 鲜花( 1)  鸡蛋( 0)
|
楼主 |
发表于 2006-5-5 16:59
|
显示全部楼层
Logfile of HijackThis v1.99.14 ^1 s4 z2 h ~. d. W
Scan saved at 16:55:24, on 2006-5-6
! N8 ~: @/ G2 f' {' A0 GPlatform: Windows XP SP2 (WinNT 5.01.2600)
" o0 U2 E, J7 V9 L6 V& q; V7 aMSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* i; ~' \/ H( R( s, u
' A" _. S) t5 v2 {Running processes:8 U& { _. X2 c) _2 ?4 I* W0 r6 N2 {
C:\WINDOWS\System32\smss.exe
1 q9 H$ g+ h. n0 J, ]2 CC:\WINDOWS\system32\winlogon.exe
3 G" W" `5 Z9 K0 _, V- |4 j4 v) B6 zC:\WINDOWS\system32\services.exe
( Z; k% R0 o1 B( lC:\WINDOWS\system32\lsass.exe
, \+ s4 B0 o, k- j) |C:\Program Files\Common Files\Virtual Token\vtserver.exe
! ~: m6 j- P" T: \. _, KC:\WINDOWS\system32\ibmpmsvc.exe
; N; G! R, Y' o O6 XC:\WINDOWS\system32\svchost.exe4 o# ~% {+ O1 M/ d9 A' p
C:\WINDOWS\System32\svchost.exe+ B/ k( [: F q. E/ J8 }$ w
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe3 c6 \8 R& B8 e. |) g
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
, V7 G. N* e1 r2 Q# E* w( UC:\WINDOWS\system32\spoolsv.exe
B- I8 t7 I2 O% ^( ^+ B$ aC:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE2 g* u( M( q( D/ t
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
9 w' K7 c* X- m; |. L3 \C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe" H$ e6 P8 R! r5 P
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE6 l6 F! c9 Y A
C:\Program Files\F-Secure\Common\FSMA32.EXE; C: l" \- H9 K4 }9 o9 ?
C:\Program Files\F-Secure\Common\FSMB32.EXE: o. S# f) ]# w3 r% G$ }' S. k& I
C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe8 {9 l$ ?; K; _) w
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe- Z) j, Q* \# N: q! s; r
C:\WINDOWS\System32\QCONSVC.EXE
. j {- _; M6 @C:\Program Files\F-Secure\Common\FCH32.EXE( e% ~3 s6 e) ?/ e" L7 A; R/ t
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
/ ?2 u& y& G& h1 i# {) DC:\Program Files\Analog Devices\SoundMAX\SMAgent.exe' x9 _7 {) k4 {7 L' N- r$ @0 h
C:\WINDOWS\System32\TPHDEXLG.EXE
: s: A7 l2 M- JC:\Program Files\F-Secure\Common\FAMEH32.EXE: q. K4 V6 q) F9 x' m, M \% B
C:\WINDOWS\system32\TpKmpSVC.exe) e/ w0 Z* I* S6 l8 Z q
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe0 q' q3 v- u' t( H; x
C:\Program Files\F-Secure\Anti-Virus\fsrw.exe* p$ t3 }0 Q6 d2 U. y8 x; M: c
C:\Program Files\F-Secure\Common\FNRB32.EXE* e# ^2 c' I4 M
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
; W. Y- W6 Y# Q7 I: O: }1 vC:\Program Files\F-Secure\Common\FIH32.EXE
2 F+ e1 j, N! _* YC:\Program Files\F-Secure\Anti-Virus\fsav32.exe
- E; W% j" A0 h! m7 vC:\WINDOWS\Explorer.EXE
6 ~, s# d: O( w* z( c% x3 LC:\Program Files\Synaptics\SynTP\SynTPLpr.exe N! ?. k+ v4 O$ {8 _7 [6 _# v
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe6 W; B$ j0 c( [2 w
C:\WINDOWS\system32\hkcmd.exe
! ^/ F' K# W3 c! g2 A& ]C:\WINDOWS\system32\TpShocks.exe
; ^8 i) U. F! IC:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe6 n, G, w: R1 s) v
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe) Y2 K" N% m* f8 m, e C
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
0 f% }, o1 f \7 p8 J# _- MC:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe6 b! H$ t5 Q6 j6 N
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe, I6 H |5 q, d6 O2 T
C:\WINDOWS\system32\dla\tfswctrl.exe
5 c3 G: P5 K* s* g! s4 j: HC:\Program Files\IBM\Messages By IBM\ibmmessages.exe5 r# i Z; w2 V7 ?* X( B; C/ _
C:\IBMTOOLS\UTILS\ibmprc.exe
8 E& y2 J1 @( b. ~! x* VC:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE! ]) C6 `4 m$ R0 l+ X
C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
: l# J |- P$ E' kC:\WINDOWS\System32\svchost.exe
5 [3 b: J3 H7 A" l0 SC:\WINDOWS\system32\rundll32.exe
( [7 ]* A% z% r3 v, j- J9 lC:\Program Files\F-Secure\Common\FSM32.EXE
' h3 _( H( w! Q8 V1 E2 L5 |C:\WINDOWS\system32\CTFMON.EXE7 I3 w* {% o3 j
C:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
! m/ k; l e2 v4 }; z/ R( o( ]C:\Program Files\Digital Line Detect\DLG.exe
- M0 O) Z: C4 r9 QC:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe5 `& Q9 J/ Z& A4 _
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
, C, Q/ k, h% zC:\Program Files\Messenger\msmsgs.exe
1 a$ c% @) R* M# J! {5 u nC:\Program Files\Internet Explorer\iexplore.exe
9 J. _( u/ V8 v3 O$ i8 D5 Z+ UC:\DOCUME~1\SHIXIN~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe3 z$ d0 l9 n7 X8 M$ u- M, j
1 r1 C H$ `6 Z0 s
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
% S7 f# M) [, r: XO4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe7 w) Q$ M# Z' E0 Y2 R+ K; c
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
- r; ^) F% U. v6 f# X) U8 o3 I% MO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
( y+ F6 R7 F% {1 z( e0 J! g8 RO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe3 \+ a, A6 M% D$ D6 g
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper7 m1 m) ^9 T3 n" g4 F% [/ @& d. V
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe( _9 A2 C0 g6 `) H
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe- ^; X) q8 \; v
O4 - HKLM\..\Run: [ControlCenter] "C:\Program Files\IBM fingerprint software\ctlcntr.exe" /startup
7 R# g. z- V% |4 JO4 - HKLM\..\Run: [TP4EX] tp4ex.exe3 s$ x1 P8 \, h6 M6 \9 b, P
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
9 Y' D' |) L( k a5 D5 eO4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
- R* I9 S. K; fO4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
6 M/ u6 |# S) @1 L! Y, Y$ aO4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
" K. X0 x8 x# A6 D4 A& eO4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
: C( I, l2 n) NO4 - HKLM\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\\ibmmessages.exe
1 j' `( C* X$ u' X7 @O4 - HKLM\..\Run: [IBMPRC] C:\IBMTOOLS\UTILS\ibmprc.exe
3 ?* Z9 Q* k# [* j7 R/ gO4 - HKLM\..\Run: [QCTRAY] C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE9 ~4 B; n( m/ n: \: [( f
O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
, I4 i5 F7 H' M" `1 e1 D7 LO4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor0 @( W1 J6 m; T; H3 w
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
: `7 O [% @7 Q4 DO4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
$ _9 |& x7 Y( I8 y$ g( E2 Z. l7 qO4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE* B2 P; p+ w0 Y5 {7 ^
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC; D5 Y t* K9 a6 |% r# e
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC4 E" O8 r2 w) z: { |! L
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
# g5 C6 e% a; l9 C; R1 OO4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash7 A: h, l6 ~4 M \% H: x( m
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW" x7 {2 I' j! V1 Q, k
O4 - HKCU\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe, K, C- c% d7 Z' {: N6 Y& H, k: ?
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
4 k% U5 Q/ p- n$ R3 \O4 - Global Startup: Digital Line Detect.lnk = ?4 t7 o( N R! p6 `' Z
O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
, P+ J9 e& e u9 s6 f0 v+ NO8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm0 x; E- b, ]5 _3 M+ H l5 n# a
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java142\jre\bin\NPJPI142.dll
& n) j+ d6 D0 r4 SO9 - Extra 'Tools' menuitem: IBM Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java142\jre\bin\NPJPI142.dll: b& y: r$ K3 {# g0 h5 ^/ Q2 P$ H
O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll/ ~% c; b( e' }* M
O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll7 x# C/ r$ p. h; l' }+ P
O9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\Lenovo\PkgMgr\\PkgMgr.exe- Q" P0 {' B- [" a$ o; W
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe4 R: d& i* Q/ M- E" a' ]1 |
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe1 v" `% l" X" H6 m/ Z
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll1 `* L5 y8 n% \7 M3 t1 N. k0 h
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
8 Q$ @. c9 z2 D/ h! V3 nO10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll/ f+ I% J& @! e% v
O11 - Options group: [JAVA_IBM] Java (IBM)
& N( ^; O+ x2 NO20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
( n( O: o. g$ [9 q$ Z1 n: HO20 - Winlogon Notify: psfus - C:\Program Files\IBM fingerprint software\psfus.dll
$ y; c( f" r& eO20 - Winlogon Notify: QConGina - C:\WINDOWS\SYSTEM32\QConGina.dll9 [( N1 R C& i" |, \ F
O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
: f6 e. p1 C7 u+ w5 Q1 X1 \- kO23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE" C3 }; x8 t9 m/ [- y6 s
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe& |" b$ N! D% e/ ]# e
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe3 @6 d* O5 ]" ]
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE2 F: I$ h, s& X1 Y1 C$ ^1 D
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
7 p3 S9 f4 W7 ~+ E- ]; b- ] JO23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe' k" j: O4 Y ^9 n# |
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE8 _2 v) v5 F |- V8 a! _1 a. M
O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe0 N" m0 P1 X( o0 I1 O: w1 s
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
; y$ F$ [- E2 [- q* `% C: zO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe) L7 }/ {8 F5 {2 Z G/ Q
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
0 b6 H! E- K& K! S1 `9 bO23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE) I% Z8 P+ ~8 n' V# w
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe/ q; m d. o2 v. c
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
. ] B3 \8 B) L% Q, Y8 [; |5 EO23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
" G* T2 c9 w8 v( [$ [; WO23 - Service: IBM HDD APS Logging Service (TPHDEXLGSVC) - IBM Corporation - C:\WINDOWS\System32\TPHDEXLG.EXE( P, k5 z; Q3 M O
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
- v. q; y' \! ~O23 - Service: Protector Suite Virtual Token (vtserver) - UPEK Inc. - C:\Program Files\Common Files\Virtual Token\vtserver.exe |
|
楼主: 九月
狗仔卡
发表于 2006-5-5 13:40
显身卡
