瑞星卡卡安全论坛
ckazl - 2005-9-20 12:27:00
Logfile of HijackThis v1.99.1
Scan saved at 12:24:57, on 2005-9-20
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
d:\rfw\rfwsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
d:\rfw\RfwMain.exe
D:\RAV\CCENTER.EXE
D:\RAV\Ravmond.exe
D:\RAV\RavStub.exe
C:\Program Files\Kingsoft\kingplayer2003\cdsprite.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe
D:\RAV\RAVTIMER.EXE
D:\RAV\RAVMON.EXE
C:\WINDOWS\system32\ctfmon.exe
D:\QQ2005\TIMPlatform.exe
D:\长宽登入器\gzgwbn.exe
D:\QQ2005\QQexternal.exe
C:\WINDOWS\system32\taskmgr.exe
D:\TT\TTraveler.exe
D:\瑞星更新\新建文件夹 (3)\HijackThis.exe
O2 - BHO: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\Assistant\Assist\yasbar.dll
O2 - BHO: QQBrowserHelperObject Class - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\QQ2005\QQIEHelper.dll
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL
O2 - BHO: KillObj Class - {66C28884-4E5D-494B-80C9-CAA27528FD6D} - C:\WINDOWS\DOWNLO~1\ddtkillw.ocx
O2 - BHO: IMU IE HELP - {9A0527C1-4D5F-4e45-9D28-6257F75EDDB1} - C:\WINDOWS\System32\imuiepls.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FLASHGET\jccatch.dll
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINDOWS\DOWNLO~1\CONFLICT.1\CnsHook.dll
O3 - Toolbar: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\Assistant\Assist\yasbar.dll
O4 - HKLM\..\Run: [CnsMin] Rundll32.exe C:\WINDOWS\DOWNLO~1\CONFLICT.1\CnsMin.dll,Rundll32
O4 - HKLM\..\Run: [YDTMain.exe] C:\PROGRA~1\YDT\YDTMain.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [MS-4011 Memory Patch] E:\RavSasser.exe -Patch
O4 - HKLM\..\Run: [kpcdst] C:\Program Files\Kingsoft\kingplayer2003\cdsprite.exe
O4 - HKLM\..\Run: [IMSCMIG40W] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40W\IMSCMIG.EXE /SetPreload /Log
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [helper.dll] C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - HKLM\..\Run: [AutoInsQyule] C:\Program Files\Qyule\QyuleInstall.exe
O4 - HKLM\..\Run: [YLive.exe] C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
O4 - HKLM\..\Run: [yassistse] "C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"
O4 - HKLM\..\Run: [RavTimer] D:\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [RavMon] D:\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\RunOnce: [RavStub] "D:\RAV\ravstub.exe" /RUNONCE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: 腾讯QQ.lnk = D:\QQ2005\QQ.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: !搜一搜 - res://C:\WINDOWS\DOWNLO~1\CONFLICT.1\CnsMinEx.dll/1003
O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\QQ2005\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\QQ2005\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\QQ2005\SendMMS.htm
O9 - Extra button: 手机短信 - {00000000-0000-0001-0001-596BAEDD1289} - http://sms.3721.com/ie/index.htm?pid=U_hawk88_74063 (file missing)
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - D:\浩方对战平台\GameClient.exe
O9 - Extra button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.mail.yahoo.com/promo/rd1 (file missing)
O9 - Extra button: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://hot.3721.com/rd/shop_btn.htm (file missing)
O9 - Extra button: 上网助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://assistant.3721.com/index.htm?fb=Cns (file missing)
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\QQ2005\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\QQ2005\QQIEHelper.dll
O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing)
O9 - Extra 'Tools' menuitem: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing)
O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O9 - Extra 'Tools' menuitem: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O11 - Options group: [!CNS] 网络实名
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1105076427620
O16 - DPF: {98A62E3F-A8C5-4EF0-8A00-C70CF9D18A89} (LoaderCore Class) - http://tb.sogou.com/DLLoader.cab
O16 - DPF: {9A0527C1-4D5F-4E45-9D28-6257F75EDDB1} (IEBHOObj Class) - http://download.imuweb.com/client/chatatwill/ie/imuiepls.cab
O16 - DPF: {DA984A6D-508E-11D6-AA49-0050FF3C628D} (Ravonline) - http://download.rising.com.cn/ravkill/rsonline.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - d:\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - D:\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\RAV\Ravmond.exe
我在我C:\WINDOWS\system32下搜索到个map_hook.all还有在注册表里也发现个同名的.exe
苍山狼 - 2005-9-20 12:32:00
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
可能有点问题,不是对不对
独孤豪侠 - 2005-9-20 12:32:00
什么杀软报的灰鸽子呀，
上面你说的那个文件是系统文件，灰鸽子文件是在c:\windows\下的！！！！
ckazl - 2005-9-20 12:33:00
是瑞星和木马助手
独孤豪侠 - 2005-9-20 12:34:00
报的文件在哪？？
你杀过没有？？
ckazl - 2005-9-20 12:35:00
病毒名称 处理结果 扫描方式 路径 文件 病毒来源
Backdoor.Gpigeon 忽略 实时监控 C:\WINDOWS\TEMP mc2D.tmp\本机
Backdoor.Gpigeon.pr 清除成功 手动扫描 Rundll32.exe>>C:\WINDOWS\Server_HOOk.DLL\本机
Backdoor.Gpigeon.pr 清除成功 手动扫描 spoolsv.exe>>C:\WINDOWS\Server_HOOk.DLL\本机
Backdoor.Gpigeon.pr 清除成功 手动扫描 CCENTER.EXE>>C:\WINDOWS\Server_HOOk.DLL\本机
Backdoor.Gpigeon.pr 清除成功 手动扫描 TIMPlatform.exe>>C:\WINDOWS\Server_HOOk.DLL\本机
Backdoor.Gpigeon.pr 清除成功 手动扫描 Ravmond.exe>>C:\WINDOWS\Server_HOOk.DLL\本机
Backdoor.Gpigeon.pr 清除成功 手动扫描 RavStub.exe>>C:\WINDOWS\Server_HOOk.DLL\本机
Backdoor.Gpigeon.pr 清除成功 手动扫描 wdfmgr.exe>>C:\WINDOWS\Server_HOOk.DLL\本机
Backdoor.Gpigeon.pr 清除成功 手动扫描 Rundll32.exe>>C:\WINDOWS\Server_HOOk.DLL\本机
Backdoor.Gpigeon.pr 清除成功 手动扫描 spoolsv.exe>>C:\WINDOWS\Server_HOOk.DLL\本机
Backdoor.Gpigeon.pr 清除成功 手动扫描 CCENTER.EXE>>C:\WINDOWS\Server_HOOk.DLL\本机
Backdoor.Gpigeon.pr 清除成功 手动扫描 TIMPlatform.exe>>C:\WINDOWS\Server_HOOk.DLL\本机
Backdoor.Gpigeon.pr 清除成功 手动扫描 Ravmond.exe>>C:\WINDOWS\Server_HOOk.DLL\本机
Backdoor.Gpigeon.pr 清除成功 手动扫描 RavStub.exe>>C:\WINDOWS\Server_HOOk.DLL\本机
Backdoor.Gpigeon.pr 清除成功 手动扫描 wdfmgr.exe>>C:\WINDOWS\Server_HOOk.DLL\本机
Backdoor.Gpigeon.pr 删除成功 手动扫描 C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP9A0002993.exe>>server.exe>>Unpack\本机
Backdoor.Gpigeon.pr 删除成功 手动扫描 C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP9A0003289.DLL\本机
Backdoor.Gpigeon.pr 删除成功 手动扫描 C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP9A0003294.exe>>Unpack\本机
ckazl - 2005-9-20 12:37:00
我用瑞星和木马助手在安全模式下杀过
但杀完重启后还会报点木马 杀了
但后来就太安静了 有点心慌 开了QQ QQ对讲机自己开了 还有TT自己关了 屏幕有点闪 怕怕
独孤豪侠 - 2005-9-20 12:41:00
不过你的日志是正常的，没见到鸽子
ckazl - 2005-9-20 13:03:00
但我机器还是有问题 刚才去玩游戏 机器自己重启了
闪电风暴 - 2005-9-20 13:05:00
在安全模式下再扫描一下
ckazl - 2005-9-20 13:42:00
?
baohe - 2005-9-20 13:56:00
【回复“ckazl”的帖子】
关闭系统还原。
清空系统还原文件夹；清空 C:\WINDOWS\TEMP文件夹。用KILLBOX强行删除C:\WINDOWS\Server_HOOk.DLL（选择“替换删除”、“删除前结束explorer.exe”）。
ckazl - 2005-9-20 14:00:00
KILLBOX是什么? 哪里有下 给个地址 谢谢 终于等到你回复了
baohe - 2005-9-20 14:02:00
| 引用: |
【ckazl的贴子】KILLBOX是什么? 哪里有下 给个地址 谢谢 终于等到你回复了
........................... |
超级主题帖子你从来不看吗？
http://forum.ikaka.com/topic.asp?board=28&artid=6979213
就在这个帖子4楼的附件里。
ckazl - 2005-9-20 14:12:00
删除前结束explorer.exe”）。 ? 是要结束EXPLORER.EXE这个进程吗?
baohe - 2005-9-20 14:15:00
| 引用: |
【ckazl的贴子】KILLBOX是什么? 哪里有下 给个地址 谢谢 终于等到你回复了
........................... |
在KILLBOX的面板中勾选“删除前结束explorer.exe”。
附件:
1558472005920141758.jpg
ckazl - 2005-9-20 14:24:00
怎么填啊?
baohe - 2005-9-20 14:36:00
| 引用: |
【ckazl的贴子】怎么填啊?
........................... |
复制C:\WINDOWS\Server_HOOk.DLL
粘贴到KILLBOX的第一个窗口里（看下面的附图）。
你可真够菜的。
附件:
1558472005920143607.jpg
ckazl - 2005-9-20 14:47:00
嘻嘻 然后就点那个红色的按钮就OK了咯?
baohe - 2005-9-20 14:49:00
| 引用: |
【ckazl的贴子】嘻嘻 然后就点那个红色的按钮就OK了咯?
........................... |
是的
ckazl - 2005-9-20 14:55:00
我删除重启好了我想知道怎么才能知道自己机器里还有没有潜伏的鸽子病毒存在?
dreamhee - 2005-9-20 15:49:00
那就重新扫个日志大家看看咯
ckazl - 2005-9-20 19:41:00
我把东西删除后 没多久在玩游戏时机器自动重启了 而且还跳出2个注册表询问我是否允许修改
ckazl - 2005-9-20 19:43:00
Logfile of HijackThis v1.99.1
Scan saved at 19:42:50, on 2005-9-20
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
d:\rfw\rfwsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
d:\rfw\RfwMain.exe
D:\RAV\CCENTER.EXE
D:\RAV\Ravmond.exe
D:\RAV\RavStub.exe
C:\Program Files\Kingsoft\kingplayer2003\cdsprite.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe
D:\RAV\RAVTIMER.EXE
D:\RAV\RAVMON.EXE
C:\WINDOWS\system32\ctfmon.exe
D:\长宽登入器\gzgwbn.exe
C:\WINDOWS\system32\wuauclt.exe
D:\TT\TTraveler.exe
D:\瑞星更新\新建文件夹 (3)\HijackThis.exe
O2 - BHO: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\Assistant\Assist\yasbar.dll
O2 - BHO: QQBrowserHelperObject Class - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\QQ2005\QQIEHelper.dll
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL
O2 - BHO: KillObj Class - {66C28884-4E5D-494B-80C9-CAA27528FD6D} - C:\WINDOWS\DOWNLO~1\ddtkillw.ocx
O2 - BHO: IMU IE HELP - {9A0527C1-4D5F-4e45-9D28-6257F75EDDB1} - C:\WINDOWS\System32\imuiepls.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FLASHGET\jccatch.dll
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINDOWS\DOWNLO~1\CONFLICT.1\CnsHook.dll
O3 - Toolbar: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\Assistant\Assist\yasbar.dll
O4 - HKLM\..\Run: [CnsMin] Rundll32.exe C:\WINDOWS\DOWNLO~1\CONFLICT.1\CnsMin.dll,Rundll32
O4 - HKLM\..\Run: [YDTMain.exe] C:\PROGRA~1\YDT\YDTMain.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [MS-4011 Memory Patch] E:\RavSasser.exe -Patch
O4 - HKLM\..\Run: [kpcdst] C:\Program Files\Kingsoft\kingplayer2003\cdsprite.exe
O4 - HKLM\..\Run: [IMSCMIG40W] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40W\IMSCMIG.EXE /SetPreload /Log
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [helper.dll] C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - HKLM\..\Run: [AutoInsQyule] C:\Program Files\Qyule\QyuleInstall.exe
O4 - HKLM\..\Run: [YLive.exe] C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
O4 - HKLM\..\Run: [yassistse] "C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"
O4 - HKLM\..\RunOnce: [RavStub] "D:\RAV\ravstub.exe" /RUNONCE
O4 - Startup: 腾讯QQ.lnk = D:\QQ2005\QQ.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: !搜一搜 - res://C:\WINDOWS\DOWNLO~1\CONFLICT.1\CnsMinEx.dll/1003
O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\QQ2005\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\QQ2005\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\QQ2005\SendMMS.htm
O9 - Extra button: 手机短信 - {00000000-0000-0001-0001-596BAEDD1289} - http://sms.3721.com/ie/index.htm?pid=U_hawk88_74063 (file missing)
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - D:\浩方对战平台\GameClient.exe
O9 - Extra button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.mail.yahoo.com/promo/rd1 (file missing)
O9 - Extra button: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://hot.3721.com/rd/shop_btn.htm (file missing)
O9 - Extra button: 上网助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://assistant.3721.com/index.htm?fb=Cns (file missing)
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\QQ2005\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\QQ2005\QQIEHelper.dll
O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing)
O9 - Extra 'Tools' menuitem: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing)
O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O9 - Extra 'Tools' menuitem: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O11 - Options group: [!CNS] 网络实名
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1105076427620
O16 - DPF: {98A62E3F-A8C5-4EF0-8A00-C70CF9D18A89} (LoaderCore Class) - http://tb.sogou.com/DLLoader.cab
O16 - DPF: {9A0527C1-4D5F-4E45-9D28-6257F75EDDB1} (IEBHOObj Class) - http://download.imuweb.com/client/chatatwill/ie/imuiepls.cab
O16 - DPF: {DA984A6D-508E-11D6-AA49-0050FF3C628D} (Ravonline) - http://download.rising.com.cn/ravkill/rsonline.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - d:\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - D:\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\RAV\Ravmond.exe
ckazl - 2005-9-20 20:29:00
==========================================================================
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
==========================================================================
CnsMin----------Rundll32.exe C:\WINDOWS\DOWNLO~1\CONFLICT.1\CnsMin.dll,Rundll32
YDTMain.exe----------C:\PROGRA~1\YDT\YDTMain.exe
RealTray----------C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
PHIME2002ASync----------C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
PHIME2002A----------C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
MSPY2002----------C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
MS-4011 Memory Patch----------E:\RavSasser.exe -Patch
kpcdst----------C:\Program Files\Kingsoft\kingplayer2003\cdsprite.exe
IMSCMIG40W----------C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40W\IMSCMIG.EXE /SetPreload /Log
IMJPMIG8.1----------"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
helper.dll----------C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
AutoInsQyule----------C:\Program Files\Qyule\QyuleInstall.exe
YLive.exe----------C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
yassistse----------"C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"
==========================================================================
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonce
==========================================================================
RavStub----------"D:\RAV\ravstub.exe" /RUNONCE
==========================================================================
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
==========================================================================
==========================================================================
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
==========================================================================
==========================================================================
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runonce
==========================================================================
==========================================================================
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices
==========================================================================
==========================================================================
常用注册表关联项目
==========================================================================
EXE文件关联----------正常
COM文件关联----------正常
BAT文件关联----------正常
PIF文件关联----------正常
SCR文件关联----------正常
REG文件关联----------正常
TXT文件关联----------正常
==========================================================================
启动组
==========================================================================
[C:\Documents and Settings\Bluewater\「开始」菜单\程序\启动]
腾讯QQ.lnk
[C:\Documents and Settings\All Users\「开始」菜单\程序\启动]
Microsoft Office.lnk
Adobe Gamma Loader.lnk
==========================================================================
WIN.INI
==========================================================================
load =
run =
==========================================================================
SYSTEM.INI
==========================================================================
shell = Explorer.exe
================================文档结束==================================
baohe 帮我看下有没有什么问题
暴风一索隆 - 2005-9-20 20:45:00
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: kavsvc - Kaspersky Lab - E:\杀毒软件\Kaspersky Anti-Hacker\Kaspersky Anti-Virus Personal Pro\kavsvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PsShutdown (PsShutdownSvc) - Unknown owner - C:\WINDOWS\System32\PSSDNSVC.EXE
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
暴风一索隆 - 2005-9-20 20:46:00
请baohe大虾帮我看看吧谢谢！
ckazl - 2005-9-20 20:53:00
- - 晕 发到我帖子这来做啥啊 你自己另外发个帖子问好了
1
© 2000 - 2026 Rising Corp. Ltd.