现已确认中毒。并且手工用ICEWORD已经在限制线程创建的基础上，清理了很多东西了。
目前清理完后，扫描如下：
[CODE]

2006-12-30,17:04:22

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows Server 2003 Enterprise Edition  (Build 3790)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    <Rav><"D:\Program Files\Rising\Rav1\Update\Setup.exe" /UNINSTALL /S /ONCE>  [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    <ntaskldr><D:\WINDOWS\system\logo_1.exe>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><D:\WINDOWS\system32\userinit.exe>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><235780M.BMP>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><%SystemRoot%\system32\logonui.exe>  [(Verified)Microsoft Corporation]

==================================
启动文件夹
N/A

==================================
服务
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <D:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[RsRavMon Service / RsRavMon][Stopped/Auto Start]
  <"D:\Program Files\Rising\Rav1\Ravmond.exe"><N/A>
[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]
  <><N/A>

==================================
驱动程序
[ati2mpad / ati2mpad][Running/Manual Start]
  <system32\DRIVERS\ati2mpad.sys><ATI Technologies Inc.>
[BaseTDI / BaseTDI][Running/Manual Start]
  <2 - 系统找不到指定的文件。
><N/A>
[Intel(R) PRO/1000 Device Driver / E1000][Running/Manual Start]
  <system32\DRIVERS\e1000325.sys><Intel Corporation>
[ExpScaner / ExpScaner][Running/Auto Start]
  <\??\D:\Program Files\Rising\Rav1\ExpScan.sys><N/A>
[HookCont / HookCont][Running/Auto Start]
  <\??\D:\Program Files\Rising\Rav1\HOOKCONT.sys><N/A>
[HookReg / HookReg][Running/Auto Start]
  <\??\D:\Program Files\Rising\Rav1\HookReg.sys><N/A>
[HookSys / HookSys][Running/Auto Start]
  <\??\D:\Program Files\Rising\Rav1\HookSys.sys><N/A>
[IP in IP Tunnel Driver / IpInIp][Stopped/Manual Start]
  <system32\DRIVERS\ipinip.sys><N/A>
[MEMSCAN / MEMSCAN][Running/Auto Start]
  <\??\D:\Program Files\Rising\Rav1\MEMSCAN.sys><N/A>
[Netgroup Packet Filter / NPF][Running/Manual Start]
  <system32\DRIVERS\npf.sys><CACE Technologies>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
  <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[RSPPSYS / RSPPSYS][Running/Auto Start]
  <\??\D:\Program Files\Rising\Rav1\RSPPSYS.sys><N/A>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[Sony USB Filter Driver (SONYPVU1) / SONYPVU1][Stopped/Manual Start]
  <system32\DRIVERS\SONYPVU1.SYS><Sony Corporation>
[symmpi / symmpi][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\symmpi.sys><LSI Logic>
[xyfilemon / xyantivirus][Running/Auto Start]
  <\??\D:\tem\VRV2005\VRV2005\vrv2005\filemon.sys><BXY>
[squell / squell][Running/]
  <2 - 系统找不到指定的文件。
><N/A>

==================================
浏览器加载项
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[上传到QQ网络硬盘]
  <D:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
  <D:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <D:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <D:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 404][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 464][\??\D:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 488][\??\D:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 532][D:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 544][D:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 688][D:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 736][D:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 908][D:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 992][D:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1016][D:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1344][D:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.3790.0 (srv03_rtm.030324-2048)]
    [D:\winrar\rarext.dll]  [N/A, N/A]
    [D:\WINDOWS\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 7]
    [D:\Program Files\Rising\Rav1\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [D:\WINDOWS\235780M.BMP]  [N/A, N/A]
    [D:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
    [D:\WINDOWS\system32\spool\DRIVERS\W32X86\3\CNAB4MUI.DLL]  [CANON INC., 1.01]
    [D:\WINDOWS\system32\spool\DRIVERS\W32X86\3\CNAB4M.DLL]  [CANON INC., 1.01]
    [D:\WINDOWS\system32\CNAB4SMK.DLL]  [CANON INC., 1.01.0.003]
    [D:\WINDOWS\system32\spool\DRIVERS\W32X86\3\CNLB0MUI_D402B.DLL]  [CANON INC., 1.45]
    [D:\WINDOWS\system32\spool\DRIVERS\W32X86\3\CNLB0M_D402B.DLL]  [CANON INC., 1.45]
[PID: 1540][D:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
    [D:\WINDOWS\system32\spool\DRIVERS\W32X86\3\CNAB4MUI.DLL]  [CANON INC., 1.01]
    [D:\WINDOWS\system32\icm32.dll]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1676][D:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1756][D:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1984][D:\WINDOWS\system32\Dfssvc.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 2416][D:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.3790.0 (srv03_rtm.030324-2048)]
    [D:\WINDOWS\235780M.BMP]  [N/A, N/A]
    [D:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
    [D:\Program Files\Rising\Rav1\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [D:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
    [D:\WINDOWS\system32\001836F9.IME]  [LongWen Corporation, 3.8.200]
[PID: 3512][D:\Program Files\Tencent\QQ\QQ.exe]  [TENCENT, 0, 0, 0, 0]
    [D:\Program Files\Tencent\QQ\QQBaseClassInDll.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\QQHelperDll.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\BasicCtrlDll.dll]  [Tencent, 5, 0, 200, 160]
    [D:\WINDOWS\235780M.BMP]  [N/A, N/A]
    [D:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
    [D:\Program Files\Tencent\QQ\QQAPI.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\TIMProxy.dll]  [tencent, 0, 3, 2, 4]
    [D:\Program Files\Tencent\QQ\LoginCtrl.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\npkcntc.dll]  [INCA Internet Co., Ltd., 2006, 3, 2, 1]
    [D:\Program Files\Tencent\QQ\npkpdb.dll]  [INCA Internet Co., Ltd., 2003, 10, 1, 1]
    [D:\Program Files\Tencent\QQ\QQRes.dll]  [tencent, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\QQMainFrame.dll]  [N/A, N/A]
    [D:\Program Files\Tencent\QQ\CQQApplication.dll]  [N/A, N/A]
    [D:\Program Files\Tencent\QQ\NewSkin.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\HostingMgr.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\CameraDll.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\MailSummary.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\QQSpace.dll]  [, 1, 0, 0, 1]
    [D:\WINDOWS\system32\msdmo.dll]  [N/A, N/A]
    [D:\Program Files\Tencent\QQ\QQGroupMng.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\GroupLive.dll]  [N/A, N/A]
    [D:\Program Files\Tencent\QQ\QQAllInOne.dll]  [N/A, N/A]
    [D:\Program Files\Tencent\QQ\SCCore.dll]  [N/A, N/A]
    [D:\Program Files\Tencent\QQ\QQCustomFace.dll]  [N/A, N/A]
    [D:\Program Files\Tencent\QQ\QQSysMsgMng.dll]  [N/A, N/A]
    [D:\Program Files\Tencent\QQ\UserDefinedHead.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\QQPlugin.dll]  [N/A, N/A]
    [D:\Program Files\Tencent\QQ\QQConfigPlugin.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\FlashAvatarDll.dll]  [, 1, 4, 0, 1]
    [D:\Program Files\Tencent\QQ\QQAvatar.dll]  [N/A, N/A]
    [D:\Program Files\Tencent\QQ\QRingMng.dll]  [N/A, N/A]
    [D:\Program Files\Tencent\QQ\PhoneAPI.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\DialerAllinOne.dll]  [tencent, 1, 4, 0, 0]
    [D:\Program Files\Tencent\QQ\LongConnection.dll]  [tencent, 5, 0, 200, 160]
    [D:\Program Files\Tencent\QQ\QQPet.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\GroupConnection.dll]  [Tencent, 5, 0, 202, 170]
    [D:\Program Files\Tencent\QQ\BQQApplication.dll]  [N/A, N/A]

[D:\Program Files\Tencent\QQ\PersonalDesktop.dll]  [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2]
    [D:\Program Files\Tencent\QQ\CommercesMng.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Tencent\QQ\QQUdpGetFileLib.dll]  [tencent, 0, 2, 2, 3]
    [D:\Program Files\Tencent\QQ\QQAddr.dll]  [深圳市腾讯计算机系统有限公司, 5, 0, 101, 200]
    [D:\Program Files\Tencent\QQ\QQSceneMng.dll]  [N/A, N/A]
    [D:\Program Files\Tencent\QQ\QQPhoneHelper.dll]  [腾讯科技（深圳）有限公司, 2, 1, 2, 23]
    [D:\Program Files\Tencent\QQ\ImageOle.dll]  [TODO: <Company name>, 1.0.0.1]
    [D:\WINDOWS\system32\001836F9.IME]  [LongWen Corporation, 3.8.200]
[PID: 3536][D:\Program Files\Tencent\QQ\TIMPlatform.exe]  [tencent, 0, 3, 1, 8]
    [D:\WINDOWS\235780M.BMP]  [N/A, N/A]
    [D:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
    [D:\Program Files\Tencent\QQ\TIMProxy.dll]  [tencent, 0, 3, 2, 4]
[PID: 2976][D:\WINDOWS\system\internet.exe]  [N/A, N/A]
    [D:\WINDOWS\235780M.BMP]  [N/A, N/A]
    [D:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
[PID: 3012][D:\RAV\SRENG\SREng.EXE]  [Smallfrogs Studio, 2.3.13.690]
    [D:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]

==================================
文件关联
.TXT  Error. [notepad.exe %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  Error. [regedit.exe %1]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  Error. [D:\WINDOWS\hh.exe %1]
.HLP  Error. [D:\WINDOWS\winhlp32.exe %1]
.INI  Error. [notepad.exe %1]
.INF  Error. [D:\WINDOWS\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[D:\]
[AutoRun]
OPEN=ghost.exe
shellexecute=ghost.exe
shell\打开(&O)\command=ghost.exe

==================================
HOSTS 文件
N/A

==================================
API HOOK
N/A

==================================


[/CODE]

【回复“小呀小顽童”的帖子】
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<ntaskldr><D:\WINDOWS\system\logo_1.exe> [N/A]————病毒启动项。

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><235780M.BMP> [N/A]————木马启动项。

[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]
<><N/A>——木马服务项。

[BaseTDI / BaseTDI][Running/Manual Start]
<2 - 系统找不到指定的文件。
><N/A>————这个是瑞星的吧？怎么丢了？

[Netgroup Packet Filter / NPF][Running/Manual Start]
<system32\DRIVERS\npf.sys><CACE Technologies>————木马驱动项。

[PID: 1344][D:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.3790.0 (srv03_rtm.030324-2048)]————资源管理器进程被木马插入。插此进程的木马是D:\WINDOWS\235780M.BMP和D:\WINDOWS\system32\windhcp.ocx。


[PID: 2416][D:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.3790.0 (srv03_rtm.030324-2048)]————IE浏览器进程被木马插入。插此进程的木马是D:\WINDOWS\235780M.BMP和D:\WINDOWS\system32\windhcp.ocx。

[PID: 3512][D:\Program Files\Tencent\QQ\QQ.exe] [TENCENT, 0, 0, 0, 0]————进程被插，同上。

[PID: 3536][D:\Program Files\Tencent\QQ\TIMPlatform.exe] [tencent, 0, 3, 1, 8]————进程被插，同上。

以上问题搞掂后，右击D盘盘符，点击“打开”。删除D盘根目录下的autorun.inf和ghost.exe

杀净病毒后，修复下列文件关联：
.TXT Error. [notepad.exe %1]
.REG Error. [regedit.exe %1]
.CHM Error. [D:\WINDOWS\hh.exe %1]
.HLP Error. [D:\WINDOWS\winhlp32.exe %1]
.INI Error. [notepad.exe %1]
.INF Error. [D:\WINDOWS\NOTEPAD.EXE %1]

引用:

【baohe的贴子】【回复“小呀小顽童”的帖子】 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] <ntaskldr><D:\WINDOWS\system\logo_1.exe> [N/A]————病毒启动项。 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><235780M.BMP> [N/A]————木马启动项。 [Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start] <><N/A>——木马服务项。 [BaseTDI / BaseTDI][Running/Manual Start] <2 - 系统找不到指定的文件。 ><N/A>————这个是瑞星的吧？怎么丢了？ [Netgroup Packet Filter / NPF][Running/Manual Start] <system32\DRIVERS\npf.sys><CACE Technologies>————木马驱动项。 [PID: 1344][D:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.3790.0 (srv03_rtm.030324-2048)]————资源管理器进程被木马插入。插此进程的木马是D:\WINDOWS\235780M.BMP和D:\WINDOWS\system32\windhcp.ocx。 [PID: 2416][D:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.3790.0 (srv03_rtm.030324-2048)]————IE浏览器进程被木马插入。插此进程的木马是D:\WINDOWS\235780M.BMP和D:\WINDOWS\system32\windhcp.ocx。 [PID: 3512][D:\Program Files\Tencent\QQ\QQ.exe] [TENCENT, 0, 0, 0, 0]————进程被插，同上。 [PID: 3536][D:\Program Files\Tencent\QQ\TIMPlatform.exe] [tencent, 0, 3, 1, 8]————进程被插，同上。 以上问题搞掂后，右击D盘盘符，点击“打开”。删除D盘根目录下的autorun.inf和ghost.exe 杀净病毒后，修复下列文件关联： .TXT Error. [notepad.exe %1] .REG Error. [regedit.exe %1] .CHM Error. [D:\WINDOWS\hh.exe %1] .HLP Error. [D:\WINDOWS\winhlp32.exe %1] .INI Error. [notepad.exe %1] .INF Error. [D:\WINDOWS\NOTEPAD.EXE %1] ………………

非常感谢你——世界上最可爱的人！