瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 c:\w32.exe是什么东西????急求金帖!

1   1  /  1  页   跳转

c:\w32.exe是什么东西????急求金帖!

c:\w32.exe是什么东西????急求金帖!


我是一个公司的职员,公司里没有网管,经理就让我负责下网络,可我是做设计的,不太懂这些啊。公司的电脑总共有70多台,现在公司里的电脑有4台染上了病毒,就是电脑的不停的出现发送邮件的警告!C盘里有c;\w32.exe和minesweeper.exe和su.exe,不知是不是“恶邮差”病毒,公司里装的是诺顿网络版杀毒软件,那台作为服务器的电脑也中了此病毒,该怎么办啊,现在结果染毒的都上不了网了!!
急死我了!!

中毒的电脑为一台xp, 2台2000 professional,1台2000 advanced server

求求各位给个办法吧!
不然我真的得撞墙了!!

谢谢!
谢谢!谢谢!
谢谢!谢谢!谢谢!

再次感谢!
最后编辑2006-05-22 12:47:08
分享到:
gototop
 

这是用sreng2扫描的结果!


2006-05-22,10:55:33

System Repair Engineer 2.0.12.350 (2.0 RC 1)
    Windows 2000 Professional Service Pack 3 - 管理权限用户 - 完整功能

以下内容被选中:
    所有的启动项目(包括注册表、启动文件夹、服务等)
    浏览器加载项
    正在运行的进程(包括进程模块信息)
    文件关联


启动项目
注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <SKYNET Personal FireWall><C:\Program Files\SkyNet\FireWall\PFW.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <ccApp><"C:\Program Files\Common Files\Symantec Shared\ccApp.exe">
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <vptray><C:\PROGRA~1\SYMANT~1\VPTray.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <Synchronization Manager><mobsync.exe /logon>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <CdnCtr><C:\Program Files\CNNIC\Cdn\cdnup.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <LoadPFW><wmimgr.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <RealTray><C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <Serial_Access_Num><>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <WinsSystem><C:\Program Files\Internet Explorer\syssmss.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <NetSpeeder><E:\chengxu\NetSpeeder.exe hide>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <IESAddr><>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <renewup><C:\Program Files\CNNIC\Cdn\cdnrenew.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <WINDOWS><C:\w32.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <shell><Explorer.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <Userinit><C:\WINNT\system32\userinit.exe,>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <AppInit_DLLs><>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  <ccenter><; >
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  <HPDJ Taskbar Utility><; >
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  <IdnMail><; >
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  <LTSMSG><; >
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  <NetSpeeder><; >
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  <RealTray><; C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  <Synchronization Manager><; mobsync.exe /logon>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  <WinVNC><; >

==================================
启动文件夹
[腾讯QQ]
  <C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\腾讯QQ.lnk><N>
[RedOffice 3.0]
  <C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\RedOffice 3.0.lnk><N>

==================================
服务
[Symantec Event Manager / ccEvtMgr]
  <"C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"><Symantec Corporation>
[Symantec Password Validation / ccPwdSvc]
  <"C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe"><Symantec Corporation>
[Symantec Settings Manager / ccSetMgr]
  <"C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"><Symantec Corporation>
[Symantec AntiVirus Definition Watcher / DefWatch]
  <"C:\Program Files\Symantec AntiVirus\DefWatch.exe"><Symantec Corporation>
[Logical Disk Manager Administrative Service / dmadmin]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[jlbkzou / jlbkzou]
  <"\\192.168.1.57\E$\NVCOM.EXE" -service><N/A>
[Net Login Helper / netlog]
  <C:\WINNT\system32\SCardSer.exe ><N/A>
[Network DRV / NTDRV]
  <"C:\WINNT\system32\netdrvr.exe"><Microsoft Corporation>
[SavRoam / SavRoam]
  <"C:\Program Files\Symantec AntiVirus\SavRoam.exe"><symantec>
[Symantec Network Drivers Service / SNDSrvc]
  <"C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe"><Symantec Corporation>
[Symantec AntiVirus / Symantec AntiVirus]
  <"C:\Program Files\Symantec AntiVirus\Rtvscan.exe"><Symantec Corporation>
[wins(WINS) / wins]
  <"C:\WINNT\system32\winscntrl.exe"><Microsoft Corporation>
[VNC Server / winvnc]
  <><N/A>

==================================
浏览器加载项
[CdnForIE Class]
  {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[IeControler Class]
  {9AFD91F9-6B03-4D22-A1E1-67D224CB7AB1} <E:\chengxu\IEMate.dll, Superhunter>
[手机短信]
  {00000000-0000-0001-0001-596BAEDD1289} <http://sms.3721.com/ie/index.htm, N/A>
[CdnForIE Class]
  {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[3721中文邮]
  {5D73EE86-05F1-49ed-B850-E423120EC329} <http://cmail.3721.com?fb=client, N/A>
[上网助手]
  {5D73EE86-05F1-49ed-B850-E423120EC338} <http://assistant.3721.com/index.htm?fb=Cns, N/A>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <D:\Program Files\QQ\Tencent\QQ.EXE, TENCENT>
[Real.com]
  {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} <C:\WINNT\System32\Shdocvw.dll, Microsoft Corporation>
[QQIEFloatBarCfgCmd Class]
  {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <D:\Program Files\QQ\Tencent\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[]
  {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} <http://assistant.3721.com/security1.htm?fb=Cns, N/A>
[]
  {FD00D911-7529-4084-9946-A29F1BDF4FE5} <http://assistant.3721.com/clean1.htm?fb=Cns, N/A>
[&Radio]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\System32\msdxm.ocx, N/A>
[FlashGet Bar]
  {E0E899AB-F487-11D5-8D29-0050BA6940E3} <D:\FLASHGET\fgiebar.dll, N/A>
[上网助手]
  {1B0E7716-898E-48cc-9690-4E338E8DE1D3} <, N/A>
[MSN]
  {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} <C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\zh-cn\msntb.dll, Microsoft Corporation>
[Edit Class]
  {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\WINNT\system32\CMBEdit.dll, >
[CEditCtrl Object]
  {488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINNT\system32\aliedit\AliEdit.dll, www.alipay.com>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\macromed\flash\Flash.ocx, Macromedia, Inc.>
[Download All by FlashGet]
  <, N/A>
[Download using FlashGet]
  <, N/A>
[上传到QQ网络硬盘]
  <D:\Program Files\QQ\Tencent\AddToNetDisk.htm, N/A>
[中国搜索(&Z)]
  <C:\WINNT\I_SearchIE.htm, N/A>
[使用彩信超级自写发送到手机]
  <http://mms.sina.com.cn/mmsnews.html, N/A>
[发送图片到手机(&M)]
  <http://sms.sina.com.cn/diy/send.html?from=20000001, N/A>
[收藏此页到ViVi]
  <http://vivi.sina.com.cn/collect/click.php?agent=ddt, N/A>
[新浪搜索]
  <http://cha.sina.com.cn/ddt.html, N/A>
[添加到QQ自定义面板]
  <D:\Program Files\QQ\Tencent\AddPanel.htm, N/A>
[添加到QQ表情]
  <D:\Program Files\QQ\Tencent\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <D:\Program Files\QQ\Tencent\SendMMS.htm, N/A>
[访问通用网址]
  <, N/A>

==================================
gototop
 

请用http://forum.ikaka.com/topic.asp?board=28&artid=6979213    一楼的工具HijackThis扫描日志上来.
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT