瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 瑞星已经被屏蔽了安全模式下也不能运行

1   1  /  1  页   跳转

瑞星已经被屏蔽了安全模式下也不能运行

瑞星已经被屏蔽了安全模式下也不能运行

用木马防线查出以下病毒,瑞星已经被屏蔽了安全模式下也不能运行,请高手支招!(在线等ing)
病毒名称如下:
trojan-proxy.win32.daemomiz.da
backdoor.win32.troffer.b
psf-wrom.win32.polipos.a
trojan-propper.win32.agent.adn
not-a-wirus.adware.win32.cash\server.a
not-a-wirus.adware.win32.cash\eztracks.b
backdoor.win32.netbus.21.a
tranjan-spy.win32.banker.cz
backdoor.win32.netshere.130
trojan-psw.win32.netmail.11
我给内网的三台电脑杀毒都有以上的那些病毒!
请各位大侠给我指点迷经!
最后编辑2006-10-18 11:37:03
分享到:
gototop
 

一台pc的
HijackThis_815汉化版扫描日志 V1.99.1
保存于      11:19:34, 日期 2006-10-18
操作系统:  Windows 2000 SP4 (WinNT 5.00.2195)
浏览器:    Internet Explorer v5.00 SP4 (5.00.2920.0000)

当前运行的进程:         
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\NAV\defwatch.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\cba\pds.exe
C:\WINNT\System32\llssrv.exe
C:\WINNT\System32\mnmsrvc.exe
C:\Program Files\NAV\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\tlntsvr.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\WINNT\system32\ams_ii\hndlrsvc.exe
C:\WINNT\system32\MsgSys.EXE
C:\WINNT\system32\ams_ii\iao.exe
C:\WINNT\system32\cba\xfr.exe
C:\WINNT\System32\msdtc.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\Dfssvc.exe
C:\Program Files\SyGate\SHN\sgserv.exe
C:\bxy_vrv\vrvmon.exe
C:\WINNT\system32\Promon.exe
C:\PROGRA~1\NAV\vptray.exe
C:\Program Files\BEYONDSOFT\VirtualDataAccessLink\scktsrvr.exe
C:\Program Files\SyGate\SHN\Sygate.exe
C:\WINNT\system32\internat.exe
C:\WINNT\System32\mdm.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\wuauclt.exe
C:\时迈科技MSN小秘书S8\Robot.exe
C:\Documents and Settings\Administrator\桌面\新建文件夹\新建文件夹\SHSERVER.exe
E:\木马防线2005\gb.exe
C:\WINNT\system32\wuauclt.exe
H:\Hijackthis1991\HijackThis1991zww.exe
C:\WINNT\SoftwareDistribution\Download\65912ba99f8b9ad288b7abb672cfbfc2\update\update.exe

F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O3 - IE工具栏增项: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - IE工具栏增项: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - 启动项HKLM\\Run: [vrvmon] C:\\bxy_vrv\\vrvmon.exe
O4 - 启动项HKLM\\Run: [Promon.exe] Promon.exe
O4 - 启动项HKLM\\Run: [vptray] C:\PROGRA~1\NAV\vptray.exe
O4 - 启动项HKLM\\Run: [xysecond] C:\Bxy_vrv\vrvmon.exe
O4 - 启动项HKLM\\Run: [Borland Socket Server] C:\Program Files\BEYONDSOFT\VirtualDataAccessLink\scktsrvr.exe
O4 - 启动项HKLM\\Run: [SANY DBMS] C:\Documents and Settings\Administrator\桌面\新建文件夹\新建文件夹\SHSERVER.exe
O4 - 启动项HKLM\\Run: [SyGateManager] C:\Program Files\SyGate\SHN\Sygate.exe
O4 - 启动项HKLM\\Run: [信息Robot] C:\时迈科技MSN小秘书S8\Robot.exe
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O8 - IE右键菜单中的新增项目: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - 浏览器额外的按钮: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - 浏览器额外的“工具”菜单项: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - 浏览器额外的按钮: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O17 - HKLM\System\CCS\Services\Tcpip\..\{24B784FC-4608-4C39-9CF0-5AC7C591A326}: NameServer = 202.106.46.151 202.106.0.20
O17 - HKLM\System\CS1\Services\Tcpip\..\{24B784FC-4608-4C39-9CF0-5AC7C591A326}: NameServer = 202.106.46.151 202.106.0.20
O20 - Winlogon Notify: NavLogon - C:\WINNT\system32\NavLogon.dll
O23 - NT 服务: DefWatch - Symantec Corporation - C:\Program Files\NAV\defwatch.exe
O23 - NT 服务: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - NT 服务: Intel Alert Handler - Intel Corporation - C:\WINNT\system32\ams_ii\hndlrsvc.exe
O23 - NT 服务: Intel Alert Originator - Intel Corporation - C:\WINNT\system32\ams_ii\iao.exe
O23 - NT 服务: Intel File Transfer - Intel Corporation - C:\WINNT\system32\cba\xfr.exe
O23 - NT 服务: Intel PDS - Intel Corporation - C:\WINNT\system32\cba\pds.exe
O23 - NT 服务: NMS Service (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - NT 服务: Norton AntiVirus Server - Symantec Corporation - C:\Program Files\NAV\rtvscan.exe
O23 - NT 服务: SyGateService (SaService) - Sygate technologies Inc. - C:\Program Files\SyGate\SHN\sgserv.exe

gototop
 

PC2
HijackThis_815汉化版扫描日志 V1.99.1
保存于      11:14:20, 日期 2006-10-18
操作系统:  Windows XP SP2 (WinNT 5.01.2600)
浏览器:    Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程:         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Rising\Rav\Ravmond.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\TP-LINK\TL-WN310G & TL-WN350G\TWCU.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Administrator\桌面\木马防线2005\gb.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\SoftwareDistribution\Download\Install\Windows-KB890830-V1.21.exe
e:\1ed8f5f9eb7828c5b7abd857198066\mrtstub.exe
C:\WINDOWS\system32\MRT.exe
H:\Hijackthis1991\HijackThis1991zww.exe

R3 - URLSearchHook: SearchCar - {BD328E49-38AB-42CB-8EEA-73AA4CD2A6FD} - C:\Program Files\SearchCar\tbu02721\SearchCar.dll
F2 - REG:system.ini: UserInit=userinit.exe,
O1 - Hosts: 125.91.1.20 localhost
O1 - Hosts: 125.91.1.20 www.7322.com
O1 - Hosts: 125.91.1.20 www.5566.net
O1 - Hosts: 125.91.1.20 www.v111.com
O1 - Hosts: 125.91.1.20 www.gjj.cc
O1 - Hosts: 125.91.1.20 www.hao123.com
O1 - Hosts: 125.91.1.20 hao123.com
O1 - Hosts: 125.91.1.20 www.9991.com
O1 - Hosts: 125.91.1.20 9991.com
O1 - Hosts: 125.91.1.20 www.gjj.cc
O1 - Hosts: 61.162.230.31 www.7939.com
O1 - Hosts: 61.162.230.31 7939.com
O1 - Hosts: 61.162.230.31 59.34.148.98
O1 - Hosts: 61.162.230.31 about:blank
O1 - Hosts: 61.141.31.11 down.Virussky.com
O1 - Hosts: 61.141.31.11 60.191.60.108
O1 - Hosts: 61.141.31.11 219.153.20.209
O1 - Hosts: 61.141.31.11 forum.ikaka.com
O1 - Hosts: 61.141.31.11 bbs.360safe.com
O1 - Hosts: 61.141.31.11 www.360safe.com
O1 - Hosts: 61.141.31.11 www.piaoxue.com
O1 - Hosts: 61.141.31.11 61.129.58.12
O1 - Hosts: 61.141.31.11 forum.jiangmin.com
O1 - Hosts: 61.141.31.11 luosoft.com
O1 - Hosts: 125.91.1.20 post.baidu.com
O1 - Hosts: 61.141.31.11 60.191.60.107
O1 - Hosts: 61.141.31.11 219.139.58.97
O1 - Hosts: 61.141.31.11 59.34.148.81
O1 - Hosts: 125.91.1.20 60.191.60.114
O1 - Hosts: 125.91.1.20 www.ycdy.com
O1 - Hosts: 61.141.31.11 cn.zs.yahoo.com
O1 - Hosts: 61.141.31.11 www.znmq.com
O1 - Hosts: 61.141.31.11 www.btbbt.com
O1 - Hosts: 61.141.31.11 bbs.btbbt.com
O1 - Hosts: 125.91.1.20 auto.search.msn.com
O1 - Hosts: 125.91.1.20 www.pcav.cn
O1 - Hosts: 125.91.1.20 www.cnhx.com.cn
O1 - Hosts: 125.91.1.20 btbaicai.com
O1 - Hosts: 125.91.1.20 www.btbaicai.com
O1 - Hosts: 125.91.1.20 219.239.102.77
O1 - Hosts: 61.141.31.11 hz.mop-hz.com
O1 - Hosts: 61.141.31.11 www.jacai.com
O1 - Hosts: 61.141.31.11 www.gao58.com
O1 - Hosts: 61.141.31.11 www.ok538.com
O1 - Hosts: 61.141.31.11 www.3000sss.com
O1 - Hosts: 61.141.31.11 www.qq658.com
O1 - Hosts: 61.141.31.11 www.53679.com
O1 - Hosts: 61.141.31.11 www.17587.net
O2 - BHO: IEMonitor Class - {08A312BB-5409-49FC-9347-54BB7D069AC6} - C:\Program Files\DeskAdTop\deskipn.dll
O2 - BHO: XBTP03129 - {71E000D6-C63D-4d95-85A0-76DF890982A3} - C:\PROGRA~1\SEARCH~1\tbu02721\SEARCH~1.DLL
O2 - BHO: conimehlp Class - {B10343BD-1DC6-442F-9BA2-D44C708CEE83} - C:\WINDOWS\system32\mskey32.dll (file missing)
O3 - IE工具栏增项: SearchCar - {BD328E49-38AB-42CB-8EEA-73AA4CD2A6FD} - C:\Program Files\SearchCar\tbu02721\SearchCar.dll
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - 启动项HKLM\\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - 启动项HKLM\\Run: [SoundMan] SOUNDMAN.EXE
O4 - 启动项HKLM\\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - 启动项HKLM\\Run: [ACU] "C:\Program Files\TP-LINK\TL-WN310G & TL-WN350G\TWCU.exe" -nogui
O4 - 启动项HKLM\\Run: [wdfmgr32] C:\WINDOWS\system32\wdfmgr32.exe
O4 - 启动项HKLM\\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [Desktop] C:\WINDOWS\system32\rundll32.exe "C:\Program Files\DeskAdTop\Run.dll" ,Rundll
O4 - 启动项HKLM\\Run: [run] C:\WINDOWS\system32\rundll32.exe rsrc.dll s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - IE右键菜单中的新增项目: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - 浏览器额外的按钮: 酷标 - {1D901067-2529-4A9B-9B6B-7A1DB3A44CB5} - C:\Program Files\coolsign\coolsign.dll
O9 - 浏览器额外的按钮: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - 浏览器额外的按钮: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - 浏览器额外的“工具”菜单项: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{FFB39679-2E88-47AD-9296-271F4941521A}: NameServer = 202.106.0.202,202.106.46.151
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O21 - SSODL: CDBurner - {D92D637A-0FB7-412D-A7E8-29340A580F7E} - C:\WINDOWS\Downloaded Program Files\jaasnt.dll (file missing)
O23 - NT 服务: 6389D0B6 - Unknown owner - C:\WINDOWS\system32\6389D0B6.EXE (file missing)
O23 - NT 服务: TP-LINK配置服务程序 (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - NT 服务: Network Logon (NetWorkLogon) - Unknown owner - rundll32.exe (file missing)
O23 - NT 服务: ODBINJRLMGMA - Unknown owner - C:\WINDOWS\system32\ODBINJRLMGMA.EXE (file missing)
O23 - NT 服务: PopWinIe - Unknown owner - C:\WINDOWS\system32\PopWin.exe (file missing)
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT