HijackThis_zww汉化版扫描日志 V1.99.1
保存于 21:57:57, 日期 2006-7-2
操作系统： Windows XP SP2 (WinNT 5.01.2600)
浏览器： Internet Explorer v6.00 SP2 (6.00.2900.2180)
当前运行的进程：
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
E:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
E:\Program Files\Rising\Rav\Ravmond.exe
e:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
E:\Program Files\Rising\Rfw\rfwmain.exe
E:\Program Files\Rising\Rav\RavTask.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Rising\Rav\Ravmon.exe
C:\Documents and Settings\Administrator\桌面\HijackThis1991【teyqiu】.exe
O3 - IE工具栏增项: 金山快译(＆K) - {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} - E:\Program Files\Kingsoft\FastAIT 2006\IEBand.dll
O4 - 启动项HKLM\\Run: [RfwMain> ＂e:\Program Files\Rising\Rfw\rfwmain.exe＂ -Startup
O4 - 启动项HKLM\\Run: [RavTask> ＂E:\Program Files\Rising\Rav\RavTask.exe＂ -system
O4 - HKCU\..\Run: [ctfmon.exe> C:\WINDOWS\system32\ctfmon.exe
O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - E:\Program Files\qq2006\QQ.EXE
O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - E:\Program Files\qq2006\QQ.EXE
O9 - 浏览器额外的按钮: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - E:\Program Files\qq2006\QQIEHelper.dll (file missing)
O9 - 浏览器额外的“工具”菜单项: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - E:\Program Files\qq2006\QQIEHelper.dll (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://www.tomatolei.com
O16 - DPF: {7634AC7F-970B-4D1D-8255-2D59AF896079} - file://H:\plugin\VoiceCtl.cab
O23 - NT 服务: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - e:\program files\rising\rfw\rfwproxy.exe
O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - e:\program files\rising\rfw\rfwsrv.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - E:\Program Files\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - E:\Program Files\Rising\Rav\Ravmond.exe
2006-07-02,21:59:05
System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (
Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run>
＜ctfmon.exe＞＜C:\WINDOWS\system32\ctfmon.exe＞ [Microsoft Corporation>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows>
＜load＞＜＞ [>
＜run＞＜＞ [>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run>
＜RfwMain＞＜＂e:\Program Files\Rising\Rfw\rfwmain.exe＂ -Startup＞ [Beijing Rising Technology Co., Ltd.>
＜RavTask＞＜＂E:\Program Files\Rising\Rav\RavTask.exe＂ -system＞ [Beijing Rising Technology Co., Ltd.>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon>
＜shell＞＜Explorer.exe＞ [Microsoft Corporation>
＜Userinit＞＜C:\WINDOWS\system32\userinit.exe,＞ [Microsoft Corporation>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows>
＜AppInit_DLLs＞＜＞ [>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon>
＜UIHost＞＜logonui.exe＞ [ORIONNET>
==================================
启动文件夹
服务
[Rising Proxy Service / RfwProxySrv>
＜e:\program files\rising\rfw\rfwproxy.exe＞＜Beijing Rising Technology Co., Ltd.＞
[Rising Personal Firewall Service / RfwService>
＜e:\program files\rising\rfw\rfwsrv.exe＞＜Beijing Rising Technology Co., Ltd.＞
[Rising Process Communication Center / RsCCenter>
＜＂E:\Program Files\Rising\Rav\CCenter.exe＂＞＜Beijing Rising Technology Co., Ltd.＞
[RsRavMon Service / RsRavMon>
＜＂E:\Program Files\Rising\Rav\Ravmond.exe＂＞＜Beijing Rising Technology Co., Ltd.＞
==================================
浏览器加载项
[QQ>
{c95fe080-8f5d-11d2-a20b-00aa003c157b} ＜E:\Program Files\qq2006\QQ.EXE, TENCENT＞
[QQIEFloatBarCfgCmd Class>
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} ＜E:\Program Files\qq2006\QQIEHelper.dll, N/A＞
[金山快译(＆K)>
{6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} ＜E:\Program Files\Kingsoft\FastAIT 2006\IEBand.dll, 金山软件股份有限公司＞
[>
{7634AC7F-970B-4D1D-8255-2D59AF896079} ＜C:\WINDOWS\DOWNLO~1\VoiceCtl.dll, ＞
[Shockwave Flash Object>
{D27CDB6E-AE6D-11CF-96B8-444553540000} ＜C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx, Macromedia, Inc.＞
[Windows Media Player>
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} ＜C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation＞
[BitComet工具栏>
{3F1ABCDB-A875-46C1-8345-B72A4567E486} ＜d:\BitComet\BitCometBar\BitCometBar0.6.dll, N/A＞
[HHCtrl Object>
{52A2AAAE-085D-4187-97EA-8C30DB990436} ＜C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation＞
[QQBrowserHelperObject Class>
{54EBD53A-9BC1-480B-966A-843A333CA162} ＜E:\Program Files\qq2006\QQIEHelper.dll, N/A＞
[WUWebControl Class>
{6414512B-B978-451D-A0D8-FCFDF33E833C} ＜C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation＞
[Windows Media Player>
{6BF52A52-394A-11D3-B153-00C04F79FAA6} ＜C:\WINDOWS\system32\wmp.dll, Microsoft Corporation＞
[金山快译(＆K)>
{6C3797D2-3FEF-4CD4-B654-D3AE55B4128C} ＜E:\Program Files\Kingsoft\FastAIT 2006\IEBand.dll, 金山软件股份有限公司＞
[Thunder Browser Helper>
{889D2FEB-5411-4565-8998-1DD2C5261283} ＜e:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, N/A＞
[>
{A9930D97-9CF0-42A0-A10D-4F28836579D5} ＜E:\PROGRA~1\KuGoo3\KUGOO3~1.OCX, N/A＞
[SearchAssistantOC>
{B45FF030-4447-11D2-85DE-00C04FA35C89} ＜%SystemRoot%\system32\shdocvw.dll, N/A＞
[Shockwave Flash Object>
{D27CDB6E-AE6D-11CF-96B8-444553540000} ＜C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx, Macromedia, Inc.＞
==================================
正在运行的进程
[PID: 384>[\SystemRoot\System32\smss.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 440>[\？？\C:\WINDOWS\system32\csrss.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 464>[\？？\C:\WINDOWS\system32\winlogon.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 508>[C:\WINDOWS\system32\services.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 520>[C:\WINDOWS\system32\lsass.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 676>[C:\WINDOWS\system32\svchost.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 752>[C:\WINDOWS\system32\svchost.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 792>[E:\Program Files\Rising\Rav\CCenter.exe> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 3＞
[PID: 808>[C:\WINDOWS\System32\svchost.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 848>[C:\WINDOWS\system32\svchost.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 876>[C:\WINDOWS\system32\svchost.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 944>[E:\Program Files\Rising\Rav\Ravmond.exe> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 1, 26＞
[E:\Program Files\Rising\Rav\BWList.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 19＞
[E:\Program Files\Rising\Rav\RsCommX.dll> ＜rising＞＜18, 0, 0, 1＞
[E:\Program Files\Rising\Rav\RSAPPMGR.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 2＞
[E:\Program Files\Rising\Rav\CfgDll.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 10＞
[E:\Program Files\Rising\Rav\RSCOMMON.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 4＞
[E:\Program Files\Rising\Rav\RsLog.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 20＞
[E:\Program Files\Rising\Rav\HOOKSYS.dll> ＜Rising＞＜18, 1, 0, 9＞
[E:\Program Files\Rising\Rav\Scanner.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 30＞
[E:\Program Files\Rising\Rav\libload.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 10＞
[E:\Program Files\Rising\Rav\VirusLib.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 10＞
[E:\Program Files\Rising\Rav\regmon.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 6＞
[E:\Program Files\Rising\Rav\HookWeb.dll> ＜rising＞＜18, 0, 0, 1＞
[E:\Program Files\Rising\Rav\MemMon.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 9＞
[E:\Program Files\Rising\Rav\expscan.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 4＞
[E:\Program Files\Rising\Rav\mPorts.dll> ＜Beijing Rising Technology Co., Ltd.＞＜4, 0, 0, 3＞
[E:\Program Files\Rising\Rav\MailMon.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 5＞
[E:\Program Files\Rising\Rav\SpamEng.dll> ＜N/A＞＜18, 0, 0, 6＞
[E:\Program Files\Rising\Rav\engine.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 30＞
[E:\Program Files\Rising\Rav\PostTrt.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 9＞
[E:\Program Files\Rising\Rav\UnExe.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 11＞
[E:\Program Files\Rising\Rav\ScanExec.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 11＞
[E:\Program Files\Rising\Rav\ScanEx.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 11＞
[E:\Program Files\Rising\Rav\NvFile.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 7＞
[E:\Program Files\Rising\Rav\ScanMac.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 8＞
[E:\Program Files\Rising\Rav\ScanSct.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 15＞
[E:\Program Files\Rising\Rav\Unpacker.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 3＞
[PID: 992>[e:\program files\rising\rfw\rfwsrv.exe> ＜Beijing Rising Technology Co., Ltd.＞＜4, 0, 0, 32＞
[e:\program files\rising\rfw\RfwRule.dll> ＜Beijing Rising Technology Co., Ltd.＞＜4, 0, 0, 13＞
[e:\program files\rising\rfw\rfwlog.dll> ＜Beijing Rising Technology Co., Ltd.＞＜4, 0, 0, 6＞
[e:\program files\rising\rfw\Rfwdrv.dll> ＜Beijing Rising Technology Co., Ltd.＞＜4, 0, 0, 21＞
[e:\program files\rising\rfw\MonDrv.dll> ＜rs＞＜1, 0, 0, 4＞
[e:\program files\rising\rfw\ProcLib.dll> ＜Beijing Rising Technology Co., Ltd.＞＜4, 0, 0, 9＞
[PID: 1260>[C:\WINDOWS\system32\spoolsv.exe> ＜Microsoft Corporation＞＜5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)＞
[PID: 1432>[C:\WINDOWS\system32\wdfmgr.exe> ＜Microsoft Corporation＞＜5.2.3790.1230 built by: dnsrv(bld4act)＞
[PID: 272>[C:\WINDOWS\System32\alg.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 1184>[C:\WINDOWS\Explorer.EXE> ＜Microsoft Corporation＞＜6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)＞
[E:\Program Files\WinRAR\rarext.dll> ＜N/A＞＜N/A＞
[C:\WINDOWS\system32\RavExt.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 21＞
[E:\Program Files\Rising\Rav\RSCOMMON.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 4＞
[PID: 2016>[E:\Program Files\Rising\Rfw\rfwmain.exe> ＜Beijing Rising Technology Co., Ltd.＞＜4, 0, 0, 51＞
[E:\Program Files\Rising\Rfw\RsGuiLib.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 23＞
[E:\Program Files\Rising\Rfw\RSCOMMON.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 4＞
[E:\Program Files\Rising\Rfw\PngDll.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 5＞
[PID: 2032>[E:\Program Files\Rising\Rav\RavTask.exe> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 22＞
[E:\Program Files\Rising\Rav\RSCOMMON.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 4＞
[E:\Program Files\Rising\Rav\RSAPPMGR.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 2＞
[E:\Program Files\Rising\Rav\CfgDll.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 10＞
[E:\Program Files\Rising\Rav\RsCommX.dll> ＜rising＞＜18, 0, 0, 1＞
[PID: 376>[C:\WINDOWS\system32\ctfmon.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 600>[E:\Program Files\Rising\Rav\Ravmon.exe> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 1, 28＞
[E:\Program Files\Rising\Rav\RsGuiLib.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 24＞
[E:\Program Files\Rising\Rav\BWList.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 19＞
[E:\Program Files\Rising\Rav\RSAPPMGR.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 2＞
[E:\Program Files\Rising\Rav\CfgDll.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 10＞
[E:\Program Files\Rising\Rav\RSCOMMON.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 4＞
[E:\Program Files\Rising\Rav\RsCommX.dll> ＜rising＞＜18, 0, 0, 1＞
[E:\Program Files\Rising\Rav\PngDll.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 5＞
[PID: 980>[C:\Documents and Settings\Administrator\桌面\SREng.exe> ＜Smallfrogs Studio＞＜2.0.21.505＞
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1>
.EXE OK. [＂%1＂ %*>
.COM OK. [＂%1＂ %*>
.PIF OK. [＂%1＂ %*>
.REG OK. [regedit.exe ＂%1＂>
.BAT OK. [＂%1＂ %*>
.SCR OK. [＂%1＂ /S>
.CHM OK. [＂C:\WINDOWS\hh.exe＂ %1>
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1>
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1>
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1>
.VBS OK. [%SystemRoot%\System32\WScript.exe ＂%1＂ %*>
.JS OK. [%SystemRoot%\System32\WScript.exe ＂%1＂ %*>
.LNK OK. [{00021401-0000-0000-C000-000000000046}>
==================================
Winsock 提供者
==================================
hijackthis和sreng的报告都看这比较干净，
就这项目不知道楼主清楚是啥？（H光盘盘符？）
O16 - DPF: {7634AC7F-970B-4D1D-8255-2D59AF896079} - file://H:\plugin\VoiceCtl.cab
sreng 浏览器加载项目
[>
{7634AC7F-970B-4D1D-8255-2D59AF896079} ＜C:\WINDOWS\DOWNLO~1\VoiceCtl.dll, ＞
连名称也没有
我也看不明白,可是瑞星监控功能被自动关了,不能启动!! |
|
设为首页
加入收藏
联系我们
打印本文 
返回顶部 
加入收藏 
关闭窗口
