被daqimm.com劫持三日,我哭,,,救命!


日志如下：

2006-10-10,12:30:21

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <MsnMsgr><; "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background>  [Microsoft Corporation]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <NvCplDaemon><; RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>  [(Verified)NVIDIA Corporation]
    <nwiz><; nwiz.exe /install>  [NVIDIA Corporation]
    <NvMediaCenter><; RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit>  [(Verified)NVIDIA Corporation]
    <Adobe Version Cue CS2><"d:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe">  [Adobe Sytems Incorporated]
    <KavStart><"d:\KAV2007\KAVStart.exe" -startup>  [Kingsoft Corporation]
    <Device Detector><; DevDetect.exe -autorun>  [N/A]
    <IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Corporation]
    <PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Corporation]
    <PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Corporation]
    <RfwMain><; "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup>  [N/A]
    <SoundMAX><; "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray>  [Analog Devices, Inc.]
    <SoundMAXPnP><; C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe>  [Analog Devices, Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\Userinit.exe,>  [(Verified)Microsoft Corporation]
    <UIHost><logonui.exe>  [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\Control Panel\Desktop]
    <SCRNSAVE.EXE><C:\WINDOWS\豪杰多~1.SCR>  [N/A]

==================================
启动文件夹
[Microsoft Office]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Microsoft Office.lnk --> C:\PROGRA~1\MICROS~2\Office\OSA9.EXE [Microsoft Corporation]><N>
[Adobe Gamma]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Gamma.lnk --> C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [Adobe Systems, Inc.]><N>
[Adobe Gamma Loader]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Gamma Loader.lnk --> C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [Adobe Systems, Inc.]><N>
[Adobe Acrobat Speed Launcher]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Acrobat Speed Launcher.lnk --> C:\WINDOWS\Installer\{AC76BA86-2052-0000-7760-000000000002}\SC_Acrobat.exe [N/A]><N>
[腾讯QQ]
  <C:\Documents and Settings\cx\「开始」菜单\程序\启动\腾讯QQ.lnk --> C:\PROGRA~1\Tencent\QQ\QQ.exe [TENCENT]><N>
[Zcom 娱乐]
  <C:\Documents and Settings\cx\「开始」菜单\程序\启动\Zcom 娱乐.lnk --> C:\PROGRA~1\Zcom\ZCOMSE~1.EXE [智通无限]><N>

==================================
服务
[Adobe LM Service / Adobe LM Service]
  <"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>
[Adobe Version Cue CS2 / Adobe Version Cue CS2]
  <"d:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe" -win32service><Adobe Systems Incorporated>
[ewido anti-spyware 4.0 guard / ewido anti-spyware 4.0 guard]
  <C:\Program Files\ewido anti-spyware 4.0\guard.exe><Anti-Malware Development a.s.>
[Kingsoft Personal Firewall Service / KPfwSvc]
  <"d:\KAV2007\KPfwSvc.EXE"><Kingsoft Corporation>
[Kingsoft Antivirus KWatch Service / KWatchSvc]
  <d:\KAV2007\KWatch.EXE><Kingsoft Corporation>
[Windows Management Update Service / ManagementUpdate]
  <C:\WINDOWS\ManagementUpdate.exe><N/A>
[NVIDIA Display Driver Service / NVSvc]
  <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[PopWinIe / PopWinIe]
  <C:\WINDOWS\system32\PopWin.exe -service><Microsoft Corporation>
[SoundMAX Agent Service / SoundMAX Agent Service (default)]
  <C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.>

==================================
驱动程序
[aeaudio / aeaudio]
  <system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
[Broadcom 440x 10/100 Integrated Controller XP Driver / bcm4sbxp]
  <system32\DRIVERS\bcm4sbxp.sys><Broadcom Corporation>
[ewido anti-spyware 4.0 driver / ewido anti-spyware 4.0 driver]
  <\??\C:\Program Files\ewido anti-spyware 4.0\guard.sys><N/A>
[GMSIPCI / GMSIPCI]
  <\??\G:\INSTALL\GMSIPCI.SYS><N/A>
[GPKiller / GPKiller]
  <\SystemRoot\system32\drivers\gpkiller.sys><Yahoo!>
[ids00035 / ids00035]
  <\??\C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids00035.sys><N/A>
[ids00118 / ids00118]
  <\??\C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids00118.sys><N/A>
[klstm / klstm]
  <\??\C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\klstm.sys><N/A>
[kmsinput / kmsinput]
  <\??\C:\WINDOWS\system32\drivers\kmsinput.sys><N/A>
[KNetWch / KNetWch]
  <\??\d:\KAV2007\KNetWch.SYS><Kingsoft Corporation>
[KWatch3 / KWatch3]
  <\??\C:\WINDOWS\system32\drivers\KWatch3.SYS><Kingsoft Corporation>
[MidiSyn / MidiSyn]
  <system32\drivers\MidiSyn.sys><Analog Devices, Inc.>
[MSICPL / MSICPL]
  <\??\G:\install4\MSICPL.sys><N/A>
[Netgroup Packet Filter / NPF]
  <system32\DRIVERS\npf.sys><CACE Technologies>
[npkcrypt / npkcrypt]
  <\??\C:\Program Files\Tencent\QQ\npkcrypt.sys><N/A>
[NTACCESS / NTACCESS]
  <\??\G:\NTACCESS.sys><N/A>
[nv / nv]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[PNP05068 / PNP05068]
  <\SystemRoot\system32\Drivers\pnp05068.sys><Anti Driver>
[Direct Parallel Link Driver / Ptilink]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[QKeyServiceDisplay / QKeyService]
  <\SystemRoot\system32\KeyCrypt.sys><>
[Secdrv / Secdrv]
  <system32\DRIVERS\secdrv.sys><N/A>
[senfilt / senfilt]
  <system32\drivers\senfilt.sys><Sensaura>
[SetupNTGLM7X / SetupNTGLM7X]
  <\??\G:\NTGLM7X.sys><N/A>
[smwdm / smwdm]
  <system32\drivers\smwdm.sys><Analog Devices, Inc.>
[Sony USB Filter Driver (SONYPVU1) / SONYPVU1]
  <system32\DRIVERS\SONYPVU1.SYS><Sony Corporation>

==================================
浏览器加载项
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[FlashGet]
  {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\flashget.exe, Amaze Soft>
[QQIEFloatBarCfgCmd Class]
  {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[金山毒霸在线产品升级]
  {52DF16E3-6C4F-4B22-8BAF-09263E463B48} <C:\PROGRA~1\KOS\KOSInit.ocx, 金山软件股份有限公司>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[上传到QQ网络硬盘]
  <C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
  <C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>
[用比特精灵下载(&B)]
  <C:\Program Files\BitSpirit\bsurl.htm, N/A>
[豪杰超级解霸V8实时播放]
  <C:\Herosoft\HeroV8\MPURLGET.HTM, N/A>
[转换为 Adobe PDF]
  <res://d:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html, N/A>
[转换为现有 PDF]
  <res://d:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html, N/A>
[转换选定的链接为 Adobe PDF]
  <res://d:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html, N/A>
[转换选定的链接为现有 PDF]
  <res://d:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html, N/A>
[转换选项为 Adobe PDF]
  <res://d:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html, N/A>
[转换选项为现有 PDF]
  <res://d:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html, N/A>
[转换链接目标为 Adobe PDF]
  <res://d:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html, N/A>
[转换链接目标为现有 PDF]
  <res://d:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html, N/A>
[金山毒霸反钓鱼...]
  <d:\KAV2007\KAF\ShowSet.htm, N/A>

==================================
正在运行的进程
[PID: 396][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 548][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 612][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 692][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 704][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 856][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 920][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1012][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1060][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1428][d:\KAV2007\KWatch.EXE]  [Kingsoft Corporation, 2005, 9, 27, 51]
    [d:\KAV2007\KAVIPC2.DLL]  [Kingsoft Corporation, 2004, 12, 28, 20]
    [d:\KAV2007\KAEPlat.DLL]  [Kingsoft Corp., 2006, 5, 30, 59]
    [d:\KAV2007\KAEMem.DAT]  [Kingsoft, 2006, 5, 17, 14]
    [d:\KAV2007\KAEUnpack.DAT]  [Kingsoft Corp., 2006, 7, 27, 59]
[PID: 1492][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [D:\KAV2007\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [D:\KAV2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 9, 7, 132]
    [d:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\PDFShell.dll]  [Adobe Systems, Inc., 7.0.0.0]
    [d:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\PDFShell.CHS]  [Adobe Systems, Inc., 7.0.0.0]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, N/A]
    [d:\KAV2007\KAVEXT.DLL]  [Kingsoft Corporation, 2005, 8, 5, 16]
    [C:\Program Files\ewido anti-spyware 4.0\context.dll]  [Anti-Malware Development a.s., 4, 0, 0, 172]
    [C:\Herosoft\HeroV8\VCvtShell.dll]  [herosoft, 1, 0, 0, 1]
    [d:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat Elements\ContextMenu.dll]  [Adobe Systems Inc., 7.0.7.2006011200\0]
    [d:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat Elements\ContextMenu.chs]  [Adobe Systems Inc., 7.0.5.2005092300\0]
[PID: 1600][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
    [C:\WINDOWS\system32\AdobePDF.dll]  [Adobe Systems Incorporated., 7.0.0.00]
    [d:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\AdistRes.CHS]  [N/A, N/A]
    [C:\WINDOWS\system32\E_FLMAHP.DLL]  [SEIKO EPSON CORPORATION, 5, 7, 0, 0]
[PID: 1712][D:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe]  [Adobe Sytems Incorporated, 2, 0, 0, 0]
    [d:\Program Files\Adobe\Adobe Version Cue CS2\bin\AdobeUpdater.dll]  [Adobe Systems Incorporated, 4, 0, 0, 44]
[PID: 1720][D:\KAV2007\KAVStart.exe]  [Kingsoft Corporation, 2006, 9, 7, 210]
    [D:\KAV2007\KAVIPC2.DLL]  [Kingsoft Corporation, 2004, 12, 28, 20]
    [D:\KAV2007\SvcTimer.DLL]  [Kingsoft Corporation, 2006.7.24.80]
    [D:\KAV2007\PopSprt3.dll]  [Kingsoft Corporation, 2006, 8, 7, 38]
    [D:\KAV2007\KAVPassp.dll]  [Kingsoft Corporation, 2006, 9, 7, 270]
    [D:\KAV2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 9, 7, 132]
    [D:\KAV2007\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
[PID: 1736][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Herosoft\HeroV8\VCvtShell.dll]  [herosoft, 1, 0, 0, 1]
[PID: 1888][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1984][d:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe]  [Adobe Systems Incorporated, 2, 0, 0, 0]
    [d:\Program Files\Adobe\Adobe Version Cue CS2\jre\bin\client\jvm.dll]  [Sun Microsystems, Inc., 1.4.2.50]
    [d:\Program Files\Adobe\Adobe Version Cue CS2\jre\bin\hpi.dll]  [N/A, N/A]
    [d:\Program Files\Adobe\Adobe Version Cue CS2\jre\bin\verify.dll]  [N/A, N/A]
    [d:\Program Files\Adobe\Adobe Version Cue CS2\jre\bin\java.dll]  [N/A, N/A]
    [d:\Program Files\Adobe\Adobe Version Cue CS2\jre\bin\zip.dll]  [N/A, N/A]
    [D:\Program Files\Adobe\Adobe Version Cue CS2\jre\bin\net.dll]  [N/A, N/A]
    [D:\Program Files\Adobe\Adobe Version Cue CS2\jre\bin\nio.dll]  [N/A, N/A]
    [D:\Program Files\Adobe\Adobe Version Cue CS2\plugins\com.adobe.versioncue.systemintegration_2.0.0\os\win32\x86\SystemIntegration.dll]  [Adobe Systems Incorporated, 2, 0, 0, 0]
    [D:\Program Files\Adobe\Adobe Version Cue CS2\bin\ps-util-vc-v8_58.dll]  [Persistence Software, Inc., 8.587]
    [d:\Program Files\Adobe\Adobe Version Cue CS2\bin\SHSMP.DLL]  [MicroQuill Software Publishing, Inc., 6.02.32]
    [d:\Program Files\Adobe\Adobe Version Cue CS2\bin\ps-rw-vc-v8_58.dll]  [N/A, N/A]
    [D:\Program Files\Adobe\Adobe Version Cue CS2\bin\ps-jni-vc-v8_58.dll]  [Persistence Software, Inc., 8.587]
    [d:\Program Files\Adobe\Adobe Version Cue CS2\bin\ps-vc-v8_58.dll]  [N/A, N/A]
    [d:\Program Files\Adobe\Adobe Version Cue CS2\bin\ps-mysql-vc-v8_58.dll]  [Persistence Software, Inc., 8.587]
    [D:\Program Files\Adobe\Adobe Version Cue CS2\plugins\com.adobe.versioncue.rendezvous_2.0.0\os\win32\x86\VCRendezvous.dll]  [Adobe Systems, 1, 0, 0, 0]
[PID: 2012][C:\Program Files\Tencent\QQ\QQ.exe]  [TENCENT, 0, 0, 0, 0]
    [C:\Program Files\Tencent\QQ\QQBaseClassInDll.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\QQHelperDll.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\BasicCtrlDll.dll]  [Tencent, 5, 0, 200, 160]
    [C:\Program Files\Tencent\QQ\QQAPI.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\LoginCtrl.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\npkcntc.dll]  [INCA Internet Co., Ltd., 2006, 3, 2, 1]
    [C:\Program Files\Tencent\QQ\npkpdb.dll]  [INCA Internet Co., Ltd., 2003, 10, 1, 1]
    [D:\KAV2007\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [D:\KAV2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 9, 7, 132]
    [C:\Program Files\Tencent\QQ\QQRes.dll]  [tencent, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\QQMainFrame.dll]  [N/A, N/A]
    [C:\Program Files\Tencent\QQ\CQQApplication.dll]  [N/A, N/A]
    [C:\Program Files\Tencent\QQ\NewSkin.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\HostingMgr.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\CameraDll.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\MailSummary.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\QQSpace.dll]  [, 1, 0, 0, 1]
    [C:\WINDOWS\system32\msdmo.dll]  [N/A, N/A]
    [C:\Program Files\Tencent\QQ\QQGroupMng.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\GroupLive.dll]  [N/A, N/A]
    [C:\Program Files\Tencent\QQ\UserDefinedHead.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\QQPlugin.dll]  [N/A, N/A]
    [C:\Program Files\Tencent\QQ\QQAllInOne.dll]  [N/A, N/A]
    [C:\Program Files\Tencent\QQ\SCCore.dll]  [N/A, N/A]
    [C:\Program Files\Tencent\QQ\QQCustomFace.dll]  [N/A, N/A]
    [C:\Program Files\Tencent\QQ\QQPet.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\QQConfigPlugin.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\QRingMng.dll]  [N/A, N/A]
    [C:\Program Files\Tencent\QQ\PhoneAPI.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\DialerAllinOne.dll]  [tencent, 1, 4, 0, 0]
    [C:\Program Files\Tencent\QQ\QQSysMsgMng.dll]  [N/A, N/A]
    [C:\Program Files\Tencent\QQ\QQAvatar.dll]  [N/A, N/A]
    [C:\Program Files\Tencent\QQ\FlashAvatarDll.dll]  [, 1, 4, 0, 1]
    [C:\Program Files\Tencent\QQ\LongConnection.dll]  [tencent, 5, 0, 200, 160]
    [C:\Program Files\Tencent\QQ\BQQApplication.dll]  [N/A, N/A]
    [C:\Program Files\Tencent\QQ\QQSettingCtrl.dll]  [, 1, 0, 0, 1]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx]  [Adobe Systems, Inc., 9,0,16,0]
    [C:\Program Files\Tencent\QQ\QQMagicFace.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\QQSceneMng.dll]  [N/A, N/A]
    [C:\Program Files\Tencent\QQ\CommercesMng.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\QQ\PersonalDesktop.dll]  [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2]
    [C:\Program Files\Tencent\QQ\QQUdpGetFileLib.dll]  [tencent, 0, 2, 2, 3]
    [C:\Program Files\Tencent\QQ\QQAddr.dll]  [深圳市腾讯计算机系统有限公司, 5, 0, 101, 200]
    [C:\Program Files\Tencent\QQ\ImageOle.dll]  [TODO: <Company name>, 1.0.0.1]
    [C:\Program Files\Tencent\QQ\GroupConnection.dll]  [Tencent, 5, 0, 202, 170]
    [C:\Program Files\Tencent\QQ\QQZip.dll]  [tencent, 0, 3, 2, 4]
    [C:\Program Files\Tencent\QQ\QQPhoneHelper.dll]  [腾讯科技（深圳）有限公司, 2, 0, 6, 60]
    [C:\Herosoft\HeroV8\VCvtShell.dll]  [herosoft, 1, 0, 0, 1]

[PID: 2028][C:\Program Files\Zcom\ZComService.exe]  [智通无限, 3.5.0.1]
    [D:\KAV2007\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [D:\KAV2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 9, 7, 132]
    [C:\Herosoft\HeroV8\VCvtShell.dll]  [herosoft, 1, 0, 0, 1]
[PID: 220][d:\KAV2007\KPfwSvc.EXE]  [Kingsoft Corporation, 2005, 9, 5, 28]
    [C:\Program Files\Zcom\skin.dll]  [http://www.zcom.com/, 1.0.0.1]
    [D:\KAV2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 9, 7, 132]
    [D:\KAV2007\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [C:\Herosoft\HeroV8\VCvtShell.dll]  [herosoft, 1, 0, 0, 1]
[PID: 428][D:\KAV2007\KMailMon.EXE]  [Kingsoft Corporation, 2006, 9, 7, 918]
    [D:\KAV2007\KAntiSpm.dll]  [Kingsoft Corporation, 2006, 8, 19, 104]
    [D:\KAV2007\KAVIPC2.DLL]  [Kingsoft Corporation, 2004, 12, 28, 20]
    [D:\KAV2007\KAECall2.DLL]  [Kingsoft Corporation, 2004, 12, 28, 7]
    [D:\KAV2007\KAEPlat.DLL]  [Kingsoft Corp., 2006, 5, 30, 59]
    [D:\KAV2007\KAEMem.DAT]  [Kingsoft, 2006, 5, 17, 14]
    [D:\KAV2007\KAEUnpack.DAT]  [Kingsoft Corp., 2006, 7, 27, 59]
    [D:\KAV2007\KAConfig.DLL]  [Kingsoft Corporation, 2006, 8, 23, 38]
    [D:\KAV2007\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [D:\KAV2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 9, 7, 132]
    [C:\Herosoft\HeroV8\VCvtShell.dll]  [herosoft, 1, 0, 0, 1]
[PID: 464][C:\WINDOWS\system32\nvsvc32.exe]  [NVIDIA Corporation, 6.14.10.7643]
[PID: 576][C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe]  [Analog Devices, Inc., 3, 2, 6, 0]
[PID: 1392][d:\Program Files\Adobe\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe]  [N/A, N/A]
[PID: 2052][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [D:\KAV2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 9, 7, 132]
    [D:\KAV2007\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx]  [Adobe Systems, Inc., 9,0,16,0]
    [C:\Herosoft\HeroV8\VCvtShell.dll]  [herosoft, 1, 0, 0, 1]
[PID: 3320][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 5992][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [D:\KAV2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 9, 7, 132]
    [D:\KAV2007\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx]  [Adobe Systems, Inc., 9,0,16,0]
    [d:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\PDFShell.dll]  [Adobe Systems, Inc., 7.0.0.0]
    [d:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\PDFShell.CHS]  [Adobe Systems, Inc., 7.0.0.0]
    [C:\Herosoft\HeroV8\VCvtShell.dll]  [herosoft, 1, 0, 0, 1]
[PID: 8100][D:\sreng2\SREng\SREng.exe]  [Smallfrogs Studio, 2.2.6.605]
    [D:\KAV2007\KMailOEBand.dll]  [Kingsoft Corporation, 2006, 9, 7, 132]
    [C:\Herosoft\HeroV8\VCvtShell.dll]  [herosoft, 1, 0, 0, 1]
    [D:\KAV2007\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[E:\]
[AutoRun]
open=sxs.exe
shellexecute=sxs.exe
shell\Auto\command=sxs.exe
[F:\]
[AutoRun]
open=sxs.exe
shellexecute=sxs.exe
shell\Auto\command=sxs.exe

==================================
HOSTS 文件
N/A

==================================

运行(双击)SRENG2，点“启动项目，服务，点“Win32服务应用程序”
勾选“隐藏微软服务”选中病毒服务
Windows Management Update Service
PopWinIe
，选择“删除服务”
点“设置”选择“否”


删除：
C:\WINDOWS\ManagementUpdate.exe
C:\WINDOWS\system32\PopWin.exe

请问:秋日蓝天,感谢
删除：
C:\WINDOWS\ManagementUpdate.exe
C:\WINDOWS\system32\PopWin.exe

要到哪里删?我怎么找不着?
我用搜索搜不着,在winrar里的目录里也找不着...

显示隐藏文件，按路径再找找，一定会有的

修复后，还有异常，再扫描上来