最近开机后自动运行iexplore.exe和rundll32.exe，经检查iexplore.exe在C:\Program Files\iNTERNET eXPlORER\目录下,用瑞星专杀工具扫描如下，请教如何解决

HijackThis_zww汉化版扫描日志 V1.99.1
保存于      16:16:55, 日期 2006-6-11
操作系统：  Windows XP SP2 (WinNT 5.01.2600)
浏览器：    Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程：         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
D:\RISING\RAV\CCENTER.EXE
d:\rising\Rav\Ravmond.exe
d:\rising\rfw\rfwsrv.exe
d:\rising\Rav\RavStub.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\iNTERNET eXPlORER\iexplore.exe
d:\rising\rfw\RfwMain.exe
C:\WINDOWS\system32\nvraidservice.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
D:\rising\Rav\RavTask.exe
D:\rising\Rav\Ravmon.exe
D:\Stardock\CursorXP\CursorXP.exe
C:\WINDOWS\system32\ctfmon.exe
D:\rising\Rav\rav.exe
E:\SOFTWARE\TOOLS\SYSTEM\procexp-v10.6h\procexp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\svchost.exe
E:\SOFTWARE\Anti-Virus\IE\HijackThis1991\HijackThis1991zww.exe

R3 - 默认的URLSearchHook丢失。用HijackThis修复
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: ClosePopup Class - {2645D297-DD4B-4DD3-BAB0-34D4BB8F7EE6} - D:\MiniPopupKiller\cpw.dll
O2 - BHO: (no name) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - (no file)
O2 - BHO: QQBrowserHelperObject Class - {54EBD53A-9BC1-480B-966A-843A333CA162} - d:\Tencent\QQ\QQIEHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - E:\SOFTWARE\DOWNLOAD\JetCar-v1.71\jccatch.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {BBE59AF5-EE22-4A3A-AB26-3F774D1B4216} - d:\FolderBox\FolderBox.dll
O2 - BHO: IEHlprObj Class - {C5E5DB7E-46B1-47E6-8447-2E517F269925} - d:\Xplus\GETIE.dll
O2 - BHO: CAdBlocker Object - {E24AD748-155E-4254-B674-4EDF86E7E1DF} - C:\PROGRA~1\Acronis\PRIVAC~1\Blocker.dll
O3 - IE工具栏增项: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - IE工具栏增项: MSN 工具栏 - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\zh-cn\msntb.dll
O3 - IE工具栏增项: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - IE工具栏增项: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - D:\TechSmith\SnagIt 7\SnagItIEAddin.dll
O3 - IE工具栏增项: Steganos Internet Anonym - {00000000-5736-4205-0008-f7ed0776fb27} - d:\steganos internet anonym 2006\sia2006iep.dll
O3 - IE工具栏增项: CyberArticle Express - {769A6A36-ED24-4376-BC7C-80225BF35698} - d:\CyberArticle\CAExp.dll
O3 - IE工具栏增项: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - IE工具栏增项: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - IE工具栏增项: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - 启动项HKLM\\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe
O4 - 启动项HKLM\\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - 启动项HKLM\\Run: [KillCopy] d:\KillSoft\KillCopy\kcresume.exe /startup
O4 - 启动项HKLM\\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - 启动项HKLM\\Run: [RavTask] "d:\rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [RfwMain] "d:\rising\Rfw\rfwmain.exe" -Startup
O4 - HKCU\..\Run: [CursorXP] D:\Stardock\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - IE右键菜单中的新增项目: + Offline &Explorer: Download the link - file://E:\SOFTWARE\IE\Browser\Offline Explorer Enterprise v4.1\Add_UrlO.htm
O8 - IE右键菜单中的新增项目: + Offline E&xplorer: Download the current page - file://E:\SOFTWARE\IE\Browser\Offline Explorer Enterprise v4.1\Add_AllO.htm
O8 - IE右键菜单中的新增项目: Google 搜索(&G) - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - IE右键菜单中的新增项目: RoboForm工具栏 - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - IE右键菜单中的新增项目: Save Flash to GetFlash - res://d:\Superhunter\GetFlash\GetFlash.dll/GetFlash.htm
O8 - IE右键菜单中的新增项目: ★飞火流星 - 添加到 收藏夹 - D:\firedemon\getHtmlURL.htm
O8 - IE右键菜单中的新增项目: ★飞火流星 - 添加到Rss频道 - D:\firedemon\Save.htm
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - D:\Tencent\qq\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 下载页面上的ED2(&K)链接 - d:\eMule\ed2k.html
O8 - IE右键菜单中的新增项目: 使用网际快车下载 - E:\SOFTWARE\DOWNLOAD\JetCar-v1.71\jc_link.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链接 - E:\SOFTWARE\DOWNLOAD\JetCar-v1.71\jc_all.htm
O8 - IE右键菜单中的新增项目: 保存: 完整网页... - d:\CyberArticle\script\Save.htm
O8 - IE右键菜单中的新增项目: 保存: 更多保存内容... - d:\CyberArticle\script\SaveAuto.htm
O8 - IE右键菜单中的新增项目: 保存表单 - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - IE右键菜单中的新增项目: 反向链接 - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - IE右键菜单中的新增项目: 填写表单 - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - IE右键菜单中的新增项目: 定制菜单 - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - IE右键菜单中的新增项目: 导出到 Microsoft Office Excel(&X) - res://D:\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - D:\Tencent\qq\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - D:\Tencent\qq\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 火狐Flash保存 - D:\MultiMedia\FoxFlashplayer\PlugIns\GetFlash.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - D:\Tencent\qq\SendMMS.htm
O8 - IE右键菜单中的新增项目: 类似网页 - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - IE右键菜单中的新增项目: 缓存的网页快照 - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - IE右键菜单中的新增项目: 翻译英文字词(&T) - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - IE右键菜单中的新增项目: 转换为现有 PDF - res://D:\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - IE右键菜单中的新增项目: 转换选定的链接为现有 PDF - res://D:\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - IE右键菜单中的新增项目: 转换选项为现有 PDF - res://D:\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - IE右键菜单中的新增项目: 转换链接目标为现有 PDF - res://D:\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - 浏览器额外的按钮: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Java\jre1.6.0\bin\ssv.dll
O9 - 浏览器额外的“工具”菜单项: Sun Java 控制台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Java\jre1.6.0\bin\ssv.dll
O9 - 浏览器额外的按钮: EmEditor - {239CDCA3-D0CA-4105-91E7-ED0B4DD2106E} - D:\16-EDIT\EmEditor\emeditor.exe
O9 - 浏览器额外的“工具”菜单项: EmEditor - {239CDCA3-D0CA-4105-91E7-ED0B4DD2106E} - D:\16-EDIT\EmEditor\emeditor.exe
O9 - 浏览器额外的按钮: Acronis?Pop-up Blocker - {2E071ADC-ADF8-4b4b-8ACB-EDC49E6D45A2} - C:\PROGRA~1\Acronis\PRIVAC~1\Blocker.dll
O9 - 浏览器额外的“工具”菜单项: Acronis Pop-up Blocker - {2E071ADC-ADF8-4b4b-8ACB-EDC49E6D45A2} - C:\PROGRA~1\Acronis\PRIVAC~1\Blocker.dll
O9 - 浏览器额外的按钮: 填写表单 - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - 浏览器额外的“工具”菜单项: 填写表单 - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - 浏览器额外的按钮: 保存 - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - 浏览器额外的“工具”菜单项: 保存表单 - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - 浏览器额外的按钮: GetFlash - {3CA1D406-30D8-4DBC-8EE6-0E2C05F78864} - d:\Superhunter\GetFlash\GetFlash.dll
O9 - 浏览器额外的“工具”菜单项: GetFlash - {3CA1D406-30D8-4DBC-8EE6-0E2C05F78864} - d:\Superhunter\GetFlash\GetFlash.dll
O9 - 浏览器额外的按钮: Registry Workshop - {6D1323A6-A137-4B02-81AB-A11F30DBE53B} - E:\SOFTWARE\TOOLS\SYSTEM\RegWorkshop-v2.51\RegWorkshop.exe
O9 - 浏览器额外的“工具”菜单项: Registry Workshop - {6D1323A6-A137-4B02-81AB-A11F30DBE53B} - E:\SOFTWARE\TOOLS\SYSTEM\RegWorkshop-v2.51\RegWorkshop.exe
O9 - 浏览器额外的按钮: CoralQQ - {71B8E5BA-8198-4590-8FF0-1810B5858A83} - D:\Tencent\qq\CoralQQ.exe
O9 - 浏览器额外的“工具”菜单项: CoralQQ - {71B8E5BA-8198-4590-8FF0-1810B5858A83} - D:\Tencent\qq\CoralQQ.exe
O9 - 浏览器额外的按钮: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - 浏览器额外的“工具”菜单项: RoboForm工具栏 - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - 浏览器额外的按钮: XnView for Windows 9x/NT/2000/Me/Xp - {A29C7018-0FAE-4AF9-BA7F-3BA6623E8A6D} - D:\XnView Deluxe 2\XNVIEW.exe
O9 - 浏览器额外的“工具”菜单项: XnView for Windows 9x/NT/2000/Me/Xp - {A29C7018-0FAE-4AF9-BA7F-3BA6623E8A6D} - D:\XnView Deluxe 2\XNVIEW.exe
O9 - 浏览器额外的按钮: MSN Messenger - {A8E27355-DA61-4E5E-97C4-983415AF3B77} - C:\Program Files\MSN Messenger\msnmsgr.exe
O9 - 浏览器额外的“工具”菜单项: MSN Messenger - {A8E27355-DA61-4E5E-97C4-983415AF3B77} - C:\Program Files\MSN Messenger\msnmsgr.exe
O9 - 浏览器额外的按钮: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\SOFTWARE\DOWNLOAD\JetCar-v1.71\FlashGet.exe
O9 - 浏览器额外的“工具”菜单项: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\SOFTWARE\DOWNLOAD\JetCar-v1.71\FlashGet.exe
O9 - 浏览器额外的按钮: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - d:\Tencent\QQ\QQIEHelper.dll
O9 - 浏览器额外的“工具”菜单项: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - d:\Tencent\QQ\QQIEHelper.dll
O9 - 浏览器额外的按钮: GetFlash - {3CA1D406-30D8-4DBC-8EE6-0E2C05F78864} - d:\Superhunter\GetFlash\GetFlash.dll (HKCU)
O9 - 浏览器额外的“工具”菜单项: GetFlash - {3CA1D406-30D8-4DBC-8EE6-0E2C05F78864} - d:\Superhunter\GetFlash\GetFlash.dll (HKCU)
O11 - Options group: [!AGetFlash] GetFlash
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1121616994890
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - https://www.gamespyid.com/alaunch.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BDB58C6E-B0CC-4386-AEC6-82523CF1FDA7}: NameServer = 202.98.161.68 202.98.160.68
O18 - 列举现有的协议: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - 列举现有的协议: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: wbsys.dll C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: AutorunsDisabled - C:\WINDOWS\
O20 - Winlogon Notify: MCPClient - C:\Program Files\Common Files\Stardock\mcpstub.dll
O20 - Winlogon Notify: WBSrv - D:\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll

O23 - NT 服务: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - NT 服务: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - NT 服务: Apache - Unknown owner - D:\usr\local\apache\Apache.exe" --ntservice (file missing)
O23 - NT 服务: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - NT 服务: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - NT 服务: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - NT 服务: eEye Application Bus (eeyeevnt) - eEye Digital Security - C:\Program Files\Common Files\eEye Digital Security\Application Bus\eeyeevnt.exe
O23 - NT 服务: Gene6 FTP Server (G6FTPServer) - Gene6 - d:\Gene6 FTP Server\G6FTPSERVER.EXE
O23 - NT 服务: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - NT 服务: InCD Helper (InCDsrv) - Ahead Software AG - d:\Ahead\InCD\InCDsrv.exe
O23 - NT 服务: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - NT 服务: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - NT 服务: MySQL - Unknown owner - D:\usr\local\mysql\bin\mysqld-nt.exe
O23 - NT 服务: Norton Ghost - Symantec Corporation - D:\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
O23 - NT 服务: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - NT 服务: O&O CleverCache Pro (OOCleverCache) - O&O Software GmbH - D:\OO Software\CleverCache\OOCCSVC.exe
O23 - NT 服务: Process Activity Monitor (paamsrv) - Unknown owner - C:\Program Files\Common Files\Acronis\ProcessActivityMonitor\paamsrv.exe
O23 - NT 服务: PDEngine - Raxco Software, Inc. - d:\Raxco\PerfectDisk\PDEngine.exe
O23 - NT 服务: PDScheduler (PDSched) - Raxco Software, Inc. - d:\Raxco\PerfectDisk\PDSched.exe
O23 - NT 服务: Peanuthull - 广东网域与上海多点 - d:\PeanutHull3\Phmain.exe
O23 - NT 服务: PGPserv - PGP Corporation - C:\WINDOWS\system32\PGPserv.exe
O23 - NT 服务: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe
O23 - NT 服务: eEye Retina Engine (RetinaEngine) - eEye Digital Security - D:\eEye Digital Security\Retina 5\Scanner\RetinaEngine.exe
O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - d:\rising\rfw\rfwsrv.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\RISING\RAV\CCENTER.EXE
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - d:\rising\Rav\Ravmond.exe
O23 - NT 服务: Sandra Data Service (SandraDataSrv) - SiSoftware - d:\SiSoftware\SiSoftware Sandra Professional 2005.SR1\RpcDataSrv.exe
O23 - NT 服务: Sandra Service (SandraTheSrv) - SiSoftware - d:\SiSoftware\SiSoftware Sandra Professional 2005.SR1\RpcSandraSrv.exe
O23 - NT 服务: Steganos Live Encryption Engine 11 [Service] (SLEE_11_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE11.exe
O23 - NT 服务: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - NT 服务: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - NT 服务: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - d:\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - NT 服务: VMware Authorization Service (VMAuthdService) - VMware, Inc. - D:\VMware\VMware Workstation\vmware-authd.exe
O23 - NT 服务: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - NT 服务: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
O23 - NT 服务: Windows XP - Unknown owner - C:\WINDOWS\G_Server1.2.exe
O23 - NT 服务: Washer AutoComplete (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe
O23 - NT 服务: WWW File Share Pro - LionMax Software - D:\WWW File Share Pro\NTService.exe

用瑞星无法查杀，在未登陆下可以查出有Gpigeon.azg并且显示清除成功，但登陆后再次出现，请教如何解决

修复
R3 - 默认的URLSearchHook丢失。用HijackThis修复
O2 - BHO: ClosePopup Class - {2645D297-DD4B-4DD3-BAB0-34D4BB8F7EE6} - D:\MiniPopupKiller\cpw.dll
O2 - BHO: (no name) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - E:\SOFTWARE\DOWNLOAD\JetCar-v1.71\jccatch.dll
O3 - IE工具栏增项: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O18 - 列举现有的协议: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: AutorunsDisabled - C:\WINDOWS\

删除
D:\MiniPopupKiller\cpw.dll
D:\Java\
E:\SOFTWARE\DOWNLOAD\JetCar-v1.71\jccatch.dll


23 - NT 服务: Apache - Unknown owner - D:\usr\local\apache\Apache.exe" --ntservice (file missing)
O23 - NT 服务: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - NT 服务: MySQL - Unknown owner - D:\usr\local\mysql\bin\mysqld-nt.exe
O23 - NT 服务: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe
O23 - NT 服务: Windows XP - Unknown owner - C:\WINDOWS\G_Server1.2.exe
最后一项鸽子..
安全模式...打开注册表编辑器，展开：HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
搜索Apache    SQLEXPRESS      MSSQL$SQLEXPRESS      MySQL    RadClock    Windows XP  删除...

删除
C:\WINDOWS\G_Server1.2.exe
C:\WINDOWS\system32\RadClock.exe
D:\usr\local\mysql\bin\mysqld-nt.exe

http://nj.onlinedown.net/soft/2636.htm
下载超级兔子..用超级兔子清理王卸载除讯雷以外的流氓软件...

用优化大师带的杀流氓软件