[CODE]

2007-02-17,21:32:24

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 1 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe>  [(Verified)Microsoft Corporation]
    <MsnMsgr><"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background>  [Microsoft Corporation]
    <MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background>  [(Verified)Microsoft Corporation]
    <eMuleAutoStart><D:\eMule\emule.exe -AutoStart>  [http://www.emule-project.net]
    <eMuleAutoStart><D:\eMule\emule.exe -AutoStart>  [http://www.emule-project.net]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Corporation]
    <PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Corporation]
    <PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Corporation]
    <IMSCMig><rem C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload>  [(Verified)Microsoft Corporation]
    <NvCplDaemon><rem RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup>  [(Verified)NVIDIA Corporation]
    <yassistse><"C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe">  [Yahoo!]
    <HP Software Update><"C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe">  [Hewlett-Packard]
    <HP Component Manager><"C:\Program Files\HP\hpcoretech\hpcmpmgr.exe">  [Hewlett-Packard Company]
    <HPDJ Taskbar Utility><C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe>  [(Verified)HP]
    <DeviceDiscovery><C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe>  [Hewlett-Packard]
    <PCSuiteTrayApplication><C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup>  [Nokia]
    <runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe>  [Beijing Rising Technology Co., Ltd.]
    <upxdnd><C:\DOCUME~1\cxm.CSX\LOCALS~1\Temp\upxdnd.exe>  [N/A]
    <Local Security Authority Service><C:\WINDOWS\System32\Isass.exe>  [N/A]
    <AutoRun><C:\Program Files\Internet Explorer\loadie.EXE>  [N/A]
    <DllRunning><rundll32.exe "C:\WINDOWS\System32\leyxwxhe.dll",setvm>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><EXPLORER.EXE>  [(Verified)Microsoft Corporation]
    <Userinit><C:\WINDOWS\System32\Userinit.exe>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{F6292B16-443E-4EF2-AFC0-01533A7ACD27}><C:\WINDOWS\system32\pmkhifg.dll>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ddaya]
    <WinlogonNotify: ddaya><C:\WINDOWS\System32\ddaya.dll>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\pmkhifg]
    <WinlogonNotify: pmkhifg><pmkhifg.dll>  [N/A]

==================================
启动文件夹
[木马杀客2007]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\木马杀客2007.Lnk --> C:\PROGRA~1\木马杀客\mmsk.exe [N/A]><N>

==================================
服务
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Local Debug Manager / Local Debug Manager][Running/Auto Start]
  <"C:\WINDOWS\system32\spoolvc.exe"><N/A>
[NVIDIA Driver Helper Service / NVSvc][Running/Auto Start]
  <C:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation>
[P4P Service / P4P Service][Running/Auto Start]
  <C:\Program Files\Common Files\Sogou PXP\p2psvr.exe><Sohu.com Inc.>
[ServiceLayer / ServiceLayer][Running/Manual Start]
  <"C:\Program Files\PC Connectivity Solution\ServiceLayer.exe"><Nokia.>
[Windows AII / SVCH0ST.EXE][Stopped/Auto Start]
  <C:\WINDOWS\SVCH0ST><N/A>
[Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\System32\mspmsnsv.dll><Microsoft Corporation>
[NeroCheck / NeroCheck][Running/Auto Start]
  <C:\WINDOWS\NeroCheck.exe><N/A>

==================================
驱动程序
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Stopped/Manual Start]
  <system32\drivers\ac97intc.sys><Intel Corporation>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
  <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[D-Link DFE-530TX PCI Fast Ethernet Adapter Driver / FETNDIS][Running/Manual Start]
  <System32\DRIVERS\dlkfet5b.sys><D-Link>
[HOOKAPI / HOOKAPI][Stopped/Manual Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\HOOKAPI.SYS><瑞星软件有限公司>
[Nokia USB Generic / Nokia USB Generic][Stopped/Manual Start]
  <system32\drivers\nmwcdc.sys><Nokia>
[Nokia USB Modem / Nokia USB Modem][Stopped/Manual Start]
  <system32\drivers\nmwcdcm.sys><Nokia>
[Nokia USB Phone Parent / Nokia USB Phone Parent][Stopped/Manual Start]
  <system32\drivers\nmwcd.sys><Nokia>
[Netgroup Packet Filter / NPF][Running/Manual Start]
  <system32\drivers\npf.sys><CACE Technologies>
[nv / nv][Running/Manual Start]
  <System32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
  <\SystemRoot\System32\drivers\RsBoot.sys><Beijing Rising>
[Secdrv / Secdrv][Stopped/Manual Start]
  <System32\DRIVERS\secdrv.sys><N/A>
[squellabcd / squellabcd][Running/Manual Start]
  <2 - 系统找不到指定的文件。
><N/A>

==================================
浏览器加载项
[雅虎助手]
  {406F94F0-504F-4a40-8DFD-58B0666ABEBD} <, N/A>
[apronA Class]
  {557B9038-FC87-453C-8B08-32D85F46EAC4} <C:\WINDOWS\System32\Searchr.dll, >
[]
  {D7206A49-4026-48B4-9BFD-D1DEBA2A3FED} <C:\WINDOWS\System32\ddaya.dll, N/A>
[]
  {E03C740E-BB24-4d3c-B92A-6F84DE1DD99C} <C:\WINDOWS\System32\gcvuxjqy.dll, N/A>
[]
  {F6292B16-443E-4EF2-AFC0-01533A7ACD27} <C:\WINDOWS\system32\pmkhifg.dll, N/A>
[kele8]
  {84920E5F-3788-49cd-A274-E365578DF174} <http://www.kele8.com/, N/A>
[信息检索(&R)]
  {92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[金山快译(&K)]
  {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} <C:\PROGRA~1\Kingsoft\FASTAI~1\IEBand.dll, >
[雅虎助手]
  {406F94F0-504F-4a40-8DFD-58B0666ABEBD} <, N/A>
[MsnMessengerSetupDownloadControl Class]
  {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} <C:\WINDOWS\Downloaded Program Files\MsnMessengerSetupDownloader.ocx, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash8a.ocx, Macromedia, Inc.>
[导出到 Microsoft Office Excel(&X)]
  <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[雅虎搜索]
  <res://C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasbar.dll/246, N/A>

==================================
正在运行的进程
[PID: 536][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 600][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 624][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\ddaya.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\FOURI_M3.IME]  [北京紫光华宇软件股份有限公司, 4.0.0.5027]
    [C:\WINDOWS\system32\pmkhifg.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\awtqrol.dll]  [N/A, N/A]
[PID: 676][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 688][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 868][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 968][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1040][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1244][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1368][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [C:\WINDOWS\system32\hpzsnt09.dll]  [HP, 2.236.4.0]
[PID: 1540][C:\WINDOWS\system32\spoolvc.exe]  [N/A, N/A]
[PID: 1600][C:\WINDOWS\System32\nvsvc32.exe]  [NVIDIA Corporation, 6.14.10.4523]
[PID: 1628][C:\Program Files\Common Files\Sogou PXP\p2psvr.exe]  [Sohu.com Inc., 2, 0, 0, 28]
    [C:\Program Files\Sogou PXP\vodsvr.dll]  [Sohu.com Inc., 2, 3, 0, 1]
    [C:\Program Files\Sogou PXP\pxpnet.dll]  [Sohu.com Inc., 1, 0, 0, 9]
    [C:\Program Files\Sogou PXP\p2pclient.dll]  [Sohu.com Inc., 2, 9, 1, 4]
[PID: 1720][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 316][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\FOURI_M3.IME]  [北京紫光华宇软件股份有限公司, 4.0.0.5027]
    [C:\WINDOWS\system32\pmkhifg.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\ddaya.dll]  [N/A, N/A]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
    [C:\DOCUME~1\cxm.CSX\LOCALS~1\Temp\upxdnd.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\Searchr.dll]  [, 1, 0, 0, 1]
    [C:\WINDOWS\System32\gcvuxjqy.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\awtqrol.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\leyxwxhe.dll]  [N/A, N/A]
[PID: 560][C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe]  [Hewlett-Packard, 1, 0, 0, 2]
    [C:\WINDOWS\System32\FOURI_M3.IME]  [北京紫光华宇软件股份有限公司, 4.0.0.5027]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 568][C:\Program Files\HP\hpcoretech\hpcmpmgr.exe]  [Hewlett-Packard Company, 2.1.1]
    [C:\WINDOWS\System32\FOURI_M3.IME]  [北京紫光华宇软件股份有限公司, 4.0.0.5027]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 580][C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe]  [HP, 2.236.4.0]
    [C:\WINDOWS\System32\spool\drivers\w32x86\3\HPZR3209.dll]  [HP, 2.236.4.0]
    [C:\WINDOWS\System32\FOURI_M3.IME]  [北京紫光华宇软件股份有限公司, 4.0.0.5027]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 588][C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe]  [Hewlett-Packard, 1, 0, 0, 1]
    [C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpodvd08.dll]  [Hewlett-Packard, 2, 0, 2, 2]
    [C:\WINDOWS\System32\FOURI_M3.IME]  [北京紫光华宇软件股份有限公司, 4.0.0.5027]
    [C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqcxm08.dll]  [Hewlett-Packard Co., 4.2.0.127]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 584][C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe]  [Nokia, 6, 82, 70, 1]
    [C:\Program Files\PC Connectivity Solution\ConnAPI.DLL]  [Nokia., 6, 82, 72, 2]
    [C:\Program Files\Nokia\Nokia PC Suite 6\PCSCM.dll]  [Nokia, 6, 82, 77, 0]
    [C:\Program Files\Nokia\Nokia PC Suite 6\PCSSupportSetup.DLL]  [Nokia, 6, 82, 20, 2]
    [C:\Program Files\PC Connectivity Solution\ConfServer.dll]  [Nokia, 6, 82, 31, 0]
    [C:\Program Files\Nokia\Nokia PC Suite 6\Lang\LaunchApplication_chi-sc.NLR]  [Nokia, 6, 82, 69, 2]
    [C:\WINDOWS\System32\FOURI_M3.IME]  [北京紫光华宇软件股份有限公司, 4.0.0.5027]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 280][C:\Program Files\Rising\AntiSpyware\runiep.exe]  [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6]
    [C:\Program Files\Rising\AntiSpyware\iep_ctrl.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
    [C:\WINDOWS\System32\FOURI_M3.IME]  [北京紫光华宇软件股份有限公司, 4.0.0.5027]
[PID: 928][C:\WINDOWS\System32\Isass.exe]  [N/A, N/A]
[PID: 1024][C:\WINDOWS\System32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\FOURI_M3.IME]  [北京紫光华宇软件股份有限公司, 4.0.0.5027]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 1180][C:\Program Files\PC Connectivity Solution\ServiceLayer.exe]  [Nokia., 6, 82, 69, 3]
    [C:\Program Files\PC Connectivity Solution\NclTools.dll]  [Nokia, 6, 82, 26, 3]
    [C:\WINDOWS\System32\FOURI_M3.IME]  [北京紫光华宇软件股份有限公司, 4.0.0.5027]
    [C:\Program Files\PC Connectivity Solution\Transports\NCLIrDAMM.dll]  [Nokia Corp., 6, 82, 31, 0]
    [C:\Program Files\PC Connectivity Solution\Transports\NCLRSMM.dll]  [Nokia Corp., 6, 82, 39, 1]
    [C:\Program Files\PC Connectivity Solution\Transports\NCLUSBMM.dll]  [Nokia Corp., 6, 82, 48, 0]
[PID: 1716][C:\WINDOWS\System32\conime.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\FOURI_M3.IME]  [北京紫光华宇软件股份有限公司, 4.0.0.5027]
[PID: 2000][C:\Progra~1\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\FOURI_M3.IME]  [北京紫光华宇软件股份有限公司, 4.0.0.5027]
    [C:\WINDOWS\System32\Searchr.dll]  [, 1, 0, 0, 1]
    [C:\WINDOWS\System32\ddaya.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\gcvuxjqy.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\pmkhifg.dll]  [N/A, N/A]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 3024][C:\WINDOWS\System32\conime.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\FOURI_M3.IME]  [北京紫光华宇软件股份有限公司, 4.0.0.5027]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 1156][C:\WINDOWS\regedit.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\FOURI_M3.IME]  [北京紫光华宇软件股份有限公司, 4.0.0.5027]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 1876][C:\WINDOWS\NeroCheck.exe]  [N/A, N/A]
    [C:\WINDOWS\System32\FOURI_M3.IME]  [北京紫光华宇软件股份有限公司, 4.0.0.5027]
[PID: 3960][C:\Documents and Settings\cxm.CSX\桌面\专杀\SREng.EXE]  [Smallfrogs Studio, 2.3.13.690]
    [C:\WINDOWS\System32\FOURI_M3.IME]  [北京紫光华宇软件股份有限公司, 4.0.0.5027]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
    [C:\Documents and Settings\cxm.CSX\桌面\专杀\Plugins\SRECXTMG.SRE]  [Smallfrogs Studio, 1, 5, 0, 55]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
N/A

==================================
API HOOK
N/A

==================================


[/CODE]

哦哟!忘了说了~瑞星也被屏蔽了,好久没有更新了~求大家帮帮忙吧~~~用卡卡助手杀出来个backdoor.Sdbot和backdoor.RxBot,也不知道杀掉没有...

日志没贴完全，不知道你说的iexplore是否正常。

你自启动的软件有些多。也是启动慢的一个原因。

把下面的服务给停了。
[Local Debug Manager / Local Debug Manager][Running/Auto Start]
<"C:\WINDOWS\system32\spoolvc.exe"><N/A>

再有，不要用什么木马杀客，没啥用的。

<Local Security Authority Service><C:\WINDOWS\System32\Isass.exe> [N/A]
<AutoRun><C:\Program Files\Internet Explorer\loadie.EXE> [N/A]
upxdnd><C:\DOCUME~1\cxm.CSX\LOCALS~1\Temp\upxdnd.exe> [N/A]
<DllRunning><rundll32.exe "C:\WINDOWS\System32\leyxwxhe.dll",setvm> [N/A]
<WinlogonNotify: ddaya><C:\WINDOWS\System32\ddaya.dll> [N/A]
Windows AII / SVCH0ST.EXE][Stopped/Auto Start]
<C:\WINDOWS\SVCH0ST><N/A
[NeroCheck / NeroCheck][Running/Auto Start]
<C:\WINDOWS\NeroCheck.exe><N/A>
好多……

[C:\WINDOWS\System32\ddaya.dll]
[C:\WINDOWS\System32\gcvuxjqy.dll]
[C:\WINDOWS\system32\pmkhifg.dll]

上面的那些dll全用icesword给删掉。

补上：
C:\WINDOWS\system32\pmkhifg.dll
C:\WINDOWS\System32\ddaya.dll
C:\WINDOWS\System32\gcvuxjqy.dll
C:\WINDOWS\System32\awtqrol.dll
C:\WINDOWS\System32\leyxwxhe.dll
C:\DOCUME~1\cxm.CSX\LOCALS~1\Temp\upxdnd.exe
C:\DOCUME~1\cxm.CSX\LOCALS~1\Temp\upxdnd.dll
C:\WINDOWS\System32\Isass.exe
C:\Program Files\Internet Explorer\loadie.EXE

顺便把C:\DOCUME~1\cxm.CSX\LOCALS~1\Temp里的文件全都给删除了。

【回复“yt2wj”的帖子】

谢谢哦~~