前段日子不小心中了流氓软件，竟然有7、8个之多？恐怖！！！
经过多次修复终于将流氓软件给干掉了，但是注册表里还有一些残留的项目怎么删也删不掉，也不知是不是有自启动保护机制，反正删掉后重起机子就又回来了。
这些残留项目是：
检测到3721上网助手残留的注册表项目:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\!搜一搜 !
检测到3721上网助手残留的注册表项目:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper
Objects\{BB936323-19FA-4521-BA29-ECA6A121BC78} !
检测到3721上网助手残留的注册表项目:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper
Objects\{D157330A-9EF3-49F8-9A67-4141AC41ADD4} !
检测到Yahoo助手残留的注册表项目:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\!搜一搜 !
检测到搜易网弹出广告残留的注册表项目:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce !
然后用HijackThis 扫了个log上面的16、17还有18里的没有文件的修复不了，不知是不是流氓软件的残留在作怪，请高手帮忙看一下！！谢谢！！！
Logfile of HijackThis v1.99.1
Scan saved at 21:21:14, on 2006-1-19
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
运行进程:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\crypserv.exe
d:\ewido3.5正式版\security suite\ewidoctrl.exe
d:\ewido3.5正式版\security suite\ewidoguard.exe
C:\Program Files\KV2006\KVSrvXP.exe
C:\Program Files\KV2006\kvwsc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\oodag.exe
C:\Program Files\联想\联想键盘驱动\TGESrvLogon.exe
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\联想\联想键盘驱动\TGEUsrLogon.exe
C:\Program Files\联想\联想键盘驱动\hidSevice.exe
C:\Program Files\联想\联想键盘驱动\usbkbdriver.exe
D:\My MPC·暴风影音(Ansi) StormCodec5.05RC1\Ringz Studio\Storm Downloader\StormDownloader.exe
C:\Program Files\联想\联想键盘驱动\fastkey.exe
C:\Program Files\KV2006\KVMonXP.kxp
C:\WINDOWS\system32\ctfmon.exe
D:\扫描、清除、免疫那些 广告及间谍软件的好东东\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\KV2006\TrojDie.kxp
C:\Program Files\Analog Devices\Eagle I and Eagle II USB ADSL\dslmon.exe
C:\Program Files\KV2006\KRegEx.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\KV2006\UIHost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\HijackThis 1.99.1 汉化版\HijackThis v1.99.1 汉化版\HijackThis.exe
O3 - Toolbar: 江民杀毒工具栏 - {B5A34A93-D538-43A7-8371-864CB6148D12} - C:\Program Files\KV2006\KvShell.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [HuaShanTGEKeyboardIC] C:\Program Files\联想\联想键盘驱动\TGEUsrLogon.exe
O4 - HKLM\..\Run: [HuaShanTGEUSBKbd] C:\Program Files\联想\联想键盘驱动\hidSevice.exe
O4 - HKLM\..\Run: [HuaShanTGEUSBKbd1] C:\Program Files\联想\联想键盘驱动\usbkbdriver.exe
O4 - HKLM\..\Run: [MINI_BFYY] D:\My MPC·暴风影音(Ansi) StormCodec5.05RC1\Ringz Studio\Storm Downloader\StormDownloader.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [KvMonXP] C:\Program Files\KV2006\KVMonXP.kxp /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [FUIClearHis] D:\FRESHU~1.50\FRESHD~1\FRESHUI\freshui.exe 16 17
O4 - Global Startup: dslmon.lnk = ?
O8 - Extra context menu item: &使用暴风下载器下载 - D:\My MPC·暴风影音(Ansi) StormCodec5.05RC1\Ringz Studio\Storm Downloader\geturl.htm
O8 - Extra context menu item: 使用迅雷下载 - D:\迅雷 5.1.1.157 快乐无极清爽优化增强版\Thunder\geturl.htm
O8 - Extra context menu item: 使用迅雷下载全部链接 - D:\迅雷 5.1.1.157 快乐无极清爽优化增强版\Thunder\getallurl.htm
O10 - Unknown file in Winsock LSP: c:\program files\kv2006\kvsock_1.dll
O10 - Unknown file in Winsock LSP: c:\program files\kv2006\kvsock_1.dll
O10 - Unknown file in Winsock LSP: c:\program files\kv2006\kvsock_1.dll
O10 - Unknown file in Winsock LSP: c:\program files\kv2006\kvsock_1.dll
O10 - Unknown file in Winsock LSP: c:\program files\kv2006\kvsock_1.dll
O10 - Unknown file in Winsock LSP: c:\program files\kv2006\kvsock_1.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} -
O17 - HKLM\System\CCS\Services\Tcpip\..\{E430787B-792F-4A2D-B312-6800C5FB31BF}: NameServer =
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: cdl - {3DD53D40-7B8B-11D0-B013-00AA0059CE02} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll
O18 - Protocol: file - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ftp - {79EAC9E3-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: gopher - {79EAC9E4-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: http - {79EAC9E2-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: https - {79EAC9E5-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ic32pp - {BBCA9F81-8F4F-11D2-90FF-0080C83D3571} - C:\WINDOWS\wc98pp.dll
O18 - Protocol: ipp - (no CLSID) - (没有文件)
O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll
O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: local - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: mailto - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: mhtml - {05300401-BCBC-11D0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll
O18 - Protocol: mk - {79EAC9E6-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll
O18 - Protocol: msdaipp - (no CLSID) - (没有文件)
O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll
O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll
