1   1  /  1  页   跳转

【求助】帮我看我的日志!

【求助】帮我看我的日志!

HijackThis_815汉化版扫描日志 V1.99.1
保存于      3:47:39, 日期 2005-11-26
操作系统:  Windows XP SP1 (WinNT 5.01.2600)
浏览器:    Internet Explorer v6.00 SP1 (6.00.2800.1106)

当前运行的进程:         
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
C:\PROGRAM FILES\RISING\RAV\RavStub.exe
C:\WINDOWS.0\system32\spoolsv.exe
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\WINDOWS.0\Explorer.EXE
C:\WINDOWS.0\soundman.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
C:\PROGRA~1\RISING\RAV\RAVMON.EXE
C:\WINDOWS.0\System32\ctfmon.exe
F:\4842302005817230232\HijackThis1991zww.exe

O1 - Hosts: 202.145.176.9 zhcw.com.cn
O1 - Hosts: 202.145.176.9 www.zhcw.com.cn
O1 - Hosts: 202.145.176.9 hcw.cn
O1 - Hosts: 202.145.176.9 www.hcw.cn
O1 - Hosts: 202.145.176.9 hcw123.com
O1 - Hosts: 202.145.176.9 www.hcw123.com
O1 - Hosts: 202.145.176.9 zhcwshop.com
O1 - Hosts: 202.145.176.9 www.zhcwshop.com
O1 - Hosts: 202.145.176.9 zhcw.comc.cn
O1 - Hosts: 202.145.176.9 www.zhcw.comc.cn
O1 - Hosts: 202.145.176.9 smswriter.com
O1 - Hosts: 202.145.176.9 www.smswriter.com
O1 - Hosts: 202.145.176.9 bf.smswriter.com
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS.0\System32\xunleibho_v8.dll
O3 - IE工具栏增项: 彩票中奖通 - {954F618B-0DEC-4D1A-9317-E0FC96F87865} - E:\3D彩票中奖通\smsband.dll (file missing)
O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS.0\System32\msdxm.ocx
O4 - 启动项HKLM\\Run: [SoundMan] soundman.exe
O4 - 启动项HKLM\\Run: [internat.exe] internat.exe
O4 - 启动项HKLM\\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - 启动项HKLM\\Run: [RavTimer] C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
O4 - 启动项HKLM\\Run: [RavMon] C:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS.0\System32\ctfmon.exe
O8 - IE右键菜单中的新增项目: &使用迅雷下载 - F:\mini\geturl.htm
O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - F:\mini\getallurl.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{9A79F006-2ED1-4EFA-9338-BBB9FF446A04}: NameServer = 202.96.69.38 202.96.64.68
O18 - 列举现有的协议: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - rising - C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe

哪些有问题,开始出现的那些网站什么意思呀?
最后编辑2005-11-26 14:14:27
分享到:
gototop
 

经过我自己的分析后,我自己修改了一下,之后再次扫描,请大家指教:

HijackThis_815汉化版扫描日志 V1.99.1
保存于      4:05:05, 日期 2005-11-26
操作系统:  Windows XP SP1 (WinNT 5.01.2600)
浏览器:    Internet Explorer v6.00 SP1 (6.00.2800.1106)

当前运行的进程:         
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
C:\PROGRAM FILES\RISING\RAV\RavStub.exe
C:\WINDOWS.0\system32\spoolsv.exe
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\WINDOWS.0\Explorer.EXE
C:\WINDOWS.0\soundman.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
C:\PROGRA~1\RISING\RAV\RAVMON.EXE
C:\WINDOWS.0\System32\ctfmon.exe
F:\4842302005817230232\HijackThis1991zww.exe

O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS.0\System32\xunleibho_v8.dll
O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS.0\System32\msdxm.ocx
O4 - 启动项HKLM\\Run: [SoundMan] soundman.exe
O4 - 启动项HKLM\\Run: [internat.exe] internat.exe
O4 - 启动项HKLM\\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - 启动项HKLM\\Run: [RavTimer] C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
O4 - 启动项HKLM\\Run: [RavMon] C:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS.0\System32\ctfmon.exe
O8 - IE右键菜单中的新增项目: &使用迅雷下载 - F:\mini\geturl.htm
O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - F:\mini\getallurl.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{9A79F006-2ED1-4EFA-9338-BBB9FF446A04}: NameServer = 202.96.69.38 202.96.64.68
O18 - 列举现有的协议: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - rising - C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe

gototop
 

解决是解决了
我现在怀疑这个项:
O17 - HKLM\System\CCS\Services\Tcpip\..\{9A79F006-2ED1-4EFA-9338-BBB9FF446A04}: NameServer = 202.96.69.38 202.96.64.68
gototop
 

还有这个O18 - 列举现有的协议: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

后面显示文件缺失,可是这个DLL明明在MSN的文件夹里
gototop
 

太谢谢你了!!!
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT