一在桌面上双击我的电脑或其他程序，都会在"system32"文件夹下生成"myconfig.ini"文件
在"windows"文件夹下生成"count.ini"和"downnew.ini"文件，并且还在"windows"下生成个"mycount.exe"文件，并自动执行，然后硬盘就狂响，有时就会弹出www.zhaomeimei.cn网页！

以下是我用SREng2扫描的结果，请尽快推出解决办法！！！

2007-01-01,22:40:54

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional  (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Corporation]
    <PHIME2002ASync><; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Corporation]
    <PHIME2002A><; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Corporation]
    <IntelliPoint><"C:\Program Files\Microsoft IntelliPoint\ipoint.exe">  [(Verified)Microsoft Corporation]
    <dr><D:\Program Files\北京城市热点资讯有限公司\Dr.COM 宽带客户端\ishare_user.exe>  [N/A]
    <kis><"D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe">  [Kaspersky Lab]
    <Anti-Spy Tools><E:\ast\ast\ast.exe -min>  [DSW Lab]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Corporation]
    <UIHost><logonui.exe>  [(Verified)Microsoft Corporation]

==================================
启动文件夹
N/A

==================================
服务
[Adobe LM Service / Adobe LM Service]
  <"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>
[卡巴斯基互联网安全套装 6.0 / AVP]
  <D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe -r><Kaspersky Lab>
[ewido anti-spyware 4.0 guard / ewido anti-spyware 4.0 guard]
  <D:\Program Files\ewido anti-spyware 4.0\ewido anti-spyware 4.0\guard.exe><Anti-Malware Development a.s.>
[Human Interface Device Access / HidServ]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[IMAPI CD-Burning COM Service / ImapiService]
  <C:\WINDOWS\System32\imapi.exe><Microsoft Corporation>
[Macromedia Licensing Service / Macromedia Licensing Service]
  <"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><N/A>
[NVIDIA Driver Helper Service / NVSvc]
  <C:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation>
[Remote Packet Capture Protocol v.0 (experimental) / rpcapd]
  <"C:\Program Files\WinPcap\rpcapd.exe" -d -f "C:\Program Files\WinPcap\rpcapd.ini"><N/A>
[WinXP DHCP Service / WinXPDHCPsvc]
  <C:\WINDOWS\System32\rundll32.exe xpdhcp.dll,start><Microsoft Corporation>

==================================

驱动程序
[ewido anti-spyware 4.0 driver / ewido anti-spyware 4.0 driver]
  <\??\D:\Program Files\ewido anti-spyware 4.0\ewido anti-spyware 4.0\guard.sys><N/A>
[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS]
  <System32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
[kl1 / kl1]
  <\SystemRoot\System32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif]
  <\??\C:\WINDOWS\System32\drivers\klif.sys><Kaspersky Lab>
[KRegEx / KRegEx]
  <\??\D:\KV2006\KRegEx.sys><N/A>
[KSysCall Service / KSysCall]
  <\??\D:\KV2006\KSysCall.sys><N/A>
[KVDriver for NT (KVDP) / KVDP]
  <\??\D:\KV2006\KVDP.sys><N/A>
[KvMemon / KvMemon]
  <\??\D:\KV2006\KvMemon.sys><N/A>
[KVREDIR / KVREDIR]
  <\??\D:\KV2006\KVREDIR.sys><N/A>
[NetGroup Packet Filter Driver / NPF]
  <system32\drivers\npf.sys><Politecnico di Torino>
[npkcrypt / npkcrypt]
  <\??\D:\Program Files\Tencent\npkcrypt.sys><INCA Internet Co., Ltd.>
[nv / nv]
  <System32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[nv4 / nv4]
  <System32\DRIVERS\nv4.sys><NVIDIA Corporation>
[oqxa / oqxay]
  <\SystemRoot\System32\DRIVERS\oqxay.sys><N/A>
[PProtect / PProtect]
  <\??\D:\KV2006\PProtect.sys><N/A>
[PSTRIP / PSTRIP]
  <\??\C:\WINDOWS\System32\DRIVERS\PSTRIP.SYS><N/A>
[Direct Parallel Link Driver / Ptilink]
  <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware]
  <\SystemRoot\System32\drivers\RsBoot.sys><N/A>
[Secdrv / Secdrv]
  <System32\DRIVERS\secdrv.sys><N/A>
[sptd / sptd]
  <\SystemRoot\System32\Drivers\sptd.sys><N/A>

==================================

浏览器加载项
[Thunder Browser Helper]
  {54EBD537-9BC1-480B-966A-843A333CA162} <D:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_006.dll, N/A>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <D:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_006.dll, N/A>
[]
  {C155E2F4-EA4D-48AD-BEE2-C837C0DC137F} <C:\WINDOWS\system32\vxtoltasaxgam.dll, N/A>
[acss]
  {E94529A9-1D27-4BC5-B1EE-321474D6EB79} <C:\PROGRA~1\jlii\npmm.dll, N/A>
[浩方对战平台]
  {0A155D3C-68E2-4215-A47A-E800A446447A} <D:\Program Files\浩方对战平台\GameClient.exe, N/A>
[Web反病毒保护]
  {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll, Kaspersky Lab>
[Sothink SWF Catcher]
  {E19ADC6E-3909-43E4-9A89-B7B676377EE3} <, N/A>
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[Edit Class]
  {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\WINDOWS\System32\CMBEdit.dll, >
[CEditCtrl Object]
  {488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\System32\aliedit\AliEdit.dll, www.alipay.com>
[AxSubmitControl Class]
  {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} <C:\WINDOWS\System32\SUBMIT~1.DLL, >
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[WangWangObj Class]
  {6E213FC7-DD5A-4115-B7E6-D4C7838C361E} <D:\Program Files\淘宝网\淘宝旺旺\WangWangX3.dll, 淘宝（中国）软件有限公司>
[&使用迅雷下载]
  <D:\Program Files\Thunder Network\Thunder\Program\geturl.htm, N/A>
[&使用迅雷下载全部链接]
  <D:\Program Files\Thunder Network\Thunder\Program\getallurl.htm, N/A>
[Download all links using BitComet]
  <, N/A>
[Download all videos using BitComet]
  <, N/A>
[Download link using BitComet]
  <, N/A>
[Sothink SWF Catcher]
  <C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm, N/A>
[使用BitComet下載全部鏈接]
  <, N/A>
[使用BitComet下載鏈接]
  <, N/A>
[使用BitComet下载]
  <, N/A>
[使用BitComet下载全部链接]
  <, N/A>
[使用BitComet下载本页视频]
  <, N/A>
[查看 Exif 信息(&V)]
  <res://D:\Program Files\Exif Show\ExShow.dll/EXSHOW.HTML, N/A>

==================================
正在运行的进程
[PID: 652][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 736][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 760][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
[PID: 804][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 816][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
[PID: 1000][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
[PID: 1100][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
[PID: 1224][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
[PID: 1236][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
[PID: 1328][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
[PID: 1660][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2600.0000 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\dxhnc.dll]  [N/A, N/A]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
    [C:\WINDOWS\System32\xpdhcp.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\vxtoltasaxgam.dll]  [N/A, N/A]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll]  [Kaspersky Lab, 1.0.6.299]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl]  [Kaspersky Lab, 6.0.0.304]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl]  [Kaspersky Lab, 6.0.0.299]
[PID: 1992][C:\Program Files\Microsoft IntelliPoint\ipoint.exe]  [Microsoft Corporation, 5.50.662.0]
[PID: 2028][D:\Program Files\北京城市热点资讯有限公司\Dr.COM 宽带客户端\ishare_user.exe]  [N/A, N/A]
    [D:\Program Files\北京城市热点资讯有限公司\Dr.COM 宽带客户端\cw3220.DLL]  [Borland International, 2.0]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
[PID: 168][E:\ast\ast\ast.exe]  [DSW Lab, 1.6]
    [E:\ast\ast\aScanCom.dll]  [DSW Lab, 2. 0. 1. 3]
    [E:\ast\ast\AutoRun.dll]  [ DSW Lab, 2.0]
    [E:\ast\ast\Common.dll]  [N/A, 1.4.0.0]
    [E:\ast\ast\EngineSDK.dll]  [DSW Lab, 1.7]
    [E:\ast\ast\FileAnalyser.dll]  [DSW Lab, 1.0.0.1]
    [E:\ast\ast\KillModule.dll]  [DSW Lab, 1.2.0.0]
    [E:\ast\ast\ManagerProcess.dll]  [N/A, 1.3.1.0]
    [E:\ast\ast\ManagerService.dll]  [N/A, 1.0.0.0]
    [E:\ast\ast\Monitor.dll]  [DSW Lab, 1.6]
    [E:\ast\ast\PortAssociate.dll]  [DSW Lab, 1.0.0.8]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
    [E:\ast\ast\SSDT.dll]  [ DSW Lab, 1.0.0.1]
    [E:\ast\ast\TIERepair.dll]  [N/A, 1.2.0.0]
    [E:\ast\ast\tRubbishClear.dll]  [DSW Lab, 1.4.0.0]
    [E:\ast\ast\tSecurityOptimize.dll]  [DSW Lab, 1.1.0.0]
    [E:\ast\ast\zDiagnosticTool.dll]  [DSW Lab, 1.1.0.0]
    [E:\ast\ast\unarc.dll]  [DSW Lab, 1.2]
[PID: 192][C:\WINDOWS\System32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 476][D:\Program Files\ewido anti-spyware 4.0\ewido anti-spyware 4.0\guard.exe]  [Anti-Malware Development a.s., 4, 0, 0, 172]
    [D:\Program Files\ewido anti-spyware 4.0\ewido anti-spyware 4.0\engine.dll]  [Anti-Malware Development a.s., 4, 0, 0, 172]
[PID: 520][C:\WINDOWS\System32\nvsvc32.exe]  [NVIDIA Corporation, 6.13.10.3082]
[PID: 3956][D:\Program Files\Maxthon\Maxthon.exe]  [MY Soft Technology, 1, 5, 0, 95]
    [D:\Program Files\Maxthon\maxzlib.dll]  [ , 1, 0, 0, 2]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program Files\Maxthon\Plugin\ViewSource\ViewSrc.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Maxthon\Services\RealTime\real_time.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll]  [Kaspersky Lab, 1.0.6.299]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl]  [Kaspersky Lab, 6.0.0.304]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl]  [Kaspersky Lab, 6.0.0.299]
    [C:\WINDOWS\System32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
[PID: 3752][C:\WINDOWS\System32\conime.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 3596][D:\sreng2\SREng\SREng.exe]  [Smallfrogs Studio, 2.2.6.605]
    [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
N/A

==================================

引用:

【红夜鬼1的贴子】运行(双击)SRENG2，点“启动项目，服务，点“Win32服务应用程序” 勾选“隐藏微软服务”选中病毒服务 Remote Packet Capture Protocol v.0 [WinXP DHCP Service ，选择“删除服务” 点“设置”选择“否” 运行SREng2,使用“系统修复”－－浏览器加载项－－删除 [] {C155E2F4-EA4D-48AD-BEE2-C837C0DC137F} <C:\WINDOWS\system32\vxtoltasaxgam.dll, N/A> [Sothink SWF Catcher] {E19ADC6E-3909-43E4-9A89-B7B676377EE3} <, N/A> [Edit Class] {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\WINDOWS\System32\CMBEdit.dll, > 重启按F８进入安全模式下 显示隐藏文件 删除：  C:\WINDOWS\System32\CMBEdit.dll C:\WINDOWS\system32\vxtoltasaxgam.dll xpdhcp.dll :\Program Files\WinPcap\rpcapd.exe" "C:\Program Files\WinPcap\rpcapd.ini ………………

太感谢了，按你说的重起后没问题了
还有就是[Sothink SWF Catcher]
{E19ADC6E-3909-43E4-9A89-B7B676377EE3}这个键值不是恶意软件