瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 【求助】Trojan.Spy.Banbra.hxj ,怎么处理?

1   1  /  1  页   跳转

【求助】Trojan.Spy.Banbra.hxj ,怎么处理?

【求助】Trojan.Spy.Banbra.hxj ,怎么处理?

我上百度看了看,好象很难处理啊?各位高手,帮帮忙吧!!
最后编辑2006-11-05 21:27:37
分享到:
gototop
 

请到我的网盘http://free5.ys168.com/?echowj下载Hijackthis
下载后运行HijackThis.rar,再运行HijackThis.exe
单击"扫描日志并保存日志"
把保存的日志复制粘贴上来. 日志一次粘不完,分次粘完,请不要修改.
gototop
 

Logfile of HijackThis v1.99.1
Scan saved at 23:30:10, on 2006-11-4
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\rising\rfw\RfwMain.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe
C:\Program Files\Rising\Rising\Rav\RsAgent.exe
C:\WINDOWS\msagent\AgentSvr.exe
C:\WINDOWS\system32\ctfmon.exe
D:\tools\下载\eMule\emule.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\Program Files\ChinaNet\VnetClient.exe
D:\tools\下载\BitComet\BitComet.exe
C:\Program Files\QQ2005\QQ.exe
C:\Program Files\QQ2005\TIMPlatform.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rising\Rav\RAVTASK.EXE
C:\Program Files\Rising\Rising\Rav\Ravmond.exe
C:\Program Files\Rising\Rising\Rav\RAVMON.EXE
C:\Program Files\Rising\Rising\Rav\RavStub.exe
C:\Program Files\Rising\Rising\Rav\rav.exe
D:\tools\QQ工具\QQGAME\QQGame.exe
D:\tools\QQ工具\QQGAME\QQGameDl.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\tools\新建文件夹\Hijackthis\HijackThis.exe
gototop
 

R3 - URLSearchHook: ContextSearch Class - {88351CEF-BAC0-4A9B-8380-31A173E2926F} - C:\PROGRA~1\yok\toolbar.dll
O2 - BHO: IExpress - {27E96DE0-8211-42CF-9A1E-FA6246A95B77} - C:\WINDOWS\system32\iexpress.dll (file missing)
O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll
O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll
O2 - BHO: VnetCookie Class - {4E83D567-4697-4F7B-B1F0-A513B01DB89A} - c:\PROGRA~1\chinanet\VNETTR~1.DLL
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL
O2 - BHO: 超级兔子上网精灵 - {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} - D:\tools\新建文件夹\MagicSet\haokanbar.dll
O2 - BHO: VeryCD超级搜索 - {75FE2B5A-D3A4-4EFA-AC11-ADC9C9459688} - C:\PROGRA~1\yok\toolbar.dll
O2 - BHO: (no name) - {A9930D97-9CF0-42A0-A10D-4F28836579D5} - D:\tools\下载\KuGoo3\KuGoo3DownXControl.ocx
O2 - BHO: AssistHelper - {FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yassist.dll
O3 - Toolbar: 超级兔子上网精灵 - {43869BB3-22FD-4F15-9B46-238106BA2F4E} - D:\tools\新建文件夹\MagicSet\haokanbar.dll
O3 - Toolbar: 雅虎助手 - {406F94F0-504F-4A40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
gototop
 

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMan] ; SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Super Rabbit SRRestore] D:\tools\新建文件夹\MagicSet\srrest.exe /autosave
O4 - HKLM\..\Run: [YLive.exe] C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
O4 - HKLM\..\Run: [yassistse] "C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [yok.exe] C:\PROGRA~1\yok\yok.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Xplus_spy] "D:\tools\新建文件夹 (2)\xvcclip.exe" /min
O4 - HKCU\..\Run: [eMuleAutoStart] D:\tools\下载\eMule\emule.exe -AutoStart
O8 - Extra context menu item: VeryCD超级搜索 - C:\PROGRA~1\yok\yoksch.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\QQ2005\AddToNetDisk.htm
O8 - Extra context menu item: 使用KuGoo3下载(&K) - D:\tools\下载\KuGoo3\KuGoo3DownX.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\QQ2005\AddEmotion.htm
O8 - Extra context menu item: 添加到雅虎订阅(&Y) - res://C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yrss.dll/YRSSMENUEXT
O8 - Extra context menu item: 雅虎搜索 - res://C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll/203
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/pcver2006new/OL2006.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{30C6A70F-4C2E-411B-81E8-448E300FFAD6}: NameServer = 202.103.44.150 202.103.24.68
O17 - HKLM\System\CS1\Services\Tcpip\..\{30C6A70F-4C2E-411B-81E8-448E300FFAD6}: NameServer = 202.103.44.150 202.103.24.68
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - d:\tools\播放工具\iPod Updater 2005-03-23\bin\iPodService.exe
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rising\Rav\CCenter.exe
O23 - Service: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rising\Rav\Ravmond.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

gototop
 

这是我扫的日志,拜托了
gototop
 

下载超级兔子清理下流氓软件

描述下病毒路径,谢谢
gototop
 

C:\System Volume Information\_restore{4A868894-65BC-436D-BE76-14D2EF42B7AA}\RP38
这是病毒路径.

还有用超级兔子的什么项目清理啊
gototop
 

关闭系统还原
gototop
 

我的为什么不能还原啊????
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT