瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 【求助】哪位大哥帮帮忙,病毒杀不掉

1   1  /  1  页   跳转

【求助】哪位大哥帮帮忙,病毒杀不掉

【求助】哪位大哥帮帮忙,病毒杀不掉

Backdoor.Gpigeon.thj    清除失败    2006-01-31 11:16    开机扫描    Ati2evxx.exe>>C:\WINDOWS\MerverKey.DLL
Backdoor.Gpigeon.thj    清除失败    2006-01-31 11:16    开机扫描    Explorer.EXE>>C:\WINDOWS\MerverKey.DLL
Backdoor.Gpigeon.thj    清除失败    2006-01-31 11:16    开机扫描    RfwMain.exe>>C:\WINDOWS\MerverKey.DLL
Backdoor.Gpigeon.thj    清除失败    2006-01-31 11:16    开机扫描    SysExplr.EXE>>C:\WINDOWS\MerverKey.DLL
Backdoor.Gpigeon.thj    清除失败    2006-01-31 11:16    开机扫描    yassistse.exe>>C:\WINDOWS\MerverKey.DLL
Backdoor.Gpigeon.thj    清除失败    2006-01-31 11:16    开机扫描    YLive.exe>>C:\WINDOWS\MerverKey.DLL
Backdoor.Gpigeon.thj    清除失败    2006-01-31 11:16    开机扫描    realsched.exe>>C:\WINDOWS\MerverKey.DLL
Backdoor.Gpigeon.thj    清除失败    2006-01-31 11:16    开机扫描    ctfmon.exe>>C:\WINDOWS\MerverKey.DLL
Backdoor.Gpigeon.thj    清除失败    2006-01-31 11:16    开机扫描    AgentSvr.exe>>C:\WINDOWS\MerverKey.DLL
Backdoor.Gpigeon.thj        wuauclt.exe>>C:\WINDOWS\MerverKey.DLL
全是这种病毒,帮帮忙大哥哥
最后编辑2006-01-31 13:53:56
分享到:
gototop
 

建议您下载并使用HijackThis1.99.1

HijackThis下载地址请参考:
【必读】本版说明及常用小软件下载
http://forum.ikaka.com/topic.asp?board=67&artid=5188931

HijackThis的使用方法-----请参考--瑞星HijackThis专题
http://it.rising.com.cn/newSite/Channels/anti_virus/Antivirus_Faq/TopicExplorerPagePackage/hijackthis.htm

运行HijackThis,先点[扫描]或[Scan]按钮,扫描完成后,[扫描]或[Scan]按钮会变为[保存Log]或[Save Log]按钮,点击它,LOG将会在记事本中显示,再从记事本里复制/粘贴到贴子里。
如果LOG比较长,一贴发不完,你可以分成几个部分发在回贴里。
gototop
 

HijackThis@Qoo的扫描日志  V1.97.7
Scan saved at 12:31:01, on 2006-1-31
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
D:\瑞星\Rising\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
D:\瑞星\Rising\Rising\Rav\Ravmond.exe
d:\瑞星\rising\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
D:\瑞星\Rising\Rising\Rav\RavStub.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
gototop
 

C:\WINDOWS\Explorer.EXE
d:\瑞星\rising\rising\rfw\RfwMain.exe
C:\Program Files\Herosoft\Hero 9\SysExplr.EXE
C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe
C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
D:\瑞星\Rising\Rising\Rav\RavTask.exe
D:\瑞星\Rising\Rising\Rav\Ravmon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\updata.exe
D:\新建文件夹 (2)\HijackThis.exe
D:\瑞星\Rising\Rising\Rav\ravhdbak.exe

R3 - URLSearchHook:
O2 - BHO: (no name) - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v5.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - e:\
O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll
O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll
gototop
 

就这么少?
gototop
 

是呀,帮忙看看
gototop
 

有垃圾
gototop
 

放到隔离区
gototop
 

O2 - BHO:
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - F:\qq2005\QQIEHelper.dll
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL
O2 - BHO: (no name) - {77FEF28E-EB96-44FF-B511-3185DEA48697} - C:\PROGRA~1\baidu\bar\baidubar.dll
O3 - Toolbar: (no name) - {F60C7D81-8471-4D40-AAFE-56D318F34C2D} - (no file)
O3 - Toolbar: ????? - {F43BD772-ABDD-43b7-A96A-3E9E61946EC0} - C:\WINDOWS\WORLD2\TOOLBAR\hmtoolbar.dll
O3 - Toolbar: ????? - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
O3 - Toolbar: ????? - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\PROGRA~1\baidu\bar\baidubar.dll
O4 - HKLM\..\Run: [SysExplr] C:\Program Files\Herosoft\Hero 9\SysExplr.EXE
O4 - HKLM\..\Run: [yassistse] "C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"
O4 - HKLM\..\Run: [YLive.exe] C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
O4 - HKLM\..\Run: [RfwMain] "D:\
O4 - HKLM\..\Run: [RavTask] "D:\
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: ntuser.dat.LOG
O4 - Startup: ntuser.ini
O4 - Startup: score.ini
O4 - Startup: _audovr.txt
O4 - Startup: sys_log_114657066.upt
O4 - Startup: ntuser.dat
O4 - Global Startup: Nokia PC Suite 6.60.16.LOG
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: 上传到QQ网络硬盘 - F:\qq2005\AddToNetDisk.htm
O8 - Extra context menu item: 使用超级解霸播放 - C:\Program Files\Herosoft\Hero 9\MPURLGET.HTM
O8 - Extra context menu item: 导出到 Microsoft Excel(&x) - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: 收藏此页到新浪ViVi - http://vivi.sina.com.cn/collect/click.php?agent=ddt
O8 - Extra context menu item: 新浪搜索 - http://cha.sina.com.cn/ddt.html
O8 - Extra context menu item: 添加到QQ自定义面板 - F:\qq2005\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - F:\qq2005\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - F:\qq2005\SendMMS.htm
O8 - Extra context menu item: 用比特精灵下载(&B) - D:\BitSpirit\bsurl.htm
O8 - Extra context menu item: 百度-搜索MP3 - res://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDUMP3.HTM
O8 - Extra context menu item: 百度-搜索图片 - res://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDUIMG.HTM
O8 - Extra context menu item: 百度-搜索新闻 - res://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDUNEWS.HTM
O8 - Extra context menu item: 百度-搜索歌词 - res://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDULYRIC.HTM
O8 - Extra context menu item: 百度-搜索网页 - res://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDUSEARCH.HTM
O8 - Extra context menu item: 百度-搜索贴吧 - res://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDUPOST.HTM
O8 - Extra context menu item: 百度-词典搜索 - res://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDU_DIC.HTM
O8 - Extra context menu item: 雅虎搜索 - res://C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll/246
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O17 - HKLM\System\CCS\Services\Tcpip\..\{CF0DEDE7-CF82-48CD-9545-89E448955456}: NameServer = 202.98.198.168 202.98.192.68
gototop
 

或者人工拆除,一个一个的。
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT