前些天为了解决一个视频问题,安装了很多不明软件
今天开机上网,时间一久,卡巴斯基和ZONEALARM就不停的报警报木马和广告
期间我也用了诸如ewido,卡巴斯基和流氓软件清理大师等各种软件在安全模式下杀过几次,但都杀不干净
后来我甚至把所有临时文件夹全部删除掉了,但每次上网或者运行程序时间一长,就会报警不断,严重时候甚至系统卡死,还不停的发出windows系统警告声音,然后就什么都不能做了,就差不多和死机一样。。。然后临时文件夹里面又是木马广告报警一堆,我明明都没上不良网站。。。
原本我想系统还原,没想到等我想起来用的时候,还原点缺全部消失了。。。
接着我又留意了下任务管理器,发觉每次不停发系统警报的时候,都有一个IEXPLORE.EXE的本地用户名执行文件占很大内存,另外一个占CPU大户就是EXPLORER.EXE,还有每次都有一些不认识的EXE文件在系统卡的时候运行,但事后我却找不到他们。。。
请各位大侠帮帮忙。。。另外,我XP还是SP1的可能有很多漏洞,但用了很久都很好,只是今天不知道为什么搞的什么都不能做
我这里也贴下我用HIJACKTHIS的日志,各位大侠看看,有什么问题,感谢啊~~!!
Logfile of HijackThis v1.99.1
Scan saved at 2:05:00, on 2006-9-29
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\taskmgr.exe
C:\Documents and Settings\Simon\桌面\HijackThis.exe
O2 - BHO: (no name) - {4BBC1A4D-DD20-4980-A645-2E13F6FC286D} - C:\WINDOWS\system32\3721.2.dll
O2 - BHO: (no name) - {70AFF2CB-9DA2-499C-8D15-900729FCE83D} - (no file)
O2 - BHO: is
Object Class - {BE0B5843-553A-48C2-9A42-258A1D791AFC} - C:\PROGRA~1\pcast\hbcast.dll (file missing)
O2 - BHO: 信息检索 - {CE7C3CF0-98A8-474D-B2B5-1ED7E2E3B004} - C:\WINDOWS\system32\IEHelper.dll (file missing)
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx (file missing)
O3 - Toolbar: BitComet工具栏 - {3F1ABCDB-A875-46c1-8345-B72A4567E486} - C:\Program Files\BitComet\BitCometBar\BitCometBar0.6.dll (file missing)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [kav] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {0062C9BD-B349-40DE-91A0-755F37ACD559} - (no file)
O11 - Options group: [CDNCLIENT] 中文上网
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1157274660546
O16 - DPF: {7FC22A16-79E6-4787-9C96-B6359BB1106D} (DigitalTrafic Control) - http://www.jt.sh.cn/trafficmap/jtj.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1652CF0A-1B77-4563-9F46-41860321C962}: NameServer = 202.109.15.135 202.96.209.134
O17 - HKLM\System\CS1\Services\Tcpip\..\{1652CF0A-1B77-4563-9F46-41860321C962}: NameServer = 202.109.15.135 202.96.209.134
O20 - Winlogon Notify: klogon - C:\WINDOWS\System32\klogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: 卡巴斯基反病毒6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe