版主帮我看一下好吗?我中招了!! - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 系统软件版主帮我看一下好吗?我中招了!!

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第四十七次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

1

1 / 1 页

跳转页

版主帮我看一下好吗?我中招了!!

watson819 初生襁褓狮帖子:4 注册: 2006-10-05 来自:	发表于： 2006-10-06 01:37 \| 只看楼主短消息资料字号：小中大 1楼版主帮我看一下好吗?我中招了!! 卡巴的日志: 2006-10-4 17:43:53 文件 C:\DOCUME~1\Watson&C.C\LOCALS~1\Temp\1.exe: 检测到木马程序 Backdoor.Win32.Hupigon.bis 2006-10-4 17:43:53 已经检测到安全威胁。建议您立即处理它们。 2006-10-4 17:44:02 文件 C:\DOCUME~1\Watson&C.C\LOCALS~1\Temp\1.exe: 删除 HijackThis的日志: Logfile of HijackThis v1.99.1 Scan saved at 1:12:38, on 2006-10-6 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\ATKKBService.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Maxthon\Maxthon.exe C:\WINDOWS\system32\conime.exe C:\WINDOWS\system32\wuauclt.exe D:\Soft\ha_hijackthis_1991\HijackThis.exe O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder\ComDlls\XunLeiBHO_002.dll O3 - Toolbar: BitComet工具栏 - {3F1ABCDB-A875-46c1-8345-B72A4567E486} - C:\Program Files\BitComet\BitCometBar\BitCometBar0.6.dll O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload O4 - HKLM\..\Run: [kis] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: 使用迅雷下载 - C:\Program Files\Thunder\Program\GetUrl.htm O8 - Extra context menu item: 使用迅雷下载全部链接 - C:\Program Files\Thunder\Program\GetAllUrl.htm O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Web反病毒保护 - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra 'Tools' menuitem: 建立行動最愛... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} (Edit Class) - https://www.sz1.cmbchina.com/download/CMBEdit.cab O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (CEditCtrl Object) - https://img.alipay.com/download/1007/aliedit.cab O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/pcver2006new/OL2006.cab O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe O23 - Service: 卡巴斯基互联网安全套装 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing) 本地连接不停的发送和接受数据包，一直都是两个小屏幕一起亮或者一起灭（屏幕右下角的连接图标）！！用了很多软件查都显示没有木马！！而且有几个进程是重复的: 进程： System Idle Process System C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\smss.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\conime.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe C:\WINDOWS\system32\ati2evxx.exe C:\WINDOWS\system32\ati2evxx.exe C:\WINDOWS\system32\alg.exe C:\Program Files\Analog Devices\SoundMAX\SMax4.exe C:\Program Files\Maxthon\Maxthon.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE D:\Soft\IceSword1.18\cn\IceSword.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe C:\WINDOWS\ATKKBService.exe 下面是用冰河查的：附件: 文件名:762354200610613703.jpg 下载次数:356 文件类型:image/pjpeg 文件大小: 上传时间:2006-10-6 1:37:22 描述: 预览信息:EXIF信息 User Comment : LEAD Technologies Inc. V1.01 2006-10-06 20:49:21
watson819 初生襁褓狮帖子:4 注册: 2006-10-05 来自:	分享到：

watson819 初生襁褓狮帖子:4 注册: 2006-10-05 来自:	发表于： 2006-10-06 01:53 \| 只看楼主短消息资料字号：小中大 2楼端口：协议本地地址远程地址状态进程ID 进程名 TCP 192.168.0.100 : 1327 219.238.233.252 : 80 ESTABLISHED 324 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe TCP 127.0.0.1 : 1334 127.0.0.1 : 1110 ESTABLISHED 264 C:\Program Files\Maxthon\Maxthon.exe TCP 127.0.0.1 : 1110 127.0.0.1 : 1334 ESTABLISHED 324 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe TCP 192.168.0.100 : 1328 219.238.233.252 : 80 ESTABLISHED 324 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe TCP 127.0.0.1 : 1110 127.0.0.1 : 1319 ESTABLISHED 324 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe TCP 127.0.0.1 : 1319 127.0.0.1 : 1110 ESTABLISHED 264 C:\Program Files\Maxthon\Maxthon.exe TCP 192.168.0.100 : 1329 219.238.233.252 : 80 ESTABLISHED 324 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe TCP 192.168.0.100 : 1315 219.238.233.252 : 80 ESTABLISHED 324 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe TCP 192.168.0.100 : 1331 219.238.233.252 : 80 ESTABLISHED 324 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe TCP 127.0.0.1 : 1322 127.0.0.1 : 1110 ESTABLISHED 264 C:\Program Files\Maxthon\Maxthon.exe TCP 127.0.0.1 : 1110 127.0.0.1 : 1322 ESTABLISHED 324 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe TCP 192.168.0.100 : 1333 219.238.233.252 : 80 ESTABLISHED 324 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe TCP 127.0.0.1 : 1324 127.0.0.1 : 1110 ESTABLISHED 264 C:\Program Files\Maxthon\Maxthon.exe TCP 127.0.0.1 : 1110 127.0.0.1 : 1324 ESTABLISHED 324 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe TCP 127.0.0.1 : 1110 127.0.0.1 : 1325 ESTABLISHED 324 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe TCP 127.0.0.1 : 1325 127.0.0.1 : 1110 ESTABLISHED 264 C:\Program Files\Maxthon\Maxthon.exe TCP 127.0.0.1 : 1326 127.0.0.1 : 1110 ESTABLISHED 264 C:\Program Files\Maxthon\Maxthon.exe TCP 127.0.0.1 : 1110 127.0.0.1 : 1326 ESTABLISHED 324 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe TCP 192.168.0.100 : 1321 219.238.233.252 : 80 ESTABLISHED 324 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe TCP 192.168.0.100 : 1323 219.238.233.252 : 80 ESTABLISHED 324 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe TCP 192.168.0.100 : 1335 219.238.233.237 : 80 ESTABLISHED 324 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe TCP 127.0.0.1 : 1110 127.0.0.1 : 1314 ESTABLISHED 324 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe TCP 127.0.0.1 : 1330 127.0.0.1 : 1110 ESTABLISHED 264 C:\Program Files\Maxthon\Maxthon.exe TCP 127.0.0.1 : 1314 127.0.0.1 : 1110 ESTABLISHED 264 C:\Program Files\Maxthon\Maxthon.exe TCP 127.0.0.1 : 1110 127.0.0.1 : 1330 ESTABLISHED 324 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe TCP 192.168.0.100 : 1317 219.159.81.166 : 80 ESTABLISHED 324 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe TCP 127.0.0.1 : 1110 127.0.0.1 : 1316 ESTABLISHED 324 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe TCP 127.0.0.1 : 1110 127.0.0.1 : 1332 ESTABLISHED 324 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe TCP 127.0.0.1 : 1316 127.0.0.1 : 1110 ESTABLISHED 264 C:\Program Files\Maxthon\Maxthon.exe TCP 127.0.0.1 : 1332 127.0.0.1 : 1110 ESTABLISHED 264 C:\Program Files\Maxthon\Maxthon.exe TCP 192.168.0.100 : 1311 219.238.233.252 : 80 TIME_WAIT 0 ---- TCP 192.168.0.100 : 1287 219.238.233.238 : 80 TIME_WAIT 0 ---- TCP 192.168.0.100 : 1307 219.238.233.237 : 80 TIME_WAIT 0 ---- TCP 127.0.0.1 : 1110 127.0.0.1 : 1318 TIME_WAIT 0 ---- TCP 192.168.0.100 : 1313 219.238.233.252 : 80 TIME_WAIT 0 ---- TCP 192.168.0.100 : 1265 219.238.233.252 : 80 TIME_WAIT 0 ---- TCP 192.168.0.100 : 1298 219.238.233.252 : 80 TIME_WAIT 0 ---- TCP 192.168.0.100 : 1299 219.238.233.252 : 80 TIME_WAIT 0 ---- TCP 192.168.0.100 : 1302 219.238.233.252 : 80 TIME_WAIT 0 ---- TCP 192.168.0.100 : 1303 219.238.233.252 : 80 TIME_WAIT 0 ---- TCP 192.168.0.100 : 1305 219.238.233.252 : 80 TIME_WAIT 0 ---- TCP 192.168.0.100 : 1291 219.238.233.252 : 80 TIME_WAIT 0 ---- TCP 0.0.0.0 : 445 0.0.0.0 : 0 LISTENING 4 NT OS Kernel TCP 0.0.0.0 : 135 0.0.0.0 : 0 LISTENING 1040 C:\WINDOWS\system32\svchost.exe TCP 127.0.0.1 : 1025 0.0.0.0 : 0 LISTENING 1996 C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe TCP 192.168.0.100 : 139 0.0.0.0 : 0 LISTENING 4 NT OS Kernel TCP 127.0.0.1 : 1049 0.0.0.0 : 0 LISTENING 3072 C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe TCP 0.0.0.0 : 1110 0.0.0.0 : 0 LISTENING 324 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe TCP 127.0.0.1 : 1031 0.0.0.0 : 0 LISTENING 1100 C:\WINDOWS\system32\alg.exe UDP 192.168.0.100 : 123 * : * 1140 C:\WINDOWS\system32\svchost.exe UDP 0.0.0.0 : 500 * : * 772 C:\WINDOWS\system32\lsass.exe UDP 0.0.0.0 : 1055 * : * 1208 C:\WINDOWS\system32\svchost.exe UDP 192.168.0.100 : 1900 * : * 1344 C:\WINDOWS\system32\svchost.exe UDP 127.0.0.1 : 1061 * : * 264 C:\Program Files\Maxthon\Maxthon.exe UDP 127.0.0.1 : 123 * : * 1140 C:\WINDOWS\system32\svchost.exe UDP 192.168.0.100 : 137 * : * 4 NT OS Kernel UDP 127.0.0.1 : 1900 * : * 1344 C:\WINDOWS\system32\svchost.exe UDP 0.0.0.0 : 4500 * : * 772 C:\WINDOWS\system32\lsass.exe UDP 192.168.0.100 : 138 * : * 4 NT OS Kernel UDP 0.0.0.0 : 445 * : * 4 NT OS Kernel RAW --- --- --- 4 NT OS Kernel RAW --- --- --- 4 NT OS Kernel RAW --- --- --- 772 C:\WINDOWS\system32\lsass.exe 卡巴用这么多端口正常吗？
watson819 初生襁褓狮帖子:4 注册: 2006-10-05 来自:

watson819 初生襁褓狮帖子:4 注册: 2006-10-05 来自:	发表于： 2006-10-06 11:55 \| 只看楼主短消息资料字号：小中大 3楼版主,帮帮忙吧!!
watson819 初生襁褓狮帖子:4 注册: 2006-10-05 来自:

watson819 初生襁褓狮帖子:4 注册: 2006-10-05 来自:	发表于： 2006-10-06 20:57 \| 只看楼主短消息资料字号：小中大 4楼救命啊!!!
watson819 初生襁褓狮帖子:4 注册: 2006-10-05 来自:

<<上一主题|下一主题>>

1

1 / 1 页

跳转页

页面顶部

Powered by Discuz!NT