中了/瑞星打不开.....日志如下
Logfile of HijackThis v1.99.1
Scan saved at 19:52:48, on 2006-10-5
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
d:\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
d:\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
d:\Rising\Rav\RavStub.exe
D:\Rising\Rav\RavTask.exe
D:\Rising\Rfw\rfwmain.exe
C:\Program Files\MSI\Live Update 3\LMonitor.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
D:\Moliyo\海盗王Online\system\game.exe
C:\WINDOWS\system32\1.exe
C:\WINDOWS\Download\svhost32.exe
C:\WINDOWS\system32\conime.exe
E:\Tencent\QQ\QQ.exe
E:\Tencent\QQ\TIMPlatform.exe
E:\Tencent\TT\TTraveler.exe
C:\Documents and Settings\Administrator\桌面\ha_hijackthis_1991\HijackThis.exe
R3 - URLSearchHook: (no name) - {6D53ADB7-6AD5-4A59-BFE4-7B57D2F4AA89} - (no file)
F2 - REG:system.ini: UserInit=userinit.exe,
O1 - Hosts: 59.34.197.239 www.baidu.com
O1 - Hosts: 59.34.197.239 baidu.com
O1 - Hosts: 59.34.197.239 www.sohu.com
O1 - Hosts: 59.34.197.239 sohu.com
O1 - Hosts: 59.34.197.239 www.sina.com
O1 - Hosts: 59.34.197.239 sina.com
O1 - Hosts: 59.34.197.239 www.sina.com.cn
O1 - Hosts: 59.34.197.239 sina.com.cn
O1 - Hosts: 59.34.197.239 www.163.com
O1 - Hosts: 59.34.197.239 163.com
O1 - Hosts: 59.34.197.239 www.google.com
O1 - Hosts: 59.34.197.239 google.com
O1 - Hosts: 59.34.197.239 www.qq.com
O1 - Hosts: 59.34.197.239 qq.com
O1 - Hosts: 59.34.197.239 www.hao123.com
O1 - Hosts: 59.34.197.239 hao123.com
O1 - Hosts: 59.34.197.239 ttlttt.com
O1 - Hosts: 203.171.236.215 www.17173.com
O1 - Hosts: 203.171.236.215 www.wowchina.com
O1 - Hosts: 203.171.236.215 www.ztgame.com.cn
O1 - Hosts: 203.171.236.215 rxjh.17game.com
O1 - Hosts: 203.171.236.215 www.17game.com
O1 - Hosts: 203.171.236.215 www.kd171.cn
O1 - Hosts: 203.171.236.215 www.72g.com
O1 - Hosts: 203.171.236.215 www.muchina.com
O1 - Hosts: 203.171.236.215 xyq.163.com
O1 - Hosts: 203.171.236.215 xy2.163.com
O1 - Hosts: 203.171.236.215 www.the9.com
O1 - Hosts: 203.171.236.215 www.5173.com
O1 - Hosts: 203.171.236.215 www.tkgame.com
O2 - BHO: WebThunderBHO - {00000AAA-A363-466E-BEF5-9BB68697AA7F} - d:\Thunder Network\WebThunder\WebThunderBHO_013.dll
O2 - BHO: (no name) - {08A312BB-5409-49FC-9347-54BB7D069AC6} - (no file)
O2 - BHO: MyIEHelper Class - {16B770A0-0E87-4278-B748-2460D64A8386} - C:\Documents and Settings\All Users\Application Data\Microsoft\UserData\IEHelper_5071.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - e:\Tencent\QQ\QQIEHelper.dll
O2 - BHO: (no name) - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - (no file)
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - D:\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll
O2 - BHO: XBTP03129 - {B07D1F6B-6B8C-4904-8EE8-5E5A2B4624B3} - (no file)
O2 - BHO: (no name) - {D11D0862-0390-4884-A95C-4702D0D4C11A} - (no file)
O2 - BHO: Internet Explorer ActiveX - {EE7C3CF0-4B15-11D1-ABED-709549C10001} - C:\PROGRA~1\INTERN~1\CONNEC~1\iccon.dll
O4 - HKLM\..\Run: [RavTask] "d:\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [RfwMain] "d:\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [LiveMonitor] C:\Program Files\MSI\Live Update 3\LMonitor.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [xy] C:\WINDOWS\Download\svhost32.exe
O4 - HKLM\..\Run: [wdfmgr32] C:\WINDOWS\system32\wdfmgr32.exe
O4 - HKLM\..\RunOnce: [RavStub] "d:\Rising\Rav\ravstub.exe" /RUNONCE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &使用迅雷下载 - D:\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: 使用Web迅雷下载 - d:\Thunder Network\WebThunder\GetUrl.htm
O9 - Extra button: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - D:\Thunder Network\Thunder\Thunder.exe
O9 - Extra 'Tools' menuitem: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - D:\Thunder Network\Thunder\Thunder.exe
O9 - Extra button: 启动Web迅雷 - {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} - http://my.xunlei.com (file missing)
O9 - Extra 'Tools' menuitem: 启动Web迅雷 - {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} - http://my.xunlei.com (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\msplus1.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\msplus1.dll
O11 - Options group: [CDNCLIENT] 中文上网
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (CEditCtrl
Object) - https://img.alipay.com/download/1007/aliedit.cab
O16 - DPF: {C661F36D-DF85-4EF4-83C7-E107B83D04B1} (WebActivater Control) - http://dl_dir.qq.com/3dshow/3DShowVM.cab
O16 - DPF: {E787FD25-8D7C-4693-AE67-9406BC6E22DF} (CPasswordEditCtrl
Object) - https://password.qq.com/download/qqedit.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0B8A7B9A-A92B-4E1C-A317-C328E1AA8E41}: NameServer = 202.109.15.135,202.96.209.134
O17 - HKLM\System\CS1\Services\Tcpip\..\{0B8A7B9A-A92B-4E1C-A317-C328E1AA8E41}: NameServer = 202.109.15.135,202.96.209.134
O17 - HKLM\System\CS2\Services\Tcpip\..\{0B8A7B9A-A92B-4E1C-A317-C328E1AA8E41}: NameServer = 202.109.15.135,202.96.209.134
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - d:\rising\rfw\rfwproxy.exe
