瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 【求助】请帮看看怎么回事?带HJ日志

12   1  /  2  页   跳转

【求助】请帮看看怎么回事?带HJ日志

【求助】请帮看看怎么回事?带HJ日志

有什么问题吗?我已经搞了一天,查毒查不到,但大虾们还说我的机有问题。

Logfile of HijackThis v1.99.1
Scan saved at 20:33:53, on 2005-9-4
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Rising\Rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
D:\RISING\RAV\CCENTER.EXE
C:\WINDOWS\Explorer.EXE
D:\Program Files\Rising\Rfw\RfwMain.exe
D:\RISING\RAV\RAVTIMER.EXE
D:\RISING\RAV\RAVMON.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\锐捷网络\Ruijie Supplicant\8021x.exe
D:\qq\QQ.exe
D:\qq\TIMPlatform.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\桌面\hijackthis英文\HijackThis.exe

O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\System32\xunleibho_v5.dll
O2 - BHO: WebMiscItem Class - {3CD4296F-6CC3-11D9-B888-000C299AA719} - C:\WINDOWS\system32\WebMisc.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\qq\QQIEHelper.dll
O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - C:\PROGRA~1\baidu\bar\BaiduBar.dll
O2 - BHO: DownloadBHO T2BHO - {B1D147E7-873E-4909-8127-695D9BB78728} - C:\WINDOWS\Downloaded Program Files\barhelp22.0.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O3 - Toolbar: 百度超级搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\PROGRA~1\baidu\bar\BaiduBar.dll
O3 - Toolbar: 博采 - {4DA2EE61-6399-4C39-AEB9-0D990E610D29} - C:\WINDOWS\System32\BOCAIT~1.DLL (file missing)
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file)
O3 - Toolbar: 完美网译通 - {F43BD772-ABDD-43b7-A96A-3E9E61946EC0} - C:\WINDOWS\WORLD2\TOOLBAR\hmtoolbar.dll
O3 - Toolbar: (no name) - {D74EC18E-3DDD-4174-B1B1-949FE3B8366D} - (no file)
O4 - HKLM\..\Run: [RfwMain] "D:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [RavTimer] D:\RISING\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [RavMon] D:\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [ADShow] C:\WINDOWS\System32\bcsysnote.ex   
O4 - HKLM\..\RunServices: [Microsoft Windows Updater] WINUPDATE.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\qq\SendMMS.htm
O8 - Extra context menu item: 用比特精灵下载(&B) - D:\BitSpirit\bsurl.htm
O9 - Extra button: Infofo 工具栏 - {8507326C-B5C1-4559-BB91-0919E753836F} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Infofo 工具栏 - {8507326C-B5C1-4559-BB91-0919E753836F} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Downloads\QQ.EXE (file missing)
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Downloads\QQ.EXE (file missing)
O9 - Extra button: 易趣购物 - {DE60714F-AC17-427e-861A-FD60CBDF119A} - http://adfarm.mediaplex.com/ad/ck/4080-23171-9517-195?cn=song;icon;hp&mpro=http://www.ebay.com.cn (file missing)
O9 - Extra 'Tools' menuitem: 易趣购物 - {DE60714F-AC17-427e-861A-FD60CBDF119A} - http://adfarm.mediaplex.com/ad/ck/4080-23171-9517-195?cn=song;icon;hp&mpro=http://www.ebay.com.cn (file missing)
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\qq\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\qq\QQIEHelper.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.legend.com
O16 - DPF: {56A7DC70-E102-4408-A34A-AE06FEF01586} (天下搜索) - http://iebar.t2t2.com/iebar.cab
O16 - DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} (AxSubmitControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{15513816-19E9-40C1-8097-38D907739C8F}: NameServer = 202.116.160.33,202.116.160.41
O17 - HKLM\System\CS2\Services\Tcpip\..\{15513816-19E9-40C1-8097-38D907739C8F}: NameServer = 202.116.160.33,202.116.160.41
O17 - HKLM\System\CS3\Services\Tcpip\..\{15513816-19E9-40C1-8097-38D907739C8F}: NameServer = 202.116.160.33,202.116.160.41
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - D:\Program Files\Rising\Rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - D:\RISING\RAV\CCENTER.EXE
O23 - Service: ScriptBlocking Service (SBService) - Unknown owner - (no file)

最后编辑2005-09-05 13:11:44
分享到:
gototop
 

【回复“紫飞机”的帖子】
O4 - HKLM\..\Run: [ADShow] C:\WINDOWS\System32\bcsysnote.ex
O4 - HKLM\..\RunServices: [Microsoft Windows Updater] WINUPDATE.EXE

还是老样子。问题根本没解决。
gototop
 

【回复“紫飞机”的帖子】你好,O23 - Service: ScriptBlocking Service (SBService) - Unknown owner - (no file)进行修复!
O4 - HKLM\..\Run: [ADShow] C:\WINDOWS\System32\bcsysnote.ex这个是什么知道吗?
gototop
 

但是我查不到斑竹叫我查的文件啊 ?这个问题严重吗?是病毒吗?会不会传染?
gototop
 

【回复“網事如夢”的帖子】
那两个O4都是木马
gototop
 

【回复“紫飞机”的帖子】在文件夹选项中把"显示文件和文件夹"和"显示系统文件"打勾!!然后在找找看看!
gototop
 

引用:
【baohe的贴子】【回复“網事如夢”的帖子】
那两个O4都是木马
...........................

谢谢baohe,又学到东西了~不过我要去寝室了,88~~明天继续关注!
gototop
 

不行啊,我还是找不到那两个文件啊!!
gototop
 

用IceSword也看不到?
gototop
 

唉,真的要被你们几个气死了~~~~~~~~~~~~~
gototop
 
12   1  /  2  页   跳转
页面顶部
Powered by Discuz!NT