疑問 - 小弟教室電腦有一個問題,想請教各位大大

[lutunhsiang]

--------------------
閱讀本主題的最佳解答
--------------------


由於換新的教室,小弟使用的電腦,本來只有一台DVD光碟機,可是在我的電腦裡面卻有兩台DVD光碟機的圖案,也沒有類似酒精之類的軟體,是其他軟體造成的還是有毒,我看裡面安裝的防毒軟體是Mcafee8.5i,請大家告訴小弟該怎麼做,謝謝
===========================
電腦組態:
CPU:Pentium4 2.4G
RAM:256MB
Motherboard:ASUS P4S533-VM
VGA:SIS 651(16MB 顯示記憶體)
AUDIO:C-Media AC97 AUdio Device
Ethernet:SIS 900-based PCI Fast Ethernet Adapter
DVD-ROM:ASUS DVD-ROM E616
HDD:ST380011A(60G)
===========================
Trend Micro HijackThis報告:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 下午 01:01:05, on 2008/2/27
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\WINDOWS\system32\conime.exe
C:\Documents and Settings\User\Application Data\U3\0000185E79619AE3\LaunchPad.exe
C:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe
C:\PROGRA~1\COMMON~1\MICROS~1\MSINFO\OINFOP11.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Altera\maxplus2\max2win.exe
D:\Home\Desktop\HiJackThis.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: NetXfer - {83B80A9C-D91A-4F22-8DCF-EA7204039F79} - C:\Program Files\Xi\NetXfer\NXIEHelper.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: NetXfer - {C16CBAAC-A75C-4DB5-A0DD-CDF5CAFCDD3A} - C:\Program Files\Xi\NetXfer\NXToolBar.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKLM\..\Policies\Explorer\Run: [waults] C:\Documents and Settings\All Users\Application Data\wpnpista.exe
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: 匯出至 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java 主控台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: 參考資料 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O12 - Plugin for .UVR: C:\Program Files\Internet Explorer\Plugins\NPUPano.dll
O15 - Trusted Zone: *.live.com
O15 - Trusted Zone: *.hotmail.msn.com
O15 - Trusted Zone: *.live.com (HKLM)
O15 - Trusted Zone: *.hotmail.msn.com (HKLM)
O17 - HKLM\System\CCS\Services\Tcpip\..\{D461BF4A-D99F-47ED-90AB-4814E344A029}: NameServer = 210.60.239.1,168.95.192.1
O23 - Service: Lookout Citadel Server (LkCitadelServer) - National Instruments, Inc. - C:\WINDOWS\system32\lkcitdl.exe
O23 - Service: National Instruments PSP Server Locator (lkClassAds) - National Instruments, Inc. - C:\WINDOWS\system32\lkads.exe
O23 - Service: National Instruments Time Synchronization (lkTimeSync) - National Instruments, Inc. - C:\WINDOWS\system32\lktsrv.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: National Instruments Domain Service (NIDomainService) - National Instruments, Inc. - C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe
O23 - Service: NI Service Locator (niSvcLoc) - National Instruments Corp. - C:\WINDOWS\system32\nisvcloc.exe

--
End of file - 5440 bytes

[plunderer]

O4 - HKLM\..\Policies\Explorer\Run: [waults] C:\Documents and Settings\All Users\Application Data\wpnpista.exe

勾選並修復上述項目, 重新開機, 若C:\Documents and Settings\All Users\Application Data\wpnpista.exe 還在就自行刪除

P.S
Mcafee8.5i 防護力不差, Firefox 對大部份網頁病毒免疫, 可能的感染途徑就是: USB 隨身碟

[lutunhsiang]

作者: plunderer

O4 - HKLM\..\Policies\Explorer\Run: [waults] C:\Documents and Settings\All Users\Application Data\wpnpista.exe

勾選並修復上述項目, 重新開機, 若C:\Documents and Settings\All Users\Application Data\wpnpista.exe 還在就自行刪除

P.S
Mcafee8.5i 防護力不差, Firefox 對大部份網頁病毒免疫, 可能的感染途徑就是: USB 隨身碟

============
這位大大,刪除與重新開機之後還是會多出另外一台的DVD光碟機,我在想辦法處理好了
ps.mcafee 8.5i是學長安裝的,一開始並非小弟安裝與使用的

[plunderer]

虛擬光碟是 sptd 驅動的, hijackthis 看不到

要用autoruns 或 System Repair Engineer 才看得到
http://www.kztechs.com/index1.html

可能是某個軟體內建虛擬光碟驅動程式吧