系统非常慢，且无法进入安全模式，凡是与病毒有关的网页不能打开，普通网页能打开。还原系统，病毒照旧，系统非常慢，感觉可能病毒在运行。
1:Trojan.PSW.XYOnline.oh重新启动计算机后删除文件手动扫描 C:\WINDOWS\system32  LYMANGR.DLL>>upack0.34 本机
2:RootKit.CallGate.s重新启动计算机后删除文件手动扫描 C:\WINDOWS\system32\drivers    usbine.sys 本机
3:Trojan.PSW.QQPass.tiu重新启动计算机后删除文件手动扫描C:\Program Files\Internet Explorer\PLUGINS  System64.sys 本机

Logfile of Kaka v Scan Module v2. 0. 0. 1
Scan saved at 04:14:00, on 2007-05-16
Platform: Microsoft Windows XP Professional Service Pack 1 (Build 2600)
MSIE: Internet Explorer v6.00 SP1;Q330994;Q823353; (6.00.2800.1106 (xpsp1.020828-1920))


Running processes:
[SMSS.EXE]
CommandLine =

[CSRSS.EXE]
CommandLine = C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

[WINLOGON.EXE]
CommandLine = winlogon.exe

[SERVICES.EXE]
CommandLine = C:\WINDOWS\system32\services.exe

[LSASS.EXE]
CommandLine = C:\WINDOWS\system32\lsass.exe

[SVCHOST.EXE]
CommandLine = C:\WINDOWS\system32\svchost -k rpcss

[CCenter.exe]
CommandLine = "E:\下载文件\瑞星\Rising\Rav\CCenter.exe"

[SVCHOST.EXE]
CommandLine = C:\WINDOWS\System32\svchost.exe -k netsvcs

[SVCHOST.EXE]
CommandLine = C:\WINDOWS\System32\svchost.exe -k NetworkService

[SVCHOST.EXE]
CommandLine = C:\WINDOWS\System32\svchost.exe -k LocalService

[EXPLORER.EXE]
CommandLine = C:\WINDOWS\Explorer.EXE

[RavMonD.exe]
CommandLine = "E:\下载文件\瑞星\Rising\Rav\Ravmond.exe"

[yassistse.exe]
CommandLine = "C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"

[RavTask.exe]
CommandLine = "E:\下载文件\瑞星\RISING\RAV\RAVTASK.EXE" -SYSTEM

[CTFMON.EXE]
CommandLine = "C:\WINDOWS\System32\ctfmon.exe"

[YahooWidgetEngine.exe]
CommandLine = "D:\Program Files\Yahoo! Widget Engine\YahooWidgetEngine.exe"

[RavMon.exe]
CommandLine = "E:\下载文件\瑞星\Rising\Rav\Ravmon.exe" -SYSTEM

[LEXBCES.EXE]
CommandLine = C:\WINDOWS\system32\LEXBCES.EXE

[SPOOLSV.EXE]
CommandLine = C:\WINDOWS\system32\spoolsv.exe

[LEXPPS.EXE]
CommandLine = LEXPPS.EXE

[NVSVC32.EXE]
CommandLine = C:\WINDOWS\System32\nvsvc32.exe

[SCARDSVR.EXE]
CommandLine = C:\WINDOWS\System32\SCardSvr.exe

[SMAgent.exe]
CommandLine = "C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe"

[WDFMGR.EXE]
CommandLine = C:\WINDOWS\System32\wdfmgr.exe

[mstsc.exe]
CommandLine = "C:\WINDOWS\System32\mstsc.exe"

[CMD.EXE]
CommandLine = cmd /c C:\WINDOWS\System32\Deleteme.bat

[CONIME.EXE]
CommandLine = C:\WINDOWS\System32\conime.exe

[YahooWidgetEngine.exe]
CommandLine = D:\Program Files\Yahoo! Widget Engine\YahooWidgetEngine.exe --child C:\Documents and Settings\xz\My Documents\My Widgets\CPU监控器.widget

[Rav.exe]
CommandLine = "E:\下载文件\瑞星\Rising\Rav\rav.exe" -BOOTSCAN

[YahooWidgetEngine.exe]
CommandLine = D:\Program Files\Yahoo! Widget Engine\YahooWidgetEngine.exe --child D:\Program Files\Yahoo! Widget Engine\freeSpace.widget

[YahooWidgetEngine.exe]
CommandLine = D:\Program Files\Yahoo! Widget Engine\YahooWidgetEngine.exe --child D:\Program Files\Yahoo! Widget Engine\PowerXP_windows.widget

[YahooWidgetEngine.exe]
CommandLine = D:\Program Files\Yahoo! Widget Engine\YahooWidgetEngine.exe --child D:\Program Files\Yahoo! Widget Engine\X-a_Clock.widget

[YahooWidgetEngine.exe]
CommandLine = D:\Program Files\Yahoo! Widget Engine\YahooWidgetEngine.exe --child C:\Documents and Settings\xz\My Documents\My Widgets\内存显示器.widget

[YahooWidgetEngine.exe]
CommandLine = D:\Program Files\Yahoo! Widget Engine\YahooWidgetEngine.exe --child C:\Documents and Settings\xz\My Documents\My Widgets\日历.widget

[YahooWidgetEngine.exe]
CommandLine = D:\Program Files\Yahoo! Widget Engine\YahooWidgetEngine.exe --child C:\Documents and Settings\xz\My Documents\My Widgets\桌面画廊.widget

[YahooWidgetEngine.exe]
CommandLine = D:\Program Files\Yahoo! Widget Engine\YahooWidgetEngine.exe --child C:\Documents and Settings\xz\My Documents\My Widgets\雅虎气象.widget

[KkScan.exe]

CommandLine = "E:\下载文件\瑞星卡卡上网助手\KkScan.exe"

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page=http://www.yahoo.com.cn
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.google.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=%SystemRoot%\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page=http://www.yahoo.com.cn
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.baidu.com/
R3 - Default URLSearchHook is missing
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: MAnt IEHelper - {064F7218-1C91-4A27-8EB9-F27A45656378} - C:\WINDOWS\System32\MAntBHO.3.2.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\program files\大笙显?8000系盗列星驱动痋\Reader\ActiveX\AcroIEHelper.ocx (file missing)
O2 - BHO: CPub Object - {0CA51D02-7739-43EA-8D9A-1E8AD4327B03} - C:\Program Files\P4P\sodaie.dll (file missing)
O2 - BHO: IESecPlugin Class - {20F1BA6D-D3F5-4089-A651-106A3DB5A7BA} - C:\WINDOWS\DOWNLO~1\SECPLU~1.DLL
O2 - BHO:  (file missing)
O2 - BHO: BitComet Helper - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - E:\下载文件\BT\BitComet\tools\BitCometBHO.dll
O2 - BHO: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
O2 - BHO:  (file missing)
O2 - BHO:  (file missing)
O2 - BHO: DragSearch BHO - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL
O2 - BHO: BHOHelper Class - {67A90DD5-128D-43AB-B97C-565D2DD42A28} - C:\Program Files\real\atloader.dll (file missing)
O2 - BHO: 珊瑚虫工具栏 - {75FE2B5A-D3A4-4EFA-AC11-ADC9C9459688} - C:\PROGRA~1\YOK.com\SUPERS~1\YOK_SuperSearch.dll (file missing)
O2 - BHO:  (file missing)
O2 - BHO: ChinaBuy Class - {85FAEA13-9C62-4917-8571-B35C563A1943} - C:\WINDOWS\System32\buyunion.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\PROGRA~1\FLASHGET\JCCATCH.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: FavHook Class - {CD8BFE70-5809-4C73-9EEE-E5672C2B79D7} - C:\Program Files\Deepdo\DeepdoBar\Favorite\FavBlock.dll
O2 - BHO:  - {E730189A-9973-4121-B046-AD1C161EC3AF} - C:\WINDOWS\system32\37211.dll (file missing)
O2 - BHO: assist - {FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8} - C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yassist.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
O3 - Toolbar:  (file missing)
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\System32\KakaTool.dll (file missing)
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKLM\..\Run: [yassistse] "C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"
O4 - HKLM\..\Run: [RavTask] "E:\下载文件\瑞星\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [qjsa] C:\DOCUME~1\xz\LOCALS~1\Temp\qjso.exe
O4 - HKLM\..\Run: [wlsa] C:\DOCUME~1\xz\LOCALS~1\Temp\wlso.exe
O4 - HKLM\..\Run: [tlsa] C:\DOCUME~1\xz\LOCALS~1\Temp\tlso.exe
O4 - Startup: desktop.ini =
O4 - Startup: Yahoo! Widget Engine.lnk = D:\Program Files\Yahoo! Widget Engine\YahooWidgetEngine.exe
O4 - Global Startup: desktop.ini =
O8 - Extra context menu item: &使用BitComet下载 - res://E:\下载文件\BT\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &使用BitComet下载全部链接 - res://E:\下载文件\BT\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &使用BitComet下载本页视频 - res://E:\下载文件\BT\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\Program Files\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 使用网际快车下载 - D:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Program Files\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Program Files\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Program Files\QQ\SendMMS.htm
O9 - Extra Button: 手机短信 - {00000000-0000-0001-0001-596BAEDD1289}? - http://sms.3721.com/ie/index.htm (file missing)
O9 - Extra Button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97}? - http://cn.mail.yahoo.com/promo/rd1 (file missing)
O9 - Extra Button: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26}? - http://hot.3721.com/rd/shop_btn.htm (file missing)
O9 - Extra Button: 雅虎WIDGET - {6354ABE6-05F1-49ed-B850-E423120EC338} - http://cn.widget.yahoo.com/index.htm?source=Cns (file missing)
O9 - Extra Button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\QQ\QQ.EXE (file missing)
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\QQ\QQ.EXE (file missing)
O9 - Extra Button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra Button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6}? -  (file missing)
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6}? -  (file missing)
O9 - Extra Button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg (file missing)
O9 - Extra Button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96}? - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
O15 - Trusted Zone:

O16 - DPF: DirectAnimation Java Classes - file://C:\WINDOWS\Java\classes\dajava.cab
O16 - DPF: {05C1004E-2596-48E5-8E26-39362985EEB9} (MMCPlayer Class) - http://p3p.sogou.com/MMCShell.cab
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://downloadcenter.samsung.com/content/common/cab/DjVuControlLite_EN.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com.cn/webscanner/kavwebscan_unicode.cab
O16 - DPF: {20F1BA6D-D3F5-4089-A651-106A3DB5A7BA} (IESecPlugin Class) - http://bocjs.jsinfo.net/SecPl_1.CAB
O16 - DPF: {53AF6E02-F18F-4228-AC13-3E79773FBE50} (CMCBooter Object) - http://download.mysee.com/plugin/booter.cab
O16 - DPF: {5DD731E6-D4F0-11D3-BE3F-00105A6FDA50} (V3ProX Control) - http://origin-www.ahn.com.cn/aspservice/plugin/myv3.cab
O16 - DPF: {62561858-71D1-11D4-B2EC-00105A8340B5} (VITEGPlayerCtrl Class) - http://www.abc.com.cn/demo/control/VTPlayer.cab
O16 - DPF: {62B938C4-4190-4F37-8CF0-A92B0A91CC77} (InfoSecNetSign Class) - https://mybank.icbc.com.cn/icbc/NetSign.dll
O16 - DPF: {6D010F04-1618-46BF-A349-8174C4348FEB} (Encrypt Class) - http://202.102.32.3/Client/NetCom.CAB
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O16 - DPF: {73FFAC43-9801-49B0-9550-57F2D7816171} (UpdateCert Class) - http://bocjs.jsinfo.net/updat_1.CAB
O16 - DPF: {98A62E3F-A8C5-4EF0-8A00-C70CF9D18A89} (LoaderCore Class) - http://tb.sogou.com/DLLoader.cab
O16 - DPF: {9BBD100C-E820-4930-9937-E8F3AA40E584} (DFVSScanFile Control) - http://antivirus3.sunv.com/dfvsolDown/dfvsol.cab
O16 - DPF: {ABA7CC7F-019D-47DB-A0D2-B3C2B3AC1B44} (Fc2Boot Class) - http://h5.kele8.com/onet/ActiveX/fc2boot.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B753331A-9543-41D2-83B2-492E5ADB7911} (cardctl Class) - https://mybank.icbc.com.cn/icbc/perbank/iccarddll.cab
O16 - DPF: {C8BD9ACB-F7EC-48E6-BB2F-DAADC6789E9A} (Kingsoft DUBA OnlineScan) - http://211.152.52.102/duba/antiscan/update/OCX/KAVClean.CAB
O16 - DPF: {DA215190-98B2-47DE-AE24-DA95481DFFBA} (AxUSBKey Class) - https://mybank.icbc.com.cn/icbc/perbank/AxUSBKey.CAB
O16 - DPF: {DA984A6D-508E-11D6-AA49-0050FF3C628D} (Ravonline) - http://download.rising.com.cn/QQ/QQkill/rsonline.cab
O16 - DPF: {E787FD25-8D7C-4693-AE67-9406BC6E22DF} (CPasswordEditCtrl Object) - https://www.tenpay.com/download/qqedit.cab
O16 - DPF: {E847C78C-C210-4195-8799-FBF3BF89797D} (金山毒霸在线产品升级) - http://scan.www.duba.net/duba/download/install/onlinescan/KOSInit.cab
O16 - DPF: {EC0978ED-24E3-403C-AB7A-060E388553E6} (BoBoControl Class) - http://www.17bobo.com/Software/BoBo_ActiveX_V3.ocx
O16 - DPF: {F138084D-84D7-48CD-BEA8-04772457516E} - http://59.36.97.38/jsxz/vqqsdl1009.cab
O16 - DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} (pCastPanel Class) - http://pcastdl.dudu.com/files/pCastCtl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{59A35174-5FA3-4F2C-873A-1B377FAFF6F4}: NameServer = 202.96.209.6 202.109.122.14
O18 - Filter : application/octet-stream - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll
O18 - Filter : application/x-complus - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll
O18 - Filter : application/x-msdownload - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\System32\msvidctl.dll
O18 - Protocol: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ipp - (no CLSID) - (no file)
O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll
O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\System32\inetcomm.dll
O18 - Protocol: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll
O18 - Protocol: msdaipp - (no CLSID) - (no file)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\System32\msvidctl.dll
O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINDOWS\System32\msdxm.ocx
O18 - Protocol: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\System32\wiascr.dll
O23 - Service: Human Interface Device Access (HidServ) -  - C:\WINDOWS\System32\svchost.exe -k netsvcs
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\System32\lexbces.exe
O23 - Service: ELSA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - "E:\下载文件\瑞星\Rising\Rav\CCenter.exe"
O23 - Service: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - "E:\下载文件\瑞星\Rising\Rav\Ravmond.exe"
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Windows Audio Services (winAudSer) -  - C:\WINDOWS\System32\winms.exe -service
O23 - Service: Windows DHCP Service (WinDHCPsvc) -  - C:\WINDOWS\System32rundll32.exe windhcp.ocx,input
O23 - Service: Windows Ins (WindowsDown) -  - C:\WINDOWS\System32\servet.exe
O23 - Service: WinWMServiceNow (WinWMServiceNow) -  - C:\DOCUME~1\xz\LOCALS~1\Temp\RAVWM.EXE
O23 - Service: WinXP DHCP Service (WinXPDHCPsvc) -  - C:\WINDOWS\System32rundll32.exe xpdhcp.dll,input

拔雅虎助手卸了，再进待命领与提示符的安全模式用任务管理器运行瑞星后杀毒，或许可以。

问题是随便哪个安全模式都进不了

我的也很慢啊！
不知什么毒！
瑞星扫不出啊！
桌面不见了！
用运行-C:\WINDOWS\explorer.exe
打开的是我的文档！
这是怎么回事啊？？？？？？？？？//

用SREng扫个日志来看看吧~~