病毒路径：C:\Program Files\SearchNet\ServeHost(7).exe。
被感染文件：Logger.Agent.iw.
其特点是：1.会自我复制其复制品以XX（1）（2）（3）（4）（5）（6）（7）
打开C:\Program Files\SearchNet文件夹瑞星发现病毒提示重启后删除，可重启后
病毒依然存在，在安全模式下也是此提示，用瑞星的开机抢先杀毒也无法删除。2.
任何关于它的操作都是无效的。我用杀木码软件ewido－guard active发现其感染我
另一文件－路径是：C:\Program Files\HuaCi\huaci\(zsearch.exe(1)(2)(3)(4)(5))    (mUin.exe(1)(2)(3)(4)(5))(zsup.exe(1)(2)(3)(4)(5))(Mouse1.dll(1)(2)(3)(4)(5))
病毒报告如下：HijackThis@Qoo的扫描日志  V1.97.7
Scan saved at 18:41:56, on 2006-2-1
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rising\Rav\Ravmond.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Rising\Rav\RavTask.exe
D:\Bentley\BiGet\bigetloader.exe
D:\Bentley\BiGet\bigetau.exe
C:\WINDOWS\System32\ctfmon.exe
D:\Program Files\魔法兔子\SRIECLI.EXE
C:\Program Files\Rising\Rav\Ravmon.exe
C:\Program Files\Huawei Technologies\Huawei SmartAX MT810\dslmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\PYINTAU.EXE
C:\DOCUME~1\luo\LOCALS~1\Temp\Rar$EX00.641\HijackThis.exe

O2 - BHO: (no name) - {00000011-04FA-11D1-B7DA-00A0C9010000} - D:\Bentley\BiGet\bigetband.dll
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - (no file)
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - Toolbar: ????? - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {F43BD772-ABDD-43b7-A96A-3E9E61946EC0} - (no file)
O3 - Toolbar: ????? - {7A38130D-BEB7-4d60-BE7A-4C4AB6A85CD1} - C:\WINDOWS\vcbar11.dll
O3 - Toolbar: ????? - {115F6E46-FCBC-41ed-B3B5-3BDDD4AAB5E5} - C:\Program Files\YiSou\yisou.dll
O3 - Toolbar: ????? - {BA440AED-8A58-46A3-B8E5-6AEE4D03A7D8} - D:\Bentley\BiGet\bigetband.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMan] ; SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] ; RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] ; nwiz.exe /install
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [Super Rabbit SRRestore] D:\Program Files\Super Rabbit\MagicSet\srrest.exe /autosave
O4 - HKLM\..\Run: [MoveSearch] C:\Program Files\HuaCi\huaci\zsearch.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [LiveUpatePower] ; C:\Program Files\
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [biget] D:\Bentley\BiGet\bigetloader.exe
O4 - HKLM\..\Run: [bigetau] D:\Bentley\BiGet\bigetau.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [NvMediaCenter] ; RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [Super Rabbit IEPro] D:\Program Files\
O4 - HKCU\..\Run: [MSMSGS] ; "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: ntuser.dat.LOG
O4 - Startup: ntuser.ini
O4 - Startup: ntuser.dat
O4 - Global Startup: ntuser.dat
O4 - Global Startup: ntuser.dat.LOG
O8 - Extra context menu item: 使用BiGet下载 - res://D:\Bentley\BiGet\bigetcatch.dll/bigethttp.html
O8 - Extra context menu item: 使用网际快车下载 - C:\PROGRA~1\FLASHGET\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\PROGRA~1\FLASHGET\jc_all.htm
O9 - Extra button: BiGet (HKLM)
O9 - Extra 'Tools' menuitem: BiGet (HKLM)
O10 - Unknown file in Winsock LSP: c:\windows\system32\cdnns.dll
O11 - Options group: [CDNCLIENT] 
O16 - DPF: {3334504D-9980-0010-8000-00AA00389B71} - http://download.microsoft.com/download/0/C/8/0C8EDFAB-30BC-4792-898E-2DABE27B2C4D/mp43dmo.CAB
O16 - DPF: {43E839C5-E10F-443A-BC1F-F09CFD2ABC77} (updatePanelX Control) - http://www.cctv.com/uusee/updateC.cab
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (CEditCtrl Object) - https://img.alipay.com/download/aliedit.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1132573878570
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1134293541781
O16 - DPF: {87CCFDB0-C4BE-4BC2-A78C-9EAA7CF96667} (pcastup Class) - http://ps.itv.mop.com/dn/files/vodupdate_1.0.0.8_20051009.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E20D4170-CA74-4D43-A1F3-F331010EEB04}: NameServer = 61.134.1.4 61.134.1.9