我是瑞星正版客户，有良好的升级习惯。目前版本是18.07.52。公元2006.1.2开始恶梦接踵而至，先后感染数种病毒，其中让我刻骨铭心的是上述两种。值得一提的是，我的系统是windowsXP带SP2P补丁，能在线升级。据瑞星公司漏洞提示，几乎打满所有补丁。满以为是商朝的江山，敦料......?
    我是一个病毒菜鸟，正像我玩帝国一样菜。经高人指点，尝试在安全模式下杀毒，无奈道高一尺，魔高一丈，病毒学会遁形，连个影子都见不着。一旦正常启动，监控程序马上提示，发现“Trojan.Rootkit.Vanti.ba”，一按确定，随即出现“清除成功”；再用瑞星手动查毒，总能定时定点找到“Backdoor.Gpigeon.ack”，紧接着也会出现“清除成功”。起初，总免不了会喜出望外，但随着这种循环走动像时钟一样精确时，我开始动摇、迷茫、失望、绝望。我也尝试搜索“_hook.?之类的文件”，结果仍然是查无此人。
    罪证：Backdoor.Gpigeon.ack 清除成功 2006-01-02 20:00 手动扫描 IEXPLORE.EXE>>C:\Program Files\Internet Explorer\IEXPLORE.EXE本机；Trojan.Rootkit.Vanti.ba 重新启动计算机后删除文件 2006-01-03 07:21 手动扫描 C:\WINDOWS\Tempvmmqk5c.dll本机。
    一个濒临绝望的人，敬盼高人指点！在此先多谢了！
                        2006.1.2 17:00-2006.1.3 9:15-.......

Logfile of HijackThis v1.99.1
Scan saved at 13:04:54, on 2006-1-3
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
h:\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
H:\Rising\Rav\Ravmond.exe
h:\rising防火墙\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
H:\Rising\Rav\RavStub.exe
h:\rising防火墙\rfw\RfwMain.exe
C:\WINDOWS\ATK0100\Hcontrol.exe
C:\WINDOWS\VM_STI.EXE
C:\WINDOWS\ATK0100\ATKOSD.exe
H:\Rising\Rav\RavTask.exe
H:\Rising\Rav\Ravmon.exe
C:\WINDOWS\system32\ctfmon.exe
H:\临时文件\HijackThis\HijackThis.exe

O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v4.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: QQBrowserHelperObject Class - {54EBD53A-9BC1-480B-966A-843A333CA162} - H:\QQ2005\QQIEHelper.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - H:\FLASHGET\jccatch.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: 好看123上网精灵 - {FEDF637B-F631-4583-A210-33CC828D42DB} - H:\SUPERR~1\MagicSet\HAOKAN~2.DLL
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - H:\FLASHGET\fgiebar.dll
O3 - Toolbar: (no name) - {AB6BEAD2-325B-4729-BB13-DB24509EFA54} - (no file)
O3 - Toolbar: UCmore - The Search Accelerator Toolbar - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: 好看123上网精灵 - {FEDF637B-F631-4583-A210-33CC828D42DB} - H:\SUPERR~1\MagicSet\HAOKAN~2.DLL
O4 - HKLM\..\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] ; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] ; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IMSCMig] ; C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - HKLM\..\Run: [ASUS Probe] ; C:\Program Files\ASUS\ASUS Probe\AsusProb.exe
O4 - HKLM\..\Run: [SoundMan] ; SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] ; AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] ; C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] ; C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ASUS Live Update] ; C:\Program Files\ASUS\ASUS Live Update\ALU.exe
O4 - HKLM\..\Run: [Hcontrol] C:\WINDOWS\ATK0100\Hcontrol.exe
O4 - HKLM\..\Run: [RfwMain] "H:\rising防火墙\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera 301x
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [hbpassport] ; C:\PROGRA~1\HBCLIENT\hbast.exe
O4 - HKLM\..\Run: [RavTask] "h:\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [res] C:\WINDOWS\system32\res.exe
O4 - HKLM\..\Run: [WinampAgent] ; "h:\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [Super Rabbit SRRestore] H:\SUPERR~1\SUPERR\SRRest.exe /autosave
O4 - HKLM\..\Run: [DAEMON Tools-1033] ; "H:\D-Tools\daemon.exe"  -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] ; "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Hotkey.lnk = C:\Program Files\ASUS\ASUS Hotkey\Hotkey.exe
O4 - Global Startup: 桌面传媒.lnk = ?
O8 - Extra context menu item: Google 搜索(&G) - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: 上传到QQ网络硬盘 - H:\QQ2005\AddToNetDisk.htm
O8 - Extra context menu item: 使用网际快车下载 - H:\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - H:\FlashGet\jc_all.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://H:\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - H:\QQ2005\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - H:\QQ2005\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - H:\QQ2005\SendMMS.htm
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - H:\HFGame3\GameClient.exe
O9 - Extra 'Tools' menuitem: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - H:\HFGame3\GameClient.exe
O9 - Extra button: UCmore Info - {33740AEB-2856-4004-B84B-37E2C0D4F13D} - C:\Program Files\UC Info\WebBand.dll
O9 - Extra 'Tools' menuitem: UCmore Info - {33740AEB-2856-4004-B84B-37E2C0D4F13D} - C:\Program Files\UC Info\WebBand.dll
O9 - Extra button: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra 'Tools' menuitem: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - H:\QQ2005\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - H:\QQ2005\QQ.EXE
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - H:\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - H:\FLASHGET\flashget.exe
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - H:\QQ2005\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - H:\QQ2005\QQIEHelper.dll
O9 - Extra button: 翻译 - {E1CC05A7-50AD-4A1A-8C5E-50145D933731} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: 翻译 - {E1CC05A7-50AD-4A1A-8C5E-50145D933731} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com.tw
O16 - DPF: {2354A44B-3CEB-4829-9940-545B03103538} (PowerPlr Control) - http://www.supernj.com/plugin/PowerPlr.ocx
O16 - DPF: {59CCB4A0-727D-11CF-AC36-00AA00A47DD2} (Timer Object) - http://www.xintv.com/download/ietimer.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1096208513187
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/Ver2005/OL2005.cab
O18 - Protocol: koboo - {7DEE9D05-FA0A-4416-A6F3-6537D0EAB6A6} - C:\WINDOWS\system32\mbprot.dll
O23 - Service: Gray_Pigeon_Server (GrayPigeonServer) - Unknown owner - C:\WINDOWS\svchost.exe (file missing)
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - h:\rising防火墙\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - h:\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - H:\Rising\Rav\Ravmond.exe
O23 - Service: QQFace (Universal Disk Manager) - Unknown owner - C:\Program Files\Common Files\SAND\qqfacerclient.exe (file missing)

在一楼高手指点下,以上是杀完的病毒的Hj日志,怎么还是有"O23 - Service: Gray_Pigeon_Server (GrayPigeonServer) - Unknown owner - C:\WINDOWS\svchost.exe (file missing)",下一步该怎么处理?请高人指点!