瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 【谁来救救我】Trojan.Clicker.AdClick.b 病毒杀不掉

12   2  /  2  页   跳转

【谁来救救我】Trojan.Clicker.AdClick.b 病毒杀不掉

[CODE]

2007-02-04,11:24:50

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中:
    所有的启动项目(包括注册表、启动文件夹、服务等)
    浏览器加载项
    正在运行的进程(包括进程模块信息)
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><; C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Corporation]
    <NvMediaCenter><; RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit>  [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
    <run><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Corporation]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Corporation]
    <IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload>  [(Verified)Microsoft Corporation]
    <RavTask><"D:\瑞星软件\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
    <CertificateRegistration><; SafeSignCertReg.exe>  [A.E.T. Europe B.V.]
    <StormCodec_Helper><"d:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti>  [N/A]
    <NvCplDaemon><; RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>  [(Verified)NVIDIA Corporation]
    <RfwMain><; "D:\瑞星软件\Rising防火墙\Rfw\rfwmain.exe" -Startup>  [N/A]
    <Adobe Photo Downloader><; "D:\应用程序\3.0\Apps\apdproxy.exe">  [Adobe Systems Incorporated]
    <DaemonTools_WhenUSave_Installer><; >  [N/A]
    <KernelFaultCheck><; %systemroot%\system32\dumprep 0 -k>  [N/A]
    <LiveUpatePower><; >  [N/A]
    <MGDRIVE.EXE><; >  [N/A]
    <miniqqlive><; "D:\QQtv\MiniQQLive.exe">  [Tencent]
    <NetPlayerAgent><; D:\Program Files\TMPlayer\PlayerAgent.exe>  [N/A]
    <nwiz><; nwiz.exe /install>  [NVIDIA Corporation]
    <Rebort><; >  [N/A]
    <SoundMan><; SOUNDMAN.EXE>  [Realtek Semiconductor Corp.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,,"C:\Program Files\HFEE\SVOHOST.EXE" un userinit.exe>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll>  [Beijing Rising Technology Co., Ltd.]

==================================
启动文件夹
[腾讯QQ]


==================================
服务
[ASP.NET State Service / aspnet_state][Stopped/Manual Start]
  <C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe><Microsoft Corporation>
[Autodesk Licensing Service / Autodesk Licensing Service][Running/Auto Start]
  <"C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe"><Autodesk>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Macromedia Licensing Service / Macromedia Licensing Service][Stopped/Manual Start]
  <"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><N/A>
[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
  <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[P4P Service / P4P Service][Running/Auto Start]
  <C:\Program Files\Common Files\Sogou PXP\p2psvr.exe><Sohu.com Inc.>
[Rising Proxy  Service / RfwProxySrv][Stopped/Manual Start]
  <d:\瑞星软件\rising防火墙\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService][Running/Auto Start]
  <D:\瑞星软件\Rising防火墙\Rising\Rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
  <"D:\瑞星软件\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
  <"D:\瑞星软件\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[Smart Nets / Smart Nets][Running/Auto Start]
  <C:\WINDOWS\system32\SmartNet.exe><N/A>

==================================
gototop
 

处理结果:重新启动计算机后删除文件    发现日期:2007-02-03 23:40    路径:C:\Documents and Settings\All Users\Application Data\Microsoft\UserData    文件:IEHelper_5057.dll    病毒来源:本机
gototop
 

路径已经知道了,那就去安全模式杀了他吧.


进入安全模式,双击我的电脑-工具-文件夹选项-查看-显示所有文件和文件夹,显示系统文件夹的内容-确定
删除
gototop
 

还是老样子

附件附件:

下载次数:142
文件类型:image/pjpeg
文件大小:
上传时间:2007-2-4 12:29:26
描述:



gototop
 

下载冰刃.置顶有
gototop
 

这个方法挺有效,已经搞定了http://bbs.xdnice.com/b59t190481.htm?BoardID=59&replyID=218664&id=190481&skin=1
gototop
 
12   2  /  2  页   跳转
页面顶部
Powered by Discuz!NT