[CODE]

2008-03-28,22:53:51

System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件
    进程特权扫描


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
    <MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background>  [(Verified)Microsoft Windows XP Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    <mscheck><rundll32.exe C:\WINDOWS\system32\wicheck080324.dll mymain>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <RavTask><"D:\ring\Rising\Rav\RavTask.exe" -system>  [(Verified)Beijing Rising Science and Technology Corporation Limited]
    <360Safetray><C:\Program Files\360safe\safemon\360tray.exe /start>  [奇虎网]
    <360Antiarp><C:\Program Files\360safe\antiarp\antiarp.exe /start>  [奇虎网]
    <stup.exe><Rundll32.exe C:\PROGRA~1\TENCENT\SSPlus\SPlus1.dll,Rundll32 R>  [(Verified)Tencent Technology(Shenzhen) Company Limited]
    <Interfacd De><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    <ozxaki37><%systemroot%\system32\Rundll32.exe %systemroot%\system32\ozxaki37.dll DllUnregisterServer>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    <zhqb_df><rundll32.exe C:\WINDOWS\system\zhqbdf080331.dll mymain>  [N/A]
    <zsmstc><rundll32.exe C:\WINDOWS\system32\mxcdcsrv16_080327.dll start>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe yyhelp.exe>  []
    <Userinit><C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sashost.exe>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><mrjhtjd.dll,qrhhb.dll,xdfntt.dll,hgfhk.dll,hjaiq.dll,kduy.dll,frntrn.dll,dnteh.dll,chmfcmh.dll,jwlah.dll,crugd.dll,lariytrz.dll,thurh.dll,mgmgmm.dll,oqrthc.dll,ydgn.dll,dbfb.dll,fjnbv.dll,wmsat.dll,gmnait.dll,hfjg.dll,xdndn.dll,rgfjj.dll,dscef.dll,xfng.dll,njritc.dll,setrhes.dll,cdxbfxdb.dll,xfgnxfn.dll,gjkhj.dll,fxnfnh.dll,bjrvm.dll,ektvm.dll,fehom.dll,jyjlt.dll,ijatnaw.dll,sehhter.dll,fhjfg.dll,zdbdb.dll,rhs.dll,atehhz.dll,gjjte.dll,xgnfn.dll,xfgnhcgfm.dll,serger.dll,bnxnb.dll,fxgnfx.dll,jzijj.dll,xfgnfx.dll,serghjm.dll,thsddh.dll,xbcvxb.dll,zfdzb.dll,hkfgh.dll,drghszd.dll,fngn.dll,xdhdg.dll,zdbfbd.dll,fjyjy.dll,awef.dll,msepbe.dll,>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll>  [(Verified)Beijing Rising Science and Technology Corporation Limited]
    <{6f477a7c-1ea5-494f-8d32-d45cb3228c28}><C:\WINDOWS\system32\ayFKKFKK1053.dll>  []
    <{73627e95-ccad-47bb-a7a6-3180cb5dfb0d}><C:\WINDOWS\system32\ayNNBNNB1042.dll>  []
    <{6c15c2d7-e36e-4077-bbe3-2efd193e6aa1}><C:\WINDOWS\system32\ayEZZEZZ1042.dll>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    <PostBootReminder><%SystemRoot%\system32\SHELL32.dll>  [(Verified)Microsoft Windows Component Publisher]
    <CDBurn><%SystemRoot%\system32\SHELL32.dll>  [(Verified)Microsoft Windows Component Publisher]
    <WebCheck><%SystemRoot%\system32\webcheck.dll>  [(Verified)Microsoft Windows Publisher]
    <SysTray><C:\WINDOWS\system32\stobject.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
    <WinlogonNotify: crypt32chain><crypt32.dll>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
    <WinlogonNotify: cryptnet><cryptnet.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
    <WinlogonNotify: cscdll><cscdll.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
    <WinlogonNotify: igfxcui><igfxdev.dll>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
    <WinlogonNotify: ScCertProp><wlnotify.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
    <WinlogonNotify: Schedule><wlnotify.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
    <WinlogonNotify: sclgntfy><sclgntfy.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
    <WinlogonNotify: SensLogn><WlNotify.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
    <WinlogonNotify: termsrv><wlnotify.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
    <WinlogonNotify: wlballoon><wlnotify.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
    <{438755C2-A8BA-11D1-B96B-00A0C90312E1}><%SystemRoot%\system32\browseui.dll>  [(Verified)Microsoft Windows Component Publisher]
    <{8C7461EF-2B13-11d2-BE35-3078302C2030}><%SystemRoot%\system32\browseui.dll>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
    <Microsoft Windows Media Player><C:\WINDOWS\inf\unregmp2.exe /ShowWMP>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
    <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
    <浏览器自定义组件><RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
    <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
    <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
    <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
    <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
    <Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
    <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]

[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
    <Windows 桌面更新><regsvr32.exe /s /n /i:U shell32.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
    <Internet Explorer 6><%SystemRoot%\system32\ie4uinit.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\60e41.exe]
    <IFEO[60e41.exe]><C:\windows\system32\svchost.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ackwin32.exe]
    <IFEO[ackwin32.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adam.exe]
    <IFEO[adam.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVXDWIN]
    <IFEO[ADVXDWIN]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvr.exe]
    <IFEO[AgentSvr.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alertsvc.exe]
    <IFEO[alertsvc.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ALOGSERV]
    <IFEO[ALOGSERV]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\amon.exe]
    <IFEO[amon.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AMON9X]
    <IFEO[AMON9X]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\an006.exe]
    <IFEO[an006.exe]><C:\windows\system32\svchost.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\anti - trojan.exe]
    <IFEO[anti - trojan.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntiArp.exe]
    <IFEO[AntiArp.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antivir]
    <IFEO[antivir]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ANTS]
    <IFEO[ANTS]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AppSvc32.exe]
    <IFEO[AppSvc32.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apvxdwin.exe]
    <IFEO[apvxdwin.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\arvmon.exe]
    <IFEO[arvmon.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ATCON]
    <IFEO[ATCON]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AtiSrv.exe]
    <IFEO[AtiSrv.exe]><C:\windows\system32\svchost.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ATUPDATER]
    <IFEO[ATUPDATER]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ATWATCH]
    <IFEO[ATWATCH]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autodown.exe]
    <IFEO[autodown.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoGuarder.exe]
    <IFEO[AutoGuarder.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoTrace]
    <IFEO[AutoTrace]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconsol.exe]
    <IFEO[avconsol.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ave32.exe]
    <IFEO[ave32.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGCC32]
    <IFEO[AVGCC32]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgctrl.exe]
    <IFEO[avgctrl.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrssvc.exe]
    <IFEO[avgrssvc.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvgServ]
    <IFEO[AvgServ]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGSERV9]
    <IFEO[AVGSERV9]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGW]
    <IFEO[AVGW]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkpop]
    <IFEO[avkpop]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvkServ]
    <IFEO[AvkServ]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkserv.exe]
    <IFEO[avkserv.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []

直接将日志内容彻底复制到一个空记事本里，然后再保存，就可以以附件的形式发论坛来了。
一定以附件形式发这论坛来。
点击我这贴右下角的“引用”然后就应该知道怎么发了。

你可以打开日志后，在左上角的“编辑”里选择“全选”再选择“复制”
就可以彻底复制日志内容到另一个空记事本保存了
千万不能遗漏任何一个字母，否则可能影响SRENG日志分析助手的工作

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkservice]
    <IFEO[avkservice]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkwctl9]
    <IFEO[avkwctl9]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe]
    <IFEO[AvMonitor.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avnt.exe]
    <IFEO[Avnt.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp32.exe]
    <IFEO[avp32.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpcc.exe]
    <IFEO[avpcc.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpdos32.exe]
    <IFEO[avpdos32.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpm.exe]
    <IFEO[avpm.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpmon.exe]
    <IFEO[avpmon.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpnt.exe]
    <IFEO[avpnt.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avptc32.exe]
    <IFEO[avptc32.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpupd.exe]
    <IFEO[avpupd.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avrep32.exe]
    <IFEO[Avrep32.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avsched32.exe]
    <IFEO[avsched32.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avsynmgr.exe]
    <IFEO[avsynmgr.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwin95.exe]
    <IFEO[avwin95.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVWINNT]
    <IFEO[AVWINNT]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwupd32.exe]
    <IFEO[avwupd32.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVXMONITOR9X]
    <IFEO[AVXMONITOR9X]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVXMONITORNT]
    <IFEO[AVXMONITORNT]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVXQUAR]
    <IFEO[AVXQUAR]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVXW]
    <IFEO[AVXW]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\blackd.exe]
    <IFEO[blackd.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\blackice.exe]
    <IFEO[blackice.exe]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuard]
    <IFEO[BullGuard]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCAPP.EXE]
    <IFEO[CCAPP.EXE]><C:\WINDOWS\system32\Intjrface De.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe]

> _ <

你只有用Xdelbox这个工具去删除这些文件。
Xdelbox下载：http://www.dodudou.com/down/里面的“原创软件文件夹”下载那个1.6版本的。
下载后
解压所有文件到一个文件夹,（一定要解压出来运行，不要懒）运行xdelbox前请拔掉插在电脑上的所有移动硬盘、U盘、MP3等。
将下面的文件信息全部复制，然后打开Xdelbox,（打开后，不要好奇点这Xdelbox玩）直接在下面大窗口的空白处，使用右键菜单的“剪贴板导入不检查路径”导入，并全选文件选择右键菜单的“立刻重启删除”

c:\windows\system32\inf\svch0st.exe
c:\windows\system32\ayezzezz1042.dll
c:\windows\system32\ayfkkfkk1053.dll
c:\windows\system32\aynnbnnb1042.dll
c:\windows\system32\ijatnaw.dll
c:\windows\system32\jyjlt.dll
c:\windows\system32\lariytrz.dll
c:\windows\system32\lwizysys16_080326.dll
c:\windows\system32\msepbe.dll
c:\windows\system32\xfgnxfn.dll
c:\docume~1\asus\locals~1\temp\intjrface de(3).exe
c:\windows\system32\mcdcsrv32_080327.dll
c:\windows\system32\yyshow.dll
c:\windows\system32\wmsat.dll
c:\windows\system32\wicheck080324.dll
c:\windows\system32\intjrface de.exe
c:\windows\system32\ozxaki37.dll
c:\windows\system\zhqbdf080331.dll
c:\windows\system32\mxcdcsrv16_080327.dll
c:\windows\system32\yyhelp.exe
c:\windows\yyhelp.exe
c:\windows\system32\sashost.exe
c:\windows\fonts\00-1b-fc-fb-55-59\system\lmmh.exe
c:\windows\system32\e4852660.exe
c:\windows\inf\pcidevices8.inf
c:\progra~1\bdwb\lngl.dll
c:\windows\system32\xrpevb.dll
c:\program files\microsoft office\system\apcdli.sys
c:\windows\system32\drivers\msosfpids32.sys
c:\windows\system32\drivers\ik92ay.sys
c:\docume~1\asus\locals~1\temp\tmp4c.tmp
c:\windows\system32\drivers\msyecp.sys
c:\windows\system32\drivers\4f.tmp
c:\windows\system32\drivers\ozxaki37.sys
c:\windows\system32\ssdtdt.sys
c:\docume~1\asus\locals~1\temp\usbcams3.sys
c:\windows\system32\drivers\jajhrq69.sys
c:\program files\common files\cpush\cpush.dll
C:\Autorun.inf
C:\Intjrface De.exe
D:\Autorun.inf
D:\Intjrface De.exe
E:\Autorun.inf
E:\Intjrface De.exe
F:\Autorun.inf
F:\Intjrface De.exe

重启计算机以后 会有两个系统进入的选择的倒计时界面
第一个是你原来的windows系统
第二个是这个软件给你设定的dos系统
系统会自动选择进入第二个系统
此时不要进行任何操作
之后会自动重启进入正常模式
进入系统后，再做下面的：
————————————————————————————————————
在扫日志的SRENG工具》启动项目》注册表》里面找下面项目删除：
[mscheck]    <rundll32.exe C:\WINDOWS\system32\wicheck080324.dll mymain>
[Interfacd De]    <C:\WINDOWS\system32\Intjrface De.exe>
[ozxaki37]    <%systemroot%\system32\Rundll32.exe %systemroot%\system32\ozxaki37.dll DllUnregisterServer>
[zhqb_df]    <rundll32.exe C:\WINDOWS\system\zhqbdf080331.dll mymain>
[zsmstc]    <rundll32.exe C:\WINDOWS\system32\mxcdcsrv16_080327.dll start>
[{6f477a7c-1ea5-494f-8d32-d45cb3228c28}]    <C:\WINDOWS\system32\ayFKKFKK1053.dll>
[{73627e95-ccad-47bb-a7a6-3180cb5dfb0d}]    <C:\WINDOWS\system32\ayNNBNNB1042.dll>
[{6c15c2d7-e36e-4077-bbe3-2efd193e6aa1}]    <C:\WINDOWS\system32\ayEZZEZZ1042.dll>
[Run]    <; C:\WINPENJR\win32\custom.exe >
————————————————————————————————————
这贴里下载那个我在17楼提供的附件，解压后运行，删除检测到的所有映像劫持。
http://forum.ikaka.com/topic.asp?board=28&artid=8433210

————————————————————————————————————
在扫日志的SRENG工具》启动项目》注册表》里将下面项目修改医下（就是选择“编辑”）这必须关闭杀毒软件的监控，否则改不了可能。
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe yyhelp.exe>  []
    <Userinit><C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sashost.exe>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]  <AppInit_DLLs><mrjhtjd.dll,qrhhb.dll,xdfntt.dll,hgfhk.dll,hjaiq.dll,kduy.dll,frntrn.dll,dnteh.dll,chmfcmh.dll,jwlah.dll,crugd.dll,lariytrz.dll,thurh.dll,mgmgmm.dll,oqrthc.dll,ydgn.dll,dbfb.dll,fjnbv.dll,wmsat.dll,gmnait.dll,hfjg.dll,xdndn.dll,rgfjj.dll,dscef.dll,xfng.dll,njritc.dll,setrhes.dll,cdxbfxdb.dll,xfgnxfn.dll,gjkhj.dll,fxnfnh.dll,bjrvm.dll,ektvm.dll,fehom.dll,jyjlt.dll,ijatnaw.dll,sehhter.dll,fhjfg.dll,zdbdb.dll,rhs.dll,atehhz.dll,gjjte.dll,xgnfn.dll,xfgnhcgfm.dll,serger.dll,bnxnb.dll,fxgnfx.dll,jzijj.dll,xfgnfx.dll,serghjm.dll,thsddh.dll,xbcvxb.dll,zfdzb.dll,hkfgh.dll,drghszd.dll,fngn.dll,xdhdg.dll,zdbfbd.dll,fjyjy.dll,awef.dll,msepbe.dll,>  [N/A]

将    <shell><Explorer.exe yyhelp.exe>  [] 的“值”项编辑为：
          <shell><Explorer.exe>
就是把<Explorer.exe yyhelp.exe>修改为<Explorer.exe>即清除Explorer.exe后面的内容
——————————————————
将    <Userinit><C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sashost.exe>  [N/A] 的“值”项编辑为：
      <Userinit><C:\WINDOWS\system32\userinit.exe,>  [N/A]
就是把<C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sashost.exe>修改为<C:\WINDOWS\system32\userinit.exe,>逗号不可省略
——————————————————
将<AppInit_DLLs><mrjhtjd.dll,qrhhb.dll,xdfntt.dll,hgfhk.dll,hjaiq.dll,kduy.dll,frntrn.dll,dnteh.dll,chmfcmh.dll,jwlah.dll,crugd.dll,lariytrz.dll,thurh.dll,mgmgmm.dll,oqrthc.dll,ydgn.dll,dbfb.dll,fjnbv.dll,wmsat.dll,gmnait.dll,hfjg.dll,xdndn.dll,rgfjj.dll,dscef.dll,xfng.dll,njritc.dll,setrhes.dll,cdxbfxdb.dll,xfgnxfn.dll,gjkhj.dll,fxnfnh.dll,bjrvm.dll,ektvm.dll,fehom.dll,jyjlt.dll,ijatnaw.dll,sehhter.dll,fhjfg.dll,zdbdb.dll,rhs.dll,atehhz.dll,gjjte.dll,xgnfn.dll,xfgnhcgfm.dll,serger.dll,bnxnb.dll,fxgnfx.dll,jzijj.dll,xfgnfx.dll,serghjm.dll,thsddh.dll,xbcvxb.dll,zfdzb.dll,hkfgh.dll,drghszd.dll,fngn.dll,xdhdg.dll,zdbfbd.dll,fjyjy.dll,awef.dll,msepbe.dll,>  [N/A] 的“值”项编辑置空为：

    <AppInit_DLLs><>  [N/A]

即清空
——————————————————————————————————————————————————
在扫日志的SRENG工具》启动项目》服务》Win32服务应用程序》里面找下面项删除，

[C36E679E / C36E679E]    <C:\WINDOWS\system32\E4852660.EXE -C36E679E>
[DCOM Service Process Manager / DCOMManager]    <C:\WINDOWS\system32\svchost.exe -k netsvcs-->C:\WINDOWS\inf\pcidevices8.inf>
[Windows gibg RunThem / gibg]    <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\PROGRA~1\bdwb\lngl.dll>
[portablemsi / portablemsi]    <>
[Remote Procedure Call System(RPCS) / RpcS]    <>
[NetwokeConnections / skynet]    <C:\WINDOWS\system32\svchost.exe -k skynet-->%SystemRoot%\System32\xrpevb.dll>
[Perfor and Alell / Transfer Service]    <>
————————————————————————————————————
在扫日志的SRENG工具》启动项目》服务》驱动程序》里面找下面项删除，

[Apcdli / Apcdli]    <\??\C:\Program Files\Microsoft Office\SYSTEM\apcdli.sys>
[fpids32 / fpids32]    <\??\C:\WINDOWS\system32\drivers\msosfpids32.sys>
[ik92a / ik92ay]    <\SystemRoot\System32\DRIVERS\ik92ay.sys>
[mnsf / mnsf]    <\??\C:\DOCUME~1\ASUS\LOCALS~1\Temp\tmp4C.tmp>
[msertk / msertk]    <system32\drivers\msyecp.sys>
[NPF / NPF]    <\??\C:\WINDOWS\system32\drivers\4F.tmp>
[ozxaki3 / ozxaki37]    <\SystemRoot\System32\DRIVERS\ozxaki37.sys>
[RESSDT / RESSDT]    <\??\C:\WINDOWS\system32\ssdtdt.sys>
[Sc Manager / Sc Manager]    <\??\C:\DOCUME~1\ASUS\LOCALS~1\Temp\usbcams3.sys>
[jajhrq69 / jajhrq69]    <\SystemRoot\system32\\drivers\\jajhrq69.sys>
—————————————————————————————
在扫日志的SRENG工具》系统修复》浏览器加载项》里面找下面删除

[CAdLogic Object]    <C:\Program Files\Common Files\CPUSH\cpush.dll>
————————————————————————————————————
在扫日志的SRENG工具》系统修复》HOSTS文件》选择“重置”再“保存

————————————————————————————————————
再重启电脑，升级杀毒软件至最新版本全盘杀毒。

下载卡卡助手，清理你那系统。

记得打打系统漏洞补丁

清空IE缓存，清空临时文件夹。

这 里 下 载 W i n d o w s 清 理 助 手 ，清理你那系统。
http://www.arswp.com/

麻烦..可以说下这个病毒有什么危害吗...

在做这一步时，

————————————————————————————————————
在扫日志的SRENG工具》启动项目》注册表》里面找下面项目删除：
[mscheck] <rundll32.exe C:\WINDOWS\system32\wicheck080324.dll mymain>
[Interfacd De] <C:\WINDOWS\system32\Intjrface De.exe>
[ozxaki37] <%systemroot%\system32\Rundll32.exe %systemroot%\system32\ozxaki37.dll DllUnregisterServer>
[zhqb_df] <rundll32.exe C:\WINDOWS\system\zhqbdf080331.dll mymain>
[zsmstc] <rundll32.exe C:\WINDOWS\system32\mxcdcsrv16_080327.dll start>
[{6f477a7c-1ea5-494f-8d32-d45cb3228c28}] <C:\WINDOWS\system32\ayFKKFKK1053.dll>
[{73627e95-ccad-47bb-a7a6-3180cb5dfb0d}] <C:\WINDOWS\system32\ayNNBNNB1042.dll>
[{6c15c2d7-e36e-4077-bbe3-2efd193e6aa1}] <C:\WINDOWS\system32\ayEZZEZZ1042.dll>
[Run] <; C:\WINPENJR\win32\custom.exe >


按删除后弹出两个对话框，内容为 

    警告！注册表值run被修改为非正常值（默认值是空）请检查你的系统中可能存在的计算机病毒.你可以编辑这个键值并清空里面的内容.

还有一个是警告AppInit_DLLs修改为非正常值（默认值是空） ，按确认后该删除的东西还在那个

先做下面那个修改编辑的操作。

一定要仔细

不能出错

否则就开机不能进系统了。

========Content========
不好意思呀..你是说这一步吗？


在扫日志的SRENG工具》启动项目》注册表》里将下面项目修改医下（就是选择“编辑”）这必须关闭杀毒软件的监控，否则改不了可能。
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe yyhelp.exe> []
<Userinit><C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sashost.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><mrjhtjd.dll,qrhhb.dll,xdfntt.dll,hgfhk.dll,hjaiq.dll,kduy.dll,frntrn.dll,dnteh.dll,chmfcmh.dll,jwlah.dll,crugd.dll,lariytrz.dll,thurh.dll,mgmgmm.dll,oqrthc.dll,ydgn.dll,dbfb.dll,fjnbv.dll,wmsat.dll,gmnait.dll,hfjg.dll,xdndn.dll,rgfjj.dll,dscef.dll,xfng.dll,njritc.dll,setrhes.dll,cdxbfxdb.dll,xfgnxfn.dll,gjkhj.dll,fxnfnh.dll,bjrvm.dll,ektvm.dll,fehom.dll,jyjlt.dll,ijatnaw.dll,sehhter.dll,fhjfg.dll,zdbdb.dll,rhs.dll,atehhz.dll,gjjte.dll,xgnfn.dll,xfgnhcgfm.dll,serger.dll,bnxnb.dll,fxgnfx.dll,jzijj.dll,xfgnfx.dll,serghjm.dll,thsddh.dll,xbcvxb.dll,zfdzb.dll,hkfgh.dll,drghszd.dll,fngn.dll,xdhdg.dll,zdbfbd.dll,fjyjy.dll,awef.dll,msepbe.dll,> [N/A]

将 <shell><Explorer.exe yyhelp.exe> [] 的“值”项编辑为：
<shell><Explorer.exe>
就是把<Explorer.exe yyhelp.exe>修改为<Explorer.exe>即清除Explorer.exe后面的内容
——————————————————
将 <Userinit><C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sashost.exe> [N/A] 的“值”项编辑为：
<Userinit><C:\WINDOWS\system32\userinit.exe,> [N/A]
就是把<C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sashost.exe>修改为<C:\WINDOWS\system32\userinit.exe,>逗号不可省略
——————————————————
将<AppInit_DLLs><mrjhtjd.dll,qrhhb.dll,xdfntt.dll,hgfhk.dll,hjaiq.dll,kduy.dll,frntrn.dll,dnteh.dll,chmfcmh.dll,jwlah.dll,crugd.dll,lariytrz.dll,thurh.dll,mgmgmm.dll,oqrthc.dll,ydgn.dll,dbfb.dll,fjnbv.dll,wmsat.dll,gmnait.dll,hfjg.dll,xdndn.dll,rgfjj.dll,dscef.dll,xfng.dll,njritc.dll,setrhes.dll,cdxbfxdb.dll,xfgnxfn.dll,gjkhj.dll,fxnfnh.dll,bjrvm.dll,ektvm.dll,fehom.dll,jyjlt.dll,ijatnaw.dll,sehhter.dll,fhjfg.dll,zdbdb.dll,rhs.dll,atehhz.dll,gjjte.dll,xgnfn.dll,xfgnhcgfm.dll,serger.dll,bnxnb.dll,fxgnfx.dll,jzijj.dll,xfgnfx.dll,serghjm.dll,thsddh.dll,xbcvxb.dll,zfdzb.dll,hkfgh.dll,drghszd.dll,fngn.dll,xdhdg.dll,zdbfbd.dll,fjyjy.dll,awef.dll,msepbe.dll,> [N/A] 的“值”项编辑置空为：

<AppInit_DLLs><> [N/A]

即清空



在这里的[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe yyhelp.exe> []
<Userinit><C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sashost.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><mrjhtjd.dll,qrhhb.dll,xdfntt.dll,hgfhk.dll,hjaiq.dll,kduy.dll,frntrn.dll,dnteh.dll,chmfcmh.dll,jwlah.dll,crugd.dll,lariytrz.dll,thurh.dll,mgmgmm.dll,oqrthc.dll,ydgn.dll,dbfb.dll,fjnbv.dll,wmsat.dll,gmnait.dll,hfjg.dll,xdndn.dll,rgfjj.dll,dscef.dll,xfng.dll,njritc.dll,setrhes.dll,cdxbfxdb.dll,xfgnxfn.dll,gjkhj.dll,fxnfnh.dll,bjrvm.dll,ektvm.dll,fehom.dll,jyjlt.dll,ijatnaw.dll,sehhter.dll,fhjfg.dll,zdbdb.dll,rhs.dll,atehhz.dll,gjjte.dll,xgnfn.dll,xfgnhcgfm.dll,serger.dll,bnxnb.dll,fxgnfx.dll,jzijj.dll,xfgnfx.dll,serghjm.dll,thsddh.dll,xbcvxb.dll,zfdzb.dll,hkfgh.dll,drghszd.dll,fngn.dll,xdhdg.dll,zdbfbd.dll,fjyjy.dll,awef.dll,msepbe.dll,> [N/A]  是键路径还是值还是名字？或者是是什么呢？我在注册表中找不到这堆英文..