2006-11-09,18:40:17

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <MsnMsgr><"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background>  [Microsoft Corporation]
    <ctfmon.exe><ctfmon.exe>  [Microsoft Corporation]
    <Super Rabbit IEPro><C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD>  [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
    <run><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <Synchronization Manager><mobsync.exe /logon>  [(Verified)Microsoft Corporation]
    <OfficeScanNT Monitor><"C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow>  [Trend Micro Inc.]
    <MINI_MYDRIVERS><C:\Program Files\DriverDownload\DriverDownloader.exe>  [N/A]
    <SoundMan><SOUNDMAN.EXE>  [(Verified)Realtek Semiconductor Corp.]
    <DAEMON Tools-2052><"C:\Program Files\D-Tools\daemon.exe"  -lang 2052>  [DAEMON'S HOME]
    <NeroFilterCheck><C:\WINNT\system32\NeroCheck.exe>  [Ahead Software Gmbh]
    <NWTRAY><NWTRAY.EXE>  [Novell, Inc.]
    <InCD><C:\Program Files\Ahead\InCD\InCD.exe>  [Nero AG]
    <o3zwmr7p><RunDll32 "C:\WINNT\Downlo~1\rx7k.dll",Run>  [Microsoft Corporation]
    <SrvNet32><RunDll32 "C:\WINNT\Downlo~1\SearchNet\SrvNet32.dll",Run>  [中搜在线]
    <IEBarUp><RunDll32 "C:\WINNT\system32\IeBar.dll",Run>  [Microsoft Corporation]
    <Desktop><C:\WINNT\system32\rundll32.exe "C:\WINNT\system32\NTService32.dll" ,Run>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><C:\WINNT\system32\userinit.exe,>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <GinaDLL><NWGINA.DLL>  [Novell, Inc.]

==================================
启动文件夹
[Image Transfer]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Image Transfer.lnk --> C:\PROGRA~1\SONYCO~1\IMAGET~1\SonyTray.exe [N/A]><N>
[地址栏搜索]
  <C:\Documents and Settings\csc\「开始」菜单\程序\启动\地址栏搜索.lnk --> C:\WINNT\Downlo~1\SEARCH~1\ServeUp.exe [中搜在线]><N>

==================================
服务
[Ati HotKey Poller / Ati HotKey Poller]
  <C:\WINNT\system32\Ati2evxx.exe><N/A>
[ATI Smart / ATI Smart]
  <C:\WINNT\system32\ati2sgag.exe><>
[C-DillaCdaC11BA / C-DillaCdaC11BA]
  <C:\WINNT\system32\drivers\CDAC11BA.EXE><Macrovision>
[Logical Disk Manager Administrative Service / dmadmin]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[InCD Helper / InCDsrv]
  <C:\Program Files\Ahead\InCD\InCDsrv.exe><Nero AG>
[OfficeScanNT 实时扫描 / ntrtscan]
  <"C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe"><Trend Micro Inc.>
[OfficeScanNT 个人防火墙 / OfcPfwSvc]
  <"C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe"><Trend Micro Inc.>
[System Event Notification / SENS]
  <C:\WINNT\system32\svchost.exe -k netsvcs-->%SystemRoot%\system32\sens.dll><N/A>
[OfficeScanNT 侦听程序 / tmlisten]
  <"C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe"><Trend Micro Inc.>
[Portable Media Serial Number Service / WmdmPmSN]
  <C:\WINNT\System32\svchost.exe -k netsvcs-->C:\WINNT\system32\mspmsnsv.dll><Microsoft Corporation>

==================================
驱动程序
[699145 / 699145]
  <\SystemRoot\System32\drivers\699145.sys><N/A>
[ADProt / ADProt]
  <\SystemRoot\system32\drivers\ADProt.sys><腾讯科技（深圳）有限公司>
[Service for WDM 3D Audio Driver / ALCXSENS]
  <system32\drivers\ALCXSENS.SYS><Sensaura>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[ati2mtag / ati2mtag]
  <system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[CdaC15BA / CdaC15BA]
  <\??\C:\WINNT\system32\drivers\CDAC15BA.SYS><Macrovision Europe Ltd>
[Cdr4_2K / Cdr4_2K]
  <C:\WINNT\SYSTEM32\DRIVERS\Cdr4_2K.SYS><Roxio>
[Cdralw2k / Cdralw2k]
  <C:\WINNT\SYSTEM32\DRIVERS\Cdralw2k.SYS><Roxio>
[d347bus / d347bus]
  <\SystemRoot\system32\DRIVERS\d347bus.sys><>
[d347prt / d347prt]
  <\SystemRoot\System32\Drivers\d347prt.sys><>
[dmboot / dmboot]
  <System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio]
  <\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload]
  <\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[D-Link DFE-530TX PCI Fast Ethernet Adapter Driver / FETNDIS]
  <system32\DRIVERS\dlkfet5b.sys><D-Link>
[hardlock / hardlock]
  <\??\C:\WINNT\system32\drivers\hardlock.sys><Aladdin Knowledge Systems>
[Haspnt / Haspnt]
  <\??\C:\WINNT\system32\drivers\Haspnt.sys><Aladdin Knowledge Systems>
[Ahead InCDFat File System Driver / InCDFat]
  <\??\C:\WINNT\system32\Drivers\InCDFat.sys><Nero AG>
[InCD File System / InCDfs]
  <C:\WINNT\SYSTEM32\DRIVERS\InCDfs.SYS><Nero AG>
[InCDPass / InCDPass]
  <System32\DRIVERS\InCDPass.sys><Nero AG>
[InCD Reader / incdrm]
  <C:\WINNT\SYSTEM32\DRIVERS\incdrm.SYS><Nero AG>
[kmsinput / kmsinput]
  <\??\C:\WINNT\system32\drivers\kmsinput.sys><N/A>
[MASPINT / MASPINT]
  <C:\WINNT\SYSTEM32\DRIVERS\MASPINT.SYS><MicroStaff Co.,Ltd.>
[Novell Client for Windows / NetwareWorkstation]
  <system32\NetWare\nwfs.sys><Novell, Inc.>
[%ProductNICMDisplayName% / NICM]
  <system32\drivers\nicm.sys><Novell, Inc.>
[npkcrypt / npkcrypt]
  <\??\C:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[Novell DHCP Inform Client / NWDHCP]
  <system32\NetWare\nwdhcp.sys><N/A>
[Novell DNS Name Space Service Provider / NWDNS]
  <system32\NetWare\nwdns.sys><N/A>
[Novell Host File Name Space Service Provider / NWHOST]
  <system32\NetWare\NWHOST.sys><N/A>
[Novell SAP Name Space Provider / NWSAP]
  <system32\NetWare\NWSAP.sys><N/A>
[Novell NetWare IPX/SPX Transport Interface / NWSIPX32]
  <system32\NetWare\nwsipx32.sys><Novell, Inc.>
[Novell SLP Name Space Service Provider / NWSLP]
  <system32\NetWare\nwslp.sys><N/A>
[Novell Simple Naming Services / NWSNS]
  <system32\NetWare\NWSNS.sys><N/A>
[Padus ASPI Shell / pfc]
  <system32\drivers\pfc.sys><Padus, Inc.>
[Direct Parallel Link Driver / Ptilink]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Novell NetWare Resource Manager / RESMGR]
  <system32\NetWare\resmgr.sys><Novell, Inc.>
[Realtek RTL8139-based PCI Fast Ethernet Adapter NT Driver / rtl8139]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Novell Service Location / SRVLOC]
  <system32\NetWare\srvloc.sys><Novell, Inc.>
[Trend Micro Filter / TmFilter]
  <\??\C:\Program Files\Trend Micro\OfficeScan Client\TmFilter.sys><Trend Micro Inc.>
[Trend Micro VSAPI NT / VSApiNt]
  <\??\C:\Program Files\Trend Micro\OfficeScan Client\VSApiNt.sys><Trend Micro Inc.>
[w / w]
  <\SystemRoot\system32\drivers\add_sys.sys><>
[World Standard Teletext Codec / WSTCODEC]
  <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>

==================================

浏览器加载项
[IEMonitor Class]
  {08A312BB-5409-49FC-9347-54BB7D069AC6} <C:\WINNT\system32\deskipn.dll, >
[超级兔子上网精灵]
  {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} <C:\Program Files\Super Rabbit\MagicSet\haokanbar.dll, N/A>
[解霸]
  {367E0A21-8601-4986-9C9A-153BF5ACA118} <C:\HEROSOFT\Hero3000\MPLAYER.EXE, N/A>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, N/A>
[@msdxmLC.dll,-1@2052,电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[MSN]
  {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} <C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\zh-cn\msntb.dll, Microsoft Corporation>
[超级兔子上网精灵]
  {43869BB3-22FD-4F15-9B46-238106BA2F4E} <C:\Program Files\Super Rabbit\MagicSet\haokanbar.dll, N/A>
[ObjWinNTCheck Class]
  {00134F72-5284-44F7-95A8-52A619F70751} <C:\WINNT\Downloaded Program Files\WinNTChk.dll, Trend Micro Inc.>
[OfficeScan Corp Edition Web-Deployment SetupINICtrl Class]
  {08D75BB0-D2B5-11D1-88FC-0080C859833B} <C:\WINNT\Downloaded Program Files\OfficeScanSetupINI.dll, Trend Micro Inc.>
[OfficeScan Corp Edition Web-Deployment SetupCtrl Class]
  {08D75BC1-D2B5-11D1-88FC-0080C859833B} <C:\WINNT\Downloaded Program Files\OfficeScanSetup.dll, Trend Micro Inc.>
[OfficeScan Corp Edition Web-Deployment ObjRemoveCtrl Class]
  {5EFE8CB1-D095-11D1-88FC-0080C859833B} <C:\WINNT\Downloaded Program Files\OfficeScanRemoveCtrl.dll, Trend Micro Inc.>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[上传到QQ网络硬盘]
  <C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[导出到 Microsoft Excel(&x)]
  <res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
  <C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 176][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 204][\??\C:\WINNT\system32\csrss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 224][\??\C:\WINNT\system32\winlogon.exe]  [Microsoft Corporation, 5.00.2195.6970]
    [C:\WINNT\system32\NWGINA.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\CALWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\CLNWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\LOCWIN32.DLL]  [Novell, Inc., 5.4.20]
    [C:\WINNT\system32\NCPWIN32.dll]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\NETWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\CLXWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\NLS\ENGLISH\NWGINAR.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\Ati2evxx.dll]  [N/A, N/A]
[PID: 252][C:\WINNT\system32\services.exe]  [Microsoft Corporation, 5.00.2195.6700]
    [C:\WINNT\system32\dmserver.dll]  [VERITAS Software Corp., 2195.6605.297.3]
[PID: 264][C:\WINNT\system32\lsass.exe]  [Microsoft Corporation, 5.00.2195.6902]
    [C:\WINNT\system32\nwv1_0.dll]  [Novell, Inc., v4.71 (000217)]
[PID: 376][C:\WINNT\system32\Ati2evxx.exe]  [N/A, N/A]
[PID: 448][C:\WINNT\system32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\netware\NWWS2NDS.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\NETWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\CLNWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\LOCWIN32.DLL]  [Novell, Inc., 5.4.20]
    [C:\WINNT\system32\NCPWIN32.dll]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\netware\NWWS2SLP.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\NWSRVLOC.dll]  [Novell, Inc., v4.83]
[PID: 496][C:\WINNT\System32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
[PID: 548][C:\WINNT\system32\spoolsv.exe]  [Microsoft Corporation, 5.00.2195.7059]
    [C:\WINNT\system32\ZLMhp1.DLL]  [Zenographics, 5, 51, 1203, 0]
    [C:\WINNT\system32\ZLM.dll]  [Zenographics, Inc., 5, 50, 1416, 0]
    [C:\WINNT\system32\ZPJL.dll]  [Zenographics, Inc., 1, 0, 1410, 1]
    [C:\WINNT\system32\ZSPOOL.dll]  [Zenographics, Inc., 5, 51, 709, 0]
    [C:\WINNT\system32\spool\PRTPROCS\W32X86\IMFPrint.DLL]  [Zenographics, Inc., 5, 54, 330, 0]
    [C:\WINNT\system32\Imf32.dll]  [Zenographics, Inc., 5, 51, 405, 0]
    [C:\WINNT\system32\ZTAG32.dll]  [Zenographics, Inc., 5, 50, 1725, 0]
    [C:\WINNT\system32\netware\NWWS2NDS.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\NETWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\CLNWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\LOCWIN32.DLL]  [Novell, Inc., 5.4.20]
    [C:\WINNT\system32\NCPWIN32.dll]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\netware\NWWS2SLP.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\NWSRVLOC.dll]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\nwspool.dll]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\CALWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\CLXWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\NLS\ENGLISH\NWSPOOLR.DLL]  [Novell, Inc., 4.70]
[PID: 616][C:\WINNT\system32\drivers\CDAC11BA.EXE]  [Macrovision, 4.20.020]
[PID: 660][C:\Program Files\Ahead\InCD\InCDsrv.exe]  [Nero AG, 4, 3, 11, 6]
    [C:\Program Files\Common Files\Ahead\Lib\DriveLocker.dll]  [Ahead Software AG, 1, 0, 0, 17]
    [C:\Program Files\Ahead\InCD\incdshx.dll]  [Nero AG, 4, 3, 11, 6]
[PID: 800][C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe]  [Trend Micro Inc., 7.3.0.1028]
    [C:\Program Files\Trend Micro\OfficeScan Client\OfcDog.dll]  [Trend Micro Inc., 7.3.0.1028]
    [C:\Program Files\Trend Micro\OfficeScan Client\OfcPlugInAPI.dll]  [Trend Micro Inc., 7.3.0.1028]
    [C:\Program Files\Trend Micro\OfficeScan Client\TimeString.dll]  [N/A, N/A]
    [C:\Program Files\Trend Micro\OfficeScan Client\OfcPIPC.dll]  [N/A, N/A]
    [C:\Program Files\Trend Micro\OfficeScan Client\OfcPlugInMain.dll]  [Trend Micro Inc., 7.3.0.1028]
    [C:\Program Files\Trend Micro\OfficeScan Client\OfcPlugInTray.dll]  [Trend Micro Inc., 7.3.0.1028]
    [C:\Program Files\Trend Micro\OfficeScan Client\tmdbg20.dll]  [trend_company_name, 1, 0, 0, 1]
[PID: 340][C:\WINNT\system32\regsvc.exe]  [Microsoft Corporation, 5.00.2195.6701]
[PID: 836][C:\WINNT\system32\MSTask.exe]  [Microsoft Corporation, 4.71.2195.6920]
    [C:\WINNT\system32\netware\NWWS2NDS.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\NETWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\CLNWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\LOCWIN32.DLL]  [Novell, Inc., 5.4.20]
    [C:\WINNT\system32\NCPWIN32.dll]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\netware\NWWS2SLP.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\NWSRVLOC.dll]  [Novell, Inc., v4.83]
[PID: 892][C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe]  [Trend Micro Inc., 7.3.0.1028]
    [C:\Program Files\Trend Micro\OfficeScan Client\TMSOCK.dll]  [Trend Micro Inc., 7.3.0.1028]
    [C:\Program Files\Trend Micro\OfficeScan Client\loadhttp.dll]  [Trend Micro Inc., 7.3.0.1028]
    [C:\Program Files\Trend Micro\OfficeScan Client\OfcPlugInAPI.dll]  [Trend Micro Inc., 7.3.0.1028]
    [C:\Program Files\Trend Micro\OfficeScan Client\OfcPIPC.dll]  [N/A, N/A]
    [C:\Program Files\Trend Micro\OfficeScan Client\libTmCAV.dll]  [Trend Micro Inc., 7.3.0.1028]
    [C:\Program Files\Trend Micro\OfficeScan Client\Pwd.dll]  [Trend Micro Inc., 7.3.0.1028]
    [C:\Program Files\Trend Micro\OfficeScan Client\OfcDog.dll]  [Trend Micro Inc., 7.3.0.1028]
    [C:\WINNT\system32\netware\NWWS2NDS.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\NETWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\CLNWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\LOCWIN32.DLL]  [Novell, Inc., 5.4.20]
    [C:\WINNT\system32\NCPWIN32.dll]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\netware\NWWS2SLP.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\NWSRVLOC.dll]  [Novell, Inc., v4.83]
    [C:\Program Files\Trend Micro\OfficeScan Client\tmdbg20.dll]  [trend_company_name, 1, 0, 0, 1]
    [C:\Program Files\Trend Micro\OfficeScan Client\OfcPlugInMain.dll]  [Trend Micro Inc., 7.3.0.1028]
    [C:\Program Files\Trend Micro\OfficeScan Client\OfcPlugInTray.dll]  [Trend Micro Inc., 7.3.0.1028]
    [C:\WINNT\system32\NOVNPNT.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\CALWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\CLXWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\MAPBASE.dll]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\NWSHLXNT.dll]  [N/A, N/A]
    [C:\WINNT\system32\NLS\ENGLISH\MAPBASER.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\NLS\ENGLISH\NWSHLXNR.DLL]  [N/A, N/A]
    [C:\WINNT\system32\NLS\ENGLISH\NOVNPNTR.DLL]  [Novell, Inc., v4.83]
    [C:\Program Files\Trend Micro\OfficeScan Client\TmUpdate.dll]  [Trend Micro Inc., 2,63,0,1007]

[PID: 936][C:\WINNT\System32\WBEM\WinMgmt.exe]  [Microsoft Corporation, 1.50.1085.0100]
[PID: 972][C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe]  [Trend Micro Inc., 7.3.0.1028]
    [C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwCommon.dll]  [N/A, N/A]
    [C:\Program Files\Trend Micro\OfficeScan Client\ZLib.dll]  [Trend Micro Inc., 1.31.0.1708]
    [C:\Program Files\Trend Micro\OfficeScan Client\OfcPIPC.dll]  [N/A, N/A]
    [C:\Program Files\Trend Micro\OfficeScan Client\tmdbg20.dll]  [trend_company_name, 1, 0, 0, 1]
    [C:\Program Files\Trend Micro\OfficeScan Client\tmCfwApi.dll]  [Trend Micro Inc., 1.2.0.1020]
[PID: 796][C:\WINNT\TEMP\CP8DFC.EXE]  [N/A, N/A]
[PID: 1208][C:\WINNT\system32\Ati2evxx.exe]  [N/A, N/A]
[PID: 1308][C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe]  [Trend Micro Inc., 7.3.0.1028]
    [C:\Program Files\Trend Micro\OfficeScan Client\loadhttp.dll]  [Trend Micro Inc., 7.3.0.1028]
    [C:\Program Files\Trend Micro\OfficeScan Client\Pwd.dll]  [Trend Micro Inc., 7.3.0.1028]
    [C:\Program Files\Trend Micro\OfficeScan Client\OfcPlugInAPI.dll]  [Trend Micro Inc., 7.3.0.1028]
    [C:\Program Files\Trend Micro\OfficeScan Client\OfcPIPC.dll]  [N/A, N/A]
    [C:\Program Files\Trend Micro\OfficeScan Client\TimeString.dll]  [N/A, N/A]
    [C:\Program Files\Trend Micro\OfficeScan Client\ntmonres.dll]  [Trend Micro Inc., 7.3.0.1028]
    [C:\Program Files\Trend Micro\OfficeScan Client\OfcPlugInMain.dll]  [Trend Micro Inc., 7.3.0.1028]
    [C:\Program Files\Trend Micro\OfficeScan Client\OfcPlugInTray.dll]  [Trend Micro Inc., 7.3.0.1028]
    [C:\Program Files\Trend Micro\OfficeScan Client\tmdbg20.dll]  [trend_company_name, 1, 0, 0, 1]
    [C:\WINNT\system32\netware\NWWS2NDS.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\NETWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\CLNWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\LOCWIN32.DLL]  [Novell, Inc., 5.4.20]
    [C:\WINNT\system32\NCPWIN32.dll]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\netware\NWWS2SLP.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\NWSRVLOC.dll]  [Novell, Inc., v4.83]
[PID: 1316][C:\WINNT\SOUNDMAN.EXE]  [Realtek Semiconductor Corp., 5.1.0.26]
[PID: 1364][C:\WINNT\system32\NWTRAY.EXE]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\NOVNPNT.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\CALWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\CLNWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\LOCWIN32.DLL]  [Novell, Inc., 5.4.20]
    [C:\WINNT\system32\NCPWIN32.dll]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\NETWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\CLXWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\MAPBASE.dll]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\NWSHLXNT.dll]  [N/A, N/A]
    [C:\WINNT\system32\NLS\ENGLISH\MAPBASER.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\NLS\ENGLISH\NWSHLXNR.DLL]  [N/A, N/A]
    [C:\WINNT\system32\NLS\ENGLISH\NOVNPNTR.DLL]  [Novell, Inc., v4.83]
[PID: 1412][C:\Program Files\Ahead\InCD\InCD.exe]  [Nero AG, 4, 3, 11, 6]
    [C:\Program Files\Ahead\InCD\InCdApi.dll]  [Nero AG, 4, 3, 11, 6]
    [C:\WINNT\system32\AcSignIcon.dll]  [Autodesk, 16.0.0.86]
    [C:\Program Files\Common Files\Ahead\Lib\DriveLocker.dll]  [Ahead Software AG, 1, 0, 0, 17]
    [C:\Program Files\Ahead\InCD\incdshx.dll]  [Nero AG, 4, 3, 11, 6]
[PID: 1444][C:\Program Files\MSN Messenger\MsnMsgr.Exe]  [Microsoft Corporation, 7.0.0816]
    [C:\WINNT\system32\netware\NWWS2NDS.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\NETWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\CLNWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\LOCWIN32.DLL]  [Novell, Inc., 5.4.20]
    [C:\WINNT\system32\NCPWIN32.dll]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\netware\NWWS2SLP.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\NWSRVLOC.dll]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\msdmo.dll]  [N/A, N/A]
[PID: 1452][C:\WINNT\system32\ctfmon.exe]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[PID: 1468][C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe]  [N/A, N/A]
    [C:\Program Files\Sony Corporation\Image Transfer\SonyTray.dll]  [N/A, N/A]
[PID: 1540][C:\WINNT\system32\taskmgr.exe]  [Microsoft Corporation, 5.00.2195.6620]
    [C:\WINNT\system32\FOURIER_M1.IME]  [北京紫光华宇软件股份有限公司, 4.0.0.5001]
    [C:\WINNT\system32\AcSignIcon.dll]  [Autodesk, 16.0.0.86]
[PID: 1260][C:\WINNT\explorer.exe]  [Microsoft Corporation, 5.00.3700.6690]
    [C:\WINNT\system32\AcSignIcon.dll]  [Autodesk, 16.0.0.86]
    [C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll]  [Autodesk, 16.0.0.86]
    [C:\WINNT\system32\NOVNPNT.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\CALWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\CLNWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\LOCWIN32.DLL]  [Novell, Inc., 5.4.20]
    [C:\WINNT\system32\NCPWIN32.dll]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\NETWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\CLXWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\MAPBASE.dll]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\NWSHLXNT.dll]  [N/A, N/A]
    [C:\WINNT\system32\NLS\ENGLISH\MAPBASER.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\NLS\ENGLISH\NWSHLXNR.DLL]  [N/A, N/A]
    [C:\WINNT\system32\NLS\ENGLISH\NOVNPNTR.DLL]  [Novell, Inc., v4.83]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, N/A]
    [C:\WINNT\Downloaded Program Files\859845\ExDLL.dll]  [, 1, 0, 0, 1]
    [C:\WINNT\system32\WebPageParser.dll]  [N/A, N/A]
    [C:\WINNT\system32\Charset.dll]  [N/A, N/A]
    [C:\WINNT\system32\CreateDomTree.dll]  [N/A, N/A]
    [C:\WINNT\Downloaded Program Files\859845\fshook.dll]  [, 1, 0, 0, 1]
    [C:\WINNT\system32\netware\NWWS2NDS.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\netware\NWWS2SLP.DLL]  [Novell, Inc., v4.83]

[C:\WINNT\system32\NWSRVLOC.dll]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\ALSNDMGR.CPL]  [Realtek Semiconductor Corp., 2.2.25]
    [C:\WINNT\system32\styleman.cpl]  [Autodesk, Inc., 8.0.16.86]
    [C:\WINNT\system32\plotman.cpl]  [Autodesk, Inc., 8.0.16.86]
[PID: 1608][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2800.1106]
    [C:\WINNT\system32\AcSignIcon.dll]  [Autodesk, 16.0.0.86]
    [C:\WINNT\system32\deskipn.dll]  [, 1, 0, 0, 1]
    [C:\WINNT\system32\netware\NWWS2NDS.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\NETWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\CLNWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\LOCWIN32.DLL]  [Novell, Inc., 5.4.20]
    [C:\WINNT\system32\NCPWIN32.dll]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\netware\NWWS2SLP.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\NWSRVLOC.dll]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\Macromed\Flash\Flash9.ocx]  [Adobe Systems, Inc., 9,0,16,0]
    [C:\WINNT\system32\NOVNPNT.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\CALWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\CLXWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\MAPBASE.dll]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\NWSHLXNT.dll]  [N/A, N/A]
    [C:\WINNT\system32\NLS\ENGLISH\MAPBASER.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\NLS\ENGLISH\NWSHLXNR.DLL]  [N/A, N/A]
    [C:\WINNT\system32\NLS\ENGLISH\NOVNPNTR.DLL]  [Novell, Inc., v4.83]
[PID: 1688][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2800.1106]
    [C:\WINNT\system32\AcSignIcon.dll]  [Autodesk, 16.0.0.86]
    [C:\WINNT\system32\deskipn.dll]  [, 1, 0, 0, 1]
    [C:\WINNT\system32\netware\NWWS2NDS.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\NETWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\CLNWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\LOCWIN32.DLL]  [Novell, Inc., 5.4.20]
    [C:\WINNT\system32\NCPWIN32.dll]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\netware\NWWS2SLP.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\NWSRVLOC.dll]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\NOVNPNT.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\CALWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\CLXWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\MAPBASE.dll]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\NWSHLXNT.dll]  [N/A, N/A]
    [C:\WINNT\system32\NLS\ENGLISH\MAPBASER.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\NLS\ENGLISH\NWSHLXNR.DLL]  [N/A, N/A]
    [C:\WINNT\system32\NLS\ENGLISH\NOVNPNTR.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\Macromed\Flash\Flash9.ocx]  [Adobe Systems, Inc., 9,0,16,0]
    [C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll]  [Autodesk, 16.0.0.86]
[PID: 1148][C:\Program Files\Ringz Studio\Storm Codec\mplayerc.exe]  [Gabest, 6, 4, 8, 3]
    [C:\WINNT\system32\msdmo.dll]  [N/A, N/A]
    [C:\Program Files\Common Files\Ahead\DSFilter\NDParser.ax]  [Nero AG, 3, 2, 0, 0]
    [C:\WINNT\system32\ffdshow.ax]  [N/A, 1, 0, 0, 1]
    [C:\Program Files\Ringz Studio\Storm Codec\Codecs\TTL2Dec.dll]  [N/A, N/A]
    [C:\Program Files\Ringz Studio\Storm Codec\Codecs\VSFilter.dll]  [Gabest, 1, 0, 0, 9]
    [C:\Program Files\Common Files\Ahead\DSFilter\NeVideo.ax]  [Nero AG, 3, 2, 0, 0]
    [C:\Program Files\Common Files\Ahead\Lib\AdvrCntr.dll]  [Ahead Software AG, 1,2,2, 2279]
    [C:\Program Files\Ringz Studio\Storm Codec\Codecs\mpeg2dmx.ax]  [Moonlight Cordless Ltd., 3, 1, 190, 41018]
    [C:\Program Files\Ringz Studio\Storm Codec\Codecs\RMSplt.ax]  [Gabest, 1, 0, 0, 9]
    [C:\Program Files\Common Files\Ahead\DSFilter\NeAudio.ax]  [Ahead Software AG and its licensors, 3, 2, 0, 0]
    [C:\Program Files\Ringz Studio\Storm Codec\Codecs\MP4Demux.ax]  [Moonlight Cordless Ltd., 1, 0, 5, 41110]
    [C:\Program Files\Ringz Studio\Storm Codec\Codecs\AMRDec.ax]  [Moonlight Cordless Ltd, 0, 0, 1, 40816]
    [C:\Program Files\PIXELA\ImageMixer\MPG2SPPX.AX]  [PiXELA Corp., 1, 0, 1, 4]
    [C:\Program Files\Ringz Studio\Storm Codec\Codecs\OGGSplt.ax]  [Gabest, 1, 0, 0, 0]
[PID: 1340][C:\WINNT\system32\mshta.exe]  [Microsoft Corporation, 6.00.2800.1106]
    [C:\WINNT\system32\AcSignIcon.dll]  [Autodesk, 16.0.0.86]
[PID: 1712][D:\tools\sreng最新版\SREng\SREng.exe]  [Smallfrogs Studio, 2.2.6.605]
    [C:\WINNT\system32\netware\NWWS2NDS.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\NETWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\CLNWIN32.DLL]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\LOCWIN32.DLL]  [Novell, Inc., 5.4.20]
    [C:\WINNT\system32\NCPWIN32.dll]  [Novell, Inc., 5.5.8]
    [C:\WINNT\system32\netware\NWWS2SLP.DLL]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\NWSRVLOC.dll]  [Novell, Inc., v4.83]
    [C:\WINNT\system32\AcSignIcon.dll]  [Autodesk, 16.0.0.86]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  Error. [AutoCADScriptFile]
.CHM  OK. ["C:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  Error. [超级解霸3000]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================

。。。

这个我着急呢!

结束进程
C:\WINNT\TEMP\CP8DFC.EXE


重新启动电脑，自动检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式(Safe Mode)进入Windows。）


运行(双击)SRENG2，点“启动项目，服务，点“驱动程序”
勾选“隐藏已认证的微软项目”选中病毒服务
699145
w
选择“删除服务”
点“设置”选择“否”


关闭所有浏览窗口以及一些不必要的程序
运行SREng2,使用“启动项目”－－注册表－－选中以下的项删除
C:\WINNT\system32\rundll32.exe "C:\WINNT\system32\NTService32.dll
C:\Program Files\DriverDownload\DriverDownloader.exe
RunDll32 "C:\WINNT\Downlo~1\rx7k.dll
RunDll32 "C:\WINNT\Downlo~1\SearchNet\SrvNet32.dll
RunDll32 "C:\WINNT\system32\IeBar.dll



显示隐藏文件
删除：
C:\WINNT\System32\drivers\699145.sys
C:\WINNT\system32\drivers\add_sys.sys
C:\WINNT\system32\NTService32.dll
C:\Program Files\DriverDownload\DriverDownloader.exe
C:\WINNT\Downlo~1\rx7k.dll
C:\WINNT\Downlo~1\SearchNet\SrvNet32.dll
C:\WINNT\system32\IeBar.dll



卸载掉:中搜在线

秋天。有几个模糊的地方。
1。RunDll32 "C:\WINNT\Downlo~1\SearchNet\SrvNet32.dll
删除不了。我是在CMD下删除的。提示拒绝访问。还有这个也删除不了 C:\WINNT\system32\NTService32.dll 
2。找不到
C:\Program Files\DriverDownload\DriverDownloader.exe
699145
w服务。

SrvNet32.dll
这个病毒的查杀办法,运行msconfig,察看启动里面是不是有这个病毒相关的启动,还有搞不清楚的,最好都去掉,

然后进入注册表查找病毒关键字的键值,也删除,删之前做好备份,

最后重启进入安全模式查找病毒文件删除,或者进入dos删除,

这样几步下来应该差不多了,实在不行只能重新安装系统了

还不至于到这个份上！