想用手动删除 BDC.exe 也找不到（在安全模式，显示所有文件及后缀名下也试过了）
以下我是现在的日志内容:
HijackThis_zww汉化版扫描日志 V1.99.1
保存于 19:39:43, 日期 2005-12-9
操作系统： Windows XP (WinNT 5.01.2600)
浏览器： Internet Explorer v6.00 SP1 (6.00.2600.0000)
当前运行的进程：
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rising\Rav\Ravmond.exe
C:\Program Files\Rising\rfw\rfwsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\Program Files\Rising\rfw\RfwMain.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\D-Tools\daemon.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\InterVideo\WinDVR\WinScheduler.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\MsPMSPSv.exe
D:\Tencent\TT\TTraveler.exe
E:\我的下载\编程技巧\2535952005811174944\HijackThis1991zww.exe
O1 - Hosts: 202.109.251.32 www.fjxm.cn.net
O1 - Hosts: 207.46.20.60 www.microsoft.com
O1 - Hosts: 219.136.244.113 dl.pconline.com.cn
O1 - Hosts: 210.34.213.6 cj.xmlju.edu.cn
O1 - Hosts: 61.152.147.182 www.muchina.com
O1 - Hosts: 210.51.170.68 www.ktsky.net
O1 - Hosts: 218.30.28.92 www.crossgate.com.cn
O1 - Hosts: 222.73.7.247 ro.gameflier.com.cn
O1 - Hosts: 219.239.89.28 www.enet.com.cn
O1 - Hosts: 61.151.255.105 dlgame.pchome.net
O1 - Hosts: 61.153.183.61 www.poco.cn
O1 - Hosts: 222.208.183.15 bt.btchina.net
O1 - Hosts: 202.167.234.181 cxok.net
O1 - Hosts: 211.147.7.186 www.cncard.com
O1 - Hosts: 202.104.236.80 www.1359.net
O1 - Hosts: 210.51.170.68 www.ktsky.net
O1 - Hosts: 202.105.31.84 www.bofu.com.cn
O1 - Hosts: 218.30.8.103 avl.com.cn
O1 - Hosts: 218.16.122.211 www.mir3.com.cn
O1 - Hosts: 61.172.57.214 www.ribo-cn.com
O1 - Hosts: 220.181.18.61 post.baidu.com
O1 - Hosts: 219.239.89.33 happy.enet.com.cn
O1 - Hosts: 219.239.89.28 www.enet.com.cn
O1 - Hosts: 219.153.18.140 www.coolpili.com
O1 - Hosts: 61.129.91.131 passport.the9.com
O1 - Hosts: 61.157.237.40 www.ibook8.com
O1 - Hosts: 218.93.127.167 push.cb.kingsoft.com
O1 - Hosts: 219.133.51.24 jump.qq.com
O1 - Hosts: 218.16.227.145 www.hunhun8.com
O1 - Hosts: 61.172.243.54 gamezone.qq.com
O1 - Hosts: 219.136.248.118 www.it.com.cn
O1 - Hosts: 207.46.20.60 www.microsoft.com
O1 - Hosts: 207.46.20.60 www.microsoft.com
O1 - Hosts: 207.46.20.60 www.microsoft.com
O1 - Hosts: 207.46.20.60 www.microsoft.com
O1 - Hosts: 219.142.91.11 www.icbc.com.cn
O1 - Hosts: 207.46.20.60 www.microsoft.com
O1 - Hosts: 211.138.155.1 www.xmmcc.com.cn
O1 - Hosts: 211.138.151.193 fj.12530.com
O1 - Hosts: 211.157.99.24 www.a.com.cn
O2 - BHO: QQBrowserHelper
Object Class - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\Tencent\qq\QQIEHelper.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\FLASHGET\jccatch.dll
O3 - IE工具栏增项: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\FLASHGET\fgiebar.dll
O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - IE工具栏增项: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\System32\KakaTool.dll
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [SoundMan] SOUNDMAN.EXE
O4 - 启动项HKLM\\Run: [nwiz] nwiz.exe /install
O4 - 启动项HKLM\\Run: [MS-4011 Memory Patch] E:\我的下载\编程技巧\RavSasser.exe -Patch
O4 - 启动项HKLM\\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - 启动项HKLM\\Run: [MS04_028 Memory Patch] E:\我的下载\编程技巧\RavJPG.exe -Patch
O4 - 启动项HKLM\\Run: [DAEMON Tools-1033] "D:\D-Tools\daemon.exe" -lang 1033
O4 - 启动项HKLM\\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: 腾讯QQ.lnk = D:\Tencent\qq\QQ.exe
O4 - Global Startup: InterVideo WinScheduler.lnk = C:\Program Files\InterVideo\WinDVR\WinScheduler.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - D:\Tencent\qq\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载 - D:\FlashGet\jc_link.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链接 - D:\FlashGet\jc_all.htm
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - D:\Tencent\qq\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - D:\Tencent\qq\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - D:\Tencent\qq\SendMMS.htm
O9 - 浏览器额外的按钮: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_01\bin\npjpi141_01.dll
O9 - 浏览器额外的“工具”菜单项: Sun Java 控制台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_01\bin\npjpi141_01.dll
O9 - 浏览器额外的按钮: TOL24 - {345ff7d8-2364-4ef7-889b-7d3c1d0bd342} - http://www.TOL24.com (file missing)
O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Tencent\qq\QQ.EXE
O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Tencent\qq\QQ.EXE
O9 - 浏览器额外的按钮: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Tencent\qq\QQIEHelper.dll
O9 - 浏览器额外的“工具”菜单项: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Tencent\qq\QQIEHelper.dll
O9 - 浏览器额外的按钮: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} (Edit Class) - https://www.sz1.cmbchina.com/download/CMBEdit.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {2761225D-F0F2-44E8-A2C9-476FB6A3316A} (QQLive TRadio Control) - http://dl_dir.qq.com/qqtools/trsetup.exe
O16 - DPF: {3D8F74EE-8692-4F8F-B8D2-7522E732519E} (WebActivater Control) - http://game.qq.com/QQGame2.cab
O16 - DPF: {40CFEA79-ED5B-4B2B-8B8D-B567E40AF812} (sslclient Control) - http://www.tol24.com/download/ocx/sslclientnew.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/30f969366abd4da4d314/netzip/RdxIE601_cn.cab
O16 - DPF: {59CCB4A0-727D-11CF-AC36-00AA00A47DD2} (Timer
Object) - http://activex.microsoft.com/controls/iexplorer/x86/ietimer.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1100778432491
O16 - DPF: {65A2AF26-BF84-49FA-B0AA-BC57B7B656A5} (XINTVClientAuthX Control) - http://www.xintv.com/shcentell/xinhua/download/XINTVClientAuthX.cab
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O16 - DPF: {9675ABBF-8D0B-4956-868C-934B5A7928D4} (Npv Control) - https://nprotect.lineage2.com.cn/nprotect/nprotect2004/ncsoft/npv.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {D6FCA8ED-4715-43DE-9BD2-2789778A5B09} (NPKCX Control) - https://nprotect.lineage2.com.cn/nprotect/keycrypt/npkcx.cab
O16 - DPF: {F138084D-84D7-48CD-BEA8-04772457516E} (VqqSpeedDlProxy Class) - http://218.85.138.27/vqqsdl1009.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2AD3AAD1-2DF6-4C7C-8C22-5DCCDAE97DB1}: NameServer = 218.85.157.99 202.101.103.55
O17 - HKLM\System\CS2\Services\Tcpip\..\{2AD3AAD1-2DF6-4C7C-8C22-5DCCDAE97DB1}: NameServer = 218.85.157.99 202.101.103.55
O18 - 列举现有的协议: dic - {C21F5C32-F57A-4A0D-8E0A-B672691C52D0} - C:\Kingsoft\XDictExB.dll
O23 - NT 服务: npkcsvc - INCA Internet Co., Ltd. - C:\WINDOWS\System32\npkcsvc.exe
O23 - NT 服务: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - C:\Program Files\Rising\rfw\rfwsrv.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
