瑞星卡卡安全论坛

HijackThis_zww汉化版扫描日志 V1.99.1
保存于      9:32:28, 日期 2005-11-25
操作系统：  Windows XP SP1 (WinNT 5.01.2600)
浏览器：    Internet Explorer v6.00 SP1 (6.00.2800.1106)

当前运行的进程：         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\Rising\Rising\Rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
D:\RISING\RAV\CCENTER.EXE
D:\RISING\RAV\Ravmond.exe
C:\WINDOWS\System32\svchost.exe
D:\RISING\RAV\RavStub.exe
C:\WINDOWS\Explorer.EXE
D:\Rising\Rising\Rfw\RfwMain.exe
C:\Program Files\Samsung\SCX 4x20 Series\PSU\Scan2Pc.exe
C:\Program Files\MediaGateway\MediaGateway.exe
C:\Program Files\95599 Certificate Tools\SHANGHAI TAX\TaxKeyManager.exe
D:\RISING\RAV\RAVTIMER.EXE
D:\RISING\RAV\RAVMON.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
D:\sos\HijackThis1991zww.exe

O1 - Hosts: 203.142.1.57 www.halifax-online.co.uk
O1 - Hosts: 203.142.1.57 ibank.barclays.co.uk
O1 - Hosts: 203.142.1.57 online.lloydstsb.co.uk
O1 - Hosts: 203.142.1.57 online-business.lloydstsb.co.uk
O1 - Hosts: 203.142.1.57 www.ukpersonal.hsbc.co.uk
O1 - Hosts: 203.142.1.57 banesnet.banesto.es
O1 - Hosts: 203.142.1.57 extranet.banesto.es
O1 - Hosts: 203.142.1.57 ebanking.bccbrescia.it
O1 - Hosts: 203.142.1.57 www.bankofscotlandhalifax-online.co.uk
O1 - Hosts: 203.142.1.57 oi.cajamadrid.es
O1 - Hosts: 203.142.1.57 bancae.caixapenedes.com
O1 - Hosts: 203.142.1.57 banking.postbank.de
O1 - Hosts: 203.142.1.57 meine.deutsche-bank.de
O1 - Hosts: 203.142.1.57 myonlineaccounts2.abbeynational.co.uk
O1 - Hosts: 203.142.1.57 ibank.cahoot.com
O1 - Hosts: 203.142.1.57 webbank.openplan.co.uk
O1 - Hosts: 203.142.1.57 bancopostaonline.poste.it
O1 - Hosts: 203.142.1.57 mybank.bybank.it
O1 - Hosts: 203.142.1.57 ibank.internationalbanking.barclays.com
O1 - Hosts: 203.142.1.57 welcome7.co-operativebank.co.uk
O1 - Hosts: 203.142.1.57 welcome11.co-operativebankonline.co.uk
O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - IE工具栏增项: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll
O3 - IE工具栏增项: Zango Toolbar - {EA0D26BD-9029-431A-86E0-83152D67828A} - C:\Program Files\Zango Programs\Zango Toolbar\ZangoTB.dll
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [EssSpkPhone] essspk.exe
O4 - 启动项HKLM\\Run: [Rocky2SEC_S2P] C:\Program Files\Samsung\SCX 4x20 Series\PSU\Scan2Pc.exe
O4 - 启动项HKLM\\Run: [Microsoft IIS] C:\WINDOWS\system32\syshost.exe
O4 - 启动项HKLM\\Run: [MediaGateway] C:\Program Files\MediaGateway\MediaGateway.exe
O4 - 启动项HKLM\\Run: [timessquare] C:\windows\timessquare.exe
O4 - 启动项HKLM\\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - 启动项HKLM\\Run: [TaxKeyManager] C:\Program Files\95599 Certificate Tools\SHANGHAI TAX\TaxKeyManager.exe
O4 - 启动项HKLM\\Run: [Windows AdTools] C:\Program Files\Windows AdTools\WinAdTools.exe
O4 - 启动项HKLM\\Run: [RavTimer] D:\RISING\RAV\RAVTIMER.EXE
O4 - 启动项HKLM\\Run: [RavMon] D:\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - 启动项HKLM\\Run: [RfwMain] "D:\Rising\Rising\Rfw\rfwmain.exe" -Startup
O4 - 启动项HKCU\\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O15 - “受信任的站点”中添加项: easyabc.95599.cn
O15 - “受信任的站点”中添加项: www.95599.cn
O17 - HKLM\System\CCS\Services\Tcpip\..\{0CEB5D68-80ED-4AA0-AFBA-63002BB02E26}: NameServer = 202.99.160.68 211.136.17.107
O18 - 列举现有的协议: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - 列举现有的协议: cdl - {3DD53D40-7B8B-11D0-B013-00AA0059CE02} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\System32\msvidctl.dll
O18 - 列举现有的协议: file - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: ftp - {79EAC9E3-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: gopher - {79EAC9E4-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: http - {79EAC9E2-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: https - {79EAC9E5-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: ipp - (no CLSID) - (no file)
O18 - 列举现有的协议: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll
O18 - 列举现有的协议: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - 列举现有的协议: local - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: mailto - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - 列举现有的协议: mhtml - {05300401-BCBC-11D0-85E3-00C04FD85AB4} - C:\WINDOWS\System32\inetcomm.dll
O18 - 列举现有的协议: mk - {79EAC9E6-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll
O18 - 列举现有的协议: msdaipp - (no CLSID) - (no file)
O18 - 列举现有的协议: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - 列举现有的协议: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\System32\mshtml.dll
O18 - 列举现有的协议: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\System32\msvidctl.dll
O18 - 列举现有的协议: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - 列举现有的协议: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINDOWS\System32\msdxm.ocx
O18 - 列举现有的协议: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\System32\wiascr.dll
O20 - Winlogon Notify: App Management - C:\WINDOWS\system32\en8ml1l11.dll
O20 - Winlogon Notify: SharedDLLs - C:\WINDOWS\system32\deloader.dll (file missing)
O20 - Winlogon Notify: sstuu - sstuu.dll (file missing)
O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - D:\Rising\Rising\Rfw\rfwsrv.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - rising - D:\RISING\RAV\CCENTER.EXE
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\RISING\RAV\Ravmond.exe

怎么没有人帮忙呢  ？？？
求大家；帮帮忙啊

引用:

【不吃萝卜的兔子的贴子】怎么没有人帮忙呢  ？？？ 求大家；帮帮忙啊 ...........................

关闭IE等不必要的程 序
清空临时文件夹
IE》属性》删除文件（包括脱机文件）》确定
修复下面的项
O1 - Hosts: 203.142.1.57 www.halifax-online.co.uk
O1 - Hosts: 203.142.1.57 ibank.barclays.co.uk
O1 - Hosts: 203.142.1.57 online.lloydstsb.co.uk
O1 - Hosts: 203.142.1.57 online-business.lloydstsb.co.uk
O1 - Hosts: 203.142.1.57 www.ukpersonal.hsbc.co.uk
O1 - Hosts: 203.142.1.57 banesnet.banesto.es
O1 - Hosts: 203.142.1.57 extranet.banesto.es
O1 - Hosts: 203.142.1.57 ebanking.bccbrescia.it
O1 - Hosts: 203.142.1.57 www.bankofscotlandhalifax-online.co.uk
O1 - Hosts: 203.142.1.57 oi.cajamadrid.es
O1 - Hosts: 203.142.1.57 bancae.caixapenedes.com
O1 - Hosts: 203.142.1.57 banking.postbank.de
O1 - Hosts: 203.142.1.57 meine.deutsche-bank.de
O1 - Hosts: 203.142.1.57 myonlineaccounts2.abbeynational.co.uk
O1 - Hosts: 203.142.1.57 ibank.cahoot.com
O1 - Hosts: 203.142.1.57 webbank.openplan.co.uk
O1 - Hosts: 203.142.1.57 bancopostaonline.poste.it
O1 - Hosts: 203.142.1.57 mybank.bybank.it
O1 - Hosts: 203.142.1.57 ibank.internationalbanking.barclays.com
O1 - Hosts: 203.142.1.57 welcome7.co-operativebank.co.uk
O1 - Hosts: 203.142.1.57 welcome11.co-operativebankonline.co.uk


O20 - Winlogon Notify: App Management - C:\WINDOWS\system32\en8ml1l11.dll
O20 - Winlogon Notify: SharedDLLs - C:\WINDOWS\system32\deloader.dll (file missing)
O20 - Winlogon Notify: sstuu - sstuu.dll (file missing)

并说明一下具体的问题~~？

O4 - 启动项HKLM\\Run: [Microsoft IIS] C:\WINDOWS\system32\syshost.exe
O4 - 启动项HKLM\\Run: [timessquare] C:\windows\timessquare.exe