机子 会弹出Internet Explorer
不时
用 瑞星 2005最新 和 木马克星都检测不出 病毒
木马克星 提示有新建文件
: C:\WINDOWS\SYSTEM32\Media2.Inf 2005-11-22 14:27:39
打开INF
800,600,http://code.dudusms.com/41.htm?userid=959
800,600,http://www.5xt.net/ads/ling.htm
800,600,http://cnt.zhaopin.com/Market/indexm.jsp?site=zhaopin&channel=hardiy
800,600,http://mlink.counter.dudu.com:8080/audit?a=5&b=2076&c=1240&d=1477&e=80&g=&f=
800,600,http://mlink.counter.dudu.com:8080/audit?a=5&b=2076&c=1240&d=1477&e=30&g=&f=
网址 就是不时弹出 IE的 网页内容
打开HijackThis
HijackThis_zww汉化版扫描日志 V1.99.1
保存于 14:31:10, 日期 2005-11-22
操作系统： Windows XP SP2 (WinNT 5.01.2600)
浏览器： Internet Explorer v6.00 SP2 (6.00.2900.2180)
当前运行的进程：
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
C:\PROGRA~1\RISING\RAV\RAVMON.EXE
C:\WINDOWS\VM_STI.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSNShell\BIN\MSNShell.exe
C:\WINDOWS\explorer.exe
E:\Program Files\Maxthon\Maxthon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
E:\Program Files\BitComet\BitComet.exe
E:\Program Files\Xi\NetTransport 2\NetTransport.exe
E:\Program Files\Iparmor\Iparmor.exe
E:\Program Files\HijackThis1991汉化版\HijackThis1991zww.exe
R3 - 默认的URLSearchHook丢失。用HijackThis修复
O1 - Hosts: 61.134.43.85 www.onlymiss.com
O1 - Hosts: 218.1.71.232 rm.dj-street.com
O1 - Hosts: 211.155.231.244 www.edushi.com
O1 - Hosts: 218.16.119.99 www.sogua.com
O1 - Hosts: 210.82.89.213 speedycars.net
O1 - Hosts: 61.152.115.189 www.7pu.com
O1 - Hosts: 58.215.64.138 www.shspgc.com
O1 - Hosts: 219.148.120.138 www.366tian.net
O1 - Hosts: 61.152.241.242 www.yes-asia.com.cn
O1 - Hosts: 217.110.117.14 www.t7online.com
O1 - Hosts: 61.172.255.37 bbs.taisha.org
O1 - Hosts: 218.83.154.90 www.youlan.net
O1 - Hosts: 206.132.82.52 www.piring.com
O1 - Hosts: 218.244.110.111 www.ehomeday.com
O1 - Hosts: 210.51.188.126 www.manfen.net
O1 - Hosts: 218.22.90.23 www.51wall.com
O1 - Hosts: 219.136.252.160 www.one2free.com.cn
O1 - Hosts: 222.186.8.88 lib.verycd.com
O1 - Hosts: 222.73.4.27 download.winzheng.com
O1 - Hosts: 61.129.81.7 www.hf110.com
O1 - Hosts: 61.152.108.10 www.blueyr.com
O1 - Hosts: 222.73.0.209 www.chinaz.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: 卡卡上网安全助手 - {AFF6E516-CBE5-4F8A-9C2F-38A68013E766}? - (no file)
O3 - IE工具栏增项: BitCometBar - {3F1ABCDB-A875-46c1-8345-B72A4567E486} - e:\Program Files\BitComet\BitCometBar\BitCometBar0.2.dll (file missing)
O3 - IE工具栏增项: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - 启动项HKLM\\Run: [RavTimer] C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
O4 - 启动项HKLM\\Run: [RavMon] C:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - 启动项HKLM\\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Teclast WE PC Camera
O4 - 启动项HKCU\\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - 启动项HKCU\\Run: [MSNShell] C:\Program Files\MSNShell\BIN\MSNShell.exe autorun
O8 - IE右键菜单中的新增项目: 使用影音传送带下载 - E:\Program Files\Xi\NetTransport 2\NTAddLink.html
O8 - IE右键菜单中的新增项目: 使用影音传送带下载全部链接 - E:\Program Files\Xi\NetTransport 2\NTAddList.html
O8 - IE右键菜单中的新增项目: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - 浏览器额外的按钮: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - 浏览器额外的按钮: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - 浏览器额外的“工具”菜单项: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3318E687-C01F-4671-95B3-B8851B125319}: NameServer = 202.96.209.6,202.96.209.133
O18 - 列举现有的协议: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - rising - C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
达人帮我看看
