我电脑老弹出一个叫http://www.game929.com/yhoo.htm的广告网，有时候弹出来自动就关又弹出个其他的网页，这是我的诊断报告，请高手帮忙下
各位高手：
非常感谢您留心我这份系统诊断报告，小菜鸟十万火急等待您的帮助！
该诊断报告由360安全卫士提供 http://www.360safe.com
诊断时间: 2007-01-01  01:58:02
诊断平台: Microsoft Windows XP  Service Pack 2
IE版本: Internet Explorer V6.0.2900.2180 Build:62900.2180
计算机物理内存:1023MB - 当前可用内存:696MB

100 - 未知 - Process: iexplorer.exe [] - c:\windows\system\m\iexplorer.exe
100 - 未知 - Process: runiep.exe [Rising AntiSpyware Monitor] - D:\瑞星卡卡\runiep.exe
100 - 未知 - Process: BitComet.exe [BitComet - a BitTorrent Client] - D:\BT\BitComet.exe
R0 - 未知 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page=http://www.yahoo.com.cn
R0 - 未知 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page=http://www.yahoo.com.cn
O4 - 未知 - HKLM\..\RunOnce: [KKDelay] [RunOnce Application] D:\瑞星卡卡\RunOnce.exe
O8 - 未知 - Extra context menu item: 上传到QQ网络硬盘 - F:\qq\AddToNetDisk.htm
O9 - 未知 - Extra button: 启动迅雷(HKLM) - D:\迅雷\Thunder.exe
O9 - 未知 - Extra button: 访问瑞星网站(HKLM) - http://www.rising.com.cn/?u=RSTB
O9 - 未知 - Extra button: 访问卡卡社区(HKLM) - http://www.ikaka.com/?u=RSTB
O23 - 未知 - Service: AVP [保护计算机远离病毒和间谍软件的威胁。] - D:\卡巴斯基\avp.exe -r - (running)
O23 - 未知 - Service: RestoreService [支持系统恢复功能] - C:\WINDOWS\system32\drivers\restore.dll - (running)
O23 - 未知 - Service: Servicelm9 [Distributed Link Tracking Clientlm9] - c:\windows\system\m\iexplorer.exe - (running)
O23 - 未知 - Service: sqlservech [为WindowsNT下的Sql Server提供高效稳定的网络通讯服务。无法终止此服务。] - c:\windows\system32\sqlservech.dll - (running)

=======================================

100 - 安全 - Process: smss.exe [进程为会话管理子系统用以初始化系统变量，ms-dos驱动名称类似lpt1以及com，调用win32壳子系统和运行在windows登陆过程。] - C:\WINDOWS\System32\smss.exe
100 - 安全 - Process: csrss.exe [客户端服务子系统，用以控制windows图形相关子系统。] - C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=base
100 - 安全 - Process: winlogon.exe [windows nt用户登陆程序。] - C:\WINDOWS\system32\winlogon.exe
100 - 安全 - Process: services.exe [用于管理windows服务系统进程。] - C:\WINDOWS\system32\services.exe
100 - 安全 - Process: lsass.exe [本地安全权限服务控制windows安全机制。] - C:\WINDOWS\system32\lsass.exe
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost -k DcomLaunch
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost -k rpcss
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\System32\svchost.exe -k netsvcs
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost.exe -k NetworkService
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost.exe -k LocalService
100 - 安全 - Process: spoolsv.exe [windows打印任务控制程序，用以打印机就绪。] - C:\WINDOWS\system32\spoolsv.exe
100 - 安全 - Process: explorer.exe [windows program manager或者windows explorer用于控制windows图形shell，包括开始菜单、任务栏，桌面和文件管理。] - C:\WINDOWS\Explorer.EXE
100 - 安全 - Process: avp.exe [卡巴斯基杀毒软件相关程序。] -
100 - 安全 - Process: nvsvc32.exe [nvidia driver helper service在nvida显卡驱动中被安装。] - C:\WINDOWS\system32\nvsvc32.exe
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\Svchost.exe -k RestoreService
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\System32\svchost.exe -k sqlservech
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost.exe -k imgsvc
100 - 安全 - Process: wdfmgr.exe [windows media player播放器相关程序。] - C:\WINDOWS\system32\wdfmgr.exe
100 - 安全 - Process: alg.exe [这是一个应用层网关服务用于网络共享。] - C:\WINDOWS\System32\alg.exe
100 - 安全 - Process: VM_STI.EXE [still image (sti) driver驱动程序，一般用于电脑摄像头。] - C:\WINDOWS\VM_STI.EXE
100 - 安全 - Process: realsched.exe [realone播放器安装时附带的升级提醒程序。] - C:\Program Files\Common Files\Real\Update_OB\realsched.exe
100 - 安全 - Process: 360tray.exe [360安全卫士实时保护模块] - D:\360安全卫士\360safe\safemon\360Tray.exe
100 - 安全 - Process: avp.exe [卡巴斯基杀毒软件相关程序。] -
100 - 安全 - Process: ctfmon.exe [office xp输入法图标。] - C:\WINDOWS\system32\ctfmon.exe
100 - 安全 - Process: IEXPLORE.EXE [microsoft internet explorer浏览器用于浏览网页。] - C:\Program Files\Internet Explorer\iexplore.exe
100 - 安全 - Process: 360Safe.exe [360安全卫士] - D:\360安全卫士\360safe\360safe.exe
R1 - 安全 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\system32\blank.htm
R1 - 安全 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\system32\blank.htm
O2 - 安全 - BHO: (NavigatMon Class) - [360safe实时保护功能模块，用于恶意网站拦截。] - {B69F34DD-F0F9-42DC-9EDD-957187DA688D} -
O3 - 安全 - Toolbar: (卡卡上网安全助手) - [卡卡安全助手工具条软件相关程序。] - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll
O4 - 安全 - HKLM\..\Run: [IMJPMIG8.1] [微软Microsoft输入法编辑器程序。] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 安全 - HKLM\..\Run: [PHIME2002ASync] [输入法软件相关程序。] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 安全 - HKLM\..\Run: [PHIME2002A] [输入法软件相关程序。] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 安全 - HKLM\..\Run: [SoundMan] [Realtek声卡相关程序。] SOUNDMAN.EXE
O4 - 安全 - HKLM\..\Run: [NvCplDaemon] [是NVIDIA显示卡相关动态链接库文件。] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - 安全 - HKLM\..\Run: [nwiz] [是NVidia的Nview特性相关程序。该程序用于用户对其特性进行配置，将桌面扩展到多台显示器上。 ] nwiz.exe /install
O4 - 安全 - HKLM\..\Run: [NvMediaCenter] [是NVidia显示卡相关文件。] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - 安全 - HKLM\..\Run: [BigDogPath] [网眼摄像头驱动] C:\WINDOWS\VM_STI.EXE Teclast WE PC Camera
O4 - 安全 - HKLM\..\Run: [TkBellExe] [是Real Networks产品定时升级检测程序。] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - 安全 - HKLM\..\Run: [360Safetray] [360安全卫士监控模块相关程序。] D:\360安全卫士\360safe\safemon\360Tray.exe /start
O4 - 安全 - HKLM\..\Run: [kav] [卡巴斯基杀毒软件相关程序。] "D:\卡巴斯基\avp.exe"
O4 - 安全 - HKLM\..\Run: [runeip] [卡卡上网安全助手相关程序。] D:\瑞星卡卡\runiep.exe
O4 - 安全 - HKCU\..\Run: [ctfmon.exe] [office xp输入法图标。] C:\WINDOWS\system32\ctfmon.exe
O9 - 安全 - Extra button: 卡巴斯基Web反病毒保护插件(HKLM) - D:\卡巴斯基\scieplugin.dll
O9 - 安全 - Extra button: Windows Messenger(HKLM) - C:\Program Files\Messenger\msmsgs.exe
O16 - 安全 - DPF: 无效的CLSID：_{73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (中国工商银行个人银行) - https://mybank.icbc.com.cn/icbc/perbank/AXSafeControls.cab
O16 - 安全 - DPF: 无效的CLSID：_{D27CDB6E-AE6D-11CF-96B8-444553540000} (Flash播放器) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O23 - 安全 - Service: NVSvc [是NVIDIA显示卡相关程序。] - C:\WINDOWS\system32\nvsvc32.exe - (running)

=======================================

O40 - winlogon.exe - Kaspersky Lab - C:\WINDOWS\system32\klogon.dll - Logon Visualizer - 7072750eb5c0f0cd54b48f972855ca61
O40 - Explorer.EXE -  - D:\360安全卫士\360safe\safemon\safemon.dll - 360安全卫士实时保护模块 - 72cb00a125c2ce57aa782c2e9cc70fdf
O40 - Explorer.EXE -  - F:\qq\qdshm.dll - QQDiskShellMenu Module - 6d32435b606707a8b3af3fff39e8a7d6
O40 - Explorer.EXE - Microsoft Corporation - F:\qq\MFC42.DLL - MFCDLL Shared Library - Retail Version - f5eb87f5223e30dcf89816ce655be74c
O40 - Explorer.EXE - Kaspersky Lab - D:\卡巴斯基\shellex.dll - Windows Shell Extension - 62281a8da78c81f4f4695c3de52ba680
O40 - Explorer.EXE - Beijing Rising Technology Co., Ltd. - D:\瑞星卡卡\ieprot.dll - IE Protector - 4a3925ad064764b75a343bce4c2f89aa
O40 - Explorer.EXE - NVIDIA Corporation - C:\WINDOWS\system32\nvcpl.dll - NVIDIA Display Properties Extension -
O40 - Explorer.EXE - NVIDIA Corporation - C:\WINDOWS\system32\NVRSZHC.DLL - NVIDIA Simplified Chinese language resource library - 429ea5d0258c82101557a11ba21cbb2a
O40 - Explorer.EXE - NVIDIA Corporation - C:\WINDOWS\system32\nvshell.dll - NVIDIA Desktop Explorer, Version 61.77  - a1485d56cbb423d136d106f82aa63e27
O40 - Svchost.exe - Microsoft Corporation All rights reserved - c:\windows\system32\drivers\restore.dll - Microsoft? Windows? Operating System - c3929cd61016d797bb97c38bb3070861
O40 - svchost.exe - Microsoft Corporation - c:\windows\system32\sqlservech.dll - Background Intelligent Transfer Services - 20c37a069cabc512718e2861fc6efa9b

=======================================

O41 - bpivszrh - bpivszrh - C:\WINDOWS\system32\drivers\bpivszrh.sys - (running) -  - Yahoo! China Corporation - b6e80103d2ef90706ddfe4aeb0a27a6b
O41 - fvqqbz85 - fvqqbz85 - C:\WINDOWS\system32\drivers\fvqqbz85.sys - (running) -  -  -
O41 - GMSIPCI - GMSIPCI - G:\INSTALL\GMSIPCI.SYS - (not running) -  -  -
O41 - kl1 - Kaspersky Unified Driver - C:\WINDOWS\system32\drivers\kl1.sys - (running) - Kaspersky Unified Driver - Kaspersky Lab - 5445b03cd42dedf5f85b9daf712fdd09
O41 - klif - spuper-ptor - C:\WINDOWS\system32\drivers\klif.sys - (running) - spuper-ptor - Kaspersky Lab - 2985985b39e13643f941b6396fb915dd
O41 - kmsinput - kmsinput - C:\WINDOWS\system32\drivers\kmsinput.sys - (not running) -  -  - f8d6ebcb50c02b42c5ffd5393229c6b6
O41 - KSCDMAN - KingSoft Virtual CDRom Driver - C:\WINDOWS\system32\drivers\kscdman.sys - (running) - KingSoft Virtual CDRom Driver - KingSoft Corp. - 60ded80078811cbe74c7510ef9259c14
O41 - npkcrypt - nProtect KeyCrypt Driver - F:\qq\npkcrypt.sys - (running) - nProtect KeyCrypt Driver - INCA Internet Co., Ltd. - e2ccef92d4acf3de8deb8b3cb08811e2
O41 - ofqbpas - sys 应用程序 - C:\WINDOWS\system32\drivers\ofqbpas.sys - (running) - sys 应用程序 - 北京三七二一科技有限公司 - db584eddf3a0a93768d0eca27954191f
O41 - RsAntiSpyware - RsBoot - C:\WINDOWS\system32\drivers\RsBoot.sys - (not running) - RsBoot - Beijing Rising - 3a6191aea8bed5ceae61d571c9d4c3b9
O41 - TSP - spuper-ptor - C:\WINDOWS\system32\drivers\klif.sys - (not running) - spuper-ptor - Kaspersky Lab - 2985985b39e13643f941b6396fb915dd
O41 - WINIO - WINIO - F:\按键精灵\20051015ajjl\WinIo.sys - (not running) -  -  - 7e5a7cf19504af7ddaf4fa36261940d1
O41 - ZSMC301b - Video streaming and Capture Device Driver - C:\WINDOWS\system32\drivers\usbVM31b.sys - (running) - Video streaming and Capture Device Driver - VM - 2dff656d7d93207a614395edbcd13e5c

=======================================
360Safe.exe=3.0.0.1001
AntiAdwa.dll=2.2.1.1000
AntiEng.dll=3.0.0.1001
AntiActi.dll=2.0.0.3000
CleanHis.dll=3.0.0.1001
safelive.exe=1.0.0.2007
live.dll=1.0.0.1011

=======================================
操作历史报告：
----------查杀恶意软件历史----------

2006-12-31 00:46
查杀恶意软件 - Cnnic中文上网 - 危险 -
查杀恶意软件 - Cnnic无忧上网工具条 - 危险 -
查杀恶意软件 - 中搜地址栏搜索 - 危险 -
查杀恶意软件 - AdvSC32广告插件 - 危险 - C:\WINDOWS\system32\SCIA.dll
查杀恶意软件 - WinSC广告插件 - 危险 - C:\WINDOWS\system32\SCINTR~1.DLL
查杀恶意软件 - DiRVIn - 危险 - C:\WINDOWS\system32\RUNDLL~1.EXE
查杀恶意软件 - 伪系统服务 - 危险 - C:\WINDOWS\system32\NTWORK~1.DLL
查杀恶意软件 - 伪lsass.exe - 危险 - C:\WINDOWS\system32\wbem\lsass.exe
查杀恶意软件 - 实用网址导航(酷站导航) - 危险 - C:\WINDOWS\system32\wbem\ocmor.dll
查杀恶意软件 - Deskipn桌面传媒 - 危险 - C:\PROGRA~1\DESKAD~1\deskipn.dll

2006-12-31 09:10
查杀恶意软件 - 搜狗工具条 - 安全 -
2007-01-01 01:16
查杀恶意软件 - 网络实名 - 危险 - C:\WINDOWS\downlo~1\CnsMin.dll
查杀恶意软件 - 雅虎助手&上网助手 - 危险 - C:\Program Files\Yahoo!\Assistant

2007-01-01 01:18
查杀恶意软件 - 网络实名 - 危险 -
查杀恶意软件 - 雅虎助手&上网助手 - 危险 -

----------插件卸载操作历史----------

2006-12-31 00:47
插件管理 - 实用搜索工具条 -
插件管理 - PCTools - C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\MICROS~1\PCTools\pctools.dll
插件管理 - 迷你PP - C:\WINDOWS\system32\XUNLEI~1.DLL
插件管理 - 搜狗工具条 - C:\PROGRA~1\COMMON~1\CPUSH\cpush0.dll
插件管理 - 腾讯QQ附带的QQIEHelper插件 -
插件管理 - Google工具栏 - C:\PROGRA~1\Google\GOOGLE~1.DLL
2006-12-31 01:22
插件管理 - 搜狗工具条 - C:\PROGRA~1\COMMON~1\CPUSH\cpush0.dll
2006-12-31 15:57
插件管理 - 腾讯QQ附带的QQIEHelper插件 -
2007-01-01 01:21
插件管理 - 迅雷下载组件 -
插件管理 - 腾讯QQ附带的QQIEHelper插件 -

----------全面诊断修复历史----------

2006-12-31 00:46
O4 - 危险 - service - C:\WINDOWS\system32\service.exe
2006-12-31 16:42
O6 - 危险 - 禁止IE首页相关设置 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel
O6 - 危险 - 禁止IE相关功能 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions
2006-12-31 16:53
O6 - 危险 - 禁止IE首页相关设置 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel
O6 - 危险 - 禁止IE相关功能 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions
2007-01-01 01:16
R0 - 危险 - IE自定义搜索引擎 - HKLM\Software\Microsoft\Internet Explorer\Search
R0 - 危险 - IE备用搜索引擎 - HKLM\Software\Microsoft\Internet Explorer\Search

----------修复IE浏览器操作历史----------

2006-12-31 00:49
R0 - 危险 - IE搜索页 - HKCU\Software\Microsoft\Internet Explorer\Main
R0 - 危险 - IE默认搜索页 - HKLM\Software\Microsoft\Internet Explorer\Main
R1 - 危险 - IE左侧搜索页 - HKCU\Software\Microsoft\Internet Explorer\Main
R1 - 危险 - IE备用搜索引擎 - HKCU\Software\Microsoft\Internet Explorer\Search
R1 - 危险 - 启用备用搜索引擎 - HKCU\Software\Microsoft\Internet Explorer\Main

=======================================

用sreng扫描如下
[CODE]

2007-01-01,02:22:50

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Corporation]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Corporation]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Corporation]
    <SoundMan><SOUNDMAN.EXE>  [(Verified)Realtek Semiconductor Corp.]
    <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>  [NVIDIA Corporation]
    <nwiz><nwiz.exe /install>  [NVIDIA Corporation]
    <NvMediaCenter><RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit>  [NVIDIA Corporation]
    <BigDogPath><C:\WINDOWS\VM_STI.EXE Teclast WE PC Camera>  [N/A]
    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
    <fvqqbz85><%systemroot%\system32\Rundll32.exe %systemroot%\system32\fvqqbz85.dll,DllUnregisterServer>  [N/A]
    <360Safetray><D:\360安全卫士\360safe\safemon\360Tray.exe /start>  [奇虎网]
    <kav><"D:\卡巴斯基\avp.exe">  [Kaspersky Lab]
    <runeip><D:\瑞星卡卡\runiep.exe>  [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    <KKDelay><D:\瑞星卡卡\RunOnce.exe>  [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Corporation]
    <UIHost><logonui.exe>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
    <WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll>  [Kaspersky Lab]

==================================
启动文件夹
N/A

==================================
服务
[卡巴斯基反病毒6.0 / AVP][Running/Auto Start]
  <D:\卡巴斯基\avp.exe -r><Kaspersky Lab>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
  <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[RestoreService / RestoreService][Running/Auto Start]
  <C:\WINDOWS\system32\Svchost.exe -k RestoreService-->C:\WINDOWS\system32\drivers\restore.dll><Microsoft Corporation All rights reserved>
[Distributed Link Tracking Clientlm9 / Servicelm9][Running/Auto Start]
  <c:\windows\system\m\iexplorer.exe><>
[SQLServer Supports / sqlservech][Running/Auto Start]
  <C:\WINDOWS\System32\svchost.exe -k sqlservech-->c:\windows\system32\sqlservech.dll><Microsoft Corporation>

==================================
驱动程序
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[bpivszrh / bpivszrh][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\bpivszrh.sys><Yahoo! China Corporation>
[fvqqbz8 / fvqqbz85][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\fvqqbz85.sys><N/A>
[GMSIPCI / GMSIPCI][Stopped/Manual Start]
  <\??\G:\INSTALL\GMSIPCI.SYS><N/A>
[kl1 / kl1][Running/Boot Start]
  <\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif][Running/System Start]
  <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[kmsinput / kmsinput][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\drivers\kmsinput.sys><N/A>
[KSCDMAN / KSCDMAN][Running/Auto Start]
  <system32\drivers\kscdman.sys><KingSoft Corp.>
[npkcrypt / npkcrypt][Running/Auto Start]
  <\??\F:\qq\npkcrypt.sys><INCA Internet Co., Ltd.>
[nv / nv][Running/Manual Start]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[ofqbpas / ofqbpas][Running/Boot Start]
  <\SystemRoot\\SystemRoot\System32\drivers\ofqbpas.sys><N/A>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Stopped/Boot Start]
  <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Running/Auto Start]
  <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
[TSP / TSP][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[WINIO / WINIO][Stopped/Manual Start]
  <\??\F:\按键精灵\20051015ajjl\winio.sys><N/A>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
  <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[Teclast WE PC Camera / ZSMC301b][Running/Manual Start]
  <System32\Drivers\usbVM31b.sys><VM>

==================================
浏览器加载项
[NavigatMon Class]
  {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <, N/A>
[启动迅雷]
  {0062C9BD-B349-40DE-91A0-755F37ACD559} <D:\迅雷\Thunder.exe, Thunder Networking Technologies,LTD>
[Web反病毒保护]
  {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <D:\卡巴斯基\scieplugin.dll, Kaspersky Lab>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[访问瑞星网站]
  {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E444} <http://www.rising.com.cn/?u=RSTB, N/A>
[访问卡卡社区]
  {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E445} <http://www.ikaka.com/?u=RSTB, N/A>
[卡卡上网安全助手]
  {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[HTML Document]
  {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\Mshtml.dll, N/A>
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[卡卡上网安全助手]
  {AFF6E516-CBE5-4F8A-9C2F-38A68013E766} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[SearchAssistantOC]
  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[NavigatMon Class]
  {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <, N/A>
[RDS.DataSpace]
  {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[卡卡上网安全助手]
  {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[上传到QQ网络硬盘]
  <F:\qq\AddToNetDisk.htm, N/A>

==================================
正在运行的进程
[PID: 500][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 568][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 592][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\klogon.dll]  [Kaspersky Lab, 6.0.0.299]
[PID: 636][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 648][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 812][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 860][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 928][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1000][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1072][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1240][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[PID: 1512][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [D:\360安全卫士\360safe\safemon\safemon.dll]  [N/A, 1, 0, 0, 1001]
    [F:\qq\qdshm.dll]  [, 1, 0, 1, 2]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, N/A]
    [D:\卡巴斯基\shellex.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\瑞星卡卡\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
    [C:\WINDOWS\system32\nvcpl.dll]  [NVIDIA Corporation, 6.14.10.6177]
    [C:\WINDOWS\system32\NVRSZHC.DLL]  [NVIDIA Corporation, 6.14.10.6177]
    [C:\WINDOWS\system32\nvshell.dll]  [NVIDIA Corporation, 6.14.10.6177]
[PID: 1664][C:\WINDOWS\system32\nvsvc32.exe]  [NVIDIA Corporation, 6.14.10.6177]
[PID: 1712][C:\WINDOWS\system32\Svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [c:\windows\system32\drivers\restore.dll]  [Microsoft Corporation All rights reserved, 1, 0, 0, 1]
[PID: 1772][c:\windows\system\m\iexplorer.exe]  [, 1.0.0.0]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
[PID: 1860][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1880][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1900][C:\WINDOWS\system32\wdfmgr.exe]  [Microsoft Corporation, 5.2.3790.1230 built by: DNSRV(bld4act)]
[PID: 552][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2020][C:\WINDOWS\VM_STI.EXE]  [BIGDOG, 4, 2, 610, 4]
    [C:\WINDOWS\system32\msdmo.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\VM31bPrp.Ax]  [Vimicro, 1.00.01.00]
    [D:\瑞星卡卡\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[PID: 1876][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3512]
    [D:\瑞星卡卡\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
    [D:\360安全卫士\360safe\safemon\safemon.dll]  [N/A, 1, 0, 0, 1001]
[PID: 716][D:\360安全卫士\360safe\safemon\360Tray.exe]  [奇虎网, 1, 0, 0, 1001]
    [D:\360安全卫士\360safe\safemon\safemon.dll]  [N/A, 1, 0, 0, 1001]
    [D:\360安全卫士\360safe\safemon\SafeKrnl.dll]  [奇虎网, 1, 0, 0, 1001]
    [D:\360安全卫士\360safe\AntiAdwa.dll]  [360Safe.com, 2, 2, 1, 1000]
    [D:\瑞星卡卡\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[PID: 292][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [D:\瑞星卡卡\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
    [D:\360安全卫士\360safe\safemon\safemon.dll]  [N/A, 1, 0, 0, 1001]
[PID: 2332][D:\瑞星卡卡\runiep.exe]  [Beijing Rising Technology Co., Ltd., 1, 0, 1, 3]
    [D:\瑞星卡卡\iep_ctrl.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]
    [D:\瑞星卡卡\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
    [D:\360安全卫士\360safe\safemon\safemon.dll]  [N/A, 1, 0, 0, 1001]
[PID: 2412][D:\BT\BitComet.exe]  [www.BitComet.com, 0.63.]
    [D:\360安全卫士\360safe\safemon\safemon.dll]  [N/A, 1, 0, 0, 1001]
    [D:\瑞星卡卡\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[PID: 3556][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [D:\360安全卫士\360safe\safemon\safemon.dll]  [N/A, 1, 0, 0, 1001]
    [C:\WINDOWS\system32\kakatool.dll]  [Beijing Rising Technology Co., Ltd., 2, 0, 2, 6]
    [D:\瑞星卡卡\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
[PID: 4056][D:\注册表扫描\SREng.EXE]  [Smallfrogs Studio, 2.3.13.690]
    [D:\360安全卫士\360safe\safemon\safemon.dll]  [N/A, 1, 0, 0, 1001]
    [D:\瑞星卡卡\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
N/A

==================================
API HOOK
警告！System Repair Engineer 提醒
你下面的函数内容与预期值不符，他
们可能被一些恶意的软件所修改：
RVA  错误： LoadLibraryA
RVA  错误： LoadLibraryExA
RVA  错误： LoadLibraryExW
RVA  错误： LoadLibraryW
入口点错误：CreateProcessA
入口点错误：CreateProcessW

==================================


[/CODE]

稍微看了下
用SREng操作
<fvqqbz85><%systemroot%\system32\Rundll32.exe %systemroot%\system32\fvqqbz85.dll,DllUnregisterServer> [N/A]

[Distributed Link Tracking Clientlm9 / Servicelm9][Running/Auto Start]
<c:\windows\system\m\iexplorer.exe><>

[SQLServer Supports / sqlservech][Running/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k sqlservech-->c:\windows\system32\sqlservech.dll><Microsoft Corporation>

删除c:\windows\system32\sqlservech.dll，c:\windows\system\m\iexplorer.exe，c:\windows\\system32\fvqqbz85.dll