瑞星卡卡安全论坛

不断出现trojan.dl.delf.ccv  急啊！！！！！！！！
病毒名称                        处理结果    扫描方式路径文件
Trojan.DL.Delf.ccv              删除成功    文件监控C:\Documents and Settings\5191\Local Settings\Temporary Internet Files\Content.IE5\6PYPG18Ryoung[1].css>>VEUnpackFile
Trojan.DL.Delf.ccv              删除成功    文件监控C:\Documents and Settings\5191\Local Settings\Temporary Internet Files\Content.IE5\ENEF4RQVyoung[1].css>>VEUnpackFile
Trojan.DL.Delf.ccv              删除成功    文件监控C:\Documents and Settings\5191\Local Settings\Temporary Internet Files\Content.IE5\ENEF4RQVyoung[1].css>>VEUnpackFile
Trojan.DL.Delf.ccv              删除成功    文件监控C:\Documents and Settings\5191\Local Settings\Temporary Internet Files\Content.IE5\WTUJKBK3young[1].css>>VEUnpackFile
Trojan.DL.Delf.ccv              删除成功    文件监控C:\Documents and Settings\5191\Local Settings\Temporary Internet Files\Content.IE5\ENEF4RQVyoung[1].css>>VEUnpackFile
Trojan.DL.Delf.ccv              删除成功    文件监控C:\Documents and Settings\5191\Local Settings\Temporary Internet Files\Content.IE5\ENEF4RQVyoung[1].css>>VEUnpackFile
Trojan.DL.Delf.ccv              删除成功    文件监控C:\Documents and Settings\5191\Local Settings\Temporary Internet Files\Content.IE5\ENEF4RQVyoung[1].css>>VEUnpackFile
Trojan.DL.Delf.ccv              删除成功    文件监控C:\Documents and Settings\5191\Local Settings\Temporary Internet Files\Content.IE5\ENEF4RQVyoung[1].css>>VEUnpackFile
Trojan.DL.Delf.ccv              删除成功    文件监控C:\Documents and Settings\5191\Local Settings\Temporary Internet Files\Content.IE5\8RABCVWFyoung[1].css>>VEUnpackFile
Trojan.DL.Delf.ccv              删除成功    文件监控C:\Documents and Settings\5191\Local Settings\Temporary Internet Files\Content.IE5\WTUJKBK3young[1].css>>VEUnpackFile



HijackThis_zww汉化版扫描日志 V1.99.1
保存于      11:42:30, 日期 2006-7-17
操作系统：  Windows XP SP2 (WinNT 5.01.2600)
浏览器：    Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程：         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
F:\瑞星2005\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
F:\瑞星2005\Rising\Rav\Ravmond.exe
F:\瑞星2005\Rising\Rav\RavStub.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\jmesoft\VCC.exe
F:\瑞星2005\Rising\Rav\RavTask.exe
F:\瑞星2005\Rising\Rav\Ravmon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\ChinaNet\VnetClient.exe
C:\Program Files\Tencent\qq\QQ.exe
C:\Program Files\Tencent\qq\TIMPlatform.exe
C:\Program Files\Maxthon\Maxthon.exe
C:\Program Files\Thunder Network\Thunder\Program\Thunder5.exe
E:\gg4f\传奇万能登入器登陆器.exe
F:\瑞星2005\Rising\Rav\RsAgent.exe
C:\WINDOWS\msagent\AgentSvr.exe
F:\瑞星2005\Rising\Rav\Rav.exe
C:\Documents and Settings\5191\桌面\网游\HijackThis1991汉化版\HijackThis1991zww.exe

F2 - REG:system.ini: UserInit=userinit.exe,
O1 - Hosts: 218.201.39.85 769web.mir666.com
O1 - Hosts: 218.201.39.85 web772.jsy666.com
O1 - Hosts: 202.103.67.180 auto.search.msn.com
O2 - BHO: ThunderIEHelper - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v8.dll
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F57} - C:\WINDOWS\System32\ThunderBHO.dll
O2 - BHO: MemoryManager Class - {2CE7166E-8BBA-4E76-BA7E-02AB3C573011} - C:\WINDOWS\DOWNLO~1\cytdcli.dll
O2 - BHO: (no name) - {2F401A09-2F10-455E-A15D-4C8B9D8D7AEB} - C:\PROGRA~1\黄河FL~1\hhcatch.dll
O2 - BHO: NetEASE Blocker - {4106B474-4C59-4911-83BA-2053AFEC8F72} - (no file)
O2 - BHO: VnetCookie Class - {4E83D567-4697-4F7B-B1F0-A513B01DB89A} - c:\PROGRA~1\chinanet\VNETTR~1.DLL
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: (no name) - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - (no file)
O2 - BHO: (no name) - {6BDE1669-B490-48E3-B668-456314F2D6C3} - (no file)
O2 - BHO: 珊瑚虫工具栏 - {75FE2B5A-D3A4-4EFA-AC11-ADC9C9459688} - C:\PROGRA~1\YOK.com\SUPERS~1\YOK_SuperSearch.dll (file missing)
O2 - BHO: (no name) - {A9930D97-9CF0-42A0-A10D-4F28836579D5} - C:\PROGRA~1\KuGoo3\KUGOO3~1.OCX (file missing)
O2 - BHO: IEHlprObj Class - {C5E5DB7E-46B1-47E6-8447-2E517F269925} - C:\Program Files\Xplus\GETIE.dll (file missing)
O2 - BHO: Infofo 工具栏 - {D74EC18E-3DDD-4174-B1B1-949FE3B8366D} - C:\Program Files\Infofo Bar\infofobar.dll
O3 - IE工具栏增项: Infofo 工具栏 - {D74EC18E-3DDD-4174-B1B1-949FE3B8366D} - C:\Program Files\Infofo Bar\infofobar.dll
O3 - IE工具栏增项: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll
O3 - IE工具栏增项: 珊瑚虫工具栏 - {F869BB38-FFEF-4589-B986-610B7AD0ADA2} - C:\PROGRA~1\YOK.com\SUPERS~1\YOK_SuperSearch.dll (file missing)
O4 - 启动项HKLM\\Run: [jmevfd] C:\Program Files\jmesoft\VCC.exe
O4 - 启动项HKLM\\Run: [RavTask] "F:\瑞星2005\Rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [SKYNET Personal FireWall] C:\PROGRA~1\SKYNET\FIREWALL\pfw.exe
O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - IE右键菜单中的新增项目: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - IE右键菜单中的新增项目: &使用迷你迅雷下载 - C:\Program Files\Thunder Network\ThunderMini\Program\GetUrl.htm
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - C:\Program Files\Tencent\qq\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - C:\Program Files\Tencent\qq\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - C:\Program Files\Tencent\qq\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - C:\Program Files\Tencent\qq\SendMMS.htm
O8 - IE右键菜单中的新增项目: 类似网页 - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - IE右键菜单中的新增项目: 雅虎搜索 - res://C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll/246
O8 - IE右键菜单中的新增项目: 黄河&Flash播放器 - C:\PROGRA~1\黄河FL~1\geturl.htm
O9 - 浏览器额外的按钮: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - 浏览器额外的“工具”菜单项: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O10 - 未知的文件在 Winsock LSP: c:\program files\permeo\security driver\s5spi.dll
O10 - 未知的文件在 Winsock LSP: c:\program files\permeo\security driver\s5spi.dll
O10 - 未知的文件在 Winsock LSP: c:\program files\permeo\security driver\s5spi.dll
O10 - 未知的文件在 Winsock LSP: c:\program files\permeo\security driver\s5spi.dll
O16 - DPF: {11111111-1111-1111-1111-111111113457} - file://c:\ied_s7.cab
O16 - DPF: {12345678-1234-1234-1234-123456789011} - http://www.5l73.net/web/weiptl.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {2EA6D939-4445-43F1-A12B-8CB3DDA8B855} - http://www.bluesky.cn/download/v2_60.cab
O16 - DPF: {354D8461-5490-4294-B155-CA6B886ACB6F} - http://games.enet.com.cn/fairy/auto.CAB
O16 - DPF: {3D8F74EE-8692-4F8F-B8D2-7522E732519E} (WebActivater Control) - http://game.qq.com/QQGame2.cab
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - http://login.5u56.com/com/EGamesPlugin.cab
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (CEditCtrl Object) - https://img.alipay.com/download/aliedit.cab
O16 - DPF: {5EC7C511-CD0F-42E6-830C-1BD9882F3458} (PowerPlayer Control) - http://www.ppstream.com/bin/powerplayer.cab
O16 - DPF: {6924091F-CD97-41E1-B1D4-D9079409D413} (IMCv1 Control) - http://202.101.62.195:1995/talk.cab
O16 - DPF: {7253A666-8D4A-11D7-A4DC-00E04C504779} (BDC Control) - http://www.xliaoliao.com/BDC.cab
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O16 - DPF: {8819C261-5B61-4628-908C-9BE795EABEC3} (IE Class) - http://www.95599.cn/download/ABC.cab
O16 - DPF: {98A62E3F-A8C5-4EF0-8A00-C70CF9D18A89} (LoaderCore Class) - http://tb.sogou.com/DLLoader.cab
O16 - DPF: {991481A7-4669-4E15-8C24-100404E1F5CB} - http://www.bluesky.cn/download/blueskyvoice_60.cab
O16 - DPF: {ACFE8232-03C5-4AEC-AF5E-42B806724096} (KSHScan Control) - http://scan.kingsoft.com/scan/fangyi/KAllScan.CAB
O16 - DPF: {DA984A6D-508E-11D6-AA49-0050FF3C628D} (Ravonline) - http://download.rising.com.cn/ravkill/rsonline.cab
O16 - DPF: {F381FC65-D92D-4410-B865-E4E9713994E8} (Cytd Encipherment Memory) - http://infologin.bbn.com.cn/sso/ccitpay.CAB
O16 - DPF: {FA463B6E-93D5-4E02-B7F2-E0BA98DA73FC} (SHLaunch Control) - http://61.155.9.9/SHLaunch_0935.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{12AC5DB2-86B5-4B94-9FBF-6E446531CED3}: NameServer = 202.101.224.69 202.101.226.68
O17 - HKLM\System\CS1\Services\Tcpip\..\{12AC5DB2-86B5-4B94-9FBF-6E446531CED3}: NameServer = 202.101.224.68 202.101.226.68
O17 - HKLM\System\CS2\Services\Tcpip\..\{12AC5DB2-86B5-4B94-9FBF-6E446531CED3}: NameServer = 202.101.224.69 202.101.226.68
O18 - 列举现有的协议: koboo - {7DEE9D05-FA0A-4416-A6F3-6537D0EAB6A6} - (no file)
O18 - 列举现有的协议: mbox - {7DEE9D05-FA0A-4416-A6F3-6537D0EAB6A6} - (no file)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WB - D:\WINDOW~3\fastload.dll
O23 - NT 服务: lanucher (DKLanucher) - Unknown owner - E:\Dekaron\exe\jswe.dat (file missing)
O23 - NT 服务: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - NT 服务: Kingsoft Personal Firewall Service (KPfwSvc) - Unknown owner - (no file)
O23 - NT 服务: Kingsoft Antivirus KWatch Service (KWatchSvc) - Unknown owner - (no file)
O23 - NT 服务: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - NT 服务: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - NT 服务: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - F:\瑞星2005\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - F:\瑞星2005\Rising\Rav\Ravmond.exe
O23 - NT 服务: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe

修复
O1 - Hosts: 218.201.39.85 769web.mir666.com
O1 - Hosts: 218.201.39.85 web772.jsy666.com
O1 - Hosts: 202.103.67.180 auto.search.msn.com
O2 - BHO: MemoryManager Class - {2CE7166E-8BBA-4E76-BA7E-02AB3C573011} - C:\WINDOWS\DOWNLO~1\cytdcli.dll
O2 - BHO: (no name) - {2F401A09-2F10-455E-A15D-4C8B9D8D7AEB} - C:\PROGRA~1\黄河FL~1\hhcatch.dll
O2 - BHO: NetEASE Blocker - {4106B474-4C59-4911-83BA-2053AFEC8F72} - (no file)
O2 - BHO: (no name) - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - (no file)
O2 - BHO: (no name) - {6BDE1669-B490-48E3-B668-456314F2D6C3} - (no file)
O18 - 列举现有的协议: koboo - {7DEE9D05-FA0A-4416-A6F3-6537D0EAB6A6} - (no file)
O18 - 列举现有的协议: mbox - {7DEE9D05-FA0A-4416-A6F3-6537D0EAB6A6} - (no file)
O20 - Winlogon Notify: WB - D:\WINDOW~3\fastload.dll
O23 - NT 服务: lanucher (DKLanucher) - Unknown owner - E:\Dekaron\exe\jswe.dat (file missing)
O23 - NT 服务: Kingsoft Personal Firewall Service (KPfwSvc) - Unknown owner - (no file)
O23 - NT 服务: Kingsoft Antivirus KWatch Service (KWatchSvc) - Unknown owner - (no file)
O23 - NT 服务: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
删除
C:\WINDOWS\DOWNLO~1\cytdcli.dll
C:\PROGRA~1\黄河FL~1\hhcatch.dll

http://www.pctutu.com/srmsdown.asp
下载超级兔子..用超级兔子清理王卸载流氓软件...(安全模式...)

图

附件: 6323982006717114838.JPG

怎么进来看了不都说话啊。。谁帮帮我啊。。我好怕我的QQ被偷啊。我的QQ好几千元钱啊我都不敢上QQ了。