这是我的扫描的报告,瑞星报的是Backdoor.IrcBot.vf
但是瑞星老是说删除失败!
郁闷死了!
哪位高手教两招吧~
Logfile of HijackThis v1.99.1
Scan saved at 11:30:17, on 2005-12-26
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\Explorer.EXE
E:\ifsclient\AutoUpg\ePMSAutoUpg.exe
C:\Program Files\Rising\Rav\RavTimer.exe
C:\WINNT\system32\ctfmon.exe
C:\VICIDEA\Vicard.exe
C:\WINNT\system32\conime.exe
c:\program files\rising\rav\RAVMON.EXE
C:\Program Files\Rising\Rav\RAVTRAY.EXE
C:\WINNT\system32\macromed\flash\GetFlash.exe
C:\Program Files\Rising\Rav\Rav.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\zhangcy1\LOCALS~1\Temp\Rar$EX20.176\HijackThis.exe
R3 - URLSearchHook: BDSrchHook Class - {BC207F7D-3E63-4ACA-99B5-FB5F8428200C} - C:\WINNT\DOWNLO~1\BDSrHook.dll
O1 - Hosts: 150.180.6.243 missvr9
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: CNNIC_IDN - {35980F6E-A137-4E50-953D-813BB8556899} - C:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll
O2 - BHO: DownloadBHO T2BHO - {B1D147E7-873E-4909-8127-695D9BB78728} - C:\WINNT\Downloaded Program Files\barhelp22.0.dll
O2 - BHO: BDSrchHook Class - {BC207F7D-3E63-4ACA-99B5-FB5F8428200C} - C:\WINNT\DOWNLO~1\BDSrHook.dll
O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [ePMSAutoUpg] e:\ifsclient\AutoUpg\ePMSAutoUpg.exe
O4 - HKLM\..\Run: [RavTimer] C:\Program Files\Rising\Rav\RavTimer.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [RavTray] C:\Program Files\Rising\Rav\RavTray.exe
O4 - HKLM\..\Run: [RavMon] C:\Program Files\Rising\Rav\RavMon.exe -system
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Startup: 安全隔离.lnk = C:\VICIDEA\Vicard.exe
O9 - Extra button: 中文上网 - {35980F6E-A137-4E50-953D-813BB8556899} - C:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll
O9 - Extra 'Tools' menuitem: 中文上网 - {35980F6E-A137-4E50-953D-813BB8556899} - C:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll
O9 - Extra button: 上网助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://www.3721.com/assistant30/jinshan.htm (file missing)
O9 - Extra button: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: 词霸 - {9A687CA6-D585-4947-9ED9-BE96071F5CD9} - C:\PROGRA~1\Kingsoft\POWERW~1\XDictExB.dll
O9 - Extra button: 百度搜索伴侣 - {BC207F7D-3E63-4ACA-99B5-FB5F8428200C} - C:\WINNT\DOWNLO~1\BDSrHook.dll
O9 - Extra button: 金山词霸 - {C8CE29C5-7589-11D3-B81B-0080C8DC5DC8} - C:\PROGRA~1\Kingsoft\XDict\IEPlugin.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O10 - Unknown file in Winsock LSP: c:\winnt\system32\tcpipdog0.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\tcpipdog0.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\tcpipdogr0.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\tcpipdogr0.dll
O11 - Options group: [!IESearch] !IESearch
O11 - Options group: [CDNCLIENT] 中文上网
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) - http://email.ctgpc.com.cn/iNotes.cab
O16 - DPF: {23739A7E-5741-4D1C-88D5-D50B18F7C347} (iWebOffice Control) - http://eiis.cypc.com.cn/eiis/uploadftp/iWebOffice2003.ocx
O16 - DPF: {56A7DC70-E102-4408-A34A-AE06FEF01586} (天下搜索) - http://iebar.t2t2.com/iebar.cab
O16 - DPF: {62561858-71D1-11D4-B2EC-00105A8340B5} (VITEGPlayerCtrl Class) - http://www.jsbdj.net/jsbdj/control/VTPlayer.cab
O16 - DPF: {6FF69C58-952A-43AF-B430-D91DD48FD778} (ReadLocalFile.Read) - http://jxc.cypc.com.cn/ReadLocalFile.CAB
O16 - DPF: {9A578C98-3C2F-4630-890B-FC04196EF420} (CNNIC_IDN) - http://client.jogo.cn/download/cnnic/cdn.cab
O16 - DPF: {9B58F7D5-4A63-4E11-816D-A6505E2CB3D7} (CUpLoad.UpLoad) - http://jxc.cypc.com.cn/CUpLoad.CAB
O16 - DPF: {BC207F7D-3E63-4ACA-99B5-FB5F8428200C} (BDSrchHook Class) - http://bar.baidu.com/update/IESearch.cab
O16 - DPF: {CF051549-EDE1-40F5-B440-BCD646CF2C25} (Ppinstall Control) - http://www.163.com/wwwimages/sms/ppinstall22.cab
O18 - Protocol: dic - {C21F5C32-F57A-4A0D-8E0A-B672691C52D0} - C:\PROGRA~1\Kingsoft\POWERW~1\XDictExB.dll
O18 - Protocol: mp3 - {BC207F7D-3E63-4ACA-99B5-FB5F8428200C} - C:\WINNT\DOWNLO~1\BDSrHook.dll
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: OracleOraHome81ClientCache - Unknown owner - E:\oracle\ora81\BIN\ONRSD.EXE
O23 - Service: RavService - Unknown owner - C:\Program Files\Rising\Rav\RavService.exe" /service (file missing)
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
O23 - Service: Smart Card Helper (SCardDrv) - Unknown owner - C:\WINNT\system32\scardsvr32.exe (file missing)
O23 - Service: WindowsNod (WinNod) - Unknown owner - C:\WINNT\winnod.exe
O23 - Service: AntiSpyUltra (Zonelaps) - Unknown owner - C:\WINNT\vsmom.exe (file missing)
