症状现象：每个盘有隐藏文件夹Temp3721TRua,里面含有3个文件
autorun.inf.1.malicious,autorun.inf.2.malicious,autorun.inf.malicious。IE浏览器随时无故、自
动打开2、3个固定网页（www.37ss.com和www.pengpeng.com(此网页自动加入收藏夹)）。卸载IE，重装后
症状一样。用雅虎助手强烈修复，没有效果。
打开word等文件，office出现“正在安装”等对话框后等许久后才打开第一次，word文件的默认打开方式
变成了写字板。
望救星能解释缘由并提出解决方案，万分感谢，我已经郁闷了1周多了，哭啊！
日志如下：
ogfile of HijackThis v1.99.1
Scan saved at 21:52:21, on 2006-10-23
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
e:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
e:\Program Files\Rising\Rav\Ravmond.exe
C:\WINDOWS\Explorer.EXE
e:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Svchost.exe
C:\WINDOWS\SYSTEM32\RUN32.EXE
e:\program files\rising\rfw\RfwMain.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Yahoo!\ASSIST~1\ylive.exe
E:\Program Files\Rising\Rav\RavMon.exe
C:\WINDOWS\System32\conime.exe
C:\Program Files\Internet Explorer\iexplore.exe
E:\Program Files\Maxthon\Maxthon.exe
C:\WINDOWS\System32\alexa.exe
e:\Program Files\Thunder Network\Thunder\Program\Thunder5.exe
e:\Program Files\Rising\Rav\RsAgent.exe
C:\WINDOWS\msagent\AgentSvr.exe
C:\WINDOWS\system32\NOTEPAD.EXE
F:\TDdownload\hijackthis\HijackThis.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program
Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &使用迅雷下载 - e:\Program Files\Thunder
Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - e:\Program Files\Thunder
Network\Thunder\Program\GetAllUrl.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://D:\PROGRA~1
\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到雅虎订阅(&Y) - res://C:\PROGRA~1\Yahoo!\ASSIST~1
\Assist\yrss.dll/YRSSMENUEXT
O8 - Extra context menu item: 雅虎搜索 - res://C:\PROGRA~1\Yahoo!\ASSIST~1
\Assist\yasbar.dll/246
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash
Object) -
http://www.mydrivers.com/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1757074C-455D-4739-AC84-E41D00B3B972}: NameServer =
61.139.2.69
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology
Co., Ltd. - e:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology
Co., Ltd. - e:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. -
e:\Program Files\Rising\Rav\Ravmond.exe
