瑞星卡卡安全论坛

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
    <在 SALE-CYM 上自动 MARK-CYM-2><C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3W1.EXE /P29 "在 SALE-CYM 上自动 MARK-CYM-2" /M "ME 1" /EF "HKCU">  [SEIKO EPSON CORPORATION]
    <在 DINGHONG 上自动 EPSON ME 1 (副本 1)><C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3W1.EXE /P38 "在 DINGHONG 上自动 EPSON ME 1 (副本 1)" /M "ME 1" /EF "HKCU">  [SEIKO EPSON CORPORATION]
    <在 RENOWN-HQ 上自动 EPSON ME 1><C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3W1.EXE /P30 "在 RENOWN-HQ 上自动 EPSON ME 1" /M "ME 1" /EF "HKCU">  [SEIKO EPSON CORPORATION]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Publisher]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Publisher]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows Publisher]
    <CoolSwitch><C:\WINDOWS\system32\taskswitch.exe>  []
    <在 DINGHONG 上自动 EPSON ME 1 (副本 1)><C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3W1.EXE /P38 "在 DINGHONG 上自动 EPSON ME 1 (副本 1)" /O22 "\\DINGHONG\EPSONME1+00" /M "ME 1">  [N/A]
    <在 CYP 上自动 EPSON ME 1><C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3W1.EXE /P24 "在 CYP 上自动 EPSON ME 1" /O14 "\\CYP\EPSONME1" /M "ME 1">  [N/A]
    <\\DINGHONG\EPSON ME 1 (副本 1)><C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3W1.EXE /P30 "\\DINGHONG\EPSON ME 1 (副本 1)" /O6 "USB004" /M "ME 1">  [N/A]
    <\\192.168.0.81\EPSON ME 1 (副本 1)><C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3W1.EXE /P34 "\\192.168.0.81\EPSON ME 1 (副本 1)" /O6 "USB001" /M "ME 1">  [N/A]
    <在 DINGHONG 上自动 EPSON ME 1><C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3W1.EXE /P29 "在 DINGHONG 上自动 EPSON ME 1" /O20 "\\DINGHONG\EPSONME1+" /M "ME 1">  [N/A]
    <\\192.168.0.81\EPSON ME 1><C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3W1.EXE /P25 "\\192.168.0.81\EPSON ME 1" /O6 "USB001" /M "ME 1">  [N/A]
    <在 SALE 上自动 EPSON ME 1><C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3W1.EXE /P25 "在 SALE 上自动 EPSON ME 1" /O17 "\\SALE\EPSONME111" /M "ME 1">  [N/A]
    <mhsa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mhso.exe>  []
    <wosa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\woso.exe>  []
    <ztsa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ztso.exe>  []
    <jtsa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\jtso.exe>  []
    <wlsa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wlso.exe>  []
    <wgsa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wgso.exe>  []
    <wmsa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wmso.exe>  []
    <fysa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\fyso.exe>  []
    <qjsa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\qjso.exe>  []
    <rxsa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\rxso.exe>  []
    <wdsa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wdso.exe>  []
    <tlsa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tlso.exe>  []
    <dasa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\daso.exe>  []
    <zxsa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\zxso.exe>  [N/A]
    <afksdfks1><C:\WINDOWS\system32\asdls1.exe>  []
    <asgfdjs2><C:\WINDOWS\system32\vbsdaas2.exe>  []
    <askasdkcl3><C:\WINDOWS\system32\faskflxld3.exe>  [N/A]
    <asfkafsk4><C:\WINDOWS\system32\fdaolfdos4.exe>  [N/A]
    <sakdasksd5><C:\WINDOWS\system32\eksdlfs5.exe>  []
    <daskaskfsak6><C:\WINDOWS\system32\dsfids6.exe>  []
    <xcxdsaa7><C:\WINDOWS\system32\slcskxsdl7.exe>  [N/A]
    <afskfask8><C:\WINDOWS\system32\fsfjasj8.exe>  []
    <akgkagaksad9><C:\WINDOWS\system32\fsakfask9.exe>  [N/A]
    <xzkadsfk10><C:\WINDOWS\system32\afslkfasl10.exe>  [N/A]
    <faslkakj11><C:\WINDOWS\system32\kjgagklj11.exe>  [N/A]
    <gadkgak12><C:\WINDOWS\system32\fsafsakx12.exe>  [N/A]
    <asdsaxcxz13><C:\WINDOWS\system32\dasxcsx13.exe>  [N/A]
    <dsadlsa14><C:\WINDOWS\system32\dsakfsak14.exe>  [N/A]
    <daskgfkkcx15><C:\WINDOWS\system32\dasdsaads15.exe>  [N/A]
    <aslkgadlkgsl1><C:\WINDOWS\system32\adfkajfaa1.exe>  [N/A]
    <HotKeysCmds><; C:\WINDOWS\system32\hkcmd.exe>  [N/A]
    <IgfxTray><; C:\WINDOWS\system32\igfxtray.exe>  [(Verified)Microsoft Windows Publisher]
    <SoundMam><; C:\WINDOWS\system32\SVOHOST.exe>  [N/A]
    <SoundMan><; SOUNDMAN.EXE>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{0FAD2E16-C8EF-5AC1-1E6A-AE3FD8EF56B3}><C:\Program Files\Internet Explorer\msvcrt.dll>  [Microsoft Corporation]
    <0CCE6E12-C2EC-56CD+1A62-AE3FD6EF56E6}><>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
    <WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll>  [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
    <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
    <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
    <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
    <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
    <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
    <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
    <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]

==================================

启动文件夹
[Microsoft Office]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Microsoft Office.lnk --> C:\PROGRA~1\MICROS~2\Office\OSA9.EXE [Microsoft Corporation]><N>
[EPSON Status Monitor 3 Environment Check(3)]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\EPSON Status Monitor 3 Environment Check(3).lnk --> C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE [SEIKO EPSON CORPORATION]><N>

==================================
服务
[Application Experience Lookup Services / AeLookupSvcs][Running/Auto Start]
  <C:\WINDOWS\system32\SVCH0ST.EXE -netsvcs><>
[卡巴斯基反病毒6.0 / AVP][Stopped/Auto Start]
  <"D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r><N/A>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[KDDelegateService / KDDelegateService][Stopped/Manual Start]
  <d:\Kingdee\K3ERP\KDDelegateService.exe><KINGDEE>

==================================
驱动程序
[Aero-Info PCI JScard / AIPCI_Device][Running/Manual Start]
  <System32\Drivers\AIPCI.sys><Your Corporation>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[ExpScaner / ExpScaner][Stopped/Auto Start]
  <\??\E:\Program Files\Rising\Rav\ExpScan.sys><N/A>
[HookCont / HookCont][Stopped/Auto Start]
  <\??\E:\Program Files\Rising\Rav\HOOKCONT.sys><N/A>
[HookReg / HookReg][Stopped/Auto Start]
  <\??\E:\Program Files\Rising\Rav\HookReg.sys><N/A>
[HookSys / HookSys][Stopped/Auto Start]
  <\??\E:\Program Files\Rising\Rav\HookSys.sys><N/A>
[ialm / ialm][Running/Manual Start]
  <system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[kl1 / kl1][Running/Boot Start]
  <\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif][Running/System Start]
  <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[MEMSCAN / MEMSCAN][Stopped/Auto Start]
  <\??\E:\Program Files\Rising\Rav\MEMSCAN.sys><N/A>
[Netgroup Packet Filter / NPF][Stopped/Manual Start]
  <system32\drivers\npf.sys><CACE Technologies>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139/810x/8169/8110 all in one NDIS NT Driver / RTL8023][Running/Manual Start]
  <system32\DRIVERS\Rtlnic51.sys><Realtek Semiconductor Corporation>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>

==================================

==================================
浏览器加载项
[]
  {A1626E66-B26B-C628-A1DF-BDACCFA26EE1} <C:\Program Files\Common Files\Relive.dll, Microsoft Corporation>
[]
  {D3626E66-B13B-C628-ACDF-BDABCFA265E1} <C:\Program Files\Common Files\Relive.dll, Microsoft Corporation>
[Web反病]
  {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll, N/A>
[番茄花园]
  {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} <http://tomatolei.com, N/A>
[]
  {A1626E66-B26B-C628-A1DF-BDACCFA26EE1} <C:\Program Files\Common Files\Relive.dll, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\Flash.ocx, Macromedia, Inc.>
[]
  {D3626E66-B13B-C628-ACDF-BDABCFA265E1} <C:\Program Files\Common Files\Relive.dll, Microsoft Corporation>

==================================
正在运行的进程
[PID: 504 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 560 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 584 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\klogon.dll]  [Kaspersky Lab, 6.0.1.411]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 628 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 640 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 796 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 840 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 944 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\wups2.dll]  [Microsoft Corporation, 7.0.6000.374 (winmain(wmbla).070416-2057)]
[PID: 1048 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1140 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1436 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
    [C:\WINDOWS\system32\CNBJMON2.DLL]  [Microsoft Corporation, 5.1.2600.2079 built by: xpsp(skatari)]
[PID: 1664 / Administrator][C:\WINDOWS\system32\taskswitch.exe]  [N/A, ]
[PID: 164 / Administrator][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 928 / SYSTEM][C:\WINDOWS\system32\SVCH0ST.EXE]  [, 3.0.1.4]
[PID: 1984 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 324 / Administrator][D:\Kingdee\K3ERP\kdmain.exe]  [金蝶软件(中国)有限公司, 9.00.1203]
    [C:\WINDOWS\system32\MSVBVM60.DLL]  [Microsoft Corporation, 6.00.9690]
    [C:\WINDOWS\system32\VB6CHS.DLL]  [Microsoft Corporation, 6.00.8169]
    [C:\WINDOWS\system32\KFO10.DLL]  [Kingdee Corporation, 1.1.1.2]
    [d:\Kingdee\K3ERP\KDLOGIN.DLL]  [金蝶软件(中国)有限公司, 9.06.1204]
    [D:\Kingdee\K3ERP\psapi.dll]  [Microsoft Corporation, 4.00]
    [C:\WINDOWS\system32\MSCOMCTL.OCX]  [Microsoft Corporation, 6.00.8862]
    [C:\Program Files\Common Files\KINGDEE\K3\Resources\FRMRESLOADER.DLL]  [kingdee, 1.00]
    [d:\Kingdee\K3ERP\DATAFLOWINFO.DLL]  [kingdee, 1.00]
    [C:\WINDOWS\system32\PROPSMGR.DLL]  [test, 1.00.0007]
    [C:\Program Files\Common Files\KINGDEE\K3\Resources\K3RESLOADER.DLL]  [, 1, 0, 0, 1]
    [C:\WINDOWS\system32\ACTBAR.OCX]  [Data Dynamics, 1, 0, 6, 5]
    [d:\Kingdee\K3ERP\DATATABFLOW.OCX]  [金蝶软件科技(深圳)有限公司, 1.00]
    [d:\Kingdee\K3ERP\TASKICON.OCX]  [activePower.idv.tw, 1, 0, 0, 4]
    [d:\Kingdee\K3ERP\KPCAPTION.OCX]  [kd, 1.00.0032]
    [C:\WINDOWS\system32\MSCOMCT2.OCX]  [Microsoft Corporation, 6.00.8418]
    [C:\WINDOWS\system32\KDVBF.DLL]  [Kingdee, 9.00.1203]
[PID: 1688 / Administrator][C:\WINDOWS\explorer.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\igfxpph.dll]  [Intel Corporation, 3.0.0.3943]
    [C:\WINDOWS\system32\hccutils.DLL]  [Intel Corporation, 3.0.0.3943]
    [C:\WINDOWS\system32\igfxres.dll]  [Intel Corporation, 3.0.0.3943]
    [C:\WINDOWS\system32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.3943]
    [C:\WINDOWS\system32\igfxdev.dll]  [Intel Corporation, 3.0.0.3943]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\Program Files\Common Files\Relive.dll]  [Microsoft Corporation, 1. 0. 0. 1]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
    [C:\PROGRA~1\sanlink\INPUT_~1\contmenu.dll]  [N/A, ]
[PID: 1620 / SYSTEM][C:\WINDOWS\system32\wuauclt.exe]  [Microsoft Corporation, 7.0.6000.374 (winmain(wmbla).070416-2057)]
    [C:\WINDOWS\system32\wups2.dll]  [Microsoft Corporation, 7.0.6000.374 (winmain(wmbla).070416-2057)]
[PID: 396 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 700 / Administrator][C:\Program Files\WinRAR\WinRAR.exe]  [Alexander Roshal, 3.51]
[PID: 784 / Administrator][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.890\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.890\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.890\Plugins\NTFSTREAM.SRE]  [Smallfrogs Studio, 1, 0, 0, 5]

==================================

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[C:\]
[AutoRun]
open=C:\WINDOWS\system32\cs.exe
shell\1=打开(&O)
shell\1\Command=C:\WINDOWS\system32\cs.exe
shell\2\=浏览(&B)
shell\2\Command=C:\WINDOWS\system32\cs.exe
shellexecute=C:\WINDOWS\system32\cs.exe
[D:\]
[AutoRun]
open=sxs.exe
shellexecute=sxs.exe
shell\Auto\command=sxs.exe
[E:\]
[AutoRun]
open=sxs.exe
shellexecute=sxs.exe
shell\Auto\command=sxs.exe

==================================
HOSTS 文件
N/A

==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 324, D:\KINGDEE\K3ERP\KDMAIN.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 700, C:\PROGRAM FILES\WINRAR\WINRAR.EXE]

==================================
API HOOK
RVA  错误： LoadLibraryA (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA  错误： LoadLibraryExA (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA  错误： LoadLibraryExW (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA  错误： LoadLibraryW (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA  错误： GetProcAddress (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)

==================================
隐藏进程
N/A

==================================


[/CODE]

http://forum.ikaka.com/topic.asp?board=28&artid=8341932

结束进程C:\WINDOWS\system32\SVCH0ST.EXE（注意其中的0是数字0而不是字母O）

用SREng在“启动项目”-“注册表”中删除以下项目：
<mhsa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mhso.exe> []
<wosa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\woso.exe> []
<ztsa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ztso.exe> []
<jtsa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\jtso.exe> []
<wlsa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wlso.exe> []
<wgsa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wgso.exe> []
<wmsa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wmso.exe> []
<fysa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\fyso.exe> []
<qjsa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\qjso.exe> []
<rxsa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\rxso.exe> []
<wdsa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wdso.exe> []
<tlsa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tlso.exe> []
<dasa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\daso.exe> []
<zxsa><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\zxso.exe> [N/A]
<afksdfks1><C:\WINDOWS\system32\asdls1.exe> []
<asgfdjs2><C:\WINDOWS\system32\vbsdaas2.exe> []
<askasdkcl3><C:\WINDOWS\system32\faskflxld3.exe> [N/A]
<asfkafsk4><C:\WINDOWS\system32\fdaolfdos4.exe> [N/A]
<sakdasksd5><C:\WINDOWS\system32\eksdlfs5.exe> []
<daskaskfsak6><C:\WINDOWS\system32\dsfids6.exe> []
<xcxdsaa7><C:\WINDOWS\system32\slcskxsdl7.exe> [N/A]
<afskfask8><C:\WINDOWS\system32\fsfjasj8.exe> []
<akgkagaksad9><C:\WINDOWS\system32\fsakfask9.exe> [N/A]
<xzkadsfk10><C:\WINDOWS\system32\afslkfasl10.exe> [N/A]
<faslkakj11><C:\WINDOWS\system32\kjgagklj11.exe> [N/A]
<gadkgak12><C:\WINDOWS\system32\fsafsakx12.exe> [N/A]
<asdsaxcxz13><C:\WINDOWS\system32\dasxcsx13.exe> [N/A]
<dsadlsa14><C:\WINDOWS\system32\dsakfsak14.exe> [N/A]
<daskgfkkcx15><C:\WINDOWS\system32\dasdsaads15.exe> [N/A]
<aslkgadlkgsl1><C:\WINDOWS\system32\adfkajfaa1.exe> [N/A]
<{0FAD2E16-C8EF-5AC1-1E6A-AE3FD8EF56B3}><C:\Program Files\Internet Explorer\msvcrt.dll> [Microsoft Corporation]
<0CCE6E12-C2EC-56CD+1A62-AE3FD6EF56E6}><> [N/A]

在“启动项目”-“服务”-“Win32服务应用程序”中点“隐藏经认证的微软项目”，选中以下项目，点“删除服务”，再点“设置”，在弹出的框中点“否”：
[Application Experience Lookup Services / AeLookupSvcs][Running/Auto Start]
<C:\WINDOWS\system32\SVCH0ST.EXE -netsvcs><>

在“系统修复”-“浏览器加载项”中删除：
[]
{A1626E66-B26B-C628-A1DF-BDACCFA26EE1} <C:\Program Files\Common Files\Relive.dll, Microsoft Corporation>
[]
{D3626E66-B13B-C628-ACDF-BDABCFA265E1} <C:\Program Files\Common Files\Relive.dll, Microsoft Corporation>

重启后从资源管理器左边的树形目录中，打开各盘符，删除：
C:\WINDOWS\system32\cs.exe
各盘符根目录的autorun.inf及sxs.exe
以及与以上列出的所有项目对应的文件。

谢谢！