求助、中了木马。。。卡巴。360干不掉

显示全部楼层 · 发表于 2007-9-8 12:15:05

[CODE]
2007-09-08,15:45:42
System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
<QQDownload><; "D:\QQDownload\QQDownload.exe" autostart>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<nod32kui><"C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE>  [Eset ]
<SoundMan><; SOUNDMAN.EXE>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<switch><; c:\windows\system32\壁纸自动换.exe>  []
<VTTimer><; VTTimer.exe>  [S3 Graphics, Inc.]
<VTTrayp><; VTtrayp.exe>  [S3 Graphics Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe>  [(Verified)Microsoft Windows Component Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
<UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
<WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll>  [(Verified)Kaspersky Lab]
==================================
启动文件夹
[服务管理器]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\服务管理器.lnk --> C:\PROGRA~1\MICROS~4\80\Tools\Binn\sqlmangr.exe [Microsoft Corporation]><N>
==================================
服务
[Kaspersky Internet Security 7.0 / AVP][Stopped/Manual Start]
  <"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" -r><Kaspersky Lab>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[MSSQLSERVER / MSSQLSERVER][Running/Auto Start]
  <C:\PROGRA~1\MICROS~4\MSSQL\binn\sqlservr.exe><Microsoft Corporation>
[MSSQLServerADHelper / MSSQLServerADHelper][Stopped/Manual Start]
  <C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe><Microsoft Corporation>
[NOD32 Kernel Service / NOD32krn][Running/Auto Start]
  <"C:\Program Files\Eset\nod32krn.exe"><Eset>
[SQLSERVERAGENT / SQLSERVERAGENT][Stopped/Manual Start]
  <C:\PROGRA~1\MICROS~4\MSSQL\binn\sqlagent.exe><Microsoft Corporation>
[Tong备份服务 / TongBackupSrv][Running/Auto Start]
  <C:\WINDOWS\system32\TongBackupSrv.exe><N/A>
[用友通 / UFNet][Running/Auto Start]
  <C:\WINDOWS\system32\ServerNT.exe><ufida>
[WinMTSrv / WinMTSrv][Running/Auto Start]
  <C:\WINDOWS\system32\WinMTSrv.exe><WinMount International Inc.>
==================================
驱动程序
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Stopped/Manual Start]
  <system32\drivers\ac97intc.sys><Intel Corporation>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[AliIde / AliIde][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\aliide.sys><Acer Laboratories Inc.>
[AMD K8 Processor Driver / AmdK8][Stopped/Manual Start]
  <System32\DRIVERS\amdk8.sys><Advanced Micro Devices>
[AMON / AMON][Running/Auto Start]
  <\SystemRoot\system32\drivers\amon.sys><Eset>
[CmdIde / CmdIde][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\cmdide.sys><CMD Technology, Inc.>
[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Stopped/Manual Start]
  <system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
[kl1 / kl1][Running/Boot Start]
  <\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif][Running/System Start]
  <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[Kaspersky Anti-Virus NDIS Filter / klim5][Running/Manual Start]
  <system32\DRIVERS\klim5.sys><Kaspersky Lab>
[nod32drv / nod32drv][Running/System Start]
  <\SystemRoot\system32\drivers\nod32drv.sys><N/A>
[npkcrypt / npkcrypt][Stopped/Auto Start]
  <\??\D:\QQ2007\npkcrypt.sys><N/A>
[nv / nv][Stopped/Manual Start]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek 10/100/1000 PCI NIC Family NDIS XP Driver / RTL8023xp][Running/Manual Start]
  <system32\DRIVERS\Rtnicxp.sys><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[Sense3 / Sense3][Running/Auto Start]
  <System32\Drivers\sense3.sys><Beijing Senselock>
[Senselock SenseIV v2.x Service / sense4v2][Running/Manual Start]
  <System32\Drivers\sense4v2.sys><Beijing Senselock Corp.>
[Sentinel / Sentinel][Running/Auto Start]
  <\SystemRoot\System32\Drivers\SENTINEL.SYS><>
[Superk53 / Superk53][Running/Auto Start]
  <\SystemRoot\System32\drivers\superk53.sys><Microsoft Corporation>
[VIA AGP Filter / viaagp1][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\viaagp1.sys><VIA Technologies, Inc.>
[viagfx / viagfx][Running/Manual Start]
  <system32\DRIVERS\vtmini.sys><Copyright (C) VIA/S3 Graphics Co, Ltd.>
[ViaIde / ViaIde][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\viaide.sys><Microsoft Corporation>
[VIAMRAID / VIAMRAID][Stopped/Boot Start]
  <\SystemRoot\system32\DRIVERS\viamraid.sys><VIA Technologies inc,.ltd>
[WinMount Bus / WinMTBus][Running/Manual Start]
  <system32\DRIVERS\WinMTBus.sys><WinMount International Inc.>
[450000 / 450000][Running/Manual Start]
  <2 - 系统找不到指定的文件。
><N/A>
==================================
浏览器加载项
[Flashget Catch Url Class]
  {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <C:\Program Files\FlashGet\jccatch.dll, www.flashget.com>
[Windows Live Sign-in Helper]
  {9030D464-4C02-4ABF-8ECC-5164760863C6} <C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll, Microsoft Corporation>
[NavigatMon Class]
  {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, >
[网络反病毒统计]
  {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll, Kaspersky Lab>
[ATGrid报表控件/WEB报表插件]
  {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <http://www.etcell.com/, N/A>
[InfosecCertInstall Class]
  {0EB487C8-E9AC-43A6-8C4C-083999B0622F} <C:\WINDOWS\Downloaded Program Files\certInStall.dll, >
[MeadCo ScriptX]
  {1663ed61-23eb-11d2-b92f-008048fdd814} <C:\WINDOWS\system32\MCScripX.dll, Mead & Co Limited>
[iTrusPTA Class]
  {1E0DFFCF-27FF-4574-849B-55007349FEDA} <C:\WINDOWS\system32\aliedit\pta.dll, >
[Windows Live Photo Upload Control]
  {7FC1B346-83E6-4774-8D20-1A6B09B0E737} <C:\WINDOWS\Downloaded Program Files\MsnPUpld.dll, Microsoft? Corporation>
[XML DOM Document 4.0]
  {88D969C0-F192-11D4-A65F-0040963251E5} <C:\WINDOWS\system32\msxml4.dll, Microsoft Corporation>
[AxSubmitControl Class]
  {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} <C:\WINDOWS\DOWNLO~1\SUBMIT~1.DLL, >
[DNPrinter Class]
  {9CDE204E-0CC2-11D6-9011-00E09873B6BB} <C:\WINDOWS\Downloaded Program Files\DNPrinter.dll, 杭州数新软件技术有限公司>
[CSetLET Class]
  {C35D7AE1-0865-4A30-BF07-29FA29324155} <C:\WINDOWS\DOWNLO~1\GDSetLET.dll, >
[ATGrid Class]
  {D0CB6A0C-E656-4BF4-BD2D-6AE5EC183D7C} <C:\WINDOWS\system32\ATGrid.dll, >
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9d.ocx, Adobe Systems, Inc.>
[EWA Control]
  {18226BF8-DC0B-4D81-80E9-A41AE37BB73A} <C:\PROGRA~1\PPLive\SYNACA~2.OCX, Synacast>
[DHTML Edit Control Safe for Scripting for IE5]
  {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[Flashget Catch Url Class]
  {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <C:\Program Files\FlashGet\jccatch.dll, www.flashget.com>
[360SafeLive]
  {87515F61-A66C-4319-A0E0-D416CB8059E3} <C:\Program Files\360safe\live.dll, 360safe.com>
[Windows Live Sign-in Helper]
  {9030D464-4C02-4ABF-8ECC-5164760863C6} <C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll, Microsoft Corporation>
[SearchAssistantOC]
  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[NavigatMon Class]
  {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, >
[RDS.DataSpace]
  {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9d.ocx, Adobe Systems, Inc.>
[JetCarNetscape Class]
  {FB5DA724-162B-11D3-8B9B-AA70B4B0B524} <C:\Program Files\FlashGet\jccatch.dll, www.flashget.com>
[&使用快车(FlashGet)下载]
  <C:\Program Files\FlashGet\jc_link.htm, N/A>
[&使用快车(FlashGet)下载全部链接]
  <C:\Program Files\FlashGet\jc_all.htm, N/A>
[使用迅雷下载]
  <C:\Program Files\Thunder\Program\geturl.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
  <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>

[ 本帖最后由 fwreal 于 2007-9-9 09:07 编辑 ]

显示全部楼层 · 发表于 2007-9-8 12:15:44

用SREng扫个报告贴上来

显示全部楼层 · 发表于 2007-9-8 12:18:34

什么是SRENG啊。。不懂。。我现在扫了。。没东西啊
==================================
正在运行的进程
[PID: 752][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 824][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 848][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.0.125]
[C:\WINDOWS\system32\klogon.dll]  [Kaspersky Lab, 7.0.0.125]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\adialhk.dll]  [Kaspersky Lab, 7.0.0.125]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1048][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234)]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.0.125]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\scrchpg.dll]  [Kaspersky Lab, 7.0.0.125]
[C:\WINDOWS\system32\WPDShServiceObj.dll]  [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\WINDOWS\system32\PortableDeviceTypes.dll]  [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\WINDOWS\system32\PortableDeviceApi.dll]  [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
[C:\Program Files\WinMount\WinMTRar.dll]  [WinMount International Inc., 1, 1, 0, 1]
[C:\WINDOWS\system32\unrar.dll]  [N/A, ]
[C:\Program Files\WinMount\WinMTExt.dll]  [, 1, 6, 3, 1]
[C:\Program Files\WinMount\WinMTCom.dll]  [, 1, 6, 3, 1]
[C:\Program Files\Eset\nodshex.dll]  [N/A, ]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ShellEx.dll]  [Kaspersky Lab, 7.0.0.125]
[C:\Program Files\MSN Messenger\fsshext.8.1.0178.00.dll]  [Microsoft Corporation, 8.1.0178.00]
[C:\WINDOWS\system32\wpdshext.dll]  [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\WINDOWS\system32\Audiodev.dll]  [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[PID: 1940][C:\Program Files\Eset\nod32kui.exe]  [Eset , 2, 70, 39 ]
[C:\Program Files\Eset\nod32rui.dll]  [N/A, ]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.0.125]
[C:\Program Files\Eset\pu_amon.dll]  [Eset , 2, 70, 39 ]
[C:\Program Files\Eset\pr_amon.dll]  [Eset , 2, 70, 16 ]
[C:\Program Files\Eset\pu_dmon.dll]  [Eset , 2, 70, 39 ]
[C:\Program Files\Eset\pr_dmon.dll]  [N/A, ]
[C:\Program Files\Eset\pu_emon.dll]  [Eset , 2, 70, 39 ]
[C:\Program Files\Eset\pr_emon.dll]  [N/A, ]
[C:\Program Files\Eset\pu_imon.dll]  [Eset , 2, 70, 39 ]
[C:\Program Files\Eset\pr_imon.dll]  [N/A, ]
[C:\Program Files\Eset\pu_nod32.dll]  [Eset , 2, 70, 39 ]
[C:\Program Files\Eset\pr_nod32.dll]  [Eset , 2, 70, 16 ]
[C:\Program Files\Eset\pu_upd.dll]  [Eset , 2, 70, 39 ]
[C:\Program Files\Eset\pr_upd.dll]  [N/A, ]
[PID: 1960][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2020][C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe]  [Microsoft Corporation, 2000.080.0194.00]
[C:\Program Files\Microsoft SQL Server\80\Tools\Binn\W95SCM.dll]  [Microsoft Corporation, 2000.080.0194.00]
[C:\Program Files\Microsoft SQL Server\80\Tools\Binn\SQLSVC.dll]  [Microsoft Corporation, 2000.080.0194.00]
[C:\WINDOWS\system32\odbcbcp.dll]  [Microsoft Corporation, 2000.085.1117.00 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Microsoft SQL Server\80\Tools\Binn\SQLRESLD.dll]  [Microsoft Corporation, 2000.080.0194.00]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.0.125]
[C:\Program Files\Microsoft SQL Server\80\Tools\Binn\Resources\2052\SQLSVC.RLL]  [Microsoft Corporation, 2000.080.0194.00]
[C:\Program Files\Microsoft SQL Server\80\Tools\Binn\Resources\2052\sqlmangr.RLL]  [Microsoft Corporation, 2000.080.0194.00]
[C:\WINDOWS\system32\imon.dll]  [Eset , 2, 70, 39 ]
[C:\Program Files\Eset\pr_imon.dll]  [N/A, ]
[PID: 1004][C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe]  [Microsoft Corporation, 4.100.313.1]
[C:\Program Files\Common Files\Microsoft Shared\Windows Live\msidcrl40.dll]  [Microsoft Corporation, 4.100.313.1]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.0.125]
[PID: 1660][D:\Program Files\Tencent\QQ\QQ.exe]  [TENCENT, 7,0,313,1681]
[D:\Program Files\Tencent\QQ\CoralAssist.dll]  [Coral Team, 5.0.0 build 20060829]
[D:\Program Files\Tencent\QQ\CoralQQ.dll]  [Coral Team, 5.0.1a Build 20070620]
[D:\Program Files\Tencent\QQ\kql.dll]  [Coral Team, 5.0.1a build 20070620]
[D:\Program Files\Tencent\QQ\mfc42.dll]  [Microsoft Corporation, 6.00.8665.0]
[D:\Program Files\Tencent\QQ\ipsearcher.dll]  [, 1.0.0.5]
[D:\Program Files\Tencent\QQ\QQBaseClassInDll.dll]  [TENCENT, 7,0,313,1681]
[D:\Program Files\Tencent\QQ\QQHelperDll.dll]  [TENCENT, 7,0,313,1681]
[D:\Program Files\Tencent\QQ\BasicCtrlDll.dll]  [TENCENT, 7, 0, 225, 1651]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.0.125]
[D:\Program Files\Tencent\QQ\NoDisturbFilter.cqx]  [Coral Team, 1.0]
[D:\Program Files\Tencent\QQ\ConfigHotkey.cqx]  [Coral Team, 1.0]
[D:\Program Files\Tencent\QQ\RICHED32.DLL]  [Microsoft Corporation, 5.00.2134.1]
[D:\Program Files\Tencent\QQ\RICHED20.dll]  [Microsoft Corporation, 5.31.23.1218]
[D:\Program Files\Tencent\QQ\QQAPI.dll]  [TENCENT, 7,0,313,1681]
[d:\Program Files\Tencent\QQ\TIMProxy.dll]  [tencent, 0, 3, 2, 4]
[D:\Program Files\Tencent\QQ\AutoReconnect.cqx]  [Coral Team, 1.0.0]
[D:\Program Files\Tencent\QQ\LoginCtrl.dll]  [TENCENT, 7,0,313,1681]
[D:\Program Files\Tencent\QQ\LoginCtrlRes.dll]  [TENCENT, 7,0,313,1681]
[D:\Program Files\Tencent\QQ\QQRes.dll]  [TENCENT, 7,0,313,1681]
[D:\Program Files\Tencent\QQ\MailSummary.dll]  [TENCENT, 7,0,313,1681]
[D:\Program Files\Tencent\QQ\QQMainFrame.dll]  [N/A, ]
[D:\Program Files\Tencent\QQ\gdiplus.dll]  [Microsoft Corporation, 5.1.3102.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\Program Files\Tencent\QQ\CQQApplication.dll]  [N/A, ]
[D:\Program Files\Tencent\QQ\FlashAvatarDll.dll]  [, 1, 4, 0, 1]
[D:\Program Files\Tencent\QQ\NewSkin.dll]  [TENCENT, 7,0,313,1681]
[D:\Program Files\Tencent\QQ\HostingMgr.dll]  [TENCENT, 7,0,313,1681]
[D:\Program Files\Tencent\QQ\CameraDll.dll]  [TENCENT, 7,0,313,1681]
[D:\Program Files\Tencent\QQ\CoralHotkey.cqx]  [Coral Team, 1.0]
[D:\Program Files\Tencent\QQ\QQKnowledgeSearch.dll]  [TENCENT, 7,0,313,1681]
[C:\WINDOWS\system32\imon.dll]  [Eset , 2, 70, 39 ]
[C:\Program Files\Eset\pr_imon.dll]  [N/A, ]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll]  [Kaspersky Lab, 7.0.0.125]
[D:\Program Files\Tencent\QQ\QQAllInOne.dll]  [TENCENT, 7,0,313,1681]
[D:\Program Files\Tencent\QQ\SCCore.dll]  [TENCENT, 1, 6, 0, 2]
[D:\Program Files\Tencent\QQ\QQSpace.dll]  [TENCENT, 7,0,313,1681]
[D:\Program Files\Tencent\QQ\vbscript.dll]  [Microsoft Corporation, 5.6.0.7426]
[C:\WINDOWS\system32\msdmo.dll]  [, ]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\adialhk.dll]  [Kaspersky Lab, 7.0.0.125]
[D:\Program Files\Tencent\QQ\QQGroupMng.dll]  [TENCENT, 7,0,313,1681]
[D:\Program Files\Tencent\QQ\QQSysMsgMng.dll]  [N/A, ]
[D:\Program Files\Tencent\QQ\UserDefinedHead.dll]  [TENCENT, 7,0,313,1681]
[D:\Program Files\Tencent\QQ\QQPlugin.dll]  [N/A, ]
[D:\Program Files\Tencent\QQ\QQConfigPlugin.dll]  [TENCENT, 7,0,313,1681]
[D:\Program Files\Tencent\QQ\QQAvatar.dll]  [N/A, ]
[D:\Program Files\Tencent\QQ\LongConnection.dll]  [TENCENT, 7,0,313,1681]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\scrchpg.dll]  [Kaspersky Lab, 7.0.0.125]
[D:\Program Files\Tencent\QQ\QRingMng.dll]  [N/A, ]
[D:\Program Files\Tencent\QQ\PhoneAPI.dll]  [TENCENT, 7,0,313,1681]
[D:\Program Files\Tencent\QQ\DialerAllinOne.dll]  [tencent, 1, 4, 0, 0]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[D:\Program Files\Tencent\QQ\QQPet.dll]  [TENCENT, 7,0,313,1681]
[D:\Program Files\Tencent\QQ\BQQApplication.dll]  [N/A, ]
[D:\Program Files\Tencent\QQ\PersonalDesktop.dll]  [TENCENT, 7,0,313,1681]
[D:\Program Files\Tencent\QQ\CommercesMng.dll]  [TENCENT, 7,0,313,1681]
[D:\Program Files\Tencent\QQ\QQAddr.dll]  [深圳市腾讯计算机系统有限公司, 5, 0, 101, 310]
[D:\Program Files\Tencent\QQ\QQSceneMng.dll]  [N/A, ]
[D:\Program Files\Tencent\QQ\AddrSearch.dll]  [腾讯科技（深圳）有限公司, 2, 1, 9, 95]
[PID: 1148][D:\QQ2007\TIMPlatform.exe]  [TENCENT, 7,0,225,1651]
[C:\Program Files\360safe\safemon\safemon.dll]  [, 3, 6, 1, 1001]
[d:\Program Files\Tencent\QQ\TIMProxy.dll]  [tencent, 0, 3, 2, 4]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.0.125]
[PID: 2940][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.0.125]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\scrchpg.dll]  [Kaspersky Lab, 7.0.0.125]
[C:\WINDOWS\system32\PortableDeviceApi.dll]  [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\imon.dll]  [Eset , 2, 70, 39 ]
[C:\Program Files\Eset\pr_imon.dll]  [N/A, ]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\adialhk.dll]  [Kaspersky Lab, 7.0.0.125]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll]  [Kaspersky Lab, 7.0.0.125]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\klscav.dll]  [Kaspersky Lab, 7.0.0.125]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\prloader.dll]  [Kaspersky Lab, 7.0.0.125]
[C:\WINDOWS\system32\FREEIME.IME]  [Delphi Fan Studio, 4.00.950]
[C:\WINDOWS\system32\Macromed\Flash\Flash9d.ocx]  [Adobe Systems, Inc., 9,0,47,0]
[C:\WINDOWS\system32\xpsp3res.dll]  [Microsoft Corporation, 5.1.2600.3157 (xpsp_sp2_gdr.070614-0013)]
[PID: 1200][D:\Downloads\SREng2\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.0.125]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\adialhk.dll]  [Kaspersky Lab, 7.0.0.125]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll]  [Kaspersky Lab, 7.0.0.125]
[C:\WINDOWS\system32\imon.dll]  [Eset , 2, 70, 39 ]
[C:\Program Files\Eset\pr_imon.dll]  [N/A, ]
==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
NOD32 protected [MSAFD Tcpip [TCP/IP]]
C:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning support)
NOD32 protected [MSAFD Tcpip [UDP/IP]]
C:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning support)
NOD32 protected [MSAFD Tcpip [RAW/IP]]
C:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning support)
NOD32 protected [RSVP UDP Service Provider]
C:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning support)
NOD32 protected [RSVP TCP Service Provider]
C:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning support)
NOD32
C:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning support)
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1    localhost
==================================
API HOOK
RVA  错误： LoadLibraryA (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xF59E5AF0)
RVA  错误： LoadLibraryExA (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xF59E5CD0)
RVA  错误： LoadLibraryExW (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xF59E5E30)
RVA  错误： LoadLibraryW (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xF59E5BE0)
RVA  错误： GetProcAddress (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0xF59E5DE0)
==================================
隐藏进程
N/A
==================================

[ 本帖最后由 fwreal 于 2007-9-9 09:09 编辑 ]

显示全部楼层 · 发表于 2007-9-8 12:21:59

反正我打开什么网都会过这个网站
www.31joy.com/s368/t368ok.gif

显示全部楼层 · 发表于 2007-9-8 12:28:52

我安全模式也杀了。。无语。。我同事说NOD32能杀。。换32去了

显示全部楼层 · 发表于 2007-9-8 12:30:49

我好像也有这个问题!是一个downloader病毒!

显示全部楼层 · 发表于 2007-9-8 12:42:43

http://www.kafan.cn/bbs/viewthre ... &extra=page%3D1
2楼：SREng

显示全部楼层 · 发表于 2007-9-8 13:26:44

1. WINDOWS下的PE病毒 Trojan.Clicker.Agent.a
2. WINDOWS下的PE病毒 Trojan.Clicker.Agent.aa
3. WINDOWS下的PE病毒 Trojan.Clicker.Agent.aaa
4. WINDOWS下的PE病毒 Trojan.Clicker.Agent.aab
5. WINDOWS下的PE病毒 Trojan.Clicker.Agent.aac
6. WINDOWS下的PE病毒 Trojan.Clicker.Agent.aad
7. WINDOWS下的PE病毒 Trojan.Clicker.Agent.aae
8. WINDOWS下的PE病毒 Trojan.Clicker.Agent.aaf
9. WINDOWS下的PE病毒 Trojan.Clicker.Agent.aag
10. WINDOWS下的PE病毒 Trojan.Clicker.Agent.aah
11. 普通文件病毒 Trojan.Clicker.Agent.aai
12. WINDOWS下的PE病毒 Trojan.Clicker.Agent.aaj
13. WINDOWS下的PE病毒 Trojan.Clicker.Agent.aak
14. WINDOWS下的PE病毒 Trojan.Clicker.Agent.aal
15. WINDOWS下的PE病毒 Trojan.Clicker.Agent.aam
16. WINDOWS下的PE病毒 Trojan.Clicker.Agent.aan
17. WINDOWS下的PE病毒 Trojan.Clicker.Agent.aao
18. WINDOWS下的PE病毒 Trojan.Clicker.Agent.aap
19. WINDOWS下的PE病毒 Trojan.Clicker.Agent.aaq
20. WINDOWS下的PE病毒 Trojan.Clicker.Agent.aar
是不是这些病毒中的一种
lz光给个Clicker不好说的

[ 本帖最后由 woai_jolin 于 2007-9-8 13:28 编辑 ]

显示全部楼层 · 发表于 2007-9-8 13:39:29

不是以上的，网上搜不到这个。。结尾好像是.jas，我用NOD32深层分析杀出了两个木马。。DOWNLOADER。好像。。

显示全部楼层 · 发表于 2007-9-8 13:58:35

完了。。还在。。受不了了。。难道只能重装嘛。。太恐怖了。。现在连提示都没了。。有很多网页都打不开

求助、中了木马。。。卡巴。360干不掉

回复 4楼 fwreal 的帖子