老弹出一个YAHOO音乐的广告还有易趣的一个..无奈啊斑竹来看看谢谢~ bbs.ikaka.com

sadfadb - 2006-9-15 20:09:00

Logfile of Kaka v2. 0. 0. 9 Scan Module v2. 0. 0. 1
Scan saved at 19:52:39, on 2006-09-15
Platform: Microsoft Windows XP Professional Service Pack 2 (Build 2600)
MSIE: Internet Explorer v6.00 SP2; (6.00.2900.2180 (xpsp_sp2_rtm.040803-2158))

Running processes:
[smss.exe]
CommandLine =

[csrss.exe]
CommandLine = C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

[winlogon.exe]
CommandLine = winlogon.exe

[SERVICES.EXE]
CommandLine = C:\WINDOWS\system32\services.exe

[LSASS.EXE]
CommandLine = C:\WINDOWS\system32\lsass.exe

[SVCHOST.EXE]
CommandLine = C:\WINDOWS\system32\svchost -k DcomLaunch

[SVCHOST.EXE]
CommandLine = C:\WINDOWS\system32\svchost -k rpcss

[SVCHOST.EXE]
CommandLine = C:\WINDOWS\System32\svchost.exe -k netsvcs

[SVCHOST.EXE]
CommandLine = C:\WINDOWS\system32\svchost.exe -k NetworkService

[SVCHOST.EXE]
CommandLine = C:\WINDOWS\system32\svchost.exe -k LocalService

[Explorer.EXE]
CommandLine = C:\WINDOWS\Explorer.EXE

[spoolsv.exe]
CommandLine = C:\WINDOWS\system32\spoolsv.exe

[RTHDCPL.EXE]
CommandLine = "C:\WINDOWS\RTHDCPL.EXE"

[VM_STI.EXE]
CommandLine = "C:\WINDOWS\VM_STI.EXE" BigDog

[daemon.exe]
CommandLine = "C:\Program Files\D-Tools\daemon.exe" -lang 1033

[ctfmon.exe]
CommandLine = "C:\WINDOWS\system32\ctfmon.exe"

[nvsvc32.exe]
CommandLine = C:\WINDOWS\system32\nvsvc32.exe

[tsakmgr.exe]
CommandLine = c:\windows\system32\tsakmgr.exe

[SVCHOST.EXE]
CommandLine = C:\WINDOWS\system32\svchost.exe -k imgsvc

[wdfmgr.exe]
CommandLine = C:\WINDOWS\system32\wdfmgr.exe

[TheWorld.exe]
CommandLine = "G:\TheWorldFull\TheWorld.exe" "http://www.kubao.com/"

[alg.exe]
CommandLine = C:\WINDOWS\System32\alg.exe

[QQ.exe]
CommandLine = "C:\Program Files\QQ2006\QQ.exe"

[TIMPlatform.exe]
CommandLine = "C:\Program Files\QQ2006\TIMPlatform.exe" -Embedding

[Game.exe]
CommandLine = "D:\水浒Q传\game.exe" zy@fs

[PPStream.exe]
CommandLine = "G:\PPStream\PPStream.exe"

[CONIME.EXE]
CommandLine = C:\WINDOWS\system32\conime.exe

[KkScan.exe]
CommandLine = "G:\kaka\KkScan.exe"

[TheWorld.exe]
CommandLine = "G:\TheWorldFull\TheWorld.exe" "http://forum.ikaka.com/list.asp?board=67&u=RSTB"

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\system32\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.hao123.com/
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: 超级兔子上网精灵 - {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} - G:\SUPERR~1\MAGICSET\haokanbar.dll (file missing)
O3 - Toolbar: BitComet工具栏 - {3F1ABCDB-A875-46c1-8345-B72A4567E486} - G:\BitComet\BitCometBar\BitCometBar0.6.dll
O3 - Toolbar: 超级兔子上网精灵 - {43869BB3-22FD-4F15-9B46-238106BA2F4E} - G:\SUPERR~1\MAGICSET\haokanbar.dll (file missing)
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Vimicro USB PC Camera (ZC0301PL)
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [kis] "G:\kav\avp.exe"
O4 - Startup: desktop.ini =
O4 - Global Startup: desktop.ini =
O8 - Extra context menu item: 使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: 使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\Mshtml.dll
O18 - Protocol: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll
O18 - Protocol: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ipp - (no CLSID) - (no file)
O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll
O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\Mshtml.dll
O18 - Protocol: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\Mshtml.dll
O18 - Protocol: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll
O18 - Protocol: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll
O18 - Protocol: msdaipp - (no CLSID) - (no file)
O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\Mshtml.dll
O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\Mshtml.dll
O18 - Protocol: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll
O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\Mshtml.dll
O18 - Protocol: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll
O20 - Winlogon Notify: klogon
O23 - Service: 卡巴斯基互联网安全套装 6.0 (AVP) - Kaspersky Lab - G:\kav\avp.exe -r
O23 - Service: COM+ Agent (COM+ Agent) - - C:\WINDOWS\system32\ccontrol.exe
O23 - Service: Human Interface Device Access (HidServ) - - C:\WINDOWS\system32\svchost.exe -k netsvcs
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - "C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe"
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Volume Shadow Copyre2 (ServiceCopyre2) - - C:\WINDOWS\system32\tsakmgr.exe

我无邪 - 2006-9-15 20:37:00

打开System Repair Engineer（也就是你的扫描日志软件SREng.exe），点“启动项目，服务，点“Win32服务应用程序”勾选“隐藏微软服务”选中病毒服务Volume Shadow Copyre2，COM+ Agent ，选择“删除服务”点“设置”选择“否”最后重启
重启后删除
C:\WINDOWS\system32\ccontrol.exe
C:\WINDOWS\system32\tsakmgr.exe
请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。

我无邪 - 2006-9-15 20:38:00

以上是错误的，看以下的。

开始→运行→输入services.msc，打开“服务”→查找 Volume Shadow Copyre2，COM+ Agent →双击→启动类型→禁止→停止→应用→确定。禁止Volume Shadow Copyre2，COM+ Agent 这2个服务（每一个逗号隔开的就是一个病毒的服务，请逐一禁用）
重启后删除
C:\WINDOWS\system32\ccontrol.exe
C:\WINDOWS\system32\tsakmgr.exe
请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。

sadfadb - 2006-9-15 21:05:00

打开“服务”→查找 Volume Shadow Copyre2，COM+ Agent
没有 Volume Shadow Copyre2，COM+ Agent 怎么回事....

我无邪 - 2006-9-15 21:17:00

请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。

sadfadb - 2006-9-15 21:24:00

2006-09-15,20:46:17

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<RTHDCPL><RTHDCPL.EXE> [Realtek Semiconductor Corp.]
<Alcmtr><ALCMTR.EXE> [Realtek Semiconductor Corp.]
<NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [NVIDIA Corporation]
<nwiz><nwiz.exe /install> []
<NvMediaCenter><RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit> [NVIDIA Corporation]
<BigDogPath><C:\WINDOWS\VM_STI.EXE Vimicro USB PC Camera (ZC0301PL)> []
<DAEMON Tools-1033><"C:\Program Files\D-Tools\daemon.exe" -lang 1033> [DAEMON'S HOME]
<kis><"G:\kav\avp.exe"> [Kaspersky Lab]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation]
<PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> []
<PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation]
<UIHost><logonui.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
<WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll> [Kaspersky Lab]

==================================
启动文件夹
服务
[卡巴斯基互联网安全套装 6.0 / AVP]
<G:\kav\avp.exe -r><Kaspersky Lab>
[COM+ Agent / COM+ Agent]
<C:\WINDOWS\system32\CControl.exe><N/A>
[InstallDriver Table Manager / IDriverT]
<"C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe"><Macrovision Corporation>
[NVIDIA Display Driver Service / NVSvc]
<C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>

==================================
浏览器加载项
[超级兔子上网精灵]
{7369D35A-5B70-4A5B-B789-B25FE09B4AF3} <G:\SUPERR~1\MAGICSET\haokanbar.dll, N/A>
[BitComet工具栏]
{3F1ABCDB-A875-46c1-8345-B72A4567E486} <G:\BitComet\BitCometBar\BitCometBar0.6.dll, N/A>
[超级兔子上网精灵]
{43869BB3-22FD-4F15-9B46-238106BA2F4E} <G:\SUPERR~1\MAGICSET\haokanbar.dll, N/A>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[Windows Genuine Advantage Validation Tool]
{17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\Mshtml.dll, N/A>
[BitComet工具栏]
{3F1ABCDB-A875-46C1-8345-B72A4567E486} <G:\BitComet\BitCometBar\BitCometBar0.6.dll, N/A>
[超级兔子上网精灵]
{43869BB3-22FD-4F15-9B46-238106BA2F4E} <G:\SUPERR~1\MAGICSET\haokanbar.dll, N/A>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Helper Class]
{6E28339B-7A2A-47B6-AEB2-197004272379} <C:\WINDOWS\vchelper.dll, N/A>
[超级兔子上网精灵]
{7369D35A-5B70-4A5B-B789-B25FE09B4AF3} <G:\SUPERR~1\MAGICSET\haokanbar.dll, N/A>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>
[]
{A9930D97-9CF0-42A0-A10D-4F28836579D5} <G:\PROGRA~1\KuGoo3\KUGOO3~1.OCX, N/A>
[卡卡上网安全助手]
{AFF6E516-CBE5-4F8A-9C2F-38A68013E766} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9a.ocx, Adobe Systems, Inc.>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[使用迅雷下载]
<C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
[使用迅雷下载全部链接]
<C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>

==================================

sadfadb - 2006-9-15 21:24:00

正在运行的进程
[PID: 672][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 720][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 744][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\klogon.dll] <Kaspersky Lab><6.0.0.299>
[PID: 800][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 812][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 964][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1012][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1108][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1156][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1220][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1592][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\nvcpl.dll] <NVIDIA Corporation><6.14.10.8466>
[C:\WINDOWS\system32\NVRSZHC.DLL] <NVIDIA Corporation><6.14.10.8466>
[C:\WINDOWS\system32\nvshell.dll] <N/A><N/A>
[C:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[G:\kav\shellex.dll] <Kaspersky Lab><6.0.0.299>
[PID: 1664][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)>
[PID: 1836][C:\WINDOWS\RTHDCPL.EXE] <Realtek Semiconductor Corp.><2.0.4.4>
[PID: 1884][C:\WINDOWS\system32\RUNDLL32.EXE] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\NvMcTray.dll] <NVIDIA Corporation><6.14.10.8466>
[C:\WINDOWS\system32\NVRSZHC.DLL] <NVIDIA Corporation><6.14.10.8466>
[PID: 1892][C:\WINDOWS\VM_STI.EXE] <Vimicro><4, 2, 1124, 6>
[C:\WINDOWS\system32\msdmo.dll] <N/A><N/A>
[C:\WINDOWS\system32\VM31bPrp.Ax] <Vimicro><1.00.01.00>
[PID: 1900][C:\Program Files\D-Tools\daemon.exe] <DAEMON'S HOME><3.47.0.0>
[C:\WINDOWS\daemon.dll] <N/A><3.47.0.0>
[C:\Program Files\D-Tools\PFCTOC.DLL] <Padus(R), Inc.><1, 0, 0, 12>
[C:\Program Files\D-Tools\Plugins\Images\ccdmount.dll] <GENERIC><1.02.0.0>
[C:\Program Files\D-Tools\Plugins\Images\mdsmount.dll] <GENERIC><1.01.0.0>
[C:\Program Files\D-Tools\Plugins\Images\pdimount.dll] <GENERIC><1.01.0.0>
[C:\Program Files\D-Tools\Plugins\Images\nrgmount.dll] <GENERIC><1.02.0.0>
[C:\Program Files\D-Tools\Plugins\Images\bw5mount.dll] <N/A><1.0.2.0>
[PID: 1940][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 272][C:\WINDOWS\system32\nvsvc32.exe] <NVIDIA Corporation><6.14.10.8466>
[PID: 308][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 348][C:\WINDOWS\system32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: dnsrv(bld4act)>
[PID: 368][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 2356][G:\TheWorldFull\TheWorld.exe] <Phoenix Studio><1, 3, 2, 0>
[G:\THEWOR~1\Plugin\SysState\SysState.dll] <Phoenix Stdio><1, 0, 0, 4>
[C:\WINDOWS\system32\Macromed\Flash\Flash9a.ocx] <Adobe Systems, Inc.><9,0,0,296>
[PID: 3068][C:\Program Files\QQ2006\QQ.exe] <TENCENT><0, 0, 0, 0>
[C:\Program Files\QQ2006\QQBaseClassInDll.dll] <><1, 0, 0, 1>
[C:\Program Files\QQ2006\QQHelperDll.dll] <><1, 0, 0, 1>
[C:\Program Files\QQ2006\BasicCtrlDll.dll] <Tencent><5, 0, 200, 160>
[C:\Program Files\QQ2006\PYKer.dll] <飘云 http://www.pyqq.cn><飘云>
[C:\Program Files\QQ2006\ipsearcher.dll] <><1.0.0.3>
[C:\Program Files\QQ2006\QQAPI.dll] <><1, 0, 0, 1>
[C:\Program Files\QQ2006\TIMProxy.dll] <tencent><0, 3, 2, 4>
[C:\Program Files\QQ2006\LoginCtrl.dll] <><1, 0, 0, 1>
[C:\Program Files\QQ2006\npkcntc.dll] <INCA Internet Co., Ltd.><2006, 3, 2, 1>
[C:\Program Files\QQ2006\npkpdb.dll] <INCA Internet Co., Ltd.><2003, 10, 1, 1>
[C:\Program Files\QQ2006\QQRes.dll] <tencent><1, 0, 0, 1>
[C:\Program Files\QQ2006\QQMainFrame.dll] <N/A><N/A>
[C:\Program Files\QQ2006\CQQApplication.dll] <N/A><N/A>
[C:\Program Files\QQ2006\NewSkin.dll] <><1, 0, 0, 1>
[C:\Program Files\QQ2006\HostingMgr.dll] <><1, 0, 0, 1>
[C:\Program Files\QQ2006\CameraDll.dll] <><1, 0, 0, 1>
[C:\Program Files\QQ2006\MailSummary.dll] <><1, 0, 0, 1>
[C:\Program Files\QQ2006\QQSpace.dll] <><1, 0, 0, 1>
[C:\WINDOWS\system32\msdmo.dll] <N/A><N/A>
[C:\Program Files\QQ2006\QQGroupMng.dll] <><1, 0, 0, 1>
[C:\Program Files\QQ2006\GroupLive.dll] <N/A><N/A>
[C:\Program Files\QQ2006\QQAllInOne.dll] <N/A><N/A>
[C:\Program Files\QQ2006\SCCore.dll] <N/A><N/A>
[C:\Program Files\QQ2006\QQCustomFace.dll] <N/A><N/A>
[C:\Program Files\QQ2006\UserDefinedHead.dll] <><1, 0, 0, 1>
[C:\Program Files\QQ2006\QQPlugin.dll] <N/A><N/A>
[C:\Program Files\QQ2006\QQConfigPlugin.dll] <><1, 0, 0, 1>
[C:\Program Files\QQ2006\QRingMng.dll] <N/A><N/A>
[C:\Program Files\QQ2006\PhoneAPI.dll] <><1, 0, 0, 1>
[C:\Program Files\QQ2006\DialerAllinOne.dll] <tencent><1, 4, 0, 0>
[C:\Program Files\QQ2006\LongConnection.dll] <tencent><5, 0, 200, 160>
[C:\Program Files\QQ2006\FlashAvatarDll.dll] <><1, 4, 0, 1>
[C:\Program Files\QQ2006\ImageOle.dll] <TODO: <Company name>><1.0.0.1>
[C:\WINDOWS\system32\Macromed\Flash\Flash9a.ocx] <Adobe Systems, Inc.><9,0,0,296>
[C:\Program Files\QQ2006\QQSceneMng.dll] <N/A><N/A>
[C:\Program Files\QQ2006\QQAvatar.dll] <N/A><N/A>
[C:\Program Files\QQ2006\BQQApplication.dll] <N/A><N/A>
[C:\Program Files\QQ2006\QQSysMsgMng.dll] <N/A><N/A>
[C:\Program Files\QQ2006\CommercesMng.dll] <><1, 0, 0, 1>
[C:\Program Files\QQ2006\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2>
[C:\Program Files\QQ2006\QQUdpGetFileLib.dll] <tencent><0, 2, 2, 3>
[C:\Program Files\QQ2006\QQAddr.dll] <深圳市腾讯计算机系统有限公司><5, 0, 101, 200>
[C:\Program Files\QQ2006\QQPhoneHelper.dll] <腾讯科技（深圳）有限公司><2, 0, 6, 60>
[PID: 3104][C:\Program Files\QQ2006\TIMPlatform.exe] <tencent><0, 3, 1, 8>
[C:\Program Files\QQ2006\TIMProxy.dll] <tencent><0, 3, 2, 4>
[PID: 3340][G:\TheWorldFull\TheWorld.exe] <Phoenix Studio><1, 3, 2, 0>
[G:\THEWOR~1\Plugin\SysState\SysState.dll] <Phoenix Stdio><1, 0, 0, 4>
[C:\WINDOWS\system32\Macromed\Flash\Flash9a.ocx] <Adobe Systems, Inc.><9,0,0,296>
[PID: 3956][C:\WINDOWS\system32\wuauclt.exe] <Microsoft Corporation><5.8.0.2469 built by: lab01_n(wmbla)>
[PID: 2596][G:\kaka\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[PID: 1576][C:\WINDOWS\system32\taskmgr.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

瑞星卡卡安全论坛