我的一个朋友中毒了.日志如下,日志每一行后面都有杂码,是因为该网站为了防止随便复制转载加上的,不是电脑问题
病毒警报
Norton AntiVirus 已从您的计算机检测并杀除了病毒
对象名称 C:/WINDOWS/TEMP/dddupdate.exe
病毒名称 Downloader.Trojan
采取的操作 该文件已被自动删除
经常重复出现
HijackThis(zww3008汉化版)V1.99.1
保存于 21:48:14, 日期 2005-11-10
操作系统： Windows XP SP2 (WinNT 5.01.2600)
浏览器： Internet Explorer v6.00 SP2 (6.00.2900.2180)
当前运行的进程：
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVC Finger-sensing Pad Driver\FspadSvr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
D:\搜狗\P4P\p2psvr.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\keyhook.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\QBU\QkOnBtn.EXE
C:\Program Files\AVC Finger-sensing Pad Driver\fscp.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Sds.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\RUNDLL32.exe
C:\WINDOWS\system32\RUNDLL32.exe
C:\Program Files\Tencent\QQ\QQ.exe
C:\Program Files\Tencent\QQ\TIMPlatform.exe
D:\杀毒\HijackThis1991汉化版\HijackThis1991zww.exe
R3 - URLSearchHook: MyURLSearchHook Class - {982CB676-38F0-4D9A-BB72-D9371ABE876E} - D:\搜狗\P4P\ToolBar.dll 褾 儩???
O2 - BHO: Tencent Browser Helper - {0C7C23EF-A848-485B-873C-0ED954731014} - C:\WINDOWS\Downloaded Program Files\TBHMain.dll y?窝S狨F?
O2 - BHO: SohuDAIEHelper - {0CA51D02-7739-43EA-8D9A-1E8AD4327B03} - D:\搜狗\P4P\sodaie.dll ?-:?楴
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\Program Files\Tencent\QQ\QQIEHelper.dll ?]d牔,um3
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FLASHGET\jccatch.dll 泝[o[8??
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll 穸a'_野?
O2 - BHO: IEHlprObj Class - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files\FlashBT\IEHelper.dll 倷鞰[O翏?
O3 - IE工具栏增项: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll 't EC?鴈?
O3 - IE工具栏增项: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll 0史賏i龙?
O3 - IE工具栏增项: 搜狗直通车 - {DBBB7978-AF21-4EF4-9AD1-B2F4BC75696C} - D:\搜狗\P4P\ToolBar.dll aハ?^5
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 偙,????
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC Q紭祚q?e?
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName 殒厎!9y缗p
O4 - 启动项HKLM\\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent 坯縸殱凁棧
O4 - 启动项HKLM\\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe 駿NLi虷?
O4 - 启动项HKLM\\Run: [SoundMan] SOUNDMAN.EXE @e? ??
O4 - 启动项HKLM\\Run: [AGRSMMSG] AGRSMMSG.exe 彤]?琹€
O4 - 启动项HKLM\\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe 嬊?亙??
O4 - 启动项HKLM\\Run: [QkOnBtn] C:\Program Files\QBU\QkOnBtn.EXE c?}県q粎?
O4 - 启动项HKLM\\Run: [fscp] C:\Program Files\AVC Finger-sensing Pad Driver\fscp.exe 骻攜h鎘毄
O4 - 启动项HKLM\\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload c囝?轂?
O4 - 启动项HKLM\\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" vN&狱 ?
O4 - 启动项HKLM\\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer :紏: #^?
O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot 抛Q{`H"瑻?
O4 - 启动项HKCU\\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe &銀?熶傰?
O4 - 启动项HKCU\\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background ?R戤O?
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe W紜g>?H
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe 篇0'$芉(
O8 - IE右键菜单中的新增项目： 使用搜狗直通车下载 - D:\搜狗\P4P\dl.htm ?濓吴Y?
O8 - IE右键菜单中的新增项目： 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm 鼉?橫蘢?
O8 - IE右键菜单中的新增项目： 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm 7墕0?滒洲
O8 - IE右键菜单中的新增项目： 发送图片到手机 - D:\搜狗\P4P\cx.htm ?拦諎钋W?
O8 - IE右键菜单中的新增项目： 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 碗筳黓kC骱
O8 - IE右键菜单中的新增项目： 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm 瞏?_91 ?
O8 - IE右键菜单中的新增项目： 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm ?]輦?o?
O8 - IE右键菜单中的新增项目： 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm 晑?+Z
O9 - 浏览器额外的按钮： 联想 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.lenovo.com (file missing) 监淗]h殦y?
O9 - 浏览器额外的按钮： SoQ - {8F67DCF3-B1DF-4A39-A787-3775784BF737} - http://www.soq.com (file missing) /奄`筦妴?
O9 - 浏览器额外的按钮： 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL &&pp晸器O
O9 - 浏览器额外的按钮： QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE 螊 G薥竈
O9 - 浏览器额外的“工具”菜单项： 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE 纏?悾Dk櫕
O9 - 浏览器额外的按钮： FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe 7H坵?Wk
O9 - 浏览器额外的“工具”菜单项： &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe 祇耋J灔?
O9 - 浏览器额外的按钮： (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll ?錷f邘皏8
O9 - 浏览器额外的“工具”菜单项： QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll ┧? o?
O9 - 浏览器额外的按钮： Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 8]:On
O9 - 浏览器额外的“工具”菜单项： Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe >虵锑 鮯fm
O11 - Options group: [TBH] QQ地址栏搜索 S歄4纱趗}
O14 - IERESET.INF: START_PAGE_URL=http://www.lenovo.com 鷍?輽[埋
O17 - HKLM\System\CCS\Services\Tcpip\..\{8ABAD1B7-252B-4770-874A-6AD18198D656}: NameServer = 202.96.128.166 202.96.128.86 惌=鏪X.3%?
O20 - AppInit_DLLs: C:\WINDOWS\system32\SoDAHK.DLL nv鐀獶?
O23 - NT 服务: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe @hm,E1
O23 - NT 服务: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe gV€.t緕+
O23 - NT 服务: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe ?lt;0闏梻禍
O23 - NT 服务: FspadSvc - Unknown owner - C:\Program Files\AVC Finger-sensing Pad Driver\FspadSvr.exe n麚厷窹Y?
O23 - NT 服务: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe P晳N啴#n
O23 - NT 服务: P4P Service - Sohu.com Inc. - D:\搜狗\P4P\p2psvr.exe d蝧腼0P羛
O23 - NT 服务: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe 罒G渤?lt; ?
O23 - NT 服务: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe 蓊 P莰蚯?
O23 - NT 服务: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe 痹靆EⅢ??
O23 - NT 服务: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe 愖蘍莫断
O23 - NT 服务: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe 攟|?銒?
O23 - NT 服务: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
