请各位高手帮忙看一下,我的电脑一点IE浏览器就直接重启,但是我用MSN的浏览器就不会出现这种情况!用瑞星的杀毒一下,查出有Trojan.Agent.ddj和Trojan.Agnet.clj病毒,可是杀完后,一点IE还是会重启啊,请帮忙看一下日志~
Logfile of HijackThis v1.99.1
Scan saved at 20:06:00, on 2006-7-15
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rising\Rav\Ravmond.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN\MSNCoreFiles\msn6.exe
C:\PROGRA~1\MSNMES~1\msnmsgr.exe
D:\426101200522225654\HijackThis.exe
R3 - URLSearchHook: (no name) - {6A98E1D8-3234-44EE-B839-BD72C59FEF61} - C:\WINDOWS\System32\Qxubln.dll
R3 - URLSearchHook: (no name) - {67D25217-0E82-4EA3-9CF3-27B6F160262B} - C:\WINDOWS\System32\Gurah.dll
R3 - URLSearchHook: (no name) - {7055DC85-8F1A-4FD0-8872-9E3C95C8F130} - C:\WINDOWS\System32\Pquu.dll
R3 - URLSearchHook: (no name) - {3A6312DB-8CCC-4AF8-A82F-2C86380AFC73} - C:\WINDOWS\System32\Icqblq.dll
R3 - URLSearchHook: (no name) - {E7BEA661-5977-4F47-A1EF-747DC74964FC} - C:\WINDOWS\System32\Olokl.dll
R3 - URLSearchHook: (no name) - {12461531-8CC6-4A18-AAAE-FB353DAD9A55} - C:\WINDOWS\System32\Qkda.dll
R3 - URLSearchHook: (no name) - {E2D4257F-67FA-4BE6-A2C3-68D500B65518} - C:\WINDOWS\System32\Nsoth.dll
R3 - URLSearchHook: (no name) - {270CDE7D-66A6-4A20-905B-FAB677261F83} - C:\WINDOWS\System32\Laqwtq.dll
R3 - URLSearchHook: (no name) - {43C39549-58C1-4CAE-BCC1-E18D6780BD6F} - C:\WINDOWS\System32\Kiuft.dll
R3 - URLSearchHook: (no name) - {5E4797B4-FD6B-4D82-A2E4-AA3B4FD634DE} - C:\WINDOWS\System32\Qifcd.dll
R3 - URLSearchHook: (no name) - {C0747786-2BB9-447E-9507-5FFE94B59A7E} - C:\WINDOWS\System32\Hmhvz.dll
R3 - URLSearchHook: (no name) - {8D62D61B-7F46-41CE-9332-A13E9633B539} - C:\WINDOWS\System32\Zwxhv.dll
R3 - URLSearchHook: (no name) - {81A705E6-664E-4B8F-9215-4FBEE5DA2E8D} - C:\WINDOWS\System32\Moaj.dll
R3 - URLSearchHook: (no name) - {33776BDB-F6F5-4992-BD4C-CE63C8DEEBB4} - C:\WINDOWS\System32\Ildgrm.dll
R3 - URLSearchHook: (no name) - {87B26D81-ACAA-4414-8A7E-A1B51B570ED0} - C:\WINDOWS\System32\Gqsh.dll
R3 - URLSearchHook: (no name) - {B25C00D9-F238-43AD-8AF8-184053B9DFC6} - C:\WINDOWS\System32\Jbhufj.dll
R3 - URLSearchHook: (no name) - {B3940BB0-D624-480A-8ACE-9F16170995A1} - C:\WINDOWS\System32\Mzlemj.dll
R3 - URLSearchHook: (no name) - {9A29B46C-2320-4EFB-BF8F-4F6F955B044E} - C:\WINDOWS\System32\Nmjdz.dll
R3 - URLSearchHook: (no name) - {FD7DB03A-0857-4ECC-A63D-B6402B5026A5} - C:\WINDOWS\System32\Rldk.dll
R3 - URLSearchHook: (no name) - {7EC85D9B-6720-45C4-840E-E517276AAD44} - C:\WINDOWS\System32\Rsci.dll
O1 - Hosts: 218.12.214.125 www.jjwxc.com
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\System32\xunleibho_v4.dll
O2 - BHO: (no name) - {12461531-8CC6-4A18-AAAE-FB353DAD9A55} - C:\WINDOWS\System32\Qkda.dll
O2 - BHO: (no name) - {270CDE7D-66A6-4A20-905B-FAB677261F83} - C:\WINDOWS\System32\Laqwtq.dll
O2 - BHO: (no name) - {33776BDB-F6F5-4992-BD4C-CE63C8DEEBB4} - C:\WINDOWS\System32\Ildgrm.dll
O2 - BHO: (no name) - {3A6312DB-8CCC-4AF8-A82F-2C86380AFC73} - C:\WINDOWS\System32\Icqblq.dll
O2 - BHO: NaviHelperObj Class - {3E422F49-1566-40D3-B43D-077EF739AC32} - C:\WINDOWS\System32\NaviHelper.dll
O2 - BHO: (no name) - {43C39549-58C1-4CAE-BCC1-E18D6780BD6F} - C:\WINDOWS\System32\Kiuft.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: (no name) - {5E4797B4-FD6B-4D82-A2E4-AA3B4FD634DE} - C:\WINDOWS\System32\Qifcd.dll
O2 - BHO: (no name) - {669751ED-D558-49AE-B01A-3B374CC7910E} - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\SSLive.dll
O2 - BHO: (no name) - {67D25217-0E82-4EA3-9CF3-27B6F160262B} - C:\WINDOWS\System32\Gurah.dll
O2 - BHO: (no name) - {6A98E1D8-3234-44EE-B839-BD72C59FEF61} - C:\WINDOWS\System32\Qxubln.dll
O2 - BHO: (no name) - {7055DC85-8F1A-4FD0-8872-9E3C95C8F130} - C:\WINDOWS\System32\Pquu.dll
O2 - BHO: (no name) - {7EC85D9B-6720-45C4-840E-E517276AAD44} - C:\WINDOWS\System32\Rsci.dll
O2 - BHO: (no name) - {81A705E6-664E-4B8F-9215-4FBEE5DA2E8D} - C:\WINDOWS\System32\Moaj.dll
O2 - BHO: (no name) - {87B26D81-ACAA-4414-8A7E-A1B51B570ED0} - C:\WINDOWS\System32\Gqsh.dll
O2 - BHO: (no name) - {8D62D61B-7F46-41CE-9332-A13E9633B539} - C:\WINDOWS\System32\Zwxhv.dll
O2 - BHO: (no name) - {9A29B46C-2320-4EFB-BF8F-4F6F955B044E} - C:\WINDOWS\System32\Nmjdz.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\Program Files\FLASHGET\jccatch.dll
O2 - BHO: (no name) - {A9930D97-9CF0-42A0-A10D-4F28836579D5} - C:\PROGRA~1\KuGoo3\KUGOO3~1.OCX
O2 - BHO: (no name) - {B25C00D9-F238-43AD-8AF8-184053B9DFC6} - C:\WINDOWS\System32\Jbhufj.dll
O2 - BHO: (no name) - {B3940BB0-D624-480A-8ACE-9F16170995A1} - C:\WINDOWS\System32\Mzlemj.dll
O2 - BHO: (no name) - {C0747786-2BB9-447E-9507-5FFE94B59A7E} - C:\WINDOWS\System32\Hmhvz.dll
O2 - BHO: IEHlprObj Class - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - C:\WINDOWS\System32\IEHelper.dll
O2 - BHO: (no name) - {E2D4257F-67FA-4BE6-A2C3-68D500B65518} - C:\WINDOWS\System32\Nsoth.dll
O2 - BHO: (no name) - {E7BEA661-5977-4F47-A1EF-747DC74964FC} - C:\WINDOWS\System32\Olokl.dll
O2 - BHO: (no name) - {FD7DB03A-0857-4ECC-A63D-B6402B5026A5} - C:\WINDOWS\System32\Rldk.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: 腾讯QQ.lnk = C:\Program Files\Tencent\QQ\QQ.exe
O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 使用KuGoo3下载(&K) - C:\Program Files\KuGoo3\KuGoo3DownX.htm
O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\FLASHGET\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\FLASHGET\jc_all.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm
O8 - Extra context menu item: 用比特精灵下载(&B) - C:\Program Files\BitSpirit\bsurl.htm
O9 - Extra button: 手机短信 - {00000000-0000-0001-0001-596BAEDD1289} - http://sms.3721.com/ie/index.htm?pid=U_3721_assist (file missing)
O9 - Extra button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.mail.yahoo.com/promo/rd1 (file missing)
O9 - Extra button: 上网助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://assistant.3721.com/index.htm?fb=Cns (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FLASHGET\flashget.exe
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/088223990a41704cde05/netzip/RdxIE601_cn.cab
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {D0A29C6C-AA71-4423-8C4A-5998B774C448} (IEDown Class) - http://download.ourgame.com/IEDown4.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: KB3516772.LOG
O21 - SSODL: SysTrays - {590498A3-4131-4D8F-BA4B-36791A9803B1} - C:\WINDOWS\System32\DLMain.dll (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
