瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 我中了Backdoor.GPigeon.twm！为什么杀了总还有？请DX救我。（有日志）

1   1  /  1  页   跳转页

我中了Backdoor.GPigeon.twm！为什么杀了总还有？请DX救我。（有日志）

收藏
19800133
头像
初生襁褓狮
  • 帖子:2
  • 注册: 2005-12-13
  • 来自:
发表于： 2005-12-13 18:02 | 只看楼主 短消息 资料
字号： 小 中 大 1楼

我中了Backdoor.GPigeon.twm！为什么杀了总还有？请DX救我。（有日志）

Logfile of HijackThis v1.99.1
Scan saved at 18:00:20, on 2005-12-13
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\RISING\RAV\Ravmond.exe
D:\RISING\RAV\RavStub.exe
d:\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
d:\rising\rfw\RfwMain.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\RISING\RAV\RAVMON.EXE
D:\SuperSoft\RdfSnap2005\RdfSnap2005.EXE
D:\RISING\RAV\RAVTIMER.EXE
C:\WINDOWS\VM_STI.EXE
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Chinese Date & Time\ICalClk.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
D:\SnowFox\DesktopSprite2\DesktopSprite.exe
D:\RISING\RAV\CCENTER.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\SAND\qqfacerclient.exe
C:\Program Files\racer-henan-cnc\racer.exe
C:\Program Files\racer-henan-cnc\RacerKp.exe
D:\Maxthon\Maxthon.exe
D:\BitComet\BitComet.exe
D:\Tencent\qq\qq\qq\QQ.exe
d:\Tencent\qq\TIMPlatform.
C:\WINDOWS\system32\NOTEPAD.EXE
D:\Xi\NetTransport 2\NetTransport.exe
d:\WinRAR\WinRAR.exe
C:\DOCUME~1\user\LOCALS~1\Temp\Rar$EX00.938\HijackThis.exe

R3 - URLSearchHook: (no name) - {BB936323-19FA-4521-BA29-ECA6A121BC78} - (no file)
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v8.dll
O2 - BHO: IDDTInitObj Class - {15DDE989-CD45-4561-BF99-D22C0D5C2B74} - D:\sina\UC\UCddt\ddtinit.dll (file missing)
O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll
O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll
O2 - BHO: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
O2 - BHO: 雅虎助手 - {5EB7CB50-E375-4718-B4C0-9AD12EFA2F84} - C:\WINDOWS\System32\aclayer.dll (file missing)
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - D:\Siber systems\AI Roboform\roboform.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\zh-cn\msntb.dll
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - d:\Xi\NetTransport 2\NTIEHelper.dll
O3 - Toolbar: BitCometBar - {3F1ABCDB-A875-46c1-8345-B72A4567E486} - D:\BitComet\BitCometBar\BitCometBar0.2.dll
O3 - Toolbar: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - D:\Siber systems\AI Roboform\roboform.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\zh-cn\msntb.dll
O3 - Toolbar: 新浪点点通 - {F60C7D81-8471-4D40-AAFE-56D318F34C2D} - D:\sina\UC\UCddt\DDTONG~1.DLL
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [StormCodec_Helper] "d:\Ringz Studio\Storm Codec\StormSet.exe" /S /opti
O4 - HKLM\..\Run: [RavMon] D:\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [RfwMain] "d:\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [RdfSnap2005] "D:\SuperSoft\RdfSnap2005\RdfSnap2005.EXE" /R
O4 - HKLM\..\Run: [RavTimer] D:\RISING\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE USB PC Camera 301P
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [helper.dll] C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - HKLM\..\Run: [CnsMin] Rundll32.exe C:\WINDOWS\DOWNLO~1\CnsMin.dll,Rundll32
O4 - HKLM\..\Run: [zcom] \zPlatform.exe MIN
O4 - HKLM\..\Run: [system] C:\windows\system.exe
O4 - HKLM\..\Run: [Str3] hongqt
O4 - HKLM\..\Run: [LongData] 焼
O4 - HKLM\..\Run: [BinaryData] "3D梯
O4 - HKLM\..\Run: [YLive.exe] C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
O4 - HKLM\..\Run: [NMGameX_AutoRun] C:\WINDOWS\system32\Rundll32.exe nmgamex.dll,LiveProcess /aa
O4 - HKLM\..\Run: [Update] C:\Program Files\Common Files\UPDATE\Update.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSCalsClocks] C:\Program Files\Microsoft Chinese Date & Time\ICalClk.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [DesktopSprite] D:\SnowFox\DesktopSprite2\DesktopSprite.exe
O8 - Extra context menu item: Customize Menu - file://D:\Siber systems\AI Roboform\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Fill Forms - file://D:\Siber systems\AI Roboform\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://D:\Siber systems\AI Roboform\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://D:\Siber systems\AI Roboform\RoboFormComSavePass.html
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\Tencent\qq\qq\qq\AddToNetDisk.htm
O8 - Extra context menu item: 使用彩信超级自写发送到手机 - http://mms.sina.com.cn/mmsnews.html
O8 - Extra context menu item: 使用影音传送带下载 - D:\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: 使用影音传送带下载全部链接 - D:\Xi\NetTransport 2\NTAddList.html
O8 - Extra context menu item: 使用新浪下载助手下载 - D:\sina\UC\UCddt\sinadl.htm
O8 - Extra context menu item: 使用超级解霸播放 - d:\Herosoft\Hero 9\MPURLGET.HTM
O8 - Extra context menu item: 使用迅雷下载 - d:\Thunder Network\Thunder\geturl.htm
O8 - Extra context menu item: 使用迅雷下载全部链接 - d:\Thunder Network\Thunder\getAllurl.htm
O8 - Extra context menu item: 发送图片到手机(&M) - http://sms.sina.com.cn/diy/send.html?from=467
O8 - Extra context menu item: 收藏此页到新浪ViVi - http://vivi.sina.com.cn/collect/click.php?agent=ddt
O8 - Extra context menu item: 新浪搜索 - http://cha.sina.com.cn/ddt.html
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Tencent\qq\qq\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Tencent\qq\qq\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Tencent\qq\qq\qq\SendMMS.htm
O9 - Extra button: 新浪UC - {2253922F-1B26-4C74-8B57-E3AEE748DBB8} - D:\sina\UC\UC.exe
O9 - Extra button: 填写表单 - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\Siber systems\AI Roboform\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: 填写表单 - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\Siber systems\AI Roboform\RoboFormComFillForms.html
O9 - Extra button: 保存 - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\Siber systems\AI Roboform\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: 保存表单 - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\Siber systems\AI Roboform\RoboFormComSavePass.html
O9 - Extra button: 豪杰超级解霸9 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - d:\Herosoft\Hero 9\STHSDVD.EXE
O9 - Extra 'Tools' menuitem: 豪杰超级解霸9 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - d:\Herosoft\Hero 9\STHSDVD.EXE
O9 - Extra button: (no name) - {6671A433-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\MMSASS~1\Mmsass~1.dll
O9 - Extra 'Tools' menuitem: MMSAssist工具条设置 - {6671A433-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\MMSASS~1\Mmsass~1.dll
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\Siber systems\AI Roboform\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm工具栏 - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\Siber systems\AI Roboform\RoboFormComShowToolbar.html
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE (file missing)
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE (file missing)
O9 - Extra button: 新浪点点通 - {F60C7D81-8471-4D40-AAFE-56D318F34C2D} - D:\sina\UC\UCddt\DDTONG~1.DLL
O9 - Extra button: (no name) - {974AD624-EA50-4831-A6C0-3040F6665396} - D:\sina\UC\UCddt\rssband.dll (HKCU)
O9 - Extra 'Tools' menuitem: 新浪点点通阅读器 - {974AD624-EA50-4831-A6C0-3040F6665396} - D:\sina\UC\UCddt\rssband.dll (HKCU)
O9 - Extra button: 新浪点点通阅读器 - {F0646DC8-58CD-4C64-8F6B-525043914685} - D:\sina\UC\UCddt\rssband.dll (HKCU)
O11 - Options group: [!CNS]  上网助手-地址栏搜索
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - d:\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - D:\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\RISING\RAV\Ravmond.exe
O23 - Service: SVCH0ST - Unknown owner - C:\WINDOWS\SVCH0ST.EXE
O23 - Service: QQFace (Universal Disk Manager) - COMENET TECHNOLOGY - C:\Program Files\Common Files\SAND\qqfacerclient.exe

最后编辑2005-12-13 19:08:04
分享到：
gototop
 
七情叉烧包
头像
快乐黄口狮
  • 帖子:191
  • 注册: 2005-12-05
  • 来自:
发表于： 2005-12-13 18:32 | 短消息 资料
字号： 小 中 大 2楼

SVCH0ST.EXE应该是 SVCHOST.EXE，中间是O不是零。
------------------------------
O23 - Service: SVCH0ST - Unknown owner - C:\WINDOWS\SVCH0ST.EXE

修复、重新启动到安全模式（进入安全模式的方法:重新启动电脑, 开机自动检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式(Safe Mode)进入Windows。）

开始→控制面板→性能和维护→管理工具→服务→查找Local Network Service→右击→属性→启动类型→禁止→应用→停止→确定。

在注册表里搜索删除SVCH0ST.EXE、SVCH0ST.dll、SVCH0ST_hook.dll相关项。修复有这个作用，加强一下。


然后打开我的电脑→再点工具→打开文件夹选项→查看→把隐藏受保护的系统文件（推荐）和隐藏已知文件类型的扩展名的勾去掉→再显示所有文件→找到以下文件并删除：(如果有的话)

在%windows%下删除SVCH0ST.EXE、SVCH0ST.dll、SVCH0ST_hook.dll和类似的文件，试试。

然后做个记录，再看看。
gototop
 
天天网
头像
强壮不惑狮
  • 帖子:782
  • 注册: 2005-03-12
  • 来自:
发表于： 2005-12-13 18:48 | 短消息 资料
字号： 小 中 大 3楼

此项也可疑：O23 - Service: QQFace (Universal Disk Manager) - COMENET TECHNOLOGY - C:\Program Files\Common Files\SAND\qqfacerclient.exe  也按楼上方法操作试试（最近挺多这个的）
gototop
 
七情叉烧包
头像
快乐黄口狮
  • 帖子:191
  • 注册: 2005-12-05
  • 来自:
发表于： 2005-12-13 19:02 | 短消息 资料
字号： 小 中 大 4楼

引用:
【天天网的贴子】此项也可疑：O23 - Service: QQFace (Universal Disk Manager) - COMENET TECHNOLOGY - C:\Program Files\Common Files\SAND\qqfacerclient.exe  也按楼上方法操作试试（最近挺多这个的）
...........................

对。
gototop
 
19800133
头像
初生襁褓狮
  • 帖子:2
  • 注册: 2005-12-13
  • 来自:
发表于： 2005-12-13 19:08 | 只看楼主 短消息 资料
字号： 小 中 大 5楼

非常感谢楼上的两位哥哥。
按二楼DX的指导做了一下。在安全模式下没有找到“Local Network Service”。L开头的只有“Logical Disk Manager”和“Logical Disk Manager Administrative Service”
然后在注册表里搜索SVCH0ST.EXE、SVCH0ST.dll、SVCH0ST_hook.dll，只查到两个“SVCH0ST.EXE”，我都给删掉了。
在windows下找不到SVCH0ST.EXE、SVCH0ST.dll、SVCH0ST_hook.dll和类似的文件。
重启之后没有出现病毒现象。不知道是不是已经删掉了。
再次扫描出的日志如下，请大虾看看。

Logfile of HijackThis v1.99.1
Scan saved at 19:00:20, on 2005-12-13
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\RISING\RAV\Ravmond.exe
D:\RISING\RAV\RavStub.exe
d:\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
d:\rising\rfw\RfwMain.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\RISING\RAV\RAVMON.EXE
D:\SuperSoft\RdfSnap2005\RdfSnap2005.EXE
D:\RISING\RAV\RAVTIMER.EXE
C:\WINDOWS\VM_STI.EXE
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Chinese Date & Time\ICalClk.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
D:\SnowFox\DesktopSprite2\DesktopSprite.exe
D:\RISING\RAV\CCENTER.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\SAND\qqfacerclient.exe
C:\Program Files\racer-henan-cnc\racer.exe
C:\Program Files\racer-henan-cnc\RacerKp.exe
C:\WINDOWS\system32\wuauclt.exe
D:\Maxthon\Maxthon.exe
d:\WinRAR\WinRAR.exe
C:\DOCUME~1\user\LOCALS~1\Temp\Rar$EX00.703\HijackThis.exe

R3 - URLSearchHook: (no name) - {BB936323-19FA-4521-BA29-ECA6A121BC78} - (no file)
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v8.dll
O2 - BHO: IDDTInitObj Class - {15DDE989-CD45-4561-BF99-D22C0D5C2B74} - D:\sina\UC\UCddt\ddtinit.dll (file missing)
O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll
O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll
O2 - BHO: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
O2 - BHO: 雅虎助手 - {5EB7CB50-E375-4718-B4C0-9AD12EFA2F84} - C:\WINDOWS\System32\aclayer.dll (file missing)
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - D:\Siber systems\AI Roboform\roboform.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\zh-cn\msntb.dll
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - d:\Xi\NetTransport 2\NTIEHelper.dll
O3 - Toolbar: BitCometBar - {3F1ABCDB-A875-46c1-8345-B72A4567E486} - D:\BitComet\BitCometBar\BitCometBar0.2.dll
O3 - Toolbar: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - D:\Siber systems\AI Roboform\roboform.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\zh-cn\msntb.dll
O3 - Toolbar: 新浪点点通 - {F60C7D81-8471-4D40-AAFE-56D318F34C2D} - D:\sina\UC\UCddt\DDTONG~1.DLL
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [StormCodec_Helper] "d:\Ringz Studio\Storm Codec\StormSet.exe" /S /opti
O4 - HKLM\..\Run: [RavMon] D:\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [RfwMain] "d:\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [RdfSnap2005] "D:\SuperSoft\RdfSnap2005\RdfSnap2005.EXE" /R
O4 - HKLM\..\Run: [RavTimer] D:\RISING\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE USB PC Camera 301P
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [helper.dll] C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - HKLM\..\Run: [CnsMin] Rundll32.exe C:\WINDOWS\DOWNLO~1\CnsMin.dll,Rundll32
O4 - HKLM\..\Run: [zcom] \zPlatform.exe MIN
O4 - HKLM\..\Run: [system] C:\windows\system.exe
O4 - HKLM\..\Run: [Str3] hongqt
O4 - HKLM\..\Run: [LongData] 焼
O4 - HKLM\..\Run: [BinaryData] "3D梯
O4 - HKLM\..\Run: [YLive.exe] C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
O4 - HKLM\..\Run: [NMGameX_AutoRun] C:\WINDOWS\system32\Rundll32.exe nmgamex.dll,LiveProcess /aa
O4 - HKLM\..\Run: [Update] C:\Program Files\Common Files\UPDATE\Update.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSCalsClocks] C:\Program Files\Microsoft Chinese Date & Time\ICalClk.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [DesktopSprite] D:\SnowFox\DesktopSprite2\DesktopSprite.exe
O8 - Extra context menu item: Customize Menu - file://D:\Siber systems\AI Roboform\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Fill Forms - file://D:\Siber systems\AI Roboform\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://D:\Siber systems\AI Roboform\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://D:\Siber systems\AI Roboform\RoboFormComSavePass.html
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\Tencent\qq\qq\qq\AddToNetDisk.htm
O8 - Extra context menu item: 使用彩信超级自写发送到手机 - http://mms.sina.com.cn/mmsnews.html
O8 - Extra context menu item: 使用影音传送带下载 - D:\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: 使用影音传送带下载全部链接 - D:\Xi\NetTransport 2\NTAddList.html
O8 - Extra context menu item: 使用新浪下载助手下载 - D:\sina\UC\UCddt\sinadl.htm
O8 - Extra context menu item: 使用超级解霸播放 - d:\Herosoft\Hero 9\MPURLGET.HTM
O8 - Extra context menu item: 使用迅雷下载 - d:\Thunder Network\Thunder\geturl.htm
O8 - Extra context menu item: 使用迅雷下载全部链接 - d:\Thunder Network\Thunder\getAllurl.htm
O8 - Extra context menu item: 发送图片到手机(&M) - http://sms.sina.com.cn/diy/send.html?from=467
O8 - Extra context menu item: 收藏此页到新浪ViVi - http://vivi.sina.com.cn/collect/click.php?agent=ddt
O8 - Extra context menu item: 新浪搜索 - http://cha.sina.com.cn/ddt.html
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Tencent\qq\qq\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Tencent\qq\qq\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Tencent\qq\qq\qq\SendMMS.htm
O9 - Extra button: 新浪UC - {2253922F-1B26-4C74-8B57-E3AEE748DBB8} - D:\sina\UC\UC.exe
O9 - Extra button: 填写表单 - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\Siber systems\AI Roboform\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: 填写表单 - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://D:\Siber systems\AI Roboform\RoboFormComFillForms.html
O9 - Extra button: 保存 - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\Siber systems\AI Roboform\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: 保存表单 - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://D:\Siber systems\AI Roboform\RoboFormComSavePass.html
O9 - Extra button: 豪杰超级解霸9 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - d:\Herosoft\Hero 9\STHSDVD.EXE
O9 - Extra 'Tools' menuitem: 豪杰超级解霸9 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - d:\Herosoft\Hero 9\STHSDVD.EXE
O9 - Extra button: (no name) - {6671A433-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\MMSASS~1\Mmsass~1.dll
O9 - Extra 'Tools' menuitem: MMSAssist工具条设置 - {6671A433-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\MMSASS~1\Mmsass~1.dll
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\Siber systems\AI Roboform\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm工具栏 - {724d43aa-0d85-11d4-9908-00400523e39a} - file://D:\Siber systems\AI Roboform\RoboFormComShowToolbar.html
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE (file missing)
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE (file missing)
O9 - Extra button: 新浪点点通 - {F60C7D81-8471-4D40-AAFE-56D318F34C2D} - D:\sina\UC\UCddt\DDTONG~1.DLL
O9 - Extra button: (no name) - {974AD624-EA50-4831-A6C0-3040F6665396} - D:\sina\UC\UCddt\rssband.dll (HKCU)
O9 - Extra 'Tools' menuitem: 新浪点点通阅读器 - {974AD624-EA50-4831-A6C0-3040F6665396} - D:\sina\UC\UCddt\rssband.dll (HKCU)
O9 - Extra button: 新浪点点通阅读器 - {F0646DC8-58CD-4C64-8F6B-525043914685} - D:\sina\UC\UCddt\rssband.dll (HKCU)
O11 - Options group: [!CNS]  上网助手-地址栏搜索
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - d:\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - D:\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\RISING\RAV\Ravmond.exe
O23 - Service: QQFace (Universal Disk Manager) - COMENET TECHNOLOGY - C:\Program Files\Common Files\SAND\qqfacerclient.exe
gototop
 
<<上一主题|下一主题>>
1   1  /  1  页   跳转页
页面顶部
Powered by Discuz!NT