中了这病毒Adware.Cockoo.a 怎么也杀不掉 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛中了这病毒Adware.Cockoo.a 怎么也杀不掉

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

12 3

1 / 3 页

跳转页

中了这病毒Adware.Cockoo.a 怎么也杀不掉

SY小飞猪初生襁褓狮帖子:27 注册: 2007-06-08 来自:	发表于： 2007-06-08 23:27 \| 只看楼主短消息资料字号：小中大 1楼中了这病毒Adware.Cockoo.a 怎么也杀不掉老是跳网站．．．内存病毒杀不掉了 2007-06-09 13:23:05
SY小飞猪初生襁褓狮帖子:27 注册: 2007-06-08 来自:	分享到：

SY小飞猪初生襁褓狮帖子:27 注册: 2007-06-08 来自:	发表于： 2007-06-08 23:28 \| 只看楼主短消息资料字号：小中大 2楼 Logfile of Kaka v2. 0. 3. 0 Scan Module v1. 0. 6. 1 Scan saved at 23:14:53, on 2005-06-08 Platform: Microsoft Windows XP Professional Service Pack 2 (Build 2600) MSIE: Internet Explorer v6.00 SP2; (6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)) O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 008.cn O1 - Hosts: 127.0.0.1 ultimate-best-hgh.0my.net O1 - Hosts: 127.0.0.1 www.139500.com O1 - Hosts: 127.0.0.1 www.1yin.net O1 - Hosts: 127.0.0.1 ****cn O1 - Hosts: 127.0.0.1 www.37021.com O1 - Hosts: 127.0.0.1 www.47555.net O1 - Hosts: 127.0.0.1 www.511ring.com O1 - Hosts: 127.0.0.1 me.5e163.com O1 - Hosts: 127.0.0.1 www.777888.com O1 - Hosts: 127.0.0.1 www.77ttt.com O1 - Hosts: 127.0.0.1 www.9p.cn O1 - Hosts: 127.0.0.1 abcdesign.ru O1 - Hosts: 127.0.0.1 gutemine.wu-wien.ac.at O1 - Hosts: 127.0.0.1 math.kobe-u.ac.jp O1 - Hosts: 127.0.0.1 www.aifind.info O1 - Hosts: 127.0.0.1 www.allyes.com O1 - Hosts: 127.0.0.1 www.aogo.net O1 - Hosts: 127.0.0.1 baltnet.ru O1 - Hosts: 127.0.0.1 quotes.barchart.com O1 - Hosts: 127.0.0.1 free.bestialityhost.com O1 - Hosts: 127.0.0.1 cctv1.net O1 - Hosts: 127.0.0.1 cctv8.net O1 - Hosts: 127.0.0.1 www.cctv8.net O1 - Hosts: 127.0.0.1 ciachoo.pl O1 - Hosts: 127.0.0.1 www.play.cn.gs O1 - Hosts: 127.0.0.1 www.cnqb.net O1 - Hosts: 127.0.0.1 www.feixue.net O1 - Hosts: 127.0.0.1 www.xiliao.com.cn O1 - Hosts: 127.0.0.1 alexey.pioneers.com.ru O1 - Hosts: 127.0.0.1 www.coolcdrom.com O1 - Hosts: 127.0.0.1 www.coolseach.com O1 - Hosts: 127.0.0.1 puldk490gj.da.ru O1 - Hosts: 127.0.0.1 dicto.ru O1 - Hosts: 127.0.0.1 www.dj3344.com O1 - Hosts: 127.0.0.1 www.donttrip.org O1 - Hosts: 127.0.0.1 www.ehomeday.com O1 - Hosts: 127.0.0.1 elemental.ru O1 - Hosts: 127.0.0.1 errorguard.com O1 - Hosts: 127.0.0.1 friendlygreeting.com O1 - Hosts: 127.0.0.1 zhp.gdynia.pl O1 - Hosts: 127.0.0.1 www.gg888.net O1 - Hosts: 127.0.0.1 gin.ru O1 - Hosts: 127.0.0.1 www.girlchinese.com O1 - Hosts: 127.0.0.1 glass-master.ru O1 - Hosts: 127.0.0.1 photo.gornet.ru O1 - Hosts: 127.0.0.1 relay.great.ru O1 - Hosts: 127.0.0.1 hack-gegen-rechts.com O1 - Hosts: 127.0.0.1 hgrstrailer.com O1 - Hosts: 127.0.0.1 www.homepage.com O1 - Hosts: 127.0.0.1 hotbar.com O1 - Hosts: 127.0.0.1 intellect.lvc O1 - Hosts: 127.0.0.1 interfoodtd.ru O1 - Hosts: 127.0.0.1 jewishgen.org O1 - Hosts: 127.0.0.1 www.jixian.net O1 - Hosts: 127.0.0.1 k2kapital.com O1 - Hosts: 127.0.0.1 security.kolla.de O1 - Hosts: 127.0.0.1 www.kuliao.com O1 - Hosts: 127.0.0.1 laugh-mail.net O1 - Hosts: 127.0.0.1 7b.com.cn O1 - Hosts: 127.0.0.1 9505.com O1 - Hosts: 127.0.0.1 www.piaoxue.com O1 - Hosts: 127.0.0.1 marketscore.com O1 - Hosts: 127.0.0.1 www.mir0.com O1 - Hosts: 127.0.0.1 momentum.ru O1 - Hosts: 127.0.0.1 www.mtv51.com O1 - Hosts: 127.0.0.1 www.mydj2005.com O1 - Hosts: 127.0.0.1 nefkom.net O1 - Hosts: 127.0.0.1 no-abi2003.de O1 - Hosts: 127.0.0.1 tdi-router.opola.pl O1 - Hosts: 127.0.0.1 packages.debian.or.jp O1 - Hosts: 127.0.0.1 perfectgirls.net O1 - Hosts: 127.0.0.1 peterstar.ru O1 - Hosts: 127.0.0.1 pgipearls.com O1 - Hosts: 127.0.0.1 phg.pl O1 - Hosts: 127.0.0.1 vip.pnet.pl O1 - Hosts: 127.0.0.1 sec.polbox.pl O1 - Hosts: 127.0.0.1 polobeer.de O1 - Hosts: 127.0.0.1 porno-mania.net O1 - Hosts: 127.0.0.1 home.profootball.ru O1 - Hosts: 127.0.0.1 qianbai.com O1 - Hosts: 127.0.0.1 ad.qingyule.com O1 - Hosts: 127.0.0.1 www.qq168.net O1 - Hosts: 127.0.0.1 www.qq3344.com O1 - Hosts: 127.0.0.1 www.qq92.com O1 - Hosts: 127.0.0.1 www.qqwz.com O1 - Hosts: 127.0.0.1 www.qu123.com O1 - Hosts: 127.0.0.1 republika.pl O1 - Hosts: 127.0.0.1 www.richfind.com O1 - Hosts: 127.0.0.1 rollenspielzirkel.de O1 - Hosts: 127.0.0.1 safer-networking.org O1 - Hosts: 127.0.0.1 sdsauto.ru O1 - Hosts: 127.0.0.1 www.searchpage.cc O1 - Hosts: 127.0.0.1 www.seekeasysoft.net O1 - Hosts: 127.0.0.1 shadkhan.ru O1 - Hosts: 127.0.0.1 slavarik.ru O1 - Hosts: 127.0.0.1 sovea.de O1 - Hosts: 127.0.0.1 spybot.info O1 - Hosts: 127.0.0.1 www.start-page.info O1 - Hosts: 127.0.0.1 lars-s.privat.t-online.de O1 - Hosts: 127.0.0.1 u.t2cn.com O1 - Hosts: 127.0.0.1 www.7939.com O1 - Hosts: 127.0.0.1 www.4199.com O1 - Hosts: 127.0.0.1 www.3448.com O1 - Hosts: 127.0.0.1 www.6781.com O1 - Hosts: 127.0.0.1 it.trendmicro-europe.com O1 - Hosts: 127.0.0.1 trendmicro.it O1 - Hosts: 127.0.0.1 truefriends.net O1 - Hosts: 127.0.0.1 www.tthao.com O1 - Hosts: 127.0.0.1 www.ttrx.net O1 - Hosts: 127.0.0.1 tuhart.net O1 - Hosts: 127.0.0.1 www.unionsky.cn O1 - Hosts: 127.0.0.1 www.unionsky.com O1 - Hosts: 127.0.0.1 www.unionsky.net O1 - Hosts: 127.0.0.1 vconsole.net O1 - Hosts: 127.0.0.1 virtumonde.com O1 - Hosts: 127.0.0.1 gamma.vyborg.ru O1 - Hosts: 127.0.0.1 financial.washingtonpost.com O1 - Hosts: 127.0.0.1 webpark.pl O1 - Hosts: 127.0.0.1 wishken.com O1 - Hosts: 127.0.0.1 www.yeapple.com O1 - Hosts: 127.0.0.1 www.yibinren.com O1 - Hosts: 127.0.0.1 www.youmiss.com O1 - Hosts: 127.0.0.1 www.yysky.net O1 - Hosts: 127.0.0.1 zelnet.ru O1 - Hosts: 127.0.0.1 www.zhengdian.com O1 - Hosts: 127.0.0.1 abc.265.com O1 - Hosts: 127.0.0.1 555.265.com O1 - Hosts: 127.0.0.1 www.baidu345.com O1 - Hosts: 127.0.0.1 www.37ss.com O1 - Hosts: 127.0.0.1 my123.com O1 - Hosts: 127.0.0.1 http://www.chinahr.com/ O1 - Hosts: 127.0.0.1 http://specials.ebay.com.cn/1yuan O1 - Hosts: 127.0.0.1 http://specials.ebay.com.cn/cheap O1 - Hosts: 127.0.0.1 http://www.wlstock.com/index.htm? O1 - Hosts: 127.0.0.1 http://www.lsjmw.net/bl05.htm?site=bl05_ O1 - Hosts: 127.0.0.1 http://qz.magforum.net/union/2c6s7d8y9u3w0g6t7m2i5t7d0a7w9g6hvtceyrbhzlf5d1q2e4d7g9q0y7d5c6c7z9m7u5r6y8u6g8d7o9e8d5a2z5g4a8v9h3e0c6j4w001.html O1 - Hosts: 127.0.0.1 http://www.openv.tv/
SY小飞猪初生襁褓狮帖子:27 注册: 2007-06-08 来自:

SY小飞猪初生襁褓狮帖子:27 注册: 2007-06-08 来自:	发表于： 2007-06-08 23:28 \| 只看楼主短消息资料字号：小中大 3楼 O2 - BHO: 超级兔子上网精灵 - {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} - C:\Program Files\Super Rabbit\MagicSet\haokanbar.dll O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\KakaTool.dll O3 - Toolbar: 超级兔子上网精灵 - {43869BB3-22FD-4F15-9B46-238106BA2F4E} - C:\Program Files\Super Rabbit\MagicSet\haokanbar.dll O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ProxyCap] D:\SOFTST~1.0汉\ProxyCap.exe O4 - HKCU\..\Run: [r7eem] C:\WINDOWS\system32\r7eem.exe O4 - HKCU\..\Run: [Super Rabbit IEPro] C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [runeip] C:\Program Files\Rising\AntiSpyware\runiep.exe O4 - HKLM\..\Run: [miniqqlive] "D:\V100\MiniQQLive.exe" O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [svpecld] C:\WINDOWS\system32\svpecld.exe O4 - HKLM\..\Run: [r7eem] C:\WINDOWS\system32\r7eem.exe O4 - HKLM\..\RunOnce: [KKDelay] C:\Program Files\Rising\AntiSpyware\RunOnce.exe O4 - Startup: desktop.ini = O4 - Startup: QQ游戏启动加速程序.lnk = D:\QQGame\Accel.exe O4 - Startup: 腾讯QQ.lnk = D:\QQ\QQ.exe O4 - Global Startup: desktop.ini = O4 - Global Startup: 星空极速.lnk = C:\Program Files\ChinaNet\VnetClient.exe O8 - Extra context menu item: &使用快车(FlashGet)下载 - D:\讯垒\jc_link.htm O8 - Extra context menu item: &使用快车(FlashGet)下载全部链接 - D:\讯垒\jc_all.htm O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\QQ\AddToNetDisk.htm O8 - Extra context menu item: 使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\geturl.htm O8 - Extra context menu item: 使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\getallurl.htm O8 - Extra context menu item: 添加到QQ自定义面板 - D:\QQ\AddPanel.htm O8 - Extra context menu item: 添加到QQ表情 - D:\QQ\AddEmotion.htm O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\QQ\SendMMS.htm O9 - Extra Button: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\Thunder.exe O9 - Extra 'Tools' menuitem: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\Thunder.exe O9 - Extra Button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\QQ\QQ.EXE O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\QQ\QQ.EXE O9 - Extra Button: 快车 - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\讯垒\FlashGet.exe O9 - Extra 'Tools' menuitem: 快车(FlashGet) - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\讯垒\FlashGet.exe O10 - Unknown file in Winsock LSP: C:\WINDOWS\system32\cdnns.dll O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome O16 - DPF: {05C1004E-2596-48E5-8E26-39362985EEB9} - http://p3p.sogou.com/MMCShell.cab O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} (Edit Class) - https://www.sz1.cmbchina.com/download/CMBEdit.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (EditCtrl Class) - https://img.alipay.com/download/1101/aliedit.cab O16 - DPF: {79312BD7-AB1A-4730-829F-F43C984D0A9D} (ACNSTAT Class) - http://www.ctsunion.com/CTS.CAB O16 - DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} (AxSubmitControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab O16 - DPF: {A22B8FD2-4CAA-4EFB-82F7-680CD656D9B0} (NowStarter Control) - http://www.gogobox.com.tw/neo.fld/GNowStarter.cab O16 - DPF: {EC0978ED-24E3-403C-AB7A-060E388553E6} (BoBo P2P多媒体网络点播/广播/直播系统 V3) - http://7099.com/BoBo_ActiveX_V3.ocx O17 - HKLM\System\CCS\Services\Tcpip\..\{268D0C6D-C493-483C-84F3-5335CDE19D6B}: NameServer = 202.96.209.5 202.109.116.116 O18 - Filter : text/html - {54B95211-7D77-11D2-9F80-00104B107C96} - (no file) O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll O18 - Protocol: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: ipp - (no CLSID) - (no file) O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll O18 - Protocol: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll O18 - Protocol: msdaipp - (no CLSID) - (no file) O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll O23 - Service: AVG Anti-Spyware Guard (AVG Anti-Spyware Guard) - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: BackgroundlligentTransfe (ComputerBrowser) - - C:\WINDOWS\SVCHOST.EXE O23 - Service: Human Interface Device Access (HidServ) - - C:\WINDOWS\system32\svchost.exe -k netsvcs O23 - Service: msn (msn) - Microsoft Corporation - C:\WINDOWS\system32\ime\svchost.exe a O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Windows pomz RunThem (pomz) - - C:\WINDOWS\system32\svchost.exe -k netsvcs O23 - Service: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rfw\rfwsrv.exe O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - "C:\Program Files\Rising\Rav\CCenter.exe" O23 - Service: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - "C:\Program Files\Rising\Rav\Ravmond.exe" O23 - Service: User Privilege Service (usprserv) - Microsoft Corporation - C:\WINDOWS\system32\svchost.exe -k netsvcs O23 - Service: Windows Firewall (Windows Firewall) - Microsoft Corporation - C:\WINDOWS\svchost.exe
SY小飞猪初生襁褓狮帖子:27 注册: 2007-06-08 来自:

SY小飞猪初生襁褓狮帖子:27 注册: 2007-06-08 来自:	发表于： 2007-06-08 23:29 \| 只看楼主短消息资料字号：小中大 4楼我用了兔子　加卡卡　ＡＶＧ+瑞星．．还是没弄好现在来求助５５５５５５５
SY小飞猪初生襁褓狮帖子:27 注册: 2007-06-08 来自:

风之咏者社区嘉宾帖子:18942 注册: 2003-07-27 来自:此心安处是吾乡	发表于： 2007-06-09 04:15 \| 短消息资料字号：小中大 5楼以下意见仅供参考，是否修复决定权在您。如果您知道某个项目是安全的，自然不必修复。如果您对注册表等部分的操作不熟悉，那么请找熟悉电脑的朋友帮忙，贸然操作很容易导致更大的问题，一切后果只能您自己承担。首先，您的log里面缺少正在运行的程序，使得我们每办法帮您终止正在运行的恶意程序。请您重新扫描一个log上传，太长的话可以以回帖的方式继续发布。 1 待得知需终止的进程后，先终止要终止的进程（关闭所有窗口，同时按下CTRL+ALT+DELETE，在打开的窗口中选中要终止的进程，然后按下“结束进程”，若有多个则依次结束，最后关闭该窗口。） 2 关闭以下服务关闭服务方法：点击“开始”→“运行”，在弹出的“运行”对话框中输入“services.msc”（注意输入时没有引号），然后点击“确定”按钮，接着会出现一个用来管理windows各项服务的界面→找到要关闭的服务名，鼠标双击打开，点“停止”，待服务停止后（服务状态变为“已停止”），点击“启动类型”右边的下拉键头，将“启动类型”改为“已禁用”。 BackgroundlligentTransfe (ComputerBrowser) msn (msn) Windows pomz RunThem (pomz) User Privilege Service (usprserv) Windows Firewall (Windows Firewall) 这个注意，不要和正常服务Windows Firewall/Internet Connection Sharing (ICS)弄混。 3 接着请重新使用HijackThis扫描一次，选中下面建议修复的项目（如果还在的话），让HijackThis修复，修复前请允许HijackThis保留备份。 O4 - HKCU\..\Run: [r7eem] C:\WINDOWS\system32\r7eem.exe O4 - HKLM\..\Run: [svpecld] C:\WINDOWS\system32\svpecld.exe O4 - HKLM\..\Run: [r7eem] C:\WINDOWS\system32\r7eem.exe O4 - Startup: desktop.ini = O4 - Global Startup: desktop.ini = 注意，O4 - HKLM\..\Run: [svpecld] C:\WINDOWS\system32\svpecld.exe可能与“星空极速”有关，请参考 http://www.rslj.cn/7a33b3152.aspx http://bbs.shxz.net/archiver/?tid-14762.html 4 修复后，运行注册表编辑器，找到HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\，找到下面5个服务对应的子键，分别记下其对应的文件（ImagePath），然后删除这5个服务对应的子键。千万小心莫弄错。 BackgroundlligentTransfe (ComputerBrowser) msn (msn) WindowspomzRunThem (pomz) UserPrivilegeService (usprserv) WindowsFirewall (Windows Firewall) 5 修复后，重新启动到安全模式，在文件夹选项中，显示隐藏文件和取消“隐藏受保护的操作系统文件”，最后找到如下文件并删除（如果有的话）。如果担心误删正常文件可以先把它压缩保存。进入安全模式的方法:重新启动电脑, 开机检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式进入Windows。 C:\WINDOWS\SVCHOST.EXE（注意这个文件中的O也许是数字0） C:\WINDOWS\svchost.exe C:\WINDOWS\system32\ime\svchost.exe 以及刚刚记下的那5个被删除的服务的对应的文件。如果要做得更彻底一些，那就再分别找一下和这5个被删除的服务的对应的文件同时建立的文件，那些也可能有问题，但要具体分析。如果瑞星不能查请先上报瑞星。
风之咏者社区嘉宾帖子:18942 注册: 2003-07-27 来自:此心安处是吾乡

SY小飞猪初生襁褓狮帖子:27 注册: 2007-06-08 来自:	发表于： 2007-06-09 07:52 \| 只看楼主短消息资料字号：小中大 6楼 Logfile of HijackThis v1.99.1 Scan saved at 7:31:16, on 2005-6-9 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Rising\Rav\CCenter.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Rising\Rfw\rfwsrv.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Rising\Rfw\RfwMain.exe C:\WINDOWS\system32\Svchost.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Rising\Rav\RavTask.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\vsnpstd3.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Rising\AntiSpyware\runiep.exe C:\Program Files\LClock\LClock.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE C:\Program Files\ChinaNet\VnetClient.exe D:\QQ\QQ.exe D:\QQ\TIMPlatform.exe C:\Program Files\Rising\Rav\Ravmond.exe C:\Program Files\Rising\Rav\RAVMON.EXE C:\Program Files\Rising\Rav\RavStub.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Internet Explorer\iexplore.exe D:\HijackThis.exe
SY小飞猪初生襁褓狮帖子:27 注册: 2007-06-08 来自:

SY小飞猪初生襁褓狮帖子:27 注册: 2007-06-08 来自:	发表于： 2007-06-09 07:53 \| 只看楼主短消息资料字号：小中大 7楼 O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\KakaTool.dll O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [runeip] C:\Program Files\Rising\AntiSpyware\runiep.exe O4 - HKLM\..\Run: [miniqqlive] "D:\V100\MiniQQLive.exe" O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [svpecld] C:\WINDOWS\system32\svpecld.exe O4 - HKLM\..\RunOnce: [KKDelay] C:\Program Files\Rising\AntiSpyware\RunOnce.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ProxyCap] D:\SOFTST~1.0汉\ProxyCap.exe O4 - HKCU\..\Run: [Super Rabbit IEPro] C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD O4 - Startup: QQ游戏启动加速程序.lnk = D:\QQGame\Accel.exe O4 - Startup: 腾讯QQ.lnk = D:\QQ\QQ.exe O4 - Global Startup: 星空极速.lnk = C:\Program Files\ChinaNet\VnetClient.exe O8 - Extra context menu item: &使用快车(FlashGet)下载 - D:\讯垒\jc_link.htm O8 - Extra context menu item: &使用快车(FlashGet)下载全部链接 - D:\讯垒\jc_all.htm O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\QQ\AddToNetDisk.htm O8 - Extra context menu item: 使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\geturl.htm O8 - Extra context menu item: 使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\getallurl.htm O8 - Extra context menu item: 添加到QQ自定义面板 - D:\QQ\AddPanel.htm O8 - Extra context menu item: 添加到QQ表情 - D:\QQ\AddEmotion.htm O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\QQ\SendMMS.htm O9 - Extra button: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\Thunder.exe O9 - Extra 'Tools' menuitem: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\Thunder.exe O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\QQ\QQ.EXE O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\QQ\QQ.EXE O9 - Extra button: 快车 - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\讯垒\FlashGet.exe O9 - Extra 'Tools' menuitem: 快车(FlashGet) - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\讯垒\FlashGet.exe O10 - Broken Internet access because of LSP provider 'c:\windows\system32\cdnns.dll' missing O16 - DPF: {05C1004E-2596-48E5-8E26-39362985EEB9} - http://p3p.sogou.com/MMCShell.cab O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} (Edit Class) - https://www.sz1.cmbchina.com/download/CMBEdit.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com.cn/webscanner/kavwebscan_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (EditCtrl Class) - https://img.alipay.com/download/1101/aliedit.cab O16 - DPF: {79312BD7-AB1A-4730-829F-F43C984D0A9D} (ACNSTAT Class) - http://www.ctsunion.com/CTS.CAB O16 - DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} (AxSubmitControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab O16 - DPF: {A22B8FD2-4CAA-4EFB-82F7-680CD656D9B0} (NowStarter Control) - http://www.gogobox.com.tw/neo.fld/GNowStarter.cab O16 - DPF: {EC0978ED-24E3-403C-AB7A-060E388553E6} (BoBo P2P多媒体网络点播/广播/直播系统 V3) - http://7099.com/BoBo_ActiveX_V3.ocx O17 - HKLM\System\CCS\Services\Tcpip\..\{268D0C6D-C493-483C-84F3-5335CDE19D6B}: NameServer = 202.96.209.5 202.109.116.116 O18 - Filter: text/html - {54B95211-7D77-11D2-9F80-00104B107C96} - (no file) O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: BackgroundlligentTransfe (ComputerBrowser) - Unknown owner - C:\WINDOWS\SVCHOST.EXE (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rfw\rfwsrv.exe O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe O23 - Service: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
SY小飞猪初生襁褓狮帖子:27 注册: 2007-06-08 来自:

SY小飞猪初生襁褓狮帖子:27 注册: 2007-06-08 来自:	发表于： 2007-06-09 07:54 \| 只看楼主短消息资料字号：小中大 8楼现在因该对了吧
SY小飞猪初生襁褓狮帖子:27 注册: 2007-06-08 来自:

红夜鬼1 横据古稀狮帖子:8602 注册: 2006-10-18 来自:	发表于： 2007-06-09 10:58 \| 短消息资料字号：小中大 9楼注意要说明病毒路径和文件名请下载SREng2（最新版），使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来,,日志一次粘不完，分次粘完，请不要修改。下载地址 http://www.kztechs.com/sreng/
红夜鬼1 横据古稀狮帖子:8602 注册: 2006-10-18 来自:

SY小飞猪初生襁褓狮帖子:27 注册: 2007-06-08 来自:	发表于： 2007-06-09 11:22 \| 只看楼主短消息资料字号：小中大 10楼 CODE] 2007-06-09,11:08:20 System Repair Engineer 2.4.12.806 Smallfrogs (http://www.KZTechs.com) Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能以下内容被选中：所有的启动项目（包括注册表、启动文件夹、服务等）浏览器加载项正在运行的进程（包括进程模块信息）文件关联 Winsock 提供者 Autorun.inf HOSTS 文件启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher] <MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background> [(Verified)Microsoft Windows XP Publisher] <ProxyCap><D:\SOFTST~1.0汉\ProxyCap.exe> [N/A] <Super Rabbit IEPro><C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD> [Super Rabbit Soft] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <load><> [N/A] <run><> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Publisher] <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows Publisher] <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows Publisher] <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [NVIDIA Corporation] <nwiz><nwiz.exe /install> [] <NvMediaCenter><RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit> [NVIDIA Corporation] <SoundMan><SOUNDMAN.EXE> [Realtek Semiconductor Corp.] <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.] <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.] <RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.] <snpstd3><C:\WINDOWS\vsnpstd3.exe> [] <ISUSPM Startup><C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup> [InstallShield Software Corporation] <ISUSScheduler><"C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start> [InstallShield Software Corporation] <runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe> [Beijing Rising Technology Co., Ltd.] <miniqqlive><"D:\V100\MiniQQLive.exe"> [Tencent] <DAEMON Tools><"C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033> [(Verified)DAEMON Tools Code Signing Services] <LClock><C:\Program Files\LClock\LClock.exe> [] <!AVG Anti-Spyware><"C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized> [Anti-Malware Development a.s.] <KernelFaultCheck><%systemroot%\system32\dumprep 0 -k> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] <RavStub><"C:\Program Files\Rising\Rav\ravstub.exe" /RUNONCE> [Beijing Rising Technology Co., Ltd.] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [(Verified)] <Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <UIHost><vistaui.exe> []
SY小飞猪初生襁褓狮帖子:27 注册: 2007-06-08 来自:

<<上一主题|下一主题>>

12 3

1 / 3 页

跳转页

页面顶部

Powered by Discuz!NT