我一开IE瑞星监控就全部关闭,中过病毒,已经清了一些,注册表的:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run被加入了这些启动项目:
"wosa"="X:\\DOCUME~1\\***\\LOCALS~1\\Temp\\woso.exe"
"ztsa"="X:\\DOCUME~1\\***\\LOCALS~1\\Temp\\ztso.exe"
"mhsa"="X:\\DOCUME~1\\***\\LOCALS~1\\Temp\\mhso.exe"
"fysa"="X:\\DOCUME~1\\***\\LOCALS~1\\Temp\\fyso.exe"
"jtsa"="X:\\DOCUME~1\\***\\LOCALS~1\\Temp\\jtso.exe"
"wlsa"="X:\\DOCUME~1\\***\\LOCALS~1\\Temp\\wlso.exe"
"wgsa"="X:\\DOCUME~1\\***\\LOCALS~1\\Temp\\wgso.exe"
"wmsa"="X:\\DOCUME~1\\***\\LOCALS~1\\Temp\\wmso.exe"
"qjsa"="X:\\DOCUME~1\\***\\LOCALS~1\\Temp\\qjso.exe"
"rxsa"="X:\\DOCUME~1\\***\\LOCALS~1\\Temp\\rxso.exe"
"wdsa"="X:\\DOCUME~1\\***\\LOCALS~1\\Temp\\wdso.exe"
"tlsa"="X:\\DOCUME~1\\***\\LOCALS~1\\Temp\\tlso.exe"
"dasa"="X:\\DOCUME~1\\***\\LOCALS~1\\Temp\\daso.exe"
相关文件*:\Program Files\Common Files\Microsoft Shared\MSInfo里有SVCHOST.exe可疑,也删除.
其相关文件和注册表已经删除,但一开IE瑞星监控还是全部关闭.瑞星\江民都查不出病毒.
以下是扫描的日志,请高手帮我分析.
HijackThis_zww汉化版扫描日志 V1.99.1
保存于 12:07:43, 日期 2007-5-24
操作系统： Windows XP (WinNT 5.01.2600)
浏览器： Internet Explorer v6.00 SP1 (6.00.2600.0000)
当前运行的进程：
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Rising\Rav\CCenter.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Rising\Rav\Ravmond.exe
D:\Program Files\Rising\Rfw\rfwsrv.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Rising\Rav\RavStub.exe
D:\WINDOWS\System32\RUNDLL32.EXE
D:\Program Files\Rising\Rfw\RfwMain.exe
D:\Program Files\Analog Devices\SoundMAX\Smtray.exe
D:\WINDOWS\VM_STI.EXE
D:\Program Files\flexnet\i486_nt\obj\lmgrd.exe
D:\Program Files\Rising\Rav\RavTask.exe
D:\Program Files\Rising\AntiSpyware\runiep.exe
D:\Program Files\淘宝网\淘宝旺旺\WangWang.EXE
D:\Program Files\flexnet\i486_nt\obj\lmgrd.exe
D:\WINDOWS\System32\ctfmon.exe
D:\Program Files\Jiangmin\AntiVirus\kvsrvxp.exe
C:\pf\酷石英钟4.0\酷石英钟4.0.exe
D:\Program Files\Rising\Rav\Ravmon.exe
D:\WINDOWS\System32\nvsvc32.exe
D:\Program Files\flexnet\i486_nt\obj\ptc_d.exe
D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Winamp\winamp.exe
D:\Tencent\QQ\QQ.exe
D:\Tencent\TM\TMDlls\TIMPlatform.exe
D:\WINDOWS\System32\conime.exe
D:\Program Files\proe2001\i486_nt\obj\xtop.exe
D:\Program Files\proe2001\i486_nt\obj\pro_comm_msg.exe
D:\Program Files\proe2001\i486_nt\obj\pglclock.exe
D:\Program Files\proe2001\i486_nt\obj\mc_server.exe
D:\Tencent\TT\TTraveler.exe
D:\Program Files\Corel\Graphics9\Programs\coreldrw.exe
D:\Program Files\Jiangmin\AntiVirus\kvxp.kxp
D:\wen\HijackThis\HijackThis1991zww.exe
D:\Program Files\Wom\WoptiProcess.exe
F2 - REG:system.ini: UserInit=D:\WINDOWS\System32\userinit.exe
O2 - BHO: (no name) - {00000AA9-A363-466E-BEF5-9BB68697AA7F} - (no file)
O2 - BHO: WebThunderBHO - {00000AAA-A363-466E-BEF5-9BB68697AA7F} - D:\Program
Files\Thunder Network\WebThunder\WebThunderBHO_016.dll
O2 - BHO: Thunder AtOnce - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - D:\Program
Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program
Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DsHelper - {0D42E1BD-09DD-4873-A826-9C7E793EB7B6} - D:\Program Files\Thunder
Network\Thunder\Components\ResWorker\DSIeHelper.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} -
D:\Tencent\QQ\QQIEHelper.dll (file missing)
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - D:\Program Files\Thunder
Network\Thunder\ComDlls\xunleiBHO_Now.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} -
D:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - IE工具栏增项: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program
Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} -
D:\WINDOWS\System32\msdxm.ocx
O3 - IE工具栏增项: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} -
D:\WINDOWS\System32\kakatool.dll
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef
/Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE
/SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE
/IMEName
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - 启动项HKLM\\Run: [nwiz] nwiz.exe /install
O4 - 启动项HKLM\\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32
\NvMcTray.dll,NvTaskbarInit
O4 - 启动项HKLM\\Run: [Smapp] D:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - 启动项HKLM\\Run: [BigDogPath] D:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera
O4 - 启动项HKLM\\Run: [gemstrmw] D:\WINDOWS\System32\gemstrmw.exe /r
O4 - 启动项HKLM\\Run: [MenuOrder] D:\Program Files\ICBCPe~1\ICBC\Gemplus(Personal)
\MenuOrder\MenuOrder.exe
O4 - 启动项HKLM\\Run: [RavTask] "D:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [IMSCMig] D:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE
/Preload
O4 - 启动项HKLM\\Run: [RfwMain] "D:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - 启动项HKLM\\Run: [runeip] D:\Program Files\Rising\AntiSpyware\runiep.exe
O4 - 启动项HKLM\\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - 启动项HKLM\\Run: [WangWang] "D:\Program Files\淘宝网\淘宝旺旺\WangWang.EXE"
O4 - 启动项HKLM\\Run: [UVS10 Preload] D:\Program Files\Ulead Systems\Ulead VideoStudio
10\uvPL.exe
O4 - 启动项HKLM\\RunOnce: [RavStub] "D:\Program Files\Rising\Rav\ravstub.exe" /RUNONCE
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [酷石英钟] C:\pf\酷石英钟4.0\酷石英钟4.0.exe
