|
論壇說明 |
歡迎您來到『史萊姆論壇』 ^___^ 您目前正以訪客的身份瀏覽本論壇,訪客所擁有的權限將受到限制,您可以瀏覽本論壇大部份的版區與文章,但您將無法參與任何討論或是使用私人訊息與其他會員交流。若您希望擁有完整的使用權限,請註冊成為我們的一份子,註冊的程序十分簡單、快速,而且最重要的是--註冊是完全免費的! 請點擊這裡:『註冊成為我們的一份子!』 |
|
主題工具 | 顯示模式 |
2007-07-31, 09:11 AM | #1 |
註冊會員
|
求助 - 學校電腦中毒了!
請各位幫忙... Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 上午 09:08:45, on 2007/7/29 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\ACD Systems\zh\DevDetect.exe C:\WINDOWS\system32\kernelwind32.exe C:\WINDOWS\retadpu27.exe C:\WINDOWS\system32\sewsol.exe C:\WINDOWS\system32\atlfwuke.exe C:\WINDOWS\system32\kbldoc.exe C:\WINDOWS\system32\assched.exe C:\WINDOWS\system32\ldcdx.exe C:\WINDOWS\system32\umcdmohw.exe C:\WINDOWS\system32\mfsysnv.exe C:\WINDOWS\system32\conime.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\ACD Systems\ACDSeeMC.EXE C:\Program Files\WinPop\winpop.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\WINDOWS\system32\aspimgr.exe C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\igfrbror.exe C:\WINDOWS\system32\defrag.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Administrator\桌面\HiJackThis.exe O2 - BHO: BHOAd - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\xhelper.dll (file missing) O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [CJIMETIPSYNC] C:\Program Files\Common Files\Microsoft Shared\IME\IMTC65\CHANGJIE\CINTLCFG.EXE /CJIMETIPSync O4 - HKLM\..\Run: [PHIMETIPSYNC] C:\Program Files\Common Files\Microsoft Shared\IME\IMTC65\PHONETIC\TINTLCFG.EXE /PHIMETIPSync O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe O4 - HKLM\..\Run: [Device Detector] DevDetect.exe -autorun O4 - HKLM\..\Run: [System] C:\WINDOWS\system32\kernelwind32.exe O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu27.exe 61A847B5BBF72810358B2B27128065E9C084320161C4661227A755E9C2933154389A284662EA4EBF968951185EFC412806867680AEC1775663CF781370FE0FB68AD6 O4 - HKLM\..\Run: [solmreg] C:\WINDOWS\system32\sewsol.exe O4 - HKLM\..\Run: [fwddls] C:\WINDOWS\system32\atlfwuke.exe O4 - HKLM\..\Run: [klibinst] C:\WINDOWS\system32\kbldoc.exe O4 - HKLM\..\Run: [winsaavc] C:\WINDOWS\system32\assched.exe O4 - HKLM\..\Run: [xpsysmt] C:\WINDOWS\system32\winygyiq.exe O4 - HKLM\..\Run: [mplaut] C:\WINDOWS\system32\ldcdx.exe O4 - HKLM\..\Run: [wsmssl] C:\WINDOWS\system32\umcdmohw.exe O4 - HKLM\..\Run: [lsitdm] C:\WINDOWS\system32\mfsysnv.exe O4 - HKLM\..\Run: [plmer32] C:\WINDOWS\system32\schskgol.exe O4 - HKLM\..\Run: [stdmce] igfrbror.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - HKCU\..\Run: [acdseemc.exe] C:\Program Files\Common Files\ACD Systems\ACDSeeMC.EXE O4 - HKCU\..\Run: [Service Pack 1] C:\WINDOWS\system32\vedxg6ame4.exe O4 - HKCU\..\Run: [WinPop] C:\Program Files\WinPop\winpop.exe O4 - HKCU\..\Run: [solmreg] C:\WINDOWS\system32\sewsol.exe O4 - HKCU\..\Run: [fwddls] C:\WINDOWS\system32\atlfwuke.exe O4 - HKCU\..\Run: [klibinst] C:\WINDOWS\system32\kbldoc.exe O4 - HKCU\..\Run: [winsaavc] C:\WINDOWS\system32\assched.exe O4 - HKCU\..\Run: [xpsysmt] C:\WINDOWS\system32\winygyiq.exe O4 - HKCU\..\Run: [mplaut] C:\WINDOWS\system32\ldcdx.exe O4 - HKCU\..\Run: [wsmssl] C:\WINDOWS\system32\umcdmohw.exe O4 - HKCU\..\Run: [lsitdm] C:\WINDOWS\system32\mfsysnv.exe O4 - HKCU\..\Run: [plmer32] C:\WINDOWS\system32\schskgol.exe O4 - HKCU\..\Run: [stdmce] igfrbror.exe O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] ctfmon.exe (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] ctfmon.exe (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] ctfmon.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] ctfmon.exe (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user') O8 - Extra context menu item: 匯出至 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: 參考資料 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O20 - Winlogon Notify: botreg - C:\Documents and Settings\All Users.WINDOWS\Documents\Settings\bot.dll O21 - SSODL: MXVpcXVtCS - {44BF7ECB-EE15-D461-1205-98866BF5C237} - C:\WINDOWS\system32\afx.dll O21 - SSODL: DCOM Server 20509 - {2C1CD3D7-86AC-4068-93BC-A02304B20509} - C:\WINDOWS\system32\ffdqhvq.dll (file missing) O21 - SSODL: CDRecorder036 - {A3BC5E20-0235-1ABF-9CE1-00AA00512036} - C:\WINDOWS\system32\frkd32.dll (file missing) O22 - SharedTaskScheduler: DCOM Server 20509 - {2C1CD3D7-86AC-4068-93BC-A02304B20509} - C:\WINDOWS\system32\ffdqhvq.dll (file missing) O23 - Service: Microsoft ASPI Manager (aspimgr) - Unknown owner - C:\WINDOWS\system32\aspimgr.exe O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\svchost.exe:exe.exe O23 - Service: Symantec AntiVirus 用戶端 (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe -- End of file - 6124 bytes |
送花文章: 821,
|
2007-07-31, 11:26 AM | #3 (permalink) |
註冊會員
|
O2 - BHO: BHOAd - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\xhelper.dll (file missing)
O4 - HKLM\..\Run: [System] C:\WINDOWS\system32\kernelwind32.exe O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu27.exe 61A847B5BBF72810358B2B27128065E9C084320161C4661227A755E9C2933154389A284662EA4EBF968951185EFC412806867680AEC1775663CF781370FE0FB68AD6 O4 - HKLM\..\Run: [solmreg] C:\WINDOWS\system32\sewsol.exe O4 - HKLM\..\Run: [fwddls] C:\WINDOWS\system32\atlfwuke.exe O4 - HKLM\..\Run: [klibinst] C:\WINDOWS\system32\kbldoc.exe O4 - HKLM\..\Run: [winsaavc] C:\WINDOWS\system32\assched.exe O4 - HKLM\..\Run: [xpsysmt] C:\WINDOWS\system32\winygyiq.exe O4 - HKLM\..\Run: [mplaut] C:\WINDOWS\system32\ldcdx.exe O4 - HKLM\..\Run: [wsmssl] C:\WINDOWS\system32\umcdmohw.exe O4 - HKLM\..\Run: [lsitdm] C:\WINDOWS\system32\mfsysnv.exe O4 - HKLM\..\Run: [plmer32] C:\WINDOWS\system32\schskgol.exe O4 - HKLM\..\Run: [stdmce] igfrbror.exe O4 - HKCU\..\Run: [Service Pack 1] C:\WINDOWS\system32\vedxg6ame4.exe O4 - HKCU\..\Run: [WinPop] C:\Program Files\WinPop\winpop.exe O4 - HKCU\..\Run: [solmreg] C:\WINDOWS\system32\sewsol.exe O4 - HKCU\..\Run: [fwddls] C:\WINDOWS\system32\atlfwuke.exe O4 - HKCU\..\Run: [klibinst] C:\WINDOWS\system32\kbldoc.exe O4 - HKCU\..\Run: [winsaavc] C:\WINDOWS\system32\assched.exe O4 - HKCU\..\Run: [xpsysmt] C:\WINDOWS\system32\winygyiq.exe O4 - HKCU\..\Run: [mplaut] C:\WINDOWS\system32\ldcdx.exe O4 - HKCU\..\Run: [wsmssl] C:\WINDOWS\system32\umcdmohw.exe O4 - HKCU\..\Run: [lsitdm] C:\WINDOWS\system32\mfsysnv.exe O4 - HKCU\..\Run: [plmer32] C:\WINDOWS\system32\schskgol.exe O4 - HKCU\..\Run: [stdmce] igfrbror.exe O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user') O20 - Winlogon Notify: botreg - C:\Documents and Settings\All Users.WINDOWS\Documents\Settings\bot.dll O21 - SSODL: MXVpcXVtCS - {44BF7ECB-EE15-D461-1205-98866BF5C237} - C:\WINDOWS\system32\afx.dll O21 - SSODL: DCOM Server 20509 - {2C1CD3D7-86AC-4068-93BC-A02304B20509} - C:\WINDOWS\system32\ffdqhvq.dll (file missing) O21 - SSODL: CDRecorder036 - {A3BC5E20-0235-1ABF-9CE1-00AA00512036} - C:\WINDOWS\system32\frkd32.dll (file missing) O22 - SharedTaskScheduler: DCOM Server 20509 - {2C1CD3D7-86AC-4068-93BC-A02304B20509} - C:\WINDOWS\system32\ffdqhvq.dll (file missing) O23 - Service: Microsoft ASPI Manager (aspimgr) - Unknown owner - C:\WINDOWS\system32\aspimgr.exe O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\svchost.exe:exe.exe 中毒很深 - 建議請學校重灌 |
送花文章: 1,
|
2007-07-31, 12:13 PM | #5 (permalink) | |
註冊會員
|
引用:
這樣的話... 得請電腦老師了... |
|
送花文章: 821,
|