006-03-07 17:37:17：进程快照列表

进程数: 30

---进程列表---

名称: [System Process](优先级：暂缺)
名称: System(优先级：标准)
名称: smss.exe(优先级：标准)
  完整路径: C:\WINDOWS\System32\smss.exe
  发行商: Microsoft Corporation
  描述: Windows NT Session Manager
  版权: ? Microsoft Corporation. All rights reserved.
  文件版本: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
  产品名称: Microsoft? Windows? Operating System
  产品版本: 5.1.2600.2180

名称: csrss.exe(优先级：标准)
  完整路径: C:\WINDOWS\system32\csrss.exe
  发行商: Microsoft Corporation
  描述: Client Server Runtime Process
  版权: ? Microsoft Corporation. All rights reserved.
  文件版本: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
  产品名称: Microsoft? Windows? Operating System
  产品版本: 5.1.2600.2180

名称: winlogon.exe(优先级：高)
  完整路径: C:\WINDOWS\system32\winlogon.exe
  发行商: Microsoft Corporation
  描述: Windows NT Logon Application
  版权: (C) Microsoft Corporation. All rights reserved.
  文件版本: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
  产品名称: Microsoft(R) Windows(R) Operating System
  产品版本: 5.1.2600.2180

名称: services.exe(优先级：标准)
  完整路径: C:\WINDOWS\system32\services.exe
  发行商: Microsoft Corporation
  描述: Services and Controller app
  版权: (C) Microsoft Corporation. All rights reserved.
  文件版本: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
  产品名称: Microsoft(R) Windows(R) Operating System
  产品版本: 5.1.2600.2180

名称: lsass.exe(优先级：标准)
  完整路径: C:\WINDOWS\system32\lsass.exe
  发行商: Microsoft Corporation
  描述: LSA Shell (Export Version)
  版权: ? Microsoft Corporation. All rights reserved.
  文件版本: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
  产品名称: Microsoft? Windows? Operating System
  产品版本: 5.1.2600.2180

名称: svchost.exe(优先级：标准)
  完整路径: C:\WINDOWS\system32\svchost.exe
  发行商: Microsoft Corporation
  描述: Generic Host Process for Win32 Services
  版权: ? Microsoft Corporation. All rights reserved.
  文件版本: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
  产品名称: Microsoft? Windows? Operating System
  产品版本: 5.1.2600.2180

名称: svchost.exe(优先级：标准)
  完整路径: C:\WINDOWS\system32\svchost.exe
  发行商: Microsoft Corporation
  描述: Generic Host Process for Win32 Services
  版权: ? Microsoft Corporation. All rights reserved.
  文件版本: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
  产品名称: Microsoft? Windows? Operating System
  产品版本: 5.1.2600.2180

名称: CCenter.exe(优先级：标准)
  完整路径: d:\Program Files\rising\Rav\CCenter.exe
  发行商: Beijing Rising Technology Co., Ltd.
  描述: CCenter
  版权: Copyright Rising  2002
  文件版本: 18, 0, 0, 3
  产品名称: Rising Antivirus Software
  产品版本: 18, 0, 0, 3

名称: svchost.exe(优先级：标准)
  完整路径: C:\WINDOWS\System32\svchost.exe
  发行商: Microsoft Corporation
  描述: Generic Host Process for Win32 Services
  版权: ? Microsoft Corporation. All rights reserved.
  文件版本: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
  产品名称: Microsoft? Windows? Operating System
  产品版本: 5.1.2600.2180

名称: svchost.exe(优先级：标准)
  完整路径: C:\WINDOWS\System32\svchost.exe
  发行商: Microsoft Corporation
  描述: Generic Host Process for Win32 Services
  版权: ? Microsoft Corporation. All rights reserved.
  文件版本: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
  产品名称: Microsoft? Windows? Operating System
  产品版本: 5.1.2600.2180

名称: svchost.exe(优先级：标准)
  完整路径: C:\WINDOWS\System32\svchost.exe
  发行商: Microsoft Corporation
  描述: Generic Host Process for Win32 Services
  版权: ? Microsoft Corporation. All rights reserved.
  文件版本: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
  产品名称: Microsoft? Windows? Operating System
  产品版本: 5.1.2600.2180

名称: Ravmond.exe(优先级：标准)
  完整路径: d:\Program Files\rising\Rav\Ravmond.exe
  发行商: Beijing Rising Technology Co., Ltd.
  描述: RavMond
  版权: Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited
  文件版本: 18, 0, 1, 3
  产品名称: Rising Antivirus Software
  产品版本: 18, 0, 1, 3

名称: Explorer.EXE(优先级：标准)
  完整路径: C:\WINDOWS\Explorer.EXE
  发行商: Microsoft Corporation
  描述: Windows Explorer
  版权: (C) Microsoft Corporation. All rights reserved.
  文件版本: 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
  产品名称: Microsoft(R) Windows(R) Operating System
  产品版本: 6.00.2900.2180

名称: rfwsrv.exe(优先级：标准)
  完整路径: d:\program files\rising\rfw\rfwsrv.exe
  发行商: Beijing Rising Technology Co., Ltd.
  描述: Rising Personal FireWall Service
  版权: Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited
  文件版本: 4, 0, 0, 30
  产品名称: Rising Personal FireWall 2006
  产品版本: 4, 0, 0, 0

名称: spoolsv.exe(优先级：标准)
  完整路径: C:\WINDOWS\system32\spoolsv.exe
  发行商: Microsoft Corporation
  描述: Spooler SubSystem App
  版权: ? Microsoft Corporation. All rights reserved.
  文件版本: 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)
  产品名称: Microsoft? Windows? Operating System
  产品版本: 5.1.2600.2696

名称: RavStub.exe(优先级：标准)
  完整路径: d:\Program Files\rising\Rav\RavStub.exe
  发行商: Beijing Rising Technology Co., Ltd.
  描述: Rising RavStub
  版权: Copyright (c) 1998-2005 Rising Corp.
  文件版本: 18, 0, 0, 12
  产品名称: RavStub Application
  产品版本: 18, 0, 0, 12

名称: RfwMain.exe(优先级：标准)
  完整路径: d:\program files\rising\rfw\RfwMain.exe
  发行商: Beijing Rising Technology Co., Ltd.
  描述: Rising Personal FireWall Main Program
  版权: Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited
  文件版本: 4, 0, 0, 48
  产品名称: Rising Personal FireWall 2006
  产品版本: 4, 0, 0, 0

名称: GhostStartService.exe(优先级：标准)
  完整路径: D:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
  发行商: Symantec Corporation
  描述: Norton Ghost Start
  版权: Copyright (C) 1998-2002 Symantec Corp. All rights reserved.
  文件版本: 2003.775
  产品名称: Norton Ghost Start Service
  产品版本: 2003.775

名称: MDM.EXE(优先级：标准)
  完整路径: C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
  发行商: Microsoft Corporation
  描述: Machine Debug Manager
  版权: ? Microsoft Corporation.  All rights reserved.
  文件版本: 7.00.9466
  产品名称: Microsoft? Visual Studio .NET
  产品版本: 7.00.9466

名称: nvsvc32.exe(优先级：标准)
  完整路径: C:\WINDOWS\System32\nvsvc32.exe
  发行商: NVIDIA Corporation
  描述: NVIDIA Driver Helper Service, Version 56.64
  版权: (C) NVIDIA Corporation. All rights reserved.
  文件版本: 6.14.10.5664
  产品名称: NVIDIA Driver Helper Service, Version 56.64
  产品版本: 6.14.10.5664

名称: wdfmgr.exe(优先级：标准)
  完整路径: C:\WINDOWS\system32\wdfmgr.exe
  发行商: Microsoft Corporation
  描述: Windows User Mode Driver Manager
  版权: ? Microsoft Corporation. All rights reserved.
  文件版本: 5.2.3790.1230 built by: DNSRV(bld4act)
  产品名称: Microsoft? Windows? Operating System
  产品版本: 5.2.3790.1230

名称: SOUNDMAN.EXE(优先级：标准)
  完整路径: C:\WINDOWS\SOUNDMAN.EXE
  发行商: Realtek Semiconductor Corp.
  描述: Realtek Sound Manager
  版权: Copyright (c) 2001-2003 Realtek Semiconductor Corp.
  文件版本: 5.1.14
  产品名称: Realtek Sound Manager
  产品版本: 5.1.14

名称: RavTask.exe(优先级：空闲)
  完整路径: D:\Program Files\rising\Rav\RavTask.exe
  发行商: Beijing Rising Technology Co., Ltd.
  描述: RavTimer
  版权: Copyright (c) 1998-2006 Rising Corp.
  文件版本: 18, 0, 0, 22
  产品名称: Rising Antivirus Software
  产品版本: 18, 0, 0, 22

名称: ctfmon.exe(优先级：标准)
  完整路径: C:\WINDOWS\system32\ctfmon.exe
  发行商: Microsoft Corporation
  描述: CTF Loader
  版权: ? Microsoft Corporation. All rights reserved.
  文件版本: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
  产品名称: Microsoft? Windows? Operating System
  产品版本: 5.1.2600.2180

名称: Ravmon.exe(优先级：标准)
  完整路径: D:\Program Files\rising\Rav\Ravmon.exe
  发行商: Beijing Rising Technology Co., Ltd.
  描述: RavMon
  版权: Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited
  文件版本: 18, 0, 0, 99
  产品名称: Rising Anti-Virus Monitor
  产品版本: 18, 0, 0, 99

名称: alg.exe(优先级：标准)
  完整路径: C:\WINDOWS\System32\alg.exe
  发行商: Microsoft Corporation
  描述: Application Layer Gateway Service
  版权: ? Microsoft Corporation. All rights reserved.
  文件版本: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
  产品名称: Microsoft? Windows? Operating System
  产品版本: 5.1.2600.2180

名称: Maxthon.exe(优先级：标准)
  完整路径: D:\Program Files\Maxthon\Maxthon.exe
  发行商: Maxthon International Ltd.
  描述: Maxthon Web Browser
  版权: Copyright (C) 2002
  文件版本: 1, 5, 2, 21
  产品名称: Maxthon Application
  产品版本: 1, 5, 2, 21

名称: WinProcess.exe(优先级：标准)
  完整路径: D:\Program Files\wom\WinProcess.exe
  发行商: Windows优化大师
  描述: Windows优化大师成员，Windows进程管理工具
  版权: 版权所有 (C) 2000-2006 鲁锦
  文件版本: 3.0.6.302
  产品名称: Windows进程管理
  产品版本: 3.0


有没有哪个是异常的！谢谢

请下载并使用HijackThis1.99.1,把HijackThis
                  1.99.1生成的log日志文件的内容贴上来，方便大家分析。

                  有关操作方法可参考：
                  【推荐】反浏览器劫持的一些常用操作
                  http://forum.ikaka.com/topic.asp?board=67&artid=6490491

Logfile of HijackThis v1.99.1
Scan saved at 19:37:17, on 2006-3-7
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
d:\Program Files\rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
d:\Program Files\rising\Rav\Ravmond.exe
C:\WINDOWS\Explorer.EXE
d:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
d:\Program Files\rising\Rav\RavStub.exe
d:\program files\rising\rfw\RfwMain.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\rising\Rav\RavTask.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Program Files\rising\Rav\Ravmon.exe
D:\Program Files\Tencent\QQ\QQ.exe
D:\Program Files\Tencent\QQ\TIMPlatform.exe
D:\Program Files\Tencent\QQ\QQ.exe
D:\Program Files\Maxthon\Maxthon.exe
D:\Downloads\ha_hijackthis_1991\HijackThis.exe

O2 - BHO: ThunderIEHelper - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v14.dll
O2 - BHO: (no name) - {0005A87D-D626-4B3A-84F9-1D9571695F55}? - (no file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}? - (no file)
O2 - BHO: TeachingHandler - {31EBA2E2-58B2-4980-9C41-F12F5F1422C5}? - (no file)
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - d:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162}? - (no file)
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B}? - (no file)
O2 - BHO: (no name) - {ADE50A7A-C3A1-4F2F-860A-89C7AC525213} - C:\WINDOWS\system32\yybho.dll
O2 - BHO: (no name) - {ADE50A7A-C3A1-4F2F-860A-89C7AC525213}? - (no file)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3}? - (no file)
O3 - Toolbar: 金山快译(&K) - {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} - D:\Program Files\Kingsoft\FastAIT 2005\IEBand.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RfwMain] "d:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [RavTask] "d:\Program Files\rising\Rav\RavTask.exe" -system
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &使用迅雷下载 - d:\Program Files\Thunder Network\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - d:\Program Files\Thunder Network\Thunder\getallurl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Program Files\Tencent\QQ\SendMMS.htm
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A}? - D:\Program Files\浩方对战平台\GameClient.exe
O9 - Extra button: 豪杰超级解霸V8 - {367E0A21-8601-4986-9C9A-153BF5ACA118}? - C:\Herosoft\HeroV8\STHSDVD.EXE
O9 - Extra 'Tools' menuitem: 豪杰超级解霸V8 - {367E0A21-8601-4986-9C9A-153BF5ACA118}? - C:\Herosoft\HeroV8\STHSDVD.EXE
O9 - Extra button: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263}? - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: 词霸 - {9A687CA6-D585-4947-9ED9-BE96071F5CD9}? - d:\Program Files\Kingsoft\Powerword 2003\XDictExB.dll
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b}? - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b}? - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3}? - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3}? - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: 东方大典 - {d7489fa7-4f38-da83-e876-ad56f2e8d761} - D:\PROGRA~1\!Sunv\EasyDict\PlugInIE.dll
O9 - Extra 'Tools' menuitem: &Easy Dict - {d7489fa7-4f38-da83-e876-ad56f2e8d761} - D:\PROGRA~1\!Sunv\EasyDict\PlugInIE.dll
O9 - Extra button: 东方大典 - {d7489fa7-4f38-da83-e876-ad56f2e8d761}? - D:\PROGRA~1\!Sunv\EasyDict\PlugInIE.dll
O9 - Extra 'Tools' menuitem: &Easy Dict - {d7489fa7-4f38-da83-e876-ad56f2e8d761}? - D:\PROGRA~1\!Sunv\EasyDict\PlugInIE.dll
O9 - Extra button: 易趣购物 - {DE607141-AC19-421e-866A-6D70ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=5 (file missing)
O9 - Extra 'Tools' menuitem: 易趣购物 - {DE607141-AC19-421e-866A-6D70ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=5 (file missing)
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - d:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - d:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6}? - d:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6}? - d:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683}? - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683}? - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1098956813625
O16 - DPF: {D0A29C6C-AA71-4423-8C4A-5998B774C448} (IEDown Class) - http://download.ourgame.com/IEDown4.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - file://C:\Herosoft\HeroV8\DVDSkin\defskin\HTML\swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = jlu.edu.cn
O17 - HKLM\Software\..\Telephony: DomainName = jlu.edu.cn
O17 - HKLM\System\CCS\Services\Tcpip\..\{F62D65AF-9A15-43D1-807D-4F84DD11B316}: NameServer = 202.198.16.3
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = jlu.edu.cn
O18 - Protocol: dic - {C21F5C32-F57A-4A0D-8E0A-B672691C52D0} - d:\Program Files\Kingsoft\Powerword 2003\XDictExB.dll
O23 - Service: GhostStartService - Symantec Corporation - D:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - d:\program files\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - d:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - d:\Program Files\rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - d:\Program Files\rising\Rav\Ravmond.exe
请帮忙看看