我的电脑经常无缘无故弹出一些莫名其妙的网页,都是不同的网站,玩游戏的时候也会弹出来,反正做什么都会时不时弹出来,我怀疑是木马,用HijackThis检查的结果如下:
HijackThis_815汉化版扫描日志 V1.99.1
保存于 17:39:11, 日期 2006-7-22
操作系统： Windows XP SP2 (WinNT 5.01.2600)
浏览器： Internet Explorer v6.00 SP1 (6.00.2900.2180)
当前运行的进程：
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
E:\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
E:\Rising\Rav\Ravmond.exe
C:\WINDOWS\system32\spoolsv.exe
E:\Rising\Rav\RavStub.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
E:\Rising\Rav\RavTask.exe
E:\Rising\Rav\Ravmon.exe
E:\DAEMON Tools\daemon.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
E:\QQ\QQ.exe
E:\tengxunQQ\TIMPlatform.exe
E:\HFGameOPT\GameClient.exe
D:\Program Files\TTPlayer\TTPlayer.exe
C:\Program Files\Internet Explorer\iexplore.exe
E:\HijackThis汉华版\HijackThis1991zww.exe
O3 - IE工具栏增项: BitComet工具栏 - {3F1ABCDB-A875-46c1-8345-B72A4567E486} - E:\BitComet\BitCometBar\BitCometBar0.6.dll
O4 - 启动项HKLM\\Run: [DAEMON Tools-1033> ＂E:\DAEMON\daemon.exe＂ -lang 1033
O4 - 启动项HKLM\\Run: [KernelFaultCheck> %systemroot%\system32\dumprep 0 -k
O4 - 启动项HKLM\\Run: [IMSCMig> C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - 启动项HKLM\\Run: [RavTask> ＂E:\Rising\Rav\RavTask.exe＂ -system
O4 - 启动项HKLM\\Run: [DAEMON Tools> ＂E:\DAEMON Tools\daemon.exe＂ -lang 1033
O4 - HKCU\..\Run: [H/PC Connection Agent> ＂C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE＂
O4 - HKCU\..\Run: [Super Rabbit IEPro> E:\超级兔子\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD
O8 - IE右键菜单中的新增项目: ＆使用迅雷下载 - E:\讯雷5\Program\GetUrl.htm
O8 - IE右键菜单中的新增项目: ＆使用迅雷下载全部链接 - E:\讯雷5\Program\GetAllUrl.htm
O10 - Broken Internet access because of LSP provider 'c:\windows\system32\cdnns.dll' missing
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/
O23 - NT 服务: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - NT 服务: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - NT 服务: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - E:\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - E:\Rising\Rav\Ravmond.exe
请大大们帮忙看看,拜托拜托!
[ 本帖最后由 网络vs浪子 于 2006-7-22 21:21 编辑 >
O4 - 启动项HKLM\\Run: [KernelFaultCheck> %systemroot%\system32\dumprep 0 -k
这个修复后，用置顶恶意软件清理助手到安全模式下清理一遍，还是出问题的话，请说明一下哪几个网站，并用SRENG软件扫个日志再贴上来
我按大大说的弄了1遍,还是会弹出网页.
弹出的网页:
用sreng扫描的日志:
2006-07-22,18:39:18
System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (
Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run>
＜H/PC Connection Agent＞＜＂C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE＂＞ [Microsoft Corporation>
＜ctfmon.exe＞＜C:\WINDOWS\system32\ctfmon.exe＞ [Microsoft Corporation>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows>
＜load＞＜＞ [>
＜run＞＜＞ [>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run>
＜DAEMON Tools-1033＞＜＂E:\DAEMON\daemon.exe＂ -lang 1033＞ [>
＜IMSCMig＞＜C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload＞ [Microsoft Corporation>
＜RavTask＞＜＂E:\Rising\Rav\RavTask.exe＂ -system＞ [Beijing Rising Technology Co., Ltd.>
＜DAEMON Tools＞＜＂E:\DAEMON Tools\daemon.exe＂ -lang 1033＞ [DT Soft Ltd.>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon>
＜shell＞＜Explorer.exe＞ [Microsoft Corporation>
＜Userinit＞＜C:\WINDOWS\system32\userinit.exe,＞ [Microsoft Corporation>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows>
＜AppInit_DLLs＞＜＞ [>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon>
＜UIHost＞＜logonui.exe＞ [ORIONNET>
==================================
启动文件夹
服务
[Ati HotKey Poller / Ati HotKey Poller>
＜C:\WINDOWS\system32\Ati2evxx.exe＞＜ATI Technologies Inc.＞
[ATI Smart / ATI Smart>
＜C:\WINDOWS\system32\ati2sgag.exe＞＜＞
[Macromedia Licensing Service / Macromedia Licensing Service>
＜＂C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe＂＞＜Macromedia＞
[Rising Process Communication Center / RsCCenter>
＜＂E:\Rising\Rav\CCenter.exe＂＞＜Beijing Rising Technology Co., Ltd.＞
[RsRavMon Service / RsRavMon>
＜＂E:\Rising\Rav\Ravmond.exe＂＞＜Beijing Rising Technology Co., Ltd.＞
[Te1net / Te1net>
＜＞＜N/A＞
==================================
浏览器加载项
[BitComet工具栏>
{3F1ABCDB-A875-46c1-8345-B72A4567E486} ＜E:\BitComet\BitCometBar\BitCometBar0.6.dll, N/A＞
[Shockwave Flash Object>
{D27CDB6E-AE6D-11CF-96B8-444553540000} ＜C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.＞
[＆使用迅雷下载>
＜E:\讯雷5\Program\GetUrl.htm, N/A＞
[＆使用迅雷下载全部链接>
＜E:\讯雷5\Program\GetAllUrl.htm, N/A＞
[？？？？ Microsoft Office Excel(＆X)>
＜, N/A＞
==================================
正在运行的进程
[PID: 612>[\SystemRoot\System32\smss.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 668>[\？？\C:\WINDOWS\system32\csrss.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 696>[\？？\C:\WINDOWS\system32\winlogon.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 744>[C:\WINDOWS\system32\services.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[C:\WINDOWS\system32\quartz32.dll> ＜＞＜4, 0, 0, 0＞
[PID: 756>[C:\WINDOWS\system32\lsass.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 920>[C:\WINDOWS\system32\Ati2evxx.exe> ＜ATI Technologies Inc.＞＜6.14.10.4123＞
[C:\WINDOWS\system32\Ati2edxx.dll> ＜ATI Technologies, Inc.＞＜6, 14, 10, 2499＞
[PID: 932>[C:\WINDOWS\system32\svchost.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 1012>[C:\WINDOWS\system32\svchost.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[C:\WINDOWS\system32\quartz32.dll> ＜＞＜4, 0, 0, 0＞
[PID: 1108>[E:\Rising\Rav\CCenter.exe> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 3＞
[PID: 1156>[C:\WINDOWS\System32\svchost.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[C:\WINDOWS\system32\quartz32.dll> ＜＞＜4, 0, 0, 0＞
[PID: 1244>[C:\WINDOWS\system32\svchost.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 1396>[C:\WINDOWS\system32\svchost.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 1416>[E:\Rising\Rav\Ravmond.exe> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 1, 29＞
[E:\Rising\Rav\BWList.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 19＞
[E:\Rising\Rav\RsCommX.dll> ＜rising＞＜18, 0, 0, 1＞
[E:\Rising\Rav\RSAPPMGR.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 2＞
[E:\Rising\Rav\CfgDll.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 11＞
[E:\Rising\Rav\RSCOMMON.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 4＞
[E:\Rising\Rav\RsLog.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 20＞
[E:\Rising\Rav\HOOKSYS.dll> ＜Rising＞＜18, 1, 0, 9＞
[E:\Rising\Rav\Scanner.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 30＞
[E:\Rising\Rav\libload.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 10＞
[E:\Rising\Rav\VirusLib.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 10＞
[E:\Rising\Rav\regmon.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 6＞
[E:\Rising\Rav\HookWeb.dll> ＜rising＞＜18, 0, 0, 2＞
[E:\Rising\Rav\MemMon.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 9＞
[E:\Rising\Rav\expscan.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 4＞
[E:\Rising\Rav\mPorts.dll> ＜Beijing Rising Technology Co., Ltd.＞＜4, 0, 0, 3＞
[E:\Rising\Rav\MailMon.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 5＞
[E:\Rising\Rav\SpamEng.dll> ＜N/A＞＜18, 0, 0, 6＞
[E:\Rising\Rav\engine.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 30＞
[C:\WINDOWS\system32\quartz32.dll> ＜＞＜4, 0, 0, 0＞
[E:\Rising\Rav\PostTrt.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 9＞
[E:\Rising\Rav\UnExe.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 11＞
[E:\Rising\Rav\ScanExec.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 11＞
[E:\Rising\Rav\ScanEx.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 12＞
[E:\Rising\Rav\NvFile.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 7＞
[E:\Rising\Rav\ScanMac.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 9＞
[E:\Rising\Rav\ScanSct.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 18＞
[E:\Rising\Rav\Unpacker.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 3＞
[E:\Rising\Rav\ScanNet.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 5＞
[PID: 1592>[C:\WINDOWS\system32\spoolsv.exe> ＜Microsoft Corporation＞＜5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)＞
[PID: 1716>[E:\Rising\Rav\RavStub.exe> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 16＞
[E:\Rising\Rav\RsCommX.dll> ＜rising＞＜18, 0, 0, 1＞
[E:\Rising\Rav\RSCOMMON.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 4＞
[PID: 1892>[C:\WINDOWS\system32\wdfmgr.exe> ＜Microsoft Corporation＞＜5.2.3790.1230 built by: dnsrv(bld4act)＞
[PID: 460>[C:\WINDOWS\System32\alg.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[C:\WINDOWS\system32\quartz32.dll> ＜＞＜4, 0, 0, 0＞
[PID: 1488>[C:\WINDOWS\Explorer.EXE> ＜Microsoft Corporation＞＜6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)＞
[C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll> ＜＞＜1, 0, 0, 1＞
[C:\Program Files\WinRAR\rarext.dll> ＜N/A＞＜N/A＞
[C:\WINDOWS\system32\RavExt.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 21＞
[E:\Rising\Rav\RSCOMMON.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 4＞
[PID: 1356>[C:\WINDOWS\system32\ctfmon.exe> ＜Microsoft Corporation＞＜5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)＞
[PID: 1808>[E:\Rising\Rav\RavTask.exe> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 22＞
[E:\Rising\Rav\RSCOMMON.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 4＞
[E:\Rising\Rav\RSAPPMGR.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 2＞
[E:\Rising\Rav\CfgDll.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 11＞
[E:\Rising\Rav\RsCommX.dll> ＜rising＞＜18, 0, 0, 1＞
[PID: 1936>[E:\Rising\Rav\Ravmon.exe> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 1, 30＞
[E:\Rising\Rav\RsGuiLib.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 24＞
[E:\Rising\Rav\BWList.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 19＞
[E:\Rising\Rav\RSAPPMGR.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 2＞
[E:\Rising\Rav\CfgDll.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 11＞
[E:\Rising\Rav\RSCOMMON.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 4＞
[E:\Rising\Rav\RsCommX.dll> ＜rising＞＜18, 0, 0, 1＞
[E:\Rising\Rav\PngDll.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 5＞
[PID: 1944>[E:\DAEMON Tools\daemon.exe> ＜DT Soft Ltd.＞＜4.03.0.0＞
[E:\DAEMON Tools\daemon.dll> ＜DT Soft Ltd.＞＜4.03.0.0＞
[E:\DAEMON Tools\PFCTOC.DLL> ＜Padus(R), Inc.＞＜1, 0, 0, 12＞
[E:\DAEMON Tools\Plugins\Images\bw5mount.dll> ＜N/A＞＜1.0.6.0＞
[E:\DAEMON Tools\Plugins\Images\ccdmount.dll> ＜GENERIC＞＜1.10.0.0＞
[E:\DAEMON Tools\Plugins\Images\mdsmount.dll> ＜GENERIC＞＜1.12.0.0＞
[E:\DAEMON Tools\Plugins\Images\nrgmount.dll> ＜GENERIC＞＜1.11.0.0＞
[E:\DAEMON Tools\Plugins\Images\pdimount.dll> ＜GENERIC＞＜1.01.0.0＞
[PID: 1912>[C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE> ＜Microsoft Corporation＞＜3.8.0.5004＞
[C:\WINDOWS\system32\quartz32.dll> ＜＞＜4, 0, 0, 0＞
[PID: 248>[E:\RogueCleaner\RogueCleaner.exe> ＜Tommsoft.com＞＜1.9.7.22＞
[C:\WINDOWS\system32\quartz32.dll> ＜＞＜4, 0, 0, 0＞
[PID: 2328>[C:\Program Files\Internet Explorer\iexplore.exe> ＜Microsoft Corporation＞＜6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)＞
[C:\WINDOWS\system32\quartz32.dll> ＜＞＜4, 0, 0, 0＞
[PID: 2636>[C:\Program Files\Internet Explorer\iexplore.exe> ＜Microsoft Corporation＞＜6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)＞
[C:\WINDOWS\system32\quartz32.dll> ＜＞＜4, 0, 0, 0＞
[PID: 1392>[C:\Program Files\Internet Explorer\iexplore.exe> ＜Microsoft Corporation＞＜6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)＞
[C:\WINDOWS\system32\quartz32.dll> ＜＞＜4, 0, 0, 0＞
[PID: 2628>[E:\sreng2\SREng2\SREng.exe> ＜Smallfrogs Studio＞＜2.0.21.505＞
[C:\WINDOWS\system32\quartz32.dll> ＜＞＜4, 0, 0, 0＞
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1>
.EXE OK. [＂%1＂ %*>
.COM OK. [＂%1＂ %*>
.PIF OK. [＂%1＂ %*>
.REG OK. [regedit.exe ＂%1＂>
.BAT OK. [＂%1＂ %*>
.SCR OK. [＂%1＂ /S>
.CHM OK. [＂C:\WINDOWS\hh.exe＂ %1>
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1>
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1>
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1>
.VBS OK. [%SystemRoot%\System32\WScript.exe ＂%1＂ %*>
.JS OK. [%SystemRoot%\System32\WScript.exe ＂%1＂ %*>
.LNK OK. [{00021401-0000-0000-C000-000000000046}>
辛苦版主了!
[ 本帖最后由 炼狱修罗 于 2006-7-22 18:51 编辑 >
C:\WINDOWS\system32\quartz32.dll看看这文件的属性，或百度一下！注入这么多进程一定不是什么好东东！到安全模式下用KILLBOX强制删除！然后搜索注册表找相关键值删之
版主,KILLBOX显示无法删除C:\WINDOWS\system32\quartz32.dll文件
为什么呢？
因为注入了很多程序，你可以用冰刃查看模块，结束注入这些进程的“C:\WINDOWS\system32\quartz32.dll”的模块！有被注入的进程请参考SRENG软件扫的日志！或到安全模式下不运行任何程序试试
终于修好了!!!太感谢版主您了!!! |
|
设为首页
加入收藏
联系我们
打印本文 
返回顶部 
加入收藏 
关闭窗口
