开机360加载了之后过几秒钟自动退出。
还会开机自动加载IEXPLORE.EXE。
然后时不时弹出来一个广告网页。
用了很多杀毒软件，也不知道是什么病毒。
请高手帮忙！
这是诊断报告：
复制内容到剪贴板
代码:
2008-03-30,21:11:50
System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 1 (Build 2600) - 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<SkinClock><D:\Atomic Alarm Clock\AtomicAlarmClock.exe> []
<ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [(Verified)Microsoft Windows XP Publisher]
<bgswitch><C:\WINDOWS\system32\bgswitch.exe> []
<BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}><"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"> [Nero AG]
<AlcoholAutomount><"D:\Alcohol 120\axcmd.exe" /automount> [(Verified)Alcohol Soft Code Signing Services]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<VolumeTray><D:\VolumeTray\VolumeTray.exe> []
<SKYNET Personal FireWall><C:\PROGRA~1\SkyNet\FireWall\pfw.exe> [广州众达天网技术有限公司]
<PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows XP Publisher]
<PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows XP Publisher]
<nwiz><nwiz.exe /install> []
<NVRaidService><C:\WINDOWS\System32\nvraidservice.exe> [NVIDIA Corporation]
<NvMediaCenter><RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit> [(Verified)Microsoft Windows XP Publisher]
<NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup> [(Verified)Microsoft Windows XP Publisher]
<Logitech Utility><LOGI_MWX.EXE> [(Verified)Microsoft Windows XP Publisher]
<IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload> [(Verified)Microsoft Corporation]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows XP Publisher]
<BigDogPath><C:\WINDOWS\VM_STI.EXE USB PC Camera 301P> [N/A]
<AVP><"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"> [Kaspersky Lab]
<360Safetray><C:\Program Files\360safe\safemon\360Tray.exe /start> [奇虎网]
<360Safebox><"C:\Program Files\360Safebox\safeboxTray.exe" /r> [奇虎网]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<zsmstc><rundll32.exe C:\WINDOWS\System32\mxcdcsrv16_080328.dll start> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows XP Publisher]
<Userinit><C:\WINDOWS\System32\userinit.exe,> [(Verified)Microsoft Windows XP Publisher]
<UIHost><logonui.exe> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
<WinlogonNotify: klogon><C:\WINDOWS\System32\klogon.dll> [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
<WinlogonNotify: WgaLogon><WgaLogon.dll> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
<Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection %SystemRoot%\INF\msmsgs.inf,BLC.Remove.PerUser> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
<N/A><C:\WINDOWS\System32\Rundll32.exe C:\WINDOWS\System32\mscories.dll,Install> [Microsoft Corporation]
==================================
启动文件夹
[QQ]
<C:\Documents and Settings\YAMAZAKI\「开始」菜单\程序\启动\QQ.lnk --> D:\QQ\QQ.exe [TENCENT]><N>
==================================
服务
[Adobe LM Service / Adobe LM Service][Stopped/Manual Start]
<"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>
[卡巴斯基反病毒6.0个人版 / AVP][Running/Auto Start]
<"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r><Kaspersky Lab>
[InstallDriver Table Manager / IDriverT][Stopped/Manual Start]
<"C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe"><Macrovision Corporation>
[iPod 服务 / iPod Service][Stopped/Manual Start]
<"C:\Program Files\iPod\bin\iPodService.exe"><Apple Inc.>
[NBService / NBService][Stopped/Manual Start]
<D:\Nero 7\Nero BackItUp\NBService.exe><Nero AG>
[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
<C:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation>
[PDAgent / PDAgent][Running/Auto Start]
<D:\PerfectDisk\PDAgent.exe><Raxco Software, Inc.>
[PDEngine / PDEngine][Running/Manual Start]
<D:\PerfectDisk\PDEngine.exe><Raxco Software, Inc.>
[User Profile Hive Cleanup / UPHClean][Running/Auto Start]
<C:\Program Files\UPHClean\uphclean.exe><Microsoft Corporation>
==================================
驱动程序
[360TimeProt / 360TimeProt][Running/Auto Start]
<\??\C:\WINDOWS\System32\drivers\360TimeProt.sys><N/A>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Stopped/Manual Start]
<system32\drivers\ALCXWDM.SYS><N/A>
[ASInsHelp / ASInsHelp][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\AsInsHelp32.sys><N/A>
[AsIO / AsIO][Running/System Start]
<system32\drivers\AsIO.sys><N/A>
[Bluetooth Audio Service / BlueletAudio][Stopped/Manual Start]
<System32\DRIVERS\blueletaudio.sys><N/A>
[Bluetooth SCO Audio Service / BlueletSCOAudio][Stopped/Manual Start]
<System32\DRIVERS\BlueletSCOAudio.sys><N/A>
[BM Win32 Network Adapter / bmnadapter][Running/Manual Start]
<System32\DRIVERS\bmnet.sys><The OpenVPN Project>
[Bluetooth PAN Network Adapter / BT][Stopped/Manual Start]
<System32\DRIVERS\btnetdrv.sys><N/A>
[Bluetooth USB For Bluetooth Service / Btcsrusb][Stopped/Manual Start]
<System32\Drivers\btcusb.sys><N/A>
[Bluetooth HID Enumerator / BTHidEnum][Stopped/Manual Start]
<System32\DRIVERS\vbtenum.sys><N/A>
[Bluetooth HID Manager Service / BTHidMgr][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\BTHidMgr.sys><N/A>
[Creative SoundFont Management Device Driver / ctsfm2k][Running/Manual Start]
<System32\DRIVERS\ctsfm2k.sys><Creative Technology Ltd>
[dohs / dohs][Stopped/Auto Start]
<\??\C:\DOCUME~1\YAMAZAKI\LOCALS~1\Temp\tmp1A.tmp><N/A>
[Intel(R) PRO/1000 Network Connection Driver / E1000][Running/Manual Start]
<System32\DRIVERS\e1000325.sys><Intel Corporation>
[EagleNT / EagleNT][Stopped/Manual Start]
<\??\C:\WINDOWS\System32\drivers\EagleNT.sys><N/A>
[ElbyCDFL / ElbyCDFL][Running/Manual Start]
<System32\Drivers\ElbyCDFL.sys><SlySoft, Inc.>
[ElbyCDIO Driver / ElbyCDIO][Running/Auto Start]
<System32\Drivers\ElbyCDIO.sys><Elaborate Bytes AG>
[ENTECH / ENTECH][Stopped/Manual Start]
<\??\C:\WINDOWS\System32\DRIVERS\ENTECH.sys><EnTech Taiwan>
[ExpScaner / ExpScaner][Stopped/Auto Start]
<\??\d:\Rav\ExpScan.sys><N/A>
[GEARAspiWDM / GEARAspiWDM][Running/Manual Start]
<System32\Drivers\GEARAspiWDM.sys><GEAR Software Inc.>
[VMware hcmon / Hcmon][Stopped/Manual Start]
<SYSTEM32\DRIVERS\HCMON.SYS><VMware, Inc.>
[kl1 / kl1][Running/Boot Start]
<\SystemRoot\System32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif][Running/System Start]
<\??\C:\WINDOWS\System32\drivers\klif.sys><Kaspersky Lab>
[kmsinput / kmsinput][Stopped/Manual Start]
<\??\C:\WINDOWS\System32\drivers\kmsinput.sys><N/A>
[MEMSCAN / MEMSCAN][Stopped/Auto Start]
<\??\d:\Rav\MEMSCAN.sys><N/A>
[ATK0110 ACPI UTILITY / MTsensor][Running/Manual Start]
<System32\DRIVERS\ASACPI.sys><>
[npkcrypt / npkcrypt][Stopped/Auto Start]
<\??\D:\QQ\npkcrypt.sys><N/A>
[npkcusb / npkcusb][Stopped/Manual Start]
<\??\C:\WINDOWS\System32\npkcusb.sys><N/A>
[nv / nv][Running/Manual Start]
<System32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[nvata / nvata][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\nvata.sys><NVIDIA Corporation>
[nvatabus / nvatabus][Running/Boot Start]
<\SystemRoot\system32\drivers\nvatabus.sys><NVIDIA Corporation>
[NVIDIA nForce(tm) RAID Class Driver / nvraid][Running/Boot Start]
<\SystemRoot\system32\drivers\nvraid.sys><NVIDIA Corporation>
[Creative OS Services Driver / ossrv][Running/Manual Start]
<System32\DRIVERS\ctoss2k.sys><Creative Technology Ltd.>
[Sound Blaster Audigy / P17][Running/Manual Start]
<system32\drivers\P17.sys><Creative Technology Ltd.>
[p17filt / p17filt][Running/Manual Start]
<system32\drivers\p17filt.sys><Sensaura>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RSPPSYS / RSPPSYS][Stopped/Auto Start]
<\??\d:\Rav\RSPPSYS.sys><N/A>
[SafeBoxKrnl / SafeBoxKrnl][Running/System Start]
<\??\C:\Program Files\360Safebox\SafeBoxKrnl.sys><奇虎网>
[Secdrv / Secdrv][Stopped/Manual Start]
<System32\DRIVERS\secdrv.sys><N/A>
[SKNFW / SKNFW][Running/System Start]
<\??\C:\WINDOWS\System32\Drivers\SKNFW.sys><N/A>
[SkyProcs / SkyProcs][Running/Manual Start]
<\??\C:\PROGRA~1\SkyNet\FireWall\SkyProcs.sys><N/A>
[sptd / sptd][Running/Boot Start]
<\SystemRoot\System32\Drivers\sptd.sys><N/A>
[SVKP / SVKP][Running/Auto Start]
<\??\C:\WINDOWS\System32\SVKP.sys><AntiCracking>
[TSP / TSP][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[vaxscsi / vaxscsi][Stopped/Manual Start]
<\SystemRoot\System32\Drivers\vaxscsi.sys><N/A>
[VCD VNC Virtual Network Adapter / vcddev][Stopped/Manual Start]
<System32\DRIVERS\vcdvnic.sys><VNN B.J.>
[Virtual Serial port driver / VComm][Stopped/Manual Start]
<System32\DRIVERS\VComm.sys><N/A>
[Bluetooth VComm Manager Service / VcommMgr][Stopped/Manual Start]
<System32\Drivers\VcommMgr.sys><N/A>
[VMware Virtual Ethernet Adapter Driver / VMnetAdapter][Stopped/Manual Start]
<System32\DRIVERS\vmnetadapter.sys><VMware, Inc.>
[VMware Bridge Protocol / VMnetBridge][Running/Auto Start]
<System32\DRIVERS\vmnetbridge.sys><VMware, Inc.>
[VMware Network Application Interface / VMnetuserif][Stopped/Manual Start]
<SYSTEM32\DRIVERS\VMNETUSERIF.SYS><VMware, Inc.>
[VMware VMparport / Vmparport][Stopped/Manual Start]
<SYSTEM32\DRIVERS\VMPARPORT.SYS><VMware, Inc.>
[VMware vmx86 / vmx86][Running/Auto Start]
<System32\DRIVERS\vmx86.sys><VMware, Inc.>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
<System32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[USB PC Camera 301P / ZSMC301b][Stopped/Manual Start]
<System32\Drivers\usbVM31b.sys><VM>
==================================
浏览器加载项
[ThunderAtOnce Class]
{01443AEC-0FD1-40fd-9C87-E93D1494C233} <D:\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[BitComet Helper]
{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} <D:\BitComet\tools\BitCometBHO_1.2.1.2.dll, N/A>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <D:\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[IeCatch2 Class]
{A5366673-E8CA-11D3-9CD9-0090271D075B} <D:\FlashGet\jccatch.dll, Amaze Soft>
[SafeMon Class]
{B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>
[金山快译(&K)]
{6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} <C:\Program Files\Common Files\Kingsoft\Extract\AddIns\IEBand.dll, 金山软件股份有限公司>
[电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[Office Genuine Advantage Validation Tool]
{05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} <C:\WINDOWS\System32\OGACheckControl.DLL, >
[InstallHelper Class]
{1DABF8D5-8430-4985-9B7F-A30E53D709B3} <D:\QQ\QQLive\QQLiveInstaller.dll, >
[GDGetTokenInfo Class]
{3AA9CF07-DF20-48FF-98BE-DED276E40146} <C:\WINDOWS\System32\GDREAD~1.DLL, >
[WebActivater Control]
{3D8F74EE-8692-4F8F-B8D2-7522E732519E} <C:\WINDOWS\System32\WEBACT~1.OCX, QQ>
[EditCtrl Class]
{488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\system32\aliedit\aliedit.dll, >
[MSN Photo Upload Tool]
{4F1E5B1A-2A80-42CA-8532-2D05CB959537} <C:\WINDOWS\Downloaded Program Files\MsnPUpld.dll, Microsoft? Corporation>
[InfoSecNetSign Class]
{5CB840B5-A94E-4AD9-B785-4866E3B04476} <C:\WINDOWS\DOWNLO~1\ICBCNE~1.DLL, Infosec Technologies Co., Ltd.>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\System32\wuweb.dll, Microsoft Corporation>
[163Uploader Control]
{8686F2A6-DC01-4E8F-BDE3-DCC7DBBAD6AE} <C:\WINDOWS\System32\163UPL~1.OCX, 广州网易互动娱乐有限公司>
[AxSubmitControl Class]
{8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} <C:\WINDOWS\DOWNLO~1\SUBMIT~1.DLL, >
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash9e.ocx, Adobe Systems, Inc.>
[PasswordEditCtrl Class]
{E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\System32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
[ThunderServer.WebThunder]
{1DE5794D-B609-4A3E-9E40-22594D5BEAAC} <D:\Thunder\ComDlls\Faker.dll, N/A>
[Thunder Agent Class]
{485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <D:\Thunder\ComDlls\ThunderAgent_Now.dll, Thunder Networking Technologies,LTD>
[JetCar.Netscape]
{69C7BEA7-0A70-4291-81ED-405D19AEE270} <D:\Thunder\ComDlls\Faker.dll, N/A>
[WangWangObj Class]
{6E213FC7-DD5A-4115-B7E6-D4C7838C361E} <D:\WangWang\WangWangX5.dll, 阿里巴巴软件(上海)有限公司>
[360SafeLive]
{87515F61-A66C-4319-A0E0-D416CB8059E3} <C:\Program Files\360safe\live.dll, 360.cn>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <D:\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[QQIEHelper.QQRightClick]
{E654770F-10E4-47BC-A309-4CAD96A096E6} <D:\Thunder\ComDlls\Faker.dll, N/A>
[使用网际快车下载]
<D:\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<D:\FlashGet\jc_all.htm, N/A>
[使用迅雷下载]
<D:\Thunder\Program\geturl.htm, N/A>
[使用迅雷下载全部链接]
<D:\Thunder\Program\getallurl.htm, N/A>
==================================
正在运行的进程
[PID: 928 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 992 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1024 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.1557 (xpsp2_gdr.040517-1325)]
[C:\WINDOWS\System32\klogon.dll] [Kaspersky Lab, 6.0.2.621]
[C:\WINDOWS\system32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1068 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1080 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 1244 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1380 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\wups2.dll] [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]
[PID: 1752 / NETWORK SERVICE][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1764 / LOCAL SERVICE][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 2020 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.1699 (xpsp2.050610-1533)]
[C:\WINDOWS\system32\CNMLM6e.DLL] [CANON INC., 1.80.2.50]
[C:\WINDOWS\system32\mdimon.dll] [Microsoft Corporation, 11.3.2175.0]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\CNMPD6e.DLL] [CANON INC., 1.80.2.50]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll] [Microsoft Corporation, 11.3.2175.0]
[PID: 896 / YAMAZAKI][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2800.1221 (xpsp2.030511-1403)]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scrchpg.dll] [Kaspersky Lab, 6.0.2.621]
[C:\WINDOWS\System32\Audiodev.dll] [Microsoft Corporation, 5.2.3802.3802 built by: dnsrv(bld4act)]
[D:\Atomic Alarm Clock\Clock.dll] [N/A, ]
[D:\Acrobat 7.0\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 7.0.0.0]
[C:\WINDOWS\System32\nvcpl.dll] [NVIDIA Corporation, 6.14.10.8198]
[C:\WINDOWS\System32\NVRSZHC.DLL] [NVIDIA Corporation, 6.14.10.8198]
[C:\WINDOWS\System32\nvshell.dll] [, ]
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 0, 1004]
[D:\MICROS~1\OFFICE11\MCPS.DLL] [Microsoft Corporation, 11.0.6551]
[PID: 1608 / SYSTEM][C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE] [Microsoft Corporation, 7.00.9466]
[C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\2052\mdmui.dll] [Microsoft Corporation, 7.00.9466]
[PID: 1488 / SYSTEM][C:\WINDOWS\System32\nvsvc32.exe] [NVIDIA Corporation, 6.14.10.8198]
[PID: 1652 / SYSTEM][D:\PerfectDisk\PDAgent.exe] [Raxco Software, Inc., 8, 0, 0, 30]
[D:\PerfectDisk\PDCommon.dll] [Raxco Software, Inc., 8, 0, 0, 30]
[D:\PerfectDisk\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[D:\PerfectDisk\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[D:\PerfectDisk\PDDb.dll] [, 8, 0, 0, 30]
[D:\PerfectDisk\sqlite3.dll] [, 8, 0, 0, 30]
[D:\PerfectDisk\PDLangEN.dll] [Raxco Software, Inc., 8, 0, 0, 30]
[D:\PerfectDisk\PDEngineps.dll] [Raxco Software, Inc., 8, 0, 0, 30]
[PID: 1844 / YAMAZAKI][C:\WINDOWS\System32\rundll32.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\mxcdcsrv16_080328.dll] [N/A, ]
[PID: 1852 / YAMAZAKI][D:\VolumeTray\VolumeTray.exe] [N/A, ]
[C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1952 / YAMAZAKI][C:\WINDOWS\System32\nvraidservice.exe] [NVIDIA Corporation, 1.0.1]
[C:\WINDOWS\System32\NvRaidSvENU.dll] [NVIDIA Corporation, 1.0.1]
[PID: 284 / YAMAZAKI][C:\WINDOWS\LOGI_MWX.EXE] [Logitech Inc., 9.78.033]
[PID: 324 / YAMAZAKI][C:\WINDOWS\VM_STI.EXE] [VM., 4.2.610.4]
[C:\WINDOWS\System32\msdmo.dll] [, ]
[PID: 368 / YAMAZAKI][D:\Atomic Alarm Clock\AtomicAlarmClock.exe] [N/A, ]
[D:\Atomic Alarm Clock\Clock.dll] [N/A, ]
[PID: 380 / YAMAZAKI][C:\WINDOWS\System32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 404 / YAMAZAKI][C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe] [Nero AG, 1, 5, 3, 0]
[C:\Program Files\Common Files\Ahead\Lib\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\Program Files\Common Files\Ahead\Lib\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\Program Files\Common Files\Ahead\Lib\AdvrCntr2.dll] [Nero AG, 5,16,1, 9000]
[C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvrPS.dll] [Nero AG, 1, 5, 3, 0]
[C:\Program Files\Common Files\Ahead\Lib\NMDataServices.dll] [Nero AG, 1, 5, 3, 0]
[PID: 460 / YAMAZAKI][C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe] [Nero AG, 1, 5, 3, 0]
[C:\Program Files\Common Files\Ahead\Lib\NMSQLDB.dll] [Nero AG, 1, 5, 3, 0]
[C:\Program Files\Common Files\Ahead\Lib\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\Program Files\Common Files\Ahead\Lib\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\Program Files\Common Files\Ahead\Lib\NMLogCxx.dll] [Nero AG, 1, 5, 3, 0]
[C:\Program Files\Common Files\Ahead\Lib\log4cxx.dll] [Nero AG, 1, 0, 0, 0]
[C:\Program Files\Common Files\Ahead\Lib\NMCoFoundation.dll] [Nero AG, 1, 5, 3, 0]
[C:\Program Files\Common Files\Ahead\Lib\NMPluginBase.dll] [Nero AG, 1, 5, 3, 0]
[C:\Program Files\Common Files\Ahead\Lib\NMFullTextExtraction.dll] [Nero AG, 1, 5, 3, 0]
[C:\Program Files\Common Files\Ahead\Lib\NMSearchPluginSimilarImages.dll] [Nero AG, 1, 5, 3, 0]
[C:\Program Files\Common Files\Ahead\Lib\NeroIPP.dll] [Nero AG, 4,5,13,0]
[C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvrPS.dll] [Nero AG, 1, 5, 3, 0]
[C:\Program Files\Common Files\Ahead\Lib\NMDataServices.dll] [Nero AG, 1, 5, 3, 0]
[PID: 524 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 552 / LOCAL SERVICE][C:\WINDOWS\System32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[PID: 588 / SYSTEM][C:\Program Files\UPHClean\uphclean.exe] [Microsoft Corporation, 1.6.30.0]
[PID: 1936 / SYSTEM][D:\PerfectDisk\PDEngine.exe] [Raxco Software, Inc., 8, 0, 0, 30]
[D:\PerfectDisk\PDCommon.dll] [Raxco Software, Inc., 8, 0, 0, 30]
[D:\PerfectDisk\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[D:\PerfectDisk\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[D:\PerfectDisk\PDLangEN.dll] [Raxco Software, Inc., 8, 0, 0, 30]
[D:\PerfectDisk\PDEngineps.dll] [Raxco Software, Inc., 8, 0, 0, 30]
[PID: 2216 / SYSTEM][C:\WINDOWS\System32\wbem\wmiprvse.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 2508 / YAMAZAKI][C:\WINDOWS\System32\conime.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 2584 / YAMAZAKI][C:\WINDOWS\System32\wbem\unsecapp.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 0, 1004]
[PID: 2396 / YAMAZAKI][D:\System Repair Engineer\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]
[C:\Program Files\360safe\safemon\safemon.dll] [360.CN, 4, 1, 0, 1004]
[D:\System Repair Engineer\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]
==================================
文件关联
.TXT Error. [C:\WINDOWS\notepad.exe %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM Error. ["hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1 localhost
127.0.0.1 yu.8s7.net
127.0.0.1 1.jopanqc.com
127.0.0.1 2.joppnqq.com
127.0.0.1 wg.47255.com
127.0.0.1 1.joppnqq.com
127.0.0.1 xxx.m111.biz
127.0.0.1 1.jopenqc.com
127.0.0.1 1.jopenkk.com
127.0.0.1 xxx.vh7.biz
127.0.0.1 xxx.j41m.com
127.0.0.1 3.joppnqq.com
127.0.0.1 d.93se.com
127.0.0.1 www.868wg.com
127.0.0.1 xxx.mmma.biz
127.0.0.1 ilove.com
127.0.0.1 tp.shpzhan.cn
127.0.0.1 www.tomwg.com
127.0.0.1 www.cike007.cn
127.0.0.1 www.22aaa.com
127.0.0.1 xx.exiao01.com
127.0.0.1 www.exiao01.com
127.0.0.1 www.exiao01.com
127.0.0.1 new.749571.com
127.0.0.1 xtx.kv8.info
127.0.0.1 cao.kv8.info
127.0.0.1 1.jopmmqq.com
127.0.0.1 171817.171817.com
127.0.0.1 d2.llsging.com
127.0.0.1 down.malasc.cn
127.0.0.1 llboss.com
127.0.0.1 nx.51ylb.cn
127.0.0.1 my.531jx.cn
127.0.0.1 qqq.dzydhx.com
127.0.0.1 qqq.hao1658.com
127.0.0.1 www.333292.com
127.0.0.1 down.18dd.net
127.0.0.1 up.22x44.com
127.0.0.1 gxgxy.net
127.0.0.1 c0mo.com
==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 1852, D:\VOLUMETRAY\VOLUMETRAY.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1952, C:\WINDOWS\SYSTEM32\NVRAIDSERVICE.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 324, C:\WINDOWS\VM_STI.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 368, D:\ATOMIC ALARM CLOCK\ATOMICALARMCLOCK.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 404, C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\NMBGMONITOR.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 460, C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\NMINDEXSTORESVR.EXE]
==================================
API HOOK
RVA 错误： LoadLibraryA (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\System32\drivers\klif.sys)
RVA 错误： LoadLibraryExA (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\System32\drivers\klif.sys)
RVA 错误： LoadLibraryExW (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\System32\drivers\klif.sys)
RVA 错误： LoadLibraryW (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\System32\drivers\klif.sys)
RVA 错误： GetProcAddress (危险等级: 高, 被下面模块所HOOK: \??\C:\WINDOWS\System32\drivers\klif.sys)
==================================
隐藏进程
N/A
==================================
