昨天中了病毒，一开浏览器就指向9505导航。当时是msconfig里多了CNNIC和down两个启
动项。取消并删除相关的EXE文件之后还是不行。QQ也删了，3年的聊天记录和一些资料

眨眼的工夫全没了，很痛苦。硬盘上有两个系统，XP和2003.XP暂时幸免于难。
用hijackthis和SREngLOG两个工具扫描下系统，向高手求救。
不胜感激!!!!!
2006-11-30,21:17:15

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows Server 2003 Enterprise Edition  (Build 3790)
- 管理权限用户 - 完整功能
以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><; I:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft
Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
    <run><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <AVP Monitor><I:\Program Files\Kaspersky Anti-Virus\avpm.exe>  [N/A]
    <MSPY2002><I:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC> 
[(Verified)N/A]
    <nod32kui><"I:\Program Files\Eset\nod32kui.exe" /WAITSERVICE>  [Eset ]
    <IMJPMIG8.1><"I:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef

/Migration32>  [(Verified)Microsoft Corporation]
    <ATIPTA><I:\Program Files\ATI Technologies\ATI Control

Panel\atiptaxx.exe>  [ATI Technologies, Inc.]
    <MSConfig><; "I:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" /auto> 
[(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><I:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft
Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><%SystemRoot%\system32\logonui.exe>  [(Verified)Microsoft
Corporation]
==================================
启动文件夹
[卡巴斯基反黑客]
  <I:\Documents and Settings\All Users\「开始」菜单\程序\启动\卡巴斯基反黑
客.lnk --> I:\PROGRA~1\KASPER~1\KASPER~1\KAVPF.exe [Kaspersky Labs]><N>
[服务管理器]
  <I:\Documents and Settings\All Users\「开始」菜单\程序\启动\服务管理器.lnk
--> I:\PROGRA~1\MICROS~1\80\Tools\Binn\sqlmangr.exe [Microsoft Corporation]
><N>
==================================
服务
[Ati HotKey Poller / Ati HotKey Poller]
  <I:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[COM+ Event System / EventSystem]
  <I:\WINDOWS\system32\svchost.exe -k netsvcs-->I:\WINDOWS\system32
\es.dll><Microsoft Corporation>
[Macromedia Licensing Service / Macromedia Licensing Service]
  <"I:\Program Files\Common Files\Macromedia Shared\Service\Macromedia
Licensing.exe"><N/A>
[Machine Debug Manager / MDM]
  <"I:\Program Files\Common Files\Microsoft
Shared\VS7Debug\mdm.exe"><Microsoft Corporation>
[Microsoft Search / MSSEARCH]
  <"I:\Program Files\Common
Files\System\MSSearch\Bin\mssearch.exe"><Microsoft Corporation>
[MSSQLSERVER / MSSQLSERVER]
  <I:\PROGRA~1\MICROS~1\MSSQL\binn\sqlservr.exe><Microsoft Corporation>
[MSSQLServerADHelper / MSSQLServerADHelper]
  <I:\Program Files\Microsoft SQL Server\80
\Tools\Binn\sqladhlp.exe><Microsoft Corporation>
[NOD32 Kernel Service / NOD32krn]
  <"I:\Program Files\Eset\nod32krn.exe"><Eset>
[OracleOraHome92TNSListener / OracleOraHome92TNSListener]
  <E:\Study\Oracle\BIN\TNSLSNR ><N/A>
[OracleServiceORACLE9 / OracleServiceORACLE9]
  <e:\study\oracle\bin\ORACLE.EXE ORACLE9><N/A>
[Remote Packet Capture Protocol v.0 (experimental) / rpcapd]
  <"I:\Program Files\WinPcap\rpcapd.exe" -d -f "I:\Program
Files\WinPcap\rpcapd.ini"><N/A>
[SQLSERVERAGENT / SQLSERVERAGENT]
  <I:\PROGRA~1\MICROS~1\MSSQL\binn\sqlagent.exe><Microsoft Corporation>
[WDelMgr20 / WDelMgr20]
  <I:\WINDOWS\system32\drivers\WDelMgr20.exe><N/A>
==================================
驱动程序
[AMON / AMON]
  <\??\I:\WINDOWS\system32\drivers\amon.sys><Eset>
[ati2mtag / ati2mtag]
  <system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[d347bus / d347bus]
  <\SystemRoot\system32\DRIVERS\d347bus.sys><>
[d347prt / d347prt]
  <\SystemRoot\System32\Drivers\d347prt.sys><>
[F-SECURE AVP / F-SECURE AVP]
  <\??\I:\Program Files\Kaspersky Anti-Virus\FSAVP.SYS><N/A>
[F-SECURE Filter / F-SECURE Filter]
  <\??\I:\Program Files\Kaspersky Anti-Virus\FSFILTER.SYS><N/A>
[F-SECURE Gatekeeper / F-SECURE Gatekeeper]
  <\??\I:\Program Files\Kaspersky Anti-Virus\FSGK.SYS><N/A>
[F-SECURE Recognizer / F-SECURE Recognizer]
  <\??\I:\Program Files\Kaspersky Anti-Virus\FSREC.SYS><N/A>
[VIA Rhine Family Fast Ethernet Adapter Driver / FETNDIS]
  <system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
[gwiopm / gwiopm]
  <\??\D:\系统重要文件\优化大师\gwiopm.sys><N/A>
[IP in IP Tunnel Driver / IpInIp]
  <system32\DRIVERS\ipinip.sys><N/A>
[Klif / Klif]
  <System32\drivers\klif.sys><Kaspersky Labs>
[Klpf / Klpf]
  <\SystemRoot\System32\drivers\Klpf.sys><KL>
[Klpid / Klpid]
  <\SystemRoot\System32\drivers\Klpid.sys><KL>
[KRegEx / KRegEx]
  <\??\I:\WINDOWS\system32\drivers\KRegEx.sys><N/A>
[KSysCall / KSysCall]
  <\??\I:\PROGRA~1\KV2005\KSysCall.sys><N/A>
[NetGroup Packet Filter Driver / NPF]
  <system32\drivers\npf.sys><Politecnico di Torino>
[npkcrypt / npkcrypt]
  <\??\D:\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[NtFsLdf20 / NtFsLdf20]
  <I:\WINDOWS\SYSTEM32\DRIVERS\NtFsLdf20.SYS><Windows (R) 2000 DDK provider>
[p2pfilter / p2pfilter]
  <\??\I:\Program Files\NetSoft\P2POver\p2pfilter.sys><N/A>
[pgyzlbh / pgyzlbhz]
  <\SystemRoot\System32\DRIVERS\pgyzlbhz.sys><N/A>
[PProtect / PProtect]
  <\??\I:\WINDOWS\system32\drivers\PProtect.sys><N/A>
[Direct Parallel Link Driver / Ptilink]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware]
  <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[Secdrv / Secdrv]
  <system32\DRIVERS\secdrv.sys><N/A>
[ViaIde / ViaIde]
  <\SystemRoot\system32\DRIVERS\viaide.sys><Microsoft Corporation>
[Vinyl AC'97 Audio Controller (WDM) / VIAudio]
  <system32\drivers\viaudios.sys><VIA Technologies, Inc.>
==================================

浏览器加载项
[@msdxmLC.dll,-1@2052,电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <I:\WINDOWS\system32\msdxm.ocx,

Microsoft Corporation>
[卡卡上网安全助手]
  {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <I:\WINDOWS\system32\kakatool.dll,

Beijing Rising Technology Co., Ltd.>
[Java Plug-in 1.5.0_04]
  {8AD9C840-044E-11D1-B3E9-00805F499D93} <I:\Program Files\Java\jre1.5.0_04

\bin\npjpi150_04.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.5.0_04]
  {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} <I:\Program Files\Java\jre1.5.0_04

\bin\npjpi150_04.dll, Sun Microsystems, Inc.>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <I:\WINDOWS\system32

\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[添加到QQ表情]
  <D:\Tencent\QQ\AddEmotion.htm, N/A>

==================================
正在运行的进程
[PID: 456][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.2.3790.0

(srv03_rtm.030324-2048)]
[PID: 512][\??\I:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation,

5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 536][\??\I:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation,

5.2.3790.0 (srv03_rtm.030324-2048)]
    [I:\WINDOWS\system32\Ati2evxx.dll]  [ATI Technologies Inc., 6.14.10.4110]
[PID: 580][I:\WINDOWS\system32\services.exe]  [Microsoft Corporation,

5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 592][I:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.2.3790.0

(srv03_rtm.030324-2048)]
    [I:\WINDOWS\system32\imon.dll]  [Eset , 2, 51, 26 ]
    [I:\Program Files\Eset\pr_imon.dll]  [N/A, N/A]
[PID: 768][I:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation,

5.2.3790.0 (srv03_rtm.030324-2048)]
    [I:\WINDOWS\system32\imon.dll]  [Eset , 2, 51, 26 ]
    [I:\Program Files\Eset\pr_imon.dll]  [N/A, N/A]
[PID: 824][I:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation,

5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1012][I:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation,

5.2.3790.0 (srv03_rtm.030324-2048)]
    [I:\WINDOWS\system32\imon.dll]  [Eset , 2, 51, 26 ]
    [I:\Program Files\Eset\pr_imon.dll]  [N/A, N/A]
[PID: 1044][I:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation,

5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1060][I:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation,

5.2.3790.0 (srv03_rtm.030324-2048)]
    [I:\WINDOWS\system32\imon.dll]  [Eset , 2, 51, 26 ]
    [I:\Program Files\Eset\pr_imon.dll]  [N/A, N/A]
    [i:\windows\system32\es.dll]  [Microsoft Corporation, 2001.12.4720.374

(srv03_gdr.050720-1553)]
[PID: 1272][I:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation,

5.2.3790.0 (srv03_rtm.030324-2048)]
    [I:\WINDOWS\system32\imon.dll]  [Eset , 2, 51, 26 ]
    [I:\Program Files\Eset\pr_imon.dll]  [N/A, N/A]
[PID: 1296][I:\WINDOWS\system32\msdtc.exe]  [Microsoft Corporation,

2001.12.4720.0 (srv03_rtm.030324-2048)]
[PID: 1432][I:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation,

5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1488][I:\WINDOWS\system32\inetsrv\inetinfo.exe]  [Microsoft

Corporation, 6.0.3790.0 (srv03_rtm.030324-2048)]
    [I:\WINDOWS\system32\es.dll]  [Microsoft Corporation, 2001.12.4720.374

(srv03_gdr.050720-1553)]
[PID: 1504][I:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe] 

[Microsoft Corporation, 7.10.3077]
    [I:\Program Files\Common Files\Microsoft Shared\VS7Debug\2052\mdmui.dll] 

[Microsoft Corporation, 7.10.3077]
    [I:\Program Files\Common Files\Microsoft Shared\VS7Debug\csm.dll] 

[Microsoft Corporation, 7.10.3077]
    [I:\Program Files\Common Files\Microsoft Shared\VS7Debug\msdbg2.dll] 

[Microsoft Corporation, 7.10.3077]
[PID: 1520][I:\PROGRA~1\MICROS~1\MSSQL\binn\sqlservr.exe]  [Microsoft

Corporation, 2000.080.0760.00]
    [I:\PROGRA~1\MICROS~1\MSSQL\binn\OPENDS60.DLL]  [Microsoft Corporation,

2000.080.0194.00]
    [I:\PROGRA~1\MICROS~1\MSSQL\binn\UMS.DLL]  [Microsoft Corporation,

2000.080.0760.00]
    [I:\PROGRA~1\MICROS~1\MSSQL\binn\SQLSORT.DLL]  [Microsoft Corporation,

2000.080.0760.00]
    [I:\PROGRA~1\MICROS~1\MSSQL\binn\Resources\2052\sqlevn70.RLL]  [Microsoft

Corporation, 2000.080.0760.00]
    [I:\PROGRA~1\MICROS~1\MSSQL\binn\SSNETLIB.dll]  [Microsoft Corporation,

2000.080.0766.00]
    [I:\PROGRA~1\MICROS~1\MSSQL\binn\SSNMPN70.dll]  [Microsoft Corporation,

2000.080.0534.00]
    [I:\WINDOWS\system32\imon.dll]  [Eset , 2, 51, 26 ]
    [I:\Program Files\Eset\pr_imon.dll]  [N/A, N/A]
    [I:\PROGRA~1\MICROS~1\MSSQL\binn\SSmsLPCn.dll]  [Microsoft Corporation,

2000.080.0760.00]
    [I:\PROGRA~1\MICROS~1\MSSQL\binn\SQLFTQRY.DLL]  [Microsoft Corporation,

2000.080.0760.00]
[PID: 1548][I:\Program Files\Eset\nod32krn.exe]  [Eset , 2, 51, 26 ]
    [I:\Program Files\Eset\nod32krr.dll]  [Eset , 2, 51, 26 ]
    [I:\Program Files\Eset\ps_amon.dll]  [Eset , 2, 51, 26 ]
    [I:\Program Files\Eset\pr_amon.dll]  [Eset , 2, 51, 26 ]
    [I:\Program Files\Eset\ps_dmon.dll]  [Eset , 2, 51, 26 ]
    [I:\Program Files\Eset\pr_dmon.dll]  [N/A, N/A]
    [I:\Program Files\Eset\ps_emon.dll]  [Eset , 2, 51, 26 ]
    [I:\Program Files\Eset\pr_emon.dll]  [N/A, N/A]
    [I:\WINDOWS\system32\imon.dll]  [Eset , 2, 51, 26 ]
    [I:\Program Files\Eset\pr_imon.dll]  [N/A, N/A]
    [I:\Program Files\Eset\ps_nod32.dll]  [Eset , 2, 51, 26 ]
    [I:\Program Files\Eset\pr_nod32.dll]  [Eset , 2, 51, 26 ]
    [I:\Program Files\Eset\ps_upd.dll]  [Eset , 2, 51, 26 ]
    [I:\Program Files\Eset\pr_upd.dll]  [N/A, N/A]
[PID: 1596][I:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation,

5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1632][I:\WINDOWS\system32\drivers\WDelMgr20.exe]  [N/A, N/A]
[PID: 1676][I:\WINDOWS\system32\Windows Media\Server\WMServer.exe] 

[Microsoft Corporation, 9.00.00.3372 (dnsrv.030218-1708)]
    [I:\WINDOWS\system32\imon.dll]  [Eset , 2, 51, 26 ]
    [I:\Program Files\Eset\pr_imon.dll]  [N/A, N/A]
[PID: 1708][I:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe] 

[Microsoft Corporation, 9.107.8320.0]
    [I:\Program Files\Common Files\System\MSSearch\Bin\mssws.dll]  [Microsoft

Corporation, 9.107.8320.0]
    [I:\PROGRA~1\COMMON~1\System\MSSearch\Bin\mssrch.dll]  [Microsoft

Corporation, 9.107.8320.0]
    [I:\Program Files\Common Files\System\MSSearch\Bin\tquery.dll] 

[Microsoft Corporation, 9.107.8320.0]
    [I:\PROGRA~1\COMMON~1\System\MSSearch\Bin\propdefs.dll]  [Microsoft

Corporation, 9.107.8320.0]
    [I:\PROGRA~1\COMMON~1\System\MSSearch\Bin\srchidx.dll]  [Microsoft

Corporation, 9.107.8320.0]
[PID: 1912][I:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation,

5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 2188][I:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.3790.0

(srv03_rtm.030324-2048)]
[PID: 2288][I:\Program Files\Eset\nod32kui.exe]  [Eset , 2, 51, 26 ]
    [I:\Program Files\Eset\nod32rui.dll]  [N/A, N/A]
    [I:\Program Files\Eset\pu_amon.dll]  [Eset , 2, 51, 26 ]
    [I:\Program Files\Eset\pr_amon.dll]  [Eset , 2, 51, 26 ]
    [I:\Program Files\Eset\pu_dmon.dll]  [Eset , 2, 51, 26 ]
    [I:\Program Files\Eset\pr_dmon.dll]  [N/A, N/A]
    [I:\Program Files\Eset\pu_emon.dll]  [Eset , 2, 51, 26 ]
    [I:\Program Files\Eset\pr_emon.dll]  [N/A, N/A]
    [I:\Program Files\Eset\pu_imon.dll]  [Eset , 2, 51, 26 ]
    [I:\Program Files\Eset\pr_imon.dll]  [N/A, N/A]
    [I:\Program Files\Eset\pu_nod32.dll]  [Eset , 2, 51, 26 ]
    [I:\Program Files\Eset\pr_nod32.dll]  [Eset , 2, 51, 26 ]
    [I:\Program Files\Eset\pu_upd.dll]  [Eset , 2, 51, 26 ]
    [I:\Program Files\Eset\pr_upd.dll]  [N/A, N/A]
[PID: 2340][I:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation,

5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 2500][I:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe] 

[Kaspersky Labs, 1.7.0.130]
    [I:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\BCGCB59.dll] 

[BCGSoft Ltd, 5, 84, 0, 0]
    [I:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\perfiloc.dll] 

[Kaspersky Labs, 1.5.0.0]
    [I:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\BCGCBRes.dll] 

[BCGSoft Ltd, 5, 84, 0, 0]
[PID: 2700][I:\WINDOWS\system32\wbem\wmiprvse.exe]  [Microsoft Corporation,

5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 2812][D:\Downloads\sreng2\SREng\SREng.exe]  [Smallfrogs Studio,

2.2.6.605]
    [I:\WINDOWS\system32\imon.dll]  [Eset , 2, 51, 26 ]
    [I:\Program Files\Eset\pr_imon.dll]  [N/A, N/A]

==================================

文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["I:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  Error. []
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
NOD32 protected [MSAFD Tcpip [TCP/IP]]
    I:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning

support)
NOD32 protected [MSAFD Tcpip [UDP/IP]]
    I:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning

support)
NOD32 protected [MSAFD Tcpip [RAW/IP]]
    I:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning

support)
NOD32 protected [RSVP UDP Service Provider]
    I:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning

support)
NOD32 protected [RSVP TCP Service Provider]
    I:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning

support)
NOD32
    I:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning

support)

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
*****************************************************************************
Logfile of HijackThis v1.99.1
Scan saved at 21:18:17 下午, on 2006-11-30
Platform: Windows 2003  (WinNT 5.02.3790)
MSIE: Internet Explorer v6.00 (6.00.3790.0000)

Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\system32\spoolsv.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\system32\inetsrv\inetinfo.exe
I:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
I:\PROGRA~1\MICROS~1\MSSQL\binn\sqlservr.exe
I:\Program Files\Eset\nod32krn.exe
I:\WINDOWS\system32\drivers\WDelMgr20.exe
I:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\Explorer.EXE
I:\Program Files\Eset\nod32kui.exe
I:\WINDOWS\System32\svchost.exe
I:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
E:\Desktopbackup\新建文件夹\未使用的桌面快捷方式\hijackthis\HijackThis.exe

O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-

00A0C9082467} - I:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} -

I:\WINDOWS\system32\kakatool.dll
O4 - HKLM\..\Run: [AVP Monitor] I:\Program Files\Kaspersky Anti-

Virus\avpm.exe
O4 - HKLM\..\Run: [MSPY2002] I:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe

/SYNC
O4 - HKLM\..\Run: [nod32kui] "I:\Program Files\Eset\nod32kui.exe"

/WAITSERVICE
O4 - HKLM\..\Run: [IMJPMIG8.1] "I:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil

/RemAdvDef /Migration32
O4 - HKLM\..\Run: [ATIPTA] I:\Program Files\ATI Technologies\ATI Control

Panel\atiptaxx.exe
O4 - HKLM\..\Run: [MSConfig] ;

"I:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" /auto
O4 - HKCU\..\Run: [ctfmon.exe] ; I:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: 卡巴斯基反黑客.lnk = I:\Program Files\Kaspersky

Lab\Kaspersky Anti-Hacker\KAVPF.exe
O4 - Global Startup: 服务管理器.lnk = I:\Program Files\Microsoft SQL

Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: 添加到QQ表情 - D:\Tencent\QQ\AddEmotion.htm
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - I:\Program

Files\Common Files\Microsoft Shared\Help\hxds.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. -

I:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - I:\Program

Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - I:\Program

Files\Eset\nod32krn.exe
O23 - Service: OracleOraHome92TNSListener - Unknown owner -

E:\Study\Oracle\BIN\TNSLSNR.exe (file missing)
O23 - Service: OracleServiceORACLE9 - Unknown owner -

e:\study\oracle\bin\ORACLE.EXE (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) -

Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%

\WinPcap\rpcapd.ini (file missing)
O23 - Service: WDelMgr20 - Unknown owner - I:\WINDOWS\system32

\drivers\WDelMgr20.exe


请高手看看怎么搞，谢谢!!

在线等高手。。。。