瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 麻烦高手抽空帮看看日志~~谢谢了

12   2  /  2  页   跳转

麻烦高手抽空帮看看日志~~谢谢了

那篇链接的帖子不是说得很清楚的吗?stdsver.dll要删。rundll32.exe是系统进程,不能删。service只是表示这一项是服务而已,并不是文件名。
HijackThis修复02项时一般也会删除相应的dll文件,C:\PROGRA~1\baidu\iexp\BDSrHook.dll应该已经被删了。
gototop
 

兄弟我能加你QQ么?  我是菜鸟哈 
还有好多问题不懂  我的QQ是11261808
gototop
 

晕  这次开机就出现这个了

附件附件:

下载次数:150
文件类型:application/octet-stream
文件大小:
上传时间:2006-4-14 2:42:35
描述:



gototop
 

Logfile of HijackThis v1.99.1
Scan saved at 3:12:52, on 2006-4-14
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\windows\System32\svchost.exe
C:\Program Files\Rising\Rav\Ravmond.exe
C:\windows\Explorer.EXE
C:\windows\system32\spoolsv.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\windows\system32\ieinfo.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\扫描仪驱动\ScannerFinder.exe
C:\Program Files\ChinaNet\VnetClient.exe
C:\WINDOWS\system32\Wtablet\TabUserW.exe
D:\腾讯QQ\QQ.exe
D:\腾讯QQ\TIMPlatform.exe
C:\windows\system32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\windows\system32\RUNDLL32.EXE
C:\windows\system32\wuauclt.exe
D:\TT\TTraveler.exe
C:\Program Files\JJOL\IME\JJSvr.EXE
D:\扫描日志的\HijackThis.exe

R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: BdSearch - {02496EBD-8455-48db-B3C7-5DAC97D9F5A7} - C:\PROGRA~1\baidu\iexp\BDSrHook.dll
O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll
O2 - BHO: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll
O2 - BHO: VnetCookie Class - {4E83D567-4697-4F7B-B1F0-A513B01DB89A} - c:\PROGRA~1\chinanet\VNETTR~1.DLL
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\腾讯QQ\QQIEHelper.dll
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL
O2 - BHO: DTSvc Class - {6B280AC7-8B18-46A4-BF70-FC579A1B2F76} - C:\Program Files\DTSVC\DTS\DTS.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FLASHGET\jccatch.dll
O3 - Toolbar: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\windows\system32\kakatool.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [YLive.exe] C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [ExFilter] Rundll32.exe "C:\PROGRA~1\CNNIC\Cdn\cdnspie.dll",ExecFilter solo
O4 - Startup: 腾讯QQ.lnk = ?
O4 - Global Startup: Microtek 扫描仪探测器.lnk = ?
O4 - Global Startup: 星空极速.lnk = C:\Program Files\ChinaNet\VnetClient.exe
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\Wtablet\TabUserW.exe
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\腾讯QQ\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\腾讯QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\腾讯QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\腾讯QQ\SendMMS.htm
O9 - Extra button: 百度首页 - {02496EBD-8455-48db-B3C7-5DAC97D9F5A7} - http://baidu.com/index.php?tn=zlroomdg (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java 控制台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\腾讯QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\腾讯QQ\QQIEHelper.dll
O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg (file missing)
O9 - Extra button: 访问瑞星网站 - {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E444} - http://www.rising.com.cn/?u=RSTB (file missing)
O9 - Extra button: 访问卡卡社区 - {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E445} - http://www.ikaka.com/?u=RSTB (file missing)
O11 - Options group: [!IESearch] 百度搜索伴侣
O17 - HKLM\System\CCS\Services\Tcpip\..\{8A30D735-35DB-4575-B8AA-AC4A187A3291}: NameServer = 202.96.128.86 202.96.134.133
O17 - HKLM\System\CCS\Services\Tcpip\..\{9B6ABE05-0DFC-4F18-81D0-6EC497C4E891}: NameServer = 202.96.134.133
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
gototop
 

请问下 我的日志还有没有问题啊??
gototop
 

怎么不理我了啊?? 我有点看不动那个连接网站说的啊
我对这些都一窍不通的啊
gototop
 

【回复“我中梅毒了”的帖子】
[RUNDLL32.EXE]
CommandLine = C:\WINDOWS\SYSTEM32\RUNDLL32.EXE C:\WINDOWS\SYSTEM32\WBEM\IRJIT.DLL,Export 1087
具体操作参考
http://forum.ikaka.com/topic.asp?board=28&artid=7946351

==============

CommandLine = "C:\windows\system32\Rundll32.exe" "C:\PROGRA~1\HBClient\hbhelper.dll",WaitWindows
具体操作参考
http://forum.ikaka.com/topic.asp?board=28&artid=7795226

============

O2 - BHO: wmpdrm - {0E674588-66B7-4E19-9D0E-2053B800F69F} - C:\windows\system32\wmpdrm.dll (file missing)
具体操作参考
http://forum.ikaka.com/topic.asp?board=28&artid=7948848

=============

CommandLine = C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\System32\STDSVER.DLL,Service
具体操作参考:
开始--控制面板--性能和维护--管理工具--服务
禁用StdService (StdService)

进入注册表
展开[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]
找到后删除StdService文件夹

用HIJACKTHIS修复
O2 - BHO: std software - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - C:\windows\SYSTEM32\stdup.dll

删除
c:\windows\system32\stdsver.dll
C:\WINDOWS\SYSTEM32\stdup.dll
C:\WINDOWS\system32\stdcache\

================

用HIJACKTHIS修复
R3 - Default URLSearchHook is missing
O2 - BHO: DTSvc Class - {6B280AC7-8B18-46A4-BF70-FC579A1B2F76} - C:\Program Files\DTSVC\DTS\DTS.dll

卸载
C:\Program Files\CaiShow Tech\
C:\Program Files\DTSVC\
gototop
 
12   2  /  2  页   跳转
页面顶部
Powered by Discuz!NT