瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 Trojan.Win32.Undef.bh 和Trojan.Win32.Undef.aca总杀不掉怎么办?

1   1  /  1  页   跳转

Trojan.Win32.Undef.bh 和Trojan.Win32.Undef.aca总杀不掉怎么办?

Trojan.Win32.Undef.bh 和Trojan.Win32.Undef.aca总杀不掉怎么办?

用瑞星查出Trojan.Win32.Undef.bh 和Trojan.Win32.Undef.aca病毒
查杀结果:删除成功
但重启后又出现了。。。老杀不掉,请高手帮忙看下,不甚感激!


用hijackthis扫了下:

HijackThis_zww汉化版扫描日志 V1.99.1
保存于      23:09:16, 日期 2007-12-15
操作系统:  Windows XP  (WinNT 5.01.2600)
浏览器:    Internet Explorer v6.00 SP1 (6.00.2600.0000)

当前运行的进程:         
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\csrss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Rising\Rav\CCenter.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\logonui.exe
D:\WINDOWS\System32\svchost.exe
D:\PROGRAM FILES\RISING\RAV\Ravmond.exe
d:\program files\rising\rfw\rfwsrv.exe
D:\WINDOWS\Explorer.EXE
d:\program files\rising\rfw\rfwproxy.exe
d:\program files\rising\rfw\rfwstub.exe
D:\PROGRAM FILES\RISING\RAV\RavStub.exe
d:\program files\rising\rfw\RfwMain.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Analog Devices\SoundMAX\SMTray.exe
D:\Program Files\Rising\Rav\RavTask.exe
D:\WINDOWS\System32\ctfmon.exe
D:\WINDOWS\VM_STI.EXE
D:\Program Files\Rising\Rav\Ravmon.exe



[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;  Embedded Web Browser from: http://bsalsa.com/)
最后编辑2007-12-17 13:34:12
分享到:
gototop
 

D:\WINDOWS\System32\alg.exe
D:\WINDOWS\System32\inf\svchost.exe
D:\WINDOWS\System32\conime.exe
D:\program files\internet explorer\iexplore.exe
D:\WINDOWS\System32\nvsvc32.exe
D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\wuauclt.exe
E:\下载\杀毒\hijackthis\HijackThis1991zww.exe

O2 - BHO: Thunder AtOnce - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - D:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - D:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll
O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [IMSCMig] D:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - 启动项HKLM\\Run: [nwiz] nwiz.exe /install
O4 - 启动项HKLM\\Run: [runeip] "D:\Program Files\Rising\AntiSpyware\runiep.exe" /startup
O4 - 启动项HKLM\\Run: [Smapp] D:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - 启动项HKLM\\Run: [UESTC考研倒计时] D:\Documents and Settings\Administrator.B-WUG40PJ2PJ3Z7\桌面\UESTC考研倒计时.exe
O4 - 启动项HKLM\\Run: [StormCodec_Helper] "E:\Storm Codec\StormSet.exe" /S /opti
O4 - 启动项HKLM\\Run: [RavTask] "D:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [RfwMain] "D:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe
O4 - Startup: QQ游戏启动加速程序.lnk = D:\Program Files\Tencent\QQGame\Accel.exe
O4 - Global Startup: office.lnk = D:\WINDOWS\system\sslxpes071212.exe
O8 - IE右键菜单中的新增项目: 使用迅雷下载 - D:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm

gototop
 

O8 - IE右键菜单中的新增项目: 使用迅雷下载全部链接 - D:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O9 - 浏览器额外的按钮: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - D:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - 浏览器额外的“工具”菜单项: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - D:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - 浏览器额外的按钮: TOL24 - {345ff7d8-2364-4ef7-889b-7d3c1d0bd342} - http://www.TOL24.com (file missing)
O9 - 浏览器额外的按钮: 解霸 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - D:\Program Files\herosoft\MPLAYER.EXE
O9 - 浏览器额外的“工具”菜单项: 超级解霸 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - D:\Program Files\herosoft\MPLAYER.EXE
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\web\related.htm
O15 - “受信任的站点”中添加项: http://ad.32666.com
O15 - “受信任的站点”中添加项: http://www.32666.com
O15 - “受信任的站点”中添加项: http://www.4570658.com
O15 - “受信任的站点”中添加项: http://jm.97779.com
O15 - “受信任的站点”中添加项: http://u.vlog365.com
O15 - “受信任的站点”中添加项: http://www.ycdy.com
gototop
 

O16 - DPF: {11010101-1001-1111-1000-110112345678} - ms-its:mhtml:file://C: oo.mht!http://www.toyssex.net/web.chm::/win32.exe
O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab
O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab
O16 - DPF: {33331111-1111-1111-1111-622221193458} - file://c:\ex.cab
O16 - DPF: {3D8F74EE-8692-4F8F-B8D2-7522E732519E} (WebActivater Control) - http://game.qq.com/QQGame2.cab
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (EditCtrl Class) - https://img.alipay.com/download/1101/aliedit.cab
O16 - DPF: {5DD731E6-D4F0-11D3-BE3F-00105A6FDA50} (V3ProX Control) - http://origin-www.ahn.com.cn/aspservice/plugin/myv3.cab
O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O16 - DPF: {7260569F-1D40-4E7F-B95B-2E68D35668B9} (MofileUploadX Control) - http://file.mofile.com/activex/MoUpload.ocx
O16 - DPF: {ACFE8232-03C5-4AEC-AF5E-42B806724096} (KSHScan Control) - http://safe.qq.com/scan/KAllScan.CAB
O16 - DPF: {C09B522F-8AED-4E21-A65C-DC1AB652BAEE} (Tencent Safety Online Base Module) - http://safe.qq.com/cgi-bin/tso/TSOBase.ocx
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/pcver2006new/OL2006.cab
O16 - DPF: {E787FD25-8D7C-4693-AE67-9406BC6E22DF} (PasswordEditCtrl Class) - https://password.qq.com/download/qqedit.cab
O16 - DPF: {FC1DF328-F720-4FD3-98A4-2595A7356D7F} (QQ声色通(&Q)) - http://219.133.38.112/toolbar/qq_sst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{84F19E35-69DE-44C3-A6EB-559A6E61B725}: NameServer = 202.101.98.55,202.101.98.54
O17 - HKLM\System\CCS\Services\Tcpip\..\{EADB90A8-22C7-452E-8C1A-6607786AD4BC}: NameServer = 202.101.98.54,202.101.98.55
O23 - NT 服务: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe
gototop
 

O23 - NT 服务: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - d:\program files\rising\rfw\rfwproxy.exe
O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - d:\program files\rising\rfw\rfwsrv.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\Program Files\Rising\Rav\CCenter.exe
O23 - NT 服务: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\PROGRAM FILES\RISING\RAV\Ravmond.exe
O23 - NT 服务: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
gototop
 

优化大师查了,可疑程序D:\windows\system32\Mbprot.dll 不知道是不是病毒
卡卡查出启动项中添加了office.lnk,但是删了后重启又出现了
我该怎么办啊?
gototop
 

谢谢“美丽无敌 ”,问题已经解决!
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT