HijackThis_zww汉化版扫描日志 V1.99.1
保存于      16:40:22, 日期 2005-8-11
操作系统：  Windows 2000 SP4 (WinNT 5.00.2195)
浏览器：    Internet Explorer v6.00 SP1 (6.00.2800.1106)

当前运行的进程：         
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\Ati2evxx.exe
C:\Program Files\ISS\BlackICE\blackd.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LxrJD31s.exe
d:\MATLAB701\webserver\bin\win32\matlabserver.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\niSvcLoc.exe
C:\Program Files\Panda Software\AVTC\PasSrv.exe
C:\Program Files\Panda Software\Panda Administrator 3\Pav_Agent\Pagent.exe
C:\Program Files\Panda Software\Panda Administrator 3\Pav_Agent\pagentwd.exe
C:\Program Files\Panda Software\Panda Administrator 3\Scheduler\pavsched.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\AVTC\PavSrv50.exe
C:\Program Files\Panda Software\AVTC\AVENGINE.EXE
C:\Program Files\Panda Software\AVTC\PsImSvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Raxco\PerfectDisk\PDSched.exe
C:\WINNT\SOUNDMAN.EXE
C:\WINNT\system32\spool\DRIVERS\W32X86\3\fpdisp5a.exe
C:\WINNT\system32\mobsync.exe
C:\Program Files\Panda Software\AVTC\ClShield.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINNT\system32\KVSer.exe
C:\WINNT\system32\SHELLEXT\EXPLORER.exe
C:\WINNT\system32\NTdhcp.exe
C:\WINNT\system32\ctfmon.exe
D:\Program Files\Internet Download Manager\idman.exe
C:\Program Files\ISS\BlackICE\blackice.exe
C:\Program Files\Panda Software\AVTC\SRVLOAD.EXE
C:\Program Files\Panda Software\AVTC\WebProxy.exe
C:\Program Files\Maxthon\Maxthon.exe
D:\Program Files\HijackThis1991汉化版\HijackThis1991zww.exe

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - IE工具栏增项: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - IE工具栏增项: (no name) - {F60C7D81-8471-4D40-AAFE-56D318F34C2D} - (no file)
O3 - IE工具栏增项: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - 启动项HKLM\\Run: [Synchronization Manager] mobsync.exe /logon
O4 - 启动项HKLM\\Run: [SoundMan] SOUNDMAN.EXE
O4 - 启动项HKLM\\Run: [FinePrint 分配器 v5] C:\WINNT\system32\spool\DRIVERS\W32X86\3\fpdisp5a.exe
O4 - 启动项HKLM\\Run: [realvloid] C:\WINNT\iexploade.exe
O4 - 启动项HKLM\\Run: [APVXDWIN] "C:\Program Files\Panda Software\AVTC\ClShield.exe"
O4 - 启动项HKLM\\Run: [DAEMON Tools-2052] "C:\Program Files\D-Tools\daemon.exe"  -lang 2052
O4 - 启动项HKLM\\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - 启动项HKLM\\Run: [ScanSoft PDF Professional 3.0-reminder] "C:\Program Files\ScanSoft\PDF Professional 3.0\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\ScanSoft\PDF Professional\3\Ereg\ereg.ini"
O4 - 启动项HKLM\\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - 启动项HKLM\\Run: [PDF3 Registry Controller] "D:\Program Files\ScanSoft\PDF Professional 3.0\\RegistryController.exe"
O4 - 启动项HKLM\\Run: [foxfock1] C:\WINNT\system32\KVSer.exe
O4 - 启动项HKLM\\Run: [EXPLORER] C:\WINNT\system32\SHELLEXT\EXPLORER.exe
O4 - 启动项HKLM\\Run: [NTdhcp] C:\WINNT\system32\NTdhcp.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [IDMan] D:\Program Files\Internet Download Manager\idman.exe /onboot
O4 - Global Startup: AutoCAD 启动加速器.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O4 - Global Startup: BlackICE Utility.lnk = C:\Program Files\ISS\BlackICE\blackice.exe
O8 - IE右键菜单中的新增项目: Google 搜索(&G) - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - IE右键菜单中的新增项目: Open with Scansoft PDF Converter 3.0 - res://D:\Program Files\ScanSoft\PDF Professional 3.0\IEShellExt.dll /100
O8 - IE右键菜单中的新增项目: 使用 IDM 下载    - D:\Program Files\Internet Download Manager\IEExt.htm
O8 - IE右键菜单中的新增项目: 使用 IDM 下载所有链接      - D:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - IE右键菜单中的新增项目: 反向链接 - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - IE右键菜单中的新增项目: 导出到 Microsoft Excel(&x) - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - IE右键菜单中的新增项目: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - IE右键菜单中的新增项目: 导出当前页到超星阅览器(&A) - C:\Program Files\SSREADER36\ss_all.htm
O8 - IE右键菜单中的新增项目: 导出选中部分到超星阅览器(&S) - C:\Program Files\SSREADER36\ss_select.htm
O8 - IE右键菜单中的新增项目: 类似网页 - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - IE右键菜单中的新增项目: 缓存的网页快照 - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - IE右键菜单中的新增项目: 翻译英文字词(&T) - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O9 - 浏览器额外的按钮: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O10 - 未知的文件在 Winsock LSP: c:\winnt\system32\idmmbc.dll
O10 - 未知的文件在 Winsock LSP: c:\winnt\system32\idmmbc.dll
O10 - 未知的文件在 Winsock LSP: c:\winnt\system32\idmmbc.dll
O10 - 未知的文件在 Winsock LSP: c:\winnt\system32\idmmbc.dll
O10 - 未知的文件在 Winsock LSP: c:\winnt\system32\idmmbc.dll
O16 - DPF: {098A3F72-3110-4004-B954-2F9DC44934B4} (AddSHCARoot Control) - http://www.sheca.com/AddSHCARootCert.cab
O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} (Edit Class) - https://www.nj1.cmbchina.com/download/CMBEdit.cab
O16 - DPF: {15DDE989-CD45-4561-BF99-D22C0D5C2B85} - http://vivi.sina.com.cn/control/vivi.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123742639304
O16 - DPF: {7FC22A16-79E6-4787-9C96-B6359BB1106D} (DigitalTrafic Control) - http://www.jt.sh.cn/trafficmap/jtj.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = shrcwc.org
O17 - HKLM\System\CCS\Services\Tcpip\..\{F908327F-89DE-48C5-8619-072EF61756D9}: NameServer = 211.95.1.123,202.96.209.5
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = shrcwc.org
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = shrcwc.org
O18 - 列举现有的协议: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O23 - NT 服务: Ati HotKey Poller - Unknown owner - C:\WINNT\system32\Ati2evxx.exe
O23 - NT 服务: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - NT 服务: BlackICE - Internet Security Systems, Inc. - C:\Program Files\ISS\BlackICE\blackd.exe
O23 - NT 服务: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - NT 服务: Lexar JD31 (LxrJD31s) - Unknown owner - C:\WINNT\SYSTEM32\LxrJD31s.exe
O23 - NT 服务: MATLAB Server (matlabserver) - Unknown owner - d:\MATLAB701\webserver\bin\win32\matlabserver.exe
O23 - NT 服务: NILM License manager - Macrovision Corporation - D:\Program Files\National Instruments\Shared\License Manager\Bin\lmgrd.exe
O23 - NT 服务: NI Service Locator (niSvcLoc) - National Instruments - C:\WINNT\system32\niSvcLoc.exe
O23 - NT 服务: Panda AntiSpam Server Service (PasSrv) - Unknown owner - C:\Program Files\Panda Software\AVTC\PasSrv.exe
O23 - NT 服务: Panda AdminSecure Communications Agent (PAVAGENTE) - Panda Software - C:\Program Files\Panda Software\Panda Administrator 3\Pav_Agent\Pagent.exe
O23 - NT 服务: Panda AdminSecure Scheduler (PavAtScheduler) - Panda Software - C:\Program Files\Panda Software\Panda Administrator 3\Scheduler\pavsched.exe
O23 - NT 服务: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - NT 服务: Panda Antivirus Report Service (PavReport) - Panda Software - C:\Program Files\Panda Software\Panda Administrator 3\PavReport\PavReport.exe
O23 - NT 服务: Panda Antivirus Service (PavSrv) - Panda Software - C:\Program Files\Panda Software\AVTC\PavSrv50.exe
O23 - NT 服务: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - NT 服务: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - NT 服务: Pml Driver HPZ12 - HP - C:\WINNT\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe
O23 - NT 服务: Panda IManager Service (PsImSvc) - Panda Software Internacional - C:\Program Files\Panda Software\AVTC\PsImSvc.exe
O23 - NT 服务: RapApp - Internet Security Systems, Inc. - C:\Program Files\ISS\BlackICE\rapapp.exe

引用:

【網事如夢的贴子】C:\WINNT\system32\SHELLEXT\EXPLORER.exe这项我觉得有问题！ ...........................

是的，我发现进程中有两个explorer，一个是explorer.exe，还有一个是EXPLORER.exe，我也很纳闷

引用:

【命运里の金色的贴子】请问你的电脑有什么问题? ...........................

有时出现桌面的图标和任务开始菜单栏只能原则其一，还有就是出现过开机时：

"0x00401237"指令引用的"0x00000000"内存。该内存不能为"read"

另外就是OE打不开了

引用:

【icesong的贴子】""0x00401237"指令引用的"0x00000000"内存。该内存不能为"read" " 这个问题楼主可以参见这里： http://forum.ikaka.com/topic.asp?board=28&artid=6537285 ...........................

谢谢！我已经看过了，MEMtest测下来也没问题，不知如何是好。

实在不清楚"0x00401237"是什么内容

引用:

【網事如夢的贴子】 请楼主好好看看EXPLORER里面的是字母o还是数字0 ...........................

确认过了，是字母O，而不是数字0