瑞星卡卡安全论坛

2006-12-13,23:10:10

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2, v.2144 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [Microsoft Corporation]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [Microsoft Corporation]
    <kav><"D:\软件\kaba\avp.exe">  [Kaspersky Lab]
    <CameraFixer><C:\WINDOWS\CameraFixer.exe>  []
    <snpstd3><C:\WINDOWS\vsnpstd3.exe>  []
    <Micro><C:\WINDOWS\Microsoft\rundll32.exe>  []
    <r><C:\WINDOWS\down\rundll32.exe>  []
    <mhs2><C:\DOCUME~1\sm\LOCALS~1\Temp\mhs2.exe>  []
    <tavpenys><C:\WINDOWS\8Sy.exe>  []
    <load><C:\WINDOWS\uninstall\rundl132.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [Microsoft Corporation]
    <UIHost><logonui.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{6E44887F-5214-41F2-AB46-4728735C4CC6}><C:\Program Files\Internet Explorer\PLUGINS\system16.sys>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
    <WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll>  [Kaspersky Lab]

==================================
启动文件夹
服务
[卡巴斯基反病毒6.0 / AVP]
  <D:\软件\kaba\avp.exe -r><Kaspersky Lab>
[BlueSoleil Hid Service / BlueSoleil Hid Service]
  <C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe><N/A>
[O2Micro Flash Memory / O2Flash]
  <C:\WINDOWS\system32\o2flash.exe><N/A>

==================================
浏览器加载项
[Web反病毒保护]
  {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <D:\软件\kaba\scieplugin.dll, Kaspersky Lab>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\flash.ocx, Macromedia, Inc.>
[上传到QQ网络硬盘]
  <F1910-F110-11D2-BB9E-00C04F795683}, N/A>
[添加到QQ自定义面板]
  <D:\软件\qq\AddPanel.htm, N/A>
[添加到QQ表情]
  <, N/A>
[用QQ彩信发送该图片]
  <, N/A>

正在运行的进程
[PID: 572][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.1.2600.2144 (xpsp.040601-1829)>
[PID: 648][\??\C:\WINDOWS\system32\csrss.exe]  <Microsoft Corporation><5.1.2600.2144 (xpsp.040601-1829)>
[PID: 672][\??\C:\WINDOWS\system32\winlogon.exe]  <Microsoft Corporation><5.1.2600.2144 (xpsp.040601-1829)>
    [C:\WINDOWS\system32\klogon.dll]  <Kaspersky Lab><6.0.0.299>
[PID: 716][C:\WINDOWS\system32\services.exe]  <Microsoft Corporation><5.1.2600.2144 (xpsp.040601-1829)>
[PID: 728][C:\WINDOWS\system32\lsass.exe]  <Microsoft Corporation><5.1.2600.2144 (xpsp.040601-1829)>
[PID: 880][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2144 (xpsp.040601-1829)>
[PID: 924][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2144 (xpsp.040601-1829)>
[PID: 984][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.2144 (xpsp.040601-1829)>
[PID: 1028][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2144 (xpsp.040601-1829)>
[PID: 1092][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2144 (xpsp.040601-1829)>
[PID: 1440][C:\WINDOWS\system32\spoolsv.exe]  <Microsoft Corporation><5.1.2600.2144 (xpsp.040601-1829)>
[PID: 1492][C:\WINDOWS\Explorer.EXE]  <Microsoft Corporation><6.00.2900.2144 (xpsp.040601-1829)>
    [C:\Program Files\Internet Explorer\PLUGINS\system16.sys]  <N/A><N/A>
    [C:\WINDOWS\system32\dt.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\igfxpph.dll]  <Intel Corporation><3.0.0.4020>
    [C:\WINDOWS\system32\hccutils.DLL]  <Intel Corporation><3.0.0.4020>
    [C:\WINDOWS\system32\igfxres.dll]  <Intel Corporation><3.0.0.4020>
    [C:\WINDOWS\system32\igfxsrvc.dll]  <Intel Corporation><3.0.0.4020>
    [C:\WINDOWS\system32\igfxdev.dll]  <Intel Corporation><3.0.0.4020>
[PID: 1592][C:\WINDOWS\CameraFixer.exe]  <><1, 0, 0, 2>
    [C:\WINDOWS\system32\dt.dll]  <N/A><N/A>
    [C:\Program Files\Internet Explorer\PLUGINS\system16.sys]  <N/A><N/A>
[PID: 1600][C:\WINDOWS\vsnpstd3.exe]  <><1, 0, 2, 2>
    [C:\Program Files\Internet Explorer\PLUGINS\system16.sys]  <N/A><N/A>
    [C:\WINDOWS\system32\dt.dll]  <N/A><N/A>
[PID: 1608][C:\WINDOWS\Microsoft\rundll32.exe]  <N/A><N/A>
    [C:\WINDOWS\system32\dt.dll]  <N/A><N/A>
    [C:\Program Files\Internet Explorer\PLUGINS\system16.sys]  <N/A><N/A>
[PID: 1628][C:\DOCUME~1\sm\LOCALS~1\Temp\mhs2.exe]  <N/A><N/A>
    [C:\DOCUME~1\sm\LOCALS~1\Temp\mhs2.dll]  <N/A><N/A>
[PID: 1636][C:\WINDOWS\8Sy.exe]  <><>
    [C:\Program Files\Internet Explorer\PLUGINS\system16.sys]  <N/A><N/A>
    [C:\WINDOWS\system32\dt.dll]  <N/A><N/A>
[PID: 1644][C:\WINDOWS\system32\ctfmon.exe]  <Microsoft Corporation><5.1.2600.2144 (xpsp.040601-1829)>
    [C:\Program Files\Internet Explorer\PLUGINS\system16.sys]  <N/A><N/A>
    [C:\WINDOWS\system32\dt.dll]  <N/A><N/A>
[PID: 1892][C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe]  <N/A><N/A>
[PID: 1964][C:\WINDOWS\system32\o2flash.exe]  <N/A><N/A>
[PID: 228][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2144 (xpsp.040601-1829)>
[PID: 1140][C:\WINDOWS\system32\wscntfy.exe]  <Microsoft Corporation><5.1.2600.2144 (xpsp.040601-1829)>
    [C:\Program Files\Internet Explorer\PLUGINS\system16.sys]  <N/A><N/A>
    [C:\WINDOWS\system32\dt.dll]  <N/A><N/A>
[PID: 1328][C:\WINDOWS\System32\alg.exe]  <Microsoft Corporation><5.1.2600.2144 (xpsp.040601-1829)>
[PID: 2436][C:\WINDOWS\system32\conime.exe]  <Microsoft Corporation><5.1.2600.2144 (xpsp.040601-1829)>
    [C:\Program Files\Internet Explorer\PLUGINS\system16.sys]  <N/A><N/A>
    [C:\WINDOWS\system32\dt.dll]  <N/A><N/A>
[PID: 1040][C:\WINDOWS\system32\taskmgr.exe]  <Microsoft Corporation><5.1.2600.2144 (xpsp.040601-1829)>
    [C:\Program Files\Internet Explorer\PLUGINS\system16.sys]  <N/A><N/A>
    [C:\WINDOWS\system32\dt.dll]  <N/A><N/A>
[PID: 3132][C:\Program Files\Internet Explorer\iexplore.exe]  <Microsoft Corporation><6.00.2900.2144 (xpsp.040601-1829)>
    [C:\Program Files\Internet Explorer\PLUGINS\system16.sys]  <N/A><N/A>
    [C:\WINDOWS\system32\dt.dll]  <N/A><N/A>
    [D:\软件\kaba\scr_ch_pg.dll]  <Kaspersky Lab><1.0.6.299>
    [D:\软件\kaba\klscav.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\软件\kaba\pr_remote.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\软件\kaba\prloader.dll]  <Kaspersky Lab><6.0.0.299>
    [D:\软件\kaba\prkernel.ppl]  <Kaspersky Lab><6.0.0.304>
    [d:\软件\kaba\params.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\软件\kaba\pxstub.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\软件\kaba\tempfile.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\软件\kaba\nfio.ppl]  <Kaspersky Lab><6.0.0.299>
    [d:\软件\kaba\fsdrvplgn.ppl]  <Kaspersky Lab><6.0.0.299>
    [C:\WINDOWS\system32\macromed\flash\flash.ocx]  <Macromedia, Inc.><6,0,79,0>
[PID: 4088][C:\WINDOWS\system32\cmd.exe]  <Microsoft Corporation><5.1.2600.2144 (xpsp.040601-1829)>
[PID: 148][D:\软件\新建文件夹 (2)\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>
    [C:\Program Files\Internet Explorer\PLUGINS\system16.sys]  <N/A><N/A>
    [C:\WINDOWS\system32\dt.dll]  <N/A><N/A>

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

我的也中呢，不过不至于伤心致死啊

http://forum.ikaka.com/topic.asp?board=28&artid=8221048&page=1
LOOK!!

无效的话,找你们敬爱的M/小聪手杀.

mopery  ,轩辕小聪 ,帮助俺看看,俺都不能GHOST了.郁闷

给机器加上开机密码，用江明威金专杀工具就差不多了

C:\WINDOWS\Microsoft\rundll32.exe
C:\WINDOWS\down\rundll32.exe
C:\DOCUME~1\sm\LOCALS~1\Temp\mhs2.exe
C:\WINDOWS\8Sy.exe
C:\WINDOWS\uninstall\rundl132.exe
C:\WINDOWS\vsnpstd3.exe
把这几个提取出来瞧瞧../发到你们敬爱的M的邮箱

修复
<Micro><C:\WINDOWS\Microsoft\rundll32.exe> []
<r><C:\WINDOWS\down\rundll32.exe> []
<mhs2><C:\DOCUME~1\sm\LOCALS~1\Temp\mhs2.exe> []
<tavpenys><C:\WINDOWS\8Sy.exe> []
<load><C:\WINDOWS\uninstall\rundl132.exe> []
<{6E44887F-5214-41F2-AB46-4728735C4CC6}><C:\Program Files\Internet Explorer\PLUGINS\system16.sys> []
C:\WINDOWS\system32\dt.dll
删除
C:\WINDOWS\Microsoft\rundll32.exe
C:\WINDOWS\down\rundll32.exe
C:\WINDOWS\8Sy.exe
C:\WINDOWS\uninstall\rundl132.exe
C:\Program Files\Internet Explorer\PLUGINS\system16.sys
C:\WINDOWS\system32\dt.dll

安全模式清空
C:\DOCUME~1\sm\LOCALS~1\Temp\

http://mopery.hits.io/viking.zip
下载专杀查杀．．