HijackThis_zww汉化版扫描日志 V1.99.1<br>保存于      18:16:03, 日期 2006-4-5<br>操作系统：  Windows XP SP1 (WinNT 5.01.2600)<br>浏览器：    Internet Explorer v6.00 SP1 (6.00.2800.1106)<br><br>当前运行的进程：          <br>C:\WINDOWS\System32\smss.exe<br>C:\WINDOWS\system32\csrss.exe<br>C:\WINDOWS\system32\winlogon.exe<br>C:\WINDOWS\system32\services.exe<br>C:\WINDOWS\system32\lsass.exe<br>C:\WINDOWS\system32\svchost.exe<br>C:\WINDOWS\System32\svchost.exe<br>C:\WINDOWS\System32\svchost.exe<br>C:\WINDOWS\System32\svchost.exe<br>C:\WINDOWS\explorer.exe<br>C:\WINDOWS\system32\spoolsv.exe<br>C:\Program Files\Rising\Rav\RavTask.exe<br>C:\WINDOWS\smss.exe<br>C:\Program Files\Common Files\Real\Update_OB\realsched.exe<br>C:\WINDOWS\System32\ctfmon.exe<br>C:\Program Files\Tencent\QQ\QQ.exe<br>C:\Program Files\SkyNet\FireWall\PFW.exe<br>C:\Program Files\Tencent\QQ\TIMPlatform.exe<br>C:\WINDOWS\System32\alg.exe<br>C:\WINDOWS\System32\nvsvc32.exe<br>C:\WINDOWS\System32\svchost.exe<br>C:\WINDOWS\System32\conime.exe<br>D:\汉化版扫描日志\HijackThis1991汉化版\HijackThis1991zww.exe<br><br>R3 - URLSearchHook: QQ Search Hook - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - C:\Program Files\TENCENT\AdPlus\IEHelp.dll (file missing)<br>F2 - REG:system.ini: Shell=explorer.exe 1<br>F2 - REG:system.ini: UserInit=userinit.exe,<br>O2 - BHO: Tencent Browser Helper - {0C7C23EF-A848-485B-873C-0ED954731014} - (no file)<br>O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yphtb.dll (file missing)<br>O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\Program Files\Tencent\QQ\QQIEHelper.dll<br>O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\assist\YDRAGS~1.DLL (file missing)<br>O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FLASHGET\jccatch.dll<br>O2 - BHO: (no name) - {A9930D97-9CF0-42A0-A10D-4F28836579D5} - F:\酷狗\KuGoo3\KuGoo3DownXControl.ocx<br>O2 - BHO: IEMoni Class - {F236CC5A-F6E4-4011-9EED-C52FDF51CE3D} - C:\WINDOWS\system32\Sbhoplin.dll<br>O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx<br>O3 - IE工具栏增项: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll<br>O3 - IE工具栏增项: BitCometBar - {3F1ABCDB-A875-46c1-8345-B72A4567E486} - D:\BT下载器\BitComet\BitCometBar\BitCometBar0.2.dll<br>O4 - 启动项HKLM\\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup<br>O4 - 启动项HKLM\\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system<br>O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup<br>O4 - 启动项HKLM\\Run: [TProgram] C:\WINDOWS\smss.exe<br>O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot<br>O4 - 启动项HKLM\\Run: [KuGoo3] F:\酷狗\KuGoo3\KuGoo.exe<br>O4 - 启动项HKLM\\Run: [AddrPlus3] C:\PROGRA~1\TENCENT\Adplus\stup.exe C:\PROGRA~1\TENCENT\Adplus\Adplus.dll Rundll32<br>O4 - 启动项HKLM\\Run: [] regedit -s C:\$NtUninstallQ5926809$\sp4custom.dll<br>O4 - 启动项HKLM\\Run: [3721] C:\$NtUninstallQ5926809$\3721.bat<br>O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe<br>O4 - HKCU\..\Run: [] regedit -s C:\$NtUninstallQ5926809$\sp4custom.dll<br>O4 - HKCU\..\Run: [3721] C:\$NtUninstallQ5926809$\3721.bat<br>O4 - Startup: 腾讯QQ.lnk = C:\Program Files\Tencent\QQ\QQ.exe<br>O4 - Global Startup: 天网防火墙个人版.lnk = C:\Program Files\SkyNet\FireWall\PFW.exe<br>O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present<br>O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm<br>O8 - IE右键菜单中的新增项目: 使用KuGoo3下载(&K) - F:\酷狗\KuGoo3\KuGoo3DownX.htm<br>O8 - IE右键菜单中的新增项目: 使用网际快车下载 - C:\PROGRA~1\FLASHGET\jc_link.htm<br>O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链接 - C:\PROGRA~1\FLASHGET\jc_all.htm<br>O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm<br>O8 - IE右键菜单中的新增项目: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm<br>O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm<br>O9 - 浏览器额外的按钮: kele8 - {84920E5F-3788-49cd-A274-E365578DF174} - http://www.kele8.com/ (file missing)<br>O9 - 浏览器额外的“工具”菜单项: kele8 - {84920E5F-3788-49cd-A274-E365578DF174} - http://www.kele8.com/ (file missing)<br>O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm<br>O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm<br>O9 - 浏览器额外的按钮: XXX {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE<br>O9 - 浏览器额外的“工具”菜单项: 腾讯XXX {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE<br>O9 - 浏览器额外的按钮: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe<br>O9 - 浏览器额外的“工具”菜单项: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe<br>O9 - 浏览器额外的按钮: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll<br>O9 - 浏览器额外的“工具”菜单项: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll<br>O11 - Options group: [TBH]  QQ地址栏搜索插件<br>O16 - DPF: {ABA7CC7F-019D-47DB-A0D2-B3C2B3AC1B44} (Fc2Boot Class) - http://fun.kele8.com/fun/system/fc2boot.cab<;br>O17 - HKLM\System\CCS\Services\Tcpip\..\{147B160B-5900-4D85-9A00-4BA2F1B4152D}: NameServer = 202.103.224.68 202.103.225.68<br>O17 - HKLM\System\CCS\Services\Tcpip\..\{47B3C511-9FF6-4708-B8CB-8010202374EF}: NameServer = 202.103.224.68<br>O20 - AppInit_DLLs: KB494002.LOG<br>O21 - SSODL: DLMon - {590498A3-4131-4D8F-BA4B-36791A0803B1} - C:\WINDOWS\System32\DLMain.dll<br>O23 - NT 服务: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe<br>O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Unknown owner - c:\program files\rising\rfw\rfwsrv.exe<br>O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe<br>O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe<br><br>

结束下列进程：
C:\WINDOWS\smss.exe
修复下列项目：
F2 - REG:system.ini: Shell=explorer.exe 1
O2 - BHO: IEMoni Class - {F236CC5A-F6E4-4011-9EED-C52FDF51CE3D} - C:\WINDOWS\system32\Sbhoplin.dll
O4 - 启动项HKLM\\Run: [TProgram] C:\WINDOWS\smss.exe
O4 - 启动项HKLM\\Run: [] regedit -s C:\$NtUninstallQ5926809$\sp4custom.dll
O4 - 启动项HKLM\\Run: [3721] C:\$NtUninstallQ5926809$\3721.bat
O4 - HKCU\..\Run: [] regedit -s C:\$NtUninstallQ5926809$\sp4custom.dll
O4 - HKCU\..\Run: [3721] C:\$NtUninstallQ5926809$\3721.bat
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O20 - AppInit_DLLs: KB494002.LOG
O21 - SSODL: DLMon - {590498A3-4131-4D8F-BA4B-36791A0803B1} - C:\WINDOWS\System32\DLMain.dll
删除文件：
C:\WINDOWS\smss.exe
C:\WINDOWS\system32\Sbhoplin.dll
C:\$NtUninstallQ5926809$\整个目录
KB494002.LOG
C:\WINDOWS\System32\DLMain.dll