启动电脑,即自动启动浏览器到http://18ol.21vod.cn/quanpin5.htm?id18=1831, 搞了几个小时,没有搞定,请高手赐教! 谢谢!
HijackThis_zww汉化版扫描日志 V1.99.1
保存于 21:15:28, 日期 2005-12-6
操作系统： Windows 2000 SP4 (WinNT 5.00.2195)
浏览器： Internet Explorer v6.00 SP1 (6.00.2800.1106)
当前运行的进程：
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\msdtc.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\InterBase Corp\InterBase\bin\ibguard.exe
C:\WINNT\System32\llssrv.exe
C:\WINNT\system32\nvsvc32.exe
C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe
C:\Program Files\10moons\RemoteService\RS.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\Dfssvc.exe
C:\Program Files\InterBase Corp\InterBase\bin\ibserver.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\Yahoo!\MiniMsgr\YMiniSvr.exe
C:\Program Files\rising\Rfw\rfwmain.exe
C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_S4I3H2.EXE
C:\WINNT\system32\internat.exe
C:\Program Files\HijackThis1991汉化版\HijackThis1991zww.exe
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FLASHGET\jccatch.dll
O2 - BHO: T2BHO Class - {B1D147E7-873E-4909-8127-695D9BB78728} - C:\WINNT\Downloaded Program Files\barhelp22.0.dll
O2 - BHO: CAP Class - {B8CCDD47-38E4-4CD2-B7FA-3B4B690F74BD} - C:\WINNT\system32\dtap.dll
O2 - BHO: (no name) - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - (no file)
O3 - IE工具栏增项: 上网助手 - {BB936323-19FA-4521-BA29-ECA6A121BC78} - (no file)
O3 - IE工具栏增项: 完美网译通 - {F43BD772-ABDD-43b7-A96A-3E9E61946EC0} - C:\WINNT\WORLD2\TOOLBAR\hmtoolbar.dll
O3 - IE工具栏增项: (no name) - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - (no file)
O3 - IE工具栏增项: 一搜工具条 - {115F6E46-FCBC-41ed-B3B5-3BDDD4AAB5E5} - C:\Program Files\YiSou\yisou.dll
O3 - IE工具栏增项: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - IE工具栏增项: BitCometBar - {3F1ABCDB-A875-46c1-8345-B72A4567E486} - C:\Program Files\BitComet\BitCometBar\BitCometBar0.2.dll
O3 - IE工具栏增项: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - 启动项HKLM\\Run: [用户接口自定义] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - 启动项HKLM\\Run: [Synchronization Manager] mobsync.exe /logon
O4 - 启动项HKLM\\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - 启动项HKLM\\Run: [MiniMsgr] C:\PROGRA~1\Yahoo!\MiniMsgr\YMiniSvr.exe
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - 启动项HKLM\\Run: [RfwMain] C:\Program Files\rising\Rfw\rfwmain.exe
O4 - 启动项HKLM\\Run: [iparmor] C:\PROGRA~1\Iparmor\Iparmor.exe mini
O4 - 启动项HKLM\\Run: [AutoInsQyule] C:\Program Files\Qyule\QyuleInstall.exe
O4 - 启动项HKLM\\Run: [Services] C:\WINNT\system32\B.tmp
O4 - 启动项HKLM\\Run: [EPSON Stylus Photo R210 Series] C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_S4I3H2.EXE /P30 "EPSON Stylus Photo R210 Series" /O6 "USB001" /M "Stylus Photo R210"
O4 - 启动项HKLM\\Run: [PigUpdate] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~ex40.exe
O4 - 启动项HKLM\\Run: [DTService] rundll32.exe C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\DTSERV~1.DLL,Load
O4 - 启动项HKLM\\Run: [ExFilter] Rundll32.exe "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\setup\cdnspie.dll,ExecFilter solo"
O4 - HKCU\..\Run: [internat] ;internat.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\eMule.exe -AutoStart
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: EPSON Online Register.lnk = C:\Program Files\EPSON\Online Register\Online Register.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - C:\PROGRA~1\pp2005\getAllurl.htm
O8 - IE右键菜单中的新增项目: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O8 - IE右键菜单中的新增项目: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 百度-搜索网页 - res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUSEARCH.HTM
O9 - 浏览器额外的按钮: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - 浏览器额外的“工具”菜单项: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O11 - Options group: [!CNS] 网络实名
O15 - “受信任的站点”中添加项: easyabc.95599.cn
O15 - “受信任的站点”中添加项: www.95599.cn
O15 - “受信任的站点”中添加项: http://www.icbc.com.cn
O16 - DPF: {15DDE989-CD45-4561-BF99-D22C0D5C2B85} - http://image2.sina.com.cn/pfp/iweb/vivimin.cab
O16 - DPF: {2354A44B-3CEB-4829-9940-545B03103538} (PowerPlr Control) - http://movie.sun116.com/plugin/PowerPlr.ocx
O16 - DPF: {56A7DC70-E102-4408-A34A-AE06FEF01586} (天下搜索) - http://iebar.t2t2.com/iebar.cab
O16 - DPF: {88E99D67-289C-41CA-882E-DDE2C0B2F495} (中文网址(&W)) - http://chajian.zwwz.cn/NT/zwwz_NT.cab
O16 - DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} (AxSubmitControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O16 - DPF: {98A62E3F-A8C5-4EF0-8A00-C70CF9D18A89} (LoaderCore Class) - http://tb.sogou.com/DLLoader.cab
O16 - DPF: {991481A7-4669-4E15-8C24-100404E1F5CB} - http://www.bluesky.cn/download/blueskyvoice_60.cab
O16 - DPF: {9CEFE6AD-175A-4AA2-ADA5-D16BC1A1ED01} (InoScan Control) - http://www.kill.com.cn/product/webscan/ocx/inoscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9BC8639C-80BB-4E35-BD32-D3F1ADFABD1B}: NameServer = 221.5.203.98,221.5.203.99
O17 - HKLM\System\CCS\Services\Tcpip\..\{AEACD552-2E80-4B18-B5AB-9F0B08013DE0}: NameServer = 221.5.203.98,221.5.203.99
O18 - 列举现有的协议: koboo - {7DEE9D05-FA0A-4416-A6F3-6537D0EAB6A6} - C:\WINNT\system32\mbprot.dll
O20 - Winlogon Notify: nwprovau - C:\WINNT\SYSTEM32\nwprovau.dll
O23 - NT 服务: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - NT 服务: DameWare Mini Remote Control (DWMRCS) - Unknown owner - C:\WINNT\SYSTEM32\DWRCS.EXE (file missing)
O23 - NT 服务: Gray_Pigeon_Server (GrayPigeonServer) - Unknown owner - C:\WINNT\G_Server.exe
O23 - NT 服务: InterBase Guardian (InterBaseGuardian) - InterBase Software Corp. - C:\Program Files\InterBase Corp\InterBase\bin\ibguard.exe
O23 - NT 服务: InterBase Server (InterBaseServer) - InterBase Software Corp. - C:\Program Files\InterBase Corp\InterBase\bin\ibserver.exe
O23 - NT 服务: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - NT 服务: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - NT 服务: PPPoE Service (PPPoEService) - Unknown owner - C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe
O23 - NT 服务: 10moons Remote Control Service (RemoteControlService) - Unknown owner - C:\Program Files\10moons\RemoteService\RS.exe
O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - c:\program files\rising\rfw\rfwsrv.exe
O23 - NT 服务: Windows Management NetWork Service Extensions - Unknown owner - NetManager.exe (file missing)
搞了几个小时,没有搞定,请高手赐教! 谢谢!
