瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 回复:C:\WINDOWS\Temp\SafePage.htm是病毒吗?如何彻底的清除?

1   1  /  1  页   跳转

[原创] 回复:C:\WINDOWS\Temp\SafePage.htm是病毒吗?如何彻底的清除?

回复:C:\WINDOWS\Temp\SafePage.htm是病毒吗?如何彻底的清除?

回复:C:\WINDOWS\Temp\SafePage.htm是病毒吗?如何彻底的清除?
Logfile of HijackThis v1.99.1
Scan saved at 10:52:33, on 2010-6-25
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Ris\RavMonD.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Rising\Ris\RsTray.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Rising\AntiSpyware\rstray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sinfor\Ingress2\zrupdate.exe
C:\Program Files\Sinfor\Ingress2\ingress.exe
C:\Program Files\Sinfor\Ingress2\srport.exe
C:\Program Files\AliWangWang\aliim.exe
C:\Program Files\Sinfor\Ingress2\arpguard.exe
C:\Program Files\LeadingSoft\limc\LIMC.exe
D:\QQ\Bin\QQ.exe
D:\QQ\Bin\TXPlatform.exe
C:\Program Files\Thunder Network\Thunder\Program\Thunder.exe
C:\WINDOWS\system32\conime.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.281\HijackThis.exe

O1 - Hosts: ------ 屏蔽迅雷看看广告 ------
O2 - BHO: Thunder AtOnce - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Baidu Toolbar BHO - {77FEF28E-EB96-44FF-B511-3185DEA48697} - C:\Program Files\Baidu\Toolbar\BaiduBarX.dll
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll
O2 - BHO: 卡卡上网安全助手 - {98B7C13A-E9CD-4959-8B46-FBEAB41E42A8} - C:\WINDOWS\system32\UrlFilter.dll
O3 - Toolbar: Baidu Toolbar - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\Program Files\Baidu\Toolbar\BaiduBarX.dll
O3 - Toolbar: 金山快译(&K) - {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} - C:\Program Files\Kingsoft\FastAIT\IEBand.dll (file missing)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [RisTray] "C:\Program Files\Rising\Ris\RsTray.exe" -system
O4 - HKLM\..\Run: [runeip] "C:\Program Files\Rising\AntiSpyware\rstray.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [singress] C:\Program Files\Sinfor\Ingress2\ingress.exe -a
O4 - HKCU\..\Run: [sinforport] C:\Program Files\Sinfor\Ingress2\srport.exe
O4 - HKCU\..\Run: [aliim] C:\Program Files\AliWangWang\aliim.exe
O4 - Global Startup: 理正即时消息.lnk = ?
O8 - Extra context menu item: 使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: 使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\program\Thunder.exe
O9 - Extra 'Tools' menuitem: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\program\Thunder.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O16 - DPF: {02309C77-1B15-4309-AC7D-1376111A2648} (AtxIngress Class) - http://10.3.5.3/singress.cab
O16 - DPF: {FDD12101-DF26-4D7D-A0E4-DA1793165487} (LZFileDownload Class) - http://10.0.66.15/CabFiles/LZFileUpload.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A7B89AB6-B7E5-4313-986B-3B1DD8E252B7}: NameServer = 202.100.64.68
O18 - Protocol: mbox - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: mboxflash - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Ris Service (RsRisMon) - Beijing Rising Information Technology Co., Ltd. - C:\Program Files\Rising\Ris\RavMonD.exe
O23 - Service: Sinfor Ingress Updater (zrupdate) - Unknown owner - C:\Program Files\Sinfor\Ingress2\zrupdate.exe



用户系统信息:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
分享到:
gototop
 

回复:回复:C:\WINDOWS\Temp\SafePage.htm是病毒吗?如何彻底的清除?

你是指删除C:\WINDOWS\Temp\SafePage.htm文件后,过一阵又出现了??

估计是你的什么软件创建的吧
百年以后,你的墓碑旁 刻着的名字不是我
gototop
 

回复:回复:C:\WINDOWS\Temp\SafePage.htm是病毒吗?如何彻底的清除?

不是病毒,是访问恶意网站卡卡拦截时弹出的页面文件。
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT