日志文件 Trend Micro HijackThis v 2.0.2
日志保存时间: 21:19:56,2010-11-17
操作系统: Windows XP SP3 (WinNT 5.01.2600)
IE版本: Internet Explorer v4.08 (4.08.0000.0985)
启动模式: 正常
正在运行的进程:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
d:\Program Files\360\360Safe\deepscan\zhudongfangyu.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
C:\Program Files\ASUS\ATK Hotkey\HControl.exe
D:\Program Files\360\360Safe\safemon\360Tray.exe
C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe
C:\Program Files\ASUS\ATK Hotkey\WDC.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Program Files\360\360sd\360sd.exe
C:\WINDOWS\System32\WScript.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
D:\Program Files\Tencent\QQ\bin\qq.exe
C:\WINDOWS\system32\conime.exe
D:\Program Files\Tencent\QQ\Bin\TXPlatform.exe
D:\Program Files\TTPlayer\TTPlayer.exe
D:\Program Files\Tencent\TT\bin\TTraveler.exe
D:\Program Files\Tencent\QQ\Plugin\Com.Tencent.QQMusic\bin\QQMusic\QzoneMusic.exe
D:\Program Files\KuGou\KuGou2010\KuGoo.exe
D:\Program Files\KuGou\KuGou2010\kgdaemon.exe
D:\Program Files\Thunder Network\Thunder\Program\Thunder.exe
c:\program files\common files\thunder network\tp\ver1\1.1.2.33_1110\thunderplatform.exe
C:\WINDOWS\explorer.exe
E:\TDDOWNLOAD\System Repair Engineer\SREngLdr.EXE
E:\TDDOWNLOAD\System Repair Engineer\SRE4dbccd01.EXE
C:\WINDOWS\system32\wuauclt.exe
E:\TDDOWNLOAD\HijackThis 汉化版\HijackThis.exe
O2 - BHO: PIPI Link Helper - {1A3440C6-F123-4CAB-84EE-C814E1AE0D8F} - C:\Program Files\pipi\JfCheck.dll
O2 - BHO: xiamistart Class - {658D2C4F-158A-46FB-8C96-B1C8F56DBBE9} - D:\PROGRA~1\Shark\XIAMIP~1.DLL
O2 - BHO: XunleiBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - D:\Program Files\Thunder Network\Thunder\BHO\XunleiBHO7.1.0.1962.dll
O2 - BHO: FlashGetBHO - {b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} - C:\Documents and Settings\Administrator\Application Data\FlashGetBHO\FlashGetBHO3.dll
O2 - BHO: SafeMon Class - {B69F34DD-F0F9-42DC-9EDD-957187DA688D} - d:\Program Files\360\360Safe\safemon\safemon.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [ATKHOTKEY] C:\Program Files\ASUS\ATK Hotkey\HControl.exe
O4 - HKLM\..\Run: [360Safetray] "D:\Program Files\360\360Safe\safemon\360Tray.exe" /start
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [360sd] "D:\Program Files\360\360sd\360sdrun.exe"
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O15 - Trusted Zone:
http://software.kuaiche.comO15 - ESC Trusted Zone:
http://*.update.microsoft.comO16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (EditCtrl Class) -
https://img.alipay.com/download/2121/aliedit.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1231141378625O16 - DPF: {7978461C-CC22-48F2-BC69-02220D3E101D} -
https://download.alipay.com/itrusenroll.cabO16 - DPF: {BCE679A7-6DF7-4F48-B3BA-A5269B60FE98} (UploaderEmbed Control) -
http://photo.163.com/photo/bin/UploaderEmbed.cabO18 - Protocol: KuGoo - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - C:\WINDOWS\system32\KuGoo3DownXControl.ocx
O18 - Protocol: KuGoo3 - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - C:\WINDOWS\system32\KuGoo3DownXControl.ocx
O23 - NT 服务: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - NT 服务: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - NT 服务: PIPIStartSvr - PIPI - C:\Program Files\pipi\PIPIStartSvr.exe
O23 - NT 服务: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - NT 服务: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - NT 服务: 主动防御 (ZhuDongFangYu) - 360.cn - d:\Program Files\360\360Safe\deepscan\zhudongfangyu.exe
--
文件结束 - 4827 字节
用户系统信息：Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; TencentTraveler 4.0)附件:
SREngLOG.log