jpmegfvy.dll 路径C:\Program Files\jpmegfvy.dll
r3.exe 路径C:\Program Files\r3.exe
r4.exe 路径C:\Program Files\r4.exe
1[1].exe 路径C:\Documents and Settings\Bluewater\Local Settings\Temporary Internet Files\k94BWRC3\1[1].exe
在安全模式下也无法删除，请大家帮忙，谢谢

http://forum.ikaka.com/topic.asp?board=28&artid=6979213第4楼下载System Repair Engineer导出全部日志

2006-08-07,11:02:07

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 1 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><; C:\WINDOWS\System32\ctfmon.exe>  [Microsoft Corporation]
    <msnmsgr><; "C:\Program Files\MSN Messenger\msnmsgr.exe" /background>  [Microsoft Corporation]
    <updateMgr><; "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1>  []
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  []
    <run><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <QuickTime Task><"C:\Program Files\QuickTime\qttask.exe" -atboottime>  [Apple Computer, Inc.]
    <IMJPMIG8.1><; >  []
    <KAVPersonal50><; "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize>  [Kaspersky Lab]
    <KernelFaultCheck><; %systemroot%\system32\dumprep 0 -k>  []
    <msnappau><; >  []
    <PHIME2002A><; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [Microsoft Corporation]
    <PHIME2002ASync><; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [Microsoft Corporation]
    <RavMon><; >  []
    <RealTray><; >  []
    <TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,C:\FUCKKFC\FUCKKFC.COM>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><APIHookDll.dll>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [Microsoft Corporation]

==================================
启动文件夹
服务
[Application Gateway Poller / Gateway Poller]
  <><N/A>
[InstallDriver Table Manager / IDriverT]
  <C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe><Macrovision Corporation>
[iPodService / iPodService]
  <><N/A>
[kavsvc / kavsvc]
  <"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe"><Kaspersky Lab>
[Net Login Helper / netlog]
  <C:\WINDOWS\system32\SCardSer.exe ><N/A>
[NVIDIA Driver Helper Service / NVSvc]
  <C:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation>

==================================
浏览器加载项
[Adobe PDF Reader Link Helper]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <, N/A>
[NTIECatcher Class]
  {C56CB6B0-0D96-11D6-8C65-B2868B609932} <, N/A>
[新浪UC]
  {2253922F-1B26-4C74-8B57-E3AEE748DBB8} <C:\Program Files\sina\UC\uc.exe, 北京新浪信息技术有限公司>
[kele8]
  {84920E5F-3788-49cd-A274-E365578DF174} <http://www.kele8.com/, N/A>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <, N/A>
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[QuickTime Object]
  {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} <C:\Program Files\QuickTime\QTPlugin.ocx, Apple Computer, Inc.>
[Musicnotes Viewer]
  {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} <C:\WINDOWS\Downloaded Program Files\mnviewer.dll, Musicnotes, Inc.>
[WebActivater Control]
  {3D8F74EE-8692-4F8F-B8D2-7522E732519E} <C:\WINDOWS\System32\WEBACT~1.OCX, QQ>
[MSN Photo Upload Tool]
  {4F1E5B1A-2A80-42CA-8532-2D05CB959537} <C:\WINDOWS\Downloaded Program Files\MsnPUpld.dll, Microsoft? Corporation>
[Sinstaller Class]
  {88D758A3-D33B-45FD-91E3-67749B4057FA} <, N/A>
[ScorchPlugin Class]
  {A8F2B9BD-A6A0-486A-9744-18920D898429} <C:\Program Files\Internet Explorer\PLUGINS\NPSibelius.dll, N/A>
[Fc2Boot Class]
  {ABA7CC7F-019D-47DB-A0D2-B3C2B3AC1B44} <C:\WINDOWS\fcbox2\system\fc2boot.dll, 北京线线通科技开发有限公司>
[FcBoot Class]
  {C0C13879-6A17-429E-80F1-60B23FC1F720} <C:\WINDOWS\fcbox2\system\fcboot.dll, XXT>
[clienttime.client]
  {C5D0DFF5-6D39-4F98-88CD-12E8430A6300} <C:\WINDOWS\Downloaded Program Files\client.ocx, NTSC>
[SMI MapView Control]
  {CA828031-4325-11D4-BDB2-00105A776E78} <C:\WINDOWS\Downloaded Program Files\SMIWMap.dll, 上海市测绘院基础地理信息中心, Shanghai Municipal Instatute of Surveying & Mapping,毕俊, 021-62549550-8122, bj@smi.stn.sh.cn>
[IEDown Class]
  {D0A29C6C-AA71-4423-8C4A-5998B774C448} <C:\WINDOWS\System32\GLIEDown2.dll, 联众公司>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash8b.ocx, Macromedia, Inc.>
[&使用迅雷下载]
  <C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
  <C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
[使用影音传送带下载]
  <C:\Program Files\Xi\NetTransport\NTAddLink.html, N/A>
[使用影音传送带下载全部链接]
  <C:\Program Files\Xi\NetTransport\NTAddList.html, N/A>

==================================
正在运行的进程
[PID: 796][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 876][\??\C:\WINDOWS\system32\csrss.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 912][\??\C:\WINDOWS\system32\winlogon.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 956][C:\WINDOWS\system32\services.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 968][C:\WINDOWS\system32\lsass.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 1132][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1224][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1424][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1504][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1804][C:\WINDOWS\Explorer.EXE]  <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
    [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll]  <Adobe Systems, Inc.><7.0.0.0>
    [C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll]  <Thunder Networking Technologies,LTD><5, 0, 0, 2>
    [C:\Program Files\WinRAR\rarext.dll]  <N/A><N/A>
    [C:\Program Files\Power MP3 WMA Converter 2006\shellext.dll]  <CooolSoft><2.0.0.1>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\shellex.dll]  <Kaspersky Lab><5.0.388.1>
    [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll]  <Adobe Systems Incorporated><7.0.7.2006011200>
[PID: 364][C:\WINDOWS\System32\alg.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 536][C:\WINDOWS\System32\nvsvc32.exe]  <NVIDIA Corporation><6.13.10.4072>
[PID: 652][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1160][C:\WINDOWS\System32\wdfmgr.exe]  <Microsoft Corporation><5.2.3790.1230 built by: dnsrv(bld4act)>
[PID: 600][C:\Program Files\Maxthon\Max.exe]  <Maxthon International Ltd.><1, 5, 3, 18>
    [C:\Program Files\Maxthon\maxzlib.dll]  < ><1, 0, 0, 2>
    [C:\Program Files\Maxthon\Services\RealTime\real_time.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\scrchpg.dll]  <Kaspersky Lab><5.0.1.18>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\scrch_ag.dll]  <Kaspersky Lab><5.0.388.1>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\FSSync.dll]  <Kaspersky Lab><5.0.388.0>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\pr_rmt.dll]  <Kaspersky Lab><5.0.388.0>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\ccclient.dll]  <Kaspersky Lab><5.0.388.1>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\klipc.dll]  <Kaspersky Lab><5.0.388.0>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\KLUtil.dll]  <Kaspersky Lab><5.0.388.1>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\rpt.dll]  <Kaspersky Lab><5.0.388.2>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\CCIFACE.dll]  <Kaspersky Lab><5.0.388.1>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\prloader.dll]  <Kaspersky Lab><5.0.388.0>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\prkernel.ppl]  <Kaspersky Lab><5.0.388.0>
    [c:\program files\kaspersky lab\kaspersky anti-virus personal\prstring.ppl]  <Kaspersky Lab><5.0.388.0>
    [c:\program files\kaspersky lab\kaspersky anti-virus personal\pr_srv.ppl]  <Kaspersky Lab><5.0.388.0>
    [c:\program files\kaspersky lab\kaspersky anti-virus personal\pr_clnt.ppl]  <Kaspersky Lab><5.0.388.0>
    [c:\program files\kaspersky lab\kaspersky anti-virus personal\tempfile.ppl]  <Kaspersky Lab><5.0.388.0>
    [C:\WINDOWS\System32\Macromed\Flash\Flash8b.ocx]  <Macromedia, Inc.><8,0,24,0>
[PID: 1700][C:\Program Files\Tencent\QQ\TMDlls\TM.exe]  <N/A><N/A>
    [C:\Program Files\Tencent\QQ\TMDlls\BasicCtrlDll.dll]  <Tencent><0, 3, 3, 9>
    [C:\Program Files\Tencent\QQ\TMDlls\QQHelperDll.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\QQ\TMDlls\QQZip.dll]  <tencent><0, 3, 2, 4>
    [C:\Program Files\Tencent\QQ\TMDlls\QQBaseClassInDll.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\QQ\TMDlls\BaseUIClass.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\QQ\TMDlls\ImageOle.dll]  <TODO: <Company name>><1.0.0.1>
    [C:\Program Files\Tencent\QQ\TMDlls\QQAPI.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\QQ\TMDlls\TIMProxy.dll]  <tencent><0, 3, 2, 4>
    [C:\Program Files\Tencent\QQ\TMDlls\QQRes.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\QQ\TMDlls\WizardCtrl.dll]  <Tencent><1, 0, 0, 1>
    [C:\Program Files\Tencent\QQ\TMDlls\HostingMgr.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\QQ\TMDlls\QQMainFrame.dll]  <TENCENT><1, 0, 0, 1>
    [C:\Program Files\Tencent\QQ\TMDlls\NewSkin.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\QQ\TMDlls\CQQApplication.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\QQ\TMDlls\FrameBar.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\QQ\TMDlls\UserRelationWeight.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\QQ\TMDlls\QQConfigPlugin.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\QQ\TMDlls\CameraDll.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\QQ\TMDlls\QQGroupMng.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\QQ\TMDlls\QQAllInOne.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\QQ\TMDlls\CommercesMng.dll]  <><1, 0, 0, 1>
    [C:\WINDOWS\System32\msdmo.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\QQ\TMDlls\MiscCtrl.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\QQ\TMDlls\GroupConnection.dll]  <Tencent><0, 3, 3, 5>
    [C:\Program Files\Tencent\QQ\TMDlls\QQUdpGetFileLib.dll]  <tencent><0, 2, 2, 3>
    [C:\Program Files\Tencent\QQ\TMDlls\QQAddr.dll]  <深圳市腾讯计算机系统有限公司><0, 3, 0, 43>
    [C:\Program Files\Tencent\QQ\TMDlls\QQSpace.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\QQ\TMDlls\LongConnection.dll]  <tencent><0, 3, 3, 8>
    [C:\Program Files\Tencent\QQ\TMDlls\QQMMSender.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\QQ\TMDlls\QQPlugin.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\QQ\TMDlls\RemoteHelp.dll]  <><1, 0, 0, 1>
[PID: 660][C:\Program Files\Tencent\QQ\TMDlls\TIMPlatform.exe]  <tencent><0, 3, 1, 8>
    [C:\Program Files\Tencent\QQ\TMDlls\TIMProxy.dll]  <tencent><0, 3, 2, 4>
[PID: 3532][C:\Program Files\Iparmor\Iparmor.exe]  <luosoft.com><5.5.0.0>
    [C:\Program Files\Iparmor\getportlistxp.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Iparmor\hookhookdll.dll]  <N/A><N/A>
    [C:\Program Files\Iparmor\unrar.dll]  <N/A><N/A>
[PID: 2428][C:\Documents and Settings\Bluewater\桌面\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>
    [C:\Documents and Settings\Bluewater\桌面\SREng2\Plugins\SREngPluginDemo.SRE]  <Smallfrogs Studio><1, 1, 1, 0>

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

运行(双击)System Repair Engineer，点“启动项目，服务，点“Win32服务应用程序”勾选“隐藏微软服务”选中病毒服务Net Login Helper / netlog选择“删除服务”点“设置”选择“否”
重启后删除:
C:\WINDOWS\system32\SCardSer.exe

谢谢你，非常感谢。只是重启后找不到C:\WINDOWS\system32\SCardSer.exe这个文件

顶一下