高手们~帮帮忙看日志 bbs.ikaka.com

drmaomao - 2005-8-6 10:33:00

Logfile of HijackThis v1.99.1
Scan saved at 10:13:08, on 2005-08-06
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\SCARDSVR.EXE
C:\PROGRAM FILES\KV2005\KVSRVXP.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\RISING\RFW\RFW.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\SYSTEM\SAFESIGNCERTREG.EXE
C:\WINDOWS\SYSTEM\NTDHCP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\反浏览器劫持\HIJACKTHIS.EXE
C:\WINDOWS\NOTEPAD.EXE

R3 - Default URLSearchHook is missing
O2 - BHO: BrowseHelper Class - {80BF4637-D65B-43F3-BB60-C5DD3D5FB7B9} - C:\PROGRAM FILES\KV2005\KVSHELL.DLL
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\SYSTEM\XUNLEIBHO_V5.DLL
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: 江民杀毒工具栏 - {B5A34A93-D538-43A7-8371-864CB6148D12} - C:\PROGRAM FILES\KV2005\KVSHELL.DLL
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [rfw] C:\Program Files\rising\Rfw\Rfw.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [CertificateRegistration] SafeSignCertReg.exe
O4 - HKLM\..\Run: [ExFilter] Rundll32.exe "C:\PROGRAM FILES\CNNIC\CDN\cdnspie.dll,ExecFilter solo"
O4 - HKLM\..\Run: [Eps_Reg.exe] C:\WINDOWS\TEMP\EPS_REG.EXE /NStarKey100_CMB
O4 - HKLM\..\Run: [NTdhcp] C:\WINDOWS\SYSTEM\NTdhcp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\RunServices: [SCardSvr] C:\WINDOWS\SYSTEM\SCardSvr.exe
O4 - HKLM\..\RunServices: [KVSrvXP] C:\PROGRA~1\KV2005\KVSRVXP.EXE -Service
O8 - Extra context menu item: !搜一搜(&S) - res://C:\PROGRAM FILES\YISOU\YISOU.DLL/232
O8 - Extra context menu item: 添加到QQ自定义面板 - E:\Program Files\腾讯QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - E:\Program Files\腾讯QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - E:\Program Files\腾讯QQ\SendMMS.htm
O8 - Extra context menu item: 解霸实时播放 - E:\Program Files\豪杰超级解霸 3000 英雄版\MPURLGET.HTM
O8 - Extra context menu item: &使用迅雷下载 - D:\PROGRAM FILES\SANDAI TECHNOLOGIES INC\THUNDER\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - D:\PROGRAM FILES\SANDAI TECHNOLOGIES INC\THUNDER\getAllurl.htm
O8 - Extra context menu item: 睰QQ﹚竡狾 - E:\Program Files\腾讯QQ\AddPanel.htm
O8 - Extra context menu item: 睰QQ薄 - E:\Program Files\腾讯QQ\AddEmotion.htm
O8 - Extra context menu item: ノQQ眒獺祇癳赣瓜 - E:\Program Files\腾讯QQ\SendMMS.htm
O8 - Extra context menu item: 添加到QQ自定義面版 - E:\PROGRAM FILES\腾讯QQ\AddPanel.htm
O8 - Extra context menu item: 用QQ彩信傳送該圖片 - E:\PROGRAM FILES\腾讯QQ\SendMMS.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - E:\Program Files\腾讯QQ\QQ.EXE (file missing)
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - E:\Program Files\腾讯QQ\QQ.EXE (file missing)
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - E:\Program Files\ICQ\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - E:\Program Files\ICQ\ICQLite\ICQLite.exe
O10 - Unknown file in Winsock LSP: c:\windows\system\kvwspxp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\kvwspxp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\kvwspxp.dll
O16 - DPF: {DC0D755B-EA1F-4E85-B7F7-B2E3A4AEB918} (VC2MyEdit Class) - https://www.sz2.cmbchina.com/download/cmbsafebase.cab
O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} (Edit Class) - https://www.sz1.cmbchina.com/download/CMBEdit.cab
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/Ver2005/OL2005.cab
O18 - Protocol: ndwiat - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\SYSTEM\WIASCR.DLL
O18 - Protocol: http - {79EAC9E2-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\SYSTEM\urlmon.dll
O18 - Protocol: ftp - {79EAC9E3-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\SYSTEM\urlmon.dll
O18 - Protocol: gopher - {79EAC9E4-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\SYSTEM\urlmon.dll
O18 - Protocol: https - {79EAC9E5-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\SYSTEM\urlmon.dll
O18 - Protocol: mk - {79EAC9E6-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\SYSTEM\urlmon.dll
O18 - Protocol: file - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\SYSTEM\urlmon.dll
O18 - Protocol: local - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\SYSTEM\urlmon.dll
O18 - Protocol: cdl - {3DD53D40-7B8B-11D0-B013-00AA0059CE02} - C:\WINDOWS\SYSTEM\urlmon.dll
O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\SYSTEM\MSHTML.DLL
O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\SYSTEM\MSHTML.DLL
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\SYSTEM\MSHTML.DLL
O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\SYSTEM\MSHTML.DLL
O18 - Protocol: mailto - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\SYSTEM\MSHTML.DLL
O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\SYSTEM\MSHTML.DLL
O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\SYSTEM\ITSS.DLL
O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\SYSTEM\ITSS.DLL
O18 - Protocol: msdaipp - (no CLSID) - (no file)
O18 - Protocol: mhtml - {05300401-BCBC-11D0-85E3-00C04FD85AB4} - C:\WINDOWS\SYSTEM\INETCOMM.DLL
O18 - Protocol: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINDOWS\SYSTEM\MSDXM.OCX

drmaomao - 2005-8-6 11:16:00

引用:

【花落花又开的贴子】【回复“drmaomao”的帖子】

您好,请修复(如果您清楚某项请不必修复它):

R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [NTdhcp] C:\WINDOWS\SYSTEM\NTdhcp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\RunServices: [SCardSvr] C:\WINDOWS\SYSTEM\SCardSvr.exe

删除文件:

C:\WINDOWS\SYSTEM\NTdhcp.exe

C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime

C:\WINDOWS\SYSTEM\SCardSvr.exe

...........................

以下修复后再扫描过的日志，能再看看有什么问题吗？谢谢！
Logfile of HijackThis v1.99.1
Scan saved at 11:08:03, on 2005-08-06
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\KV2005\KVSRVXP.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\RISING\RFW\RFW.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\反浏览器劫持\HIJACKTHIS.EXE

O2 - BHO: BrowseHelper Class - {80BF4637-D65B-43F3-BB60-C5DD3D5FB7B9} - C:\PROGRAM FILES\KV2005\KVSHELL.DLL
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\SYSTEM\XUNLEIBHO_V5.DLL
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: 江民杀毒工具栏 - {B5A34A93-D538-43A7-8371-864CB6148D12} - C:\PROGRAM FILES\KV2005\KVSHELL.DLL
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [rfw] C:\Program Files\rising\Rfw\Rfw.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [CertificateRegistration] SafeSignCertReg.exe
O4 - HKLM\..\Run: [ExFilter] Rundll32.exe "C:\PROGRAM FILES\CNNIC\CDN\cdnspie.dll,ExecFilter solo"
O4 - HKLM\..\Run: [Eps_Reg.exe] C:\WINDOWS\TEMP\EPS_REG.EXE /NStarKey100_CMB
O4 - HKLM\..\RunServices: [KVSrvXP] C:\PROGRA~1\KV2005\KVSRVXP.EXE -Service
O8 - Extra context menu item: !搜一搜(&S) - res://C:\PROGRAM FILES\YISOU\YISOU.DLL/232
O8 - Extra context menu item: 添加到QQ自定义面板 - E:\Program Files\腾讯QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - E:\Program Files\腾讯QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - E:\Program Files\腾讯QQ\SendMMS.htm
O8 - Extra context menu item: 解霸实时播放 - E:\Program Files\豪杰超级解霸 3000 英雄版\MPURLGET.HTM
O8 - Extra context menu item: &使用迅雷下载 - D:\PROGRAM FILES\SANDAI TECHNOLOGIES INC\THUNDER\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - D:\PROGRAM FILES\SANDAI TECHNOLOGIES INC\THUNDER\getAllurl.htm
O8 - Extra context menu item: 睰QQ﹚竡狾 - E:\Program Files\腾讯QQ\AddPanel.htm
O8 - Extra context menu item: 睰QQ薄 - E:\Program Files\腾讯QQ\AddEmotion.htm
O8 - Extra context menu item: ノQQ眒獺祇癳赣瓜 - E:\Program Files\腾讯QQ\SendMMS.htm
O8 - Extra context menu item: 添加到QQ自定義面版 - E:\PROGRAM FILES\腾讯QQ\AddPanel.htm
O8 - Extra context menu item: 用QQ彩信傳送該圖片 - E:\PROGRAM FILES\腾讯QQ\SendMMS.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - E:\Program Files\腾讯QQ\QQ.EXE (file missing)
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - E:\Program Files\腾讯QQ\QQ.EXE (file missing)
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - E:\Program Files\ICQ\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - E:\Program Files\ICQ\ICQLite\ICQLite.exe
O10 - Unknown file in Winsock LSP: c:\windows\system\kvwspxp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\kvwspxp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\kvwspxp.dll
O16 - DPF: {DC0D755B-EA1F-4E85-B7F7-B2E3A4AEB918} (VC2MyEdit Class) - https://www.sz2.cmbchina.com/download/cmbsafebase.cab
O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} (Edit Class) - https://www.sz1.cmbchina.com/download/CMBEdit.cab
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/Ver2005/OL2005.cab

瑞星卡卡安全论坛