我遇到了一个奇怪的问题,现象是会弹出广告! bbs.ikaka.com

abc128 - 2006-9-3 23:46:00

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><; C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation]
<Realplayer.exe><C:\WINDOWS\system32\Realplayer.exe> []
<eMuleAutoStart><; F:\Program Files\eMule\eMule.exe -AutoStart> [http://www.emule.org.cn]
<Kugoo><; C:\PROGRA~1\KuGoo\kugoo.exe> [KuGoo(酷狗)]
<MS Updating Utility><; msupdater.exe> []
<MsnMsgr><; "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background> [Microsoft Corporation]
<PcSync><; C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog> [Time Information Services Ltd.]
<UniTuner><; > []
<Wireless Presenter><; C:\Program Files\Nokia\Nokia Wireless Presenter\Wireless Presenter.exe /NOSPLASH> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<AdslTime><C:\Program Files\WsSoft\上网计时\AdslTime.exe hide> []
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation]
<RfwMain><"C:\Program Files\rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
<BluetoothAuthenticationAgent><rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent> [Microsoft Corporation]
<IMEKRMIG6.1><C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE> [Microsoft Corporation]
<SoundMan><SOUNDMAN.EXE> [Realtek Semiconductor Corp.]
<NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [NVIDIA Corporation]
<nwiz><nwiz.exe /install> [NVIDIA Corporation]
<NvMediaCenter><; RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit> [NVIDIA Corporation]
<SsAAD.exe><; C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe> []
<RavTask><; "C:\Program Files\rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<spoolsv><; C:\WINDOWS\system32\spoolsv\spoolsv.exe -printer> [广州傲讯信息科技有限公司]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]
<BigDogPath><C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera 301x> []
<Realplayer.exe><C:\WINDOWS\system32\Realplayer.exe> []
<AutoData><; > []
<AutoInsQyule><; > []
<CnsMin><; Rundll32.exe ?,Rundll32> []
<DataLayer><; C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe> [Nokia Mobile Phones Ltd.]
<Desktop><; C:\WINDOWS\system32\rundll32.exe "C:\Program Files\DeskAdTop\Run.dll" ,Rundll> []
<ezShieldProtector for Px><; C:\WINDOWS\System32\ezSP_Px.exe> [Easy Systems Japan Ltd.]
<ICQ Lite><; C:\Program Files\ICQLite\ICQLite.exe -minimize> [ICQ Ltd.]
<InCD><; C:\Program Files\Ahead\InCD\InCD.exe> [Nero AG]
<KernelFaultCheck><; %systemroot%\system32\dumprep 0 -k> []
<KnightIII><; "C:\Program Files\rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<KsgUpdateRun><; C:\Program Files\Common Files\kingsoft\KSG\client.exe> []
<MINI_BFYY><; > []
<Mirabilis ICQ><; C:\PROGRA~1\ICQ\ICQNet.exe> []
<NeroFilterCheck><; C:\WINDOWS\system32\NeroCheck.exe> [Ahead Software Gmbh]
<P XQQ><; F:\工具\飘雪PXQQ\PXQQ.exe> []
<PCSuiteTrayApplication><; C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray> [Nokia]
<poco><; > []
<QuickTime Task><; > []
<RichMedia><; C:\WINDOWS\system32\Rundll32.exe "C:\PROGRA~1\hbclient\HBHelper.dll",WaitWindows> []
<Skype><; > []
<StormCodec_Helper><; "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti> []
<TkBellExe><; "realsched.exe" -osboot> []
<TProgram><; > []
<WinampAgent><; C:\Program Files\Winamp\winampa.exe> []
<YLive.exe><; > []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><EXPLORER.EXE> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]

==================================
启动文件夹
[Adobe Reader Speed Launch]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Reader Speed Launch.lnk><N>
[蓝牙控制盘]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\蓝牙控制盘.lnk><N>
[Winamp (2)]
<C:\Documents and Settings\Haoqiangxu\「开始」菜单\程序\启动\Winamp (2).lnk><N>

==================================
服务
[Adobe LM Service / Adobe LM Service]
<"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>
[aucup / aucup]
<><N/A>
[aukld / aukld]
<><N/A>
[Bluetooth Service / btwdins]
<C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe><Broadcom Corporation.>
[InCD Helper / InCDsrv]
<C:\Program Files\Ahead\InCD\InCDsrv.exe><Nero AG>
[InCD Helper (read only) / InCDsrvR]
<C:\Program Files\Ahead\InCD\InCDsrv.exe -r><Nero AG>
[JMediaService / JMediaService]
<C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\MMSASS~1\MMSSVER.DLL,Service><N/A>
[Macromedia Licensing Service / Macromedia Licensing Service]
<"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><N/A>
[mms-up / mms-up]
<><N/A>
[MSCSPTISRV / MSCSPTISRV]
<"C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe"><Sony Corporation>
[svchost / msnmsgr]
<><N/A>
[MD Simple Burner Service / NetMDSB]
<C:\Program Files\Sony\MD Simple Burner\NetMDSB.exe><Sony Corporation>
[NVIDIA Display Driver Service / NVSvc]
<C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[PACSPTISVR / PACSPTISVR]
<"C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe"><Sony Corporation>
[Rising Proxy Service / RfwProxySrv]
<c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService]
<c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter]
<"C:\Program Files\rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Sony SPTI Service / SPTISRV]
<"C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe"><Sony Corporation>
[SonicStage SCSI Service / SSScsiSV]
<C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe><Sony Corporation>

abc128 - 2006-9-3 23:48:00

==================================
浏览器加载项
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v8.dll, >
[Adobe PDF Reader Link Helper]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[wmpdrm]
{0E674588-66B7-4E19-9D0E-2053B800F69F} <C:\WINDOWS\system32\wmpdrm.dll, Allsum Info. Tech. Ltd.>
[Yahoo!Photo]
{33BBE430-0E42-4f12-B075-8D21ACB10DCB} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll, N/A>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[DragSearch BHO]
{62EED7C6-9F02-42f9-B634-98E2899E147B} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL, N/A>
[Vision]
{6671A431-5C3D-463d-A7CF-5587F9B7E191} <C:\PROGRA~1\MMSASS~1\mmsass~1.dll, >
[IeCatch2 Class]
{A5366673-E8CA-11D3-9CD9-0090271D075B} <C:\PROGRA~1\FlashGet\jccatch.dll, Amaze Soft>
[]
{A9930D97-9CF0-42A0-A10D-4F28836579D5} <C:\PROGRA~1\KuGoo2\KUGOO3~1.OCX, N/A>
[NTIECatcher Class]
{C56CB6B0-0D96-11D6-8C65-B2868B609932} <C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll, Xi>
[GMBar]
{FD9936EF-C90D-4914-9EAB-699612B11A47} <C:\WINDOWS\csapix.dll, N/A>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FlashGet\fgiebar.dll, Amaze Soft>
[CyberArticle Express]
{769A6A36-ED24-4376-BC7C-80225BF35698} <F:\D盘文件\CyberArticle\CyberArticle\CAExp.dll, shijun.com>
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v8.dll, >
[Adobe PDF Reader Link Helper]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[wmpdrm]
{0E674588-66B7-4E19-9D0E-2053B800F69F} <C:\WINDOWS\system32\wmpdrm.dll, Allsum Info. Tech. Ltd.>
[Yahoo!Photo]
{33BBE430-0E42-4F12-B075-8D21ACB10DCB} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll, N/A>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[DragSearch BHO]
{62EED7C6-9F02-42F9-B634-98E2899E147B} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL, N/A>
[Vision]
{6671A431-5C3D-463D-A7CF-5587F9B7E191} <C:\PROGRA~1\MMSASS~1\mmsass~1.dll, >
[IeCatch2 Class]
{A5366673-E8CA-11D3-9CD9-0090271D075B} <C:\PROGRA~1\FlashGet\jccatch.dll, Amaze Soft>
[]
{A9930D97-9CF0-42A0-A10D-4F28836579D5} <C:\PROGRA~1\KuGoo2\KUGOO3~1.OCX, N/A>
[NTIECatcher Class]
{C56CB6B0-0D96-11D6-8C65-B2868B609932} <C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll, Xi>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[GMBar]
{FD9936EF-C90D-4914-9EAB-699612B11A47} <C:\WINDOWS\csapix.dll, N/A>
[&使用迅雷下载]
<C:\Program Files\Sandai Technologies Inc\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
<C:\Program Files\Sandai Technologies Inc\Thunder\Program\GetAllUrl.htm, N/A>
[>>彩信发送<<]
<res://C:\PROGRA~1\MMSASS~1\mmsass~1.dll/mms.htm, N/A>
[上传到QQ网络硬盘]
<C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用CyberArticle保存当前网页...]
<F:\D盘文件\CyberArticle\CyberArticle\script\save.htm, N/A>
[使用CyberArticle保存更多内容...]
<F:\D盘文件\CyberArticle\CyberArticle\script\savex.htm, N/A>
[使用CyberArticle保存网页选中部分...]
<F:\D盘文件\CyberArticle\CyberArticle\script\savesel.htm, N/A>
[使用KuGoo3下载(&K)]
<C:\PROGRA~1\KuGoo2\KuGoo3DownX.htm, N/A>
[发送到 Bluetooth 设备(&B)...]
<C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm, N/A>
[添加到QQ自定义面板]
<C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 404][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 456][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 480][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 524][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 1, 0, 0>
[PID: 544][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 708][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 756][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 1, 0, 0>
[PID: 836][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 1, 0, 0>
[PID: 1004][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1036][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1060][c:\program files\rising\rfw\rfwsrv.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 32>
[c:\program files\rising\rfw\RfwRule.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 13>
[c:\program files\rising\rfw\rfwlog.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 6>
[c:\program files\rising\rfw\Rfwdrv.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 21>
[c:\program files\rising\rfw\MonDrv.dll] <rs><1, 0, 0, 4>
[c:\program files\rising\rfw\ProcLib.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 9>
[PID: 1196][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\bthcrp.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\WidcommSdk.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\wbtapi.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll] <Windows (R) 2000 DDK provider><5.00.2195.1620>
[PID: 1392][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1408][C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe] <Broadcom Corporation.><5.1.0.1100>
[PID: 1460][C:\WINDOWS\system32\rundll32.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\PROGRA~1\MMSASS~1\MMSSVER.DLL] <><1, 2, 0, 4>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 1, 0, 0>
[PID: 1504][C:\WINDOWS\system32\nvsvc32.exe] <NVIDIA Corporation><6.14.10.5672>
[PID: 1592][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 884][c:\program files\rising\rfw\RfwMain.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 52>
[c:\program files\rising\rfw\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23>
[c:\program files\rising\rfw\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[c:\program files\rising\rfw\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 940][C:\Program Files\WsSoft\上网计时\AdslTime.exe] <Ws-Soft><2, 2, 4, 0>
[PID: 1428][C:\WINDOWS\system32\rundll32.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1544][C:\WINDOWS\SOUNDMAN.EXE] <Realtek Semiconductor Corp.><5.0.18>
[PID: 1708][C:\WINDOWS\system32\RUNDLL32.EXE] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\NvMcTray.dll] <NVIDIA Corporation><6.14.10.5672>
[PID: 1724][C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe] <N/A><3.4.01.13062>
[PID: 1732][C:\Program Files\rising\Rav\RavTask.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
[C:\Program Files\rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Program Files\rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[PID: 1800][C:\WINDOWS\VM_STI.EXE] <VM.><4.2.610.4>
[C:\WINDOWS\system32\msdmo.dll] <N/A><N/A>
[PID: 1892][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 2012][C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\wbtapi.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\btosif.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\btwhidcs.DLL] <Broadcom Corporation.><5.1.0.1100>
[C:\Program Files\WIDCOMM\Bluetooth Software\BtBalloon.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\btrez.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\CSH.dll] <Blue Sky Software Corporation><2.00.039>
[C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll] <N/A><N/A>
[PID: 2028][C:\Program Files\Winamp\Winamp.exe] <Nullsoft><5.03a>

abc128 - 2006-9-3 23:48:00

[C:\Program Files\Winamp\Plugins\in_asfs.dll] <AudioSoft><1.30>
[C:\Program Files\Winamp\Plugins\in_cdda.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\in_dshow.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\in_midi.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\read_file.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\in_mod.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\in_mp3.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\in_mp4.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\in_nsv.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\in_vorbis.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\in_vqf.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\in_wave.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\in_wm.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\out_disk.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\out_ds.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\out_ds_ssrc.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\out_KB51chn.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\out_wave.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\out_wave_ssrc.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\gen_ctrlfreak.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\vis_ctrlfreak.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\gen_hotkeys.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\gen_jumpex.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\gen_ml.dll] <N/A><N/A>
[C:\WINDOWS\system32\PXDRV.DLL] <Sonic Solutions><1.01.34a>
[C:\WINDOWS\system32\PXMAS.DLL] <Sonic Solutions><2.4.4.501>
[C:\WINDOWS\system32\PXWAVE.DLL] <Sonic Solutions><2.4.4.501>
[C:\Program Files\Winamp\Plugins\gen_tray.dll] <N/A><N/A>
[PID: 352][C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\btins.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\btosif.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\BtAudioHelper.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\btrez.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\CSH.dll] <Blue Sky Software Corporation><2.00.039>
[C:\WINDOWS\system32\btosif_ol.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\btosif_olx.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\btosif_notes.dll] <Broadcom Corporation.><5.1.0.1100>
[PID: 2576][C:\Program Files\Cheating-Death\cdeath.exe] <N/A><N/A>
[PID: 2616][F:\Program Files\CGA Cs1.6 中文完全版\CSMate.exe] <SourceTec><1, 6, 0, 0>
[F:\Program Files\CGA Cs1.6 中文完全版\CSMate.dll] <SourceTec><1, 6, 0, 0>
[PID: 2968][C:\WINDOWS\system32\rundll32.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\DOCUME~1\HAOQIA~1\LOCALS~1\Temp\spoolsv.cpl] <N/A><N/A>
[C:\WINDOWS\csapix.dll] <N/A><N/A>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 1, 0, 0>
[PID: 3428][C:\WINDOWS\system32\Realplayer.exe] <N/A><N/A>
[PID: 3424][C:\WINDOWS\explorer.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\Rsvtub.dll] <N/A><N/A>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 1, 0, 0>
[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[C:\PROGRA~1\FlashGet\jccatch.dll] <Amaze Soft><1, 1, 4, 0>
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll] <Adobe Systems, Inc.><7.0.0.0>
[F:\Program Files\CGA Cs1.6 中文完全版\CSMate.dll] <SourceTec><1, 6, 0, 0>
[C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll] <N/A><N/A>
[C:\WINDOWS\system32\nvcpl.dll] <NVIDIA Corporation><6.14.10.5672>
[C:\Program Files\Ahead\InCD\incdshx.dll] <Nero AG><4, 3, 20, 1>
[C:\WINDOWS\system32\nvshell.dll] <NVIDIA Corporation><6.14.10.5672>
[C:\WINDOWS\system32\NVWRSZHC.DLL] <NVIDIA Corporation><6.14.10.5672>
[C:\WINDOWS\system32\msdmo.dll] <N/A><N/A>
[C:\Program Files\rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll] <Nokia><6, 60, 4, 7>
[C:\WINDOWS\system32\ConnAPI.DLL] <Nokia.><6, 60, 21, 1>
[C:\Program Files\Nokia\Nokia PC Suite 6\PCSCM.dll] <Nokia><6, 60, 45, 3>
[C:\Program Files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_chi-sc.nlr] <Nokia><6, 60, 5, 0>
[C:\Program Files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr] <Nokia><6, 60, 1, 0>
[C:\WINDOWS\system32\btncopy.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\btneighborhood.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\wbtapi.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\btwpimif.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\btosif.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\btrez.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\CSH.dll] <Blue Sky Software Corporation><2.00.039>
[C:\WINDOWS\system32\BtXpPanel.Dll] <Broadcom Corporation.><5.1.0.1100>
[C:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[C:\Program Files\全能音频转换通\ShellEx.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\qdshm.dll] <><1, 0, 101, 20>
[C:\Program Files\ICQLite\ICQLiteShell.dll] <><20, 32, 2309, 0>
[PID: 2396][C:\Program Files\Tencent\QQ\QQ.exe] <TENCENT><0, 0, 0, 0>
[C:\Program Files\Tencent\QQ\QQBaseClassInDll.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\QQHelperDll.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\BasicCtrlDll.dll] <Tencent><5, 0, 200, 160>
[C:\Program Files\Tencent\QQ\QQAPI.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\TIMProxy.dll] <tencent><0, 3, 2, 4>
[C:\Program Files\Tencent\QQ\LoginCtrl.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\npkcntc.dll] <INCA Internet Co., Ltd.><2006, 3, 2, 1>
[C:\Program Files\Tencent\QQ\npkpdb.dll] <INCA Internet Co., Ltd.><2003, 10, 1, 1>
[F:\Program Files\CGA Cs1.6 中文完全版\CSMate.dll] <SourceTec><1, 6, 0, 0>
[C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\QQRes.dll] <tencent><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\QQMainFrame.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\CQQApplication.dll] <N/A><N/A>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 1, 0, 0>
[C:\Program Files\Tencent\QQ\NewSkin.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\HostingMgr.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\CameraDll.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\MailSummary.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\QQSpace.dll] <><1, 0, 0, 1>
[C:\WINDOWS\system32\msdmo.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\QQGroupMng.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\GroupLive.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\UserDefinedHead.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\QQPlugin.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\QQConfigPlugin.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\QRingMng.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\PhoneAPI.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\DialerAllinOne.dll] <tencent><1, 4, 0, 0>
[C:\Program Files\Tencent\QQ\QQAllInOne.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\SCCore.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\QQPet.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\QQCustomFace.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\FlashAvatarDll.dll] <><1, 4, 0, 1>
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] <Adobe Systems, Inc.><9,0,16,0>
[C:\Program Files\Tencent\QQ\QQAvatar.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\QQSceneMng.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\LongConnection.dll] <tencent><5, 0, 200, 160>
[C:\Program Files\Tencent\QQ\QQSysMsgMng.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\GroupConnection.dll] <Tencent><5, 0, 202, 170>
[C:\Program Files\Tencent\QQ\BQQApplication.dll] <N/A><N/A>
[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[C:\Program Files\Tencent\QQ\CommercesMng.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2>
[C:\Program Files\Tencent\QQ\QQUdpGetFileLib.dll] <tencent><0, 2, 2, 3>
[C:\Program Files\Tencent\QQ\QQAddr.dll] <深圳市腾讯计算机系统有限公司><5, 0, 101, 200>
[C:\Program Files\Tencent\QQ\QQPhoneHelper.dll] <腾讯科技（深圳）有限公司><2, 0, 6, 60>

abc128 - 2006-9-3 23:48:00

[PID: 1700][C:\Program Files\Tencent\QQ\TIMPlatform.exe] <tencent><0, 3, 1, 8>
[C:\Program Files\Tencent\QQ\TIMProxy.dll] <tencent><0, 3, 2, 4>
[PID: 2260][C:\Program Files\BitComet\BitComet.exe] <www.BitComet.com><0.56.>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 1, 0, 0>
[PID: 3060][C:\Program Files\Opera\Opera.exe] <Opera Software><8552>
[C:\Program Files\Opera\Opera.dll] <Opera Software><8552>
[C:\Program Files\Opera\vxmplugin.dll] <Opera Software ASA><1, 0, 0, 1>
[C:\Program Files\Opera\vxm.dll] <N/A><N/A>
[C:\Program Files\Opera\xmlparse.dll] <N/A><N/A>
[C:\Program Files\Opera\vxmservices.dll] <N/A><N/A>
[C:\Program Files\Opera\ecictts.dll] <N/A><N/A>
[C:\Program Files\Opera\ecienus.syn] <N/A><N/A>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 1, 0, 0>
[C:\Program Files\Opera\Program\Plugins\NPSWF32.dll] <N/A><N/A>
[PID: 3536][C:\Program Files\Tencent\TT\TTraveler.exe] <深圳市腾讯计算机系统有限公司><2, 0, 15, 200>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 1, 0, 0>
[C:\Program Files\Tencent\TT\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 4>
[C:\Program Files\Tencent\TT\Plugins\QQFloatBar\QQFloatBar4TT2.dll] <深圳市腾讯计算机系统有限公司><1, 1, 0, 5>
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll] <Adobe Systems, Inc.><7.0.0.0>
[PID: 2128][C:\Documents and Settings\Haoqiangxu\桌面\sreng2\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 1, 0, 0>
[C:\Documents and Settings\Haoqiangxu\桌面\sreng2\SREng2\Plugins\SREngPluginDemo.SRE] <Smallfrogs Studio><1, 1, 1, 0>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

abc128 - 2006-9-3 23:53:00

谢谢你,我的电脑经常会弹出一个这样的窗口,好像自从出现上面说的那个自动弹出广告就同时出现这个了,这个窗口出现的情况也是在没开打开浏览器的情况下出现的,希望对解决问题有帮助~!谢谢~!

附件: 743157200693234523.jpg

abc128 - 2006-9-5 19:57:00

找不到原因吗?

KIDGIN - 2006-9-5 21:04:00

1开始-运行-MSCONFIG-启动-除CTFMON外其他的全部勾掉.
2开始-运行-REGEDIT-按CTRL+F-输入恶意网址-查找-删除即可.
3建议用360安全卫士修复IE并杀毒

我无邪 - 2006-9-5 21:05:00

下载超级兔子,专业卸载。
http://www.pctutu.com/news.asp?id=92
安装好后，打开“winspeed”“专业卸载,卸载所有提示的垃圾软件，卸载是不要打开任何浏览窗口。卸载不了可以重启后再去卸载。

卸载完后
打开System Repair Engineer（也就是你的扫描日志软件SREng.exe），点“启动项目，服务，点“Win32服务应用程序”勾选“隐藏微软服务”选中病毒服务
aucup,aukld,mms-up,svchost，选择“删除服务”点“设置”选择“否”最后重启。（每一个逗号隔开的就是一个病毒的服务，请逐一删除）

请到http://forum.ikaka.com/topic.asp?board=67&artid=5188931，下载，LSPFix.exe，WinsockXPFix这两个软件
重新启动电脑, 开机检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式进入Windows
打开System Repair Engineer（也就是你的扫描日志软件SREng.exe），使用“启动项目，注册表”来删除以下选项。
msupdater.exe
运行LSPFix.exe
删除
wshcon32.dll
附说明一份
LSPFix.exe这个软件主要用来辅助修复HijackThis扫描发现的O10项。
使用时，请关闭所有IE界面和文件夹界面后运行LSPFix，运行后，把要修复的那一个O10项从左边转到右边，点“Finish”即可。（不过这之前，需要在“I know what I`m doing”前面打勾。）
双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示确定更改时，单击“是”，清除“隐藏已知文件类型的扩展名
删除
C:\WINDOWS\system32\wshcon32.dll
C:\WINDOWS\system32\msupdater.exe
修复后重启，如果无法上网，请运行WinsockXPFix，让它修复一下。
回到正常模式，请再扫日志粘上来。

C:\WINDOWS\system32\Realplayer.exe这一项看以下的帖子
关于www.7939.com劫持的解决方法（Realplayer.exe）
http://forum.ikaka.com/topic.asp?board=67&artid=8155668
完后重启，再扫个日志粘上来。

abc128 - 2006-9-6 19:10:00

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation]
<BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}><; "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"> []
<eMuleAutoStart><; ; F:\Program Files\eMule\eMule.exe -AutoStart> []
<Kugoo><; ; C:\PROGRA~1\KuGoo\kugoo.exe> []
<MsnMsgr><; ; "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background> []
<PcSync><; ; C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog> []
<UniTuner><; ; > []
<Wireless Presenter><; ; C:\Program Files\Nokia\Nokia Wireless Presenter\Wireless Presenter.exe /NOSPLASH> []
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
<run><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<AdslTime><C:\Program Files\WsSoft\上网计时\AdslTime.exe hide> []
<NvCplDaemon><; RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [NVIDIA Corporation]
<Realplayer.exe><; C:\WINDOWS\system32\Realplayer.exe> []
<Realplayer.e|?><; C:\WINDOWS\system32\Realplayer.exe> []
<SsAAD.exe><; C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]

==================================
启动文件夹
[蓝牙控制盘]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\蓝牙控制盘.lnk><N>
[Winamp (2)]
<C:\Documents and Settings\Haoqiangxu\「开始」菜单\程序\启动\Winamp (2).lnk><N>

==================================
服务
[Adobe LM Service / Adobe LM Service]
<"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>
[Bluetooth Service / btwdins]
<C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe><Broadcom Corporation.>
[Macromedia Licensing Service / Macromedia Licensing Service]
<"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><N/A>
[MSCSPTISRV / MSCSPTISRV]
<"C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe"><Sony Corporation>
[MD Simple Burner Service / NetMDSB]
<C:\Program Files\Sony\MD Simple Burner\NetMDSB.exe><Sony Corporation>
[NVIDIA Display Driver Service / NVSvc]
<C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[PACSPTISVR / PACSPTISVR]
<"C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe"><Sony Corporation>
[Rising Proxy Service / RfwProxySrv]
<c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService]
<c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter]
<"C:\Program Files\rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Sony SPTI Service / SPTISRV]
<"C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe"><Sony Corporation>
[SonicStage SCSI Service / SSScsiSV]
<C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe><Sony Corporation>

==================================
浏览器加载项
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FlashGet\fgiebar.dll, Amaze Soft>
[CyberArticle Express]
{769A6A36-ED24-4376-BC7C-80225BF35698} <F:\D盘文件\CyberArticle\CyberArticle\CAExp.dll, shijun.com>
[Windows Live Toolbar]
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} <C:\Program Files\Windows Live Toolbar\msntb.dll, N/A>
[Adobe PDF Reader Link Helper]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, N/A>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, N/A>
[IeCatch2 Class]
{A5366673-E8CA-11D3-9CD9-0090271D075B} <C:\PROGRA~1\FlashGet\jccatch.dll, N/A>
[]
{A9930D97-9CF0-42A0-A10D-4F28836579D5} <C:\PROGRA~1\KuGoo2\KUGOO3~1.OCX, N/A>
[Windows Live Toolbar]
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} <C:\Program Files\Windows Live Toolbar\msntb.dll, N/A>
[Windows Live Toolbar Helper]
{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} <C:\Program Files\Windows Live Toolbar\msntb.dll, N/A>
[NTIECatcher Class]
{C56CB6B0-0D96-11D6-8C65-B2868B609932} <C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll, N/A>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[GMBar]
{FD9936EF-C90D-4914-9EAB-699612B11A47} <C:\WINDOWS\csapix.dll, N/A>

abc128 - 2006-9-6 19:10:00

[&使用迅雷下载]
<C:\Program Files\Sandai Technologies Inc\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
<C:\Program Files\Sandai Technologies Inc\Thunder\Program\GetAllUrl.htm, N/A>
[上传到QQ网络硬盘]
<C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用网际快车下载]
<C:\Program Files\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<C:\Program Files\FlashGet\jc_all.htm, N/A>
[添加到QQ自定义面板]
<C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 396][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 444][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 468][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 512][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 1, 0, 0>
[PID: 532][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 696][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 744][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 1, 0, 0>
[PID: 824][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 1, 0, 0>
[PID: 960][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1028][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1056][c:\program files\rising\rfw\rfwsrv.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 32>
[c:\program files\rising\rfw\RfwRule.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 13>
[c:\program files\rising\rfw\rfwlog.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 6>
[c:\program files\rising\rfw\Rfwdrv.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 21>
[c:\program files\rising\rfw\MonDrv.dll] <rs><1, 0, 0, 4>
[c:\program files\rising\rfw\ProcLib.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 9>
[PID: 1192][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\bthcrp.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\WidcommSdk.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\wbtapi.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll] <Windows (R) 2000 DDK provider><5.00.2195.1620>
[PID: 1496][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll] <Adobe Systems, Inc.><7.0.0.0>
[C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll] <N/A><N/A>
[C:\Program Files\rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 1584][c:\program files\rising\rfw\RfwMain.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 52>
[c:\program files\rising\rfw\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23>
[c:\program files\rising\rfw\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[c:\program files\rising\rfw\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 1656][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1672][C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe] <Broadcom Corporation.><5.1.0.1100>
[PID: 1732][C:\WINDOWS\system32\nvsvc32.exe] <NVIDIA Corporation><6.14.10.5672>
[PID: 1868][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1336][C:\Program Files\WsSoft\上网计时\AdslTime.exe] <Ws-Soft><2, 2, 4, 0>
[PID: 1420][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1960][C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\wbtapi.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\btosif.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\btwhidcs.DLL] <Broadcom Corporation.><5.1.0.1100>
[C:\Program Files\WIDCOMM\Bluetooth Software\BtBalloon.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\btrez.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\CSH.dll] <Blue Sky Software Corporation><2.00.039>
[C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll] <N/A><N/A>
[PID: 1968][C:\Program Files\Winamp\Winamp.exe] <Nullsoft><5.03a>
[C:\Program Files\Winamp\Plugins\in_asfs.dll] <AudioSoft><1.30>
[C:\Program Files\Winamp\Plugins\in_cdda.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\in_dshow.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\in_midi.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\read_file.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\in_mod.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\in_mp3.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\in_mp4.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\in_nsv.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\in_vorbis.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\in_vqf.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\in_wave.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\in_wm.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\out_disk.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\out_ds.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\out_ds_ssrc.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\out_KB51chn.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\out_wave.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\out_wave_ssrc.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\gen_ctrlfreak.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\vis_ctrlfreak.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\gen_hotkeys.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\gen_jumpex.dll] <N/A><N/A>
[C:\Program Files\Winamp\Plugins\gen_ml.dll] <N/A><N/A>
[C:\WINDOWS\system32\PXDRV.DLL] <Sonic Solutions><1.01.34a>
[C:\WINDOWS\system32\PXMAS.DLL] <Sonic Solutions><2.4.4.501>
[C:\WINDOWS\system32\PXWAVE.DLL] <Sonic Solutions><2.4.4.501>
[C:\Program Files\Winamp\Plugins\gen_tray.dll] <N/A><N/A>
[PID: 320][C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\btins.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\btosif.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\BtAudioHelper.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\btrez.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\CSH.dll] <Blue Sky Software Corporation><2.00.039>
[C:\WINDOWS\system32\btosif_ol.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\btosif_olx.dll] <Broadcom Corporation.><5.1.0.1100>
[C:\WINDOWS\system32\btosif_notes.dll] <Broadcom Corporation.><5.1.0.1100>
[PID: 3228][C:\Documents and Settings\Haoqiangxu\桌面\sreng2\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 1, 0, 0>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

abc128 - 2006-9-6 19:24:00

这次的日志少了这么多的?
很谢谢你.
我在C:\WINDOWS\system32\下删除不了wshcon32.dll.
我找不到C:\WINDOWS\system32\目录下的msupdater.exe
"www.7939.com"这个好像用超级白兔子时已经删了.现在还会弹出那个窗口出来(如下图)
被"www.7939.com"劫持的一个特征是任务管理器里的进程里有"Realplayer.exe"但我的是没有的,而且是也没有发现Realplayer.exe这个文件,可能真被超级白兔子搞掂了.
不过我发现有时会出现一个"iexplore.ee"和"iexplore.exe"这两个进程会自动消失的,没试过同时出现,出现时我没有打开IE浏览器的.

附件: 743157200696191601.jpg

秋日里的蓝天 - 2006-9-6 19:39:00

楼主有两项没有修复，这两项都是病毒
可以按我以下的方法和我无邪朋友的方法修复

C:\WINDOWS\system32\Realplayer.exe

启动项
C:\WINDOWS\system32\Realplayer.exe
C:\WINDOWS\system32\Realplayer.exe
运行中的程序
C:\WINDOWS\system32\brlmon.dll

解决方法
解决方法如下
双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示确定更改时，单击“是”，清除“隐藏已知文件类型的扩展名
ALT+CTRL+DELETE调出任务管理器,终止explorer.exe 还有Realplayer.exe的进程
点“文件”“新任务”“浏览”找到C:\WINDOWS\system32\Realplayer.exe
删除Realplayer.exe
点“文件”“新任务”“浏览”找到C:\WINDOWS\explorer.exe,双击打开

运行(双击)System Repair Engineer，使用“启动项目，注册表”来删除以下选项。
C:\WINDOWS\system32\Realplayer.exe
C:\WINDOWS\system32\Realplayer.exe
删除
C:\WINDOWS\system32\brlmon.dll
把主页改回来。

运行LSPFix.exe
删除
wshcon32.dll
附说明一份
LSPFix.exe这个软件主要用来辅助修复HijackThis扫描发现的O10项。
使用时，请关闭所有IE界面和文件夹界面后运行LSPFix，运行后，把要修复的那一个O10项从左边转到右边，点“Finish”即可。（不过这之前，需要在“I know what I`m doing”前面打勾。）
双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示确定更改时，单击“是”，清除“隐藏已知文件类型的扩展名
删除
C:\WINDOWS\system32\wshcon32.dll
C:\WINDOWS\system32\msupdater.exe
修复后重启，如果无法上网，请运行WinsockXPFix，让它修复一下。

回到正常模式，请再扫日志粘上来。

瑞星卡卡安全论坛