用瑞星杀的结果：
详细内容2006-08-07 08:38:23, IEXPLORE.EXE>>C:\Program Files\Internet Explorer\IEXPLORE.EXE ->Backdoor.GPigeon.vla

但是杀完重启后又出现。。。。。。。。。。

下面是检测报告，请高手帮忙分析：



              系统检查检测报告!
建议:修复时请按照高手的反馈编号在修复工具中打勾进行修复.

--------------------------系统环境-------------------------
检测日期: 2006-8-7 9:1
Windows: Microsoft Windows XP
ServicePack: Service Pack 2
Update: 2600.xpsp_sp2_gdr.050301-1519
Internet Explorer: 6.0.2900.2180


-----------------------网络基础安全测试--------------------
密码安全检测:已经设置了管理员密码,建议:将密码复杂度和长度提高!
网络漏洞检测:空连接检查安全!

服务名称        是否运行              描述
RemoteRegistry [已停止] [说明:这个服务可能被利用远程操作注册表]
Windows Time  [已停止] [说明:这个服务可能被黑客利用来启动木马]
Telnet        [已停止] [说明:这个服务可能被黑客登录到您计算机]
Messenger      [已停止] [说明:这个服务常被广告商用来发垃圾广告]
Server        [已停止] [说明:如果你的电脑不用局域网中,可以关闭]


-----------------------计算机网络端口----------------------
协议      端口号              端口类型
TCP        135        未知类型
TCP        445        未知类型
TCP      1723        未知类型
TCP      6059        未知类型
TCP        139        未知类型
TCP        139        未知类型
TCP        139        未知类型
TCP      1190        未知类型
TCP      1191        未知类型
TCP        445        未知类型
TCP        500        未知类型
TCP      1025        未知类型
TCP      1701        未知类型
TCP      4500        未知类型
TCP      1027        未知类型
TCP      1028        未知类型
TCP      1098        未知类型
TCP        137        未知类型
TCP        138        未知类型


--------------------计算机系统组件体检----------------------
[编号:0]
[名称:\SystemRoot\System32\smss.exe]
[类型:运行进程]
[内容:未知]

[编号:1]
[名称:\??\C:\WINDOWS\system32\winlogon.exe]
[类型:运行进程]
[内容:未知]

[编号:2]
[名称:C:\WINDOWS\system32\services.exe]
[类型:运行进程]
[内容:Microsoft(R) Windows(R) Operating System (C) Microsoft Corporation. All rights reserved.]

[编号:3]
[名称:C:\WINDOWS\system32\lsass.exe]
[类型:运行进程]
[内容:Microsoft? Windows? Operating System ? Microsoft Corporation. All rights reserved.]

[编号:4]
[名称:C:\WINDOWS\system32\svchost.exe]
[类型:运行进程]
[内容:Microsoft? Windows? Operating System ? Microsoft Corporation. All rights reserved.]

[编号:5]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\CCenter.exe]
[类型:运行进程]
[内容:Rising Antivirus Software Copyright Rising  2002]

[编号:6]
[名称:C:\WINDOWS\System32\svchost.exe]
[类型:运行进程]
[内容:Microsoft? Windows? Operating System ? Microsoft Corporation. All rights reserved.]

[编号:7]
[名称:C:\Program Files\Intel\Wireless\Bin\EvtEng.exe]
[类型:运行进程]
[内容:Intel(R) PROSet/Wireless Event Log Copyright (c) Intel Corporation 1999-2005]

[编号:8]
[名称:C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe]
[类型:运行进程]
[内容:Intel(R) PROSet/Wireless Service Copyright (c) Intel Corporation 1999-2005]

[编号:9]
[名称:C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe]
[类型:运行进程]
[内容:SSO Service Copyright (c) Intel Corporation 1999-2005]

[编号:10]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\Ravmond.exe]
[类型:运行进程]
[内容:Rising Antivirus Software Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:11]
[名称:e:\program files\需要安装的大型软件\rising\rfw\rfwsrv.exe]
[类型:运行进程]
[内容:Rising Personal FireWall 2006 Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:12]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\RavStub.exe]
[类型:运行进程]
[内容:RavStub Application Copyright (c) 1998-2005 Rising Corp.]

[编号:13]
[名称:C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe]
[类型:运行进程]
[内容:Microsoft? Visual Studio .NET Copyright? Microsoft Corporation.  All rights reserved.]

[编号:14]
[名称:C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe]
[类型:运行进程]
[内容:Intel(R) PROSet/Wireless Registry Service Copyright (c) Intel Corporation 1999-2005]

[编号:15]
[名称:C:\WINDOWS\Explorer.EXE]
[类型:运行进程]
[内容:Microsoft(R) Windows(R) Operating System (C) Microsoft Corporation. All rights reserved.]

[编号:16]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\RavTask.exe]
[类型:运行进程]
[内容:Rising Antivirus Software Copyright (c) 1998-2006 Rising Corp.]

[编号:17]
[名称:C:\WINDOWS\system32\ctfmon.exe]
[类型:运行进程]
[内容:Microsoft? Windows? Operating System ? Microsoft Corporation. All rights reserved.]

[编号:18]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\Ravmon.exe]
[类型:运行进程]
[内容:Rising Anti-Virus Monitor Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:19]
[名称:E:\Program Files\免安装绿色软件\未知木马清除器Hijackthis.exe]
[类型:运行进程]
[内容:完美卸载V2006-ChinaHijackThis 版权所有 (C) 2006]

[编号:20]
[名称:C:\Program Files\Maxthon\Maxthon.exe]
[类型:运行进程]
[内容:Maxthon Application Copyright (C) 2002]

[编号:21]
[名称:E:\Program Files\免安装绿色软件\音速启动\VStart.exe]
[类型:运行进程]
[内容:音速启动(VStart) http://www.3lsoft.com]

[编号:22]
[名称:E:\Program Files\免安装绿色软件\未知木马清除器Hijackthis.exe]
[类型:运行进程]
[内容:完美卸载V2006-ChinaHijackThis 版权所有 (C) 2006]

[编号:23]
[分隔符:---------------------------------------------------------------------]

[编号:24]
[名称:C:\WINDOWS\system32\IWPDGINA.DLL]
[类型:已加载DLL]
[内容: Copyright (c) Intel Corporation 1999-2005]

[编号:25]
[名称:C:\Program Files\Intel\Wireless\Bin\SsoGnCHS.dll]
[类型:已加载DLL]
[内容: Copyright (c) Intel Corporation 1999-2005]

[编号:26]
[名称:C:\WINDOWS\system32\Ati2evxx.dll]
[类型:已加载DLL]
[内容:ATI External Event Utility for NT, W2K and W9X Copyright ? 1999-2004 ATI Technologies Inc.]

[编号:27]
[名称:C:\Program Files\Intel\Wireless\Bin\PsRegApi.dll]
[类型:已加载DLL]
[内容:PsRegApi Copyright (c) Intel Corporation 1999-2005]

[编号:28]
[名称:C:\Program Files\Intel\Wireless\Bin\TraceAPI.DLL]
[类型:已加载DLL]
[内容:TraceAPI Module Copyright (c) Intel Corporation 1999-2005]

[编号:29]
[名称:C:\Program Files\Intel\Wireless\Bin\LIBEAY32.dll]
[类型:已加载DLL]
[内容:未知]

[编号:30]
[名称:C:\Program Files\Intel\Wireless\Bin\IntStngs.dll]
[类型:已加载DLL]
[内容:IntelSettings Dynamic Link Library Copyright (c) Intel Corporation 1999-2005]

[编号:31]
[名称:C:\Program Files\Intel\Wireless\Bin\IWMSPROV.DLL]
[类型:已加载DLL]
[内容:未知]

[编号:32]
[名称:C:\Program Files\Intel\Wireless\Bin\PfMgrApi.dll]
[类型:已加载DLL]
[内容:ProfileMgrApi Dynamic Link Library Copyright (c) Intel Corporation 1999-2005]

[编号:33]
[名称:C:\Program Files\Intel\Wireless\Bin\DbEngine.dll]
[类型:已加载DLL]
[内容:Secure Database Egnine Copyright (c) Intel Corporation 1999-2005]

[编号:34]
[名称:C:\Program Files\Intel\Wireless\Bin\MurocApi.dll]
[类型:已加载DLL]
[内容:MurocApi Dynamic Link Library Copyright (c) Intel Corporation 1999-2005]

[编号:35]
[名称:C:\Program Files\Intel\Wireless\Bin\S24MUDLL.dll]
[类型:已加载DLL]
[内容:Intel Mobile Unit Support Service Copyright (c) Intel Corporation 1999-2004]

[编号:36]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\BWList.dll]
[类型:已加载DLL]
[内容:BWList Dynamic Link Library Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:37]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\RsCommX.dll]
[类型:已加载DLL]
[内容:rising RsCommX Copyright ? 2002]

[编号:38]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\RSAPPMGR.DLL]
[类型:已加载DLL]
[内容:Rising AntiVirus 2006 Copyright ? 2004 - 2005]

[编号:39]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\CfgDll.dll]
[类型:已加载DLL]
[内容:Rising AntiVirus 2006 Copyright ? 2004 - 2006]

[编号:40]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\RSCOMMON.DLL]
[类型:已加载DLL]
[内容:Rising Antivirus Software Copyright (c) 1998-2006 Rising Corp.]
[编号:41]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\RsLog.dll]
[类型:已加载DLL]
[内容:RsLog Dynamic Link Library Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:42]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\HOOKSYS.dll]
[类型:已加载DLL]
[内容:HOOKSYS Dynamic Link Library Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:43]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\Scanner.dll]
[类型:已加载DLL]
[内容:Rising RsScanner Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:44]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\libload.dll]
[类型:已加载DLL]
[内容:rising libload Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:45]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\VirusLib.dll]
[类型:已加载DLL]
[内容:Rising VirusLib Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:46]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\regmon.dll]
[类型:已加载DLL]
[内容:  regmon Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:47]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\HookWeb.dll]
[类型:已加载DLL]
[内容:rising HookWeb Copyright ? 2004]

[编号:48]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\MemMon.dll]
[类型:已加载DLL]
[内容:北京瑞星 MemMon Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:49]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\expscan.dll]
[类型:已加载DLL]
[内容:ExpScan Dynamic Link Library Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:50]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\mPorts.dll]
[类型:已加载DLL]
[内容:Personal Firewall Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:51]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\MailMon.dll]
[类型:已加载DLL]
[内容:mailmon Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:52]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\SpamEng.dll]
[类型:已加载DLL]
[内容: SpamEng Dynamic Link Library Copyright (C) 2004]

[编号:53]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\engine.dll]
[类型:已加载DLL]
[内容:rising engine Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:54]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\PostTrt.dll]
[类型:已加载DLL]
[内容:Rising PostTrt Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:55]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\UnExe.dll]
[类型:已加载DLL]
[内容:rising UnExe Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:56]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\ScanExec.dll]
[类型:已加载DLL]
[内容:rising ScanExec Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:57]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\ScanEx.dll]
[类型:已加载DLL]
[内容:Rising ScanEX Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:58]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\NvFile.dll]
[类型:已加载DLL]
[内容:rising NVFile Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:59]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\ScanMac.dll]
[类型:已加载DLL]
[内容:rising ScanMac Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:60]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\ScanSct.dll]
[类型:已加载DLL]
[内容:rising ScanSct Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:61]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\Unpacker.dll]
[类型:已加载DLL]
[内容:rising UnPacker Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:62]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\ExtOLE.dll]
[类型:已加载DLL]
[内容:rising ExtOLE Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:63]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\ScanNet.dll]
[类型:已加载DLL]
[内容:rising ScanNet Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:64]
[名称:e:\program files\需要安装的大型软件\rising\rfw\RfwRule.dll]
[类型:已加载DLL]
[内容:rule Dynamic Link Library Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:65]
[名称:e:\program files\需要安装的大型软件\rising\rfw\rfwlog.dll]
[类型:已加载DLL]
[内容:Rising Personal FireWall 2006 Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:66]
[名称:e:\program files\需要安装的大型软件\rising\rfw\Rfwdrv.dll]
[类型:已加载DLL]
[内容:Rising Personal FireWall 2005 Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:67]
[名称:e:\program files\需要安装的大型软件\rising\rfw\MonDrv.dll]
[类型:已加载DLL]
[内容:进程保护 Copyright ? 2005]

[编号:68]
[名称:e:\program files\需要安装的大型软件\rising\rfw\ProcLib.dll]
[类型:已加载DLL]
[内容:Rising Personal FireWall  Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:69]
[名称:e:\program files\需要安装的大型软件\rising\rfw\mPorts.dll]
[类型:已加载DLL]
[内容:Personal Firewall Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:70]
[名称:C:\WINDOWS\system32\widgetdownload.dll]
[类型:已加载DLL]
[内容:鱼鱼桌面秀widget插件下载工具 ]

[编号:71]
[名称:C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll]
[类型:已加载DLL]
[内容:XunLeiBHO Module Copyright 2004-2006]

[编号:72]
[名称:C:\Program Files\Common Files\Ahead\lib\NMDataServices.dll]
[类型:已加载DLL]
[内容:Nero Home Copyright (c) 1995-2005 Nero AG and its licensors]

[编号:73]
[名称:C:\Program Files\Common Files\Ahead\lib\NMCoFoundation.dll]
[类型:已加载DLL]
[内容:Nero Home Copyright (c) 1995-2005 Nero AG and its licensors]

[编号:74]
[名称:C:\Program Files\Common Files\Ahead\lib\NMVDS.dll]
[类型:已加载DLL]
[内容:Nero Home Copyright (c) 1995-2005 Nero AG and its licensors]

[编号:75]
[名称:C:\Program Files\Common Files\Ahead\lib\NMIndexStoreSvrPS.dll]
[类型:已加载DLL]
[内容:Nero Home Copyright (c) 1995-2005 Nero AG and its licensors]

[编号:76]
[名称:C:\Program Files\WinRAR\rarext.dll]
[类型:已加载DLL]
[内容:未知]

[编号:77]
[名称:C:\WINDOWS\system32\RavExt.dll]
[类型:已加载DLL]
[内容:Rising Antivirus Software Copyright (c) 1998-2006 Rising Corp.]

[编号:78]
[名称:C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX]
[类型:已加载DLL]
[内容:AcroIEHelper Module Copyright 2001]

[编号:79]
[名称:C:\Program Files\Common Files\Ahead\lib\NMPluginBase.dll]
[类型:已加载DLL]
[内容:Nero Home Copyright (c) 1995-2005 Nero AG and its licensors]

[编号:80]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\RsGuiLib.dll]
[类型:已加载DLL]
[内容:Rising Antivirus Software Copyright (c) 1998-2006 Rising Corp.]

[编号:81]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\PngDll.dll]
[类型:已加载DLL]
[内容:Rising Antivirus Software Copyright (c) 1998-2005 Rising Corp.]

[编号:82]
[名称:C:\Program Files\Maxthon\maxzlib.dll]
[类型:已加载DLL]
[内容:  maxzlib Copyright ? 2005]

[编号:83]
[名称:C:\Program Files\Maxthon\Services\RealTime\real_time.dll]
[类型:已加载DLL]
[内容:RealTime Module Copyright 2003]

[编号:84]
[名称:E:\Program Files\需要安装的大型软件\Rising\Rav\RavScrCh.dll]
[类型:已加载DLL]
[内容:RavScrCh Module Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]

[编号:85]
[名称:C:\WINDOWS\system32\Macromed\Flash\Flash.ocx]
[类型:已加载DLL]
[内容:Shockwave Flash Copyright ? 1996-2003 Macromedia, Inc.]

[编号:86]
[名称:C:\WINDOWS\system32\UNISPIM.IME]
[类型:已加载DLL]
[内容:紫光拼音输入法 Copyright (c) 北京清华紫光软件股份有限公司]

[编号:87]
[名称:C:\WINDOWS\system32\upengine.dll]
[类型:已加载DLL]
[内容:紫光拼音输入法 Copyright (c) 北京清华紫光软件股份有限公司]

[编号:88]
[分隔符:---------------------------------------------------------------------]

[编号:89]
[名称:IMJPMIG8.1]
[类型:开机启动]
[内容:"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32]

[编号:90]
[名称:PHIME2002ASync]
[类型:开机启动]
[内容:C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC]

[编号:91]
[名称:PHIME2002A]
[类型:开机启动]
[内容:C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName]

[编号:92]
[名称:VStart5.0]
[类型:开机启动]
[内容:E:\Program Files\免安装绿色软件\音速启动\VStart.exe]

[编号:93]
[名称:RavTask]
[类型:开机启动]
[内容:"E:\Program Files\需要安装的大型软件\Rising\Rav\RavTask.exe" -system]

[编号:94]
[名称:RfwMain]
[类型:开机启动]
[内容:"E:\Program Files\需要安装的大型软件\Rising\Rfw\rfwmain.exe" -Startup]

[编号:95]
[分隔符:---------------------------------------------------------------------]

[编号:96]
[名称:Adobe LM Service]
[类型:服务:未知]
[内容:"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"]

[编号:97]
[名称:AEGIS Protocol (IEEE 802.1x) v3.4.10.0]
[类型:服务:AEGIS Client 3.4.10.0 Copyright (C) Meetinghouse Data Communications 1997-2005]
[内容:C:\WINDOWS\system32\drivers\aegisp.sys]

[编号:98]
[名称:AFD]
[类型:服务:未知]
[内容:\SystemRoot\System32\drivers\afd.sys]

[编号:99]
[名称:ASP.NET State Service]
[类型:服务:未知]
[内容:C:\WINDOWS\microsoft.net\framework\v1.1.4322\aspnet_state.exe]

[编号:100]
[名称:Ati HotKey Poller]
[类型:服务:未知]
[内容:C:\WINDOWS\system32\ati2evxx.exe]

[编号:101]
[名称:Rising TDI Base Driver]
[类型:服务:Rising PFW Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]
[内容:C:\WINDOWS\system32\drivers\basetdi.sys]

[编号:102]
[名称:Bluetooth Audio Service]
[类型:服务:Windows (R) 2000 DDK driver Copyright (C) IVT Corp.2000-2002]
[内容:C:\WINDOWS\system32\drivers\blueletaudio.sys]

[编号:103]
[名称:BlueSoleil Hid Service]
[类型:服务:未知]
[内容:C:\Program Files\BlueSoleil\BTNtService.exe]

[编号:104]
[名称:HelloNet PPPoE 虚拟网卡]
[类型:服务:未知]
[内容:C:\WINDOWS\system32\drivers\brpppoe.sys]

[编号:105]
[名称:Bluetooth PAN Network Adapter]
[类型:服务:BlueSoleil Copyright (C) IVT Corp. 2000-2004]
[内容:C:\WINDOWS\system32\drivers\btnetdrv.sys]

[编号:106]
[名称:Bluetooth USB For Bluetooth Service]
[类型:服务:Bluetooth USB Device Driver Copyright (C) IVT/CSR, 2002-2004]
[内容:C:\WINDOWS\system32\drivers\btcusb.sys]

[编号:107]
[名称:Bluetooth HID Enumerator]
[类型:服务:未知]
[内容:C:\WINDOWS\system32\drivers\vbtenum.sys]

[编号:108]
[名称:Bluetooth HID Manager Service]
[类型:服务:BlueSoleil(c) Copyright (c) IVT Corporation1999-2004]
[内容:C:\WINDOWS\system32\drivers\bthidmgr.sys]

[编号:109]
[名称:DCOM Server Process Launcher]
[类型:服务:未知]
[内容:C:\WINDOWS\system32\svchost ]

[编号:110]
[名称:Disk Manager Logical]
[类型:服务:未知]
[内容:C:\WINDOWS\WindowsShell.exe]

[编号:111]
[名称:Intel(R) PROSet/Wireless Event Log]
[类型:服务:Intel(R) PROSet/Wireless Event Log Copyright (c) Intel Corporation 1999-2005]
[内容:C:\Program Files\Intel\Wireless\Bin\EvtEng.exe]

[编号:112]
[名称:ExpScaner]
[类型:服务:ExpScan.sys Copyright (C) 2004 Rising]
[内容:e:\program files\需要安装的大型软件\rising\rav\expscan.sys]

[编号:113]
[名称:gwiopm]
[类型:服务:未知]
[内容:e:\program files\免安装绿色软件\windows优化大师\gwiopm.sys]

[编号:114]
[名称:HookCont]
[类型:服务:TDIHOOK Driver for Windows NT Copyright ]
[内容:e:\program files\需要安装的大型软件\rising\rav\hookcont.sys]

[编号:115]
[名称:HookReg]
[类型:服务: 版权所有 (@) 2003]
[内容:e:\program files\需要安装的大型软件\rising\rav\hookreg.sys]

[编号:116]
[名称:HookSys]
[类型:服务:Hooksys Copyright (C) 2004]
[内容:e:\program files\需要安装的大型软件\rising\rav\hooksys.sys]

[编号:117]
[名称:HookUrl]
[类型:服务:Personal FireWall Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]
[内容:e:\program files\需要安装的大型软件\rising\rfw\hookurl.sys]

[编号:118]
[名称:InCD File System]
[类型:服务:未知]
[内容:C:\WINDOWS\system32\drivers\incdfs.sys]

[编号:119]
[名称:InCDPass]
[类型:服务:未知]
[内容:C:\WINDOWS\system32\drivers\incdpass.sys]

[编号:120]
[名称:InCD Reader]
[类型:服务:未知]
[内容:C:\WINDOWS\system32\drivers\incdrm.sys]

[编号:121]
[名称:Machine Debug Manager]
[类型:服务:未知]
[内容:"C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe"]

[编号:122]
[名称:MEMSCAN]
[类型:服务:MemScan Drivers for Windows NT Copyright (C) RFW Corp. 2000-2002]
[内容:e:\program files\需要安装的大型软件\rising\rav\memscan.sys]

[编号:123]
[名称:mProcRs]
[类型:服务:Rising Personal FireWall  Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]
[内容:e:\program files\需要安装的大型软件\rising\rfw\mprocrs.sys]

[编号:124]
[名称:FTP Publishing]
[类型:服务:未知]
[内容:C:\WINDOWS\system32\inetsrv\inetinfo.exe]

[编号:125]
[名称:Windows Installer]
[类型:服务:未知]
[内容:C:\WINDOWS\system32\msiexec.exe /V]

[编号:126]
[名称:NetGroup Packet Filter Driver]
[类型:服务:WinPcap Netgroup Packet Filter Driver Copyright ? 2005 CACE Technologies. Copyright ? 2003-2005 NetGroup, Politecnico di Torino.]
[内容:C:\WINDOWS\system32\drivers\npf.sys]

[编号:127]
[名称:npkcrypt]
[类型:服务:nProtect KeyCrypt Driver Copyright (C) INCA Internet. 2000-2005]
[内容:e:\program files\免安装绿色软件\qq\npkcrypt.sys]

[编号:128]
[名称:Office Source Engine]
[类型:服务:未知]
[内容:"C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"]

[编号:129]
[名称:PCANDIS5 Protocol Driver]
[类型:服务:PCAUSA Rawether for Windows Copyright ? 1995-2000 Printing Communications Assoc., Inc. (PCAUSA)]
[内容:e:\黑之门\工具\嗅探扫描\一个运~1\tianxi~1\nethac~1\tools\pcandis5.sys]

[编号:130]
[名称:REGMON]
[类型:服务:未知]
[内容:c:\windows\system32\drivers\regsys.sys]

[编号:131]
[名称:Intel(R) PROSet/Wireless Registry Service]
[类型:服务:Intel(R) PROSet/Wireless Registry Service Copyright (c) Intel Corporation 1999-2005]
[内容:C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe]

[编号:132]
[名称:Rising Proxy  Service]
[类型:服务:Rising Personal FireWall 2006 Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]
[内容:e:\program files\需要安装的大型软件\rising\rfw\rfwproxy.exe]

[编号:133]
[名称:Rising Personal Firewall Service]
[类型:服务:Rising Personal FireWall 2006 Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]
[内容:e:\program files\需要安装的大型软件\rising\rfw\rfwsrv.exe]

[编号:134]
[名称:Remote Packet Capture Protocol v.0 (experimental)]
[类型:服务:未知]
[内容:"%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini"]

[编号:135]
[名称:Remote Procedure Call (RPC)]
[类型:服务:未知]
[内容:C:\WINDOWS\system32\svchost ]

[编号:136]
[名称:Rising Process Communication Center]
[类型:服务:未知]
[内容:"E:\Program Files\需要安装的大型软件\Rising\Rav\CCenter.exe"]

[编号:137]
[名称:RsFwDrv]
[类型:服务:Rising nt_fwdrv Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited]
[内容:e:\program files\需要安装的大型软件\rising\rfw\rsfwdrv.sys]

[编号:138]
[名称:RsRavMon Service]
[类型:服务:未知]
[内容:"E:\Program Files\需要安装的大型软件\Rising\Rav\Ravmond.exe"]

[编号:139]
[名称:TL-WN321G 1.0 USB Wireless Adapter]
[类型:服务:Ralink 802.11 Wireless Adapters Copyright (C) 2005 Ralink Technology, Corp.]
[内容:C:\WINDOWS\system32\drivers\rt73.sys]

[编号:140]
[名称:Realtek 10/100/1000 NIC Family all in one NDIS XP Driver]
[类型:服务:Realtek 10/100/1000 NIC Family all in one NDIS Driver                            Copyright (C) 2003 Realtek Semiconductor Corporation                          ]
[内容:C:\WINDOWS\system32\drivers\rtlnicxp.sys]

[编号:141]
[名称:Intel(R) PROSet/Wireless Service]
[类型:服务:Intel(R) PROSet/Wireless Service Copyright (c) Intel Corporation 1999-2005]
[内容:C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe]

[编号:142]
[名称:WLAN 传输]
[类型:服务:Intel Wireless LAN Packet Driver Copyright ? Intel Corporation, Inc. 2002-2004 Copyright ? Symbol Technologies, Inc. 1995-1998]
[内容:C:\WINDOWS\system32\drivers\s24trans.sys]

[编号:143]
[名称:Secdrv]
[类型:服务:未知]
[内容:C:\WINDOWS\system32\drivers\secdrv.sys]

[编号:144]
[名称:System Restore Filter Driver]
[类型:服务:未知]
[内容:\SystemRoot\system32\DRIVERS\sr.sys]

[编号:145]
[名称:Synaptics TouchPad Driver]
[类型:服务:Synaptics Pointing Device Driver Copyright (C) Synaptics, Inc. 1996-2005]
[内容:C:\WINDOWS\system32\drivers\syntp.sys]

[编号:146]
[名称:Terminal Services]
[类型:服务:未知]
[内容:C:\WINDOWS\system32\svchost ]

[编号:147]
[名称:Virtual Serial port driver]
[类型:服务:BlueSoleil Copyright (C) IVT Corporation1999-2004]
[内容:C:\WINDOWS\system32\drivers\vcomm.sys]

[编号:148]
[名称:Bluetooth VComm Manager Service]
[类型:服务:BlueSoleil Copyright (C) IVT Corporation1999-2004]
[内容:C:\WINDOWS\system32\drivers\vcommmgr.sys]

[编号:149]
[名称:vcool]
[类型:服务:VCool Driver Copyright (C) 2001 M.Peters]
[内容:c:\windows\system32\vcool.sys]

[编号:150]
[名称:Vinyl AC'97 Audio Controller (WDM)]
[类型:服务:Vinyl AC'97 Codec Combo WDM Driver Copyright (C) VIA Technologies, Inc. 1999-2004]
[内容:C:\WINDOWS\system32\drivers\vinyl97.sys]

[编号:151]
[名称:用于 Windows XP 的英特尔(R) PRO/无线 2200BG 网络连接驱动程序]
[类型:服务:Intel? Wireless LAN Adapter Copyright ? Intel? Corporation 2004]
[内容:C:\WINDOWS\system32\drivers\w29n51.sys]

[编号:152]
[名称:World Wide Web Publishing]
[类型:服务:未知]
[内容:C:\WINDOWS\system32\inetsrv\inetinfo.exe]

[编号:153]
[名称:Intel(R) PROSet/Wireless SSO Service]
[类型:服务:SSO Service Copyright (c) Intel Corporation 1999-2005]
[内容:C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe]

[编号:154]
[名称:XScanPF]
[类型:服务:未知]
[内容:e:\黑之门\工具\嗅探扫描\x-scan-v3.2-cn\dat\xpf.sys]

[编号:155]
[分隔符:---------------------------------------------------------------------]

[编号:156]
[名称:Start Page]
[类型:IE主页-当前用户]
[内容:about:blank]

[编号:157]
[名称:Search Page]
[类型:IE搜索-当前用户]
[内容:http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch]

[编号:158]
[名称:Start Page]
[类型:IE主页-所有用户]
[内容:http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home]

[编号:159]
[名称:Search Page]
[类型:IE搜索-所有用户]
[内容:http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch]

[编号:160]
[名称:Default_Page_URL]
[类型:默认IE主页-所有用户]
[内容:http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome]

[编号:161]
[名称:Default_Search_URL]
[类型:默认IE搜索-所有用户]
[内容:http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch]

[编号:162]
[分隔符:---------------------------------------------------------------------]

[编号:163]
[名称:AcroIEHlprObj Class]
[类型:IE 嵌入对象]
[内容:C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX]

[编号:164]
[名称:]
[类型:IE 嵌入对象]
[内容:C:\WINDOWS\system32\widgetdownload.dll]

[编号:165]
[名称:Thunder Browser Helper]
[类型:IE 嵌入对象]
[内容:C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll]

[编号:166]
[分隔符:---------------------------------------------------------------------]

[编号:167]
[名称:{0A155D3C-68E2-4215-A47A-E800A446447A}]
[类型:IE 扩展按钮]
[内容:浩方对战平台 路径:C:\Program Files\浩方对战平台\GameClient.exe]

[编号:168]
[名称:{223bc3fe-345a-ffee-3c9e-fe12345678e1}]
[类型:IE 扩展按钮]
[内容:溯雪 路径:E:\黑之门\工具\嗅探扫描\溯雪B7\DanSnowB7.exe]

[编号:169]
[名称:{92780B25-18CC-41C8-B9BE-3C9C571A8263}]
[类型:IE 扩展按钮]
[内容:信息检索 路径:信息检索]

[编号:170]
[名称:{FB5F1910-F110-11d2-BB9E-00C04F795683}]
[类型:IE 扩展按钮]
[内容:Messenger 路径:C:\Program Files\Messenger\msmsgs.exe]

[编号:171]
[分隔符:---------------------------------------------------------------------]

[编号:172]
[名称:&使用迅雷下载]
[类型:IE 右键按钮]
[内容: 路径:er\m]

[编号:173]
[名称:&使用迅雷下载全部链接]
[类型:IE 右键按钮]
[内容: 路径:er\m]

[编号:174]
[分隔符:---------------------------------------------------------------------]

[编号:175]
[名称:{233A9694-667E-11D1-9DFB-006097D50408}]
[类型:Outlook Express Address Book <IE控件>]
[内容:%ProgramFiles%\Outlook Express\msoe.dll]

[编号:176]
[分隔符:---------------------------------------------------------------------]

[编号:177]
[名称:wwwroot$]
[类型:共享文件]
[内容:c:\inetpub\wwwroot
]

[编号:178]
[分隔符:---------------------------------------------------------------------]

[编号:179]
[名称:PostBootReminder]
[类型:正常嵌入对象]
[内容:%SystemRoot%\system32\SHELL32.dll]

[编号:180]
[名称:CDBurn]
[类型:正常嵌入对象]
[内容:%SystemRoot%\system32\SHELL32.dll]

[编号:181]
[名称:WebCheck]
[类型:正常嵌入对象]
[内容:%SystemRoot%\system32\webcheck.dll]

[编号:182]
[名称:SysTray]
[类型:正常嵌入对象]
[内容:C:\WINDOWS\system32\stobject.dll]

[编号:183]
[分隔符:---------------------------------------------------------------------]

[编号:184]
[名称:]
[类型:EXE关联]
[内容:"%1" %*]

[编号:185]
[名称:]
[类型:TXT关联]
[内容:%SystemRoot%\system32\NOTEPAD.EXE %1]

[编号:186]
[名称:]
[类型:vbs关联]
[内容:%SystemRoot%\System32\WScript.exe "%1" %*]

[编号:187]
[名称:]
[类型:Js关联]
[内容:%SystemRoot%\System32\WScript.exe "%1" %*]

[编号:188]
[名称:]
[类型:htmlfile关联]
[内容:"C:\Program Files\Maxthon\Maxthon.exe" "%1"]

[编号:189]
[名称:]
[类型:HTTP协议]
[内容:"C:\Program Files\Maxthon\Maxthon.exe" "%1"]

[编号:190]
[名称:]
[类型:FTP协议]
[内容:"C:\PROGRA~1\INTERN~1\iexplore.exe" -nohome]

[编号:191]
[分隔符:---------------------------------------------------------------------]

[编号:192]
[名称:c:\windows\system32\deskpan.dll]
[类型:第三方 COM/ActiveX组件]
[内容:显示摇曳 CPL 扩展---发布公司:未知]

http://www.pctutu.com/srmsdown.asp
下载超级兔子..用超级兔子清理王卸载流氓软件...(安全模式...)


http://forum.ikaka.com/topic.asp?board=28&artid=8105899
下载HijackThis...把日志帖上来..

好的，马上，先谢谢了

Logfile of HijackThis v1.99.1
Scan saved at 9:28:02, on 2006-08-07
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
E:\Program Files\需要安装的大型软件\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
E:\Program Files\需要安装的大型软件\Rising\Rav\Ravmond.exe
e:\program files\需要安装的大型软件\rising\rfw\rfwsrv.exe
E:\Program Files\需要安装的大型软件\Rising\Rav\RavStub.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\Explorer.EXE
E:\Program Files\需要安装的大型软件\Rising\Rav\RavTask.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Program Files\需要安装的大型软件\Rising\Rav\Ravmon.exe
E:\Program Files\免安装绿色软件\未知木马清除器Hijackthis.exe
C:\Program Files\Maxthon\Maxthon.exe
E:\Program Files\免安装绿色软件\音速启动\VStart.exe
E:\Program Files\免安装绿色软件\未知木马清除器Hijackthis.exe
C:\WINDOWS\system32\Notepad.exe
E:\Program Files\需要安装的大型软件\Rising\Rfw\rfwmain.exe
C:\Program Files\Thunder Network\Thunder\Program\Thunder5.exe
E:\down\HijackThis V1.99.1 汉化版\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {105E4D0C-5E21-41ED-90F9-013EEF271BD6} - C:\WINDOWS\system32\widgetdownload.dll
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll
O3 - Toolbar: (no name) - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - (no file)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [VStart5.0] E:\Program Files\免安装绿色软件\音速启动\VStart.exe
O4 - HKLM\..\Run: [RavTask] "E:\Program Files\需要安装的大型软件\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [RfwMain] "E:\Program Files\需要安装的大型软件\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [XDeskShow] E:\PROGRAM FILES\免安装绿色软件\鱼鱼软件\鱼鱼桌面秀\XDeskShow.exe
O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - C:\Program Files\浩方对战平台\GameClient.exe
O9 - Extra button: 溯雪 - {223bc3fe-345a-ffee-3c9e-fe12345678e1} - E:\黑之门\工具\嗅探扫描\溯雪B7\DanSnowB7.exe
O9 - Extra 'Tools' menuitem: 溯雪 - {223bc3fe-345a-ffee-3c9e-fe12345678e1} - E:\黑之门\工具\嗅探扫描\溯雪B7\DanSnowB7.exe
O9 - Extra button: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\需要安~1\OFFICE~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{139DE9F9-2D2C-4EFF-B576-AC451DEA2BF8}: NameServer = 192.168.0.101
O17 - HKLM\System\CCS\Services\Tcpip\..\{1709FE2C-BA5B-4317-BD19-D069E84300EA}: NameServer = 202.101.224.69,202.101.226.68
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Disk Manager Logical - Unknown owner - C:\WINDOWS\WindowsShell.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - e:\program files\需要安装的大型软件\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - e:\program files\需要安装的大型软件\rising\rfw\rfwsrv.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - E:\Program Files\需要安装的大型软件\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - E:\Program Files\需要安装的大型软件\Rising\Rav\Ravmond.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

大侠你看是不是
O23 - Service: Disk Manager Logical - Unknown owner - C:\WINDOWS\WindowsShell.exe
这项比较可疑啊？

O23 - Service: Disk Manager Logical - Unknown owner - C:\WINDOWS\WindowsShell.exe
安全模式...打开注册表编辑器，展开：HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
搜索Disk Manager Logical 删除..
删除
C:\WINDOWS\WindowsShell.exe


修复
O2 - BHO: (no name) - {105E4D0C-5E21-41ED-90F9-013EEF271BD6} - C:\WINDOWS\system32\widgetdownload.dll
O3 - Toolbar: (no name) - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - (no file)

删除
C:\WINDOWS\system32\widgetdownload.dll

http://www.pctutu.com/srmsdown.asp
下载超级兔子..用超级兔子清理王卸载流氓软件...(安全模式...)

哈哈，已经解决！！！
谢谢大侠！