日志文件 Trend Micro HijackThis v 2.0.2
日志保存时间: 11:57:47,2007-11-30
操作系统: Windows XP SP2 (WinNT 5.01.2600)
IE版本: Internet Explorer v6.00 SP2 (6.00.2900.2180)
启动模式: 正常
正在运行的进程:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
E:\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
E:\RISING\RAV\Ravmond.exe
e:\rising\rfw\rfwsrv.exe
e:\rising\rfw\rfwproxy.exe
e:\rising\rfw\rfwstub.exe
C:\WINDOWS\Explorer.EXE
E:\RISING\RAV\RavStub.exe
C:\WINDOWS\system32\spoolsv.exe
e:\rising\rfw\RfwMain.exe
E:\st\stormliv.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\system32\TongBackupSrv.exe
C:\WINDOWS\system32\ServerNT.exe
E:\Rising\Rav\RavTask.exe
C:\WINDOWS\system32\SafeSignCertReg.exe
E:\Rising\Rav\Ravmon.exe
C:\WINDOWS\system32\ctfmon.exe
D:\QQ\TXPlatform.exe
C:\WINDOWS\system32\conime.exe
D:\HijackThis v2.02 汉化版\HijackThis.exe
O2 - BHO: WebThunderBHO - {00000AAA-A363-466E-BEF5-9BB68697AA7F} - D:\WebThunder1.11.1.188delux\WebThunderBHO_Now.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\BitComet\tools\BitCometBHO_1.1.9.24.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RfwMain] "E:\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [RavTask] "E:\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - HKLM\..\Run: [CertificateRegistration] SafeSignCertReg.exe
O4 - HKLM\..\Run: [checkinstall] C:\Program Files\ICBCPe~1\ICBC\BHDC(Personal)\CheckInstall.exe
O4 - HKLM\..\Run: [MenuOrder] C:\Program Files\ICBCPe~1\ICBC\BHDC(Personal)\MenuOrder\MenuOrder.exe
O4 - HKLM\..\Run: [WebThunder] D:\WebThunder1.11.1.188delux\WebThunder.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [bgswitch] C:\WINDOWS\system32\bgswitch.exe
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] ctfmon.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [bgswitch] C:\WINDOWS\system32\bgswitch.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] ctfmon.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] ctfmon.exe (User 'Default user')
O4 - Startup: 腾讯QQ.lnk = D:\QQ\QQ.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - 扩展右键菜单项: &使用BitComet下载 - res://D:\BitComet\BitComet.exe/AddLink.htm
O8 - 扩展右键菜单项: &使用BitComet下载全部链接 - res://D:\BitComet\BitComet.exe/AddAllLink.htm
O8 - 扩展右键菜单项: &使用BitComet下载本页视频 - res://D:\BitComet\BitComet.exe/AddVideo.htm
O8 - 扩展右键菜单项: 使用WEB迅雷下载 - D:\WebThunder1.11.1.188delux\GetUrl.htm
O8 - 扩展右键菜单项: 使用WEB迅雷下载全部链接 - D:\WebThunder1.11.1.188delux\GetAllUrl.htm
O8 - 扩展右键菜单项: 导出到 Microsoft Office Excel(&X) - res://E:\OFFICE~1\OFFICE11\EXCEL.EXE/3000
O8 - 扩展右键菜单项: 添加到QQ表情 - D:\QQ\AddEmotion.htm
O9 - 额外的按钮: BitComet 资源搜索 - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - D:\BitComet\tools\BitCometBHO_1.1.9.24.dll
O9 - 额外的按钮: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.tomatolei.com(文件不存在)
O9 - 额外的“工具”菜单项目: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.tomatolei.com(文件不存在)
O9 - 额外的按钮: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\OFFICE~1\OFFICE11\REFIEBAR.DLL
O9 - 额外的按钮: 启动WEB迅雷 - {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} - http://my.xunlei.com(文件不存在)
O9 - 额外的“工具”菜单项目: 启动WEB迅雷 - {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} - http://my.xunlei.com(文件不存在)
O15 - Trusted Zone: http://*.d80533265ec54ab
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{158B20ED-E526-4BF0-A8F1-92BA58104920}: NameServer = 202.101.172.35 202.101.172.47
O17 - HKLM\System\CS1\Services\Tcpip\..\{158B20ED-E526-4BF0-A8F1-92BA58104920}: NameServer = 202.101.172.35 202.101.172.47
O23 - NT 服务: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - NT 服务: Contrl Center of Storm Media (ccosm) - 北京暴风网际科技有限公司 - E:\st\stormliv.exe
O23 - NT 服务: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - e:\rising\rfw\rfwproxy.exe
O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - e:\rising\rfw\rfwsrv.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - E:\Rising\Rav\CCenter.exe
O23 - NT 服务: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - E:\RISING\RAV\Ravmond.exe
O23 - NT 服务: Tong备份服务 (TongBackupSrv) - Unknown owner - C:\WINDOWS\system32\TongBackupSrv.exe
O23 - NT 服务: 用友通 (UFNet) - ufida - C:\WINDOWS\system32\ServerNT.exe
--
文件结束 - 4978 字节
