收藏本站 |切换到宽版 | 更换论坛皮肤
 找回密码  忘记邮箱  QQ快速登录  快速登录  快速注册

卡饭»论坛 › 安全区 › 原创工具区 › 电脑中毒了
12下一页
返回列表 发新帖
查看: 6030|回复: 11
收起左侧

[讨论] 电脑中毒了

[复制链接]
alicelijing1
发表于 2007-5-30 12:24:16 | 显示全部楼层 |阅读模式
卡巴斯基  不停地提示 Trojan.generic ！！！！运行进程。。。
只能隔离  完了之后卡巴斯基  提示要修复  估计是修复那个setup.exe文件    又提示修复失败！！！
之后  所有的硬盘都成了这样  ！！！ 只要是双击    卡巴斯基就不停地提示 ！！
上网搜了 搜    说是什么间谍软件？？？！！！有没有专杀工具 ？？？怎么删除？？
请各位朋友帮忙！！！万分感谢！！！
2007-5-30 13:00:12 运行进程 C:\WINDOWS\system32\veckdld.exe: 检测到新变种风险软件 'Trojan.generic'.

[ 本帖最后由 alicelijing1 于 2007-5-30 17:50 编辑 ]

SRE扫描文件.rar

4.46 KB, 下载次数: 61
回复

举报

xffsfy
发表于 2007-5-30 12:37:12 | 显示全部楼层
原帖由 alicelijing1 于 2007-5-30 12:24 发表
卡巴斯基  不停地提示 Trojan.generic ！！！！运行进程。。。
只能隔离  完了之后卡巴斯基  提示要修复  估计是修复那个setup.exe文件    又提示修复失败！！！
之后  所有的硬盘都成了这样  ！！！ 只要是 ...

打开分区不要直接双击，选择右键菜单中的“打开”选项
用SRE扫报告，大家帮你瞅瞅
回复

举报

alicelijing1
 楼主| 发表于 2007-5-30 12:54:21 | 显示全部楼层
SRE扫描结果如下：
  1. 2007-05-30,12:50:45
  2. System Repair Engineer 2.4.12.806
  3. Smallfrogs (http://www.KZTechs.com)
  4. Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
  5. 以下内容被选中：
  6.     所有的启动项目（包括注册表、启动文件夹、服务等）
  7.     浏览器加载项
  8.     正在运行的进程（包括进程模块信息）
  9.     文件关联
  10.     Winsock 提供者
  11.     Autorun.inf
  12.     HOSTS 文件

  14. 启动项目
  15. 注册表
  16. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  17.     <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
  18.     <bgswitch><C:\WINDOWS\system32\bgswitch.exe>  []
  19. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  20.     <IgfxTray><C:\WINDOWS\system32\igfxtray.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
  21.     <HotKeysCmds><C:\WINDOWS\system32\hkcmd.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
  22.     <Cmaudio><RunDll32 cmicnfg.cpl,CMICtrlWnd>  [N/A]
  23.     <STDSB><C:\WINDOWS\system32\STDSB.exe>  []
  24.     <SynTPLpr><C:\Program Files\Synaptics\SynTP\SynTPLpr.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
  25.     <SynTPEnh><C:\Program Files\Synaptics\SynTP\SynTPEnh.exe>  [(Verified)Microsoft Windows Publisher]
  26.     <IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload>  [(Verified)Microsoft Corporation]
  27.     <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
  28.     <RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup>  [Beijing Rising Technology Co., Ltd.]
  29.     <360Safetray><C:\Program Files\360safe\safemon\360Tray.exe /start>  [奇虎网]
  30.     <AVP><"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe">  [Kaspersky Lab]
  31.     <WebThunder><C:\Program Files\Thunder Network\WebThunder\WebThunder.exe>  [(Verified)ShenZhen Thunder Networking Technologies Ltd.]
  32.     <ymfqplr><C:\WINDOWS\system32\oduxyym.exe>  []
  33.     <kudxrkr><C:\WINDOWS\system32\veckdld.exe>  []
  34. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  35.     <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
  36.     <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
  37.     <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
  38. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
  39.     <WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll>  [Kaspersky Lab]
  40. [HKEY_CURRENT_USER\Control Panel\Desktop]
  41.     <SCRNSAVE.EXE><""C:\Program Files\Herosoft\Hero 9\解霸屏保.SCR"">  [N/A]
  42. ==================================
  43. 启动文件夹
  44. [Adobe Reader Speed Launch]
  45.   <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Reader Speed Launch.lnk --> C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE [Adobe Systems Incorporated]><N>
  46. ==================================
  47. 服务
  48. [卡巴斯基反病毒6.0个人版 / AVP][Running/Auto Start]
  49.   <"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r><Kaspersky Lab>
  50. [Human Interface Device Access / HidServ][Stopped/Disabled]
  51.   <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
  52. [Rising Proxy  Service / RfwProxySrv][Stopped/Manual Start]
  53.   <c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
  54. [Rising Personal Firewall Service / RfwService][Running/Auto Start]
  55.   <c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
  56. [SmartLinkService / SLService][Running/Auto Start]
  57.   <slserv.exe><>
  58. ==================================
  59. 驱动程序
  60. [Rising TDI Base Driver / BaseTDI][Running/Auto Start]
  61.   <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
  62. [C-Media WDM Audio Interface / cmuda][Running/Manual Start]
  63.   <system32\drivers\cmuda.sys><C-Media Inc>
  64. [VIA Rhine Family Fast Ethernet Adapter Driver Service / FETNDISB][Running/Manual Start]
  65.   <system32\DRIVERS\fetnd5b.sys><VIA Technologies, Inc.>
  66. [HookUrl / HookUrl][Running/Auto Start]
  67.   <\??\C:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
  68. [ialm / ialm][Running/Manual Start]
  69.   <system32\DRIVERS\ialmnt5.sys><Intel Corporation>
  70. [kl1 / kl1][Running/Boot Start]
  71.   <\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
  72. [klif / klif][Running/System Start]
  73.   <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
  74. [mProcRs / mProcRs][Running/Auto Start]
  75.   <\??\c:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
  76. [Scroll Bar Driver / MTC0003_STDSB][Running/Auto Start]
  77.   <system32\STDSB.sys><>
  78. [Mtlmnt5 / Mtlmnt5][Running/Manual Start]
  79.   <system32\DRIVERS\Mtlmnt5.sys><>
  80. [Mtlstrm / Mtlstrm][Stopped/Manual Start]
  81.   <system32\DRIVERS\Mtlstrm.sys><>
  82. [NtMtlFax / NtMtlFax][Stopped/Manual Start]
  83.   <system32\DRIVERS\NtMtlFax.sys><>
  84. [NTSIM / NTSIM][Stopped/Manual Start]
  85.   <\??\C:\WINDOWS\system32\ntsim.sys><VIA Technologies, Inc.>
  86. [Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  87.   <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
  88. [RecAgent / RecAgent][Stopped/Manual Start]
  89.   <\??\C:\WINDOWS\system32\DRIVERS\RecAgent.sys><Smart Link>
  90. [RsFwDrv / RsFwDrv][Running/Auto Start]
  91.   <\??\C:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
  92. [Secdrv / Secdrv][Stopped/Manual Start]
  93.   <system32\DRIVERS\secdrv.sys><N/A>
  94. [SmartLink AMR_PCI Driver / Slntamr][Running/Manual Start]
  95.   <system32\DRIVERS\slntamr.sys><>
  96. [SlNtHal / SlNtHal][Stopped/Manual Start]
  97.   <system32\DRIVERS\Slnthal.sys><>
  98. [SlWdmSup / SlWdmSup][Running/Manual Start]
  99.   <system32\DRIVERS\SlWdmSup.sys><Vireo Software>
  100. [Synaptics TouchPad Driver / SynTP][Running/Manual Start]
  101.   <system32\DRIVERS\SynTP.sys><Synaptics, Inc.>
  102. [Intel(R) Graphics Platform (SoftBIOS) Driver / {6080A529-897E-4629-A488-ABA0C29B635E}][Running/Manual Start]
  103.   <system32\drivers\ialmsbw.sys><Intel Corporation>
  104. [Intel(R) Graphics Chipset (KCH) Driver / {D31A0762-0CEB-444e-ACFF-B049A1F6FE91}][Running/Manual Start]
  105.   <system32\drivers\ialmkchw.sys><Intel Corporation>
  106. [360TimeProt / 360TimeProt][Running/Auto Start]
  107.   <\??\C:\WINDOWS\system32\drivers\360TimeProt.sys><N/A>
  108. ==================================
  109. 浏览器加载项
  110. [WebThunder Browser Helper]
  111.   {00000AAA-A363-466E-BEF5-9BB68697AA7F} <C:\Program Files\Thunder Network\WebThunder\WebThunderBHO_016.dll, Thunder Networking Technologies,LTD>
  112. [NavigatMon Class]
  113.   {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, >
  114. [Web反病毒统计]
  115.   {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll, Kaspersky Lab>
  116. [信息检索(&R)]
  117.   {92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
  118. [启动Web迅雷]
  119.   {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} <http://my.xunlei.com, N/A>
  120. [QQ]
  121.   {c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
  122. [Messenger]
  123.   {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
  124. [WebThunder Browser Helper]
  125.   {00000AAA-A363-466E-BEF5-9BB68697AA7F} <C:\Program Files\Thunder Network\WebThunder\WebThunderBHO_016.dll, Thunder Networking Technologies,LTD>
  126. [WebThunder Class]
  127.   {03507A1A-E0C5-4404-AA26-205385C0892D} <, N/A>
  128. [Windows Media Player]
  129.   {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
  130. [SearchAssistantOC]
  131.   {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
  132. [NavigatMon Class]
  133.   {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, >
  134. [Shockwave Flash Object]
  135.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
  136. [上传到QQ网络硬盘]
  137.   <C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
  138. [使用Web迅雷下载]
  139.   <C:\Program Files\Thunder Network\WebThunder\GetUrl.htm, N/A>
  140. [使用Web迅雷下载全部链接]
  141.   <C:\Program Files\Thunder Network\WebThunder\GetAllUrl.htm, N/A>
  142. [使用超级解霸播放]
  143.   <C:\Program Files\Herosoft\Hero 9\MPURLGET.HTM, N/A>
  144. [导出到 Microsoft Office Excel(&X)]
  145.   <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
  146. [添加到QQ自定义面板]
  147.   <C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
  148. [添加到QQ表情]
  149.   <C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
  150. [用QQ彩信发送该图片]
  151.   <C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>
  152. ==================================
  153. 正在运行的进程
  154. [PID: 624][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  155. [PID: 676][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  156. [PID: 704][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  157.     [C:\WINDOWS\system32\klogon.dll]  [Kaspersky Lab, 6.0.2.621]
  158.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  159. [PID: 748][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  160. [PID: 760][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  161. [PID: 916][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  162. [PID: 1012][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  163. [PID: 1052][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  164. [PID: 1544][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
  165.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scrchpg.dll]  [Kaspersky Lab, 6.0.2.621]
  166.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  167.     [C:\WINDOWS\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.4.4 27Mar03]
  168.     [C:\WINDOWS\system32\mxkeybd.dll]  [N/A, ]
  169.     [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll]  [Adobe Systems, Inc., 7.0.0.0]
  170.     [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
  171.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\ShellEx.dll]  [Kaspersky Lab, 6.0.2.621]
  172.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]
  173.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\MSVCP80.dll]  [Microsoft Corporation, 8.00.50727.42]
  174.     [C:\WINDOWS\system32\igfxpph.dll]  [Intel Corporation, 3.0.0.2172]
  175.     [C:\WINDOWS\system32\hccutils.DLL]  [Intel Corporation, 3.0.0.2172]
  176.     [C:\WINDOWS\system32\igfxres.dll]  [Intel Corporation, 3.0.0.2172]
  177.     [C:\WINDOWS\system32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.2172]
  178.     [C:\WINDOWS\system32\igfxdev.dll]  [Intel Corporation, 3.0.0.2172]
  179.     [C:\WINDOWS\system32\igfxress.dll]  [Intel Corporation, 3.0.0.2172]
  180.     [C:\WINDOWS\system32\msdmo.dll]  [, ]
  181.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prremote.dll]  [Kaspersky Lab, 6.0.2.621]
  182.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll]  [Kaspersky Lab, 6.0.2.621]
  183. [PID: 244][C:\WINDOWS\system32\igfxtray.exe]  [Intel Corporation, 3.0.0.2172]
  184.     [C:\WINDOWS\system32\hccutils.DLL]  [Intel Corporation, 3.0.0.2172]
  185.     [C:\WINDOWS\system32\igfxdev.dll]  [Intel Corporation, 3.0.0.2172]
  186.     [C:\WINDOWS\system32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.2172]
  187.     [C:\WINDOWS\system32\igfxres.dll]  [Intel Corporation, 3.0.0.2172]
  188.     [C:\WINDOWS\system32\igfxress.dll]  [Intel Corporation, 3.0.0.2172]
  189. [PID: 252][C:\WINDOWS\system32\hkcmd.exe]  [Intel Corporation, 3.0.0.2172]
  190.     [C:\WINDOWS\system32\hccutils.DLL]  [Intel Corporation, 3.0.0.2172]
  191.     [C:\WINDOWS\system32\igfxdev.dll]  [Intel Corporation, 3.0.0.2172]
  192.     [C:\WINDOWS\system32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.2172]
  193.     [C:\WINDOWS\system32\igfxhk.dll]  [Intel Corporation, 3.0.0.2172]
  194.     [C:\WINDOWS\system32\igfxres.dll]  [Intel Corporation, 3.0.0.2172]
  195.     [C:\WINDOWS\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.4.4 27Mar03]
  196. [PID: 268][C:\WINDOWS\system32\STDSB.exe]  [N/A, ]
  197.     [C:\WINDOWS\system32\mxkeybd.dll]  [N/A, ]
  198. [PID: 276][C:\Program Files\Synaptics\SynTP\SynTPLpr.exe]  [Synaptics, Inc., 7.4.4 27Mar03]
  199.     [C:\WINDOWS\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.4.4 27Mar03]
  200. [PID: 284][C:\Program Files\Synaptics\SynTP\SynTPEnh.exe]  [Synaptics, Inc., 7.4.4 27Mar03]
  201.     [C:\WINDOWS\system32\SynCOM.dll]  [Synaptics, Inc., 7.4.4 27Mar03]
  202.     [C:\WINDOWS\system32\SynTPAPI.dll]  [Synaptics, Inc., 7.4.4 27Mar03]
  203.     [C:\WINDOWS\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.4.4 27Mar03]
  204. [PID: 340][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3510]
  205. [PID: 424][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  206.     [C:\WINDOWS\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.4.4 27Mar03]
  207. [PID: 3832][c:\program files\rising\rfw\RfwMain.exe]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 66]
  208.     [c:\program files\rising\rfw\RsGuiLib.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 31]
  209.     [c:\program files\rising\rfw\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
  210.     [c:\program files\rising\rfw\RfwCtrl.dll]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]
  211.     [c:\program files\rising\rfw\RsXML.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
  212.     [c:\program files\rising\rfw\PngDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
  213.     [C:\WINDOWS\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.4.4 27Mar03]
  214. [PID: 560][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  215.     [C:\WINDOWS\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.4.4 27Mar03]
  216. [PID: 988][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
  217.     [C:\WINDOWS\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.4.4 27Mar03]
  218.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scrchpg.dll]  [Kaspersky Lab, 6.0.2.621]
  219.     [C:\Program Files\Thunder Network\WebThunder\WebThunderBHO_016.dll]  [Thunder Networking Technologies,LTD, 6, 0, 0, 5]
  220.     [C:\Program Files\360safe\safemon\safemon.dll]  [, 3, 4, 0, 1001]
  221.     [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
  222.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\klscav.dll]  [Kaspersky Lab, 6.0.2.621]
  223.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]
  224.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prremote.dll]  [Kaspersky Lab, 6.0.2.621]
  225.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\MSVCP80.dll]  [Microsoft Corporation, 8.00.50727.42]
  226.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll]  [Kaspersky Lab, 6.0.2.621]
  227.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prkernel.ppl]  [Kaspersky Lab, 6.0.2.621]
  228.     [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\params.ppl]  [Kaspersky Lab, 6.0.2.621]
  229.     [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\pxstub.ppl]  [Kaspersky Lab, 6.0.2.621]
  230.     [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\tempfile.ppl]  [Kaspersky Lab, 6.0.2.621]
  231.     [C:\WINDOWS\system32\mxkeybd.dll]  [N/A, ]
  232.     [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\nfio.ppl]  [Kaspersky Lab, 6.0.2.621]
  233.     [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\fsdrvplgn.ppl]  [Kaspersky Lab, 6.0.2.621]
  234.     [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\basegui.ppl]  [Kaspersky Lab, 6.0.2.621]
  235.     [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\thpimpl.ppl]  [Kaspersky Lab, 6.0.2.621]
  236.     [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\FSSync.dll]  [Kaspersky Lab, 6.0.5.621]
  237.     [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\winreg.ppl]  [Kaspersky Lab, 6.0.2.621]
  238.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  239.     [C:\WINDOWS\system32\IMSC40A.IME]  [Microsoft Corporation, 6.0.0.2527]
  240.     [C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx]  [Adobe Systems, Inc., 9,0,16,0]
  241. [PID: 3656][D:\Download\sreng2\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
  242.     [C:\WINDOWS\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.4.4 27Mar03]
  243. ==================================
  244. 文件关联
  245. .TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
  246. .EXE  OK. ["%1" %*]
  247. .COM  OK. ["%1" %*]
  248. .PIF  OK. ["%1" %*]
  249. .REG  OK. [regedit.exe "%1"]
  250. .BAT  OK. ["%1" %*]
  251. .SCR  OK. ["%1" /S]
  252. .CHM  OK. ["C:\WINDOWS\hh.exe" %1]
  253. .HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
  254. .INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
  255. .INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
  256. .VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
  257. .JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
  258. .LNK  OK. [{00021401-0000-0000-C000-000000000046}]
  259. ==================================
  260. Winsock 提供者
  261. N/A
  262. ==================================
  263. Autorun.inf
  264. [D:\]
  265. [AutoRun]
  266. open=ymfqplr.exe
  267. shell\open=打开(&O)
  268. shell\open\Command=ymfqplr.exe
  269. shell\open\Default=1
  270. shell\explore=资源管理器(&X)
  271. shell\explore\Command=ymfqplr.exe
  272. [F:\]
  273. [AutoRun]
  274. open=ymfqplr.exe
  275. shell\open=打开(&O)
  276. shell\open\Command=ymfqplr.exe
  277. shell\open\Default=1
  278. shell\explore=资源管理器(&X)
  279. shell\explore\Command=ymfqplr.exe
  280. [G:\]
  281. [AutoRun]
  282. open=ymfqplr.exe
  283. shell\open=打开(&O)
  284. shell\open\Command=ymfqplr.exe
  285. shell\open\Default=1
  286. shell\explore=资源管理器(&X)
  287. shell\explore\Command=ymfqplr.exe
  288. ==================================
  289. HOSTS 文件
  290. 127.0.0.1       localhost
  291. ==================================
  292. API HOOK
  293. RVA  错误： LoadLibraryA (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xF0C55AF0)
  294. RVA  错误： LoadLibraryExA (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xF0C55CD0)
  295. RVA  错误： LoadLibraryExW (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xF0C55E30)
  296. RVA  错误： LoadLibraryW (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xF0C55BE0)
  297. RVA  错误： GetProcAddress (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0xF0C55DE0)
  298. ==================================
  299. 隐藏进程
  300. N/A
  301. ==================================
复制代码

[ 本帖最后由 alicelijing1 于 2007-5-30 16:27 编辑 ]
回复

举报

xffsfy
发表于 2007-5-30 13:48:56 | 显示全部楼层
看了你的报告，参照http://bbs.kafan.cn/viewthread.php?tid=88745解决吧....最近这毒很猖狂
你的电脑中的那3个病毒文件是：
c:\windows\system32\veckdld.exe
c:\windows\system32\oduxyym.exe
c:\windows\system32\bgswitch.exe（疑似）

[ 本帖最后由 xffsfy 于 2007-5-31 14:58 编辑 ]
回复

举报

wangjay1980
发表于 2007-5-30 15:27:17 | 显示全部楼层
先用求助区置顶提供的USB专杀和WINGDOWS清理助手进行查杀，然后再用SRE扫个报告
回复

举报

alicelijing1
 楼主| 发表于 2007-5-30 16:30:30 | 显示全部楼层

回复 #4 xffsfy 的帖子

不好意思，还是没杀掉。
回复

举报

xffsfy
发表于 2007-5-30 16:34:32 | 显示全部楼层
原帖由 alicelijing1 于 2007-5-30 16:30 发表
不好意思，还是没杀掉。

  具体什么现象？
回复

举报

batti
发表于 2007-5-30 17:04:29 | 显示全部楼层
先运行SRENG和ICESWORD,结束进程EXPLORER.EXE,IEXPLORER.EXE

使用SRENG删除以下
启动
<STDSB><C:\WINDOWS\system32\STDSB.exe>
<ymfqplr><C:\WINDOWS\system32\oduxyym.exe>
<kudxrkr><C:\WINDOWS\system32\veckdld.exe>

服务
[SmartLinkService / SLService][Running/Auto Start]
  <slserv.exe>

驱动
[Scroll Bar Driver / MTC0003_STDSB][Running/Auto Start]
  <system32\STDSB.sys>
[Mtlmnt5 / Mtlmnt5][Running/Manual Start]
  <system32\DRIVERS\Mtlmnt5.sys>
[Mtlstrm / Mtlstrm][Stopped/Manual Start]
  <system32\DRIVERS\Mtlstrm.sys>
[NtMtlFax / NtMtlFax][Stopped/Manual Start]
  <system32\DRIVERS\NtMtlFax.sys>

重启后删除以上提及的文件以及
C:\WINDOWS\system32\mxkeybd.dll

运行AUTORUNS(一个工具),在点到"驱动器"标签,删除下面列表的自动运行
回复

举报

shuipao
发表于 2007-5-30 17:39:19 | 显示全部楼层
病毒清除前请不要双击任何盘符，可以通过鼠标右键选择打开。

**************以下分析报告由SREngLog分析助手提供******************

根据SREng扫描日志请按照如下步骤，尝试删除和修复

1.建议使用XDelBox删除以下文件：(XDelBox下载)
使用说明：删除时复制所有要删除文件的路径，在待删除文件列表里点击右键选择从剪贴板导入，导入后在要删除文件上点击右键，选择立刻重启删除，电脑会重启进入DOS界面进行删除操作。运行xdelbox前最好卸载所有可移动存储介质（包括U盘，MP3，手机存储卡等）。

c:\windows\system32\stdsb.exe      此项也有人说是笔记本的一个滚屏程序，请自行决定要不要删除
c:\windows\system32\mxkeybd.dll    此为上面的相关程序
c:\windows\system32\veckdld.exe
c:\windows\system32\oduxyym.exe
c:\windows\system32\stdsb.sys     此为第一项的相关驱动
d:\ymfqplr.exe
d:\autorun.inf
f:\ymfqplr.exe
f:\autorun.inf
g:\ymfqplr.exe
g:\autorun.inf

2.删除重启后使用SREng修复下面各项：

    启动项目 －－ 注册表之如下项删除：
[kudxrkr]    <C:\WINDOWS\system32\veckdld.exe>
[ymfqplr]    <C:\WINDOWS\system32\oduxyym.exe>

    启动项目 －－ 服务－－ 驱动程序之如下项删除：
[Scroll Bar Driver / MTC0003_STDSB]    <system32\STDSB.sys>

3.下载windows清理助手清理恶意软件
http://www.arswp.com/download/arswp/arswp.rar

**************以上分析报告由SREngLog分析助手提供******************
分析：shuipao
时间：2007-5-30
SREngLog分析助手 1.2 (20070420 更新 BY 草莽书生)

[ 本帖最后由 shuipao 于 2007-5-30 17:40 编辑 ]
回复

举报

alicelijing1
 楼主| 发表于 2007-5-30 18:40:26 | 显示全部楼层
终于杀掉了，谢谢大家！！！
回复

举报

下一页 »
12下一页
返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2024-12-23 11:53 , Processed in 0.143013 second(s), 20 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究，不得将上述内容用于商业或者其他非法用途，否则产生的一切后果自负，本站信息来自网络，版权争议问题与本站无关，您必须在下载后的24小时之内从您的电脑中彻底删除上述信息，如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表