日志文件 Trend Micro HijackThis v 2.0.2
日志保存时间: 18:11:03,2009-1-18
操作系统: Windows XP SP3 (WinNT 5.01.2600)
IE版本: Internet Explorer v7.00 (7.00.6000.16762)
启动模式: 正常
正在运行的进程:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lenovo\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KPfwSvc.EXE
C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KWatch.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\IgrsSvcs.exe
C:\Program Files\StormII\stormliv.exe
C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KISSvc.EXE
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KMailMon.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lenovo\SysIC\SysICUD.exe
C:\WINDOWS\System32\TPHDEXLG.exe
C:\WINDOWS\Explorer.EXE
D:\Program Files\360safe\safemon\360Tray.exe
C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVStart.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kpfw32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\TTPlayer\TTPlayer.exe
C:\Program Files\Tencent\QQ\QQ.exe
C:\Program Files\Tencent\QQ\TXPlatform.exe
C:\Program Files\Kingsoft\KAC\Service\kaccore.exe
C:\Program Files\Tencent\QQ\QQ.exe
C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAV32.EXE
D:\Program Files\Thunder Network\Thunder\Program\Thunder5.exe
C:\Documents and Settings\Boing\桌面\hijackthis_v2.02h\HijackThis.exe
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - D:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll
O2 - BHO: SafeMon Class - {B69F34DD-F0F9-42DC-9EDD-957187DA688D} - D:\Program Files\360safe\safemon\safemon.dll
O3 - IE 工具栏: System Link - {04699E3B-1CD1-4479-B171-DAF8CA8518DF} - C:\WINDOWS\system32\bdsl2.dll
O4 - HKLM\..\Run: [PHIME2002ASync] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] ; RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ; ALCMTR.EXE
O4 - HKLM\..\Run: [KTPWare] ; C:\Program Files\Elantech\ktp.exe
O4 - HKLM\..\Run: [EnergyUtility] ; C:\Program Files\Lenovo\EnergyCut\utilty.exe
O4 - HKLM\..\Run: [EnergyCut] ; C:\Program Files\Lenovo\EnergyCut\EnergyCut.exe
O4 - HKLM\..\Run: [TpShocks] ; TpShocks.exe
O4 - HKLM\..\Run: [IMSCMig] ; C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - HKLM\..\Run: [360Safetray] D:\Program Files\360safe\safemon\360Tray.exe /start
O4 - HKLM\..\Run: [LanguageShortcut] ; "C:\Program Files\Lenovo\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [NvCplDaemon] ; RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] ; "D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [VMSnap3] ; C:\WINDOWS\VMSnap3.exe
O4 - HKLM\..\Run: [LenovoLogin] ; C:\Program Files\Lenovo\NovoEase\LenovoLoginCN.exe
O4 - HKLM\..\Run: [NovoEase] ; C:\Program Files\Lenovo\NovoEase\NovoEase.exe
O4 - HKLM\..\Run: [NvMediaCenter] ; RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] ; nwiz.exe /install
O4 - HKLM\..\Run: [RemoteControl] ; "C:\Program Files\Lenovo\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [KavStart] "C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVStart.exe" -startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] ; "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Power2GoExpress] ; "C:\Program Files\Lenovo\Power2Go\Power2GoExpress.exe" /Startup
O4 - HKCU\..\Run: [KavPFW] "C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\kpfw32.exe" -startup
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - 扩展右键菜单项: 使用迅雷下载 - D:\Program Files\Thunder Network\Thunder\Program\geturl.htm
O8 - 扩展右键菜单项: 使用迅雷下载全部链接 - D:\Program Files\Thunder Network\Thunder\Program\getallurl.htm
O8 - 扩展右键菜单项: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - 扩展右键菜单项: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm
O9 - 额外的按钮: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - d:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - 额外的“工具”菜单项目: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - d:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - 额外的按钮: 金山网页防挂马模块设置 - {3AECD3C1-7085-4731-96DC-47B6CF7EF749} - C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL
O9 - 额外的“工具”菜单项目: 金山网页防挂马模块设置 - {3AECD3C1-7085-4731-96DC-47B6CF7EF749} - C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {1E0DFFCF-27FF-4574-849B-55007349FEDA} (iTrusPTA Class) - https://img.alipay.com/download/1101/aliedit.cab
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (EditCtrl Class) - https://img.alipay.com/download/2121/aliedit.cab
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://b2c.icbc.com.cn/icbc/newperbank/AXSafeControls.cab
O16 - DPF: {C728DAB8-FDF5-4CD7-89DD-879D25794C77} (KooPlayer Control) - http://hd.cctv.com/library/column/C20825/lianghui/video_player/img/CCTVKooPlayer.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: cdl - {3DD53D40-7B8B-11D0-B013-00AA0059CE02} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll
O18 - Protocol: file - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ftp - {79EAC9E3-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: gopher - {79EAC9E4-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: http - {79EAC9E2-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: https - {79EAC9E5-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ipp - (no CLSID) - (没有文件)
O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll
O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: local - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: mailto - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: mhtml - {05300401-BCBC-11D0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll
O18 - Protocol: mk - {79EAC9E6-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll
O18 - Protocol: msdaipp - (no CLSID) - (没有文件)
O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll
O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll
O23 - NT 服务:  Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Lenovo\Bluetooth Software\bin\btwdins.exe
O23 - NT 服务:  Contrl Center of Storm Media (ccosm) - 北京暴风网际科技有限公司 - C:\Program Files\StormII\stormliv.exe
O23 - NT 服务:  Kingsoft Basic Service (kaccore) - Kingsoft Corporation - C:\Program Files\Kingsoft\KAC\Service\kaccore.exe
O23 - NT 服务:  Kingsoft Internet Security Common Service (KISSvc) - Kingsoft Corporation - C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KISSvc.EXE
O23 - NT 服务:  Kingsoft Personal Firewall Service (KPfwSvc) - Kingsoft Corporation - C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KPfwSvc.EXE
O23 - NT 服务:  Kingsoft Antivirus KWatch Service (KWatchSvc) - Kingsoft Corporation - C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KWatch.EXE
O23 - NT 服务:  Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - NT 服务:  SysICUD - Lenovo - C:\Program Files\Lenovo\SysIC\SysICUD.exe
O23 - NT 服务:  ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.exe
--
文件结束 - 9326 字节

用户系统信息：Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; http://bsalsa.com) )

个人建议不要偷懒，清理助手必须清理系统（如果可以运行的话），金山和sreng日志必须同时上传

1.扫日志前建议清理助手清理系统
清理助手下载
升级清理助手，全盘扫描，只清理报为病毒的高危险项目,其他项目请自己判断
同时观察清理助手是否报告系统文件被替换。(注：如发现系统文件被替换，请将情况报上来，勿自己随意操作。如自己私自替换的，导致不能进系统，责任自负)

如清理无效

2.扫日志前关闭无用进程，如QQ，迅雷及播放器程序
3.Sreng官方下载
SREng/智能扫描(记得勾选“检查进程的数字签名)
等扫描完成,保存日志(LOG格式)
PS：如主程序SREng**.exe无法运行,导致无法扫描日志
将主程序改名为我爱小狮子.bat
或我爱小狮子.scr
4.金山清理专家官方下载  | 免安装版直接运行版金山清理专家下载
金山清理专家-在线系统诊断（隐藏安全项）-导出诊断报告-（全选）-导出报告
5.2份日志/报告以附件上传（点击我这贴右下角的“引用”或最右下角的那个较大的“回复”然后就应该知道怎么发了。），贴到反病毒/反流氓软件论坛.如已发帖的请跟贴，勿另开新帖。

建议2份日志同时上传，起到互补的作用（原因：金山和SRENG都能扫出另一个不能扫出的内容）！！

谢谢高手的指点！按照第一步清理了，结果显示恶意软件9505.com还在，无效！
按照第二步，分别用金山和SRENG扫描了！诊断报告在附件里！

高手们！帮帮忙！这个流氓软件！真烦人啊！给您送去春节的祝福了！

试试大蜘蛛吧

ftp://ftp.drweb.com/pub/drweb/cureit/launch.exe

记得
开始后要立即中止杀毒
这个程序，默认的是快速扫描

你选中止之后，选择全面扫描再扫描