这是日志：
Logfile of Kaka v2. 0. 0. 9 Scan Module v2. 0. 0. 1
Scan saved at 09:46:24, on 2006-08-05
Platform: Microsoft Windows XP Professional Service Pack 2 (Build 2600)
MSIE: Internet Explorer v6.00 SP2; (6.00.2900.2180 (xpsp_sp2_rtm.040803-2158))
Running processes:
[SMSS.EXE]
CommandLine =
[CSRSS.EXE]
CommandLine = C:\WINDOWS\system32\csrss.exe
ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
[WINLOGON.EXE]
CommandLine = winlogon.exe
[SERVICES.EXE]
CommandLine = C:\WINDOWS\system32\services.exe
[LSASS.EXE]
CommandLine = C:\WINDOWS\system32\lsass.exe
[SVCHOST.EXE]
CommandLine = C:\WINDOWS\system32\svchost -k DcomLaunch
[SVCHOST.EXE]
CommandLine = C:\WINDOWS\system32\svchost -k rpcss
[SVCHOST.EXE]
CommandLine = C:\WINDOWS\System32\svchost.exe -k netsvcs
[SVCHOST.EXE]
CommandLine = C:\WINDOWS\system32\svchost.exe -k NetworkService
[SVCHOST.EXE]
CommandLine = C:\WINDOWS\system32\svchost.exe -k LocalService
[rfwsrv.exe]
CommandLine = d:\工具\瑞星安全软件\瑞星防火墙\rfwsrv.exe
[SPOOLSV.EXE]
CommandLine = C:\WINDOWS\system32\spoolsv.exe
[MDM.EXE]
CommandLine = "C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE"
[SCHVOTS.EXE]
CommandLine = C:\WINDOWS\lm\SCHVOTS.EXE
[SVCHOST.EXE]
CommandLine = C:\WINDOWS\system32\svchost.exe -k imgsvc
[TLNTSVR.EXE]
CommandLine = C:\WINDOWS\system32\tlntsvr.exe
[SVCHOST.EXE]
CommandLine = C:\WINDOWS\System32\svchost.exe -k HTTPFilter
[RUNDLL32.EXE]
CommandLine = Rundll32.exe C:\WINDOWS\DOWNLO~1\CnsMin.dll,Rundll32
[realsched.exe]
CommandLine = "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
[SVOHOST.exe]
CommandLine = "C:\WINDOWS\system32\SVOHOST.exe"
[CTFMON.EXE]
CommandLine = "C:\WINDOWS\system32\ctfmon.exe"
[RACER.EXE]
CommandLine = "C:\Program Files\racer-henan-cnc\racer.exe"
[conime.exe]
CommandLine = C:\WINDOWS\system32\conime.exe
[RFWMAIN.EXE]
CommandLine = -StartUp
[RacerKp.exe]
CommandLine = RacerKp.exe
[CCenter.exe]
CommandLine = "D:\工具\瑞星安全软件\瑞星杀毒程序\CCenter.exe"
[rfwProxy.exe]
CommandLine = d:\工具\瑞星安全软件\瑞星防火墙\rfwproxy.exe
[RsAgent.exe]
CommandLine = "D:\工具\瑞星安全软件\瑞星杀毒程序\RsAgent.exe"
[AgentSvr.exe]
CommandLine = C:\WINDOWS\msagent\AgentSvr.exe -Embedding
[QQ.exe]
CommandLine = "D:\工具\腾讯\QQ.exe"
[QQPet.exe]
CommandLine = "D:\工具\腾讯\qqpet\qqpet.exe" 514401010600041200BDA8B9B2BD8C9F8C80B2899AA58C838981880400000030060100040F00A0B5A4AFA09182919DAF9487A5999E040000009F276A18061100BEABBAB1BE8F9C8F83B19D9A9CA0878D850B00000034423D5FDB808D38184B21061000BFAABBB0BF8E9D8E82B09C9B9DA48A964000000089FBFC8FFAFAFC8B8A8A898C898AFC8989FA8D86F987F98D8A8B8CFCFC8C88F98BFCFC8FFE87FBFCF98EFDFCFCFA8F8D8C89F9FE8BF987FEFCFAF9FC8A8E8F8A040100AE04000000EBF4D344021400BBAEBFB4BB8A998A86B488BB99849392BF929B8E0100000000
[RUNDLL32.EXE]
CommandLine = C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
[Thunder5.exe]
CommandLine = "D:\工具\讯雷\Program\Thunder5.exe" /s /221.13.151.86microsof-de01257E3
[EXPLORER.EXE]
CommandLine = C:\WINDOWS\explorer.exe
[RUNDLL32.EXE]
CommandLine = "C:\WINDOWS\system32\rundll32.exe" C:\WINDOWS\system32\shell32.dll,Control_RunDLL appwiz.cpl
[IEXPLORE.EXE]
CommandLine = "C:\Program Files\Internet Explorer\iexplore.exe"
[KkScan.exe]
CommandLine = "C:\Program Files\Rising\KaKaToolBar\KkScan.exe"
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=%SystemRoot%\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page=http://www.yahoo.com.cn
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (file missing)
O2 - BHO: CnsHook Class - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINDOWS\DOWNLO~1\CnsHook.dll
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\KakaTool.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [eMuleAutoStart] D:\工具\eMule\emule.exe -AutoStart
O4 - HKLM\..\Run: [CnsMin] Rundll32.exe C:\WINDOWS\DOWNLO~1\CnsMin.dll,Rundll32
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Thunder] "D:\工具\讯雷\Thunder.exe" /s
O4 - HKLM\..\Run: [SoundMam] C:\WINDOWS\system32\SVOHOST.exe
O4 - HKLM\..\Run: [helper.dll] C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - HKLM\..\Run: [RavTask] "D:\工具\瑞星安全软件\瑞星杀毒程序\RavTask.exe" -system
O4 - Startup: desktop.ini =
O4 - Startup: 腾讯QQ.lnk = D:\工具\腾讯\QQ.exe
O4 - Global Startup: desktop.ini =
O4 - Global Startup: 瑞星监控中心.lnk = D:\工具\瑞星安全软件\瑞星杀毒程序\RavMon.exe
O4 - Global Startup: 河南网通宽带用户客户端.lnk = C:\Program Files\racer-henan-cnc\racer.exe
O8 - Extra context menu item: &使用迅雷下载 - D:\工具\讯雷\Program\GetUrl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - D:\工具\讯雷\Program\GetAllUrl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\工具\腾讯\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\工具\腾讯\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\工具\腾讯\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\工具\腾讯\SendMMS.htm
O9 - Extra Button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail (file missing)
O9 - Extra Button: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao (file missing)
O9 - Extra Button: 雅虎助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist (file missing)
O9 - Extra Button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg (file missing)
O9 - Extra Button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - Extra 'Tools' menuitem: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - Extra Button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O9 - Extra 'Tools' menuitem: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O10 - Unknown file in Winsock LSP: C:\WINDOWS\system32\wshcon32.dll
O10 - Unknown file in Winsock LSP: C:\WINDOWS\system32\wshcon32.dll
O11 - Options group: [!CNS] 网络实名
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
O18 - Filter : application/octet-stream - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll
O18 - Filter : application/x-complus - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll
O18 - Filter : application/x-msdownload - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll
O18 - Protocol: ipp - (no CLSID) - (no file)
O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll
O18 - Protocol: msdaipp - (no CLSID) - (no file)
O23 - Service: Human Interface Device Access (HidServ) - - C:\WINDOWS\system32\svchost.exe -k netsvcs
O23 - Service: InCD Helper (InCDsrv) - Nero AG - D:\工具\Nero 7\InCD\InCDsrv.exe
O23 - Service: Macromedia Licensing Service (Macromedia Licensing Service) - - "C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"
O23 - Service: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - d:\工具\瑞星安全软件\瑞星防火墙\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - d:\工具\瑞星安全软件\瑞星防火墙\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - "D:\工具\瑞星安全软件\瑞星杀毒程序\CCenter.exe"
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - "D:\工具\瑞星安全软件\瑞星杀毒程序\Ravmond.exe"
O23 - Service: TNS Servers (Service49773) - - C:\WINDOWS\lm\SCHVOTS.EXE
