瑞星卡卡安全论坛

今天QQ突然被迫下线  提示在别的地方上线    吓一跳  马上改密码
用usbcleaner 6.0扫了一下  发现Trojan.DL.Adload.alx  C:\Documents and Settings\ibm\「开始」菜单\Internet Explorer.lnk  删除失败 请到安全模式下清除
在网上搜了一下  没发现好的解决办法  不知道是不是新病毒

扫了日志  请各位大大帮忙分析下  谢谢了
[CODE]
2007-09-17,16:37:40
System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能
以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\windows\system32\ctfmon.exe>  [(Verified)Microsoft Corporation]
    <MSMSGS><; "C:\Program Files\Messenger\msmsgs.exe" /background>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <HPLJ Config><C:\Program Files\Hewlett-Packard\hp LaserJet 1150_1300\SetConfig.exe -c Direct -p PS964870-P1 -pn "hp LaserJet 1150 PCL 5e" -n 0 -l 2052 -sl 120000>  [N/A]
    <DU Meter><; F:\网速测试\DUMeter.exe>  [Hagel Technologies Ltd]
    <NMGameX_AutoRun><; C:\windows\system32\Rundll32.exe NMGameX.dll,LiveProcess /aa>  [NMGameX]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [Microsoft Corporation]
    <Userinit><C:\windows\system32\userinit.exe,>  [(Verified)Microsoft Corporation]
    <UIHost><logonui.exe>  [N/A]
==================================
启动文件夹
N/A
==================================
服务
[Contrl Center of Storm Media / ccosm][Stopped/Disabled]
  <C:\Program Files\Ringz Studio\Storm Codec\stormliv.exe /asservice><北京暴风网际科技有限公司>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\windows\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[IBM User Verification Manager / IBM User Verification Manager][Running/Auto Start]
  <"C:\Program Files\IBM\Security\uvmserv.exe"><IBM>
[MPSVC Service / MPSVCService][Running/Auto Start]
  <C:\Program Files\Micropoint\MPSVC.exe><Micropoint Corporation>
[Windows Installer / MSIServer][Stopped/Manual Start]
  <C:\WINDOWS\system32\msiexec.exe /V><Microsoft Corporation>
[Pml Driver HPZ12 / Pml Driver HPZ12][Stopped/Manual Start]
  <C:\WINDOWS\system32\HPZipm12.exe><N/A>
[Remote Packet Capture Protocol v.0 (experimental) / rpcapd][Stopped/Manual Start]
  <"C:\Program Files\WinPcap\rpcapd.exe" -d -f "C:\Program Files\WinPcap\rpcapd.ini"><N/A>
[ServiceLayer / ServiceLayer][Running/Manual Start]
  <"C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe"><Nokia.>
[Shadow System Service / ShadowSystemService][Running/Auto Start]
  <C:\WINDOWS\system32\shadow\ShadowService.exe><N/A>
[Stormser / Stormser][Running/Auto Start]
  <C:\PROGRA~1\RINGZS~1\STORMC~1\Stormser.exe><暴风网际>
==================================
驱动程序
[ADI UAA Function Driver for High Definition Audio Service / ADIHdAudAddService][Running/Manual Start]
  <system32\drivers\ADIHdAud.sys><Analog Devices, Inc.>
[bootdrv / bootdrv][Stopped/Boot Start]
  <\SystemRoot\System32\Drivers\bootdrv.sys><N/A>
[Intel(R) PRO/1000 PCI Express Network Connection Driver / e1express][Running/Manual Start]
  <system32\DRIVERS\e1e5132.sys><Intel Corporation>
[FTCProtect / FTCProtect][Stopped/Manual Start]
  <System32\Drivers\FTCProtect.sys><N/A>
[FTCProTime / FTCProTime][Stopped/Manual Start]
  <System32\Drivers\FTCProTime.sys><N/A>
[Microsoft 用于 High Definition Audio 的 UAA 总线驱动程序 / HDAudBus][Running/Manual Start]
  <system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
[hidproc / hidproc][Stopped/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\hidproc.sys><N/A>
[ialm / ialm][Running/Manual Start]
  <system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[mp110001 / mp110001][Running/Auto Start]
  <system32\drivers\mp110001.sys><MicroPoint Corporation>
[mp110002 / mp110002][Running/Auto Start]
  <system32\drivers\mp110002.sys><Micropoint Corporation>
[mp110003 / mp110003][Running/Boot Start]
  <\SystemRoot\system32\drivers\mp110003.sys><Micropoint Corporation>
[mp110004 / mp110004][Running/Auto Start]
  <system32\drivers\mp110004.sys><Micropoint Corporation>
[mp110005 / mp110005][Running/Manual Start]
  <system32\drivers\mp110005.sys><Micropoint Corporation>
[mp110006 / mp110006][Running/System Start]
  <system32\drivers\mp110006.sys><Micropoint Corporation>
[mp110007 / mp110007][Running/System Start]
  <system32\drivers\mp110007.sys><Micropoint Corporation>
[mp110008 / mp110008][Running/Auto Start]
  <system32\drivers\mp110008.sys><Micropoint Corporation>
[mp110009 / mp110009][Running/System Start]
  <system32\drivers\mp110009.sys><Micropoint Corporation>
[mp110010 / mp110010][Running/Boot Start]
  <\SystemRoot\system32\drivers\mp110010.sys><Micropoint Corporation>
[mp110011 / mp110011][Running/System Start]
  <system32\drivers\mp110011.sys><Micropoint Corporation>
[mp110012 / mp110012][Running/Boot Start]
  <\SystemRoot\system32\drivers\mp110012.sys><Micropoint Corporation>
[mp110013 / mp110013][Running/Boot Start]
  <\SystemRoot\system32\drivers\mp110013.sys><Micropoint Corporation>
[nmpkg / nmpkg][Stopped/Auto Start]
  <\??\C:\windows\system32\drivers\nmpkg.sys><N/A>
[Nokia USB Generic / Nokia USB Generic][Stopped/Manual Start]
  <system32\drivers\nmwcdc.sys><Nokia>
[Nokia USB Modem / Nokia USB Modem][Stopped/Manual Start]
  <system32\drivers\nmwcdcm.sys><Nokia>
[Nokia USB Phone Parent / Nokia USB Phone Parent][Stopped/Manual Start]
  <system32\drivers\nmwcd.sys><Nokia>
[Nokia USB Port / Nokia USB Port][Stopped/Manual Start]
  <system32\drivers\nmwcdcj.sys><Nokia>
[NetGroup Packet Filter Driver / NPF][Stopped/Manual Start]
  <system32\drivers\npf.sys><Politecnico di Torino>
[npkcrypt / npkcrypt][Stopped/Manual Start]
  <\??\C:\windows\system32\npkcrypt.sys><N/A>
[npkycryp / npkycryp][Stopped/Manual Start]
  <\??\C:\windows\system32\npkycryp.sys><N/A>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
  <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising Technology Co., Ltd.>
[SKNFW / SKNFW][Running/System Start]
  <\??\C:\windows\system32\Drivers\SKNFW.sys><N/A>
[SVKP / SVKP][Stopped/Auto Start]
  <\??\C:\WINDOWS\system32\SVKP.sys><N/A>
[TCP/IP Protocol Driver / Tcpip][Running/System Start]
  <system32\DRIVERS\tcpip.sys><Microsoft Corporation>
[NSC Integrated Trusted Platform Module 1.2 / TPM12][Running/Manual Start]
  <system32\DRIVERS\nsctpm12.sys><National Semiconductor Corp.>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
  <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[XW / XW][Stopped/Manual Start]
  <\??\C:\windows\system32\drivers\XW.ahc><N/A>
[VIMICRO USB PC Camera / ZSMC302][Stopped/Manual Start]
  <System32\Drivers\usbVM31b.sys><N/A>

用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler ; KuGooSoft; Mozilla/4.0(Compatible Mozilla/4.0(Compatible-EmbeddedWB 14.58 http://bsalsa.com/ EmbeddedWB- 14.58  from: http://bsalsa.com/ ; Mozilla/4.0(Compatible RogueCleanerEmbeddedWB- 14.58  from: http://bsalsa.com/ )

==================================
浏览器加载项
[ThunderAtOnce Class]
  {01443AEC-0FD1-40fd-9C87-E93D1494C233} <F:\迅雷\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[BitComet Helper]
  {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} <F:\BitComet\tools\BitCometBHO.dll, BitComet>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <F:\迅雷\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[SafeMon Class]
  {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>
[启动迅雷5]
  {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <F:\迅雷\Thunder.exe, Thunder Networking Technologies,LTD>
[浩方对战平台]
  {0A155D3C-68E2-4215-A47A-E800A446447A} <F:\浩方对战平台\GameClient.exe, 上海浩方在线信息技术有限公司>
[AddSHCARoot Control]
  {098A3F72-3110-4004-B954-2F9DC44934B4} <C:\WINDOWS\DOWNLO~1\ADDCAR~1.OCX, SHECA>
[Microsoft Chart Control 6.0 (SP4) (OLEDB)]
  {3A2B370C-BA0A-11D1-B137-0000F8753F5D} <C:\windows\system32\MSCHRT20.OCX, Microsoft Corporation>
[CTVUAxCtrl Object]
  {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} <C:\WINDOWS\Downloaded Program Files\TVUAx.dll, TVU networks>
[XMapControl Control]
  {7188EB1C-F9A1-4290-A97A-CA3C18AE988C} <C:\WINDOWS\DOWNLO~1\xmapctl.ocx, 上海城市交通信息中心>
[AxInputControl Class]
  {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL, >
[DLoader Class]
  {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} <C:\WINDOWS\Downloaded Program Files\downloader.dll, Sina Com>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\windows\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>
[ThunderAtOnce Class]
  {01443AEC-0FD1-40FD-9C87-E93D1494C233} <F:\迅雷\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[ActiveMovieControl Object]
  {05589FA1-C356-11CE-BF01-00AA0055595A} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[ULiveCtrl Control]
  {070CA17A-4BD2-4612-83B4-32B1B9159B48} <C:\PROGRA~1\sina\SINAWE~1\302~1.9BE\UCLIVE~1.OCX, 北京新浪信息技术有限公司>
[AddSHCARoot Control]
  {098A3F72-3110-4004-B954-2F9DC44934B4} <C:\WINDOWS\DOWNLO~1\ADDCAR~1.OCX, SHECA>
[Windows Media Player]
  {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[DHTML Edit Control Safe for Scripting for IE5]
  {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\windows\system32\dllcache\dhtmled.ocx, Microsoft Corporation>
[BitComet Helper]
  {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} <F:\BitComet\tools\BitCometBHO.dll, BitComet>
[XML Document]
  {48123BC4-99D9-11D1-A6B3-00C04FD91555} <%SystemRoot%\system32\msxml3.dll, N/A>
[Thunder Agent Class]
  {485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <F:\迅雷\ComDlls\ThunderAgent_Now.dll, Thunder Networking Technologies,LTD>
[HHCtrl Object]
  {52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\windows\system32\hhctrl.ocx, Microsoft Corporation>
[Shell Name Space]
  {55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[KvScan Control]
  {626AEE7D-DC95-4405-8F9E-9FB1EA80AEDE} <C:\WINDOWS\KVSCAN~1\KvKill.ocx, jiangmin>
[XMP Class]
  {6483F145-A768-4C41-AACC-52D4D7845851} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xplayer.dll_1_work, N/A>
[XDRM]
  {693571CB-54A3-4E90-9D52-EEAE1334E2D3} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xdrm.dll_1_work, >
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[XMapControl Control]
  {7188EB1C-F9A1-4290-A97A-CA3C18AE988C} <C:\WINDOWS\DOWNLO~1\xmapctl.ocx, 上海城市交通信息中心>
[AxInputControl Class]
  {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL, >
[MediaComm Class]
  {7670648D-461B-42AF-BDFE-46D26AF5EFF2} <F:\迅雷\Components\InMedia\MediaAddin17.dll, Thunder Networking Technologies,LTD>
[DLoader Class]
  {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} <C:\WINDOWS\Downloaded Program Files\downloader.dll, Sina Com>
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <F:\迅雷\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[AxSubmitControl Class]
  {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} <C:\WINDOWS\DOWNLO~1\SUBMIT~1.DLL, >
[DapCtrl Class]
  {ACACC6EB-1FBA-4E13-A729-53AEB2DF54F8} <C:\Program Files\Common Files\Thunder Network\KanKan\DapCtrl.2.1.5803.60.(645).dll, ShenZhen Thunder Networking Technologies Ltd.>
[Microsoft Scriptlet Component]
  {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\windows\system32\mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[SafeMon Class]
  {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>
[RDS.DataSpace]
  {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[VIDEO__X_MS_ASF Moniker Class]
  {CD3AFA8F-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
  {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\windows\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\windows\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>
[PasswordEditCtrl Class]
  {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\windows\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
[Thunder DapPlayer]
  {EEDD6FF9-13DE-496B-9A1C-D78B3215E266} <F:\迅雷\Components\DownAndPlay\DapPlayer3.0.5712.71.645.dll, ShenZhen Thunder Networking Technologies Ltd.>
[XPPlayer Class]
  {F3E70CEA-956E-49CC-B444-73AFE593AD7F} <C:\Program Files\Common Files\Thunder Network\KanKan\PPlayer.2.0.0.181.(646).dll, Xunlei Networking Technologies,LTD>
[]
  {FDFF0878-4FF2-4510-8B0D-4E03F37A8DBF} <C:\WINDOWS\system32\4510cfsb.dll, N/A>
[&使用BitComet下载]
  <res://F:\BTcomet\BitComet.exe/AddLink.htm, N/A>
[&使用BitComet下载全部链接]
  <res://F:\BTcomet\BitComet.exe/AddAllLink.htm, N/A>
[&使用BitComet下载本页视频]
  <res://F:\BTcomet\BitComet.exe/AddVideo.htm, N/A>
[使用网际快车下载]
  <C:\Documents and Settings\ibm\桌面\flashget\jc_link.htm, N/A>
[使用网际快车下载全部链接]
  <C:\Documents and Settings\ibm\桌面\flashget\jc_all.htm, N/A>
[使用迅雷下载]
  <F:\迅雷\Program\geturl.htm, N/A>
[使用迅雷下载全部链接]
  <F:\迅雷\Program\getallurl.htm, N/A>
[添加到QQ表情]
  <F:\终结版QQ\AddEmotion.htm, N/A>

==================================
正在运行的进程
[PID: 684][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 748][\??\C:\windows\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 772][\??\C:\windows\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10050]
[PID: 816][C:\windows\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10050]
[PID: 828][C:\windows\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10050]
[PID: 1004][C:\windows\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10050]
[PID: 1380][C:\windows\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10050]
[PID: 1544][C:\windows\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10050]
[PID: 1736][C:\windows\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10050]
[PID: 1876][C:\windows\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10050]
[PID: 2040][C:\windows\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10050]
    [C:\windows\system32\HPBMMON.DLL]  [Hewlett-Packard, 10.00.16]
    [C:\windows\system32\hpdomon.dll]  [Hewlett-Packard, 03.42.00]
    [C:\windows\system32\HPBHealr.dll]  [N/A, N/A]
    [C:\windows\system32\PSNTMON.DLL]  [Microsoft Corporation, 4.00.950]
    [C:\windows\System32\spool\PRTPROCS\W32X86\HPPRN05.DLL]  [Hewlett-Packard Corporation, 60.05.17.02]
[PID: 340][C:\Program Files\IBM\Security\uvmserv.exe]  [IBM, 5.43.173.0]
    [C:\windows\system32\tsp.dll]  [IBM, 1.1.0.015]
    [C:\windows\system32\tcscom.dll]  [IBM, 1.1.0.015]
    [C:\windows\system32\uvm_wait.dll]  [, 5.43.173.0]
    [C:\windows\system32\archrest.dll]  [, 5.43.173.0]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10050]
    [C:\Program Files\IBM\Security\P11Plugin.dll]  [, 5.43.173.0]
    [C:\windows\system32\uvm_string.dll]  [IBM, 5.43.173.0]
[PID: 412][C:\Program Files\IBM\Security\TssCore.exe]  [, 1.1.0.015]
    [C:\windows\system32\TDDL.dll]  [National Semiconductor Corp., 5, 0, 41, 2000]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10050]
[PID: 536][C:\WINDOWS\system32\shadow\ShadowService.exe]  [N/A, N/A]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10050]
[PID: 592][C:\windows\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10050]
[PID: 672][C:\PROGRA~1\RINGZS~1\STORMC~1\Stormser.exe]  [暴风网际, 1, 0, 0, 11]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10050]
[PID: 640][C:\windows\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10050]
    [F:\迅雷\ComDlls\TDAtOnce_Now.dll]  [Thunder Networking Technologies,LTD, 1.0.5.29]
    [F:\迅雷\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 8, 96]
    [F:\迅雷\Components\ResWorker\DsBho_00.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 20]
    [F:\迅雷\Components\ResWorker\DataProcessor_00.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 16]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, N/A]
    [F:\Unlocker\UnlockerCOM.dll]  [N/A, N/A]
    [C:\windows\system32\msdmo.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\l3codeca.acm]  [Fraunhofer Institut Integrierte Schaltungen IIS, 1, 9, 0, 0305]
    [C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll]  [Nokia, 6, 80, 37, 4]
    [C:\Program Files\Nokia\Nokia PC Suite 6\PCSCM.dll]  [Nokia, 6, 80, 66, 0]
    [C:\windows\system32\ConnAPI.DLL]  [Nokia., 6, 80, 55, 5]
    [C:\Program Files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_chi-sc.nlr]  [Nokia, 6, 80, 26, 0]
    [C:\Program Files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr]  [Nokia, 6, 80, 8, 0]
    [C:\WINDOWS\system32\igfxpph.dll]  [Intel Corporation, 3.0.0.4497]
    [C:\WINDOWS\system32\hccutils.DLL]  [Intel Corporation, 3.0.0.4497]
    [C:\windows\system32\igfxres.dll]  [Intel Corporation, 3.0.0.4497]
    [C:\windows\system32\igfxress.dll]  [Intel Corporation, 3.0.0.4497]
    [C:\WINDOWS\system32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.4497]
    [C:\Program Files\Common Files\Adobe\Shell\PSICON.DLL]  [Adobe Systems, Incorporated, 7.0]
[PID: 496][C:\windows\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1684][C:\windows\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10050]
[PID: 2088][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10050]
    [F:\迅雷\ComDlls\TDAtOnce_Now.dll]  [Thunder Networking Technologies,LTD, 1.0.5.29]
    [F:\BitComet\tools\BitCometBHO.dll]  [BitComet, 20061213]
    [F:\迅雷\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 8, 96]
    [F:\迅雷\Components\ResWorker\DsBho_00.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 20]
    [F:\迅雷\Components\ResWorker\DataProcessor_00.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 16]
    [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
    [C:\windows\system32\Macromed\Flash\Flash9f.ocx]  [Adobe Systems, Inc., 9,0,124,0]
[PID: 2792][C:\windows\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2108][F:\终结版QQ\QQ.exe]  [TENCENT, 8,0,777,1805]
    [F:\终结版QQ\QQBaseClassInDll.dll]  [TENCENT, 8,0,777,1805]
    [F:\终结版QQ\QQHelperDll.dll]  [TENCENT, 8,0,777,1805]
    [F:\终结版QQ\BasicCtrlDll.dll]  [TENCENT, 8,0,777,1805]
    [F:\终结版QQ\MSIMG32.dll]  [N/A, N/A]
    [F:\终结版QQ\FinePlus.dll]  [N/A, N/A]
    [F:\终结版QQ\fphelper.dll]  [N/A, N/A]
    [F:\终结版QQ\QQAPI.dll]  [TENCENT, 8,0,777,1805]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10050]
    [F:\终结版QQ\LoginCtrl.dll]  [TENCENT, 8,0,777,1805]
    [F:\终结版QQ\LoginCtrlRes.dll]  [TENCENT, 8,0,777,1805]
    [F:\终结版QQ\QQRes.dll]  [TENCENT, 8,0,776,1805]
    [F:\终结版QQ\WizardCtrl.dll]  [TENCENT, 8,0,777,1805]
    [F:\终结版QQ\QQMainFrame.dll]  [N/A, N/A]
    [F:\终结版QQ\QQPlugin.dll]  [N/A, N/A]
    [F:\终结版QQ\UnReadMsgMgr.dll]  [N/A, N/A]
    [F:\终结版QQ\CQQApplication.dll]  [N/A, N/A]
    [F:\终结版QQ\FlashAvatarDll.dll]  [, 1, 4, 0, 1]
    [F:\终结版QQ\NewSkin.dll]  [TENCENT, 8,0,777,1805]
    [F:\终结版QQ\MailSummary.dll]  [TENCENT, 8,0,777,1805]
    [F:\终结版QQ\QQSpace.dll]  [TENCENT, 8,0,777,1805]
    [F:\终结版QQ\vbscript.dll]  [N/A, N/A]
    [C:\windows\system32\msdmo.dll]  [N/A, N/A]
    [F:\终结版QQ\QQKnowledgeSearch.dll]  [TENCENT, 8,0,777,1805]
    [F:\终结版QQ\OEMApplication.dll]  [TENCENT, 8,0,777,1805]
    [F:\终结版QQ\QQGroupMng.dll]  [TENCENT, 8,0,777,1805]
    [F:\终结版QQ\QQAvatar.dll]  [N/A, N/A]
    [F:\终结版QQ\QQAllInOne.dll]  [TENCENT, 8,0,777,1805]
    [F:\终结版QQ\SCCore.dll]  [TENCENT, 1, 6, 0, 2]
    [F:\终结版QQ\CameraDll.dll]  [TENCENT, 8,0,777,1805]
    [F:\终结版QQ\QQPet.dll]  [TENCENT, 8,0,777,1805]
    [F:\终结版QQ\UserDefinedHead.dll]  [TENCENT, 8,0,777,1805]
    [F:\终结版QQ\QQConfigPlugin.dll]  [TENCENT, 8,0,777,1805]
    [F:\终结版QQ\QQCustomFace.dll]  [N/A, N/A]
    [F:\终结版QQ\QRingMng.dll]  [N/A, N/A]
    [F:\终结版QQ\LongConnection.dll]  [TENCENT, 8,0,777,1805]
    [F:\终结版QQ\PhoneAPI.dll]  [TENCENT, 8,0,777,1805]
    [F:\终结版QQ\DialerAllinOne.dll]  [tencent, 1, 4, 0, 0]
    [F:\终结版QQ\PersonalDesktop.dll]  [TENCENT, 8,0,777,1805]
    [F:\终结版QQ\QQSysMsgMng.dll]  [N/A, N/A]
    [F:\终结版QQ\BQQApplication.dll]  [N/A, N/A]
    [F:\终结版QQ\CommercesMng.dll]  [TENCENT, 8,0,777,1805]
    [F:\终结版QQ\QQAddr.dll]  [深圳市腾讯计算机系统有限公司, 5, 0, 101, 330]
    [F:\终结版QQ\QQSettingCtrl.dll]  [TENCENT, 8,0,777,1805]
    [F:\终结版QQ\QQSceneMng.dll]  [N/A, N/A]
    [F:\终结版QQ\AddrSearch.dll]  [腾讯科技（深圳）有限公司, 2, 0, 1, 10]
[PID: 220][F:\终结版QQ\TXPlatform.exe]  [Tencent, 1, 0, 170, 0]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10050]
[PID: 3384][C:\Documents and Settings\ibm\桌面\新建文件夹\USBCleaner.exe]  [ZJU S-Zone, 6.00.0053]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10050]
    [C:\Documents and Settings\ibm\桌面\新建文件夹\FileCheck.dll]  [N/A, N/A]
[PID: 3276][C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe]  [Nokia., 6, 80, 56, 4]
    [C:\windows\system32\NclTools.dll]  [Nokia., 6, 80, 18, 3]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10050]
    [C:\Program Files\Common Files\PCSuite\Transports\NCLIrDAMM.dll]  [Nokia Corp., 6, 80, 26, 0]
    [C:\Program Files\Common Files\PCSuite\Transports\NCLRSMM.dll]  [Nokia, 6, 80, 33, 0]
    [C:\Program Files\Common Files\PCSuite\Transports\NCLUSBMM.dll]  [Nokia, 6, 80, 37, 0]
    [C:\Program Files\Common Files\PCSuite\Transports\NclMSBTMM.dll]  [Nokia., 6, 80, 38, 2]
[PID: 3380][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10050]
    [F:\迅雷\ComDlls\TDAtOnce_Now.dll]  [Thunder Networking Technologies,LTD, 1.0.5.29]
    [F:\BitComet\tools\BitCometBHO.dll]  [BitComet, 20061213]
    [F:\迅雷\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 8, 96]
    [F:\迅雷\Components\ResWorker\DsBho_00.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 20]
    [F:\迅雷\Components\ResWorker\DataProcessor_00.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 16]
    [C:\Program Files\360safe\safemon\safemon.dll]  [360.CN, 4, 1, 5, 1001]
    [C:\windows\system32\Macromed\Flash\Flash9f.ocx]  [Adobe Systems, Inc., 9,0,124,0]
    [C:\windows\system32\WINABCX.IME]  [PKUETI, 5.22.216]
    [C:\windows\system32\UNISPIM.IME]  [北京清华紫光软件股份有限公司, 3.0.0.3045]
[PID: 3252][F:\sreng\SREng.EXE]  [Smallfrogs Studio, 2.3.13.690]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10050]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\windows\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost
127.0.0.1  yu.8s7.net
127.0.0.1  1.jopanqc.com
127.0.0.1  2.joppnqq.com
127.0.0.1  wg.47255.com
127.0.0.1  1.joppnqq.com
127.0.0.1  xxx.m111.biz
127.0.0.1  1.jopenqc.com
127.0.0.1  1.jopenkk.com
127.0.0.1  xxx.vh7.biz
127.0.0.1  xxx.j41m.com
127.0.0.1  3.joppnqq.com
127.0.0.1  d.93se.com
127.0.0.1  www.868wg.com
127.0.0.1  xxx.mmma.biz
127.0.0.1  ilove.com
127.0.0.1  tp.shpzhan.cn
127.0.0.1  www.tomwg.com
127.0.0.1  www.cike007.cn
127.0.0.1  www.22aaa.com
127.0.0.1  xx.exiao01.com
127.0.0.1  www.exiao01.com
127.0.0.1  www.exiao01.com
127.0.0.1  new.749571.com
127.0.0.1  xtx.kv8.info
127.0.0.1  cao.kv8.info
127.0.0.1  1.jopmmqq.com
127.0.0.1  171817.171817.com
127.0.0.1  d2.llsging.com
127.0.0.1  down.malasc.cn
127.0.0.1  llboss.com
127.0.0.1  nx.51ylb.cn
127.0.0.1  my.531jx.cn
127.0.0.1  qqq.dzydhx.com
127.0.0.1  qqq.hao1658.com
127.0.0.1  www.333292.com
127.0.0.1  down.18dd.net
127.0.0.1  up.22x44.com
127.0.0.1  aaa.faba01.com
127.0.0.1  bad.tqdlt.cn
127.0.0.1  1.chsipo.com
127.0.0.1  c3.aishangai.net
127.0.0.1  c2.aishangai.net
127.0.0.1  xxx.188dm.com
127.0.0.1  x2.1a2b3c1.com
127.0.0.1  d1.163500.net
127.0.0.1  down.google-serv.cn
127.0.0.1  idc.windowsupdeta.cn
127.0.0.1  nc.mskess.com
127.0.0.1  ok.sl8cjs.cn
127.0.0.1  dl.pvs360.com
127.0.0.1  ta.pvs360.com
127.0.0.1  cw.pvs360.com
127.0.0.1  fg.pvs360.com

==================================
API HOOK
N/A

==================================


[/CODE]

你应该中了Ｈost这类病毒吧。。小狮子师傅进来看看

1.扫日志前建议清理助手清理系统
http://www.arswp.com/download.html
只清理高危险项目
2.扫日志前关闭无用进程，如QQ，迅雷及播放器程序

3.到官方下载SReng
下载地址
http://www.kztechs.com/sreng/download.html
SREng/智能扫描

等扫描完成,保存日志(LOG格式)

PS：如主程序SREng**.exe无法运行,导致无法扫描日志
将主程序改名为小狮子.bat


如还不能运行尝试该版本SRENG
http://bbs.ikaka.com/attachment.aspx?attachmentid=412527）
如2.6的能用，还是用2.6的,2.4的就免了

4.为了最大程度减少对病毒的误判，和对病毒准确定位和判断，必须同时上传金山清理专家日志
下载金山清理专家
http://www.duba.net/qing/

金山清理专家-在线系统诊断（隐藏安全项）-导出诊断报告-（全选）-导出报告



5.2份日志/报告以附件上传（点击我回的贴的右下角的“引用”，然后就应该知道怎么以附件发了），贴到反病毒区.已发帖请跟贴，勿另开新帖。
PS:
1.如想成功解决问题，请按照步骤严格操作，金山和SRENG报告一个也不能少,要同时上传
2.如都不能正常运行
应使用下列工具：http://bbs.ikaka.com/showtopic-8442813.aspx的44，45，46，47，49，50，51楼的工具扫描日志

扫完日志传上来之后，，，ＬＺ请按照这帖http://bbs.ikaka.com/showtopic-8546152.aspx的内容设置好ＨＯＳＴ文件。