HijackThis_zww汉化版扫描日志 V1.99.1
保存于      20:53:51, 日期 2006-02-05
操作系统：  Windows 2000 SP4 (WinNT 5.00.2195)
浏览器：    Internet Explorer v6.00 SP1 (6.00.2800.1106)

当前运行的进程：         
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\nvsvc32.exe
C:\RAD\r_server.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\SAND\qqfacerclient.exe
C:\WINNT\system32\VPort1.1.exe
C:\WINNT\services.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
E:\拨号软件\WrOS.EXE
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
E:\拨号软件\WinPPPoverEthernet.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINNT\system32\NTdhcp.exe
C:\WINNT\sllserv.exe
C:\WINNT\system32\svchoxt.exe
C:\Program Files\BullsEye Network\bin\bargains.exe
C:\Program Files\NaviSearch\bin\nls.exe
C:\WINNT\system32\conime.exe
C:\Program Files\Network\network.exe
F:\hj\HijackThis1991zww.exe

R3 - URLSearchHook: MyURLSearchHook Class - {982CB676-38F0-4D9A-BB72-D9371ABE876E} - C:\Program Files\P4P\ToolBar.dll
R3 - URLSearchHook: SgUrlSearHook Class - {BAB1AC41-6FF7-4F2E-A04E-5C592CCFEA7D} - C:\WINNT\system32\socul.dll
R3 - URLSearchHook: QQ Search Hook - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - C:\Program Files\TENCENT\AddrPlus\IEHelp.dll
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,C:\WINNT\ .exe
O2 - BHO: Tencent Browser Helper - {0C7C23EF-A848-485B-873C-0ED954731014} - (no file)
O2 - BHO: CNNIC_IDN - {35980F6E-A137-4E50-953D-813BB8556899} - C:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll
O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINNT\system32\nvms.dll
O2 - BHO: MacroMediapd - {B8CCDD47-38E4-4CD2-B7FA-3B4B690F74BD} - C:\WINNT\system32\microapmddt.dll
O2 - BHO: IEHlprObj Class - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files\Internet Explorer\lib\stdie.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINNT\system32\msbe.dll
O3 - IE工具栏增项: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - IE工具栏增项: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINNT\system32\KakaTool.dll
O3 - IE工具栏增项: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll
O4 - 启动项HKLM\\Run: [Synchronization Manager] mobsync.exe /logon
O4 - 启动项HKLM\\Run: [WinPoET] E:\拨号软件\WinPPPoverEthernet.exe
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - 启动项HKLM\\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - 启动项HKLM\\Run: [ClamWin] "C:\Program Files\ClamWin\bin\ClamTray.exe" --logon
O4 - 启动项HKLM\\Run: [NTdhcp] C:\WINNT\system32\NTdhcp.exe
O4 - 启动项HKLM\\Run: [Net] C:\WINNT\sllserv.exe
O4 - 启动项HKLM\\Run: [] helper
O4 - 启动项HKLM\\Run: [Update] C:\Program Files\Common Files\UPDATE\Update.exe
O4 - 启动项HKLM\\Run: [res] C:\WINNT\system32\bsd.exe
O4 - 启动项HKLM\\Run: [AddrPlus3] C:\PROGRA~1\TENCENT\AddrPlus\Runner.exe C:\PROGRA~1\TENCENT\AddrPlus\QAHook.dll Rundll32
O4 - 启动项HKLM\\Run: [Winhoxt] C:\WINNT\system32\svchoxt.exe
O4 - 启动项HKLM\\Run: [winsysupd] C:\windows\winsysupd5.exe
O4 - 启动项HKLM\\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - 启动项HKLM\\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe
O4 - 启动项HKLM\\Run: [Network] C:\Program Files\Network\network.exe
O4 - HKCU\..\Run: [update8] C:\WINNT\aupdate.exe
O4 - HKCU\..\Run: [uninstallex.exe] C:\WINNT\uninstallex.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm
O9 - 浏览器额外的按钮: 中文上网 - {35980F6E-A137-4E50-953D-813BB8556899} - C:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll
O9 - 浏览器额外的“工具”菜单项: 中文上网 - {35980F6E-A137-4E50-953D-813BB8556899} - C:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O10 - 未知的文件在 Winsock LSP: c:\winnt\system32\cdnns.dll
O11 - Options group: [!CNS]  网络实名
O11 - Options group: [!IESearch] !IESearch
O11 - Options group: [CDNCLIENT]  中文上网
O11 - Options group: [TBH]  QQ地址栏搜索插件
O16 - DPF: {56A7DC70-E102-4408-A34A-AE06FEF01586} (天下搜索) - http://iebar.t2t2.com/iebar.cab
O16 - DPF: {98A62E3F-A8C5-4EF0-8A00-C70CF9D18A89} (LoaderCore Class) - http://tb.sogou.com/DLLoader.cab
O16 - DPF: {9A578C98-3C2F-4630-890B-FC04196EF420} (CNNIC_IDN) - http://jump.cnnic.cn/stat/stat?sid=0008&debug=false&pid=c_admin88&url=http://client.jogo.cn/download/cnnic/cdn.cab
O16 - DPF: {C14D003A-DA41-4FEE-8204-62A94EAA29D1} (GLWebAvt Control) - http://bbs.ourgame.com/image/GLWebAvt.cab
O16 - DPF: {DA984A6D-508E-11D6-AA49-0050FF3C628D} (Ravonline) - http://download.rising.com.cn/QQ/QQkill/rsonline.cab
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/Ver2005/OL2005.cab
O20 - AppInit_DLLs: KB3999521.LOG
O23 - NT 服务: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - NT 服务: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - NT 服务: Remote Administrator Service (r_server) - Unknown owner - C:\RAD\r_server.exe" /service (file missing)
O23 - NT 服务: Telnetl (Telneti) - Unknown owner - C:\WINNT\win1ogn.exe
O23 - NT 服务: QQFace (Universal Disk Manager) - COMENET TECHNOLOGY - C:\Program Files\Common Files\SAND\qqfacerclient.exe
O23 - NT 服务: VPort2005_In_Lan (VPort2005_Lan) - Unknown owner - C:\WINNT\system32\VPort1.1.exe
O23 - NT 服务: Microsoft Windows HelpFile (Windows Helpfile) - Unknown owner - C:\WINNT\services.exe
O23 - NT 服务: WinPPPoverEthernet - iVasion, a Routerware Company - E:\拨号软件\WrOS.EXE
O23 - NT 服务: Win_xp - Unknown owner - C:\WINNT\Wupdate.exe

是中鸽子了，看来还很多哦。等等啊

F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,C:\WINNT\ .exe
O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINNT\system32\nvms.dll
O2 - BHO: IEHlprObj Class - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files\Internet Explorer\lib\stdie.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINNT\system32\msbe.dll
O4 - 启动项HKLM\\Run: [NTdhcp] C:\WINNT\system32\NTdhcp.exe
O4 - 启动项HKLM\\Run: [Net] C:\WINNT\sllserv.exe
O4 - 启动项HKLM\\Run: [] helper
O4 - 启动项HKLM\\Run: [Update] C:\Program Files\Common Files\UPDATE\Update.exe
O4 - 启动项HKLM\\Run: [res] C:\WINNT\system32\bsd.exe
O4 - 启动项HKLM\\Run: [Winhoxt] C:\WINNT\system32\svchoxt.exe
O4 - 启动项HKLM\\Run: [Network] C:\Program Files\Network\network.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O4 - HKCU\..\Run: [update8] C:\WINNT\aupdate.exe
O4 - HKCU\..\Run: [uninstallex.exe] C:\WINNT\uninstallex.exe
O23 - NT 服务: Telnetl (Telneti) - Unknown owner - C:\WINNT\win1ogn.exe
O23 - NT 服务: QQFace (Universal Disk Manager) - COMENET TECHNOLOGY - C:\Program Files\Common Files\SAND\qqfacerclient.exe
O23 - NT 服务: VPort2005_In_Lan (VPort2005_Lan) - Unknown owner - C:\WINNT\system32\VPort1.1.exe
O23 - NT 服务: Microsoft Windows HelpFile (Windows Helpfile) - Unknown owner - C:\WINNT\services.exe
O23 - NT 服务: Win_xp - Unknown owner - C:\WINNT\Wupdate.exe



建议重装系统。

老大```这个毒是影响我的机器还是要乱收我的钱啊（我听说鸽子是别人可以用你的网买东西）

Logfile of Kaka v2. 0. 0. 7 Scan Module v2. 0. 0. 1
Scan saved at 00:28:24, on 2006-02-06
Platform: Microsoft Windows 2000 Professional Service Pack 4 (Build 2195)
MSIE: Internet Explorer v6.00 SP1;Q832894;Q837009;Q831167;Q833989;Q823353; (6.00.2800.1106)


Running processes:
[smss.exe]
CommandLine =

[csrss.exe]
CommandLine = C:\WINNT\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

[winlogon.exe]
CommandLine = winlogon.exe

[services.exe]
CommandLine = C:\WINNT\system32\services.exe

[lsass.exe]
CommandLine = C:\WINNT\system32\lsass.exe

[svchost.exe]
CommandLine = C:\WINNT\system32\svchost -k rpcss

[spoolsv.exe]
CommandLine = C:\WINNT\system32\spoolsv.exe

[command.exe]
CommandLine = C:\WINNT\0+resQ\command.exe

[svchost.exe]
CommandLine = C:\WINNT\system32\svchost.exe -k netsvcs

[netmon.exe]
CommandLine = "C:\Program Files\Network Monitor\netmon.exe" service

[nvsvc32.exe]
CommandLine = C:\WINNT\system32\nvsvc32.exe

[r_server.exe]
CommandLine = "C:\RAD\r_server.exe" /service

[MSTask.exe]
CommandLine = C:\WINNT\system32\MSTask.exe

[stisvc.exe]
CommandLine = C:\WINNT\system32\stisvc.exe

[IEXPLORE.EXE]
CommandLine = "C:\Program Files\Internet Explorer\IEXPLORE.EXE"

[qqfacerclient.e]
CommandLine = "C:\Program Files\Common Files\SAND\qqfacerclient.exe"

[VPort1.1.exe]
CommandLine = C:\WINNT\system32\VPort1.1.exe

[services.exe]
CommandLine = "C:\WINNT\services.exe"

[WinMgmt.exe]
CommandLine = C:\WINNT\System32\WBEM\WinMgmt.exe

[WrOS.EXE]
CommandLine = E:\拨号软件\WrOS.EXE

[svchost.exe]
CommandLine = C:\WINNT\system32\svchost.exe -k wugroup

[Explorer.EXE]
CommandLine = C:\WINNT\Explorer.EXE

[WinPPPoverEther]
CommandLine = "E:\拨号软件\WinPPPoverEthernet.exe"

[realsched.exe]
CommandLine = "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[bargains.exe]
CommandLine = "C:\Program Files\BullsEye Network\bin\bargains.exe"

[nls.exe]
CommandLine = "C:\Program Files\NaviSearch\bin\nls.exe"

[winsysban5.exe]
CommandLine = "C:\winsysban5.exe"

[wjtd161a.exe]
CommandLine = "C:\Documents and Settings\Administrator\桌面\wjtd161a.exe"

[wjtd161a.exe]
CommandLine = "C:\Documents and Settings\Administrator\桌面\wjtd161a.exe"

[wjtd161a.exe]
CommandLine = "C:\Documents and Settings\Administrator\桌面\wjtd161a.exe"

[wjtd161a.exe]
CommandLine = "C:\Documents and Settings\Administrator\桌面\wjtd161a.exe"

[wjtd161a.exe]
CommandLine = "C:\Documents and Settings\Administrator\桌面\wjtd161a.exe"

[wjtd161a.exe]
CommandLine = "C:\Documents and Settings\Administrator\桌面\wjtd161a.exe"

[μ*){Fh V0.3.ex]
CommandLine = "F:\倚天\纵横倚天\纵横倚天登陆器 V0.3.exe"

[jdbb.EXE]
CommandLine = "C:\Documents and Settings\Administrator\桌面\简单宝贝破解版内挂\jdbb1.28沙滩本地验证无错版\jdbb.EXE"

[IEXPLORE.EXE]
CommandLine = "C:\Program Files\Internet Explorer\iexplore.exe" -nohome

[KkScan.exe]
CommandLine = "C:\Program Files\Rising\KakaToolBar\KkScan.exe"

R3 - URLSearchHook: MyURLSearchHook Class - {982CB676-38F0-4D9A-BB72-D9371ABE876E} - C:\Program Files\P4P\ToolBar.dll
R3 - URLSearchHook: SgUrlSearHook Class - {BAB1AC41-6FF7-4F2E-A04E-5C592CCFEA7D} - C:\WINNT\system32\socul.dll
R3 - URLSearchHook: QQ Search Hook - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - C:\Program Files\TENCENT\AddrPlus\IEHelp.dll
O2 - BHO: Tencent Browser Helper - {0C7C23EF-A848-485B-873C-0ED954731014} -  (file missing)
O2 - BHO: CNNIC_IDN - {35980F6E-A137-4E50-953D-813BB8556899} - C:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll
O2 - BHO: MacroMediapd - {B8CCDD47-38E4-4CD2-B7FA-3B4B690F74BD} - C:\WINNT\system32\microapmddt.dll
O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINNT\system32\KakaTool.dll
O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [WinPoET] E:\拨号软件\WinPPPoverEthernet.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ClamWin] "C:\Program Files\ClamWin\bin\ClamTray.exe" --logon
O4 - HKLM\..\Run: [AddrPlus3] C:\PROGRA~1\TENCENT\AddrPlus\Runner.exe C:\PROGRA~1\TENCENT\AddrPlus\QAHook.dll Rundll32
O4 - HKLM\..\Run: [winsysupd] C:\windows\winsysupd5.exe
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe
O4 - HKLM\..\Run: [gimmygames] C:\\gimmygames.exe
O4 - HKLM\..\Run: [winsysban] c:\\winsysban5.exe
O4 - HKLM\..\Run: [ntdll.dll] C:\\winsysban5.exe
O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm
O9 - Extra Button: 中文上网 - {35980F6E-A137-4E50-953D-813BB8556899} - C:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll
O9 - Extra 'Tools' menuitem: 中文上网 - {35980F6E-A137-4E50-953D-813BB8556899} - C:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll
O9 - Extra Button: @shdoclc.dll,-866 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: @shdoclc.dll,-864 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\system32\shdocvw.dll
O10 - Unknown file in Winsock LSP: C:\WINNT\system32\cdnns.dll
O11 - Options group: [!CNS]  网络实名
O11 - Options group: [!IESearch] !IESearch
O11 - Options group: [CDNCLIENT]  中文上网
O11 - Options group: [TBH]  QQ地址栏搜索插件
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
O16 - DPF: {56A7DC70-E102-4408-A34A-AE06FEF01586} (天下搜索) - http://iebar.t2t2.com/iebar.cab
O16 - DPF: {98A62E3F-A8C5-4EF0-8A00-C70CF9D18A89} (LoaderCore Class) - http://tb.sogou.com/DLLoader.cab
O16 - DPF: {9A578C98-3C2F-4630-890B-FC04196EF420} (CNNIC_IDN) - http://jump.cnnic.cn/stat/stat?sid=0008&debug=false&pid=c_admin88&url=http://client.jogo.cn/download/cnnic/cdn.cab
O16 - DPF: {C14D003A-DA41-4FEE-8204-62A94EAA29D1} (GLWebAvt Control) - http://bbs.ourgame.com/image/GLWebAvt.cab
O16 - DPF: {DA984A6D-508E-11D6-AA49-0050FF3C628D} (Ravonline) - http://download.rising.com.cn/QQ/QQkill/rsonline.cab
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/Ver2005/OL2005.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5F5CBC8A-391E-4929-BC24-E5856CF6041C}: NameServer = 61.137.94.195 202.103.96.112
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll
O18 - Protocol: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: ipp - (no CLSID) - (no file)
O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINNT\system32\itss.dll
O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll
O18 - Protocol: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll
O18 - Protocol: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINNT\system32\inetcomm.dll
O18 - Protocol: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINNT\system32\itss.dll
O18 - Protocol: msdaipp - (no CLSID) - (no file)
O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll
O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINNT\system32\mshtml.dll
O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll
O18 - Protocol: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINNT\system32\msdxm.ocx
O20 - AppInit_DLLs: KB3999521.LOG
O20 - Winlogon Notify: wzcnotif
O23 - Service: Command Service (cmdService) -  - C:\WINNT\0+resQ\command.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\system32\dmadmin.exe /com
O23 - Service: Network Monitor (Network Monitor) -  - C:\Program Files\Network Monitor\netmon.exe service
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: Remote Administrator Service (r_server) -  - "C:\RAD\r_server.exe" /service
O23 - Service: Telnetl (Telneti) -  - C:\WINNT\win1ogn.exe
O23 - Service: QQFace (Universal Disk Manager) - COMENET TECHNOLOGY - C:\Program Files\Common Files\SAND\qqfacerclient.exe
O23 - Service: User Privilege Service (usprserv) - Microsoft Corporation - C:\WINNT\system32\svchost.exe -k netsvcs
O23 - Service: VPort2005_In_Lan (VPort2005_Lan) -  - C:\WINNT\system32\vport1.1.exe
O23 - Service: Microsoft Windows HelpFile (Windows Helpfile) -  - "C:\WINNT\services.exe"
O23 - Service: WinPPPoverEthernet (WinPPPoverEthernet) - iVasion, a Routerware Company - E:\拨号软件\WrOS.EXE
O23 - Service: Win_xp (Win_xp) -  - C:\WINNT\Wupdate.exe

这个还有问题吗？我已经修复过了的，麻烦你帮我看看了`谢谢！

不知道您是如何修复的，越来越多

开始→控制面板→管理工具→服务→分别查找Command Service、Telnetl 、QQFace、Microsoft Windows HelpFile、Win_xp→右击→属性→启动类型→禁止→应用→停止→确定。

重新启动电脑, 开机检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式进入Windows

修复

R3 - URLSearchHook: SgUrlSearHook Class - {BAB1AC41-6FF7-4F2E-A04E-5C592CCFEA7D} - C:\WINNT\system32\socul.dll
O2 - BHO: MacroMediapd - {B8CCDD47-38E4-4CD2-B7FA-3B4B690F74BD} - C:\WINNT\system32\microapmddt.dll
O4 - HKLM\..\Run: [winsysupd] C:\windows\winsysupd5.exe
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe
O4 - HKLM\..\Run: [gimmygames] C:\\gimmygames.exe
O4 - HKLM\..\Run: [winsysban] c:\\winsysban5.exe
O4 - HKLM\..\Run: [ntdll.dll] C:\\winsysban5.exe
O16 - DPF: {56A7DC70-E102-4408-A34A-AE06FEF01586} (天下搜索) - http://iebar.t2t2.com/iebar.cab
O20 - AppInit_DLLs: KB3999521.LOG

到控制面板卸载BullsEye Network、NaviSearch

显示隐藏文件

双击我的电脑--工具---文件夹选项--查看选项卡--单击选取"显示隐藏文件或文件夹"--清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示您确定更改时，单击“是”--单击“确定”。

然后找到如下文件并删除（如果有的话）。

C:\WINNT\system32\socul.dll
C:\WINNT\system32\microapmddt.dll
C:\windows\winsysupd5.exe
C:\Program Files\BullsEye Network\整个目录
C:\Program Files\NaviSearch\整个目录
C:\\gimmygames.exe
c:\\winsysban5.exe
KB3999521.LOG（请用开始菜单中的搜索功能查找）
C:\WINNT\0+resQ\command.exe
C:\WINNT\win1ogn.exe
C:\WINNT\win1ogn.dll
C:\WINNT\win1ogn_hook.dll
C:\WINNT\win1ognkey.dll
C:\Program Files\Common Files\SAND\整个目录
C:\WINNT\services.exe
C:\WINNT\services.dll
C:\WINNT\services_hook.dll
C:\WINNT\serviceskey.dll
C:\WINNT\Wupdate.exe
C:\WINNT\Wupdate.dll
C:\WINNT\Wupdate_hook.dll
C:\WINNT\Wupdatekey.dll

O23 - Service: Remote Administrator Service (r_server) - - "C:\RAD\r_server.exe" /service

这一项如果不是您自己安装的，也请卸载