瑞星卡卡安全论坛

Logfile of HijackThis v1.99.1
Scan saved at 15:34:54, on 2006-7-26
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\explorer.exe
F:\WINDOWS\SOUNDMAN.EXE
F:\Program Files\Common Files\Real\Update_OB\realsched.exe
F:\WINDOWS\System32\RUNDLL32.EXE
F:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
F:\PROGRA~1\Yahoo!\Assistant\yassistse.exe
F:\WINDOWS\System32\ctfmon.exe
F:\WINDOWS\System32\rundll32.exe
F:\WINDOWS\System32\nvsvc32.exe
F:\WINDOWS\wincup\wincup.exe
C:\QQ\QQ.exe
C:\QQ\TIMPlatform.exe
F:\WINDOWS\System32\conime.exe
F:\Program Files\Internet Explorer\IEXPLORE.EXE
F:\Documents and Settings\Leona\桌面\HijackThis.exe

F2 - REG:system.ini: Shell=explorer.exe 1
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - F:\WINDOWS\System32\xunleibho_v14.dll
O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - F:\PROGRA~1\Yahoo!\ASSIST~1\assist\yphtb.dll
O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - F:\PROGRA~1\Yahoo!\ASSIST~1\assist\yangling.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\QQ\QQIEHelper.dll
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - F:\PROGRA~1\Yahoo!\ASSIST~1\assist\YDRAGS~1.DLL
O2 - BHO: Vision - {6671A431-5C3D-463d-A7CF-5587F9B7E191} - F:\PROGRA~1\MMSASS~1\mmsass~1.dll
O2 - BHO: stdup - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - F:\WINDOWS\SYSTEM32\stdup.dll (file missing)
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\FALSHGET\FLASHGET\jccatch.dll
O2 - BHO: AssistHelper - {FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8} - F:\PROGRA~1\Yahoo!\ASSIST~1\assist\yassist.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - F:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: 雅虎助手 - {406F94F0-504F-4A40-8DFD-58B0666ABEBD} - F:\PROGRA~1\Yahoo!\Assistant\Assist\yasbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] F:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] F:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] F:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [TkBellExe] "F:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TProgram] F:\WINDOWS\smss.exe
O4 - HKLM\..\Run: [Syetwlyes] F:\WINDOWS\System32\algesteiybs.exe
O4 - HKLM\..\Run: [NTdhcp] F:\WINDOWS\System32\NTdhcp.exe
O4 - HKLM\..\Run: [YLive.exe] F:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
O4 - HKLM\..\Run: [yassistse] "F:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = F:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: >>彩信发送<< - res://F:\PROGRA~1\MMSASS~1\mmsass~1.dll/mms.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 使用网际快车下载 - C:\FALSHGET\FLASHGET\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\FALSHGET\FLASHGET\jc_all.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\QQ\SendMMS.htm
O9 - Extra button: (no name) - {6671A433-5C3D-463d-A7CF-5587F9B7E191} - F:\PROGRA~1\MMSASS~1\mmsass~1.dll
O9 - Extra 'Tools' menuitem: 彩E精灵设置 - {6671A433-5C3D-463d-A7CF-5587F9B7E191} - F:\PROGRA~1\MMSASS~1\mmsass~1.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - F:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - F:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\QQ\QQIEHelper.dll
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://F:\TempEI4\EI40_\msxml4.cab
O16 - DPF: {A96C48EA-AA88-4BBD-B58C-7B41146A6EAC} (Qzone Media Tools) - http://qz-photo.qq.com/qzone3/QzoneMediaTools.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3040661D-CA0B-4534-94B1-297DEB3A4449}: NameServer = 202.96.209.134 202.96.209.6
O17 - HKLM\System\CS1\Services\Tcpip\..\{3040661D-CA0B-4534-94B1-297DEB3A4449}: NameServer = 202.96.209.134 202.96.209.6
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "F:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: reset5 - F:\WINDOWS\SYSTEM32\reset5.dll
O21 - SSODL: SysTime - {724C75F1-B757-408D-A50A-4CF99DA35D73} - F:\PROGRA~1\WinKld\WinKld.dll
O23 - Service: Adobe LM Service - Unknown owner - F:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - F:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\System32\nvsvc32.exe
O23 - Service: WinWrCup - MsWinCup - F:\WINDOWS\wincup\wincup.exe




这个啥情况```

T。T 米人吗。。。

【回复“KiSsy1217”的帖子】
http://forum.ikaka.com/topic.asp?board=28&artid=8122728

楼上滴```这个素什么

版主你没仔细看哦!)
还有这个列:
修复
O4 - HKLM\..\Run: [TProgram] F:\WINDOWS\smss.exe
删除F:\WINDOWS\smss.exe
不知道楼主机子有什么问题?
还有啊,那么多流氓文件,开机慢的话去  反浏览器劫持版 置顶帖下载删除恶意软件的工具
http://forum.ikaka.com/topic.asp?board=67&artid=5188931

问题。。。我游戏ID被盗了``机器里貌似有木马`
具体```该怎么操作恩``T-T 偶是电脑白痴```来的

引用:

O4 - HKLM\..\Run: [TProgram] F:\WINDOWS\smss.exe 删除F:\WINDOWS\smss.exe ...........................

饿```具体~~怎么操作恩```

引用:

【KiSsy1217的贴子】 引用: O4 - HKLM\..\Run: [TProgram] F:\WINDOWS\smss.exe 删除F:\WINDOWS\smss.exe ........................... 饿```具体~~怎么操作恩``` ...........................

呵呵，问得好，要是有那么简单就好了……

F:\WINDOWS\smss.exe，参考http://forum.ikaka.com/topic.asp?board=28&artid=8046765
注意你的系统盘是F盘，就是这一点不同。

O4 - HKLM\..\Run: [Syetwlyes] F:\WINDOWS\System32\algesteiybs.exe
O4 - HKLM\..\Run: [NTdhcp] F:\WINDOWS\System32\NTdhcp.exe
修复这两项，删除（如果还有的话）
F:\WINDOWS\System32\algesteiybs.exe
F:\WINDOWS\System32\NTdhcp.exe

其他的照版主说的办。

``修复``删除`` -。- 咋弄```

...这木马很BT...如果动手能力差建议重装...或者ghost

重装。。。装8来。。。GHOST素什么。。

引用:

【KiSsy1217的贴子】重装。。。装8来。。。GHOST素什么。。 ...........................

看了这个帖子及全部回帖。
楼主啊——在身边找个明白人帮你搞吧。
再这么讨论下去——恐怕会出人命的。

简单的说...
你完全可以重装去了...

T.T 是~~~

呵呵  比我还菜`

T.T 作孽的偶``` 这木马怎么来的也8晓得
偶又米乱接别人发滴东西 又米去8该去的网站```

21世纪啥最多？  木马呗`

汗下`` ||| 明天拿去给修电脑滴地方重装下好了