HijackThis_zww汉化版扫描日志 V1.99.1
保存于 7:54:36, 日期 2005-5-9
操作系统： Windows XP SP1 (WinNT 5.01.2600)
浏览器： Internet Explorer v6.00 SP1 (6.00.2800.1106)
当前运行的进程：
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\rising\Rav\Ravmond.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\rising\Rav\RavStub.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\rising\Rav\RavTask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\rising\AntiSpyware\runiep.exe
C:\WINDOWS\shualai.exe
C:\Program Files\rising\Rav\RavMon.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\tcsafe.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\cmd.exe
C:\WINDOWS\System32\conime.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Deepdo\DeepdoBar\Favorite\Update.exe
C:\DOCUME~1\zhy1\LOCALS~1\Temp\Rar$EX04.594\HijackThis1991zww.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: ThunderIEHelper - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\System32\xunleibho_v11.dll
O2 - BHO: (no name) - {5B02EBA1-EFDD-477D-A37F-05383165C9C0} - (no file)
O2 - BHO: AdPutHelper.AdHelper - {631EDC67-F035-49BA-B8BC-983B474E9BB4} - C:\WINDOWS\System32\AdPutHelper.dll
O2 - BHO: (no name) - {85ECAFCC-BDD9-5B03-97A8-FA65CBE8809A} - C:\WINDOWS\system32\1234.ini (file missing)
O2 - BHO: ChinaBuy Class - {85FAEA13-9C62-4917-8571-B35C563A1943} - C:\WINDOWS\System32\buyunion.dll
O2 - BHO: Advance Helper - {8E25AC4A-B129-451B-BEE2-3B510BB751DA} - C:\WINDOWS\System32\NTDLL32.dll
O2 - BHO: Fav Manager - {CD8BFE70-5809-4C73-9EEE-E5672C2B79D7} - C:\Program Files\Deepdo\DeepdoBar\Favorite\FavBlock.dll
O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - IE工具栏增项: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\System32\kakatool.dll
O4 - 启动项HKLM\\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - 启动项HKLM\\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - 启动项HKLM\\Run: [SoundMan] SOUNDMAN.EXE
O4 - 启动项HKLM\\Run: [RavTask] "C:\Program Files\rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [dl_accel] rem C:\Program Files\3721\Dlaccel\YDownloader.exe
O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - 启动项HKLM\\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - 启动项HKLM\\Run: [runeip] C:\Program Files\rising\AntiSpyware\runiep.exe
O4 - 启动项HKLM\\Run: [cmdbcs] C:\WINDOWS\cmdbcs.exe
O4 - 启动项HKLM\\Run: [mppds] C:\WINDOWS\mppds.exe
O4 - 启动项HKLM\\Run: [msccrt] C:\WINDOWS\msccrt.exe
O4 - 启动项HKLM\\Run: [testrun] C:\WINDOWS\testexe.exe
O4 - 启动项HKLM\\Run: [shualai] C:\WINDOWS\shualai.exe /i
O4 - HKCU\..\Run: [y8g0cujtqf] C:\DOCUME~1\zhy1\LOCALS~1\Temp\crasos.exe
O4 - HKCU\..\Run: [t9grru737yhe29] C:\DOCUME~1\zhy1\LOCALS~1\Temp\c0nime.exe
O8 - IE右键菜单中的新增项目: Mail to a Friend... - http://client.alexa.com/holiday/script/actions/mailto.htm
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - E:\Program Files\Tencent\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - E:\Program Files\Tencent\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - E:\Program Files\Tencent\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - E:\Program Files\Tencent\SendMMS.htm
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: _{B2900CC6-9736-4AF5-8B98-FFFCBBDD46D8} - http://110dj.com/sz/RealPlayer.ocx
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5EC7C511-CD0F-42E6-830C-1BD9882F3458} (PowerPlayer Control) - http://vod.keepc.com/download/powerplayer.cab
O16 - DPF: {7FC751A9-492D-41B1-9F8D-D2C8809D8907} (EmoWebInstallerCtl Class) - http://img.365ren.com/tv/cabs/EmoWebInstaller.cab
O16 - DPF: {ACFE8232-03C5-4AEC-AF5E-42B806724096} (KSHScan Control) - http://safe.qq.com/scan/KAllScan.CAB
O16 - DPF: {B83FC273-3522-4CC6-92EC-75CC86678DA4} - http://download.3721.com/download/CnsMin.cab
O16 - DPF: {CF051549-EDE1-40F5-B440-BCD646CF2C25} (Ppinstall Control) - http://popo.163.com/install/ppinstall2.cab
O16 - DPF: {E847C78C-C210-4195-8799-FBF3BF89797D} (金山毒霸在线产品升级) - http://www.duba.net/cab/KOSInit.cab
O16 - DPF: {FE70C9C0-FB4D-4225-A50D-F967EC8FC54A} (Hqext Control) - http://www.yataioa.com/hqext.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{84212EDB-FEB3-42E8-8EF5-32E7173A9FAA}: NameServer = 202.98.0.68,202.98.5.68
O18 - 列举现有的协议: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
O23 - NT 服务: gqyuiopa (gqyuiop) - Unknown owner - C:\WINDOWS\System32\1.exe
O23 - NT 服务: Rising Personal FireWall Main Program (Rising Personal FireWall Main PrRising Personal FireWall Main Program) - Unknown owner - C:\WINDOWS\System32\tcsafe.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\rising\Rav\CCenter.exe
O23 - NT 服务: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\rising\Rav\Ravmond.exe
O23 - NT 服务: Windows_SystemDown (WindowsDown) - Unknown owner - C:\WINDOWS\System32\servet.exe
O23 - NT 服务: Windows Accounts Driver (windows_0) - Unknown owner - C:\WINDOWS\System32\1.exe
O23 - NT 服务: WinWLServiceNow - Unknown owner - C:\DOCUME~1\zhy1\LOCALS~1\Temp\RAVWL.EXE
