1   1  /  1  页   跳转

帮忙看看

帮忙看看

有那位高手请帮忙看看我的计算机出什么毛病了?万分感谢!
HijackThis_zww汉化版扫描日志 V1.99.1
保存于      15:47:40, 日期 2006-8-28
操作系统:  Windows XP SP1 (WinNT 5.01.2600)
浏览器:    Internet Explorer v6.00 SP1 (6.00.2800.1106)

当前运行的进程:         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\datetime11.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\msime.exe
C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe
C:\Program Files\Intel\svhost32.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\WINDOWS\command\rundll32.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\KVFW\kvfw.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\wincup\wincup.exe
C:\PROGRA~1\KV2005\KVSrvXP.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\HijackThis1991zww.exe

R3 - URLSearchHook: SrchHook Class - {EED92A43-CFCE-4548-BD73-B0A405470ED5} - C:\PROGRA~1\CNNIC\Cdn\iesrch.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,C:\WINDOWS\System32\datetime11.exe
O2 - BHO: Query Class - {01C2F1E8-5C69-4B5C-B052-26941B6C23A6} - C:\WINDOWS\System32\iequery.dll
O2 - BHO: Vision - {6671A431-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\MMSASS~1\mmsass~1.dll
O2 - BHO: stdup - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - C:\WINDOWS\SYSTEM32\stdup.dll
O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - C:\PROGRA~1\baidu\bar\baidubar.dll
O2 - BHO: BrowseHelper Class - {80BF4637-D65B-43F3-BB60-C5DD3D5FB7B9} - C:\Program Files\KV2005\KvShell_3.dll
O2 - BHO: Subconscious Intruder - {E2218499-2FD4-4EED-A94A-7F0B9C6E300E} - C:\WINDOWS\system32\Inte32.dll
O3 - IE工具栏增项: 江民杀毒工具栏 - {B5A34A93-D538-43A7-8371-864CB6148D12} - C:\Program Files\KV2005\KvShell_3.dll
O3 - IE工具栏增项: (no name) - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - (no file)
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - 启动项HKLM\\Run: [Microsoft Update] msconfg.exe
O4 - 启动项HKLM\\Run: [KvMonXP] "C:\PROGRA~1\KV2005\KVMonXP.kxp" /auto
O4 - 启动项HKLM\\Run: [SOUNDM] winsmd.exe
O4 - 启动项HKLM\\Run: [yassistse] "C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"
O4 - 启动项HKLM\\Run: [KVautoupdate ] "C:\Program Files\KV2005\kvol.exe" /silent
O4 - 启动项HKLM\\Run: [zt] C:\Program Files\Intel\svhost32.exe
O4 - 启动项HKLM\\Run: [CnsMHlp.exe] C:\WINDOWS\Downloaded Program files\CnsMHlp.exe
O4 - 启动项HKLM\\Run: [_rx] C:\WINDOWS\command\rundll32.exe
O4 - 启动项HKLM\\RunServices: [Microsoft Update] msconfg.exe
O4 - 启动项HKLM\\RunOnce: [uninsrest] C:\DOCUME~1\谭华灵\LOCALS~1\Temp\uninrest.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [KVFW] C:\Program Files\KVFW\kvfw.exe -silent
O4 - HKCU\..\Run: [KvXP] "C:\Program Files\KV2005\KvXP.kxp" /ScanBoot /ScanSys
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - IE右键菜单中的新增项目: >>彩信发送<< - res://C:\PROGRA~1\MMSASS~1\mmsass~1.dll/mms.htm
O9 - 浏览器额外的按钮: (no name) - {6671A433-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\MMSASS~1\mmsass~1.dll
O9 - 浏览器额外的“工具”菜单项: 彩E精灵设置 - {6671A433-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\MMSASS~1\mmsass~1.dll
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O10 - 未知的文件在 Winsock LSP: c:\windows\system32\raspapi.dll
O10 - 未知的文件在 Winsock LSP: c:\windows\system32\kvwspxp_1.dll
O10 - 未知的文件在 Winsock LSP: c:\windows\system32\kvwspxp_1.dll
O10 - 未知的文件在 Winsock LSP: c:\windows\system32\kvwspxp_1.dll
O10 - 未知的文件在 Winsock LSP: c:\windows\system32\raspapi.dll
O16 - DPF: _{8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O16 - DPF: {18F57D30-EF36-4C0E-9343-7BFA6DF79B4A} (XLink Class) - http://active.micr0media.com/swflash.CAB
O16 - DPF: {28E0FA88-ABA8-4937-A247-3031F1A11165} - http://pi.51.net/download/diybar2.cab
O16 - DPF: {53AF6E02-F18F-4228-AC13-3E79773FBE50} - http://download.mysee.com/plugin/booter.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1144370618781
O16 - DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} (AxSubmitControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O16 - DPF: {DE3496D2-AFB9-47EB-A8C2-C3B330222513} - http://www.photo.163.com/PhotoUpload.cab
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} - http://download.rising.com.cn/register/pcver/autoupgradepad/Ver2005/OL2005.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C8BA2528-52D5-4807-8602-72E90A696F95}: NameServer = 10.254.131.253
O17 - HKLM\System\CCS\Services\Tcpip\..\{F422489E-5EAD-4131-B1BD-53FDE270FE68}: NameServer = 10.254.131.253,205.252.144.228
O21 - SSODL: SysTime - {724C75F1-B757-408D-A50A-4CF99DA35D73} - C:\PROGRA~1\WinKld\WinKld.dll
O21 - SSODL: webwork - {4C611512-2C1D-44b2-A044-872AD2AD5A61} - C:\WINDOWS\webwork\webwork.dll
O21 - SSODL: themeadp - {64274C93-3CE7-4663-9C8D-CD2DC8A3590B} - C:\WINDOWS\System32\themeadp.dll
O23 - NT 服务: aucup - Unknown owner - C:\DOCUME~1\谭华灵\LOCALS~1\Temp\wincup\wincup.exe (file missing)
O23 - NT 服务: aukld - Unknown owner - C:\DOCUME~1\谭华灵\LOCALS~1\Temp\aukld\aukld.exe (file missing)
O23 - NT 服务: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - NT 服务: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - NT 服务: KVSrvXP - JiangMin New Tech Ltd. - C:\PROGRA~1\KV2005\KVSrvXP.exe
O23 - NT 服务: Network Logon (NetWorkLogon) - Unknown owner - rundll32.exe (file missing)
O23 - NT 服务: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
O23 - NT 服务: WinWrCup - MsWinCup - C:\WINDOWS\wincup\wincup.exe

最后编辑2006-08-28 16:00:02
分享到:
gototop
 

结束进程:
C:\WINDOWS\wincup\wincup.exe
修复:
R3 - URLSearchHook: SrchHook Class - {EED92A43-CFCE-4548-BD73-B0A405470ED5} - C:\PROGRA~1\CNNIC\Cdn\iesrch.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,C:\WINDOWS\System32\datetime11.exe
O23 - NT 服务: WinWrCup - MsWinCup - C:\WINDOWS\wincup\wincup.exe
删除:
C:\WINDOWS\wincup\wincup.exe
开始-控制面板-性能和维护-管理工具-服务
禁用掉WinWrCup - MsWinCup

点开始-运行-regedit
注册表
展开
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Currentversion\Uninstall\
删除WinWrCup 文件夹..

展开
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\
删除 LEGACY_WINWRCUP 文件夹..

gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT