这是我的日志，帮小的看看啊。已经确定的是中了一个new.net的间谍，弄不掉，还有我的机子里有5个svchost.exe进程，很可疑啊。有一个System Idle P...SYSTEM 进程经常CPU利用率很高，不知道怎么回事，是不是病毒啊。用最新的瑞星什么都查不到。

Logfile of Kaka v2. 0. 0. 3 Scan Module v2. 0. 0. 1
Scan saved at 21:01:20, on 2005-12-21
Platform: Microsoft Windows XP Professional Service Pack 2 (Build 2600)
MSIE: Internet Explorer v6.00 SP2; (6.00.2900.2180 (xpsp_sp2_rtm.040803-2158))


Running processes:
[smss.exe]
CommandLine =

[csrss.exe]
CommandLine = C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

[winlogon.exe]
CommandLine = winlogon.exe

[services.exe]
CommandLine = C:\WINDOWS\system32\services.exe

[lsass.exe]
CommandLine = C:\WINDOWS\system32\lsass.exe

[svchost.exe]
CommandLine = C:\WINDOWS\system32\svchost -k DcomLaunch

[svchost.exe]
CommandLine = C:\WINDOWS\system32\svchost -k rpcss

[CCenter.exe]
CommandLine = "H:\应用软件\Rising\Rav\CCenter.exe"

[svchost.exe]
CommandLine = C:\WINDOWS\System32\svchost.exe -k netsvcs

[svchost.exe]
CommandLine = C:\WINDOWS\system32\svchost.exe -k NetworkService

[svchost.exe]
CommandLine = C:\WINDOWS\system32\svchost.exe -k LocalService

[RavMonD.exe]
CommandLine = "H:\应用软件\Rising\Rav\Ravmond.exe"

[rfwsrv.exe]
CommandLine = h:\应用软件\rising\rfw\rfwsrv.exe

[spoolsv.exe]
CommandLine = C:\WINDOWS\system32\spoolsv.exe

[DkService.exe]
CommandLine = "H:\应用软件\Diskeeper Corporation\Diskeeper\DkService.exe"

[nvsvc32.exe]
CommandLine = C:\WINDOWS\system32\nvsvc32.exe

[explorer.exe]
CommandLine = C:\WINDOWS\Explorer.EXE

[rfwmain.exe]
CommandLine =  -StartUp

[SMAgent.exe]
CommandLine = "C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe"

[wdfmgr.exe]
CommandLine = C:\WINDOWS\system32\wdfmgr.exe

[uphclean.exe]
CommandLine = H:\应用软件\shut\uphclean.exe

[RavMon.exe]
CommandLine = "H:\应用软件\RISING\RAV\RAVMON.EXE" -SYSTEM

[GoogleDesktop.exe]
CommandLine = "H:\应用软件\Google\Google Desktop Search\GoogleDesktop.exe" /startup

[RavTask.exe]
CommandLine = "H:\应用软件\RISING\RAV\RAVTASK.EXE" -SYSTEM

[MsWinb.exe]
CommandLine = "H:\应用软件\白猫清理工\MsWinb.exe"

[GoogleDesktopIndex.exe]
CommandLine = "GoogleDesktopIndex.exe"

[alg.exe]
CommandLine = C:\WINDOWS\System32\alg.exe

[ctfmon.exe]
CommandLine = "C:\WINDOWS\system32\ctfmon.exe"

[robotaskbaricon.exe]
CommandLine = "H:\应用软件\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"

[GoogleDesktopCrawl.exe]
CommandLine = "GoogleDesktopCrawl.exe" /recent /ie /shell

[GoogleDesktopQQPlugin.exe]
CommandLine = "GoogleDesktopQQPlugin.exe"

[BitComet.exe]
CommandLine = "H:\应用软件\BitComet\BitComet.exe"

[conime.exe]
CommandLine = C:\WINDOWS\system32\conime.exe

[spd.exe]
CommandLine = "H:\应用软件\cFosSpeed\spd.exe" -service

[lovespeed.exe]
CommandLine = H:\应用软件\cFosSpeed\LoveSpeed.exe

[Rav.exe]
CommandLine = "H:\应用软件\Rising\Rav\Rav.exe" "C:\Documents and Settings\All Users\Application Data\Rising\Rav\ShortCut\RsQuick0.rav"

[Maxthon.exe]
CommandLine = "H:\应用软件\Maxthon\Maxthon.exe"  "http://127.0.0.1:4664/&s=MalP0Hw5D4In1G6FdpgZIYGbh54"

[KkScan.exe]
CommandLine = "H:\应用软件\Rising\kaka\KkScan.exe"

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page=http://www.66169.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=cn.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,default_page_url=http://www.66169.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=%SystemRoot%\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page=http://www.66169.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page=cn.yahoo.com
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: 255.255.255.255 download.3721,com
O1 - Hosts: 255.255.255.255 cdn2.cnnic.cn
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - H:\应τ用萌软砑件\Siber Systems\AI RoboForm\roboform.dll (file missing)
O3 - Toolbar:  (file missing)
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll
O4 - HKCU\..\Run: [MsWinb] H:\应用软件\白猫清理工\MsWinb.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RoboForm] "H:\应用软件\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "H:\应用软件\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [RavMon] H:\应用软件\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [Google Desktop Search] "H:\应用软件\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [DiskeeperSystray] "H:\应用软件\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [RfwMain] "H:\应用软件\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [RavTask] "H:\应用软件\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [cFosSpeed] H:\应用软件\cFosSpeed\LoveSpeed.exe
O4 - Startup: desktop.ini =
O4 - Startup: Diskeeper 10 Professional Edition Registration.lnk = H:\应用软件\Diskeeper Corporation\Diskeeper\ESIRegister.exe
O4 - Global Startup: desktop.ini =
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &使用迅雷下载 - H:\应用软件\Thunder Network\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - H:\应用软件\Thunder Network\Thunder\getallurl.htm
O9 - Extra Button: 填写表单 - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: 填写表单 - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra Button: 保存 - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: 保存 - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\WINDOWS\system32\shdocvw.dll

上面那个是用卡卡安全助手的扫描的日志
  这个是用HijackThis扫描的日志，请高手给看看。
    有多少病毒，包括广告和间谍软件，给个方法清除

HijackThis_815汉化版扫描日志 V1.99.1
保存于      21:29:58, 日期 2005-12-21
操作系统：  Windows XP SP2 (WinNT 5.01.2600)
浏览器：    Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程：         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
H:\应用软件\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
H:\应用软件\Rising\Rav\Ravmond.exe
h:\应用软件\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
H:\应用软件\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
h:\应用软件\rising\rfw\RfwMain.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
H:\应用软件\shut\uphclean.exe
H:\应用软件\RISING\RAV\RAVMON.EXE
H:\应用软件\Google\Google Desktop Search\GoogleDesktop.exe
H:\应用软件\Rising\Rav\RavTask.exe
H:\应用软件\白猫清理工\MsWinb.exe
H:\应用软件\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\WINDOWS\system32\ctfmon.exe
H:\应用软件\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
H:\应用软件\Google\Google Desktop Search\GoogleDesktopCrawl.exe
H:\应用软件\Google\Google Desktop Search\GoogleDesktopQQPlugin.exe
H:\应用软件\BitComet\BitComet.exe
C:\WINDOWS\system32\conime.exe
H:\应用软件\cFosSpeed\spd.exe
H:\应用软件\cFosSpeed\LoveSpeed.exe
H:\应用软件\Maxthon\Maxthon.exe
H:\应用软件\Thunder Network\Thunder\Thunder.exe
C:\Documents and Settings\柚轨迹\桌面\系统优化\HijackThis1991zww.exe

F2 - REG:system.ini: UserInit=userinit.exe,
O1 - Hosts: 255.255.255.255 download.3721,com
O1 - Hosts: 255.255.255.255 cdn2.cnnic.cn
O3 - IE工具栏增项: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - H:\应τ用萌软砑件\Siber Systems\AI RoboForm\roboform.dll (file missing)
O3 - IE工具栏增项: (no name) - {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C}? - (no file)
O3 - IE工具栏增项: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - 启动项HKLM\\Run: [BootSkin Startup Jobs] "H:\应用软件\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - 启动项HKLM\\Run: [RavMon] H:\应用软件\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - 启动项HKLM\\Run: [Google Desktop Search] "H:\应用软件\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - 启动项HKLM\\Run: [DiskeeperSystray] "H:\应用软件\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - 启动项HKLM\\Run: [RfwMain] "H:\应用软件\Rising\Rfw\rfwmain.exe" -Startup
O4 - 启动项HKLM\\Run: [RavTask] "H:\应用软件\Rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [cFosSpeed] H:\应用软件\cFosSpeed\LoveSpeed.exe
O4 - HKCU\..\Run: [MsWinb] H:\应用软件\白猫清理工\MsWinb.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RoboForm] "H:\应用软件\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - Startup: Diskeeper 10 Professional Edition Registration.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - IE右键菜单中的新增项目: &使用迅雷下载 - H:\应用软件\Thunder Network\Thunder\geturl.htm
O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - H:\应用软件\Thunder Network\Thunder\getallurl.htm
O9 - 浏览器额外的按钮: 填写表单 - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://H:\%D3%A6%D3%C3%C8%ED%BC%FE\Siber Systems\AI RoboForm\RoboFormComFillForms.html (file missing)
O9 - 浏览器额外的“工具”菜单项: 填写表单 - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://H:\%D3%A6%D3%C3%C8%ED%BC%FE\Siber Systems\AI RoboForm\RoboFormComFillForms.html (file missing)
O9 - 浏览器额外的按钮: 保存 - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://H:\%D3%A6%D3%C3%C8%ED%BC%FE\Siber Systems\AI RoboForm\RoboFormComSavePass.html (file missing)
O9 - 浏览器额外的“工具”菜单项: 保存 - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://H:\%D3%A6%D3%C3%C8%ED%BC%FE\Siber Systems\AI RoboForm\RoboFormComSavePass.html (file missing)
O9 - 浏览器额外的按钮: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://H:\%D3%A6%D3%C3%C8%ED%BC%FE\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html (file missing)
O9 - 浏览器额外的“工具”菜单项: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://H:\%D3%A6%D3%C3%C8%ED%BC%FE\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html (file missing)
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O16 - DPF: {87CCFDB0-C4BE-4BC2-A78C-9EAA7CF96667} - http://ps.itv.mop.com/dn/files/vodupdate_1.0.0.8_20051009.cab
O20 - AppInit_DLLs: H:\应用软件\Google\GOOGLE~1\GOEC62~1.DLL
O21 - SSODL: IconPackager Repair - {1799460C-0BC8-4865-B9DF-4A36CD703FF0} - H:\应τ用萌软砑件\Stardock\Object Desktop\IconPackager\iprepair.dll (file missing)
O23 - NT 服务: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - NT 服务: cFosSpeed System Service (cFosSpeedS) - Unknown owner - H:\应用软件\cFosSpeed\spd.exe" -service (file missing)
O23 - NT 服务: Diskeeper - Diskeeper Corporation - H:\应用软件\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - NT 服务: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - h:\应用软件\rising\rfw\rfwsrv.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - H:\应用软件\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - H:\应用软件\Rising\Rav\Ravmond.exe
O23 - NT 服务: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe