Question

请高手帮我分析下Hijackthis日志！

O4 - HKLM\..\Run: [switch] c:\windows\system32\壁纸自动换.exe
O4 - HKLM\..\Run: [runeip] "C:\Program Files\Rising\AntiSpyware\runiep.exe" /startup
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Thunder] "D:\迅雷软件\Thunder.exe" /s
O4 - HKLM\..\Run: [RfwMain] "D:\新建文件夹\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [RavTask] "D:\新建文件夹\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [ZSSnp211] C:\WINDOWS\ZSSnp211.exe
O4 - HKLM\..\Run: [Domino] C:\WINDOWS\Domino.exe
O4 - HKLM\..\Run: [NewRecog] D:\新建文件夹 (2)\HandWrite\MyNewRecog.exe
O4 - HKLM\..\Run: [Google IME Autoupdater] "C:\Program Files\Google\Google Pinyin\GooglePinyinDaemon.exe"
O4 - HKLM\..\Run: [Windows木马防火墙] F:\新建文件夹\Trojanwall.exe
O4 - HKLM\..\RunOnce: [Rfw] "D:\新建文件夹\Rising\Rfw\Update\Setup.exe" /UPDATE /ONCE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PPS Accelerator] C:\Program Files\PPStream\ppsap.exe
O4 - HKCU\..\Run: [QQDownload] "D:\QQ\QQDownload\QQDownload.exe" autostart
O4 - HKCU\..\Run: [Vagaa] "F:\电影\Vagaa\Vagaa.exe" -tray
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-2000478354-842925246-1202660629-500\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-2000478354-842925246-1202660629-500\..\Run: [Vagaa] "F:\电影\Vagaa\Vagaa.exe" -tray (User '?')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - S-1-5-21-2000478354-842925246-1202660629-500 Startup: QQ游戏启动加速程序.lnk = D:\QQ\QQGAME\Accel.exe (User '?')
O4 - S-1-5-21-2000478354-842925246-1202660629-500 Startup: PPS.lnk = C:\Program Files\PPStream\PPStream.exe (User '?')
O4 - S-1-5-21-2000478354-842925246-1202660629-500 Startup: 腾讯QQ.lnk = D:\QQ\Tencent\QQ.exe (User '?')
O4 - S-1-5-21-2000478354-842925246-1202660629-500 Startup: 网络人.lnk = ? (User '?')
O4 - Startup: QQ游戏启动加速程序.lnk = D:\QQ\QQGAME\Accel.exe
O4 - Startup: PPS.lnk = C:\Program Files\PPStream\PPStream.exe
O4 - Startup: 腾讯QQ.lnk = D:\QQ\Tencent\QQ.exe
O4 - Startup: 网络人.lnk = ?

Answer 1

好复杂哦