谢谢了下面是日志
Logfile of HijackThis v1.99.1
Scan saved at 19:35:41, on 2006-7-16
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\Rising\Rav\CCenter.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Rising\Rav\Ravmond.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Rising\Rav\RavStub.exe
E:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
E:\WINDOWS\system32\inetsrv\inetinfo.exe
E:\Program Files\Common Files\Sogou PXP\p2psvr.exe
E:\Program Files\rising\Rfw\Rfw.exe
E:\Program Files\Rising\Rav\RavTask.exe
E:\Program Files\Rising\Rav\Ravmon.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Rising\Rav\Rav.exe
E:\Program Files\Rising\Rav\RsAgent.exe
E:\WINDOWS\msagent\AgentSvr.exe
E:\WINDOWS\system32\wuauclt.exe
E:\Program Files\Internet Explorer\iexplore.exe
F:\杀毒\hijackthis\HijackThis.exe
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: (no name) - {35980F6E-A137-4E50-953D-813BB8556899} - (no file)
O2 - BHO: CdnForIE Class - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - E:\PROGRA~1\CNNIC\Cdn\cdnforie.dll
O4 - HKLM\..\Run: [rfw] E:\Program Files\rising\Rfw\Rfw.exe
O4 - HKLM\..\Run: [NeroCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RavTask] "E:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [stup.exe] E:\PROGRA~1\TENCENT\Adplus\stup.exe
O4 - HKCU\..\Run: [ctfmon.exe] E:\WINDOWS\system32\ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: >>彩信发送<< - res://E:\PROGRA~1\MMSASS~1\Mmsass~1.dll/mms.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - F:\qq\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - F:\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - F:\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - F:\qq\SendMMS.htm
O8 - Extra context menu item: 用炫彩图铃发送该图片 - E:\Program Files\CaiShow Tech\CaiShow\SendMMS.htm
O8 - Extra context menu item: 访问通用网址 - E:\Program Files\CNNIC\Cdn\cnnic.htm
O9 - Extra button: 中文上网 - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - E:\PROGRA~1\CNNIC\Cdn\cdnforie.dll
O9 - Extra 'Tools' menuitem: 中文上网 - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - E:\PROGRA~1\CNNIC\Cdn\cdnforie.dll
O10 - Unknown file in Winsock LSP: e:\windows\system32\cdnns.dll
O11 - Options group: [CDNCLIENT] 中文上网
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O17 - HKLM\System\CCS\Services\Tcpip\..\{26D76812-236D-43B8-8AEA-DBFCF9700953}: NameServer = 61.153.177.200 61.153.177.198
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - E:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: P4P Service - Sohu.com Inc. - E:\Program Files\Common Files\Sogou PXP\p2psvr.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - E:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - E:\Program Files\Rising\Rav\Ravmond.exe
