[PID: 1532][C:\WINDOWS\system32\ctfmon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 2540][C:\WINDOWS\System32\alg.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\System32\sockspy.dll]  <N/A><N/A>
[PID: 7016][C:\Program Files\AutoCAD 2004\acad.exe]  <Autodesk, Inc.><R16.00.086>
    [C:\Program Files\Common Files\Autodesk Shared\ac1st16.dll]  <Autodesk, Inc.><16.1.63.0>
    [C:\Program Files\Common Files\Autodesk Shared\acdb16.dll]  <Autodesk, Inc.><16.1.63.10>
    [C:\Program Files\Common Files\Autodesk Shared\AcGe16.dll]  <Autodesk, Inc.><16.1.63.0>
    [C:\Program Files\AutoCAD 2004\acui16.dll]  <><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\ANav.dll]  <Autodesk><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\adui16.dll]  <><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\dswhip.dll]  <Autodesk Inc.><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\heidi8.dll]  <Autodesk, Inc.><8.0.16.86>
    [C:\Program Files\AutoCAD 2004\dlint8.dll]  <Autodesk, Inc.><8.0.16.86>
    [C:\Program Files\AutoCAD 2004\SFTTABAC.dll]  <Softel vdm><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\UserData.dll]  <Autodesk><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\adlmdll.dll]  <Autodesk, Inc.><4.0.0.2>
    [C:\Program Files\AutoCAD 2004\adctrls.dll]  <Autodesk, Inc.><16.0.0.86>
    [C:\WINDOWS\system32\sockspy.dll]  <N/A><N/A>
    [C:\Program Files\AutoCAD 2004\adui16res.dll]  <><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\AnavRes.dll]  <Autodesk><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\acui16res.dll]  <><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\DsWhipRes.dll]  <Autodesk Inc.><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\sfttabacRes.dll]  <Softel vdm><16.0.0.86>
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~ef4b6b\~df394b.tmp]  <N/A><N/A>
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~ef4b6b\~de8c3a.tmp]  <N/A><2.20.020>
    [C:\Program Files\AutoCAD 2004\ADCtrlsRes.dll]  <Autodesk, Inc.><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\acadbtn.dll]  <Autodesk><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\acadres.dll]  <Autodesk, Inc.><16.0.0.86>
    [C:\Program Files\Common Files\Autodesk Shared\acdb16enures.dll]  <Autodesk, Inc.><16.1.63.0>
    [C:\Program Files\AutoCAD 2004\adlmres.dll]  <Autodesk, Inc.><4.0.0.2>
    [C:\Program Files\AutoCAD 2004\PrxyInet.dll]  <Autodesk><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\PrxyInetRes.dll]  <Autodesk><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\oleaprot.arx]  <Autodesk><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\colorRes.dll]  <><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\drv\gdi8.hdi]  <Autodesk, Inc.><8.0.16.86>
    [C:\Program Files\AutoCAD 2004\drv\gdi8Res.dll]  <Autodesk, Inc.><8.0.16.86>
    [C:\Program Files\AutoCAD 2004\drv\szb8.hdi]  <Autodesk, Inc.><8.0.16.86>
    [C:\Program Files\AutoCAD 2004\drv\rblast8.hdi]  <Autodesk, Inc.><8.0.16.86>
    [C:\Program Files\AutoCAD 2004\drv\gdifont8.hdi]  <Autodesk, Inc.><8.0.16.86>
    [C:\Program Files\AutoCAD 2004\acgs.dll]  <Autodesk Inc.><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\acgsRes.dll]  <Autodesk Inc.><16.0.0.86>
    [c:\program files\common files\autodesk shared\achapi16.dbx]  <Autodesk, Inc.><16.1.63.0>
    [C:\Program Files\AutoCAD 2004\hcreg8.dll]  <Autodesk, Inc.><8.0.16.86>
    [C:\Program Files\AutoCAD 2004\hcreg8Res.dll]  <Autodesk, Inc.><8.0.16.86>
    [C:\Program Files\AutoCAD 2004\vl.arx]  <Autodesk Inc.><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\VLMSG.DLL]  <Autodesk Inc.><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\VLLIB.DLL]  <Autodesk Inc.><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\AcApp.arx]  <Autodesk><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\AcDblClkEdit.arx]  <Autodesk><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\AcDblClkEditPE.arx]  <Autodesk><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\AcDblClkEditRes.dll]  <Autodesk><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\acdim.arx]  <><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\ShareAC.dll]  <Autodesk, Inc><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\ShareMFC.dll]  <Autodesk, Inc><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\AcDimRes.dll]  <><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\aceplotx.arx]  <Autodesk><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\AcEplotXRes.dll]  <Autodesk><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\achlnkui.arx]  <Autodesk><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\achlnkuiRes.dll]  <Autodesk><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\AcIDropMgr.arx]  <Autodesk><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\AcIDropMgrRes.dll]  <Autodesk><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\AcLayerP.arx]  <Autodesk><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\AcLayerPRes.dll]  <Autodesk, Inc.><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\AcPltStamp.arx]  <Autodesk, Inc.><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\APPERR.dll]  <Autodesk, Inc.><8.0.16.86>
    [C:\Program Files\AutoCAD 2004\plotcfg8.dll]  <Autodesk, Inc.><8.0.16.86>
    [C:\Program Files\AutoCAD 2004\pm8.dll]  <Autodesk, Inc.><8.0.16.86>
    [C:\Program Files\AutoCAD 2004\pctres8.dll]  <Autodesk, Inc.><8.0.16.86>
    [C:\Program Files\AutoCAD 2004\apperrRes.dll]  <Autodesk, Inc.><8.0.16.86>
    [C:\Program Files\AutoCAD 2004\pmres8.dll]  <Autodesk, Inc.><8.0.16.86>
    [C:\Program Files\AutoCAD 2004\AcPltStampRes.dll]  <Autodesk, Inc.><16.0.0.86>

    [C:\Program Files\AutoCAD 2004\AcSign.arx]  <Autodesk><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\AcSignRes.dll]  <Autodesk><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\AcSpaceTrans.arx]  <Autodesk><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\AcSpaceTransRes.dll]  <Autodesk, Inc.><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\AcStd.arx]  <Autodesk><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\AcStStdRes.dll]  <Autodesk><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\AcTp.arx]  <Autodesk><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\AcTc.DLL]  <Autodesk><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\AcTcUi.dll]  <Autodesk><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\AcTcRes.dll]  <Autodesk><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\AcTcUiRes.dll]  <Autodesk><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\whohas.arx]  <><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\whohasRes.dll]  <><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\acetlodr.arx]  <Autodesk, Inc.><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\WSCommCntrAcCon.arx]  <Autodesk, Inc.><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\WSCommCntrAcConRes.dll]  <Autodesk><16.0.0.86>
    [C:\Program Files\AutoCAD 2004\support\vel.arx]  <><0,0,16,0>
    [c:\program files\common files\autodesk shared\modlr16.dll]  <Autodesk, Inc.><16.1.63.0>
    [c:\program files\common files\autodesk shared\ASMkern80A.dll]  <Autodesk, Inc.><8.0.2.7023>
    [c:\program files\common files\autodesk shared\ASMlaw80A.dll]  <Autodesk, Inc.><8.0.2.7023>
    [c:\program files\common files\autodesk shared\ASMbase80A.dll]  <Autodesk, Inc.><8.0.2.7023>
    [c:\program files\common files\autodesk shared\ASMfct80A.dll]  <Autodesk, Inc.><8.0.2.7023>
    [c:\program files\common files\autodesk shared\ASMintr80A.dll]  <Autodesk, Inc.><8.0.2.7023>
    [c:\program files\common files\autodesk shared\ASMcstr80A.dll]  <Autodesk, Inc.><8.0.2.7023>
    [c:\program files\common files\autodesk shared\ASMbool80A.dll]  <Autodesk, Inc.><8.0.2.7023>
    [c:\program files\common files\autodesk shared\ASMeulr80A.dll]  <Autodesk, Inc.><8.0.2.7023>
    [c:\program files\common files\autodesk shared\ASMcovr80A.dll]  <Autodesk, Inc.><8.0.2.7023>
    [c:\program files\common files\autodesk shared\ASMblnd80A.dll]  <Autodesk, Inc.><8.0.2.7023>
    [c:\program files\common files\autodesk shared\ASMofst80A.dll]  <Autodesk, Inc.><8.0.2.7023>
    [c:\program files\common files\autodesk shared\ASMga80A.dll]  <Autodesk, Inc.><8.0.2.7023>
    [c:\program files\common files\autodesk shared\ASMswp80A.dll]  <Autodesk, Inc.><8.0.2.7023>
    [c:\program files\common files\autodesk shared\ASMrem80A.dll]  <Autodesk, Inc.><8.0.2.7023>
    [c:\program files\common files\autodesk shared\ASMlopt80A.dll]  <Autodesk, Inc.><8.0.2.7023>
    [c:\program files\common files\autodesk shared\ASMrbi80A.dll]  <Autodesk, Inc.><8.0.2.7023>
    [c:\program files\common files\autodesk shared\ASMct80A.dll]  <Autodesk, Inc.><8.0.2.7023>
    [c:\program files\common files\autodesk shared\ASMsbool80A.dll]  <Autodesk, Inc.><8.0.2.7023>
    [c:\program files\common files\autodesk shared\ASMlop80A.dll]  <Autodesk, Inc.><8.0.2.7023>
    [c:\program files\common files\autodesk shared\ASMshl80A.dll]  <Autodesk, Inc.><8.0.2.7023>
    [c:\program files\common files\autodesk shared\ASMihl80A.dll]  <Autodesk, Inc.><8.0.2.7023>
    [c:\program files\common files\autodesk shared\ad16asm80.dll]  <Autodesk><16.1.63.0>
[PID: 7408][C:\WINDOWS\system32\wuauclt.exe]  <Microsoft Corporation><5.8.0.2469 built by: lab01_n(wmbla)>
    [C:\WINDOWS\system32\sockspy.dll]  <N/A><N/A>
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~e5d141.tmp]  <Macrovision Europe Ltd.><1, 0, 0, 1>
    [C:\WINDOWS\system32\sockspy.dll]  <N/A><N/A>
[PID: 11004][C:\Program Files\Common Files\Autodesk Shared\WSCommCntr1.exe]  <Autodesk, Inc.><17.0.54.0>
    [C:\WINDOWS\system32\sockspy.dll]  <N/A><N/A>
    [C:\Program Files\Common Files\Autodesk Shared\WebServices1.dll]  <Autodesk, Inc.><17.0.54.0>
[PID: 12400][C:\Program Files\Softwin\BitDefender10\bdlite.exe]  <SOFTWIN S.R.L.><10, 0, 0, 35>
    [C:\Program Files\Softwin\BitDefender10\txmlx.dll]  <Softwin><1, 0, 0, 1>
    [C:\Program Files\Softwin\BitDefender10\bdsubmit.dll]  <SOFTWIN><1, 0, 0, 143>
    [C:\Program Files\Softwin\BitDefender10\bdch.dll]  <SOFTWIN><1, 0, 0, 266>
    [C:\WINDOWS\system32\XCOMM.dll]  <Softwin><1, 8, 12, 0>
    [C:\Program Files\Softwin\BitDefender10\librtvr.dll]  <Softwin SRL><1, 3, 0, 0>
    [C:\WINDOWS\system32\sockspy.dll]  <N/A><N/A>
    [C:\Program Files\Softwin\BitDefender10\quarcore.dll]  <SOFTWIN S.R.L.><10, 0, 0, 1>
[PID: 30704][C:\Documents and Settings\Administrator\桌面\杀毒软件\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>    [C:\WINDOWS\system32\sockspy.dll]  <N/A><N/A>

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  Error. [AutoCADScriptFile]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

打开 System Repair Engineer 2(也就是的扫描软件sreng2)
打开启动项目--注册表

删除以下项
C:\PROGRA~1\KUGOO2\KUGOO.EXE
C:\WINDOWS\realupdate.exe other
F:\qttask.exe" -atboottime
C:\Program Files\skype\Phone\Skype.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe


sockspy.dll




系统修复--浏览器加载项--删除以下项
[ToolBar888]
{C004DEC2-2623-438e-9CA2-C9043AB28508} <C:\Program Files\Common Files\{306A1408-086E-2052-1110-040407040056}\MyToolBar.dll, N/A>
[ToolBar888]
{C004DEC2-2623-438e-9CA2-C9043AB28508} <C:\Program Files\Common Files\{306A1408-086E-2052-1110-040407040056}\MyToolBar.dll, N/A>

[Microsoft DirectAnimation Control]
{B6FFC24C-7E13-11D0-9B47-00C04FC2F51D} <C:\WINDOWS\system32\danim.dll, Microsoft Corporation>
[ToolBar888]
{C004DEC2-2623-438E-9CA2-C9043AB28508} <C:\Program Files\Common Files\{306A1408-086E-2052-1110-040407040056}\MyToolBar.dll, N/A>


重启安全模式




[PID: 1848][C:\WINDOWS\system32\drivers\CDAC11BA.EXE] <Macrovision><4.20.030>
[PID: 1868][C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE] <C-Dilla Ltd><3.23.000>
删除
C:\Program Files\Common Files\{306A1408-086E-2052-1110-040407040056}\MyToolBar.dll
C:\WINDOWS\system32\danim.dll