我在用IE浏览网页的时候会IE会不定时的自己打开一些网站,用咖啡和木马工具查过系统后没有异常,也用＂全能助手流氓软件杀手＂查过,同样正常.以下是我用HijackThis扫描的日志,请高手帮忙看一下,非常感谢!
Logfile of HijackThis v1.99.1
Scan saved at 13:31:49, on 2006-7-6
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\SCardSvr.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Amaranten\Firewall Logger\FWLogger.exe
C:\WINNT\system32\hidserv.exe
C:\WINNT\System32\llssrv.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Program Files\ngsrv\ngslotd.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINNT\system32\vmnat.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\system32\inetsrv\inetinfo.exe
C:\WINNT\system32\msdtc.exe
C:\WINNT\system32\vmnetdhcp.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\SOUNDMAN.EXE
C:\WINNT\AGRSMMSG.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Amaranten\Firewall Manager 8\fwm.exe
C:\WINNT\system32\mstsc.exe
C:\Program Files\Sinfor\DlanSSL Gateway client\CtrlClient.exe
C:\Program Files\Sinfor\DlanSSL Gateway client\logv.exe
C:\WINNT\regedit.exe
C:\WINNT\system32\conime.exe
C:\WINNT\explorer.exe
E:\防火墙\木马杀客\mmsk.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
E:\软件夹\ha_hijackthis_1991\HijackThis.exe
O2 - BH SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BH CpapView Class - {77962960-536E-47EC-9DDB-52651519705F} - C:\WINNT\system32\Rundll32.dll
O4 - HKLM\..\Run: [IgfxTray> C:\WINNT\system32\igfxtray.exe
O4 - HKLM\..\Run: [SoundMan> SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG> AGRSMMSG.exe
O4 - HKLM\..\Run: [ShStatEXE> ＂C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE＂ /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI> ＂C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe＂ /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service> ＂C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe＂
O4 - HKLM\..\Run: [D-Link AirPlus G> C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [FwCtrlRun> ;C:\Program Files\Sinfor\NG Firewall\NGCtrl.exe
O4 - HKCU\..\Run: [ctfmon.exe> ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java 控制台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{AE375E2A-E946-4A5E-8FF5-AA93F4B8832A}: NameServer = 202.96.209.133,202.96.209.6
O17 - HKLM\System\CCS\Services\Tcpip\..\{B1DE2A58-103E-40DF-A9C5-224F0872E4CC}: NameServer = 202.96.209.6,202.96.209.133
O17 - HKLM\System\CCS\Services\Tcpip\..\{F274083D-6A0D-42F3-AB54-2C085E36A592}: NameServer = 202.96.209.5,202.96.209.6
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O21 - SSODL: Vision - {6671A431-5C3D-463d-A7CF-5587F9B7E191} - (no file)
O21 - SSODL: stdup - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - (no file)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Clavister Firewall Logger (FWLogger) - Clavister AB - C:\Program Files\Amaranten\Firewall Logger\FWLogger.exe
O23 - Service: McAfee Framework 服务 (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe＂ -sSQLEXPRESS (file missing)
O23 - Service: ngSlotDaemon (ngSlotD) - ^_^ - C:\Program Files\ngsrv\ngslotd.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINNT\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINNT\system32\vmnat.exe
修复
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java 控制台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O21 - SSODL: Vision - {6671A431-5C3D-463d-A7CF-5587F9B7E191} - (no file)
O21 - SSODL: stdup - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - (no file)
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe＂ -sSQLEXPRESS (file missing)
O23 - Service: ngSlotDaemon (ngSlotD) - ^_^ - C:\Program Files\ngsrv\ngslotd.exe
以上项目已修复过.但仍然会跳出页面
中木马了！！建议楼主可以用兔子清除！！！
原帖由 baby1221 于 2006-7-7 11:22 发表
以上项目已修复过.但仍然会跳出页面
换SRENG软件扫
我的机器发生同样的情况啊！
用兔子也无法修复啊！ |
|
设为首页
加入收藏
联系我们
打印本文 
返回顶部 
加入收藏 
关闭窗口
