瑞星卡卡安全论坛

首页 » 技术交流区 » 反病毒/反流氓软件论坛 » 我的IBM笔记本最近老是蓝频~帮下忙,谢谢了
SaintJochen - 2006-6-7 21:35:00
有两个问题,一是在时间查看器里有这样两个

属性:

2006-6-7  来源:Symantec AntiVirus
发现威胁！威胁：SecurityRisk.eGatherer 位于文件：C:\IBMTOOLS\APPS\ACCESS\TEMP\ACPCON~1.DLL 由：自动防护 扫描。操作：隔离 失败 : 删除 失败 : 允许访问。操作说明：文件保持未变。

属性:

2006-6-7 来源:System Error
错误代码 1000000a，参数1 f895e480，参数2 00000002，参数3 00000001，参数4 80802bba。

有关更多信息，请参阅在 http://go.microsoft.com/fwlink/events.asp 的帮助和支持中心。

数据:
字节
0000: 53 79 73 74 65 6d 20 45  System E
0008: 72 72 6f 72 20 20 45 72  rror  Er
0010: 72 6f 72 20 63 6f 64 65  ror code
0018: 20 31 30 30 30 30 30 30    1000000
0020: 61 20 20 50 61 72 61 6d  a  Param
0028: 65 74 65 72 73 20 66 38  eters f8
0030: 39 35 65 34 38 30 2c 20  95e480,
0038: 30 30 30 30 30 30 30 32  00000002
0040: 2c 20 30 30 30 30 30 30  , 000000
0048: 30 31 2c 20 38 30 38 30  01, 8080
0050: 32 62 62 61              2bba   

字:
0000: 74737953 45206d65 726f7272 72452020
0010: 20726f72 65646f63 30303120 30303030
0020: 50202061 6d617261 72657465 38662073
0030: 34653539 202c3038 30303030 32303030
0040: 3030202c 30303030 202c3130 30383038
0050: 61626232


还有就是老是蓝频,重启后显示说在重大错误后恢复
我无邪 - 2006-6-7 21:30:00
请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。
SaintJochen - 2006-6-7 21:33:00
Hijackthis可以吗?
SaintJochen - 2006-6-7 21:41:00
2006-06-07,21:35:09

System Repair Engineer 2.0.12.350 (2.0 RC 1)
    Windows XP Professional Service Pack 2 - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <IBM RecordNow!><>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <load><>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <run><>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <S3TRAY2><; S3Tray2.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <SynTPLpr><C:\Program Files\Synaptics\SynTP\SynTPLpr.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <SynTPEnh><C:\Program Files\Synaptics\SynTP\SynTPEnh.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <ATIModeChange><; Ati2mdxx.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <BluetoothAuthenticationAgent><; rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <TPKMAPHELPER><C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <TpShocks><TpShocks.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <TPHOTKEY><C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <BMMLREF><C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <BMMMONWND><rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <TP4EX><tp4ex.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <EZEJMNAP><C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <ATIPTA><C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <ibmmessages><; C:\Program Files\IBM\Messages By IBM\\ibmmessages.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <UpdateManager><; "c:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <dla><C:\WINDOWS\system32\dla\tfswctrl.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <IBMPRC><C:\IBMTOOLS\UTILS\ibmprc.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <QCWLICON><C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <Mouse Suite 98 Daemon><ICO.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <BMMGAG><RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <MSPY2002><C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <SDJobCheck><triggusr.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <IMEKRMIG6.1><; C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <ccApp><; "C:\Program Files\Common Files\Symantec Shared\ccApp.exe">
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <vptray><; C:\PROGRA~1\SYMANT~2\VPTray.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <StormCodec_Helper><; "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <iTunesHelper><"C:\Program Files\iTunes\iTunesHelper.exe">
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <shell><Explorer.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <Userinit><C:\WINDOWS\system32\userinit.exe,,C:\ca\SxpInst\sxplog32.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <AppInit_DLLs><>

==================================
SaintJochen - 2006-6-7 21:41:00
启动文件夹
[Digital Line Detect]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Digital Line Detect.lnk><N>
[Microsoft Office]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Microsoft Office.lnk><N>

==================================
服务
[Ati HotKey Poller / Ati HotKey Poller]
  <C:\WINDOWS\System32\Ati2evxx.exe><N/A>
[Symantec Event Manager / ccEvtMgr]
  <"C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"><Symantec Corporation>
[Symantec Password Validation / ccPwdSvc]
  <"C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe"><Symantec Corporation>
[Symantec Settings Manager / ccSetMgr]
  <"C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"><Symantec Corporation>
[Symantec AntiVirus Definition Watcher / DefWatch]
  <"C:\Program Files\Symantec AntiVirus\DefWatch.exe"><Symantec Corporation>
[IBM Rapid Restore Ultra Service / IBM Rapid Restore Ultra Service]
  <C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe><>
[IBM PM Service / IBMPMSVC]
  <C:\WINDOWS\System32\ibmpmsvc.exe><N/A>
[InstallDriver Table Manager / IDriverT]
  <"C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe"><Macrovision Corporation>
[iPodService / iPodService]
  <C:\Program Files\iPod\bin\iPodService.exe><Apple Computer, Inc.>
[IBM PSA Access Driver Control / PsaSrv]
  <C:\WINDOWS\system32\PsaSrv.exe><N/A>
[QCONSVC / QCONSVC]
  <System32\QCONSVC.EXE><IBM Corp.>
[RegSrvc / RegSrvc]
  <C:\WINDOWS\System32\RegSrvc.exe><Intel Corporation>
[Spectrum24 Event Monitor / S24EventMonitor]
  <C:\WINDOWS\System32\S24EvMon.exe><Intel Corporation >
[SavRoam / SavRoam]
  <"C:\Program Files\Symantec AntiVirus\SavRoam.exe"><symantec>
[Unicenter Software Delivery / SDService]
  <C:\CA\TNGSD\BIN\SDSERV.EXE><Computer Accociates, Intl Inc.>
[Symantec Network Drivers Service / SNDSrvc]
  <"C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe"><Symantec Corporation>
[Symantec SPBBCSvc / SPBBCSvc]
  <"C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe"><Symantec Corporation>
[Symantec AntiVirus / Symantec AntiVirus]
  <"C:\Program Files\Symantec AntiVirus\Rtvscan.exe"><Symantec Corporation>
[IBM KCU Service / TpKmpSVC]
  <C:\WINDOWS\system32\TpKmpSVC.exe><N/A>
[TrcBoot / TrcBoot]
  <C:\WINDOWS\System32\drivers\trcboot.exe><N/A>

==================================
浏览器加载项
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[DriveLetterAccess]
  {5CA3D70E-1895-11CF-8E15-001234567890} <C:\WINDOWS\system32\dla\tfswshx.dll, Sonic Solutions>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
  {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[BitCometBar]
  {3F1ABCDB-A875-46c1-8345-B72A4567E486} <C:\Program Files\BitComet\BitCometBar\BitCometBar0.3.dll, N/A>
[Java Plug-in 1.4.1]
  {8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\IBM\Java141\jre\bin\NPJPI141.dll, IBM.>
[Java Plug-in 1.4.1]
  {CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA} <C:\Program Files\IBM\Java141\jre\bin\NPJPI141.dll, IBM.>
[BitCometBar]
  {3F1ABCDB-A875-46C1-8345-B72A4567E486} <C:\Program Files\BitComet\BitCometBar\BitCometBar0.3.dll, N/A>
[HHCtrl Object]
  {52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[DriveLetterAccess]
  {5CA3D70E-1895-11CF-8E15-001234567890} <C:\WINDOWS\system32\dla\tfswshx.dll, Sonic Solutions>
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\System32\shdocvw.dll, Microsoft Corporation>
[SearchAssistantOC]
  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\System32\shdocvw.dll, N/A>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx, Macromedia, Inc.>
[上传到QQ网络硬盘]
  <C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
  <C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================
SaintJochen - 2006-6-7 21:42:00
正在运行的进程
[PID: 860][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 940][\??\C:\WINDOWS\system32\csrss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 972][\??\C:\WINDOWS\system32\winlogon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\Ati2evxx.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\NavLogon.dll]  <Symantec Corporation><10.0.1.1000>
[PID: 1048][C:\WINDOWS\system32\services.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1060][C:\WINDOWS\system32\lsass.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\pwdmon.dll]  <N/A><N/A>
[PID: 1236][C:\WINDOWS\System32\ibmpmsvc.exe]  <N/A><N/A>
[PID: 1260][C:\WINDOWS\System32\Ati2evxx.exe]  <N/A><N/A>
[PID: 1276][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1384][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1420][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1544][C:\WINDOWS\System32\S24EvMon.exe]  <Intel Corporation ><4, 1, 0, 3>
[PID: 1596][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1680][C:\WINDOWS\system32\Ati2evxx.exe]  <N/A><N/A>
[PID: 1744][C:\ca\SxpInst\sxplog32.exe]  <Computer Associates International, Inc.><6.3/19>
    [C:\ca\SxpInst\CCSINI32.dll]  <Computer Associates International, Inc.><6.3/17>
    [C:\CA\TNGSD\BIN\SDStrCnv.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\CAWINEXF.dll]  <Computer Associates International, Inc.><1.19.1>
    [C:\ca\SxpInst\ccsTrc32.dll]  <Computer Associates International, Inc.><6.3/17>
    [C:\ca\SxpInst\CCSLCK32.dll]  <Computer Associates International, Inc.><6.3/17>
    [C:\ca\SxpInst\CCSTOO32.dll]  <Computer Associates International, Inc.><6.3/19>
    [C:\ca\SxpInst\SXPAAF32.dll]  <Computer Associates International, Inc.><6.3/17>
    [C:\ca\SxpInst\SXP2MSI.dll]  <N/A><N/A>
    [C:\CA\TNGSD\SD\NLS\sxplog32.ENU]  <Computer Associates International, Inc.><6.3/20>
[PID: 1820][C:\WINDOWS\Explorer.EXE]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.8 19Nov03>
    [C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll]  <IBM Corp.><1, 0, 0, 0>
    [C:\WINDOWS\system32\pelscrll.dll]  <Primax Electronics Ltd.><1, 0, 9, 0>
    [C:\WINDOWS\system32\PELCOMM.dll]  <Primax Electronics Ltd.><1, 0, 3, 4>
    [C:\WINDOWS\system32\PELHOOKS.dll]  <Primax Electronics Ltd.><1, 0, 5, 2>
    [C:\WINDOWS\system32\dla\tfswshx.dll]  <Sonic Solutions><1.04.07a>
    [C:\WINDOWS\system32\tfswapi.dll]  <Sonic Solutions><1.04.07a>
    [C:\WINDOWS\system32\dla\tfswcres.dll]  <Sonic Solutions><1.04.07a>
    [C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll]  <Symantec Corporation><10.0.1.1000>
    [C:\Program Files\WinRAR\rarext.dll]  <N/A><N/A>
[PID: 168][C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe]  <Symantec Corporation><103.5.4.3>
    [C:\Program Files\Common Files\Symantec Shared\ccL35.dll]  <Symantec Corporation><103.5.4.3>
    [C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll]  <Symantec Corporation><103.5.4.3>
    [C:\Program Files\Common Files\Symantec Shared\ccSetEvt.dll]  <Symantec Corporation><103.5.4.3>
[PID: 260][C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe]  <Symantec Corporation><103.5.4.3>
    [C:\Program Files\Common Files\Symantec Shared\ccL35.dll]  <Symantec Corporation><103.5.4.3>
    [C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll]  <Symantec Corporation><103.5.4.3>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\SPBBC\BB.DLL]  <Symantec Corporation><1,5,1,3>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\SPBBC\SPBBCEVT.DLL]  <Symantec Corporation><1,5,1,3>
    [C:\Program Files\Common Files\Symantec Shared\ccSet.dll]  <Symantec Corporation><103.5.4.3>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\CCSETEVT.DLL]  <Symantec Corporation><103.5.4.3>
[PID: 468][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 496][C:\WINDOWS\System32\drivers\trcboot.exe]  <N/A><N/A>
[PID: 520][C:\Program Files\Symantec AntiVirus\DefWatch.exe]  <Symantec Corporation><10.0.1.1000>
[PID: 600][C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe]  <><4,0,0,4026>
[PID: 768][C:\WINDOWS\System32\QCONSVC.EXE]  <IBM Corp.><3, 1, 0, 0>
[PID: 880][C:\Program Files\Symantec AntiVirus\SavRoam.exe]  <symantec><10.0.1.1000>
    [C:\Program Files\Common Files\Symantec Shared\SSC\Transman.dll]  <Symantec Corporation><10.0.1.1000>
    [C:\WINDOWS\system32\CBA.DLL]  <LANDesk Software Ltd.><6.12.0.137 E>
    [C:\WINDOWS\system32\MsgSys.dll]  <LANDesk Software Ltd.><6.12.0.137 E>
    [C:\WINDOWS\system32\NTS.dll]  <LANDesk Software Ltd.><6.12.0.137 E>
    [C:\WINDOWS\system32\PDS.DLL]  <LANDesk Software Ltd.><6.12.0.137 E>
    [c:\program files\common files\symantec shared\ssc\ScsComms.dll]  <Symantec Corporation><10.0.1.1000>
[PID: 1008][C:\CA\TNGSD\BIN\SDSERV.EXE]  <Computer Accociates, Intl Inc.><3, 0, 0, 1>
    [C:\CA\TNGSD\BIN\CTRLCOM.DLL]  <N/A><N/A>
    [C:\CA\TNGSD\BIN\RDCNF.dll]  <N/A><N/A>
    [C:\CA\TNGSD\BIN\SDStrCnv.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\CAWINEXF.dll]  <Computer Associates International, Inc.><1.19.1>
    [C:\CA\TNGSD\BIN\SDWINAPI.dll]  <N/A><N/A>
    [C:\CA\TNGSD\BIN\SDWCHAR.dll]  <N/A><N/A>
[PID: 1752][C:\Program Files\Symantec AntiVirus\Rtvscan.exe]  <Symantec Corporation><10.0.1.1000>
    [C:\WINDOWS\system32\CBA.DLL]  <LANDesk Software Ltd.><6.12.0.137 E>
    [C:\WINDOWS\system32\MsgSys.dll]  <LANDesk Software Ltd.><6.12.0.137 E>
    [C:\WINDOWS\system32\NTS.dll]  <LANDesk Software Ltd.><6.12.0.137 E>
    [C:\WINDOWS\system32\PDS.DLL]  <LANDesk Software Ltd.><6.12.0.137 E>
    [C:\Program Files\Symantec AntiVirus\NAVLU.dll]  <Symantec Corporation><10.0.1.1000>
    [C:\Program Files\Symantec AntiVirus\NAVNTUTL.DLL]  <Symantec Corporation><10.0.1.1000>
    [c:\program files\common files\symantec shared\ssc\ScsComms.dll]  <Symantec Corporation><10.0.1.1000>
    [C:\Program Files\Symantec AntiVirus\I2ldvp3.dll]  <Symantec Corporation><10.0.1.1000>
    [C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll]  <Symantec Corporation><103.5.4.3>
    [C:\Program Files\Common Files\Symantec Shared\ccL35.dll]  <Symantec Corporation><103.5.4.3>
    [C:\Program Files\Common Files\Symantec Shared\ccDec.dll]  <Symantec Corporation><103.5.4.3>
    [C:\Program Files\Common Files\Symantec Shared\Decomposers\decsdk.dll]  <Symantec Corporation><3.02.12.35>
    [C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2.dll]  <Symantec Corporation><3.02.12.35>
    [C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2ID.dll]  <Symantec Corporation><3.02.12.35>
    [C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2Zip.dll]  <Symantec Corporation><3.02.12.35>
    [C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2SS.dll]  <Symantec Corporation><3.02.12.35>
    [C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2GZIP.dll]  <Symantec Corporation><3.02.12.35>
    [C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2CAB.dll]  <Symantec Corporation><3.02.12.35>
    [C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2LHA.dll]  <Symantec Corporation><3.02.12.35>
    [C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2ARJ.dll]  <Symantec Corporation><3.02.12.35>
    [C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2TNEF.dll]  <Symantec Corporation><3.02.12.35>
    [C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2LZ.dll]  <Symantec Corporation><3.02.12.35>
    [C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2AMG.dll]  <Symantec Corporation><3.02.12.35>
    [C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2RAR.dll]  <Symantec Corporation><3.02.12.35>
    [C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2TAR.dll]  <Symantec Corporation><3.02.12.35>
    [C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2RTF.dll]  <Symantec Corporation><3.02.12.35>
    [C:\Program Files\Common Files\Symantec Shared\Decomposers\Dec2Text.dll]  <Symantec Corporation><3.02.12.35>
    [C:\Program Files\Common Files\Symantec Shared\ccScan.dll]  <Symantec Corporation><103.5.4.3>
    [C:\Program Files\Common Files\Symantec Shared\ecmldr32.DLL]  <Symantec Corporation><1.4.0.11>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20060327.006\ccEraser.dll]  <Symantec Corporation><105.0.2.3>
    [C:\Program Files\Symantec AntiVirus\DefUtDCD.dll]  <Symantec Corporation><3.1.13a.0>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20060327.006\ecmsvr32.dll]  <Symantec Corporation><51.3.0.11>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20060327.006\NAVEX32a.DLL]  <Symantec Corporation><20051.3.1.11>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20060327.006\NAVENG32.DLL]  <Symantec Corporation><20051.3.1.11>
    [C:\Program Files\Symantec AntiVirus\NAVAP32.DLL]  <Symantec Corporation><9.5.0.44>
    [C:\Program Files\Symantec AntiVirus\SAVRT32.DLL]  <Symantec Corporation><9.5.0.44>
    [C:\Program Files\Symantec AntiVirus\IMail.dll]  <Symantec Corporation><10.0.1.1000>
    [C:\Program Files\Symantec AntiVirus\NotesExt.dll]  <Symantec Corporation><10.0.1.1000>
    [C:\Program Files\Symantec AntiVirus\vpmsece3.dll]  <Symantec Corporation><10.0.1.1000>
    [C:\Program Files\Symantec AntiVirus\SymProtectStorage.dll]  <Symantec Corporation><10.0.1.1000>
    [C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCEvt.dll]  <Symantec Corporation><1,5,1,3>
SaintJochen - 2006-6-7 21:43:00
[PID: 172][C:\WINDOWS\system32\TpKmpSVC.exe]  <N/A><N/A>
[PID: 192][C:\CA\TNGSD\BIN\TRIGGAG.EXE]  <N/A><N/A>
    [C:\CA\TNGSD\BIN\ACPORT32.dll]  <N/A><N/A>
    [C:\CA\TNGSD\BIN\RDCNF.dll]  <N/A><N/A>
    [C:\CA\TNGSD\BIN\SDStrCnv.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\CAWINEXF.dll]  <Computer Associates International, Inc.><1.19.1>
    [C:\CA\TNGSD\BIN\SDWINAPI.dll]  <N/A><N/A>
    [C:\CA\TNGSD\BIN\CTRLCOM.dll]  <N/A><N/A>
    [C:\CA\TNGSD\BIN\SDWCHAR.dll]  <N/A><N/A>
    [C:\CA\TNGSD\BIN\SDLIC.dll]  <N/A><N/A>
    [C:\CA\TNGSD\BIN\SDNLS.dll]  <N/A><N/A>
    [C:\CA\TNGSD\BIN\SDRES.dll]  <N/A><N/A>
[PID: 200][C:\WINDOWS\system32\wdfmgr.exe]  <Microsoft Corporation><5.2.3790.1230 built by: DNSRV(bld4act)>
[PID: 1920][C:\WINDOWS\System32\alg.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1928][C:\Program Files\Synaptics\SynTP\SynTPLpr.exe]  <Synaptics, Inc.><7.5.17.8 19Nov03>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.8 19Nov03>
[PID: 1580][C:\Program Files\Synaptics\SynTP\SynTPEnh.exe]  <Synaptics, Inc.><7.5.17.8 19Nov03>
    [C:\WINDOWS\System32\SynCOM.dll]  <Synaptics, Inc.><7.5.17.8 19Nov03>
    [C:\WINDOWS\system32\SynTPAPI.dll]  <Synaptics, Inc.><7.5.17.8 19Nov03>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.8 19Nov03>
[PID: 1656][C:\WINDOWS\system32\TpShocks.exe]  <IBM Corp.><1, 0, 0, 1>
    [C:\WINDOWS\system32\Sensor.dll]  <N/A><N/A>
[PID: 1672][C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe]  <N/A><N/A>
    [C:\Program Files\ThinkPad\PkgMgr\HOTKEY_2\tphk_2k.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\Oemdspif.dll]  <ATI Technologies, Inc.><6.14.0010>
[PID: 1764][C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe]  <N/A><N/A>
[PID: 1772][C:\WINDOWS\system32\rundll32.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll]  <N/A><N/A>
    [C:\PROGRA~1\ThinkPad\UTILIT~1\tppwrw32.dll]  <IBM Corp.><1, 0, 0, 0>
[PID: 1800][C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe]  <IBM Corporation><1.06>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.8 19Nov03>
[PID: 1376][C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe]  <IBM Corp.><1, 0, 0, 0>
[PID: 2172][C:\WINDOWS\system32\dla\tfswctrl.exe]  <Sonic Solutions><1.04.07a>
    [C:\WINDOWS\system32\tfswapi.dll]  <Sonic Solutions><1.04.07a>
    [C:\WINDOWS\system32\dla\tfswcres.dll]  <Sonic Solutions><1.04.07a>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.8 19Nov03>
[PID: 2180][C:\IBMTOOLS\UTILS\ibmprc.exe]  <IBM Corp.><1, 0, 0, 3>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.8 19Nov03>
[PID: 2192][C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE]  <IBM Corp.><3, 1, 0, 0>
    [C:\Program Files\ThinkPad\ConnectUtilities\QCON.dll]  <IBM Corp.><3, 1, 0, 0>
    [C:\Program Files\ThinkPad\ConnectUtilities\MerlinC201.dll]  <Novatel Wireless Inc.><1, 0, 0, 1>
    [C:\Program Files\ThinkPad\ConnectUtilities\ANCA.dll]  <N/A><N/A>
    [C:\Program Files\ThinkPad\ConnectUtilities\ANC.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\SbrngAPI.dll]  <Intel Corporation><1, 7, 0, 0>
    [C:\WINDOWS\system32\PfMgrApi.dll]  <Intel Corporation><4, 1, 0, 0>
    [C:\WINDOWS\system32\PsRegApi.dll]  <Intel Corporation><4, 1, 0, 0>
    [C:\WINDOWS\system32\WConfig.DLL]  <Intel Corporation><4, 1, 0, 1>
    [C:\WINDOWS\system32\WiFiAdap.DLL]  <Intel Corporation><4, 1, 0, 0>
    [C:\WINDOWS\system32\S24MUDLL.dll]  <Intel Corporation><4, 1, 0, 3>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.8 19Nov03>
    [C:\Program Files\ThinkPad\ConnectUtilities\Res\CH\IconRes.dll]  <N/A><N/A>
[PID: 2200][C:\WINDOWS\system32\ICO.EXE]  <Primax Electronics Ltd.><1, 0, 1, 0>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.8 19Nov03>
[PID: 2208][C:\WINDOWS\system32\RunDll32.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll]  <IBM Corp.><1, 0, 0, 0>
    [C:\PROGRA~1\ThinkPad\UTILIT~1\tppwrw32.dll]  <IBM Corp.><1, 0, 0, 0>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.8 19Nov03>
[PID: 2224][C:\CA\TNGSD\BIN\triggusr.exe]  <N/A><N/A>
    [C:\CA\TNGSD\BIN\RDCNF.dll]  <N/A><N/A>
    [C:\CA\TNGSD\BIN\SDStrCnv.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\CAWINEXF.dll]  <Computer Associates International, Inc.><1.19.1>
    [C:\CA\TNGSD\BIN\SDWINAPI.dll]  <N/A><N/A>
    [C:\CA\TNGSD\BIN\SDOSAPI.dll]  <N/A><N/A>
    [C:\CA\TNGSD\BIN\ASMCOM32.dll]  <N/A><N/A>
    [C:\CA\TNGSD\BIN\ACPORT32.dll]  <N/A><N/A>
    [C:\CA\TNGSD\BIN\NATFCL32.dll]  <N/A><N/A>
    [C:\CA\TNGSD\BIN\SDWCHAR.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.8 19Nov03>
[PID: 2232][C:\Program Files\iTunes\iTunesHelper.exe]  <Apple Computer, Inc.><6.0.0.18>
    [C:\Program Files\iTunes\iTunesHelper.Resources\zh_CN.lproj\iTunesHelperLocalized.DLL]  <Apple Computer, Inc.><6.0.0.7>
    [C:\Program Files\iTunes\iTunesHelper.Resources\iTunesHelper.DLL]  <Apple Computer, Inc.><6.0.0.18>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.8 19Nov03>
[PID: 2248][C:\WINDOWS\system32\ctfmon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.8 19Nov03>
[PID: 2264][C:\Program Files\Digital Line Detect\DLG.exe]  <BVRP Software><1, 0, 0, 1>
    [C:\Program Files\Digital Line Detect\BVRPDIAG.dll]  <BVRP Software><1.0>
    [C:\WINDOWS\system32\MdmXSdk.dll]  <Conexant><1.0.2.006>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.8 19Nov03>
[PID: 2288][C:\WINDOWS\system32\FSRremoS.EXE]  <><1, 0, 0, 3>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.8 19Nov03>
[PID: 2344][C:\WINDOWS\system32\Pelmiced.exe]  <Primax Electronics Ltd.><1, 0, 9, 9>
    [C:\WINDOWS\system32\PELUTIL.dll]  <Primax Electronics Ltd.><1, 0, 9, 2>
    [C:\WINDOWS\system32\PELCOMM.dll]  <Primax Electronics Ltd.><1, 0, 3, 4>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.8 19Nov03>
    [C:\WINDOWS\system32\pelhooks.dll]  <Primax Electronics Ltd.><1, 0, 5, 2>
    [C:\WINDOWS\system32\Pelzoom.dll]  <Primax Electronics Ltd.><1, 0, 1, 0>
    [C:\WINDOWS\system32\pelscrll.dll]  <Primax Electronics Ltd.><1, 0, 9, 0>
[PID: 2380][C:\Program Files\iPod\bin\iPodService.exe]  <Apple Computer, Inc.><6.0.0.18>
    [C:\Program Files\iPod\bin\iPodService.Resources\zh_CN.lproj\iPodServiceLocalized.DLL]  <Apple Computer, Inc.><6.0.0.7>
    [C:\Program Files\iPod\bin\iPodService.Resources\iPodService.DLL]  <Apple Computer, Inc.><6.0.0.18>
[PID: 2876][C:\Program Files\Internet Explorer\iexplore.exe]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.8 19Nov03>
    [C:\Program Files\BitComet\BitCometBar\BitCometBar0.3.dll]  <N/A><0, 3, 0, 0>
    [C:\Program Files\Tencent\QQ\QQIEHelper.dll]  <深圳市腾讯计算机系统有限公司><1, 1, 0, 5>
    [C:\WINDOWS\system32\dla\tfswshx.dll]  <Sonic Solutions><1.04.07a>
    [C:\WINDOWS\system32\tfswapi.dll]  <Sonic Solutions><1.04.07a>
    [C:\WINDOWS\system32\dla\tfswcres.dll]  <Sonic Solutions><1.04.07a>
    [C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx]  <Macromedia, Inc.><8,0,24,0>
    [C:\WINDOWS\system32\pelscrll.dll]  <Primax Electronics Ltd.><1, 0, 9, 0>
    [C:\WINDOWS\system32\PELCOMM.dll]  <Primax Electronics Ltd.><1, 0, 3, 4>
    [C:\WINDOWS\system32\PELHOOKS.dll]  <Primax Electronics Ltd.><1, 0, 5, 2>
[PID: 3544][C:\Documents and Settings\gh\My Documents\sreng2\SREng.exe]  <Smallfrogs Studio><2.0.12.350>
    [C:\WINDOWS\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.8 19Nov03>
SaintJochen - 2006-6-7 21:43:00
==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  Error. []
.JS  Error. []
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
SaintJochen - 2006-6-7 21:44:00
下面是HIJACKTHIS扫描的
Logfile of HijackThis v1.99.1
Scan saved at 21:40:08, on 2006-6-7
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\ca\SxpInst\sxplog32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\drivers\trcboot.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
C:\WINDOWS\System32\QCONSVC.EXE
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\CA\TNGSD\BIN\SDSERV.EXE
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\TpKmpSVC.exe
C:\CA\TNGSD\BIN\TRIGGAG.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\TpShocks.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\IBMTOOLS\UTILS\ibmprc.exe
C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
C:\WINDOWS\system32\ICO.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\CA\TNGSD\BIN\triggusr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\FSRremoS.EXE
C:\WINDOWS\system32\Pelmiced.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\gh\My Documents\hijackthis\HijackThis.exe
SaintJochen - 2006-6-7 21:44:00
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,,C:\ca\SxpInst\sxplog32.exe
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O3 - Toolbar: BitCometBar - {3F1ABCDB-A875-46c1-8345-B72A4567E486} - C:\Program Files\BitComet\BitCometBar\BitCometBar0.3.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [S3TRAY2] ; S3Tray2.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIModeChange] ; Ati2mdxx.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] ; rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE
O4 - HKLM\..\Run: [BMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ibmmessages] ; C:\Program Files\IBM\Messages By IBM\\ibmmessages.exe
O4 - HKLM\..\Run: [UpdateManager] ; "c:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [IBMPRC] C:\IBMTOOLS\UTILS\ibmprc.exe
O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [SDJobCheck] triggusr.exe
O4 - HKLM\..\Run: [IMEKRMIG6.1] ; C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [ccApp] ; "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] ; C:\PROGRA~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [StormCodec_Helper] ; "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm
O9 - Extra button: IBM Java 控制台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java141\jre\bin\NPJPI141.dll
O9 - Extra 'Tools' menuitem: IBM Java 控制台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java141\jre\bin\NPJPI141.dll
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [JAVA_IBM] Java (IBM)
O17 - HKLM\System\CCS\Services\Tcpip\..\{39B0374F-2D5C-4C71-91D5-FBB9F01055C7}: NameServer = 10.250.243.10,10.250.243.11
O17 - HKLM\System\CCS\Services\Tcpip\..\{A834DA1D-FE6D-46BC-9C68-06A10EA5B7A0}: NameServer = 192.168.1.181
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Unicenter Software Delivery (SDService) - Computer Accociates, Intl Inc. - C:\CA\TNGSD\BIN\SDSERV.EXE
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
O23 - Service: TrcBoot - Unknown owner - C:\WINDOWS\System32\drivers\trcboot.exe
SaintJochen - 2006-6-8 17:26:00
发好了
我无邪 - 2006-6-8 21:23:00
C:\ca\SxpInst\sxplog32.exe这个你知道是什么吗？
我看诺顿的杀毒目录，这应该是IBM的东东。
我认为是诺顿在误报
建议卸载卸载，看看能否解决蓝屏的问题
最后，修复一下。
运行System Repair Engineer，使用“系统修复，文件关联，勾选“全选”点“修复”使所有扩展名都恢复正常。
城市豆沙包 - 2006-6-8 21:38:00
System Repair Engineer
那里下啊.
1
查看完整版本: 我的IBM笔记本最近老是蓝频~帮下忙,谢谢了
© 2000 - 2026 Rising Corp. Ltd.