瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 比较烦,好像中毒了,请哪位大侠帮我查一下,我附上报告

12   2  /  2  页   跳转

比较烦,好像中毒了,请哪位大侠帮我查一下,我附上报告

[F:\Program Files\rising\Rav\PngDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
    [C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys]  [N/A, N/A]
    [C:\WINDOWS\system32\bdscheca001.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\c.dll]  [N/A, N/A]
[PID: 588][F:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe]  [High Criteria inc., 5, 3, 0, 1]
    [C:\WINDOWS\System32\DrvTrNTm.dll]  [High Criteria inc., 5, 3, 0, 1]
    [C:\WINDOWS\System32\DrvTrNTl.dll]  [High Criteria inc., 5, 3, 0, 1]
    [C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys]  [N/A, N/A]
    [C:\WINDOWS\system32\bdscheca001.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\c.dll]  [N/A, N/A]
[PID: 600][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3512]
    [C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys]  [N/A, N/A]
    [C:\WINDOWS\system32\bdscheca001.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\c.dll]  [N/A, N/A]
[PID: 1848][C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe]  [InstallShield Software Corporation, 3, 10, 100, 1146]
    [C:\WINDOWS\system32\bdscheca001.dll]  [N/A, N/A]
    [C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys]  [N/A, N/A]
    [C:\WINDOWS\System32\c.dll]  [N/A, N/A]
[PID: 1444][C:\WINDOWS\System32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys]  [N/A, N/A]
    [C:\WINDOWS\system32\bdscheca001.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\c.dll]  [N/A, N/A]
[PID: 2876][F:\Program Files\Maxthon\Maxthon.exe]  [Maxthon International Ltd., 1, 5, 6, 42]
    [F:\Program Files\Maxthon\maxzlib.dll]  [ , 1, 0, 0, 2]
    [C:\WINDOWS\System32\DrvTrNTm.dll]  [High Criteria inc., 5, 3, 0, 1]
    [C:\WINDOWS\System32\DrvTrNTl.dll]  [High Criteria inc., 5, 3, 0, 1]
    [C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys]  [N/A, N/A]
    [C:\WINDOWS\System32\AcSignIcon.dll]  [Autodesk, 16.2.54.0]
    [F:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll]  [Thunder Networking Technologies,LTD, 5, 0, 0, 2]
    [F:\Program Files\Maxthon\Plugin\FloatBar\FloatBar.dll]  [, 1, 8, 0, 0]
    [C:\WINDOWS\system32\bdscheca001.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\c.dll]  [N/A, N/A]
    [F:\Program Files\Maxthon\Services\RealTime\real_time.dll]  [, 1, 0, 0, 1]
    [C:\WINDOWS\System32\Macromed\Flash\Flash8b.ocx]  [Macromedia, Inc., 8,0,24,0]
    [f:\Program Files\rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll]  [Autodesk, 16.2.54.0]
    [C:\Program Files\Thunder Network\WebThunder\MediaAddin10.dll]  [Thunder Networking Technologies,LTD, 3, 1, 0, 62]
[PID: 3208][C:\Program Files\Thunder Network\WebThunder\WebThunder.exe]  [深圳市迅雷网络技术有限公司, 1, 5, 0, 77]
    [C:\Program Files\Thunder Network\WebThunder\taskmanage.dll]  [Thunder Networking Technologies,LTD, 1, 5, 0, 77]
    [C:\Program Files\Thunder Network\WebThunder\download_interface.dll]  [Thunder Networking Technologies,LTD, 2, 11, 3, 22]
    [C:\Program Files\Thunder Network\WebThunder\asyn_dns.dll]  [Thunder Networking Technologies,LTD, 2, 11, 3, 22]
    [C:\Program Files\Thunder Network\WebThunder\RegisterDll.dll]  [Thunder Networking Technologies,LTD, 2, 2, 1, 39]
    [C:\WINDOWS\System32\DrvTrNTm.dll]  [High Criteria inc., 5, 3, 0, 1]
    [C:\WINDOWS\System32\DrvTrNTl.dll]  [High Criteria inc., 5, 3, 0, 1]
    [C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys]  [N/A, N/A]
    [C:\Program Files\Thunder Network\WebThunder\historyinfo_manage.dll]  [Thunder Networking Technologies,LTD, 5, 3, 0, 228]
    [C:\Program Files\Thunder Network\WebThunder\UpdateDownload.dll]  [Thunder Networking Technologies,LTD, 1, 0, 1, 8]
    [C:\Program Files\Thunder Network\WebThunder\UpdateExec.dll]  [Thunder Networking Technologies,LTD, 1, 0, 1, 5]
    [C:\Program Files\Thunder Network\WebThunder\iEmbedShell.dll]  [ , 1, 0, 0, 14]
    [C:\Program Files\Thunder Network\WebThunder\iEmbed07.dll]  [ , 3, 1, 0, 58]
    [C:\WINDOWS\system32\bdscheca001.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\c.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\Macromed\Flash\Flash8b.ocx]  [Macromedia, Inc., 8,0,24,0]
    [C:\WINDOWS\System32\AcSignIcon.dll]  [Autodesk, 16.2.54.0]
[PID: 3800][C:\Program Files\WinRAR\WinRAR.exe]  [N/A, N/A]
    [C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys]  [N/A, N/A]
    [C:\WINDOWS\System32\AcSignIcon.dll]  [Autodesk, 16.2.54.0]
    [C:\WINDOWS\system32\bdscheca001.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\c.dll]  [N/A, N/A]
[PID: 3820][C:\DOCUME~1\mxy\LOCALS~1\Temp\Rar$EX00.656\SREng.EXE]  [Smallfrogs Studio, 2.3.13.690]
    [C:\WINDOWS\System32\DrvTrNTm.dll]  [High Criteria inc., 5, 3, 0, 1]
    [C:\WINDOWS\System32\DrvTrNTl.dll]  [High Criteria inc., 5, 3, 0, 1]
    [C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys]  [N/A, N/A]
    [C:\WINDOWS\system32\bdscheca001.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\c.dll]  [N/A, N/A]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
N/A

==================================
API HOOK
N/A

==================================


[/CODE]
gototop
 

全部发上了,请高手帮我看一下,是不是病毒没用了
gototop
 

安全模式下删除;
C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys
C:\WINDOWS\system32\bdscheca001.dll
C:\WINDOWS\System32\c.dll
C:\WINDOWS\System32\mssapi.dll
C:\WINDOWS\System32\windhcp.ocx
C:\WINDOWS\System32\xpdhcp.dll
C:\WINDOWS\System32\drivers\EagleNT.sys
SystemRoot\System32\DRIVERS\kiaroc28.sys
C:\WINDOWS\System32\new.sys

运行SREng2,使用“启动项目”--注册表--删除
<load><; ?矹?词矵?逷矵?????> [N/A]
<run><; ?矹?词矵?逷矵?????> [N/A]
运行(双击)SRENG2,点“启动项目,服务,点“Win32服务应用程序”
勾选“隐藏微软服务”选中病毒服务
[Portable Equipment Service / Investor][Stopped/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\System32\mssapi.dll><N/A>
[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]
<C:\WINDOWS\System32\\rundll32.exe windhcp.ocx,start><Microsoft Corporation>
[WinXP DHCP Service / WinXPDHCPsvc][Stopped/Auto Start]
<C:\WINDOWS\System32\rundll32.exe xpdhcp.dll,start><Microsoft Corporation>
,选择“删除服务”
点“设置”选择“否”

运行(双击)SRENG2,点“启动项目,服务,点“驱动程序”
勾选“隐藏微软服务”选中病毒服务
[EagleNT / EagleNT][Stopped/Manual Start]
<\??\C:\WINDOWS\System32\drivers\EagleNT.sys><N/A>
[kiaroc2 / kiaroc28][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\kiaroc28.sys><N/A>
[New0 / New0][Running/Auto Start]
<\??\C:\WINDOWS\System32\new.sys><N/A>
,选择“删除服务”
点“设置”选择“否”

gototop
 
12   2  /  2  页   跳转
页面顶部
Powered by Discuz!NT