 鲜花( 1)  鸡蛋( 0)
|

楼主 |
发表于 2006-5-5 16:59
|
显示全部楼层
Logfile of HijackThis v1.99.1
! i( W% @( _/ tScan saved at 16:55:24, on 2006-5-6! ^0 Q+ [7 |9 r5 ]
Platform: Windows XP SP2 (WinNT 5.01.2600); ~- B4 A. Q! d+ q
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)6 g) M0 `0 k( v( O, e0 H
; K+ L$ V9 K, l& N3 X$ F5 A$ Y
Running processes:
9 K+ `" g7 A- ]' u: |! I. @, ?C:\WINDOWS\System32\smss.exe1 b e# _: W; A
C:\WINDOWS\system32\winlogon.exe
' Z6 I' T3 P6 y @9 U( |C:\WINDOWS\system32\services.exe' [( ^, M/ X& w Y" d
C:\WINDOWS\system32\lsass.exe, r7 Z. z7 n) I# [4 i/ ?
C:\Program Files\Common Files\Virtual Token\vtserver.exe
2 O. ]" m6 [* L1 YC:\WINDOWS\system32\ibmpmsvc.exe
$ P5 j2 D1 d0 h+ r }C:\WINDOWS\system32\svchost.exe
. g. d( i- C1 [$ RC:\WINDOWS\System32\svchost.exe
, t$ o) R3 m- Y$ b; bC:\Program Files\Intel\Wireless\Bin\EvtEng.exe' x/ h( r! G/ @' X( N) [3 |( Q' w8 Z
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe2 h/ [: n( I9 Y% Q, k9 u! U# j
C:\WINDOWS\system32\spoolsv.exe
( q1 o: G8 u( {C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE1 a3 J0 y$ ]% I$ R
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
6 h0 k2 Z. b6 r5 P; XC:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
M3 f: J6 v, D7 oC:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE5 O# \7 j4 n/ F) A- l! e1 A: K
C:\Program Files\F-Secure\Common\FSMA32.EXE' m. K6 {" C4 w7 L7 ~% ?; L
C:\Program Files\F-Secure\Common\FSMB32.EXE
/ W9 K# h1 e+ b4 P' V% IC:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
1 V2 M! ?: \0 eC:\Program Files\F-Secure\Anti-Virus\fssm32.exe
- O2 R! c2 a; [: [C:\WINDOWS\System32\QCONSVC.EXE
! M. @% b2 P0 R! z5 r, u. tC:\Program Files\F-Secure\Common\FCH32.EXE
+ J0 i+ |' q% a' a' ~0 n, m# U3 @C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
) M$ y: o4 X P4 _9 DC:\Program Files\Analog Devices\SoundMAX\SMAgent.exe$ T. Y2 A# y: B3 a
C:\WINDOWS\System32\TPHDEXLG.EXE
1 P$ {# H. R2 F' R- W# J4 eC:\Program Files\F-Secure\Common\FAMEH32.EXE
% [- a' C. {5 H5 I1 F) DC:\WINDOWS\system32\TpKmpSVC.exe
0 O( S0 R* u: u2 |2 kC:\Program Files\F-Secure\Anti-Virus\fsqh.exe
, T6 _2 X: ?1 D/ dC:\Program Files\F-Secure\Anti-Virus\fsrw.exe
) J' _- X& C& z) D' y6 x8 a# _6 FC:\Program Files\F-Secure\Common\FNRB32.EXE- k* a* Z5 n& |5 K. { A
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe0 Y2 ?5 }9 z& [$ d
C:\Program Files\F-Secure\Common\FIH32.EXE
0 I( ]' n5 U6 f, ]4 | i% j6 |' v1 ^C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
! z: h- R9 u1 H% d& D& U* j" v6 ZC:\WINDOWS\Explorer.EXE( i x" p; k. H, t; _
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
4 M+ m8 O. g: f* r4 U2 vC:\Program Files\Synaptics\SynTP\SynTPEnh.exe7 j7 o. u, [: e1 x+ N( }. o& L
C:\WINDOWS\system32\hkcmd.exe
- f4 G% e8 C" jC:\WINDOWS\system32\TpShocks.exe9 ^+ P8 a# r& j( y2 O' `- t% T9 m
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
1 S4 E* ~, Z0 R6 LC:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
5 x3 P+ o$ _1 q+ X8 d ZC:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
* k) A( ]# o+ G7 @) _; MC:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
6 g9 m' _& N- k. B* aC:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
" i% D" ?! T8 S$ p/ k+ DC:\WINDOWS\system32\dla\tfswctrl.exe. D" `3 r: S" W1 E X' C+ ]
C:\Program Files\IBM\Messages By IBM\ibmmessages.exe% S" v1 O/ v% `! X: z
C:\IBMTOOLS\UTILS\ibmprc.exe# ?4 `( `. K# Y& P. G$ y7 o
C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE7 t. Q: |$ I# Z0 t% R, ^* E
C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
+ s; \3 S- k3 c0 \, {' MC:\WINDOWS\System32\svchost.exe. w5 @9 K3 q1 H2 L
C:\WINDOWS\system32\rundll32.exe" [7 u8 \0 N# F& C2 a! _
C:\Program Files\F-Secure\Common\FSM32.EXE
# A/ I2 e' j* n3 @% k. v' R: i0 vC:\WINDOWS\system32\CTFMON.EXE: f: C5 R" j! P, B- h
C:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
& K$ R9 Y8 g3 t2 M& O% A# yC:\Program Files\Digital Line Detect\DLG.exe
* e7 I3 F' F: w7 m" Z b UC:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
' G7 A6 p: r8 C; ^% K; vC:\Program Files\F-Secure\FSGUI\fsguidll.exe
" z, d$ x5 H3 C8 I8 ?: [1 w7 R; P& ^C:\Program Files\Messenger\msmsgs.exe
9 ]$ w9 h% d5 @4 Y% [, r2 R* CC:\Program Files\Internet Explorer\iexplore.exe
( e; m) s/ I9 T. `C:\DOCUME~1\SHIXIN~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe
& g( ~7 Z6 u2 y8 Q/ E9 r
+ {5 W z. Z; `: bO2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
. B, P+ x9 `$ Z' A7 D/ f# kO4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe, B6 _1 G9 u1 x4 p/ Y" d9 K0 f
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
! ]$ Q& n1 @5 x$ R! s# x h+ XO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe4 o* V0 s+ T6 p! R
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
" D# T" g3 p1 lO4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
' P2 L W! f% V5 IO4 - HKLM\..\Run: [TpShocks] TpShocks.exe
$ Y8 r1 \% k- F8 e; d. C/ tO4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
" a M( e3 g! V9 E4 T/ ?" UO4 - HKLM\..\Run: [ControlCenter] "C:\Program Files\IBM fingerprint software\ctlcntr.exe" /startup
* \( C6 C; O xO4 - HKLM\..\Run: [TP4EX] tp4ex.exe% g( n( ]$ @* _& n4 _! F9 F
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe3 C! T1 U8 p6 s% h
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
! W0 b9 S: N O# c8 U$ lO4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray" f2 w3 c. H8 u
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
( \+ a2 |1 M/ R/ d4 Z0 PO4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe7 `5 e% A' p" t( i
O4 - HKLM\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\\ibmmessages.exe
0 |8 U: x/ E& I; I+ I! r" Y2 dO4 - HKLM\..\Run: [IBMPRC] C:\IBMTOOLS\UTILS\ibmprc.exe
& h: Z- t0 W/ r QO4 - HKLM\..\Run: [QCTRAY] C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE
4 Z, m$ y: F2 v. {2 k4 AO4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
; H) \* t- Z @0 o3 UO4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor+ F) D' z, |3 D/ U) O/ d! `
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
. @1 b/ P! G* x: a# s# Q- q: fO4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
7 z7 G, V7 m! ]7 SO4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE6 h1 {$ J0 L- r0 k- O
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
. U, S9 w/ N& a, P9 S! h. kO4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
9 n5 Y u R u3 F+ V! {) }$ J$ |" S3 cO4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
6 x& p* k, w! ?& EO4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash h3 @6 W' N* ]
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
" F; p" W4 X, h( U( w5 m/ [O4 - HKCU\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
. X$ Y8 g' Q/ T- L! E6 [( xO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe6 Z9 _) H5 P9 O% I; w' R) f
O4 - Global Startup: Digital Line Detect.lnk = ?* W# J+ w4 O2 t8 u! ~' d' e
O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
, l1 u$ a+ M) T( C1 \: ^O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
4 C0 i: V" x: Z6 H0 @O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java142\jre\bin\NPJPI142.dll% U, s, t7 B; a+ w4 x4 I
O9 - Extra 'Tools' menuitem: IBM Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java142\jre\bin\NPJPI142.dll
0 K' e; G$ B4 Y' ?/ a/ U- P* \O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
- v2 \$ z: D# K: ]- P0 N8 kO9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll7 j# d' O8 W+ M; Q% a- Z( W5 i$ [2 R
O9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\Lenovo\PkgMgr\\PkgMgr.exe
( [. B2 W5 g7 Q% SO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
$ e( u" d! X0 |5 `O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
$ X4 t, f$ E! s! `O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll* M3 d. n$ R3 i$ ^7 }! P+ ^
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll2 ^4 l. i0 D; V+ X, P. v
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll- u- A* W6 I+ w
O11 - Options group: [JAVA_IBM] Java (IBM)/ S/ Z- ~7 X7 j$ M( e5 g6 U8 R
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll$ p1 }/ S8 M0 @" H t0 u
O20 - Winlogon Notify: psfus - C:\Program Files\IBM fingerprint software\psfus.dll: O5 S( Z2 f# m6 x: L. c' B
O20 - Winlogon Notify: QConGina - C:\WINDOWS\SYSTEM32\QConGina.dll2 r. w' n0 o {# q6 V1 h# x5 S: c' {
O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll0 ]& @) {3 A4 d% |
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE5 Y& X' s1 E0 I+ i7 |( w
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
$ V$ d- e1 v8 @, | `O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe0 x, J( `1 j7 z1 p: h5 _$ {6 k
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE& G) _ w8 X y9 P# ^6 W) y8 t
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
/ D7 E N1 D# b B0 ?O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe9 Z/ i6 d" n3 g
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
( w ?6 |1 b4 P+ N iO23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
5 R2 X" E% c# R* k& |3 Y! j3 v( tO23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe) a3 y# i) o* e9 J6 U6 `+ s. i0 h( |
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe9 c$ R* ?+ p9 [' N8 F
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
& r1 j* z1 w( b. U a! O7 e6 HO23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE; I: V2 y* f* q# E
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe: ~- h7 j; Q5 s) S9 D! Z, X
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe/ m' U. C6 T a9 W' S# c) R
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
' r S' I+ S. ?: |) H! s% KO23 - Service: IBM HDD APS Logging Service (TPHDEXLGSVC) - IBM Corporation - C:\WINDOWS\System32\TPHDEXLG.EXE0 m5 ]& r' }! r" m, ?
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
7 {: G1 C" i2 A u* D. q3 dO23 - Service: Protector Suite Virtual Token (vtserver) - UPEK Inc. - C:\Program Files\Common Files\Virtual Token\vtserver.exe |
|