今天逛网的时候中了个毒，所有程序全部被关闭了，然后机子重启。
重启以后卡卡安全助手就没了，打开360安全卫士就重启，按F8选择进入安全
模式也重启。随机启动两个“RUNDLL32.EXE”和两个IE浏览器，但是这两个IE浏
览器是只能在进程里面看得到。
搜索机器，在那个时间段机子里多了这么些文件。
c:\windows\system32\bd.dll
c:\windows\0.exe
c:\windows\1.exe
c:\windows\system32\3.1
c:\windows\system32\1.1
c:\Program Files\Common Files\Microsoft Shared\MSInfo\NewInfo.rxk
c:\Program Files\Common Files\Microsoft Shared\MSInfosystem.2dt
还有这几个文件不记得是哪个文件夹了：alxres070301.exe、
scrsys070301.exe、winsys32_070301.dll、scrsys16_070301.scr、
winsys16_070301.dll
好不容易把上面这些文件和这些文件对应的注册表相应键值删除干净了，但
是机子从不太对头，IE标题栏变成了下面图片的样子（里面红圈部分变成两个“-
”了，正常的应该是一个“-”）还有一个在任何随机启动组里都看不到的
“RUNDLL32.EXE”，包括用冰刃也查不到，在启动系统以后就会出现在进程里。
卡巴斯基也不能升级了，总显示是今天中毒之前最后一次升级的时间。
现在可以用360安全卫士了，但是用360安全卫士查不出什么奇怪的东西。
再附上HijackThis v1.99.1的扫描日志，请各位强人帮帮忙啊！！！！
Logfile of HijackThis v1.99.1
Scan saved at 23:34:38, on 2007-3-3
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
D:\Program Files\ExeSoft\strong\strong.exe
C:\WINDOWS\VMSnap3.EXE
C:\WINDOWS\Domino.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
C:\Program Files\Maxthon\Maxthon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\notepad.exe
F:\sysbak\防护软件\HijackThis.exe
R3 - Default URLSearchHook is missing
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Java\jre\bin\ssv.dll
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - D:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_007.dll
O2 - BHO: BH
Object Class - {AA2F655A-7618-499D-B0A5-4F84B91D2C5F} - C:\WINDOWS\System32\PCEggs.dll
O2 - BHO: NavigatMon Class - {B69F34DD-F0F9-42DC-9EDD-957187DA688D} - C:\Program Files\360safe\safemon\safemon.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\System32\kakatool.dll (file missing)
O4 - HKLM\..\Run: [ExeSoft] D:\Program Files\ExeSoft\strong\strong.exe un
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [VMSnap3] C:\WINDOWS\VMSnap3.EXE
O4 - HKLM\..\Run: [Domino] C:\WINDOWS\Domino.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: 卡巴斯基反黑客.lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: &使用迅雷下载 - D:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - D:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Program Files\Tencent\QQ\SendMMS.htm
O9 - Extra button: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559}? - D:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - Extra 'Tools' menuitem: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559}? - D:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Java\jre\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java 控制台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Java\jre\bin\ssv.dll
O9 - Extra button: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436}? - D:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - Extra 'Tools' menuitem: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436}? - D:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - Extra button: PC蛋蛋 - {AA2F655A-7618-499D-B0A5-4F84B91D2C5F} - C:\WINDOWS\System32\PCEggs.dll
O9 - Extra 'Tools' menuitem: PC蛋蛋 - {AA2F655A-7618-499D-B0A5-4F84B91D2C5F} - C:\WINDOWS\System32\PCEggs.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b}? - D:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b}? - D:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6}? - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6}? - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O16 - DPF: Aces Up! by pogo - http://game2.eapogo.com.cn/applet-6.7.5.20/aces/aces-zh_CN.cab
O16 - DPF: Fighting Landlord by Pogo - http://game2.eapogo.com.cn/applet-6.7.5.27/landlord/landlord-zh_CN.cab
O16 - DPF: Harvest Mania by pogo - http://game2.eapogo.com.cn/applet-6.7.5.20/harvest/harvest-zh_CN.cab
O16 - DPF: Mah Jong Garden by pogo - http://game2.eapogo.com.cn/applet-6.8.1.26/mahjong/mahjong-zh_CN.cab
O16 - DPF: Poppit by pogo - http://game2.eapogo.com.cn/applet-6.7.5.27/poppit2/poppit2-zh_CN.cab
O16 - DPF: Quick Quack by pogo - http://game2.eapogo.com.cn/applet-6.8.1.26/hotstreak/hotstreak-zh_CN.cab
O16 - DPF: Squelchies by pogo - http://game2.eapogo.com.cn/applet-6.7.5.20/squelchies/squelchies-zh_CN.cab
O16 - DPF: Stellar Sweeper by pogo - http://game2.eapogo.com.cn/applet-6.8.1.26/sweeper/sweeper-zh_CN.cab
O16 - DPF: Tri-Peaks by pogo - http://game2.eapogo.com.cn/applet-6.7.5.20/peaks/peaks-zh_CN.cab
O16 - DPF: Wonderland Memories by pogo - http://game2.eapogo.com.cn/applet-6.8.2.19/memories/memories-zh_CN.cab
O16 - DPF: {C09B522F-8AED-4E21-A65C-DC1AB652BAEE} (Tencent Safety Online Base Module) - http://safe.qq.com/cgi-bin/tso/TSOBase.ocx
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
