瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 好像也中毒了,请大家帮忙诊断一下

1   1  /  1  页   跳转

好像也中毒了,请大家帮忙诊断一下

好像也中毒了,请大家帮忙诊断一下

最近总会跳出几个不请自来的网站,然后速度也慢了。总会有一些小的广告跳出来,不胜其扰。用hijackthis扫描之后的结果是这样的,可是我看不懂,只好来这里找大家帮忙了。多谢
HijackThis_815汉化版扫描日志 V1.99.1
保存于      22:13:17, 日期 2005-12-21
操作系统:  Windows XP SP2 (WinNT 5.01.2600)
浏览器:    Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程:         
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\csrss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\Ati2evxx.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\system32\svchost.exe
D:\Program Files\kav6\KWatch.EXE
C:\WINDOWS.0\system32\spoolsv.exe
D:\Program Files\kav6\KPfwSvc.EXE
C:\WINDOWS.0\System32\alg.exe
C:\WINDOWS.0\system32\Ati2evxx.exe
C:\WINDOWS.0\Explorer.EXE
C:\WINDOWS.0\system32\Rundll32.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\WINDOWS.0\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
D:\Program Files\kav6\KAVStart.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\WINDOWS.0\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
D:\Program Files\kav6\KavPFW.exe
D:\Program Files\kav6\KMailMon.EXE
D:\Program Files\HijackThis1991汉化版\HijackThis1991zww.exe

O2 - BHO: KOSIE HelperInternet Explorer Web Content Guard  - {1B2F92A1-CDAF-4511-9382-91E3F5CE0880} - C:\Program Files\KOS\KOSIEBar.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\PROGRA~1\FLASHGET\jccatch.dll
O2 - BHO: MacroMediapd - {B8CCDD47-38E4-4CD2-B7FA-3B4B690F74BD} - C:\WINDOWS.0\system32\microapmddt.dll
O3 - IE工具栏增项: 金山毒霸安全助手 - {EF72500A-C234-46C4-BF0A-9AA6913DDF34} - C:\Program Files\KOS\KOSIEBar.dll
O3 - IE工具栏增项: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\fgiebar.dll
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] "C:\WINDOWS.0\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS.0\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS.0\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - 启动项HKLM\\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - 启动项HKLM\\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - 启动项HKLM\\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - 启动项HKLM\\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - 启动项HKLM\\Run: [KavStart] "D:\Program Files\kav6\KAVStart.exe" -startup
O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - 启动项HKLM\\Run: [Windows木马防火墙] D:\Program Files\ftc\Trojanwall.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS.0\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [KavPFW] "D:\Program Files\kav6\KavPFW.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - IE右键菜单中的新增项目: 使用网际快车下载 - D:\PROGRA~1\FLASHGET\jc_link.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链接 - D:\PROGRA~1\FLASHGET\jc_all.htm
O9 - 浏览器额外的按钮: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\flashget.exe
O9 - 浏览器额外的“工具”菜单项: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\flashget.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{4E29BC7A-7EFD-4E88-B9D0-9E608F2FA48F}: NameServer = 211.100.0.58,202.106.196.115
O23 - NT 服务: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS.0\system32\Ati2evxx.exe
O23 - NT 服务: Kingsoft Personal Firewall Service (KPfwSvc) - Kingsoft Corporation - D:\Program Files\kav6\KPfwSvc.EXE
O23 - NT 服务: Kingsoft Antivirus KWatch Service (KWatchSvc) - Kingsoft Corporation - D:\Program Files\kav6\KWatch.EXE
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Unknown owner - D:\Program Files\rising\rav\CCenter.exe (file missing)
O23 - NT 服务: Rising Realtime Monitor Service (RsRavMon) - Unknown owner - D:\Program Files\rising\rav\RavMonD.exe (file missing)


跳出来的两个网站是http://123.sooe.cn
                  http://vtunion.viewtoo.com
最后编辑2005-12-22 07:50:19
分享到:
gototop
 

【回复“海色の月”的帖子】
这么快就有人回复,开心。
这个怎么解决,直接用修复就可以吗?
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT