【求助】帮忙看下日志，有没有中毒！ bbs.ikaka.com

西门喝血 - 2007-5-10 13:27:00

各位高手：
非常感谢您留心我这份系统诊断报告，小菜鸟十万火急等待您的帮助！
该诊断报告由360安全卫士提供 http://www.360safe.com
诊断时间: 2007-05-10 13:27:23
诊断平台: Microsoft Windows 2000 Service Pack 4
IE版本: Internet Explorer V6.0.2800.1106 Build:62800.1106
计算机物理内存:1022MB - 当前可用内存:614MB

100 - 未知 - Process: Bar.exe [] - C:\Program Files\jxnetshargepubwin\Bar.exe
100 - 未知 - Process: ServiceManager.exe [TODO: <文件说明>] - C:\Program Files\Hintsoft\PubwinServer\version\bin\ServiceManager.exe
100 - 未知 - Process: wrapper.exe [] - C:\Program Files\Hintsoft\PubwinServer\appServ\bin\wrapper.exe
100 - 未知 - Process: java.exe [] - C:\Program Files\Hintsoft\PubwinServer\appServ\java\bin\java.exe
100 - 未知 - Process: FasterSnake.exe [FasterSnake ] - C:\Program Files\Hintsoft\PubwinServer\appServ\bin\FasterSnake.exe
O2 - 未知 - BHO: (浏览器辅助对象(BHO)) - [无效的CLSID:?{0D42E1BD-09DD-4873-A826-9C7E793EB7B6}] - ?{0D42E1BD-09DD-4873-A826-9C7E793EB7B6} -
O3 - 未知 - Toolbar: (第三方IE工具栏) - [无效的CLSID:{710EB7A1-45ED-11D0-924A-0020AFC7AC4D}] - {710EB7A1-45ED-11D0-924A-0020AFC7AC4D} -
O4 - 未知 - HKLM\..\Run: [Kvsc3] [] C:\WINNT\8Sy.exe
O4 - 未知 - HKLM\..\Run: [UnlockerAssistant] [] "F:\BT下载\BitComet\1111\杀毒\Unlocker\UnlockerAssistant.exe"
O4 - 未知 - HKCU\..\Run: [BarExe] []
O8 - 未知 - Extra context menu item: &使用BitComet下载 - res://F:\BT下载\BitComet\BitComet.exe/AddLink.htm
O8 - 未知 - Extra context menu item: &使用BitComet下载全部链接 - res://F:\BT下载\BitComet\BitComet.exe/AddAllLink.htm
O8 - 未知 - Extra context menu item: &使用BitComet下载本页视频 - res://F:\BT下载\BitComet\BitComet.exe/AddVideo.htm
O8 - 未知 - Extra context menu item: 上传到QQ网络硬盘 - E:\QQ\AddToNetDisk.htm
O8 - 未知 - Extra context menu item: 使用迅雷下载 - C:\Program Files\Thunder Network\Program\geturl.htm
O8 - 未知 - Extra context menu item: 添加到QQ自定义面板 - E:\QQ\AddPanel.htm
O8 - 未知 - Extra context menu item: 添加到QQ表情 - E:\QQ\AddEmotion.htm
O8 - 未知 - Extra context menu item: 用QQ彩信发送该图片 - E:\QQ\SendMMS.htm
O9 - 未知 - Extra button: 启动迅雷5(HKLM) - C:\Program Files\Thunder Network\Thunder.exe
O9 - 未知 - Extra button: 腾讯QQ(HKLM) - E:\QQ\QQ.EXE
O16 - 未知 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - 未知 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl) - http://test.catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1177944749726
O16 - 未知 - DPF: {5EC7C511-CD0F-42E6-830C-1BD9882F3458} (PowerPlayer Control) - http://www.ppstream.com/bin/powerplayer.cab
O16 - 未知 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1176437372188
O16 - 未知 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc4.cab
O16 - 未知 - DPF: {E787FD25-8D7C-4693-AE67-9406BC6E22DF} (CPasswordEditCtrl Object) - https://password.qq.com/download/qqedit2.cab
O23 - 未知 - Service: AdminPwdSrv [Program:ChenPeng Email:Gamezcp@163.net] - c:\Tools\PwdSrv.exe - (running)
O23 - 未知 - Service: AppServer [Pubwin Application Server -- Apache Tomcat 5] - "C:\Program Files\Hintsoft\PubwinServer\appServ\bin\wrapper.exe" -s "C:\Program Files\Hintsoft\PubwinServer\appServ\conf\wrapper.conf" - (running)
O23 - 未知 - Service: MSSQLSERVER [MSSQLSERVER] - C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe -sMSSQLSERVER - (running)
O23 - 未知 - Service: OOCleverCache [O&O CleverCache Pro Description] - C:\Program Files\OO Software\CleverCache\OOCCSVC.exe - (running)
O23 - 未知 - Service: PubwinUpdate [Pubwin Server Update Program] - "C:\Program Files\Hintsoft\PubwinServer\version\bin\wrapper.exe" -s "C:\Program Files\Hintsoft\PubwinServer\version\conf\wrapper.conf" - (not running)
O23 - 未知 - Service: RemoteBoot [逍遥游RPL服务] - C:\WINNT\Rpl\rplsvc.exe - (not running)
O23 - 未知 - Service: SQLSERVERAGENT [SQLSERVERAGENT] - C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlagent.EXE -i MSSQLSERVER - (running)
O23 - 未知 - Service: TrkSvr [保存文件在域中卷之间移动的信息。] - C:\WINNT\system32\services.exe - (not running)

附件: 8747342007510131736.jpg

西门喝血 - 2007-5-10 13:28:00

100 - 安全 - Process: SMSS.EXE [该进程为会话管理子系统用以初始化系统变量，ms-dos驱动名称类似lpt1以及com，调用win32壳子系统和运行在windows登陆过程。] - C:\WINNT\System32\smss.exe
100 - 安全 - Process: CSRSS.EXE [客户端服务子系统，用以控制windows图形相关子系统。] - C:\WINNT\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesr
100 - 安全 - Process: WINLOGON.EXE [windows nt用户登陆程序。] - C:\WINNT\system32\winlogon.exe
100 - 安全 - Process: SERVICES.EXE [用于管理windows服务系统进程。] - C:\WINNT\system32\services.exe
100 - 安全 - Process: LSASS.EXE [本地安全权限服务控制windows安全机制。] - C:\WINNT\system32\lsass.exe
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINNT\system32\svchost -k rpcss
100 - 安全 - Process: CCenter.exe [瑞星杀毒软件控制台相关程序。] -
100 - 安全 - Process: RavMonD.exe [瑞星杀毒软件的一部分。] -
100 - 安全 - Process: spoolsv.exe [windows打印任务控制程序，用以打印机就绪。] - C:\WINNT\system32\spoolsv.exe
100 - 安全 - Process: PwdSrv.exe [一款无盘网络服务器的相关程序。] - c:\Tools\PwdSrv.exe
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINNT\System32\svchost.exe -k netsvcs
100 - 安全 - Process: LLSSRV.EXE [windows自带的许可证日志记录服务。] - C:\WINNT\System32\llssrv.exe
100 - 安全 - Process: sqlservr.exe [microsoft sql server用于架设sql服务。] - C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
100 - 安全 - Process: nvsvc32.exe [nvidia driver helper service在nvida显卡驱动中被安装。] - C:\WINNT\system32\nvsvc32.exe
100 - 安全 - Process: OOCCSVC.exe [一款系统增强工具相关程序。] - C:\Program Files\OO Software\CleverCache\OOCCSVC.exe
100 - 安全 - Process: mstask.exe [windows计划任务用于设定继承在什么时间或者什么日期备份或者运行。] - C:\WINNT\system32\MSTask.exe
100 - 安全 - Process: RavStub.exe [瑞星出品的杀毒软件相关程序。] - C:\Program Files\Rising\Rav\RavStub.exe
100 - 安全 - Process: SMAgent.exe [一个声卡相关软件。] - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
100 - 安全 - Process: WinMgmt.exe [windows management service透过windows management instrumentation data (wmi)技术处理来自应用客户端的请求。] - C:\WINNT\System32\WBEM\WinMgmt.exe
100 - 安全 - Process: explorer.exe [windows program manager或者windows explorer用于控制windows图形shell，包括开始菜单、任务栏，桌面和文件管理。] - C:\WINNT\Explorer.EXE
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINNT\system32\svchost.exe -k wugroup
100 - 安全 - Process: SMax4PNP.exe [声卡相关软件。] - C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
100 - 安全 - Process: RavTask.exe [瑞星出品的杀毒软件相关程序。] -
100 - 安全 - Process: RavMon.exe [瑞星杀毒软件防火墙。] -
100 - 安全 - Process: 360tray.exe [360安全卫士实时监控程序。] - C:\Program Files\360safe\safemon\360Tray.exe
100 - 安全 - Process: internat.exe [输入控制图标用于更改类似国家设置、键盘类型和日期格式。] - C:\WINNT\system32\internat.exe
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINNT\System32\svchost.exe -k tapisrv
100 - 安全 - Process: sqlmangr.exe [sql server服务管理器软件。] - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
100 - 安全 - Process: sqlagent.EXE [sql server服务管理器软件。] - C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlagent.EXE
100 - 安全 - Process: 360Safe.exe [360安全卫士相关程序。] - C:\Program Files\360safe\360safe.exe
R1 - 安全 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINNT\system32\blank.htm
R1 - 安全 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINNT\system32\blank.htm
O2 - 安全 - BHO: (BitComet Helper) - [下载软件BitComet的相关程序。] - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - F:\BT下载\BitComet\tools\BitCometBHO_1.1.3.28.dll
O3 - 安全 - Toolbar: (BitComet工具栏) - [bitcomet工具栏] - {3F1ABCDB-A875-46c1-8345-B72A4567E486} -
O3 - 安全 - Toolbar: (电台(&R)) - [是Windows Media Player播放器ActiveX控制相关文件。] - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - 安全 - HKLM\..\Run: [SoundMAXPnP] [analog device公司声卡驱动程序。] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - 安全 - HKLM\..\Run: [runeip] [卡卡上网安全助手相关程序。] C:\Program Files\Rising\AntiSpyware\runiep.exe
O4 - 安全 - HKLM\..\Run: [RavTask] [瑞星杀毒软件的任务计划程序。] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - 安全 - HKLM\..\Run: [360Safetray] [360safe实时保护功能模块。] C:\Program Files\360safe\safemon\360Tray.exe /start
O4 - 安全 - HKLM\..\Run: [StormCodec_Helper] [是暴风影音的插件。] "C:\Program Files\Storm Codec\StormSet.exe" /S /opti
O4 - 安全 - HKCU\..\Run: [internat.exe] [输入法在任务栏里的图标] internat.exe
O9 - 安全 - Extra button: 电台(HKLM) - C:\WINNT\web\related.htm
O16 - 安全 - DPF: 无效的CLSID：{0000000A-0000-0010-8000-00AA00389B71} ({0000000A-0000-0010-8000-00AA00389B71}) - http://download.microsoft.com/download/d/4/4/d446e8a9-3a86-4b59-bb19-f5bd11b40367/wmavax.CAB
O16 - 安全 - DPF: 无效的CLSID：{33564D57-0000-0010-8000-00AA00389B71} ({33564D57-0000-0010-8000-00AA00389B71}) - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - 安全 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (Windows升级工具V5) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1174366493058
O16 - 安全 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (中国工商银行个人银行) - https://mybank.icbc.com.cn/icbc/perbank/AXSafeControls.cab
O16 - 安全 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Flash播放器) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O23 - 安全 - Service: Adobe LM Service [adobe公司相关产品的许可服务程序。] - "C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe" - (not running)
O23 - 安全 - Service: Fax [微软Microsoft传真服务相关程序，该服务允许用户创建和发送传真到微软Office组件中。] - C:\WINNT\system32\faxsvc.exe - (not running)
O23 - 安全 - Service: NtFrs [在多个服务器间维护文件目录内容的文件同步。] - C:\WINNT\system32\ntfrs.exe - (not running)
O23 - 安全 - Service: NVSvc [是NVIDIA显示卡相关程序。] - C:\WINNT\system32\nvsvc32.exe - (running)
O23 - 安全 - Service: RsCCenter [是瑞星杀毒软件控制台相关程序。] - "C:\Program Files\Rising\Rav\CCenter.exe" - (running)
O23 - 安全 - Service: RsRavMon [是瑞星杀毒软件相关监控程序。] - "C:\Program Files\Rising\Rav\Ravmond.exe" - (running)
O23 - 安全 - Service: SoundMAX Agent Service (default) [是Analog SoundMAX声卡产品相关程序。] - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe - (running)

西门喝血 - 2007-5-10 13:29:00

O40 - Explorer.EXE - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\AntiSpyware\ieprot.dll - IE Protector - 369c1d78953b00cf8306e7028654092d

=======================================

O41 - BaseTDI - basetdi - C:\WINNT\system32\drivers\basetdi.sys - (running) - basetdi - Beijing Rising Technology Co., Ltd. - 0064810c1b03f2c889130b669a4ce937
O41 - ExpScaner - ExpScan.sys - C:\Program Files\Rising\Rav\ExpScan.sys - (running) - ExpScan.sys - - 5a690926c7181d5c0b2721016442c9c3
O41 - fasttrak - Promise FastTrak Series Driver for Win2000 - C:\WINNT\system32\drivers\Fasttrak.sys - (running) - Promise FastTrak Series Driver for Win2000 - Promise Technology, Inc. - d3a41b9167c11b0fa0cb7c61fc876982
O41 - HookCont - HookCont - C:\Program Files\Rising\Rav\HookCont.sys - (running) - HookCont - Rising - 3926cb7b005564bc77d6b40235c53817
O41 - HookReg - HookReg - C:\Program Files\Rising\Rav\HOOKREG.sys - (running) - - - 997c395147f8e5b3f714bdd112fe8945
O41 - HookSys - Hooksys - C:\Program Files\Rising\Rav\HookSys.sys - (running) - Hooksys - Rising - 265b67f85db6226f2439e13e7c1fa8bf
O41 - ISODrive - ISO DVD/CD-ROM Device Driver - C:\Program Files\UltraISO\drivers\ISODrive.sys - (running) - ISO DVD/CD-ROM Device Driver - EZB Systems, Inc. - 3ff410ccffcc6a25f33080b8f6e345cd
O41 - MEMSCAN - MemScan Driver - C:\Program Files\Rising\Rav\MemScan.sys - (running) - MemScan Driver - 瑞星软件有限公司 - 9811b256023dd985cbc5bad790e5bb84
O41 - npkcrypt - nProtect KeyCrypt Driver - E:\QQ\npkcrypt.sys - (running) - nProtect KeyCrypt Driver - INCA Internet Co., Ltd. - 8bcb281a2540e7aff0cd00f9878fe21f
O41 - RsAntiSpyware - RsBoot - C:\WINNT\system32\drivers\RsBoot.sys - (running) - RsBoot - Beijing Rising - c5b80d9d49751520be540db12b6a7730
O41 - RsNTGDI - RsNTGDI - C:\WINNT\system32\drivers\RsNTGdi.sys - (running) - RsNTGDI - Beijing Rising Technology Co., Ltd. - 17214e7b192cb93ff014fca1484b97ad
O41 - RSPPSYS - RSPPSYS.SYS - C:\Program Files\Rising\Rav\rsppsys.sys - (running) - RSPPSYS.SYS - Rising - f38c10d8c21626a4878ea16717e971fa
O41 - sptd - sptd - C:\WINNT\system32\drivers\sptd.sys - (running) - - -
O41 - 88747 - 88747 - C:\WINNT\system32\Drivers\88246.sys - (not running) - - -
O41 - atzbss04 - atzbss04 - C:\WINNT\system32\drivers\atzbss04.sys - (not running) - - -
O41 - Cdsys - Cdsys - C:\WINNT\system32\cdcd.sys - (not running) - - -
O41 - cunerw07 - cunerw07 - C:\WINNT\system32\drivers\cunerw07.sys - (not running) - - -
O41 - drwebv15 - drwebv15 - C:\WINNT\system32\drivers\drwebv15.sys - (not running) - - -
O41 - kmsinput - kmsinput - C:\WINNT\system32\drivers\kmsinput.sys - (not running) - - - f8d6ebcb50c02b42c5ffd5393229c6b6
O41 - KNetWch - KNetWch - C:\KAV\KNetWch.SYS - (not running) - - -
O41 - lfgtxc19 - lfgtxc19 - C:\WINNT\system32\drivers\lfgtxc19.sys - (not running) - - -
O41 - luynzz90 - luynzz90 - C:\WINNT\system32\drivers\luynzz90.sys - (not running) - - -
O41 - NPF - npf - C:\WINNT\system32\drivers\npf.sys - (not running) - npf - CACE Technologies - d21fee8db254ba762656878168ac1db6
O41 - nuschq69 - nuschq69 - C:\WINNT\system32\drivers\nuschq69.sys - (not running) - - -
O41 - zesubj11 - zesubj11 - C:\WINNT\system32\drivers\zesubj11.sys - (not running) - - -
O41 - zwgmnd03 - zwgmnd03 - C:\WINNT\system32\drivers\zwgmnd03.sys - (not running) - - -

西门喝血 - 2007-5-10 13:29:00

=======================================
360Safe.exe=3.3.0.1004
AntiAdwa.dll=3.3.0.1004
AntiEng.dll=3.3.0.1001
AntiActi.dll=2.0.0.3000
CleanHis.dll=3.0.2.1000
safelive.exe=1.0.0.2007
live.dll=1.0.0.1012

=======================================
操作历史报告：
----------清理恶评软件历史----------

2007-05-09 12:06
清理恶评软件 - meuevfznjceic.dll - C:\WINNT\RichDll.dll

2007-05-09 13:12
清理恶评软件 - 36sqgw7 - C:\WINNT\SERVICES.EXE
清理恶评软件 - meuevfznjceic.dll - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\$$a1.tmp
清理恶评软件 - services - C:\WINNT\services.exe

2007-05-09 14:01
清理恶评软件 - 易趣购物按钮 - C:\Documents and Settings\Administrator\Favorites\易趣购物.lnk

2007-05-09 14:17
清理恶评软件 - 易趣购物按钮 - C:\Documents and Settings\Administrator\Favorites\易趣购物.lnk

2007-05-09 14:20
清理恶评软件 - meuevfznjceic.dll -
2007-05-09 14:24
清理恶评软件 - 36sqgw7 - C:\WINNT\SERVICES.EXE
清理恶评软件 - services - C:\WINNT\services.exe

2007-05-09 17:01
清理恶评软件 - 伪TIMPlatform.exe木马 - C:\WINNT\system32\ctfnom.exe

----------全面诊断修复历史----------

2007-05-09 12:04
100 - 危险 - Logo1_.exe - C:\WINNT\Logo1_.exe
2007-05-09 13:12
100 - 危险 - Logo1_.exe - C:\WINNT\Logo1_.exe
2007-05-09 14:01
100 - 危险 - Logo1_.exe - C:\WINNT\Logo1_.exe
2007-05-09 14:01
O4 - 危险 - load - C:\WINNT\uninstall\rundl132.exe
2007-05-09 14:23
100 - 危险 - Logo1_.exe - C:\WINNT\Logo1_.exe
2007-05-09 15:58
O4 - 危险 - load - C:\WINNT\uninstall\rundl132.exe

=======================================

360安全卫士，彻底查杀各种流氓软件,全面保护系统安全,并赠送正版卡巴斯基V6.0
最新免费下载：http://www.360safe.com

瑞星卡卡安全论坛