收藏本站 |切换到宽版 | 更换论坛皮肤
 找回密码  忘记邮箱  QQ快速登录  快速登录  快速注册

卡饭»论坛 › 安全区 › 原创工具区 › 删除不了Trojan-Downloader.Win32.Agent.bcc
返回列表 发新帖
查看: 3241|回复: 6
收起左侧

删除不了Trojan-Downloader.Win32.Agent.bcc

[复制链接]
aq3333
发表于 2007-3-30 09:58:45 | 显示全部楼层 |阅读模式
多谢楼主指点，不过按楼主所示操作，结果BAD_STATUS(5) 木马程序 Trojan-Downloader.Win32.Agent.bcc        文件: C:\WINDOWS\Temp\SYSTEM.dat仍在。附操作后的扫描报告：


  3. 2007-03-30,09:50:58

  5. System Repair Engineer 2.4.12.806
  6. Smallfrogs (http://www.KZTechs.com)

  8. Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

  10. 以下内容被选中：
  11.     所有的启动项目（包括注册表、启动文件夹、服务等）
  12.     浏览器加载项
  13.     正在运行的进程（包括进程模块信息）
  14.     文件关联
  15.     Winsock 提供者
  16.     Autorun.inf
  17.     HOSTS 文件


  20. 启动项目
  21. 注册表
  22. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  23.     <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
  24.     <Super Rabbit IEPro><C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD>  [Super Rabbit Soft]
  25. [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  26.     <run><>  [N/A]
  27. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  28.     <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Publisher]
  29.     <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Publisher]
  30.     <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows Publisher]
  31.     <SoundMAXPnP><C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe>  [Analog Devices, Inc.]
  32.     <SoundMAX><"C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray>  [Analog Devices, Inc.]
  33.     <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [(Verified)"RealNetworks, Inc."]
  34.     <UnlockerAssistant><"C:\Program Files\Unlocker\UnlockerAssistant.exe">  []
  35.     <kis><"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe">  [Kaspersky Lab]
  36.     <Windows木马防火墙><D:\windowsmuma\Trojanwall.exe>  [风云谷]
  37. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  38.     <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
  39.     <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
  40. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  41.     <AppInit_DLLs><>  [N/A]
  42. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  43.     <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]

  45. ==================================
  46. 启动文件夹
  47. N/A

  49. ==================================
  50. 服务
  51. [卡巴斯基互联网安全套装 6.0 / AVP][Running/Auto Start]
  52.   <"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r><Kaspersky Lab>
  53. [ewido anti-spyware 4.0 guard / ewido anti-spyware 4.0 guard][Stopped/Auto Start]
  54.   <><N/A>
  55. [Human Interface Device Access / HidServ][Stopped/Disabled]
  56.   <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
  57. [SoundMAX Agent Service / SoundMAX Agent Service (default)][Running/Auto Start]
  58.   <C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.>

  60. ==================================
  61. 驱动程序
  62. [aeaudio / aeaudio][Running/Manual Start]
  63.   <system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
  64. [Service for Realtek AC97 Audio (WDM) / ALCXWDM][Stopped/Manual Start]
  65.   <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
  66. [AVG Anti-Spyware Clean Driver / AvgAsCln][Running/System Start]
  67.   <System32\DRIVERS\AvgAsCln.sys><GRISOFT, s.r.o.>
  68. [ewido anti-spyware 4.0 driver / ewido anti-spyware 4.0 driver][Stopped/System Start]
  69.   <\??\C:\Documents and Settings\qing3liu\桌面\ewido\guard.sys><N/A>
  70. [VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Running/Manual Start]
  71.   <system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
  72. [FlexBIOS Service / FlexBios][Stopped/Manual Start]
  73.   <\??\C:\WINDOWS\System32\Drivers\FlexBios.sys><Your Corporation>
  74. [Flash5 Invoker Service / Invoker][Stopped/Manual Start]
  75.   <\??\C:\WINDOWS\System32\Drivers\Invoker.sys><Your Corporation>
  76. [keshkco / keshkco][Stopped/Boot Start]
  77.   <\SystemRoot\\SystemRoot\System32\drivers\keshkco.sys><N/A>
  78. [kl1 / kl1][Running/Boot Start]
  79.   <\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
  80. [klif / klif][Running/System Start]
  81.   <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
  82. [MidiSyn / MidiSyn][Stopped/Manual Start]
  83.   <system32\drivers\MidiSyn.sys><Analog Devices Inc>
  84. [msusbbux / msusbbux][Stopped/Auto Start]
  85.   <\??\C:\WINDOWS\system32\drivers\msusbbux.sys><N/A>
  86. [nv / nv][Running/Manual Start]
  87.   <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
  88. [Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  89.   <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
  90. [R0A / R0A][Stopped/Manual Start]
  91.   <\??\C:\WINDOWS\system32\a 30500.sys><N/A>
  92. [Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
  93.   <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
  94. [Secdrv / Secdrv][Stopped/Manual Start]
  95.   <system32\DRIVERS\secdrv.sys><N/A>
  96. [senfilt / senfilt][Running/Manual Start]
  97.   <system32\drivers\senfilt.sys><Sensaura>
  98. [SFI Service / sf][Running/System Start]
  99.   <system32\drivers\sf.sys><Sonic Focus, Inc>
  100. [Intel (R) System Management BIOS Service / SMBios][Running/Manual Start]
  101.   <system32\DRIVERS\SMBios.sys><Intel Corporation>
  102. [Intel(R) SMBus 2.0 Driver / smbusp][Running/Manual Start]
  103.   <system32\DRIVERS\intelsmb.sys><Intel Corporation>
  104. [smwdm / smwdm][Running/Manual Start]
  105.   <system32\drivers\smwdm.sys><Analog Devices, Inc.>
  106. [TSP / TSP][Stopped/Manual Start]
  107.   <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>

  109. ==================================
  110. 浏览器加载项
  111. [启动Web迅雷]
  112.   {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} <http://my.xunlei.com, N/A>
  113. [@shdoclc.dll,-866]
  114.   {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
  115. [快车]
  116.   {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\PROGRA~1\FlashGet\flashget.exe, FlashGet.com>
  117. [Windows Genuine Advantage Validation Tool]
  118.   {17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft Corporation>
  119. [Shockwave Flash Object]
  120.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
  121. [Shockwave Flash Object]
  122.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
  123. [&使用快车(FlashGet)下载]
  124.   <C:\PROGRA~1\FlashGet\jc_link.htm, N/A>
  125. [&使用快车(FlashGet)下载全部链接]
  126.   <C:\PROGRA~1\FlashGet\jc_all.htm, N/A>
  127. [使用Web迅雷下载]
  128.   <C:\Program Files\Thunder Network\WebThunder\GetUrl.htm, N/A>
  129. [使用Web迅雷下载全部链接]
  130.   <C:\Program Files\Thunder Network\WebThunder\GetAllUrl.htm, N/A>

  132. ==================================
  133. 正在运行的进程
  134. [PID: 684][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  135. [PID: 708][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  136.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  137. [PID: 752][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  138.     [C:\WINDOWS\AppPatch\AcAdProc.dll]  [Microsoft Corporation, 5.1.2600.3008 (xpsp.061004-0027)]
  139. [PID: 764][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  140. [PID: 940][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  141. [PID: 1008][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  142. [PID: 1104][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  143.     [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
  144. [PID: 1708][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
  145.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  146.     [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
  147.     [C:\Program Files\Unlocker\UnlockerCOM.dll]  [N/A, ]
  148.     [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\shellex.dll]  [Kaspersky Lab, 6.0.0.299]
  149.     [D:\windowsmuma\Commenu.dll]  [Fygsoft and Microsoft, 3.0.0.63]
  150.     [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
  151.     [C:\WINDOWS\system32\WNWB.IME]  [深圳世强软件开发部 www.wn51.com , 2006, 10, 20, 1]
  152.     [F:\AVG Anti-Spyware 7.5\AVG Anti-Spyware 7.5\context.dll]  [Anti-Malware Development a.s., 7, 5, 0, 49]
  153.     [C:\WINDOWS\system32\PortableDeviceApi.dll]  [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
  154. [PID: 1400][C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe]  [Analog Devices, Inc., 5, 0, 2, 1]
  155.     [C:\Program Files\Analog Devices\SoundMAX\SMWDMIF.dll]  [Analog Devices, Inc., 5, 0, 2, 008]
  156.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  157. [PID: 380][C:\Program Files\Analog Devices\SoundMAX\Smax4.exe]  [Analog Devices, Inc., 5, 0, 2, 4]
  158.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  159. [PID: 2012][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3760]
  160. [PID: 1376][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  161. [PID: 856][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
  162.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  163.     [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
  164.     [C:\WINDOWS\system32\WNWB.IME]  [深圳世强软件开发部 www.wn51.com , 2006, 10, 20, 1]
  165.     [C:\WINDOWS\system32\mscoree.dll]  [Microsoft Corporation, 2.0.50727.42 (RTM.050727-4200)]
  166.     [C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorie.dll]  [Microsoft Corporation, 2.0.50727.42 (RTM.050727-4200)]
  167.     [C:\WINDOWS\system32\xpsp3res.dll]  [Microsoft Corporation, 5.1.2600.3059 (xpsp_sp2_gdr.070104-0050)]
  168. [PID: 992][F:\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
  169.     [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]

  171. ==================================
  172. 文件关联
  173. .TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
  174. .EXE  OK. ["%1" %*]
  175. .COM  OK. ["%1" %*]
  176. .PIF  OK. ["%1" %*]
  177. .REG  OK. [regedit.exe "%1"]
  178. .BAT  OK. ["%1" %*]
  179. .SCR  OK. ["%1" /S]
  180. .CHM  OK. ["C:\WINDOWS\hh.exe" %1]
  181. .HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
  182. .INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
  183. .INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
  184. .VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
  185. .JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
  186. .LNK  OK. [{00021401-0000-0000-C000-000000000046}]

  188. ==================================
  189. Winsock 提供者
  190. N/A

  192. ==================================
  193. Autorun.inf
  194. N/A

  196. ==================================
  197. HOSTS 文件
  198. 127.0.0.1       localhost

  200. ==================================
  201. API HOOK
  202. RVA  错误： LoadLibraryA (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0xF57F7B25)
  203. RVA  错误： LoadLibraryExA (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0xF57F7D67)
  204. RVA  错误： LoadLibraryExW (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0xF57F7F0B)
  205. RVA  错误： LoadLibraryW (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0xF57F7C49)
  206. 入口点错误：FreeLibrary (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x5F00002D)
  207. RVA  错误： GetProcAddress (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0xF57F7E8F)

  209. ==================================
  210. 隐藏进程
  211. N/A

  213. ==================================


复制代码

而且“修复入口错误”无法修复“扫描报告中的”API HOOK"的错误，还请各位高手支招，帮忙解决，多谢了！
回复

举报

mj399256
发表于 2007-3-30 12:44:57 | 显示全部楼层
1 杀毒前关闭系统还原：右键 我的电脑 ，属性，系统还原，在所有驱动器上关闭系统还原 打勾即可。
清除IE的临时文件：打开IE 点工具-->Internet选项 : Internet临时文件，点“删除文件”按钮 ，将 删除所有脱机内容 打勾，点确定删除。

2.SREng 删除如下各项
方法看下面的链接，看懂再下手操作！
http://hi.baidu.com/teyqiu/blog/ ... 2346ec54e72351.html

启动项目
注册表

<{B876D045-E0B1-4E79-9359-0B1BF00813EA}><C:\WINDOWS\system32\filter.dll> [N/A]
<WebSecurity><C:\WINDOWS\system32\PvSec.dll> []

==================================
服务

[Network AutoCheck / AutoC]
<c:\Winnt\System32\NTserv.exe><Microsoft Corporation>


==================================
驱动程序
[amdk5 / amdk5]
<\??\C:\WINDOWS\system32\drivers\amdk5.sys><N/A>

[LanPort / LanPort]
<\??\C:\WINDOWS\system32\drivers\LanPort.sys><N/A>

[parcls / parcls]
<\??\C:\WINDOWS\system32\drivers\parcls.sys><N/A>

[SetupNT / SetupNT]
<\SystemRoot\system32\SetupNT.sys><N/A>

[tzccqnhq / tzccqnhq]
<\SystemRoot\System32\DRIVERS\tzccqnhq.sys><N/A>


转载 崔衍渠先生
回复

举报

wangjay1980
发表于 2007-3-30 14:16:23 | 显示全部楼层
用SRE修复这个入口点错误：FreeLibrary (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x5F00002D)，其他的不用修复，修复后再扫个报告
回复

举报

aq3333
 楼主| 发表于 2007-3-30 16:20:25 | 显示全部楼层
用SRE修复不了这个入口点错误：FreeLibrary (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x5F00002D)，用SRE修复，点确定，再查看，错误仍在。
谢谢了，请再指点。
回复

举报

aq3333
 楼主| 发表于 2007-3-30 16:24:26 | 显示全部楼层

删除不了Trojan-Downloader.Win32.Agent.bcc

请教崔衍渠先生：
删除不了Trojan-Downloader.Win32.Agent.bcc


多谢楼主指点，不过按楼主所示操作，结果BAD_STATUS(5) 木马程序 Trojan-Downloader.Win32.Agent.bcc        文件: C:\WINDOWS\Temp\SYSTEM.dat仍在。附操作后的扫描报告：

[Copy to clipboard] [ - ]CODE:
2007-03-30,09:50:58

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
    <Super Rabbit IEPro><C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD>  [Super Rabbit Soft]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <run><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Publisher]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Publisher]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows Publisher]
    <SoundMAXPnP><C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe>  [Analog Devices, Inc.]
    <SoundMAX><"C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray>  [Analog Devices, Inc.]
    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [(Verified)"RealNetworks, Inc."]
    <UnlockerAssistant><"C:\Program Files\Unlocker\UnlockerAssistant.exe">  []
    <kis><"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe">  [Kaspersky Lab]
    <Windows木马防火墙><D:\windowsmuma\Trojanwall.exe>  [风云谷]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]

==================================
启动文件夹
N/A

==================================
服务
[卡巴斯基互联网安全套装 6.0 / AVP][Running/Auto Start]
  <"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r><Kaspersky Lab>
[ewido anti-spyware 4.0 guard / ewido anti-spyware 4.0 guard][Stopped/Auto Start]
  <><N/A>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[SoundMAX Agent Service / SoundMAX Agent Service (default)][Running/Auto Start]
  <C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.>

==================================
驱动程序
[aeaudio / aeaudio][Running/Manual Start]
  <system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Stopped/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[AVG Anti-Spyware Clean Driver / AvgAsCln][Running/System Start]
  <System32\DRIVERS\AvgAsCln.sys><GRISOFT, s.r.o.>
[ewido anti-spyware 4.0 driver / ewido anti-spyware 4.0 driver][Stopped/System Start]
  <\??\C:\Documents and Settings\qing3liu\桌面\ewido\guard.sys><N/A>
[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Running/Manual Start]
  <system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
[FlexBIOS Service / FlexBios][Stopped/Manual Start]
  <\??\C:\WINDOWS\System32\Drivers\FlexBios.sys><Your Corporation>
[Flash5 Invoker Service / Invoker][Stopped/Manual Start]
  <\??\C:\WINDOWS\System32\Drivers\Invoker.sys><Your Corporation>
[keshkco / keshkco][Stopped/Boot Start]
  <\SystemRoot\\SystemRoot\System32\drivers\keshkco.sys><N/A>
[kl1 / kl1][Running/Boot Start]
  <\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif][Running/System Start]
  <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[MidiSyn / MidiSyn][Stopped/Manual Start]
  <system32\drivers\MidiSyn.sys><Analog Devices Inc>
[msusbbux / msusbbux][Stopped/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\msusbbux.sys><N/A>
[nv / nv][Running/Manual Start]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[R0A / R0A][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\a 30500.sys><N/A>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[senfilt / senfilt][Running/Manual Start]
  <system32\drivers\senfilt.sys><Sensaura>
[SFI Service / sf][Running/System Start]
  <system32\drivers\sf.sys><Sonic Focus, Inc>
[Intel (R) System Management BIOS Service / SMBios][Running/Manual Start]
  <system32\DRIVERS\SMBios.sys><Intel Corporation>
[Intel(R) SMBus 2.0 Driver / smbusp][Running/Manual Start]
  <system32\DRIVERS\intelsmb.sys><Intel Corporation>
[smwdm / smwdm][Running/Manual Start]
  <system32\drivers\smwdm.sys><Analog Devices, Inc.>
[TSP / TSP][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>

==================================
浏览器加载项
[启动Web迅雷]
  {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} <http://my.xunlei.com, N/A>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[快车]
  {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\PROGRA~1\FlashGet\flashget.exe, FlashGet.com>
[Windows Genuine Advantage Validation Tool]
  {17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[&使用快车(FlashGet)下载]
  <C:\PROGRA~1\FlashGet\jc_link.htm, N/A>
[&使用快车(FlashGet)下载全部链接]
  <C:\PROGRA~1\FlashGet\jc_all.htm, N/A>
[使用Web迅雷下载]
  <C:\Program Files\Thunder Network\WebThunder\GetUrl.htm, N/A>
[使用Web迅雷下载全部链接]
  <C:\Program Files\Thunder Network\WebThunder\GetAllUrl.htm, N/A>

==================================
正在运行的进程
[PID: 684][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 708][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 752][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\AppPatch\AcAdProc.dll]  [Microsoft Corporation, 5.1.2600.3008 (xpsp.061004-0027)]
[PID: 764][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 940][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1008][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1104][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
[PID: 1708][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
    [C:\Program Files\Unlocker\UnlockerCOM.dll]  [N/A, ]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\shellex.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\windowsmuma\Commenu.dll]  [Fygsoft and Microsoft, 3.0.0.63]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
    [C:\WINDOWS\system32\WNWB.IME]  [深圳世强软件开发部 www.wn51.com , 2006, 10, 20, 1]
    [F:\AVG Anti-Spyware 7.5\AVG Anti-Spyware 7.5\context.dll]  [Anti-Malware Development a.s., 7, 5, 0, 49]
    [C:\WINDOWS\system32\PortableDeviceApi.dll]  [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[PID: 1400][C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe]  [Analog Devices, Inc., 5, 0, 2, 1]
    [C:\Program Files\Analog Devices\SoundMAX\SMWDMIF.dll]  [Analog Devices, Inc., 5, 0, 2, 008]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 380][C:\Program Files\Analog Devices\SoundMAX\Smax4.exe]  [Analog Devices, Inc., 5, 0, 2, 4]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 2012][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3760]
[PID: 1376][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 856][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
    [C:\WINDOWS\system32\WNWB.IME]  [深圳世强软件开发部 www.wn51.com , 2006, 10, 20, 1]
    [C:\WINDOWS\system32\mscoree.dll]  [Microsoft Corporation, 2.0.50727.42 (RTM.050727-4200)]
    [C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorie.dll]  [Microsoft Corporation, 2.0.50727.42 (RTM.050727-4200)]
    [C:\WINDOWS\system32\xpsp3res.dll]  [Microsoft Corporation, 5.1.2600.3059 (xpsp_sp2_gdr.070104-0050)]
[PID: 992][F:\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1       localhost

==================================
API HOOK
RVA  错误： LoadLibraryA (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0xF57F7B25)
RVA  错误： LoadLibraryExA (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0xF57F7D67)
RVA  错误： LoadLibraryExW (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0xF57F7F0B)
RVA  错误： LoadLibraryW (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0xF57F7C49)
入口点错误：FreeLibrary (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x5F00002D)
RVA  错误： GetProcAddress (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0xF57F7E8F)

==================================
隐藏进程
N/A

==================================
而且“修复入口错误”无法修复“扫描报告中的”API HOOK"的错误，请帮忙解决，多谢了！
回复

举报

wangjay1980
发表于 2007-3-30 17:45:39 | 显示全部楼层
在安全模式下修复试试
回复

举报

aq3333
 楼主| 发表于 2007-4-1 15:08:15 | 显示全部楼层
试过，没有用，谢谢
回复

举报

返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2024-12-22 21:20 , Processed in 0.128389 second(s), 17 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究，不得将上述内容用于商业或者其他非法用途，否则产生的一切后果自负，本站信息来自网络，版权争议问题与本站无关，您必须在下载后的24小时之内从您的电脑中彻底删除上述信息，如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表