请高手帮帮忙,机器中木马,杀不了,附hijackthis的扫描记录帮看看

lhuang2006

已清空过各种临时记录,在安全模式下查杀,找不到木马,可每次开机都有如下提示:
已检测
------
状态 对象
---- ----
已检测到: 广告程序 not-a-virus:AdWare.Win32.Guanggao.a URL: http://www.oamo.com/setup.exe/ASPack
已删除: 广告程序 not-a-virus:AdWare.Win32.Guanggao.a 文件: D:\常用软件\setup.exe.jc!/ASPack
已检测到: 木马程序 Trojan-Downloader.Win32.Delf.bal URL: http://www.gameput.com/link.exe/data.rar/tan.exe/UPack
已删除: 木马程序 Trojan-Downloader.Win32.Delf.bal 文件: D:\常用软件\link.exe/data.rar\tan.exe/UPack
已检测到: 木马程序 Trojan-Downloader.VBS.Psyme.cy URL: http://www.zzyqr.com/lm/wm.htm
已删除: 木马程序 Trojan-Downloader.JS.Psyme.cm 文件: C:\Documents and Settings\Lhuang\Local Settings\Temp\Temporary Internet Files\Content.IE5\GPABGLUJ\cmnt_xml[1].js
已删除: 木马程序 Trojan-Downloader.JS.Psyme.cm 文件: C:\Documents and Settings\Lhuang\Local Settings\Temporary Internet Files\Content.IE5\7ASJV1CL\cmnt_skin_v4[1].js
已删除: 木马程序 Trojan-Downloader.JS.Psyme.cm 文件: C:\Documents and Settings\Lhuang\Local Settings\Temporary Internet Files\Content.IE5\SJDFYAV5\cmnt_xml[2].js
已删除: 木马程序 Trojan-Downloader.JS.Psyme.cm 文件: C:\Documents and Settings\Lhuang\Local Settings\Temporary Internet Files\Content.IE5\UX5Q7YD4\visual_effects[1].js
已删除: 木马程序 Trojan-Downloader.JS.Psyme.cm 文件: D:\Maxthon\Language\Chinese\js\ajax.js
已删除: 木马程序 Trojan-Downloader.JS.Psyme.cm 文件: D:\Maxthon\Language\Chinese\js\feed.js
已删除: 木马程序 Trojan-Downloader.JS.Psyme.cm 文件: D:\Maxthon\Language\Chinese\js\general.js
已检测到: 木马程序 Trojan-Downloader.JS.IstBar.ai URL: http://down.jaox.cn/Software/Catalog33/300.html
已删除: 广告程序 not-a-virus:AdWare.Win32.SearchBar.d 文件: D:\常用软件\IPQQ06453.exe/stream/data1705/data0002
已检测到: 木马程序 Trojan-Downloader.VBS.Small.bu 脚本: [url=http://my.winzheng.com/html/index.html[1]http://my.winzheng.com/html/index.html[1[/url]]
已删除: 广告程序 not-a-virus:AdWare.Win32.Dm.e 文件: G:\AutoCAD2007_chs\AutoCAD2007简体中文版\Bin\AcadFEUI\Program Files\Root\Support\dfst.dll/UPX
已删除: 广告程序 not-a-virus:AdWare.Win32.Dm.e 文件: E:\TDDownload\AutoCAD2007_chs.rar\AutoCAD2007简体中文版\Bin\acadFeui\Program Files\Root\Support\dfst.dll/UPX
下面是hijackthis的扫描记录:
Logfile of HijackThis v1.99.1
Scan saved at 16:40:34, on 2007-4-17
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
D:\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
D:\ASUS\AI Nap\AiNap.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
D:\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
d:\Grisoft\AVG Anti-Spyware 7.5\guard.exe
D:\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
d:\MagicTune Premium\MagicTuneEngine.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
d:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
d:\MagicTune Premium\MagicTune.exe
C:\WINDOWS\system32\NOTEPAD.EXE
E:\电脑安全常用工具\ha_hijackthis_1991\HijackThis.exe
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - D:\FlashGet\jccatch.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - d:\Tencent\QQ\QQIEHelper.dll
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - d:\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - D:\FlashGet\getflash.dll
O3 - Toolbar: 快车(FlashGet) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\FlashGet\fgiebar.dll
O3 - Toolbar: BitComet工具栏 - {3F1ABCDB-A875-46c1-8345-B72A4567E486} - d:\BitComet\BitCometBar\BitCometBar0.6.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [kav] "D:\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Ai Nap] "d:\ASUS\AI Nap\AiNap.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Microsoft Pinyin IME Migration] C:\PROGRA~1\COMMON~1\MICROS~1\IME12\IMESC\IMSCMIG.EXE /INSTALL
O4 - HKLM\..\Run: [SoundMAX] ; "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
O4 - HKLM\..\Run: [SoundMAXPnP] ; C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [StormCodec_Helper] ; "d:\Ringz Studio\Storm Codec\StormSet.exe" /S /opti
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "d:\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: AutoCAD 启动加速器.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart17.exe
O8 - Extra context menu item: &使用快车(FlashGet)下载 - D:\FlashGet\jc_link.htm
O8 - Extra context menu item: &使用快车(FlashGet)下载全部链接 - D:\FlashGet\jc_all.htm
O8 - Extra context menu item: &使用迅雷下载 - d:\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - d:\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Tencent\QQ\AddEmotion.htm
O9 - Extra button: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - d:\Thunder Network\Thunder\Thunder.exe
O9 - Extra 'Tools' menuitem: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - d:\Thunder Network\Thunder\Thunder.exe
O9 - Extra button: Web反病毒保护 - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Tencent\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Tencent\QQ\QQ.EXE
O9 - Extra button: 快车 - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: 快车(FlashGet) - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - d:\Tencent\QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - d:\Tencent\QQ\QQIEHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - d:\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: 卡巴斯基反病毒软件6.0 (AVP) - Unknown owner - D:\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: MagicTuneEngine - Unknown owner - d:\MagicTune Premium\MagicTuneEngine.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - d:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
请各位高手帮帮忙,哦,对了,在用ICESWORDL进行SSDT扫描中,提示有个函数模块所在地址与原始地址不符,所在位置是:\??\C:\windows\system32\drivers\klif.sys,看到是个驱动的我不敢乱动,各位高手帮帮忙.

ooo-ppp

到卡饭http://bbs.kafan.cn/viewthread.php?tid=71602&extra=page%3D3看看，下载syscheck2v1.0.069使用进程查看病毒路径记下后使用安全环境功能，用文件浏览删除病毒。用注册表编辑器清理后重启。
           利用狙剑5010
            1、锁定计算机
            2、在自启动项中删除所有可疑启动项后（利用创建、写入时间对比，结合文件属性）
            3、再重启计算机
            4、用狙剑检查内核、ssdt、fsd等项目有无可疑项目恢复后，再清除启动项相关内容
            5、进程中反注册后卸载并删除病毒模块
            
这样就可以清掉了，无论是进程也好、进程注入也好，都依赖于自启动项中注册才能开机自启动，清掉其自启动项后，它们自然也就无法启动了，也就成了任人宰割的死马了。
       也可到http://www.zhulinfeng.com/bbs/逛一逛，看看木马查杀图解攻略。

一天一天过

klif.sys应该是卡巴的东西；
修复：O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
卡巴服务有问题，覆盖安装试试

wangjay1980

C:\WINDOWS\system32\NOTEPAD.EXE
这个有问题，正常的 notepad.exe 应该在C:\WINDOWS下，先用这个查杀，修复安装一下卡巴在安全模式下在查

lhuang2006

版主,你给的附件下不了

lhuang2006

用arswp查只查出个BT载的工具栏,卡巴修复后还是一样,:\??\C:\windows\system32\drivers\klif.sys还是在,回到安全模式下也查不出

wangjay1980

那就扫个报告

一天一天过

搜索了一下，notepad.exe在机子的windows目录下、system32目录下以及dllcache目录下都有啊