瑞星卡卡安全论坛

HijackThis(zww3008汉化版)V1.99.1
保存于      17:27:13, 日期 2005-8-25
操作系统：  Windows 2000 SP4 (WinNT 5.00.2195)
浏览器：    Internet Explorer v6.00 SP1 (6.00.2800.1106)

当前运行的进程：         
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\llssrv.exe
C:\WINNT\system32\ntfrs.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\locator.exe
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\dns.exe
C:\WINNT\system32\inetsrv\inetinfo.exe
C:\WINNT\System32\ismserv.exe
C:\WINNT\system32\msdtc.exe
C:\Program Files\Exchsrvr\bin\mad.exe
C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Exchsrvr\bin\store.exe
C:\Program Files\Exchsrvr\bin\emsmta.exe
C:\WINNT\Explorer.EXE
c:\program files\rising\rfw\RfwMain.exe
C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MINIPP\MINIPP.exe
C:\WINNT\system32\ctfmon.exe
C:\WINNT\System32\svchost.exe
E:\Program Files\wwwTencent\TM\TMDlls\TIMPlatform.exe
C:\WINNT\system32\conime.exe
C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
C:\PROGRAM FILES\RISING\RAV\RavStub.exe
c:\program files\rising\rav\RAVMON.EXE
C:\WINNT\system32\WISPTIS.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
E:\Program Files\wwwTencent\TM\TMDlls\TM.exe
E:\Program Files\Tencent\TT\TTraveler.exe
H:\HB_HijackThis1991zww\HijackThis1991汉化版\HB_HijackThis1991_zww.exe

O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINNT\system32\xunleibho_v5.dll
O3 - IE工具栏增项: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - 启动项HKLM\\Run: [nwiz] nwiz.exe /install
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - 启动项HKLM\\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - 启动项HKLM\\Run: [RavMon] C:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - 启动项HKLM\\Run: [RavTimer] C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - 启动项HKLM\\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - 启动项HKLM\\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - 启动项HKLM\\Run: [MINI_MINIPP] C:\Program Files\MINIPP\MINIPP.exe
O4 - 启动项HKCU\\Run: [ctfmon.exe] ctfmon.exe
O8 - IE右键菜单中的新增项目： &使用迅雷下载 - C:\PROGRA~1\Thunder\geturl.htm
O8 - IE右键菜单中的新增项目： &使用迅雷下载全部链接 - C:\PROGRA~1\Thunder\getAllurl.htm
O8 - IE右键菜单中的新增项目： &使用迷你PP下载 - C:\Program Files\MINIPP\geturl.htm
O8 - IE右键菜单中的新增项目： 使用影音传送带下载 - E:\Program Files\NetTransport 2\NetTransport 2\NTAddLink.html
O8 - IE右键菜单中的新增项目： 使用影音传送带下载全部链接 - E:\Program Files\NetTransport 2\NetTransport 2\NTAddList.html
O8 - IE右键菜单中的新增项目： 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - IE右键菜单中的新增项目： 添加到QQ自定义面板 - E:\Program Files\Tencent\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目： 用QQ彩信发送该图片 - E:\Program Files\Tencent\QQ\SendMMS.htm
O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} (Edit Class) - https://www.sz1.cmbchina.com/download/CMBEdit.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/2937593beca1f1d60905/netzip/RdxIE601_cn.cab
O16 - DPF: {56A7DC70-E102-4408-A34A-AE06FEF01586} (天下搜索) - http://iebar.t2t2.com/iebar.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1119052122656
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = hengsida.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{FFF929E6-A4C9-4E86-AC12-D2D1F56A8795}: NameServer = 192.168.1.2
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = hengsida.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = hengsida.com
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = hengsida.com
O23 - NT 服务: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - NT 服务: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - NT 服务: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - c:\program files\rising\rfw\rfwsrv.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - rising - C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe

你的进程太多了吧？至少下面这些我是没有的！
C:\WINNT\system32\spoolsv.exe[如果不用打印机这个服务可以禁用]
C:\WINNT\system32\Dfssvc.exe[？？]
C:\WINNT\System32\llssrv.exe[？？]
C:\WINNT\system32\ntfrs.exe[？？]
C:\WINNT\system32\nvsvc32.exe[？？]
C:\WINNT\system32\locator.exe[？？]
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE[没多大用，网页经常更新太慢]
C:\WINNT\system32\MSTask.exe[？？]
C:\WINNT\system32\stisvc.exe[？？]
C:\WINNT\System32\WBEM\WinMgmt.exe[？？]
C:\WINNT\System32\dns.exe[？？]
C:\WINNT\system32\inetsrv\inetinfo.exe[IIS？？]
C:\WINNT\System32\ismserv.exe[？？]
C:\WINNT\system32\msdtc.exe[？？]
C:\Program Files\Exchsrvr\bin\mad.exe[？？]
C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe[？？]
C:\Program Files\Exchsrvr\bin\store.exe[？？]
C:\Program Files\Exchsrvr\bin\emsmta.exe[？？]
C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE[我也觉得没多大用]
C:\Program Files\Common Files\Real\Update_OB\realsched.exe[这个更是垃圾]
C:\Program Files\MINIPP\MINIPP.exe[？？]
E:\Program Files\wwwTencent\TM\TMDlls\TIMPlatform.exe[垃圾]
C:\WINNT\system32\WISPTIS.EXE[？？]
C:\Program Files\MSN Messenger\msnmsgr.exe[一定要用吗]
E:\Program Files\wwwTencent\TM\TMDlls\TM.exe[垃圾]
E:\Program Files\Tencent\TT\TTraveler.exe[垃圾]


附件: 293892005825191647.JPG

【回复“ADL”的帖子】
请问怎样才能禁止RAVTIMER.EXE和CCENTER.EXE运行啊
我已取消所有定时设置

我的电脑是WINDOWS 2K SERVER 系统！外加EXCHANGE 2000 SERVER 进程应该会多些吧！

有点难度