瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 gtask.exe是什么程序?杀毒软件开机就自动关闭为什么?

1   1  /  1  页   跳转

gtask.exe是什么程序?杀毒软件开机就自动关闭为什么?

gtask.exe是什么程序?杀毒软件开机就自动关闭为什么?

我用的是金山毒霸,前两天突然开机就自动关闭毒霸和网镖,而任务管理器里面出现了一个gtask.exe的进程,这个程序是system32里面的,而且还是隐藏的系统进程,如果移除gtask.exe,则金山毒霸和网镖不会开机即关闭,但gtask.exe好像和windows的搜索程序有关,还不能随便删掉,这个现象很像是中毒,但是不知道如何处理?

金山查毒和安全模式下杀毒,都没有发现


朋友们给我想想办法,谢谢
最后编辑2005-09-07 03:04:15
分享到:
gototop
 

有HJ扫描日志吗?
gototop
 

没有,没用过HJ
gototop
 

贴上来了,谢谢帮我看看


Logfile of HijackThis v1.99.1
Scan saved at 18:54:34, on 2005-8-26
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\KAV6\KAVSvc.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\gtask.exe
C:\WINDOWS\System32\ctfmon.exe
C:\KAV6\Kavpfw.EXE
C:\KAV6\KAVPlus.exe
C:\KAV6\KWatchUI.EXE
C:\Program Files\MYIE2\MyIE.exe
G:\Z-ProgramFiles\HIjackThis\HijackThis.exe

R3 - URLSearchHook: 上网助手 - {1B0E7716-898E-48cc-9690-4E338E8DE1D3} - C:\PROGRA~1\3721\Assist\assist.dll
O2 - BHO: IDDTInitObj Class - {15DDE989-CD45-4561-BF99-D22C0D5C2B74} - (no file)
O2 - BHO: 上网助手 - {1B0E7716-898E-48cc-9690-4E338E8DE1D3} - C:\PROGRA~1\3721\Assist\assist.dll
O2 - BHO: T2BHO HDTBHO - {70B3DA2C-E02D-4ce0-B1F8-48320FD443D2} - (no file)
O2 - BHO: ReviseHelper Class - {749D1D7D-1969-4014-A98D-9E867E7508D0} - (no file)
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FLASHGET\jccatch.dll
O2 - BHO: DownloadBHO T2BHO - {B1D147E7-873E-4909-8127-695D9BB78728} - C:\WINDOWS\Downloaded Program Files\CONFLICT.3\barhelp22.0.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - Toolbar: 金山毒霸 - {A9BE2902-C447-420A-BB7F-A5DE921E6138} - C:\KAV6\KAIEPlus.DLL
O3 - Toolbar: 上网助手 - {1B0E7716-898E-48cc-9690-4E338E8DE1D3} - C:\PROGRA~1\3721\Assist\assist.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [KAVRun] C:\KAV6\KAVRun.EXE
O4 - HKLM\..\Run: [Kulansyn] C:\KAV6\Kulansyn.EXE
O4 - HKLM\..\Run: [KpopMon] C:\KAV6\KpopMon.EXE
O4 - HKLM\..\Run: [iDuba Personal FireWall] C:\KAV6\Kavpfw.EXE
O4 - HKCU\..\Run: [iDuba Personal FireWall] C:\KAV6\Kavpfw.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: 导出到 Microsoft Excel(&x) - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\qq\SendMMS.htm
O9 - Extra button: vpp - {0713E8D2-850A-101B-AFC0-4210102A8DA7} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: (no name) - {2253922F-1B26-4C74-8B57-E3AEE748DBB8} - (no file)
O9 - Extra button: 金山卓越 - {8DE0FCD4-5EB5-11D3-AD25-00002100131B} - url:http://www.joyo.com (file missing)
O9 - Extra button: 词霸 - {9A687CA6-D585-4947-9ED9-BE96071F5CD9} - C:\PROGRA~1\Kingsoft\POWERW~1\XDictExB.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra button: 金山毒霸网站 - {e1fc9760-7b95-49cd-80b9-8c9e41017b93} - url:http://www.duba.net (file missing)
O9 - Extra button: 在线查毒 - {f58d36c3-40be-4418-a786-d8fbe3eb3554} - C:\KAV6\kavie.HTM
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O15 - Trusted Zone: http://*.xxxtoolbar.com
O15 - Trusted Zone: *.05p.com (HKLM)
O15 - Trusted Zone: *.blazefind.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.flingstone.com (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.scoobidoo.com (HKLM)
O15 - Trusted Zone: *.searchbarcash.com (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.slotch.com (HKLM)
O15 - Trusted Zone: *.xxxtoolbar.com (HKLM)
O15 - Trusted IP range: 206.161.125.149 (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O16 - DPF: {DDA166FA-B3EA-4A3B-8EE2-4F552CDEEE81} (KATScan Control) - http://scan.kingsoft.com/scan/KatNewVerHtml/KATScan.CAB
O16 - DPF: {EF6205C1-3F17-4829-BCB5-1336ED89E356} - http://club.jiangmin.com/kvscan/KvDown.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A92BF5A3-C1A8-433F-9390-78DA30F34B4D}: NameServer = 202.106.0.20 202.106.46.151
O18 - Protocol: dic - {C21F5C32-F57A-4A0D-8E0A-B672691C52D0} - C:\PROGRA~1\Kingsoft\POWERW~1\XDictExB.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WindowsUpdate - C:\WINDOWS\
O21 - SSODL: System - {2BD5F7B5-A0A6-40B8-BFA6-CC940A7F3505} - (no file)
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - (no file)
O23 - Service: Kingsoft AntiVirus Service (KAVSvc) - kingsoft Antivirus - C:\KAV6\KAVSvc.EXE
O23 - Service: Smart Card Helper (SCardDrv) - Unknown owner - C:\WINDOWS\system32\SCardSer.exe (file missing)

gototop
 

把015修复了.

还有,这项O23 - Service: Smart Card Helper (SCardDrv) - Unknown owner - C:\WINDOWS\system32\SCardSer.exe (file missing)
有毛病.系统有漏洞,在控制面板 管理工具 服务里把SmartCard服务设为禁用
然后删了那个程序

gototop
 

把这个也修复了吧O20 - Winlogon Notify: WindowsUpdate - C:\WINDOWS\
gototop
 

谢谢楼上的朋友们,我今天升级了金山,终于把这个gtask.exe杀掉了,是个木马,金山的杀毒日志是:

发现病毒在: C:\WINDOWS\system32\gtask.exe
病毒名:Win32.Troj.PSWLmir.ge.97221
病毒类型: 其他病毒
处理结果: 删除
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT