瑞星卡卡安全论坛
安网科技 - 2006-7-28 12:31:00
我是用的路由器上的网,连着有几台机器,我的系统是WIN2003的,防火墙是卖咖啡的,最近经常被内网的用户攻击,昨天晚上被用syn flood攻击,虽然卖咖啡检测到了攻击,但之后却上不了网了,请问如何解决,有什么防御的办法,或者能反攻击的办法,高手指点
问题补充:他来攻击我的时候我正好在电脑旁,我用P2P终结者查看他的下载量超长的高,超过几千,对了,我及时更改自己的IP后,重起防火墙竟然提示我受到我以前的IP攻击,这是怎么回事啊....你说的kis是什么啊另外我重新设置了IP重起后 ,发现自己原来的IP竟然也来攻击我,是怎么回事,是不是自己的机子里中了木马,
安网科技 - 2006-7-28 13:41:00
没人知道吗?
我无邪 - 2006-7-28 14:28:00
应该是其它用户在BT下载
你让他们不下载,应该就正常了。
安网科技 - 2006-7-28 16:04:00
但是防火墙显示syn flood攻击啊
我无邪 - 2006-7-28 20:33:00
你先试试让他们不BT,看看情况怎么样。
建议你也扫份日志粘上来吧
请下载 System Repair Engineer,使用“智能扫描”,按下“扫描”按钮进行扫描,扫描完成后按下“保存报告”按钮保存报告日志文件(SREng.LOG),把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完,分次粘完,请不要修改。
安网科技 - 2006-7-28 21:22:00
HijackThis_815汉化版扫描日志 V1.99.1
保存于 21:13:26, 日期 2006-7-28
操作系统: Windows 2003 SP1 (WinNT 5.02.3790)
浏览器: Internet Explorer v6.00 SP1 (6.00.3790.1830)
当前运行的进程:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\msdtc.exe
d:\NETWOR~1\MCAFEE~1\FireSvc.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
D:\Network Associates\Common Framework\FrameworkService.exe
D:\Network Associates\VirusScan\Mcshield.exe
D:\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\NETWOR~1\COMMON~1\naPrdMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\Explorer.EXE
D:\Network Associates\VirusScan\SHSTAT.EXE
D:\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\Super Rabbit\MagicSet\DS.EXE
C:\Program Files\systems\pvv.exe
C:\WINDOWS\system32\ctfmon.exe
D:\NETWOR~1\MCAFEE~1\FireTray.exe
D:\Program Files\P2Pzjz\P2POver.exe
C:\Program Files\Internet Explorer\iexplore.exe
d:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.688\HijackThis1991zww.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\difd.exe
O3 - IE工具栏增项: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\fgiebar.dll
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [IMEKRMIG6.1] ; C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - 启动项HKLM\\Run: [PHIME2002ASync] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [ShStatEXE] "D:\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - 启动项HKLM\\Run: [McAfeeUpdaterUI] "D:\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - 启动项HKLM\\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - 启动项HKLM\\Run: [SoundMan] SOUNDMAN.EXE
O4 - 启动项HKLM\\Run: [StormCodec_Helper] "d:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti
O4 - 启动项HKLM\\Run: [Super Rabbit Desktop Set] D:\Program Files\Super Rabbit\MagicSet\DS.EXE /Load
O4 - 启动项HKLM\\Run: [3721] C:\Program Files\systems\pvv.exe
O4 - 启动项HKLM\\Run: [baidu] C:\Program Files\systems\Call.exe
O4 - 启动项HKLM\\Run: [Str3] hongqt
O4 - 启动项HKLM\\Run: [LongData] 焼
O4 - 启动项HKLM\\Run: [BinaryData] "3D梯
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: McAfee Desktop Firewall 任务栏.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - D:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载 - D:\PROGRA~1\FLASHGET\jc_link.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链接 - D:\PROGRA~1\FLASHGET\jc_all.htm
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - D:\Program Files\Tencent\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - D:\Program Files\Tencent\QQ\SendMMS.htm
O9 - 浏览器额外的按钮: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\flashget.exe
O9 - 浏览器额外的“工具”菜单项: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\flashget.exe
O10 - 未知的文件在 Winsock LSP: c:\windows\system32\wshcon32.dll
O10 - 未知的文件在 Winsock LSP: c:\windows\system32\wshcon32.dll
O16 - DPF: {A3CD7F74-93C9-4BC4-B892-CCDF1514F714} (Submit Class) - https://pbank.95559.com.cn/personbank/ocx/safe.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7674EE12-B3FE-4E8A-B213-DBC201249CFB}: NameServer = 61.147.37.1,61.177.7.1
O18 - Filter: text/html - {E7009873-0D40-45B1-8D59-5B9AE98C7D38} - C:\Program Files\Internet Explorer\Connection Wizard\icwnet.dll
O20 - Winlogon Notify: dimsntfy - C:\WINDOWS\SYSTEM32\dimsntfy.dll
O23 - NT 服务: McAfee Desktop Firewall Service (FireSvc) - Networks Associates Technology, Inc. - d:\NETWOR~1\MCAFEE~1\FireSvc.exe
O23 - NT 服务: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - NT 服务: McAfee Framework 服务 (McAfeeFramework) - Network Associates, Inc. - D:\Network Associates\Common Framework\FrameworkService.exe
O23 - NT 服务: Network Associates McShield (McShield) - Network Associates, Inc. - D:\Network Associates\VirusScan\Mcshield.exe
O23 - NT 服务: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - D:\Network Associates\VirusScan\VsTskMgr.exe
安网科技 - 2006-7-28 21:25:00
syn flood攻击和BT有什么关系啊
安网科技 - 2006-7-28 21:39:00
下面是用System Repair Engineer扫描的
2006-07-28,21:27:07
System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)
Windows Server 2003 Standard Edition Service Pack 1 (Build 3790)
- 管理权限用户 - 完整功能
以下内容被选中:
所有的启动项目(包括注册表、启动文件夹、服务等)
浏览器加载项
正在运行的进程(包括进程模块信息)
文件关联
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation]
<IMEKRMIG6.1><; C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE> [Microsoft Corporation]
<PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation]
<PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]
<ShStatEXE><"D:\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE> [Network Associates, Inc.]
<McAfeeUpdaterUI><"D:\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey> [Network Associates, Inc.]
<Network Associates Error Reporting Service><"C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"> [Network Associates, Inc.]
<SoundMan><SOUNDMAN.EXE> [Avance Logic, Inc.]
<StormCodec_Helper><"d:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti> []
<Super Rabbit Desktop Set><D:\Program Files\Super Rabbit\MagicSet\DS.EXE /Load> [Super Rabbit Software]
<baidu><C:\Program Files\systems\Call.exe> []
<Str3><hongqt> []
<LongData><焼> []
<BinaryData><"3D梯> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\difd.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><%SystemRoot%\system32\logonui.exe> [Microsoft Corporation]
==================================
启动文件夹
[Adobe Gamma Loader]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Gamma Loader.lnk><N>
[McAfee Desktop Firewall 任务栏]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\McAfee Desktop Firewall 任务栏.lnk><N>
==================================
服务
[McAfee Desktop Firewall Service / FireSvc]
<d:\NETWOR~1\MCAFEE~1\FireSvc.exe><Networks Associates Technology, Inc.>
[Macromedia Licensing Service / Macromedia Licensing Service]
<"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><N/A>
[McAfee Framework 服务 / McAfeeFramework]
<D:\Network Associates\Common Framework\FrameworkService.exe /ServiceStart><Network Associates, Inc.>
[Network Associates McShield / McShield]
<"D:\Network Associates\VirusScan\Mcshield.exe"><Network Associates, Inc.>
[Network Associates Task Manager / McTaskManager]
<"D:\Network Associates\VirusScan\VsTskMgr.exe"><Network Associates, Inc.>
==================================
浏览器加载项
[FlashGet]
{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <D:\PROGRA~1\FLASHGET\flashget.exe, FlashGet.com>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <D:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[Submit Class]
{A3CD7F74-93C9-4BC4-B892-CCDF1514F714} <C:\WINDOWS\Downloaded Program Files\safein.dll, Beijing eChannels Century Technology Co.,Ltd>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[FltSetUp Class]
{1D49D58D-5C84-4B50-8359-D9809BEB2B32} <C:\Program Files\Internet Explorer\Connection Wizard\icwnet.dll, N/A>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[XML DOM Document]
{2933BF90-7B36-11D2-B20E-00C04F983E60} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[IeCatch5 Class]
{2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <D:\PROGRA~1\FLASHGET\jccatch.dll, FlashGet>
[Yahoo Ie-Bar]
{4FCE0A2B-6D48-4B22-AD7A-1ACACABC0B38} <C:\WINDOWS\twuenk_16.dll, N/A>
[HHCtrl Object]
{52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <d:\Program Files\Tencent\QQ\QQIEHelper.dll, N/A>
[XML Data Source Object]
{550DDA30-0541-11D2-9CA9-0060B0EC3D39} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Macrosoft Class]
{58DB541D-F15A-4E95-A5D9-5DF5EE13920C} <c:\windows\system32\winlogin.dll, N/A>
[ActiveBHO Class]
{63C55A7F-6E29-8D4F-5C76-4F850F28D13A} <C:\Progra~1\DoDoorRSSFinder\ActiveBandObject.dll, N/A>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[XML HTTP 4.0]
{88D969C5-F192-11D4-A65F-0040963251E5} <C:\WINDOWS\system32\msxml4.dll, Microsoft Corporation>
[IEHlprObj Class]
{999ADFA2-8AD1-47FF-97FC-69FB847458F4} <C:\Progra~1\NetMeeting\nmview.dll, Microsoft Corporation>
[Submit Class]
{A3CD7F74-93C9-4BC4-B892-CCDF1514F714} <C:\WINDOWS\Downloaded Program Files\safein.dll, Beijing eChannels Century Technology Co.,Ltd>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE6]
{BF3FF9A2-AC03-40A1-BA0F-F31076325AA7} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[AUDIO__MP3 Moniker Class]
{CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
{CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Msxml]
{CFC399AF-D876-11D0-9C10-00C04FC99C8E} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[IEHlprObj Class]
{D424FE4E-CAF9-4FDD-BC5F-E6E6B91D53BF} <C:\Progra~1\NetMeeting\conf.dll, N/A>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <D:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[FlashFXP Helper for Internet Explorer]
{E5A1691B-D188-4419-AD02-90002030B8EE} <d:\PROGRA~1\FlashFXP\IEFlash.dll, IniCom Networks, Inc.>
[safeInput Class]
{ECCBA953-80E5-11D3-9285-0080ADB811C5} <C:\WINDOWS\Downloaded Program Files\safein.dll, Beijing eChannels Century Technology Co.,Ltd>
[TimwpDll.TimwpCheck]
{ED4CA2E5-0EEA-44C1-AD7E-74A07A7507A4} <D:\PROGRA~1\Tencent\QQ\Timwp.dll, >
[XML HTTP Request]
{ED8C108E-4349-11D2-91A4-00C04F7969E8} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[Letscool System Helper]
{F0C15012-7DBD-4068-95A2-0A82DB03AC35} <C:\WINDOWS\system32\CoolBho.dll, N/A>
[XML DOM Document]
{F6D90F11-9C73-11D3-B32E-00C04F990BB4} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[Free Threaded XML DOM Document]
{F6D90F12-9C73-11D3-B32E-00C04F990BB4} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[XML HTTP]
{F6D90F16-9C73-11D3-B32E-00C04F990BB4} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[上传到QQ网络硬盘]
<D:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用网际快车下载]
<D:\PROGRA~1\FLASHGET\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<D:\PROGRA~1\FLASHGET\jc_all.htm, N/A>
[添加到QQ自定义面板]
<D:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<D:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<D:\Program Files\Tencent\QQ\SendMMS.htm, N/A>
==================================
安网科技 - 2006-7-28 21:41:00
正在运行的进程
[PID: 348][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[PID: 396][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.2.3790.0 (srv03_rtm.030324-2048)>
[PID: 420][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[PID: 464][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 0, 0, 0>
[C:\WINDOWS\system32\EntApi.dll] <Network Associates, Inc><8.0.0.240>
[PID: 476][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.2.3790.0 (srv03_rtm.030324-2048)>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 0, 0, 0>
[C:\WINDOWS\system32\EntApi.dll] <Network Associates, Inc><8.0.0.240>
[PID: 656][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[C:\WINDOWS\system32\EntApi.dll] <Network Associates, Inc><8.0.0.240>
[PID: 716][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 0, 0, 0>
[C:\WINDOWS\system32\EntApi.dll] <Network Associates, Inc><8.0.0.240>
[PID: 756][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 0, 0, 0>
[C:\WINDOWS\system32\EntApi.dll] <Network Associates, Inc><8.0.0.240>
[PID: 792][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[C:\WINDOWS\system32\EntApi.dll] <Network Associates, Inc><8.0.0.240>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 0, 0, 0>
[PID: 832][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[C:\WINDOWS\system32\EntApi.dll] <Network Associates, Inc><8.0.0.240>
[PID: 984][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 0, 0, 0>
[PID: 1044][C:\WINDOWS\system32\msdtc.exe] <Microsoft Corporation><2001.12.4720.1830 (srv03_sp1_rtm.050324-1447)>
[PID: 1168][d:\NETWOR~1\MCAFEE~1\FireSvc.exe] <Networks Associates Technology, Inc.><8.0>
[C:\WINDOWS\system32\FireCore.dll] <Networks Associates Technology, Inc.><2.5>
[C:\WINDOWS\system32\FireCNL.dll] <Networks Associates Technology, Inc.><2.5>
[C:\WINDOWS\system32\FireCUI.dll] <Networks Associates Technology, Inc.><2.5>
[d:\NETWOR~1\MCAFEE~1\Resource\0804\NetShrRL.dll] <Networks Associates Technology, Inc.><8.0>
[PID: 1216][C:\WINDOWS\system32\inetsrv\inetinfo.exe] <Microsoft Corporation><6.0.3790.1830 (srv03_sp1_rtm.050324-1447)>
[C:\WINDOWS\system32\EntApi.dll] <Network Associates, Inc><8.0.0.240>
[PID: 1288][D:\Network Associates\Common Framework\FrameworkService.exe] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\nailog.dll] <Network Associates, Inc.><3.5.0.474>
[D:\Network Associates\Common Framework\naXML.dll] <Network Associates, Inc.><3.5.0.474>
[D:\Network Associates\Common Framework\naCmnLib.dll] <Network Associates, Inc.><3.5.0.474>
[D:\Network Associates\Common Framework\applib.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\0804\AgentRes.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\Logging.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\InternetManager.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\naInet.dll] <Network Associates, Inc.><3.5.0.474>
[D:\Network Associates\Common Framework\UserSpace.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\SecureFrameworkFactory.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\Management.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\cmalib.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\naPolicyManager.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\ScriptSubSys.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\UpdateSubSys.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\Scheduler.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\TCSubSys.dll] <Network Associates, Inc.><3.5.0.412>
[C:\WINDOWS\system32\EntApi.dll] <Network Associates, Inc><8.0.0.240>
安网科技 - 2006-7-28 21:42:00
[PID: 1364][D:\Network Associates\VirusScan\Mcshield.exe] <Network Associates, Inc.><8.0.0.251>
[D:\Network Associates\VirusScan\Res04\McShield.DLL] <Network Associates, Inc.><8.0.0.251>
[D:\Network Associates\VirusScan\FTL.Dll] <Network Associates, Inc.><8.0.0.133>
[D:\Network Associates\VirusScan\naiann.dll] <Network Associates, Inc.><8.0.0.251>
[D:\Network Associates\VirusScan\mytilus.dll] <Network Associates, Inc.><8.0.0.251>
[D:\Network Associates\Common Framework\GenEvtInf.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\VirusScan\NaEventU.DLL] <Network Associates, Inc.><8.0.0.342>
[D:\Network Associates\VirusScan\Res04\naEvtRes.dll] <Network Associates, Inc.><8.0.0.342>
[D:\Network Associates\VirusScan\VSIDSvr.dll] <Network Associates, Inc.><8.0.0.251>
[C:\Program Files\Common Files\Network Associates\Engine\MCSCAN32.DLL] <McAfee, Inc.><4.4.00>
[D:\Network Associates\Common Framework\SecureFrameworkFactory.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\VirusScan\EntSrv.Dll] <Network Associates, Inc><8.0.0.240>
[PID: 1384][D:\Network Associates\VirusScan\VsTskMgr.exe] <Network Associates, Inc.><8.0.0.912>
[D:\Network Associates\VirusScan\SHUTIL.dll] <Network Associates, Inc.><8.0.0.912>
[D:\Network Associates\VirusScan\naiwmain.dll] <Network Associates, Inc.><8.0.0.912>
[D:\Network Associates\VirusScan\naicondl.dll] <Network Associates, Inc.><8.0.0.912>
[D:\Network Associates\VirusScan\RES04\VsTskMgr.dll] <Network Associates, Inc.><8.0.0.912>
[D:\Network Associates\VirusScan\MIDUtil.Dll] <Network Associates, Inc.><8.0.0.145>
[PID: 1448][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[C:\WINDOWS\system32\EntApi.dll] <Network Associates, Inc><8.0.0.240>
[PID: 1536][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[C:\WINDOWS\system32\EntApi.dll] <Network Associates, Inc><8.0.0.240>
[PID: 1700][D:\NETWOR~1\COMMON~1\naPrdMgr.exe] <Network Associates, Inc.><3.5.0.412>
[D:\NETWOR~1\COMMON~1\nailog.dll] <Network Associates, Inc.><3.5.0.474>
[D:\NETWOR~1\COMMON~1\naCmnLib.dll] <Network Associates, Inc.><3.5.0.474>
[D:\NETWOR~1\COMMON~1\naXML.dll] <Network Associates, Inc.><3.5.0.474>
[D:\NETWOR~1\COMMON~1\0804\AgentRes.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\VirusScan\VsPlugin.dll] <Network Associates, Inc.><8.0.0.912>
[C:\WINDOWS\system32\FireePO.dll] <Networks Associates Technology, Inc.><8.0>
[C:\WINDOWS\system32\FireCL.dll] <Networks Associates Technology, Inc.><8.0>
[C:\WINDOWS\system32\FireCore.dll] <Networks Associates Technology, Inc.><2.5>
[C:\WINDOWS\system32\FireCNL.dll] <Networks Associates Technology, Inc.><2.5>
[C:\WINDOWS\system32\FireCUI.dll] <Networks Associates Technology, Inc.><2.5>
[d:\NETWOR~1\MCAFEE~1\Resource\0804\CLibRL.dll] <Networks Associates Technology, Inc.><8.0>
[C:\WINDOWS\system32\EntApi.dll] <Network Associates, Inc><8.0.0.240>
[PID: 1964][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[C:\WINDOWS\system32\EntApi.dll] <Network Associates, Inc><8.0.0.240>
[PID: 2036][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 0, 0, 0>
[PID: 2352][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[PID: 2556][C:\WINDOWS\system32\wbem\wmiprvse.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[PID: 2856][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.3790.1830 (srv03_sp1_rtm.050324-1447)>
[PID: 2912][D:\Network Associates\VirusScan\SHSTAT.EXE] <Network Associates, Inc.><8.0.0.912>
[D:\Network Associates\VirusScan\SHUTIL.dll] <Network Associates, Inc.><8.0.0.912>
[D:\Network Associates\VirusScan\naiwmain.dll] <Network Associates, Inc.><8.0.0.912>
[D:\Network Associates\VirusScan\RES04\shstat.dll] <Network Associates, Inc.><8.0.0.912>
[D:\Network Associates\VirusScan\RES04\Product.dll] <Network Associates, Inc.><8.0.0.912>
[D:\Network Associates\VirusScan\RES04\McShield.dll] <Network Associates, Inc.><8.0.0.251>
[D:\Network Associates\VirusScan\RES04\Shutilrc.dll] <Network Associates, Inc.><8.0.0.912>
[D:\Network Associates\VirusScan\Graphics.dll] <Network Associates, Inc.><8.0.0.912>
[PID: 2924][D:\Network Associates\Common Framework\UpdaterUI.exe] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\nailog.dll] <Network Associates, Inc.><3.5.0.474>
[D:\Network Associates\Common Framework\naCmnLib.dll] <Network Associates, Inc.><3.5.0.474>
[D:\Network Associates\Common Framework\naXML.dll] <Network Associates, Inc.><3.5.0.474>
[D:\Network Associates\Common Framework\0804\UpdRes.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\0804\AgentRes.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\SecureFrameworkFactory.dll] <Network Associates, Inc.><3.5.0.412>
安网科技 - 2006-7-28 21:42:00
[PID: 2932][C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe] <Network Associates, Inc.><2.0.275.0>
[PID: 2944][C:\WINDOWS\SOUNDMAN.EXE] <Avance Logic, Inc.><5.0.02>
[PID: 2968][D:\Program Files\Super Rabbit\MagicSet\DS.EXE] <Super Rabbit Software><1.50>
[PID: 3012][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[PID: 3040][D:\NETWOR~1\MCAFEE~1\FireTray.exe] <Networks Associates Technology, Inc.><8.0>
[C:\WINDOWS\system32\FireCL.dll] <Networks Associates Technology, Inc.><8.0>
[C:\WINDOWS\system32\FireCore.dll] <Networks Associates Technology, Inc.><2.5>
[C:\WINDOWS\system32\FireCNL.dll] <Networks Associates Technology, Inc.><2.5>
[C:\WINDOWS\system32\FireCUI.dll] <Networks Associates Technology, Inc.><2.5>
[d:\NETWOR~1\MCAFEE~1\Resource\0804\CLibRL.dll] <Networks Associates Technology, Inc.><8.0>
[d:\NETWOR~1\MCAFEE~1\nailite.dll] <Network Associates, Inc.><1.0.452>
[d:\NETWOR~1\MCAFEE~1\Resource\0804\TrayRL.dll] <Networks Associates Technology, Inc.><8.0>
[PID: 3160][D:\Program Files\P2Pzjz\P2POver.exe] <><2, 0, 0, 5>
[D:\Program Files\P2Pzjz\wpcap.dll] <Politecnico di Torino><3, 0, 0, 18>
[D:\Program Files\P2Pzjz\pthreadVC.dll] <N/A><N/A>
[D:\Program Files\P2Pzjz\packet.dll] <Politecnico di Torino><3, 0, 0, 18>
[D:\Program Files\P2Pzjz\DBdll.dll] <><1, 0, 0, 1>
[PID: 3244][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.3790.1830 (srv03_sp1_rtm.050324-1447)>
[D:\Network Associates\VirusScan\scriptproxy.dll] <Network Associates, Inc.><8.0.0.912>
[D:\Network Associates\VirusScan\mytilus.dll] <Network Associates, Inc.><8.0.0.251>
[D:\Network Associates\VirusScan\Res04\McShield.dll] <Network Associates, Inc.><8.0.0.251>
[C:\Program Files\Common Files\Network Associates\Engine\mcscan32.dll] <McAfee, Inc.><4.4.00>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 0, 0, 0>
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] <Adobe Systems, Inc.><9,0,16,0>
[C:\WINDOWS\system32\msdmo.dll] <N/A><N/A>
[C:\WINDOWS\system32\l3codeca.acm] <Fraunhofer Institut Integrierte Schaltungen IIS><1, 9, 0, 0305>
[C:\WINDOWS\system32\ffdshow.ax] <N/A><1.0.2.1997>
[d:\Program Files\Ringz Studio\Storm Codec\Codecs\VSFilter.dll] <Gabest><1, 0, 1, 3>
[PID: 808][C:\Program Files\Windows Media Player\wmplayer.exe] <Microsoft Corporation><10.00.00.3700>
[D:\Network Associates\VirusScan\scriptproxy.dll] <Network Associates, Inc.><8.0.0.912>
[D:\Network Associates\VirusScan\mytilus.dll] <Network Associates, Inc.><8.0.0.251>
[D:\Network Associates\VirusScan\Res04\McShield.dll] <Network Associates, Inc.><8.0.0.251>
[C:\Program Files\Common Files\Network Associates\Engine\mcscan32.dll] <McAfee, Inc.><4.4.00>
[C:\WINDOWS\system32\msdmo.dll] <N/A><N/A>
[C:\WINDOWS\system32\l3codeca.acm] <Fraunhofer Institut Integrierte Schaltungen IIS><1, 9, 0, 0305>
[C:\WINDOWS\system32\ffdshow.ax] <N/A><1.0.2.1997>
[d:\Program Files\Ringz Studio\Storm Codec\Codecs\VSFilter.dll] <Gabest><1, 0, 1, 3>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 0, 0, 0>
[PID: 2784][d:\Program Files\WinRAR\WinRAR.exe] <N/A><N/A>
[PID: 3024][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX02.359\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 0, 0, 0>
安网科技 - 2006-7-28 21:42:00
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
==================================
我无邪 - 2006-7-28 21:52:00
C:\Program Files\systems\pvv.exe
C:\Program Files\systems\Call.exe
这两项我感觉可疑,如果你也不知道,建议删除
关闭所有浏览窗口以及一些不必要的程序
运行(双击)System Repair Engineer,使用“系统修复,浏览器加载项”来删除以下选项
c:\windows\system32\winlogin.dll
C:\WINDOWS\Downloaded Program Files\safein.dll
C:\WINDOWS\system32\CoolBho.dll
修复以下选项
C:\WINDOWS\system32\wshcon32.dll
有一定的危险性,如果你愿意,可以这样做。(建议你去做,虽然有一些风险)
请到http://forum.ikaka.com/topic.asp?board=67&artid=5188931,下载,LSPFix.exe,WinsockXPFix这两个软件
重新启动电脑, 开机检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式进入Windows
运行(双击)System Repair Engineer,使用“启动项目,注册表”来删除以下选项。
C:\Program Files\systems\Call.exe
运行LSPFix.exe
删除
wshcon32.dll
附说明一份
LSPFix.exe这个软件主要用来辅助修复HijackThis扫描发现的O10项。
使用时,请关闭所有IE界面和文件夹界面后运行LSPFix,运行后,把要修复的那一个O10项从左边转到右边,点“Finish”即可。(不过这之前,需要在“I know what I`m doing”前面打勾。)
双击我的电脑,工具,文件夹选项,查看,单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件(推荐)"复选框。在提示确定更改时,单击“是”,清除“隐藏已知文件类型的扩展名
删除
c:\windows\system32\winlogin.dll
C:\WINDOWS\Downloaded Program Files\safein.dll
C:\WINDOWS\system32\CoolBho.dll
C:\WINDOWS\system32\wshcon32.dll
C:\Program Files\systems
修复后重启,如果无法上网,请运行WinsockXPFix,让它修复一下。
回到正常模式
关于这一项
C:\WINDOWS\system32\userinit.exe,C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\difd.exe
看以下的帖子
http://forum.ikaka.com/topic.asp?board=28&artid=8122808
修复后,请再扫份日志粘上来。
安网科技 - 2006-7-28 22:27:00
2006-07-28,22:16:50
System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)
Windows Server 2003 Standard Edition Service Pack 1 (Build 3790)
- 管理权限用户 - 完整功能
以下内容被选中:
所有的启动项目(包括注册表、启动文件夹、服务等)
浏览器加载项
正在运行的进程(包括进程模块信息)
文件关联
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation]
<IMEKRMIG6.1><; C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE> [Microsoft Corporation]
<PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation]
<PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]
<ShStatEXE><"D:\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE> [Network Associates, Inc.]
<McAfeeUpdaterUI><"D:\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey> [Network Associates, Inc.]
<Network Associates Error Reporting Service><"C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"> [Network Associates, Inc.]
<SoundMan><SOUNDMAN.EXE> [Avance Logic, Inc.]
<StormCodec_Helper><"d:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti> []
<Super Rabbit Desktop Set><D:\Program Files\Super Rabbit\MagicSet\DS.EXE /Load> [Super Rabbit Software]
<baidu><C:\Program Files\systems\Call.exe> []
<Str3><hongqt> []
<LongData><焼> []
<BinaryData><"3D梯> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><%SystemRoot%\system32\logonui.exe> [Microsoft Corporation]
==================================
启动文件夹
[Adobe Gamma Loader]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Gamma Loader.lnk><N>
[McAfee Desktop Firewall 任务栏]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\McAfee Desktop Firewall 任务栏.lnk><N>
==================================
服务
[McAfee Desktop Firewall Service / FireSvc]
<d:\NETWOR~1\MCAFEE~1\FireSvc.exe><Networks Associates Technology, Inc.>
[Macromedia Licensing Service / Macromedia Licensing Service]
<"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><N/A>
[McAfee Framework 服务 / McAfeeFramework]
<D:\Network Associates\Common Framework\FrameworkService.exe /ServiceStart><Network Associates, Inc.>
[Network Associates McShield / McShield]
<"D:\Network Associates\VirusScan\Mcshield.exe"><Network Associates, Inc.>
[Network Associates Task Manager / McTaskManager]
<"D:\Network Associates\VirusScan\VsTskMgr.exe"><Network Associates, Inc.>
==================================
浏览器加载项
[FlashGet]
{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <D:\PROGRA~1\FLASHGET\flashget.exe, FlashGet.com>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <D:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[FltSetUp Class]
{1D49D58D-5C84-4B50-8359-D9809BEB2B32} <C:\Program Files\Internet Explorer\Connection Wizard\icwnet.dll, N/A>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[XML DOM Document]
{2933BF90-7B36-11D2-B20E-00C04F983E60} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[IeCatch5 Class]
{2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <D:\PROGRA~1\FLASHGET\jccatch.dll, FlashGet>
[Yahoo Ie-Bar]
{4FCE0A2B-6D48-4B22-AD7A-1ACACABC0B38} <C:\WINDOWS\twuenk_16.dll, N/A>
[HHCtrl Object]
{52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <d:\Program Files\Tencent\QQ\QQIEHelper.dll, N/A>
[XML Data Source Object]
{550DDA30-0541-11D2-9CA9-0060B0EC3D39} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[ActiveBHO Class]
{63C55A7F-6E29-8D4F-5C76-4F850F28D13A} <C:\Progra~1\DoDoorRSSFinder\ActiveBandObject.dll, N/A>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[XML HTTP 4.0]
{88D969C5-F192-11D4-A65F-0040963251E5} <C:\WINDOWS\system32\msxml4.dll, Microsoft Corporation>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE6]
{BF3FF9A2-AC03-40A1-BA0F-F31076325AA7} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[AUDIO__MP3 Moniker Class]
{CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
{CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Msxml]
{CFC399AF-D876-11D0-9C10-00C04FC99C8E} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[IEHlprObj Class]
{D424FE4E-CAF9-4FDD-BC5F-E6E6B91D53BF} <C:\Progra~1\NetMeeting\conf.dll, N/A>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <D:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[FlashFXP Helper for Internet Explorer]
{E5A1691B-D188-4419-AD02-90002030B8EE} <d:\PROGRA~1\FlashFXP\IEFlash.dll, IniCom Networks, Inc.>
[safeInput Class]
{ECCBA953-80E5-11D3-9285-0080ADB811C5} <C:\WINDOWS\Downloaded Program Files\safein.dll, Beijing eChannels Century Technology Co.,Ltd>
[TimwpDll.TimwpCheck]
{ED4CA2E5-0EEA-44C1-AD7E-74A07A7507A4} <D:\PROGRA~1\Tencent\QQ\Timwp.dll, >
[XML HTTP Request]
{ED8C108E-4349-11D2-91A4-00C04F7969E8} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[XML DOM Document]
{F6D90F11-9C73-11D3-B32E-00C04F990BB4} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[Free Threaded XML DOM Document]
{F6D90F12-9C73-11D3-B32E-00C04F990BB4} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[XML HTTP]
{F6D90F16-9C73-11D3-B32E-00C04F990BB4} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[上传到QQ网络硬盘]
<D:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用网际快车下载]
<D:\PROGRA~1\FLASHGET\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<D:\PROGRA~1\FLASHGET\jc_all.htm, N/A>
安网科技 - 2006-7-28 22:28:00
正在运行的进程
[PID: 348][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[PID: 396][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.2.3790.0 (srv03_rtm.030324-2048)>
[PID: 420][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[PID: 464][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 0, 0, 0>
[C:\WINDOWS\system32\EntApi.dll] <Network Associates, Inc><8.0.0.240>
[PID: 476][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.2.3790.0 (srv03_rtm.030324-2048)>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 0, 0, 0>
[C:\WINDOWS\system32\EntApi.dll] <Network Associates, Inc><8.0.0.240>
[PID: 656][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[C:\WINDOWS\system32\EntApi.dll] <Network Associates, Inc><8.0.0.240>
[PID: 716][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 0, 0, 0>
[C:\WINDOWS\system32\EntApi.dll] <Network Associates, Inc><8.0.0.240>
[PID: 756][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 0, 0, 0>
[C:\WINDOWS\system32\EntApi.dll] <Network Associates, Inc><8.0.0.240>
[PID: 792][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[C:\WINDOWS\system32\EntApi.dll] <Network Associates, Inc><8.0.0.240>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 0, 0, 0>
[PID: 832][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[C:\WINDOWS\system32\EntApi.dll] <Network Associates, Inc><8.0.0.240>
[PID: 984][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 0, 0, 0>
[PID: 1044][C:\WINDOWS\system32\msdtc.exe] <Microsoft Corporation><2001.12.4720.1830 (srv03_sp1_rtm.050324-1447)>
[PID: 1168][d:\NETWOR~1\MCAFEE~1\FireSvc.exe] <Networks Associates Technology, Inc.><8.0>
[C:\WINDOWS\system32\FireCore.dll] <Networks Associates Technology, Inc.><2.5>
[C:\WINDOWS\system32\FireCNL.dll] <Networks Associates Technology, Inc.><2.5>
[C:\WINDOWS\system32\FireCUI.dll] <Networks Associates Technology, Inc.><2.5>
[d:\NETWOR~1\MCAFEE~1\Resource\0804\NetShrRL.dll] <Networks Associates Technology, Inc.><8.0>
[PID: 1216][C:\WINDOWS\system32\inetsrv\inetinfo.exe] <Microsoft Corporation><6.0.3790.1830 (srv03_sp1_rtm.050324-1447)>
[C:\WINDOWS\system32\EntApi.dll] <Network Associates, Inc><8.0.0.240>
[PID: 1288][D:\Network Associates\Common Framework\FrameworkService.exe] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\nailog.dll] <Network Associates, Inc.><3.5.0.474>
[D:\Network Associates\Common Framework\naXML.dll] <Network Associates, Inc.><3.5.0.474>
[D:\Network Associates\Common Framework\naCmnLib.dll] <Network Associates, Inc.><3.5.0.474>
[D:\Network Associates\Common Framework\applib.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\0804\AgentRes.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\Logging.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\InternetManager.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\naInet.dll] <Network Associates, Inc.><3.5.0.474>
[D:\Network Associates\Common Framework\UserSpace.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\SecureFrameworkFactory.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\Management.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\cmalib.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\naPolicyManager.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\ScriptSubSys.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\UpdateSubSys.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\Scheduler.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\TCSubSys.dll] <Network Associates, Inc.><3.5.0.412>
[C:\WINDOWS\system32\EntApi.dll] <Network Associates, Inc><8.0.0.240>
[PID: 1364][D:\Network Associates\VirusScan\Mcshield.exe] <Network Associates, Inc.><8.0.0.251>
[D:\Network Associates\VirusScan\Res04\McShield.DLL] <Network Associates, Inc.><8.0.0.251>
[D:\Network Associates\VirusScan\FTL.Dll] <Network Associates, Inc.><8.0.0.133>
[D:\Network Associates\VirusScan\naiann.dll] <Network Associates, Inc.><8.0.0.251>
[D:\Network Associates\VirusScan\mytilus.dll] <Network Associates, Inc.><8.0.0.251>
[D:\Network Associates\Common Framework\GenEvtInf.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\VirusScan\NaEventU.DLL] <Network Associates, Inc.><8.0.0.342>
[D:\Network Associates\VirusScan\Res04\naEvtRes.dll] <Network Associates, Inc.><8.0.0.342>
[D:\Network Associates\VirusScan\VSIDSvr.dll] <Network Associates, Inc.><8.0.0.251>
[C:\Program Files\Common Files\Network Associates\Engine\MCSCAN32.DLL] <McAfee, Inc.><4.4.00>
[D:\Network Associates\Common Framework\SecureFrameworkFactory.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\VirusScan\EntSrv.Dll] <Network Associates, Inc><8.0.0.240>
安网科技 - 2006-7-28 22:29:00
[PID: 1384][D:\Network Associates\VirusScan\VsTskMgr.exe] <Network Associates, Inc.><8.0.0.912>
[D:\Network Associates\VirusScan\SHUTIL.dll] <Network Associates, Inc.><8.0.0.912>
[D:\Network Associates\VirusScan\naiwmain.dll] <Network Associates, Inc.><8.0.0.912>
[D:\Network Associates\VirusScan\naicondl.dll] <Network Associates, Inc.><8.0.0.912>
[D:\Network Associates\VirusScan\RES04\VsTskMgr.dll] <Network Associates, Inc.><8.0.0.912>
[D:\Network Associates\VirusScan\MIDUtil.Dll] <Network Associates, Inc.><8.0.0.145>
[PID: 1448][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[C:\WINDOWS\system32\EntApi.dll] <Network Associates, Inc><8.0.0.240>
[PID: 1536][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[C:\WINDOWS\system32\EntApi.dll] <Network Associates, Inc><8.0.0.240>
[PID: 1700][D:\NETWOR~1\COMMON~1\naPrdMgr.exe] <Network Associates, Inc.><3.5.0.412>
[D:\NETWOR~1\COMMON~1\nailog.dll] <Network Associates, Inc.><3.5.0.474>
[D:\NETWOR~1\COMMON~1\naCmnLib.dll] <Network Associates, Inc.><3.5.0.474>
[D:\NETWOR~1\COMMON~1\naXML.dll] <Network Associates, Inc.><3.5.0.474>
[D:\NETWOR~1\COMMON~1\0804\AgentRes.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\VirusScan\VsPlugin.dll] <Network Associates, Inc.><8.0.0.912>
[C:\WINDOWS\system32\FireePO.dll] <Networks Associates Technology, Inc.><8.0>
[C:\WINDOWS\system32\FireCL.dll] <Networks Associates Technology, Inc.><8.0>
[C:\WINDOWS\system32\FireCore.dll] <Networks Associates Technology, Inc.><2.5>
[C:\WINDOWS\system32\FireCNL.dll] <Networks Associates Technology, Inc.><2.5>
[C:\WINDOWS\system32\FireCUI.dll] <Networks Associates Technology, Inc.><2.5>
[d:\NETWOR~1\MCAFEE~1\Resource\0804\CLibRL.dll] <Networks Associates Technology, Inc.><8.0>
[C:\WINDOWS\system32\EntApi.dll] <Network Associates, Inc><8.0.0.240>
[PID: 1964][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[C:\WINDOWS\system32\EntApi.dll] <Network Associates, Inc><8.0.0.240>
[PID: 2036][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 0, 0, 0>
[PID: 2352][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[PID: 2556][C:\WINDOWS\system32\wbem\wmiprvse.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[PID: 2856][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.3790.1830 (srv03_sp1_rtm.050324-1447)>
[d:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[D:\Network Associates\VirusScan\shext.dll] <Network Associates, Inc.><8.0.0.912>
[D:\Network Associates\VirusScan\RES04\ShExtRes.dll] <Network Associates, Inc.><8.0.0.912>
[PID: 2912][D:\Network Associates\VirusScan\SHSTAT.EXE] <Network Associates, Inc.><8.0.0.912>
[D:\Network Associates\VirusScan\SHUTIL.dll] <Network Associates, Inc.><8.0.0.912>
[D:\Network Associates\VirusScan\naiwmain.dll] <Network Associates, Inc.><8.0.0.912>
[D:\Network Associates\VirusScan\RES04\shstat.dll] <Network Associates, Inc.><8.0.0.912>
[D:\Network Associates\VirusScan\RES04\Product.dll] <Network Associates, Inc.><8.0.0.912>
[D:\Network Associates\VirusScan\RES04\McShield.dll] <Network Associates, Inc.><8.0.0.251>
[D:\Network Associates\VirusScan\RES04\Shutilrc.dll] <Network Associates, Inc.><8.0.0.912>
[D:\Network Associates\VirusScan\Graphics.dll] <Network Associates, Inc.><8.0.0.912>
[PID: 2924][D:\Network Associates\Common Framework\UpdaterUI.exe] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\nailog.dll] <Network Associates, Inc.><3.5.0.474>
[D:\Network Associates\Common Framework\naCmnLib.dll] <Network Associates, Inc.><3.5.0.474>
[D:\Network Associates\Common Framework\naXML.dll] <Network Associates, Inc.><3.5.0.474>
[D:\Network Associates\Common Framework\0804\UpdRes.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\0804\AgentRes.dll] <Network Associates, Inc.><3.5.0.412>
[D:\Network Associates\Common Framework\SecureFrameworkFactory.dll] <Network Associates, Inc.><3.5.0.412>
[PID: 2932][C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe] <Network Associates, Inc.><2.0.275.0>
[PID: 2944][C:\WINDOWS\SOUNDMAN.EXE] <Avance Logic, Inc.><5.0.02>
[PID: 3012][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[PID: 3040][D:\NETWOR~1\MCAFEE~1\FireTray.exe] <Networks Associates Technology, Inc.><8.0>
[C:\WINDOWS\system32\FireCL.dll] <Networks Associates Technology, Inc.><8.0>
[C:\WINDOWS\system32\FireCore.dll] <Networks Associates Technology, Inc.><2.5>
[C:\WINDOWS\system32\FireCNL.dll] <Networks Associates Technology, Inc.><2.5>
[C:\WINDOWS\system32\FireCUI.dll] <Networks Associates Technology, Inc.><2.5>
[d:\NETWOR~1\MCAFEE~1\Resource\0804\CLibRL.dll] <Networks Associates Technology, Inc.><8.0>
[d:\NETWOR~1\MCAFEE~1\nailite.dll] <Network Associates, Inc.><1.0.452>
[d:\NETWOR~1\MCAFEE~1\Resource\0804\TrayRL.dll] <Networks Associates Technology, Inc.><8.0>
[PID: 3160][D:\Program Files\P2Pzjz\P2POver.exe] <><2, 0, 0, 5>
[D:\Program Files\P2Pzjz\wpcap.dll] <Politecnico di Torino><3, 0, 0, 18>
[D:\Program Files\P2Pzjz\pthreadVC.dll] <N/A><N/A>
[D:\Program Files\P2Pzjz\packet.dll] <Politecnico di Torino><3, 0, 0, 18>
[D:\Program Files\P2Pzjz\DBdll.dll] <><1, 0, 0, 1>
[PID: 3636][D:\新建文件夹\安装原程序\sd\日志\sreng2\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\WINDOWS\system32\wshcon32.dll] <><4, 0, 0, 0>
安网科技 - 2006-7-28 22:29:00
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
==================================
我无邪 - 2006-7-28 22:44:00
还有二个
C:\Program Files\systems\Call.exe
是你知道不是病毒,没有修复,还是无法解决??
C:\WINDOWS\system32\wshcon32.dll
这个你在安全模式下修复了吗???
请描述一下。
安网科技 - 2006-7-28 22:59:00
C:\Program Files\systems\Call.exe 这个文件我在C盘里没找到
C:\WINDOWS\system32\wshcon32.dll 这个我就是刚刚按你说的几个方法删除的,但没遇到这个
安网科技 - 2006-7-28 23:01:00
这些和syn flood攻击有关吗?
另外我想问一下,syn flood是如何攻击的,有这样的工具吗,
如何反攻击对方
我无邪 - 2006-7-28 23:16:00
C:\Program Files\systems\Call.exe这个文件找不到???
这样呢C:\Program Files\systems??
wshcon32.dll能弹出窗口,建议你再试着修复。
最后两个问题
这个无邪不知了
安网科技 - 2006-8-13 14:07:00
继续求解
Handsome_001 - 2006-9-23 13:17:00
听说是洪水攻击
Handsome_001 - 2006-9-23 13:21:00
2006-9-23 11:03:42 您的计算机受到来自192.168.0.111攻击。攻击- SYN Flood。 已成功拦截该攻击。
此攻击将向计算机发送连接请求,将导致计算机不能响应从其它信息源发起的请求.
安网科技 - 2006-10-16 21:37:00
继续求解
1
© 2000 - 2026 Rising Corp. Ltd.