CODE] 2007-09-27,20:14:28 System Repair Engineer 2.5.16.900 Smallfrogs (http://www.KZTechs.com) Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能 以下内容被选中： 所有的启动项目（包括注册表、启动文件夹、服务等） 浏览器加载项 正在运行的进程（包括进程模块信息） 文件关联 Winsock 提供者 Autorun.inf HOSTS 文件 进程特权扫描 启动项目 注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
[(Verified)Microsoft Windows Publisher]
<"D:\QQDownload\QQDownload.exe" autostart> [N/A] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Publisher]
[(Verified)Microsoft Windows Publisher]
[(Verified)Microsoft Windows Publisher]
[]
[Jiangmin Co., Ltd.]
[TENCENT] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
[(Verified)Microsoft Windows Publisher]
[(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
[(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
[(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
[(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
[(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A]

[D:\qq\PersonalDesktop.dll] [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2] [D:\qq\QQAddr.dll] [深圳市腾讯计算机系统有限公司, 5, 0, 101, 320] [C:\WINDOWS\system32\msdmo.dll] [, ] [D:\qq\QRingMng.dll] [N/A, ] [D:\qq\QQGroupMng.dll] [TENCENT, 7,0,365,1701] [D:\qq\QQCustomFace.dll] [N/A, ] [D:\qq\QQSysMsgMng.dll] [N/A, ] [D:\qq\ImageOle.dll] [TENCENT, 7,0,365,1701] [D:\qq\QQLiveQMng.dll] [TENCENT, 7,0,365,1701] [D:\qq\QQSceneMng.dll] [N/A, ] [D:\qq\QQPet.dll] [TENCENT, 7,0,365,1701] [D:\qq\LongConnection.dll] [TENCENT, 7,0,365,1701] [D:\qq\QQFileTransfer.dll] [TENCENT, 7,0,365,1701] [D:\qq\GroupConnection.dll] [TENCENT, 7,0,365,1701] [D:\qq\AddrSearch.dll] [腾讯科技（深圳）有限公司, 2, 1, 9, 95] [D:\qq\QQSettingCtrl.dll] [TENCENT, 7,0,365,1701] [PID: 1632 / Administrator][D:\qq\TIMPlatform.exe] [TENCENT, 7,0,365,1701] [C:\PROGRA~1\TENCENT\SSPlus\SPlus.dll] [TENCENT, 5, 0, 1, 22] [D:\qq\TIMProxy.dll] [tencent, 0, 3, 2, 4] [PID: 508 / SYSTEM][C:\Program Files\JiangMin\AntiVirus\KVWSC.exe] [Jiangmin Co.,Ltd, 1, 0, 7, 131] [C:\WINDOWS\system32\HiveBase.dll] [Jiangmin Co., Ltd., 1, 0, 7, 326] [PID: 2028 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 3040 / Administrator][D:\QQDownload\QQDownload.exe] [Tencent Technology (Shenzhen) Company Limited, 1, 5, 134, 134] [C:\PROGRA~1\TENCENT\SSPlus\SPlus.dll] [TENCENT, 5, 0, 1, 22] [D:\QQDownload\QQDownload.dll] [Tencent Technology (Shenzhen) Company Limited, 1, 5, 134, 134] [D:\QQDownload\TNProxy.dll] [Tencent Technology(Shenzhen) Company Limited, 2, 1, 101, 90] [D:\qq\TIMProxy.dll] [tencent, 0, 3, 2, 4] [PID: 1624 / Administrator][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\PROGRA~1\TENCENT\SSPlus\SPlus.dll] [TENCENT, 5, 0, 1, 22] [C:\Program Files\TENCENT\SSPlus\SAddr.dll] [Tencent, 5, 0, 1, 18] [D:\QQDownload\QQIEHelper01.dll] [腾讯公司, 1, 1, 0, 5] [C:\WINDOWS\system32\macromed\flash\flash.ocx] [Macromedia, Inc., 6,0,79,0] [C:\WINDOWS\system32\xpsp3res.dll] [Microsoft Corporation, 5.1.2600.3121 (xpsp_sp2_gdr.070418-0032)] [PID: 1056 / Administrator][C:\Program Files\WinRAR\WinRAR.exe] [N/A, ] [C:\PROGRA~1\TENCENT\SSPlus\SPlus.dll] [TENCENT, 5, 0, 1, 22] [PID: 1868 / Administrator][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.766\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900] [C:\PROGRA~1\TENCENT\SSPlus\SPlus.dll] [TENCENT, 5, 0, 1, 22] [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.766\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]

文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %*] .COM OK. ["%1" %*] .PIF OK. ["%1" %*] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %*] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf [C:\] [AutoRun] open= shell\open=打开(&O) shell\open\Command=WScript.exe .\autorun.vbs shell\open\Default=1 [D:\] [AutoRun] open= shell\open=打开(&O) shell\open\Command=WScript.exe .\autorun.vbs shell\open\Default=1 [F:\] [AutoRun] open= shell\open=打开(&O) shell\open\Command=WScript.exe .\autorun.vbs shell\open\Default=1 ================================== HOSTS 文件 127.0.0.1 localhost ================================== 进程特权扫描 特殊特权被允许： SeLoadDriverPrivilege [PID = 1448, C:\PROGRAM FILES\JIANGMIN\KVFW\KVFWMCL.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 3040, D:\QQDOWNLOAD\QQDOWNLOAD.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 1056, C:\PROGRAM FILES\WINRAR\WINRAR.EXE] ================================== API HOOK N/A ================================== 隐藏进程 N/A ================================== [/CODE]

Autorun.inf [C:\] [AutoRun] open= shell\open=打开(&O) shell\open\Command=WScript.exe .\autorun.vbs shell\open\Default=1 [D:\] [AutoRun] open= shell\open=打开(&O) shell\open\Command=WScript.exe .\autorun.vbs shell\open\Default=1 [F:\] [AutoRun] open= shell\open=打开(&O) shell\open\Command=WScript.exe .\autorun.vbs shell\open\Default=1 问题就是这些了，找auto专杀试试 然后：开始--运行--regedit，打开注册表，利用其菜单中的查找功能，分别查找这个autorun.inf中的每句，例如“shell\open=打开(&O) ”---每行都查找，找到的项目都删除掉 [PID: 1440 / Administrator][C:\WINDOWS\system32\Wscript.exe] [Microsoft Corporation, 5.6.0.8820] [C:\PROGRA~1\TENCENT\SSPlus\SPlus.dll] [TENCENT, 5, 0, 1, 22] 那个[PID: 1440 / Administrator][C:\WINDOWS\system32\Wscript.exe] 进程看能否结束，然后把这个wscript.exe改名 这个 [C:\PROGRA~1\TENCENT\SSPlus\SPlus.dll] [TENCENT, 5, 0, 1, 22] 对应的dll也最好改名

我记得这是很久以前我在百度知道上提问的，当时您很热心的回复我。真没想到你居然发了贴在这儿帮我。非常感谢您、