瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 【求助】Trojan-Spy.Win32.Agent.iw这个病毒怎么杀

1   1  /  1  页   跳转

【求助】Trojan-Spy.Win32.Agent.iw这个病毒怎么杀

【求助】Trojan-Spy.Win32.Agent.iw这个病毒怎么杀

启动的时候PF使用率有1G多,是不是这个造成的啊?
最后编辑2005-12-17 13:13:49
分享到:
gototop
 

是虚拟内存吧,每次开机都提示虚拟内存最小值太低
这是用卡巴斯基在线查出来的,可我不知道怎么杀,之前用瑞星都没查出来
Infected Object Name - Virus Name
C:\Program Files\zsxz\ieserva32.dll    Infected: Trojan-Spy.Win32.Agent.iw
C:\Program Files\zsxz\IEUrldrive.exe    Infected: Trojan-Spy.Win32.Agent.iw
C:\Program Files\zsxz\UrlService.exe    Infected: Trojan-Spy.Win32.Agent.iw
C:\System Volume Information\_restore{5B9B53A2-4F31-46FA-8C86-E7120F058DF8}\RP131\A0037786.exe    Infected: Trojan-Spy.Win32.Agent.iw
C:\System Volume Information\_restore{5B9B53A2-4F31-46FA-8C86-E7120F058DF8}\RP131\A0037787.exe    Infected: Trojan-Spy.Win32.Agent.iw
C:\System Volume Information\_restore{5B9B53A2-4F31-46FA-8C86-E7120F058DF8}\RP131\A0037788.exe    Infected: Trojan-Spy.Win32.Agent.iw
C:\System Volume Information\_restore{5B9B53A2-4F31-46FA-8C86-E7120F058DF8}\RP131\A0037789.exe    Infected: Trojan-Spy.Win32.Agent.iw
C:\System Volume Information\_restore{5B9B53A2-4F31-46FA-8C86-E7120F058DF8}\RP131\A0037790.exe    Infected: Trojan-Spy.Win32.Agent.iw
C:\System Volume Information\_restore{5B9B53A2-4F31-46FA-8C86-E7120F058DF8}\RP131\A0037791.exe    Infected: Trojan-Spy.Win32.Agent.iw
C:\System Volume Information\_restore{5B9B53A2-4F31-46FA-8C86-E7120F058DF8}\RP131\A0037792.exe    Infected: Trojan-Spy.Win32.Agent.iw
C:\System Volume Information\_restore{5B9B53A2-4F31-46FA-8C86-E7120F058DF8}\RP131\A0037793.exe    Infected: Trojan-Spy.Win32.Agent.iw
C:\System Volume Information\_restore{5B9B53A2-4F31-46FA-8C86-E7120F058DF8}\RP131\A0037794.dll    Infected: Trojan-Spy.Win32.Agent.iw
C:\System Volume Information\_restore{5B9B53A2-4F31-46FA-8C86-E7120F058DF8}\RP131\A0037795.sys    Infected: Trojan-Spy.Win32.Agent.iw
C:\System Volume Information\_restore{5B9B53A2-4F31-46FA-8C86-E7120F058DF8}\RP131\A0037797.sys    Infected: Trojan-Spy.Win32.Agent.iw
C:\WINDOWS\Servers.exe    Infected: Backdoor.Win32.Delf.tp
C:\WINDOWS\SYSTEM32\SeedServ.exe    Infected: Trojan-Downloader.Win32.Agent.abm
C:\WINDOWS\Temp\setb.exe    Infected: Trojan-Dropper.Win32.Agent.ael
D:\System Volume Information\_restore{5B9B53A2-4F31-46FA-8C86-E7120F058DF8}\RP129\A0034323.exe    Infected: Backdoor.Win32.Hupigon.es
D:\setup\rav.rar/rav/setup.exe    Infected: Backdoor.Win32.Delf.tp
D:\setup\rav.rar    Infected: Backdoor.Win32.Delf.tp
D:\setup\eMule-0.46b-VeryCD0715Install.exe/stream/data0211/stream/data0001/stream/data0001    Infected: Trojan-Downloader.Win32.Agent.rs
D:\setup\eMule-0.46b-VeryCD0715Install.exe/stream/data0211/stream/data0001/stream    Infected: Trojan-Downloader.Win32.Agent.rs
D:\setup\eMule-0.46b-VeryCD0715Install.exe/stream/data0211/stream/data0001    Infected: Trojan-Downloader.Win32.Agent.rs
D:\setup\eMule-0.46b-VeryCD0715Install.exe/stream/data0211/stream    Infected: Trojan-Downloader.Win32.Agent.rs
D:\setup\eMule-0.46b-VeryCD0715Install.exe/stream/data0211    Infected: Trojan-Downloader.Win32.Agent.rs
D:\setup\eMule-0.46b-VeryCD0715Install.exe/stream    Infected: Trojan-Downloader.Win32.Agent.rs
D:\setup\eMule-0.46b-VeryCD0715Install.exe    Infected: Trojan-Downloader.Win32.Agent.rs
D:\Recycled\Dd1.vir\UsbDriver.lib.vir    Infected: Backdoor.Win32.BlackHole.2004.c
E:\System Volume Information\_restore{5B9B53A2-4F31-46FA-8C86-E7120F058DF8}\RP114\A0028805.exe/streg.dll    Infected: Trojan-Downloader.Win32.Small.btn
E:\System Volume Information\_restore{5B9B53A2-4F31-46FA-8C86-E7120F058DF8}\RP114\A0028805.exe    Infected: Trojan-Downloader.Win32.Small.btn
gototop
 

各位大大帮帮忙啊,现在运行程序的速度很慢
下面是日志,请各位帮我看看,谢谢
HijackThis_815汉化版扫描日志 V1.99.1
保存于      12:10:49, 日期 2005-12-17
操作系统:  Windows XP SP2 (WinNT 5.01.2600)
浏览器:    Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程:         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\Explorer.EXE
D:\Kaspersky Anti-Virus Personal\kav.exe
D:\Kaspersky Anti-Virus Personal\kavsvc.exe
D:\setup\hijachthis\HijackThis1991zww.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\adobe\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file)
O3 - IE工具栏增项: (no name) - {4DA2EE61-6399-4C39-AEB9-0D990E610D29} - (no file)
O3 - IE工具栏增项: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\fgiebar.dll
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - 启动项HKLM\\Run: [ATIModeChange] Ati2mdxx.exe
O4 - 启动项HKLM\\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - 启动项HKLM\\Run: [PRONoMgr.exe] C:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe
O4 - 启动项HKLM\\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - 启动项HKLM\\Run: [bascstray] BascsTray.exe
O4 - 启动项HKLM\\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - 启动项HKLM\\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - 启动项HKLM\\Run: [TkBellExe] ; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - 启动项HKLM\\Run: [wcmdmgr] ; C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch
O4 - 启动项HKLM\\Run: [AdaptecDirectCD] ; "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - 启动项HKLM\\Run: [RavTask] "C:\Program Files\rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [SigmaTel StacMon] C:\Program Files\SigmaTel\SigmaTel AC97 音频驱动器\stacmon.exe
O4 - 启动项HKLM\\Run: [Super Rabbit SRRestore] D:\program\MagicSet\srrest.exe /autosave
O4 - 启动项HKLM\\Run: [KAVPersonal50] "D:\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/kws/kavwebscan_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097719635291
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1122014713375
O20 - Winlogon Notify: Sebring - C:\WINDOWS\System32\LgNotify.dll
O23 - NT 服务: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - NT 服务: Broadcom ASF IP monitoring service v6.0.3 (BAsfIpM) - Broadcom Corp. - C:\WINDOWS\System32\basfipm.exe
O23 - NT 服务: kavsvc - Kaspersky Lab - D:\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - NT 服务: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - NT 服务: Remote Log - Unknown owner - C:\WINDOWS\system32\ServeHost.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\rising\Rav\Ravmond.exe
O23 - NT 服务: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\WINDOWS\System32\S24EvMon.exe

gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT