用 HijackThis 扫描后日志:
Logfile of HijackThis v1.99.1
Scan saved at 18:11:58, on 2007-1-2
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
D:\安全软件\瑞星杀毒软件\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
D:\安全软件\瑞星杀毒软件\Rising\Rav\Ravmond.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
D:\安全软件\瑞星杀毒软件\Rising\Rav\RavTask.exe
D:\安全软件\瑞星杀毒软件\Rising\Rav\Ravmon.exe
C:\program files\common files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\Service.exe
E:\宽带登陆\ishare_user.exe
C:\WINDOWS\system32\svchost.exe
C:\program files\internet explorer\IEXPLORE.EXE
D:\安全软件\HijackThis.exe
R3 - URLSearchHook: 6e2d - {DFCB34B6-902D-426E-AE2B-1B294AE19F4F} - C:\WINDOWS\system32\48f6ntos.dll
O2 - BHO: (no name) - {44424148-6e2d-48f6-ae2b-1b294ae19f4f} - C:\WINDOWS\system32\48f6ntos.dll
O2 - BHO: 超级兔子上网精灵 - {FEDF637B-F631-4583-A210-33CC828D42DB} - D:\超级兔~1.35\MagicSet\HAOKAN~1.DLL
O3 - Toolbar: 超级兔子上网精灵 - {FEDF637B-F631-4583-A210-33CC828D42DB} - D:\超级兔~1.35\MagicSet\HAOKAN~1.DLL
O3 - Toolbar: 6e2d - {DFCB34B6-902D-426E-AE2B-1B294AE19F4F} - C:\WINDOWS\system32\48f6ntos.dll
O4 - HKLM\..\Run: [SKYNET Personal FireWall] D:\安全软件\天网防火墙\3.0\FireWall\PFW.exe
O4 - HKLM\..\Run: [RavTask] "D:\安全软件\瑞星杀毒软件\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [Cmaudio] ; RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [StormCodec_Helper] ; "D:\暴风影音\Storm Codec\StormSet.exe" /S /opti
O4 - HKLM\..\Run: [BigDogPath] ; C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera
O4 - HKLM\..\Run: [Super Rabbit Shutdown] ; D:\超级兔子魔法设置 v7.35\MagicSet\srshut.EXE /LOAD
O4 - HKLM\..\Run: [TkBellExe] ; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] ; rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SunJavaUpdateSched] ; "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] ; %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\program files\common files\InstallShield\UpdateService\issch.exe" -start
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Reboot.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\program files\common files\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &使用迅雷下载 - D:\迅雷\Program\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - D:\迅雷\Program\getallurl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - F:\游戏\qq\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - F:\游戏\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - F:\游戏\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - F:\游戏\qq\SendMMS.htm
O9 - Extra button: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - D:\迅雷\Thunder.exe
O9 - Extra 'Tools' menuitem: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - D:\迅雷\Thunder.exe
O10 - Unknown file in Winsock LSP: c:\windows\kbmw.dll
O10 - Unknown file in Winsock LSP: c:\windows\kbmw.dll
O10 - Unknown file in Winsock LSP: c:\windows\kbmw.dll
O10 - Unknown file in Winsock LSP: c:\windows\kbmw.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\tcpipdog0.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\tcpipdog0.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\tcpipdogr0.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\tcpipdogr0.dll
O16 - DPF: {05C1004E-2596-48E5-8E26-39362985EEB9} (MMCPlayer Class) - http://p3p.sogou.com/MMCShell.cab
O16 - DPF: {32D72994-45B9-42B5-8980-FB561D1BE2D0} (nEdit Control) - https://ekey.163.com/nEdit.cab
O16 - DPF: {43E839C5-E10F-443A-BC1F-F09CFD2ABC77} (updatePanelX Control) - http://www.uusee.com/player/updateC.cab
O21 - SSODL: NetWork - {FC055E7D-8144-4706-8586-2F1C49FCDD2A} - (no file)
O21 - SSODL: WebSecurity - {3DD78ACF-0745-4532-94F8-A574457E1A81} - C:\WINDOWS\system32\PvSed.dll
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\安全软件\瑞星杀毒软件\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\安全软件\瑞星杀毒软件\Rising\Rav\Ravmond.exe
