瑞星卡卡安全论坛

ogfile of HijackThis v1.99.1
Scan saved at 21:43:05 上午, on 2005-9-2
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\Explorer.EXE
F:\WINDOWS\system32\spoolsv.exe
F:\PROGRA~1\RISING\RAV\RAVMON.EXE
F:\PROGRA~1\SKYNET\FIREWALL\pfw.exe
F:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
F:\Program Files\Common Files\Real\Update_OB\realsched.exe
F:\WINDOWS\System32\ctfmon.exe
F:\Program Files\Internet Explorer\iexplore.exe
F:\WINDOWS\System32\devldr32.exe
F:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
F:\PROGRAM FILES\RISING\RAV\Ravmond.exe
F:\PROGRAM FILES\RISING\RAV\RavStub.exe
F:\Program Files\WinRAR\WinRAR.exe
F:\DOCUME~1\qq\LOCALS~1\Temp\Rar$EX00.875\HijackThis.exe

O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - F:\WINDOWS\System32\xunleibho_v4.dll
O2 - BHO: IEMoni Class - {F236CC5A-F6E4-4011-9EED-C52FDF51CE3D} - F:\WINDOWS\system32\SBHOPlin.dll
O3 - Toolbar: BitCometBar - {3F1ABCDB-A875-46c1-8345-B72A4567E486} - F:\Program Files\BitComet\BitCometBar\BitCometBar0.1.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - F:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: 卡卡安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - F:\WINDOWS\System32\KakaTool.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "F:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] F:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] F:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RavMon] F:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [SKYNET Personal FireWall] F:\PROGRA~1\SKYNET\FIREWALL\pfw.exe
O4 - HKLM\..\Run: [RavTimer] F:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [TkBellExe] "F:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [startkey] F:\WINDOWS\System32\server.exe
O8 - Extra context menu item: &使用迅雷下载 - F:\Program Files\Sandai Technologies Inc\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - F:\Program Files\Sandai Technologies Inc\Thunder\getAllurl.htm
O8 - Extra context menu item: 使用Kugoo下载 - F:\Program Files\KuGoo2\KugooDownX.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - F:\Program Files\Tencent\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - F:\Program Files\Tencent\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - F:\Program Files\Tencent\qq\SendMMS.htm
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - F:\Program Files\浩方对战平台\GameClient.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - F:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - F:\WINDOWS\web\related.htm
O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/games/clients/y/ct2_x.cab
O16 - DPF: Yahoo! Reversi - http://download.games.yahoo.com/games/clients/y/rt0_x.cab
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - F:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - F:\PROGRAM FILES\RISING\RAV\Ravmond.exe

我在没开网页时的HijackThis,有IEXPLORE.EXE,有1个
Backdoor.Bifrose.ch病毒.杀不干净.

关闭系统还原，清空回收站临时文件
建议修复
O2 - BHO: IEMoni Class - {F236CC5A-F6E4-4011-9EED-C52FDF51CE3D} - F:\WINDOWS\system32\SBHOPlin.dll

【回复“ericaa1398”的帖子】
F:\WINDOWS\System32\devldr32.exe
F:\WINDOWS\System32\server.exe
打包传上来。

引用:

【garnett21的贴子】关闭系统还原，清空回收站临时文件 建议修复 O2 - BHO: IEMoni Class - {F236CC5A-F6E4-4011-9EED-C52FDF51CE3D} - F:\WINDOWS\system32\SBHOPlin.dll ...........................

这个好像是天网的东西哟

我压缩好了,帮我看看谢谢.

附件: 530296200593114308.rar

地2个文件.

附件: 530296200593114355.rar

什么东西??server.exe?听起来好恐怖……

呵呵，偶们工具不全，最好别动，

wo ding

还是没人吗?

楼主，你好，你上传的serve.exe被病毒感染，斑竹过会会有查杀方法，请耐心等待。

server.exe - infected by Backdoor.Win32.Bifrose.d

第一个没问题，Creative Device Loader属于Create Soundblaster驱动

第二个是Backdoor.Win32.Bifrose.d
在安全模式下查毒