| 引用: |
| 【命运里の金色的贴子】把这个文件打包发到virusdied@yahoo.com.cn ........................... |
| 引用: |
| 【mycoffee的贴子】HijackThis@Qoo的扫描日志 V1.97.7 Scan saved at 22:01:35, on 2005-11-6 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe D:\mysql\bin\mysqld-nt.exe d:\program files\rising\rfw\rfwsrv.exe D:\PROGRAM FILES\RISING\RAV\CCENTER.EXE D:\PROGRAM FILES\RISING\RAV\Ravmond.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\services.exe D:\Program Files\Rising\Rfw\rfwmain.exe D:\Program Files\Rising\Rav\RavTimer.exe D:\Program Files\Rising\Rav\RavMon.exe C:\WINDOWS\system32\ctfmon.exe D:\Program Files\Thunder Network\Thunder\Thunder.exe C:\WINDOWS\system32\conime.exe C:\Program Files\Windows Media Player\wmplayer.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe D:\Program Files\Iparmor\Iparmor.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\Coffee\桌面\hijackthis1.97_qoo\HijackThis.exe O2 - BHO: (no name) - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v8.dll O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [NVMixerTray] ; "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [RfwMain] d:\Program Files\Rising\Rfw\rfwmain.exe O4 - HKLM\..\Run: [RavTimer] d:\Program Files\Rising\Rav\RavTimer.exe O4 - HKLM\..\Run: [RavMon] d:\Program Files\Rising\Rav\RavMon.exe -system O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Super Rabbit IEPro] D:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD O4 - HKCU\..\Run: [services] C:\WINDOWS\services.exe O4 - HKCU\..\RunServices: [services] C:\WINDOWS\services.exe O4 - Startup: NTUSER.DAT O4 - Startup: ntuser.dat.LOG O4 - Startup: ntuser.ini O8 - Extra context menu item: &使用迅雷下载 - d:\Program Files\Thunder Network\Thunder\geturl.htm O8 - Extra context menu item: &使用迅雷下载全部链接 - d:\Program Files\Thunder Network\Thunder\getallurl.htm O8 - Extra context menu item: 导出到 Microsoft Excel(&x) - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000 O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (CEditCtrl ) - https://img.alipay.com/download/aliedit.cab O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - %SystemRoot%\system32\mshtml.dll ........................... |
| 引用: |
| 【mycoffee的贴子】以下是最新信息： HijackThis_zww汉化版扫描日志 V1.99.1 保存于 22:31:55, 日期 2005-11-6 操作系统： Windows XP SP2 (WinNT 5.01.2600) 浏览器： Internet Explorer v6.00 SP2 (6.00.2900.2180) 当前运行的进程： C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe D:\mysql\bin\mysqld-nt.exe d:\program files\rising\rfw\rfwsrv.exe D:\PROGRAM FILES\RISING\RAV\CCENTER.EXE D:\PROGRAM FILES\RISING\RAV\Ravmond.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\services.exe C:\Program Files\Internet Explorer\iexplore.exe d:\program files\rising\rfw\RfwMain.exe C:\Documents and Settings\Coffee\桌面\2535952005811174944\HijackThis1991zww.exe F3 - REG:win.ini: run=C:\WINDOWS\services.exe O4 - 启动项HKLM\\Run: [services] C:\WINDOWS\services.exe O4 - 启动项HKLM\\RunServices: [services] C:\WINDOWS\services.exe O4 - HKCU\..\Run: [services] C:\WINDOWS\services.exe O4 - 启动项HKCU\\RunServices: [services] C:\WINDOWS\services.exe O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O20 - AppInit_DLLs: APIHookDll.dll O23 - NT 服务: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - NT 服务: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - NT 服务: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - NT 服务: MySql - Unknown owner - D:/mysql/bin/mysqld-nt.exe O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - d:\program files\rising\rfw\rfwsrv.exe O23 - NT 服务: Rising Process Communication Center (RsCCenter) - rising - D:\PROGRAM FILES\RISING\RAV\CCENTER.EXE O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\PROGRAM FILES\RISING\RAV\Ravmond.exe ........................... |
| 引用: |
| 【神无的贴子】O23 - NT 服务: MySql - Unknown owner - D:/mysql/bin/mysqld-nt.exe 这个服务是干什么用的。 ........................... |