高手帮忙看看~~~~~~~~~~~~ 我又重装的c盘. 新的日志在4楼 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛高手帮忙看看~~~~~~~~~~~~ 我又重装的c盘. 新的日志在4楼

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

1

1 / 1 页

跳转页

高手帮忙看看~~~~~~~~~~~~ 我又重装的c盘. 新的日志在4楼

无笑山人拙长孩提狮帖子:63 注册: 2006-03-03 来自:	发表于： 2006-08-05 23:18 \| 只看楼主短消息资料字号：小中大 1楼高手帮忙看看~~~~~~~~~~~~ 我又重装的c盘. 新的日志在4楼 Logfile of HijackThis v1.99.1 Scan saved at 23:02:43, on 2006-8-5 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\eXk\command.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Network Monitor\netmon.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\update\updmgr.exe C:\WINDOWS\system32\smsc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\winmer.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Herosoft\HeroV8\SYSEXPLR.EXE C:\Program Files\Thunder Network\Thunder\Thunder.exe C:\Program Files\Thunder Network\WebThunder\WebThunder.exe C:\WINDOWS\System32\SVOHOST.exe C:\dfndrff_7.exe C:\WINDOWS\System32\lssas.exe C:\nwnmff_7.exe C:\kybrdff_7.exe C:\WINDOWS\System32\ctfmon.exe C:\WINDOWS\System32\conime.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\WinRAR\WinRAR.exe C:\DOCUME~1\yy\LOCAL O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINDOWS\DOWNLO~1\CnsHook.dll O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\System32\kakatool.dll (file missing) O4 - HKLM\..\Run: [IMJPMIG8.1] ; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SysExplr] C:\Herosoft\HeroV8\SYSEXPLR.EXE O4 - HKLM\..\Run: [CnsMin] Rundll32.exe C:\WINDOWS\DOWNLO~1\CnsMin.dll,Rundll32 O4 - HKLM\..\Run: [Thunder] "C:\Program Files\Thunder Network\Thunder\Thunder.exe" /s O4 - HKLM\..\Run: [WebThunder] C:\Program Files\Thunder Network\WebThunder\WebThunder.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [SoundMam] C:\WINDOWS\System32\SVOHOST.exe O4 - HKLM\..\Run: [ikwOaLlMajkyMaNvJ] C:\WINDOWS\System32\yilgqkdks.exe O4 - HKLM\..\Run: [defender] C:\\dfndrff_7.exe O4 - HKLM\..\Run: [^jP`OOaT] C:\WINDOWS\System32\tlmeels.exe O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINDOWS\System32\lssas.exe O4 - HKLM\..\Run: [newname] C:\\nwnmff_7.exe O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_7.exe O4 - HKLM\..\Run: [Microsoft (R) Windows Update Manager] C:\WINDOWS\update\updmgr.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [TYStartup] C:\Program Files\四川蓝月科技\统一加速器1.0\VDC.exe O4 - HKCU\..\Run: [BitComet] "C:\Downloads\BitComet\BitComet.exe" O4 - Startup: 腾讯QQ.lnk = D:\Program Files\QQ2005\QQ.exe O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\Program Files\QQ2005\AddToNetDisk.htm O8 - Extra context menu item: 使用Web迅雷下载 - C:\Program Files\Thunder Network\WebThunder\GetUrl.htm O8 - Extra context menu item: 使用Web迅雷下载全部链接 - C:\Program Files\Thunder Network\WebThunder\GetAllUrl.htm O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Program Files\QQ2005\AddPanel.htm O8 - Extra context menu item: 添加到QQ表情 - D:\Program Files\QQ2005\AddEmotion.htm O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Program Files\QQ2005\SendMMS.htm O9 - Extra button: 免费精彩视频超流畅在线观看 - {022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com (file missing) O9 - Extra 'Tools' menuitem: 播霸电视 - {022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com (file missing) O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - C:\Program Files\浩方对战平台\GameClient.exe O9 - Extra button: 豪杰超级解霸V8 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - C:\Herosoft\HeroV8\STHSDVD.EXE O9 - Extra 'Tools' menuitem: 豪杰超级解霸V8 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - C:\Herosoft\HeroV8\STHSDVD.EXE O9 - Extra button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail (file missing) O9 - Extra button: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao (file missing) O9 - Extra button: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26}? - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao (file missing) O9 - Extra button: 雅虎助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist (file missing) O9 - Extra button: 雅虎助手 - {5D73EE86-05F1-49ed-B850-E423120EC338}? - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist (file missing) O9 - Extra button: (no name) - {6671A433-5C3D-463d-A7CF-5587F9B7E191}? - C:\PROGRA~1\MMSASS~1\Mmsass~1.dll (file missing) O9 - Extra 'Tools' menuitem: 彩E精灵设置 - {6671A433-5C3D-463d-A7CF-5587F9B7E191}? - C:\PROGRA~1\MMSASS~1\Mmsass~1.dll (file missing) O9 - Extra button: 启动Web迅雷 - {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} - http://my.xunlei.com (file missing) O9 - Extra 'Tools' menuitem: 启动Web迅雷 - {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} - http://my.xunlei.com (file missing) O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\ipQQ\QQ.EXE (file missing) O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\ipQQ\QQ.EXE (file missing) O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6}? - D:\Program Files\ipQQ\QQIEHelper.dll (file missing) O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6}? - D:\Program Files\ipQQ\QQIEHelper.dll (file missing) O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg (file missing) O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96}? - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing) O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing) O9 - Extra 'Tools' menuitem: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing) O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing) O9 - Extra 'Tools' menuitem: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing) O9 - Extra button: 访问瑞星网站 - {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E444} - http://www.rising.com.cn/?u=RSTB (file missing) O9 - Extra button: 访问卡卡社区 - {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E445} - http://www.ikaka.com/?u=RSTB (file missing) O10 - Unknown file in Winsock LSP: c:\windows\system32\wmpcd32.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wmpcd32.dll O11 - Options group: [!CNS] 网络实名 O16 - DPF: {18F57D30-EF36-4C0E-9343-7BFA6DF79B4A} (XLink Class) - http://www.ycdy.com/PSWEdit.CAB O16 - DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} (pCastPanel Class) - http://cache10.itv.mop.com/pCastCtl_1.0.0.87_20060601.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{6B108E60-F507-4188-9375-9B507CCD87C5}: NameServer = 202.102.192.68 O17 - HKLM\System\CCS\Services\Tcpip\..\{C9E1AA11-82EA-4E10-8AF5-DCC5902312EC}: NameServer = 202.102.192.68 202.102.199.68 O17 - HKLM\System\CS1\Services\Tcpip\..\{6B108E60-F507-4188-9375-9B507CCD87C5}: NameServer = 202.102.192.68 O17 - HKLM\System\CS2\Services\Tcpip\..\{6B108E60-F507-4188-9375-9B507CCD87C5}: NameServer = 202.102.192.68 O17 - HKLM\System\CS3\Services\Tcpip\..\{6B108E60-F507-4188-9375-9B507CCD87C5}: NameServer = 202.102.192.68 O20 - Winlogon Notify: Applets - C:\WINDOWS\system32\kzd101c.dll O20 - Winlogon Notify: IME - C:\WINDOWS\system32\j64o0gh3e64.dll O20 - Winlogon Notify: MCD - C:\WINDOWS\system32\nitapi32.dll O20 - Winlogon Notify: Shell Extensions - C:\WINDOWS\system32\j64o0gh3e64.dll O20 - Winlogon Notify: ShellServiceObjectDelayLoad - C:\WINDOWS\system32\nitapi32.dll O20 - Winlogon Notify: SideBySide - C:\WINDOWS\system32\kzd101c.dll O20 - Winlogon Notify: Telephony - C:\WINDOWS\system32\nitapi32.dll O20 - Winlogon Notify: Winlogon - C:\WINDOWS\system32\nitapi32.dll O21 - SSODL: stdup - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - C:\WINDOWS\SYSTEM32\stdup.dll O21 - SSODL: Vision - {6671A431-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\MMSASS~1\Mmsass~1.dll (file missing) O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\eXk\command.exe O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe O23 - Service: Network Logon (NetWorkLogon) - Unknown owner - rundll32.exe (file missing) O23 - Service: Windows Update Manager (UpdateManager) - Unknown owner - C:\WINDOWS\update\updmgr.exe O23 - Service: Window Kernel Memory - Unknown owner - C:\WINDOWS\system32\smsc.exe S~1\Temp\Rar$EX00.938\HijackThis.exe 2006-08-06 10:22:56
无笑山人拙长孩提狮帖子:63 注册: 2006-03-03 来自:	分享到：

sunsubway1 初生襁褓狮帖子:218 注册: 2005-01-16 来自:	发表于： 2006-08-05 23:21 \| 短消息资料字号：小中大 2楼 O10 - Unknown file in Winsock LSP: c:\windows\system32\wmpcd32.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wmpcd32.dll 用超级兔子清理。
sunsubway1 初生襁褓狮帖子:218 注册: 2005-01-16 来自:

我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林	发表于： 2006-08-06 09:51 \| 短消息资料字号：小中大 3楼开始→运行→输入services.msc，打开“服务”→查找Command Service, Network Monitor,Network Logon,Windows Update Manager,Window Kernel Memory→双击→启动类型→禁止→停止→应用→确定。禁止Command Service, Network Monitor,Network Logon,Windows Update Manager,Window Kernel Memory这5个服务（每一个逗号隔开的就是一个病毒的服务，请逐一禁用）(除非你知道) 进入控制面版的添加删除程序中卸载Winstdup,MMSASS~1彩信请到http://forum.ikaka.com/topic.asp?board=67&artid=5188931，下载，LSPFix.exe，WinsockXPFix这两个软件重新启动电脑, 开机检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式进入Windows 运行Hijackthis，扫描结束后在下列选项前打上勾，然后选"修复" O4 - HKLM\..\Run: [SoundMam] C:\WINDOWS\System32\SVOHOST.exe O4 - HKLM\..\Run: [ikwOaLlMajkyMaNvJ] C:\WINDOWS\System32\yilgqkdks.exe O4 - HKLM\..\Run: [defender] C:\\dfndrff_7.exe O4 - HKLM\..\Run: [^jP`OOaT] C:\WINDOWS\System32\tlmeels.exe O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINDOWS\System32\lssas.exe O4 - HKLM\..\Run: [newname] C:\\nwnmff_7.exe O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_7.exe O4 - HKLM\..\Run: [Microsoft (R) Windows Update Manager] C:\WINDOWS\update\updmgr.exe O9 - Extra button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail (file missing) O9 - Extra button: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao (file missing) O9 - Extra button: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26}? - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao (file missing) O9 - Extra button: 雅虎助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist (file missing) O9 - Extra button: 雅虎助手 - {5D73EE86-05F1-49ed-B850-E423120EC338}? - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist (file missing) O9 - Extra button: (no name) - {6671A433-5C3D-463d-A7CF-5587F9B7E191}? - C:\PROGRA~1\MMSASS~1\Mmsass~1.dll (file missing) O9 - Extra 'Tools' menuitem: 彩E精灵设置 - {6671A433-5C3D-463d-A7CF-5587F9B7E191}? - C:\PROGRA~1\MMSASS~1\Mmsass~1.dll (file missing) O20 - Winlogon Notify: Applets - C:\WINDOWS\system32\kzd101c.dll O20 - Winlogon Notify: IME - C:\WINDOWS\system32\j64o0gh3e64.dll O20 - Winlogon Notify: MCD - C:\WINDOWS\system32\nitapi32.dll O20 - Winlogon Notify: Shell Extensions - C:\WINDOWS\system32\j64o0gh3e64.dll O20 - Winlogon Notify: ShellServiceObjectDelayLoad - C:\WINDOWS\system32\nitapi32.dll O20 - Winlogon Notify: SideBySide - C:\WINDOWS\system32\kzd101c.dll O20 - Winlogon Notify: Telephony - C:\WINDOWS\system32\nitapi32.dll O20 - Winlogon Notify: Winlogon - C:\WINDOWS\system32\nitapi32.dll O21 - SSODL: stdup - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - C:\WINDOWS\SYSTEM32\stdup.dll O21 - SSODL: Vision - {6671A431-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\MMSASS~1\Mmsass~1.dl 运行LSPFix.exe 删除 wmpcd32.dll 附说明一份 LSPFix.exe这个软件主要用来辅助修复HijackThis扫描发现的O10项。使用时，请关闭所有IE界面和文件夹界面后运行LSPFix，运行后，把要修复的那一个O10项从左边转到右边，点“Finish”即可。（不过这之前，需要在“I know what I`m doing”前面打勾。）双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示确定更改时，单击“是”，清除“隐藏已知文件类型的扩展名删除 C:\\kybrdff_7.exe C:\WINDOWS\system32\kzd101c.dll C:\PROGRA~1\MMSASS~1 C:\WINDOWS\eXk C:\Program Files\Network Monitor c:\windows\system32\wmpcd32.dll C:\WINDOWS\system32\smsc.exe C:\WINDOWS\update\updmgr.exe C:\WINDOWS\SYSTEM32\stdup.dll C:\WINDOWS\system32\nitapi32.dll C:\WINDOWS\system32\kzd101c.dll C:\WINDOWS\system32\j64o0gh3e64.dll C:\\nwnmff_7.exe C:\WINDOWS\System32\lssas.exe C:\WINDOWS\System32\tlmeels.exe C:\WINDOWS\System32\yilgqkdks.exe C:\WINDOWS\System32\SVOHOST.exe C:\WINDOWS\System32\winmer.exe(一定要删除) 修复后重启，如果无法上网，请运行WinsockXPFix，让它修复一下。回到正常模式，请再扫日志粘上来。请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来下载网址 http://www.kztechs.com/sreng/sreng2.zip http://forum.ikaka.com/topic.asp?board=67&artid=5188931 日志一次粘不完，分次粘完，请不要修改。
我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林

无笑山人拙长孩提狮帖子:63 注册: 2006-03-03 来自:	发表于： 2006-08-06 10:19 \| 只看楼主短消息资料字号：小中大 4楼 C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\Rundll32.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Herosoft\HeroV8\SYSEXPLR.EXE C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\System32\ctfmon.exe D:\Program Files\QQ2005\QQexternal.exe C:\Program Files\Thunder Network\Thunder\Program\Thunder5.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Rising\Rav\CCenter.exe C:\Program Files\Rising\Rav\RavTask.exe C:\Program Files\Rising\Rav\RavMon.exe C:\Program Files\Rising\Rav\Ravmond.exe C:\Program Files\Rising\Rav\RavStub.exe C:\Program Files\Rising\Rav\RsAgent.exe C:\WINDOWS\msagent\AgentSvr.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\WinRAR\WinRAR.exe C:\DOCUME~1\yy\LOCALS~1\Temp\Rar$EX00.640\HijackThis.exe
无笑山人拙长孩提狮帖子:63 注册: 2006-03-03 来自:

无笑山人拙长孩提狮帖子:63 注册: 2006-03-03 来自:	发表于： 2006-08-06 10:20 \| 只看楼主短消息资料字号：小中大 5楼 O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\Program Files\ipQQ\QQIEHelper.dll O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\XUNLEIBHO_002.dll O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINDOWS\DOWNLO~1\CnsHook.dll O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\System32\kakatool.dll O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SysExplr] C:\Herosoft\HeroV8\SYSEXPLR.EXE O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [CnsMin] Rundll32.exe C:\WINDOWS\DOWNLO~1\CnsMin.dll,Rundll32 O4 - HKLM\..\Run: [helper.dll] C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32 O4 - HKLM\..\Run: [Thunder] "C:\Program Files\Thunder Network\Thunder\Thunder.exe" /s O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - Startup: 腾讯QQ.lnk = D:\Program Files\ipQQ\QQ.exe O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Program Files\ipQQ\AddPanel.htm O8 - Extra context menu item: 添加到QQ表情 - D:\Program Files\ipQQ\AddEmotion.htm O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Program Files\ipQQ\SendMMS.htm O8 - Extra context menu item: 豪杰超级解霸V8实时播放 - C:\Herosoft\HeroV8\MPURLGET.HTM O9 - Extra button: 豪杰超级解霸V8 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - C:\Herosoft\HeroV8\STHSDVD.EXE O9 - Extra 'Tools' menuitem: 豪杰超级解霸V8 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - C:\Herosoft\HeroV8\STHSDVD.EXE O9 - Extra button: Yahoo 3.5G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail (file missing) O9 - Extra button: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26}? - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao (file missing) O9 - Extra button: 雅虎助手 - {5D73EE86-05F1-49ed-B850-E423120EC338}? - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist (file missing) O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\ipQQ\QQ.EXE O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\ipQQ\QQ.EXE O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\ipQQ\QQIEHelper.dll O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\ipQQ\QQIEHelper.dll O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing) O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing) O9 - Extra 'Tools' menuitem: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing) O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing) O9 - Extra 'Tools' menuitem: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing) O9 - Extra button: 访问瑞星网站 - {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E444} - http://www.rising.com.cn/?u=RSTB (file missing) O9 - Extra button: 访问卡卡社区 - {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E445} - http://www.ikaka.com/?u=RSTB (file missing) O11 - Options group: [!CNS] 网络实名 O17 - HKLM\System\CCS\Services\Tcpip\..\{C9E1AA11-82EA-4E10-8AF5-DCC5902312EC}: NameServer = 202.102.192.68 202.102.199.68 O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology
无笑山人拙长孩提狮帖子:63 注册: 2006-03-03 来自:

我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林	发表于： 2006-08-06 10:26 \| 短消息资料字号：小中大 6楼这日志看不出问题了但为了保险，我建议你下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来下载网址 http://www.kztechs.com/sreng/sreng2.zip http://forum.ikaka.com/topic.asp?board=67&artid=5188931 日志一次粘不完，分次粘完，请不要修改。
我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林

sunsubway1 初生襁褓狮帖子:218 注册: 2005-01-16 来自:	发表于： 2006-08-06 10:30 \| 短消息资料字号：小中大 7楼补充： O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINDOWS\DOWNLO~1\CnsHook.dll 上述是劫持程序，请用hijackthis清除。
sunsubway1 初生襁褓狮帖子:218 注册: 2005-01-16 来自:

<<上一主题|下一主题>>

1

1 / 1 页

跳转页

页面顶部

Powered by Discuz!NT