求助 - 這樣有中毒嗎?請幫忙

[jinxiang]

我每次開機完成後,打開KAV看詳細訊息,都看到一樣的訊息:

偵測到: 木馬程式 Trojan-Downloader.VBS.Agent.n 網址: http://194.126.193.152/stats.php?id=5011
偵測到: 危險軟體 Invader 執行程序: C:\WINDOWS\System32\svchost.exe
偵測到: 危險軟體 Invader 執行程序: C:\Documents and Settings\compaq\Local Settings\Temp\is-64EQO.tmp\is-I0956.tmp
偵測到: 危險軟體 Invader 執行程序: C:\WINDOWS\system32\svchost.exe
偵測到: 危險軟體 Invader 執行程序: C:\WINDOWS\system32\cmd.exe
偵測到: 危險軟體 Invader 執行程序: C:\WINDOWS\Explorer.EXE
偵測到: 危險軟體 Invader 執行程序: C:\WINDOWS\system32\winlogon.exe
偵測到: 危險軟體 Invader 執行程序: C:\WINDOWS\system32\services.exe
偵測到: 危險軟體 Invader 執行程序: C:\WINDOWS\system32\LEXBCES.EXE
偵測到: 危險軟體 Invader 執行程序: C:\WINDOWS\system32\spoolsv.exe
偵測到: 木馬程式 Trojan-Clicker.HTML.IFrame.ag 網址: http://www.enkei.com.tw/active.htm
偵測到: 木馬程式 Trojan-Downloader.JS.Small.fs 網址: http://81.29.241.70/new/counter.php?b=3
已刪除: 木馬程式 Trojan-Clicker.HTML.IFrame.cu 檔案: C:\Documents and Settings\compaq\Local Settings\Temporary Internet Files\Content.IE5\XKW711W1\index[4].htm

請問:這樣有中毒嗎?我覺得奇怪的是最後一項 (已刪除: 木馬程式 Trojan-Clicker.HTML.IFrame.cu 檔案: C:\Documents and Settings\compaq\Local Settings\Temporary Internet Files\Content.IE5\XKW711W1\index[4].htm)既然已刪除,為何每次開機它都在?請先進們釋疑,謝謝!

[Living]

請參考置頂文章
將您的LOG登出來以方便參考

[jinxiang]

謝謝版主提醒 , 以下為掃描解果 .

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 下午 08:56:56, on 2008/1/15
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Compaq\EAB\EabServr.exe
C:\Program Files\Acronis\TrueImageEnterprise\TrueImageMonitor.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
E:\Temp-Soure\黃金記憶體(Memory Booster) v3.2 繁體中文免安裝版\黃金記憶體(Memory Booster) v3.2 繁體中文免安裝版\Memory Booster.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
E:\Temp-Soure\公告 - 煩請系統中毒要求協助或是解毒的版友注意\HiJackThis.exe

O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\ycomp5_1_6_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - E:\Temp-Soure\FlashGet- V1.9.6.1073 Final綠色免安裝版\FlashGet196\jccatch.dll (file missing)
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - E:\Sources\迅雷(Thunder) v5.7.6.426 去廣告完美者特別版(安裝+免安裝)\Thunder v5.7.6.426 portable\ComDlls\xunleiBHO_Now.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\ycomp5_1_6_0.dll
O3 - Toolbar: Dr.eye WebPage Translation - {92B255FE-94E2-4BCA-958D-3926CE38913F} - C:\Program Files\Inventec\Dreye\DreyeMT\DreyeIEBar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\Compaq\EAB\EabServr.exe /Start
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageEnterprise\TrueImageMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [MemoryIdle] E:\Temp-Soure\黃金記憶體(Memory Booster) v3.2 繁體中文免安裝版\黃金記憶體(Memory Booster) v3.2 繁體中文免安裝版\Memory Booster.exe -PowerOn
O4 - HKLM\..\RunServices: [CPQDFWAG] C:\WINDOWS\Cpqdiag\CpqDfwAg.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: 網頁病毒防護統計 - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\SCIEPlgn.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\Temp-Soure\FlashGet- V1.9.6.1073 Final綠色免安裝版\FlashGet196\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\Temp-Soure\FlashGet- V1.9.6.1073 Final綠色免安裝版\FlashGet196\flashget.exe (file missing)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2B38E40E-977D-4767-919C-2AA29C041618} (BOT Class) - https://ebank.bot.com.tw/FCard/NetATM/FCardS.CAB
O16 - DPF: {338D07FB-5B35-41CB-B696-33F24C91F201} (TWCAPI3 Class) - https://pis.wls.com.tw/TWCACAPIX.cab
O16 - DPF: {5F4D222D-5EEE-40A8-8810-5642B4E4F441} (KENCAPI Class) - https://ebank.tcb-bank.com.tw/netban.../FSCAPIATL.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://www.nfreeway.gov.tw/activex/Camera.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O16 - DPF: {C7BD467B-0B38-442F-840F-3F048E7F6005} (RootKeyDistributor Class) - http://grca.nat.gov.tw/pse/CHTPKI_PSE.cab
O16 - DPF: {DBFB1725-E5BD-43A1-9C18-9F7B054793E0} (SendOrder Class) - https://ez.wls.com.tw/secs/axebroker.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0A29E326-4620-4B83-92AA-CA938CAC4879}: NameServer = 168.95.192.1 168.95.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{0A29E326-4620-4B83-92AA-CA938CAC4879}: NameServer = 168.95.192.1 168.95.1.1
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
O23 - Service: Compaq Remote Diagnostics Enabling Agent (CpqDfwWebAgent) - Compaq Computer Corporation - C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: SNDSrvc - Acronis - (no file)

--
End of file - 7427 bytes