八达网

标题: 中了这个病毒怎么杀 [打印本页]

作者: 红尘づ泪 时间: 2009-7-25 10:58
标题: 中了这个病毒怎么杀
每次重新启动会把系统时间修改为1990年1月1日

这个是360的诊断报告
各位高手：
非常感谢您留心我这份系统诊断报告，小菜鸟十万火急等待您的帮助！
该诊断报告由360安全卫士提供 http://www.360safe.com
诊断时间: 1990-01-01  10:01:45
诊断平台: Microsoft Windows XP  Service Pack 3
IE版本: Internet Explorer V7.0.5730.11 Build:75730
计算机物理内存:2.00GB - 当前可用内存:245.21MB

100 - 未知 - Process: AtService.exe [AFSS Service] - C:\WINDOWS\system32\AtService.exe - cbd4d08d090b760f8d015ccf3f7fd9f1
100 - 未知 - Process: FpLogonServ.exe [Fingerprint Winlogon Service] - C:\WINDOWS\system32\FpLogonServ.exe - 8fa03c76d2dcc29014583fa5095bf5b1
100 - 未知 - Process: S24EvMon.exe [Intel(R) Wireless Management Service] - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe - 55ccc8ced5778556f6b516b3858ac970
100 - 未知 - Process: acs.exe [ACS] - C:\WINDOWS\system32\acs.exe - 468e777aaa2dd1245720cd58a9c4063c
100 - 未知 - Process: stormliv.exe [暴风影音媒体控制中心] - C:\Program Files\StormII\stormliv.exe - 9a3ce7b450bfa0fd400f99c3346be74f
100 - 未知 - Process: ekrn.exe [Eset Service] - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe - d5d4124827086ba54f6bfe75ce330531
100 - 未知 - Process: EvtEng.exe [Intel(R) PROSet/Wireless Event Log Service] - C:\Program Files\Intel\WiFi\bin\EvtEng.exe - 53cca6b4df0977074e85c9a18f42b5cc
100 - 未知 - Process: LMS.exe [Local Manageability Service] - C:\Program Files\Intel\AMT\LMS.exe - dfcdb6c952e0394a6d7e4efbcc916839
100 - 未知 - Process: RegSrvc.exe [Intel(R) PROSet/Wireless Registry Service] - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe - 7c4391419852dfc331f6af620c33af3c
100 - 未知 - Process: tvt_reg_monitor_svc.exe [ThinkVantage Registry Monitor Service] - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe - 9626746a9b120d2ed537dd8d76278405
100 - 未知 - Process: tvtsched.exe [ThinkVantage Scheduler] - C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe - e9ea448f1174be4052416b62263ea4ee
100 - 未知 - Process: UNS.exe [User Notification Service] - C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe - e8564b679636adce737c15de80cd3b53
100 - 未知 - Process: PWMDBSVC.exe [PWMDBSVC Module] - C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE - f854c9ee0bb20073614cf546e5b59e8a
100 - 未知 - Process: SUService.exe [ThinkVantage System Update Service] - C:\Program Files\Lenovo\System Update\SUService.exe - ecc419e6ac1fe8ea5f9e792d2c9b1737
100 - 未知 - Process: btwdins.exe [Bluetooth Support Server] - C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe - 3189011e06be80f56b9f9b45f4595e49
100 - 未知 - Process: egui.exe [Eset GUI] - C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe - 96d4ecd27feef7f5f23a8518eee2f591
100 - 未知 - Process: PrivacyIconClient.exe [Intel(R) Management and Security] - C:\Program Files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe - 385e1c37b0c8badeb83e32cf30f1308a
100 - 未知 - Process: TPOSDSVC.exe [On screen display message generator for ThinkPad] - C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe - 25c0acc7e241b6e9687f1f9f933ba7c6
100 - 未知 - Process: TPONSCR.exe [On screen display drawer] - C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe - 30ef15afe2d5df5ed18bb54995440572
100 - 未知 - Process: TpScrex.exe [ThinkPad UltraZoom] - C:\Program Files\Lenovo\Zoom\TpScrex.exe - d30c5e95ec578f1b18c22ebba6701d11
100 - 未知 - Process: LPMGR.EXE [ThinkVantage Productivity Center Manager] - C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe - e081ffe1890c1f523ea375500bf0a3b9
100 - 未知 - Process: LPMLCHK.EXE [ThinkVantage Productivity Center MailChecker] - C:\PROGRA~1\THINKV~1\PrdCtr\LPMLCHK.exe - 0fe121ef4e7ea2132cbc283c662f2425
100 - 未知 - Process: scheduler_proxy.exe [scheduler_proxy Application] - C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe - 58c27ebbbeb67a26484a1c50909c002c
100 - 未知 - Process: LiveUpdate360.exe [360升级加速器] -  - 49934743eb55d3e0ee5ff9acb1ded7b1
100 - 未知 - Process: TXPlatform.exe [Tencent Instant Messaging Platform] - C:\Program Files\Tencent\QQ\TXPlatform.exe - 2dafaa1627a01627f88790e8984b36a6
100 - 未知 - Process: Thunder.exe [Thunder] - C:\Program Files\Thunder Network\Thunder\Program\Thunder.exe - b27147d4014b454e00ca573eac554ab2
100 - 未知 - Process: ThunderMinisite.exe [ThunderMinisite] - C:\Program Files\Thunder Network\Thunder\Components\InMedia\ThunderMinisite.exe - d512372447729c5c1090b9be568e0bf2
O2 - 未知 - BHO: (ThunderAtOnce Class) - [TDAtOnce] - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll
O2 - 未知 - BHO: (Adobe PDF Link Helper) - [Adobe PDF Helper for Internet Explorer] - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - 未知 - HKLM\..\Run: [egui] [Eset GUI] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - 未知 - HKLM\..\Run: [FingerPrintSoftware] [] "C:\Program Files\Lenovo Fingerprint Software\fpapp.exe" \s
O4 - 未知 - HKLM\..\Run: [picon] [Intel(R) Management and Security] "C:\Program Files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe" -startup
O4 - 未知 - HKLM\..\Run: [PWRMGRTR] [ThinkPad Power Manager Background Monitor and Tray Battery Gauge] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - 未知 - HKLM\..\Run: [BLOG] [] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - 未知 - HKLM\..\Run: [LPMailChecker] [ThinkVantage Productivity Center MailChecker] C:\PROGRA~1\THINKV~1\PrdCtr\LPMLCHK.exe
O4 - 未知 - HKLM\..\Run: [TVT Scheduler Proxy] [scheduler_proxy Application] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
O4 - 未知 - HKLM\..\Run: [StartCCC] [Catalyst? Control Center Launcher] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O8 - 未知 - Extra context menu item: 使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - 未知 - Extra context menu item: 使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - 未知 - Extra context menu item: 发送到 Bluetooth - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O8 - 未知 - Extra context menu item: 发送到 Bluetooth 设备(&B)... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
O8 - 未知 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - 未知 - Extra context menu item: 转换为现有 PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - 未知 - Extra context menu item: 转换选定的链接为 Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - 未知 - Extra context menu item: 转换选定的链接为现有 PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - 未知 - Extra context menu item: 转换选项为 Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - 未知 - Extra context menu item: 转换选项为现有 PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - 未知 - Extra context menu item: 转换链接目标为 Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - 未知 - Extra context menu item: 转换链接目标为现有 PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - 未知 - Extra button: 信息检索(HKLM) - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - 未知 - Extra button: @btrez.dll,-12650(HKLM) - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O9 - 未知 - Extra button: @xpsp3res.dll,-20001(HKLM) - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O15 - 未知 - Trusted Zone: https://mybank.icbc.com.cn
O15 - 未知 - Trusted Zone: http://www.icbc.com.cn
O16 - 未知 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (EditCtrl) - https://img.alipay.com/download/2121/aliedit.cab
O16 - 未知 - DPF: 无效的CLSID：{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} ({8FFBE65D-2C9C-4669-84BD-5829DC0B603C}) - http://fpdownload.macromedia.com ... rrent/ultrashim.cab
O22 - 未知 - Filename Extention: .scr - "C:\WINDOWS\notepad.exe" "%1"
O23 - 未知 - Service: acs [Gives access to single sign on and a mechanism to communicate with the supplicant for security negotiation.] - C:\WINDOWS\system32\acs.exe - (running)
O23 - 未知 - Service: ATService [Provides applications with access to AuthenTec fingerprint sensors.] - C:\WINDOWS\system32\AtService.exe - (running)
O23 - 未知 - Service: btwdins [处理 Bluetooth 设备的安装和删除。] - C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe - (running)
O23 - 未知 - Service: ccosm [Contrl Center of Storm Media] - C:\Program Files\StormII\stormliv.exe /asservice - (running)
O23 - 未知 - Service: EhttpSrv [Eset HTTP Server] - "C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe" - (not running)
O23 - 未知 - Service: ekrn [Eset Service] - "C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe" - (running)
O23 - 未知 - Service: EvtEng [Manages the event trace messages for all the Intel? PROSet/Wireless Software components.] - C:\Program Files\Intel\WiFi\bin\EvtEng.exe - (running)
O23 - 未知 - Service: FingerprintServer [AuthenTec Biometric Software Fingerprint Server] - C:\WINDOWS\system32\FpLogonServ.exe - (running)
O23 - 未知 - Service: idsvc [Securely enables the creation, management, and disclosure of digital identities.] - "c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe" - (error)
O23 - 未知 - Service: LMS [Intel(R) Active Management Technology Local Management Service - Allows applications to access the local Intel(R) Active Management Technology using its locally-available SOAP interfaces.] - C:\Program Files\Intel\AMT\LMS.exe - (running)
O23 - 未知 - Service: NetTcpPortSharing [Provides ability to share TCP ports over the net.tcp protocol.] - "c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe" - (not running)
O23 - 未知 - Service: Power Manager DBC Service [Power Manager DBC Service] - C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE - (running)
O23 - 未知 - Service: RegSrvc [Provides registry access to all Intel? PROSet/Wireless Software components] - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe - (running)
O23 - 未知 - Service: S24EventMonitor [Wireless Management Service for Intel(R) PROSet/Wireless WiFi Software] - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe - (running)
O23 - 未知 - Service: SUService [ThinkVantage System Update] - "C:\Program Files\Lenovo\System Update\SUService.exe" - (running)
O23 - 未知 - Service: ThinkVantage Registry Monitor Service [ThinkVantage Registry Monitor Service] - "C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe" - (running)
O23 - 未知 - Service: TVT Scheduler [TVT Scheduler] - "C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe" - (running)
O23 - 未知 - Service: UNS [Intel(R) Active Management Technology User Notification Service - Updates the Windows Event Log with notifications of pre defined events received from the local Intel(R) Active Management Technology Device.] - C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe - (running)

=======================================

100 - 安全 - Process: smss.exe [进程为会话管理子系统用以初始化系统变量，ms-dos驱动名称类似lpt1以及com，调用win32壳子系统和运行在windows登陆过程。] - C:\WINDOWS\System32\smss.exe - 6129c73d0a6402008f7695ddc7b683e2
100 - 安全 - Process: csrss.exe [客户端服务子系统，用以控制windows图形相关子系统。] - C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=base - fea5c15e63790770b1e8216a7d64d90d
100 - 安全 - Process: winlogon.exe [windows nt用户登陆程序。] - C:\WINDOWS\system32\winlogon.exe - c10d631b1d60635545a05c5b3556c68d
100 - 安全 - Process: services.exe [用于管理windows服务系统进程。] - C:\WINDOWS\system32\services.exe - 803423c13395019f2dd004ff5a3c0290
100 - 安全 - Process: lsass.exe [本地安全权限服务控制windows安全机制。] - C:\WINDOWS\system32\lsass.exe - bc16a35900d8abdbce0d87e9fcf21f65
100 - 安全 - Process: ibmpmsvc.exe [ibm笔记本电源管理相关软件。] - C:\WINDOWS\system32\ibmpmsvc.exe - baf38fd0cd7a3f0ded23eaca3eec4751
100 - 安全 - Process: ati2evxx.exe [ati显卡相关后台程序。] - C:\WINDOWS\system32\Ati2evxx.exe - 838b66554a9f896be6bc6e036925340e
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost -k DcomLaunch - e31fb4f13f5949b868c117714bb44375
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost -k rpcss - e31fb4f13f5949b868c117714bb44375
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\System32\svchost.exe -k netsvcs - e31fb4f13f5949b868c117714bb44375
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost.exe -k NetworkService - e31fb4f13f5949b868c117714bb44375
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost.exe -k LocalService - e31fb4f13f5949b868c117714bb44375
100 - 安全 - Process: ati2evxx.exe [ati显卡相关后台程序。] - C:\WINDOWS\system32\Ati2evxx.exe - 838b66554a9f896be6bc6e036925340e
100 - 安全 - Process: spoolsv.exe [windows打印任务控制程序，用以打印机就绪。] - C:\WINDOWS\system32\spoolsv.exe - 6475496dea6eae2046e15cf422c205fa
100 - 安全 - Process: scardsvr.exe [对插入在计算机智能卡阅读器中的智能卡进行管理和访问控制。] - C:\WINDOWS\System32\SCardSvr.exe - e4523f1a50923c745021ab7fe6b4faf4
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost.exe -k LocalService - e31fb4f13f5949b868c117714bb44375
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost.exe -k bthsvcs - e31fb4f13f5949b868c117714bb44375
100 - 安全 - Process: CDAC11BA.EXE [macrovision公司的版权保护软件，用于保护一些软件不被非法拷贝复制。] - C:\WINDOWS\system32\drivers\CDAC11BA.EXE - 9bdbda21d3ba8e374fd06a405be10215
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost.exe -k imgsvc - e31fb4f13f5949b868c117714bb44375
100 - 安全 - Process: TPHDEXLG.exe [ibm公司出品的硬盘自动保护(active protection system)软件。] - C:\WINDOWS\System32\TPHDEXLG.exe - 51b679f627a43a25ef9444ad23bbff9a
100 - 安全 - Process: explorer.exe [windows program manager或者windows explorer用于控制windows图形shell，包括开始菜单、任务栏，桌面和文件管理。] - C:\WINDOWS\Explorer.EXE - 9eb867933136ad37eaf7f2ecb97e3a4d
100 - 安全 - Process: alg.exe [这是一个应用层网关服务用于网络共享。] - C:\WINDOWS\System32\alg.exe - f031c127d798e1549861317064066287
100 - 安全 - Process: wmiprvse.exe [wmi 提供程序 (wmi provider) 在 wmi 和操作系统、应用程序以及其他系统的组件之间充当中介.此进程为合法的系统进程。] - C:\WINDOWS\system32\wbem\wmiprvse.exe - f520ab392d58c0a1070268032d809382
100 - 安全 - Process: rundll32.exe [windows rundll32为了需要调用dlls的程序。] - C:\WINDOWS\system32\rundll32.exe - a5dd94434c702493d4577e966134b303
100 - 安全 - Process: 360tray.exe [360安全卫士实时监控程序。] -  - f236fe5648f906505ebe1ab0105e5e29
100 - 安全 - Process: TpShocks.exe [ibm笔记本电脑相关驱动程序。] - C:\WINDOWS\system32\TpShocks.exe - 4f2988d81ba6b069991b012f2df4ce57
100 - 安全 - Process: rundll32.exe [windows rundll32为了需要调用dlls的程序。] - C:\WINDOWS\system32\rundll32.exe - a5dd94434c702493d4577e966134b303
100 - 安全 - Process: SynTPLpr.exe [触摸板相关程序。] - C:\Program Files\Synaptics\SynTP\SynTPLpr.exe - ead2ccc0f427da355e85e3263c628ef6
100 - 安全 - Process: SynTPEnh.exe [美国新思公司出版的触摸板驱动程序的一部分。] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe - 49e9b2d790163fea86e0fab1c0a2aabc
100 - 安全 - Process: ctfmon.exe [office xp输入法图标。] - C:\WINDOWS\system32\ctfmon.exe - 9339a79fa7d415dc39cf021880af7992
100 - 安全 - Process: QQ.exe [腾讯公司出品的qq即时通讯软件。] - C:\Program Files\Tencent\QQ\QQ.exe - cdbf64038edd93c1dc92d53d5b8c2e5d
100 - 安全 - Process: iexplore.exe [microsoft internet explorer浏览器用于浏览网页。] - C:\Program Files\Internet Explorer\iexplore.exe - 030d78fe84a086ed376efcbd2d72c522
100 - 安全 - Process: WinRAR.exe [一款解压缩软件，支持.rar和.zip等格式。] - C:\Program Files\WinRAR\WinRAR.exe - 612d29e2ede43ecfd6a6537ef93fb10a
100 - 安全 - Process: cmdCheckTools.exe [] - R:\TEMP\Rar$EX00.547\cmdCheckTools.exe - 31343765396335396635303734336664
100 - 安全 - Process: conime.exe [console ime ime输入法控制台软件。] - C:\WINDOWS\system32\conime.exe - d613fe3b6dccb7ba114c8d81337108e1
R0 - 安全 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page=http://go.microsoft.com/fwlink/?LinkId=69157
R0 - 安全 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page=http://go.microsoft.com/fwlink/?LinkId=54896
R0 - 安全 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL=http://go.microsoft.com/fwlink/?LinkId=69157
R0 - 安全 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL=http://go.microsoft.com/fwlink/?LinkId=54896
R1 - 安全 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\system32\blank.htm
R1 - 安全 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\system32\blank.htm
O2 - 安全 - BHO: (Thunder Browser Helper) - [迅雷附带下载监视器相关文件。] - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll
O4 - 安全 - HKLM\..\Run: [TrackPointSrv] [ibm笔记本的应用程序。] C:\Program Files\Lenovo\TrackPoint\tp4serv.exe
O4 - 安全 - HKLM\..\Run: [BluetoothAuthenticationAgent] [蓝牙相关程序。] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - 安全 - HKLM\..\Run: [360Safetray] [360safe实时保护功能模块。] C:\Program Files\360safe\safemon\360Tray.exe /start
O4 - 安全 - HKLM\..\Run: [TpShocks] [ibm笔记本电脑相关驱动程序。] TpShocks.exe
O4 - 安全 - HKLM\..\Run: [TPHOTKEY] [ibm thinkpad笔记本应用程序。] C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
O4 - 安全 - HKLM\..\Run: [SynTPLpr] [新思手写板，多用于各种笔记本触摸板驱动程序设置] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - 安全 - HKLM\..\Run: [SynTPEnh] [新思手写板，多用于各种笔记本触摸板驱动程序设置] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - 安全 - HKLM\..\Run: [LPManager] [ibm笔记本电脑相关程序。] C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe
O4 - 安全 - HKLM\..\Run: [Persistence] [Intel用户界面模块程序。] C:\WINDOWS\system32\igfxpers.exe
O4 - 安全 - HKCU\..\Run: [ctfmon.exe] [office xp输入法图标。] C:\WINDOWS\system32\ctfmon.exe
O8 - 安全 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - 安全 - Extra button: Windows Messenger(HKLM) - C:\Program Files\Messenger\msmsgs.exe
O11 - 安全 - Options Group: International*
O18 - 安全 - Protocol: OFFICE 相关 - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
O18 - 安全 - Protocol: OFFICE 相关 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
O23 - 安全 - Service: Ati HotKey Poller [ati显卡相关后台程序。] - C:\WINDOWS\system32\Ati2evxx.exe - (running)
O23 - 安全 - Service: BthServ [蓝牙支持服务。] - C:\WINDOWS\System32\bthserv.dll - (running)
O23 - 安全 - Service: C-DillaCdaC11BA [是MacroVision safeCast反复制保护软件。该进程是一些软件为了保护其产品不被盗版而安装的。] - C:\WINDOWS\system32\drivers\CDAC11BA.EXE - (running)
O23 - 安全 - Service: IBMPMSVC [IBM笔记本电脑电源管理相关程序。 ] - C:\WINDOWS\system32\ibmpmsvc.exe - (running)
O23 - 安全 - Service: TPHDEXLGSVC [ibm笔记本电脑的主动保护系统相关程序。] - System32\TPHDEXLG.exe - (running)
O25 - 安全 - ABOUT: DesktopItemNavigationFailure - res://ieframe.dll/navcancl.htm
O25 - 安全 - ABOUT: NavigationCanceled - res://ieframe.dll/navcancl.htm
O25 - 安全 - ABOUT: NavigationFailure - res://ieframe.dll/navcancl.htm
O25 - 安全 - ABOUT: OfflineInformation - res://ieframe.dll/offcancl.htm
O25 - 安全 - ABOUT: PostNotCached - res://ieframe.dll/repost.htm

=======================================

O31 - 未知 - Notify: ATFUS - C:\WINDOWS\system32\FpWinLogonNp.dll - AuthenTec,Inc - Fingerprint Winlogon Dynamic Link Library - 3.1.25.80 - 180224 - 4f9fe9ea63536541277912da299b7ff0
O31 - 未知 - SEApproved: {42071714-76d4-11d1-8b24-00a0c9068ff3} - deskpan.dll -  -  -  - 0 -
O31 - 未知 - SEApproved: 无效的CLSID：Shell extensions for file compression -  -  -  -  - 0 -
O31 - 未知 - SEApproved: 无效的CLSID：加密上下文菜单 -  -  -  -  - 0 -
O31 - 未知 - SEApproved: {0DF44EAA-FF21-4412-828E-260A8728E7F1} -  -  -  -  - 0 -
O31 - 未知 - SEApproved: {00E7B358-F65B-4dcf-83DF-CD026B94BFD4} -  -  -  -  - 0 -
O31 - 未知 - SEApproved: {7A9D77BD-5403-11d2-8785-2E0420524153} -  -  -  -  - 0 -
O31 - 未知 - SEApproved: {B41DB860-8EE4-11D2-9906-E49FADC173CA} - C:\Program Files\WinRAR\rarext.dll - Alexander Roshal - WinRAR shell extension - 3.80.4.0 - 131584 - 3edb9c080aa1857369ee1704d018065b
O31 - 未知 - SEApproved: {5E2121EE-0300-11D4-8D3B-444553540000} - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll - Advanced Micro Devices, Inc. - AMD Desktop Control Panel - 6.14.10.2001 - 704512 - 2fd8d38608abe4c3055388525c2562bf
O31 - 未知 - SEApproved: 无效的CLSID： -  -  -  -  - 0 -
O31 - 未知 - SEApproved: {6af09ec9-b429-11d4-a1fb-0090960218cb} - C:\WINDOWS\system32\BTNEIG~1.DLL - Broadcom Corporation. - BTNeighborhood DLL - 5.5.0.4300 - 991309 - 739095b5ca5af72c17b31fcf82aa8414
O31 - 未知 - SEApproved: {7842554E-6BED-11D2-8CDB-B05550C10000} - C:\WINDOWS\system32\btncopy.dll - Broadcom Corporation. - BTNCopy Module - 5.5.0.4300 - 49152 - c0944d5176f35b0fe5fe8a17dff6347e
O31 - 未知 - SEApproved: {32020A01-506E-484D-A2A8-BE3CF17601C3} - C:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll - Alcohol Soft Development Team - AXShlEx.dll - 1.4.7.1024 - 387584 - 0c1d3ca7d2c8a48ab01dfa958e150169
O31 - 未知 - Directory Menu: {B41DB860-8EE4-11D2-9906-E49FADC173CA} - C:\Program Files\WinRAR\rarext.dll - Alexander Roshal - WinRAR shell extension - 3.80.4.0 - 131584 - 3edb9c080aa1857369ee1704d018065b
O31 - 未知 - LSA: Security Packages - sv1_0.dll -  -  -  - 0 -
O31 - 未知 - LSA: Security Packages - channel.dll -  -  -  - 0 -

=======================================

O40 - winlogon.exe - AuthenTec,Inc - C:\WINDOWS\system32\FpWinLogonNp.dll - Fingerprint Winlogon Dynamic Link Library - 4f9fe9ea63536541277912da299b7ff0
O40 - winlogon.exe -  - C:\Program Files\Lenovo Fingerprint Software\SharedResources.dll - Fingerprint Shared Resources Dynamic Link Library - 77d413c252767419ab992b7f657b50be
O40 - winlogon.exe - AuthenTec, Inc - C:\Program Files\Lenovo Fingerprint Software\FPResource.dll - Multilingual Resource Dynamic Link Library - 9fc6e3e4f246eedc0044de66d60bec8c
O40 - Explorer.EXE - Broadcom Corporation. - C:\WINDOWS\system32\btncopy.dll - BTNCopy Module - c0944d5176f35b0fe5fe8a17dff6347e
O40 - rundll32.exe - Lenovo Group Limited - C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL - ThinkPad Power Manager Background Monitor and Tray Battery Gauge - 3c4d5aacf84f4d72cb31fd94f9ffae28
O40 - rundll32.exe -  - C:\PROGRA~1\ThinkPad\UTILIT~1\SC\PWRMGRRT.DLL -  - f380a6772dc4074f0aea6c7a07577996
O40 - rundll32.exe -  - C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRIF.DLL -  - 246201898be91c4f736ae4178263a0dc
O40 - rundll32.exe - Lenovo Japan - C:\PROGRA~1\ThinkPad\UTILIT~1\ATM.DLL - ATM - a48ba32f25002426618764ff68bcc0a6

=======================================

O41 - a347bus - Plug and Play BIOS Extension - C:\WINDOWS\system32\drivers\a347bus.sys - (running) - Plug and Play BIOS Extension - - 1f61cacacb521215f39061789147968c
O41 - a347scsi - SCSI miniport - C:\WINDOWS\system32\drivers\a347scsi.sys - (running) - SCSI miniport - - 113e4b318bbaa7483ca4e582a4d63f49
O41 - CdaC15BA - Macrovision SECURITY Driver - C:\WINDOWS\system32\drivers\CDAC15BA.SYS - (running) - Macrovision SECURITY Driver - Macrovision Europe Ltd - f76cb7259aa575cc53f3996bc6b68c18
O41 - pfc - Padus(R) ASPI Shell - C:\WINDOWS\system32\drivers\pfc.sys - (running) - Padus(R) ASPI Shell - Padus, Inc. - 5903fa75200807ad739286bbf40c4904
O41 - RRamdisk - Ramdisk Driver for win2k/xp/2k3 - C:\WINDOWS\system32\drivers\rramdisk.sys - (running) - Ramdisk Driver for win2k/xp/2k3 - gavotte - 3762a37c7ddd4afce6bd75aef790a920
O41 - TPPWRIF - TPPWRIF - C:\WINDOWS\system32\drivers\TPPWRIF.SYS - (running) -  -  - 44672de6cea9569c21c4b7a8d2560750
O41 - TSMAPIP - TSMAPIP - C:\WINDOWS\system32\drivers\TSMAPIP.SYS - (running) -  -  - f2aba3066d7921d7fcdbd66dea88be11

=======================================
[userinit.exe情况]
MD5: 431fed77e71b1831cd485890159d467c
文件大小: 25088
版本信息: 5.1.2600.5512 (xpsp.080413-2113)
是否签名: 是
未被感染

=======================================
[URL历史情况]

http://update.360safe.com/safe/safeup.cab?type=tray&m=61c1e7f5cd14e840d9340aeba5918d81&protect=11,21,31,41,51,60,71&t=303156&ver=5.1.1.1003
http://update.360safe.com/safe/urlini.cab?m=61c1e7f5cd14e840d9340aeba5918d81&t=364953&ver=5.1.1.1003
http://update.360safe.com/safe/urlini.cab?m=61c1e7f5cd14e840d9340aeba5918d81&t=199656&ver=5.1.1.1003
http://update.360safe.com/safe/safeup.cab?m=61c1e7f5cd14e840d9340aeba5918d81&t=203140&ver=5.1.1.1003
http://updatem.360safe.com/safe/safeupm.cab?type=tray&m=61c1e7f5cd14e840d9340aeba5918d81&t=78640&ver=5.1.1.1003
http://update.360safe.com/safe/safeup.cab?m=61c1e7f5cd14e840d9340aeba5918d81&t=138140&ver=5.1.1.1003
http://update.360safe.com/safe/safeup.cab?type=tray&m=61c1e7f5cd14e840d9340aeba5918d81&protect=11,21,31,41,51,60,71&t=88156&ver=5.1.1.1003
http://update.360safe.com/safe/safeup.cab?m=61c1e7f5cd14e840d9340aeba5918d81&t=368156&ver=5.1.1.1003
http://updatem.360safe.com/safe/safeupm.cab?type=tray&m=61c1e7f5cd14e840d9340aeba5918d81&t=293140&ver=5.1.1.1003
http://update.360safe.com/safe/urlini.cab?m=61c1e7f5cd14e840d9340aeba5918d81&t=83140&ver=5.1.1.1003
http://update.360safe.com/safe/urlini.cab?m=61c1e7f5cd14e840d9340aeba5918d81&t=137578&ver=5.1.1.1003
http://update.360safe.com/safe/urlini.cab?m=61c1e7f5cd14e840d9340aeba5918d81&t=298140&ver=5.1.1.1003

复制代码

=======================================

808f2e5c7be49fe7068d5b4fbc969491

作者: 温特斯 时间: 2009-7-25 10:59
提示: 作者被禁止或删除内容自动屏蔽

作者: 红尘づ泪 时间: 2009-7-25 11:04

你确定不是主板电池没有电？
温特斯发表于 2009-7-25 10:59

不是,查毒可以查出a.exe啊什么的
但是每次重新启动后又有,而且系统时间也不是开机就改,要开机一会

作者: srggggg 时间: 2009-7-25 11:08
提示: 作者被禁止或删除内容自动屏蔽

作者: AJMAX 时间: 2009-7-25 11:09
格了他

作者: 红尘づ泪 时间: 2009-7-25 11:10

格式化，重装系统，万能方
srggggg 发表于 2009-7-25 11:08

有其他办法没啊
不想重装

作者: cart200501 时间: 2009-7-25 11:14
和谐。。

作者: 红尘づ泪 时间: 2009-7-25 11:31
手动改回来后用NOD32查了个smss.exe然后把它杀了
重新启动到现在,系统时间暂时没被修改,不晓得搞好没

作者: 姐夫戏小姨 时间: 2009-7-25 11:34
AV病毒就像艾滋病毒一样无药可救

作者: 红尘づ泪 时间: 2009-7-25 11:55

AV病毒就像艾滋病毒一样无药可救
姐夫戏小姨发表于 2009-7-25 11:34

-_-;;

欢迎光临八达网 (https://www.8-da.com/)