查看: 2039|回复: 8
收起左侧

同一问题二次求助,发了个LOG哪位高手帮我看下!

[复制链接]
martion
发表于 2007-6-8 18:24:35 | 显示全部楼层 |阅读模式
Trojan-Downloader.Win32.Agent.bmc这个木马我用了木马清道夫2007 、木马克星、木马杀客都搞不定啊
它隐藏在c:\windows\system32\d9dx.dll里面,卡巴老是提醒,又杀 不掉,一杀就要求重启

我在安全模式下了,重启后又出来了,用冰刃找到了删除后,重启下就又出来了,我都快疯了
扫了个LOG,哪位高手帮我看下

SREngLOG.rar

4.1 KB, 下载次数: 21

wangjay1980
发表于 2007-6-8 19:48:34 | 显示全部楼层


  1. 2007-06-08,17:20:27

  2. System Repair Engineer 2.4.12.806
  3. Smallfrogs ([url]http://www.KZTechs.com[/url])

  4. Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

  5. 以下内容被选中:
  6.     所有的启动项目(包括注册表、启动文件夹、服务等)
  7.     浏览器加载项
  8.     正在运行的进程(包括进程模块信息)
  9.     文件关联
  10.     Winsock 提供者
  11.     Autorun.inf
  12.     HOSTS 文件


  13. 启动项目
  14. 注册表
  15. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  16.     <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
  17.     <jiajiasr><F:\工具\应用软件\文字输入\拼音加加\jj4\jiajiasr.exe>  [加加工作组]
  18.     <CalSprite><; C:\WINDOWS\Resources\Themes\CalSprite\CalSprite.exe>  [SnowFox Studio.]
  19.     <Super Rabbit IEPro><; F:\工具\Windows 流氓软件清理大师\MagicSet\SRIECLI.EXE /LOAD>  [Super Rabbit Soft]
  20. [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  21.     <load><>  [N/A]
  22.     <run><>  [N/A]
  23. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  24.     <kav><"F:\工具\KAV6.0\avp.exe">  [Kaspersky Lab]
  25.     <IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Publisher]
  26.     <PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows Publisher]
  27.     <PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Publisher]
  28.     <TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
  29. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  30.     <shell><Explorer.exe>  [Microsoft Corporation]
  31.     <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
  32. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  33.     <AppInit_DLLs><>  [N/A]
  34. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  35.     <UIHost><logonui.exe>  [Microsoft Corporation]
  36. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
  37.     <{AEB6717E-7E19-11d0-97EE-00C04FD91972}><shell32.dll>  [Microsoft Corporation]
  38. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  39.     <PostBootReminder><%SystemRoot%\system32\SHELL32.dll>  [Microsoft Corporation]
  40.     <CDBurn><%SystemRoot%\system32\SHELL32.dll>  [Microsoft Corporation]
  41.     <WebCheck><%SystemRoot%\system32\webcheck.dll>  [Microsoft Corporation]
  42.     <SysTray><C:\WINDOWS\system32\stobject.dll>  [Microsoft Corporation]
  43.     <DirectX><C:\WINDOWS\system32\d3d8xof.dll>  [Microsoft Corporation]
  44. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
  45.     <WinlogonNotify: crypt32chain><crypt32.dll>  [(Verified)Microsoft Windows Publisher]
  46. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
  47.     <WinlogonNotify: cryptnet><cryptnet.dll>  [(Verified)Microsoft Windows Publisher]
  48. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
  49.     <WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll>  [Kaspersky Lab]
  50. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
  51.     <WinlogonNotify: ScCertProp><wlnotify.dll>  [(Verified)Microsoft Windows Publisher]
  52. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
  53.     <WinlogonNotify: Schedule><wlnotify.dll>  [(Verified)Microsoft Windows Publisher]
  54. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
  55.     <WinlogonNotify: sclgntfy><sclgntfy.dll>  [(Verified)Microsoft Windows Publisher]
  56. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
  57.     <WinlogonNotify: SensLogn><WlNotify.dll>  [(Verified)Microsoft Windows Publisher]
  58. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
  59.     <WinlogonNotify: termsrv><wlnotify.dll>  [(Verified)Microsoft Windows Publisher]
  60. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
  61.     <WinlogonNotify: wlballoon><wlnotify.dll>  [(Verified)Microsoft Windows Publisher]
  62. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  63.     <{438755C2-A8BA-11D1-B96B-00A0C90312E1}><%SystemRoot%\system32\browseui.dll>  [Microsoft Corporation]
  64.     <{8C7461EF-2B13-11d2-BE35-3078302C2030}><%SystemRoot%\system32\browseui.dll>  [Microsoft Corporation]
  65. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
  66.     <Microsoft Windows Media Player><C:\WINDOWS\inf\unregmp2.exe /ShowWMP>  [(Verified)Microsoft Windows Publisher]
  67. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
  68.     <Windows 桌面更新><regsvr32.exe /s /n /i:U shell32.dll>  [(Verified)Microsoft Windows Publisher]
  69. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
  70.     <Internet Explorer 6><%SystemRoot%\system32\ie4uinit.exe>  [(Verified)Microsoft Windows Publisher]

  71. ==================================
  72. 启动文件夹
  73. N/A

  74. ==================================
  75. 服务
  76. [Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start]
  77.   <C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
  78. [ATI Smart / ATI Smart][Stopped/Auto Start]
  79.   <C:\WINDOWS\system32\ati2sgag.exe><>
  80. [卡巴斯基反病毒6.0 / AVP][Running/Auto Start]
  81.   <F:\工具\KAV6.0\avp.exe -r><Kaspersky Lab>
  82. [Human Interface Device Access / HidServ][Stopped/Disabled]
  83.   <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>

  84. ==================================
  85. 驱动程序
  86. [ati2mtag / ati2mtag][Running/Manual Start]
  87.   <system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
  88. [kl1 / kl1][Running/Boot Start]
  89.   <\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
  90. [klif / klif][Running/System Start]
  91.   <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
  92. [npkcrypt / npkcrypt][Running/Auto Start]
  93.   <\??\F:\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
  94. [Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  95.   <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
  96. [Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
  97.   <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
  98. [Secdrv / Secdrv][Stopped/Manual Start]
  99.   <system32\DRIVERS\secdrv.sys><N/A>
  100. [TCP/IP Protocol Driver / Tcpip][Running/System Start]
  101.   <system32\DRIVERS\tcpip.sys><Microsoft Corporation>
  102. [Vinyl AC'97 Audio Controller (WDM) / VIAudio][Running/Manual Start]
  103.   <system32\drivers\vinyl97.sys><VIA Technologies, Inc.>

  104. ==================================
  105. 浏览器加载项
  106. [超级兔子上网精灵]
  107.   {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} <F:\工具\Windows 流氓软件清理大师\MagicSet\haokanbar.dll, Xiang Feng Technology>
  108. [启动迅雷5]
  109.   {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <F:\工具\迅雷5\Thunder.exe, Thunder Networking Technologies,LTD>
  110. [Web反病毒保护]
  111.   {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <F:\工具\KAV6.0\scieplugin.dll, Kaspersky Lab>
  112. [番茄花园]
  113.   {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} <[url]http://www.tomatolei.com[/url], N/A>
  114. [QQ]
  115.   {c95fe080-8f5d-11d2-a20b-00aa003c157b} <F:\QQ\QQ.EXE, TENCENT>
  116. [QQIEFloatBarCfgCmd Class]
  117.   {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <F:\QQ\QQIEHelper.dll, N/A>
  118. [超级兔子上网精灵]
  119.   {43869BB3-22FD-4F15-9B46-238106BA2F4E} <F:\工具\Windows 流氓软件清理大师\MagicSet\haokanbar.dll, Xiang Feng Technology>
  120. [Shockwave Flash Object]
  121.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>
  122. [Thunder Browser Helper]
  123.   {54EBD539-9BC1-480B-966A-843A333CA162} <F:\工具\迅雷5\ComDlls\XunLeiBHO_006.dll, Thunder Networking Technologies,LTD>
  124. [QQBrowserHelperObject Class]
  125.   {54EBD53A-9BC1-480B-966A-843A333CA162} <F:\QQ\QQIEHelper.dll, N/A>
  126. [超级兔子上网精灵]
  127.   {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} <F:\工具\Windows 流氓软件清理大师\MagicSet\haokanbar.dll, Xiang Feng Technology>
  128. [Shockwave Flash Object]
  129.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>
  130. [&使用迅雷下载]
  131.   <F:\工具\迅雷5\Program\geturl.htm, N/A>
  132. [&使用迅雷下载全部链接]
  133.   <F:\工具\迅雷5\Program\getallurl.htm, N/A>
  134. [上传到QQ网络硬盘]
  135.   <F:\QQ\AddToNetDisk.htm, N/A>
  136. [添加到QQ自定义面板]
  137.   <F:\QQ\AddPanel.htm, N/A>
  138. [添加到QQ表情]
  139.   <F:\QQ\AddEmotion.htm, N/A>
  140. [用QQ彩信发送该图片]
  141.   <F:\QQ\SendMMS.htm, N/A>

  142. ==================================
  143. 正在运行的进程
  144. [PID: 476][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  145. [PID: 544][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  146.     [C:\WINDOWS\system32\winsrv.dll]  [Microsoft Corporation, 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)]
  147. [PID: 1496][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
  148.     [C:\WINDOWS\system32\SHLWAPI.dll]  [Microsoft Corporation, 6.00.2900.2713 (xpsp_sp2_gdr.050702-1513)]
  149.     [C:\WINDOWS\system32\SHELL32.dll]  [Microsoft Corporation, 6.00.2900.2620 (xpsp_sp2_gdr.050225-1820)]
  150.     [C:\WINDOWS\system32\BROWSEUI.dll]  [Microsoft Corporation, 6.00.2900.2713 (xpsp_sp2_gdr.050702-1513)]
  151.     [C:\WINDOWS\system32\SHDOCVW.dll]  [Microsoft Corporation, 6.00.2900.2713 (xpsp_sp2_gdr.050702-1513)]
  152.     [C:\WINDOWS\system32\WININET.dll]  [Microsoft Corporation, 6.00.2900.2713 (xpsp_sp2_gdr.050702-1513)]
  153.     [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
  154.     [C:\WINDOWS\system32\themeui.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
  155.     [C:\WINDOWS\system32\urlmon.dll]  [Microsoft Corporation, 6.00.2900.2713 (xpsp_sp2_gdr.050702-1513)]
  156.     [C:\WINDOWS\system32\ntshrui.dll]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  157.     [C:\WINDOWS\system32\d9dx.dll]  [N/A, ]
  158.     [C:\WINDOWS\system32\sfc_os.dll]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  159.     [C:\WINDOWS\system32\webcheck.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
  160.     [C:\WINDOWS\system32\stobject.dll]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  161.     [C:\WINDOWS\system32\NETSHELL.dll]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  162.     [C:\WINDOWS\system32\credui.dll]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  163.     [C:\WINDOWS\system32\MSGINA.dll]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  164.     [D:\解压缩工具\rarext.dll]  [N/A, ]
  165.     [F:\工具\KAV6.0\shellex.dll]  [Kaspersky Lab, 6.0.0.299]
  166.     [C:\WINDOWS\system32\zipfldr.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
  167.     [C:\WINDOWS\system32\shdoclc.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
  168. [PID: 1596][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  169.     [C:\WINDOWS\system32\SHELL32.dll]  [Microsoft Corporation, 6.00.2900.2620 (xpsp_sp2_gdr.050225-1820)]
  170.     [C:\WINDOWS\system32\SHLWAPI.dll]  [Microsoft Corporation, 6.00.2900.2713 (xpsp_sp2_gdr.050702-1513)]
  171.     [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
  172. [PID: 1604][F:\工具\应用软件\文字输入\拼音加加\jj4\jiajiasr.exe]  [加加工作组, 4, 1, 0, 47]
  173.     [C:\WINDOWS\system32\SHLWAPI.dll]  [Microsoft Corporation, 6.00.2900.2713 (xpsp_sp2_gdr.050702-1513)]
  174.     [C:\WINDOWS\system32\SHELL32.dll]  [Microsoft Corporation, 6.00.2900.2620 (xpsp_sp2_gdr.050225-1820)]
  175.     [C:\WINDOWS\system32\d9dx.dll]  [N/A, ]
  176.     [C:\WINDOWS\system32\WININET.dll]  [Microsoft Corporation, 6.00.2900.2713 (xpsp_sp2_gdr.050702-1513)]
  177.     [C:\WINDOWS\system32\sfc_os.dll]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  178.     [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
  179. [PID: 2028][G:\Maxthon2\Maxthon.exe]  [Maxthon International ltd., 2, 0, 2, 615]
  180.     [C:\WINDOWS\system32\WININET.dll]  [Microsoft Corporation, 6.00.2900.2713 (xpsp_sp2_gdr.050702-1513)]
  181.     [C:\WINDOWS\system32\SHLWAPI.dll]  [Microsoft Corporation, 6.00.2900.2713 (xpsp_sp2_gdr.050702-1513)]
  182.     [G:\Maxthon2\mxpp.dll]  [Maxthon, 1, 0, 0, 50]
  183.     [G:\Maxthon2\MxSk.dll]  [Maxthon, 1, 0, 0, 119]
  184.     [G:\Maxthon2\MxProxy2.dll]  [, 1, 0, 0, 3115]
  185.     [C:\WINDOWS\system32\urlmon.dll]  [Microsoft Corporation, 6.00.2900.2713 (xpsp_sp2_gdr.050702-1513)]
  186.     [C:\WINDOWS\system32\SHELL32.dll]  [Microsoft Corporation, 6.00.2900.2620 (xpsp_sp2_gdr.050225-1820)]
  187.     [C:\WINDOWS\system32\d9dx.dll]  [N/A, ]
  188.     [C:\WINDOWS\system32\sfc_os.dll]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  189.     [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
  190. [PID: 1816][C:\WINDOWS\system32\wscntfy.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  191.     [C:\WINDOWS\system32\SHELL32.dll]  [Microsoft Corporation, 6.00.2900.2620 (xpsp_sp2_gdr.050225-1820)]
  192.     [C:\WINDOWS\system32\SHLWAPI.dll]  [Microsoft Corporation, 6.00.2900.2713 (xpsp_sp2_gdr.050702-1513)]
  193.     [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
  194. [PID: 3652][F:\QQ\QQ.exe]  [TENCENT, 0, 0, 0, 0]
  195.     [F:\QQ\QQBaseClassInDll.dll]  [, 1, 0, 0, 1]
  196.     [F:\QQ\QQHelperDll.dll]  [, 1, 0, 0, 1]
  197.     [F:\QQ\BasicCtrlDll.dll]  [Tencent, 6, 0, 200, 320]
  198.     [C:\WINDOWS\system32\SHELL32.dll]  [Microsoft Corporation, 6.00.2900.2620 (xpsp_sp2_gdr.050225-1820)]
  199.     [C:\WINDOWS\system32\SHLWAPI.dll]  [Microsoft Corporation, 6.00.2900.2713 (xpsp_sp2_gdr.050702-1513)]
  200.     [F:\QQ\MFC42.DLL]  [Microsoft Corporation, 6.00.8665.0]
  201.     [C:\WINDOWS\system32\WININET.dll]  [Microsoft Corporation, 6.00.2900.2713 (xpsp_sp2_gdr.050702-1513)]
  202.     [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
  203.     [F:\QQ\RICHED32.DLL]  [Microsoft Corporation, 5.00.2134.1]
  204.     [F:\QQ\RICHED20.dll]  [Microsoft Corporation, 5.31.23.1218]
  205.     [F:\QQ\QQAPI.dll]  [, 1, 0, 0, 1]
  206.     [F:\QQ\TIMProxy.dll]  [tencent, 0, 3, 2, 4]
  207.     [F:\QQ\LoginCtrl.dll]  [, 1, 0, 0, 1]
  208.     [F:\QQ\npkcntc.dll]  [INCA Internet Co., Ltd., 2006, 6, 27, 1]
  209.     [F:\QQ\npkpdb.dll]  [INCA Internet Co., Ltd., 2003, 10, 1, 1]
  210.     [F:\QQ\QQRes.dll]  [tencent, 1, 0, 0, 1]
  211.     [F:\QQ\QQMainFrame.dll]  [N/A, ]
  212.     [C:\WINDOWS\system32\urlmon.dll]  [Microsoft Corporation, 6.00.2900.2713 (xpsp_sp2_gdr.050702-1513)]
  213.     [F:\QQ\CQQApplication.dll]  [N/A, ]
  214.     [F:\QQ\NewSkin.dll]  [, 1, 0, 0, 1]
  215.     [F:\QQ\HostingMgr.dll]  [, 1, 0, 0, 1]
  216.     [F:\QQ\CameraDll.dll]  [, 1, 0, 0, 1]
  217.     [F:\QQ\MailSummary.dll]  [, 1, 0, 0, 1]
  218.     [F:\QQ\QQKnowledgeSearch.dll]  [, 1, 0, 0, 1]
  219.     [F:\QQ\QQAllInOne.dll]  [N/A, ]
  220.     [F:\QQ\GroupLive.dll]  [N/A, ]
  221.     [F:\QQ\SCCore.dll]  [TENCENT, 2, 0, 0, 1]
  222.     [F:\QQ\gdiplus.dll]  [Microsoft Corporation, 5.1.3102.2180 (xpsp_sp2_rtm.040803-2158)]
  223.     [F:\QQ\QQSpace.dll]  [, 1, 0, 0, 1]
  224.     [F:\QQ\vbscript.dll]  [Microsoft Corporation, 5.6.0.7426]
  225.     [C:\WINDOWS\system32\msdmo.dll]  [, ]
  226.     [F:\QQ\QQGroupMng.dll]  [, 1, 0, 0, 1]
  227.     [F:\QQ\UserDefinedHead.dll]  [, 1, 0, 0, 1]
  228.     [F:\QQ\QQPlugin.dll]  [N/A, ]
  229.     [F:\QQ\QQConfigPlugin.dll]  [, 1, 0, 0, 1]
  230.     [F:\QQ\QQAvatar.dll]  [N/A, ]
  231.     [F:\QQ\FlashAvatarDll.dll]  [, 1, 4, 0, 1]
  232.     [C:\WINDOWS\system32\shdocvw.dll]  [Microsoft Corporation, 6.00.2900.2713 (xpsp_sp2_gdr.050702-1513)]
  233.     [C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx]  [Adobe Systems, Inc., 9,0,45,0]
  234.     [F:\QQ\QQCustomFace.dll]  [N/A, ]
  235.     [F:\QQ\QRingMng.dll]  [N/A, ]
  236.     [F:\QQ\QQPet.dll]  [, 1, 0, 0, 1]
  237.     [F:\QQ\QQSceneMng.dll]  [N/A, ]
  238.     [F:\QQ\LongConnection.dll]  [tencent, 5, 0, 200, 160]
  239.     [F:\QQ\PhoneAPI.dll]  [, 1, 0, 0, 1]
  240.     [F:\QQ\DialerAllinOne.dll]  [tencent, 1, 4, 0, 0]
  241.     [F:\QQ\BQQApplication.dll]  [N/A, ]
  242.     [F:\QQ\QQSysMsgMng.dll]  [N/A, ]
  243.     [F:\QQ\ImageOle.dll]  [TODO: <Company name>, 1.0.0.1]
  244.     [C:\WINDOWS\system32\browseui.dll]  [Microsoft Corporation, 6.00.2900.2713 (xpsp_sp2_gdr.050702-1513)]
  245.     [C:\WINDOWS\system32\ntshrui.dll]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  246.     [C:\WINDOWS\system32\MSGINA.dll]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  247.     [F:\QQ\CommercesMng.dll]  [, 1, 0, 0, 1]
  248.     [F:\QQ\PersonalDesktop.dll]  [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2]
  249.     [F:\QQ\QQAddr.dll]  [深圳市腾讯计算机系统有限公司, 5, 0, 101, 271]
  250.     [F:\QQ\GroupConnection.dll]  [Tencent, 0, 3, 3, 5]
  251.     [F:\QQ\QQPhoneHelper.dll]  [腾讯科技(深圳)有限公司, 2, 1, 9, 93]
  252. [PID: 3676][F:\QQ\TIMPlatform.exe]  [tencent, 0, 3, 1, 8]
  253.     [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
  254.     [F:\QQ\TIMProxy.dll]  [tencent, 0, 3, 2, 4]
  255. [PID: 2728][F:\工具\系统扫描修复工具\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
  256.     [C:\WINDOWS\system32\SHLWAPI.dll]  [Microsoft Corporation, 6.00.2900.2713 (xpsp_sp2_gdr.050702-1513)]
  257.     [C:\WINDOWS\system32\SHELL32.dll]  [Microsoft Corporation, 6.00.2900.2620 (xpsp_sp2_gdr.050225-1820)]
  258.     [C:\WINDOWS\system32\WININET.dll]  [Microsoft Corporation, 6.00.2900.2713 (xpsp_sp2_gdr.050702-1513)]
  259.     [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
  260.     [C:\WINDOWS\system32\sfc_os.dll]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  261.     [C:\WINDOWS\system32\urlmon.dll]  [Microsoft Corporation, 6.00.2900.2713 (xpsp_sp2_gdr.050702-1513)]

  262. ==================================
  263. 文件关联
  264. .TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
  265. .EXE  OK. ["%1" %*]
  266. .COM  OK. ["%1" %*]
  267. .PIF  OK. ["%1" %*]
  268. .REG  OK. [regedit.exe "%1"]
  269. .BAT  OK. ["%1" %*]
  270. .SCR  OK. ["%1" /S]
  271. .CHM  OK. ["C:\WINDOWS\hh.exe" %1]
  272. .HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
  273. .INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
  274. .INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
  275. .VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
  276. .JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
  277. .LNK  OK. [{00021401-0000-0000-C000-000000000046}]

  278. ==================================
  279. Winsock 提供者
  280. N/A

  281. ==================================
  282. Autorun.inf
  283. N/A

  284. ==================================
  285. HOSTS 文件
  286. 127.0.0.1       localhost

  287. ==================================
  288. API HOOK
  289. RVA  错误: LoadLibraryA (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xEFD20B25)
  290. RVA  错误: LoadLibraryExA (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xEFD20D67)
  291. RVA  错误: LoadLibraryExW (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xEFD20F0B)
  292. RVA  错误: LoadLibraryW (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xEFD20C49)
  293. RVA  错误: GetProcAddress (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0xEFD20E8F)

  294. ==================================
  295. 隐藏进程
  296. N/A

  297. ==================================


复制代码
wangjay1980
发表于 2007-6-8 19:57:02 | 显示全部楼层
C:\WINDOWS\system32\d9dx.dll
C:\WINDOWS\system32\d3d8xof.dll

用冰刃删除这两个病毒文件

<DirectX><C:\WINDOWS\system32\d3d8xof.dll>  [Microsoft Corporation]
用SRE删除这个启动项
martion
 楼主| 发表于 2007-6-9 22:38:59 | 显示全部楼层

回复 #3 wangjay1980 的帖子

大哥,我按照这个方法试了4次
没有用
唉!!!
lxilikepal
发表于 2007-6-9 22:50:09 | 显示全部楼层
在安全模式下去.启动冰刃后先别删那几个文件,先看看进程里是不是有别的可疑进程.如果有就结束进程后再删除那几个文件.

API HOOK
RVA  错误: LoadLibraryA (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xEFD20B25)
RVA  错误: LoadLibraryExA (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xEFD20D67)
RVA  错误: LoadLibraryExW (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xEFD20F0B)
RVA  错误: LoadLibraryW (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xEFD20C49)
RVA  错误: GetProcAddress (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0xEFD20E8F)


是哪个/哪些程序hook的这些函数?
xiaowangzi
发表于 2007-6-9 22:51:44 | 显示全部楼层
原帖由 lxilikepal 于 2007-6-9 22:50 发表
在安全模式下去.启动冰刃后先别删那几个文件,先看看进程里是不是有别的可疑进程.如果有就结束进程后再删除那几个文件.



是哪个/哪些程序hook的这些函数?


这是安装卡巴斯基的原因
wangjay1980
发表于 2007-6-10 10:48:34 | 显示全部楼层
安装个防火墙
zxy_xin
发表于 2007-6-10 20:16:34 | 显示全部楼层
C:\WINDOWS\system32\d3d8xof.dll
这Y还真能伪装
martion
 楼主| 发表于 2007-6-10 22:28:12 | 显示全部楼层
感谢各位的支持
特别感谢wangjay1980 、lxilikepal
我试了N遍之后,重装了
连镜像都感染了,
谢谢大家了啊!!
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2024-12-23 17:10 , Processed in 0.152906 second(s), 20 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究,不得将上述内容用于商业或者其他非法用途,否则产生的一切后果自负,本站信息来自网络,版权争议问题与本站无关,您必须在下载后的24小时之内从您的电脑中彻底删除上述信息,如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表