我的电脑自从插过一个优盘后，就出现只要一运行任何一个程序，就会弹出如下图示，还有无法关机，关机时总是重启，然后还会弹出如图所示的类似窗口！请各位救救我吧！我已经用毒霸杀过没有发现病毒，是4月6号的病毒库！

下载 System Repair Engineer，
http://www.kztechs.com/sreng/download.html
1 解压缩sreng2.zip
2 运行SREng.exe
3 智能扫描=》扫描=》保存报告
4 把日志中的报告完整拷贝贴上来，不要修改

明天才能贴上来，顶一下，看大家还有什么高招！

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><ctfmon.exe>  [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
    <run><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <internat.exe><internat.exe>  [(Verified)Microsoft Windows 2000 Publisher]
    <Media Services><; C:\Program Files\Windows Media Player\wmplayer.exe.exe>  [N/A]
    <KAVRUN><C:\KAV6\KAVRUN.EXE>  [kingsoft]
    <Super Rabbit Desktop Set><; C:\Program Files\Super Rabbit\MagicSet\DS.EXE /Load>  [Super Rabbit Software]
    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
    <Super Rabbit SafeEdit><; C:\Program Files\Super Rabbit\MagicSet\SRFC.EXE /Load>  [Super Rabbit Soft]
    <Synchronization Manager><mobsync.exe /logon>  [(Verified)Microsoft Windows 2000 Publisher]
    <psojva><; C:\WINNT\system32\dsbjrn.exe>  [N/A]
    <SKYNET Personal FireWall><C:\Program Files\SkyNet\FireWall\PFWmain.exe>  [sky.net.cn]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows 2000 Publisher]
    <Userinit><C:\WINNT\system32\userinit.exe,>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{AEB6717E-7E19-11d0-97EE-00C04FD91972}><shell32.dll>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    <Network.ConnectionTray><C:\WINNT\system32\NETSHELL.dll>  [(Verified)Microsoft Windows 2000 Publisher]
    <WebCheck><>  [N/A]
    <SysTray><stobject.dll>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
    <WinlogonNotify: crypt32chain><crypt32.dll>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
    <WinlogonNotify: cryptnet><cryptnet.dll>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
    <WinlogonNotify: cscdll><cscdll.dll>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
    <WinlogonNotify: sclgntfy><sclgntfy.dll>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
    <WinlogonNotify: SensLogn><WlNotify.dll>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
    <WinlogonNotify: wzcnotif><wzcdlg.dll>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
    <{438755C2-A8BA-11D1-B96B-00A0C90312E1}><%SystemRoot%\system32\browseui.dll>  [(Verified)Microsoft Windows Component Publisher]
    <{8C7461EF-2B13-11d2-BE35-3078302C2030}><%SystemRoot%\system32\browseui.dll>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
    <Windows Media Player><C:\WINNT\inf\unregmp2.exe /ShowWMP>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6A5110B5-E14B-4268-A065-EF89FF33C325}]
    <EnableRevocation><regsvr32.exe /s /n /i:"S 2 true 3 true 4 true 5 true 6 true 7 true" initpki.dll>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
    <Windows 桌面更新><regsvr32.exe /s /n /i:U shell32.dll>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
    <Internet Explorer 6><%SystemRoot%\system32\ie4uinit.exe>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_CURRENT_USER\Control Panel\Desktop]
    <SCRNSAVE.EXE><C:\WINNT\system32\ssflwbox.scr>  [(Verified)Microsoft Windows 2000 Publisher]

启动文件夹
[Microsoft Office]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Microsoft Office.lnk --> C:\PROGRA~1\MICROS~2\Office10\OSA.EXE [Microsoft Corporation]><H>

==================================
服务
[Creative Service for CDROM Access / Creative Service for CDROM Access][Stopped/Auto Start]
  <C:\WINNT\System32\CTSvcCDA.exe><Creative Technology Ltd>
[Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[Kingsoft AntiVirus Service / KAVSvc][Stopped/Auto Start]
  <C:\KAV6\KAVSvc.EXE><kingsoft Antivirus>
[Machine Debug Manager / MDM][Stopped/Auto Start]
  <"C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe"><Microsoft Corporation>
[NVIDIA Driver Helper Service / NVSvc][Stopped/Auto Start]
  <C:\WINNT\System32\nvsvc32.exe><NVIDIA Corporation>
[Network Connections Sharing / RpcTftpd][Stopped/Manual Start]
  <C:\WINNT\system32\wins\svchost.exe><Microsoft Corporation>
[U8管理软件 / UFNet][Stopped/Auto Start]
  <C:\WINNT\system32\ServerNT.exe><N/A>
[Windows Management NetWork Service Extensions / Windows Management NetWork Service Extensions][Stopped/Auto Start]
  <NetManager.exe -exe_start><N/A>
[Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start]
  <C:\WINNT\System32\svchost.exe -k netsvcs-->C:\WINNT\System32\mspmsnsv.dll><Microsoft Corporation>

==================================
驱动程序
[Legend DFE-530TX PCI Fast Ethernet Adapter / dlkfet][Stopped/Manual Start]
  <System32\DRIVERS\dlkfet.sys><Fast Ethernet PCI Adapter Manufacturer>
[dmboot / dmboot][Stopped/Disabled]
  <System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[Creative SB AudioPCI Audio Driver (WDM) / ev19x8mp][Stopped/Manual Start]
  <system32\drivers\ev19x8mp.sys><Creative Technology Ltd.>
[KNetWch / KNetWch][Stopped/System Start]
  <\??\C:\KAV6\KNetWch.SYS><金山电脑公司>
[KWATCH / KWATCH][Stopped/Manual Start]
  <\??\C:\WINNT\system32\drivers\KWatch.Sys><Kingsoft Corporation>
[KWatch2 / KWatch2][Stopped/Manual Start]
  <\??\C:\WINNT\system32\drivers\KWatch2.sys><Kingsoft Antivirus>
[nv / nv][Stopped/Manual Start]
  <System32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[PCANDIS5 Protocol Driver / PCANDIS5][Stopped/Manual Start]
  <\??\C:\WINNT\system32\PCANDIS5.SYS><Printing Communications Assoc., Inc. (PCAUSA)>
[Padus ASPI Shell / pfc][Running/Manual Start]
  <system32\drivers\pfc.sys><Padus, Inc.>
[PfModNT / PfModNT][Stopped/Auto Start]
  <\??\C:\WINNT\System32\PfModNT.sys><Creative Technology Ltd.>
[Direct Parallel Link Driver / Ptilink][Stopped/Manual Start]
  <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Sentinel / Sentinel][Stopped/Auto Start]
  <\SystemRoot\System32\Drivers\SENTINEL.SYS><>
[SKNFW / SKNFW][Stopped/System Start]
  <\??\C:\WINNT\System32\Drivers\SKNFW.sys><N/A>
[Sony Memory Stick Driver(SONYPVM1) / SONYPVM1][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\SONYPVM1.SYS><Sony Corporation>
[Sony USB Filter Driver (SONYPVU1) / SONYPVU1][Stopped/Manual Start]
  <system32\DRIVERS\SONYPVU1.SYS><Sony Corporation>
[Superk53 / Superk53][Stopped/Auto Start]
  <\SystemRoot\System32\drivers\superk53.sys><Microsoft Corporation>
[VNN VNC Virtual Network Adapter / vnndev][Stopped/Manual Start]
  <system32\DRIVERS\vnnvnic.sys><VNN B.J.>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
  <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>

==================================
浏览器加载项
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[FlashGet Bar]
  {E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[金山毒霸]
  {A9BE2902-C447-420A-BB7F-A5DE921E6138} <C:\KAV6\KAIEPlus.DLL, >
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[V3PROXL Control]
  {733652F9-53EF-4BF1-B391-375980675D6F} <C:\WINNT\DOWNLO~1\v3proxl.ocx, Ahnlab, Inc.>
[IEDown Class]
  {99888952-AC62-437C-AFC6-7B5CF05A7F2F} <C:\WINNT\system32\GLIEDown.dll, N/A>
[Update Class]
  {9F1C11AA-197B-4942-BA54-47A8489BB47F} <C:\WINNT\System32\iuctl.dll, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\macromed\flash\Flash.ocx, Macromedia, Inc.>
[CHtmlIp1View Object]
  {D854FC15-D3EA-496A-B2A0-A772A3DE1D09} <C:\WINNT\Downloaded Program Files\Ip1HtmlView.dll, TODO: BTECK>
[使用网际快车下载]
  <C:\Program Files\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
  <C:\Program Files\FlashGet\jc_all.htm, N/A>
[导出到 Microsoft Excel(&x)]
  <res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000, N/A>

正在运行的进程
[PID: 112][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.00.2195.6601]
    [C:\WINNT\system32\ntdll.dll]  [Microsoft Corporation, 5.00.2195.6899]
    [C:\WINNT\System32\sfcfiles.dll]  [Microsoft Corporation, 5.00.2195.6894]
[PID: 140][\??\C:\WINNT\system32\csrss.exe]  [Microsoft Corporation, 5.00.2195.6601]
    [C:\WINNT\system32\ntdll.dll]  [Microsoft Corporation, 5.00.2195.6899]
    [C:\WINNT\system32\CSRSRV.dll]  [Microsoft Corporation, 5.00.2195.6601]
    [C:\WINNT\system32\basesrv.dll]  [Microsoft Corporation, 5.00.2195.6824]
    [C:\WINNT\system32\winsrv.dll]  [Microsoft Corporation, 5.00.2195.6826]
    [C:\WINNT\system32\USER32.dll]  [Microsoft Corporation, 5.00.2195.6897]
    [C:\WINNT\system32\KERNEL32.DLL]  [Microsoft Corporation, 5.00.2195.6897]
    [C:\WINNT\system32\GDI32.DLL]  [Microsoft Corporation, 5.00.2195.6898]
[PID: 160][\??\C:\WINNT\system32\winlogon.exe]  [Microsoft Corporation, 5.00.2195.6898]
    [C:\WINNT\system32\ntdll.dll]  [Microsoft Corporation, 5.00.2195.6899]
    [C:\WINNT\system32\MSVCRT.DLL]  [Microsoft Corporation, 6.10.9844.0]
    [C:\WINNT\system32\KERNEL32.dll]  [Microsoft Corporation, 5.00.2195.6897]
    [C:\WINNT\system32\ADVAPI32.DLL]  [Microsoft Corporation, 5.00.2195.6876]
    [C:\WINNT\system32\RPCRT4.DLL]  [Microsoft Corporation, 5.00.2195.6904]
    [C:\WINNT\system32\GDI32.DLL]  [Microsoft Corporation, 5.00.2195.6898]
    [C:\WINNT\system32\USER32.DLL]  [Microsoft Corporation, 5.00.2195.6897]
    [C:\WINNT\system32\USERENV.DLL]  [Microsoft Corporation, 5.00.2195.6794]
    [C:\WINNT\system32\NDDEAPI.DLL]  [Microsoft Corporation, 5.00.2195.6661]
    [C:\WINNT\system32\SFC.DLL]  [Microsoft Corporation, 5.00.2195.6673]
    [C:\WINNT\system32\sfcfiles.dll]  [Microsoft Corporation, 5.00.2195.6894]
    [C:\WINNT\system32\SECUR32.DLL]  [Microsoft Corporation, 5.00.2195.6695]
    [C:\WINNT\system32\PROFMAP.DLL]  [Microsoft Corporation, 5.00.2195.6610]
    [C:\WINNT\system32\NETAPI32.dll]  [Microsoft Corporation, 5.00.2195.6897]
    [C:\WINNT\system32\NETRAP.DLL]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\SAMLIB.DLL]  [Microsoft Corporation, 5.00.2195.6897]
    [C:\WINNT\system32\WS2_32.DLL]  [Microsoft Corporation, 5.00.2195.6601]
    [C:\WINNT\system32\WS2HELP.DLL]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\WLDAP32.DLL]  [Microsoft Corporation, 5.00.2195.6666]
    [C:\WINNT\system32\DNSAPI.DLL]  [Microsoft Corporation, 5.00.2195.6824]
    [C:\WINNT\system32\WSOCK32.DLL]  [Microsoft Corporation, 5.00.2195.6603]
    [C:\WINNT\system32\IMM32.DLL]  [Microsoft Corporation, 5.00.2195.6655]
    [C:\WINNT\system32\iphlpapi.dll]  [Microsoft Corporation, 5.00.2195.6602]
    [C:\WINNT\system32\ICMP.DLL]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\MPRAPI.DLL]  [Microsoft Corporation, 5.00.2181.1]
    [C:\WINNT\system32\OLE32.DLL]  [Microsoft Corporation, 5.00.2195.6906]
    [C:\WINNT\system32\OLEAUT32.DLL]  [Microsoft Corporation, 2.40.4522]
    [C:\WINNT\system32\ACTIVEDS.DLL]  [Microsoft Corporation, 5.00.2195.6601]
    [C:\WINNT\system32\ADSLDPC.DLL]  [Microsoft Corporation, 5.00.2195.6701]
    [C:\WINNT\system32\RTUTILS.DLL]  [Microsoft Corporation, 5.00.2168.1]
    [C:\WINNT\system32\SETUPAPI.DLL]  [Microsoft Corporation, 5.00.2195.6622]
    [C:\WINNT\system32\RASAPI32.DLL]  [Microsoft Corporation, 5.00.2195.6625]
    [C:\WINNT\system32\RASMAN.DLL]  [Microsoft Corporation, 5.00.2195.6604]
    [C:\WINNT\system32\TAPI32.DLL]  [Microsoft Corporation, 5.00.2195.6664]
    [C:\WINNT\system32\COMCTL32.DLL]  [Microsoft Corporation, 5.81]
    [C:\WINNT\system32\SHLWAPI.DLL]  [Microsoft Corporation, 6.00.2800.1106]
    [C:\WINNT\system32\DHCPCSVC.DLL]  [Microsoft Corporation, 5.00.2195.6685]
    [C:\WINNT\system32\msgina.dll]  [Microsoft Corporation, 5.00.2195.6895]
    [C:\WINNT\system32\SHELL32.DLL]  [Microsoft Corporation, 5.00.3700.6705]
    [C:\WINNT\system32\WINSTA.DLL]  [Microsoft Corporation, 5.00.2195.6701]
    [C:\WINNT\system32\WINMM.dll]  [Microsoft Corporation, 5.00.2161.1]
    [C:\WINNT\system32\cscdll.dll]  [Microsoft Corporation, 5.00.2195.6713]
    [C:\WINNT\system32\WlNotify.dll]  [Microsoft Corporation, 5.00.2195.6706]
    [C:\WINNT\system32\CERTCLI.DLL]  [Microsoft Corporation, 5.00.2195.6619]
    [C:\WINNT\system32\ATL.DLL]  [Microsoft Corporation, 3.00.9435]
    [C:\WINNT\system32\CRYPT32.DLL]  [Microsoft Corporation, 5.131.2195.6824]
    [C:\WINNT\system32\MSASN1.DLL]  [Microsoft Corporation, 5.00.2195.6905]
    [C:\WINNT\system32\WINSCARD.DLL]  [Microsoft Corporation, 5.00.2195.6609]
    [C:\WINNT\system32\WINSPOOL.DRV]  [Microsoft Corporation, 5.00.2195.6659]
    [C:\WINNT\system32\MPR.DLL]  [Microsoft Corporation, 5.00.2195.6824]
    [C:\WINNT\system32\cscui.dll]  [Microsoft Corporation, 5.00.2195.6705]
    [C:\WINNT\system32\wzcdlg.dll]  [Microsoft Corporation, 5.00.2195.6604]
    [C:\WINNT\system32\WZCSAPI.DLL]  [Microsoft Corporation, 5.00.2195.6604]
    [C:\WINNT\system32\CLBCATQ.DLL]  [Microsoft Corporation, 2000.2.3511.0]
[PID: 268][C:\WINNT\Explorer.EXE]  [Microsoft Corporation, 5.00.3700.6690]
    [C:\WINNT\system32\ntdll.dll]  [Microsoft Corporation, 5.00.2195.6899]
    [C:\WINNT\system32\ADVAPI32.DLL]  [Microsoft Corporation, 5.00.2195.6876]
    [C:\WINNT\system32\KERNEL32.DLL]  [Microsoft Corporation, 5.00.2195.6897]
    [C:\WINNT\system32\RPCRT4.DLL]  [Microsoft Corporation, 5.00.2195.6904]
    [C:\WINNT\system32\GDI32.DLL]  [Microsoft Corporation, 5.00.2195.6898]
    [C:\WINNT\system32\USER32.DLL]  [Microsoft Corporation, 5.00.2195.6897]
    [C:\WINNT\system32\SHLWAPI.DLL]  [Microsoft Corporation, 6.00.2800.1106]
    [C:\WINNT\system32\msvcrt.dll]  [Microsoft Corporation, 6.10.9844.0]
    [C:\WINNT\system32\COMCTL32.DLL]  [Microsoft Corporation, 5.81]
    [C:\WINNT\system32\IMM32.DLL]  [Microsoft Corporation, 5.00.2195.6655]
    [C:\WINNT\system32\shim.dll]  [Microsoft Corporation, 5.00.2195.6717]
    [C:\WINNT\AppPatch\AcLayers.DLL]  [Microsoft Corporation, 5.00.2195.6717]
    [C:\WINNT\system32\WS2_32.DLL]  [Microsoft Corporation, 5.00.2195.6601]
    [C:\WINNT\system32\WS2HELP.DLL]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\OLE32.DLL]  [Microsoft Corporation, 5.00.2195.6906]
    [C:\WINNT\system32\SHELL32.dll]  [Microsoft Corporation, 5.00.3700.6705]
    [C:\WINNT\system32\CLBCATQ.DLL]  [Microsoft Corporation, 2000.2.3511.0]
    [C:\WINNT\system32\OLEAUT32.dll]  [Microsoft Corporation, 2.40.4522]
    [C:\WINNT\system32\SHDOCVW.DLL]  [Microsoft Corporation, 6.00.2800.1106]
    [C:\WINNT\system32\browseui.dll]  [Microsoft Corporation, 6.00.2800.1106]
    [C:\WINNT\system32\MPR.DLL]  [Microsoft Corporation, 5.00.2195.6824]
    [C:\WINNT\system32\USERENV.DLL]  [Microsoft Corporation, 5.00.2195.6794]
    [C:\WINNT\system32\ntshrui.dll]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\ATL.DLL]  [Microsoft Corporation, 3.00.9435]
    [C:\WINNT\system32\NETAPI32.DLL]  [Microsoft Corporation, 5.00.2195.6897]
    [C:\WINNT\system32\SECUR32.DLL]  [Microsoft Corporation, 5.00.2195.6695]
    [C:\WINNT\system32\NETRAP.DLL]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\SAMLIB.DLL]  [Microsoft Corporation, 5.00.2195.6897]
    [C:\WINNT\system32\WLDAP32.DLL]  [Microsoft Corporation, 5.00.2195.6666]
    [C:\WINNT\system32\DNSAPI.DLL]  [Microsoft Corporation, 5.00.2195.6824]
    [C:\WINNT\system32\WSOCK32.DLL]  [Microsoft Corporation, 5.00.2195.6603]
    [C:\WINNT\system32\mydocs.dll]  [Microsoft Corporation, 5.00.3502.6601]
    [C:\WINNT\System32\ntlanman.dll]  [Microsoft Corporation, 5.00.2195.6601]
    [C:\WINNT\System32\NETUI0.DLL]  [Microsoft Corporation, 5.00.2195.6601]
    [C:\WINNT\System32\NETUI1.DLL]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\MSI.DLL]  [Microsoft Corporation, 2.0.2600.1183]
    [C:\WINNT\system32\WININET.dll]  [Microsoft Corporation, 6.00.2800.1106]
    [C:\WINNT\system32\CRYPT32.dll]  [Microsoft Corporation, 5.131.2195.6824]
    [C:\WINNT\system32\MSASN1.DLL]  [Microsoft Corporation, 5.00.2195.6905]
    [C:\WINNT\system32\CfgMgr32.dll]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\setupapi.dll]  [Microsoft Corporation, 5.00.2195.6622]
    [C:\Program Files\Microsoft Office\Office10\msohev.dll]  [Microsoft Corporation, 10.0.2609]
    [C:\WINNT\system32\browselc.dll]  [Microsoft Corporation, 6.00.2800.1106]
    [C:\WINNT\system32\urlmon.dll]  [Microsoft Corporation, 6.00.2800.1106]
    [C:\WINNT\system32\VERSION.dll]  [Microsoft Corporation, 5.00.2195.6623]
    [C:\WINNT\system32\LZ32.DLL]  [Microsoft Corporation, 5.00.2195.6611]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
    [C:\WINNT\system32\LINKINFO.DLL]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\cscui.dll]  [Microsoft Corporation, 5.00.2195.6705]
    [C:\WINNT\system32\CSCDLL.DLL]  [Microsoft Corporation, 5.00.2195.6713]
    [C:\KAV6\KAVEXT.DLL]  [Kingsoft Corp., 2002, 5, 24, 6]
    [C:\WINNT\system32\WINMM.dll]  [Microsoft Corporation, 5.00.2161.1]
    [C:\WINNT\system32\MSCTF.dll]  [Microsoft Corporation, 1.00.2409.8 built by: Lab06_N]
[PID: 600][K:\sreng2\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
    [C:\WINNT\system32\ntdll.dll]  [Microsoft Corporation, 5.00.2195.6899]
    [C:\WINNT\system32\kernel32.dll]  [Microsoft Corporation, 5.00.2195.6897]
    [C:\WINNT\system32\USER32.dll]  [Microsoft Corporation, 5.00.2195.6897]
    [C:\WINNT\system32\GDI32.DLL]  [Microsoft Corporation, 5.00.2195.6898]
    [C:\WINNT\system32\comdlg32.dll]  [Microsoft Corporation, 5.00.3700.6693]
    [C:\WINNT\system32\SHLWAPI.DLL]  [Microsoft Corporation, 6.00.2800.1106]
    [C:\WINNT\system32\msvcrt.dll]  [Microsoft Corporation, 6.10.9844.0]
    [C:\WINNT\system32\ADVAPI32.dll]  [Microsoft Corporation, 5.00.2195.6876]
    [C:\WINNT\system32\RPCRT4.DLL]  [Microsoft Corporation, 5.00.2195.6904]
    [C:\WINNT\system32\COMCTL32.DLL]  [Microsoft Corporation, 5.81]
    [C:\WINNT\system32\SHELL32.DLL]  [Microsoft Corporation, 5.00.3700.6705]
    [C:\WINNT\system32\WINSPOOL.DRV]  [Microsoft Corporation, 5.00.2195.6659]
    [C:\WINNT\system32\MPR.DLL]  [Microsoft Corporation, 5.00.2195.6824]
    [C:\WINNT\system32\oledlg.dll]  [Microsoft Corporation, 1.0]
    [C:\WINNT\system32\OLE32.DLL]  [Microsoft Corporation, 5.00.2195.6906]
    [C:\WINNT\system32\OLEAUT32.dll]  [Microsoft Corporation, 2.40.4522]
    [C:\WINNT\system32\VERSION.dll]  [Microsoft Corporation, 5.00.2195.6623]
    [C:\WINNT\system32\LZ32.DLL]  [Microsoft Corporation, 5.00.2195.6611]
    [C:\WINNT\system32\CRYPT32.dll]  [Microsoft Corporation,

文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[D:\]
[AutoRun]
open=sxs.exe
shellexecute=sxs.exe
shell\Auto\command=sxs.exe
[E:\]
[AutoRun]
open=sxs.exe
shellexecute=sxs.exe
shell\Auto\command=sxs.exe
[F:\]
[AutoRun]
open=sxs.exe
shellexecute=sxs.exe
shell\Auto\command=sxs.exe

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
API HOOK
RVA  错误： NtQueryInformationFile (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x2AE6B3E7)
RVA  错误： NtQuerySystemInformation (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x2AE6CA87)
RVA  错误： ZwQueryInformationFile (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x2AE6B3E7)
RVA  错误： RegEnumValueA (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x2AE6C490)
RVA  错误： RegEnumValueW (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x2AE6C4ED)
RegDeleteKeyA (危险等级: ,  被下面模块所HOOK: )
RegDeleteKeyW (危险等级: ,  被下面模块所HOOK: )
RegDeleteValueA (危险等级: ,  被下面模块所HOOK: )
RegDeleteValueW (危险等级: ,  被下面模块所HOOK: )
RVA  错误： FindFirstFileA (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x2AE6E3CF)
RVA  错误： FindFirstFileExA (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x2AE6A806)
RVA  错误： FindFirstFileExW (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x2AE6AA23)
RVA  错误： FindFirstFileW (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x2AE693AD)
RVA  错误： FindNextFileA (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x2AE6BD9A)
RVA  错误： FindNextFileW (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x2AE6B4A1)
RVA  错误： LoadLibraryA (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0x2AE66B20)
RVA  错误： LoadLibraryExA (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0x2AE66C0E)
RVA  错误： LoadLibraryExW (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0x2AE66D36)
RVA  错误： LoadLibraryW (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0x2AE67113)
RVA  错误： Process32First (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x2AE6B4A1)
RVA  错误： Process32FirstW (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x2AE6CF58)
RVA  错误： Process32Next (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x2AE69D1B)
Process32NextW (危险等级: ,  被下面模块所HOOK: )
RVA  错误： Module32First (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x2AE6B581)
RVA  错误： Module32FirstW (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x2AE69917)
Module32Next (危险等级: ,  被下面模块所HOOK: )
RVA  错误： Module32NextW (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x2AE6B00A)
RVA  错误： MoveFileExA (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x2AE63D36)
RVA  错误： MoveFileExW (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x2AE6B581)
RVA  错误： Thread32First (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x2AE6B8B6)
RVA  错误： Thread32Next (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x2AE6DC19)
RVA  错误： CreateFileA (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x2AE6C99C)
RVA  错误： CreateFileW (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x2AE6CBE0)
RVA  错误： Thread32First (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x2AE6B8B6)
RVA  错误： Thread32Next (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x2AE6DC19)
CreateProcessA (危险等级: ,  被下面模块所HOOK: )
RVA  错误： CreateProcessW (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0x2AE65E0B)
RVA  错误： FreeLibrary (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0x2AE63109)
RVA  错误： GetFileAttributesA (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0x2AE6ABFE)
RVA  错误： GetFileAttributesExA (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0x2AE69888)
RVA  错误： GetFileAttributesExW (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0x2AE6A5CB)
GetFileAttributesW (危险等级: ,  被下面模块所HOOK: )
RVA  错误： GetProcAddress (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x2AE6571C)
RVA  错误： OpenProcess (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x2AE64E30)

==================================
隐藏进程
N/A

今天我的电脑几乎瘫痪，已经无法使用OFFICE，输入法也用不成，只能用英语！

自己顶

首先断网，卸载杀毒软件。
————————————————
在安全模式下，尽量备份注册表和下面提到的对应文件。
————————————————————————
用冰刃（1.2版本的）禁止进程创建，用冰刃删除C、D、E、F、各盘根目录下的和下面同名文件：

Autorun.inf
sxs.exe
————————————————————————
可能的话继续用冰刃删除下面的注册表项和对应文件，

如果用冰刃不好查找注册表，就取消冰刃的禁止进程创建，用SRENG删除注册表项，用冰刃删除对应文件。

启动项目
注册表

<Media Services><; C:\Program Files\Windows Media Player\wmplayer.exe.exe> [N/A]
<Super Rabbit Desktop Set><; C:\Program Files\Super Rabbit\MagicSet\DS.EXE /Load> [Super Rabbit Software]

<Super Rabbit SafeEdit><; C:\Program Files\Super Rabbit\MagicSet\SRFC.EXE /Load> [Super Rabbit Soft]
<Synchronization Manager><mobsync.exe /logon> [(Verified)Microsoft Windows 2000 Publisher]
<psojva><; C:\WINNT\system32\dsbjrn.exe> [N/A]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6A5110B5-E14B-4268-A065-EF89FF33C325}]
<EnableRevocation><regsvr32.exe /s /n /i:"S 2 true 3 true 4 true 5 true 6 true 7 true" initpki.dll> [(Verified)Microsoft Windows 2000 Publisher]

服务

[Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start]
<C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>

[Network Connections Sharing / RpcTftpd][Stopped/Manual Start]
<C:\WINNT\system32\wins\svchost.exe><Microsoft Corporation>

[Windows Management NetWork Service Extensions / Windows Management NetWork Service Extensions][Stopped/Auto Start]
<NetManager.exe -exe_start><N/A>

浏览器加载项
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>

[V3PROXL Control]
{733652F9-53EF-4BF1-B391-375980675D6F} <C:\WINNT\DOWNLO~1\v3proxl.ocx, Ahnlab, Inc.>
[IEDown Class]
{99888952-AC62-437C-AFC6-7B5CF05A7F2F} <C:\WINNT\system32\GLIEDown.dll, N/A>
[Update Class]
{9F1C11AA-197B-4942-BA54-47A8489BB47F} <C:\WINNT\System32\iuctl.dll, Microsoft Corporation>

[CHtmlIp1View Object]
{D854FC15-D3EA-496A-B2A0-A772A3DE1D09} <C:\WINNT\Downloaded Program Files\Ip1HtmlView.dll, TODO: BTECK>
——————————————————————————————————
重启后再见以上文件，用冰刃或unlocker删除文件。
可能很多文件已感染，重启后不要打开任何文件，安装杀毒软件，升级到最新病毒库，全盘杀毒。碰运气吧。