其中一个是http://tl.bestlm.net/adnewslm/sms.php?partner_id=sw88_angly
HijackThis@Qoo的扫描日志 V1.97.7
Scan saved at 23:49:22, on 2005-9-12
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
H:\PAV杀毒\Ravmond.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\nvsvc32.exe
H:\PAV杀毒\CCENTER.EXE
D:\WINDOWS\system32\svchost.exe
H:\PAV杀毒\RAVTIMER.EXE
H:\PAV杀毒\RAVMON.EXE
D:\WINDOWS\system32\rundll32.exe
D:\WINDOWS\system32\ctfmon.exe
H:\QQ2005\QQ.exe
H:\QQ2005\TIMPlatform.exe
D:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Program Files\Internet Explorer\IEXPLORE.EXE
F:\hijackthis1.97_qoo\HijackThis.exe
O2 - BHO: (no name) - {0005A87D-D626-4B3A-84F9-1D9571695F55} - D:\WINDOWS\system32
\xunleibho_v4.dll
O2 - BHO: AssistII - {BB936323-19FA-4521-BA29-ECA6A121BC78} - D:\PROGRA~1\3721
\Assist\asbar.dll
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - D:\WINDOWS\downlo~1\CnsHook.dll
O3 - Toolbar: ????? - {BB936323-19FA-4521-BA29-ECA6A121BC78} - D:\PROGRA~1\3721
\Assist\asbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef
/Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RavTimer] H:\PAV
O4 - HKLM\..\Run: [RavMon] H:\PAV
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CnsMin] Rundll32.exe D:\WINDOWS\downlo~1\CnsMin.dll,Rundll32
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32
\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [helper.dll] D:\WINDOWS\system32\rundll32.exe D:\PROGRA~1\3721
\helper.dll,Rundll32
O4 - HKLM\..\Run: [StormCodec_Helper] "H:\
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - Startup: NTUSER.DAT
O4 - Startup: NTUSER.DAT.LOG
O4 - Startup: ntuser.ini
O4 - Startup: 请稍候comment.htt
O4 - Startup: 请稍候desktop.ini
O4 - Startup: 视频源comment.htt
O4 - Startup: 视频源desktop.ini
O4 - Global Startup: ntuser.dat
O4 - Global Startup: ntuser.dat.LOG
O11 - Options group: [!CNS]
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash
Object) -
http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{91BC9147-5B3F-48BF-823C-25CEA87CBC71}: NameServer = *****(我的IP)
