日志文件 Trend Micro HijackThis v 2.0.2
日志保存时间: 16:46:44,2000-6-21
操作系统: Windows XP SP2 (WinNT 5.01.2600)
IE版本: Internet Explorer v6.00 SP2 (6.00.2900.2180)
启动模式: 正常
正在运行的进程:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRAM FILES\RISING\RAV\ravmond.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRAM FILES\RISING\RAV\RavStub.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Rising\Rav\Ravmon.exe
D:\Program Files\360Safebox\safeboxTray.exe
D:\Program Files\360safe\safemon\360tray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
d:\Program Files\StormII\stormliv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ChinaNet\VnetClient.exe
D:\Program Files\Tencent\QQ\TXPlatform.exe
d:\Program Files\Thunder Network\WebThunder\WebThunder.exe
D:\Program Files\kingsoft\WPS Office 2003\WinWPS.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
F:\工具\hijackthis.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsp3A.tmp\hijackthis.exe
O2 - BHO: WebThunderBHO - {00000AAA-A363-466E-BEF5-9BB68697AA7F} - d:\Program Files\Thunder Network\WebThunder\WebThunderBHO_Now.dll
O2 - BHO: Thunder AtOnce - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - d:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll(文件不存在)
O2 - BHO: VnetCookie Class - {4E83D567-4697-4F7B-B1F0-A513B01DB89A} - C:\PROGRA~1\ChinaNet\VNETTR~1.DLL
O2 - BHO: 超级兔子上网精灵 - {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} - D:\Program Files\Super Rabbit\MagicSet\haokanbar.dll(文件不存在)
O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - C:\PROGRA~1\baidu\bar\baidubar.dll
O2 - BHO: SafeMon Class - {B69F34DD-F0F9-42DC-9EDD-957187DA688D} - d:\Program Files\360safe\safemon\safemon.dll
O3 - IE 工具栏: 百度工具栏 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\PROGRA~1\baidu\bar\baidubar.dll
O3 - IE 工具栏: 超级兔子上网精灵 - {43869BB3-22FD-4F15-9B46-238106BA2F4E} - D:\Program Files\Super Rabbit\MagicSet\haokanbar.dll(文件不存在)
O4 - HKLM\..\Run: [Google IME Autoupdater] rem "d:\Program Files\Google\Google Pinyin\GooglePinyinDaemon.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [360Safebox] "d:\Program Files\360Safebox\safeboxTray.exe" /r
O4 - HKLM\..\Run: [360Safetray] d:\Program Files\360safe\safemon\360tray.exe /start
O4 - HKLM\..\Run: [WebThunder] d:\Program Files\Thunder Network\WebThunder\WebThunder.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O8 - 扩展右键菜单项: iSee 保存所有图片 - d:\Program Files\iSee\iSeeSavePicAll.htm
O8 - 扩展右键菜单项: iSee保存Flash - d:\Program Files\iSee\iSeeSaveFlash.htm
O8 - 扩展右键菜单项: iSee保存所有图片 - d:\Program Files\iSee\iSeeSavePicAll.htm
O8 - 扩展右键菜单项: iSee读取Exif - d:\Program Files\iSee\iSeeReadExif.htm
O8 - 扩展右键菜单项: 使用Web迅雷下载 - d:\Program Files\Thunder Network\WebThunder\GetUrl.htm
O8 - 扩展右键菜单项: 使用Web迅雷下载全部链接 - d:\Program Files\Thunder Network\WebThunder\GetAllUrl.htm
O8 - 扩展右键菜单项: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - 扩展右键菜单项: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - 扩展右键菜单项: 添加相册用户到iSee收藏 - d:\Program Files\iSee\iSeeAddToAlbum.htm
O9 - 额外的按钮: (未命名) - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - (没有文件)
O9 - 额外的按钮: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - 额外的按钮: 启动WEB迅雷 - {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} -
http://my.xunlei.com(文件不存在)
O9 - 额外的“工具”菜单项目: 启动WEB迅雷 - {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} -
http://my.xunlei.com(文件不存在)
O10 - Broken Internet access because of LSP provider 'c:\windows\system32\cdnns.dll' missing
O15 - Trusted Zone:
http://www.icbc.com.cnO16 - DPF: {45540001-5750-5300-4B49-4E47534F4654} (Kingsoft Spreadsheets Application Class) -
http://sql1.hckwj.com/lzmis/ETT/setup.exeO16 - DPF: {B219E31C-E110-4638-AF01-7BDD5ACA552C} (ICBCQPKCom_HH Class) -
https://mybank.icbc.com.cn/icbc/ICBCQPK_HH.cabO16 - DPF: {C09B522F-8AED-4E21-A65C-DC1AB652BAEE} (Tencent Safety Online Base Module) -
http://safe.qq.com/cgi-bin/tso/TSOBase.ocxO16 - DPF: {E787FD25-8D7C-4693-AE67-9406BC6E22DF} (PasswordEditCtrl Class) -
https://password.qq.com/download/qqedit2.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{081A8921-5109-4AC6-9454-B797292E6648}: NameServer = 218.30.19.40 61.134.1.4
O23 - NT 服务: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - NT 服务: Contrl Center of Storm Media (ccosm) - 北京暴风网际科技有限公司 - d:\Program Files\StormII\stormliv.exe
O23 - NT 服务: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - NT 服务: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
--
用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; RogueCleaner)