HijackThis_zww汉化版扫描日志 V1.99.1
保存于      19:28:18, 日期 2006-5-12
操作系统：  Windows XP SP2 (WinNT 5.01.2600)
浏览器：    Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程：         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rising\Rav\Ravmond.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\IME\dllhost.exe
C:\WINDOWS\system32\drivers\services.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\COMM\Network.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
F:\5迅雷\Thunder.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
E:\马\HijackThis1991zww.exe

R3 - URLSearchHook: 虎翼DIY吧! - {0A00D11E-B1E7-44b5-AD88-C9190876AAC4} - C:\WINDOWS\system32\diybar2\diybar2.dll
O2 - BHO: ThunderIEHelper - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v14.dll
O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll
O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll
O2 - BHO: Link Filter - {4022F902-ABC7-4C79-924F-BB26F1D355A2} - C:\WINDOWS\system32\diybar2\diybar2.dll
O2 - BHO: IEYHlprObj Class - {5C761D09-377E-4EAC-ADA1-C9CDE39B5674} - C:\WINDOWS\IEYHelper.dll
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL
O2 - BHO: std software - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - C:\WINDOWS\SYSTEM32\stdup.dll
O2 - BHO: estAliveObj Class - {A2B7A0F0-B697-4A71-8D91-43443F57D7BB} - C:\WINDOWS\estAlive.dll
O2 - BHO: DownloadBHO T2BHO - {B1D147E7-873E-4909-8127-695D9BB78728} - C:\WINDOWS\Downloaded Program Files\CONFLICT.3\barhelp24.0.dll
O2 - BHO: XBTP05119 - {E87AF1BA-66FE-45d9-81AA-BC1CB2D2D257} - C:\WINDOWS\DOWNLO~1\tbu1E\bysoo.dll
O4 - 启动项HKLM\\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - 启动项HKLM\\Run: [C-Media Speaker Configuration] G:\SOUND\SOUND\1060100000200\WIN2K_XP\Setup.exe /SPEAKER
O4 - 启动项HKLM\\Run: [SoundMan] SOUNDMAN.EXE
O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - 启动项HKLM\\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime
O4 - 启动项HKLM\\Run: [YLive.exe] C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
O4 - 启动项HKLM\\Run: [yassistse] "C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"
O4 - 启动项HKLM\\Run: [Update] C:\Program Files\Common Files\UPDATE\Update.exe
O4 - 启动项HKLM\\Run: [SearchNet_Up] "C:\Program Files\SearchNet\ServeUp.exe"
O4 - 启动项HKLM\\Run: [PigUpdate] C:\DOCUME~1\MAGUAN~1\LOCALS~1\Temp\is-A5H9G.tmp\DownLoadPig.exe
O4 - 启动项HKLM\\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - 启动项HKLM\\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - 启动项HKLM\\Run: [real_sl] C:\WINDOWS\system\svchost.exe
O4 - 启动项HKLM\\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - IE右键菜单中的新增项目: &使用迅雷下载 - F:\5迅雷\geturl.htm
O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - F:\5迅雷\getallurl.htm
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - E:\连中\qq\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - E:\连中\qq\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - E:\连中\qq\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - E:\连中\qq\SendMMS.htm
O9 - 浏览器额外的按钮: (no name) - {3F686D91-4AFA-4ed1-B43F-F1DB46ED480C} - C:\WINDOWS\system32\shdocvw.dll
O9 - 浏览器额外的“工具”菜单项: Link Filter - {3F686D91-4AFA-4ed1-B43F-F1DB46ED480C} - C:\WINDOWS\system32\shdocvw.dll
O9 - 浏览器额外的按钮: Bysoo Toolbar - {77FBF9B8-1D37-4FF2-9CED-192D8E3ABA6F} - C:\WINDOWS\Downloaded Program Files\tbu1E\bysoo.dll
O9 - 浏览器额外的“工具”菜单项: Bysoo Toolbar - {77FBF9B8-1D37-4FF2-9CED-192D8E3ABA6F} - C:\WINDOWS\Downloaded Program Files\tbu1E\bysoo.dll
O9 - 浏览器额外的按钮: 比较购物搜索 - {A36ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\WINDOWS\YayaBands.dll
O9 - 浏览器额外的“工具”菜单项: The AskYaya VerticalBar - {A36ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\WINDOWS\YayaBands.dll
O9 - 浏览器额外的按钮: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - 浏览器额外的“工具”菜单项: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - IE插件，支持文件类型.pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {164B406B-0FD6-4E7F-BA7E-64D227D4CA37} (dnlplayer Class) - http://www.digitalwebbooks.com/reader/dbplugin.cab
O16 - DPF: {28E0FA88-ABA8-4937-A247-3031F1A11165} (Installer Class) - http://pi.51.net/download/diybar2.cab
O16 - DPF: {3D812B3C-B008-4A21-ACF0-9E3389ACE6E5} (PopKart Control) - http://popkart.tiancity.com/homepage/js/PopKartX.cab
O16 - DPF: {3D8F74EE-8692-4F8F-B8D2-7522E732519E} (WebActivater Control) - http://game.qq.com/QQGame2.cab
O16 - DPF: {3F618E1F-D981-4905-A757-4D237441B5B3} (GolfInstallCheck2 Class) - http://download.ourgame.com/GolfInstallCheck2.cab
O16 - DPF: {5EC7C511-CD0F-42E6-830C-1BD9882F3458} (PowerPlayer Control) - http://www.ppstream.com/bin/powerplayer.cab
O16 - DPF: {75DB194D-86A1-4475-B44A-28501AF66EEA} (FlashPlayer8 Control) - http://download.xhd.cn/FlashPlayer8.cab
O16 - DPF: {A927C078-E82F-471B-83F5-3D1504F7D01B} (estInsObj Class) - http://info.askyaya.com/estAlive.cab
O16 - DPF: {D0A29C6C-AA71-4423-8C4A-5998B774C448} (IEDown Class) - http://download.ourgame.com/IEDown4.cab
O16 - DPF: {DECEAAA2-370A-49BB-9362-68C3A58DDC62} (SAIX) - http://static.zangocash.com/cab/Seekmo/ie/bridge-c15.cab?a0dbba5079a7604e4c93f4ab8f2582a5854f3a49c786c57500b463da4ed0c12aeffcd5d5e34f57ce9695b84fb9dfe7e7348cac9fd26416455c00170142:f5bc481adedbecd5174fbce3a1105f83
O16 - DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} (pCastPanel Class) - http://ps.itv.mop.com/dn/files/pCastCtl_1.0.0.80_20060123.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{170D4A4E-FB61-4C11-8D30-152307090405}: NameServer = 219.146.0.130 219.150.32.132
O17 - HKLM\System\CS1\Services\Tcpip\..\{170D4A4E-FB61-4C11-8D30-152307090405}: NameServer = 219.146.0.130 219.150.32.132
O23 - NT 服务: .Net Boot Service - Unknown owner - C:\WINDOWS\system32\big5_gb2312.exe (file missing)
O23 - NT 服务: hpdj - Unknown owner - C:\DOCUME~1\MAGUAN~1\LOCALS~1\Temp\hpdj.exe (file missing)
O23 - NT 服务: Remote Log - Unknown owner - C:\WINDOWS\system32\ServeHost.exe (file missing)
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
O23 - NT 服务: Network System (Universal Disk Manager) - COMENET TECHNOLOGY - C:\Program Files\Common Files\COMM\Network.exe

结束进程C:\Program Files\Common Files\COMM\Network.exe

修复：
R3 - URLSearchHook: 虎翼DIY吧! - {0A00D11E-B1E7-44b5-AD88-C9190876AAC4} - C:\WINDOWS\system32\diybar2\diybar2.dll
O2 - BHO: Link Filter - {4022F902-ABC7-4C79-924F-BB26F1D355A2} - C:\WINDOWS\system32\diybar2\diybar2.dll
O2 - BHO: IEYHlprObj Class - {5C761D09-377E-4EAC-ADA1-C9CDE39B5674} - C:\WINDOWS\IEYHelper.dll
O2 - BHO: std software - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - C:\WINDOWS\SYSTEM32\stdup.dll
O2 - BHO: estAliveObj Class - {A2B7A0F0-B697-4A71-8D91-43443F57D7BB} - C:\WINDOWS\estAlive.dll
O2 - BHO: DownloadBHO T2BHO - {B1D147E7-873E-4909-8127-695D9BB78728} - C:\WINDOWS\Downloaded Program Files\CONFLICT.3\barhelp24.0.dll
O2 - BHO: XBTP05119 - {E87AF1BA-66FE-45d9-81AA-BC1CB2D2D257} - C:\WINDOWS\DOWNLO~1\tbu1E\bysoo.dll
O4 - 启动项HKLM\\Run: [Update] C:\Program Files\Common Files\UPDATE\Update.exe
O4 - 启动项HKLM\\Run: [SearchNet_Up] "C:\Program Files\SearchNet\ServeUp.exe"
O4 - 启动项HKLM\\Run: [PigUpdate] C:\DOCUME~1\MAGUAN~1\LOCALS~1\Temp\is-A5H9G.tmp\DownLoadPig.exe
O4 - 启动项HKLM\\Run: [real_sl] C:\WINDOWS\system\svchost.exe
O23 - NT 服务: .Net Boot Service - Unknown owner - C:\WINDOWS\system32\big5_gb2312.exe (file missing)
O23 - NT 服务: hpdj - Unknown owner - C:\DOCUME~1\MAGUAN~1\LOCALS~1\Temp\hpdj.exe (file missing)
O23 - NT 服务: Remote Log - Unknown owner - C:\WINDOWS\system32\ServeHost.exe (file missing)
O23 - NT 服务: Network System (Universal Disk Manager) - COMENET TECHNOLOGY - C:\Program Files\Common Files\COMM\Network.exe

重启后删除：
C:\Program Files\Common Files\COMM\
C:\WINDOWS\system32\diybar2\
C:\WINDOWS\IEYHelper.dll
C:\WINDOWS\SYSTEM32\stdup.dll
C:\WINDOWS\system\svchost.exe
在安全模式下：
清空C:\WINDOWS\Downloaded Program Files\文件夹
清空C:\DOCUME~1\MAGUAN~1\LOCALS~1\Temp\文件夹

其中：
C:\WINDOWS\SYSTEM32\stdup.dll的详细处理参考http://forum.ikaka.com/topic.asp?board=28&artid=7971417


C:\Program Files\SearchNet\是中搜流氓软件，一般很难卸载，建议参考：
1、重启进入安全模式
2、在注册表中删除如下注册表项目（用HijackThis修复后可能已经没了）：

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

SearchNet_Up --> ["C:\Program Files\SearchNet\ServeUp.exe"]

CdnCtr --> ["C:\Program Files\SearchNet\ServeUp.exe"]

3、重启到安全模式下运行searchnet目录中的uninstall,输入其验证码，则删除了该目录中的文件（除UNINSTALL外）

4、再删除uninstall,接着删SEARCHNET目录。

5、删除如下文件：
C:\WINDOWS\system32\ServeHost.exe
C:\WINDOWS\system32\SeedServ.exe
6、重启回到正常模式，使用防毒软件对系统进行全盘扫描。

按1楼操作后这个文件夹也要干掉
C:\Program Files\Common Files\UPDATE\

引用:

【yanmings的贴子】按1楼操作后这个文件夹也要干掉 C:\Program Files\Common Files\UPDATE\ ...........................

呵呵，不好意思，列举删除的文件时不小心漏掉了，多谢补充。

谢谢