HijackThis_zww汉化版扫描日志 V1.99.1
保存于 16:00:04, 日期 2006-9-27
操作系统： Windows XP SP2 (WinNT 5.01.2600)
浏览器： Internet Explorer v6.00 SP2 (6.00.2900.2180)
当前运行的进程：
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rising\Rav\Ravmond.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CEZEO software\LanTalk XP\LanTalk.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\hi jackthis\HijackThis1991汉化版\HijackThis1991zww.exe
C:\WINDOWS\system32\NOTEPAD.EXE
R3 - 默认的URLSearchHook丢失。用HijackThis修复
O3 - IE工具栏增项: 东方快车 - {3EA85E14-887D-4E2F-91E2-3158CE58ED62} - C:\Program Files\!Sunv\DFKC2003\IEBand.DLL
O4 - 启动项HKLM\\Run: [LanTalk] "C:\Program Files\CEZEO software\LanTalk XP\LanTalk.exe"
O4 - 启动项HKLM\\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: desktop.ini
O4 - Global Startup: desktop.ini
O8 - IE右键菜单中的新增项目: 东方快车-保存翻译后的网页 - C:\Program Files\!Sunv\DFKC2003\ExtSave.htm
O9 - 浏览器额外的按钮: 东方快车 - {0B66EBA4-5F53-40e4-B17B-A0E9BC1E8D50} - C:\Program Files\!Sunv\DFKC2003\IEBand.DLL
O9 - 浏览器额外的按钮: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - 浏览器额外的“工具”菜单项: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'c:\windows\system32\cdnns.dll' missing
O15 - “受信任的站点”中添加项: http://www.icbc.com.cn
O16 - DPF: {05C1004E-2596-48E5-8E26-39362985EEB9} (MMCPlayer Class) - http://p3p.sogou.com/MMCShell.cab
O16 - DPF: {0EB487C8-E9AC-43A6-8C4C-083999B0622F} (InfosecCertInstall Class) - https://mybank.icbc.com.cn/icbc/perbank/certInStall.dll
O16 - DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} (AxSubmitControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O16 - DPF: {DA215190-98B2-47DE-AE24-DA95481DFFBA} (AxUSBKey Class) - https://mybank.icbc.com.cn/icbc/perbank/AxUSBKey.CAB
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = spl.com
O17 - HKLM\Software\..\Telephony: DomainName = spl.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{7412A458-BED5-4958-A12F-E03C4A94A7E3}: NameServer = 192.16.8.50
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = spl.com
O17 - HKLM\System\CS1\Services\Tcpip\..\{7412A458-BED5-4958-A12F-E03C4A94A7E3}: NameServer = 192.16.8.50
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = spl.com
O17 - HKLM\System\CS2\Services\Tcpip\..\{7412A458-BED5-4958-A12F-E03C4A94A7E3}: NameServer = 192.16.8.50
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = spl.com
O17 - HKLM\System\CS3\Services\Tcpip\..\{7412A458-BED5-4958-A12F-E03C4A94A7E3}: NameServer = 192.16.8.50
O18 - 列举现有的协议: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\Mshtml.dll
O18 - 列举现有的协议: cdl - {3DD53D40-7B8B-11D0-B013-00AA0059CE02} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll
O18 - 列举现有的协议: file - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: ftp - {79EAC9E3-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: gopher - {79EAC9E4-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: http - {79EAC9E2-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: https - {79EAC9E5-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: ipp - (no CLSID) - (no file)
O18 - 列举现有的协议: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll
O18 - 列举现有的协议: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\Mshtml.dll
O18 - 列举现有的协议: local - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: mailto - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\Mshtml.dll
O18 - 列举现有的协议: mhtml - {05300401-BCBC-11D0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll
O18 - 列举现有的协议: mk - {79EAC9E6-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll
O18 - 列举现有的协议: msdaipp - (no CLSID) - (no file)
O18 - 列举现有的协议: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\Mshtml.dll
O18 - 列举现有的协议: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\Mshtml.dll
O18 - 列举现有的协议: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll
O18 - 列举现有的协议: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\Mshtml.dll
O18 - 列举现有的协议: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll
O20 - Winlogon Notify: App Paths - C:\WINDOWS\system32\o284lclq1fqe.dll (file missing)
O20 - Winlogon Notify: Dynamic Directory - C:\WINDOWS\system32\wgavusd.dll (file missing)
O20 - Winlogon Notify: ShellCompatibility - C:\WINDOWS\system32\wfcsvc.dll (file missing)
O23 - NT 服务: Runtime Optimization Service (clr_Optimization_v2.1.51706_32) - Unknown owner - C:\WINDOWS\system32\wincer.exe (file missing)
O23 - NT 服务: Command Service (cmdService) - Unknown owner - C:\WINDOWS\bXh5\command.exe (file missing)
O23 - NT 服务: GrayPigeonServer - Unknown owner - C:\WINDOWS\G_Server2006.exe (file missing)
O23 - NT 服务: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
