木马超多，无法杀除，亟盼赐教（1）！

carolgy

各位前辈：

       本人是新手，借用朋友的笔记本电脑。最近发现无法正常关机，常看的pplive程序也无法缓冲，电脑运行速度变慢。

       无意中发现卡饭，通宵学习了各类精华贴，下载了卡巴、AVG7.5、SRE等相关软件。交替使用瑞星、卡巴、AVG查杀并数次重启后，卡巴仍提示有很多木马程序。

       继续按照精华贴中用删除解锁软件进行删除，并修改注册编辑表后，木马威胁并未解除。

      现将扫描报告附贴上来，敬请各位指教！不胜感激！


[CODE]

2007-04-03,10:35:49

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联

Winsock 提供者

Autorun.inf

HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>
[(Verified)Microsoft Windows Publisher]

<5553vzl><C:\DOCUME~1\t16633\LOCALS~1\Temp\rundl132.exe>
[]

<h3m06qded8sv><C:\DOCUME~1\t16633\LOCALS~1\Temp\servicer.exe>
[]

<swg><C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe>
[(Verified)Google Inc]

<MsnMsgr><"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background>
[(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]

<333><C:\Syswm1h\svchost.exe>
[]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]

<load><>
[N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>
[(Verified)Microsoft Windows Publisher]

<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>
[(Verified)Microsoft Windows Publisher]

<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>
[(Verified)Microsoft Windows Publisher]

<TrackPointSrv><tp4mon.exe>
[(Verified)Microsoft Windows Publisher]

<ATIModeChange><Ati2mdxx.exe>
[(Verified)Microsoft Windows Publisher]

<ATIPTA><C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe>
[ATI Technologies, Inc.]

<IMSCMIG40W><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40W\IMSCMIG.EXE /SetPreload /Log>
[Microsoft Corporation]

<KuGoo3><C:\PROGRA~1\KuGoo3\KuGoo.exe>
[]

<YLive.exe><C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe>
[(Verified)"beijing yahoo consulting and service co., ltd."]

<Microsoft Pinyin IME Migration><C:\PROGRA~1\COMMON~1\MICROS~1\IME12\IMESC\IMSCMIG.EXE /INSTALL>
[(Verified)Microsoft Corporation]

<winform><C:\WINDOWS\winform.exe>
[N/A]

<wsttrs><C:\WINDOWS\wsttrs.exe>
[N/A]

<kav><"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe">
[Kaspersky Lab]

<!AVG Anti-Spyware><"C:\Downloads\AVG Anti-Spyware_7.5\AVG Anti-Spyware 7.5\avgas.exe" /minimized>
[Anti-Malware Development a.s.]

<upxdnd><C:\DOCUME~1\t16633\LOCALS~1\Temp\zz.exe>
[]

<cmdbcs><C:\WINDOWS\cmdbcs.exe>
[]

<UnlockerAssistant><"C:\Program Files\Unlocker\UnlockerAssistant.exe">
[N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

<shell><Explorer.exe>
[(Verified)Microsoft Windows Publisher]

<Userinit><C:\WINDOWS\system32\userinit.exe,>
[(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]

<AppInit_DLLs><>
[N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]


<UIHost><logonui.exe>
[(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

<{4BAB150F-DD97-476D-9C1E-41B6CDC0CA7A}><C:\PROGRA~1\Yahoo!\Assistant\yClickOn.dll>
[(Verified)"beijing yahoo consulting and service co., ltd."]

<{A6011F8F-A7F8-49AA-9ADA-49127D43138F}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.dll>
[N/A]

<{E25C29AB-12B9-4523-A53C-324B5FBA648C}><c:\progra~1\yahoo!\assist~1\jeurtntz.dll>
[]

<{754FB7D8-B8FE-4810-B363-A788CD060F1F}><C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys>
[]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]

<WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll>
[Kaspersky Lab]

==================================
启动文件夹
[腾讯QQ]

<C:\Documents and Settings\t16633\「开始」菜单\程序\启动\腾讯QQ.lnk --> C:\PROGRA~1\Tencent\QQ\QQ.exe [TENCENT]><N>

==================================
服务
[Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start]

<C:\WINDOWS\system32\Ati2evxx.exe><>
[卡巴斯基反病毒6.0 / AVP][Stopped/Auto Start]

<"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r><Kaspersky Lab>
[Google Updater Service / gusvc][Stopped/Manual Start]

<"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"><Google>
[Human Interface Device Access / HidServ][Stopped/Disabled]

<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[IBM PM Service / IBMPMSVC][Running/Auto Start]

<C:\WINDOWS\system32\ibmpmsvc.exe><N/A>
[Machine Debug Manager / MDM][Running/Auto Start]

<"C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe"><Microsoft Corporation>
[P4P Service / P4P Service][Running/Auto Start]

<C:\Program Files\Common Files\Sogou PXP\p2psvr.exe><Sohu.com Inc.>
[Vedio Adapter / VGADown][Running/Auto Start]

<C:\WINDOWS\lsass.exe><N/A>
[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]

<C:\WINDOWS\system32\\rundll32.exe windhcp.ocx,input><Microsoft Corporation>

==================================
驱动程序
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Running/Manual Start]

<system32\drivers\ac97intc.sys><Intel Corporation>
[ati2mtag / ati2mtag][Running/Manual Start]

<system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[ATSpy / ATSpy][Stopped/Manual Start]

<\??\C:\WINDOWS\system32\ATSpy.sys><N/A>
[AVG Anti-Spyware Clean Driver / AvgAsCln][Running/System Start]

<System32\DRIVERS\AvgAsCln.sys><GRISOFT, s.r.o.>
[Intel(R) PRO Adapter Driver / E100B][Running/Manual Start]

<system32\DRIVERS\e100b325.sys><Intel Corporation>
[gmtnktfm / gmtnktfm][Running/Boot Start]

<\SystemRoot\System32\DRIVERS\gmtnktfm.sys><Yahoo! China Corporation>
[IBMPMDRV / IBMPMDRV][Running/Manual Start]

<system32\DRIVERS\ibmpmdrv.sys><IBM Corp.>
[kl1 / kl1][Running/Boot Start]

<\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif][Running/System Start]

<\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[kmsinput / kmsinput][Stopped/Manual Start]

<\??\C:\WINDOWS\system32\drivers\kmsinput.sys><N/A>
[Lucent Technologies Soft Modem / LucentSoftModem][Running/Manual Start]

<system32\DRIVERS\LTSM.sys><Lucent Technologies>
[npkycryp / npkycryp][Stopped/Manual Start]

<\??\C:\Program Files\Tencent\QQ\npkycryp.sys><N/A>
[NSC Infrared Device Driver / NSCIRDA][Running/Manual Start]

<system32\DRIVERS\nscirda.sys><National Semiconductor Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]

<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Secdrv / Secdrv][Stopped/Manual Start]

<system32\DRIVERS\secdrv.sys><N/A>
[TSP / TSP][Stopped/Manual Start]

<\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[IBM PS/2 TrackPoint Filter Driver / TwoTrack][Running/Manual Start]

<system32\DRIVERS\TwoTrack.sys><IBM Corporation>
[yaskp / yaskp][Running/Boot Start]

<\SystemRoot\system32\drivers\yaskp.sys><Copyright (C) yahoo Corporation.>
[npkcrypt / npkcrypt][Running/Auto Start]

<\??\C:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>

==================================
浏览器加载项
[FGCatchUrl]

{2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <C:\Program Files\FlashGet\jccatch.dll, www.flashget.com>
[Yahoo!Photo]

{33BBE430-0E42-4f12-B075-8D21ACB10DCB} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll, Yahoo! China>
[AntiFish Class]

{38928D50-8A48-44C2-945F-D2F23F771410} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll, yahoo! china>
[QQBrowserHelperObject Class]

{54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[DragSearch BHO]

{62EED7C6-9F02-42f9-B634-98E2899E147B} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~2.DLL, yahoo! china>
[Google Toolbar Helper]

{AA58ED58-01DD-4d91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>
[FlashGet GetFlash Class]

{F156768E-81EF-470C-9057-481BA8380DBA} <C:\Program Files\FlashGet\getflash.dll, www.flashget.com>
[assist]

{FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8} <C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yassist.dll, Yahoo! China>
[Web反病毒保护]

{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll, Kaspersky Lab>
[信息检索(&R)]

{92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL, Microsoft Corporation>
[QQ]

{c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[快车]

{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\Program Files\FlashGet\FlashGet.exe, FlashGet.com>
[QQIEFloatBarCfgCmd Class]

{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Messenger]

{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[雅虎助手]


{406F94F0-504F-4A40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar0.dll, yahoo! china>
[&Google]

{2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>
[MMCPlayer Class]

{05C1004E-2596-48E5-8E26-39362985EEB9} <C:\Program Files\feidianTV\MMCShell.dll, N/A>
[Edit Class]

{0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\WINDOWS\system32\CMBEdit.dll, >
[Shockwave Flash Object]

{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[UpdateC2 Control]

{DC7094C6-8F61-42ED-AECE-63F5EEF647C5} <C:\PROGRA~1\UUSee\updateC2.ocx, uusee.com>
[金山毒霸在线产品升级]

{E847C78C-C210-4195-8799-FBF3BF89797D} <C:\PROGRA~1\KOS\KOSInit.OCX, 金山软件股份有限公司>
[MMCPlayer Class]

{05C1004E-2596-48E5-8E26-39362985EEB9} <C:\Program Files\feidianTV\MMCShell.dll, N/A>
[Edit Class]

{0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\WINDOWS\system32\CMBEdit.dll, >
[EWA Control]

{18226BF8-DC0B-4D81-80E9-A41AE37BB73A} <C:\PROGRA~1\PPLive\SYNACA~2.OCX, Synacast>
[Windows Media Player]

{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[&Google]

{2318C2B1-4965-11D4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>
[HTML Document]

{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]

{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[FGCatchUrl]

{2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <C:\Program Files\FlashGet\jccatch.dll, www.flashget.com>
[Yahoo!Photo]

{33BBE430-0E42-4F12-B075-8D21ACB10DCB} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll, Yahoo! China>
[AntiFish Class]

{38928D50-8A48-44C2-945F-D2F23F771410} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll, yahoo! china>
[雅虎助手]

{406F94F0-504F-4A40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar0.dll, yahoo! china>
[HHCtrl Object]

{52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[QQBrowserHelperObject Class]

{54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Shell Name Space]

{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Yahoo!Live]

{57421194-58FB-49AE-9B4F-FD48869B9AD4} <C:\Program Files\Yahoo!\Assistant\yaLive.dll, yahoo! china>
                                                                                     （未完，待续）

chr707

先顶了！！！

有360没有？？？我看到你的那个雅虎助手就是恶意软件

你先试试看。你怎么用卡巴还有 瑞新呢？？  没有冲突？？？

一般卡巴就可以解决问题的。你把avg 装上去扫！

它扫木马很厉害的！！！

最后祝你成功

听雨醉

你的几个帖我都看了，只略微看了下，你电脑中病毒太多了。

方法：
1、升级卡巴斯基至最新病毒库。然后卸载瑞星，不然二者有冲突。AVG可以装上。
2、下载用360安全卫士、恶意软件清理助手等软件，也要升级最新。你的电脑中流氓太多了。可到反病毒、木马、流氓程序、广告程序区  去看看。
3、删除IE缓存、临时文件等，断网。
4、至少要到安全模式下查杀。（开机按F8……）

carolgy

谢谢，已经照您教的方法试过了，搞定！再次感谢！

晃晃悠悠

这些帖子不应该发在会员服务区的，警告！下不为例！！