这个病毒无法被卡巴认出来,我杀完后,电脑老是反复登录?

kowloons

运行后,在system32目录后,产生3个文件:
candoall.exe
masxml32.dll
massltuas35.dll


第一个 candoall.exe 是超级隐藏文件,必须在冰刃的文件管理器中才能看到!是一只手的图标

把这3个文件删除后,重启XP后,电脑老是反复登录????

[ 本帖最后由 kowloons 于 2007-10-20 12:52 编辑 ]

promised

就是上次先锋论坛被挂的东西http://bbs.kafan.cn/viewthread.php?tid=143349
等下给你个处理方案

eubyo

试了一下，
"已阻止应用程序 '1.exe' 改写文件, C:\WINDOWS\system32\passsd.exe"
阻止了应没问题了吧

promised

强制删除C:\WINDOWS\system32
alldele.ini
hideme.sys
allinstall.exe
passsd.exe
MASSLTUAS35.DLL
masxml32.dll
candoall.exe
删除注册表
HKEY_CLASSES_ROOT\AllDll.AllBHO
HKEY_CLASSES_ROOT\AllDll.AllBHO.1
HKEY_CLASSES_ROOT\CLSID\{1798BEA6-E891-46B7-A1F8-C15780D0A023}
HKEY_CLASSES_ROOT\TypeLib\{04750F2D-DE63-4790-90F4-C5CE892E5AA4}
HKEY_CLASSES_ROOT\Interface\{E44384ED-10F7-49FD-A210-41C9BD4A119C}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System中DisableRegistryTools
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel中Homepage
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1798BEA6-E891-46B7-A1F8-C15780D0A023}
HKEY_LOCAL_MACHINE\software\microsoft\command processor\中autorun
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1798BEA6-E891-46B7-A1F8-C15780D0A023}
修改注册表
HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon中Userinit数值设为C:\WINDOWS\system32\userinit.exe,   （，不要漏）
主页被改请自行改回,建议装ie7

[ 本帖最后由 promised 于 2007-10-20 14:13 编辑 ]

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\1.rar'
C:\Users\morgan\Documents\
  1.rar
    [0] Archive type: RAR
    --> 1.exe
        [DETECTION] Is the Trojan horse TR/DelFile.E
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!

The EQs

这个病毒会新建
C:\WINDOWS\system32\passsd.exe
C:\WINDOWS\system32\hideme.sys
C:\WINDOWS\system32\allinstall.exe
C:\WINDOWS\system32\masxml32.dll
C:\WINDOWS\system32\MASSLTUAS35.DLL
C:\WINDOWS\system32\candoall.exe
会删除C:\file.exe
会修改如下注册表项：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor "autorun" = C:\WINDOWS\system32\candoall.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon "Userinit" = C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\candoall.exe
HKEY_CLASSES_ROOT\AllDll.AllBHO.1 "" = WEB·´²¡¶¾³ÌÐò
HKEY_CLASSES_ROOT\AllDll.AllBHO.1\CLSID "" = {1798BEA6-E891-46B7-A1F8-C15780D0A023}
HKEY_CLASSES_ROOT\AllDll.AllBHO "" = WEB·´²¡¶¾³ÌÐò
HKEY_CLASSES_ROOT\AllDll.AllBHO\CLSID "" = {1798BEA6-E891-46B7-A1F8-C15780D0A023}
HKEY_CLASSES_ROOT\AllDll.AllBHO\CurVer "" = AllDll.AllBHO.1
HKEY_CLASSES_ROOT\CLSID\{1798BEA6-E891-46B7-A1F8-C15780D0A023} "" = WEB·´²¡¶¾³ÌÐò
HKEY_CLASSES_ROOT\CLSID\{1798BEA6-E891-46B7-A1F8-C15780D0A023}\ProgID "" = AllDll.AllBHO.1
HKEY_CLASSES_ROOT\CLSID\{1798BEA6-E891-46B7-A1F8-C15780D0A023}\VersionIndependentProgID "" = AllDll.AllBHO
HKEY_CLASSES_ROOT\CLSID\{1798BEA6-E891-46B7-A1F8-C15780D0A023}\InprocServer32 "" = C:\WINDOWS\system32\masxml32.dll
HKEY_CLASSES_ROOT\CLSID\{1798BEA6-E891-46B7-A1F8-C15780D0A023}\InprocServer32 "ThreadingModel" = Apartment
HKEY_CLASSES_ROOT\CLSID\{1798BEA6-E891-46B7-A1F8-C15780D0A023}\TypeLib "" = {04750F2D-DE63-4790-90F4-C5CE892E5AA4}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1798BEA6-E891-46B7-A1F8-C15780D0A023} "" = WEB·´²¡¶¾³ÌÐò
HKEY_CLASSES_ROOT\TypeLib\{04750F2D-DE63-4790-90F4-C5CE892E5AA4}\1.0 "" = AllDll 1.0 Type Library
HKEY_CLASSES_ROOT\TypeLib\{04750F2D-DE63-4790-90F4-C5CE892E5AA4}\1.0\FLAGS "" = 0
HKEY_CLASSES_ROOT\TypeLib\{04750F2D-DE63-4790-90F4-C5CE892E5AA4}\1.0\0\win32 "" = C:\WINDOWS\system32\masxml32.dll
HKEY_CLASSES_ROOT\TypeLib\{04750F2D-DE63-4790-90F4-C5CE892E5AA4}\1.0\HELPDIR "" = C:\WINDOWS\system32\
HKEY_CLASSES_ROOT\Interface\{E44384ED-10F7-49FD-A210-41C9BD4A119C} "" = IAllBHO
HKEY_CLASSES_ROOT\Interface\{E44384ED-10F7-49FD-A210-41C9BD4A119C}\ProxyStubClsid "" = {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\Interface\{E44384ED-10F7-49FD-A210-41C9BD4A119C}\ProxyStubClsid32 "" = {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\Interface\{E44384ED-10F7-49FD-A210-41C9BD4A119C}\TypeLib "" = {04750F2D-DE63-4790-90F4-C5CE892E5AA4}
HKEY_CLASSES_ROOT\Interface\{E44384ED-10F7-49FD-A210-41C9BD4A119C}\TypeLib "Version" = 1.0

qigang

RX20.14.52没啥反应。