 鲜花( 1)  鸡蛋( 0)
|
楼主 |
发表于 2006-5-5 16:59
|
显示全部楼层
Logfile of HijackThis v1.99.1) l0 E2 N d I" W% {/ y) A
Scan saved at 16:55:24, on 2006-5-6* j0 J* p% g6 ?
Platform: Windows XP SP2 (WinNT 5.01.2600)
" a# Y8 b0 S6 A9 R5 M* P# pMSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
6 m) @5 r2 G; w0 e j0 K4 o8 E& A9 n( {* d$ W$ A
Running processes:) n/ i8 }+ l* z
C:\WINDOWS\System32\smss.exe0 i/ E \: s! j* i/ g
C:\WINDOWS\system32\winlogon.exe6 Z/ r/ @- X. x4 V
C:\WINDOWS\system32\services.exe; c9 h$ B, r! q+ g$ G
C:\WINDOWS\system32\lsass.exe! h3 k0 I2 ^( j7 v0 o! [
C:\Program Files\Common Files\Virtual Token\vtserver.exe+ ~, C9 \! Z( @9 V6 D# `4 x9 h
C:\WINDOWS\system32\ibmpmsvc.exe1 r2 X% u+ L/ \8 Q
C:\WINDOWS\system32\svchost.exe
5 e& p7 R& ?5 U1 {4 k6 ~C:\WINDOWS\System32\svchost.exe$ r8 Q7 T3 w5 |3 X! u4 a
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe, Z; @5 n4 ?- O, Q
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe8 h6 F. g3 c; ]1 R% {+ V
C:\WINDOWS\system32\spoolsv.exe
/ [! e+ s' M+ G; t1 vC:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE5 V# S2 j3 a" S' }0 ?
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
4 g' H' d8 R" h2 I( _0 eC:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe6 S* w. Q* w* O9 J
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
9 q3 t0 O+ Z- i, PC:\Program Files\F-Secure\Common\FSMA32.EXE
$ p- M9 F" S0 m) t8 ZC:\Program Files\F-Secure\Common\FSMB32.EXE
1 v, a9 k V5 m+ r+ [C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
8 s9 i' T2 y G) K1 x- TC:\Program Files\F-Secure\Anti-Virus\fssm32.exe% @) V X; @! D7 q! w) o
C:\WINDOWS\System32\QCONSVC.EXE
- c6 t+ h/ w8 Z* IC:\Program Files\F-Secure\Common\FCH32.EXE: P0 f2 F$ b( o L
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
* Y: f; P2 {3 I" Y2 p+ U- xC:\Program Files\Analog Devices\SoundMAX\SMAgent.exe3 m. T/ l0 g ]$ s1 O2 i$ L' p
C:\WINDOWS\System32\TPHDEXLG.EXE# x8 p* G/ T6 J3 t
C:\Program Files\F-Secure\Common\FAMEH32.EXE
! L/ o7 U2 N! K: ]8 O0 g9 {# rC:\WINDOWS\system32\TpKmpSVC.exe# i1 m6 r) q* _5 a
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe" [; @" ]* {& z4 B. W t
C:\Program Files\F-Secure\Anti-Virus\fsrw.exe5 }* _ \/ ]% x9 P4 H2 X2 W/ l& F
C:\Program Files\F-Secure\Common\FNRB32.EXE+ R, `6 r: Q' n7 r2 Y
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
! t9 y, P7 k* F0 C* u% s8 B6 |- y; aC:\Program Files\F-Secure\Common\FIH32.EXE
2 |4 N+ m( ?8 G/ P, ^# fC:\Program Files\F-Secure\Anti-Virus\fsav32.exe! w& b2 \" L- E" c
C:\WINDOWS\Explorer.EXE- _; h: S: e( F! A- n i
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
$ F* ?) Y; c( E8 h; iC:\Program Files\Synaptics\SynTP\SynTPEnh.exe: B0 h$ ]% Q# u6 r, Y; |- ^
C:\WINDOWS\system32\hkcmd.exe
% |& j" y' f" @1 S' c) x$ R3 j+ nC:\WINDOWS\system32\TpShocks.exe
: l2 q* d% c6 D& UC:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
6 m$ l! I' q- vC:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe! G' h$ L) I7 N( t: g4 n
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe4 y' M2 K B/ R7 _" Y
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
6 Q, Q5 d: N( L& H p$ c9 R: p0 FC:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe& `1 }' y7 T: A; m/ T7 X6 B
C:\WINDOWS\system32\dla\tfswctrl.exe6 G* d2 f& @, U
C:\Program Files\IBM\Messages By IBM\ibmmessages.exe; k! {* M6 P' h, i" Z& _. |0 Y
C:\IBMTOOLS\UTILS\ibmprc.exe @# q8 C4 V" \0 `7 i
C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE# i: K- {% w7 n" F% p3 H1 [
C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
+ _- B2 x5 m4 u8 r/ N6 dC:\WINDOWS\System32\svchost.exe
) r" b9 J; ?5 t2 \4 j8 t8 b. lC:\WINDOWS\system32\rundll32.exe
8 x1 |0 A+ U2 L6 q- z) G. K5 u7 \C:\Program Files\F-Secure\Common\FSM32.EXE
! r, }) e7 L+ Q1 u1 W8 F- f" T) PC:\WINDOWS\system32\CTFMON.EXE* ~8 X+ F7 \' }6 B* o
C:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
, i3 `% f+ C0 q3 B, nC:\Program Files\Digital Line Detect\DLG.exe
- G% E" P5 A/ T0 `" GC:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
2 V7 x T1 m. b: B1 y7 BC:\Program Files\F-Secure\FSGUI\fsguidll.exe
/ S Z$ n9 ~- V3 [7 WC:\Program Files\Messenger\msmsgs.exe
7 S# F) m# I' ~8 ~& [C:\Program Files\Internet Explorer\iexplore.exe
3 y R: z- H+ WC:\DOCUME~1\SHIXIN~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe
5 S7 H. t2 k# ?) K$ u f; @) Z0 u! R; M% H4 E. ]* g: C# t4 D
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll/ Z& c; l2 t- ]& ?2 r
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
& V! j. |6 }& P3 M4 LO4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe2 i# b* z; M P+ y" _3 Y' [3 u
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
. F. G4 U* y! M+ j9 mO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe+ @8 h1 H, z9 h% M
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
8 k9 _, h5 |5 E# EO4 - HKLM\..\Run: [TpShocks] TpShocks.exe
1 G, N- m5 G8 c8 j! a5 R5 [O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
" ~' M* x! e x. @0 Q& MO4 - HKLM\..\Run: [ControlCenter] "C:\Program Files\IBM fingerprint software\ctlcntr.exe" /startup# R2 ^. M M0 p2 D
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
5 v; D2 G- `+ s- s% g gO4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
* c6 V- n8 i2 `. d' iO4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
& B* W( P1 L, O# o6 o2 IO4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray$ L+ k$ [% }" u% P' D
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r. m0 o' y9 {- q# w5 D; x
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe6 O) |* Q1 r# K1 a: x* A8 _4 P
O4 - HKLM\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\\ibmmessages.exe0 \* o* b) j9 E/ e* P
O4 - HKLM\..\Run: [IBMPRC] C:\IBMTOOLS\UTILS\ibmprc.exe
/ f% A6 [* z, t& K1 ?: tO4 - HKLM\..\Run: [QCTRAY] C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE( D3 }) S3 _) G; E
O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
- x' c# B3 U0 O* P* ?# J' }O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor; \/ k' B* j0 t$ Y
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog; C. P1 q, T P* E/ Q
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration327 Q3 s/ O9 \# j8 {
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
3 f7 _" d" w9 _4 S5 rO4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC9 X# x; U f; K2 \8 {% P" e& H* F
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
$ R0 M4 I7 x- ^( v& ~O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName2 Q9 @. _' [6 g* S) O6 A& ~. Z' F0 M
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash* {5 ?! M. l) q
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW9 e3 B" S2 }: `' P2 m, b$ B! n
O4 - HKCU\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe) ?% |6 f% [4 ^9 Y
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
3 o# m4 j& `. g, e" a* z! XO4 - Global Startup: Digital Line Detect.lnk = ?4 m7 U ?" u9 w6 M) l- p$ o
O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
$ z# Y7 C. p8 H/ IO8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
& @9 K1 H& L E9 ?4 TO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java142\jre\bin\NPJPI142.dll
% R! U$ X1 Y3 b/ PO9 - Extra 'Tools' menuitem: IBM Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java142\jre\bin\NPJPI142.dll
' F& A" S( P, }& j4 j6 K7 jO9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll0 A0 m% N' c5 d' [) l- E' E
O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
# }. r7 q0 ~( p; r7 h: \; rO9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\Lenovo\PkgMgr\\PkgMgr.exe- V z- a. q7 o6 I
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
9 T; `4 e! G* R. r" E2 }6 mO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe0 \* A) H# a% k4 ~; x: E! x, K2 T
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
: ]& i# X( T _! ^- ^ ~O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll H! D1 G+ H$ t' v% E3 A
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll# P0 m# z/ Y" b) m- U7 R8 J( Z
O11 - Options group: [JAVA_IBM] Java (IBM)" @" T! h$ n3 V% G x1 E y# h
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
4 s% y2 y" ]8 {# fO20 - Winlogon Notify: psfus - C:\Program Files\IBM fingerprint software\psfus.dll
9 e. {6 [6 m! ^1 d( U# [* I4 oO20 - Winlogon Notify: QConGina - C:\WINDOWS\SYSTEM32\QConGina.dll
8 z" N ~( O( c4 O- WO20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
' ] Y: R6 b, n6 K- N, ^ _$ pO23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
' x+ I# Y/ i6 B1 K$ BO23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
7 ]4 G. e/ K: H& E+ Y# c, F# ?O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
o) {( a4 Q8 |( a; I2 m: {O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
. _/ C1 l* m! IO23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe. H$ r B# m, I& Y
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe6 C, x+ M, `/ d
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
/ i) K4 C/ U1 hO23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe* V6 { j: |# g- \+ u+ G! N
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe5 A- F( l8 i% C: r8 K8 T
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
) Y! [; O3 t: A7 _O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)' P, _; c6 m. H& ^
O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE* V* X2 q) T+ D: R( h- [; `
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
9 m8 O( Y( J6 a! YO23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe: o1 V3 b2 c6 T; o2 d( r
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe Q$ G6 k# i' Q2 g( |- }& I
O23 - Service: IBM HDD APS Logging Service (TPHDEXLGSVC) - IBM Corporation - C:\WINDOWS\System32\TPHDEXLG.EXE
+ r! W( q9 l) q2 d: T/ M# FO23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe! u& `/ }& C, n! W- ~0 n4 u9 ?# g
O23 - Service: Protector Suite Virtual Token (vtserver) - UPEK Inc. - C:\Program Files\Common Files\Virtual Token\vtserver.exe |
|
楼主: 九月
狗仔卡
发表于 2006-5-5 13:40
显身卡
