系统进程explorer.exe被捆绑了灰鸽子新变种：如图：

请到http://forum.ikaka.com/topic.asp?board=28&artid=8105899
下载HijackThis
下载后运行HijackThis.rar,再运行HijackThis.exe
单机＂扫描日志并保存日志＂
把保存的日志复制粘贴上来．

用木马杀客杀了以后桌面就没了，如图

啊~~回的好快啊，我还没贴完，下面是扫描日志

Logfile of HijackThis v1.99.1
Scan saved at 15:17:12, on 2006-10-2
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
d:\已安装软件\瑞星防火墙\rfwsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
d:\已安装软件\瑞星防火墙\RfwMain.exe
D:\下载\木马杀客 5.3 1 绿色版\mmsk.exe
D:\绿色环保软件\腾讯QQ2006 中国黑客专用第6版(最终冲击II)完美绿色版\TIMPlatform.exe
C:\Program Files\Maxthon\Max.exe
C:\WINDOWS\Explorer.exe
D:\下载\杀毒防毒\瑞星系列工具\HijackThis V1.99.1 汉化版\HijackThis.exe

R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: XBTB05774 - {129DD540-E5E4-4601-825A-43ED660159E0} - C:\PROGRA~1\OFFLIN~1.0\2323233.dll
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - D:\下载\迅雷5.3.0.220绿色Vista中国绿软基地专用版\ComDlls\XunLeiBHO_002.dll
O4 - HKLM\..\Run: [KAVPersonal50] C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe /minimize
O4 - HKLM\..\Run: [RfwMain] "D:\已安装软件\瑞星防火墙\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [mmsk] D:\下载\木马杀客 5.3 1 绿色版\mmsk.exe
O4 - HKLM\..\Run: [AGB5Monitor] C:\Program Files\Antiy Labs\AGuard\AGuard.exe /AutoRun
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: 使用迅雷下载 - D:\下载\迅雷5.3.0.220绿色Vista中国绿软基地专用版\Program\GetUrl.htm
O8 - Extra context menu item: 使用迅雷下载全部链接 - D:\下载\迅雷5.3.0.220绿色Vista中国绿软基地专用版\Program\GetAllUrl.htm
O8 - Extra context menu item: 导出到 Microsoft Excel(&x) - res://D:\已安装~1\OfficeXP\Office10\EXCEL.EXE/3000
O9 - Extra button: Offline Web 2.0 - {6D53ADB7-6AD5-4A59-BFE4-7B57D2F4AA89} - (no file)
O9 - Extra 'Tools' menuitem: Offline Web 2.0 - {6D53ADB7-6AD5-4A59-BFE4-7B57D2F4AA89} - (no file)
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O17 - HKLM\System\CCS\Services\Tcpip\..\{F83C567A-DDC8-42D7-9375-951A25D1FD3E}: NameServer = 211.98.72.8 211.98.2.4
O23 - Service: COM+ System Application (COMSysApp) - Unknown owner - C:\WINDOWS\system32\dllhost.exe (file missing)
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - d:\已安装软件\瑞星防火墙\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - d:\已安装软件\瑞星防火墙\rfwsrv.exe

这是木马杀客 的误报 它把 explorer.exe当病毒给杀掉了 那个是桌面程序
所以最好不要用那玩意

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O23 - Service: COM+ System Application (COMSysApp) - Unknown owner - C:\WINDOWS\system32\dllhost.exe (file missing)

R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=userinit.exe,

修复

哦~~谢谢了，我的卡巴一直也没报警，瑞星防火墙倒是一直闪，所以用杀马杀了一下，结果就依偎中了灰鸽子Backdoor.GrayBird.ad.2085

木马杀客 不说什么了 不要用 用了你会后悔的 把你的系统搞坏了都没地找人说理去

这是修复后的日志

Logfile of HijackThis v1.99.1
Scan saved at 15:39:00, on 2006-10-2
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
d:\已安装软件\瑞星防火墙\rfwsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
d:\已安装软件\瑞星防火墙\RfwMain.exe
D:\下载\木马杀客 5.3 1 绿色版\mmsk.exe
C:\Program Files\Maxthon\Max.exe
C:\WINDOWS\Explorer.exe
D:\下载\小巧的记事本\metapad.exe
D:\下载\杀毒防毒\瑞星系列工具\HijackThis V1.99.1 汉化版\HijackThis.exe

O2 - BHO: XBTB05774 - {129DD540-E5E4-4601-825A-43ED660159E0} - C:\PROGRA~1\OFFLIN~1.0\2323233.dll
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - D:\下载\迅雷5.3.0.220绿色Vista中国绿软基地专用版\ComDlls\XunLeiBHO_002.dll
O4 - HKLM\..\Run: [KAVPersonal50] C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe /minimize
O4 - HKLM\..\Run: [RfwMain] "D:\已安装软件\瑞星防火墙\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [mmsk] D:\下载\木马杀客 5.3 1 绿色版\mmsk.exe
O4 - HKLM\..\Run: [AGB5Monitor] C:\Program Files\Antiy Labs\AGuard\AGuard.exe /AutoRun
O8 - Extra context menu item: 使用迅雷下载 - D:\下载\迅雷5.3.0.220绿色Vista中国绿软基地专用版\Program\GetUrl.htm
O8 - Extra context menu item: 使用迅雷下载全部链接 - D:\下载\迅雷5.3.0.220绿色Vista中国绿软基地专用版\Program\GetAllUrl.htm
O8 - Extra context menu item: 导出到 Microsoft Excel(&x) - res://D:\已安装~1\OfficeXP\Office10\EXCEL.EXE/3000
O9 - Extra button: Offline Web 2.0 - {6D53ADB7-6AD5-4A59-BFE4-7B57D2F4AA89} - (no file)
O9 - Extra 'Tools' menuitem: Offline Web 2.0 - {6D53ADB7-6AD5-4A59-BFE4-7B57D2F4AA89} - (no file)
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O17 - HKLM\System\CCS\Services\Tcpip\..\{F83C567A-DDC8-42D7-9375-951A25D1FD3E}: NameServer = 211.98.72.8 211.98.2.4
O23 - Service: COM+ System Application (COMSysApp) - Unknown owner - C:\WINDOWS\system32\dllhost.exe (file missing)
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - d:\已安装软件\瑞星防火墙\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - d:\已安装软件\瑞星防火墙\rfwsrv.exe