估计很多杀软误报，帮我用手动hips测试下

IllusionWing

应该是。红伞的分析结果是BD的机器

挪威的冬天

原帖由 gankeyu 于 2009-1-23 10:47 发表
应该是。红伞的分析结果是BD的机器

BD 的机器?...

IllusionWing

机器的BD...反了

germany05400

机器的BD.什么意思吖？？？

hddu

2009-01-23 13:43:37        应用程序保护(运行应用程序)     操作:阻止
进程路径:F:\files\files\fix.exe
文件路径:C:\WINDOWS\system32\conime.exe

2009-01-23 13:43:43        文件保护(创建文件)     操作:阻止并结束进程
进程路径:F:\files\files\疑难杂症处理.exe
文件路径:C:\met.bat

2009-01-23 13:43:43        文件保护(创建文件)     操作:阻止并结束进程
进程路径:F:\files\files\疑难杂症处理.exe
文件路径:C:\met.bat

2009-01-23 13:43:43        文件保护(创建文件)     操作:阻止并结束进程
进程路径:F:\files\files\疑难杂症处理.exe
文件路径:C:\met.bat

germany05400

有病毒特征么？？？

germany05400

注意一共有3个单独的不相干的样本（从软件中提取出来滴）

willjjyu

nod32 3.0 没有报  to eset

雨宫优子

都是误报

fix.exe无法运行...

疑难杂症处理.exe释放了一个bat文件，是正常的注册文件bat

1. rundll32.exe /s advpack.dll /DelNodeRunDLL32 %systemroot%\System32\dacui.dll
   
2. rundll32.exe /s advpack.dll /DelNodeRunDLL32 %systemroot%\Catroot\icatalog.mdb
   
3. regsvr32 /s setupwbv.dll
   
4. regsvr32 /s wininet.dll
   
5. regsvr32 /s comcat.dll
   
6. regsvr32 /s shdoc401.dll
   
7. regsvr32 /s shdoc401.dll /i
   
8. regsvr32 /s asctrls.ocx
   
9. regsvr32 /s oleaut32.dll
   
10. regsvr32 /s shdocvw.dll /I
    
11. regsvr32 /s shdocvw.dll
    
12. regsvr32 /s browseui.dll
    
13. regsvr32 /s browseui.dll /I
    
14. regsvr32 /s msrating.dll
    
15. regsvr32 /s mlang.dll
    
16. regsvr32 /s hlink.dll
    
17. regsvr32 /s mshtml.dll
    
18. regsvr32 /s mshtmled.dll
    
19. regsvr32 /s urlmon.dll
    
20. regsvr32 /s plugin.ocx
    
21. regsvr32 /s sendmail.dll
    
22. regsvr32 /s comctl32.dll /i
    
23. regsvr32 /s inetcpl.cpl /i
    
24. regsvr32 /s mshtml.dll /i
    
25. regsvr32 /s scrobj.dll
    
26. regsvr32 /s mmefxe.ocx
    
27. regsvr32 /s proctexe.ocx mshta.exe /register
    
28. regsvr32 /s corpol.dll
    
29. regsvr32 /s jscript.dll
    
30. regsvr32 /s msxml.dll
    
31. regsvr32 /s imgutil.dll
    
32. regsvr32 /s thumbvw.dll
    
33. regsvr32 /s cryptext.dll
    
34. regsvr32 /s rsabase.dll
    
35. regsvr32 /s triedit.dll
    
36. regsvr32 /s dhtmled.ocx
    
37. regsvr32 /s inseng.dll
    
38. regsvr32 /s iesetup.dll /i
    
39. regsvr32 /s hmmapi.dll
    
40. regsvr32 /s cryptdlg.dll
    
41. regsvr32 /s actxprxy.dll
    
42. regsvr32 /s dispex.dll
    
43. regsvr32 /s occache.dll
    
44. regsvr32 /s occache.dll /i
    
45. regsvr32 /s iepeers.dll
    
46. regsvr32 /s wininet.dll /i
    
47. regsvr32 /s urlmon.dll /i
    
48. regsvr32 /s digest.dll /i
    
49. regsvr32 /s cdfview.dll
    
50. regsvr32 /s webcheck.dll
    
51. regsvr32 /s mobsync.dll
    
52. regsvr32 /s pngfilt.dll
    
53. regsvr32 /s licmgr10.dll
    
54. regsvr32 /s icmfilter.dll
    
55. regsvr32 /s hhctrl.ocx
    
56. regsvr32 /s inetcfg.dll
    
57. regsvr32 /s trialoc.dll
    
58. regsvr32 /s tdc.ocx
    
59. regsvr32 /s MSR2C.DLL
    
60. regsvr32 /s msident.dll
    
61. regsvr32 /s msieftp.dll
    
62. regsvr32 /s xmsconf.ocx
    
63. regsvr32 /s ils.dll
    
64. regsvr32 /s msoeacct.dll
    
65. regsvr32 /s wab32.dll
    
66. regsvr32 /s wabimp.dll
    
67. regsvr32 /s wabfind.dll
    
68. regsvr32 /s oemiglib.dll
    
69. regsvr32 /s directdb.dll
    
70. regsvr32 /s inetcomm.dll
    
71. regsvr32 /s msoe.dll
    
72. regsvr32 /s oeimport.dll
    
73. regsvr32 /s msdxm.ocx
    
74. regsvr32 /s dxmasf.dll
    
75. regsvr32 /s laprxy.dll
    
76. regsvr32 /s l3codecx.ax
    
77. regsvr32 /s acelpdec.ax
    
78. regsvr32 /s mpg4ds32.ax
    
79. regsvr32 /s voxmsdec.ax
    
80. regsvr32 /s danim.dll
    
81. regsvr32 /s Daxctle.ocx
    
82. regsvr32 /s lmrt.dll
    
83. regsvr32 /s datime.dll
    
84. regsvr32 /s dxtrans.dll
    
85. regsvr32 /s dxtmsft.dll
    
86. regsvr32 /s vgx.dll
    
87. regsvr32 /s WEBPOST.DLL
    
88. regsvr32 /s WPWIZDLL.DLL
    
89. regsvr32 /s POSTWPP.DLL
    
90. regsvr32 /s CRSWPP.DLL
    
91. regsvr32 /s FTPWPP.DLL
    
92. regsvr32 /s FPWPP.DLL
    
93. regsvr32 /s FLUPL.OCX
    
94. regsvr32 /s wshom.ocx
    
95. regsvr32 /s wshext.dll
    
96. regsvr32 /s vbscript.dll
    
97. regsvr32 /s wupdinfo.dll
    
98. regsvr32 /s shimgvw.dll
    
99. regsvr32 /s wmpdxm.dll
    
100. regsvr32 /s appwiz.cpl
     
101. regsvr32 /s msi.dll
     
102. regsvr32 /s /i shell32.dll
     
103. regsvr32 /s scrrun.dll mstinit.exe /setup
     
104. regsvr32 /s msnsspc.dll /SspcCreateSspiReg
     
105. regsvr32 /s msapsspc.dll /SspcCreateSspiReg
     
106. del C:\met.bat   

复制代码

重建图标缓存.exe的重建图标缓存功能修改了：
HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics下的Shell Icon Size，值修改为了32
恢复系统默认功能修改了很多东西
自己看吧，都是很正常的东西，太多了...

注：推荐用写字板看，用记事本看很花的

[ 本帖最后由 aarwwefdds 于 2009-1-23 18:05 编辑 ]

germany05400

真是太感谢了！！！