瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 求助!高手帮我看看啊!谢谢了!

12   1  /  2  页   跳转

求助!高手帮我看看啊!谢谢了!

求助!高手帮我看看啊!谢谢了!

Logfile of HijackThis v1.99.1
Scan saved at 14:50:32, on 2005-12-8
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
d:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS.0\System32\svchost.exe
d:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS.0\system32\spoolsv.exe
C:\WINDOWS.0\Explorer.EXE
d:\program files\rising\rfw\RfwMain.exe
d:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS.0\system32\rundll32.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\VM_STI.EXE
D:\Program Files\Rising\Rav\RavTask.exe
C:\WINDOWS.0\system32\ctfmon.exe
D:\Program Files\Tencent\qq\QQ.exe
D:\Program Files\Tencent\qq\TIMPlatform.exe
D:\Program Files\Maxthon\Maxthon.exe
D:\HijackThis.exe

O1 - Hosts: 202.85.22.10 bbs.100free.net
O1 - Hosts: 202.85.22.10 100free.net
O1 - Hosts: 202.85.22.10 www.100free.net
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS.0\system32\xunleibho_v8.dll
O2 - BHO: SohuDAIEHelper - {0CA51D02-7739-43EA-8D9A-1E8AD4327B03} - C:\Program Files\P4P\sodaie.dll (file missing)
O2 - BHO: Shareaza Web Download Hook - {0EEDB912-C5FA-486F-8334-57288578C627} - C:\Program Files\超级BT下载软件\Plugins\RazaWebHook.dll (file missing)
O2 - BHO: i&Bar搜索引擎 - {2E7D3330-EB94-4518-B0FE-E05379A5C1DA} - C:\PROGRA~1\iBar\10002\iBar.dll
O2 - BHO: Yahoo!Photo - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll (file missing)
O2 - BHO: DragSearch BHO - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL (file missing)
O2 - BHO: MMSAssist BHO - {6671A431-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\MMSASS~1\MMSASS~1.DLL (file missing)
O2 - BHO: std software - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - C:\WINDOWS.0\SYSTEM32\stdup.dll
O2 - BHO: CAP Class - {B8CCDD47-38E4-4CD2-B7FA-3B4B690F74BD} - C:\WINDOWS.0\system32\dtap.dll
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: i&Bar搜索引擎 - {2E7D3330-EB94-4518-B0FE-E05379A5C1DA} - C:\PROGRA~1\iBar\10002\iBar.dll
O3 - Toolbar: 捜狗直通车 - {DBBB7978-AF21-4EF4-9AD1-B2F4BC75696C} - C:\Program Files\P4P\ToolBar.dll (file missing)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS.0\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS.0\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS.0\VM_STI.EXE YXT USB PC CAMERA
O4 - HKLM\..\Run: [RavTask] "d:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [RfwMain] "D:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS.0\system32\ctfmon.exe
O9 - Extra button: 常用网址 - {36B39F01-7B48-44AD-A165-5849CD8EF562} - C:\WINDOWS.0\system32\SHDOCVW.DLL
O9 - Extra button: (no name) - {6671A433-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\MMSASS~1\MMSASS~1.DLL (file missing)
O9 - Extra 'Tools' menuitem: MMSAssist工具条设置 - {6671A433-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\MMSASS~1\MMSASS~1.DLL (file missing)
O9 - Extra button: 我的订阅 - {8755CE6E-0BF7-4441-8751-FB728941B0B4} - C:\Program Files\P4P\rss.dll (file missing)
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\WINDOWS.0\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\WINDOWS.0\system32\shdocvw.dll
O9 - Extra button: 易趣购物 - {DE607142-AC19-422e-865A-5D70ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=5 (file missing)
O9 - Extra 'Tools' menuitem: 易趣购物 - {DE607142-AC19-422e-865A-5D70ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=5 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.foundertech.com
O16 - DPF: {88734439-46D0-42C0-A13F-7E881EE550CF} (Filetran Control) - http://www.bluesky.cn/download/filetran.cab
O20 - AppInit_DLLs: C:\WINDOWS.0\system32\SoDAHK.DLL
O23 - Service: svchost (Netmans) - Unknown owner - C:\WINDOWS.0\svchost.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - d:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - d:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - d:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

最后编辑2005-12-09 16:37:54
分享到:
gototop
 

怎么没人啊!是不是天气太冷啊!
我的电脑确实中毒了!在页面的坐下角有个灰鸽子服务端的图标,在安全模式下用06版的瑞星查不到!按网页上的手动查找也找不到_hook.dll文件!急死了!还老是一进系统就死机!哪位高手帮帮忙啊!谢谢了!
gototop
 

O23 - Service: svchost (Netmans) - Unknown owner - C:\WINDOWS.0\svchost.exe

修复
重启
删除C:\WINDOWS.0\svchost.exe试试

若删除不了
用Unlocker工具删除试试
工具下载、使用参考http://forum.ikaka.com/topic.asp?board=28&artid=7471002
gototop
 

不好意思啊!我试了很久!还是不行啊!不管是直接删除还是用工具都删除不了!进程实在太多了!关不掉!一关就要关机了!哪位大侠能再指点小弟一下啊!真的很急
gototop
 

重新启动到安全模式(进入安全模式的方法:重新启动电脑, 开机自动检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式(Safe Mode)进入Windows。)

开始→控制面板→性能和维护→管理工具→服务→查找Local Network Service→右击→属性→启动类型→禁止→应用→停止→确定。

在注册表里搜索删除svchost.exe、svchost.dll、svchost_hook.dll相关项。


然后打开我的电脑→再点工具→打开文件夹选项→查看→把隐藏受保护的系统文件(推荐)和隐藏已知文件类型的扩展名的勾去掉→再显示所有文件→找到以下文件并删除:svchost.exe、svchost.dll、svchost_hook.dll(如果有的话)
gototop
 

是%windows%目录里的svchost.exe。
gototop
 

按楼上的提示操作,再修复以下
O1 - Hosts: 202.85.22.10 bbs.100free.net
O1 - Hosts: 202.85.22.10 100free.net
O1 - Hosts: 202.85.22.10 www.100free.net
O2 - BHO: MMSAssist BHO - {6671A431-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\MMSASS~1\MMSASS~1.DLL (file missing)
O2 - BHO: std software - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - C:\WINDOWS.0\SYSTEM32\stdup.dll
O2 - BHO: CAP Class - {B8CCDD47-38E4-4CD2-B7FA-3B4B690F74BD} - C:\WINDOWS.0\system32\dtap.dll
O9 - Extra button: (no name) - {6671A433-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\MMSASS~1\MMSASS~1.DLL (file missing)
O9 - Extra 'Tools' menuitem: MMSAssist工具条设置 - {6671A433-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\MMSASS~1\MMSASS~1.DLL (file missing)
同时删除上述相应路径下的*.dll文件

gototop
 

引用:
【小胡子的爱的贴子】不好意思啊!我试了很久!还是不行啊!不管是直接删除还是用工具都删除不了!进程实在太多了!关不掉!一关就要关机了!哪位大侠能再指点小弟一下啊!真的很急
...........................


注意操作步骤

修复
重启
删除
gototop
 

O20 - AppInit_DLLs: C:\WINDOWS.0\system32\SoDAHK.DLL
建议修复掉
gototop
 

引用:
【七情叉烧包的贴子】O20 - AppInit_DLLs: C:\WINDOWS.0\system32\SoDAHK.DLL
建议修复掉
...........................


那个好像是搜狐的
gototop
 
12   1  /  2  页   跳转
页面顶部
Powered by Discuz!NT