总斑竹：我电脑中了灰鸽子，看了你的有关文章也按说明操作了，但没解决问题，现将扫描日记发上来，请帮忙看一下，多谢。
Norton扫描发现但清除隔离为失败。日记如下：
Logfile of HijackThis v1.99.1
Scan saved at 23:31:18, on 2006-6-26
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\LSASS.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\NTdhcp.exe
C:\Herosoft\HeroV8\SysExplr.EXE
C:\Program Files\ChinaNet\VnetClient.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\aaa\LOCALS~1\Temp\Rar$EX00.864\HijackThis.exe
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=userinit.exe,
O1 - Hosts: 61.129.75.124 ert0003.e76.163ns.com
O1 - Hosts: 61.129.75.124
O1 - Hosts: 61.129.75.124
O1 - Hosts: 61.129.75.124 mir.100888290cs.com
O1 - Hosts: 61.129.75.124
O1 - Hosts: 61.129.75.124 woool.100888290cs.com
O3 - Toolbar: 电台(＆R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} - (no file)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [IMJPMIG8.1> ＂C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE＂ /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002A> C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [PHIME2002ASync> C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [SysExplr> C:\Herosoft\HeroV8\SysExplr.EXE
O4 - HKLM\..\Run: [TkBellExe> ＂C:\Program Files\Common Files\Real\Update_OB\realsched.exe＂ -osboot
O4 - HKLM\..\Run: [NTdhcp> C:\WINDOWS\System32\NTdhcp.exe
O4 - HKLM\..\Run: [ToP> C:\WINDOWS\LSASS.exe
O4 - HKCU\..\Run: [ctfmon.exe> C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [ScanRegistry> C:\Program Files\Common Files\update\update.exe
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: 导出到 Microsoft Office Excel(＆X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show ＆Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O17 - HKLM\System\CCS\Services\Tcpip\..\{DE2F158A-A5A3-4338-8D35-95E7A99AF790}: NameServer = 202.96.128.166 202.96.144.47
O23 - Service: DHCPP (DHCP Clientt) - Unknown owner - C:\WINDOWS\lsasss.exe (file missing)
O23 - Service: Media Classic - Unknown owner - C:\WINDOWS\Media Classic.exe (file missing)
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\System32\nvsvc32.exe (file missing)
请给予赐教。
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=userinit.exe,
O1 - Hosts: 61.129.75.124 ert0003.e76.163ns.com
O1 - Hosts: 61.129.75.124
O1 - Hosts: 61.129.75.124
O1 - Hosts: 61.129.75.124 mir.100888290cs.com
O1 - Hosts: 61.129.75.124
O1 - Hosts: 61.129.75.124 woool.100888290cs.com
直接修复
O23 - Service: DHCPP (DHCP Clientt) - Unknown owner - C:\WINDOWS\lsasss.exe (file missing)
O23 - Service: Media Classic - Unknown owner - C:\WINDOWS\Media Classic.exe (file missing)
这些都怀疑鸽子样的dd，关闭服务，删除可能有的文件
如：
C:\WINDOWS\lsasss.dll
C:\WINDOWS\lsassskey.dll
C:\WINDOWS\lsasss.bat
C:\WINDOWS\lsassshook.dll
C:\WINDOWS\Media Classic.dll
C:\WINDOWS\Media Classickey.dll
C:\WINDOWS\Media Classic.bat
C:\WINDOWS\Media Classichook.dll
O4 - HKCU\..\Run: [ScanRegistry> C:\Program Files\Common Files\update\update.exe
修复，强行删除文件
进程中：C:\WINDOWS\System32\NTdhcp.exe
O4 - HKLM\..\Run: [NTdhcp> C:\WINDOWS\System32\NTdhcp.exe
O4 - HKLM\..\Run: [ToP> C:\WINDOWS\LSASS.exe
均是难缠的病毒，建议摆渡一下，到处都有解决方法的。
多谢斑竹，我操作一下。
最后还是没能清除,而且机子不听使唤了,所以用了键恢复.恢复后病毒仍存在于D盘上,用新NORTON清了一下,清后C盘D盘所有文件都不存在了,可能换路径了,后又恢复一遍,再查,病毒没有了.不知什么原因.谢红桃斑主.在清除过程中学了不少东西. |
|
设为首页
加入收藏
联系我们
打印本文 
返回顶部 
加入收藏 
关闭窗口
