亡羊补牢

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛亡羊补牢

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

1 / 1 页

跳转页

欧·海翔初生襁褓狮帖子:23 注册: 2006-11-30 来自:	发表于： 2006-11-30 11:39 \| 只看楼主短消息资料字号：小中大 1楼亡羊补牢嗨，楼主，帮我看一下哪个病毒需要删除吧？谢谢了！我是一头雾水。 Logfile of HijackThis v1.99.1 Scan saved at 11:26:36, on 2006-11-30 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\rising\Rav\CCenter.exe C:\WINDOWS\System32\svchost.exe c:\program files\rising\rfw\rfwsrv.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\atievxx.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\PROGRA~1\KV2005\KVSrvXP.exe C:\WINDOWS\Explorer.EXE c:\program files\rising\rfw\RfwMain.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\rising\Rav\RavTask.exe C:\Program Files\联创通信\宽带上网助手\Dot1xClient.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Thunder Network\Thunder\Program\Thunder5.exe C:\TDdownload\扫描工具\ha_hijackthis_1991\HijackThis.exe R3 - Default URLSearchHook is missing F2 - REG:system.ini: UserInit=userinit.exe, O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [RavTask] "C:\Program Files\rising\Rav\RavTask.exe" -system O4 - HKLM\..\Run: [TkBellExe] ; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm O8 - Extra context menu item: 使用Web迅雷下载 - C:\Program Files\Thunder Network\WebThunder\GetUrl.htm O8 - Extra context menu item: 使用Web迅雷下载全部链接 - C:\Program Files\Thunder Network\WebThunder\GetAllUrl.htm O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm O9 - Extra button: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - C:\Program Files\Thunder Network\Thunder\Thunder.exe O9 - Extra 'Tools' menuitem: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - C:\Program Files\Thunder Network\Thunder\Thunder.exe O9 - Extra button: 启动Web迅雷 - {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} - http://my.xunlei.com (file missing) O9 - Extra 'Tools' menuitem: 启动Web迅雷 - {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} - http://my.xunlei.com (file missing) O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll (file missing) O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll (file missing) O10 - Unknown file in Winsock LSP: c:\windows\system32\kvwspxp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\kvwspxp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\kvwspxp.dll O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1136711262736 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136711622163 O23 - Service: COM+ADSL - Unknown owner - C:\WINDOWS\COM+ADSL.exe O23 - Service: KVSrvXP - JiangMin New Tech Ltd. - C:\PROGRA~1\KV2005\KVSrvXP.exe O23 - Service: KVWSC - Jiangmin Co.Ltd - C:\Program Files\KV2005\kvwsc.exe O23 - Service: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\rising\Rav\CCenter.exe 2006-12-03 14:14:03
欧·海翔初生襁褓狮帖子:23 注册: 2006-11-30 来自:	分享到：

6981313 强壮不惑狮帖子:880 注册: 2006-04-24 来自:	发表于： 2006-11-30 12:02 \| 短消息资料字号：小中大 2楼到http://free5.ys168.com/?jxsbb下载 LSPFix.zip 178.3KB lsp修复工具 WinsockxpFix.rar 0.6MB lsp修复工具执行完以下步骤后,用LSPFix修复LSP，如果不能正常上网用WinsockxpFix修复。开始→控制面板→性能和维护→管理工具→服务→查找COM+ADSL→右击→属性→启动类型→禁止→应用→停止→确定。修复： R3 - Default URLSearchHook is missing O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O9 - Extra button: 启动Web迅雷 - {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} - http://my.xunlei.com (file missing) O9 - Extra 'Tools' menuitem: 启动Web迅雷 - {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} - http://my.xunlei.com (file missing) O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll (file missing) O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll (file missing) O10 - Unknown file in Winsock LSP: c:\windows\system32\kvwspxp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\kvwspxp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\kvwspxp.dll O23 - Service: COM+ADSL - Unknown owner - C:\WINDOWS\COM+ADSL.exe 安全模式下，显示隐藏文件和文件夹，删除： c:\windows\system32\kvwspxp.dll
6981313 强壮不惑狮帖子:880 注册: 2006-04-24 来自:

欧·海翔初生襁褓狮帖子:23 注册: 2006-11-30 来自:	发表于： 2006-12-03 13:21 \| 只看楼主短消息资料字号：小中大 3楼谢谢楼上高手指点，按照如上操作，我已经中的有半年之久的backdoor gpigeon.uvc病毒消失了，我很激动，不幸的是，又被另外两种木马病毒（Trojan.DL.Agent.zlo 和　Worm.Manvil.a）袭击，且其中一种用最新版的瑞星也无法清除，郁闷啊～还望指点一二！ Logfile of HijackThis v1.99.1 Scan saved at 13:02:30, on 2006-12-03 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\rising\Rav\CCenter.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe c:\program files\rising\rfw\rfwsrv.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE c:\program files\rising\rfw\RfwMain.exe C:\WINDOWS\system32\atievxx.exe C:\PROGRA~1\KV2005\KVSrvXP.exe C:\WINDOWS\system32\notaped.exe C:\WINDOWS\system32\RpcS.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\System32\svchost.exe c:\windows\system32\wbem\lsass.exe C:\Program Files\rising\Rav\RavTask.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\TDdownload\扫描工具\ha_hijackthis_1991\HijackThis.exe F2 - REG:system.ini: UserInit=userinit.exe, O1 - Hosts: 202.109.114.142 iplusms.allyes.com O1 - Hosts: 202.109.114.142 mms.t2t2.com O1 - Hosts: 202.109.114.142 www.u8u.com O1 - Hosts: 202.109.114.142 u.u8u.com O1 - Hosts: 202.109.114.142 tl.linktone.com O1 - Hosts: 202.109.114.142 channel.e78.com O1 - Hosts: 202.109.114.142 u.7town.com O1 - Hosts: 202.109.114.142 union.95ol.com.cn O1 - Hosts: 202.109.114.142 mms1.95ol.com.cn O1 - Hosts: 202.109.114.142 mfs.95ol.com.cn O1 - Hosts: 202.109.114.142 tl.a8.com O1 - Hosts: 202.109.114.142 ad01.a8.com O1 - Hosts: 202.109.114.142 u2.caiku.com O1 - Hosts: 202.109.114.142 mms.caiku.com O1 - Hosts: 202.109.114.142 code1.caiku.com O1 - Hosts: 202.109.114.142 pub.lele.com O1 - Hosts: 202.109.114.142 u.lele.com O1 - Hosts: 202.109.114.142 7town.com O1 - Hosts: 202.109.114.142 tvsend.7town.com O1 - Hosts: 202.109.114.142 ivrsend.7town.com O1 - Hosts: 202.109.114.142 tlt.7town.com O1 - Hosts: 202.109.114.142 gsend.7town.com O1 - Hosts: 202.109.114.142 smssend.7town.com O1 - Hosts: 202.109.114.142 91ivr.com O1 - Hosts: 202.109.114.142 myad.91ivr.com O1 - Hosts: 202.109.114.142 u.91ivr.com O1 - Hosts: 202.109.114.142 union.91ivr.com O1 - Hosts: 203.191.146.205 corep.dmcast.com O1 - Hosts: 203.191.146.205 m081.dmcast.com O1 - Hosts: 203.191.146.205 dcww.dmcast.com O1 - Hosts: 203.191.146.205 renren.dmcast.com O1 - Hosts: 203.191.146.205 files.henbang.net O1 - Hosts: 203.191.146.205 bannerbox.cn O1 - Hosts: 203.191.146.205 www.bannerbox.cn O1 - Hosts: 203.191.146.205 action.coopen.cn O1 - Hosts: 203.191.146.205 u4.sky99.cn O1 - Hosts: 203.191.146.205 u1.sky99.cn O1 - Hosts: 203.191.146.205 u2.sky99.cn O1 - Hosts: 203.191.146.205 u3.sky99.cn O1 - Hosts: 203.191.146.205 sky99.cn O1 - Hosts: 203.191.146.205 u.sky99.cn O1 - Hosts: 203.191.146.205 u.ete.cn O1 - Hosts: 203.191.146.205 ip.alexaanywhere.com O1 - Hosts: 203.191.146.205 www.365tan.com O1 - Hosts: 203.191.146.205 www.winopen.cn O1 - Hosts: 203.191.146.205 www.tanip.com O1 - Hosts: 203.191.146.205 alexaanywhere.com O1 - Hosts: 203.191.146.205 jssb.alexaanywhere.com O1 - Hosts: 203.191.146.205 ns250.alexaanywhere.com O1 - Hosts: 203.191.146.205 sb.alexaanywhere.com O1 - Hosts: 203.191.146.205 ip.alexaanywhere.com O1 - Hosts: 203.191.146.205 pop.9v.cn O1 - Hosts: 203.191.146.205 xuni.myad.cn O1 - Hosts: 203.191.146.205 iebar.t2t2.com O1 - Hosts: 203.191.146.205 error.newcell.cn O1 - Hosts: 203.191.146.205 auto.search.msn.com O1 - Hosts: 203.191.146.205 www.kuaiso.com O1 - Hosts: 203.191.146.205 cns.3721.com O1 - Hosts: 203.191.146.205 seek.3721.com O1 - Hosts: 203.191.146.205 name.cnnic.cn O1 - Hosts: 203.191.146.205 toolsbar.kuaiso.com O1 - Hosts: 203.191.146.205 www.kuaiso.com O1 - Hosts: 203.191.146.205 kuaiso.com O1 - Hosts: 203.191.146.205 www.copyso.com O1 - Hosts: 203.191.146.205 union.copyso.com O1 - Hosts: 203.191.146.205 auto.search.msn.com O1 - Hosts: 203.191.146.205 ok.mop-hz.com O1 - Hosts: 203.191.146.205 www.ncast.cn O1 - Hosts: 203.191.146.205 www.ads3721.com O1 - Hosts: 203.191.146.205 360.ads3721.com O1 - Hosts: 203.191.146.205 www.maohehe.com O1 - Hosts: 203.191.146.205 www.5566.net O1 - Hosts: 203.191.146.205 5566.net O1 - Hosts: 203.191.146.205 www.gjj.cc O1 - Hosts: 203.191.146.205 gjj.cc O1 - Hosts: 203.191.146.205 www.9495.com O1 - Hosts: 203.191.146.205 9495.com O1 - Hosts: 203.191.146.205 my123.com O1 - Hosts: 203.191.146.205 www.my123.com O1 - Hosts: 203.191.146.205 7b.com.cn O1 - Hosts: 203.191.146.205 www.7b.com.cn O1 - Hosts: 203.191.146.205 www.qu123.com O1 - Hosts: 203.191.146.205 www.37021.com O1 - Hosts: 203.191.146.205 www.37021.net O1 - Hosts: 203.191.146.205 www.4199.com O1 - Hosts: 203.191.146.205 4199.com O1 - Hosts: 203.191.146.205 www.9505.com O1 - Hosts: 203.191.146.205 9505.com O1 - Hosts: 203.191.146.205 7939.com O1 - Hosts: 203.191.146.205 www.7939.com O1 - Hosts: 203.191.146.205 www.3448.com O1 - Hosts: 203.191.146.205 3448.com O1 - Hosts: 203.191.146.205 8925.com O1 - Hosts: 203.191.146.205 www.8925.com O1 - Hosts: 203.191.146.205 www.ttmp3.com O1 - Hosts: 203.191.146.205 ttmp3.com O1 - Hosts: 203.191.146.205 www.3tg.cn O1 - Hosts: 203.191.146.205 3tg.cn O1 - Hosts: 203.191.146.205 123wa.com O1 - Hosts: 203.191.146.205 www.123wa.com O1 - Hosts: 203.191.146.205 www.159.com O2 - BHO: IEMonitor Class - {08A312BB-5409-49FC-9347-54BB7D069AC6} - C:\Program Files\DeskAdTop\deskipn.dll O2 - BHO: AdPopup - {11F09AFD-75AD-4E51-AB43-E09E9351CE16} - C:\Program Files\Common Files\CPUSH\cpush.dll O2 - BHO: Info cache - {385AB8C6-FB22-4D17-8834-064E2BA0A6F0} - C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools_2006122_7017.dll O2 - BHO: SafeMe Internet Explorer Helper - {3AE06CEE-58A6-4F5F-AF89-6C5350842F16} - C:\WINDOWS\system32\SafeHelper12.dll O2 - BHO: (no name) - {E5A7A15F-213F-4FCF-8DE7-D388F9FB09EB} - C:\WINDOWS\system32\cnwin.dll O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [RavTask] "C:\Program Files\rising\Rav\RavTask.exe" -system O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup O4 - HKLM\..\Run: [sdmmrnm] C:\WINDOWS\temp\sd153.exe O4 - HKLM\..\Run: [Desktop] C:\WINDOWS\system32\rundll32.exe "C:\Program Files\DeskAdTop\Run.dll" ,Rundll O4 - HKLM\..\Run: [C:\WINDOWS\TEMP\sna.exe] C:\WINDOWS\TEMP\sna.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm O8 - Extra context menu item: 使用Web迅雷下载 - C:\Program Files\Thunder Network\WebThunder\GetUrl.htm O8 - Extra context menu item: 使用Web迅雷下载全部链接 - C:\Program Files\Thunder Network\WebThunder\GetAllUrl.htm O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm O9 - Extra button: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - C:\Program Files\Thunder Network\Thunder\Thunder.exe O9 - Extra 'Tools' menuitem: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - C:\Program Files\Thunder Network\Thunder\Thunder.exe O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1136711262736 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136711622163 O23 - Service: KVSrvXP - JiangMin New Tech Ltd. - C:\PROGRA~1\KV2005\KVSrvXP.exe O23 - Service: KVWSC - Jiangmin Co.Ltd - C:\Program Files\KV2005\kvwsc.exe O23 - Service: Media Serial Number Service - Unknown owner - C:\WINDOWS\system32\moviemk.exe O23 - Service: Medie Sariel Number Services - Unknown owner - C:\WINDOWS\system32\notaped.exe O23 - Service: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\rising\Rav\CCenter.exe 不胜感激
欧·海翔初生襁褓狮帖子:23 注册: 2006-11-30 来自:

社区嘉宾

帖子:30678
注册: 2004-09-17
来自:蓝色星球

发表于： 2006-12-03 13:30 | 短消息资料

字号：小中大 4楼

引用:

【6981313的贴子】到http://free5.ys168.com/?jxsbb下载
LSPFix.zip 178.3KB lsp修复工具
WinsockxpFix.rar 0.6MB lsp修复工具
执行完以下步骤后,用LSPFix修复LSP，如果不能正常上网用WinsockxpFix修复。

开始→控制面板→性能和维护→管理工具→服务→查找COM+ADSL→右击→属性→启动类型→禁止→应用→停止→确定。
修复：
R3 - Default URLSearchHook is missing
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O9 - Extra button: 启动Web迅雷 - {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} - http://my.xunlei.com (file missing)
O9 - Extra ''Tools'' menuitem: 启动Web迅雷 - {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} - http://my.xunlei.com (file missing)
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll (file missing)
O9 - Extra ''Tools'' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\kvwspxp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\kvwspxp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\kvwspxp.dll
O23 - Service: COM+ADSL - Unknown owner - C:\WINDOWS\COM+ADSL.exe
安全模式下，显示隐藏文件和文件夹，删除：
c:\windows\system32\kvwspxp.dll
………………

O10 - Unknown file in Winsock LSP: c:\windows\system32\kvwspxp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\kvwspxp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\kvwspxp.dll
这三项是正常的
kvwspxp.dll是江民的网络协议处理器文件
所以没有必要用LSPFIX来修复010项

AngelPray 健康舞勺狮帖子:371 注册: 2006-08-02 来自:	发表于： 2006-12-03 13:32 \| 短消息资料字号：小中大 5楼 c:\windows\system32\wbem\lsass.exe结束进程删除文件修复01项 O4 - HKLM\..\Run: [sdmmrnm] C:\WINDOWS\temp\sd153.exe O4 - HKLM\..\Run: [C:\WINDOWS\TEMP\sna.exe] C:\WINDOWS\TEMP\sna.exe 这个日志是跟第一个日志同一台电脑? 把将民卸载吧的一份日志的010项是将民以经被弄死了
AngelPray 健康舞勺狮帖子:371 注册: 2006-08-02 来自:

水树雨下横据古稀狮帖子:8397 注册: 2006-07-26 来自:	发表于： 2006-12-03 13:35 \| 短消息资料字号：小中大 6楼 O4 - HKLM\..\Run: [sdmmrnm] C:\WINDOWS\temp\sd153.exe O4 - HKLM\..\Run: [C:\WINDOWS\TEMP\sna.exe] C:\WINDOWS\TEMP\sna.exe O23 - Service: Media Serial Number Service - Unknown owner - C:\WINDOWS\system32\moviemk.exe O23 - Service: Medie Sariel Number Services - Unknown owner - C:\WINDOWS\system32\notaped.exe 删除 c:\windows\system32\wbem\lsass.exe C:\WINDOWS\system32\RpcS.exe C:\WINDOWS\system32\moviemk.exe C:\WINDOWS\system32\notaped.exe 这个文件夹所有文件C:\WINDOWS\temp 修复01项
水树雨下横据古稀狮帖子:8397 注册: 2006-07-26 来自:

不言放弃社区嘉宾帖子:30678 注册: 2004-09-17 来自:蓝色星球	发表于： 2006-12-03 13:38 \| 短消息资料字号：小中大 7楼【回复“欧·海翔”的帖子】结束如下进程： C:\WINDOWS\system32\notaped.exe C:\WINDOWS\system32\RpcS.exe c:\windows\system32\wbem\lsass.exe ＝＝＝＝＝＝＝＝＝＝＝修复所有的01项＝＝＝＝＝＝＝＝＝修复 O2 - BHO: IEMonitor Class - {08A312BB-5409-49FC-9347-54BB7D069AC6} - C:\Program Files\DeskAdTop\deskipn.dll O2 - BHO: AdPopup - {11F09AFD-75AD-4E51-AB43-E09E9351CE16} - C:\Program Files\Common Files\CPUSH\cpush.dll O2 - BHO: Info cache - {385AB8C6-FB22-4D17-8834-064E2BA0A6F0} - C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools_2006122_7017.dll O2 - BHO: SafeMe Internet Explorer Helper - {3AE06CEE-58A6-4F5F-AF89-6C5350842F16} - C:\WINDOWS\system32\SafeHelper12.dll O2 - BHO: (no name) - {E5A7A15F-213F-4FCF-8DE7-D388F9FB09EB} - C:\WINDOWS\system32\cnwin.dll O4 - HKLM\..\Run: [sdmmrnm] C:\WINDOWS\temp\sd153.exe O4 - HKLM\..\Run: [Desktop] C:\WINDOWS\system32\rundll32.exe "C:\Program Files\DeskAdTop\Run.dll" ,Rundll O4 - HKLM\..\Run: [C:\WINDOWS\TEMP\sna.exe] C:\WINDOWS\TEMP\sna.exe O23 - Service: Media Serial Number Service - Unknown owner - C:\WINDOWS\system32\moviemk.exe O23 - Service: Medie Sariel Number Services - Unknown owner - C:\WINDOWS\system32\notaped.exe ＝＝＝＝＝＝＝＝＝＝进入注册表删除如下两项在注册表中的相关信息 O23 - Service: Media Serial Number Service - Unknown owner - C:\WINDOWS\system32\moviemk.exe O23 - Service: Medie Sariel Number Services - Unknown owner - C:\WINDOWS\system32\notaped.exe ＝＝＝＝＝＝＝＝＝＝卸载 C:\Program Files\DeskAdTop\ ＝＝＝＝＝＝＝＝＝＝删除 C:\Program Files\DeskAdTop\ C:\WINDOWS\system32\SafeHelper12.dll C:\WINDOWS\system32\cnwin.dll C:\WINDOWS\temp\sd153.exe C:\WINDOWS\TEMP\sna.exe C:\WINDOWS\system32\moviemk.exe C:\WINDOWS\system32\notaped.exe C:\WINDOWS\system32\RpcS.exe c:\windows\system32\wbem\lsass.exe ＝＝＝＝＝＝＝＝另外删除软件C:\Program Files\DeskAdTop\ 向C:\WINDOWS\system32\导入的几个DLL文件提示：与C:\Program Files\DeskAdTop\中的DLL文件名相同＝＝＝＝＝＝＝＝＝＝＝对于如下两个文件如果楼主确认没有安装的话建议删除如下文件及文件夹： C:\Program Files\Common Files\CPUSH\cpush.dll C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools_2006122_7017.dll C:\Program Files\Common Files\CPUSH\ C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\
不言放弃社区嘉宾帖子:30678 注册: 2004-09-17 来自:蓝色星球

欧·海翔初生襁褓狮帖子:23 注册: 2006-11-30 来自:	发表于： 2006-12-03 14:22 \| 只看楼主短消息资料字号：小中大 8楼好像很麻烦的样子，不过还是充满了斗志。感谢楼上的指点！在下不才，嗨想问一下Trojan.DL.Agent.zlo 和　Worm.Manvil.a这两种病毒是不是新的变种啊，为什么在百度上都找不出相关的文章呢
欧·海翔初生襁褓狮帖子:23 注册: 2006-11-30 来自:

<<上一主题|下一主题>>

1 / 1 页

跳转页

欧·海翔初生襁褓狮帖子:23 注册: 2006-11-30 来自:	发表于： 2006-11-30 11:39 \| 只看楼主短消息资料字号：小中大 1楼亡羊补牢嗨，楼主，帮我看一下哪个病毒需要删除吧？谢谢了！我是一头雾水。 Logfile of HijackThis v1.99.1 Scan saved at 11:26:36, on 2006-11-30 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\rising\Rav\CCenter.exe C:\WINDOWS\System32\svchost.exe c:\program files\rising\rfw\rfwsrv.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\atievxx.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\PROGRA~1\KV2005\KVSrvXP.exe C:\WINDOWS\Explorer.EXE c:\program files\rising\rfw\RfwMain.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\rising\Rav\RavTask.exe C:\Program Files\联创通信\宽带上网助手\Dot1xClient.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Thunder Network\Thunder\Program\Thunder5.exe C:\TDdownload\扫描工具\ha_hijackthis_1991\HijackThis.exe R3 - Default URLSearchHook is missing F2 - REG:system.ini: UserInit=userinit.exe, O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [RavTask] "C:\Program Files\rising\Rav\RavTask.exe" -system O4 - HKLM\..\Run: [TkBellExe] ; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm O8 - Extra context menu item: 使用Web迅雷下载 - C:\Program Files\Thunder Network\WebThunder\GetUrl.htm O8 - Extra context menu item: 使用Web迅雷下载全部链接 - C:\Program Files\Thunder Network\WebThunder\GetAllUrl.htm O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm O9 - Extra button: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - C:\Program Files\Thunder Network\Thunder\Thunder.exe O9 - Extra 'Tools' menuitem: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - C:\Program Files\Thunder Network\Thunder\Thunder.exe O9 - Extra button: 启动Web迅雷 - {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} - http://my.xunlei.com (file missing) O9 - Extra 'Tools' menuitem: 启动Web迅雷 - {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} - http://my.xunlei.com (file missing) O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll (file missing) O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll (file missing) O10 - Unknown file in Winsock LSP: c:\windows\system32\kvwspxp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\kvwspxp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\kvwspxp.dll O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1136711262736 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136711622163 O23 - Service: COM+ADSL - Unknown owner - C:\WINDOWS\COM+ADSL.exe O23 - Service: KVSrvXP - JiangMin New Tech Ltd. - C:\PROGRA~1\KV2005\KVSrvXP.exe O23 - Service: KVWSC - Jiangmin Co.Ltd - C:\Program Files\KV2005\kvwsc.exe O23 - Service: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\rising\Rav\CCenter.exe 2006-12-03 14:14:03
欧·海翔初生襁褓狮帖子:23 注册: 2006-11-30 来自:	分享到：

瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 亡羊补牢

亡羊补牢

亡羊补牢

瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛亡羊补牢