[凝逸反毒]黑洞引擎[吞噬](Trojan-Downloader.Win32.Agent.bzd)
------------
使用时QQ不能进行对话，一打开对话框QQ就被关闭了。卡巴斯基扫描后----计算机重启后删除: 木马程序 Trojan-Downloader.Win32.Agent.bzd 文件: C:\WINDOWS\system32\mbjq9jwu6.dll
出现这个，而且重启后依然如此！！！！
请高手帮帮忙！！！！
付： sreng日志
-----
试下:[凝逸反毒]的[黑洞]引擎,
(把木马与注册表值加入【自定吞噬】,就能删除)
1.黑洞吞噬一切启动型病毒
2.吞噬:av终结者.帕虫.随机7/8位病毒,U盘病毒,QQ尾巴,
3.锁定时间.显示文件
方法: 1.点【黑洞】
2.强行关机后,重开机在点次【黑洞】
3.在用杀软扫除病毒
【自定吞噬】
删除难清除木马的文件与注册表目录
【凝逸实验室】-[凝逸反毒]
QQ:503165656
主页:http://hi.baidu.com/503165656
下载:http://groups.google.com/group/503165656/web/nyfd.zip
杀不了,样本发到:503165656@qq.com
[黑洞]引擎的【自定吞噬】说明
http://hi.baidu.com/503165656/blog/item/1420ebfc5637acfffd037f4a.html
(把木马与注册表值加入【自定吞噬】,就能删除)
========木马============
C:\WINDOWS\system32\BLISS.SCR
C:\WINDOWS\system32\klogon.dll
C:\WINDOWS\system32\NvCpl.dll
cmicnfg.cpl
logonui.exe
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXe
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE
c:\windows\system32\bq10\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
%SystemRoot%\System32\hidserv.dll
C:\DOCUME~1\new\LOCALS~1\Temp\Rar$EX00.938\SREng.EXE
===注册表===
(ServiceCopyrebq10)
(NVSvc)
(HidServ)
==================================
启动文件夹
N/A
==================================
C:\WINDOWS\system32\drivers\7yt7rr.sys 可能是
====原记录=======
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows Publisher]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows Publisher]
<Cmaudio><RunDll32 cmicnfg.cpl,CMICtrlWnd> [N/A]
<SoundMan><SOUNDMAN.EXE> [Realtek Semiconductor Corp.]
<kav><"D:\卡巴斯基\avp.exe"> [Kaspersky Lab]
<360Safetray><D:\360safe\safemon\360tray.exe /start> [奇虎网]
<NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Publisher]
<Userinit><C:\Windows\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
<WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll> [Kaspersky Lab]
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><C:\WINDOWS\system32\BLISS.SCR> [Microsoft]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<ClientQyule><; D:\wind\Qyule\Qyule.exe -autostart> [北京锋力信息科技有限公司 京ICP 040460 版权所有 (C) 2004]
==================================
启动文件夹
N/A
==================================
服务
[卡巴斯基反病毒6.0 / AVP][Running/Auto Start]
<D:\卡巴斯基\avp.exe -r><Kaspersky Lab>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
<C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[Volume Shadow Copyrebq10 / ServiceCopyrebq10][Running/Auto Start]
<c:\windows\system32\bq10\svchost.exe><>
==================================
驱动程序
[7yt7rr / 7yt7rr][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\7yt7rr.sys><N/A>
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Stopped/Manual Start]
<system32\drivers\ac97intc.sys><Intel Corporation>
[acpidisk / acpidisk][Running/Boot Start]
<2 - 系统找不到指定的文件。
><N/A>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[AliIde / AliIde][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\aliide.sys><N/A>
[AVG Anti-Spyware Clean Driver / AvgAsCln][Running/System Start]
<System32\DRIVERS\AvgAsCln.sys><GRISOFT, s.r.o.>
[CmdIde / CmdIde][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\cmdide.sys><CMD Technology, Inc.>
[C-Media WDM Audio Interface / cmuda][Stopped/Manual Start]
<system32\drivers\cmuda.sys><C-Media Inc>
[Conexant AccessRunner USB ADSL Adapter Filter Driver / CnxEtP][Stopped/Manual Start]
<system32\DRIVERS\CnxEtP.sys><N/A>
[Conexant AccessRunner USB ADSL Interface Device Driver / CnxEtU][Stopped/Manual Start]
<system32\DRIVERS\CnxEtU.sys><N/A>
[Conexant AccessRunner ADSL WAN PPPoA Adapter Driver / CnxTgNW][Stopped/Manual Start]
<system32\DRIVERS\CnxTgNW.sys><N/A>
[EagleNT / EagleNT][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\EagleNT.sys><N/A>
[edqmv / edqmvw][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\edqmvw.sys><N/A>
[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Stopped/Manual Start]
<system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
[HWiNFO32 Kernel Driver / HWiNFO32][Running/Auto Start]
<\??\C:\Program Files\HWiNFO32\HWiNFO32.SYS><REALiX(tm)>
[kl1 / kl1][Running/Boot Start]
<\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif][Running/System Start]
<\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[MegaIDE / MegaIDE][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\MegaIDE.sys><LSI Logic Corporation.>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\D:\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[nv / nv][Running/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek 10/100/1000 NIC Family all in one NDIS XP Driver / RTL8023xp][Running/Manual Start]
<system32\DRIVERS\Rtlnicxp.sys><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Running/Auto Start]
<system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
[sptd / sptd][Running/Boot Start]
<\SystemRoot\System32\Drivers\sptd.sys><N/A>
[XDva001 / XDva001][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\XDva001.sys><N/A>
[XDva009 / XDva009][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\XDva009.sys><N/A>
[mxdispdr / mxdispdr][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\mxdispdr.sys><N/A>
[2989750 / 2989750][Running/]
<2 - 系统找不到指定的文件。
><N/A> |
[复制链接]
发表于 2007-7-20 11:30:00
楼主