Logfile of HijackThis v1.99.1
Scan saved at 1:47:51, on 2006-7-13
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
D:\KAV2005\KWatch.EXE
C:\WINDOWS\Explorer.EXE
D:\KAV2005\KAVStart.exe
C:\WINDOWS\VM_STI.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ctfmon.exe
D:\KAV2005\KPFW32.EXE
D:\KAV2005\KPfwSvc.EXE
C:\WINDOWS\SYSTEM32\RUNDLL32.EXE
D:\KAV2005\KMailMon.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
D:\遨游浏览器\Maxthon\Maxthon.exe
C:\WINDOWS\System32\VIPTray.exe
F:\qq b3\QQ2006\QQ.exe
F:\qq b3\QQ2006\TIMPlatform.exe
F:\qq b3\QQ2006\QQ.exe
D:\opdra浏览器\Opera.exe
F:\qq b3\QQ2006\QQ.exe
F:\qq b3\QQ2006\QQ.exe
D:\扫描地址\HA_HijackThis\HijackThis.exe
R3 - URLSearchHook: (no name) - {EED92A43-CFCE-4548-BD73-B0A405470ED5} - (no file)
O2 - BHO: ThunderIEHelper - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v14.dll
O2 - BHO: BrowserHelper Class - {2D99E8F4-56B7-457B-9A92-61B5D247D263} - C:\WINDOWS\system32\WinDefendor.dll
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - D:\迅雷下载\ComDlls\XunLeiBHO_001.dll
O2 - BHO: ElkNuywd Class - {9E1A5801-9142-E4E7-EAF8-0759353F2A0A} - C:\WINDOWS\DOWNLO~1\vcvqzl.dll
O2 - BHO: estAliveObj Class - {A2B7A0F0-B697-4A71-8D91-43443F57D7BB} - C:\WINDOWS\estAlive.dll
O2 - BHO: IEHlprObj Class - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - C:\WINDOWS\system32\IEHelper.dll
O3 - Toolbar: 金山毒霸安全助手 - {EF72500A-C234-46C4-BF0A-9AA6913DDF34} - C:\Program Files\KOS\KOSIEBar.dll
O3 - Toolbar: ＆Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [PHIME2002ASync> C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A> C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [KavStart> ＂D:\KAV2005\KAVStart.exe＂ -startup
O4 - HKLM\..\Run: [BigDogPath> C:\WINDOWS\VM_STI.EXE USB PC Camera 301P
O4 - HKLM\..\Run: [SoundMan> SOUNDMAN.EXE
O4 - HKCU\..\Run: [ctfmon.exe> C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [KavPFW> ＂D:\KAV2005\KPFW32.EXE＂
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: IE-BAR.lnk = ？
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: ＆使用迅雷下载 - D:\迅雷下载\Program\GetUrl.htm
O8 - Extra context menu item: ＆使用迅雷下载全部链接 - D:\迅雷下载\Program\GetAllUrl.htm
O8 - Extra context menu item: 夺宝奇兵(＆X) - res://D:\夺宝奇兵\PageDigger5.0\DownFlashCom.dll/htm/DOWNHTML
O8 - Extra context menu item: 缓存的网页快照 - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: 奇兵 - {9A2B6F50-4461-448E-A6C0-066623CD75B9} - D:\夺宝奇兵\PageDigger5.0\xbDrctDown.exe
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\WINDOWS\system32\shdocvw.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{18548B94-D60E-4B39-B15C-25E6C5DA2E3F}: NameServer = 202.99.160.68 202.99.166.4
O17 - HKLM\System\CCS\Services\Tcpip\..\{5CFD54C0-9B46-4EF3-A494-806277ABC741}: NameServer = 219.150.32.132,219.146.0.130
O17 - HKLM\System\CS1\Services\Tcpip\..\{18548B94-D60E-4B39-B15C-25E6C5DA2E3F}: NameServer = 202.99.160.68 202.99.166.4
O23 - Service: Kingsoft Personal Firewall Service (KPfwSvc) - Kingsoft Corporation - D:\KAV2005\KPfwSvc.EXE
O23 - Service: Kingsoft Antivirus KWatch Service (KWatchSvc) - Kingsoft Corporation - D:\KAV2005\KWatch.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe＂ -d -f ＂%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: VIPTray - Unknown owner - C:\WINDOWS\System32\VIPTray.exe
浏览网页的时候有时跳出来 ＂连接到127.0.0.1失败＂ ，然后开不了网页。
最近还经常弹出网页，网址：ht*tp://gallery.photos.cn.yahoo.com/site/worldcup/
然后大家帮我看看是中毒了吗？
O23 - Service: VIPTray - Unknown owner - C:\WINDOWS\System32\VIPTray.exe
O4 - Global Startup: IE-BAR.lnk = ？
建议参考：
|
|
设为首页
加入收藏
联系我们
打印本文 
返回顶部 
加入收藏 
关闭窗口
