Logfile of HijackThis v1.99.1
Scan saved at 20:49:22, on 2005-9-13
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
D:\PROGRA~1\RISING\RAV\RAVMON.EXE
C:\WINDOWS\System32\conime.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
D:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
D:\PROGRAM FILES\RISING\RAV\Ravmond.exe
D:\PROGRAM FILES\RISING\RAV\RavStub.exe
C:\Program Files\BitSpirit\BitSpirit.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Downloads\driver\1903632005219183744\HijackThis.exe
R3 - Default URLSearchHook is missing
O1 - Hosts: 218.85.139.122 www.minisite.qq.com
O1 - Hosts: 218.85.139.122 minisite.qq.com
O1 - Hosts: 218.85.139.122 www.zhao114.com
O1 - Hosts: 218.85.139.122 zhao114.com
O1 - Hosts: 218.85.139.122 www.zhao114.com
O1 - Hosts: 218.85.139.122 zhao114.com
O1 - Hosts: 218.85.139.122 www.yan88.com
O1 - Hosts: 218.85.139.122 yan88.com
O1 - Hosts: 218.85.139.122 www.yan88.com
O1 - Hosts: 218.85.139.122 yan88.com
O1 - Hosts: 218.85.139.122 www.cnww.net
O1 - Hosts: 218.85.139.122 cnww.net
O1 - Hosts: 218.85.139.122 www.zhao123.com
O1 - Hosts: 218.85.139.122 zhao123.com
O1 - Hosts: 218.85.139.122 www.4399.com
O1 - Hosts: 218.85.139.122 4399.com
O1 - Hosts: 218.85.139.122 www.chinagames.net
O1 - Hosts: 218.85.139.122 chinagames.net
O1 - Hosts: 218.85.139.122 www.tiexue.net
O1 - Hosts: 218.85.139.122 tiexue.net
O1 - Hosts: 218.85.139.122 www.qq163.com
O1 - Hosts: 218.85.139.122 qq163.com
O1 - Hosts: 218.85.139.122 www.tt67.com
O1 - Hosts: 218.85.139.122 tt67.com
O1 - Hosts: 218.85.139.122 www.chinamp3.com
O1 - Hosts: 218.85.139.122 chinamp3.com
O1 - Hosts: 218.85.139.122 www.pg168.com
O1 - Hosts: 218.85.139.122 pg168.com
O1 - Hosts: 218.85.139.122 www.yymp3.com
O1 - Hosts: 218.85.139.122 yymp3.com
O1 - Hosts: 218.85.139.122 www.yy138.com
O1 - Hosts: 218.85.139.122 yy138.com
O1 - Hosts: 218.85.139.122 www.dj99.com
O1 - Hosts: 218.85.139.122 dj99.com
O1 - Hosts: 218.85.139.122 www.sogua.com
O1 - Hosts: 218.85.139.122 sogua.com
O1 - Hosts: 218.85.139.122 www.snsn.net
O1 - Hosts: 218.85.139.122 snsn.net
O1 - Hosts: 218.85.139.122 www.flash8.net
O1 - Hosts: 218.85.139.122 flash8.net
O1 - Hosts: 218.85.139.122 www.mop.com
O1 - Hosts: 218.85.139.122 mop.com
O1 - Hosts: 218.85.139.122 www.tianyaclub.com
O1 - Hosts: 218.85.139.122 tianyaclub.com
O1 - Hosts: 218.85.139.122 www.xici.net
O1 - Hosts: 218.85.139.122 xici.net
O1 - Hosts: 218.85.139.122 www.ucanlove.com
O1 - Hosts: 218.85.139.122 ucanlove.com
O1 - Hosts: 218.85.139.122 www.cmfu.com
O1 - Hosts: 218.85.139.122 cmfu.com
O1 - Hosts: 218.85.139.122 www.21red.net
O1 - Hosts: 218.85.139.122 21red.net
O1 - Hosts: 218.85.139.122 www.pconline.com.cn
O1 - Hosts: 218.85.139.122 pconline.com.cn
O1 - Hosts: 218.85.139.122 www.donews.com
O1 - Hosts: 218.85.139.122 donews.com
O1 - Hosts: 218.85.139.122 www.pcauto.com.cn
O1 - Hosts: 218.85.139.122 pcauto.com.cn
O1 - Hosts: 218.85.139.122 www.265.com
O1 - Hosts: 218.85.139.122 265.com
O1 - Hosts: 218.85.139.122 www.wo99.com
O1 - Hosts: 218.85.139.122 wo99.com
O1 - Hosts: 218.85.139.122 www.familydoctor.com.cn
O1 - Hosts: 218.85.139.122 familydoctor.com.cn
O1 - Hosts: 218.85.139.122 www.flashempire.com
O1 - Hosts: 218.85.139.122 flashempire.com
O1 - Hosts: 218.85.139.122 www.showgood.tv
O1 - Hosts: 218.85.139.122 showgood.tv
O1 - Hosts: 218.85.139.122 www.flashfan.net
O1 - Hosts: 218.85.139.122 flashfan.net
O1 - Hosts: 218.85.139.122 www.long21.net
O1 - Hosts: 218.85.139.122 long21.net
O1 - Hosts: 218.85.139.122 www.sowww.com
O1 - Hosts: 218.85.139.122 sowww.com
O1 - Hosts: 218.85.139.122 www.flashhome.net
O1 - Hosts: 218.85.139.122 flashhome.net
O1 - Hosts: 218.85.139.122 www.cnflash.net
O1 - Hosts: 218.85.139.122 cnflash.net
O1 - Hosts: 218.85.139.122 www.flashsky.com
O1 - Hosts: 218.85.139.122 flashsky.com
O1 - Hosts: 218.85.139.122 www.hunansky.com
O1 - Hosts: 218.85.139.122 hunansky.com
O1 - Hosts: 218.85.139.122 www.52flash.net
O1 - Hosts: 218.85.139.122 52flash.net
O1 - Hosts: 218.85.139.122 www.flashh.com
O1 - Hosts: 218.85.139.122 flashh.com
O1 - Hosts: 218.85.139.122 www.flashsun.com
O1 - Hosts: 218.85.139.122 flashsun.com
O1 - Hosts: 218.85.139.122 www.7k7k.com
O1 - Hosts: 218.85.139.122 7k7k.com
O1 - Hosts: 218.85.139.122 www.xuanxuan.com
O1 - Hosts: 218.85.139.122 xuanxuan.com
O1 - Hosts: 218.85.139.122 www.flash88.net
O1 - Hosts: 218.85.139.122 flash88.net
O1 - Hosts: 218.85.139.122 www.91flash.com
O1 - Hosts: 218.85.139.122 91flash.com
O1 - Hosts: 218.85.139.122 www.doingflash.com
O1 - Hosts: 218.85.139.122 doingflash.com
O1 - Hosts: 218.85.139.122 www.5see.com
O1 - Hosts: 218.85.139.122 5see.com
O1 - Hosts: 218.85.139.122 www.skyhits.com
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\Program Files\FlashGet\jccatch.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: 卡卡安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\System32\KakaTool.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [YDTMain.exe] C:\PROGRA~1\YDT\YDTMain.exe
O4 - HKLM\..\Run: [] regedit -s C:\$NtUninstallQ9494$\sp4custom.reg
O4 - HKLM\..\Run: [hosts] C:\WINDOWS\system32\hosts.bat
O4 - HKLM\..\Run: [3721] C:\$NtUninstallQ9494$\3721.bat
O4 - HKLM\..\Run: [WlN32] regedit -s C:\$NtUninstallQ9494$\WINSYS.cer
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [] regedit -s C:\$NtUninstallQ9494$\sp4custom.reg
O4 - HKCU\..\Run: [hosts] C:\WINDOWS\system32\hosts.bat
O4 - Startup: hosts.bat
O4 - Startup: runx.bat
O8 - Extra context menu item: 使用搜狗直通车下载 - C:\Program Files\P4P\dl.htm
O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: 用比特精灵下载(&B) - C:\Program Files\BitSpirit\bsurl.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe
O16 - DPF: {DA984A6D-508E-11D6-AA49-0050FF3C628D} (Ravonline) - http://download.rising.com.cn/ravkill/rsonline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{269E0FBE-26D9-49C1-8121-D23AC4877580}: NameServer = 61.233.9.9 211.98.2.4
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - D:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\PROGRAM FILES\RISING\RAV\Ravmond.exe
以下是瑞星日志
病毒名称 处理结果 扫描方式 路径 文件 病毒来源
Backdoor.Gpigeon.tg 删除成功 手动扫描 C:\WINDOWS G_Server.exe 本机
Backdoor.Gpigeon.tg 删除成功 手动扫描 C:\WINDOWS G_Server.DLL 本机
Trojan.WinREG.StartPage.d 删除成功 手动扫描 C:\Documents and Settings\tjy\「开始」菜单\程序\启动 runx.bat 本机
Backdoor.Gpigeon.oc 删除成功 手动扫描 C:\System Volume Information\_restore{7CD7D720-5DD3-4188-A5E9-7CC88D9C96FB}\RP11 A0008825.DLL 本机
Backdoor.Gpigeon.tg 删除成功 手动扫描 C:\System Volume Information\_restore{7CD7D720-5DD3-4188-A5E9-7CC88D9C96FB}\RP15 A0010021.exe>>love.exe 本机
Backdoor.Gpigeon.tg 删除成功 手动扫描 C:\System Volume Information\_restore{7CD7D720-5DD3-4188-A5E9-7CC88D9C96FB}\RP15 A0010035.DLL 本机
Backdoor.Gpigeon.tg 删除成功 手动扫描 C:\System Volume Information\_restore{7CD7D720-5DD3-4188-A5E9-7CC88D9C96FB}\RP16 A0010094.DLL 本机
Backdoor.Gpigeon.tg 删除成功 手动扫描 C:\System Volume Information\_restore{7CD7D720-5DD3-4188-A5E9-7CC88D9C96FB}\RP16 A0010103.DLL 本机
Backdoor.Gpigeon.tg 删除成功 手动扫描 C:\System Volume Information\_restore{7CD7D720-5DD3-4188-A5E9-7CC88D9C96FB}\RP16 A0010120.DLL 本机
Backdoor.Gpigeon.tg 删除成功 手动扫描 C:\System Volume Information\_restore{7CD7D720-5DD3-4188-A5E9-7CC88D9C96FB}\RP16 A0011120.DLL 本机
Backdoor.Gpigeon.tg 删除成功 手动扫描 C:\System Volume Information\_restore{7CD7D720-5DD3-4188-A5E9-7CC88D9C96FB}\RP16 A0011126.DLL 本机
Backdoor.Gpigeon.tg 删除成功 手动扫描 C:\System Volume Information\_restore{7CD7D720-5DD3-4188-A5E9-7CC88D9C96FB}\RP16 A0011142.exe 本机
Trojan.WinREG.StartPage.d 删除成功 手动扫描 C:\System Volume Information\_restore{7CD7D720-5DD3-4188-A5E9-7CC88D9C96FB}\RP16 A0011144.bat 本机
Trojan.VBS.Wisis.e 删除成功 手动扫描 C:\$NtUninstallQ9494$ sp4custom.reg 本机
Trojan.VBS.Wisis.e 删除成功 手动扫描 C:\System Volume Information\_restore{7CD7D720-5DD3-4188-A5E9-7CC88D9C96FB}\RP16 A0011145.reg 本机
Js.hta.StartPage 忽略 实时监控 C:\Documents and Settings\tjy\Local Settings\Temporary Internet Files\Content.IE5\2D0NS1I3 set[1].hta 本机
Trojan.VBS.Wisis.e 删除成功 实时监控 C:\$NtUninstallQ9494$ sp4custom.reg 本机
Trojan.WinREG.StartPage.d 删除成功 实时监控 C:\Documents and Settings\tjy\「开始」菜单\程序\启动 runx.bat 本机
Js.hta.StartPage 忽略 实时监控 C:\Documents and Settings\tjy\Local Settings\Temporary Internet Files\Content.IE5\8J234N0P set[1].hta 本机
Js.hta.StartPage 发现病毒 实时监控 C:\Documents and Settings\tjy\Local Settings\Temporary Internet Files\Content.IE5\2D0NS1I3 set[1].hta 本机
Trojan.VBS.Wisis.e 发现病毒 实时监控 C:\$NtUninstallQ9494$ sp4custom.reg 本机
Trojan.WinREG.StartPage.d 发现病毒 实时监控 C:\Documents and Settings\tjy\「开始」菜单\程序\启动 runx.bat 本机
