瑞星卡卡安全论坛

中trojan dropper病毒，杀毒后，瑞星监控的小伞变成黄色，说是邮件接受和发送监控禁用，然后就所有和网络有关的东西都上部了，下面是用hijackthis扫描的日志
Logfile of HijackThis v1.99.1
Scan saved at 0:33:19, on 2006-7-13
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
d:\Rising\Rav\CCenter.exe
d:\Rising\Rav\Ravmond.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
d:\Rising\Rav\RavStub.exe
C:\WINNT\Explorer.EXE
C:\WINNT\SOUNDMAN.EXE
D:\Super Rabbit\MagicSet\DS.EXE
D:\Rising\Rav\RavTask.exe
D:\Rising\Rav\Ravmon.exe
C:\WINNT\system32\Internat.exe
D:\Bitment\BitComet.exe
C:\Program Files\Sandai Technologies Inc\Thunder\Thunder.exe
C:\Program Files\Sandai Technologies Inc\Thunder\TDUpdate.exe
C:\WINNT\system32\wuauclt.exe
D:\Rising\Rav\RsAgent.exe
C:\WINNT\msagent\AgentSvr.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.985\HijackThis.exe

F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: 超级兔子上网精灵 - {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} - D:\Super Rabbit\MagicSet\haokanbar.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINNT\system32\kakatool.dll (file missing)
O3 - Toolbar: 超级兔子上网精灵 - {43869BB3-22FD-4F15-9B46-238106BA2F4E} - D:\Super Rabbit\MagicSet\haokanbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Super Rabbit Desktop Set] D:\Super Rabbit\MagicSet\DS.EXE /Load
O4 - HKLM\..\Run: [RavTask] "d:\Rising\Rav\RavTask.exe" -system
O4 - HKCU\..\Run: [Internat.exe] Internat.exe
O4 - HKCU\..\Run: [msnmsgr] ; "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BitComet] "D:\Bitment\BitComet.exe"
O4 - HKCU\..\Run: [Super Rabbit Desktop Search] ; D:\Super Rabbit\MagicSet\srsearch.exe
请高手帮我看一下，谢谢

是因为下载清华紫光输入法的时候，下载下来好多插件和程序而中毒了，别的我都卸载了。只剩下一个易虎用超级兔子也卸载不了。

该用户帖子内容已被屏蔽

日志看来没问题...

我在安全模式下也卸载不了。瑞星重装了，还是黄伞。

病毒路径。...

把日志帖全了，这样方便分析

Logfile of HijackThis v1.99.1
Scan saved at 0:33:19, on 2006-7-13
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
d:\Rising\Rav\CCenter.exe
d:\Rising\Rav\Ravmond.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
d:\Rising\Rav\RavStub.exe
C:\WINNT\Explorer.EXE
C:\WINNT\SOUNDMAN.EXE
D:\Super Rabbit\MagicSet\DS.EXE
D:\Rising\Rav\RavTask.exe
D:\Rising\Rav\Ravmon.exe
C:\WINNT\system32\Internat.exe
D:\Bitment\BitComet.exe
C:\Program Files\Sandai Technologies Inc\Thunder\Thunder.exe
C:\Program Files\Sandai Technologies Inc\Thunder\TDUpdate.exe
C:\WINNT\system32\wuauclt.exe
D:\Rising\Rav\RsAgent.exe
C:\WINNT\msagent\AgentSvr.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.985\HijackThis.exe

F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: 超级兔子上网精灵 - {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} - D:\Super Rabbit\MagicSet\haokanbar.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINNT\system32\kakatool.dll (file missing)
O3 - Toolbar: 超级兔子上网精灵 - {43869BB3-22FD-4F15-9B46-238106BA2F4E} - D:\Super Rabbit\MagicSet\haokanbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Super Rabbit Desktop Set] D:\Super Rabbit\MagicSet\DS.EXE /Load
O4 - HKLM\..\Run: [RavTask] "d:\Rising\Rav\RavTask.exe" -system
O4 - HKCU\..\Run: [Internat.exe] Internat.exe
O4 - HKCU\..\Run: [msnmsgr] ; "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BitComet] "D:\Bitment\BitComet.exe"
O4 - HKCU\..\Run: [Super Rabbit Desktop Search] ; D:\Super Rabbit\MagicSet\srsearch.exe
O4 - Startup: 腾讯QQ.lnk = D:\Tencent\QQ\QQ.exe
O4 - Startup: 迅雷4.lnk = C:\Program Files\Sandai Technologies Inc\Thunder\Thunder.exe
O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Sandai Technologies Inc\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Sandai Technologies Inc\Thunder\getAllurl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Tencent\QQ\SendMMS.htm
O9 - Extra button: 相关站点 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: 相关站点 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - d:\Tencent\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - d:\Tencent\QQ\QQ.EXE
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b}? - C:\Program Files\Tencent\QQ\QQ.EXE (file missing)
O9 - Extra 'Tools' menuitem: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b}? - C:\Program Files\Tencent\QQ\QQ.EXE (file missing)
O9 - Extra button: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - d:\Tencent\QQ\QQIEHelper.dll (file missing)
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - d:\Tencent\QQ\QQIEHelper.dll (file missing)
O9 - Extra button: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6}? - d:\Tencent\QQ\QQIEHelper.dll (file missing)
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6}? - d:\Tencent\QQ\QQIEHelper.dll (file missing)
O10 - Broken Internet access because of LSP provider 'c:\winnt\system32\msplus.dll' missing
O16 - DPF: {ACFE8232-03C5-4AEC-AF5E-42B806724096} (KSHScan Control) - http://safe.qq.com/scan/KAllScan.CAB
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {BF8C499A-AC6E-4F58-82EA-9E5FCC41C34B} (PicUploadCtrl Class) - http://tb.sogou.com/PicUpload.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{72808810-E05A-4708-873E-552CDA75A993}: NameServer = 202.97.224.68,202.97.230.4
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - d:\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - d:\Rising\Rav\Ravmond.exe

由于重装了瑞星，病毒路径我都无从查起，还有别得方法可以看病毒路径么？？

瑞星在C:\ 有个隔离系统  从那里可以看到..

哦，我等会儿回宿舍看看。日志应该没有问题吧！

没问题..

3q

病毒路径：c:\winnt\system
c:\program files\netmeeting
c:\
c:\documents and settings\administrator\local settings\temporary internet files\content ie5\kti7w963
c:\documents and settings\administrator\local settings\temporary internet files\content ie5\o1efst6j
c:\documents and settings\administrator\local settings\temporary internet files\content ie5\2p8fytq5