这是启动的：
启动项报告： 2006-2-21, 上午 22:34:22
启动项扫描器版本： 1.52.2
开始于： C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.781\HijackThis1991zww.EXE
系统检测： Windows 2000 SP4 (WinNT 5.00.2195)
系统检测： Internet Explorer v6.00 SP1 (6.00.2800.1106)
* 使用默认选项
==================================================
当前运行的进程：
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\Program Files\Rising\Rav\Ravmond.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\WINNT\system32\nvsvc32.exe
C:\Program Files\P4P\p2psvr.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\inetsrv\inetinfo.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\WINNT\system32\internat.exe
C:\Program Files\Acesoft\Tracks Eraser Pro\te.exe
C:\Program Files\Rising\Rav\rav.exe
C:\Program Files\Rising\Rav\RsAgent.exe
C:\WINNT\msagent\AgentSvr.exe
C:\WINNT\system32\conime.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\Tencent\QQ1\QQ.exe
E:\Tencent\TIMPlatform.exe
C:\Program Files\Rising\Rav\RsLogVw.exe
C:\WINNT\regedit.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.781\HijackThis1991zww.exe
C:\WINNT\system32\notepad.exe
--------------------------------------------------
Checking Windows NT UserInit:
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINNT\system32\userinit.exe,
--------------------------------------------------
注册表中的启动项:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
RavScanBD = "C:\Program Files\rising\Rav\ScanBD.exe" /INST
RavTask = "C:\Program Files\Rising\Rav\RavTask.exe" -system
Synchronization Manager = mobsync.exe /logon
--------------------------------------------------
注册表中的启动项:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Internat.exe = internat.exe
Tracks Eraser Pro = C:\Program Files\Acesoft\Tracks Eraser Pro\te.exe min
--------------------------------------------------
文件打开方式关联 for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command
(黙认) = notepad.exe %1
--------------------------------------------------
Load/Run keys from C:\WINNT\WIN.INI:
load=* 未找到INI相关项目值 *
run=* 未找到INI相关项目值 *
Load/Run keys from Registry:
HKLM\..\Windows NT\CurrentVersion\WinLogon: load=* 未找到相关注册表键值 *
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=* 未找到相关注册表键值 *
HKLM\..\Windows\CurrentVersion\WinLogon: load=* 未找到相关注册表键值 *
HKLM\..\Windows\CurrentVersion\WinLogon: run=* 未找到相关注册表键值 *
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=* 未找到相关注册表键值 *
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=* 未找到相关注册表键值 *
HKCU\..\Windows\CurrentVersion\WinLogon: load=* 未找到相关注册表键值 *
HKCU\..\Windows\CurrentVersion\WinLogon: run=* 未找到相关注册表键值 *
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=* 未找到相关注册表键值 *
HKLM\..\Windows NT\CurrentVersion\Windows: load=* 未找到相关注册表键值 *
HKLM\..\Windows NT\CurrentVersion\Windows: run=* 未找到相关注册表键值 *
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=C:\WINNT\system32\SoDAHK.DLL
--------------------------------------------------
外壳扩展和屏幕保护程序的键值 从 C:\WINNT\SYSTEM.INI:
Shell=* 未找到INI相关项目值 *
SCRNSAVE.EXE=* 未找到INI相关项目值 *
drivers=* 未找到INI相关项目值 *
外壳扩展和屏幕保护程序的键值 从 注册表
Shell=Explorer.exe
SCRNSAVE.EXE=* 未找到相关注册表键值 *
drivers=* 未找到相关注册表键值 *
Policies Shell key:
HKCU\..\Policies: Shell=* 未找到相关注册表键值 *
HKLM\..\Policies: Shell=* 未找到相关注册表键值 *
--------------------------------------------------
列举IE浏览器辅助对象(BHO模块):
myBar BHO - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC}
SohuDAIEHelper - C:\Program Files\P4P\sodaie.dll - {0CA51D02-7739-43EA-8D9A-1E8AD4327B03}
QQIEHelper - d:\Program Files\Tencent\QQ1\QQIEHelper.dll - {54EBD53A-9BC1-480B-966A-843A333CA162}
--------------------------------------------------
列举下载的程序文件：
[Edit Class]
InProcServer32 = C:\WINNT\system32\CMBEdit.dll
CODEBASE = https://www.sz1.cmbchina.com/download/CMBEdit.cab
[BDC Control]
InProcServer32 = C:\WINNT\DOWNLO~1\BDC.ocx
CODEBASE = http://www.51zsf.net/BDC.cab
[AxInputControl Class]
InProcServer32 = C:\WINNT\DOWNLO~1\INPUTC~1.DLL
CODEBASE = https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
[VnetAnprIns Class]
InProcServer32 = C:\WINNT\Downloaded Program Files\anprins.dll
CODEBASE = http://plugin.chinavnet.com/VnetPluginIns.CAB
[pcastup Class]
InProcServer32 = C:\WINNT\Downloaded Program Files\vodupdate.dll
CODEBASE = http://ps.itv.mop.com/dn/files/vodupdate_1.0.0.8_20051009.cab
[AxSubmitControl Class]
InProcServer32 = C:\WINNT\DOWNLO~1\SUBMIT~1.DLL
CODEBASE = https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
[Update Class]
InProcServer32 = C:\WINNT\system32\iuctl.dll
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38455.2106828704
[Shockwave Flash
Object]
InProcServer32 = C:\WINNT\system32\Macromed\Flash\Flash8.ocx
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
[pCastPanel Class]
InProcServer32 = C:\Program Files\pcast\PodcastbarMini\pCastCtl.dll
CODEBASE = http://ps.itv.mop.com/dn/files/pCastCtl_1.0.0.80_20060123.cab
--------------------------------------------------
列举 Winsock LSP 文件：
NameSpace #1: C:\WINNT\system32\cdnns.dll
--------------------------------------------------
Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*
Windows NT checkdisk command:
BootExecute = autocheck autochk *
Windows NT 'Wininit.ini':
PendingFileRenameOperations: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\GLB1A2B.EXE||C:\Program Files\FlashGet\UNWISE.EXE
--------------------------------------------------
列举 ShellService
ObjectDelayLoad 项目：
Network.ConnectionTray: C:\WINNT\system32\NETSHELL.dll
WebCheck: C:\WINNT\system32\webcheck.dll
SysTray: st
object.dll
--------------------------------------------------
报告完毕，共 7,270 字节
报告生成用时：0.125秒
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
