我的卡卡助手"IE及系统修复"项目下,有一项Winsock提供者项目,其中有三项状态为异常,但始终修复不了.其中包括:webhancer MSAFD Tcpip[TCP/IP] 、webhancer MSAFD Tcpip[UDP/IP]  、webhancer。文件描述：C:\Program Files\webHancer\Programs\webhdll.dll

肯定哪位大虾指教,这个是什么病毒?用什么专杀工具可以去除?我现在用的是"买咖啡",只能查出来,但是杀不了.作为一个外行,我很着急啊!!!

现将卡卡日志复制如下,以供分析.谢谢了!!!

Logfile of Kaka v2. 0. 3. 0 Scan Module v1. 0. 6. 1
Scan saved at 00:05:01, on 2007-05-02
Platform: Microsoft Windows XP Professional Service Pack 2 (Build 2600)
MSIE: Internet Explorer v6.00 SP2; (6.00.2900.2180 (xpsp_sp2_rtm.040803-2158))


R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=%SystemRoot%\system32\blank.htm
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: Thunder Browser Helper - {06849E9E-C8D7-4D59-B87D-784B7D6BE0B3} - F:\程序\迅雷\ComDlls\XunLeiBHO_007.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -  (file missing)
O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\Program Files\webHancer\programs\whiehlpr.dll
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [PRONoMgrWired] C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE
O4 - HKLM\..\Run: [BMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor
O4 - HKLM\..\Run: [BLOG] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [webHancer Agent] "C:\Program Files\webHancer\Programs\whAgent.exe"
O4 - HKLM\..\Run: [runeip] C:\Documents and Settings\朱亚东\My Documents\runiep.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE USB PC Camera 301P
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\RunOnce: [KKDelay] C:\Documents and Settings\朱亚东\My Documents\RunOnce.exe
O4 - Startup: desktop.ini =
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: desktop.ini =
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &使用迅雷下载 - F:\程序\迅雷\Program\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - F:\程序\迅雷\Program\getallurl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - F:\程序\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 导出到 Microsoft Excel(&x) - res://F:\程序\Office\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - F:\程序\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - F:\程序\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - F:\程序\QQ\SendMMS.htm
O9 - Extra Button: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - F:\程序\迅雷\Thunder.exe
O9 - Extra 'Tools' menuitem: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - F:\程序\迅雷\Thunder.exe
O9 - Extra Button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - F:\程序\浩方\浩方对战平台\GameClient.exe
O9 - Extra Button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - F:\程序\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - F:\程序\QQ\QQ.EXE
O9 - Extra Button: 更新 ThinkPad 软件 - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\Lenovo\PkgMgr\\PkgMgr.exe
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
O17 - HKLM\System\CCS\Services\Tcpip\..\{A5F9A619-6D45-4A13-ADDD-6F83B553AC04}: NameServer = 220.192.0.130 220.192.8.58
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL
O18 - Protocol: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll
O18 - Protocol: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ipp - (no CLSID) - (no file)
O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll
O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll
O18 - Protocol: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll
O18 - Protocol: msdaipp - (no CLSID) - (no file)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll"
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll
O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll
O20 - Winlogon Notify: ACNotify
O20 - Winlogon Notify: AtiExtEvent
O20 - Winlogon Notify: tpfnf2
O20 - Winlogon Notify: tphotkey
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) -  - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: Ati HotKey Poller (Ati HotKey Poller) - ATI Technologies Inc. - C:\WINDOWS\system32\ati2evxx.exe
O23 - Service: Human Interface Device Access (HidServ) -  - C:\WINDOWS\system32\svchost.exe -k netsvcs
O23 - Service: IBM PM Service (IBMPMSVC) -  - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: McAfee Framework 服务 (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe /ServiceStart
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - "C:\Program Files\Network Associates\VirusScan\Mcshield.exe"
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - "C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe"
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: IBM KCU Service (TpKmpSVC) -  - C:\WINDOWS\system32\tpkmpsvc.exe

接上,"买咖啡"的日志文件:

2007-4-1212:58:38会被行为阻挡规则阻挡（规则当前处于警告模式） FDE0778D18F04CA\朱亚东WinRAR.exeC:\DOCUME~1\朱亚东\LOCALS~1\Temp\Rar$EX00.223\WomRelease.exe禁止 WinRAR 从 Temp 文件夹启动任何项目已阻止的操作:执行
2007-4-1212:58:46被端口阻挡规则阻挡 InstallCasino.e禁止大量发送邮件的蠕虫病毒发送邮件208.0.227.62
2007-4-1216:28:21被端口阻挡规则阻挡 Thunder5.exe?61.149.25.80
2007-4-1216:33:21被端口阻挡规则阻挡 Thunder5.exe?61.149.120.118
2007-4-1216:34:21被端口阻挡规则阻挡 Thunder5.exe?61.149.120.118
2007-4-1216:36:21被端口阻挡规则阻挡 Thunder5.exe?61.149.0.186
2007-4-139:21:28会被行为阻挡规则阻挡（规则当前处于警告模式） FDE0778D18F04CA\朱亚东WinRAR.exeC:\DOCUME~1\朱亚东\LOCALS~1\Temp\Rar$EX00.156\Driver\Setup.exe禁止 WinRAR 从 Temp 文件夹启动任何项目已阻止的操作:执行
2007-4-139:31:47被端口阻挡规则阻挡 Thunder5.exe禁止 IRC 通讯61.149.74.102
2007-4-139:37:47被端口阻挡规则阻挡 Thunder5.exe禁止 IRC 通讯211.99.134.28
2007-4-139:38:47被端口阻挡规则阻挡 Thunder5.exe禁止 IRC 通讯211.99.134.28
2007-4-139:38:47被端口阻挡规则阻挡 Thunder5.exe禁止大量发送邮件的蠕虫病毒发送邮件61.149.34.246
2007-4-139:39:47被端口阻挡规则阻挡 Thunder5.exe禁止 IRC 通讯211.99.134.28
2007-4-139:40:47被端口阻挡规则阻挡 Thunder5.exe禁止 IRC 通讯211.99.134.28
2007-4-1311:04:10被端口阻挡规则阻挡 Thunder5.exe禁止大量发送邮件的蠕虫病毒发送邮件61.148.100.42
2007-4-1315:25:36被端口阻挡规则阻挡 Thunder5.exe禁止 IRC 通讯125.34.130.132
2007-4-1315:26:36被端口阻挡规则阻挡 Thunder5.exe禁止 IRC 通讯125.34.130.132
2007-4-1315:28:36被端口阻挡规则阻挡 Thunder5.exe禁止 IRC 通讯125.34.130.132
2007-4-169:48:51被端口阻挡规则阻挡 Thunder5.exe禁止大量发送邮件的蠕虫病毒发送邮件221.222.8.103
2007-4-169:50:51被端口阻挡规则阻挡 Thunder5.exe禁止大量发送邮件的蠕虫病毒发送邮件221.220.212.185
2007-4-169:59:51被端口阻挡规则阻挡 Thunder5.exe禁止 IRC 通讯60.209.230.149
2007-4-1610:09:51被端口阻挡规则阻挡 Thunder5.exe禁止 IRC 通讯61.241.74.1
2007-4-1610:10:51被端口阻挡规则阻挡 Thunder5.exe禁止 IRC 通讯61.241.74.1
2007-4-1611:06:51被端口阻挡规则阻挡 Thunder5.exe禁止大量发送邮件的蠕虫病毒发送邮件58.19.31.199
2007-4-179:13:15被端口阻挡规则阻挡 Thunder5.exe禁止大量发送邮件的蠕虫病毒发送邮件221.218.218.182
2007-4-179:19:23被端口阻挡规则阻挡 Thunder5.exe禁止大量发送邮件的蠕虫病毒发送邮件221.218.221.14
2007-4-179:29:23被端口阻挡规则阻挡 Thunder5.exe禁止大量发送邮件的蠕虫病毒发送邮件221.6.207.124
2007-4-179:30:23被端口阻挡规则阻挡 Thunder5.exe禁止大量发送邮件的蠕虫病毒发送邮件221.209.16.33
2007-4-179:31:23被端口阻挡规则阻挡 Thunder5.exe禁止 IRC 通讯221.209.16.33
2007-4-179:31:23被端口阻挡规则阻挡 Thunder5.exe禁止 IRC 通讯221.6.207.124
2007-4-179:36:23被端口阻挡规则阻挡 Thunder5.exe禁止大量发送邮件的蠕虫病毒发送邮件221.3.141.181
2007-4-179:45:23被端口阻挡规则阻挡 Thunder5.exe禁止大量发送邮件的蠕虫病毒发送邮件60.213.123.40
2007-4-179:46:23被端口阻挡规则阻挡 Thunder5.exe禁止 IRC 通讯222.130.208.17
2007-4-179:47:23被端口阻挡规则阻挡 Thunder5.exe禁止大量发送邮件的蠕虫病毒发送邮件60.212.57.91
2007-4-179:49:23被端口阻挡规则阻挡 Thunder5.exe禁止大量发送邮件的蠕虫病毒发送邮件61.181.250.45
2007-4-179:50:23被端口阻挡规则阻挡 Thunder5.exe禁止 IRC 通讯61.181.250.45
2007-4-179:50:23被端口阻挡规则阻挡 Thunder5.exe禁止大量发送邮件的蠕虫病毒发送邮件222.130.208.17
2007-4-179:51:23被端口阻挡规则阻挡 Thunder5.exe禁止 IRC 通讯123.112.97.11
2007-4-179:52:23被端口阻挡规则阻挡 Thunder5.exe禁止大量发送邮件的蠕虫病毒发送邮件221.216.4.224
2007-4-179:53:23被端口阻挡规则阻挡 Thunder5.exe禁止 IRC 通讯60.213.123.40
2007-4-179:53:23被端口阻挡规则阻挡 Thunder5.exe禁止大量发送邮件的蠕虫病毒发送邮件221.216.4.224
2007-4-179:54:23被端口阻挡规则阻挡 Thunder5.exe禁止 IRC 通讯124.64.140.253
2007-4-179:59:23被端口阻挡规则阻挡 Thunder5.exe禁止大量发送邮件的蠕虫病毒发送邮件221.220.142.136
2007-4-179:59:23被端口阻挡规则阻挡 Thunder5.exe禁止大量发送邮件的蠕虫病毒发送邮件221.198.44.253
2007-4-179:59:24被端口阻挡规则阻挡 Thunder5.exe禁止 IRC 通讯221.220.142.136
2007-4-1710:00:23被端口阻挡规则阻挡 Thunder5.exe禁止 IRC 通讯221.198.44.253
2007-4-1710:03:23被端口阻挡规则阻挡 Thunder5.exe禁止 IRC 通讯60.214.187.77
2007-4-1710:20:23被端口阻挡规则阻挡 Thunder5.exe禁止大量发送邮件的蠕虫病毒发送邮件60.208.111.202
2007-4-1710:21:23被端口阻挡规则阻挡 Thunder5.exe禁止大量发送邮件的蠕虫病毒发送邮件60.208.111.202
2007-4-1710:24:23被端口阻挡规则阻挡 Thunder5.exe禁止大量发送邮件的蠕虫病毒发送邮件61.149.104.173
2007-4-1710:25:23被端口阻挡规则阻挡 Thunder5.exe禁止大量发送邮件的蠕虫病毒发送邮件222.160.35.249
2007-4-1710:26:23被端口阻挡规则阻挡 Thunder5.exe禁止大量发送邮件的蠕虫病毒发送邮件221.222.115.96
2007-4-1710:29:23被端口阻挡规则阻挡 Thunder5.exe禁止大量发送邮件的蠕虫病毒发送邮件61.181.250.45
2007-4-2423:51:50会被行为阻挡规则阻挡（规则当前处于警告模式） FDE0778D18F04CA\朱亚东IEXPLORE.EXEC:\WINDOWS\Downloaded Program Files\Lava-Lava.exe禁止 Internet Explorer 从 Downloaded Programs 文件夹启动文件  (.exe)已阻止的操作:执行
2007-4-250:26:14被端口阻挡规则阻挡 Thunder5.exe禁止大量发送邮件的蠕虫病毒发送邮件218.26.197.178
2007-4-2515:25:00会被行为阻挡规则阻挡（规则当前处于警告模式） FDE0778D18F04CA\朱亚东WinRAR.exeC:\DOCUME~1\朱亚东\LOCALS~1\Temp\Rar$EX03.597\officexp_36.exe禁止 WinRAR 从 Temp 文件夹启动任何项目已阻止的操作:执行

用SRE扫...