1   1  /  1  页   跳转

请教

请教

这里面哪里是黑客软件或者和病毒

HijackThis_zww汉化版扫描日志 V1.99.1
保存于      21:33:49, 日期 2006-7-24
操作系统:  Windows 2000 SP4 (WinNT 5.00.2195)
浏览器:    Internet Explorer v6.00 SP1 (6.00.2800.1106)

当前运行的进程:         
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\DRIVERS\CDANTSRV.EXE
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINNT\SYSTEM32\RUNDLL32.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\rclumad.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
D:\UG安装\UGNXFLEXlm\lmgrd.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
D:\UG安装\UGNXFLEXlm\uglmd.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\hkcmd.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\WINNT\system32\IME\wServer.exe
C:\WINNT\svchost.exe
C:\WINNT\system32\internat.exe
C:\Program Files\Symantec AntiVirus\vpc32.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\Windows Media Player\mplayer2.exe
C:\Program Files\HijackThis1991汉化版\HijackThis1991zww.exe

O2 - BHO: QQBrowserHelperObject Class - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: enhr32 - {8383990D-07DA-4051-8124-6F1034E807C5} - C:\WINNT\system32\enhd32.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FLASHGET\jccatch.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: 珊瑚虫 工具栏 - {D74EC18E-3DDD-4174-B1B1-949FE3B8366D} - C:\Program Files\Infofo Bar\infofobar.dll
O3 - IE工具栏增项: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - IE工具栏增项: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - IE工具栏增项: 珊瑚虫 工具栏 - {D74EC18E-3DDD-4174-B1B1-949FE3B8366D} - C:\Program Files\Infofo Bar\infofobar.dll
O4 - 启动项HKLM\\Run: [Synchronization Manager] mobsync.exe /logon
O4 - 启动项HKLM\\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - 启动项HKLM\\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - 启动项HKLM\\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - 启动项HKLM\\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - 启动项HKLM\\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - 启动项HKLM\\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - 启动项HKLM\\Run: [MSService_v1.0] C:\WINNT\system\vfp104.exe
O4 - 启动项HKLM\\Run: [Desktop] C:\WINNT\system32\rundll32.exe "C:\Program Files\DeskAdTop\Run.dll" ,Rundll
O4 - 启动项HKLM\\Run: [Update] C:\Program Files\Common Files\UPDAT\Update.exe
O4 - 启动项HKLM\\Run: [Windir] C:\WINNT\system32\Windir.exe
O4 - 启动项HKLM\\Run: [WINS] C:\WINNT\guanggao.exe
O4 - 启动项HKLM\\Run: [webacc] C:\WINNT\webacc.exe
O4 - 启动项HKLM\\Run: [EMagZone] "C:\Program Files\EMagZone\EMagZone.exe" -minimize
O4 - 启动项HKLM\\Run: [res] C:\WINNT\system32\res.exe
O4 - 启动项HKLM\\Run: [LoadEWXD] C:\WINNT\system32\msxml4r.exe
O4 - 启动项HKLM\\Run: [wServer] C:\WINNT\system32\IME\wServer.exe
O4 - 启动项HKLM\\Run: [spoolsv] C:\WINNT\system32\spoolsv\spoolsv.exe -printer
O4 - 启动项HKLM\\Run: [svc] C:\WINNT\svchost.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [pbmini] C:\Program Files\pcast\PodcastbarMini\PodcastBarMiniStater.exe
O4 - HKCU\..\Run: [caishowmanage] C:\Program Files\CaiShow Tech\CaiShow\UpdateManager.EXE
O4 - HKCU\..\Run: [webacc] C:\WINNT\webacc.exe
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\eMule.exe -AutoStart
O4 - HKCU\..\Run: [Luobooshow] C:\Program Files\luobooshow\luobooshow.exe
O4 - HKCU\..\Run: [svc] C:\WINNT\svchost.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Startup: 腾讯QQ珊瑚虫版.lnk = C:\Program Files\Tencent\QQ\CoralQQ.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - IE右键菜单中的新增项目: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - IE右键菜单中的新增项目: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - IE右键菜单中的新增项目: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - IE右键菜单中的新增项目: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - IE右键菜单中的新增项目: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - IE右键菜单中的新增项目: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - IE右键菜单中的新增项目: 使用网际快车下载 - C:\PROGRA~1\FLASHGET\jc_link.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链接 - C:\PROGRA~1\FLASHGET\jc_all.htm
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - D:\小软件\qq\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - D:\小软件\qq\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - D:\小软件\qq\SendMMS.htm
O9 - 浏览器额外的按钮: 珊瑚虫 工具栏 - {8507326C-B5C1-4559-BB91-0919E753836F} - C:\Program Files\Infofo Bar\infofobar.dll
O9 - 浏览器额外的“工具”菜单项: 珊瑚虫 工具栏 - {8507326C-B5C1-4559-BB91-0919E753836F} - C:\Program Files\Infofo Bar\infofobar.dll
O9 - 浏览器额外的按钮: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\OFFICE11\REFIEBAR.DLL
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - 浏览器额外的按钮: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - 浏览器额外的“工具”菜单项: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - 浏览器额外的按钮: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - 浏览器额外的“工具”菜单项: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O10 - 未知的文件在 Winsock LSP: c:\winnt\system32\cdnns.dll
O10 - 未知的文件在 Winsock LSP: c:\winnt\system32\engt32.dll
O10 - 未知的文件在 Winsock LSP: c:\winnt\system32\engt32.dll
O11 - Options group: [!CNS]  网络实名
O11 - Options group: [CDNCLIENT]  中文上网
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINNT\system32\NavLogon.dll
O23 - NT 服务: C-DillaSrv - C-Dilla Ltd - C:\WINNT\system32\DRIVERS\CDANTSRV.EXE
O23 - NT 服务: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - NT 服务: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program F
最后编辑2006-07-24 22:58:37
分享到:
gototop
 

【回复“flyfish123”的帖子】
两个备用工具
请先下载

LSPFix.exe下载:http://cexx.org/lspfix.htm

WinsockFix下载:http://www.winsockfix.nl/

=====================

重启机器
以下步骤在断开网络的情况下操作

===============

结束C:\WINNT\svchost.exe进程

===============

修复
O2 - BHO: enhr32 - {8383990D-07DA-4051-8124-6F1034E807C5} - C:\WINNT\system32\enhd32.dll
O2 - BHO: 珊瑚虫 工具栏 - {D74EC18E-3DDD-4174-B1B1-949FE3B8366D} - C:\Program Files\Infofo Bar\infofobar.dll
O3 - IE工具栏增项: 珊瑚虫 工具栏 - {D74EC18E-3DDD-4174-B1B1-949FE3B8366D} - C:\Program Files\Infofo Bar\infofobar.dll
O4 - 启动项HKLM\\Run: [MSService_v1.0] C:\WINNT\system\vfp104.exe
O4 - 启动项HKLM\\Run: [Desktop] C:\WINNT\system32\rundll32.exe "C:\Program Files\DeskAdTop\Run.dll" ,Rundll
O4 - 启动项HKLM\\Run: [Update] C:\Program Files\Common Files\UPDAT\Update.exe
O4 - 启动项HKLM\\Run: [Windir] C:\WINNT\system32\Windir.exe
O4 - 启动项HKLM\\Run: [WINS] C:\WINNT\guanggao.exe
O4 - 启动项HKLM\\Run: [webacc] C:\WINNT\webacc.exe
O4 - 启动项HKLM\\Run: [EMagZone] "C:\Program Files\EMagZone\EMagZone.exe" -minimize
O4 - 启动项HKLM\\Run: [res] C:\WINNT\system32\res.exe
O4 - 启动项HKLM\\Run: [LoadEWXD] C:\WINNT\system32\msxml4r.exe
O4 - 启动项HKLM\\Run: [wServer] C:\WINNT\system32\IME\wServer.exe
O4 - 启动项HKLM\\Run: [spoolsv] C:\WINNT\system32\spoolsv\spoolsv.exe -printer
O4 - 启动项HKLM\\Run: [svc] C:\WINNT\svchost.exe
O4 - HKCU\..\Run: [pbmini] C:\Program Files\pcast\PodcastbarMini\PodcastBarMiniStater.exe
O4 - HKCU\..\Run: [caishowmanage] C:\Program Files\CaiShow Tech\CaiShow\UpdateManager.EXE
O4 - HKCU\..\Run: [webacc] C:\WINNT\webacc.exe
O4 - HKCU\..\Run: [Luobooshow] C:\Program Files\luobooshow\luobooshow.exe
O4 - HKCU\..\Run: [svc] C:\WINNT\svchost.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

=================

卸载
C:\Program Files\Infofo Bar\
C:\Program Files\DeskAdTop\
C:\Program Files\EMagZone\
C:\Program Files\pcast\
C:\Program Files\CaiShow Tech\
C:\Program Files\luobooshow\

================

用LSPFix.exe 修复010项中的c:\winnt\system32\engt32.dll
修复方法参考图片
注意这次应该选中engt32.dll文件

若用LSPFix.exe修复后还是不能上网
建议用WinsockFix修复注册表

================

删除
C:\Program Files\Infofo Bar\
C:\Program Files\DeskAdTop\
C:\Program Files\EMagZone\
C:\Program Files\pcast\
C:\Program Files\CaiShow Tech\
C:\Program Files\luobooshow\
C:\WINNT\system32\enhd32.dll
C:\WINNT\system\vfp104.exe
C:\Program Files\Common Files\UPDAT\
C:\WINNT\system32\Windir.exe
C:\WINNT\guanggao.exe
C:\WINNT\system32\res.exe
C:\WINNT\system32\msxml4r.exe
C:\WINNT\system32\IME\wServer.exe
C:\WINNT\system32\spoolsv\
C:\WINNT\webacc.exe
C:\WINNT\svchost.exe

若能在C盘搜索到webacc.dll
同样删除之

============

其中
C:\WINDOWS\system32\spoolsv\是傲迅浏览器辅助流氓插件
具体操作参考
http://forum.ikaka.com/topic.asp?board=28&artid=7948848

==============

无法上传图片啊

参考下面这个贴子中的相关图片吧:
http://forum.ikaka.com/topic.asp?board=28&artid=7795226

OK?
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT