瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 12月11日半夜求助:中木马,高手或版主帮我看看日志..【求助】

1   1  /  1  页   跳转

12月11日半夜求助:中木马,高手或版主帮我看看日志..【求助】

12月11日半夜求助:中木马,高手或版主帮我看看日志..【求助】

HijackThis_zww汉化版扫描日志 V1.99.1
保存于      1:55:49, 日期 2005-12-11
操作系统:  Windows XP SP2 (WinNT 5.01.2600)
浏览器:    Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程:         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
D:\解压文件夹\新建文件夹2\HijackThis1991zww.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O1 - Hosts: 218.108.245.69 www.5d.cn
O1 - Hosts: 61.151.239.49 www.ahcomic.com
O1 - Hosts: 202.101.62.21 forum.cgercn.com
O1 - Hosts: 211.155.251.141 www.cgtimes.com.cn
O1 - Hosts: 218.75.64.246 www.chinadfcg.com
O1 - Hosts: 218.78.211.225 www.chinadv.com
O1 - Hosts: 61.139.76.181 www.netyi.net
O1 - Hosts: 61.152.102.77 www.mbcomic.com
O1 - Hosts: 61.55.138.187 pop.pcpop.com
O1 - Hosts: 219.239.89.53 www.enet.com.cn
O1 - Hosts: 220.168.167.206 poser.yyfet.gov.cn
O1 - Hosts: 61.135.150.156 club.it.sohu.com
O1 - Hosts: 64.152.166.83 www.techsmith.com
O1 - Hosts: 218.5.76.151 www.54master.com
O1 - Hosts: 202.103.213.125 bbs.sucaiw.com
O1 - Hosts: 219.239.88.110 soft.yesky.com
O1 - Hosts: 218.90.160.76 bbs.modchina.com
O1 - Hosts: 202.107.237.202 bbs.cndtp.com
O1 - Hosts: 210.51.23.29 www.cndgn.com
O1 - Hosts: 210.51.181.59 www.chinatoon.com.cn
O1 - Hosts: 219.133.51.76 comic.qq.com
O1 - Hosts: 219.136.244.101 www.pconline.com.cn
O1 - Hosts: 60.195.249.53 www.chinavisual.com
O1 - Hosts: 219.129.216.4 www.yfdmt.com
O1 - Hosts: 218.83.154.184 www.yy-s.com
O1 - Hosts: 219.129.216.75 www.swcool.com
O1 - Hosts: 219.146.78.83 www.flash8.net
O1 - Hosts: 222.85.127.191 www.pc120.net.cn
O1 - Hosts: 202.8.88.61 resources.emb.gov.hk
O1 - Hosts: 218.76.215.232 xxol.net
O1 - Hosts: 220.189.255.7 tech.987654.net
O1 - Hosts: 61.144.192.19 www.cj888.com
O1 - Hosts: 222.187.105.52 www.nn11.com
O1 - Hosts: 220.194.57.26 www.blueidea.com
O1 - Hosts: 60.191.132.102 www.1110.net
O1 - Hosts: 218.16.118.176 bbs.sj00.com
O1 - Hosts: 61.129.32.27 www.koohon.com
O1 - Hosts: 210.73.88.170 www.flashempire.com
O1 - Hosts: 60.173.64.116 www.kegirl.com
O1 - Hosts: 61.132.102.88 photo.163.com
O1 - Hosts: 211.157.101.200 www.7share.com
O1 - Hosts: 218.12.214.125 www.jjwxc.com
O1 - Hosts: 61.129.67.29 tw.netsh.com
O1 - Hosts: 218.5.77.16 www.eachu.com
O1 - Hosts: 210.59.230.87 photo.pchome.com.tw
O1 - Hosts: 205.209.133.30 www.so-ga.com
O1 - Hosts: 219.136.252.175 my.6to23.com
O1 - Hosts: 59.42.10.7 free.activeclub.net
O1 - Hosts: 61.129.51.9 www.danmeijijie.com
O1 - Hosts: 219.238.232.22 www.coolsee.com
O1 - Hosts: 61.129.115.236 www.blgarden.com
O1 - Hosts: 61.129.70.230 www.acfield.net
O1 - Hosts: 219.153.18.148 www.chi-san.com
O1 - Hosts: 61.140.60.83 game.21cn.com
O1 - Hosts: 219.84.161.200 forum.gamebase.com.tw
O1 - Hosts: 61.182.66.73 daisyhanke.vbbcn.com
O1 - Hosts: 222.36.41.24 www.bldevotee.net
O1 - Hosts: 61.186.70.250 www1.www6.cn
O1 - Hosts: 218.12.214.116 www.jjwxc.net
O1 - Hosts: 219.148.106.172 bbs.jjwxc.net
O1 - Hosts: 61.152.251.216 www.bbol.org
O1 - Hosts: 61.152.102.122 www.blnet.net
O1 - Hosts: 220.181.18.57 post.baidu.com
O1 - Hosts: 210.51.212.10 www.michong.com
O1 - Hosts: 64.225.154.135 www.zonghengdao.com
O1 - Hosts: 218.85.134.197 51xy.com
O1 - Hosts: 202.103.178.60 xnc.hllx.com
O1 - Hosts: 219.235.232.235 bbs15.xilu.com
O1 - Hosts: 219.235.232.210 blzyzznew.bbs.xilu.com
O1 - Hosts: 61.155.107.152 www0.hotqq.com
O1 - Hosts: 61.145.112.13 dreamboatbt.3322.org
O1 - Hosts: 61.129.83.138 cq.netsh.com
O1 - Hosts: 61.129.67.106 www.netsh.com
O1 - Hosts: 218.93.124.228 www.xixibt.cn
O1 - Hosts: 222.36.41.232 www.55188.com
O1 - Hosts: 218.5.74.146 www.3lsoft.com
O1 - Hosts: 202.105.31.85 bbs.055.cn
O1 - Hosts: 218.83.154.223 bbs.superdown.com
O1 - Hosts: 218.108.238.106 follow-me.home.sunbo.net
O1 - Hosts: 218.204.251.12 bbs.macd.cn
O1 - Hosts: 61.129.90.222 www.5icrack.com
O1 - Hosts: 218.75.68.242 bbs.mumayi.net
O1 - Hosts: 219.148.120.138 bbs.366tian.net
O1 - Hosts: 210.188.203.12 bbs.100free.net
O1 - Hosts: 61.172.196.51 bbs.51soft.com
O1 - Hosts: 202.103.176.121 www.cn808.net
O1 - Hosts: 218.1.14.145 bbs.163down.com
O1 - Hosts: 210.51.170.68 bbs.jetdown.com
O1 - Hosts: 211.94.206.38 www.cschina.org
O1 - Hosts: 218.93.114.213 www.hanzify.org
O1 - Hosts: 219.239.89.28 www.enet.com.cn
O1 - Hosts: 210.51.21.218 bbs.pcicp.com
O1 - Hosts: 61.151.248.149 bbs.sayba.cn
O1 - Hosts: 219.149.195.150 bbs.cnxy.org
O1 - Hosts: 210.22.195.78 bbs.arongsoft.com
O1 - Hosts: 61.168.228.238 www.4oa.com
O1 - Hosts: 61.135.158.72 mail.tom.com
O1 - Hosts: 61.129.75.121 base.997.cn
O1 - Hosts: 202.43.216.252 cn.mail.yahoo.com
O1 - Hosts: 61.177.95.155 www.126.com
O1 - Hosts: 60.171.206.2 photo.eastgame.net
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v8.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - IE右键菜单中的新增项目: &使用迅雷下载 - D:\安装文件夹\Thunder\geturl.htm
O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - D:\安装文件夹\Thunder\getallurl.htm
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - D:\绿色文件夹\Tencent\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 使用网络传送带下载 - D:\安装文件夹\NetXfer\NXAddLink.html
O8 - IE右键菜单中的新增项目: 使用网络传送带下载全部链接 - D:\安装文件夹\NetXfer\NXAddList.html
O8 - IE右键菜单中的新增项目: 保存全部网页 到网文任我存 - res://D:\安装文件夹\Web Shutter\brwstart.dll/brwsall
O8 - IE右键菜单中的新增项目: 保存所选文字 到网文任我存 - res://D:\安装文件夹\Web Shutter\brwstart.dll/txtstart
O8 - IE右键菜单中的新增项目: 保存所选网页 到网文任我存 - res://D:\安装文件夹\Web Shutter\brwstart.dll/brwstart
O8 - IE右键菜单中的新增项目: 复制图片链接 - C:\WINDOWS\web\CopyImageUrl.html
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - D:\绿色文件夹\Tencent\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - D:\绿色文件夹\Tencent\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - D:\绿色文件夹\Tencent\SendMMS.htm
O9 - 浏览器额外的按钮: Web Shutter - {0713E8D2-850A-101B-AFC0-4210102A8DA7} - D:\安装文件夹\Web Shutter\WShutter.exe
O9 - 浏览器额外的“工具”菜单项: &Web Shutter - {0713E8D2-850A-101B-AFC0-4210102A8DA7} - D:\安装文件夹\Web Shutter\WShutter.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{34176AE6-8C6F-4BC0-B169-CDDA342A9F09}: NameServer = 202.103.224.68,202.96.128.68
O17 - HKLM\System\CS1\Services\Tcpip\..\{34176AE6-8C6F-4BC0-B169-CDDA342A9F09}: NameServer = 202.103.224.68,202.96.128.68
O17 - HKLM\System\CS2\Services\Tcpip\..\{34176AE6-8C6F-4BC0-B169-CDDA342A9F09}: NameServer = 202.103.224.68,202.96.128.68
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - NT 服务: Gray_Pigeon_Server (GrayPigeonServer) - Unknown owner - C:\WINDOWS\tServer.exe
O23 - NT 服务: kavsvc - Kaspersky Lab - D:\安装文件夹\Kaspersky Anti-Virus Personal\kavsvc.exe
最后编辑2005-12-11 21:59:39
分享到:
gototop
 

附件附件:

下载次数:0
文件类型:image/pjpeg
文件大小:
上传时间:2005-12-11 2:36:50
描述:



gototop
 

【回复“adddummy”的帖子】
修复:
所有01项,
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

开始-控制面版--管理工具--服务--找到Gray_Pigeon_Server 属性--改为已禁用

显示所有文件,找到以下删除:(如果有的话)
C:\WINDOWS\tServer.exe
C:\WINDOWS\tServer.dll
C:\WINDOWS\tServerkey.dll
C:\WINDOWS\tServer_Hook.dll

gototop
 

谢谢...我昨晚杀了一夜,以为清除了,谁知道第二天所有程序都打不开了,只好重装....痛苦哇..
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT