电脑中毒了，菜鸟求救！ - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛电脑中毒了，菜鸟求救！

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第四十七次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

1

1 / 1 页

跳转页

电脑中毒了，菜鸟求救！

碧空明月初生襁褓狮帖子:2 注册: 2005-07-03 来自:	发表于： 2005-07-03 21:57 \| 只看楼主短消息资料字号：小中大 1楼电脑中毒了，菜鸟求救！这几天一上网就老自动弹出一些从没去过的网站，现已下载了Hijack1.99,扫描结果如下，请各位大虾指点一下，感激不尽！ R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINNT\nem220.dll O2 - BHO: CNNIC_IDN - {35980F6E-A137-4E50-953D-813BB8556899} - C:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll O2 - BHO: (no name) - {8C774050-292E-77D8-AF2D-FAB46039BDFA} - C:\WINNT\system32\cdmdownld\idqjfudiur.dll O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\WINNT\wsem303.dll O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINNT\system32\msbe.dll O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe O4 - HKLM\..\Run: [rfw] C:\Program Files\rising\Rfw\Rfw.exe O4 - HKLM\..\Run: [RavTimer] C:\PROGRA~1\rising\Rav\RavTimer.exe O4 - HKLM\..\Run: [RavMon] C:\PROGRA~1\rising\Rav\RavMon.exe O4 - HKLM\..\Run: [Msbb.exe] Msbb.exe O4 - HKLM\..\Run: [ati control panel] atiphexx.exe O4 - HKLM\..\Run: [WindowsRegKey update] winupdatez.exe O4 - HKLM\..\Run: [Microsoft Update Time] wuam.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [CdnCtr] C:\Program Files\CNNIC\Cdn\cdnup.exe O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe" O4 - HKLM\..\Run: [WeirdOnTheWeb] "C:\Program Files\WeirdOnTheWeb\WeirdOnTheWeb.exe" O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe O4 - HKLM\..\Run: [msxct] msxct.exe O4 - HKLM\..\Run: [Yhawmlca] C:\Program Files\Tdrrma\Izrco.exe O4 - HKLM\..\Run: [ap9h4qmo] C:\WINNT\system32\ap9h4qmo.exe O4 - HKLM\..\RunServices: [RavMon] C:\PROGRA~1\rising\Rav\RavMon.exe /AUTO O4 - HKLM\..\RunServices: [Msbb.exe] Msbb.exe O4 - HKLM\..\RunServices: [ati control panel] atiphexx.exe O4 - HKLM\..\RunServices: [WindowsRegKey update] winupdatez.exe O4 - HKLM\..\RunServices: [Microsoft Update Time] wuam.exe O4 - HKCU\..\Run: [ati control panel] atiphexx.exe O4 - HKCU\..\Run: [Msbb.exe] Msbb.exe O4 - HKCU\..\Run: [WindowsRegKey update] winupdatez.exe O4 - HKCU\..\Run: [Microsoft Update Time] wuam.exe O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe O4 - HKCU\..\Run: [180ClientStubInstall] "C:\Temp\180SA3013.exe" O4 - Startup: 腾讯QQ.lnk = C:\Program Files\Tencent\QQ\QQ.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Photo Loader supervisory.lnk = C:\Program Files\CASIO\Photo Loader\Plauto.exe O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe O4 - Global Startup: 服务管理器.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe O8 - Extra context menu item: 使用网际快车下载 - C:\PROGRA~1\FLASHGET\jc_link.htm O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\PROGRA~1\FLASHGET\jc_all.htm O8 - Extra context menu item: 导出到 Microsoft Excel(&x) - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm O9 - Extra button: 中文上网 - {35980F6E-A137-4E50-953D-813BB8556899} - C:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll O9 - Extra 'Tools' menuitem: 中文上网 - {35980F6E-A137-4E50-953D-813BB8556899} - C:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe O11 - Options group: [CDNCLIENT] 中文上网 O14 - IERESET.INF: SEARCH_PAGE_URL= O14 - IERESET.INF: START_PAGE_URL= O16 - DPF: {9A578C98-3C2F-4630-890B-FC04196EF420} (CNNIC_IDN) - http://client.jogo.cn/cdnClient/cab/cdn.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{CABEC79D-FC01-4A50-B4CD-2D96AD19A91F}: NameServer = 61.144.56.101 202.96.128.86 O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: Rising Process Communication Center (RsCCenter) - rising - C:\Program Files\rising\rav\CCenter.exe O23 - Service: Rising Realtime Monitor Service (RsRavMon) - rising - C:\Program Files\rising\rav\RavMonD.exe O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINNT\svcproc.exe 2005-07-04 23:44:03
碧空明月初生襁褓狮帖子:2 注册: 2005-07-03 来自:	分享到：

魔法学徒卡卡技术团队帖子:11465 注册: 2004-10-03 来自:	发表于： 2005-07-03 22:24 \| 短消息资料字号：小中大 2楼您的log不全建议尝试在控制面板的添加删除程序中卸载BullsEye Network、Internet Optimizer、Media Access、WeirdOnTheWeb、Tdrrma 不论是否能够找到卸载项，请进行下一步重新启动电脑, 开机检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式进入Windows 终止可疑的进程运行Hijackthis，扫描结束后在下列选项前打上勾，然后选修复“Fix Checked”： R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINNT\nem220.dll O2 - BHO: (no name) - {8C774050-292E-77D8-AF2D-FAB46039BDFA} - C:\WINNT\system32\cdmdownld\idqjfudiur.dll O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\WINNT\wsem303.dll O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINNT\system32\msbe.dll O4 - HKLM\..\Run: [Msbb.exe] Msbb.exe O4 - HKLM\..\Run: [ati control panel] atiphexx.exe O4 - HKLM\..\Run: [WindowsRegKey update] winupdatez.exe O4 - HKLM\..\Run: [Microsoft Update Time] wuam.exe O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe" O4 - HKLM\..\Run: [WeirdOnTheWeb] "C:\Program Files\WeirdOnTheWeb\WeirdOnTheWeb.exe" O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe O4 - HKLM\..\Run: [msxct] msxct.exe O4 - HKLM\..\Run: [Yhawmlca] C:\Program Files\Tdrrma\Izrco.exe O4 - HKLM\..\Run: [ap9h4qmo] C:\WINNT\system32\ap9h4qmo.exe O4 - HKLM\..\RunServices: [Msbb.exe] Msbb.exe O4 - HKLM\..\RunServices: [ati control panel] atiphexx.exe O4 - HKLM\..\RunServices: [WindowsRegKey update] winupdatez.exe O4 - HKLM\..\RunServices: [Microsoft Update Time] wuam.exe O4 - HKCU\..\Run: [Msbb.exe] Msbb.exe O4 - HKCU\..\Run: [WindowsRegKey update] winupdatez.exe O4 - HKCU\..\Run: [Microsoft Update Time] wuam.exe O4 - HKCU\..\Run: [ati control panel] atiphexx.exe O4 - HKCU\..\Run: [180ClientStubInstall] "C:\Temp\180SA3013.exe" O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINNT\svcproc.exe 显示隐藏文件双击我的电脑--工具---文件夹选项--查看选项卡--单击选取"显示隐藏文件或文件夹"--清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示您确定更改时，单击“是”--单击“确定”。然后找到如下文件并删除（如果有的话）。 C:\WINNT\nem220.dll C:\WINNT\system32\cdmdownld\整个目录 C:\WINNT\wsem303.dll C:\WINNT\system32\msbe.dll Msbb.exe（请用开始菜单中的搜索功能查找） winupdatez.exe（请用开始菜单中的搜索功能查找） wuam.exe（请用开始菜单中的搜索功能查找） C:\Program Files\Media Access\整个目录 C:\Program Files\Internet Optimizer\整个目录 C:\Program Files\WeirdOnTheWeb\整个目录 C:\Program Files\BullsEye Network\整个目录 msxct.exe（请用开始菜单中的搜索功能查找） C:\Program Files\Tdrrma\整个目录 C:\WINNT\system32\ap9h4qmo.exe C:\Temp\180SA3013.exe C:\WINNT\svcproc.exe atiphexx.exe（请用开始菜单中的搜索功能查找）
魔法学徒卡卡技术团队帖子:11465 注册: 2004-10-03 来自:

碧空明月初生襁褓狮帖子:2 注册: 2005-07-03 来自:	发表于： 2005-07-04 21:54 \| 只看楼主短消息资料字号：小中大 3楼谢谢魔法学徒的鼎力相助！！我已按您的建议去做了，现在上网时没再出现自动弹出网页的情况，真的是感激不尽！下面是我“驱毒”后用Hijack1.99再次扫描的结果。 O2 - BHO: CNNIC_IDN - {35980F6E-A137-4E50-953D-813BB8556899} - C:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll O2 - BHO: (no name) - {7022A4B4-CD0D-5B00-C478-CE245069C46E} - C:\WINNT\system32\cdmdownld\idqjfudiur.dll (file missing) O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe O4 - HKLM\..\Run: [rfw] C:\Program Files\rising\Rfw\Rfw.exe O4 - HKLM\..\Run: [RavTimer] C:\PROGRA~1\rising\Rav\RavTimer.exe O4 - HKLM\..\Run: [RavMon] C:\PROGRA~1\rising\Rav\RavMon.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [CdnCtr] C:\Program Files\CNNIC\Cdn\cdnup.exe O4 - HKLM\..\Run: [gah95on6] C:\WINNT\system32\gah95on6.exe O4 - HKLM\..\RunServices: [RavMon] C:\PROGRA~1\rising\Rav\RavMon.exe /AUTO O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe O4 - Startup: 腾讯QQ.lnk = C:\Program Files\Tencent\QQ\QQ.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Photo Loader supervisory.lnk = C:\Program Files\CASIO\Photo Loader\Plauto.exe O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe O4 - Global Startup: 服务管理器.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe O8 - Extra context menu item: 使用网际快车下载 - C:\PROGRA~1\FLASHGET\jc_link.htm O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\PROGRA~1\FLASHGET\jc_all.htm O8 - Extra context menu item: 导出到 Microsoft Excel(&x) - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm O9 - Extra button: 中文上网 - {35980F6E-A137-4E50-953D-813BB8556899} - C:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll O9 - Extra 'Tools' menuitem: 中文上网 - {35980F6E-A137-4E50-953D-813BB8556899} - C:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe O11 - Options group: [CDNCLIENT] 中文上网 O14 - IERESET.INF: SEARCH_PAGE_URL= O14 - IERESET.INF: START_PAGE_URL= O16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} (ClientInstaller Class) - http://www.180searchassistant.com/180saax.cab O16 - DPF: {9A578C98-3C2F-4630-890B-FC04196EF420} (CNNIC_IDN) - http://client.jogo.cn/cdnClient/cab/cdn.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{CABEC79D-FC01-4A50-B4CD-2D96AD19A91F}: NameServer = 61.144.56.101 202.96.128.86 O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: Rising Process Communication Center (RsCCenter) - rising - C:\Program Files\rising\rav\CCenter.exe O23 - Service: Rising Realtime Monitor Service (RsRavMon) - rising - C:\Program Files\rising\rav\RavMonD.exe O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINNT\svcproc.exe
碧空明月初生襁褓狮帖子:2 注册: 2005-07-03 来自:

建能横据古稀狮帖子:5755 注册: 2005-04-01 来自:	发表于： 2005-07-04 22:07 \| 短消息资料字号：小中大 4楼 O2 - BHO: (no name) - {7022A4B4-CD0D-5B00-C478-CE245069C46E} - C:\WINNT\system32\cdmdownld\idqjfudiur.dll (file missing) O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINNT\svcproc.exe O16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} (ClientInstaller Class) - http://www.180searchassistant.com/180saax.cab 在安全摸试下修复上面几项)（如果你清楚某项是安全的，可以不处理），将隐藏的文件不隐藏。找到下面几项 c:\WINNT\svcproc.exe C:\WINNT\system32\cdmdownld\idqjfudiur.dll 把它们删除。
建能横据古稀狮帖子:5755 注册: 2005-04-01 来自:

魔法学徒卡卡技术团队帖子:11465 注册: 2004-10-03 来自:	发表于： 2005-07-04 23:44 \| 短消息资料字号：小中大 5楼建能朋友已经指出了一些有问题的地方建议重新启动电脑, 开机检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式进入Windows 终止可疑的进程运行Hijackthis，扫描结束后在下列选项前打上勾，然后选修复“Fix Checked”： O2 - BHO: (no name) - {7022A4B4-CD0D-5B00-C478-CE245069C46E} - C:\WINNT\system32\cdmdownld\idqjfudiur.dll (file missing) O4 - HKLM\..\Run: [gah95on6] C:\WINNT\system32\gah95on6.exe O16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} (ClientInstaller Class) - http://www.180searchassistant.com/180saax.cab O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINNT\svcproc.exe 显示隐藏文件双击我的电脑--工具---文件夹选项--查看选项卡--单击选取"显示隐藏文件或文件夹"--清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示您确定更改时，单击“是”--单击“确定”。然后找到如下文件并删除（如果有的话）。 C:\WINNT\system32\cdmdownld\整个目录 C:\WINNT\system32\gah95on6.exe C:\WINNT\svcproc.exe 请您再贴log时，将完整的log贴上来，包括正在运行的进程部分
魔法学徒卡卡技术团队帖子:11465 注册: 2004-10-03 来自:

<<上一主题|下一主题>>

1

1 / 1 页

跳转页

页面顶部

Powered by Discuz!NT