Logfile of Kaka v2. 0. 0. 9 Scan Module v2. 0. 0. 1
Scan saved at 14:04:12, on 2006-07-12
Platform: Microsoft Windows XP Professional Service Pack 2 (Build 2600)
MSIE: Internet Explorer v6.00 SP2; (6.00.2900.2180 (xpsp_sp2_rtm.040803-2158))
Running processes:
[SMSS.EXE]
CommandLine =
[CSRSS.EXE]
CommandLine = C:\WINDOWS\system32\csrss.exe
ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
[WINLOGON.EXE]
CommandLine = winlogon.exe
[SERVICES.EXE]
CommandLine = C:\WINDOWS\system32\services.exe
[LSASS.EXE]
CommandLine = C:\WINDOWS\system32\lsass.exe
[SVCHOST.EXE]
CommandLine = C:\WINDOWS\system32\svchost -k DcomLaunch
[SVCHOST.EXE]
CommandLine = C:\WINDOWS\system32\svchost -k rpcss
[CCenter.exe]
CommandLine = "F:\Rising\Rav\CCenter.exe"
[SVCHOST.EXE]
CommandLine = C:\WINDOWS\System32\svchost.exe -k netsvcs
[SVCHOST.EXE]
CommandLine = C:\WINDOWS\System32\svchost.exe -k NetworkService
[SVCHOST.EXE]
CommandLine = C:\WINDOWS\System32\svchost.exe -k LocalService
[EXPLORER.EXE]
CommandLine = C:\WINDOWS\Explorer.EXE
[RavMonD.exe]
CommandLine = "F:\Rising\Rav\Ravmond.exe"
[SPOOLSV.EXE]
CommandLine = C:\WINDOWS\system32\spoolsv.exe
[ALG.EXE]
CommandLine = C:\WINDOWS\System32\alg.exe
[RavStub.exe]
CommandLine = F:\Rising\Rav\RavStub.exe /RAVMOND
[rundll32.exe]
CommandLine = Rundll32.exe C:\WINDOWS\DOWNLO~1\CnsMin.dll,Rundll32
[hkcmd.exe]
CommandLine = "C:\WINDOWS\System32\hkcmd.exe"
[RavTask.exe]
CommandLine = "F:\RISING\RAV\RAVTASK.EXE" -SYSTEM
[RavMon.exe]
CommandLine = "F:\Rising\Rav\Ravmon.exe" -SYSTEM
[rundll32.exe]
CommandLine = "C:\WINDOWS\system32\rundll32.exe" C:\PROGRA~1\3721\helper.dll,Rundll32
[ctfmon.exe]
CommandLine = "C:\WINDOWS\system32\ctfmon.exe"
[rundll32.exe]
CommandLine = "C:\WINDOWS\system32\rundll32.exe" C:\Progra~1\IE-BAR\Cast\dmipn.dll,Always
[QQ.exe]
CommandLine = "F:\Tencent\QQ\QQ.exe"
[TIMPlatform.exe]
CommandLine = f:\Tencent\QQ\TIMPlatform.exe -Embedding
[QQPet.exe]
CommandLine = "F:\Tencent\QQ\qqpet\qqpet.exe" 514401010600041200BDA8B9B2BD8C9F8C80B2899AA58C8389818804000000BC020800040F00A0B5A4AFA09182919DAF9487A5999E04000000A7AC4711061100BEABBAB1BE8F9C8F83B19D9A9CA0878D850C0000005A94697B441456171C845755061000BFAABBB0BF8E9D8E82B09C9B9DA48A964000000087FDFB86F989898D8DFDFBFCFC8F87FAFAFE88F9FA8BFBF989FA87F988FAF98A87F98E8A8FFD8A8FF98FFBFE8687FA8A888AFE87898E8FF98FF9FA86FC8FFDFA040100AE04000000248AB444021400BBAEBFB4BB8A998A86B488BB99849392BF929B8E0100000000
[QQPetBonne.exe]
CommandLine = "F:\sofe\QQPETBONNE3.0b37030\QQPetBonne.exe"
[Thunder5.exe]
CommandLine = "E:\Thunder Network\Thunder\Program\Thunder5.exe" /s /222.40.58.180sss-iyjdliwn35y7E9
[TTPlayer.exe]
CommandLine = "F:\TTPlayer\TTPlayer.exe"
[hh.exe]
CommandLine = "hh.exe" C:\Documents and Settings\lizhong\桌面\文件\从零开始.chm
[KkScan.exe]
CommandLine = "F:\Rising\卡卡上网助手\KkScan.exe"
R3 - URLSearchHook: (no name) - {BB936323-19FA-4521-BA29-ECA6A121BC78} - (no file)
O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - C:\PROGRA~1\baidu\bar\baidubar.dll
O2 - BHO: (file missing)
O2 - BHO: Thunder Browser Helper - {889D2FEB-5411-4565-8998-1DD2C5261283} - E:\Thunder Network\Thunder\ComDlls\XUNLEIBHO_002.dll
O2 - BHO: 卡卡上网安全助手 - {AFF6E516-CBE5-4F8A-9C2F-38A68013E766} - C:\WINDOWS\system32\KakaTool.dll
O2 - BHO: CnsHook Class - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINDOWS\DOWNLO~1\CnsHook.dll
O3 - Toolbar: 百度超级搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\PROGRA~1\baidu\bar\baidubar.dll
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\KakaTool.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Outlooker] C:\Program Files\Common Files\System\gd_bin_ini.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SKYNET Personal FireWall] F:\SKYNET\FIREWALL\pfw.exe
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [RavTask] "F:\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [Thunder] "e:\Thunder Network\Thunder\Thunder.exe" /s
O4 - HKLM\..\Run: [CnsMin] Rundll32.exe C:\WINDOWS\DOWNLO~1\CnsMin.dll,Rundll32
O4 - HKLM\..\Run: [ProxyThorn] F:\sofe\proxythorn\ProxyThorn.exe
O4 - HKLM\..\Run: [XDeskWeather] F:\桌面天气\XDeskWeather.exe
O4 - HKLM\..\Run: [Windows木马防火墙] F:\清道夫\Trojanwall.exe
O4 - HKLM\..\Run: [helper.dll] C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - Startup: desktop.ini =
O4 - Global Startup: desktop.ini =
O4 - Global Startup: IE-BAR.lnk = C:\WINDOWS\system32\rundll32.exe
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &使用迅雷下载 - e:\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - e:\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - F:\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - F:\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - F:\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - F:\Tencent\QQ\SendMMS.htm
O9 - Extra Button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail (file missing)
O9 - Extra Button: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao (file missing)
O9 - Extra Button: 雅虎助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist (file missing)
O9 - Extra Button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg (file missing)
O9 - Extra Button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - Extra 'Tools' menuitem: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - Extra Button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O9 - Extra 'Tools' menuitem: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O11 - Options group: [!CNS] 网络实名
O11 - Options group: [CDNCLIENT] 中文上网
O11 - Options group: [TBH] 搜搜地址栏搜索
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
O16 - DPF: DirectAnimation Java Classes -
file://C:\WINDOWS\Java\classes\dajava.cab
O16 - DPF: {0796034F-1464-4290-8822-B24BED491FF5} - http://play.unionsky.cn/flash/t3j4/t3j4.cab
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (CEditCtrl
Object) - https://img.alipay.com/download/1007/aliedit.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {DA984A6D-508E-11D6-AA49-0050FF3C628D} (Ravonline) - http://download.rising.com.cn/ravkill/rsonline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A24C0A9A-72B4-432C-A34F-01B996F90C95}: NameServer = 202.102.227.68,202.102.224.68
O17 - HKLM\System\CCS\Services\Tcpip\..\{B433D1B2-12ED-4E57-80BB-27A42424B688}: NameServer = 61.233.65.3 211.98.192.3
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\Mshtml.dll
O18 - Protocol: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC
