瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 请高手看看日志,为什么病毒怎么也杀不完?

1   1  /  1  页   跳转

请高手看看日志,为什么病毒怎么也杀不完?

请高手看看日志,为什么病毒怎么也杀不完?


HijackThis_zww汉化版扫描日志 V1.99.1
保存于 13:06:16, 日期 2006-05-27
操作系统: Windows XP SP1 (WinNT 5.01.2600)
浏览器: Internet Explorer v6.00 SP1 (6.00.2800.1106)

当前运行的进程:
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
D:\Program Files\rising\Rav\CCenter.exe
C:\WINDOWS.0\System32\svchost.exe
D:\Program Files\rising\Rav\Ravmond.exe
C:\WINDOWS.0\Explorer.EXE
C:\WINDOWS.0\system32\spoolsv.exe
D:\Program Files\rising\Rav\RavStub.exe
C:\WINDOWS.0\System32\ctfmon.exe
C:\Program Files\MwIE\MwIE.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS.0\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.016\HijackThis1991zww.exe

R3 - 默认的URLSearchHook丢失。用HijackThis修复
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: (no name) - {35980F6E-A137-4E50-953D-813BB8556899} - (no file)
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - (no file)
O4 - 启动项HKLM\\RunOnce: [RavStub] "D:\Program Files\rising\Rav\ravstub.exe" /RUNONCE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS.0\System32\ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - IE右键菜单中的新增项目: 用比特精灵下载(&B) - F:\比特精灵\BitSpirit\bsurl.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{4A8C8B35-06FE-48D4-B731-CE7E85F90535}: NameServer = 202.103.224.68,202.103.225.68
O23 - NT 服务: qq - Sonic Solutions - (no file)
O23 - NT 服务: ReRavMon Remote Center - Unknown owner - C:\WINDOWS.0\UNIWISE32.EXE (file missing)
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\Program Files\rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\Program Files\rising\Rav\Ravmond.exe
O23 - NT 服务: Rwx (Rwx2005) - Realtek Semiconductor Corporation - (no file)
最后编辑2006-05-27 23:17:20
分享到:
gototop
 

修复
O2 - BHO: (no name) - {35980F6E-A137-4E50-953D-813BB8556899} - (no file)
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - (no file)
R3 - 默认的URLSearchHook丢失。用HijackThis修复

O23 - NT 服务: qq - Sonic Solutions - (no file)
O23 - NT 服务: ReRavMon Remote Center - Unknown owner - C:\WINDOWS.0\UNIWISE32.EXE (file missing)
这俩个是鸽子..
安全模式..打开注册表编辑器,展开:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
搜索qq 和 ReRavMon Remote Center 删除这俩个项..

删除

C:\WINDOWS.0\UNIWISE32.EXE (file missing)

最后安全模式再全盘杀一次毒..


gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT