瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 【十万火急】【求助】昨天的问题,Backdoor.Rbot.atx这个病毒怎么彻底杀

1   1  /  1  页   跳转

【十万火急】【求助】昨天的问题,Backdoor.Rbot.atx这个病毒怎么彻底杀

【十万火急】【求助】昨天的问题,Backdoor.Rbot.atx这个病毒怎么彻底杀

高手帮忙啊,小弟感激不尽!
如下


Logfile of HijackThis v1.99.1
Scan saved at 16:37:45, on 2005-7-24
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
C:\PROGRAM FILES\RISING\RAV\RavStub.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\rising\rfw\Rfw.exe
C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
C:\PROGRA~1\RISING\RAV\RAVMON.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\PROGRA~1\RISING\RAV\Rav.exe
C:\WINDOWS\System32\svchost.exe
D:\Tencent2005\TT\TTraveler.exe
C:\WINDOWS\System32\bcup.exe
D:\HijackThis.exe

O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\Tencent2005\qq\QQIEHelper.dll
O3 - Toolbar: 博采 - {4DA2EE61-6399-4C39-AEB9-0D990E610D29} - C:\WINDOWS\System32\BOCAIT~1.DLL
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - (no file)
O3 - Toolbar: 完美网译通 - {F43BD772-ABDD-43b7-A96A-3E9E61946EC0} - C:\WINDOWS\WORLD2\TOOLBAR\hmtoolbar.dll
O3 - Toolbar: (no name) - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - (no file)
O4 - HKLM\..\Run: [rfw] C:\Program Files\rising\rfw\Rfw.exe
O4 - HKLM\..\Run: [RavTimer] C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [RavMon] C:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [PHIME2002ASync] ; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] ; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [nwiz] ; nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] ; RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [BCUpdate] ; C:\WINDOWS\System32\BCUP.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Tencent2005\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Tencent2005\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Tencent2005\qq\SendMMS.htm
O8 - Extra context menu item: 百度-搜索MP3 - res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUMP3.HTM
O8 - Extra context menu item: 百度-搜索图片 - res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUIMG.HTM
O8 - Extra context menu item: 百度-搜索新闻 - res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUNEWS.HTM
O8 - Extra context menu item: 百度-搜索歌词 - res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDULYRIC.HTM
O8 - Extra context menu item: 百度-搜索网页 - res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUSEARCH.HTM
O8 - Extra context menu item: 百度-搜索贴吧 - res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUPOST.HTM
O8 - Extra context menu item: 百度-词典搜索 - res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDU_DIC.HTM
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - E:\网络游戏\hfgame3\HFGame3\GameClient.exe
O9 - Extra button: Start spyware remover - {BF69DF00-2734-477F-8257-27CD04F88779} - C:\Program Files\WareOut\WareOut.exe (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Start spyware remover - {BF69DF00-2734-477F-8257-27CD04F88779} - C:\Program Files\WareOut\WareOut.exe (file missing) (HKCU)
O16 - DPF: {11212111-2121-1311-1141-115611111222} - ms-its:mhtml:file://d: oo.mht!http://195.95.218.83/users/sale/web/axe/x.chm::/update.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{22CC31FA-53EB-4787-AB63-CF17DFC49806}: NameServer = 69.50.184.86,85.255.112.9
O17 - HKLM\System\CCS\Services\Tcpip\..\{35C670EA-AF0C-4135-B916-50F5F4A84BDB}: NameServer = 69.50.184.86 85.255.112.9
O17 - HKLM\System\CCS\Services\Tcpip\..\{A46D907F-0453-4D22-844E-A7A9C34BD402}: NameServer = 69.50.184.86,85.255.112.9
O17 - HKLM\System\CCS\Services\Tcpip\..\{EC25151E-55E8-4F6D-8449-8910C9D7FBAA}: NameServer = 69.50.184.86,85.255.112.9
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
最后编辑2005-07-25 20:19:04
分享到:
gototop
 

你想问什么?
gototop
 

中没中灰鸽子???
还有,这个病毒是什么?
BAckdoor.Rbot.dcz
gototop
 

灰鸽子没看到,垃圾软件看到不少,想百度的插件等等的
BAckdoor.Rbot.dcz
这个请在安全模式下查杀,注意用window update打好系统补丁
gototop
 

首先谢谢楼上的~~
昨天我打完了补丁,然后去安全模式下杀毒,但是没有查到任何病毒,本来以为从前杀没了呢
可是今天下午,突然有一个漏洞攻击,叫MS-4011 Exploit
然后瑞星发现病毒Backdoor.Rbot.atx,从这一刻起,机速变慢,然后我选择杀毒,然后瑞星显示文件被删除,然后机速超慢,是超慢啊,就死机了

那个病毒是不是不在我的电脑上,而是别人总想我攻击?
怎么解决,高手帮忙啊!!
gototop
 

5555555555~~~怎么没人理我
gototop
 

1. 结束BCUP.EXE进程;
2. 使用命令卸载BoCaiToolBar.dll;
regsvr32 /u %System%\BoCaiToolBar.dll
3. 删除%System%下的BCUP.EXE和BoCaiToolBar.dll;
4. 删除注册表启动项信息:
[HKEY_LOCAL_MACHINE\SOFTWARE\BlogChina]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BCUpdate"="%System%\BCUP.EXE"
gototop
 

太感谢了!
按照你说的做了
找到那2个文件,删了
注册表也按照你说的删了
谢谢了
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT