现已确认中毒。并且手工用ICEWORD已经在限制线程创建的基础上，清理了很多东西了。
目前清理完后，扫描如下：
[CODE]
2006-12-30,17:04:22
System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)
Windows Server 2003 Enterprise Edition (Build 3790)
- 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
启动项目
注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<Rav><"D:\Program Files\Rising\Rav1\Update\Setup.exe" /UNINSTALL /S /ONCE> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<ntaskldr><D:\WINDOWS\system\logo_1.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><D:\WINDOWS\system32\userinit.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><235780M.BMP> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><%SystemRoot%\system32\logonui.exe> [(Verified)Microsoft Corporation]
==================================
启动文件夹
N/A
==================================
服务
[Human Interface Device Access / HidServ][Stopped/Disabled]
<D:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[RsRavMon Service / RsRavMon][Stopped/Auto Start]
<"D:\Program Files\Rising\Rav1\Ravmond.exe"><N/A>
[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]
<><N/A>
==================================
驱动程序
[ati2mpad / ati2mpad][Running/Manual Start]
<system32\DRIVERS\ati2mpad.sys><ATI Technologies Inc.>
[BaseTDI / BaseTDI][Running/Manual Start]
<2 - 系统找不到指定的文件。
><N/A>
[Intel(R) PRO/1000 Device Driver / E1000][Running/Manual Start]
<system32\DRIVERS\e1000325.sys><Intel Corporation>
[ExpScaner / ExpScaner][Running/Auto Start]
<\??\D:\Program Files\Rising\Rav1\ExpScan.sys><N/A>
[HookCont / HookCont][Running/Auto Start]
<\??\D:\Program Files\Rising\Rav1\HOOKCONT.sys><N/A>
[HookReg / HookReg][Running/Auto Start]
<\??\D:\Program Files\Rising\Rav1\HookReg.sys><N/A>
[HookSys / HookSys][Running/Auto Start]
<\??\D:\Program Files\Rising\Rav1\HookSys.sys><N/A>
[IP in IP Tunnel Driver / IpInIp][Stopped/Manual Start]
<system32\DRIVERS\ipinip.sys><N/A>
[MEMSCAN / MEMSCAN][Running/Auto Start]
<\??\D:\Program Files\Rising\Rav1\MEMSCAN.sys><N/A>
[Netgroup Packet Filter / NPF][Running/Manual Start]
<system32\DRIVERS\npf.sys><CACE Technologies>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
<\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[RSPPSYS / RSPPSYS][Running/Auto Start]
<\??\D:\Program Files\Rising\Rav1\RSPPSYS.sys><N/A>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[Sony USB Filter Driver (SONYPVU1) / SONYPVU1][Stopped/Manual Start]
<system32\DRIVERS\SONYPVU1.SYS><Sony Corporation>
[symmpi / symmpi][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\symmpi.sys><LSI Logic>
[xyfilemon / xyantivirus][Running/Auto Start]
<\??\D:\tem\VRV2005\VRV2005\vrv2005\filemon.sys><BXY>
[squell / squell][Running/]
<2 - 系统找不到指定的文件。
><N/A>
==================================
浏览器加载项
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[上传到QQ网络硬盘]
<D:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
<D:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<D:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<D:\Program Files\Tencent\QQ\SendMMS.htm, N/A>
==================================
正在运行的进程
[PID: 404][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 464][\??\D:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 488][\??\D:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 532][D:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 544][D:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 688][D:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 736][D:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 908][D:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 992][D:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1016][D:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1344][D:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.3790.0 (srv03_rtm.030324-2048)]
[D:\winrar\rarext.dll] [N/A, N/A]
[D:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 7]
[D:\Program Files\Rising\Rav1\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[D:\WINDOWS\235780M.BMP] [N/A, N/A]
[D:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[D:\WINDOWS\system32\spool\DRIVERS\W32X86\3\CNAB4MUI.DLL] [CANON INC., 1.01]
[D:\WINDOWS\system32\spool\DRIVERS\W32X86\3\CNAB4M.DLL] [CANON INC., 1.01]
[D:\WINDOWS\system32\CNAB4SMK.DLL] [CANON INC., 1.01.0.003]
[D:\WINDOWS\system32\spool\DRIVERS\W32X86\3\CNLB0MUI_D402B.DLL] [CANON INC., 1.45]
[D:\WINDOWS\system32\spool\DRIVERS\W32X86\3\CNLB0M_D402B.DLL] [CANON INC., 1.45]
[PID: 1540][D:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[D:\WINDOWS\system32\spool\DRIVERS\W32X86\3\CNAB4MUI.DLL] [CANON INC., 1.01]
[D:\WINDOWS\system32\icm32.dll] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1676][D:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1756][D:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1984][D:\WINDOWS\system32\Dfssvc.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 2416][D:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.3790.0 (srv03_rtm.030324-2048)]
[D:\WINDOWS\235780M.BMP] [N/A, N/A]
[D:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[D:\Program Files\Rising\Rav1\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[D:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[D:\WINDOWS\system32\001836F9.IME] [LongWen Corporation, 3.8.200]
[PID: 3512][D:\Program Files\Tencent\QQ\QQ.exe] [TENCENT, 0, 0, 0, 0]
[D:\Program Files\Tencent\QQ\QQBaseClassInDll.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\QQHelperDll.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\BasicCtrlDll.dll] [Tencent, 5, 0, 200, 160]
[D:\WINDOWS\235780M.BMP] [N/A, N/A]
[D:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[D:\Program Files\Tencent\QQ\QQAPI.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\TIMProxy.dll] [tencent, 0, 3, 2, 4]
[D:\Program Files\Tencent\QQ\LoginCtrl.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\npkcntc.dll] [INCA Internet Co., Ltd., 2006, 3, 2, 1]
[D:\Program Files\Tencent\QQ\npkpdb.dll] [INCA Internet Co., Ltd., 2003, 10, 1, 1]
[D:\Program Files\Tencent\QQ\QQRes.dll] [tencent, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\QQMainFrame.dll] [N/A, N/A]
[D:\Program Files\Tencent\QQ\CQQApplication.dll] [N/A, N/A]
[D:\Program Files\Tencent\QQ\NewSkin.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\HostingMgr.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\CameraDll.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\MailSummary.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\QQSpace.dll] [, 1, 0, 0, 1]
[D:\WINDOWS\system32\msdmo.dll] [N/A, N/A]
[D:\Program Files\Tencent\QQ\QQGroupMng.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\GroupLive.dll] [N/A, N/A]
[D:\Program Files\Tencent\QQ\QQAllInOne.dll] [N/A, N/A]
[D:\Program Files\Tencent\QQ\SCCore.dll] [N/A, N/A]
[D:\Program Files\Tencent\QQ\QQCustomFace.dll] [N/A, N/A]
[D:\Program Files\Tencent\QQ\QQSysMsgMng.dll] [N/A, N/A]
[D:\Program Files\Tencent\QQ\UserDefinedHead.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\QQPlugin.dll] [N/A, N/A]
[D:\Program Files\Tencent\QQ\QQConfigPlugin.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\FlashAvatarDll.dll] [, 1, 4, 0, 1]
[D:\Program Files\Tencent\QQ\QQAvatar.dll] [N/A, N/A]
[D:\Program Files\Tencent\QQ\QRingMng.dll] [N/A, N/A]
[D:\Program Files\Tencent\QQ\PhoneAPI.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\DialerAllinOne.dll] [tencent, 1, 4, 0, 0]
[D:\Program Files\Tencent\QQ\LongConnection.dll] [tencent, 5, 0, 200, 160]
[D:\Program Files\Tencent\QQ\QQPet.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\GroupConnection.dll] [Tencent, 5, 0, 202, 170]
[D:\Program Files\Tencent\QQ\BQQApplication.dll] [N/A, N/A]