOWS\system32\rundll32.exe msdebug.dll,input><Microsoft Corporation>

[Symantec AntiVirus Client / Norton AntiVirus Server][Running/Auto Start]

  <C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe><Symantec Corporation>

[NVIDIA Driver Helper Service / NVSvc][Running/Auto Start]

  <C:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation>

[ServiceLayer / ServiceLayer][Stopped/Manual Start]

  <"C:\Program Files\PC Connectivity Solution\ServiceLayer.exe"><Nokia.>

[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]

  <C:\WINDOWS\system32\rundll32.exe windhcp.ocx,input><Microsoft Corporation>

[Network DDC / Windowsdate][Stopped/Auto Start]

  <C:\WINDOWS\system32\servex.exe><N/A>

[WMI Performance API / WMIApiSrv][Stopped/Auto Start]

  <C:\WINDOWS\system32\rundll32.exe WMIApiSrv.dll,input><Microsoft Corporation>

[Wireless Service / WZCSRVC][Stopped/Auto Start]

  <C:\WINDOWS\system32\rundll32.exe netsrvcs.dll,input><Microsoft Corporation>



==================================

��������

[Service for WDM 3D Audio Driver / ALCXSENS][Running/Manual Start]

  <system32\drivers\ALCXSENS.SYS><Sensaura Ltd>

[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]

  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>

[AVG Anti-Spyware Driver / AVG Anti-Spyware Driver][Running/System Start]

  <\??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys><N/A>

[AVG Anti-Spyware Clean Driver / AvgAsCln][Running/System Start]

  <System32\DRIVERS\AvgAsCln.sys><GRISOFT, s.r.o.>

[ICatch (VI) PC Camera / CA561][Stopped/Manual Start]

  <System32\Drivers\SPCA561.SYS><N/A>

[d347bus / d347bus][Running/Boot Start]

  <\SystemRoot\System32\DRIVERS\d347bus.sys><>

[d347prt / d347prt][Running/Boot Start]

  <\SystemRoot\System32\Drivers\d347prt.sys><>

[ldmirror / ldmirror][Running/Manual Start]

  <System32\DRIVERS\ldmirror.sys><Windows (R) Server 2003 DDK provider>

[Mirror Filter Driver for Uninstall / mirrorflt][Running/Manual Start]

  <System32\DRIVERS\mirrorflt.sys><Windows (R) Server 2003 DDK provider>

[NAVAP / NAVAP][Running/Manual Start]

  <\??\C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVAP.sys><Symantec Corporation>

[NAVAPEL / NAVAPEL][Running/Auto Start]

  <\??\C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVAPEL.SYS><Symantec Corporation>

[NAVENG / NAVENG][Running/Manual Start]

  <\??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20070326.020\NAVENG.sys><Symantec Corporation>

[NAVEX15 / NAVEX15][Running/Manual Start]

  <\??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20070326.020\NAVEX15.sys><Symantec Corporation>

[Nokia USB Generic / Nokia USB Generic][Stopped/Manual Start]

  <system32\drivers\nmwcdc.sys><Nokia>

[Nokia USB Modem / Nokia USB Modem][Stopped/Manual Start]

  <system32\drivers\nmwcdcm.sys><Nokia>

[Nokia USB Phone Parent / Nokia USB Phone Parent][Stopped/Manual Start]

  <system32\drivers\nmwcd.sys><Nokia>

[Netgroup Packet Filter / NPF][Stopped/Manual Start]

  <system32\drivers\npf.sys><N/A>

[nv / nv][Running/Manual Start]

  <System32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>

[Direct Parallel Link Driver / Ptilink][Running/Manual Start]

  <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>

[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]

  <System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>

[Secdrv / Secdrv][Stopped/Manual Start]

  <System32\DRIVERS\secdrv.sys><N/A>

[SymEvent / SymEvent][Running/Manual Start]

  <\??\C:\Program Files\Symantec\SYMEVENT.SYS><Symantec Corporation>

[UsbKDev / UsbKDev][Stopped/Auto Start]

  <System32\Drivers\UsbKDev.sys><>

[UNION Technology USB Key Device / utkey][Stopped/Manual Start]

  <System32\Drivers\utkey.sys><Union Technology>

[UNION Technology Virtual SmartCard / utvsc][Running/Manual Start]

  <System32\DRIVERS\utvsc.sys><Union Technology>

[Virtual PC Application Services / VPCAppSv][Running/Auto Start]

  <System32\DRIVERS\VPCAppSv.sys><Connectix Corporation>

[Virtual PC Emulated Ethernet Switch Driver / VPCNetS2][Running/Manual Start]

  <System32\DRIVERS\VPCNetS2.sys><Connectix Corporation>

[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]

  <System32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>



==================================

�����������

[Messenger]

  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>

[WebUserWord.WebUserWordControl]

  {0058F192-8C9C-41D9-AF98-DFB02562CF59} <C:\WINDOWS\Downloaded Program Files\WebUserWord.ocx, ss>

[ExFileToRs.FileToRs]

  {0A8F723A-6075-11D5-914D-0050BAE45AF2} <C:\WINDOWS\System32\ExFileToRs.dll, excellence>

[iTrusPTA Class]

  {1E0DFFCF-27FF-4574-849B-55007349FEDA} <C:\WINDOWS\System32\aliedit\pta.dll, >

[ExWshell.Exwscript]

  {227215F6-BE50-473A-8387-8517410C80CC} <C:\WINDOWS\System32\Exwscript.dll, EXCEL>

[DataTitle Control]

  {31A1CB88-08EE-47A5-B585-06B3299775A4} <C:\WINDOWS\System32\EXDATA~1.OCX, EXCELLENCE>

[exADO.ado]

  {345676E7-6139-11D5-914F-0050BAE45AF2} <C:\WINDOWS\System32\exADO.dll, excellence>

[DataForm Control]

  {3DE7BCC0-533C-4042-9801-21AC47BF45BB} <C:\WINDOWS\System32\EX7923~1.OCX, �����о����������޹�˾>

[exSoftVersion.SoftVersion]

  {9C08B36C-1339-11D4-A595-00105A776069} <C:\WINDOWS\System32\exSoftVersion.dll, excellence>

[proDocument.exDocument]

  {9CBAD573-826C-11D2-9073-0020AF05A5B1} <C:\WINDOWS\System32\proDocument.ocx, �����о����������޹�˾>

[Shockwave Flash Object]

  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>

[exSystem.clsSystem]

  {D88F3328-0321-11D6-9C64-00105A776064} <C:\WINDOWS\System32\exSystem.dll, Excellence>

[ship.ShipOfVB]

  {EC1792AB-7C76-4302-AF4B-CC7E67AC480E} <C:\WINDOWS\System32\ship.ocx, orifound>

[exFileAccess.ExFileSys]

  {FDC65D71-83A0-11D2-9075-0020AF05A5B1} <C:\WINDOWS\System32\exFileAccess.dll, excellence>

[DownActivex Control]

  {25F1DDE2-85C3-4554-94EB-BA3B165C23B5} <C:\WINDOWS\System32\DOWNAC~1.OCX, reesion>

[IEWnd Class]

  {4E2C3F16-6BD7-48EB-9F71-EA40663F5CAB} <C:\WINDOWS\System32\WinUICom.dll, ������̩����ͨ�Ƽ����޹�˾>

[Microsoft Web �����]

  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\System32\shdocvw.dll, Microsoft Corporation>

[Shockwave Flash Object]

  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>

[������ Microsoft Excel(&x)]

  <res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000, N/A>



==================================

�������еĽ���

[PID: 596][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 660][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 684][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\System32\NavLogon.dll]  [N/A, ]

    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]

    [C:\WINDOWS\system32\utsec.DLL]  [N/A, ]

    [C:\WINDOWS\system32\WKCSPIC.dll]  [UNION Technology, 2, 53, 0, 665]

[PID: 728][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\LYMANGR.DLL]  [N/A, ]

[PID: 740][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 896][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 960][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 1044][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 1100][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 1240][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 1384][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]

    [C:\WINDOWS\system32\CNMLM38.DLL]  [CANON INC., 1.52.2.0]

    [C:\WINDOWS\system32\ippnu.dll]  [N/A, ]

    [C:\WINDOWS\system32\ssgb3mon.dll]  [Samsung Electronics., 1, 0, 0, 0]

    [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\CNMPD38.DLL]  [CANON INC., 1.52.2.0]

[PID: 1432][C:\WINDOWS\System32\SCardSvr.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 1576][C:\Program Files\LANDesk\Shared Files\residentagent.exe]  [LANDesk Software, Ltd., 8.5.0.38]

    [C:\Program Files\LANDesk\Shared Files\pds2lis.dll]  [LANDesk Software, Ltd., 8.5.0.38]

    [C:\Program Files\LANDesk\Shared Files\cbaroot\extensions\lclxsvc.dll]  [LANDesk Software Ltd.   , 8.5.0.164 ]

    [C:\WINDOWS\system32\PDS.DLL]  [LANDesk Software Ltd., 6.12.0.135 E]

    [C:\WINDOWS\system32\NTS.dll]  [LANDesk Software Ltd., 6.12.0.135 E]

    [C:\Program Files\LANDesk\Shared Files\cbaroot\extensions\proxyext.dll]  [LANDesk Software, Ltd., 8.5.0.38]

[PID: 1600][C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe]  [Symantec Corporation, 8.00.00.9374]

[PID: 1644][C:\Program Files\LANDesk\LDClient\LocalSch.EXE]  [LANDesk Software Ltd., 8.5.0.164]

    [C:\Program Files\LANDesk\LDClient\LTAPI.DLL]  [LANDesk Software Ltd., 8.5.22.1]

[PID: 1672][C:\WINDOWS\System32\CBA\pds.exe]  [LANDesk Software Ltd., 6.12.0.135 E]

    [C:\WINDOWS\system32\PDS.DLL]  [LANDesk Software Ltd., 6.12.0.135 E]

    [C:\WINDOWS\system32\NTS.dll]  [LANDesk Software Ltd., 6.12.0.135 E]

    [C:\WINDOWS\system32\loc32vc0.dll]  [Intel, 3, 0, 0, 2]

[PID: 1700][C:\Program Files\LANDesk\LDClient\qipclnt.exe]  [LANDesk Software Ltd., 8.5.2.1]

[PID: 612][C:\WINDOWS\system32\MsgSys.EXE]  [LANDesk Software Ltd., 6.12.0.135 E]

    [C:\WINDOWS\system32\NTS.dll]  [LANDesk Software Ltd., 6.12.0.135 E]

    [C:\WINDOWS\system32\CBA.DLL]  [LANDesk Software Ltd., 6.12.0.135 E]

    [C:\WINDOWS\system32\MsgSys.dll]  [LANDesk Software Ltd., 6.12.0.135 E]

    [C:\WINDOWS\system32\PDS.DLL]  [LANDesk Software Ltd., 6.12.0.135 E]

    [C:\WINDOWS\system32\msdebug.dll]  [N/A, ]

    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, ]

[PID: 1120][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\msdebug.dll]  [N/A, ]

    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, ]

    [C:\WINDOWS\system32\wscsv.dll]  [N/A, ]

    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]

    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]

    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]

    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]

    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]

    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]

    [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]

    [C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll]  [Symantec Corporation, 8.00.00.9374]

    [C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll]  [Anti-Malware Development a.s., 7, 5, 0, 49]

    [C:\Program Files\Microsoft Office\Office10\msohev.dll]  [Microsoft Corporation, 10.0.2609]

    [C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll]  [Anti-Malware Development a.s., 7, 5, 0, 47]

[PID: 1508][C:\Program Files\UNION Technology\�������氲ȫ�׼�  V2.5.10-S\eKeyDaemon.exe]  [���ݿ��ѿƼ��ɷ����޹�˾, 2.4.0.12]

    [C:\WINDOWS\system32\UTAdmDll.dll]  [N/A, ]

    [C:\WINDOWS\system32\msdebug.dll]  [N/A, ]

    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, ]

    [C:\WINDOWS\system32\utsec.DLL]  [N/A, ]

    [C:\WINDOWS\system32\WKCSPIC.dll]  [UNION Technology, 2, 53, 0, 665]

    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]

    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]

    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]

    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]

    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]

[PID: 1572][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\msdebug.dll]  [N/A, ]

    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, ]

    [C:\WINDOWS\system32\netsrvcs.dll]  [N/A, ]

    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]

    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]

    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]

    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]

    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]

[PID: 532][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\msdebug.dll]  [N/A, ]

    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, ]

    [C:\WINDOWS\system32\netsrvcs.dll]  [N/A, ]

    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]

    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]

    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]

    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]

    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]

[PID: 560][C:\Program Files\GZGS\������Կ���鹤��\eKey.exe]  [, 1, 0, 0, 1]

    [C:\WINDOWS\system32\MwUsbD.dll]  [N/A, ]

    [C:\WINDOWS\system32\msdebug.dll]  [N/A, ]

    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, ]

    [C:\WINDOWS\system32\netsrvcs.dll]  [N/A, ]

    [C:\Program Files\GZGS\������Կ���鹤��\MwCRes.dll]  [, 1, 0, 0, 1]

    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]

    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]

    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]

    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]

    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]

[PID: 3772][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\msdebug.dll]  [N/A, ]

    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, ]

    [C:\WINDOWS\system32\netsrvcs.dll]  [N/A, ]

    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]

    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]

    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]

    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]

    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]

    [C:\Program Files\Common Files\Microsoft Shared\Ink\PENCHS.DLL]  [Microsoft Corporation, 1.0.1038.0]

    [C:\Program Files\Microsoft Office\Office10\msohev.dll]  [Microsoft Corporation, 10.0.2609]

    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]

    [C:\WINDOWS\system32\xpsp3res.dll]  [Microsoft Corporation, 5.1.2600.3100 (xpsp_sp2_gdr.070309-0025)]

    [C:\WINDOWS\system32\utsec.DLL]  [N/A, ]

    [C:\WINDOWS\system32\WKCSPIC.dll]  [UNION Technology, 2, 53, 0, 665]

    [C:\WINDOWS\system32\WINWB86.IME]  [Microsoft Corporation, 5.00.2000.3]

    [C:\WINDOWS\system32\UNISPIM.IME]  [�����廪�Ϲ������ɷ����޹�˾, 3.0.0.3045]

    [C:\WINDOWS\System32\Macromed\Flash\Flash9c.ocx]  [Adobe Systems, Inc., 9,0,45,0]

    [C:\WINDOWS\system32\msdmo.dll]  [, ]

    [C:\Program Files\Ringz Studio\Storm Codec\Codecs\VSFilter.dll]  [Gabest, 1, 0, 0, 9]

    [C:\WINDOWS\System32\DivXAF.ax]  [, 0.4]

    [C:\Program Files\Ringz Studio\Storm Codec\Codecs\OGGSplt.ax]  [Gabest, 1, 0, 0, 0]

    [C:\Program Files\Ringz Studio\Storm Codec\Codecs\RMSplt.ax]  [Gabest, 1, 0, 1, 0]

    [C:\Program Files\Ringz Studio\Storm Codec\Codecs\mpeg2dmx.ax]  [Moonlight Cordless Ltd., 3, 1, 200, 50117]

    [C:\WINDOWS\System32\ffdshow.ax]  [, 1.0.2.24]

    [C:\WINDOWS\System32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]

    [C:\WINDOWS\System32\MMSwitch.ax]  [Morgan Multimedia, 0.94?]

[PID: 3712][C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe]  [Anti-Malware Development a.s., 7, 5, 0, 50]

    [C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\engine.dll]  [Anti-Malware Development a.s., 4, 2, 0, 15]

    [C:\WINDOWS\system32\msdebug.dll]  [N/A, ]

    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, ]

    [C:\WINDOWS\system32\netsrvcs.dll]  [N/A, ]

    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]

    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]

    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]

    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]

    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]

[PID: 1336][F:\sreng2\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]

    [C:\WINDOWS\system32\msdebug.dll]  [N/A, ]

    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, ]

    [C:\WINDOWS\system32\netsrvcs.dll]  [N/A, ]

    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]

    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]

    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]

    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]

    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]



==================================

�ļ�����

.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]

.EXE  OK. ["%1" %*]

.COM  OK. ["%1" %*]

.PIF  OK. ["%1" %*]

.REG  OK. [regedit.exe "%1"]

.BAT  OK. ["%1" %*]

.SCR  OK. ["%1" /S]

.CHM  OK. ["C:\WINDOWS\hh.exe" %1]

.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]

.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]

.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]

.VBS  Error. [�������3000]

.JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]

.LNK  OK. [{00021401-0000-0000-C000-000000000046}]



==================================

Winsock �ṩ��

N/A



==================================

Autorun.inf

N/A



==================================

HOSTS �ļ�

127.0.0.1       localhost

192.168.0.247        server_manager



==================================

API HOOK

N/A



==================================

���ؽ���

N/A



==================================

��ATF Cleaner
ִ�к󣬹�ѡ��ȫѡ��¡��

��SREngɨ��־�밴��²��裬��ɾ��޸�

1.��ʹ��XDelBoxɾ��ļ���(XDelBox��)
ʹ��˵��ɾ��ʱ��Ҫɾ��ļ��·��ڴ�ɾ��ļ��б��Ҽ�ѡ��Ӽ��嵼�룬��Ҫɾ��ļ��ϵ��Ҽ��ѡ��ɾ��Ի��DOS��ɾ��xdelboxǰ��ж��п��ƶ��洢��ʣ��U�̣�MP3��ֻ��洢��ȣ��

c:\windows\system32\lymangr.dll
c:\windows\system32\ippnu.dll
c:\windows\system32\windhcp.ocx
c:\windows\system32\msdebug.dll
c:\windows\system32\fksdy.dll
c:\windows\system32\hreax.dll
c:\windows\system32\wfdrd.dll
c:\windows\system32\wgptl.dll
c:\windows\system32\wscsv.dll
c:\windows\system32\wtrmm.dll
c:\windows\system32\netsrvcs.dll
c:\windows\system32\utsec.dll
c:\windows\system32\svrhost.exe
c:\windows\system32\msstart.exe
c:\docume~1\by08099\locals~1\temp\daso.exe
c:\windows\system32\msacn.dll
c:\windows\system32\servex.exe
c:\windows\system32\drivers\npf.sys

2.ɾ��ʹ��SREng�޸��

��Ŀ �� ע��֮��ɾ��
[svrhost] <; C:\WINDOWS\System32\svrhost.exe>
[msstart] <; C:\WINDOWS\System32\msstart.exe>
[dasa] <; C:\DOCUME~1\by08099\LOCALS~1\Temp\daso.exe>
[{1496D5ED-7A09-46D0-8C92-B8E71A4304DF}] <C:\WINDOWS\system32\msacn.dll>
[MSDQG32] <LYLoadqr.exe>
[MSDHG32] <LYLoadhr.exe>
[MSDMG32] <LYLoadmr.exe>
[MSDSG32] <LYLoadar.exe>
[MSDOG32] <LYLoador.exe>
[MSDCG32 ] <LYLeador.exe>
[MSDWG32] <LYLoadbr.exe>
[MSDEG32] <LYLoader.exe>

��Ŀ �� Win32��Ӧ�ó��֮��ɾ��
[Wireless Service / WZCSRVC] <C:\WINDOWS\system32\rundll32.exe netsrvcs.dll,input>
[WMI Performance API / WMIApiSrv] <C:\WINDOWS\system32\rundll32.exe WMIApiSrv.dll,input>
[Network DDC / Windowsdate] <C:\WINDOWS\system32\servex.exe>
[Windows DHCP Service / WinDHCPsvc] <C:\WINDOWS\system32\rundll32.exe windhcp.ocx,input>
[Win32 Debug Service / MSDebugsvc] <C:\WINDOWS\system32\rundll32.exe msdebug.dll,input>

��Ŀ �� 񣭣� ��֮��ɾ��
[Netgroup Packet Filter / NPF] <system32\drivers\npf.sys>

ϵͳ�޸�� HOSTS�ļ��

ϵͳ�ָ��ļ��޸�
.VBS Error. [��3000]

��windows��Լ��ɱ��£��ȫ��ɱ��
http://www.arswp.com/download/arswp/arswp.rar

лл��ȥ��ǳ��л��

atf cleaner ��һЩ��ʱ�ļ��ߣ��ɱ��ʲô��ã�SREng��ɨ��ʹ��һ��û��Ч��
��è��֣��Ѳ��帽��ϵͳ�ļ��ϣ��һֱ��˱Ƚ�ͷ�ۣ��֪��ʹ��û��ʲô�õĽ��顣

��Ҳ��ˡ��¥��˵��һ��

��ڰ��ջظ��в�� ٴα��¸м�֮��!

��ʱ�ļ��Ϊ��ÿ��ɲ��Ŀ¼��IE ��ʱ�ļ��棬��,��һ��Ҫ��,��,��BAIDU ��Ҳ�ǵ�һ��ʱ�ļ��ѡ��!��,��ҿ��.

IE��ʱ�ļ��У��Ǳ��еġ�Ȼ��շ�Դ��־��û��޸ı��ѽ��

��ļ��Ⱦ�˲��ֻ��ͨ��һЩ��޸��ļ��ɱ��޸��ǲ��ܱ�֤ȫ��޸��ϵͳ��޸��ʹ�á�

��ھ�ֻ��1��,��ԭ��һ��ʹ��Կ�ľ��ĸ��Կ��ҳ�򲻿��ˣ��ٰ�æ��ô��

��:

ԭ�� lhw5585055 �� 2007-6-6 15:28 ��
��ھ�ֻ��1��,��ԭ��һ��ʹ��Կ�ľ��ĸ��Կ��ҳ�򲻿��ˣ��ٰ�æ��ô��

��ǣ��ҵ��˼��ǲ��ʱ��Ǹ��Կ��DLL��ˣ��û��أ�

��:

ԭ�� lhw5585055 �� 2007-6-7 00:04 ��
��ǣ��ҵ��˼��ǲ��ʱ��Ǹ��Կ��DLL��ˣ��û��أ�

��°�װ��2�Σ��ǲ��У��޷�ע�ᣬ�ҵ��˼��û��һ��ע��Ŀ��أ�

��õľ��IP��ܣ��רҵ��ܡ��һ�¹��ߡ�

лл,�Ѿ��ˣ��ǳ��л��æ!

��ǩ��
֤ȯ/�� Ʊ �� շ� �෽ �µ� 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1
��:

]]>

MM ��Ů ��

��ά�𲡶��

��Զ��BT1.exe BT2.exe ��?

��:

��:

��:

mdm.exe �鷳��

MM ��Ů ����

��������ά�𲡶�����������

�����Զ�����BT1.exe BT2.exe ��?

����:

����:

����:

mdm.exe �鷳��

MM ��Ů ��

��ά�𲡶��

��Զ��BT1.exe BT2.exe ��?

��:

��:

��: