[CODE]

2007-01-12,09:00:34

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <Internat.exe><internat.exe>  [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
    <assistse><"C:\PROGRA~1\3721\assistse.exe">  [N/A]
    <NeroFilterCheck><C:\WINNT\system32\NeroCheck.exe>  [Ahead Software Gmbh]
    <Synchronization Manager><mobsync.exe /logon>  [(Verified)Microsoft Corporation]
    <cmdbcs><C:\WINNT\cmdbcs.exe>  [Microsoft Corporation]
    <wabqpt><C:\WINNT\system32\ynxevc.exe>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><EXPLORER.EXE>  [(Verified)Microsoft Corporation]
    <Userinit><C:\WINNT\system32\userinit.exe,C:\WINNT\system\userinit.exe>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]

启动文件夹
N/A

==================================
服务
[Adobe LM Service / Adobe LM Service][Stopped/Manual Start]
  <"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><N/A>
[Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[Dmsarrytps / Dmsarrytps][Stopped/Manual Start]
  <><N/A>
[Macromedia Licensing Service / Macromedia Licensing Service][Stopped/Manual Start]
  <"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><N/A>
[MSSQLSERVER / MSSQLSERVER][Running/Auto Start]
  <d:\PROGRA~1\MICROS~2\MSSQL\binn\sqlservr.exe><Microsoft Corporation>
[MSSQLServerADHelper / MSSQLServerADHelper][Stopped/Manual Start]
  <C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe><Microsoft Corporation>
[Intel NCS NetService / NetSvc][Stopped/Manual Start]
  <C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe><Intel(R) Corporation>
[NVIDIA Driver Helper Service / NVSvc][Stopped/Auto Start]
  <C:\WINNT\System32\nvsvc32.exe><NVIDIA Corporation>
[Rcaotpy / Rcaotpy][Stopped/Manual Start]
  <><N/A>
[Rising Process Communication Center / RsCCenter][Stopped/Auto Start]
  <"d:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon][Running/Auto Start]
  <"d:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[SQLSERVERAGENT / SQLSERVERAGENT][Stopped/Manual Start]
  <d:\PROGRA~1\MICROS~2\MSSQL\binn\sqlagent.exe><Microsoft Corporation>
[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]
  <C:\WINNT\system32\rundll32.exe windhcp.ocx,start><Microsoft Corporation>
[WinXP DHCP Service / WinXPDHCPsvc][Stopped/Auto Start]
  <C:\WINNT\system32\rundll32.exe xpdhcp.dll,start><Microsoft Corporation>
[Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start]
  <C:\WINNT\System32\svchost.exe -k netsvcs-->C:\WINNT\System32\mspmsnsv.dll><Microsoft Corporation>

驱动程序
[USB 2.0 (FS) ADFU Device / AdfuUd][Stopped/Manual Start]
  <System32\Drivers\AdfuUd.sys><>
[ADProt / ADProt][Stopped/System Start]
  <system32\drivers\ADProt.sys><腾讯科技（深圳）有限公司>
[aeaudio / aeaudio][Running/Manual Start]
  <system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
  <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[Cdsys / Cdsys][Stopped/Manual Start]
  <\??\C:\WINNT\system32\cdcd.sys><N/A>
[dmboot / dmboot][Stopped/Disabled]
  <System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[Intel(R) PRO/1000 Network Connection Driver / E1000][Running/Manual Start]
  <System32\DRIVERS\e1000nt5.sys><Intel Corporation>
[epffurg / epffurg][Running/Boot Start]
  <\SystemRoot\system32\drivers\epffurg.sys><>
[ExpScaner / ExpScaner][Running/Auto Start]
  <\??\d:\Program Files\Rising\Rav\ExpScan.sys><>
[hardlock / hardlock][Running/Auto Start]
  <\??\C:\WINNT\System32\drivers\hardlock.sys><Aladdin Knowledge Systems>
[Haspnt / Haspnt][Running/Auto Start]
  <\??\C:\WINNT\System32\drivers\Haspnt.sys><Aladdin Knowledge Systems>
[HOOKAPI / HOOKAPI][Stopped/Manual Start]
  <\??\D:\PROGRAM FILES\RISING\RAV\HookApi.Sys><瑞星软件有限公司>
[HookCont / HookCont][Running/Auto Start]
  <\??\d:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
  <\??\d:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
  <\??\d:\Program Files\Rising\Rav\HookSys.sys><Rising>
[keshjd / keshjd][Running/Boot Start]
  <\SystemRoot\\SystemRoot\System32\drivers\keshjd.sys><N/A>
[MEMSCAN / MEMSCAN][Running/Auto Start]
  <\??\d:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[npkcrypt / npkcrypt][Stopped/Auto Start]
  <\??\D:\Program Files\Tencent\QQ\npkcrypt.sys><N/A>
[nv / nv][Running/Manual Start]
  <System32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Padus ASPI Shell / pfc][Stopped/Manual Start]
  <system32\drivers\pfc.sys><Padus, Inc.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Feitian ROCKEY4 Device Service / ROCKEYNT][Running/Manual Start]
  <System32\DRIVERS\Rockey4.sys><Feitian Technologies Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
  <\SystemRoot\System32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
  <\??\d:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[senfilt / senfilt][Running/Manual Start]
  <system32\drivers\senfilt.sys><Sensaura>
[smwdm / smwdm][Running/Manual Start]
  <system32\drivers\smwdm.sys><Analog Devices, Inc.>
[TDVideo / TDVideo][Running/System Start]
  <\??\C:\WINNT\System32\Drivers\TDVideo.sys><Nanjing Universal Networks (U-NET) Co., LTD.>
[VIA AGP Filter / viaagp1][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\viaagp1.sys><VIA Technologies, Inc.>
[viamraid / viamraid][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\viamraid.sys><VIA Technologies inc,.ltd>
[VIA USB Host Controller Lower Filter / vulfnths][Running/Manual Start]
  <\SystemRoot\System32\Drivers\vulfnth.sys><VIA Technologies, Inc.>
[VIA USB Roothub Lower Filter / vulfntrs][Running/Manual Start]
  <\SystemRoot\System32\Drivers\vulfntr.sys><VIA Technologies, Inc.>
[vypirrxd / vypirrxd][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\vypirrxd.sys><Yahoo! China Corporation>
[yaskp / yaskp][Running/Boot Start]
  <\SystemRoot\system32\drivers\yaskp.sys><Copyright (C) yahoo Corporation.>

==================================
浏览器加载项
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <D:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_006.dll, Thunder Networking Technologies,LTD>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[@msdxmLC.dll,-1@2052,电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\System32\msdxm.ocx, Microsoft Corporation>
[AxSubmitControl Class]
  {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} <C:\WINNT\DOWNLO~1\SUBMIT~1.DLL, >
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[Yahoo!Live]
  {57421194-58FB-49AE-9B4F-FD48869B9AD4} <C:\Program Files\Yahoo!\Assistant\yaLive.dll, yahoo! china>
[assist]
  {FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8} <C:\Program Files\Yahoo!\Assistant\Assist\yassist.dll, Yahoo! China>
[&使用迅雷下载]
  <D:\Program Files\Thunder Network\Thunder\Program\geturl.htm, N/A>
[&使用迅雷下载全部链接]
  <D:\Program Files\Thunder Network\Thunder\Program\getallurl.htm, N/A>
[添加到雅虎订阅(&Y)]
  <res://C:\Program Files\Yahoo!\Assistant\Assist\yrss.dll/YRSSMENUEXT, N/A>
[雅虎搜索]
  <res://C:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll/203, N/A>

==================================
正在运行的进程
[PID: 152][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 176][\??\C:\WINNT\system32\csrss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 172][\??\C:\WINNT\system32\winlogon.exe]  [Microsoft Corporation, 5.00.2195.6714]
[PID: 224][C:\WINNT\system32\services.exe]  [Microsoft Corporation, 5.00.2195.6700]
    [C:\WINNT\system32\dmserver.dll]  [VERITAS Software Corp., 2195.6605.297.3]
[PID: 236][C:\WINNT\system32\lsass.exe]  [Microsoft Corporation, 5.00.2195.6695]
[PID: 408][C:\WINNT\system32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
[PID: 496][C:\WINNT\system32\spoolsv.exe]  [Microsoft Corporation, 5.00.2195.6659]
    [C:\WINNT\system32\CNMLM6e.DLL]  [CANON INC., 1.80.2.50]
    [C:\WINNT\system32\OLFMNT40.DLL]  [Microsoft Corporation, 9.0.98.0105]
    [C:\WINNT\system32\spool\PRTPROCS\W32X86\CNMPD6e.DLL]  [CANON INC., 1.80.2.50]
    [C:\WINNT\system32\spool\PRTPROCS\W32X86\olfpnt40.dll]  [Microsoft Corporation, 9.0.98.0105]
[PID: 536][C:\WINNT\System32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\ynxevc.dll]  [N/A, N/A]
[PID: 568][d:\PROGRA~1\MICROS~2\MSSQL\binn\sqlservr.exe]  [Microsoft Corporation, 2000.080.0194.00]
[PID: 684][C:\WINNT\system32\regsvc.exe]  [Microsoft Corporation, 5.00.2195.6701]
[PID: 704][C:\WINNT\system32\MSTask.exe]  [Microsoft Corporation, 4.71.2195.6704]
[PID: 788][C:\WINNT\System32\WBEM\WinMgmt.exe]  [Microsoft Corporation, 1.50.1085.0100]
[PID: 840][C:\WINNT\system32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
[PID: 892][d:\Program Files\Rising\Rav\RavStub.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 4]
    [d:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [d:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[PID: 1052][C:\WINNT\TEMP\gg.exe]  [雨薇在线, 1.00]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [C:\WINNT\system32\ynxevc.dll]  [N/A, N/A]
[PID: 1528][C:\WINNT\system32\iexpl0re.exe]  [N/A, N/A]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [C:\WINNT\TEMP\LgSym.dll]  [N/A, N/A]
[PID: 372][C:\Progra~1\Eset\rund1132.exe]  [N/A, N/A]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
[PID: 1124][C:\WINNT\Explorer.EXE]  [Microsoft Corporation, 5.00.3700.6690]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
    [C:\WINNT\system32\ynxevc.dll]  [N/A, N/A]
    [C:\WINNT\system32\run1132.dll]  [N/A, N/A]
    [C:\WINNT\system32\cmdbcs.dll]  [N/A, N/A]
    [D:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_006.dll]  [Thunder Networking Technologies,LTD, 5, 0, 0, 3]
    [C:\WINNT\system32\nvtuicpl.cpl]  [NVIDIA Corporation, 6.13.10.2832]
    [C:\WINNT\system32\NVWRSZHC.DLL]  [NVIDIA Corporation, 6.13.10.2832]
[PID: 1580][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3427]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
    [C:\WINNT\system32\ynxevc.dll]  [N/A, N/A]
[PID: 656][C:\WINNT\system32\ynxevc.exe]  [N/A, N/A]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
    [C:\WINNT\system32\ynxevc.dll]  [N/A, N/A]
[PID: 424][C:\WINNT\system32\internat.exe]  [Microsoft Corporation, 5.00.2920.0000]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
    [C:\WINNT\system32\ynxevc.dll]  [N/A, N/A]
[PID: 1360][C:\WINNT\system32\wuauclt.exe]  [Microsoft Corporation, 5.4.3630.2554 built by: lab04_n]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
    [C:\WINNT\system32\ynxevc.dll]  [N/A, N/A]
[PID: 520][C:\WINNT\Explorer.exe]  [Microsoft Corporation, 5.00.3700.6690]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
    [C:\WINNT\system32\ynxevc.dll]  [N/A, N/A]
[PID: 1156][C:\WINNT\system32\internat.exe]  [Microsoft Corporation, 5.00.2920.0000]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
    [C:\WINNT\system32\ynxevc.dll]  [N/A, N/A]
[PID: 1624][C:\WINNT\system32\iexpl0re.exe]  [N/A, N/A]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
    [C:\WINNT\TEMP\MgSym.dll]  [N/A, N/A]
[PID: 1640][C:\WINNT\system32\iexp1ore.exe]  [N/A, N/A]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
    [C:\WINNT\TEMP\LgSyzr.dll]  [N/A, N/A]
[PID: 348][C:\WINNT\system32\lexplore.exe]  [N/A, N/A]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
    [C:\WINNT\TEMP\LgSyl.dll]  [N/A, N/A]
[PID: 940][C:\WINNT\Welcome.exe]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
[PID: 1652][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2800.1106]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
[PID: 1128][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2800.1106]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
    [C:\WINNT\system32\ynxevc.dll]  [N/A, N/A]
    [D:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_006.dll]  [Thunder Networking Technologies,LTD, 5, 0, 0, 3]
    [C:\WINNT\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
[PID: 1200][D:\Program Files\Thunder Network\Thunder\Program\Thunder5.exe]  [Thunder Networking Technologies,LTD, 5, 5, 2, 252]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
    [C:\WINNT\system32\ynxevc.dll]  [N/A, N/A]
    [D:\Program Files\Thunder Network\Thunder\Program\TaskManager.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 10]
    [D:\Program Files\Thunder Network\Thunder\Program\download_interface.dll]  [Thunder Networking Technologies,LTD, 2, 11, 2, 22]
    [D:\Program Files\Thunder Network\Thunder\Program\stlport_vc646.dll]  [STLport Consulting, Inc., 4.6.2003.1031]
    [D:\Program Files\Thunder Network\Thunder\Program\log4cplus.dll]  [, 1, 0, 2, 1]
    [D:\Program Files\Thunder Network\Thunder\Program\asyn_dns.dll]  [Thunder Networking Technologies,LTD, 2, 11, 2, 22]
    [D:\Program Files\Thunder Network\Thunder\Program\BHOStub.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 8]
    [D:\Program Files\Thunder Network\Thunder\Program\iTargetAD.dll]  [Thunder Networking Technologies,LTD, 1, 0, 2, 12]
    [C:\WINNT\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
    [D:\Program Files\Thunder Network\Thunder\Components\DTAG\DTAG.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Thunder Network\Thunder\Program\LiveUpdate.dll]  [, 1, 0, 0, 9]
    [D:\Program Files\Thunder Network\Thunder\Program\UpdateDownload.dll]  [Thunder Networking Technologies,LTD, 1, 0, 1, 8]
    [D:\Program Files\Thunder Network\Thunder\Components\InMedia\iEmbedShell.dll]  [　, 1, 0, 0, 14]
    [D:\Program Files\Thunder Network\Thunder\Components\InMedia\iEmbed07.dll]  [　, 3, 1, 0, 58]
    [D:\Program Files\Thunder Network\Thunder\Components\Community\XLCommunity.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 10]
    [D:\Program Files\Thunder Network\Thunder\Program\RegisterDll.dll]  [Thunder Networking Technologies,LTD, 2, 2, 1, 42]
    [D:\Program Files\Thunder Network\Thunder\Components\Search\XLSearch.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
    [D:\Program Files\Thunder Network\Thunder\Components\P4PClient\P4PClient.dll]  [Thunder Networking Technologies,LTD, 1, 0, 2, 3]
    [D:\Program Files\Thunder Network\Thunder\Program\msgmanage.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 15]
    [D:\Program Files\Thunder Network\Thunder\Plugins\TingTing\TingTing.dll]  [Thunder Networking Technologies,LTD, 1, 1, 1, 12]
    [D:\Program Files\Thunder Network\Thunder\Plugins\BhoAdv\bho_adv.dll]  [深圳市迅雷网络技术有限公司, 1.0.1.0]
[PID: 1404][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2800.1106]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
    [C:\WINNT\system32\ynxevc.dll]  [N/A, N/A]
    [D:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_006.dll]  [Thunder Networking Technologies,LTD, 5, 0, 0, 3]
    [C:\WINNT\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
    [C:\Program Files\Yahoo!\Assistant\yaLive.dll]  [yahoo! china, 3, 5, 7, 1109]
    [C:\Program Files\Yahoo!\Assistant\Assist\yassist.dll]  [Yahoo! China, 3, 1, 4, 1019]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasfsks.dll]  [Yahoo! China, 2, 1, 3, 89]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yprockg.dll]  [Yahoo! China, 3, 0, 2, 1006]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\yhelper.dll]  [Yahoo! China, 3, 0, 5, 1023]
    [c:\progra~1\yahoo!\assist~1\assist\yadfil~1.dll]  [Yahoo! China, 3, 0, 2, 1003]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yrepair.dll]  [Yahoo! China, 3, 0, 9, 1012]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\yscrblock.dll]  [Yahoo! China, 3, 0, 2, 1003]
[PID: 1508][D:\Program Files\WinRAR\WinRAR.exe]  [N/A, N/A]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
    [C:\WINNT\system32\ynxevc.dll]  [N/A, N/A]
[PID: 1784][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.734\SREng.EXE]  [Smallfrogs Studio, 2.3.13.690]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
    [C:\WINNT\system32\ynxevc.dll]  [N/A, N/A]

文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[D:\]
[AutoRun]
open=sxs.exe
shellexecute=sxs.exe
shell\Auto\command=sxs.exe
[E:\]
[AutoRun]
open=sxs.exe
shellexecute=sxs.exe
shell\Auto\command=sxs.exe
[F:\]
[AutoRun]
open=sxs.exe
shellexecute=sxs.exe
shell\Auto\command=sxs.exe

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
API HOOK
N/A

==================================


[/CODE]

我去帮你叫我大叔吧... 这小东西太有个性 我怕我弄不好

谢谢！！，我整个公司的内部局域网都是这种病毒，电脑用了都会不会动的。

IceSword冰刃－斩断木马黑手的利刃
下载地址1：
中文：http://202.38.64.10/~jfpan/download/IceSword120_cn.zip
MD5 : cfb8514add1fbfb510b0084e837e561c

下载地址2：http://free.ys168.com/?ljs3508反病毒及安全工具区，
文件名：IceSword120_cn.zip 2.1MB

使用IceSword杀毒的一些基本操作
http://forum.ikaka.com/topic.asp?board=28&artid=7168178


展开：[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

<cmdbcs><C:\WINNT\cmdbcs.exe> [Microsoft Corporation]
<wabqpt><C:\WINNT\system32\ynxevc.exe> [N/A]

展开[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

<Userinit><C:\WINNT\system32\userinit.exe,C:\WINNT\system\userinit.exe> [N/A]红色的删掉

打开注册表编辑器，定位到HKEY_LOCAL_MACHINE\ SYSTEM\ CURRENT CONTROLSET\ SERVICES
[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]
<C:\WINNT\system32\rundll32.exe windhcp.ocx,start><Microsoft Corporation>
[WinXP DHCP Service / WinXPDHCPsvc][Stopped/Auto Start]
<C:\WINNT\system32\rundll32.exe xpdhcp.dll,start><Microsoft Corporation>
1、下载、运行IceSword。
2、用IceSword禁止进程创建。
3、找到并右击IceSword自身的进程名，点击“模块信息”。仔细查看模块中是否有
[C:\WINNT\system32\windhcp.ocx]
[C:\WINNT\system32\xpdhcp.dll]
[C:\WINNT\system32\ynxevc.dll] 。如果有，用IceSword强制卸除之（千万不要省略这一步）。
4、用IceSword结束除下列进程以外的进程（已经被病毒模块插入了）：
[PID: 152][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.00.2195.6601]
[PID: 176][\??\C:\WINNT\system32\csrss.exe] [Microsoft Corporation, 5.00.2195.6601]
[PID: 172][\??\C:\WINNT\system32\winlogon.exe] [Microsoft Corporation, 5.00.2195.6714]
[PID: 224][C:\WINNT\system32\services.exe] [Microsoft Corporation, 5.00.2195.6700]
[C:\WINNT\system32\dmserver.dll] [VERITAS Software Corp., 2195.6605.297.3]
[PID: 236][C:\WINNT\system32\lsass.exe] [Microsoft Corporation, 5.00.2195.6695]
[PID: 408][C:\WINNT\system32\svchost.exe] [Microsoft Corporation, 5.00.2134.1]
[PID: 496][C:\WINNT\system32\spoolsv.exe] [Microsoft Corporation, 5.00.2195.6659]
5、用IceSword删除上述加载项（红字内容）。
6、用IceSword删除以下文件。
C:\WINNT\system\userinit.exe
C:\WINNT\TEMP\gg.exe
C:\WINNT\system32\windhcp.ocx
C:\WINNT\system32\ynxevc.dll
C:\WINNT\system32\iexpl0re.exe
C:\WINNT\system32\windhcp.ocx
C:\WINNT\TEMP\LgSym.dll
C:\Progra~1\Eset\rund1132.exe
C:\WINNT\system32\windhcp.ocx
C:\WINNT\system32\xpdhcp.dll
C:\WINNT\system32\lexplore.exe
C:\WINNT\system\userinit.exe
删除D,E,F下的
Autorun.inf  sxs.exe
清空。。C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp

7、点击IceSword工具栏上的“文件”、“设置”，取消“禁止进程创建”。
8、点击IceSword工具栏上的“文件”、“重启并监视”。此时，系统重启。
禁用远程注册表修改服务。。重新扫日志传上来 给系统administrator 加密。。

IceSword冰刃－斩断木马黑手的利刃
下载地址1：
中文：http://202.38.64.10/~jfpan/download/IceSword120_cn.zip
MD5 : cfb8514add1fbfb510b0084e837e561c

下载地址2：http://free.ys168.com/?ljs3508反病毒及安全工具区，
文件名：IceSword120_cn.zip 2.1MB

使用IceSword杀毒的一些基本操作
http://forum.ikaka.com/topic.asp?board=28&artid=7168178

谢谢指点，我去试试