各位老大,这个病毒怎么杀啊?用瑞星每次都告诉我清除成功,可是每次重启都有,请各位指教了,谢谢!急啊
附Hijackthis日志,高手们帮看一下,谢谢!
Logfile of HijackThis v1.99.1
Scan saved at 11:14:38, on 2005-9-11
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
C:\PROGRAM FILES\RISING\RAV\RavStub.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\INTERNET Explorer\IexpLORE.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Compaq\EAB\EABSERVR.EXE
C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
C:\PROGRA~1\RISING\RAV\RAVMON.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
F:\Ringz Studio\Storm Downloader\StormDownloader.exe
C:\WINDOWS\System32\hosts.exe
F:\Ringz Studio\Storm Downloader\TDUpdate.exe
C:\WINDOWS\System32\ctfmon.exe
F:\155847200541134207\HijackThis.exe
R3 - Default URLSearchHook is missing
O1 - Hosts: 210.22.14.182 www.163.com
O1 - Hosts: 210.22.14.182 www.sohu.com
O1 - Hosts: 210.22.14.182 www.sina.com.cn
O1 - Hosts: 210.22.14.182 www.chinagames.net
O1 - Hosts: 210.22.14.182 www.mir2.com.cn
O1 - Hosts: 210.22.14.182 cn.yahoo.com
O1 - Hosts: 210.22.14.182 www.baidu.com
O1 - Hosts: 210.22.14.182 www.google.com
O1 - Hosts: 210.22.14.182 www.ourgame.com
O1 - Hosts: 210.22.14.182 www.skycn.com
O1 - Hosts: 210.22.14.182 www.dy510.com
O1 - Hosts: 210.22.14.182 www.ku500.com
O1 - Hosts: 210.22.14.182 www.hao338.com
O1 - Hosts: 210.22.14.182 www.qq500.org
O1 - Hosts: 210.22.14.182 www.18dy.com
O1 - Hosts: 210.22.14.182 tw18.com
O1 - Hosts: 210.22.14.182
O1 - Hosts: 210.22.14.182 www.333uuu.com
O1 - Hosts: 210.22.14.182
O1 - Hosts: 210.22.14.182
O1 - Hosts: 210.22.14.182 dy66.cn
O1 - Hosts: 210.22.14.182 www.qq858.com
O1 - Hosts: 210.22.14.182 www.pigdns.net
O1 - Hosts: 210.22.14.182 www.hao858.com
O1 - Hosts: 210.22.14.182 www.kubao.com
O1 - Hosts: 210.22.14.182 www.dy5168.com
O1 - Hosts: 210.22.14.182 www.dy5168.com
O1 - Hosts: 210.22.14.182 www.wo888.com
O1 - Hosts: 210.22.14.182
O1 - Hosts: 210.22.14.182
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\System32\xunleibho_v4.dll
O2 - BHO: QQBrowserHelper
Object Class - {54EBD53A-9BC1-480B-966A-843A333CA162} - F:\Tencent\QQ\QQIEHelper.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {115F6E46-FCBC-41ed-B3B5-3BDDD4AAB5E5} - (no file)
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\Compaq\EAB\EABSERVR.EXE /Start
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\compaq\cpqsetup\cpqset.exe
O4 - HKLM\..\Run: [RavTimer] C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [RavMon] C:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AdbusUpdate] C:\WINDOWS\System32\adbus\update.exe
O4 - HKLM\..\Run: [StormCodec_Helper] "F:\Ringz Studio\Storm Codec\StormSet.exe" /S /opti
O4 - HKLM\..\Run: [MINI_BFYY] F:\Ringz Studio\Storm Downloader\StormDownloader.exe
O4 - HKLM\..\Run: [SysIEop] C:\WINDOWS\System32\hosts.exe
O4 - HKLM\..\Run: [DisplayName] www.772882.com
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: &使用暴风下载器下载 - F:\Ringz Studio\Storm Downloader\geturl.htm
O8 - Extra context menu item: &使用迅雷下载 - F:\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - F:\Thunder\getAllurl.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - F:\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - F:\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - F:\Tencent\QQ\SendMMS.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - F:\Tencent\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - F:\Tencent\QQ\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - F:\Tencent\QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - F:\Tencent\QQ\QQIEHelper.dll
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Msupdate - Unknown owner - C:\WINDOWS\help.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
O23 - Service: winieup (winie up) - Unknown owner - C:\WINDOWS\winup.exe
