[求助]请问有没有人遇到过这种情况，杀不干净啊！！

LandyVanRoy

谢谢
非常感谢

马上尝试

LandyVanRoy

现在iexplore不会常驻进程管理器了
但我执行10楼大侠指导的步骤时
遇到了如下问题：

第一步，用xdelbox删除文件，所有文件都顺利删除了
第二步，一点sreng的“启动项目”，就弹出对话框说我的user.ini被更改了，问我要不要恢复，我点了“恢复”，结果“注册表”标签栏下无故多出了好多条，其它标签栏就不知道了，多半也有多出。 我把“注册表”标签栏下不熟悉的全删除了，“服务”和“浏览器加载”中有些删掉又冒出来了
第三步，第四步，都很顺利。

然后，这个分析报告是用软件生成的么？告诉我生成的方法吧！省得麻烦大侠每次进来。

LandyVanRoy

这是我现在的扫描报告：

[CODE]

2007-09-27,22:30:07

System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件
    进程特权扫描


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <run><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <KernelFaultCheck><%systemroot%\system32\dumprep 0 -k>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
    <Userinit><C:\WINDOWS\system32\UserInit.exe,>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]

==================================
启动文件夹
[Kaspersky Anti-Virus Personal]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Kaspersky Anti-Virus Personal.lnk --> D:\Program\KASPER~1\KASPER~1\kav.exe [Kaspersky Lab]><N>

==================================
服务
[Apache2 / Apache2][Running/Auto Start]
  <"D:\Program\apache\Apache2\bin\Apache.exe" -k runservice><Apache Software Foundation>
[ASP.NET State Service / aspnet_state][Stopped/Manual Start]
  <C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe><Microsoft Corporation>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[kavsvc / kavsvc][Running/Auto Start]
  <d:\Program\Kaspersky\Kaspersky\kavsvc.exe><Kaspersky Lab>
[MySQL / MySQL][Running/Auto Start]
  <"D:\Program\MySQL\bin\mysqld-nt" --defaults-file="D:\Program\MySQL\my.ini" MySQL><N/A>
[Pml Driver HPZ12 / Pml Driver HPZ12][Running/Auto Start]
  <C:\WINDOWS\system32\HPZipm12.exe><HP>
[postgre / postgre][Stopped/Auto Start]
  <d:/program/postgre/bin/pg_ctl.exe runservice -N "postgre" -D "d:/program/postgre/data"><PostgreSQL Global Development Group>
[Visual Studio Analyzer RPC bridge / Visual Studio Analyzer RPC bridge][Stopped/Manual Start]
  <D:\Program\Microsoft Visual Studio\Common\Tools\VS-Ent98\Vanalyzr\varpc.exe><Microsoft Corporation>
[Windows Live Setup Service / WLSetupSvc][Stopped/Manual Start]
  <"C:\Program Files\Windows Live\installer\WLSetupSvc.exe"><>

==================================
驱动程序
[AFW / AFW][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\drivers\jjrgr.sys><N/A>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[Belcarra USBLAN / Belcarra USBLAN][Stopped/Manual Start]
  <system32\DRIVERS\btblan.sys><Belcarra Technologies>
[HPMobileDisk / HPMobileDisk][Running/Auto Start]
  <\??\C:\WINDOWS\system32\Drivers\hpmobiledisk.sys><HP>
[ialm / ialm][Running/Manual Start]
  <system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[Klif / Klif][Running/System Start]
  <System32\drivers\klif.sys><Kaspersky Labs>
[Klmc / Klmc][Running/System Start]
  <System32\drivers\klmc.sys><Kaspersky Lab>
[Motorola USB Device / P2k][Stopped/Manual Start]
  <system32\DRIVERS\P2k.sys><Motorola Inc>
[Padus ASPI Shell / pfc][Running/Manual Start]
  <system32\drivers\pfc.sys><Padus, Inc.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[PxHelp20 / PxHelp20][Running/Boot Start]
  <\SystemRoot\System32\Drivers\PxHelp20.sys><Sonic Solutions>
[Realtek 10/100/1000 PCI NIC Family NDIS XP Driver / RTL8023xp][Running/Manual Start]
  <system32\DRIVERS\Rtnicxp.sys><Realtek Semiconductor Corporation>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[TSP / TSP][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Labs>

LandyVanRoy

==================================
浏览器加载项
[Thunder Browser Helper]
  {0005A87C-D626-4B3A-84F9-1D9571695F55} <D:\Program\thunder\ComDlls\XunLeiBHO_007.dll, Thunder Networking Technologies,LTD>
[AcroIEHlprObj Class]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx, >
[腾讯QQ]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <, N/A>
[SSVHelper Class]
  {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.6.0_02]
  {08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
[启动迅雷5]
  {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <D:\Program\thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[联想]
  {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} <http://www.lenovo.com, N/A>
[信息检索(&R)]
  {92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[金山词霸]
  {9A687CA6-D585-4947-9ED9-BE96071F5CD9} <, N/A>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[Kwyshell MidpX]
  {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} <d:\Program\javaSimulator\JadInvoker\MidpInvoker.dll, Kwyshell G.Corp>
[全能助手广告拦截专家]
  {ED51E9A3-16C5-4236-99E0-9F093B021433} <d:\Program\TweakAssist\AssistIEBar.dll, 全能助手工作室>
[WUWebControl Class]
  {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[Java Plug-in 1.6.0_02]
  {8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.4.1_01]
  {CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.5.0_12]
  {CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.6.0_02]
  {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.6.0_02]
  {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll, Sun Microsystems, Inc.>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>
[Thunder Browser Helper]
  {0005A87C-D626-4B3A-84F9-1D9571695F55} <D:\Program\thunder\ComDlls\XunLeiBHO_007.dll, Thunder Networking Technologies,LTD>
[AcroIEHlprObj Class]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx, >
[Web Browser Applet Control]
  {08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\WINDOWS\system32\msjava.dll, Microsoft Corporation>
[腾讯QQ]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <, N/A>
[SSVHelper Class]
  {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
[Kwyshell MidpX]
  {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} <d:\Program\javaSimulator\JadInvoker\MidpInvoker.dll, Kwyshell G.Corp>
[&Download using ??????à×]
  <F1910-F110-11D2-BB9E-00C04F795683}, N/A>
[&使用迅雷下载]
  <D:\Program\thunder\Program\geturl.htm, N/A>
[&使用迅雷下载全部链接]
  <D:\Program\thunder\Program\getallurl.htm, N/A>
[Link to &MidpX]
  <d:\Program\javaSimulator\JadInvoker\Extent\jad_wrap.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
  <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到广告杀手]
  <d:\Program\TweakAssist\AdKiller.htm, N/A>

==================================
正在运行的进程
[PID: 508 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 568 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 592 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 636 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 648 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 816 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 864 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 932 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1040 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1116 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1224 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
    [C:\WINDOWS\system32\HpTcpMon.dll]  [Hewlett Packard, 5.01.01.01]
    [C:\WINDOWS\system32\hpzjrd01.dll]  [Hewlett Packard, 2.01.00.003]
    [C:\WINDOWS\system32\HPTcpMUI.dll]  [Microsoft Corporation, 5.01.01.01]
    [C:\WINDOWS\system32\hptcpmib.dll]  [Hewlett Packard, 5.01.01.01]
    [C:\WINDOWS\system32\mdimon.dll]  [Microsoft Corporation, 11.3.1897.0]
    [C:\WINDOWS\system32\hpz3l43a.dll]  [Hewlett-Packard Company, 60.053.243.00]
    [C:\WINDOWS\system32\pdfports.dll]  [Adobe Systems Incorporated., 5.0.000]
    [C:\Program Files\Adobe\Acrobat 5.0\Distillr\ADistRes.CHS]  [Adobe Systems Incorporated., 5.0.0.0]
    [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\hpzpp43a.dll]  [Hewlett-Packard Corporation, 60.053.243.00]
    [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll]  [Microsoft Corporation, 11.3.1897.0]
[PID: 1492 / SYSTEM][D:\Program\apache\Apache2\bin\Apache.exe]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\bin\libapr.dll]  [Apache Software Foundation, 0.9.7]
    [D:\Program\apache\Apache2\bin\libaprutil.dll]  [Apache Software Foundation, 0.9.7]
    [D:\Program\apache\Apache2\bin\libapriconv.dll]  [Apache Software Foundation, 0.9.7]
    [D:\Program\apache\Apache2\bin\libhttpd.dll]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_access.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_actions.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_alias.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_asis.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_auth.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_autoindex.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_cgi.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_dir.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_env.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_imap.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_include.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_isapi.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_log_config.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_mime.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_negotiation.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_setenvif.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_userdir.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\php5apache2.dll]  [The PHP Group, 5.2.3.3]
    [C:\WINDOWS\system32\php5ts.dll]  [The PHP Group, 5.2.3.3]
    [C:\php\ext\php_gd2.dll]  [The PHP Group, 5.2.3.3]
    [C:\php\ext\php_mysql.dll]  [The PHP Group, 5.2.3.3]
    [c:\php\LIBMYSQL.dll]  [N/A, ]
    [C:\php\ext\php_pgsql.dll]  [The PHP Group, 5.2.3.3]
[PID: 1720 / Administrator][C:\WINDOWS\explorer.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [D:\Program\Tortoise\bin\tortoisesvn.dll]  [www.tortoisesvn.org, 1, 4, 4, 9706]
    [D:\Program\Tortoise\bin\libapr_tsvn.dll]  [Apache Software Foundation, 0.9.12]
    [D:\Program\Tortoise\bin\libaprutil_tsvn.dll]  [Apache Software Foundation, 0.9.12]
    [D:\Program\Tortoise\bin\libapriconv_tsvn.dll]  [Apache Software Foundation, 0.9.7]
    [D:\Program\Tortoise\bin\intl3_svn.dll]  [Free Software Foundation, 0.14.5]
    [D:\Program\Tortoise\iconv\_tbl_simple.so]  [N/A, ]
    [D:\Program\Tortoise\iconv\cp936.so]  [N/A, ]
    [D:\Program\Tortoise\iconv\utf-8.so]  [N/A, ]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\PROGRA~1\MICROS~2\OFFICE11\MCPS.DLL]  [Microsoft Corporation, 11.0.5510]
[PID: 1752 / SYSTEM][C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE]  [Microsoft Corporation, 7.00.9466]
    [C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\2052\mdmui.dll]  [Microsoft Corporation, 7.00.9466]
[PID: 1792 / SYSTEM][D:\Program\MySQL\bin\mysqld-nt.exe]  [N/A, ]
[PID: 1832 / SYSTEM][D:\Program\apache\Apache2\bin\Apache.exe]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\bin\libapr.dll]  [Apache Software Foundation, 0.9.7]
    [D:\Program\apache\Apache2\bin\libaprutil.dll]  [Apache Software Foundation, 0.9.7]
    [D:\Program\apache\Apache2\bin\libapriconv.dll]  [Apache Software Foundation, 0.9.7]
    [D:\Program\apache\Apache2\bin\libhttpd.dll]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_access.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_actions.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_alias.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_asis.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_auth.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_autoindex.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_cgi.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_dir.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_env.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_imap.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_include.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_isapi.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_log_config.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_mime.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_negotiation.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_setenvif.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\mod_userdir.so]  [Apache Software Foundation, 2.0.55]
    [D:\Program\apache\Apache2\modules\php5apache2.dll]  [The PHP Group, 5.2.3.3]
    [C:\WINDOWS\system32\php5ts.dll]  [The PHP Group, 5.2.3.3]
    [C:\php\ext\php_gd2.dll]  [The PHP Group, 5.2.3.3]
    [C:\php\ext\php_mysql.dll]  [The PHP Group, 5.2.3.3]
    [c:\php\LIBMYSQL.dll]  [N/A, ]
    [C:\php\ext\php_pgsql.dll]  [The PHP Group, 5.2.3.3]
[PID: 2064 / SYSTEM][C:\WINDOWS\system32\HPZipm12.exe]  [HP, 10, 1, 1, 2]
[PID: 2556 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2612 / Administrator][C:\WINDOWS\system32\wscntfy.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2944 / SYSTEM][C:\WINDOWS\system32\wuauclt.exe]  [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[PID: 3060 / Administrator][D:\Program\Tortoise\bin\TSVNCache.exe]  [www.tortoisesvn.org, 1, 4, 4, 9706]
    [D:\Program\Tortoise\bin\libapr_tsvn.dll]  [Apache Software Foundation, 0.9.12]
    [D:\Program\Tortoise\bin\libaprutil_tsvn.dll]  [Apache Software Foundation, 0.9.12]
    [D:\Program\Tortoise\bin\libapriconv_tsvn.dll]  [Apache Software Foundation, 0.9.7]
    [D:\Program\Tortoise\bin\intl3_svn.dll]  [Free Software Foundation, 0.14.5]
    [D:\Program\Tortoise\bin\CrashRpt.dll]  [, 3.1.2.3]
    [D:\Program\Tortoise\bin\dbghelp.dll]  [Microsoft Corporation, 6.3.0017.0 (DbgBuild.040415-1850)]
    [D:\Program\Tortoise\iconv\_tbl_simple.so]  [N/A, ]
    [D:\Program\Tortoise\iconv\cp936.so]  [N/A, ]
    [D:\Program\Tortoise\iconv\utf-8.so]  [N/A, ]
[PID: 3600 / Administrator][D:\Program\firefox\firefox.exe]  [Mozilla Corporation, 1.8.1.4: 2007051502]
    [D:\Program\firefox\js3250.dll]  [Netscape Communications Corporation, 4.0]
    [D:\Program\firefox\nspr4.dll]  [Netscape Communications Corporation, 4.6.7]
    [D:\Program\firefox\xpcom_core.dll]  [Mozilla Foundation, 1.8.1.4: 2007051502]
    [D:\Program\firefox\plc4.dll]  [Netscape Communications Corporation, 4.6.7]
    [D:\Program\firefox\plds4.dll]  [Netscape Communications Corporation, 4.6.7]
    [D:\Program\firefox\smime3.dll]  [Mozilla Foundation, 3.11.5 Basic ECC]
    [D:\Program\firefox\nss3.dll]  [Mozilla Foundation, 3.11.5 Basic ECC]
    [D:\Program\firefox\softokn3.dll]  [Mozilla Foundation, 3.11.4 Basic ECC]
    [D:\Program\firefox\ssl3.dll]  [Mozilla Foundation, 3.11.5 Basic ECC]
    [D:\Program\firefox\xpcom_compat.dll]  [Mozilla Foundation, 1.8.1.4: 2007051502]
    [D:\Program\firefox\components\myspell.dll]  [Mozilla Foundation, 1.8.1.4: 2007051502]
    [D:\Program\firefox\components\jar50.dll]  [Mozilla Foundation, 1.8.1.4: 2007051502]
    [D:\Program\firefox\components\jsd3250.dll]  [Mozilla Foundation, 1.8.1.4: 2007051502]
    [D:\Program\firefox\freebl3.dll]  [Mozilla Foundation, 3.11.4 Basic ECC]
    [D:\Program\firefox\nssckbi.dll]  [Mozilla Foundation, 1.62]
    [D:\Program\firefox\components\spellchk.dll]  [Mozilla Foundation, 1.8.1.4: 2007051502]
[PID: 952 / Administrator][D:\Program\totalcmd\LANGUAGE\pojie\totalcmd_.exe]  [C. Ghisler & Co., 7.01]
    [D:\Program\Tortoise\bin\tortoisesvn.dll]  [www.tortoisesvn.org, 1, 4, 4, 9706]
    [D:\Program\Tortoise\bin\libapr_tsvn.dll]  [Apache Software Foundation, 0.9.12]
    [D:\Program\Tortoise\bin\libaprutil_tsvn.dll]  [Apache Software Foundation, 0.9.12]
    [D:\Program\Tortoise\bin\libapriconv_tsvn.dll]  [Apache Software Foundation, 0.9.7]
    [D:\Program\Tortoise\bin\intl3_svn.dll]  [Free Software Foundation, 0.14.5]
    [D:\Program\Tortoise\iconv\_tbl_simple.so]  [N/A, ]
    [D:\Program\Tortoise\iconv\cp936.so]  [N/A, ]
    [D:\Program\Tortoise\iconv\utf-8.so]  [N/A, ]
[PID: 2924 / Administrator][D:\Program\systemRepairEngineer\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
    [D:\Program\systemRepairEngineer\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  Error. ["hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  Error. [UltraEdit.ini]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS   Error. []
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1       localhost
211.166.155.2   www.1.com

==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 3060, D:\PROGRAM\TORTOISE\BIN\TSVNCACHE.EXE]

==================================
API HOOK
RVA  错误： LoadLibraryA (危险等级: 高,  被下面模块所HOOK: \SystemRoot\System32\drivers\klif.sys)
RVA  错误： LoadLibraryExA (危险等级: 高,  被下面模块所HOOK: \SystemRoot\System32\drivers\klif.sys)
RVA  错误： LoadLibraryExW (危险等级: 高,  被下面模块所HOOK: \SystemRoot\System32\drivers\klif.sys)
RVA  错误： LoadLibraryW (危险等级: 高,  被下面模块所HOOK: \SystemRoot\System32\drivers\klif.sys)

==================================
隐藏进程
    [1537] d:\Program\Kaspersky\Kaspersky\kavsvc.exe
    [3121] D:\Program\Kaspersky\Kaspersky\kav.exe

==================================


[/CODE]

LandyVanRoy

而且sreng仍然报危险

shuipao

C:\WINDOWS\system32\drivers\jjrgr.sys有就删除，没有就不用管。
sreng报危险的那个是你安装的咔吧修改的没什么事情的。
这个日志是我自己分析的，没有自动生成的工具。
只有那个可以方便查看的工具，就是那个sreng日志分析助手。

shyoow

呵呵，纯粹学习。谢谢