大家帮我看看啊!!!!!! - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛大家帮我看看啊!!!!!!

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第四十七次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

1

1 / 1 页

跳转页

大家帮我看看啊!!!!!!

沉鱼1986 初生襁褓狮帖子:5 注册: 2005-08-17 来自:	发表于： 2005-12-06 10:22 \| 只看楼主短消息资料字号：小中大 1楼大家帮我看看啊!!!!!! HijackThis_815汉化版扫描日志 V1.99.1 保存于 10:24:26, 日期 2005-12-06 操作系统： Windows 2000 SP2 (WinNT 5.00.2195) 浏览器： Internet Explorer v6.00 SP1 (6.00.2800.1106) 当前运行的进程： C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\MSTask.exe C:\WINNT\system32\rundll32.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\system32\mspmspsv.exe C:\WINNT\system32\rundll32.exe C:\WINNT\Explorer.EXE C:\Program Files\Maxthon\maxthon.exe C:\WINNT\system32\rundll32.exe C:\DOCUME~1\ly\LOCALS~1\Temp\Rar$EX00.734\HijackThis1991zww.exe R3 - URLSearchHook: (no name) - {BB936323-19FA-4521-BA29-ECA6A121BC78} - (no file) O1 - Hosts: 61.152.90.72 www.cnww.net O1 - Hosts: 61.152.90.72 cnww.net O1 - Hosts: 61.152.90.72 www.zhao123.com O1 - Hosts: 61.152.90.72 zhao123.com O1 - Hosts: 61.152.90.72 www.4399.com O1 - Hosts: 61.152.90.72 4399.com O1 - Hosts: 61.152.90.72 www.chinagames.net O1 - Hosts: 61.152.90.72 chinagames.net O1 - Hosts: 61.152.90.72 www.tiexue.net O1 - Hosts: 61.152.90.72 tiexue.net O1 - Hosts: 61.152.90.72 www.qq163.com O1 - Hosts: 61.152.90.72 qq163.com O1 - Hosts: 61.152.90.72 www.tt67.com O1 - Hosts: 61.152.90.72 tt67.com O1 - Hosts: 61.152.90.72 www.chinamp3.com O1 - Hosts: 61.152.90.72 chinamp3.com O1 - Hosts: 61.152.90.72 www.pg168.com O1 - Hosts: 61.152.90.72 pg168.com O1 - Hosts: 61.152.90.72 www.yymp3.com O1 - Hosts: 61.152.90.72 yymp3.com O1 - Hosts: 61.152.90.72 www.yy138.com O1 - Hosts: 61.152.90.72 yy138.com O1 - Hosts: 61.152.90.72 www.dj99.com O1 - Hosts: 61.152.90.72 dj99.com O1 - Hosts: 61.152.90.72 www.sogua.com O1 - Hosts: 61.152.90.72 sogua.com O1 - Hosts: 61.152.90.72 www.snsn.net O1 - Hosts: 61.152.90.72 snsn.net O1 - Hosts: 61.152.90.72 www.flash8.net O1 - Hosts: 61.152.90.72 flash8.net O1 - Hosts: 61.152.90.72 www.mop.com O1 - Hosts: 61.152.90.72 mop.com O1 - Hosts: 61.152.90.72 www.tianyaclub.com O1 - Hosts: 61.152.90.72 tianyaclub.com O1 - Hosts: 61.152.90.72 www.xici.net O1 - Hosts: 61.152.90.72 xici.net O1 - Hosts: 61.152.90.72 www.ucanlove.com O1 - Hosts: 61.152.90.72 ucanlove.com O1 - Hosts: 61.152.90.72 www.cmfu.com O1 - Hosts: 61.152.90.72 cmfu.com O1 - Hosts: 61.152.90.72 www.21red.net O1 - Hosts: 61.152.90.72 21red.net O1 - Hosts: 61.152.90.72 www.pconline.com.cn O1 - Hosts: 61.152.90.72 pconline.com.cn O1 - Hosts: 61.152.90.72 www.donews.com O1 - Hosts: 61.152.90.72 donews.com O1 - Hosts: 61.152.90.72 www.pcauto.com.cn O1 - Hosts: 61.152.90.72 pcauto.com.cn O1 - Hosts: 61.152.90.72 www.265.com O1 - Hosts: 61.152.90.72 265.com O1 - Hosts: 61.152.90.72 www.wo99.com O1 - Hosts: 61.152.90.72 wo99.com O1 - Hosts: 61.152.90.72 www.familydoctor.com.cn O1 - Hosts: 61.152.90.72 familydoctor.com.cn O1 - Hosts: 61.152.90.72 www.flashempire.com O1 - Hosts: 61.152.90.72 flashempire.com O1 - Hosts: 61.152.90.72 www.showgood.tv O1 - Hosts: 61.152.90.72 showgood.tv O1 - Hosts: 61.152.90.72 www.flashfan.net O1 - Hosts: 61.152.90.72 flashfan.net O1 - Hosts: 61.152.90.72 www.long21.net O1 - Hosts: 61.152.90.72 long21.net O1 - Hosts: 61.152.90.72 www.sowww.com O1 - Hosts: 61.152.90.72 sowww.com O1 - Hosts: 61.152.90.72 www.flashhome.net O1 - Hosts: 61.152.90.72 flashhome.net O1 - Hosts: 61.152.90.72 www.cnflash.net O1 - Hosts: 61.152.90.72 cnflash.net O1 - Hosts: 61.152.90.72 www.flashsky.com O1 - Hosts: 61.152.90.72 flashsky.com O1 - Hosts: 61.152.90.72 www.hunansky.com O1 - Hosts: 61.152.90.72 hunansky.com O1 - Hosts: 61.152.90.72 www.52flash.net O1 - Hosts: 61.152.90.72 52flash.net O1 - Hosts: 61.152.90.72 www.flashh.com O1 - Hosts: 61.152.90.72 flashh.com O1 - Hosts: 61.152.90.72 www.flashsun.com O1 - Hosts: 61.152.90.72 flashsun.com O1 - Hosts: 61.152.90.72 www.7k7k.com O1 - Hosts: 61.152.90.72 7k7k.com O1 - Hosts: 61.152.90.72 www.xuanxuan.com O1 - Hosts: 61.152.90.72 xuanxuan.com O1 - Hosts: 61.152.90.72 www.flash88.net O1 - Hosts: 61.152.90.72 flash88.net O1 - Hosts: 61.152.90.72 www.91flash.com O1 - Hosts: 61.152.90.72 91flash.com O1 - Hosts: 61.152.90.72 www.doingflash.com O1 - Hosts: 61.152.90.72 doingflash.com O1 - Hosts: 61.152.90.72 www.5see.com O1 - Hosts: 61.152.90.72 5see.com O1 - Hosts: 61.152.90.72 www.skyhits.com O1 - Hosts: 61.152.90.72 skyhits.com O1 - Hosts: 61.152.90.72 www.ting78.com O1 - Hosts: 61.152.90.72 ting78.com O1 - Hosts: 61.152.90.72 www.91.com O1 - Hosts: 61.152.90.72 91.com O1 - Hosts: 61.152.90.72 www.flashchina.net O1 - Hosts: 61.152.90.72 flashchina.net O1 - Hosts: 61.152.90.72 www.flash8.com.cn O1 - Hosts: 61.152.90.72 flash8.com.cn O1 - Hosts: 61.152.90.72 www.f130.net O2 - BHO: std software - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - C:\WINNT\SYSTEM32\stdup.dll O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx O4 - 启动项HKLM\\Run: [Synchronization Manager] mobsync.exe /logon O8 - IE右键菜单中的新增项目: 添加到QQ表情 - C:\WINNT\system\sys\AddEmotion.htm O9 - 浏览器额外的按钮: 手机短信 - {00000000-0000-0001-0001-596BAEDD1289} - http://sms.3721.com/ie/index.htm?pid=U_changcheng_66125 (file missing) O9 - 浏览器额外的按钮: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.mail.yahoo.com/promo/rd1 (file missing) O9 - 浏览器额外的按钮: 上网助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://assistant.3721.com/index.htm?fb=Cns (file missing) O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - 浏览器额外的按钮: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing) O15 - “受信任的站点”中添加项: http://www.icbc.com.cn O16 - DPF: Yahoo! Chat 1.3 - http://jcs.chat.dcn.yahoo.com/c174/chat.cab O16 - DPF: {2EA6D939-4445-43F1-A12B-8CB3DDA8B855} (BlueskyVideo Control) - http://www.bluesky.cn/download/v2_60.cab O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (CEditCtrl Object) - https://img.alipay.com/download/aliedit.cab O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab O16 - DPF: {9E265649-6E0E-4EEA-9F49-DAE0801440CF} (WebDigiNet Control) - http://mgxjjd.oicp.net/WebDiginet.CAB O16 - DPF: {A984ED9F-E8DA-44E5-BC18-C14B9ABEF79D} (photo_uploader Control) - http://upload.photo.163.com/photoup.cab O16 - DPF: {C8BD9ACB-F7EC-48E6-BB2F-DAADC6789E9A} (Kingsoft DUBA OnlineScan) - http://211.152.52.102/duba/antiscan/update/OCX/KAVClean.CAB O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - file://C:\Herosoft\HeroV8\DVDSkin\defskin\HTML\swflash.cab O16 - DPF: {E787FD25-8D7C-4693-AE67-9406BC6E22DF} (CPasswordEditCtrl Object) - https://www.tenpay.com/download/qqedit.cab O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.companion.yahoo.com/dl/toolbar/yiebio5_1_6_0.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{1D67853C-6FC8-45E1-927C-07765730D70D}: NameServer = 61.177.7.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{1D67853C-6FC8-45E1-927C-07765730D70D}: NameServer = 61.177.7.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{1D67853C-6FC8-45E1-927C-07765730D70D}: NameServer = 61.177.7.1 O20 - Winlogon Notify: AdminDebug - C:\WINNT\system32\fpns0357e.dll O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll O23 - NT 服务: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - NT 服务: Remote Connections Services (Ranver) - Unknown owner - C:\WINNT\conime.exe (file missing) O23 - NT 服务: Remote Connections Services (Reice) - Unknown owner - C:\WINNT\system\svchost.exe 2005-12-06 11:06:48
沉鱼1986 初生襁褓狮帖子:5 注册: 2005-08-17 来自:	分享到：

飞跃迷离社区嘉宾帖子:7351 注册: 2004-10-15 来自:	发表于： 2005-12-06 11:06 \| 短消息资料字号：小中大 2楼重新启动到安全模式（进入安全模式的方法:重新启动电脑, 开机自动检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式(Safe Mode)进入Windows。）开始→控制面板→性能和维护→管理工具→服务→查找Remote Connections Services→右击→属性→启动类型→禁止→应用→停止→确定。请关闭所有IE界面，重新使用HijackThis扫描一次，选中下面建议修复的项目，让HijackThis修复，修复前请允许HijackThis保留备份。（如果楼主知道是安全的可以不必勾选）所有01项 O2 - BHO: std software - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - C:\WINNT\SYSTEM32\stdup.dll O20 - Winlogon Notify: AdminDebug - C:\WINNT\system32\fpns0357e.dll 然后打开我的电脑→再点工具→打开文件夹选项→查看→把隐藏受保护的系统文件（推荐）和隐藏已知文件类型的扩展名的勾去掉→再显示所有文件→找到以下文件并删除：(如果有的话) C:\WINNT\SYSTEM32\stdup.dll C:\WINNT\system32\fpns0357e.dll C:\WINNT\system\svchost.exe
飞跃迷离社区嘉宾帖子:7351 注册: 2004-10-15 来自:

<<上一主题|下一主题>>

1

1 / 1 页

跳转页

页面顶部

Powered by Discuz!NT