这两天才发现的，机器登录后什么都不干，然后就看见工作指示灯狂闪，CPU有时也会狂飙，用瑞星杀了N道，没毒。把这个发上来请各位大侠过目，还希望多多帮忙啊，在此先谢过了啊！！！
Logfile of HijackThis v1.99.1
Scan saved at 1:40:09, on 2005-7-14
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
F:\PROGRAM FILES\RISING\RAV\Ravmond.exe
F:\PROGRAM FILES\RISING\RAV\RavStub.exe
C:\WINDOWS\system32\spoolsv.exe
F:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
F:\Program Files\甲壳虫系统工具\BEETLE.exe
F:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
F:\PROGRA~2\RISING\RAV\RAVTIMER.EXE
F:\PROGRA~2\RISING\RAV\RAVMON.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\conime.exe
F:\Program Files\Tencent\TT\TTraveler.exe
F:\ProcessSpyer1100\ProcessSpyer.exe
C:\WINDOWS\System32\PYINTAU.EXE
C:\WINDOWS\System32\taskmgr.exe
F:\Program Files\Tencent\QQ\QQ.exe
f:\Program Files\Tencent\QQ\TIMPlatform.exe
C:\WINDOWS\System32\svchost.exe
E:\安装源\安全防护\HijackThis.exe
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - f:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: (no name) - {6EC1C33C-AB68-439A-A1A4-7A5EB587A033} - f:\PROGRA~2\甲壳虫~1\BEETLE~1.DLL
O2 - BHO: AssistII - {BB936323-19FA-4521-BA29-ECA6A121BC78} - (no file)
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - f:\Program Files\Xi\NetTransport 2\NTIEHelper.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: 上网助手 - {BB936323-19FA-4521-BA29-ECA6A121BC78} - (no file)
O3 - Toolbar: 卡卡安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\Program Files\Rising\KaKaToolBar\kakatool.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Beetle] F:\Program Files\甲壳虫系统工具\BEETLE.exe
O4 - HKLM\..\Run: [Zone Labs Client] f:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [RavTimer] F:\PROGRA~2\RISING\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [RavMon] F:\PROGRA~2\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - Startup: 腾讯QQ.lnk = F:\Program Files\Tencent\QQ\QQ.exe
O8 - Extra context menu item: 使用影音传送带下载 - F:\Program Files\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: 使用影音传送带下载全部链接 - F:\Program Files\Xi\NetTransport 2\NTAddList.html
O8 - Extra context menu item: 添加到QQ自定义面板 - F:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - F:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - F:\Program Files\Tencent\QQ\SendMMS.htm
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - E:\Program Files\浩方对战平台2\GameClient.exe
O9 - Extra button: 上网助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://assistant.3721.com/index.htm?fb=Cns (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - f:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - f:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - f:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - f:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - Extra button: 访问瑞星网站 - {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E444} - http://www.rising.com.cn (file missing)
O9 - Extra button: 访问卡卡社区 - {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E445} - http://www.ikaka.com (file missing)
O11 - Options group: [!CNS] 上网助手-地址栏搜索
O11 - Options group: [TBH] QQ地址栏搜索
O16 - DPF: {3D8F74EE-8692-4F8F-B8D2-7522E732519E} (WebActivater Control) - http://game.qq.com/QQGame2.cab
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan
Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/Ver2005/OL2005.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0BA432CF-51C8-4EC2-91FB-6A646D9571A9}: NameServer = 210.41.224.33
O17 - HKLM\System\CS1\Services\Tcpip\..\{0BA432CF-51C8-4EC2-91FB-6A646D9571A9}: NameServer = 210.41.224.33
O17 - HKLM\System\CS2\Services\Tcpip\..\{0BA432CF-51C8-4EC2-91FB-6A646D9571A9}: NameServer = 210.41.224.33
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - F:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - F:\PROGRAM FILES\RISING\RAV\Ravmond.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
用进程间谍查看svhost.exe有：
