| 引用: |
| 【大Bowl的贴子】我中了个backdoor.agobot.aae的病毒，一开机就弹出2个cmd.exe的框框出来，然后防火墙就说有木马，已经清除了，之后用瑞星杀怎样都杀不死，安全模式也试过了，还是不行，而且一上网米几分钟就说什么“系统将重新启动，这是由于RPC服务意外终止引起的”，我中病毒之前不会这样的，子阳的方法用了也不行， 我到底该怎么办？？？各位高手指点一下吧！我是WIN XP SP1的， 我的日志如下： Logfile of HijackThis v1.99.1 Scan saved at 16:16:44, on 2005-8-7 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe E:\PROGRAM FILES\RISING\RAV\Ravmond.exe C:\WINDOWS\Explorer.EXE e:\program files\rising\rfw\rfwsrv.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\conime.exe E:\PROGRA~1\RISING\RAV\RAVTIMER.EXE E:\PROGRA~1\RISING\RAV\RAVMON.EXE E:\Program Files\Ringz Studio\Storm Downloader\StormDownloader.exe C:\WINDOWS\SOUNDMAN.EXE e:\program files\rising\rfw\RfwMain.exe C:\WINDOWS\System32\lssas.exe C:\WINDOWS\System32\ctfmon.exe E:\Program Files\Ringz Studio\Storm Downloader\TDUpdate.exe C:\WINDOWS\system32\notepad.exe E:\PROGRAM FILES\RISING\RAV\CCENTER.EXE C:\Program Files\WinRAR\WinRAR.exe C:\DOCUME~1\OYZ\LOCALS~1\Temp\Rar$EX00.109\HijackThis.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [RavTimer] E:\PROGRA~1\RISING\RAV\RAVTIMER.EXE O4 - HKLM\..\Run: [RavMon] E:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM O4 - HKLM\..\Run: [StormCodec_Helper] "e:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti O4 - HKLM\..\Run: [MINI_BFYY] E:\Program Files\Ringz Studio\Storm Downloader\StormDownloader.exe O4 - HKLM\..\Run: [RfwMain] "e:\Program Files\Rising\Rfw\rfwmain.exe" -Startup O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINDOWS\System32\lssas.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - Startup: 腾讯QQ.lnk = E:\Program Files\Tencent\QQ\QQ.exe O8 - Extra context menu item: &使用暴风下载器下载 - E:\Program Files\Ringz Studio\Storm Downloader\geturl.htm O8 - Extra context menu item: &使用迅雷下载 - E:\Program Files\Thunder\geturl.htm O8 - Extra context menu item: &使用迅雷下载全部链接 - E:\Program Files\Thunder\getAllurl.htm O8 - Extra context menu item: 添加到QQ自定义面板 - e:\Program Files\Tencent\QQ\AddPanel.htm O8 - Extra context menu item: 添加到QQ表情 - e:\Program Files\Tencent\QQ\AddEmotion.htm O8 - Extra context menu item: 用QQ彩信发送该图片 - e:\Program Files\Tencent\QQ\SendMMS.htm O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra ''Tools'' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - e:\Program Files\Tencent\QQ\QQ.EXE O9 - Extra ''Tools'' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - e:\Program Files\Tencent\QQ\QQ.EXE O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - e:\Program Files\Tencent\QQ\QQIEHelper.dll O9 - Extra ''Tools'' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - e:\Program Files\Tencent\QQ\QQIEHelper.dll O9 - Extra button: 易趣购物 - {EE60714F-AC19-427e-861A-FD60ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=1 (file missing) O9 - Extra ''Tools'' menuitem: 易趣购物 - {EE60714F-AC19-427e-861A-FD60ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=1 (file missing) O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan ) - http://download.rising.com.cn/register/pcver/autoupgradepad/Ver2005/OL2005.cab O23 - Service: Net Functions Monitoring (Netmon) - Unknown owner - C:\WINDOWS\system32\lll.exe (file missing) O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - e:\program files\rising\rfw\rfwsrv.exe O23 - Service: Rising Process Communication Center (RsCCenter) - rising - E:\PROGRAM FILES\RISING\RAV\CCENTER.EXE O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - E:\PROGRAM FILES\RISING\RAV\Ravmond.exe ........................... |