【求助】新病毒变种? bbs.ikaka.com

欲哭无泪70896 - 2006-6-20 21:36:00

各位,窃喜一下.我的电脑经过我,一个超级菜鸟的两天两宿的奋战,已经恢复正常了.瑞星杀毒跟防火墙都好了.把现在的日志帖上来,让大家看看是不是彻底好了.
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Cmaudio><RunDll32 cmicnfg.cpl,CMICtrlWnd> []
<IgfxTray><C:\WINDOWS\System32\igfxtray.exe> [Intel Corporation]
<HotKeysCmds><C:\WINDOWS\System32\hkcmd.exe> [Intel Corporation]
<StormCodec_Helper><"C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti> []
<SysExplr><C:\Herosoft\HeroV8\SysExplr.EXE> []
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation]
<PHIME2002A><; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]
<PHIME2002ASync><; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation]
<RealTray><; > []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<Rav><"C:\Program Files\Rising\Rav\Update\Setup.exe" /UNINSTALL /S /ONCE> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]

欲哭无泪70896 - 2006-6-20 21:37:00

动文件夹
服务
[C-DillaSrv / C-DillaSrv]
<C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE><C-Dilla Ltd>

==================================
浏览器加载项
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>
[Google Toolbar Helper]
{AA58ED58-01DD-4d91-8333-CF10577473F7} <c:\program files\google\googletoolbar1.dll, Google Inc.>
[豪杰超级解霸V8]
{367E0A21-8601-4986-9C9A-153BF5ACA118} <C:\Herosoft\HeroV8\STHSDVD.EXE, N/A>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[&Google]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar1.dll, Google Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\FLASH.OCX, Macromedia, Inc.>
[&使用迅雷下载]
<C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
<C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
[Google 搜索(&G)]
<res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html, N/A>
[上传到QQ网络硬盘]
<C:\Program Files\腾讯 QQ & TM Q哥Q妹版\AddToNetDisk.htm, N/A>
[反向链接]
<res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html, N/A>
[添加到QQ自定义面板]
<C:\Program Files\腾讯 QQ & TM Q哥Q妹版\AddPanel.htm, N/A>
[添加到QQ表情]
<C:\Program Files\腾讯 QQ & TM Q哥Q妹版\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<C:\Program Files\腾讯 QQ & TM Q哥Q妹版\SendMMS.htm, N/A>
[类似网页]
<res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html, N/A>
[缓存的网页快照]
<res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html, N/A>
[翻译英文字词(&T)]
<res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html, N/A>
[豪杰超级解霸V8实时播放]
<C:\Herosoft\HeroV8\MPURLGET.HTM, N/A>

==================================
正在运行的进程
[PID: 480][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 540][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 564][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 608][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 620][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 788][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 836][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 956][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1004][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1376][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
[C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll] <Thunder Networking Technologies,LTD><5, 0, 0, 2>
[C:\Program Files\Rising\Rav\RavScrCh.dll] <><17, 0, 0, 7>
[PID: 1392][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.0 (XPClient.010817-1148)>
[PID: 1628][C:\WINDOWS\System32\conime.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 1788][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 1800][C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE] <C-Dilla Ltd><3.24.010>
[PID: 452][C:\Program Files\Internet Explorer\IEXPLORE.EXE] <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
[c:\program files\google\googletoolbar1.dll] <Google Inc.><3, 0, 131, 0>
[C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll] <Thunder Networking Technologies,LTD><5, 0, 0, 2>
[C:\Program Files\Rising\Rav\RavScrCh.dll] <><17, 0, 0, 7>
[C:\WINDOWS\System32\msdmo.dll] <N/A><N/A>
[C:\Program Files\Ringz Studio\Storm Codec\Codecs\VSFilter.dll] <Gabest><1, 0, 1, 3>
[C:\Program Files\Ringz Studio\Storm Codec\Codecs\empgdmx.ax] <Elecard Ltd.><1, 0, 19, 51017>
[C:\Program Files\Ringz Studio\Storm Codec\Codecs\RMSplt.ax] <Gabest><1, 0, 1, 1>
[C:\WINDOWS\System32\ffdshow.ax] <N/A><1.0.2.2003>
[PID: 156][C:\WINDOWS\System32\ctfmon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 1920][C:\Program Files\Internet Explorer\IEXPLORE.EXE] <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
[c:\program files\google\googletoolbar1.dll] <Google Inc.><3, 0, 131, 0>
[C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll] <Thunder Networking Technologies,LTD><5, 0, 0, 2>
[C:\Program Files\Rising\Rav\RavScrCh.dll] <><17, 0, 0, 7>
[C:\WINDOWS\System32\FLASH.OCX] <Macromedia, Inc.><7,0,19,0>
[C:\WINDOWS\System32\JPWB.IME] <常诚研制><4.00.950>
[PID: 684][C:\Program Files\Internet Explorer\IEXPLORE.EXE] <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
[c:\program files\google\googletoolbar1.dll] <Google Inc.><3, 0, 131, 0>
[C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll] <Thunder Networking Technologies,LTD><5, 0, 0, 2>
[C:\Program Files\Rising\Rav\RavScrCh.dll] <><17, 0, 0, 7>
[C:\WINDOWS\System32\JPWB.IME] <常诚研制><4.00.950>
[C:\TDdownload\SREng2\sreng2.com] <Smallfrogs Studio><2.0.21.505>
[PID: 1500][C:\Program Files\Thunder Network\Thunder\Program\Thunder5.exe] <Thunder Networking Technologies,LTD><5.2.0.207>
[C:\Program Files\Thunder Network\Thunder\Program\UpdateDownload.dll] <Thunder Networking Technologies,LTD><1, 0, 1, 8>
[C:\Program Files\Thunder Network\Thunder\Program\download_interface.dll] <Thunder Networking Technologies,LTD><1, 0, 3, 70>
[C:\Program Files\Thunder Network\Thunder\Program\log4cplus.dll] <><1, 0, 2, 1>
[C:\Program Files\Thunder Network\Thunder\Program\stlport_vc646.dll] <STLport Consulting, Inc.><4.6.2003.1031>
[C:\Program Files\Thunder Network\Thunder\Program\asyn_dns.dll] <N/A><N/A>
[C:\Program Files\Thunder Network\Thunder\Program\msgmanage.dll] <Thunder Networking Technologies,LTD><1, 0, 0, 15>
[C:\Program Files\Thunder Network\Thunder\Program\historyinfo_manage.dll] <Thunder Networking Technologies,LTD><5, 2, 0, 148>
[C:\Program Files\Thunder Network\Thunder\Program\RegisterDll.dll] <Thunder Networking Technologies,LTD><1, 2, 0, 7>
[C:\Program Files\Thunder Network\Thunder\Program\FloatBar.dll] <Thunder Networking Technologies,LTD><1, 0, 0, 2>
[C:\Program Files\Thunder Network\Thunder\Components\InMedia\iEmbedShell.dll] <　><1, 0, 0, 5>
[C:\Program Files\Thunder Network\Thunder\Components\InMedia\iEmbed.dll] <　><2, 1, 0, 29>
[C:\Program Files\Thunder Network\Thunder\Components\P4PClient\P4PClient.dll] <Thunder Networking Technologies,LTD><1, 0, 1, 6>
[C:\Program Files\Thunder Network\Thunder\Program\iTargetAd.dll] <Thunder Networking Technologies,LTD><1, 0, 0, 60>
[C:\WINDOWS\System32\FLASH.OCX] <Macromedia, Inc.><7,0,19,0>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

瑞星卡卡安全论坛