|
|
|||||||
| 論壇說明 |
|
歡迎您來到『史萊姆論壇』 ^___^ 您目前正以訪客的身份瀏覽本論壇，訪客所擁有的權限將受到限制，您可以瀏覽本論壇大部份的版區與文章，但您將無法參與任何討論或是使用私人訊息與其他會員交流。若您希望擁有完整的使用權限，請註冊成為我們的一份子，註冊的程序十分簡單、快速，而且最重要的是－－註冊是完全免費的！ 請點擊這裡：『註冊成為我們的一份子！』 |
 |
|
|
主題工具 | 顯示模式 |
2009-02-20, 03:48 PM
|
#1 |
|
註冊會員
|
求助 - 請大家幫我解決一下(病毒?)
-------------------- 閱讀本主題的最佳解答 -------------------- 最近掃了毒，發現幾個檔案，防毒軟體說是木馬?誰能幫我? C:\Documents and Settings\OFC\Local Settings\Temp\cc.exe →Infected: Trojan-Dropper.Win32.Agent.ahjk 1 C:\Documents and Settings\OFC\Local Settings\Temporary Internet Files\Content.IE5\4H6F4TQB\ff[1].rar →Infected: Trojan.Win32.RaMag.a 1 C:\Documents and Settings\OFC\Local Settings\Temporary Internet Files\Content.IE5\71T3IEM9\cc[1].rar →Infected: Trojan.Win32.RaMag.a 1 C:\System Volume Information\_restore{4E0227D...15-5E97E5C4B88D}\RP358\A0116320.dll C:\Program Files\Super Rabbit\magicset\magicset.exe C:\WINDOWS\system32\godert0.dll |
|
送花文章: 56,
|
|
2009-02-20, 03:50 PM
|
#2 (permalink) | |
|
列管會員
 
|
引用:
請先貼出以下log http://forum.slime.com.tw/thread208952.html |
|
|
|
送花文章: 56979,
|
|
向 lutunhsiang 送花的會員:
|
|
2009-02-20, 08:08 PM
|
#3 (permalink) | |
|
註冊會員
|
引用:
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 下午 08:06:46, on 2009/2/20 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\hkcmd.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\AGRSMMSG.exe C:\acer\epm\epm-dm.exe C:\Program Files\Launch Manager\QtZgAcer.EXE C:\Program Files\Acer\eRecovery\Monitor.exe C:\Program Files\McAfee.com\Agent\mcagent.exe C:\WINDOWS\system32\UUToken.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Rainlendar\Rainlendar.exe C:\Acer\eManager\anbmServ.exe C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe C:\Program Files\McAfee\SiteAdvisor\McSACore.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\McAfee\MPF\MPFSrv.exe C:\WINDOWS\system32\oodag.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\drivers\WDelMgr20.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Program Files\Huawei technologies\Mobile Connect\Mobile Connect.exe C:\Program Files\Internet Explorer\iexplore.exe D:\軟體天地\防毒軟體\Ad-Aware SE Professional, Build 1.06r1最新中文免安裝版\Ad-Watch.exe C:\Program Files\NextLink\GOGOBOX\GFSCAgent.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\msiexec.exe c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe D:\軟體天地\清理軟體\hijackthis登錄檔刪除\HijackThis.exe R3 - URLSearchHook: Yahoo!奇摩捷徑列 - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\Jccatch.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll O3 - Toolbar: Dr.eye WebPage Translation - {92B255FE-94E2-4BCA-958D-3926CE38913F} - C:\Program Files\Inventec\Dreye\DreyeMT\DreyeIEBar.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll O3 - Toolbar: Yahoo!奇摩捷徑列 - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll O4 - HKLM\..\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [IgfxTray] ; C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE O4 - HKLM\..\Run: [eRecoveryService] C:\Program Files\Acer\eRecovery\Monitor.exe O4 - HKLM\..\Run: [CJIMETIPSYNC] ; C:\Program Files\Common Files\Microsoft Shared\IME\IMTC65\CHANGJIE\CINTLCFG.EXE /CJIMETIPSync O4 - HKLM\..\Run: [PHIMETIPSYNC] ; C:\Program Files\Common Files\Microsoft Shared\IME\IMTC65\PHONETIC\TINTLCFG.EXE /PHIMETIPSync O4 - HKLM\..\Run: [PHIME2002ASync] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [Network Associates Error Reporting Service] ; "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [QuickTime Task] ; "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iPrint Tray] ; C:\WINDOWS\system32\iprntctl.exe TRAY_ICON O4 - HKLM\..\Run: [iPrint Event Monitor] ; C:\WINDOWS\system32\iprntlgn.exe O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey O4 - HKLM\..\Run: [iStarTracer-2.7] UUToken.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [EPSON Stylus CX5500 Series] ; C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAP.EXE /FU "C:\WINDOWS\TEMP\E_S885.tmp" /EF "HKCU" O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: 使用 FlashGet 下載 - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: 全部使用 FlashGet 下載 - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: 匯出至 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Sun Java 主控台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java 主控台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: 參考資料 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra 'Tools' menuitem: 參考資料 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe O9 - Extra button: D.S.Lite - {F8475519-8412-4D40-A46E-692D9D04DF7F} - D:\軟體天地\續傳軟體\D.S.Lite\DSLite2\DSLite.exe (file missing) O9 - Extra 'Tools' menuitem: D.S.Lite - {F8475519-8412-4D40-A46E-692D9D04DF7F} - D:\軟體天地\續傳軟體\D.S.Lite\DSLite2\DSLite.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\uunsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\uunsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\uunsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\uunsp.dll O15 - Trusted Zone: http://eform.pcsc.com.tw O15 - Trusted Zone: http://my.pcsc.com.tw O15 - Trusted Zone: http://*.mcafee.com O15 - ESC Trusted Zone: http://eform.pcsc.com.tw O15 - ESC Trusted Zone: http://my.pcsc.com.tw O16 - DPF: {00134F72-5284-44F7-95A8-52A619F70751} (ObjWinNTCheck Class) - http://192.168.10.5/officescan/conso...l/WinNTChk.cab O16 - DPF: {0202078E-1F02-4966-8F1C-48BBF31BB7A4} (UUAPP_2.7 Class) - https://sslvpn.pcsc.com.tw/uu200@pcs...uapp/0207/0a13 O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {35C3D91E-401A-4E45-88A5-F3B32CD72DF4} (Encrypt Class) - http://192.168.10.5/officescan/console/html/AtxEnc.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1135234836031 O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://set-711.spaces.live.com/PhotoUpload/MsnPUpld.cab O16 - DPF: {A22B8FD2-4CAA-4EFB-82F7-680CD656D9B0} (NowStarter Control) - http://www.gogobox.com.tw/neo.fld/GNowStarter.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{E8084A83-72F9-4CC1-9662-90A61409A7FE}: NameServer = 168.95.1.1 168.95.192.1 O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe O23 - Service: OracleClientCache80 - Unknown owner - C:\orawin95\BIN\ONRSD80.EXE O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: WDelMgr20 - Unknown owner - C:\WINDOWS\system32\drivers\WDelMgr20.exe -- End of file - 10728 bytes |
|
|
|
送花文章: 56,
|
|
向 大眼蛙來嚕 送花的會員:
|
|
2009-02-21, 10:54 AM
|
#4 (permalink) | |
|
長老會員
 
|
LOG檔看起來還好，下面有一些程式我沒看過，不過用Google搜尋結果，似乎也不是病毒...
UUToken.exe & uunsp.dll & UUAPP_2.7 可能是中國電信杭州分公司遠程流動辦公平台VPN的程序。 http://baike.360.cn/4020285/3200144.html WDelMgr20.exe 可能是 FinalData 的 I/O監控服務。 http://www.codecharge.com.tw/phpBB2/viewtopic.php?p=921&sid=6272b87311485a27e6cac703e012663a ONRSD80.EXE 可能是 Oracle 甲骨文的軟體。 引用:
|
|
|
__________________ 我就是我 |
||
|
|
送花文章: 96,
|
|
2009-02-21, 04:38 PM
|
#5 (permalink) | |
|
註冊會員
|
引用:
http://baike.360.cn/4020285/3200144.html 這個會怎樣?我也沒看過! |
|
|
|
送花文章: 56,
|
|
2009-02-21, 05:31 PM
|
#6 (permalink) | |
|
長老會員
|
引用:
如果連工程師也不知道的話，就把它移除吧～ |
|
|
|
送花文章: 96,
|
|
向 GaMNiA 送花的會員:
|
|
2009-02-21, 05:42 PM
|
#7 (permalink) |
|
長老會員
|
C:\System Volume Information\_restore{4E0227D...15-5E97E5C4B88D}\RP358\A0116320.dll
這在系統還原的備份檔內, 防毒軟體殺不掉...關閉系統還原就行了 C:\Program Files\Super Rabbit\magicset\magicset.exe 應該是誤報 其他的就交給防毒軟體刪除吧 P.S O10 - Unknown file in Winsock LSP: c:\windows\system32\uunsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\uunsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\uunsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\uunsp.dll 這幾項若直接用 HJ 修復可能會造成無法上網, 建議使用專門工具修復 LSPFix http://www.cexx.org/lspfix.htm |
|
__________________ 刑天舞干戚
|
|
|
|
送花文章: 6,
|
|
向 plunderer 送花的會員:
|
|
2009-02-21, 06:00 PM
|
#8 (permalink) | |
|
註冊會員
|
引用:
→Infected: Trojan-Dropper.Win32.Agent.ahjk 1 C:\Documents and Settings\OFC\Local Settings\Temporary Internet Files\Content.IE5\4H6F4TQB\ff[1].rar →Infected: Trojan.Win32.RaMag.a 1 C:\Documents and Settings\OFC\Local Settings\Temporary Internet Files\Content.IE5\71T3IEM9\cc[1].rar →Infected: Trojan.Win32.RaMag.a 1 C:\System Volume Information\_restore{4E0227D...15-5E97E5C4B88D}\RP358\A0116320.dll C:\Program Files\Super Rabbit\magicset\magicset.exe C:\WINDOWS\system32\godert0.dll 大大:那這幾個檔能解釋是啥嗎?有害處嗎? |
|
|
|
送花文章: 56,
|
|
2009-02-21, 07:00 PM
|
#9 (permalink) |
|
長老會員
|
C:\Documents and Settings\OFC\Local Settings\Temp\cc.exe 可能是某程式的生成物, 不清楚有害無害, 但刪掉不會有任何影響 C:\Documents and Settings\OFC\Local Settings\Temporary Internet Files\Content.IE5\4H6F4TQB\ff[1].rar →Infected: Trojan.Win32.RaMag.a 1 C:\Documents and Settings\OFC\Local Settings\Temporary Internet Files\Content.IE5\71T3IEM9\cc[1].rar →Infected: Trojan.Win32.RaMag.a 1 瀏覽某些網頁時所留下的暫存檔....不管有沒有問題, 都可以刪...因為那目錄內都是 "暫存檔" C:\System Volume Information\_restore{4E0227D...15-5E97E5C4B88D}\RP358\A0116320.dll 說過了, 這在系統還原的備份檔內, 防毒軟體殺不掉...關閉系統還原就行了 C:\Program Files\Super Rabbit\magicset\magicset.exe 應該是誤報 |
|
|
送花文章: 6,
|
|
向 plunderer 送花的會員:
|
|
|
|
|
相似的主題
|
||||
| 主題 | 主題作者 | 討論區 | 回覆 | 最後發表 |
| 討論 - 請大家幫我想想辦法~感謝(所得稅問題) | anan6608 | 生活話題、日常閒聊、喇勒唬爛灌水區 | 0 | 2006-05-24 02:09 PM |
| 不好意思.請大家幫我估個價錢好嗎 ? | 我是工匠啦 | 硬體疑難使用問題討論區 | 6 | 2006-02-21 02:35 PM |
| 最近要組一台電腦 請大家幫忙一下 | s751025 | 硬體疑難使用問題討論區 | 21 | 2005-02-03 11:32 PM |
| 請大家幫忙一下在下感激不盡!! | smalltom | 一般電腦疑難討論區 | 2 | 2002-12-25 09:17 PM |
| 有關RAM的小問題....請大家幫忙解決 | 阿部 | 硬體疑難使用問題討論區 | 4 | 2002-12-10 11:22 PM |
平板模式
