Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 16:05:51, on 2008-6-20

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe


C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

D:\360safe\safemon\360tray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\DOCUME~1\Srkura\LOCALS~1\Temp\HiJackThis_PConline.zip 的临时目录 1\HijackThis.exe

O2 - BHO: SafeMon Class - {B69F34DD-F0F9-42DC-9EDD-957187DA688D} - D:\360safe\safemon\safemon.dll

O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe

O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay

O4 - HKLM\..\Run: [360Safetray] D:\360safe\safemon\360tray.exe /start

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{50F96255-2F82-47AF-B383-F985E39C327E}: NameServer = 202.109.15.135 202.96.209.134

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

--

End of file - 2417 bytes

你只有　重新启动　再检查才能确认

我都重装过了。。。

　　同上

那我去重起下

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 16:22:00, on 2008-6-20

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\\WINDOWS\\System32\\smss.exe

C:\\WINDOWS\\system32\\winlogon.exe

C:\\WINDOWS\\system32\\services.exe

C:\\WINDOWS\\system32\\lsass.exe

C:\\WINDOWS\\system32\\Ati2evxx.exe

C:\\WINDOWS\\system32\\svchost.exe

C:\\WINDOWS\\System32\\svchost.exe

C:\\WINDOWS\\system32\\spoolsv.exe

C:\\WINDOWS\\system32\\Ati2evxx.exe

C:\\WINDOWS\\Explorer.EXE

C:\\WINDOWS\\system32\\wscntfy.exe

C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe

D:\\360safe\\safemon\\360tray.exe

C:\\WINDOWS\\system32\\ctfmon.exe

C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe

C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe

C:\\WINDOWS\\system32\\wuauclt.exe

C:\\DOCUME~1\\Srkura\\LOCALS~1\\Temp\\HiJackThis_PConline.zip 的临时目录 2\\HijackThis.exe

O2 - BHO: SafeMon Class - {B69F34DD-F0F9-42DC-9EDD-957187DA688D} - D:\\360safe\\safemon\\safemon.dll

O4 - HKLM\\..\\Run: [IMJPMIG8.1] \"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32

O4 - HKLM\\..\\Run: [PHIME2002ASync] C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC

O4 - HKLM\\..\\Run: [PHIME2002A] C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName

O4 - HKLM\\..\\Run: [ATIModeChange] Ati2mdxx.exe

O4 - HKLM\\..\\Run: [ATICCC] \"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime -Delay

O4 - HKLM\\..\\Run: [360Safetray] D:\\360safe\\safemon\\360tray.exe /start

O4 - HKCU\\..\\Run: [ctfmon.exe] C:\\WINDOWS\\system32\\ctfmon.exe

O4 - HKUS\\S-1-5-19\\..\\Run: [ctfmon.exe] C:\\WINDOWS\\system32\\CTFMON.EXE (User \'LOCAL SERVICE\')

O4 - HKUS\\S-1-5-20\\..\\Run: [ctfmon.exe] C:\\WINDOWS\\system32\\CTFMON.EXE (User \'NETWORK SERVICE\')

O4 - HKUS\\S-1-5-18\\..\\Run: [ctfmon.exe] C:\\WINDOWS\\system32\\CTFMON.EXE (User \'SYSTEM\')

O4 - HKUS\\.DEFAULT\\..\\Run: [ctfmon.exe] C:\\WINDOWS\\system32\\CTFMON.EXE (User \'Default user\')

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\Program Files\\Messenger\\msmsgs.exe

O9 - Extra \'Tools\' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\Program Files\\Messenger\\msmsgs.exe

O17 - HKLM\\System\\CCS\\Services\\Tcpip\\..\\{50F96255-2F82-47AF-B383-F985E39C327E}: NameServer = 202.109.15.135 202.96.209.134

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\\WINDOWS\\system32\\Ati2evxx.exe

--

End of file - 2417 bytes

重起过了 请问帮我看看 还有吗 灰鸽子怪怕的

自己看端口，如果有不正常的就是还有，现在灰鸽子自己可以变种，挺麻烦的。