求助 - 可以麻煩大大們幫忙看一下嗎??

[bryand]

我的電腦之前是灌avast!這個防毒軟體~但是覺得系統好像很慢~~
不管是開檔案還是上網~~後來有大大說avast!序號機有木馬~~
我就去抓了小紅傘這個防毒軟體~~然後把avast!移除~~
發覺系統變快了~~但是後來又看到avast!4.7.1074版~還有更新檔~~
我就抓下來用雖然2套防毒軟體不會相衝~~但是發覺系統變慢了~~
是avast!的問題還是哪裡出問題了~~可以麻煩大大們幫我看一下嗎??謝

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 下午 11:12:56, on 2007/12/4
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
d:\Avast4\aswUpdSv.exe
d:\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
D:\Comodo\Firewall\CPF.exe
D:\Avast4\ashDisp.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
D:\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
d:\Avast4\ashMaiSv.exe
d:\Avast4\ashWebSv.exe
C:\Program Files\Internet Explorer\iexplore.exe
d:\Avast4\ashSimpl.exe
D:\TTPlayer\TTPlayer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [COMODO Firewall Pro] "D:\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [avast!] d:\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O8 - Extra context menu item: Foxy 下載 - res://D:\Foxy\Foxy.exe/download.htm
O8 - Extra context menu item: Foxy 搜尋 - res://D:\Foxy\Foxy.exe/search.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{8DF2DE17-FABC-4EF5-9797-2A3C72C3982C}: NameServer = 168.95.192.1 168.95.1.1
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - d:\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - d:\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - d:\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - d:\Avast4\ashWebSv.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - D:\Comodo\Firewall\cmdagent.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 3119 bytes

[bryand]

我看我還是用avast!好了~~
把AntiVir移除好了~~
謝謝大大的幫忙~~

[明心皓月]

作者: plunderer

防毒軟體只有自己用過才知好壞...
我很久沒用防毒軟體了, 無從比較好壞

若以你現有的 Avast 與 AntiVir 比較, 數據顯示 AntiVir 偵測率較高

請問Plunderer大大
不用防毒軟體.難不成 您是用 " 硬體 "

[plunderer]

作者: 明心皓月

請問Plunderer大大
不用防毒軟體.難不成 您是用 " 硬體 "

非也, 而是傳說中的 "裸奔"
看我的工作管理員及 hijackthis 日誌就知道了, 夠簡單



Scan saved at 12:36:20, on 2007/12/11
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\cFosSpeed\spd.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\cFosSpeed\cFosSpeed.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Internet\Opera\opera.exe
E:\Utility\HiJackThis\HijackThis.exe

O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O4 - HKLM\..\Run: [PHIMETIPSYNC] C:\Program Files\Common Files\Microsoft Shared\IME\IMTC65\Phonetic\TINTLCFG.EXE /PHIMETIPSync
O4 - HKLM\..\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: 匯出至 Microsoft Excel(&X) - res://C:\PROGRA~1\Microsoft Office\Office12\EXCEL.EXE/3000
O9 - Extra button: 傳送至 OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: 傳送至 OneNote(E) - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{987F457C-C13D-415D-AF2A-42F5C939761C}: NameServer = 168.95.192.1,168.95.1.1
O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\Program Files\cFosSpeed\spd.exe

--
End of file - 2388 bytes

網站照樣上, 軟體照樣下, 並非我一定不會中毒, 而是:

1. 可疑的程式處理程序逃不過我的眼睛

2. 路由上網, 外界很難攻進

3. Firefox 或 Opera 瀏覽, 對惡意網站幾乎免疫

4. 即使中毒, 10 分鐘即可自己搞定, 萬一系統被破壞, Ghost 還原更快
但裝防毒軟體及防火牆, 拖慢系統速度累積起來就不知浪費多少時間

5.自誇的說, 對病毒及防毒軟體都有相當程度的了解了....病毒是 "日新月異", 防毒軟體是 "了無新意", 所以呢, 該中還是會中...若非要裝個維護安全的軟體, 我會裝 HIPS 軟體

6.以上純屬個人意見, 不鼓勵他人效法