本人用上面论坛的方法也没有卸载掉酷桌面。。。现在发现进程里有spoolsv。。。。我怀疑电脑里有spoolsv病毒。便用网上的方法,新建一个txt文件。命名为spoolsv.exe。。粘贴到c:/windows/system32/spoolsv文件夹中。。但其实我并没有在文件夹中找到spoolsv.exe.
但是我的cpu占用率很正常。。。很郁闷。往高手指点之。。。。
下面是 我用论坛上的方法清理后的日志,请高手帮忙。。。。还有c:/windows/system32/media/update删除不掉。。。。也找不到coolbho.dll...
Logfile of HijackThis v1.99.1
Scan saved at 10:00:12, on 2006-8-20
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\Explorer.EXE
C:\windows\SOUNDMAN.EXE
D:\Program Files\SkyNet\FireWall\PFW.exe
D:\Program Files\ewido anti-spyware 4.0\ewido.exe
D:\Program Files\NavNT\vptray.exe
C:\windows\system32\ctfmon.exe
D:\Program Files\NavNT\defwatch.exe
D:\Program Files\ewido anti-spyware 4.0\guard.exe
D:\Program Files\NavNT\rtvscan.exe
C:\windows\system32\MsgSys.EXE
C:\windows\system32\svchost.exe
D:\Program Files\Windows 流氓软件清理大师\clean.exe
C:\windows\system32\conime.exe
D:\Program Files\Windows 流氓软件清理大师\iehelp.exe
C:\Program Files\Super Rabbit\MagicSet\MagicSet.exe
D:\Program Files\Tencent\QQ\QQ.exe
D:\Program Files\Tencent\QQ\TIMPlatform.exe
D:\Program Files\Maxthon\Maxthon.exe
D:\新建文件夹\ha_hijackthis_1991\HijackThis.exe
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\windows\Media\update.exe,C:\windows\SYSTEM32\Userinit.exe,
O2 - BHO: MyIEHelper Class - {16B770A0-0E87-4278-B748-2460D64A8386} - C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\IEHelper_4738.dll (file missing)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SKYNET Personal FireWall] D:\Program Files\SkyNet\FireWall\PFW.exe
O4 - HKLM\..\Run: [!ewido] "D:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [vptray] D:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [PHIME2002A] ; ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [PHIME2002ASync] ; ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [spoolsv] C:\windows\system32\spoolsv\spoolsv.exe -printer
O4 - HKLM\..\RunOnce: [ANetFox ADClean] "D:\Program Files\Windows 流氓软件清理大师\clean.exe" /autokill:88,81
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O8 - Extra context menu item: &使用迅雷下载 - D:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - D:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Program Files\Tencent\QQ\SendMMS.htm
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/
O17 - HKLM\System\CCS\Services\Tcpip\..\{E47F34E9-4D44-47E8-A7E6-69F9F293694D}: NameServer = 61.233.65.3 211.98.192.3
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: DefWatch - Symantec Corporation - D:\Program Files\NavNT\defwatch.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - D:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus 客户端 (Norton AntiVirus Server) - Symantec Corporation - D:\Program Files\NavNT\rtvscan.exe
O23 - Service: Print Spooler (Spooler) - Unknown owner - C:\windows\system32\spoolsv.exe (file missing)
