Logfile of Kaka v2. 0. 0. 8 Scan Module v2. 0. 0. 1
Scan saved at 17:18:51, on 2006-04-13
Platform: Microsoft Windows 2000 Professional Service Pack 4 (Build 2195)
MSIE: Internet Explorer v5.00 SP4; (5.00.2920.0000)


Running processes:
[smss.exe]
CommandLine =

[csrss.exe]
CommandLine = C:\WINNT\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

[winlogon.exe]
CommandLine = winlogon.exe

[services.exe]
CommandLine = C:\WINNT\system32\services.exe

[lsass.exe]
CommandLine = C:\WINNT\system32\lsass.exe

[svchost.exe]
CommandLine = C:\WINNT\system32\svchost -k rpcss

[CCenter.exe]
CommandLine = "C:\Program Files\Rising\Rav\CCenter.exe"

[Ravmond.exe]
CommandLine = "C:\Program Files\Rising\Rav\Ravmond.exe"

[spoolsv.exe]
CommandLine = C:\WINNT\system32\spoolsv.exe

[RavStub.exe]
CommandLine = "C:\Program Files\Rising\Rav\RavStub.exe" /RAVMOND

[svchost.exe]
CommandLine = C:\WINNT\system32\svchost.exe -k netsvcs

[ntsec.exe]
CommandLine = "C:\WINNT\system32\ntsec.exe"

[MSTask.exe]
CommandLine = C:\WINNT\system32\MSTask.exe

[Explorer.EXE]
CommandLine = C:\WINNT\Explorer.EXE

[WinMgmt.exe]
CommandLine = C:\WINNT\System32\WBEM\WinMgmt.exe

[svchost.exe]
CommandLine = C:\WINNT\system32\svchost.exe -k wugroup

[wxpdll32.exe]
CommandLine = "C:\WINNT\wxpdll32.exe"

[krvukj.exe]
CommandLine = "C:\WINNT\system32\krvukj.exe"

[RavTask.exe]
CommandLine = "C:\PROGRAM FILES\RISING\RAV\RAVTASK.EXE" -SYSTEM

[internat.exe]
CommandLine = "C:\WINNT\system32\internat.exe"

[Ravmon.exe]
CommandLine = "C:\Program Files\Rising\Rav\Ravmon.exe" -SYSTEM

[CCProxy.exe]
CommandLine = "C:\Program Files\CCProxy\CCProxy.exe"

[taskmgr.exe]
CommandLine = taskmgr.exe

[iexplore.exe]
CommandLine = "C:\Program Files\Internet Explorer\iexplore.exe"

[KkScan.exe]
CommandLine = "C:\Program Files\Rising\KakaToolBar\KkScan.exe"

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page=http://searchbar.findthewebsiteyouneed.com
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: 192.168.102.20          www.norasia.com
O1 - Hosts: 141.146.168.178        apps.csav.com
O1 - Hosts: 192.168.200.136        bds.csavgroup.com
O1 - Hosts: 192.168.200.65          bdsspool.csavgroup.com
O1 - Hosts: 140.85.236.200          auohscsuvp5.oracleoutsourcing.com
O2 - BHO:  - {6001CDF7-6F45-471b-A203-0225615E35A7} - C:\WINNT\DH.dll (file missing)
O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINNT\system32\KakaTool.dll
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-110-12-0000133.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Configuration Loader] scvhost.exe
O4 - HKLM\..\Run: [seeve] C:\WINNT\seeve.exe
O4 - HKLM\..\Run: [Adware removal Tool] C:\WINNT\system32\krvukj.exe
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [keyboard] c:\windows\keyboard10.exe
O4 - HKLM\..\RunServices: [Configuration Loader] scvhost.exe
O9 - Extra Button: @shdoclc.dll,-866 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: @shdoclc.dll,-864 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\system32\shdocvw.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/windows/ie_intl/cn/start/
O16 - DPF: v3cab - http://searchmiracle.com/cab/v3cab.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/MediaAccessVerisign/ie/Bridge-c139.cab
O16 - DPF: {7149E79C-DC19-4C5E-A53C-A54DDF75EEE9} (IObjSafety.DemoCtl) - http://cabs.media-motor.net/cabs/joysaver.cab
O16 - DPF: {DECEAAA2-370A-49BB-9362-68C3A58DDC62} (SAIX) - http://static.zangocash.com/cab/Zango/ie/bridge-c32.cab?3fcebfa36d55accca2f7b1a22fafa85e7053a7fd2e22f129a5df6f3e3385895924c6f2b93224bbef060365d69fe4efa9f9227798c1b7fe11dfa7cbf3ebf91c63e77c5c:e57b0d0bfc854fd9ac8339d8b7105add
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/Ver2005/OL2005.cab
O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} (WMService Class) - http://download.overpro.com/WildAppNonUS.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2C7E738F-3F34-41FD-898F-A6498B9D57CE}: NameServer = 211.93.80.129,202.96.64.68
O17 - HKLM\System\CCS\Services\Tcpip\..\{56652387-F385-4098-8031-5FD67354D978}: NameServer = 202.96.69.38 202.96.64.68
O17 - HKLM\System\CCS\Services\Tcpip\..\{909225A6-1E5F-4F36-AE91-4D9BA5B3C520}: NameServer = 211.93.80.129
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll
O18 - Protocol: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: ipp - (no CLSID) - (no file)
O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINNT\system32\itss.dll
O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll
O18 - Protocol: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll
O18 - Protocol: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINNT\system32\inetcomm.dll
O18 - Protocol: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINNT\system32\itss.dll
O18 - Protocol: msdaipp - (no CLSID) - (no file)
O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll
O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINNT\system32\mshtml.dll
O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll
O18 - Protocol: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINNT\system32\msdxm.ocx
O20 - Winlogon Notify: wzcnotif
O23 - Service: windows dll (dll host) -  - "C:\WINNT\dllhosts.exe"
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\system32\dmadmin.exe /com
O23 - Service: Net Functions Library (Netlib) -  - C:\WINNT\system32\netlib.exe
O23 - Service: NTSec(ntsec) (NTSec) -  - C:\WINNT\system32\ntsec.exe"
O23 - Service: Remote Procedure Call (RPC) Client (RpcClient) -  - C:\WINNT\system32\rpcclient.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - "C:\Program Files\Rising\Rav\CCenter.exe"
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - "C:\Program Files\Rising\Rav\Ravmond.exe"
O23 - Service: Smart Card Client (SCardClnt) -  - C:\WINNT\system32\bbb.exe
O23 - Service: winfws (winfws) -  - "C:\WINNT\winfws.exe"
O23 - Service: wxpdll32 (wxpdll32) -  - "C:\WINNT\wxpdll32.exe"

【回复“超级小菜”的帖子】
结束如下进程
[wxpdll32.exe]
CommandLine = "C:\WINNT\wxpdll32.exe"

[krvukj.exe]
CommandLine = "C:\WINNT\system32\krvukj.exe"

[ntsec.exe]
CommandLine = "C:\WINNT\system32\ntsec.exe"

＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝

清空HOST表
或用HIJACKTHIS修复所有的01项

＝＝＝＝＝＝＝＝＝

用HIJACKTHIS修复
O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-110-12-0000133.exe
O4 - HKLM\..\Run: [Configuration Loader] scvhost.exe
O4 - HKLM\..\Run: [seeve] C:\WINNT\seeve.exe
O4 - HKLM\..\Run: [Adware removal Tool] C:\WINNT\system32\krvukj.exe
O4 - HKLM\..\Run: [keyboard] c:\windows\keyboard10.exe
O4 - HKLM\..\RunServices: [Configuration Loader] scvhost.exe

＝＝＝＝＝＝＝＝＝＝＝＝＝

开始－－控制面板－－性能和维护－－管理工具－－服务
禁用如下服务
windows dll (dll host)
Net Functions Library (Netlib)
NTSec(ntsec) (NTSec)
Remote Procedure Call (RPC) Client (RpcClient)
Smart Card Client (SCardClnt)
winfws (winfws)
wxpdll32 (wxpdll32)


进入注册表
展开[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]
找到后删除如下七个文件夹：
dll host
Netlib
NTSec
RpcClient
SCardClnt
winfws
wxpdll32

＝＝＝＝＝＝＝＝＝＝＝＝

删除
C:\WINNT\dllhosts.exe
C:\WINNT\system32\netlib.exe
C:\WINNT\system32\ntsec.exe
C:\WINNT\system32\rpcclient.exe
C:\WINNT\system32\bbb.exe
C:\WINNT\winfws.exe
C:\WINNT\wxpdll32.exe
C:\WINNT\system32\krvukj.exe
C:\Program Files\Common Files\Windows\mc-110-12-0000133.exe
scvhost.exe（在硬盘中搜索）
C:\WINNT\seeve.exe
c:\windows\keyboard10.exe

提示：
若正常模式下无法解决
建议进入安全模式下操作

十分感谢 不言大侠的详细指点， 小菜这里谢过了！！！！！

不言这几天的回复详细多了 是受何动力啊

引用:

【zq77的贴子】不言这几天的回复详细多了 是受何动力啊 ...........................

无非是尽快解决问题

我不喜欢看到某个会员问那些简单到有点无聊的问题
有时某个会员的回贴惹得我急