最近机器中了奇怪的病毒，系统恢复过一次，好了2天，今天又出现类似情况。
在WINNT/temp目录下 莫名其妙的多出zx.exe qqq.exe zt.exe 1.exe 等文件
任务管理器无法直接结束上述文件的进程。
瑞星扫描内存时以上文件全部安全通过杀毒，不被人为是病毒。
使用优化大师的进程管理也无法结束进程。
WINNT目录下生成DOWNLOAD DOWN INTER 文件夹 内有SVCHOST.exe 等类似系统文件的可疑文件
以上WINNT目录下的几个文件在瑞星杀毒时总能提前出现错误，被windows关闭掉。
上次恢复系统前，计算机的任何杀毒软件无法启动，包括瑞星和毒霸的注册表恢复工具
每隔10分钟 CPU使用率就达到100% 整个局域网掉线！
以上所有文件都可以安全通过瑞星杀毒的检查。今天早上杀了4遍还是告诉我没病毒！
今天在使用进程强暴器删除所有可疑文件重起后，在WINNT/TEMP目录中多出一个1.ini的文件

内容如下：
[DOWNLOADNUMS]

updatetm=10
downfile=10
killproc=5
removreg=1

[STARTHTMPAGE]

;mainpage=http://www.sina.com.cn

[DOWNMAINLIST]

mainfile=http://www.god74.com/top/top.exe

[DOWNFILELIST]

downfile1=http://www.god74.com/mm/1.exe
downfile2=http://www.god74.com/mm/2.exe
downfile3=http://www.god74.com/mm/3.exe
downfile4=http://www.god74.com/mm/4.exe
downfile5=http://www.god74.com/mm/5.exe
downfile6=http://www.god74.com/mm/6.exe
downfile7=http://www.god74.com/mm/7.exe
downfile8=http://www.god74.com/mm/8.exe
downfile9=http://www.god74.com/mm/9.exe
downfile10=http://www.god74.com/mm/10.exe

[DOWNKILLLIST]

killproc1=avp.EXE
killproc2=rav.EXE
killproc3=kav.EXE
killproc4=kavsvc.EXE
killproc5=NAVAPSVC.EXE

[REMOVREGLIST]

;removreg1=HKEY_LOCAL_MACHINE\SOFTWARE\C07ft5Y\WinXP*test


不知道哪位大仙知道是什么原因，非常感谢！

浏览器劫持,下载大量未知程序,结束杀软进程!
删除这个1.INI脚本件,在其他盘查找该文件,删除.用卡卡修复IE,全盘查找1.EXE-10.EXE和TOP.EXE,安全模式下删除.

HijackThis_815汉化版扫描日志 V1.99.1
保存于      13:06:01, 日期 2006-12-04
操作系统：  Windows 2000 SP4 (WinNT 5.00.2195)
浏览器：    Internet Explorer v5.00 SP4 (5.00.2920.0000)

当前运行的进程：         
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\Program Files\Rising\Rav\Ravmond.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\regsvc.exe
E:\rzx\Net110\RService.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\WINNT\system32\r_server.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
E:\rzx\Net110\SysMon.exe
E:\Wx2004\Server.exe
C:\Program Files\CNK\网吧服务器\BarServer.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\WINNT\system32\internat.exe
F:\网管呼叫\MgrClient.exe
E:\rzx\Net110\Lsui.exe
F:\网管呼叫\CallMgr.exe
E:\rzx\Net110\LSParser.exe
E:\Wx2004\Store.exe
E:\Wx2004\rzxsurename.exe
E:\Wx2004\ICache\wxCache.exe
C:\WINNT\system32\conime.exe
E:\Wx2004\ICache\unlinkd.exe
C:\Program Files\Rising\Rav\RsAgent.exe
C:\WINNT\msagent\AgentSvr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\桌面\Hijackthis1991\HijackThis1991zww.exe

F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: QQBrowserHelperObject Class - {54EBD53A-9BC1-480B-966A-843A333CA162} - e:\QQ\QQIEHelper.dll (file missing)
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FLASHGET\jccatch.dll
O3 - IE工具栏增项: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - IE工具栏增项: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O4 - 启动项HKLM\\Run: [Synchronization Manager] mobsync.exe /logon
O4 - 启动项HKLM\\Run: [SYSMON] e:\rzx\Net110\SysMon.exe
O4 - 启动项HKLM\\Run: [ssServ] E:\Wx2004\Server.exe
O4 - 启动项HKLM\\Run: [BarServer] C:\Program Files\CNK\网吧服务器\BarServer.exe
O4 - 启动项HKLM\\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O4 - Startup: 快捷方式 MgrClient.exe.lnk = ?
O4 - Startup: 快捷方式 CallMgr.exe.lnk = ?
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - E:\QQ\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载 - C:\PROGRA~1\FLASHGET\jc_link.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链接 - C:\PROGRA~1\FLASHGET\jc_all.htm
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - E:\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - E:\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - E:\QQ\SendMMS.htm
O9 - 浏览器额外的按钮: 就要你 - {42CE9921-7259-11D6-B76A-0010A48548DC} - url:http://www.91ni.com (file missing)
O9 - 浏览器额外的按钮: 网吧.net计划 - {64187580-726B-11D6-B76A-0010A48548DC} - url:http://www.sicent.net (file missing)
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - e:\QQ\QQ.EXE (file missing)
O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - e:\QQ\QQ.EXE (file missing)
O9 - 浏览器额外的按钮: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - 浏览器额外的“工具”菜单项: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - 浏览器额外的按钮: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - e:\QQ\QQIEHelper.dll (file missing)
O9 - 浏览器额外的“工具”菜单项: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - e:\QQ\QQIEHelper.dll (file missing)
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O17 - HKLM\System\CCS\Services\Tcpip\..\{F007591E-A2E4-4A82-87AE-FE81C2E11D04}: NameServer = 202.102.199.68,202.102.192.68
O23 - NT 服务: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - NT 服务: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - NT 服务: RService - Unknown owner - E:\rzx\Net110\RService.exe
O23 - NT 服务: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
O23 - NT 服务: RzxSevce - Unknown owner - e:\rzx\Net110\rzxsevce.exe (file missing)
O23 - NT 服务: Remote Administrator Service (r_server) - Unknown owner - C:\WINNT\system32\r_server.exe" /service (file missing)

引用:

【6981313的贴子】浏览器劫持,下载大量未知程序,结束杀软进程! 删除这个1.INI脚本件,在其他盘查找该文件,删除.用卡卡修复IE,全盘查找1.EXE-10.EXE和TOP.EXE,安全模式下删除. ………………

楼上讲的我试了！全盘没有1.exe-10.exe 和 top.exe文件！1.exe-4.exe我已经删掉了 ！
关键是为什么当时进程里的1.exe到4.exe还有其他的莫名其妙的东西会被瑞星忽略！
还有zt.exe 我记得上个礼拜瑞星还能辨别出这个是征途游戏的木马！xy.exe是梦幻的盗号木马最近几次更新后就完全不能识别了。

高手来指点一二啊！！！现在对瑞星是大大的不放心了！！！

【回复“stevehunter”的帖子】
killproc1=avp.EXE
killproc2=rav.EXE
killproc3=kav.EXE
killproc4=kavsvc.EXE
killproc5=NAVAPSVC.EXE
竟然能够禁止这么多杀软
看来此病毒比较严重

楼主机器好像中了木马下载器

http://www.KZTechs.com/
下载System Repair Engineer
导出全部日志

2006-12-04,14:07:40

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Server Service Pack 4 (Build 2195)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <Internat.exe><internat.exe>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <Synchronization Manager><mobsync.exe /logon>  [(Verified)Microsoft Corporation]
    <SYSMON><e:\rzx\Net110\SysMon.exe>  []
    <ssServ><E:\Wx2004\Server.exe>  []
    <BarServer><C:\Program Files\CNK\网吧服务器\BarServer.exe>  [N/A]
    <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><userinit.exe,>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINNT\system32\RavExt.dll>  [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <HotKeysCmds><; C:\WINNT\system32\hkcmd.exe>  [(Verified)Intel Corporation]
    <IgfxTray><; C:\WINNT\system32\igfxtray.exe>  [(Verified)Intel Corporation]
    <SoundMan><; SOUNDMAN.EXE>  [(Verified)Realtek Semiconductor Corp.]
    <Synchronization Manager><; mobsync.exe /logon>  [(Verified)Microsoft Corporation]
    <TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]

==================================
启动文件夹
[快捷方式 MgrClient.exe]
  <C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\快捷方式 MgrClient.exe.lnk --> F:\网管呼叫\MGRCLI~1.EXE [www.gmblade.com]><N>
[快捷方式 CallMgr.exe]
  <C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\快捷方式 CallMgr.exe.lnk --> F:\网管呼叫\CallMgr.exe [www.gmblade.com]><N>

==================================
服务
[Logical Disk Manager Administrative Service / dmadmin]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[Remote Packet Capture Protocol v.0 (experimental) / rpcapd]
  <"C:\Program Files\WinPcap\rpcapd.exe" -d -f "C:\Program Files\WinPcap\rpcapd.ini"><N/A>
[Remote Procedure Call System(RPCS) / RpcS]
  <C:\WINNT\system32\RpcS.exe><Microsoft Corporation>
[Rising Process Communication Center / RsCCenter]
  <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RService / RService]
  <E:\rzx\Net110\RService.exe><>
[Rising RealTime Monitor / RsRavMon]
  <"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[RzxSevce / RzxSevce]
  <e:\rzx\Net110\rzxsevce.exe><N/A>
[Remote Administrator Service / r_server]
  <"C:\WINNT\system32\r_server.exe" /service><>

==================================
驱动程序
[Service for Realtek AC97 Audio (WDM) / ALCXWDM]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[BaseTDI / BaseTDI]
  <\??\C:\WINNT\system32\drivers\basetdi.sys><Beijing Rising Technology Co., Ltd.>
[dmboot / dmboot]
  <System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio]
  <\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload]
  <\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[ExpScaner / ExpScaner]
  <\??\C:\Program Files\Rising\Rav\ExpScan.sys><>
[HookCont / HookCont]
  <\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising tech Co. ltd>
[HookReg / HookReg]
  <\??\C:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys]
  <\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising>
[i81x / i81x]
  <system32\DRIVERS\i81xnt5.sys><Intel(R) Corporation>
[MEMSCAN / MEMSCAN]
  <\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[NetGroup Packet Filter Driver / NPF]
  <system32\drivers\npf.sys><Politecnico di Torino>
[npkcrypt / npkcrypt]
  <\??\E:\QQ\npkcrypt.sys><N/A>
[Direct Parallel Link Driver / Ptilink]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RSPPSYS / RSPPSYS]
  <\??\C:\PROGRAM FILES\RISING\RAV\RSPPSYS.sys><Rising>
[Realtek RTL8139-based PCI Fast Ethernet Adapter NT Driver / rtl8139]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>

==================================
浏览器加载项
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <e:\QQ\QQIEHelper.dll, N/A>
[IeCatch2 Class]
  {A5366673-E8CA-11D3-9CD9-0090271D075B} <C:\PROGRA~1\FLASHGET\jccatch.dll, Amaze Soft>
[就要你]
  {42CE9921-7259-11D6-B76A-0010A48548DC} <url:http://www.91ni.com, N/A>
[网吧.net计划]
  {64187580-726B-11D6-B76A-0010A48548DC} <url:http://www.sicent.net, N/A>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <e:\QQ\QQ.EXE, N/A>
[FlashGet]
  {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\flashget.exe, Amaze Soft>
[QQIEFloatBarCfgCmd Class]
  {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <e:\QQ\QQIEHelper.dll, N/A>
[@msdxmLC.dll,-1@2052,电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[FlashGet Bar]
  {E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[上传到QQ网络硬盘]
  <E:\QQ\AddToNetDisk.htm, N/A>
[使用网际快车下载]
  <C:\PROGRA~1\FLASHGET\jc_link.htm, N/A>
[使用网际快车下载全部链接]
  <C:\PROGRA~1\FLASHGET\jc_all.htm, N/A>
[添加到QQ自定义面板]
  <E:\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <E:\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <E:\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 164][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 188][\??\C:\WINNT\system32\csrss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 184][\??\C:\WINNT\system32\winlogon.exe]  [Microsoft Corporation, 5.00.2195.6714]
[PID: 236][C:\WINNT\system32\services.exe]  [Microsoft Corporation, 5.00.2195.6700]
    [C:\WINNT\system32\dmserver.dll]  [VERITAS Software Corp., 2195.6605.297.3]
[PID: 248][C:\WINNT\system32\lsass.exe]  [Microsoft Corporation, 5.00.2195.6695]
[PID: 432][C:\WINNT\system32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
[PID: 460][C:\Program Files\Rising\Rav\CCenter.exe]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
[PID: 512][C:\WINNT\system32\spoolsv.exe]  [Microsoft Corporation, 5.00.2195.6659]
[PID: 548][C:\WINNT\system32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
[PID: 592][C:\WINNT\system32\regsvc.exe]  [Microsoft Corporation, 5.00.2195.6701]
[PID: 740][E:\rzx\Net110\RService.exe]  [, 1, 0, 0, 1]
    [E:\rzx\Net110\RKernel.dll]  [TODO: <公司名>, 1.0.0.1]
    [E:\rzx\Net110\IpSecMan.dll]  [TODO: <公司名>, 1.0.0.1]
    [E:\rzx\Net110\packet.dll]  [Politecnico di Torino, 3, 0, 0, 18]
    [E:\rzx\Net110\SerIFace.dll]  [深圳任子行网络技术有限公司, 3, 1, 0, 1]
    [E:\rzx\Net110\NetLogPath.dll]  [, 1, 0, 0, 1]
    [E:\rzx\Net110\UniLog.dll]  [, 1, 0, 0, 1]
    [E:\rzx\Net110\RzxSdk.dll]  [RZX, 2, 1, 0, 3]
    [E:\rzx\Net110\IPList.dll]  [N/A, N/A]
    [E:\rzx\Net110\ListSet.dll]  [, 1, 0, 0, 1]
    [E:\rzx\Net110\DynaSet.dll]  [, 1, 0, 0, 1]
    [E:\rzx\Net110\NetSet.dll]  [N/A, N/A]
    [E:\rzx\Net110\LanSet.dll]  [N/A, N/A]
    [E:\rzx\Net110\RAnalyse.dll]  [TODO: <公司名>, 1.0.0.1]
    [E:\rzx\Net110\nicman.dll]  [TODO: <公司名>, 1.0.0.1]
[PID: 788][C:\Program Files\Rising\Rav\RavStub.exe]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 16]
    [C:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[PID: 896][C:\WINNT\system32\r_server.exe]  [, 2, 2, 0, 0]
[PID: 980][C:\WINNT\system32\MSTask.exe]  [Microsoft Corporation, 4.71.2195.6704]
[PID: 1064][C:\WINNT\System32\WBEM\WinMgmt.exe]  [Microsoft Corporation, 1.50.1085.0100]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
[PID: 1104][C:\WINNT\system32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
[PID: 1140][C:\WINNT\Explorer.EXE]  [Microsoft Corporation, 5.00.3700.6690]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [C:\PROGRA~1\FLASHGET\jccatch.dll]  [Amaze Soft, 1, 1, 4, 0]
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\WINNT\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 21]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, N/A]
[PID: 1284][E:\rzx\Net110\SysMon.exe]  [, 1, 0, 0, 1]
    [E:\rzx\Net110\LanSet.dll]  [N/A, N/A]
    [E:\rzx\Net110\DynaSet.dll]  [, 1, 0, 0, 1]
    [E:\rzx\Net110\StatiSet.dll]  [, 1, 0, 0, 1]
    [E:\rzx\Net110\NetLogPath.dll]  [, 1, 0, 0, 1]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
[PID: 636][E:\Wx2004\Server.exe]  [, 16.4.8.920]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [E:\Wx2004\uptCom.dll]  [, 1.0.0.1020]
    [E:\Wx2004\WxComm.dll]  [N/A, N/A]
    [E:\Wx2004\wxcal.dll]  [成都吉胜, 16.3.7.708]
    [E:\Wx2004\rzx.dll]  [成都吉胜科技, 1.1.0.622]
    [E:\Wx2004\Iplist.dll]  [N/A, N/A]
    [E:\Wx2004\wxhelper.dll]  [成都吉胜科技有限公司, 1.1.0.6536]
    [E:\Wx2004\idlogupload.dll]  [深圳任子行网络技术公司, 2.0]
    [E:\Wx2004\NBConfig.dll]  [, 1, 0, 0, 1]
    [E:\Wx2004\LanSet.dll]  [N/A, N/A]
    [E:\Wx2004\DynaSet.dll]  [, 1, 0, 0, 1]
    [C:\WINNT\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 21]
[PID: 1316][C:\Program Files\CNK\网吧服务器\BarServer.exe]  [, 1, 0, 0, 1]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
[PID: 1444][C:\WINNT\system32\internat.exe]  [Microsoft Corporation, 5.00.2920.0000]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
[PID: 1432][F:\网管呼叫\MgrClient.exe]  [www.gmblade.com, 1, 0, 0, 1]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
[PID: 1452][E:\rzx\Net110\Lsui.exe]  [N/A, 1, 0, 0, 1]
    [E:\rzx\Net110\LanSockS.dll]  [, 1, 0, 0, 1]
    [E:\rzx\Net110\NetLogPath.dll]  [, 1, 0, 0, 1]
    [E:\rzx\Net110\StatiSet.dll]  [, 1, 0, 0, 1]
    [E:\rzx\Net110\StateSet.dll]  [N/A, N/A]
    [E:\rzx\Net110\LanSet.dll]  [N/A, N/A]
    [E:\rzx\Net110\NetSet.dll]  [N/A, N/A]
    [E:\rzx\Net110\UniLog.dll]  [, 1, 0, 0, 1]
    [E:\rzx\Net110\DynaSet.dll]  [, 1, 0, 0, 1]
    [E:\rzx\Net110\RzxSdk.dll]  [RZX, 2, 1, 0, 3]
    [E:\rzx\Net110\PracticeCheck.dll]  [, 1, 0, 0, 1]
    [E:\rzx\Net110\rzxbackup.dll]  [, 1, 0, 0, 1]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
[PID: 1460][F:\网管呼叫\CallMgr.exe]  [www.gmblade.com, 1, 0, 0, 1]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
[PID: 1208][E:\rzx\Net110\LSParser.exe]  [, 1, 0, 0, 1]
    [E:\rzx\Net110\NetSet.dll]  [N/A, N/A]
    [E:\rzx\Net110\LSReg.dll]  [深圳任子行网络技术, 1.0.0.1]
    [E:\rzx\Net110\LanSet.dll]  [N/A, N/A]
    [E:\rzx\Net110\UniComm.dll]  [, 1, 0, 0, 1]
    [E:\rzx\Net110\DynaSet.dll]  [, 1, 0, 0, 1]
    [E:\rzx\Net110\PracticeCheck.dll]  [, 1, 0, 0, 1]
    [E:\rzx\Net110\StatiSet.dll]  [, 1, 0, 0, 1]
    [E:\rzx\Net110\LanSockS.dll]  [, 1, 0, 0, 1]
    [E:\rzx\Net110\LsAsProc.dll]  [, 1, 0, 0, 1]
    [E:\rzx\Net110\StateSet.dll]  [N/A, N/A]
    [E:\rzx\Net110\ListSet.dll]  [, 1, 0, 0, 1]
    [E:\rzx\Net110\IPList.dll]  [N/A, N/A]
    [E:\rzx\Net110\CheckNet.dll]  [, 1, 0, 0, 1]
    [E:\rzx\Net110\UniLog.dll]  [, 1, 0, 0, 1]
    [E:\rzx\Net110\NetLogPath.dll]  [, 1, 0, 0, 1]
    [E:\rzx\Net110\RzxSdk.dll]  [RZX, 2, 1, 0, 3]
    [E:\rzx\Net110\zlib.dll]  [N/A, 1.2.2]
    [E:\rzx\Net110\UPNetLog.dll]  [, 1, 0, 0, 1]
    [E:\rzx\Net110\CheckUsr.dll]  [, 1, 0, 0, 1]
    [E:\rzx\Net110\LtSet.dll]  [, 1, 0, 0, 1]
    [E:\rzx\Net110\LsLtProc.dll]  [, 1, 0, 0, 1]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [E:\rzx\Net110\FindHost.dll]  [N/A, N/A]
[PID: 1688][E:\Wx2004\Store.exe]  [, 2.0.0.0]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
[PID: 1648][E:\Wx2004\rzxsurename.exe]  [深圳任子行网络技术有限公司, 2.0]
    [E:\Wx2004\NetManageIDCard.dll]  [N/A, N/A]
    [E:\Wx2004\GCardID_RZX.dll]  [N/A, N/A]
    [E:\Wx2004\idcardupdown.dll]  [深圳任子行网络技术公司, 2.0]
    [E:\Wx2004\NBConfig.dll]  [, 1, 0, 0, 1]
    [E:\Wx2004\LanSet.dll]  [N/A, N/A]
    [E:\Wx2004\DynaSet.dll]  [, 1, 0, 0, 1]
    [E:\Wx2004\idlogupload.dll]  [深圳任子行网络技术公司, 2.0]
    [E:\Wx2004\IPList.dll]  [N/A, N/A]
    [E:\Wx2004\IdLostInfo.dll]  [深圳任子行网络技术公司, 2.0]
    [E:\Wx2004\zlib.dll]  [N/A, 1.2.2]
    [E:\Wx2004\IdApi.dll]  [深圳任子行网络技术公司, 2.0]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
[PID: 1584][E:\Wx2004\ICache\wxCache.exe]  [N/A, N/A]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [E:\Wx2004\ICache\CacheNode.dll]  [N/A, N/A]
[PID: 1744][C:\WINNT\system32\conime.exe]  [Microsoft Corporation, 5.00.2195.6655]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
[PID: 1756][E:\Wx2004\ICache\unlinkd.exe]  [N/A, N/A]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
[PID: 384][C:\Program Files\Rising\Rav\RsAgent.exe]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 12]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [C:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
[PID: 584][C:\WINNT\msagent\AgentSvr.exe]  [Microsoft Corporation, 2.00.0.3422]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
[PID: 1680][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 5.00.2920.0000]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [C:\PROGRA~1\FLASHGET\jccatch.dll]  [Amaze Soft, 1, 1, 4, 0]
    [C:\WINNT\system32\Macromed\Flash\Flash9.ocx]  [Adobe Systems, Inc., 9,0,16,0]
[PID: 1816][C:\Downloads\sreng2\SREng\SREng.exe]  [Smallfrogs Studio, 2.2.6.605]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================

高手在哪捏？？？救命啊！
我不想天天删这个删那个啊！
给个一劳永逸的解决方法！
感谢先！！！