该死的垃圾9505导航【求助】 bbs.ikaka.com

dadajiangtu - 2006-11-30 21:49:00

昨天中了病毒，一开浏览器就指向9505导航。当时是msconfig里多了CNNIC和down两个启
动项。取消并删除相关的EXE文件之后还是不行。QQ也删了，3年的聊天记录和一些资料

眨眼的工夫全没了，很痛苦。硬盘上有两个系统，XP和2003.XP暂时幸免于难。
用hijackthis和SREngLOG两个工具扫描下系统，向高手求救。
不胜感激!!!!!
2006-11-30,21:17:15

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows Server 2003 Enterprise Edition (Build 3790)
- 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><; I:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft
Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
<run><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<AVP Monitor><I:\Program Files\Kaspersky Anti-Virus\avpm.exe> [N/A]
<MSPY2002><I:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC>
[(Verified)N/A]
<nod32kui><"I:\Program Files\Eset\nod32kui.exe" /WAITSERVICE> [Eset ]
<IMJPMIG8.1><"I:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef

/Migration32> [(Verified)Microsoft Corporation]
<ATIPTA><I:\Program Files\ATI Technologies\ATI Control

Panel\atiptaxx.exe> [ATI Technologies, Inc.]
<MSConfig><; "I:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" /auto>
[(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><I:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft
Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><%SystemRoot%\system32\logonui.exe> [(Verified)Microsoft
Corporation]
==================================
启动文件夹
[卡巴斯基反黑客]
<I:\Documents and Settings\All Users\「开始」菜单\程序\启动\卡巴斯基反黑
客.lnk --> I:\PROGRA~1\KASPER~1\KASPER~1\KAVPF.exe [Kaspersky Labs]><N>
[服务管理器]
<I:\Documents and Settings\All Users\「开始」菜单\程序\启动\服务管理器.lnk
--> I:\PROGRA~1\MICROS~1\80\Tools\Binn\sqlmangr.exe [Microsoft Corporation]
><N>
==================================
服务
[Ati HotKey Poller / Ati HotKey Poller]
<I:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[COM+ Event System / EventSystem]
<I:\WINDOWS\system32\svchost.exe -k netsvcs-->I:\WINDOWS\system32
\es.dll><Microsoft Corporation>
[Macromedia Licensing Service / Macromedia Licensing Service]
<"I:\Program Files\Common Files\Macromedia Shared\Service\Macromedia
Licensing.exe"><N/A>
[Machine Debug Manager / MDM]
<"I:\Program Files\Common Files\Microsoft
Shared\VS7Debug\mdm.exe"><Microsoft Corporation>
[Microsoft Search / MSSEARCH]
<"I:\Program Files\Common
Files\System\MSSearch\Bin\mssearch.exe"><Microsoft Corporation>
[MSSQLSERVER / MSSQLSERVER]
<I:\PROGRA~1\MICROS~1\MSSQL\binn\sqlservr.exe><Microsoft Corporation>
[MSSQLServerADHelper / MSSQLServerADHelper]
<I:\Program Files\Microsoft SQL Server\80
\Tools\Binn\sqladhlp.exe><Microsoft Corporation>
[NOD32 Kernel Service / NOD32krn]
<"I:\Program Files\Eset\nod32krn.exe"><Eset>
[OracleOraHome92TNSListener / OracleOraHome92TNSListener]
<E:\Study\Oracle\BIN\TNSLSNR ><N/A>
[OracleServiceORACLE9 / OracleServiceORACLE9]
<e:\study\oracle\bin\ORACLE.EXE ORACLE9><N/A>
[Remote Packet Capture Protocol v.0 (experimental) / rpcapd]
<"I:\Program Files\WinPcap\rpcapd.exe" -d -f "I:\Program
Files\WinPcap\rpcapd.ini"><N/A>
[SQLSERVERAGENT / SQLSERVERAGENT]
<I:\PROGRA~1\MICROS~1\MSSQL\binn\sqlagent.exe><Microsoft Corporation>
[WDelMgr20 / WDelMgr20]
<I:\WINDOWS\system32\drivers\WDelMgr20.exe><N/A>
==================================
驱动程序
[AMON / AMON]
<\??\I:\WINDOWS\system32\drivers\amon.sys><Eset>
[ati2mtag / ati2mtag]
<system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[d347bus / d347bus]
<\SystemRoot\system32\DRIVERS\d347bus.sys><>
[d347prt / d347prt]
<\SystemRoot\System32\Drivers\d347prt.sys><>
[F-SECURE AVP / F-SECURE AVP]
<\??\I:\Program Files\Kaspersky Anti-Virus\FSAVP.SYS><N/A>
[F-SECURE Filter / F-SECURE Filter]
<\??\I:\Program Files\Kaspersky Anti-Virus\FSFILTER.SYS><N/A>
[F-SECURE Gatekeeper / F-SECURE Gatekeeper]
<\??\I:\Program Files\Kaspersky Anti-Virus\FSGK.SYS><N/A>
[F-SECURE Recognizer / F-SECURE Recognizer]
<\??\I:\Program Files\Kaspersky Anti-Virus\FSREC.SYS><N/A>
[VIA Rhine Family Fast Ethernet Adapter Driver / FETNDIS]
<system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
[gwiopm / gwiopm]
<\??\D:\系统重要文件\优化大师\gwiopm.sys><N/A>
[IP in IP Tunnel Driver / IpInIp]
<system32\DRIVERS\ipinip.sys><N/A>
[Klif / Klif]
<System32\drivers\klif.sys><Kaspersky Labs>
[Klpf / Klpf]
<\SystemRoot\System32\drivers\Klpf.sys><KL>
[Klpid / Klpid]
<\SystemRoot\System32\drivers\Klpid.sys><KL>
[KRegEx / KRegEx]
<\??\I:\WINDOWS\system32\drivers\KRegEx.sys><N/A>
[KSysCall / KSysCall]
<\??\I:\PROGRA~1\KV2005\KSysCall.sys><N/A>
[NetGroup Packet Filter Driver / NPF]
<system32\drivers\npf.sys><Politecnico di Torino>
[npkcrypt / npkcrypt]
<\??\D:\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[NtFsLdf20 / NtFsLdf20]
<I:\WINDOWS\SYSTEM32\DRIVERS\NtFsLdf20.SYS><Windows (R) 2000 DDK provider>
[p2pfilter / p2pfilter]
<\??\I:\Program Files\NetSoft\P2POver\p2pfilter.sys><N/A>
[pgyzlbh / pgyzlbhz]
<\SystemRoot\System32\DRIVERS\pgyzlbhz.sys><N/A>
[PProtect / PProtect]
<\??\I:\WINDOWS\system32\drivers\PProtect.sys><N/A>
[Direct Parallel Link Driver / Ptilink]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware]
<\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[Secdrv / Secdrv]
<system32\DRIVERS\secdrv.sys><N/A>
[ViaIde / ViaIde]
<\SystemRoot\system32\DRIVERS\viaide.sys><Microsoft Corporation>
[Vinyl AC'97 Audio Controller (WDM) / VIAudio]
<system32\drivers\viaudios.sys><VIA Technologies, Inc.>
==================================

dadajiangtu - 2006-11-30 21:50:00

浏览器加载项
[@msdxmLC.dll,-1@2052,电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <I:\WINDOWS\system32\msdxm.ocx,

Microsoft Corporation>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <I:\WINDOWS\system32\kakatool.dll,

Beijing Rising Technology Co., Ltd.>
[Java Plug-in 1.5.0_04]
{8AD9C840-044E-11D1-B3E9-00805F499D93} <I:\Program Files\Java\jre1.5.0_04

\bin\npjpi150_04.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.5.0_04]
{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} <I:\Program Files\Java\jre1.5.0_04

\bin\npjpi150_04.dll, Sun Microsystems, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <I:\WINDOWS\system32

\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[添加到QQ表情]
<D:\Tencent\QQ\AddEmotion.htm, N/A>

==================================
正在运行的进程
[PID: 456][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.2.3790.0

(srv03_rtm.030324-2048)]
[PID: 512][\??\I:\WINDOWS\system32\csrss.exe] [Microsoft Corporation,

5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 536][\??\I:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation,

5.2.3790.0 (srv03_rtm.030324-2048)]
[I:\WINDOWS\system32\Ati2evxx.dll] [ATI Technologies Inc., 6.14.10.4110]
[PID: 580][I:\WINDOWS\system32\services.exe] [Microsoft Corporation,

5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 592][I:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.2.3790.0

(srv03_rtm.030324-2048)]
[I:\WINDOWS\system32\imon.dll] [Eset , 2, 51, 26 ]
[I:\Program Files\Eset\pr_imon.dll] [N/A, N/A]
[PID: 768][I:\WINDOWS\system32\svchost.exe] [Microsoft Corporation,

5.2.3790.0 (srv03_rtm.030324-2048)]
[I:\WINDOWS\system32\imon.dll] [Eset , 2, 51, 26 ]
[I:\Program Files\Eset\pr_imon.dll] [N/A, N/A]
[PID: 824][I:\WINDOWS\System32\svchost.exe] [Microsoft Corporation,

5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1012][I:\WINDOWS\system32\svchost.exe] [Microsoft Corporation,

5.2.3790.0 (srv03_rtm.030324-2048)]
[I:\WINDOWS\system32\imon.dll] [Eset , 2, 51, 26 ]
[I:\Program Files\Eset\pr_imon.dll] [N/A, N/A]
[PID: 1044][I:\WINDOWS\system32\svchost.exe] [Microsoft Corporation,

5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1060][I:\WINDOWS\System32\svchost.exe] [Microsoft Corporation,

5.2.3790.0 (srv03_rtm.030324-2048)]
[I:\WINDOWS\system32\imon.dll] [Eset , 2, 51, 26 ]
[I:\Program Files\Eset\pr_imon.dll] [N/A, N/A]
[i:\windows\system32\es.dll] [Microsoft Corporation, 2001.12.4720.374

(srv03_gdr.050720-1553)]
[PID: 1272][I:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation,

5.2.3790.0 (srv03_rtm.030324-2048)]
[I:\WINDOWS\system32\imon.dll] [Eset , 2, 51, 26 ]
[I:\Program Files\Eset\pr_imon.dll] [N/A, N/A]
[PID: 1296][I:\WINDOWS\system32\msdtc.exe] [Microsoft Corporation,

2001.12.4720.0 (srv03_rtm.030324-2048)]
[PID: 1432][I:\WINDOWS\System32\svchost.exe] [Microsoft Corporation,

5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1488][I:\WINDOWS\system32\inetsrv\inetinfo.exe] [Microsoft

Corporation, 6.0.3790.0 (srv03_rtm.030324-2048)]
[I:\WINDOWS\system32\es.dll] [Microsoft Corporation, 2001.12.4720.374

(srv03_gdr.050720-1553)]
[PID: 1504][I:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe]

[Microsoft Corporation, 7.10.3077]
[I:\Program Files\Common Files\Microsoft Shared\VS7Debug\2052\mdmui.dll]

[Microsoft Corporation, 7.10.3077]
[I:\Program Files\Common Files\Microsoft Shared\VS7Debug\csm.dll]

[Microsoft Corporation, 7.10.3077]
[I:\Program Files\Common Files\Microsoft Shared\VS7Debug\msdbg2.dll]

[Microsoft Corporation, 7.10.3077]
[PID: 1520][I:\PROGRA~1\MICROS~1\MSSQL\binn\sqlservr.exe] [Microsoft

Corporation, 2000.080.0760.00]
[I:\PROGRA~1\MICROS~1\MSSQL\binn\OPENDS60.DLL] [Microsoft Corporation,

2000.080.0194.00]
[I:\PROGRA~1\MICROS~1\MSSQL\binn\UMS.DLL] [Microsoft Corporation,

2000.080.0760.00]
[I:\PROGRA~1\MICROS~1\MSSQL\binn\SQLSORT.DLL] [Microsoft Corporation,

2000.080.0760.00]
[I:\PROGRA~1\MICROS~1\MSSQL\binn\Resources\2052\sqlevn70.RLL] [Microsoft

Corporation, 2000.080.0760.00]
[I:\PROGRA~1\MICROS~1\MSSQL\binn\SSNETLIB.dll] [Microsoft Corporation,

2000.080.0766.00]
[I:\PROGRA~1\MICROS~1\MSSQL\binn\SSNMPN70.dll] [Microsoft Corporation,

2000.080.0534.00]
[I:\WINDOWS\system32\imon.dll] [Eset , 2, 51, 26 ]
[I:\Program Files\Eset\pr_imon.dll] [N/A, N/A]
[I:\PROGRA~1\MICROS~1\MSSQL\binn\SSmsLPCn.dll] [Microsoft Corporation,

2000.080.0760.00]
[I:\PROGRA~1\MICROS~1\MSSQL\binn\SQLFTQRY.DLL] [Microsoft Corporation,

2000.080.0760.00]
[PID: 1548][I:\Program Files\Eset\nod32krn.exe] [Eset , 2, 51, 26 ]
[I:\Program Files\Eset\nod32krr.dll] [Eset , 2, 51, 26 ]
[I:\Program Files\Eset\ps_amon.dll] [Eset , 2, 51, 26 ]
[I:\Program Files\Eset\pr_amon.dll] [Eset , 2, 51, 26 ]
[I:\Program Files\Eset\ps_dmon.dll] [Eset , 2, 51, 26 ]
[I:\Program Files\Eset\pr_dmon.dll] [N/A, N/A]
[I:\Program Files\Eset\ps_emon.dll] [Eset , 2, 51, 26 ]
[I:\Program Files\Eset\pr_emon.dll] [N/A, N/A]
[I:\WINDOWS\system32\imon.dll] [Eset , 2, 51, 26 ]
[I:\Program Files\Eset\pr_imon.dll] [N/A, N/A]
[I:\Program Files\Eset\ps_nod32.dll] [Eset , 2, 51, 26 ]
[I:\Program Files\Eset\pr_nod32.dll] [Eset , 2, 51, 26 ]
[I:\Program Files\Eset\ps_upd.dll] [Eset , 2, 51, 26 ]
[I:\Program Files\Eset\pr_upd.dll] [N/A, N/A]
[PID: 1596][I:\WINDOWS\system32\svchost.exe] [Microsoft Corporation,

5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1632][I:\WINDOWS\system32\drivers\WDelMgr20.exe] [N/A, N/A]
[PID: 1676][I:\WINDOWS\system32\Windows Media\Server\WMServer.exe]

[Microsoft Corporation, 9.00.00.3372 (dnsrv.030218-1708)]
[I:\WINDOWS\system32\imon.dll] [Eset , 2, 51, 26 ]
[I:\Program Files\Eset\pr_imon.dll] [N/A, N/A]
[PID: 1708][I:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe]

[Microsoft Corporation, 9.107.8320.0]
[I:\Program Files\Common Files\System\MSSearch\Bin\mssws.dll] [Microsoft

Corporation, 9.107.8320.0]
[I:\PROGRA~1\COMMON~1\System\MSSearch\Bin\mssrch.dll] [Microsoft

Corporation, 9.107.8320.0]
[I:\Program Files\Common Files\System\MSSearch\Bin\tquery.dll]

[Microsoft Corporation, 9.107.8320.0]
[I:\PROGRA~1\COMMON~1\System\MSSearch\Bin\propdefs.dll] [Microsoft

Corporation, 9.107.8320.0]
[I:\PROGRA~1\COMMON~1\System\MSSearch\Bin\srchidx.dll] [Microsoft

Corporation, 9.107.8320.0]
[PID: 1912][I:\WINDOWS\System32\svchost.exe] [Microsoft Corporation,

5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 2188][I:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.3790.0

(srv03_rtm.030324-2048)]
[PID: 2288][I:\Program Files\Eset\nod32kui.exe] [Eset , 2, 51, 26 ]
[I:\Program Files\Eset\nod32rui.dll] [N/A, N/A]
[I:\Program Files\Eset\pu_amon.dll] [Eset , 2, 51, 26 ]
[I:\Program Files\Eset\pr_amon.dll] [Eset , 2, 51, 26 ]
[I:\Program Files\Eset\pu_dmon.dll] [Eset , 2, 51, 26 ]
[I:\Program Files\Eset\pr_dmon.dll] [N/A, N/A]
[I:\Program Files\Eset\pu_emon.dll] [Eset , 2, 51, 26 ]
[I:\Program Files\Eset\pr_emon.dll] [N/A, N/A]
[I:\Program Files\Eset\pu_imon.dll] [Eset , 2, 51, 26 ]
[I:\Program Files\Eset\pr_imon.dll] [N/A, N/A]
[I:\Program Files\Eset\pu_nod32.dll] [Eset , 2, 51, 26 ]
[I:\Program Files\Eset\pr_nod32.dll] [Eset , 2, 51, 26 ]
[I:\Program Files\Eset\pu_upd.dll] [Eset , 2, 51, 26 ]
[I:\Program Files\Eset\pr_upd.dll] [N/A, N/A]
[PID: 2340][I:\WINDOWS\System32\svchost.exe] [Microsoft Corporation,

5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 2500][I:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe]

[Kaspersky Labs, 1.7.0.130]
[I:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\BCGCB59.dll]

[BCGSoft Ltd, 5, 84, 0, 0]
[I:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\perfiloc.dll]

[Kaspersky Labs, 1.5.0.0]
[I:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\BCGCBRes.dll]

[BCGSoft Ltd, 5, 84, 0, 0]
[PID: 2700][I:\WINDOWS\system32\wbem\wmiprvse.exe] [Microsoft Corporation,

5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 2812][D:\Downloads\sreng2\SREng\SREng.exe] [Smallfrogs Studio,

2.2.6.605]
[I:\WINDOWS\system32\imon.dll] [Eset , 2, 51, 26 ]
[I:\Program Files\Eset\pr_imon.dll] [N/A, N/A]

==================================

dadajiangtu - 2006-11-30 21:59:00

文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["I:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS Error. []
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
NOD32 protected [MSAFD Tcpip [TCP/IP]]
I:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning

support)
NOD32 protected [MSAFD Tcpip [UDP/IP]]
I:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning

support)
NOD32 protected [MSAFD Tcpip [RAW/IP]]
I:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning

support)
NOD32 protected [RSVP UDP Service Provider]
I:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning

support)
NOD32 protected [RSVP TCP Service Provider]
I:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning

support)
NOD32
I:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning

support)

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
*****************************************************************************
Logfile of HijackThis v1.99.1
Scan saved at 21:18:17 下午, on 2006-11-30
Platform: Windows 2003 (WinNT 5.02.3790)
MSIE: Internet Explorer v6.00 (6.00.3790.0000)

Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\system32\spoolsv.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\system32\inetsrv\inetinfo.exe
I:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
I:\PROGRA~1\MICROS~1\MSSQL\binn\sqlservr.exe
I:\Program Files\Eset\nod32krn.exe
I:\WINDOWS\system32\drivers\WDelMgr20.exe
I:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\Explorer.EXE
I:\Program Files\Eset\nod32kui.exe
I:\WINDOWS\System32\svchost.exe
I:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
E:\Desktopbackup\新建文件夹\未使用的桌面快捷方式\hijackthis\HijackThis.exe

O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-

00A0C9082467} - I:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} -

I:\WINDOWS\system32\kakatool.dll
O4 - HKLM\..\Run: [AVP Monitor] I:\Program Files\Kaspersky Anti-

Virus\avpm.exe
O4 - HKLM\..\Run: [MSPY2002] I:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe

/SYNC
O4 - HKLM\..\Run: [nod32kui] "I:\Program Files\Eset\nod32kui.exe"

/WAITSERVICE
O4 - HKLM\..\Run: [IMJPMIG8.1] "I:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil

/RemAdvDef /Migration32
O4 - HKLM\..\Run: [ATIPTA] I:\Program Files\ATI Technologies\ATI Control

Panel\atiptaxx.exe
O4 - HKLM\..\Run: [MSConfig] ;

"I:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" /auto
O4 - HKCU\..\Run: [ctfmon.exe] ; I:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: 卡巴斯基反黑客.lnk = I:\Program Files\Kaspersky

Lab\Kaspersky Anti-Hacker\KAVPF.exe
O4 - Global Startup: 服务管理器.lnk = I:\Program Files\Microsoft SQL

Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: 添加到QQ表情 - D:\Tencent\QQ\AddEmotion.htm
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - I:\Program

Files\Common Files\Microsoft Shared\Help\hxds.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. -

I:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - I:\Program

Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - I:\Program

Files\Eset\nod32krn.exe
O23 - Service: OracleOraHome92TNSListener - Unknown owner -

E:\Study\Oracle\BIN\TNSLSNR.exe (file missing)
O23 - Service: OracleServiceORACLE9 - Unknown owner -

e:\study\oracle\bin\ORACLE.EXE (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) -

Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%

\WinPcap\rpcapd.ini (file missing)
O23 - Service: WDelMgr20 - Unknown owner - I:\WINDOWS\system32

\drivers\WDelMgr20.exe

请高手看看怎么搞，谢谢!!

瑞星卡卡安全论坛