求助...高手帮忙看看...眼花了...

qwertttrewq

疯了疯了...下个魔兽私服...希奇古怪地中了招...

咔吧一点反应都没,360查了,说isDrv120恶意软件...清除一遍又一遍...清除时,BlackIce提醒LocalSetting/TEMP下有.EXE运行...结束不结束都自动重新中招...

SRE2扫的东西如下...救命啊...

2007-04-27,09:55:59

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件


启动项目


注册表

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
(ctfmon.exe)(C:\WINDOWS\system32\ctfmon.exe) [(Verified)Microsoft Windows Publisher]
(RAMSaverPro)(C:\Program Files\RAM Saver Pro\ramsaverpro.exe) []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
(kav)("C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe") [Kaspersky Lab]
(racer)(C:\Program Files\racer-han-cnc\racer.exe) [Putian Runway]
(IMJPMIG8.1)(; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32) [(Verified)Microsoft Windows Publisher]
(PHIME2002A)(; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName) [(Verified)Microsoft Windows Publisher]
(PHIME2002ASync)(; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC) [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
(shell)(Explorer.exe) [(Verified)Microsoft Windows Publisher]
(Userinit)(C:\WINDOWS\system32\userinit.exe,) [(Verified)Microsoft Windows Publisher]
(UIHost)(logonui.exe) [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\({12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
(IE7 Uninstall Stub)(C:\WINDOWS\system32\ieudinit.exe) [(Verified)Microsoft Windows Component Publisher]


启动文件夹

[BlackICE Server Protection]
(C:\Documents and Settings\All Users\「开始」菜单\程序\启动\BlackICE Server Protection.lnk --) C:\PROGRA~1\ISS\BlackICE\blackice.exe [Internet Security Systems, Inc.])(N)



服务

[卡巴斯基反病毒6.0 / AVP][Running/Auto Start]
("C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r)(Kaspersky Lab)
[BlackICE / BlackICE][Running/Auto Start]
("C:\Program Files\ISS\BlackICE\blackd.exe")(Internet Security Systems, Inc.)
[Human Interface Device Access / HidServ][Stopped/Disabled]
(C:\WINDOWS\System32\svchost.exe -k netsvcs--)%SystemRoot%\System32\hidserv.dll)(N/A)



驱动程序

[Agere Systems Soft Modem / AgereSoftModem][Running/Manual Start]
(System32\DRIVERS\AGRSM.sys)(Agere Systems)
[Service for WDM 3D Audio Driver / ALCXSENS][Running/Manual Start]
(system32\drivers\ALCXSENS.SYS)(Sensaura Ltd)
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
(system32\drivers\ALCXWDM.SYS)(Realtek Semiconductor Corp.)
[AVG Anti-Spyware Clean Driver / AvgAsCln][Running/System Start]
(System32\DRIVERS\AvgAsCln.sys)(GRISOFT, s.r.o.)
[black / black][Running/Disabled]
(System32\drivers\BlackDrv.sys)(Internet Security Systems, Inc.)
[ENUS_NDIS_DRIVER / ENUS_NDIS_DRIVER][Running/Boot Start]
(\SystemRoot\system32\enusndis.sys)(N/A)
[ialm / ialm][Running/Manual Start]
(System32\DRIVERS\ialmnt5.sys)(Intel Corporation)
[kl1 / kl1][Running/Boot Start]
(\SystemRoot\system32\drivers\kl1.sys)(Kaspersky Lab)
[klif / klif][Running/System Start]
(\??\C:\WINDOWS\system32\drivers\klif.sys)(Kaspersky Lab)
[NetGroup Packet Filter Driver / NPF][Running/Manual Start]
(system32\drivers\npf.sys)(CACE Technologies)
[npkcrypt / npkcrypt][Running/Auto Start]
(\??\C:\Program Files\Tencent\QQ\npkcrypt.sys)(INCA Internet Co., Ltd.)
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
(System32\DRIVERS\ptilink.sys)(Parallel Technologies, Inc.)
[RapDrv / RapDrv][Running/Manual Start]
(\??\C:\WINDOWS\system32\drivers\RapDrv.sys)(Internet Security Systems, Inc.)
[RapFile / RapFile][Running/Manual Start]
(\??\C:\WINDOWS\system32\drivers\RapFile.sys)(Internet Security Systems, Inc.)
[RapNet / RapNet][Running/Manual Start]
(\??\C:\WINDOWS\system32\drivers\RapNet.sys)(Internet Security Systems, Inc.)
[Realtek RTL8139/810x/8169/8110 all in one NDIS NT Driver / RTL8023][Running/Manual Start]
(System32\DRIVERS\Rtlnic51.sys)(Realtek Semiconductor Corporation)
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
(System32\DRIVERS\RTL8139.SYS)(Realtek Semiconductor Corporation)
[Secdrv / Secdrv][Stopped/Manual Start]
(System32\DRIVERS\secdrv.sys)(N/A)
[Intel(R) PRO/Wireless 7100 Adapter 驱动程序 / w70n51][Stopped/Manual Start]
(System32\DRIVERS\w70n51.sys)(Intel? Corporation)
[Intel(R) Graphics Platform (SoftBIOS) Driver / {6080A529-897E-4629-A488-ABA0C29B635E}][Stopped/Manual Start]
(system32\drivers\ialmsbw.sys)(Intel Corporation)
[Intel(R) Graphics Chipset (KCH) Driver / {D31A0762-0CEB-444e-ACFF-B049A1F6FE91}][Stopped/Manual Start]
(system32\drivers\ialmkchw.sys)(Intel Corporation)
[AIM 3.0 Part 01 Codec Driver CH-7009-A/CH-7011 / {E2B953A6-195A-44F9-9BA3-3D5F4E32BB55}][Stopped/Manual Start]
(system32\drivers\wA301a.sys)(Intel Corporation)
[IEProtect / IEProtect][Running/Boot Start]
(\SystemRoot\System32\DRIVERS\IEProtect.sys)(N/A)



浏览器加载项

[ThunderAtOnce Class]
{01443AEC-0FD1-40fd-9C87-E93D1494C233} (C:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD)
[Adobe PDF Reader Link Helper]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated)
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} (C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD)
[Java Plug-in 1.6.0]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} (C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll, Sun Microsystems, Inc.)
[浩方对战平台]
{0A155D3C-68E2-4215-A47A-E800A446447A} (C:\Program Files\浩方对战平台\GameClient.exe, 上海浩方在线信息技术有限公司)
[Web反病毒保护]
{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} (C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll, Kaspersky Lab)
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} (C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation)
[Java Plug-in 1.6.0]
{8AD9C840-044E-11D1-B3E9-00805F499D93} (C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll, Sun Microsystems, Inc.)
[Java Plug-in 1.6.0]
{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} (C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll, Sun Microsystems, Inc.)
[Java Plug-in 1.6.0]
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll, Sun Microsystems, Inc.)
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} (C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.)
[ThunderAtOnce Class]
{01443AEC-0FD1-40FD-9C87-E93D1494C233} (C:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD)
[Adobe PDF Reader Link Helper]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated)
[Web Browser Applet Control]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} (C:\WINDOWS\system32\Msjava.dll, Microsoft Corporation)
[Active Desktop Mover]
{72267F6A-A6F9-11D0-BC94-00C04FB67863} (%SystemRoot%\system32\SHELL32.dll, N/A)
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} (C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD)
[Java Plug-in 1.6.0]
{8AD9C840-044E-11D1-B3E9-00805F499D93} (C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll, Sun Microsystems, Inc.)
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} (%SystemRoot%\System32\shdocvw.dll, N/A)
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} (C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.)
[使用迅雷下载]
(C:\Program Files\Thunder\Program\geturl.htm, N/A)
[使用迅雷下载全部链接]
(C:\Program Files\Thunder\Program\getallurl.htm, N/A)
[导出到 Microsoft Office Excel(&X)]
(res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A)



正在运行的进程

[PID: 488][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 600][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1628][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 8.0.0.0]
[C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.CHS] [Adobe Systems, Inc., 8.0.0.0]
[C:\WINDOWS\system32\igfxpph.dll] [Intel Corporation, 3.0.0.3943]
[C:\WINDOWS\system32\hccutils.DLL] [Intel Corporation, 3.0.0.3943]
[C:\WINDOWS\system32\igfxres.dll] [Intel Corporation, 3.0.0.3943]
[C:\WINDOWS\system32\igfxsrvc.dll] [Intel Corporation, 3.0.0.3943]
[C:\WINDOWS\system32\igfxdev.dll] [Intel Corporation, 3.0.0.3943]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\pr_remote.dll] [Kaspersky Lab, 6.0.0.299]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll] [Kaspersky Lab, 6.0.0.299]
[C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 8.0.0.2006102200]
[C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 2, 17]
[PID: 1812][C:\Program Files\racer-han-cnc\racer.exe] [Putian Runway, 3,3,116,192]
[C:\Program Files\racer-han-cnc\rwxre.dll] [Mozilla Foundation, 1.7.3: 2006072418]
[C:\Program Files\racer-han-cnc\nspr4.dll] [Netscape Communications Corporation, 4.5 Beta]
[C:\Program Files\racer-han-cnc\xpcom.dll] [Mozilla Foundation, 1.7.3: 2006072418]
[C:\Program Files\racer-han-cnc\nss3.dll] [Netscape Communications Corporation, 3.9.1]
[C:\Program Files\racer-han-cnc\softokn3.dll] [Netscape Communications Corporation, 3.9.1]
[C:\Program Files\racer-han-cnc\gkgfx.dll] [Mozilla Foundation, 1.7.3: 2006072418]
[C:\Program Files\racer-han-cnc\xpcom_compat.dll] [Mozilla Foundation, 1.7.3: 2006072418]
[C:\Program Files\racer-han-cnc\js3250.dll] [Netscape Communications Corporation, 4.0]
[C:\Program Files\racer-han-cnc\components\racer_base_comp.dll] [Putian Runway, 3,3,116,192]
[C:\Program Files\racer-han-cnc\racer_base.dll] [Putian Runway, 3,3,116,192]
[C:\Program Files\racer-han-cnc\kbdhook.dll] [Putian Runway, 3,3,116,192]
[C:\Program Files\racer-han-cnc\components\pipnss.dll] [Mozilla Foundation, 1.7.3: 2006072418]
[C:\Program Files\racer-han-cnc\components\gklayout.dll] [Mozilla Foundation, 1.7.3: 2006072418]
[C:\Program Files\racer-han-cnc\components\jar50.dll] [Mozilla Foundation, 1.7.3: 2006072418]
[C:\Program Files\racer-han-cnc\components\xpcom_compat_c.dll] [Mozilla Foundation, 1.7.3: 2006072418]
[C:\Program Files\racer-han-cnc\components\racer_ad_comp.dll] [Putian Runway, 3,3,116,192]
[C:\Program Files\racer-han-cnc\components\racer_access_pppoe.dll] [Putian Runway, 3,3,116,192]
[C:\Program Files\racer-han-cnc\pppoe.dll] [北京润汇科技有限公司, 9, 0, 22, 48]
[C:\Program Files\racer-han-cnc\components\racer_nss4_comp.dll] [Putian Runway, 3,3,116,192]
[C:\Program Files\racer-han-cnc\nss4.dll] [北京润汇科技有限公司, 1, 0, 0, 4]
[C:\Program Files\racer-han-cnc\wpcap.dll] [CACE Technologies, 3, 2, 0, 29]
[C:\Program Files\racer-han-cnc\packet.dll] [CACE Technologies, 3, 2, 0, 29]
[C:\Program Files\racer-han-cnc\WanPacket.dll] [CACE Technologies, 3, 2, 0, 29]
[PID: 1912][C:\Program Files\RAM Saver Pro\ramsaverpro.exe] [N/A, ]
[PID: 2036][C:\Program Files\ISS\BlackICE\blackice.exe] [Internet Security Systems, Inc., 3.6.320]
[C:\Program Files\ISS\BlackICE\FileSec.dll] [Internet Security Systems, Inc., 3.6.319]
[C:\Program Files\ISS\BlackICE\MFC42.DLL] [Microsoft Corporation, 6.00.8665.0]
[PID: 3044][D:\TEMP\sre2\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
[D:\TEMP\sre2\Plugins\NWMON.SRE] [Smallfrogs Studio, 1, 0, 0, 8]
[D:\TEMP\sre2\Plugins\SRECXTMG.SRE] [Smallfrogs Studio, 1, 5, 0, 55]



文件关联

.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]



Winsock 提供者

N/A



Autorun.inf

N/A



HOSTS 文件

N/A



API HOOK

RVA 错误： LoadLibraryA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xEEC7CB25)
RVA 错误： LoadLibraryExA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xEEC7CD67)
RVA 错误： LoadLibraryExW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xEEC7CF0B)
RVA 错误： LoadLibraryW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xEEC7CC49)
RVA 错误： GetProcAddress (危险等级: 高, 被下面模块所HOOK: Dest Addr: 0xEEC7CE8F)



隐藏进程

N/A

qwertttrewq

我被华丽地忽略了么?

wangjay1980

360清理的时候是会在TEMP文件夹里运行清理程序，这个正常，报告也没什么问题，只是有几个可疑的，不过感觉是正常的东西

qwertttrewq

刚打开360重新查的时候...更新了...

然后恶意软件奇迹般的消失了....

网页照弹...广告照旧...

天哪...它耍我么...

wangjay1980

我看你不是装着IE守护吗，怎么还弹广告