[A917A7]

qiqi00612

不太想讲也差不多搞死我了，所有的法宝差点全出了，
先看我发给卡吧的邮件吧，还不全的，我不会英文只有这样发了。
这东东非常新鲜的我刚刚在一个朋友电脑上用QQ远程控制搞来的，
他会自动删360哦！！！还有一个比360强小小的软件。其它的就不知道了，听说还会删全山的杀软与词霸！？？？
请高手分析一下吧


lmnklmno.dll is virus???? for c:\windows\system32\ ???? 高人帮我看看是不是毒来的？？

svkp.sys for windows\system32\ virus!!!! 这个是360报的

ED6677C5AAD97546215D8545423BF389.dll for C:\Program Files\Tencent\QQ\QQFileCache\ 这个与。BAT是一伙的

delself.bat for c:\program files\tencent\QQ\

a.reg for [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

!!!q.dll  good virus?!??? 可能不是这个，好像还没有找到原头。。。。。。重启后又有了，QQ叫他重装他就装回以前那个，又有一个新的文件生成了。。。。。。
for C:\Program Files\Tencent\QQ \
in
C:\Program Files\Internet Explorer\IEXPLORE.EXE (op)

auto delete:
360Safe.exe
ArSwp.exe

!!hosts   这毒很有个性

127.0.0.1       localhost
61.152.244.167 search.114.vnet.cn
61.152.244.167 114.vnet.cn
61.152.244.167 auto.search.msn.com
61.152.244.167    www.hao123.com
61.152.244.167    hao123.com
61.152.244.167    www.360safe.com
61.152.244.167    360safe.com
222.73.126.115    update.360safe.com
61.152.244.167    dl.360safe.com
61.152.244.167    bbs.360safe.com
61.152.244.167    www.btbaicai.com
61.152.244.167    btbaicai.com
61.152.244.167    www.pctutu.com
61.152.244.167    www.7322.com
61.152.244.167    www.5566.net
61.152.244.167    www.9991.com
61.152.244.167    9991.com
61.152.244.167    forum.ikaka.com
61.152.244.167    www.ikaka.com
222.73.126.115    update.ikaka.com
61.152.244.167    forum.jiangmin.com
222.73.126.115    update.jiangmin.com
61.152.244.167    post.baidu.com
222.73.126.115    update.rising.com.cn
61.152.244.167    online.rising.com.cn
222.73.126.115        center.rising.com.cn   
61.152.244.167    up.duba.net
61.152.244.167    shadu.baidu.com
61.152.244.167    security.symantec.com
61.152.244.167    shadu.duba.net
61.152.244.167    online.jiangmin.com
61.152.244.167    cn.mcafee.com
61.152.244.167    www.ahn.com.cn
61.152.244.167    www.kaspersky.com.cn
61.152.244.167    www.pcav.cn
61.152.244.167    mopery.hits.io
61.152.244.167    www.luosoft.com
61.152.244.167    luosoft.com
61.152.244.167    www.im286.com
61.152.244.167    bbs.htmlman.net
61.152.244.167    10000.286er.com
61.152.244.167    im286.net
61.152.244.167    cool.47555.com
61.152.244.167    ju.qihoo.com
61.152.244.167    bbs.chinaz.com
222.73.126.115 dnl-cn1.kaspersky-labs.com
222.73.126.115 dnl-cn2.kaspersky-labs.com
222.73.126.115 dnl-cn3.kaspersky-labs.com
222.73.126.115 dnl-cn4.kaspersky-labs.com
222.73.126.115 dnl-cn5.kaspersky-labs.com
222.73.126.115 dnl-cn6.kaspersky-labs.com
222.73.126.115 dnl-cn7.kaspersky-labs.com
222.73.126.115 dnl-cn8.kaspersky-labs.com
222.73.126.115 dnl-cn9.kaspersky-labs.com
222.73.126.115 dnl-cn10.kaspersky-labs.com
222.73.126.115 dnl-cn11.kaspersky-labs.com
222.73.126.115 dnl-cn12.kaspersky-labs.com
222.73.126.115 dnl-cn13.kaspersky-labs.com
222.73.126.115 dnl-cn14.kaspersky-labs.com
222.73.126.115 dnl-cn15.kaspersky-labs.com
222.73.126.115    dnl-eu1.kaspersky-labs.com
222.73.126.115   dnl-eu2.kaspersky-labs.com
222.73.126.115    dnl-eu3.kaspersky-labs.com
222.73.126.115    dnl-eu4.kaspersky-labs.com
222.73.126.115    dnl-eu5.kaspersky-labs.com
222.73.126.115    dnl-eu6.kaspersky-labs.com
222.73.126.115    dnl-eu7.kaspersky-labs.com
222.73.126.115    dnl-eu8.kaspersky-labs.com
222.73.126.115    dnl-eu9.kaspersky-labs.com
222.73.126.115    dnl-eu10.kaspersky-labs.com
222.73.126.115    dnl-eu11.kaspersky-labs.com
222.73.126.115    dnl-eu12.kaspersky-labs.com
222.73.126.115    dnl-eu13.kaspersky-labs.com
222.73.126.115    dnl-eu14.kaspersky-labs.com
222.73.126.115    dnl-eu15.kaspersky-labs.com
222.73.126.115    dnl-us1.kaspersky-labs.com
222.73.126.115    dnl-us2.kaspersky-labs.com
222.73.126.115    dnl-us3.kaspersky-labs.com
222.73.126.115    dnl-us4.kaspersky-labs.com
222.73.126.115    dnl-us5.kaspersky-labs.com
222.73.126.115    dnl-us6.kaspersky-labs.com
222.73.126.115    dnl-us7.kaspersky-labs.com
222.73.126.115    dnl-us8.kaspersky-labs.com
222.73.126.115    dnl-us9.kaspersky-labs.com
222.73.126.115    dnl-us10.kaspersky-labs.com
222.73.126.115    dnl-us11.kaspersky-labs.com
222.73.126.115    dnl-us12.kaspersky-labs.com
222.73.126.115    dnl-us13.kaspersky-labs.com
222.73.126.115    dnl-us14.kaspersky-labs.com
222.73.126.115    dnl-us15.kaspersky-labs.com
222.73.126.115    dnl-ru1.kaspersky-labs.com
222.73.126.115    dnl-ru2.kaspersky-labs.com
222.73.126.115    dnl-ru3.kaspersky-labs.com
222.73.126.115    dnl-ru4.kaspersky-labs.com
222.73.126.115    dnl-ru5.kaspersky-labs.com
222.73.126.115    dnl-ru6.kaspersky-labs.com
222.73.126.115    dnl-ru7.kaspersky-labs.com
222.73.126.115    dnl-ru8.kaspersky-labs.com
222.73.126.115    dnl-ru9.kaspersky-labs.com
222.73.126.115    dnl-ru10.kaspersky-labs.com
222.73.126.115    dnl-ru11.kaspersky-labs.com
222.73.126.115    dnl-ru12.kaspersky-labs.com
222.73.126.115    dnl-ru13.kaspersky-labs.com
222.73.126.115    dnl-ru14.kaspersky-labs.com
222.73.126.115    dnl-ru15.kaspersky-labs.com
222.73.126.115    dnl-jp1.kaspersky-labs.com
222.73.126.115    dnl-jp2.kaspersky-labs.com
222.73.126.115   dnl-jp3.kaspersky-labs.com
222.73.126.115    dnl-jp4.kaspersky-labs.com
222.73.126.115   dnl-jp5.kaspersky-labs.com
222.73.126.115   dnl-jp6.kaspersky-labs.com
222.73.126.115   dnl-jp7.kaspersky-labs.com
222.73.126.115   dnl-jp8.kaspersky-labs.com
222.73.126.115   dnl-jp9.kaspersky-labs.com
222.73.126.115   dnl-jp10.kaspersky-labs.com
222.73.126.115   dnl-jp11.kaspersky-labs.com
222.73.126.115   dnl-jp12.kaspersky-labs.com
222.73.126.115   dnl-jp13.kaspersky-labs.com
222.73.126.115   dnl-jp14.kaspersky-labs.com
222.73.126.115   dnl-jp15.kaspersky-labs.com
222.73.126.115    dnl-kr1.kaspersky-labs.com
222.73.126.115   dnl-kr2.kaspersky-labs.com
222.73.126.115   dnl-kr3.kaspersky-labs.com
222.73.126.115    dnl-kr4.kaspersky-labs.com
222.73.126.115    dnl-kr5.kaspersky-labs.com
222.73.126.115    dnl-kr6.kaspersky-labs.com
222.73.126.115    dnl-kr7.kaspersky-labs.com
222.73.126.115    dnl-kr8.kaspersky-labs.com
222.73.126.115    dnl-kr9.kaspersky-labs.com
222.73.126.115    dnl-kr10.kaspersky-labs.com
222.73.126.115    dnl-kr11.kaspersky-labs.com
222.73.126.115    dnl-kr12.kaspersky-labs.com
222.73.126.115    dnl-kr13.kaspersky-labs.com
222.73.126.115    dnl-kr14.kaspersky-labs.com
222.73.126.115    dnl-kr15.kaspersky-labs.com
222.73.126.115 dnl-cd1.kaspersky-labs.com
222.73.126.115 dnl-cd2.kaspersky-labs.com
222.73.126.115 dnl-cd3.kaspersky-labs.com
222.73.126.115 dnl-cd4.kaspersky-labs.com
222.73.126.115 dnl-cd5.kaspersky-labs.com
222.73.126.115 dnl-cd6.kaspersky-labs.com
222.73.126.115 dnl-cd7.kaspersky-labs.com
222.73.126.115 dnl-cd8.kaspersky-labs.com
222.73.126.115 dnl-cd9.kaspersky-labs.com
222.73.126.115 dnl-cd10.kaspersky-labs.com
222.73.126.115 dnl-cd11.kaspersky-labs.com
222.73.126.115 dnl-cd12.kaspersky-labs.com
222.73.126.115 dnl-cd13.kaspersky-labs.com
222.73.126.115 dnl-cd14.kaspersky-labs.com
222.73.126.115 dnl-cd15.kaspersky-labs.com
61.152.244.167    ishare.sina.com.cn
61.152.244.167    www.google.com
61.152.244.167    google.com
61.152.244.167    www.google.cn
61.152.244.167    www.sogou.com
61.152.244.167    www.yahoo.com.cn
61.152.244.167    cn.yahoo.com
222.73.210.148    www.comewz.com
61.152.244.167    www.iask.com
61.152.244.167    iask.com
61.152.244.167    search.tom.com
61.152.244.167    page.so.163.com
61.152.244.167    www.soso.com
61.152.244.167    sou.china.com
61.152.244.167   toolsbar.kuaiso.com
61.152.244.167   www.kuaiso.com
61.152.244.167  m2126.com

qiqi00612
2007-08-09


[ 本帖最后由 promised 于 2007-8-9 11:50 编辑 ]

qiqi00612

还在收集中，还有一个超强的还没到手等下再补上，最强的一个在c:\windows\system32\下的一个叫1.1的文件没收到手。。。这文件保护很强。。。。。。可能在QQ上删不了，要入DOS才可以。。。。现在我把他的权限封了。试试行不行
PS：之所以放那个a.reg文件出来是因为，在毒运行时Autoruns861-YYZ原全查不出来。。。。我看过注册表也看不到。。。是隐了吗？？？请高手回答?
PS:最后更新！！那个1.1的文件找不到了，我想应该是毒运行时生成的，加上我现在是把c:\windows\system32\下的1.1文件的读与写的权限都封了。可能没得生了。。。你们自己看着办吧·看能不能在现在的文件中提出来吧。我也没办法了，太晚了。朋友也得睡啊。
再PS：大家一样事就是我朋友的机用360查是报有100个洞的。。。。 反正就是那种没有开天网的话，机子上就会有好cmd.exe的进程的。。。 一个字强！[:26:]
其实你们想要最新的毒的话你们就找一台机子装了最原装的XP，然后用单一的ADSL拔号上网，挂着！就可以了。[:26:] 什么也不用做，你们也不用什么专业的工具去找了，自动送上门来呢！ [:27:]

[ 本帖最后由 qiqi00612 于 2007-8-9 02:30 编辑 ]

shmily512099

你可以试试安装微点     效果不错的唆！

纯静の水

有密码。。不能解压。。咋杀

qiqi00612

我以前装过，兼容性太差了，装了好多游戏有问题，我才不要，就卡丁车就不可以了

qiqi00612

原帖由 纯静の水 于 2007-8-9 01:44 发表
有密码。。不能解压。。咋杀

晕，标准密码啊！
是：(virus)!!!!!!

qiqi00612

原帖由 shmily512099 于 2007-8-9 01:41 发表
你可以试试安装微点     效果不错的唆！

你用微点试下，有没有反应，这东东其实出了好久的了。我的朋友一直叫我帮他看看，都几个星期了今天晚上才有空。。。好像是他N年前的那个QQ带的吧

qiqi00612

我好久没有上卡饭了。上来就搞个大的！！！！

qiqi00612

高人帮我查一下，lmnklmno.dll is virus???? for c:\windows\system32\ ????

这个文件是不是毒来的？！我删了重启没什么反应

qiqi00612

有人在吗？？？楼上的二个兄弟？？？走了？！