求助 - 電腦會自動重開機

[銀燄]

開機後沒多久計會出現lsass關閉甚麼的
然60秒後就自動重開
請問是甚麼原因呢?


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 上午 10:27:05, on 2008/5/4
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.

1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Anti

-Virus 6.0\avp.exe
C:\Program Files\NetLimiter\NetLimiter.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\tsqla.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti

-Virus 6.0\avp.exe
C:\Program Files\Alcohol Soft\Alcohol 120

\StarWind\StarWindService.exe
C:\WINDOWS\Explorer.EXE
D:\bestboy\GreenBrowser 4.2.0712\GreenBrowser

.exe
C:\Program Files\FlashGet\flashget.exe
C:\Program Files\Trend

Micro\HijackThis\HijackThis.exe

R3 - URLSearchHook: Yahoo!奇摩捷徑列 - {EF99

BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F2 - REG:system.ini: UserInit=C:

\WINDOWS\system32\userinit.exe,C:\Win\msn.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D

7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM

FILES\ADOBE\ACROBAT 5.0

\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {7E853D72-626A-48EC-A

868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030

D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program

Files\Common Files\Microsoft Shared\Windows

Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF

36AF6E4} - C:\Program Files\MSN Apps\ST\01.03

.0000.1005\en-xu\stmain.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D

3-9CD9-0090271D075B} - C:\PROGRA~1

\FLASHGET\jccatch.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A

17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN

Apps\MSN Toolbar\01.02.3000.1001\zh-tw\msntb.

dll
O2 - BHO: GetIE Helper - {BDEEE1B1-8B25-42BE-

9925-1E0228C27126} - C:\WINDOWS\SYSTEM32

\GetIEBrowser.dll (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-

64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN

Toolbar\01.02.3000.1001\zh-tw\msntb.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-

11D5-8D29-0050BA6940E3} - C:\PROGRA~1

\FLASHGET\fgiebar.dll
O3 - Toolbar: (no name) - {92B255FE-94E2-4BCA

-958D-3926CE38913F} - (no file)
O3 - Toolbar: 收音機(&R) - {8E718888-423F-11D

2-876E-00A0C9082467} - C:\WINDOWS\System32

\msdxm.ocx
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:

\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /

RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:

\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /

SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:

\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /

IMEName
O4 - HKLM\..\Run: [HotKeysCmds] C:

\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.

cpl,CMICtrlWnd
O4 - HKLM\..\Run: [LTT2] C:

\WINDOWS\system\rundll32.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %

systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [AVP] "C:\Program

Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0

\avp.exe"
O4 - HKLM\..\Run: [NetLimiter] C:\Program

Files\NetLimiter\NetLimiter.exe /s
O4 - HKLM\..\Run: [Internet Firewall Layer]

tsqla.exe
O4 - HKLM\..\Run: [UserFaultCheck] %

systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\RunServices: [Windows Service

Agent] wgl23.exe
O4 - HKLM\..\RunServices: [Internet Security

Service] nmsq22.exe
O4 - HKLM\..\RunServices: [Microsoft Windows

Update] lfdfqpq.exe
O4 - HKLM\..\RunServices: [Systam13] first.exe
O4 - HKLM\..\RunServices: [Internet Firewall

Layer] tsqla.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:

\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Internet Firewall Layer]

tsqla.exe
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] C:

\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] C:

\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-1993962763-854245398-

1060284298-1003\..\Run: [ctfmon.exe] C:

\WINDOWS\System32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:

\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-18\..\Run: [Internet Firewall

Layer] tsqla.exe (User '?')
O4 - HKUS\S-1-5-18\..\RunOnce: [Printing

Migration] rundll32.exe C:\WINDOWS\System32

\spool\migrate.dll,ProcessWin9xNetworkPrinters

(User '?')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:

\WINDOWS\System32\CTFMON.EXE (User 'Default

user')
O4 - HKUS\.DEFAULT\..\RunOnce: [Printing

Migration] rundll32.exe C:\WINDOWS\System32

\spool\migrate.dll,ProcessWin9xNetworkPrinters

(User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet

Explorer\Control Panel present
O8 - Extra context menu item: Foxy 下載 - res

://C:\Program Files\Foxy\Foxy.exe/download.htm
O8 - Extra context menu item: Foxy 搜尋 - res

://C:\Program Files\Foxy\Foxy.exe/search.htm
O8 - Extra context menu item: 使用 FlashGet 下

載 - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 全部使用

FlashGet 下載 - C:\Program

Files\FlashGet\jc_all.htm
O9 - Extra button: 網頁防護 - {1F460357-8A94-

4D71-9CA3-AA4ACF32ED8E} - C:\Program

Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0

\scieplugin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08

-11D5-AD55-00010333D0AD} - C:\WINDOWS\System

32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger

- {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:

\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Related - {c95fe080-8f5d-

11d2-a20b-00aa003c157a} - C:

\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related

Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a}

- C:\WINDOWS\web\related.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-

11d4-8D29-0050BA6940E3} - C:\PROGRA~1

\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E

814A0-E0C5-11d4-8D29-0050BA6940E3} - C:

\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C

4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1

\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger

- {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:

\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra button: Messenger - {FB5F1910-F110

-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5

F1910-F110-11d2-BB9E-00C04F795683} - C:

\Program Files\Messenger\MSMSGS.EXE
O13 - WWW. Prefix: http://
O16 - DPF: {75A89484-8152-461B-87B0-4D253259E

972} (HnBkClientATM Control) - https://www.

smartatm.com.tw/eatm/components/HnBkClientATM

.cab
O16 - DPF: {7AD348C0-76CD-4FC0-B514-1CDD2F

767212} (GTDControl Control) - http://www.

camangi.com/GTD/GTD.cab
O16 - DPF: {9E7138EE-4E7B-11D5-94EF-006008A4

ED7F} (DialZ Class) - http://216.101.214.150/

dnavi/DialX16.CAB
O16 - DPF: {A45F39DC-3608-4237-8F0E-139F1BC

49464} - http://www.greatplugin.com/

diallerfiles/013636.exe
O16 - DPF: {B596344E-F60F-42C2-8640-5954EEDBD

428} (RegExe Control) - http://shaiya.omg.com

.tw/Activex/macrowell.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{400D

48CE-04CB-45EF-BCB7-B3FDEDC5042A}: NameServer

= 168.95.192.1 168.95.1.1
O20 - AppInit_DLLs: 608769M.BMP
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP)

- Kaspersky Lab - C:\Program Files\Kaspersky

Lab\Kaspersky Anti-Virus 6.0\avp.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG

- C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: MXS(mxs) (MXS) - Unknown owner

- C:\WINDOWS\system32\mxs.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:

\WINDOWS\System32\HPZipm12.exe
O23 - Service: StarWind iSCSI Service (

StarWindService) - Rocket Division Software -

C:\Program Files\Alcohol Soft\Alcohol 120

\StarWind\StarWindService.exe
O23 - Service: Windows User Mode Driver

Framework (UMWdf) - Unknown owner - C:

\WINDOWS\System32\wdfmgr.exe (file missing)

--
End of file - 7679 bytes

[crd1871]

中毒現象,請等待高手解毒~~

[GaMNiA]

作者: 銀燄

Platform: Windows XP SP1 (WinNT 5.01.2600)

C:\WINDOWS\System32\tsqla.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Win\msn.com
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: (no name) - {92B255FE-94E2-4BCA-958D-3926CE38913F} - (no file)
O4 - HKLM\..\Run: [LTT2] C:\WINDOWS\system\rundll32.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Internet Firewall Layer] tsqla.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\RunServices: [Windows Service Agent] wgl23.exe
O4 - HKLM\..\RunServices: [Internet Security Service] nmsq22.exe
O4 - HKLM\..\RunServices: [Microsoft Windows Update] lfdfqpq.exe
O4 - HKLM\..\RunServices: [Systam13] first.exe
O4 - HKLM\..\RunServices: [Internet Firewall Layer] tsqla.exe
O4 - HKCU\..\Run: [Internet Firewall Layer] tsqla.exe
O4 - HKUS\S-1-5-18\..\Run: [Internet Firewall Layer] tsqla.exe (User '?')
O16 - DPF: {9E7138EE-4E7B-11D5-94EF-006008A4ED7F} (DialZ Class) - http://216.101.214.150/dnavi/DialX16.CAB
O16 - DPF: {A45F39DC-3608-4237-8F0E-139F1BC49464} - http://www.greatplugin.com/diallerfiles/013636.exe
O20 - AppInit_DLLs: 608769M.BMP
O23 - Service: MXS(mxs) (MXS) - Unknown owner - C:\WINDOWS\system32\mxs.exe (file missing)
O23 - Service: Windows User Mode Driver Framework (UMWdf) - Unknown owner - C:\WINDOWS\System32\wdfmgr.exe (file missing)

你的LOG很亂，因為好像被排版過，都跳行了，我看的一個頭二個大...

上面的項目打勾，然後按 [Fix Checked] ，重新開機後，將紅色標示的檔案刪除。

XP SP1 漏洞很多，請到去下面下載 Windows XP SP3 官方下載:
http://forum.slime.com.tw/thread228535.html

[a471]

你用微軟的系統卻不喝解毒劑=自殺

請升級到SP2否則建議你別用XP作業系統<=蓋茲跟我講的

[銀燄]

我照著上面大大的指示做了，本來好像感覺不會再跳出重開機的視窗，但裝了sp3再重開機之後，就一直是藍底白字進不去windows了…連安全模式也是一樣的情況，請問還有得救嗎？><

[GaMNiA]

...........................慘~

你用XP光碟開機，用修復安裝試試看...

[a471]

會倒數計時的是"疾風"病毒對不對?.....這我有映象

是系統漏洞造成的，可現該系統沒有適時的"補漏"....才會這樣