收藏本站 |切换到宽版 | 更换论坛皮肤
 找回密码  忘记邮箱  QQ快速登录  快速登录  快速注册

卡饭»论坛 › 安全区 › 原创工具区 › 前几日上腾讯网站卡巴6.0总提示恶意HTTP和木马
返回列表 发新帖
查看: 1977|回复: 1
收起左侧

前几日上腾讯网站卡巴6.0总提示恶意HTTP和木马

[复制链接]
a971222
发表于 2007-7-16 21:09:07 | 显示全部楼层 |阅读模式
重做系统多次，包括G的和重新安装的。在昨天晚上之前，访问腾讯多个网站
包括：my.qq.com kf.qq.com 和财付通时都会有如下提示
也包括点击客户端的小钱包时弹出的网页也会报
已检测到: 木马程序 Trojan-Clicker.JS.Small.c URL: http://bankdev.qpay.qq.com/cgi-bin/analyse/advclick.cgi?PcacheTime=1184508187046&currenturl=http://bank.qq.com//lh_index.shtml
也不知道是被腾讯盯上了。
极度郁闷。大家帮忙看下吧。
--------------------------------------------------------------------------

  2. 2007-07-16,16:45:53
  3. System Repair Engineer 2.5.16.900
  4. Smallfrogs (http://www.KZTechs.com)
  5. Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
  6. 以下内容被选中：
  7.     所有的启动项目（包括注册表、启动文件夹、服务等）
  8.     浏览器加载项
  9.     正在运行的进程（包括进程模块信息）
  10.     文件关联
  11.     Winsock 提供者
  12.     Autorun.inf
  13.     HOSTS 文件
  14.     进程特权扫描

  16. 启动项目
  17. 注册表
  18. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  19.     <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
  20. [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  21.     <load><>  [N/A]
  22. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  23.     <kav><"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe">  [Kaspersky Lab]
  24.     <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Publisher]
  25.     <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows Publisher]
  26.     <Zone Labs Client><C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe>  [(Verified)Check Point Software Technologies Inc.]
  27.     <!AVG Anti-Spyware><"C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized>  [(Verified)GRISOFT LTD]
  28. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  29.     <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
  30.     <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
  31. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  32.     <AppInit_DLLs><>  [N/A]
  33. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  34.     <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
  35. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
  36.     <{57B86673-276A-48B2-BAE7-C6DBB3020EB8}><C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll>  [(Verified)GRISOFT LTD]
  37. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
  38.     <WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll>  [Kaspersky Lab]
  39. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
  40.     <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [N/A]
  41. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
  42.     <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]
  43. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
  44.     <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]
  45. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
  46.     <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
  47. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
  48.     <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
  49. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
  50.     <Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser>  [(Verified)Microsoft Windows Publisher]
  51. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
  52.     <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub>  [(Verified)Microsoft Windows Component Publisher]
  53. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
  54.     <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]
  55. ==================================
  56. 启动文件夹
  57. N/A
  58. ==================================
  59. 服务
  60. [Ati HotKey Poller / Ati HotKey Poller][Stopped/Manual Start]
  61.   <C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
  62. [ATI Smart / ATI Smart][Stopped/Auto Start]
  63.   <C:\WINDOWS\system32\ati2sgag.exe><>
  64. [AVG Anti-Spyware Guard / AVG Anti-Spyware Guard][Running/Auto Start]
  65.   <C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe><GRISOFT s.r.o.>
  66. [卡巴斯基反病毒6.0 / AVP][Running/Auto Start]
  67.   <"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r><Kaspersky Lab>
  68. [Human Interface Device Access / HidServ][Stopped/Disabled]
  69.   <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
  70. [TrueVector Internet Monitor / vsmon][Running/Auto Start]
  71.   <C:\WINDOWS\system32\ZONELABS\vsmon.exe -service><Zone Labs, LLC>
  72. ==================================
  73. 驱动程序
  74. [ati2mtag / ati2mtag][Running/Manual Start]
  75.   <system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
  76. [AVG Anti-Spyware Driver / AVG Anti-Spyware Driver][Running/System Start]
  77.   <\??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys><N/A>
  78. [AVG Anti-Spyware Clean Driver / AvgAsCln][Running/System Start]
  79.   <System32\DRIVERS\AvgAsCln.sys><GRISOFT, s.r.o.>
  80. [Creative SBLive! Gameport / ctljystk][Running/Manual Start]
  81.   <system32\DRIVERS\ctljystk.sys><Creative Technology Ltd.>
  82. [Creative SB Live! (WDM) / emu10k][Running/Manual Start]
  83.   <system32\drivers\emu10k1m.sys><Creative Technology Ltd.>
  84. [Creative Interface Manager Driver (WDM) / emu10k1][Running/Manual Start]
  85.   <system32\drivers\ctlfacem.sys><Creative Technology Ltd.>
  86. [kl1 / kl1][Running/Boot Start]
  87.   <\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
  88. [klif / klif][Running/System Start]
  89.   <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
  90. [npkcrypt / npkcrypt][Stopped/Auto Start]
  91.   <\??\D:\QQ\珊瑚虫\npkcrypt.sys><N/A>
  92. [NVIDIA nForce Networking Controller Driver / NVENETFD][Running/Manual Start]
  93.   <system32\DRIVERS\NVENETFD.sys><NVIDIA Corporation>
  94. [NVIDIA Network Bus Enumerator / nvnetbus][Running/Manual Start]
  95.   <system32\DRIVERS\nvnetbus.sys><NVIDIA Corporation>
  96. [Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  97.   <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
  98. [Secdrv / Secdrv][Stopped/Manual Start]
  99.   <system32\DRIVERS\secdrv.sys><N/A>
  100. [Creative SoundFont Manager Driver (WDM) / sfman][Running/Manual Start]
  101.   <system32\drivers\sfmanm.sys><Creative Technology Ltd.>
  102. [TSP / TSP][Stopped/Manual Start]
  103.   <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
  104. [vsdatant / vsdatant][Running/System Start]
  105.   <System32\vsdatant.sys><Zone Labs, LLC>
  106. [World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
  107.   <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
  108. [VIMICRO USB PC Camera / ZSMC301b][Stopped/Manual Start]
  109.   <System32\Drivers\usbVM31b.sys><VM>
  110. ==================================
  111. 浏览器加载项
  112. [NavigatMon Class]
  113.   {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, >
  114. [Web反病毒保护]
  115.   {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll, Kaspersky Lab>
  116. [Messenger]
  117.   {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
  118. [EditCtrl Class]
  119.   {488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\system32\aliedit\aliedit.dll, >
  120. [CEnroll Class]
  121.   {127698E4-E730-4E5C-A2B1-21490A70C8A1} <C:\WINDOWS\system32\xenroll.dll, Microsoft Corporation>
  122. [iTrusPTA Class]
  123.   {1E0DFFCF-27FF-4574-849B-55007349FEDA} <C:\WINDOWS\system32\aliedit\pta.dll, >
  124. [EditCtrl Class]
  125.   {488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\system32\aliedit\aliedit.dll, >
  126. [WangWangObj Class]
  127.   {6E213FC7-DD5A-4115-B7E6-D4C7838C361E} <D:\淘宝网\WangWang\WangWangX4.dll, 阿里巴巴软件(上海)有限公司>
  128. [SearchAssistantOC]
  129.   {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
  130. [NavigatMon Class]
  131.   {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, >
  132. [AUDIO__MP3 Moniker Class]
  133.   {CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
  134. [Shockwave Flash Object]
  135.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
  136. [使用网际快车下载]
  137.   <F:\FlashGet\jc_link.htm, N/A>
  138. [使用网际快车下载全部链接]
  139.   <F:\FlashGet\jc_all.htm, N/A>
  140. [添加到QQ表情]
  141.   <D:\QQ\珊瑚虫\AddEmotion.htm, N/A>
  142. ==================================
  143. 正在运行的进程
  144. [PID: 428 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  145. [PID: 496 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  146. [PID: 520 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  147.     [C:\WINDOWS\system32\Ati2evxx.dll]  [ATI Technologies Inc., 6.14.10.4112]
  148.     [C:\WINDOWS\system32\klogon.dll]  [Kaspersky Lab, 6.0.0.299]
  149.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  150. [PID: 564 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  151. [PID: 576 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  152. [PID: 724 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  153. [PID: 768 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  154. [PID: 832 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  155.     [C:\WINDOWS\system32\wups2.dll]  [Microsoft Corporation, 7.0.6000.374 (winmain(wmbla).070416-2057)]
  156. [PID: 876 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  157. [PID: 1016 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  158. [PID: 1144 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
  159. [PID: 1512 / qq][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
  160.     [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
  161.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\shellex.dll]  [Kaspersky Lab, 6.0.0.299]
  162.     [C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll]  [GRISOFT s.r.o., 7, 5, 1, 36]
  163.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  164.     [C:\Program Files\360safe\safemon\safemon.dll]  [, 1, 0, 0, 1002]
  165.     [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
  166.     [C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll]  [GRISOFT s.r.o., 7, 5, 1, 36]
  167. [PID: 1612 / qq][C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe]  [GRISOFT s.r.o., 7, 5, 1, 43]
  168.     [C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\engine.dll]  [GRISOFT s.r.o., 4, 2, 0, 19]
  169. [PID: 1620 / qq][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  170. [PID: 2012 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  171. [PID: 156 / qq][C:\WINDOWS\system32\devldr32.exe]  [Creative Technology Ltd., 1, 0, 0, 17]
  172.     [C:\WINDOWS\system32\DEVCON32.DLL]  [Creative Technology Ltd., 4.06.651]
  173.     [C:\WINDOWS\system32\SFMAN32.DLL]  [Creative Technology Ltd., 4.06.501]
  174.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  175. [PID: 176 / LOCAL SERVICE][C:\WINDOWS\system32\wdfmgr.exe]  [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
  176. [PID: 1964 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  177. [PID: 2820 / SYSTEM][C:\WINDOWS\system32\wuauclt.exe]  [Microsoft Corporation, 7.0.6000.374 (winmain(wmbla).070416-2057)]
  178.     [C:\WINDOWS\system32\wups2.dll]  [Microsoft Corporation, 7.0.6000.374 (winmain(wmbla).070416-2057)]
  179. [PID: 2892 / NETWORK SERVICE][C:\WINDOWS\system32\wbem\wmiprvse.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  180. [PID: 3136 / qq][E:\下载专用\sreng2\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
  181.     [E:\下载专用\sreng2\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]
  182. ==================================
  183. 文件关联
  184. .TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
  185. .EXE  OK. ["%1" %*]
  186. .COM  OK. ["%1" %*]
  187. .PIF  OK. ["%1" %*]
  188. .REG  OK. [regedit.exe "%1"]
  189. .BAT  OK. ["%1" %*]
  190. .SCR  OK. ["%1" /S]
  191. .CHM  OK. ["C:\WINDOWS\hh.exe" %1]
  192. .HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
  193. .INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
  194. .INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
  195. .VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
  196. .JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
  197. .LNK  OK. [{00021401-0000-0000-C000-000000000046}]
  198. ==================================
  199. Winsock 提供者
  200. N/A
  201. ==================================
  202. Autorun.inf
  203. N/A
  204. ==================================
  205. HOSTS 文件
  206. 127.0.0.1       localhost
  207. ==================================
  208. 进程特权扫描
  209. N/A
  210. ==================================
  211. API HOOK
  212. RVA  错误： LoadLibraryA (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
  213. RVA  错误： LoadLibraryExA (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
  214. RVA  错误： LoadLibraryExW (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
  215. RVA  错误： LoadLibraryW (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
  216. RVA  错误： GetProcAddress (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
  217. ==================================
  218. 隐藏进程
  219. N/A
  220. ==================================
复制代码
回复

举报

a971222
 楼主| 发表于 2007-7-16 21:23:30 | 显示全部楼层
又出现 了。

已检测到: 木马程序 Trojan-Clicker.JS.Small.c        URL: http://bank.qq.com/lh/lh_list.shtml?3803
回复

举报

返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2024-12-23 20:55 , Processed in 0.127748 second(s), 17 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究，不得将上述内容用于商业或者其他非法用途，否则产生的一切后果自负，本站信息来自网络，版权争议问题与本站无关，您必须在下载后的24小时之内从您的电脑中彻底删除上述信息，如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表