nzoafo71.dll
win2000server系统，C盘NTFS格式，注册表RUN分支下有nzoafo71=%systemroot%\system32\Rundll32.exe %systemroot%\system32\nzoafo71.dll,DllUnregisterServer
安全模式下也无法删除.
我也不知道如何在DOS下删除NTFS格式目录下文件
注册表中搜索nzoafo71.dll 并删除．重起后又自动增加
无法删除，请高手帮助。
2006-12-20,11:36:53
System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)
Windows 2000 Server Service Pack 4 (Build 2195)
- 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><ctfmon.exe> [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
<run><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<vptray><C:\PROGRA~1\SAV\vptray.exe> [Symantec Corporation]
<Super Rabbit Desktop Set><C:\Program Files\Super Rabbit\MagicSet\DS.EXE /Load> [Super Rabbit Software]
<NvCplDaemon><RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup> [NVIDIA Corporation]
<nzoafo71><%systemroot%\system32\Rundll32.exe %systemroot%\system32\nzoafo71.dll,DllUnregisterServer> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINNT\system32\userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
<WinlogonNotify: NavLogon><C:\WINNT\system32\\NavLogon.dll> [N/A]
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><(无)> [N/A]
==================================
启动文件夹
N/A
==================================
服务
[ASP.NET State Service / aspnet_state]
<C:\WINNT\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe><Microsoft Corporation>
[DefWatch / DefWatch]
<"C:\Program Files\SAV\DefWatch.exe"><Symantec Corporation>
[Logical Disk Manager Administrative Service / dmadmin]
<C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[Intel PDS / Intel PDS]
<C:\WINNT\system32\cba\pds.exe><Intel? Corporation>
[Machine Debug Manager / MDM]
<"C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe"><Microsoft Corporation>
[Symantec AntiVirus Server / Norton AntiVirus Server]
<"C:\Program Files\SAV\Rtvscan.exe"><Symantec Corporation>
[NVIDIA Display Driver Service / NVSvc]
<C:\WINNT\system32\nvsvc32.exe><NVIDIA Corporation>
[ServiceLayer / ServiceLayer]
<"C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe"><Nokia.>
[Smart Nets / Smart Nets]
<><N/A>
==================================
驱动程序
[agaieiaf / agaieiaf]
<\SystemRoot\system32\drivers\agaieiaf.sys><N/A>
[dmboot / dmboot]
<System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio]
<\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload]
<\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[VK USB Driver / ISP68X]
<System32\Drivers\ISP68X.sys><Winbond Electronics Crop.>
[NAVAP / NAVAP]
<\??\C:\Program Files\SAV\NAVAP.sys><Symantec Corporation>
[NAVAPEL / NAVAPEL]
<\??\C:\Program Files\SAV\NAVAPEL.SYS><Symantec Corporation>
[NAVENG / NAVENG]
<\??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20061213.022\NAVENG.sys><Symantec Corporation>
[NAVEX15 / NAVEX15]
<\??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20061213.022\NAVEX15.sys><Symantec Corporation>
[Nokia USB Generic / Nokia USB Generic]
<system32\drivers\nmwcdc.sys><Nokia>
[Nokia USB Modem / Nokia USB Modem]
<system32\drivers\nmwcdcm.sys><Nokia>
[Nokia USB Phone Parent / Nokia USB Phone Parent]
<system32\drivers\nmwcd.sys><Nokia>
[Nokia USB Port / Nokia USB Port]
<system32\drivers\nmwcdcj.sys><Nokia>
[npkcrypt / npkcrypt]
<\??\C:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[nv / nv]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[nzoafo7 / nzoafo71]
<\SystemRoot\System32\DRIVERS\nzoafo71.sys><N/A>
[Create Tech Dual Mode USB Camera Plus / OVT511Plus]
<System32\Drivers\omcamvid.sys><OmniVision Technologies, Inc.>
[PfModNT / PfModNT]
<\??\C:\WINNT\system32\PfModNT.sys><Creative Technology Ltd.>
[Direct Parallel Link Driver / Ptilink]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8029(AS)-based PCI Ethernet Adapter NT Driver / rtl8029]
<system32\DRIVERS\RTL8029.SYS><REALTEK Semiconductor Corp.>
[SB PCI Family Audio Driver (WDM) / sbpci]
<system32\drivers\sbpci.sys><Creative Technology Ltd.>
[SymEvent / SymEvent]
<\??\C:\Program Files\Symantec\SYMEVENT.SYS><Symantec Corporation>
==================================
浏览器加载项
[百度首页]
{02496EBD-8455-48db-B3C7-5DAC97D9F5A7} <http://baidu.com/index.php?tn=winstonzh_dg, N/A>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <, N/A>
[@msdxmLC.dll,-1@2052,电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FlashGet\fgiebar.dll, Amaze Soft>
[实用搜索工具条2.0]
{03465FF5-00AE-411a-9C34-960ED566EC03} <C:\Program Files\superutilbar\superutilbar.dll, www.shiyongsousuo.com>
[Timer
Object]
{59CCB4A0-727D-11CF-AC36-00AA00A47DD2} <C:\WINNT\Downloaded Program Files\ietimer.ocx, Microsoft Corporation>
[BoBo P2P多媒体网络点播/广播/直播系统 V3]
{EC0978ED-24E3-403C-AB7A-060E388553E6} <C:\WINNT\DOWNLO~1\BOBO_A~1.OCX, 广州易播信息科技有限公司>
[上传到QQ网络硬盘]
<C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用网际快车下载]
<C:\Program Files\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<C:\Program Files\FlashGet\jc_all.htm, N/A>
[添加到QQ自定义面板]
<C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>
==================================
正在运行的进程
[PID: 160][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.00.2195.6601]
[PID: 196][\??\C:\WINNT\system32\csrss.exe] [Microsoft Corporation, 5.00.2195.6601]
[PID: 216][\??\C:\WINNT\system32\winlogon.exe] [Microsoft Corporation, 5.00.2195.6997]
[C:\WINNT\system32\NavLogon.dll] [N/A, N/A]
[PID: 244][C:\WINNT\system32\services.exe] [Microsoft Corporation, 5.00.2195.7035]
[C:\WINNT\system32\dmserver.dll] [VERITAS Software Corp., 2195.6605.297.3]
[PID: 256][C:\WINNT\system32\lsass.exe] [Microsoft Corporation, 5.00.2195.7011]
[PID: 432][C:\WINNT\system32\svchost.exe] [Microsoft Corporation, 5.00.2134.1]
[PID: 452][C:\WINNT\system32\spoolsv.exe] [Microsoft Corporation, 5.00.2195.7059]
[C:\WINNT\system32\CNMLM2H.DLL] [CANON INC., 1.50.2.6]
[C:\WINNT\system32\spool\PRTPROCS\W32X86\CNMPD2H.DLL] [CANON INC., 1.50.2.6]
[PID: 480][C:\Program Files\SAV\DefWatch.exe] [Symantec Corporation, 8.00.00.9374]
[PID: 496][C:\WINNT\system32\svchost.exe] [Microsoft Corporation, 5.00.2134.1]
[PID: 516][C:\WINNT\system32\cba\pds.exe] [Intel? Corporation, 6.12.0.71 E]
[C:\WINNT\system32\PDS.DLL] [Intel? Corporation, 6.12.0.71 E]
[C:\WINNT\system32\NTS.dll] [Intel? Corporation, 6.12.0.71 E]
[C:\WINNT\system32\loc32vc0.dll] [Intel, 3, 0, 0, 2]
[PID: 560][C:\WINNT\System32\llssrv.exe] [Microsoft Corporation, 5.00.2195.7021]
[PID: 588][C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe] [Microsoft Corporation, 7.00.9064.9150]
[PID: 632][C:\Program Files\SAV\Rtvscan.exe] [Symantec Corporation, 8.00.00.9374]
[C:\WINNT\system32\CBA.DLL] [Intel? Corporation, 6.12.0.71 E]
[C:\WINNT\system32\MsgSys.dll] [Intel? Corporation, 6.12.0.71 E]
[C:\WINNT\system32\NTS.dll] [Intel? Corporation, 6.12.0.71 E]
[C:\WINNT\system32\PDS.DLL] [Intel? Corporation, 6.12.0.71 E]
[C:\Program Files\SAV\NAVLU.dll] [Symantec Corporation, 8.00.00.9374]
[C:\Program Files\SAV\NAVNTUTL.DLL] [Symantec/Peter Norton Group, 1, 0, 0, 1]
[C:\Program Files\SAV\i2ldvp3.dll] [Symantec Corporation, 8.00.00.9374]
[C:\Program Files\SAV\NAVAPI32.DLL] [Symantec Corp., 4.1.0.15]
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20061213.022\NAVEX32a.DLL] [Symantec Corporation, 20061.3.0.12]
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20061213.022\NAVENG32.DLL] [Symantec Corporation, 20061.3.0.12]
[C:\Program Files\SAV\NAVAP32.DLL] [Symantec Corporation, 9.0.0.14]
[PID: 700][C:\WINNT\system32\nvsvc32.exe] [NVIDIA Corporation, 6.14.10.6072]
[PID: 844][C:\WINNT\system32\MSTask.exe] [Microsoft Corporation, 4.71.2195.6972]
[PID: 860][C:\WINNT\system32\stisvc.exe] [Microsoft Corporation, 5.00.2195.6656]
[C:\WINNT\system32\OmCamUSD.dll] [Omnivision Technologies, Inc., 2.2.0.2600]
[PID: 928][C:\WINNT\System32\WBEM\WinMgmt.exe] [Microsoft Corporation, 1.50.1085.0100]
[PID: 952][C:\WINNT\system32\svchost.exe] [Microsoft Corporation, 5.00.2134.1]
[PID: 972][C:\WINNT\system32\Dfssvc.exe] [Microsoft Corporation, 5.00.2195.6664]
[PID: 1000][C:\WINNT\system32\inetsrv\inetinfo.exe] [Microsoft Corporation, 5.00.0984]
[PID: 1020][C:\WINNT\system32\msdtc.exe] [Microsoft Corporation, 1999.9.3421.3]
[PID: 1368][C:\WINNT\Explorer.EXE] [Microsoft Corporation, 5.00.3700.6690]
[PID: 1404][C:\PROGRA~1\SAV\vptray.exe] [Symantec Corporation, 8.00.00.9374]
[C:\Program Files\SAV\Cliproxy.dll] [Symantec Corporation, 8.00.00.9374]
[C:\PROGRA~1\SAV\NAVNTUTL.DLL] [Symantec/Peter Norton Group, 1, 0, 0, 1]
[C:\Program Files\SAV\Cliscan.dll] [Symantec Corporation, 8.00.00.9374]
[PID: 680][C:\Program Files\Super Rabbit\MagicSet\DS.EXE] [Super Rabbit Software, 1.50]
[PID: 1588][C:\WINNT\system32\ctfmon.exe] [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[PID: 1652][C:\WINNT\System32\svchost.exe] [Microsoft Corporation, 5.00.2134.1]
[PID: 1248][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2800.1106]
[C:\Program Files\superutilbar\superutilbar.dll] [www.shiyongsousuo.com, 2, 1, 8, 24]
[C:\WINNT\system32\Macromed\Flash\Flash8.ocx] [Macromedia, Inc., 8,0,22,0]
[PID: 1808][K:\bak\Downloads\sreng2\SREng\SREng.exe] [Smallfrogs Studio, 2.2.6.605]
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINNT\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1 localhost
==================================
