招徕病毒无数,实在我没招了,请各位大虾帮忙瞧瞧日志
HijackThis_zww汉化版扫描日志 V1.99.1
保存于 10:46:52, 日期 2008-2-27
操作系统： Windows XP SP2 (WinNT 5.01.2600)
浏览器： Internet Explorer v7.00 (7.00.6000.16608)
当前运行的进程：
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec\SPA\smc.exe
C:\Program Files\Rising\Rav\Ravmond.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Rising\Rav\RavService.exe
C:\Program Files\Symantec\SPA\SmcGui.exe
C:\Program Files\Rising\Rav\RavTray.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Rising\AntiSpyware\runiep.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Windows Desktop Search\WindowsSearchIndexer.exe
D:\Program Files\AutoCAD 2004\acad.exe
C:\DOCUME~1\ADMINI~1.MIC\LOCALS~1\Temp\~e5d141.tmp
C:\Program Files\Common Files\Autodesk Shared\WSCommCntr1.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Rising\Rav\rav.exe
C:\Program Files\Rising\Rav\RsAgent.exe
C:\WINDOWS\msagent\AgentSvr.exe
D:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
E:\HijackThis1991zww.exe
O2 - BHO: Promote Class - {0FA24E3E-422C-4D94-A125-104F32352C90} - C:\WINDOWS\system32\promote.dll
O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll
O2 - BHO: AliAnti Fish - {38938D50-8A48-44C2-945F-D2F23F771410} - C:\PROGRA~1\Alisoft\Toolbar\assist\yangling.dll
O2 - BHO: (no name) - {4D2EAF15-81D0-42DA-8C39-19EDD39E0FB3} - C:\WINDOWS\system32\rwauakshlm.dll
O2 - BHO: AssistHelper - {FE3FCAE7-0A37-4506-8A7D-3CC9A04D2CA8} - C:\Program Files\Alisoft\Toolbar\Assist\yassist.dll
O3 - IE工具栏增项: 淘宝工具条 - {78B2F60E-AFA5-4d3d-A49E-2BFF013D9D23} - C:\PROGRA~1\Alisoft\Toolbar\Assist\yasbar.dll
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [RavTray] "C:\Program Files\Rising\Rav\RavTray.exe"
O4 - 启动项HKLM\\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [runeip] "C:\Program Files\Rising\AntiSpyware\runiep.exe" /startup
O4 - 启动项HKLM\\RunOnce: [KKDelay] C:\Program Files\Rising\AntiSpyware\RunOnce.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - 浏览器额外的按钮: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - 浏览器额外的“工具”菜单项: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - 浏览器额外的按钮: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - 浏览器额外的“工具”菜单项: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {F2EB8999-766E-4BF6-AAAD-188D398C0D0B} (PBActiveX40 Control) - http://szdl.cmbchina.com/download/PB/pb50.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{292D0FEC-1B12-41D6-9969-39B7014F1CB0}: NameServer = 202.102.152.3
O17 - HKLM\System\CCS\Services\Tcpip\..\{30064F6B-F0C1-4ED2-8CB5-20948909890B}: NameServer = 202.102.152.3
O17 - HKLM\System\CS1\Services\Tcpip\..\{292D0FEC-1B12-41D6-9969-39B7014F1CB0}: NameServer = 202.102.152.3
O17 - HKLM\System\CS2\Services\Tcpip\..\{292D0FEC-1B12-41D6-9969-39B7014F1CB0}: NameServer = 202.102.152.3
O23 - NT 服务: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - NT 服务: RavService - Unknown owner - C:\Program Files\Rising\Rav\RavService.exe" /service (file missing)
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
O23 - NT 服务: Symantec Protection Agent 5.1 (SmcService) - Symantec Corporation. - C:\Program Files\Symantec\SPA\smc.exe
[用户系统信息]Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727)
