Logfile of HijackThis v1.99.1
Scan saved at 14:25:18, on 2005-9-10
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Conexant\AccessRunner ADSL\CnxDslTb.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
D:\备份\应用\金山毒霸2005绿色版\050829kav_2005\kav_2005\金山毒霸2005绿色版\KPfwSvc.EXE
C:\WINDOWS\system32\conime.exe
C:\Program Files\Tencent\qq\QQ.exe
C:\Program Files\Tencent\qq\TIMPlatform.exe
C:\Program Files\Maxthon\Maxthon.exe
D:\备份\应用\HijackThis1.99.1\HijackThis.exe

O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v8.dll
O2 - BHO: IE5BarLauncherBHO Class - {1ADBCCE8-CF84-441E-9B38-AFC7A19C06A4} - C:\Program Files\e-zshopper\BarLcher.dll
O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet6_38.dll
O2 - BHO: LinkTracker Class - {85A77577-A8CA-41b7-AA1E-DDAD4C0B12B1} - C:\WINDOWS\system32\hlwin.dll
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file)
O2 - BHO: IEHlprObj Class - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - C:\WINDOWS\system32\qylhelper.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: e-zshopper          1.200 - {3D782BB3-F2A5-11D3-BF4C-000000000000} - C:\Program Files\e-zshopper\BarLcher.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [CnxDslTaskBar] C:\Program Files\Conexant\AccessRunner ADSL\CnxDslTb.exe
O4 - HKLM\..\Run: [IMSCMIG40W] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40W\IMSCMIG.EXE /SetPreload /Log
O4 - HKLM\..\Run: [StormCodec_Helper] "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti
O4 - HKLM\..\Run: [NTdhcp] C:\WINDOWS\system32\NTdhcp.exe
O4 - HKLM\..\Run: [Anti Trojan Elite] C:\Program Files\Anti Trojan Elite\TJEnder.exe :NO
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [ExFilter] Rundll32.exe "C:\PROGRA~1\CNNIC\Cdn\cdnspie.dll",ExecFilter solo
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: 卡巴斯基反黑客.lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &使用迅雷下载 - d:\Program Files\Thunder Network\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - d:\Program Files\Thunder Network\Thunder\getAllurl.htm
O8 - Extra context menu item: 使用网际快车下载 - D:\备份\应用\FlashGet\v1.65\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - D:\备份\应用\FlashGet\v1.65\jc_all.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\备份\应用\QQ\中国黑客专用2\qq2005\腾讯QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\备份\应用\QQ\中国黑客专用2\qq2005\腾讯QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\备份\应用\QQ\中国黑客专用2\qq2005\腾讯QQ\SendMMS.htm
O9 - Extra button: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://tomatolei.com (file missing)
O9 - Extra button: eZshopper - {BFA03761-5565-41b3-93D9-82B354C0A8EC} - SHDOCVW.DLL (file missing)
O9 - Extra 'Tools' menuitem: e-zshopper - {BFA03761-5565-41b3-93D9-82B354C0A8EC} - SHDOCVW.DLL (file missing)
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O14 - IERESET.INF: START_PAGE_URL=about:blank
O17 - HKLM\System\CCS\Services\Tcpip\..\{2067A03C-0459-4E85-8A27-2C1C030C7548}: NameServer = 218.76.192.100 218.76.192.101
O18 - Filter: text/html - {03974811-C15F-462c-B6B0-2D2336AA57D0} - C:\WINDOWS\system32\hlwin.dll
O23 - Service: Gray_Pigeon_Server2.0 (GrayPigeonServer2.0) - Unknown owner - C:\WINDOWS\G_Server2.0.exe (file missing)
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: Kingsoft Personal Firewall Service (KPfwSvc) - Unknown owner - D:\备份\应用\金山毒霸2005绿色版\050829kav_2005\kav_2005\金山毒霸2005绿色版\KPfwSvc.EXE (file missing)
O23 - Service: taskmon - Unknown owner - C:\WINDOWS\taskmon.exe
O23 - Service: vip_Server (vipServer) - Unknown owner - C:\WINDOWS\vip_Server.exe (file missing)



G_Server2.0.exe  这个不知道是不是灰鸽子但是在WINDOWS文件下找不到这个文件.
所有隐藏文件都打开了的。

引用:

【什么情况的贴子】都快成了鸽子窝了 O23 - Service: Gray_Pigeon_Server2.0 (GrayPigeonServer2.0) - Unknown owner - C:\WINDOWS\G_Server2.0.exe (file missing) O23 - Service: vip_Server (vipServer) - Unknown owner - C:\WINDOWS\vip_Server.exe (file missing 在注册表中看看有没有相应的服务项，有的话，删，再c:\windows下看看有没有.dll _hook.dll 文件，有的话，删，另外把 C:\WINDOWS\taskmon.exe 打包发到我的邮件上，看看这个到底是什么 ...........................

注册表不懂,不敢乱动呀。
也不知道在注册表的那里面.
请教怎么差找.

C:\WINDOWS\taskmon.exe

无法打包 说进程正在运行,
在安全模式下可以打包吗?

引用:

【什么情况的贴子】开始，运行，输入regedit，定位到HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\ 看看下面有没有Gray_Pigeon_Server2.0  vip_Server 的项 ...........................

你的邮箱是多少,我已经在安全模式下打好包了.

HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\
里面有GrayPigeonServer2.0  vipServer  这两项
是不是直接把这项给删除.

引用:

【cathy123的贴子】【回复“惡魔メ寶貝”的帖子】 用LSPxpFix修复O10 ...........................

LSPxpFix 没用过这个东西.
不晓得那里有下.

引用:

【cathy123的贴子】【回复“惡魔メ寶貝”的帖子】 O23 - Service: taskmon - Unknown owner - C:\WINDOWS\taskmon.exe O23 - Service: vip_Server (vipServer) - Unknown owner - C:\WINDOWS\vip_Server.exe (file missing) 两之小鸽子。 O4 - HKLM\..\Run: [NTdhcp] C:\WINDOWS\system32\NTdhcp.exe 一个关闭杀软的木马。 ...........................

O4 - HKLM\..\Run: [NTdhcp] C:\WINDOWS\system32\NTdhcp.exe
是一个关闭杀软的木马啊?
请教怎么解决这个问题.

在c:\windows目录下没找到_hook.dll
只找到一个vip_Server.dll
G_Server2.0.dll这个文件好象上次给我删了。
现在没有了。这样算是清除完了鸽子了吗?

怎么没人回答我的问题了呀。郁闷ing

那里中了新灰鸽子了呀。
请指教!