这是一个什么病毒？ bbs.ikaka.com

561005 - 2006-7-7 20:32:00

每次杀都会有，杀毒软件提示说要“重启后删除”，但是过几天在杀毒它还是这样提示，这到底是什么病毒？怎样才能彻底杀干净？
病毒名“Backdoor/Huigezi.esy"

独孤豪侠 - 2006-7-7 20:36:00

http://forum.ikaka.com/topic.asp?board=28&artid=6979213 下载四楼的工具。扫一份日志上来。

561005 - 2006-7-7 20:55:00

2006-07-07,20:40:01

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><E:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<CnsMin><Rundll32.exe E:\WINDOWS\downlo~1\CnsMin.dll,Rundll32> [北京三七二一科技有限公司]
<KvMonXP><"E:\Program Files\KV2006\KVMonXP.kxp" /auto> [Jiangmin Co.Ltd]
<KVautoupdate ><E:\Program Files\KV2006\kvol.exe /silent> [Jiangmin Co.Ltd]
<MINI_BFYY><E:\Program Files\Ringz Studio\Storm Downloader\StormDownloader.exe> [深圳市三代科技开发有限公司]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><E:\WINDOWS\system32\Userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{D157330A-9EF3-49F8-9A67-4141AC41ADD4}><E:\WINDOWS\downlo~1\CnsHook.dll> [北京三七二一科技有限公司]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><> []

==================================
启动文件夹
服务
[Gray_Pigeon_Server2.0 / GrayPigeonServer2.0]
<><N/A>
[KVSrvXP / KVSrvXP]
<E:\Program Files\KV2006\KVSrvXP.exe /Service><Jiangmin Co. Ltd>
[KVWSC / KVWSC]
<><N/A>
[rundll32.exe / rundll32.exe]
<E:\Program Files\WindowsUpdate\rundll32.exe><N/A>
[Smart Card Event / Smart Card Event]
<><N/A>
[User Profile Hive Cleanup / UPHClean]
<E:\Program Files\UPHClean\uphclean.exe><Microsoft Corporation>

==================================
浏览器加载项
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <E:\WINDOWS\system32\xunleibho_v4.dll, >
[CSaveTarget Object]
{0654EACE-5660-4ca2-B673-04B7FC9FE45A} <E:\Program Files\MiniTuoTu\MiniTuoTu.dll, N/A>
[CPub Object]
{0CA51D02-7739-43EA-8D9A-1E8AD4327B03} <E:\Program Files\P4P\sodaie.dll, N/A>
[Yahoo!Photo]
{33BBE430-0E42-4f12-B075-8D21ACB10DCB} <E:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll, Yahoo! China>
[AntiFish Class]
{38928D50-8A48-44C2-945F-D2F23F771410} <E:\Program Files\Yahoo!\Assistant\Assist\yAngling.dll, Yahoo.>
[雅虎助手]
{406F94F0-504F-4a40-8DFD-58B0666ABEBD} <E:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll, Yahoo!>
[FiltrateWebObj Class]
{42AFACEE-2A77-41EB-9EE2-D9F8AF827F90} <E:\Program Files\KV2006\KVBHO.dll, Jiangmin Co.Ltd>
[DragSearch BHO]
{62EED7C6-9F02-42f9-B634-98E2899E147B} <E:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL, >
[BrowseHelper Class]
{80BF4637-D65B-43F3-BB60-C5DD3D5FB7B9} <E:\Program Files\KV2006\KvShell.dll, Jiangmin Co.Ltd>
[CBHelper Object]
{8A4280AD-9B37-4922-A51D-73F3C3A32AF7} <E:\WINDOWS\system32\msibm\cfsbho.dll, N/A>
[IeCatch2 Class]
{A5366673-E8CA-11D3-9CD9-0090271D075B} <E:\PROGRA~1\FLASHGET\jccatch.dll, Amaze Soft>
[CnsHook Class]
{D157330A-9EF3-49F8-9A67-4141AC41ADD4} <E:\WINDOWS\downlo~1\CnsHook.dll, 北京三七二一科技有限公司>
[免费精彩视频超流畅在线观看]
{022C4009-5283-4365-97BF-144054B40E2E} <http://itv.mop.com, N/A>
[东方快车]
{0B66EBA4-5F53-40e4-B17B-A0E9BC1E8D50} <E:\Program Files\!Sunv\DFKC2003\IEBand.DLL, 交大铭泰>
[Yahoo 1G电邮]
{507F9113-CD77-4866-BA92-0E86DA3D0B97} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail, N/A>
[寻宝乐趣多]
{59BC54A2-56B3-44a0-93E5-432D58746E26} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao, N/A>
[雅虎助手]
{5D73EE86-05F1-49ed-B850-E423120EC338} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist, N/A>
[我的订阅]
{8755CE6E-0BF7-4441-8751-FB728941B0B4} <E:\Program Files\P4P\rss.dll, N/A>
[信息检索(&R)]
{92780B25-18CC-41C8-B9BE-3C9C571A8263} <E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[@shdoclc.dll,-866@2052,相关站点]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <, N/A>
[FlashGet]
{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <E:\PROGRA~1\FLASHGET\flashget.exe, Amaze Soft>
[易趣购物]
{DE607142-AC19-422e-868A-8D70ABDF119A} <http://click2.ad4all.net/url2/urlmanage/url.asp?id=5, N/A>
[情景聊天]
{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} <http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/, N/A>
[]
{ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair, N/A>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <E:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[]
{FD00D911-7529-4084-9946-A29F1BDF4FE5} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean, N/A>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <E:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[东方快车]
{3EA85E14-887D-4E2F-91E2-3158CE58ED62} <E:\Program Files\!Sunv\DFKC2003\IEBand.DLL, 交大铭泰>
[雅虎助手]
{406F94F0-504F-4a40-8DFD-58B0666ABEBD} <E:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll, Yahoo!>
[江民杀毒工具栏]
{B5A34A93-D538-43A7-8371-864CB6148D12} <E:\Program Files\KV2006\KvShell.dll, Jiangmin Co.Ltd>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <E:\WINDOWS\system32\Flash8.ocx, Macromedia, Inc.>
[AcPreview 控件]
{F281A59C-7B65-11D3-8617-0010830243BD} <E:\WINDOWS\DOWNLO~1\ACPREV~1.OCX, Autodesk>
[pCastPanel Class]
{FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} <E:\WINDOWS\Downloaded Program Files\pCastCtl.dll, >
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <E:\WINDOWS\system32\xunleibho_v4.dll, >
[ActiveMovieControl Object]
{05589FA1-C356-11CE-BF01-00AA0055595A} <C:\WINDOWS\SYSTEM\MSDXM.OCX, Microsoft Corporation>
[CSaveTarget Object]
{0654EACE-5660-4CA2-B673-04B7FC9FE45A} <E:\Program Files\MiniTuoTu\MiniTuoTu.dll, N/A>
[CPub Object]
{0CA51D02-7739-43EA-8D9A-1E8AD4327B03} <E:\Program Files\P4P\sodaie.dll, N/A>
[Windows Genuine Advantage]
{17492023-C23A-453E-A040-C7C580BBF700} <E:\WINDOWS\system32\LegitCheckControl.dll, Microsoft? Corporation>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <E:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <E:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[Yahoo!Photo]
{33BBE430-0E42-4F12-B075-8D21ACB10DCB} <E:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll, Yahoo! China>
[AntiFish Class]
{38928D50-8A48-44C2-945F-D2F23F771410} <E:\Program Files\Yahoo!\Assistant\Assist\yAngling.dll, Yahoo.>

561005 - 2006-7-7 20:57:00

[E:\Program Files\KV2006\KVHookG.dll] <Jiangmin Co.Ltd><9.0.0.1226>
[PID: 1184][E:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[E:\Program Files\KV2006\TrojDie.kxp] <Jiangmin Co.Ltd><9.0.6.0413>
[E:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1>
[E:\Program Files\KV2006\UpdateX.dll] <JiangMin Co.Ltd.><9, 0, 5, 831>
[E:\Program Files\KV2006\lang\TrojDie0804.lng] <Jiangmin Co.Ltd><9.0.0.0813>
[E:\Program Files\KV2006\GUIExt.dll] <Jiangmin Co.Ltd><9, 0, 5, 927>
[E:\Program Files\KV2006\lang\GUIExt0804.lng] <JiangMin Ltd.><7, 1, 0, 200>
[E:\Program Files\KV2006\PProtect.dll] <Jiangmin Co. Ltd.><9.0.0.921>
[E:\Program Files\KV2006\KVHookG.dll] <Jiangmin Co.Ltd><9.0.0.1226>
[E:\Program Files\KV2006\ComUIPS.dll] <Jiangmin Ltd.><9. 5. 5. 20>
[PID: 2200][E:\Program Files\KV2006\KRegEx.exe] <Jiangmin Co.Ltd><9.0.6.210>
[E:\Program Files\KV2006\KRegEx.dll] <Jiangmin Co. Ltd.><9.0.6.0119>
[E:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1>
[E:\Program Files\KV2006\KRegTrust.dll] <Jiangmin Co. Ltd.><9.0.0.825>
[E:\Program Files\KV2006\KVHookG.dll] <Jiangmin Co.Ltd><9.0.0.1226>
[PID: 2288][E:\Program Files\KV2006\UIHost.exe] <Jiangmin Co. Ltd><9.2.0.50822>
[E:\Program Files\KV2006\KVHookG.dll] <Jiangmin Co.Ltd><9.0.0.1226>
[E:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1>
[E:\Program Files\KV2006\UpdateX.dll] <JiangMin Co.Ltd.><9, 0, 5, 831>
[E:\Program Files\KV2006\ComUI.dll] <Jiangmin Ltd.><9. 0. 0.509>
[E:\Program Files\KV2006\ComUIPS.dll] <Jiangmin Ltd.><9. 5. 5. 20>
[E:\Program Files\KV2006\GUIExt.dll] <Jiangmin Co.Ltd><9, 0, 5, 927>
[E:\Program Files\KV2006\lang\GUIExt0804.lng] <JiangMin Ltd.><7, 1, 0, 200>
[PID: 2768][D:\QQ\QQ2006Hacker-v6.II\QQ.exe] <TENCENT><0, 0, 0, 0>
[D:\QQ\QQ2006Hacker-v6.II\QQBaseClassInDll.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\QQHelperDll.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\BasicCtrlDll.dll] <Tencent><5, 0, 200, 14>
[D:\QQ\QQ2006Hacker-v6.II\RunJin.dll] <飘云 http://www.pyqq.cn><飘云>
[D:\QQ\QQ2006Hacker-v6.II\ipsearcher.dll] <><1.0.0.3>
[E:\Program Files\KV2006\KVHookG.dll] <Jiangmin Co.Ltd><9.0.0.1226>
[E:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1>
[D:\QQ\QQ2006Hacker-v6.II\QQAPI.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\TIMProxy.dll] <tencent><0, 3, 2, 4>
[D:\QQ\QQ2006Hacker-v6.II\LoginCtrl.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\npkcntc.dll] <INCA Internet Co., Ltd.><2005, 9, 1, 1>
[D:\QQ\QQ2006Hacker-v6.II\npkpdb.dll] <INCA Internet Co., Ltd.><2003, 10, 1, 1>
[D:\QQ\QQ2006Hacker-v6.II\QQRes.dll] <tencent><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\QQMainFrame.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\CQQApplication.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\NewSkin.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\HostingMgr.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\CameraDll.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\MailSummary.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\QQSpace.dll] <><1, 0, 0, 1>
[E:\WINDOWS\system32\msdmo.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\QQGroupMng.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\QQConfigPlugin.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\LongConnection.dll] <tencent><0, 3, 3, 8>
[D:\QQ\QQ2006Hacker-v6.II\QQPlugin.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\UserDefinedHead.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\QRingMng.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\QQAllInOne.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\SCCore.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\QQCustomFace.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\QQPet.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\QQAvatar.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\FlashAvatarDll.dll] <><1, 4, 0, 1>
[E:\WINDOWS\system32\Flash8.ocx] <Macromedia, Inc.><8,0,22,0>
[D:\QQ\QQ2006Hacker-v6.II\QQMagicFace.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\QQSceneMng.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\QQSysMsgMng.dll] <N/A><N/A>
[E:\WINDOWS\downlo~1\CnsHook.dll] <北京三七二一科技有限公司><1, 0, 2, 5>
[D:\QQ\QQ2006Hacker-v6.II\CommercesMng.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2>
[D:\QQ\QQ2006Hacker-v6.II\QQAddr.dll] <深圳市腾讯计算机系统有限公司><5, 0, 101, 141>
[D:\QQ\QQ2006Hacker-v6.II\GroupConnection.dll] <Tencent><0, 3, 3, 5>
[D:\QQ\QQ2006Hacker-v6.II\QQPhoneHelper.dll] <腾讯科技（深圳）有限公司><2, 0, 4, 40>
[PID: 2856][D:\QQ\QQ2006Hacker-v6.II\TIMPlatform.exe] <tencent><0, 3, 1, 8>
[E:\Program Files\KV2006\KVHookG.dll] <Jiangmin Co.Ltd><9.0.0.1226>
[E:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1>
[D:\QQ\QQ2006Hacker-v6.II\TIMProxy.dll] <tencent><0, 3, 2, 4>
[PID: 2088][E:\Program Files\Internet Explorer\IEXPLORE.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[E:\Program Files\KV2006\KVHookG.dll] <Jiangmin Co.Ltd><9.0.0.1226>
[E:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1>
[E:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll] <Yahoo!><2, 0, 4, 1026>
[E:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yaswiper.dll] <Yahoo><1, 0, 1, 1004>
[E:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasiesec.dll] <Yahoo><1, 0, 1, 1000>
[E:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasnoad.dll] <><1, 1, 0, 1002>
[E:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yzsNetProto.dll] <Yahoo><1, 0, 0, 1>
[E:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll] <Yahoo! China><1, 0, 3, 1016>
[E:\WINDOWS\system32\xunleibho_v4.dll] <><4, 3, 2, 29>
[E:\Program Files\Yahoo!\Assistant\Assist\yAngling.dll] <Yahoo.><1, 0, 1, 1001>
[E:\Program Files\KV2006\KVBHO.dll] <Jiangmin Co.Ltd><9.0.6.0113>
[E:\Program Files\KV2006\KVAddrDb.dll] <Jiangmin Co.Ltd><9, 0, 0, 1018>
[E:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL] <><1, 2, 7, 1006>
[E:\Program Files\KV2006\KvShell.dll] <Jiangmin Co.Ltd><9, 0, 5, 830>
[E:\Program Files\KV2006\UpdateX.dll] <JiangMin Co.Ltd.><9, 0, 5, 831>
[E:\Program Files\KV2006\lang\Kvxp0804.lng] <N/A><N/A>
[E:\Program Files\KV2006\APIImpl.dll] <JiangMin Ltd.><9.0.0.500>
[E:\WINDOWS\system32\msibm\cfsbho.dll] <N/A><1.0.0.1>
[E:\PROGRA~1\FLASHGET\jccatch.dll] <Amaze Soft><1, 1, 4, 0>
[E:\WINDOWS\downlo~1\CnsHook.dll] <北京三七二一科技有限公司><1, 0, 2, 5>
[E:\WINDOWS\system32\Flash8.ocx] <Macromedia, Inc.><8,0,22,0>
[e:\progra~1\yahoo!\assist~1\assist\yadfil~1.dll] < ><1, 0, 1, 6>
[E:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yrepair.dll] <Yahoo><1, 0, 6, 1319>
[E:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasfsks.dll] <3721.com><2, 1, 1, 87>
[E:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yoptimum.dll] <Yahoo><1, 0, 1, 1001>
[E:\PROGRA~1\yahoo!\assistant\Shell\yAssecblk.dll] <Yahoo><1, 0, 2, 1002>
[E:\WINDOWS\system32\CJWB.IME] <liming><4.00.950>
[PID: 3016][D:\QQ\QQ2006Hacker-v6.II\QQ.exe] <TENCENT><0, 0, 0, 0>
[D:\QQ\QQ2006Hacker-v6.II\QQBaseClassInDll.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\QQHelperDll.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\BasicCtrlDll.dll] <Tencent><5, 0, 200, 14>
[D:\QQ\QQ2006Hacker-v6.II\RunJin.dll] <飘云 http://www.pyqq.cn><飘云>
[D:\QQ\QQ2006Hacker-v6.II\ipsearcher.dll] <><1.0.0.3>
[E:\Program Files\KV2006\KVHookG.dll] <Jiangmin Co.Ltd><9.0.0.1226>
[E:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1>
[D:\QQ\QQ2006Hacker-v6.II\QQAPI.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\TIMProxy.dll] <tencent><0, 3, 2, 4>
[D:\QQ\QQ2006Hacker-v6.II\LoginCtrl.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\npkcntc.dll] <INCA Internet Co., Ltd.><2005, 9, 1, 1>
[D:\QQ\QQ2006Hacker-v6.II\npkpdb.dll] <INCA Internet Co., Ltd.><2003, 10, 1, 1>

玩游戏的 - 2006-7-7 20:57:00

又见3721这个流氓

561005 - 2006-7-7 20:58:00

[D:\QQ\QQ2006Hacker-v6.II\QQRes.dll] <tencent><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\QQMainFrame.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\CQQApplication.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\NewSkin.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\HostingMgr.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\CameraDll.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\MailSummary.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\QQSpace.dll] <><1, 0, 0, 1>
[E:\WINDOWS\system32\msdmo.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\QQGroupMng.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\LongConnection.dll] <tencent><0, 3, 3, 8>
[D:\QQ\QQ2006Hacker-v6.II\QQPlugin.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\ShareFiles.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\QQZip.dll] <tencent><0, 3, 2, 4>
[D:\QQ\QQ2006Hacker-v6.II\QQSysMsgMng.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\QQConfigPlugin.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\UserDefinedHead.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\QRingMng.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\QQAvatar.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\FlashAvatarDll.dll] <><1, 4, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\QQSettingCtrl.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\QQAllInOne.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\SCCore.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\QQPet.dll] <><1, 0, 0, 1>
[E:\WINDOWS\system32\Flash8.ocx] <Macromedia, Inc.><8,0,22,0>
[E:\WINDOWS\downlo~1\CnsHook.dll] <北京三七二一科技有限公司><1, 0, 2, 5>
[D:\QQ\QQ2006Hacker-v6.II\CommercesMng.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2>
[D:\QQ\QQ2006Hacker-v6.II\QQAddr.dll] <深圳市腾讯计算机系统有限公司><5, 0, 101, 141>
[D:\QQ\QQ2006Hacker-v6.II\QQSceneMng.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\QQPhoneHelper.dll] <腾讯科技（深圳）有限公司><2, 0, 4, 40>
[D:\QQ\QQ2006Hacker-v6.II\QQCustomFace.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\GroupConnection.dll] <Tencent><0, 3, 3, 5>
[E:\WINDOWS\system32\CJWB.IME] <liming><4.00.950>
[PID: 800][D:\QQ\QQ2006Hacker-v6.II\QQ.exe] <TENCENT><0, 0, 0, 0>
[D:\QQ\QQ2006Hacker-v6.II\QQBaseClassInDll.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\QQHelperDll.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\BasicCtrlDll.dll] <Tencent><5, 0, 200, 14>
[D:\QQ\QQ2006Hacker-v6.II\RunJin.dll] <飘云 http://www.pyqq.cn><飘云>
[D:\QQ\QQ2006Hacker-v6.II\ipsearcher.dll] <><1.0.0.3>
[E:\Program Files\KV2006\KVHookG.dll] <Jiangmin Co.Ltd><9.0.0.1226>
[E:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1>
[D:\QQ\QQ2006Hacker-v6.II\QQAPI.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\TIMProxy.dll] <tencent><0, 3, 2, 4>
[D:\QQ\QQ2006Hacker-v6.II\LoginCtrl.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\npkcntc.dll] <INCA Internet Co., Ltd.><2005, 9, 1, 1>
[D:\QQ\QQ2006Hacker-v6.II\npkpdb.dll] <INCA Internet Co., Ltd.><2003, 10, 1, 1>
[D:\QQ\QQ2006Hacker-v6.II\QQRes.dll] <tencent><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\QQMainFrame.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\CQQApplication.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\NewSkin.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\HostingMgr.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\CameraDll.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\MailSummary.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\QQSpace.dll] <><1, 0, 0, 1>
[E:\WINDOWS\system32\msdmo.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\QQGroupMng.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\LongConnection.dll] <tencent><0, 3, 3, 8>
[D:\QQ\QQ2006Hacker-v6.II\QQPlugin.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\ShareFiles.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\QQZip.dll] <tencent><0, 3, 2, 4>
[D:\QQ\QQ2006Hacker-v6.II\QQConfigPlugin.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\QQAvatar.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\FlashAvatarDll.dll] <><1, 4, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\UserDefinedHead.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\QRingMng.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\QQSysMsgMng.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\QQAllInOne.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\SCCore.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\QQCustomFace.dll] <N/A><N/A>
[E:\WINDOWS\system32\Flash8.ocx] <Macromedia, Inc.><8,0,22,0>
[D:\QQ\QQ2006Hacker-v6.II\QQSceneMng.dll] <N/A><N/A>
[D:\QQ\QQ2006Hacker-v6.II\QQPet.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\QQAddr.dll] <深圳市腾讯计算机系统有限公司><5, 0, 101, 141>
[D:\QQ\QQ2006Hacker-v6.II\GroupConnection.dll] <Tencent><0, 3, 3, 5>
[E:\WINDOWS\downlo~1\CnsHook.dll] <北京三七二一科技有限公司><1, 0, 2, 5>
[D:\QQ\QQ2006Hacker-v6.II\CommercesMng.dll] <><1, 0, 0, 1>
[D:\QQ\QQ2006Hacker-v6.II\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2>
[D:\QQ\QQ2006Hacker-v6.II\QQSettingCtrl.dll] <><1, 0, 0, 1>
[PID: 880][D:\BT\BitComet0.67\BitComet.exe] <www.BitComet.com><0.67>
[E:\Program Files\KV2006\KVHookG.dll] <Jiangmin Co.Ltd><9.0.0.1226>
[E:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1>
[PID: 2808][E:\Program Files\Common Files\Real\Update_OB\realsched.exe] <RealNetworks, Inc.><0.1.0.3510>
[E:\Program Files\KV2006\KVHookG.dll] <Jiangmin Co.Ltd><9.0.0.1226>
[E:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1>
[PID: 3832][E:\Documents and Settings\zga\桌面\sreng2\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[E:\Program Files\KV2006\KVHookG.dll] <Jiangmin Co.Ltd><9.0.0.1226>
[E:\WINDOWS\downlo~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1>

==================================
文件关联
.TXT Error. [NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR Error. [AutoCADScriptFile]
.CHM OK. ["E:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI Error. [UltraEdit.ini]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS Error. [UltraEdit.js]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

mopery - 2006-7-7 21:02:00

打开SRE 系统修复修复文件关联..
[Gray_Pigeon_Server2.0 / GrayPigeonServer2.0]
<><N/A>
[rundll32.exe / rundll32.exe]
<E:\Program Files\WindowsUpdate\rundll32.exe><N/A>
鸽子..安全模式...打开注册表编辑器，展开：HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
搜索GrayPigeonServer2.0 和 rundll32.exe 删除..
删除
E:\Program Files\WindowsUpdate\rundll32.exe

瑞星卡卡安全论坛