Logfile of HijackThis v1.99.1
Scan saved at 8:07:33, on 2005-9-16
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\etb\pokapoka67.exe
C:\Program Files\Tencent\QQ\TMDlls\TM.exe
C:\Program Files\Tencent\QQ\TIMPlatform.exe
C:\WINNT\system32\conime.exe
C:\Program Files\Iparmor\Iparmor.exe
C:\Vrv\Client\vrvmon.exe
C:\Vrv\Client\vrvnet.exe
C:\Vrv\Client\vrvmail.exe
C:\Vrv\Client\vrv.exe
C:\WINNT\explorer.exe
C:\Program Files\TouchNet\TouchNet.exe
F:\download\HijackThis.exe

F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-B72A4567E486} - C:\Program Files\ISTbar\istbar.dll (file missing)
O4 - HKLM\..\Run: [xysecond] C:\Vrv\Client\vrvmon.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [vmailmon] C:\Vrv\Client\Vrvmail.exe
O4 - HKLM\..\Run: [vrvnet] C:\Vrv\Client\vrvnet.exe
O4 - HKLM\..\Run: [System service67] C:\WINNT\\etb\pokapoka67.exe
O4 - Startup: 金山迷你背单词.lnk = C:\Program Files\Kingsoft\PowerWord 2005\ScrollWord.exe
O4 - Startup: 腾讯TM.lnk = C:\Program Files\Tencent\QQ\TMShell.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O10 - Unknown file in Winsock LSP: c:\winnt\vmaildog.dll
O10 - Unknown file in Winsock LSP: c:\winnt\vmaildog.dll
O10 - Unknown file in Winsock LSP: c:\winnt\vmaildog.dll
O10 - Unknown file in Winsock LSP: c:\winnt\vmaildog.dll
O16 - DPF: v3cab - http://searchmiracle.com/cab/1.cab
O16 - DPF: {6924091F-CD97-41E1-B1D4-D9079409D413} (IMCv1 Control) - http://www.bbsliao.com:1995/talk.cab
O16 - DPF: {7253A666-8D4A-11D7-A4DC-00E04C504779} (BDC Control) - http://fyliao.com/BDC.cab
O16 - DPF: {7C559105-9ECF-42B8-B3F7-832E75EDD959} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v4.0/0006_adult.cab
O16 - DPF: {88734439-46D0-42C0-A13F-7E881EE550CF} (Filetran Control) - http://www.bluesky.cn/download/filetran.cab
O16 - DPF: {ACFE8232-03C5-4AEC-AF5E-42B806724096} (KSHScan Control) - http://scan.kingsoft.com/scan/fangyi/KAllScan.CAB
O16 - DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} (pCastPanel Class) - http://pcastdl.dudu.com/files/pCastCtl.cab
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINNT\system32\NavLogon.dll
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: kytib - Unknown owner - \\10.36.31.24\E$\winlogoff.exe" -service (file missing)
O23 - Service: ppdqhcd - Unknown owner - \\10.36.31.24\E$\winlogoff.exe" -service (file missing)
O23 - Service: qydxbtd - Unknown owner - \\10.36.31.24\E$\crs.exe" -service (file missing)

怎么有人看，没人管啊，惨啊，高手，我的系统总是创建这样的进程：winnt/etb/pokapoka67.exe，但是根本没有这个文件夹阿，怎么搞得，帮忙啊！谢谢了。
经常生成china.exe等很多不认识的系统进程，怎么办。

新鲜出炉的热乎病毒大甩卖阿，血溅满地阿

高手帮忙啊，机器是公司的，有很重要的资料，不能重新做系统的。

O23 - Service: kytib - Unknown owner - \\10.36.31.24\E$\winlogoff.exe" -service (file missing)
O23 - Service: ppdqhcd - Unknown owner - \\10.36.31.24\E$\winlogoff.exe" -service (file missing)
O23 - Service: qydxbtd - Unknown owner - \\10.36.31.24\E$\crs.exe" -service (file missing)
是什么？不知道，请baohe斑竹帮忙吧

【回复“E的老公”的帖子】
使用IceSword结束进程pokapoka67.exe(IS在置顶贴中有详细介绍)

运行hijackthis修复:
O4 - HKLM\..\Run: [System service67] C:\WINNT\\etb\pokapoka67.exe
O16 - DPF: {7C559105-9ECF-42B8-B3F7-832E75EDD959} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v4.0/0006_adult.cab
O23 - Service: kytib - Unknown owner - \\10.36.31.24\E$\winlogoff.exe" -service (file missing)
O23 - Service: ppdqhcd - Unknown owner - \\10.36.31.24\E$\winlogoff.exe" -service (file missing)
O23 - Service: qydxbtd - Unknown owner - \\10.36.31.24\E$\crs.exe" -service (file missing)

删除:C:\WINNT\\etb\整个目录

停止kytib,ppdqhcd,qydxbtd这几项的服务.

根本没有winnt\etb这个目录

而且那几个服务已经停止

【回复“E的老公”的帖子】汗刚刚看了baohe版主给你的贴.

请问您补丁打全了吗?如是,请显示隐藏文件及受保护的文件夹删除c:\winnt\etb这个目录


>>怎么显示隐藏文件?

http://forum.ikaka.com/topic.asp?board=67&artid=6789825

我实在显示了隐藏文件的情况下察看的，确实没有这个目录，很奇怪，至于机器补丁，我用windows开始菜单的update，已经显示没有可用的更新了，难道还有其他更新