HijackThis_815汉化版扫描日志 V1.99.1
保存于 16:14:27, 日期 2006-11-6
操作系统： Windows XP SP2 (WinNT 5.01.2600)
浏览器： Internet Explorer v6.00 SP2 (6.00.2900.2180)
当前运行的进程：
C:\WINDOWS1\System32\smss.exe
C:\WINDOWS1\system32\winlogon.exe
C:\WINDOWS1\system32\services.exe
C:\WINDOWS1\system32\lsass.exe
C:\WINDOWS1\system32\svchost.exe
C:\WINDOWS1\system32\svchost.exe
C:\WINDOWS1\Explorer.EXE
C:\WINDOWS1\system32\ctfmon.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\WINDOWS1\system32\conime.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\FUC516~1.ADJ\LOCALS~1\Temp\Rar$EX00.782\HijackThis1991zww.exe
R3 - URLSearchHook: SrchHook Class - {6E1BC898-505A-44f4-BC88-BCE43016AC96} - C:\WINDOWS1\system32\BarSea.dll
O2 - BHO: (no name) - {29A8B48F-9AB3-43D3-8B87-7D1888197563} - C:\WINDOWS1\system32\ATIDEMGRED.dll
O2 - BHO: SYM - {36BF6929-DCBC-4CCD-A620-C5E3BBA77B95} - C:\WINDOWS1\system32\usercrd.dll (file missing)
O2 - BHO: Windows Shell - {5772085A-B7F2-4380-BD99-1778988E96A7} - C:\WINDOWS1\system32\atmfd32.dll
O2 - BHO: (no name) - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - (no file)
O2 - BHO: SrchHook Class - {6E1BC898-505A-44f4-BC88-BCE43016AC96} - C:\WINDOWS1\system32\BarSea.dll
O2 - BHO: (no name) - {75FE2B5A-D3A4-4EFA-AC11-ADC9C9459688} - (no file)
O2 - BHO: (no name) - {9C363D55-07D7-433d-A13E-D9C105202F6F} - (no file)
O2 - BHO: (no name) - {AF3876B1-7D5F-4F0F-BECA-A6324D125A48} - C:\WINDOWS1\system32\ATIDEMGREDEM.dll
O2 - BHO: bingo - {B626AE7E-4F5D-4CD4-B457-D8693015DEFC} - C:\WINDOWS1\system32\amvda.dll
O2 - BHO: (no name) - {EAACBF9E-4B91-45FF-93ED-B297093951EA} - (no file)
O2 - BHO: (no name) - {FE32DECF-06AD-426E-9F53-3018A366B5AE} - (no file)
O3 - IE工具栏增项: (no name) - {F869BB38-FFEF-4589-B986-610B7AD0ADA2}? - (no file)
O3 - IE工具栏增项: (no name) - {FBFF8F98-AE9D-4599-975E-E9B31E88EF04}? - (no file)
O3 - IE工具栏增项: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS1\system32\kakatool.dll
O4 - 启动项HKLM\\Run: [Antiy Auto Update] C:\Program Files\Antiy Labs\Alive\AliveCenter.exe
O4 - 启动项HKLM\\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - 启动项HKLM\\RunServices: [_mzu_stonedrv2] c:\windows1\system32\_mzu_stonedrv2.exe
O4 - 启动项HKLM\\RunOnce: [ANetFox ADClean] "C:\Program Files\Windows 流氓软件清理大师\clean.exe" /autokill:96
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS1\system32\ctfmon.exe
O4 - Startup: 381C8E.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - IE右键菜单中的新增项目: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - 浏览器额外的按钮: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6}? - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - 浏览器额外的“工具”菜单项: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6}? - C:\Program
Files\Tencent\QQ\QQIEHelper.dll
O14 - IERESET.INF: START_PAGE_URL=
about:blank
O16 - DPF: {414E7D87-8073-4EFB-9E4B-C8DF04C979EE} (PortalCom AAA 1.0) - http://218.2.135.36/PortalAX02.cab
O16 - DPF: {52DF16E3-6C4F-4B22-8BAF-09263E463B48} (金山毒霸在线产品升级) - http://www.duba.net/cab/KOSInit.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = asia.jcdecaux.org
O17 - HKLM\Software\..\Telephony: DomainName = asia.jcdecaux.org
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = asia.jcdecaux.org
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = asia.jcdecaux.org
O17 - HKLM\System\CS4\Services\Tcpip\Parameters: Domain = asia.jcdecaux.org
O18 - 列举现有的协议: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - 列举现有的协议: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - NT 服务: Antiy live update (Alive Auto-Update Service) - Unknown owner - C:\Program Files\Antiy
Labs\Alive\AliveCenter.exe
O23 - NT 服务: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS1\system32\Ati2evxx.exe
O23 - NT 服务: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec
Shared\ccPwdSvc.exe
O23 - NT 服务: EpsonBidirectionalService - Unknown owner - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - NT 服务: KSD2Service - Unknown owner - C:\WINDOWS1\system32\WINL0GON.exe
O23 - NT 服务: Network Logons (NetWorkLogons) - Unknown owner - rundll32.exe (file missing)
O23 - NT 服务: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - NT 服务: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
