被zhicheng.com劫持，每天都跳出来，可恶之极 bbs.ikaka.com

Yangtze - 2006-6-20 10:30:00

zhicheng.com 可恶之极！每天都跳出来。
简直想请人骂爆他们的电话。

下面是HijackThis的日志，怎么解决这个问题？
谢谢！

Logfile of HijackThis v1.99.1
Scan saved at 10:16:02, on 2006-6-20
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\ctfmon.exe
D:\AppServ\Apache\Apache.exe
C:\WINDOWS\SYSTEM32\RUNDLL32.EXE
D:\AppServ\mysql\bin\mysqld-nt.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
D:\AppServ\Apache\Apache.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\download\hijackthis1991\HijackThis.exe

O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v8.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/
O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} (Edit Class) - https://www.sz1.cmbchina.com/download/CMBEdit.cab
O16 - DPF: {F2EB8999-766E-4BF6-AAAD-188D398C0D0B} (PBActiveX40 Control) - http://www4.cmbchina.com/download/pb45.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Apache - Unknown owner - D:\AppServ\Apache\Apache.exe" --ntservice (file missing)
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MySQL - Unknown owner - D:\AppServ\mysql\bin\mysqld-nt.exe
O23 - Service: PurgeIE XP Service (PurgeIEservice) - Unknown owner - C:\Program Files\PurgeIE\PurgeIE_Service.exe (file missing)
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
O23 - Service: VAIO Entertainment Task Scheduler - Unknown owner - C:\Program Files\Sony\VAIO Entertainment\VzTaskScheduler.exe (file missing)
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-IntegratedServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\IntegratedServer\HTTP (file missing)
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe" /Service=VAIOMediaPlatform-Mobile-Gateway /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Addons\Packages\Mobile\Gateway" /DisplayName="VAIO Media Gateway Server (file missing)
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

我无邪 - 2006-6-20 14:46:00

O23 - Service: PurgeIE XP Service (PurgeIEservice) - Unknown owner - C:\Program Files\PurgeIE\PurgeIE_Service.exe (file missing)
这一项，如果似乎是个下载软件，你知道吗？
请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。

Yangtze - 2006-6-21 10:32:00

这是稍描结果的第一部分

2006-06-21,10:19:14

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Home Edition Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation]
<eMuleAutoStart><; C:\Program Files\eMule\eMule.exe -AutoStart> []
<MsnMsgr><; "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background> [Microsoft Corporation]
<Skype><; "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized> []
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
<run><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IgfxTray><C:\WINDOWS\system32\igfxtray.exe> [Intel Corporation]
<HotKeysCmds><C:\WINDOWS\system32\hkcmd.exe> [Intel Corporation]
<IMEKRMIG6.1><C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE> [Microsoft Corporation]
<BigDog303><; C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)> []
<ccApp><; "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"> []
<Google Desktop Search><; "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup> []
<ISBMgr.exe><; C:\Program Files\Sony\ISB Utility\ISBMgr.exe> [Sony Corporation]
<iTunesHelper><; "C:\Program Files\iTunes\iTunesHelper.exe"> []
<QuickTime Task><; "C:\Program Files\QuickTime\qttask.exe" -atboottime> []
<StormCodec_Helper><; "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti> []
<{0228e555-4f9c-4e35-a3ec-b109a192b4c2}><; C:\Program Files\Google\Gmail Notifier\gnotify.exe> [Google Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><C:\WINDOWS\system32\vaiomov.scr> [Sony Corporation]

==================================
启动文件夹
服务
[Apache / Apache]
<"D:\AppServ\Apache\Apache.exe" --ntservice><N/A>
[Performance Moniter / BUZOR]
<C:\WINDOWS\SYSTEM32\RUNDLL32.EXE C:\WINDOWS\SYSTEM32\WBEM\IRJIT.DLL,Export 1087><N/A>
[EvtEng / EvtEng]
<C:\Program Files\Intel\Wireless\Bin\EvtEng.exe><Intel Corporation>
[InstallDriver Table Manager / IDriverT]
<"C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe"><Macrovision Corporation>
[Macromedia Licensing Service / Macromedia Licensing Service]
<"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><N/A>
[MySQL / MySQL]
<D:\AppServ\mysql\bin\mysqld-nt.exe MySQL><N/A>
[PurgeIE XP Service / PurgeIEservice]
<C:\Program Files\PurgeIE\PurgeIE_Service.exe><N/A>
[RegSrvc / RegSrvc]
<C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe><Intel Corporation>
[Spectrum24 Event Monitor / S24EventMonitor]
<C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe><Intel Corporation>
[Symantec Network Drivers Service / SNDSrvc]
<"C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe"><Symantec Corporation>
[VAIO Entertainment Aggregation and Control Service / VAIO Entertainment Aggregation and Control Service]
<"C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe"><Sony Corporation>
[VAIO Entertainment Task Scheduler / VAIO Entertainment Task Scheduler]
<"C:\Program Files\Sony\VAIO Entertainment\VzTaskScheduler.exe"><N/A>
[VAIO Entertainment TV Device Arbitration Service / VAIO Entertainment TV Device Arbitration Service]
<"C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe"><Sony Corporation>
[VAIO Event Service / VAIO Event Service]
<C:\Program Files\Sony\VAIO Event Service\VESMgr.exe><Sony Corporation>
[VAIO Media Integrated Server / VAIOMediaPlatform-IntegratedServer-AppServer]
<C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe><Sony Corporation>
[VAIO Media Integrated Server (HTTP) / VAIOMediaPlatform-IntegratedServer-HTTP]
<"C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-IntegratedServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\IntegratedServer\HTTP"><N/A>
[VAIO Media Integrated Server (UPnP) / VAIOMediaPlatform-IntegratedServer-UPnP]
<C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe><Sony Corporation>
[VAIO Media Gateway Server / VAIOMediaPlatform-Mobile-Gateway]
<"C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe" /Service=VAIOMediaPlatform-Mobile-Gateway /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Addons\Packages\Mobile\Gateway" /DisplayName="VAIO Media Gateway Server"><N/A>
[VAIO Entertainment UPnP Client Adapter / Vcsw]
<C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe -RunBySCM><Sony Corporation>
[VAIO Entertainment Database Service / VzCdbSvc]
<"C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe"><Sony Corporation>
[VAIO Entertainment File Import Service / VzFw]
<C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe><Sony Corporation>

Yangtze - 2006-6-21 10:34:00

这是稍描结果的第二部分

==================================
浏览器加载项
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v8.dll, >
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[Google Toolbar Helper]
{AA58ED58-01DD-4d91-8333-CF10577473F7} <c:\program files\google\googletoolbar1.dll, Google Inc.>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FlashGet\fgiebar.dll, Amaze Soft>
[&Google]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar1.dll, Google Inc.>
[Edit Class]
{0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\WINDOWS\system32\CMBEdit.dll, >
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Flash.ocx, Macromedia, Inc.>
[PBActiveX40 Control]
{F2EB8999-766E-4BF6-AAAD-188D398C0D0B} <C:\WINDOWS\system32\CMBPB40.ocx, China Merchants Bank>
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v8.dll, >
[HelperObject Class]
{00C6482D-C502-44C8-8409-FCE54AD9C208} <C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll, TechSmith Corporation>
[Google Script Object]
{00EF2092-6AC5-47C0-BD25-CF2D5D657FEB} <c:\program files\google\googletoolbar1.dll, Google Inc.>
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[MiPMchatBtn Class]
{0AD483DA-CC0E-4562-B828-C33E11F5FA62} <D:\Miphone2\IeMibtn.dll, N/A>
[Edit Class]
{0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\WINDOWS\system32\CMBEdit.dll, >
[PaiditEdit Class]
{110D36B4-DA6C-4A2B-B160-44109802C707} <C:\WINDOWS\DOWNLO~1\PAIDIT~1.DLL, >
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[&Google]
{2318C2B1-4965-11D4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar1.dll, Google Inc.>
[PowerPlr Control]
{2354A44B-3CEB-4829-9940-545B03103538} <C:\WINDOWS\DOWNLO~1\PowerPlr.ocx, Powerise Digital>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[IETag Factory]
{38481807-CA0E-42D2-BF39-B33AF135CC4D} <C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\IETAG.DLL, Microsoft Corporation>
[XML Document]
{48123BC4-99D9-11D1-A6B3-00C04FD91555} <%SystemRoot%\system32\msxml3.dll, N/A>
[CEditCtrl Object]
{488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\system32\aliedit\AliEdit.dll, www.alipay.com>
[MSN Photo Upload Tool]
{4F1E5B1A-2A80-42CA-8532-2D05CB959537} <C:\WINDOWS\Downloaded Program Files\MsnPUpld.dll, Microsoft? Corporation>
[HHCtrl Object]
{52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[DragSearch BHO]
{62EED7C6-9F02-42F9-B634-98E2899E147B} <C:\PROGRA~1\Yahoo!\ASSIST~1\assist\YDRAGS~1.DLL, N/A>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[SnagIt]
{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} <C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll, TechSmith Corporation>
[photo_uploader Control]
{A984ED9F-E8DA-44E5-BC18-C14B9ABEF79D} <C:\PROGRA~1\PHOTO_~1\PHOTO_~1.OCX, N/A>
[RMGetLicense Class]
{A9FC132B-096D-460B-B7D5-1DB0FAE0C062} <C:\WINDOWS\system32\msnetobj.dll, Microsoft Corporation>
[Google Toolbar Helper]
{AA58ED58-01DD-4D91-8333-CF10577473F7} <c:\program files\google\googletoolbar1.dll, Google Inc.>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[IECmdExecute Class]
{B13B4423-2647-4CFC-A4B3-C7D56CB83487} <C:\Program Files\Hello\PicasaCapture.dll, Picasa, Inc.>
[MiPBtn Class]
{B35138BB-9270-4EF1-9A7B-9EEC90220024} <D:\Miphone2\IeMibtn.dll, N/A>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[]
{B69003B3-C55E-4B48-836C-BC5946FC3B28} <C:\Program Files\Messenger\msgsc.dll, Microsoft Corporation>
[Microsoft DirectAnimation Control]
{B6FFC24C-7E13-11D0-9B47-00C04FC2F51D} <C:\WINDOWS\system32\danim.dll, Microsoft Corporation>
[MacroMediapd]
{B8CCDD47-38E4-4CD2-B7FA-3B4B690F74BD} <C:\WINDOWS\system32\microapmddt.dll, MACROMEDlA>
[OWSClientMiscApis Class]
{BDEADE3F-C265-11D0-BCED-00A0C90AB50F} <C:\PROGRA~1\MICROS~2\OFFICE11\OWSCLT.DLL, Microsoft Corporation>
[OWSBrowserUI Class]
{BDEADE43-C265-11D0-BCED-00A0C90AB50F} <C:\PROGRA~1\MICROS~2\OFFICE11\OWSCLT.DLL, Microsoft Corporation>
[OWSDiscussionServers Class]
{BDEADEB7-C265-11D0-BCED-00A0C90AB50F} <C:\PROGRA~1\MICROS~2\OFFICE11\OWSCLT.DLL, Microsoft Corporation>
[Adobe Acrobat 7.0 Browser Document]
{CA8A9780-280D-11CF-A24D-444553540000} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroPDF.dll, Adobe Systems, Inc.>
[AUDIO__MID Moniker Class]
{CD3AFA74-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__MP3 Moniker Class]
{CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__WAV Moniker Class]
{CD3AFA7B-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
{CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__AVI Moniker Class]
{CD3AFA88-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_ASF Moniker Class]
{CD3AFA8F-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
{CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Flash.ocx, Macromedia, Inc.>
[VC2MyEdit Class]
{DC0D755B-EA1F-4E85-B7F7-B2E3A4AEB918} <C:\WINDOWS\system32\CmbSafeBase.dll, >
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FlashGet\fgiebar.dll, Amaze Soft>
[PBActiveX40 Control]
{F2EB8999-766E-4BF6-AAAD-188D398C0D0B} <C:\WINDOWS\system32\CMBPB40.ocx, China Merchants Bank>
[使用网际快车下载]
<C:\Program Files\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<C:\Program Files\FlashGet\jc_all.htm, N/A>

Yangtze - 2006-6-21 10:36:00

第三部分

==================================
正在运行的进程
[PID: 604][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 668][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 692][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2505 (xpsp.040806-1825)>
[PID: 736][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 748][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 904][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 976][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1068][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1100][C:\Program Files\Intel\Wireless\Bin\EvtEng.exe] <Intel Corporation><9, 0, 1, 12>
[C:\Program Files\Intel\Wireless\Bin\PsRegApi.dll] <Intel Corporation><9, 0, 1, 14>
[C:\Program Files\Intel\Wireless\Bin\TraceAPI.DLL] <Intel Corporation><9, 0, 1, 22>
[PID: 1224][C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe] <Intel Corporation ><9, 0, 1, 41>
[C:\Program Files\Intel\Wireless\Bin\TraceAPI.DLL] <Intel Corporation><9, 0, 1, 22>
[C:\Program Files\Intel\Wireless\Bin\PsRegApi.dll] <Intel Corporation><9, 0, 1, 14>
[PID: 1260][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1392][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1644][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)>
[C:\WINDOWS\system32\CNMLM6e.DLL] <CANON INC.><1.80.2.50>
[C:\WINDOWS\system32\cpwmon2k.dll] <N/A><N/A>
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\CNMPD6e.DLL] <CANON INC.><1.80.2.50>
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\CNMUI6e.DLL] <CANON INC.><1.80.2.50>
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\CNMDR6e.DLL] <CANON INC.><1.80.2.50>
[PID: 1880][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll] <Adobe Systems, Inc.><7.0.0.0>
[C:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[C:\Program Files\TechSmith\SnagIt 7\SnagItShellExt.dll] <TechSmith Corporation><1.0.0.1>
[D:\Applications\phpZip\phpZipExt.dll] <><1, 0, 0, 19>
[C:\Program Files\eFax Messenger 4.0\J2GShell.dll] <j2 Global Communications, Inc.><4.0.134.0>
[C:\Program Files\eFax Messenger 4.0\J2GRes_Enu.dll] <j2 Global Communications, Inc.><4.0.134.0>
[C:\Program Files\Ipswitch\WS_FTP Professional\wsftpsi.dll] <Ipswitch, Inc. 10 Maguire Road - Suite 220 Lexington, MA 02421><2006,0,1,0>
[C:\Program Files\Ipswitch\WS_FTP Professional\wsftpext.dll] <Ipswitch, Inc. 10 Maguire Road - Suite 220 Lexington, MA 02421><2006,0,1,0>
[C:\Program Files\Ipswitch\WS_FTP Professional\LIBEAY32.dll] <N/A><N/A>
[C:\Program Files\Ipswitch\WS_FTP Professional\SSLEAY32.dll] <N/A><N/A>
[C:\Program Files\Ipswitch\WS_FTP Professional\sslsvc.dll] <Ipswitch, Inc. 10 Maguire Road - Suite 220 Lexington, MA 02421><2006,0,1,0>
[C:\Program Files\Ipswitch\WS_FTP Professional\wsftplib.dll] <N/A><N/A>
[C:\Program Files\Ipswitch\WS_FTP Professional\wsfirscr.dll] <N/A><N/A>
[C:\Program Files\Ipswitch\WS_FTP Professional\wshosts.dll] <N/A><N/A>
[C:\Program Files\Ipswitch\WS_FTP Professional\ipspgp.dll] <N/A><N/A>
[C:\Program Files\Ipswitch\WS_FTP Professional\res0409.dll] <Ipswitch, Inc. 10 Maguire Road - Suite 220 Lexington, MA 02421><2006, 0, 1, 0>
[C:\WINDOWS\system32\xunleibho_v8.dll] <><4, 5, 1, 33>
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll] <Adobe Systems Incorporated><7.0.0.2004121400>
[PID: 368][C:\WINDOWS\system32\hkcmd.exe] <Intel Corporation><3.0.0.3929>
[C:\WINDOWS\system32\hccutils.DLL] <Intel Corporation><3.0.0.3929>
[C:\WINDOWS\system32\igfxdev.dll] <Intel Corporation><3.0.0.3929>
[C:\WINDOWS\system32\igfxsrvc.dll] <Intel Corporation><3.0.0.3929>
[C:\WINDOWS\system32\igfxhk.dll] <Intel Corporation><3.0.0.3929>
[C:\WINDOWS\system32\igfxres.dll] <Intel Corporation><3.0.0.3929>
[PID: 392][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1512][D:\AppServ\Apache\Apache.exe] <N/A><N/A>
[D:\AppServ\Apache\ApacheCore.dll] <N/A><N/A>
[D:\AppServ\Apache\Win9xConHook.dll] <N/A><N/A>
[d:\appserv\php\php5ts.dll] <The PHP Group><5.0.1.1>
[D:\AppServ\php\ext\php_dbase.dll] <The PHP Group><5.0.1.1>
[D:\AppServ\php\ext\php_gd2.dll] <The PHP Group><5.0.1.1>
[D:\AppServ\php\ext\php_mysql.dll] <The PHP Group><5.0.1.1>
[C:\WINDOWS\system32\LIBMYSQL.dll] <N/A><N/A>
[D:\AppServ\php\ext\php_ming.dll] <The PHP Group><5.0.1.1>
[D:\AppServ\php\ext\php_sockets.dll] <The PHP Group><5.0.1.1>
[d:\appserv\apache\modules\mod_status.so] <N/A><N/A>
[d:\appserv\apache\modules\mod_info.so] <N/A><N/A>
[d:\appserv\apache\modules\mod_rewrite.so] <N/A><N/A>
[d:\appserv\php\php5apache.dll] <The PHP Group><5.0.1.1>
[D:\AppServ\php\Zend\lib\ZendExtensionManager.dll] <N/A><N/A>
[D:\AppServ\php\Zend\lib\Optimizer-2.5.3\php-5.0.0\ZendOptimizer.dll] <N/A><N/A>
[PID: 1536][C:\WINDOWS\SYSTEM32\RUNDLL32.EXE] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1616][D:\AppServ\mysql\bin\mysqld-nt.exe] <N/A><N/A>
[PID: 1944][D:\AppServ\Apache\Apache.exe] <N/A><N/A>
[D:\AppServ\Apache\ApacheCore.dll] <N/A><N/A>
[D:\AppServ\Apache\Win9xConHook.dll] <N/A><N/A>
[d:\appserv\apache\modules\mod_status.so] <N/A><N/A>
[d:\appserv\apache\modules\mod_info.so] <N/A><N/A>
[d:\appserv\apache\modules\mod_rewrite.so] <N/A><N/A>
[d:\appserv\php\php5apache.dll] <The PHP Group><5.0.1.1>
[d:\appserv\php\php5ts.dll] <The PHP Group><5.0.1.1>
[D:\AppServ\php\Zend\lib\ZendExtensionManager.dll] <N/A><N/A>
[D:\AppServ\php\ext\php_dbase.dll] <The PHP Group><5.0.1.1>
[D:\AppServ\php\ext\php_gd2.dll] <The PHP Group><5.0.1.1>
[D:\AppServ\php\ext\php_mysql.dll] <The PHP Group><5.0.1.1>
[C:\WINDOWS\system32\LIBMYSQL.dll] <N/A><N/A>
[D:\AppServ\php\ext\php_ming.dll] <The PHP Group><5.0.1.1>
[D:\AppServ\php\ext\php_sockets.dll] <The PHP Group><5.0.1.1>
[D:\AppServ\php\Zend\lib\Optimizer-2.5.3\php-5.0.0\ZendOptimizer.dll] <N/A><N/A>
[PID: 1968][C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe] <Intel Corporation><9, 0, 1, 10>
[PID: 436][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 480][C:\WINDOWS\system32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: DNSRV(bld4act)>
[PID: 512][C:\Program Files\Sony\VAIO Event Service\VESMgr.exe] <Sony Corporation><2.0.00.09300>
[C:\Program Files\Sony\VAIO Event Service\VESSuEvent.dll] <Sony Corporation><2.0.00.10290>
[C:\Program Files\Sony\VAIO Event Service\VESBasePS.dll] <N/A><N/A>
[C:\Program Files\Common Files\Sony Shared\Sony Utilities\SnyUtils.dll] <Sony Corporation><6, 0, 0, 10230>
[C:\Program Files\Common Files\Sony Shared\SXBIOS\sxbios.dll] <Sony Corporation><4.02.8170>
[C:\Program Files\Sony\VAIO Event Service\VESWndMsg.dll] <Sony Corporation><2.0.00.10290>
[C:\Program Files\Sony\VAIO Event Service\VESTransform.dll] <Sony Corporation><2.0.00.10290>
[C:\Program Files\Sony\VAIO Event Service\VESWndMsgHook.dll] <Sony Corporation><1.1.00.08050>
[C:\Program Files\Sony\VAIO Power Management\VESPowerMgr.dll] <Sony Corporation><2.0.00.102700>
[C:\Program Files\Sony\VAIO Event Service\VESSuPerform.dll] <Sony Corporation><2.0.00.10290>
[C:\Program Files\Sony\VAIO Event Service\VESVideo.dll] <Sony Corporation><2.0.00.11050>
[C:\Program Files\Sony\VAIO Event Service\VESPerform.dll] <Sony Corporation><2.0.00.11050>
[C:\Program Files\Sony\VAIO Event Service\VESHKWndCommon.dll] <Sony Corporation><2.0.00.10290>
[PID: 576][C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe] <Sony Corporation><1.2.00.09101>
[C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\sonyuppc.dll] <Sony Corporation><6.0.00.08050>
[C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\UPnPCtrl.dll] <Sony Corporation><2, 0, 1, 10010>
[C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSWEXEps.dll] <Sony Corporation><1.2.00.09101>
[PID: 824][C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe] <Sony Corporation><1.2.01.10250>
[C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbVcds.dll] <Sony Corporation><1.2.01.10070>
[C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSsDB.dll] <Sony Corporation><1.2.01.10120>
[C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbLocalDB.dll] <Sony Corporation><1.2.01.10070>
[C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSWEXEps.dll] <Sony Corporation><1.2.00.09101>
[C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvcps.dll] <Sony Corporation><1.2.01.10250>
[C:\Program Files\Common Files\Sony Shared\AvLib\Metallic.dll] <Sony Corporation><2.7.00.14160>

Yangtze - 2006-6-21 10:36:00

第四部分

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS Error. ["C:\Program Files\Macromedia\Dreamweaver MX 2004\Dreamweaver.exe" "%1"]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

我无邪 - 2006-6-21 13:49:00

我要删除这几项
如果你知道，就不必修复
PurgeIE XP Service / PurgeIEservice]
<C:\Program Files\PurgeIE\PurgeIE_Service.exe><N/A>

Edit Class]
{0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\WINDOWS\system32\CMBEdit.dll, >
MacroMediapd]
{B8CCDD47-38E4-4CD2-B7FA-3B4B690F74BD} <C:\WINDOWS\system32\microapmddt.dll, MACROMEDlA>
[VC2MyEdit Class]
{DC0D755B-EA1F-4E85-B7F7-B2E3A4AEB918} <C:\WINDOWS\system32\CmbSafeBase.dll, >
运行System Repair Engineer，点“启动项目，服务，点“Win32服务应用程序”勾选“隐藏微软服务”选中病毒服务Performance Moniter ，PurgeIE XP Service选择“删除服务”点“设置”选择“否”最后重启。（每一个逗号隔开的就是一个病毒的服务，请逐一删除）
关闭所有浏览窗口以及一些不必要的程序
运行System Repair Engineer，使用“系统修复，浏览器加载项”来删除以下选项。
Edit Class]
{0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\WINDOWS\system32\CMBEdit.dll, >
MacroMediapd]
{B8CCDD47-38E4-4CD2-B7FA-3B4B690F74BD} <C:\WINDOWS\system32\microapmddt.dll, MACROMEDlA>
[VC2MyEdit Class]
{DC0D755B-EA1F-4E85-B7F7-B2E3A4AEB918} <C:\WINDOWS\system32\CmbSafeBase.dll, >
双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示确定更改时，单击“是”，清除“隐藏已知文件类型的扩展名
删除
C:\WINDOWS\system32\CmbSafeBase.dll
C:\WINDOWS\system32\microapmddt.dll
C:\WINDOWS\system32\CMBEdit.dll
C:\Program Files\PurgeIE
C:\WINDOWS\SYSTEM32\WBEM\IRJIT.DLL

瑞星卡卡安全论坛