求助!哪位大侠给看一下扫描日志文件

xxy701102

卡巴老是提示我发现危险,让我处理,但我处理时,却发现病毒已经全部删除了,但卡巴还是提示我发现危险,请处理,我都不知道该怎么办了.我再问一下扫描中有RVA错误,这是个什么错误,有什么影响吗?该怎么处理?下面是我的扫描日志文件,哪位大侠给看一下:

1. 
   
2. 2007-05-16,10:28:45
   
3. System Repair Engineer 2.4.12.806
   
4. Smallfrogs (http://www.KZTechs.com)
   
5. Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
   
6. 以下内容被选中：
   
7.     所有的启动项目（包括注册表、启动文件夹、服务等）
   
8.     浏览器加载项
   
9.     正在运行的进程（包括进程模块信息）
   
10.     文件关联
    
11.     Winsock 提供者
    
12.     Autorun.inf
    
13.     HOSTS 文件
    
14. 
    
15. 启动项目
    
16. 注册表
    
17. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    
18.     <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
    
19. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    
20.     <ThunderMini><C:\Program Files\Thunder Network\ThunderMini\ThunderMiniShell.exe>  []
    
21.     <AVP><"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe">  [Kaspersky Lab]
    
22. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    
23.     <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
    
24.     <Userinit><C:\WINDOWS\system32\UserInit.exe,>  [(Verified)Microsoft Windows Publisher]
    
25.     <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
    
26. [HKEY_CURRENT_USER\Control Panel\Desktop]
    
27.     <SCRNSAVE.EXE><C:\WINDOWS\system32\BLISS.SCR>  [Microsoft]
    
28. ==================================
    
29. 启动文件夹
    
30. N/A
    
31. ==================================
    
32. 服务
    
33. [Kaspersky Anti-Virus 6.0 / AVP][Running/Auto Start]
    
34.   <"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r><Kaspersky Lab>
    
35. [Human Interface Device Access / HidServ][Stopped/Disabled]
    
36.   <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
    
37. [tjmysql / tjmysql][Running/Auto Start]
    
38.   <D:\hrims_statistic\mysql\bin\mysqld-nt --defaults-file=D:\hrims_statistic\mysql\my.ini tjmysql><N/A>
    
39. [tjtomcat / tjtomcat][Running/Auto Start]
    
40.   <D:\hrims_statistic\tomcat5.0\bin\tomcat5.exe //RS//tjtomcat><Apache Software Foundation>
    
41. ==================================
    
42. 驱动程序
    
43. N/A
    
44. ==================================
    
45. 浏览器加载项
    
46. [ThunderMini Browser Helper]
    
47.   {8E6C1C49-F9CE-4311-9FB4-D70E8B0AEAEB} <C:\Program Files\Thunder Network\ThunderMini\ComDlls\XunLeiMiniBHO_001.dll, Thunder Networking Technologies,LTD>
    
48. [启动迅雷5]
    
49.   {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <e:\xxy2006\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
    
50. [网页]
    
51.   {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll, Kaspersky Lab>
    
52. [Microgarden WebTools]
    
53.   {E929661E-3728-4E52-BCCB-AE4058F75466} <E:\xxy2006\Microgarden WebTools\WebTools.dll, Microgarden LLC>
    
54. [DSO Framer Control Object]
    
55.   {00460182-9E5E-11D5-B7C8-B8269041DD57} <C:\WINDOWS\system32\RiseWord.ocx, 国家信息中心学术委员会软件评测研究中心>
    
56. [RiseSelObj Control]
    
57.   {B53903D5-F777-4A9A-BFC7-63689541257E} <C:\WINDOWS\DOWNLO~1\RISESE~1.OCX, 软件测评研究院>
    
58. [SAXFile FileDownload ActiveX Control]
    
59.   {B82FA17C-F3A9-11D2-B5DD-0050041B7FF6} <C:\WINDOWS\system32\Softartisans\SAXFile\saaxfile.dll, SoftArtisans, Inc. (http://www.softartisans.com)>
    
60. [Shockwave Flash Object]
    
61.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
    
62. [ComponentOne FlexGrid 7.1 (OLEDB)]
    
63.   {D76D712E-4A96-11D3-BD95-D296DC2DD072} <C:\WINDOWS\Downloaded Program Files\vsflex7.ocx, ComponentOne>
    
64. [RiseOfficeCtl Class]
    
65.   {FA80B292-5BF9-4617-975C-01C02BFA49B0} <C:\WINDOWS\system32\RISEOF~1.DLL, 国家信息中心软件评测>
    
66. [ThunderMini Browser Helper]
    
67.   {8E6C1C49-F9CE-4311-9FB4-D70E8B0AEAEB} <C:\Program Files\Thunder Network\ThunderMini\ComDlls\XunLeiMiniBHO_001.dll, Thunder Networking Technologies,LTD>
    
68. [RiseSelObj Control]
    
69.   {B53903D5-F777-4A9A-BFC7-63689541257E} <C:\WINDOWS\DOWNLO~1\RISESE~1.OCX, 软件测评研究院>
    
70. [Shockwave Flash Object]
    
71.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
    
72. [Microgarden WebTools]
    
73.   {E929661E-3728-4E52-BCCB-AE4058F75466} <E:\xxy2006\Microgarden WebTools\WebTools.dll, Microgarden LLC>
    
74. [RiseOfficeCtl Class]
    
75.   {FA80B292-5BF9-4617-975C-01C02BFA49B0} <C:\WINDOWS\system32\RISEOF~1.DLL, 国家信息中心软件评测>
    
76. [&使用迷你迅雷下载]
    
77.   <C:\Program Files\Thunder Network\ThunderMini\Program\GetUrl.htm, N/A>
    
78. [上传到QQ网络硬盘]
    
79.   <E:\myfile\qq\AddToNetDisk.htm, N/A>
    
80. [使用迅雷下载]
    
81.   <e:\xxy2006\Thunder\Program\GetUrl.htm, N/A>
    
82. [使用迅雷下载全部链接]
    
83.   <e:\xxy2006\Thunder\Program\GetAllUrl.htm, N/A>
    
84. [导出到 Microsoft Office Excel(&X)]
    
85.   <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
    
86. ==================================
    
87. 正在运行的进程
    
88. [PID: 636][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    
89. [PID: 716][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    
90. [PID: 740][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    
91.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    
92. [PID: 784][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    
93. [PID: 796][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    
94. [PID: 948][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    
95. [PID: 1012][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    
96. [PID: 1128][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    
97.     [C:\WINDOWS\system32\wups2.dll]  [Microsoft Corporation, 7.0.6000.374 (winmain(wmbla).070416-2057)]
    
98. [PID: 1532][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    
99.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scrchpg.dll]  [Kaspersky Lab, 1.0.6.411]
    
100.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
     
101.     [C:\Program Files\Thunder Network\ThunderMini\ComDlls\XunLeiMiniBHO_001.dll]  [Thunder Networking Technologies,LTD, 2, 0, 0, 1]
     
102. [PID: 1728][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
     
103. [PID: 1824][C:\Program Files\Thunder Network\ThunderMini\program\ThunderMini.exe]  [Thunder Networking Technologies,LTD, 2, 0, 0, 29]
     
104.     [C:\Program Files\Thunder Network\ThunderMini\program\download_interface.dll]  [N/A, ]
     
105.     [C:\Program Files\Thunder Network\ThunderMini\program\UpdateDownload.dll]  [Thunder Networking Technologies,LTD, 1, 0, 1, 6]
     
106.     [C:\Program Files\Thunder Network\ThunderMini\Components\InMedia\iEmbedShell.dll]  [　, 1, 0, 0, 6]
     
107.     [e:\xxy2006\Thunder\Components\InMedia\iEmbed09.dll]  [　, 3, 3, 0, 80]
     
108. [PID: 528][C:\WINDOWS\system32\BRMFRSMG.EXE]  [Brother Industries, Ltd., 1.45.15.340]
     
109.     [C:\WINDOWS\system32\BREVIF.dll]  [Brother Industries, Ltd., 1.45.15.340]
     
110.     [C:\WINDOWS\system32\BrSerIf.DLL]  [Brother Industries, Ltd., 1.45.15.340]
     
111.     [C:\WINDOWS\system32\BrmfLPT.DLL]  [Brother Industries, Ltd., 1.45.15.346]
     
112.     [C:\WINDOWS\system32\BrBiDiIf.DLL]  [Brother Industries, Ltd., 1.45.15.340]
     
113. [PID: 3632][E:\xxy2006\同花顺核新\hexin.exe]  [上海核新软件技术有限公司, 2007, 2, 5, 84]
     
114.     [E:\xxy2006\同花顺核新\RICHED20.dll]  [Microsoft Corporation, 5.30.23.1205]
     
115.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scrchpg.dll]  [Kaspersky Lab, 1.0.6.411]
     
116. [PID: 2128][E:\xxy2006\同花顺核新\GLT.exe]  [上海核新软件技术有限公司, 2006, 10, 9, 1]
     
117.     [E:\xxy2006\同花顺核新\sqlite30.dll]  [上海核新软件技术有限公司, 2005, 5, 12, 0]
     
118.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scrchpg.dll]  [Kaspersky Lab, 1.0.6.411]
     
119.     [E:\xxy2006\同花顺核新\RICHEDTW.DLL]  [Microsoft Corporation, 5.00.2134.1]
     
120.     [E:\xxy2006\同花顺核新\RICHED20.dll]  [Microsoft Corporation, 5.30.23.1205]
     
121. [PID: 524][E:\xxy2006\同花顺核新\LiveUpdate.exe]  [上海核新软件技术有限公司, 2006, 11, 2, 0]
     
122.     [E:\xxy2006\同花顺核新\RICHED20.dll]  [Microsoft Corporation, 5.30.23.1205]
     
123. [PID: 3448][E:\xxy2006\tddownload\sreng2-1\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
     
124. ==================================
     
125. 文件关联
     
126. .TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
     
127. .EXE  OK. ["%1" %*]
     
128. .COM  OK. ["%1" %*]
     
129. .PIF  OK. ["%1" %*]
     
130. .REG  OK. [regedit.exe "%1"]
     
131. .BAT  OK. ["%1" %*]
     
132. .SCR  OK. ["%1" /S]
     
133. .CHM  OK. ["C:\WINDOWS\hh.exe" %1]
     
134. .HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
     
135. .INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
     
136. .INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
     
137. .VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
     
138. .JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
     
139. .LNK  OK. [{00021401-0000-0000-C000-000000000046}]
     
140. ==================================
     
141. Winsock 提供者
     
142. N/A
     
143. ==================================
     
144. Autorun.inf
     
145. N/A
     
146. ==================================
     
147. HOSTS 文件
     
148. 127.0.0.1       localhost
     
149. ==================================
     
150. API HOOK
     
151. RVA  错误： LoadLibraryA (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xF3D4BB25)
     
152. RVA  错误： LoadLibraryExA (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xF3D4BD67)
     
153. RVA  错误： LoadLibraryExW (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xF3D4BF0B)
     
154. RVA  错误： LoadLibraryW (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xF3D4BC49)
     
155. RVA  错误： GetProcAddress (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0xF3D4BE8F)
     
156. ==================================
     
157. 隐藏进程
     
158. N/A
     
159. ==================================
     

复制代码

mds

这几个RVA错误是卡巴HOOK的!没有关系!不必担心!
没看出什么大问题!先用这个清理下!等待wang版细看!

[ 本帖最后由 mds 于 2007-5-16 10:51 编辑 ]

wangjay1980

[tjmysql / tjmysql][Running/Auto Start]
  <D:\hrims_statistic\mysql\bin\mysqld-nt --defaults-file=D:\hrims_statistic\mysql\my.ini tjmysql><N/A>
这个服务删除，删除不了就设置为disabled
安装个防火墙

xxy701102

我清理过了,没发现什么.但卡巴还是提示我已检测到危险,建议我处理,我该怎么办呢?

wangjay1980

安装防火墙，要不老有危险

xxy701102

我装有卡巴6.0.1.411,老大你能告诉我安装什么防火墙好吗?我光装卡巴6能能吗?

zhaonimm

你去防火墙专区看看把 哪的介绍多 你可以先试试  风云防火墙 这个比较简单！
你去论坛防火墙专区研究把 呵呵

xxy701102

老大,我装了风云防火墙了,可它要我掏银子,才能注册,才能自动升级.老大,你有什么办法能让我即不掏银子,又能自动在线升级呢.

Giggs

推荐COMODO.
你的日志好像没有问题

xxy701102

tomcat5.exe是什么文件?每次启动时,防火墙都要询问是否启动?能删除这个文件吗?