瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 HijackThis扫描病毒恳请各位帮忙看看

1   1  /  1  页   跳转

HijackThis扫描病毒恳请各位帮忙看看

HijackThis扫描病毒恳请各位帮忙看看

电脑最近运转缓慢,网页总是运行如蜗牛~~~不知道问题在哪,请各位帮忙看看,先谢谢了!


Logfile of HijackThis v1.99.1
Scan saved at 10:24:20:金来沅, on 2006-5-15
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\dell\My Documents\tool\瑞星杀毒\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\dell\My Documents\tool\瑞星杀毒\Rising\Rav\Ravmond.exe
c:\documents and settings\dell\my documents\tool\瑞星杀毒\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Documents and Settings\dell\My Documents\tool\瑞星杀毒\Rising\Rav\RavStub.exe
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\SYSTEM32\RUNDLL32.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
c:\documents and settings\dell\my documents\tool\瑞星杀毒\rising\rfw\RfwMain.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe
C:\Documents and Settings\dell\My Documents\tool\瑞星杀毒\Rising\Rav\RavTask.exe
C:\WINDOWS\VM_STI.EXE
C:\Documents and Settings\dell\My Documents\tool\瑞星杀毒\Rising\Rav\Ravmon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\dell\My Documents\tool\瑞星杀毒\Rising\Rav\Smartup.exe
C:\Program Files\zoomtech\web宽带上网\GateClient.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\dell\My Documents\tool\realplay\realplay.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\dell\My Documents\tool\讯雷\Thunder.exe
C:\WINDOWS\system32\regsvr32.exe
C:\Documents and Settings\dell\My Documents\tool\qq杀毒软件\RavQQMsender.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\dell\My Documents\tool\Hijack This1.99.1\HijackThis.exe

R3 - URLSearchHook: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
O2 - BHO: std software - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - C:\WINDOWS\SYSTEM32\stdup.dll
O2 - BHO: 卡卡上网安全助手 - {AFF6E516-CBE5-4F8A-9C2F-38A68013E766} - C:\WINDOWS\system32\kakatool.dll
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINDOWS\DOWNLO~1\cnshook.dll
O3 - Toolbar: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [helper.dll] C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - HKLM\..\Run: [CnsMin] Rundll32.exe C:\WINDOWS\DOWNLO~1\CnsMin.dll,Rundll32
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [MS-4011 Memory Patch] C:\Documents and Settings\dell\My Documents\tool\密码解调器\超级杀毒软件\第4个.exe -Patch
O4 - HKLM\..\Run: [YLive.exe] C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
O4 - HKLM\..\Run: [yassistse] "C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"
O4 - HKLM\..\Run: [RavTask] "C:\Documents and Settings\dell\My Documents\tool\瑞星杀毒\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [RfwMain] "C:\Documents and Settings\dell\My Documents\tool\瑞星杀毒\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE USB PC Camera 301P
O4 - HKLM\..\Run: [res] C:\WINDOWS\system32\res.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [Thunder] "C:\Documents and Settings\dell\My Documents\tool\讯雷\ThunderShell.exe" /s
O4 - HKLM\..\Run: [cyogia] C:\WINDOWS\system32\cyogia.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: 迅雷4.lnk = ?
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: 金山词霸 2002.lnk = C:\Program Files\Kingsoft\XDict\XDICT.EXE
O4 - Global Startup: 问题解答.lnk = ?
O9 - Extra button: 雅虎助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist (file missing)
O11 - Options group: [!CNS]  网络实名
O16 - DPF: {74060AB6-3060-4800-BE28-B2B3147E2469} (QiconInstallerVer1 Control) - http://qicon.cn/setup/QiconInstallerVer1.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O21 - SSODL: SysTime - {724C75F1-B757-408D-A50A-4CF99DA35D73} - C:\PROGRA~1\winkld\winkld.dll
O21 - SSODL: Vision - {6671A431-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\MMSASS~1\Mmsass~1.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Documents and Settings\dell\My Documents\tool\BTNtService.exe (file missing)
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\documents and settings\dell\my documents\tool\瑞星杀毒\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\documents and settings\dell\my documents\tool\瑞星杀毒\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Documents and Settings\dell\My Documents\tool\瑞星杀毒\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Documents and Settings\dell\My Documents\tool\瑞星杀毒\Rising\Rav\Ravmond.exe

最后编辑2006-05-15 11:19:11
分享到:
gototop
 

没有问题吗?没有人帮我看看吗?谢谢~~~
gototop
 

【回复“苏格拉底女孩”的帖子】
修复
O2 - BHO: std software - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - C:\WINDOWS\SYSTEM32\stdup.dll
O4 - HKLM\..\Run: [res] C:\WINDOWS\system32\res.exe
O4 - HKLM\..\Run: [cyogia] C:\WINDOWS\system32\cyogia.exe
O21 - SSODL: Vision - {6671A431-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\MMSASS~1\Mmsass~1.dll

卸载
C:\Program Files\MMSAssist\

删除
C:\Program Files\MMSAssist\
C:\WINDOWS\SYSTEM32\stdup.dll
C:\WINDOWS\system32\res.exe
C:\WINDOWS\system32\cyogia.exe

其中
C:\WINDOWS\SYSTEM32\stdup.dll是间谍广告插件
具体操作参考
http://forum.ikaka.com/topic.asp?board=28&artid=7971417
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT