Logfile of HijackThis v1.99.0
Scan saved at 12:17:59, on 2006-6-27
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINXP\System32\smss.exe
D:\WINXP\system32\winlogon.exe
D:\WINXP\system32\services.exe
D:\WINXP\system32\lsass.exe
D:\WINXP\system32\svchost.exe
D:\WINXP\System32\svchost.exe
D:\WINXP\system32\spoolsv.exe
D:\WINXP\Explorer.EXE
D:\WINXP\SOUNDMAN.EXE
D:\WINXP\system32\IEXPLORER.exe
D:\WINXP\system\servicess.exe
D:\WINXP\system32\ctfmon.exe
D:\Program Files\Internet Explorer\iexplore.exe
E:\ghost\IE杀毒\HijackThis\HijackThis\HijackThis.exe
D:\Program Files\Internet Explorer\iexplore.exe

O2 - BHO: wmpdrm - {0E674588-66B7-4E19-9D0E-2053B800F69F} - D:\WINXP\system32\wmpdrm.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - E:\QQ2005新版\QQIEHelper.dll
O2 - BHO: IEHlprObj Class - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - D:\WINXP\system32\IEHelper.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "D:\WINXP\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] D:\WINXP\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] D:\WINXP\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINXP\system32\\NVCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [KAVPersonal50] "D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize
O4 - HKLM\..\Run: [rundll31] D:\WINXP\system32\IEXPLORER.exe
O4 - HKLM\..\Run: [MSService_v1.0] D:\WINXP\system\servicess.exe
O4 - HKLM\..\Run: [MoveSearch] D:\Program Files\HuaCi\huaci\zsearch.exe
O4 - HKLM\..\Run: [spoolsv] D:\WINXP\system32\spoolsv\spoolsv.exe -printer
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINXP\system32\ctfmon.exe
O4 - HKCU\..\Run: [caishowmanage] D:\Program Files\CaiShow Tech\CaiShow\UpdateManager.EXE
O8 - Extra context menu item: 上传到QQ网络硬盘 - E:\ghost\2006去广告版本\pcbt_2006322112045\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - E:\ghost\2006去广告版本\pcbt_2006322112045\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - E:\ghost\2006去广告版本\pcbt_2006322112045\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - E:\ghost\2006去广告版本\pcbt_2006322112045\SendMMS.htm
O8 - Extra context menu item: 用炫彩图铃发送该图片 - D:\Program Files\CaiShow Tech\CaiShow\SendMMS.htm
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - F:\星际争霸\浩方对战平台\GameClient.exe
O9 - Extra button: 网际飞音 - {8E4E4123-AAC7-42CA-AF1B-68CE70B8D385} - E:\MP3\网际飞音\新\Donor\donor.exe
O9 - Extra 'Tools' menuitem: 网际飞音(&D) - {8E4E4123-AAC7-42CA-AF1B-68CE70B8D385} - E:\MP3\网际飞音\新\Donor\donor.exe
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - E:\QQ2005新版\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - E:\QQ2005新版\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - E:\QQ2005新版\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - E:\QQ2005新版\QQIEHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (CEditCtrl Object) - https://img.alipay.com/download/1007/aliedit.cab
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0F7CBA3D-D3AA-4987-8BB5-8A74BA11D61F}: NameServer = 202.96.128.166 202.96.128.86
O17 - HKLM\System\CCS\Services\Tcpip\..\{92510E04-6142-4544-9799-FDEF8DC9C238}: NameServer = 202.96.128.166,202.96.128.143
O17 - HKLM\System\CS1\Services\Tcpip\..\{0F7CBA3D-D3AA-4987-8BB5-8A74BA11D61F}: NameServer = 202.96.128.166 202.96.128.86
O23 - Service: kavsvc - Kaspersky Lab - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe

下载超级兔子。
http://www.pctutu.com/srmsdown.asp
安装好后，打开“超级兔子优化王”“专业卸载,卸载所有提示的垃圾软件，卸载是不要打开任何浏览窗口。卸载不了可以重启后再去卸载。
卸载完后，重启。
请到www.27814939.ys168.com,点“我的软件”下载诺顿进程管理器，终止所有IEXPLORER.exe，D:\WINXP\system\servicess.exe（注意这个进程的目录，不要终止错）的进程
关闭所有浏览窗口以及一些不必要的程序
运行Hijackthis，扫描结束后在下列选项前打上勾，然后选"修复
O4 - HKLM\..\Run: [rundll31] D:\WINXP\system32\IEXPLORER.exe
O4 - HKLM\..\Run: [MSService_v1.0] D:\WINXP\system\servicess.exe
双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示确定更改时，单击“是”，清除“隐藏已知文件类型的扩展名
删除
D:\WINXP\system32\IEXPLORER.exe
D:\WINXP\system\servicess.exe
D:\Program Files\HuaCi
D:\WINXP\system32\spoolsv删除整个文件夹
D:\Program Files\CaiShow Tech
D:\WINXP\system32\wmpdrm.dll
D:\WINXP\system32\IEHelper.dll
修复后
请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。

谢谢了，大侠，我马上去搞。