唔知中左咩广告毒<白色广告>

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:43:19, on 14/1/2014
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\alipay\alieditplus\AlipaySecSvc.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\Intel\iCLS Client\HeciServer.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\Program Files\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINPENJR\win32\custom.exe
C:\WINPENJR\win32\pphidpad.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\UsageTemp.exe
C:\Program Files\VLC Player GPU+\UsageLog.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\WINPENJR\win32\PPHBUF.EXE
C:\WINPENJR\win32\DRAWOBJ.EXE
C:\Program Files\Nikon\Nikon Message Center 2\NkMC2.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\program files\real\realplayer\update\realsched.exe
C:\Program Files\BeatTrojanSecuritySuite2012\BeatTrojanWall2012\BeatTrojanWall.exe
C:\Program Files\BeatTrojanSecuritySuite2012\BeatTrojan2012\BeatTrojanMon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Administrator\Application Data\Wandoujia2\Applications\2.70.0.5471\wandoujia_helper.exe
C:\Program Files\VLC Player GPU+\UsageMonitor.exe
C:\WINDOWS\system32\conime.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
c:\program files\real\realplayer\RealPlay.exe
C:\Program Files\BeatTrojanSecuritySuite2012\BeatTrojan2012\BeatTrojan.exe
c:\program files\real\realplayer\RealPlay.exe
c:\program files\real\realplayer\RealPlay.exe
c:\program files\real\realplayer\RealPlay.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
c:\program files\real\realplayer\RealPlay.exe

R3 - URLSearchHook: uTorrentControl2 Toolbar - {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files\uTorrentControl2\prxtbuTo0.dll
F3 - REG:win.ini: run=C:\WINPENJR\win32\custom.exe
O2 - BHO: WandoujiaBHO - {000DA090-57AA-424B-A8F0-621B7C08B8F4} - C:\Program Files\WandouLabs\wandoujia_bho.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dll
O2 - BHO: QPMIEHelper - {50F4150A-48B2-417A-BE4C-C83F580FB904} - C:\Program Files\Common Files\Tencent\QQPhoneManager\1.8.101.2154\npQQPhoneManagerExt.dll
O2 - BHO: uTorrentControl2 - {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files\uTorrentControl2\prxtbuTo0.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: XunleiBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\BHO\XunleiBHO7.9.9.4578.dll
O2 - BHO: B22CC489-9BE7-1F3D-7AF1-530DD5169888 Class - {B22CC489-9BE7-1F3D-7AF1-530DD5169888} - C:\Program Files\Thunder Network\Thunder\BBInside\{E5A0523F-6547-4334-7275-60EAC2D11C53}\AddressBar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O2 - BHO: E5A0523F-6547-4334-7275-60EAC2D11C53 Class - {E5A0523F-6547-4334-7275-60EAC2D11C53} - C:\Program Files\Thunder Network\Thunder\BBInside\{E5A0523F-6547-4334-7275-60EAC2D11C53}\AddressBar.dll
O2 - BHO: Shopping Suggestion. - {e7e8ed77-2fba-4ec6-bc07-65de4de6709f} - mscoree.dll (file missing)
O2 - BHO: InjectScript - {F6C07882-D703-4DD5-905A-2C4E815A5066} - C:\Documents and Settings\Administrator\Application Data\D394D188-BAC7-4e03-8FAF-389A4D7EC6F4\Shopping Suggestion.dll
O3 - Toolbar: uTorrentControl2 Toolbar - {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files\uTorrentControl2\prxtbuTo0.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [IJNetworkScannerSelectorEX] C:\Program Files\Canon\IJ Network Scanner Selector EX\CNMNSST.exe /FORCE
O4 - HKLM\..\Run: [UsageTemp] "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\UsageTemp.exe"
O4 - HKLM\..\Run: [UsageLoader] "C:\Program Files\VLC Player GPU+\UsageLog.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [CanonSolutionMenuEx] C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE /logon
O4 - HKLM\..\Run: [Nikon Message Center 2] C:\Program Files\Nikon\Nikon Message Center 2\NkMC2.exe -s
O4 - HKLM\..\Run: [PPHIDPAD] C:\WINPENJR\Win32\pphidpad.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\program files\real\realplayer\update\realsched.exe" -osboot
O4 - HKLM\..\Run: [BeatTrojanWall] C:\Program Files\BeatTrojanSecuritySuite2012\BeatTrojanWall2012\BeatTrojanWall.exe
O4 - HKLM\..\Run: [BeatTrojan] C:\Program Files\BeatTrojanSecuritySuite2012\BeatTrojan2012\BeatTrojanMon.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] ctfmon.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] ctfmon.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O8 - Extra context menu item: &使用BitComet下载 - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &使用BitComet下载全部连结 - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\BHO\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\BHO\GetAllUrl.htm
O8 - Extra context menu item: &使用迅雷离线下载 - C:\Program Files\Thunder Network\Thunder\BHO\OfflineDownload.htm
O8 - Extra context menu item: Foxy 下载 - res://C:\Documents and Settings\Administrator\My Documents\FOXY 1[1].9.8 繁体中文免安装版\FOXY 1.9.8 繁体中文免安装版\Foxy.exe/download.htm
O8 - Extra context menu item: Foxy 搜寻 - res://C:\Documents and Settings\Administrator\My Documents\FOXY 1[1].9.8 繁体中文免安装版\FOXY 1.9.8 繁体中文免安装版\Foxy.exe/search.htm
O8 - Extra context menu item: Google 网页注解... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
O8 - Extra context menu item: 汇出至 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: 妏蚚嫖荌晤怃睿艺赵 - C:\Program Files\nEO iMAGING\NeoOpenNeo.htm
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dll/206 (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O10 - Unknown file in Winsock LSP: c:\program files\beattrojansecuritysuite2012\beattrojanwall2012\beatwall.dll
O10 - Unknown file in Winsock LSP: c:\program files\beattrojansecuritysuite2012\beattrojanwall2012\beatwall.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\thunder network\netmon\net_monitor2.0.2.9.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\thunder network\netmon\net_monitor2.0.2.9.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\thunder network\netmon\net_monitor2.0.2.9.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\thunder network\netmon\net_monitor2.0.2.9.dll
O10 - Unknown file in Winsock LSP: c:\program files\beattrojansecuritysuite2012\beattrojanwall2012\beatwall.dll
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Alipay security service (AlipaySecSvc) - Alipay Inc. - C:\Program Files\alipay\alieditplus\AlipaySecSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Canon Inkjet Printer/Scanner/Fax Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: Intel(R) Capability Licensing Service Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: 木马清除大师设定性服务 - Lofocus(洛克思)安全实验室 - C:\Program Files\BeatTrojanSecuritySuite2012\BeatTrojan2012\BeatTrojanSvc.exe

--
End of file - 11090 bytes

移除木马清除大师后再做次Hijackthis thx

已解泱，换了浏览器就没再出现