F2 - REG:system.ini: Shell=Explorer.exe vchelp.exe
F2 - REG:system.ini: UserInit=userinit.exe,C:\WINDOWS\system\svchost.exe
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AdPopup - {11F09AFD-75AD-4E51-AB43-E09E9351CE16} - C:\Program Files\Common Files\CPUSH\cpush0.dll
O2 - BHO: Info cache - {385AB8C6-FB22-4D17-8834-064E2BA0A6F0} - C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll
O2 - BHO: ff Class - {B9751A53-4494-4d7c-9732-AE3058D8145F} - C:\WINDOWS\system32\3051.dll
O2 - BHO: Windows Messenger Assistant - {C86488AF-13D5-4FEF-9DDF-9FB88698CFC1} - C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\USERDATA\webbrowser_3104.dll
O4 - HKLM\..\Run: [AVPSrv] C:\WINDOWS\AVPSrv.exE
O4 - HKLM\..\Run: [SSLDyn] C:\WINDOWS\SSLDyn.exe
O4 - HKLM\..\Run: [Kvsc3] C:\WINDOWS\Kvsc3.exE
O4 - HKLM\..\Run: [DbgHlp32] C:\WINDOWS\DbgHlp32.exe
O4 - HKLM\..\Run: [mppds] C:\WINDOWS\mppds.exe
O4 - HKLM\..\Run: [NVDispDrv] C:\WINDOWS\NVDispDRV.EXE
O4 - HKLM\..\Run: [cmdbcs] C:\WINDOWS\cmdbcs.exe
O4 - HKLM\..\Run: [upxdnd] C:\WINDOWS\upxdnd.exe
O4 - HKLM\..\Run: [msccrt] C:\WINDOWS\msccrt.exe
O4 - HKLM\..\Run: [MsIMMs32] C:\WINDOWS\MsIMMs32.exE
O4 - HKLM\..\Run: [PTSShell] C:\WINDOWS\PTSShell.exe
O4 - HKLM\..\Run: [LotusHlp] C:\WINDOWS\LotusHlp.exe
O4 - HKLM\..\Run: [MsPrint32D] C:\WINDOWS\MsPrint32D.exe
O4 - HKCU\..\Run: [kava] C:\WINDOWS\system32\kavo.exe
O4 - HKLM\..\Policies\Explorer\Run: [MSDEG32] LYLoader.exe
O4 - HKLM\..\Policies\Explorer\Run: [MSDWG32] LYLoadbr.exe
O4 - HKLM\..\Policies\Explorer\Run: [MSDCG32 ] LYLeador.exe
O4 - HKLM\..\Policies\Explorer\Run: [MSDOG32] LYLoador.exe
O4 - HKLM\..\Policies\Explorer\Run: [MSDSG32] LYLoadar.exe
O4 - HKLM\..\Policies\Explorer\Run: [MSDMG32] LYLoadmr.exe
O4 - HKLM\..\Policies\Explorer\Run: [MSDHG32] LYLoadhr.exe
O4 - HKLM\..\Policies\Explorer\Run: [MSDQG32] LYLoadqr.exe
O9 - Extra button: 珨懂秞氈扦 - {7DBC6ADB-5788-4FB9-AEC3-B40A58AC11DF} -
http://www.yiqilai.com (file missing)
O9 - Extra button: 參考資料 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\雜七雜八\OFFICE11\REFIEBAR.DLL (file missing)
O9 - Extra button: 眢劃昜 - {EE60714F-AC17-427e-861A-FD60CBDF119A} -
http://click2.ad4all.net/url2/urlmanage/url.asp?id=824 (file missing)
O9 - Extra 'Tools' menuitem: 眢劃昜 - {EE60714F-AC17-427e-861A-FD60CBDF119A} -
http://click2.ad4all.net/url2/urlmanage/url.asp?id=824 (file missing)
O23 - Service: 2A3F0910 - Unknown owner - C:\WINDOWS\system32\796A0F30.EXE
O23 - Service: Fax 2Client (ms_2fax) - Unknown owner - C:\WINDOWS\system32\05db1.exe
O23 - Service: ServicevcHelp - Unknown owner - C:\WINDOWS\system32\vcplay.exe
說真的, 建議你重裝系統比較快.....
若要手動清理乾淨, 很麻煩的:
1. 勾選並修復上述項目, 重新開機, 刪除與上述項目有關的檔案
2. 在 DOS 下 c:\ 分別執行下列命令:
attrib -r -h -s autorun.inf
attrib -r -h -s Ntdelect.com
del autorun.inf
del Ntdelect.com (注意! 不是 NTDETECT.COM)
3. 執行 System Repair Engineer
http://www.kztechs.com/sreng/download.html
"系統修復" => "高級修復" => "自動修復"
4. 重新開機, 在檔案總管 "資料夾選項" 內設成 "顯示所有檔案和資料夾 "
再把每個磁碟 (含 USB 隨身碟) 根目錄下的 autorun.inf 全部刪除
5. 清空C:\Documents and Settings\Administrator\Local Settings\Temp 目錄