C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\conime.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
c:\windows\system32\wbem\winlogon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
E:\Maxthon\Maxthon~.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Documents and Settings\Administrator\桌面\ha_hijackthis_1991\HijackThis.exe
R3 - URLSearchHook: (no name) - {40987A5C-6AB8-4977-8BE9-A8889DE2EDCC} - (no file)
F2 - REG:system.ini: Shell=explorer.exe C:\WINDOWS\system32\downasp.exe
O2 - BHO: (no name) - {00014B58-338A-45F2-81E2-6A86F27399B7} - C:\PROGRA~1\INTERN~1\PLUGINS\cfg.dll
O2 - BHO: SYM - {36BF6929-DCBC-4CCD-A620-C5E3BBA77B95} - C:\WINDOWS\system32\usercrd.dll
O2 - BHO: (no name) - {46F194EB-B7DB-4B7A-BD42-5FF39FD17664} - (no file)
O2 - BHO: Vision - {6671A431-5C3D-463d-A7CF-5587F9B7E191} - (no file)
O2 - BHO: stdup - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - D:\迅雷\ComDlls\XUNLEIBHO_002.dll
O2 - BHO: (no name) - {A697BC46-BC93-4833-93F5-1E365011E88A} - (no file)
O2 - BHO: (no name) - {A9930D97-9CF0-42A0-A10D-4F28836579D5} - D:\酷狗\KuGoo3\KuGoo3DownXControl.ocx
O2 - BHO: 信息检索 - {CE7C3CF0-98A8-474D-B2B5-1ED7E2E3B004} - C:\WINDOWS\system32\IEHelper.dll
O2 - BHO: update wnwb - {ED8DFC5C-10EF-45AB-9DC2-0639AFF5A270} - C:\PROGRA~1\COMMON~1\Wnwb\wnwbio.dll
O3 - Toolbar: (no name) - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - (no file)
O3 - Toolbar: ESou 工具栏 - {00BE86F6-2E61-4c1e-A36B-AE233EE21FA2} - C:\Program Files\eSou\ESouBar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [StormCodec_Helper] "E:\Storm Codec\StormSet.exe" /S /opti
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IntelFile] C:\WINDOWS\system32\IntelFile.exe
O4 - HKLM\..\Run: [C:\WINDOWS\system32\SetupCmd.exe] C:\WINDOWS\system32\SetupCmd.exe
O4 - HKLM\..\Run: [CnsMin] Rundll32.exe C:\WINDOWS\DOWNLO~1\CnsMin.dll,Rundll32
O4 - HKLM\..\Run: [-654632] C:\WINDOWS\system32\-654632.exe
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE USB PC Camera 301P
O4 - HKLM\..\RunOnce: [Super Rabbit Winspeed] "C:\Program Files\Super Rabbit\MagicSet\SRCK.exe" /autokill:122,54,12,3
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: 181009.lnk = C:\WINDOWS\system32\181009.exe
O8 - Extra context menu item: &使用迅雷下载 - D:\迅雷\Program\GetUrl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - D:\迅雷\Program\GetAllUrl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - E:\qq\新建文件夹 (5)\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - E:\qq\新建文件夹 (5)\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - E:\qq\新建文件夹 (5)\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - E:\qq\新建文件夹 (5)\SendMMS.htm
O9 - Extra button: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - D:\迅雷\Thunder.exe
O9 - Extra 'Tools' menuitem: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - D:\迅雷\Thunder.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\quartz32.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{C50569A2-4ECC-4D9D-AAC6-E0B450C4CFDC}: NameServer = 202.96.128.166 202.96.128.86
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: KSD2Service - Unknown owner - C:\WINDOWS\system32\SVCH0ST.exe (file missing)
O23 - Service: Remote Access - Unknown owner - C:\WINDOWS\system32\RAccess.exe
