.Wwq613
HijackThis_815汉化版扫描日志 V1.99.1
保存于 10:37:16, 日期 2006-12-30
操作系统： Windows 2000 SP4 (WinNT 5.00.2195)
浏览器： Internet Explorer v6.00 SP1 (6.00.2800.1106)
当前运行的进程：
F:\WINNT\System32\smss.exe
F:\WINNT\system32\winlogon.exe
F:\WINNT\system32\services.exe
F:\WINNT\system32\lsass.exe
F:\WINNT\system32\svchost.exe
F:\WINNT\System32\WBEM\WinMgmt.exe
F:\WINNT\Explorer.EXE
F:\WINNT\System32\svchost.exe
F:\Program Files\360safe\safemon\360tray.exe
F:\WINNT\rund1132.exe
F:\Program Files\Internet Explorer\IEXPLORE.EXE
F:\Program Files\WinRAR\WinRAR.exe
F:\DOCUME~1\chawen\LOCALS~1\Temp\Rar$EX00.823\HijackThis1991zww.exe
F:\WINNT\system32\NOTEPAD.EXE
O2 - BHO: NavigatMon Class - {B69F34DD-F0F9-42DC-9EDD-957187DA688D} - F:\Program Files\360safe\safemon\safemon.dll
O3 - IE工具栏增项: @msdxmLC.dll,-1@2052,电台(＆R) - {8E718888-423F-11D2-876E-00A0C9082467} - F:\WINNT\system32\msdxm.ocx
O4 - 启动项HKLM\\Run: [Synchronization Manager] mobsync.exe /logon
O4 - 启动项HKLM\\Run: [KAVPersonal50] ＂F:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe＂ /minimize
O4 - 启动项HKLM\\Run: [360Safetray] F:\Program Files\360safe\safemon\360tray.exe
O4 - 启动项HKLM\\RunOnce: [360Safe] Rundll32.exe F:\PROGRA~1\360safe\AntiAdwa.dll,KillAdware
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O4 - HKCU\..\Run: [MsnMsgr] ＂F:\Program Files\MSN Messenger\MsnMsgr.Exe＂ /background
O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - F:\WINNT\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show ＆Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - F:\WINNT\web\related.htm
O9 - 浏览器额外的按钮: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - F:\Program Files\Yahoo!\Messenger\YahooMessenger.exe dngz.net您的电脑医生
O9 - 浏览器额外的“工具”菜单项: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - F:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O10 - 未知的文件在 Winsock LSP: f:\winnt\system32\hssound6.dll
O10 - 未知的文件在 Winsock LSP: f:\winnt\system32\hssound6.dll
O16 - DPF: {448A5F6B-8C03-4B54-A338-F00237C508AD} - http://www.51uc.com/cab/WEBChatRoom_1_55.cab
O16 - DPF: {A3CD7F74-93C9-4BC4-B892-CCDF1514F714} (Submit Class) - https://pbank.95559.com.cn/personbank/ocx/safe.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = sfzhcenter.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{122B7E2A-BA6B-45BE-B1D8-CB5B6DECAB3F}: NameServer = 192.9.1.1,202.96.209.133
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = sfzhcenter.com
O17 - HKLM\System\CS1\Services\Tcpip\..\{122B7E2A-BA6B-45BE-B1D8-CB5B6DECAB3F}: NameServer = 192.9.1.1,202.96.209.133
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = sfzhcenter.com
O17 - HKLM\System\CS2\Services\Tcpip\..\{122B7E2A-BA6B-45BE-B1D8-CB5B6DECAB3F}: NameServer = 192.9.1.1,202.96.209.133
O18 - 列举现有的协议: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - F:\WINNT\system32\Mshtml.dll
O18 - 列举现有的协议: cdl - {3DD53D40-7B8B-11D0-B013-00AA0059CE02} - F:\WINNT\system32\urlmon.dll
O18 - 列举现有的协议: file - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - F:\WINNT\system32\urlmon.dll
O18 - 列举现有的协议: ftp - {79EAC9E3-BAF9-11CE-8C82-00AA004BA90B} - F:\WINNT\system32\urlmon.dll
O18 - 列举现有的协议: gopher - {79EAC9E4-BAF9-11CE-8C82-00AA004BA90B} - F:\WINNT\system32\urlmon.dll
O18 - 列举现有的协议: http - {79EAC9E2-BAF9-11CE-8C82-00AA004BA90B} - F:\WINNT\system32\urlmon.dll
O18 - 列举现有的协议: https - {79EAC9E5-BAF9-11CE-8C82-00AA004BA90B} - F:\WINNT\system32\urlmon.dll
O18 - 列举现有的协议: ipp - (no CLSID) - (no file)
O18 - 列举现有的协议: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - F:\WINNT\system32\itss.dll (www.dngz.net)
O18 - 列举现有的协议: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - F:\WINNT\system32\Mshtml.dll
O18 - 列举现有的协议: local - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - F:\WINNT\system32\urlmon.dll
O18 - 列举现有的协议: mailto - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0B} - F:\WINNT\system32\Mshtml.dll
O18 - 列举现有的协议: mhtml - {05300401-BCBC-11D0-85E3-00C04FD85AB4} - F:\WINNT\system32\inetcomm.dll
O18 - 列举现有的协议: mk - {79EAC9E6-BAF9-11CE-8C82-00AA004BA90B} - F:\WINNT\system32\urlmon.dll
O18 - 列举现有的协议: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - F:\WINNT\system32\itss.dll
O18 - 列举现有的协议: msdaipp - (no CLSID) - (no file)
O18 - 列举现有的协议: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - F:\WINNT\system32\Mshtml.dll
O18 - 列举现有的协议: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - F:\WINNT\system32\Mshtml.dll
O18 - 列举现有的协议: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - F:\WINNT\system32\Mshtml.dll
O18 - 列举现有的协议: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - F:\WINNT\system32\msdxm.ocx
O23 - NT 服务: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - F:\WINNT\System32\dmadmin.exe
O23 - NT 服务: kavsvc - Kaspersky Lab - F:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe
O23 - NT 服务: Audio Adapter (VGADown) - Unknown owner - F:\WINNT\avp.exe
ding.............
不大能看明白 帮你顶上去让高手来看看
删除这个：F:\WINNT\rund1132.exe
建议你 去下载，Dr.web下载:ftp://ftp.drweb.com/pub/drweb/cureit/cureit.exe
O23 - NT 服务: Audio Adapter (VGADown) - Unknown owner - F:\WINNT\avp.exe
这是啥，楼主自己清楚？
O10 - 未知的文件在 Winsock LSP: f:\winnt\system32\hssound6.dll
O10 - 未知的文件在 Winsock LSP: f:\winnt\system32\hssound6.dll
参考置顶帖子修复