最近下载了BitComet0.70安装，结果打开网页-＞查看-＞浏览器栏内多出一个BitComet0.70工具栏，不知道这是否属于IE插件，会不会带来麻烦。
现在扫描结果如下（SREng）：
2006-07-21,13:49:15
System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (
Windows XP Professional Service Pack 1 (Build 2600)
- 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run>
＜ctfmon.exe＞＜C:\WINDOWS\System32\ctfmon.exe＞ [Microsoft Corporation>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows>
＜load＞＜＞ [>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run>
＜RavTask＞＜＂f:\Rising\Rav\RavTask.exe＂ -system＞ [Beijing Rising Technology Co., Ltd.>
＜KernelFaultCheck＞＜%systemroot%\system32\dumprep 0 -k＞ [>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon>
＜shell＞＜Explorer.exe＞ [Microsoft Corporation>
＜Userinit＞＜C:\WINDOWS\system32\userinit.exe,＞ [Microsoft Corporation>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows>
＜AppInit_DLLs＞＜＞ [>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon>
＜UIHost＞＜logonui.exe＞ [Microsoft Corporation>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks>
＜{32CD708B-60A7-4C00-9377-D73EAA495F0F}＞＜C:\WINDOWS\system32\RavExt.dll＞ [Beijing Rising Technology Co., Ltd.>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad>
＜Vision＞＜＞ [>
==================================
启动文件夹
服务
[Rising Personal Firewall Service / RfwService>
＜f:\rising\rfw\rfwsrv.exe＞＜Beijing Rising Technology Corporation Limited＞
[Rising Process Communication Center / RsCCenter>
＜＂f:\Rising\Rav\CCenter.exe＂＞＜Beijing Rising Technology Co., Ltd.＞
[RsRavMon Service / RsRavMon>
＜＂f:\Rising\Rav\Ravmond.exe＂＞＜Beijing Rising Technology Co., Ltd.＞
==================================
浏览器加载项
[@shdoclc.dll,-866>
{c95fe080-8f5d-11d2-a20b-00aa003c157a} ＜, N/A＞
[QQ>
{c95fe080-8f5d-11d2-a20b-00aa003c157b} ＜F:\Tencent\QQ\QQ.EXE, TENCENT＞
[FlashGet>
{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} ＜F:\FlashGet\flashget.exe, Amaze Soft＞
[>
{DE607143-AC19-423e-862A-2D70ABDF119A} ＜, N/A＞
[QQIEFloatBarCfgCmd Class>
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} ＜F:\Tencent\QQ\QQIEHelper.dll, N/A＞
[Shockwave Flash Object>
{D27CDB6E-AE6D-11CF-96B8-444553540000} ＜C:\WINDOWS\System32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.＞
[上传到QQ网络硬盘>
＜F:\Tencent\QQ\AddToNetDisk.htm, N/A＞
[使用网际快车下载>
＜F:\FlashGet\jc_link.htm, N/A＞
[使用网际快车下载全部链接>
＜F:\FlashGet\jc_all.htm, N/A＞
[添加到QQ自定义面板>
＜F:\Tencent\QQ\AddPanel.htm, N/A＞
[添加到QQ表情>
＜F:\Tencent\QQ\AddEmotion.htm, N/A＞
[用QQ彩信发送该图片>
＜F:\Tencent\QQ\SendMMS.htm, N/A＞
==================================
正在运行的进程
[PID: 540>[\SystemRoot\System32\smss.exe> ＜Microsoft Corporation＞＜5.1.2600.1106 (xpsp1.020828-1920)＞
[PID: 596>[\？？\C:\WINDOWS\system32\csrss.exe> ＜Microsoft Corporation＞＜5.1.2600.0 (xpclient.010817-1148)＞
[PID: 620>[\？？\C:\WINDOWS\system32\winlogon.exe> ＜Microsoft Corporation＞＜5.1.2600.1557 (xpsp2_gdr.040517-1325)＞
[PID: 664>[C:\WINDOWS\system32\services.exe> ＜Microsoft Corporation＞＜5.1.2600.0 (xpclient.010817-1148)＞
[PID: 676>[C:\WINDOWS\system32\lsass.exe> ＜Microsoft Corporation＞＜5.1.2600.1106 (xpsp1.020828-1920)＞
[PID: 844>[C:\WINDOWS\system32\svchost.exe> ＜Microsoft Corporation＞＜5.1.2600.0 (xpclient.010817-1148)＞
[PID: 956>[f:\Rising\Rav\CCenter.exe> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 3＞
[PID: 972>[C:\WINDOWS\System32\svchost.exe> ＜Microsoft Corporation＞＜5.1.2600.0 (xpclient.010817-1148)＞
[PID: 1072>[C:\WINDOWS\System32\svchost.exe> ＜Microsoft Corporation＞＜5.1.2600.0 (xpclient.010817-1148)＞
[PID: 1168>[C:\WINDOWS\System32\svchost.exe> ＜Microsoft Corporation＞＜5.1.2600.0 (xpclient.010817-1148)＞
[PID: 1180>[f:\Rising\Rav\Ravmond.exe> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 1, 26＞
[f:\Rising\Rav\BWList.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 19＞
[f:\Rising\Rav\RsCommX.dll> ＜rising＞＜18, 0, 0, 1＞
[f:\Rising\Rav\RSAPPMGR.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 2＞
[f:\Rising\Rav\CfgDll.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 10＞
[f:\Rising\Rav\RSCOMMON.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 4＞
[f:\Rising\Rav\RsLog.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 20＞
[f:\Rising\Rav\HOOKSYS.dll> ＜Rising＞＜18, 1, 0, 9＞
[f:\Rising\Rav\Scanner.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 30＞
[f:\Rising\Rav\libload.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 10＞
[f:\Rising\Rav\VirusLib.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 10＞
[f:\Rising\Rav\regmon.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 6＞
[f:\Rising\Rav\HookWeb.dll> ＜rising＞＜18, 0, 0, 1＞
[f:\Rising\Rav\MemMon.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 9＞
[f:\Rising\Rav\expscan.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 4＞
[f:\Rising\Rav\mPorts.dll> ＜Beijing Rising Technology Co., Ltd.＞＜4, 0, 0, 3＞
[f:\Rising\Rav\MailMon.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 5＞
[f:\Rising\Rav\SpamEng.dll> ＜N/A＞＜18, 0, 0, 6＞
[f:\Rising\Rav\engine.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 30＞
[f:\Rising\Rav\PostTrt.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 9＞
[f:\Rising\Rav\UnExe.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 11＞
[f:\Rising\Rav\ScanExec.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 11＞
[f:\Rising\Rav\ScanEx.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 11＞
[f:\Rising\Rav\NvFile.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 7＞
[f:\Rising\Rav\ScanMac.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 8＞
[f:\Rising\Rav\ScanSct.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 17＞
[f:\Rising\Rav\ExtOLE.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 6＞
[f:\Rising\Rav\ScanNet.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 5＞
[f:\Rising\Rav\ExtMail.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 13＞
[PID: 1324>[f:\rising\rfw\rfwsrv.exe> ＜Beijing Rising Technology Corporation Limited＞＜3, 2, 0, 0＞
[f:\rising\rfw\Rfwdrv.dll> ＜Beijing Rising Technology Corporation Limited＞＜3, 0, 1, 5＞
[f:\rising\rfw\rfwrule.dll> ＜Beijing Rising Technology Corporation Limited＞＜3, 1, 0, 0＞
[f:\rising\rfw\rfwlog.dll> ＜Beijing Rising Technology Corporation Limited＞＜3, 1, 0, 2＞
[PID: 1460>[C:\WINDOWS\system32\spoolsv.exe> ＜Microsoft Corporation＞＜5.1.2600.1699 (xpsp2.050610-1533)＞
[PID: 1852>[C:\WINDOWS\Explorer.EXE> ＜Microsoft Corporation＞＜6.00.2800.1106 (xpsp1.020828-1920)＞
[C:\WINDOWS\system32\RavExt.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 21＞
[f:\Rising\Rav\RSCOMMON.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 4＞
[f:\WinRAR\rarext.dll> ＜N/A＞＜N/A＞
[F:\FlashGet\fgiebar.dll> ＜Amaze Soft＞＜1, 2, 0, 0＞
[PID: 1872>[C:\WINDOWS\System32\alg.exe> ＜Microsoft Corporation＞＜5.1.2600.1106 (xpsp1.020828-1920)＞
[PID: 1892>[f:\rising\rfw\RfwMain.exe> ＜Beijing Rising Technology Corporation Limited＞＜3, 1, 0, 19＞
[f:\rising\rfw\RsGuiLib.dll> ＜Beijing Rising Technology Co., Ltd.＞＜17, 0, 0, 40＞
[f:\rising\rfw\RSCOMMON.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜17, 0, 0, 17＞
[f:\rising\rfw\PngDll.dll> ＜Rising＞＜17, 0, 0, 2＞
[PID: 2028>[C:\WINDOWS\System32\wdfmgr.exe> ＜Microsoft Corporation＞＜5.2.3790.1230 built by: DNSRV(bld4act)＞
[PID: 524>[F:\Rising\Rav\RavTask.exe> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 22＞
[F:\Rising\Rav\RSCOMMON.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 4＞
[F:\Rising\Rav\RSAPPMGR.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 2＞
[F:\Rising\Rav\CfgDll.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 10＞
[F:\Rising\Rav\RsCommX.dll> ＜rising＞＜18, 0, 0, 1＞
[PID: 564>[F:\Rising\Rav\Ravmon.exe> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 1, 28＞
[F:\Rising\Rav\RsGuiLib.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 24＞
[F:\Rising\Rav\BWList.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 19＞
[F:\Rising\Rav\RSAPPMGR.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 2＞
[F:\Rising\Rav\CfgDll.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 10＞
[F:\Rising\Rav\RSCOMMON.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 4＞
[F:\Rising\Rav\RsCommX.dll> ＜rising＞＜18, 0, 0, 1＞
[F:\Rising\Rav\PngDll.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 5＞
[PID: 836>[C:\WINDOWS\System32\ctfmon.exe> ＜Microsoft Corporation＞＜5.1.2600.1106 (xpsp1.020828-1920)＞
[PID: 1684>[C:\WINDOWS\System32\conime.exe> ＜Microsoft Corporation＞＜5.1.2600.1106 (xpsp1.020828-1920)＞
[PID: 1312>[C:\WINDOWS\System32\svchost.exe> ＜Microsoft Corporation＞＜5.1.2600.0 (xpclient.010817-1148)＞
[PID: 360>[f:\BitComet\BitComet.exe> ＜＞＜0.70＞
[PID: 3904>[F:\foobar2000\foobar2000.exe> ＜N/A＞＜N/A＞
[F:\foobar2000\utf8api.dll> ＜N/A＞＜N/A＞
[F:\foobar2000\components\foo_input_std.dll> ＜N/A＞＜N/A＞
[F:\foobar2000\components\foo_midi.dll> ＜N/A＞＜N/A＞
[F:\foobar2000\components\foo_output_std.dll> ＜N/A＞＜N/A＞
[F:\foobar2000\components\foo_uie_dbexplorer.dll> ＜N/A＞＜N/A＞
[F:\foobar2000\components\foo_uie_simple_spectrum.dll> ＜ ＞＜0, 1, 6, 1＞
[F:\foobar2000\components\foo_uie_tabs.dll> ＜N/A＞＜N/A＞
[F:\foobar2000\components\foo_uie_trackinfo.dll> ＜N/A＞＜N/A＞
[F:\foobar2000\components\foo_uie_volume.dll> ＜N/A＞＜N/A＞
[F:\foobar2000\components\foo_ui_columns.dll> ＜N/A＞＜N/A＞
[F:\foobar2000\components\foo_ui_std.dll> ＜N/A＞＜N/A＞
[F:\foobar2000\components\foo_vis_manager.dll> ＜N/A＞＜N/A＞
[F:\foobar2000\components\foo_wma.dll> ＜＞＜1.0.9＞
[PID: 364>[C:\Program Files\Internet Explorer\iexplore.exe> ＜Microsoft Corporation＞＜6.00.2800.1106 (xpsp1.020828-1920)＞
[C:\WINDOWS\System32\UNISPIM.IME> ＜北京清华紫光软件股份有限公司＞＜3.0.0.3045＞
[C:\WINDOWS\System32\upengine.dll> ＜北京清华紫光软件股份有限公司＞＜3.0.0.3045＞
[PID: 1284>[D:\病毒相关\sreng\SREng2\SREng.exe> ＜Smallfrogs Studio＞＜2.0.21.505＞
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1>
.EXE OK. [＂%1＂ %*>
.COM OK. [＂%1＂ %*>
.PIF OK. [＂%1＂ %*>
.REG OK. [regedit.exe ＂%1＂>
.BAT OK. [＂%1＂ %*>
.SCR OK. [＂%1＂ /S>
.CHM OK. [＂C:\WINDOWS\hh.exe＂ %1>
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1>
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1>
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1>
.VBS OK. [%SystemRoot%\System32\WScript.exe ＂%1＂ %*>
.JS Error. [＂f:\Macromedia\Dreamweaver MX\Dreamweaver.exe＂ ＂%1＂>
.LNK OK. [{00021401-0000-0000-C000-000000000046}>
==================================
Winsock 提供者
==================================
[ 本帖最后由 福运 于 2006-7-21 14:23 编辑 >
HijackThis_815汉化版扫描日志 V1.99.1
保存于 13:48:23, 日期 2006-7-21
操作系统： Windows XP SP1 (WinNT 5.01.2600)
浏览器： Unable to get Internet Explorer version!
当前运行的进程：
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
f:\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
f:\Rising\Rav\Ravmond.exe
f:\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
f:\rising\rfw\RfwMain.exe
F:\Rising\Rav\RavTask.exe
F:\Rising\Rav\Ravmon.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\conime.exe
C:\WINDOWS\System32\svchost.exe
f:\BitComet\BitComet.exe
F:\foobar2000\foobar2000.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\病毒相关\HijackThis汉华版\HijackThis1991zww.exe
O1 - Hosts: kill taobao
O4 - 启动项HKLM\\Run: [RavTask> ＂f:\Rising\Rav\RavTask.exe＂ -system
O4 - 启动项HKLM\\Run: [KernelFaultCheck> %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe> C:\WINDOWS\System32\ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - F:\Tencent\QQ\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载 - F:\FlashGet\jc_link.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链接 - F:\FlashGet\jc_all.htm
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - F:\Tencent\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - F:\Tencent\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - F:\Tencent\QQ\SendMMS.htm
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show ＆Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - F:\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - F:\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的按钮: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\FlashGet\flashget.exe
O9 - 浏览器额外的“工具”菜单项: ＆FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\FlashGet\flashget.exe
O9 - 浏览器额外的按钮: (no name) - {DE607143-AC19-423e-862A-2D70ABDF119A} - (file missing)
O9 - 浏览器额外的按钮: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - F:\Tencent\QQ\QQIEHelper.dll (file missing)
O9 - 浏览器额外的“工具”菜单项: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - F:\Tencent\QQ\QQIEHelper.dll (file missing)
O13 - DefaultPrefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{DAB4EDFB-B5E4-486F-8940-F2A48D0EA654}: NameServer = 202.106.46.151 202.106.0.20
O18 - 列举现有的协议: msnim - {828030A1-22C1-4009-854F-8E305202313F} - ＂C:\PROGRA~1\MSNMES~1\msgrapp.dll＂ (file missing)
O21 - SSODL: Vision - {6671A431-5C3D-463d-A7CF-5587F9B7E191} - (no file)
O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - f:\rising\rfw\rfwsrv.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - f:\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - f:\Rising\Rav\Ravmond.exe
我现在正在用BT下东西，用foobar2000听音乐..
其实刚才自己还处理了一个flashget下载工具栏的问题。
[ 本帖最后由 福运 于 2006-7-21 13:55 编辑 >
行了，经过努力已经把这个工具栏删掉了。用的还是regedit删除大法。。。此帖沉吧。
怎样删除的，可否一叙？ |
|
设为首页
加入收藏
联系我们
打印本文 
返回顶部 
加入收藏 
关闭窗口
