看了各位说的我立刻下了个HijackThis扫描了一遍!下面是扫描结果!
Logfile of HijackThis v1.99.1
Scan saved at 15:41:24, on 2006-7-17
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
运行进程:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\WINLOGON.EXE
C:\Program Files\Starsoftcomm\StarCenter\alert.exe
C:\Program Files\Starsoftcomm\StarCenter\StarCenter.exe
C:\Program Files\Starsoftcomm\StarCenter\UpdTray.exe
C:\WINDOWS\system32\conime.exe
C:\WINDOWS\LSASS.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\help\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Rising\Rav\RsAgent.exe
C:\DOCUME~1\Tnnx\LOCALS~1\Temp\3.exe
C:\Program Files\sfx software\svch0st.exe
C:\WINDOWS\system32\conime.exe
E:\软件\新建文件夹\ha-hijackthis1991-xqb\HijackThis.exe
F2 - REG:system.ini: Shell=Explorer.exe 1
F3 - REG:win.ini: load=C:\WINDOWS\rundl132.exe
O1 - Hosts: 61.129.75.124 mir.100888290cs.com
O1 - Hosts: 61.129.75.124 woool.100888290cs.com
O1 - Hosts: 61.129.75.124 www.mir5173.com
O1 - Hosts: 61.129.75.124 ert0003.e76.163ns.com
O1 - Hosts: 222.73.4.246 www.5173a.com
O1 - Hosts: 59.36.96.132 qq.etsoft.com.cn
O3 - Toolbar: 金山快译(&K) - {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} - C:\PROGRA~1\Kingsoft\FASTAI~1\IEBand.dll
O4 - HKLM\..\Run: [Alert] C:\Program Files\Starsoftcomm\StarCenter\alert.exe
O4 - HKLM\..\Run: [StarCenter] C:\Program Files\Starsoftcomm\StarCenter\StarCenter.exe
O4 - HKLM\..\Run: [AutoUpd] C:\Program Files\Starsoftcomm\StarCenter\UpdTray.exe
O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [Torjan Program] C:\WINDOWS\WINLOGON.EXE
O4 - HKLM\..\Run: [explorer.exe] C:\Program Files\explorer.exe
O4 - HKLM\..\Run: [ToP] C:\WINDOWS\LSASS.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [update82] C:\Program Files\Common Files\update\update.exe
O4 - Startup: ADSL超频奇兵 V4.3.lnk = ?
O8 - Extra context menu item: 上传到QQ网络硬盘 - E:\Game\QQGame\AddToNetDisk.htm
O8 - Extra context menu item: 导出到 Microsoft Excel(&x) - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - E:\Game\QQGame\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - E:\Game\QQGame\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - E:\Game\QQGame\SendMMS.htm
O8 - Extra context menu item: 解霸实时播放 - C:\Program Files\Hero3000\MPURLGET.HTM
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - E:\浩方对战平台\浩方对战平台\GameClient.exe
O9 - Extra button: 网址大全 - {1FBA04EE-3024-11D2-8F1F-0000F87ABD18} - http://www.coc.cc (文件故障)
O9 - Extra button: 解霸 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - C:\Program Files\Hero3000\MPLAYER.EXE
O9 - Extra 'Tools' menuitem: 超级解霸 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - C:\Program Files\Hero3000\MPLAYER.EXE
O9 - Extra button: 卓越 - {8DE0FCD4-5EB5-11D3-AD25-00002100131B} - C:\PROGRA~1\Kingsoft\POWERW~1\IEPlugin.dll
O9 - Extra button: 金山词霸 - {C8CE29C5-7589-11D3-B81B-0080C8DC5DC8} - C:\PROGRA~1\Kingsoft\POWERW~1\IEPlugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\cn_spi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cn_spi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cn_spi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cn_spi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cn_spi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cn_spi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cn_spi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cn_spi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cn_spi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cn_spi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cn_spi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cn_spi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cn_spi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cn_spi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cn_spi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cn_spi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cn_spi.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.thtf.com.cn
O17 - HKLM\System\CCS\Services\Tcpip\..\{21856BDE-2D0E-44FB-894F-D45CFCFEFA6E}: NameServer = 202.102.192.68,202.102.199.68
O17 - HKLM\System\CS1\Services\Tcpip\..\{21856BDE-2D0E-44FB-894F-D45CFCFEFA6E}: NameServer = 202.102.192.68,202.102.199.68
O17 - HKLM\System\CS2\Services\Tcpip\..\{21856BDE-2D0E-44FB-894F-D45CFCFEFA6E}: NameServer = 202.102.192.68,202.102.199.68
O20 - AppInit_DLLs: KB49400M.LOG
