 鲜花( 1)  鸡蛋( 0)
|
楼主 |
发表于 2006-5-5 16:59
|
显示全部楼层
Logfile of HijackThis v1.99.1& v; P) L- g, H
Scan saved at 16:55:24, on 2006-5-6
4 c0 F# C, E% CPlatform: Windows XP SP2 (WinNT 5.01.2600)
/ d" S. b, G' x" LMSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)8 \9 x$ U$ i" Y6 T4 r( E+ |# N4 P, {0 b* C
" }( @8 y7 D: |# H. bRunning processes:0 u9 z H, S: s- K6 Q
C:\WINDOWS\System32\smss.exe D6 y }! P4 d6 s2 @
C:\WINDOWS\system32\winlogon.exe
% f" T0 }8 e" H+ K2 J& \( l4 R! l' ^C:\WINDOWS\system32\services.exe1 v2 ]* E) k7 d0 g5 y
C:\WINDOWS\system32\lsass.exe- v1 ^; z3 W) B1 i
C:\Program Files\Common Files\Virtual Token\vtserver.exe
. _: u9 A {) r8 ^/ {) a6 wC:\WINDOWS\system32\ibmpmsvc.exe1 k) e+ K( q) o2 b
C:\WINDOWS\system32\svchost.exe" s3 t3 ^' t4 n3 o
C:\WINDOWS\System32\svchost.exe) z6 m; q. C1 ~' I8 u) d7 B
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
& i( r+ _) \5 v8 ^6 q! SC:\Program Files\Intel\Wireless\Bin\S24EvMon.exe+ _) O2 w. m' M3 F) x3 j! _: ^& v* b
C:\WINDOWS\system32\spoolsv.exe
0 B; s% K" w1 w: G- | vC:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE p; m9 b7 J% I
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
! U. P f2 q- m. k0 S$ \C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
+ _; e) A; f t* Q( K) p5 r: FC:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
, y+ p. @( P+ G" W* ZC:\Program Files\F-Secure\Common\FSMA32.EXE+ A( R$ ?9 D2 {9 |
C:\Program Files\F-Secure\Common\FSMB32.EXE( I6 _; `; {! |2 W! I$ b) D
C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
( C3 }! N/ p" A5 y0 uC:\Program Files\F-Secure\Anti-Virus\fssm32.exe
0 F) Q( ]* [. {0 }0 |: M0 hC:\WINDOWS\System32\QCONSVC.EXE
, c& O3 {. Q6 v& @C:\Program Files\F-Secure\Common\FCH32.EXE- i& Y1 l! `/ K# P
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
2 p5 k4 M+ z! x8 b7 l! ?C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe X( B; E) q1 u( Z k
C:\WINDOWS\System32\TPHDEXLG.EXE' }5 M9 B: I- }: W9 z1 A
C:\Program Files\F-Secure\Common\FAMEH32.EXE
" ^' J% |2 t! v" A' w6 Q; i+ ]C:\WINDOWS\system32\TpKmpSVC.exe( ?7 w: h( S* q% H; D: ~ v
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe5 R0 m6 M8 H( ^! a( P; O0 [. g6 j
C:\Program Files\F-Secure\Anti-Virus\fsrw.exe3 B) x. x/ \- A G1 y
C:\Program Files\F-Secure\Common\FNRB32.EXE
0 _) t) V: u" ]! l4 k$ ~! F# _C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe6 [; G% _1 {/ T
C:\Program Files\F-Secure\Common\FIH32.EXE; ]; U! r! T- k: O" P6 f1 M! t
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
: S0 n/ d7 s5 c) }C:\WINDOWS\Explorer.EXE
, M+ U) |8 o- N3 o9 jC:\Program Files\Synaptics\SynTP\SynTPLpr.exe
9 b) M3 @$ c0 u+ B+ pC:\Program Files\Synaptics\SynTP\SynTPEnh.exe
5 @( @. _2 e6 D0 Q% dC:\WINDOWS\system32\hkcmd.exe! u% U3 m# C, u2 p
C:\WINDOWS\system32\TpShocks.exe
% W0 J: `1 c- K- r; IC:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
& y8 Q4 l4 t" gC:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
% M/ N% N2 D9 Q" q1 @3 N' z' l2 qC:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe) a3 ~0 {3 K) u6 S# s" r
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe) G0 a5 R7 r6 l) C! ^
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe& u9 k, h) h' q
C:\WINDOWS\system32\dla\tfswctrl.exe
. V- `) g4 I' U/ b( ]C:\Program Files\IBM\Messages By IBM\ibmmessages.exe' h3 Z$ c, P$ Y* Q8 |9 d
C:\IBMTOOLS\UTILS\ibmprc.exe
1 }& F1 S t% |6 s$ xC:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE
. P: [0 `$ y. A9 O+ k7 V( B( iC:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
! [! { e+ T# X% ~' h+ XC:\WINDOWS\System32\svchost.exe6 j) V: s3 q& }) z
C:\WINDOWS\system32\rundll32.exe( C* g( r, |. x! i: [% W: M
C:\Program Files\F-Secure\Common\FSM32.EXE0 w3 ~0 d! ?) v
C:\WINDOWS\system32\CTFMON.EXE
$ Z7 d) j f" j/ L, y2 E1 K0 h5 FC:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
6 B- G0 l0 ~) L. M, A" l8 C6 ~C:\Program Files\Digital Line Detect\DLG.exe
1 G1 I5 h" j5 A' ~& UC:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe$ x8 o/ z- v1 {
C:\Program Files\F-Secure\FSGUI\fsguidll.exe9 E. h5 f& h# o# `1 {' X' ]
C:\Program Files\Messenger\msmsgs.exe
) P2 j4 Y, i* J1 T) i5 i2 ]8 y, z. a+ aC:\Program Files\Internet Explorer\iexplore.exe1 O; j3 C2 g! D' Y$ o
C:\DOCUME~1\SHIXIN~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe, H- @3 I5 y, G: x
7 k0 k0 w; Q% p& W8 P6 x
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll# J6 O# Q9 {* a
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe# ?+ L9 ^% {( K& R# W! X
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe7 x! o m, x/ s+ t" M
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe' D m9 o( d1 Z/ u5 V( ]: ]
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe- W7 X2 g* N4 t3 {* Q/ ]9 T
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper& F( L% h$ y% n6 k4 _% f
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe- j6 ?- B' E s1 {
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe4 P4 G( O% w6 @/ M# [
O4 - HKLM\..\Run: [ControlCenter] "C:\Program Files\IBM fingerprint software\ctlcntr.exe" /startup
0 G2 W7 H- Q, h3 m XO4 - HKLM\..\Run: [TP4EX] tp4ex.exe
: J7 s, v8 \* P' wO4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
+ W+ l9 [) E% d9 B% y [1 L6 wO4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
( b E# i! o" i3 W, K6 z" V# xO4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray+ X; f: {2 e( D- P' {" n
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
- F3 x8 s3 g& s: ?: zO4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
0 w- A+ y! O1 ?O4 - HKLM\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\\ibmmessages.exe
: ~: o9 }% q+ P, L; ]6 eO4 - HKLM\..\Run: [IBMPRC] C:\IBMTOOLS\UTILS\ibmprc.exe
# p* Z- V) Z& @' I( ?% T2 ~0 ^7 X* [O4 - HKLM\..\Run: [QCTRAY] C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE% I+ D, L; E5 L6 d6 g9 j+ c" n) s
O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE) g; R4 k! T, p* ?# r
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor7 y- B8 m3 i7 C/ t
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog" C6 E- c' Q5 a
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
/ H* z& @- c& M4 }6 W* a6 zO4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
( Z: X8 G' J+ H. K" k2 L CO4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC k' B% y7 ]9 y5 N
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC# ^' w6 M z& V6 e( ~8 {+ Z( k9 x
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName! y: p/ e8 h! }* u0 ]2 P
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash" P$ Y: A9 z4 I5 R5 b9 J4 O" F, Z c
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW( P. L+ I K4 n/ ]2 h6 {
O4 - HKCU\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe$ @0 K$ O! e4 x, {
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe3 |: L6 k/ E( U4 e* z2 b: k
O4 - Global Startup: Digital Line Detect.lnk = ?# [8 V# U t! ~2 k8 ~8 y+ \( V
O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
3 M5 X, ~/ E4 w+ H4 HO8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm3 J" |3 @ E+ G+ B6 A4 d( R# ]" F
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java142\jre\bin\NPJPI142.dll9 Q, {- s! R* H/ B# C9 T* E# X: Y
O9 - Extra 'Tools' menuitem: IBM Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java142\jre\bin\NPJPI142.dll
7 C2 y. f: S7 E# FO9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
- c6 ~6 A4 k3 Z( w) h/ h- RO9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll4 O6 g: W8 H* j" k- L u
O9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\Lenovo\PkgMgr\\PkgMgr.exe3 s$ \. M6 O' b2 U/ o2 t
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
0 M& H; O6 T, }8 L2 A' i- l2 Z9 GO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
0 V' r. X8 F% g3 IO10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
+ I/ t/ j# j U1 Y+ q+ BO10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
- k. I9 l( X/ M$ O. pO10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
8 C3 L* E8 B0 I* ?$ jO11 - Options group: [JAVA_IBM] Java (IBM)
6 R7 i+ T. P# ~- D/ ], o# PO20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
- @ s _4 {( L. n( O8 \4 H- sO20 - Winlogon Notify: psfus - C:\Program Files\IBM fingerprint software\psfus.dll
0 ^/ ^6 _+ n# q* X. @O20 - Winlogon Notify: QConGina - C:\WINDOWS\SYSTEM32\QConGina.dll2 _* l! M6 ~; v& z) V
O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll) d' U! B2 P( u% J" h! y6 D4 p
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
8 y ]9 U& A- i! N6 F* b! q, jO23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe# A6 E. K5 h! n" Q! ?2 [# u
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe/ m* b# p1 Z9 r1 k _7 z' d+ [2 I
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
7 l- O( U3 ]5 Y8 zO23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe. r4 q, o+ t" _2 V7 n6 b
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
+ |6 w6 Z, T. W4 a: FO23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
6 I5 K b P# e6 ?7 U! p5 tO23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe: h9 b' N$ G: [/ @5 ^$ b
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
: P6 q- }9 R2 e! k sO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe6 ~: v0 T6 o' p; W l
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
8 o3 m! y4 `1 m, S* P3 h4 KO23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE
8 L) r' H+ W1 t b3 P( f3 \O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe; O( l3 L# U9 w3 b0 h. R* d% p1 o' [
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
! i: x% H, o. m# DO23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
+ d, k$ H% A4 b& C+ G, uO23 - Service: IBM HDD APS Logging Service (TPHDEXLGSVC) - IBM Corporation - C:\WINDOWS\System32\TPHDEXLG.EXE
H# E: D1 n! [. a, J {O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
* p& ]2 u1 E4 B& N& U7 JO23 - Service: Protector Suite Virtual Token (vtserver) - UPEK Inc. - C:\Program Files\Common Files\Virtual Token\vtserver.exe |
|
楼主: 九月
狗仔卡
发表于 2006-5-5 13:40
显身卡
