BYR Achieve · 镜像论坛

卡巴斯基的提示：计算机重启后删除: 木马程序 Trojan.Win32.Zapchast.ch 文件: C:\WINDOWS\system32\drivers\cxjiyo21.sys 但就是删不掉，好多天了，我上网搜索，根据网上的提示找了好多杀毒的软件，一直没杀掉它，快疯了。求大侠帮忙救命啊！ Logfile of HijackThis v1.99.1 Scan saved at 19:00:39, on 2006-11-18 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\Rundll32.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\ewido anti-spyware 4.0\ewido.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ctfmon.exe D:\应用程序\杀毒软件\系统扫描\HijackThis.exe D:\Program Files\Tencent\QQ\qq.exe C:\WINDOWS\system32\conime.exe D:\Program Files\Tencent\QQ\TIMPlatform.exe D:\Program Files\Maxthon\Maxthon.exe D:\应用程序\杀毒软件\系统扫描\HijackThis.exe R3 - Default URLSearchHook is missing F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe O1 - Hosts: 125.91.14.230 www.kzdh.com O1 - Hosts: 125.91.14.230 www.7255.com O1 - Hosts: 125.91.14.230 www.7322.com O1 - Hosts: 125.91.14.230 www.7939.com O1 - Hosts: 125.91.14.230 www.piaoxue.com O1 - Hosts: 125.91.14.230 www.feixu.net O1 - Hosts: 125.91.14.230 www.6781.com O1 - Hosts: 125.91.14.230 www.7b.com.cn O1 - Hosts: 125.91.14.230 7b.com.cn O1 - Hosts: 125.91.14.230 www.918188.com O1 - Hosts: 125.91.14.230 hao.allxue.com O1 - Hosts: 125.91.14.230 good.allxue.com O1 - Hosts: 125.91.14.230 baby.allxue.com O1 - Hosts: 125.91.14.230 www.allxue.com O1 - Hosts: 125.91.14.230 about.lank.la O1 - Hosts: 125.91.14.230 www.x114x.com O1 - Hosts: 125.91.14.230 www.37ss.com O1 - Hosts: 125.91.14.230 www.7k.cc O1 - Hosts: 125.91.14.230 www.73ss.com O1 - Hosts: 125.91.14.230 www.hao123.com O1 - Hosts: 125.91.14.230 www.81915.com O1 - Hosts: 125.91.14.230 222.88.90.22 O1 - Hosts: 125.91.14.230 www.9991.com O1 - Hosts: 125.91.14.230 www.my123.com O1 - Hosts: 125.91.14.230 www.haokan123.com O1 - Hosts: 125.91.14.230 www.5566.net O1 - Hosts: 125.91.14.230 www.gjj.cc O1 - Hosts: 125.91.14.230 www.2345.com O1 - Hosts: 125.91.14.230 dl.hao318.com O1 - Hosts: 125.91.14.230 www.123wa.com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - D:\PROGRA~2\FlashGet\jccatch.dll O2 - BHO: 珊瑚虫超级搜索 - {75FE2B5A-D3A4-4EFA-AC11-ADC9C9459688} - C:\PROGRA~1\yok\toolbar.dll O2 - BHO: EyeOnIE - {C14393E1-95FF-4DFF-9BE0-EA008D4EF930} - C:\PROGRA~1\test\BHOPLU~1.DLL O2 - BHO: BDHlprObj Class - {CA92B524-BC8A-4610-BD2C-6BD3E28155D0} - C:\WINDOWS\DOWNLO~1\BDHelper.dll O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - D:\PROGRA~2\FlashGet\getflash.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\PROGRA~2\FlashGet\fgiebar.dll O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [kav] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [yok.exe] C:\PROGRA~1\yok\yok.exe O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\Program Files\Tencent\QQ\AddToNetDisk.htm O8 - Extra context menu item: 使用网际快车下载 - D:\PROGRA~2\FlashGet\jc_link.htm O8 - Extra context menu item: 使用网际快车下载全部链接 - D:\PROGRA~2\FlashGet\jc_all.htm O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Program Files\Tencent\QQ\AddPanel.htm O8 - Extra context menu item: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm O8 - Extra context menu item: 珊瑚虫超级搜索 - C:\PROGRA~1\yok\yoksch.htm O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Program Files\Tencent\QQ\SendMMS.htm O9 - Extra button: Web反病毒保护 - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll O9 - Extra button: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\QQ\QQ.EXE O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\QQ\QQ.EXE O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~2\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~2\FlashGet\flashget.exe O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\QQ\QQIEHelper.dll O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\QQ\QQIEHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll O23 - Service: 卡巴斯基反病毒软件6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing) O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

求助，病毒！