Logfile of HijackThis v1.99.1
Scan saved at 18:29:43, on 2009-10-29
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\360safe\deepscan\zhudongfangyu.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\360safe\safemon\360Tray.exe
C:\Program Files\USB Modem\AccessRunner ADSL USB\CnxDslTb.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Tencent\QQ\Bin\QQ.exe
D:\Program Files\Tencent\QQ\Bin\TXPlatform.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Program Files\Tencent\QQMusic\QzoneMusic.exe
C:\Program Files\WinRAR\WinRAR.exe
D:\Program Files\Rising\Rav\RavMonD.exe
D:\Program Files\Rising\Rav\RsTray.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.062\极品飞车 9 最高通缉中文版 _369.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\3dsMax9\QQDownload.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.297\HijackThis.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Program Files\果果桌面秀\Rainmeter.exe
O1 - Hosts: 218.75.159.150
www.kzdh.comO1 - Hosts: 218.75.159.150
www.6781.comO1 - Hosts: 218.75.159.150
www.v2233.comO1 - Hosts: 218.75.159.150
www.iq123.comO1 - Hosts: 218.75.159.150
www.i2345.cnO1 - Hosts: 218.75.159.150
www.haokan123.comO1 - Hosts: 218.75.159.150
www.365wz.netO1 - Hosts: 218.75.159.150
www.5d5e.comO1 - Hosts: 218.75.159.150
www.112r.comO1 - Hosts: 218.75.159.150
www.32e.comO1 - Hosts: 218.75.159.150
www.77177.comO1 - Hosts: 218.75.159.150
www.daluobo.cnO1 - Hosts: 218.75.159.150
www.haha111.comO1 - Hosts: 218.75.159.150
www.haoz123.cnO1 - Hosts: 218.75.159.150
www.85vv.comO1 - Hosts: 218.75.159.150
www.ok100.net.cnO1 - Hosts: 218.75.159.150
www.ai1234.comO1 - Hosts: 218.75.159.150
www.15wz.comO1 - Hosts: 218.75.159.150
www.fm5566.comO1 - Hosts: 218.75.159.150
www.9798.netO1 - Hosts: 218.75.159.150
www.s565.comO1 - Hosts: 218.75.159.150
www.345s.comO1 - Hosts: 218.75.159.150
www.110wz.comO1 - Hosts: 218.75.159.150
www.6dh.comO1 - Hosts: 218.75.159.150
www.tt98.comO1 - Hosts: 218.75.159.150
www.85851.comO1 - Hosts: 218.75.159.150
www.66d8.cnO1 - Hosts: 218.75.159.150
www.baihu.cnO1 - Hosts: 218.75.159.150
www.hang123.comO1 - Hosts: 218.75.159.150
www.17909.comO1 - Hosts: 218.75.159.150
www.838.ccO1 - Hosts: 218.75.159.150
www.ee258.comO1 - Hosts: 218.75.159.150
www.gjj.ccO2 - BHO: QQCycloneHelper - {00000000-12C9-4305-82F9-43058F20E8D2} - D:\3dsMax9\QQIEHelper01.dll
O2 - BHO: Thunder AtOnce - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - C:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll
O2 - BHO: QQ工具栏 - {29CF293A-1E7D-4069-9E11-E39698D0AF95} - C:\Program Files\Tencent\QQToolbar\IEBar.dll
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll
O2 - BHO: SafeMon Class - {B69F34DD-F0F9-42DC-9EDD-957187DA688D} - C:\Program Files\360safe\safemon\safemon.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [360Safetray] "C:\Program Files\360safe\safemon\360Tray.exe" /start
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\USB Modem\AccessRunner ADSL USB\CnxDslTb.exe" "USB Modem\AccessRunner ADSL USB"
O4 - HKLM\..\Run: [qqlive] "E:\3GP转换器\QQLiveOneClick.exe" -system_startup
O4 - HKLM\..\Run: [RavTray] "D:\Program Files\Rising\Rav\RsTray.exe" -system
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [QQ2009] "D:\Program Files\Tencent\QQ\Bin\QQ.exe" /background
O4 - HKCU\..\Run: [QQDownload] "D:\3dsMax9\QQDownload.exe" autostart
O4 - Startup: QQ游戏启动加速程序.lnk = ?
O8 - Extra context menu item: &使用QQ旋风下载 - D:\3dsMax9\geturl.htm
O8 - Extra context menu item: &使用QQ旋风下载全部链接 - D:\3dsMax9\getAllurl.htm
O8 - Extra context menu item: 使用迅雷下载 - C:\Program Files\Thunder\Program\geturl.htm
O8 - Extra context menu item: 使用迅雷下载全部链接 - C:\Program Files\Thunder\Program\getallurl.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ表情 - D:\Program Files\Tencent\QQ\Bin\AddEmotion.htm
O8 - Extra context menu item: 百度一下所选文字 (&B) - C:\Program Files\Common Files\Baidu\Baidu.html
O8 - Extra context menu item: 百度一下所选文字 (&S) - C:\Program Files\Common Files\baidu\Baidu.html
O9 - Extra button: 浩方电竞平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - C:\Program Files\Holdfast\platform 5.0\gameclient.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (EditCtrl Class) -
https://img.alipay.com/download/2121/aliedit.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{0CFC3822-7C54-463C-97AA-2D40654937BD}: NameServer = 202.102.134.68 202.102.128.68
O17 - HKLM\System\CS2\Services\Tcpip\..\{0CFC3822-7C54-463C-97AA-2D40654937BD}: NameServer = 202.102.134.68 202.102.128.68
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Rav Service (RsRavMon) - Beijing Rising Information Technology Co., Ltd. - D:\Program Files\Rising\Rav\RavMonD.exe
O23 - Service: Tencent Software Update Service (TSUSVC) - Unknown owner - C:\Program Files\Tencent\QQSoftMgr\1.0.298.203\\TencentUpdateSvc.exe" -run (file missing)
O23 - Service: 主动防御 (ZhuDongFangYu) - 360安全中心 - C:\Program Files\360safe\deepscan\zhudongfangyu.exe
用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; QQDownload 590; SV1)
