瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 请高手尽快解决4533.cn的劫持,我修复了两天了还不行。

12   1  /  2  页   跳转

请高手尽快解决4533.cn的劫持,我修复了两天了还不行。

请高手尽快解决4533.cn的劫持,我修复了两天了还不行。

最近中http://www.4533.cn的人还挺多,看日期都是5月20号以后中的,应该是最新出来的了。我也中了,昨天还举报了,不过还没有通过审核。卡卡的审核速度是不是有点慢啦?希望改进哦。
具体情况如下,请高手给看看:
浏览器主页设置被禁止,用卡卡助手和超级兔子都修复过了,没有用。
后来就修改注册表,可是每次修改完不到2分钟又被改回去了。注册表里面HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\Run主键下无registry.exe子键,那个HKEY_CLASSES_ROOT\PROTOCOLS\Handler\about,检查其下的CLASS 键无可疑的网址,将HKEY_CLASHKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel” 其中键值名为“HomePage”的键值改为“0”或删除后,不到2分钟会自动出现并且键值仍然回到了“1”。
Windows\systom32\etc中的Hosts文件也删除了。
另外,注册表修改器“被管理员停用”,修改过属性了,但是还是被停用了,每次使用修改器之前都要重新修改一次属性才行。
怎么办啊?
最后编辑2006-06-04 20:23:12
分享到:
gototop
 

请下载 System Repair Engineer,使用“智能扫描”,按下“扫描”按钮进行扫描,扫描完成后按下“保存报告”按钮保存报告日志文件(SREng.LOG),把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完,分次粘完,请不要修改。
gototop
 

2006-06-03,17:31:49

System Repair Engineer 2.0.12.350 (2.0 RC 1)
    Windows XP Professional Service Pack 2 - 管理权限用户 - 完整功能

以下内容被选中:
    所有的启动项目(包括注册表、启动文件夹、服务等)
    浏览器加载项
    正在运行的进程(包括进程模块信息)
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <ctfmon.exe><C:\windows\system32\ctfmon.exe>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <load><>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <run><>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <KAVRun><C:\KAV6\KAVRun.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <HP Software Update><D:\Program Files\HP Software Update\HPWuSchd2.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <winlass><C:\Program Files\Outlook Express\winlass.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <stup.exe><C:\PROGRA~1\TENCENT\Adplus\stup.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <NvCplDaemon><RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <shell><Explorer.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <Userinit><C:\windows\system32\userinit.exe,>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <AppInit_DLLs><>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  <IESAddr><; Null>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  <IMSCMig><; C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  <kc32update><; rundll32 C:\windows\system32\kc32update.dll,AppMain>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  <KernelFaultCheck><; %systemroot%\system32\dumprep 0 -k>
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  <KpopMon><; C:\KAV6\KPopMon.EXE>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  <KUCO><; D:\酷客娱乐平台\KUCO.exe>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  <Kulansyn><; C:\KAV6\Kulansyn.EXE>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  <NvCplDaemon><; RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  <NvMediaCenter><; RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  <nwiz><; nwiz.exe /install>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  <SoundMan><; SOUNDMAN.EXE>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  <stup.exe><; C:\PROGRA~1\TENCENT\Adplus\stup.exe>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  <Thunder><; "D:\DownLoads\迅雷\ThunderShell.exe" /s>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  <TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  <vqpl20to><; RunDll32 "C:\windows\Downlo~1\memu8n7v.dll",Run>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  <winlass><; C:\Program Files\Outlook Express\winlass.exe>
gototop
 

==================================
启动文件夹
[HP Digital Imaging Monitor]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\HP Digital Imaging Monitor.lnk><N>
[HP Image Zone 快速启动 ]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\HP Image Zone 快速启动 .lnk><N>

==================================
服务
[Kingsoft AntiVirus Service / KAVSvc]
  <C:\KAV6\KAVSvc.EXE><kingsoft Antivirus>
[NVIDIA Display Driver Service / NVSvc]
  <C:\windows\system32\nvsvc32.exe><NVIDIA Corporation>
[Pml Driver HPZ12 / Pml Driver HPZ12]
  <C:\WINDOWS\system32\HPZipm12.exe><HP>

==================================
浏览器加载项
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <D:\QQ\QQ2005\qq\QQ.EXE, TENCENT>
[FlashGet]
  {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\flashget.exe, Amaze Soft>
[金山毒霸网站]
  {e1fc9760-7b95-49cd-80b9-8c9e41017b93} <url:http://www.duba.net, N/A>
[在线查毒]
  {f58d36c3-40be-4418-a786-d8fbe3eb3554} <C:\KAV6\kavie.htm, N/A>
[FlashGet Bar]
  {E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[金山毒霸]
  {A9BE2902-C447-420A-BB7F-A5DE921E6138} <C:\KAV6\KAIEPlus.DLL, >
[卡卡上网安全助手]
  {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\windows\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[DigitalTrafic Control]
  {7FC22A16-79E6-4787-9C96-B6359BB1106D} <C:\WINDOWS\DOWNLO~1\DIGITA~1.OCX, Broad-way>
[HTML Document]
  {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[金山毒霸]
  {A9BE2902-C447-420A-BB7F-A5DE921E6138} <C:\KAV6\KAIEPlus.DLL, >
[SearchAssistantOC]
  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[卡卡上网安全助手]
  {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\windows\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[FlashGet Bar]
  {E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[]
  {E1FC9760-7B95-49CD-80B9-8C9E41017B93} <C:\KAV6\KAVEXT.DLL, Kingsoft Corp.>
[&使用迅雷下载]
  <D:\DownLoads\迅雷\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
  <D:\DownLoads\迅雷\Program\GetAllUrl.htm, N/A>
[添加到QQ表情]
  <D:\QQ\QQ2005\qq\AddEmotion.htm, N/A>
gototop
 

==================================
正在运行的进程
[PID: 436][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 484][\??\C:\windows\system32\csrss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 508][\??\C:\windows\system32\winlogon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 552][C:\windows\system32\services.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 564][C:\windows\system32\lsass.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 712][C:\windows\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 756][C:\windows\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 836][C:\windows\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 904][C:\windows\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 964][C:\windows\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1160][C:\windows\system32\spoolsv.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\windows\system32\HpTcpMon.dll]  <Hewlett Packard><5.01.00.011>
    [C:\windows\system32\hpzjrd01.dll]  <Hewlett Packard><2.01.00.001>
    [C:\windows\system32\HPTcpMUI.dll]  <Microsoft Corporation><5.01.00.011>
    [C:\windows\system32\hptcpmib.dll]  <Hewlett Packard><5.01.00.011>
    [C:\windows\system32\hpzsnt12.dll]  <HP><14.00.00.41711>
    [C:\windows\System32\spool\PRTPROCS\W32X86\vprproc.dll]  <Windows (R) 2000 DDK provider><5.00.2195.1620>
[PID: 1284][C:\KAV6\KAVSvc.EXE]  <kingsoft Antivirus><2003, 11, 12, 70>
    [C:\KAV6\SvcComm.dll]  <kingsoft Antivirus><2004, 7, 28, 1>
    [C:\KAV6\SvcTimer.DLL]  <Kingsoft><2004.4.29.79>
    [C:\KAV6\KavComm.dll]  <Kingsoft Corporation><2003, 11, 12, 66>
    [C:\KAV6\RpcBrge.DLL]  <kingsoft><2003, 11, 12, 64>
    [C:\KAV6\KWatchFn2.dll]  <kingsoft Corporation><2004, 8, 24, 25>
    [C:\KAV6\KAEPlat.DLL]  <Kingsoft Corp.><2004, 11, 26, 53>
    [C:\KAV6\KAEMem.DAT]  <Kingsoft><2004, 11, 9, 11>
    [C:\KAV6\KAVUtils.dll]  <Kingsoft Corp><2004, 2, 12, 69>
    [C:\KAV6\KAVDlg.DLL]  <><2004.7.20.81>
    [C:\KAV6\KAVLogFn.dll]  <N/A><2003, 11, 26, 16>
gototop
 

[PID: 1304][C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE]  <Microsoft Corporation><7.00.9466>
[PID: 1340][C:\windows\system32\nvsvc32.exe]  <NVIDIA Corporation><6.14.10.8194>
[PID: 1384][C:\windows\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1408][C:\WINDOWS\system32\wdfmgr.exe]  <Microsoft Corporation><5.2.3790.1230 built by: dnsrv(bld4act)>
[PID: 1728][C:\windows\System32\alg.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 456][C:\windows\Explorer.EXE]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\Program Files\TENCENT\Adplus\Adplus.dll]  <Tencent><4, 0, 6, 61>
    [C:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 860][C:\KAV6\KWatchUI.EXE]  <><2004.1.6.119>
    [C:\KAV6\kavcomm.dll]  <Kingsoft Corporation><2003, 11, 12, 66>
    [C:\KAV6\kavdlg.dll]  <><2004.7.20.81>
    [C:\Program Files\TENCENT\Adplus\Adplus.dll]  <Tencent><4, 0, 6, 61>
    [C:\KAV6\KAVMLM.DLL]  <Kingsoft Corporation><2003.11.12.10>
    [C:\KAV6\RpcBrge.DLL]  <kingsoft><2003, 11, 12, 64>
    [C:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 912][D:\Program Files\HP Software Update\HPWuSchd2.exe]  <Hewlett-Packard Co.><53.0.13.000>
    [C:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 928][C:\Program Files\Outlook Express\winlass.exe]  < ><5.01.2715>
    [C:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
    [C:\Program Files\TENCENT\Adplus\Adplus.dll]  <Tencent><4, 0, 6, 61>
[PID: 1056][C:\Program Files\Internet Explorer\Mui\winlog.exe]  < ><1.02.2750>
    [C:\Program Files\TENCENT\Adplus\Adplus.dll]  <Tencent><4, 0, 6, 61>
    [C:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 1064][C:\windows\system32\ctfmon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\Program Files\TENCENT\Adplus\Adplus.dll]  <Tencent><4, 0, 6, 61>
    [C:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 1484][D:\Program Files\Digital Imaging\bin\hpqtra08.exe]  <Hewlett-Packard Co.><53.0.13.000>
    [C:\Program Files\TENCENT\Adplus\Adplus.dll]  <Tencent><4, 0, 6, 61>
    [D:\Program Files\Digital Imaging\bin\hpqcxm08.dll]  <Hewlett-Packard Co.><53.0.13.000>
    [D:\Program Files\Digital Imaging\bin\hpquio08.dll]  <Hewlett-Packard Co.><53.0.13.000>
    [D:\Program Files\Digital Imaging\bin\hpqtra08.rsc]  <Hewlett-Packard Co.><53.0.13.000>
    [D:\Program Files\Digital Imaging\bin\hpqtao08.dll]  <Hewlett-Packard Co.><53.0.13.000>
    [D:\Program Files\Digital Imaging\bin\hpqrif08.dll]  <Hewlett-Packard Co.><53.0.13.000>
    [D:\Program Files\Digital Imaging\bin\hpotra08.dll]  <Hewlett-Packard Co.><50.0.206.000>
    [D:\Program Files\Digital Imaging\bin\hpotra08.rsc]  <Hewlett-Packard Co.><50.0.206.000>
    [C:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
    [D:\Program Files\Digital Imaging\bin\hpodio08.dll]  <Hewlett-Packard Co.><53.0.13.000>
    [D:\Program Files\Digital Imaging\bin\hpqcob08.dll]  <Hewlett-Packard Co.><53.0.13.000>
    [D:\Program Files\Digital Imaging\bin\hpotradd.dll]  <Hewlett-Packard Co.><53.0.13.000>
    [D:\Program Files\Digital Imaging\bin\hpodvd09.dll]  <Hewlett-Packard Co.><53.0.13.000>
    [D:\Program Files\Digital Imaging\bin\hpoddcomm09.dll]  <Hewlett-Packard Co.><53.0.13.000>
    [C:\windows\system32\hpzidr12.dll]  <HP><9, 0, 0, 0>
    [C:\windows\system32\hpzipr12.dll]  <HP><9, 0, 0, 0>
gototop
 

[PID: 1376][C:\KAV6\MailMon.EXE]  <Kingsoft Co., Ltd><2004, 2, 6, 245>
    [C:\KAV6\KMFilter.DLL]  <><2004, 3, 1, 37>
    [C:\KAV6\parse822.dll]  <Quiksoft Corporation><2, 0, 0, 9>
    [C:\KAV6\KAVLogFn.dll]  <N/A><2003, 11, 26, 16>
    [C:\KAV6\KAVMLM.DLL]  <Kingsoft Corporation><2003.11.12.10>
    [C:\KAV6\KAMsgBox.DLL]  <><2002.9.27.30>
    [C:\Program Files\TENCENT\Adplus\Adplus.dll]  <Tencent><4, 0, 6, 61>
    [C:\KAV6\KAVComm.dll]  <Kingsoft Corporation><2003, 11, 12, 66>
    [C:\KAV6\RpcBrge.DLL]  <kingsoft><2003, 11, 12, 64>
    [C:\KAV6\KAVIPC.DLL]  <Kingsoft Corp.><2002, 3, 29, 8>
    [C:\KAV6\KAVDlg.DLL]  <><2004.7.20.81>
    [C:\KAV6\KAECall.DLL]  <Kingsoft Corporation><2003, 11, 14, 66>
    [C:\KAV6\KAEScan.DLL]  <Kingsoft Corp.><2003, 5, 24, 36>
    [C:\KAV6\KAEPlat.DLL]  <Kingsoft Corp.><2004, 11, 26, 53>
    [C:\KAV6\KAEMem.DAT]  <Kingsoft><2004, 11, 9, 11>
    [C:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 1664][C:\KAV6\KAVPlus.EXE]  <><2004, 3, 3, 71>
    [C:\Program Files\TENCENT\Adplus\Adplus.dll]  <Tencent><4, 0, 6, 61>
    [C:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 1976][D:\Program Files\Digital Imaging\bin\hpqimzone.exe]  <Hewlett-Packard Co.><053.000.013.000>
    [c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_7b44bf62\mscorlib.dll]  <N/A><N/A>
    [C:\Program Files\TENCENT\Adplus\Adplus.dll]  <Tencent><4, 0, 6, 61>
    [C:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
    [c:\windows\assembly\gac\hpqiface\4.0.0.0__a53cf5803f4c3827\hpqiface.dll]  <Hewlett-Packard Co.><053.000.013.000>
    [c:\windows\assembly\nativeimages1_v1.1.4322\system.windows.forms\1.0.5000.0__b77a5c561934e089_3770f62d\system.windows.forms.dll]  <N/A><N/A>
    [c:\windows\assembly\nativeimages1_v1.1.4322\system.drawing\1.0.5000.0__b03f5f7f11d50a3a_8e2493c6\system.drawing.dll]  <N/A><N/A>
    [c:\windows\assembly\nativeimages1_v1.1.4322\system\1.0.5000.0__b77a5c561934e089_888d61da\system.dll]  <N/A><N/A>
    [c:\windows\assembly\gac\hpqcc2\3.0.0.0__a53cf5803f4c3827\hpqcc2.dll]  <Hewlett-Packard Co.><053.000.013.000>
    [c:\windows\assembly\gac\hpqutils\4.0.0.0__a53cf5803f4c3827\hpqutils.dll]  <Hewlett-Packard Co.><053.000.013.000>
    [c:\windows\assembly\gac\hpqfmrsc\4.0.0.0__a53cf5803f4c3827\hpqfmrsc.dll]  <Hewlett-Packard Co.><053.000.013.000>
    [c:\windows\assembly\gac\hpqtray\4.0.0.0__a53cf5803f4c3827\hpqtray.dll]  <Hewlett-Packard Co.><053.000.013.000>
    [c:\windows\assembly\gac\hpqovskn\3.0.0.0__a53cf5803f4c3827\hpqovskn.dll]  <Hewlett-Packard Co.><053.000.013.000>
    [c:\windows\assembly\gac\hpqimvlt\3.0.0.0__a53cf5803f4c3827\hpqimvlt.dll]  <Hewlett-Packard Co.><053.000.013.000>
    [c:\windows\assembly\gac\hpqimgrc\4.0.0.0__a53cf5803f4c3827\hpqimgrc.dll]  <Hewlett-Packard Co.><053.000.013.000>
    [d:\program files\digital imaging\bin\zh-chs\hpqimzone.resources.dll]  < ><50.0.120.0>
    [c:\windows\assembly\gac\hpqntrop\4.0.0.0__a53cf5803f4c3827\hpqntrop.dll]  <Hewlett-Packard Co.><053.000.013.000>
    [c:\windows\assembly\gac\interop.hpqcxm08\3.0.0.0__a53cf5803f4c3827\interop.hpqcxm08.dll]  <Hewlett-Packard Co.><53.0.13.000>
    [D:\Program Files\Digital Imaging\bin\hpqcxm08.dll]  <Hewlett-Packard Co.><53.0.13.000>
    [c:\windows\assembly\nativeimages1_v1.1.4322\system.xml\1.0.5000.0__b77a5c561934e089_7e871ea9\system.xml.dll]  <N/A><N/A>
    [c:\windows\assembly\gac\lead\13.0.0.113__9cf889f53ea9b907\lead.dll]  <LEAD Technologies, Inc.><13.0.0.113>
    [c:\windows\assembly\gac\lead.wrapper\13.0.0.113__9cf889f53ea9b907\lead.wrapper.dll]  <LEAD Technologies, Inc.><13.0.0.113>
    [D:\Program Files\Digital Imaging\bin\ltkrn13n.dll]  <LEAD Technologies, Inc.><13.0.0.098>
    [c:\windows\assembly\gac\hpqtray.resources\4.0.0.0_zh-chs_a53cf5803f4c3827\hpqtray.resources.dll]  < ><50.0.120.0>
    [c:\windows\assembly\gac\hpqfmrsc.resources\4.0.0.0_zh-chs_a53cf5803f4c3827\hpqfmrsc.resources.dll]  < ><50.0.120.0>
    [c:\windows\assembly\gac\lead.windows.forms\13.0.0.113__9cf889f53ea9b907\lead.windows.forms.dll]  <LEAD Technologies, Inc.><13.0.0.113>
    [c:\windows\assembly\gac\lead.drawing\13.0.0.113__9cf889f53ea9b907\lead.drawing.dll]  <LEAD Technologies, Inc.><13.0.0.113>
    [c:\windows\assembly\gac\interop.hpqimgr\3.0.0.0__a53cf5803f4c3827\interop.hpqimgr.dll]  <Hewlett-Packard Co.><53.0.13.000>
    [D:\Program Files\Digital Imaging\Bin\hpqimgr.dll]  <Hewlett-Packard Co.><53.0.13.000>
    [c:\windows\assembly\gac\hpqasset\4.0.0.0__a53cf5803f4c3827\hpqasset.dll]  <Hewlett-Packard Co.><053.000.013.000>
    [d:\program files\digital imaging\bin\hpqmirsc.dll]  <Hewlett-Packard Co.><053.000.013.000>
    [d:\program files\digital imaging\bin\zh-chs\hpqmirsc.resources.dll]  < ><50.0.120.0>
    [c:\windows\assembly\gac\hpqedit\3.0.0.0__a53cf5803f4c3827\hpqedit.dll]  <Hewlett-Packard Co.><053.000.013.000>
    [c:\windows\assembly\gac\hpqvideo\3.0.0.0__a53cf5803f4c3827\hpqvideo.dll]  <Hewlett-Packard Co.><053.000.013.000>
    [c:\windows\assembly\gac\lead.windows.forms.drawingcontainer\13.0.0.113__9cf889f53ea9b907\lead.windows.forms.drawingcontainer.dll]  <LEAD Technologies, Inc.><13.0.0.113>
    [c:\windows\assembly\gac\hpqmdmr\4.0.0.0__a53cf5803f4c3827\hpqmdmr.dll]  <Hewlett-Packard Co.><053.000.013.000>
    [c:\windows\assembly\gac\lead.drawing.imaging.imageprocessing\13.0.0.113__9cf889f53ea9b907\lead.drawing.imaging.imageprocessing.dll]  <LEAD Technologies, Inc.><13.0.0.113>
    [c:\windows\assembly\gac\hpqimlib\3.0.0.0__a53cf5803f4c3827\hpqimlib.dll]  <Hewlett-Packard Co.><053.000.013.000>
    [c:\windows\assembly\gac\hpqedit.resources\3.0.0.0_zh-chs_a53cf5803f4c3827\hpqedit.resources.dll]  < ><50.0.131.0>
    [c:\windows\assembly\gac\hpqglutl\4.0.0.0__a53cf5803f4c3827\hpqglutl.dll]  <Hewlett-Packard Co.><053.000.013.000>
    [c:\windows\assembly\gac\hpqcc2.resources\3.0.0.0_zh-chs_a53cf5803f4c3827\hpqcc2.resources.dll]  < ><50.0.120.0>
    [d:\program files\digital imaging\bin\zh-chs\hpqvideo.resources.dll]  < ><50.0.127.0>
    [c:\windows\assembly\gac\interop.hpqvideo\3.0.0.0__a53cf5803f4c3827\interop.hpqvideo.dll]  <Hewlett-Packard Co.><53.0.13.000>
    [D:\Program Files\Digital Imaging\bin\hpqvdcom.dll]  <Hewlett-Packard Co.><53.0.13.000>
    [c:\windows\assembly\gac\hpqprrsc\4.0.0.0__a53cf5803f4c3827\hpqprrsc.dll]  <Hewlett-Packard Co.><053.000.013.000>
    [c:\windows\assembly\gac\hpqprrsc.resources\4.0.0.0_zh-chs_a53cf5803f4c3827\hpqprrsc.resources.dll]  < ><53.0.6.0>
    [c:\windows\assembly\gac\interop.hprblog\3.0.0.0__a53cf5803f4c3827\interop.hprblog.dll]  < ><3.0.0.0>
    [c:\windows\assembly\gac\hpqcprsc\3.0.0.0__a53cf5803f4c3827\hpqcprsc.dll]  <Hewlett-Packard Co.><053.000.013.000>
    [c:\windows\assembly\gac\hpqcprsc.resources\3.0.0.0_zh-chs_a53cf5803f4c3827\hpqcprsc.resources.dll]  <Hewlett-Packard Co.><50.0.145.0>
    [c:\windows\assembly\gac\hpqisrtb\4.0.0.0__a53cf5803f4c3827\hpqisrtb.dll]  <Hewlett-Packard Co.><053.000.013.000>
    [c:\windows\assembly\gac\hpqisrtb.resources\4.0.0.0_zh-chs_a53cf5803f4c3827\hpqisrtb.resources.dll]  <Hewlett-Packard Co.><53.0.13.0>
    [c:\windows\assembly\gac\hpqbakup\3.0.0.0__a53cf5803f4c3827\hpqbakup.dll]  <Hewlett-Packard Co.><053.000.013.000>
    [c:\windows\assembly\gac\hpqbakup.resources\3.0.0.0_zh-chs_a53cf5803f4c3827\hpqbakup.resources.dll]  < ><50.0.154.0>
    [c:\windows\assembly\gac\hpqthumb\3.0.0.0__a53cf5803f4c3827\hpqthumb.dll]  <Hewlett-Packard Co.><053.000.013.000>
[PID: 1984][D:\Program Files\Digital Imaging\bin\hpqSTE08.exe]  <Hewlett-Packard Co.><53.0.13.000>
    [D:\Program Files\Digital Imaging\bin\hpqmfc09.dll]  <Hewlett-Packard Co.><53.0.13.000>
    [D:\Program Files\Digital Imaging\bin\hpqtap08.dll]  <Hewlett-Packard Co.><53.0.13.000>
    [C:\Program Files\TENCENT\Adplus\Adplus.dll]  <Tencent><4, 0, 6, 61>
    [C:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
    [D:\Program Files\Digital Imaging\bin\hpqcxm08.dll]  <Hewlett-Packard Co.><53.0.13.000>
    [D:\Program Files\Digital Imaging\bin\hpqSTE08.rsc]  <Hewlett-Packard Co.><53.0.13.000>
    [C:\KAV6\KAVEXT.DLL]  <Kingsoft Corp.><2002, 5, 24, 6>
    [D:\Program Files\Digital Imaging\bin\hpqsti08.dll]  <Hewlett-Packard Co.><53.0.13.000>
    [D:\Program Files\Digital Imaging\bin\hpqcob08.dll]  <Hewlett-Packard Co.><53.0.13.000>
    [D:\Program Files\Digital Imaging\bin\hpqstp08.dll]  <Hewlett-Packard Co.><53.0.13.000>
    [D:\Program Files\Digital Imaging\bin\hpodio08.dll]  <Hewlett-Packard Co.><53.0.13.000>
    [D:\Program Files\Digital Imaging\bin\hpocxi08.dll]  <Hewlett-Packard Co.><53.0.13.000>
    [C:\windows\system32\hpzipr12.dll]  <HP><9, 0, 0, 0>
    [C:\windows\system32\hpzidr12.dll]  <HP><9, 0, 0, 0>
    [D:\Program Files\Digital Imaging\bin\hpqsem08.rsc]  <Hewlett-Packard Co.><53.0.13.000>
[PID: 2108][D:\Program Files\Digital Imaging\Product Assistant\bin\hprblog.exe]  <Hewlett-Packard Co.><53.0.13.000>
    [D:\Program Files\Digital Imaging\Product Assistant\bin\hprbutil.dll]  <Hewlett-Packard Co.><53.0.13.000>
    [C:\Program Files\TENCENT\Adplus\Adplus.dll]  <Tencent><4, 0, 6, 61>
    [C:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
gototop
 

[PID: 2188][D:\QQ\QQ2005\qq\QQ.exe]  <TENCENT><0, 0, 0, 0>
    [D:\QQ\QQ2005\qq\CoralAssist.DLL]  <Coral Team><4.5.0 build 20060422>
    [D:\QQ\QQ2005\qq\CoralQQ.DLL]  <Coral Team><4.5 Build 20060511>
    [D:\QQ\QQ2005\qq\ipsearcher.dll]  <N/A><1.0.0.4>
    [D:\QQ\QQ2005\qq\QQBaseClassInDll.dll]  <><1, 0, 0, 1>
    [D:\QQ\QQ2005\qq\QQHelperDll.dll]  <><1, 0, 0, 1>
    [D:\QQ\QQ2005\qq\BasicCtrlDll.dll]  <Tencent><5, 0, 200, 160>
    [C:\Program Files\TENCENT\Adplus\Adplus.dll]  <Tencent><4, 0, 6, 61>
    [C:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
    [D:\QQ\QQ2005\qq\QQAPI.dll]  <><1, 0, 0, 1>
    [D:\QQ\QQ2005\qq\TIMProxy.dll]  <tencent><0, 3, 2, 4>
    [D:\QQ\QQ2005\qq\LoginCtrl.dll]  <><1, 0, 0, 1>
    [D:\QQ\QQ2005\qq\npkcntc.dll]  <INCA Internet Co., Ltd.><2006, 3, 2, 1>
    [D:\QQ\QQ2005\qq\npkpdb.dll]  <INCA Internet Co., Ltd.><2003, 10, 1, 1>
    [D:\QQ\QQ2005\qq\QQRes.dll]  <tencent><1, 0, 0, 1>
    [D:\QQ\QQ2005\qq\QQMainFrame.dll]  <N/A><N/A>
    [D:\QQ\QQ2005\qq\CQQApplication.dll]  <N/A><N/A>
    [D:\QQ\QQ2005\qq\NewSkin.dll]  <><1, 0, 0, 1>
    [D:\QQ\QQ2005\qq\HostingMgr.dll]  <><1, 0, 0, 1>
    [D:\QQ\QQ2005\qq\CameraDll.dll]  <><1, 0, 0, 1>
    [D:\QQ\QQ2005\qq\MailSummary.dll]  <><1, 0, 0, 1>
    [D:\QQ\QQ2005\qq\QQSpace.dll]  <><1, 0, 0, 1>
    [C:\windows\system32\msdmo.dll]  <N/A><N/A>
    [D:\QQ\QQ2005\qq\QQGroupMng.dll]  <><1, 0, 0, 1>
    [D:\QQ\QQ2005\qq\GroupLive.dll]  <N/A><N/A>
    [D:\QQ\QQ2005\qq\QQSysMsgMng.dll]  <N/A><N/A>
    [D:\QQ\QQ2005\qq\UserDefinedHead.dll]  <><1, 0, 0, 1>
    [D:\QQ\QQ2005\qq\QQPlugin.dll]  <N/A><N/A>
    [D:\QQ\QQ2005\qq\QQConfigPlugin.dll]  <><1, 0, 0, 1>
    [D:\QQ\QQ2005\qq\QRingMng.dll]  <N/A><N/A>
    [D:\QQ\QQ2005\qq\PhoneAPI.dll]  <><1, 0, 0, 1>
    [D:\QQ\QQ2005\qq\DialerAllinOne.dll]  <tencent><1, 4, 0, 0>
    [D:\QQ\QQ2005\qq\QQAvatar.dll]  <N/A><N/A>
    [D:\QQ\QQ2005\qq\FlashAvatarDll.dll]  <><1, 4, 0, 1>
    [D:\QQ\QQ2005\qq\LongConnection.dll]  <tencent><5, 0, 200, 160>
    [D:\QQ\QQ2005\qq\QQPet.dll]  <><1, 0, 0, 1>
    [D:\QQ\QQ2005\qq\BQQApplication.dll]  <N/A><N/A>
    [D:\QQ\QQ2005\qq\CommercesMng.dll]  <><1, 0, 0, 1>
    [D:\QQ\QQ2005\qq\PersonalDesktop.dll]  <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2>
    [D:\QQ\QQ2005\qq\QQUdpGetFileLib.dll]  <tencent><0, 2, 2, 3>
    [D:\QQ\QQ2005\qq\QQAddr.dll]  <深圳市腾讯计算机系统有限公司><5, 0, 101, 200>
    [D:\QQ\QQ2005\qq\QQSceneMng.dll]  <N/A><N/A>
    [D:\QQ\QQ2005\qq\QQPhoneHelper.dll]  <腾讯科技(深圳)有限公司><2, 0, 3, 30>
    [D:\QQ\QQ2005\qq\QQAllInOne.dll]  <N/A><N/A>
    [D:\QQ\QQ2005\qq\SCCore.dll]  <N/A><N/A>
    [D:\QQ\QQ2005\qq\QQCustomFace.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx]  <Macromedia, Inc.><8,0,22,0>
    [D:\QQ\QQ2005\qq\GroupConnection.dll]  <Tencent><5, 0, 202, 170>
    [C:\windows\system32\FHPI.IME]  <DUT><4.5>
    [C:\windows\system32\XHPYConv.dll]  <><1, 0, 0, 1>
[PID: 2264][D:\QQ\QQ2005\qq\TIMPlatform.exe]  <tencent><0, 3, 1, 8>
    [C:\Program Files\TENCENT\Adplus\Adplus.dll]  <Tencent><4, 0, 6, 61>
    [C:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
    [D:\QQ\QQ2005\qq\TIMProxy.dll]  <tencent><0, 3, 2, 4>
[PID: 2316][C:\Program Files\Internet Explorer\iexplore.exe]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\Program Files\TENCENT\Adplus\Adplus.dll]  <Tencent><4, 0, 6, 61>
    [C:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
    [C:\windows\system32\kakatool.dll]  <Beijing Rising Technology Co., Ltd.><2, 0, 0, 8>
    [C:\KAV6\KAVEXT.DLL]  <Kingsoft Corp.><2002, 5, 24, 6>
    [C:\windows\system32\FHPI.IME]  <DUT><4.5>
    [C:\windows\system32\XHPYConv.dll]  <><1, 0, 0, 1>
    [C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx]  <Macromedia, Inc.><8,0,22,0>
[PID: 2716][C:\Program Files\Microsoft Office\Office\WINWORD.EXE]  <Microsoft Corporation><9.0.7924>
    [C:\Program Files\TENCENT\Adplus\Adplus.dll]  <Tencent><4, 0, 6, 61>
    [C:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
    [C:\windows\System32\spool\DRIVERS\W32X86\3\hpzpm312.dll]  <HP><2.335.5.0>
    [C:\windows\System32\spool\DRIVERS\W32X86\3\hpz2ku12.dll]  <HP><2.335.5.0>
    [C:\windows\system32\FHPI.IME]  <DUT><4.5>
    [C:\windows\system32\XHPYConv.dll]  <><1, 0, 0, 1>
[PID: 2228][C:\Program Files\MSN Messenger\msnmsgr.exe]  <Microsoft Corporation><7.5.0324>
    [C:\Program Files\TENCENT\Adplus\Adplus.dll]  <Tencent><4, 0, 6, 61>
    [C:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
    [C:\windows\system32\msdmo.dll]  <N/A><N/A>
[PID: 3740][D:\DownLoads\迅雷\Program\Thunder5.exe]  <Thunder Networking Technologies,LTD><5.1.6.198>
    [D:\DownLoads\迅雷\Program\UpdateDownload.dll]  <Thunder Networking Technologies,LTD><1, 0, 1, 3>
    [D:\DownLoads\迅雷\Program\download_interface.dll]  <Thunder Networking Technologies,LTD><1, 0, 2, 69>
    [D:\DownLoads\迅雷\Program\log4cplus.dll]  <><1, 0, 2, 1>
    [D:\DownLoads\迅雷\Program\stlport_vc646.dll]  <STLport Consulting, Inc.><4.6.2003.1031>
    [D:\DownLoads\迅雷\Program\asyn_dns.dll]  <N/A><N/A>
    [D:\DownLoads\迅雷\Program\msgmanage.dll]  <Thunder Networking Technologies,LTD><1, 0, 0, 15>
    [D:\DownLoads\迅雷\Program\historyinfo_manage.dll]  <Thunder Networking Technologies,LTD><5, 2, 0, 148>
    [C:\Program Files\TENCENT\Adplus\Adplus.dll]  <Tencent><4, 0, 6, 61>
    [C:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
    [D:\DownLoads\迅雷\Program\RegisterDll.dll]  <Thunder Networking Technologies,LTD><1, 2, 0, 7>
    [D:\DownLoads\迅雷\Program\FloatBar.dll]  <Thunder Networking Technologies,LTD><1, 0, 0, 2>
    [D:\DownLoads\迅雷\Components\InMedia\iEmbedShell.dll]  < ><1, 0, 0, 5>
    [D:\DownLoads\迅雷\Components\InMedia\iEmbed.dll]  < ><2, 1, 0, 29>
    [D:\DownLoads\迅雷\Components\P4PClient\P4PClient.dll]  <Thunder Networking Technologies,LTD><1, 0, 0, 4>
    [C:\KAV6\KAVEXT.DLL]  <Kingsoft Corp.><2002, 5, 24, 6>
    [D:\DownLoads\迅雷\Program\iTargetAd.dll]  <Thunder Networking Technologies,LTD><1, 0, 0, 60>
    [C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx]  <Macromedia, Inc.><8,0,22,0>
[PID: 3004][D:\DownLoads\木马专杀\卡卡助手\SREng.exe]  <Smallfrogs Studio><2.0.12.350>
    [C:\Program Files\TENCENT\Adplus\Adplus.dll]  <Tencent><4, 0, 6, 61>
    [C:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
gototop
 

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================


顺便提一句,启动项那里我设置过了的,什么酷客平台什么的都已经删掉了。
gototop
 

用sreng删除
启动项目
注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<winlass><C:\Program Files\Outlook Express\winlass.exe>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<kc32update><; rundll32 C:\windows\system32\kc32update.dll,AppMain>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<KUCO><; D:\酷客娱乐平台\KUCO.exe>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<vqpl20to><; RunDll32 "C:\windows\Downlo~1\memu8n7v.dll",Run>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<winlass><; C:\Program Files\Outlook Express\winlass.exe

重启后删除

C:\Program Files\Outlook Express\winlass.exe
C:\windows\system32\kc32update.dll
gototop
 
12   1  /  2  页   跳转
页面顶部
Powered by Discuz!NT