高手来看看我C盘文件是否正常!!!!!!!! - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛高手来看看我C盘文件是否正常!!!!!!!!

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

12

1 / 2 页

跳转页

高手来看看我C盘文件是否正常!!!!!!!!

nomads 初生襁褓狮帖子:8 注册: 2006-10-04 来自:	发表于： 2006-10-04 12:36 \| 只看楼主短消息资料字号：小中大 1楼高手来看看我C盘文件是否正常!!!!!!!! 肯定是中毒了,可又不知道中了哪些,杀毒软件杀过重启还有.现在把图放上来,高手指点一下吧!!!! 附件: 文件名:7612912006104122846.JPG 下载次数:203 文件类型:image/pjpeg 文件大小: 上传时间:2006-10-4 12:36:59 描述: 2006-10-05 00:59:09
nomads 初生襁褓狮帖子:8 注册: 2006-10-04 来自:	分享到：

newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:	发表于： 2006-10-04 12:41 \| 短消息资料字号：小中大 2楼那些exe文件基本都不是好东西
newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:

mxdg 初生襁褓狮帖子:204 注册: 2005-08-14 来自:	发表于： 2006-10-04 12:42 \| 短消息资料字号：小中大 3楼有病毒用HijackThis扫描下
mxdg 初生襁褓狮帖子:204 注册: 2005-08-14 来自:

nomads 初生襁褓狮帖子:8 注册: 2006-10-04 来自:	发表于： 2006-10-04 12:48 \| 只看楼主短消息资料字号：小中大 4楼 Logfile of HijackThis v1.99.1 Scan saved at 12:36:07, on 2006-10-4 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\Mamager.exe C:\WINDOWS\system32\conime.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Administrator\桌面\HijackThis.exe R3 - URLSearchHook: (no name) - {6D53ADB7-6AD5-4A59-BFE4-7B57D2F4AA89} - (no file) O1 - Hosts: 125.91.1.20 localhost O1 - Hosts: 125.91.1.20 www.7322.com O1 - Hosts: 125.91.1.20 www.5566.net O1 - Hosts: 125.91.1.20 www.v111.com O1 - Hosts: 125.91.1.20 www.gjj.cc O1 - Hosts: 125.91.1.20 www.hao123.com O1 - Hosts: 125.91.1.20 www.265.com O1 - Hosts: 125.91.1.20 www.9991.com O1 - Hosts: 61.141.31.11 www.v111.com O1 - Hosts: 61.141.31.11 www.gjj.cc O1 - Hosts: 61.141.31.11 www.9505.com O1 - Hosts: 61.141.31.11 www.7939.com O1 - Hosts: 61.141.31.11 59.34.148.98 O1 - Hosts: 61.141.31.11 about:blank O1 - Hosts: 61.141.31.11 down.Virussky.com O1 - Hosts: 61.141.31.11 60.191.60.108 O1 - Hosts: 61.141.31.11 219.153.20.209 O4 - HKLM\..\Run: [xy] C:\WINDOWS\Download\svhost32.exe O4 - HKLM\..\Run: [winla] c:\winla\winla.exe O4 - HKLM\..\Run: [Ljx] C:\WINDOWS\inf\rundll32.exe O4 - HKLM\..\Run: [run] rundll32.exe rsrc.dll s O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm O8 - Extra context menu item: 金山毒霸反钓鱼... - D:\丁威\kav\KAF\ShowSet.htm O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll (file missing) O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll (file missing) O16 - DPF: {2354A44B-3CEB-4829-9940-545B03103538} (PowerPlr Control) - http://bb.wuhan.net.cn/plugin/PowerPlr.ocx O16 - DPF: {8686F2A6-DC01-4E8F-BDE3-DCC7DBBAD6AE} (163Uploader Control) - http://upload.photo.163.com/163Uploader.cab O20 - AppInit_DLLs: KB896588M.LOG 上面是扫描的日志,我也不懂是怎么个意思,还请各位知道的朋友指点一下,谢谢各位的帮忙:)
nomads 初生襁褓狮帖子:8 注册: 2006-10-04 来自:

newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:	发表于： 2006-10-04 12:55 \| 短消息资料字号：小中大 5楼日志不全把
newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:

mxdg 初生襁褓狮帖子:204 注册: 2005-08-14 来自:	发表于： 2006-10-04 12:56 \| 短消息资料字号：小中大 6楼修复 R3 - URLSearchHook: (no name) - {6D53ADB7-6AD5-4A59-BFE4-7B57D2F4AA89} - (no file) O1 - Hosts: 125.91.1.20 localhost O1 - Hosts: 125.91.1.20 www.7322.com O1 - Hosts: 125.91.1.20 www.5566.net O1 - Hosts: 125.91.1.20 www.v111.com O1 - Hosts: 125.91.1.20 www.gjj.cc O1 - Hosts: 125.91.1.20 www.hao123.com O1 - Hosts: 125.91.1.20 www.265.com O1 - Hosts: 125.91.1.20 www.9991.com O1 - Hosts: 61.141.31.11 www.v111.com O1 - Hosts: 61.141.31.11 www.gjj.cc O1 - Hosts: 61.141.31.11 www.9505.com O1 - Hosts: 61.141.31.11 www.7939.com O1 - Hosts: 61.141.31.11 59.34.148.98 O1 - Hosts: 61.141.31.11 about:blank O1 - Hosts: 61.141.31.11 down.Virussky.com O1 - Hosts: 61.141.31.11 60.191.60.108 O1 - Hosts: 61.141.31.11 219.153.20.209 O4 - HKLM\..\Run: [xy] C:\WINDOWS\Download\svhost32.exe O4 - HKLM\..\Run: [winla] c:\winla\winla.exe O4 - HKLM\..\Run: [Ljx] C:\WINDOWS\inf\rundll32.exe O4 - HKLM\..\Run: [run] rundll32.exe rsrc.dll s O20 - AppInit_DLLs: KB896588M.LOG 重启后删除 C:\WINDOWS\Download\svhost32.exe c:\winla\winla.exe C:\WINDOWS\inf\rundll32.exe 还有只到 020 就没了?
mxdg 初生襁褓狮帖子:204 注册: 2005-08-14 来自:

我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林	发表于： 2006-10-04 12:56 \| 短消息资料字号：小中大 7楼关闭所有浏览窗口以及一些不必要的程序运行Hijackthis，扫描结束后在下列选项前打上勾，然后选"修复"" O20 - AppInit_DLLs: KB896588M.LOG R3 - URLSearchHook: (no name) - {6D53ADB7-6AD5-4A59-BFE4-7B57D2F4AA89} - (no file) O1 - Hosts: 125.91.1.20 localhost O1 - Hosts: 125.91.1.20 www.7322.com O1 - Hosts: 125.91.1.20 www.5566.net O1 - Hosts: 125.91.1.20 www.v111.com O1 - Hosts: 125.91.1.20 www.gjj.cc O1 - Hosts: 125.91.1.20 www.hao123.com O1 - Hosts: 125.91.1.20 www.265.com O1 - Hosts: 125.91.1.20 www.9991.com O1 - Hosts: 61.141.31.11 www.v111.com O1 - Hosts: 61.141.31.11 www.gjj.cc O1 - Hosts: 61.141.31.11 www.9505.com O1 - Hosts: 61.141.31.11 www.7939.com O1 - Hosts: 61.141.31.11 59.34.148.98 O1 - Hosts: 61.141.31.11 about:blank O1 - Hosts: 61.141.31.11 down.Virussky.com O1 - Hosts: 61.141.31.11 60.191.60.108 O1 - Hosts: 61.141.31.11 219.153.20.209 O4 - HKLM\..\Run: [xy] C:\WINDOWS\Download\svhost32.exe O4 - HKLM\..\Run: [winla] c:\winla\winla.exe O4 - HKLM\..\Run: [Ljx] C:\WINDOWS\inf\rundll32.exe O4 - HKLM\..\Run: [run] rundll32.exe rsrc.dll s 请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来下载网址 http://www.kztechs.com/sreng/sreng2.zip http://forum.ikaka.com/topic.asp?board=67&artid=5188931 日志一次粘不完，分次粘完，请不要修改。 C盘中的EXE程序，可以考虑删除。
我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林

nomads 初生襁褓狮帖子:8 注册: 2006-10-04 来自:	发表于： 2006-10-04 12:58 \| 只看楼主短消息资料字号：小中大 8楼谢谢楼上各位帮忙.我要对他们开刀了!
nomads 初生襁褓狮帖子:8 注册: 2006-10-04 来自:

nomads 初生襁褓狮帖子:8 注册: 2006-10-04 来自:	发表于： 2006-10-04 13:01 \| 只看楼主短消息资料字号：小中大 9楼我是用的hijackthis扫描的,也是他自己保存的日志,就这么些啊
nomads 初生襁褓狮帖子:8 注册: 2006-10-04 来自:

nomads 初生襁褓狮帖子:8 注册: 2006-10-04 来自:	发表于： 2006-10-04 13:08 \| 只看楼主短消息资料字号：小中大 10楼启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <load><> [N/A] <run><> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <run><rundll32.exe rsrc.dll s> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [(Verified)Microsoft Corporation] <Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <UIHost><logonui.exe> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{AEB6717E-7E19-11d0-97EE-00C04FD91972}><shell32.dll> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] <PostBootReminder><%SystemRoot%\system32\SHELL32.dll> [(Verified)Microsoft Corporation] <CDBurn><%SystemRoot%\system32\SHELL32.dll> [(Verified)Microsoft Corporation] <WebCheck><%SystemRoot%\system32\webcheck.dll> [(Verified)Microsoft Corporation] <SysTray><C:\WINDOWS\system32\stobject.dll> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] <WinlogonNotify: crypt32chain><crypt32.dll> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] <WinlogonNotify: cryptnet><cryptnet.dll> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] <WinlogonNotify: cscdll><cscdll.dll> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] <WinlogonNotify: ScCertProp><wlnotify.dll> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] <WinlogonNotify: Schedule><wlnotify.dll> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] <WinlogonNotify: sclgntfy><sclgntfy.dll> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] <WinlogonNotify: SensLogn><WlNotify.dll> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] <WinlogonNotify: termsrv><wlnotify.dll> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] <WinlogonNotify: wlballoon><wlnotify.dll> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] <{438755C2-A8BA-11D1-B96B-00A0C90312E1}><%SystemRoot%\system32\browseui.dll> [(Verified)Microsoft Corporation] <{8C7461EF-2B13-11d2-BE35-3078302C2030}><%SystemRoot%\system32\browseui.dll> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <-987805><; C:\WINDOWS\system32\-987805.exe> [N/A] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><; C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation] <KavStart><; "D:\丁威\kav\KAVStart.exe" -startup> [Kingsoft Corporation] <PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Corporation] <PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation] <Realplayer.exe><; C:\WINDOWS\system32\Realplayer.exe> [N/A] <SunJavaUpdateSched><; C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe> [Sun Microsystems, Inc.] <TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.] <Tray><; C:\WINDOWS\command\rundll32.exe> [N/A] <xy><; C:\WINDOWS\Download\svhost32.exe> [N/A]
nomads 初生襁褓狮帖子:8 注册: 2006-10-04 来自:

<<上一主题|下一主题>>

12

1 / 2 页

跳转页

页面顶部

Powered by Discuz!NT