我的电脑中了病毒，每当系统启动以及IE启动（包括打开新网页），都会有如下病毒提示：“病毒名称：Rootkit.Vanti.gen，文件路径：C/WINDOWS/TEMP/exjb7b.dll”。
  请教高手：这是什么病毒？为什么瑞星杀不掉它？
              谢谢！

应该是某个IE插件引起的,清空IE临时文件夹.
如能判断是哪个插件引起的,就卸载他.若不行
请您先下载HijackThis1.99.1（它是免费的）：

http://www.spywareinfo.com/~merijn/files/hijackthis.zip
将它解压到一个非临时性的文件夹（比如C:\Program Files\HijackThis\HijackThis.exe）。然后双击HijackThis.exe图标，选择Do a system scan and save a logfile，将产生的文本文件中的日志贴上来。如果一个帖子贴不下，可以将剩余的部分另开一帖。

谢谢老大！！

我也是中了这个病毒，每次开机都提示，但提示的是该病毒已经被杀掉，但下次开机的时候又出来了。还有每次扫描内存的时候都出现一个叫backdoor.gpigeon.5.dq的病毒，也显示已经杀掉，但重启后还是照旧。我用HijackThis已经扫描了一遍，导出的日志也已经跟最初备份的日志对比了一下，把有改动的地方全修复了，为什么还是照旧。下面是我的日志，各位高人看看。谢谢
Logfile of HijackThis v1.99.1
Scan saved at 22:25:15, on 2006-4-9
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rising\Rav\Ravmond.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
c:\program files\rising\rfw\RfwMain.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\taskswitch.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\赛尔网络\8021X\8021X.exe
C:\Program Files\Internet Explorer\iexplore.exe
E:\软件\杀毒软件\HijackThis.exe

O2 - BHO: ThunderIEHelper - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v14.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &使用迅雷下载 - d:\Program Files\Thunder Network\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - d:\Program Files\Thunder Network\Thunder\getallurl.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - D:\Program Files\浩方对战平台\GameClient.exe
O9 - Extra button: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://tomatolei.com (file missing)
O9 - Extra button: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://tomatolei.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{17946649-DE18-44F8-8215-BF5695A8B5B4}: NameServer = 211.64.144.130,211.64.142.7
O17 - HKLM\System\CCS\Services\Tcpip\..\{42D35D98-1EB6-42C1-B7EF-DDD7719C712F}: NameServer = 211.64.144.130,211.64.142.7
O17 - HKLM\System\CS1\Services\Tcpip\..\{17946649-DE18-44F8-8215-BF5695A8B5B4}: NameServer = 211.64.144.130,211.64.142.7
O17 - HKLM\System\CS2\Services\Tcpip\..\{17946649-DE18-44F8-8215-BF5695A8B5B4}: NameServer = 211.64.144.130,211.64.142.7
O23 - Service: d2cs service (d2cs) - Unknown owner - E:\d2server\pvpgn\d2cs.exe
O23 - Service: d2dbs service (d2dbs) - Unknown owner - E:\d2server\pvpgn\d2dbs.exe
O23 - Service: Diablo II Close Game Server (D2GS) - Unknown owner - E:\d2server\d2110\D2GSSVC.exe
O23 - Service: Media Player Server - Unknown owner - C:\Program.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PvPGN service (pvpgn) - Unknown owner - E:\d2server\pvpgn\PvPGNs.exe
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe

Rootkit  好象说HijackThis 发现不了...

  楼主此病毒难搞..找不言放弃帮帮忙去...

此病毒确实是hijackthis难以发现,建议导出SRENG日志

不知道Rootkit.Vanti.gen是个什么类型的病毒

顶起来

O23 - Service: Diablo II Close Game Server (D2GS) - Unknown owner - E:\d2server\d2110\D2GSSVC.exe
O23 - Service: d2cs service (d2cs) - Unknown owner - E:\d2server\pvpgn\d2cs.exe
O23 - Service: d2dbs service (d2dbs) - Unknown owner - E:\d2server\pvpgn\d2dbs.exe
O23 - Service: PvPGN service (pvpgn) - Unknown owner - E:\d2server\pvpgn\PvPGNs.exe这是你装的什么东东？？？？
O23 - Service: Media Player Server - Unknown owner - C:\Program.exe (file missing)这项明显有问题~~~
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)这项修复！！