瑞星卡卡安全论坛

HijackThis_815汉化版扫描日志 V1.99.1
保存于      22:26:25, 日期 2006-8-3
操作系统：  Windows XP SP2 (WinNT 5.01.2600)
浏览器：    Unable to get Internet Explorer version!

当前运行的进程：         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
E:\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
E:\Rising\Rav\Ravmond.exe
e:\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
E:\Rising\Rav\RavStub.exe
e:\rising\rfw\RfwMain.exe
C:\HP\KBD\KBD.EXE
E:\Rising\Rav\RavTask.exe
E:\Rising\Rav\Ravmon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\UberIcon\UberIcon Manager.exe
C:\WINDOWS\system32\conime.exe
E:\遨游\Maxthon\Max.exe
D:\专杀木马\HijackThis1991zww.exe

F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: ThunderIEHelper - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v13.dll
O2 - BHO: (no name) - {999ADFA2-8AD1-47ff-97FC-69FB847458F4} - (no file)
O2 - BHO: (no name) - {A9930D97-9CF0-42A0-A10D-4F28836579D5} - E:\KuGoo3\KuGoo3DownXControl.ocx
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [ATIPTA] ; "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - 启动项HKLM\\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - 启动项HKLM\\Run: [RfwMain] "E:\Rising\Rfw\rfwmain.exe" -Startup
O4 - 启动项HKLM\\Run: [RavTask] "E:\Rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [System Files Updater] ; C:\WINDOWS\FlyakiteOSX\Tools\System Files Updater.exe /S
O4 - 启动项HKLM\\Run: [BigDogPath] ; C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera
O4 - 启动项HKLM\\RunOnce: [RavStub] "E:\Rising\Rav\ravstub.exe" /RUNONCE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] ; "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RK Launcher] ; C:\Program Files\RK Launcher\RKLauncher.exe
O4 - HKCU\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe"
O4 - HKCU\..\Run: [WinRoll] ; C:\Program Files\WinRoll\winroll.exe
O4 - HKCU\..\Run: [Yz Shadow] ; C:\Program Files\YzShadow\YzShadow.exe
O4 - Startup: 新浪UC.lnk = E:\UCSetup_2005III\UC\uc.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - IE右键菜单中的新增项目: &使用迅雷下载 - E:\讯雷\geturl.htm
O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - E:\讯雷\getallurl.htm
O9 - 浏览器额外的按钮: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - F:\cs1.5\浩方对战平台\GameClient.exe
O9 - 浏览器额外的按钮: 新浪UC - {2253922F-1B26-4C74-8B57-E3AEE748DBB8} - E:\UCSetup_2005III\UC\uc.exe
O9 - 浏览器额外的按钮: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.tomatolei.com (file missing)
O10 - 未知的文件在 Winsock LSP: c:\windows\system32\wshcon32.dll
O10 - 未知的文件在 Winsock LSP: c:\windows\system32\wshcon32.dll
O14 - IERESET.INF: START_PAGE_URL=about:blank
O16 - DPF: {2354A44B-3CEB-4829-9940-545B03103538} (PowerPlr Control) - http://movie.sun116.com/plugin/PowerPlr.ocx
O16 - DPF: {3D8F74EE-8692-4F8F-B8D2-7522E732519E} (WebActivater Control) - http://game.qq.com/QQGame2.cab
O16 - DPF: {E4CF9B52-A94E-4A27-AD90-904A81D0643A} (QPicControl Control) - http://my.paipai.com/activex/qpic.cab
O16 - DPF: {E787FD25-8D7C-4693-AE67-9406BC6E22DF} (CPasswordEditCtrl Object) - https://www.tenpay.com/download/qqedit.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{22EEEDE8-4680-4526-960C-0ED96101AD2C}: NameServer = 221.5.203.98 221.5.203.99
O17 - HKLM\System\CS1\Services\Tcpip\..\{22EEEDE8-4680-4526-960C-0ED96101AD2C}: NameServer = 221.5.203.98 221.5.203.99
O18 - 列举现有的协议: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - NT 服务: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - NT 服务: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - NT 服务: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - NT 服务: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - e:\rising\rfw\rfwproxy.exe
O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - e:\rising\rfw\rfwsrv.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - E:\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - E:\Rising\Rav\Ravmond.exe

不知道为什么~~总是不行~~杀不完呀~

怎么 没有人里我呀!

要等傻眼了

我等等等~~~

O10 - 未知的文件在 Winsock LSP: c:\windows\system32\wshcon32.dll
O10 - 未知的文件在 Winsock LSP: c:\windows\system32\wshcon32.dll
需要用LSPFix 来修复..
LSPFix(汉化版) 下载地址:http://forum.ikaka.com/topic.asp?board=67&artid=5188931
(8楼...)
同时下载WinsockXPFix.exe...(2楼...)
----------------------------------------------------------------
先运行LSPFix ... 勾上 我确定要进行修复操作 ...
然后将wshcon32.dll移到右边...点下完成...
----------------------------------------------------------------
如果在操作之后不能上网...请用WinsockXPFix.exe 修复一下即可...安全模式下..

修复
O2 - BHO: (no name) - {999ADFA2-8AD1-47ff-97FC-69FB847458F4} - (no file)


http://www.pctutu.com/srmsdown.asp
下载超级兔子..用超级兔子清理王卸载流氓软件...(安全模式...)

就只是这样吗?就完了吗?不需要手动删除一些文件吗?

?????????

你还想有多少?

病毒路径..

对不起了~我只是想把病毒一起杀完~~对不起了~

这个是我在安全模式下扫的日志~你看看还有什么问题没有???谢谢了~还有就是那个02总是删不掉``
HijackThis_815汉化版扫描日志 V1.99.1
保存于      23:05:17, 日期 2006-8-3
操作系统：  Windows XP SP2 (WinNT 5.01.2600)
浏览器：    Unable to get Internet Explorer version!

当前运行的进程：         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
D:\专杀木马\HijackThis1991zww.exe

F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: ThunderIEHelper - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v13.dll
O2 - BHO: (no name) - {999ADFA2-8AD1-47ff-97FC-69FB847458F4} - (no file)
O2 - BHO: (no name) - {A9930D97-9CF0-42A0-A10D-4F28836579D5} - E:\KuGoo3\KuGoo3DownXControl.ocx
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [ATIPTA] ; "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - 启动项HKLM\\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - 启动项HKLM\\Run: [RfwMain] "E:\Rising\Rfw\rfwmain.exe" -Startup
O4 - 启动项HKLM\\Run: [RavTask] "E:\Rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [System Files Updater] ; C:\WINDOWS\FlyakiteOSX\Tools\System Files Updater.exe /S
O4 - 启动项HKLM\\Run: [BigDogPath] ; C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera
O4 - 启动项HKLM\\RunOnce: [Super Rabbit Winspeed] "E:\MagicSet\MagicSet\winspeed.exe" /autokill:26
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] ; "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RK Launcher] ; C:\Program Files\RK Launcher\RKLauncher.exe
O4 - HKCU\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe"
O4 - HKCU\..\Run: [WinRoll] ; C:\Program Files\WinRoll\winroll.exe
O4 - HKCU\..\Run: [Yz Shadow] ; C:\Program Files\YzShadow\YzShadow.exe
O4 - Startup: 新浪UC.lnk = E:\UCSetup_2005III\UC\uc.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - IE右键菜单中的新增项目: &使用迅雷下载 - E:\讯雷\geturl.htm
O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - E:\讯雷\getallurl.htm
O9 - 浏览器额外的按钮: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - F:\cs1.5\浩方对战平台\GameClient.exe
O9 - 浏览器额外的按钮: 新浪UC - {2253922F-1B26-4C74-8B57-E3AEE748DBB8} - E:\UCSetup_2005III\UC\uc.exe
O9 - 浏览器额外的按钮: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.tomatolei.com (file missing)
O14 - IERESET.INF: START_PAGE_URL=about:blank
O16 - DPF: {2354A44B-3CEB-4829-9940-545B03103538} (PowerPlr Control) - http://movie.sun116.com/plugin/PowerPlr.ocx
O16 - DPF: {3D8F74EE-8692-4F8F-B8D2-7522E732519E} (WebActivater Control) - http://game.qq.com/QQGame2.cab
O16 - DPF: {E4CF9B52-A94E-4A27-AD90-904A81D0643A} (QPicControl Control) - http://my.paipai.com/activex/qpic.cab
O16 - DPF: {E787FD25-8D7C-4693-AE67-9406BC6E22DF} (CPasswordEditCtrl Object) - https://www.tenpay.com/download/qqedit.cab
O18 - 列举现有的协议: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - NT 服务: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - NT 服务: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - NT 服务: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - NT 服务: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - e:\rising\rfw\rfwproxy.exe
O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - e:\rising\rfw\rfwsrv.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - E:\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - E:\Rising\Rav\Ravmond.exe

你还在吗?

不知道你还在不在哦!

一定要让你看到!

盼你归来~

等你~

坚持就是胜利~一定要在这里等到你!

还是没有来~

/....别灌好吧...


你病毒路径说下..

啊````这个我不会呀~~~你教教我好不??怎么看!??

病毒名称处理结果发现日期扫描方式路径文件病毒来源
Trojan.DL.ADLoad.ei删除成功2006-07-19 22:31其它嵌入杀毒F:\cs1.5install.rar >>Setup.exe>>101596.exe本机
Trojan.Clicker.Agent.abx删除成功2006-07-19 22:31其它嵌入杀毒F:\cs1.5install.rar >>Setup.exe>>do_566.exe>>LoadDriver.exe本机
Trojan.Agent.dfm删除成功2006-07-19 22:31其它嵌入杀毒F:\cs1.5install.rar >>Setup.exe>>1202.exe>>xboxcenter.dll本机
Trojan.DL.Agent.kab删除成功2006-07-19 22:35其它嵌入杀毒F:\cs1.5install.rar >>Setup.exe>>1202.exe>>ehuupdate.exe本机
Backdoor.Agent.dbv删除成功2006-07-19 22:35其它嵌入杀毒F:\cs1.5install.rar >>Setup.exe>>1202.exe本机
Trojan.DL.Diyer.a删除成功2006-07-19 22:36其它嵌入杀毒F:\cs1.5install.rar >>Setup.exe>>4022.exe>>tool.exe本机
Backdoor.Agent.ddb清除成功2006-07-19 22:40手动扫描Explorer.EXE>>C:\WINDOWS\Explorer.EXE本机
Trojan.DL.ADLoad.ei删除成功2006-07-19 22:43手动扫描C:\Documents and Settings\wb\Local Settings\Temp\Rar$EX00.000Setup.exe>>101596.exe本机
Trojan.Clicker.Agent.abx删除成功2006-07-19 22:43手动扫描C:\Documents and Settings\wb\Local Settings\Temp\Rar$EX00.000Setup.exe>>do_566.exe>>LoadDriver.exe本机
Trojan.Agent.dfm删除成功2006-07-19 22:43手动扫描C:\Documents and Settings\wb\Local Settings\Temp\Rar$EX00.000Setup.exe>>1202.exe>>xboxcenter.dll本机
Trojan.DL.Agent.kab删除成功2006-07-19 22:43手动扫描C:\Documents and Settings\wb\Local Settings\Temp\Rar$EX00.000Setup.exe>>1202.exe>>ehuupdate.exe本机
Backdoor.Agent.dbv删除成功2006-07-19 22:43手动扫描C:\Documents and Settings\wb\Local Settings\Temp\Rar$EX00.000Setup.exe>>1202.exe本机
Trojan.DL.Diyer.a删除成功2006-07-19 22:44手动扫描C:\Documents and Settings\wb\Local Settings\Temp\Rar$EX00.000Setup.exe>>4022.exe>>tool.exe本机
Dropper.Agent.wd删除成功2006-07-19 22:44手动扫描C:\Documents and Settings\wb\Local Settings\Temporary Internet Files\Content.IE5\3AYG8LRDsefInstall047[1].txt>>WIS293.exe本机
Trojan.Agent.dfm删除成功2006-07-19 22:49手动扫描C:\Temp1202.exe>>xboxcenter.dll本机
Trojan.DL.Agent.kab删除成功2006-07-19 22:49手动扫描C:\Temp1202.exe>>ehuupdate.exe本机
Backdoor.Agent.dbv删除成功2006-07-19 22:49手动扫描C:\Temp1202.exe本机
Trojan.DL.Diyer.a删除成功2006-07-19 22:49手动扫描C:\Temp4022.exe>>tool.exe本机
Trojan.Clicker.Agent.abx删除成功2006-07-19 22:49手动扫描C:\Tempdo_566.exe>>LoadDriver.exe本机
Dropper.Agent.cra删除成功2006-07-19 23:21手动扫描F:\电脑迷\pcfan0606b (K)\SOFTWARE\ISSUE\新软推荐给EXE加启动图片工具.EXE>>给EXE加启动图片工具.exe本机
Backdoor.Agent.ddb删除成功2006-07-23 17:11手动扫描C:\Documents and Settings\All Users\Application Data\Microsoft\Cryptoemje.exe本机
Backdoor.Agent.ddb删除成功2006-07-23 17:11手动扫描C:\Documents and Settings\Default User\Local Settings\Tempmvonp.exe本机
Trojan.DL.Small.ibr删除成功2006-07-23 17:24手动扫描C:\RECYCLER\S-1-5-21-861567501-926492609-725345543-1003Dc1096.scr本机
Dropper.Agent.cra删除成功2006-07-23 20:35手动扫描F:\System Volume Information\_restore{96981AA3-B8B0-4B2C-87BD-5F72DF6E8472}\RP5A0002405.EXE>>给EXE加启动图片工具.exe本机
Backdoor.Agent.deo删除成功2006-07-30 00:07手动扫描C:\Documents and Settings\All Users\Application Data\Microsoft\Cryptoemje.exe本机
Backdoor.Agent.deo删除成功2006-07-30 00:08手动扫描C:\Program Files\ATI Technologieskblujb.exe本机
Backdoor.Agent.deo删除成功2006-07-30 00:09手动扫描C:\Program Files\Common Files\Systemlfke.dat本机
Backdoor.Agent.deo删除成功2006-07-30 00:09手动扫描C:\Program Files\DoDoorRSSFindercczrkns.exe本机
Backdoor.Agent.deo删除成功2006-07-30 00:11手动扫描C:\Program Files\Realteksqujt.exe本机
Trojan.DL.Agent.amc删除成功2006-07-30 00:12手动扫描C:\Temp1079.exe本机
Trojan.DL.Small.mys删除成功2006-08-03 21:09屏保扫描C:\Temp194040044.exe本机
Trojan.DL.VB.apw删除成功2006-08-03 22:13快捷扫描D:jiekshijf.exe>>bo.exe本机
Trojan.DL.VB.apv删除成功2006-08-03 22:13快捷扫描D:jiekshijf.exe>>sys.exe本机
Trojan.Clicker.VB.jy删除成功2006-08-03 22:13快捷扫描D:jiekshijf.exe>>ad.exe本机
Trojan.Clicker.Mobo.a删除成功2006-08-03 22:13快捷扫描D:jiekshijf.exe>>AD2.EXE本机
Trojan.Clicker.Mobo.b删除成功2006-08-03 22:13快捷扫描D:jiekshijf.exe>>ADd.exe本机
Trojan.Clicker.VB.of删除成功2006-08-03 22:13快捷扫描D:jiekshijf.exe>>benben.exe>>31.exe本机
Trojan.DL.VB.apw删除成功2006-08-03 22:18其它嵌入杀毒D:jiekshijf.exe >>bo.exe本机
Trojan.DL.VB.apw删除成功2006-08-03 22:48屏保扫描C:\Documents and Settings\wb\Local Settings\Temporary Internet Files\Content.IE5\EBQF696Jjiekshijf[1].exe>>bo.exe本机
Trojan.DL.VB.apv删除成功2006-08-03 22:48屏保扫描C:\Documents and Settings\wb\Local Settings\Temporary Internet Files\Content.IE5\EBQF696Jjiekshijf[1].exe>>sys.exe本机
Trojan.Clicker.VB.jy删除成功2006-08-03 22:48屏保扫描C:\Documents and Settings\wb\Local Settings\Temporary Internet Files\Content.IE5\EBQF696Jjiekshijf[1].exe>>ad.exe本机
Trojan.Clicker.Mobo.a删除成功2006-08-03 22:48屏保扫描C:\Documents and Settings\wb\Local Settings\Temporary Internet Files\Content.IE5\EBQF696Jjiekshijf[1].exe>>AD2.EXE本机
Trojan.Clicker.Mobo.b删除成功2006-08-03 22:48屏保扫描C:\Documents and Settings\wb\Local Settings\Temporary Internet Files\Content.IE5\EBQF696Jjiekshijf[1].exe>>ADd.exe本机

有这么多~你看看~

清空IE临时文件夹..

删除
F:\cs1.5install.rar

安全模式清空
C:\Documents and Settings\wb\Local Settings\Temp\

我的电脑-右键-属性-系统还原-在所有磁盘上关闭系统还原  勾上..重启 ...把勾取消掉..

安全模式全盘扫毒..