Logfile of HijackThis v1.99.1
Scan saved at 14:07:48, on 2006-8-24
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
D:\rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
D:\rising\Rav\Ravmond.exe
C:\WINDOWS\Explorer.EXE
d:\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
D:\rising\Rav\RavTask.exe
C:\WINDOWS\system32\ctfmon.exe
D:\rising\Rav\RavStub.exe
D:\rising\Rav\Ravmon.exe
d:\rising\rfw\RfwMain.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\updown.exe
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\FLASHGET\fgiebar.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RavTask] "D:\rising\Rav\RavTask.exe" -system
O4 - HKLM\..\RunOnce: [RavStub] "D:\rising\Rav\ravstub.exe" /RUNONCE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\Tencent\qq\AddToNetDisk.htm
O8 - Extra context menu item: 使用网际快车下载 - D:\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - D:\FlashGet\jc_all.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Tencent\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Tencent\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Tencent\qq\SendMMS.htm
O16 - DPF: {3D8F74EE-8692-4F8F-B8D2-7522E732519E} (WebActivater Control) - http://game.qq.com/QQGame2.cab
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (CEditCtrl Object) - https://img.alipay.com/download/1007/aliedit.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1102594094902
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C590FE4C-076F-42CE-9497-9330A2078F2E}: NameServer = 61.153.177.202 61.153.177.200
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - d:\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - d:\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\rising\Rav\Ravmond.exe

在注册表里搜索一下这个文件，删除和它相关的注册表项，重启后再试试。

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\updown.exe>
到注册表里把这个C:\WINDOWS\system32\updown.exe删除，只删除这一节。找到[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]<Userinit>这a项，编辑，去掉C:\WINDOWS\system32\updown.exe这一节

引用:

【阿诺8979的贴子】[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [Microsoft Corporation] <Userinit><C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\updown.exe> 到注册表里把这个C:\WINDOWS\system32\updown.exe删除，只删除这一节。找到[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]<Userinit>这a项，编辑，去掉C:\WINDOWS\system32\updown.exe这一节 ………………

这我已做过,不行,启动后又有,是不是有updown的都删除才行?

删除updown.exe的所有注册表项，】[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<Userinit><C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\updown.exe>
这个只删除C:\WINDOWS\system32\updown.exe保留前面的，一定要注意。这不能都删除。

天啊,还不行,那个C:\WINDOWS\system32\updown.exe还是删除不了,没重启,再开一次注册表里就还有

装个矮人dos工具箱即可进入dos

引用:

【bettertiger的贴子】装个矮人dos工具箱即可进入dos ………………

华军和天空都找不到

我虚心顶

引用:

【chenlf的贴子】 华军和天空都找不到 ………………

官方下载地址

http://ar.cccip.com/plug-ins/download/list.asp?id=30