HijackThis_zww汉化版扫描日志 V1.99.1保存于 14:46:25, 日期 2007-5-10操作系统： Windows XP SP2 (WinNT 5.01.2600)浏览器： Internet Explorer v6.00 SP2 (6.00.2900.2180)当前运行的进程： C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Rising\Rav\CCenter.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Rising\Rav\Ravmond.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Rising\Rfw\rfwsrv.exeC:\Program Files\Rising\Rav\RavStub.exeC:\Program Files\Rising\Rfw\RfwMain.exeC:\WINDOWS\system32\nvsvc32.exeC:\WINDOWS\system32\drivers\WDelMgr20.exeC:\Program Files\Rising\Rav\RavTask.exeC:\Program Files\Rising\Rav\Ravmon.exeC:\WINDOWS\system32\SafeSignCertReg.exeC:\Program Files\Permeo\e-Border Driver\s5credmgr.exeC:\Program Files\Rising\AntiSpyware\runiep.exeC:\WINDOWS\SOUNDMAN.EXEC:\WINDOWS\system32\Internat.exeC:\Program Files\MSN Messenger\MsnMsgr.ExeC:\Program Files\wnwb\wnwb.exeD:\tools\QQ\QQ.exeC:\Program Files\MSN Messenger\usnsvc.exeD:\tools\QQ\TIMPlatform.exeC:\Program Files\Symantec\pcAnywhere\awrem32.exeD:\tools\QQ\QQ.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\Common Files\Real\Update_OB\realsched.exeD:\tools\HijackThis1991【teyqiu】.exeO2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - 启动项HKLM\\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -systemO4 - 启动项HKLM\\Run: [CertificateRegistration] SafeSignCertReg.exeO4 - 启动项HKLM\\Run: [e-Border Credential] C:\Program Files\Permeo\e-Border Driver\s5credmgr.exeO4 - 启动项HKLM\\Run: [runeip] C:\Program Files\Rising\AntiSpyware\runiep.exeO4 - 启动项HKLM\\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -StartupO4 - 启动项HKLM\\Run: [SoundMan] SOUNDMAN.EXEO4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osbootO4 - HKCU\..\Run: [Internat.exe] Internat.exeO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /backgroundO4 - Startup: QQ游戏启动加速程序.lnk = C:\Program Files\Tencent\QQGAME\Accel.exeO4 - Startup: wnwb.lnk = C:\Program Files\wnwb\wnwb.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions presentO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - D:\tools\QQ\AddToNetDisk.htmO8 - IE右键菜单中的新增项目: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - D:\tools\QQ\AddPanel.htmO8 - IE右键菜单中的新增项目: 添加到QQ表情 - D:\tools\QQ\AddEmotion.htmO8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - D:\tools\QQ\SendMMS.htmO10 - 未知的文件在 Winsock LSP: c:\program files\permeo\e-border driver\s5spi.dllO10 - 未知的文件在 Winsock LSP: c:\program files\permeo\e-border driver\s5spi.dll

O10 - 未知的文件在 Winsock LSP: c:\program files\permeo\e-border driver\s5spi.dllO10 - 未知的文件在 Winsock LSP: c:\program files\permeo\e-border driver\s5spi.dllO10 - 未知的文件在 Winsock LSP: c:\program files\permeo\e-border driver\s5spi.dllO10 - 未知的文件在 Winsock LSP: c:\program files\permeo\e-border driver\s5spi.dllO15 - “受信任的站点”中添加项: easyabc.95599.cnO15 - “受信任的站点”中添加项: www.95599.cnO15 - “受信任的站点”中添加项: http://www.icbc.com.cnO16 - DPF: {5876CAD0-1636-42EA-AC50-4C06F3196089} (HanGamePlugin19 Class) - http://down.hangame.com/dist/activex/HanGamePlugin19.cabO16 - DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} (AxSubmitControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cabO16 - DPF: {9BDBC41E-C335-4263-83C0-ECE78EE28A33} (SysMonOCX Control) - http://www.ahn.com.cn/aspservice/plugin/myfirewall20.cabO16 - DPF: {AA07EBD2-EBDD-4BD6-9F8F-114BD513492C} (NeffyLauncherCtl Class) - http://dist.cdnetworks.co.kr/cdndist/neffynew/NeffyLauncher.cabO16 - DPF: {C044CD87-DFB0-4130-A5E4-49361106FBC8} (HanSetupCtrl1009 Class) - http://r2.hangame.com/common/HanSetup1009.cabO16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/pcver2007/OL2006.cabO16 - DPF: {E787FD25-8D7C-4693-AE67-9406BC6E22DF} (PasswordEditCtrl Class) - https://www.tenpay.com/download/qqedit.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{F7482DDE-562E-49D5-9C9E-B5C447747D96}: NameServer = 192.168.0.253O18 - 列举现有的协议: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLLO18 - 列举现有的协议: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLLO23 - NT 服务: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exeO23 - NT 服务: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exeO23 - NT 服务: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exeO23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rfw\rfwsrv.exeO23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exeO23 - NT 服务: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exeO23 - NT 服务: WDelMgr20 - Unknown owner - C:\WINDOWS\system32\drivers\WDelMgr20.exe