(www.dngz.net)版权所有
O9 - 浏览器额外的“工具”菜单项: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\PROGRA~1\FlashGet\flashget.exe O9 - 浏览器额外的按钮: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - F:\QQ\QQIEHelper.dll O9 - 浏览器额外的“工具”菜单项: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - F:\QQ\QQIEHelper.dll O9 - 浏览器额外的按钮: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - 浏览器额外的“工具”菜单项: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [TBH] 中文搜搜 O23 - NT 服务: Kingsoft Personal Firewall Service (KPfwSvc) - Unknown owner - C:\KAV2006\KPfwSvc.EXE (file missing) O23 - NT 服务: Kingsoft Antivirus KWatch Service (KWatchSvc) - Unknown owner - C:\KAV2006\KWatch.EXE (file missing) O23 - NT 服务: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE 2006-12-19,10:18:12 System Repair Engineer 2.2.6.605 Smallfrogs (http://www.KZTechs.com) Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能 以下内容被选中: 所有的启动项目(包括注册表、启动文件夹、服务等) 浏览器加载项 正在运行的进程(包括进程模块信息) 文件关联 Winsock 提供者 Autorun.inf HOSTS 文件 启动项目 注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation] <KavPFW><"C:\KAV2006\KPFW32.EXE"> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation] <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation] dngz.net <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Corporation] <SiSPower><Rundll32.exe SiSPower.dll,ModeAgent> [Silicon Integrated Systems Corporation] <IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload> [(Verified)Microsoft Corporation] <KavStart><"C:\KAV2006\KAVStart.exe" -startup> [N/A] <SoundMan><SOUNDMAN.EXE> [(Verified)Realtek Semiconductor Corp.] <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.] <stup.exe><C:\PROGRA~1\TENCENT\Adplus\stup.exe> [Tencent] <KernelFaultCheck><%systemroot%\system32\dumprep 0 -k> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] <szexoa55><%systemroot%\system32\Rundll32.exe %systemroot%\system32\szexoa55.dll,DllUnregisterServer> [Microsoft Corporation] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [(Verified)Microsoft Corporation] <Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation] <UIHost><logonui.exe> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{AEB6717E-7E19-11d0-97EE-00C04FD91972}><shell32.dll> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] <PostBootReminder><%SystemRoot%\system32\SHELL32.dll> [(Verified)Microsoft Corporation] <CDBurn><%SystemRoot%\system32\SHELL32.dll> [(Verified)Microsoft Corporation] <WebCheck><%SystemRoot%\system32\webcheck.dll> [(Verified)Microsoft Corporation] <SysTray><C:\WINDOWS\system32\stobject.dll> [(Verified)Microsoft Corporation] dngz.net [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] <WinlogonNotify: crypt32chain><crypt32.dll> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] <WinlogonNotify: cryptnet><cryptnet.dll> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] <WinlogonNotify: cscdll><cscdll.dll> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] <WinlogonNotify: ScCertProp><wlnotify.dll> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] <WinlogonNotify: Schedule><wlnotify.dll> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] <WinlogonNotify: sclgntfy><sclgntfy.dll> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] <WinlogonNotify: SensLogn><WlNotify.dll> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] <WinlogonNotify: termsrv><wlnotify.dll> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] <WinlogonNotify: wlballoon><wlnotify.dll> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] <{438755C2-A8BA-11D1-B96B-00A0C90312E1}><%SystemRoot%\system32\browseui.dll> [(Verified)Microsoft Corporation] <{8C7461EF-2B13-11d2-BE35-3078302C2030}><%SystemRoot%\system32\browseui.dll> [(Verified)Microsoft Corporation].
[HKEY_CURRENT_USER\Control Panel\Desktop] <SCRNSAVE.EXE><C:\WINDOWS\System32\logon.scr> [(Verified)Microsoft Corporation] ================================== 启动文件夹 [Utility Tray] <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Utility Tray.lnk --> C:\WINDOWS\system32\sistray.exe [Silicon Integrated Systems Corporation]><N> [腾讯QQ] <C:\Documents and Settings\s\「开始」菜单\程序\启动\腾讯QQ.lnk --> F:\QQ\QQ.exe [TENCENT]><N> [腾讯QQ珊瑚虫版] <C:\Documents and Settings\s\「开始」菜单\程序\启动\腾讯QQ珊瑚虫版.lnk --> F:\QQ\CoralQQ.exe [珊瑚虫工作室]><N> ================================== 服务 [Human Interface Device Access / HidServ] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A> [Kingsoft Personal Firewall Service / KPfwSvc] <"C:\KAV2006\KPfwSvc.EXE"><N/A> [Kingsoft Antivirus KWatch Service / KWatchSvc] <C:\KAV2006\KWatch.EXE><N/A> [LexBce Server / LexBceS] <C:\WINDOWS\system32\LEXBCES.EXE><Lexmark International, Inc.> ================================== 驱动程序 [Service for WDM 3D Audio Driver / ALCXSENS] <system32\drivers\ALCXSENS.SYS><Sensaura> [Service for Realtek AC97 Audio (WDM) / ALCXWDM] <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.> [dhmqvfp / dhmqvfpu] <\SystemRoot\System32\DRIVERS\dhmqvfpu.sys><N/A> [EagleNT / EagleNT] <\?\C:\WINDOWS\system32\drivers\EagleNT.sys><N/A> [KNetWch / KNetWch] <\?\C:\KAV2006\KNetWch.SYS><N/A> [KWatch3 / KWatch3] <\?\C:\WINDOWS\system32\drivers\KWatch3.SYS><Kingsoft Corporation> [npkcrypt / npkcrypt] <\?\F:\QQ\npkcrypt.sys><INCA Internet Co., Ltd.> [npkycryp / npkycryp] <\?\F:\QQ\npkycryp.sys><N/A> dngz.net [oreans32 / oreans32] <\?\C:\WINDOWS\system32\drivers\oreans32.sys><N/A> [Direct Parallel Link Driver / Ptilink] <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.> [Realtek 10/100/1000 NIC Family all in one NDIS XP Driver / RTL8023xp] <system32\DRIVERS\Rtlnicxp.sys><Realtek Semiconductor Corporation> [Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139] <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation> [Secdrv / Secdrv] <system32\DRIVERS\secdrv.sys><N/A> [SiS315 / SiS315] <system32\DRIVERS\sisgrp.sys><Silicon Integrated Systems Corporation> [SiSkp / SiSkp] <system32\DRIVERS\srvkp.sys><Silicon Integrated Systems Corporation> [Sony USB Filter Driver (SONYPVU1) / SONYPVU1] <system32\DRIVERS\SONYPVU1.SYS><Sony Corporation> [szexoa5 / szexoa55] <\SystemRoot\System32\DRIVERS\szexoa55.sys><Microsoft Corporation> [TYKeeper / TYKeeper] <2 - 系统找不到指定的文件。 ><N/A> ================================== 浏览器加载项 [Tencent Browser Helper] {0C7C23EF-A848-485B-873C-0ED954731014} <C:\Program Files\TENCENT\Adplus\SSAddr.dll, Tencent> [IeCatch5 Class] {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <F:\PROGRA~1\FlashGet\jccatch.dll, FlashGet> [QQBrowserHelperObject Class] {54EBD53A-9BC1-480B-966A-843A333CA162} <F:\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司> [Google Toolbar Helper] {AA58ED58-01DD-4d91-8333-CF10577473F7} <c:\program files\google\googletoolbar1.dll, Google Inc.> [信息检索(&R)] {92780B25-18CC-41C8-B9BE-3C9C571A8263} <D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL, Microsoft Corporation> [QQ] {c95fe080-8f5d-11d2-a20b-00aa003c157b} <F:\QQ\QQ.EXE, TENCENT> [FlashGet] {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <F:\PROGRA~1\FlashGet\flashget.exe, FlashGet.com>www.dngz.net
[QQIEFloatBarCfgCmd Class] {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <F:\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司> [Messenger] {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation> [FlashGet Bar] {E0E899AB-F487-11D5-8D29-0050BA6940E3} <F:\PROGRA~1\FlashGet\fgiebar.dll, Amaze Soft> [&Google] {2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar1.dll, Google Inc.> [Google Script Object] {00EF2092-6AC5-47C0-BD25-CF2D5D657FEB} <c:\program files\google\googletoolbar1.dll, Google Inc.> [ActiveMovieControl Object] {05589FA1-C356-11CE-BF01-00AA0055595A} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation> [Tencent Browser Helper] {0C7C23EF-A848-485B-873C-0ED954731014} <C:\Program Files\TENCENT\Adplus\SSAddr.dll, Tencent> [Windows Media Player] {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation> [&Google] {2318C2B1-4965-11D4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar1.dll, Google Inc.> [HTML Document] {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\Mshtml.dll, N/A> [IeCatch5 Class] {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <F:\PROGRA~1\FlashGet\jccatch.dll, FlashGet> [HHCtrl Object] {52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation> [QQBrowserHelperObject Class] {54EBD53A-9BC1-480B-966A-843A333CA162} <F:\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司> [Shell Name Space] {55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A> [YOKHttpFilter Class] {686D3343-D00D-49A1-96DF-66F3AF62F348} <C:\PROGRA~1\yok\adblock.dll, N/A> [Windows Media Player] {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> (www.dngz.net) [YOKAdBlock Class] {718F4AD3-70D4-425E-9159-5598DFC732ED} <C:\PROGRA~1\yok\adblock.dll, N/A> [Microsoft Web 浏览器] {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation> [RMGetLicense Class] {A9FC132B-096D-460B-B7D5-1DB0FAE0C062} <C:\WINDOWS\system32\msnetobj.dll, Microsoft Corporation> [Google Toolbar Helper] {AA58ED58-01DD-4D91-8333-CF10577473F7} <c:\program files\google\googletoolbar1.dll, Google Inc.> [Microsoft Scriptlet Component] {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\Mshtml.dll, Microsoft Corporation> [SearchAssistantOC] {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A> [RDS.DataSpace] {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation> [VIDEO__X_MS_WMV Moniker Class] {CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [RealPlayer G2 Control] {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.> [TencentVmpCtl Class] {D9819BD5-422B-4281-8523-726466ED692B} <C:\Program Files\Tencent\Viewpoint Media Player\AxMetaStream.dll, Viewpoint Corporation> [FlashGet Bar] {E0E899AB-F487-11D5-8D29-0050BA6940E3} <F:\PROGRA~1\FlashGet\fgiebar.dll, Amaze Soft> [上传到QQ网络硬盘] <F:\QQ\AddToNetDisk.htm, N/A> [使用网际快车下载] <F:\jc_link.htm, N/A> [使用网际快车下载全部链接] <F:\jc_all.htm, N/A> [导出到 Microsoft Office Excel(&X)] <res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000, N/A> [添加到QQ自定义面板] (www.dngz.net) <F:\QQ\AddPanel.htm, N/A> [添加到QQ表情] <F:\QQ\AddEmotion.htm, N/A> [珊瑚虫超级搜索] <C:\PROGRA~1\yok\yoksch.htm, N/A> [用QQ彩信发送该图片] <F:\QQ\SendMMS.htm, N/A> ================================== 正在运行的进程 [PID: 156][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 204][\?\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 228][\?\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 272][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 284][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 436][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 500][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 544][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 864][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\msdmo.dll] [N/A, N/A] [PID: 1096][C:\WINDOWS\system32\taskmgr.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1200][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1500][H:\sreng2\SREng\SREng.exe] [Smallfrogs Studio, 2.2.6.605] ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %*] .COM OK. ["%1" %*] .PIF OK. ["%1" %*] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %*] (www.dngz.net)版权所有 .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\system32\winhlp32.exe %1] .INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf N/A ================================== HOSTS 文件 127.0.0.1 localhost ==================================修复R3、02、011项以及04项中除了ctfmon.exe外的所有项目; 对O4 - 启动项HKLM\\RunOnce: [szexoa55] %systemroot%\system32\Rundll32.exe %systemroot%\system32\szexoa55.dll,DllUnregisterServer,删除szexoa55.dll及其注册表项目; 注册表中搜索删除KAV2006的所有项目; 用SREng的服务功能删除KAV2006的服务,最后用兔子清理文件; 重启再装试试
谢谢爱版:) ,基本搞掂了~