朋友的电脑很多木马总杀不干净，高手帮忙看看

阵风

Network\Thunder\Plugins\BhoAdv\bho_adv.dll]  [深圳市迅雷网络技术有限公司, 1.0.1.0]
    [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\klscav.dll]  [Kaspersky Lab, 6.0.1.411]
    [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prremote.dll]  [Kaspersky Lab, 6.0.1.411]
    [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll]  [Kaspersky Lab, 6.0.1.411]
    [C:\WINDOWS\system32\VB6CHS.DLL]  [Microsoft Corporation, 6.00.8988]
    [D:\Program Files\Microsoft Office\OFFICE11\msostyle.dll]  [Microsoft Corporation, 11.0.5510]
    [D:\Program Files\Microsoft Office\OFFICE11\GdiPlus.DLL]  [Microsoft Corporation, 6.0.3260.0]
    [C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FPERSON.DLL]  [Microsoft Corporation, 11.0.5510]
    [C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\2052\stintl.dll]  [Microsoft Corporation, 11.0.5510]
    [C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\MOFL.DLL]  [Microsoft Corporation, 11.0.5510]
    [C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSXML5.DLL]  [Microsoft Corporation, 5.00.2916.0]
    [C:\Program Files\Common Files\Microsoft Shared\Smart Tag\CHDATEST.DLL]  [Microsoft Corporation, 2.00]
    [C:\Program Files\Common Files\Microsoft Shared\Smart Tag\Chinese Measurement Converter\CHMETCNV.DLL]  [Microsoft Corp., 1.00]
    [C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FDATE.DLL]  [Microsoft Corporation, 11.0.5510]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\INTLNAME.DLL]  [Microsoft Corporation, 11.0.5315]
    [C:\Program Files\Common Files\Microsoft Shared\PROOF\mslid.dll]  [Microsoft Corporation, 1.0.2305]
    [C:\Program Files\Common Files\Microsoft Shared\PROOF\2052\MSGR3SC.DLL]  [Microsoft Corporation, 3.0.1707.0]
    [C:\WINDOWS\system32\IMSC40A.IME]  [Microsoft Corporation, 6.0.0.2527]
    [C:\Program Files\Common Files\Microsoft Shared\PROOF\2052\MSGR3EN.DLL]  [Microsoft Corporation, 3.1.2303]
    [C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL]  [Microsoft Corporation, 11.0.5510]
    [C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mdiui.dll]  [Microsoft Corporation, 11.3.1897.0]
    [C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mdigraph.dll]  [Microsoft Corporation, 11.3.1897.0]
[PID: 1472 / Administrator][C:\Program Files\MSN Messenger\msnmsgr.exe]  [Microsoft Corporation, 8.1.0178.00]
    [C:\Program Files\MSN Messenger\MSNCore.dll]  [Microsoft Corporation, 8.1.0178.00]
    [C:\Program Files\MSN Messenger\msidcrl40.dll]  [Microsoft Corporation, 4.100.313.1]
    [C:\Program Files\MSN Messenger\ContactsUX.dll]  [Microsoft Corporation, 8.1.0178.00]
    [C:\Program Files\MSN Messenger\msgslang.8.1.0178.00.dll]  [Microsoft Corporation, 8.1.0178.00]
    [C:\Program Files\MSN Messenger\msgsres.dll]  [Microsoft Corporation, 8.1.0178.00]
    [C:\WINDOWS\system32\SOGOUPY.IME]  [Sohu.com Inc., 3, 0, 0, 0]
    [d:\Program Files\SogouInput\Plugin\SgImeWord.dll]  [, 1, 0, 0, 31]
    [C:\Program Files\MSN Messenger\MSGSWCAM.dll]  [Microsoft Corporation, 8.1.0178.00]
    [C:\WINDOWS\system32\sirenacm.dll]  [Microsoft Corp., 8.1.0178.00]
    [C:\WINDOWS\system32\msdmo.dll]  [, ]
    [C:\Program Files\MSN Messenger\lmcdata.dll]  [Microsoft Corporation, 8.1.0178.00]
    [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scrchpg.dll]  [Kaspersky Lab, 1.0.6.411]
    [C:\Program Files\MSN Messenger\custsat.dll]  [Microsoft Corporation, 9.0.3790.2428 (srv03_sp1_qfe.050422-1043)]
    [C:\Program Files\MSN Messenger\abssm.dll]  [Microsoft Corporation, 8.1.0178.00]
    [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\klscav.dll]  [Kaspersky Lab, 6.0.1.411]
    [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prremote.dll]  [Kaspersky Lab, 6.0.1.411]
    [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll]  [Kaspersky Lab, 6.0.1.411]
    [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prkernel.ppl]  [Kaspersky Lab, 6.0.1.411]
    [d:\program files\kaspersky lab\kaspersky anti-virus 6.0\params.ppl]  [Kaspersky Lab, 6.0.1.411]
    [d:\program files\kaspersky lab\kaspersky anti-virus 6.0\pxstub.ppl]  [Kaspersky Lab, 6.0.1.411]
    [d:\program files\kaspersky lab\kaspersky anti-virus 6.0\tempfile.ppl]  [Kaspersky Lab, 6.0.1.411]
    [C:\Program Files\MSN Messenger\contact.dll]  [Microsoft Corporation, 8.1.0178.00]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 736 / Administrator][D:\Program Files\安装软件\cmqq2007Beta4v19\QQ.exe]  [TENCENT, 7,0,365,1701]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\QQBaseClassInDll.dll]  [TENCENT, 7,0,365,1701]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\QQHelperDll.dll]  [TENCENT, 7,0,365,1701]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\BasicCtrlDll.dll]  [TENCENT, 7,0,365,1701]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\MFC42.DLL]  [Microsoft Corporation, 6.00.8665.0]
    [C:\WINDOWS\system32\SOGOUPY.IME]  [Sohu.com Inc., 3, 0, 0, 0]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\RICHED32.DLL]  [Microsoft Corporation, 5.00.2134.1]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\MailSummary.dll]  [TENCENT, 7,0,365,1701]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\QQKnowledgeSearch.dll]  [TENCENT, 7,0,365,1701]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\QQAllInOne.dll]  [TENCENT, 7,0,365,1701]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\SCCore.dll]  [TENCENT, 1, 6, 0, 2]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\QQSpace.dll]  [TENCENT, 7,0,365,1701]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\vbscript.dll]  [N/A, ]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\aqing.dll]  [Microsoft Corporation, 5.6.0.8825]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\AddrSearch.dll]  [腾讯科技（深圳）有限公司, 2, 1, 9, 95]
    [C:\WINDOWS\system32\msdmo.dll]  [, ]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\QQGroupMng.dll]  [TENCENT, 7,0,365,1701]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\UserDefinedHead.dll]  [TENCENT, 7,0,365,1701]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\QQPlugin.dll]  [N/A, ]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\QQConfigPlugin.dll]  [TENCENT, 7,0,365,1701]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\QQAvatar.dll]  [N/A, ]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\QQCustomFace.dll]  [N/A, ]
    [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scrchpg.dll]  [Kaspersky Lab, 1.0.6.411]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\l3codeca.acm]  [Fraunhofer Institut Integrierte Schaltungen IIS, 1, 9, 0, 0305]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\QQPet.dll]  [TENCENT, 7,0,365,1701]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\QRingMng.dll]  [N/A, ]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\LongConnection.dll]  [TENCENT, 7,0,365,1701]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\QQSysMsgMng.dll]  [N/A, ]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\ImageOle.dll]  [TENCENT, 7,0,365,1701]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\QQLiveQMng.dll]  [TENCENT, 7,0,365,1701]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\QQMagicFace.dll]  [TENCENT, 7,0,365,1701]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\QQSceneMng.dll]  [N/A, ]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\BQQApplication.dll]  [N/A, ]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\CommercesMng.dll]  [TENCENT, 7,0,365,1701]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\PersonalDesktop.dll]  [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\QQAddr.dll]  [深圳市腾讯计算机系统有限公司, 5, 0, 101, 320]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\QQSettingCtrl.dll]  [TENCENT, 7,0,365,1701]
    [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\klscav.dll]  [Kaspersky Lab, 6.0.1.411]
    [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prremote.dll]  [Kaspersky Lab, 6.0.1.411]
    [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll]  [Kaspersky Lab, 6.0.1.411]
    [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prkernel.ppl]  [Kaspersky Lab, 6.0.1.411]
    [d:\program files\kaspersky lab\kaspersky anti-virus 6.0\params.ppl]  [Kaspersky Lab, 6.0.1.411]
    [d:\program files\kaspersky lab\kaspersky anti-virus 6.0\pxstub.ppl]  [Kaspersky Lab, 6.0.1.411]
    [d:\program files\kaspersky lab\kaspersky anti-virus 6.0\tempfile.ppl]  [Kaspersky Lab, 6.0.1.411]
    [D:\Program Files\安装软件\cmqq2007Beta4v19\GroupConnection.dll]  [TENCENT, 7,0,365,1701]
[PID: 3628 / Administrator][D:\Program Files\安装软件\新建文件夹\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
    [C:\WINDOWS\system32\SOGOUPY.IME]  [Sohu.com Inc., 3, 0, 0, 0]
    [d:\Program Files\SogouInput\Plugin\SgImeWord.dll]  [, 1, 0, 0, 31]
    [D:\Program Files\安装软件\新建文件夹\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]

==================================
文件关联
.TXT  Error. [C:\WINDOWS\notepad.exe %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  Error. ["hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1       localhost

==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 3692, D:\PROGRAM FILES\安装软件\TTPLAYER\TTPLAYER.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3748, D:\PROGRAM FILES\安装软件\GREENBROWSER\GREENBROWSER.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2956, D:\PROGRAM FILES\THUNDER NETWORK\THUNDER\PROGRAM\THUNDER5.EXE]

==================================
API HOOK
RVA  错误： LoadLibraryA (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA  错误： LoadLibraryExA (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA  错误： LoadLibraryExW (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA  错误： LoadLibraryW (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA  错误： GetProcAddress (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)

==================================
隐藏进程
N/A

==================================


[/CODE]

风雪

进入安全模式用下面的工具，清理系统临时文件和IE临时文件夹      
http://hzqedison.mm9mm.com/hanhua/ATF-Cleaner-cn.exe
用xdelbox(http://www.i170.com/attach/ACE2E7C9-25BF-4A78-AECC-504D9918F8CD下载)删除下面文件（按住鼠标左键向下拖动，用鼠标从第一行拖动从上往下到最后一行，右键复制，或者（添入“文件路径”点击“添加”路径），在xdelbox窗口空白处点右键-从剪贴板导入,在抑制再生前打钩,在要删除文件上点击右键，选择立刻重启删除,运行xdelbox前最好卸载所有可移动存储介质（包括U盘，MP3，手机存储卡等））。
C:\WINDOWS\system32\mbfofy.dll
C:\WINDOWS\System32\Drivers\bootdrv.sys
C:\WINDOWS\System32\DRIVERS\ezarts.sys
C:\WINDOWS\System32\drivers\kfqbpf.sys
C:\WINDOWS\system32\mssock.sys
C:\WINDOWS\system32\npkycryp.sys
C:\WINDOWS\system32\drivers\vx8pmmkjz.sys
C:\WINDOWS\system32\znlbzujsrpwgr.dll
C:\WINDOWS\system32\WinFormA6.dll
C:\WINDOWS\system32\jzipri.dll
C:\WINDOWS\system32\qhfpri.dll
C:\WINDOWS\system32\mxbman.dll
C:\WINDOWS\system32\qjgpri.dll
C:\WINDOWS\system32\dhepri.dll
C:\WINDOWS\system32\system.dat

运行SREng——启动项目——注册表删除下面的。
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{ACADABAF-1000-0010-8000-10AA006D2EA4}><C:\WINDOWS\system32\system.dat>  [N/A]
    <{52311A42-AC1B-158F-FD32-5674345F23A5}><C:\WINDOWS\system32\dhepri.dll>  []
    <{74123FF1-8371-9834-9021-184518451FA7}><C:\WINDOWS\system32\qjgpri.dll>  [N/A]
    <{2231A43A-1642-641A-64FD-146ADAB223B2}><C:\WINDOWS\system32\mxbman.dll>  [N/A]
    <{66368135-64FA-BC34-DA32-DCF4FD431C96}><C:\WINDOWS\system32\qhfpri.dll>  [N/A]
    <{959AFD5B-159F-ACD8-954C-ACD545FA6589}><C:\WINDOWS\system32\jzipri.dll>  [N/A]
    <{B12BC423-3713-224D-3F55-32B35C62B11B}><C:\WINDOWS\system32\WinFormA6.dll>  [N/A]

运行 System Repair Engineer在"启动项目->服务->"驱动程序"选中"隐藏微软服务" 然后将下面名称的服务
"修改启动类型"->"disable"->"设置"
"删除服务"->"设置"->"否" (注意: 按"否"是确认删除服务,按"是"为取消操作)
[bootdrv / bootdrv][Stopped/Boot Start]
  <\SystemRoot\System32\Drivers\bootdrv.sys><N/A>
[ezart / ezarts][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\ezarts.sys><N/A>
[kfqbpf / kfqbpf][Stopped/Boot Start]
  <\SystemRoot\\SystemRoot\System32\drivers\kfqbpf.sys><N/A
[mssock / mssock][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\mssock.sys><N/A>
[npkycryp / npkycryp][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\npkycryp.sys><N/A>
[vx8pmmkjz / vx8pmmkjz][Stopped/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\vx8pmmkjz.sys><N/A>


运行SREng——系统修复——浏览器加载项找到下面删除
  {C74CDF30-68C2-49B4-9918-EBD66B8D9FBF} <C:\WINDOWS\system32\znlbzujsrpwgr.dll, >



Windows清理助手升级查一下：
http://www.arswp.com/download/arswp2/arswp2.zip

阵风

谢谢

酉生

用AVG-antispyware在安全模式杀杀。