瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 无邪请帮忙看看服务器是否中了“落雪”病毒

1234   3  /  4  页   跳转

无邪请帮忙看看服务器是否中了“落雪”病毒

WinsockXPFix.exe 修复的吧...
gototop
 

你照无邪老大说的再贴个日志上来吧。用他说的软件。
一般这二个软件结合扫的报告更有参考价值。
gototop
 

是的用LSPFix和WinsockXPFix.exe 修复过。
gototop
 

楼主你先把那些服务删除了
再做010项应该就简单的多了
快去快回,时间不多了。
gototop
 

谢谢各位的指点,服务删除要等上班了。向大家致敬!
gototop
 

服务器事关重大,建议在删除东东时,能有人在你身边商量
gototop
 

今天上班了,再贴个日志上来,请无邪帮助看看。
2006-07-24,12:35:52

2006-07-24,12:35:52

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Advanced Server Service Pack 4 (Build 2195)
- 管理权限用户 - 完整功能

以下内容被选中:
    所有的启动项目(包括注册表、启动文件夹、服务等)
    浏览器加载项
    正在运行的进程(包括进程模块信息)
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <internat.exe><internat.exe>  [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  []
    <run><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <CPQTEAM><cpqteam.exe>  [Hewlett-Packard Company]
    <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  []
    <Userinit><C:\WINNT\system32\userinit.exe,>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  []

==================================
启动文件夹
[Adobe Reader Speed Launch]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Reader Speed Launch.lnk><N>

==================================
服务
[Adobe LM Service / Adobe LM Service]
  <"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>
[Compaq Remote Monitor Service / CpqRcmc]
  <C:\WINNT\system32\CpqRcmc.exe><Compaq>
[Logical Disk Manager Administrative Service / dmadmin]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[Rav Net Agent / RavAgent]
  <"C:\PROGRAM FILES\RISING\RAV\RavAgent.exe"><北京瑞星科技股份有限公司>
[Rav Net Alert / RavAlert]
  <"C:\PROGRAM FILES\RISING\RAV\RavAlert.exe"><瑞星科技股份发展有限公司>
[RavService / RavService]
  <"C:\Program Files\Rising\Rav\RavService.exe" /service><Beijing Rising Technology Co., Ltd.>
[RavUpdate / RavUpdate]
  <"C:\PROGRAM FILES\RISING\RAV\RavUpdate.exe" ><Beijing Rising Technology Co., Ltd.>
[RNReport / RNReport]
  <"C:\Program Files\Rising\Rav\RNReport.exe"><瑞星科技股份发展有限公司>
[Rising Process Communication Center / RsCCenter]
  <C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
  <"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[Surveyor / Surveyor]
  <C:\compaq\survey\Surveyor.EXE><Hewlett-Packard Development Group, L.P.>
[HP ProLiant System Shutdown Service / sysdown]
  <C:\WINNT\system32\sysdown.exe><Compaq Computer Corporation>

==================================
浏览器加载项
[Adobe PDF Reader Link Helper]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[超级兔子上网精灵]
  {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} <C:\Program Files\Super Rabbit\MagicSet\haokanbar.dll, Xiang Feng Technology>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[@msdxmLC.dll,-1@2052,电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[超级兔子上网精灵]
  {43869BB3-22FD-4F15-9B46-238106BA2F4E} <C:\Program Files\Super Rabbit\MagicSet\haokanbar.dll, Xiang Feng Technology>
[WebFun Control]
  {12FCCF9A-24C5-4556-AD8B-ACFAE87E7C4A} <C:\WINNT\Downlo~1\webfun.ocx, >
[WebScan Control]
  {21DF962B-D2EF-4BE5-8753-53311F3DFF23} <C:\WINNT\DOWNLO~1\WebScan.ocx, >
[MUWebControl Class]
  {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} <C:\WINNT\system32\muweb.dll, Microsoft Corporation>
[iSignatureSetup Control]
  {80602244-4662-46AC-A1FA-4DE9328C5023} <C:\WINNT\DOWNLO~1\SetupOcx.ocx, >
[IWFC Control]
  {CAA96807-4A02-43E5-8D12-65570621FAC6} <C:\WINNT\DOWNLO~1\iwfc.ocx, 威尔软件>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[KATScan Control]
  {DDA166FA-B3EA-4A3B-8EE2-4F552CDEEE81} <C:\WINNT\system32\kingsoft\KATScan\KATScan.OCX, Kingsoft>
[WebInstall Control]
  {E86CD9A0-00A5-42BB-A872-B3572129C0C8} <C:\WINNT\DOWNLO~1\WEBINS~1.OCX, >
[UpLoad Control]
  {F75241BE-34FC-4EFA-A049-65BC895947C8} <C:\WINNT\Downlo~1\UpLoad.ocx, 威尔软件>

==================================
gototop
 

引用:
【我的疑问的贴子】O10 - Broken Internet access because of LSP provider ''c:\documents and settings\administrator\windows\system32\rnr20.dll'' missing

此项正确的rnr20.dll提供的是tcpip服务。若是丢失,你的服务器根本上不到网。你应该使用LSP-FIX,看看,左边框里的有几个组件。首先要删除此路径下的''c:\documents and settings\administrator\windows\system32\rnr20.dll'' 这个假的rnr20.dll组件跟注册表项(若有)正常的rnr20.dll组件是在c:\winnt\system32下,提供tcpip服务。
我想的可能性,你要重装TCPIP服务。删除注册表下的H-L-M\SYSTEM\CCSET\SERVICES\下的winsock跟winsock32.或是没有权限要加权限删除。并且重装TCP/IP协议。
...........................


c:\documents and settings\administrator\windows\system32\rnr20.dll 这个文件已经不存在了。
gototop
 

正在运行的进程
[PID: 216][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.00.2195.6601>
[PID: 240][\??\C:\WINNT\system32\csrss.exe]  <Microsoft Corporation><5.00.2195.6601>
[PID: 264][\??\C:\WINNT\system32\winlogon.exe]  <Microsoft Corporation><5.00.2195.6997>
[PID: 292][C:\WINNT\system32\services.exe]  <Microsoft Corporation><5.00.2195.7035>
    [C:\WINNT\system32\dmserver.dll]  <VERITAS Software Corp.><2195.6605.297.3>
[PID: 304][C:\WINNT\system32\lsass.exe]  <Microsoft Corporation><5.00.2195.7011>
[PID: 396][C:\WINNT\System32\termsrv.exe]  <Microsoft Corporation><5.00.2195.6696>
[PID: 504][C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 520][C:\Program Files\Rising\Rav\Ravmond.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 1, 29>
    [C:\Program Files\Rising\Rav\BWList.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 18>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [C:\Program Files\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\RsLog.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20>
    [C:\Program Files\Rising\Rav\HOOKSYS.dll]  <Rising><18, 1, 0, 9>
    [C:\Program Files\Rising\Rav\Scanner.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30>
    [C:\Program Files\Rising\Rav\libload.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\VirusLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\regmon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
    [C:\Program Files\Rising\Rav\HookWeb.dll]  <rising><18, 0, 0, 2>
    [C:\Program Files\Rising\Rav\MemMon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
    [C:\Program Files\Rising\Rav\expscan.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\mPorts.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
    [C:\Program Files\Rising\Rav\MailMon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
    [C:\Program Files\Rising\Rav\SpamEng.dll]  <N/A><18, 0, 0, 6>
    [C:\Program Files\Rising\Rav\engine.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30>
    [C:\Program Files\Rising\Rav\PostTrt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
    [C:\Program Files\Rising\Rav\UnExe.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\Rising\Rav\ScanExec.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\Rising\Rav\ScanEx.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\Rising\Rav\NvFile.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
    [C:\Program Files\Rising\Rav\ScanMac.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 8>
    [C:\Program Files\Rising\Rav\ScanSct.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 15>
    [C:\Program Files\Rising\Rav\Unpacker.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
    [C:\Program Files\Rising\Rav\ExtOLE.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[PID: 572][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 604][C:\WINNT\system32\spoolsv.exe]  <Microsoft Corporation><5.00.2195.7059>
[PID: 636][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 664][C:\WINNT\System32\llssrv.exe]  <Microsoft Corporation><5.00.2195.7021>
[PID: 720][C:\PROGRAM FILES\RISING\RAV\RavAgent.exe]  <北京瑞星科技股份有限公司><18, 0, 1, 27>
    [C:\Program Files\Rising\Rav\RsCommx.dll]  <rising><18, 0, 0, 1>
    [C:\PROGRAM FILES\RISING\RAV\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [C:\PROGRAM FILES\RISING\RAV\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\Strategy.dll]  <Rising><18, 0, 0, 10>
[PID: 776][C:\PROGRAM FILES\RISING\RAV\RavAlert.exe]  <瑞星科技股份发展有限公司><18, 0, 0, 20>
    [C:\Program Files\Rising\Rav\RsCommx.dll]  <rising><18, 0, 0, 1>
    [C:\Program Files\Rising\Rav\PlugIn\RptMC.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
    [C:\Program Files\Rising\Rav\PlugIn\AltP936.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\PlugIn\MalAlrt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\PlugIn\TrpPlgIn.dll]  <><18, 0, 0, 6>
    [C:\PROGRAM FILES\RISING\RAV\RsSnmp.dll]  <><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\PlugIn\MBPlgIn.dll]  <><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\PlugIn\NLPlgIn.dll]  <><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\PlugIn\RptUpCT.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[PID: 804][C:\Program Files\Rising\Rav\RavStub.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 932][C:\Program Files\Rising\Rav\RavService.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 35>
    [C:\Program Files\Rising\Rav\DLCenter.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
[PID: 980][C:\PROGRAM FILES\RISING\RAV\RavUpdate.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 29>
    [C:\PROGRAM FILES\RISING\RAV\DLCenter.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23>
    [C:\PROGRAM FILES\RISING\RAV\RsCommX.dll]  <rising><18, 0, 0, 1>
[PID: 1016][C:\WINNT\system32\regsvc.exe]  <Microsoft Corporation><5.00.2195.6701>
[PID: 1028][C:\Program Files\Rising\Rav\RNReport.exe]  <瑞星科技股份发展有限公司><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\RsCommx.dll]  <rising><18, 0, 0, 1>
[PID: 1084][C:\WINNT\system32\MSTask.exe]  <Microsoft Corporation><4.71.2195.6972>
[PID: 1144][C:\compaq\survey\Surveyor.EXE]  <Hewlett-Packard Development Group, L.P.><2.56>
    [C:\compaq\survey\CpqHMMO.dll]  <HP><5.91.0>
    [C:\compaq\survey\expat.dll]  <N/A><N/A>
    [C:\compaq\survey\mssngrus.dll]  <Hewlett-Packard Development Group, L.P.><2.56>
[PID: 1224][C:\WINNT\system32\lserver.exe]  <Microsoft Corporation><5.00.2195.6701>
[PID: 1280][C:\WINNT\System32\WBEM\WinMgmt.exe]  <Microsoft Corporation><1.50.1085.0100>
[PID: 1296][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 1316][C:\WINNT\system32\CpqRcmc.exe]  <Compaq><5.0.2.0>
[PID: 1336][C:\WINNT\system32\Dfssvc.exe]  <Microsoft Corporation><5.00.2195.6664>
[PID: 1368][C:\WINNT\system32\inetsrv\inetinfo.exe]  <Microsoft Corporation><5.00.0984>
[PID: 1404][C:\WINNT\system32\msdtc.exe]  <Microsoft Corporation><1999.9.3421.3>
[PID: 1484][C:\WINNT\system32\sysdown.exe]  <Compaq Computer Corporation><5.32.3790.0 built by: >
[PID: 1804][\??\C:\WINNT\system32\csrss.exe]  <Microsoft Corporation><5.00.2195.6601>
[PID: 1828][\??\C:\WINNT\system32\winlogon.exe]  <Microsoft Corporation><5.00.2195.6997>
[PID: 1852][\??\C:\WINNT\system32\csrss.exe]  <Microsoft Corporation><5.00.2195.6601>
[PID: 1876][\??\C:\WINNT\system32\winlogon.exe]  <Microsoft Corporation><5.00.2195.6997>
[PID: 2012][C:\WINNT\system32\conime.exe]  <Microsoft Corporation><5.00.2195.6655>
[PID: 460][C:\WINNT\Explorer.EXE]  <Microsoft Corporation><5.00.3700.6690>
    [C:\Program Files\WinRAR\rarext.dll]  <N/A><N/A>
    [C:\WINNT\system32\ravext.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
    [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll]  <Adobe Systems Incorporated><7.0.7.2006011200>
    [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll]  <Adobe Systems, Inc.><7.0.0.0>
[PID: 2040][C:\WINNT\System32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 2172][C:\WINNT\system32\cpqteam.exe]  <Hewlett-Packard Company><7.41.0.5>
[PID: 2192][C:\Program Files\Rising\Rav\RavTask.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [C:\Program Files\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
[PID: 2212][C:\Program Files\Rising\Rav\Ravmon.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 1, 30>
    [C:\Program Files\Rising\Rav\RsGuiLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 24>
    [C:\Program Files\Rising\Rav\BWList.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 18>
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [C:\Program Files\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\Program Files\Rising\Rav\PngDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 2220][C:\WINNT\system32\internat.exe]  <Microsoft Corporation><5.00.2920.0000>
[PID: 512][E:\智能扫描\sreng2\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>
gototop
 

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  Error. ["C:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  Error. []
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================
gototop
 
1234   3  /  4  页   跳转
页面顶部
Powered by Discuz!NT