bu gan yong han zi shuo hua ,yi yong ping ying jiu zhi jie yi shi IE you wen ti
ci cuo wu shi ka ka ying qi de .zen me ban . wo xian zai bu neng shuo hua bu
neng kan wang ye
jiu jiu wo a ,ke lian yi xia xiang wo zhe yang bu zhi suo cuo de ren ba.
Logfile of Kaka v2. 0. 0. 1 Scan Module v2. 0. 0. 0
Scan saved at 17:11:20, on 2006-08-28
Platform: Microsoft Windows XP Professional Service Pack 2 (Build 2600)
MSIE: Internet Explorer v6.00 SP2; (6.00.2900.2180 (xpsp_sp2_rtm.040803-2158))
Running processes:
[SMSS.EXE]
CommandLine =
[CSRSS.EXE]
CommandLine = D:\WINDOWS\system32\csrss.exe
ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
[WINLOGON.EXE]
CommandLine = winlogon.exe
[SERVICES.EXE]
CommandLine = D:\WINDOWS\system32\services.exe
[LSASS.EXE]
CommandLine = D:\WINDOWS\system32\lsass.exe
[SVCHOST.EXE]
CommandLine = D:\WINDOWS\system32\svchost -k DcomLaunch
[SVCHOST.EXE]
CommandLine = D:\WINDOWS\system32\svchost -k rpcss
[CCenter.exe]
CommandLine = "D:\Program Files\Rising\Rav\CCenter.exe"
[SVCHOST.EXE]
CommandLine = D:\WINDOWS\System32\svchost.exe -k netsvcs
[SVCHOST.EXE]
CommandLine = D:\WINDOWS\system32\svchost.exe -k NetworkService
[SVCHOST.EXE]
CommandLine = D:\WINDOWS\system32\svchost.exe -k LocalService
[RavMonD.exe]
CommandLine = "D:\Program Files\Rising\Rav\Ravmond.exe"
[RFWSRV.EXE]
CommandLine = "d:\program files\rising\rfw\rfwsrv.exe"
[SPOOLSV.EXE]
CommandLine = D:\WINDOWS\system32\spoolsv.exe
[RavStub.exe]
CommandLine = "D:\Program Files\Rising\Rav\RavStub.exe" /RAVMOND
[CDAC11BA.EXE]
CommandLine = D:\WINDOWS\system32\drivers\CDAC11BA.EXE
[CDANTSRV.EXE]
CommandLine = D:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
[alg.exe]
CommandLine = D:\WINDOWS\System32\alg.exe
[Explorer.EXE]
CommandLine = D:\WINDOWS\Explorer.EXE
[RfwMain.exe]
CommandLine = -StartUp
[RavTask.exe]
CommandLine = "D:\PROGRAM FILES\RISING\RAV\RAVTASK.EXE" -SYSTEM
[RavMon.exe]
CommandLine = "D:\Program Files\Rising\Rav\Ravmon.exe" -SYSTEM
[WebThunder.exe]
CommandLine = "H:\计算机工具软件\WAD\WebThunder.exe"
[realsched.exe]
CommandLine = "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
[SOUNDMAN.EXE]
CommandLine = "D:\WINDOWS\SOUNDMAN.EXE"
[ctfmon.exe]
CommandLine = "D:\WINDOWS\system32\ctfmon.exe"
[Rainlendar.exe]
CommandLine = "C:\Program Files\Rainlendar\Rainlendar.exe"
[QQ.exe]
CommandLine = "H:\游戏软件\QQ文件\QQ.exe"
[TIMPlatform.exe]
CommandLine = H:\游戏软件\QQ文件\TIMPlatform.exe -Embedding
[mmsk.exe]
CommandLine = "H:\计算机工具软件\木马杀客\木马杀客\mmsk.exe"
[WinpopupX.exe]
CommandLine = "E:\5.1安装\WinpopupX\WinpopupX.exe"
[KkScan.exe]
CommandLine = "H:\计算机工具软件\瑞星杀毒软件2006单机版\KAKA\KkScan.exe"
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.baidu.com/
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - D:\WINDOWS\system32\kakatool.dll
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IMSCMig] D:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - HKLM\..\Run: [RfwMain] "D:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [RavTask] "D:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [WebThunder] H:\计算机工具软件\WAD\WebThunder.exe
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - Startup: desktop.ini =
O4 - Startup: Rainlendar精美日历.lnk = C:\Program Files\Rainlendar\Rainlendar.exe
O4 - Global Startup: desktop.ini =
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: 上传到QQ网络硬盘 - H:\游戏软件\QQ文件\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - H:\游戏软件\QQ文件\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - H:\游戏软件\QQ文件\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - H:\游戏软件\QQ文件\SendMMS.htm
O14 - IERESET.INF: START_PAGE_URL=
about:blank
O16 - DPF: {339C1EE2-1029-46B8-81F1-360217F26FC4} (VGAPlayer Control) - http://219.144.186.220/gdsx/13/VGAPlayer.cab
O16 - DPF: {E787FD25-8D7C-4693-AE67-9406BC6E22DF} (CPasswordEditCtrl
Object) - https://password.qq.com/download/qqedit.cab
O16 - DPF: {F138084D-84D7-48CD-BEA8-04772457516E} (VqqSpeedDlProxy Class) - http://218.85.138.27/vqqsdl1009.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9A15C641-9E3A-4201-8578-E04278FB8D7D}: NameServer = 61.128.99.133
O18 - Filter : application/octet-stream - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - D:\WINDOWS\system32\mscoree.dll
O18 - Filter : application/x-complus - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - D:\WINDOWS\system32\mscoree.dll
O18 - Filter : application/x-msdownload - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - D:\WINDOWS\system32\mscoree.dll
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - D:\WINDOWS\system32\mshtml.dll
O18 - Protocol: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - D:\WINDOWS\system32\urlmon.dll
O18 - Protocol: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - D:\WINDOWS\system32\msvidctl.dll
O18 - Protocol: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - D:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - D:\WINDOWS\system32\urlmon.dll
O18 - Protocol: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - D:\WINDOWS\system32\urlmon.dll
O18 - Protocol: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - D:\WINDOWS\system32\urlmon.dll
O18 - Protocol: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - D:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ipp - (no CLSID) - (no file)
O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - D:\WINDOWS\system32\itss.dll
O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - D:\WINDOWS\system32\mshtml.dll
O18 - Protocol: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - D:\WINDOWS\system32\urlmon.dll
O18 - Protocol: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - D:\WINDOWS\system32\mshtml.dll
O18 - Protocol: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - D:\WINDOWS\system32\inetcomm.dll
O18 - Protocol: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - D:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - D:\WINDOWS\system32\itss.dll
O18 - Protocol: msdaipp - (no CLSID) - (no file)
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - D:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - D:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - D:\WINDOWS\system32\mshtml.dll
O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - D:\WINDOWS\system32\mshtml.dll
O18 - Protocol: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - D:\WINDOWS\system32\msvidctl.dll
O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - D:\WINDOWS\system32\mshtml.dll
O18 - Protocol: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - D:\WINDOWS\system32\wiascr.dll
O23 - Service: Adobe LM Service (Adobe LM Service) - Adobe Systems - "D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"
O23 - Service: C-DillaCdaC11BA (C-DillaCdaC11BA) - Macrovision - D:\WINDOWS\system32\drivers\cdac11ba.exe
O23 - Service: C-DillaSrv (C-DillaSrv) - C-Dilla Ltd - D:\WINDOWS\system32\drivers\cdantsrv.exe
O23 - Service: Human Interface Device Access (HidServ) - - D:\WINDOWS\system32\svchost.exe -k netsvcs
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - d:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - "D:\Program Files\Rising\Rav\CCenter.exe"
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - "D:\Program Files\Rising\Rav\Ravmond.exe"
