我有两台电脑，一台瑞星用得好好的，但是另一台手提电脑在没装瑞星之前就中毒了，今天我把瑞星的最新版本做成安装包，想替我的手提杀个毒的，但是才开始安装，就告诉我瑞星安装包要么被病毒篡改了，要么安装信息不完全，我忽略了这个问题后继续安装，结果又告诉我病毒库也无法装上去，我再次忽略这个问题，继续安装。整个安装完成后，杀了几个内存里的病毒，之后就没办法杀毒了，杀什么地方都告诉我“用户中止”。
而且，手提里的瑞星还是一把黄伞！
想从网络上求救，但是我把网线接上去后老是“登陆超时……”，从那台电脑我无法上网了。
求救：我现在该怎么办？

请大虾们帮忙啊！！


2006-08-10,21:04:40

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Home Edition Service Pack 1 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [Microsoft Corporation]
<tgcmd><> []
<ibmmessages><C:\Program Files\IBM\Messages By IBM\ibmmessages.exe> [IBM]
<MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background> [Microsoft Corporation]
<Tok-Cirrhatus><"C:\Documents and Settings\ok\Local Settings\Application Data\smss.exe"> [ ]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
<run><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation]
<PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]
<S3TRAY2><S3Tray2.exe> [S3 Graphics, Inc.]
<ATIModeChange><Ati2mdxx.exe> [ATI Technologies, Inc.]
<BluetoothAuthenticationAgent><rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent> [Microsoft Corporation]
<TPHOTKEY><C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe> []
<BMMLREF><C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE> []
<TPKMAPMN><C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe> []
<BCONSET><regedit /s "C:\Program Files\ThinkPad\ConnectUtilities\bconprof.reg"> []
<QCWLICON><C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE> []
<EZEJMNAP><C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe> [IBM Corp.]
<AGRSMMSG><AGRSMMSG.exe> [Agere Systems]
<ATIPTA><C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe> [ATI Technologies, Inc.]
<ibmmessages><C:\Program Files\IBM\Messages By IBM\ibmmessages.exe> [IBM]
<IMEKRMIG6.1><C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE> [Microsoft Corporation]
<MSPY2002><C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC> []
<ccApp><"C:\Program Files\Common Files\Symantec Shared\ccApp.exe"> [Symantec Corporation]
<vptray><C:\PROGRA~1\SYMANT~1\VPTray.exe> [Symantec Corporation]
<BIE><Rundll32.exe C:\WINDOWS\DOWNLO~1\BDSrHook.dll,Rundll32> []
<PPHIDPAD><C:\WINPENJR\Win32\pphidpad.exe> []
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<msstart><C:\WINDOWS\System32\msstart.exe> []
<Bron-Spizaetus><"C:\WINDOWS\ShellNew\ElnorB.exe"> [ ]
<RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{BC207F7D-3E63-4ACA-99B5-FB5F8428200C}><C:\WINDOWS\DOWNLO~1\BDSrHook.dll> []
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
<WinlogonNotify: NavLogon><C:\WINDOWS\System32\NavLogon.dll> [Symantec Corporation]

==================================

启动文件夹
[Microsoft Office]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Microsoft Office.lnk><N>
[Empty]
<C:\Documents and Settings\ok\「开始」菜单\程序\启动\Empty.pif><N>

==================================
服务
[Ati HotKey Poller / Ati HotKey Poller]
<C:\WINDOWS\System32\Ati2evxx.exe><N/A>
[Symantec Event Manager / ccEvtMgr]
<"C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"><Symantec Corporation>
[Symantec Password Validation / ccPwdSvc]
<"C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe"><Symantec Corporation>
[Symantec Settings Manager / ccSetMgr]
<"C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"><Symantec Corporation>
[Symantec AntiVirus Definition Watcher / DefWatch]
<"C:\Program Files\Symantec AntiVirus\DefWatch.exe"><Symantec Corporation>
[IBM PM Service / IBMPMSVC]
<C:\WINDOWS\System32\ibmpmsvc.exe><N/A>
[QCONSVC / QCONSVC]
<System32\QCONSVC.EXE><N/A>
[Rising Process Communication Center / RsCCenter]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[SavRoam / SavRoam]
<"C:\Program Files\Symantec AntiVirus\SavRoam.exe"><symantec>
[Symantec Network Drivers Service / SNDSrvc]
<"C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe"><Symantec Corporation>
[Symantec AntiVirus / Symantec AntiVirus]
<"C:\Program Files\Symantec AntiVirus\Rtvscan.exe"><Symantec Corporation>

==================================

浏览器加载项
[BDSrchHook Class]
{BC207F7D-3E63-4ACA-99B5-FB5F8428200C} <C:\WINDOWS\DOWNLO~1\BDSrHook.dll, >
[BDSrchHook Class]
{BC207F7D-3E63-4ACA-99B5-FB5F8428200C} <C:\WINDOWS\DOWNLO~1\BDSrHook.dll, >
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, N/A>
[FlashGet]
{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\PROGRA~1\FlashGet\flashget.exe, Amaze Soft>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\MSMSGS.EXE, Microsoft Corporation>
[电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FlashGet\fgiebar.dll, Amaze Soft>
[SassCln Object]
{A8658086-E6AC-4957-BC8E-7D54A7E8A78E} <C:\WINDOWS\Downloaded Program Files\SassCln.dll, Microsoft Corporation>
[BDSrchHook Class]
{BC207F7D-3E63-4ACA-99B5-FB5F8428200C} <C:\WINDOWS\DOWNLO~1\BDSrHook.dll, >
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\macromed\flash\Flash.ocx, Macromedia, Inc.>
[使用网际快车下载]
<C:\Program Files\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<C:\Program Files\FlashGet\jc_all.htm, N/A>
[添加到QQ自定义面板]
<C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================

正在运行的进程
[PID: 600][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 648][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 672][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[C:\WINDOWS\System32\NavLogon.dll] <Symantec Corporation><9.0.0.338>
[PID: 716][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 728][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 880][C:\WINDOWS\System32\ibmpmsvc.exe] <N/A><N/A>
[PID: 928][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 992][C:\Program Files\Rising\Rav\CCenter.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 1008][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1136][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1160][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1180][C:\Program Files\Rising\Rav\Ravmond.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 29>
[C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\RsLog.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20>
[C:\Program Files\Rising\Rav\HOOKSYS.dll] <Rising><18, 1, 0, 9>
[C:\Program Files\Rising\Rav\Scanner.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30>
[C:\Program Files\Rising\Rav\libload.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[C:\Program Files\Rising\Rav\regmon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[C:\Program Files\Rising\Rav\MemMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
[C:\Program Files\Rising\Rav\expscan.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
[C:\Program Files\Rising\Rav\PostTrt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
[PID: 1276][C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe] <Symantec Corporation><2.2.0.577>
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] <Symantec Corporation><2.2.0.577>
[PID: 1308][C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe] <Symantec Corporation><2.2.0.577>
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] <Symantec Corporation><2.2.0.577>
[C:\PROGRA~1\COMMON~1\SYMANT~1\CCSETEVT.DLL] <Symantec Corporation><2.2.0.577>
[PID: 1432][C:\Program Files\Rising\Rav\RavStub.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 1440][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.0 (XPClient.010817-1148)>
[PID: 1564][C:\WINDOWS\System32\Ati2evxx.exe] <N/A><N/A>
[PID: 1604][C:\Program Files\Symantec AntiVirus\DefWatch.exe] <Symantec Corporation><9.0.0.338>
[PID: 1652][C:\WINDOWS\System32\QCONSVC.EXE] <N/A><N/A>
[PID: 1676][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1740][C:\Program Files\Symantec AntiVirus\Rtvscan.exe] <Symantec Corporation><9.0.0.338>
[C:\WINDOWS\System32\CBA.DLL] <Intel? Corporation><6.12.0.112 E>
[C:\WINDOWS\System32\MsgSys.dll] <Intel? Corporation><6.12.0.112 E>
[C:\WINDOWS\System32\NTS.dll] <Intel? Corporation><6.12.0.112 E>
[C:\WINDOWS\System32\PDS.DLL] <Intel? Corporation><6.12.0.112 E>
[C:\Program Files\Symantec AntiVirus\NAVLU.dll] <Symantec Corporation><9.0.0.338>
[C:\Program Files\Symantec AntiVirus\I2ldvp3.dll] <Symantec Corporation><9.0.0.338>
[C:\Program Files\Symantec AntiVirus\ecmldr32.DLL] <Symantec Corp.><1.1.0.3>
[C:\Program Files\Symantec AntiVirus\SAVRT32.DLL] <Symantec Corporation><9.3.0.28>
[C:\Program Files\Symantec AntiVirus\NAVNTUTL.DLL] <Symantec Corporation><9.0.0.338>
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20040512.009\ecmsvr32.dll] <Symantec Corp.><1.1.0.3>
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20040512.009\NAVEX32a.DLL] <Symantec Corporation><2003.03.1.2>
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20040512.009\NAVENG32.DLL] <Symantec Corporation><2003.03.1.2>
[C:\Program Files\Symantec AntiVirus\IMail.dll] <Symantec Corporation><9.0.0.338>
[C:\Program Files\Symantec AntiVirus\NotesExt.dll] <Symantec Corporation><9.0.0.338>

[C:\Program Files\Symantec AntiVirus\vpmsece.dll] <Symantec Corporation><9.0.0.338>
[C:\Program Files\Symantec AntiVirus\DecSDK.dll] <Symantec Corporation><3.02.11.32>
[C:\Program Files\Symantec AntiVirus\Dec2.dll] <Symantec Corporation><3.02.11.32>
[C:\Program Files\Symantec AntiVirus\Dec2ID.dll] <Symantec Corporation><3.02.11.32>
[C:\Program Files\Symantec AntiVirus\Dec2ZIP.dll] <Symantec Corporation><3.02.11.32>
[C:\Program Files\Symantec AntiVirus\Dec2SS.dll] <Symantec Corporation><3.02.11.32>
[C:\Program Files\Symantec AntiVirus\Dec2GZIP.dll] <Symantec Corporation><3.02.11.32>
[C:\Program Files\Symantec AntiVirus\Dec2CAB.dll] <Symantec Corporation><3.02.11.32>
[C:\Program Files\Symantec AntiVirus\Dec2LHA.dll] <Symantec Corporation><3.02.11.32>
[C:\Program Files\Symantec AntiVirus\Dec2ARJ.dll] <Symantec Corporation><3.02.11.32>
[C:\Program Files\Symantec AntiVirus\Dec2TNEF.dll] <Symantec Corporation><3.02.11.32>
[C:\Program Files\Symantec AntiVirus\Dec2LZ.dll] <Symantec Corporation><3.02.11.32>
[C:\Program Files\Symantec AntiVirus\Dec2AMG.dll] <Symantec Corporation><3.02.11.32>
[C:\Program Files\Symantec AntiVirus\Dec2TAR.dll] <Symantec Corporation><3.02.11.32>
[C:\Program Files\Symantec AntiVirus\Dec2RTF.dll] <Symantec Corporation><3.02.11.32>
[C:\Program Files\Symantec AntiVirus\Dec2Text.dll] <Symantec Corporation><3.02.11.32>
[C:\Program Files\Common Files\Symantec Shared\SSC\scandlgs.dll] <Symantec Corporation><9.0.0.338>
[PID: 384][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 472][C:\WINDOWS\System32\Rundll32.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 944][C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe] <N/A><N/A>
[C:\Program Files\ThinkPad\PkgMgr\HOTKEY_2\tphk_2k.dll] <N/A><N/A>
[C:\WINDOWS\System32\Oemdspif.dll] <ATI Technologies, Inc.><4.12.0007>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 960][C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe] <N/A><N/A>
[C:\Program Files\ThinkPad\Utilities\TpKmapHk.dll] <N/A><N/A>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 968][C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe] <N/A><N/A>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 1076][C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe] <IBM Corporation><1.06>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 1080][C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE] <N/A><N/A>
[C:\Program Files\ThinkPad\ConnectUtilities\QCON.dll] <N/A><N/A>
[C:\Program Files\ThinkPad\ConnectUtilities\MerlinC201.dll] <Novatel Wireless Inc.><1, 0, 0, 1>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 1056][C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe] <IBM Corp.><1, 0, 0, 0>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 1208][C:\WINDOWS\AGRSMMSG.exe] <Agere Systems><2.1.21 2.1.21 11/21/2002 14:17:53>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 1468][C:\Program Files\IBM\Messages By IBM\ibmmessages.exe] <IBM><1.058>
[C:\WINDOWS\System32\AIBMRUNL.dll] <N/A><N/A>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 1580][C:\Program Files\Common Files\Symantec Shared\ccApp.exe] <Symantec Corporation><2.2.0.577>
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] <Symantec Corporation><2.2.0.577>
[C:\Program Files\Symantec\LiveUpdate\ProductRegCom.DLL] <Symantec Corporation><2.0.39.0>
[C:\Program Files\Symantec\LiveUpdate\LuComServerPS.DLL] <Symantec Corporation><2.0.39.0>
[C:\PROGRA~1\COMMON~1\SYMANT~1\CCALERT.DLL] <Symantec Corporation><2.2.0.577>
[C:\PROGRA~1\COMMON~1\SYMANT~1\CCEMLPXY.DLL] <Symantec Corporation><2.2.0.577>
[C:\WINDOWS\System32\SYMREDIR.dll] <Symantec Corporation><5.3.0.46>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[C:\Program Files\Symantec AntiVirus\SavEmail.dll] <Symantec Corporation><9.0.0.338>
[C:\Program Files\Common Files\Symantec Shared\ccSetEvt.dll] <Symantec Corporation><2.2.0.577>
[C:\Program Files\Common Files\Symantec Shared\ccProSub.dll] <Symantec Corporation><2.2.0.577>
[PID: 1132][C:\PROGRA~1\SYMANT~1\VPTray.exe] <Symantec Corporation><9.0.0.338>
[C:\Program Files\Symantec AntiVirus\SAVRT32.DLL] <Symantec Corporation><9.3.0.28>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[C:\Program Files\Symantec AntiVirus\Cliproxy.dll] <Symantec Corporation><9.0.0.338>
[C:\PROGRA~1\SYMANT~1\NAVNTUTL.DLL] <Symantec Corporation><9.0.0.338>
[C:\Program Files\Symantec AntiVirus\Cliscan.dll] <Symantec Corporation><9.0.0.338>
[PID: 1972][C:\WINPENJR\Win32\pphidpad.exe] <N/A><N/A>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 2072][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] <RealNetworks, Inc.><0.1.0.1622>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 2144][C:\Program Files\Rising\Rav\RavTask.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 2220][C:\WINDOWS\System32\ctfmon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 2316][C:\Program Files\Messenger\msmsgs.exe] <Microsoft Corporation><4.7.2010>
[C:\WINDOWS\System32\msdmo.dll] <N/A><N/A>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 2492][C:\Program Files\Rising\Rav\Ravmon.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 30>
[C:\Program Files\Rising\Rav\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 24>
[C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Program Files\Rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 2548][C:\Documents and Settings\ok\Local Settings\Application Data\winlogon.exe] < ><1.00.0004>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 2692][C:\WINDOWS\System32\conime.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 2708][C:\Documents and Settings\ok\Local Settings\Application Data\services.exe] < ><1.00.0004>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 2720][C:\Documents and Settings\ok\Local Settings\Application Data\lsass.exe] < ><1.00.0004>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[PID: 3248][C:\Program Files\WinRAR\WinRAR.exe] <N/A><N/A>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>
[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[PID: 3296][C:\DOCUME~1\ok\LOCALS~1\Temp\Rar$EX03.393\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\WINDOWS\DOWNLO~1\BDSrHook.dll] <><2, 0, 1, 2>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

救……！！！help！！

请到www.27814939.ys168.com,点“我的软件”下载诺顿进程管理器，终止以下
C:\Documents and Settings\ok\Local Settings\Application Data\winlogon.exe
C:\Documents and Settings\ok\Local Settings\Application Data\services.exe
C:\Documents and Settings\ok\Local Settings\Application Data\lsass.exe
的进程，注意目录，不要终止错。
运行(双击)System Repair Engineer，使用“启动项目，注册表”来删除以下选项。
C:\Documents and Settings\ok\Local Settings\Application Data\smss.exe
C:\WINDOWS\System32\msstart.exe
C:\WINDOWS\ShellNew\ElnorB.exe这两项，如果删除不了，在诺顿里查看一下有无它的进程，如果有就终止。
双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示确定更改时，单击“是”，清除“隐藏已知文件类型的扩展名
删除
C:\Documents and Settings\ok\Local Settings\Application Data\smss.exe
C:\WINDOWS\System32\msstart.exe
C:\WINDOWS\ShellNew\ElnorB.exe
C:\Documents and Settings\ok\Local Settings\Application Data\winlogon.exe
C:\Documents and Settings\ok\Local Settings\Application Data\services.exe
C:\Documents and Settings\ok\Local Settings\Application Data\lsass.exe
修复后，重启。
请再扫份日志粘上来。

引用:

【我无邪的贴子】请到www.27814939.ys168.com,点“我的软件”下载诺顿进程管理器，终止以下 C:\Documents and Settings\ok\Local Settings\Application Data\winlogon.exe C:\Documents and Settings\ok\Local Settings\Application Data\services.exe C:\Documents and Settings\ok\Local Settings\Application Data\lsass.exe 的进程，注意目录，不要终止错。 运行(双击)System Repair Engineer，使用“启动项目，注册表”来删除以下选项。 C:\Documents and Settings\ok\Local Settings\Application Data\smss.exe C:\WINDOWS\System32\msstart.exe C:\WINDOWS\ShellNew\ElnorB.exe这两项，如果删除不了，在诺顿里查看一下有无它的进程，如果有就终止。 双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示确定更改时，单击“是”，清除“隐藏已知文件类型的扩展名 删除 C:\Documents and Settings\ok\Local Settings\Application Data\smss.exe C:\WINDOWS\System32\msstart.exe C:\WINDOWS\ShellNew\ElnorB.exe C:\Documents and Settings\ok\Local Settings\Application Data\winlogon.exe C:\Documents and Settings\ok\Local Settings\Application Data\services.exe C:\Documents and Settings\ok\Local Settings\Application Data\lsass.exe 修复后，重启。 请再扫份日志粘上来。 ………………

大哥……再帮帮忙
现在那台手提上不了网……