电脑又有问题了

jimmy_3030

HijackThis_815汉化版扫描日志 V1.99.1
保存于      17:01:38, 日期 2007-4-12
操作系统：  Windows 2000 SP3 (WinNT 5.00.2195)
浏览器：    Internet Explorer v5.00 SP3 (5.00.2920.0000)
当前运行的进程：         
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\Program Files\Faronics\Deep Freeze\Install C-0\DF5Serv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system\SVCH0ST.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\SOUNDMAN.EXE
C:\WINNT\System32\igfxtray.exe
C:\WINNT\System32\hkcmd.exe
C:\Program Files\Faronics\Deep Freeze\Install C-0\_$Df\FrzState2k.exe
C:\WINNT\system32\internat.exe
D:\GreatWall\Eclassroom\lanclt.exe
C:\WINNT\system32\DCOMSvr.EXE
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\conime.exe
E:\WinRAR\WinRAR.exe
C:\DOCUME~1\xs1\LOCALS~1\Temp\Rar$EX00.375\HijackThis1991zww.exe
O2 - BHO: Browser Class - {D8C32D92-3120-4D44-B295-5D4461C6AF95} - C:\WINNT\system32\rasapi.DLL
O2 - BHO: IEHelp Class - {ED863792-FADB-4D21-8B20-409DA940B7A2} - C:\WINNT\system\PDFAid.dll
O3 - IE工具栏增项: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - 启动项HKLM\\Run: [Synchronization Manager] mobsync.exe /logon
O4 - 启动项HKLM\\Run: [SoundMan] SOUNDMAN.EXE
O4 - 启动项HKLM\\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - 启动项HKLM\\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - 启动项HKLM\\Run: [StormCodec_Helper] "d:\Storm Codec\StormSet.exe" /S /opti
O4 - 启动项HKLM\\Run: [LanStar Client] d:\GreatWall\Eclassroom\CltLoad.exe
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O8 - IE右键菜单中的新增项目: &使用迅雷下载 - C:\Program Files\Thunder Networks\Thunder\Program\geturl.htm
O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - C:\Program Files\Thunder Networks\Thunder\Program\getallurl.htm
O8 - IE右键菜单中的新增项目: 导出到 Microsoft Office Excel(&X) - res://D:\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O17 - HKLM\System\CCS\Services\Tcpip\..\{50E891D6-2285-4494-91B0-108CA1703CA4}: NameServer = 202.103.44.5,202.103.0.117
O20 - Winlogon Notify: DfLogon - C:\WINNT\SYSTEM32\LogonDll.dll
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O23 - NT 服务: DCOM Client (DCOMClient) - Unknown owner - C:\WINNT\system32\DCOMSvr.EXE
O23 - NT 服务: DF5Serv - Faronics Corporation - C:\Program Files\Faronics\Deep Freeze\Install C-0\DF5Serv.exe
O23 - NT 服务: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - NT 服务: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - NT 服务: MICR0SOFT SVCH0ST (MS_SVCH0ST) - Unknown owner - C:\WINNT\system\SVCH0ST.EXE


[CODE]
2007-04-12,16:59:22
System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)
Windows 2000 Professional Service Pack 3 (Build 2195) - 管理权限用户 - 完整功能
以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <Internat.exe><internat.exe>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <Synchronization Manager><mobsync.exe /logon>  [(Verified)Microsoft Windows 2000 Publisher]
    <SoundMan><SOUNDMAN.EXE>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <IgfxTray><C:\WINNT\System32\igfxtray.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <HotKeysCmds><C:\WINNT\System32\hkcmd.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <StormCodec_Helper><"d:\Storm Codec\StormSet.exe" /S /opti>  []
    <LanStar Client><d:\GreatWall\Eclassroom\CltLoad.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows 2000 Publisher]
    <Userinit><C:\WINNT\system32\userinit.exe,>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\DfLogon]
    <WinlogonNotify: DfLogon><LogonDll.dll>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
    <Microsoft Windows Media Player><C:\WINNT\System32\setup\wmpocm.exe /ShowWMP>  [(Verified)Microsoft Windows 2000
Publisher]
[HKEY_CURRENT_USER\Control Panel\Desktop]
    <SCRNSAVE.EXE><(无)>  [N/A]
==================================
启动文件夹
N/A
==================================
服务
[DF5Serv / DF5Serv][Running/Auto Start]
  <C:\Program Files\Faronics\Deep Freeze\Install C-0\DF5Serv.exe><Faronics Corporation>
[Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[Macromedia Licensing Service / Macromedia Licensing Service][Stopped/Manual Start]
  <"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><>
[MICR0SOFT SVCH0ST / MS_SVCH0ST][Running/Auto Start]
  <C:\WINNT\system\SVCH0ST.EXE><N/A>
[DCOM Client / DCOMClient][Running/Auto Start]
  <C:\WINNT\system32\DCOMSvr.EXE><N/A>
==================================
驱动程序
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[bihafigd / bihafigd][Stopped/Boot Start]
  <\SystemRoot\system32\drivers\bihafigd.sys><N/A>
[dmboot / dmboot][Stopped/Disabled]
  <System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[ialm / ialm][Running/Manual Start]
  <System32\DRIVERS\ialmnt5.sys><Intel Corporation>
[npkcrypt / npkcrypt][Running/Auto Start]
  <\??\E:\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
  <System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[SSCFS / SSCFS][Running/Boot Start]
  <\SystemRoot\system32\drivers\sscfs.sys><N/A>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
  <System32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[Intel(R) Graphics Platform (SoftBIOS) Driver / {6080A529-897E-4629-A488-ABA0C29B635E}][Running/Manual Start]
  <system32\drivers\ialmsbw.sys><Intel Corporation>
[Intel(R) Graphics Chipset (KCH) Driver / {D31A0762-0CEB-444e-ACFF-B049A1F6FE91}][Running/Manual Start]
  <system32\drivers\ialmkchw.sys><Intel Corporation>
[profilenh / profilenh][Running/System Start]
  <system32\drivers\profilenh.sys><Microsoft Corporation>
[proregnh / proregnh][Running/System Start]
  <system32\drivers\proregnh.sys><Windows System Internal>
==================================
浏览器加载项
[Browser Class]
  {D8C32D92-3120-4D44-B295-5D4461C6AF95} <C:\WINNT\system32\rasapi.DLL, TODO: <公司名>>
[IEHelp Class]
  {ED863792-FADB-4D21-8B20-409DA940B7A2} <C:\WINNT\system\PDFAid.dll, adobe system>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[@msdxmLC.dll,-1@2052,电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\System32\msdxm.ocx, Microsoft Corporation>
[&使用迅雷下载]
  <C:\Program Files\Thunder Networks\Thunder\Program\geturl.htm, N/A>
[&使用迅雷下载全部链接]
  <C:\Program Files\Thunder Networks\Thunder\Program\getallurl.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
  <res://D:\MICROS~1\OFFICE11\EXCEL.EXE/3000, N/A>
==================================
正在运行的进程
[PID: 892][C:\WINNT\Explorer.EXE]  [Microsoft Corporation, 5.00.3502.5321]
    [C:\WINNT\AppPatch\AcLayers.DLL]  [Microsoft Corporation, 5.00.2195.5308]
    [C:\WINNT\system32\wdmaud.drv]  [Microsoft Corporation, 5.00.2195.3649]
    [C:\WINNT\system32\msacm32.drv]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\rasapi.DLL]  [TODO: <公司名>, 1.0.0.1]
    [C:\WINNT\system\PDFAid.dll]  [adobe system, 1.0.0.1]
    [D:\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
    [C:\WINNT\system32\msadp32.acm]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\System32\igfxpph.dll]  [Intel Corporation, 3.0.0.2350]
    [C:\WINNT\System32\hccutils.DLL]  [Intel Corporation, 3.0.0.2350]
    [E:\WinRAR\rarext.dll]  [N/A, ]
    [C:\WINNT\system32\igfxres.dll]  [Intel Corporation, 3.0.0.2350]
    [C:\WINNT\System32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.2350]
    [C:\WINNT\System32\igfxdev.dll]  [Intel Corporation, 3.0.0.2350]
[PID: 896][C:\WINNT\SOUNDMAN.EXE]  [Realtek Semiconductor Corp., 5.1.0.30]
[PID: 1012][C:\WINNT\System32\igfxtray.exe]  [Intel Corporation, 3.0.0.2350]
    [C:\WINNT\System32\hccutils.DLL]  [Intel Corporation, 3.0.0.2350]
    [C:\WINNT\System32\igfxdev.dll]  [Intel Corporation, 3.0.0.2350]
    [C:\WINNT\System32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.2350]
    [C:\WINNT\System32\igfxres.dll]  [Intel Corporation, 3.0.0.2350]
    [C:\WINNT\System32\igfxress.dll]  [Intel Corporation, 3.0.0.2350]
[PID: 1040][C:\WINNT\System32\hkcmd.exe]  [Intel Corporation, 3.0.0.2350]
    [C:\WINNT\System32\hccutils.DLL]  [Intel Corporation, 3.0.0.2350]
    [C:\WINNT\System32\igfxdev.dll]  [Intel Corporation, 3.0.0.2350]
    [C:\WINNT\System32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.2350]
    [C:\WINNT\System32\igfxhk.dll]  [Intel Corporation, 3.0.0.2350]
    [C:\WINNT\System32\igfxres.dll]  [Intel Corporation, 3.0.0.2350]
[PID: 1092][C:\WINNT\system32\internat.exe]  [Microsoft Corporation, 5.00.2920.0000]
[PID: 1112][D:\GreatWall\Eclassroom\lanclt.exe]  [N/A, ]
    [D:\GreatWall\Eclassroom\MFC42.DLL]  [Microsoft Corporation, 6.00.8267.0]
    [D:\GreatWall\Eclassroom\SimCom.dll]  [N/A, ]
    [D:\GreatWall\Eclassroom\gbm.dll]  [N/A, ]
    [D:\GreatWall\Eclassroom\LanSound.dll]  [, 1, 0, 0, 1]
    [D:\GreatWall\Eclassroom\Collusion.dll]  [Golden Soft Corp., 2.0]
    [D:\GreatWall\Eclassroom\LanCap32.dll]  [Goldensoft Co., LTD, 3, 0, 0, 1]
    [D:\GreatWall\Eclassroom\LanComp.dll]  [Goldensoft, Co., LTD., 2, 0, 0, 2]
    [D:\GreatWall\Eclassroom\LanEng32.dll]  [Goldensoft, Co., LTD, 2, 0, 0, 1]
    [C:\WINNT\system32\wdmaud.drv]  [Microsoft Corporation, 5.00.2195.3649]
    [D:\GreatWall\Eclassroom\CltRes.DLL]  [YZRD, 4, 0, 0, 0]
[PID: 616][C:\WINNT\system32\rundll32.exe]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system\WINS0C~1.DLL]  [mcsoft, 1, 0, 0, 0]
[PID: 1104][C:\WINNT\system32\conime.exe]  [Microsoft Corporation, 5.00.2195.5433]
[PID: 440][E:\WinRAR\WinRAR.exe]  [N/A, ]
    [F:\sreng2[1]\sreng2\6618.BAT]  [Smallfrogs Studio, 2.4.12.806]
==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS   Error. ["d:\Macromedia\Dreamweaver MX 2004\Dreamweaver.exe" "%1"]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1       localhost
==================================
API HOOK
N/A
==================================
隐藏进程
N/A
==================================

[/CO


我怀疑C:\WINNT\system32\DCOMSvr.EXE，C:\WINNT\system32\rasapi.DLL，C:\WINNT\system\SVCH0ST.EXE这3个文件都是毒，因为都没有公司 并且服务里面多了[MICR0SOFT SVCH0ST / MS_SVCH0ST][Running/Auto Start]
  <C:\WINNT\system\SVCH0ST.EXE><N/A>
[DCOM Client / DCOMClient][Running/Auto Start]
  <C:\WINNT\system32\DCOMSvr.EXE><N/A>
C:\WINNT\system\SVCH0ST.EXE这个可以删除，但是DCOMSvr.EXE和rasapi.DLL都删除不了，删了又有，服务里面也不能禁止dcomsvr，重启以后又是启动的。请高手帮下忙

大雨落幽燕

C:\WINNT\system\SVCH0ST.EXE
==================================
服务
[MICR0SOFT SVCH0ST / MS_SVCH0ST][Running/Auto Start]
  <C:\WINNT\system\SVCH0ST.EXE><N/A>
bihafigd / bihafigd][Stopped/Boot Start]
  <\SystemRoot\system32\drivers\bihafigd.sys><N/A>
[SSCFS / SSCFS][Running/Boot Start]
  <\SystemRoot\system32\drivers\sscfs.sys><N/A>
======================================
正在运行的进程
C:\WINNT\system32\rasapi.DLL]  
[C:\WINNT\system\WINS0C~1.DLL


首先，从设备管理器察看隐含设备，定位到 “非即插即用设备”，找到以下几个设备，卸载后重启：
bihafigd / bihafigd
SSCFS / SSCFS

然后停止上面的3个服务，再删除你说的那几个文件。

jimmy_3030

请问你qq多少 我有很多想向你请教 谢谢 或者你加我qq 418461905 你很强。。

大雨落幽燕

不好意思，自从N年前注册国一个6位的QQ后就很少用，连号码都忘记啦，偶现在不用QQ那个垃圾的，用MSN啦。bainingat@msn.com

jimmy_3030

首先，从设备管理器察看隐含设备，定位到 “非即插即用设备”，找到以下几个设备，卸载后重启：
bihafigd / bihafigd
SSCFS / SSCFS
这个是怎么看出来的呢？我不知道该怎么问，但是我想知道原理，为什么看到设备管理器的非即插即用设备
还有在非即插即用设备里我怎么看bihafigd / bihafigd和SSCFS / SSCFS啊？
哪有3个服务呢？就
[MICR0SOFT SVCH0ST / MS_SVCH0ST][Running/Auto Start]
  <C:\WINNT\system\SVCH0ST.EXE><N/A>
[DCOM Client / DCOMClient][Running/Auto Start]
  <C:\WINNT\system32\DCOMSvr.EXE><N/A>
2个啊

大雨落幽燕

在非即插即用设备中一次点击，看看设备驱动的详细信息，找到文件的路径

jimmy_3030

毒有可能会到驱动程序中吧 我只听说加载到进程里面啊

大雨落幽燕

服务
[MICR0SOFT SVCH0ST / MS_SVCH0ST][Running/Auto Start]
  <C:\WINNT\system\SVCH0ST.EXE><N/A>
bihafigd / bihafigd][Stopped/Boot Start]
  <\SystemRoot\system32\drivers\bihafigd.sys><N/A>
[SSCFS / SSCFS][Running/Boot Start]
  <\SystemRoot\system32\drivers\sscfs.sys><N/A>
这3个啊

jimmy_3030

不能注册msn帐号啊，还是有几个问题不明白想问问你的 ， 这样讲又不方便

jimmy_3030

3个服务我用sreng都停止了，可是dcomsvr.exe文件和rasapi.DLL还是不能删除，注册表一样

xintong123

像这样的只是软问题，没事的，最多重新安装一次就行了， 不过最好是正常的时候做个GHOST备份

jimmy_3030

如果每次出问题了都重装 那我不是每天都疲于奔命？ 我不是搞一台两台电脑那么简单

wuyongju

路过..顶一下..HOHO~

大雨落幽燕

[DCOM Client / DCOMClient][Running/Auto Start]
  <C:\WINNT\system32\DCOMSvr.EXE>
这个服务也要停止掉

jimmy_3030

你终于来了等了你一上午了。dcomsvr.exe这个服务停止不了，服务里面不能停 用sreng也不能停。。。。。。好烦啊 ，大侠帮忙啊

大雨落幽燕

除了上面提到的几个文件，还有LogonDll.dll，用PE启动巴这些文件删了算了，这样做比较简单

jimmy_3030

LogonDll.dll 这个文件我已经手动删除了

大雨落幽燕

C:\WINNT\system\SVCH0ST.EXE=========== 注意不是SYSYTEM32
C:\WINNT\system32\DCOMSvr.EXE
C:\WINNT\system32\rasapi.DLL
C:\WINNT\SYSTEM32\LogonDll.dll
C:\WINNT\system32\DCOMSvr.EXE
SystemRoot\system32\drivers\bihafigd.sys
SystemRoot\system32\drivers\sscfs.sys

bianlimit

C:\WINNT\system\SVCH0ST.EXE
这个肯定有问题啦，