有个毒杀了,但启动项还在??(附日志,帮忙看一下吧)

显示全部楼层 · 发表于 2007-6-2 23:38:37

那毒就是MPG4C32.EXE!!!!
我用费尔木马查杀掉并且抑制掉了!!!
但每次启动还是会弹出这个文件夹!
用360禁用,删除启动项,还是没用唉!!!

------------------------------------------------

改了个名字再删除注册表~!~!!~就OK了~!!~~哈哈~!!~

[ 本帖最后由 Eshadow 于 2007-6-4 12:07 编辑 ]

显示全部楼层 · 发表于 2007-6-3 07:32:36

弹出文件夹？

显示全部楼层 · 发表于 2007-6-3 09:21:41

进安全模式或用冰刃看看能删除否

显示全部楼层 · 发表于 2007-6-3 12:05:23

好像没用唉~~~
删了重启~~启动项那里又有了~~~~
搜索过全盘```又说没这个文件或文件夹!~~晕啊``

显示全部楼层 · 发表于 2007-6-3 12:23:07

==================================
正在运行的进程
[PID: 652][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 720][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 744][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\klogon.dll]  [Kaspersky Lab, 6.0.0.299]
[PID: 788][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 800][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 956][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1020][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1140][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1268][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1360][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1560][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[E:\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 1, 4]
[E:\Thunder Network\Thunder\Components\ResWorker\DsBho_00.dll]  [, 1, 0, 0, 2]
[E:\Thunder Network\Thunder\Components\ResWorker\DataProcessor_00.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 4]
[C:\Program Files\WinRAR\rarext.dll]  [N/A, N/A]
[E:\软件工具\Unlocker\UnlockerCOM.dll]  [N/A, N/A]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\shellex.dll]  [Kaspersky Lab, 6.0.0.299]
[C:\WINDOWS\system32\nvshell.dll]  [N/A, N/A]
[PID: 1656][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[PID: 1740][C:\WINDOWS\system32\RunDll32.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system\cmicnfg.cpl]  [C-Media Corporation, 1, 0, 41, 14]
[C:\WINDOWS\System32\udaprop.dll]  [C-Media Corporation, 1.0.2.2]
[PID: 1792][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2040][C:\WINDOWS\system32\nvsvc32.exe]  [NVIDIA Corporation, 6.14.10.8195]
[PID: 220][C:\WINDOWS\system32\wdfmgr.exe]  [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[PID: 1600][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[E:\QQ2006\QQAPI.dll]  [, 1, 0, 0, 1]
[E:\QQ2006\LoginCtrl.dll]  [, 1, 0, 0, 1]
[E:\QQ2006\QQRes.dll]  [tencent, 1, 0, 0, 1]
[E:\QQ2006\QQMainFrame.dll]  [N/A, N/A]
[E:\QQ2006\CQQApplication.dll]  [N/A, N/A]
[E:\QQ2006\NewSkin.dll]  [, 1, 0, 0, 1]
[E:\QQ2006\HostingMgr.dll]  [, 1, 0, 0, 1]
[E:\QQ2006\CameraDll.dll]  [, 1, 0, 0, 1]
[E:\QQ2006\MailSummary.dll]  [, 1, 0, 0, 1]
[E:\QQ2006\QQKnowledgeSearch.dll]  [, 1, 0, 0, 1]
[E:\QQ2006\QQAllInOne.dll]  [N/A, N/A]
[E:\QQ2006\GroupLive.dll]  [N/A, N/A]
[E:\QQ2006\SCCore.dll]  [TENCENT, 2, 0, 0, 1]
[E:\QQ2006\QQSpace.dll]  [, 1, 0, 0, 1]
[C:\WINDOWS\system32\msdmo.dll]  [N/A, N/A]
[E:\QQ2006\QQGroupMng.dll]  [, 1, 0, 0, 1]
[E:\QQ2006\QQSysMsgMng.dll]  [N/A, N/A]
[E:\QQ2006\UserDefinedHead.dll]  [, 1, 0, 0, 1]
[E:\QQ2006\QQPlugin.dll]  [N/A, N/A]
[E:\QQ2006\QQConfigPlugin.dll]  [, 1, 0, 0, 1]
[E:\QQ2006\QRingMng.dll]  [N/A, N/A]
[E:\QQ2006\LongConnection.dll]  [tencent, 5, 0, 200, 160]
[E:\QQ2006\QQAvatar.dll]  [N/A, N/A]
[E:\QQ2006\FlashAvatarDll.dll]  [, 1, 4, 0, 1]
[E:\QQ2006\QQPet.dll]  [, 1, 0, 0, 1]
[E:\QQ2006\PhoneAPI.dll]  [, 1, 0, 0, 1]
[E:\QQ2006\DialerAllinOne.dll]  [tencent, 1, 4, 0, 0]
[E:\QQ2006\QQFileTransfer.dll]  [Tencent, 0, 3, 3, 5]
[E:\QQ2006\BQQApplication.dll]  [N/A, N/A]
[E:\QQ2006\CommercesMng.dll]  [, 1, 0, 0, 1]
[E:\QQ2006\PersonalDesktop.dll]  [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2]
[E:\QQ2006\QQAddr.dll]  [深圳市腾讯计算机系统有限公司, 5, 0, 101, 271]
[E:\QQ2006\npkcntc.dll]  [INCA Internet Co., Ltd., 2006, 6, 27, 1]
[E:\QQ2006\npkpdb.dll]  [INCA Internet Co., Ltd., 2003, 10, 1, 1]
[E:\QQ2006\QQSceneMng.dll]  [N/A, N/A]
[E:\QQ2006\QQPhoneHelper.dll]  [腾讯科技（深圳）有限公司, 2, 1, 9, 92]
[PID: 3752][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[c:\program files\google\googletoolbar2.dll]  [Google Inc., 4, 0, 1601, 4978]
[E:\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll]  [Thunder Networking Technologies,LTD, 1.0.0.4]
[E:\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 1, 4]
[E:\Thunder Network\Thunder\Components\ResWorker\DsBho_00.dll]  [, 1, 0, 0, 2]
[E:\Thunder Network\Thunder\Components\ResWorker\DataProcessor_00.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 4]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scr_ch_pg.dll]  [Kaspersky Lab, 1.0.6.299]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\klscav.dll]  [Kaspersky Lab, 6.0.0.299]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\pr_remote.dll]  [Kaspersky Lab, 6.0.0.299]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll]  [Kaspersky Lab, 6.0.0.299]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prkernel.ppl]  [Kaspersky Lab, 6.0.0.304]
[c:\program files\kaspersky lab\kaspersky anti-virus 6.0\params.ppl]  [Kaspersky Lab, 6.0.0.299]
[c:\program files\kaspersky lab\kaspersky anti-virus 6.0\pxstub.ppl]  [Kaspersky Lab, 6.0.0.299]
[c:\program files\kaspersky lab\kaspersky anti-virus 6.0\tempfile.ppl]  [Kaspersky Lab, 6.0.0.299]
[c:\program files\kaspersky lab\kaspersky anti-virus 6.0\nfio.ppl]  [Kaspersky Lab, 6.0.0.299]
[c:\program files\kaspersky lab\kaspersky anti-virus 6.0\fsdrvplgn.ppl]  [Kaspersky Lab, 6.0.0.299]
[C:\WINDOWS\system32\UNISPIM5.IME]  [北京紫光华宇软件股份有限公司, 5.0.0.5091]
[C:\WINDOWS\system32\macromed\flash\Flash85.ocx]  [Macromedia, Inc., 8,5,0,133]
[PID: 3668][E:\Thunder Network\Thunder\Program\Thunder5.exe]  [Thunder Networking Technologies,LTD, 5, 6, 2, 300]
[E:\Thunder Network\Thunder\Program\TaskManager.dll]  [Thunder Networking Technologies,LTD, 1, 1, 0, 21]
[E:\Thunder Network\Thunder\Program\download_interface.dll]  [Thunder Networking Technologies,LTD, 2, 15, 2, 85]
[E:\Thunder Network\Thunder\Program\stlport_vc646.dll]  [STLport Consulting, Inc., 4.6.2003.1031]
[E:\Thunder Network\Thunder\Program\asyn_dns.dll]  [Thunder Networking Technologies,LTD, 2, 15, 2, 85]
[E:\Thunder Network\Thunder\Program\BHOStub.dll]  [Thunder Networking Technologies,LTD, 1, 1, 0, 8]
[E:\Thunder Network\Thunder\Components\DownAndPlay\DownAndPlay.dll]  [, 1, 0, 0, 3]
[E:\Thunder Network\Thunder\Program\iTargetAD.dll]  [Thunder Networking Technologies,LTD, 1, 0, 2, 26]
[C:\WINDOWS\system32\macromed\flash\Flash85.ocx]  [Macromedia, Inc., 8,5,0,133]
[E:\Thunder Network\Thunder\Components\InMedia\iEmbedShell.dll]  [　, 1, 0, 0, 17]
[E:\Thunder Network\Thunder\Components\Community\XLCommunity.dll]  [Thunder Networking Technologies,LTD, 1, 0, 8, 30]
[E:\Thunder Network\Thunder\Components\Security\ThunderSafe.dll]  [深圳市迅雷网络技术有限公司, 1.0.0.10]
[E:\Thunder Network\Thunder\Components\Search\XLSearch.dll]  [Thunder Networking Technologies,LTD, 1, 1, 2, 12]
[E:\Thunder Network\Thunder\Components\P4PClient\P4PClient.dll]  [Thunder Networking Technologies,LTD, 2, 2, 1, 46]
[E:\Thunder Network\Thunder\Program\LiveUpdate.dll]  [Thunder Networking Technologies,LTD, 1, 2, 1, 20]
[E:\Thunder Network\Thunder\Components\ExplorerHelper\ExplorerHelper.dll]  [Thunder Networking Technologies,LTD, 1, 0, 4, 15]
[E:\Thunder Network\Thunder\Components\Tips\TipsClient.dll]  [Thunder Networking Technologies,LTD, 2, 1, 3, 58]
[E:\Thunder Network\Thunder\Components\VPSHELL\VPSHELL.dll]  [XunLei, 1, 2, 0, 10]
[E:\Thunder Network\Thunder\Components\UserExperience\UserExperience.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
[E:\Thunder Network\Thunder\Components\ResWorker\DsXlCom.dll]  [, 1, 0, 0, 9]
[E:\Thunder Network\Thunder\Components\InMedia\iEmbed09.dll]  [　, 3, 3, 0, 80]
[E:\Thunder Network\Thunder\Program\RegisterDll.dll]  [Thunder Networking Technologies,LTD, 2, 13, 2, 61]
[E:\Thunder Network\Thunder\Program\XLNet.Dll]  [Thunder Networking Technologies,LTD, 1, 2, 0, 8]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scr_ch_pg.dll]  [Kaspersky Lab, 1.0.6.299]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\klscav.dll]  [Kaspersky Lab, 6.0.0.299]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\pr_remote.dll]  [Kaspersky Lab, 6.0.0.299]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll]  [Kaspersky Lab, 6.0.0.299]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prkernel.ppl]  [Kaspersky Lab, 6.0.0.304]
[E:\Thunder Network\Thunder\Plugins\BhoAdv\bho_adv.dll]  [深圳市迅雷网络技术有限公司, 1.0.1.0]
[c:\program files\kaspersky lab\kaspersky anti-virus 6.0\params.ppl]  [Kaspersky Lab, 6.0.0.299]
[c:\program files\kaspersky lab\kaspersky anti-virus 6.0\pxstub.ppl]  [Kaspersky Lab, 6.0.0.299]
[c:\program files\kaspersky lab\kaspersky anti-virus 6.0\tempfile.ppl]  [Kaspersky Lab, 6.0.0.299]
[c:\program files\kaspersky lab\kaspersky anti-virus 6.0\nfio.ppl]  [Kaspersky Lab, 6.0.0.299]
[c:\program files\kaspersky lab\kaspersky anti-virus 6.0\fsdrvplgn.ppl]  [Kaspersky Lab, 6.0.0.299]
[E:\Thunder Network\Thunder\Components\VPSHELL\VideoPicture.dll]  [XunLei, 1, 2, 0, 11]
[E:\Thunder Network\Thunder\Components\ResWorker\DataProcessor_00.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 4]
[E:\Thunder Network\Thunder\Components\ResWorker\MediaWorker.dll]  [Thunder Networking Technologies,LTD, 1, 2, 0, 8]
[PID: 3744][E:\软件工具\SREng\SREng.EXE]  [Smallfrogs Studio, 2.3.13.690]

==================================
文件关联
.TXT  Error. [C:\WINDOWS\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1    localhost

==================================
API HOOK
警告！System Repair Engineer 提醒
你下面的函数内容与预期值不符，他
们可能被一些恶意的软件所修改：
RVA  错误： LoadLibraryA
RVA  错误： LoadLibraryExA
RVA  错误： LoadLibraryExW
RVA  错误： LoadLibraryW

==================================

[/CODE]

显示全部楼层 · 发表于 2007-6-3 12:26:04

<MPG4C32><MPG4C32.exe> [N/A]
就是这个了!!!怎么做掉它啊~?~?`

显示全部楼层 · 发表于 2007-6-3 12:44:42

在安全模式用冰刃删除了那个键值也不行!~~!
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<MPG4C32><MPG4C32.exe> [N/A]

显示全部楼层 · 发表于 2007-6-3 12:52:40

以MPG4C32.exe为关键字搜索整个注册表，启动项不一定都在[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

显示全部楼层 · 发表于 2007-6-3 13:56:44

大大啊!~~!~!
搜索过注册表了!!一共3个!!```
其它两个删除了!!
但没用!!!下面这个启动项自己还会恢复!!!
键信息:
电脑:本地
单元:HKEY_LOCAL_MACHINE
键:SOFTWARE\Microsoft\Windows\CurrentVersion\Run

完整路径:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

子键数目:2
值的数目:13
修改日期:2007年6月3日 13:50:23

值信息:
值:MPG4C32
类型:REG_SZ (字串)

数据信息:
数据:MPG4C32.exe
------------------------------------------------------------------
还有什么办法啊?!?~?~?~

显示全部楼层 · 发表于 2007-6-3 17:29:05

这个病毒似乎很强的样子，请参考这个帖子试一试：

http://hi.baidu.com/liuwanxin/bl ... 1deb00203f2e43.html

[已解决] 有个毒杀了,但启动项还在??(附日志,帮忙看一下吧)