弹出时还会发现病毒:script.Taprao.a\HTA.startpage
附日志
Logfile of HijackThis v1.99.1
Scan saved at 19:11:15, on 2005-12-7
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\WINDOWS\System32\capp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\rising\rfw\Rfw.exe
C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
E:\Storm Downloader\StormDownloader.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
D:\Program Files\Iparmor\Iparmor.exe
C:\WINDOWS\System32\conime.exe
C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
C:\PROGRAM FILES\RISING\RAV\RavStub.exe
c:\program files\rising\rav\RAVMON.EXE
C:\Program Files\Thunder Network\Thunder\Thunder.exe
C:\download\game\新建文件夹\HijackThis.exe
R3 - URLSearchHook: (no name) - {A3AB20B7-35FC-34EB-BC07-47F196EF99A6} - zxc.dll (file missing)
F2 - REG:system.ini: UserInit=userinit.exe,C:\WINDOWS\System32\hosts.exe,
O1 - Hosts: 218.93.16.85 dj99.net
O1 - Hosts: 218.93.16.85 vv66.com
O1 - Hosts: 218.93.16.85 666e.com
O1 - Hosts: 218.93.16.85 qq230.com
O1 - Hosts: 218.93.16.85 5music.org
O1 - Hosts: 218.93.16.85 99music.com
O1 - Hosts: 218.93.16.85 yymp3.com
O1 - Hosts: 218.93.16.85 6y.cn
O1 - Hosts: 218.93.16.85 tt78.com
O1 - Hosts: 218.93.16.85 vv66.net
O1 - Hosts: 218.93.16.85 91f.net
O1 - Hosts: 218.93.16.85 66vv.net
O1 - Hosts: 218.93.16.85 v111.com
O1 - Hosts: 218.93.16.85 cnww.net
O1 - Hosts: 218.93.16.85 wo123.com
O1 - Hosts: 218.93.16.85 ttjj.com
O1 - Hosts: 218.93.16.85 88321.com
O1 - Hosts: 218.93.16.85 432.cn
O1 - Hosts: 218.93.16.85 5566.net
O1 - Hosts: 218.93.16.85 chinavbar.com
O1 - Hosts: 218.93.16.85 kan123.com
O1 - Hosts: 218.93.16.85 t3j4.com
O1 - Hosts: 218.93.16.85 wysw.com
O1 - Hosts: 218.93.16.85 fhvcd.com
O1 - Hosts: 218.93.16.85 movie4.com
O1 - Hosts: 218.93.16.85 chinasee.net
O1 - Hosts: 218.93.16.85 freefilm.cn
O1 - Hosts: 218.93.16.85 kan5.com
O1 - Hosts: 218.93.16.85 88860.com
O1 - Hosts: 218.93.16.85 free-movie.org
O1 - Hosts: 218.93.16.85 qq001.com
O1 - Hosts: 218.93.16.85 xk88.com
O1 - Hosts: 218.93.16.85 topdy.com
O1 - Hosts: 218.93.16.85 sunmovie.net
O1 - Hosts: 218.93.16.85 klyy.net
O1 - Hosts: 218.93.16.85 700600.com
O1 - Hosts: 218.93.16.85 365ww.com
O1 - Hosts: 218.93.16.85 postadult.com
O1 - Hosts: 218.93.16.85 cococn.com
O1 - Hosts: 218.93.16.85 sexy-books.com
O1 - Hosts: 218.93.16.85 18-girl.net
O1 - Hosts: 218.93.16.85 cnxxx.com
O1 - Hosts: 218.93.16.85 w12345.com
O1 - Hosts: 218.93.16.85 www.139mm.com
O1 - Hosts: 218.93.16.85 www.qq78.com
O1 - Hosts: 218.93.16.85 link8.com
O1 - Hosts: 218.93.16.85 yes-movies.com
O1 - Hosts: 218.93.16.85 5isex.com
O1 - Hosts: 218.93.16.85 v23.com
O1 - Hosts: 218.93.16.85 9i0.com
O1 - Hosts: 218.93.16.85 woogood.com
O1 - Hosts: 218.93.16.85 168101.com
O1 - Hosts: 218.93.16.85 flash51.com
O1 - Hosts: 218.93.16.85 yingku.com
O1 - Hosts: 218.93.16.85 gaoshou.net
O1 - Hosts: 218.93.16.85 139mm.com
O1 - Hosts: 218.93.16.85 vodfans.com
O1 - Hosts: 218.93.16.85 h2004.com
O1 - Hosts: 218.93.16.85 kan51.com
O1 - Hosts: 218.93.16.85 k369.com
O1 - Hosts: 218.93.16.85 zhss.com
O1 - Hosts: 218.93.16.85 dlmovie.com
O1 - Hosts: 218.93.16.85 www.gaoshou.net
O1 - Hosts: 218.93.16.85 www.yingku.com
O1 - Hosts: 218.93.16.85 www.flash51.com
O1 - Hosts: 218.93.16.85 www.168101.com
O1 - Hosts: 218.93.16.85 www.woogood.com
O1 - Hosts: 218.93.16.85 www.cnxp.com
O1 - Hosts: 218.93.16.85 bt.cnxp.com
O1 - Hosts: 218.93.16.85 bbs.cnxp.com
O1 - Hosts: 218.93.16.85 cnxp.com
O1 - Hosts: 218.93.16.85 musicfbi.com
O1 - Hosts: 218.93.16.85 www.musicfbi.com
O1 - Hosts: 218.93.16.85 pics.skyhits.com
O1 - Hosts: 218.93.16.85 pic.9i0.com
O1 - Hosts: 218.93.16.85 www.9i0.com
O1 - Hosts: 218.93.16.85 flash.9i0.com
O1 - Hosts: 218.93.16.85 mp3.9i0.com
O1 - Hosts: 218.93.16.85 skyhits.com
O1 - Hosts: 218.93.16.85 www.skyhits.com
O1 - Hosts: 218.93.16.85 btchina.net
O1 - Hosts: 218.93.16.85 www.btchina.net
O1 - Hosts: 218.93.16.85 9617.com
O1 - Hosts: 218.93.16.85 www.x365x.net
O1 - Hosts: 218.93.16.85 www.x365x.com
O1 - Hosts: 218.93.16.85 17777.com
O1 - Hosts: 218.93.16.85 www.17777.com
O1 - Hosts: 218.93.16.85 51115.com
O1 - Hosts: 218.93.16.85 www.51115.com
O1 - Hosts: 218.93.16.85 www.v23.com
O1 - Hosts: 218.93.16.85 91f.cn
O1 - Hosts: 218.93.16.85 www.91f.cn
O1 - Hosts: 218.93.16.85 www.5isex.com
O1 - Hosts: 218.93.16.85 www.yes-movies.com
O1 - Hosts: 218.93.16.85 www.link8.com
O1 - Hosts: 218.93.16.85 55025.net
O1 - Hosts: 218.93.16.85 91f.org
O1 - Hosts: 218.93.16.85 www.91f.org
O1 - Hosts: 218.93.16.85 da123.com
O1 - Hosts: 218.93.16.85 www.da123.com
O1 - Hosts: 218.93.16.85 3tom.com
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\System32\xunleibho_v8.dll
O2 - BHO: CNNIC_IDN - {35980F6E-A137-4E50-953D-813BB8556899} - C:\WINDOWS\System32\CdnIEHlp.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - G:\QQ\QQIEHelper.dll
O2 - BHO: 百度超级搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\WINDOWS\DOWNLO~1\BaiDuBar.dll (file missing)
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - (no file)
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: 金山快译(&K) - {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} - d:\PROGRA~1\Kingsoft\FASTAI~1\IEBand.dll
O3 - Toolbar: 上网助手 - {1B0E7716-898E-48cc-9690-4E338E8DE1D3} - C:\PROGRA~1\3721\Assist\assist.dll
O3 - Toolbar: 百度超级搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\WINDOWS\DOWNLO~1\BaiDuBar.dll (file missing)
O3 - Toolbar: (no name) - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - (no file)
O4 - HKLM\..\Run: [CApp] C:\WINDOWS\System32\capp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [rfw] C:\Program Files\rising\rfw\Rfw.exe
O4 - HKLM\..\Run: [RavTimer] C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [RavMon] C:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [迅雷4] C:\Program Files\Thunder Network\Thunder\TDUpdate.exe
O4 - HKLM\..\Run: [MINI_BFYY] E:\Storm Downloader\StormDownloader.exe
O4 - HKLM\..\Run: [StormCodec_Helper] "\StormSet.exe" /S /opti
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\RunOnce: [RavStub] "C:\PROGRAM FILES\RISING\RAV\ravstub.exe" /RUNONCE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [WareOut] "C:\Program Files\WareOut\WareOut.exe"
O4 - Startup: 腾讯QQ.LNK = G:\QQ\QQ.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &使用暴风下载器下载 - E:\Storm Downloader\geturl.htm
O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\getallurl.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - G:\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - G:\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - G:\QQ\SendMMS.htm
O8 - Extra context menu item: 百度-搜索MP3 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUMP3.HTM
O8 - Extra context menu item: 百度-搜索图片 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUIMG.HTM
O8 - Extra context menu item: 百度-搜索新闻 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUNEWS.HTM
O8 - Extra context menu item: 百度-搜索歌词 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDULYRIC.HTM
O8 - Extra context menu item: 百度-搜索网页 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUSEARCH.HTM
O8 - Extra context menu item: 百度-搜索贴吧 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUPOST.HTM
O8 - Extra context menu item: 百度-词典搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDU_DIC.HTM
O8 - Extra context menu item: 解霸实时播放 - C:\HEROSOFT\Hero3000\MPURLGET.HTM
O9 - Extra button: kele8 - {84920E5F-3788-49cd-A274-E365578DF174} - http://www.kele8.com/ (file missing)
O9 - Extra 'Tools' menuitem: kele8 - {84920E5F-3788-49cd-A274-E365578DF174} - http://www.kele8.com/ (file missing)
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - G:\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - G:\QQ\QQ.EXE
O9 - Extra button: 易趣购物 - {DE60714F-AC17-427e-861A-FD60CBDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=1 (file missing)
O9 - Extra 'Tools' menuitem: 易趣购物 - {DE60714F-AC17-427e-861A-FD60CBDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=1 (file missing)
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - G:\QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - G:\QQ\QQIEHelper.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O17 - HKLM\System\CCS\Services\Tcpip\..\{22AAF31D-26F7-423E-9CD9-57D6F144A4E5}: NameServer = 69.50.184.86,85.255.112.9
O17 - HKLM\System\CCS\Services\Tcpip\..\{54E3177E-B161-488D-B265-06552C56CA5E}: NameServer = 69.50.184.86 85.255.112.9
O17 - HKLM\System\CCS\Services\Tcpip\..\{A6848213-6294-455A-874D-87ECD2D116FC}: NameServer = 69.50.184.86,85.255.112.9
O17 - HKLM\System\CS1\Services\Tcpip\..\{22AAF31D-26F7-423E-9CD9-57D6F144A4E5}: NameServer = 69.50.184.86,85.255.112.9
O17 - HKLM\System\CS2\Services\Tcpip\..\{22AAF31D-26F7-423E-9CD9-57D6F144A4E5}: NameServer = 69.50.184.86,85.255.112.9
O20 - AppInit_DLLs: apihookdll.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
