以下是启动项扫描报告:
启动项报告： 2006/08/10, 17:54:18
启动项扫描器版本： 1.52.2
开始于： C:\Documents and Settings\Administrator\桌面\Hijackthis1991zww\HijackThis1991zww.EXE
系统检测： Windows XP SP2 (WinNT 5.01.2600)
系统检测： Internet Explorer v6.00 SP2 (6.00.2900.2180)
* 使用默认选项
==================================================
当前运行的进程：
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rising\Rav\Ravmond.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Rising\Rav\Ravmon.exe
d:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\桌面\Hijackthis1991zww\HijackThis1991zww.exe
--------------------------------------------------
Checking Windows NT UserInit:
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,
--------------------------------------------------
注册表中的启动项:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
RavTask = "C:\Program Files\Rising\Rav\RavTask.exe" -system
--------------------------------------------------
注册表中的启动项:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
RavStub = "C:\Program Files\Rising\Rav\ravstub.exe" /RUNONCE
--------------------------------------------------
注册表中的启动项:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
--------------------------------------------------
Load/Run keys from C:\WINDOWS\WIN.INI:
load=* 未找到INI相关项目值 *
run=* 未找到INI相关项目值 *
Load/Run keys from Registry:
HKLM\..\Windows NT\CurrentVersion\WinLogon: load=* 未找到相关注册表键值 *
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=* 未找到相关注册表键值 *
HKLM\..\Windows\CurrentVersion\WinLogon: load=* 未找到相关注册表键值 *
HKLM\..\Windows\CurrentVersion\WinLogon: run=* 未找到相关注册表键值 *
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=* 未找到相关注册表键值 *
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=* 未找到相关注册表键值 *
HKCU\..\Windows\CurrentVersion\WinLogon: load=* 未找到相关注册表键值 *
HKCU\..\Windows\CurrentVersion\WinLogon: run=* 未找到相关注册表键值 *
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=
HKLM\..\Windows NT\CurrentVersion\Windows: load=
HKLM\..\Windows NT\CurrentVersion\Windows: run=
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=
--------------------------------------------------
外壳扩展和屏幕保护程序的键值 从 C:\WINDOWS\SYSTEM.INI:
Shell=* 未找到INI相关项目值 *
SCRNSAVE.EXE=* 未找到INI相关项目值 *
drivers=* 未找到INI相关项目值 *
外壳扩展和屏幕保护程序的键值 从 注册表
Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\system32\sstext3d.scr
drivers=* 未找到相关注册表键值 *
Policies Shell key:
HKCU\..\Policies: Shell=* 未找到相关注册表键值 *
HKLM\..\Policies: Shell=* 未找到相关注册表键值 *
--------------------------------------------------
列举IE浏览器辅助对象(BHO模块):
WebThunderBHO - C:\Program Files\Thunder Network\WebThunder\WebThunderBHO_011.dll - {00000AAA-A363-466E-BEF5-9BB68697AA7F}
ThunderIEHelper - C:\WINDOWS\system32\xunleibho_v14.dll - {0005A87D-D626-4B3A-84F9-1D9571695F55}
CAISHOW TOOLBAR - (no file) - {3AF40CB8-B3BA-4E2D-8968-4BF8DB172997}
(no name) - (no file) - {64990116-A9CC-4828-A90E-3613F71F1C62}
(no name) - (no file) - {6E28339B-7A2A-47B6-AEB2-46BA53782379}?
(no name) - (no file) - {77FEF28E-EB96-44FF-B511-3185DEA48697}?
ThunderBHO - d:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll - {889D2FEB-5411-4565-8998-1DD2C5261283}
(no name) - (no file) - {9E1E1371-9D8F-4421-81B9-F8D2E1773A59}?
--------------------------------------------------
列举下载的程序文件：
[JITDSign Control]
InProcServer32 = C:\WINDOWS\system32\JITDSign.ocx
CODEBASE = https://218.22.18.205:7002/JITDSign.cab
[SysMonOCX Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\SYSMON~1.OCX
CODEBASE = http://www.ahn.com.cn/aspservice/plugin/myfirewall20.cab
[Shockwave Flash
Object]
InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
--------------------------------------------------
列举 ShellService
ObjectDelayLoad 项目：
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\st
object.dll
--------------------------------------------------
报告完毕，共 5,542 字节
报告生成用时：0.150秒
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
