中了Backdoor.Gpigeon.uql启动运行IE，每次瑞星提示清除成功，但重启再次出现
用ha_hijackthis_1991扫描，日志如下
Logfile of HijackThis v1.99.1
Scan saved at 11:54:00, on 2006-7-23
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
e:\Program Files\Rising\Rav\CCenter.exe
D:\WINDOWS\System32\svchost.exe
e:\Program Files\Rising\Rav\Ravmond.exe
e:\program files\rising\rfw\rfwproxy.exe
e:\Program Files\Rising\Rfw\rfwsrv.exe
e:\Program Files\Rising\Rav\RavStub.exe
D:\WINDOWS\Explorer.EXE
e:\Program Files\Rising\Rfw\RfwMain.exe
E:\Program Files\MagicSet\memdef.EXE
E:\Program Files\Rising\Rav\RavTask.exe
E:\Program Files\Rising\Rav\Ravmon.exe
D:\WINDOWS\System32\ctfmon.exe
E:\Program Files\Rising\Rav\rav.exe
D:\Program Files\VnetClient1.6\VnetClient.exe
D:\Program Files\Internet Explorer\iexplore.exe
d:\Program Files\Thunder Network\Thunder\Program\Thunder5.exe
G:\downloads\ha_hijackthis_1991\HijackThis.exe
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - D:\WINDOWS\System32\xunleibho_v8.dll
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - d:\Program Files\Thunder Network\Thunder\ComDlls\XUNLEIBHO_002.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - D:\WINDOWS\System32\KakaTool.dll
O4 - HKLM\..\Run: [RfwMain] "e:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [Super Rabbit Memory] E:\Program Files\MagicSet\memdef.EXE /LOAD
O4 - HKLM\..\Run: [RavTask] "e:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &使用迅雷下载 - d:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - d:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - F:\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - F:\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - F:\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - F:\QQ\SendMMS.htm
O8 - Extra context menu item: 网博士上次设置快速保存(Ctrl+Shift+D) - D:\Program Files\Websaver\config\ieext\网博士上次设置快速保存.htm
O8 - Extra context menu item: 网博士保存当前图片 - D:\Program Files\Websaver\config\ieext\网博士保存当前图片.htm
O8 - Extra context menu item: 网博士保存当前链接 - D:\Program Files\Websaver\config\ieext\网博士保存当前链接.htm
O8 - Extra context menu item: 网博士保存网页 - D:\Program Files\Websaver\config\ieext\网博士保存网页.htm
O8 - Extra context menu item: 网博士保存网页(接上次) - D:\Program Files\Websaver\config\ieext\网博士保存网页(接上次).htm
O8 - Extra context menu item: 网博士保存选中部分 - D:\Program Files\Websaver\config\ieext\网博士保存选中部分.htm
O8 - Extra context menu item: 网博士保存选中部分(接上次) - D:\Program Files\Websaver\config\ieext\网博士保存选中部分(接上次).htm
O8 - Extra context menu item: 网博士收集大图片 - D:\Program Files\Websaver\config\ieext\网博士收集大图片.htm
O9 - Extra button: 网博士上次设置快速保存 - {100CAA51-3232-4577-89CD-2ECC7E7724FF} - D:\Program Files\Websaver\config\ieext\网博士上次设置快速保存.htm
O9 - Extra 'Tools' menuitem: 网博士上次设置快速保存(Ctrl+Shift+D) - {100CAA51-3232-4577-89CD-2ECC7E7724FF} - D:\Program Files\Websaver\config\ieext\网博士上次设置快速保存.htm
O9 - Extra button: 网博士保存网页 - {5885C17B-E8C2-4649-941F-1C7FB6F29C03} - D:\Program Files\Websaver\config\ieext\网博士保存网页.htm (file missing)
O9 - Extra 'Tools' menuitem: 网博士保存网页 - {5885C17B-E8C2-4649-941F-1C7FB6F29C03} - D:\Program Files\Websaver\config\ieext\网博士保存网页.htm (file missing)
O16 - DPF: {E787FD25-8D7C-4693-AE67-9406BC6E22DF} (CPasswordEditCtrl
Object) - https://password.qq.com/download/qqedit.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C5F77362-A46A-40A5-A243-B4FAFAA93B2A}: NameServer = 202.96.128.166 202.96.128.86
O23 - Service: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - e:\program files\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - e:\Program Files\Rising\Rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - e:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - e:\Program Files\Rising\Rav\Ravmond.exe
O23 - Service: Windows XP Vista - Unknown owner - D:\WINDOWS\Hacker.com.cn.ini
急，help
