HijackThis@Qoo的扫描日志 V1.97.7
Scan saved at 23:27:03, on 2006-5-30
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
D:\网络应用\瑞星\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
D:\网络应用\瑞星\Rising\Rav\Ravmond.exe
d:\网络应用\瑞星\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
D:\网络应用\瑞星\Rising\Rav\RavStub.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
D:\网络应用\瑞星\Rising\Rav\RavTask.exe
d:\网络应用\瑞星\rising\rfw\RfwMain.exe
D:\网络应用\瑞星\Rising\Rav\Ravmon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ctfmon.exe
D:\网络应用\傲游\Maxthon\Maxthon.exe
D:\网络应用\qq\QQ.exe
D:\网络应用\qq\TIMPlatform.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\conime.exe
C:\PROGRA~1\THUNDE~1\WEBTHU~1\WEBTHU~1.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\xinlei\LOCALS~1\Temp\Rar$EX00.406\HijackThis.exe
O2 - BHO: WebThunderBHO - {00000AAA-A363-466E-BEF5-9BB68697AA7F} - C:\Program Files\Thunder Network\WebThunder\WebThunderBHO_010.dll
O2 - BHO: ThunderIEHelper - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v14.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\
O2 - BHO: (no name) - {2EF14E3B-45CE-45d6-913E-7AA65331A933} - C:\WINDOWS\DTSVC\DTS\DTS.dll
O2 - BHO: (no name) - {A9930D97-9CF0-42A0-A10D-4F28836579D5} - D:\
O4 - HKLM\..\Run: [RavTask] "D:\
O4 - HKLM\..\Run: [RfwMain] "D:\
O4 - HKLM\..\Run: [SoundMan] ; SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] ; RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CHotkey] ; mHotkey.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMSCMig] ; C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - HKLM\..\Run: [NeroFilterCheck] ; C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvMediaCenter] ; RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] ; nwiz.exe /install
O4 - HKLM\..\Run: [PHIME2002A] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [PHIME2002ASync] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PLoader] ; c:\program files\umsd\umsd.exe sys_auto_run C:\Program Files\UMSD
O4 - HKLM\..\Run: [StormCodec_Helper] ; "D:\
O4 - HKLM\..\Run: [WangWang] ; "D:\
O4 - HKCU\..\Run: [ctfmon.exe] ; C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [eMuleAutoStart] ; D:\
O4 - Startup: NTUSER.DAT
O4 - Startup: ntuser.dat.LOG
O4 - Startup: ntuser.ini
O4 - Global Startup: ntuser.dat
O4 - Global Startup: ntuser.dat.LOG
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\
O8 - Extra context menu item: 使用FlashExplorer播放 - C:\Program Files\FlashExplorer\IELink.htm
O8 - Extra context menu item: 使用KuGoo3下载(&K) - D:\
O8 - Extra context menu item: 使用Web迅雷下载 - C:\Program Files\Thunder Network\WebThunder\GetUrl.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://D:\
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\
O8 - Extra context menu item: 添加到QQ表情 - D:\
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (CEditCtrl
Object) - https://img.alipay.com/download/1007/aliedit.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash
Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0D09FBA3-1474-4A9E-9CB4-B1BE9F62C52B}: NameServer = 202.106.0.20 202.106.46.151
O17 - HKLM\System\CS1\Services\Tcpip\..\{0D09FBA3-1474-4A9E-9CB4-B1BE9F62C52B}: NameServer = 202.106.0.20 202.106.46.151
楼上的大哥。。。 我真的不懂 嘿嘿 慢慢学
