我也中毒了,帮我看看吧!
HijackThis@Qoo的扫描日志 V1.97.7
Scan saved at 23:32:42, on 2006-1-4
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\Rundll32.exe
C:\Program Files\rising\rfw\Rfw.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
E:\ske\TrojanAssistant.exe
C:\Program Files\Internet Explorer\iexplore.exe
E:\HijackThis.exe
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file)
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINDOWS\downlo~1\CnsHook.dll
O2 - BHO: (no name) - {FEDF637B-F631-4583-A210-33CC828D42DB} - E:\tu\MagicSet\HaokanBar.dll
O3 - Toolbar: ????? - {FEDF637B-F631-4583-A210-33CC828D42DB} - E:\tu\MagicSet\HaokanBar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] ; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] ; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [DAEMON Tools-1033] ; "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvCplDaemon] ; RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] ; nwiz.exe /install
O4 - HKLM\..\Run: [Super Rabbit SRRestore] E:\tu\MagicSet\srrest.exe /autosave
O4 - HKLM\..\Run: [NeroFilterCheck] ; C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] ; %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [CnsMin] Rundll32.exe C:\WINDOWS\downlo~1\CnsMin.dll,Rundll32
O4 - HKLM\..\Run: [AsShell] ; "C:\Program Files\3721\assist\AsShell.exe"
O4 - HKLM\..\Run: [Rapdyler] ; C:\WINDOWS\System32\wonoste.exe
O4 - HKLM\..\Run: [foxrxjh] ; C:\WINDOWS\System32\foxrxjh.exe
O4 - HKLM\..\Run: [RavUpter] ; C:\Program Files\NOTEPAD.EXE
O4 - HKLM\..\Run: [Systeres] ; C:\Program Files\winhelp.exe
O4 - HKLM\..\Run: [RavTask] ; "C:\Program Files\rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [rfw] C:\Program Files\rising\rfw\Rfw.exe
O4 - HKLM\..\Run: [MediaGateway] ; C:\Program Files\MediaGateway\MediaGateway.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] ; "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Super Rabbit Desktop Search] ; E:\tu\MagicSet2\
O4 - Startup: NTUSER.DAT.LOG
O4 - Startup: ntuser.ini
O4 - Startup: userroom.db
O4 - Startup: userESky.db
O4 - Startup: ntuser.dat
O4 - Startup: default.pls
O8 - Extra context menu item: 上传到QQ网络硬盘 - F:\QQ2005\AddToNetDisk.htm
O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - F:\QQ2005\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - F:\QQ2005\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - F:\QQ2005\SendMMS.htm
O8 - Extra context menu item: 用比特精灵下载(&B) - E:\BT\BT3.1.0.07\BitSpirit\bsurl.htm
O11 - Options group: [!CNS]
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/
O16 - DPF: {0000000A-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/d/4/4/d446e8a9-3a86-4b59-bb19-f5bd11b40367/wmavax.CAB
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {88734439-46D0-42C0-A13F-7E881EE550CF} (Filetran Control) - http://www.bluesky.cn/download/filetran.cab
O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} (MediaGatewayX) - http://static.zangocash.com/cab/Seekmo/ie/bridge-c15.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash
Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DA984A6D-508E-11D6-AA49-0050FF3C628D} (Ravonline) - http://download.rising.com.cn/QQ/QQkill/rsonline.cab
O16 - DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} (pCastPanel Class) - http://ps.itv.mop.com/dn/files/pCastCtl_1.0.0.76_20051110.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{22F1F193-26E3-4E74-80EF-204C42B8DDB1}: NameServer = 202.103.225.68 202.103.224.68
O17 - HKLM\System\CS1\Services\Tcpip\..\{22F1F193-26E3-4E74-80EF-204C42B8DDB1}: NameServer = 202.103.225.68 202.103.224.68
