瑞星卡卡安全论坛

Trojan.PSW.LMir.hzt怎么杀杀也杀不掉呀！！！！！！请各位高手指点！！

我用的是最新的瑞星17.41.20杀的，然后手工重新启动后再杀还是有病毒！（不能在开始栏中启动了）。在安全模式下找到病毒文件删除后，再打开windows还是有！怎么办呀？希望大家多多帮助！我这里多谢了！

扫描一个HJ日志

Logfile of HijackThis v1.99.1
Scan saved at 14:47:29, on 2005-8-24
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
C:\PROGRAM FILES\RISING\RAV\RavStub.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\system32\rundll32.exe
D:\Herosoft\HeroV8\SYSEXPLR.EXE
C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
C:\PROGRA~1\RISING\RAV\RAVMON.EXE
C:\Program Files\切换控制程序\netctl.exe
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Rising\Rav\RsAgent.exe
C:\WINDOWS\msagent\AgentSvr.exe
D:\hijackthis\HijackThis.exe

O1 - Hosts: 218.85.139.121 www.zhao123.com
O1 - Hosts: 218.85.139.121 zhao123.com
O1 - Hosts: 218.85.139.121 www.4399.com
O1 - Hosts: 218.85.139.121 4399.com
O1 - Hosts: 218.85.139.121 www.chinagames.net
O1 - Hosts: 218.85.139.121 chinagames.net
O1 - Hosts: 218.85.139.121 www.tiexue.net
O1 - Hosts: 218.85.139.121 tiexue.net
O1 - Hosts: 218.85.139.121 www.qq163.com
O1 - Hosts: 218.85.139.121 qq163.com
O1 - Hosts: 218.85.139.121 www.flashmi.net
O1 - Hosts: 218.85.139.121 flashmi.net
O1 - Hosts: 218.85.139.121 www.chinamp3.com
O1 - Hosts: 218.85.139.121 chinamp3.com
O1 - Hosts: 218.85.139.121 www.pg168.com
O1 - Hosts: 218.85.139.121 pg168.com
O1 - Hosts: 218.85.139.121 www.yymp3.com
O1 - Hosts: 218.85.139.121 yymp3.com
O1 - Hosts: 218.85.139.121 www.yy138.com
O1 - Hosts: 218.85.139.121 yy138.com
O1 - Hosts: 218.85.139.121 www.dj99.com
O1 - Hosts: 218.85.139.121 dj99.com
O1 - Hosts: 218.85.139.121 www.sogua.com
O1 - Hosts: 218.85.139.121 sogua.com
O1 - Hosts: 218.85.139.121 www.snsn.net
O1 - Hosts: 218.85.139.121 snsn.net
O1 - Hosts: 218.85.139.121 www.flash8.net
O1 - Hosts: 218.85.139.121 flash8.net
O1 - Hosts: 218.85.139.121 www.mop.com
O1 - Hosts: 218.85.139.121 mop.com
O1 - Hosts: 218.85.139.121 www.tianyaclub.com
O1 - Hosts: 218.85.139.121 tianyaclub.com
O1 - Hosts: 218.85.139.121 www.xici.net
O1 - Hosts: 218.85.139.121 xici.net
O1 - Hosts: 218.85.139.121 www.ucanlove.com
O1 - Hosts: 218.85.139.121 ucanlove.com
O1 - Hosts: 218.85.139.121 www.cmfu.com
O1 - Hosts: 218.85.139.121 cmfu.com
O1 - Hosts: 218.85.139.121 www.21red.net
O1 - Hosts: 218.85.139.121 21red.net
O1 - Hosts: 218.85.139.121 www.pconline.com.cn
O1 - Hosts: 218.85.139.121 pconline.com.cn
O1 - Hosts: 218.85.139.121 www.donews.com
O1 - Hosts: 218.85.139.121 donews.com
O1 - Hosts: 218.85.139.121 www.pcauto.com.cn
O1 - Hosts: 218.85.139.121 pcauto.com.cn
O1 - Hosts: 218.85.139.121 www.265.com
O1 - Hosts: 218.85.139.121 265.com
O1 - Hosts: 218.85.139.121 www.wo99.com
O1 - Hosts: 218.85.139.121 wo99.com
O1 - Hosts: 218.85.139.121 www.familydoctor.com.cn
O1 - Hosts: 218.85.139.121 familydoctor.com.cn
O1 - Hosts: 218.85.139.121 www.flashempire.com
O1 - Hosts: 218.85.139.121 flashempire.com
O1 - Hosts: 218.85.139.121 www.showgood.tv
O1 - Hosts: 218.85.139.121 showgood.tv
O1 - Hosts: 218.85.139.121 www.flashfan.net
O1 - Hosts: 218.85.139.121 flashfan.net
O1 - Hosts: 218.85.139.121 www.long21.net
O1 - Hosts: 218.85.139.121 long21.net
O1 - Hosts: 218.85.139.121 www.sowww.com
O1 - Hosts: 218.85.139.121 sowww.com
O1 - Hosts: 218.85.139.121 www.flashhome.net
O1 - Hosts: 218.85.139.121 flashhome.net
O1 - Hosts: 218.85.139.121 www.cnflash.net
O1 - Hosts: 218.85.139.121 cnflash.net
O1 - Hosts: 218.85.139.121 www.flashsky.com
O1 - Hosts: 218.85.139.121 flashsky.com
O1 - Hosts: 218.85.139.121 www.hunansky.com
O1 - Hosts: 218.85.139.121 hunansky.com
O1 - Hosts: 218.85.139.121 www.52flash.net
O1 - Hosts: 218.85.139.121 52flash.net
O1 - Hosts: 218.85.139.121 www.flashh.com
O1 - Hosts: 218.85.139.121 flashh.com
O1 - Hosts: 218.85.139.121 www.flashsun.com
O1 - Hosts: 218.85.139.121 flashsun.com
O1 - Hosts: 218.85.139.121 www.7k7k.com
O1 - Hosts: 218.85.139.121 7k7k.com
O1 - Hosts: 218.85.139.121 www.xuanxuan.com
O1 - Hosts: 218.85.139.121 xuanxuan.com
O1 - Hosts: 218.85.139.121 www.flash88.net
O1 - Hosts: 218.85.139.121 flash88.net
O1 - Hosts: 218.85.139.121 www.91flash.com
O1 - Hosts: 218.85.139.121 91flash.com
O1 - Hosts: 218.85.139.121 www.doingflash.com
O1 - Hosts: 218.85.139.121 doingflash.com
O1 - Hosts: 218.85.139.121 www.5see.com
O1 - Hosts: 218.85.139.121 5see.com
O1 - Hosts: 218.85.139.121 www.skyhits.com
O1 - Hosts: 218.85.139.121 skyhits.com
O1 - Hosts: 218.85.139.121 www.ting78.com
O1 - Hosts: 218.85.139.121 ting78.com
O1 - Hosts: 218.85.139.121 www.91.com
O1 - Hosts: 218.85.139.121 91.com
O1 - Hosts: 218.85.139.121 www.flashchina.net
O1 - Hosts: 218.85.139.121 flashchina.net
O1 - Hosts: 218.85.139.121 www.flash8.com.cn
O1 - Hosts: 218.85.139.121 flash8.com.cn
O1 - Hosts: 218.85.139.121 www.f130.net
O1 - Hosts: 218.85.139.121 f130.net
O1 - Hosts: 218.85.139.121 www.chinanim.com
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\QQ\QQIEHelper.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\FLASHGET\jccatch.dll
O2 - BHO: AssistII - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\PROGRA~1\3721\assist\asbar.dll
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINDOWS\downlo~1\CnsHook.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: 上网助手 - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\PROGRA~1\3721\assist\asbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [helper.dll] C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - HKLM\..\Run: [KAVRun] d:\KAV6\KAVRun.EXE
O4 - HKLM\..\Run: [Kulansyn] d:\KAV6\Kulansyn.EXE
O4 - HKLM\..\Run: [KpopMon] d:\KAV6\KpopMon.EXE
O4 - HKLM\..\Run: [iDuba Personal FireWall] D:\KAV6\Kavpfw.EXE
O4 - HKLM\..\Run: [SysExplr] d:\Herosoft\HeroV8\SYSEXPLR.EXE
O4 - HKLM\..\Run: [CnsMin] Rundll32.exe C:\WINDOWS\downlo~1\CnsMin.dll,Rundll32
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [YDTMain.exe] C:\PROGRA~1\YDT\YDTMain.exe
O4 - HKLM\..\Run: [] regedit -s C:\$NtUninstallQ5926809$\sp4custom.dll
O4 - HKLM\..\Run: [SysMudu] C:\WINDOWS\System32\sysMudu.exe
O4 - HKLM\..\Run: [cih] C:\WINDOWS\cih.exe
O4 - HKLM\..\Run: [RavTimer] C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [RavMon] C:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [NetCtl] C:\Program Files\切换控制程序\netctl.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: 腾讯QQ.lnk = D:\QQ\QQ.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: !搜一搜 - res://C:\WINDOWS\downlo~1\CnsMinEx.dll/1003
O8 - Extra context menu item: 使用网际快车下载 - D:\FLASHGET\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - D:\FLASHGET\jc_all.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\QQ\SendMMS.htm
O9 - Extra button: 手机短信 - {00000000-0000-0001-0001-596BAEDD1289} - http://sms.3721.com/ie/index.htm?pid=U_3721_assist (file missing)
O9 - Extra button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.mail.yahoo.com/promo/rd1 (file missing)
O9 - Extra button: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://hot.3721.com/rd/shop_btn.htm (file missing)
O9 - Extra button: 上网助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://assistant.3721.com/index.htm?fb=Cns (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\QQ\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\QQ\QQIEHelper.dll
O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing)
O9 - Extra 'Tools' menuitem: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing)
O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O9 - Extra 'Tools' menuitem: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O11 - Options group: [!CNS]  上网助手-地址栏搜索
O11 - Options group: [TBH] QQ地址栏搜索
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - file://D:\Herosoft\HeroV8\DVDSkin\defskin\HTML\swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6021F349-0DEF-4F10-B3D6-411CE38911B3}: NameServer = 10.255.0.68,202.102.224.68
O17 - HKLM\System\CS1\Services\Tcpip\..\{6021F349-0DEF-4F10-B3D6-411CE38911B3}: NameServer = 10.255.0.68,202.102.224.68
O17 - HKLM\System\CS2\Services\Tcpip\..\{6021F349-0DEF-4F10-B3D6-411CE38911B3}: NameServer = 10.255.0.68,202.102.224.68
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Kingsoft AntiVirus Service (KAVSvc) - Unknown owner - d:\KAV6\KAVSvc.EXE (file missing)
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe


请楼上的高手帮忙看一下，谢谢了！

晕从没见过这么乱的系统，眼都花了。

我知道肯定有毛病的，但我看不懂的，怎么解决呢？我快急死了，这是领导的机子让我修的。大家都来帮帮忙吧！

呵呵，把他格了重装，就不用那么烦了

呵呵，格了重装是最后一步，有没有更好的方法呀！快来救我呀！

这么乱，我看还是重装吧，手动清除比重装还烦

多谢大侠热心帮助，真的没有办法了吗？机子里的重要资料太多，不好移动的.

你的电脑装了KV和瑞星两个杀毒软件？？？？

用最新版瑞星DOS下杀.

今上午装正版瑞星的时候，我把原来不知从那里弄来的金山卸载了，现在就一个瑞星。

哦！怪不得会有这项O23 - Service: Kingsoft AntiVirus Service (KAVSvc) - Unknown owner - d:\KAV6\KAVSvc.EXE (file missing)
不过你的KV没删干净！

电脑出毛病时，电脑上装的是金山，我看不能用，就删了，是不没删干净。我先用最新的瑞星DOS下面杀一下试试。多谢了，两位，呵呵，有毛病继续帮忙呀...

引用:

【新手入门请教的贴子】电脑出毛病时，电脑上装的是金山，我看不能用，就删了，是不没删干净。我先用最新的瑞星DOS下面杀一下试试。多谢了，两位，呵呵，有毛病继续帮忙呀... ...........................

瑞星dos版（Ravdos.exe）使用方法

            特别注意：杀毒前尽量将杀毒软件升级到最新。推荐在纯dos的方式下杀毒，虽然比较慢，但这样会比较干净。
            建议在Win200，XP, 2003系统中将瑞星安装在非NTFS驱动器的根目录下，如：D:\rising\，这样用dos杀毒比较方便。

            进入纯dos的方法：
            1、9x系统－开机后按F8，选择第5项。
            2、NT系统(包括WinXP、2003)－用WIN98的启动软盘（光盘）启动系统，再运行Ravdos.exe。（用软盘或光盘启动系统请在BIOS中设置系统启动顺序first为软盘或光盘）
            3、 假设瑞星安装在d:\program files\rising中，依次输入如下命令：
            d:
            cd \progra~1\rising
            Ravdos

            进去后按回车键直接查杀所有硬盘，Alt+X退出RAV2004，Tab键用来选择选项，方向箭头←↑→↓用来选择目标。


            如果想制作软盘版:

            先用瑞星杀毒程序的菜单：

            工具--》制作/升级软盘版


            按提示插入软盘

            然后用制作好的软盘引导计算机进入DOS，按提示操作就行了。

非常详细的，真是太感谢楼上的高手了！我试试能不能完成，呵呵，我是菜鸟级的。