以前曾经发现过recyclecl.exe病毒文件，不过都删了，
注册表也清过相关recyclecl.exe的选项



HijackThis_815汉化版扫描日志 V1.99.1
保存于      15:58:09, 日期 2006-1-18
操作系统：  Windows 2000 SP4 (WinNT 5.00.2195)
浏览器：    Internet Explorer v6.00 (6.00.2600.0000)

当前运行的进程：         
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\hp\hpsmh\data\cgi-bin\vcagent\vcagent.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\llssrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINNT\System32\mnmsrvc.exe
C:\PROGRA~1\MICROS~3\MSSQL\binn\sqlservr.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\snmp.exe
C:\hp\hpsmh\bin\smhstart.exe
C:\VRV\VRVAnyWhere\vrvscr_s.exe
C:\Vrv\Server7\vrvmon.exe
C:\hp\hpsmh\bin\hpsmhd.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\CPQNiMgt\cpqnimgt.exe
C:\WINNT\System32\CpqRcmc.exe
C:\WINNT\System32\CPQMgmt\CqMgServ\cqmgserv.exe
C:\WINNT\System32\CPQMgmt\CqMgStor\cqmgstor.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\system32\inetsrv\inetinfo.exe
C:\WINNT\System32\msdtc.exe
C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe
C:\Vrv\Server7\vrvnet.exe
C:\WINNT\System32\sysdown.exe
C:\WINNT\System32\CPQMgmt\CqMgHost\cqmghost.exe
C:\hp\hpsmh\bin\hpsmhd.exe
C:\WINNT\system32\VrvEisp.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\nsmscrs.exe
C:\WINNT\Explorer.EXE
C:\VRV\VrvAmc\VRVAMC.EXE
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\VRV\VrvAmc\autoload.exe
D:\补丁下载\DownPatch.exe
D:\补丁下载\autoload.exe
C:\WINNT\system32\conime.exe
C:\WINNT\system32\WatchClient.exe
C:\VRV\RegionManage\RegionManage.exe
C:\VRV\RegionManage\autoload.exe
C:\VRV\RegionManage\DownLoadMend.exe
C:\VRV\RegionManage\Usprites.exe
C:\VRV\RegionScan\RegionScan.exe
C:\VRV\RegionScan\autoload.exe
C:\Program Files\NetMeeting\conf.exe
C:\WINNT\system32\internat.exe
C:\Documents and Settings\Administrator\桌面\hijackthis\hijackthis.exe

F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe
O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - 启动项HKLM\\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - 启动项HKLM\\Run: [vrvnet] C:\Vrv\Server7\vrvnet.exe
O4 - 启动项HKLM\\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - 启动项HKLM\\Run: [ATI Radeon Drivers] radeon.exe
O4 - 启动项HKLM\\Run: [Microsoft CSRSS Service] nsmscrs.exe
O4 - 启动项HKLM\\RunServices: [ATI Radeon Drivers] radeon.exe
O4 - 启动项HKLM\\RunServices: [Microsoft CSRSS Service] nsmscrs.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\RuunServices:[Microsoft Task Manager] mstsk.exe
O4 - HKCU\..\RuunServices:[ATI Radeon Drivers] radeon.exe
O4 - HKCU\..\RuunServices:[Microsoft CSRSS Service] nsmscrs.exe
O4 - Global Startup: 北信源病毒集中监控.lnk = C:\VRV\VrvAmc\VRVAMC.EXE
O4 - Global Startup: 服务管理器.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - IE右键菜单中的新增项目: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - 浏览器额外的按钮: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\..\{085359F7-AA09-4C44-8223-9B13F53754C4}: NameServer = 10.137.188.5
O17 - HKLM\System\CCS\Services\Tcpip\..\{38C7D11C-EC6F-4280-9559-02394ED13896}: NameServer = 172.18.0.36,203.93.18.6
O17 - HKLM\System\CS1\Services\Tcpip\..\{085359F7-AA09-4C44-8223-9B13F53754C4}: NameServer = 10.137.188.5
O17 - HKLM\System\CS2\Services\Tcpip\..\{085359F7-AA09-4C44-8223-9B13F53754C4}: NameServer = 10.137.188.5
O18 - 列举现有的协议: hpapp - {24F45006-5BD9-41B7-9BD9-5F8921C8EBD1} - C:\Program Files\Compaq\Cpqacuxe\Bin\hpapp.dll
O23 - NT 服务: HP Insight NIC Agent (CpqNicMgmt) - Hewlett-Packard Company - C:\WINNT\System32\CPQNiMgt\cpqnimgt.exe
O23 - NT 服务: HP ProLiant Remote Monitor Service (CpqRcmc) - Hewlett-Packard Company - C:\WINNT\System32\CpqRcmc.exe
O23 - NT 服务: HP Version Control Agent (cpqvcagent) - Hewlett-Packard Company - C:\hp\hpsmh\data\cgi-bin\vcagent\vcagent.exe
O23 - NT 服务: HP Insight Foundation Agents (CqMgHost) - Hewlett-Packard Company - C:\WINNT\System32\CPQMgmt\CqMgHost\cqmghost.exe
O23 - NT 服务: HP Insight Server Agents (CqMgServ) - Hewlett-Packard Company - C:\WINNT\System32\CPQMgmt\CqMgServ\cqmgserv.exe
O23 - NT 服务: HP Insight Storage Agents (CqMgStor) - Hewlett-Packard Company - C:\WINNT\System32\CPQMgmt\CqMgStor\cqmgstor.exe
O23 - NT 服务: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - NT 服务: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - NT 服务: HP ProLiant System Shutdown Service (sysdown) - Compaq Computer Corporation - C:\WINNT\System32\sysdown.exe
O23 - NT 服务: HP System Management Homepage (SysMgmtHP) - Hewlett-Packard Company - C:\hp\hpsmh/bin/smhstart.exe
O23 - NT 服务: VrvAnywhere Server (vrvanywhere) - Unknown owner - C:\VRV\VRVAnyWhere\vrvscr_s.exe" -service (file missing)
O23 - NT 服务: VrvRegionManage - Unknown owner - C:\VRV\RegionManage\RegionManage.exe" -service (file missing)
O23 - NT 服务: VrvSvrScan - Unknown owner - C:\VRV\RegionScan\RegionScan.exe" -service (file missing)
O23 - NT 服务: vrv Virus Moniter Service (VrvVMS) - Unknown owner - C:\Vrv\Server7\vrvmon.exe" -service (file missing)
O23 - NT 服务: VRVWatchServer - Unknown owner - C:\WINNT\system32\WatchClient.exe" -service (file missing)

重新启动到安全模式（进入安全模式的方法:重新启动电脑, 开机自动检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式(Safe Mode)进入Windows。）

请关闭所有IE界面，重新使用HijackThis扫描一次，选中下面建议修复的项目，让HijackThis修复，修复前请允许HijackThis保留备份。（如果楼主知道是安全的可以不必勾选）
O4 - 启动项HKLM\\Run: [Microsoft CSRSS Service] nsmscrs.exe
O4 - 启动项HKLM\\RunServices: [Microsoft CSRSS Service] nsmscrs.exe
O4 - HKCU\..\RuunServices:[Microsoft CSRSS Service] nsmscrs.exe

然后打开我的电脑→再点工具→打开文件夹选项→查看→把隐藏受保护的系统文件（推荐）和隐藏已知文件类型的扩展名的勾去掉→再显示所有文件→找到以下文件并删除：(如果有的话)

C:\WINNT\system32\nsmscrs.exe