瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 请帮忙看看我的日志正常吗?最近电脑怪怪的~谢谢大家~已上传

1   1  /  1  页   跳转

请帮忙看看我的日志正常吗?最近电脑怪怪的~谢谢大家~已上传

请帮忙看看我的日志正常吗?最近电脑怪怪的~谢谢大家~已上传

请帮忙看看我的日志正常吗?最近电脑怪怪的~~谢谢大家~

winlogon.exe进程在任务管理器显示为:
\??\C:\windows\system32\winlogon.exe




HijackThis_815汉化版扫描日志 V1.99.1
保存于      16:06:51, 日期 2008-6-2
操作系统:  Windows XP SP2 (WinNT 5.01.2600)
浏览器:    Internet Explorer v7.00 (7.00.6000.16640)
当前运行的进程:         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
D:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
D:\PROGRAM FILES\RISING\RAV\ravmond.exe
D:\PROGRAM FILES\RISING\RAV\RavStub.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
D:\Program Files\StormII\stormliv.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
D:\Program Files\Rising\Rav\RavTask.exe
D:\Program Files\Rising\Rav\Ravmon.exe
D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
D:\Program Files\AntiARP Stand-alone Edition\AntiArp.exe
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\CRavgas.exe
C:\Program Files\GridService\peer.exe
C:\Program Files\Rising\AntiSpyware\runiep.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE
D:\Program Files\Tencent\TT\TTraveler.exe
C:\Program Files\Rising\AntiSpyware\Ras.exe
D:\Program Files\Thunder Network\Thunder\Program\Thunder5.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\幻影\LOCALS~1\Temp\Rar$EX07.907\HijackThis1991\HijackThis1991zww.exe
O2 - BHO: Thunder AtOnce - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - D:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll
O2 - BHO: VnetCookie Class - {4E83D567-4697-4F7B-B1F0-A513B01DB89A} - d:\chinanet\vnettransfer1.dll
O2 - BHO: 超级兔子上网精灵 - {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} - D:\Program Files\Super Rabbit\MagicSet\haokanbar.dll
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - D:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll
O3 - IE工具栏增项: 超级兔子上网精灵 - {43869BB3-22FD-4F15-9B46-238106BA2F4E} - D:\Program Files\Super Rabbit\MagicSet\haokanbar.dll
O3 - IE工具栏增项: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - 启动项HKLM\\Run: [RavTask] "D:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [nwiz] nwiz.exe /install
O4 - 启动项HKLM\\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - 启动项HKLM\\Run: [Super Rabbit SafeEdit] D:\Program Files\Super Rabbit\MagicSet\SRFC.EXE /Load
O4 - 启动项HKLM\\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - 启动项HKLM\\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - 启动项HKLM\\Run: [DeviceDiscovery] ; C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - 启动项HKLM\\Run: [AntiARPStandalone] D:\Program Files\AntiARP Stand-alone Edition\AntiArp.exe
O4 - 启动项HKLM\\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\CRavgas.exe" /minimized
O4 - 启动项HKLM\\Run: [Grid Service] "C:\Program Files\GridService\peer.exe" -n Grid
O4 - 启动项HKLM\\Run: [runeip] "C:\Program Files\Rising\AntiSpyware\runiep.exe" /startup
O4 - 启动项HKLM\\RunOnce: [KKDelay] C:\Program Files\Rising\AntiSpyware\RunOnce.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Super Rabbit IEPro] D:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - IE右键菜单中的新增项目: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O8 - IE右键菜单中的新增项目: 使用迅雷下载 - D:\Program Files\Thunder Network\Thunder\Program\geturl.htm
O8 - IE右键菜单中的新增项目: 使用迅雷下载全部链接 - D:\Program Files\Thunder Network\Thunder\Program\getallurl.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - D:\Program Files\QQ2007\AddEmotion.htm
O9 - 浏览器额外的按钮: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - D:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - 浏览器额外的“工具”菜单项: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - D:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - 浏览器额外的按钮: 呼ъ瓜 - {27EC5DBC-9C46-4b99-BCE8-2707BBCCBD82} - D:\PChome\PChome_Uploader\photo_all.htm
O9 - 浏览器额外的按钮: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - 浏览器额外的“工具”菜单项: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {5B822B99-DA4B-4553-88CC-8DCA4E9C5656} (NtreevLauncher Control) - http://www.trickster.co.kr/Control/NtreevLauncher.cab
O16 - DPF: {8686F2A6-DC01-4E8F-BDE3-DCC7DBBAD6AE} (163Uploader Control) - http://photo.163.com/163Uploader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6AA8186B-47B2-4C77-A185-97B243F0EEA6}: NameServer = 61.128.114.133 61.128.114.166
O17 - HKLM\System\CS1\Services\Tcpip\..\{6AA8186B-47B2-4C77-A185-97B243F0EEA6}: NameServer = 61.128.114.133 61.128.114.166
O17 - HKLM\System\CS2\Services\Tcpip\..\{6AA8186B-47B2-4C77-A185-97B243F0EEA6}: NameServer = 61.128.114.133 61.128.114.166
O18 - 列举现有的协议: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - 列举现有的协议: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: ieprot.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - NT 服务: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - NT 服务: Contrl Center of Storm Media (ccosm) - 北京暴风网际科技有限公司 - D:\Program Files\StormII\stormliv.exe
O23 - NT 服务: KailleraServer - Unknown owner - C:\WINDOWS\system32\kaillera\srvany.exe
O23 - NT 服务: kailleraServerJK - Unknown owner - C:\WINDOWS\system32\kaillera\srvany.exe
O23 - NT 服务: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - NT 服务: PeanutHull DDNS Service (Peanuthull5Core) - 上海贝锐 - D:\Program Files\Oray\PeanutHull5\PhCore.exe
O23 - NT 服务: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\Program Files\Rising\Rav\CCenter.exe
O23 - NT 服务: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\PROGRAM FILES\RISING\RAV\Ravmond.exe
O23 - NT 服务: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

用户系统信息:Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; TencentTraveler ; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
最后编辑幻影de宝宝 最后编辑于 2008-06-02 17:10:19
分享到:
gototop
 

回复:请帮忙看看我的日志正常吗?最近电脑怪怪的~~谢谢大家~

下载Sreng,解压缩运行

1.先把不相关的软件关闭(比如QQ 浏览器 播放软件之类...)
2.智能扫描(记得勾上数字签名选项)=》扫描=》保存报告
3.把日志SREngLOG.log中的报告完整复制粘贴上来,[全选(Ctrl+a) >>复制(Ctrl+c) >>粘贴(Ctrl+v)] 上来或者粘贴到记事本中以附件形式上传上来

SRE下载地址
http://download.kztechs.com/files/sreng2.zip
友情提示:如果下载后不能运行请删除已下载的,然后重新下载.下载后首先不要运行先将下载的SREng.exe重命名为SREng.com(SREng.scr\SREng.bat\SREng.pif)或者abc.exe运行
gototop
 

回复: 请帮忙看看我的日志正常吗?最近电脑怪怪的~~谢谢大家~



感谢~帮忙看看~~

附件附件:

文件名:SREngLOG.log
下载次数:76
文件类型:application/octet-stream
文件大小:
上传时间:2008-6-2 17:05:35
描述:log

gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT