诺顿杀毒软件显示:
Scan type: Realtime Protection Scan
Event: Virus Found!
Virus name: Downloader
File: C:\Program Files\3721\helper.dll
Location: C:\Program Files\3721
Computer: LSSERVER
User: Administrator
Action taken: Clean failed : Quarantine failed : Access denied
Date found: 2006年8月10日 16:35:08
我用HIjack This扫描了的日志如下:
HijackThis_815汉化版扫描日志 V1.99.1
保存于 16:23:11, 日期 2006-08-10
操作系统： Windows 2000 SP4 (WinNT 5.00.2195)
浏览器： Internet Explorer v6.00 SP1 (6.00.2800.1106)
当前运行的进程：
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\termsrv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\msdtc.exe
C:\Program Files\Dell\OpenManage\OMSA\bin\dcevt32.exe
C:\Program Files\Dell\OpenManage\OMSA\bin\dcstor32.exe
C:\WINNT\System32\tcpsvcs.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\llssrv.exe
C:\Program Files\Dell\OpenManage\Array Manager\mr2kserv.exe
d:\MICROS~1\MSSQL\binn\sqlservr.exe
d:\orant\bin\oracle80.exe
d:\orant\bin\oracle80.exe
d:\orant\BIN\TNSLSNR80.EXE
d:\orant\bin\OWASTsvr.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\RsFsa.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Dell\OpenManage\iws\bin\win32\omaws32.exe
d:\MICROS~1\MSSQL\binn\sqlagent.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\lserver.exe
C:\WINNT\System32\ups.exe
C:\Program Files\Dell\OpenManage\Array Manager\VxSvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\wins.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\System32\dns.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe
d:\orant\BIN\strtdb80.exe
d:\orant\BIN\strtdb80.exe
C:\PROGRA~1\Dell\OPENMA~1\oldiags\vendor\pcdoctor\bin\diagorb.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\Rundll32.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\atiptaxx.exe
C:\WINNT\system32\internat.exe
C:\WINNT\system32\spool\drivers\w32x86\3\CAP3LAK.EXE
C:\WINNT\SYSTEM32\SPOOL\DRIVERS\W32X86\3\CAP3SWK.EXE
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\WINNT\system32\RsSub.exe
C:\WINNT\system32\RsEng.exe
C:\WINNT\system32\conime.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Rising\Rav\Ravmond.exe
C:\Program Files\Rising\Rav\RAVMON.EXE
C:\Program Files\Rising\Rav\RavStub.exe
C:\WINNT\system32\msiexec.exe
C:\WINNT\system32\MsiExec.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
D:\吴杭华\hi jack\HijackThis1991zww.exe
O2 - BHO: UpdateCache Class - {6E28339B-7A2A-47B6-AEB2-46BA53782378} - (no file)
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINNT\DOWNLO~1\CnsHook.dll
O3 - IE工具栏增项: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - IE工具栏增项: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - 启动项HKLM\\Run: [ATIPTA] atiptaxx.exe
O4 - 启动项HKLM\\Run: [CnsMin] Rundll32.exe C:\WINNT\DOWNLO~1\CnsMin.dll,Rundll32
O4 - 启动项HKLM\\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - 启动项HKLM\\Run: [helper.dll] C:\WINNT\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - 启动项HKLM\\RunOnce: [SymantecCleanUp] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\SymClnUp.exe
O4 - 启动项HKLM\\RunOnce: [CnsMinEx.dll] regsvr32.exe /s
O4 - 启动项HKLM\\RunOnce: [CnsHook.dll] regsvr32 /s C:\WINNT\DOWNLO~1\CnsHook.dll
O4 - 启动项HKLM\\RunOnce: [cnshint.dll] regsvr32 /s C:\WINNT\DOWNLO~1\cnshint.dll
O4 - 启动项HKLM\\RunOnce: [CnsMinKP] rundll32.exe C:\WINNT\DOWNLO~1\KEEPMAIN.DLL,ReInstallKP
O4 - 启动项HKLM\\RunOnce: [3721C:\PROGRA~1\3721\alrex.dll112779437] regsvr32 /s C:\PROGRA~1\3721\alrex.dll
O4 - 启动项HKLM\\RunOnce: [3721C:\PROGRA~1\3721\alliveex.dll112795421] regsvr32 /s C:\PROGRA~1\3721\alliveex.dll
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O4 - Global Startup: Canon LASER SHOT LBP-1120 状态窗口.LNK = C:\WINNT\system32\spool\drivers\w32x86\3\CAP3LAK.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: 服务管理器.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - IE右键菜单中的新增项目: 使用网际快车下载 - C:\PROGRA~1\FlashGet\jc_link.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链接 - C:\PROGRA~1\FlashGet\jc_all.htm
O9 - 浏览器额外的按钮: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail (file missing)
O9 - 浏览器额外的按钮: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao (file missing)
O9 - 浏览器额外的按钮: 雅虎助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist (file missing)
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE (file missing)
O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE (file missing)
O9 - 浏览器额外的按钮: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - 浏览器额外的“工具”菜单项: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - 浏览器额外的按钮: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg (file missing)
O9 - 浏览器额外的按钮: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - 浏览器额外的“工具”菜单项: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - 浏览器额外的按钮: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O9 - 浏览器额外的“工具”菜单项: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O11 - Options group: [!CNS] 网络实名
O17 - HKLM\System\CCS\Services\Tcpip\..\{21D20BE6-026A-44C2-843C-DBA249BB99F0}: NameServer = 202.101.172.35
O17 - HKLM\System\CS1\Services\Tcpip\..\{21D20BE6-026A-44C2-843C-DBA249BB99F0}: NameServer = 218.108.248.245,218.108.248.219
O17 - HKLM\System\CS2\Services\Tcpip\..\{21D20BE6-026A-44C2-843C-DBA249BB99F0}: NameServer = 202.101.172.35
O17 - HKLM\System\CS3\Services\Tcpip\..\{21D20BE6-026A-44C2-843C-DBA249BB99F0}: NameServer = 202.101.172.35
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O23 - NT 服务: Dell OpenManage Server Agent Event Monitor (dcevt32) - Dell Inc. - C:\Program Files\Dell\OpenManage\OMSA\bin\dcevt32.exe
O23 - NT 服务: Dell OpenManage Server Agent (dcstor32) - Dell Inc. - C:\Program Files\Dell\OpenManage\OMSA\bin\dcstor32.exe
O23 - NT 服务: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - NT 服务: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\system32\dmadmin.exe
O23 - NT 服务: mr2kserv - Unknown owner - C:\Program Files\Dell\OpenManage\Array Manager\mr2kserv.exe
O23 - NT 服务: MySql - Unknown owner - C:/mysql/bin/mysqld-nt.exe (file missing)
O23 - NT 服务: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - NT 服务: OracleAgent80 - oracle - d:\orant\agentbin\DBSNMP.EXE
O23 - NT 服务: OracleClientCache80 - Unknown owner - d:\orant\BIN\ONRSD80.EXE
O23 - NT 服务: OracleCMAdminService80 - Unknown owner - d:\orant\BIN\CMADM80.EXE
O23 - NT 服务: OracleCManService80 - Unknown owner - d:\orant\BIN\CMGW80.EXE
O23 - NT 服务: OracleDataGatherer - Unknown owner - d:\orant\bin\vppdc.exe
O23 - NT 服务: OracleExtprocAgent - Unknown owner - d:\orant\BIN\EXTPROCT.EXE
O23 - NT 服务: OracleNamesService80 - Unknown owner - d:\orant\BIN\NAMES80.EXE
O23 - NT 服务: OracleServiceBASE - Oracle Corporation - d:\orant\bin\oracle80.exe
O23 - NT 服务: OracleServiceTLT - Oracle Corporation - d:\orant\bin\oracle80.exe
O23 - NT 服务: OracleStartBASE - Unknown owner - d:\orant\BIN\strtdb80.exe
O23 - NT 服务: OracleStartTLT - Unknown owner - d:\orant\BIN\strtdb80.exe
O23 - NT 服务: OracleTNSListener80 - Unknown owner - d:\orant\BIN\TNSLSNR80.EXE
O23 - NT 服务: OracleWebAssistant - Oracle Corporation - d:\orant\bin\OWASTsvr.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
O23 - NT 服务: Secure Port Server (Server Administrator) - Unknown owner - %SystemDrive%\Program Files\Dell\OpenManage\iws\bin\win32\omaws32.exe (file missing)
O23 - NT 服务: Disk Management Service (VxSvc) - VERITAS Software Corp. - C:\Program Files\Dell\OpenManage\Array Manager\VxSvc.exe
哪位好心人能帮我看看么?
