瑞星卡卡安全论坛

电脑安装瑞星网络版，现升级到17.78.40，用瑞星手动查毒时没发现病毒，但实时监控时发现2个病毒：一个是worm.mail.silly.i,另一个是worm.mail.ghost.f，在安全模式下杀毒也没有用。请问高手：如何杀去这两个病毒？

【回复“海浪之魂”的帖子】
病毒文件名称与路径？

worm.mail.ghost.f在D：\WINDOWS.exe
或C:\Documents and Settings\All Users\「开始」菜单\程序\启动\startup.bat

worm.mail.silly.i在D;\folder.htt

本机安装的是win2000,windows安装在C:，不是D：
请高手们指点，谢了。

【回复“海浪之魂”的帖子】
安全模式下删除

谢谢不言放弃高手。但我进入安全模式后，没有发现上述三个文件，所以无法删除。问题依然存在。
下面是我用HijackThis.exe扫描的，不知能否发现问题：
Logfile of HijackThis v1.99.1
Scan saved at 15:48:41, on 2006-5-15
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
C:\PROGRAM FILES\RISING\RAV\RavStub.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Rising\Rav\RavService.exe
C:\WINNT\system32\regsvc.exe
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\igfxtray.exe
C:\WINNT\system32\hkcmd.exe
C:\WINNT\SOUNDMAN.EXE
C:\Program Files\Rising\Rav\RavTray.exe
C:\Program Files\Rising\Rav\RavTimer.exe
C:\Program Files\Rising\Rav\RavMon.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
E:\BACKUP\杀毒\ha_hijackthis_1991\HijackThis.exe

R3 - Default URLSearchHook is missing
O2 - BHO: SnapFlash Class - {A44CBB0B-C77D-4BF5-87CC-B4EE79AD1B7E} - C:\Program Files\Common Files\justDo\Jd2002.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FLASHGET\jccatch.dll
O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RavTray] C:\Program Files\Rising\Rav\RavTray.exe
O4 - HKLM\..\Run: [RavTimer] C:\Program Files\Rising\Rav\RavTimer.exe
O4 - HKLM\..\Run: [RavMon] C:\Program Files\Rising\Rav\RavMon.exe -system
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [pbmini] C:\Program Files\pcast\PodcastbarMini\PodcastBarMiniStater.exe
O8 - Extra context menu item: Save Flash with Flash Catcher - res://C:\Program Files\Common Files\justDo\IECatcher.DLL/FlashCatcher.htm
O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: 导出到 Microsoft Excel(&x) - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java 控制台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Flash Catcher - {90BAE0EF-F4BF-4FAC-B2EC-2C725C34AF12} - C:\Program Files\Common Files\justDo\IECatcher.DLL
O9 - Extra 'Tools' menuitem: Flash Catcher - {90BAE0EF-F4BF-4FAC-B2EC-2C725C34AF12} - C:\Program Files\Common Files\justDo\IECatcher.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE (file missing)
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE (file missing)
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{060C643F-0E48-4A4F-A137-CE2E2BB0AC38}: NameServer = 10.32.1.11,61.175.153.129
O17 - HKLM\System\CS1\Services\Tcpip\..\{060C643F-0E48-4A4F-A137-CE2E2BB0AC38}: NameServer = 10.32.1.11,61.175.153.129
O17 - HKLM\System\CS2\Services\Tcpip\..\{060C643F-0E48-4A4F-A137-CE2E2BB0AC38}: NameServer = 10.32.1.11,61.175.153.129
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: RavService - Unknown owner - C:\Program Files\Rising\Rav\RavService.exe" /service (file missing)
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe

我查阅了网上许多资料，有人说：病毒在svchost.exe进程中，win2000中svchost.exe一般有2个，而我的电脑现在有3个，请问如何处理？
下面是用Norton Process Viewer（Norton出品的进程管理器） 5.2 汉化版扫描出来的内容：
CCENTER.EXE604C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
csrss.exe168C:\WINNT\system32\csrss.exe
ctfmon.exe1064C:\WINNT\system32\ctfmon.exe
Explorer.EXE920C:\WINNT\Explorer.EXE
hkcmd.exe1024C:\WINNT\system32\hkcmd.exe
iexplore.exe3012C:\Program Files\Internet Explorer\iexplore.exe
igfxtray.exe1016C:\WINNT\system32\igfxtray.exe
lsass.exe228C:\WINNT\system32\lsass.exe
MSTask.exe616C:\WINNT\system32\MSTask.exe
Rav.exe2804C:\Program Files\Rising\Rav\Rav.exe
RavMon.exe1056C:\Program Files\Rising\Rav\RavMon.exe
Ravmond.exe380C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
RavService.exe564C:\Program Files\Rising\Rav\RavService.exe
RavStub.exe408C:\PROGRAM FILES\RISING\RAV\RavStub.exe
RavTimer.exe1048C:\Program Files\Rising\Rav\RavTimer.exe
RavTray.exe1040C:\Program Files\Rising\Rav\RavTray.exe
regsvc.exe592C:\WINNT\system32\regsvc.exe
services.exe216C:\WINNT\system32\services.exe
smss.exe144C:\WINNT\System32\smss.exe
SOUNDMAN.EXE1032C:\WINNT\SOUNDMAN.EXE
spoolsv.exe488C:\WINNT\system32\spoolsv.exe
  svchost.exe444C:\WINNT\system32\svchost.exe
  svchost.exe520C:\WINNT\system32\svchost.exe
  svchost.exe696C:\WINNT\system32\svchost.exe
taskmgr.exe3968C:\Downloads\Norton Process Viewer（Norton出品的进程管理器） 5.2 汉化版\Norton Process Viewer（Norton出品的进程管理器） 5.2 汉化版\Norton Process Viewer（Norton出品的进程管理器） 5.2 汉化版\taskmgr.exe
winlogon.exe188C:\WINNT\system32\winlogon.exe
WinMgmt.exe668C:\WINNT\System32\WBEM\WinMgmt.exe
WINWORD.EXE2020C:\Program Files\Microsoft Office\Office10\WINWORD.EXE

以下是用System Repair Engineer 2.0.12.350扫描的内容:
2006-05-18,07:43:51

System Repair Engineer 2.0.12.350 (2.0 RC 1)
    Windows 2000 Professional Service Pack 4 - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <ctfmon.exe><ctfmon.exe>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <load><>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <Synchronization Manager><mobsync.exe /logon>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <IgfxTray><C:\WINNT\system32\igfxtray.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <HotKeysCmds><C:\WINNT\system32\hkcmd.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <SoundMan><SOUNDMAN.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <RavTray><C:\Program Files\Rising\Rav\RavTray.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <RavTimer><C:\Program Files\Rising\Rav\RavTimer.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <RavMon><C:\Program Files\Rising\Rav\RavMon.exe -system>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <shell><Explorer.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <Userinit><C:\WINNT\system32\userinit.exe,>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <AppInit_DLLs><>
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  <ctfmon.exe><; ctfmon.exe>
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  <pbmini><; C:\Program Files\pcast\PodcastbarMini\PodcastBarMiniStater.exe>

==================================
启动文件夹
服务
[Logical Disk Manager Administrative Service / dmadmin]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[Macromedia Licensing Service / Macromedia Licensing Service]
  <"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><N/A>
[RavService / RavService]
  <"C:\Program Files\Rising\Rav\RavService.exe" /service><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter]
  <C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
  <C:\PROGRAM FILES\RISING\RAV\Ravmond.exe><Beijing Rising Technology Co., Ltd.>

==================================

接上面：
浏览器加载项
[SnapFlash Class]
  {A44CBB0B-C77D-4BF5-87CC-B4EE79AD1B7E} <C:\Program Files\Common Files\justDo\Jd2002.dll, justDo Software>
[IeCatch2 Class]
  {A5366673-E8CA-11D3-9CD9-0090271D075B} <C:\PROGRA~1\FLASHGET\jccatch.dll, Amaze Soft>
[Java Plug-in 1.5.0_04]
  {08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll, Sun Microsystems, Inc.>
[Flash Catcher]
  {90BAE0EF-F4BF-4FAC-B2EC-2C725C34AF12} <, N/A>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, N/A>
[FlashGet]
  {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\flashget.exe, Amaze Soft>
[@msdxmLC.dll,-1@2052,电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[FlashGet Bar]
  {E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[Java Plug-in 1.5.0_04]
  {8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.5.0_04]
  {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll, Sun Microsystems, Inc.>
[Save Flash with Flash Catcher]
  <res://C:\Program Files\Common Files\justDo\IECatcher.DLL/FlashCatcher.htm, N/A>
[使用网际快车下载]
  <C:\Program Files\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
  <C:\Program Files\FlashGet\jc_all.htm, N/A>
[导出到 Microsoft Excel(&x)]
  <res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
  <C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================

接上面：　
正在运行的进程
[PID: 144][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.00.2195.6601>
[PID: 168][\??\C:\WINNT\system32\csrss.exe]  <Microsoft Corporation><5.00.2195.6601>
[PID: 188][\??\C:\WINNT\system32\winlogon.exe]  <Microsoft Corporation><5.00.2195.6970>
[PID: 216][C:\WINNT\system32\services.exe]  <Microsoft Corporation><5.00.2195.6700>
    [C:\WINNT\system32\dmserver.dll]  <VERITAS Software Corp.><2195.6605.297.3>
[PID: 228][C:\WINNT\system32\lsass.exe]  <Microsoft Corporation><5.00.2195.6902>
[PID: 380][C:\PROGRAM FILES\RISING\RAV\Ravmond.exe]  <Beijing Rising Technology Co., Ltd.><17, 0, 1, 58>
    [C:\PROGRAM FILES\RISING\RAV\guidll.dll]  <rising><17, 0, 0, 13>
    [C:\PROGRAM FILES\RISING\RAV\RsCommX.dll]  <rising><17, 0, 0, 3>
    [C:\PROGRAM FILES\RISING\RAV\RSAPPMGR.DLL]  <Rising Corp.><17, 0, 0, 7>
    [C:\PROGRAM FILES\RISING\RAV\CfgDll.dll]  <Rising Corp.><17, 0, 1, 71>
    [C:\Program Files\Rising\Rav\Scanner.dll]  <Rising><17, 0, 0, 43>
    [C:\PROGRAM FILES\RISING\RAV\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><17, 0, 0, 17>
    [C:\Program Files\Rising\Rav\libload.dll]  <Rising><17, 0, 0, 14>
    [C:\Program Files\Rising\Rav\VirusLib.dll]  <Rising><17, 0, 0, 26>
    [C:\PROGRAM FILES\RISING\RAV\MailMon.dll]  < ><17, 0, 0, 9>
    [C:\Program Files\Rising\Rav\engine.dll]  <rising><17, 0, 0, 43>
    [C:\Program Files\Rising\Rav\SpamEng.dll]  <N/A><17, 0, 0, 7>
    [C:\Program Files\Rising\Rav\UnExe.dll]  <Rising><17, 0, 0, 31>
    [C:\Program Files\Rising\Rav\ScanEx.dll]  <Rising><17, 0, 0, 35>
    [C:\PROGRAM FILES\RISING\RAV\MemMon.dll]  <北京瑞星><17, 8, 0, 0>
    [C:\Program Files\Rising\Rav\PostTrt.dll]  <Rising><17, 0, 0, 21>
    [C:\Program Files\Rising\Rav\NvFile.dll]  <瑞星><17, 0, 0, 13>
    [C:\PROGRAM FILES\RISING\RAV\expscan.dll]  <N/A><17, 0, 0, 6>
    [C:\PROGRAM FILES\RISING\RAV\mPorts.dll]  <Beijing Rising Technology Corporation Limited><3, 0, 0, 3>
    [C:\PROGRAM FILES\RISING\RAV\regmon.dll]  < ><17, 0, 0, 12>
    [C:\PROGRAM FILES\RISING\RAV\HookWeb.dll]  <rising><17, 0, 0, 4>
    [C:\Program Files\Rising\Rav\ScanMac.dll]  <rising><17, 0, 0, 20>
    [C:\Program Files\Rising\Rav\ScanSct.dll]  <rising><17, 0, 0, 37>
    [C:\Program Files\Rising\Rav\ScanExec.dll]  <N/A><17, 0, 0, 23>
    [C:\Program Files\Rising\Rav\Unpacker.dll]  <rising><17, 0, 0, 19>
    [C:\Program Files\Rising\Rav\RsStore.dll]  <Beijing Rising Technology Co., Ltd.><17, 0, 0, 10>
    [C:\Program Files\Rising\Rav\posttrtx.dll]  <瑞星科技股份有限公司><17, 0, 0, 32>
[PID: 412][C:\PROGRAM FILES\RISING\RAV\RavStub.exe]  <Beijing Rising Technology Co., Ltd.><17, 0, 0, 27>
    [C:\PROGRAM FILES\RISING\RAV\RsCommX.dll]  <rising><17, 0, 0, 3>
    [C:\PROGRAM FILES\RISING\RAV\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><17, 0, 0, 17>
[PID: 448][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 488][C:\WINNT\system32\spoolsv.exe]  <Microsoft Corporation><5.00.2195.7059>
[PID: 520][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 576][C:\Program Files\Rising\Rav\RavService.exe]  <Beijing Rising Technology Co., Ltd.><17, 0, 0, 73>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><17, 0, 0, 3>
[PID: 596][C:\WINNT\system32\regsvc.exe]  <Microsoft Corporation><5.00.2195.6701>
[PID: 608][C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE]  <Beijing Rising Technology Co., Ltd.><17, 0, 0, 6>
[PID: 620][C:\WINNT\system32\MSTask.exe]  <Microsoft Corporation><4.71.2195.6920>
[PID: 672][C:\WINNT\System32\WBEM\WinMgmt.exe]  <Microsoft Corporation><1.50.1085.0100>
[PID: 700][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 920][C:\WINNT\Explorer.EXE]  <Microsoft Corporation><5.00.3700.6690>
    [C:\PROGRA~1\FLASHGET\jccatch.dll]  <Amaze Soft><1, 1, 4, 0>
    [C:\Program Files\WinRAR\rarext.dll]  <N/A><N/A>
    [C:\WINNT\system32\RavExt.DLL]  <Beijing Rising Technology Co., Ltd.><17, 0, 0, 8>
[PID: 1000][C:\WINNT\system32\igfxtray.exe]  <Intel Corporation><3.0.0.2331>
    [C:\WINNT\system32\hccutils.DLL]  <Intel Corporation><3.0.0.2331>
    [C:\WINNT\system32\igfxdev.dll]  <Intel Corporation><3.0.0.2331>
    [C:\WINNT\system32\igfxsrvc.dll]  <Intel Corporation><3.0.0.2331>
    [C:\WINNT\system32\igfxres.dll]  <Intel Corporation><3.0.0.2331>
    [C:\WINNT\system32\igfxress.dll]  <Intel Corporation><3.0.0.2331>
[PID: 1008][C:\WINNT\system32\hkcmd.exe]  <Intel Corporation><3.0.0.2331>
    [C:\WINNT\system32\hccutils.DLL]  <Intel Corporation><3.0.0.2331>
    [C:\WINNT\system32\igfxdev.dll]  <Intel Corporation><3.0.0.2331>
    [C:\WINNT\system32\igfxsrvc.dll]  <Intel Corporation><3.0.0.2331>
    [C:\WINNT\system32\igfxhk.dll]  <Intel Corporation><3.0.0.2331>
    [C:\WINNT\system32\igfxres.dll]  <Intel Corporation><3.0.0.2331>
[PID: 1016][C:\WINNT\SOUNDMAN.EXE]  <Realtek Semiconductor Corp.><5.1.09>
[PID: 1024][C:\Program Files\Rising\Rav\RavTray.exe]  <Rising><17, 0, 0, 32>
    [C:\Program Files\Rising\Rav\RavTray936.dll]  <Rising><17, 0, 0, 28>
    [C:\Program Files\Rising\Rav\RsCommx.dll]  <rising><17, 0, 0, 3>
[PID: 1032][C:\Program Files\Rising\Rav\RavTimer.exe]  <Beijing Rising Technology Co., Ltd.><17, 0, 0, 36>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><17, 0, 0, 17>
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Rising Corp.><17, 0, 0, 7>
    [C:\Program Files\Rising\Rav\CfgDll.dll]  <Rising Corp.><17, 0, 1, 71>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><17, 0, 0, 3>
[PID: 1040][C:\Program Files\Rising\Rav\RavMon.exe]  <Beijing Rising Technology Co., Ltd.><17, 0, 1, 39>
    [C:\Program Files\Rising\Rav\RsGuiLib.dll]  <Beijing Rising Technology Co., Ltd.><17, 0, 0, 40>
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Rising Corp.><17, 0, 0, 7>
    [C:\Program Files\Rising\Rav\CfgDll.dll]  <Rising Corp.><17, 0, 1, 71>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><17, 0, 0, 3>
    [C:\Program Files\Rising\Rav\PngDll.dll]  <Rising><17, 0, 0, 2>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><17, 0, 0, 17>
[PID: 1048][C:\WINNT\system32\ctfmon.exe]  <Microsoft Corporation><1.00.2409.7 built by: Lab06_N>
[PID: 1216][C:\Program Files\Internet Explorer\iexplore.exe]  <Microsoft Corporation><6.00.2800.1106>
    [C:\Program Files\Common Files\justDo\Jd2002.dll]  <justDo Software><2, 6, 0, 1>
    [C:\PROGRA~1\FLASHGET\jccatch.dll]  <Amaze Soft><1, 1, 4, 0>
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  <><17, 0, 0, 8>
    [C:\WINNT\system32\macromed\flash\Flash.ocx]  <Macromedia, Inc.><7,0,14,0>
    [C:\WINNT\system32\CHENHU4.IME]  <chenhu><5.6>
[PID: 1652][C:\Program Files\FlashGet\flashget.exe]  <Amaze Soft><1, 6, 5, 0>
[PID: 1592][E:\BACKUP\杀毒\System Repair Engineer 2.0.12.350\SREng.exe]  <Smallfrogs Studio><2.0.12.350>

接上面：
==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================
[完毕]

请高手们分析。这2个病毒发作次数逐渐增多，希望近几日能被各位高手们破解。否则只能重新安装的份了。。。。。。。。。。

【回复“海浪之魂”的帖子】
日志没有什么问题

用HIJACKTHIS修复
O4 - HKCU\..\Run: [pbmini] C:\Program Files\pcast\PodcastbarMini\PodcastBarMiniStater.exe

卸载
C:\Program Files\pcast\

删除
C:\Program Files\pcast\

另：
若文件找不到
建议作如下操作：
打开我的电脑
在工具栏中点击－－工具－－文件夹选项－－查看
勾选“显示所有文件及文件夹”
同时把“隐藏受保护的操作系统文件（推荐）”前的勾去掉
然后再进行查找一下

用HIJACKTHIS已经修复
O4 - HKCU\..\Run: [pbmini] C:\Program Files\pcast\PodcastbarMini\PodcastBarMiniStater.exe

但没有C:\Program Files\pcast\，所以无法卸载或删除

在前面查找和删除过程中，已经操作了以下过程：
勾选“显示所有文件及文件夹”
同时把“隐藏受保护的操作系统文件（推荐）”前的勾去掉


手动没发现病毒，实时监控时发现的病毒，瑞星马上删除了。
病毒还在发作。我们单位中好多电脑都是如此。

有没有更好的办法进行解决？