最新正版瑞星，安全模式下也无法杀除。
再次开机又出现！
Logfile of HijackThis v1.99.1
Scan saved at 9:38:05, on 2006-11-15
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
E:\WINNT\System32\smss.exe
E:\WINNT\system32\csrss.exe
E:\WINNT\system32\winlogon.exe
E:\WINNT\system32\services.exe
E:\WINNT\system32\lsass.exe
F:\RAV\CCENTER.EXE
f:\rav\rfw\rfwsrv.exe
E:\WINNT\system32\svchost.exe
E:\WINNT\system32\spoolsv.exe
E:\WINNT\system32\msdtc.exe
E:\WINNT\system32\drivers\CDAC11BA.EXE
E:\WINNT\system32\DRIVERS\CDANTSRV.EXE
E:\WINNT\system32\svchost.exe
E:\WINNT\System32\svchost.exe
E:\WINNT\system32\rundll32.exe
E:\WINNT\system32\nvsvc32.exe
E:\WINNT\system32\regsvc.exe
E:\WINNT\system32\MSTask.exe
E:\Program Files\Internet Explorer\iexplore.exe
E:\WINNT\System32\snmp.exe
E:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
E:\WINNT\system32\rundll32.exe
E:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
E:\WINNT\System32\WBEM\WinMgmt.exe
E:\program files\internet explorer\IEXPLORE.EXE
E:\WINNT\system32\svchost.exe
E:\WINNT\system32\mqsvc.exe
E:\WINNT\Explorer.EXE
F:\Rav\RavTask.exe
E:\WINNT\system32\Rundll32.exe
f:\rav\rfw\RfwMain.exe
F:\Rav\Ravmond.exe
F:\Rav\RAVMON.EXE
F:\Rav\RavStub.exe
E:\PROGRA~1\INTERN~1\IEXPLORE.EXE
H:\木马工具\ha_hijackthis_1991\HijackThis.exe

O2 - BHO: Vision - {6671A431-5C3D-463d-A7CF-5587F9B7E191} - E:\PROGRA~1\MMSASS~1\mmsass~1.dll
O2 - BHO: (no name) - {6671A431-5C3D-463d-A7CF-5587F9B7E191}? - (no file)
O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINNT\system32\msdxm.ocx
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - E:\WINNT\system32\KakaTool.dll
O4 - HKLM\..\Run: [RavTask] "F:\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: >>彩信发送<< - res://E:\PROGRA~1\MMSASS~1\mmsass~1.dll/mms.htm
O9 - Extra button: Yahoo 3.5G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail (file missing)
O9 - Extra button: 名品折扣 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://adtaobao.allyes.com/main/adfclick?db=adtaobao&bid=138,140,18&cid=816,8,1&sid=5042&show=ignore&url=http://www.taobao.com/vertical/mall/pro.php?allyesPara=816 (file missing)
O9 - Extra button: 雅虎助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist (file missing)
O9 - Extra button: 雅虎WIDGET - {6354ABE6-05F1-49ed-B850-E423120EC338} - http://cn.widget.yahoo.com/index.htm?source=Cns (file missing)
O9 - Extra button: (no name) - {6671A433-5C3D-463d-A7CF-5587F9B7E191} - E:\PROGRA~1\MMSASS~1\mmsass~1.dll
O9 - Extra 'Tools' menuitem: 彩E精灵设置 - {6671A433-5C3D-463d-A7CF-5587F9B7E191} - E:\PROGRA~1\MMSASS~1\mmsass~1.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - E:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - E:\WINNT\web\related.htm
O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg (file missing)
O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - Extra 'Tools' menuitem: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O9 - Extra 'Tools' menuitem: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O12 - Plugin for .pdf: E:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {3048123A-ED27-47AE-B5AF-A630E991514C} (BigAttach Control) - http://211.150.96.79:6682/BigAttach.cab
O16 - DPF: {3C38DEE8-BE1A-4DEC-B232-2C78706CC7EA} (GUpdate Class) - http://ps.itv.mop.com/update/update/GUpdate-1.0.0.8-signed.cab
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/normalbank/AxSafeControls.cab
O16 - DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} (AxSubmitControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O16 - DPF: {D1056C7C-E30B-4234-9A4B-7E1038B167A7} (RootCertInstall Class) - https://mybank.icbc.com.cn/icbc/perbank/RootCert.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7AEE9896-CCB5-47FC-9773-9EE026F28DDA}: NameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{7AEE9896-CCB5-47FC-9773-9EE026F28DDA}: NameServer = 10.64.1.20
O17 - HKLM\System\CS2\Services\Tcpip\..\{7AEE9896-CCB5-47FC-9773-9EE026F28DDA}: NameServer = 192.168.1.1
O17 - HKLM\System\CS3\Services\Tcpip\..\{7AEE9896-CCB5-47FC-9773-9EE026F28DDA}: NameServer = 192.168.1.1
O21 - SSODL: webwork - {4C611512-2C1D-44b2-A044-872AD2AD5A61} - E:\WINNT\webwork\webwork.dll
O23 - Service: C-DillaCdaC11BA - Macrovision - E:\WINNT\system32\drivers\CDAC11BA.EXE
O23 - Service: C-DillaSrv - C-Dilla Ltd - E:\WINNT\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - E:\WINNT\System32\dmadmin.exe
O23 - Service: Gray_Pigeon_Server1.23 (GrayPigeonServer1.23) - Unknown owner - E:\WINNT\G_Server1.23.exe
O23 - Service: NHCP Service Logs For Networks (NetworksLogs5) - Unknown owner - E:\WINNT\system32\msvcll.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINNT\system32\nvsvc32.exe
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - f:\rav\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - f:\rav\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - F:\RAV\CCENTER.EXE
O23 - Service: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - F:\Rav\Ravmond.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - E:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - E:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: media-play_service (wmpsvc) - Unknown owner - E:\Program Files\Common Files\Microsoft Shared\MSINFO\wmpsvc.exe