瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 backdoor.pcclient.kc,附日志,急求解决办法!!baohe版主再来看一下!

12   1  /  2  页   跳转

backdoor.pcclient.kc,附日志,急求解决办法!!baohe版主再来看一下!

backdoor.pcclient.kc,附日志,急求解决办法!!baohe版主再来看一下!

Logfile of HijackThis v1.99.1
Scan saved at 22:48:50, on 2006-2-24
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
D:\RAV\CCENTER.EXE
D:\Rising\Rav\Ravmond.exe
d:\rising\rfw\rfwsrv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
d:\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\svchost.exe
D:\Norton AntiVirus\navapsvc.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
d:\rising\rfw\RfwMain.exe
C:\WINNT\system32\Rundll32.exe
C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
D:\Rising\Rav\RavTask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Rising\Rav\Ravmon.exe
C:\WINNT\system32\internat.exe
C:\Program Files\Ringz Studio\Storm Downloader\StormDownloader.exe
C:\Program Files\Ringz Studio\Storm Downloader\TDUpdate.exe
C:\Program Files\VnetClient1.6\VnetClient.exe
D:\Rising\Rav\RsAgent.exe
C:\WINNT\msagent\AgentSvr.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.875\HijackThis.exe

最后编辑2006-02-25 21:34:09
分享到:
gototop
 

R3 - URLSearchHook: (no name) - {BB936323-19FA-4521-BA29-ECA6A121BC78} - (no file)
R3 - URLSearchHook: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe
O1 - Hosts: 218.6.168.124 www.elunwen.com.cn
O1 - Hosts: 211.162.209.187 www.21manager.com
O1 - Hosts: 61.143.140.250 www.cz520.net
O1 - Hosts: 61.143.140.246 www.521000.com
O1 - Hosts: 61.134.43.9 www.goto8.net
O1 - Hosts: 222.187.105.59 www.mpachina.com
O1 - Hosts: 61.172.250.87 bbs.cn5566.com
O1 - Hosts: 218.16.124.120 www.yyfc.com
O1 - Hosts: 211.100.62.102 www.chinahrd.net
O1 - Hosts: 219.132.21.141 www.99jl.net
O1 - Hosts: 61.144.120.8 www.nanfangdaily.com.cn
O1 - Hosts: 220.181.27.5 www.baidu.com
O1 - Hosts: 202.27.17.241 www.zaobao.com
O1 - Hosts: 61.145.117.162 www.gdrc.com
O1 - Hosts: 210.34.38.100 www.hrexam.com
O1 - Hosts: 207.44.226.185 www.ri-ji.com
O1 - Hosts: 219.153.7.59 www.qq-tv.com
O1 - Hosts: 202.106.181.242 www.mop.gov.cn
O1 - Hosts: 218.91.19.100 www.jayfan.com
O1 - Hosts: 218.30.97.111 www.czcm.com
O1 - Hosts: 210.76.65.166 www.humanassess.com.cn
O1 - Hosts: 219.153.19.5 www.chinampa.cn
O1 - Hosts: 211.144.68.71 www.chinazikao.com
O1 - Hosts: 218.75.127.108 ebook.hzrtvu.edu.cn
O1 - Hosts: 210.51.180.113 www.zikao365.com
O1 - Hosts: 218.108.238.38 music.skyhits.com
O1 - Hosts: 61.188.177.15 www.yuxiupr.com
O1 - Hosts: 202.71.228.164 bbs.monnet.com.hk
O1 - Hosts: 210.245.166.145 www.fucking.com.hk
O1 - Hosts: 210.75.48.27 www.sti.gd.cn
O1 - Hosts: 210.76.65.13 www.gdnet.com.cn
O1 - Hosts: 61.145.126.46 www.gdsc.net.cn
O1 - Hosts: 203.175.146.203 www.qlslyy.sz.gov.cn
O1 - Hosts: 222.36.42.209 www.diamei.com
O1 - Hosts: 219.153.18.147 www.forumabc.net
O1 - Hosts: 218.30.96.180 www.xxsx.cn
O1 - Hosts: 211.151.94.199 www.chinayz.com.cn
O1 - Hosts: 219.153.18.147 www.forumabc.net
O1 - Hosts: 202.108.59.143 www.confucius2000.com
O1 - Hosts: 60.191.132.102 www.5432.cn
O1 - Hosts: 210.51.188.126 www.manfen.net
O1 - Hosts: 218.104.136.227 www.adu520.net
O1 - Hosts: 61.135.144.64 forum.chasedream.com
O1 - Hosts: 219.223.222.35 www.szpku.edu.cn
O1 - Hosts: 59.108.32.163 www.chinamp.org
O1 - Hosts: 218.83.153.2 bt.greedland.net
O1 - Hosts: 219.153.18.147 www.forumabc.net
O1 - Hosts: 219.153.18.147 www.forumabc.net
O1 - Hosts: 210.51.189.121 www.zzyjs.com
O1 - Hosts: 218.16.123.141 radio.21cn.com
O1 - Hosts: 58.215.64.130 www.cz51.cn
O1 - Hosts: 218.244.47.250 www.manager.cn
O1 - Hosts: 219.153.18.147 www.forumabc.net
O1 - Hosts: 218.16.123.141 radio.21cn.com
O1 - Hosts: 220.164.140.173 bbs.dovs.com
O1 - Hosts: 219.139.240.53 www.aay.cn
O1 - Hosts: 61.188.38.128 www.520cz.com
O1 - Hosts: 202.98.223.140 www.kygame.cn
O1 - Hosts: 218.11.155.125 www.pkucet.com
O1 - Hosts: 218.75.75.126 www.zbbc.com
O1 - Hosts: 218.80.208.106 www.51windows.net
O1 - Hosts: 69.41.170.29 bbs.m6mm.net
O1 - Hosts: 65.54.153.254 spaces.msn.com
O1 - Hosts: 61.153.48.126 www.tv888.net
O1 - Hosts: 218.5.77.233 www.yanzigd.com
O1 - Hosts: 219.84.160.83 www.gogorock.com
O1 - Hosts: 218.30.100.101 heyunfeng.com
O1 - Hosts: 218.85.133.207 www.4ico.com
O1 - Hosts: 207.46.20.60 www.microsoft.com
O1 - Hosts: 207.46.20.60 www.microsoft.com
O1 - Hosts: 207.46.20.60 www.microsoft.com
O1 - Hosts: 207.46.20.60 www.microsoft.com
O1 - Hosts: 207.46.20.60 www.microsoft.com
O1 - Hosts: 219.148.120.158 update.rising.com.cn
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: IDDTInitObj Class - {15DDE989-CD45-4561-BF99-D22C0D5C2B74} - C:\WINNT\DOWNLO~1\ddtinit.dll
O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll
O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll
O2 - BHO: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
O2 - BHO: Router Layer - {5EB7CB50-E375-4718-B4C0-9AD12EFA2F84} - C:\WINNT\System32\aclayer.dll (file missing)
O2 - BHO: (no name) - {A9930D97-9CF0-42A0-A10D-4F28836579D5} - D:\KuGoo2\KuGoo3DownXControl.ocx
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - D:\Norton AntiVirus\NavShExt.dll (file missing)
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - D:\Xi\NetTransport 2\NTIEHelper.dll (file missing)
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINNT\downlo~1\cnshook.dll
O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: 金山快译(&K) - {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} - C:\PROGRA~1\Kingsoft\FASTAI~1\IEBand.dll
O3 - Toolbar: 新浪点点通 - {F60C7D81-8471-4D40-AAFE-56D318F34C2D} - C:\WINNT\DOWNLO~1\DDTONG~1.DLL
O3 - Toolbar: 一搜工具条 - {115F6E46-FCBC-41ed-B3B5-3BDDD4AAB5E5} - C:\Program Files\YiSou\yisou.dll
O3 - Toolbar: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [CnsMin] Rundll32.exe C:\WINNT\downlo~1\CnsMin.dll,Rundll32
O4 - HKLM\..\Run: [YLive.exe] C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [RavTask] "D:\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [RfwMain] "D:\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [MINI_BFYY] C:\Program Files\Ringz Studio\Storm Downloader\StormDownloader.exe
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O8 - Extra context menu item: !搜一搜 - res://C:\Program Files\YiSou\yisou.dll/232
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: &使用暴风下载器下载 - C:\Program Files\Ringz Studio\Storm Downloader\geturl.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\Tencent\qq\AddToNetDisk.htm
O8 - Extra context menu item: 使用KuGoo3下载(&K) - D:\KUGOO2\KuGoo3DownX.htm
O8 - Extra context menu item: 使用彩信超级自写发送到手机 - http://mms.sina.com.cn/mmsnews.html
O8 - Extra context menu item: 使用新浪下载助手下载 - C:\WINNT\DOWNLO~1\sinadl.htm
O8 - Extra context menu item: 发送图片到手机(&M) - http://sms.sina.com.cn/diy/send.html?from=467
O8 - Extra context menu item: 收藏此页到新浪ViVi - http://vivi.sina.com.cn/collect/click.php?agent=ddt
O8 - Extra context menu item: 新浪搜索 - http://cha.sina.com.cn/ddt.html
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Tencent\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Tencent\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Tencent\qq\SendMMS.htm
O8 - Extra context menu item: 雅虎搜索 - res://C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll/246
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_02\bin\npjpi141_02.dll
O9 - Extra 'Tools' menuitem: Sun Java 控制台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_02\bin\npjpi141_02.dll
O9 - Extra button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail (file missing)
O9 - Extra button: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao (file missing)
O9 - Extra button: 雅虎助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist (file missing)
O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/mess ... essenger.yahoo.com/ (file missing)
O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - Extra 'Tools' menuitem: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - Extra button: 新浪点点通 - {F60C7D81-8471-4D40-AAFE-56D318F34C2D} - C:\WINNT\DOWNLO~1\DDTONG~1.DLL
O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O9 - Extra 'Tools' menuitem: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O9 - Extra button: (no name) - {974AD624-EA50-4831-A6C0-3040F6665396} - C:\WINNT\DOWNLO~1\rssband.dll (HKCU)
O9 - Extra 'Tools' menuitem: 新浪点点通阅读器 - {974AD624-EA50-4831-A6C0-3040F6665396} - C:\WINNT\DOWNLO~1\rssband.dll (HKCU)
O9 - Extra button: 新浪点点通阅读器 - {F0646DC8-58CD-4C64-8F6B-525043914685} - C:\WINNT\DOWNLO~1\rssband.dll (HKCU)
O11 - Options group: [!CNS]  上网助手-地址栏搜索
O16 - DPF: {88734439-46D0-42C0-A13F-7E881EE550CF} (Filetran Control) - http://www.bluesky.cn/download/filetran.cab
O16 - DPF: {AC3A36A8-9BFF-410A-A33D-2279FFEB69D2} (Qzone Media Tools) - http://219.133.62.248/QQPlayer.cab
O16 - DPF: {C8BD9ACB-F7EC-48E6-BB2F-DAADC6789E9A} (Kingsoft DUBA OnlineScan) - http://211.152.52.102/duba/antiscan/update/OCX/KAVClean.CAB
O16 - DPF: {DA984A6D-508E-11D6-AA49-0050FF3C628D} (Ravonline) - http://download.rising.com.cn/QQ/QQkill/rsonline.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://gdou.china-webex.com/client/T20L10N/training/ieatgpc.cab
O16 - DPF: {E787FD25-8D7C-4693-AE67-9406BC6E22DF} (CPasswordEditCtrl Object) - https://www.tenpay.com/download/qqedit.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B1128337-02ED-41AB-A31C-02B7143C31AD}: NameServer = 202.96.128.166 202.96.128.86
O17 - HKLM\System\CCS\Services\Tcpip\..\{C6C611D4-A949-46A7-929C-5E21A9C8CD77}: NameServer = 202.96.134.133,202.96.128.143
O20 - AppInit_DLLs: APIHookDll.dll
O23 - Service: BlueSoleil Hid Service - Unknown owner - d:\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - (no file)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
gototop
 

O23 - Service: Norton AntiVirus 自动防护服务 (navapsvc) - Symantec Corporation - D:\Norton AntiVirus\navapsvc.exe
O23 - Service: VOTUSUM NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - d:\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - d:\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - D:\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\Rising\Rav\Ravmond.exe
O23 - Service: ScriptBlocking Service (SBService) - Unknown owner - (no file)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Analog Devices, Inc. - (no file)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - (no file)
O23 - Service: ucbjyjz - Unknown owner - \\219.131.135.150\E$\ethernet.exe" -service (file missing)
gototop
 

其文件名及路径为: svchost.exe  C:/windows/system32/mroawxiv.dll和winlogon.exe  C:/windows/system32/mroawxiv.dll
gototop
 

引用:
【悠悠Wǒ╭心的贴子】其文件名及路径为: svchost.exe  C:/windows/system32/mroawxiv.dll和winlogon.exe  C:/windows/system32/mroawxiv.dll

...........................

1、用SSM,按下图所示设置svchost.exe和winlogon.exe的规则(禁止其它任何程序挂接、代码注入)。
2、将SSM设置为启动加载。
3、重启系统。
4、删除C:/windows/system32/mroawxiv.dll。

附件附件:

下载次数:1285
文件类型:image/pjpeg
文件大小:
上传时间:2006-2-24 23:15:14
描述:
预览信息:EXIF信息



gototop
 

baohe版主,这是一个什么病毒??

SSM哪有下???
gototop
 

引用:
【悠悠Wǒ╭心的贴子】baohe版主,这是一个什么病毒??

SSM哪有下???
...........................

SSM下载地址:http://www.syssafety.com/files.html

什么病毒?不知道。我觉得是只木马。
gototop
 

日志中有其他问题需要改进吗?
瑞星杀毒也提示病毒已删除,但重启后又发现了它们,不知有无办法彻底杀掉。。
gototop
 

引用:
【悠悠Wǒ╭心的贴子】日志中有其他问题需要改进吗?
瑞星杀毒也提示病毒已删除,但重启后又发现了它们,不知有无办法彻底杀掉。。

...........................

修复所有O1。

O23 - Service: BlueSoleil Hid Service - Unknown owner - d:\IVT Corporation\BlueSoleil\BTNtService.exe——不知道是什么
gototop
 

呵呵,我也不知道,版主要不要把病毒打包发给你呀??
gototop
 
12   1  /  2  页   跳转
页面顶部
Powered by Discuz!NT