【求助】我周一查出192个病毒，周三又查出19个，我已重扫日志 bbs.ikaka.com

旺旺财财 - 2006-2-15 12:54:00

我周一查出192个病毒，周三（即今天）又查出19个，请帮我看看日志
Logfile of Kaka v2. 0. 0. 7 Scan Module v2. 0. 0. 1
Scan saved at 12:41:29, on 2006-02-15
Platform: Microsoft Windows 2000 Professional Service Pack 4 (Build 2195)
MSIE: Internet Explorer v6.00 SP1;Q833989; (6.00.2800.1106)

Running processes:
[SMSS.EXE]
CommandLine =

[CSRSS.EXE]
CommandLine = C:\WINNT\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

[WINLOGON.EXE]
CommandLine = winlogon.exe

[SERVICES.EXE]
CommandLine = C:\WINNT\system32\services.exe

[LSASS.EXE]
CommandLine = C:\WINNT\system32\lsass.exe

[RavMonD.exe]
CommandLine = "C:\PROGRAM FILES\RISING\RAV\Ravmond.exe"

[RavStub.exe]
CommandLine = "C:\PROGRAM FILES\RISING\RAV\RavStub.exe" /RAVMOND

[svchost.exe]
CommandLine = C:\WINNT\system32\svchost -k rpcss

[spoolsv.exe]
CommandLine = C:\WINNT\system32\spoolsv.exe

[CDAC11BA.EXE]
CommandLine = C:\WINNT\System32\drivers\CDAC11BA.EXE

[svchost.exe]
CommandLine = C:\WINNT\System32\svchost.exe -k netsvcs

[RavService.exe]
CommandLine = "C:\Program Files\Rising\Rav\RavService.exe" /service

[regsvc.exe]
CommandLine = C:\WINNT\system32\regsvc.exe

[CCenter.exe]
CommandLine = "C:\Program Files\Rising\Rav\CCenter.exe"

[mstask.exe]
CommandLine = C:\WINNT\system32\MSTask.exe

[stisvc.exe]
CommandLine = C:\WINNT\system32\stisvc.exe

[WinMgmt.exe]
CommandLine = C:\WINNT\System32\WBEM\WinMgmt.exe

[svchost.exe]
CommandLine = C:\WINNT\system32\svchost.exe -k wugroup

[explorer.exe]
CommandLine = C:\WINNT\Explorer.EXE

[rundll32.exe]
CommandLine = Rundll32.exe C:\WINNT\downlo~1\CnsMin.dll,Rundll32

[hkcmd.exe]
CommandLine = "C:\WINNT\System32\hkcmd.exe"

[SOUNDMAN.EXE]
CommandLine = "C:\WINNT\SOUNDMAN.EXE"

[RavTimer.exe]
CommandLine = "C:\Program Files\Rising\Rav\RavTimer.exe"

[realsched.exe]
CommandLine = "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[rundll32.exe]
CommandLine = "C:\WINNT\system32\rundll32.exe" C:\PROGRA~1\3721\helper.dll,Rundll32

[RavMon.exe]
CommandLine = "C:\PROGRAM FILES\RISING\RAV\RAVMON.EXE" -SYSTEM

[ylive.exe]
CommandLine = "C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe"

[RavTray.exe]
CommandLine = "C:\Program Files\Rising\Rav\RavTray.exe"

[winlog.exe]
CommandLine = "C:\WINNT\system32\winlog.exe"

[anti_troj.exe]
CommandLine = "C:\WINNT\system32\anti_troj.exe"

[CTFMON.EXE]
CommandLine = "C:\WINNT\system32\ctfmon.exe"

[winlog.exe]
CommandLine = "C:\WINNT\system32\winlog.exe"

[anti_troj.exe]
CommandLine = "C:\WINNT\system32\anti_troj.exe"

[RsAgent.exe]
CommandLine = "C:\Program Files\Rising\Rav\RsAgent.exe" /p:748,472

[agentsvr.exe]
CommandLine = C:\WINNT\msagent\AgentSvr.exe -Embedding

[mshta.exe]
CommandLine = mshta.exe res://sp3res.dll/default.hta

[IEXPLORE.EXE]
CommandLine = "C:\Program Files\Internet Explorer\iexplore.exe" -nohome

[IEXPLORE.EXE]
CommandLine = "C:\Program Files\Internet Explorer\IEXPLORE.EXE"

[KkScan.exe]
CommandLine = "C:\Program Files\Rising\KakaToolBar\KkScan.exe"

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINNT\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=%SystemRoot%\system32\blank.htm
O1 - Hosts: 127.0.0.1 localhost

旺旺财财 - 2006-2-15 12:55:00

承上
O1 - Hosts: 127.0.0.1 ad.doubleclick.net
O1 - Hosts: 127.0.0.1 ad.fastclick.net
O1 - Hosts: 127.0.0.1 ads.fastclick.net
O1 - Hosts: 127.0.0.1 ar.atwola.com
O1 - Hosts: 127.0.0.1 atdmt.com
O1 - Hosts: 127.0.0.1 avp.ch
O1 - Hosts: 127.0.0.1 avp.com
O1 - Hosts: 127.0.0.1 avp.ru
O1 - Hosts: 127.0.0.1 awaps.net
O1 - Hosts: 127.0.0.1 banner.fastclick.net
O1 - Hosts: 127.0.0.1 banners.fastclick.net
O1 - Hosts: 127.0.0.1 ca.com
O1 - Hosts: 127.0.0.1 click.atdmt.com
O1 - Hosts: 127.0.0.1 clicks.atdmt.com
O1 - Hosts: 127.0.0.1 dispatch.mcafee.com
O1 - Hosts: 127.0.0.1 download.mcafee.com
O1 - Hosts: 127.0.0.1 download.microsoft.com
O1 - Hosts: 127.0.0.1 downloads.microsoft.com
O1 - Hosts: 127.0.0.1 engine.awaps.net
O1 - Hosts: 127.0.0.1 fastclick.net
O1 - Hosts: 127.0.0.1 f-secure.com
O1 - Hosts: 127.0.0.1 ftp.f-secure.com
O1 - Hosts: 127.0.0.1 ftp.sophos.com
O1 - Hosts: 127.0.0.1 go.microsoft.com
O1 - Hosts: 127.0.0.1 liveupdate.symantec.com
O1 - Hosts: 127.0.0.1 mast.mcafee.com
O1 - Hosts: 127.0.0.1 mcafee.com
O1 - Hosts: 127.0.0.1 media.fastclick.net
O1 - Hosts: 127.0.0.1 msdn.microsoft.com
O1 - Hosts: 127.0.0.1 my-etrust.com
O1 - Hosts: 127.0.0.1 nai.com
O1 - Hosts: 127.0.0.1 networkassociates.com
O1 - Hosts: 127.0.0.1 office.microsoft.com
O1 - Hosts: 127.0.0.1 phx.corporate-ir.net
O1 - Hosts: 127.0.0.1 secure.nai.com
O1 - Hosts: 127.0.0.1 securityresponse.symantec.com
O1 - Hosts: 127.0.0.1 service1.symantec.com
O1 - Hosts: 127.0.0.1 sophos.com
O1 - Hosts: 127.0.0.1 spd.atdmt.com
O1 - Hosts: 127.0.0.1 support.microsoft.com
O1 - Hosts: 127.0.0.1 symantec.com
O1 - Hosts: 127.0.0.1 update.symantec.com
O1 - Hosts: 127.0.0.1 updates.symantec.com
O1 - Hosts: 127.0.0.1 us.mcafee.com
O1 - Hosts: 127.0.0.1 vil.nai.com
O1 - Hosts: 127.0.0.1 viruslist.ru
O1 - Hosts: 127.0.0.1 windowsupdate.microsoft.com
O1 - Hosts: 127.0.0.1 www.avp.ch
O1 - Hosts: 127.0.0.1 www.avp.com
O1 - Hosts: 127.0.0.1 www.avp.ru
O1 - Hosts: 127.0.0.1 www.awaps.net
O1 - Hosts: 127.0.0.1 www.ca.com
O1 - Hosts: 127.0.0.1 www.fastclick.net
O1 - Hosts: 127.0.0.1 www.f-secure.com
O1 - Hosts: 127.0.0.1 www.kaspersky.ru
O1 - Hosts: 127.0.0.1 www.mcafee.com
O1 - Hosts: 127.0.0.1 www.my-etrust.com
O1 - Hosts: 127.0.0.1 www.nai.com
O1 - Hosts: 127.0.0.1 www.networkassociates.com
O1 - Hosts: 127.0.0.1 www.sophos.com
O1 - Hosts: 127.0.0.1 www.symantec.com
O1 - Hosts: 127.0.0.1 www.trendmicro.com
O1 - Hosts: 127.0.0.1 www.viruslist.ru
O1 - Hosts: 127.0.0.1 www3.ca.com
O2 - BHO: CnsHook Class - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINNT\downlo~1\CnsHook.dll
O2 - BHO: (file missing)
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINNT\system32\kakatool.dll
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [sysformat] C:\WINNT\system32\sysformat.exe
O4 - HKCU\..\Run: [key2] C:\WINNT\system32\winlog.exe
O4 - HKCU\..\Run: [anti_troj] C:\WINNT\system32\anti_troj.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RavTimer] C:\Program Files\Rising\Rav\RavTimer.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [helper.dll] C:\WINNT\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - HKLM\..\Run: [RavMon] C:\Program Files\Rising\Rav\RavMon.exe -system
O4 - HKLM\..\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RavTray] C:\Program Files\Rising\Rav\RavTray.exe
O4 - HKLM\..\Run: [CnsMin] Rundll32.exe C:\WINNT\downlo~1\CnsMin.dll,Rundll32
O4 - HKLM\..\Run: [key2] C:\WINNT\system32\winlog.exe
O4 - HKLM\..\Run: [anti_troj] C:\WINNT\system32\anti_troj.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra Button: @shdoclc.dll,-866 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: @shdoclc.dll,-864 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\system32\shdocvw.dll
O11 - Options group: [!CNS] 网络实名
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
O16 - DPF: DirectAnimation Java Classes - file://C:\WINNT\Java\classes\dajava.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1134711063608
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1139797184375
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = htdomain
O17 - HKLM\System\CCS\Services\Tcpip\..\{9CE4F38D-F5AA-4FAF-BEBF-76B5625B1875}: NameServer = 172.28.1.1
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\System32\mshtml.dll
O18 - Protocol: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL
O18 - Protocol: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: ipp - (no CLSID) - (no file)
O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINNT\System32\itss.dll
O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\System32\mshtml.dll
O18 - Protocol: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\System32\mshtml.dll
O18 - Protocol: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINNT\System32\inetcomm.dll
O18 - Protocol: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINNT\system32\urlmon.dll
O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINNT\System32\itss.dll
O18 - Protocol: msdaipp - (no CLSID) - (no file)
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\System32\mshtml.dll
O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINNT\System32\mshtml.dll
O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\System32\mshtml.dll
O18 - Protocol: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINNT\System32\msdxm.ocx
O20 - Winlogon Notify: igfxcui
O20 - Winlogon Notify: wzcnotif
O23 - Service: C-DillaCdaC11BA (C-DillaCdaC11BA) - Macrovision - C:\WINNT\system32\drivers\cdac11ba.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\system32\dmadmin.exe /com
O23 - Service: RavInstallService (RavInstallService) - - \\yumei\C$\Program Files\Rising\Rav\RavISvc.exe
O23 - Service: RavService (RavService) - Beijing Rising Technology Co., Ltd. - "C:\Program Files\Rising\Rav\RavService.exe" /service
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe

ppdog - 2006-2-15 13:43:00

O4 - HKCU\..\Run: [sysformat] C:\WINNT\system32\sysformat.exe
O4 - HKCU\..\Run: [key2] C:\WINNT\system32\winlog.exe
O4 - HKCU\..\Run: [anti_troj] C:\WINNT\system32\anti_troj.exe

几个不明程序，楼主去看看是否认得

O1项的hosts不是楼主自己设置得把，如果不是请修复所有O1项

宇宙之巅 - 2006-2-15 14:19:00

你的01和04项太多了吧.

旺旺财财 - 2006-2-15 15:02:00

引用:

【ppdog的贴子】O4 - HKCU\..\Run: [sysformat] C:\WINNT\system32\sysformat.exe
O4 - HKCU\..\Run: [key2] C:\WINNT\system32\winlog.exe
O4 - HKCU\..\Run: [anti_troj] C:\WINNT\system32\anti_troj.exe

几个不明程序，楼主去看看是否认得

O1项的hosts不是楼主自己设置得把，如果不是请修复所有O1项
...........................

第2楼，我也不知道这几个程序是什么？
O1项的hosts大概是公司的局域网设置的，该怎么修复呢？为什么我的瑞星好象睡着了一样，一点作用也不起
请指教，谢谢

旺旺财财 - 2006-2-15 16:14:00

第2楼走了，有没有别的高手帮帮我

不言放弃 - 2006-2-15 16:17:00

卡卡助手没有修复功能
用起来不方便
建议
http://forum.ikaka.com/topic.asp?board=28&artid=6979213
下载HIJACKTHIS
重新导出日志

旺旺财财 - 2006-2-15 16:21:00

引用:

【不言放弃的贴子】卡卡助手没有修复功能
用起来不方便
建议
http://forum.ikaka.com/topic.asp?board=28&artid=6979213
下载HIJACKTHIS
重新导出日志
...........................

谢谢，我马上去

旺旺财财 - 2006-2-16 8:41:00

引用:

我已按照第6楼说的，重新导出日志，请再帮我看看
HijackThis_zww汉化版扫描日志 V1.99.1
保存于 8:35:56, 日期 2006-2-16
操作系统： Windows 2000 SP4 (WinNT 5.00.2195)
浏览器： Internet Explorer v6.00 SP1 (6.00.2800.1106)

当前运行的进程：
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
C:\PROGRAM FILES\RISING\RAV\RavStub.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\drivers\CDAC11BA.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\Rising\Rav\RavService.exe
C:\WINNT\system32\regsvc.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\Rundll32.exe
C:\WINNT\System32\hkcmd.exe
C:\WINNT\SOUNDMAN.EXE
C:\Program Files\Rising\Rav\RavTimer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\Rising\Rav\RavMon.exe
C:\Program Files\Rising\Rav\RavTray.exe
C:\WINNT\system32\winlog.exe
C:\WINNT\system32\anti_troj.exe
C:\WINNT\system32\ctfmon.exe
C:\WINNT\system32\winlog.exe
C:\WINNT\system32\anti_troj.exe
D:\HijackThis1991zww.exe

F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINNT\downlo~1\CnsHook.dll
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4}? - (no file)
O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - IE工具栏增项: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINNT\system32\kakatool.dll
O4 - 启动项HKLM\\Run: [Synchronization Manager] mobsync.exe /logon
O4 - 启动项HKLM\\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - 启动项HKLM\\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - 启动项HKLM\\Run: [SoundMan] SOUNDMAN.EXE
O4 - 启动项HKLM\\Run: [RavTimer] C:\Program Files\Rising\Rav\RavTimer.exe
O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - 启动项HKLM\\Run: [helper.dll] C:\WINNT\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - 启动项HKLM\\Run: [RavMon] C:\Program Files\Rising\Rav\RavMon.exe -system
O4 - 启动项HKLM\\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - 启动项HKLM\\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - 启动项HKLM\\Run: [RavTray] C:\Program Files\Rising\Rav\RavTray.exe
O4 - 启动项HKLM\\Run: [CnsMin] Rundll32.exe C:\WINNT\downlo~1\CnsMin.dll,Rundll32
O4 - 启动项HKLM\\Run: [key2] C:\WINNT\system32\winlog.exe
O4 - 启动项HKLM\\Run: [anti_troj] C:\WINNT\system32\anti_troj.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [sysformat] C:\WINNT\system32\sysformat.exe
O4 - HKCU\..\Run: [key2] C:\WINNT\system32\winlog.exe
O4 - HKCU\..\Run: [anti_troj] C:\WINNT\system32\anti_troj.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - 浏览器额外的按钮: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail (file missing)
O9 - 浏览器额外的按钮: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao (file missing)
O9 - 浏览器额外的按钮: 雅虎助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist (file missing)
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - 浏览器额外的按钮: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg (file missing)
O9 - 浏览器额外的按钮: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - 浏览器额外的“工具”菜单项: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - 浏览器额外的按钮: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O9 - 浏览器额外的“工具”菜单项: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O11 - Options group: [!CNS] 网络实名
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1134711063608
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1139797184375
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = htdomain
O17 - HKLM\System\CCS\Services\Tcpip\..\{9CE4F38D-F5AA-4FAF-BEBF-76B5625B1875}: NameServer = 172.28.1.1
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = htdomain
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = htdomain
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O23 - NT 服务: C-DillaCdaC11BA - Macrovision - C:\WINNT\System32\drivers\CDAC11BA.EXE
O23 - NT 服务: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - NT 服务: RavInstallService - Unknown owner - \\yumei\C$\Program Files\Rising\Rav\RavISvc.exe (file missing)
O23 - NT 服务: RavService - Unknown owner - C:\Program Files\Rising\Rav\RavService.exe" /service (file missing)
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe

不言放弃 - 2006-2-16 8:54:00

结束如下进程
C:\WINNT\system32\winlog.exe
C:\WINNT\system32\anti_troj.exe

修复
O4 - 启动项HKLM\\Run: [key2] C:\WINNT\system32\winlog.exe
O4 - 启动项HKLM\\Run: [anti_troj] C:\WINNT\system32\anti_troj.exe
O4 - HKCU\..\Run: [sysformat] C:\WINNT\system32\sysformat.exe
O4 - HKCU\..\Run: [key2] C:\WINNT\system32\winlog.exe
O4 - HKCU\..\Run: [anti_troj] C:\WINNT\system32\anti_troj.exe

删除
C:\WINNT\system32\sysformat.exe
C:\WINNT\system32\winlog.exe
C:\WINNT\system32\anti_troj.exe

旺旺财财 - 2006-2-16 9:05:00

引用:

【不言放弃的贴子】结束如下进程
C:\WINNT\system32\winlog.exe
C:\WINNT\system32\anti_troj.exe

修复
O4 - 启动项HKLM\\Run: [key2] C:\WINNT\system32\winlog.exe
O4 - 启动项HKLM\\Run: [anti_troj] C:\WINNT\system32\anti_troj.exe
O4 - HKCU\..\Run: [sysformat] C:\WINNT\system32\sysformat.exe
O4 - HKCU\..\Run: [key2] C:\WINNT\system32\winlog.exe
O4 - HKCU\..\Run: [anti_troj] C:\WINNT\system32\anti_troj.exe

删除
C:\WINNT\system32\sysformat.exe
C:\WINNT\system32\winlog.exe
C:\WINNT\system32\anti_troj.exe

...........................

第9楼，对不起，我不太懂
结束进程，是不是推出该程序的运用？
修复，是用hijackthis修复吗？
删除，是直接从文件夹里删除还是别的什么办法？
谢谢！

newcenturymoon - 2006-2-16 9:41:00

引用:

【旺旺财财的贴子】

引用:

第2楼，我也不知道这几个程序是什么？
O1项的hosts大概是公司的局域网设置的，该怎么修复呢

应该有一部分是公司设置的吧，因为有一些是安全网站和杀毒软件网站。可能是病毒造成，建议修复！
手动修复方法：到C:\WINNT\system32\drivers\etc 下找到hosts文件，用记事本打开。把O1 - Hosts: 127.0.0.1 ad.doubleclick.net
O1 - Hosts: 127.0.0.1 ad.fastclick.net
O1 - Hosts: 127.0.0.1 ads.fastclick.net
O1 - Hosts: 127.0.0.1 ar.atwola.com
O1 - Hosts: 127.0.0.1 atdmt.com
O1 - Hosts: 127.0.0.1 avp.ch
O1 - Hosts: 127.0.0.1 avp.com
O1 - Hosts: 127.0.0.1 avp.ru
O1 - Hosts: 127.0.0.1 awaps.net
O1 - Hosts: 127.0.0.1 banner.fastclick.net
O1 - Hosts: 127.0.0.1 banners.fastclick.net
O1 - Hosts: 127.0.0.1 ca.com
O1 - Hosts: 127.0.0.1 click.atdmt.com
O1 - Hosts: 127.0.0.1 clicks.atdmt.com
O1 - Hosts: 127.0.0.1 dispatch.mcafee.com
O1 - Hosts: 127.0.0.1 download.mcafee.com
O1 - Hosts: 127.0.0.1 download.microsoft.com
O1 - Hosts: 127.0.0.1 downloads.microsoft.com
O1 - Hosts: 127.0.0.1 engine.awaps.net
O1 - Hosts: 127.0.0.1 fastclick.net
O1 - Hosts: 127.0.0.1 f-secure.com
O1 - Hosts: 127.0.0.1 ftp.f-secure.com
O1 - Hosts: 127.0.0.1 ftp.sophos.com
O1 - Hosts: 127.0.0.1 go.microsoft.com
O1 - Hosts: 127.0.0.1 liveupdate.symantec.com
O1 - Hosts: 127.0.0.1 mast.mcafee.com
O1 - Hosts: 127.0.0.1 mcafee.com
O1 - Hosts: 127.0.0.1 media.fastclick.net
O1 - Hosts: 127.0.0.1 msdn.microsoft.com
O1 - Hosts: 127.0.0.1 my-etrust.com
O1 - Hosts: 127.0.0.1 nai.com
O1 - Hosts: 127.0.0.1 networkassociates.com
O1 - Hosts: 127.0.0.1 office.microsoft.com
O1 - Hosts: 127.0.0.1 phx.corporate-ir.net
O1 - Hosts: 127.0.0.1 secure.nai.com
O1 - Hosts: 127.0.0.1 securityresponse.symantec.com
O1 - Hosts: 127.0.0.1 service1.symantec.com
O1 - Hosts: 127.0.0.1 sophos.com
O1 - Hosts: 127.0.0.1 spd.atdmt.com
O1 - Hosts: 127.0.0.1 support.microsoft.com
O1 - Hosts: 127.0.0.1 symantec.com
O1 - Hosts: 127.0.0.1 update.symantec.com
O1 - Hosts: 127.0.0.1 updates.symantec.com
O1 - Hosts: 127.0.0.1 us.mcafee.com
O1 - Hosts: 127.0.0.1 vil.nai.com
O1 - Hosts: 127.0.0.1 viruslist.ru
O1 - Hosts: 127.0.0.1 windowsupdate.microsoft.com
O1 - Hosts: 127.0.0.1 www.avp.ch
O1 - Hosts: 127.0.0.1 www.avp.com
O1 - Hosts: 127.0.0.1 www.avp.ru
O1 - Hosts: 127.0.0.1 www.awaps.net
O1 - Hosts: 127.0.0.1 www.ca.com
O1 - Hosts: 127.0.0.1 www.fastclick.net
O1 - Hosts: 127.0.0.1 www.f-secure.com
O1 - Hosts: 127.0.0.1 www.kaspersky.ru
O1 - Hosts: 127.0.0.1 www.mcafee.com
O1 - Hosts: 127.0.0.1 www.my-etrust.com
O1 - Hosts: 127.0.0.1 www.nai.com
O1 - Hosts: 127.0.0.1 www.networkassociates.com
O1 - Hosts: 127.0.0.1 www.sophos.com
O1 - Hosts: 127.0.0.1 www.symantec.com
O1 - Hosts: 127.0.0.1 www.trendmicro.com
O1 - Hosts: 127.0.0.1 www.viruslist.ru
O1 - Hosts: 127.0.0.1 www3.ca.com
都删掉，然后保存即可

旺旺财财 - 2006-2-16 9:49:00

谢谢，11楼，我马上去试

旺旺财财 - 2006-2-16 11:08:00

我已修复过了,但C:\WINNT\system32\winlog.exe一直被告之源文件可能正在使用,而无法删除,可我已将所有运行的程序统统关闭,包括网络.
我又扫描了日志，请再帮我看看
HijackThis_zww汉化版扫描日志 V1.99.1
保存于 11:09:47, 日期 2006-2-16
操作系统： Windows 2000 SP4 (WinNT 5.00.2195)
浏览器： Internet Explorer v6.00 SP1 (6.00.2800.1106)

当前运行的进程：
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
C:\PROGRAM FILES\RISING\RAV\RavStub.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\drivers\CDAC11BA.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\Rising\Rav\RavService.exe
C:\WINNT\system32\regsvc.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\Rundll32.exe
C:\WINNT\System32\hkcmd.exe
C:\Program Files\Rising\Rav\RavTimer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\Rising\Rav\RavTray.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Rising\Rav\RsAgent.exe
C:\WINNT\msagent\AgentSvr.exe
C:\Program Files\Rising\Rav\RavMon.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\HijackThis1991zww.exe

F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINNT\downlo~1\CnsHook.dll
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4}? - (no file)
O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - IE工具栏增项: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINNT\system32\kakatool.dll
O4 - 启动项HKLM\\Run: [Synchronization Manager] mobsync.exe /logon
O4 - 启动项HKLM\\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - 启动项HKLM\\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - 启动项HKLM\\Run: [SoundMan] SOUNDMAN.EXE
O4 - 启动项HKLM\\Run: [RavTimer] C:\Program Files\Rising\Rav\RavTimer.exe
O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - 启动项HKLM\\Run: [helper.dll] C:\WINNT\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - 启动项HKLM\\Run: [RavMon] C:\Program Files\Rising\Rav\RavMon.exe -system
O4 - 启动项HKLM\\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - 启动项HKLM\\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - 启动项HKLM\\Run: [RavTray] C:\Program Files\Rising\Rav\RavTray.exe
O4 - 启动项HKLM\\Run: [CnsMin] Rundll32.exe C:\WINNT\downlo~1\CnsMin.dll,Rundll32
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - 浏览器额外的按钮: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail (file missing)
O9 - 浏览器额外的按钮: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao (file missing)
O9 - 浏览器额外的按钮: 雅虎助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist (file missing)
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - 浏览器额外的按钮: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg (file missing)
O9 - 浏览器额外的按钮: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - 浏览器额外的“工具”菜单项: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - 浏览器额外的按钮: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O9 - 浏览器额外的“工具”菜单项: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O11 - Options group: [!CNS] 网络实名
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1134711063608
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1139797184375
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = htdomain
O17 - HKLM\System\CCS\Services\Tcpip\..\{9CE4F38D-F5AA-4FAF-BEBF-76B5625B1875}: NameServer = 172.28.1.1
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = htdomain
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = htdomain
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O23 - NT 服务: C-DillaCdaC11BA - Macrovision - C:\WINNT\System32\drivers\CDAC11BA.EXE
O23 - NT 服务: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - NT 服务: RavInstallService - Unknown owner - \\yumei\C$\Program Files\Rising\Rav\RavISvc.exe (file missing)
O23 - NT 服务: RavService - Unknown owner - C:\Program Files\Rising\Rav\RavService.exe" /service (file missing)
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe

谢谢

不言放弃 - 2006-2-16 11:12:00

进入安全模式下删除

或用KILLBOX来删除

或参考http://www.xfilt.com/tech/trojan-horse.htm

旺旺财财 - 2006-2-16 12:08:00

引用:

我已删除了如下文件名:
C:\WINNT\system32\anti_troj.exe
C:\WINNT\system32\sysformat.EXEOPENOPEN
C:\WINNT\system32\sysformat.EXEOPENOPENOPENOPEN
C:\WINNT\system32\winlog.exe
请问对吗?我暂时放入回收站,如删除不对还可拿回

旺旺财财 - 2006-2-16 15:17:00

14楼能再看看我删除的对吗

不言放弃 - 2006-2-16 15:20:00

现在机器还有什么问题

旺旺财财 - 2006-2-16 15:37:00

机器目前正常，但我怕删错文件，后患无穷。以为我发现2个sysformat.exe文件，我都删除了。
C:\WINNT\system32\sysformat.EXEOPENOPEN
C:\WINNT\system32\sysformat.EXEOPENOPENOPENOPEN
又发现2个winlog.exe文件，一起删除时，只能删除其中之一
这是正常的吗？

查看完整版本: 【求助】我周一查出192个病毒，周三又查出19个，我已重扫日志

瑞星卡卡安全论坛