[求助]麻烦大家看看HIjackThis的报告有什么问题？

tingyuqian

Logfile of HijackThis v1.99.1
Scan saved at 12:25:52, on 2006-8-6
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Permeo\Security Driver\nbproxy.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\Program Files\Raxco\PerfectDisk\PDSched.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\VStart50\VStart.exe
C:\Program Files\随手贴\随手贴.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\internat.exe
C:\Program Files\FlashGet\flashget.exe
C:\Program Files\系统安全盾\sysshield.exe
C:\Program Files\Maxthon\Maxthon.exe
M:\AUTORUN.EXE
C:\Program Files\HJ\HIJACKTHIS.EXE

R3 - Default URLSearchHook is missing
O1 - Hosts: ; 0.0.0.0 cn.yahoo.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: MyIEHelper Class - {16A770A0-0E87-4278-B748-2460D64A8386} - C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\IEHelper2006223_8157.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)
O2 - BHO: std software - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - (no file)
O2 - BHO: CpapView Class - {77962960-536E-47EC-9DDB-52651519705F} - (no file)
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder\ComDlls\XunLeiBHO_002.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: (no name) - {A9930D97-9CF0-42A0-A10D-4F28836579D5} - C:\PROGRA~1\KuGoo3\KUGOO3~1.OCX
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: 电鹰工具栏 - {1BC0B497-3010-43BF-AD78-5858A70907A2} - C:\WINDOWS\system32\dytoolband.dll (file missing)
O3 - Toolbar: (no name) - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - (no file)
O3 - Toolbar: 金山快译(&K) - {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} - C:\Program Files\Kingsoft\FastAIT 2006\IEBand.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [VStart5.0] C:\Program Files\VStart50\VStart.exe
O4 - HKLM\..\Run: [随手贴] "C:\Program Files\随手贴\随手贴.EXE"                  
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Startup: 系统安全盾.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: 使用KuGoo3下载(&K) - C:\Program Files\KuGoo3\KuGoo3DownX.htm
O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: 使用迅雷下载 - C:\Program Files\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: 使用迅雷下载全部链接 - C:\Program Files\Thunder\Program\GetAllUrl.htm
O8 - Extra context menu item: 在Foxmail中添加该RSS频道/频道组 - res://C:\WINDOWS\system32\fmrsslink.dll/201
O8 - Extra context menu item: 导出到 Microsoft Excel(&x) - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: 导出当前页到超星阅览器(&A) - C:\Program Files\SSREADER37\ss_all.htm
O8 - Extra context menu item: 导出选中部分到超星阅览器(&S) - C:\Program Files\SSREADER37\ss_select.htm
O8 - Extra context menu item: 电鹰搜索 - res://C:\WINDOWS\system32\dytoolband.dll/MENUSEARCH.HTM
O8 - Extra context menu item: 转换为 Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: 转换为现有 PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: 转换选定的链接为 Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: 转换选定的链接为现有 PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: 转换选项为 Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: 转换选项为现有 PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: 转换链接目标为 Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: 转换链接目标为现有 PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O10 - Unknown file in Winsock LSP: c:\program files\permeo\security driver\s5spi.dll
O10 - Unknown file in Winsock LSP: c:\program files\permeo\security driver\s5spi.dll
O10 - Unknown file in Winsock LSP: c:\program files\permeo\security driver\s5spi.dll
O10 - Unknown file in Winsock LSP: c:\program files\permeo\security driver\s5spi.dll
O10 - Unknown file in Winsock LSP: c:\program files\permeo\security driver\s5spi.dll
O10 - Unknown file in Winsock LSP: c:\program files\permeo\security driver\s5spi.dll
O14 - IERESET.INF: START_PAGE_URL=about:blank
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/wind ... e.cab?1139673218953
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/micr ... e.cab?1151856005812
O17 - HKLM\System\CCS\Services\Tcpip\..\{A87A78A0-E74C-4225-937E-F45BC6F9A76F}: NameServer = 192.168.12.27
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Security Driver NetBT Proxy (nbproxy) - Permeo Technologies, Inc. - C:\Program Files\Permeo\Security Driver\nbproxy.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
O23 - Service: WinkldUP - Unknown owner - (no file)

以上是HIJackThis 的报告
请问各位高手有什么建议？

lxl1638

晕，没看完就晕了，太多了。我的机子正常是23个进程，需要才关2个变为21个，你的太多了，很多没见过，帮不上。

wang6071

日志基本正常,没发现大问题，有几个地方你自已确定一下。

M:\AUTORUN.EXE  这个是你自已做的?

这几个要不要就由你了.
O2 - BHO: MyIEHelper Class - {16A770A0-0E87-4278-B748-2460D64A8386} - C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\IEHelper2006223_8157.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)
O2 - BHO: std software - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - (no file)
O2 - BHO: CpapView Class - {77962960-536E-47EC-9DDB-52651519705F} - (no file)
O3 - Toolbar: 电鹰工具栏 - {1BC0B497-3010-43BF-AD78-5858A70907A2} - C:\WINDOWS\system32\dytoolband.dll (file missing)
O3 - Toolbar: (no name) - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - (no file)
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

这几个是否是诺顿的?
O10 - Unknown file in Winsock LSP: c:\program files\permeo\security driver\s5spi.dll
O10 - Unknown file in Winsock LSP: c:\program files\permeo\security driver\s5spi.dll
O10 - Unknown file in Winsock LSP: c:\program files\permeo\security driver\s5spi.dll
O10 - Unknown file in Winsock LSP: c:\program files\permeo\security driver\s5spi.dll
O10 - Unknown file in Winsock LSP: c:\program files\permeo\security driver\s5spi.dll
O10 - Unknown file in Winsock LSP: c:\program files\permeo\security driver\s5spi.dll
O23 - Service: Security Driver NetBT Proxy (nbproxy) - Permeo Technologies, Inc. - C:\Program Files\Permeo\Security Driver\nbproxy.exe

以下服务偶不知道,去看一下是否是你装的软件.
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: WinkldUP - Unknown owner - (no file)

tingyuqian

谢谢wang6071兄

tingyuqian

谢谢wang6071兄!
M:\AUTORUN.EXE  应该是红叶的Autorun

O10 - Unknown file in Winsock LSP: c:\program files\permeo\security driver\s5spi.dll
O10 - Unknown file in Winsock LSP: c:\program files\permeo\security driver\s5spi.dll
O10 - Unknown file in Winsock LSP: c:\program files\permeo\security driver\s5spi.dll
O10 - Unknown file in Winsock LSP: c:\program files\permeo\security driver\s5spi.dll
O10 - Unknown file in Winsock LSP: c:\program files\permeo\security driver\s5spi.dll
O10 - Unknown file in Winsock LSP: c:\program files\permeo\security driver\s5spi.dll
这几个是代理软件来的，刚才删掉了。

O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe
这2个是PefectDisk磁盘扫描工具弄上去的，也不知道有没有用。

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: WinkldUP - Unknown owner - (no file)
这2个不知道是什么东西，我搞不懂得就是它们2个。WinPcap我是曾经安装过，不知道实际上有用没！

O3 - Toolbar: 电鹰工具栏 - {1BC0B497-3010-43BF-AD78-5858A70907A2} - C:\WINDOWS\system32\dytoolband.dll (file missing)
这个是我怎么都删不掉，非常恼人！但我是没有安装过这个工具栏的，我用Maxthon！不知道是否有保护进程？

另外我常用Maxthon的搜索工具，但经常搜索的时候不是用我设置的默认的Google，而是弄出来一个什么BT的网址搜索！但也不是每回都这样，有时又是Google，非常郁闷，不知道Wang兄有什么建议呢？

tingyuqian

另外看了一下，IE首页被soft.studa.com锁定了，但找不到守护程序！怎么都删不到!

[ 本帖最后由 tingyuqian 于 2006-8-6 06:18 PM 编辑 ]

tingyuqian

请各位大虾帮忙删掉这个网址阿，比较烦!

wang6071

搞不掉的那个工具栏可以用syscheck，在进程中找到Explorer，看其模块加载的dll,查看属性，是不良的就加入到＜重启后删除＞．

然后再用活动文件页显示出来的bho，删除一次．IE首页也可以用syscheck修复一下，修复时关闭一下安全盾，确保修复成功．修复完立即打开安全盾，以固定首页．

[ 本帖最后由 wang6071 于 2006-8-6 10:00 PM 编辑 ]

6618

哗 ，看到眼都花了把下面的项修掉：

O2 - BHO: MyIEHelper Class - {16A770A0-0E87-4278-B748-2460D64A8386} - C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\IEHelper2006223_8157.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)
O2 - BHO: std software - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - (no file)
O2 - BHO: CpapView Class - {77962960-536E-47EC-9DDB-52651519705F} - (no file)
O3 - Toolbar: 电鹰工具栏 - {1BC0B497-3010-43BF-AD78-5858A70907A2} - C:\WINDOWS\system32\dytoolband.dll (file missing)
O3 - Toolbar: (no name) - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - (no file)
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O10 - Unknown file in Winsock LSP: c:\program files\permeo\security driver\s5spi.dll
O10 - Unknown file in Winsock LSP: c:\program files\permeo\security driver\s5spi.dll
O10 - Unknown file in Winsock LSP: c:\program files\permeo\security driver\s5spi.dll
O10 - Unknown file in Winsock LSP: c:\program files\permeo\security driver\s5spi.dll
O10 - Unknown file in Winsock LSP: c:\program files\permeo\security driver\s5spi.dll
O10 - Unknown file in Winsock LSP: c:\program files\permeo\security driver\s5spi.dll

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: WinkldUP - Unknown owner - (no file)

tingyuqian

原帖由 wang6071 于 2006-8-6 09:59 PM 发表
搞不掉的那个工具栏可以用syscheck，在进程中找到Explorer，看其模块加载的dll,查看属性，是不良的就加入到＜重启后删除＞．

然后再用活动文件页显示出来的bho，删除一次．IE首页也可以用syscheck修复一下，修 ...

差了一天，还是查不到，Explorer 进程也是找不到什么可疑的dll模块，很奇怪！
因为我一直都用的Maxthon，就是昨天无聊的打开IE的时候方才发现中招了，也不知道何时中招，系统一直也没有什么大的问题，就是Maxthon的搜索工具时候些有时候会进入一个烂BT网站。

用hijackthis查出来的这2个
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)
O2 - BHO: std software - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - (no file)
删除了以后竟然会又跑出来，应该是同一个东西了！
可以断定搜索引擎的问题和IE锁定应为同一个Dll作怪，但是就是找不出来，非常郁闷阿！

以前帮人修理了那么多流氓，竟然这次自己中了不会修理!

[ 本帖最后由 tingyuqian 于 2006-8-7 03:37 PM 编辑 ]

tingyuqian

终于查明白了！结果令我晕倒！
竟然是迅雷，怪不得我找半天都找不到可疑进程！原来是迅雷搞的鬼~！

[ 本帖最后由 tingyuqian 于 2006-8-7 10:15 PM 编辑 ]

tingyuqian

个人觉得这种情况应该引起大家的注意。