一开机自动打开system32文件夹~~好奇怪....
Logfile of HijackThis v1.99.1
Scan saved at 10:54:40, on 2007-2-23
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\VM_STI.EXE
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\explorer.exe
E:\Program Files\HijackThis\HijackThis.exe

O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - e:\Program Files\Thunder\ComDlls\XunLeiBHO_002.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [StormCodec_Helper] "e:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera L
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: 使用迅雷下载 - e:\Program Files\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: 使用迅雷下载全部链接 - e:\Program Files\Thunder\Program\GetAllUrl.htm
O10 - Unknown file in Winsock LSP: c:\windows\system32\espi11.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\espi11.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1153208072552
O17 - HKLM\System\CCS\Services\Tcpip\..\{01A89511-E63D-4AAC-8C3A-3AC040674584}: NameServer = 202.102.128.68,202.102.134.68
O17 - HKLM\System\CS1\Services\Tcpip\..\{01A89511-E63D-4AAC-8C3A-3AC040674584}: NameServer = 202.102.128.68,202.102.134.68
O17 - HKLM\System\CS2\Services\Tcpip\..\{01A89511-E63D-4AAC-8C3A-3AC040674584}: NameServer = 202.102.128.68,202.102.134.68
O20 - AppInit_DLLs: APIHookDll.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: ASP.NET 状态服务 (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe


谢谢各位了~~~

以下项目可能有问题：
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k        
//关闭windows错误报告

O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera L    
//摄像头相关程序，运行MSconfig，去掉试试。

O10 - Unknown file in Winsock LSP: c:\windows\system32\espi11.dll      
O10 - Unknown file in Winsock LSP: c:\windows\system32\espi11.dll
//金山毒霸升级精灵留下的东西，看你现在在用nod32,这个应该没用了，备份注册表中HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\ESPI11这个项，然后删除该项,备份删除c:\windows\system32\espi11.dll。

O23 - Service: ASP.NET 状态服务 (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
//把这个服务禁用。

再按这篇文章检查一下：http://support.microsoft.com/?kbid=170086

"开始"-“运行”输入：msconfig回车
打开“启动”选项卡，除“ctfmon”前打对号，其他的都别选，确定、重起看看，
如果还是那样，那就是中病毒了！！！杀毒先！！！

其实为了排除问题，所有的启动项都可以先禁用。

会不会是shell那块出什么问题了？

注册表的问题...
我拿去年的注册表恢复了一下，竟然搞定了，我都不知道怎么回事....