中毒了，卡巴和AVG都杀不掉，如何解决？附SREngLOG.log

显示全部楼层 · 发表于 2007-3-27 19:36:47

中毒了，卡巴和AVG都杀不掉，如何解决？附SREngLOG.log

本机中毒：BAD_STATUS(5) 木马程序 Trojan-Downloader.Win32.Agent.bcc 文件: C:\WINDOWS\Temp\SYSTEM.dat

Trojan-Downloader.Win32.Agent.bcc 文件: c:\windows\system32\drivers\ndcia.sys
木马程序 Trojan-Downloader.Win32.Agent.bcc 文件: C:\WINDOWS\SYSTEM32\DRIVERS\NDCIA.SYS
木马程序 Trojan.Win32.Agent.afb 文件: C:\WINDOWS\system32\drivers\stdio.sys

卡巴和AVG都杀不掉！

附SREngLOG.log

2007-03-27,19:10:07
System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
<Super Rabbit IEPro><C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD> [Super Rabbit Soft]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
<run><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Publisher]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows Publisher]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows Publisher]
<SoundMAXPnP><C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe> [Analog Devices, Inc.]
<SoundMAX><"C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray> [Analog Devices, Inc.]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [(Verified)"RealNetworks, Inc."]
<sdafdsafds><D;]XJOEPXT]ufnq]te262/fyf> [N/A]
<WebThunder><C:\Program Files\Thunder Network\WebThunder\WebThunder.exe> [深圳市迅雷网络技术有限公司]
<UnlockerAssistant><"C:\Program Files\Unlocker\UnlockerAssistant.exe"> []
<kis><"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"> [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<Super Rabbit SRCK><"C:\Program Files\Super Rabbit\MagicSet\SRCK.exe" /autokill:291> [Super Rabbit Soft]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
==================================
启动文件夹
N/A
==================================
服务
[卡巴斯基互联网安全套装 6.0 / AVP][Running/Auto Start]
<"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r><Kaspersky Lab>
[ewido anti-spyware 4.0 guard / ewido anti-spyware 4.0 guard][Stopped/Auto Start]
<><N/A>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[SoundMAX Agent Service / SoundMAX Agent Service (default)][Running/Auto Start]
<C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.>
==================================
驱动程序
[aeaudio / aeaudio][Running/Manual Start]
<system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Stopped/Manual Start]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[AVG Anti-Spyware Clean Driver / AvgAsCln][Running/System Start]
<System32\DRIVERS\AvgAsCln.sys><GRISOFT, s.r.o.>
[dcijhbhh / dcijhbhh][Stopped/Boot Start]
<\SystemRoot\system32\drivers\dcijhbhh.sys><N/A>
[ewido anti-spyware 4.0 driver / ewido anti-spyware 4.0 driver][Stopped/System Start]
<\??\C:\Documents and Settings\qing3liu\桌面\ewido\guard.sys><N/A>
[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Running/Manual Start]
<system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
[FlexBIOS Service / FlexBios][Stopped/Manual Start]
<\??\C:\WINDOWS\System32\Drivers\FlexBios.sys><Your Corporation>
[gigdecad / gigdecad][Stopped/Boot Start]
<\SystemRoot\system32\drivers\gigdecad.sys><N/A>
[Flash5 Invoker Service / Invoker][Stopped/Manual Start]
<\??\C:\WINDOWS\System32\Drivers\Invoker.sys><Your Corporation>
[kajfqfqi / kajfqfqi][Stopped/Boot Start]
<\SystemRoot\\SystemRoot\System32\drivers\kajfqfqi.sys><N/A>
[kl1 / kl1][Running/Boot Start]
<\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif][Running/System Start]
<\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[kxsmp / kxsmp][Stopped/Auto Start]
<\??\C:\WINDOWS\system32\drivers\kxsmp.sys><N/A>
[lanfs / lanfs][Stopped/Auto Start]
<\??\C:\WINDOWS\system32\drivers\lanfs.sys><N/A>
[MidiSyn / MidiSyn][Stopped/Manual Start]
<system32\drivers\MidiSyn.sys><Analog Devices Inc>
[msqmx / msqmx][Stopped/Boot Start]
<\SystemRoot\system32\drivers\msqmx.sys><N/A>
[msusbbux / msusbbux][Stopped/Auto Start]
<\??\C:\WINDOWS\system32\drivers\msusbbux.sys><N/A>
[mttvbyfd / mttvbyfd][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\mttvbyfd.sys><Yahoo! China Corporation>
[nv / nv][Running/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[romman / romman][Stopped/Auto Start]
<\??\C:\WINDOWS\system32\drivers\romman.sys><N/A>
[rqrdnw5 / rqrdnw56][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\rqrdnw56.sys><N/A>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[senfilt / senfilt][Running/Manual Start]
<system32\drivers\senfilt.sys><Sensaura>
[SFI Service / sf][Running/System Start]
<system32\drivers\sf.sys><Sonic Focus, Inc>
[Intel (R) System Management BIOS Service / SMBios][Running/Manual Start]
<system32\DRIVERS\SMBios.sys><Intel Corporation>
[Intel(R) SMBus 2.0 Driver / smbusp][Running/Manual Start]
<system32\DRIVERS\intelsmb.sys><Intel Corporation>
[smwdm / smwdm][Running/Manual Start]
<system32\drivers\smwdm.sys><Analog Devices, Inc.>
[TSP / TSP][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
==================================
浏览器加载项
[超级兔子上网精灵]
{7369D35A-5B70-4A5B-B789-B25FE09B4AF3} <C:\PROGRA~1\SUPERR~1\MagicSet\haokanbar.dll, Xiang Feng Technology>
[启动Web迅雷]
{962EFB8E-2683-42d4-AC74-AAA4C759B9C6} <http://my.xunlei.com, N/A>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[快车]
{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\PROGRA~1\FlashGet\flashget.exe, FlashGet.com>
[超级兔子上网精灵]
{43869BB3-22FD-4F15-9B46-238106BA2F4E} <C:\PROGRA~1\SUPERR~1\MagicSet\haokanbar.dll, Xiang Feng Technology>
[Windows Genuine Advantage Validation Tool]
{17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[超级兔子上网精灵]
{7369D35A-5B70-4A5B-B789-B25FE09B4AF3} <C:\PROGRA~1\SUPERR~1\MagicSet\haokanbar.dll, Xiang Feng Technology>
[&使用快车(FlashGet)下载]
<C:\PROGRA~1\FlashGet\jc_link.htm, N/A>
[&使用快车(FlashGet)下载全部链接]
<C:\PROGRA~1\FlashGet\jc_all.htm, N/A>
[使用Web迅雷下载]
<C:\Program Files\Thunder Network\WebThunder\GetUrl.htm, N/A>
[使用Web迅雷下载全部链接]
<C:\Program Files\Thunder Network\WebThunder\GetAllUrl.htm, N/A>
==================================
正在运行的进程
[PID: 600][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 676][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 704][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 752][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\AppPatch\AcAdProc.dll] [Microsoft Corporation, 5.1.2600.3008 (xpsp.061004-0027)]
[PID: 764][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 944][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1012][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1104][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[PID: 1732][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
[C:\Program Files\Unlocker\UnlockerCOM.dll] [N/A, ]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\shellex.dll] [Kaspersky Lab, 6.0.0.299]
[D:\windowsmuma\Commenu.dll] [Fygsoft and Microsoft, 3.0.0.63]
[C:\WINDOWS\system32\PortableDeviceApi.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[PID: 1840][C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe] [Analog Devices, Inc., 5, 0, 2, 1]
[C:\Program Files\Analog Devices\SoundMAX\SMWDMIF.dll] [Analog Devices, Inc., 5, 0, 2, 008]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1856][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] [RealNetworks, Inc., 0.1.0.3760]
[PID: 1892][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1908][C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE] [Super Rabbit Soft, 7.98]
[C:\WINDOWS\system32\msvbvm60.dll] [Microsoft Corporation, 6.00.9690]
[C:\WINDOWS\system32\vb6chs.dll] [Microsoft Corporation, 6.00.8988]
[C:\PROGRA~1\SUPERR~1\MagicSet\shlobj71.ocx] [Sky Software (http://www.ssware.com), 7, 1, 0, 0]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[PID: 204][C:\Program Files\Microsoft Office\Office\WINWORD.EXE] [Microsoft Corporation, 9.0.2823]
[C:\Program Files\Microsoft Office\Office\MSO9.DLL] [Microsoft Corporation, 9.0.2812]
[C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL] [, ]
[C:\PROGRA~1\COMMON~1\System\OLEDB~1\MSDAIPP.DLL] [Microsoft Corporation, 8.103.5219.0]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[C:\PROGRA~1\COMMON~1\MICROS~1\WEBSER~1\40\bin\FP4AWEC.DLL] [Microsoft Corporation, 4.0.2.4715]
[C:\PROGRA~1\COMMON~1\MICROS~1\WEBSER~1\40\bin\fp4Autl.dll] [Microsoft Corporation, 4.0.2.7523]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\UNIDRVUI.DLL] [Microsoft Corporation, 5.2.3790.120 (srv03_qfe.031205-1652)]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\UNIDRV.DLL] [Microsoft Corporation, 5.2.3790.184 (srv03_qfe.040410-1236)]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EPEPCRES.Dll] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\unires.dll] [Microsoft Corporation, 5.2.3790.120 (srv03_qfe.031205-1652)]
[C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL] [Microsoft Corporation, 6.00.8435]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\offguard.dll] [Kaspersky Lab, 6.0.0.299]
[C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\2052\VBE6INTL.DLL] [Microsoft Corporation, 6.00.8435]
[C:\Program Files\Common Files\Microsoft Shared\Proof\wdbrkchs.dll] [Microsoft Corporation, 1.0]
[C:\PROGRA~1\MICROS~2\Office\2052\OBALLOON.DLL] [Microsoft Corporation, 9.0.2720]
[C:\PROGRA~1\MICROS~2\Office\BLNMGRPS.DLL] [, ]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\Common Files\Microsoft Shared\Proof\mslid.dll] [Microsoft Corporation, 1.0.2305]
[C:\WINDOWS\system32\wpdshext.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\WINDOWS\system32\PortableDeviceApi.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\WINDOWS\system32\Audiodev.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\Program Files\Common Files\Microsoft Shared\Web Folders\msows804.dll] [Microsoft Corporation, 9.0.2717]
[PID: 3456][C:\WINDOWS\msagent\AgentSvr.exe] [Microsoft Corporation, 2.00.0.3424]
[C:\Program Files\Microsoft Office\Office\BLNMGR.DLL] [, ]
[PID: 3408][F:\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1 localhost
==================================
API HOOK
RVA 错误： LoadLibraryA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF5723B25)
RVA 错误： LoadLibraryExA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF5723D67)
RVA 错误： LoadLibraryExW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF5723F0B)
RVA 错误： LoadLibraryW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF5723C49)
RVA 错误： GetProcAddress (危险等级: 高, 被下面模块所HOOK: Dest Addr: 0xF5723E8F)
==================================
隐藏进程
N/A
==================================

复制代码

请高手速帮忙解决，谢谢

显示全部楼层 · 发表于 2007-3-27 20:16:32

既然已经得到路径,安全模式下ICESORD配合UNLOCKER手工删除试试

显示全部楼层 · 发表于 2007-3-27 22:17:40

<sdafdsafds><D;]XJOEPXT]ufnq]te262/fyf>  [N/A]
这个启动项删除

[dcijhbhh / dcijhbhh][Stopped/Boot Start]
  <\SystemRoot\system32\drivers\dcijhbhh.sys><N/A>
[gigdecad / gigdecad][Stopped/Boot Start]
  <\SystemRoot\system32\drivers\gigdecad.sys><N/A>
[kajfqfqi / kajfqfqi][Stopped/Boot Start]
  <\SystemRoot\\SystemRoot\System32\drivers\kajfqfqi.sys><N/A>
[kxsmp / kxsmp][Stopped/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\kxsmp.sys><N/A>
[lanfs / lanfs][Stopped/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\lanfs.sys><N/A>
[msqmx / msqmx][Stopped/Boot Start]
  <\SystemRoot\system32\drivers\msqmx.sys><N/A>
[msusbbux / msusbbux][Stopped/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\msusbbux.sys><N/A>
[mttvbyfd / mttvbyfd][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\mttvbyfd.sys><Yahoo! China Corporation>
[romman / romman][Stopped/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\romman.sys><N/A>
[rqrdnw5 / rqrdnw56][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\rqrdnw56.sys><N/A>
这些驱动删除

最后用这个清理一下，安全模式下在用卡吧查一遍

[ 本帖最后由 wangjay1980 于 2007-3-27 22:18 编辑 ]

显示全部楼层 · 发表于 2007-3-30 08:30:23

按阁下所示操作，结果BAD_STATUS(5) 木马程序 Trojan-Downloader.Win32.Agent.bcc 文件: C:\WINDOWS\Temp\SYSTEM.dat仍在。

中毒了，卡巴和AVG都杀不掉，如何解决？附SREngLOG.log

没有作用，Trojan-Downloader.Win32.Agent.bcc还在