这个病毒是什么东东,老是删不了,已扫描了报告上来了,请看看

烟水寒云

以下的问题还有没有更好的办法解决啊?昨天用了论坛老大的UNLOCK解锁删除,再清理注册表,再杀毒.今天一开机先是卡巴无法更新,重启动后.更新的同时就弹出附件里面的对话框.怎么办啊?
   另外,这两天为什么老是提示激活日期错误啊?

[ 本帖最后由 烟水寒云 于 2007-5-21 15:34 编辑 ]

独孤犬

刚刚在360上面也看到这个病毒  同样杀不掉它  楼主试试在安全模式下手工杀除

zhaonimm

用这个  选择抑制生成  看可以不  最好清理下注册表！还有临时文件！不行就用SRENG扫个报告来看看把！！

烟水寒云

以上二楼三楼两位兄弟的办法都杀不死此毒.有时候看起来没有了,但是有时候有会重新生成,在桌面上还有一个方框里面像个S形的图标!!为什么会是这样??/难道真杀不死此UPXDND.DLL的病毒了????高手都进来看看啊?

hljbhs

我进厂经常是进入安全模式杀掉它

烟水寒云

在安全模式下也杀不了/看着好像杀了.但是重启动后卡巴又报

烟水寒云

SRENG扫描的报告怎么上传啊?能否发个邮箱传送呢?

观弈书童

直接复制到论坛回复就行了

烟水寒云

1. 
   
2. 2007-05-21,11:51:46                     请帮忙看看
   
3. System Repair Engineer 2.4.12.806
   
4. Smallfrogs (http://www.KZTechs.com)
   
5. Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
   
6. 以下内容被选中：
   
7.     所有的启动项目（包括注册表、启动文件夹、服务等）
   
8.     浏览器加载项
   
9.     正在运行的进程（包括进程模块信息）
   
10.     文件关联
    
11.     Winsock 提供者
    
12.     Autorun.inf
    
13.     HOSTS 文件
    
14. 
    
15. 启动项目
    
16. 注册表
    
17. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    
18.     <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
    
19.     <1s658cy0fqzkte><C:\DOCUME~1\asus\LOCALS~1\Temp\iexpl0re.exe>  [N/A]
    
20. [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    
21.     <load><>  [N/A]
    
22.     <run><>  [N/A]
    
23. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    
24.     <IgfxTray><; C:\WINDOWS\system32\igfxtray.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    
25.     <HotKeysCmds><; C:\WINDOWS\system32\hkcmd.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    
26.     <Persistence><; C:\WINDOWS\system32\igfxpers.exe>  [(Verified)Microsoft Windows Publisher]
    
27.     <HControl><C:\WINDOWS\ATK0100\HControl.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    
28.     <High Definition Audio 属性页快捷方式><HDAShCut.exe>  [(Verified)Microsoft Windows XP Publisher]
    
29.     <SynTPEnh><C:\Program Files\Synaptics\SynTP\SynTPEnh.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    
30.     <Wireless Console 2><C:\Program Files\Wireless Console 2\wcourier.exe>  []
    
31.     <IntelZeroConfig><"C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe">  [Intel Corporation]
    
32.     <IntelWireless><"C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless>  [Intel Corporation]
    
33.     <ACMON><C:\Program Files\ASUS\Splendid\ACMON.exe>  [ATK]
    
34.     <kis><"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe">  [Kaspersky Lab]
    
35.     <WebThunder><; D:\Program Files\Thunder Network\WebThunder\WebThunder.exe>  [(Verified)ShenZhen Thunder Networking Technologies Ltd.]
    
36.     <upxdnd><C:\WINDOWS\upxdnd.exe>  []
    
37. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    
38.     <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
    
39.     <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
    
40. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    
41.     <AppInit_DLLs><C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll>  [Kaspersky Lab]
    
42. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    
43.     <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
    
44. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    
45.     <{42A612A4-4334-4424-4234-42261A31A236}><>  [N/A]
    
46. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
    
47.     <WinlogonNotify: igfxcui><igfxdev.dll>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    
48. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
    
49.     <WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll>  [Kaspersky Lab]
    
50. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
    
51.     <WinlogonNotify: WgaLogon><WgaLogon.dll>  [(Verified)Microsoft Corporation]
    
52. ==================================
    
53. 启动文件夹
    
54. [Adobe Reader Speed Launch]
    
55.   <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Reader Speed Launch.lnk --> D:\PROGRA~1\Adobe\Reader\READER~1.EXE [Adobe Systems Incorporated]><H>
    
56. [卸载阿里旺旺(淘宝版)]
    
57.   <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\卸载阿里旺旺(淘宝版).lnk --> D:\PROGRA~1\Alisoft\WangWang\UNWISE.EXE [N/A]><H>
    
58. [阿里旺旺(淘宝版)]
    
59.   <C:\Documents and Settings\asus\「开始」菜单\程序\启动\阿里旺旺(淘宝版).lnk --> D:\PROGRA~1\Alisoft\WangWang\WangWang.exe [阿里软件（中国）有限公司]><H>
    
60. ==================================
    
61. 服务
    
62. [卡巴斯基互联网安全套装 6.0 / AVP][Running/Auto Start]
    
63.   <"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r><Kaspersky Lab>
    
64. [Intel(R) PROSet/Wireless Event Log / EvtEng][Running/Auto Start]
    
65.   <C:\Program Files\Intel\Wireless\Bin\EvtEng.exe><Intel Corporation>
    
66. [Human Interface Device Access / HidServ][Stopped/Disabled]
    
67.   <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
    
68. [Intel(R) PROSet/Wireless Registry Service / RegSrvc][Running/Auto Start]
    
69.   <C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe><Intel Corporation>
    
70. [Intel(R) PROSet/Wireless Service / S24EventMonitor][Running/Auto Start]
    
71.   <C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe><Intel Corporation>
    
72. [WinWMServiceNow / WinWMServiceNow][Stopped/Auto Start]
    
73.   <><N/A>
    
74. ==================================
    
75. 驱动程序
    
76. [ADI UAA Function Driver for High Definition Audio Service / ADIHdAudAddService][Running/Manual Start]
    
77.   <system32\drivers\ADIHdAud.sys><Analog Devices, Inc.>
    
78. [AEGIS Protocol (IEEE 802.1x) v3.5.3.0 / AegisP][Running/Auto Start]
    
79.   <system32\DRIVERS\AegisP.sys><Meetinghouse Data Communications>
    
80. [Microsoft 用于 High Definition Audio 服务的 UAA 功能驱动程序 / HdAudAddService][Stopped/Manual Start]
    
81.   <system32\drivers\HdAudio.sys><Windows (R) Server 2003 DDK provider>
    
82. [Microsoft 用于 High Definition Audio 的 UAA 总线驱动程序 / HDAudBus][Running/Manual Start]
    
83.   <system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
    
84. [ialm / ialm][Running/Manual Start]
    
85.   <system32\DRIVERS\igxpmp32.sys><Intel Corporation>
    
86. [kl1 / kl1][Running/Boot Start]
    
87.   <\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
    
88. [klif / klif][Running/System Start]
    
89.   <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
    
90. [Motorola Messenger Modem Audio Device / M3AD][Running/Manual Start]
    
91.   <system32\drivers\m3aux.sys><Motorola Inc>
    
92. [ATK0100 ACPI UTILITY / MTsensor][Running/Manual Start]
    
93.   <system32\DRIVERS\ATKACPI.sys><>
    
94. [用于 Windows XP 32 Bit 版的英特尔(R) PRO/无线 3945ABG 适配器驱动程序 / NETw3x32][Running/Manual Start]
    
95.   <system32\DRIVERS\NETw3x32.sys><Intel? Corporation>
    
96. [npkcrypt / npkcrypt][Running/Auto Start]
    
97.   <\??\D:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
    
98. [Direct Parallel Link Driver / Ptilink][Running/Manual Start]
    
99.   <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
    
100. [rimmptsk / rimmptsk][Running/Manual Start]
     
101.   <system32\DRIVERS\rimmptsk.sys><REDC>
     
102. [rimsptsk / rimsptsk][Running/Manual Start]
     
103.   <system32\DRIVERS\rimsptsk.sys><REDC>
     
104. [Ricoh xD-Picture Card Driver / rismxdp][Running/Manual Start]
     
105.   <system32\DRIVERS\rixdptsk.sys><REDC>
     
106. [Realtek 10/100/1000 NIC Family all in one NDIS XP Driver / RTL8023xp][Running/Manual Start]
     
107.   <system32\DRIVERS\Rtenicxp.sys><Realtek Semiconductor Corporation>
     
108. [WLAN Transport / s24trans][Running/Auto Start]
     
109.   <system32\DRIVERS\s24trans.sys><Intel Corporation>
     
110. [Secdrv / Secdrv][Stopped/Manual Start]
     
111.   <system32\DRIVERS\secdrv.sys><N/A>
     
112. [Synaptics TouchPad Driver / SynTP][Running/Manual Start]
     
113.   <system32\DRIVERS\SynTP.sys><Synaptics, Inc.>
     
114. [TSP / TSP][Stopped/Manual Start]
     
115.   <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
     
116. ==================================
     
117. 浏览器加载项
     
118. [Adobe PDF Reader Link Helper]
     
119.   {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <D:\Program Files\Adobe\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
     
120. [艾美特CRM管理系统(正式环境)]
     
121.   {0471FE67-7F62-453A-BE13-2A47498B6AEE} <http://crm.airmate-china.cc:80/, N/A>
     
122. [Web反病毒保护]
     
123.   {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll, Kaspersky Lab>
     
124. [启动Web迅雷]
     
125.   {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} <http://my.xunlei.com, N/A>
     
126. [SinoCCTools Control]
     
127.   {5BF185B5-AED9-4F7F-818F-5C48A674D016} <C:\WINDOWS\DOWNLO~1\SINOCC~1.DLL, Guangzhou Collaborative Commerce Tech Co,. Ltd.>
     
128. [AmtCrm_inf Control]
     
129.   {38F53BD4-21A1-4BC8-B54E-489E13AFE5CF} <C:\WINDOWS\system32\AmtCrm.dll, >
     
130. [SinoCCTools Control]
     
131.   {5BF185B5-AED9-4F7F-818F-5C48A674D016} <C:\WINDOWS\DOWNLO~1\SINOCC~1.DLL, Guangzhou Collaborative Commerce Tech Co,. Ltd.>
     
132. [Windows Media Player]
     
133.   {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
     
134. [SearchAssistantOC]
     
135.   {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
     
136. [RDS.DataSpace]
     
137.   {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
     
138. [Shockwave Flash Object]
     
139.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
     
140. [使用Web迅雷下载]
     
141.   <D:\Program Files\Thunder Network\WebThunder\GetUrl.htm, N/A>
     
142. [使用Web迅雷下载全部链接]
     
143.   <D:\Program Files\Thunder Network\WebThunder\GetAllUrl.htm, N/A>
     
144. [导出到 Microsoft Excel(&x)]
     
145.   <res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000, N/A>
     
146. ==================================

复制代码

烟水寒云

==================================
文件关联
.TXT  Error. [C:\WINDOWS\notepad.exe %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  Error. ["hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1       localhost
==================================
API HOOK
RVA  错误： LoadLibraryA (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xAA567B25)
RVA  错误： LoadLibraryExA (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xAA567D67)
RVA  错误： LoadLibraryExW (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xAA567F0B)
RVA  错误： LoadLibraryW (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xAA567C49)
RVA  错误： GetProcAddress (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0xAA567E8F)