瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 【求助】帮忙看下灰鸽子hijackthis日志;关于cmd图标疑惑

12   1  /  2  页   跳转

【求助】帮忙看下灰鸽子hijackthis日志;关于cmd图标疑惑

【求助】帮忙看下灰鸽子hijackthis日志;关于cmd图标疑惑

早上更新瑞星后仍然无法查杀病毒(如图1.所示)

于是按照版主的帖子下了hijackthis并且扫描日志如下:


Logfile of HijackThis v1.99.1
Scan saved at11:53:58, on 2006-8-28
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
d:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
d:\Program Files\Rising\Rav\Ravmond.exe
d:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
d:\Program Files\Rising\Rav\RavStub.exe
d:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
d:\program files\rising\rfw\RfwMain.exe
D:\Program Files\Rising\Rav\RavTask.exe
C:\Storm Downloader\StormDownloader.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Storm Downloader\TDUpdate.exe
D:\Program Files\Tencent\TT\TTraveler.exe
D:\Program Files\Rising\Rav\RsAgent.exe
C:\WINDOWS\msagent\AgentSvr.exe
D:\Program Files\Rising\Rav\RavMon.exe
F:\tools\155847200541134207\HijackThis.exe

R3 - URLSearchHook: Micrsoft SearchBar - {6D53ADB7-6AD5-4A59-BFE4-7B57D2F4AA89} - C:\WINDOWS\Downloaded Program Files\CONFLICT.1\SearchBar.dll
F2 - REG:system.ini: UserInit=userinit.exe,
O1 - Hosts: 59.34.197.239 www.baidu.com
O1 - Hosts: 59.34.197.239 baidu.com
O1 - Hosts: 59.34.197.239 www.sohu.com
O1 - Hosts: 59.34.197.239 sohu.com
O1 - Hosts: 59.34.197.239 www.sina.com
O1 - Hosts: 59.34.197.239 sina.com
O1 - Hosts: 59.34.197.239 www.sina.com.cn
O1 - Hosts: 59.34.197.239 sina.com.cn
O1 - Hosts: 59.34.197.239 www.163.com
O1 - Hosts: 59.34.197.239 163.com
O1 - Hosts: 59.34.197.239 www.google.com
O1 - Hosts: 59.34.197.239 google.com
O1 - Hosts: 59.34.197.239 www.qq.com
O1 - Hosts: 59.34.197.239 qq.com
O1 - Hosts: 59.34.197.239 www.hao123.com
O1 - Hosts: 59.34.197.239 hao123.com
O1 - Hosts: 59.34.197.239 about:blank
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v4.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - d:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: QQIEHelper - {5EB7CB50-E375-4718-B4C0-9AD12EFA2F84} - C:\WINDOWS\System32\aclayer.dll (file missing)
O2 - BHO: (no name) - {A9930D97-9CF0-42A0-A10D-4F28836579D5} - C:\PROGRA~1\KuGoo2\KUGOO3~1.OCX
O2 - BHO: XBTP03129 - {B07D1F6B-6B8C-4904-8EE8-5E5A2B4624B3} - C:\WINDOWS\DOWNLO~1\CONFLICT.1\SEARCH~1.DLL
O3 - Toolbar: (no name) - {D74EC18E-3DDD-4174-B1B1-949FE3B8366D} - (no file)
O3 - Toolbar: Micrsoft SearchBar - {6D53ADB7-6AD5-4A59-BFE4-7B57D2F4AA89} - C:\WINDOWS\Downloaded Program Files\CONFLICT.1\SearchBar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [RavTask] "d:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [MINI_BFYY] C:\Storm Downloader\StormDownloader.exe
O4 - HKLM\..\Run: [RfwMain] "d:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Kugoo] D:\Program Files\KuGoo2\KuGoo.exe
O4 - Global Startup: microsoft office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item:  >> 彩信发送 << - res://C:\PROGRA~1\MMSASS~1\Mmsass~1.dll/mms.htm
O8 - Extra context menu item: !搜一搜(&S) - res://C:\Program Files\YiSou\yisou.dll/232
O8 - Extra context menu item: &使用暴风下载器下载 - C:\Storm Downloader\geturl.htm
O8 - Extra context menu item: >>彩信发送<< - res://C:\PROGRA~1\MMSASS~1\mmsass~1.dll/mms.htm
O8 - Extra context menu item: >>粗陓楷冞<< - res://C:\PROGRA~1\MMSASS~1\Mmsass~1.dll/mms.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 使用KuGoo3下载(&K) - C:\Program Files\KuGoo2\KuGoo3DownX.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Program Files\Tencent\QQ\SendMMS.htm
O9 - Extra button: 免费精彩视频超流畅在线观看 - {022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com (file missing)
O9 - Extra 'Tools' menuitem: 播霸电视 - {022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com (file missing)
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: {6D53ADB7-6AD5-4A59-BFE4-7B57D2F4AA89} (Micrsoft SearchBar) - http://toolsbar.kuaiso.com/SearchBar_XP.cab
O16 - DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} (pCastPanel Class) - http://ps.itv.mop.com/dn/files/pCastCtl-1.0.0.90-signed.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{26D2BAD1-47DE-4EC7-9AFE-E19618DCA247}: NameServer = 202.106.0.20 202.106.46.151
O17 - HKLM\System\CCS\Services\Tcpip\..\{8111D69D-9621-4B10-A631-6F2103FA3A26}: NameServer = 192.168.1.1
O18 - Protocol: koboo - {7DEE9D05-FA0A-4416-A6F3-6537D0EAB6A6} - C:\WINDOWS\system32\mbprot.dll
O21 - SSODL: SysTime - {724C75F1-B757-408D-A50A-4CF99DA35D73} - C:\PROGRA~1\WinKld\WinKld.dll (file missing)
O23 - Service: BlueSoleil Hid Service - Unknown owner - d:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Pml Driver OEM12 - HP - C:\WINDOWS\system32\OEMipm12.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - d:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - d:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - d:\Program Files\Rising\Rav\Ravmond.exe
O23 - Service: svchost - Unknown owner - C:\WINDOWS\Hacker.com.cn.ini

==========================================================================
请问手工清毒具体操作方法?

==========================================================================
另,我发现C:目录下的cmd.exe的图标为一疑似金刚狼(《X战警》人物)的头像(如图3.所示),我从未该变过任何文件夹图标,请问是否是病毒?且我的百度搜索“网页”这项无法打开,其余“贴吧”“知道”及其他网页均访问正常,请问是否和病毒或注册表有关?
另外我之前清理完橙色八月病毒后,注册表信息仍旧可以在 瑞星注册表修复工具里看到(如图2.所示)请问有什么办法可以彻底清理注册表?

请各位帮帮小弟!谢谢!

附件附件:

下载次数:489
文件类型:image/pjpeg
文件大小:
上传时间:2006-8-28 13:00:17
描述:
预览信息:EXIF信息



最后编辑2006-08-28 15:50:55
分享到:
gototop
 

O23 - Service: svchost - Unknown owner - C:\WINDOWS\Hacker.com.cn.ini
删掉这个服务......
重起
删除对应文件
gototop
 

已经删除该文件,请问如何删除对应文件?
谢谢!
gototop
 

引用:
【水灵灵的鱼干的贴子】已经删除该文件,请问如何删除对应文件?
谢谢!
………………

找到C:\WINDOWS\Hacker.com.cn.ini--右击--删除.......
请把那个cmd.exe打包后发到s710207@eyou.com
gototop
 

那个cmd.exe反正不是好东西
正常的cmd.exe路径c:\windows\system32\cmd.exe
楼主的cmd.exe路径c:\cmd.exe

正常图片.......

附件附件:

下载次数:332
文件类型:application/octet-stream
文件大小:
上传时间:2006-8-28 13:13:14
描述:



gototop
 

cmd.exe已打包发送至您邮箱。

嗯,我机器也是查出落雪之后才比较关注c盘内不明文件。
朋友来家一般也不随便给他们使用机子了。

另:并无发现C:\WINDOWS\Hacker.com.cn.ini (已改变文件夹察看方式为可见扩展名、可见所有系统及隐藏文件)

gototop
 

O23 - Service: svchost - Unknown owner - C:\WINDOWS\Hacker.com.cn.ini
鸽子..安全模式...打开注册表编辑器,展开:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
搜索 svchost 删除..
删除
C:\WINDOWS\Hacker.com.cn.ini
gototop
 

修复
O2 - BHO: QQIEHelper - {5EB7CB50-E375-4718-B4C0-9AD12EFA2F84} - C:\WINDOWS\System32\aclayer.dll (file missing)
O3 - Toolbar: (no name) - {D74EC18E-3DDD-4174-B1B1-949FE3B8366D} - (no file)
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

http://www.pctutu.com/srmsdown.asp
下载超级兔子..用超级兔子清理王卸载流氓软件...(安全模式...)
gototop
 

把那个CMD.EXE 旁边的CMD.TXT 文件打开,看看都写些啥?也许有让你吃惊的东西。
gototop
 

引用:
【mopery的贴子】O23 - Service: svchost - Unknown owner - C:\WINDOWS\Hacker.com.cn.ini
鸽子..安全模式...打开注册表编辑器,展开:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
搜索 svchost 删除..
删除
C:\WINDOWS\Hacker.com.cn.ini

………………


刚从安全模式里退过来问一下,是删整个svchost文件夹还是删除查找"svchost"后显示出来的每一个单个文件?
谢谢!

引用:
http://www.pctutu.com/srmsdown.asp
下载超级兔子..用超级兔子清理王卸载流氓软件...(安全模式...)


机器并无装过或弹出过流氓软件的症状,请问卸载哪些?
谢谢!

引用:
把那个CMD.EXE 旁边的CMD.TXT 文件打开,看看都写些啥?也许有让你吃惊的东西。


打开后是关于QQ号的我看不懂得字符串。还有一个test.txt文档也看了,“Disconnected right now” 是否机器正被连接着?
请教如何处理此未知cmd文件?
谢谢!

====================================================
我按照楼上几位高手的方法处理鸽子先,等一下再过来看。
感谢大家的帮忙!
gototop
 
12   1  /  2  页   跳转
页面顶部
Powered by Discuz!NT