HijackThis_zww汉化版扫描日志 V1.99.1
保存于      8:16:43, 日期 2006-3-21
操作系统：  Windows XP SP2 (WinNT 5.01.2600)
浏览器：    Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程：         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rising\Rav\Ravmond.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\Program Files\InterBase Corp\InterBase\Bin\ibguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\RDPSSW32.EXE
C:\Program Files\InterBase Corp\InterBase\Bin\ibserver.exe
C:\WINDOWS\System32\BeTwinServiceXP.exe
c:\program files\rising\rfw\RfwMain.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\Buddy\BeTwinAssistant.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Buddy\BeTwinMessages.exe
C:\WINDOWS\system32\CTFMON.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\taskmgr.exe
D:\TDDownload\2535952005811174944\HijackThis1991zww.exe

F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: ThunderIEHelper - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v14.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: wmpdrm - {0E674588-66B7-4E19-9D0E-2053B800F69F} - C:\WINDOWS\system32\wmpdrm.dll
O2 - BHO: MyIEHelper Class - {16A770A0-0E87-4278-B748-2460D64A8386} - C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\IEHelper_8033.dll
O2 - BHO: MEobjectSDT - {4136C3F6-7636-49bf-A122-D4DA53B1ADDF} - C:\WINDOWS\system32\shwasobj.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - E:\QQ\QQIEHelper.dll
O2 - BHO: NewWeb Controller - {9ACEEE30-143F-471A-AA45-72B061FE7D60} - C:\WINDOWS\system32\AdvSC32.dll
O3 - IE工具栏增项: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll
O4 - 启动项HKLM\\Run: [VTTimer] VTTimer.exe
O4 - 启动项HKLM\\Run: [VTTrayp] VTtrayp.exe
O4 - 启动项HKLM\\Run: [BeTwinAssistant] "C:\Program Files\Buddy\BeTwinAssistant.exe"
O4 - 启动项HKLM\\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - 启动项HKLM\\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - 启动项HKLM\\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - 启动项HKLM\\Run: [BeTwinMessages] "C:\Program Files\Buddy\BeTwinMessages.exe"
O4 - 启动项HKLM\\Run: [spoolsv] C:\WINDOWS\system32\spoolsv\spoolsv.exe -printer
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - E:\QQ\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - E:\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - E:\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - E:\QQ\SendMMS.htm
O9 - 浏览器额外的按钮: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\OFFICE~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1136629685859
O17 - HKLM\System\CCS\Services\Tcpip\..\{EAE83952-73D2-473D-BA14-64366BB335C6}: NameServer = 202.96.134.133,202.96.128.68
O20 - Winlogon Notify: BeTwinNotify - C:\WINDOWS\SYSTEM32\BeTwinNotify.dll
O23 - NT 服务: InterBase Guardian (InterBaseGuardian) - InterBase Software Corp. - C:\Program Files\InterBase Corp\InterBase\Bin\ibguard.exe
O23 - NT 服务: InterBase Server (InterBaseServer) - InterBase Software Corp. - C:\Program Files\InterBase Corp\InterBase\Bin\ibserver.exe
O23 - NT 服务: RDPSSW32 - Unknown owner - C:\WINDOWS\System32\RDPSSW32.EXE
O23 - NT 服务: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe
O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
O23 - NT 服务: Buddy 终端服务 (TermService) - ThinSoft Pte Ltd. - C:\WINDOWS\System32\BeTwinServiceXP.exe
CPU占用100%晕

【回复“lcjstar”的帖子】
结束C:\WINDOWS\System32\RDPSSW32.EXE进程

修复
O2 - BHO: wmpdrm - {0E674588-66B7-4E19-9D0E-2053B800F69F} - C:\WINDOWS\system32\wmpdrm.dll
O2 - BHO: MyIEHelper Class - {16A770A0-0E87-4278-B748-2460D64A8386} - C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\IEHelper_8033.dll
O2 - BHO: MEobjectSDT - {4136C3F6-7636-49bf-A122-D4DA53B1ADDF} - C:\WINDOWS\system32\shwasobj.dll
O2 - BHO: NewWeb Controller - {9ACEEE30-143F-471A-AA45-72B061FE7D60} - C:\WINDOWS\system32\AdvSC32.dll
O4 - 启动项HKLM\\Run: [spoolsv] C:\WINDOWS\system32\spoolsv\spoolsv.exe -printer
O20 - Winlogon Notify: BeTwinNotify - C:\WINDOWS\SYSTEM32\BeTwinNotify.dll
O23 - NT 服务: RDPSSW32 - Unknown owner - C:\WINDOWS\System32\RDPSSW32.EXE

若存在C:\WINDOWS\system32\msibm\
双击C:\WINDOWS\system32\msibm\下的uninstall程序
卸载清除C:\WINDOWS\system32\msibm\

删除
C:\WINDOWS\system32\msibm\（若存在的话）
C:\WINDOWS\system32\msicn\（若存在的话）
C:\WINDOWS\system32\spoolsv\
C:\WINDOWS\system32\wmpdrm.dll
C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\IEHelper_8033.dll
C:\WINDOWS\system32\shwasobj.dll
C:\WINDOWS\system32\AdvSC32.dll
C:\WINDOWS\SYSTEM32\BeTwinNotify.dll
C:\WINDOWS\System32\RDPSSW32.EXE

进入注册表
删除如下服务在注册表中的相关信息
O23 - NT 服务: RDPSSW32 - Unknown owner - C:\WINDOWS\System32\RDPSSW32.EXE

提示：
若正常模式下无法解决
建议进入安全模式下操作