只要浏览器一找不到网页就打开两个站：
http://www.10dian.net/
还有一个就是大唐下载



清除后重启动就会再有！
病毒路径如下图：



这个应该是系统的关键进程，所以结束不了此进程！
下图是超级兔子查到的：




瑞星也杀不到啊，怎么办？
请教各位帮忙！

请问怎么清除呢？

顶

我扫一下先，谢谢

HijackThis@Qoo的扫描日志  V1.97.7
Scan saved at 22:01:35, on 2005-11-6
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
D:\mysql\bin\mysqld-nt.exe
d:\program files\rising\rfw\rfwsrv.exe
D:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
D:\PROGRAM FILES\RISING\RAV\Ravmond.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\services.exe
D:\Program Files\Rising\Rfw\rfwmain.exe
D:\Program Files\Rising\Rav\RavTimer.exe
D:\Program Files\Rising\Rav\RavMon.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Thunder Network\Thunder\Thunder.exe
C:\WINDOWS\system32\conime.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\Iparmor\Iparmor.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Coffee\桌面\hijackthis1.97_qoo\HijackThis.exe

O2 - BHO: (no name) - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v8.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NVMixerTray] ; "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [RfwMain] d:\Program Files\Rising\Rfw\rfwmain.exe
O4 - HKLM\..\Run: [RavTimer] d:\Program Files\Rising\Rav\RavTimer.exe
O4 - HKLM\..\Run: [RavMon] d:\Program Files\Rising\Rav\RavMon.exe -system
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Super Rabbit IEPro] D:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD
O4 - HKCU\..\Run: [services] C:\WINDOWS\services.exe
O4 - HKCU\..\RunServices: [services] C:\WINDOWS\services.exe
O4 - Startup: NTUSER.DAT
O4 - Startup: ntuser.dat.LOG
O4 - Startup: ntuser.ini
O8 - Extra context menu item: &使用迅雷下载 - d:\Program Files\Thunder Network\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - d:\Program Files\Thunder Network\Thunder\getallurl.htm
O8 - Extra context menu item: 导出到 Microsoft Excel(&x) - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (CEditCtrl Object) - https://img.alipay.com/download/aliedit.cab
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - %SystemRoot%\system32\mshtml.dll

引用:

【命运里の金色的贴子】把这个文件打包发到virusdied@yahoo.com.cn ...........................

好的

已经发送到virusdied@yahoo.com.cn，谢谢

好的，谢谢

以下是最新信息：

HijackThis_zww汉化版扫描日志 V1.99.1
保存于      22:31:55, 日期 2005-11-6
操作系统：  Windows XP SP2 (WinNT 5.01.2600)
浏览器：    Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程：         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
D:\mysql\bin\mysqld-nt.exe
d:\program files\rising\rfw\rfwsrv.exe
D:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
D:\PROGRAM FILES\RISING\RAV\Ravmond.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\services.exe
C:\Program Files\Internet Explorer\iexplore.exe
d:\program files\rising\rfw\RfwMain.exe
C:\Documents and Settings\Coffee\桌面\2535952005811174944\HijackThis1991zww.exe

F3 - REG:win.ini: run=C:\WINDOWS\services.exe
O4 - 启动项HKLM\\Run: [services] C:\WINDOWS\services.exe
O4 - 启动项HKLM\\RunServices: [services] C:\WINDOWS\services.exe
O4 - HKCU\..\Run: [services] C:\WINDOWS\services.exe
O4 - 启动项HKCU\\RunServices: [services] C:\WINDOWS\services.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O20 - AppInit_DLLs: APIHookDll.dll
O23 - NT 服务: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - NT 服务: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - NT 服务: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - NT 服务: MySql - Unknown owner - D:/mysql/bin/mysqld-nt.exe
O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - d:\program files\rising\rfw\rfwsrv.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - rising - D:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\PROGRAM FILES\RISING\RAV\Ravmond.exe

我将C:\WINDOWS\system32\services.exe删除了，不知道有什么后果？