(病毒)Trojan-Downloader.VBS.Psyme.fm大家帮我看看

显示全部楼层 · 发表于 2007-4-3 13:23:48

一上网,开一会网页就卡吧就报警Trojan-Downloader.VBS.Psyme.fm
病毒位置是在E:\Temporary Internet Files\Content.IE5\6HT2VYT4\0[1].htm,删掉重起电脑,一开网页还是老样子弹出来,帮我看看怎么解决,用卡吧和EW,360等清除恶意的软件全盘查又查不出什么病毒,而且网页没有被篡改的迹象

显示全部楼层 · 发表于 2007-4-3 13:36:35

先用冰刃删除试试，不行就扫个报告

显示全部楼层 · 发表于 2007-4-3 14:19:51

我不了解这些

显示全部楼层 · 发表于 2007-4-3 15:50:51

我是新手,怎么扫报告啊,那个病毒卡吧可以删掉,就是重起后一开网站过一会就又弹出来了

显示全部楼层 · 发表于 2007-4-3 15:56:13

这是360扫的报告,有用没?

各位高手：
非常感谢您留心我这份系统诊断报告，小菜鸟十万火急等待您的帮助！
该诊断报告由360安全卫士提供 http://www.360safe.com
诊断时间: 2007-04-03  15:55:10
诊断平台: Microsoft Windows XP  Service Pack 2
IE版本: Internet Explorer V6.0.2900.2180 Build:62900.2180
计算机物理内存:1023MB - 当前可用内存:568MB

100 - 未知 - Process: guard.exe [ewido anti-spyware guard] -
100 - 未知 - Process: ewido.exe [ewido anti-spyware] - C:\Program Files\ewido anti-spyware 4.0\ewido.exe
100 - 未知 - Process: IceSword.exe [] -
O4 - 未知 - HKLM\..\Run: [!ewido] [ewido anti-spyware] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - 未知 - HKLM\..\RunOnce: [KKDelay] [RunOnce Application] C:\Program Files\Rising\KakaToolBar\RunOnce.exe
O8 - 未知 - Extra context menu item: 上传到QQ网络硬盘 - D:\Program Files\tencent\AddToNetDisk.htm
O8 - 未知 - Extra context menu item: 使用脱兔下载 - C:\Program Files\Tuotu\TT_one.htm
O8 - 未知 - Extra context menu item: 使用脱兔下载全部链接 - C:\Program Files\Tuotu\TT_all.htm
O8 - 未知 - Extra context menu item: 添加到QQ自定义面板 - D:\Program Files\tencent\AddPanel.htm
O8 - 未知 - Extra context menu item: 添加到QQ表情 - D:\Program Files\tencent\AddEmotion.htm
O8 - 未知 - Extra context menu item: 用QQ彩信发送该图片 - D:\Program Files\tencent\SendMMS.htm
O9 - 未知 - Extra button: 启动迅雷5(HKLM) - C:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - 未知 - Extra button: 浩方对战平台(HKLM) - E:\Program Files\浩方对战平台\GameClient.exe
O9 - 未知 - Extra button: 番茄花园(HKLM) - http://tomatolei.com
O9 - 未知 - Extra button: 腾讯QQ(HKLM) - D:\Program Files\tencent\QQ.EXE
O9 - 未知 - Extra button: (HKLM) - C:\Program Files\Tuotu\TuoTu.exe
O9 - 未知 - Extra button: &FlashGet(HKLM) - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - 未知 - Extra button: QQ炫彩工具条设置(HKLM) - D:\Program Files\tencent\QQIEHelper.dll
O16 - 未知 - DPF: {05C1004E-2596-48E5-8E26-39362985EEB9} (MMCPlayer) - http://p3p.sogou.com/MMCShell.cab
O22 - 未知 - Filename Extention: .hlp - winhlp32.exe %1
O23 - 未知 - Service: AVP [Kaspersky Anti-Virus provides anti-virus services to applications and performs real-time protection of computer.] - "E:\Downloads\kabasj\Kaspersky\Kav6[1]\Avp.exe -r" - (not running)
O23 - 未知 - Service: Investor [Windows 的文档索引服务，提供高效稳定的快速索引功能。无法终止此服务。] - C:\WINDOWS\System32\svchost.exe -k netsvcs - (not running)
O23 - 未知 - Service: SOCEESe [本地链路保护功能，提供应用程序之间的通讯机制。] - C:\WINDOWS\SYSTEM32\RUNDLL.EXE C:\WINDOWS\SYSTEM32\WBEM\IRJIT.DLL,Export 1087 - (not running)
O23 - 未知 - Service: StyleXPService [StyleXPService] - "C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe" - (not running)

=======================================

100 - 安全 - Process: smss.exe [进程为会话管理子系统用以初始化系统变量，ms-dos驱动名称类似lpt1以及com，调用win32壳子系统和运行在windows登陆过程。] - C:\WINDOWS\System32\smss.exe
100 - 安全 - Process: csrss.exe [客户端服务子系统，用以控制windows图形相关子系统。] - C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=base
100 - 安全 - Process: winlogon.exe [windows nt用户登陆程序。] - C:\WINDOWS\system32\winlogon.exe
100 - 安全 - Process: services.exe [用于管理windows服务系统进程。] - C:\WINDOWS\system32\services.exe
100 - 安全 - Process: lsass.exe [本地安全权限服务控制windows安全机制。] - C:\WINDOWS\system32\lsass.exe
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost -k DcomLaunch
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost -k rpcss
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\System32\svchost.exe -k netsvcs
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost.exe -k NetworkService
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost.exe -k LocalService
100 - 安全 - Process: kavsvc.exe [卡巴斯基出品的反病毒相关程序。] -
100 - 安全 - Process: p2psvr.exe [搜狗下载加速器。] - C:\Program Files\Common Files\Sogou PXP\p2psvr.exe
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost.exe -k imgsvc
100 - 安全 - Process: wdfmgr.exe [windows media player播放器相关程序。] - C:\WINDOWS\system32\wdfmgr.exe
100 - 安全 - Process: explorer.exe [windows program manager或者windows explorer用于控制windows图形shell，包括开始菜单、任务栏，桌面和文件管理。] - C:\WINDOWS\Explorer.EXE
100 - 安全 - Process: kav.exe [] -
100 - 安全 - Process: ctfmon.exe [office xp输入法图标。] - C:\WINDOWS\system32\ctfmon.exe
100 - 安全 - Process: alg.exe [这是一个应用层网关服务用于网络共享。] - C:\WINDOWS\System32\alg.exe
100 - 安全 - Process: Maxthon.exe [傲游maxthon浏览器相关程序的一部分。] - C:\Program Files\Maxthon\Maxthon.exe
100 - 安全 - Process: Thunder5.exe [迅雷5，支持多资源超线程技术的下载工具] - C:\Program Files\Thunder Network\Thunder\Program\Thunder5.exe
100 - 安全 - Process: 360Safe.exe [360安全卫士相关程序。] - C:\Program Files\360safe\360Safe.exe
R1 - 安全 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=about:blank
R1 - 安全 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=about:blank
O2 - 安全 - BHO: (ThunderIEHelper Class) - [迅雷的IE模块。] - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v14.dll
O2 - 安全 - BHO: (AcroIEHlprObj Class) - [Adobe Reader，查看和打印 Adobe 便携文档格式 (PDF) 文件。] - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - 安全 - BHO: (CLDown Object) - [脱兔下载， BT电影下载。] - {0BECAB3A-E1F8-45E6-8332-38DD750EBA01} - C:\Program Files\Tuotu\TuoTuHelper.dll
O2 - 安全 - BHO: (QQBrowserHelperObject Class) - [腾讯QQ的一个插件。] - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\Program Files\tencent\QQIEHelper.dll
O2 - 安全 - BHO: (Thunder Browser Helper) - [迅雷附带下载监视器相关文件。] - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_007.dll
O2 - 安全 - BHO: (IeCatch2 Class) - [网际快车IE模块。] - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FLASHGET\jccatch.dll
O3 - 安全 - Toolbar: (FlashGet Bar) - [FlashGet IE工具条。] - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - 安全 - Toolbar: (卡卡上网安全助手) - [卡卡安全助手工具条软件相关程序。] - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\KakaTool.dll
O4 - 安全 - HKLM\..\Run: [IMJPMIG8.1] [微软Microsoft输入法编辑器程序。] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 安全 - HKLM\..\Run: [PHIME2002ASync] [输入法软件相关程序。] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 安全 - HKLM\..\Run: [PHIME2002A] [输入法软件相关程序。] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 安全 - HKLM\..\Run: [KAVPersonal50] [kaspersky labs公司出品的卡巴斯基反病毒软件的一部分。] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize
O4 - 安全 - HKCU\..\Run: [ctfmon.exe] [office xp输入法图标。] C:\WINDOWS\system32\ctfmon.exe
O8 - 安全 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\geturl.htm
O8 - 安全 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\getallurl.htm
O8 - 安全 - Extra context menu item: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - 安全 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O9 - 安全 - Extra button: Windows Messenger(HKLM) - C:\Program Files\Messenger\msmsgs.exe
O16 - 安全 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Flash播放器) - http://fpdownload.macromedia.com ... s/flash/swflash.cab
O21 - 安全 - Protocol Icons: HKCR\http\shell\open\command - "C:\Program Files\Maxthon\maxthon.exe" "%1"
O21 - 安全 - Protocol Icons: HKCR\ftp\shell\open\command - "C:\Program Files\Maxthon\maxthon.exe" "%1"
O21 - 安全 - Protocol Icons: HKCR\https\shell\open\command - "C:\Program Files\Maxthon\maxthon.exe" "%1"
O21 - 安全 - Protocol Icons: HKCR\htmlfile\shell\open\command - "C:\Program Files\Maxthon\maxthon.exe" "%1"
O23 - 安全 - Service: ewido anti-spyware 4.0 guard [木马专杀工具ewido anti-spyware的相关服务。] - C:\Program Files\ewido anti-spyware 4.0\guard.exe - (running)
O23 - 安全 - Service: kavsvc [卡巴斯基反病毒软件] - "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe" - (running)
O23 - 安全 - Service: NVSvc [是NVIDIA显示卡相关程序。] - C:\WINDOWS\system32\nvsvc32.exe - (not running)
O23 - 安全 - Service: P4P Service [搜狐的搜狗下载加速工具。] - C:\Program Files\Common Files\Sogou PXP\p2psvr.exe - (running)

=======================================

O40 - svchost.exe - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\scrchpg.dll - Kaspersky Anti-Virus Script Checker - 1e3037ec77209463cdc3354d79674d05
O40 - svchost.exe - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\scrch_ag.dll - Script Checker Component - d0afd12c582c2972ec57df071ba2aada
O40 - svchost.exe - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\FSSync.dll - FSSYNC.DLL - 3abb49d259ff276225e8df6afda607d9
O40 - svchost.exe - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\pr_rmt.dll - PR_REMOTE - dadf4f1b8d09e44d856221a36a937372
O40 - svchost.exe - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\ccclient.dll - Kaspersky Anti-Virus CC Client - d3dd0a46a28d00c35cf6ff1632234e6a
O40 - svchost.exe - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\klipc.dll - IPC - 2de36599a7b9e42bfa12d9a7b3f1ebb9
O40 - svchost.exe - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\KLUtil.dll - COMMON CLASSES - e8ea456a8392b5427a56abe94209371f
O40 - svchost.exe - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\rpt.dll - Kaspersky Anti-Virus Report Library - ae1c7e29688c682539110259d2390b24
O40 - svchost.exe - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\CCIFACE.dll - Kaspersky Anti-Virus CC Interface - 8035f49e4e7e67e2d33bfc0fa531bd98
O40 - svchost.exe - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\prloader.dll - Prague Loader - 706e80ef61fafb8b9dda3fb41fb101e8
O40 - svchost.exe - VM - C:\WINDOWS\system32\VM31bSTI.dll - Still Image (STI) Driver - 345e7d466d86526f998367038eddcf29
O40 - Explorer.EXE - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll - ewido anti-spyware guard - ba94ae54d7beeaa8a98bb98c81fd02ed
O40 - Explorer.EXE - Thunder Networking Technologies,LTD - C:\WINDOWS\system32\xunleibho_v14.dll - XunLei BHO - df9effae9491774e861ebc1cc8ac2971
O40 - Explorer.EXE -  - C:\Program Files\Tuotu\TuoTuHelper.dll - TuoTuHelper for IE - 6bb4e3da437a14d8a9c459808dd63ac7
O40 - Explorer.EXE - Thunder Networking Technologies,LTD - C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_007.dll - XunLeiBHO - f86be67dc96656afec3e74784f9546a9
O40 - Explorer.EXE - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\context.dll - Context-Menu (Shell Extension) - 1bb3bd0ef15e385716027bac1eb1b888
O40 - Explorer.EXE - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\shellex.dll - Kasperksy Anti-Virus Shell Extension - 603ea859873ace9bb2d2dadecdb2bf95
O40 - Explorer.EXE - Gabest - C:\WINDOWS\system32\vobsub.dll - vobsub - c4f97e10038edc4e772480b0da11b9d8

=======================================

O41 - d347bus - PnP BIOS Extension - C:\WINDOWS\system32\drivers\d347bus.sys - (running) - PnP BIOS Extension - - 5776322f93cdb91086111f5ffbfda2a0
O41 - d347prt - SCSI miniport - C:\WINDOWS\system32\drivers\d347prt.sys - (running) - SCSI miniport - - b49f79ace459763f4e0380071be9cb45
O41 - ewido anti-spyware 4.0 driver - ewido anti-spyware 4.0 driver - C:\Program Files\ewido anti-spyware 4.0\guard.sys - (running) -  -  - 9b6b54865bd0ec9ed2532dad89554969
O41 - Kl1 - Kaspersky Anti-Hacker Only Driver - C:\WINDOWS\system32\drivers\kl1.sys - (running) - Kaspersky Anti-Hacker Only Driver - Kaspersky Lab - 94b73d5dcb3198728394d0292a2f5bc6
O41 - Klif - spuper-ptor - C:\WINDOWS\system32\drivers\klif.sys - (running) - spuper-ptor - Kaspersky Labs - 959678ca71522fdcdfb1c869f5869ed7
O41 - Klmc - Kaspersky Anti-Virus Mail Checker Proxy - C:\WINDOWS\system32\drivers\klmc.sys - (running) - Kaspersky Anti-Virus Mail Checker Proxy - Kaspersky Lab - 8d864ff1ebcea8e5a38401b2b85f5b31
O41 - npkcrypt - nProtect KeyCrypt Driver - D:\Program Files\tencent\npkcrypt.sys - (running) - nProtect KeyCrypt Driver - INCA Internet Co., Ltd. - 8bcb281a2540e7aff0cd00f9878fe21f
O41 - RsAntiSpyware - RsBoot - C:\WINDOWS\system32\drivers\RsBoot.sys - (running) - RsBoot - Beijing Rising - c79cf8d2f5225a2216fe3b91ceb8b225
O41 - StyleXPHelper - StyleXP - C:\Program Files\TGTSoft\StyleXP\StyleXPHelper.exe - (running) - StyleXP - Windows (R) 2000 DDK provider - 7e40b43922b2896f40a5930af7489c60
O41 - ZSMC301b - Video streaming and Capture Device Driver - C:\WINDOWS\system32\drivers\usbVM31b.sys - (running) - Video streaming and Capture Device Driver - VM - d94d9777e33c70e8489c7e6ce678fd23
O41 - GMSIPCI - GMSIPCI - G:\INSTALL\GMSIPCI.SYS - (not running) -  -  -
O41 - ids00026 - ids00026 - C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids00026.sys - (not running) -  -  -
O41 - ids0005c - ids0005c - C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids0005c.sys - (not running) -  -  -
O41 - klstm - klstm - C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\klstm.sys - (not running) -  -  -
O41 - MSICPL - MSICPL - G:\install4\MSICPL.sys - (not running) -  -  -
O41 - NTACCESS - NTACCESS - G:\NTACCESS.sys - (not running) -  -  -
O41 - nwlnksipx - nwlnksipx - C:\WINDOWS\system32\drivers\nwlnksipx.sys - (not running) -  -  -
O41 - SetupNTGLM7X - SetupNTGLM7X - G:\NTGLM7X.sys - (not running) -  -  -
O41 - TSP - spuper-ptor - C:\WINDOWS\system32\drivers\klif.sys - (not running) - spuper-ptor - Kaspersky Labs - 959678ca71522fdcdfb1c869f5869ed7
O41 - wanusb - wanusb - C:\WINDOWS\system32\DRIVERS\gwausb.sys - (not running) -  -  -

=======================================
360Safe.exe=3.2.1.1001
AntiAdwa.dll=3.2.0.1001
AntiEng.dll=3.0.2.2000
AntiActi.dll=2.0.0.3000
CleanHis.dll=3.0.2.1000
safelive.exe=1.0.0.2007
live.dll=1.0.0.1011

=======================================
操作历史报告：
----------查杀恶意软件历史----------

2006-11-07 17:21
查杀恶意软件 - 实用搜索工具条 - 危险 - C:\PROGRA~1\SUPERT~1\SUPERT~1.DLL

2006-11-07 17:23
查杀恶意软件 - 实用搜索工具条 - 危险 -
2006-11-07 18:12
查杀恶意软件 - 实用搜索工具条 - 危险 -
2006-11-07 19:40
查杀恶意软件 - 实用搜索工具条 - 危险 -
2006-11-10 16:12
查杀恶意软件 - 百度超级搜霸 - 危险 -
查杀恶意软件 - 实用搜索工具条 - 危险 - C:\PROGRA~1\SUPERT~1\SUPERT~1.DLL

2006-11-10 16:13
查杀恶意软件 - 实用搜索工具条 - 危险 -
2006-11-11 00:31
查杀恶意软件 - 实用搜索工具条 - 危险 -
2006-11-11 00:33
查杀恶意软件 - 实用网址导航(酷站导航) - 危险 - C:\WINDOWS\system32\Score.txt
查杀恶意软件 - Dudu下载加速器 - 危险 - C:\Documents and Settings\All Users\Application Data\DuDu

2006-11-24 18:48
查杀恶意软件 - 中搜地址栏搜索 - 危险 -

2006-12-16 22:04
查杀恶意软件 - PPGou桌面媒体 - 危险 - C:\WINDOWS\iun6002.exe

2006-12-24 02:16
查杀恶意软件 - adx广告 - 危险 - C:\WINDOWS\PIF

2007-03-31 00:28
查杀恶意软件 - services - 危险 -

----------插件卸载操作历史----------

2006-10-29 18:54
插件管理 - Yayad - C:\PROGRA~1\Yayad\AdCore.dll
2006-11-10 16:11
插件管理 - 网络猪 -
插件管理 - 划词搜索 -
2007-02-11 16:44
插件管理 - Yayad -

----------全面诊断修复历史----------

2006-11-04 00:38
R0 - 未知 - IE首页 - HKCU\Software\Microsoft\Internet Explorer\Main
2006-11-04 00:44
R0 - 未知 - IE首页 - HKCU\Software\Microsoft\Internet Explorer\Main

----------修复IE浏览器操作历史----------

2006-11-04 00:40
O27 - 危险 - 登录提示框标题 - HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
O27 - 危险 - 登录提示框文字 - HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

=======================================

360安全卫士，彻底查杀各种流氓软件,全面保护系统安全,并赠送正版卡巴斯基V6.0
最新免费下载：http://www.360safe.com

显示全部楼层 · 发表于 2007-4-3 16:12:01

有点烦

看了也没有看出什么来

不好意思了，水平就到这个地方，等高手把

[已解决] (病毒)Trojan-Downloader.VBS.Psyme.fm大家帮我看看