再次求助4533.cn的劫持【求助】 bbs.ikaka.com

想飞的公主 - 2006-6-5 10:39:00

上次问题还没有得到解决，但是求助的贴子不能显示了，只好再扫描了一遍。

2006-06-05,10:27:08

System Repair Engineer 2.0.12.350 (2.0 RC 1)
Windows XP Professional Service Pack 2 - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\windows\system32\ctfmon.exe>
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<KpopMon><; C:\KAV6\KPopMon.EXE>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<run><>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<KAVRun><C:\KAV6\KAVRun.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<HP Software Update><; D:\Program Files\HP Software Update\HPWuSchd2.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<stup.exe><C:\PROGRA~1\TENCENT\Adplus\stup.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<NvCplDaemon><; RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IESAddr><; Null>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMSCMig><; C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<KernelFaultCheck><; %systemroot%\system32\dumprep 0 -k>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Kulansyn><; C:\KAV6\Kulansyn.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<NvMediaCenter><; RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<nwiz><; nwiz.exe /install>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<SoundMan><; SOUNDMAN.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Thunder><; "D:\DownLoads\迅雷\ThunderShell.exe" /s>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<Userinit><C:\windows\system32\userinit.exe,>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><>

想飞的公主 - 2006-6-5 10:32:00

==================================
启动文件夹
[HP Digital Imaging Monitor]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\HP Digital Imaging Monitor.lnk><N>
[HP Image Zone 快速启动 ]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\HP Image Zone 快速启动 .lnk><N>

==================================
服务
[Kingsoft AntiVirus Service / KAVSvc]
<C:\KAV6\KAVSvc.EXE><kingsoft Antivirus>
[NVIDIA Display Driver Service / NVSvc]
<C:\windows\system32\nvsvc32.exe><NVIDIA Corporation>
[Pml Driver HPZ12 / Pml Driver HPZ12]
<C:\WINDOWS\system32\HPZipm12.exe><HP>

==================================
浏览器加载项
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <D:\QQ\QQ2005\qq\QQ.EXE, TENCENT>
[FlashGet]
{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\flashget.exe, Amaze Soft>
[金山毒霸网站]
{e1fc9760-7b95-49cd-80b9-8c9e41017b93} <url:http://www.duba.net, N/A>
[在线查毒]
{f58d36c3-40be-4418-a786-d8fbe3eb3554} <C:\KAV6\kavie.htm, N/A>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[金山毒霸]
{A9BE2902-C447-420A-BB7F-A5DE921E6138} <C:\KAV6\KAIEPlus.DLL, >
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\windows\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[DigitalTrafic Control]
{7FC22A16-79E6-4787-9C96-B6359BB1106D} <C:\WINDOWS\DOWNLO~1\DIGITA~1.OCX, Broad-way>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[金山毒霸]
{A9BE2902-C447-420A-BB7F-A5DE921E6138} <C:\KAV6\KAIEPlus.DLL, >
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\windows\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[]
{E1FC9760-7B95-49CD-80B9-8C9E41017B93} <C:\KAV6\KAVEXT.DLL, Kingsoft Corp.>
[&使用迅雷下载]
<D:\DownLoads\迅雷\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
<D:\DownLoads\迅雷\Program\GetAllUrl.htm, N/A>
[添加到QQ表情]
<D:\QQ\QQ2005\qq\AddEmotion.htm, N/A>

想飞的公主 - 2006-6-5 10:34:00

==================================
正在运行的进程
[PID: 436][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 484][\??\C:\windows\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 508][\??\C:\windows\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 552][C:\windows\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 564][C:\windows\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 716][C:\windows\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 760][C:\windows\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 824][C:\windows\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 936][C:\windows\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 976][C:\windows\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1168][C:\windows\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\windows\system32\HpTcpMon.dll] <Hewlett Packard><5.01.00.011>
[C:\windows\system32\hpzjrd01.dll] <Hewlett Packard><2.01.00.001>
[C:\windows\system32\HPTcpMUI.dll] <Microsoft Corporation><5.01.00.011>
[C:\windows\system32\hptcpmib.dll] <Hewlett Packard><5.01.00.011>
[C:\windows\system32\hpzsnt12.dll] <HP><14.00.00.41711>
[C:\windows\System32\spool\PRTPROCS\W32X86\vprproc.dll] <Windows (R) 2000 DDK provider><5.00.2195.1620>
[PID: 1444][C:\windows\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\TENCENT\Adplus\Adplus.dll] <Tencent><4, 0, 6, 61>
[C:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[C:\WINDOWS\system32\nvcpl.dll] <NVIDIA Corporation><6.14.10.8194>
[C:\windows\system32\NVRSZHC.DLL] <NVIDIA Corporation><6.14.10.8194>
[C:\WINDOWS\system32\nvshell.dll] <N/A><N/A>
[PID: 1496][C:\KAV6\KAVSvc.EXE] <kingsoft Antivirus><2003, 11, 12, 70>
[C:\KAV6\SvcComm.dll] <kingsoft Antivirus><2004, 7, 28, 1>
[C:\KAV6\SvcTimer.DLL] <Kingsoft><2004.4.29.79>
[C:\KAV6\KavComm.dll] <Kingsoft Corporation><2003, 11, 12, 66>
[C:\KAV6\RpcBrge.DLL] <kingsoft><2003, 11, 12, 64>
[C:\KAV6\KWatchFn2.dll] <kingsoft Corporation><2004, 8, 24, 25>
[C:\KAV6\KAEPlat.DLL] <Kingsoft Corp.><2004, 11, 26, 53>
[C:\KAV6\KAEMem.DAT] <Kingsoft><2004, 11, 9, 11>
[C:\KAV6\KAVUtils.dll] <Kingsoft Corp><2004, 2, 12, 69>
[C:\KAV6\KAVDlg.DLL] <><2004.7.20.81>
[C:\KAV6\KAVLogFn.dll] <N/A><2003, 11, 26, 16>

想飞的公主 - 2006-6-5 10:34:00

[PID: 1512][C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE] <Microsoft Corporation><7.00.9466>
[PID: 1544][C:\windows\system32\nvsvc32.exe] <NVIDIA Corporation><6.14.10.8194>
[PID: 1616][C:\windows\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1664][C:\WINDOWS\system32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: dnsrv(bld4act)>
[PID: 1868][C:\KAV6\KWatchUI.EXE] <><2004.1.6.119>
[C:\KAV6\kavcomm.dll] <Kingsoft Corporation><2003, 11, 12, 66>
[C:\KAV6\kavdlg.dll] <><2004.7.20.81>
[C:\Program Files\TENCENT\Adplus\Adplus.dll] <Tencent><4, 0, 6, 61>
[C:\KAV6\KAVMLM.DLL] <Kingsoft Corporation><2003.11.12.10>
[C:\KAV6\RpcBrge.DLL] <kingsoft><2003, 11, 12, 64>
[C:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 1884][C:\Program Files\Internet Explorer\Mui\winlog.exe] < ><1.02.2750>
[C:\Program Files\TENCENT\Adplus\Adplus.dll] <Tencent><4, 0, 6, 61>
[C:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 1900][C:\windows\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\TENCENT\Adplus\Adplus.dll] <Tencent><4, 0, 6, 61>
[C:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 1980][D:\Program Files\Digital Imaging\bin\hpqtra08.exe] <Hewlett-Packard Co.><53.0.13.000>
[C:\Program Files\TENCENT\Adplus\Adplus.dll] <Tencent><4, 0, 6, 61>
[D:\Program Files\Digital Imaging\bin\hpqcxm08.dll] <Hewlett-Packard Co.><53.0.13.000>
[D:\Program Files\Digital Imaging\bin\hpquio08.dll] <Hewlett-Packard Co.><53.0.13.000>
[D:\Program Files\Digital Imaging\bin\hpqtra08.rsc] <Hewlett-Packard Co.><53.0.13.000>
[D:\Program Files\Digital Imaging\bin\hpqtao08.dll] <Hewlett-Packard Co.><53.0.13.000>
[D:\Program Files\Digital Imaging\bin\hpqrif08.dll] <Hewlett-Packard Co.><53.0.13.000>
[D:\Program Files\Digital Imaging\bin\hpotra08.dll] <Hewlett-Packard Co.><50.0.206.000>
[D:\Program Files\Digital Imaging\bin\hpotra08.rsc] <Hewlett-Packard Co.><50.0.206.000>
[C:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[D:\Program Files\Digital Imaging\bin\hpodio08.dll] <Hewlett-Packard Co.><53.0.13.000>
[D:\Program Files\Digital Imaging\bin\hpqcob08.dll] <Hewlett-Packard Co.><53.0.13.000>
[D:\Program Files\Digital Imaging\bin\hpotradd.dll] <Hewlett-Packard Co.><53.0.13.000>
[D:\Program Files\Digital Imaging\bin\hpodvd09.dll] <Hewlett-Packard Co.><53.0.13.000>
[D:\Program Files\Digital Imaging\bin\hpoddcomm09.dll] <Hewlett-Packard Co.><53.0.13.000>
[C:\windows\system32\hpzidr12.dll] <HP><9, 0, 0, 0>
[C:\windows\system32\hpzipr12.dll] <HP><9, 0, 0, 0>
[PID: 2020][C:\KAV6\MailMon.EXE] <Kingsoft Co., Ltd><2004, 2, 6, 245>
[C:\KAV6\KMFilter.DLL] <><2004, 3, 1, 37>
[C:\KAV6\parse822.dll] <Quiksoft Corporation><2, 0, 0, 9>
[C:\KAV6\KAVLogFn.dll] <N/A><2003, 11, 26, 16>
[C:\KAV6\KAVMLM.DLL] <Kingsoft Corporation><2003.11.12.10>
[C:\KAV6\KAMsgBox.DLL] <><2002.9.27.30>
[C:\Program Files\TENCENT\Adplus\Adplus.dll] <Tencent><4, 0, 6, 61>
[C:\KAV6\KAVComm.dll] <Kingsoft Corporation><2003, 11, 12, 66>
[C:\KAV6\RpcBrge.DLL] <kingsoft><2003, 11, 12, 64>
[C:\KAV6\KAVIPC.DLL] <Kingsoft Corp.><2002, 3, 29, 8>
[C:\KAV6\KAVDlg.DLL] <><2004.7.20.81>
[C:\KAV6\KAECall.DLL] <Kingsoft Corporation><2003, 11, 14, 66>
[C:\KAV6\KAEScan.DLL] <Kingsoft Corp.><2003, 5, 24, 36>
[C:\KAV6\KAEPlat.DLL] <Kingsoft Corp.><2004, 11, 26, 53>
[C:\KAV6\KAEMem.DAT] <Kingsoft><2004, 11, 9, 11>
[C:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 188][D:\Program Files\Digital Imaging\bin\hpqimzone.exe] <Hewlett-Packard Co.><053.000.013.000>
[c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_7b44bf62\mscorlib.dll] <N/A><N/A>
[C:\Program Files\TENCENT\Adplus\Adplus.dll] <Tencent><4, 0, 6, 61>
[c:\windows\assembly\gac\hpqiface\4.0.0.0__a53cf5803f4c3827\hpqiface.dll] <Hewlett-Packard Co.><053.000.013.000>
[c:\windows\assembly\nativeimages1_v1.1.4322\system.windows.forms\1.0.5000.0__b77a5c561934e089_3770f62d\system.windows.forms.dll] <N/A><N/A>
[c:\windows\assembly\nativeimages1_v1.1.4322\system.drawing\1.0.5000.0__b03f5f7f11d50a3a_8e2493c6\system.drawing.dll] <N/A><N/A>
[c:\windows\assembly\nativeimages1_v1.1.4322\system\1.0.5000.0__b77a5c561934e089_888d61da\system.dll] <N/A><N/A>
[c:\windows\assembly\gac\hpqcc2\3.0.0.0__a53cf5803f4c3827\hpqcc2.dll] <Hewlett-Packard Co.><053.000.013.000>
[c:\windows\assembly\gac\hpqutils\4.0.0.0__a53cf5803f4c3827\hpqutils.dll] <Hewlett-Packard Co.><053.000.013.000>
[c:\windows\assembly\gac\hpqfmrsc\4.0.0.0__a53cf5803f4c3827\hpqfmrsc.dll] <Hewlett-Packard Co.><053.000.013.000>
[c:\windows\assembly\gac\hpqtray\4.0.0.0__a53cf5803f4c3827\hpqtray.dll] <Hewlett-Packard Co.><053.000.013.000>
[c:\windows\assembly\gac\hpqovskn\3.0.0.0__a53cf5803f4c3827\hpqovskn.dll] <Hewlett-Packard Co.><053.000.013.000>
[c:\windows\assembly\gac\hpqimvlt\3.0.0.0__a53cf5803f4c3827\hpqimvlt.dll] <Hewlett-Packard Co.><053.000.013.000>
[c:\windows\assembly\gac\hpqimgrc\4.0.0.0__a53cf5803f4c3827\hpqimgrc.dll] <Hewlett-Packard Co.><053.000.013.000>
[d:\program files\digital imaging\bin\zh-chs\hpqimzone.resources.dll] < ><50.0.120.0>
[C:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[c:\windows\assembly\gac\hpqntrop\4.0.0.0__a53cf5803f4c3827\hpqntrop.dll] <Hewlett-Packard Co.><053.000.013.000>
[c:\windows\assembly\gac\interop.hpqcxm08\3.0.0.0__a53cf5803f4c3827\interop.hpqcxm08.dll] <Hewlett-Packard Co.><53.0.13.000>
[D:\Program Files\Digital Imaging\bin\hpqcxm08.dll] <Hewlett-Packard Co.><53.0.13.000>
[c:\windows\assembly\nativeimages1_v1.1.4322\system.xml\1.0.5000.0__b77a5c561934e089_7e871ea9\system.xml.dll] <N/A><N/A>
[c:\windows\assembly\gac\lead\13.0.0.113__9cf889f53ea9b907\lead.dll] <LEAD Technologies, Inc.><13.0.0.113>
[c:\windows\assembly\gac\lead.wrapper\13.0.0.113__9cf889f53ea9b907\lead.wrapper.dll] <LEAD Technologies, Inc.><13.0.0.113>
[D:\Program Files\Digital Imaging\bin\ltkrn13n.dll] <LEAD Technologies, Inc.><13.0.0.098>
[c:\windows\assembly\gac\hpqtray.resources\4.0.0.0_zh-chs_a53cf5803f4c3827\hpqtray.resources.dll] < ><50.0.120.0>
[c:\windows\assembly\gac\hpqfmrsc.resources\4.0.0.0_zh-chs_a53cf5803f4c3827\hpqfmrsc.resources.dll] < ><50.0.120.0>
[c:\windows\assembly\gac\lead.windows.forms\13.0.0.113__9cf889f53ea9b907\lead.windows.forms.dll] <LEAD Technologies, Inc.><13.0.0.113>
[c:\windows\assembly\gac\lead.drawing\13.0.0.113__9cf889f53ea9b907\lead.drawing.dll] <LEAD Technologies, Inc.><13.0.0.113>
[c:\windows\assembly\gac\interop.hpqimgr\3.0.0.0__a53cf5803f4c3827\interop.hpqimgr.dll] <Hewlett-Packard Co.><53.0.13.000>
[D:\Program Files\Digital Imaging\Bin\hpqimgr.dll] <Hewlett-Packard Co.><53.0.13.000>
[c:\windows\assembly\gac\hpqasset\4.0.0.0__a53cf5803f4c3827\hpqasset.dll] <Hewlett-Packard Co.><053.000.013.000>
[d:\program files\digital imaging\bin\hpqmirsc.dll] <Hewlett-Packard Co.><053.000.013.000>
[d:\program files\digital imaging\bin\zh-chs\hpqmirsc.resources.dll] < ><50.0.120.0>
[c:\windows\assembly\gac\hpqedit\3.0.0.0__a53cf5803f4c3827\hpqedit.dll] <Hewlett-Packard Co.><053.000.013.000>
[c:\windows\assembly\gac\hpqvideo\3.0.0.0__a53cf5803f4c3827\hpqvideo.dll] <Hewlett-Packard Co.><053.000.013.000>
[c:\windows\assembly\gac\lead.windows.forms.drawingcontainer\13.0.0.113__9cf889f53ea9b907\lead.windows.forms.drawingcontainer.dll] <LEAD Technologies, Inc.><13.0.0.113>
[c:\windows\assembly\gac\hpqmdmr\4.0.0.0__a53cf5803f4c3827\hpqmdmr.dll] <Hewlett-Packard Co.><053.000.013.000>
[c:\windows\assembly\gac\lead.drawing.imaging.imageprocessing\13.0.0.113__9cf889f53ea9b907\lead.drawing.imaging.imageprocessing.dll] <LEAD Technologies, Inc.><13.0.0.113>
[c:\windows\assembly\gac\hpqimlib\3.0.0.0__a53cf5803f4c3827\hpqimlib.dll] <Hewlett-Packard Co.><053.000.013.000>
[c:\windows\assembly\gac\hpqedit.resources\3.0.0.0_zh-chs_a53cf5803f4c3827\hpqedit.resources.dll] < ><50.0.131.0>
[c:\windows\assembly\gac\hpqglutl\4.0.0.0__a53cf5803f4c3827\hpqglutl.dll] <Hewlett-Packard Co.><053.000.013.000>
[c:\windows\assembly\gac\hpqcc2.resources\3.0.0.0_zh-chs_a53cf5803f4c3827\hpqcc2.resources.dll] < ><50.0.120.0>
[d:\program files\digital imaging\bin\zh-chs\hpqvideo.resources.dll] < ><50.0.127.0>
[c:\windows\assembly\gac\interop.hpqvideo\3.0.0.0__a53cf5803f4c3827\interop.hpqvideo.dll] <Hewlett-Packard Co.><53.0.13.000>
[D:\Program Files\Digital Imaging\bin\hpqvdcom.dll] <Hewlett-Packard Co.><53.0.13.000>
[c:\windows\assembly\gac\hpqprrsc\4.0.0.0__a53cf5803f4c3827\hpqprrsc.dll] <Hewlett-Packard Co.><053.000.013.000>
[c:\windows\assembly\gac\hpqprrsc.resources\4.0.0.0_zh-chs_a53cf5803f4c3827\hpqprrsc.resources.dll] < ><53.0.6.0>
[c:\windows\assembly\gac\interop.hprblog\3.0.0.0__a53cf5803f4c3827\interop.hprblog.dll] < ><3.0.0.0>
[c:\windows\assembly\gac\hpqcprsc\3.0.0.0__a53cf5803f4c3827\hpqcprsc.dll] <Hewlett-Packard Co.><053.000.013.000>
[c:\windows\assembly\gac\hpqcprsc.resources\3.0.0.0_zh-chs_a53cf5803f4c3827\hpqcprsc.resources.dll] <Hewlett-Packard Co.><50.0.145.0>
[c:\windows\assembly\gac\hpqisrtb\4.0.0.0__a53cf5803f4c3827\hpqisrtb.dll] <Hewlett-Packard Co.><053.000.013.000>
[c:\windows\assembly\gac\hpqisrtb.resources\4.0.0.0_zh-chs_a53cf5803f4c3827\hpqisrtb.resources.dll] <Hewlett-Packard Co.><53.0.13.0>
[c:\windows\assembly\gac\hpqbakup\3.0.0.0__a53cf5803f4c3827\hpqbakup.dll] <Hewlett-Packard Co.><053.000.013.000>
[c:\windows\assembly\gac\hpqbakup.resources\3.0.0.0_zh-chs_a53cf5803f4c3827\hpqbakup.resources.dll] < ><50.0.154.0>
[c:\windows\assembly\gac\hpqthumb\3.0.0.0__a53cf5803f4c3827\hpqthumb.dll] <Hewlett-Packard Co.><053.000.013.000>

想飞的公主 - 2006-6-5 10:35:00

[PID: 232][C:\KAV6\KAVPlus.EXE] <><2004, 3, 3, 71>
[C:\Program Files\TENCENT\Adplus\Adplus.dll] <Tencent><4, 0, 6, 61>
[C:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 1240][D:\Program Files\Digital Imaging\bin\hpqSTE08.exe] <Hewlett-Packard Co.><53.0.13.000>
[D:\Program Files\Digital Imaging\bin\hpqmfc09.dll] <Hewlett-Packard Co.><53.0.13.000>
[D:\Program Files\Digital Imaging\bin\hpqtap08.dll] <Hewlett-Packard Co.><53.0.13.000>
[C:\Program Files\TENCENT\Adplus\Adplus.dll] <Tencent><4, 0, 6, 61>
[C:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[D:\Program Files\Digital Imaging\bin\hpqcxm08.dll] <Hewlett-Packard Co.><53.0.13.000>
[D:\Program Files\Digital Imaging\bin\hpqSTE08.rsc] <Hewlett-Packard Co.><53.0.13.000>
[C:\KAV6\KAVEXT.DLL] <Kingsoft Corp.><2002, 5, 24, 6>
[D:\Program Files\Digital Imaging\bin\hpqsti08.dll] <Hewlett-Packard Co.><53.0.13.000>
[D:\Program Files\Digital Imaging\bin\hpqcob08.dll] <Hewlett-Packard Co.><53.0.13.000>
[D:\Program Files\Digital Imaging\bin\hpqstp08.dll] <Hewlett-Packard Co.><53.0.13.000>
[D:\Program Files\Digital Imaging\bin\hpodio08.dll] <Hewlett-Packard Co.><53.0.13.000>
[D:\Program Files\Digital Imaging\bin\hpocxi08.dll] <Hewlett-Packard Co.><53.0.13.000>
[C:\windows\system32\hpzipr12.dll] <HP><9, 0, 0, 0>
[C:\windows\system32\hpzidr12.dll] <HP><9, 0, 0, 0>
[D:\Program Files\Digital Imaging\bin\hpqsem08.rsc] <Hewlett-Packard Co.><53.0.13.000>
[PID: 1272][C:\windows\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 2212][D:\Program Files\Digital Imaging\Product Assistant\bin\hprblog.exe] <Hewlett-Packard Co.><53.0.13.000>
[D:\Program Files\Digital Imaging\Product Assistant\bin\hprbutil.dll] <Hewlett-Packard Co.><53.0.13.000>
[C:\Program Files\TENCENT\Adplus\Adplus.dll] <Tencent><4, 0, 6, 61>
[C:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 2388][C:\windows\system32\wuauclt.exe] <Microsoft Corporation><5.4.3790.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 3260][D:\DownLoads\木马专杀\卡卡助手\SREng.exe] <Smallfrogs Studio><2.0.12.350>
[C:\Program Files\TENCENT\Adplus\Adplus.dll] <Tencent><4, 0, 6, 61>
[C:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

colt00 - 2006-6-5 12:24:00

跟你的帖子，偶的也被劫持了，贴上来请高手看看。
2006-06-04,18:04:17

System Repair Engineer 2.0.12.350 (2.0 RC 1)
Windows XP Professional Service Pack 2 - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<H/PC Connection Agent><"C:\PROGRA~1\MICROS~1\wcescomm.exe">
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><; C:\WINDOWS\system32\ctfmon.exe>
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<winccs><C:\Program Files\Internet Explorer\Mui\winlog.exe>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<SynTPLpr><C:\Program Files\Synaptics\SynTP\SynTPLpr.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<SynTPEnh><C:\Program Files\Synaptics\SynTP\SynTPEnh.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Hcontrol><C:\WINDOWS\ATK0100\Hcontrol.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<ShStatEXE><"D:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<McAfeeUpdaterUI><"D:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Network Associates Error Reporting Service><"C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe">
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<SoundMan><; SOUNDMAN.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<thunder_mini><C:\Program Files\Thunder Network\ThunderMini\ThunderMini.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<winccs><C:\Program Files\Internet Explorer\Mui\winlog.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<Userinit><userinit.exe,>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><>

==================================
启动文件夹
[McAfee Desktop Firewall 任务栏]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\McAfee Desktop Firewall 任务栏.lnk><N>

==================================
服务
[McAfee Desktop Firewall Service / FireSvc]
<d:\PROGRA~1\NETWOR~1\MCAFEE~1\FireSvc.exe><Networks Associates Technology, Inc.>
[McAfee Framework 服务 / McAfeeFramework]
<D:\Program Files\Network Associates\Common Framework\FrameworkService.exe /ServiceStart><Network Associates, Inc.>
[Network Associates McShield / McShield]
<"D:\Program Files\Network Associates\VirusScan\Mcshield.exe"><Network Associates, Inc.>
[Network Associates Task Manager / McTaskManager]
<"D:\Program Files\Network Associates\VirusScan\VsTskMgr.exe"><Network Associates, Inc.>

==================================

colt00 - 2006-6-5 12:24:00

浏览器加载项
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v14.dll, Thunder Networking Technologies,LTD>
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[Create Mobile Favorite]
{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} <C:\PROGRA~1\MICROS~1\INetRepl.dll, Microsoft Corporation>
[Create Mobile Favorite]
{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} <C:\PROGRA~1\MICROS~1\INetRepl.dll, Microsoft Corporation>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[BitCometBar]
{3F1ABCDB-A875-46c1-8345-B72A4567E486} <d:\Program Files\BitComet\BitCometBar\BitCometBar0.3.dll, N/A>
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v14.dll, Thunder Networking Technologies,LTD>
[HelperObject Class]
{00C6482D-C502-44C8-8409-FCE54AD9C208} <D:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll, TechSmith Corporation>
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[MonitorURL Class]
{08A312BB-5409-49FC-9347-54BB7D069AC6} <, N/A>
[BitCometBar]
{3F1ABCDB-A875-46C1-8345-B72A4567E486} <d:\Program Files\BitComet\BitCometBar\BitCometBar0.3.dll, N/A>
[Adobe PDF]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} <D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll, Adobe Systems Incorporated>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[SnagIt]
{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} <D:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll, TechSmith Corporation>
[NewWebController Class]
{9ACEEE30-143F-471A-AA45-72B061FE7D60} <, N/A>
[AcroIEToolbarHelper Class]
{AE7CD045-E861-484F-8273-0445EE161910} <D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll, Adobe Systems Incorporated>
[卡卡上网安全助手]
{AFF6E516-CBE5-4F8A-9C2F-38A68013E766} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\flash.ocx, Macromedia, Inc.>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[&使用迷你迅雷下载]
<C:\Program Files\Thunder Network\ThunderMini\geturl.htm, N/A>
[使用迅雷下载]
<d:\Program Files\Thunder Network\Thunder\geturl.htm, N/A>
[使用迅雷下载全部链接]
<d:\Program Files\Thunder Network\Thunder\getallurl.htm, N/A>

==================================
正在运行的进程
[PID: 156][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 216][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 240][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 284][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 296][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 428][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 488][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 544][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 752][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[D:\Program Files\Network Associates\VirusScan\shext.dll] <Network Associates, Inc.><8.0.0.912>
[D:\Program Files\Network Associates\VirusScan\RES04\ShExtRes.dll] <Network Associates, Inc.><8.0.0.912>
[D:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll] <Adobe Systems, Inc.><7.0.0.0>
[D:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.CHS] <Adobe Systems, Inc.><7.0.0.0>
[PID: 988][D:\DOWNLOAD\系统清理\sreng2\SREng.exe] <Smallfrogs Studio><2.0.12.350>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

colt00 - 2006-6-5 12:26:00

以上是我在安全模式下扫描的结果。而且启动项扫描中还发现UserInit.exe被改为非正常值。请高手帮忙。

想飞的公主 - 2006-6-5 12:38:00

哇靠，楼上的，虽然是同病相怜，还是请你再开一张贴好吧？这样子很混乱哎。

我无邪 - 2006-6-5 13:35:00

【回复“想飞的公主”的帖子】
并未看出问题来，你能描述一下吗
进入控制面版的添加删除程序中卸载，搜搜地址栏搜索(QQ搜索小助手
删除
C:\PROGRA~1\TENCENT\Adplus

我无邪 - 2006-6-5 13:38:00

【回复“colt00”的帖子】
运行System Repair Engineer，使用“启动项目，注册表”来删除以下选项。
（如果在注册表里无法识别那一下，可以选中一项后，点“编辑”这样会有很明细的路径）
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<winccs><C:\Program Files\Internet Explorer\Mui\winlog.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<winccs><C:\Program Files\Internet Explorer\Mui\winlog.exe>
双击我的电脑--工具---文件夹选项--查看--单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示您确定更改时，单击“是”
删除
C:\Program Files\Internet Explorer\Mui

想飞的公主 - 2006-6-5 13:45:00

C:\PROGRA~1\TENCENT\Adplus这个文件删除不掉，还有，添加删除程序当中并没有搜搜地址栏搜索这个东东。
具体情况还是和开始的时候一样：
浏览器主页设置被禁止，用卡卡助手和超级兔子都修复过了，没有用。
后来就修改注册表，可是每次修改完不到2分钟又被改回去了。注册表里面HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\Run主键下无registry.exe子键，那个HKEY_CLASSES_ROOT\PROTOCOLS\Handler\about，检查其下的CLASS 键无可疑的网址，将HKEY_CLASHKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel” 其中键值名为“HomePage”的键值改为“0”或删除后，不到2分钟会自动出现并且键值仍然回到了“1”。
Windows\systom32\etc中的Hosts文件也删除了。
另外，注册表修改器“被管理员停用”，修改过属性了，但是还是被停用了，每次使用修改器之前都要重新修改一次属性才行。

我无邪 - 2006-6-5 13:56:00

你是否用卡卡助手或者兔子禁止修复主页了？
没有搜搜地址栏搜索，可以使用兔子的专业卸载来卸载它。

想飞的公主 - 2006-6-5 14:03:00

我用兔子卸载过它了，没有卸载掉。

我无邪 - 2006-6-5 14:06:00

那兔子应该提示你到模式下试试
你去了吗？

想飞的公主 - 2006-6-5 14:07:00

没有用卡卡或者兔子禁止修复主页，是修复过之后马上又被劫持了。

我无邪 - 2006-6-5 14:22:00

你这帖子又出问题了，只能看到第一楼。

想飞的公主 - 2006-6-5 15:33:00

贴子又显示不出来了，怎么这么倒霉啊？555555……

想飞的公主 - 2006-6-5 15:34:00

突然又好了？！

想飞的公主 - 2006-6-5 15:36:00

嘿嘿，高手们快出现，救救小菜鸟吧？4533.cn是我遇到过的最流氓的网站了！

想飞的公主 - 2006-6-5 15:38:00

我到安全模式下试过的，第一次没有删除掉就去了安全模式，后来又去了几次，其他一起中的流氓软件都删除了，就这个删除不掉。

龙飞扬 - 2006-6-5 17:18:00

运行regedit进入注册表搜索4533.cn，全删除．退出重起．不行的话，搜索hosts文件，看里面有没４５３３．cn.删除，保存．该文件是隐藏的，用记事本打开．在系统目录里．

我无邪 - 2006-6-5 20:51:00

再扫报告粘上来吧

想飞的公主 - 2006-6-5 21:03:00

host文件早就给我删除掉了。注册表修改过无数次了，每次修改完都会被改回去的。我觉得问题还是出在注册表锁定的问题上。明天要考试了，一考就是两个礼拜。

再扫描的问题等我复习得要爆炸了再来解决吧。

colt00 - 2006-6-6 2:00:00

偶的主页和公主的一样
改了没用，重启一下它就自动恢复了
不知道要往哪里改
网上现在能找到的修改方法都试过了，没用
即使现在能改主页，也能解除主页锁定，电脑重启后就自动恢复了
我只知道我的userinit.exe扫描结果说被改动过

colt00 - 2006-6-6 2:47:00

报告一下，按我无邪兄的方法，解决了这个问题。公主的扫描结果不知道是不是在安全模式下获得的，我在上一页粘的结果是在安全模式下扫描的。然后也在安全模式下把这些键值和那个文件夹删了，再用软件修复一下就行了。重启后主页不会再被修改了。公主也可以试一下，在安全模式下扫描看看有没有我无邪兄说的这几项，如果有，在安全模式下照着改应该可以的。

瑞星卡卡安全论坛