Logfile of HijackThis v1.99.1
Scan saved at 10:10:22, on 2006-1-10
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
D:\QQ\QQ.exe
D:\QQ\TIMPlatform.exe
C:\Program Files\Antiy Labs\Alive\AliveCenter.exe
e:\新建文件夹\rising\rfw\rfwsrv.exe
e:\新建文件夹\rising\rfw\RfwMain.exe
C:\Program Files\ChinaNet\VnetClient.exe
D:\新建文件夹\troyanfindinfo.exe
D:\新建文件夹\有用工具\SREng.exe
D:\新建文件夹\HijackThis.exe

R3 - URLSearchHook: QQ Search Hook - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - C:\Program Files\TENCENT\AddrPlus\IEHelp.dll
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v8.dll
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F57} - C:\WINDOWS\system32\THUNDE~1.DLL
O2 - BHO: Tencent Browser Helper - {0C7C23EF-A848-485B-873C-0ED954731014} - C:\Program Files\TENCENT\AddrPlus\IEHelp.dll
O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB}? - (no file)
O2 - BHO: VnetCookie Class - {4E83D567-4697-4F7B-B1F0-A513B01DB89A} - c:\PROGRA~1\chinanet\VNETTR~1.DLL
O2 - BHO: (no name) - {4E83D567-4697-4F7B-B1F0-A513B01DB89A}? - (no file)
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\QQ\QQIEHelper.dll
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B}? - (no file)
O2 - BHO: Norton Personal Firewall - {9ECB9560-04F9-4bbc-943D-298DDF1699E1}? - (no file)
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4}? - (no file)
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] rem "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] rem C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] rem C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMan] rem SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [Synchronization Manager] rem %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [RfwMain] rem E:\新建文件夹\Rising\Rfw\rfwmain.exe
O4 - HKLM\..\Run: [dfvsx] rem "E:\新建文件夹 (2)\DFVSX\DFVSX.exe" -Min
O4 - HKLM\..\Run: [AddrPlus3] RUNDLL32.EXE C:\PROGRA~1\TENCENT\AddrPlus\QAHook.dll,Rundll32
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] rem "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: 腾讯QQ.lnk = D:\QQ\QQ.exe
O8 - Extra context menu item: &使用迅雷下载 - D:\讯雷\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - D:\讯雷\Thunder\getallurl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\QQ\SendMMS.htm
O9 - Extra button: 手机短信 - {00000000-0000-0001-0001-596BAEDD1289}? - http://sms.3721.com/ie/index.htm (file missing)
O9 - Extra button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97}? - http://cn.mail.yahoo.com/promo/rd1 (file missing)
O9 - Extra button: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26}? - http://adtaobao.allyes.com/main/adfclick?db=adtaobao&bid=138,140,18&cid=816,8,1&sid=5042&show=ignore&url=?allyesPara=816 (file missing)
O9 - Extra button: 雅虎助手 - {5D73EE86-05F1-49ed-B850-E423120EC338}? - http://cn.zs.yahoo.com/?source=Cns (file missing)
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\QQ\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\QQ\QQIEHelper.dll
O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96}? - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5}? - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O9 - Extra 'Tools' menuitem: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5}? - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O10 - Broken Internet access because of LSP provider 'c:\windows\system32\cdnns.dll' missing
O11 - Options group: [TBH]  QQ地址栏搜索插件
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://cn.download.zs.yahoo.com/partner/kavwebscan_unicode.cab
O16 - DPF: {90B1ECB2-FC3B-49AE-A6BD-F5F11BF5C4AD} (TWeb Class) - http://tbh.qq.com/SetupAx.exe
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/Ver2005/OL2005.cab
O16 - DPF: {EF6205C1-3F17-4829-BCB5-1336ED89E356} - http://club.jiangmin.com/kvscan/KvDown.cab
O16 - DPF: {F138084D-84D7-48CD-BEA8-04772457516E} (VqqSpeedDlProxy Class) - http://218.85.138.27/vqqsdl1009.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4BED69F1-67A0-4005-BEC8-AD8139FE588A}: NameServer = 218.2.135.1 61.147.37.1
O23 - Service: Antiy live update (Alive Auto-Update Service) - Unknown owner - C:\Program Files\Antiy Labs\Alive\AliveCenter.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (file missing)
O23 - Service: Symantec Network Proxy (ccProxy) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe (file missing)
O23 - Service: Symantec Password Validation (ccPwdSvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (file missing)
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Personal Firewall\ISSVC.exe
O23 - Service: Kingsoft Personal Firewall Service (KPfwSvc) - Kingsoft Corporation - C:\Documents and Settings\admin\My Documents\11\KPfwSvc.EXE
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - e:\新建文件夹\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Unknown owner - C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (file missing)
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe (file missing)

我记得上天有人叫我修复那几项的!可是重启后又出来了!而且那3个毒也杀不掉!...

我没安装什么软件在C盘里.......我的文件夹选项没有了...昨天用了SREng修复!可是没有...!我想上面那4个在隐藏文件里...现在没办法用文件夹选项,就不知道是什么东西......

昨天就修复过了!可是开机后 又出来了!

引用:

【猎鹰渔民的贴子】Symantec的报告贴上来看看 ...........................

用什么工具?

我是用在线杀的!路径忘了....但是我的文件夹选项里边的(显示所有文件和文件夹这项)没用!别的有用!这是怎么回事?

而且是用了修复工具修复的,可是 没用...

=============== 2006-01-10,13:57:08 =============
[RegFix 1.2.1.0 Final Build 20040408]
    Windows XP Professional Service Pack 2

谢谢使用 RegFix 的功能之一 ：输出启动组的内容

    下面是你电脑上启动组的结果（需要注意的是：本
版本的 RegFix 仅支持注册表里面的启动组，开始——
程序——启动里面的内容暂时不被支持。一些配置文件
（如：Win.ini、System.ini）里面的加载项内容也暂时
不被支持。
    后续版本的 RegFix 将逐渐解决这些问题。
                                      Smallfrogs
                                          2004-4
-------------------------------------------------
------------------------------------------------------------
1：HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
------------------------------------------------------------
ctfmon.exe …… C:\WINDOWS\system32\ctfmon.exe
MSMSGS …… rem "C:\Program Files\Messenger\msmsgs.exe" /background
------------------------------------------------------------
2：HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
------------------------------------------------------------
------------------------------------------------------------
3：HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
------------------------------------------------------------
------------------------------------------------------------
4：HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices
------------------------------------------------------------
------------------------------------------------------------
5：HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
------------------------------------------------------------
------------------------------------------------------------
6：HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows  键值名称:load
------------------------------------------------------------
load ……
------------------------------------------------------------
7：HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows  键值名称:run
------------------------------------------------------------
------------------------------------------------------------
8：HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System  键值名称:Shell
------------------------------------------------------------
------------------------------------------------------------
9：HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
------------------------------------------------------------
------------------------------------------------------------
10：HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
------------------------------------------------------------
IMJPMIG8.1 …… rem "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
PHIME2002ASync …… rem C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
PHIME2002A …… rem C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
SoundMan …… rem SOUNDMAN.EXE
TkBellExe …… "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
Synchronization Manager …… rem %SystemRoot%\system32\mobsync.exe /logon
RfwMain …… rem E:\新建文件夹\Rising\Rfw\rfwmain.exe
dfvsx …… rem "E:\新建文件夹 (2)\DFVSX\DFVSX.exe" -Min
AddrPlus3 …… RUNDLL32.EXE C:\PROGRA~1\TENCENT\AddrPlus\QAHook.dll,Rundll32
dfvsnet …… E:\新建文件夹 (2)\DFVSX\net\DFVSNET.EXE
------------------------------------------------------------
11：HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
------------------------------------------------------------
------------------------------------------------------------
12：HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
------------------------------------------------------------
------------------------------------------------------------
13：HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunService
------------------------------------------------------------
------------------------------------------------------------
14：HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServiceOnce
------------------------------------------------------------
------------------------------------------------------------
15：HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
------------------------------------------------------------
------------------------------------------------------------
16：HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon  键值名称:Shell
------------------------------------------------------------
Shell …… Explorer.exe
------------------------------------------------------------
17：HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon  键值名称:Userinit
------------------------------------------------------------
Userinit …… C:\WINDOWS\system32\userinit.exe
  手工修复功能是为只需要解除部分常见限制的用户设计的。如果你需要解除全部限制，请使用“全自动修复”功能。
    使用手工修复功能仅能修复在列表里面已经列出的限制，对于没有列出的限制，手工修复是不起作用的。如果你碰到的限制没有出现在手工修复列表里面，请使用自动修复功能。自动修复功能能够解决大部分已知的限制。
    如果手工修复和自动修复都不能够解决或解决以后马上失效或重启后失效，那么可能是你的启动组或正在运行的进程里面出现了非正常的程序（例如：Trojan木马或后门程序），请使用“手工修复——基本功能——导出启动组内容”功能导出你的启动组内容，并分析启动组内容，删除不必要的启动项即可解决。如果你不能够分析，可以把导出的文本文件不做修改的提交到 regfix@hotmail.com ，我将帮助你分析该文件。
    帮忙看下哪个是不必要的启动项!我就是中了它说的那种毒!....

文件: C:\WINDOWS\system32\V12003518.EPE，发现病毒Win-Trojan/Backdoor.322048

来个人帮忙解决下上面问题!......................

开始扫描硬盘分区C:...
硬盘中发现木马!-=>伪系统Worm.DocKill.b #2870
C:\WINDOWS\doc1.exe
木马在硬盘清除失败!木马可能还在内存中运行
C:\WINDOWS\doc1.exe