Logfile of HijackThis v1.99.1
Scan saved at 17:33:10, on 2006-10-9
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Faronics\Deep Freeze\Install C-0\DF5Serv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Faronics\Deep Freeze\Install C-0\_$Df\FrzState2k.exe
C:\WINDOWS\system32\Clsmn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wxsyncli.exe
C:\Program Files\RainSoft\NDWtClient\WtClient.exe
C:\WINDOWS\system32\iscsiexe.exe
C:\Program Files\Fantasy\nzLandskcli\nzlancli.exe
C:\WINDOWS\system32\conime.exe
C:\WINDOWS\system32\rundll32.exe
H:\武林外传\element\ElementClient.exe
E:\MagicSet 7.6\MagicSet\internat.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.297\HijackThis.exe

R3 - Default URLSearchHook is missing
O2 - BHO: 超级兔子上网精灵 - {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} - E:\MagicSet 7.6\MagicSet\haokanbar.dll
O3 - Toolbar: 金山快译(&K) - {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} - G:\Kingsoft\FastAIT 2005\IEBand.dll (file missing)
O3 - Toolbar: (no name) - {F60C7D81-8471-4D40-AAFE-56D318F34C2D} - (no file)
O3 - Toolbar: 超级兔子上网精灵 - {43869BB3-22FD-4F15-9B46-238106BA2F4E} - E:\MagicSet 7.6\MagicSet\haokanbar.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] ; C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [NvCplDaemon] ; RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] ; nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] ; RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [wxClient] C:\WINDOWS\system32\Clsmn.exe
O4 - HKLM\..\Run: [ldkrun] C:\Program Files\Fantasy\nzLandskcli\ldkrun.exe
O4 - HKLM\..\RunOnce: [Super Rabbit Winspeed] "E:\MagicSet 7.6\MagicSet\winspeed.exe" /autokill:38
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Super Rabbit IEPro] E:\MagicSet 7.6\MagicSet\SRIECLI.EXE /LOAD
O4 - Startup: 腾讯QQ.lnk = D:\Program Files\Tencent\QQ\QQ.exe
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Program Files\Tencent\QQ\SendMMS.htm
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - I:\Program Files\浩方对战平台\GameClient.exe
O9 - Extra button: 新浪UC - {2253922F-1B26-4C74-8B57-E3AEE748DBB8} - D:\Program Files\sina\UC\uc.exe (file missing)
O9 - Extra button: kele8 - {84920E5F-3788-49cd-A274-E365578DF174} - http://www.kele8.com/ (file missing)
O9 - Extra 'Tools' menuitem: kele8 - {84920E5F-3788-49cd-A274-E365578DF174} - http://www.kele8.com/ (file missing)
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra button: 易趣购物 - {DE607141-AC19-421e-861A-1D70ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=5 (file missing)
O9 - Extra 'Tools' menuitem: 易趣购物 - {DE607141-AC19-421e-861A-1D70ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=5 (file missing)
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\QQ\QQIEHelper.dll (file missing)
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\QQ\QQIEHelper.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{F183472C-80A1-462B-995E-FDE525F7D951}: NameServer = 202.106.196.115,202.106.0.20
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: DfLogon - C:\WINDOWS\SYSTEM32\LogonDll.dll
O23 - Service: DF5Serv - Faronics Corporation - C:\Program Files\Faronics\Deep Freeze\Install C-0\DF5Serv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: NetZone LanDsk Client (nzLandskcli) - 上海网众信息技术有限公司 - C:\Program Files\Fantasy\nzLandskcli\nzlancli.exe
O23 - Service: Sicent Network File Synchronization (sicentnetsync) - 成都吉胜科技有限公司 - C:\WINDOWS\system32\wxsyncli.exe
O23 - Service: WtClient - Unknown owner - C:\Program Files\RainSoft\NDWtClient\WtClient.exe

用瑞星,卡巴,木马杀客,木马清道夫,兔子,优化大师都试过.无法解决.跪求各位高手帮助!

双击我的电脑，工具，文件夹选项，查看，单击选取“显示隐藏文件或文件夹”清除“隐藏受保护的操作系统文件（推荐）”复选框。在提示确定更改时，单击“是”，清除“隐藏已知文件类型的扩展名”
进入控制面版的添加删除程序中卸载IE-BAR

关闭所有浏览窗口以及一些不必要的程序
运行Hijackthis，扫描结束后在下列选项前打上勾，然后选"修复""（如果有的话）
R3 - Default URLSearchHook is missing
O3 - Toolbar: (no name) - {F60C7D81-8471-4D40-AAFE-56D318F34C2D} - (no file)
O9 - Extra button: 新浪UC - {2253922F-1B26-4C74-8B57-E3AEE748DBB8} - D:\Program Files\sina\UC\uc.exe (file missing)
O9 - Extra button: kele8 - {84920E5F-3788-49cd-A274-E365578DF174} - http://www.kele8.com/ (file missing)
O9 - Extra 'Tools' menuitem: kele8 - {84920E5F-3788-49cd-A274-E365578DF174} - http://www.kele8.com/ (file missing)
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: 易趣购物 - {DE607141-AC19-421e-861A-1D70ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=5 (file missing)
O9 - Extra 'Tools' menuitem: 易趣购物 - {DE607141-AC19-421e-861A-1D70ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=5 (file missing)
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\QQ\QQIEHelper.dll (file missing)
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\QQ\QQIEHelper.dll (file missing)
O23 - Service: DF5Serv - Faronics Corporation - C:\Program Files\Faronics\Deep Freeze\Install C-0\DF5Serv.exe
O23 - Service: NetZone LanDsk Client (nzLandskcli) - 上海网众信息技术有限公司 - C:\Program Files\Fantasy\nzLandskcli\nzlancli.exe
O23 - Service: Sicent Network File Synchronization (sicentnetsync) - 成都吉胜科技有限公司 - C:\WINDOWS\system32\wxsyncli.exe
O23 - Service: WtClient - Unknown owner - C:\Program Files\RainSoft\NDWtClient\WtClient.exe

删除
C:\WINDOWS\system32\wxsyncli.exe
C:\Program Files\Fantasy\nzLandskcli\nzlancli.exe
C:\Program Files\RainSoft\NDWtClient\WtClient.exe
C:\Program Files\Faronics\Deep Freeze\Install C-0\DF5Serv.exe

上述的：上海网众信息技术有限公司和成都吉胜科技有限公司如果是你有用的则不要修复
O23 - Service: NetZone LanDsk Client (nzLandskcli) - 上海网众信息技术有限公司 - C:\Program Files\Fantasy\nzLandskcli\nzlancli.exe
O23 - Service: Sicent Network File Synchronization (sicentnetsync) - 成都吉胜科技有限公司 - C:\WINDOWS\system32\wxsyncli.exe

不要删除
C:\WINDOWS\system32\wxsyncli.exe
C:\Program Files\Fantasy\nzLandskcli\nzlancli.exe

023项你先确定再修复


修复后,重启,还有异常,请下载SREng2 ，使用“智能扫描”，按下“扫描”按钮进行扫描，
扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告
日志文件内容复制-粘贴上来,,日志一次粘不完，分次粘完，请不要修改。

下载地址
http://www.kztechs.com/sreng/sreng2.zip
http://free5.ys168.com/?ufwihgu168

先谢谢这位大哥帮我分析了.不过我这是网吧.如果要弄的话一百多台机器不可能每台都这么做吧.而且好象是安装某个网络游戏后就开始出现这种情况.我们用的是网众的虚拟磁盘系统,所有游戏都在虚拟磁盘上的......所以我现在就想知道源头在哪...
马上就把SREng2下完了.下完了我再扫描一下.还得麻烦大哥您了......

C:\WINDOWS\system32\wxsyncli.exe
C:\Program Files\Fantasy\nzLandskcli\nzlancli.exe
C:\Program Files\RainSoft\NDWtClient\WtClient.exe
C:\Program Files\Faronics\Deep Freeze\Install C-0\DF5Serv.exe
这4项都不能删啊....
第一个是万象网管系统
第二个是网众虚拟磁盘系统
第三个是北京市公安局给网吧安装的摄相IP对照系统
第四个是冰点还原网络版客户端

还是弹网页.
2006-10-10,12:46:07

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Corporation]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Corporation]
    <WTBat><"C:\Program Files\RainSoft\NDWtClient\Wt.exe" 150 "C:\Program Files\RainSoft\NDWtClient\Wt.bat">  [N/A]
    <wxClient><C:\WINDOWS\system32\Clsmn.exe>  []
    <ldkrun><C:\Program Files\Fantasy\nzLandskcli\ldkrun.exe>  [上海网众信息技术有限公司]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <GinaDLL><C:\WINDOWS\system32\LogUser.dll>  [N/A]
    <UIHost><logonui.exe>  [(Verified)Microsoft Corporation]

==================================
启动文件夹
N/A

==================================
服务
[Human Interface Device Access / HidServ]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Spectrum24 Events Monitor / IPRIP]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\acss.dll><LINKMEDIA Tech>
[NVIDIA Display Driver Service / NVSvc]
  <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[NetMeeting Remote Desktop Agent / Nwsapagent]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\Nwsapagent.dll><LINKMEDIA Tech>
[NetZone LanDsk Client / nzLandskcli]
  <C:\Program Files\Fantasy\nzLandskcli\nzlancli.exe><上海网众信息技术有限公司>
[Sicent Network File Synchronization / sicentnetsync]
  <C:\WINDOWS\system32\wxsyncli.exe><成都吉胜科技有限公司>
[WtClient / WtClient]
  <C:\Program Files\RainSoft\NDWtClient\WtClient.exe><N/A>

==================================
驱动程序
[Service for Realtek AC97 Audio (WDM) / ALCXWDM]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[dtscsi / dtscsi]
  <\SystemRoot\System32\Drivers\dtscsi.sys><N/A>
[EagleNT / EagleNT]
  <\??\C:\WINDOWS\system32\drivers\EagleNT.sys><N/A>
[npkcrypt / npkcrypt]
  <\??\D:\Program Files\Tencent\QQ珊瑚虫2006\npkcrypt.sys><N/A>
[ntdisk / ntdisk]
  <C:\WINDOWS\SYSTEM32\DRIVERS\ntdisk.SYS><>
[nv / nv]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[nvatabus / nvatabus]
  <\SystemRoot\system32\DRIVERS\nvatabus.sys><NVIDIA Corporation>
[Service for NVIDIA(R) nForce(TM) Audio Enumerator / nvax]
  <system32\drivers\nvax.sys><NVIDIA Corporation>
[NVIDIA nForce Networking Controller Driver / NVENETFD]
  <system32\DRIVERS\NVENETFD.sys><NVIDIA Corporation>
[NVIDIA Network Bus Enumerator / nvnetbus]
  <system32\DRIVERS\nvnetbus.sys><NVIDIA Corporation>
[Service for NVIDIA(R) nForce(TM) Audio / nvnforce]
  <system32\drivers\nvapu.sys><NVIDIA Corporation>
[Padus ASPI Shell / pfc]
  <system32\drivers\pfc.sys><Padus, Inc.>
[Direct Parallel Link Driver / Ptilink]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Feitian ROCKEY4 Device Service / ROCKEYNT]
  <system32\DRIVERS\Rockey4.sys><Feitian Technologies Co., Ltd.>
[safnt / safnt]
  <C:\WINDOWS\SYSTEM32\DRIVERS\safnt.SYS><>
[Secdrv / Secdrv]
  <system32\DRIVERS\secdrv.sys><N/A>
[sptd / sptd]
  <\SystemRoot\System32\Drivers\sptd.sys><N/A>

==================================
浏览器加载项
[AcroIEHlprObj Class]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[SafeMe Internet Explorer Helper]
  {3AE06CEE-58A6-4F5F-AF89-6C5350842F16} <C:\WINDOWS\system32\SafeHelper12.dll, LINKMEDIA Tech>
[IE 4.x-5.x BHO in ObjectPascal]
  {49E0E0F0-5C30-11D4-945D-000000000000} <C:\WINDOWS\system32\IEHelper.dll, >
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <D:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[浩方对战平台]
  {0A155D3C-68E2-4215-A47A-E800A446447A} <I:\Program Files\浩方对战平台\GameClient.exe, 上海浩方在线信息技术有限公司>
[ICQ Lite]
  {B863453A-26C3-4e1f-A54D-A2CD196348E9} <D:\Program Files\ICQLite\ICQLite.exe, ICQ Ltd.>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <D:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[Yahoo! Messenger]
  {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} <D:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE, N/A>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[AcroIEHlprObj Class]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[SafeMe Internet Explorer Helper]
  {3AE06CEE-58A6-4F5F-AF89-6C5350842F16} <C:\WINDOWS\system32\SafeHelper12.dll, LINKMEDIA Tech>
[IE 4.x-5.x BHO in ObjectPascal]
  {49E0E0F0-5C30-11D4-945D-000000000000} <C:\WINDOWS\system32\IEHelper.dll, >
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <D:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[添加到QQ自定义面板]
  <D:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <D:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <D:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

正在运行的进程
[PID: 540][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 596][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 624][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\LogUser.dll]  [N/A, N/A]
[PID: 672][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 684][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 844][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 908][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1048][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [c:\windows\system32\nwsapagent.dll]  [LINKMEDIA Tech, 1, 5, 0, 4]
    [c:\windows\system32\acss.dll]  [LINKMEDIA Tech, 1, 5, 0, 4]
[PID: 1072][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1140][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1380][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\HookNamePwd.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\HookICQ.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\HookUC.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\QqHook.dll]  [N/A, N/A]
    [C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll]  [Adobe Systems Incorporated, 6.0.1.2003110300]
    [C:\WINDOWS\system32\IEHelper.dll]  [, 1.0.0.0]
    [C:\WINDOWS\system32\nvcpl.dll]  [NVIDIA Corporation, 6.14.10.8198]
    [C:\WINDOWS\system32\NVRSZHC.DLL]  [NVIDIA Corporation, 6.14.10.8198]
    [C:\WINDOWS\system32\nvshell.dll]  [N/A, N/A]
    [C:\PROGRA~1\WINZIP\WZSHLSTB.DLL]  [WinZip Computing, Inc., 4.1 (32-bit)]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, N/A]
    [D:\Program Files\ICQLite\ICQLiteShell.dll]  [, 20, 34, 2321, 0]
[PID: 1572][C:\WINDOWS\system32\Clsmn.exe]  [, 16.3.12.602]
    [C:\WINDOWS\system32\RegCode.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\HookNamePwd.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\HookICQ.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\HookUC.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\QqHook.dll]  [N/A, N/A]
[PID: 1596][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\HookNamePwd.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\HookICQ.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\HookUC.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\QqHook.dll]  [N/A, N/A]
[PID: 1748][C:\WINDOWS\system32\wxsyncli.exe]  [成都吉胜科技有限公司, 1.0.1.259]
    [C:\WINDOWS\system32\HookNamePwd.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\HookICQ.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\HookUC.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\QqHook.dll]  [N/A, N/A]
[PID: 1892][C:\WINDOWS\system32\wdfmgr.exe]  [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[PID: 1932][C:\Program Files\RainSoft\NDWtClient\WtClient.exe]  [N/A, N/A]
    [C:\WINDOWS\system32\QqHook.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\HookNamePwd.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\HookUC.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\HookICQ.dll]  [N/A, N/A]
[PID: 332][C:\WINDOWS\system32\iscsiexe.exe]  [Microsoft Corporation, 5.2.3790.279 built by: srv03_rtm(wmbla-s)]
[PID: 460][C:\Program Files\Fantasy\nzLandskcli\nzlancli.exe]  [上海网众信息技术有限公司, 1.0.0.83]
[PID: 1552][C:\WINDOWS\system32\rundll32.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\sdmAgent22.dll]  [LINKMEDIA Tech, 1, 5, 0, 7]
    [C:\WINDOWS\system32\HookNamePwd.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\HookICQ.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\HookUC.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\QqHook.dll]  [N/A, N/A]
[PID: 1620][E:\SREng\SREng.exe]  [Smallfrogs Studio, 2.2.6.605]
    [C:\WINDOWS\system32\HookNamePwd.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\HookICQ.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\HookUC.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\QqHook.dll]  [N/A, N/A]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost



另外.如果在弹出的网页的地址栏里直接输入其他网址进入其他网站,有时会弹出如附图所示的对话框

运行(双击)SRENG2，点“启动项目，服务，点“Win32服务应用程序”
勾选“隐藏微软服务”选中病毒服务
NetMeeting Remote Desktop Agent
Spectrum24 Events Monitor
，选择“删除服务”
点“设置”选择“否”

运行SREng2,使用“启动项目”－－注册表－－选中以下的项删除
C:\WINDOWS\system32\Clsmn.exe

删除：
C:\WINDOWS\system32\Nwsapagent.dll
C:\WINDOWS\system32\acss.dll
C:\WINDOWS\system32\HookNamePwd.dll
[C:\WINDOWS\system32\HookICQ.dll
[C:\WINDOWS\system32\HookUC.dll
[C:\WINDOWS\system32\QqHook.dll
C:\WINDOWS\system32\Clsmn.exe

修复后，请重新扫描上来