瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 小女子被17777绑架啦,帮我看一下日志啊!求大侠们了

1   1  /  1  页   跳转

小女子被17777绑架啦,帮我看一下日志啊!求大侠们了

小女子被17777绑架啦,帮我看一下日志啊!求大侠们了

到底是哪里出问题了呢!?

Logfile of HijackThis v1.99.1
Scan saved at 22:14:45, on 2005-7-22
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
e:\rising\rfw\rfwsrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\联想\联想标准键盘\skdaemon.exe
C:\Program Files\Common Files\Lenovo\digitalsuit\commondll\MyDevice.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\Program Files\lenovo\幸福相册\AlbumFileWatch.exe
C:\Program Files\lenovo\幸福音乐\MusicMonitor.exe
C:\program files\lenovo\联想安全中心\安全中心\LenovoHD.exe
C:\WINDOWS\VM_STI.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
D:\Herosoft\HeroV8\SysExplr.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Rising\Rav\RavTimer.exe
D:\Rising\Rav\RavMon.exe
E:\Rising\Rfw\rfwmain.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Tencent\qq\QQ.exe
C:\Program Files\Tencent\qq\TIMPlatform.exe
C:\Program Files\Lenovo\数码家电\lxRecSvr.exe
D:\RISING\RAV\CCENTER.EXE
D:\RISING\RAV\Ravmond.exe
C:\Program Files\Lenovo\联想智能控制中心\SCC\SCCMonitor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Lenovo\联想智能控制中心\SCC\LenovoSmartControlCenter.exe
C:\program files\lenovo\联想安全中心\安全中心\LENOVOHDPRO.EXE
C:\Program Files\Tencent\qq\QQ.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\BLUEWA~1\LOCALS~1\Temp\Rar$EX00.136\HijackThis.exe

R3 - Default URLSearchHook is missing
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\Program Files\Tencent\qq\QQIEHelper.dll
O2 - BHO: 百度搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\WINDOWS\DOWNLO~1\BaiDuBar.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - Toolbar: 百度搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\WINDOWS\DOWNLO~1\BaiDuBar.dll
O3 - Toolbar: 卡卡安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\System32\KakaTool.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SKDaemon] C:\Program Files\联想\联想标准键盘\skdaemon.exe
O4 - HKLM\..\Run: [Mydevice] "C:\Program Files\Common Files\Lenovo\digitalsuit\commondll\MyDevice.exe"
O4 - HKLM\..\Run: [FileWatch] C:\Program Files\lenovo\幸福相册\AlbumFileWatch.exe
O4 - HKLM\..\Run: [MusicMonitor.exe] C:\Program Files\lenovo\幸福音乐\MusicMonitor.exe
O4 - HKLM\..\Run: [PPCListerner.exe] C:\Program Files\lenovo\幸福音乐\PPCListener.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LenovoHD] c:\program files\lenovo\联想安全中心\安全中心\LenovoHD.exe
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera 301x
O4 - HKLM\..\Run: [SysExplr] d:\Herosoft\HeroV8\SysExplr.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [ccproc] C:\PROGRA~1\KAMUN\KAMUN.EXE
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [RavTimer] D:\Rising\Rav\RavTimer.exe
O4 - HKLM\..\Run: [RavMon] D:\Rising\Rav\RavMon.exe -system
O4 - HKLM\..\Run: [internet.exe] C:/system.hta
O4 - HKLM\..\Run: [ExFilter] Rundll32.exe "C:\PROGRA~1\CNNIC\Cdn\cdnspie.dll,ExecFilter solo"
O4 - HKLM\..\Run: [RfwMain] "E:\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: 腾讯QQ.lnk = C:\Program Files\Tencent\qq\QQ.exe
O8 - Extra context menu item: 使用搜狗直通车下载 - C:\PROGRA~1\P4P\dl.htm
O8 - Extra context menu item: 使用网际快车下载 - C:\PROGRA~1\FLASHGET\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\PROGRA~1\FLASHGET\jc_all.htm
O8 - Extra context menu item: 反向链接 - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\qq\SendMMS.htm
O8 - Extra context menu item: 百度Flash搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/FLASHSEARCH.HTM
O8 - Extra context menu item: 百度mp3搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUMP3.HTM
O8 - Extra context menu item: 百度信息快递搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUIE.HTM
O8 - Extra context menu item: 百度图片搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUIMG.HTM
O8 - Extra context menu item: 百度搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUSEARCH.HTM
O8 - Extra context menu item: 百度新闻搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUNEWS.HTM
O8 - Extra context menu item: 类似网页 - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html
O8 - Extra context menu item: 缓存的网页快照 - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html
O8 - Extra context menu item: 豪杰超级解霸V8实时播放 - d:\Herosoft\HeroV8\MPURLGET.HTM
O9 - Extra button: 豪杰超级解霸V8 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - d:\Herosoft\HeroV8\STHSDVD.EXE
O9 - Extra 'Tools' menuitem: 豪杰超级解霸V8 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - d:\Herosoft\HeroV8\STHSDVD.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\qq\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\qq\QQ.EXE
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\qq\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\qq\QQIEHelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{6D045967-BAFC-4B5C-842D-CCF868D92BA8}: NameServer = 61.130.254.34 61.130.254.35
O23 - Service: Lenovo TV Recoding - Unknown owner - C:\Program Files\Lenovo\数码家电\lxRecSvr.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - e:\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - D:\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\RISING\RAV\Ravmond.exe
O23 - Service: SCCMonitor - Unknown owner - C:\Program Files\Lenovo\联想智能控制中心\SCC\SCCMonitor.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
最后编辑2005-07-22 23:11:13
分享到:
gototop
 

您好,请您重启电脑,按F8转入安全模式

运行hijackthis

修复:

R3 - Default URLSearchHook is missing

O4 - HKLM\..\Run: [internet.exe] C:/system.hta

删除:

C:/system.hta

gototop
 

R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [internet.exe] C:/system.hta

修复(fix checked)上面的项目,重新启动到安全模式,在文件夹选项中,显示隐藏文件和取消“隐藏受保护的操作系统文件”。然后找到如下文件并删除(如果有的话)。
C:/system.hta
gototop
 

搞定了耶~!很感谢很感谢花落花又开^@^非常非常非非常感谢斑竹!大恩大德小女子COPY在脑子里了呢
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT