==================================
正在运行的进程
[PID: 436 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 492 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 516 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 560 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 572 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 724 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 828 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 892 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [c:\windows\system32\clkea.dll]  [Microsoft Corporation, 5.1.2600.0]
[PID: 944 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1032 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1176 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
    [C:\WINDOWS\system32\EBPMON24.DLL]  [SEIKO EPSON CORPORATION, 5, 4, 0, 0]
[PID: 1520 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [c:\progra~1\couk\myeu.dll]  [ , 5, 0, 0, 4]
    [c:\progra~1\couk\pbhx.dll]  [, 5, 0, 0, 4]
    [c:\progra~1\couk\ugmc.dll]  [ , 5, 0, 0, 4]
    [c:\progra~1\couk\rdjz.dll]  [ , 5, 0, 0, 4]
    [c:\progra~1\couk\iuaq.dll]  [, 5, 0, 0, 2]
[PID: 1564 / 于刚][C:\WINDOWS\AdsNT.exe]  [, 1, 0, 0, 1]
    [c:\progra~1\couk\pbhx.dll]  [, 5, 0, 0, 4]
    [c:\progra~1\couk\ugmc.dll]  [ , 5, 0, 0, 4]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.Sys]  [N/A, ]
[PID: 1596 / SYSTEM][C:\Program Files\Jiangmin\AntiVirus\KVWSC.exe]  [Jiangmin Co.,Ltd, 1, 0, 7, 131]
    [C:\Program Files\Jiangmin\Kernel\EngFace.dll]  [Jiangmin Co., Ltd., 2, 0, 7, 412]
    [C:\WINDOWS\system32\HiveBase.dll]  [Jiangmin Co., Ltd., 1, 0, 7, 226]
[PID: 1672 / SYSTEM][C:\WINDOWS\SYSTEM32\RUNDLLFOROUR.EXE]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINDOWS\SYSTEM32\WBEM\FTAWX.DLL]  [Microsoft Corporation, 5, 1, 2600, 2709]
[PID: 1676 / 于刚][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.1622]
    [c:\progra~1\couk\pbhx.dll]  [, 5, 0, 0, 4]
    [c:\progra~1\couk\ugmc.dll]  [ , 5, 0, 0, 4]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.Sys]  [N/A, ]
[PID: 1708 / 于刚][C:\Program Files\Jiangmin\AntiVirus\KVMonXP.kxp]  [Jiangmin Co.Ltd, 1, 0, 7, 516]
    [C:\WINDOWS\system32\HiveBase.dll]  [Jiangmin Co., Ltd., 1, 0, 7, 226]
    [C:\Program Files\Jiangmin\AntiVirus\lang\kvmonxp0804.lng]  [N/A, ]
    [c:\progra~1\couk\pbhx.dll]  [, 5, 0, 0, 4]
    [c:\progra~1\couk\ugmc.dll]  [ , 5, 0, 0, 4]
    [C:\Program Files\Jiangmin\Kernel\EngFace.dll]  [Jiangmin Co., Ltd., 2, 0, 7, 412]
    [C:\Program Files\Jiangmin\common\GUIEXT.DLL]  [Jiangmin Co.Ltd, 1, 0, 6, 1201]
    [C:\Program Files\Jiangmin\common\lang\guiext0804.lng]  [JiangMin Ltd., 7, 1, 0, 200]
    [C:\Program Files\Jiangmin\AntiVirus\KvInterpreter.dll]  [Jiangmin Co., Ltd., 10, 0, 7, 417]
    [C:\Program Files\Jiangmin\AntiVirus\VirusUpload.dll]  [, 2, 1, 7, 521]
    [C:\Program Files\Jiangmin\antivirus\TrojDie.dll]  [Jiangmin Co.Ltd, 10, 0, 6, 1222]
    [C:\Program Files\Jiangmin\AntiVirus\KVFileMon.dll]  [Jiangmin Co.Ltd, 1, 0, 7, 411]
    [C:\Program Files\Jiangmin\AntiVirus\KVNotifyUI.dll]  [Jiangmin Co.Ltd, 1.0.6.802]
    [C:\Program Files\Jiangmin\AntiVirus\lang\KVNotifyUI0804.lng]  [N/A, ]
    [C:\Program Files\Jiangmin\AntiVirus\KVMon.dll]  [Jiangmin Co., Ltd., 1, 0, 6, 1123]
    [C:\Program Files\Jiangmin\AntiVirus\lang\KVMon0804.lng]  [Jiangmin Co., Ltd., 1, 0, 6, 1019]
    [C:\Program Files\Jiangmin\AntiVirus\KVNetMon.dll]  [Jiangmin Co.Ltd, 1, 0, 6, 1107]
    [C:\Program Files\Jiangmin\AntiVirus\GuardPS.dll]  [Jiangmin Co., Ltd., 1, 0, 6, 1110]
    [C:\Program Files\Jiangmin\AntiVirus\KvGuardJsMenu.dll]  [Jiangmin Co Ltd, 10, 0, 0, 831]
    [C:\Program Files\Jiangmin\antivirus\KRegEx.dll]  [Jiangmin Co. Ltd., 10, 0, 6, 1214]
    [C:\Program Files\Jiangmin\AntiVirus\Kvwshm.dll]  [Jiangmin Co., Ltd., 10, 0, 6, 724]
    [C:\Program Files\Jiangmin\AntiVirus\lang\TrojDie0804.lng]  [, 10, 0, 6, 1221]
    [C:\Program Files\Jiangmin\common\ComUIPS.dll]  [Jiangmin Co.Ltd, 1.0.0.808]
    [C:\Program Files\Jiangmin\AntiVirus\PrivateMon.dll]  [Jiangmin Co.Ltd, 1, 0, 0, 909]
    [C:\Program Files\Jiangmin\AntiVirus\KsProtect.dll]  [Jiangmin Co. Ltd., 1, 0, 7, 326]
    [C:\Program Files\Jiangmin\common\KvTools.dll]  [Jiangmin Co. Ltd., 1, 0, 7, 323]
    [C:\Program Files\Jiangmin\common\IsysCall.dll]  [Jiangmin Co.,  Ltd., 1, 0, 7, 326]
    [C:\Program Files\Jiangmin\AntiVirus\ISysMon.dll]  [Jiangmin Co., Ltd., 1, 0, 7, 301]
    [C:\Program Files\Jiangmin\common\KregTrust.dll]  [Jiangmin Co., 10, 0, 6, 812]
    [C:\Program Files\Jiangmin\antivirus\KRegExMain.dll]  [Jiangmin Co.Ltd, 10, 0, 6, 1103]
    [C:\Program Files\Jiangmin\common\KvTxd.dll]  [Jiangmin Co., Ltd., 10.0.6.1106]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  [Yahoo! China, 3, 1, 0, 1028]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.Sys]  [N/A, ]
[PID: 1732 / SYSTEM][C:\WINDOWS\system32\92e31.exe]  [N/A, ]
[PID: 1832 / 于刚][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [c:\progra~1\couk\pbhx.dll]  [, 5, 0, 0, 4]
    [c:\progra~1\couk\ugmc.dll]  [ , 5, 0, 0, 4]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.Sys]  [N/A, ]
[PID: 1868 / SYSTEM][C:\WINDOWS\system32\nvsvc32.exe]  [NVIDIA Corporation, 6.14.10.8198]
    [c:\progra~1\couk\pbhx.dll]  [, 5, 0, 0, 4]
    [c:\progra~1\couk\ugmc.dll]  [ , 5, 0, 0, 4]
[PID: 200 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 344 / 于刚][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [c:\progra~1\couk\pbhx.dll]  [, 5, 0, 0, 4]
    [c:\progra~1\couk\ugmc.dll]  [ , 5, 0, 0, 4]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.Sys]  [N/A, ]
[PID: 1600 / 于刚][C:\WINDOWS\system32\rundll32.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\c91.dll]  [  , 1, 0, 0, 3]
    [c:\progra~1\couk\pbhx.dll]  [, 5, 0, 0, 4]
    [c:\progra~1\couk\ugmc.dll]  [ , 5, 0, 0, 4]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.Sys]  [N/A, ]
[PID: 1632 / 于刚][C:\WINDOWS\system32\DllHost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [c:\progra~1\couk\pbhx.dll]  [, 5, 0, 0, 4]
    [c:\progra~1\couk\ugmc.dll]  [ , 5, 0, 0, 4]
    [C:\Program Files\Jiangmin\common\ComUI.dll]  [Jiangmin Co,.Ltd, 1, 0, 7, 112]
    [C:\Program Files\Jiangmin\common\ComUIPS.dll]  [Jiangmin Co.Ltd, 1.0.0.808]
    [C:\WINDOWS\system32\HiveBase.dll]  [Jiangmin Co., Ltd., 1, 0, 7, 226]
    [C:\Program Files\Jiangmin\common\GUIEXT.DLL]  [Jiangmin Co.Ltd, 1, 0, 6, 1201]
    [C:\Program Files\Jiangmin\common\lang\guiext0804.lng]  [JiangMin Ltd., 7, 1, 0, 200]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  [Yahoo! China, 3, 1, 0, 1028]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.Sys]  [N/A, ]
[PID: 4020 / 于刚][C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe]  [RealNetworks, Inc., 7.0.0.1176]
    [C:\WINDOWS\system32\PNCRT.dll]  [Real Networks, Inc, 6.0.0.0]
    [C:\Program Files\Common Files\Real\Update_OB\athn3270.dll]  [RealNetworks, Inc., 7.0.0.1187]
    [C:\Program Files\Common Files\Real\Common\pnrs3260.dll]  [RealNetworks, Inc., 6.0.9.2068]
    [c:\progra~1\couk\pbhx.dll]  [, 5, 0, 0, 4]
    [c:\progra~1\couk\ugmc.dll]  [ , 5, 0, 0, 4]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.Sys]  [N/A, ]
[PID: 2908 / SYSTEM][C:\Program Files\Jiangmin\AntiVirus\kvsrvxp.exe]  [Jiangmin Co., Ltd., 10, 0, 7, 526]
    [c:\progra~1\couk\pbhx.dll]  [, 5, 0, 0, 4]
    [c:\progra~1\couk\ugmc.dll]  [ , 5, 0, 0, 4]

[C:\WINDOWS\system32\HiveBase.dll]  [Jiangmin Co., Ltd., 1, 0, 7, 226]
    [C:\Program Files\Jiangmin\AntiVirus\SvcSafe.dll]  [Jiangmin Co., Ltd., 10, 0, 7, 129]
    [C:\Program Files\Jiangmin\AntiVirus\lang\SvcSafe0804.lng]  [N/A, ]
    [C:\Program Files\Jiangmin\Kernel\Scan.dll]  [Jiangmin Co., Ltd., 2.0.7.119]
    [C:\Program Files\Jiangmin\Kernel\EngFace.dll]  [Jiangmin Co., Ltd., 2, 0, 7, 412]
    [C:\Program Files\Jiangmin\KVOL\autoUpdate.dll]  [Jiangmin Co.Ltd, 1, 0, 7, 3291]
    [C:\Program Files\Jiangmin\common\KvTxd.dll]  [Jiangmin Co., Ltd., 10.0.6.1106]
    [C:\Program Files\Jiangmin\AntiVirus\FileGuardNT.dll]  [Jiangmin Co., Ltd., 10, 2, 7, 413]
    [C:\Program Files\Jiangmin\AntiVirus\NetGuard.dll]  [Jiangmin Co., Ltd., 1, 0, 7, 530]
    [C:\Program Files\Jiangmin\AntiVirus\KvCkMail.dll]  [Jiangmin Co., Ltd., 10, 0, 7, 410]
    [C:\Program Files\Jiangmin\AntiVirus\lang\KvMailRes0804.lng]  [N/A, ]
    [C:\Program Files\Jiangmin\AntiVirus\KVAddrDb.dll]  [Jiangmin Co., Ltd., 1.0.0.1]
    [C:\Program Files\Jiangmin\AntiVirus\KvMailDb.dll]  [Jiangmin Co., Ltd., 10, 0, 6, 1103]
    [C:\Program Files\Jiangmin\AntiVirus\KsProtect.dll]  [Jiangmin Co. Ltd., 1, 0, 7, 326]
    [C:\Program Files\Jiangmin\common\KvTools.dll]  [Jiangmin Co. Ltd., 1, 0, 7, 323]
    [C:\Program Files\Jiangmin\common\IsysCall.dll]  [Jiangmin Co.,  Ltd., 1, 0, 7, 326]
    [C:\Program Files\Jiangmin\AntiVirus\ISysMon.dll]  [Jiangmin Co., Ltd., 1, 0, 7, 301]
    [C:\Program Files\Jiangmin\common\KregTrust.dll]  [Jiangmin Co., 10, 0, 6, 812]
    [C:\Program Files\Jiangmin\AntiVirus\GuardPS.dll]  [Jiangmin Co., Ltd., 1, 0, 6, 1110]
    [C:\Program Files\Jiangmin\KVOL\UpdatePlugIn.dll]  [Jiangmin Co., Ltd., 1, 0, 6, 831]
[PID: 916 / 于刚][C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe]  [Yahoo! China, 3, 2, 4, 1030]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  [Yahoo! China, 3, 1, 0, 1028]
    [c:\progra~1\couk\pbhx.dll]  [, 5, 0, 0, 4]
    [c:\progra~1\couk\ugmc.dll]  [ , 5, 0, 0, 4]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\yaLive.dll]  [yahoo! china, 3, 7, 4, 1133]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll]  [Yahoo! China, 3, 0, 3, 1012]
    [C:\Program Files\Yahoo!\Assistant\yNotifier.dll]  [yahoo! china, 3, 0, 4, 1004]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.Sys]  [N/A, ]
[PID: 2400 / 于刚][C:\Program Files\Yahoo!\Assistant\yAssistSe.exe]  [Yahoo! China, 3, 0, 9, 1012]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  [Yahoo! China, 3, 1, 0, 1028]
    [c:\progra~1\couk\pbhx.dll]  [, 5, 0, 0, 4]
    [c:\progra~1\couk\ugmc.dll]  [ , 5, 0, 0, 4]
    [C:\Program Files\Yahoo!\Assistant\shell\yAssecblk.dll]  [Yahoo! China, 3, 2, 1, 1029]
    [C:\Program Files\Yahoo!\Assistant\shell\yMenuInfo.dll]  [Yahoo! China, 3, 0, 1, 1001]
    [C:\Program Files\Yahoo!\Assistant\shell\yIEAngel.dll]  [Yahoo! China, 3, 0, 4, 1005]
    [C:\Program Files\Yahoo!\Assistant\shell\yAsMenu.dll]  [Yahoo! China, 3, 0, 4, 1006]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.Sys]  [N/A, ]
[PID: 1388 / 于刚][C:\WINDOWS\AutoUp.exe]  [, 1, 0, 0, 1]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  [Yahoo! China, 3, 1, 0, 1028]
    [c:\progra~1\couk\pbhx.dll]  [, 5, 0, 0, 4]
    [c:\progra~1\couk\ugmc.dll]  [ , 5, 0, 0, 4]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.Sys]  [N/A, ]
[PID: 2116 / 于刚][C:\Program Files\Jiangmin\common\KVUpload.exe]  [Jiangmin Co. Ltd., 10, 0, 6, 1019]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  [Yahoo! China, 3, 1, 0, 1028]
    [c:\progra~1\couk\pbhx.dll]  [, 5, 0, 0, 4]
    [c:\progra~1\couk\ugmc.dll]  [ , 5, 0, 0, 4]
    [C:\Program Files\Jiangmin\common\KVSend.dll]  [Jiangmin Co. Ltd., 9.0.0.825]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.Sys]  [N/A, ]
[PID: 3796 / 于刚][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  [Yahoo! China, 3, 1, 0, 1028]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\yscrblock.dll]  [Yahoo! China, 3, 0, 3, 1004]
    [c:\progra~1\couk\pbhx.dll]  [, 5, 0, 0, 4]
    [c:\progra~1\couk\ugmc.dll]  [ , 5, 0, 0, 4]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\yaLive.dll]  [yahoo! china, 3, 7, 4, 1133]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll]  [Yahoo! China, 3, 0, 3, 1012]
    [C:\WINDOWS\system32\kakatool.dll]  [Beijing Rising Technology Co., Ltd., 4.0.0.4]
    [C:\Program Files\Thunder Network\WebThunder\WebThunderBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 2, 10]
    [C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX]  [, 1, 0, 0, 1]
    [C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll]  [Yahoo! China, 3, 1, 1, 1012]
    [C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll]  [金泰丰(广州)科技有限公司, 2, 3, 0, 0]
    [C:\Program Files\Yahoo!\Assistant\Assist\yAngling.dll]  [yahoo! china, 3, 0, 6, 1008]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL]  [yahoo! china, 3, 0, 7, 1009]
    [C:\Program Files\Yahoo!\Assistant\Assist\yflashdl.dll]  [Yahoo! China, 3, 0, 5, 1019]
    [C:\WINDOWS\system32\9921.dll]  [TODO: <公司名>, 1.0.0.1]
    [C:\Program Files\Yahoo!\Assistant\Assist\yassist.dll]  [Yahoo! China, 3, 2, 0, 1025]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
    [C:\WINDOWS\system32\WINWB86.IME]  [Microsoft Corporation, 4.00.950]
    [C:\WINDOWS\system32\UNISPIM5.IME]  [北京紫光华宇软件股份有限公司, 5.0.0.5076]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.Sys]  [N/A, ]
    [C:\WINDOWS\system32\qhbpri.dll]  [N/A, ]
[PID: 2324 / 于刚][C:\Program Files\Thunder Network\WebThunder\WebThunder.exe]  [深圳市迅雷网络技术有限公司, 1, 9, 2, 147]
    [C:\Program Files\Thunder Network\WebThunder\RegisterDll.dll]  [Thunder Networking Technologies,LTD, 2, 13, 4, 58]
    [C:\Program Files\Thunder Network\WebThunder\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  [Yahoo! China, 3, 1, 0, 1028]

[c:\progra~1\couk\pbhx.dll]  [, 5, 0, 0, 4]
    [c:\progra~1\couk\ugmc.dll]  [ , 5, 0, 0, 4]
    [C:\Program Files\Thunder Network\WebThunder\TaskManager.dll]  [Thunder Networking Technologies,LTD, 1, 1, 2, 26]
    [C:\Program Files\Thunder Network\WebThunder\download_interface.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 46]
    [C:\Program Files\Thunder Network\WebThunder\stlport_vc646.dll]  [STLport Consulting, Inc., 4.6.2003.1031]
    [C:\Program Files\Thunder Network\WebThunder\asyn_dns.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 46]
    [C:\Program Files\Thunder Network\WebThunder\Inmedia\iEmbedShell.dll]  [　, 1, 0, 0, 19]
    [C:\Program Files\Thunder Network\WebThunder\InMedia\iEmbed10.dll]  [　, 3, 3, 1, 83]
    [C:\Program Files\Thunder Network\WebThunder\DownAndPlay\WebDownAndPlay.dll]  [xl, 1, 0, 0, 18]
    [C:\Program Files\Thunder Network\WebThunder\CacheServer.dll]  [, 1, 0, 0, 1]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.Sys]  [N/A, ]
[PID: 2224 / 于刚][C:\DOCUME~1\于刚\LOCALS~1\Temp\Rar$EX00.078\HA_HijackThisv2_PP\HiJackThis_v2.exe]  [, ]
    [C:\WINDOWS\system32\MSVBVM60.DLL]  [Microsoft Corporation, 6.00.9690]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  [Yahoo! China, 3, 1, 0, 1028]
    [c:\progra~1\couk\pbhx.dll]  [, 5, 0, 0, 4]
    [c:\progra~1\couk\ugmc.dll]  [ , 5, 0, 0, 4]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.Sys]  [N/A, ]
[PID: 3700 / 于刚][E:\应用程序\sreng2\SREngPS.EXE]  [N/A, ]
    [C:\WINDOWS\system32\qhbpri.dll]  [N/A, ]
    [C:\WINDOWS\system32\RAV009F.DAT]  [N/A, ]
    [C:\WINDOWS\system32\RAV008C.DAT]  [N/A, ]
    [C:\WINDOWS\system32\RAV00AE.DAT]  [N/A, ]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  [Yahoo! China, 3, 1, 0, 1028]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.Sys]  [N/A, ]
    [c:\progra~1\couk\pbhx.dll]  [, 5, 0, 0, 4]
    [c:\progra~1\couk\ugmc.dll]  [ , 5, 0, 0, 4]
    [E:\应用程序\sreng2\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]
[PID: 3704 / 于刚][C:\WINDOWS\explorer.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\qhbpri.dll]  [N/A, ]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  [Yahoo! China, 3, 1, 0, 1028]
    [c:\progra~1\couk\pbhx.dll]  [, 5, 0, 0, 4]
    [c:\progra~1\couk\ugmc.dll]  [ , 5, 0, 0, 4]
    [C:\WINDOWS\system32\nvcpl.dll]  [NVIDIA Corporation, 6.14.10.8198]
    [C:\WINDOWS\system32\NVRSZHC.DLL]  [NVIDIA Corporation, 6.14.10.8198]
    [C:\WINDOWS\system32\nvshell.dll]  [, ]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\yaLive.dll]  [yahoo! china, 3, 7, 4, 1133]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll]  [Yahoo! China, 3, 0, 3, 1012]
    [C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmt]  [N/A, ]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.Sys]  [N/A, ]
    [C:\WINDOWS\system32\mh104.dll]  [N/A, ]
    [C:\WINDOWS\system32\nwizwmgjs.dll]  [N/A, ]
    [C:\WINDOWS\system32\nwizzhuxians.dll]  [N/A, ]
    [C:\WINDOWS\system32\Ravasktao.dll]  [N/A, ]
    [C:\WINDOWS\system32\nwizqjsj.dll]  [N/A, ]
    [C:\WINDOWS\system32\nwizwlwzs.dll]  [N/A, ]
[PID: 2368 / 于刚][E:\应用程序\sreng2\ABC.EXE]  [Smallfrogs Studio, 2.5.16.900]
    [C:\WINDOWS\system32\qhbpri.dll]  [N/A, ]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  [Yahoo! China, 3, 1, 0, 1028]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.Sys]  [N/A, ]
    [c:\progra~1\couk\pbhx.dll]  [, 5, 0, 0, 4]
    [c:\progra~1\couk\ugmc.dll]  [ , 5, 0, 0, 4]


==================================
文件关联
.TXT  Error. [C:\WINDOWS\notepad.exe %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  Error. ["hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]


==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[E:\]
[AutoRun]
open=SysAuto.exe
shellexecute=SysAuto.exe
shell\打开(&O)\command=SysAuto.exe


==================================
HOSTS 文件
127.0.0.1      localhost


==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 1676, C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 1708, C:\PROGRAM FILES\JIANGMIN\ANTIVIRUS\KVMONXP.KXP]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1708, C:\PROGRAM FILES\JIANGMIN\ANTIVIRUS\KVMONXP.KXP]
特殊特权被允许： SeLoadDriverPrivilege [PID = 4020, C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\RNATHCHK.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2908, C:\PROGRAM FILES\JIANGMIN\ANTIVIRUS\KVSRVXP.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1388, C:\WINDOWS\AUTOUP.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 2116, C:\PROGRAM FILES\JIANGMIN\COMMON\KVUPLOAD.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2116, C:\PROGRAM FILES\JIANGMIN\COMMON\KVUPLOAD.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 2224, C:\DOCUME~1\于刚\LOCALS~1\TEMP\RAR$EX00.078\HA_HIJACKTHISV2_PP\HIJACKTHIS_V2.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2224, C:\DOCUME~1\于刚\LOCALS~1\TEMP\RAR$EX00.078\HA_HIJACKTHISV2_PP\HIJACKTHIS_V2.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 3700, E:\应用程序\SRENG2\SRENGPS.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3700, E:\应用程序\SRENG2\SRENGPS.EXE]


==================================
API HOOK
N/A

==================================
隐藏进程
    [1548] C:\WINDOWS\system32\usrinit.exe


[/CODE]

终于贴完了。。。。。。呼呼

没人回复吗～～～～！！！！！！

删除以下启动项
<Microsoft Autorun4><C:\WINDOWS\system32\dllhost32.exe> []
<RAV00AE><C:\WINDOWS\system32\RAV00AE.exe> []
<Microsoft Autorun10><C:\WINDOWS\system32\nwizwmgjs.exe> []
<RAV008C><C:\WINDOWS\system32\RAV008C.exe> []
<Microsoft Autorun9><C:\WINDOWS\system32\Ravasktao.exe> []
<Microsoft Autorun7><C:\WINDOWS\system32\nwizqjsj.exe> []
<Microsoft Autorun11><C:\WINDOWS\system32\nwizwlwzs.exe> []
<RAV009F><C:\WINDOWS\system32\RAV009F.exe> []
<AppInit_DLLs><qhbpri.dll> []（把括号中的qhbpri.dll清空即可）
<{A6011F8F-A7F8-49AA-9ADA-49127D43138F}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmt> []
<{754FB7D8-B8FE-4810-B363-A788CD060F1F}><C:\Program Files\Internet Explorer\PLUGINS\System64.Sys> []
<{26368135-64FA-BC34-DA32-DCF4FD431C92}><C:\WINDOWS\system32\qhbpri.dll> []
<N/A><C:\WINDOWS\system32\nwizzhuxians.exe> []
下面这些太无语了，应该是被劫持了，全部删除
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe]
<IFEO[360rpt.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe]
<IFEO[360Safe.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe]
<IFEO[360tray.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adam.exe]
<IFEO[adam.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvr.exe]
<IFEO[AgentSvr.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AppSvc32.exe]
<IFEO[AppSvc32.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe]
<IFEO[autoruns.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrssvc.exe]
<IFEO[avgrssvc.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe]
<IFEO[AvMonitor.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com]
<IFEO[avp.com]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe]
<IFEO[avp.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe]
<IFEO[CCenter.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe]
<IFEO[ccSvcHst.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FileDsty.exe]
<IFEO[FileDsty.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FTCleanerShell.exe]
<IFEO[FTCleanerShell.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe]
<IFEO[HijackThis.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe]
<IFEO[IceSword.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmo.exe]

<IFEO[iparmo.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe]
<IFEO[Iparmor.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isPwdSvc.exe]
<IFEO[isPwdSvc.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kabaload.exe]
<IFEO[kabaload.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KaScrScn.SCR]
<IFEO[KaScrScn.SCR]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMain.exe]
<IFEO[KASMain.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASTask.exe]
<IFEO[KASTask.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe]
<IFEO[KAV32.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe]
<IFEO[KAVDX.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.exe]
<IFEO[KAVPFW.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSetup.exe]
<IFEO[KAVSetup.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe]
<IFEO[KAVStart.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLnchr.exe]
<IFEO[KISLnchr.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMailMon.exe]
<IFEO[KMailMon.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMFilter.exe]
<IFEO[KMFilter.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe]
<IFEO[KPFW32.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32X.exe]
<IFEO[KPFW32X.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFWSvc.exe]
<IFEO[KPFWSvc.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe]
<IFEO[KRegEx.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\krepair.COM]
<IFEO[krepair.COM]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KsLoader.exe]
<IFEO[KsLoader.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe]
<IFEO[KWatch.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch9x.exe]
<IFEO[KWatch9x.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchX.exe]
<IFEO[KWatchX.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe]
<IFEO[loaddll.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe]
<IFEO[MagicSet.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe]
<IFEO[mcconsol.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmqczj.exe]
<IFEO[mmqczj.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmsk.exe]
<IFEO[mmsk.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVSetup.exe]
<IFEO[NAVSetup.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe]
<IFEO[nod32krn.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe]
<IFEO[nod32kui.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe]
<IFEO[PFW.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe]
<IFEO[PFWLiveUpdate.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSET.exe]
<IFEO[QHSET.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ras.exe]
<IFEO[Ras.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe]

<IFEO[Rav.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe]
<IFEO[RavMon.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe]
<IFEO[RavMonD.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe]
<IFEO[RavStub.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe]
<IFEO[RavTask.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegClean.exe]
<IFEO[RegClean.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe]
<IFEO[rfwcfg.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe]
<IFEO[RfwMain.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwProxy.exe]
<IFEO[rfwProxy.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe]
<IFEO[rfwsrv.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe]
<IFEO[RsAgent.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe]
<IFEO[Rsaupd.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe]
<IFEO[runiep.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safelive.exe]
<IFEO[safelive.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe]
<IFEO[scan32.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shcfg32.exe]
<IFEO[shcfg32.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmartUp.exe]
<IFEO[SmartUp.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREng.EXE]
<IFEO[SREng.EXE]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe]
<IFEO[symlcsvc.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SysSafe.exe]
<IFEO[SysSafe.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.exe]
<IFEO[TrojanDetector.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trojanwall.exe]
<IFEO[Trojanwall.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.kxp]
<IFEO[TrojDie.kxp]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe]
<IFEO[UIHost.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAgent.exe]
<IFEO[UmxAgent.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAttachment.exe]
<IFEO[UmxAttachment.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxCfg.exe]
<IFEO[UmxCfg.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxFwHlp.exe]
<IFEO[UmxFwHlp.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxPol.exe]
<IFEO[UmxPol.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpLive.EXE.exe]
<IFEO[UpLive.EXE.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WoptiClean.exe]
<IFEO[WoptiClean.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zxsweep.exe]
<IFEO[zxsweep.exe]><C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\C38E9D97.dat> [N/A]

删除以下服务
[10F33F8C / 10F33F8C][Stopped/Disabled]
<><N/A>
[Windows htzp RunThem / htzp][Running/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\PROGRA~1\couk\myeu.dll>< >
[ClipManage / MouTALS][Running/Auto Start]
<C:\WINDOWS\SYSTEM32\RUNDLLFOROUR.EXE C:\WINDOWS\SYSTEM32\WBEM\FTAWX.DLL,DllRegisterServer 1087><Microsoft Corporation>
[Fax 2Client / ms_2fax][Running/Auto Start]
<C:\WINDOWS\system32\92e31.exe><N/A>
[Remote Help Session Manager / Rasautol][Stopped/Auto Start]
<><N/A>
[Remote Debug Service / RemoteDbg][Stopped/Auto Start]
<C:\WINDOWS\system32\rundll32.exe RemoteDbg.dll,input><Microsoft Corporation>
[Network Engine / Trial][Running/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\clkea.dll><Microsoft Corporation>
[Win32 Display Driver / Win32DDS][Stopped/Auto Start]
<C:\WINDOWS\system32\rundll32.exe windds32.dll,input><Microsoft Corporation>
[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]
<C:\WINDOWS\system32\rundll32.exe windhcp.ocx,input><Microsoft Corporation>
[Telephonyl / WindowsDown][Stopped/Auto Start]
<><N/A>
[WMI Performance API / WMIApiSrv][Stopped/Auto Start]
<C:\WINDOWS\system32\rundll32.exe WMIApiSrv.dll,input><Microsoft Corporation>
[Wireless Service / WZCSRVC][Stopped/Auto Start]
<C:\WINDOWS\system32\rundll32.exe netsrvcs.dll,input><Microsoft Corporation>
删除以下驱动
[HidProcess / HidProcess][Stopped/System Start]
<system32\drivers\hprocess.sys><N/A>
[msqmx / msqmx][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\msqmx.sys><N/A>
[Netgroup Packet Filter / NPF][Stopped/Manual Start]
<system32\drivers\npf.sys><CACE Technologies>

并删除上述相应文件，以及下面这些
[c:\windows\system32\clkea.dll] [Microsoft Corporation, 5.1.2600.0]
[c:\progra~1\couk\myeu.dll] [ , 5, 0, 0, 4]
[c:\progra~1\couk\pbhx.dll] [, 5, 0, 0, 4]
[c:\progra~1\couk\ugmc.dll] [ , 5, 0, 0, 4]
[c:\progra~1\couk\rdjz.dll] [ , 5, 0, 0, 4]
[c:\progra~1\couk\iuaq.dll] [, 5, 0, 0, 2]
[C:\WINDOWS\system32\qhbpri.dll] [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\System64.Sys] [N/A, ]
[C:\WINDOWS\system32\RAV009F.DAT] [N/A, ]
[C:\WINDOWS\system32\RAV008C.DAT] [N/A, ]
[C:\WINDOWS\system32\RAV00AE.DAT] [N/A, ]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmt] [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\System64.Sys] [N/A, ]
[C:\WINDOWS\system32\mh104.dll] [N/A, ]
[C:\WINDOWS\system32\nwizwmgjs.dll] [N/A, ]
[C:\WINDOWS\system32\nwizzhuxians.dll] [N/A, ]
[C:\WINDOWS\system32\Ravasktao.dll] [N/A, ]
[C:\WINDOWS\system32\nwizqjsj.dll] [N/A, ]
[C:\WINDOWS\system32\nwizwlwzs.dll] [N/A, ]

用winrar删除E盘下autorun.inf SysAuto.exe