每次用瑞星杀完报告已清除,可下次再杀又是同样的文件,同样的路径,不知该怎么办?请大家帮忙啊.这是我今天的瑞星扫描报告:

病毒名称    处理结果    发现日期    扫描方式    路径    文件    病毒来源
Backdoor.GPigeon.sxt    清除成功    05-11-20 21:38    手动扫描        IEXPLORE.EXE>>C:\Program Files\Internet Explorer\IEXPLORE.EXE    本机
Backdoor.Gpigeon.szj    删除成功    05-11-20 21:42    手动扫描    C:\WINDOWS\Temp    tcung9af.dll    本机
Backdoor.Gpigeon.szj    删除成功    05-11-20 22:02    实时监控    C:\WINDOWS\Temp    tcung9af.dll    本机
Backdoor.Gpigeon.szj    删除成功    05-11-20 22:23    手动扫描    C:\WINDOWS\Temp    tcung9af.dll    本机


下面是HijackThis扫描日志:
Logfile of HijackThis v1.99.1
Scan saved at 0:56:04, on 2005-11-21
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
d:\rfw\rfwsrv.exe
D:\RAV\CCENTER.EXE
D:\RAV\Ravmond.exe
C:\WINDOWS\System32\MsPMSPSv.exe
D:\RAV\RavStub.exe
C:\WINDOWS\Explorer.EXE
d:\rfw\RfwMain.exe
D:\大师\strongly\SVCH0ST.EXE
C:\Program Files\Conexant\AccessRunner ADSL\CnxDslTb.exe
C:\WINDOWS\system32\ctfmon.exe
D:\rav\RavMon.exe
D:\Rav\RavTimer.exe
G:\下载软件\155847200541134207\HijackThis.exe

O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v8.dll
O2 - BHO: Shockwave Flash Objects - {1002C84D-A326-2D3C-13F3-2C2474392A91} - C:\WINDOWS\system32\msfzb.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - (no file)
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ExeSoft] D:\大师\strongly\SVCH0ST.EXE un
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\Conexant\AccessRunner ADSL\CnxDslTb.exe"
O4 - HKLM\..\Run: [桌面图标文字自动透明] D:\Windows优化大师 V6.6 Build 5.601 注册版\WinMem.exe XP
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &使用迅雷下载 - D:\迅雷5.0.3.86最完美去广告重新封装版\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - D:\迅雷5.0.3.86最完美去广告重新封装版\Thunder\getallurl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - G:\我的下载\qq\AddToNetDisk.htm
O8 - Extra context menu item: 导出到 Microsoft Excel(&x) - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - G:\我的下载\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - G:\我的下载\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - G:\我的下载\qq\SendMMS.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\WINDOWS\System32\shdocvw.dll
O11 - Options group: [!ANetSpeeder]  NetSpeeder
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O15 - Trusted Zone: http://bbs.99bbs.com
O15 - Trusted Zone: http://www.taiwan-trick.org
O16 - DPF: {0400AC1C-EEF0-4638-A501-31D5A0DC2002} (VTPlug3 Class) - http://202.101.62.195:1995/VTrans.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/313df22a9d0cabdb5816/netzip/RdxIE601_cn.cab
O16 - DPF: {59CCB4A0-727D-11CF-AC36-00AA00A47DD2} (Timer Object) - http://www.jdnt.com/tv/tools/ietimer.cab
O16 - DPF: {6924091F-CD97-41E1-B1D4-D9079409D413} (IMCv1 Control) - http://202.101.62.195:1995/talk.cab
O16 - DPF: {991481A7-4669-4E15-8C24-100404E1F5CB} (Blueskyvoice Control) - http://www.bluesky.cn/download/blueskyvoice_60.cab
O16 - DPF: {99888952-AC62-437C-AFC6-7B5CF05A7F2F} - http://download.ourgame.com/IEDown.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B5E3187F-6130-11D5-BF70-0050BA6E0CA5} (BtecKView Class) - http://www.zdxw.com.cn/code/BK_paper.dll
O16 - DPF: {BA0F088C-72C1-475A-92F8-42391DEF6961} (Blueskyvoice Control) - http://www.bluesky.cn/download/blueskyvoice_27.cab
O16 - DPF: {CF85459D-DFA7-4028-A065-3C6D1356DCC8} (CertInstall Control) - http://gd.chinavnet.com/CertInstall.cab
O16 - DPF: {DDA166FA-B3EA-4A3B-8EE2-4F552CDEEE81} - http://scan.kingsoft.com/scan/KatNewVerHtml/KATScan.CAB
O16 - DPF: {EF6205C1-3F17-4829-BCB5-1336ED89E356} (KvScanOnline Control) - http://www.jiangmin.com/KvOnline/KvDown.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BEF66AA8-B37E-4AF2-AC27-DC40D561DA62}: NameServer = 202.99.224.8 202.99.224.68
O18 - Protocol: mbox - {7DEE9D05-FA0A-4416-A6F3-6537D0EAB6A6} - (no file)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: apihookdll.dll
O23 - Service: Network Connection (Netmans) - Unknown owner - C:\WINDOWS\svhost.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - d:\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - D:\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\RAV\Ravmond.exe

小弟是菜菜,具体怎样删除,请哥哥们指教,感激不尽!!![/font]

O23 - Service: Network Connection (Netmans) - Unknown owner - C:\WINDOWS\svhost.exe
是个很木马~
开始/运行/services.msc 进到本地服务设置 查找Network Connection ，找到后双击出“属性”对话框/启动类型→禁止/服务状态→停止 然后确定。
开始/运行/regedit 进入注册表编辑器 进入HKEY_LOCAL_MACHINE\SYSTEM目录，然后单击 编辑/查找 Network Connection ,找出确认后并删除整个Network Connection目录~
重起电脑~然后到C:\WINDOWS目录下搜索svhost，找到svhost.exe
svhost.dll  svhost_hook.dll  svhostkey.dll然后删除即可（如果有的话）
到C:\program目录下看看有没有Network Connection文件夹~有就删掉

PS：真正的svhost.exe程序是在C:\WINDOWS\system32目录下，而不是C:\WINDOWS目录下~
另外建议楼主
运行Hijackthis，扫描结束后在下列选项前打上勾，然后选修复有(file missing)和(no file)的相关项

强烈感谢"夏天去跳海"哥哥,小弟马上照办!

请问"夏天去跳海"哥哥,还有一个Network Connections 跟它是什么关系啊?

引用:

【夏天去跳海的贴子】PS：真正的svhost.exe程序是在C:\WINDOWS\system32目录下，而不是C:\WINDOWS目录下~ 另外建议楼主 运行Hijackthis，扫描结束后在下列选项前打上勾，然后选修复有(file missing)和(no file)的相关项 ...........................

找见了!直接删除可以吗?