瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 【求助】电脑总是在线时自动重登陆,扫描个日志请高手赐教!

1   1  /  1  页   跳转

【求助】电脑总是在线时自动重登陆,扫描个日志请高手赐教!

【求助】电脑总是在线时自动重登陆,扫描个日志请高手赐教!


    我的电脑总是在线时自动重登陆,这种情况会随机出现,尤其是晚上时居多,有一次竟然被远程用admin用户登陆并提示计算机已被锁定,我用木马杀客和瑞星(18.16.40)扫描都没有木马和病毒,请高手赐教是怎么回事,谢谢!
    以下是扫描日志:
Logfile of HijackThis v1.99.0
Scan saved at 0:51:32, on 2006-3-3
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
d:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
d:\Program Files\Rising\Rav\Ravmond.exe
d:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
d:\Program Files\Rising\Rav\RavStub.exe
C:\WINDOWS\system32\crypserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\Rising\Rav\RavTask.exe
D:\Program Files\Rising\Rfw\rfwmain.exe
C:\Program Files\DuDu\DddClient\DuDuAcc.exe
C:\Program Files\DuDu\DddClient\dudupros.exe
D:\Program Files\Rising\Rav\Ravmon.exe
D:\下载\木马专杀\HijackThis\HijackThis.exe

O2 - BHO: ThunderIEHelper - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v13.dll
O2 - BHO: IDDTInitObj Class - {15DDE989-CD45-4561-BF99-D22C0D5C2B74} - C:\PROGRA~1\Sina\ddt\DDTInit.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - c:\Program Files\Tencent\珊瑚虫QQ\QQIEHelper.dll
O2 - BHO: KillObj Class - {66C28884-4E5D-494B-80C9-CAA27528FD6D} - C:\PROGRA~1\Sina\ddt\ddtkillw.ocx (file missing)
O2 - BHO: DuDu.com - {6BDE1669-B490-48E3-B668-456314F2D6C3} - C:\Program Files\DuDu\DddClient\dddiemon.dll
O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - C:\PROGRA~1\baidu\bar\baidubar.dll
O3 - Toolbar: 新浪点点通 - {F60C7D81-8471-4D40-AAFE-56D318F34C2D} - C:\PROGRA~1\Sina\ddt\DDTONG~1.DLL
O3 - Toolbar: 百度超级搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\PROGRA~1\baidu\bar\baidubar.dll
O3 - Toolbar: 电鹰工具栏 - {1BC0B497-3010-43BF-AD78-5858A70907A2} - C:\Program Files\100ai佰爱经典QQ表情\cj\dyToolBar-100ai1\dyToolBar-100ai\dyToolBand.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RavTask] "d:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [RfwMain] "d:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - Global Startup: DuDu下载加速器.lnk = C:\Program Files\DuDu\DddClient\DuDuAcc.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &使用DuDu 加速器下载 - res://C:\Program Files\DuDu\DddClient\dddmext.dll/202
O8 - Extra context menu item: &使用DuDu 加速器下载全部链接 - res://C:\Program Files\DuDu\DddClient\dddmext.dll/203
O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\getallurl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\Tencent\qq\AddToNetDisk.htm
O8 - Extra context menu item: 使用影音传送带下载 - C:\Program Files\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: 使用影音传送带下载全部链接 - C:\Program Files\Xi\NetTransport 2\NTAddList.html
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\qq\SendMMS.htm
O8 - Extra context menu item: 用比特精灵下载(&B) - C:\Program Files\BitSpirit\bsurl.htm
O9 - Extra button: 微软 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.microsoft.com/china/index.htm (file missing)
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - c:\Program Files\Tencent\珊瑚虫QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - c:\Program Files\Tencent\珊瑚虫QQ\QQIEHelper.dll
O9 - Extra button: 新浪点点通 - {F60C7D81-8471-4D40-AAFE-56D318F34C2D} - C:\PROGRA~1\Sina\ddt\DDTONG~1.DLL
O9 - Extra button: (no name) - {974AD624-EA50-4831-A6C0-3040F6665396} - C:\PROGRA~1\Sina\ddt\rssband.dll (HKCU)
O9 - Extra 'Tools' menuitem: 新浪点点通阅读器 - {974AD624-EA50-4831-A6C0-3040F6665396} - C:\PROGRA~1\Sina\ddt\rssband.dll (HKCU)
O9 - Extra button: 新浪点点通阅读器 - {F0646DC8-58CD-4C64-8F6B-525043914685} - C:\PROGRA~1\Sina\ddt\rssband.dll (HKCU)
O10 - Broken Internet access because of LSP provider 'c:\windows\system32\cdnns.dll' missing
O15 - Trusted Zone: http://www.icbc.com.cn
O16 - DPF: {9A578C98-3C2F-4630-890B-FC04196EF420} - http://jump.cnnic.cn/stat/stat?sid=0008&debug=false&pid=c_hbcnc&url=http://client.jogo.cn/download/cnnic/cdn.cab
O16 - DPF: {E787FD25-8D7C-4693-AE67-9406BC6E22DF} (CPasswordEditCtrl Object) - https://www.tenpay.com/download/qqedit.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2F9BFE5C-9C24-40B9-90E1-360ECD244805}: NameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{92281E44-BB71-435D-B2DD-765C2098A121}: NameServer = 202.99.166.4 202.99.160.68
O17 - HKLM\System\CS1\Services\Tcpip\..\{2F9BFE5C-9C24-40B9-90E1-360ECD244805}: NameServer = 192.168.0.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{2F9BFE5C-9C24-40B9-90E1-360ECD244805}: NameServer = 192.168.0.1
O17 - HKLM\System\CS3\Services\Tcpip\..\{2F9BFE5C-9C24-40B9-90E1-360ECD244805}: NameServer = 192.168.0.1
O17 - HKLM\System\CS4\Services\Tcpip\..\{2F9BFE5C-9C24-40B9-90E1-360ECD244805}: NameServer = 192.168.0.1
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Crypkey License - Unknown - crypserv.exe (file missing)
O23 - Service: Rising Proxy  Service - Beijing Rising Technology Co., Ltd. - d:\program files\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service - Beijing Rising Technology Co., Ltd. - d:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center - Beijing Rising Technology Co., Ltd. - d:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service - Beijing Rising Technology Co., Ltd. - d:\Program Files\Rising\Rav\Ravmond.exe

最后编辑2006-03-03 10:57:39
分享到:
gototop
 

【回复“不言放弃”的帖子】
感谢楼主的不吝赐教,可是我还是有问题,我打开您推荐的lsp-fix工具,可是我日志里的010项中的cdnns.dll已经在remove项里面,请问我该如何操作?
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT