【求助】QQ老提示激活，高手指点！附两个日志！在线等待 bbs.ikaka.com

4805 - 2006-10-10 8:32:00

HijackThis_zww汉化版扫描日志 V1.99.1
保存于 8:22:55, 日期 2006-10-10
操作系统： Windows 2000 SP4 (WinNT 5.00.2195)
浏览器： Internet Explorer v6.00 SP1 (6.00.2800.1106)

当前运行的进程：
C:\WINNT\Explorer.EXE
D:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\KV2006\KVMonXP.kxp
C:\WINNT\system32\ctfmon.exe
D:\Program Files\Rising\Rav\Ravmon.exe
d:\program files\rising\rfw\RfwMain.exe
C:\Program Files\KV2006\TrojDie.kxp
C:\Program Files\KV2006\KRegEx.exe
C:\Program Files\KV2006\UIHost.exe
C:\Program Files\Internet Explorer\iexplore.exe
E:\HijackThis1[1].99.1\HijackThis1991zww.exe

O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - d:\Program Files\Thunder\ComDlls\XunLeiBHO_002.dll
O3 - IE工具栏增项: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - IE工具栏增项: 江民杀毒工具栏 - {B5A34A93-D538-43A7-8371-864CB6148D12} - C:\Program Files\KV2006\KvShell.dll
O3 - IE工具栏增项: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINNT\system32\kakatool.dll
O4 - 启动项HKLM\\Run: [RavTask] "d:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [KvMonXP] "C:\Program Files\KV2006\KVMonXP.kxp" /auto
O4 - 启动项HKLM\\Run: [Synchronization Manager] mobsync.exe /logon
O4 - 启动项HKLM\\RunOnce: [RavStub] "d:\Program Files\Rising\Rav\ravstub.exe" /RUNONCE
O4 - HKCU\..\Run: [CTFMON.EXE] ctfmon.exe
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - D:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 使用迅雷下载 - d:\Program Files\Thunder\Program\GetUrl.htm
O8 - IE右键菜单中的新增项目: 使用迅雷下载全部链接 - d:\Program Files\Thunder\Program\GetAllUrl.htm
O8 - IE右键菜单中的新增项目: 导出到 Microsoft Office Excel(&X) - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - D:\Program Files\Tencent\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - D:\Program Files\Tencent\QQ\SendMMS.htm
O9 - 浏览器额外的按钮: 豪杰超级解霸9 - {367E0A21-8601-4986-9C9A-153BF5ACA118}? - d:\Program Files\Herosoft\Hero 9\STHSDVD.EXE
O9 - 浏览器额外的“工具”菜单项: 豪杰超级解霸9 - {367E0A21-8601-4986-9C9A-153BF5ACA118}? - d:\Program Files\Herosoft\Hero 9\STHSDVD.EXE
O9 - 浏览器额外的按钮: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263}? - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - 浏览器额外的“工具”菜单项: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263}? - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - 浏览器额外的按钮: 相关站点 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - 浏览器额外的“工具”菜单项: 相关站点 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - 浏览器额外的按钮: 精彩图铃 - {EE60714F-AC37-427e-861A-FD60CBDF119A}? - http://ad.imhero.com/ADShow.aspx?PlaceID=B2 (file missing)
O9 - 浏览器额外的“工具”菜单项: 精彩图铃 - {EE60714F-AC37-427e-861A-FD60CBDF119A}? - http://ad.imhero.com/ADShow.aspx?PlaceID=B2 (file missing)
O17 - HKLM\System\CCS\Services\Tcpip\..\{1A8984DF-FAC5-4BBF-9106-F9E1E5C71F96}: NameServer = 61.139.2.69
O17 - HKLM\System\CS1\Services\Tcpip\..\{1A8984DF-FAC5-4BBF-9106-F9E1E5C71F96}: NameServer = 61.139.2.69
O17 - HKLM\System\CS2\Services\Tcpip\..\{1A8984DF-FAC5-4BBF-9106-F9E1E5C71F96}: NameServer = 61.139.2.69
O23 - NT 服务: C-DillaCdaC11BA - Macrovision - C:\WINNT\system32\drivers\CDAC11BA.EXE
O23 - NT 服务: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - NT 服务: KVSrvXP - Jiangmin Co. Ltd - C:\Program Files\KV2006\KVSrvXP.exe
O23 - NT 服务: lvbs_device - Lenovo (Beijing) Ltd. - C:\WINNT\system32\lvbscoms.exe
O23 - NT 服务: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - d:\program files\rising\rfw\rfwproxy.exe
O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - d:\program files\rising\rfw\rfwsrv.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - d:\Program Files\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - d:\Program Files\Rising\Rav\Ravmond.exe

4805 - 2006-10-10 8:33:00

2006-10-10,08:27:29

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195)
- 非管理权限用户 - 受限功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<CTFMON.EXE><ctfmon.exe> [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<RavTask><"d:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<KvMonXP><"C:\Program Files\KV2006\KVMonXP.kxp" /auto> [Jiangmin Co.Ltd]
<Synchronization Manager><mobsync.exe /logon> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<RavStub><"d:\Program Files\Rising\Rav\ravstub.exe" /RUNONCE> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINNT\system32\userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINNT\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]

==================================
启动文件夹
N/A

==================================
服务
[C-DillaCdaC11BA / C-DillaCdaC11BA]
<C:\WINNT\system32\drivers\CDAC11BA.EXE><Macrovision>
[Logical Disk Manager Administrative Service / dmadmin]
<C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[KVSrvXP / KVSrvXP]
<C:\Program Files\KV2006\KVSrvXP.exe /Service><Jiangmin Co. Ltd>
[lvbs_device / lvbs_device]
<C:\WINNT\system32\lvbscoms.exe -service><Lenovo (Beijing) Ltd.>
[Messenger / Messenger]
<\SystemRoot\C:\WINNT\system32\services.exe><N/A>
[Rising Proxy Service / RfwProxySrv]
<d:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService]
<d:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter]
<"d:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
<"d:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[Portable Media Serial Number Service / WmdmPmSN]
<C:\WINNT\System32\svchost.exe -k netsvcs-->C:\WINNT\system32\mspmsnsv.dll><Microsoft Corporation>

==================================

4805 - 2006-10-10 8:34:00

驱动程序
[Rising TDI Base Driver / BaseTDI]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[CdaC15BA / CdaC15BA]
<\??\C:\WINNT\system32\drivers\CDAC15BA.SYS><Macrovision Europe Ltd>
[Cdr4_2K / Cdr4_2K]
<C:\WINNT\SYSTEM32\DRIVERS\Cdr4_2K.SYS><Roxio>
[Cdralw2k / Cdralw2k]
<C:\WINNT\SYSTEM32\DRIVERS\Cdralw2k.SYS><Roxio>
[dmboot / dmboot]
<System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio]
<\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload]
<\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[ExpScaner / ExpScaner]
<\??\d:\Program Files\Rising\Rav\ExpScan.sys><>
[VIA Rhine Family Fast Ethernet Adapter Driver Service / FETNDISB]
<system32\DRIVERS\fetnd5b.sys><VIA Technologies, Inc.>
[HookCont / HookCont]
<\??\d:\Program Files\Rising\Rav\HOOKCONT.sys><Rising tech Co. ltd>
[HookReg / HookReg]
<\??\d:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys]
<\??\d:\Program Files\Rising\Rav\HookSys.sys><Rising>
[HookUrl / HookUrl]
<\??\d:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[KRegEx / KRegEx]
<\??\C:\PROGRA~1\KV2006\KRegEx.sys><Jiangmin Co. Ltd.>
[KSysCall Service / KSysCall]
<\??\C:\PROGRA~1\KV2006\KSysCall.sys><Jiangmin Co. Ltd.>
[KVDP_1 / KVDP_1]
<\??\C:\Program Files\KV2006\KVDP_1.sys><Jiangmin Co., Ltd.>
[KvMemon / KvMemon]
<\??\C:\PROGRA~1\KV2006\KvMemon.sys><Jiangmin Co. Ltd.>
[KVREDIR / KVREDIR]
<\??\C:\Program Files\KV2006\KVREDIR.sys><Jiangmin Co. Ltd>
[MEMSCAN / MEMSCAN]
<\??\d:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[mProcRs / mProcRs]
<\??\d:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[npkcrypt / npkcrypt]
<\??\D:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[PProtect / PProtect]
<\??\C:\PROGRA~1\KV2006\PProtect.sys><Jiangmin Co. Ltd.>
[Direct Parallel Link Driver / Ptilink]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsFwDrv / RsFwDrv]
<\??\d:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[viagfx / viagfx]
<system32\DRIVERS\vtmini.sys><Copyright (C) VIA/S3 Graphics Co, Ltd.>
[VIA AC'97 Audio Controller (WDM) / VIAudio]
<system32\drivers\viaudio.sys><VIA Technologies, Inc.>

==================================
浏览器加载项
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <d:\Program Files\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>
[豪杰超级解霸9]
{367E0A21-8601-4986-9C9A-153BF5ACA118}? <d:\Program Files\Herosoft\Hero 9\STHSDVD.EXE, Herosoft>
[信息检索(&R)]
{92780B25-18CC-41C8-B9BE-3C9C571A8263}? <D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[相关站点]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[精彩图铃]
{EE60714F-AC37-427e-861A-FD60CBDF119A}? <http://ad.imhero.com/ADShow.aspx?PlaceID=B2, N/A>
[@msdxmLC.dll,-1@2052,电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[江民杀毒工具栏]
{B5A34A93-D538-43A7-8371-864CB6148D12} <C:\Program Files\KV2006\KvShell.dll, Jiangmin Co.Ltd>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINNT\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[上传到QQ网络硬盘]
<D:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用迅雷下载]
<d:\Program Files\Thunder\Program\GetUrl.htm, N/A>
[使用迅雷下载全部链接]
<d:\Program Files\Thunder\Program\GetAllUrl.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
<D:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<D:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<D:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

4805 - 2006-10-10 8:34:00

正在运行的进程
[PID: 1124][C:\WINNT\Explorer.EXE] [Microsoft Corporation, 5.00.3700.6690]
[C:\WINNT\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86]
[C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] [Autodesk, 16.0.0.86]
[C:\Program Files\KV2006\KVHookG_1.dll] [Jiangmin Co.Ltd, 9.0.0.1226]
[C:\Program Files\KV2006\KvShell.dll] [Jiangmin Co.Ltd, 9, 0, 5, 830]
[C:\Program Files\KV2006\UpdateX.dll] [JiangMin Co.Ltd., 9, 0, 5, 831]
[C:\Program Files\KV2006\lang\Kvxp0804_1.lng] [N/A, N/A]
[C:\Program Files\KV2006\APIImpl.dll] [JiangMin Ltd., 9.0.0.500]
[C:\WINNT\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 21]
[d:\Program Files\Thunder\ComDlls\XunLeiBHO_002.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 2]
[d:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[D:\Program Files\WinRAR\rarext.dll] [N/A, N/A]
[C:\WINNT\system32\MrContMenu.dll] [北京梦龙科技有限公司, 1.0.0.5]
[PID: 1236][D:\Program Files\Rising\Rav\RavTask.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 22]
[D:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[D:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[D:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[D:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\KV2006\KVHookG_1.dll] [Jiangmin Co.Ltd, 9.0.0.1226]
[C:\Program Files\KV2006\KVMonXP.kxp] [Jiangmin Co.Ltd, 9, 2, 0, 60905]
[C:\Program Files\KV2006\UpdateX.dll] [JiangMin Co.Ltd., 9, 0, 5, 831]
[C:\Program Files\KV2006\lang\Kvxp0804_1.lng] [N/A, N/A]
[C:\Program Files\KV2006\GUIExt_1.dll] [Jiangmin Co.Ltd, 9, 0, 5, 927]
[C:\Program Files\KV2006\lang\GUIExt0804.lng] [JiangMin Ltd., 7, 1, 0, 200]
[C:\Program Files\KV2006\EngFace.dll] [Jiangmin Co.Ltd, 9.0.0.50809]
[C:\Program Files\KV2006\EngPS.dll] [Jiangmin Co.Ltd, 9, 2, 0, 50817]
[C:\Program Files\KV2006\KvMemory.dll] [Jiangmin Co. Ltd., 9, 0, 6, 0214]
[C:\Program Files\KV2006\KvOffice.dll] [JiangMin New Tech., 9.0.0.1213]
[C:\Program Files\KV2006\lang\KVOffice0804.lng] [N/A, N/A]
[C:\Program Files\KV2006\VirusUpload.dll] [N/A, 2, 16, 6, 7260]
[C:\Program Files\KV2006\KVHookG_1.dll] [Jiangmin Co.Ltd, 9.0.0.1226]
[C:\Program Files\KV2006\PProtect.dll] [Jiangmin Co. Ltd., 9.0.0.921]
[PID: 1276][C:\WINNT\system32\ctfmon.exe] [Microsoft Corporation, 1.00.2409.34 built by: Lab06_N]
[C:\Program Files\KV2006\KVHookG_1.dll] [Jiangmin Co.Ltd, 9.0.0.1226]
[PID: 1260][D:\Program Files\Rising\Rav\Ravmon.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 1, 33]
[D:\Program Files\Rising\Rav\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 26]
[D:\Program Files\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 19]
[D:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[D:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[D:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[D:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[D:\Program Files\Rising\Rav\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\Program Files\KV2006\KVHookG_1.dll] [Jiangmin Co.Ltd, 9.0.0.1226]
[PID: 1304][d:\program files\rising\rfw\RfwMain.exe] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 51]
[d:\program files\rising\rfw\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 23]
[d:\program files\rising\rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[d:\program files\rising\rfw\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\Program Files\KV2006\KVHookG_1.dll] [Jiangmin Co.Ltd, 9.0.0.1226]
[C:\Program Files\KV2006\TrojDie.kxp] [Jiangmin Co.Ltd, 9.0.6.0413]
[C:\Program Files\KV2006\UpdateX.dll] [JiangMin Co.Ltd., 9, 0, 5, 831]
[C:\Program Files\KV2006\lang\TrojDie0804.lng] [Jiangmin Co.Ltd, 9.0.0.0813]
[C:\Program Files\KV2006\GUIExt_1.dll] [Jiangmin Co.Ltd, 9, 0, 5, 927]
[C:\Program Files\KV2006\lang\GUIExt0804.lng] [JiangMin Ltd., 7, 1, 0, 200]
[C:\Program Files\KV2006\PProtect.dll] [Jiangmin Co. Ltd., 9.0.0.921]
[C:\Program Files\KV2006\KVHookG_1.dll] [Jiangmin Co.Ltd, 9.0.0.1226]
[C:\Program Files\KV2006\ComUIPS.dll] [Jiangmin Ltd., 9. 5. 5. 20]
[C:\Program Files\KV2006\KVWPSet.dll] [Jiangmin Co.Ltd, 9, 0, 0, 60220]
[PID: 428][C:\Program Files\KV2006\KRegEx.exe] [Jiangmin Co.Ltd, 9.0.6.210]
[C:\Program Files\KV2006\KRegEx.dll] [Jiangmin Co. Ltd., 9.0.6.0119]
[C:\Program Files\KV2006\KRegTrust.dll] [Jiangmin Co. Ltd., 9.0.0.825]
[C:\Program Files\KV2006\KVHookG_1.dll] [Jiangmin Co.Ltd, 9.0.0.1226]
[PID: 1376][C:\Program Files\KV2006\UIHost.exe] [Jiangmin Co. Ltd, 9.2.0.50822]
[C:\Program Files\KV2006\KVHookG_1.dll] [Jiangmin Co.Ltd, 9.0.0.1226]
[C:\Program Files\KV2006\UpdateX.dll] [JiangMin Co.Ltd., 9, 0, 5, 831]
[C:\Program Files\KV2006\ComUI.dll] [Jiangmin Ltd., 9. 0. 0.509]
[C:\Program Files\KV2006\ComUIPS.dll] [Jiangmin Ltd., 9. 5. 5. 20]
[C:\Program Files\KV2006\GUIExt_1.dll] [Jiangmin Co.Ltd, 9, 0, 5, 927]
[C:\Program Files\KV2006\lang\GUIExt0804.lng] [JiangMin Ltd., 7, 1, 0, 200]
[PID: 1500][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2800.1106]
[C:\Program Files\KV2006\KVHookG_1.dll] [Jiangmin Co.Ltd, 9.0.0.1226]
[C:\WINNT\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86]
[d:\Program Files\Thunder\ComDlls\XunLeiBHO_002.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 2]
[C:\WINNT\system32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] [Autodesk, 16.0.0.86]
[PID: 1600][C:\WINNT\system32\NOTEPAD.EXE] [Microsoft Corporation, 5.00.2140.1]
[C:\Program Files\KV2006\KVHookG_1.dll] [Jiangmin Co.Ltd, 9.0.0.1226]
[C:\WINNT\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86]
[PID: 1192][D:\Program Files\TTPlayer\TTPlayer.exe] [Alen Soft, 4, 6, 8, 0]
[D:\Program Files\TTPlayer\ttpcomm.dll] [N/A, N/A]
[C:\Program Files\KV2006\KVHookG_1.dll] [Jiangmin Co.Ltd, 9.0.0.1226]
[D:\Program Files\TTPlayer\ttpres.dll] [Alen Soft, 4, 6, 8, 0]
[D:\Program Files\TTPlayer\AddIn\ttp_asf.dll] [N/A, N/A]
[D:\Program Files\TTPlayer\AddIn\ttp_aac.dll] [N/A, N/A]
[D:\Program Files\TTPlayer\AddIn\ttp_ac3dts.dll] [N/A, N/A]
[D:\Program Files\TTPlayer\AddIn\ttp_lrcsh.dll] [N/A, N/A]

4805 - 2006-10-10 8:35:00

[PID: 1364][C:\Documents and Settings\jihuabu\My Documents\sreng2\SREng\SREng.exe] [Smallfrogs Studio, 2.2.6.605]
[C:\Program Files\KV2006\KVHookG_1.dll] [Jiangmin Co.Ltd, 9.0.0.1226]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINNT\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost

==================================

请高手指点，在线等待！！！！

4805 - 2006-10-10 14:27:00

怎么沉得那么快啊?找了半天才找到!请大虾们指点啊!!!

jasonlee55 - 2006-10-10 16:00:00

怎么日志里显示有瑞星和江民两个杀软呢,你同时用不冲突么?

4805 - 2006-10-11 15:25:00

不冲突,我这台机子比较重要,所以装了两个杀毒软件,这样的一个好处就是任何想随便修改注册表的行为都会被禁止!一般的病毒是不怕的,就怕有的木马偷偷混进来,所以想请高手看看我的日志,因为这两天qq老提示激活，而且我登陆的是受限用户一，而上网时都是用的受限用户二，所以我怀疑不知道什么地方的病毒跑进来了，请大虾们帮我看看，谢谢阿~~~~~~~~~~~~

天天泡泡 - 2006-10-11 21:35:00

O23 - NT 服务: lvbs_device - Lenovo (Beijing) Ltd. - C:\WINNT\system32\lvbscoms.exe
这个没见国，打包发送到fangrensong@yahoo.com.cn

两个杀毒软件只留一个，1＋1<2！

影子110 - 2006-10-11 21:48:00

- 非管理权限用户 - 受限功能

进入管理员用户再扫个日志上来~~

里面有好多都扫不出来~~

jasonlee55 - 2006-10-12 15:39:00

没见过装两个杀软的````汗

瑞星卡卡安全论坛