BYR Achieve · 镜像论坛

winXP，依然是经过查杀木马后，发现每次登陆进桌面，均会自动弹出及打开我的文档的文件夹，经过查杀木马后，使用木马克星检测，仍然会弹出警告提示发现木马C:\WINDOWS\system32\iexplorer.exe ，问题是我的iexplorer.exe也不再C:\WINDOWS\system32\iexplorer.exe下面。我的iexplorer在c:\program files\internet explorer下面。 HijackThis_zww汉化版扫描日志 V1.99.1 保存于 22:54:03, 日期 2007-3-15 操作系统： Windows XP SP2 (WinNT 5.01.2600) 浏览器： Unable to get Internet Explorer version! 当前运行的进程： C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Rising\Rav\CCenter.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Rising\Rav\Ravmond.exe C:\WINDOWS\Explorer.EXE c:\program files\rising\rfw\rfwsrv.exe C:\WINDOWS\system32\spoolsv.exe c:\program files\rising\rfw\RfwMain.exe C:\Program Files\Rising\Rav\RavStub.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Apoint\Apoint.exe C:\Program Files\Sony\VAIO Power Management\SPMgr.exe C:\Program Files\Rising\AntiSpyware\runiep.exe C:\Program Files\Rising\Rav\RavTask.exe C:\Program Files\Rising\Rav\Ravmon.exe C:\Program Files\Apoint\Apntex.exe C:\WINDOWS\system32\conime.exe C:\WINDOWS\system32\netevent.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\Rpcsx.exe C:\WINDOWS\system32\Rpcsa.exe C:\WINDOWS\system32\Rpcsh.exe C:\WINDOWS\system32\Rpcy.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\mslogin.exe C:\WINDOWS\system32\svcmost.exe C:\WINDOWS\system32\scvhost.exe C:\Program Files\港湾网络\宽带接入客户端\HammerSupplicant.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Maxthon\maxthon.exe C:\Program Files\Tencent\QQ\QQ.exe C:\Program Files\Tencent\QQ\TIMPlatform.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\HijackThis1991汉化版\HijackThis1991zww.exe R3 - URLSearchHook: 6eab - {DFCB34B6-902D-426E-AE2B-1B294AE19F4F} - C:\WINDOWS\system32\4678ntos.dll F2 - REG:system.ini: UserInit=userinit.exe, O2 - BHO: (no name) - RsAutorunsDisabled - (no file) O2 - BHO: ThunderBHO - {06849E9E-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Thunder\ComDlls\XunLeiBHO_007.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {6bf4c10a-6eab-4678-ae2b-1b294ae19f4f} - C:\WINDOWS\system32\4678ntos.dll O2 - BHO: mslogin linker - {74BC093A-540E-4340-897B-4653A8EB2F47} - C:\WINDOWS\system32\mslink\mslink.dll O2 - BHO: (no name) - {798fc109-07d1-49d0-8b0d-4e03f37a8dbf} - C:\WINDOWS\system32\49d0cfsb.dll O3 - IE工具栏增项: 6eab - {DFCB34B6-902D-426E-AE2B-1B294AE19F4F} - C:\WINDOWS\system32\4678ntos.dll O4 - 启动项HKLM\\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe O4 - 启动项HKLM\\Run: [RTHDCPL] RTHDCPL.EXE O4 - 启动项HKLM\\Run: [Alcmtr] ALCMTR.EXE O4 - 启动项HKLM\\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe O4 - 启动项HKLM\\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - 启动项HKLM\\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe O4 - 启动项HKLM\\Run: [SonyPowerCfg] C:\Program Files\Sony\VAIO Power Management\SPMgr.exe O4 - 启动项HKLM\\Run: [runeip] C:\Program Files\Rising\AntiSpyware\runiep.exe O4 - 启动项HKLM\\Run: [Barsaka] explorer.exe O4 - 启动项HKLM\\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system O4 - 启动项HKLM\\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup O4 - 启动项HKLM\\Run: [StormCodec_Helper] "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti O4 - 启动项HKLM\\RunOnce: [KKDelay] C:\Program Files\Rising\AntiSpyware\RunOnce.exe O4 - Startup: desktop.ini O4 - Startup: 腾讯QQ.lnk = C:\Program Files\Tencent\QQ\QQ.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: desktop.ini O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - IE右键菜单中的新增项目: &使用迅雷下载 - C:\Program Files\Thunder\Program\geturl.htm O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - C:\Program Files\Thunder\Program\getallurl.htm O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm O8 - IE右键菜单中的新增项目: 使用迅雷下载 - C:\Program Files\Thunder\Program\geturl.htm O8 - IE右键菜单中的新增项目: 使用迅雷下载全部链接 - C:\Program Files\Thunder\Program\getallurl.htm O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm O8 - IE右键菜单中的新增项目: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O23 - NT 服务: 1FDBB1C4 - Unknown owner - C:\WINDOWS\system32\1FDBB1C4.EXE (file missing) O23 - NT 服务: 3674CF8 - Unknown owner - C:\WINDOWS\system32\3674CF8.EXE (file missing) O23 - NT 服务: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - NT 服务: Net Event - Unknown owner - C:\WINDOWS\system32\netevent.exe O23 - NT 服务: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - NT 服务: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe O23 - NT 服务: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe O23 - NT 服务: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - NT 服务: Windows Login - Unknown owner - C:\WINDOWS\system32\mslogin.exe

请大家帮我看看这么解决这个问题