Logfile of HijackThis v1.99.1
Scan saved at 21:09:39 上午, on 2005-8-25
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\Explorer.EXE
F:\WINDOWS\system32\spoolsv.exe
F:\PROGRA~1\RISING\RAV\RAVMON.EXE
F:\PROGRA~1\SKYNET\FIREWALL\pfw.exe
F:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
F:\Program Files\Common Files\Real\Update_OB\realsched.exe
F:\WINDOWS\System32\ctfmon.exe
F:\Program Files\Real\RealPlayer\realplay.exe
F:\WINDOWS\System32\devldr32.exe
F:\Program Files\Internet Explorer\IEXPLORE.EXE
F:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
F:\PROGRAM FILES\RISING\RAV\Ravmond.exe
F:\PROGRAM FILES\RISING\RAV\RavStub.exe
F:\Program Files\WinRAR\WinRAR.exe
F:\DOCUME~1\qq\LOCALS~1\Temp\Rar$EX00.782\HijackThis.exe

O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - F:\WINDOWS\System32\xunleibho_v4.dll
O2 - BHO: IEMoni Class - {F236CC5A-F6E4-4011-9EED-C52FDF51CE3D} - F:\WINDOWS\system32\SBHOPlin.dll
O3 - Toolbar: BitCometBar - {3F1ABCDB-A875-46c1-8345-B72A4567E486} - F:\Program Files\BitComet\BitCometBar\BitCometBar0.1.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - F:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: 卡卡安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - F:\WINDOWS\System32\kakatool.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "F:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] F:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] F:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RavMon] F:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [SKYNET Personal FireWall] F:\PROGRA~1\SKYNET\FIREWALL\pfw.exe
O4 - HKLM\..\Run: [RavTimer] F:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [TkBellExe] "F:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: &使用迅雷下载 - F:\Program Files\Sandai Technologies Inc\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - F:\Program Files\Sandai Technologies Inc\Thunder\getAllurl.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - F:\Program Files\Tencent\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - F:\Program Files\Tencent\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - F:\Program Files\Tencent\qq\SendMMS.htm
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - F:\Program Files\浩方对战平台\GameClient.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - F:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - F:\WINDOWS\web\related.htm
O23 - Service: SVCHOST.EXE (Event Log) - Unknown owner - F:\WINDOWS\setup.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - F:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - F:\PROGRAM FILES\RISING\RAV\Ravmond.exe


我也知道是F:\WINDOWS\Explorer.EXE不对头,但杀了还有.安全模式也不行.哪位大哥帮帮我,PS注册表-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet没有Explorer.EXE的服务.

病毒文件名是setup.exe

但F盘没这个文件呀,还有怎么杀掉呢,安全模式根本就杀不到毒,我不会用DOS不然就DOS杀毒了.

引用:

【ericaa1398的贴子】但F盘没这个文件呀,还有怎么杀掉呢,安全模式根本就杀不到毒,我不会用DOS不然就DOS杀毒了. ...........................

O23 - Service: SVCHOST.EXE (Event Log) - Unknown owner - F:\WINDOWS\setup.exe

解释一下：

1。要删除的注册表键：Event Log。在HKEY_LOCAL_MACHINE\SYSTEM\CURRENT CONTROLSET\SERVICES\分支。
2。删除注册表键后，重启系统。
3。要删除的木马文件：F:\WINDOWS\文件夹中的setup.exe、setup.dll、setup_hook.dll、setupKey.dll。这些文件都是隐藏的。
按下图设置好“文件夹选项”，才能找到。

没有setup.dll、setup_hook.dll、setupKey.dll这2个文件,看来不像是灰鸽子.只删除了setup.exe.希望没事了:)