QQ木马好厉害，瑞星好怕怕！ - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛 QQ木马好厉害，瑞星好怕怕！

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

12

1 / 2 页

跳转页

QQ木马好厉害，瑞星好怕怕！

小海之夜初生襁褓狮帖子:8 注册: 2005-10-25 来自:	发表于： 2005-11-21 20:09 \| 只看楼主短消息资料字号：小中大 1楼 QQ木马好厉害，瑞星好怕怕！ windows木马病毒，使用QQ时：第一次打开好友聊天时，会自动发 “http://%39%31%2E%39%31%62%62%62%2E%63%6F%6D/?______________◢██◣_______________________________________█⊙⊙█_______________________________________◤◥◤◥_____________________________________◢▔▂▂▔◣___________________________________◤▔▂▂▔◥_____________________________________╲▁▁╱_______________________________________╯╜╙╰_______________ 若你看到的是一只企鹅表示你的电脑非常先进若你看到的是一堆乱码表示你的电脑需要升级” 然后用瑞星17.54进行杀毒，找到病毒： Hack.LaSta.b ；Hack.LaSta.b（001.exe；2[1].exe) 杀掉后，QQ正常。后发现C：根目录下有个，commbte.exe文件。不小心点击后，出现IE自动弹出；第一次打开好友聊天时，会自动发： “http://info.91bbb.com/wufuwawa.htm 五福娃娃异形版你不知道什么是五福娃娃好丢人 ” 然后，怎么也查杀不了病毒。用瑞星17.54已经找不到病毒了。试了一下在线查毒，也没有用。请问怎么解决？？？（别叫我重装QQ，或者系统） 2005-11-22 16:05:35
小海之夜初生襁褓狮帖子:8 注册: 2005-10-25 来自:	分享到：

不言放弃社区嘉宾帖子:30678 注册: 2004-09-17 来自:蓝色星球	发表于： 2005-11-21 20:11 \| 短消息资料字号：小中大 2楼用HIJACKTHIS导出LOG
不言放弃社区嘉宾帖子:30678 注册: 2004-09-17 来自:蓝色星球

小海之夜初生襁褓狮帖子:8 注册: 2005-10-25 来自:	发表于： 2005-11-22 13:19 \| 只看楼主短消息资料字号：小中大 3楼 HijackThis@Qoo的扫描日志 V1.97.7 Scan saved at 13:15:12, on 2005-11-22 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 (6.00.2462.0000) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe D:\PROGRAM FILES\RISING\RAV\Ravmond.exe D:\PROGRAM FILES\RISING\RAV\RavStub.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\System32\msdtc.exe C:\WINNT\System32\tcpsvcs.exe C:\WINNT\System32\svchost.exe C:\WINNT\System32\llssrv.exe C:\WINNT\System32\sfmprint.exe C:\WINNT\system32\regsvc.exe D:\PROGRAM FILES\RISING\RAV\CCENTER.EXE C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\System32\wins.exe C:\WINNT\system32\mspmspsv.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\Dfssvc.exe C:\WINNT\System32\dns.exe C:\WINNT\System32\inetsrv\inetinfo.exe C:\WINNT\system32\mqsvc.exe C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe C:\WINNT\System32\svchost.exe C:\WINNT\Explorer.EXE C:\WINNT\System32\mdm.exe C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe D:\PROGRA~1\RISING\RAV\RAVTIMER.EXE C:\WINNT\system32\internat.exe C:\WINNT\csrss.exe D:\Program Files\Tencent\qq\QQ.exe D:\Program Files\Tencent\qq\TIMPlatform.exe D:\Program Files\Rising\Rav\Rav.exe C:\Program Files\Internet Explorer\iexplore.exe D:\Program Files\Thunder Network\Thunder\Thunder.exe C:\WINNT\system32\NOTEPAD.EXE D:\Downloads\hijackthis1.97_qoo\HijackThis.exe R3 - URLSearchHook: (no name) - {BB936323-19FA-4521-BA29-ECA6A121BC78} - (no file) R3 - URLSearchHook: O2 - BHO: (no name) - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINNT\system32\xunleibho_v8.dll O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll O2 - BHO: O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\Program Files\Tencent\qq\QQIEHelper.dll O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL O2 - BHO: DownloadBHO T2BHO - {B1D147E7-873E-4909-8127-695D9BB78728} - C:\WINNT\Downloaded Program Files\barhelp22.0.dll O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINNT\DOWNLO~1\CnsHook.dll O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O3 - Toolbar: ????? - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll O3 - Toolbar: ????? - {56A7DC70-E102-4408-A34A-AE06FEF01586} - C:\WINNT\DOWNLO~1\IEBAR2~1.DLL O3 - Toolbar: ????? - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx O4 - HKLM\..\Run: [CnsMin] Rundll32.exe C:\WINNT\DOWNLO~1\CnsMin.dll,Rundll32 O4 - HKLM\..\Run: [8751bol] C:\Program Files\8751ip\8751ip.exe O4 - HKLM\..\Run: [YLive.exe] C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe O4 - HKLM\..\Run: [yassistse] "C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe" O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [RavTimer] D:\PROGRA~1\RISING\RAV\RAVTIMER.EXE O4 - HKLM\..\Run: [RavMon] D:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM O4 - HKLM\..\Run: [csrss] C:\WINNT\csrss.exe O4 - HKLM\..\RunServices: [csrss] C:\WINNT\csrss.exe O4 - HKCU\..\Run: [Internat.exe] internat.exe O4 - HKCU\..\Run: [SDO2005] C:\Program Files\ O4 - HKCU\..\Run: [csrss] C:\WINNT\csrss.exe O4 - HKCU\..\RunServices: [csrss] C:\WINNT\csrss.exe O4 - Startup: ntuser.ini O4 - Startup: NTUSER.DAT O4 - Startup: ntuser.dat.LOG O4 - Startup: 96_CD_Quality_Audio.asd O4 - Startup: 64_High_Fidelity_Stereo_Audio.asd O4 - Startup: 56_dialup_Video_For_Web_Server.asd O4 - Startup: 56_Dialup_Modem_Video.asd O4 - Startup: 56_Dialup_High_Quality_Stereo.asd O4 - Startup: 512_Video.asd O4 - Startup: 3Mb_Video.asd O4 - Startup: 28.8_Video_Voice.asd O4 - Startup: 28.8_Video_For_Web_Server.asd O4 - Startup: 28.8_Video_Audio_Emphasis.asd O4 - Startup: 28.8_FM_Radio_Stereo.asd O4 - Startup: 28.8_FM_Radio_Mono.asd O4 - Startup: 28.8_56_100_MBR_VIDEO.asd O4 - Startup: 250_Video.asd O4 - Startup: 1Mb_Video.asd O4 - Startup: 16_AM_Radio.asd O4 - Startup: 128_CD_Transparency_Audio.asd O4 - Startup: 100_Video.asd O4 - Startup: 6.5_Voice_Audio.asd O4 - Startup: nspmcvt.exe O4 - Startup: Intranet_HighSpeed_Lan_MBR_Video.asd O4 - Startup: Dialup_Modems_ISDN_MBR_Video.asd O4 - Global Startup: ntuser.pol O8 - Extra context menu item: !搜一搜 - res://C:\WINNT\DOWNLO~1\CnsMinEx.dll/1003 O8 - Extra context menu item: &使用迅雷下载 - d:\Program Files\Thunder Network\Thunder\geturl.htm O8 - Extra context menu item: &使用迅雷下载全部链接 - d:\Program Files\Thunder Network\Thunder\getallurl.htm O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\Program Files\Tencent\qq\AddToNetDisk.htm O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Program Files\Tencent\qq\AddPanel.htm O8 - Extra context menu item: 添加到QQ表情 - D:\Program Files\Tencent\qq\AddEmotion.htm O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Program Files\Tencent\qq\SendMMS.htm O8 - Extra context menu item: 百度Flash搜索 - res://C:\WINNT\DOWNLO~1\BaiDuBar.dll/FLASHSEARCH.HTM O8 - Extra context menu item: 百度mp3搜索 - res://C:\WINNT\DOWNLO~1\BaiDuBar.dll/BAIDUMP3.HTM O8 - Extra context menu item: 百度信息快递搜索 - res://C:\WINNT\DOWNLO~1\BaiDuBar.dll/BAIDUIE.HTM O8 - Extra context menu item: 百度图片搜索 - res://C:\WINNT\DOWNLO~1\BaiDuBar.dll/BAIDUIMG.HTM O8 - Extra context menu item: 百度搜索 - res://C:\WINNT\DOWNLO~1\BaiDuBar.dll/BAIDUSEARCH.HTM O8 - Extra context menu item: 百度新闻搜索 - res://C:\WINNT\DOWNLO~1\BaiDuBar.dll/BAIDUNEWS.HTM O8 - Extra context menu item: 豪杰超级解霸V8实时播放 - d:\Herosoft\HeroV8\MPURLGET.HTM O8 - Extra context menu item: 雅虎搜索 - res://C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll/246 O9 - Extra button: kele8 (HKLM) O9 - Extra 'Tools' menuitem: kele8 (HKLM) O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O9 - Extra button: QQ (HKLM) O11 - Options group: [!CNS] O14 - IERESET.INF: SEARCH_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=iear=iesearch(&A) O16 - DPF: {2354A44B-3CEB-4829-9940-545B03103538} (PowerPlr Control) - http://bbsky.wuhan.net.cn/xintv/plugin/PowerPlr.ocx O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/1681601da9de94a1f416/netzip/RdxIE601_cn.cab O16 - DPF: {56A7DC70-E102-4408-A34A-AE06FEF01586} ( O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1131432933997 O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38010.9195138889 O16 - DPF: {AC3A36A8-9BFF-410A-A33D-2279FFEB69D2} (QQPlayer Control) - http://219.133.62.236/QQPlayer.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - file://D:\Herosoft\HeroV8\DVDSkin\defskin\HTML\swflash.cab O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/Ver2005/OL2005.cab O16 - DPF: {EF9F1C48-1A63-495A-9317-B7B71B34A9CF} (Msp Class) - http://ddddl.dudu.com/ddd/update/plugin/sinamsp.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{7CF00975-FE49-4905-B41F-868AF6A14ED9}: NameServer = 202.103.24.68
小海之夜初生襁褓狮帖子:8 注册: 2005-10-25 来自:

建能横据古稀狮帖子:5755 注册: 2005-04-01 来自:	发表于： 2005-11-22 13:35 \| 短消息资料字号：小中大 4楼 R3 - URLSearchHook: (no name) - {BB936323-19FA-4521-BA29-ECA6A121BC78} - (no file) R3 - URLSearchHook: O2 - BHO: (no name) - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINNT\system32\xunleibho_v8.dll O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O4 - HKLM\..\Run: [8751bol] C:\Program Files\8751ip\8751ip.exe O4 - HKLM\..\Run: [csrss] C:\WINNT\csrss.exe O4 - HKLM\..\RunServices: [csrss] C:\WINNT\csrss.exe O4 - HKCU\..\Run: [Internat.exe] internat.exe O4 - HKCU\..\Run: [SDO2005] C:\Program Files\ O4 - HKCU\..\Run: [csrss] C:\WINNT\csrss.exe O4 - HKCU\..\RunServices: [csrss] C:\WINNT\csrss.exe O4 - Startup: ntuser.ini O4 - Startup: NTUSER.DAT O4 - Startup: ntuser.dat.LOG O4 - Startup: 96_CD_Quality_Audio.asd O4 - Startup: 64_High_Fidelity_Stereo_Audio.asd O4 - Startup: 56_dialup_Video_For_Web_Server.asd O4 - Startup: 56_Dialup_Modem_Video.asd O4 - Startup: 56_Dialup_High_Quality_Stereo.asd O4 - Startup: 512_Video.asd O4 - Startup: 3Mb_Video.asd O4 - Startup: 28.8_Video_Voice.asd O4 - Startup: 28.8_Video_For_Web_Server.asd O4 - Startup: 28.8_Video_Audio_Emphasis.asd O4 - Startup: 28.8_FM_Radio_Stereo.asd O4 - Startup: 28.8_FM_Radio_Mono.asd O4 - Startup: 28.8_56_100_MBR_VIDEO.asd O4 - Startup: 250_Video.asd O4 - Startup: 1Mb_Video.asd O4 - Startup: 16_AM_Radio.asd O4 - Startup: 128_CD_Transparency_Audio.asd O4 - Startup: 100_Video.asd O4 - Startup: 6.5_Voice_Audio.asd O4 - Startup: nspmcvt.exe O4 - Startup: Intranet_HighSpeed_Lan_MBR_Video.asd O4 - Startup: Dialup_Modems_ISDN_MBR_Video.asd O4 - Global Startup: ntuser.pol O14 - IERESET.INF: SEARCH_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=iear=iesearch(&A) 修复上面各项，用hijackthis1.99.1扫个日志上来
建能横据古稀狮帖子:5755 注册: 2005-04-01 来自:

小海之夜初生襁褓狮帖子:8 注册: 2005-10-25 来自:	发表于： 2005-11-22 13:52 \| 只看楼主短消息资料字号：小中大 5楼 HijackThis@Qoo的扫描日志 V1.97.7 Scan saved at 13:49:30, on 2005-11-22 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 (6.00.2462.0000) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe D:\PROGRAM FILES\RISING\RAV\Ravmond.exe D:\PROGRAM FILES\RISING\RAV\RavStub.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\System32\msdtc.exe C:\WINNT\System32\tcpsvcs.exe C:\WINNT\System32\svchost.exe C:\WINNT\System32\llssrv.exe C:\WINNT\System32\sfmprint.exe C:\WINNT\system32\regsvc.exe D:\PROGRAM FILES\RISING\RAV\CCENTER.EXE C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\System32\wins.exe C:\WINNT\system32\mspmspsv.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\Dfssvc.exe C:\WINNT\System32\dns.exe C:\WINNT\System32\inetsrv\inetinfo.exe C:\WINNT\system32\mqsvc.exe C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe C:\WINNT\System32\svchost.exe C:\WINNT\Explorer.EXE C:\WINNT\System32\mdm.exe C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe D:\PROGRA~1\RISING\RAV\RAVTIMER.EXE C:\WINNT\system32\internat.exe C:\WINNT\csrss.exe C:\Program Files\Internet Explorer\iexplore.exe D:\Program Files\Rising\Rav\Rav.exe C:\WINNT\system32\NOTEPAD.EXE D:\Downloads\hijackthis1.97_qoo\HijackThis.exe R3 - URLSearchHook: O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll O2 - BHO: O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\Program Files\Tencent\qq\QQIEHelper.dll O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL O2 - BHO: DownloadBHO T2BHO - {B1D147E7-873E-4909-8127-695D9BB78728} - C:\WINNT\Downloaded Program Files\barhelp22.0.dll O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINNT\DOWNLO~1\CnsHook.dll O3 - Toolbar: ????? - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll O3 - Toolbar: ????? - {56A7DC70-E102-4408-A34A-AE06FEF01586} - C:\WINNT\DOWNLO~1\IEBAR2~1.DLL O3 - Toolbar: ????? - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx O4 - HKLM\..\Run: [csrss] C:\WINNT\csrss.exe O4 - HKLM\..\RunServices: [csrss] C:\WINNT\csrss.exe O4 - HKCU\..\Run: [csrss] C:\WINNT\csrss.exe O4 - HKCU\..\RunServices: [csrss] C:\WINNT\csrss.exe O4 - Startup: ntuser.ini O4 - Startup: NTUSER.DAT O4 - Startup: ntuser.dat.LOG O4 - Startup: 96_CD_Quality_Audio.asd O4 - Startup: 64_High_Fidelity_Stereo_Audio.asd O4 - Startup: 56_dialup_Video_For_Web_Server.asd O4 - Startup: 56_Dialup_Modem_Video.asd O4 - Startup: 56_Dialup_High_Quality_Stereo.asd O4 - Startup: 512_Video.asd O4 - Startup: 3Mb_Video.asd O4 - Startup: 28.8_Video_Voice.asd O4 - Startup: 28.8_Video_For_Web_Server.asd O4 - Startup: 28.8_Video_Audio_Emphasis.asd O4 - Startup: 28.8_FM_Radio_Stereo.asd O4 - Startup: 28.8_FM_Radio_Mono.asd O4 - Startup: 28.8_56_100_MBR_VIDEO.asd O4 - Startup: 250_Video.asd O4 - Startup: 1Mb_Video.asd O4 - Startup: 16_AM_Radio.asd O4 - Startup: 128_CD_Transparency_Audio.asd O4 - Startup: 100_Video.asd O4 - Startup: 6.5_Voice_Audio.asd O4 - Startup: nspmcvt.exe O4 - Startup: Intranet_HighSpeed_Lan_MBR_Video.asd O4 - Startup: Dialup_Modems_ISDN_MBR_Video.asd O4 - Global Startup: ntuser.pol O8 - Extra context menu item: !搜一搜 - res://C:\WINNT\DOWNLO~1\CnsMinEx.dll/1003 O8 - Extra context menu item: &使用迅雷下载 - d:\Program Files\Thunder Network\Thunder\geturl.htm O8 - Extra context menu item: &使用迅雷下载全部链接 - d:\Program Files\Thunder Network\Thunder\getallurl.htm O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\Program Files\Tencent\qq\AddToNetDisk.htm O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Program Files\Tencent\qq\AddPanel.htm O8 - Extra context menu item: 添加到QQ表情 - D:\Program Files\Tencent\qq\AddEmotion.htm O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Program Files\Tencent\qq\SendMMS.htm O8 - Extra context menu item: 百度Flash搜索 - res://C:\WINNT\DOWNLO~1\BaiDuBar.dll/FLASHSEARCH.HTM O8 - Extra context menu item: 百度mp3搜索 - res://C:\WINNT\DOWNLO~1\BaiDuBar.dll/BAIDUMP3.HTM O8 - Extra context menu item: 百度信息快递搜索 - res://C:\WINNT\DOWNLO~1\BaiDuBar.dll/BAIDUIE.HTM O8 - Extra context menu item: 百度图片搜索 - res://C:\WINNT\DOWNLO~1\BaiDuBar.dll/BAIDUIMG.HTM O8 - Extra context menu item: 百度搜索 - res://C:\WINNT\DOWNLO~1\BaiDuBar.dll/BAIDUSEARCH.HTM O8 - Extra context menu item: 百度新闻搜索 - res://C:\WINNT\DOWNLO~1\BaiDuBar.dll/BAIDUNEWS.HTM O8 - Extra context menu item: 豪杰超级解霸V8实时播放 - d:\Herosoft\HeroV8\MPURLGET.HTM O8 - Extra context menu item: 雅虎搜索 - res://C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll/246 O9 - Extra button: kele8 (HKLM) O9 - Extra 'Tools' menuitem: kele8 (HKLM) O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O9 - Extra button: QQ (HKLM) O11 - Options group: [!CNS] O16 - DPF: {2354A44B-3CEB-4829-9940-545B03103538} (PowerPlr Control) - http://bbsky.wuhan.net.cn/xintv/plugin/PowerPlr.ocx O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/1681601da9de94a1f416/netzip/RdxIE601_cn.cab O16 - DPF: {56A7DC70-E102-4408-A34A-AE06FEF01586} ( O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1131432933997 O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38010.9195138889 O16 - DPF: {AC3A36A8-9BFF-410A-A33D-2279FFEB69D2} (QQPlayer Control) - http://219.133.62.236/QQPlayer.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - file://D:\Herosoft\HeroV8\DVDSkin\defskin\HTML\swflash.cab O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/Ver2005/OL2005.cab O16 - DPF: {EF9F1C48-1A63-495A-9317-B7B71B34A9CF} (Msp Class) - http://ddddl.dudu.com/ddd/update/plugin/sinamsp.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{7CF00975-FE49-4905-B41F-868AF6A14ED9}: NameServer = 202.103.24.68
小海之夜初生襁褓狮帖子:8 注册: 2005-10-25 来自:

小海之夜初生襁褓狮帖子:8 注册: 2005-10-25 来自:	发表于： 2005-11-22 14:08 \| 只看楼主短消息资料字号：小中大 6楼已经修复上面各项，用hijackthisV1.97.7扫的日志重启了计算机，但IE主页上还是：http://yinyue84.com/? 是亮的，可以改，但改后从启还是这个。无效哟。
小海之夜初生襁褓狮帖子:8 注册: 2005-10-25 来自:

小海之夜初生襁褓狮帖子:8 注册: 2005-10-25 来自:	发表于： 2005-11-22 14:12 \| 只看楼主短消息资料字号：小中大 7楼怎么这个病毒，瑞星杀不了呢。瑞星的同志们要加油啊。冲冲冲~~~~ 快点升级版本，如果瑞星杀不了这个，我会很没有面子的。因为我跟很多人说过，瑞星已经很好用了，虽然不是万能的。
小海之夜初生襁褓狮帖子:8 注册: 2005-10-25 来自:

小海之夜初生襁褓狮帖子:8 注册: 2005-10-25 来自:	发表于： 2005-11-22 14:32 \| 只看楼主短消息资料字号：小中大 8楼 Logfile of HijackThis v1.99.1 Scan saved at 14:29:07, on 2005-11-22 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 (6.00.2462.0000) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe D:\PROGRAM FILES\RISING\RAV\Ravmond.exe D:\PROGRAM FILES\RISING\RAV\RavStub.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\System32\msdtc.exe C:\WINNT\System32\tcpsvcs.exe C:\WINNT\System32\svchost.exe C:\WINNT\System32\llssrv.exe C:\WINNT\System32\sfmprint.exe C:\WINNT\system32\regsvc.exe D:\PROGRAM FILES\RISING\RAV\CCENTER.EXE C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\System32\wins.exe C:\WINNT\system32\mspmspsv.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\Dfssvc.exe C:\WINNT\System32\dns.exe C:\WINNT\System32\inetsrv\inetinfo.exe C:\WINNT\system32\mqsvc.exe C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe C:\WINNT\Explorer.EXE C:\WINNT\csrss.exe C:\WINNT\System32\svchost.exe C:\WINNT\System32\mdm.exe D:\Program Files\Rising\Rav\Rav.exe C:\Program Files\Internet Explorer\iexplore.exe D:\Downloads\ha_hijackthis_1991\HijackThis.exe R3 - URLSearchHook: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll O2 - BHO: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\Program Files\Tencent\qq\QQIEHelper.dll O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL O2 - BHO: DownloadBHO T2BHO - {B1D147E7-873E-4909-8127-695D9BB78728} - C:\WINNT\Downloaded Program Files\barhelp22.0.dll O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINNT\DOWNLO~1\CnsHook.dll O3 - Toolbar: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll O3 - Toolbar: 天下搜索 - {56A7DC70-E102-4408-A34A-AE06FEF01586} - C:\WINNT\DOWNLO~1\IEBAR2~1.DLL O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx O4 - HKLM\..\Run: [csrss] C:\WINNT\csrss.exe O4 - HKLM\..\RunServices: [csrss] C:\WINNT\csrss.exe O4 - HKCU\..\Run: [csrss] C:\WINNT\csrss.exe O4 - HKCU\..\RunServices: [csrss] C:\WINNT\csrss.exe O8 - Extra context menu item: !搜一搜 - res://C:\WINNT\DOWNLO~1\CnsMinEx.dll/1003 O8 - Extra context menu item: &使用迅雷下载 - d:\Program Files\Thunder Network\Thunder\geturl.htm O8 - Extra context menu item: &使用迅雷下载全部链接 - d:\Program Files\Thunder Network\Thunder\getallurl.htm O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\Program Files\Tencent\qq\AddToNetDisk.htm O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Program Files\Tencent\qq\AddPanel.htm O8 - Extra context menu item: 添加到QQ表情 - D:\Program Files\Tencent\qq\AddEmotion.htm O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Program Files\Tencent\qq\SendMMS.htm O8 - Extra context menu item: 百度Flash搜索 - res://C:\WINNT\DOWNLO~1\BaiDuBar.dll/FLASHSEARCH.HTM O8 - Extra context menu item: 百度mp3搜索 - res://C:\WINNT\DOWNLO~1\BaiDuBar.dll/BAIDUMP3.HTM O8 - Extra context menu item: 百度信息快递搜索 - res://C:\WINNT\DOWNLO~1\BaiDuBar.dll/BAIDUIE.HTM O8 - Extra context menu item: 百度图片搜索 - res://C:\WINNT\DOWNLO~1\BaiDuBar.dll/BAIDUIMG.HTM O8 - Extra context menu item: 百度搜索 - res://C:\WINNT\DOWNLO~1\BaiDuBar.dll/BAIDUSEARCH.HTM O8 - Extra context menu item: 百度新闻搜索 - res://C:\WINNT\DOWNLO~1\BaiDuBar.dll/BAIDUNEWS.HTM O8 - Extra context menu item: 豪杰超级解霸V8实时播放 - d:\Herosoft\HeroV8\MPURLGET.HTM O8 - Extra context menu item: 雅虎搜索 - res://C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll/246 O9 - Extra button: 手机短信 - {00000000-0000-0001-0001-596BAEDD1289} - http://sms.3721.com/ie/index.htm?pid=U_newhua_5424 (file missing) O9 - Extra button: (no name) - {233A9694-667E-11d1-9DFB-006097D5040A} - (no file) O9 - Extra button: 豪杰超级解霸V8 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - d:\Herosoft\HeroV8\STHSDVD.EXE O9 - Extra 'Tools' menuitem: 豪杰超级解霸V8 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - d:\Herosoft\HeroV8\STHSDVD.EXE O9 - Extra button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.mail.yahoo.com/promo/rd1 (file missing) O9 - Extra button: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://adtaobao.allyes.com/main/adfclick?db=adtaobao&bid=138,140,18&cid=816,8,1&sid=5042&show=ignore&url=?allyesPara=816 (file missing) O9 - Extra button: 雅虎助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://cn.zs.yahoo.com/?source=Cns (file missing) O9 - Extra button: kele8 - {84920E5F-3788-49cd-A274-E365578DF174} - http://www.kele8.com/ (file missing) O9 - Extra 'Tools' menuitem: kele8 - {84920E5F-3788-49cd-A274-E365578DF174} - http://www.kele8.com/ (file missing) O9 - Extra button: 联系人 - {9239E4EC-C9A6-11D2-A844-00C04F68D538} - C:\Program Files\Internet Explorer\iecont.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\qq\QQ.EXE O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\qq\QQ.EXE O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\qq\QQIEHelper.dll O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\qq\QQIEHelper.dll O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing) O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing) O9 - Extra 'Tools' menuitem: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing) O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing) O9 - Extra 'Tools' menuitem: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing) O11 - Options group: [!CNS] 网络实名 O16 - DPF: {2354A44B-3CEB-4829-9940-545B03103538} (PowerPlr Control) - http://bbsky.wuhan.net.cn/xintv/plugin/PowerPlr.ocx O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/1681601da9de94a1f416/netzip/RdxIE601_cn.cab O16 - DPF: {56A7DC70-E102-4408-A34A-AE06FEF01586} (天下搜索) - http://iebar.t2t2.com/iebar.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1131432933997 O16 - DPF: {AC3A36A8-9BFF-410A-A33D-2279FFEB69D2} (QQPlayer Control) - http://219.133.62.236/QQPlayer.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - file://D:\Herosoft\HeroV8\DVDSkin\defskin\HTML\swflash.cab O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/Ver2005/OL2005.cab O16 - DPF: {EF9F1C48-1A63-495A-9317-B7B71B34A9CF} (Msp Class) - http://ddddl.dudu.com/ddd/update/plugin/sinamsp.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{7CF00975-FE49-4905-B41F-868AF6A14ED9}: NameServer = 202.103.24.68 O18 - Protocol: koboo - {7DEE9D05-FA0A-4416-A6F3-6537D0EAB6A6} - C:\WINNT\system32\mbprot.dll O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: Rising Process Communication Center (RsCCenter) - rising - D:\PROGRAM FILES\RISING\RAV\CCENTER.EXE O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\PROGRAM FILES\RISING\RAV\Ravmond.exe
小海之夜初生襁褓狮帖子:8 注册: 2005-10-25 来自:

raulronaldo 锋芒艾服狮帖子:1481 注册: 2002-07-04 来自:海的另一边	发表于： 2005-11-22 15:09 \| 短消息资料字号：小中大 9楼 O4 - HKLM\..\Run: [csrss] C:\WINNT\csrss.exe O4 - HKLM\..\RunServices: [csrss] C:\WINNT\csrss.exe O4 - HKCU\..\Run: [csrss] C:\WINNT\csrss.exe O4 - HKCU\..\RunServices: [csrss] C:\WINNT\csrss.exe O18 - Protocol: koboo - {7DEE9D05-FA0A-4416-A6F3-6537D0EAB6A6} - C:\WINNT\system32\mbprot.dll 修复然后到任务管理器中终止！最后删掉！
raulronaldo 锋芒艾服狮帖子:1481 注册: 2002-07-04 来自:海的另一边

raulronaldo 锋芒艾服狮帖子:1481 注册: 2002-07-04 来自:海的另一边	发表于： 2005-11-22 15:38 \| 短消息资料字号：小中大 10楼瑞星最新版能杀这个毒啊！！
raulronaldo 锋芒艾服狮帖子:1481 注册: 2002-07-04 来自:海的另一边

<<上一主题|下一主题>>

12

1 / 2 页

跳转页

页面顶部

Powered by Discuz!NT