Logfile of HijackThis v1.99.1
Scan saved at 上午 11:45:06, on 2005-8-2
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\rising\Rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\LLJAgent\KXAgentS.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
F:\Program Files\HFEE\SVOHOST.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\rising\Rfw\RfwMain.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
F:\Program Files\D-Tools\daemon.exe
C:\Program Files\Qyule\QyuleInstall.exe
C:\Program Files\wsearch\Search.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\wsearch\mupdate.exe
C:\PROGRA~1\RISING\RAV\RsAgent.exe
F:\Program Files\QQ贺岁版\QQ.exe
C:\WINDOWS\System32\conime.exe
F:\Program Files\Kingsoft Word 2005\XDICT.EXE
C:\WINDOWS\msagent\AgentSvr.exe
F:\Program Files\QQ贺岁版\TIMPlatform.exe
F:\Program Files\QQ贺岁版\qq\QQ.exe
F:\Program Files\QQ贺岁版\QQexternal.exe
F:\Program Files\NetTransport 2\NetTransport.exe
F:\Program Files\BitComet\BitComet.exe
C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
C:\PROGRAM FILES\RISING\RAV\RavStub.exe
c:\program files\rising\rav\RAVMON.EXE
D:\7\HijackThis.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,,"F:\Program Files\HFEE\SVOHOST.EXE" un userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3D898C55-74CC-4B7C-B5F1-45913F368388} - C:\WINDOWS\System32\MSTXRC.DLL (file missing)
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - F:\Program Files\QQ贺岁版\QQIEHelper.dll
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file)
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - f:\Program Files\NetTransport 2\NTIEHelper.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - F:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - Toolbar: BitCometBar - {3F1ABCDB-A875-46c1-8345-B72A4567E486} - f:\Program Files\BitComet\BitCometBar\BitCometBar0.1.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [MsWinb] ; d:\Program Files\白猫清理工\MsWinb.exe
O4 - HKLM\..\Run: [Kg-Fere] D:\快车下载\11kgbl\KG-Fere\Kg-Fere
O4 - HKLM\..\Run: [金山词霸] ; F:\Program Files\Kingsoft\XDict\xdict.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [WinampAgent] ; "F:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [Super Rabbit SafeEdit] ; F:\Program Files\MagicSet\SRFC.EXE /Load
O4 - HKLM\..\Run: [RavTimer] C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [Super Rabbit SRRestore] F:\Program Files\MagicSet\srrest.exe /autosave
O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [Poco] F:\Program Files\PP\pp.exe
O4 - HKLM\..\Run: [DAEMON Tools-2052] "F:\Program Files\D-Tools\daemon.exe"  -lang 2052
O4 - HKLM\..\Run: [AutoInsQyule] C:\Program Files\Qyule\QyuleInstall.exe
O4 - HKLM\..\Run: [RavMon] C:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [MoveSearch] C:\Program Files\wsearch\Search.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsWinb] ; d:\Program Files\白猫清理工\MsWinb.exe
O4 - HKCU\..\Run: [MSMSGS] ; "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AutoInsQyule] C:\Program Files\Qyule\QyuleInstall.exe
O4 - Startup: 腾讯QQ.lnk = ?
O4 - Startup: 金山词霸 2005.lnk = F:\Program Files\Kingsoft Word 2005\XDICT.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: 使用影音传送带下载 - F:\Program Files\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: 使用影音传送带下载全部链接 - F:\Program Files\NetTransport 2\NTAddList.html
O8 - Extra context menu item: 使用网际快车下载 - F:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - F:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - F:\Program Files\QQ贺岁版\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - F:\Program Files\QQ贺岁版\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - F:\Program Files\QQ贺岁版\SendMMS.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - F:\Program Files\QQ贺岁版\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - F:\Program Files\QQ贺岁版\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - F:\Program Files\QQ贺岁版\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - F:\Program Files\QQ贺岁版\QQIEHelper.dll
O16 - DPF: {3D8F74EE-8692-4F8F-B8D2-7522E732519E} (WebActivater Control) - http://game.qq.com/QQGame2.cab
O16 - DPF: {48038521-20FB-11D8-BC64-00B0D07A8A19} (PortalCom Control 2.0) - http://61.136.63.165/PortalAX02.cab
O16 - DPF: {AD0CB4E1-37FB-44A9-A42B-0B084491FB73} (LTCPlayer Class) - http://www.lt21.com.cn/control/ltctrl.cab
O16 - DPF: {DA984A6D-508E-11D6-AA49-0050FF3C628D} (Ravonline) - http://download.rising.com.cn/QQ/QQkill/rsonline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3B014A9A-3E32-45B7-9EA1-A07AE62DFCF8}: NameServer = 69.50.184.85,195.225.176.37
O17 - HKLM\System\CCS\Services\Tcpip\..\{D05033D2-329B-4388-8743-D7529B837CF7}: NameServer = 69.50.184.85 195.225.176.37
O17 - HKLM\System\CS1\Services\VxD\MSTCP: NameServer = 69.50.184.85,195.225.176.37
O17 - HKLM\System\CS2\Services\VxD\MSTCP: NameServer = 69.50.184.85,195.225.176.37
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 69.50.184.85,195.225.176.37
O23 - Service: KXAgent Service (KXAgentService) - SmartDove - C:\Program Files\LLJAgent\KXAgentS.exe
O23 - Service: rpcrss (Remote Procedure Call(RPC)) - Unknown owner - C:\WINDOWS\svchost.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - C:\Program Files\rising\Rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe

多谢！！！

O23 - Service: rpcrss (Remote Procedure Call(RPC)) - Unknown owner - C:\WINDOWS\svchost.exe
灰鸽子
修复该项
重起进安全模式
关闭系统还原
控制面版--管理工具--服务--停止并禁用rpcrss (Remote Procedure Call(RPC))
显示所有文件（如图）
查找并删除C:\WINDOWS\svchost.exe
请您清空IE缓存
开始--控制面版--internet选项--删除文件--删除所有脱机内容

http://forum.ikaka.com/topic.asp?board=28&artid=6202404参考这里

请问怎样进入安全模式啊
我对电脑是个ABC

1.开始-运行输入regedit,定位到HKEY_LOCAL_MACHINE\ SYSTEM \ CURRENTCONTROLSET \ SERVICES分支，删除左栏中的病毒服务名
rpcrss (Remote Procedure Call(RPC))
2.重启系统，在“文件夹选项”的“查看”面板中勾选“显示系统文件”、“显示所有的文件和文件夹”两项，点击“确定”按钮。然后在windows下寻找病毒文件名svchost.exe,svchost.dll,svchost_Hook.dll,svchostkey,dll,能找到的删除,记住system32下的svchost.exe不能删除

开机自检后按主F8进入安全模式