丝质流年 - 2006-6-26 13:48:00
Logfile of HijackThis v1.99.1
Scan saved at 13:38:23, on 2006-6-26
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
F:\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
F:\Rising\Rav\Ravmond.exe
C:\WINDOWS\system32\spoolsv.exe
F:\Rising\Rav\RavStub.exe
C:\WINDOWS\System32\inetsrv\daemon\services.exe
C:\WINDOWS\System32\inetsrv\daemon\ethernet.exe
C:\WINDOWS\update\updmangr.exe
C:\WINDOWS\system32\winmsi.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RunDll32.exe
C:\Program Files\Conexant\AccessRunner ADSL\CnxDslTb.exe
C:\Program Files\CNNIC\Cdn\cdnup.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
F:\Rising\Rav\RavTask.exe
F:\Rising\Rav\Ravmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\conime.exe
F:\Program Files\Tencent\QQ\QQ.exe
F:\Program Files\Tencent\QQ\TIMPlatform.exe
C:\WINDOWS\System32\spoolsvc.exe
F:\Program Files\Tencent\TT\TTraveler.exe
F:\Rising\Rav\Rav.exe
F:\新建文件夹\HijackThis1.99.1\HijackThis.exe
R3 - URLSearchHook: (no name) - {BB936323-19FA-4521-BA29-ECA6A121BC78} - (no file)
F2 - REG:system.ini: UserInit=userinit.exe,
O1 - Hosts: 83.228.30.22 www.halifax-online.co.uk
O1 - Hosts: 83.228.30.22 ibank.barclays.co.uk
O1 - Hosts: 83.228.30.22 online.lloydstsb.co.uk
O1 - Hosts: 83.228.30.22 online-business.lloydstsb.co.uk
O1 - Hosts: 83.228.30.22 www.ukpersonal.hsbc.co.uk
O1 - Hosts: 83.228.30.22 banesnet.banesto.es
O1 - Hosts: 83.228.30.22 extranet.banesto.es
O1 - Hosts: 83.228.30.22 ebanking.bccbrescia.it
O1 - Hosts: 83.228.30.22 www.bankofscotlandhalifax-online.co.uk
O1 - Hosts: 83.228.30.22 oi.cajamadrid.es
O1 - Hosts: 83.228.30.22 bancae.caixapenedes.com
O1 - Hosts: 83.228.30.22 banking.postbank.de
O1 - Hosts: 83.228.30.22 meine.deutsche-bank.de
O1 - Hosts: 83.228.30.22 myonlineaccounts2.abbeynational.co.uk
O1 - Hosts: 83.228.30.22 ibank.cahoot.com
O1 - Hosts: 83.228.30.22 webbank.openplan.co.uk
O1 - Hosts: 83.228.30.22 bancopostaonline.poste.it
O1 - Hosts: 83.228.30.22 mybank.bybank.it
O1 - Hosts: 83.228.30.22 ibank.internationalbanking.barclays.com
O1 - Hosts: 83.228.30.22 welcome7.co-operativebank.co.uk
O1 - Hosts: 83.228.30.22 welcome11.co-operativebankonline.co.uk
O2 - BHO: CdnForIE Class - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll
O2 - BHO: MFCOptimizeClass Object - {A6CEA0E7-6B4D-4CD9-9932-D85705CBC1A9} - C:\WINDOWS\System32\ddaba.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - Toolbar: 上网助手 - {1B0E7716-898E-48cc-9690-4E338E8DE1D3} - C:\Program Files\3721\assist\assist.dll
O3 - Toolbar: BitCometBar - {3F1ABCDB-A875-46c1-8345-B72A4567E486} - F:\Downloads\BitComet\BitCometBar\BitCometBar0.1.dll
O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\Conexant\AccessRunner ADSL\CnxDslTb.exe"
O4 - HKLM\..\Run: [CdnCtr] C:\Program Files\CNNIC\Cdn\cdnup.exe
O4 - HKLM\..\Run: [helper.dll] C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [VJSITaSYH] C:\WINDOWS\System32\dhoyftj.exe
O4 - HKLM\..\Run: [gimmygames] C:\\gimmygames.exe
O4 - HKLM\..\Run: [rngpqxgxvwkl] C:\WINDOWS\System32\miwuaygjf.exe
O4 - HKLM\..\Run: [RavTask] "F:\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [keyboard] C:\\kybrd_1.exe
O4 - HKLM\..\Run: [Microsoft (R) Windows Update Manager Tool] C:\WINDOWS\update\updmangr.exe
O4 - HKLM\..\RunServices: [VJSITaSYH] C:\WINDOWS\System32\dhoyftj.exe
O4 - HKLM\..\RunServices: [rngpqxgxvwkl] C:\WINDOWS\System32\miwuaygjf.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: 腾讯QQ.lnk = F:\Program Files\Tencent\QQ\QQ.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - F:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - F:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - F:\Program Files\Tencent\QQ\SendMMS.htm
O8 - Extra context menu item: 访问通用网址 - C:\Program Files\CNNIC\Cdn\cnnic.htm
O8 - Extra context menu item: 豪杰超级解霸V8实时播放 - C:\Herosoft\HeroV8\MPURLGET.HTM
O9 - Extra button: 豪杰超级解霸V8 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - C:\Herosoft\HeroV8\STHSDVD.EXE
O9 - Extra 'Tools' menuitem: 豪杰超级解霸V8 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - C:\Herosoft\HeroV8\STHSDVD.EXE
O9 - Extra button: 中文上网 - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll
O9 - Extra 'Tools' menuitem: 中文上网 - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - f:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - f:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\cdnns.dll
O11 - Options group: [CDNCLIENT] 中文上网
O15 - Trusted Zone: http://*.billingnow.com
O15 - Trusted Zone: http://*.reliablestats.com
O15 - Trusted Zone: http://*.winantispyware.com
O15 - Trusted Zone: http://*.winantivirus.com
O15 - Trusted Zone: http://*.winantiviruspro.com
O15 - Trusted Zone: http://*.winfixer.com
O15 - Trusted Zone: http://*.winnanny.com
O15 - Trusted Zone: http://*.winsoftware.com
O16 - DPF: {0150EB11-5FB4-4D9E-85EA-0F155705227E} (Yahoo! 相册轻松上载工具 Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/ydropper/ydropper1_7cn.cab
O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} (Edit Class) - https://www.sz1.cmbchina.com/download/CMBEdit.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123233667436
O16 - DPF: {7FC751A9-492D-41B1-9F8D-D2C8809D8907} (EmoWebInstallerCtl Class) - http://img.365ren.com/tv/cabs/EmoWebInstaller.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A5005155-1BBE-47E3-8055-F1E6E1D9033A}: NameServer = 202.102.128.68,202.102.134.68
O17 - HKLM\System\CCS\Services\Tcpip\..\{FA91937E-E07A-4976-8D67-A63CFB6BA6B4}: NameServer = 202.102.134.68 202.102.128.68
O17 - HKLM\System\CS1\Services\Tcpip\..\{A5005155-1BBE-47E3-8055-F1E6E1D9033A}: NameServer = 202.102.128.68,202.102.134.68
O17 - HKLM\System\CS2\Services\Tcpip\..\{A5005155-1BBE-47E3-8055-F1E6E1D9033A}: NameServer = 202.102.128.68,202.102.134.68
O20 - AppInit_DLLs: KB2357802.LOG
O20 - Winlogon Notify: ddaba - C:\WINDOWS\System32\ddaba.dll
O20 - Winlogon Notify: jkhhf - jkhhf.dll (file missing)
O23 - Service: DisplayController - Unknown owner - C:\WINDOWS\System32\inetsrv\daemon\services.exe
O23 - Service: EthernetController - Unknown owner - C:\WINDOWS\System32\inetsrv\daemon\services.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - F:\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - F:\Rising\Rav\Ravmond.exe
O23 - Service: Windows Update Manager Tool (UpdateManagerTool) - Unknown owner - C:\WINDOWS\update\updmangr.exe
O23 - Service: Windows MSI Services - Unknown owner - C:\WINDOWS\system32\winmsi.exe
© 2000 - 2025 Rising Corp. Ltd.