Logfile of HijackThis v1.99.1
Scan saved at 22:58:14, on 2006-6-9
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
D:\网络软件\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
D:\网络软件\Rising\Rav\Ravmond.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
D:\网络软件\Rising\Rav\RavTask.exe
D:\网络软件\Rising\Rav\Ravmon.exe
C:\WINDOWS\system32\exp1orer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\ctfmon.exe
D:\系统软件\卡巴斯基反黑客\KAVPF.exe
D:\网络软件\QQ\QQ.exe
D:\网络软件\QQ\TIMPlatform.exe
D:\网络软件\GOSURF2\gsfbwsr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\mp2004\桌面\HijackThis V1.99.1 汉化版\HijackThis.exe

O2 - BHO: ThunderIEHelper - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v13.dll
O2 - BHO: 超级兔子上网精灵 - {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} - D:\系低统橙软砑件\MAGICSET\haokanbar.dll (file missing)
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - D:\网络软件\迅雷\ComDlls\XunLeiBHO_001.dll
O2 - BHO: bu - {CCC4C283-DF1B-483C-97AE-E22D79FEA86B} - C:\WINDOWS\system32\smsband2005.dll
O3 - Toolbar: CyberArticle Express - {769A6A36-ED24-4376-BC7C-80225BF35698} - D:\网络软件\网文快捕\CAExp.dll
O3 - Toolbar: 超级兔子上网精灵 - {43869BB3-22FD-4F15-9B46-238106BA2F4E} - D:\系统软件\MAGICSET\haokanbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - HKLM\..\Run: [RavTask] "D:\网络软件\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [LoadEWXD] C:\WINDOWS\system32\exp1orer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: 腾讯QQ珊瑚虫版.lnk = ?
O4 - Global Startup: 卡巴斯基反黑客.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &使用迅雷下载 - D:\网络软件\迅雷\Program\GetUrl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - D:\网络软件\迅雷\Program\GetAllUrl.htm
O8 - Extra context menu item: 使用CyberArticle保存网页选中部分... - D:\网络软件\网文快捕\script\savesel.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://D:\办公软件\OFFICE~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\网络软件\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\网络软件\QQ\AddEmotion.htm
O8 - Extra context menu item: 用比特精灵下载(&B) - D:\网络软件\比特精灵\bsurl.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\网络软件\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\网络软件\QQ\QQ.EXE
O14 - IERESET.INF: START_PAGE_URL=http://www.tomatolei.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{B2101BE8-6704-4753-896F-1EF93322A863}: NameServer = 192.168.1.200
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: onServer - Unknown owner - C:\WINDOWS\Server2008.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\网络软件\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\网络软件\Rising\Rav\Ravmond.exe

双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示确定更改时，单击“是”，清除“隐藏已知文件类型的扩展名
开始→运行→输入services.msc，打开“服务”→查找onServer →双击→启动类型→禁止→停止→应用→确定。禁止onServer这个服务
重启
关闭所有浏览窗口以及一些不必要的程序
运行Hijackthis，扫描结束后在下列选项前打上勾，然后选"修复""（如果有的话）
O4 - HKLM\..\Run: [LoadEWXD] C:\WINDOWS\system32\exp1orer.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O23 - Service: onServer - Unknown owner - C:\WINDOWS\Server2008.exe
删除
C:\WINDOWS\Server2008.exe
C:\WINDOWS\system32\exp1orer.exe（注意这是数字1）

非常感谢！！