瑞星卡卡安全论坛

首页 » 技术交流区 » 反病毒/反流氓软件论坛 » 大家好，我的电脑好像中了木马了，哪位帮我分析一下
麦田守望 - 2006-4-8 22:57:00
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell           

+ 1            File not found: 1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run           

+ AVPCC            File not found: ;

+ CtrlVol            File not found: ;

+ HotkeyApp            File not found: ;

+ internat.exe            File not found: ;

+ ISUSPM Startup            File not found: ;

+ ISUSScheduler            File not found: ;

+ LaunchAp            File not found: ;

+ PRONoMgr.exe            File not found: ;

+ PRPCMonitor            File not found: ;

+ RavUptye    Microsoft 基础类图片程序        c:\winnt\system32\agetlkeylie.exe

+ TkBellExe    RealNetworks Scheduler    RealNetworks, Inc.    c:\program files\common files\real\update_ob\realsched.exe

+ TProgram        Pong    c:\winnt\smss.exe

+ Wbutton            File not found: ;

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad           

+ DLMon            File not found: C:\WINNT\system32\DLMain.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks           

+ 8159.dll            c:\winnt\system32\8159.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved           

+ Display Panning CPL Extension            File not found: deskpan.dll

+ HyperTerminal Icon Ext    HyperTerminal Applet Library    Hilgraeve, Inc.    c:\winnt\system32\hticons.dll

+ Shell Extensions for RealOne Player    RealPlayer Shell Extensions    RealNetworks, Inc.    c:\program files\real\realplayer\rpshell.dll

+ Trojan Remover Shell Extension            File not found: d:\TROJAN~1\Trshlex.dll

+ WinRAR shell extension            c:\program files\winrar\rarext.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects           

+ QQBrowserHelperObject Class    QQIEHelper Module    深圳市腾讯计算机系统有限公司    e:\qq\qqiehelper.dll

+ ThunderIEHelper Class    xunleibho Module        c:\winnt\system32\xunleibho_v5.dll

HKLM\Software\Microsoft\Internet Explorer\Extensions           

+ @shdoclc.dll,-864            c:\winnt\web\related.htm

+ 腾讯QQ    QQ    TENCENT    e:\qq\qq.exe

HKLM\System\CurrentControlSet\Services           

+ AVPCC    KL Control Centre    Kaspersky Labs.    d:\kbs\avpcc.exe

+ KAVMonitorService    KAV Monitor main module    Kaspersky Labs.    d:\kbs\avpm.exe

HKLM\System\CurrentControlSet\Services           

+ AgereSoftModem    SoftModem Device Driver    Agere Systems    c:\winnt\system32\drivers\agrsm.sys

+ bcm4sbe5    Broadcom Corporation NDIS 5.0 ethernet driver    Broadcom Corporation    c:\winnt\system32\drivers\bcm4sbe5.sys

+ cs429x    Crystal AC9x WDM Driver    Applied Drivers Corporation    c:\winnt\system32\drivers\cwawdm.sys

+ dmio    NT Disk Manager I/O Driver    VERITAS Software Corp.    c:\winnt\system32\drivers\dmio.sys

+ dmload    NT Disk Manager Startup Driver    VERITAS Software Corp.    c:\winnt\system32\drivers\dmload.sys

+ hname            c:\winnt\system32\drivers\hname.sys

+ ialm    Controller Hub for Intel Graphics Driver    Intel Corporation    c:\winnt\system32\drivers\ialmnt5.sys

+ Klif    spuper-ptor    Kaspersky Labs    c:\winnt\system32\drivers\klif.sys

+ kmsinput            c:\winnt\system32\drivers\kmsinput.sys

+ KRegEx            File not found: C:\WINNT\system32\drivers\KRegEx.sys

+ KSysCall            File not found: D:\KV2005\KSysCall.sys

+ NAL    Intel(R) Network Adapter Diagnostic Driver    Intel Corporation     c:\winnt\system32\drivers\iqvw32.sys

+ New0            c:\winnt\system32\new.sys

+ npkcrypt            File not found: E:\qq\npkcrypt.sys

+ NSCIRDA    NSC Fast Infrared Driver.    National Semiconductor Corporation    c:\winnt\system32\drivers\nscirda.sys

+ PProtect            File not found: C:\WINNT\system32\drivers\PProtect.sys

+ Ptilink    Direct Parallel Link Driver    Parallel Technologies, Inc.    c:\winnt\system32\drivers\ptilink.sys

+ WBMS    Winbond Memory Stick Card Driver    Winbond Electronics Corp.    c:\winnt\system32\drivers\wbms.sys

+ WBSD    Winbond Secure Digital (SD/MMC) Storage Device Driver    Winbond Electronics Corp.    c:\winnt\system32\drivers\wbsd.sys

+ Wbutton            c:\winnt\system32\drivers\wbutton.sys

+ {6080A529-897E-4629-A488-ABA0C29B635E}    Intel Graphics Platform (SoftBIOS) Driver for Windows 2000(R) & Windows XP(TM)    Intel Corporation    c:\winnt\system32\drivers\ialmsbw.sys

+ {D31A0762-0CEB-444e-ACFF-B049A1F6FE91}    Intel Graphics Chipset (KCH) Driver for Windows 2000(R) & Windows XP(TM)    Intel Corporation    c:\winnt\system32\drivers\ialmkchw.sys

+ {E2B953A6-195A-44F9-9BA3-3D5F4E32BB55}    Ch7009 Minidriver    Intel Corporation    c:\winnt\system32\drivers\wa301a.sys

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify           

+ igfxcui    igfxsrvc Module    Intel Corporation    c:\winnt\system32\igfxsrvc.dll

------------------------------------
这是根据你网站提供的软件获取的
HijackThis(zww3008汉化版)V1.99.1
保存于      22:50:06, 日期 2006-4-8
操作系统：  Windows 2000 SP4 (WinNT 5.00.2195)
浏览器：    Internet Explorer v6.00 SP1 (6.00.2800.1106)

当前运行的进程：         
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Microsoft.NET\Framework\v2.0.50215\aspnet_state.exe
d:\kbs\avpcc.exe
d:\kbs\avpm.exe
C:\WINNT\System32\llssrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\system32\inetsrv\inetinfo.exe
C:\WINNT\explorer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINNT\system32\agetlkeylie.exe
C:\WINNT\smss.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\dllhost.exe
C:\WINNT\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
C:\WINNT\system32\conime.exe
C:\Program Files\Internet Explorer\iexplore.exe
E:\共享文件\HB_HijackThis\HijackThis1991汉化版\HB_HijackThis1991_zww.exe

R3 - URLSearchHook: (no name) - {982CB676-38F0-4D9A-BB72-D9371ABE876E} - (no file)
F2 - REG:system.ini: Shell=explorer.exe 1
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINNT\system32\xunleibho_v5.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - E:\qq\QQIEHelper.dll
O3 - IE工具栏增项: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - 启动项HKLM\\Run: [PRPCMonitor] ; PRPCUI.exe
O4 - 启动项HKLM\\Run: [LaunchAp] ; C:\Program Files\Launch Manager\LaunchAp.exe
O4 - 启动项HKLM\\Run: [HotkeyApp] ; C:\Program Files\Launch Manager\HotkeyApp.exe
O4 - 启动项HKLM\\Run: [CtrlVol] ; C:\Program Files\Launch Manager\CtrlVol.exe
O4 - 启动项HKLM\\Run: [Wbutton] ; "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - 启动项HKLM\\Run: [PRONoMgr.exe] ; C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - 启动项HKLM\\Run: [AVPCC] ; d:\kbs\avpcc.exe /wait
O4 - 启动项HKLM\\Run: [ISUSPM Startup] ; C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - 启动项HKLM\\Run: [ISUSScheduler] ; "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - 启动项HKLM\\Run: [internat.exe] ; internat.exe
O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - 启动项HKLM\\Run: [TProgram] C:\WINNT\smss.exe
O4 - 启动项HKLM\\Run: [RavUptye] C:\WINNT\system32\agetlkeylie.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\2052\OLFSNT40.EXE
O4 - Global Startup: 服务管理器.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - IE右键菜单中的新增项目： 上传到QQ网络硬盘 - E:\qq\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目： 导出当前页到超星阅览器(&A) - C:\超星阅读器\SSREADER36\ss_all.htm
O8 - IE右键菜单中的新增项目： 导出选中部分到超星阅览器(&S) - C:\超星阅读器\SSREADER36\ss_select.htm
O8 - IE右键菜单中的新增项目： 添加到QQ自定义面板 - E:\qq\AddPanel.htm
O8 - IE右键菜单中的新增项目： 添加到QQ表情 - E:\qq\AddEmotion.htm
O8 - IE右键菜单中的新增项目： 用QQ彩信发送该图片 - E:\qq\SendMMS.htm
O9 - 浏览器额外的按钮： Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - 浏览器额外的“工具”菜单项： Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - 浏览器额外的按钮： QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - E:\qq\QQ.EXE
O9 - 浏览器额外的“工具”菜单项： 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - E:\qq\QQ.EXE
O9 - 浏览器额外的按钮： (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - E:\qq\QQIEHelper.dll
O9 - 浏览器额外的“工具”菜单项： QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - E:\qq\QQIEHelper.dll
O16 - DPF: {88734439-46D0-42C0-A13F-7E881EE550CF} (Filetran Control) - http://www.bluesky.cn/download/filetran.cab
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/pcver2006new/OL2006.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{517FD4F6-0BC3-4FD9-A255-396F31EC052A}: NameServer = 202.98.160.68
O18 - 列举现有的协议: dynascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINNT\system32\mshtml.dll
O18 - 列举现有的协议: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O21 - SSODL: DLMon - {590498A3-4131-4D8F-BA4B-36791A0803B1} - C:\WINNT\system32\DLMain.dll (file missing)
O23 - NT 服务: AVP Control Centre Service (AVPCC) - Kaspersky Labs. - d:\kbs\avpcc.exe
O23 - NT 服务: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - NT 服务: KAV Monitor Service (KAVMonitorService) - Kaspersky Labs. - d:\kbs\avpm.exe
O23 - NT 服务: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - NT 服务: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - NT 服务: systme (systme2) - Unknown owner - C:\WINNT\system01.exe (file missing)

---
麻烦各位了，祝大家周未愉快
不言放弃 - 2006-4-9 8:04:00
【回复“麦田守望”的帖子】
结束如下进程
C:\WINNT\system32\agetlkeylie.exe
C:\WINNT\smss.exe

用HIJACKTHIS修复
R3 - URLSearchHook: (no name) - {982CB676-38F0-4D9A-BB72-D9371ABE876E} - (no file)
F2 - REG:system.ini: Shell=explorer.exe 1
O3 - IE工具栏增项: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - 启动项HKLM\\Run: [TProgram] C:\WINNT\smss.exe
O4 - 启动项HKLM\\Run: [RavUptye] C:\WINNT\system32\agetlkeylie.exe

＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝

进入注册表
删除如下几项
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
+ TProgram Pong c:\winnt\smss.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
+ DLMon File not found: C:\WINNT\system32\DLMain.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
+ 8159.dll c:\winnt\system32\8159.dll

＝＝＝＝＝＝＝＝＝＝＝＝＝＝

进入注册表
修改
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <shell><Explorer.exe 1>
为
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <shell><Explorer.exe>

＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝

删除
C:\WINNT\system32\DLMain.dll
c:\winnt\system32\8159.dll
C:\WINNT\system32\agetlkeylie.exe
C:\WINNT\smss.exe

＝＝＝＝＝＝＝＝＝＝＝＝

提示：若正常模式下无法解决
建议进入安全模式下操作
麦田守望 - 2006-4-9 10:17:00
老大好，我按你的方法，进安全模式了。C:\WINNT\smss.exe这个删了不了，
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe 1>
这项我删了，又来了。我改成
Explorer.exe一刷新又变回来了。这是怎么回事
--------------------------
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

+ 1File not found: 1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

+ AVPCCFile not found: ;

+ CtrlVolFile not found: ;

+ HotkeyAppFile not found: ;

+ internat.exeFile not found: ;

+ ISUSPM StartupFile not found: ;

+ ISUSSchedulerFile not found: ;

+ LaunchApFile not found: ;

+ PRONoMgr.exeFile not found: ;

+ PRPCMonitorFile not found: ;

+ TkBellExeFile not found: ;

+ TProgramFile not found: ;

+ WbuttonFile not found: ;

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad

+ DLMonFile not found: C:\WINNT\system32\DLMain.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

+ InprocServer32File not found: CLSID\{CF49F9F2-A8D3-464F-83EC-6AFC6573C267}\InprocServer32

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved

+ Display Panning CPL ExtensionFile not found: deskpan.dll

+ HyperTerminal Icon ExtHyperTerminal Applet LibraryHilgraeve, Inc.c:\winnt\system32\hticons.dll

+ Shell Extensions for RealOne PlayerRealPlayer Shell ExtensionsRealNetworks, Inc.c:\program files\real\realplayer\rpshell.dll

+ Trojan Remover Shell ExtensionFile not found: d:\TROJAN~1\Trshlex.dll

+ WinRAR shell extensionc:\program files\winrar\rarext.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

+ QQBrowserHelperObject ClassQQIEHelper Module深圳市腾讯计算机系统有限公司e:\qq\qqiehelper.dll

+ ThunderIEHelper Classxunleibho Modulec:\winnt\system32\xunleibho_v5.dll

HKLM\Software\Microsoft\Internet Explorer\Extensions

+ @shdoclc.dll,-864c:\winnt\web\related.htm

+ 腾讯QQQQTENCENTe:\qq\qq.exe

HKLM\System\CurrentControlSet\Services

+ AVPCCKL Control CentreKaspersky Labs.d:\kbs\avpcc.exe

+ KAVMonitorServiceKAV Monitor main moduleKaspersky Labs.d:\kbs\avpm.exe

HKLM\System\CurrentControlSet\Services

+ AgereSoftModemSoftModem Device DriverAgere Systemsc:\winnt\system32\drivers\agrsm.sys

+ bcm4sbe5Broadcom Corporation NDIS 5.0 ethernet driverBroadcom Corporationc:\winnt\system32\drivers\bcm4sbe5.sys

+ cs429xCrystal AC9x WDM DriverApplied Drivers Corporationc:\winnt\system32\drivers\cwawdm.sys

+ dmioNT Disk Manager I/O DriverVERITAS Software Corp.c:\winnt\system32\drivers\dmio.sys

+ dmloadNT Disk Manager Startup DriverVERITAS Software Corp.c:\winnt\system32\drivers\dmload.sys

+ hnamec:\winnt\system32\drivers\hname.sys

+ ialmController Hub for Intel Graphics DriverIntel Corporationc:\winnt\system32\drivers\ialmnt5.sys

+ Klifspuper-ptorKaspersky Labsc:\winnt\system32\drivers\klif.sys

+ kmsinputc:\winnt\system32\drivers\kmsinput.sys

+ KRegExFile not found: C:\WINNT\system32\drivers\KRegEx.sys

+ KSysCallFile not found: D:\KV2005\KSysCall.sys

+ NALIntel(R) Network Adapter Diagnostic DriverIntel Corporation c:\winnt\system32\drivers\iqvw32.sys

+ New0c:\winnt\system32\new.sys

+ npkcryptFile not found: E:\qq\npkcrypt.sys

+ NSCIRDANSC Fast Infrared Driver.National Semiconductor Corporationc:\winnt\system32\drivers\nscirda.sys

+ PProtectFile not found: C:\WINNT\system32\drivers\PProtect.sys

+ PtilinkDirect Parallel Link DriverParallel Technologies, Inc.c:\winnt\system32\drivers\ptilink.sys

+ WBMSWinbond Memory Stick Card DriverWinbond Electronics Corp.c:\winnt\system32\drivers\wbms.sys

+ WBSDWinbond Secure Digital (SD/MMC) Storage Device DriverWinbond Electronics Corp.c:\winnt\system32\drivers\wbsd.sys

+ Wbuttonc:\winnt\system32\drivers\wbutton.sys

+ {6080A529-897E-4629-A488-ABA0C29B635E}Intel Graphics Platform (SoftBIOS) Driver for Windows 2000(R) & Windows XP(TM)Intel Corporationc:\winnt\system32\drivers\ialmsbw.sys

+ {D31A0762-0CEB-444e-ACFF-B049A1F6FE91}Intel Graphics Chipset (KCH) Driver for Windows 2000(R) & Windows XP(TM)Intel Corporationc:\winnt\system32\drivers\ialmkchw.sys

+ {E2B953A6-195A-44F9-9BA3-3D5F4E32BB55}Ch7009 MinidriverIntel Corporationc:\winnt\system32\drivers\wa301a.sys

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify

+ igfxcuiigfxsrvc ModuleIntel Corporationc:\winnt\system32\igfxsrvc.dll

麦田守望 - 2006-4-10 8:51:00
老大好，我按你的方法，进安全模式了。C:\WINNT\smss.exe这个删了不了，
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe 1>
这项我删了，又来了。我改成
Explorer.exe一刷新又变回来了。这是怎么回事
展示空间 - 2006-4-10 13:45:00
你可以用费尔托斯特安全 2005这个软件查一下
麦田守望 - 2006-4-12 8:48:00
谢谢各位我试了。
报警类型: 发现错误的值
危险等级: 非常高!!
注册表分支: HKEY_CLASSES_ROOT\.exe
注册表值名:
当前的类型: REG_SZ
正确的类型: REG_SZ
当前的值: WindowFiles
正确的值: exefile
修复方法: 重新设置
当前状态: 等待修复
--
报警类型: 发现错误的值
危险等级: 非常高!!
注册表分支: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
注册表值名: Shell
当前的类型: REG_SZ
正确的类型: REG_SZ
当前的值: explorer.exe 1
正确的值: Explorer.exe
修复方法: 重新设置
当前状态: 等待修复
我查找1.com文件是有，但删了不了，不管在安全模式也好，而explorer.exe 1
这个文件找不到，注册表每次把这两项给修复一打开ie又回来。请问我用什么方式找出自动执行这个文件
麦田守望 - 2006-4-12 8:48:00
再次谢谢大家
不言放弃 - 2006-4-12 8:56:00
【回复“麦田守望”的帖子】
http://forum.ikaka.com/topic.asp?board=28&artid=6979213
下载System Repair Engineer 2.0.12.350
导出全部日志
麦田守望 - 2006-4-12 8:59:00
谢谢老大，这么用心，谢谢
麦田守望 - 2006-4-12 9:04:00
老大你是不是告诉错了。这个软件没有导出功能
麦田守望 - 2006-4-12 9:06:00
老兄你说的是这个文件吧，:
-----------------------------
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

+ 1File not found: 1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

+ AVPCCFile not found: ;

+ CtrlVolFile not found: ;

+ HotkeyAppFile not found: ;

+ internat.exeFile not found: ;

+ ISUSPM StartupFile not found: ;

+ ISUSSchedulerFile not found: ;

+ LaunchApFile not found: ;

+ PRONoMgr.exeFile not found: ;

+ PRPCMonitorFile not found: ;

+ TkBellExeRealNetworks SchedulerRealNetworks, Inc.c:\program files\common files\real\update_ob\realsched.exe

+ TProgramPongc:\winnt\smss.exe

+ twisterTwister Anti-TrojanVirusFilseclab Corporationd:\twister\twister.exe

+ WbuttonFile not found: ;

C:\Documents and Settings\All Users\「开始」菜单\程序\启动

+ 费尔消息服务.lnk费尔消息服务费尔安全实验室c:\program files\common files\filseclab\filmsg.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

+ ctfmon.exeFile not found: ctfmon.exe

+ internat.exeFile not found: internat.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved

+ Display Panning CPL ExtensionFile not found: deskpan.dll

+ HyperTerminal Icon ExtHyperTerminal Applet LibraryHilgraeve, Inc.c:\winnt\system32\hticons.dll

+ Shell Extensions for RealOne PlayerRealPlayer Shell ExtensionsRealNetworks, Inc.c:\program files\real\realplayer\rpshell.dll

+ Trojan Remover Shell ExtensionFile not found: d:\TROJAN~1\Trshlex.dll

+ Twister scan shell extensionTwister Shell Extension DLLFILSECLAB Corp.d:\twister\twshlext.dll

+ WinRAR shell extensionc:\program files\winrar\rarext.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

+ QQBrowserHelperObject ClassQQIEHelper Module深圳市腾讯计算机系统有限公司e:\qq\qqiehelper.dll

+ ThunderIEHelper Classxunleibho Modulec:\winnt\system32\xunleibho_v5.dll

HKLM\Software\Microsoft\Internet Explorer\Extensions

+ @shdoclc.dll,-864c:\winnt\web\related.htm

+ 腾讯QQQQTENCENTe:\qq\qq.exe

HKLM\System\CurrentControlSet\Services

+ AVPCCKL Control CentreKaspersky Labs.d:\kbs\avpcc.exe

+ KAVMonitorServiceKAV Monitor main moduleKaspersky Labs.d:\kbs\avpm.exe

+ RsCCenterFile not found: d:\Rising\Rav\CCenter.exe

HKLM\System\CurrentControlSet\Services

+ AgereSoftModemSoftModem Device DriverAgere Systemsc:\winnt\system32\drivers\agrsm.sys

+ bcm4sbe5Broadcom Corporation NDIS 5.0 ethernet driverBroadcom Corporationc:\winnt\system32\drivers\bcm4sbe5.sys

+ cs429xCrystal AC9x WDM DriverApplied Drivers Corporationc:\winnt\system32\drivers\cwawdm.sys

+ dmioNT Disk Manager I/O DriverVERITAS Software Corp.c:\winnt\system32\drivers\dmio.sys

+ dmloadNT Disk Manager Startup DriverVERITAS Software Corp.c:\winnt\system32\drivers\dmload.sys

+ ExpScanerFile not found: d:\Rising\Rav\ExpScan.sys

+ hnamec:\winnt\system32\drivers\hname.sys

+ HookContFile not found: d:\Rising\Rav\HOOKCONT.sys

+ HookRegFile not found: d:\Rising\Rav\HookReg.sys

+ HookSysFile not found: d:\Rising\Rav\HookSys.sys

+ ialmController Hub for Intel Graphics DriverIntel Corporationc:\winnt\system32\drivers\ialmnt5.sys

+ IMMDRVTwister Anti-TrojanVirus DriverFILSECLAB Corp.d:\twister\immdrv.sys

+ Klifspuper-ptorKaspersky Labsc:\winnt\system32\drivers\klif.sys

+ kmsinputc:\winnt\system32\drivers\kmsinput.sys

+ KRegExFile not found: C:\WINNT\system32\drivers\KRegEx.sys

+ KSysCallFile not found: D:\KV2005\KSysCall.sys

+ MEMSCANFile not found: d:\Rising\Rav\MEMSCAN.sys

+ NALIntel(R) Network Adapter Diagnostic DriverIntel Corporation c:\winnt\system32\drivers\iqvw32.sys

+ New0c:\winnt\system32\new.sys

+ npkcryptFile not found: E:\qq\npkcrypt.sys

+ NSCIRDANSC Fast Infrared Driver.National Semiconductor Corporationc:\winnt\system32\drivers\nscirda.sys

+ PProtectFile not found: C:\WINNT\system32\drivers\PProtect.sys

+ PtilinkDirect Parallel Link DriverParallel Technologies, Inc.c:\winnt\system32\drivers\ptilink.sys

+ WBMSWinbond Memory Stick Card DriverWinbond Electronics Corp.c:\winnt\system32\drivers\wbms.sys

+ WBSDWinbond Secure Digital (SD/MMC) Storage Device DriverWinbond Electronics Corp.c:\winnt\system32\drivers\wbsd.sys

+ Wbuttonc:\winnt\system32\drivers\wbutton.sys

+ {6080A529-897E-4629-A488-ABA0C29B635E}Intel Graphics Platform (SoftBIOS) Driver for Windows 2000(R) & Windows XP(TM)Intel Corporationc:\winnt\system32\drivers\ialmsbw.sys

+ {D31A0762-0CEB-444e-ACFF-B049A1F6FE91}Intel Graphics Chipset (KCH) Driver for Windows 2000(R) & Windows XP(TM)Intel Corporationc:\winnt\system32\drivers\ialmkchw.sys

+ {E2B953A6-195A-44F9-9BA3-3D5F4E32BB55}Ch7009 MinidriverIntel Corporationc:\winnt\system32\drivers\wa301a.sys

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify

+ igfxcuiigfxsrvc ModuleIntel Corporationc:\winnt\system32\igfxsrvc.dll

不言放弃 - 2006-4-12 9:34:00
引用:
【麦田守望的贴子】老大你是不是告诉错了。这个软件没有导出功能
...........................

有的

在那个软件主界面
点击扫描
然后保存日志
就生成日志内容了
不言放弃 - 2006-4-12 9:39:00
【回复“麦田守望”的帖子】
结束如下进程
C:\WINNT\system32\agetlkeylie.exe
C:\WINNT\smss.exe

用HIJACKTHIS修复
R3 - URLSearchHook: (no name) - {982CB676-38F0-4D9A-BB72-D9371ABE876E} - (no file)
F2 - REG:system.ini: Shell=explorer.exe 1
O3 - IE工具栏增项: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - 启动项HKLM\\Run: [TProgram] C:\WINNT\smss.exe
O4 - 启动项HKLM\\Run: [RavUptye] C:\WINNT\system32\agetlkeylie.exe

＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝

进入注册表
删除如下几项
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
+ TProgram Pong c:\winnt\smss.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
+ DLMon File not found: C:\WINNT\system32\DLMain.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
+ 8159.dll c:\winnt\system32\8159.dll

＝＝＝＝＝＝＝＝＝＝＝＝＝＝

进入注册表
修改
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <shell><Explorer.exe 1>
为
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <shell><Explorer.exe>

＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝

删除
C:\WINNT\system32\DLMain.dll
c:\winnt\system32\8159.dll
C:\WINNT\system32\agetlkeylie.exe
C:\WINNT\smss.exe
C:\winnt\system32\drivers\hname.sys

＝＝＝＝＝＝＝＝＝＝＝＝

提示：若正常模式下无法解决
建议进入安全模式下操作
麦田守望 - 2006-4-12 10:18:00
我导出来了。但是论坛不支持说我的字节多了老兄，有邮箱吗，我按你上在的做了，重启或一打开ie又恢复原来的样子了。根本不起作用我又找不出来，是哪个文件在运行。
不言放弃 - 2006-4-12 10:20:00
【回复“麦田守望”的帖子】
先参考一下12楼的回贴
1
查看完整版本: 大家好，我的电脑好像中了木马了，哪位帮我分析一下
© 2000 - 2026 Rising Corp. Ltd.