高手帮忙看看有啥问题,有日志 bbs.ikaka.com

fym19912 - 2006-10-6 11:37:00

Logfile of HijackThis v1.99.1
Scan saved at 11:22:39, on 2006-10-5
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rising\Rav\Ravmond.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Rising\Rav\RavStub.exe
c:\program files\rising\rfw\RfwMain.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\Program Files\Rising\Rav\RsAgent.exe
C:\WINDOWS\msagent\AgentSvr.exe
C:\Program Files\Maxthon\Maxthon.exe
C:\TDdownload\HijackThis.exe

R3 - URLSearchHook: (no name) - {1B0E7716-898E-48cc-9690-4E338E8DE1D3} - (no file)
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: 上网助手 - {1B0E7716-898E-48cc-9690-4E338E8DE1D3} - (no file)
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\XUNLEIBHO_002.dll
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\KakaTool.dll
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\RunOnce: [RavStub] "C:\Program Files\Rising\Rav\ravstub.exe" /RUNONCE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - Extra context menu item: 用比特精灵下载(&B) - C:\Program Files\BitSpirit\bsurl.htm
O9 - Extra button: (no name) - RsAutorunsDisabled - (no file)
O9 - Extra button: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - C:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - Extra 'Tools' menuitem: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - C:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - C:\Program Files\Kingsoft\Powerword 2006\浩方对战平台\GameClient.exe
O9 - Extra button: 豪杰超级解霸9 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - C:\Program Files\Herosoft\Hero 9\STHSDVD.EXE
O9 - Extra 'Tools' menuitem: 豪杰超级解霸9 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - C:\Program Files\Herosoft\Hero 9\STHSDVD.EXE
O9 - Extra button: kele8 - {84920E5F-3788-49cd-A274-E365578DF174} - http://www.kele8.com/ (file missing)
O9 - Extra 'Tools' menuitem: kele8 - {84920E5F-3788-49cd-A274-E365578DF174} - http://www.kele8.com/ (file missing)
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O17 - HKLM\System\CCS\Services\Tcpip\..\{C60D15BB-2987-46A1-A543-562A3EF197B8}: NameServer = 202.96.128.143,202.96.134.183
O23 - Service: Machine Debug Manager (MDM) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (file missing)
O23 - Service: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Silicon Integrated Systems Corp. - (no file)

fym19912 - 2006-10-6 11:38:00

这是进程的!
2006-10-05 11:14:27：进程快照列表

进程数: 25

---进程列表---

名称: [System Process](优先级：暂缺)
完整路径: [System Process]

名称: System(优先级：标准)
完整路径: System

名称: smss.exe(优先级：标准)
完整路径: C:\WINDOWS\System32\smss.exe
发行商: Microsoft Corporation
描述: Windows NT Session Manager
版权: ? Microsoft Corporation. All rights reserved.
文件版本: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
产品名称: Microsoft? Windows? Operating System
产品版本: 5.1.2600.2180

名称: csrss.exe(优先级：标准)
完整路径: C:\WINDOWS\system32\csrss.exe
发行商: Microsoft Corporation
描述: Client Server Runtime Process
版权: ? Microsoft Corporation. All rights reserved.
文件版本: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
产品名称: Microsoft? Windows? Operating System
产品版本: 5.1.2600.2180

名称: winlogon.exe(优先级：高)
完整路径: C:\WINDOWS\system32\winlogon.exe
发行商: Microsoft Corporation
描述: Windows NT Logon Application
版权: (C) Microsoft Corporation. All rights reserved.
文件版本: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
产品名称: Microsoft(R) Windows(R) Operating System
产品版本: 5.1.2600.2180

名称: services.exe(优先级：标准)
完整路径: C:\WINDOWS\system32\services.exe
发行商: Microsoft Corporation
描述: Services and Controller app
版权: (C) Microsoft Corporation. All rights reserved.
文件版本: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
产品名称: Microsoft(R) Windows(R) Operating System
产品版本: 5.1.2600.2180

名称: lsass.exe(优先级：标准)
完整路径: C:\WINDOWS\system32\lsass.exe
发行商: Microsoft Corporation
描述: LSA Shell (Export Version)
版权: ? Microsoft Corporation. All rights reserved.
文件版本: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
产品名称: Microsoft? Windows? Operating System
产品版本: 5.1.2600.2180

名称: svchost.exe(优先级：标准)
完整路径: C:\WINDOWS\system32\svchost.exe
发行商: Microsoft Corporation
描述: Generic Host Process for Win32 Services
版权: ? Microsoft Corporation. All rights reserved.
文件版本: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
产品名称: Microsoft? Windows? Operating System
产品版本: 5.1.2600.2180

名称: svchost.exe(优先级：标准)
完整路径: C:\WINDOWS\system32\svchost.exe
发行商: Microsoft Corporation
描述: Generic Host Process for Win32 Services
版权: ? Microsoft Corporation. All rights reserved.
文件版本: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
产品名称: Microsoft? Windows? Operating System
产品版本: 5.1.2600.2180

名称: CCenter.exe(优先级：标准)
完整路径: C:\Program Files\Rising\Rav\CCenter.exe
发行商: Beijing Rising Technology Co., Ltd.
描述: CCenter
版权: Copyright Rising 2002
文件版本: 18, 0, 0, 3
产品名称: Rising Antivirus Software
产品版本: 18, 0, 0, 3

名称: svchost.exe(优先级：标准)
完整路径: C:\WINDOWS\System32\svchost.exe
发行商: Microsoft Corporation
描述: Generic Host Process for Win32 Services
版权: ? Microsoft Corporation. All rights reserved.
文件版本: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
产品名称: Microsoft? Windows? Operating System
产品版本: 5.1.2600.2180

名称: svchost.exe(优先级：标准)
完整路径: C:\WINDOWS\system32\svchost.exe
发行商: Microsoft Corporation
描述: Generic Host Process for Win32 Services
版权: ? Microsoft Corporation. All rights reserved.
文件版本: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
产品名称: Microsoft? Windows? Operating System
产品版本: 5.1.2600.2180

名称: svchost.exe(优先级：标准)
完整路径: C:\WINDOWS\system32\svchost.exe
发行商: Microsoft Corporation
描述: Generic Host Process for Win32 Services
版权: ? Microsoft Corporation. All rights reserved.
文件版本: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
产品名称: Microsoft? Windows? Operating System
产品版本: 5.1.2600.2180

名称: Ravmond.exe(优先级：标准)
完整路径: C:\Program Files\Rising\Rav\Ravmond.exe
发行商: Beijing Rising Technology Co., Ltd.
描述: RavMond
版权: Copyright(c) 1998-2006 Beijing Rising Technology Corporation Limited
文件版本: 18, 0, 1, 35
产品名称: Rising Antivirus Software
产品版本: 18, 0, 1, 35

名称: rfwsrv.exe(优先级：标准)
完整路径: c:\program files\rising\rfw\rfwsrv.exe
发行商: Beijing Rising Technology Co., Ltd.
描述: Rising Personal FireWall Service
版权: Copyright(c) 1998-2006 Beijing Rising Technology Corporation Limited
文件版本: 4, 0, 0, 33
产品名称: Rising Personal FireWall 2006
产品版本: 4, 0, 0, 0

名称: spoolsv.exe(优先级：标准)
完整路径: C:\WINDOWS\system32\spoolsv.exe
发行商: Microsoft Corporation
描述: Spooler SubSystem App
版权: ? Microsoft Corporation. All rights reserved.
文件版本: 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)
产品名称: Microsoft? Windows? Operating System
产品版本: 5.1.2600.2696

名称: Explorer.EXE(优先级：标准)
完整路径: C:\WINDOWS\Explorer.EXE
发行商: Microsoft Corporation
描述: Windows Explorer
版权: (C) Microsoft Corporation. All rights reserved.
文件版本: 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
产品名称: Microsoft(R) Windows(R) Operating System
产品版本: 6.00.2900.2180

名称: RavStub.exe(优先级：标准)
完整路径: C:\Program Files\Rising\Rav\RavStub.exe
发行商: Beijing Rising Technology Co., Ltd.
描述: Rising RavStub
版权: Copyright (c) 1998-2005 Rising Corp.
文件版本: 18, 0, 0, 16
产品名称: RavStub Application
产品版本: 18, 0, 0, 16

名称: RfwMain.exe(优先级：标准)
完整路径: c:\program files\rising\rfw\RfwMain.exe
发行商: Beijing Rising Technology Co., Ltd.
描述: Rising Personal FireWall Main Program
版权: Copyright(c) 1998-2006 Beijing Rising Technology Corporation Limited
文件版本: 4, 0, 0, 52
产品名称: Rising Personal FireWall 2006
产品版本: 4, 0, 0, 0

名称: svchost.exe(优先级：标准)
完整路径: C:\WINDOWS\System32\svchost.exe
发行商: Microsoft Corporation
描述: Generic Host Process for Win32 Services
版权: ? Microsoft Corporation. All rights reserved.
文件版本: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
产品名称: Microsoft? Windows? Operating System
产品版本: 5.1.2600.2180

名称: RavTask.exe(优先级：空闲)
完整路径: C:\Program Files\Rising\Rav\RavTask.exe
发行商: Beijing Rising Technology Co., Ltd.
描述: RavTimer
版权: Copyright (c) 1998-2006 Rising Corp.
文件版本: 18, 0, 0, 22
产品名称: Rising Antivirus Software
产品版本: 18, 0, 0, 22

名称: ctfmon.exe(优先级：标准)
完整路径: C:\WINDOWS\system32\ctfmon.exe
发行商: Microsoft Corporation
描述: CTF Loader
版权: ? Microsoft Corporation. All rights reserved.
文件版本: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
产品名称: Microsoft? Windows? Operating System
产品版本: 5.1.2600.2180

名称: Ravmon.exe(优先级：标准)
完整路径: C:\Program Files\Rising\Rav\Ravmon.exe
发行商: Beijing Rising Technology Co., Ltd.
描述: RavMon
版权: Copyright(c) 1998-2006 Beijing Rising Technology Corporation Limited
文件版本: 18, 0, 1, 33
产品名称: Rising Anti-Virus Monitor
产品版本: 18, 0, 1, 33

名称: alg.exe(优先级：标准)
完整路径: C:\WINDOWS\System32\alg.exe
发行商: Microsoft Corporation
描述: Application Layer Gateway Service
版权: ? Microsoft Corporation. All rights reserved.
文件版本: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
产品名称: Microsoft? Windows? Operating System
产品版本: 5.1.2600.2180

名称: WoptiProcess.exe(优先级：标准)
完整路径: C:\Program Files\Wom\WoptiProcess.exe
发行商: 鲁锦
描述: Wopti 进程管理大师
版权: 版权所有 (C) 2000-2006 鲁锦
文件版本: 3.3.6.929
产品名称: Wopti 进程管理大师
产品版本: 3.3

thjl - 2006-10-6 11:45:00

修复以下项：
R3 - URLSearchHook: (no name) - {1B0E7716-898E-48cc-9690-4E338E8DE1D3} - (no file)
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: 上网助手 - {1B0E7716-898E-48cc-9690-4E338E8DE1D3} - (no file)
O23 - Service: Machine Debug Manager (MDM) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Silicon Integrated Systems Corp. - (no file)

fym19912 - 2006-10-6 12:12:00

谢谢
进程里有问题吗?

fym19912 - 2006-10-6 16:17:00

O23 - Service: Machine Debug Manager (MDM) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Silicon Integrated Systems Corp. - (no file)

删除不掉

fym19912 - 2006-10-6 16:18:00

现在的日志
HijackThis_815汉化版扫描日志 V1.99.1
保存于 16:04:23, 日期 2006-10-5
操作系统： Windows XP SP2 (WinNT 5.01.2600)
浏览器： Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程：
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rising\Rav\Ravmond.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Rising\Rav\RavStub.exe
c:\program files\rising\rfw\RfwMain.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Maxthon\Maxthon.exe
C:\Program Files\Thunder Network\Thunder\Program\Thunder5.exe
C:\Program Files\Rising\Rav\RsAgent.exe
C:\WINDOWS\msagent\AgentSvr.exe
C:\TDdownload\HijackThis1991zww.exe

O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\XUNLEIBHO_002.dll
O3 - IE工具栏增项: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\KakaTool.dll
O4 - 启动项HKLM\\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - 启动项HKLM\\RunOnce: [RavStub] "C:\Program Files\Rising\Rav\ravstub.exe" /RUNONCE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - IE右键菜单中的新增项目: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm
O8 - IE右键菜单中的新增项目: 用比特精灵下载(&B) - C:\Program Files\BitSpirit\bsurl.htm
O9 - 浏览器额外的按钮: (no name) - RsAutorunsDisabled - (no file)
O9 - 浏览器额外的按钮: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - C:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - 浏览器额外的“工具”菜单项: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - C:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - 浏览器额外的按钮: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - C:\Program Files\Kingsoft\Powerword 2006\浩方对战平台\GameClient.exe
O9 - 浏览器额外的按钮: 豪杰超级解霸9 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - C:\Program Files\Herosoft\Hero 9\STHSDVD.EXE
O9 - 浏览器额外的“工具”菜单项: 豪杰超级解霸9 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - C:\Program Files\Herosoft\Hero 9\STHSDVD.EXE
O9 - 浏览器额外的按钮: kele8 - {84920E5F-3788-49cd-A274-E365578DF174} - http://www.kele8.com/ (file missing)
O9 - 浏览器额外的“工具”菜单项: kele8 - {84920E5F-3788-49cd-A274-E365578DF174} - http://www.kele8.com/ (file missing)
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O17 - HKLM\System\CCS\Services\Tcpip\..\{C60D15BB-2987-46A1-A543-562A3EF197B8}: NameServer = 202.96.128.143,202.96.134.183
O23 - NT 服务: Machine Debug Manager (MDM) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (file missing)
O23 - NT 服务: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe
O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
O23 - NT 服务: Symantec Network Drivers Service (SNDSrvc) - Silicon Integrated Systems Corp. - (no file)

瑞星卡卡安全论坛