1   1  /  1  页   跳转

【求助】Exploit.Realplayer

【求助】Exploit.Realplayer

我种了Exploit.Realplayer这个病毒
C:\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\8RSBUVWX里的 hackworkshop[1].htm 这是瑞星监控所报的位置。我的瑞星过期了,想手动删除,但我又搜索不到这个文件。
  后来我在注册表中找到了hackworkshop[1].htm 删除了(普通模式下删除的) 只在注册表中删除了,病毒还会不会影响我的机器?   
  请高手帮我出出主意。。


最后编辑2006-08-03 20:07:51
分享到:
gototop
 


请您先下载HijackThis1.99.1(它是免费的):

http://www.spywareinfo.com/~merijn/files/hijackthis.zip
将它解压到一个非临时性的文件夹(比如C:\Program Files\HijackThis\HijackThis.exe)。然后双击HijackThis.exe图标,选择Do a system scan and save a logfile,将产生的文本文件中的日志贴上来。如果一个帖子贴不下,可以将剩余的部分另开一帖。
gototop
 

RealPlayer的溢出攻击
参考:
1:目前厂商已经发布了升级补丁以修复这个安全问题,请下载更新

2:对临时文件夹需要经常清理

3:清空临时文件夹的方法:

IE》属性》删除文件(包括脱机文件)》确定
gototop
 

Logfile of HijackThis v1.99.1
Scan saved at 20:00:19, on 2006-8-3
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
d:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
d:\Program Files\Rising\Rav\Ravmond.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Rising\Rav\RavTask.exe
D:\Program Files\Rising\Rav\Ravmon.exe
D:\乱\IeTools\IeTools.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\windows.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\乱\hijackthis\HijackThis.exe
d:\Program Files\Real\RealPlayer\RealPlay.exe
d:\Program Files\Real\RealPlayer\RealPlay.exe

F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - d:\Program Files\Tencent\QQ\QQIEHelper.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RavTask] "d:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKCU\..\Run: [IE浏览器修复工具] D:\乱\IeTools\IeTools.exe /AutoRun
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
O8 - Extra context menu item: 添加到QQ表情 - d:\Program Files\Tencent\QQ\AddEmotion.htm
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - d:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - d:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=about:blank
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - d:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - d:\Program Files\Rising\Rav\Ravmond.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: windows - Unknown owner - C:\WINDOWS\windows.exe

gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT