Adware.Win32.CPush.d 病毒怎么解决 bbs.ikaka.com

阿辉xx - 2007-8-1 14:05:00

Adware.Win32.CPush.d 病毒怎么解决!每天杀毒后都有几出来!杀不死了?請大家帮解决下!谢谢了!!!

[用户系统信息]Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

阿辉xx - 2007-8-1 14:09:00

瑞星卡卡电脑诊断日志 v1.30 (2007-8-1 13:56:12) 北京瑞星科技股份有限公司

注释:[A]表示该文件存在自启动关联;
[M]表示该文件在内存中;

+ 注册表自运行项目
+ 系统服务
+ HKLM\System\CurrentControlSet\Services
C-DillaCdaC11BA
[AM] 1. c:\windows\system32\drivers\cdac11ba.exe

NOD32krn
[AM] 2. c:\program files\eset\nod32krn.exe

ose
[A ] 3. c:\program files\common files\microsoft shared\source engine\ose.exe

RfwProxySrv
[A ] 4. d:\program files\rising\rfw\rfwproxy.exe

RfwService
[A ] 5. d:\program files\rising\rfw\rfwsrv.exe

RsCCenter
[A ] 6. d:\program files\rising\rav\ccenter.exe

RsRavMon
[A ] 7. d:\program files\rising\rav\ravmond.exe

+ 内核驱动
+ HKLM\System\CurrentControlSet\Services
ALCXSENS
[A ] 8. c:\windows\system32\drivers\alcxsens.sys

ALCXWDM
[A ] 9. c:\windows\system32\drivers\alcxwdm.sys

AMON
[A ] 10. c:\windows\system32\drivers\amon.sys

BaseTDI
[A ] 11. c:\windows\system32\drivers\basetdi.sys

CdaC15BA
[A ] 12. c:\windows\system32\drivers\cdac15ba.sys

ExpScaner
[A ] 13. d:\program files\rising\rav\expscan.sys

HookCont
[A ] 14. d:\program files\rising\rav\hookcont.sys

HookReg
[A ] 15. d:\program files\rising\rav\hookreg.sys

HookSys
[A ] 16. d:\program files\rising\rav\hooksys.sys

HookUrl
[A ] 17. d:\program files\rising\rfw\hookurl.sys

ialm
[A ] 18. c:\windows\system32\drivers\ialmnt5.sys

IdeBusDr
[A ] 19. c:\windows\system32\drivers\idebusdr.sys

IdeChnDr
[A ] 20. c:\windows\system32\drivers\idechndr.sys

MEMSCAN
[A ] 21. d:\program files\rising\rav\memscan.sys

mProcRs
[A ] 22. d:\program files\rising\rfw\mprocrs.sys

npkcrypt
[A ] 23. d:\program files\tencent\tm\tmdlls\npkcrypt.sys

QKeyService
[A ] 24. c:\windows\system32\keycrypt.sys

RsAntiSpyware
[A ] 25. c:\windows\system32\drivers\rsboot.sys

RsFwDrv
[A ] 26. d:\program files\rising\rfw\rsfwdrv.sys

RsNTGDI
[A ] 27. c:\windows\system32\drivers\rsntgdi.sys

RSPPSYS
[A ] 28. d:\program files\rising\rav\rsppsys.sys

Secdrv
[A ] 29. c:\windows\system32\drivers\secdrv.sys

usbsermptxp
[A ] 30. c:\windows\system32\drivers\usbsermptxp.sys

阿辉xx - 2007-8-1 14:10:00

+ 系统登陆自运行
+ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
igfxcui
[AM] 31. c:\windows\system32\igfxsrvc.dll

+ HKCU\Control Panel\Desktop
Scrnsave.exe
[A ] 32. c:\windows\system32\七彩泡泡.scr

+ IE浏览器加载模块
+ HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C}
[A ] 33. c:\windows\system32\kakatool.dll

{3F1ABCDB-A875-46c1-8345-B72A4567E486}
[A ] 34. c:\program files\bitcomet\bitcometbar\bitcometbar0.6.dll

+ HKCU\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks
{CFBFAE00-17A6-11D0-99CB-00C04FD64497}
[AM] 35. c:\windows\system32\ieframe.dll

+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
{00000AAA-A363-466E-BEF5-9BB68697AA7F}
[AM] 36. e:\program files\thunder network\webthunder\webthunderbho_now.dll

+ 资源管理器加载模块
+ HKLM\SOFTWARE\Classes\PROTOCOLS\Filter
text/xml
[AM] 37. c:\program files\common files\microsoft shared\office11\msoxmlmf.dll

+ HKLM\SOFTWARE\Classes\PROTOCOLS\Handler
mso-offdap
[A ] 38. c:\program files\common files\microsoft shared\web components\10\owc10.dll

+ HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}
[A ] 39. c:\windows\system32\ieudinit.exe

+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
HyperTerminal Icon Ext
[A ] 40. c:\windows\system32\hticons.dll

IE Search Band
[AM] 35. c:\windows\system32\ieframe.dll

Shell DocObject Viewer
[AM] 35. c:\windows\system32\ieframe.dll

InternetShortcut
[AM] 35. c:\windows\system32\ieframe.dll

Microsoft Url History Service
[AM] 35. c:\windows\system32\ieframe.dll

History
[AM] 35. c:\windows\system32\ieframe.dll

Temporary Internet Files
[AM] 35. c:\windows\system32\ieframe.dll

Temporary Internet Files
[AM] 35. c:\windows\system32\ieframe.dll

Microsoft Url Search Hook
[AM] 35. c:\windows\system32\ieframe.dll

The Internet
[AM] 35. c:\windows\system32\ieframe.dll

Internet Name Space
[AM] 35. c:\windows\system32\ieframe.dll

WinRAR shell extension
[A ] 41. c:\program files\winrar\rarext.dll

PicaView
[A ] 42. c:\program files\acdsee\picaview.dll

IE Microsoft BrowserBand
[AM] 35. c:\windows\system32\ieframe.dll

IE Fade Task
[AM] 35. c:\windows\system32\ieframe.dll

IE Menu Desk Bar
[AM] 35. c:\windows\system32\ieframe.dll

IE AutoComplete
[AM] 35. c:\windows\system32\ieframe.dll

IE Navigation Bar
[AM] 35. c:\windows\system32\ieframe.dll

IE Menu Site
[AM] 35. c:\windows\system32\ieframe.dll

IE Menu Band
[AM] 35. c:\windows\system32\ieframe.dll

IE Microsoft History AutoComplete List
[AM] 35. c:\windows\system32\ieframe.dll

IE Tracking Shell Menu
[AM] 35. c:\windows\system32\ieframe.dll

IE IShellFolderBand
[AM] 35. c:\windows\system32\ieframe.dll

IE BandProxy
[AM] 35. c:\windows\system32\ieframe.dll

IE MRU AutoComplete List
[AM] 35. c:\windows\system32\ieframe.dll

IE RSS Feeder Folder
[AM] 35. c:\windows\system32\ieframe.dll

IE Microsoft Shell Folder AutoComplete List
[AM] 35. c:\windows\system32\ieframe.dll

IE Microsoft Multiple AutoComplete List Container
[AM] 35. c:\windows\system32\ieframe.dll

Microsoft Browser Architecture
[AM] 35. c:\windows\system32\ieframe.dll

IE Shell Rebar BandSite
[AM] 35. c:\windows\system32\ieframe.dll

IE Shell Band Site Menu
[AM] 35. c:\windows\system32\ieframe.dll

&Links
[AM] 35. c:\windows\system32\ieframe.dll

IE Registry Tree Options Utility
[AM] 35. c:\windows\system32\ieframe.dll

IE User Assist
[AM] 35. c:\windows\system32\ieframe.dll

IE Custom MRU AutoCompleted List
[AM] 35. c:\windows\system32\ieframe.dll

Microsoft Office HTML Icon Handler
[AM] 43. c:\program files\microsoft office\office11\msohev.dll

Web Folders
[A ] 44. c:\program files\common files\microsoft shared\web folders\msonsext.dll

RISING
[AM] 45. c:\windows\system32\ravext.dll

阿辉xx - 2007-8-1 14:10:00

AutoCAD 数字签名图标覆盖处理程序
[AM] 46. c:\windows\system32\acsignicon.dll

Autodesk Drawing Preview
[A ] 47. c:\program files\common files\autodesk shared\thumbnail\acthumbnail16.dll

NOD32 Context Menu Shell Extension
[A ] 48. c:\program files\eset\nodshex.dll

+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
{32CD708B-60A7-4C00-9377-D73EAA495F0F}
[AM] 45. c:\windows\system32\ravext.dll

{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}
[AM] 49. c:\windows\system32\shlhook.dll

+ 用户登陆自运行项目
+ HKCU\Software\Microsoft\Windows\CurrentVersion\Run
bgswitch
[A ] 50. c:\windows\system32\bgswitch.exe

+ HKLM\Software\Microsoft\Windows\CurrentVersion\Run
IgfxTray
[AM] 51. c:\windows\system32\igfxtray.exe

HotKeysCmds
[A ] 52. c:\windows\system32\hkcmd.exe

SoundMan
[AM] 53. c:\windows\soundman.exe

RavTask
[A ] 54. d:\program files\rising\rav\ravtask.exe

RfwMain
[A ] 55. d:\program files\rising\rfw\rfwmain.exe

runeip
[AM] 56. d:\program files\rising\antispyware\runiep.exe

nod32kui
[AM] 57. c:\program files\eset\nod32kui.exe

+ 开机执行
+ HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
BootExecute
[A ] 58. c:\windows\system32\bsmain.exe

+ 映像劫持
+ HKCR\.exe
exefile\启用/禁用数字签名图标\Command
[A ] 59. c:\windows\system32\acsignopt.exe

+ HKCR\.html
htmlfile\Edit\Command
[A ] 60. c:\program files\microsoft office\office11\msohtmed.exe

htmlfile\Print\Command
[A ] 60. c:\program files\microsoft office\office11\msohtmed.exe

+ HKCR\.htm
htmlfile\Edit\Command
[A ] 60. c:\program files\microsoft office\office11\msohtmed.exe

htmlfile\Print\Command
[A ] 60. c:\program files\microsoft office\office11\msohtmed.exe

+ 其他自启动项目
+ C:\Documents and Settings\Administrator\「开始」菜单\程序\启动
QQ游戏启动加速程序.lnk
[A ] 61. e:\program files\tencent\qqgame\accel.exe

阿辉xx - 2007-8-1 14:11:00

正在运行的进程
+ 0000010c(268) CDAC11BA.EXE
00400000[00012000]
[AM] 1. c:\windows\system32\drivers\cdac11ba.exe

+ 000001ac(428) smss.exe

+ 000001cc(460) nod32krn.exe
00400000[0007E000]
[AM] 2. c:\program files\eset\nod32krn.exe

10000000[00007000]
[ M] 62. c:\program files\eset\nod32krr.dll

20500000[0003C000]
[ M] 63. c:\program files\eset\ps_amon.dll

01990000[00005000]
[ M] 64. c:\program files\eset\pr_amon.dll

21D00000[00027000]
[ M] 65. c:\program files\eset\ps_dmon.dll

019B0000[00003000]
[ M] 66. c:\program files\eset\pr_dmon.dll

22100000[00030000]
[ M] 67. c:\program files\eset\ps_emon.dll

01AF0000[00008000]
[ M] 68. c:\program files\eset\pr_emon.dll

20B00000[00045000]
[ M] 69. c:\windows\system32\imon.dll

01B10000[00008000]
[ M] 70. c:\program files\eset\pr_imon.dll

20E00000[00032000]
[ M] 71. c:\program files\eset\ps_mirr.dll

20F00000[00006000]
[ M] 72. c:\program files\eset\pr_mirr.dll

20800000[00043000]
[ M] 73. c:\program files\eset\ps_nod32.dll

01B50000[00004000]
[ M] 74. c:\program files\eset\pr_nod32.dll

20200000[00061000]
[ M] 75. c:\program files\eset\ps_upd.dll

01B70000[00006000]
[ M] 76. c:\program files\eset\pr_upd.dll

+ 000001e8(488) csrss.exe

+ 00000200(512) winlogon.exe
72C80000[00008000]
[ M] 77. c:\windows\system32\msacm32.drv

+ 0000022c(556) services.exe

+ 00000238(568) lsass.exe

+ 000002c8(712) Ras.exe
00400000[0013F000]
[ M] 78. d:\program files\rising\antispyware\ras.exe

00370000[00009000]
[ M] 79. c:\windows\system32\normaliz.dll

41D50000[00045000]
[ M] 80. c:\windows\system32\iertutil.dll

10000000[000A3000]
[ M] 81. d:\program files\rising\antispyware\rasgui.dll

017F0000[0001B000]
[ M] 82. d:\program files\rising\antispyware\ieprot.dll

422B0000[005CB000]
[AM] 35. c:\windows\system32\ieframe.dll

阿辉xx - 2007-8-1 14:11:00

+ 000002d0(720) svchost.exe

+ 000002fc(764) svchost.exe

+ 0000036c(876) svchost.exe
00E30000[00009000]
[ M] 79. c:\windows\system32\normaliz.dll

41D50000[00045000]
[ M] 80. c:\windows\system32\iertutil.dll

50E60000[0000C000]
[ M] 83. c:\windows\system32\wups2.dll

+ 000003d0(976) svchost.exe

+ 00000444(1092) svchost.exe
00800000[00009000]
[ M] 79. c:\windows\system32\normaliz.dll

41D50000[00045000]
[ M] 80. c:\windows\system32\iertutil.dll

+ 000004c0(1216) alg.exe

+ 00000528(1320) Explorer.EXE
00400000[00009000]
[ M] 79. c:\windows\system32\normaliz.dll

41D50000[00045000]
[ M] 80. c:\windows\system32\iertutil.dll

62830000[00026000]
[AM] 46. c:\windows\system32\acsignicon.dll

10000000[0001B000]
[AM] 45. c:\windows\system32\ravext.dll

00DE0000[00011000]
[AM] 49. c:\windows\system32\shlhook.dll

422B0000[005CB000]
[AM] 35. c:\windows\system32\ieframe.dll

628E0000[00039000]
[ M] 84. c:\program files\common files\autodesk shared\acsigncore16.dll

01350000[0001B000]
[ M] 82. d:\program files\rising\antispyware\ieprot.dll

72C80000[00008000]
[ M] 77. c:\windows\system32\msacm32.drv

01D80000[0003C000]
[ M] 85. c:\windows\system32\igfxpph.dll

01DC0000[0001E000]
[ M] 86. c:\windows\system32\hccutils.dll

01DF0000[00024000]
[ M] 87. c:\windows\system32\igfxres.dll

01E30000[00058000]
[AM] 31. c:\windows\system32\igfxsrvc.dll

01390000[00024000]
[ M] 88. c:\windows\system32\igfxdev.dll

23700000[0001A000]
[ M] 89. d:\program files\rising\rav\rscommon.dll

+ 000005ec(1516) spoolsv.exe

+ 0000066c(1644) igfxtray.exe
00400000[0002B000]
[AM] 51. c:\windows\system32\igfxtray.exe

10000000[0001E000]
[ M] 86. c:\windows\system32\hccutils.dll

00A90000[00024000]
[ M] 88. c:\windows\system32\igfxdev.dll

00B60000[0001B000]
[ M] 82. d:\program files\rising\antispyware\ieprot.dll

00CA0000[00058000]
[AM] 31. c:\windows\system32\igfxsrvc.dll

00D10000[00024000]
[ M] 87. c:\windows\system32\igfxres.dll

00D50000[00131000]
[ M] 90. c:\windows\system32\igfxress.dll

+ 00000690(1680) SOUNDMAN.EXE
00400000[00014000]
[AM] 53. c:\windows\soundman.exe

10000000[0001B000]
[ M] 82. d:\program files\rising\antispyware\ieprot.dll

+ 00000700(1792) runiep.exe
00400000[00012000]
[AM] 56. d:\program files\rising\antispyware\runiep.exe

00C00000[0001B000]
[ M] 82. d:\program files\rising\antispyware\ieprot.dll

+ 00000760(1888) nod32kui.exe
00400000[000EC000]
[AM] 57. c:\program files\eset\nod32kui.exe

10000000[0000E000]
[ M] 91. c:\program files\eset\nod32rui.dll

00CC0000[0001B000]
[ M] 82. d:\program files\rising\antispyware\ieprot.dll

20700000[0002E000]
[ M] 92. c:\program files\eset\pu_amon.dll

00F70000[00005000]
[ M] 64. c:\program files\eset\pr_amon.dll

21E00000[0002B000]
[ M] 93. c:\program files\eset\pu_dmon.dll

010A0000[00003000]
[ M] 66. c:\program files\eset\pr_dmon.dll

22200000[00030000]
[ M] 94. c:\program files\eset\pu_emon.dll

010B0000[00008000]
[ M] 68. c:\program files\eset\pr_emon.dll

20D00000[00030000]
[ M] 95. c:\program files\eset\pu_imon.dll

010C0000[00008000]
[ M] 70. c:\program files\eset\pr_imon.dll

21000000[00021000]
[ M] 96. c:\program files\eset\pu_mirr.dll

20F00000[00006000]
[ M] 72. c:\program files\eset\pr_mirr.dll

20A00000[0002B000]
[ M] 97. c:\program files\eset\pu_nod32.dll

010D0000[00004000]
[ M] 74. c:\program files\eset\pr_nod32.dll

20400000[0002F000]
[ M] 98. c:\program files\eset\pu_upd.dll

010E0000[00006000]
[ M] 76. c:\program files\eset\pr_upd.dll

+ 00000784(1924) RavStub.exe
00400000[00018000]
[ M] 99. d:\program files\rising\rav\ravstub.exe

10000000[0001B000]
[ M] 100. d:\program files\rising\rav\rscommx.dll

23700000[0001A000]
[ M] 89. d:\program files\rising\rav\rscommon.dll

+ 00000788(1928) ctfmon.exe
10000000[0001B000]
[ M] 82. d:\program files\rising\antispyware\ieprot.dll

+ 000009c4(2500) svchost.exe

+ 00000a28(2600) RsLogVw.exe
00400000[0002C000]
[ M] 101. d:\program files\rising\rav\rslogvw.exe

10000000[0001B000]
[ M] 100. d:\program files\rising\rav\rscommx.dll

26600000[0007D000]
[ M] 102. d:\program files\rising\rav\rsguilib.dll

23800000[0001A000]
[ M] 103. d:\program files\rising\rav\rsxml.dll

23900000[00031000]
[ M] 104. d:\program files\rising\rav\pngdll.dll

23700000[0001A000]
[ M] 89. d:\program files\rising\rav\rscommon.dll

0AAD0000[0001B000]
[ M] 82. d:\program files\rising\antispyware\ieprot.dll

13100000[0002E000]
[ M] 105. d:\program files\rising\rav\libload.dll

0BC50000[0002C000]
[ M] 106. d:\program files\rising\rav\viruslib.dll

41D50000[00045000]
[ M] 80. c:\windows\system32\iertutil.dll

+ 00000ec8(3784) IEXPLORE.EXE
41D50000[00045000]
[ M] 80. c:\windows\system32\iertutil.dll

422B0000[005CB000]
[AM] 35. c:\windows\system32\ieframe.dll

5DFF0000[0002F000]
[ M] 107. c:\windows\system32\ieui.dll

47060000[00021000]
[ M] 108. c:\windows\system32\xmllite.dll

62830000[00026000]
[AM] 46. c:\windows\system32\acsignicon.dll

325C0000[00012000]
[AM] 43. c:\program files\microsoft office\office11\msohev.dll

61930000[0004A000]
[ M] 109. c:\program files\internet explorer\ieproxy.dll

10000000[0001B000]
[ M] 82. d:\program files\rising\antispyware\ieprot.dll

01580000[00009000]
[ M] 79. c:\windows\system32\normaliz.dll

02120000[00019000]
[AM] 36. e:\program files\thunder network\webthunder\webthunderbho_now.dll

43560000[00060000]
[ M] 110. c:\windows\system32\ieapfltr.dll

72C80000[00008000]
[ M] 77. c:\windows\system32\msacm32.drv

30000000[002EE000]
[ M] 111. c:\windows\system32\macromed\flash\flash9b.ocx

06A50000[0000B000]
[AM] 37. c:\program files\common files\microsoft shared\office11\msoxmlmf.dll

糊弄局门口 - 2007-8-7 11:32:00

该用户帖子内容已被屏蔽

爱咔咔 - 2007-8-7 11:36:00

该用户帖子内容已被屏蔽

瑞星卡卡安全论坛