========Title========
瑞星被病毒终止，完全不能重装，安全助手也不能运行
========Content========
我前几天回老家，不知谁用了我的电脑，染上了病毒，它终止了瑞星2007的运行，盗取了我的QQ密码，向所有好友发黄色广告。气死我了，还好QQ可以取回。它还自动弹出许多乱七八糟的网页，同时屏蔽了瑞星和诺顿，也不能安装卡巴斯基，360安全卫士也不能使用，双击后什么反应也没有。很麻烦，请各位高手帮忙。其他程序都能运行。这让我还不用重装。庆幸！
各位高手：
非常感谢您留心我这份系统诊断报告，诊断时间: 2007-04-24 10:19:07
诊断平台: Microsoft Windows XP Service Pack 2
IE版本: Internet Explorer V6.0.2900.2180 Build:62900.2180
计算机物理内存:255MB - 当前可用内存:100MB
O2 - 低危险 - BHO: (网页搜索) - [net help ] - {0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} - C:\WINDOWS\system32\nethelp.dll
O3 - 中危险 - Toolbar: (网页搜索) - [net seacher] - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - C:\WINDOWS\system32\sporder.dll
100 - 未知 - Process: RUNDLL2KXP.EXE [Run a DLL as an App] - C:\WINDOWS\SYSTEM32\RUNDLL2KXP.EXE C:\WINDOWS\SYSTEM32\WBEM\WATNK.DLL,Export 1087
R0 - 未知 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.jsing.net/index1.htm
R0 - 未知 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page=http://www.jsing.net/index1.htm
R0 - 未知 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page=http://www.jsing.net/index1.htm
R0 - 未知 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL=http://www.jsing.net/index1.htm
R0 - 未知 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL=http://www.jsing.net/index1.htm
R1 - 未知 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL=http://www.jsing.net/index1.htm
R1 - 未知 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL=http://www.jsing.net/index1.htm
R1 - 未知 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page=http://www.jsing.net/index1.htm
R1 - 未知 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page=http://www.jsing.net/index1.htm
R1 - 未知 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar=http://www.jsing.net/index1.htm
R1 - 未知 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://www.jsing.net/index1.htm
R1 - 未知 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=http://www.jsing.net/index1.htm
R1 - 未知 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=http://www.jsing.net/index1.htm
R1 - 未知 - HKCU\Software\Microsoft\Internet Explorer\Main,Use Search Asst=no
O2 - 未知 - BHO: (Info cache) - [Pctools Module] - {385AB8C6-FB22-4D17-8834-064E2BA0A6F0} - C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll
O3 - 未知 - Toolbar: (第三方IE工具栏) - [无效的CLSID:{1E796980-9CC5-11D1-A83F-00C04FC99D61}] - {1E796980-9CC5-11D1-A83F-00C04FC99D61} -
O4 - 未知 - HKLM\..\Run: [Share-to-Web Namespace Daemon] [] ; C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - 未知 - HKLM\..\Run: [msccrt] [] C:\WINDOWS\msccrt.exe
O4 - 未知 - HKLM\..\RunOnce: [avp6_post_uninstall] []
O8 - 未知 - Extra context menu item: &Net Search - res://C:\WINDOWS\system32\sporder.dll/MENUSEARCH.HTM
O8 - 未知 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - 未知 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm
O8 - 未知 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - 未知 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm
O9 - 未知 - Extra button: 网页搜索(HKLM) - C:\WINDOWS\system32\sporder.dll
O9 - 未知 - Extra button: 腾讯QQ(HKLM) - C:\Program Files\Tencent\QQ\QQ.EXE
O16 - 未知 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX) - [url=http://portal.gd-n-tax.gov.cn/wssw/ScriptX.cabhttp://portal.gd-n-tax.gov.cn/wssw/ScriptX.cab[/color[/url]]
O16 - 未知 - DPF: {17E3A1C3-EA8A-4970-AF29-7F54610B1D4C} (Certificates) - [url=http://htsw.yuan-heng.com.cn/capicom.cabhttp://htsw.yuan-heng.com.cn/capicom.cab[/color[/url]]
O16 - 未知 - DPF: {C09B522F-8AED-4E21-A65C-DC1AB652BAEE} (Tencent Safety Online Base Module) - [url=http://safe.qq.com/cgi-bin/tso/TSOBase.ocxhttp://safe.qq.com/cgi-bin/tso/TSOBase.ocx[/color[/url]]
O23 - 未知 - Service: Mercha2 [提供传输协议的数据安全保护机制，有效维护数据传输中的安全及完整。] - C:\WINDOWS\SYSTEM32\RUNDLL2KXP.EXE C:\WINDOWS\SYSTEM32\WBEM\WATNK.DLL,Export 1087 - (running)
O23 - 未知 - Service: Tech [启用内核的安全服务器，保护 Windows 的防火墙和内置过滤器正常运行。无法终止此服务。] - C:\WINDOWS\system32\ctbvx.dll - (running)
=======================================
=======================================
O40 - winlogon.exe - - C:\WINDOWS\system32\winlib .dll - -
O40 - svchost.exe - Microsoft Corporation - c:\windows\system32\ctbvx.dll - szdj - 505371e485c70c71eb67645ef4b9c222
O40 - Explorer.EXE - - C:\Program Files\Common Files\Microsoft Shared\MSINFO\C5D07FF0.dll - - d93d8938e5704cbaa2ef21a824050161
O40 - Explorer.EXE - Beijing Rising Technology Co., Ltd. - C:\WINDOWS\system32\RavExt.dll - Rising Shell Ext Module - fd0d1389219b779135ff6bc2086bac49
O40 - Explorer.EXE - - C:\WINDOWS\system32\qcjwn.dll - -
O40 - Explorer.EXE - - C:\WINDOWS\system32\mprss.dll - - 70df4b779a7b979628aade2051818354
O40 - Explorer.EXE - - C:\WINDOWS\system32\msccrt.dll - - fe79e76095c06d9db5f6f6b03f5fef3a
O40 - Explorer.EXE - Microsoft Corporation - C:\WINDOWS\system32\nethelp.dll - net help - 499afabb5700bd88cd01e1f446add0df
O40 - Explorer.EXE - Adobe Systems, Inc. - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll - PDF Shell Extension - 4b0991cd076b617a2231b19a6663c1c9
=======================================
O41 - 0000_sys - 0000_sys - C:\WINDOWS\system32\drivers\0000_sys.sys - (not running) - - -
O41 - Achernar - Achernar.sys - C:\WINDOWS\system32\drivers\Achernar.sys - (running) - Achernar.sys - An Chen Computer Co., Ltd. - 4848abf6d2f38c8a1f2138d4fe8f9455
O41 - acpidisk - acpidisk - C:\WINDOWS\system32\drivers\acpidisk.sys - (running) - - - 42e342839b6e4da55d542c9b4bc98cf9
O41 - ADProt - ADProt - C:\WINDOWS\system32\drivers\ADProt.sys - (not running) - - -
O41 - Aldebaran - Aldebaran.sys - C:\WINDOWS\system32\drivers\Aldebaran.sys - (running) - Aldebaran.sys - An Chen Computer Co., Ltd. - 03a26904786d78552b93bb4d64f0b72f
O41 - BaseTDI - basetdi - C:\WINDOWS\system32\drivers\basetdi.sys - (running) - basetdi - Beijing Rising Technology Co., Ltd. - 0064810c1b03f2c889130b669a4ce937
O41 - msqmx - msqmx - C:\WINDOWS\system32\drivers\msqmx.sys - (running) - - - 18e6682b1fafbfa7d894599042dc3d98
O41 - npkcrypt - nProtect KeyCrypt Driver - C:\Program Files\Tencent\QQ\npkcrypt.sys - (running) - nProtect KeyCrypt Driver - INCA Internet Co., Ltd. - 8bcb281a2540e7aff0cd00f9878fe21f
O41 - rsdt - RSDT Device Driver - C:\WINDOWS\system32\drivers\rsdt.sys - (running) - RSDT Device Driver - - 4d93edf140da02e188904708b4d19cb0
O41 - RsNTGDI - RsNTGDI - C:\WINDOWS\system32\drivers\RsNTGdi.sys - (running) - RsNTGDI - Beijing Rising Technology Co., Ltd. - 17214e7b192cb93ff014fca1484b97ad
O41 - Sense3 - SENSE3 I/O - C:\WINDOWS\system32\drivers\Sense3.sys - (running) - SENSE3 I/O - Microsoft Corporation - 4a4f97226ba84299ee1ff0d42140f05f
O41 - sgwur - sgwur - C:\WINDOWS\system32\drivers\sgwur.sys - (running) - - -
O41 - Superk5 - Superk5 I/O - C:\WINDOWS\system32\drivers\superk5.sys - (running) - Superk5 I/O - Microsoft Corporation - f2bd76cd7edbab70a6e4473ad3e0e461
O41 - usbsermpt - USB Modem Driver - C:\WINDOWS\system32\drivers\usbsermpt.sys - (not running) - USB Modem Driver - Microsoft Corporation - caad3467fbfae8a380f67e9c7150a85e
