瑞星卡卡安全论坛

这两天IE自动弹出的图片广告和网页广告，把我搞得是焦头烂额了，用了N多IE修复软件也不成，请版

主在百忙中帮我分析一下，谢谢！！！

Logfile of Kaka v2. 0. 0. 9 Scan Module v2. 0. 0. 1
Scan saved at 11:40:52, on 2006-08-11
Platform: Microsoft Windows XP Professional Service Pack 2 (Build 2600)
MSIE: Internet Explorer v6.00 SP2; (6.00.2900.2180 (xpsp_sp2_rtm.040803-2158))


Running processes:
[smss.exe]
CommandLine =

[csrss.exe]
CommandLine = D:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows

SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1

ServerDll=winsrv:UserServerDllInitialization,3

ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

[winlogon.exe]
CommandLine = winlogon.exe

[services.exe]
CommandLine = D:\WINDOWS\system32\services.exe

[lsass.exe]
CommandLine = D:\WINDOWS\system32\lsass.exe

[ati2evxx.exe]
CommandLine = D:\WINDOWS\system32\Ati2evxx.exe

[svchost.exe]
CommandLine = D:\WINDOWS\system32\svchost -k DcomLaunch

[svchost.exe]
CommandLine = D:\WINDOWS\system32\svchost -k rpcss

[svchost.exe]
CommandLine = D:\WINDOWS\System32\svchost.exe -k netsvcs

[svchost.exe]
CommandLine = D:\WINDOWS\system32\svchost.exe -k NetworkService

[svchost.exe]
CommandLine = D:\WINDOWS\system32\svchost.exe -k LocalService

[spoolsv.exe]
CommandLine = D:\WINDOWS\system32\spoolsv.exe

[ATKKBService.exe]
CommandLine = D:\WINDOWS\ATKKBService.exe

[DefWatch.exe]
CommandLine = D:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe

[inetinfo.exe]
CommandLine = D:\WINDOWS\system32\inetsrv\inetinfo.exe

[ati2evxx.exe]
CommandLine = Ati2evxx.exe -Client

[explorer.exe]
CommandLine = D:\WINDOWS\Explorer.EXE

[CLI.exe]
CommandLine = "D:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime

[SOUNDMAN.EXE]
CommandLine = "D:\WINDOWS\SOUNDMAN.EXE"

[ALCWZRD.EXE]
CommandLine = "D:\WINDOWS\ALCWZRD.EXE"

[VPTray.exe]
CommandLine = "D:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe"

[winampa.exe]
CommandLine = "D:\Program Files\Winamp\winampa.exe"

[StatusClient.exe]
CommandLine = "D:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe"

/auto

[OrderReminder.exe]
CommandLine = "D:\Program Files\Hewlett-

Packard\OrderReminder\OrderReminder\OrderReminder.exe"

[hpwuSchd2.exe]
CommandLine = "D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe"

[TotRecSched.exe]
CommandLine = "D:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe"

[Mysee Alert.exe]
CommandLine = "D:\Program Files\GAOV\Mysee Alert\Mysee Alert.exe" -notray

[acrotray.exe]
CommandLine = "D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

[daemon.exe]
CommandLine = "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

[ctfmon.exe]
CommandLine = "D:\WINDOWS\system32\ctfmon.exe"

[msnmsgr.exe]
CommandLine = "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

[MSNShell.exe]
CommandLine = "D:\Program Files\MSNShell\BIN\MSNShell.exe" autorun

[rundll32.exe]
CommandLine = D:\WINDOWS\system32\rundll32.exe D:\DOCUME~1\ericdong\TEMPLA~1

\14d036e\1.dll,Always

[svchost.exe]
CommandLine = D:\WINDOWS\System32\svchost.exe -k mysee2

[Rtvscan.exe]
CommandLine = D:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe

[HPZipm12.exe]
CommandLine = D:\WINDOWS\system32\hpzipm12.exe

[svchost.exe]
CommandLine = D:\WINDOWS\system32\svchost.exe -k imgsvc

[javaw.exe]
CommandLine = "D:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe" -jar -

Duser.dir="D:\Program Files\Hewlett-Packard\Toolbox\Apache Tomcat 4.0" "D:\Program

Files\Hewlett-Packard\Toolbox\Apache Tomcat 4.0\bin\bootstrap.jar" start

[wdfmgr.exe]
CommandLine = D:\WINDOWS\system32\wdfmgr.exe

[rundll32.exe]
CommandLine = D:\WINDOWS\system32\Rundll32.exe "D:\WINDOWS\Downloader.dll",Run

[alg.exe]
CommandLine = D:\WINDOWS\System32\alg.exe

[iMook.exe]
CommandLine = "C:\Program Files\iMook\iMook.exe" IMOOK://MINIMIZE

[Maxthon.exe]
CommandLine = "D:\Program Files\Maxthon\Maxthon.exe"

[Photoshop.exe]
CommandLine = "D:\Program Files\Adobe\Photoshop CS\Photoshop.exe"

[~e5d141.tmp]
CommandLine = "D:\DOCUME~1\ericdong\LOCALS~1\Temp\~e5d141.tmp" 3628 "D:\DOCUME~1

\ericdong\LOCALS~1\Temp\""~ef22bb"

[Adobelmsvc.exe]
CommandLine = "D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"

[~e5d141.tmp]
CommandLine = "D:\DOCUME~1\ericdong\LOCALS~1\Temp\~e5d141.tmp" 3628 "D:\DOCUME~1

\ericdong\LOCALS~1\Temp\""~ef30d4"

[KkScan.exe]
CommandLine = "D:\Program Files\Rising\KakaToolBar\KkScan.exe"

R3 - URLSearchHook: (no name) - {BB936323-19FA-4521-BA29-ECA6A121BC78} - (no file)
F1 - win.ini: Load=D:\WINDOWS\941i62c.exe
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: 192.168.0.102  www.gougoujia.com
O1 - Hosts: 192.168.0.102  www.odeum.com
O2 - BHO: wmpdrm - {0E674588-66B7-4E19-9D0E-2053B800F69F} - D:\WINDOWS\system32

\wmpdrm.dll
O2 - BHO:  (file missing)
O2 - BHO: hbieobj Class - {147E230B-FC8D-4A66-AB96-FFD464A9B2A3} - D:\PROGRA~1

\pcast\hbcast.dll (file missing)
O2 - BHO:  (file missing)
O2 - BHO:  (file missing)
O2 - BHO: WebDownloader Class - {E78F50F9-51CF-40EC-AE3F-4F802528150B} -

D:\WINDOWS\Downloader.dll
O2 - BHO:  (file missing)
O2 - BHO: BHelper Class - {F2E37336-BFDB-409B-8D0E-6F013C438B20} -

D:\WINDOWS\941o62c1.dll
O2 - BHO:  (file missing)
O3 - Toolbar: 金山毒霸安全助手 - {EF72500A-C234-46C4-BF0A-9AA6913DDF34} - D:\Program

Files\KOS\KOSIEBar.dll
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} -

D:\WINDOWS\system32\KakaTool.dll
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [googletalk] "D:\Program Files\Google\Google Talk\googletalk.exe"

/autostart
O4 - HKCU\..\Run: [MSNShell] D:\Program Files\MSNShell\BIN\MSNShell.exe autorun
O4 - HKLM\..\Run: [IMJPMIG8.1] "D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef

--------<接上面>

O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "D:\Program Files\Adobe\Acrobat 7.0

\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [spoolsv] D:\WINDOWS\system32\spoolsv\spoolsv.exe -printer
O4 - Startup: desktop.ini =
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = D:\WINDOWS\Installer\{AC76BA86-

1033-0000-7760-000000000002}\SC_Acrobat.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common

Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: desktop.ini =
O4 - Global Startup: IE-Bar.lnk = D:\Program Files\Common Files\IE-Bar\iebar.exe
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\Program Files\haha\AddToNetDisk.htm
O8 - Extra context menu item: 使用影音传送带下载 - D:\Program Files\Xi\NetTransport 2

\NTAddLink.html
O8 - Extra context menu item: 使用网络传送带下载 - D:\Program

Files\NetXfer\NXAddLink.html
O8 - Extra context menu item: 使用网际快车下载 - D:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://D:\PROGRA~1

\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Program Files\haha\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Program Files\haha\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Program Files\haha\SendMMS.htm
O8 - Extra context menu item: 用WanMP3搜索播放 - res://WanMP3.ocx/search.htm
O8 - Extra context menu item: 设为 Messenger Live 头像 - D:\Program

Files\MSNShell\BIN\SetMSNDP.htm
O9 - Extra Button: MSN Shell 4 - {0713E8D2-850A-101B-AFC0-4210102A8DA7} - D:\Program

Files\MSNShell\Bin\MSNShell.exe
O9 - Extra 'Tools' menuitem: MSN Shell 4 - {0713E8D2-850A-101B-AFC0-4210102A8DA7} -

D:\Program Files\MSNShell\Bin\MSNShell.exe
O9 - Extra Button: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -

D:\WINDOWS\system32\shdocvw.dll
O9 - Extra Button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program

Files\haha\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program

Files\haha\QQ.EXE
O9 - Extra Button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1

\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} -

D:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra Button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program

Files\haha\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} -

D:\Program Files\haha\QQIEHelper.dll
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program

Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

D:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?

prd=ie&pver=6&ar=msnhome
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (CEditCtrl Object) -

https://img.alipay.com/download/1007/aliedit.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -

http://ajin20035.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {52DF16E3-6C4F-4B22-8BAF-09263E463B48} (金山毒霸在线产品升级) -

http://zs.kingsoft.com/KOSInit.cab
O16 - DPF: {53AF6E02-F18F-4228-AC13-3E79773FBE50} (CMCBooter Object) -

http://download.mysee.com/plugin/booter.cab
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) -

https://mybank.icbc.com.cn/icbc/perbank/AXSafeControls.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -

http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {E787FD25-8D7C-4693-AE67-9406BC6E22DF} (CPasswordEditCtrl Object) -

https://www.tenpay.com/download/qqedit.cab
O18 - Filter : application/octet-stream - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} -

D:\WINDOWS\system32\mscoree.dll
O18 - Filter : application/x-complus - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} -

D:\WINDOWS\system32\mscoree.dll
O18 - Filter : application/x-msdownload - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} -

D:\WINDOWS\system32\mscoree.dll
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - D:\WINDOWS\system32

\mshtml.dll
O18 - Protocol: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - D:\WINDOWS\system32

\urlmon.dll
O18 - Protocol: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - D:\WINDOWS\system32

\msvidctl.dll
O18 - Protocol: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - D:\WINDOWS\system32

\urlmon.dll
O18 - Protocol: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - D:\WINDOWS\system32

\urlmon.dll
O18 - Protocol: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - D:\WINDOWS\system32

\urlmon.dll
O18 - Protocol: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - D:\WINDOWS\system32

\urlmon.dll
O18 - Protocol: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - D:\WINDOWS\system32

\urlmon.dll
O18 - Protocol: ipp - (no CLSID) - (no file)
O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - D:\WINDOWS\system32

\itss.dll
O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} -

D:\WINDOWS\system32\mshtml.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1

\MSGRAP~1.DLL
O18 - Protocol: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - D:\WINDOWS\system32

\urlmon.dll
O18 - Protocol: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - D:\WINDOWS\system32

\mshtml.dll
O18 - Protocol: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - D:\WINDOWS\system32

\inetcomm.dll
O18 - Protocol: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - D:\WINDOWS\system32

\urlmon.dll
O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - D:\WINDOWS\system32

\itss.dll
O18 - Protocol: msdaipp - (no CLSID) - (no file)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1

\MSGRAP~1.DLL
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - D:\PROGRA~1

\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - D:\PROGRA~1

\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - D:\WINDOWS\system32

\mshtml.dll
O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - D:\WINDOWS\system32

\mshtml.dll
O18 - Protocol: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - D:\WINDOWS\system32

\msvidctl.dll
O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - D:\WINDOWS\system32

\mshtml.dll
O18 - Protocol: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - D:\WINDOWS\system32

\wiascr.dll
O20 - Winlogon Notify: AtiExtEvent
O20 - Winlogon Notify: NavLogon
O21 - SSODL: DelayRun - {5A6F2F95-3191-433B-8533-EB0B596A7BAC} - D:\WINDOWS\system32

\941d62c0.dll
O23 - Service: Adobe LM Service (Adobe LM Service) - Adobe Systems - "D:\Program

Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"
O23 - Service: Ati HotKey Poller (Ati HotKey Poller) - ATI Technologies Inc. -

D:\WINDOWS\system32\ati2evxx.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. -

D:\WINDOWS\ATKKBService.exe
O23 - Service: DefWatch (DefWatch) - Symantec Corporation - D:\PROGRA~1\SYMANT~1

\SYMANT~1\DefWatch.exe
O23 - Service: Human Interface Device Access (HidServ) -  - D:\WINDOWS\system32

\svchost.exe -k netsvcs
O23 - Service: JMediaService (JMediaService) -  - D:\WINDOWS\system32\rundll32.exe

d:\progra~1\mmsass~1\mmssver.dll,service
O23 - Service: Macromedia Licensing Service (Macromedia Licensing Service) -  -

"D:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"
O23 - Service: Mysee2_Runtime (Mysee2_Runtime) - 北京高维视讯科技有限公司 -

D:\WINDOWS\system32\svchost.exe -k mysee2
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation

- D:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: Pml Driver HPZ12 (Pml Driver HPZ12) - HP - D:\WINDOWS\system32

\hpzipm12.exe
O23 - Service: Remote Log (Remote Log) -  - D:\WINDOWS\system32\servehost.exe
O23 - Service: 共享 USN 杂志阅读器服务 (usnsvc) - Microsoft Corporation -

D:\WINDOWS\system32\svchost.exe -k usnsvc
O23 - Service: XDownloadService (XDownloadService) -  - D:\WINDOWS\system32\rundll32.exe

"d:\windows\downloader.dll",run

弹出的东西如图：























PS:我用的是遨游浏览器，一直都挺好的，就这段时间不知道下载了什么东西，不小心给安装了，现在有时候页面会自动在遨游浏览器里弹出，也会弹出微软自带的IE。[img][/img]

---<接上>

图片还有如下:






页面弹出后跳转前的网站地址是如下图:




附件: 2612952006811125729.jpg

Logfile of HijackThis v1.99.1
Scan saved at 13:33:29, on 2006-8-11
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\ATKKBService.exe
D:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
D:\WINDOWS\system32\inetsrv\inetinfo.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\ATI Technologies\ATI.ACE\cli.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\WINDOWS\ALCWZRD.EXE
D:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
D:\Program Files\Winamp\winampa.exe
D:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe
D:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder\OrderReminder.exe
D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
D:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe
D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
D:\Program Files\DAEMON Tools\daemon.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\Program Files\MSNShell\BIN\MSNShell.exe
D:\WINDOWS\System32\svchost.exe
D:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
D:\WINDOWS\system32\hpzipm12.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
D:\WINDOWS\system32\Rundll32.exe
C:\Program Files\iMook\iMook.exe
D:\Program Files\Maxthon\Maxthon.exe
D:\Program Files\Adobe\Photoshop CS\Photoshop.exe
D:\DOCUME~1\ericdong\LOCALS~1\Temp\~e5d141.tmp
D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
D:\DOCUME~1\ericdong\LOCALS~1\Temp\~e5d141.tmp
D:\WINDOWS\system32\conime.exe
F:\软件\ha_hijackthis_1991注册表扫描工具\HijackThis.exe

R3 - URLSearchHook: (no name) - {BB936323-19FA-4521-BA29-ECA6A121BC78} - (no file)
O2 - BHO: wmpdrm - {0E674588-66B7-4E19-9D0E-2053B800F69F} - D:\WINDOWS\system32\wmpdrm.dll
O2 - BHO: wmpdrm - {0E674588-66B7-4E19-9D0E-2053B800F69F}? - (no file)
O2 - BHO: hbieobj Class - {147E230B-FC8D-4A66-AB96-FFD464A9B2A3} - D:\PROGRA~1\pcast\hbcast.dll (file missing)
O2 - BHO: (no name) - {147E230B-FC8D-4A66-AB96-FFD464A9B2A3}? - (no file)
O2 - BHO: KOSIE HelperInternet Explorer Web Content Guard  - {1B2F92A1-CDAF-4511-9382-91E3F5CE0880}? - (no file)
O2 - BHO: 1 - {E78F50F9-51CF-40EC-AE3F-4F802528150B} - D:\WINDOWS\Downloader.dll
O2 - BHO: 1 - {E78F50F9-51CF-40EC-AE3F-4F802528150B}? - (no file)
O2 - BHO: (no name) - {F2E37336-BFDB-409B-8D0E-6F013C438B20}? - (no file)
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - D:\WINDOWS\system32\KakaTool.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [ATICCC] "D:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [vptray] D:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [IMSCMig] D:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [StatusClient 2.6] D:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe /auto
O4 - HKLM\..\Run: [TomcatStartup 2.5] D:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe
O4 - HKLM\..\Run: [OrderReminder] D:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [HP Software Update] D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TotalRecorderScheduler] "D:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe"
O4 - HKLM\..\Run: [yb6x0i] RunDll32 "D:\WINDOWS\Downlo~1\yb6x0i.dll",Run
O4 - HKLM\..\Run: [iMookWaiting] C:\Program Files\iMook\iMookWaiting.exe
O4 - HKLM\..\Run: [Mysee Alert] "D:\Program Files\GAOV\Mysee Alert\Mysee Alert.exe" -notray
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [spoolsv] D:\WINDOWS\system32\spoolsv\spoolsv.exe -printer
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [googletalk] "D:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [MSNShell] D:\Program Files\MSNShell\BIN\MSNShell.exe autorun
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?SystemRoot%\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\Program Files\haha\AddToNetDisk.htm
O8 - Extra context menu item: 使用影音传送带下载 - D:\Program Files\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: 使用网络传送带下载 - D:\Program Files\NetXfer\NXAddLink.html
O8 - Extra context menu item: 使用网际快车下载 - D:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Program Files\haha\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Program Files\haha\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Program Files\haha\SendMMS.htm
O8 - Extra context menu item: 用WanMP3搜索播放 - res://WanMP3.ocx/search.htm
O8 - Extra context menu item: 设为 Messenger Live 头像 - D:\Program Files\MSNShell\BIN\SetMSNDP.htm
O9 - Extra button: MSN Shell 4 - {0713E8D2-850A-101B-AFC0-4210102A8DA7} - D:\Program Files\MSNShell\Bin\MSNShell.exe
O9 - Extra 'Tools' menuitem: MSN Shell 4 - {0713E8D2-850A-101B-AFC0-4210102A8DA7} - D:\Program Files\MSNShell\Bin\MSNShell.exe
O9 - Extra button: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\haha\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\haha\QQ.EXE
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\haha\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\haha\QQIEHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (CEditCtrl Object) - https://img.alipay.com/download/1007/aliedit.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://ajin20035.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {52DF16E3-6C4F-4B22-8BAF-09263E463B48} - http://zs.kingsoft.com/KOSInit.cab
O16 - DPF: {53AF6E02-F18F-4228-AC13-3E79773FBE50} (CMCBooter Object) - http://download.mysee.com/plugin/booter.cab
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AXSafeControls.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {E787FD25-8D7C-4693-AE67-9406BC6E22DF} (CPasswordEditCtrl Object) - https://www.tenpay.com/download/qqedit.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: NavLogon - D:\WINDOWS\system32\NavLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - D:\WINDOWS\ATKKBService.exe
O23 - Service: DefWatch - Symantec Corporation - D:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - D:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - D:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: Pml Driver HPZ12 - HP - D:\WINDOWS\system32\hpzipm12.exe
O23 - Service: Remote Log - Unknown owner - D:\WINDOWS\system32\ServeHost.exe (file missing)

这是流氓软件或者是间谍软件造成的。用超级兔子清理王清理一下
www.pctutu.com
卡卡助手“疑难杂症”好像也能对付这东西。

开始→运行→输入services.msc，打开“服务”→查找 XDownloadService→双击→启动类型→禁止→停止→应用→确定。禁止XDownloadService这个服务
下载超级兔子。
http://www.pctutu.com/srmsdown.asp
安装好后，打开“超级兔子清理王”“专业卸载,卸载所有提示的垃圾软件，卸载是不要打开任何浏览窗口。卸载不了可以重启后再去卸载。
卸载完后完重启。
删除
d:\windows\downloader.dll
请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。

谢谢"我无邪",刚才我用RogueCleaner,在安全模式下清理了一遍机器(之前一直都是在系统正常模式下弄的),还删了个控件,现在好像好了~~如果还有问题就按照你的方法弄一遍,然后把日志贴上来.谢谢:)