|
|
|||||||
| 論壇說明 |
|
歡迎您來到『史萊姆論壇』 ^___^ 您目前正以訪客的身份瀏覽本論壇，訪客所擁有的權限將受到限制，您可以瀏覽本論壇大部份的版區與文章，但您將無法參與任何討論或是使用私人訊息與其他會員交流。若您希望擁有完整的使用權限，請註冊成為我們的一份子，註冊的程序十分簡單、快速，而且最重要的是－－註冊是完全免費的！ 請點擊這裡：『註冊成為我們的一份子！』 |
 |
|
|
主題工具 | 顯示模式 |
2007-09-28, 10:11 PM
|
#1 |
|
長老會員
|
求助 - 麻煩幫忙看一下
Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 下午 09:45:08, on 2007/9/28 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Java\j2re1.4.2_14\bin\jusched.exe C:\Program Files\EmvSmartCardReader\SmartMON.exe C:\Program Files\EmvSmartCardReader\BePCSC.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\最好的內存釋放軟體\SysInfoMyWork.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Administrator\桌面\DSLite2\DSLite.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\MSN Messenger\msnmsgr.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Yahoo!\Messenger\YPager.exe C:\Documents and Settings\Administrator\桌面\BDBZM_v1.41\BDBZM.exe C:\PROGRA~1\COMMON~1\MICROS~1\IME\SHARED2.0\IMEPADSV.EXE C:\Program Files\Skype\Phone\Skype.exe C:\Documents and Settings\Administrator\桌面\HiJackThis_v2.exe F2 - REG:system.ini: Shell=Explorer.exe,C:\WINDOWS\system32\NETSVCS.EXE F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Program Files\Windows Media Player\svchost.exe,C:\Program Files\Windows NT\SERVICES.EXE,userinit.exe O2 - BHO: ThunderAtOnce Class - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - C:\Documents and Settings\Administrator\桌面\Thunder\ComDlls\TDAtOnce_Now.dll O2 - BHO: ThunderBHO - {06849E9E-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Documents and Settings\Administrator\桌面\Thunder\ComDlls\xunleiBHO_Now.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\Jccatch.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll O3 - Toolbar: &Translator Internet - {8E4AA109-7239-4B85-8196-7377A53DDEFF} - C:\PROGRA~1\Antadis\TRANSL~1\DELPHI~1.DLL O4 - HKLM\..\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [Cmaudio] ; RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NeroFilterCheck] ; C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [CJIMETIPSYNC] C:\Program Files\Common Files\Microsoft Shared\IME\IMTC65\CHANGJIE\CINTLCFG.EXE /CJIMETIPSync O4 - HKLM\..\Run: [PHIMETIPSYNC] C:\Program Files\Common Files\Microsoft Shared\IME\IMTC65\PHONETIC\TINTLCFG.EXE /PHIMETIPSync O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] ; "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\j2re1.4.2_14\bin\jusched.exe" O4 - HKLM\..\Run: [SmartMon] C:\Program Files\EmvSmartCardReader\SmartMON.exe O4 - HKLM\..\Run: [BePCSC] C:\Program Files\EmvSmartCardReader\BePCSC.exe O4 - HKLM\..\Run: [mnsa] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mnso.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] ; "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe -quiet O4 - HKCU\..\Run: [63rx] C:\WINDOWS\rundl13a.exe O4 - HKCU\..\Run: [2l1] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe O4 - HKCU\..\Run: [x41fm] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\rundl132.exe O4 - HKCU\..\Run: [bmx0wzbq] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\servicer.exe O4 - HKCU\..\Policies\Explorer\Run: [66] C:\SysDayN2\svchost.exe O4 - HKCU\..\Policies\Explorer\Run: [tx] C:\SysTx3\svchost.exe O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] ctfmon.exe (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] ctfmon.exe (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] ctfmon.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] ctfmon.exe (User 'Default user') O8 - Extra context menu item: &使用 FlashGet 下載 - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &全部使用 FlashGet 下載 - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Foxy 下載 - res://C:\Program Files\Foxy\Foxy.exe/download.htm O8 - Extra context menu item: Foxy 搜尋 - res://C:\Program Files\Foxy\Foxy.exe/search.htm O8 - Extra context menu item: 下載編碼內容(&D.S.Lite) - C:\Documents and Settings\Administrator\桌面\DSLite2\dl_text.html O8 - Extra context menu item: 下載編碼內容(S&martGet) - C:\Documents and Settings\Administrator\桌面\SmartGet1.1\dl_text.html O8 - Extra context menu item: 下載編碼檔案內容(&D.S.Lite) - C:\Documents and Settings\Administrator\桌面\DSLite2\dl_url.html O8 - Extra context menu item: 使用 S&martGet 下載 - C:\Documents and Settings\Administrator\桌面\SmartGet1.1\dl_link.htm O8 - Extra context menu item: 使用迅雷下載 - C:\Documents and Settings\Administrator\桌面\Thunder\Program\geturl.htm O8 - Extra context menu item: 使用迅雷下載全部鏈接 - C:\Documents and Settings\Administrator\桌面\Thunder\Program\getallurl.htm O8 - Extra context menu item: 匯出至 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java 主控台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra button: 參考資料 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE O9 - Extra button: D.S.Lite - {F8475519-8412-4D40-A46E-692D9D04DF7F} - C:\Documents and Settings\Administrator\桌面\DSLite2\DSLite.exe O9 - Extra 'Tools' menuitem: &D.S.Lite - {F8475519-8412-4D40-A46E-692D9D04DF7F} - C:\Documents and Settings\Administrator\桌面\DSLite2\DSLite.exe O14 - IERESET.INF: START_PAGE_URL=tw.yahoo.com O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {2CFB9D51-2B41-4A5E-BAC1-87ADB3E071CC} (Npcms Control) - https://210.241.69.188/moica/npcms.cab O16 - DPF: {3C232DA1-E9AC-4C74-A792-2A686F7315EE} (GPKICryptATL Class) - https://eservice.nhitb.gov.tw/nhiweb...KICryptATL.cab O16 - DPF: {4AB44776-260B-401E-9B30-8221534A95EB} (ErrCodeATL Class) - https://eservice.nhitb.gov.tw/nhiweb...ErrCodeATL.cab O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab56986.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/ZH-TW/.../GAME_UNO1.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {991481A7-4669-4E15-8C24-100404E1F5CB} (Blueskyvoice Control) - http://cn.chat104.com/download/tstvoice_60.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab O16 - DPF: {BB76BF14-7D3D-48CA-8824-42CA1A8FB040} (FSHCA Class) - https://eservice.nhitb.gov.tw/nhiweb...C/FSHCAATL.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O16 - DPF: {CACFD501-1157-442B-9D0E-3E0BC34FC4A9} (CYTWInst Class) - http://tw.cyworld.com/common/activex/cytwinst.cab O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab31267.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{22913F06-0DA9-47A3-AFE8-530E47CFC9F5}: NameServer = 168.95.192.1 168.95.1.1 O20 - AppInit_DLLs: awlpri.dll O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe -- End of file - 11027 bytes 感謝plunderer 大大 此帖於 2007-09-29 06:16 PM 被 minjj741 編輯. |
__________________
|
|
|
送花文章: 13,
|
|
2007-09-28, 10:27 PM
|
#2 (permalink) |
|
管理員
 
|
O4 - HKCU\..\Run: [63rx] C:\WINDOWS\rundl13a.exe
O4 - HKCU\..\Run: [2l1] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe O4 - HKCU\..\Run: [x41fm] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\rundl132.exe O4 - HKCU\..\Run: [bmx0wzbq] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\servicer.exe svchost.exe 照理講應該只會在 C:\windows\system32 中 O4 - HKCU\..\Policies\Explorer\Run: [66] C:\SysDayN2\svchost.exe O4 - HKCU\..\Policies\Explorer\Run: [tx] C:\SysTx3\svchost.exe 這幾可看起來很可疑 |
|
__________________ 在「專業主討論區」中的問題解決後，要記得按一下  按鈕喔，這是一種禮貌動作。  一樣是在「專業主討論區」中發問，不管問題解決與否，都要回應別人的回答文喔。 不然搞 [斷頭文]，只看不回應，下次被別人列入黑名單就不要怪人喔。 天線寶寶說再見啦~ ... 天線寶寶說再見啦~ 迪西：「再見~ 再見~」 『 Otaku Culture Party 』 關心您 ... 
|
|
|
|
送花文章: 37855,
|
|
向 getter 送花的會員:
|
|
2007-09-29, 02:39 AM
|
#3 (permalink) |
|
長老會員
 
|
F2 - REG:system.ini: Shell=Explorer.exe,C:\WINDOWS\system32\NETSVCS.EXE
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Program Files\Windows Media Player\svchost.exe,C:\Program Files\Windows NT\SERVICES.EXE,userinit.exe O4 - HKCU\..\Run: [63rx] C:\WINDOWS\rundl13a.exe O4 - HKCU\..\Run: [2l1] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe O4 - HKCU\..\Run: [x41fm] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\rundl132.exe O4 - HKCU\..\Run: [bmx0wzbq] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\servicer.exe O4 - HKCU\..\Policies\Explorer\Run: [66] C:\SysDayN2\svchost.exe O4 - HKCU\..\Policies\Explorer\Run: [tx] C:\SysTx3\svchost.exe O20 - AppInit_DLLs: awlpri.dll 勾選並修復上述項目, 重新開機, 以安全模式登入windows, 刪除下列檔案: C:\WINDOWS\system32\NETSVCS.EXE C:\Program Files\Windows Media Player\svchost.exe C:\Program Files\Windows NT\SERVICES.EXE C:\WINDOWS\rundl13a.exe C:\SysDayN2\ 刪除整個目錄 C:\SysTx3\ 刪除整個目錄 awlpri.dll C:\Documents and Settings\administrators\Local Settings\Temp 裡的檔案全部刪除 |
|
__________________ 刑天舞干戚
|
|
|
|
送花文章: 6,
|
|
向 plunderer 送花的會員:
|
|
|
|
|
相似的主題
|
||||
| 主題 | 主題作者 | 討論區 | 回覆 | 最後發表 |
| 疑問 - 實在是看不懂測試報告麻煩幫忙看一下 | kada | 軟體應用問題討論區 | 3 | 2006-08-12 01:27 PM |
| 組裝一台電腦，煩請各位大大幫忙看一下配備 | shichien | 硬體疑難使用問題討論區 | 13 | 2003-08-12 12:46 AM |
| Microsoft Window Server 2003 中文版陰影複製的使用說明 | psac | 網路軟硬體架設技術文件 | 1 | 2003-06-04 08:32 PM |
平板模式
