何必分析，打了完事

quartz.dll
CQTStream::BuildMediaType(xx,xx)

quartz.pdb 怎么显示不出这个符号， MP4 LIB?

就是想看看到底补了哪了。。上班中正在偷偷的看那个dll的代码...

我的问题是如何卸载？

这个exe只是释放了safemon.dll
升级了360里的。
卸载什么？

微软今天给出解决办法了，禁用QT内容播放：
http://support.microsoft.com/kb/971778/en-us

看 Let me fix it myself 部分的说明：

Using the interactive method
Click Start, click Run, type regedit in the Open box, and then click OK.

Locate and then click the following subkeys in the registry:

For 32-bit Windows systems:
HKEY_CLASSES_ROOT\CLSID\{D51BD5A0-7548-11CF-A520-0080C77EF58A}

For 64 bit Windows Systems:
HKEY_CLASSES_ROOT\CLSID\{D51BD5A0-7548-11CF-A520-0080C77EF58A}
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{D51BD5A0-7548-11CF-A520-0080C77EF58A}

On the File menu, click Export.
In the Export Registry File dialog box, type Quicktime_Parser_Backup.reg, and then click Save.

Note By default, this will create a backup of this registry key in the My Documents folder.
Press DELETE on the keyboard to delete the registry key. When prompted to delete the registry key in the Confirm Key Delete dialog box, click Yes.

Exit Registry Editor.

有這一個漏洞的範例嗎？
想要分析可是不知從何下手
找不到ccfer 所說的 CQTStream::BuildMediaType(xx,xx)

再多一些提示：

signed int __stdcall CQTStream__BuildMediaType(int a1, signed int a2, int a3)
{
  __int64 ST0C_8_0; // ST0C_8@0
  int v4; // ebx@1
  unsigned __int32 *v5; // esi@1
  int v6; // edi@2
  signed int v7; // eax@4
  int v9; // esi@7
  int v10; // ST0C_4@11
  signed int v11; // ST0C_4@19
  signed __int16 v12; // si@20
  int v13; // edi@22
  unsigned __int16 v14; // cx@7
  __int16 v15; // ax@7
  unsigned __int16 v16; // ax@7
  int v17; // eax@19
  signed __int16 v18; // ax@20
  __int16 v19; // dx@20
  signed int v20; // edx@21
  int v21; // eax@23
  signed __int64 v22; // ST08_8@23
  int v23; // [sp+4C4h] [bp-70h]@1
  char v24; // [sp+48Ch] [bp-A8h]@7
  _WORD v25[3]; // [sp+4A6h] [bp-8Eh]@7
  char v26; // [sp+4A5h] [bp-8Fh]@7
  char v27; // [sp+4A4h] [bp-90h]@7
  __int16 v28; // [sp+4C0h] [bp-74h]@7
  int v29; // [sp+4B0h] [bp-84h]@7
  unsigned __int16 v30; // [sp+4BEh] [bp-76h]@7
  char v31; // [sp+4ADh] [bp-87h]@7
  char v32; // [sp+4ACh] [bp-88h]@7
  int v33; // [sp+4B4h] [bp-80h]@7
  unsigned __int16 v34; // [sp+4BCh] [bp-78h]@7
  int v35; // [sp+4B8h] [bp-7Ch]@7
  signed int v36; // [sp+490h] [bp-A4h]@7
  char v37; // [sp+4C8h] [bp-6Ch]@20
  _BYTE v38[31]; // [sp+4FBh] [bp-39h]@20
  char v39; // [sp+4FAh] [bp-3Ah]@20
  signed __int16 v40; // [sp+4EAh] [bp-4Ah]@20
  char v41; // [sp+4E9h] [bp-4Bh]@20
  char v42; // [sp+4E8h] [bp-4Ch]@20
  _WORD v43[3]; // [sp+51Ah] [bp-1Ah]@20
  int v44; // [sp+Ch] [bp-528h]@20
  int v45; // [sp+50h] [bp-4E4h]@20
  int v46; // [sp+40h] [bp-4F4h]@20
  int v47; // [sp+44h] [bp-4F0h]@20
  signed int v48; // [sp+3Ch] [bp-4F8h]@20
  signed __int16 v49; // [sp+4Ah] [bp-4EAh]@20
  __int16 v50; // [sp+48h] [bp-4ECh]@20
  int v51; // [sp+4CCh] [bp-68h]@20
  int v52; // [sp+4Ch] [bp-4E8h]@20
  char v53; // [sp+64h] [bp-4D0h]@21
  signed int v54; // [sp+5Ch] [bp-4D8h]@21
  char v55; // [sp+484h] [bp-B0h]@23
  signed __int64 v56; // [sp+34h] [bp-500h]@23
  __int16 v57; // [sp+524h] [bp-10h]@24
  int v58; // [sp+520h] [bp-14h]@24
  __int16 v59; // [sp+526h] [bp-Eh]@24
  signed int v60; // [sp+528h] [bp-Ch]@24
  signed int v61; // [sp+52Ch] [bp-8h]@24

  v4 = a1;
  v23 = a3;
  v5 = *(unsigned __int32 **)(a1 + 0x1A4);
  if ( a2 > 1 )
  {
    v6 = a2 - 1;
    do
    {
      v5 = (unsigned __int32 *)((char *)v5 + SwapDWORD(*v5));
      --v6;
    }
    while ( v6 );
  }
  v7 = *(_DWORD *)(v4 + 0x1B8);
  if ( v7 == 0x65646976 )
  {
    memcpy(&v37, v5, 0x58u);
    v38[v39] = 0;
    LOBYTE(v18) = HIBYTE(v40);
    HIBYTE(v18) = v40;
    LOBYTE(v19) = v41;
    HIBYTE(v19) = v42;
    v40 = v18;
    LOBYTE(v18) = HIBYTE(v43[0]);
    HIBYTE(v18) = (_BYTE)v43;
    v12 = v18;
    memset(&v44, 0, 0x468u);
    v45 = 0;
    v46 = v19;
    v47 = v40;
    v43[0] = v18;
    v48 = 40;
    v49 = v18;
    v50 = 1;
    v52 = v51;
    if ( v18 <= 8 )
    {
      v20 = 1 << (char)v43;
      memset(&v53, 0, 4 * (1 << (char)v43));
      v54 = v20;
    }
    v13 = v4 + 0x1C4;
    if ( *(_DWORD *)(v4 + 0x1C4) )
    {
      *(_DWORD *)&ST0C_8_0 = *(_DWORD *)(v4 + 0x1C8);
      v21 = CQTStream__SampleToRefTime(&v55, ST0C_8_0);
      *((_DWORD *)&v22 + 1) = (unsigned __int64)*(_DWORD *)v13 >> 32;
      *(_DWORD *)&v22 = *(_DWORD *)v13;
      v56 = *(_QWORD *)v21 / v22;
    }
    CMediaType__SetType(&MEDIATYPE_Video);
    v57 = 0;
    v58 = v52;
    v59 = 16;
    v60 = 0xAA000080u;
    v61 = 0x719B3800u;
    CMediaType__SetSubtype(&v58);
    CMediaType__SetFormat((int)&v44, (((v12 > 8) - 1) & 0x400) + 88);
    CMediaType__SetFormatType(FORMAT_VideoInfo);
    CMediaType__SetVariableSize();
    v11 = 1;
  }
  else
  {
    if ( v7 != 0x6E756F73 )
      return 0x80040265u;
    memcpy(&v24, v5, 0x24u);
    LOBYTE(v14) = HIBYTE(v25[0]);
    LOBYTE(v15) = v26;
    HIBYTE(v15) = v27;
    HIBYTE(v14) = (_BYTE)v25;
    v28 = 0;
    HIWORD(v29) = v15;
    v9 = v15;
    v25[0] = v14;
    v30 = v14;
    v16 = (v15 * (signed __int16)v14 + 7) / 8;
    LOBYTE(v14) = v31;
    HIBYTE(v14) = v32;
    v33 = v14;
    v34 = v16;
    v35 = v14 * v16;
    if ( v36 == 0x20776172 )
    {
      LOWORD(v29) = 1;
      CMediaType__SetFormat((int)&v29, 0x12u);
      CMediaType__SetSampleSize(v34);
      if ( (_WORD)v25 == 16 )
        *(_DWORD *)(v4 + 0x1DC) = 1;
    }
    else
    {
      if ( v36 == 0x34616D69 )
      {
        *(_DWORD *)(v4 + 0x1D8) = 1;
        LOWORD(v29) = 1;
        CMediaType__SetFormat((int)&v29, 0x12u);
        v10 = 34 * v9;
      }
      else
      {
        if ( v36 == 0x736F7774 )
        {
          LOWORD(v29) = 1;
          if ( (_WORD)v25 == 16 )
            *(_DWORD *)(v4 + 0x1DC) = 1;
          else
            *(_DWORD *)(v4 + 0x1D4) = 1;
        }
        else
        {
          LOWORD(v29) = v36;
        }
        CMediaType__SetFormat((int)&v29, 0x12u);
        v10 = v34;
      }
      CMediaType__SetSampleSize(v10);
    }
    CMediaType__SetType(&MEDIATYPE_Audio);
    CMediaType__SetFormatType(&FORMAT_WaveFormatEx);
    v17 = FOURCCMap__FOURCCMap((unsigned __int16)v29);
    CMediaType__SetSubtype(v17);
    v11 = 0;
  }
  CMediaType__SetTemporalCompression(v11);
  return 0;
}

是我編程還太弱了嗎..
看了一個下午還是看不太出來
請問是要對照QuickTime 的file format嗎？