exe白化问题

显示全部楼层 · 发表于 2007-10-7 18:31:30

大概是威金的新变种，机子里几乎所有软件的exe都被感染，图标变成空白

中毒后我早早ghost了C盘，解除了盘符上的AUTORUN，基本上使用算是正常（指不卡），没有找到啥Logo1_.exe、rundl132.exe（因为C盘复原了嘛），甚至DEF盘里也没有找到desktop.ini。

用了N种专杀，都没找到病毒。

但问题无法消除——exe仍旧是白色的，而卡巴死命要删掉它们，我只好把实时保护设成记录状态，到现在已经报了2000多个“病毒”……要是全部删了那我的硬盘也算是废了，那么多软件TAT

那个恢复图标的reg文本试过也没用。

请高手指点，我现在都不敢点那些exe了

—————————————
事后说明：
遇到类似情况的难友，请退出卡巴司机，然后用凝逸反毒修复！谢谢大家！

[ 本帖最后由 Bekanoi 于 2007-10-8 22:07 编辑 ]

显示全部楼层 · 发表于 2007-10-7 18:43:55

汗.看来.卡巴遇到难题了,这是什么病毒呢?这么厉害.

显示全部楼层 · 发表于 2007-10-7 19:10:21

ftp://ftp.drweb.com/pub/drweb/cureit/cureit.exe查一下EXE文件，EXE文件恢复的可能性很小了。
System Repair Engineer2.5(SREng)或者System Repair Engineer2.5(SREng)下载System Repair Engineer2.5扫描日志上来.
如果不能运行将下载的SREngPS.EXE重命名为SREngPS.com(SREngPS.scr\SREngPS.bat\SREngPS.pif)或者改名为11BD.abc等等自己随便改运行.
sreng——智能扫描——扫描——保存日志——打开日志记事本SREngLOG——Ctrl+A——Ctrl+C——到论坛回复——Ctrl+V。

显示全部楼层 · 发表于 2007-10-8 11:22:48

[CODE]

2007-10-08,11:20:48

System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 1 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe>  [(Verified)Microsoft Windows XP Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows XP Publisher]
<PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows XP Publisher]
<PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows XP Publisher]
<SoundMan><SOUNDMAN.EXE>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<ATIPTA><C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe>  [ATI Technologies, Inc.]
<KAVPersonal50><"F:\Kaspersky\kav.exe" /minimize>  [Kaspersky Lab]
<IMSCMIG40W><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40W\IMSCMIG.EXE /SetPreload /Log>  [Microsoft Corporation]
<H2O><C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe>  [Team H2O]
<DAEMON Tools-2052><"D:\D-Tools\daemon.exe"  -lang 2052>  [DAEMON'S HOME]
<Jiangmin KVFW><E:\JiangMin\KVFW\FWMon.exe>  [Jiangmin Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe>  [(Verified)Microsoft Windows XP Publisher]
<Userinit><C:\WINDOWS\System32\UserInit.exe,>  [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe>  [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
<Microsoft Windows Media Player 6.4><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\mplayer2.inf,PerUserStub.NT>  [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{306D6C21-C1B6-4629-986C-E59E1875B8AF}]
<N/A><"C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Messenger\msgsc.dll",ShowIconsUser>  [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
<Windows Messenger><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.Install.PerUser>  [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player 8><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub>  [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]

==================================
启动文件夹
N/A

==================================
服务
[Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start]
  <C:\WINDOWS\System32\Ati2evxx.exe><>
[ATI Smart / ATI Smart][Stopped/Auto Start]
  <C:\WINDOWS\system32\ati2sgag.exe><>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[kavsvc / kavsvc][Running/Auto Start]
  <"F:\Kaspersky\kavsvc.exe"><Kaspersky Lab>

==================================
驱动程序
[Service for WDM 3D Audio Driver / ALCXSENS][Running/Manual Start]
  <system32\drivers\ALCXSENS.SYS><Sensaura Ltd>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[ati2mtag / ati2mtag][Running/Manual Start]
  <System32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[Team H2O CLEDX service / CLEDX][Running/Manual Start]
  <System32\DRIVERS\cledx.sys><Team H2O>
[d347bus / d347bus][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\d347bus.sys><>
[d347prt / d347prt][Running/Boot Start]
  <\SystemRoot\System32\Drivers\d347prt.sys><>
[HdFw_slot / HdFw_slot][Running/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\HdFw.sys><Jiangmin Co., Ltd.>
[HDPT Miniport / HDPT][Running/Manual Start]
  <System32\DRIVERS\HDPT.sys><Jiangmin Co., Ltd.>
[JmFwDDos / JmFwDDos][Running/Auto Start]
  <system32\DRIVERS\JmFwDDos.sys><Jiangmin Co., Ltd.>
[Kl1 / Kl1][Running/Boot Start]
  <\SystemRoot\System32\drivers\kl1.sys><Kaspersky Lab>
[Klif / Klif][Running/System Start]
  <System32\drivers\klif.sys><Kaspersky Labs>
[Klmc / Klmc][Running/System Start]
  <System32\drivers\klmc.sys><Kaspersky Lab>
[KRegEx / KRegEx][Running/Auto Start]
  <\??\E:\JiangMin\antivirus\KRegEx.sys><Jiangmin Co. Ltd.>
[Jiangmin Antivirus Software - SysCall Services / KSysCall][Running/System Start]
  <\??\E:\JiangMin\common\KSysCall.sys><Jiangmin Co.,  Ltd.>
[Jiangmin Antivirus Software - System Monitor / KSysMon][Running/System Start]
  <\??\E:\JiangMin\AntiVirus\KSysMon.sys><Jiangmin Co., Ltd.>
[Jiangmin Antivirus Software - File Tracer / KSysTrace][Running/System Start]
  <\??\E:\JiangMin\AntiVirus\KSysTrace.sys><Jiangmin Co., Ltd.>
[npkcrypt / npkcrypt][Stopped/Manual Start]
  <\??\D:\Lineage\npkcrypt.sys><INCA Internet Co., Ltd.>
[NVIDIA nForce MCP Networking Controller Driver / NVENET][Running/Manual Start]
  <System32\DRIVERS\NVENET.sys><NVIDIA Corporation>
[nvidesm / nvidesm][Running/Boot Start]
  <\SystemRoot\system32\drivers\nvidesm.sys><NVIDIA Corporation>
[NVIDIA nForce AGP Bus Filter / nv_agp][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\nv_agp.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Secdrv / Secdrv][Stopped/Manual Start]
  <System32\DRIVERS\secdrv.sys><N/A>
[sptd / sptd][Running/Boot Start]
  <\SystemRoot\System32\Drivers\sptd.sys><N/A>
[TSP / TSP][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Labs>

==================================
浏览器加载项
[FGCatchUrl]
  {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <D:\FlashGet\jccatch.dll, www.flashget.com>
[超级兔子上网精灵]
  {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} <e:\Super Rabbit\MagicSet\haokanbar.dll, Xiang Feng Technology>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <D:\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>
[FlashGet GetFlash Class]
  {F156768E-81EF-470C-9057-481BA8380DBA} <D:\FlashGet\getflash.dll, www.flashget.com>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[快车]
  {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <D:\FlashGet\FlashGet.exe, FlashGet.com>
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[金山快译(&K)]
  {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} <E:\FastAIT 2006\IEBand.dll, 金山软件股份有限公司>
[快车(FlashGet)]
  {E0E899AB-F487-11D5-8D29-0050BA6940E3} <D:\FlashGet\fgiebar.dll, N/A>
[超级兔子上网精灵]
  {43869BB3-22FD-4F15-9B46-238106BA2F4E} <e:\Super Rabbit\MagicSet\haokanbar.dll, Xiang Feng Technology>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\macromed\flash\Flash.ocx, Macromedia, Inc.>
[FGCatchUrl]
  {FB5DA724-162B-11D3-8B9B-AA70B4B0B524} <D:\FlashGet\jccatch.dll, www.flashget.com>
[&使用快车(FlashGet)下载]
  <D:\FlashGet\jc_link.htm, N/A>
[&使用快车(FlashGet)下载全部链接]
  <D:\FlashGet\jc_all.htm, N/A>
[&使用迅雷下载]
  <D:\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
  <D:\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
[使用KuGoo3下载(&K)]
  <E:\KuGoo2\KuGoo3DownX.htm, N/A>
[添加到QQ自定义面板]
  <, N/A>
[添加到QQ表情]
  <, N/A>
[用QQ彩信发送该图片]
  <, N/A>

==================================
正在运行的进程
[PID: 992][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 1048][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1072][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\system32\Ati2evxx.dll]  [, ]
[C:\WINDOWS\System32\wdmaud.drv]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1124][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1136][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 1288][C:\WINDOWS\System32\Ati2evxx.exe]  [, ]
[PID: 1324][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1524][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1688][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1712][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1940][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[PID: 1356][C:\WINDOWS\system32\Ati2evxx.exe]  [, ]
[PID: 840][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
[E:\JiangMin\AntiVirus\KsPec.dll]  [Jiangmin Co., Ltd., 1, 0, 7, 903]
[E:\JiangMin\common\KvTrust.dll]  [Jiangmin Co., Ltd., 10, 0, 7, 910]
[E:\JiangMin\common\KvTools.dll]  [Jiangmin Co., Ltd., 2, 0, 7, 830]
[C:\WINDOWS\System32\wdmaud.drv]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[e:\WinRAR\rarext.dll]  [N/A, ]
[D:\Unlocker\UnlockerCOM.dll]  [N/A, ]
[F:\Kaspersky\shellex.dll]  [Kaspersky Lab, 5.0.388.1]
[C:\WINDOWS\System32\HiveBase.dll]  [Jiangmin Co., Ltd., 1, 0, 7, 717]
[C:\WINDOWS\System32\l3codeca.acm]  [Fraunhofer Institut Integrierte Schaltungen IIS, 1, 9, 0, 0305]
[D:\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll]  [Thunder Networking Technologies,LTD, 5, 0, 0, 2]
[E:\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
[D:\FlashGet\fgmgr.dll]  [www.flashget.com, 1, 8, 4, 1007]
[PID: 1508][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 1756][C:\WINDOWS\System32\wdfmgr.exe]  [Microsoft Corporation, 5.2.3790.1230 built by: DNSRV(bld4act)]
[PID: 616][C:\WINDOWS\SOUNDMAN.EXE]  [Realtek Semiconductor Corp., 5.1.11]
[PID: 744][C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe]  [ATI Technologies, Inc., 6.14.10.5090]
[C:\Program Files\ATI Technologies\ATI Control Panel\atipdsxx.dll]  [ATI Technologies, Inc., 6.14.10.5090]
[C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATRPUIXX.CHS]  [ATI Technologies, Inc., 6.14.10.5090]
[C:\Program Files\ATI Technologies\ATI Control Panel\atipdxxx.dll]  [ATI Technologies, Inc., 6.14.10.5090]
[PID: 864][C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe]  [Team H2O, v0.3.1412]
[C:\Program Files\SyncroSoft\Pos\H2O\emu.dll]  [Team H2O, 4.1.0.0]
[PID: 880][D:\D-Tools\daemon.exe]  [DAEMON'S HOME, 3.47.0.0]
[C:\WINDOWS\daemon.dll]  [, 3.47.0.0]
[D:\D-Tools\PFCTOC.DLL]  [Padus(R), Inc., 1, 0, 0, 12]
[D:\D-Tools\Plugins\Images\bw5mount.dll]  [, 1.0.2.0]
[D:\D-Tools\Plugins\Images\ccdmount.dll]  [GENERIC, 1.02.0.0]
[D:\D-Tools\Plugins\Images\mdsmount.dll]  [GENERIC, 1.01.0.0]
[D:\D-Tools\Plugins\Images\nrgmount.dll]  [GENERIC, 1.02.0.0]
[D:\D-Tools\Plugins\Images\pdimount.dll]  [GENERIC, 1.01.0.0]
[PID: 980][C:\WINDOWS\System32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 1864][C:\Program Files\VnetClient1.6\VnetClient.exe]  [, 1, 0, 0, 1]
[F:\Kaspersky\scrchpg.dll]  [Kaspersky Lab, 5.0.1.18]
[F:\Kaspersky\scrch_ag.dll]  [Kaspersky Lab, 5.0.388.1]
[F:\Kaspersky\FSSync.dll]  [Kaspersky Lab, 5.0.388.0]
[F:\Kaspersky\pr_rmt.dll]  [Kaspersky Lab, 5.0.388.0]
[F:\Kaspersky\ccclient.dll]  [Kaspersky Lab, 5.0.388.1]
[F:\Kaspersky\klipc.dll]  [Kaspersky Lab, 5.0.388.0]
[F:\Kaspersky\KLUtil.dll]  [Kaspersky Lab, 5.0.388.1]
[F:\Kaspersky\rpt.dll]  [Kaspersky Lab, 5.0.388.2]
[F:\Kaspersky\CCIFACE.dll]  [Kaspersky Lab, 5.0.388.1]
[F:\Kaspersky\prloader.dll]  [Kaspersky Lab, 5.0.388.0]
[F:\Kaspersky\prkernel.ppl]  [Kaspersky Lab, 5.0.388.0]
[f:\kaspersky\prstring.ppl]  [Kaspersky Lab, 5.0.388.0]
[f:\kaspersky\pr_srv.ppl]  [Kaspersky Lab, 5.0.388.0]
[f:\kaspersky\pr_clnt.ppl]  [Kaspersky Lab, 5.0.388.0]
[f:\kaspersky\tempfile.ppl]  [Kaspersky Lab, 5.0.388.0]
[C:\WINDOWS\System32\wdmaud.drv]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 2168][E:\Kmplayer-v2.931339\KMPlayer.exe]  [With Force!!, 2.9.3.1339]
[C:\WINDOWS\System32\msdmo.dll]  [, ]
[C:\WINDOWS\System32\wdmaud.drv]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[E:\Kmplayer-v2.931339\Plugins\IN_MP3.DLL]  [N/A, ]
[E:\Kmplayer-v2.931339\MSVCP60.dll]  [Microsoft Corporation, 6.00.8972.0]
[E:\Kmplayer-v2.931339\Plugins\in_mp4.dll]  [N/A, ]
[E:\Kmplayer-v2.931339\Plugins\in_nsv.dll]  [N/A, ]
[E:\Kmplayer-v2.931339\Plugins\in_vorbis.dll]  [N/A, ]
[E:\Kmplayer-v2.931339\Plugins\in_wm.dll]  [N/A, ]
[E:\Kmplayer-v2.931339\Plugins\gen_hotkeys.dll]  [N/A, ]
[E:\Kmplayer-v2.931339\Plugins\gen_ml.dll]  [N/A, ]
[E:\Kmplayer-v2.931339\PProcDLL.dll]  [TODO: <?? ??>, 1.0.0.1]
[E:\Kmplayer-v2.931339\drvc.dll]  [RealNetworks, Inc., 10.0.0.1707]
[E:\Kmplayer-v2.931339\PNCRT.dll]  [Real Networks, Inc, 6.0.0.0]
[E:\Kmplayer-v2.931339\LibDTS.dll]  [N/A, ]
[E:\Kmplayer-v2.931339\SIPR.dll]  [RealNetworks, Inc., 10.0.0.3004]
[E:\Kmplayer-v2.931339\libmplay.dll]  [N/A, ]
[E:\Kmplayer-v2.931339\libcodec.dll]  [N/A, ]
[PID: 2044][E:\Firefox Plus\App\firefox\firefox.exe]  [Mozilla Corporation, 1.8.1.7: 2007091417]
[E:\Firefox Plus\App\firefox\js3250.dll]  [Netscape Communications Corporation, 4.0]
[E:\Firefox Plus\App\firefox\nspr4.dll]  [Netscape Communications Corporation, 4.6.7]
[E:\Firefox Plus\App\firefox\xpcom_core.dll]  [Mozilla Foundation, 1.8.1.7: 2007091417]
[E:\Firefox Plus\App\firefox\plc4.dll]  [Netscape Communications Corporation, 4.6.7]
[E:\Firefox Plus\App\firefox\plds4.dll]  [Netscape Communications Corporation, 4.6.7]
[E:\Firefox Plus\App\firefox\smime3.dll]  [Mozilla Foundation, 3.11.5 Basic ECC]
[E:\Firefox Plus\App\firefox\nss3.dll]  [Mozilla Foundation, 3.11.5 Basic ECC]
[E:\Firefox Plus\App\firefox\softokn3.dll]  [Mozilla Foundation, 3.11.4 Basic ECC]
[E:\Firefox Plus\App\firefox\ssl3.dll]  [Mozilla Foundation, 3.11.5 Basic ECC]
[E:\Firefox Plus\App\firefox\xpcom_compat.dll]  [Mozilla Foundation, 1.8.1.7: 2007091417]
[E:\Firefox Plus\App\firefox\components\jar50.dll]  [Mozilla Foundation, 1.8.1.7: 2007091417]
[E:\Firefox Plus\App\firefox\components\jsd3250.dll]  [Mozilla Foundation, 1.8.1.7: 2007091417]
[E:\Firefox Plus\App\firefox\components\myspell.dll]  [Mozilla Foundation, 1.8.1.7: 2007091417]
[E:\Firefox Plus\App\firefox\components\spellchk.dll]  [Mozilla Foundation, 1.8.1.7: 2007091417]
[E:\Firefox Plus\App\firefox\components\ThunderComponent.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 7]
[E:\Firefox Plus\App\firefox\components\xpinstal.dll]  [Mozilla Foundation, 1.8.1.7: 2007091417]
[E:\Firefox Plus\App\firefox\freebl3.dll]  [Mozilla Foundation, 3.11.4 Basic ECC]
[e:\Firefox Plus\App\firefox\nssckbi.dll]  [Mozilla Foundation, 1.64]
[E:\Firefox Plus\App\firefox\xpcom.dll]  [Mozilla Foundation, 1.8.1.7: 2007091417]
[C:\Program Files\Windows Media Player\npdsplay.dll]  [Microsoft Corporation (written by Digital Renaissance Inc.), 3.0.2.627]
[C:\WINDOWS\System32\wdmaud.drv]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[E:\JiangMin\AntiVirus\KsPec.dll]  [Jiangmin Co., Ltd., 1, 0, 7, 903]
[E:\JiangMin\common\KvTrust.dll]  [Jiangmin Co., Ltd., 10, 0, 7, 910]

显示全部楼层 · 发表于 2007-10-8 11:23:04

[E:\JiangMin\common\KvTools.dll]  [Jiangmin Co., Ltd., 2, 0, 7, 830]
[D:\FlashGet\fgmgr.dll]  [www.flashget.com, 1, 8, 4, 1007]
[PID: 3080][E:\down\sreng2\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
[E:\down\sreng2\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]
[E:\down\sreng2\Plugins\NTFSTREAM.SRE]  [Smallfrogs Studio, 1, 0, 0, 5]
[D:\FlashGet\fgmgr.dll]  [www.flashget.com, 1, 8, 4, 1007]
[PID: 3280][D:\FlashGet\flashget.exe]  [FlashGet.com, 1, 9, 6, 1073]
[D:\FlashGet\FGBTCORE.dll]  [, 1, 0, 0, 36]
[D:\FlashGet\FGEMCORE.dll]  [, 1, 0, 3, 1002]
[D:\FlashGet\debugrpt.dll]  [flashget, 1, 0, 0, 1006]
[D:\FlashGet\fgmgr.dll]  [www.flashget.com, 1, 8, 4, 1007]
[D:\FlashGet\fgupdate.dll]  [www.flashget.com, 1, 8, 1, 1003]
[F:\Kaspersky\scrchpg.dll]  [Kaspersky Lab, 5.0.1.18]
[F:\Kaspersky\scrch_ag.dll]  [Kaspersky Lab, 5.0.388.1]
[F:\Kaspersky\FSSync.dll]  [Kaspersky Lab, 5.0.388.0]
[F:\Kaspersky\pr_rmt.dll]  [Kaspersky Lab, 5.0.388.0]
[F:\Kaspersky\ccclient.dll]  [Kaspersky Lab, 5.0.388.1]
[F:\Kaspersky\klipc.dll]  [Kaspersky Lab, 5.0.388.0]
[F:\Kaspersky\KLUtil.dll]  [Kaspersky Lab, 5.0.388.1]
[F:\Kaspersky\rpt.dll]  [Kaspersky Lab, 5.0.388.2]
[F:\Kaspersky\CCIFACE.dll]  [Kaspersky Lab, 5.0.388.1]
[F:\Kaspersky\prloader.dll]  [Kaspersky Lab, 5.0.388.0]
[F:\Kaspersky\prkernel.ppl]  [Kaspersky Lab, 5.0.388.0]
[f:\kaspersky\prstring.ppl]  [Kaspersky Lab, 5.0.388.0]
[f:\kaspersky\pr_srv.ppl]  [Kaspersky Lab, 5.0.388.0]
[f:\kaspersky\pr_clnt.ppl]  [Kaspersky Lab, 5.0.388.0]
[f:\kaspersky\tempfile.ppl]  [Kaspersky Lab, 5.0.388.0]
[E:\JiangMin\AntiVirus\KsPec.dll]  [Jiangmin Co., Ltd., 1, 0, 7, 903]
[E:\JiangMin\common\KvTrust.dll]  [Jiangmin Co., Ltd., 10, 0, 7, 910]
[E:\JiangMin\common\KvTools.dll]  [Jiangmin Co., Ltd., 2, 0, 7, 830]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1    localhost

==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 1072, C:\WINDOWS\SYSTEM32\WINLOGON.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 744, C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 864, C:\PROGRAM FILES\SYNCROSOFT\POS\H2O\CLEDX.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 880, D:\D-TOOLS\DAEMON.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1864, C:\PROGRAM FILES\VNETCLIENT1.6\VNETCLIENT.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2168, E:\KMPLAYER-V2.931339\KMPLAYER.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3280, D:\FLASHGET\FLASHGET.EXE]

==================================
API HOOK
RVA  错误： LoadLibraryA (危险等级: 高,  被下面模块所HOOK: \SystemRoot\System32\drivers\klif.sys)
RVA  错误： LoadLibraryExA (危险等级: 高,  被下面模块所HOOK: \SystemRoot\System32\drivers\klif.sys)
RVA  错误： LoadLibraryExW (危险等级: 高,  被下面模块所HOOK: \SystemRoot\System32\drivers\klif.sys)
RVA  错误： LoadLibraryW (危险等级: 高,  被下面模块所HOOK: \SystemRoot\System32\drivers\klif.sys)

==================================
隐藏进程
[761] F:\Kaspersky\kav.exe
[1605] F:\Kaspersky\kavsvc.exe

==================================

[/CODE]

显示全部楼层 · 发表于 2007-10-8 11:38:26

日志正常，如果有问题有小的exe文件发到样本区。

显示全部楼层 · 发表于 2007-10-8 12:12:23

又江明又卡巴 - -
都被感染了~~~

显示全部楼层 · 发表于 2007-10-8 12:27:55

江民是中毒后补上的防火墙

问题是那些exe被锁定了，用unlocker也不行，还有别的办法移动它们吗？

显示全部楼层 · 发表于 2007-10-8 12:36:14

exe安装文件要删除么。让你用winrar压缩发到样本区。直接删除不掉么。是文件夹还是EXE文件。如果使用这个工具删除。
http://ishare.iask.sina.com.cn/cgi-bin/fileid.cgi?fileid=1812834 用下面的360工具，把文件拖到工具中，选上阻止被删除程序再次生成。然后删除空文件夹。或者
http://www.crsky.com/soft/6947.html 冰刃IceSword v1.22

[ 本帖最后由风雪于 2007-10-8 12:50 编辑 ]

显示全部楼层 · 发表于 2007-10-8 12:52:28

我不是要删exe，那些属于被感染的正常软件，比如按键精灵、金山词霸和游戏之类。我现在就想保住这些exe，让它们还原。

用winrar压缩exe显示“拒绝访问”。

——————
我用冰刃复制了一个exe，可以删除，但无法移动、无法改名，上传的结果是“0字节”，传不上来。。

[ 本帖最后由 Bekanoi 于 2007-10-8 13:06 编辑 ]

[已解决] exe白化问题

OK