麻烦高手帮看一下日志，我发现C:\Program Files\blogmark怎么也删不掉，老是经常弹出一个网页，很是郁闷。另外，进程里有两个winxpser的进程（扫描时已强行结束），以前没见过，有一次瑞星报是病毒，之后却又视而不见，不知道怎么回事，麻烦帮看一下，多谢多谢！！！
Logfile of HijackThis v1.99.1
Scan saved at 21:04:43, on 2005-12-5
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WIN98\System32\smss.exe
C:\WIN98\system32\winlogon.exe
C:\WIN98\system32\services.exe
C:\WIN98\system32\lsass.exe
C:\WIN98\system32\svchost.exe
C:\WIN98\System32\svchost.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\WIN98\System32\brsvc01a.exe
C:\WIN98\system32\spoolsv.exe
C:\WIN98\System32\brss01a.exe
C:\WIN98\Explorer.EXE
C:\PROGRA~1\RISING\RAV\RAVMON.EXE
C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WIN98\System32\ctfmon.exe
C:\WIN98\System32\conime.exe
C:\WIN98\System32\Ati2evxx.exe
C:\Program Files\P4P\p2psvr.exe
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
C:\WIN98\System32\tcpsvcs.exe
C:\WIN98\System32\svchost.exe
C:\PROGRAM FILES\RISING\RAV\RavStub.exe
C:\Program Files\Tencent\QQ\TMDlls\TM.exe
C:\Program Files\Tencent\QQ\TIMPlatform.exe
C:\Program Files\SnowFox\DesktopSprite2\DesktopSprite.exe
C:\Program Files\rising\Rfw\rfwmain.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\tools\ha_hijackthis_1991\HijackThis.exe

R3 - URLSearchHook: MyURLSearchHook Class - {982CB676-38F0-4D9A-BB72-D9371ABE876E} - C:\Program Files\P4P\ToolBar.dll
O2 - BHO: (no name) - {0E7505F8-8F30-41E0-9D1E-D9DEABD36D38} - (no file)
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FLASHGET\jccatch.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WIN98\System32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WIN98\System32\KakaTool.dll
O3 - Toolbar: 搜狗直通车 - {DBBB7978-AF21-4EF4-9AD1-B2F4BC75696C} - C:\Program Files\P4P\ToolBar.dll
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [MS-4011 Memory Patch] D:\tools\RavSasser.exe -Patch
O4 - HKLM\..\Run: [RavMon] C:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [RavTimer] C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [DAEMON Tools-2052] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [Service Monitor] winxpser.exe
O4 - HKLM\..\RunServices: [Service Monitor] winxpser.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WIN98\System32\ctfmon.exe
O4 - HKCU\..\Run: [RegBar] regsvr32.exe /u C:\progra~1\blogmark\bocaitoolbar.dll /s /i /n
O4 - HKCU\..\Run: [DesktopSprite] C:\Program Files\SnowFox\DesktopSprite2\DesktopSprite.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: 快捷方式 到 u8.lnk = C:\Documents and Settings\shewei\u8.bat
O8 - Extra context menu item: 使用搜狗直通车下载 - C:\Program Files\P4P\dl.htm
O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: 使用脱兔下载 - C:\Program Files\TuoTu\xdownGeturl.htm
O8 - Extra context menu item: 发送图片到手机 - C:\Program Files\P4P\cx.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 添加到“我的订阅” - C:\Program Files\P4P\rss.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm
O8 - Extra context menu item: 用比特精灵下载(&B) - C:\Program Files\BitSpirit\bsurl.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WIN98\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WIN98\web\related.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {2354A44B-3CEB-4829-9940-545B03103538} (PowerPlr Control) - http://vod.ruyi.com/plugin/PowerPlr.ocx
O16 - DPF: {3D8F74EE-8692-4F8F-B8D2-7522E732519E} (WebActivater Control) - http://game.qq.com/QQGame2.cab
O16 - DPF: {62B938C4-4190-4F37-8CF0-A92B0A91CC77} (InfoSecNetSign Class) - https://www.bjtax.gov.cn/NetSign.dll
O16 - DPF: {8F9E8A28-C296-4C6F-9A57-8FE4374135A1} (TV Stream Source) - http://211.161.45.69:8080/mysee/Chaos.cab
O16 - DPF: {98A62E3F-A8C5-4EF0-8A00-C70CF9D18A89} (LoaderCore Class) - http://tb.sogou.com/DLLoader.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {D0A29C6C-AA71-4423-8C4A-5998B774C448} (IEDown Class) - http://download.ourgame.com/IEDown2.cab
O16 - DPF: {DA984A6D-508E-11D6-AA49-0050FF3C628D} (Ravonline) - http://download.rising.com.cn/ravkill/rsonline.cab
O16 - DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} (pCastPanel Class) - http://pcastdl.dudu.com/files/pCastCtl.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: C:\WIN98\System32\SoDAHK.DLL
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WIN98\System32\Ati2evxx.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WIN98\System32\brsvc01a.exe
O23 - Service: P4P Service - Sohu.com Inc. - C:\Program Files\P4P\p2psvr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WIN98\System32\HPZipm12.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
O23 - Service: U8管理软件 (UFNet) - Unknown owner - C:\WIN98\System32\ServerNT.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WIN98\System32\UAService7.exe

重新启动电脑, 开机检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式进入Windows

开始——运行——

regsvr32.exe -u C:\progra~1\blogmark\bocaitoolbar.dll
regsvr32.exe -u C:\WIN98\system32\msaddon.dll

运行Hijackthis，扫描结束后在下列选项前打上勾，然后选修复“Fix Checked”：

O2 - BHO: (no name) - {0E7505F8-8F30-41E0-9D1E-D9DEABD36D38} - (no file)
O4 - HKLM\..\Run: [Service Monitor] winxpser.exe
O4 - HKLM\..\RunServices: [Service Monitor] winxpser.exe
O4 - HKCU\..\Run: [RegBar] regsvr32.exe /u C:\progra~1\blogmark\bocaitoolbar.dll /s /i /n
O16 - DPF: {8F9E8A28-C296-4C6F-9A57-8FE4374135A1} (TV Stream Source) - http://211.161.45.69:8080/mysee/Chaos.cab

显示隐藏文件

双击我的电脑--工具---文件夹选项--查看选项卡--单击选取"显示隐藏文件或文件夹"--清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示您确定更改时，单击“是”--单击“确定”。

然后找到如下文件并删除（如果有的话）。

winxpser.exe（请用开始菜单中的搜索功能查找）
C:\progra~1\blogmark\整个目录
C:\WIN98\system32\msaddon.dll

见楼上.
另,还有个问题,最后那个023项是干什么用的?请告之.

具体我也不太清楚，好像是用友财务软件的一部分，和sql和serverNT一起启动的

刚才被高手提问难免紧张，只顾回答连谢谢都忘了
多谢多谢！！！！！！