这是今早的扫描报告，请高手看看有没有问题，还中了什么招？ bbs.ikaka.com

wyqy - 2006-1-20 9:42:00

请各位老大帮忙看看，以下是今早用HijackThis v1.99.1扫描的：（前两天是打开网页慢！不选[启用第三方浏览器扩展]后正常。现在是IE 选项卡中IE主页栏失效！）

Logfile of HijackThis v1.99.1
Scan saved at 9:26:41, on 2006-1-20
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rising\Rav\Ravmond.exe
C:\WINDOWS\Explorer.EXE
c:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\3721\Dlaccel\YDownloader.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
c:\program files\rising\rfw\RfwMain.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\软件下载\HijackThis.exe

R3 - URLSearchHook: (no name) - {BB936323-19FA-4521-BA29-ECA6A121BC78} - (no file)
O1 - Hosts: 60.191.249.131 www.511yly.com
O1 - Hosts: 219.153.20.154 www.bt2008.net
O1 - Hosts: 218.94.124.36 bbs.btmyth.com
O1 - Hosts: 218.94.124.36 bbs.btmyth.com
O1 - Hosts: 210.22.199.140 www.*******com
O1 - Hosts: 202.107.225.180 dm.xiuxianchina.com
O1 - Hosts: 61.144.66.72 power.gsta.com
O1 - Hosts: 61.172.250.156 movie.ourrc.com
O1 - Hosts: 61.172.249.205 www.dmxf.com
O1 - Hosts: 60.190.125.55 www.csyes.net
O1 - Hosts: 61.129.75.102 www.tttx66.com
O1 - Hosts: 206.225.94.62 ttmov.suneuro.org
O1 - Hosts: 218.83.154.90 www.youlan.net
O1 - Hosts: 65.54.153.254 spaces.msn.com
O1 - Hosts: 220.201.109.147 www.lovebt.net
O1 - Hosts: 61.129.90.98 www.xyhc.com
O1 - Hosts: 218.90.163.131 www.ctuonline.com.cn
O1 - Hosts: 61.129.102.211 www.evermory.com
O1 - Hosts: 61.147.119.197 bbs.manmi.com
O1 - Hosts: 61.129.45.100 www.x611.com
O1 - Hosts: 211.144.32.135 www.qqkid.com
O1 - Hosts: 219.133.41.213 www.qq.com
O1 - Hosts: 221.208.208.199 www.btmypp.com
O1 - Hosts: 222.73.5.140 bbs1.greatweb.cn
O1 - Hosts: 61.172.197.149 bt.joyyang.com
O1 - Hosts: 202.43.216.50 cn.yaho,.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll
O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll
O2 - BHO: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\Assistant\Assist\yasbar.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL
O3 - Toolbar: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\Assistant\Assist\yasbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [yahoo_mini] C:\Program Files\3721\Dlaccel\YDownloader.exe
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [helper.dll] C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - HKLM\..\Run: [YLive.exe] C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
O4 - HKLM\..\Run: [yassistse] "C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &使用下载加速专家下载 - C:\Program Files\3721\Dlaccel\geturl.htm
O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Sandai Technologies Inc\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Sandai Technologies Inc\Thunder\getAllurl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 使用影音传送带下载 - C:\Program Files\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: 使用影音传送带下载全部链接 - C:\Program Files\Xi\NetTransport 2\NTAddList.html
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: 手机短信 - {00000000-0000-0001-0001-596BAEDD1289} - http://sms.3721.com/ie/index.htm (file missing)
O9 - Extra button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.mail.yahoo.com/promo/rd1 (file missing)
O9 - Extra button: 上网助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://assistant.3721.com/index.htm?fb=Cns (file missing)
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/
O17 - HKLM\System\CCS\Services\Tcpip\..\{BD03850D-B191-47CC-A8CC-8564EFC3D6CF}: NameServer = 61.166.150.101 61.139.2.69
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe

天使之剑 - 2006-1-20 15:47:00

【回复“wyqy”的帖子】

重新启动至安全模式，关闭所有不必要的窗口，使用HijackThis扫描后修复（在需要修复的项目前面打对勾，然后按“Fix checked”或“修复”，修复前会询问您是否需要备份，请选择“Yes”或“是”）：
R3 - URLSearchHook: (no name) - {BB936323-19FA-4521-BA29-ECA6A121BC78} - (no file)
O1 - Hosts: 60.191.249.131 www.511yly.com
O1 - Hosts: 219.153.20.154 www.bt2008.net
O1 - Hosts: 218.94.124.36 bbs.btmyth.com
O1 - Hosts: 218.94.124.36 bbs.btmyth.com
O1 - Hosts: 210.22.199.140 www.*******com
O1 - Hosts: 202.107.225.180 dm.xiuxianchina.com
O1 - Hosts: 61.144.66.72 power.gsta.com
O1 - Hosts: 61.172.250.156 movie.ourrc.com
O1 - Hosts: 61.172.249.205 www.dmxf.com
O1 - Hosts: 60.190.125.55 www.csyes.net
O1 - Hosts: 61.129.75.102 www.tttx66.com
O1 - Hosts: 206.225.94.62 ttmov.suneuro.org
O1 - Hosts: 218.83.154.90 www.youlan.net
O1 - Hosts: 65.54.153.254 spaces.msn.com
O1 - Hosts: 220.201.109.147 www.lovebt.net
O1 - Hosts: 61.129.90.98 www.xyhc.com
O1 - Hosts: 218.90.163.131 www.ctuonline.com.cn
O1 - Hosts: 61.129.102.211 www.evermory.com
O1 - Hosts: 61.147.119.197 bbs.manmi.com
O1 - Hosts: 61.129.45.100 www.x611.com
O1 - Hosts: 211.144.32.135 www.qqkid.com
O1 - Hosts: 219.133.41.213 www.qq.com
O1 - Hosts: 221.208.208.199 www.btmypp.com
O1 - Hosts: 222.73.5.140 bbs1.greatweb.cn
O1 - Hosts: 61.172.197.149 bt.joyyang.com
O1 - Hosts: 202.43.216.50 cn.yaho,.com
待修复完成，如果问题依旧，请继续跟帖说明情况。
以上建议仅供参考，如果您认识其中的一些设置抑或是您的手动设置，就不必执行。

瑞星卡卡安全论坛