最近电脑启动速度变的很慢,而且又中了好多插件,刚才有瑞星在安全模式下杀毒居然查出18个木马和病毒。。。
病毒如下:
Dropper.Agent.dbf
Dropper.Agent.wl
Dropper.Misc.at
Dropper.Agent.wl
Trojan.DL.Agent.amw
Dropper.Misc.at
Trojan.Agent.djp
Trojan.Clicker.Agent.ads
Trojan.Clicker.Qhost.i
Trojan.DL.Agent.amw
Trojan.Spy.Agent.bhs
Trojan.DL.Agent.kmz
Trojan.DL.Agent.kmy
Trojan.Clicker.Delf.di
Trojan.DL.Small.nhc
Trojan.Clicker.Agent.ads
Trojan.Agent.djp
Trojan.Clicker.Agent.ads
Trojan.Clicker.Qhost.i
Trojan.Spy.Agent.bhs
请高手们帮忙看看。这些病毒用瑞星在安全模式下都直接杀掉了,但过段时间还会自己出来,还应该怎么弄,麻烦指点下,谢谢~
Logfile of HijackThis v1.99.1
Scan saved at 14:46:04, on 2006-8-18
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
F:\Rising\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
F:\Rising\Rising\Rav\Ravmond.exe
f:\rising\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
F:\Rising\Rising\Rav\RavStub.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
F:\Nokia\NOKIAP~1\NOKIAP~1\NOKIAP~1\LAUNCH~1.EXE
C:\WINDOWS\VM_STI.EXE
F:\Rising\Rising\Rfw\rfwmain.exe
F:\Rising\Rising\Rav\RavTask.exe
C:\WINDOWS\system32\ctfmon.exe
F:\Xplus\xvcclip.exe
F:\Nokia\Nokia PC Suite 6\Nokia PC Suite 6\Nokia PC Suite 6\PcSync2.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
F:\Rising\Rising\Rav\Ravmon.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\WINDOWS\system32\Rundll32.exe
F:\BitSpirit\BitSpirit.exe
F:\Xplus\Xplus.exe
F:\Rising\hijackthis\HijackThis.exe
O2 - BHO: (no name) - RsAutorunsDisabled - (no file)
O2 - BHO: Query Class - {01C2F1E8-5C69-4B5C-B052-26941B6C23A6} - C:\WINDOWS\system32\iequery.dll (file missing)
O2 - BHO: hbieobj Class - {147E230B-FC8D-4A66-AB96-FFD464A9B2A3} - C:\PROGRA~1\hbclient\hbhelper.dll
O2 - BHO: Shockwave Flash
Object - {14A21378-5BB1-4BC4-95D5-5D3F51527F6F} - C:\WINDOWS\system32\smflash.ocx
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - F:\QQ2006\QQIEHelper.dll
O2 - BHO: ActiveBHO Class - {63C55A7F-6E29-8D4F-5C76-4F850F28D13A} - C:\Progra~1\DoDoorRSSFinder\ActiveBand
Object.dll
O2 - BHO: Vision - {6671A431-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\MMSASS~1\mmsass~1.dll
O2 - BHO: stdup - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - C:\WINDOWS\SYSTEM32\stdup.dll
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - F:\xunlei\ComDlls\XunLeiBHO_002.dll
O2 - BHO: NewWeb Controller - {9ACEEE31-1440-471B-AA46-72B061FE7D61} - C:\WINDOWS\system32\WinSC32.dll
O2 - BHO: (no name) - {A9930D97-9CF0-42A0-A10D-4F28836579D5} - F:\KuGoo3\KuGoo3DownXControl.ocx
O2 - BHO: (no name) - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - (no file)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PCSuiteTrayApplication] F:\Nokia\NOKIAP~1\NOKIAP~1\NOKIAP~1\LAUNCH~1.EXE -onlytray
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Anyvision USB PC Camera
O4 - HKLM\..\Run: [RfwMain] "F:\Rising\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [RavTask] "F:\Rising\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [StormCodec_Helper] "F:\Storm Codec\StormSet.exe" /S /opti
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Xplus] "F:\Xplus\Xplus_Wait.exe" /min
O4 - HKCU\..\Run: [xvcclip] F:\Xplus\xvcclip.exe
O4 - HKCU\..\Run: [PcSync] F:\Nokia\Nokia PC Suite 6\Nokia PC Suite 6\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Xplus_spy] "F:\Xplus\xvcclip.exe" /min
O8 - Extra context menu item: &使用迅雷下载 - F:\xunlei\Program\GetUrl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - F:\xunlei\Program\GetAllUrl.htm
O8 - Extra context menu item: >>彩信发送<< - res://C:\PROGRA~1\MMSASS~1\mmsass~1.dll/mms.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - F:\QQ2006\AddToNetDisk.htm
O8 - Extra context menu item: 使用KuGoo3下载(&K) - F:\KuGoo3\KuGoo3DownX.htm
O8 - Extra context menu item: 使用Web迅雷下载 - F:\xunlei\GetUrl.htm
O8 - Extra context menu item: 使用Web迅雷下载全部链接 - F:\xunlei\GetAllUrl.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - F:\QQ2006\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - F:\QQ2006\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - F:\QQ2006\SendMMS.htm
O8 - Extra context menu item: 用比特精灵下载(&B) - F:\BitSpirit\bsurl.htm
O9 - Extra button: (no name) - RsAutorunsDisabled - (no file)
O9 - Extra button: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - F:\xunlei\Thunder.exe
O9 - Extra 'Tools' menuitem: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - F:\xunlei\Thunder.exe
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - F:\浩方对战平台\GameClient.exe
O9 - Extra button: (no name) - {6671A433-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\MMSASS~1\mmsass~1.dll
O9 - Extra 'Tools' menuitem: 彩E精灵设置 - {6671A433-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\MMSASS~1\mmsass~1.dll
O9 - Extra button: 启动Web迅雷 - {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} - http://my.xunlei.com (file missing)
O9 - Extra 'Tools' menuitem: 启动Web迅雷 - {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} - http://my.xunlei.com (file missing)
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - F:\QQ2006\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - F:\QQ2006\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - F:\QQ2006\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - F:\QQ2006\QQIEHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://ericsgun.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {ACFE8232-03C5-4AEC-AF5E-42B806724096} (KSHScan Control) - http://safe.qq.com/scan/KAllScan.CAB
O16 - DPF: {E787FD25-8D7C-4693-AE67-9406BC6E22DF} (CPasswordEditCtrl
Object) - https://password.qq.com/download/qqedit.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - f:\rising\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - f:\rising\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - F:\Rising\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - F:\Rising\Rising\Rav\Ravmond.exe