HijackThis@Qoo的扫描日志 V1.97.7
Scan saved at 20:14:01, on 2005-9-12
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\ibmpmsvc.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\mnmsrvc.exe
C:\WINNT\System32\QCONSVC.EXE
C:\WINNT\system32\regsvc.exe
F:\SOFTWARE FILES\VIRUS SOFTWARE\RISING\RAV\CCENTER.EXE
F:\SOFTWARE FILES\VIRUS SOFTWARE\RISING\RAV\Ravmond.exe
C:\WINNT\system32\MSTask.exe
F:\SOFTWARE FILES\VIRUS SOFTWARE\RISING\RAV\RavStub.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINNT\system32\TpKmpSVC.exe
C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
C:\WINNT\system32\drivers\WDelMgr20.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
F:\SOFTWA~2\VIRUSS~1\RISING\RAV\RAVTIMER.EXE
F:\SOFTWA~2\VIRUSS~1\RISING\RAV\RAVMON.EXE
C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
C:\WINNT\system32\TpShocks.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\PROGRA~1\ThinkPad\CONNEC~1\QCWLIcon.exe
C:\PROGRA~1\ThinkPad\CONNEC~1\QCTray.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
F:\SoftWare Files\file software\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\WINNT\system32\internat.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
C:\Program Files\MSN Messenger\MSNShell\BIN\MSNShell.exe
C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
F:\SoftWare Files\internet software\Thunder\Thunder.exe
C:\Program Files\Google\Web Accelerator\googlewebaccclient.exe
c:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
F:\SoftWare Files\internet software\Thunder\MediaIssue\Issue.exe
F:\SoftWare Files\internet software\Thunder\TDUpdate.exe
C:\WINNT\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
F:\SoftWare Files\mvmu software\Winamp\Winamp.exe
C:\Documents and Settings\Administrator\桌面\HijackThis.exe
O2 - BHO: (no name) - {00000000-6CB0-410C-8C3D-8FA8D2011D0A} - F:\SoftWare Files\file software\iMesh5\iMeshBHO.dll
O2 - BHO: (no name) - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINNT\system32\xunleibho_v5.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - F:\SoftWare Files\internet software\qq\QQIEHelper.dll
O2 - BHO: Google Web Accelerator Helper - {69A87B7D-DE56-4136-9655-716BA50C19C7} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - F:\SOFTWA~2\INTERN~1\FLASHGET\jccatch.dll
O2 - BHO: (no name) - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - F:\SoftWare Files\internet software\NetTransport 2\NTIEHelper.dll
O3 - Toolbar: ????? - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - F:\SOFTWA~2\INTERN~1\FLASHGET\fgiebar.dll
O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O4 - HKLM\..\Run: [RavTimer] F:\SOFTWA~2\VIRUSS~1\RISING\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [RavMon] F:\SOFTWA~2\VIRUSS~1\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [Windows Update System Shell] svhostcs32.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [QCWLIcon] C:\PROGRA~1\ThinkPad\CONNEC~1\QCWLIcon.exe
O4 - HKLM\..\Run: [QCTray] C:\PROGRA~1\ThinkPad\CONNEC~1\QCTray.exe
O4 - HKLM\..\Run: [DataLayer] c:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] F:\SoftWare Files\file software\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [TPKMAPMN] C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
O4 - HKCU\..\Run: [MSNShell] C:\Program Files\MSN Messenger\MSNShell\BIN\MSNShell.exe autorun
O4 - Startup: NTUSER.DAT
O4 - Startup: ntuser.dat.LOG
O4 - Startup: ntuser.ini
O4 - Startup: sqlnet.log
O4 - Global Startup: ntuser.pol
O4 - Global Startup: ntuser.dat
O4 - Global Startup: ntuser.dat.LOG
O4 - Global Startup: Nokia PC Suite 6.60.16.LOG
O4 - Global Startup: Nokia Connectivity Cable Driver 1.00.150.2.LOG
O8 - Extra context menu item: &使用迅雷下载 - F:\SoftWare Files\internet software\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - F:\SoftWare Files\internet software\Thunder\getAllurl.htm
O8 - Extra context menu item: 使用影音传送带下载 - F:\SoftWare Files\internet software\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: 使用影音传送带下载全部链接 - F:\SoftWare Files\internet software\NetTransport 2\NTAddList.html
O8 - Extra context menu item: 使用网际快车下载 - F:\SoftWare Files\internet software\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - F:\SoftWare Files\internet software\FlashGet\jc_all.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - F:\SoftWare Files\internet software\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - F:\SoftWare Files\internet software\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - F:\SoftWare Files\internet software\qq\SendMMS.htm
O9 - Extra button: kele8 (HKLM)
O9 - Extra 'Tools' menuitem: kele8 (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: QQ (HKLM)
O9 - Extra button: FlashGet (HKLM)
O9 - Extra 'Tools' menuitem: &FlashGet (HKLM)
