系统里检查有一个systerms.exe得程序
卸载后仍自动加载，无法关闭，删除后重启又自动加载
怎么样才能删除，哪位大虾指点一下！！！！！

查杀相关联的病毒名字是Trojan.Disabler.c

请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。

搜索BAOHE版主的帖子,应该是近几天发的新帖,里面就有一个病毒的样本和楼主的一样,中了之后主页就被恶意定向为该网址.

刚刚帮楼主找到帖子了,里面有详细的手工查杀办法:
http://forum.ikaka.com/topic.asp?board=28&artid=8168584

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [Microsoft Corporation]
    <KAVPersonal50><"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize>  [Kaspersky Lab]
    <Logitech Utility><Logi_MwX.Exe>  [Logitech Inc.]
    <webService><systems.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,,C:\WINDOWS\system32\explore.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    <themeadp><C:\WINDOWS\system32\themeadp.dll>  []

==================================
启动文件夹
服务
[ewido anti-spyware 4.0 guard / ewido anti-spyware 4.0 guard]
  <C:\Program Files\ewido anti-spyware 4.0\guard.exe><Anti-Malware Development a.s.>
[InstallDriver Table Manager / IDriverT]
  <"C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe"><Macrovision Corporation>
[Audio / Internet Server Owen]
  <><N/A>
[kavsvc / kavsvc]
  <"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe"><Kaspersky Lab>
[NVIDIA Driver Helper Service / NVSvc]
  <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[Routing and Remote SqlServer / Remote SQL]
  <><N/A>
[Remote Managements Instrumenta / Remss_Ser]
  <C:\WINDOWS\system32\netstart.exe -service><N/A>

==================================
浏览器加载项
[AcroIEHlprObj Class]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <D:\program\pdf\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[MyIEHelper Class]
  {16B770A0-0E87-4278-B748-2460D64A8386} <C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\IEHelper_4857.dll, N/A>
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <D:\program\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[浩方对战平台]
  {0A155D3C-68E2-4215-A47A-E800A446447A} <D:\program\浩方对战平台\浩方对战平台\GameClient.exe, 上海浩方在线信息技术有限公司>
[QQIEFloatBarCfgCmd Class]
  {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <D:\program\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx, Macromedia, Inc.>
[Rising Web Scan Object]
  {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\Downloaded Program Files\CONFLICT.1\OL2005.dll, Beijing Rising Technology Co., Ltd.>
[AcroIEHlprObj Class]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <D:\program\pdf\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[MonitorURL Class]
  {08A312BB-5409-49FC-9347-54BB7D069AC6} <C:\PROGRA~1\DESKAD~1\deskipn.dll, N/A>
[MyIEHelper Class]
  {16B770A0-0E87-4278-B748-2460D64A8386} <C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\IEHelper_4857.dll, N/A>
[Windows Media Player]
  {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
  {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
  {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\WINDOWS\system32\dllcache\dhtmled.ocx, Microsoft Corporation>
[HHCtrl Object]
  {41B23C28-488E-4E5C-ACE2-BB0BBABE99E8} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <D:\program\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[WebVGPlayer Class]
  {AA899B43-24BD-4B6B-BBD0-45557D8D11E0} <C:\PROGRA~1\VIEWGOOD\WEBPLA~1\VGPlayer.dll, >
[Microsoft Scriptlet Component]
  {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
  {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[AUDIO__MP3 Moniker Class]
  {CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
  {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\PROGRA~1\Kuree\Codec\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx, Macromedia, Inc.>
[Shockwave Flash Object]
  {DE8C8BF0-4A16-12DD-CBBD-789569C11983} <C:\WINDOWS\system32\FLASHO~1.DLL, Macromedia,Inc.>
[Rising Web Scan Object]
  {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\Downloaded Program Files\CONFLICT.1\OL2005.dll, Beijing Rising Technology Co., Ltd.>
[上传到QQ网络硬盘]
  <D:\program\QQ\AddToNetDisk.htm, N/A>
[使用网际快车下载]
  <D:\program\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
  <D:\program\FlashGet\jc_all.htm, N/A>
[导出到 Microsoft Excel(&x)]
  <res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
  <D:\program\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <D:\program\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <D:\program\QQ\SendMMS.htm, N/A>

==================================

正在运行的进程
[PID: 516][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 572][\??\C:\WINDOWS\system32\csrss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 616][\??\C:\WINDOWS\system32\winlogon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 660][C:\WINDOWS\system32\services.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 672][C:\WINDOWS\system32\lsass.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 816][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 864][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 932][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1000][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1136][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1472][C:\WINDOWS\Explorer.EXE]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll]  <Logitech Inc.><1.1.0>
    [C:\DOCUME~1\cory\LOCALS~1\Temp\themeadp.nls]  <N/A><N/A>
    [C:\Program Files\Logitech\MouseWare\System\LgWndHk.dll]  <Logitech Inc.><9.80.019>
    [D:\program\pdf\ActiveX\PDFShell.dll]  <Adobe Systems, Inc.><7.0.0.0>
    [D:\program\pdf\ActiveX\AcroIEHelper.dll]  <Adobe Systems Incorporated><7.0.0.2004121400>
[PID: 1680][C:\Program Files\ewido anti-spyware 4.0\guard.exe]  <Anti-Malware Development a.s.><4, 0, 0, 172>
    [C:\Program Files\ewido anti-spyware 4.0\engine.dll]  <Anti-Malware Development a.s.><4, 0, 0, 172>
[PID: 1716][C:\WINDOWS\system32\nvsvc32.exe]  <NVIDIA Corporation><6.13.10.4072>
[PID: 464][C:\WINDOWS\System32\alg.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 364][C:\WINDOWS\system32\ctfmon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll]  <Logitech Inc.><1.1.0>
[PID: 1036][C:\Program Files\Logitech\MouseWare\system\em_exec.exe]  <Logitech Inc.><9.80.019>
    [C:\Program Files\Logitech\MouseWare\system\EVENTEX.dll]  <Logitech Inc.><9.80.019>
    [C:\WINDOWS\system32\COMNCTR.dll]  <Logitech Inc.><9.80.019>
    [C:\Program Files\Logitech\MouseWare\system\ccresrce.dll]  <Logitech Inc.><9.80.019>
    [C:\Program Files\Logitech\MouseWare\system\GlbResLt.dll]  <Logitech Inc.><9.80.019>
    [C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll]  <Logitech Inc.><1.1.0>
    [C:\Program Files\Logitech\MouseWare\System\devices.dll]  <Logitech Inc.><9.80.019>
    [C:\Program Files\Logitech\MouseWare\system\ccstmglb.dll]  <Logitech Inc.><9.80.019>
    [C:\Program Files\Logitech\MouseWare\system\ccustom.dll]  <Logitech Inc.><9.80.019>
    [C:\Program Files\Logitech\MouseWare\system\ccmsghk.dll]  <Logitech Inc.><9.80.019>
    [C:\Program Files\Logitech\MouseWare\System\LgWndHk.dll]  <Logitech Inc.><9.80.019>
[PID: 240][D:\program\QQ\QQ.exe]  <TENCENT><0, 0, 0, 0>
    [D:\program\QQ\CoralAssist.DLL]  <Coral Team><4.5.0 build 20060515>
    [D:\program\QQ\CoralQQ.DLL]  <Coral Team><4.5 Build 20060515>
    [D:\program\QQ\ipsearcher.dll]  <N/A><1.0.0.4>
    [D:\program\QQ\QQBaseClassInDll.dll]  <><1, 0, 0, 1>
    [D:\program\QQ\QQHelperDll.dll]  <><1, 0, 0, 1>
    [D:\program\QQ\BasicCtrlDll.dll]  <Tencent><5, 0, 200, 160>
    [C:\Program Files\Logitech\MouseWare\System\LgWndHk.dll]  <Logitech Inc.><9.80.019>
    [D:\program\QQ\QQAPI.dll]  <><1, 0, 0, 1>
    [D:\program\QQ\LoginCtrl.dll]  <><1, 0, 0, 1>
    [D:\program\QQ\npkcntc.dll]  <INCA Internet Co., Ltd.><2006, 3, 2, 1>
    [D:\program\QQ\npkpdb.dll]  <INCA Internet Co., Ltd.><2003, 10, 1, 1>
    [C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll]  <Logitech Inc.><1.1.0>
    [D:\program\QQ\QQRes.dll]  <tencent><1, 0, 0, 1>
    [D:\program\QQ\QQMainFrame.dll]  <N/A><N/A>
    [D:\program\QQ\CQQApplication.dll]  <N/A><N/A>
    [D:\program\QQ\NewSkin.dll]  <><1, 0, 0, 1>
    [D:\program\QQ\HostingMgr.dll]  <><1, 0, 0, 1>
    [D:\program\QQ\CameraDll.dll]  <><1, 0, 0, 1>
    [D:\program\QQ\MailSummary.dll]  <><1, 0, 0, 1>
    [D:\program\QQ\QQSpace.dll]  <><1, 0, 0, 1>
    [C:\WINDOWS\system32\msdmo.dll]  <N/A><N/A>
    [D:\program\QQ\QQGroupMng.dll]  <><1, 0, 0, 1>
    [D:\program\QQ\GroupLive.dll]  <N/A><N/A>
    [D:\program\QQ\LongConnection.dll]  <tencent><5, 0, 200, 160>
    [D:\program\QQ\QQPlugin.dll]  <N/A><N/A>
    [D:\program\QQ\ShareFiles.dll]  <N/A><N/A>
    [D:\program\QQ\QQZip.dll]  <tencent><0, 3, 2, 4>
    [D:\program\QQ\UserDefinedHead.dll]  <><1, 0, 0, 1>
    [D:\program\QQ\QQConfigPlugin.dll]  <><1, 0, 0, 1>
    [D:\program\QQ\QRingMng.dll]  <N/A><N/A>
    [D:\program\QQ\QQAvatar.dll]  <N/A><N/A>
    [D:\program\QQ\FlashAvatarDll.dll]  <><1, 4, 0, 1>
    [C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx]  <Macromedia, Inc.><8,0,24,0>
    [D:\program\QQ\PhoneAPI.dll]  <><1, 0, 0, 1>
    [D:\program\QQ\DialerAllinOne.dll]  <tencent><1, 4, 0, 0>
    [D:\program\QQ\QQPet.dll]  <><1, 0, 0, 1>
    [D:\program\QQ\QQSysMsgMng.dll]  <N/A><N/A>
    [D:\program\QQ\BQQApplication.dll]  <N/A><N/A>
    [D:\program\QQ\CommercesMng.dll]  <><1, 0, 0, 1>
    [D:\program\QQ\PersonalDesktop.dll]  <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2>
    [D:\program\QQ\QQAddr.dll]  <深圳市腾讯计算机系统有限公司><5, 0, 101, 200>
    [D:\program\QQ\QQSceneMng.dll]  <N/A><N/A>
    [D:\program\QQ\QQPhoneHelper.dll]  <腾讯科技（深圳）有限公司><2, 0, 6, 60>
    [D:\program\QQ\QQFileTransfer.dll]  <Tencent><5, 0, 202, 180>
[PID: 860][D:\program\QQ\QQ.exe]  <TENCENT><0, 0, 0, 0>

[D:\program\QQ\CoralAssist.DLL]  <Coral Team><4.5.0 build 20060515>
    [D:\program\QQ\CoralQQ.DLL]  <Coral Team><4.5 Build 20060515>
    [D:\program\QQ\ipsearcher.dll]  <N/A><1.0.0.4>
    [D:\program\QQ\QQBaseClassInDll.dll]  <><1, 0, 0, 1>
    [D:\program\QQ\QQHelperDll.dll]  <><1, 0, 0, 1>
    [D:\program\QQ\BasicCtrlDll.dll]  <Tencent><5, 0, 200, 160>
    [C:\Program Files\Logitech\MouseWare\System\LgWndHk.dll]  <Logitech Inc.><9.80.019>
    [D:\program\QQ\QQAPI.dll]  <><1, 0, 0, 1>
    [D:\program\QQ\LoginCtrl.dll]  <><1, 0, 0, 1>
    [D:\program\QQ\npkcntc.dll]  <INCA Internet Co., Ltd.><2006, 3, 2, 1>
    [D:\program\QQ\npkpdb.dll]  <INCA Internet Co., Ltd.><2003, 10, 1, 1>
    [C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll]  <Logitech Inc.><1.1.0>
    [D:\program\QQ\QQRes.dll]  <tencent><1, 0, 0, 1>
    [D:\program\QQ\QQMainFrame.dll]  <N/A><N/A>
    [D:\program\QQ\CQQApplication.dll]  <N/A><N/A>
    [D:\program\QQ\NewSkin.dll]  <><1, 0, 0, 1>
    [D:\program\QQ\HostingMgr.dll]  <><1, 0, 0, 1>
    [D:\program\QQ\CameraDll.dll]  <><1, 0, 0, 1>
    [D:\program\QQ\MailSummary.dll]  <><1, 0, 0, 1>
    [D:\program\QQ\QQSpace.dll]  <><1, 0, 0, 1>
    [C:\WINDOWS\system32\msdmo.dll]  <N/A><N/A>
    [D:\program\QQ\QQGroupMng.dll]  <><1, 0, 0, 1>
    [D:\program\QQ\GroupLive.dll]  <N/A><N/A>
    [D:\program\QQ\UserDefinedHead.dll]  <><1, 0, 0, 1>
    [D:\program\QQ\QQPlugin.dll]  <N/A><N/A>
    [D:\program\QQ\QQConfigPlugin.dll]  <><1, 0, 0, 1>
    [D:\program\QQ\QQAllInOne.dll]  <N/A><N/A>
    [D:\program\QQ\SCCore.dll]  <N/A><N/A>
    [D:\program\QQ\QQCustomFace.dll]  <N/A><N/A>
    [D:\program\QQ\QRingMng.dll]  <N/A><N/A>
    [D:\program\QQ\PhoneAPI.dll]  <><1, 0, 0, 1>
    [D:\program\QQ\DialerAllinOne.dll]  <tencent><1, 4, 0, 0>
    [D:\program\QQ\GroupConnection.dll]  <Tencent><5, 0, 202, 170>
    [D:\program\QQ\LongConnection.dll]  <tencent><5, 0, 200, 160>
    [D:\program\QQ\QQAvatar.dll]  <N/A><N/A>
    [D:\program\QQ\FlashAvatarDll.dll]  <><1, 4, 0, 1>
    [D:\program\QQ\QQPet.dll]  <><1, 0, 0, 1>
    [D:\program\QQ\ImageOle.dll]  <TODO: <Company name>><1.0.0.1>
    [C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx]  <Macromedia, Inc.><8,0,24,0>
    [D:\program\QQ\QQSceneMng.dll]  <N/A><N/A>
    [D:\program\QQ\QQSysMsgMng.dll]  <N/A><N/A>
    [D:\program\QQ\BQQApplication.dll]  <N/A><N/A>
    [D:\program\QQ\ShareFiles.dll]  <N/A><N/A>
    [D:\program\QQ\QQZip.dll]  <tencent><0, 3, 2, 4>
    [D:\program\QQ\QQFileTransfer.dll]  <Tencent><5, 0, 202, 180>
    [D:\program\QQ\CommercesMng.dll]  <><1, 0, 0, 1>
    [D:\program\QQ\PersonalDesktop.dll]  <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2>
    [D:\program\QQ\QQAddr.dll]  <深圳市腾讯计算机系统有限公司><5, 0, 101, 200>
[PID: 2912][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\Program Files\Logitech\MouseWare\System\LgWndHk.dll]  <Logitech Inc.><9.80.019>
    [D:\program\pdf\ActiveX\AcroIEHelper.dll]  <Adobe Systems Incorporated><7.0.0.2004121400>
    [D:\program\QQ\QQIEHelper.dll]  <深圳市腾讯计算机系统有限公司><1, 1, 0, 5>
    [C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll]  <Logitech Inc.><1.1.0>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\scrchpg.dll]  <Kaspersky Lab><5.0.1.18>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\scrch_ag.dll]  <Kaspersky Lab><5.0.388.1>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\FSSync.dll]  <Kaspersky Lab><5.0.388.0>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\pr_rmt.dll]  <Kaspersky Lab><5.0.388.0>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\ccclient.dll]  <Kaspersky Lab><5.0.388.1>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\klipc.dll]  <Kaspersky Lab><5.0.388.0>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\KLUtil.dll]  <Kaspersky Lab><5.0.388.1>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\rpt.dll]  <Kaspersky Lab><5.0.388.2>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\CCIFACE.dll]  <Kaspersky Lab><5.0.388.1>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\prloader.dll]  <Kaspersky Lab><5.0.388.0>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\prkernel.ppl]  <Kaspersky Lab><5.0.388.0>
    [c:\program files\kaspersky lab\kaspersky anti-virus personal pro\prstring.ppl]  <Kaspersky Lab><5.0.388.0>
    [c:\program files\kaspersky lab\kaspersky anti-virus personal pro\pr_srv.ppl]  <Kaspersky Lab><5.0.388.0>
    [c:\program files\kaspersky lab\kaspersky anti-virus personal pro\pr_clnt.ppl]  <Kaspersky Lab><5.0.388.0>
    [c:\program files\kaspersky lab\kaspersky anti-virus personal pro\tempfile.ppl]  <Kaspersky Lab><5.0.388.0>
    [C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx]  <Macromedia, Inc.><8,0,24,0>
[PID: 3220][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\Program Files\Logitech\MouseWare\System\LgWndHk.dll]  <Logitech Inc.><9.80.019>
    [D:\program\pdf\ActiveX\AcroIEHelper.dll]  <Adobe Systems Incorporated><7.0.0.2004121400>
    [D:\program\QQ\QQIEHelper.dll]  <深圳市腾讯计算机系统有限公司><1, 1, 0, 5>
    [C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll]  <Logitech Inc.><1.1.0>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\scrchpg.dll]  <Kaspersky Lab><5.0.1.18>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\scrch_ag.dll]  <Kaspersky Lab><5.0.388.1>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\FSSync.dll]  <Kaspersky Lab><5.0.388.0>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\pr_rmt.dll]  <Kaspersky Lab><5.0.388.0>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\ccclient.dll]  <Kaspersky Lab><5.0.388.1>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\klipc.dll]  <Kaspersky Lab><5.0.388.0>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\KLUtil.dll]  <Kaspersky Lab><5.0.388.1>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\rpt.dll]  <Kaspersky Lab><5.0.388.2>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\CCIFACE.dll]  <Kaspersky Lab><5.0.388.1>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\prloader.dll]  <Kaspersky Lab><5.0.388.0>
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\prkernel.ppl]  <Kaspersky Lab><5.0.388.0>
    [c:\program files\kaspersky lab\kaspersky anti-virus personal pro\prstring.ppl]  <Kaspersky Lab><5.0.388.0>
    [c:\program files\kaspersky lab\kaspersky anti-virus personal pro\pr_srv.ppl]  <Kaspersky Lab><5.0.388.0>
    [c:\program files\kaspersky lab\kaspersky anti-virus personal pro\pr_clnt.ppl]  <Kaspersky Lab><5.0.388.0>
    [c:\program files\kaspersky lab\kaspersky anti-virus personal pro\tempfile.ppl]  <Kaspersky Lab><5.0.388.0>
    [C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx]  <Macromedia, Inc.><8,0,24,0>
[PID: 3300][C:\Program Files\WinRAR\WinRAR.exe]  <N/A><N/A>
    [C:\Program Files\Logitech\MouseWare\System\LgWndHk.dll]  <Logitech Inc.><9.80.019>
    [C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll]  <Logitech Inc.><1.1.0>
[PID: 3412][C:\DOCUME~1\cory\LOCALS~1\Temp\Rar$EX00.110\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>
    [C:\Program Files\Logitech\MouseWare\System\LgWndHk.dll]  <Logitech Inc.><9.80.019>
    [C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll]  <Logitech Inc.><1.1.0>

==================================
文件关联
.TXT  Error. [NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

打开System Repair Engineer（也就是你的扫描日志软件SREng.exe），使用“系统修复，文件关联，勾选“全选”点“修复”使所有扩展名都恢复正常。

打开System Repair Engineer（也就是你的扫描日志软件SREng.exe），点“启动项目，服务，点“Win32服务应用程序”勾选“隐藏微软服务”选中病毒服务Audio,Routing and Remote SqlServer,Remote Managements Instrumenta，选择“删除服务”点“设置”选择“否”最后重启。（每一个逗号隔开的就是一个病毒的服务，请逐一删除）

C:\WINDOWS\system32\userinit.exe,,C:\WINDOWS\system32\explore.exe这一项，建议按以下帖子的思路去解决
http://forum.ikaka.com/topic.asp?board=28&artid=8122808

下载超级兔子,专业卸载。
http://www.pctutu.com/news.asp?id=92
安装好后，打开“winspeed”“专业卸载,卸载所有提示的垃圾软件，卸载是不要打开任何浏览窗口。卸载不了可以重启后再去卸载。
卸载完后

请到www.27814939.ys168.com,点“我的软件”下载KillBox.exe
重新启动电脑, 开机检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式进入Windows
双击打开KillBox.exe，分别删除
C:\WINDOWS\system32\explore.exe
C:\WINDOWS\system32\themeadp.dll
C:\DOCUME~1\cory\LOCALS~1\Temp\themeadp.nls
C:\WINDOWS\system32\netstart.exe

（删除时勾选“删除前先结束Explorer.EXE进程”不行再试着勾选"删除DLL文件前反注册此文件"
给菜鸟的东东—KillBox的使用技巧
http://forum.ikaka.com/topic.asp?board=28&artid=8160799

另附一个链接

清除systems.exe2006年09月11日 星期一 04:16Win32.Troj.Clicker.pa   

病毒别名：        处理时间：2006-09-06    威胁级别：★
中文名称：        病毒类型：木马          影响系统：Win 9x/ME,Win 2000/NT,Win XP,Win 2003

病毒行为:
弹出网页http://vod.mmdy.org/ 禁用注册表
该病毒为windows平台下的集于下载其它病毒、修改主页和后台访问指定网站的复合型病毒，病毒运行后复制自身为多个
伪系统正常程序，并将自身安装成伪系统正常服务，以使用户更难以发觉。同时病毒未经用户允许强制修改用户IE主页；
网络可用时病毒尝试访问特定的网站，并通过网络进行病毒的自我更新操作。造成用户机器不稳定。
病毒主要通过捆绑软件和欺骗方式进行传播。


1、复制自身为以下伪系统正常文件:
%Windir%\system32\netstart.exe
%Windir%\system32\regshell.exe
%Windir%\system32\inetesvr.exe
%Windir%\system32\INTasks.exe
%Windir%\system32\lsas.exe
%Windir%\system32\svchest.exe
%Windir%\system32\service.exe

2、生成以下相关文件:
%Windir%\system32\winpub.reg
%Windir%\system32\deleteme.bat
%Windir%\systems.exe

3、写入以下注册表项:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{340121DC-1BEF-1A77-0106-060207060704}]
"StubPath" = "%Windir%\system32\regshell.exe"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"webService" = "%Windir%\systems.exe"

4、添加如下伪系统正常服务，使病毒开机后自动运行:
服务名: Remss_Ser
显示名称: Remote Managements Instrumenta
描述: 管理局域网和远程连接。如果此服务被禁用，任何依赖它的服务将无法启动。
　路径: C:\WINNT\System32\netstart.exe -service
启动方式: 自动

5、删除以下注册表键:
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{340121DC-1BEF-1A77-0106-060207060704}]

6、系统为WinNT/2k/xp/2003时，病毒通过查找窗体类名为:"Shell_TrayWnd" 的方式定位explorer进程，然后通过explorer访问相关网站并进行病毒更新。

7、病毒通过修改以下注册表项强制设置用户ie主页:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page" = "http://vod.mmdy.org"
"Start Page" = "http://vod.mmdy.org"

8、运行如下相关命令访问相关的网站页面:
Explorer.exe http://vod.mmdy.org/
Explorer.exe http://vod.mmdy.org/news
Explorer.exe http://vod.mmdy.org/goodvip
Explorer.exe http://vod.mmdy.org/mm
Explorer.exe http://vod.mmdy.org/mp3
Explorer.exe http://vod.mmdy.org/sp
Explorer.exe http://vod.mmdy.org/yx
Explorer.exe http://vod.mmdy.org/zz

9、病毒同时通过以下链接进行病毒的自我更新操作:
http://vod.mmdy.org/guest.exe

10、病毒通过修改以下注册表项使用户中毒后无法打开注册表编辑器:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=dword:00000001

11、同时病毒修改注册以下项目的使用户无法在IE设置中修改主页:
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel]
"HomePage"=dword:00000001
"Settings"=dword:00000001
"Links"=dword:00000001
"SecAddSites"=dword:00000001