瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 重装格式都不行!!!!日志及图!!

123   1  /  3  页   跳转

重装格式都不行!!!!日志及图!!

重装格式都不行!!!!日志及图!!

我的电脑经常重启,查杀病毒,可每次上机继续出现!!病毒名字:Win32.Troj.Look2Me.g.237191还有个Win32.Hack.IRCBot.cy.8224
而且还经常弹出一些网页,及两个小窗口,桌面上也莫名其妙出现一些图标,如图:
下面是扫描的日志:
2006-07-31,18:06:09

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195)
- 管理权限用户 - 完整功能

以下内容被选中:
    所有的启动项目(包括注册表、启动文件夹、服务等)
    浏览器加载项
    正在运行的进程(包括进程模块信息)
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <Internat.exe><internat.exe>  [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <Synchronization Manager><mobsync.exe /logon>  [Microsoft Corporation]
    <NvCplDaemon><RUNDLL32.EXE NvQTwk,NvCplDaemon initialize>  []
    <defender><C:\\dfndrfg_7.exe>  [&%&%&%&%%&%&%%&%]
    <keyboard><C:\\kybrdfg_7.exe>  [#$*&$*&#&$&*$&#&*$&*#$&*]
    <SKYNET Personal FireWall><D:\PROGRA~1\SKYNET\FIREWALL\pfw.exe>  [广州众达天网技术有限公司]
    <newname><C:\\nwnmfg_7.exe>  [&#&*&$*#&*$&*#&$*&*&$*&#*&#*]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [Microsoft Corporation]
    <Userinit><C:\WINNT\system32\userinit.exe,>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><NVDESK32.DLL>  [NVIDIA Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}><C:\WINNT\system32\ljjihfd.dll>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\CSCSettings]
    <WinlogonNotify: CSCSettings><C:\WINNT\system32\p6n80g5ue6.dll>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\IntlRun]
    <WinlogonNotify: IntlRun><C:\WINNT\system32\UBERENV.DLL>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\IPConfTSP]
    <WinlogonNotify: IPConfTSP><C:\WINNT\system32\mvafd.dll>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\khfgdda]
    <WinlogonNotify: khfgdda><khfgdda.dll>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ljjihfd]
    <WinlogonNotify: ljjihfd><ljjihfd.dll>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ModuleUsage]
    <WinlogonNotify: ModuleUsage><C:\WINNT\system32\mvafd.dll>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\rqrsrro]
    <WinlogonNotify: rqrsrro><rqrsrro.dll>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Shell Extensions]
    <WinlogonNotify: Shell Extensions><C:\WINNT\system32\rjsutils.dll>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ShellScrap]
    <WinlogonNotify: ShellScrap><C:\WINNT\system32\rjsutils.dll>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sstro]
    <WinlogonNotify: sstro><C:\WINNT\system32\sstro.dll>  []

==================================

附件附件:

下载次数:459
文件类型:application/octet-stream
文件大小:
上传时间:2006-7-31 20:20:09
描述:



最后编辑2006-08-01 10:51:13
分享到:
gototop
 

这个日志不会看。用HJ扫。给我
gototop
 

启动文件夹
[河南网通宽带用户客户端]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\河南网通宽带用户客户端.lnk><N>

==================================
服务
[Command Service / cmdService]
  <C:\WINNT\QWRtaW5pc3RyYXRvcg\command.exe><N/A>
[Logical Disk Manager Administrative Service / dmadmin]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[Kingsoft Personal Firewall Service / KPfwSvc]
  <"D:\Program Files\jinshan\KPfwSvc.EXE"><Kingsoft Corporation>
[Network Monitor / Network Monitor]
  <C:\Program Files\Network Monitor\netmon.exe service><N/A>
[NVIDIA Driver Helper Service / NVSvc]
  <C:\WINNT\system32\nvsvc32.exe><NVIDIA Corporation>
[Microsoft Windows Spool Service / Windows Spool Service]
  <"C:\WINNT\wdfmgr.exe"><N/A>

==================================
浏览器加载项
[]
  {894647B4-12AF-40DE-A89A-49B8E19F17E5} <C:\WINNT\system32\sstro.dll, N/A>
[信息检索(&R)]
  {92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[@msdxmLC.dll,-1@2052,电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[上传到QQ网络硬盘]
  <D:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
  <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
  <D:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <D:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <D:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================
gototop
 

正在运行的进程
[PID: 1188][C:\WINNT\system32\rundll32.exe]  <Microsoft Corporation><5.00.2134.1>
    [C:\WINNT\system32\NVDESK32.DLL]  <NVIDIA Corporation><5.13.01.2183>
    [C:\WINNT\QWRtaW5pc3RyYXRvcg\asappsrv.dll]  <><2.1.3.466>
    [C:\WINNT\system32\bWtt.dll]  <N/A><N/A>
[PID: 2120][C:\WINNT\Explorer.EXE]  <Microsoft Corporation><5.00.3700.6690>
    [C:\WINNT\system32\NVDESK32.DLL]  <NVIDIA Corporation><5.13.01.2183>
    [C:\WINNT\QWRtaW5pc3RyYXRvcg\asappsrv.dll]  <><2.1.3.466>
    [C:\WINNT\system32\sstro.dll]  <N/A><N/A>
    [C:\WINNT\system32\bWtt.dll]  <N/A><N/A>
    [C:\WINNT\system32\ljjihfd.dll]  <N/A><N/A>
    [C:\Program Files\WinRAR\rarext.dll]  <N/A><N/A>
[PID: 2240][C:\dfndrfg_7.exe]  <&%&%&%&%%&%&%%&%><1.00.0164>
    [C:\WINNT\system32\NVDESK32.DLL]  <NVIDIA Corporation><5.13.01.2183>
    [C:\WINNT\QWRtaW5pc3RyYXRvcg\asappsrv.dll]  <><2.1.3.466>
[PID: 2252][C:\kybrdfg_7.exe]  <#$*&$*&#&$&*$&#&*$&*#$&*><1.00.0116>
    [C:\WINNT\system32\NVDESK32.DLL]  <NVIDIA Corporation><5.13.01.2183>
    [C:\WINNT\QWRtaW5pc3RyYXRvcg\asappsrv.dll]  <><2.1.3.466>
[PID: 2268][D:\PROGRA~1\SKYNET\FIREWALL\pfw.exe]  <广州众达天网技术有限公司><2.7.7.1004>
    [D:\PROGRA~1\SKYNET\FIREWALL\SKYMISC.DLL]  <N/A><N/A>
    [D:\PROGRA~1\SKYNET\FIREWALL\COMPRESSWRAP.DLL]  <N/A><N/A>
    [C:\WINNT\system32\NVDESK32.DLL]  <NVIDIA Corporation><5.13.01.2183>
    [C:\WINNT\QWRtaW5pc3RyYXRvcg\asappsrv.dll]  <><2.1.3.466>
[PID: 2100][C:\WINNT\system32\internat.exe]  <Microsoft Corporation><5.00.2920.0000>
    [C:\WINNT\system32\NVDESK32.DLL]  <NVIDIA Corporation><5.13.01.2183>
    [C:\WINNT\QWRtaW5pc3RyYXRvcg\asappsrv.dll]  <><2.1.3.466>
[PID: 2312][C:\Program Files\racer-henan-cnc\racer.exe]  <Putian Runway><2, 0, 51, 92>
    [C:\WINNT\system32\NVDESK32.DLL]  <NVIDIA Corporation><5.13.01.2183>
    [C:\WINNT\QWRtaW5pc3RyYXRvcg\asappsrv.dll]  <><2.1.3.466>
    [C:\Program Files\racer-henan-cnc\rwxre.dll]  <Mozilla Foundation><1.7.3: 2005040616>
    [C:\Program Files\racer-henan-cnc\nspr4.dll]  <Netscape Communications Corporation><4.5 Beta>
    [C:\Program Files\racer-henan-cnc\xpcom.dll]  <Mozilla Foundation><1.7.3: 2005040616>
    [C:\Program Files\racer-henan-cnc\nss3.dll]  <Netscape Communications Corporation><3.9.1>
    [C:\Program Files\racer-henan-cnc\softokn3.dll]  <Netscape Communications Corporation><3.9.1>
    [C:\Program Files\racer-henan-cnc\gkgfx.dll]  <Mozilla Foundation><1.7.3: 2005040616>
    [C:\Program Files\racer-henan-cnc\js3250.dll]  <Netscape Communications Corporation><4.0>
    [C:\Program Files\racer-henan-cnc\components\racer_base_comp.dll]  <Putian Runway><2,0,47,87>
    [C:\Program Files\racer-henan-cnc\xpcom_compat.dll]  <Mozilla Foundation><1.7.3: 2005040616>
    [C:\Program Files\racer-henan-cnc\racer_base.dll]  <Putian Runway><2,0,47,87>
    [C:\Program Files\racer-henan-cnc\components\pipnss.dll]  <Mozilla Foundation><1.7.3: 2005040616>
    [C:\Program Files\racer-henan-cnc\components\gklayout.dll]  <Mozilla Foundation><1.7.3: 2005040616>
    [C:\Program Files\racer-henan-cnc\components\jar50.dll]  <Mozilla Foundation><1.7.3: 2005040616>
    [C:\Program Files\racer-henan-cnc\components\xpcom_compat_c.dll]  <Mozilla Foundation><1.7.3: 2005040616>
    [C:\Program Files\racer-henan-cnc\components\racer_ad_comp.dll]  <Putian Runway><2,0,47,87>
    [C:\Program Files\racer-henan-cnc\components\racer_access_dhcpplus.dll]  <Putian Runway><2,0,47,87>
    [C:\Program Files\racer-henan-cnc\dhcpplus.dll]  <北京润汇科技有限公司><0, 13, 21, 45>
    [C:\Program Files\racer-henan-cnc\components\racer_nss4_comp.dll]  <Putian Runway><2,0,47,87>
    [C:\Program Files\racer-henan-cnc\nss4.dll]  <北京普天润汇科技有限公司><1, 0, 0, 3>
    [C:\Program Files\racer-henan-cnc\wpcap.dll]  <Politecnico di Torino><3, 0, 0, 18>
    [C:\Program Files\racer-henan-cnc\pthreadVC.dll]  <N/A><N/A>
    [C:\Program Files\racer-henan-cnc\packet.dll]  <Politecnico di Torino><3, 0, 0, 18>
[PID: 392][C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE]  <Microsoft Corporation><6.00.2800.1106>
    [C:\WINNT\system32\NVDESK32.DLL]  <NVIDIA Corporation><5.13.01.2183>
    [C:\WINNT\QWRtaW5pc3RyYXRvcg\asappsrv.dll]  <><2.1.3.466>
    [C:\WINNT\system32\sstro.dll]  <N/A><N/A>
[PID: 2320][C:\Program Files\Internet Explorer\iexplore.exe]  <Microsoft Corporation><6.00.2800.1106>
    [C:\WINNT\system32\NVDESK32.DLL]  <NVIDIA Corporation><5.13.01.2183>
    [C:\WINNT\QWRtaW5pc3RyYXRvcg\asappsrv.dll]  <><2.1.3.466>
    [C:\WINNT\system32\sstro.dll]  <N/A><N/A>
    [C:\WINNT\system32\Macromed\Flash\Flash9.ocx]  <Adobe Systems, Inc.><9,0,16,0>
[PID: 752][C:\Program Files\racer-henan-cnc\RacerKp.exe]  <北京润汇科技有限公司><1, 0, 0, 1>
    [C:\WINNT\system32\NVDESK32.DLL]  <NVIDIA Corporation><5.13.01.2183>
    [C:\WINNT\QWRtaW5pc3RyYXRvcg\asappsrv.dll]  <><2.1.3.466>
[PID: 2484][C:\WINNT\regedit.exe]  <Microsoft Corporation><5.00.2195.6707>
    [C:\WINNT\system32\NVDESK32.DLL]  <NVIDIA Corporation><5.13.01.2183>
    [C:\WINNT\QWRtaW5pc3RyYXRvcg\asappsrv.dll]  <><2.1.3.466>
[PID: 2080][D:\Program Files\jinshan\KAVLog2.EXE]  <Kingsoft Corporation><2006.3.29.41>
    [C:\WINNT\system32\NVDESK32.DLL]  <NVIDIA Corporation><5.13.01.2183>
    [C:\WINNT\QWRtaW5pc3RyYXRvcg\asappsrv.dll]  <><2.1.3.466>
    [D:\Program Files\jinshan\KAConfig.DLL]  <Kingsoft Corporation><2005, 3, 23, 30>
[PID: 3512][D:\Program Files\PIXELA\ImageMixer\IMxVCDSO.exe]  <PIXELA Corporation><2, 0, 0, 9>
    [D:\Program Files\PIXELA\ImageMixer\Exif.dll]  <FUJI PHOTO FILM CO., LTD><2, 4, 3, 0>
    [D:\Program Files\PIXELA\ImageMixer\MpegSplitterMixerLibrary.dll]  <PiXELA Corp.><1, 0, 4, 5>
    [D:\Program Files\PIXELA\ImageMixer\MpgBasic.dll]  <PiXELA Corp.><1, 0, 4, 5>
    [D:\Program Files\PIXELA\ImageMixer\dvdcdlib.dll]  <Pixela Corporation><3, 0, 0, 7>
    [D:\Program Files\PIXELA\ImageMixer\EncoderInterface.dll]  <PiXELA Corp.><1, 0, 4, 5>
    [D:\Program Files\PIXELA\ImageMixer\EncodeToMpegLibrary.dll]  <PiXELA Corp.><1, 0, 4, 5>
    [D:\Program Files\PIXELA\ImageMixer\px_mpegv.dll]  <Pixela Corporation (C)><1, 5, 16, 0>
    [D:\Program Files\PIXELA\ImageMixer\px_mpega.dll]  <N/A><N/A>
    [D:\Program Files\PIXELA\ImageMixer\PxScalingFilter.dll]  <pixela><1, 1, 0, 0>
    [D:\Program Files\PIXELA\ImageMixer\px_mpegvd.dll]  <ピクセラ><1, 1, 9, 0>
    [D:\Program Files\PIXELA\ImageMixer\px_mpeg_util.dll]  <ピクセラ><1, 0, 7, 0>
    [D:\Program Files\PIXELA\ImageMixer\improvement_filter.dll]  <pixela corporation><1, 0, 0, 6>
    [D:\Program Files\PIXELA\ImageMixer\px_filter.dll]  <N/A><N/A>
    [D:\Program Files\PIXELA\ImageMixer\dvdAuthoring.dll]  <><1, 1, 0, 7>
    [D:\Program Files\PIXELA\ImageMixer\WriteCheck.dll]  <><1, 0, 0, 1>
    [D:\Program Files\PIXELA\ImageMixer\BGOLDLIB.dll]  <B.H.A Co.,Ltd.><7, 2, 1, 0>
    [D:\Program Files\PIXELA\ImageMixer\CDRBSVSD.DLL]  <B.H.A Co.,Ltd.><7, 6, 2, 0>
    [D:\Program Files\PIXELA\ImageMixer\OSR1HELP.DLL]  <B.H.A Co.,Ltd.><1, 0, 1, 0>
    [C:\WINNT\system32\NVDESK32.DLL]  <NVIDIA Corporation><5.13.01.2183>
    [C:\WINNT\QWRtaW5pc3RyYXRvcg\asappsrv.dll]  <><2.1.3.466>
    [D:\Program Files\PIXELA\ImageMixer\ImxPsSpl.ax]  <PIXELA Corp.><1, 0, 5, 0>
    [D:\Program Files\PIXELA\ImageMixer\ImageMixerVCDRes.dll]  <N/A><N/A>
    [C:\WINNT\system32\msdmo.dll]  <N/A><N/A>
[PID: 3524][D:\Program Files\新建文件夹\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>
    [C:\WINNT\system32\NVDESK32.DLL]  <NVIDIA Corporation><5.13.01.2183>
    [C:\WINNT\QWRtaW5pc3RyYXRvcg\asappsrv.dll]  <><2.1.3.466>

==================================
gototop
 

文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  Error. ["hh.exe" %1]
.HLP  Error. [winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================
gototop
 

救救我吧!!!!
gototop
 

HJ的以前用过,我的电脑用不成,才用这个的,我的电脑就是这么奇怪啊~~~~~~~~~~~
gototop
 

别都不理我呀,真的要崩溃了!!!
gototop
 

光看你的启动项就晕了
楼主请到http://forum.ikaka.com/topic.asp?board=28&artid=8105899
下载HijackThis
下载后运行HijackThis.rar,再运行HijackThis.exe
单机"扫描日志并保存日志"
把保存的日志复制粘贴上来.
gototop
 

【回复“飞侠小猪”的帖子】
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<defender><C:\\dfndrfg_7.exe> [&%&%&%&%%&%&%%&%]
<keyboard><C:\\kybrdfg_7.exe> [#$*&$*�&$&*$�&*$&*#$&*]
<newname><C:\\nwnmfg_7.exe> [�&*&$*#&*$&*#&$*&*&$*�*�*]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}><C:\WINNT\system32\ljjihfd.dll> []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\CSCSettings]
<WinlogonNotify: CSCSettings><C:\WINNT\system32\p6n80g5ue6.dll> []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\IntlRun]
<WinlogonNotify: IntlRun><C:\WINNT\system32\UBERENV.DLL> []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\IPConfTSP]
<WinlogonNotify: IPConfTSP><C:\WINNT\system32\mvafd.dll> []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\khfgdda]
<WinlogonNotify: khfgdda><khfgdda.dll> []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ljjihfd]
<WinlogonNotify: ljjihfd><ljjihfd.dll> []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\rqrsrro]
<WinlogonNotify: rqrsrro><rqrsrro.dll> []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Shell Extensions]
<WinlogonNotify: Shell Extensions><C:\WINNT\system32\rjsutils.dll> []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ShellScrap]
<WinlogonNotify: ShellScrap><C:\WINNT\system32\rjsutils.dll> []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sstro]
<WinlogonNotify: sstro><C:\WINNT\system32\sstro.dll> []

[Microsoft Windows Spool Service / Windows Spool Service]
<"C:\WINNT\wdfmgr.exe"><N/A>




汗!!
这都是什么呀?????
gototop
 
123   1  /  3  页   跳转
页面顶部
Powered by Discuz!NT