系统中了不知道什么病毒,直接强制关闭窗口和程序,导致不能使用杀毒软件(瑞星打不开.卡卡打不开.冰刃,SREngPS都打不开...)唯一能打开的就只有hijackthis..
还不时弹出其他的网页,进程增多,不能查看隐藏文件,急求帮助.!
以下为日志:
HijackThis_zww汉化版扫描日志 V1.99.1
保存于 ＡＭＡＭ10:40:32, 日期 2002-1-1
操作系统： Windows XP SP2 (WinNT 5.01.2600)
浏览器： Unable to get Internet Explorer version!
当前运行的进程：
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\msnshel.exe
D:\Porgram Files\StormII\stormliv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\94961.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\host.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\system32\rundll32.exe
D:\Porgram Files\VStart\VStart.exe
C:\WINDOWS\moni.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\winhelp.exe
E:\·游戏\QQGAME\Accel.exe
C:\WINDOWS\system32\conime.exe
D:\辉的下载\sysem系统扫描\HijackThis\HijackThis1[1].99.1\HijackThis1991zww.exe
C:\WINDOWS\System32\alg.exe
c:\e.exe
C:\WINDOWS\system32\ChiNiu(2).exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauc1t.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,,C:\WINDOWS\system32
\host.exe
O2 - BHO: Thunder AtOnce - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - D:\Porgram
Files\Thunder.v5.7.3.389.NoAD-Ayu\ComDlls\TDAtOnce_Now.dll
O2 - BHO: AdPopup - {11F09AFD-75AD-4E51-AB43-E09E9351CE16} - C:\Program
Files\Common Files\CPUSH\cpush.dll
O2 - BHO: Info cache - {385AB8C6-FB22-4D17-8834-064E2BA0A6F0} - C:\Documents and
Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll
O2 - BHO: 网站排名工具条BHO - {489873CE-F3E1-44A3-8E89-04BE26BE4446} - C:\Program
Files\zzToolBar\Toolbar_bho.dll
O2 - BHO: Thunder5下载 - {54EBD53A-9BC1-480B-966A-843A333CA162} -
C:\WINDOWS\ThunderBHONew3.dll
O2 - BHO: (no name) - {6167F471-EF2B-41DD-A5E5-C26ACDB5C096} - C:\Program
Files\Internet Explorer\PLUGINS\WinSys8v.Sys
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - D:\Porgram
Files\Thunder.v5.7.3.389.NoAD-Ayu\ComDlls\xunleiBHO_Now.dll
O2 - BHO: Adobe Common
Objects - {986488AF-13D5-9DDF-4FEF-9FB88698CFC1} -
C:\Documents and Settings\All Users\Application
Data\Microsoft\OFFICE\USERDATA\webbrowser_2085.dll
O2 - BHO: brush Class - {E157D62A-D8A4-45DF-8E9B-C33D93821BDF} -
C:\WINDOWS\system32\ffdfvq82.dll (file missing)
O2 - BHO: Thunder5下载辅助 - {EA2FCCA9-F44F-43DD-9724-9339950D103C} -
C:\WINDOWS\ThunderHelper32.dll
O2 - BHO: Invoke Class - {FFB3D068-F8DA-4370-A71E-83B1C959CDD6} -
C:\WINDOWS\system32\3941.dll
O3 - IE工具栏增项: 网站排名工具条 - {0A1230F1-EB52-4CA3-9D34-DE2ABC2EED35} -
C:\Program Files\zzToolBar\ToolBand.dll
O4 - 启动项HKLM\\Run: [VStart5.0] D:\Porgram Files\VStart\VStart.exe
O4 - 启动项HKLM\\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32
\NvCpl.dll,NvStartup
O4 - 启动项HKLM\\Run: [nwiz] nwiz.exe /install
O4 - 启动项HKLM\\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32
\NvMcTray.dll,NvTaskbarInit
O4 - 启动项HKLM\\Run: [runeip] "D:\Porgram Files\瑞星卡卡\runiep.exe" /startup
O4 - 启动项HKLM\\Run: [BsChiNiu] C:\WINDOWS\system32\ChiNiu.exe
O4 - 启动项HKLM\\Run: [upxdnd] C:\WINDOWS\upxdnd.exe
O4 - 启动项HKLM\\Run: [RavMonI] C:\WINDOWS\moni.exe
O4 - 启动项HKLM\\Run: [ArpInsert] C:\WINDOWS\system32\Cache\ArpHack.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: QQ游戏启动加速程序.lnk = ?
O4 - Global Startup: chiniu(2).exe
O8 - IE右键菜单中的新增项目: 使用迅雷下载 - D:\Porgram Files\Thunder.v5.7.3.389.NoAD
-Ayu\Program\geturl.htm
O8 - IE右键菜单中的新增项目: 使用迅雷下载全部链接 - D:\Porgram
Files\Thunder.v5.7.3.389.NoAD-Ayu\Program\getallurl.htm
O8 - IE右键菜单中的新增项目: 易趣购物 - C:\Program Files\AD4All\link1\ebaylink.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - D:\Porgram Files\Tencent\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 添加到网络硬盘 - D:\Porgram
Files\Tencent\AddToNetDisk.htm
O9 - 浏览器额外的按钮: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} -
http://www.tomatolei.com (file missing)
O9 - 浏览器额外的“工具”菜单项: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} -
http://www.tomatolei.com (file missing)
O9 - 浏览器额外的按钮: 一起来音乐社区 - {7DBC6ADB-5788-4FB9-AEC3-B40A58AC11DF} -
http://www.yiqilai.com (file missing)
O9 - 浏览器额外的按钮: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - D:\Porgram
Files\PPLive\PPLive.exe
O9 - 浏览器额外的“工具”菜单项: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} -
D:\Porgram Files\PPLive\PPLive.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {9FAFB576-6933-4CCC-AB3D-B988EC43D04E} (RavOnline Class) -
http://download.rising.com.cn/rs2008/online/notvista/ravolctl.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash
Object) -
http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O16 - DPF: {E787FD25-8D7C-4693-AE67-9406BC6E22DF} -
https://password.qq.com/download/qqedit2.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E7E82254-035B-41DF-8571-F4F5EC444114}:
NameServer = 202.96.128.86,202.96.128.166
O18 - 列举现有的协议: KuGoo - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} -
C:\WINDOWS\system32\KuGoo3DownXControl.ocx
O18 - 列举现有的协议: KuGoo3 - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} -
C:\WINDOWS\system32\KuGoo3DownXControl.ocx
O18 - 列举现有的协议: livecall - {828030A1-22C1-4009-854F-8E305202313F} -
C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - 列举现有的协议: msnim - {828030A1-22C1-4009-854F-8E305202313F} -
C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs:
mrjhtjd.dll,qrhhb.dll,xdfntt.dll,hgfhk.dll,hjaiq.dll,kduy.dll,frntrn.dll,dnteh.dll,chmfcmh.dll,j
wlah.dll,crugd.dll,lariytrz.dll,thurh.dll,mgmgmm.dll,oqrthc.dll,ydgn
[用户系统信息]Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; Chinarank Toolbar)
