1   1  /  1  页   跳转

中病毒了,跪求帮助!!~~

中病毒了,跪求帮助!!~~

中了个病毒,不知道叫什么名字,电脑工作效率变慢,蓝底色桌面变成黑底色。上面有英文,最上面是黄色的英文WARNING!下面题目是YOU`AR IN DANGER 内容如下:
 
                          WARNING!
                      YOU'RE IN DANGER!



ALL YOU DO WITH COMPUTER IS STORED FOREVER IN YOUR HARD DISK. WHEN YOU VISIT SITES, SEND EMAILS... ALL YOUR ACTIONS ARE LOGGED. AND IT IS IMPOSSIBLE TO REMOVE THEM WITH STANDARD TOOLS. YOUR DATA IS STILL AVAILABLE FOR FORENSICS. AND IN SOME CASES FOR YOUR BOSS, YOUR FRIENDS, YOUR WIFE, YOUR CHILDREN.

Every site you or somebody or even something, like spyware, opened in your browser, with all images, and all downloaded and maybe later removed movies or mp3 songs - ARE STILL THERE and could broke your life!


SECURE YOURSELF RIGHT NOW!
REMOVE ALL SPYWARE FROM YOUR PC!

并且,电脑右下角的工具栏出现一个黄色 中间带有黑色感叹号的三角。

请高手来帮我杀掉这个东西。再次跪拜ING~~~~~~~~~~~~~~~~~
最后编辑2005-08-25 13:17:01
分享到:
gototop
 

点击黑色部分和文字会出现一个新的网页,网页地址和内容现在还没看到,因为一出现这个新网页,就无响应,然后就死机.
gototop
 

Logfile of HijackThis v1.99.1
Scan saved at 14:01:41, on 2005-8-24
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Rising\Rav\RavService.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\sndvol32.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Rising\Rav\Backup\RavTimer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\3721\Dlaccel\YDownloader.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\3721\assistse.exe
C:\WINNT\system32\BCUP.exe
C:\WINNT\system32\outpostupdate.exe
C:\WINNT\system32\internat.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\3721\Dlaccel\TDUpdate.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Rising\Rav\Backup\RavService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.708\HijackThis.exe

R3 - URLSearchHook: 上网助手 - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\Program Files\3721\Assist\asbar.dll
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINNT\system32\xunleibho_v6.dll
O2 - BHO: CNNIC_IDN - {35980F6E-A137-4E50-953D-813BB8556899} - C:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll
O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - C:\Program Files\3721\Assist\Angling.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: DownloadBHO T2BHO - {B1D147E7-873E-4909-8127-695D9BB78728} - C:\WINNT\Downloaded Program Files\barhelp22.0.dll
O2 - BHO: AssistII - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\Program Files\3721\Assist\asbar.dll
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINNT\downlo~1\CnsHook.dll
O2 - BHO: Infofo 工具栏 - {D74EC18E-3DDD-4174-B1B1-949FE3B8366D} - C:\Program Files\Infofo Bar\infofobar.dll
O3 - Toolbar: 博采 - {4DA2EE61-6399-4C39-AEB9-0D990E610D29} - C:\WINNT\system32\BOCAIT~1.DLL
O3 - Toolbar: 上网助手 - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\Program Files\3721\Assist\asbar.dll
O3 - Toolbar: 天下搜索 - {56A7DC70-E102-4408-A34A-AE06FEF01586} - C:\WINNT\Downloaded Program Files\iebar22.0.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Infofo 工具栏 - {D74EC18E-3DDD-4174-B1B1-949FE3B8366D} - C:\Program Files\Infofo Bar\infofobar.dll
O3 - Toolbar: BitCometBar - {3F1ABCDB-A875-46c1-8345-B72A4567E486} - C:\Program Files\BitComet\BitCometBar\BitCometBar0.1.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [RavTimer] C:\Program Files\Rising\Rav\Backup\RavTimer.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [dl_accel] C:\Program Files\3721\Dlaccel\YDownloader.exe
O4 - HKLM\..\Run: [CdnCtr] C:\Program Files\CNNIC\Cdn\cdnup.exe
O4 - HKLM\..\Run: [renewup] C:\Program Files\CNNIC\Cdn\cdnrenew.exe
O4 - HKLM\..\Run: [helper.dll] C:\WINNT\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - HKLM\..\Run: [assistse] "C:\Program Files\3721\assistse.exe"
O4 - HKLM\..\Run: [CnsMin] Rundll32.exe C:\WINNT\downlo~1\CnsMin.dll,Rundll32
O4 - HKLM\..\Run: [BCUpdate] C:\WINNT\system32\BCUP.exe
O4 - HKLM\..\Run: [outpostupdate] C:\WINNT\system32\outpostupdate.exe
O4 - HKLM\..\RunServices: [outpostupdate] C:\WINNT\system32\outpostupdate.exe
O4 - HKLM\..\RunOnce: [Local runole service] C:\WINNT\System32\srvc32.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [outpostupdate] C:\WINNT\system32\outpostupdate.exe
O4 - HKCU\..\RunOnce: [Local runole service] C:\WINNT\System32\srvc32.exe
O4 - Startup: Office 启动.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O8 - Extra context menu item: !搜一搜 - res://C:\WINNT\downlo~1\CnsMinEx.dll/1003
O8 - Extra context menu item: &使用下载加速专家下载 - C:\Program Files\3721\Dlaccel\geturl.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\qq\SendMMS.htm
O9 - Extra button: 手机短信 - {00000000-0000-0001-0001-596BAEDD1289} - http://sms.3721.com/ie/index.htm?pid=U_3721home (file missing)
O9 - Extra button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.mail.yahoo.com/promo/rd1 (file missing)
O9 - Extra button: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://hot.3721.com/rd/shop_btn.htm (file missing)
O9 - Extra button: 上网助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://assistant.3721.com/index.htm?fb=Cns (file missing)
O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing)
O9 - Extra 'Tools' menuitem: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing)
O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O9 - Extra 'Tools' menuitem: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O9 - Extra button: Microsoft AntiSpyware helper - {9DCAFC50-D767-479C-9A8C-A2B9C2AE950E} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {9DCAFC50-D767-479C-9A8C-A2B9C2AE950E} - (no file) (HKCU)
O10 - Unknown file in Winsock LSP: c:\winnt\system32\cdnns.dll
O11 - Options group: [!CNS]  上网助手-地址栏搜索
O11 - Options group: [CDNCLIENT]  中文上网
O16 - DPF: {56A7DC70-E102-4408-A34A-AE06FEF01586} (天下搜索) - http://iebar.t2t2.com/iebar.cab
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O16 - DPF: {A23817F2-733B-4BC5-8DED-C1B9B4BBF93C} - http://bar.yok.com/yokbar.cab
O16 - DPF: {F553452A-E0A8-489F-9E82-4A6360136F8A} (QfGoLivingBroadcastCtrl Control) - http://weiqi.sports.sohu.com/qipu/QfGoLivingBroadcastCtrl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{56C48529-2600-4711-BD99-98A2FDEDB2E9}: NameServer = 69.50.176.198,85.255.112.12
O21 - SSODL: CdnClient - {E83A22B5-BCF3-DB05-AAD9-6DD1C5B6041C} - c:\program files\cnnic\cdn\windcpcs32.dll
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: RavService - Unknown owner - C:\Program Files\Rising\Rav\RavService.exe" /service (file missing)
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - C:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: Rising Realtime Monitor Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\RavMonD.exe


gototop
 

5楼的高手,我已经把LOG贴出来了,请问要如何解决?
gototop
 

我的电脑是2000系统,在清理3721的时候遇到了问题,请问,如何在硬盘上删除以下内容?(以下引用的是3721的卸载办法的后半部分)

在删除完注册表中的项之后,还需要删除存储在硬盘中的3721网络实名文件。
  删除如下文件:
  C:WINNTDOWNLO~1 目录下
  (如果是win98,这里的 C:WINNTDOWNLO~1 为 C:WINDOWSDOWNLO~1 下同)
2001-08-09 15:34
3721
2001-08-02 17:03 40,960 cnsio.dll
2001-08-08 14:14 102,400 CnsMin.dll
2001-08-24 23:14 42 CnsMin.ini
2001-08-09 10:18 13,848 CnsMinEx.cab
2001-07-06 17:57 32,768 CnsMinEx.dll
2001-08-25 02:52 115 CnsMinEx.ini
2001-08-25 02:51 17,945 CnsMinIO.cab
2001-08-02 17:02 32,768 CnsMinIO.dll
2001-08-24 23:15 40,793 CnsMinUp.cab
C:WINNTDOWNLO~13721 目录下
2001-08-02 17:03 40,960 cnsio.dll
2001-08-24 15:53 102,400 CnsMin.dll
2001-07-06 17:59 213 CnsMin.inf
2001-08-24 15:48 28,672 CnsMinIO.dll
  以上文件全部删除,这样3721网络实名“病毒”就从您的计算机中全部清除了。
  最后,重新启动计算机,进入正常模式。现在已经完全没有3721网络实名的困扰了!

gototop
 

找不到这个目录
gototop
 

命运里の金色 ,我已经按你的方法做了,可是仍然无法删除那流氓软件。
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT