IE主页是乱码 http://%77%77%77%2e%68%75%6e%64%75%6e%2e%62%69%7a/%68/
收藏夹也自动添加几个网页
一打开杀毒软件就跳出“winlogon.exe应用程序错误”，无论点确定和取消都马上关机

下面是扫描日志

2006-12-19,22:21:39

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 1 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe>  [(Verified)Microsoft Corporation]
    <MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Corporation]
    <PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Corporation]
    <PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Corporation]
    <EPSON Stylus C63 Series><C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C63 Series" /O6 "USB001" /M "Stylus C63">  [SEIKO EPSON CORPORATION]
    <PPHIDPAD><C:\WINPENJR\Win32\pphidpad.exe>  [N/A]
    <iamapp><C:\PROGRA~1\SYMANT~1\SYMANT~1\IAMAPP.EXE>  [(Verified)Symantec Corporation]
    <NeroCheck><C:\WINDOWS\System32\\NeroCheck.exe>  [Ahead Software Gmbh]
    <KAVPersonal50><"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize>  [Kaspersky Lab]
    <KernelFaultCheck><%systemroot%\system32\dumprep 0 -k>  [N/A]
    <在线安装><C:\DOCUME~1\hongtuo\LOCALS~1\Temp\QGG\ylzs.exe>  [N/A]
    <Alitalk><C:\PROGRA~1\阿里巴巴\贸易通\AliTalk.EXE -hideframe>  [Alibaba]
    <Install Alitalk><C:\WINDOWS\temp\alitalk\alitalk.exe -hideframe>  [N/A]
    <runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe>  [Beijing Rising Technology Co., Ltd.]
    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,rundll32.exe C:\WINDOWS\System32\winsys16_061218.dll start>  [N/A]
    <UIHost><logonui.exe>  [(Verified)Microsoft Corporation]

==================================
启动文件夹
[Microsoft Office]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Microsoft Office.lnk --> C:\PROGRA~1\MICROS~2\Office\OSA9.EXE [Microsoft Corporation]><N>
[腾讯QQ]
  <C:\Documents and Settings\hongtuo\「开始」菜单\程序\启动\腾讯QQ.lnk --> D:\陈守桓\QQ文件\QQ.exe [TENCENT]><N>
[腾讯TM]
  <C:\Documents and Settings\hongtuo\「开始」菜单\程序\启动\腾讯TM.lnk --> C:\PROGRA~1\Tencent\QQ\TMShell.exe [腾讯公司]><N>

==================================
服务
[QoS Service / BRGNS]
  <C:\WINDOWS\SYSTEM32\RUNDLL32.EXE C:\WINDOWS\SYSTEM32\WBEM\IRJIT.DLL,Export 1087><N/A>
[Volume Optimization / ClipArt]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\System32\spted.dll><Microsoft Corporation>
[Human Interface Device Access / HidServ]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[kavsvc / kavsvc]
  <"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe"><Kaspersky Lab>
[Symantec Client Firewall Service / NISSERV]
  <C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISSERV.EXE><Symantec Corporation>
[Symantec Client Firewall Accounts Manager / NISUM]
  <C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISUM.EXE><Symantec Corporation>
[Symantec Client Firewall Proxy Service / SymPxSvc]
  <C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\SymPxSvc.exe><Symantec Corporation>

==================================
驱动程序
[ids00026 / ids00026]
  <\??\C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids00026.sys><N/A>
[ids00118 / ids00118]
  <\??\C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids00118.sys><N/A>
[ids0014f / ids0014f]
  <\??\C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids0014f.sys><N/A>
[ids0015d / ids0015d]
  <\??\C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids0015d.sys><Kaspersky Lab>
[Klick / Klick]
  <\SystemRoot\System32\drivers\klick.sys><Kaspersky Lab>
[Klif / Klif]
  <System32\drivers\klif.sys><Kaspersky Labs>
[Klin / Klin]
  <\SystemRoot\System32\drivers\klin.sys><Kaspersky Lab>
[Klmc / Klmc]
  <System32\drivers\klmc.sys><Kaspersky Lab>
[klstm / klstm]
  <\??\C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\klstm.sys><Kaspersky Lab>
[PNP21406 / PNP21406]
  <\SystemRoot\System32\Drivers\pnp21406.sys><Anti Driver>
[ppmoucls / ppmoucls]
  <System32\DRIVERS\ppmoucls.sys><N/A>
[PenPower Touchpad / pptchpad]
  <System32\DRIVERS\pptchpd5.sys><N/A>
[Direct Parallel Link Driver / Ptilink]
  <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139]
  <System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv]
  <System32\DRIVERS\secdrv.sys><N/A>
[Sony USB Filter Driver (SONYPVU1) / SONYPVU1]
  <System32\DRIVERS\SONYPVU1.SYS><Sony Corporation>
[SYMDNS / SYMDNS]
  <\??\C:\WINDOWS\System32\Drivers\SYMDNS.SYS><Symantec Corporation>
[SYMFW / SYMFW]
  <\??\C:\WINDOWS\System32\Drivers\SYMFW.SYS><Symantec Corporation>
[SYMIDS / SYMIDS]
  <\??\C:\WINDOWS\System32\Drivers\SYMIDS.SYS><Symantec Corporation>
[SYMIDSCO / SYMIDSCO]
  <\??\C:\WINDOWS\System32\Drivers\SYMIDSCO.SYS><Symantec Corporation>
[SYMNDIS / SYMNDIS]
  <\??\C:\WINDOWS\System32\Drivers\SYMNDIS.SYS><Symantec Corporation>
[SYMREDRV / SYMREDRV]
  <\??\C:\WINDOWS\System32\Drivers\SYMREDRV.SYS><Symantec Corporation>
[SYMTDI / SYMTDI]
  <\??\C:\WINDOWS\System32\Drivers\SYMTDI.SYS><Symantec Corporation>
[TSP / TSP]
  <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Labs>

浏览器加载项
[迅彩图铃通]
  {1D8E8710-88F8-4d6e-AD7C-1437937E82A9} <C:\Program Files\FLISoft\Capture Studio\xuncaiie.dll, 迅彩科技>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[迅彩图铃通]
  {1D8E8710-88F8-4d6e-AD7C-1437937E82A9} <C:\Program Files\FLISoft\Capture Studio\xuncaiie.dll, 迅彩科技>
[CKAVWebScan Object]
  {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} <C:\WINDOWS\System32\Kaspersky Lab\Kaspersky Online Scanner Pro\kavwebscan.dll, Kaspersky Lab>
[DownLoad Class]
  {276BF72D-CA22-4237-9BCF-593B4E490DE9} <C:\WINDOWS\Downloaded Program Files\AliTalk_WebUpdate.dll, >
[AxSubmitControl Class]
  {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} <C:\WINDOWS\DOWNLO~1\SUBMIT~1.DLL, >
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[  发送到手机<迅彩图铃通>]
  <C:\WINDOWS\System32\xuncaiie.htm, N/A>
[Download All by FlashGet]
  <E:\flashget\jc_all.htm, N/A>
[Download using FlashGet]
  <E:\flashget\jc_link.htm, N/A>
[上传到QQ网络硬盘]
  <D:\陈守桓\QQ文件\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
  <D:\陈守桓\QQ文件\AddPanel.htm, N/A>
[添加到QQ表情]
  <D:\陈守桓\QQ文件\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <D:\陈守桓\QQ文件\SendMMS.htm, N/A>
=================================
正在运行的进程
[PID: 484][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 532][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 556][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 600][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 612][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 772][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 824][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 900][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 936][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1240][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 5]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, N/A]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\shellex.dll]  [Kaspersky Lab, 5.0.227.1]
[PID: 1368][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [C:\WINDOWS\system32\EBPMON24.DLL]  [SEIKO EPSON CORPORATION, 1, 4, 0, 0]
    [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll]  [Windows (R) 2000 DDK provider, 5.00.2195.1620]
[PID: 1476][C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE]  [SEIKO EPSON CORPORATION, 3.08]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 5]
[PID: 1484][C:\WINPENJR\Win32\pphidpad.exe]  [N/A, N/A]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 5]
[PID: 1496][C:\PROGRA~1\SYMANT~1\SYMANT~1\IAMAPP.EXE]  [Symantec Corporation, 5.0.0.375]
    [C:\PROGRA~1\SYMANT~1\SYMANT~1\iamevent.dll]  [Symantec Corporation, 5.0.0.375]
    [C:\PROGRA~1\SYMANT~1\SYMANT~1\NISRES.DLL]  [N/A, N/A]
    [C:\WINDOWS\System32\SYMSTORE.dll]  [Symantec Corporation, 4.6.0.53]
    [C:\PROGRA~1\SYMANT~1\SYMANT~1\IAMLOG.dll]  [Symantec Corporation, 5.0.0.375]
    [C:\PROGRA~1\SYMANT~1\SYMANT~1\N32USERL.DLL]  [Symantec Corporation, 5.0.0.375]
    [C:\PROGRA~1\SYMANT~1\SYMANT~1\UMCBK.DLL]  [Symantec Corporation, 5.0.0.375]
    [C:\PROGRA~1\SYMANT~1\SYMANT~1\NISALERT.DLL]  [Symantec Corporation, 5.0.0.375]
    [C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISUMPS.DLL]  [Symantec Corporation, 5.0.0.375]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 5]
    [C:\PROGRA~1\SYMANT~1\SYMANT~1\IAMCPL.CPL]  [Symantec Corporation, 5.0.0.375]
    [C:\PROGRA~1\SYMANT~1\SYMANT~1\tlevel.dll]  [Symantec Corporation, 5.0.0.375]
    [C:\PROGRA~1\SYMANT~1\SYMANT~1\NAVAPI32.DLL]  [Symantec Corp., 4.1.0.15]
    [C:\Program Files\Common Files\Symantec Shared\BRUNOALE.DLL]  [Symantec Corporation, 5.0.0.375]
    [C:\Program Files\Common Files\Symantec Shared\PProfile.dll]  [Symantec Corporation, 5.0.0.375]
[PID: 1572][C:\DOCUME~1\hongtuo\LOCALS~1\Temp\QGG\ylzs.exe]  [N/A, N/A]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 5]
[PID: 1628][C:\Program Files\Rising\AntiSpyware\runiep.exe]  [Beijing Rising Technology Co., Ltd., 1, 0, 1, 3]
    [C:\Program Files\Rising\AntiSpyware\iep_ctrl.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 5]
[PID: 1648][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3536]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 5]
[PID: 1672][C:\WINDOWS\System32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 5]
[PID: 1732][D:\陈守桓\QQ文件\QQ.exe]  [TENCENT, 0, 0, 0, 0]
    [D:\陈守桓\QQ文件\QQBaseClassInDll.dll]  [, 1, 0, 0, 1]
    [D:\陈守桓\QQ文件\QQHelperDll.dll]  [, 1, 0, 0, 1]
    [D:\陈守桓\QQ文件\BasicCtrlDll.dll]  [Tencent, 5, 0, 200, 160]
    [D:\陈守桓\QQ文件\QQAPI.dll]  [, 1, 0, 0, 1]
    [D:\陈守桓\QQ文件\TIMProxy.dll]  [tencent, 0, 3, 2, 4]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 5]
    [D:\陈守桓\QQ文件\LoginCtrl.dll]  [, 1, 0, 0, 1]
    [D:\陈守桓\QQ文件\npkcntc.dll]  [INCA Internet Co., Ltd., 2006, 3, 2, 1]
    [D:\陈守桓\QQ文件\npkpdb.dll]  [INCA Internet Co., Ltd., 2003, 10, 1, 1]
    [D:\陈守桓\QQ文件\QQRes.dll]  [tencent, 1, 0, 0, 1]
    [D:\陈守桓\QQ文件\QQMainFrame.dll]  [N/A, N/A]
    [D:\陈守桓\QQ文件\CQQApplication.dll]  [N/A, N/A]
    [D:\陈守桓\QQ文件\NewSkin.dll]  [, 1, 0, 0, 1]
    [D:\陈守桓\QQ文件\HostingMgr.dll]  [, 1, 0, 0, 1]
    [D:\陈守桓\QQ文件\CameraDll.dll]  [, 1, 0, 0, 1]
    [D:\陈守桓\QQ文件\MailSummary.dll]  [, 1, 0, 0, 1]
    [D:\陈守桓\QQ文件\QQSpace.dll]  [, 1, 0, 0, 1]
    [C:\WINDOWS\System32\msdmo.dll]  [N/A, N/A]
    [D:\陈守桓\QQ文件\QQGroupMng.dll]  [, 1, 0, 0, 1]
    [D:\陈守桓\QQ文件\GroupLive.dll]  [N/A, N/A]
    [D:\陈守桓\QQ文件\UserDefinedHead.dll]  [, 1, 0, 0, 1]
    [D:\陈守桓\QQ文件\QQPlugin.dll]  [N/A, N/A]
    [D:\陈守桓\QQ文件\QQConfigPlugin.dll]  [, 1, 0, 0, 1]
    [D:\陈守桓\QQ文件\QQSysMsgMng.dll]  [N/A, N/A]
    [D:\陈守桓\QQ文件\QQAllInOne.dll]  [N/A, N/A]
    [D:\陈守桓\QQ文件\SCCore.dll]  [N/A, N/A]
    [D:\陈守桓\QQ文件\QQCustomFace.dll]  [N/A, N/A]
    [D:\陈守桓\QQ文件\LongConnection.dll]  [tencent, 5, 0, 200, 160]
    [D:\陈守桓\QQ文件\QRingMng.dll]  [N/A, N/A]
    [D:\陈守桓\QQ文件\PhoneAPI.dll]  [, 1, 0, 0, 1]
    [D:\陈守桓\QQ文件\DialerAllinOne.dll]  [tencent, 1, 4, 0, 0]
    [D:\陈守桓\QQ文件\QQPet.dll]  [, 1, 0, 0, 1]
    [D:\陈守桓\QQ文件\QQAvatar.dll]  [N/A, N/A]
    [D:\陈守桓\QQ文件\FlashAvatarDll.dll]  [, 1, 4, 0, 1]
    [D:\陈守桓\QQ文件\ImageOle.dll]  [TODO: <Company name>, 1.0.0.1]
    [C:\WINDOWS\System32\Macromed\Flash\Flash8.ocx]  [Macromedia, Inc., 8,0,22,0]
    [D:\陈守桓\QQ文件\QQSceneMng.dll]  [N/A, N/A]
    [D:\陈守桓\QQ文件\BQQApplication.dll]  [N/A, N/A]
    [D:\陈守桓\QQ文件\GroupConnection.dll]  [Tencent, 5, 0, 202, 170]
    [D:\陈守桓\QQ文件\QQPhoneHelper.dll]  [腾讯科技（深圳）有限公司, 2, 1, 1, 12]
    [D:\陈守桓\QQ文件\CommercesMng.dll]  [, 1, 0, 0, 1]
    [D:\陈守桓\QQ文件\PersonalDesktop.dll]  [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2]
    [D:\陈守桓\QQ文件\QQUdpGetFileLib.dll]  [tencent, 0, 2, 2, 3]
    [D:\陈守桓\QQ文件\QQAddr.dll]  [深圳市腾讯计算机系统有限公司, 5, 0, 101, 200]
[PID: 1888][D:\陈守桓\QQ文件\TIMPlatform.exe]  [tencent, 0, 3, 1, 8]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 5]
    [D:\陈守桓\QQ文件\TIMProxy.dll]  [tencent, 0, 3, 2, 4]

[PID: 1984][C:\WINDOWS\System32\cmd.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 2024][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 2044][C:\WINDOWS\SYSTEM32\RUNDLL32.EXE]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 264][C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISUM.EXE]  [Symantec Corporation, 5.0.0.375]
    [C:\WINDOWS\System32\SYMSTORE.dll]  [Symantec Corporation, 4.6.0.53]
    [C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISUMPS.DLL]  [Symantec Corporation, 5.0.0.375]
[PID: 444][C:\WINDOWS\System32\conime.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 5]
[PID: 868][C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISSERV.EXE]  [Symantec Corporation, 5.0.0.375]
    [C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\IAMLOG.dll]  [Symantec Corporation, 5.0.0.375]
    [C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\iamevent.dll]  [Symantec Corporation, 5.0.0.375]
    [C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISRES.DLL]  [N/A, N/A]
    [C:\WINDOWS\System32\SYMSTORE.dll]  [Symantec Corporation, 4.6.0.53]
    [C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISUMPS.DLL]  [Symantec Corporation, 5.0.0.375]
[PID: 952][C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\SymPxSvc.exe]  [Symantec Corporation, 5.0.0.375]
    [C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\SymProxy.dll]  [Symantec Corporation, 5.0.0.375]
    [C:\WINDOWS\System32\SYMREDIR.dll]  [Symantec Corporation, 4.6.0.53]
    [C:\WINDOWS\System32\SYMSTORE.dll]  [Symantec Corporation, 4.6.0.53]
    [C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISALERT.DLL]  [Symantec Corporation, 5.0.0.375]
    [C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISRES.DLL]  [N/A, N/A]
    [C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\ProxyIM.DLL]  [Symantec Corporation, 5.0.0.375]
    [C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\StrmFilt.dll]  [Symantec Corporation, 5.0.0.375]
    [C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\SymIConv.dll]  [Symantec Corporation, 5.0.0.375]
    [C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\SymPxAlt.dll]  [Symantec Corporation, 5.0.0.375]
    [C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\SymURL.dll]  [Symantec Corporation, 5.0.0.375]
    [C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\iamevent.dll]  [Symantec Corporation, 5.0.0.375]
    [C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\PrxyNNTP.DLL]  [Symantec Corporation, 5.0.0.375]
    [C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\PrxyHTTP.dll]  [Symantec Corporation, 5.0.0.375]
    [C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISUMPS.DLL]  [Symantec Corporation, 5.0.0.375]
[PID: 2592][C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\ATRACK.EXE]  [Symantec Corporation, 5.0.0.375]
    [C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\iamevent.dll]  [Symantec Corporation, 5.0.0.375]
    [C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISRES.DLL]  [N/A, N/A]
    [C:\WINDOWS\System32\SYMSTORE.dll]  [Symantec Corporation, 4.6.0.53]
    [C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISUMPS.DLL]  [Symantec Corporation, 5.0.0.375]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 5]
    [C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\tdit_msg.dll]  [Symantec Corporation, 5.0.0.375]
[PID: 2916][C:\WINDOWS\System32\wuauclt.exe]  [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 5]
[PID: 3524][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [C:\Program Files\FLISoft\Capture Studio\xuncaiie.dll]  [迅彩科技, 2, 0, 0, 1]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 5]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpscrch.dll]  [Kaspersky Lab, 1.0.227.342]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\concl.dll]  [Kaspersky Lab, 1.0.227.3]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\FSSync.dll]  [Kaspersky Lab, 5.0.227.0]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\ipc.dll]  [Kaspersky Lab, 5.0.227.0]
    [C:\WINDOWS\System32\Macromed\Flash\Flash8.ocx]  [Macromedia, Inc., 8,0,22,0]
[PID: 4048][D:\陈守桓\QQ文件\QQLiveUpdate.exe]  [, 1, 29, 0, 1036]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 5]
[PID: 1312][D:\陈守桓\QQ文件\QQ.exe]  [TENCENT, 0, 0, 0, 0]
    [D:\陈守桓\QQ文件\QQBaseClassInDll.dll]  [, 1, 0, 0, 1]
    [D:\陈守桓\QQ文件\QQHelperDll.dll]  [, 1, 0, 0, 1]
    [D:\陈守桓\QQ文件\BasicCtrlDll.dll]  [Tencent, 5, 0, 200, 160]
    [D:\陈守桓\QQ文件\QQAPI.dll]  [, 1, 0, 0, 1]
    [D:\陈守桓\QQ文件\TIMProxy.dll]  [tencent, 0, 3, 2, 4]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 5]
    [D:\陈守桓\QQ文件\LoginCtrl.dll]  [, 1, 0, 0, 1]
    [D:\陈守桓\QQ文件\npkcntc.dll]  [INCA Internet Co., Ltd., 2006, 3, 2, 1]
    [D:\陈守桓\QQ文件\npkpdb.dll]  [INCA Internet Co., Ltd., 2003, 10, 1, 1]
    [D:\陈守桓\QQ文件\QQRes.dll]  [tencent, 1, 0, 0, 1]
    [D:\陈守桓\QQ文件\QQMainFrame.dll]  [N/A, N/A]
    [D:\陈守桓\QQ文件\CQQApplication.dll]  [N/A, N/A]
    [D:\陈守桓\QQ文件\NewSkin.dll]  [, 1, 0, 0, 1]
    [D:\陈守桓\QQ文件\HostingMgr.dll]  [, 1, 0, 0, 1]
    [D:\陈守桓\QQ文件\CameraDll.dll]  [, 1, 0, 0, 1]
    [D:\陈守桓\QQ文件\MailSummary.dll]  [, 1, 0, 0, 1]
    [D:\陈守桓\QQ文件\QQSpace.dll]  [, 1, 0, 0, 1]
    [C:\WINDOWS\System32\msdmo.dll]  [N/A, N/A]
    [D:\陈守桓\QQ文件\QQGroupMng.dll]  [, 1, 0, 0, 1]
    [D:\陈守桓\QQ文件\GroupLive.dll]  [N/A, N/A]
    [D:\陈守桓\QQ文件\UserDefinedHead.dll]  [, 1, 0, 0, 1]
    [D:\陈守桓\QQ文件\QQPlugin.dll]  [N/A, N/A]
    [D:\陈守桓\QQ文件\QQAllInOne.dll]  [N/A, N/A]
    [D:\陈守桓\QQ文件\SCCore.dll]  [N/A, N/A]
    [D:\陈守桓\QQ文件\QQCustomFace.dll]  [N/A, N/A]
    [D:\陈守桓\QQ文件\QQPet.dll]  [, 1, 0, 0, 1]
    [D:\陈守桓\QQ文件\QQSysMsgMng.dll]  [N/A, N/A]
    [D:\陈守桓\QQ文件\QQConfigPlugin.dll]  [, 1, 0, 0, 1]
    [D:\陈守桓\QQ文件\QRingMng.dll]  [N/A, N/A]
    [D:\陈守桓\QQ文件\PhoneAPI.dll]  [, 1, 0, 0, 1]
    [D:\陈守桓\QQ文件\DialerAllinOne.dll]  [tencent, 1, 4, 0, 0]
    [D:\陈守桓\QQ文件\LongConnection.dll]  [tencent, 5, 0, 200, 160]
    [D:\陈守桓\QQ文件\QQAvatar.dll]  [N/A, N/A]
    [D:\陈守桓\QQ文件\FlashAvatarDll.dll]  [, 1, 4, 0, 1]
    [D:\陈守桓\QQ文件\BQQApplication.dll]  [N/A, N/A]
    [D:\陈守桓\QQ文件\CommercesMng.dll]  [, 1, 0, 0, 1]
    [D:\陈守桓\QQ文件\PersonalDesktop.dll]  [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2]
    [D:\陈守桓\QQ文件\QQAddr.dll]  [深圳市腾讯计算机系统有限公司, 5, 0, 101, 200]
    [D:\陈守桓\QQ文件\QQPhoneHelper.dll]  [腾讯科技（深圳）有限公司, 2, 1, 1, 12]
    [D:\陈守桓\QQ文件\QQSceneMng.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\Macromed\Flash\Flash8.ocx]  [Macromedia, Inc., 8,0,22,0]
    [D:\陈守桓\QQ文件\ImageOle.dll]  [TODO: <Company name>, 1.0.0.1]
    [D:\陈守桓\QQ文件\QQMagicFace.dll]  [, 1, 0, 0, 1]
[PID: 3572][E:\flashget\flashget.exe]  [Amaze Soft, 1, 7, 1, 0]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 5]
[PID: 2060][D:\程序\SREng2-v2.2\SREng\SREng.exe]  [Smallfrogs Studio, 2.2.6.605]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 5]
=================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[D:\]
[autorun]
open=d:\mplay.com

==================================
HOSTS 文件
127.0.0.1      localhost

==================================

重新启动电脑，自动检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式(Safe Mode)进入Windows。）


运行(双击)SRENG2，点“启动项目，服务，点“Win32服务应用程序”
勾选“隐藏微软服务”选中病毒服务
QoS Service
Volume Optimization
，选择“删除服务”
点“设置”选择“否”



关闭所有浏览窗口以及一些不必要的程序
运行SREng2,使用“启动项目”－－注册表－－选中以下的项删除
C:\WINPENJR\Win32\pphidpad.exe


运行SREng2,使用“启动项目”－－注册表－－选择要修改的项
C:\WINDOWS\system32\userinit.exe,rundll32.exe C:\WINDOWS\System32\winsys16_061218.dll start
，点“编辑”在“值”里删除rundll32.exe C:\WINDOWS\System32\winsys16_061218.dll start


显示隐藏文件
删除：
C:\WINDOWS\SYSTEM32\WBEM\IRJIT.DLL
C:\WINDOWS\System32\spted.dll
C:\WINPENJR\Win32\pphidpad.exe
C:\WINDOWS\System32\winsys16_061218.dll

没有发现
QoS Service
Volume Optimization

全部都按照上面的步骤操作后,电脑无法正常启动

另外,因为我这台电脑是双系统
一个C盘,一个D盘
中毒的是D盘这个
这几天用的是C盘这个系统
所以连C盘的系统也感染了
但还没出现winlogon.exe应用程序错误的情况
只是主页变成乱码和收藏夹和桌面自动添加网页

http://forum.ikaka.com/topic.asp?board=28&artid=8229638
参考

还是不行啊
一开机又变回原样了

引用:

【慕容小燕的贴子】没有发现 QoS Service Volume Optimization 全部都按照上面的步骤操作后,电脑无法正常启动 另外,因为我这台电脑是双系统 一个C盘,一个D盘 中毒的是D盘这个 这几天用的是C盘这个系统 所以连C盘的系统也感染了 但还没出现winlogon.exe应用程序错误的情况 只是主页变成乱码和收藏夹和桌面自动添加网页 ………………

请问你是怎么修复的,可以说一下吧!


双系统两个都扫描上来

引用:

【秋日里的蓝天的贴子】 请问你是怎么修复的,可以说一下吧! 双系统两个都扫描上来 ………………

就是按照你上面说的那个方法
弄完之后就开不了机


现在的情况是这样的
一开机就跳出explorer.exe应用程序错误的框，两次
还有一个服务器正在运行的框
然后就是无论打开IE或其它软件就跳出winlogon.exe应用程序错误

另外请帮忙看看Explorer.EXE 这个程序是不是有问题
谢谢！！