防火墙总是提示ftp.exe要访问网络,如果允许ftp.exe通过,它就会下载病毒,下载的病毒有filereg.exe,winssh.exe,eraseme_*.exe ,即使删除了ftp.exe,tftp.exe也会自动生成,我已经做过几遍系统了,难道一定要全格? :( 瑞星,毒霸都试过可是杀不掉啊,只能杀掉ftp.exe下载的病毒,到底是什么时候东东驱动了ftp.exe就是查不到,咋办啊各位老大,帮俺看看,这用HijackThis扫描的日志
Logfile of HijackThis v1.99.1
Scan saved at 9:38:26, on 2006-5-18
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
d:\KAV2005\KWatch.EXE
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\svchost.exe
d:\KAV2005\KPfwSvc.EXE
C:\WINNT\System32\llssrv.exe
d:\PROGRA~1\MICROS~2\MSSQL\binn\sqlservr.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\system32\inetsrv\inetinfo.exe
C:\WINNT\system32\msdtc.exe
C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe
C:\WINNT\Explorer.EXE
D:\Program Files\DAEMON Tools\daemon.exe
D:\KAV2005\KAVStart.exe
C:\WINNT\system32\ctfmon.exe
D:\KAV2005\KPFW32.EXE
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
E:\Downloads\简体中文版IPMsgCHS206\简体中文版IPMsgCHS206\IPMSG.exe
D:\KAV2005\KMailMon.EXE
C:\WINNT\System32\svchost.exe
D:\Program Files\Maxthon\Max.exe
C:\WINNT\system32\NOTEPAD.EXE
C:\WINNT\system32\NOTEPAD.EXE
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\conime.exe
C:\WINNT\system32\NOTEPAD.EXE
D:\KAV2005\KAVLog2.EXE
C:\WINNT\system32\NOTEPAD.EXE
C:\WINNT\system32\mmc.exe
D:\Program Files\Macromedia\Fireworks 8\Fireworks.exe
d:\Program Files\ewido anti-malware 4.0\guard.exe
d:\Program Files\ewido anti-malware 4.0\ewido.exe
C:\WINNT\system32\cmd.exe '这两个只有有下载病毒的时候才出现
C:\WINNT\system32\ftp.exe '
E:\Downloads\ha_hijackthis_1991\HijackThis.exe
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\PROGRA~1\FlashGet\jccatch.dll
O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - HKLM\..\Run: [DAEMON Tools] "d:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [KavStart] "d:\KAV2005\KAVStart.exe" -startup
O4 - HKLM\..\Run: [!ewido] "d:\Program Files\ewido anti-malware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [KavPFW] "D:\KAV2005\KPFW32.EXE"
O4 - Startup: 飞鸽传书.lnk = ?
O4 - Global Startup: 服务管理器.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: 使用网际快车下载 - D:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - D:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\flashget.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{A284FBB9-3A3C-4F81-9B71-0F9F1293EF1E}: NameServer = 202.102.128.68
O17 - HKLM\System\CS1\Services\Tcpip\..\{A284FBB9-3A3C-4F81-9B71-0F9F1293EF1E}: NameServer = 202.102.128.68
O17 - HKLM\System\CS2\Services\Tcpip\..\{A284FBB9-3A3C-4F81-9B71-0F9F1293EF1E}: NameServer = 202.102.128.68
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxdev.dll
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido anti-malware 4.0 guard - Unknown owner - d:\Program Files\ewido anti-malware 4.0\guard.exe
O23 - Service: Kingsoft Personal Firewall Service (KPfwSvc) - Kingsoft Corporation - d:\KAV2005\KPfwSvc.EXE
O23 - Service: Kingsoft Antivirus KWatch Service (KWatchSvc) - Kingsoft Corporation - d:\KAV2005\KWatch.EXE
