[fire333]

位置在C:\WINDOWS\inf 1427個檔案共68.7M

位置在C:\WINDOWS\inf 1427個檔案共68.7M

一些可疑的檔案檔名:
wtv1.inf wtv1.PNF wtv2.inf wtv2.PNF wtv3.inf wtv3.PNF
wtv4.inf wtv4.PNF
3dfxvs2k.inf 3dfxvs2k.PNF 1394.inf 1394.PNF 1394vdbg.inf
1394vdbg.PNF 61883.inf 61883.PNF

另外再問一個問題 如何強制刪除XP安裝紀錄檔

執行HiJackThis.exe後的訊息
----------------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:35:14, on 2009-7-11
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\360\360safebox\safeboxTray.exe
C:\Program Files\360\360Safe\safemon\360tray.exe
C:\WINDOWS\system32\CTFMON.EXE
C:\Program Files\Thunder Network\Thunder\Program\Thunder.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\ddd\HiJackThis.exe

O2 - BHO: Thunder AtOnce - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll
O2 - BHO: SafeMon Class - {B69F34DD-F0F9-42DC-9EDD-957187DA688D} - C:\Program Files\360\360Safe\safemon\safemon.dll
O4 - HKLM\..\Run: [360Safebox] "C:\Program Files\360\360safebox\safeboxTray.exe" /r
O4 - HKLM\..\Run: [360Safetray] C:\Program Files\360\360Safe\safemon\360tray.exe /start
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: 使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: 使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

--
End of file - 2088 bytes