Logfile of HijackThis v1.99.1
Scan saved at 22:46:31, on 2006-1-25
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\dXNlcg\command.exe
C:\Program Files\Network Monitor\netmon.exe
C:\WINDOWS\System32\nvsvc32.exe
d:\rising\rising\rfw\rfwsrv.exe
D:\RISING\RISING\RAV\CCENTER.EXE
D:\RISING\RISING\RAV\Ravmond.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\GreenNet\USB ADSL\CnxDslTb.exe
D:\Rising\Rising\Rfw\rfwmain.exe
D:\Rising\Rising\Rav\RavTimer.exe
D:\Rising\Rising\Rav\RavMon.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\conime.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\Hijackthis\新建文件夹\HijackThis.exe

R3 - URLSearchHook: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\Assistant\Assist\yasbar.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\System32\KakaTool.dll
O3 - Toolbar: BitCometBar - {3F1ABCDB-A875-46c1-8345-B72A4567E486} - D:\BT\BitComet\BitCometBar\BitCometBar0.1.dll
O3 - Toolbar: 一搜工具条 - {115F6E46-FCBC-41ed-B3B5-3BDDD4AAB5E5} - C:\Program Files\yisou\yisou.dll
O3 - Toolbar: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\Assistant\Assist\yasbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] ; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] ; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] ; RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] ; nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] ; RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] ; SOUNDMAN.EXE
O4 - HKLM\..\Run: [Alert] ; C:\Program Files\Starsoftcomm\StarCenter\alert.exe
O4 - HKLM\..\Run: [StarCenter] ; C:\Program Files\Starsoftcomm\StarCenter\StarCenter.exe
O4 - HKLM\..\Run: [AutoUpd] ; C:\Program Files\Starsoftcomm\StarCenter\UpdTray.exe
O4 - HKLM\..\Run: [BigDogPath] ; C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera
O4 - HKLM\..\Run: [KAVRun] ; D:\金山毒霸\KAVRun.EXE
O4 - HKLM\..\Run: [CnxDslTaskBar] C:\Program Files\GreenNet\USB ADSL\CnxDslTb.exe
O4 - HKLM\..\Run: [winsysupd] ; C:\windows\winsysupd2.exe
O4 - HKLM\..\Run: [taskbar.exe] ; C:\dm.exe
O4 - HKLM\..\Run: [winsysban] ; C:\windows\winsysban2.exe
O4 - HKLM\..\Run: [Microsoft Application Viewer] ; msappview32.exe
O4 - HKLM\..\Run: [WinDLL (steam.dll)] ; rundll32.exe C:\WINDOWS\System32\steam.dll,start
O4 - HKLM\..\Run: [WinDLL (vdm32.dll)] ; rundll32.exe C:\WINDOWS\System32\vdm32.dll,start
O4 - HKLM\..\Run: [RfwMain] D:\Rising\Rising\Rfw\rfwmain.exe
O4 - HKLM\..\Run: [Super Rabbit SRRestore] ; D:\Program Files\Super Rabbit\MagicSet\srrest.exe /autosave
O4 - HKLM\..\Run: [RavTimer] D:\Rising\Rising\Rav\RavTimer.exe
O4 - HKLM\..\Run: [RavMon] D:\Rising\Rising\Rav\RavMon.exe -system
O4 - HKLM\..\Run: [TkBellExe] ; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunServices: [Microsoft Application Viewer] ; msappview32.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Program Files\Tencent\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Program Files\Tencent\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Program Files\Tencent\qq\SendMMS.htm
O8 - Extra context menu item: 雅虎搜索 - res://C:\PROGRA~1\Yahoo!\Assistant\Assist\yasbar.dll/246
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - D:\Program Files\浩方对战平台\GameClient.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{7045CEAA-64B3-4D69-B004-4CC677F69BF9}: NameServer = 202.97.132.100 202.99.192.66
O20 - Winlogon Notify: Shell Extensions - C:\WINDOWS\system32\en62l1jo1.dll
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\dXNlcg\command.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - d:\rising\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - D:\RISING\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\RISING\RISING\RAV\Ravmond.exe

快点嘛

西西~~

有什么问题？请先说明……

建议
开始→控制面板→性能和维护→管理工具→服务→查找Command Service→右击→属性→启动类型→禁止→应用→停止→确定。

重新启动电脑, 开机检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式进入Windows

运行Hijackthis，扫描结束后在下列选项前打上勾，然后选修复“Fix Checked”：

O4 - HKLM\..\Run: [winsysupd] ; C:\windows\winsysupd2.exe
O4 - HKLM\..\Run: [taskbar.exe] ; C:\dm.exe
O4 - HKLM\..\Run: [winsysban] ; C:\windows\winsysban2.exe
O4 - HKLM\..\Run: [Microsoft Application Viewer] ; msappview32.exe
O4 - HKLM\..\Run: [WinDLL (steam.dll)] ; rundll32.exe C:\WINDOWS\System32\steam.dll,start
O4 - HKLM\..\Run: [WinDLL (vdm32.dll)] ; rundll32.exe C:\WINDOWS\System32\vdm32.dll,start
O4 - HKLM\..\RunServices: [Microsoft Application Viewer] ; msappview32.exe
O20 - Winlogon Notify: Shell Extensions - C:\WINDOWS\system32\en62l1jo1.dll

显示隐藏文件

双击我的电脑--工具---文件夹选项--查看选项卡--单击选取"显示隐藏文件或文件夹"--清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示您确定更改时，单击“是”--单击“确定”。

然后找到如下文件并删除（如果有的话）。

C:\WINDOWS\system32\en62l1jo1.dll
C:\WINDOWS\dXNlcg\command.exe