HijackThis_zww汉化版扫描日志 V1.99.1
保存于 10:15:30, 日期 2005-9-9
操作系统： Windows 2000 SP4 (WinNT 5.00.2195)
浏览器： Internet Explorer v6.00 SP1 (6.00.2800.1106)
当前运行的进程：
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
D:\瑞星\Rising\Rfw\rfwsrv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\nvsvc32.exe
C:\PROGRA~1\北京通信\宽带E~1\app\pppoeservice.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
D:\瑞星\Rising\Rfw\RfwMain.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\瑞星\RAV\RAVTIMER.EXE
C:\WINNT\system32\internat.exe
C:\Downloads\HijackThis1991zww.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\SPYBOT~1\SDHelper.dll
O4 - 启动项HKLM\\Run: [Synchronization Manager] mobsync.exe /logon
O4 - 启动项HKLM\\Run: [AdbusUpdate] ; C:\WINNT\system32\adbus\update.exe
O4 - 启动项HKLM\\Run: [hcuninstall] C:\WINNT\system32\1113556311pigUinstl.exe
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - 启动项HKLM\\Run: [StormCodec_Helper] "D:\Storm Codec\StormSet.exe" /S /opti
O4 - 启动项HKLM\\Run: [RfwMain] "D:\瑞星\Rising\Rfw\rfwmain.exe" -Startup
O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - 启动项HKLM\\Run: [RavTimer] D:\瑞星\RAV\RAVTIMER.EXE
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Startup: VP-EYE.lnk = C:\VP-EYE\control\vpeyev1.exe
O4 - Startup: 腾讯QQ.lnk = D:\qq\QQ.exe
O4 - Global Startup: Microsoft Office.lnk = D:\office\Office\OSA9.EXE
O9 - 浏览器额外的按钮: 易趣购物 - {DE60714F-AC17-427e-861A-FD60CBDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=1 (file missing)
O9 - 浏览器额外的“工具”菜单项: 易趣购物 - {DE60714F-AC17-427e-861A-FD60CBDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=1 (file missing)
O18 - 列举现有的协议: mbox - {7DEE9D05-FA0A-4416-A6F3-6537D0EAB6A6} - C:\WINNT\system32\mbprot.dll
O20 - Winlogon Notify: nwprovau - C:\WINNT\SYSTEM32\nwprovau.dll
O23 - NT 服务: bahbnb - Unknown owner - \\61.49.181.15\E$\vbrun6nt.exe" -service (file missing)
O23 - NT 服务: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - NT 服务: htboy - Unknown owner - \\61.49.181.155\D$\vbrun6nt.exe" -service (file missing)
O23 - NT 服务: jeaaq - Unknown owner - \\61.49.180.202\E$\fensvc32.exe" -service (file missing)
O23 - NT 服务: lzzmu - Unknown owner - \\61.49.181.246\E$\vbrun6nt.exe" -service (file missing)
O23 - NT 服务: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - NT 服务: nzpyuh - Unknown owner - \\61.51.93.112\E$\vbrun6nt.exe" -service (file missing)
O23 - NT 服务: PPPoE Service (PPPoEService) - Unknown owner - C:\PROGRA~1\北京通信\宽带E~1\app\pppoeservice.exe
O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - D:\瑞星\Rising\Rfw\rfwsrv.exe
O23 - NT 服务: rnpgy - Unknown owner - \\61.49.181.155\E$\fnesvc32.exe" -service (file missing)
O23 - NT 服务: Remote Administrator Service (r_server) - Unknown owner - C:\WINNT\system\svchast.exe" /service (file missing)
O23 - NT 服务: yhrngkx - Unknown owner - \\61.51.92.162\E$\fnesvc32.exe" -service (file missing)
O23 - NT 服务: yjxifso - Unknown owner - \\61.49.105.54\D$\vcvhost.exe" -service (file missing)
O23 - NT 服务: zzbfu - Unknown owner - \\61.49.105.10\E$\vbrun6nt.exe" -service (file missing)
下边这几个是什么东西啊？
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\MSTask.exe
O4 - 启动项HKLM\\Run: [Synchronization Manager] mobsync.exe /logon
O4 - 启动项HKLM\\Run: [AdbusUpdate] ; C:\WINNT\system32\adbus\update.exe
O4 - 启动项HKLM\\Run: [hcuninstall] C:\WINNT\system32\1113556311pigUinstl.exe
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
下面这几个已经删除了，可开机扫描还是有，该怎么彻底干掉它啊？
O4 - 启动项HKLM\\Run: [hcuninstall] C:\WINNT\system32\1113556311pigUinstl.exe
O4 - Startup: VP-EYE.lnk = C:\VP-EYE\control\vpeyev1.exe
O9 - 浏览器额外的按钮: 易趣购物 - {DE60714F-AC17-427e-861A-FD60CBDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=1 (file missing)
O9 - 浏览器额外的“工具”菜单项: 易趣购物 - {DE60714F-AC17-427e-861A-FD60CBDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=1 (file missing)
