有谁帮帮我,头大中 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛有谁帮帮我,头大中

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第四十五次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

1

1 / 1 页

跳转页

有谁帮帮我,头大中

乐不起来初生襁褓狮帖子:4 注册: 2005-07-11 来自:	发表于： 2005-07-11 22:47 \| 只看楼主短消息资料字号：小中大 1楼有谁帮帮我,头大中请大家帮我分析一下，谢谢。最近局域网机器中了，有一台不断的发包，还检测局域网机器，使用hijackthis，得到的结果如下：（一） Logfile of HijackThis v1.99.1 Scan saved at 17:27:52, on 2005-07-11 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\System32\msdtc.exe C:\WINNT\system32\Dfssvc.exe C:\WINNT\System32\svchost.exe C:\WINNT\System32\ismserv.exe C:\WINNT\System32\llssrv.exe C:\WINNT\system32\ooo.exe C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\WINNT\system32\regsvc.exe C:\WINNT\System32\locator.exe C:\Program Files\RDS\RsiSvc.exe C:\Program Files\RDS\srscandr.exe C:\WINNT\system32\MSTask.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\System32\mspmspsv.exe C:\WINNT\system32\svchost.exe C:\Program Files\RDS\ddsschednt.exe C:\WINNT\System32\dns.exe C:\WINNT\System32\inetsrv\inetinfo.exe C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe C:\WINNT\System32\svchost.exe C:\WINNT\Explorer.EXE C:\WINNT\system32\rundll32.exe C:\WINNT\system32\rundll32.exe C:\WINNT\system32\USBMonit.exe C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe C:\WINNT\system32\internat.exe C:\Program Files\srua\etwn.exe C:\Program Files\DuDu\DddClient\DuDuAcc.exe C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe C:\Program Files\DuDu\DddClient\dudupros.exe C:\WINNT\system32\conime.exe C:\Program Files\Iparmor\Iparmor.exe C:\WINNT\system32\cmd.exe C:\WINNT\system32\lsasrv.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\HijackThis.exe R3 - URLSearchHook: 上网助手 - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\Program Files\3721\Assist\asbar.dll O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINNT\system32\xunleibho_v6.dll O2 - BHO: 3721中文邮 - {6231D512-E4A4-4DF2-BE62-5B8F0EE348EF} - C:\PROGRA~1\3721\Ces\cesweb.dll O2 - BHO: DDDMon Class - {6BDE1669-B490-48E3-B668-456314F2D6C3} - C:\Program Files\DuDu\DddClient\dddiemon.dll O2 - BHO: 上网助手 - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\Program Files\3721\Assist\asbar.dll O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINNT\DOWNLO~1\CnsHook.dll O3 - Toolbar: 上网助手 - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\Program Files\3721\Assist\asbar.dll O4 - HKLM\..\Run: [CnsMin] Rundll32.exe C:\WINNT\DOWNLO~1\CnsMin.dll,Rundll32 O4 - HKLM\..\Run: [cesmain.dll] C:\WINNT\system32\rundll32.exe C:\PROGRA~1\3721\Ces\cmail.dll,Rundll32 O4 - HKLM\..\Run: [helper.dll] C:\WINNT\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32 O4 - HKLM\..\Run: [Gene USB Monitor] C:\WINNT\system32\USBMonit.exe O4 - HKLM\..\Run: [C2000Manager] C:\Program Files\C2000Plus\C2000Manager.exe O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" O4 - HKCU\..\Run: [Internat.exe] internat.exe O4 - HKCU\..\Run: [Saeo] C:\Program Files\srua\etwn.exe O4 - Global Startup: DuDu加速器.lnk = C:\Program Files\DuDu\DddClient\DuDuAcc.exe O4 - Global Startup: 服务管理器.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe O8 - Extra context menu item: !搜一搜 - res://C:\WINNT\DOWNLO~1\CnsMinEx.dll/1003 O8 - Extra context menu item: &使用下载加速专家下载 - C:\Program Files\3721\Dlaccel\geturl.htm O9 - Extra button: 手机短信 - {00000000-0000-0001-0001-596BAEDD1289} - http://sms.3721.com/ie/index.htm?pid=U_mydrivers_2517 (file missing) O9 - Extra button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.mail.yahoo.com/promo/rd1 (file missing) O9 - Extra button: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://hot.3721.com/rd/shop_btn.htm (file missing) O9 - Extra button: 3721中文邮 - {5D73EE86-05F1-49ed-B850-E423120EC329} - http://cmail.3721.com?fb=client (file missing) O9 - Extra button: 上网助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://assistant.3721.com/index.htm?fb=Cns (file missing) O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing) O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing) O9 - Extra 'Tools' menuitem: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing) O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing) O9 - Extra 'Tools' menuitem: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing) O11 - Options group: [!CNS] 网络实名 O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab?refid=4678 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = domain.com O17 - HKLM\System\CCS\Services\Tcpip\..\{6EA30FBC-40A6-4101-82AB-A4E8B02AD474}: NameServer = 202.96.209.6,202.96.209.133 O17 - HKLM\System\CCS\Services\Tcpip\..\{6EB7B46F-28C5-4640-BC83-6CEB01504AA5}: NameServer = 202.96.209.6,202.96.209.133 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = domain.com O20 - AppInit_DLLs: APIHookDll.dll O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe O23 - Service: Dds Scheduler Deamon (DdsSched) - RICOH Company Ltd. - C:\Program Files\RDS\ddsschednt.exe O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: Local Security Authority Server (LSA Server) - Unknown owner - C:\WINNT\system32\ooo.exe O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe O23 - Service: Ridoc Server Information Service (RsiSvc) - RICOH Company Ltd. - C:\Program Files\RDS\RsiSvc.exe O23 - Service: ScanRouterDriverV2 - Ricoh Co.,Ltd. - C:\Program Files\RDS\srscandr.exe O23 - Service: SOption - RICOH Company Ltd. - C:\Program Files\RDS\SOption.exe 2005-07-12 23:43:54
乐不起来初生襁褓狮帖子:4 注册: 2005-07-11 来自:	分享到：

乐不起来初生襁褓狮帖子:4 注册: 2005-07-11 来自:	发表于： 2005-07-11 22:48 \| 只看楼主短消息资料字号：小中大 2楼（二） Logfile of HijackThis v1.99.1 Scan saved at 17:35:29, on 2005-7-11 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\WINDOWS\System32\lsasrv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\Program Files\SnowFox\CalSprite\CalSprite.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\CNNIC\Cdn\cdnup.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\WINDOWS\System32\conime.exe D:\工具类软件\atnotes9.01\ATnotes.exe C:\Program Files\Iparmor\Iparmor.exe C:\WINDOWS\System32\msiexec.exe C:\Program Files\WinRAR\WinRAR.exe C:\DOCUME~1\WANGLI~1\LOCALS~1\Temp\Rar$EX01.115\HijackThis.exe R3 - URLSearchHook: 上网助手 - {1B0E7716-898E-48cc-9690-4E338E8DE1D3} - C:\PROGRA~1\3721\Assist\assist.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: 上网助手 - {1B0E7716-898E-48cc-9690-4E338E8DE1D3} - C:\PROGRA~1\3721\Assist\assist.dll O2 - BHO: (no name) - {35980F6E-A137-4E50-953D-813BB8556899} - (no file) O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: 上网助手 - {1B0E7716-898E-48cc-9690-4E338E8DE1D3} - C:\PROGRA~1\3721\Assist\assist.dll O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload O4 - HKLM\..\Run: [CalSprite] C:\Program Files\SnowFox\CalSprite\CalSprite.exe O4 - HKLM\..\Run: [CnsMin] Rundll32.exe C:\WINDOWS\DOWNLO~1\CnsMin.dll,Rundll32 O4 - HKLM\..\Run: [CdnCtr] C:\Program Files\CNNIC\Cdn\cdnup.exe O4 - HKLM\..\Run: [iparmor] C:\Program Files\Iparmor\Iparmor.exe mini O4 - HKLM\..\Run: [helper.dll] C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32 O4 - HKLM\..\RunOnce: [WMC_0] C:\WINDOWS\System32\regsvr32.exe /s "C:\WINDOWS\System32\mp4sds32.ax" O4 - HKLM\..\RunOnce: [WMC_1] C:\WINDOWS\System32\regsvr32.exe /s "C:\WINDOWS\System32\mp4sdmod.dll" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Startup: ATnotes.lnk = ? O4 - Startup: 金山词霸 2005.lnk = C:\Program Files\Kingsoft\PowerWord 2005\XDICT.EXE O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {35980F6E-A137-4E50-953D-813BB8556899} - (no file) O9 - Extra button: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O11 - Options group: [!CNS] 网络实名 O11 - Options group: [CDNCLIENT] 中文上网 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1121060896959 O16 - DPF: {9A578C98-3C2F-4630-890B-FC04196EF420} (CNNIC_IDN) - http://client.jogo.cn/cdnClient/cab/cdn.cab O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/Ver2005/OL2005.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = domain.com O17 - HKLM\Software\..\Telephony: DomainName = domain.com O17 - HKLM\System\CCS\Services\Tcpip\..\{2ACE88D2-BAA7-42CA-BBC5-2F6F8DE5EC45}: NameServer = 192.168.0.254,202.96.209.5 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = domain.com O17 - HKLM\System\CS1\Services\Tcpip\..\{2ACE88D2-BAA7-42CA-BBC5-2F6F8DE5EC45}: NameServer = 192.168.0.254,202.96.209.5 O20 - AppInit_DLLs: APIHookDll.dll O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: Local Security Authority Server (LSA Server) - Unknown owner - C:\WINDOWS\System32\lsasrv.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
乐不起来初生襁褓狮帖子:4 注册: 2005-07-11 来自:

乐不起来初生襁褓狮帖子:4 注册: 2005-07-11 来自:	发表于： 2005-07-11 22:58 \| 只看楼主短消息资料字号：小中大 3楼问题多多，哎
乐不起来初生襁褓狮帖子:4 注册: 2005-07-11 来自:

浪漫の都初生襁褓狮帖子:480 注册: 2005-01-03 来自:	发表于： 2005-07-11 23:02 \| 短消息资料字号：小中大 4楼搂主认真检查以下项目 C:\WINNT\System32\ismserv.exe C:\WINNT\System32\llssrv.exe C:\WINNT\system32\ooo.exe 还有，C:\Program Files\RDS 是什么软件？
浪漫の都初生襁褓狮帖子:480 注册: 2005-01-03 来自:

乐不起来初生襁褓狮帖子:4 注册: 2005-07-11 来自:	发表于： 2005-07-11 23:08 \| 只看楼主短消息资料字号：小中大 5楼 RDS理光的数码软件,C:\WINNT\System32\ismserv.exe和C:\WINNT\System32\llssrv.exe是系统服务,C:\WINNT\system32\ooo.exe应该是病毒,但是不运行还是有病毒
乐不起来初生襁褓狮帖子:4 注册: 2005-07-11 来自:

乐不起来初生襁褓狮帖子:4 注册: 2005-07-11 来自:	发表于： 2005-07-11 23:09 \| 只看楼主短消息资料字号：小中大 6楼 OOO.exe,不运行,还是会不断的探测网络上的机器,请高手指点
乐不起来初生襁褓狮帖子:4 注册: 2005-07-11 来自:

浪漫の都初生襁褓狮帖子:480 注册: 2005-01-03 来自:	发表于： 2005-07-11 23:38 \| 短消息资料字号：小中大 7楼那就试着在安全模式里面把他删掉吧
浪漫の都初生襁褓狮帖子:480 注册: 2005-01-03 来自:

乐不起来初生襁褓狮帖子:4 注册: 2005-07-11 来自:	发表于： 2005-07-12 22:27 \| 只看楼主短消息资料字号：小中大 8楼这里解答的人真少
乐不起来初生襁褓狮帖子:4 注册: 2005-07-11 来自:

天天泡泡卡卡技术团队帖子:17486 注册: 2004-01-21 来自:安徽安庆	发表于： 2005-07-12 23:43 \| 短消息资料字号：小中大 9楼看了你的第二个日志，中了Mydoom，建议操作如下： 1.断网，将Hijackthis解压到本地文件夹，运行中止进程：C:\WINDOWS\System32\lsasrv.exe 修复： O2 - BHO: (no name) - {35980F6E-A137-4E50-953D-813BB8556899} - (no file) O9 - Extra button: (no name) - {35980F6E-A137-4E50-953D-813BB8556899} - (no file) O23 - Service: Local Security Authority Server (LSA Server) - Unknown owner - C:\WINDOWS\System32\lsasrv.exe 这个服务项先运行services.msc命令进入“服务”项，将其停止并禁用，再修复。 2.重起到安全模式下，删除： C:\WINDOWS\System32\lsasrv.exe 并查找有无version.ini 和 hserv.sys，删除。 3. O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = domain.com O17 - HKLM\Software\..\Telephony: DomainName = domain.com O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = domain.com 这三项是否你自己设置？酌情修复。 4.这两项： O4 - HKLM\..\RunOnce: [WMC_0] C:\WINDOWS\System32\regsvr32.exe /s "C:\WINDOWS\System32\mp4sds32.ax" O4 - HKLM\..\RunOnce: [WMC_1] C:\WINDOWS\System32\regsvr32.exe /s "C:\WINDOWS\System32\mp4sdmod.dll" 留待高手分析。 5.差点忘了，给系统把所有关键更新都补上。
天天泡泡卡卡技术团队帖子:17486 注册: 2004-01-21 来自:安徽安庆

<<上一主题|下一主题>>

1

1 / 1 页

跳转页

页面顶部

Powered by Discuz!NT