我公司的机器中病毒了,有4个启动文件不正常,上网查了是木马但是没看到什么有效的解决方法,都叫重做系统,但是我的系统不能重做那位高手帮帮忙急哦,还有就是公司的局域网聊天工具竟然上不去了~这是用SREngLOG扫描的结果:
[CODE]

2007-01-04,08:47:12

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195)
- Administrative User - Completed Functions Allowed

Follow item(s) have been choosed:
    All Boot Items (Including Registry, Startup Folders, Services and so on)
    Browser Add-ons
    Runing Processes (Including process model information)
    File Associations
    Winsock Provider
    Autorun.Inf
    HOSTS File


Boot Items
Registry
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <msnmsgr><"C:\Program Files\MSN Messenger\msnmsgr.exe" /background>  [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
    <CnsMin><Rundll32.exe C:\WINNT\downlo~1\CnsMin.dll,Rundll32>  [杒嫗嶰幍擇堦壢媄桳尷岞巌]
    <Synchronization Manager><mobsync.exe /logon>  [(Verified)Microsoft Corporation]
    <zts2><C:\WINNT\TEMP\zts2.exe>  [N/A]
    <mhs2><C:\WINNT\TEMP\mhs2.exe>  [N/A]
    <wlzs><C:\WINNT\TEMP\wlzs.exe>  [N/A]
    <rxzs><C:\WINNT\TEMP\rxzs.exe>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><C:\WINNT\system32\userinit.exe,>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINNT\system32\RavExt.dll>  [Beijing Rising Technology Co., Ltd.]
    <{D157330A-9EF3-49F8-9A67-4141AC41ADD4}><C:\WINNT\downlo~1\CnsHook.dll>  [杒嫗嶰幍擇堦壢媄桳尷岞巌]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cmdmant]
    <WinlogonNotify: cmdmant><msgcom.dll>  [N/A]
[HKEY_CURRENT_USER\Control Panel\Desktop]
    <SCRNSAVE.EXE><C:\WINNT\system32\sstext3d.scr>  [(Verified)Microsoft Corporation]

==================================
Startup Folders
[Outlook Express 偺婲摦]
  <C:\Documents and Settings\tya003\僗僞乕僩 儊僯儏乕\僾儘僌儔儉\僗僞乕僩傾僢僾\Outlook Express 偺婲摦.lnk --> C:\PROGRA~1\OUTLOO~1\msimn.exe [Microsoft Corporation]><N>
[MariMail]
  <C:\Documents and Settings\tya003\僗僞乕僩 儊僯儏乕\僾儘僌儔儉\僗僞乕僩傾僢僾\MariMail.lnk --> E:\03僣乕~1\MMAIL0~1\MariMail.exe [N/A]><N>
[VyChat]
  <C:\Documents and Settings\tya003\僗僞乕僩 儊僯儏乕\僾儘僌儔儉\僗僞乕僩傾僢僾\VyChat.lnk --> C:\PROGRA~1\jyth\VyChat.exe [VyPRESS Research, LLC]><N>
[DelShare]
  <C:\Documents and Settings\tya003\僗僞乕僩 儊僯儏乕\僾儘僌儔儉\僗僞乕僩傾僢僾\DelShare.lnk --> E:\05偦偺~1\tools\宯摑僣~1\DelShare.bat [N/A]><N>

==================================
Services
[ATScher / ATScher][Running/Auto Start]
  <C:\WINNT\system32\fs\Updater\ATScher.exe><N/A>
[Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[InstallDriver Table Manager / IDriverT][Stopped/Manual Start]
  <"C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe"><Macrovision Corporation>
[PFD Service / PFDService][Running/Auto Start]
  <C:\WINNT\system32\pscds_NT.exe><N/A>
[Remote Packet Capture Protocol v.0 (experimental) / rpcapd][Stopped/Manual Start]
  <"C:\Program Files\WinPcap\rpcapd.exe" -d -f "C:\Program Files\WinPcap\rpcapd.ini"><CACE Technologies>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
  <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon][Running/Auto Start]
  <"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]
  <C:\WINNT\system32\rundll32.exe windhcp.ocx,start><Microsoft Corporation>
[WinXP DHCP Service / WinXPDHCPsvc][Stopped/Auto Start]
  <C:\WINNT\system32\rundll32.exe xpdhcp.dll,start><Microsoft Corporation>
[Plus Working Service / PlusService][Stopped/Auto Start]
  <C:\WINNT\system32\plusservices.exe><N/A>

==================================
Drivers
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
  <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[CnsMinKP / CnsMinKP][Running/Boot Start]
  <\SystemRoot\system32\drivers\CnsMinKP.sys><Copyright (C) 3721 Corporation.>
[dmboot / dmboot][Stopped/Disabled]
  <System32\drivers\dmboot.sys><VERITAS Software Corp.>
[榑棟僨傿僗僋 儅僱乕僕儍 僪儔僀僶 / dmio][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[ExpScaner / ExpScaner][Running/Auto Start]
  <\??\C:\Program Files\Rising\Rav\ExpScan.sys><>
[GMSIPCI / GMSIPCI][Stopped/Manual Start]
  <\??\F:\INSTALL\GMSIPCI.SYS><N/A>
[HookCont / HookCont][Running/Auto Start]
  <\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
  <\??\C:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
  <\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising>
[ialm / ialm][Running/Manual Start]
  <System32\DRIVERS\ialmnt5.sys><Intel Corporation>
[kfrang / kfrang][Running/Boot Start]
  <\SystemRoot\\SystemRoot\System32\drivers\kfrang.sys><N/A>
[MEMSCAN / MEMSCAN][Running/Auto Start]
  <\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><悙惎?審桳尷岞巌>
[NetGroup Packet Filter Driver / NPF][Running/Auto Start]
  <system32\drivers\npf.sys><CACE Technologies>
[Psc File Monitor / PscFdv][Running/Boot Start]
  <\SystemRoot\System32\Drivers\PscFdv.sys><WeING Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
  <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
  <\??\C:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[Realtek RTL8139-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
  <System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[dit IPSEC Virtual Adapter / sshvnic][Stopped/Manual Start]
  <system32\DRIVERS\sshvnic5.sys><dit Co., Ltd.>
[TDDI / TDDI][Running/Auto Start]
  <\??\C:\WINNT\system32\drivers\tddi.sys><Microsoft Corporation>
[R2A / R2A][Stopped/Disabled]
  <\??\C:\WINNT\system32a2.sys><N/A>

==================================
Browser Add-ons
[Yahoo! Toolbar Helper]
  {02478D38-C3F9-4EFB-9B51-7695ECA05670} <C:\Program Files\Yahoo!\Companion\yt.dll, Yahoo! JAPAN  Corporation.>
[AcroIEHlprObj Class]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx, >
[CAdLogic Object]
  {11F09AFD-75AD-4E51-AB43-E09E9351CE16} <C:\Program Files\Common Files\CPUSH\cpush1.dll, N/A>
[CnsHook Class]
  {D157330A-9EF3-49F8-9A67-4141AC41ADD4} <C:\WINNT\downlo~1\CnsHook.dll, 杒嫗嶰幍擇堦壢媄桳尷岞巌>
[Flash Assistant]
  {E29F0B13-0D84-45aa-81EC-CC629BC07566} <C:\WINNT\system32\Macromed\Flash\Flasher.dll, N/A>
[Yahoo 1G mail]
  {507F9113-CD77-4866-BA92-0E86DA3D0B97} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail, N/A>
[E bazar]
  {59BC54A2-56B3-44a0-93E5-432D58746E26} <http://adtaobao.allyes.com/main/adfclick?db=adtaobao&bid=138,140,18&cid=816,8,1&sid=5042&show=ignore&url=http://www.taobao.com/vertical/mall/pro.php?allyesPara=816, N/A>
[Yahoo Assistant]
  {5D73EE86-05F1-49ed-B850-E423120EC338} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist, N/A>
[]
  {6354ABE6-05F1-49ed-B850-E423120EC338} <http://cn.widget.yahoo.com/index.htm?source=Cns, N/A>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[Instant Messenger]
  {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg, N/A>
[]
  {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair, N/A>
[]
  {FD00D911-7529-4084-9946-A29F1BDF4FE5} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean, N/A>
[儔僕僆(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\System32\msdxm.ocx, Microsoft Corporation>
[&Yahoo!僣乕儖僶乕]
  {EF99BD32-C1FB-11D2-892F-0090271D4F88} <C:\Program Files\Yahoo!\Companion\yt.dll, Yahoo! JAPAN  Corporation.>

==================================
Running Processes
[PID: 144][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 168][\??\C:\WINNT\system32\csrss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 164][\??\C:\WINNT\system32\winlogon.exe]  [Microsoft Corporation, 5.00.2195.6714]
    [C:\WINNT\system32\msgcom.dll]  [N/A, N/A]
    [C:\WINNT\system32\WSD_SOCK32.dll]  [N/A, N/A]
    [C:\WINNT\system32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.3943]
    [C:\WINNT\system32\hccutils.DLL]  [Intel Corporation, 3.0.0.3943]
[PID: 216][C:\WINNT\system32\services.exe]  [Microsoft Corporation, 5.00.2195.6700]
    [C:\WINNT\system32\dmserver.dll]  [VERITAS Software Corp., 2195.6605.297.3]
    [C:\WINNT\system32\plus.vxd]  [N/A, N/A]
[PID: 228][C:\WINNT\system32\lsass.exe]  [Microsoft Corporation, 5.00.2195.6695]
    [C:\WINNT\system32\WSD_SOCK32.dll]  [N/A, N/A]
[PID: 388][C:\WINNT\system32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
[PID: 416][C:\Program Files\Rising\Rav\CCenter.exe]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
[PID: 476][C:\WINNT\system32\spoolsv.exe]  [Microsoft Corporation, 5.00.2195.6659]
    [C:\WINNT\system32\pstcmon.dll]  [N/A, N/A]
[PID: 624][C:\WINNT\system32\fs\Updater\ATScher.exe]  [N/A, 4, 0, 1, 1101]
    [C:\WINNT\system32\pscliba.dll]  [N/A, 1, 0, 1, 40]
    [C:\WINNT\system32\wpcap.dll]  [CACE Technologies, 3, 1, 0, 27]
    [C:\WINNT\system32\packet.dll]  [CACE Technologies, 3, 1, 0, 27]
    [C:\WINNT\system32\WanPacket.dll]  [CACE Technologies, 3, 1, 0, 27]
[PID: 652][C:\WINNT\System32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
[PID: 680][C:\WINNT\system32\pscds_NT.exe]  [N/A, 4, 0, 1, 1101]
[PID: 756][C:\WINNT\system32\regsvc.exe]  [Microsoft Corporation, 5.00.2195.6701]
[PID: 768][C:\WINNT\system32\MSTask.exe]  [Microsoft Corporation, 4.71.2195.6704]
[PID: 836][C:\WINNT\System32\WBEM\WinMgmt.exe]  [Microsoft Corporation, 1.50.1085.0100]
[PID: 904][C:\WINNT\system32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
[PID: 1068][C:\WINNT\Explorer.EXE]  [Microsoft Corporation, 5.00.3700.6690]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
    [C:\WINNT\downlo~1\CnsMin.dll]  [杒嫗嶰幍擇堦壢媄桳尷岞巌, 1, 5, 4, 2]
    [C:\WINNT\system32\igfxpph.dll]  [Intel Corporation, 3.0.0.3943]
    [C:\WINNT\system32\hccutils.DLL]  [Intel Corporation, 3.0.0.3943]
    [C:\WINNT\system32\igfxres.dll]  [Intel Corporation, 3.0.0.3943]
    [C:\WINNT\system32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.3943]
    [C:\WINNT\system32\igfxdev.dll]  [Intel Corporation, 3.0.0.3943]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [C:\WINNT\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 7]
    [C:\WINNT\downlo~1\CnsHook.dll]  [杒嫗嶰幍擇堦壢媄桳尷岞巌, 1, 0, 4, 2]
    [C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx]  [, 1, 0, 0, 1]
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[PID: 1000][C:\WINNT\system32\imejpmgr.exe]  [Microsoft Corporation, 7.0.1.4326]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
    [C:\WINNT\downlo~1\CnsMin.dll]  [杒嫗嶰幍擇堦壢媄桳尷岞巌, 1, 5, 4, 2]
[PID: 1032][C:\WINNT\system32\Rundll32.exe]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
    [C:\WINNT\downlo~1\CnsMin.dll]  [杒嫗嶰幍擇堦壢媄桳尷岞巌, 1, 5, 4, 2]
    [C:\WINNT\downlo~1\CnsMinIO.dll]  [杒嫗嶰幍擇堦壢媄桳尷岞巌, 1, 0, 3, 7]
    [C:\WINNT\downlo~1\cnsio.dll]  [杒嫗嶰幍擇堦壢媄桳尷岞巌, 1, 0, 2, 8]
    [C:\WINNT\downlo~1\CnsMinEx.dll]  [崙?場摿?審(杒嫗)桳尷岞巌, 1, 0, 3, 4]
[PID: 1244][C:\Program Files\MSN Messenger\msnmsgr.exe]  [Microsoft Corporation, 7.0.0816]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
    [C:\WINNT\downlo~1\CnsMin.dll]  [杒嫗嶰幍擇堦壢媄桳尷岞巌, 1, 5, 4, 2]
    [C:\WINNT\System32\devenum.dll]  [N/A, N/A]
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\WINNT\system32\WSD_SOCK32.dll]  [N/A, N/A]
    [C:\WINNT\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
[PID: 1212][C:\Program Files\Outlook Express\msimn.exe]  [Microsoft Corporation, 6.00.2800.1106]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
    [C:\WINNT\downlo~1\CnsMin.dll]  [杒嫗嶰幍擇堦壢媄桳尷岞巌, 1, 5, 4, 2]
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\WINNT\system32\WSD_SOCK32.dll]  [N/A, N/A]
[PID: 1292][E:\03 僣乕儖\mmail096a\MariMail.exe]  [N/A, N/A]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
    [C:\WINNT\downlo~1\CnsMin.dll]  [杒嫗嶰幍擇堦壢媄桳尷岞巌, 1, 5, 4, 2]
[PID: 1348][C:\WINNT\system32\conime.exe]  [Microsoft Corporation, 5.00.2195.6655]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
    [C:\WINNT\downlo~1\CnsMin.dll]  [杒嫗嶰幍擇堦壢媄桳尷岞巌, 1, 5, 4, 2]
[PID: 1284][C:\WINNT\TEMP\zts2.exe]  [N/A, N/A]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
    [C:\WINNT\TEMP\zts2.dll]  [N/A, N/A]
[PID: 1496][C:\WINNT\TEMP\mhs2.exe]  [N/A, N/A]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
    [C:\WINNT\TEMP\mhs2.dll]  [N/A, N/A]
[PID: 1308][C:\WINNT\TEMP\wlzs.exe]  [N/A, N/A]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
    [C:\WINNT\TEMP\wlzs.dll]  [N/A, N/A]
[PID: 940][C:\WINNT\TEMP\rxzs.exe]  [N/A, N/A]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
    [C:\WINNT\TEMP\rxzs.dll]  [N/A, N/A]
[PID: 280][C:\WINNT\system32\winsuaex.exe]  [N/A, N/A]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
[PID: 1064][C:\WINNT\system32\cmd.exe]  [Microsoft Corporation, 5.00.2195.6656]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
[PID: 1400][C:\Program Files\Microsoft Office\Office\EXCEL.EXE]  [Microsoft Corporation, 9.0.2823]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
    [C:\WINNT\downlo~1\CnsMin.dll]  [杒嫗嶰幍擇堦壢媄桳尷岞巌, 1, 5, 4, 2]
    [C:\WINNT\downlo~1\CnsHook.dll]  [杒嫗嶰幍擇堦壢媄桳尷岞巌, 1, 0, 4, 2]
    [C:\Program Files\Rising\Rav\RsPlugIn.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 14]
    [C:\PROGRA~1\Adobe\ACROBA~1.0\PDFMaker\ADOBEP~1.DLL]  [Adobe Systems, Incorporated, 5.0.5.2001091000]
    [C:\PROGRA~1\Adobe\ACROBA~1.0\PDFMaker\AdobePDFMakerX.JPN]  [Adobe Systems, Incorporated, 5.0.0.0]
    [C:\PROGRA~1\MICROS~3\Office\BLNMGRPS.DLL]  [N/A, N/A]
[PID: 1376][C:\WINNT\msagent\AgentSvr.exe]  [Microsoft Corporation, 2.00.0.3422]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
    [C:\WINNT\downlo~1\CnsMin.dll]  [杒嫗嶰幍擇堦壢媄桳尷岞巌, 1, 5, 4, 2]
    [C:\Program Files\Microsoft Office\Office\BLNMGR.DLL]  [N/A, N/A]
[PID: 1368][C:\Documents and Settings\tya003\僨僗僋僩僢僾\sreng2\SREng.EXE]  [Smallfrogs Studio, 2.3.13.690]
    [C:\WINNT\system32\windhcp.ocx]  [N/A, N/A]
    [C:\WINNT\system32\xpdhcp.dll]  [N/A, N/A]
    [C:\WINNT\downlo~1\CnsMin.dll]  [杒嫗嶰幍擇堦壢媄桳尷岞巌, 1, 5, 4, 2]
    [C:\WINNT\system32\WSD_SOCK32.dll]  [N/A, N/A]

==================================
File Associations
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  Error. [notepad.exe %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock Provider
MSAFD Tcpip [TCP/IP]
    C:\WINNT\system32\WSD_SOCK32.dll(N/A, N/A)
MT-TcpFilter
    C:\WINNT\system32\WSD_SOCK32.dll(N/A, N/A)

==================================
Autorun.Inf
N/A

==================================
HOSTS File
127.0.0.1      localhost

==================================
API HOOK
N/A

==================================


[/CODE]

zts2><C:\WINNT\TEMP\zts2.exe> [N/A]
<mhs2><C:\WINNT\TEMP\mhs2.exe> [N/A]
<wlzs><C:\WINNT\TEMP\wlzs.exe> [N/A]
<rxzs><C:\WINNT\TEMP\rxzs.exe> [N/A]
就这4个文件删了后重起就自动又出来了

清理后无法上网，用这个软件修复---下载地址：http://www.wedoc.com/software/WinsockXPFix.exe


置顶下载IceSword,菜单文件--设置--禁止进程创建，下面注册表中删除下列值：
（IceSword的下载地址：http://www.blogcn.com/user17/pjf/blog/44570897.html ）

[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<zts2><C:\WINNT\TEMP\zts2.exe> [N/A]
<mhs2><C:\WINNT\TEMP\mhs2.exe> [N/A]
<wlzs><C:\WINNT\TEMP\wlzs.exe> [N/A]
<rxzs><C:\WINNT\TEMP\rxzs.exe> [N/A]
启动文件夹：
[Outlook Express 偺婲摦]
<C:\Documents and Settings\tya003\僗僞乕僩 儊僯儏乕\僾儘僌儔儉\僗僞乕僩傾僢僾\Outlook Express 偺婲摦.lnk --> C:\PROGRA~1\OUTLOO~1\msimn.exe [Microsoft Corporation]><N>
[MariMail]
<C:\Documents and Settings\tya003\僗僞乕僩 儊僯儏乕\僾儘僌儔儉\僗僞乕僩傾僢僾\MariMail.lnk --> E:\03僣乕~1\MMAIL0~1\MariMail.exe [N/A]><N>
[VyChat]
<C:\Documents and Settings\tya003\僗僞乕僩 儊僯儏乕\僾儘僌儔儉\僗僞乕僩傾僢僾\VyChat.lnk --> C:\PROGRA~1\jyth\VyChat.exe [VyPRESS Research, LLC]><N>
[DelShare]
<C:\Documents and Settings\tya003\僗僞乕僩 儊僯儏乕\僾儘僌儔儉\僗僞乕僩傾僢僾\DelShare.lnk --> E:\05偦偺~1\tools\宯摑僣~1\DelShare.bat [N/A]><N>
服务：
[ATScher / ATScher][Running/Auto Start]
<C:\WINNT\system32\fs\Updater\ATScher.exe><N/A>
[PFD Service / PFDService][Running/Auto Start]
<C:\WINNT\system32\pscds_NT.exe><N/A>
[Remote Packet Capture Protocol v.0 (experimental) / rpcapd][Stopped/Manual Start]
<"C:\Program Files\WinPcap\rpcapd.exe" -d -f "C:\Program Files\WinPcap\rpcapd.ini"><CACE Technologies>
[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]
<C:\WINNT\system32\rundll32.exe windhcp.ocx,start><Microsoft Corporation>
[WinXP DHCP Service / WinXPDHCPsvc][Stopped/Auto Start]
<C:\WINNT\system32\rundll32.exe xpdhcp.dll,start><Microsoft Corporation>
[Plus Working Service / PlusService][Stopped/Auto Start]
<C:\WINNT\system32\plusservices.exe><N/A>

点进程，右面窗口中关闭所有非系统关键进程，逐个右击进程，点模块，弹出的窗口中删除下列加载项：
[C:\WINNT\system32\windhcp.ocx] [N/A, N/A]
[C:\WINNT\system32\xpdhcp.dll] [N/A, N/A]
[C:\WINNT\system32\plus.vxd] [N/A, N/A]
[C:\WINNT\system32\WSD_SOCK32.dll] [N/A, N/A]
[C:\WINNT\system32\pstcmon.dll] [N/A, N/A]
[PID: 624][C:\WINNT\system32\fs\Updater\ATScher.exe] [N/A, 4, 0, 1, 1101]
[C:\WINNT\system32\pscliba.dll] [N/A, 1, 0, 1, 40]
[C:\WINNT\downlo~1\CnsMin.dll]

文件中，清空：
C:\WINNT\TEMP
删除上述加载项中指向的所有文件:
C:\WINNT\system32\windhcp.ocx
C:\WINNT\system32\xpdhcp.dll
C:\WINNT\system32\plus.vxd
C:\WINNT\system32\WSD_SOCK32.dll
C:\WINNT\system32\pstcmon.dll
C:\WINNT\system32\fs\Updater\ATScher.exe
C:\WINNT\system32\pscliba.dll
C:\WINNT\downlo~1\CnsMin.dll
C:\WINNT\system32\plusservices.exe

取消禁止进程创建，重启并监视

重启后，扫日志贴上来