我的电脑中了Trojan.QQRob.gi这个木马病毒,据我所之好像是一个QQ盗号病毒,但是我用了瑞星,ewido(3.5版),费尔托斯安全2005,等三个杀毒软件都根本不能杀掉这个病毒.只有这个病毒发作时ewido才能杀到,但是根本找不到这个病毒的根源在哪里.所以在这里肯请各位朋友指点一下,这个病毒要如何才能杀掉???/

http://forum.ikaka.com/topic.asp?board=28&artid=8105899
下载HijackThis...把日志帖上来

HijackThis_815汉化版扫描日志 V1.99.1
保存于      23:23:09, 日期 2006-8-15
操作系统：  Windows XP SP2 (WinNT 5.01.2600)
浏览器：    Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程：         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
D:\Ring\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
D:\Ring\Rising\Rav\Ravmond.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
D:\Ring\Rising\Rav\RavStub.exe
D:\Ring\Rising\Rav\RavTask.exe
D:\Ring\Rising\Rav\Ravmon.exe
D:\超级兔子\MagicSet\SRFC.EXE
C:\费尔托斯特安全\安装\twister.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Filseclab\FilMsg.exe
C:\ewido-setup\ewido anti-malware3.5\ewidoctrl.exe
C:\ewido-setup\ewido anti-malware3.5\ewidoguard.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\Ring\Rising\Rav\Rav.exe
D:\迅雷\软件\Program\Thunder5.exe
D:\WinRAR\程序\WinRAR.exe
C:\DOCUME~1\new\LOCALS~1\Temp\Rar$EX03.582\HijackThis1991zww.exe

R3 - URLSearchHook: (no name) - {BAB1AC41-6FF7-4F2E-A04E-5C592CCFEA7D} - (no file)
R3 - URLSearchHook: Tencent SearchHook - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - C:\Program Files\TENCENT\Adplus\SSAddr1.dll
O2 - BHO: 搜搜地址栏搜索 - {0C7C23EF-A848-485B-873C-0ED954731014} - C:\Program Files\TENCENT\Adplus\SSAddr1.dll
O2 - BHO: 超级兔子上网精灵 - {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} - D:\超级兔子\MagicSet\haokanbar.dll
O3 - IE工具栏增项: (no name) - {43869BB3-22FD-4F15-9B46-238106BA2F4E}? - (no file)
O3 - IE工具栏增项: 超级兔子上网精灵 - {43869BB3-22FD-4F15-9B46-238106BA2F4E} - D:\超级兔子\MagicSet\haokanbar.dll
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [RavTask] "D:\Ring\Rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [NeroFilterCheck] ; C:\WINDOWS\system32\NeroCheck.exe
O4 - 启动项HKLM\\Run: [Super Rabbit SafeEdit] D:\超级兔子\MagicSet\SRFC.EXE /Load
O4 - 启动项HKLM\\Run: [stup.exe] C:\PROGRA~1\TENCENT\Adplus\stup.exe
O4 - 启动项HKLM\\Run: [LiveUpatePower] ; MyUpdate.exe
O4 - 启动项HKLM\\Run: [twister] "C:\费尔托斯特安全\安装\twister.exe" -a
O4 - 启动项HKLM\\RunOnce: [RavStub] "D:\Ring\Rising\Rav\ravstub.exe" /RUNONCE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: 费尔消息服务.lnk = ?
O8 - IE右键菜单中的新增项目: &使用迅雷下载 - D:\迅雷\软件\Program\GetUrl.htm
O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - D:\迅雷\软件\Program\GetAllUrl.htm
O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\WINDOWS\system32\shdocvw.dll
O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\WINDOWS\system32\shdocvw.dll
O11 - Options group: [TBH] 搜搜地址栏搜索
O16 - DPF: {3676996C-D8C6-4356-B4BE-3A80400C606E} ({3676996C-D8C6-4356-B4BE-3A80400C606E}) - http://www.17bobo.com/Software/BoBo_ActiveX_1.19b.ocx
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (CEditCtrl Object) - https://img.alipay.com/download/1007/aliedit.cab
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O16 - DPF: {7FC751A9-492D-41B1-9F8D-D2C8809D8907} (EmoWebInstallerCtl Class) - http://img.365ren.com/tv/cabs/EmoWebInstaller.cab
O16 - DPF: {A8C3B40D-5384-44AD-ACC4-504B4D8A85F5} (BoBo_V2 Control) - http://www.88mov.com/88movV203.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{728ECC81-9A08-4BE2-974F-F9B9046CF8DE}: NameServer = 218.6.200.139 61.139.2.69
O17 - HKLM\System\CCS\Services\Tcpip\..\{E00A090A-6323-469D-B476-931258CE5DFC}: NameServer = 61.139.39.73,61.139.2.69
O23 - NT 服务: ewido security suite control - ewido networks - C:\ewido-setup\ewido anti-malware3.5\ewidoctrl.exe
O23 - NT 服务: ewido security suite guard - ewido networks - C:\ewido-setup\ewido anti-malware3.5\ewidoguard.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\Ring\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\Ring\Rising\Rav\Ravmond.exe

修复并删除相关文件
R3 - URLSearchHook: (no name) - {BAB1AC41-6FF7-4F2E-A04E-5C592CCFEA7D} - (no file)
R3 - URLSearchHook: Tencent SearchHook - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - C:\Program Files\TENCENT\Adplus\SSAddr1.dll
O2 - BHO: 搜搜地址栏搜索 - {0C7C23EF-A848-485B-873C-0ED954731014} - C:\Program Files\TENCENT\Adplus\SSAddr1.dll
O3 - IE工具栏增项: (no name) - {43869BB3-22FD-4F15-9B46-238106BA2F4E}? - (no file)
O4 - 启动项HKLM\\Run: [stup.exe] C:\PROGRA~1\TENCENT\Adplus\stup.exe
O4 - 启动项HKLM\\Run: [LiveUpatePower] ; MyUpdate.exe
O11 - Options group: [TBH] 搜搜地址栏搜索
卸载搜搜地址栏搜索

我卸载了搜搜地址栏搜索,
    不知怎么修改:R3 - URLSearchHook: (no name) - {BAB1AC41-6FF7-4F2E-A04E-5C592CCFEA7D} - (no file)
    无法删除:R3 - URLSearchHook: Tencent SearchHook - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - C:\Program Files\TENCENT\Adplus\SSAddr1.dll

我现在的日志是:
HijackThis_815汉化版扫描日志 V1.99.1
保存于      0:57:30, 日期 2006-8-16
操作系统：  Windows XP SP2 (WinNT 5.01.2600)
浏览器：    Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程：         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
D:\Ring\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
D:\Ring\Rising\Rav\Ravmond.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
D:\Ring\Rising\Rav\RavStub.exe
D:\Ring\Rising\Rav\RavTask.exe
D:\Ring\Rising\Rav\Ravmon.exe
D:\超级兔子\MagicSet\SRFC.EXE
C:\费尔托斯特安全\安装\twister.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Filseclab\FilMsg.exe
C:\ewido-setup\ewido anti-malware3.5\ewidoctrl.exe
C:\ewido-setup\ewido anti-malware3.5\ewidoguard.exe
D:\绑架克星\Hijackthis1991zww\HijackThis1991zww.exe

R3 - URLSearchHook: (no name) - {BAB1AC41-6FF7-4F2E-A04E-5C592CCFEA7D} - (no file)
O2 - BHO: 超级兔子上网精灵 - {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} - D:\超级兔子\MagicSet\haokanbar.dll
O3 - IE工具栏增项: (no name) - {43869BB3-22FD-4F15-9B46-238106BA2F4E}? - (no file)
O3 - IE工具栏增项: 超级兔子上网精灵 - {43869BB3-22FD-4F15-9B46-238106BA2F4E} - D:\超级兔子\MagicSet\haokanbar.dll
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [RavTask] "D:\Ring\Rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [NeroFilterCheck] ; C:\WINDOWS\system32\NeroCheck.exe
O4 - 启动项HKLM\\Run: [Super Rabbit SafeEdit] D:\超级兔子\MagicSet\SRFC.EXE /Load
O4 - 启动项HKLM\\Run: [LiveUpatePower] ; MyUpdate.exe
O4 - 启动项HKLM\\Run: [twister] "C:\费尔托斯特安全\安装\twister.exe" -a
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: 费尔消息服务.lnk = ?
O8 - IE右键菜单中的新增项目: &使用迅雷下载 - D:\迅雷\软件\Program\GetUrl.htm
O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - D:\迅雷\软件\Program\GetAllUrl.htm
O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\WINDOWS\system32\shdocvw.dll
O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\WINDOWS\system32\shdocvw.dll
O16 - DPF: {3676996C-D8C6-4356-B4BE-3A80400C606E} ({3676996C-D8C6-4356-B4BE-3A80400C606E}) - http://www.17bobo.com/Software/BoBo_ActiveX_1.19b.ocx
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (CEditCtrl Object) - https://img.alipay.com/download/1007/aliedit.cab
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O16 - DPF: {7FC751A9-492D-41B1-9F8D-D2C8809D8907} (EmoWebInstallerCtl Class) - http://img.365ren.com/tv/cabs/EmoWebInstaller.cab
O16 - DPF: {A8C3B40D-5384-44AD-ACC4-504B4D8A85F5} (BoBo_V2 Control) - http://www.88mov.com/88movV203.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{728ECC81-9A08-4BE2-974F-F9B9046CF8DE}: NameServer = 218.6.200.139 61.139.2.69
O17 - HKLM\System\CCS\Services\Tcpip\..\{E00A090A-6323-469D-B476-931258CE5DFC}: NameServer = 61.139.39.73,61.139.2.69
O23 - NT 服务: ewido security suite control - ewido networks - C:\ewido-setup\ewido anti-malware3.5\ewidoctrl.exe
O23 - NT 服务: ewido security suite guard - ewido networks - C:\ewido-setup\ewido anti-malware3.5\ewidoguard.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\Ring\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\Ring\Rising\Rav\Ravmond.exe

修复
R3 - URLSearchHook: (no name) - {BAB1AC41-6FF7-4F2E-A04E-5C592CCFEA7D} - (no file)
O3 - IE工具栏增项: (no name) - {43869BB3-22FD-4F15-9B46-238106BA2F4E}? - (no file)
O4 - 启动项HKLM\\Run: [LiveUpatePower] ; MyUpdate.exe
最好在安全模式下操作

引用:

【yanmings的贴子】修复 R3 - URLSearchHook: (no name) - {BAB1AC41-6FF7-4F2E-A04E-5C592CCFEA7D} - (no file) O3 - IE工具栏增项: (no name) - {43869BB3-22FD-4F15-9B46-238106BA2F4E}? - (no file) O4 - 启动项HKLM\\Run: [LiveUpatePower] ; MyUpdate.exe 最好在安全模式下操作 ………………

请问怎么修复,或用什么工具来修复???是删除文件???在哪个文件下面去修复???
请这位大哥说的详细一点!!谢谢!!!!

引用:

【xiaomiao6的贴子】 引用: 【yanmings的贴子】修复 R3 - URLSearchHook: (no name) - {BAB1AC41-6FF7-4F2E-A04E-5C592CCFEA7D} - (no file) O3 - IE工具栏增项: (no name) - {43869BB3-22FD-4F15-9B46-238106BA2F4E}? - (no file) O4 - 启动项HKLM\\Run: [LiveUpatePower] ; MyUpdate.exe 最好在安全模式下操作 ……………… 请问怎么修复,或用什么工具来修复???是删除文件???在哪个文件下面去修复??? 请这位大哥说的详细一点!!谢谢!!!! ………………

用你扫日志的工具修复

我用卡巴斯基一下就把这个病毒杀死了.谢谢各位的帮忙!!!!

我的日志 大侠帮忙啊也是这个Trojan.QQRob.gi

Logfile of HijackThis v1.99.1
Scan saved at 16:42:53, on 2006-8-19
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TTPlayer\TTPlayer.exe
C:\WINDOWS\system32\wscntfy.exe
D:\msn\msnmsgr.exe
G:\mathon\Maxthon\Maxthon.exe
C:\Documents and Settings\window\桌面\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: TeachingHandler - {31EBA2E2-58B2-4980-9C41-F12F5F1422C5} - C:\Program Files\Common Files\Collegesoft\Share Components\TPHANDLE.dll
O2 - BHO: Wbho Class - {40E3A34A-3282-41F8-AD2C-051BAB96AD4A} - C:\WINDOWS\system32\Usign.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\qq\tencent\QQIEHelper.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\FLASHGET\jccatch.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\FLASHGET\fgiebar.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - E:\canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [ExFilter] Rundll32.exe C:\WINDOWS\system32\hookdll.dll,ExecFilter solo
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [KAVPersonal50] "D:\卡巴斯基\kabasiji\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: Easy-WebPrint打印 - res://E:\canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint添加到打印列表 - res://E:\canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint预览 - res://E:\canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint高速打印 - res://E:\canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\qq\tencent\AddToNetDisk.htm
O8 - Extra context menu item: 使用网际快车下载 - D:\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - D:\FlashGet\jc_all.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\qq\tencent\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\qq\tencent\AddEmotion.htm
O8 - Extra context menu item: 用 - D:\qq\tencent\SendMMS.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\qq\tencent\SendMMS.htm
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: TOL24 - {345ff7d8-2364-4ef7-889b-7d3c1d0bd342} - http://www.TOL24.com (file missing)
O9 - Extra button: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ATS专业网络心理测评系统(429b.) - {A7907061-4B2F-4A0D-B37D-FEF8E13D99AA} - C:\Program Files\ats - www.psy-test.net\ats.exe (file missing)
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\qq\tencent\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\qq\tencent\QQ.EXE
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\FLASHGET\flashget.exe
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\qq\tencent\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\qq\tencent\QQIEHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D30CA0FD-1CA0-11D4-AC78-006008A9A8BC} (WebBasedClientInstall Class) - http://202.118.1.38/scs2000/webinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D2191E0A-090E-4390-8FDB-D2108F719E5E}: NameServer = 202.96.69.38 202.96.64.68
O18 - Filter: application/xhtml+xml - {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll
O18 - Filter: text/xml; charset=iso-8859-1 - {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll
O18 - Filter: text/xml; charset=utf-8 - {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: kavsvc - Kaspersky Lab - D:\卡巴斯基\kabasiji\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Tgeon Server - Unknown owner - C:\WINDOWS\G_Server2.03.exe (file missing)
O23 - Service: Windows Management - Unknown owner - C:\WINDOWS\system32\ Serverkljs.exe (file missing)