瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 各位老大,我是被“域劫持”的受害者,请搭救小弟!

12   1  /  2  页   跳转

各位老大,我是被“域劫持”的受害者,请搭救小弟!

各位老大,我是被“域劫持”的受害者,请搭救小弟!

建能老大,我昨晚照你推荐的方法去下载了一个新的HijackThis1991,今天分别在安全模式和正常的XP上网模式下扫描了两份Logo,请帮我分析一下,谢谢了!
安全模式Logo:
ackThis_815汉化版扫描日志 V1.99.1
保存于      16:53:44, 日期 2005-11-14
操作系统:  Windows XP  (WinNT 5.01.2600)
浏览器:    Internet Explorer v6.00 SP1 (6.00.2600.0000)

当前运行的进程:         
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\Explorer.EXE
F:\应用程序\HijachThis V1.99.2汉化版\HijackThis1991zww.exe

O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - D:\PROGRA~1\baidu\bar\baidubar.dll (file missing)
O3 - IE工具栏增项: 百度超级搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - D:\PROGRA~1\baidu\bar\baidubar.dll (file missing)
O4 - 启动项HKLM\\Run: [APVXDWIN] "D:\Program Files\Panda Software\熊猫卫士钛金版2004\APVXDWIN.EXE" /s
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O10 - Broken Internet access because of LSP provider 'd:\program files\panda software\
O16 - DPF: {371B29D9-4563-4E7F-B93D-F85ED5682ABC} (CoRaise Player Object) - http://202.104.212.55/tsplay/tsplay.cab
O18 - 列举现有的协议: ipp - (no CLSID) - (no file)
O18 - 列举现有的协议: msdaipp - (no CLSID) - (no file)
O23 - NT 服务: Gray_Pigeon_Server (GrayPigeonServer) - Unknown owner - D:\WINDOWS\G_Server.exe
O23 - NT 服务: Panda Process Protection Service (PavPrSrv) - Panda Software - D:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - NT 服务: Panda anti-virus service (PAVSRV) - Panda Software - D:\Program Files\Panda Software\熊猫卫士钛金版2004\pavsrv51.exe
O23 - NT 服务: Panda IManager Service (PSIMSVC) - Panda Software Internacional - D:\Program Files\Panda Software\熊猫卫士钛金版2004\PsImSvc.exe

-------------------------------------------------------------------------------

正常的XP上网模式Logo:
jackThis_815汉化版扫描日志 V1.99.1
保存于      17:00:32, 日期 2005-11-14
操作系统:  Windows XP  (WinNT 5.01.2600)
浏览器:    Internet Explorer v6.00 SP1 (6.00.2600.0000)

当前运行的进程:         
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\csrss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
D:\Program Files\Panda Software\熊猫卫士钛金版2004\PsImSvc.exe
D:\WINDOWS\System32\wdfmgr.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Panda Software\熊猫卫士钛金版2004\APVXDWIN.EXE
D:\WINDOWS\System32\ctfmon.exe
D:\Program Files\Panda Software\熊猫卫士钛金版2004\WebProxy.exe
D:\Program Files\VnetClient1.6\VnetClient.exe
F:\应用程序\HijachThis V1.99.2汉化版\HijackThis1991zww.exe

O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - D:\PROGRA~1\baidu\bar\baidubar.dll (file missing)
O3 - IE工具栏增项: 百度超级搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - D:\PROGRA~1\baidu\bar\baidubar.dll (file missing)
O4 - 启动项HKLM\\Run: [APVXDWIN] "D:\Program Files\Panda Software\熊猫卫士钛金版2004\APVXDWIN.EXE" /s
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O10 - Broken Internet access because of LSP provider 'd:\program files\panda software\
O16 - DPF: {371B29D9-4563-4E7F-B93D-F85ED5682ABC} (CoRaise Player Object) - http://202.104.212.55/tsplay/tsplay.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3A5220D4-E0CA-4A7C-810F-455C11C140B3}: NameServer = 202.96.128.86 202.96.128.166
O23 - NT 服务: Gray_Pigeon_Server (GrayPigeonServer) - Unknown owner - D:\WINDOWS\G_Server.exe
O23 - NT 服务: Panda Process Protection Service (PavPrSrv) - Panda Software - D:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - NT 服务: Panda anti-virus service (PAVSRV) - Panda Software - D:\Program Files\Panda Software\熊猫卫士钛金版2004\pavsrv51.exe
O23 - NT 服务: Panda IManager Service (PSIMSVC) - Panda Software Internacional - D:\Program Files\Panda Software\熊猫卫士钛金版2004\PsImSvc.exe


请高手和各位大侠帮忙分析一下,谢谢!

[font_color=#FF0000]
请救救小弟!!!
最后编辑2005-11-25 19:26:11
分享到:
gototop
 

谢谢飞跃迷离老大的回复和指导,我昨天没空搞,现在立即去试。不过我还想请问飞跃迷离老大,这样搞会不会把系统也搞的崩溃了,要不要备份文件啊,请回答,谢谢!噢,对了,哪个baidu我在注册表编辑器里也不能删除,我一删它就会出问题,注册表编辑器连动也动不了,在安全模式下也是一样,我该怎么办,由于我是一个菜鸟,有些方法能不能讲得详细一点,拜托了,谢谢,如果看见了就请快点回答我,我及着要去尝试!
gototop
 

飞跃迷离、魔法学徒两位老大你们好啊,我刚刚按照飞跃迷离老大所教的方法把哪个Gray_Pigeon_Server的祸害搞惦了,但是我现在的问题是,哪个baidu还在,我等会再按照魔法学徒老大所的方法去搞,这是第一个问题,第二个问题是,我现在的杀毒软件熊猫卫士钛金2004(不好意思我本来是用瑞星的,但后来我生日我朋友送了熊猫卫士给我当礼物,我没理由不用的,你们不会歧视不帮吧?!哈哈哈)不能正常升级了,本来我是设定为自动升级的,现在也行,只是升级过后还是不能加载哪个自动保护,和升级完了,但是显示还是当初那个日期,升级不了,我想应该还是有其他病毒影响!所以我都不知该怎么办,请两位老大帮帮忙吧,感激不尽,谢谢!
gototop
 

这是刚刚用HijackThis1991扫的两份新的扫描logo!如下:
2005-11-16(安全模式):
This_815汉化版扫描日志 V1.99.1
保存于      17:41:44, 日期 2005-11-16
操作系统:  Windows XP  (WinNT 5.01.2600)
浏览器:    Internet Explorer v6.00 SP1 (6.00.2600.0000)

当前运行的进程:         
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\System32\ctfmon.exe
D:\WINDOWS\system32\mmc.exe
F:\应用程序\HijachThis V1.99.2汉化版\HijackThis1991zww.exe

O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - D:\PROGRA~1\baidu\bar\baidubar.dll (file missing)
O3 - IE工具栏增项: 百度超级搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - D:\PROGRA~1\baidu\bar\baidubar.dll (file missing)
O4 - 启动项HKLM\\Run: [APVXDWIN] "D:\Program Files\Panda Software\熊猫卫士钛金版2004\APVXDWIN.EXE" /s
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O10 - Broken Internet access because of LSP provider 'd:\program files\panda software\
O16 - DPF: {371B29D9-4563-4E7F-B93D-F85ED5682ABC} (CoRaise Player Object) - http://202.104.212.55/tsplay/tsplay.cab
O23 - NT 服务: Panda Process Protection Service (PavPrSrv) - Panda Software - D:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - NT 服务: Panda anti-virus service (PAVSRV) - Panda Software - D:\Program Files\Panda Software\熊猫卫士钛金版2004\pavsrv51.exe
O23 - NT 服务: Panda IManager Service (PSIMSVC) - Panda Software Internacional - D:\Program Files\Panda Software\熊猫卫士钛金版2004\PsImSvc.exe
-----------------------------------------------------------
2005-11-16(上网模式):
HijackThis_815汉化版扫描日志 V1.99.1
保存于      17:58:41, 日期 2005-11-16
操作系统:  Windows XP  (WinNT 5.01.2600)
浏览器:    Internet Explorer v6.00 SP1 (6.00.2600.0000)

当前运行的进程:         
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\csrss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
D:\Program Files\Panda Software\熊猫卫士钛金版2004\PsImSvc.exe
D:\WINDOWS\System32\wdfmgr.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Panda Software\熊猫卫士钛金版2004\APVXDWIN.EXE
D:\WINDOWS\System32\ctfmon.exe
D:\Program Files\Panda Software\熊猫卫士钛金版2004\WebProxy.exe
D:\Program Files\VnetClient1.6\VnetClient.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\Panda Software\熊猫卫士钛金版2004\pavprot.exe
D:\Program Files\Panda Software\熊猫卫士钛金版2004\PavFnSvr.exe
D:\Program Files\Panda Software\熊猫卫士钛金版2004\AVENGINE.EXE
F:\应用程序\HijachThis V1.99.2汉化版\HijackThis1991zww.exe

O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - D:\PROGRA~1\baidu\bar\baidubar.dll (file missing)
O3 - IE工具栏增项: 百度超级搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - D:\PROGRA~1\baidu\bar\baidubar.dll (file missing)
O4 - 启动项HKLM\\Run: [APVXDWIN] "D:\Program Files\Panda Software\熊猫卫士钛金版2004\APVXDWIN.EXE" /s
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O10 - Broken Internet access because of LSP provider 'd:\program files\panda software\
O16 - DPF: {371B29D9-4563-4E7F-B93D-F85ED5682ABC} (CoRaise Player Object) - http://202.104.212.55/tsplay/tsplay.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3A5220D4-E0CA-4A7C-810F-455C11C140B3}: NameServer = 202.96.128.86 202.96.128.166
O23 - NT 服务: Panda PAVFNSVR (PAVFNSVR) - Panda Software - D:\Program Files\Panda Software\熊猫卫士钛金版2004\PavFnSvr.exe
O23 - NT 服务: Panda PAVPROT (PAVPROT) - Panda Software - D:\Program Files\Panda Software\熊猫卫士钛金版2004\pavprot.exe
O23 - NT 服务: Panda Process Protection Service (PavPrSrv) - Panda Software - D:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - NT 服务: Panda anti-virus service (PAVSRV) - Panda Software - D:\Program Files\Panda Software\熊猫卫士钛金版2004\pavsrv51.exe
O23 - NT 服务: Panda Preventium+ Service (PREVSRV) - Panda Software - D:\Program Files\Panda Software\熊猫卫士钛金版2004\Prevsrv.exe
O23 - NT 服务: Panda IManager Service (PSIMSVC) - Panda Software Internacional - D:\Program Files\Panda Software\熊猫卫士钛金版2004\PsImSvc.exe


gototop
 

好的,谢谢老大回复,搞不惦我再找各位帮忙,先吃饭,再见了!
gototop
 

各位老大好,我刚吃完了饭,我忘了告诉你们,我是装了双系统的,我刚在98那边升级了杀毒软件,将它更新为熊猫钛金2005,再用它扫描了全机,结果发现了两个病毒,一个是QQPass、还有一个是间谍软件,之后我再重启回到XP,我在开机的时候用HijackThis1991扫描了一个Logo,然后又在上网时扫了一个Logo,我等会再发给老大研究。之后我的这个熊猫又自动升级,但是还是无法开启自动保护,之后我的机子就发现一个病毒Exploit/Lsass它正想入侵我的机子,这是熊猫刚发的提示!现在呈上Logo两份,请帮忙分析,好象有变化哦!Logo如下:
2005-11-16(刚开机):
This_815汉化版扫描日志 V1.99.1
保存于      20:12:51, 日期 2005-11-16
操作系统:  Windows XP  (WinNT 5.01.2600)
浏览器:    Internet Explorer v6.00 SP1 (6.00.2600.0000)

当前运行的进程:         
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\csrss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Panda Software\熊猫卫士钛金版2004\PavFnSvr.exe
D:\Program Files\Panda Software\熊猫卫士钛金版2004\pavprot.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
D:\Program Files\Panda Software\熊猫卫士钛金版2004\Prevsrv.exe
D:\Program Files\Panda Software\熊猫卫士钛金版2004\PsImSvc.exe
D:\WINDOWS\System32\wdfmgr.exe
D:\Program Files\Panda Software\熊猫卫士钛金版2004\APVXDWIN.EXE
D:\WINDOWS\System32\ctfmon.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\Panda Software\熊猫卫士钛金版2004\WebProxy.exe
F:\应用程序\HijachThis V1.99.2汉化版\HijackThis1991zww.exe

O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - D:\PROGRA~1\baidu\bar\baidubar.dll (file missing)
O3 - IE工具栏增项: 百度超级搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - D:\PROGRA~1\baidu\bar\baidubar.dll (file missing)
O4 - 启动项HKLM\\Run: [APVXDWIN] "D:\Program Files\Panda Software\熊猫卫士钛金版2004\APVXDWIN.EXE" /s
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O10 - Broken Internet access because of LSP provider 'd:\program files\panda software\
O16 - DPF: {371B29D9-4563-4E7F-B93D-F85ED5682ABC} (CoRaise Player Object) - http://202.104.212.55/tsplay/tsplay.cab
O20 - AppInit_DLLs: PAVWAIT.DLL
O23 - NT 服务: Panda PAVFNSVR (PAVFNSVR) - Panda Software - D:\Program Files\Panda Software\熊猫卫士钛金版2004\PavFnSvr.exe
O23 - NT 服务: Panda PAVPROT (PAVPROT) - Panda Software - D:\Program Files\Panda Software\熊猫卫士钛金版2004\pavprot.exe
O23 - NT 服务: Panda Process Protection Service (PavPrSrv) - Panda Software - D:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - NT 服务: Panda anti-virus service (PAVSRV) - Panda Software - D:\Program Files\Panda Software\熊猫卫士钛金版2004\pavsrv51.exe
O23 - NT 服务: Panda Preventium+ Service (PREVSRV) - Panda Software - D:\Program Files\Panda Software\熊猫卫士钛金版2004\Prevsrv.exe
O23 - NT 服务: Panda IManager Service (PSIMSVC) - Panda Software Internacional - D:\Program Files\Panda Software\熊猫卫士钛金版2004\PsImSvc.exe

-----------------------------------------------------------
2005-11-16(上网后):
HijackThis_815汉化版扫描日志 V1.99.1
保存于      20:20:14, 日期 2005-11-16
操作系统:  Windows XP  (WinNT 5.01.2600)
浏览器:    Internet Explorer v6.00 SP1 (6.00.2600.0000)

当前运行的进程:         
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\csrss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Panda Software\熊猫卫士钛金版2004\PavFnSvr.exe
D:\Program Files\Panda Software\熊猫卫士钛金版2004\pavprot.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
D:\Program Files\Panda Software\熊猫卫士钛金版2004\Prevsrv.exe
D:\Program Files\Panda Software\熊猫卫士钛金版2004\PsImSvc.exe
D:\WINDOWS\System32\wdfmgr.exe
D:\Program Files\Panda Software\熊猫卫士钛金版2004\APVXDWIN.EXE
D:\WINDOWS\System32\ctfmon.exe
D:\Program Files\Panda Software\熊猫卫士钛金版2004\WebProxy.exe
D:\Program Files\VnetClient1.6\VnetClient.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\WINDOWS\system32\cmd.exe
D:\WINDOWS\System32\csrssv.exe
D:\Program Files\Panda Software\熊猫卫士钛金版2004\pavsrv51.exe
D:\Program Files\Panda Software\熊猫卫士钛金版2004\AVENGINE.EXE
F:\应用程序\HijachThis V1.99.2汉化版\HijackThis1991zww.exe

O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - D:\PROGRA~1\baidu\bar\baidubar.dll (file missing)
O3 - IE工具栏增项: 百度超级搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - D:\PROGRA~1\baidu\bar\baidubar.dll (file missing)
O4 - 启动项HKLM\\Run: [APVXDWIN] "D:\Program Files\Panda Software\熊猫卫士钛金版2004\APVXDWIN.EXE" /s
O4 - 启动项HKLM\\Run: [Microsoft DLL Verifier] csrssv.exe
O4 - 启动项HKLM\\RunServices: [Microsoft DLL Verifier] csrssv.exe
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O10 - Broken Internet access because of LSP provider 'd:\program files\panda software\
O16 - DPF: {371B29D9-4563-4E7F-B93D-F85ED5682ABC} (CoRaise Player Object) - http://202.104.212.55/tsplay/tsplay.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3A5220D4-E0CA-4A7C-810F-455C11C140B3}: NameServer = 202.96.128.86 202.96.128.166
O20 - AppInit_DLLs: PAVWAIT.DLL
O23 - NT 服务: Panda PAVFNSVR (PAVFNSVR) - Panda Software - D:\Program Files\Panda Software\熊猫卫士钛金版2004\PavFnSvr.exe
O23 - NT 服务: Panda PAVPROT (PAVPROT) - Panda Software - D:\Program Files\Panda Software\熊猫卫士钛金版2004\pavprot.exe
O23 - NT 服务: Panda Process Protection Service (PavPrSrv) - Panda Software - D:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - NT 服务: Panda anti-virus service (PAVSRV) - Panda Software - D:\Program Files\Panda Software\熊猫卫士钛金版2004\pavsrv51.exe
O23 - NT 服务: Panda Preventium+ Service (PREVSRV) - Panda Software - D:\Program Files\Panda Software\熊猫卫士钛金版2004\Prevsrv.exe
O23 - NT 服务: Panda IManager Service (PSIMSVC) - Panda Software Internacional - D:\Program Files\Panda Software\熊猫卫士钛金版2004\PsImSvc.exe

-----------------------------------------------------------

请高手们详细分析,请[font_color=#FF0000]“救救小弟,Please!Helep Me!SOS”[/font]
gototop
 

谢谢飞跃迷离老大的指导,我现在就立即去搞,但愿能搞好,要不然我又得麻烦你了!谢谢!
gototop
 

飞跃迷离老大,我刚照你说的方法去搞了,我进入到安全模式下,进入了进程管理器,但是却没有找到哪个D:\WINDOWS\System32\csrssv.exe进程,只有csrss.exe进程,我看都差不多,就尝试着想关掉这个进程,那知系统提示说,这是一个关键进程,没法结束,我又尝试去修改它的级别,好让我能结束它,结果还是不成,没办法我就先做了下一步,先用HijackThis扫描,在HijackThis中可以找到它,我就修复了两项04项,那两项06项是我用设置大师2005锁上了的,之后我就按你的下一步要求去删了D:\WINDOWS\System32\csrssv.exe。我还在安全模式下用HijackThis扫了个Logo,Logo如下:
ijackThis_815汉化版扫描日志 V1.99.1
保存于      15:45:03, 日期 2005-11-17
操作系统:  Windows XP  (WinNT 5.01.2600)
浏览器:    Internet Explorer v6.00 SP1 (6.00.2600.0000)

当前运行的进程:         
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Internet Explorer\iexplore.exe
D:\WINDOWS\System32\ctfmon.exe
F:\应用程序\HijachThis V1.99.2汉化版\HijackThis1991zww.exe

O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - D:\PROGRA~1\baidu\bar\baidubar.dll (file missing)
O3 - IE工具栏增项: 百度超级搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - D:\PROGRA~1\baidu\bar\baidubar.dll (file missing)
O4 - 启动项HKLM\\Run: [APVXDWIN] "D:\Program Files\Panda Software\熊猫卫士钛金版2004\APVXDWIN.EXE" /s
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O10 - Broken Internet access because of LSP provider 'd:\program files\panda software\
O16 - DPF: {371B29D9-4563-4E7F-B93D-F85ED5682ABC} (CoRaise Player Object) - http://202.104.212.55/tsplay/tsplay.cab
O20 - AppInit_DLLs: PAVWAIT.DLL
O23 - NT 服务: Panda PAVFNSVR (PAVFNSVR) - Panda Software - D:\Program Files\Panda Software\熊猫卫士钛金版2004\PavFnSvr.exe
O23 - NT 服务: Panda PAVPROT (PAVPROT) - Panda Software - D:\Program Files\Panda Software\熊猫卫士钛金版2004\pavprot.exe
O23 - NT 服务: Panda Process Protection Service (PavPrSrv) - Panda Software - D:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - NT 服务: Panda anti-virus service (PAVSRV) - Panda Software - D:\Program Files\Panda Software\熊猫卫士钛金版2004\pavsrv51.exe
O23 - NT 服务: Panda Preventium+ Service (PREVSRV) - Panda Software - D:\Program Files\Panda Software\熊猫卫士钛金版2004\Prevsrv.exe
O23 - NT 服务: Panda IManager Service (PSIMSVC) - Panda Software Internacional - D:\Program Files\Panda Software\熊猫卫士钛金版2004\PsImSvc.exe

-----------------------------------------------------------
请帮忙再看看,还有什么病毒吗?!请问刚才删了的那项是为什么,我好想知道,可告之吗?!我现在的机子,基本上上网都能正常了,只是开机进入系统比几天前慢了和那个杀毒软件还是不行,不能加载自动保护功能,看来要重装了!至于哪个baidu搜霸,看来要用魔法学徒老大的方法去搞了!谢谢你们的帮助!!!
gototop
 

好,谢谢回复,我本来就是用瑞星的,我支持国货的嘛,但是,我现在有现成的,我不用就是浪费啊!到期就改用瑞星了,要不然我也不知这个论坛!噢,对了魔法学徒版主,你那删除baidu的方法可不可以讲得详细一点,我对Dos命令真的是一窍不通啊,而且我的机子是双系统—98&XP,我已经在98中删了XP里的哪个baidu文件夹了,只有XP的注册表中还有根键!不知有没有效?如果我真的把它删了我又该怎么预防baidu呢?还有,好象你的工具包里没有你说的哪个工具啊,快点放进去啊,拜托,能回答我吗?谢谢!
gototop
 

谢谢老大你,我立即去下载去搞!
gototop
 
12   1  /  2  页   跳转
页面顶部
Powered by Discuz!NT