我现在管理软件不能连接上
管理软件是通过IE开的,数据库是SQL SERVER
瑞星查出来Backdoor.IRXBOT.bxo和Trojan.Proxy.Ranky.vb两个病毒
我自己把启动项里的SSCFBTN.EXE删了以及注册表RUN里的SPOOLVS.EXE删了
现在是管理软件开不开
应该怎么解决啊？
下面是用HijackTis在安全模式下查的注册表
Logfile of HijackThis v1.99.1
Scan saved at 8:09:11, on 2006-6-26
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.046\HijackThis.exe
F2 - REG:system.ini: UserInit=userinit.exe,
O3 - Toolbar: 电台(＆R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [IMJPMIG8.1> C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync> C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A> C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [rfw> C:\Program Files\Rising\rfw\Rfw.exe
O4 - HKLM\..\Run: [SoundMAXPnP> C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX> ＂C:\Program Files\Analog Devices\SoundMAX\Smax4.exe＂ /tray
O4 - HKLM\..\Run: [IgfxTray> C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds> C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Century Star PM> C:\Program Files\Hechuan\Century Star PM\pm.exe
O4 - HKLM\..\Run: [NeroCheck> C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KDT> C:\Program Files\快递通\kdtmain.exe
O4 - HKLM\..\Run: [KDTAnywhere> ＂C:\Program Files\快递通\KDTAnywhereS.exe＂ -servicehelper
O4 - HKLM\..\Run: [RavTask> ＂D:\Rising\Rav\RavTask.exe＂ -system
O4 - HKLM\..\Run: [RegNetPass> C:\WINDOWS\System32\regcsp.exe
O4 - HKLM\..\Run: [gemstrmw> C:\WINDOWS\System32\gemstrmw.exe /r
O4 - HKLM\..\Run: [MenuOrder> C:\Program Files\ICBCCO~1\ICBC\Gemplus(Corp)\MenuOrder\MenuOrder.exe
O4 - HKLM\..\Run: [ISUSPM Startup> C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler> ＂C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe＂ -start
O4 - HKLM\..\Run: [GW Port Controller> d:\Samsung\SmarThru\PORTCTRL.EXE
O4 - HKLM\..\Run: [KAVPersonal50> ＂d:\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe＂ /minimize
O4 - HKCU\..\Run: [ctfmon.exe> C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Scktsrvr.exe
O8 - Extra context menu item: ＆使用迅雷下载 - d:\Thunder Network\Thunder\geturl.htm
O8 - Extra context menu item: ＆使用迅雷下载全部链接 - d:\Thunder Network\Thunder\getallurl.htm
O8 - Extra context menu item: 导出到 Microsoft Excel(＆x) - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show ＆Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE (file missing)
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {62B938C4-4190-4F37-8CF0-A92B0A91CC77} (InfoSecNetSign Class) -
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) -
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab
O16 - DPF: {E9707834-5BF7-4CFF-A639-398427DE1991} (IcbcSslCacheCleanerCtrl Class) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{A954CAB0-2F70-447B-B2E7-F19B439C4493}: NameServer = 192.168.0.1
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: iMTS Service (iMTSService) - Unknown owner - D:\Kingdee\imts\iMTSService.exe
O23 - Service: kavsvc - Kaspersky Lab - d:\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe
O23 - Service: KDTAnywhere Server (kdtanywhere) - Unknown owner - C:\Program Files\快递通\KDTAnywhereS.exe＂ -service (file missing)
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\Rising\Rav\Ravmond.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
[ 本帖最后由 coconut_selena 于 2006-6-29 09:30 编辑 >
2006-06-28,09:04:49
System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (
Windows XP Professional (Build 2600)
- 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run>
＜ctfmon.exe＞＜C:\WINDOWS\System32\ctfmon.exe＞ [Microsoft Corporation>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows>
＜load＞＜＞ [>
＜run＞＜＞ [>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run>
＜IMJPMIG8.1＞＜C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32＞ [Microsoft Corporation>
＜PHIME2002ASync＞＜C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC＞ [Microsoft Corporation>
＜PHIME2002A＞＜C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName＞ [Microsoft Corporation>
＜rfw＞＜C:\Program Files\Rising\rfw\Rfw.exe＞ [>
＜SoundMAXPnP＞＜C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe＞ [Analog Devices, Inc.>
＜SoundMAX＞＜＂C:\Program Files\Analog Devices\SoundMAX\Smax4.exe＂ /tray＞ [Analog Devices, Inc.>
＜IgfxTray＞＜C:\WINDOWS\System32\igfxtray.exe＞ [Intel Corporation>
＜HotKeysCmds＞＜C:\WINDOWS\System32\hkcmd.exe＞ [Intel Corporation>
＜Century Star PM＞＜C:\Program Files\Hechuan\Century Star PM\pm.exe＞ [>
＜NeroCheck＞＜C:\WINDOWS\system32\NeroCheck.exe＞ [Ahead Software Gmbh>
＜KDT＞＜C:\Program Files\快递通\kdtmain.exe＞ [深圳畅通伟业科技有限公司>
＜KDTAnywhere＞＜＂C:\Program Files\快递通\KDTAnywhereS.exe＂ -servicehelper＞ [Transtong co., Ltd.>
＜RavTask＞＜＂D:\Rising\Rav\RavTask.exe＂ -system＞ [Beijing Rising Technology Co., Ltd.>
＜RegNetPass＞＜C:\WINDOWS\System32\regcsp.exe＞ [>
＜gemstrmw＞＜C:\WINDOWS\System32\gemstrmw.exe /r＞ [Gemplus>
＜MenuOrder＞＜C:\Program Files\ICBCCO~1\ICBC\Gemplus(Corp)\MenuOrder\MenuOrder.exe＞ [>
＜ISUSPM Startup＞＜C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup＞ [InstallShield Software Corporation>
＜ISUSScheduler＞＜＂C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe＂ -start＞ [InstallShield Software Corporation>
＜GW Port Controller＞＜d:\Samsung\SmarThru\PORTCTRL.EXE＞ [Samsung Electronics Co., Ltd., Samsung Software Center.>
＜KAVPersonal50＞＜＂d:\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe＂ /minimize＞ [Kaspersky Lab>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon>
＜shell＞＜Explorer.exe＞ [Microsoft Corporation>
＜Userinit＞＜userinit.exe,＞ [Microsoft Corporation>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows>
＜AppInit_DLLs＞＜＞ [>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon>
＜UIHost＞＜logonui.exe＞ [Microsoft Corporation>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks>
＜{54D9498B-CF93-414F-8984-8CE7FDE0D391}＞＜d:\ewido\security suite\shellhook.dll＞ [>
==================================
启动文件夹
[Scktsrvr>
＜C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Scktsrvr.exe＞＜N＞
==================================
服务
[ewido security suite control / ewido security suite control>
＜d:\ewido\security suite\ewidoctrl.exe＞＜ewido networks＞
[ewido security suite guard / ewido security suite guard>
＜d:\ewido\security suite\ewidoguard.exe＞＜ewido networks＞
[IMAPI CD-Burning COM Service / ImapiService>
＜C:\WINDOWS\System32\imapi.exe＞＜Microsoft Corporation＞
[iMTS Service / iMTSService>
＜D:\Kingdee\imts\iMTSService.exe＞＜＞
[kavsvc / kavsvc>
＜＂d:\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe＂＞＜Kaspersky Lab＞
[KDTAnywhere Server / kdtanywhere>
＜＂C:\Program Files\快递通\KDTAnywhereS.exe＂ -service＞＜Transtong co., Ltd.＞
[PCTEL Speaker Phone / Pctspk>
＜C:\WINDOWS\system32\pctspk.exe＞＜PCtel, Inc.＞
[Rising Process Communication Center / RsCCenter>
＜＂D:\Rising\Rav\CCenter.exe＂＞＜Beijing Rising Technology Co., Ltd.＞
[RsRavMon Service / RsRavMon>
＜＂D:\Rising\Rav\Ravmond.exe＂＞＜Beijing Rising Technology Co., Ltd.＞
[SoundMAX Agent Service / SoundMAX Agent Service (default)>
＜C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe＞＜Analog Devices, Inc.＞
==================================
浏览器加载项
[@shdoclc.dll,-866>
{c95fe080-8f5d-11d2-a20b-00aa003c157a} ＜, N/A＞
[QQ>
{c95fe080-8f5d-11d2-a20b-00aa003c157b} ＜C:\Program Files\Tencent\QQ\QQ.EXE, N/A＞
[电台(＆R)>
{8E718888-423F-11D2-876E-00A0C9082467} ＜C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation＞
[InfoSecNetSign Class>
{62B938C4-4190-4F37-8CF0-A92B0A91CC77} ＜C:\WINDOWS\System32\NetSign.dll, Infosec Technologies Co., Ltd.＞
[AxInputControl Class>
{73E4740C-08EB-4133-896B-8D0A7C9EE3CD} ＜C:\WINDOWS\System32\INPUTC~1.DLL, ＞
[XML DOM Document 4.0>
{88D969C0-F192-11D4-A65F-0040963251E5} ＜%SystemRoot%\System32\msxml4.dll, N/A＞
[Java Plug-in 1.3.1>
{8AD9C840-044E-11D1-B3E9-00805F499D93} ＜C:\Program Files\JavaSoft\JRE\1.3.1\bin\npjava131.dll, JavaSoft / Sun Microsystems, Inc.＞
[Java Plug-in 1.3.1>
{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA} ＜C:\Program Files\JavaSoft\JRE\1.3.1\bin\npjava131.dll, JavaSoft / Sun Microsystems, Inc.＞
[Shockwave Flash Object>
{D27CDB6E-AE6D-11CF-96B8-444553540000} ＜C:\WINDOWS\System32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.＞
[IcbcSslCacheCleanerCtrl Class>
{E9707834-5BF7-4CFF-A639-398427DE1991} ＜C:\WINDOWS\Downloaded Program Files\IcbcSslCacheCleaner.dll, 中国工商银行＞
[＆使用迅雷下载>
＜d:\Thunder Network\Thunder\geturl.htm, N/A＞
[＆使用迅雷下载全部链接>
＜d:\Thunder Network\Thunder\getallurl.htm, N/A＞
[导出到 Microsoft Excel(＆x)>
＜res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000, N/A＞
[添加到QQ自定义面板>
＜C:\Program Files\Tencent\QQ\AddPanel.htm, N/A＞
[添加到QQ表情>
＜C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A＞
==================================
正在运行的进程
[PID: 164>[\SystemRoot\System32\smss.exe> ＜Microsoft Corporation＞＜5.1.2600.0 (xpclient.010817-1148)＞
[PID: 212>[\？？\C:\WINDOWS\system32\csrss.exe> ＜Microsoft Corporation＞＜5.1.2600.0 (xpclient.010817-1148)＞
[PID: 236>[\？？\C:\WINDOWS\system32\winlogon.exe> ＜Microsoft Corporation＞＜5.1.2600.0 (xpclient.010817-1148)＞
[PID: 280>[C:\WINDOWS\system32\services.exe> ＜Microsoft Corporation＞＜5.1.2600.0 (xpclient.010817-1148)＞
[PID: 292>[C:\WINDOWS\system32\lsass.exe> ＜Microsoft Corporation＞＜5.1.2600.0 (xpclient.010817-1148)＞
[PID: 460>[C:\WINDOWS\system32\svchost.exe> ＜Microsoft Corporation＞＜5.1.2600.0 (xpclient.010817-1148)＞
[PID: 484>[C:\WINDOWS\system32\svchost.exe> ＜Microsoft Corporation＞＜5.1.2600.0 (xpclient.010817-1148)＞
[PID: 700>[C:\WINDOWS\Explorer.EXE> ＜Microsoft Corporation＞＜6.00.2600.0000 (xpclient.010817-1148)＞
[d:\ewido\security suite\shellhook.dll> ＜N/A＞＜N/A＞
[C:\Program Files\WinRAR\rarext.dll> ＜N/A＞＜N/A＞
[C:\WINDOWS\System32\ravext.dll> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 21＞
[d:\ewido\security suite\context.dll> ＜ewido networks＞＜1.0.0.1＞
[d:\ewido\security suite\lang.dll> ＜privat＞＜1, 0, 0, 1＞
[D:\Rising\Rav\RSCOMMON.DLL> ＜Beijing Rising Technology Co., Ltd.＞＜18, 0, 0, 4＞
[d:\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\shellex.dll> ＜Kaspersky Lab＞＜5.0.388.1＞
[C:\WINDOWS\System32\igfxpph.dll> ＜Intel Corporation＞＜3,0,0,2104＞
[C:\WINDOWS\System32\hccutils.DLL> ＜Intel Corporation＞＜3,0,0,2104＞
[C:\WINDOWS\System32\igfxres.dll> ＜Intel Corporation＞＜3,0,0,2104＞
[C:\WINDOWS\System32\igfxsrvc.dll> ＜Intel Corporation＞＜3,0,0,2104＞
[C:\WINDOWS\System32\igfxdev.dll> ＜Intel Corporation＞＜3,0,0,2104＞
[PID: 932>[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.157\SREng2\SREng.exe> ＜Smallfrogs Studio＞＜2.0.21.505＞
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1>
.EXE OK. [＂%1＂ %*>
.COM OK. [＂%1＂ %*>
.PIF OK. [＂%1＂ %*>
.REG OK. [regedit.exe ＂%1＂>
.BAT OK. [＂%1＂ %*>
.SCR OK. [＂%1＂ /S>
.CHM OK. [＂C:\WINDOWS\hh.exe＂ %1>
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1>
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1>
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1>
.VBS OK. [%SystemRoot%\System32\WScript.exe ＂%1＂ %*>
.JS OK. [%SystemRoot%\System32\WScript.exe ＂%1＂ %*>
.LNK OK. [{00021401-0000-0000-C000-000000000046}>
==================================
Winsock 提供者
==================================
System Repair Engineer
启动项里注册表里
有个红的
名字:Userinit 数据:userinit.exe,
键路径:hkey_local_machine\software\microsoft\windows nt\currentversion\winlogon
我也把这个数据改成[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon>
＜Userinit＞＜C:\WINDOWS\system32\userinit.exe,＞
可是现在仍然不能连接管理软件,应该怎么办呢？!~
而且进程里spoolvs.exe以及scvhost.exe占用内存很多的
刚才俺看了半天，三杀软同时上阵？？
＜RegNetPass＞＜C:\WINDOWS\System32\regcsp.exe＞ [>
sreng报告，启动项注册表，hijackthis也有，04 广告软件
我现在瑞星不开
ewido也不开
就开了个卡巴
＜RegNetPass＞＜C:\WINDOWS\System32\regcsp.exe＞ [>
sreng报告，启动项注册表，hijackthis也有，04 广告软件
我不是很理解这句话
原帖由 coconut_selena 于 2006-6-28 15:03 发表
我现在瑞星不开
ewido也不开
就开了个卡巴
＜RegNetPass＞＜C:\WINDOWS\System32\regcsp.exe＞ [>
sreng报告，启动项注册表，hijackthis也有，04 广告软件
我不是很理解这句话
意思就是说2个软件扫描的启动项都包含下面这个进程。
＜RegNetPass＞＜C:\WINDOWS\System32\regcsp.exe＞
是不是这个进程有问题？
该怎么办啊？！~
现在电脑程序开不开……
一开始开开了，过了一会儿就自己关了……
而且速度很慢的……
会是中什么毒或木马呢？！~
先手动修复
＜RegNetPass＞＜C:\WINDOWS\System32\regcsp.exe＞
同时请再次扫描系统日志上来。
这个我搜索过了
是工行的网上银行的东西 |
|
设为首页
加入收藏
联系我们
打印本文 
返回顶部 
加入收藏 
关闭窗口
