瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 再次麻烦版主！！我计算机还是有病毒啊！

1   1  /  1  页   跳转页

再次麻烦版主！！我计算机还是有病毒啊！

收藏
yanhongmyanhongm
头像
初生襁褓狮
  • 帖子:39
  • 注册: 2005-11-06
  • 来自:
发表于： 2005-11-07 18:34 | 显示全部 短消息 资料
字号： 小 中 大 1楼

再次麻烦版主！！我计算机还是有病毒啊！

Logfile of HijackThis v1.99.1
Scan saved at 18:30:39, on 2002-1-1
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRAM FILES\RISING\RISING\RAV\Ravmond.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\PROGRAM FILES\RISING\RISING\RAV\RavStub.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
c:\program files\rising\rfw\RfwMain.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\HEROSOFT\Hero3000\SYSEXPLR.EXE
C:\PROGRA~1\RISING\RISING\RAV\RAVTIMER.EXE
C:\PROGRA~1\RISING\RISING\RAV\RAVMON.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRAM FILES\RISING\RISING\RAV\CCENTER.EXE
C:\Program Files\Tencent\qq\QQ.exe
C:\Program Files\Tencent\qq\TIMPlatform.exe
C:\Program Files\Tencent\qq\QQ.exe
C:\Program Files\Tencent\qq\QQ.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\macromed\flash\GetFlash.exe
E:\游戏\灰鸽子\426101200522225654\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\Program Files\Tencent\qq\QQIEHelper.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [PRONoMgr.exe] c:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [SysExplr] C:\HEROSOFT\Hero3000\SYSEXPLR.EXE
O4 - HKLM\..\Run: [RavTimer] C:\PROGRA~1\RISING\RISING\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [RavMon] C:\PROGRA~1\RISING\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - Global Startup: Microsoft Office.lnk = E:\Office10\OSA.EXE
O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\Tencent\qq\AddToNetDisk.htm
O8 - Extra context menu item: 导出到 Microsoft Excel(&x) - res://E:\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\qq\SendMMS.htm
O9 - Extra button: 卓越 - {8DE0FCD4-5EB5-11D3-AD25-00002100131B} - C:\PROGRA~1\Kingsoft\XDict\IEPlugin.dll
O9 - Extra button: 金山词霸 - {C8CE29C5-7589-11D3-B81B-0080C8DC5DC8} - C:\PROGRA~1\Kingsoft\XDict\IEPlugin.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\qq\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\qq\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\qq\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\qq\QQIEHelper.dll
O16 - DPF: {96996894-D69B-4FD0-92ED-0950891FFA5C} (TwodaysOCX.PPT) - http://res.ptjy.com/plugin/TwodaysOCX.CAB
O16 - DPF: {ACFE8232-03C5-4AEC-AF5E-42B806724096} (KSHScan Control) - http://safe.qq.com/scan/KAllScan.CAB
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/Ver2005/OL2005.cab
O16 - DPF: {F138084D-84D7-48CD-BEA8-04772457516E} (VqqSpeedDlProxy Class) - http://218.85.138.27/vqqsdl1009.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{56A05474-6FC4-47B7-AE25-12E76844889E}: NameServer = 218.108.245.157 218.108.248.219
O17 - HKLM\System\CS1\Services\Tcpip\..\{56A05474-6FC4-47B7-AE25-12E76844889E}: NameServer = 218.108.245.157 218.108.248.219
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - c:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - C:\PROGRAM FILES\RISING\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RISING\RAV\Ravmond.exe

最后编辑2005-11-12 15:05:38
分享到：
gototop
 
yanhongmyanhongm
头像
初生襁褓狮
  • 帖子:39
  • 注册: 2005-11-06
  • 来自:
发表于： 2005-11-07 18:36 | 显示全部 短消息 资料
字号： 小 中 大 2楼

麻烦飞跃迷离，您帮我帮到底
gototop
 
yanhongmyanhongm
头像
初生襁褓狮
  • 帖子:39
  • 注册: 2005-11-06
  • 来自:
发表于： 2005-11-07 18:46 | 显示全部 短消息 资料
字号： 小 中 大 3楼

发错，不好意思
gototop
 
yanhongmyanhongm
头像
初生襁褓狮
  • 帖子:39
  • 注册: 2005-11-06
  • 来自:
发表于： 2005-11-07 18:49 | 显示全部 短消息 资料
字号： 小 中 大 4楼

病毒名称发现日期扫描方式路径文件病毒来源
Exploit.HTML.Mht.bl05-09-26 17:25手动扫描C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\O9AVOPMV111[1].htm本机
Exploit.VBS.Phel.e05-09-26 17:27手动扫描C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\WZ1B66F5hunkema[1].htm本机
Exploit.VBS.Phel.k05-09-26 17:27手动扫描C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\WZ1B66F5feng[1].htm本机
Exploit.VBS.Phel.c05-09-26 17:27手动扫描C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\WZ1B66F5sp2[1].htm本机
Exploit.HTML.Mht.bl05-09-26 19:02实时监控C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\HVJR1DGEindex[9].htm本机
Exploit.HTML.Mht.bl05-09-30 20:38实时监控C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\IU5ZE6DSindex[2].htm本机
Exploit.HTML.Mht.bl05-10-01 08:38手动扫描C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\QO39G9FMindex[4].htm本机
Exploit.HTML.Mht.bl05-10-01 11:11实时监控C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\I48R15UAindex[7].htm本机
Exploit.HTML.Mht.bl05-10-01 11:12实时监控C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\IAGB29GQindex[6].htm本机
Exploit.HTML.Mht.bl05-10-01 11:12实时监控C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\QO39G9FMindex[4].htm本机
Exploit.HTML.Mht.bl05-10-01 19:58实时监控C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\I48R15UAindex[7].htm本机
Exploit.HTML.Mht.bl05-10-01 19:58实时监控C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\OHU74XMVindex[1].htm本机
Exploit.HTML.Mht.bl05-10-04 20:37实时监控C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\0TYJGDYNindex[1].htm本机
Exploit.HTML.Mht.bl05-10-04 20:37实时监控C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\0TYJGDYNindex[7].htm本机
Trojan.PSW.Gameabc.b05-10-19 20:32实时监控C:\MYMUSI~1QXV.DLL本机
Trojan.Rootkit.k05-10-22 19:49手动扫描C:\WINDOWS\system32rdriv.sys本机
Trojan.Rootkit.k05-10-22 19:59手动扫描C:\System Volume Information\_restore{9FE6C08C-3B14-45F9-A7A3-8790F0FC7F8E}\RP46A0022509.sys本机
未知病毒05-10-22 20:34实时监控C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\ACJSWNX0Article_Show[1].htm本机
未知病毒05-10-22 20:37实时监控C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\61W9GBU1Article_Show[1].htm本机
未知病毒05-10-22 20:39实时监控C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\ACJSWNX0Article_Show[1].htm本机
Exploit.VBS.Phel.l05-11-02 21:44实时监控C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\QKLLVRZJtzd[1].htm本机
Exploit.VBS.Phel.l05-11-02 21:44实时监控C:\DOCUME~1\Owner\LOCALS~1\Temp110434158064.tmp本机
Exploit.HHCtrl.b05-11-02 21:44实时监控C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\FLWK4B73ray[1].htm本机
Exploit.VBS.Phel05-11-02 21:44实时监控C:\DOCUME~1\Owner\LOCALS~1\Temp110434158064.tmp本机
Script.JS.Psyme.as05-11-02 21:44实时监控C:NTDETECT.hta本机
Exploit.VBS.Phel05-11-02 21:45实时监控C:\DOCUME~1\Owner\LOCALS~1\Temp110434158064.tmp本机
Script.JS.Psyme.as05-11-02 21:45实时监控C:NTDETECT.hta本机
Exploit.VBS.Phel05-11-02 21:45实时监控C:\DOCUME~1\Owner\LOCALS~1\Temp110434158064.tmp本机
Script.JS.Psyme.as05-11-02 21:45实时监控C:NTDETECT.hta本机
Exploit.VBS.Phel.l05-11-04 19:45实时监控C:\DOCUME~1\Owner\LOCALS~1\Temp470035608312.tmp本机
Exploit.HTML.Mht.p05-11-04 20:52实时监控C:\DOCUME~1\Owner\LOCALS~1\Temp470035608312.tmp本机
Exploit.HTML.Mht.p05-11-04 20:53实时监控C:\DOCUME~1\Owner\LOCALS~1\Temp470035608312.tmp本机
Backdoor.GPigeon.uq05-11-05 16:49手动扫描C:\System Volume Information\_restore{9FE6C08C-3B14-45F9-A7A3-8790F0FC7F8E}\RP55A0028427.DLL本机
Backdoor.GPigeon.uq05-11-06 18:57手动扫描C:\WINDOWSSqLSever_HOOk.DLL本机
Backdoor.GPigeon.uq05-11-06 19:05手动扫描C:\System Volume Information\_restore{9FE6C08C-3B14-45F9-A7A3-8790F0FC7F8E}\RP56A0028564.DLL本机
Backdoor.GPigeon.uq05-11-06 19:05手动扫描C:\System Volume Information\_restore{9FE6C08C-3B14-45F9-A7A3-8790F0FC7F8E}\RP56A0028574.DLL本机
Exploit.VBS.Phel.l02-01-01 18:18实时监控C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\LBFJHTWEfo[1].htm本机
Exploit.VBS.Phel.l02-01-01 18:18实时监控C:\DOCUME~1\Owner\LOCALS~1\Temp358435994672.tmp本机
gototop
 
yanhongmyanhongm
头像
初生襁褓狮
  • 帖子:39
  • 注册: 2005-11-06
  • 来自:
发表于： 2005-11-07 18:53 | 显示全部 短消息 资料
字号： 小 中 大 5楼

今天计算机接上电源就开启，日期是2002.01.01，2个病毒Exploit.VBS.Phel.l02-01-01 18:18实时监控C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\LBFJHTWEfo[1].htm本机
Exploit.VBS.Phel.l02-01-01 18:18实时监控C:\DOCUME~1\Owner\LOCALS~1\Temp358435994672.tmp本机
gototop
 
yanhongmyanhongm
头像
初生襁褓狮
  • 帖子:39
  • 注册: 2005-11-06
  • 来自:
发表于： 2005-11-12 10:13 | 显示全部 短消息 资料
字号： 小 中 大 6楼

不好意思,今天又发现老病毒,用老方法操作了,再扫了一遍,版主帮我看看,谢谢!
Logfile of HijackThis v1.99.1
Scan saved at 10:08:45, on 2005-11-12
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRAM FILES\RISING\RISING\RAV\Ravmond.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\PROGRAM FILES\RISING\RISING\RAV\RavStub.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
c:\program files\rising\rfw\RfwMain.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\HEROSOFT\Hero3000\SYSEXPLR.EXE
C:\PROGRA~1\RISING\RISING\RAV\RAVTIMER.EXE
C:\PROGRA~1\RISING\RISING\RAV\RAVMON.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRAM FILES\RISING\RISING\RAV\CCENTER.EXE
E:\游戏\灰鸽子\426101200522225654\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\Program Files\Tencent\qq\QQIEHelper.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [PRONoMgr.exe] c:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [SysExplr] C:\HEROSOFT\Hero3000\SYSEXPLR.EXE
O4 - HKLM\..\Run: [RavTimer] C:\PROGRA~1\RISING\RISING\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [RavMon] C:\PROGRA~1\RISING\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - Global Startup: Microsoft Office.lnk = E:\Office10\OSA.EXE
O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\Tencent\qq\AddToNetDisk.htm
O8 - Extra context menu item: 导出到 Microsoft Excel(&x) - res://E:\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\qq\SendMMS.htm
O9 - Extra button: 卓越 - {8DE0FCD4-5EB5-11D3-AD25-00002100131B} - C:\PROGRA~1\Kingsoft\XDict\IEPlugin.dll
O9 - Extra button: 金山词霸 - {C8CE29C5-7589-11D3-B81B-0080C8DC5DC8} - C:\PROGRA~1\Kingsoft\XDict\IEPlugin.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\qq\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\qq\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\qq\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\qq\QQIEHelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1131486390031
O16 - DPF: {96996894-D69B-4FD0-92ED-0950891FFA5C} (TwodaysOCX.PPT) - http://res.ptjy.com/plugin/TwodaysOCX.CAB
O16 - DPF: {ACFE8232-03C5-4AEC-AF5E-42B806724096} (KSHScan Control) - http://safe.qq.com/scan/KAllScan.CAB
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/Ver2005/OL2005.cab
O16 - DPF: {F138084D-84D7-48CD-BEA8-04772457516E} (VqqSpeedDlProxy Class) - http://218.85.138.27/vqqsdl1009.cab
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - c:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - C:\PROGRAM FILES\RISING\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RISING\RAV\Ravmond.exe
gototop
 
yanhongmyanhongm
头像
初生襁褓狮
  • 帖子:39
  • 注册: 2005-11-06
  • 来自:
发表于： 2005-11-12 10:23 | 显示全部 短消息 资料
字号： 小 中 大 7楼

Backdoor.BlackHole.4.a05-11-12 09:35手动扫描Explorer.EXE>>C:\WINDOWS\SSMS.dll
Backdoor.BlackHole.4.a05-11-12 09:35手动扫描Explorer.EXE>>C:\WINDOWS\SSMS.dll
Backdoor.BlackHole.4.a05-11-12 09:35手动扫描Explorer.EXE>>C:\WINDOWS\System32\_UsbDriver_.dll
Backdoor.BlackHole.4.a05-11-12 09:35手动扫描Explorer.EXE>>C:\WINDOWS\SSMS.dll
Backdoor.BlackHole.4.a05-11-12 09:35手动扫描Explorer.EXE>>C:\WINDOWS\System32\_UsbDriver_.dll
Backdoor.BlackHole.4.a05-11-12 09:35手动扫描SOUNDMAN.EXE>>C:\WINDOWS\System32\_UsbDriver_.dll
Backdoor.BlackHole.4.a05-11-12 09:35手动扫描SOUNDMAN.EXE>>C:\WINDOWS\System32\_UsbDriver_.dll
Backdoor.BlackHole.4.a05-11-12 09:35手动扫描PRONoMgr.exe>>C:\WINDOWS\System32\_UsbDriver_.dll
Backdoor.BlackHole.4.a05-11-12 09:35手动扫描PRONoMgr.exe>>C:\WINDOWS\System32\_UsbDriver_.dll
Backdoor.BlackHole.4.a05-11-12 09:35手动扫描SYSEXPLR.EXE>>C:\WINDOWS\System32\_UsbDriver_.dll
Backdoor.BlackHole.4.a05-11-12 09:35手动扫描SYSEXPLR.EXE>>C:\WINDOWS\System32\_UsbDriver_.dll
Backdoor.BlackHole.4.a05-11-12 09:35手动扫描RUNDLL32.EXE>>C:\WINDOWS\System32\_UsbDriver_.dll
Backdoor.BlackHole.4.a05-11-12 09:35手动扫描RUNDLL32.EXE>>C:\WINDOWS\System32\_UsbDriver_.dll
gototop
 
yanhongmyanhongm
头像
初生襁褓狮
  • 帖子:39
  • 注册: 2005-11-06
  • 来自:
发表于： 2005-11-12 10:28 | 显示全部 短消息 资料
字号： 小 中 大 8楼

_UsbDriver_.dll这文件我找到了,直接删除可以吗?
gototop
 
<<上一主题|下一主题>>
1   1  /  1  页   跳转页
页面顶部
Powered by Discuz!NT