昨天中了熊猫烧香刚开始不能上网，用了瑞星、超级巡警、萧心IT乐园的专杀！以为没有是了，没想到今天又发作了不能上网，用冰刃结束了几个进程，把文件删除,但现在还有病毒，赶快用专杀又杀了一次上网求助！！
    瑞星卡卡还提示c:\docume~1\admini~1\locals~1\temp\win58.exe是病毒，一直有不同的文件提示！如win58.exe、win59.exe、win60.exe等！！！！
    下面是日志，请水树雨下大哥帮忙看一下！！！
   
HijackThis_zww汉化版扫描日志 V1.99.1
保存于      19:09:01, 日期 2007-1-14
操作系统：  Windows 2000 SP4 (WinNT 5.00.2195)
浏览器：    Internet Explorer v6.00 SP1 (6.00.2800.1106)

当前运行的进程：         
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
d:\Rav\CCenter.exe
d:\Rav\Ravmond.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\llssrv.exe
C:\WINNT\system32\tcpsvcs.exe
C:\WINNT\system32\regsvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINNT\Explorer.EXE
d:\Rav\RavStub.exe
C:\WINNT\system32\hkcmd.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\scon\scon.exe
C:\Program Files\Rising\AntiSpyware\runiep.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Rav\RavTask.exe
D:\Rav\Ravmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\system32\sfmsvc.exe
C:\WINNT\system32\msdtc.exe
C:\WINNT\msagent\AgentSvr.exe
C:\Program Files\Internet Explorer\Connection Wizard\ICWCONN1.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.906\HijackThis1991zww.exe

O3 - IE工具栏增项: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - 启动项HKLM\\Run: [IgfxTray] C:\WINNT\system32\igfxtray.exe
O4 - 启动项HKLM\\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - 启动项HKLM\\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - 启动项HKLM\\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - 启动项HKLM\\Run: [scon] C:\scon\scon.exe
O4 - 启动项HKLM\\Run: [runeip] C:\Program Files\Rising\AntiSpyware\runiep.exe
O4 - 启动项HKLM\\Run: [assistse] "C:\PROGRA~1\3721\assistse.exe"
O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - 启动项HKLM\\Run: [RavTask] "d:\Rav\RavTask.exe" -system
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX03.406\QQ\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX03.406\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX03.406\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX03.406\QQ\SendMMS.htm
O9 - 浏览器额外的按钮: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.tomatolei.com (file missing)
O9 - 浏览器额外的“工具”菜单项: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.tomatolei.com (file missing)
O9 - 浏览器额外的按钮: 网址大全 - {C18CB140-0BBB-11D4-8FE8-0088CC102438} - http://www.mpsoft.net/wz.htm (file missing)
O9 - 浏览器额外的“工具”菜单项: 网址大全 - {C18CB140-0BBB-11D4-8FE8-0088CC102438} - http://www.mpsoft.net/wz.htm (file missing)
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\Documents and Settings\Administrator\Local Settings\Temp\EI40_\msxml4.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{EA737D22-2A2B-4BAD-9A8E-F92DCA1D1807}: NameServer = 202.102.224.68,202.102.227.68
O20 - AppInit_DLLs: 235780M.BMP
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O23 - NT 服务: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - NT 服务: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - d:\Rav\CCenter.exe
O23 - NT 服务: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - d:\Rav\Ravmond.exe
O23 - NT 服务: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

我下了一个不能用提示版本过期，大哥能不能给一个安全的下载地址！！！谢谢了

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IgfxTray><C:\WINNT\system32\igfxtray.exe>  [Intel Corporation]
    <HotKeysCmds><C:\WINNT\system32\hkcmd.exe>  [Intel Corporation]
    <SoundMAXPnP><C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe>  [Analog Devices, Inc.]
    <SoundMAX><"C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray>  [Analog Devices, Inc.]
    <scon><C:\scon\scon.exe>  []
    <runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe>  [Beijing Rising Technology Co., Ltd.]
    <assistse><"C:\PROGRA~1\3721\assistse.exe">  []
    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
    <RavTask><"d:\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    <twin><C:\WINNT\system32\twunk32.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [Microsoft Corporation]
    <Userinit><C:\WINNT\system32\userinit.exe,>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><235780M.BMP>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINNT\system32\RavExt.dll>  [Beijing Rising Technology Co., Ltd.]
    <{1CFA2881-2881-CFA4-81CF-881FA881CFA4}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\2881CFA4.dll>  []
[HKEY_CURRENT_USER\Control Panel\Desktop]
    <SCRNSAVE.EXE><(无)>  []

==================================
启动文件夹
服务
[Logical Disk Manager Administrative Service / dmadmin]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[Remote Packet Capture Protocol v.0 (experimental) / rpcapd]
  <"C:\Program Files\WinPcap\rpcapd.exe" -d -f "C:\Program Files\WinPcap\rpcapd.ini"><N/A>
[Rising Process Communication Center / RsCCenter]
  <"d:\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon]
  <"d:\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[SoundMAX Agent Service / SoundMAX Agent Service (default)]
  <C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.>

==================================
浏览器加载项
[番茄花园]
  {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} <http://www.tomatolei.com, N/A>
[网址大全]
  {C18CB140-0BBB-11D4-8FE8-0088CC102438} <http://www.mpsoft.net/wz.htm, N/A>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[@msdxmLC.dll,-1@2052,电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[XML DOM Document 4.0]
  {88D969C0-F192-11D4-A65F-0040963251E5} <%SystemRoot%\system32\msxml4.dll, N/A>
[上传到QQ网络硬盘]
  <C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX03.406\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
  <C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX03.406\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX03.406\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX03.406\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 168][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.00.2195.6601>
[PID: 196][\??\C:\WINNT\system32\csrss.exe]  <Microsoft Corporation><5.00.2195.6601>
[PID: 216][\??\C:\WINNT\system32\winlogon.exe]  <Microsoft Corporation><5.00.2195.6997>
    [C:\WINNT\235780M.BMP]  <N/A><N/A>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 8>
[PID: 252][C:\WINNT\system32\services.exe]  <Microsoft Corporation><5.00.2195.7035>
    [C:\WINNT\235780M.BMP]  <N/A><N/A>
    [C:\WINNT\system32\dmserver.dll]  <VERITAS Software Corp.><2195.6605.297.3>
[PID: 264][C:\WINNT\system32\lsass.exe]  <Microsoft Corporation><5.00.2195.7011>
    [C:\WINNT\235780M.BMP]  <N/A><N/A>
[PID: 464][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
    [C:\WINNT\235780M.BMP]  <N/A><N/A>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 8>
[PID: 504][d:\Rav\CCenter.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
    [C:\WINNT\235780M.BMP]  <N/A><N/A>
[PID: 616][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
    [C:\WINNT\235780M.BMP]  <N/A><N/A>
[PID: 660][C:\WINNT\System32\llssrv.exe]  <Microsoft Corporation><5.00.2195.7021>
    [C:\WINNT\235780M.BMP]  <N/A><N/A>
[PID: 696][C:\WINNT\system32\tcpsvcs.exe]  <Microsoft Corporation><5.00.2134.1>
    [C:\WINNT\235780M.BMP]  <N/A><N/A>
[PID: 820][C:\WINNT\system32\regsvc.exe]  <Microsoft Corporation><5.00.2195.6701>
[PID: 956][C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe]  <Analog Devices, Inc.><3, 2, 6, 0>
    [C:\WINNT\235780M.BMP]  <N/A><N/A>
[PID: 1084][C:\WINNT\Explorer.EXE]  <Microsoft Corporation><5.00.3700.6690>
    [C:\WINNT\235780M.BMP]  <N/A><N/A>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 8>
    [C:\WINNT\system32\hccutils.DLL]  <Intel Corporation><3,0,0,2082>
    [C:\WINNT\system32\igfxres.dll]  <Intel Corporation><3,0,0,2082>
    [C:\WINNT\system32\igfxsrvc.dll]  <Intel Corporation><3,0,0,2082>
    [C:\WINNT\system32\igfxdev.dll]  <Intel Corporation><3,0,0,2082>
    [C:\WINNT\system32\RavExt.dll]  <Beijing Rising Technology Co., Ltd.><19, 0, 0, 7>
    [d:\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><19, 0, 0, 5>
    [C:\Program Files\WinRAR\rarext.dll]  <N/A><N/A>
[PID: 1124][d:\Rav\RavStub.exe]  <Beijing Rising Technology Co., Ltd.><19, 0, 0, 4>
    [C:\WINNT\235780M.BMP]  <N/A><N/A>
    [d:\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [d:\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><19, 0, 0, 5>
[PID: 1216][C:\WINNT\system32\hkcmd.exe]  <Intel Corporation><3,0,0,2082>
    [C:\WINNT\system32\hccutils.DLL]  <Intel Corporation><3,0,0,2082>
    [C:\WINNT\235780M.BMP]  <N/A><N/A>
    [C:\WINNT\system32\igfxdev.dll]  <Intel Corporation><3,0,0,2082>
    [C:\WINNT\system32\igfxsrvc.dll]  <Intel Corporation><3,0,0,2082>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 8>
    [C:\WINNT\system32\igfxhk.dll]  <Intel Corporation><3,0,0,2082>
    [C:\WINNT\system32\igfxres.dll]  <Intel Corporation><3,0,0,2082>
[PID: 1228][C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe]  <Analog Devices, Inc.><4, 0, 3, 6>
    [C:\Program Files\Analog Devices\SoundMAX\SMWDMIF.dll]  <Analog Device, Inc.><1, 0, 20, 1>
    [C:\WINNT\235780M.BMP]  <N/A><N/A>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 8>
[PID: 1268][C:\Program Files\Rising\AntiSpyware\runiep.exe]  <Beijing Rising Technology Co., Ltd.><1, 0, 1, 3>
    [C:\WINNT\235780M.BMP]  <N/A><N/A>
    [C:\Program Files\Rising\AntiSpyware\iep_ctrl.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 4>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 8>
[PID: 1296][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  <RealNetworks, Inc.><0.1.0.3536>
    [C:\WINNT\235780M.BMP]  <N/A><N/A>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 8>
[PID: 1004][C:\WINNT\System32\WBEM\WinMgmt.exe]  <Microsoft Corporation><1.50.1085.0100>
    [C:\WINNT\235780M.BMP]  <N/A><N/A>
[PID: 1608][C:\WINNT\system32\Dfssvc.exe]  <Microsoft Corporation><5.00.2195.6664>
    [C:\WINNT\235780M.BMP]  <N/A><N/A>
[PID: 1636][C:\WINNT\system32\sfmsvc.exe]  <Microsoft Corporation><5.00.2195.6684>
    [C:\WINNT\235780M.BMP]  <N/A><N/A>
[PID: 1716][C:\WINNT\system32\msdtc.exe]  <Microsoft Corporation><1999.9.3421.3>
    [C:\WINNT\235780M.BMP]  <N/A><N/A>
[PID: 1476][C:\WINNT\msagent\AgentSvr.exe]  <Microsoft Corporation><2.00.0.3422>
    [C:\WINNT\235780M.BMP]  <N/A><N/A>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 8>
[PID: 2036][C:\Program Files\Internet Explorer\Connection Wizard\ICWCONN1.EXE]  <Microsoft Corporation><5.00.3502.6602>
    [C:\WINNT\235780M.BMP]  <N/A><N/A>
[PID: 1924][C:\WINNT\System32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
    [C:\WINNT\235780M.BMP]  <N/A><N/A>
[PID: 1212][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  <Microsoft Corporation><6.00.2800.1106>
    [C:\WINNT\235780M.BMP]  <N/A><N/A>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 8>
    [C:\WINNT\system32\macromed\flash\Flash.ocx]  <Macromedia, Inc.><7,0,19,0>
[PID: 736][d:\Rav\RsAgent.exe]  <Beijing Rising Technology Co., Ltd.><19, 0, 0, 9>
    [C:\WINNT\235780M.BMP]  <N/A><N/A>
    [d:\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 8>
[PID: 2300][C:\WINNT\msagent\AgentSvr.exe]  <Microsoft Corporation><2.00.0.3422>
    [C:\WINNT\235780M.BMP]  <N/A><N/A>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 8>
[PID: 1468][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  <Microsoft Corporation><6.00.2800.1106>
    [C:\WINNT\235780M.BMP]  <N/A><N/A>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 8>
[PID: 1256][C:\Program Files\WinRAR\WinRAR.exe]  <N/A><N/A>
    [C:\WINNT\235780M.BMP]  <N/A><N/A>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 8>
[PID: 1316][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.672\SREng2 系统修复\SREng.exe]  <Smallfrogs Studio><2.0.21.505>
    [C:\WINNT\235780M.BMP]  <N/A><N/A>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 8>
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.672\SREng2 系统修复\Plugins\SREngPluginDemo.SRE]  <Smallfrogs Studio><1, 1, 1, 0>

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

先谢谢大哥了，我用了瑞星、超级巡警、萧心IT乐园的专杀了！
    我中的这几个是什么病毒、还是木马呀！！！

中马那天我就没有上网，估计是别人中的传染给我了，这几天老中找招，有没有好的防范措施，我这里就安装了一个瑞星！！！