是下载QQ引起的。重装了很多次，只要一上网就会中毒，重装也没办法。用卡巴斯基杀过，效果不大。

帮帮我，我被这个搞得很晕了。维修店那可能也中了这个病毒，我这电脑中毒就是与他们有关，所以我也不拿去给他们折腾了。

Logfile of HijackThis v1.99.1
Scan saved at 17:39:21, on 2006-7-16
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
D:\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\conime.exe
D:\avp.exe
C:\WINDOWS\system32\SuService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\锐捷网络\Ruijie Supplicant\8021x.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
D:\ha_hijackthis_1991\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ACDSee\ACDSee.exe
D:\讯雷\unins000.exe
C:\Program Files\ACDSee\ACDSee.exe
C:\WINDOWS\explorer.exe
F:\HijackThis.exe

F3 - REG:win.ini: load=C:\WINDOWS\rundl132.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [kav] "D:\avp.exe"
O4 - HKLM\..\RunServices: [Supplicant] c:\program files\锐捷网络\ruijie supplicant\8021x.exe -Boot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: 使用影音传送带下载 - C:\Program Files\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: 使用影音传送带下载全部链接 - C:\Program Files\Xi\NetTransport 2\NTAddList.html
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\scieplugin.dll
O9 - Extra button: 微软 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.microsoft.com/china/index.htm (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - D:\avp.exe
O23 - Service: Supplicant Service - Unknown owner - C:\WINDOWS\system32\SuService.exe

抢小生的沙发！

F3 - REG:win.ini: load=C:\WINDOWS\rundl132.exe
这个就是病毒，资料见：http://topchn.cnfan.net/?action/viewspace/itemid/72

具体说这么清除——

删除
C:\WINDOWS\rundl132.exe
C:\Program Files\svhost32.exe
C:\WINDOWS\System32\ztdll.dll

以下文件如果有，也都删除
C:\WINDOWS\1.com
C:\WINDOWS\1SY.EXE
C:\WINDOWS\smss.exe
C:\WINDOWS\finders.com
C:\WINDOWS\EXP10RER.com
C:\WINDOWS\exerouter.exe
C:\WINDOWS\System32\rund1132.com
C:\WINDOWS\System32\command.pif
C:\WINDOWS\System32\MSCONFIG.COM
C:\WINDOWS\System32\dxdiag.com
C:\WINDOWS\System32\regedit.com
C:\WINDOWS\Debug\DebugProgram.exe
C:\progra~1\intern~1\inexplore.com
C:\progra~1\common~1\inexplore.pif
C:\WINDOWS\2SY.EXE
C:\WINDOWS\LSASS.exe
C:\WINDOWS\EXERT.exe
C:\WINDOWS\System32\MSCONFIG.COM
C:\WINDOWS\System32\dxdiag.com
C:\WINDOWS\System32\regedit.com
C:\WINDOWS\Debug\DebugProgram.exe
C:\progra~1\intern~1\INTEXPLORE.com
C:\progra~1\common~1\INTEXPLORE.pif
D:\command.com
D:\command.com
D:\_desktop.ini

搜索vDll.dll并删除。

在注册表里头清理
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
"load"="C:\WINDOWS\rundl132.exe"
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
"load"="C:\PROGRA~1\svhost32.exe"
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
"TProgram"="C:\WINDOWS\smss.exe"
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
"ToP"="C:\WINDOWS\LSASS.exe"

以下注册表项如果能找到，也都清理干净——

HKLM\SOFTWARE\Classes\htmlfile\shell\open\command
(Default)=""C:\Program Files\Internet Explorer\inexplore.com" -nohome"
HKCR\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command
(Default)=""C:\Program Files\Internet Explorer\inexplore.com""
HKCR\ftp\shell\open\command
(Default)=""C:\Program Files\Internet Explorer\inexplore.com" %1"
HKCR\htmlfile\shell\open\command
(Default)=""C:\Program Files\Internet Explorer\inexplore.com" -nohome"
HKCR\htmlfile\shell\opennew\command
(Default)=""C:\Program Files\common~1\inexplore.pif""
HKCR\http\shell\open\command
(Default)=""C:\Program Files\common~1\inexplore.pif" -nohome"
HKLM\SOFTWARE\Classes\http\shell\open\command
(Default)=""C:\Program Files\common~1\inexplore.pif" -nohome"
HKCR\Drive\shell\find\command
(Default)="%SystemRoot%\EXP10RER.com"
HKLM\SOFTWARE\Classes\htmlfile\shell\open\comman
(Default)=""C:\Program Files\Internet Explorer\inexplore.com" -nohome"
HKCR\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command
(Default)=""C:\Program Files\Internet Explorer\inexplore.com""
HKCR\ftp\shell\open\command
(Default)=""C:\Program Files\Internet Explorer\inexplore.com" %1"
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Cookies="C:\Documents and Settings\jjwen1\Cookies"
HKCR\htmlfile\shell\open\command
(Default)=""C:\Program Files\Internet Explorer\inexplore.com" -nohome"
HKCR\htmlfile\shell\opennew\command
(Default)=""C:\Program Files\common~1\inexplore.pif""
HKCR\http\shell\open\command
(Default)=""C:\Program Files\common~1\inexplore.pif" -nohome"
HKLM\SOFTWARE\Classes\http\shell\open\command
(Default)=""C:\Program Files\common~1\inexplore.pif" -nohome"
HKCR\WindowFiles\shell\open\command
(Default)="C:\WINDOWS\EXERT.exe "%1" %*"
HKCR\.exe
(Default)="WindowFiles"

完了。


另外：
O23 - Service: Supplicant Service - Unknown owner - C:\WINDOWS\system32\SuService.exe
这个网上没人说明白了它是什么，但是http://help.lockergnome.com/general/default-ftopict17023.html 和 http://www.castlecops.com/modules.php?name=Forums&file=viewtopic&p=136133 两个大佬级论坛都建议修复掉。

又及：
楼兰的卡巴是直接安装在D盘根目录下面的？很特别。