我有一次按照网上一方法试过，有改过，可是重新启动后，又变回来了，改都改不了啊，怎么办啊，下面是我的日志：帮帮忙啊！！
Logfile of Kaka v2. 0. 0. 9 Scan Module v2. 0. 0. 1
Scan saved at 15:55:42, on 2006-09-07
Platform: Microsoft Windows XP Personal  (Build 2600)
MSIE: Internet Explorer v6.00 SP1; (6.00.2600.0000 (xpclient.010817-1148))


Running processes:
[SMSS.EXE]
CommandLine =

[CSRSS.EXE]
CommandLine = C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

[WINLOGON.EXE]
CommandLine = winlogon.exe

[SERVICES.EXE]
CommandLine = C:\WINDOWS\system32\services.exe

[LSASS.EXE]
CommandLine = C:\WINDOWS\system32\lsass.exe

[SVCHOST.EXE]
CommandLine = C:\WINDOWS\system32\svchost -k rpcss

[SVCHOST.EXE]
CommandLine = C:\WINDOWS\System32\svchost.exe -k netsvcs

[SVCHOST.EXE]
CommandLine = C:\WINDOWS\System32\svchost.exe -k NetworkService

[EXPLORER.EXE]
CommandLine = Explorer.exe 1

[SPOOLSV.EXE]
CommandLine = C:\WINDOWS\system32\spoolsv.exe

[SMSS.EXE]
CommandLine = C:\WINDOWS\SMSS.EXE

[YLive.exe]
CommandLine = "C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe"

[ashDisp.exe]
CommandLine = "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"

[LAUNCH~1.EXE]
CommandLine = "D:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" -onlytray

[CTFMON.EXE]
CommandLine = "C:\WINDOWS\System32\ctfmon.exe"

[Ad-Watch.exe]
CommandLine = "D:\Program Files\Aware绿色版\Ad-Watch.exe"

[PcSync2.exe]
CommandLine = "D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog

[AhnSDsv.exe]
CommandLine = "C:\Program Files\ZarvaSoft\Smart Update Utility\Ahnsdsv.exe"

[ALG.EXE]
CommandLine = C:\WINDOWS\System32\alg.exe

[aswUpdSv.exe]
CommandLine = "C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"

[ashServ.exe]
CommandLine = "C:\Program Files\Alwil Software\Avast4\ashServ.exe"

[RUNDLL32.EXE]
CommandLine = C:\WINDOWS\System32\rundll32.exe C:\DOCUME~1\t\TEMPLA~1\b8bfc8d\1.dll,Always

[SERVIC~1.EXE]
CommandLine = C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE -Embedding

[NVSVC32.EXE]
CommandLine = C:\WINDOWS\System32\nvsvc32.exe

[SVCHOST.EXE]
CommandLine = C:\WINDOWS\System32\svchost.exe -k imgsvc

[WDFMGR.EXE]
CommandLine = C:\WINDOWS\System32\wdfmgr.exe

[MPAPI3s.exe]
CommandLine = C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe -Embedding

[ZRundlll.exe]
CommandLine = C:\WINDOWS\System32\ZRundlll.exe -NetSata

[ashWebSv.exe]
CommandLine = "C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service

[ashMaiSv.exe]
CommandLine = "C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service

[IEXPLORE.EXE]
CommandLine = IEXPLORE.EXE

[QQ.exe]
CommandLine = "D:\Program Files\Tencent\QQ\QQ.exe"

[TIMPlatform.exe]
CommandLine = "D:\Program Files\Tencent\QQ\TIMPlatform.exe" -Embedding

[Repair.exe]
CommandLine = "C:\Program Files\Rising\KakaToolBar\Repair.exe"

[KkScan.exe]
CommandLine = "C:\Program Files\Rising\KakaToolBar\KkScan.exe"

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\System32\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.7939.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=%SystemRoot%\system32\blank.htm
R3 - Default URLSearchHook is missing
F0 - system.ini: Shell=Explorer.exe 1
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\System32\kakatool.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [PcSync] D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [AWMON] "D:\Program Files\Aware绿色版\Ad-Watch.exe"
O4 - HKCU\..\Run: [Realplayer.exe] C:\WINDOWS\System32\Realplayer.exe
O4 - HKLM\..\Run: [TkBellExe] rem "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [Thunder] rem d:\Program Files\Thunder Network\Thunder\Thunder.exe /s
O4 - HKLM\..\Run: [YLive.exe] C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
O4 - HKLM\..\Run: [yassistse] "C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"
O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray
O4 - HKLM\..\Run: [Baigoo.exe] C:\PROGRA~1\baigoo\Baigoo.exe
O4 - HKLM\..\Run: [TProgram] C:\WINDOWS\SMSS.EXE
O4 - HKLM\..\Run: [Realplayer.exe] C:\WINDOWS\System32\Realplayer.exe
O4 - HKLM\..\RunServices: [TProgram] C:\WINDOWS\SMSS.EXE
O4 - Startup: desktop.ini =
O4 - Startup: 腾讯QQ.lnk = D:\Program Files\Tencent\QQ\QQ.exe
O4 - Global Startup: desktop.ini =
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Program Files\Tencent\QQ\SendMMS.htm
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
O16 - DPF: DirectAnimation Java Classes - file://C:\WINDOWS\System32\dajava.cab
O16 - DPF: Internet Explorer Classes for Java - file://C:\WINDOWS\System32\iejava.cab
O16 - DPF: {098A3F72-3110-4004-B954-2F9DC44934B4} (AddSHCARoot Control) - http://61.175.132.234/livingcast/AddSHCARootCert.cab
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/normalbank/AxSafeControls.cab
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/pcver2006new/OL2006.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{68DE8CF6-3197-4F8B-8F82-084D0E259ACD}: NameServer = 61.153.177.197 61.153.177.201
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\System32\msvidctl.dll
O18 - Protocol: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll
O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: lid - {5C135180-9973-46D9-ABF4-148267CBB8BF} - C:\WINDOWS\System32\msvidctl.dll
O18 - Protocol: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\System32\inetcomm.dll
O18 - Protocol: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll
O18 - Protocol: msdaipp - (no CLSID) - (no file)
O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\System32\msvidctl.dll
O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINDOWS\System32\msdxm.ocx
O18 - Protocol: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\System32\wiascr.dll
O21 - SSODL: DelayRun - {5A6F2F95-3191-433B-8533-EB0B596A7BAC} - C:\WINDOWS\System32\4e9d4ee0.dll
O23 - Service: Ahnlab Task Scheduler (Ahnlab Task Scheduler) - Ahnlab, Inc. - "C:\Program Files\ZarvaSoft\Smart Update Utility\Ahnsdsv.exe"
O23 - Service: Application Management (AppMgmt) -  - C:\WINDOWS\System32\svchost.exe -k netsvcs
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) -  - "C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"
O23 - Service: avast! Antivirus (avast! Antivirus) -  - "C:\Program Files\Alwil Software\Avast4\ashServ.exe"
O23 - Service: avast! Mail Scanner (avast! Mail Scanner) - ALWIL Software - "C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service
O23 - Service: avast! Web Scanner (avast! Web Scanner) - ALWIL Software - "C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service
O23 - Service: Human Interface Device Access (HidServ) -  - C:\WINDOWS\System32\svchost.exe -k netsvcs
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe"
O23 - Service: iPodService (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MonSvcNT (MonSvcNT) - Ahnlab, Inc. - C:\PROGRA~1\ZARVAS~1\ZVC\MonSvcNT.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: User Profile Hive Cleanup (UPHClean) -  - C:\Program Files\UPHClean\uphclean.exe
O23 - Service: WinKld (WinKld) -  - C:\WINDOWS\System32\rundll32.exe "c:\progra~1\winkld\winkld.dll",run -r
O23 - Service: Windows Rwxz (ZRundlll) -  - C:\WINDOWS\System32\zrundlll.exe -netsata

控制面板－－管理工具－－服务－－查找Windows Rwxz －－启动类型－－已禁用－－服务状态－－停止

在任务管理器中结束进程
SMSS.EXE

删除：
C:\WINDOWS\SMSS.EXE
C:\WINDOWS\System32\zrundlll.exe
C:\WINDOWS\System32\4e9d4ee0.dll

O4 - HKLM\..\Run: [Realplayer.exe] C:\WINDOWS\System32\Realplayer.exe
启动项
C:\WINDOWS\system32\Realplayer.exe
C:\WINDOWS\system32\Realplayer.exe
运行中的程序
C:\WINDOWS\system32\brlmon.dll

解决方法
解决方法如下
双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示确定更改时，单击“是”，清除“隐藏已知文件类型的扩展名
ALT+CTRL+DELETE调出任务管理器,终止explorer.exe 还有Realplayer.exe的进程
点“文件”“新任务”“浏览”找到C:\WINDOWS\system32\Realplayer.exe
删除Realplayer.exe
点“文件”“新任务”“浏览”找到C:\WINDOWS\explorer.exe,双击打开
请下载SRENG2,下载地址：http://free5.ys168.com/?ufwihgu168
运行(双击)System Repair Engineer，使用“启动项目，注册表”来删除以下选项。
C:\WINDOWS\system32\Realplayer.exe
C:\WINDOWS\system32\Realplayer.exe
删除
C:\WINDOWS\system32\brlmon.dll
把主页改回来。

修复后，重启

使用“智能扫描”，按下“扫描”按钮进行扫描，
扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告
日志文件内容复制-粘贴上来,,日志一次粘不完，分次粘完，请不要修改。