學校電腦中毒了!
 

請各位幫忙...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 上午 09:08:45, on 2007/7/29
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\ACD Systems\zh\DevDetect.exe
C:\WINDOWS\system32\kernelwind32.exe
C:\WINDOWS\retadpu27.exe
C:\WINDOWS\system32\sewsol.exe
C:\WINDOWS\system32\atlfwuke.exe
C:\WINDOWS\system32\kbldoc.exe
C:\WINDOWS\system32\assched.exe
C:\WINDOWS\system32\ldcdx.exe
C:\WINDOWS\system32\umcdmohw.exe
C:\WINDOWS\system32\mfsysnv.exe
C:\WINDOWS\system32\conime.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\ACD Systems\ACDSeeMC.EXE
C:\Program Files\WinPop\winpop.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\aspimgr.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\igfrbror.exe
C:\WINDOWS\system32\defrag.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\桌面\HiJackThis.exe
O2 - BHO: BHOAd - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\xhelper.dll (file missing)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [CJIMETIPSYNC] C:\Program Files\Common Files\Microsoft Shared\IME\IMTC65\CHANGJIE\CINTLCFG.EXE /CJIMETIPSync
O4 - HKLM\..\Run: [PHIMETIPSYNC] C:\Program Files\Common Files\Microsoft Shared\IME\IMTC65\PHONETIC\TINTLCFG.EXE /PHIMETIPSync
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [Device Detector] DevDetect.exe -autorun
O4 - HKLM\..\Run: [System] C:\WINDOWS\system32\kernelwind32.exe
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu27.exe 61A847B5BBF72810358B2B27128065E9C084320161C4661227A755E9C2933154389A284662EA4EBF968951185EFC412806867680AEC1775663CF781370FE0FB68AD6
O4 - HKLM\..\Run: [solmreg] C:\WINDOWS\system32\sewsol.exe
O4 - HKLM\..\Run: [fwddls] C:\WINDOWS\system32\atlfwuke.exe
O4 - HKLM\..\Run: [klibinst] C:\WINDOWS\system32\kbldoc.exe
O4 - HKLM\..\Run: [winsaavc] C:\WINDOWS\system32\assched.exe
O4 - HKLM\..\Run: [xpsysmt] C:\WINDOWS\system32\winygyiq.exe
O4 - HKLM\..\Run: [mplaut] C:\WINDOWS\system32\ldcdx.exe
O4 - HKLM\..\Run: [wsmssl] C:\WINDOWS\system32\umcdmohw.exe
O4 - HKLM\..\Run: [lsitdm] C:\WINDOWS\system32\mfsysnv.exe
O4 - HKLM\..\Run: [plmer32] C:\WINDOWS\system32\schskgol.exe
O4 - HKLM\..\Run: [stdmce] igfrbror.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [acdseemc.exe] C:\Program Files\Common Files\ACD Systems\ACDSeeMC.EXE
O4 - HKCU\..\Run: [Service Pack 1] C:\WINDOWS\system32\vedxg6ame4.exe
O4 - HKCU\..\Run: [WinPop] C:\Program Files\WinPop\winpop.exe
O4 - HKCU\..\Run: [solmreg] C:\WINDOWS\system32\sewsol.exe
O4 - HKCU\..\Run: [fwddls] C:\WINDOWS\system32\atlfwuke.exe
O4 - HKCU\..\Run: [klibinst] C:\WINDOWS\system32\kbldoc.exe
O4 - HKCU\..\Run: [winsaavc] C:\WINDOWS\system32\assched.exe
O4 - HKCU\..\Run: [xpsysmt] C:\WINDOWS\system32\winygyiq.exe
O4 - HKCU\..\Run: [mplaut] C:\WINDOWS\system32\ldcdx.exe
O4 - HKCU\..\Run: [wsmssl] C:\WINDOWS\system32\umcdmohw.exe
O4 - HKCU\..\Run: [lsitdm] C:\WINDOWS\system32\mfsysnv.exe
O4 - HKCU\..\Run: [plmer32] C:\WINDOWS\system32\schskgol.exe
O4 - HKCU\..\Run: [stdmce] igfrbror.exe
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] ctfmon.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] ctfmon.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] ctfmon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] ctfmon.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')
O8 - Extra context menu item: 匯出至 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: 參考資料 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O20 - Winlogon Notify: botreg - C:\Documents and Settings\All Users.WINDOWS\Documents\Settings\bot.dll
O21 - SSODL: MXVpcXVtCS - {44BF7ECB-EE15-D461-1205-98866BF5C237} - C:\WINDOWS\system32\afx.dll
O21 - SSODL: DCOM Server 20509 - {2C1CD3D7-86AC-4068-93BC-A02304B20509} - C:\WINDOWS\system32\ffdqhvq.dll (file missing)
O21 - SSODL: CDRecorder036 - {A3BC5E20-0235-1ABF-9CE1-00AA00512036} - C:\WINDOWS\system32\frkd32.dll (file missing)
O22 - SharedTaskScheduler: DCOM Server 20509 - {2C1CD3D7-86AC-4068-93BC-A02304B20509} - C:\WINDOWS\system32\ffdqhvq.dll (file missing)
O23 - Service: Microsoft ASPI Manager (aspimgr) - Unknown owner - C:\WINDOWS\system32\aspimgr.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\svchost.exe:exe.exe
O23 - Service: Symantec AntiVirus 用戶端 (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
--
End of file - 6124 bytes

學校都不是有安裝還原卡

按一下按鍵就好

O2 - BHO: BHOAd - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\xhelper.dll (file missing)
O4 - HKLM\..\Run: [System] C:\WINDOWS\system32\kernelwind32.exe
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu27.exe 61A847B5BBF72810358B2B27128065E9C084320161C4661227A755E9C2933154389A284662EA4EBF968951185EFC412806867680AEC1775663CF781370FE0FB68AD6
O4 - HKLM\..\Run: [solmreg] C:\WINDOWS\system32\sewsol.exe
O4 - HKLM\..\Run: [fwddls] C:\WINDOWS\system32\atlfwuke.exe
O4 - HKLM\..\Run: [klibinst] C:\WINDOWS\system32\kbldoc.exe
O4 - HKLM\..\Run: [winsaavc] C:\WINDOWS\system32\assched.exe
O4 - HKLM\..\Run: [xpsysmt] C:\WINDOWS\system32\winygyiq.exe
O4 - HKLM\..\Run: [mplaut] C:\WINDOWS\system32\ldcdx.exe
O4 - HKLM\..\Run: [wsmssl] C:\WINDOWS\system32\umcdmohw.exe
O4 - HKLM\..\Run: [lsitdm] C:\WINDOWS\system32\mfsysnv.exe
O4 - HKLM\..\Run: [plmer32] C:\WINDOWS\system32\schskgol.exe
O4 - HKLM\..\Run: [stdmce] igfrbror.exe
O4 - HKCU\..\Run: [Service Pack 1] C:\WINDOWS\system32\vedxg6ame4.exe
O4 - HKCU\..\Run: [WinPop] C:\Program Files\WinPop\winpop.exe
O4 - HKCU\..\Run: [solmreg] C:\WINDOWS\system32\sewsol.exe
O4 - HKCU\..\Run: [fwddls] C:\WINDOWS\system32\atlfwuke.exe
O4 - HKCU\..\Run: [klibinst] C:\WINDOWS\system32\kbldoc.exe
O4 - HKCU\..\Run: [winsaavc] C:\WINDOWS\system32\assched.exe
O4 - HKCU\..\Run: [xpsysmt] C:\WINDOWS\system32\winygyiq.exe
O4 - HKCU\..\Run: [mplaut] C:\WINDOWS\system32\ldcdx.exe
O4 - HKCU\..\Run: [wsmssl] C:\WINDOWS\system32\umcdmohw.exe
O4 - HKCU\..\Run: [lsitdm] C:\WINDOWS\system32\mfsysnv.exe
O4 - HKCU\..\Run: [plmer32] C:\WINDOWS\system32\schskgol.exe
O4 - HKCU\..\Run: [stdmce] igfrbror.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')
O20 - Winlogon Notify: botreg - C:\Documents and Settings\All Users.WINDOWS\Documents\Settings\bot.dll
O21 - SSODL: MXVpcXVtCS - {44BF7ECB-EE15-D461-1205-98866BF5C237} - C:\WINDOWS\system32\afx.dll
O21 - SSODL: DCOM Server 20509 - {2C1CD3D7-86AC-4068-93BC-A02304B20509} - C:\WINDOWS\system32\ffdqhvq.dll (file missing)
O21 - SSODL: CDRecorder036 - {A3BC5E20-0235-1ABF-9CE1-00AA00512036} - C:\WINDOWS\system32\frkd32.dll (file missing)
O22 - SharedTaskScheduler: DCOM Server 20509 - {2C1CD3D7-86AC-4068-93BC-A02304B20509} - C:\WINDOWS\system32\ffdqhvq.dll (file missing)
O23 - Service: Microsoft ASPI Manager (aspimgr) - Unknown owner - C:\WINDOWS\system32\aspimgr.exe
O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\svchost.exe:exe.exe



中毒很深 - 建議請學校重灌

有嗎? 沒有吧...

這樣的話... 得請電腦老師了...

學校已重灌... 謝謝...:on_45: