Logfile of HijackThis v1.99.1
Scan saved at 11:27:12, on 2006-4-14
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\WINNT\system32\DVDRAMSV.exe
D:\nike zhu\personal file\software\EWIDO-35-ºÃʹ\ewido anti-malware\ewidoctrl.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\Program Files\Stoll\M1\bin\mcx_winservice.exe
C:\Program Files\Stoll\M1\bin\mcxserver.exe
C:\WINNT\system32\conime.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Stoll\M1\bin\m1agent.exe
C:\WINNT\system32\RAMASST.exe
C:\WINNT\system32\PowerDesk8\Matrox.PowerDesk.PDeskNet.exe
C:\Program Files\Stoll\M1\bin\m1.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\WINNT\explorer.exe
D:\nike zhu\personal file\software\ÈÕÖ¾\HijackThis.exe

O4 - HKLM\..\Run: [IMJPMIG8.1] ; "C:\WINNT\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINNT\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINNT\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Matrox PowerDesk 8] C:\WINNT\system32\PowerDesk8\Matrox.PowerDesk.exe /silent
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [StormCodec_Helper] ; "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti
O4 - HKLM\..\Run: [helper.dll] C:\WINNT\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: M1 Agent.lnk = C:\Program Files\Stoll\M1\bin\m1agent.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: RAMASST.lnk = C:\WINNT\system32\RAMASST.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: ÉÏ´«µ½QQÍøÂçÓ²ÅÌ - D:\nike zhu\personal file\software\qq\AddToNetDisk.htm
O8 - Extra context menu item: Ìí¼Óµ½QQ×Ô¶¨ÒåÃæ°å - D:\nike zhu\personal file\software\qq\AddPanel.htm
O8 - Extra context menu item: Ìí¼Óµ½QQ±íÇé - D:\nike zhu\personal file\software\qq\AddEmotion.htm
O8 - Extra context menu item: ÓÃQQ²ÊÐÅ·¢Ë͸ÃͼƬ - D:\nike zhu\personal file\software\qq\SendMMS.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\nike zhu\personal file\software\qq\QQ.EXE (file missing)
O9 - Extra 'Tools' menuitem: ÌÚѶQQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\nike zhu\personal file\software\qq\QQ.EXE (file missing)
O10 - Broken Internet access because of LSP provider 'c:\winnt\system32\cdnns.dll' missing
O16 - DPF: {ECCBA953-80E5-11D3-9285-0080ADB811C5} (safeInput Class) - https://ebank.bankofshanghai.com/perbank/ocx/safe.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = sh.stoll.com.cn
O17 - HKLM\Software\..\Telephony: DomainName = sh.stoll.com.cn
O17 - HKLM\System\CCS\Services\Tcpip\..\{DFE99639-34FB-4A8B-AA02-ED12C8FA73BC}: NameServer = 202.96.209.5,202.96.209.133
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = sh.stoll.com.cn
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = sh.stoll.com.cn
O18 - Protocol: dic - {C21F5C32-F57A-4A0D-8E0A-B672691C52D0} - C:\Program Files\Kingsoft\Powerword 2003\XDictExB.dll
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINNT\system32\DVDRAMSV.exe
O23 - Service: ewido security suite control - ewido networks - D:\nike zhu\personal file\software\EWIDO-35-ºÃʹ\ewido anti-malware\ewidoctrl.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: Stoll mcxWinService (Stoll_mcxWinService) - Unknown owner - C:\Program Files\Stoll\M1\bin\mcx_winservice.exe

O23 - Service: Stoll mcxWinService (Stoll_mcxWinService) - Unknown owner - C:\Program Files\Stoll\M1\bin\mcx_winservice.exe
这个应该是灰鸽子病毒```具体的请参照以下的帖子
我也不怎么懂  你在请教下高手

http://forum.ikaka.com/topic.asp?board=28&artid=7713905

引用:

【o珍惜ャ伱的贴子】O23 - Service: Stoll mcxWinService (Stoll_mcxWinService) - Unknown owner - C:\Program Files\Stoll\M1\bin\mcx_winservice.exe 这个应该是灰鸽子病毒```具体的请参照以下的帖子 我也不怎么懂  你在请教下高手 http://forum.ikaka.com/topic.asp?board=28&artid=7713905 ...........................

这项应该不是灰鸽子，鸽子一般不会在这个位置，更不会有这么多文件作为进程运行（不然再笨的人也会发现它了）。但我仍然想知道C:\Program Files\Stoll\是什么软件。

【回复“NIKEZHU”的帖子】
日志没有问题
机器有何异常

米问题呀

C:\Program Files\Stoll\M1\,M1花型准备系统（百度搜到的），楼主是从事纺织业的吗，一般人还真不知道这个软件呢，呵呵。

5楼真厉害阿被你猜对了。我是搞纺织的
一开机一上网电脑诺顿就有提示种了www3.tmp或者www5.tmp
怎么办啊