这是扫描下来的，麻烦各位帮我看看，




日志文件: 趋势科技 HijackThis v2.0.0 (BETA)
保存时间: 13:52:22, on 2007-7-30
操作系统: Windows XP SP3 (WinNT 5.01.2600)
启动模式: 正常
正在运行的进程:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\TOPRO\TPPOLL.EXE
C:\Program Files\Filseclab\Twister\twister.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\360\360sd\360sd.exe
C:\Program Files\Common Files\Filseclab\FilMsg.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Tencent\QQSoftMgr\TencentUpdateSvc.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
D:\Program Files\Tencent\QQ\QQ.exe
D:\Program Files\Tencent\QQ\TXPlatform.exe
C:\Program Files\Tencent\TT\bin\TTraveler.exe
C:\WINDOWS\system32\conime.exe
C:\Documents and Settings\Administrator\桌面\ha_hijackthisv2_pp\HiJackThis_v2.exe
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll
O4 - HKLM\..\Run: [tppoll] C:\Program Files\TOPRO\TPPOLL.EXE
O4 - HKLM\..\Run: [360sd] C:\Program Files\360\360sd\360sdrun.exe
O4 - HKLM\..\Run: [twister] "C:\Program Files\Filseclab\Twister\twister.exe" -a
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Startup: QQ游戏启动加速程序.lnk = C:\Program Files\Tencent\QQGAME\Accel.exe
O4 - Startup: 腾讯QQ.lnk = D:\Program Files\Tencent\QQ\QQ.exe
O4 - Global Startup: 书报递送.lnk = ?
O4 - Global Startup: 费尔消息服务.lnk = ?
O8 - 扩展右键菜单项: 使用迅雷下载 - C:\Program Files\Thunder\Program\geturl.htm
O8 - 扩展右键菜单项: 使用迅雷下载全部链接 - C:\Program Files\Thunder\Program\getallurl.htm
O8 - 扩展右键菜单项: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - 扩展右键菜单项: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O9 - Extra button: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - Extra 'Tools' menuitem: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - Extra button: (未命名) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\xunyount.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xunyount.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xunyount.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xunyount.dll
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (EditCtrl Class) - https://img.alipay.com/download/2121/aliedit.cab
O16 - DPF: {9FAFB576-6933-4CCC-AB3D-B988EC43D04E} (Rising Online Antivirus scanner control) - http://download.rising.com.cn/rs2009/online/ravolctl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8F597A90-7332-407B-8A4D-47613F3AD951}: NameServer = 202.96.128.86 202.96.128.166
O18 - Protocol: mbox - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: mboxflash - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O22 - SharedTaskScheduler: Browseui 预加载程序 - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: 组件类别缓存程序 - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: A6H5NT (0VH1YLWC) - Unknown owner - C:\WINDOWS\0VH1YLWC.exe (file missing)
O23 - Service: BEHP1RB43Y (1I2DVWD) - Unknown owner - C:\WINDOWS\1I2DVWD.exe (file missing)
O23 - Service: 360rp - 360安全中心 - C:\Program Files\360\360sd\360rp.exe
O23 - Service: GIROE71C (48ID7W9DCD) - Unknown owner - C:\WINDOWS\48ID7W9DCD.exe (file missing)
O23 - Service: FJD05H13 (4XEYZ99C17) - Unknown owner - C:\WINDOWS\4XEYZ99C17.exe (file missing)
O23 - Service: B1HSQURFY2 (5FZ4PYC6WB7M) - Unknown owner - C:\WINDOWS\5FZ4PYC6WB7M.exe (file missing)
O23 - Service: HNX4DXX (8J7Y7KHQ) - Unknown owner - C:\WINDOWS\8J7Y7KHQ.exe (file missing)
O23 - Service: FA0R2LRK1IW (9TUEK) - Unknown owner - C:\WINDOWS\9TUEK.exe (file missing)
O23 - Service: agl - Unknown owner - C:\WINDOWS\system32\agl.exe (file missing)
O23 - Service: P3V9KFO8G07Z (AHNDZ) - Unknown owner - C:\WINDOWS\AHNDZ.exe (file missing)
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - D:\Ares\chatServer.exe
O23 - Service: ROKYV (CLZ5PM0044) - Unknown owner - C:\WINDOWS\CLZ5PM0044.exe (file missing)
O23 - Service: SPTQZBB (FT7JADK9X) - Unknown owner - C:\WINDOWS\FT7JADK9X.exe (file missing)
O23 - Service: TKGBE9DZBC (G5O1YAKPB1W) - Unknown owner - C:\WINDOWS\G5O1YAKPB1W.exe (file missing)
O23 - Service: G20NCVE (GB7MTBVGI) - Unknown owner - C:\WINDOWS\GB7MTBVGI.exe (file missing)
O23 - Service: WUU3G7QTQ3OD (ISTBN1VZH) - Unknown owner - C:\WINDOWS\ISTBN1VZH.exe (file missing)
O23 - Service: ZX1CMXMY4VFZ (JYJG2S7FO) - Unknown owner - C:\WINDOWS\JYJG2S7FO.exe (file missing)
O23 - Service: lasas - Unknown owner - C:\WINDOWS\system32\lasas.exe (file missing)
O23 - Service: npkcmsvc - Unknown owner - D:\MXD\冒险岛online\npkcmsvc.exe (file missing)
O23 - Service: NV0DIA Dispy Driverv  (NV0DIA Dispy Driverv) - Unknown owner - C:\WINDOWS\svuhier.exe (file missing)
O23 - Service: NVI0DIA Dispy Driverv  (NVI0DIA Dispy Driverv) - Unknown owner - C:\WINDOWS\svhiser.exe (file missing)
O23 - Service: NVIDIA Dissplay Drilverv - Unknown owner - C:\WINDOWS\guocyok88.exe (file missing)
O23 - Service: qdw - Unknown owner - C:\WINDOWS\system32\qdw.exe (file missing)
O23 - Service: scvst - Unknown owner - C:\WINDOWS\system32\scvst.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: svch0st - Unknown owner - C:\WINDOWS\system32\svch0st.exe (file missing)
O23 - Service: svost - Unknown owner - C:\WINDOWS\system32\svost.exe (file missing)
O23 - Service: tstm - Unknown owner - C:\WINDOWS\system32\tstm.exe (file missing)
O23 - Service: Tencent Software Update Service (TSUSVC) - Tencent - C:\Program Files\Tencent\QQSoftMgr\TencentUpdateSvc.exe
O23 - Service: 7GEOJ (V3YTHNR) - Unknown owner - C:\WINDOWS\V3YTHNR.exe (file missing)
O23 - Service: Winets Server (Winet) - Unknown owner - C:\WINDOWS\system32\Winet.exe (file missing)

用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler 4.0)

怎么判断被远程控制了
  上报sreng日志
下载SRENG工具然后扫描日志，看这贴2楼：http://bbs.ikaka.com/showtopic-8442813.aspx
日志文件以附件形式发来
点击贴子右下角的“编辑”,然后就知道怎么发附件了

O23 - Service: Winets Server (Winet) - Unknown owner - C:\WINDOWS\system32\Winet.exe (file missing)

请问是这个文件的问题吗？Winet.exe

不管那个文件 上传sreng日志先

1.建议使用XDelBox（Xdelbox解压后运行）删除以下文件：(XDelBox1.8下载)
使用说明：(先勾选抑制再生)删除时复制所有要删除文件的路径，在待删除文件列表里点击右键选择从剪贴板导入不检查路径，导入后在要删除文件上点击右键，选择立刻重启删除，电脑会重启进入DOS界面进行删除操作。运行xdelbox前最好卸载所有可移动存储介质（包括U盘，MP3，手机存储卡等）。

C:\windows\tasks\eps.vbs
c:\windows\system32\drivers\etc\tvjniwzn.dll
c:\windows\system32\cnfngw.dll


2.删除重启后使用SREng修复下面各项：

    启动项目 －－ 注册表之如下项删除：
[系统设置]    <%windir%\Tasks\eps.vbs>

   
    启动项目 －－ 服务 －－ Win32服务应用程序之如下项删除：
  (勾选隐藏已认证的微软项目,选中有问题的驱动/服务后，点"删除服务"，点"设置"按钮即可。注意弹出的窗口中要点"否"才是确认删除服务）

[Servioice / Servioice]    <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\system32\drivers\etc\TvJNIWZn.dll>
[ftrbxn / ftrbxn]    <C:\WINDOWS\system32\SVCHOST.EXE -k ftrbxn-->%SystemRoot%\System32\cnfngw.dll>
[GIROE71C / 48ID7W9DCD]    <C:\WINDOWS\48ID7W9DCD.exe QUCX4ZT>
[FJD05H13 / 4XEYZ99C17]    <C:\WINDOWS\4XEYZ99C17.exe PV5RHYM>
[B1HSQURFY2 / 5FZ4PYC6WB7M]    <C:\WINDOWS\5FZ4PYC6WB7M.exe L90W65YKJ>
[HNX4DXX / 8J7Y7KHQ]    <C:\WINDOWS\8J7Y7KHQ.exe RZH6PE>
[FA0R2LRK1IW / 9TUEK]    <C:\WINDOWS\9TUEK.exe PK19DW9NN4>
[P3V9KFO8G07Z / AHNDZ]    <C:\WINDOWS\AHNDZ.exe XGB4H25K9O5>
[agl / agl]    <C:\WINDOWS\system32\agl.exe>
[ROKYV / CLZ5PM0044]    <C:\WINDOWS\CLZ5PM0044.exe 10VVKPLB9EO5>
[SPTQZBB / FT7JADK9X]    <C:\WINDOWS\FT7JADK9X.exe 2K2CTT>
[A6H5NT / 0VH1YLWC]    <C:\WINDOWS\0VH1YLWC.exe GMRPR>
[TKGBE9DZBC / G5O1YAKPB1W]    <C:\WINDOWS\G5O1YAKPB1W.exe 2WWP4Q1D7>
[G20NCVE / GB7MTBVGI]    <C:\WINDOWS\GB7MTBVGI.exe QLV5N2>
[BEHP1RB43Y / 1I2DVWD]    <C:\WINDOWS\1I2DVWD.exe LQ8XZW9DW>
[WUU3G7QTQ3OD / ISTBN1VZH]    <C:\WINDOWS\ISTBN1VZH.exe 68F92OT6FH5>
[ZX1CMXMY4VFZ / JYJG2S7FO]    <C:\WINDOWS\JYJG2S7FO.exe 9LH95GEHB0X>
[lasas / lasas]    <C:\WINDOWS\system32\lasas.exe>
[NV0DIA Dispy Driverv   / NV0DIA Dispy Driverv]    <C:\WINDOWS\svuhier.exe>
[NVI0DIA Dispy Driverv   / NVI0DIA Dispy Driverv]    <C:\WINDOWS\svhiser.exe>
[NVIDIA Dissplay Drilverv / NVIDIA Dissplay Drilverv]    <C:\WINDOWS\guocyok88.exe>
[qdw / qdw]    <C:\WINDOWS\system32\qdw.exe>
[scvst / scvst]    <C:\WINDOWS\system32\scvst.exe>
[svch0st / svch0st]    <C:\WINDOWS\system32\svch0st.exe>
[svost / svost]    <C:\WINDOWS\system32\svost.exe>
[tstm / tstm]    <C:\WINDOWS\system32\tstm.exe>
[7GEOJ / V3YTHNR]    <C:\WINDOWS\V3YTHNR.exe AT5HA478L1BV>
[Winets Server / Winet]    <C:\WINDOWS\system32\Winet.exe>


    启动项目 －－ 服务－－ 驱动程序之如下项删除：
(勾选隐藏已认证的微软项目,选中有问题的驱动/服务后，点"删除服务"，点"设置"按钮即可。注意弹出的窗口中要点"否"才是确认删除服务）
[1F1BMW46P / 1EX77E]    <\??\C:\WINDOWS\R9YEMR5.txt>
[T9AWRYJ / 3Q09N]    <\??\C:\WINDOWS\TFJ5AT.txt>
[FR3Q7X6 / 8U98H]    <\??\C:\WINDOWS\YGHXV4.txt>
[NQJWE2ZC / A911UD]    <\??\C:\WINDOWS\9YTH2WO.txt>
[D549HMUNDO / YWG90AP]    <\??\C:\WINDOWS\OLV1F9G5.txt>
[HHDRP / YRPN4WPMZY]    <\??\C:\WINDOWS\OG4EKUL7U2Q.txt>
[6KRJCC5T7 / TTZX8X9]    <\??\C:\WINDOWS\LHONAH6O.txt>
[3173X8Q / QEPS54NCGYBQ]    <\??\C:\WINDOWS\I9546.txt>
[YB3J113DOV7 / KXEOQTHAL]    <\??\C:\WINDOWS\AJTF6Z0FI6.txt>
[NSRB7Y / C7IYQNXGBFWG]    <\??\C:\WINDOWS\90FW6.txt>

    系统修复－－ HOSTS文件－－重置

**************以上分析报告由SREngLog分析助手提供******************
分析：小狮子
时间：2009-7-30
SREngLog分析助手 1.4 BY 草莽书生 (20090209 更新 BY 小金)