求助 - 請大家幫我看看我的電腦是否有毒?

[asdfasdf00xz]

--------------------
閱讀本主題的最佳解答
--------------------


請大家幫我看看我的電腦是否有毒?
有的話請教我怎麼解毒 和以後怎麼防護! 拜託了! 謝謝!!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 上午 08:22:08, on 2009/2/16
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe
C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\SVCHOST.EXE
C:\Program Files\Vista Drive Icon\DrvIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Program Files\NextLink\GOGOBOX\gfscagent.exe
C:\Documents and Settings\leonard\新資料夾\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Windows Live ?n﹑J﹑p??﹑ - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll (file missing)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [CJIMETIPSYNC] C:\Program Files\Common Files\Microsoft Shared\IME\IMTC65\CHANGJIE\CINTLCFG.EXE /CJIMETIPSync
O4 - HKLM\..\Run: [PHIMETIPSYNC] C:\Program Files\Common Files\Microsoft Shared\IME\IMTC65\PHONETIC\TINTLCFG.EXE /PHIMETIPSync
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe"
O4 - HKLM\..\Run: [XboxStat] "C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [svchost] C:\WINDOWS\SVCHOST.EXE
O4 - HKLM\..\Run: [DrvIcon] C:\Program Files\Vista Drive Icon\DrvIcon.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [RGSC] D:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: 匯出至 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 新增至廣告橫幅防護 - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\ie_banner_deny.htm
O9 - Extra button: ?????@???p - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\SCIEPlgn.dll
O9 - Extra button: ?o?G??????? - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: ???? Windows Live Writer ?o?G????????&B) - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: 參考資料 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1231072516462
O16 - DPF: {A22B8FD2-4CAA-4EFB-82F7-680CD656D9B0} (NowStarter Control) - http://www.gogobox.com.tw/neo.fld/GNowStarter.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2AAE6F20-D6A8-4DEC-848B-756F725AE9FF}: NameServer = 168.95.192.1 168.95.1.1
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0FO\adialhk.dll,wbsys.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe
O23 - Service: Bonjour ?A?? (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod ?A?? (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

--
End of file - 8751 bytes







順便附上卡巴斯基的防護和一張昨天掃毒的圖: (還有我之前[已封鎖的攻擊]有2個 請問這是發生什麼事情呢?)

已偵測: riskware Invader 執行程序: C:\Documents and Settings\leonard\Local Settings\Temp\_is3F.exe
已刪除: 特洛伊木馬程式 Trojan.Win32.Agent.aphc 檔案: C:\System Volume Information\_restore{DA8FCEF9-1EB5-46BF-968F-FD2080BE62BB}\RP11\A0000781.exe
已刪除: 特洛伊木馬程式 Trojan-GameThief.Win32.Magania.amoc 檔案: C:\System Volume Information\_restore{DA8FCEF9-1EB5-46BF-968F-FD2080BE62BB}\RP71\A0003944.dll
已刪除: 特洛伊木馬程式 Trojan-GameThief.Win32.Magania.amob 檔案: C:\System Volume Information\_restore{DA8FCEF9-1EB5-46BF-968F-FD2080BE62BB}\RP71\A0003945.exe
已刪除: 特洛伊木馬程式 Trojan-GameThief.Win32.Magania.amob 檔案: C:\System Volume Information\_restore{DA8FCEF9-1EB5-46BF-968F-FD2080BE62BB}\RP72\A0003954.exe
已刪除: 特洛伊木馬程式 Trojan-GameThief.Win32.Magania.amoc 檔案: C:\System Volume Information\_restore{DA8FCEF9-1EB5-46BF-968F-FD2080BE62BB}\RP72\A0003955.dll
已刪除: 特洛伊木馬程式 Trojan-GameThief.Win32.Magania.amoc 檔案: C:\System Volume Information\_restore{DA8FCEF9-1EB5-46BF-968F-FD2080BE62BB}\RP72\A0003963.dll
已刪除: 特洛伊木馬程式 Trojan-GameThief.Win32.Magania.amob 檔案: C:\q1pady.cmd
已刪除: 特洛伊木馬程式 Trojan-GameThief.Win32.Magania.amob 檔案: C:\WINDOWS\system32\j3ewro.exe
已刪除: 特洛伊木馬程式 Trojan-GameThief.Win32.Magania.amoc 檔案: C:\WINDOWS\system32\jwedsfdo0.dll
已刪除: 特洛伊木馬程式 Trojan-GameThief.Win32.Magania.amob 檔案: D:\q1pady.cmd
已刪除: 特洛伊木馬程式 Trojan.Win32.Agent.aphc 檔案: D:\真三國無雙-5\真三5安裝檔\crack\asx-ss5_jpn.exe
已刪除: 特洛伊木馬程式 Trojan-GameThief.Win32.Magania.amob 檔案: E:\q1pady.cmd
已刪除: 特洛伊木馬程式 Trojan-GameThief.Win32.Magania.amob 檔案: C:\System Volume Information\_restore{DA8FCEF9-1EB5-46BF-968F-FD2080BE62BB}\RP126\A0016082.cmd
已刪除: 特洛伊木馬程式 Trojan-GameThief.Win32.Magania.amob 檔案: C:\System Volume Information\_restore{DA8FCEF9-1EB5-46BF-968F-FD2080BE62BB}\RP126\A0016093.exe
已偵測: riskware Hidden install 執行程序: C:\Documents and Settings\leonard\Local Settings\Temp\Rar$EX00.563\ViOrb OneStep.exe
已偵測: riskware Hidden install 執行程序: C:\Documents and Settings\leonard\Local Settings\Temp\Rar$EX00.750\ViSplore OneStep.exe
已刪除: 特洛伊木馬程式 Trojan-GameThief.Win32.Magania.amoc 檔案: C:\System Volume Information\_restore{DA8FCEF9-1EB5-46BF-968F-FD2080BE62BB}\RP126\A0016094.dll
已偵測: riskware Hidden install 執行程序: H:\AUTORUN.EXE
已偵測: riskware Invader 執行程序: C:\Documents and Settings\leonard\Local Settings\Temp\{7DC9399C-6783-4DD4-912F-CEACE3F19E8E}\setup.exe
已偵測: riskware Invader 執行程序: C:\Documents and Settings\leonard\Local Settings\Temp\{6AE4A0BA-8A79-4B01-A250-5A47841EC3BA}\setup.exe
已偵測: riskware Hidden install 執行程序: C:\Documents and Settings\leonard\Local Settings\Temp\Rar$EX00.125\ViStart OneStep.exe
已偵測: riskware Invader 執行程序: C:\Documents and Settings\leonard\Local Settings\Temp\{84061220-0C4B-4C23-961A-F305E1723ADB}\setup.exe
已偵測: riskware Invader 執行程序: C:\Documents and Settings\leonard\Local Settings\Temp\{DE9233B3-C77F-4583-BAB5-3258F107C246}\setup.exe
已偵測: riskware Invader 執行程序: D:\Program Files\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe
已偵測: riskware Hidden install 執行程序: C:\Documents and Settings\leonard\Local Settings\Temp\Rar$EX00.860\ViStart OneStep.exe
已刪除: 特洛伊木馬程式 Trojan-GameThief.Win32.Magania.amob 檔案: D:\System Volume Information\_restore{DA8FCEF9-1EB5-46BF-968F-FD2080BE62BB}\RP127\A0016096.cmd
已刪除: 特洛伊木馬程式 Trojan.Win32.Agent.aphc 檔案: D:\System Volume Information\_restore{DA8FCEF9-1EB5-46BF-968F-FD2080BE62BB}\RP129\A0016251.exe
已刪除: 特洛伊木馬程式 Trojan-GameThief.Win32.Magania.amob 檔案: E:\System Volume Information\_restore{DA8FCEF9-1EB5-46BF-968F-FD2080BE62BB}\RP129\A0016252.cmd
已偵測: riskware Hidden install 執行程序: C:\Program Files\Stardock\Object Desktop\WindowBlinds\UNWISE.EXE
已偵測: 特洛伊木馬程式 Trojan-Downloader.Win32.Banload.tvg 網址: http://fs04n2.sendspace.com/download...FastAeroWM.dll
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Banload.tvg 檔案: C:\DOCUME~1\leonard\LOCALS~1\Temp\Rar$EX01.735\fastaero0751\FastAeroWM.dll
已刪除: 特洛伊木馬程式 Trojan-Downloader.Win32.Banload.tvg 檔案: C:\DOCUME~1\leonard\LOCALS~1\Temp\Rar$EX14.953\fastaero0751\FastAeroWM.dll
已偵測: 特洛伊木馬程式 Trojan-Downloader.Win32.Banload.tvg 網址: http://fs04n5.sendspace.com/download...FastAeroWM.dll
已偵測: riskware Invader 執行程序: C:\Documents and Settings\leonard\Local Settings\Temp\{30A735AF-40D8-4C38-9C49-1F8F3463CC06}\setup.exe
已偵測: riskware Invader 執行程序: C:\Documents and Settings\leonard\Local Settings\Temp\{DC5CD4FA-934F-4535-99F4-29B5EC7FB485}\setup.exe
已偵測: riskware Invader 執行程序: C:\Documents and Settings\leonard\Local Settings\Temp\{DC1C6B2A-2F54-4E1A-990F-33289E97E80C}\setup.exe
已偵測: riskware Invader 執行程序: C:\Documents and Settings\leonard\Local Settings\Temp\{2E44F32C-4AF4-4FF5-BF1E-249AABDF5248}\setup.exe
已偵測: riskware Invader 執行程序: C:\Documents and Settings\leonard\Local Settings\Temp\_is708.exe
已偵測: riskware Invader 執行程序: C:\Documents and Settings\leonard\Local Settings\Temp\{7F099683-A39C-4BC9-B216-90BA2F8E8885}\setup.exe
已偵測: riskware Invader 執行程序: C:\Documents and Settings\leonard\Local Settings\Temp\~e5.0001
已偵測: riskware Invader 執行程序: C:\Documents and Settings\leonard\Local Settings\Temp\Rar$EX00.016\WindXX修改器.exe
已偵測: riskware Invader 執行程序: C:\Documents and Settings\leonard\桌面\WindXX修改器.exe
已刪除: 特洛伊木馬程式 Trojan.Win32.Agent2.cdb 檔案: C:\System Volume Information\_restore{DA8FCEF9-1EB5-46BF-968F-FD2080BE62BB}\RP144\A0026472.exe
已刪除: 特洛伊木馬程式 Trojan.Win32.Agent2.cdb 檔案: C:\WINDOWS\system32\scrnrdr.exe
已刪除: 特洛伊木馬程式 Trojan.Win32.Agent2.cdb 檔案: C:\WINDOWS\system32\viwc.exe
已偵測: riskware Invader 執行程序: C:\Documents and Settings\leonard\Local Settings\Temp\{062BC040-7699-4351-93AE-B40EEB9F3FD5}\setup.exe
已刪除: 特洛伊木馬程式 Trojan.Win32.Agent2.cdb 檔案: C:\System Volume Information\_restore{DA8FCEF9-1EB5-46BF-968F-FD2080BE62BB}\RP197\A0032676.exe
已偵測: riskware Invader 執行程序: C:\Documents and Settings\leonard\Local Settings\Temp\{D74AF4A6-9E27-436F-8181-82908EF0BBDD}\setup.exe
已偵測: riskware Invader 執行程序: C:\Documents and Settings\leonard\Local Settings\Temp\{77F65714-354E-4B03-A325-E3EB018D2F2D}\setup.exe
已刪除: 特洛伊木馬程式 Trojan.Win32.Agent2.cdb 檔案: C:\System Volume Information\_restore{DA8FCEF9-1EB5-46BF-968F-FD2080BE62BB}\RP197\A0032677.exe
已刪除: 特洛伊木馬程式 Trojan.Win32.Agent2.cdb 檔案: C:\System Volume Information\_restore{DA8FCEF9-1EB5-46BF-968F-FD2080BE62BB}\RP200\A0032931.exe


拜託幫忙了!!!!!!

[GaMNiA]

你的卡巴斯基防毒軟體已經將大部分的病毒都清除了，剩下下面那一隻沒刪除，
重新執行 HiajckThis ，將下面那二個項目勾選後，再按 [Fix checked]，執行完後，
重新開機，然後用檔案總管將 C:\WINDOWS\SVCHOST.EXE 手動刪除即可。
刪除完後，更新一下病毒碼，再重新掃描一次...

作者: asdfasdf00xz

O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll (file missing)
O4 - HKLM\..\Run: [svchost] C:\WINDOWS\SVCHOST.EXE

你的圖已經說明...所有威脅均已處理...

順便附上卡巴斯基的防護和一張昨天掃毒的圖: (還有我之前[已封鎖的攻擊]有2個 請問這是發生什麼事情呢?)