浏览器被劫持 bbs.ikaka.com

farewell - 2006-10-21 9:58:00

总是弹出http://www.qddown.com/love.htm,有解决办法吗?

我被毒了 - 2006-10-21 12:08:00

http://www.arswp.com/download/arswp/arswp.rar

下来用下，不错。

farewell - 2006-10-21 17:59:00

2006-10-21,17:38:46

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
<MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Corporation]
<igfxtray><C:\WINDOWS\system32\igfxtray.exe> [(Verified)Intel Corporation]
<igfxhkcmd><C:\WINDOWS\system32\hkcmd.exe> [(Verified)Intel Corporation]
<igfxpers><C:\WINDOWS\system32\igfxpers.exe> [(Verified)Intel Corporation]
<High Definition Audio Property Page Shortcut><CHDAudPropShortcut.exe> [(Verified)Windows (R) Server 2003 DDK provider]
<SmartAudio><C:\Program Files\CONEXANT\SmartAudio\SmartAudio.exe -c> [Conexant]
<SynTPEnh><C:\Program Files\Synaptics\SynTP\SynTPEnh.exe> [(Verified)Synaptics, Inc.]
<EnergyUtility><C:\Program Files\Lenovo\EnergyCut\utilty.exe> [TODO: <Company name>]
<EnergyCut><C:\Program Files\Lenovo\EnergyCut\EnergyCut.exe> [N/A]
<QkOnBtn><C:\PROGRA~1\QBU\QkOnBtn.EXE> [Dritek System Inc.]
<Biomenu><"C:\Program Files\Lenovo\Lenovo PSQL\menusw.exe"> [UPEK Inc.]
<SunJavaUpdateSched><C:\Program Files\Java\jre1.5.0\bin\jusched.exe> [Sun Microsystems, Inc.]
<ccApp><"C:\Program Files\Common Files\Symantec Shared\ccApp.exe"> [(Verified)Symantec Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
<WinlogonNotify: igfxcui><igfxdev.dll> [(Verified)Intel Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\psfus]
<WinlogonNotify: psfus><fusstub.dll> [UPEK Inc.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<iDuba Personal FireWall><; > [N/A]
<Kavrun><; > [N/A]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<MSMSGS><; "C:\Program Files\Messenger\msmsgs.exe" /background> [(Verified)Microsoft Corporation]
<Power2GoExpress><; "C:\Program Files\CyberLink\Power2Go\Power2GoExpress.exe" /Startup> [Cyberlink]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<RemoteControl><; "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"> [Cyberlink Corp.]

==================================
启动文件夹
N/A

==================================
服务
[Symantec Event Manager / ccEvtMgr]
<"C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"><Symantec Corporation>
[Symantec Settings Manager / ccSetMgr]
<"C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"><Symantec Corporation>
[Human Interface Device Access / HidServ]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[LexBce Server / LexBceS]
<C:\WINDOWS\system32\LEXBCES.EXE><Lexmark International, Inc.>
[Norton AntiVirus 自动防护服务 / navapsvc]
<"C:\Program Files\Norton AntiVirus\navapsvc.exe"><Symantec Corporation>
[Norton AntiVirus Firewall Monitor Service / NPFMntor]
<"C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe"><Symantec Corporation>
[Norton Protection Center Service / NSCService]
<"C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE"><Symantec Corporation>
[Symantec AVScan / SAVScan]
<"C:\Program Files\Norton AntiVirus\SAVScan.exe"><Symantec Corporation>
[Computer Browsereser / ServiceF2]
<c:\windows\system\FilMsg.exe><>
[Symantec Network Drivers Service / SNDSrvc]
<"C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe"><Symantec Corporation>
[SPBBCSvc / SPBBCSvc]
<"C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe"><Symantec Corporation>
[Symantec Core LC / Symantec Core LC]
<"C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe"><Symantec Corporation>

==================================
驱动程序
[Lenovo Virtual Power Controller Driver / ACPIVPC]
<system32\DRIVERS\AcpiVpc.sys><Lenovo Corporation>
[Broadcom NetXtreme Gigabit Ethernet / b57w2k]
<system32\DRIVERS\b57xp32.sys><Broadcom Corporation>
[Dritek Keyboard Filter Driver / DKbFltr]
<system32\DRIVERS\DKbFltr.sys><Dritek System Inc.>
[Symantec Eraser Control driver / eeCtrl]
<\??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys><Symantec Corporation>
[EraserUtilRebootDrv / EraserUtilRebootDrv]
<\??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys><Symantec Corporation>
[FdRedir / FdRedir]
<\??\C:\Program Files\Common Files\Protector Suite QL\Drivers\FdRedir.sys><UPEK Inc.>
[FileDisk Protector Kernel Driver / FileDisk2]
<\??\C:\Program Files\Common Files\Protector Suite QL\Drivers\filedisk.sys><UPEK Inc.>
[FrzSys / FrzSys]
<C:\WINDOWS\SYSTEM32\DRIVERS\FrzSys.SYS><PowerShadow>
[Microsoft UAA Function Driver for High Definition Audio Service / HdAudAddService]
<system32\drivers\CHDAud.sys><Conexant Systems Inc.>
[Microsoft UAA Bus Driver for High Definition Audio / HDAudBus]
<system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
[HSFHWAZL / HSFHWAZL]
<system32\DRIVERS\HSFHWAZL.sys><Conexant Systems, Inc.>
[HSF_DPV / HSF_DPV]
<system32\DRIVERS\HSF_DPV.sys><Conexant Systems, Inc.>
[ialm / ialm]
<system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[mdmxsdk / mdmxsdk]
<system32\DRIVERS\mdmxsdk.sys><Conexant>
[NAVENG / NAVENG]
<\??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20061020.020\NAVENG.Sys><Symantec Corporation>
[NAVEX15 / NAVEX15]
<\??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20061020.020\NavEx15.Sys><Symantec Corporation>
[npkcrypt / npkcrypt]
<\??\D:\Software\qq\npkcrypt.sys><INCA Internet Co., Ltd.>
[NSC Infrared Device Driver / NSCIRDA]
<system32\DRIVERS\nscirda.sys><National Semiconductor Corporation>
[Direct Parallel Link Driver / Ptilink]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[SAVRT / SAVRT]
<\??\C:\Program Files\Norton AntiVirus\SAVRT.SYS><Symantec Corporation>
[SAVRTPEL / SAVRTPEL]
<\??\C:\Program Files\Norton AntiVirus\SAVRTPEL.SYS><Symantec Corporation>
[Secdrv / Secdrv]
<system32\DRIVERS\secdrv.sys><N/A>
[SPBBCDrv / SPBBCDrv]
<\??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys><Symantec Corporation>
[SYMDNS / SYMDNS]
<\SystemRoot\System32\Drivers\SYMDNS.SYS><Symantec Corporation>
[SymEvent / SymEvent]
<\??\C:\Program Files\Symantec\SYMEVENT.SYS><Symantec Corporation>
[SYMFW / SYMFW]
<\SystemRoot\System32\Drivers\SYMFW.SYS><Symantec Corporation>
[SYMIDS / SYMIDS]
<\SystemRoot\System32\Drivers\SYMIDS.SYS><Symantec Corporation>
[SYMIDSCO / SYMIDSCO]
<\??\C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\IDS-DI~1\20060922.092\symidsco.sys><Symantec Corporation>
[symlcbrd / symlcbrd]
<\??\C:\WINDOWS\system32\drivers\symlcbrd.sys><Symantec Corporation>
[SYMNDIS / SYMNDIS]
<\SystemRoot\System32\Drivers\SYMNDIS.SYS><Symantec Corporation>
[SYMREDRV / SYMREDRV]
<\SystemRoot\System32\Drivers\SYMREDRV.SYS><Symantec Corporation>
[SYMTDI / SYMTDI]
<\SystemRoot\System32\Drivers\SYMTDI.SYS><Symantec Corporation>
[Synaptics TouchPad Driver / SynTP]
<system32\DRIVERS\SynTP.sys><Synaptics, Inc.>
[TCP/IP Protocol Driver / Tcpip]
<system32\DRIVERS\tcpip.sys><Microsoft Corporation>
[TC USB Kernel Driver / TcUsb]
<System32\Drivers\tcusb.sys><UPEK Inc.>
[tifm21 / tifm21]
<system32\drivers\tifm21.sys><Texas Instruments>
[Conexant Setup API / UIUSys]
<system32\DRIVERS\UIUSYS.SYS><Conexant Systems, Inc>
[Intel(R) PRO/Wireless 3945ABG Adapter Driver / w39n51]
<system32\DRIVERS\w39n51.sys><Intel? Corporation>

farewell - 2006-10-21 18:00:00

==================================
浏览器加载项
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <D:\Software\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>
[CNavExtBho Class]
{A8F38D8D-E480-4D52-B7A2-731BB6995FDD} <C:\Program Files\Norton AntiVirus\NavShExt.dll, Symantec Corporation>
[启动迅雷]
{0062C9BD-B349-40DE-91A0-755F37ACD559} <D:\Software\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[Java Plug-in 1.5.0]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll, Sun Microsystems, Inc.>
[联想]
{6096E38F-5AC1-4391-8EC4-75DFA92FB32F} <http://www.lenovo.com, N/A>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[Norton AntiVirus]
{C4069E3A-68F1-403E-B40E-20066696354B} <C:\Program Files\Norton AntiVirus\NavShExt.dll, Symantec Corporation>
[Java Plug-in 1.5.0]
{8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.5.0]
{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll, Sun Microsystems, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[Web Browser Applet Control]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\WINDOWS\system32\msjava.dll, Microsoft Corporation>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[HHCtrl Object]
{52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[MediaComm Class]
{7670648D-461B-42AF-BDFE-46D26AF5EFF2} <D:\Software\Thunder\Components\InMedia\MediaAddin07.dll, Thunder Networking Technologies,LTD>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <D:\Software\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>
[CNavExtBho Class]
{A8F38D8D-E480-4D52-B7A2-731BB6995FDD} <C:\Program Files\Norton AntiVirus\NavShExt.dll, Symantec Corporation>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[卡卡上网安全助手]
{AFF6E516-CBE5-4F8A-9C2F-38A68013E766} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Norton AntiVirus]
{C4069E3A-68F1-403E-B40E-20066696354B} <C:\Program Files\Norton AntiVirus\NavShExt.dll, Symantec Corporation>
[AUDIO__MP3 Moniker Class]
{CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
{CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[&使用迅雷下载]
<D:\Software\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
<D:\Software\Thunder\Program\GetAllUrl.htm, N/A>

farewell - 2006-10-21 18:01:00

==================================
正在运行的进程
[PID: 672][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 724][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 748][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\fusstub.dll] [UPEK Inc., 5.3.0.2882]
[C:\Program Files\Lenovo\Lenovo PSQL\infra.dll] [UPEK Inc., 5.3.0.2882]
[C:\Program Files\Lenovo\Lenovo PSQL\homefus.dll] [UPEK Inc., 5.3.0.2882]
[C:\Program Files\Lenovo\Lenovo PSQL\homepass.dll] [UPEK Inc., 5.3.0.2882]
[C:\Program Files\Lenovo\Lenovo PSQL\passport.dll] [UPEK Inc., 5.3.0.2882]
[C:\Program Files\Lenovo\Lenovo PSQL\BhTcAll.dll] [UPEK Inc., 5.3.0.2882]
[C:\Program Files\Lenovo\Lenovo PSQL\BhDevTfm.dll] [UPEK Inc., 5.3.0.2882]
[C:\Program Files\Lenovo\Lenovo PSQL\tfm.dll] [UPEK, 3.1.0.1013]
[C:\Program Files\Lenovo\Lenovo PSQL\AlgVer.dll] [UPEK Inc., 5.3.0.2882]
[C:\Program Files\Lenovo\Lenovo PSQL\TCBioLib.dll] [Veridicom, Inc. STMicroelectronics, 3, 0, 1, 1]
[C:\Program Files\Lenovo\Lenovo PSQL\remote.dll] [UPEK Inc., 5.3.0.2882]
[C:\Program Files\Lenovo\Lenovo PSQL\mysafe.dll] [UPEK Inc., 5.3.0.2882]
[PID: 792][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 804][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\fusstub.dll] [UPEK Inc., 5.3.0.2882]
[C:\Program Files\Lenovo\Lenovo PSQL\infra.dll] [UPEK Inc., 5.3.0.2882]
[C:\Program Files\Lenovo\Lenovo PSQL\homefus.dll] [UPEK Inc., 5.3.0.2882]
[PID: 980][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1044][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1272][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1308][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1460][C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\ccL40.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\ccSetEvt.dll] [Symantec Corporation, 104.0.8.3]
[PID: 1512][C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\ccL40.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\ccSet.dll] [Symantec Corporation, 104.0.8.3]
[C:\PROGRA~1\COMMON~1\SYMANT~1\SPBBC\SPBBCEVT.DLL] [Symantec Corporation, 2.1.0.4]
[C:\PROGRA~1\COMMON~1\SYMANT~1\CCLOGIN.DLL] [Symantec Corporation, 104.0.8.3]
[C:\PROGRA~1\COMMON~1\SYMANT~1\CCSETEVT.DLL] [Symantec Corporation, 104.0.8.3]
[C:\PROGRA~1\NORTON~1\HPPEVT32.DLL] [Symantec Corporation, 12.2.0.13]
[C:\PROGRA~1\NORTON~1\HPPRES32.loc] [Symantec Corporation, 12.2.0.13]
[C:\PROGRA~1\NORTON~1\NAVEVENT.DLL] [Symantec Corporation, 12.2.0.13]
[C:\WINDOWS\SYSTEM32\SYMNETI.DLL] [Symantec Corporation, 6.0.4.402]
[PID: 1600][C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe] [Symantec Corporation, 6.0.4.402]
[C:\WINDOWS\system32\SymNeti.dll] [Symantec Corporation, 6.0.4.402]
[PID: 1612][C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe] [Symantec Corporation, 2.1.0.4]
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\ccL40.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\ccSet.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCEvt.dll] [Symantec Corporation, 2.1.0.4]
[C:\Program Files\Common Files\Symantec Shared\SPBBC\bbRGen.dll] [Symantec Corporation, 2.1.0.4]
[PID: 1636][C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe] [Symantec Corporation, 1.9.1.762]
[C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcnet.dll] [Symantec Corporation, 1.9.1.762]
[PID: 1932][C:\WINDOWS\system32\LEXBCES.EXE] [Lexmark International, Inc., 9.42]
[C:\WINDOWS\system32\lexp2p32.dll] [Lexmark International, Inc., 9.42]
[C:\WINDOWS\system32\lex2kusb.dll] [Lexmark International, Inc., 9.42]
[PID: 1976][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\WINDOWS\system32\LEXLMPM.DLL] [Lexmark International, Inc., 96.9.42]
[C:\WINDOWS\system32\LexBce.dll] [Lexmark International, Inc., 9.42]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\LVCMPP5C.dll] [Lenovo (Beijing) Ltd., 1.0.1.14]
[C:\WINDOWS\system32\LVCMpwr.dll] [Lenovo (Beijing) Ltd., 1, 0, 1, 0]
[PID: 1988][C:\WINDOWS\system32\LEXPPS.EXE] [Lexmark International, Inc., 9.42]
[C:\WINDOWS\system32\LEXBCE.DLL] [Lexmark International, Inc., 9.42]
[PID: 372][C:\Program Files\Norton AntiVirus\navapsvc.exe] [Symantec Corporation, 12.2.0.13]
[C:\Program Files\Common Files\Symantec Shared\ccL40.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Norton AntiVirus\SAVRT32.DLL] [Symantec Corporation, 9.7.0.10]
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Norton AntiVirus\navapsvc.loc] [Symantec Corporation, 12.2.0.13]
[C:\Program Files\Norton AntiVirus\N32Exclu.dll] [Symantec Corporation, 12.2.0.13]
[C:\Program Files\Common Files\Symantec Shared\ccSet.dll] [Symantec Corporation, 104.0.8.3]
[PID: 512][C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe] [Symantec Corporation, 12.2.0.13]
[C:\Program Files\Common Files\Symantec Shared\ccL40.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Norton AntiVirus\IWP\iwp.dll] [Symantec Corporation, 12.2.0.13]
[PID: 556][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Lenovo\EnergyCut\HookLib.dll] [N/A, N/A]
[C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~1\NSCEXT.DLL] [Symantec Corporation, 2006.1.5.17]
[C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~1\NSCEXT.LOC] [Symantec Corporation, 2006.1.5.17]
[D:\Software\Thunder\ComDlls\XunLeiBHO_002.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 2]
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 7.0.0.0]
[C:\WINDOWS\system32\igfxpph.dll] [Intel Corporation, 3.0.0.4543]
[C:\WINDOWS\system32\hccutils.DLL] [Intel Corporation, 3.0.0.4543]
[C:\WINDOWS\system32\igfxres.dll] [Intel Corporation, 3.0.0.4543]
[C:\WINDOWS\system32\igfxress.dll] [Intel Corporation, 3.0.0.4543]
[C:\WINDOWS\system32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4543]
[D:\Software\rarext.dll] [N/A, N/A]
[C:\Program Files\Norton AntiVirus\NavShExt.dll] [Symantec Corporation, 12.2.0.13]
[PID: 400][c:\windows\system\FilMsg.exe] [, 1.0.0.0]
[PID: 1788][C:\WINDOWS\system32\igfxtray.exe] [Intel Corporation, 3.0.0.4543]
[C:\WINDOWS\system32\hccutils.DLL] [Intel Corporation, 3.0.0.4543]
[C:\WINDOWS\system32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4543]
[C:\WINDOWS\system32\igfxres.dll] [Intel Corporation, 3.0.0.4543]
[C:\WINDOWS\system32\igfxress.dll] [Intel Corporation, 3.0.0.4543]
[PID: 1280][C:\WINDOWS\system32\hkcmd.exe] [Intel Corporation, 3.0.0.4543]
[C:\WINDOWS\system32\hccutils.DLL] [Intel Corporation, 3.0.0.4543]
[C:\WINDOWS\system32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4543]
[C:\WINDOWS\system32\igfxres.dll] [Intel Corporation, 3.0.0.4543]
[PID: 1800][C:\WINDOWS\system32\igfxpers.exe] [Intel Corporation, 3.0.0.4543]
[C:\WINDOWS\system32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4543]
[PID: 1876][C:\Program Files\CONEXANT\SmartAudio\SmartAudio.exe] [Conexant, 1, 3, 12, 2]
[C:\Program Files\CONEXANT\SmartAudio\dll\res0804.dll] [Conexant, 1, 0, 0, 1]
[PID: 1900][C:\Program Files\Synaptics\SynTP\SynTPEnh.exe] [Synaptics, Inc., 8.0.9 20May05]
[C:\WINDOWS\system32\SynCOM.dll] [Synaptics, Inc., 8.0.9 20May05]
[C:\WINDOWS\system32\SynTPAPI.dll] [Synaptics, Inc., 8.0.9 20May05]
[PID: 1940][C:\Program Files\Lenovo\EnergyCut\utilty.exe] [TODO: <Company name>, 1.0.0.1]
[PID: 2056][C:\Program Files\Lenovo\EnergyCut\EnergyCut.exe] [N/A, N/A]
[C:\Program Files\Lenovo\EnergyCut\HookLib.dll] [N/A, N/A]

farewell - 2006-10-21 18:01:00

[PID: 2080][C:\PROGRA~1\QBU\QkOnBtn.EXE] [Dritek System Inc., 1, 0, 0, 421]
[C:\PROGRA~1\QBU\ComFnUtl.dll] [Dritek System Inc., 1, 0, 0, 605]
[C:\PROGRA~1\QBU\Wnd2File.dll] [Dritek System Inc., 3.00]
[C:\PROGRA~1\QBU\SzUPFUtl.dll] [Dritek System Inc., 1.00]
[C:\PROGRA~1\QBU\OSDUtl.dll] [Dritek System Inc., 1, 1, 1, 309]
[C:\PROGRA~1\QBU\RgnMaker.dll] [Dritek System Inc., 12.07.1999 ( VC60 )]
[C:\PROGRA~1\QBU\CDRomUtl.dll] [Dritek System Inc., 1.00]
[C:\PROGRA~1\QBU\MixerUtl.dll] [Dritek System Inc., 1.00]
[C:\PROGRA~1\QBU\LgKCUtl.dll] [Dritek System Inc., 2, 0, 2, 1007]
[C:\PROGRA~1\QBU\MMDUtl.dll] [Dritek System Inc., 1, 2, 4, 4914]
[C:\WINDOWS\system32\IGFXEXPS.DLL] [Intel Corporation, 3.0.0.4543]
[PID: 2120][C:\Program Files\Java\jre1.5.0\bin\jusched.exe] [Sun Microsystems, Inc., 1.5.0.0]
[PID: 2180][C:\Program Files\Common Files\Symantec Shared\ccApp.exe] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\ccL40.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\ccSet.dll] [Symantec Corporation, 104.0.8.3]
[C:\PROGRA~1\COMMON~1\SYMANT~1\CCALERT.DLL] [Symantec Corporation, 104.0.8.3]
[C:\PROGRA~1\COMMON~1\SYMANT~1\CCEMLPXY.DLL] [Symantec Corporation, 104.0.8.3]
[C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~1\NSCTRAY.DLL] [Symantec Corporation, 2006.1.5.17]
[C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~1\NSCTRAY.LOC] [Symantec Corporation, 2006.1.5.17]
[C:\PROGRA~1\NORTON~1\CCIMSCAN.DLL] [Symantec Corporation, 104.0.5.3]
[C:\PROGRA~1\NORTON~1\DEFALERT.DLL] [Symantec Corporation, 12.2.0.13]
[C:\PROGRA~1\COMMON~1\SYMANT~1\rcEmlPxy.dll] [Symantec Corporation, 104.0.8.3]
[C:\PROGRA~1\NORTON~1\HPP32.DLL] [Symantec Corporation, 12.2.0.13]
[C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~1\NSCUICOR.dll] [Symantec Corporation, 2006.1.5.17]
[C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~1\NSCUICOR.LOC] [Symantec Corporation, 2006.1.5.17]
[C:\WINDOWS\system32\SYMREDIR.DLL] [Symantec Corporation, 6.0.4.402]
[C:\Program Files\Common Files\Symantec Shared\ccSetEvt.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\ccProSub.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\Security Console\NSC_Hlpr.dll] [Symantec Corporation, 2006.1.5.17]
[C:\PROGRA~1\NORTON~1\HPPRES32.loc] [Symantec Corporation, 12.2.0.13]
[C:\PROGRA~1\NORTON~1\IWP\IWP.DLL] [Symantec Corporation, 12.2.0.13]
[C:\PROGRA~1\NORTON~1\NAVAPW32.DLL] [Symantec Corporation, 12.2.0.13]
[C:\PROGRA~1\NORTON~1\apwutil.dll] [Symantec Corporation, 12.2.0.13]
[C:\Program Files\Norton AntiVirus\ccAVMail.dll] [Symantec Corporation, 104.0.5.3]
[C:\PROGRA~1\NORTON~1\navapw32.loc] [Symantec Corporation, 12.2.0.13]
[C:\PROGRA~1\NORTON~1\NAVOPTRF.DLL] [Symantec Corporation, 12.0.0.94]
[C:\PROGRA~1\NORTON~1\STATUSHP.DLL] [Symantec Corporation, 12.2.0.13]
[C:\Program Files\Norton AntiVirus\HPPEVT32.dll] [Symantec Corporation, 12.2.0.13]
[C:\PROGRA~1\NORTON~1\apwutil.loc] [Symantec Corporation, 12.2.0.13]
[C:\Program Files\Norton AntiVirus\Navlcom.dll] [Symantec Corporation, 12.2.0.13]
[C:\Program Files\Norton AntiVirus\apwcmdnt.dll] [Symantec Corporation, 12.2.0.13]
[C:\Program Files\Norton AntiVirus\apwcmdNT.loc] [Symantec Corporation, 12.2.0.13]
[C:\Program Files\Norton AntiVirus\NAVError.dll] [Symantec Corporation, 12.2.0.13]
[C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCEvt.dll] [Symantec Corporation, 2.1.0.4]
[C:\Program Files\Norton AntiVirus\naverror.loc] [Symantec Corporation, 12.2.0.13]
[C:\Program Files\Norton AntiVirus\NAVEvent.dll] [Symantec Corporation, 12.2.0.13]
[C:\Program Files\Norton AntiVirus\IWP\SymFWAgt.dll] [Symantec Corporation, 104.0.1.17]
[C:\WINDOWS\system32\SymNeti.DLL] [Symantec Corporation, 6.0.4.402]
[C:\Program Files\Common Files\Symantec Shared\ccLogin.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Norton AntiVirus\IWP\ccFWSetg.dll] [Symantec Corporation, 104.0.1.17]
[C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~1\NSCSRVPS.DLL] [Symantec Corporation, 2006.1.5.17]
[C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~1\NSCUIBL.DLL] [Symantec Corporation, 2006.1.5.17]
[C:\Program Files\Norton AntiVirus\NAVOpts.dll] [Symantec Corporation, 12.2.0.13]
[C:\Program Files\Norton AntiVirus\navopts.loc] [Symantec Corporation, 12.2.0.13]
[C:\Program Files\Norton AntiVirus\NAVAPSCR.dll] [Symantec Corporation, 12.2.0.13]
[C:\Program Files\Symantec\LiveUpdate\ProductRegCom_2_7.DLL] [Symantec Corporation, 2.7.39.0]
[C:\Program Files\Symantec\LiveUpdate\LuComServerPS_2_7.DLL] [Symantec Corporation, 2.7.39.0]
[C:\PROGRA~1\NORTON~1\NAVTasks.dll] [Symantec Corporation, 12.2.0.13]
[C:\PROGRA~1\NORTON~1\NAVTasks.loc] [Symantec Corporation, 12.2.0.13]
[C:\Program Files\Symantec\LiveUpdate\NetDetectController_2_7.DLL] [Symantec Corporation, 2.7.39.0]

[PID: 2192][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2200][C:\Program Files\Messenger\msmsgs.exe] [Microsoft Corporation, 4.7.3001]
[PID: 2344][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2456][C:\WINDOWS\system32\igfxext.exe] [Intel Corporation, 3.0.0.4543]
[C:\WINDOWS\system32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4543]
[C:\WINDOWS\system32\IGFXEXPS.DLL] [Intel Corporation, 3.0.0.4543]
[PID: 2496][C:\WINDOWS\system32\igfxsrvc.exe] [Intel Corporation, 3.0.0.4543]
[C:\WINDOWS\system32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4543]
[C:\WINDOWS\system32\igfxdev.dll] [Intel Corporation, 3.0.0.4543]
[PID: 3296][C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE] [Symantec Corporation, 2006.1.5.17]
[C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~1\NSCSRVPS.DLL] [Symantec Corporation, 2006.1.5.17]
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\ccL40.dll] [Symantec Corporation, 104.0.8.3]
[C:\Program Files\Common Files\Symantec Shared\ccSet.dll] [Symantec Corporation, 104.0.8.3]
[C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~1\NSCUIBL.DLL] [Symantec Corporation, 2006.1.5.17]
[C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~1\NSCUICOR.LOC] [Symantec Corporation, 2006.1.5.17]
[C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~1\NSCJSBL.DLL] [Symantec Corporation, 2006.1.5.17]
[C:\Program Files\Norton AntiVirus\avFPXY.dll] [Symantec Corporation, 2006.1.4.4]
[C:\Program Files\Norton AntiVirus\avFMST.dll] [Symantec Corporation, 2006.1.4.4]
[C:\Program Files\Norton AntiVirus\avNSCPlg.dll] [Symantec Corporation, 12.2.0.13]
[C:\Program Files\Norton AntiVirus\avNSCPlg.loc] [Symantec Corporation, 12.2.0.13]
[C:\Program Files\Common Files\Symantec Shared\Security Console\NSC_WSCR.DLL] [Symantec Corporation, 2006.1.5.17]
[C:\Program Files\Common Files\Symantec Shared\Security Console\NSC_WSCR.LOC] [Symantec Corporation, 2006.1.5.17]
[C:\Program Files\Common Files\Symantec Shared\Security Console\NSC_Hlpr.dll] [Symantec Corporation, 2006.1.5.17]
[C:\Program Files\Norton AntiVirus\NAVEvent.dll] [Symantec Corporation, 12.2.0.13]
[PID: 408][D:\Software\Thunder\Program\Thunder5.exe] [Thunder Networking Technologies,LTD, 5.4.0.226]
[D:\Software\Thunder\Program\UpdateDownload.dll] [Thunder Networking Technologies,LTD, 1, 0, 1, 8]
[D:\Software\Thunder\Program\download_interface.dll] [Thunder Networking Technologies,LTD, 2, 0, 0, 1]
[D:\Software\Thunder\Program\stlport_vc646.dll] [STLport Consulting, Inc., 4.6.2003.1031]
[D:\Software\Thunder\Program\log4cplus.dll] [, 1, 0, 2, 1]
[D:\Software\Thunder\Program\asyn_dns.dll] [N/A, N/A]
[D:\Software\Thunder\Program\msgmanage.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 15]
[D:\Software\Thunder\Program\historyinfo_manage.dll] [Thunder Networking Technologies,LTD, 5, 2, 0, 148]
[D:\Software\Thunder\Program\RegisterDll.dll] [Thunder Networking Technologies,LTD, 2, 1, 0, 18]
[D:\Software\Thunder\Program\FloatBar.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 2]
[D:\Software\Thunder\Components\InMedia\iEmbedShell.dll] [　, 1, 0, 0, 11]
[D:\Software\Thunder\Components\InMedia\iEmbed04.dll] [　, 2, 3, 0, 37]
[D:\Software\Thunder\Components\P4PClient\P4PClient.dll] [Thunder Networking Technologies,LTD, 1, 0, 4, 10]
[D:\Software\Thunder\Program\iTargetAd.dll] [Thunder Networking Technologies,LTD, 1, 0, 1, 59]
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[PID: 3172][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 412][C:\Program Files\Rising\KakaToolBar\KkScan.exe] [Beijing Rising Technology Co., Ltd., 2, 0, 0, 1]
[PID: 896][C:\WINDOWS\system32\wbem\wmiprvse.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1504][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\kakatool.dll] [Beijing Rising Technology Co., Ltd., 2, 0, 0, 9]
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 7.0.7.2006011200]
[D:\Software\Thunder\ComDlls\XunLeiBHO_002.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 2]
[C:\Program Files\Norton AntiVirus\NavShExt.dll] [Symantec Corporation, 12.2.0.13]
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[PID: 2024][C:\DOCUME~1\yd\LOCALS~1\Temp\Rar$EX00.844\SREng\SREng.exe] [Smallfrogs Studio, 2.2.6.605]
[C:\DOCUME~1\yd\LOCALS~1\Temp\Rar$EX00.844\SREng\Plugins\SRECXTMG.SRE] [Smallfrogs Studio, 1, 5, 0, 55]

farewell - 2006-10-21 18:02:00

==================================
文件关联
.TXT Error. [UltraEdit.txt]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI Error. [UltraEdit.ini]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
a# Copyright (c) 1998 Microsoft Corp.
127.0.0.1 localhost
10.161.32.24 jlmcoa02 jlmcoa02.jlmc.com
10.161.32.29 jlmcoa03 jlmcoa03.jlmc.com
10.161.32.67 emis.jlmc.com
10.161.32.30 jlmcmail.jlmc.com
10.161.32.25 jlmcie ie.jlmc.com
10.161.32.104 oa01.jlmc.com
10.161.32.105 oa02.jlmc.com
10.161.32.106 oa03.jlmc.com
10.161.32.107 oa04.jlmc.com
10.161.32.108 mail01.jlmc.com
10.161.32.109 mail02.jlmc.com
211.137.211.69 MAIL1.JLMC.COM
211.137.211.73 MAIL2.JLMC.COM
127.0.0.1 pop3.Kingsoft.AntiVirus # Added by Kingsoft AntiVirus for e-Mail scanning

==================================

farewell - 2006-10-21 18:04:00

在线等大侠出手相救!!

farewell - 2006-10-21 18:28:00

没人能干掉它吗??

附件: 77139720061021182019.bmp

shenlan874 - 2006-10-21 19:47:00

和楼主一样的问题，等高手

瑞星卡卡安全论坛