急急急！到底是哪个病毒的事？ bbs.ikaka.com

william124 - 2006-8-10 11:59:00

弹出网页桌面上快捷方式不能打开！一开机就是杀毒！

Logfile of HijackThis v1.99.1
Scan saved at 11:36:46, on 2006-8-10
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\Program Files\Rising\Rav\Ravmond.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\igfxtray.exe
C:\WINNT\system32\hkcmd.exe
C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\WINNT\system32\internat.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Tencent\QQ\TIMPlatform.exe
C:\Program Files\Tencent\QQ\QQ.exe
C:\Program Files\BitComet\BitComet.exe
C:\Program Files\Tencent\QQ\qqpet\qqpet.exe
C:\WINNT\system32\Rundll32.exe
C:\WINNT\NOTEPAD.EXE
F:\软件\hijackthis\HijackThis.exe

R3 - URLSearchHook: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
O2 - BHO: hbieobj Class - {147E230B-FC8D-4A66-AB96-FFD464A9B2A3} - C:\PROGRA~1\hbclient\tbhelper.dll
O2 - BHO: Shockwave Flash Object - {14A21378-5BB1-4BC4-95D5-5D3F51527F6F} - C:\WINNT\system32\smflash.ocx
O2 - BHO: FltSetUp Class - {1D49D58D-5C84-4B50-8359-D9809BEB2B32} - C:\Program Files\Internet Explorer\Connection Wizard\icwuti1.dll
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FLASHGET\jccatch.dll
O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll
O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - C:\Program Files\Yahoo!\Assistant\Assist\yAngling.dll
O2 - BHO: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL
O2 - BHO: (no name) - {D424FE4E-CAF9-4fdd-BC5F-E6E6B91D53BF} - (no file)
O3 - Toolbar: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [YLive.exe] C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
O4 - HKLM\..\Run: [yassistse] "C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 使用网际快车下载 - C:\PROGRA~1\FLASHGET\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\PROGRA~1\FLASHGET\jc_all.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 添加到雅虎订阅(&Y) - res://C:\Program Files\Yahoo!\Assistant\Assist\yrss.dll/YRSSMENUEXT
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm
O8 - Extra context menu item: 雅虎搜索 - res://C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll/246
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{34CD1FB4-AFEB-4391-BD5A-0A4C0420BF67}: NameServer = 202.99.96.68,202.99.104.68
O17 - HKLM\System\CS1\Services\Tcpip\..\{34CD1FB4-AFEB-4391-BD5A-0A4C0420BF67}: NameServer = 202.99.96.68,202.99.104.68
O17 - HKLM\System\CS2\Services\Tcpip\..\{34CD1FB4-AFEB-4391-BD5A-0A4C0420BF67}: NameServer = 202.99.96.68,202.99.104.68
O20 - AppInit_DLLs: KB350217M.LOG
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe

william124 - 2006-8-10 12:01:00

这是这两天杀的病毒！到底是哪个病毒的事？？？？

病毒名称处理结果发现日期扫描方式路径文件
Trojan.DL.Agent.hoh 删除成功 2006-06-15 10:46 文件监控 C:\DOCUME~1\kl\LOCALS~1\Temp\mum1 mum1.exe
Trojan.DL.Agent.hoh 删除成功 2006-06-19 13:21 文件监控 C:\DOCUME~1\kl\LOCALS~1\Temp\mum1 mum1.exe
Trojan.DL.ADLoad.ei 删除成功 2006-06-21 10:16 文件监控 C:\DOCUME~1\kl\LOCALS~1\Temp 101577.exe
Trojan.DL.ADLoad.ei 删除成功 2006-06-21 10:16 文件监控 C:\DOCUME~1\kl\LOCALS~1\Temp 101577.exe
Trojan.DL.Agent.hoh 删除成功 2006-07-03 09:15 文件监控 C:\DOCUME~1\kl\LOCALS~1\Temp\mum1 mum1.exe
Backdoor.SdBot.jne 删除成功 2006-08-04 12:17 文件监控 C:\WINNT eraseme_85301.exe
Trojan.PSW.Lmir.kta 忽略 2006-08-09 15:05 文件监控 C:\WINNT KB350217M.LOG
Trojan.PSW.Lmir.kta 忽略 2006-08-09 15:05 文件监控 C:\WINNT KB350217M.LOG
Trojan.PSW.Lmir.kta 忽略 2006-08-09 15:05 文件监控 C:\WINNT KB350217M.LOG
Trojan.PSW.Lmir.kta 忽略 2006-08-09 15:05 文件监控 C:\WINNT KB350217M.LOG
Trojan.PSW.Lmir.kta 忽略 2006-08-09 15:05 文件监控 C:\WINNT KB350217M.LOG
Trojan.PSW.Lmir.kta 忽略 2006-08-09 15:05 文件监控 C:\WINNT KB350217M.LOG
Trojan.PSW.Lmir.kta 重新启动计算机后删除文件2006-08-09 15:05 文件监控 C:\WINNT KB350217M.LOG
Trojan.DL.Agent.hoc 删除成功 2006-08-09 15:05 文件监控 C:\WINNT\system32 WinSC.dll
Trojan.Clicker.Delf.di 删除成功 2006-08-09 15:39 文件监控 C:\WINNT\system32 tasklist.dll>>Unpack
Trojan.Clicker.Delf.di 删除成功 2006-08-09 15:40 文件监控 C:\WINNT\system32 tasklist.dll>>Unpack
Trojan.StartPage.szo 删除成功 2006-08-09 15:41 文件监控 C:\Documents and Settings\kl\Local Settings\Temp 10032_setup.exe
Trojan.DL.Agent.amw 删除成功 2006-08-09 15:41 文件监控 C:\Documents and Settings\kl\Local Settings\Temp 101370.exe>>Unpack
Trojan.DL.Delf.ccr 删除成功 2006-08-09 15:41 文件监控 C:\Documents and Settings\kl\Local Settings\Temp Setup_L0038.exe>>Unpack
Trojan.Delf.azf 删除成功 2006-08-09 15:43 文件监控 C:\WINNT Skymmstp017.exe
Dropper.Delf.axs 删除成功 2006-08-09 15:43 文件监控 C:\WINNT soft1201.exe>>Unpack
Trojan.DL.Agent.kgx 删除成功 2006-08-09 15:44 文件监控 C:\WINNT\system vfp104.exe
Dropper.Agent.bmg 删除成功 2006-08-09 15:44 文件监控 C:\WINNT\system32 bdcjins.exe
Trojan.DL.Agent.htu 删除成功 2006-08-09 15:44 文件监控 C:\WINNT\system32 iebar.exe
Dropper.Agent.bmg 删除成功 2006-08-09 15:44 文件监控 C:\WINNT\system32 s_bdextinsU217.exe
Trojan.DL.VB.bzs 删除成功 2006-08-09 15:45 文件监控 C:\WINNT\system32 sysmini.exe
Trojan.Clicker.Delf.di 删除成功 2006-08-09 15:45 文件监控 C:\WINNT\system32 youyi21.exe
Trojan.DL.NPro.a 删除成功 2006-08-09 16:05 文件监控 C:\WINNT\Downloaded Program Files NProtect.dll
Trojan.Clicker.Delf.di 删除成功 2006-08-09 16:09 文件监控 C:\WINNT\system32 tasklist.dll>>Unpack
Trojan.Clicker.Delf.di 删除成功 2006-08-09 16:46 文件监控 C:\WINNT\system32 tasklist.dll>>Unpack
Trojan.DL.Agent.kkz 删除成功 2006-08-10 11:33 文件监控 C:\Documents and Settings\kl\Local Settings\Temporary Internet Files\Content.IE5\LGOZTTS9 up888[1].exe
Trojan.DL.Agent.kkz 删除成功 2006-08-10 11:33 文件监控 C:\WINNT mrgtask.exe

mopery - 2006-8-10 12:18:00

修复
O2 - BHO: FltSetUp Class - {1D49D58D-5C84-4B50-8359-D9809BEB2B32} - C:\Program Files\Internet Explorer\Connection Wizard\icwuti1.dll
O2 - BHO: (no name) - {D424FE4E-CAF9-4fdd-BC5F-E6E6B91D53BF} - (no file)
O20 - AppInit_DLLs: KB350217M.LOG
删除
C:\Program Files\Internet Explorer\Connection Wizard\icwuti1.dll
C:\WINDOWS\KB350217M.LOG

http://www.pctutu.com/srmsdown.asp
下载超级兔子..用超级兔子清理王卸载流氓软件...(安全模式...)

mopery - 2006-8-10 12:19:00

清空IE临时文件夹..

C:\Documents and Settings\kl\Local Settings\Temp
C:\DOCUME~1\kl\LOCALS~1\Temp\
这俩个文件夹清空..

附件: 6323982006810121136.JPG

william124 - 2006-8-10 12:54:00

C:\Program Files\Internet Explorer\Connection Wizard\icwuti1.dll 删不了显示正在使用
C:\WINDOWS\KB350217M.LOG 没有这个文件！！！~~~~~~~~

mopery - 2006-8-10 13:02:00

安全模式删..用WINRAR..
http://forum.ikaka.com/topic.asp?board=28&artid=6979213第4楼下载System Repair Engineer
把SREng.exe改成SREng.com 运行系统修复修复文件关联..

修炼忍耐 - 2006-8-10 19:58:00

你可以来这个网站上下载超级兔子然后用清理王上网精灵 IE修复专家来解决 http://www.pctutu.com/

瑞星卡卡安全论坛