疑是3448变种病毒卷土重来..求救！！随贴已附日志！！因日志过长。。无法一次放上来。。所以分两部分。。。

中毒特征跟3448类似。。。一运行杀毒软件就自动关机。。安全模式无法进入，直接转为重启动。。。IE可以运行，百度知道可以打开。。但是卡卡社区和瑞星在线杀毒被屏闭，点击进入卡卡社区和瑞星在线杀毒直接转为cn.yahoo.com。。。卡卡助手无法安装。。一点击安装包就死机。。。

本人电脑98+XP双系统。。。但是在98系统装了卡卡助手，在未知病毒查杀那里却显示加载家族病毒特征库失败!。。所以一直无法查杀病毒。。。请坛主大大急救。。。。

PS。最近两天本人搜索各大搜索引擎。。却发现很多跟我一样的中毒者无法上卡卡社区或者瑞星相关论坛求救。。估计是该病毒继3448被卡卡阻杀以后进化变种。。针对当时有效杀除3448的各大杀毒软件论坛进行屏闭，所以很多人无法求救。。。请紧急解决。。！！！！！

PS：本人在QQ文件夹内找出3个病毒程序，名为0013.exe  h1.bmp  svchost.exe 

以下为System Repair Engineer所导出的日志

[CODE]

2007-01-12,18:33:27

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 1 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><D:\WINDOWS\System32\ctfmon.exe>  [(Verified)Microsoft Corporation]
    <msnmsgr><; "D:\Program Files\MSN Messenger\msnmsgr.exe" /background>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <RfwMain><"G:\杀毒工具\瑞星2006防火墙\Rising\Rfw\rfwmain.exe" -Startup>  [Beijing Rising Technology Co., Ltd.]
    <NvCplDaemon><RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup>  [(Verified)NVIDIA Corporation]
    <kav><"G:\杀毒工具\卡巴斯基6.0\avp.exe">  [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><D:\WINDOWS\System32\userinit.exe,>  [(Verified)Microsoft Corporation]
    <UIHost><D:\Program Files\TGTSoft\StyleXP\CurrentLogon.EXE>  [Microsoft Corporation]

==================================
启动文件夹
N/A

==================================
服务
[AVP / AVP][Stopped/Auto Start]
  <"G:\杀毒工具\卡巴斯基6.0\avp.exe -r"><Kaspersky Lab>
[Rising Proxy  Service / RfwProxySrv][Stopped/Manual Start]
  <g:\杀毒工具\瑞星2006防火墙\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService][Running/Auto Start]
  <g:\杀毒工具\瑞星2006防火墙\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Distributed Link Tracking ClientXyfne2 / ServiceXyfne2][Stopped/Auto Start]
  <><N/A>
[STI Simulator / STI Simulator][Stopped/Auto Start]
  <><N/A>
[VMware Authorization Servicec / VMware Authorization Servicec][Stopped/Auto Start]
  <><N/A>
[Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start]
  <D:\WINDOWS\System32\svchost.exe -k netsvcs-->D:\WINDOWS\System32\mspmsnsv.dll><Microsoft Corporation>

==================================
驱动程序
[BaseTDI / BaseTDI][Running/Auto Start]
  <\??\D:\WINDOWS\System32\drivers\basetdi.sys><Rising>
[C-Media WDM Audio Interface / cmuda][Stopped/Manual Start]
  <system32\drivers\cmuda.sys><C-Media Inc>
[HookUrl / HookUrl][Running/Auto Start]
  <\??\G:\杀毒工具\瑞星2006防火墙\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[kl1 / kl1][Running/Boot Start]
  <\SystemRoot\System32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif][Running/System Start]
  <\??\D:\WINDOWS\System32\drivers\klif.sys><Kaspersky Lab>
[kmsinput / kmsinput][Stopped/Manual Start]
  <\??\D:\WINDOWS\System32\drivers\kmsinput.sys><N/A>
[KNetWch / KNetWch][Running/System Start]
  <\??\G:\金山新毒霸\KNetWch.SYS><金山电脑公司>
[KWatch / KWatch][Stopped/Manual Start]
  <\??\D:\WINDOWS\System32\drivers\KWatch.Sys><Kingsoft Corporation>
[KWatch2 / KWatch2][Stopped/Manual Start]
  <\??\D:\WINDOWS\System32\drivers\KWatch2.sys><Kingsoft Antivirus>
[mProcRs / mProcRs][Running/Auto Start]
  <\??\g:\杀毒工具\瑞星2006防火墙\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[npkcrypt / npkcrypt][Running/Auto Start]
  <\??\G:\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[NPPTNT / NPPTNT][Running/System Start]
  <\??\D:\WINDOWS\System32\npptNT.sys><INCA Internet Co., Ltd.>
[nv / nv][Running/Manual Start]
  <System32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Service for NVIDIA(R) nForce(TM) Audio Enumerator / nvax][Running/Manual Start]
  <system32\drivers\nvax.sys><NVIDIA Corporation>
[NVIDIA nForce MCP Networking Adapter Driver / NVENET][Running/Manual Start]
  <System32\DRIVERS\NVENET.sys><NVIDIA Corporation>
[nvidesm / nvidesm][Running/Boot Start]
  <\SystemRoot\system32\drivers\nvidesm.sys><NVIDIA Corporation>
[Service for NVIDIA(R) nForce(TM) Audio / nvnforce][Running/Manual Start]
  <system32\drivers\nvapu.sys><NVIDIA Corporation>
[nVidia WDM TVAudio Crossbar / nvtvSND][Stopped/Auto Start]
  <System32\DRIVERS\nvtvsnd.sys><N/A>
[NVIDIA nForce AGP Bus Filter / nv_agp][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\nv_agp.sys><NVIDIA Corporation>
[SoC PC-Camera / PAC207][Stopped/Manual Start]
  <System32\DRIVERS\pfc027.sys><>
[PNP29141 / PNP29141][Running/Boot Start]
  <\SystemRoot\System32\Drivers\pnp29141.sys><Anti Driver>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[R2A / R2A][Stopped/Manual Start]
  <\??\D:\WINDOWS\System32a2.sys><N/A>
[WAN 微型端口 (PPP over Ethernet 协议) / RMSPPPOE][Running/Manual Start]
  <System32\DRIVERS\RMSPPPOE.SYS><Robert Schlabbach>
[RsFwDrv / RsFwDrv][Running/Auto Start]
  <\??\G:\杀毒工具\瑞星2006防火墙\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[Secdrv / Secdrv][Running/Auto Start]
  <System32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
[StyleXPHelper / StyleXPHelper][Running/System Start]
  <\??\D:\Program Files\TGTSoft\StyleXP\StyleXPHelper.exe><Windows (R) 2000 DDK provider>
[SVKP / SVKP][Stopped/Auto Start]
  <\??\D:\WINDOWS\System32\SVKP.sys><N/A>
[TSP / TSP][Stopped/Manual Start]
  <\??\D:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[Sony Ericsson W700 Driver driver (WDM) / W700bus][Stopped/Manual Start]
  <System32\DRIVERS\W700bus.sys><MCCI>
[Sony Ericsson W700 USB WMC Modem Filter / W700mdfl][Stopped/Manual Start]
  <System32\DRIVERS\W700mdfl.sys><MCCI>
[Sony Ericsson W700 USB WMC Modem Driver / W700mdm][Stopped/Manual Start]
  <System32\DRIVERS\W700mdm.sys><MCCI>
[Sony Ericsson W700 USB WMC Device Management Drivers (WDM) / W700mgmt][Stopped/Manual Start]
  <System32\DRIVERS\W700mgmt.sys><MCCI>
[Sony Ericsson W700 USB WMC OBEX Interface / W700obex][Stopped/Manual Start]
  <System32\DRIVERS\W700obex.sys><MCCI>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
  <System32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[NTPort Library Driver / zntport][Stopped/Auto Start]
  <\??\D:\WINDOWS\System32\zntport.sys><N/A>
[USB PC Camera 301P / ZSMC301b][Stopped/Manual Start]
  <System32\Drivers\usbVM31b.sys><VM>

==================================
浏览器加载项
[浩方对战平台]
  {0A155D3C-68E2-4215-A47A-E800A446447A} <E:\浩方平台\HFGameOPT\HFGameOPT\GameClient.exe, 上海浩方在线信息技术有限公司>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <G:\QQ\新版qq\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
  {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <, N/A>
[CaiFuCOM Class]
  {C1F0024B-8278-4999-B7E6-2718426D9FE6} <D:\Program Files\财富通\caifu.dll, N/A>
[PGEdit Class]
  {2BFAA61B-5C83-4865-8281-D8BDBF863061} <D:\WINDOWS\Downloaded Program Files\PG_ATL_Edit.dll, 银联网络支付集团有限公司>
[VnetAnprIns Class]
  {74447F9C-5691-4A9A-8BE4-564092E40B03} <D:\WINDOWS\Downloaded Program Files\anprins.dll, 中国电信股份有限公司>
[Tencent Safety Online Base Module]
  {C09B522F-8AED-4E21-A65C-DC1AB652BAEE} <D:\WINDOWS\DOWNLO~1\TSOBase.ocx, Tencent Corporation>
[上传到QQ网络硬盘]
  <G:\QQ\新版qq\AddToNetDisk.htm, N/A>
[使用网际快车下载]
  <G:\下载工具\网际快车1.4官方正式版+完美破解注册\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
  <G:\下载工具\网际快车1.4官方正式版+完美破解注册\FlashGet\jc_all.htm, N/A>
[添加到QQ自定义面板]
  <G:\QQ\新版qq\AddPanel.htm, N/A>
[添加到QQ表情]
  <G:\QQ\新版qq\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <G:\QQ\新版qq\SendMMS.htm, N/A>

==================================

接上楼日志未完部分

正在运行的进程
[PID: 668][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 744][\??\D:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 768][\??\D:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 812][D:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 824][D:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 984][D:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1072][D:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1220][D:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1244][D:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1284][g:\杀毒工具\瑞星2006防火墙\rising\rfw\rfwsrv.exe]  [Beijing Rising Technology Co., Ltd., 4, 0, 0, 32]
    [g:\杀毒工具\瑞星2006防火墙\rising\rfw\RfwRule.dll]  [Beijing Rising Technology Co., Ltd., 4, 0, 0, 13]
    [g:\杀毒工具\瑞星2006防火墙\rising\rfw\rfwlog.dll]  [Beijing Rising Technology Co., Ltd., 4, 0, 0, 6]
    [g:\杀毒工具\瑞星2006防火墙\rising\rfw\Rfwdrv.dll]  [Beijing Rising Technology Co., Ltd., 4, 0, 0, 21]
    [g:\杀毒工具\瑞星2006防火墙\rising\rfw\MonDrv.dll]  [rs, 1, 0, 0, 4]
    [g:\杀毒工具\瑞星2006防火墙\rising\rfw\ProcLib.dll]  [Beijing Rising Technology Co., Ltd., 4, 0, 0, 9]
[PID: 1480][D:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.1699 (xpsp2.050610-1533)]
    [D:\WINDOWS\system32\ZLhp1020.DLL]  [Zenographics, Inc., 5, 53, 2714, 0]
    [D:\WINDOWS\system32\ZLM.dll]  [Zenographics, Inc., 5, 50, 1416, 0]
    [D:\WINDOWS\System32\spool\PRTPROCS\W32X86\IMFPrint.DLL]  [Zenographics, Inc., 5, 54, 330, 0]
    [D:\WINDOWS\system32\Imf32.dll]  [Zenographics, Inc., 5, 60, 1204, 0]
    [D:\WINDOWS\system32\ZTAG32.dll]  [Zenographics, Inc., 5, 60, 1210, 0]
    [D:\WINDOWS\system32\ZSPOOL.dll]  [Zenographics, Inc., 5, 51, 709, 0]
    [D:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll]  [Windows (R) 2000 DDK provider, 5.00.2195.1620]
[PID: 1788][D:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [D:\WINDOWS\System32\1.1]  [N/A, N/A]
    [D:\WINDOWS\System32\nvcpl.dll]  [NVIDIA Corporation, 6.13.10.4104]
    [D:\WINDOWS\System32\nvshell.dll]  [N/A, N/A]
[PID: 324][G:\杀毒工具\瑞星2006防火墙\Rising\Rfw\rfwmain.exe]  [Beijing Rising Technology Co., Ltd., 4, 0, 0, 51]
    [G:\杀毒工具\瑞星2006防火墙\Rising\Rfw\RsGuiLib.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 23]
    [G:\杀毒工具\瑞星2006防火墙\Rising\Rfw\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [G:\杀毒工具\瑞星2006防火墙\Rising\Rfw\PngDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
    [D:\WINDOWS\System32\1.1]  [N/A, N/A]
[PID: 348][G:\杀毒工具\卡巴斯基6.0\avp.exe]  [Kaspersky Lab, 6.0.0.299]
    [G:\杀毒工具\卡巴斯基6.0\pr_remote.dll]  [Kaspersky Lab, 6.0.0.299]
    [G:\杀毒工具\卡巴斯基6.0\FSSync.dll]  [Kaspersky Lab, 6.0.5.0]
    [D:\WINDOWS\System32\1.1]  [N/A, N/A]
    [G:\杀毒工具\卡巴斯基6.0\AVPGS.PPL]  [Kaspersky Lab, 6.0.0.299]
    [G:\杀毒工具\卡巴斯基6.0\prloader.dll]  [Kaspersky Lab, 6.0.0.299]
    [G:\杀毒工具\卡巴斯基6.0\prkernel.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\pxstub.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\params.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\winreg.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\tm.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\nfio.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\fsdrvplgn.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\bl.ppl]  [Kaspersky Lab, 6.0.0.300]
    [g:\杀毒工具\卡巴斯基6.0\wmihlpr.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\ndetect.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\crpthlpr.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\schedule.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\timer.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\thpimpl.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\lic60.ppl]  [Kaspersky Lab, 6.0.0.300]
    [g:\杀毒工具\卡巴斯基6.0\report.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\hashmd5.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\avs.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\avpmgr.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\wdiskio.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\avlib.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\avspm.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\avp3info.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\avpgui.ppl]  [Kaspersky Lab, 6.0.0.300]
    [G:\杀毒工具\卡巴斯基6.0\basegui.dll]  [Kaspersky Lab, 6.0.0.300]
    [g:\杀毒工具\卡巴斯基6.0\og.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\sc.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\httpscan.ppl]  [Kaspersky Lab, 6.0.0.299]
    [G:\杀毒工具\卡巴斯基6.0\klaveng.dll]  [N/A, N/A]
    [g:\杀毒工具\卡巴斯基6.0\mc.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\oas.ppl]  [Kaspersky Lab, 6.0.0.300]
    [g:\杀毒工具\卡巴斯基6.0\pdm.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\dtreg.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\procmon.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\prutil.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\sfdb.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\avp1.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\l_llio.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\qb.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\ichk2.ppl]  [Kaspersky Lab, 6.0.0.300]
    [g:\杀毒工具\卡巴斯基6.0\icheckersa.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\smtpprotocoller.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\httpanlz.ppl]  [Kaspersky Lab, 6.0.0.300]
    [g:\杀毒工具\卡巴斯基6.0\pop3protocoller.ppl]  [Kaspersky Lab, 6.0.0.300]
    [g:\杀毒工具\卡巴斯基6.0\trafficmonitor2.ppl]  [N/A, N/A]
    [G:\杀毒工具\卡巴斯基6.0\CKAHUM.dll]  [Kaspersky Lab, 6.0.0.1]
    [G:\杀毒工具\卡巴斯基6.0\CKAHComm.dll]  [Kaspersky Lab, 6.0.0.1]
    [G:\杀毒工具\卡巴斯基6.0\ckahrule.dll]  [Kaspersky Lab, 6.0.0.1]
    [g:\杀毒工具\卡巴斯基6.0\imapprotocoller.ppl]  [Kaspersky Lab, 6.0.0.300]
    [g:\杀毒工具\卡巴斯基6.0\nntpprotocoller.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\hashcont.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\hccmp.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\iwgen.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\inflate.ppl]  [Kaspersky Lab, 6.0.0.16]
    [g:\杀毒工具\卡巴斯基6.0\tempfile.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\uniarc.ppl]  [Kaspersky Lab, 6.0.0.16]
    [g:\杀毒工具\卡巴斯基6.0\minizip.ppl]  [Kaspersky Lab, 6.0.0.16]
    [g:\杀毒工具\卡巴斯基6.0\cab.ppl]  [Kaspersky Lab, 6.0.0.16]
    [g:\杀毒工具\卡巴斯基6.0\arj.ppl]  [Kaspersky Lab, 6.0.0.16]
    [g:\杀毒工具\卡巴斯基6.0\rar.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\lha.ppl]  [Kaspersky Lab, 6.0.0.299]
    [g:\杀毒工具\卡巴斯基6.0\mdb.ppl]  [Kaspersky Lab, 6.0.0.300]
    [g:\杀毒工具\卡巴斯基6.0\msoe.ppl]  [Kaspersky Lab, 6.0.0.299]
[PID: 356][D:\WINDOWS\System32\rundll32.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\1.1]  [N/A, N/A]
[PID: 376][D:\WINDOWS\System32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [D:\WINDOWS\System32\1.1]  [N/A, N/A]
[PID: 540][G:\金山新毒霸\KAVPlus.EXE]  [, 2004, 3, 3, 71]
    [D:\WINDOWS\System32\1.1]  [N/A, N/A]
[PID: 1028][D:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 1148][D:\WINDOWS\System32\wdfmgr.exe]  [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[PID: 1968][D:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1264][G:\杀毒工具\System Repair Engineer(SREng)\sreng23\SREng.EXE]  [Smallfrogs Studio, 2.3.13.690]
    [D:\WINDOWS\System32\1.1]  [N/A, N/A]
[PID: 1644][G:\QQ\TT\TTraveler.exe]  [腾讯公司, 3.0.0.250]
    [D:\WINDOWS\System32\1.1]  [N/A, N/A]
    [G:\QQ\TT\Plugins\QQFloatBar\QQFloatBar4TT2.dll]  [腾讯公司, 1, 1, 0, 5]
    [G:\QQ\TT\Plugins\TWeather\TWeather.dll]  [, 1, 0, 0, 3]
    [G:\QQ\TT\PersonalDesktop.dll]  [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 4]
    [G:\QQ\新版qq\qdshm.dll]  [, 1, 0, 101, 20]
    [G:\系统小~1\解压工~1\WZSHLSTB.DLL]  [WinZip Computing, Inc., 4.1 (32-bit)]
    [D:\Program Files\WinRAR\rarext.dll]  [N/A, N/A]
    [G:\金山新毒霸\KAVEXT.DLL]  [Kingsoft Corp., 2002, 5, 24, 6]
    [G:\杀毒工具\卡巴斯基6.0\shellex.dll]  [Kaspersky Lab, 6.0.0.299]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["D:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
N/A

==================================
API HOOK
警告！System Repair Engineer 提醒
你下面的函数内容与预期值不符，他
们可能被一些恶意的软件所修改：
入口点错误：RegEnumValueA
入口点错误：RegEnumValueW
RVA  错误： LoadLibraryA
RVA  错误： LoadLibraryExA
RVA  错误： LoadLibraryExW
RVA  错误： LoadLibraryW

==================================


[/CODE]

推荐使用360安全卫士试试

.360下载地址:
http://www.360safe.com/
http://www.xdowns.com/soft/8/9/2006/Soft_31554.html
使用后删除360安全卫士

360安全卫士我电脑本身就有。。但是根本是无法启动。。一运行杀毒软件直接就是自动关机。。并且自动删除杀毒软件的主程序。。

运行(双击)SRENG2，点“启动项目，服务，点“Win32服务应用程序”
勾选“隐藏微软服务”选中病毒服务
R2A
，选择“删除服务”
点“设置”选择“否”
重启按F８进入安全模式下
显示隐藏文件
删除： 
D:\WINDOWS\System32a2.sys
D:\WINDOWS\System32\1.1

御载360安全卫士,重装360安全卫士行吗,要换个文件夹安装

不行。。安全模式的相关注册表选项已被删除。。每次按F8进安全模式都是直接重新启动。。。并切选择任何的杀毒软件（瑞星，360，木马杀客，卡卡，优化大师，超级兔子等）都会直接导致关机。。安装也是一样。。自动关机

而且瑞星，兔子，360等各大论坛被屏闭。。无法在中毒的系统打开。。每次都是自动转向cn.yahoo.con...

郁闷...

sreng有修复安全模式 你试一下...

干掉整个QQ文件夹!

汗。。。病毒都把驻入我的进程里了。。估计干了也没用

D:\WINDOWS\System32a2.sys
D:\WINDOWS\System32\1.1
日志里面只看见这两个毒驱,剩下的都是些流氓!