Logfile of HijackThis v1.99.1
Scan saved at 10:32:49, on 2005-9-28
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Antiy Labs\Alive\AliveCenter.exe
C:\Program Files\KV2006\KVSrvXP.exe
C:\Program Files\KV2006\kvwsc.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe
C:\Program Files\rising\rfw\Rfw.exe
D:\超级兔子ie保护器\IELock\ielock.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Conexant\AccessRunner ADSL\CnxDslTb.exe
C:\Program Files\KV2006\KVMonXP.kxp
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\KV2006\TrojDie.kxp
C:\Program Files\KV2006\KRegEx.exe
C:\Program Files\KV2006\UIHost.exe
C:\WINDOWS\system32\DllHost.exe
E:\腾讯QQ\qq\QQ.exe
E:\腾讯QQ\qq\TIMPlatform.exe
D:\新建文件夹\Iparmor\Iparmor.exe
C:\WINDOWS\SoftwareDistribution\Download\d17d5a02bade1355c53c05a074638a14\iexplore.exe
F:\汉化扫描工具\HijackThis.exe

O2 - BHO: FiltrateWebObj Class - {42AFACEE-2A77-41EB-9EE2-D9F8AF827F90} - C:\Program Files\KV2006\KVBHO.dll
O2 - BHO: BrowseHelper Class - {80BF4637-D65B-43F3-BB60-C5DD3D5FB7B9} - C:\Program Files\KV2006\KvShell.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - E:\网际士快斐车礬\FLASHGET\jccatch.dll (file missing)
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - E:\网际士快斐车礬\FLASHGET\fgiebar.dll (file missing)
O3 - Toolbar: (no name) - {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} - (no file)
O3 - Toolbar: 江民杀毒工具栏 - {B5A34A93-D538-43A7-8371-864CB6148D12} - C:\Program Files\KV2006\KvShell.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvMixerTray] C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe
O4 - HKLM\..\Run: [RfwMain] rem C:\Program Files\rising\Rfw\rfwmain.exe
O4 - HKLM\..\Run: [rfw] C:\Program Files\rising\rfw\Rfw.exe
O4 - HKLM\..\Run: [Super Rabbit IEPro] rem D:\超级兔子ie保护器\IEPro\SRIECLI.EXE /load
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Super Rabbit IELock] D:\超级兔子ie保护器\IELock\ielock.exe /load
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\Conexant\AccessRunner ADSL\CnxDslTb.exe"
O4 - HKLM\..\Run: [KvMonXP] C:\Program Files\KV2006\KVMonXP.kxp /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Super Rabbit SRRestore] D:\超级兔~1\IEPRO\SRRest.exe /autosave
O8 - Extra context menu item: 使用网际快车下载 - E:\网际快车\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - E:\网际快车\FlashGet\jc_all.htm
O8 - Extra context menu item: 导出到 Microsoft Excel(&x) - res://D:\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - E:\腾讯QQ\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - E:\腾讯QQ\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - E:\腾讯QQ\qq\SendMMS.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\网际快车\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\网际快车\FLASHGET\flashget.exe
O10 - Unknown file in Winsock LSP: c:\program files\kv2006\kvsock_1.dll
O10 - Unknown file in Winsock LSP: c:\program files\kv2006\kvsock_1.dll
O10 - Unknown file in Winsock LSP: c:\program files\kv2006\kvsock_1.dll
O10 - Unknown file in Winsock LSP: c:\program files\kv2006\kvsock_1.dll
O10 - Unknown file in Winsock LSP: c:\program files\kv2006\kvsock_1.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1118555937875
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1122807103859
O17 - HKLM\System\CCS\Services\Tcpip\..\{CD566ED3-C751-4605-8E51-11C496606C59}: NameServer = 61.134.1.9 219.146.0.130
O20 - AppInit_DLLs: apihookdll.dll
O23 - Service: Antiy live update (Alive Auto-Update Service) - Unknown owner - C:\Program Files\Antiy Labs\Alive\AliveCenter.exe
O23 - Service: KVSrvXP - Jiangmin Co. Ltd - C:\Program Files\KV2006\KVSrvXP.exe
O23 - Service: KVWSC - Jiangmin Co.Ltd - C:\Program Files\KV2006\kvwsc.exe
O23 - Service: Windows User Mode Driver Framework (UMWdf) - Unknown owner - C:\WINDOWS\system32\wdfmgr.exe (file missing)
木马克星扫描提示好几个文件怀疑为灰鸽子木马,我想让BAOHE版主看看我是否中了灰鸽子:

等待BAOHE版主

【回复“风中的雨和云”的帖子】
木马克星的东东，我不信。

O23 - Service: Windows User Mode Driver Framework (UMWdf) - Unknown owner - C:\WINDOWS\system32\wdfmgr.exe (file missing)
这个.exe文件已经被删。用HijackThis修复这项。

【回复“风中的雨和云”的帖子】

引用:

【baohe的贴子】【回复“风中的雨和云”的帖子】 木马克星的东东，我不信。 O23 - Service: Windows User Mode Driver Framework (UMWdf) - Unknown owner - C:\WINDOWS\system32\wdfmgr.exe (file missing) 这个.exe文件已经被删。用HijackThis修复这项。 ...........................

是从备份中恢复,还是用工具中的修复选项??

引用:

【baohe的贴子】【回复“风中的雨和云”的帖子】 木马克星的东东，我不信。 O23 - Service: Windows User Mode Driver Framework (UMWdf) - Unknown owner - C:\WINDOWS\system32\wdfmgr.exe (file missing) 这个.exe文件已经被删。用HijackThis修复这项。 ...........................

用HijackThis修复了多次,那一项始终存在!!