kcbppacketopapi.dll

运行hijackth**，把下面的选中打上钩，修复o4 - 启动项hklm\\run: [svc] c:\windows\svchost.exeo4 - hkcu\..\run: [updatereal] c:\windows\realupdate.exe othero4 - hkcu\..\run: [svc] c:\windows\svchost.exe结束进程后,删除c:\windows\realupdate.exe c:\windows\svchost.exe请下载sreng2（最新版） ，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（sreng.log），把保存的报告日志文件内容复制-粘贴上来,,日志一次粘不完，分次粘完，请不要修改。下载地址logfile of hijackth** v1.99.1scan s**ed at 10:43:17, on 2006-11-6platform: windows xp sp2 (winnt 5.01.2600)msie: unable to get internet explorer version!running processes:c:\windows\system32\csrss.exec:\windows\system32\winlogon.exec:\windows\system32\services.exec:\windows\system32\lsass.exec:\windows\system32\svchost.exec:\windows\system32\svchost.exec:\program files\r**ing\r**\ccenter.exec:\windows\system32\svchost.exec:\windows\system32\svchost.exec:\windows\system32\svchost.exec:\program files\r**ing\r**\r**mond.exec:\program files\r**ing\rfw\rfwsrv.exec:\program files\r**ing\r**\r**stub.exec:\program files\common files\microsoft shared\vs7debug\mdm.exec:\windows\explorer.exec:\windows\system32\svchost.exec:\windows\system32\wdfmgr.exec:\program files\r**ing\rfw\rfwmain.exec:\windows\system32\rundll32.exec:\windows\system32\alg.exec:\program files\r**ing\r**\r**task.exec:\program files\r**ing\r**\r**mon.exec:\windows\system32\ctfmon.exed:\股票\国泰君安大智慧\internet\hypw**e.exed:\股票\国泰君安大智慧\internet\hypmain.exec:\progra~1\yahoo!\ass**t~1\ylive.exed:\program files\超级兔子\magicset\srieh.exec:\windows\system32\spoolsv.exed:\program files\超级兔子\magicset\sriecli.exec:\program files\internet explorer\iexplore.exee:\tddownload\软件\hijackth** v1.99.1\hijackth**.exer3 - urlsearchhook: 雅虎助手 - {406f94f0-504f-4a40-8dfd-58b0666abebd} - c:\progra~1\yahoo!\ass**t~1\ass**t\ya**ar.dllo2 - bho: yphtb - {33bbe430-0e42-4f12-b075-8d21acb10dcb} - c:\program files\yahoo!\ass**tant\ass**t\yphtb.dllo2 - bho: anti f**h - {38928d50-8a48-44c2-945f-d2f23f771410} - c:\progra~1\yahoo!\ass**t~1\ass**t\yangling.dllo2 - bho: ydragsearch - {62eed7c6-9f02-42f9-b634-98e2899e147b} - c:\progra~1\yahoo!\ass**t~1\ass**t\ydrags~1.dllo2 - bho: ie - {d157330a-9ef3-49f8-9a67-4141ac41add4} - c:\windows\downlo~1\cnshook.dllo3 - **: 雅虎助手 - {406f94f0-504f-4a40-8dfd-58b0666abebd} - c:\progra~1\yahoo!\ass**t~1\ass**t\ya**ar.dllo4 - hklm\..\run: [imjpmig8.1] "c:\windows\ime\imjp8_1\imjpmig.exe" /spoil /remadvdef /migration32o4 - hklm\..\run: [phime2002async] c:\windows\system32\ime\tintlgnt\tintsetp.exe /synco4 - hklm\..\run: [phime2002a] c:\windows\system32\ime\tintlgnt\tintsetp.exe /imenameo4 - hklm\..\run: [imscmig] c:\progra~1\common~1\micros~1\ime\imsc40a\imscmig.exe /preloado4 - hklm\..\run: [桌面图标文字自动透明] d:\我的下载\工具软件\win优化**6[1].5\wom6.5\winmem.exe xpo4 - hklm\..\run: [r**task] "c:\program files\r**ing\r**\r**task.exe" -systemo4 - hklm\..\run: [rfwmain] "c:\program files\r**ing\rfw\rfwmain.exe" -startupo4 - hklm\..\run: [yass**tse] "c:\progra~1\yahoo!\ass**tant\yass**tse.exe"o4 - hkcu\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exeo4 - hkcu\..\run: [super rabbit iepro] d:\program files\超级兔子\magicset\sriecli.exe /loado8 - extra context menu item: &使用** - d:\program files\thunder network\thunder\program\geturl.htmo8 - extra context menu item: &使用**全部链接 - d:\program files\thunder network\thunder\program\getallurl.htmo8 - extra context menu item: 上传到qq网络硬盘 - d:\program files\tencent\qq\addtonetd**k.htmo8 - extra context menu item: 导出到 microsoft office excel(&x) - res://c:\progra~1\micros~2\office11\excel.exe/3000o8 - extra context menu item: 添加到qq自定义面板 - d:\program files\tencent\qq\addpanel.htmo8 - extra context menu item: 添加到qq表情 - d:\program files\tencent\qq\addemotion.htmo8 - extra context menu item: 用qq彩信发送该图片 - d:\program files\tencent\qq\sendmms.htmo9 - extra button: yahoo 3.5g电邮 - {507f9113-cd77-4866-ba92-0e86da3d0b97} - (file m**sing)o9 - extra button: 名品折扣 - {59bc54a2-56b3-44a0-93e5-432d58746e26} - ,140,18&cid=816,8,1&sid=5042&show=ignore&url= (file m**sing)o9 - extra button: 雅虎助手 - {5d73ee86-05f1-49ed-b850-e423120ec338} - (file m**sing)o9 - extra button: 雅虎widget - {6354abe6-05f1-49ed-b850-e423120ec338} - (file m**sing)o9 - extra button: 情景聊天 - {e5d12c4e-7b4f-11d3-b5c9-0050045c3c96} - (file m**sing)o9 - extra button: (no name) - {ecf2e268-f28c-48d2-9ab7-8f69c11ccb71} - (file m**sing)o9 - extra 'tools' menuitem: 修复浏览器 - {ecf2e268-f28c-48d2-9ab7-8f69c11ccb71} - (file m**sing)o9 - extra button: (no name) - {fd00d911-7529-4084-9946-a29f1bdf4fe5} - (file m**sing)o9 - extra 'tools' menuitem: 清理上网记录 - {fd00d911-7529-4084-9946-a29f1bdf4fe5} - (file m**sing)o11 - options group: [!cns] 中文上网o14 - iereset.inf: start_page_url=o16 - dpf: {6414512b-b978-451d-a0d8-fcfdf33e833c} (wuwebcontrol class) - o17 - hklm\system\ccs\services\tcpip\..\{22bb33a0-34cb-436d-9ee8-388e9ad3b530}: nameserver = 61.187.98.3 202.103.96.68o17 - hklm\system\ccs\services\tcpip\..\{7e110ab3-a731-4af5-841b-2735a7b1f755}: nameserver = 61.187.98.6,61.187.96.3o23 - service: r**ing proxy service (rfwproxysrv) - beijing r**ing technology co., ltd. - c:\program files\r**ing\rfw\rfwproxy.exeo23 - service: r**ing personal firewall service (rfwservice) - beijing r**ing technology co., ltd. - c:\program files\r**ing\rfw\rfwsrv.exeo23 - service: r**ing process communication center (rsccenter) - beijing r**ing technology co., ltd. - c:\program files\r**ing\r**\ccenter.exeo23 - service: r**ing realtime monitor (rsr**mon) - beijing r**ing technology co., ltd. - c:\program files\r**ing\r**\r**mond.exe 20210311