中了Rootkit.Win32.Vanti.dd ，求助，谢谢 bbs.ikaka.com

solostone - 2006-7-20 18:13:00

这是SREngLOG，帮忙分析一下，谢谢各位了

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><D:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation]
<MSMSGS><"D:\Program Files\Messenger\msmsgs.exe" /background> [Microsoft Corporation]
<Xplus_spy><"D:\Program Files\Xplus\xvcclip.exe" /min> []
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation]
<PHIME2002ASync><D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation]
<PHIME2002A><D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]
<IMSCMig><D:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload> [Microsoft Corporation]
<TkBellExe><"D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<QuickTime Task><"D:\Program Files\QuickTime\qttask.exe" -atboottime> [Apple Computer, Inc.]
<SKYNET Personal FireWall><D:\Program Files\SkyNet\FireWall\PFW.exe> []
<NvCplDaemon><RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup> [NVIDIA Corporation]
<nwiz><nwiz.exe /install> [NVIDIA Corporation]
<NvMediaCenter><RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit> [NVIDIA Corporation]
<KAVPersonal50><D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe /minimize> [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<CheckFaultKernel><D:\WINDOWS\system32\mswdm.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><D:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{54D9498B-CF93-414F-8984-8CE7FDE0D391}><D:\Program Files\ewido\security suite\shellhook.dll> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WB]
<WinlogonNotify: WB><D:\Program Files\Stardock\Object Desktop\ThemeManager\fastload.dll> [Stardock]

==================================

solostone - 2006-7-20 18:15:00

==================================
启动文件夹
[Adobe Gamma Loader]
<D:\Documents and Settings\All Users.WINDOWS\「开始」菜单\程序\启动\Adobe Gamma Loader.lnk><N>

==================================
服务
[ewido security suite control / ewido security suite control]
<D:\Program Files\ewido\security suite\ewidoctrl.exe><ewido networks>
[ewido security suite guard / ewido security suite guard]
<D:\Program Files\ewido\security suite\ewidoguard.exe><ewido networks>
[kavsvc / kavsvc]
<D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe><Kaspersky Lab>
[NVIDIA Display Driver Service / NVSvc]
<D:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[PDEngine / PDEngine]
<"D:\Program Files\Raxco\PerfectDisk\PDEngine.exe"><>
[PDScheduler / PDSched]
<"D:\Program Files\Raxco\PerfectDisk\PDSched.exe"><>

solostone - 2006-7-20 18:15:00

==================================
正在运行的进程
[PID: 752][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 832][\??\D:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 872][\??\D:\WINDOWS\SYSTEM32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[D:\Program Files\Stardock\Object Desktop\ThemeManager\fastload.dll] <Stardock><1, 0, 0, 1>
[PID: 916][D:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 928][D:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1084][D:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1164][D:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1304][D:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1352][D:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1476][D:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1740][D:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)>
[D:\WINDOWS\system32\AdobePDF.dll] <Adobe Systems Incorporated.><6.0.000>
[D:\Program Files\Adobe\Acrobat 6.0\Distillr\AdistRes.CHS] <N/A><N/A>
[D:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll] <Windows (R) 2000 DDK provider><5.00.2195.1620>
[PID: 2028][D:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[D:\WINDOWS\system32\nvcpl.dll] <NVIDIA Corporation><6.14.10.6693>
[D:\WINDOWS\system32\NVRSZHC.DLL] <NVIDIA Corporation><6.14.10.6693>
[D:\WINDOWS\system32\nvshell.dll] <NVIDIA Corporation><6.14.10.6693>
[D:\PROGRA~1\FLASHGET\jccatch.dll] <Amaze Soft><1, 1, 4, 0>
[D:\Program Files\ewido\security suite\shellhook.dll] <N/A><N/A>
[D:\Program Files\Adobe\Acrobat 6.0\Acrobat Elements\ContextMenu.chs] <Adobe Systems Inc.><1.0.0.2003051500>
[PID: 268][D:\Program Files\Common Files\Real\Update_OB\realsched.exe] <RealNetworks, Inc.><0.1.0.3208>
[PID: 324][D:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 332][D:\Program Files\Messenger\msmsgs.exe] <Microsoft Corporation><4.7.3001>
[PID: 684][D:\Program Files\ewido\security suite\ewidoctrl.exe] <ewido networks><3, 0, 0, 1>
[D:\Program Files\ewido\security suite\lang.dll] <privat><1, 0, 0, 1>
[PID: 732][D:\WINDOWS\system32\nvsvc32.exe] <NVIDIA Corporation><6.14.10.6693>
[D:\WINDOWS\system32\NVRSZHC.DLL] <NVIDIA Corporation><6.14.10.6693>
[PID: 1212][D:\WINDOWS\system32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: DNSRV(bld4act)>
[PID: 1368][D:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1872][D:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 3264][D:\WINDOWS\system32\conime.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 3532][D:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[D:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll] <TechSmith Corporation><1.0.1>
[D:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll] <Adobe Systems Incorporated><6.0.0.2003051500>
[D:\Program Files\Tencent\QQ\QQIEHelper.dll] <深圳市腾讯计算机系统有限公司><1, 1, 0, 5>
[D:\PROGRA~1\FLASHGET\jccatch.dll] <Amaze Soft><1, 1, 4, 0>
[D:\PROGRA~1\KuGoo3\KUGOO3~1.OCX] <N/A><N/A>
[D:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll] <N/A><N/A>
[D:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.CHS] <N/A><N/A>
[D:\Program Files\Xi\NetTransport 2\NTIEHelper.dll] <Xi><1.91.12>
[D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpscrch.dll] <Kaspersky Lab><1.0.142.342>
[D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\concl.dll] <Kaspersky Lab><1.0.142.3>
[D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\FSSync.dll] <Kaspersky Lab><5.0.0.0>
[D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\ipc.dll] <Kaspersky Lab><5.0.142.0>
[D:\WINDOWS\system32\UNISPIM.IME] <北京清华紫光软件股份有限公司><3.0.0.3045>
[D:\WINDOWS\system32\upengine.dll] <北京清华紫光软件股份有限公司><3.0.0.3045>
[D:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx] <Macromedia, Inc.><8,0,24,0>
[PID: 2124][D:\Program Files\WinRAR\WinRAR.exe] <N/A><N/A>

solostone - 2006-7-20 18:32:00

大虾快现身啊……

独孤豪侠 - 2006-7-20 18:36:00

杀软怎么报的?
可不可以截个图上来.

另:日志不全.

不言放弃 - 2006-7-20 19:01:00

【回复“solostone”的帖子】
病毒文件名称与路径？

solostone - 2006-7-20 23:17:00

Log 还有这一部分
[PID: 2140][D:\DOCUME~1\aaa~1.DAI\LOCALS~1\Temp\Rar$EX00.406\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[D:\DOCUME~1\aaa~1.DAI\LOCALS~1\Temp\Rar$EX00.406\SREng2\Plugins\SREngPluginDemo.SRE] <Smallfrogs Studio><1, 1, 1, 0>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["D:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

病毒路径在的d:\Documents and Settings\aaa~\local settings\temp
每次杀了开机会重新生成，文件名都叫7gcs.dll，杀毒软件报rootkit.win32.vanti.dd
有时候会提示感染windows\services,然后自动关机

不言放弃 - 2006-7-20 23:19:00

引用:

【solostone的贴子】Log 还有这一部分
[PID: 2140][D:\DOCUME~1\aaa~1.DAI\LOCALS~1\Temp\Rar$EX00.406\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[D:\DOCUME~1\aaa~1.DAI\LOCALS~1\Temp\Rar$EX00.406\SREng2\Plugins\SREngPluginDemo.SRE] <Smallfrogs Studio><1, 1, 1, 0>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["D:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

病毒路径在的d:\Documents and Settings\aaa~\local settings\temp
每次杀了开机会重新生成，文件名都叫7gcs.dll，杀毒软件报rootkit.win32.vanti.dd
有时候会提示感染windows\services,然后自动关机
...........................

从楼主的日志中并没有发现ROOTKIT啊

solostone - 2006-7-20 23:22:00

【回复“不言放弃”的帖子】

我都找了一天了，要不要开机把杀毒软件关了再弄一次日志……

不言放弃 - 2006-7-20 23:31:00

引用:

【solostone的贴子】【回复“不言放弃”的帖子】

我都找了一天了，要不要开机把杀毒软件关了再弄一次日志……
...........................

7gcs.dll?
能否找到这个文件？
楼主玩网游吗？

solostone - 2006-7-20 23:32:00

【回复“不言放弃”的帖子】

能，每次开机都冒出来

大型网游已经大半年没碰了啊，就昨天在QQ上玩了会麻将……

solostone - 2006-7-21 0:13:00

HijackThis的日志

HijackThis_815汉化版扫描日志 V1.99.1
保存于 0:02:46, 日期 2006-7-21
操作系统： Windows XP SP2 (WinNT 5.01.2600)
浏览器： Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程：
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\SYSTEM32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\ewido\security suite\ewidoctrl.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Messenger\msmsgs.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\FlashGet\flashget.exe
D:\Program Files\WinRAR\WinRAR.exe
D:\DOCUME~1\aaa~1.DAI\LOCALS~1\Temp\Rar$EX00.313\HijackThis1991zww.exe

O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - D:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\PROGRA~1\FLASHGET\jccatch.dll
O2 - BHO: (no name) - {A9930D97-9CF0-42A0-A10D-4F28836579D5} - D:\PROGRA~1\KuGoo3\KUGOO3~1.OCX
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - D:\Program Files\Xi\NetTransport 2\NTIEHelper.dll
O3 - IE工具栏增项: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - IE工具栏增项: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - D:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll
O3 - IE工具栏增项: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - IE工具栏增项: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - IE工具栏增项: BitCometBar - {3F1ABCDB-A875-46c1-8345-B72A4567E486} - D:\Program Files\BitComet\BitCometBar\BitCometBar0.1.dll
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] "D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [IMSCMig] D:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - 启动项HKLM\\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - 启动项HKLM\\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - 启动项HKLM\\Run: [SKYNET Personal FireWall] D:\Program Files\SkyNet\FireWall\PFW.exe
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - 启动项HKLM\\Run: [nwiz] nwiz.exe /install
O4 - 启动项HKLM\\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - 启动项HKLM\\Run: [KAVPersonal50] D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe /minimize
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Xplus_spy] "D:\Program Files\Xplus\xvcclip.exe" /min
O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - IE右键菜单中的新增项目: 使用KuGoo3下载(&K) - D:\Program Files\KuGoo3\KuGoo3DownX.htm
O8 - IE右键菜单中的新增项目: 使用影音传送带下载 - D:\Program Files\Xi\NetTransport 2\NTAddLink.html
O8 - IE右键菜单中的新增项目: 使用影音传送带下载全部链接 - D:\Program Files\Xi\NetTransport 2\NTAddList.html
O8 - IE右键菜单中的新增项目: 使用网际快车下载 - D:\Program Files\FlashGet\jc_link.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链接 - D:\Program Files\FlashGet\jc_all.htm
O8 - IE右键菜单中的新增项目: 导出到 Microsoft Office Excel(&X) - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - IE右键菜单中的新增项目: 添加到 Windows Live Favorites(W) - http://favorites.live.com/quickadd.aspx
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - D:\Program Files\Tencent\qq\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - D:\Program Files\Tencent\qq\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - D:\Program Files\Tencent\qq\SendMMS.htm
O9 - 浏览器额外的按钮: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - C:\haofang\HFGame3\GameClient.exe
O9 - 浏览器额外的按钮: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的按钮: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\flashget.exe
O9 - 浏览器额外的“工具”菜单项: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\flashget.exe
O9 - 浏览器额外的按钮: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - 浏览器额外的“工具”菜单项: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - 浏览器额外的按钮: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - 浏览器额外的“工具”菜单项: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O10 - 未知的文件在 Winsock LSP: d:\windows\system32\tcpipdogr0.dll
O10 - 未知的文件在 Winsock LSP: d:\windows\system32\tcpipdogr0.dll
O15 - 添加的受信任的 IP 地址范围: http://219.235.231.22
O15 - 添加的受信任的 IP 地址范围: http://192.168.100.2
O15 - 添加的受信任的 IP 地址范围: http://219.235.231.228
O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} (Edit Class) - https://www.sz1.cmbchina.com/download/CMBEdit.cab
O16 - DPF: {15803D41-4851-11D2-B5CE-00A0C991E1E3} (PostFile Class) - http://219.235.231.228/webaccess/Bin/NewsWebPost.dll
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {30CADB40-6FD7-433F-BF0D-4827CA7B5BDF} (FavImport Class) - https://favorites.live.com/cab/ImportAx.cab
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O16 - DPF: {8BB4EE5B-5919-11D1-A01A-0060971932BC} (Editor Control) - http://219.235.231.228/webaccess/Bin/Editor.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {CC51C20A-CD54-4FC9-AAF6-2E76207FE733} (NewsAddon.NewsCtrl) - http://219.235.231.228/webaccess/Bin/NewsAddOn.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - 列举现有的协议: livecall - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - 列举现有的协议: msnim - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WB - D:\Program Files\Stardock\Object Desktop\ThemeManager\fastload.dll
O23 - NT 服务: ewido security suite control - ewido networks - D:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - NT 服务: kavsvc - Kaspersky Lab - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - NT 服务: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - NT 服务: PDEngine - Unknown owner - D:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - NT 服务: PDScheduler (PDSched) - Unknown owner - D:\Program Files\Raxco\PerfectDisk\PDSched.exe

sanjingshou - 2006-7-21 12:27:00

单击工具选项，打开文件夹选项，选查看，选查看所有文件！
进入C：\Documents and Settings\你用的用户文件夹local settings\temp
清空所有文件，尤其是你说的那个病毒~
清空IE缓存~~
重起下看还有吧~~
应该搞定了

sanjingshou - 2006-7-21 12:28:00

单击工具选项，打开文件夹选项，选查看，选查看所有文件！
进入C：\Documents and Settings\你用的用户文件夹\local settings\temp
清空所有文件，尤其是你说的那个病毒~
清空IE缓存~~
重起下看还有吧~~
应该搞定了

solostone - 2006-7-21 16:18:00

【回复“sanjingshou”的帖子】

不行啊，昨天试过，刚刚又试过，这个病毒开机就自动生成

baohe - 2006-7-21 16:39:00

引用:

【solostone的贴子】【回复“sanjingshou”的帖子】

不行啊，昨天试过，刚刚又试过，这个病毒开机就自动生成
...........................

检查一下你的%system%文件夹中是否有以下两个文件（见图）。如果有，可以用SSM禁止其加载运行。
然后，将SSM设置为“自动启动”。重启系统，删除这两个文件。然后，删除C：\Documents and Settings\当前用户\local settings\temp文件夹中的所有文件。
前些天拿到这个木马样本，主体文件是Win168.exe，运行后，释放图中所示那两个文件到%system%文件夹中。
这个木马进入系统后，插入explorer.exe以及所有正在运行的应用程序进程。
比较奇怪的是：它在我的系统中无法添加启动项。

附件: 1558472006721163201.jpg

solostone - 2006-7-21 17:15:00

【回复“baohe”的帖子】

确实有一个pyj...exe，但是删除后重启，依然报\temp里有7gcs.dll
晕了

solostone - 2006-7-22 15:46:00

各位再帮忙看看啊，还是搞不定它……

baohe - 2006-7-22 16:30:00

引用:

【solostone的贴子】【回复“baohe”的帖子】

确实有一个pyj...exe，但是删除后重启，依然报\temp里有7gcs.dll
晕了
...........................

用SSM禁止\temp\7gcs.dll加载，将SSM设置为“自动运行”。
重启。
删除那个\temp\7gcs.dll。

solostone - 2006-7-22 18:00:00

【回复“baohe”的帖子】
在system32里找到一个mswdm.exe，是它在生成7gcs.dll

谢谢啦

瑞星卡卡安全论坛