瑞星卡卡安全论坛

Logfile of HijackThis v1.99.1
Scan saved at 10:19:01, on 2009-3-22
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\暴风影音3.6\stormliv.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
D:\Program Files\双飞燕鼠标\Amoumain.exe
D:\Program Files\淘宝旺旺\WangWang.EXE
D:\Program Files\音速启动\VStart.exe
D:\Program Files\卡卡上网安全助手6.0\rstray.exe
C:\Program Files\Gemplus\GemSafe Libraries\BIN\Regtool.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
D:\Program Files\超级巡警\ast.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Messenger\msnmsgr.exe
D:\Warcraft III\WarHelper.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclToBTSrv.exe
D:\Program Files\世界之窗\TheWorld.exe
C:\WINDOWS\system32\conime.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\dwwin.exe
D:\Program Files\迅雷\Program\Thunder5.exe
C:\Documents and Settings\WangLi\桌面\ha_hijackthis_1991\HijackThis.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: Thunder AtOnce - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - D:\Program Files\迅雷\ComDlls\TDAtOnce_Now.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - D:\Program Files\迅雷\ComDlls\xunleiBHO_Now.dll
O2 - BHO: 卡卡上网安全助手 - {98B7C13A-E9CD-4959-8B46-FBEAB41E42A8} - C:\WINDOWS\system32\UrlFilter.dll
O2 - BHO: SecAddons Class - {AF69627B-8489-41C2-971A-B927DF7A5B0F} - D:\Program Files\超级巡警\SecAddons.dll
O2 - BHO: ntFilter - {C2EB616C-BFB0-4361-A02C-588F869A0E97} - C:\Program Files\Sucop\SecPlugin\SecPlugin.dll
O3 - Toolbar: 瑞星卡卡工具条(&R) - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\KakaTool.dll
O3 - Toolbar: 畅游巡警 - {B057BF9C-55B4-4AA4-938A-FE78617866B8} - C:\Program Files\Sucop\SecPlugin\SecPlugin.dll
O4 - HKLM\..\Run: [WheelMouse] D:\Program Files\双飞燕鼠标\Amoumain.exe
O4 - HKLM\..\Run: [WangWang] "D:\Program Files\淘宝旺旺\WangWang.EXE"
O4 - HKLM\..\Run: [VStart5.0] "D:\Program Files\音速启动\VStart.exe"
O4 - HKLM\..\Run: [runeip] "D:\Program Files\卡卡上网安全助手6.0\rstray.exe" /startup
O4 - HKLM\..\Run: [Regtool] C:\Program Files\Gemplus\GemSafe Libraries\BIN\Regtool.exe
O4 - HKLM\..\Run: [Anti-Spy Tools] D:\Program Files\超级巡警\ast.exe -min
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" /min /nosplash
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\暴风影音3.6\Codec\qttask.exe" -atboottime
O4 - HKLM\..\RunOnce: [KKDelay] D:\Program Files\卡卡上网安全助手6.0\RunOnce.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [WarHelper.exe] D:\Warcraft III\WarHelper.exe
O4 - HKCU\..\Run: [PC Suite Tray] "D:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - Global Startup: Bluetooth Manager.lnk = ?
O8 - Extra context menu item: 使用VV下载 - D:\Program Files\VV加速器\geturl.htm
O8 - Extra context menu item: 使用迅雷下载 - D:\Program Files\迅雷\Program\GetUrl.htm
O8 - Extra context menu item: 使用迅雷下载全部链接 - D:\Program Files\迅雷\Program\GetAllUrl.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java 控制台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O14 - IERESET.INF: START_PAGE_URL=http://vaio-online.sony.com/cn/
O16 - DPF: {1E0DFFCF-27FF-4574-849B-55007349FEDA} (iTrusPTA Class) - https://img.alipay.com/download/1101/aliedit.cab
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (EditCtrl Class) - https://img.alipay.com/download/2121/aliedit.cab
O16 - DPF: {5CB840B5-A94E-4AD9-B785-4866E3B04476} (InfoSecNetSign Class) - https://b2c.icbc.com.cn/icbc/ICBCNetSignG.dll
O16 - DPF: {7AEA10C5-B38F-4D72-A8F0-ED2D43D2A59E} (ICBCOCX Public Key Check) - https://b2c.icbc.com.cn/icbc/ICBCPKCheck.cab
O20 - AppInit_DLLs: kmon.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: psfus - C:\WINDOWS\SYSTEM32\fusstub.dll
O20 - Winlogon Notify: VESWinlogon - C:\WINDOWS\SYSTEM32\VESWinlogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Premium Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe
O23 - Service: Avira AntiVir Premium Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour 服务 (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Contrl Center of Storm Media (ccosm) - 北京暴风网际科技有限公司 - D:\Program Files\暴风影音3.6\stormliv.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
O23 - Service: iPod 服务 (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
O23 - Service: VAIO Entertainment Task Scheduler - Sony Corporation - C:\Program Files\Sony\VAIO Entertainment\VzTaskScheduler.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-IntegratedServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\IntegratedServer\HTTP (file missing)
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe" /Service=VAIOMediaPlatform-Mobile-Gateway /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Addons\Packages\Mobile\Gateway" /DisplayName="VAIO Media Gateway Server (file missing)
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

原帖由 aaccbbdd 于 2009-3-22 10:25:00 发表
因为
1.HJ日志看不出异常
2.HJ日志本身不完整
3.扫扫可能会有帮助
WINDOWS清理助手适用于莫名其妙的系统故障:default5: 

原帖由 aaccbbdd 于 2009-3-22 10:28:00 发表
你看看现在什么论坛用hijackthis
原因：1.N久没更新
2.项目严重短缺

想让分析的话
上sreng日志

Sreng官方下载
SREng/智能扫描(记得勾选“检查进程的数字签名)
等扫描完成,保存日志(LOG格式)
PS：如主程序SREng**.

原帖由 aaccbbdd 于 2009-3-22 10:52:00 发表
sreng-    启动项目 －－ 服务－－ 驱动程序之如下项删除：
(勾选隐藏已认证的微软项目,选中有问题的驱动/服务后，点"删除服务"，点"设置"按钮即可。注意弹出的窗口中要点"否"才是确认删除服务）

[Safe Mon 360 / SafeMon0]    <>
[Safe Mon 360 / SafeMo

原帖由 aaccbbdd 于 2009-3-22 11:09:00 发表
[Safe Mon 360 / SafeMon0]   

原帖由 aaccbbdd 于 2009-3-22 11:19:00 发表
小红伞？
不错呀
世界一流

杀毒软件
还是推荐国内的
瑞星也是不错的选择

小红伞，avast，大蜘蛛等
误报率均较高

原帖由 zoxmes 于 2009-3-22 11:46:00 发表
9DA3BB14.dat:default3: 这个是一个Rootkit级病毒木马，
楼主可以看一下这个帖子，学习一下
http://baike.360.cn/4071464/21399915.html
虽然已经清除掉，但还是预防一下，还有，杀软是看自己需求的，
别人不知道你的上网习惯的话，很难判断应该推荐哪款软件你使用的

原帖由 aaccbbdd 于 2009-3-22 11:45:00 发表
[Safe Mon 360 / SafeMon0]   
病毒的服务对应的就是
C:\windows\system32\9DA3BB14.dat

现在还报不？



我那时候就是中了什么autorun病毒变种什么的瑞星完全杀不出，换了nod立马就清除了所以留下阴影了— —b
瑞星09有了木马入侵拦截
U盘病毒根本不可能进入系统

原帖由 aaccbbdd 于 2009-3-22 12:08:00 发表
1.建议使用XDelBox删除以下文件： Xdelbox1.8下载地址
使用说明：先勾选抑制再生，删除时

原帖由 wanglizero 于 2009-3-22 12:23:00 发表
[quote] 原帖由 aaccbbdd 于 2009-3-22 12:08:00 发表
1.建议使用XDelBox删除以下文件： Xdelbox1.8下载地址
使用说明

原帖由 aaccbbdd 于 2009-3-22 12:59:00 发表
[quote] 原帖由 wanglizero 于 2009-3-22 12:23:00 发表
[quote] 原帖由 aaccbbdd 于 2009-3-22 12:08:00 发表
1.建议使用XDelBox删除以下文件： [url=http://www.dodudou.com/down/index.ph......

原帖由 天月来了 于 2009-3-22 13:30:00 发表
唉

一直就没见去我置顶贴找删除工具删除试试

还有用解压工具WinRAR打开看看，文件不在，就算了呗

还有这打开文件夹就那样异常的，我好象在剑盟见过一位求助的。

最终也没能解决问题，不知道什么原因。

我个人猜测是因为中毒后，系统部分注册表项被病毒破坏或影响，导致打开文件夹的相关东西异常。

日志看不出什么主要问题的时候，一般建议恢复系统备份，或重装系统了。