启动项报告： 2006-11-23, 22:38:31
启动项扫描器版本： 1.52.2
开始于： D:\系统工具\HB_Hijackthis\HijackThis1991汉化版\HijackThis1991zww.EXE
系统检测： Windows XP SP1 (WinNT 5.01.2600)
系统检测： Internet Explorer v6.00 SP1 (6.00.2800.1106)
* 使用默认选项
==================================================
当前运行的进程：
D:\系统工具\HB_Hijackthis\HijackThis1991汉化版\HijackThis1991zww.exe
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS.0\Explorer.EXE
C:\WINDOWS.0\System32\rundll32.exe
C:\WINDOWS.0\System32\ctfmon.exe
C:\Program Files\Stardock\
ObjectDock\
ObjectDock.exe
C:\WINDOWS.0\System32\nvsvc32.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS.0\system32\spoolsv.exe
C:\Program Files\Winamp\Winamp.exe
D:\Program Files\Tencent\qq\QQ.exe
D:\Program Files\Tencent\qq\TIMPlatform.exe
C:\Documents and Settings\Rin\My Documents\杂货专用箱\HA-LeapFTP274602-yfy\HA-LeapFTP2.7.4.602-yfy\LeapFTP.exe
C:\Program Files\eMule\eMule.exe
D:\系统工具\HB_Hijackthis\HijackThis1991汉化版\HijackThis1991zww.exe
--------------------------------------------------
文件夹中的启动项
Shell folders Startup:
[C:\Documents and Settings\Rin\「开始」菜单\程序\启动]
ObjectDock.lnk = C:\Program Files\Stardock\
ObjectDock\
ObjectDock.exe
--------------------------------------------------
Checking Windows NT UserInit:
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS.0\system32\userinit.exe,
--------------------------------------------------
注册表中的启动项:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
NvCplDaemon = RUNDLL32.EXE C:\WINDOWS.0\System32\NvCpl.dll,NvStartup
--------------------------------------------------
注册表中的启动项:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
ctfmon.exe = C:\WINDOWS.0\System32\ctfmon.exe
--------------------------------------------------
文件打开方式关联 for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command
(黙认) = C:\WINDOWS.0\NOTEPAD.EXE %1
--------------------------------------------------
Load/Run keys from C:\WINDOWS.0\WIN.INI:
load=* 未找到INI相关项目值 *
run=* 未找到INI相关项目值 *
Load/Run keys from Registry:
HKLM\..\Windows NT\CurrentVersion\WinLogon: load=* 未找到相关注册表键值 *
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=* 未找到相关注册表键值 *
HKLM\..\Windows\CurrentVersion\WinLogon: load=* 未找到相关注册表键值 *
HKLM\..\Windows\CurrentVersion\WinLogon: run=* 未找到相关注册表键值 *
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=* 未找到相关注册表键值 *
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=* 未找到相关注册表键值 *
HKCU\..\Windows\CurrentVersion\WinLogon: load=* 未找到相关注册表键值 *
HKCU\..\Windows\CurrentVersion\WinLogon: run=* 未找到相关注册表键值 *
HKCU\..\Windows NT\CurrentVersion\Windows: load=* 未找到相关注册表键值 *
HKCU\..\Windows NT\CurrentVersion\Windows: run=* 未找到相关注册表键值 *
HKLM\..\Windows NT\CurrentVersion\Windows: load=* 未找到相关注册表键值 *
HKLM\..\Windows NT\CurrentVersion\Windows: run=* 未找到相关注册表键值 *
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=
--------------------------------------------------
外壳扩展和屏幕保护程序的键值 从 C:\WINDOWS.0\SYSTEM.INI:
Shell=* 未找到INI相关项目值 *
SCRNSAVE.EXE=* 未找到INI相关项目值 *
drivers=* 未找到INI相关项目值 *
外壳扩展和屏幕保护程序的键值 从 注册表
Shell=Explorer.exe
SCRNSAVE.EXE=* 未找到相关注册表键值 *
drivers=* 未找到相关注册表键值 *
Policies Shell key:
HKCU\..\Policies: Shell=* 未找到相关注册表键值 *
HKLM\..\Policies: Shell=* 未找到相关注册表键值 *
--------------------------------------------------
列举IE浏览器辅助对象(BHO模块):
(no name) - D:\Program Files\Tencent\QQ\QQIEHelper.dll - {54EBD53A-9BC1-480B-966A-843A333CA162}
(no name) - C:\PROGRA~1\FLASHGET\jccatch.dll - {A5366673-E8CA-11D3-9CD9-0090271D075B}
--------------------------------------------------
列举下载的程序文件：
[NetmarbleStarter23 Class]
InProcServer32 = C:\WINDOWS.0\Downloaded Program Files\NMStarter23.dll
CODEBASE = http://download.netmarble.com/web/nmstarter/NMStarter23.cab
[ctl4RA Class]
InProcServer32 = C:\WINDOWS.0\System32\PRINTC~1.DLL
CODEBASE = http://www.95599.cn/ra/printCtl.cab
[Nexon Package Manager Control]
InProcServer32 = C:\WINDOWS.0\nxpm.ocx
CODEBASE = http://file.nx.com/activex/public_new/nxpm.cab
[CEditCtrl
Object]
InProcServer32 = C:\WINDOWS.0\System32\aliedit\AliEdit.dll
CODEBASE = https://img.alipay.com/download/1007/aliedit.cab
[CCtInf Class]
InProcServer32 = C:\WINDOWS.0\System32\BANKCE~1.DLL
CODEBASE = http://www.95599.cn/BankControl.cab
[LiveMediaOcx Control]
InProcServer32 = D:\PROGRA~1\Tencent\QQLIVE~1\QQLive\QQLive.ocx
CODEBASE = http://dl_dir.qq.com/qqtv/QQLiveOcxSetup.exe
[NMTransX Module]
InProcServer32 = C:\WINDOWS.0\Downloaded Program Files\NMTransX.dll
CODEBASE = http://download.netmarble.com/NMChatX/NMTransX.cab
[Shockwave Flash
Object]
InProcServer32 = C:\WINDOWS.0\System32\Macromed\Flash\Flash9.ocx
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
--------------------------------------------------
列举 Winsock LSP 文件：
Protocol #1: w2pxdrv.dll (file MISSING)
Protocol #2: w2pxdrv.dll (file MISSING)
Protocol #3: w2pxdrv.dll (file MISSING)
Protocol #4: w2pxdrv.dll (file MISSING)
Protocol #5: w2pxdrv.dll (file MISSING)
Protocol #21: w2pxdrv.dll (file MISSING)
--------------------------------------------------
Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*
Windows NT checkdisk command:
BootExecute = autocheck autochk *
Windows NT 'Wininit.ini':
PendingFileRenameOperations: C:\DOCUME~1\Rin\LOCALS~1\Temp\__1.tmp||C:\DOCUME~1\Rin\LOCALS~1\Temp\__2.tmp||C:\DOCUME~1\Rin\LOCALS~1\Temp\__124.tmp||C:\DOCUME~1\Rin\LOCALS~1\Temp\__207.tmp
--------------------------------------------------
列举 ShellService
ObjectDelayLoad 项目：
WebCheck: C:\WINDOWS.0\System32\webcheck.dll
SysTray: C:\WINDOWS.0\System32\st
object.dll
PostBootReminder: C:\WINDOWS.0\system32\SHELL32.dll
CDBurn: C:\WINDOWS.0\system32\SHELL32.dll
--------------------------------------------------
报告完毕，共 7,157 字节
报告生成用时：1.125秒
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
