进程里有个160sa.exe的进程找不到文件！启动每次都有，恶意软件清理助手清理失败deskadtop.安全模式进入兰屏！扫描一份srenglog.log大虾们分析一下！谢谢！
System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
  所有的启动项目（包括注册表、启动文件夹、服务等）
  浏览器加载项
  正在运行的进程（包括进程模块信息）
  文件关联
  Winsock 提供者
  Autorun.inf
  HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
  <{3A2C080E-0680-2052-0325-030407280056}><"C:\Program Files\Common Files\{3A2C080E-0680-2052-0325-030407280056}\Update.exe" te-110-12-0000113> [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <load><> [N/A]
  <run><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <cFosDNT><D:\CFOSSPEED\cFosDNT.exe> [cFos Software GmbH]
  <agv><D:\AVG Anti-Spyware 7.5\avgas.exe> [Anti-Malware Development a.s.]
  <IEBarUp><RunDll32 "C:\WINDOWS\system32\IeBar1.dll",Run> [Microsoft Corporation]
  <Desktop><"C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\NTService32.dll",Run> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <shell><Explorer.exe> [(Verified)Microsoft Corporation]
  <Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <UIHost><logonui.exe> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  <WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll> [(Verified)Microsoft Corporation]
  <NetWork><> [N/A]

==================================
启动文件夹
N/A

==================================
服务
[Ati HotKey Poller / Ati HotKey Poller]
<C:\WINDOWS\system32\Ati2evxx.exe><N/A>
[ATI Smart / ATI Smart]
<C:\WINDOWS\system32\ati2sgag.exe><>
[AVG Anti-Spyware Guard / AVG Anti-Spyware Guard]
<d:\AVG Anti-Spyware 7.5\guard.exe><Anti-Malware Development a.s.>
[DNS Cache / BRGNS]
<C:\WINDOWS\SYSTEM32\RUNDLL32.EXE C:\WINDOWS\SYSTEM32\WBEM\SBRVQF05.DLL,Export 1087><N/A>
[System Security / ClipArt]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\lrntoe24.dll><Microsoft Corporation>
[Human Interface Device Access / HidServ]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Network DDE / NetDDE]
<C:\WINDOWS\system32\netdde.exe><Microsoft Corporation>
[Network DDE DSDM / NetDDEdsdm]
<C:\WINDOWS\system32\netdde.exe><Microsoft Corporation>
[WindowsNt Workstation / NTWorkStan]
<C:\WINDOWS\System32\svchost.exe -k NTWorkStan-->c:\windows\system32\NTWorkStan.dll><N/A>
[RestoreService / RestoreService]
<C:\WINDOWS\system32\Svchost.exe -k RestoreService-->C:\WINDOWS\system32\drivers\service.dll><N/A>
[Remote Procedure Call (RPC) Locator / RpcLocator]
<C:\WINDOWS\system32\locator.exe><Microsoft Corporation>
[QoS RSVP / RSVP]
<C:\WINDOWS\system32\rsvp.exe><Microsoft Corporation>
[Smart Card / SCardSvr]
<C:\WINDOWS\System32\SCardSvr.exe><Microsoft Corporation>
[Win-SMOS / SMOSWin]
<C:\Windows\system32\JNTXEKP.EXE><N/A>
[Telnet / TlntSvr]
<C:\WINDOWS\system32\tlntsvr.exe><Microsoft Corporation>
[Windows NT Service32 / Windows NT Service32]
<"C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\NTService32.dll",Start><N/A>
[Windows Media Player Network Sharing Service / WMPNetworkSvc]
<C:\Program Files\Windows Media Player\WMPNetwk.exe><Microsoft Corporation>

==================================
驱动程序
[8865093 / 8865093]
<C:\WINDOWS\SYSTEM32\DRIVERS\8865093.SYS><N/A>
[ati2mtag / ati2mtag]
<system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[AVG Anti-Spyware Driver / AVG Anti-Spyware Driver]
<\??\d:\AVG Anti-Spyware 7.5\guard.sys><N/A>
[AVG Anti-Spyware Clean Driver / AvgAsCln]
<System32\DRIVERS\AvgAsCln.sys><GRISOFT, s.r.o.>
[bhfdifhf / bhfdifhf]
<\SystemRoot\system32\drivers\bhfdifhf.sys><N/A>
[cFosNT / cFosNT]
<\SystemRoot\System32\Drivers\cFosNT.sys><cFos Software GmbH>
[cgcoe / cgcoe]
<\??\C:\WINDOWS\system32\drivers\cgcoe.sys><N/A>
[dtscsi / dtscsi]
<\SystemRoot\System32\Drivers\dtscsi.sys><N/A>
[jr / jr]
<\??\C:\WINDOWS\system32\drivers\jr.sys><N/A>
[msqmx / msqmx]
<\SystemRoot\system32\drivers\msqmx.sys><Microsoft Corporation>
[npkcrypt / npkcrypt]
<\??\D:\qq\qq\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[nvatabus / nvatabus]
<\SystemRoot\system32\DRIVERS\nvatabus.sys><NVIDIA Corporation>
[Service for NVIDIA(R) nForce(TM) Audio Enumerator / nvax]
<system32\drivers\nvax.sys><NVIDIA Corporation>
[NVIDIA nForce Networking Legacy Driver / NVENET]
<system32\DRIVERS\NVENET.sys><NVIDIA Corporation>
[Service for NVIDIA(R) nForce(TM) Audio / nvnforce]
<system32\drivers\nvapu.sys><NVIDIA Corporation>
[NVIDIA nForce AGP Bus Filter / nv_agp]
<\SystemRoot\system32\DRIVERS\nv_agp.sys><NVIDIA Corporation>
[oxoktg4 / oxoktg40]
<\SystemRoot\System32\DRIVERS\oxoktg40.sys><N/A>
[Motorola USB Device / P2k]
<system32\DRIVERS\P2k.sys><Motorola Inc>
[Direct Parallel Link Driver / Ptilink]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Secdrv / Secdrv]
<system32\DRIVERS\secdrv.sys><Macrovision Europe Ltd>
[SmartAVS / SmartAVS]
<\??\C:\WINDOWS\system32\drivers\SmartAVS.sys><All-In-Smart [CWJ]>
[sptd / sptd]
<\SystemRoot\System32\Drivers\sptd.sys><N/A>
[spywao07 / spywao07]
<\??\C:\WINDOWS\system32\drivers\spywao07.sys><Microsoft Corporation>
[TAP-Win32 Adapter V8 / tap0801]
<system32\DRIVERS\tap0801.sys><The OpenVPN Project>
[TCP/IP Protocol Driver / Tcpip]
<system32\DRIVERS\tcpip.sys><Microsoft Corporation>
[TSP / TSP]
<\??\C:\WINDOWS\system32\drivers\klif.sys><N/A>
[Windows Driver Foundation - User-mode Driver Framework Platform Driver / WudfPf]
<system32\DRIVERS\WudfPf.sys><Microsoft Corporation>

==================================
浏览器加载项
[IDMIEHlprObj Class]
{0055C089-8582-441B-A0BF-17B458C2A3A8} <D:\IDM\IDMIECC.dll, Tonec Inc.>
[IEMonitor Class]
{08A312BB-5409-49FC-9347-54BB7D069AC6} <C:\WINDOWS\system32\deskipn.dll, >
[超级兔子上网精灵]
{7369D35A-5B70-4A5B-B789-B25FE09B4AF3} <D:\MAGICSET\haokanbar.dll, Xiang Feng Technology>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <D:\网络快车\Thunder530220_byLHych\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>
[超级兔子上网精灵]
{43869BB3-22FD-4F15-9B46-238106BA2F4E} <D:\MAGICSET\haokanbar.dll, Xiang Feng Technology>
[Office Genuine Advantage Validation Tool]
{05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} <C:\WINDOWS\system32\OGACheckControl.DLL, N/A>
[Windows Genuine Advantage Validation Tool]
{17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft Corporation>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[IDMIEHlprObj Class]
{0055C089-8582-441B-A0BF-17B458C2A3A8} <D:\IDM\IDMIECC.dll, Tonec Inc.>
[IEMonitor Class]
{08A312BB-5409-49FC-9347-54BB7D069AC6} <C:\WINDOWS\system32\deskipn.dll, >
[超级兔子上网精灵]
{43869BB3-22FD-4F15-9B46-238106BA2F4E} <D:\MAGICSET\haokanbar.dll, Xiang Feng Technology>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[超级兔子上网精灵]
{7369D35A-5B70-4A5B-B789-B25FE09B4AF3} <D:\MAGICSET\haokanbar.dll, Xiang Feng Technology>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <D:\网络快车\Thunder530220_byLHych\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>
[888Bar]
{C004DEC2-2623-438E-9CA2-C9043AB28508} <C:\Program Files\Common Files\{3A2C080E-0680-2052-0325-030407280056}\888.dll, N/A>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[Download All Links with IDM]
<D:\IDM\IEGetAll.htm, N/A>
[Download with IDM]
<D:\IDM\IEExt.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>

==================================
正在运行的进程
[PID: 668][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 724][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 752][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  [C:\WINDOWS\system32\Ati2evxx.dll] [ATI Technologies Inc., 6.14.10.4146]
[PID: 800][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 812][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 972][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1052][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1080][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1144][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[PID: 1216][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1560][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
  [C:\Windows\system32\LQWBIOTX.DLL] [N/A, 1.0.0.1]
  [D:\IDM\IDMIECC.dll] [Tonec Inc., 3, 0, 0, 1]
  [D:\网络快车\Thunder530220_byLHych\Thunder\ComDlls\XunLeiBHO_002.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 2]
  [D:\IDM\idmmkb.dll] [Tonec Inc., 3, 0, 0, 1]
  [C:\WINDOWS\system32\mmfinfo.dll] [N/A, N/A]
  [C:\WINDOWS\system32\mkunicode.dll] [N/A, N/A]
[PID: 1592][C:\Windows\system32\JNTXEKP.EXE] [N/A, N/A]
[PID: 1972][D:\CFOSSPEED\cFosDNT.exe] [cFos Software GmbH, 7.04.2968]
[PID: 1980][D:\AVG Anti-Spyware 7.5\avgas.exe] [Anti-Malware Development a.s., 7, 5, 0, 50]
  [D:\AVG Anti-Spyware 7.5\engine.dll] [Anti-Malware Development a.s., 4, 2, 0, 15]
[PID: 308][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 384][C:\Program Files\Common Files\16OSA.EXE] [Copyright? Microsoft Corporation 1994-1999. All rights reserved., 9.0.2617]
[PID: 324][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
  [D:\MAGICSET\haokanbar.dll] [Xiang Feng Technology, 2, 2, 0, 1612]
  [D:\IDM\IDMIECC.dll] [Tonec Inc., 3, 0, 0, 1]
  [C:\WINDOWS\system32\deskipn.dll] [, 1, 0, 0, 1]
  [D:\网络快车\Thunder530220_byLHych\Thunder\ComDlls\XunLeiBHO_002.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 2]
[PID: 1760][C:\Program Files\Mozilla Firefox\firefox.exe] [Mozilla Corporation, 1.8.1: 2006101023]
  [C:\Program Files\Mozilla Firefox\js3250.dll] [Netscape Communications Corporation, 4.0]
  [C:\Program Files\Mozilla Firefox\nspr4.dll] [Netscape Communications Corporation, 4.6.3]
  [C:\Program Files\Mozilla Firefox\xpcom_core.dll] [Mozilla Foundation, 1.8.1: 2006101023]
  [C:\Program Files\Mozilla Firefox\plc4.dll] [Netscape Communications Corporation, 4.6.3]
  [C:\Program Files\Mozilla Firefox\plds4.dll] [Netscape Communications Corporation, 4.6.3]
  [C:\Program Files\Mozilla Firefox\smime3.dll] [Mozilla Foundation, 3.11.3 Basic ECC]
  [C:\Program Files\Mozilla Firefox\nss3.dll] [Mozilla Foundation, 3.11.3 Basic ECC]
  [C:\Program Files\Mozilla Firefox\softokn3.dll] [Mozilla Foundation, 3.11.3 Basic ECC]
  [C:\Program Files\Mozilla Firefox\ssl3.dll] [Mozilla Foundation, 3.11.3 Basic ECC]
  [C:\Program Files\Mozilla Firefox\xpcom_compat.dll] [Mozilla Foundation, 1.8.1: 2006101023]
  [C:\Program Files\Mozilla Firefox\components\myspell.dll] [Mozilla Foundation, 1.8.1: 2006101023]
  [C:\Documents and Settings\lxhxp\Application Data\IDM\idmmzcc\components\idmmzcc.dll] [Tonec Inc., 1, 0, 0, 1]
  [C:\Program Files\Mozilla Firefox\xpcom.dll] [Mozilla Foundation, 1.8.1: 2006101023]
  [C:\Program Files\Mozilla Firefox\components\jar50.dll] [Mozilla Foundation, 1.8.1: 2006101023]
  [C:\Program Files\Mozilla Firefox\freebl3.dll] [Mozilla Foundation, 3.11.3 Basic ECC]
  [C:\Program Files\Mozilla Firefox\nssckbi.dll] [Mozilla Foundation, 1.62]
  [C:\Program Files\Mozilla Firefox\components\spellchk.dll] [Mozilla Foundation, 1.8.1: 2006101023]
  [D:\sreng2\SREng\SREng.com] [Smallfrogs Studio, 2.2.6.605]
  [D:\IDM\idmmkb.dll] [Tonec Inc., 3, 0, 0, 1]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

在dos状态下杀毒吧～