【求助】在线等无邪的帮助~5555555555 bbs.ikaka.com

骑着乌龟玩飘移 - 2006-7-27 9:01:00

有一个进程占了好大CPU~不知道是什么~你帮我看看~

附件: 703730200672785334.BMP

秋日里的蓝天 - 2006-7-27 9:04:00

1.添加/删除---卸载，

2.通过Mircrosoft AntiSpyware反间谍软件

骑着乌龟玩飘移 - 2006-7-27 9:23:00

什么？看不懂诶~

骑着乌龟玩飘移 - 2006-7-27 9:29:00

无邪~~你去哪里了？就等你来解决我的电脑了啊~你比我清楚啊~

骑着乌龟玩飘移 - 2006-7-27 9:38:00

这个东西删不掉~帮帮

骑着乌龟玩飘移 - 2006-7-27 9:40:00

骑着乌龟玩飘移 - 2006-7-27 9:49:00

顶上去~无邪快来！！！！！！！！

骑着乌龟玩飘移 - 2006-7-27 11:17:00

顶顶顶~！！！！！！！！！无邪 ~你去哪里了？

骑着乌龟玩飘移 - 2006-7-27 13:09:00

人都哪去了？顶上去~无邪~~快来~~！

骑着乌龟玩飘移 - 2006-7-27 13:09:00

人都哪去了？顶上去~无邪~~快来~~！

骑着乌龟玩飘移 - 2006-7-27 13:31:00

2006-07-27,13:35:51

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<Internat.exe><internat.exe> [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
<run><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Synchronization Manager><mobsync.exe /logon> [Microsoft Corporation]
<KvMonXP><C:\KV2004\KVMonXP.kxp /auto> [JiangMin Ltd.]
<HP Software Update><C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe> []
<HPDJ Taskbar Utility><C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb08.exe> [HP]
<DeviceDiscovery><C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe> [Hewlett-Packard]
<C-Media Mixer><Mixer.exe /startup> [C-Media Electronic Inc. (www.cmedia.com.tw)]
<CreativeMixer><C:\Program Files\Creative\Audio2K\PROGRAM\CTMIX32.EXE /t> [Creative Technology Ltd.]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<CdnCtr><C:\Program Files\CNNIC\Cdn\cdnup.exe> []
<spoolsv><C:\WINNT\system32\spoolsv\spoolsv.exe -printer> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<Super Rabbit Winspeed><"F:\Program Files\Super Rabbit\IEG\winspeed.exe" /autokill:88,81,5,1> [Super Rabbit Soft]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINNT\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><C:\WINNT\LULA3D~1.SCR> [andUP GmbH && Co.KG]

==================================
启动文件夹
[河南网通宽带用户客户端]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\河南网通宽带用户客户端.lnk><N>
[腾讯QQ]
<C:\Documents and Settings\lsy1\「开始」菜单\程序\启动\腾讯QQ.lnk><N>

==================================
服务
[Logical Disk Manager Administrative Service / dmadmin]
<C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[hpdj / hpdj]
<><N/A>
[KVSrvXP / KVSrvXP]
<C:\KV2004\KVSrvXP.exe -Service><JiangMin Ltd.>

==================================
浏览器加载项
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[超级兔子上网精灵]
{7369D35A-5B70-4A5B-B789-B25FE09B4AF3} <, N/A>
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, N/A>
[@msdxmLC.dll,-1@2052,电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\System32\msdxm.ocx, Microsoft Corporation>
[江民杀毒工具栏]
{B5A34A93-D538-43A7-8371-864CB6148D12} <C:\KV2004\KvShell.dll, JiangMin Lmt>
[超级兔子上网精灵]
{43869BB3-22FD-4F15-9B46-238106BA2F4E} <, N/A>
[bbmao Toolbar]
{6AE02E1C-8859-4F57-9097-5A55A56A4CAF} <C:\Program Files\bbmao toolbar\bbmao_tb_v1_0_pd1002.dll, IE Toolbar>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[&使用迅雷下载]
<F:\thunder5\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
<F:\thunder5\Program\GetAllUrl.htm, N/A>
[上传到QQ网络硬盘]
<C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
<C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

骑着乌龟玩飘移 - 2006-7-27 13:31:00

正在运行的进程
[PID: 136][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.00.2195.6601>
[PID: 164][\??\C:\WINNT\system32\csrss.exe] <Microsoft Corporation><5.00.2195.6601>
[PID: 184][\??\C:\WINNT\system32\winlogon.exe] <Microsoft Corporation><5.00.2195.6970>
[PID: 212][C:\WINNT\system32\services.exe] <Microsoft Corporation><5.00.2195.6700>
[C:\WINNT\system32\KvWspXp.dll] <JiangMin Ltd.><8.0.0.312>
[C:\WINNT\system32\quartz32.dll] <><4, 0, 0, 0>
[C:\WINNT\system32\dmserver.dll] <VERITAS Software Corp.><2195.6605.297.3>
[PID: 224][C:\WINNT\system32\lsass.exe] <Microsoft Corporation><5.00.2195.6902>
[C:\WINNT\system32\KvWspXp.dll] <JiangMin Ltd.><8.0.0.312>
[PID: 528][C:\KV2004\KVSrvXP.exe] <JiangMin Ltd.><8.0.0.311>
[C:\KV2004\UpdateX.dll] <JiangMin Ltd.><8.0.0.309>
[C:\KV2004\KVEnhD.dll] <JiangMin Ltd.><8.0.0.311>
[C:\KV2004\KvSPI.dll] <JiangMin Ltd.><8.0.0.312>
[C:\KV2004\KVEnhP.dll] <JiangMin Ltd.><8.0.0.309>
[C:\KV2004\KVEnhM.dll] <JiangMin Ltd.><8.0.0.311>
[C:\KV2004\KVEnhC.DLL] <JiangMin Ltd.><8.0.0.311>
[C:\KV2004\KVEnhO_1.dll] <JiangMin Ltd.><8.0.0.314>
[C:\KV2004\KVEnhS_1.dll] <JiangMin Ltd.><8.0.0.313>
[C:\KV2004\KVEnhJ.dll] <JiangMin Ltd.><8.0.0.311>
[C:\KV2004\KVExtCab.dll] <Jiangmin New Tech. Co. Ltd.><8.0.0.309>
[C:\KV2004\KVExtEml.dll] <JiangMin Ltd.><8.0.0.312>
[C:\KV2004\KvExtRar.dll] <Jiangmin New Tech. Co. Ltd.><8.0.0.309>
[C:\KV2004\KvExtZip.dll] <JiangMin Ltd.><8.0.0.309>
[C:\KV2004\KVExtLZH_1.dll] <N/A><N/A>
[C:\KV2004\KVEnhK_1.dll] <JiangMin Ltd.><7, 1, 0, 307>
[C:\KV2004\KvSpiPS.dll] <JiangMin Ltd.><8.0.0.309>
[C:\WINNT\system32\quartz32.dll] <><4, 0, 0, 0>
[C:\WINNT\system32\KvWspXp.dll] <JiangMin Ltd.><8.0.0.312>
[C:\KV2004\lang\PrivateCfg0804.lng] <TODO: <Company name>><1.0.0.1>
[C:\WINNT\system32\cdnns.dll] <N/A><N/A>
[PID: 576][C:\WINNT\system32\MSTask.exe] <Microsoft Corporation><4.71.2195.6920>
[C:\WINNT\system32\quartz32.dll] <><4, 0, 0, 0>
[C:\WINNT\system32\KvWspXp.dll] <JiangMin Ltd.><8.0.0.312>
[C:\WINNT\system32\cdnns.dll] <N/A><N/A>
[PID: 660][C:\WINNT\System32\WBEM\WinMgmt.exe] <Microsoft Corporation><1.50.1085.0100>
[PID: 848][C:\WINNT\Explorer.EXE] <Microsoft Corporation><5.00.3700.6690>
[C:\PROGRA~1\MMSASS~1\Mmsass~1.dll] <N/A><N/A>
[C:\WINNT\system32\cdnns.dll] <N/A><N/A>
[C:\WINNT\system32\msicn\msibm.dll] <N/A><N/A>
[C:\WINNT\system32\msicn\plugins\bse.dll] <N/A><N/A>
[C:\WINNT\system32\msicn\plugins\lup.dll] <N/A><N/A>
[C:\WINNT\system32\msicn\plugins\bm.dll] <N/A><N/A>
[C:\WINNT\system32\msicn\plugins\as.dll] <N/A><N/A>
[C:\KV2004\KvShell.dll] <JiangMin Lmt><8.0.0.309>
[C:\KV2004\UpdateX.dll] <JiangMin Ltd.><8.0.0.309>
[C:\KV2004\lang\Kvxp0804.lng] <N/A><N/A>
[C:\KV2004\KVComm_1.dll] <JiangMin Ltd.><8.0.0.312>
[C:\KV2004\APIImpl.dll] <JiangMin Ltd.><8.0.0.309>
[C:\KV2004\GUIExt.dll] <JiangMin Ltd.><8.0.0.309>
[C:\KV2004\lang\GUIExt0804.lng] <JiangMin Ltd.><7, 1, 0, 200>
[C:\Progra~1\DoDoorRSSFinder\ActiveBandObject.dll] <><1, 0, 0, 1>
[C:\PROGRA~1\baidu\bar\baidubar.dll] <N/A><N/A>
[F:\thunder5\ComDlls\XunLeiBHO_002.dll] <Thunder Networking Technologies,LTD><5, 0, 0, 2>
[C:\WINNT\system32\KvWspXp.dll] <JiangMin Ltd.><8.0.0.312>
[C:\WINNT\system32\quartz32.dll] <><4, 0, 0, 0>
[C:\Program Files\Tencent\QQ\qdshm.dll] <><1, 0, 101, 20>
[C:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll] <CNNIC><2, 0, 0, 2>
[C:\KV2004\KVMonXP.kxp] <JiangMin Ltd.><8.0.0.309>
[C:\KV2004\UpdateX.dll] <JiangMin Ltd.><8.0.0.309>
[C:\KV2004\lang\Kvxp0804.lng] <N/A><N/A>
[C:\KV2004\GUIExt.dll] <JiangMin Ltd.><8.0.0.309>
[C:\KV2004\lang\GUIExt0804.lng] <JiangMin Ltd.><7, 1, 0, 200>
[C:\KV2004\KVEnhP.dll] <JiangMin Ltd.><8.0.0.309>
[C:\KV2004\KvSpiPS.dll] <JiangMin Ltd.><8.0.0.309>
[C:\KV2004\lang\PrivateCfg0804.lng] <TODO: <Company name>><1.0.0.1>
[C:\KV2004\ComUIPS.dll] <N/A><8.0.0.309>
[PID: 964][C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe] <N/A><N/A>
[PID: 932][C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe] <Hewlett-Packard><1, 0, 0, 1>
[C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpodvd08.dll] <Hewlett-Packard><2, 0, 2, 2>
[C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqcxm08.dll] <Hewlett-Packard Co.><4.2.0.127>
[PID: 1080][C:\WINNT\Mixer.exe] <C-Media Electronic Inc. (www.cmedia.com.tw)><1.60>
[C:\WINNT\System32\cmnprop.dll] <C-Media Corporation><5.00.2195.12>
[PID: 1088][C:\Program Files\Creative\Audio2K\PROGRAM\CTMIX32.EXE] <Creative Technology Ltd.><6.01.1>
[C:\Program Files\Creative\Audio2K\PROGRAM\CTMRES32.DLL] <Creative Technology Ltd.><1.02.0>
[PID: 1096][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] <RealNetworks, Inc.><0.1.0.1622>
[C:\WINNT\system32\msicn\msibm.dll] <N/A><N/A>
[C:\WINNT\system32\cdnns.dll] <N/A><N/A>
[C:\WINNT\system32\quartz32.dll] <><4, 0, 0, 0>
[C:\WINNT\system32\KvWspXp.dll] <JiangMin Ltd.><8.0.0.312>
[PID: 1176][C:\WINNT\system32\internat.exe] <Microsoft Corporation><5.00.2920.0000>
[PID: 1220][C:\Program Files\racer-henan-cnc\racer.exe] <Putian Runway><2, 0, 51, 92>

骑着乌龟玩飘移 - 2006-7-27 13:31:00

[C:\Program Files\racer-henan-cnc\rwxre.dll] <Mozilla Foundation><1.7.3: 2005040616>
[C:\Program Files\racer-henan-cnc\nspr4.dll] <Netscape Communications Corporation><4.5 Beta>
[C:\Program Files\racer-henan-cnc\xpcom.dll] <Mozilla Foundation><1.7.3: 2005040616>
[C:\Program Files\racer-henan-cnc\nss3.dll] <Netscape Communications Corporation><3.9.1>
[C:\Program Files\racer-henan-cnc\softokn3.dll] <Netscape Communications Corporation><3.9.1>
[C:\Program Files\racer-henan-cnc\gkgfx.dll] <Mozilla Foundation><1.7.3: 2005040616>
[C:\Program Files\racer-henan-cnc\js3250.dll] <Netscape Communications Corporation><4.0>
[C:\Program Files\racer-henan-cnc\components\racer_base_comp.dll] <Putian Runway><2,0,47,87>
[C:\Program Files\racer-henan-cnc\xpcom_compat.dll] <Mozilla Foundation><1.7.3: 2005040616>
[C:\Program Files\racer-henan-cnc\racer_base.dll] <Putian Runway><2,0,47,87>
[C:\WINNT\system32\quartz32.dll] <><4, 0, 0, 0>
[C:\WINNT\system32\KvWspXp.dll] <JiangMin Ltd.><8.0.0.312>
[C:\Program Files\racer-henan-cnc\components\pipnss.dll] <Mozilla Foundation><1.7.3: 2005040616>
[C:\Program Files\racer-henan-cnc\components\gklayout.dll] <Mozilla Foundation><1.7.3: 2005040616>
[C:\Program Files\racer-henan-cnc\components\jar50.dll] <Mozilla Foundation><1.7.3: 2005040616>
[C:\Program Files\racer-henan-cnc\components\xpcom_compat_c.dll] <Mozilla Foundation><1.7.3: 2005040616>
[C:\Program Files\racer-henan-cnc\components\racer_ad_comp.dll] <Putian Runway><2,0,47,87>
[C:\Program Files\racer-henan-cnc\components\racer_access_dhcpplus.dll] <Putian Runway><2,0,47,87>
[C:\Program Files\racer-henan-cnc\dhcpplus.dll] <北京润汇科技有限公司><0, 13, 21, 45>
[C:\Program Files\racer-henan-cnc\components\racer_nss4_comp.dll] <Putian Runway><2,0,47,87>
[C:\Program Files\racer-henan-cnc\nss4.dll] <北京普天润汇科技有限公司><1, 0, 0, 3>
[C:\Program Files\racer-henan-cnc\wpcap.dll] <NetGroup - Politecnico di Torino><3, 1, 0, 24>
[C:\Program Files\racer-henan-cnc\packet.dll] <NetGroup - Politecnico di Torino><3, 1, 0, 24>
[C:\Program Files\racer-henan-cnc\WanPacket.dll] <NetGroup - Politecnico di Torino><3, 1, 0, 24>
[C:\WINNT\system32\cdnns.dll] <N/A><N/A>
[PID: 1408][C:\WINNT\system32\conime.exe] <Microsoft Corporation><5.00.2195.6655>
[C:\WINNT\system32\msicn\msibm.dll] <N/A><N/A>
[PID: 1384][C:\Program Files\racer-henan-cnc\RacerKp.exe] <北京润汇科技有限公司><1, 0, 0, 1>
[C:\Program Files\CNNIC\Cdn\cdnspie.dll] <><2, 1, 0, 3>
[PID: 2080][C:\Program Files\Internet Explorer\IEXPLORE.EXE] <Microsoft Corporation><5.00.2920.0000>
[C:\Program Files\bbmao toolbar\bbmao_tb_v1_0_pd1002.dll] <IE Toolbar><1, 0, 0, 4>
[C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll] <CNNIC><2, 0, 0, 2>
[C:\WINNT\system32\KvWspXp.dll] <JiangMin Ltd.><8.0.0.312>
[C:\WINNT\system32\quartz32.dll] <><4, 0, 0, 0>
[C:\WINNT\system32\Macromed\Flash\Flash9.ocx] <Adobe Systems, Inc.><9,0,16,0>
[PID: 1716][C:\WINNT\system32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[C:\WINNT\system32\quartz32.dll] <><4, 0, 0, 0>
[C:\WINNT\system32\KvWspXp.dll] <JiangMin Ltd.><8.0.0.312>
[PID: 2412][C:\WINNT\System32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[PID: 1724][F:\智能扫描\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\WINNT\system32\KvWspXp.dll] <JiangMin Ltd.><8.0.0.312>
[C:\WINNT\system32\quartz32.dll] <><4, 0, 0, 0>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINNT\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

我无邪 - 2006-7-27 13:37:00

运行(双击)System Repair Engineer，点“启动项目，服务，点“Win32服务应用程序”勾选“隐藏微软服务”选中病毒服务hpdj，选择“删除服务”点“设置”选择“否”

下载超级兔子。
http://www.pctutu.com/srmsdown.asp
安装好后，打开“超级兔子优化王”“专业卸载,卸载所有提示的垃圾软件，卸载是不要打开任何浏览窗口。卸载不了可以重启后再去卸载。

修复以下选项
C:\WINNT\system32\quartz32.dll
有一定的危险性，如果你愿意，可以这样做。(建议你去做，虽然有一些风险)
请到http://forum.ikaka.com/topic.asp?board=67&artid=5188931，下载，LSPFix.exe，WinsockXPFix这两个软件
重新启动电脑, 开机检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式进入Windows

运行LSPFix.exe
删除
quartz32.dll
附说明一份
LSPFix.exe这个软件主要用来辅助修复HijackThis扫描发现的O10项。
使用时，请关闭所有IE界面和文件夹界面后运行LSPFix，运行后，把要修复的那一个O10项从左边转到右边，点“Finish”即可。（不过这之前，需要在“I know what I`m doing”前面打勾。）
双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示确定更改时，单击“是”，清除“隐藏已知文件类型的扩展名
删除
C:\WINNT\system32\quartz32.dll
修复后重启，如果无法上网，请运行WinsockXPFix，让它修复一下。
回到正常模式，请再扫日志粘上来。

我无邪 - 2006-7-27 13:38:00

最后多说两句，不要发这么多帖子，一个帖子把所有的话题都往里说。

骑着乌龟玩飘移 - 2006-7-27 14:59:00

2006-07-27,14:52:54

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<Internat.exe><internat.exe> [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
<run><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Synchronization Manager><mobsync.exe /logon> [Microsoft Corporation]
<KvMonXP><C:\KV2004\KVMonXP.kxp /auto> [JiangMin Ltd.]
<HP Software Update><C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe> []
<HPDJ Taskbar Utility><C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb08.exe> [HP]
<DeviceDiscovery><C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe> [Hewlett-Packard]
<C-Media Mixer><Mixer.exe /startup> [C-Media Electronic Inc. (www.cmedia.com.tw)]
<CreativeMixer><C:\Program Files\Creative\Audio2K\PROGRAM\CTMIX32.EXE /t> [Creative Technology Ltd.]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<CdnCtr><C:\Program Files\CNNIC\Cdn\cdnup.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINNT\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><C:\WINNT\LULA3D~1.SCR> [andUP GmbH && Co.KG]

==================================
启动文件夹
[河南网通宽带用户客户端]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\河南网通宽带用户客户端.lnk><N>
[腾讯QQ]
<C:\Documents and Settings\lsy1\「开始」菜单\程序\启动\腾讯QQ.lnk><N>

==================================
服务
[Logical Disk Manager Administrative Service / dmadmin]
<C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[KVSrvXP / KVSrvXP]
<C:\KV2004\KVSrvXP.exe -Service><JiangMin Ltd.>

==================================
浏览器加载项
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[超级兔子上网精灵]
{7369D35A-5B70-4A5B-B789-B25FE09B4AF3} <, N/A>
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, N/A>
[@msdxmLC.dll,-1@2052,电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\System32\msdxm.ocx, Microsoft Corporation>
[江民杀毒工具栏]
{B5A34A93-D538-43A7-8371-864CB6148D12} <C:\KV2004\KvShell.dll, JiangMin Lmt>
[超级兔子上网精灵]
{43869BB3-22FD-4F15-9B46-238106BA2F4E} <, N/A>
[bbmao Toolbar]
{6AE02E1C-8859-4F57-9097-5A55A56A4CAF} <C:\Program Files\bbmao toolbar\bbmao_tb_v1_0_pd1002.dll, IE Toolbar>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[&使用迅雷下载]
<F:\thunder5\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
<F:\thunder5\Program\GetAllUrl.htm, N/A>
[上传到QQ网络硬盘]
<C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
<C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

骑着乌龟玩飘移 - 2006-7-27 15:00:00

正在运行的进程
[PID: 136][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.00.2195.6601>
[PID: 164][\??\C:\WINNT\system32\csrss.exe] <Microsoft Corporation><5.00.2195.6601>
[PID: 184][\??\C:\WINNT\system32\winlogon.exe] <Microsoft Corporation><5.00.2195.6970>
[PID: 212][C:\WINNT\system32\services.exe] <Microsoft Corporation><5.00.2195.6700>
[C:\WINNT\system32\dmserver.dll] <VERITAS Software Corp.><2195.6605.297.3>
[PID: 224][C:\WINNT\system32\lsass.exe] <Microsoft Corporation><5.00.2195.6902>
[PID: 400][C:\WINNT\system32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[PID: 432][C:\WINNT\system32\spoolsv.exe] <Microsoft Corporation><5.00.2195.7059>
[C:\WINNT\system32\hpzsnt08.dll] <HP><2,223,0,0>
[PID: 464][C:\WINNT\System32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[PID: 484][C:\KV2004\KVSrvXP.exe] <JiangMin Ltd.><8.0.0.311>
[C:\KV2004\UpdateX.dll] <JiangMin Ltd.><8.0.0.309>
[C:\KV2004\KVEnhD.dll] <JiangMin Ltd.><8.0.0.311>
[C:\KV2004\KvSPI.dll] <JiangMin Ltd.><8.0.0.312>
[C:\KV2004\KVEnhP.dll] <JiangMin Ltd.><8.0.0.309>
[C:\KV2004\KVEnhM.dll] <JiangMin Ltd.><8.0.0.311>
[C:\KV2004\KVEnhC.DLL] <JiangMin Ltd.><8.0.0.311>
[C:\KV2004\KVEnhO_1.dll] <JiangMin Ltd.><8.0.0.314>
[C:\KV2004\KVEnhS_1.dll] <JiangMin Ltd.><8.0.0.313>
[C:\KV2004\KVEnhJ.dll] <JiangMin Ltd.><8.0.0.311>
[C:\KV2004\KVExtCab.dll] <Jiangmin New Tech. Co. Ltd.><8.0.0.309>
[C:\KV2004\KVExtEml.dll] <JiangMin Ltd.><8.0.0.312>
[C:\KV2004\KvExtRar.dll] <Jiangmin New Tech. Co. Ltd.><8.0.0.309>
[C:\KV2004\KvExtZip.dll] <JiangMin Ltd.><8.0.0.309>
[C:\KV2004\KVExtLZH_1.dll] <N/A><N/A>
[C:\KV2004\KVEnhK_1.dll] <JiangMin Ltd.><7, 1, 0, 307>
[C:\KV2004\KvSpiPS.dll] <JiangMin Ltd.><8.0.0.309>
[PID: 528][C:\WINNT\system32\MSTask.exe] <Microsoft Corporation><4.71.2195.6920>
[PID: 568][C:\WINNT\System32\WBEM\WinMgmt.exe] <Microsoft Corporation><1.50.1085.0100>
[PID: 612][C:\WINNT\system32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[PID: 800][C:\WINNT\Explorer.EXE] <Microsoft Corporation><5.00.3700.6690>
[C:\Program Files\CNNIC\Cdn\cdnspie.dll] <><2, 1, 0, 3>
[C:\Program Files\CNNIC\Cdn\imaoe.dll] <CNNIC><2, 2, 0, 1>
[C:\Program Files\CNNIC\Cdn\cdnforie.dll] <CNNIC><2, 0, 0, 2>
[C:\Program Files\CNNIC\Cdn\cdndet.dll] <CNNIC><2, 4, 0, 1>
[C:\KV2004\UpdateX.dll] <JiangMin Ltd.><8.0.0.309>
[C:\KV2004\KVComm_1.dll] <JiangMin Ltd.><8.0.0.312>
[C:\KV2004\GUIExt.dll] <JiangMin Ltd.><8.0.0.309>
[C:\KV2004\lang\GUIExt0804.lng] <JiangMin Ltd.><7, 1, 0, 200>
[C:\KV2004\KVMonXP.kxp] <JiangMin Ltd.><8.0.0.309>
[C:\KV2004\UpdateX.dll] <JiangMin Ltd.><8.0.0.309>
[C:\KV2004\lang\Kvxp0804.lng] <N/A><N/A>
[C:\KV2004\GUIExt.dll] <JiangMin Ltd.><8.0.0.309>
[C:\KV2004\lang\GUIExt0804.lng] <JiangMin Ltd.><7, 1, 0, 200>
[C:\KV2004\KVEnhP.dll] <JiangMin Ltd.><8.0.0.309>
[C:\KV2004\KvSpiPS.dll] <JiangMin Ltd.><8.0.0.309>
[C:\KV2004\lang\PrivateCfg0804.lng] <TODO: <Company name>><1.0.0.1>
[PID: 920][C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe] <N/A><N/A>
[PID: 940][C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe] <Hewlett-Packard><1, 0, 0, 1>
[C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpodvd08.dll] <Hewlett-Packard><2, 0, 2, 2>
[C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqcxm08.dll] <Hewlett-Packard Co.><4.2.0.127>
[C:\Program Files\CNNIC\Cdn\cdndet.dll] <CNNIC><2, 4, 0, 1>
[C:\Program Files\CNNIC\Cdn\cdnforie.dll] <CNNIC><2, 0, 0, 2>
[PID: 964][C:\WINNT\Mixer.exe] <C-Media Electronic Inc. (www.cmedia.com.tw)><1.60>
[C:\WINNT\System32\cmnprop.dll] <C-Media Corporation><5.00.2195.12>
[PID: 972][C:\Program Files\Creative\Audio2K\PROGRAM\CTMIX32.EXE] <Creative Technology Ltd.><6.01.1>

骑着乌龟玩飘移 - 2006-7-27 15:00:00

[C:\Program Files\Creative\Audio2K\PROGRAM\CTMRES32.DLL] <Creative Technology Ltd.><1.02.0>
[PID: 988][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] <RealNetworks, Inc.><0.1.0.1622>
[PID: 1008][C:\WINNT\system32\internat.exe] <Microsoft Corporation><5.00.2920.0000>
[PID: 1172][C:\WINNT\system32\wuauclt.exe] <Microsoft Corporation><5.8.0.2469 built by: lab01_n(wmbla)>
[C:\Program Files\CNNIC\Cdn\cdnspie.dll] <><2, 1, 0, 3>
[C:\Program Files\CNNIC\Cdn\imaoe.dll] <CNNIC><2, 2, 0, 1>
[C:\Program Files\CNNIC\Cdn\cdnforie.dll] <CNNIC><2, 0, 0, 2>
[C:\Program Files\CNNIC\Cdn\cdndet.dll] <CNNIC><2, 4, 0, 1>
[PID: 712][C:\Program Files\Internet Explorer\IEXPLORE.EXE] <Microsoft Corporation><5.00.2920.0000>
[C:\Program Files\CNNIC\Cdn\cdnspie.dll] <><2, 1, 0, 3>
[C:\Program Files\CNNIC\Cdn\imaoe.dll] <CNNIC><2, 2, 0, 1>
[C:\Program Files\CNNIC\Cdn\cdnforie.dll] <CNNIC><2, 0, 0, 2>
[C:\Program Files\CNNIC\Cdn\cdndet.dll] <CNNIC><2, 4, 0, 1>
[C:\Program Files\bbmao toolbar\bbmao_tb_v1_0_pd1002.dll] <IE Toolbar><1, 0, 0, 4>
[C:\WINNT\system32\Macromed\Flash\Flash9.ocx] <Adobe Systems, Inc.><9,0,16,0>
[PID: 1224][C:\WINNT\system32\conime.exe] <Microsoft Corporation><5.00.2195.6655>
[C:\Program Files\CNNIC\Cdn\cdnspie.dll] <><2, 1, 0, 3>
[C:\Program Files\CNNIC\Cdn\imaoe.dll] <CNNIC><2, 2, 0, 1>
[C:\Program Files\CNNIC\Cdn\cdnforie.dll] <CNNIC><2, 0, 0, 2>
[C:\Program Files\CNNIC\Cdn\cdndet.dll] <CNNIC><2, 4, 0, 1>
[PID: 1388][F:\智能扫描\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\Program Files\CNNIC\Cdn\cdnspie.dll] <><2, 1, 0, 3>
[C:\Program Files\CNNIC\Cdn\imaoe.dll] <CNNIC><2, 2, 0, 1>
[C:\Program Files\CNNIC\Cdn\cdnforie.dll] <CNNIC><2, 0, 0, 2>
[C:\Program Files\CNNIC\Cdn\cdndet.dll] <CNNIC><2, 4, 0, 1>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINNT\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

骑着乌龟玩飘移 - 2006-7-27 15:26:00

无邪~~快来~

骑着乌龟玩飘移 - 2006-7-27 20:45:00

顶上去 ~无邪人呢？

我无邪 - 2006-7-27 21:09:00

建议你卸载中文上网，然后再用兔子卸载它。
那个终止不了的，可能就是它。

骑着乌龟玩飘移 - 2006-7-27 21:20:00

哦~~谢谢了~

瑞星卡卡安全论坛