这是我启动项的列表 麻烦给看看
StartupList report, 2004-8-13, 12:12:47
StartupList version: 1.52.2
Started from : D:\programs\hijack\HijackThis.EXE
Detected: Windows XP SP2, v.2149 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2149)
* Using default options
==================================================
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\Program Files\Rising\Rav\Ravmond.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\Program Files\MDL CrossFire Commander 7.0\xfdlink.exe
D:\programs\天网Maze\MazeSvr.exe
C:\WINDOWS\system32\ctfmon.exe
D:\programs\QQ\QQ.exe
F:\软件\客户端上网认证.exe
C:\Program Files\QQ\TIMPlatform.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\baigoo\bgoomain.exe
C:\Program Files\Maxthon\Maxthon.exe
D:\programs\hijack\HijackThis.exe
D:\programs\kingsoft\XDICT.EXE
--------------------------------------------------
Listing of startup folders:
Shell folders Startup:
[C:\Documents and Settings\Administrator\「开始」菜单\程序\启动]
快捷方式 到 QQ.lnk = D:\programs\QQ\QQ.exe
快捷方式 到 客户端上网认证.lnk = ?
--------------------------------------------------
Checking Windows NT UserInit:
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\SYSTEM32\Userinit.exe,C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\egnd.exe
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
IMJPMIG8.1 = "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
PHIME2002ASync = C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
RavTask = "C:\Program Files\Rising\Rav\RavTask.exe" -system
IMSCMig = C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
XFDLINK = "C:\Program Files\MDL CrossFire Commander 7.0\xfdlink.exe"
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
RavStub = "C:\Program Files\Rising\Rav\ravstub.exe" /RUNONCE
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
--------------------------------------------------
File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command
(Default) = NOTEPAD.EXE %1
--------------------------------------------------
Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*
Shell & screensaver key from Registry:
Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\system32\logon.scr
drivers=*Registry value not found*
Policies Shell key:
HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*
--------------------------------------------------
Enumerating Browser Helper
Objects:
(no name) - D:\programs\ACR\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\Program Files\Internet Explorer\Connection Wizard\icwuti1.dll - {1D49D58D-5C84-4B50-8359-D9809BEB2B32}
yPhtb - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll - {33BBE430-0E42-4f12-B075-8D21ACB10DCB}
Anti Fish - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll - {38928D50-8A48-44C2-945F-D2F23F771410}
雅虎助手 - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll - {406F94F0-504F-4a40-8DFD-58B0666ABEBD}
YDragSearch - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL - {62EED7C6-9F02-42f9-B634-98E2899E147B}
(no name) - C:\Progra~1\DoDoorRSSFinder\ActiveBand
Object.dll - {63C55A7F-6E29-8D4F-5C76-4F850F28D13A}
bg - C:\Program Files\baigoo\BGooBHO.dll - {7BDAF75A-0D6F-4F50-AFE9-333D08DF4005}
ThunderBHO - C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_001.dll - {889D2FEB-5411-4565-8998-1DD2C5261283}
(no name) - C:\WINDOWS\System32\wabimp.dll - {AA158CA5-93B4-4cd4-8D8C-BB6F9F515213}
(no name) - D:\programs\ACR\Acrobat\AcroIEFavClient.dll - {AE7CD045-E861-484f-8273-0445EE161910}
(no name) - C:\WINDOWS\system32\flash8.dll - {B8CCDD47-38E4-4CD2-B7FA-3B4B690F74BD}
(no name) - C:\WINDOWS\system32\shdocvw2.dll - {BE442802-3911-46E0-B227-076B15A4EAD3}
(no name) - C:\Progra~1\NetMeeting\conf.dll - {D424FE4E-CAF9-4fdd-BC5F-E6E6B91D53BF}
--------------------------------------------------
Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*
Windows NT checkdisk command:
BootExecute = autocheck autochk *
Windows NT 'Wininit.ini':
PendingFileRenameOperations: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\XERKEMKB\hgz[1].exe|||T
--------------------------------------------------
Enumerating ShellService
ObjectDelayLoad items:
PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\st
object.dll
--------------------------------------------------
End of report, 6,195 bytes
Report generated in 0.266 seconds
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
