【求助】高手帮看一下日志是不是中了木马了！55 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛【求助】高手帮看一下日志是不是中了木马了！55

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

1

1 / 1 页

跳转页

【求助】高手帮看一下日志是不是中了木马了！55

【晓晓】初生襁褓狮帖子:52 注册: 2004-02-18 来自:	发表于： 2006-04-09 11:18 \| 只看楼主短消息资料字号：小中大 1楼【求助】高手帮看一下日志是不是中了木马了！55 Logfile of Kaka v2. 0. 0. 8 Scan Module v2. 0. 0. 1 Scan saved at 11:04:42, on 2006-04-09 Platform: Microsoft Windows XP Professional Service Pack 2 (Build 2600) MSIE: Internet Explorer v6.00 SP2; (6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)) Running processes: [smss.exe] CommandLine = [csrss.exe] CommandLine = C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 [winlogon.exe] CommandLine = winlogon.exe [services.exe] CommandLine = C:\WINDOWS\system32\services.exe [lsass.exe] CommandLine = C:\WINDOWS\system32\lsass.exe [svchost.exe] CommandLine = C:\WINDOWS\system32\svchost -k DcomLaunch [svchost.exe] CommandLine = C:\WINDOWS\system32\svchost -k rpcss [CCenter.exe] CommandLine = "C:\Program Files\Rising\Rav\CCenter.exe" [svchost.exe] CommandLine = C:\WINDOWS\System32\svchost.exe -k netsvcs [svchost.exe] CommandLine = C:\WINDOWS\System32\svchost.exe -k NetworkService [svchost.exe] CommandLine = C:\WINDOWS\System32\svchost.exe -k LocalService [RavMonD.exe] CommandLine = "C:\Program Files\Rising\Rav\Ravmond.exe" [rfwsrv.exe] CommandLine = "c:\program files\rising\rfw\rfwsrv.exe" [RavStub.exe] CommandLine = "C:\Program Files\Rising\Rav\RavStub.exe" /RAVMOND [wdfmgr.exe] CommandLine = C:\WINDOWS\System32\wdfmgr.exe [alg.exe] CommandLine = C:\WINDOWS\System32\alg.exe [Explorer.EXE] CommandLine = C:\WINDOWS\Explorer.EXE [wscntfy.exe] CommandLine = C:\WINDOWS\system32\wscntfy.exe [RavTask.exe] CommandLine = "C:\PROGRAM FILES\RISING\RAV\RAVTASK.EXE" -SYSTEM [RfwMain.exe] CommandLine = "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup [ctfmon.exe] CommandLine = "C:\WINDOWS\system32\ctfmon.exe" [RavMon.exe] CommandLine = "C:\Program Files\Rising\Rav\Ravmon.exe" -SYSTEM [QQ.exe] CommandLine = "D:\Program Files\Tencent\QQ.exe" [TIMPlatform.exe] CommandLine = "D:\Program Files\Tencent\TIMPlatform.exe" -Embedding [Rav.exe] CommandLine = "C:\Program Files\Rising\Rav\Rav.exe" [iexplore.exe] CommandLine = "C:\Program Files\Internet Explorer\iexplore.exe" [KkScan.exe] CommandLine = "C:\Program Files\Rising\KakaToolBar\KkScan.exe" R3 - URLSearchHook: (no name) - {0A00D11E-B1E7-44b5-AD88-C9190876AAC4} - (no file) O1 - Hosts: 60.190.127.84 www.heima.com O1 - Hosts: 60.190.127.84 www.4399.com O1 - Hosts: 60.190.127.84 www.66mh.com O1 - Hosts: 60.190.127.84 www.915mh.com O1 - Hosts: 60.190.127.84 www.28mh.com O1 - Hosts: 60.190.127.84 www.26652.com O1 - Hosts: 60.190.127.84 www.98mh.com O1 - Hosts: 60.190.127.84 www.5173.com O1 - Hosts: 60.190.127.84 www.jy173.com O1 - Hosts: 60.190.127.84 www.haomhsf.com O1 - Hosts: 60.190.127.84 www.88jb.com O1 - Hosts: 60.190.127.84 www.d1v.cn O1 - Hosts: 60.190.127.84 www.mhxyq.com O1 - Hosts: 60.190.127.84 games.sina.com.cn O1 - Hosts: 60.190.127.84 games.enet.com.cn O1 - Hosts: 60.190.127.84 www.menghuanxiyou.net O1 - Hosts: 60.190.127.84 doseo.yimeng.com.cn O1 - Hosts: 60.190.127.84 menghuanxiyou.net O1 - Hosts: 60.190.127.84 www.axzj.com O1 - Hosts: 60.190.127.84 www.173mh.com O1 - Hosts: 60.190.127.84 www.91mh.com O1 - Hosts: 60.190.127.84 q811.c5u.cn O1 - Hosts: 60.190.127.84 www.qq262.com O1 - Hosts: 60.190.127.84 q817.c5u.cn O1 - Hosts: 60.190.127.84 28hh.com O1 - Hosts: 60.190.127.84 www.28hh.com O1 - Hosts: 60.190.127.84 www.234f.net O1 - Hosts: 60.190.127.84 www.23mh.com O1 - Hosts: 60.190.127.84 www.dh4f.cxo.cn O1 - Hosts: 60.190.127.84 www.onlysf.net O1 - Hosts: 60.190.127.84 bbs.yezizhu.com O1 - Hosts: 60.190.127.84 www.hotqq.com O1 - Hosts: 60.190.127.84 www.mhxysf.com O1 - Hosts: 60.190.127.84 bbs.08518.cn O1 - Hosts: 60.190.127.84 www.173at.com O1 - Hosts: 60.190.127.84 www.mfmh.cxo.cn O1 - Hosts: 60.190.127.84 www.qqfo.cxo.cn O1 - Hosts: 60.190.127.84 game.tyfo.com O1 - Hosts: 60.190.127.84 www.hao123.com O1 - Hosts: 60.190.127.84 club.heima.com O1 - Hosts: 60.190.127.84 post.baidu.com O1 - Hosts: 60.190.127.84 games.heima.com O1 - Hosts: 60.190.127.84 www.sou1234.com O1 - Hosts: 60.190.127.84 zhidao.baidu.com O1 - Hosts: 60.190.127.84 www.16sf.cn O1 - Hosts: 60.190.127.84 www.169wg.com O1 - Hosts: 60.190.127.84 www.778mh.com O1 - Hosts: 60.190.127.84 www.lawhome.net O1 - Hosts: 60.190.127.84 fuwu.bcqx.com O1 - Hosts: 60.190.127.84 sf.543.com.cn O1 - Hosts: 60.190.127.84 mhxy66.bokee.com O1 - Hosts: 60.190.127.84 xyq.hlgame.com O1 - Hosts: 60.190.127.84 xyq.lcinfo.cn O1 - Hosts: 60.190.127.84 xyq.cnbb.com.cn O1 - Hosts: 60.190.127.84 xyq.yezizhu.com O1 - Hosts: 60.190.127.84 xyq.tianya.net O1 - Hosts: 60.190.127.84 xyq.92wy.com O1 - Hosts: 60.190.127.84 xyq.yzvod.com O1 - Hosts: 60.190.127.84 xyq.yzvod.com O1 - Hosts: 60.190.127.84 www.sa20.com O1 - Hosts: 60.190.127.84 xyq.daqing.net O1 - Hosts: 60.190.127.84 games.52pk.net O1 - Hosts: 60.190.127.84 xyq.gamevnet.com O1 - Hosts: 60.190.127.84 xyq.373.cn O1 - Hosts: 60.190.127.84 www.258cq.com O1 - Hosts: 60.190.127.84 www.33mh.com O1 - Hosts: 60.190.127.84 www.47qq.com O1 - Hosts: 60.190.127.84 47qq.com O1 - Hosts: 60.190.127.84 33mh.com O1 - Hosts: 60.190.127.84 wtjy.hdt.net.cn O1 - Hosts: 60.190.127.84 www.mir2.com.cn O1 - Hosts: 60.190.127.84 www.wowchina.com O1 - Hosts: 60.190.127.84 www.4399.com O1 - Hosts: 60.190.127.84 www.taobao.com O1 - Hosts: 60.190.127.84 www.haohx.com O1 - Hosts: 60.190.127.84 www.ourgame.com O1 - Hosts: 60.190.127.84 www.ngacn.com O1 - Hosts: 60.190.127.84 www.chinagames.net O1 - Hosts: 60.190.127.84 www.5617.com O1 - Hosts: 60.190.127.84 www.5173.com O1 - Hosts: 60.190.127.84 www1.cga.com.cn O1 - Hosts: 60.190.127.84 www.ali213.net O1 - Hosts: 60.190.127.84 www.1t1t.com O1 - Hosts: 60.190.127.84 www.popsoft.com O1 - Hosts: 60.190.127.84 www.1ting.com O1 - Hosts: 60.190.127.84 www.666ccc.com O1 - Hosts: 60.190.127.84 www.qq163.com O1 - Hosts: 60.190.127.84 www.sogua.com O1 - Hosts: 60.190.127.84 www.999mh.com O1 - Hosts: 60.190.127.84 www.w100g.com O1 - Hosts: 60.190.127.84 www.5460.net O1 - Hosts: 60.190.127.84 www.wangyou.com O1 - Hosts: 60.190.127.84 www.greedland.net O1 - Hosts: 60.190.127.84 www.fzdm.com O1 - Hosts: 60.190.127.84 www.verycd.com O1 - Hosts: 60.190.127.84 www.mop.com O1 - Hosts: 60.190.127.84 www.qq.com O1 - Hosts: 60.190.127.84 www.265.com O1 - Hosts: 60.190.127.84 www.17173.com O1 - Hosts: 60.190.127.84 www.pcpop.com O1 - Hosts: 60.190.127.84 www.hjsm.net O1 - Hosts: 60.190.127.84 www.51yes.com O1 - Hosts: 60.190.127.84 count.51yes.com O1 - Hosts: 60.190.127.84 www.hc360.com O1 - Hosts: 60.190.127.84 www.126.com O1 - Hosts: 60.190.127.84 www.sohu.com O1 - Hosts: 60.190.127.84 www.163888.net O1 - Hosts: 60.190.127.84 www.7t7t.com O1 - Hosts: 60.190.127.84 www.wo99.com O1 - Hosts: 60.190.127.84 www.7xi.net O1 - Hosts: 60.190.127.84 www.99music.net O1 - Hosts: 60.190.127.84 www.haoting.com O1 - Hosts: 60.190.127.84 www.a8.com O1 - Hosts: 60.190.127.84 www.ydy.com O1 - Hosts: 60.190.127.84 www.915cs.net O1 - Hosts: 60.190.127.84 www.11y.cn O1 - Hosts: 60.190.127.84 www.ezit.com.cn O1 - Hosts: 60.190.127.84 www.wg999.com O1 - Hosts: 60.190.127.84 www.uc999.com O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v14.dll O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - C:\PROGRA~1\baidu\bar\baidubar.dll O3 - Toolbar: 百度超级搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\PROGRA~1\baidu\bar\baidubar.dll O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup O4 - Startup: desktop.ini = O4 - Global Startup: desktop.ini = O4 - Global Startup: Microsoft Office.lnk = D:\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\geturl.htm O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\getallurl.htm O8 - Extra context menu item: 上传到QQ网络硬盘 - O8 - Extra context menu item: 添加到QQ自定义面板 - O8 - Extra context menu item: 添加到QQ表情 - O8 - Extra context menu item: 用QQ彩信发送该图片 - O8 - Extra context menu item: 百度--MP3搜索 - RES://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDUMP3.HTM O8 - Extra context menu item: 百度--图片搜索 - RES://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDUIMG.HTM O8 - Extra context menu item: 百度--地图搜索 - RES://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDU_MAP.HTM O8 - Extra context menu item: 百度--新闻搜索 - RES://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDUNEWS.HTM O8 - Extra context menu item: 百度--歌词搜索 - RES://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDULYRIC.HTM O8 - Extra context menu item: 百度--知道搜索 - RES://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDU_ZHIDAO.HTM O8 - Extra context menu item: 百度--硬盘搜索 - RES://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDU_DISK.HTM O8 - Extra context menu item: 百度--站内搜索 - RES://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDU_SITE.HTM O8 - Extra context menu item: 百度--网页搜索 - RES://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDUSEARCH.HTM O8 - Extra context menu item: 百度--词典搜索 - RES://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDU_DIC.HTM O8 - Extra context menu item: 百度--贴吧搜索 - RES://C:\PROGRA~1\baidu\bar\baidubar.dll/BAIDUPOST.HTM O9 - Extra Button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - E:\浩方\浩方对战平台\GameClient.exe O9 - Extra Button: 访问瑞星网站 - {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E444} - http://www.rising.com.cn/?u=RSTB (file missing) O9 - Extra Button: 访问卡卡社区 - {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E445} - http://www.ikaka.com/?u=RSTB (file missing) O14 - IERESET.INF: START_PAGE_URL=about:blank O16 - DPF: DirectAnimation Java Classes - file://C:\WINDOWS\Java\classes\dajava.cab O16 - DPF: {28E0FA88-ABA8-4937-A247-3031F1A11165} - http://pi.51.net/download/diybar2.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1140156707796 O16 - DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} (AxSubmitControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab 2006-04-09 11:20:04
【晓晓】初生襁褓狮帖子:52 注册: 2004-02-18 来自:	分享到：

【晓晓】初生襁褓狮帖子:52 注册: 2004-02-18 来自:	发表于： 2006-04-09 11:20 \| 只看楼主短消息资料字号：小中大 2楼 O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll O18 - Protocol: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll O18 - Protocol: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: ipp - (no CLSID) - (no file) O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll O18 - Protocol: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll O18 - Protocol: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\System32\inetcomm.dll O18 - Protocol: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll O18 - Protocol: msdaipp - (no CLSID) - (no file) O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\System32\mshtml.dll O18 - Protocol: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll O18 - Protocol: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\System32\wiascr.dll O23 - Service: Performance Moniter (BARCASE) - - C:\WINDOWS\system32\rundll32.exe c:\windows\system32\wbem\irjit.dll,export 1087 O23 - Service: Human Interface Device Access (HidServ) - - C:\WINDOWS\system32\svchost.exe -k netsvcs O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - "C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe" O23 - Service: PsShutdown (PsShutdownSvc) - - C:\WINDOWS\system32\pssdnsvc.exe O23 - Service: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - "C:\Program Files\Rising\Rav\CCenter.exe" O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - "C:\Program Files\Rising\Rav\Ravmond.exe" O23 - Service: Indexing Manager (Templates) - Microsoft Corporation - C:\WINDOWS\system32\svchost.exe -k netsvcs 01项那里的那些网站原来是没有的后来上了一个网沾后就出现了！！是不是中了木马了！！
【晓晓】初生襁褓狮帖子:52 注册: 2004-02-18 来自:

<<上一主题|下一主题>>

1

1 / 1 页

跳转页

页面顶部

Powered by Discuz!NT