瑞星防火墙经常提示说"防范2003蠕虫王攻击"是不是有病毒? bbs.ikaka.com

年年有宇 - 2006-3-1 22:36:00

哪位高手帮我看看吧!

HijackThis_zww汉化版扫描日志 V1.99.1
保存于 22:02:36, 日期 2006-3-1
操作系统： Windows XP SP2 (WinNT 5.01.2600)
浏览器： Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程：
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\HP\KBD\KBD.EXE
C:\WINDOWS\system32\SafeSignCertReg.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Rising\Rav\RsAgent.exe
C:\WINDOWS\msagent\AgentSvr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\system32\conime.exe
C:\Program Files\Rising\Rav\Ravmond.exe
C:\Program Files\Rising\Rav\RAVMON.EXE
C:\Program Files\Rising\Rav\RavStub.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Rising\Rfw\RfwMain.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\Downloads\2535952005811174944\HijackThis1991zww.exe

O3 - IE工具栏增项: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\KakaTool.dll
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [SoundMan] SOUNDMAN.EXE
O4 - 启动项HKLM\\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - 启动项HKLM\\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - 启动项HKLM\\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - 启动项HKLM\\Run: [CertificateRegistration] SafeSignCertReg.exe
O4 - 启动项HKLM\\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - 启动项HKLM\\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {20C2C286-BDE8-441B-B73D-AFA22D914DA5} (PowerList Control) - http://www.ppstream.com/bin/powerplayer.cab
O16 - DPF: {62B938C4-4190-4F37-8CF0-A92B0A91CC77} (InfoSecNetSign Class) - https://mybank.icbc.com.cn/icbc/NetSign.dll
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/pcver2006new/OL2006.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{06B352A6-C55A-4148-8F73-5BAAE3671FD0}: NameServer = 218.108.248.219 218.108.248.245
O17 - HKLM\System\CCS\Services\Tcpip\..\{0AF2463C-0290-42F8-A277-DED0EEB3F0E8}: NameServer = 202.96.128.86,202.96.128.166
O17 - HKLM\System\CS1\Services\Tcpip\..\{06B352A6-C55A-4148-8F73-5BAAE3671FD0}: NameServer = 218.108.248.219 218.108.248.245
O23 - NT 服务: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - NT 服务: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - NT 服务: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - NT 服务: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe
O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
--------

这个文件-- C:\WINDOWS\system32\ctfmon.exe 是不是有问题?

年年有宇 - 2006-3-1 22:45:00

这是瑞星2006防火墙提供的日志:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
+ SoundMan Realtek Sound Manager Realtek Semiconductor Corp. C:\WINDOWS\SOUNDMAN.EXE
+ ATIPTA ATI Desktop Control Panel ATI Technologies, Inc. C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE
+ KBD KBD EXE Hewlett-Packard Company C:\HP\KBD\KBD.EXE
+ PS2 PS2 EXE Hewlett-Packard Company C:\WINDOWS\SYSTEM32\PS2.EXE
+ CertificateRegistration Certificate Registration Utility A.E.T. Europe B.V. C:\WINDOWS\system32\SAFESIGNCERTREG.EXE
+ NvCplDaemon NVIDIA Display Properties Extension NVIDIA Corporation C:\WINDOWS\SYSTEM32\NVCPL.DLL
+ TkBellExe RealNetworks Scheduler RealNetworks, Inc. C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
+ CdnCtr C:\PROGRAM FILES\CNNIC\CDN\CDNUP.EXE
+ DTService C:\DOCUME~1\NEW\LOCALS~1\TEMP\RARSFX0\DTSERV~1.DLL
+ TkBellExe RealNetworks Scheduler RealNetworks, Inc. C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
+ NvCplDaemon NVIDIA Display Properties Extension NVIDIA Corporation C:\WINDOWS\SYSTEM32\NVCPL.DLL
+ nwiz C:\WINDOWS\system32\NWIZ.EXE
+ NvMediaCenter NVIDIA Media Center Library NVIDIA Corporation C:\WINDOWS\SYSTEM32\NVMCTRAY.DLL
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
+ Skype D:\PROGRAM FILES\SKYPE\PHONE\SKYPE.EXE
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
+ ipsec C:\PROGRA~1\COMMON~1\SYSTEM\MSDC32.DLL

影子110 - 2006-3-1 22:53:00

正常进程~~~
关于这个提示，可能是让你把一些危险的端口给关闭了吧
你看看是在哪个端口上提示的~~

年年有宇 - 2006-3-1 23:14:00

引用:

【影子110的贴子】正常进程~~~
关于这个提示，可能是让你把一些危险的端口给关闭了吧
你看看是在哪个端口上提示的~~
...........................

谢谢!是1434端口

今天瑞星又杀到一个木马病毒，有点担心的说~

病毒名称发现日期扫描方式路径文件病毒来源
Trojan.DL.Agent.vp 2006-01-25 13:24手动扫描C:\WINDOWS\system32aclayer.exe本机
Trojan.DL.Agent.vp 2006-01-25 13:24手动扫描C:\WINDOWS\system32aclayer.dll本机
Trojan.DL.Agent.vp 2006-01-25 13:28手动扫描C:\System Volume Information\_restore{4A868894-65BC-436D-BE76-14D2EF42B7AA}\RP26A0001545.exe本机
Trojan.DL.Agent.vp 2006-01-25 13:28手动扫描C:\System Volume Information\_restore{4A868894-65BC-436D-BE76-14D2EF42B7AA}\RP26A0001546.dll本机
Trojan.DL.Agent.vp 2006-01-25 13:29手动扫描C:\System Volume Information\_restore{4A868894-65BC-436D-BE76-14D2EF42B7AA}\RP35A0011093.exe本机
Trojan.DL.Agent.vp 2006-01-25 13:29手动扫描C:\System Volume Information\_restore{4A868894-65BC-436D-BE76-14D2EF42B7AA}\RP35A0011094.dll本机
Trojan.Clicker.Agent.rv 2006-01-25 13:41手动扫描C:\WINDOWS .exe本机
Trojan.Clicker.Agent.rv 2006-01-25 13:41手动扫描C:\Documents and Settings\new\Local Settings\Tempxp14.tmp.exe本机
Trojan.Clicker.Agent.rv 2006-01-25 13:42手动扫描C:\Documents and Settings\new\Local Settings\Tempxp24.tmp.exe本机
Adware.Clicker.YNYW.m 2006-01-25 13:42手动扫描C:\Program Files\Common Files\SANDNetwork.exe本机
Trojan.DL.Small.cdy 2006-01-25 13:43手动扫描C:\Program Files\系统优化大师fuzi01.exe>>dtservice.dll本机
Trojan.Clicker.Agent.rv 2006-01-25 13:44手动扫描C:\System Volume Information\_restore{4A868894-65BC-436D-BE76-14D2EF42B7AA}\RP35A0011096.exe本机
Adware.Clicker.YNYW.m 2006-01-25 13:44手动扫描C:\System Volume Information\_restore{4A868894-65BC-436D-BE76-14D2EF42B7AA}\RP35A0011097.exe本机
Trojan.DL.Small.cdy 2006-01-25 13:44手动扫描C:\System Volume Information\_restore{4A868894-65BC-436D-BE76-14D2EF42B7AA}\RP35A0011098.exe>>dtservice.dll本机
Trojan.Clicker.Agent.rv 2006-01-25 13:44手动扫描C:\Recycled INFO本机
Trojan.DL.QQHelper.x 2006-02-03 21:07定时扫描C:\System Volume Information\_restore{4A868894-65BC-436D-BE76-14D2EF42B7AA}\RP42A0012855.DLL本机
Trojan.DL.Small.cit 2006-02-15 21:01定时扫描C:\WINDOWS\system32microapmddt.dll本机
Trojan.DL.Small.cit 2006-02-15 21:06定时扫描C:\System Volume Information\_restore{4A868894-65BC-436D-BE76-14D2EF42B7AA}\RP46A0013312.dll本机
Trojan.DL.Small.cit 2006-02-15 21:06定时扫描C:\System Volume Information\_restore{4A868894-65BC-436D-BE76-14D2EF42B7AA}\RP47A0013668.dll本机
Trojan.Clicker.Agent.se 2006-03-01 21:13定时扫描C:\System Volume Information\_restore{4A868894-65BC-436D-BE76-14D2EF42B7AA}\RP54A0014703.dll本机

影子110 - 2006-3-1 23:22:00

清空回收站
清空临时文件夹，
关闭系统还原~~~
然后进入安全模式再次全盘查杀下~~~

我的电脑》属性》系统还原》关闭所有盘的系统还原》确定
清空临时文件夹的方法：
IE》属性》删除文件（包括脱机文件）》确定
（清空回收站就不要再教了吧~~~）

影子110 - 2006-3-1 23:27:00

另，用瑞星的墙关闭1434端口~~~在祥细设置》端口开关（或 IP规则亦可~~）

年年有宇 - 2006-3-1 23:33:00

谢谢~非常感谢~

瑞星卡卡安全论坛