疑似中毒

JRT.txt (594 Bytes)

2014-2-7 10:12 PM, 下载次数: 1

log.txt (16.73 KB)

2014-2-7 10:12 PM, 下载次数: 1

OTL.Txt (69.77 KB)

2014-2-7 10:12 PM, 下载次数: 1

1.bmp (641.3 KB)

2014-2-7 10:12 PM

2.bmp (641.3 KB)

2014-2-7 10:12 PM

引用::OTL
O2 - BHO: (RealNetworks Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users.WINDOWS\Application Data\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
O2 - BHO: (FlashGetBHO) - {b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} - D:\Program Files\FlashG@@@@2013-08-09work\FlashGet 3\FlashGetBHO3.dll (Trend Media Group)
O4 - HKLM..\Run: [ilasss] C:\WINDOWS\system\lsass.exe ()
O4 - HKLM..\Run: [netmon] C:\WINDOWS\system\netmon.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [WSVCHO] C:\WINDOWS\system\svhost.exe ()
O4 - HKCU..\Run: [FlashGetBHO] D:\Program Files\FlashG@@@@2013-08-09work\FlashGet 3\mxhelper.exe ()
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\「开始」功能表\程式集\启动\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe (McAfee, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: 使用快车3下载 - D:\Program Files\FlashG@@@@2013-08-09work\FlashGet 3\GetUrl.htm ()
O8 - Extra context menu item: 使用快车3下载全部链结 - D:\Program Files\FlashG@@@@2013-08-09work\FlashGet 3\GetAllUrl.htm ()
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 118.143.251.45 210.0.128.242
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6E4F9B09-AD36-4F64-A4F8-73440791C4DC}: DhcpNameServer = 118.143.251.45 210.0.128.242


:Files
C:\WINDOWS\tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-527237240-562591055-1801674531-1003.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{AEA72D59-F3DD-4F83-9B2D-23E252512452}.job
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-527237240-562591055-1801674531-1003.job
C:\WINDOWS\System\svhost.exe
C:\WINDOWS\System\1sass.exe
C:\WINDOWS\imsins.BAK
C:\WINDOWS\System\netmon.exe
C:\WINDOWS\PEV.exe
C:\WINDOWS\MBR.exe
C:\WINDOWS\sed.exe
C:\WINDOWS\grep.exe
C:\WINDOWS\zip.exe


ipconfig /flushdns /c

:Commands
[PURITY]
[EMPTYTEMP]
[reboot]