瑞星卡卡安全论坛

浏览网页被提醒说有Trojan DL. VBS. Agent. cmf病毒，我想杀一遍毒，但是瑞星已无法响应。重启后，监控日志显示病毒已经被清除。我再杀一遍，杀到c:\windows下面某个文件或是文件包的时候，电脑突然关机，如此反复开机关机多次，始终无法查出病毒，也不知道确切感染的文件。后来监控又提示有Trojan DL. IEFrame.ak 和Trojan DL. IEFrame.al，都被直接删除，我按照路径，将temporary internet..里的所有临时文件和cookies删除。重新杀毒害是在那一块就死机。昨天按照论坛里的办法，查net user的时候，发现有什么assistant和另外一个乱七八糟的使用者，我就删掉了，结果连admin也删掉了，只留了administrator和 guest，结果今天登陆，发现我的邮件和一些东西都不见了，真是快死了。从服务器导入邮件的时候，连续收到3个邮件监控的提示说有病毒邮件，不知道是不是黑客已经在我重新设置帐号的时候盗取了我的密码。
我扫描了日志，但是我不会看，请大家帮忙我查查到底问题何在。谢谢！
瑞星根本没有提示有病毒,但是扫到那里就死机,应该一定有什么东西在吧.以下为日志.

[CODE]

2007-05-16,13:33:42

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
    <MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background>  [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Publisher]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Publisher]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows Publisher]
    <MSPY2002><C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC>  [(Verified)Microsoft Windows Publisher]
    <VTTimer><VTTimer.exe>  [(Verified)Microsoft Windows Publisher]
    <IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload>  [(Verified)Microsoft Corporation]
    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot>  [RealNetworks, Inc.]
    <CorelDRAW SA 11f><; C:\Program Files\Corel\Corel Graphics 11\Register\registration.exe /title="CorelDRAW SA 11" /date=053007 serial=DS11CRF-0362846-YCK>  [Corel Corporation]
    <Install Alitalk><; C:\WINDOWS\temp\alitalk\alitalk.exe -hideframe>  [N/A]
    <Acrobat Assistant 7.0><"E:\Program Files\Adobe7.0 professional\Distillr\Acrotray.exe">  [Adobe Systems Inc.]
    <SetDefPrt><C:\Program Files\Brother\Brmfl04a\BrStDvPt.exe>  [Brother Industories, Ltd.]
    <ControlCenter2.0><C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun>  [Brother Industries, Ltd.]
    <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
    <KernelFaultCheck><%systemroot%\system32\dumprep 0 -k>  [N/A]
    <runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe>  [Beijing Rising Technology Co., Ltd.]
    <RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup>  [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows XP Publisher]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]

==================================
启动文件夹
[Adobe Acrobat Speed Launcher]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Acrobat Speed Launcher.lnk --> C:\WINDOWS\Installer\{AC76BA86-2052-0000-7760-100000000002}\SC_Acrobat.exe [N/A]><N>

==================================
服务
[Brother Popup Suspend service for Resource manager / brmfrmps][Running/Auto Start]
  <"C:\WINDOWS\system32\Brmfrmps.exe" -service ><Brother Industries, Ltd.>
[BrSplService / Brother XP spl Service][Running/Auto Start]
  <C:\WINDOWS\system32\brsvc01a.exe><brother Industries Ltd>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Rising Proxy  Service / RfwProxySrv][Stopped/Manual Start]
  <c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService][Running/Auto Start]
  <c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
  <"D:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
  <"C:\Program Files\Rising\Rav\RavMonD.exe"><Beijing Rising Technology Co., Ltd.>

==================================
驱动程序
[138515 / 138515][Running/Boot Start]
  <\SystemRoot\System32\drivers\138515.sys><N/A>
[AliIde / AliIde][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\aliide.sys><N/A>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
  <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[Brother USB Still Image driver / BrScnUsb][Running/Manual Start]
  <System32\Drivers\BrScnUsb.sys><Brother Industries Ltd.>
[CmdIde / CmdIde][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\cmdide.sys><CMD Technology, Inc.>
[ExpScaner / ExpScaner][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\ExpScan.sys><>
[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Stopped/Manual Start]
  <system32\DRIVERS\fetnd5.sys><N/A>
[HookCont / HookCont][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\HookSys.sys><Rising>
[HookUrl / HookUrl][Running/Auto Start]
  <\??\C:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[MegaIDE / MegaIDE][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\MegaIDE.sys><LSI Logic Corporation.>
[MEMSCAN / MEMSCAN][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\MEMSCAN.sys><瑞星软件有限公司>
[mProcRs / mProcRs][Running/Auto Start]
  <\??\c:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[npkcrypt / npkcrypt][Stopped/Auto Start]
  <\??\E:\Program Files\npkcrypt.sys><N/A>
[nv / nv][Stopped/Manual Start]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
  <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[RsFwDrv / RsFwDrv][Running/Auto Start]
  <\??\C:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
  <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\RSPPSYS.sys><Rising>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[SetupNT / SetupNT][Running/Auto Start]
  <\SystemRoot\system32\SetupNT.sys><N/A>
[viagfx / viagfx][Running/Manual Start]
  <system32\DRIVERS\vtmini.sys><Copyright (C) VIA/S3 Graphics Co, Ltd.>
[ViaIde / ViaIde][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\viaide.sys><Microsoft Corporation>
[Vinyl AC'97 Audio Controller (WDM) / VIAudio][Running/Manual Start]
  <system32\drivers\vinyl97.sys><VIA Technologies, Inc.>

==================================

浏览器加载项
[Adobe PDF Reader Link Helper]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <E:\Program Files\Adobe7.0 professional\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[]
  {3DD98C55-74CC-4B7C-B5F1-45913F368388} <C:\WINDOWS\DOWNLO~1\urn.dll, Microsoft>
[IeCatch2 Class]
  {A5366673-E8CA-11D3-9CD9-0090271D075B} <C:\Program Files\FlashGet\jccatch.dll, www.flashget.com>
[Adobe PDF Conversion Toolbar Helper]
  {AE7CD045-E861-484f-8273-0445EE161910} <E:\Program Files\Adobe7.0 professional\Acrobat\AcroIEFavClient.dll, Adobe Systems Incorporated>
[FlashGet GetFlash Class]
  {F156768E-81EF-470C-9057-481BA8380DBA} <C:\Program Files\FlashGet\getflash.dll, www.flashget.com>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <E:\Program Files\QQ.EXE, N/A>
[快车]
  {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\Program Files\FlashGet\FlashGet.exe, FlashGet.com>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[快车(FlashGet)]
  {E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[Adobe PDF]
  {47833539-D0C5-4125-9FA8-0819E2EAAC93} <E:\Program Files\Adobe7.0 professional\Acrobat\AcroIEFavClient.dll, Adobe Systems Incorporated>
[卡卡上网安全助手]
  {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\KakaTool.dll, Beijing Rising Technology Co., Ltd.>
[Edit Class]
  {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\WINDOWS\system32\CMBEdit.dll, >
[Windows Genuine Advantage Validation Tool]
  {17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft Corporation>
[PowerList Control]
  {20C2C286-BDE8-441B-B73D-AFA22D914DA5} <C:\DOCUME~1\Admin\APPLIC~1\ppStream\100~1.140\POWERL~1.OCX, PPStream.com>
[]
  {3DD98C55-74CC-4B7C-B5F1-45913F368388} <C:\WINDOWS\DOWNLO~1\urn.dll, Microsoft>
[CEditCtrl Object]
  {488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\system32\aliedit\AliEdit.dll, www.alipay.com>
[MSN Photo Upload Tool]
  {4F1E5B1A-2A80-42CA-8532-2D05CB959537} <C:\WINDOWS\Downloaded Program Files\MsnPUpld.dll, Microsoft? Corporation>
[GLAvatar Control]
  {61238DE1-3317-4322-89AC-AC844831380D} <F:\PROGRA~1\联众\GLAVAT~1.OCX, >
[WUWebControl Class]
  {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[AxInputControl Class]
  {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\WINDOWS\DOWNLO~1\CONFLICT.1\INPUTC~1.DLL, >
[MessengerStatsClient Class]
  {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} <C:\WINDOWS\Downloaded Program Files\messengerstatsclient.dll, Microsoft Corporation>
[LiveMediaOcx Control]
  {9242BB35-0DB0-43AC-8DFC-8EA07E63B92A} <C:\PROGRA~1\Tencent\QQLive\QQLive.ocx, Tencent>
[Chaos Filter]
  {AB89C9BF-9250-473B-BE49-D34F615CB678} <C:\WINDOWS\system32\chaos.ax, Gaov Info Tech Co, LTD.>
[TV Stream Source]
  {BE9535B7-76FB-4572-AD20-B32BADB3643B} <C:\WINDOWS\system32\FAggr.ax, www.sina.com.cn>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[PhotoUpload Control]
  {DE3496D2-AFB9-47EB-A8C2-C3B330222513} <C:\WINDOWS\DOWNLO~1\PHOTOU~1.OCX, 网 易>
[PopCapLoader Object]
  {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} <C:\WINDOWS\Downloaded Program Files\popcaploader.dll, PopCap Games>
[CPPMediaCtrl Object]
  {FCD61199-E187-4ADD-88E5-9AF238486D11} <C:\WINDOWS\system32\forcetv.dll, 北京原力创新科技有限公司>
[Adobe PDF Reader Link Helper]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <E:\Program Files\Adobe7.0 professional\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[]
  {3DD98C55-74CC-4B7C-B5F1-45913F368388} <C:\WINDOWS\DOWNLO~1\urn.dll, Microsoft>
[Adobe PDF]
  {47833539-D0C5-4125-9FA8-0819E2EAAC93} <E:\Program Files\Adobe7.0 professional\Acrobat\AcroIEFavClient.dll, Adobe Systems Incorporated>
[Shell Name Space]
  {55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[IeCatch2 Class]
  {A5366673-E8CA-11D3-9CD9-0090271D075B} <C:\Program Files\FlashGet\jccatch.dll, www.flashget.com>
[Adobe PDF Conversion Toolbar Helper]
  {AE7CD045-E861-484F-8273-0445EE161910} <E:\Program Files\Adobe7.0 professional\Acrobat\AcroIEFavClient.dll, Adobe Systems Incorporated>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[卡卡上网安全助手]
  {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\KakaTool.dll, Beijing Rising Technology Co., Ltd.>
[快车(FlashGet)]
  {E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[FlashGet GetFlash Class]
  {F156768E-81EF-470C-9057-481BA8380DBA} <C:\Program Files\FlashGet\getflash.dll, www.flashget.com>
[转换为 Adobe PDF]
  <res://E:\Program Files\Adobe7.0 professional\Acrobat\AcroIEFavClient.dll/AcroIECapture.html, N/A>
[转换为现有 PDF]
  <res://E:\Program Files\Adobe7.0 professional\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html, N/A>
[转换选定的链接为 Adobe PDF]
  <res://E:\Program Files\Adobe7.0 professional\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html, N/A>
[转换选定的链接为现有 PDF]
  <res://E:\Program Files\Adobe7.0 professional\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html, N/A>
[转换选项为 Adobe PDF]
  <res://E:\Program Files\Adobe7.0 professional\Acrobat\AcroIEFavClient.dll/AcroIECapture.html, N/A>
[转换选项为现有 PDF]
  <res://E:\Program Files\Adobe7.0 professional\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html, N/A>
[转换链接目标为 Adobe PDF]
  <res://E:\Program Files\Adobe7.0 professional\Acrobat\AcroIEFavClient.dll/AcroIECapture.html, N/A>
[转换链接目标为现有 PDF]
  <res://E:\Program Files\Adobe7.0 professional\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html, N/A>

==================================
正在运行的进程
[PID: 424][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 500][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 224][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\mp3infp.dll]  [win32lab.com, 2.44.3.0]
    [E:\Program Files\Adobe7.0 professional\ActiveX\PDFShell.dll]  [Adobe Systems, Inc., 7.0.0.0]
    [E:\Program Files\Adobe7.0 professional\ActiveX\PDFShell.CHS]  [Adobe Systems, Inc., 7.0.0.0]
    [C:\WINDOWS\DOWNLO~1\urn.dll]  [Microsoft, 1.3.2.69]
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [E:\Program Files\Adobe7.0 professional\ActiveX\AcroIEHelper.dll]  [Adobe Systems Incorporated, 7.0.9.2006121800]
    [C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
[PID: 908][c:\program files\rising\rfw\RfwMain.exe]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 72]
    [c:\program files\rising\rfw\RsGuiLib.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33]
    [c:\program files\rising\rfw\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [c:\program files\rising\rfw\RfwCtrl.dll]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]
    [c:\program files\rising\rfw\RsXML.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
    [c:\program files\rising\rfw\PngDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
    [E:\Program Files\Adobe7.0 professional\Acrobat Elements\ContextMenu.chs]  [Adobe Systems Inc., 7.0.5.2005092300\0]
[PID: 2000][C:\WINDOWS\system32\VTTimer.exe]  [S3 Graphics, Inc., 1.04.04-0901]
[PID: 2072][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.1622]
[PID: 2096][E:\Program Files\Adobe7.0 professional\Distillr\Acrotray.exe]  [Adobe Systems Inc., 7.0.7.2006011200]
    [E:\Program Files\Adobe7.0 professional\Distillr\Acrotray.chs]  [, ]
[PID: 2132][C:\Program Files\Brother\ControlCenter2\brctrcen.exe]  [Brother Industries, Ltd., 2, 0, 8, 0]
    [C:\Program Files\Brother\ControlCenter2\LTDIS12n.dll]  [LEAD Technologies, Inc., 12.1.0.009]
    [C:\Program Files\Brother\ControlCenter2\LTKRN12n.dll]  [LEAD Technologies, Inc., 12.1.0.012]
    [C:\Program Files\Brother\ControlCenter2\LTFIL12n.DLL]  [LEAD Technologies, Inc., 12.1.0.009]
    [C:\Program Files\Brother\ControlCenter2\brccfile.dll]  [Brother Industries, Ltd., 2, 0, 8, 0]
    [C:\Program Files\Brother\ControlCenter2\brctcchn.DLL]  [Brother Industries, Ltd., 2, 0, 2, 2]
    [C:\Program Files\Brother\ControlCenter2\BRCCWIA.DLL]  [Brother Industries, Ltd., 2, 0, 8, 0]
[PID: 2300][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2528][C:\Program Files\Messenger\msmsgs.exe]  [Microsoft Corporation, 4.7.3001]
[PID: 3744][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3520][C:\Program Files\Rising\Rav\RsAgent.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 12]
    [C:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
[PID: 3108][C:\WINDOWS\msagent\AgentSvr.exe]  [Microsoft Corporation, 2.00.0.3424]
[PID: 3860][F:\Program Files\SREng\新建文件夹\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================


[/CODE]

没人来帮忙看一下吗？
我自己看看好像没有发现什么问题
但是为什么杀毒软件杀到windows下面就关机了？
刚刚又关了三次，即使在安全模式下面也一样
我快疯了~

重装吧~= =

注册表删除：
<Install Alitalk><; C:\WINDOWS\temp\alitalk\alitalk.exe -hideframe> [N/A]
驱动删除：
[SetupNT / SetupNT][Running/Auto Start]
<\SystemRoot\system32\SetupNT.sys><N/A>
然后把对应文件删掉。
删完啥结果回来说一声

先谢谢楼上的回复，这么热心，当然要鼓励的！
但是我比较了以前的没有带病毒时候的日志，这两个进程都是存在的，也就是应该没有问题了。我是电脑菜鸟，所以不敢贸然行动
<Install Alitalk><; C:\WINDOWS\temp\alitalk\alitalk.exe -hideframe> [N/A]这个是一个谈话软件
电脑运行基本没有问题，就是杀毒就死机。我都不知道怎么死的，盼高手指点。

哦，那注册表那个就不用了。
那个驱动要删。
看证据：
http://virus.ywan.com/fangzhi/2007/1/1/3013003495145_2.html
http://www.x5dj.com/UserForum/ThreadDetail.aspx?UserID=209520&ThreadID=314270&Page=5000