瑞星卡卡安全论坛

首页 » 技术交流区 » 反病毒/反流氓软件论坛 » 救救我呀.....寻找高手.....我的日志好可怕!!! 我该怎么办呀????
才不要被你毒 - 2006-5-19 20:06:00
Logfile of Kaka v2. 0. 0. 8 Scan Module v2. 0. 0. 1
Scan saved at 20:33:54, on 2006-05-19
Platform: Microsoft Windows 98 SE
MSIE: Internet Explorer v6.00 SP1; (6.00.2800.1106)


Running processes:
[KERNEL32.DLL]
CommandLine =

[MSGSRV32.EXE]
CommandLine =

[MPREXE.EXE]
CommandLine = C:\WINDOWS\SYSTEM\MPREXE.EXE

[KWATCH9X.EXE]
CommandLine = "D:\金山体验\KWatch9x.EXE"

[mmtask.tsk]
CommandLine =

[MSTASK.EXE]
CommandLine = C:\WINDOWS\SYSTEM\mstask.exe

[EXPLORER.EXE]
CommandLine = C:\WINDOWS\explorer.exe

[RUNDLL32.EXE]
CommandLine = Rundll32.exe

[SOUNDMAN.EXE]
CommandLine = "C:\WINDOWS\SOUNDMAN.EXE"

[KAVSTART.EXE]
CommandLine = "D:\金山体验\kavstart.exe" -startup

[EXPLORER.EXE]
CommandLine = "C:\WINDOWS\SYSTEM\explorer.exe"

[STIMON.EXE]
CommandLine = "C:\WINDOWS\SYSTEM\STIMON.EXE"

[LSASS.EXE]
CommandLine = C:\WINDOWS\LSASS.exe

[KMAILMON.EXE]
CommandLine = KMailMon.EXE

[DUDUPROS.EXE]
CommandLine = "C:\Program Files\DuDu\DddClient\dudupros.exe"

[CTFMON.EXE]
CommandLine = ctfmon.exe

[PSTORES.EXE]
CommandLine = C:\WINDOWS\SYSTEM\PSTORES.EXE

[DDHELP.EXE]
CommandLine = ddhelp.exe

[DUDUACC.EXE]
CommandLine = "C:\Program Files\DuDu\DddClient\DuDuAcc.exe" "http://download.rising.com.cn/for_down/kakatool/KakaSetup.exe" /m2 "/c__utma=237202181.1946361962.1148040332.1148040332.1148040332.1; __utmb=237202181; __utmc=237202181; __utmz=237202181.1148040332.1.1.utmccn=(organic)|utmcsr=google|utmctr=%E7%91%9E%E6%96%B0%E6%9D%80%E6%AF%92+%E5%8D%A1%E5%8D%A1%E4%B8%8A%E7%BD%91%E5%8A%A9%E6%89%8B|utmcmd=organic; ASPSESSIONIDAAABBTQS=ANNOLMBCJNOLLODKPBIIDIME" "/ehttp://tool.ikaka.com/" "/i"

[IEXPLORE.EXE]
CommandLine = C:\PROGRA~1\INTERN~1\IEXPLORE.EXE -Embedding

[KKSCAN.EXE]
CommandLine = "E:\卡卡网上助手\KkScan.exe"

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page=http://www.yahoo.com.cn
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page=http://www.yahoo.com.cn
R3 - URLSearchHook: 上网助手 - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\PROGRAM FILES\3721\ASSIST\ASBAR.DLL
R3 - URLSearchHook: Tencent SearchHook - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - C:\PROGRAM FILES\TENCENT\ADPLUS\SSADDR.DLL
O2 - BHO: 上网助手 - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\PROGRAM FILES\3721\ASSIST\ASBAR.DLL
O2 - BHO:  (file missing)
O2 - BHO:  (file missing)
O2 - BHO:  (file missing)
O2 - BHO:  (file missing)
O2 - BHO:  (file missing)
O2 - BHO:  (file missing)
O2 - BHO:  (file missing)
O3 - Toolbar: 上网助手 - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\PROGRAM FILES\3721\ASSIST\ASBAR.DLL
O3 - Toolbar: 金山毒霸安全助手 - {EF72500A-C234-46C4-BF0A-9AA6913DDF34} - C:\PROGRAM FILES\KOS\KOSIEBAR.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\SYSTEM\KAKATOOL.DLL
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CnsMin] Rundll32.exe C:\WINDOWS\DOWNLO~1\CNSMIN.DLL,Rundll32
O4 - HKLM\..\Run: [KavStart] "D:\金山体验\KAVStart.exe" -startup
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [EXPLORER.EXE] C:\WINDOWS\SYSTEM\explorer.exe
O4 - HKLM\..\Run: [NTdhcp] C:\WINDOWS\SYSTEM\NTdhcp.exe
O4 - HKLM\..\Run: [ToP] C:\WINDOWS\LSASS.exe
O4 - HKLM\..\RunServices: [KWatch9x] D:\金山体验\KWatch9x.EXE
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - Startup: DuDu下载加速器.lnk = C:\Program Files\DuDu\DddClient\DuDuAcc.exe
O8 - Extra context menu item: 使用网际快车下载 - E:\FG美化版\网际快车\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - E:\FG美化版\网际快车\jc_all.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\ZUIXINQQQQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\ZUIXINQQQQ\AddEmotion.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\ZUIXINQQQQ\AddToNetDisk.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\ZUIXINQQQQ\SendMMS.htm
O8 - Extra context menu item: &使用暴风下载器下载 - E:\STORM DOWNLOADER\geturl.htm
O8 - Extra context menu item: &使用迅雷下载 - D:\XUNLEI\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - D:\XUNLEI\getallurl.htm
O8 - Extra context menu item: Google 搜索(&G) - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: 翻译英文字词(&T) - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmwordtrans.html
O8 - Extra context menu item: 缓存的网页快照 - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: 类似网页 - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: 反向链接 - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: &使用DuDu 加速器下载 - res://C:\PROGRAM FILES\DUDU\DDDCLIENT\dddmext.dll/202
O8 - Extra context menu item: &使用DuDu 加速器下载全部链接 - res://C:\Program Files\DuDu\DddClient\dddmext.dll/203
O9 - Extra Button: @shdoclc.dll,-866 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
O9 - Extra 'Tools' menuitem: @shdoclc.dll,-864 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
O9 - Extra Button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\zuixinqqQQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\zuixinqqQQ\QQ.EXE
O9 - Extra Button: 视频聊天 - {6924091F-CD97-41E1-B1D4-D9079409D413} - http://www.liantang.net (file missing)
O9 - Extra 'Tools' menuitem: 视频聊天 - {6924091F-CD97-41E1-B1D4-D9079409D413} - http://www.liantang.net (file missing)
O9 - Extra Button: 寻论网--中学作业解答 - {6924091F-CD97-41E1-B1D4-D9079409D423} - http://www.xunlun.com (file missing)
O9 - Extra 'Tools' menuitem: 中学作业 - {6924091F-CD97-41E1-B1D4-D9079409D423} - http://www.xunlun.com (file missing)
O9 - Extra Button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O9 - Extra 'Tools' menuitem: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O9 - Extra Button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - Extra 'Tools' menuitem: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - Extra Button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96}? - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
O9 - Extra Button: kele8 - {84920E5F-3788-49cd-A274-E365578DF174}? - http://www.kele8.com/ (file missing)
O9 - Extra 'Tools' menuitem: kele8 - {84920E5F-3788-49cd-A274-E365578DF174}? - http://www.kele8.com/ (file missing)
O9 - Extra Button: 雅虎助手 - {5D73EE86-05F1-49ed-B850-E423120EC338}? - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist (file missing)
O9 - Extra Button: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26}? - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao (file missing)
O9 - Extra Button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97}? - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail (file missing)
O11 - Options group: [!CNS]  上网助手-地址栏搜索
O11 - Options group: [TBH]  搜搜地址栏搜索
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
O16 - DPF: DirectAnimation Java Classes - file://C:\WINDOWS\SYSTEM\dajava.cab
O16 - DPF: Internet Explorer Classes for Java - file://C:\WINDOWS\SYSTEM\iejava.cab
O16 - DPF: {5DD731E6-D4F0-11D3-BE3F-00105A6FDA50} (V3ProX Control) - http://origin-www.ahn.com.cn/aspservice/plugin/myv3.cab
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O16 - DPF: {3359C0B1-2363-40B3-AFCA-1ABC799AC486} (SSReaderPlug Control) - http://reg.ssreader.com/ssreaderplug.ocx
O16 - DPF: {E787FD25-8D7C-4693-AE67-9406BC6E22DF} (CPasswordEditCtrl Object) - https://tenpay.qq.com/download/qqedit.cab
O16 - DPF: {D1056C7C-E30B-4234-9A4B-7E1038B167A7} (RootCertInstall Class) - https://mybank.icbc.com.cn/icbc/perbank/RootCert.cab
O16 - DPF: {52DF16E3-6C4F-4B22-8BAF-09263E463B48} (金山毒霸安全助手) - http://zs.kingsoft.com/KOSInit.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP:  NameServer = 202.103.24.68,202.103.0.117
O18 - Filter : application/octet-stream - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\SYSTEM\mscoree.dll
O18 - Filter : application/x-complus - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\SYSTEM\mscoree.dll
O18 - Filter : application/x-msdownload - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\SYSTEM\mscoree.dll
O18 - Protocol: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\SYSTEM\urlmon.dll
O18 - Protocol: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\SYSTEM\urlmon.dll
O18 - Protocol: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\SYSTEM\urlmon.dll
O18 - Protocol: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\SYSTEM\urlmon.dll
O18 - Protocol: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\SYSTEM\urlmon.dll
O18 - Protocol: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\SYSTEM\urlmon.dll
O18 - Protocol: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\SYSTEM\urlmon.dll
O18 - Protocol: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\SYSTEM\urlmon.dll
O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\SYSTEM\MSHTML.DLL
O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\SYSTEM\MSHTML.DLL
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\SYSTEM\MSHTML.DLL
O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\SYSTEM\MSHTML.DLL
O18 - Protocol: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\SYSTEM\MSHTML.DLL
O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\SYSTEM\MSHTML.DLL
O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\SYSTEM\ITSS.DLL
O18 - Protocol: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\SYSTEM\INETCOMM.DLL
O18 - Protocol: msdaipp - (no CLSID) - (no file)
O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\SYSTEM\ITSS.DLL
O18 - Protocol: ic32pp - {BBCA9F81-8F4F-11D2-90FF-0080C83D3571} - C:\WINDOWS\wc98pp.dll
O18 - Protocol: mctp - {d7b95390-b1c5-11d0-b111-0080c712fe82} - e:\activesync\aatp.dll
O18 - Protocol: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O18 - Protocol: ipp - (no CLSID) - (no file)
阿杜QQ - 2006-5-19 20:09:00
O4 - HKLM\..\Run: [ToP] C:\WINDOWS\LSASS.exe
这个木马有点变态!做好准备
http://blog.sina.com.cn/u/1034488164                             
,请下载使用 System Repair Engineer,使用“智能扫描”,按下“扫描”按钮进行扫描,完成后按下“保存报告”按钮保存报告日志文件(SREng.LOG),
把保存的报告日志文件内容复制-

才不要被你毒 - 2006-5-19 20:11:00
谢谢呀 ...我都快疯了..我去试一试... 55555
才不要被你毒 - 2006-5-19 20:16:00
我扫描过了 可保存的文件是 SREng.LOG 怎么打开 复制啊???
阿杜QQ - 2006-5-19 20:18:00
请把日志全部粘贴上来
才不要被你毒 - 2006-5-19 20:20:00
.log 格式的文件 我打不开啊 怎么查看日志啊啊?
阿杜QQ - 2006-5-19 20:21:00
怎么打不开。怎么提示啊?
才不要被你毒 - 2006-5-19 20:24:00
.log 我双击这个文件 我不知道 打开方式是什么?

这格式的文件我好像打不开...看不到日志内容..
阿杜QQ - 2006-5-19 20:28:00
打开瑞星,找到注册表修复工具,整个修复!然后打开log
才不要被你毒 - 2006-5-19 20:30:00
我双击 SREng.LOG 后

提示说: 单击要使用的程序以便打开文件"SREng.LOG ".
如果程序不在列表,请单击 "其他"

我不知道用什么程序打开.... : ((
才不要被你毒 - 2006-5-19 20:32:00
汗!!! 我的机器两年没用过杀毒软件...网上可以在线修复不?
阿杜QQ - 2006-5-19 20:32:00
选择记事本,或者文本本档
才不要被你毒 - 2006-5-19 20:38:00
日志太多 我复制那部分???

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <ctfmon.exe><ctfmon.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <SoundMan><SOUNDMAN.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <CnsMin><Rundll32.exe C:\WINDOWS\DOWNLO~1\CNSMIN.DLL,Rundll32>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <KavStart><"D:\金山体验\KAVStart.exe" -startup>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <StillImageMonitor><C:\WINDOWS\SYSTEM\STIMON.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <ScanRegistry><C:\WINDOWS\scanregw.exe /autorun>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <EXPLORER.EXE><C:\WINDOWS\SYSTEM\explorer.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <NTdhcp><C:\WINDOWS\SYSTEM\NTdhcp.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <ToP><C:\WINDOWS\LSASS.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
  <KWatch9x><D:\金山体验\KWatch9x.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
  <SchedulingAgent><C:\WINDOWS\SYSTEM\mstask.exe>
才不要被你毒 - 2006-5-19 20:45:00
要在 注册表里 把
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<ToP><C:\WINDOWS\LSASS.exe>
这个键值删掉吗?
阿杜QQ - 2006-5-19 20:46:00
必须全部!
才不要被你毒 - 2006-5-19 21:03:00
打开瑞星,找到注册表修复工具,整个修复!然后打开log

我已经 整个修复。。打开log后 接下来怎么做啊?

才不要被你毒 - 2006-5-19 21:19:00
2006-05-19,21:43:01

System Repair Engineer 2.0.12.350 (2.0 RC 1)
    Windows 98 Second Edition

以下内容被选中:
    所有的启动项目(包括注册表、启动文件夹、服务等)
    浏览器加载项
    正在运行的进程(包括进程模块信息)
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <ctfmon.exe><ctfmon.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <SoundMan><SOUNDMAN.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <CnsMin><Rundll32.exe C:\WINDOWS\DOWNLO~1\CNSMIN.DLL,Rundll32>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <KavStart><"D:\金山体验\KAVStart.exe" -startup>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <StillImageMonitor><C:\WINDOWS\SYSTEM\STIMON.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <ScanRegistry><C:\WINDOWS\scanregw.exe /autorun>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <EXPLORER.EXE><C:\WINDOWS\SYSTEM\explorer.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <NTdhcp><C:\WINDOWS\SYSTEM\NTdhcp.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <ToP><C:\WINDOWS\LSASS.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
  <KWatch9x><D:\金山体验\KWatch9x.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
  <SchedulingAgent><C:\WINDOWS\SYSTEM\mstask.exe>

==================================
启动文件夹
[DuDu下载加速器]
  <C:\WINDOWS\Html\DuDu下载加速器.lnk><N>

==================================
服务

==================================
浏览器加载项
[DDDMon Class]
  {6BDE1669-B490-48E3-B668-456314F2D6C3} <C:\PROGRAM FILES\DUDU\DDDCLIENT\DDDIEMON.DLL, DuDu.com>
[上网助手]
  {BB936323-19FA-4521-BA29-ECA6A121BC78} <C:\PROGRAM FILES\3721\ASSIST\ASBAR.DLL, 3721>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <D:\zuixinqqQQ\QQ.EXE, TENCENT>
[视频聊天]
  {6924091F-CD97-41E1-B1D4-D9079409D413} <http://www.liantang.net, N/A>
[寻论网--中学作业解答]
  {6924091F-CD97-41E1-B1D4-D9079409D423} <http://www.xunlun.com, N/A>
[]
  {FD00D911-7529-4084-9946-A29F1BDF4FE5} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean, N/A>
[]
  {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair, N/A>
[情景聊天]
  {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96}? <http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/, N/A>
[kele8]
  {84920E5F-3788-49cd-A274-E365578DF174}? <http://www.kele8.com/, N/A>
[雅虎助手]
  {5D73EE86-05F1-49ed-B850-E423120EC338}? <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist, N/A>
[寻宝乐趣多]
  {59BC54A2-56B3-44a0-93E5-432D58746E26}? <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao, N/A>
[Yahoo 1G电邮]
  {507F9113-CD77-4866-BA92-0E86DA3D0B97}? <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail, N/A>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH8B.OCX, Macromedia, Inc.>
[V3ProX Control]
  {5DD731E6-D4F0-11D3-BE3F-00105A6FDA50} <C:\WINDOWS\DOWNLO~1\V3PROX.OCX, Ahnlab, Inc.>
[Java Plug-in 1.3.1_09]
  {8AD9C840-044E-11D1-B3E9-00805F499D93} <E:\java虚拟机\bin\npjava131_09.dll, JavaSoft / Sun Microsystems, Inc.>
[AxInputControl Class]
  {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL, (>
[SSReaderPlug Control]
  {3359C0B1-2363-40B3-AFCA-1ABC799AC486} <C:\WINDOWS\SYSTEM\SSREAD~1.OCX, CX>
[CPasswordEditCtrl Object]
  {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\SYSTEM\QQEDIT\QQEDIT.DLL, 腾讯科技(深圳)有限公司>
[RootCertInstall Class]
  {D1056C7C-E30B-4234-9A4B-7E1038B167A7} <C:\WINDOWS\DOWNLO~1\ROOTCERT.DLL, $>
[金山毒霸安全助手]
  {52DF16E3-6C4F-4B22-8BAF-09263E463B48} <C:\PROGRA~1\KOS\KOSINIT.OCX, 金山软件股份有限公司>
[使用网际快车下载]
  <E:\FG美化版\网际快车\jc_link.htm, N/A>
[使用网际快车下载全部链接]
  <E:\FG美化版\网际快车\jc_all.htm, N/A>
[添加到QQ自定义面板]
  <D:\ZUIXINQQQQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <D:\ZUIXINQQQQ\AddEmotion.htm, N/A>
[上传到QQ网络硬盘]
  <D:\ZUIXINQQQQ\AddToNetDisk.htm, N/A>
[用QQ彩信发送该图片]
  <D:\ZUIXINQQQQ\SendMMS.htm, N/A>
[&使用暴风下载器下载]
  <E:\STORM DOWNLOADER\geturl.htm, N/A>
[&使用迅雷下载]
  <D:\XUNLEI\geturl.htm, N/A>
[&使用迅雷下载全部链接]
  <D:\XUNLEI\getallurl.htm, N/A>
[Google 搜索(&G)]
  <res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html, N/A>
[翻译英文字词(&T)]
  <res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmwordtrans.html, N/A>
[缓存的网页快照]
  <res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html, N/A>
[类似网页]
  <res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html, N/A>
[反向链接]
  <res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html, N/A>
[&使用DuDu 加速器下载]
  <res://C:\PROGRAM FILES\DUDU\DDDCLIENT\dddmext.dll/202, N/A>
[&使用DuDu 加速器下载全部链接]
  <res://C:\Program Files\DuDu\DddClient\dddmext.dll/203, N/A>

==================================
正在运行的进程
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMIN.DLL]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  <N/A><N/A>
    [D:\金山体验\KASOCKET.DLL]  <Kingsoft Corporation><2005, 2, 22, 233>
[PID: 4294965765][C:\WINDOWS\SYSTEM\MPREXE.EXE]  <Microsoft Corporation><4.10.1998>
    [D:\金山体验\KAEMEM.DAT]  <Kingsoft><2004, 11, 9, 11>
    [D:\金山体验\KAEPLAT.DLL]  <Kingsoft Corp.><2004, 11, 26, 53>
    [D:\金山体验\KAVIPC2.DLL]  <Kingsoft Corporation><2004, 12, 28, 20>
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  <N/A><N/A>
[PID: 4294844585][D:\金山体验\KWATCH9X.EXE]  <Kingsoft Corporation><2005, 4, 24, 31>
[PID: 4294848709][C:\WINDOWS\SYSTEM\MSTASK.EXE]  <Microsoft Corporation><4.71.1959.1>
    [C:\WINDOWS\SYSTEM\XUNLEIBHO_V8.DLL]  <Thunder Networking Technologies,LTD><4, 5, 1, 33>
    [C:\PROGRAM FILES\3721\ASSIST\ASIESEC.DLL]  <yahoo><1, 0, 0, 9>
    [C:\PROGRAM FILES\3721\ASSIST\ASWIPER.DLL]  <3721><1, 0, 0, 2>
    [C:\PROGRAM FILES\3721\ASSIST\TBWRAP.DLL]  <3721><1, 0, 0, 2>
    [E:\豪杰V8\VCVTSHELL.DLL]  <herosoft><1, 0, 0, 1>
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMINIO.DLL]  <北京三七二一科技有限公司><1, 0, 3, 4>
    [C:\PROGRAM FILES\3721\ASSIST\XPSTYLE.DLL]  <N/A><N/A>
    [C:\PROGRAM FILES\3721\ASSIST\ASSECBLK.DLL]  <3721><1, 0, 0, 8>
    [C:\PROGRAM FILES\3721\ASSIST\OPTIMUM.DLL]  <N/A><N/A>
    [C:\PROGRAM FILES\3721\ASSIST\REPAIR.DLL]  <北京三七二一科技有限公司><1, 0,
才不要被你毒 - 2006-5-19 21:19:00
4, 1001>
    [C:\PROGRAM FILES\3721\ASSIST\ASFSKS.DLL]  <3721.com><2, 1, 1, 87>
    [C:\WINDOWS\SYSTEM\DHCPCSVC.DLL]  <N/A><N/A>
    [C:\PROGRAM FILES\3721\ASSIST\ADFILTER.DLL]  < ><1, 0, 1, 6>
    [C:\PROGRAM FILES\3721\ASSIST\ASBAR.DLL]  <3721><1, 0, 1, 1008>
    [D:\金山体验\KASOCKET.DLL]  <Kingsoft Corporation><2005, 2, 22, 233>
    [C:\WINDOWS\SYSTEM\SYSTEMLR.DLL]  <N/A><N/A>
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMIN.DLL]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  <N/A><N/A>
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSHOOK.DLL]  <北京三七二一科技有限公司><1, 0, 2, 5>
[PID: 4294881685][C:\WINDOWS\EXPLORER.EXE]  <Microsoft Corporation><4.72.3110.1>
    [D:\金山体验\KASOCKET.DLL]  <Kingsoft Corporation><2005, 2, 22, 233>
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMINEX.DLL]  <国风因特软件(北京)有限公司><1, 0, 3, 1>
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSIO.DLL]  <北京三七二一科技有限公司><1, 0, 2, 5>
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMINIO.DLL]  <北京三七二一科技有限公司><1, 0, 3, 4>
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMIN.DLL]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  <N/A><N/A>
[PID: 4294778681][C:\WINDOWS\RUNDLL32.EXE]  <Microsoft Corporation><4.10.1998>
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMIN.DLL]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  <N/A><N/A>
[PID: 4294758477][C:\WINDOWS\SOUNDMAN.EXE]  <Avance Logic, Inc.><5.0>
    [D:\金山体验\KAVPASSP.DLL]  <Kingsoft Corporation><2006, 4, 12, 231>
    [D:\金山体验\POPSPRT3.DLL]  <Kingsoft Corporation><2005, 12, 6, 30>
    [D:\金山体验\KAVIPC2.DLL]  <Kingsoft Corporation><2004, 12, 28, 20>
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMIN.DLL]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  <N/A><N/A>
[PID: 4294648877][D:\金山体验\KAVSTART.EXE]  <Kingsoft Corporation><2006, 4, 10, 196>
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMIN.DLL]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  <N/A><N/A>
    [C:\WINDOWS\SYSTEM\SYSTEMLR.DLL]  <N/A><N/A>
[PID: 4294650033][C:\WINDOWS\SYSTEM\EXPLORER.EXE]  <N/A><N/A>
    [C:\WINDOWS\SYSTEM\VM31BSTI.DLL]  <VM><4.2.510.21>
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMIN.DLL]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  <N/A><N/A>
[PID: 4294683521][C:\WINDOWS\SYSTEM\STIMON.EXE]  <Microsoft Corporation><4.10.2222>
    [D:\金山体验\KASOCKET.DLL]  <Kingsoft Corporation><2005, 2, 22, 233>
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMIN.DLL]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  <N/A><N/A>
[PID: 4294656865][C:\WINDOWS\LSASS.EXE]  <XQM><0.00.0064>
    [D:\金山体验\KASOCKET.DLL]  <Kingsoft Corporation><2005, 2, 22, 233>
    [D:\金山体验\KACONFIG.DLL]  <Kingsoft Corporation><2005, 3, 23, 30>
    [D:\金山体验\KAEMEM.DAT]  <Kingsoft><2004, 11, 9, 11>
    [D:\金山体验\KAEPLAT.DLL]  <Kingsoft Corp.><2004, 11, 26, 53>
    [D:\金山体验\KAECALL2.DLL]  <Kingsoft Corporation><2004, 12, 28, 7>
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMIN.DLL]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  <N/A><N/A>
    [D:\金山体验\KAVIPC2.DLL]  <Kingsoft Corporation><2004, 12, 28, 20>
    [D:\金山体验\KANTISPM.DLL]  <N/A><1, 0, 0, 2>
[PID: 4294734733][D:\金山体验\KMAILMON.EXE]  <Kingsoft Corporation><2005, 10,
才不要被你毒 - 2006-5-19 21:20:00
8, 85>
    [C:\PROGRAM FILES\DUDU\DDDCLIENT\DHTIWL.DLL]  <DuDu.com><4.3.0.1>
    [D:\金山体验\KASOCKET.DLL]  <Kingsoft Corporation><2005, 2, 22, 233>
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMIN.DLL]  <北京三七二一科技有限公司><1, 5, 3, 1>
[PID: 4294094113][C:\PROGRAM FILES\DUDU\DDDCLIENT\DUDUPROS.EXE]  <DuDu.com><4, 3, 0, 1>
    [C:\WINDOWS\SYSTEM\DHCPCSVC.DLL]  <N/A><N/A>
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  <N/A><N/A>
    [D:\金山体验\KASOCKET.DLL]  <Kingsoft Corporation><2005, 2, 22, 233>
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMIN.DLL]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  <N/A><N/A>
[PID: 4294159209][C:\WINDOWS\SYSTEM\CTFMON.EXE]  <Microsoft Corporation><1.00.2409.7 built by: Lab06_N>
    [C:\WINDOWS\SYSTEM\NVDD32.DLL]  <NVidia Corporation><4.13.01.1470>
    [C:\WINDOWS\SYSTEM\NVARCH32.DLL]  <NVidia Corporation><4.13.01.1470>
    [D:\金山体验\KASOCKET.DLL]  <Kingsoft Corporation><2005, 2, 22, 233>
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMIN.DLL]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  <N/A><N/A>
[PID: 4294018913][C:\WINDOWS\SYSTEM\DDHELP.EXE]  <Microsoft Corporation><4.09.00.0900>
    [C:\WINDOWS\SYSTEM\SYSTEMLR.DLL]  <N/A><N/A>
    [C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH8B.OCX]  <Macromedia, Inc.><8,0,24,0>
    [C:\PROGRAM FILES\DUDU\DDDCLIENT\DDDDL.DLL]  <DuDu.com><4, 3, 0, 1>
    [C:\PROGRAM FILES\DUDU\DDDCLIENT\DDDSKIN.DLL]  <dudu><1, 0, 0, 1>
    [D:\金山体验\KASOCKET.DLL]  <Kingsoft Corporation><2005, 2, 22, 233>
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMIN.DLL]  <北京三七二一科技有限公司><1, 5, 3, 1>
[PID: 4293931569][C:\PROGRAM FILES\DUDU\DDDCLIENT\DUDUACC.EXE]  <DuDu.com><4, 3, 0, 1>
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  <N/A><N/A>
    [C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WEB 文件夹\MSONSEXT.DLL]  <N/A><N/A>
    [C:\PROGRAM FILES\3721\ASSIST\EHEOCX.DLL]  <$><9, 0, 0, 9>
    [C:\PROGRAM FILES\3721\ASSIST\XPSTYLE.DLL]  <N/A><N/A>
    [C:\PROGRAM FILES\3721\ASSIST\ASSECBLK.DLL]  <3721><1, 0, 0, 8>
    [C:\PROGRAM FILES\3721\ASSIST\OPTIMUM.DLL]  <N/A><N/A>
    [C:\PROGRAM FILES\3721\ASSIST\REPAIR.DLL]  <北京三七二一科技有限公司><1, 0, 4, 1001>
    [C:\PROGRAM FILES\3721\ASSIST\ASFSKS.DLL]  <3721.com><2, 1, 1, 87>
    [C:\WINDOWS\SYSTEM\DHCPCSVC.DLL]  <N/A><N/A>
    [C:\PROGRAM FILES\3721\ASSIST\ADFILTER.DLL]  < ><1, 0, 1, 6>
    [C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH8B.OCX]  <Macromedia, Inc.><8,0,24,0>
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSIO.DLL]  <北京三七二一科技有限公司><1, 0, 2, 5>
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMINIO.DLL]  <北京三七二一科技有限公司><1, 0, 3, 4>
    [C:\WINDOWS\SYSTEM\SYSTEMLR.DLL]  <N/A><N/A>
    [C:\PROGRAM FILES\KOS\KOSIEBAR.DLL]  <金山软件股份有限公司><2005, 8, 19, 45>
    [C:\WINDOWS\SYSTEM\XUNLEIBHO_V8.DLL]  <Thunder Networking Technologies,LTD><4, 5, 1, 33>
    [C:\PROGRAM FILES\TENCENT\QQ\QQIEHELPER.DLL]  <深圳市腾讯计算机系统有限公司><1, 1, 0, 5>
    [C:\WINDOWS\SYSTEM\OLEACC.DLL]  <Microsoft Corporation><4.2.2209.0>
    [C:\PROGRAM FILES\DUDU\DDDCLIENT\DDDIEMON.DLL]  <DuDu.com><4, 3, 0, 1>
    [C:\WINDOWS\SYSTEM\KAKATOOL.DLL]  <Beijing Rising Technology Co., Ltd.><2, 0, 0, 8>
    [C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL]  <Google Inc.><3, 0, 131, 0>
    [C:\PROGRAM FILES\3721\ASSIST\ASIESEC.DLL]  <yahoo><1, 0, 0, 9>
    [C:\PROGRAM FILES\3721\ASSIST\ASWIPER.DLL]  <3721><1, 0, 0, 2>
    [C:\PROGRAM FILES\3721\ASSIST\TBWRAP.DLL]  <3721><1, 0, 0, 2>
    [C:\PROGRAM FILES\3721\ASSIST\ASBAR.DLL]  <3721><1, 0, 1, 1008>
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSPLUS.DLL]  <3721><1, 0, 0, 2>
    [D:\金山体验\KASOCKET.DLL]  <Kingsoft Corporation><2005, 2, 22, 233>
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSHINT.DLL]  <3721><1, 0, 0, 4>
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMIN.DLL]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  <N/A><N/A>
[PID: 4055797381][C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE]  <Microsoft Corporation><6.00.2800.1106>
[PID: 4222310973][C:\WINDOWS\SYSTEM\PSTORES.EXE]  <Microsoft Corporation><5.00.1877.3>
    [D:\ZUIXINQQQQ\QQSYSMSGMNG.DLL]  <N/A><N/A>
    [D:\ZUIXINQQQQ\QQSCENEMNG.DLL]  <N/A><N/A>
    [D:\ZUIXINQQQQ\QQADDR.DLL]  <深圳市腾讯计算机系统有限公司><4, 0, 200, 32>
    [D:\ZUIXINQQQQ\QQUDPGETFILELIB.DLL]  <tencent><0, 2, 2, 3>
    [D:\ZUIXINQQQQ\COMMERCESMNG.DLL]  <(><1, 0, 0, 1>
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSHOOK.DLL]  <北京三七二一科技有限公司><1, 0, 2, 5>
    [D:\ZUIXINQQQQ\GROUPCONNECTION.DLL]  <Tencent><0, 3, 3, 5>
    [D:\ZUIXINQQQQ\BQQAPPLICATION.DLL]  <N/A><N/A>
    [D:\ZUIXINQQQQ\IMAGEOLE.DLL]  <TODO: <Company name>><1.0.0.1>
    [D:\ZUIXINQQQQ\QQPET.DLL]  < ><1, 0, 0, 1>
    [C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH8B.OCX]  <Macromedia, Inc.><8,0,24,0>
    [D:\ZUIXINQQQQ\QQAVATAR.DLL]  <N/A><N/A>
    [D:\ZUIXINQQQQ\FLASHAVATARDLL.DLL]  <(><1, 4, 0, 1>
    [D:\ZUIXINQQQQ\LONGCONNECTION.DLL]  <tencent><0, 3, 3, 8>
    [D:\ZUIXINQQQQ\QQPLUGIN.DLL]  <N/A><N/A>
    [D:\ZUIXINQQQQ\QQSETTINGCTRL.DLL]  <(><1, 0, 0, 1>
    [D:\ZUIXINQQQQ\QQCUSTOMFACE.DLL]  <N/A><N/A>
    [D:\ZUIXINQQQQ\QQALLINONE.DLL]  <N/A><N/A>
    [D:\ZUIXINQQQQ\SCCORE.DLL]  <N/A><N/A>
    [D:\ZUIXINQQQQ\CAMERADLL.DLL]  <$><1, 0, 0, 1>
    [D:\ZUIXINQQQQ\QQGROUPMNG.DLL]  <$><1, 0, 0, 1>
    [D:\ZUIXINQQQQ\DIALERALLINONE.DLL]  <tencent><1, 4, 0, 0>
    [D:\ZUIXINQQQQ\PHONEAPI.DLL]  <$><1, 0, 0, 1>
    [D:\ZUIXINQQQQ\QRINGMNG.DLL]  <N/A><N/A>
    [D:\ZUIXINQQQQ\PERSONALDESKTOP.DLL]  <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2>
    [D:\ZUIXINQQQQ\USERDEFINEDHEAD.DLL]  <(><1, 0, 0, 1>
    [D:\ZUIXINQQQQ\QQCONFIGPLUGIN.DLL]  <(><1, 0, 0, 1>
    [D:\ZUIXINQQQQ\QQSPACE.DLL]  < ><1, 0, 0, 1>
    [D:\ZUIXINQQQQ\MAILSUMMARY.DLL]  <$><1, 0, 0, 1>
    [D:\ZUIXINQQQQ\HOSTINGMGR.DLL]  <$><1, 0, 0, 1>
    [D:\ZUIXINQQQQ\NEWSKIN.DLL]  <$><1, 0, 0, 1>
    [D:\ZUIXINQQQQ\CQQAPPLICATION.DLL]  <N/A><N/A>
    [D:\ZUIXINQQQQ\QQMAINFRAME.DLL]  <N/A><N/A>
    [D:\ZUIXINQQQQ\QQRES.DLL]  <tencent><1, 0, 0, 1>
    [C:\WINDOWS\SYSTEM\SYSTEMLR.DLL]  <N/A><N/A>
    [D:\ZUIXINQQQQ\NPKCNTC.DLL]  <INCA Internet Co., Ltd.><2005, 9, 1, 1>
    [D:\ZUIXINQQQQ\NPKPDB.DLL]  <INCA Internet Co., Ltd.><2003, 10, 1, 1>
    [D:\ZUIXINQQQQ\LOGINCTRL.DLL]  <$><1, 0, 0, 1>
    [D:\ZUIXINQQQQ\TIMPROXY.DLL]  <tencent><0, 3, 2, 4>
    [D:\ZUIXINQQQQ\QQAPI.DLL]  <(><1, 0, 0, 1>
    [D:\金山体验\KASOCKET.DLL]  <Kingsoft Corporation><2005, 2, 22, 233>
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMIN.DLL]  <北京三七二一科技有限公司><1, 5, 3, 1>
[PID: 4222164513][D:\ZUIXINQQQQ\QQ.EXE]  <TENCENT><14, 45, 0, 110>
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  <N/A><N/A>
    [D:\ZUIXINQQQQ\QQBASECLASSINDLL.DLL]  <,><1, 0, 0, 1>
    [D:\ZUIXINQQQQ\QQHELPERDLL.DLL]  <$><1, 0, 0, 1>
    [D:\ZUIXINQQQQ\BASICCTRLDLL.DLL]  <Tencent><0, 3, 3, 6>
    [C:\WINDOWS\SYSTEM\DCIMAN32.DLL]  <Intel(R) Corp., Microsoft Corp.><4.03.1998>
    [D:\ZUIXINQQQQ\TIMPROXY.DLL]  <tencent><0, 3, 2, 4>
    [D:\金山体验\KASOCKET.DLL]  <Kingsoft Corporation><2005, 2, 22, 233>
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMIN.DLL]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  <N/A><N/A>
[PID: 3971670361][D:\ZUIXINQQQQ\TIMPLATFORM.EXE]  <tencent><0, 3, 1, 8>
    [C:\WINDOWS\SYSTEM\SYSTEMLR.DLL]  <N/A><N/A>
    [D:\金山体验\KASOCKET.DLL]  <Kingsoft Corporation><2005, 2, 22, 233>
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMIN.DLL]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  <N/A><N/A>
[PID: 4184708313][E:\智能扫描\SRENG.EXE]  <Smallfrogs Studio><2.0.12.350>

==================================
文件关联
.TXT  Error. [NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  Error. [hh.exe %1]
.HLP  Error. [winhlp32.exe %1]
.INI  Error. [NOTEPAD.EXE %1]
.INF  Error. [NOTEPAD.EXE %1]
.VBS  Error. [WScript.exe "%1" %*]
.JS  Error. [WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
阿杜QQ - 2006-5-19 21:21:00
有个重要问题,你电脑自己重启吗
才不要被你毒 - 2006-5-19 21:22:00
扫描后的 文本太大 我分三个部分 贴出来了..

帮我诊断一下啊....谢谢了.... 好急人啊.
baohe - 2006-5-19 21:38:00
19楼的:
你要的SREng日志,楼主已经贴出来了。请给楼主解决方案。
不要问他的电脑是否自动重启。
他的杀软都不灵了!
阿杜QQ - 2006-5-19 21:46:00
http://www.jxust.com/bbs/job.php?action=download&pid=25422&tid=3128&aid=3945
先下载专杀试试,不行按下面操作进行
阿杜QQ - 2006-5-19 21:46:00
1........[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<CnsMin><Rundll32.exe C:\WINDOWS\DOWNLO~1\CNSMIN.DLL,Rundll32>  删除启动项目
2........[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<NTdhcp><C:\WINDOWS\SYSTEM\NTdhcp.exe>  qq大盗 变态木马
运行REGEDIT注册表编辑器,定位到[HKEY_LOCALMACHINE\Software\Microsoft\Windows\CurrentVersion\Run],将RUN下面的键值“NTdhcp” = %SystemDir%\NTdhcp.exe删除。

手工清除办法:

首先运行任务管理器,查找并结束掉NTdhcp.exe进程

按照病毒文件所在位置System\NTdhcp.exe找到系统目录下的病毒文件,手工删除,。运行REGEDIT注册表编辑器,定位到[HKEY_LOCALMACHINE\Software\Microsoft\Windows\CurrentVersion\Run],将RUN下面的键值“NTdhcp” = %SystemDir%\NTdhcp.exe删除。

3........[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<ToP><C:\WINDOWS\LSASS.exe>
手工删除:
一、 结束病毒进程
鼠标右键点击“任务栏”,选择“任务管理器”。点击菜单“查看”->“选择列”,在弹出的对话框中选择“PID(进程标识符)”,并点击“确定”。

找到映象名称为“LSASS.exe”,并且用户名不是“SYSTEM”的一项,记住其PID号。

点击“开始”-》“运行”,输入“CMD”,点击“确定”打开命令行控制台。输入“ntsd –c q -p (PID)”,比如我的计算机上就输入“ntsd –c q -p 1464”。

二、 删除病毒文件
打开“我的电脑”,设置显示所有的隐藏文件、系统文件并显示文件扩展名。删除如下几个文件:
C:\Program Files\Common Files\INTEXPLORE.pif、
C:\Program Files\Internet Explorer\INTEXPLORE.com、
C:\WINDOWS\EXERT.exe、
C:\WINDOWS\IO.SYS.BAK、
C:\WINDOWS\LSASS.exe、
C:\WINDOWS\Debug\DebugProgram.exe、
C:\WINDOWS\system32\dxdiag.com、
C:\WINDOWS\system32\MSCONFIG.COM、
C:\WINDOWS\system32\regedit.com

如果硬盘有其他分区,则在其他分区上点击鼠标右键,选择“打开”。删除掉该分区根目录下的“Autorun.inf”和“command.com”文件。



三、删除注册表中的其他垃圾信息
这个病毒该写的注册表位置相当多,如果不进行修复将会有一些系统功能发生异常。

将Windows目录下的“regedit.exe”改名为“regedit.com”并运行,删除以下项目:
HKEY_CLASSES_ROOT\WindowFiles、
HKEY_CURRENT_USER\Software\VB and VBA Program Settings、
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main下面的 Check_Associations项、
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\INTEXPLORE.pif、
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run下面的ToP项。

将HKEY_CLASSES_ROOT\.exe的默认值修改为“exefile”
将HKEY_CLASSES_ROOT\Applications\iexplore.exe\shell\open\command的默认值修改为“"C:\Program Files\Internet Explorer\iexplore.exe" %1”
将HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command的默认值修改为“C:\Program Files\Internet Explorer\IEXPLORE.EXE”
将HKEY_CLASSES_ROOT\ftp\shell\open\command和HKEY_CLASSES_ROOT\htmlfile\shell\opennew\command的默认值修改为“"C:\Program Files\Internet Explorer\iexplore.exe" %1”
将HKEY_CLASSES_ROOT\htmlfile\shell\open\command和HKEY_CLASSES_ROOT\HTTP\shell\open\command的默认值修改为“"C:\Program Files\Internet Explorer\iexplore.exe" –nohome”
将HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet的默认值修改为“IEXPLORE.EXE”。

重新将Windows目录下的regedit扩展名改回exe,至此病毒清除成功,注册表修复完毕。
因为上传不了~所以就给那个专杀工具的地址:http://www.jxust.com/bbs/job.php?action=download&pid=25422&tid=3128&aid=3945

打开SRE  找到系统修复,修复所有关联,电脑还有别的问题,把上面解决在解决别的问题吧
阿杜QQ - 2006-5-20 0:12:00
有问题直接M我
1
查看完整版本: 救救我呀.....寻找高手.....我的日志好可怕!!! 我该怎么办呀????