启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [Microsoft Corporation]
    <BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}><; "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe">  []
    <eMuleAutoStart><; ; F:\Program Files\eMule\eMule.exe -AutoStart>  []
    <Kugoo><; ; C:\PROGRA~1\KuGoo\kugoo.exe>  []
    <MsnMsgr><; ; "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background>  []
    <PcSync><; ; C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog>  []
    <UniTuner><; ; >  []
    <Wireless Presenter><; ; C:\Program Files\Nokia\Nokia Wireless Presenter\Wireless Presenter.exe /NOSPLASH>  []
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  []
    <run><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <AdslTime><C:\Program Files\WsSoft\上网计时\AdslTime.exe hide>  []
    <NvCplDaemon><; RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>  [NVIDIA Corporation]
    <Realplayer.exe><; C:\WINDOWS\system32\Realplayer.exe>  []
    <Realplayer.e|?><; C:\WINDOWS\system32\Realplayer.exe>  []
    <SsAAD.exe><; C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [Microsoft Corporation]

==================================
启动文件夹
[蓝牙控制盘]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\蓝牙控制盘.lnk><N>
[Winamp (2)]
  <C:\Documents and Settings\Haoqiangxu\「开始」菜单\程序\启动\Winamp (2).lnk><N>

==================================
服务
[Adobe LM Service / Adobe LM Service]
  <"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>
[Bluetooth Service / btwdins]
  <C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe><Broadcom Corporation.>
[Macromedia Licensing Service / Macromedia Licensing Service]
  <"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><N/A>
[MSCSPTISRV / MSCSPTISRV]
  <"C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe"><Sony Corporation>
[MD Simple Burner Service / NetMDSB]
  <C:\Program Files\Sony\MD Simple Burner\NetMDSB.exe><Sony Corporation>
[NVIDIA Display Driver Service / NVSvc]
  <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[PACSPTISVR / PACSPTISVR]
  <"C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe"><Sony Corporation>
[Rising Proxy  Service / RfwProxySrv]
  <c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService]
  <c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter]
  <"C:\Program Files\rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Sony SPTI Service / SPTISRV]
  <"C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe"><Sony Corporation>
[SonicStage SCSI Service / SSScsiSV]
  <C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe><Sony Corporation>

==================================
浏览器加载项
[FlashGet Bar]
  {E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FlashGet\fgiebar.dll, Amaze Soft>
[CyberArticle Express]
  {769A6A36-ED24-4376-BC7C-80225BF35698} <F:\D盘文件\CyberArticle\CyberArticle\CAExp.dll, shijun.com>
[Windows Live Toolbar]
  {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} <C:\Program Files\Windows Live Toolbar\msntb.dll, N/A>
[Adobe PDF Reader Link Helper]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, N/A>
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, N/A>
[IeCatch2 Class]
  {A5366673-E8CA-11D3-9CD9-0090271D075B} <C:\PROGRA~1\FlashGet\jccatch.dll, N/A>
[]
  {A9930D97-9CF0-42A0-A10D-4F28836579D5} <C:\PROGRA~1\KuGoo2\KUGOO3~1.OCX, N/A>
[Windows Live Toolbar]
  {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} <C:\Program Files\Windows Live Toolbar\msntb.dll, N/A>
[Windows Live Toolbar Helper]
  {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} <C:\Program Files\Windows Live Toolbar\msntb.dll, N/A>
[NTIECatcher Class]
  {C56CB6B0-0D96-11D6-8C65-B2868B609932} <C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll, N/A>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[GMBar]
  {FD9936EF-C90D-4914-9EAB-699612B11A47} <C:\WINDOWS\csapix.dll, N/A>

[&使用迅雷下载]
  <C:\Program Files\Sandai Technologies Inc\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
  <C:\Program Files\Sandai Technologies Inc\Thunder\Program\GetAllUrl.htm, N/A>
[上传到QQ网络硬盘]
  <C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用网际快车下载]
  <C:\Program Files\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
  <C:\Program Files\FlashGet\jc_all.htm, N/A>
[添加到QQ自定义面板]
  <C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 396][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 444][\??\C:\WINDOWS\system32\csrss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 468][\??\C:\WINDOWS\system32\winlogon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 512][C:\WINDOWS\system32\services.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\wshcon32.dll]  <><4, 1, 0, 0>
[PID: 532][C:\WINDOWS\system32\lsass.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 696][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 744][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\wshcon32.dll]  <><4, 1, 0, 0>
[PID: 824][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\wshcon32.dll]  <><4, 1, 0, 0>
[PID: 960][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1028][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1056][c:\program files\rising\rfw\rfwsrv.exe]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 32>
    [c:\program files\rising\rfw\RfwRule.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 13>
    [c:\program files\rising\rfw\rfwlog.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 6>
    [c:\program files\rising\rfw\Rfwdrv.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 21>
    [c:\program files\rising\rfw\MonDrv.dll]  <rs><1, 0, 0, 4>
    [c:\program files\rising\rfw\ProcLib.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 9>
[PID: 1192][C:\WINDOWS\system32\spoolsv.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\bthcrp.dll]  <Broadcom Corporation.><5.1.0.1100>
    [C:\WINDOWS\system32\WidcommSdk.dll]  <Broadcom Corporation.><5.1.0.1100>
    [C:\WINDOWS\system32\wbtapi.dll]  <Broadcom Corporation.><5.1.0.1100>
    [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll]  <Windows (R) 2000 DDK provider><5.00.2195.1620>
[PID: 1496][C:\WINDOWS\Explorer.EXE]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll]  <Adobe Systems, Inc.><7.0.0.0>
    [C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll]  <N/A><N/A>
    [C:\Program Files\rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 1584][c:\program files\rising\rfw\RfwMain.exe]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 52>
    [c:\program files\rising\rfw\RsGuiLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23>
    [c:\program files\rising\rfw\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [c:\program files\rising\rfw\PngDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 1656][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1672][C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe]  <Broadcom Corporation.><5.1.0.1100>
[PID: 1732][C:\WINDOWS\system32\nvsvc32.exe]  <NVIDIA Corporation><6.14.10.5672>
[PID: 1868][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1336][C:\Program Files\WsSoft\上网计时\AdslTime.exe]  <Ws-Soft><2, 2, 4, 0>
[PID: 1420][C:\WINDOWS\system32\ctfmon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1960][C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe]  <Broadcom Corporation.><5.1.0.1100>
    [C:\WINDOWS\system32\wbtapi.dll]  <Broadcom Corporation.><5.1.0.1100>
    [C:\WINDOWS\system32\btosif.dll]  <Broadcom Corporation.><5.1.0.1100>
    [C:\WINDOWS\system32\btwhidcs.DLL]  <Broadcom Corporation.><5.1.0.1100>
    [C:\Program Files\WIDCOMM\Bluetooth Software\BtBalloon.dll]  <Broadcom Corporation.><5.1.0.1100>
    [C:\WINDOWS\system32\btrez.dll]  <Broadcom Corporation.><5.1.0.1100>
    [C:\WINDOWS\system32\CSH.dll]  <Blue Sky Software Corporation><2.00.039>
    [C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll]  <N/A><N/A>
[PID: 1968][C:\Program Files\Winamp\Winamp.exe]  <Nullsoft><5.03a>
    [C:\Program Files\Winamp\Plugins\in_asfs.dll]  <AudioSoft><1.30>
    [C:\Program Files\Winamp\Plugins\in_cdda.dll]  <N/A><N/A>
    [C:\Program Files\Winamp\Plugins\in_dshow.dll]  <N/A><N/A>
    [C:\Program Files\Winamp\Plugins\in_midi.dll]  <N/A><N/A>
    [C:\Program Files\Winamp\Plugins\read_file.dll]  <N/A><N/A>
    [C:\Program Files\Winamp\Plugins\in_mod.dll]  <N/A><N/A>
    [C:\Program Files\Winamp\Plugins\in_mp3.dll]  <N/A><N/A>
    [C:\Program Files\Winamp\Plugins\in_mp4.dll]  <N/A><N/A>
    [C:\Program Files\Winamp\Plugins\in_nsv.dll]  <N/A><N/A>
    [C:\Program Files\Winamp\Plugins\in_vorbis.dll]  <N/A><N/A>
    [C:\Program Files\Winamp\Plugins\in_vqf.dll]  <N/A><N/A>
    [C:\Program Files\Winamp\Plugins\in_wave.dll]  <N/A><N/A>
    [C:\Program Files\Winamp\Plugins\in_wm.dll]  <N/A><N/A>
    [C:\Program Files\Winamp\Plugins\out_disk.dll]  <N/A><N/A>
    [C:\Program Files\Winamp\Plugins\out_ds.dll]  <N/A><N/A>
    [C:\Program Files\Winamp\Plugins\out_ds_ssrc.dll]  <N/A><N/A>
    [C:\Program Files\Winamp\Plugins\out_KB51chn.dll]  <N/A><N/A>
    [C:\Program Files\Winamp\Plugins\out_wave.dll]  <N/A><N/A>
    [C:\Program Files\Winamp\Plugins\out_wave_ssrc.dll]  <N/A><N/A>
    [C:\Program Files\Winamp\Plugins\gen_ctrlfreak.dll]  <N/A><N/A>
    [C:\Program Files\Winamp\Plugins\vis_ctrlfreak.dll]  <N/A><N/A>
    [C:\Program Files\Winamp\Plugins\gen_hotkeys.dll]  <N/A><N/A>
    [C:\Program Files\Winamp\Plugins\gen_jumpex.dll]  <N/A><N/A>
    [C:\Program Files\Winamp\Plugins\gen_ml.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\PXDRV.DLL]  <Sonic Solutions><1.01.34a>
    [C:\WINDOWS\system32\PXMAS.DLL]  <Sonic Solutions><2.4.4.501>
    [C:\WINDOWS\system32\PXWAVE.DLL]  <Sonic Solutions><2.4.4.501>
    [C:\Program Files\Winamp\Plugins\gen_tray.dll]  <N/A><N/A>
[PID: 320][C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE]  <Broadcom Corporation.><5.1.0.1100>
    [C:\WINDOWS\system32\btins.dll]  <Broadcom Corporation.><5.1.0.1100>
    [C:\WINDOWS\system32\btosif.dll]  <Broadcom Corporation.><5.1.0.1100>
    [C:\WINDOWS\system32\BtAudioHelper.dll]  <Broadcom Corporation.><5.1.0.1100>
    [C:\WINDOWS\system32\btrez.dll]  <Broadcom Corporation.><5.1.0.1100>
    [C:\WINDOWS\system32\CSH.dll]  <Blue Sky Software Corporation><2.00.039>
    [C:\WINDOWS\system32\btosif_ol.dll]  <Broadcom Corporation.><5.1.0.1100>
    [C:\WINDOWS\system32\btosif_olx.dll]  <Broadcom Corporation.><5.1.0.1100>
    [C:\WINDOWS\system32\btosif_notes.dll]  <Broadcom Corporation.><5.1.0.1100>
[PID: 3228][C:\Documents and Settings\Haoqiangxu\桌面\sreng2\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>
    [C:\WINDOWS\system32\wshcon32.dll]  <><4, 1, 0, 0>

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

这次的日志少了这么多的?
很谢谢你.
我在C:\WINDOWS\system32\下删除不了wshcon32.dll.
我找不到C:\WINDOWS\system32\目录下的msupdater.exe
"www.7939.com"这个好像用超级白兔子时已经删了.现在还会弹出那个窗口出来(如下图)
被"www.7939.com"劫持的一个特征是任务管理器里的进程里有"Realplayer.exe"但我的是没有的,而且是也没有发现Realplayer.exe这个文件,可能真被超级白兔子搞掂了.
不过我发现有时会出现一个"iexplore.ee"和"iexplore.exe"这两个进程会自动消失的,没试过同时出现,出现时我没有打开IE浏览器的.

楼主有两项没有修复，这两项都是病毒
可以按我以下的方法和我无邪朋友的方法修复

C:\WINDOWS\system32\Realplayer.exe

启动项
C:\WINDOWS\system32\Realplayer.exe
C:\WINDOWS\system32\Realplayer.exe
运行中的程序
C:\WINDOWS\system32\brlmon.dll

解决方法
解决方法如下
双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示确定更改时，单击“是”，清除“隐藏已知文件类型的扩展名
ALT+CTRL+DELETE调出任务管理器,终止explorer.exe 还有Realplayer.exe的进程
点“文件”“新任务”“浏览”找到C:\WINDOWS\system32\Realplayer.exe
删除Realplayer.exe
点“文件”“新任务”“浏览”找到C:\WINDOWS\explorer.exe,双击打开


运行(双击)System Repair Engineer，使用“启动项目，注册表”来删除以下选项。
C:\WINDOWS\system32\Realplayer.exe
C:\WINDOWS\system32\Realplayer.exe
删除
C:\WINDOWS\system32\brlmon.dll
把主页改回来。


运行LSPFix.exe
删除
wshcon32.dll
附说明一份
LSPFix.exe这个软件主要用来辅助修复HijackThis扫描发现的O10项。
使用时，请关闭所有IE界面和文件夹界面后运行LSPFix，运行后，把要修复的那一个O10项从左边转到右边，点“Finish”即可。（不过这之前，需要在“I know what I`m doing”前面打勾。）
双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示确定更改时，单击“是”，清除“隐藏已知文件类型的扩展名
删除
C:\WINDOWS\system32\wshcon32.dll
C:\WINDOWS\system32\msupdater.exe
修复后重启，如果无法上网，请运行WinsockXPFix，让它修复一下。

回到正常模式，请再扫日志粘上来。

谢谢高手.
我按你们的提示去做,发现找不到"brlmon.dll""Realplayer.exe"“msupdater.exe”任务管理器里也发现不了Realplayer.exe这个进程.
我的电脑不知为什么不能"显示隐藏文件夹"但我可以用搜索,搜索隐藏文件.
"wshcon32.dll"就删不了。
LSPFix修复O10项wshcon32.dll已经很多次了，但是你说没有修复，所以我想是不是有些什么问题使之不能修复.

楼主看一下此贴

http://forum.ikaka.com/topic.asp?board=67&artid=8162074

接贴子上面的去修复

到安全模式下