瑞星卡卡安全论坛

HijackThis_zww汉化版扫描日志 V1.99.1
保存于      20:33:14, 日期 2006-9-4
操作系统：  Windows XP SP2, v.2096 (WinNT 5.01.2600)
浏览器：    Internet Explorer v6.00 SP2 (6.00.2900.2096)

当前运行的进程：         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\CTFMON.EXE
D:\毒霸\MailMon.exe
C:\WINDOWS\regedit.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\conime.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\新建文件夹 (2)\SREng2\SREng.exe
D:\新建文件夹 (2)\HijackThis1991汉化版\HijackThis1991zww.exe

O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [KAVRUN] D:\毒霸\KAVRUN.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - 浏览器额外的按钮: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - 浏览器额外的“工具”菜单项: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{71F9FBC7-18E8-4918-875B-F058C02E58FF}: NameServer = 202.103.225.68 202.103.224.68

怎么没有服务项?其他的正常。。。
问题描述一下

重装过后,机器依然很卡!至于服务项怎么没有,我不清楚!以往我都是这样扫描程序的!刚用毒霸查了一下毒,所有硬盘有39个病毒,感染的都是*.exe文件,提示是清除干净了!现在除了系统盘另外几个硬盘右键点开看的话，都是"AUTO"在首位的,我不敢双击!打开这几个盘都是右键,现在!如果有必要的我想用SREng2扫描上来看看!!

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [Microsoft Corporation]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [Microsoft Corporation]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [Microsoft Corporation]
    <KAVRUN><D:\毒霸\KAVRUN.EXE>  [kingsoft]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [Microsoft Corporation]

==================================
启动文件夹
服务

==================================
浏览器加载项
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\system32\msdxm.ocx, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\swflash.ocx, Macromedia, Inc.>

==================================
正在运行的进程
[PID: 416][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)>
[PID: 480][\??\C:\WINDOWS\system32\csrss.exe]  <Microsoft Corporation><5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)>
[PID: 504][\??\C:\WINDOWS\system32\winlogon.exe]  <Microsoft Corporation><5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)>
[PID: 548][C:\WINDOWS\system32\services.exe]  <Microsoft Corporation><5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)>
[PID: 560][C:\WINDOWS\system32\lsass.exe]  <Microsoft Corporation><5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)>
[PID: 720][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)>
[PID: 808][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)>
[PID: 872][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)>
[PID: 1056][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)>
[PID: 1156][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)>
[PID: 1256][C:\WINDOWS\system32\spoolsv.exe]  <Microsoft Corporation><5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)>
[PID: 1188][C:\WINDOWS\system32\wuauclt.exe]  <Microsoft Corporation><5.4.3790.2096 (xpsp_sp2_rc1.040311-2315)>
[PID: 1064][C:\WINDOWS\Explorer.EXE]  <Microsoft Corporation><6.00.2900.2096 (xpsp_sp2_rc1.040311-2315)>
    [D:\毒霸\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
    [D:\毒霸\KAVEXT.DLL]  <Kingsoft Corp.><2002, 5, 24, 6>
[PID: 1716][C:\WINDOWS\system32\wscntfy.exe]  <Microsoft Corporation><5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)>
    [D:\毒霸\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 1980][C:\WINDOWS\system32\CTFMON.EXE]  <Microsoft Corporation><5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)>
    [D:\毒霸\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 1100][D:\毒霸\MailMon.exe]  <Kingsoft Co., Ltd><2004, 2, 6, 245>
    [D:\毒霸\KMFilter.DLL]  <><2004, 3, 1, 37>
    [D:\毒霸\parse822.dll]  <Quiksoft Corporation><2, 0, 0, 9>
    [D:\毒霸\KAVLogFn.dll]  <N/A><2003, 11, 26, 16>
    [D:\毒霸\KAVMLM.DLL]  <Kingsoft Corporation><2003.11.12.10>
    [D:\毒霸\KAMsgBox.DLL]  <><2002.9.27.30>
    [D:\毒霸\KAVComm.dll]  <Kingsoft Corporation><2003, 11, 12, 66>
    [D:\毒霸\RpcBrge.DLL]  <kingsoft><2003, 11, 12, 64>
    [D:\毒霸\KAVDlg.DLL]  <><2004.7.20.81>
    [D:\毒霸\KAECall.DLL]  <Kingsoft Corporation><2003, 11, 14, 66>
    [D:\毒霸\KAEScan.DLL]  <Kingsoft Corp.><2003, 5, 24, 36>
    [D:\毒霸\KAEPlat.DLL]  <Kingsoft Corp.><2005, 12, 29, 56>
    [D:\毒霸\KAEMem.DAT]  <Kingsoft><2006, 4, 12, 13>
    [D:\毒霸\KAEUnpack.DAT]  <Kingsoft Corp.><2006, 6, 15, 44>
    [D:\毒霸\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 1756][C:\WINDOWS\regedit.exe]  <Microsoft Corporation><5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)>
    [D:\毒霸\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 2012][C:\Program Files\Internet Explorer\iexplore.exe]  <Microsoft Corporation><6.00.2900.2096 (xpsp_sp2_rc1.040311-2315)>
    [D:\毒霸\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
    [C:\WINDOWS\system32\macromed\flash\swflash.ocx]  <Macromedia, Inc.><5,0,44,0>
[PID: 1796][C:\WINDOWS\system32\conime.exe]  <Microsoft Corporation><5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)>
    [D:\毒霸\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 160][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  <Microsoft Corporation><6.00.2900.2096 (xpsp_sp2_rc1.040311-2315)>
    [D:\毒霸\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
    [C:\WINDOWS\system32\macromed\flash\swflash.ocx]  <Macromedia, Inc.><5,0,44,0>
[PID: 988][D:\新建文件夹 (2)\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>
    [D:\毒霸\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

引用:

【3Q你的贴子】重装过后,机器依然很卡!至于服务项怎么没有,我不清楚!以往我都是这样扫描程序的!刚用毒霸查了一下毒,所有硬盘有39个病毒,感染的都是*.exe文件,提示是清除干净了!现在除了系统盘另外几个硬盘右键点开看的话，都是"AUTO"在首位的,我不敢双击!打开这几个盘都是右键,现在!如果有必要的我想用SREng2扫描上来看看!! ………………

可能是维金啊。。。

westbeck帮看看吧!各位大哥也帮着看看吧!我已经格盘4次了，这个病毒太厉害了!

维金?是新病毒吗?该怎么杀呢?麻烦给个参考吧!谢谢了!几个硬盘都被"AUTO"了，这个特征应该是很明显的!大家帮帮我吧!

给个意见吧~~~~痛苦啊!

所有盘全格  C盘格多少次好象也没用

大哥,有没别的办法啊!全格了，损失严重啊!

同情.........

维金...........!!!太可怕了~~现在无敌啊！郁闷了！电脑难道要变呆滞了吗？？