瑞星卡卡安全论坛

用HijackThis扫描
Logfile of HijackThis v1.99.1
Scan saved at 18:57:17, on 2006-10-17
Platform: Windows 2003 SP1 (WinNT 5.02.3790)
MSIE: Internet Explorer v6.00 SP1 (6.00.3790.1830)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
d:\Program Files\Rising\Rav\CCenter.exe
d:\Program Files\Rising\Rav\Ravmond.exe
C:\WINDOWS\System32\svchost.exe
d:\program files\rising\rfw\rfwsrv.exe
d:\Program Files\Rising\Rav\RavStub.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Cyberlink\Shared files\RichVideo.exe
d:\program files\rising\rfw\RfwMain.exe
D:\Program Files\UPHClean\uphclean.exe
d:\Program Files\Rising\Rav\RavTask.exe
d:\Program Files\Rising\Rav\Ravmon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
d:\Program Files\Maxthon\maxthon.exe
C:\WINDOWS\system32\conime.exe
D:\dzh\internet\hypwise.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\Com\CSRSS.EXE
C:\WINDOWS\explorer.exe
D:\Program Files\Tencent\QQ.exe
D:\Program Files\Tencent\TIMPlatform.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\桌面\HijackThis V1[1].99.1汉化版\HijackThis.exe

O2 - BHO: MyIEHelper Class - {16B770A0-0E87-4278-B748-2460D64A8386} - C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\IEHelper20061017_8888.dll (file missing)
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - D:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: URLMonitor Class - {3ED9FFDA-79DB-4B2D-99B7-16EA3C4A3A92} - C:\WINDOWS\system32\hap.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - d:\Program Files\Tencent\QQIEHelper.dll
O2 - BHO: DownloadValue Class - {616D4040-5712-4F0F-BCF1-5C6420A99E14} - C:\WINDOWS\system32\winhtp.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [RavTask] "d:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [RfwMain] "d:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: 使用网际快车下载 - D:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - D:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - d:\Program Files\Tencent\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - d:\Program Files\Tencent\QQIEHelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{43A82EE9-1BE5-4B4A-907F-CD82156F8C20}: NameServer = 192.168.0.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{43A82EE9-1BE5-4B4A-907F-CD82156F8C20}: NameServer = 192.168.0.1
O20 - Winlogon Notify: dimsntfy - C:\WINDOWS\SYSTEM32\dimsntfy.dll
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - d:\program files\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - d:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - d:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - d:\Program Files\Rising\Rav\Ravmond.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - d:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

C:\WINDOWS\system32\Com\CSRSS.EXE先结束掉，删除看看。，具体的行为不清楚，可以的话，把这个文件找到，发到我邮箱，邮箱地址见我签名

好像还有不明文件，该怎样删？

附件: 304020061017191817.jpg

好像还有不明文件，该怎样删？

附件: 304020061017191851.jpg

不是看大小写的。。。。是看路径的

CSRSS.EXE已发到gudugd@yahoo.com.cn

我去测试看看

谢谢，conime,msdtc以前也没看到过。CSRSS.EXE要安全模式才能删吗？

还有弹出
http://61.145.116.78/index2.jsp
会改主页为http://www.pengpeng.com/

呼。。。终于出来了。。。。卡的要死。。。竟然是个垃圾。。。运行后没反应，只要结束进程就可以删除的东西。。。进程你可以用IS查看


修复
O2 - BHO: URLMonitor Class - {3ED9FFDA-79DB-4B2D-99B7-16EA3C4A3A92} - C:\WINDOWS\system32\hap.dll
O2 - BHO: DownloadValue Class - {616D4040-5712-4F0F-BCF1-5C6420A99E14} - C:\WINDOWS\system32\winhtp.dll

删除
C:\WINDOWS\system32\hap.dll
C:\WINDOWS\system32\winhtp.dll

用IS结束CSRSS.EXE进程
电脑马上蓝屏：Beginning dump of physical memory
Dumping physical memory to disk :01

附件: 304020061017205555.jpg

上面是重启后的提示。

今天刚重装完系统，看来明天又要装了。

查看一下提示错误的这几个文件.有的话就把它删除了
重启试试看.