卡卡3.2到底是不是清除工具？ bbs.ikaka.com

laicw - 2007-4-1 10:34:00

病毒名称处理结果扫描方式路径文件
Hack.Exploit.RIFF.a 重新启动计算机后删除文件文件监控 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ID6VEN4X 2111111[1].js
Hack.Exploit.RIFF.a 重新启动计算机后删除文件文件监控 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ID6VEN4X 2111111[2].js
Trojan.Spy.Agent.cxt 忽略文件监控 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\O5Q3KNYP wm0328[1].exe>>fsg2.0
Trojan.Spy.Agent.cxt 删除成功文件监控 C:\WINDOWS\system32 kdjs5.exe>>fsg2.0
Trojan.Spy.Agent.cxt 删除成功文件监控 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1ZN351SE wm0328[1].exe>>fsg2.0
Trojan.PSW.CabalOnLine.r 删除成功文件监控 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\8O30Y8HN zt0329b[1].exe
Trojan.Spy.Agent.cxt 删除成功文件监控 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ID6VEN4X wmsj0328[1].exe>>fsg2.0
Trojan.Spy.Agent.cxt 删除成功文件监控 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6LTQ72DS wm0328[1].exe>>fsg2.0
Trojan.Spy.Agent.cxt 删除成功文件监控 C:\WINDOWS\system32 kdjs5.exe>>fsg2.0
Trojan.PSW.CabalOnLine.r 删除成功文件监控 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\8O30Y8HN zt0329b[1].exe
Trojan.Spy.Agent.cxt 删除成功文件监控 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\1ZN351SE wmsj0328[1].exe>>fsg2.0
Trojan.Spy.Agent.cxt 删除成功文件监控 C:\WINDOWS\system32 kdjs9.exe>>fsg2.0
Trojan.Spy.Agent.cxt 删除成功文件监控 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ID6VEN4X wm0328[1].exe>>fsg2.0
Trojan.Spy.Agent.cxt 删除成功文件监控 C:\WINDOWS\system32 kdjs5.exe>>fsg2.0
Trojan.PSW.CabalOnLine.r 删除成功文件监控 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\8O30Y8HN zt0329b[1].exe
Trojan.Spy.Agent.cxt 删除成功文件监控 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6LTQ72DS wmsj0328[1].exe>>fsg2.0
Trojan.Spy.Agent.cxt 删除成功文件监控 C:\WINDOWS\system32 kdjs9.exe>>fsg2.0
Trojan.Spy.Agent.cxt 忽略文件监控 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\JHO4LW5S wm0328[1].exe>>fsg2.0
Trojan.Spy.Agent.cxt 删除成功文件监控 C:\WINDOWS\system32 kdjs5.exe>>fsg2.0
Trojan.Spy.Agent.cxt 删除成功文件监控 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\JHO4LW5S CAU69LEK.exe>>fsg2.0
Trojan.PSW.CabalOnLine.r 删除成功文件监控 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\8O30Y8HN zt0329b[1].exe
Trojan.Spy.Agent.cxt 删除成功文件监控 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ID6VEN4X wmsj0328[1].exe>>fsg2.0
Trojan.Spy.Agent.cxt 删除成功文件监控 C:\WINDOWS\system32 kdjs9.exe>>fsg2.0

360安全卫士能查出5个：但是清除了过会又有了
卡卡一个都没发现：没想法
我该怎么办

newcenturymoon - 2007-4-1 10:37:00

卡卡不是杀毒软件

laicw - 2007-4-1 10:50:00

补充一下下面那四个是用360查杀出来的恶意软件提示完全清除后

重启或过多少时间瑞星就跳出监控，又有了
c:\windows\cmdbcs.exe
c:\windows\msccrt.exe
c:\windows\mppds.exe
c:\windows\system32\jdsfdutj.dat

newcenturymoon - 2007-4-1 10:51:00

下载 System Repair Engineer，
http://www.kztechs.com/sreng/download.html
1 解压缩sreng2.zip
2 运行SREng.exe
3 智能扫描=》扫描=》保存报告
4 把日志中的报告完整拷贝贴上来，不要修改

laicw - 2007-4-1 11:17:00

谢谢！
我一运行 SRENG.exe 就出现提示
RVA错误：loadlibrarya 高 dest addr:0xf6b816e0
RVA错误：loadlibraryEXA 高 dest addr:0xf6b81820
RVA错误：loadlibraryEXA 高 dest addr:0xf6b818E0
RVA错误：loadlibraryW 高 dest addr:0xf6b81780

然后接着照你说的扫描下面是报告
文件太长我分开发了

[CODE]

2007-04-01,10:57:35

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\CTFMON.EXE> [(Verified)Microsoft Windows Publisher]
<MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background> [(Verified)Microsoft Windows XP Publisher]
<QQDownload><"d:\Program Files\Tencent\QQDownload\QQDownload.exe" autostart> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<RavTask><"d:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<StormCodec_Helper><"d:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti> []
<runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe> [Beijing Rising Technology Co., Ltd.]
<SoundMAXPnP><C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe> [Analog Devices, Inc.]
<SoundMAX><"C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray> [Analog Devices, Inc.]
<QuickTime Task><"D:\会声会影\setup\schinese\qttask.exe" -atboottime> [N/A]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows Publisher]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows Publisher]
<nwiz><nwiz.exe /install> []
<NvMediaCenter><RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit> [NVIDIA Corporation]
<NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [NVIDIA Corporation]
<miniqqlive><"D:\qq\MiniQQLive.exe"> [N/A]
<KernelFaultCheck><%systemroot%\system32\dumprep 0 -k> [N/A]
<IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload> [(Verified)Microsoft Corporation]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Publisher]
<BigDogPath><C:\WINDOWS\VM_STI.EXE USB PC Camera 301P> [N/A]
<nortonq><C:\WINDOWS\nortonq.exe> []
<winform><C:\WINDOWS\winform.exe> []
<mppds><C:\WINDOWS\mppds.exe> []
<msccrt><C:\WINDOWS\msccrt.exe> []
<cmdbcs><C:\WINDOWS\cmdbcs.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<RavStub><"d:\Program Files\Rising\Rav\ravstub.exe" /RUNONCE> [Beijing Rising Technology Co., Ltd.]
<360Safe><Rundll32.exe D:\PROGRA~1\360safe\AntiAdwa.dll,KillAdware> [360Safe.com]
<KKDelay><C:\Program Files\Rising\AntiSpyware\RunOnce.exe> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><C:\WINDOWS\system32\coopen.scr> [N/A]

==================================
启动文件夹
[腾讯QQ]
<C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\腾讯QQ.lnk --> D:\qq\QQ.exe [TENCENT]><N>

==================================
服务
[admin / admin][Stopped/Auto Start]
<C:\WINDOWS\Hacker.com.cn.ini><N/A>
[Adobe LM Service / Adobe LM Service][Stopped/Manual Start]
<"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>
[Network IPSEC Connections / BUZOR][Stopped/Auto Start]
<C:\WINDOWS\SYSTEM32\RUNDLL32.EXE C:\WINDOWS\SYSTEM32\WBEM\TRAPG.DLL,Export 1087><N/A>
[C-DillaCdaC11BA / C-DillaCdaC11BA][Running/Auto Start]
<C:\WINDOWS\system32\drivers\CDAC11BA.EXE><Macrovision>
[D01AFBE / D01AFBE][Stopped/Auto Start]
<C:\WINDOWS\system32\D01AFBE.EXE -service><Microsoft Corporation>
[D16BBD86 / D16BBD86][Stopped/Auto Start]
<C:\WINDOWS\system32\D16BBD86.EXE -service><Microsoft Corporation>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[kavsvc / kavsvc][Stopped/Auto Start]
<"D:\卡巴杀毒\Kaspersky Anti-Virus Personal Pro\kavsvc.exe"><N/A>
[Macromedia Licensing Service / Macromedia Licensing Service][Stopped/Manual Start]
<"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><>
[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
<C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
<"d:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
<"d:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[Serv-U FTP 服务器 / Serv-U][Running/Auto Start]
<D:\SERV-U\ServUDaemon.exe><Rhino Software, Inc. +1(262) 560-9627>
[SoundMAX Agent Service / SoundMAX Agent Service (default)][Running/Auto Start]
<C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.>
[Unigraphics Plot Server (ugiipqd) / ugiipqd][Running/Auto Start]
<C:\WINDOWS\system32\spool\ugplot\ugiipqd.exe><Unigraphics Solutions, Inc>
[Ulead Burning Helper / UleadBurningHelper][Running/Auto Start]
<C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe><Ulead Systems, Inc.>
[Unigraphics License Server (uglmd) / Unigraphics License Server (uglmd)][Running/Auto Start]
<"D:\Program Files\EDS\License Servers\UGNXFLEXlm\lmgrd.exe"><Macrovision Corporation>

laicw - 2007-4-1 11:17:00

==================================
驱动程序
[aeaudio / aeaudio][Running/Manual Start]
<system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[bootdrv / bootdrv][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\bootdrv.sys><N/A>
[CdaC15BA / CdaC15BA][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\CDAC15BA.SYS><Macrovision Europe Ltd>
[dhegidad / dhegidad][Stopped/Boot Start]
<\SystemRoot\system32\drivers\dhegidad.sys><N/A>
[EagleNT / EagleNT][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\EagleNT.sys><N/A>
[ExpScaner / ExpScaner][Running/Auto Start]
<\??\d:\Program Files\Rising\Rav\ExpScan.sys><>
[fz3plus / fz3plus][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\yytuplus.sys><N/A>
[HookCont / HookCont][Running/Auto Start]
<\??\d:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
<\??\d:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
<\??\d:\Program Files\Rising\Rav\HookSys.sys><Rising>
[jdy#hook / jdy#hook][Stopped/Manual Start]
<\??\E:\新建文件夹 (5)\592wg.com-jwt3.0-b-boyl2.2\jb20jwtbboy\hknm.sys><N/A>
[jwxb#01 / jwxb#01][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\ttyufzplushelper.sys><N/A>
[Kl1 / Kl1][Running/Boot Start]
<\SystemRoot\System32\drivers\kl1.sys><Kaspersky Lab>
[Klif / Klif][Running/System Start]
<System32\drivers\klif.sys><Kaspersky Labs>
[Klmc / Klmc][Running/System Start]
<System32\drivers\klmc.sys><Kaspersky Lab>
[kmsinput / kmsinput][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\kmsinput.sys><N/A>
[MEMSCAN / MEMSCAN][Running/Auto Start]
<\??\d:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[MidiSyn / MidiSyn][Stopped/Manual Start]
<system32\drivers\MidiSyn.sys><Analog Devices Inc>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\D:\qq\npkcrypt.sys><INCA Internet Co., Ltd.>
[npkycryp / npkycryp][Stopped/Manual Start]
<\??\D:\qq\npkycryp.sys><N/A>
[nv / nv][Running/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
<\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
<\??\d:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[Sentinel / Sentinel][Running/Auto Start]
<\SystemRoot\System32\Drivers\SENTINEL.SYS><Rainbow Technologies, Inc.>
[SFI Service / sf][Running/System Start]
<system32\drivers\sf.sys><Sonic Focus, Inc>
[Intel (R) System Managment BIOS Service / SMBios][Running/Manual Start]
<system32\DRIVERS\SMBios.sys><Intel Corporation>
[smwdm / smwdm][Running/Manual Start]
<system32\drivers\smwdm.sys><Analog Devices, Inc.>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
<system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[USB PC Camera 301P / ZSMC301b][Stopped/Manual Start]
<System32\Drivers\usbVM31b.sys><VM>

==================================
浏览器加载项
[QQCycloneHelper Class]
{00000000-12C9-4305-82F9-43058F20E8D2} <d:\Program Files\Tencent\QQDownload\QQIEHelper01.dll, 腾讯公司>
[启动迅雷5]
{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <D:\迅雷\Thunder.exe, Thunder Networking Technologies,LTD>
[硕思闪客名捕]
{E19ADC6E-3909-43E4-9A89-B7B676377EE3} <, N/A>
[金山快译(&K)]
{6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} <D:\Program Files\Kingsoft\FastAIT 2005\IEBand.dll, 金山软件股份有限公司>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[QQCycloneHelper Class]
{00000000-12C9-4305-82F9-43058F20E8D2} <d:\Program Files\Tencent\QQDownload\QQIEHelper01.dll, 腾讯公司>
[QuickTime Object]
{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} <d:\会声会影\setup\schinese\QTPlugin.ocx, N/A>
[ActiveMovieControl Object]
{05589FA1-C356-11CE-BF01-00AA0055595A} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[Thunder Browser Helper]
{09BA1AA8-CAD4-4C14-BDE6-922DFF5F6F38} <D:\迅雷\ComDlls\XunLeiBHO_007.dll, N/A>
[PeerDraw Class]
{10072CEC-8CC1-11D1-986E-00A0C955B42E} <C:\WINDOWS\system32\dllcache\vgx.dll, Microsoft Corporation>
[Windows Genuine Advantage Validation Tool]
{17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\legitcheckcontrol.dll, Microsoft Corporation>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\Mshtml.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\WINDOWS\system32\dllcache\dhtmled.ocx, Microsoft Corporation>
[IETag Factory]
{38481807-CA0E-42D2-BF39-B33AF135CC4D} <C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\IETAG.DLL, Microsoft Corporation>
[]
{474F0C87-DB8A-4897-9542-DCBAA39534A7} <C:\WINDOWS\system32\msdrivty.dll, N/A>
[HHCtrl Object]
{52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[金山快译(&K)]
{6C3797D2-3FEF-4CD4-B654-D3AE55B4128C} <D:\Program Files\Kingsoft\FastAIT 2005\IEBand.dll, 金山软件股份有限公司>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[WebVGPlayer Class]
{AA899B43-24BD-4B6B-BBD0-45557D8D11E0} <C:\PROGRA~1\VIEWGOOD\WEBPLA~1\VGPlayer.dll, >
[Qzone Media Tools]
{AC3A36A8-9BFF-410A-A33D-2279FFEB69D2} <D:\qq\VQQPLA~1.OCX, Tencent Technology (Shenzhen) Company Limited>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\Mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Messenger Object]
{B69003B3-C55E-4B48-836C-BC5946FC3B28} <C:\Program Files\Messenger\msgsc.dll, Microsoft Corporation>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[OWSClientMiscApis Class]
{BDEADE3F-C265-11D0-BCED-00A0C90AB50F} <D:\PROGRA~1\MICROS~1\OFFICE11\OWSCLT.DLL, Microsoft Corporation>
[OWSBrowserUI Class]
{BDEADE43-C265-11D0-BCED-00A0C90AB50F} <D:\PROGRA~1\MICROS~1\OFFICE11\OWSCLT.DLL, Microsoft Corporation>
[Tencent Safety Online Base Module]
{C09B522F-8AED-4E21-A65C-DC1AB652BAEE} <C:\WINDOWS\system32\TSOBase\TSOBase.ocx, Tencent Corporation>
[ActiveX Class]
{C3D8F2C7-A508-4724-BC3A-C247058D17EB} <d:\Program Files\Novasoft\vodplayer\VODPlayer.dll, PowerCOM>
[AUDIO__MP3 Moniker Class]
{CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__MPEGURL Moniker Class]
{CD3AFA78-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
{CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_ASF Moniker Class]
{CD3AFA8F-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
{CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[TencentVmpCtl Class]
{D9819BD5-422B-4281-8523-726466ED692B} <C:\Program Files\Tencent\Viewpoint Media Player\AxMetaStream.dll, Viewpoint Corporation>
[SWFDecompiler.InternetExplorer]
{E19ADC6E-3909-43E4-9A89-B7B676377EE3} <C:\PROGRA~1\COMMON~1\SOURCE~1\SWFCAT~1\SWFCAT~1.DLL, SourceTec>
[CPasswordEditCtrl Object]
{E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
[上传到QQ网络硬盘]
<D:\qq\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
<D:\qq\AddPanel.htm, N/A>
[添加到QQ表情]
<D:\qq\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<D:\qq\SendMMS.htm, N/A>

laicw - 2007-4-1 11:18:00

==================================
正在运行的进程
[PID: 492][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 548][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 572][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\D01AFBE.DLL] [Microsoft Corporation, ]
[D:\卡巴杀毒\Kaspersky Anti-Virus Personal Pro\offguard.dll] [Kaspersky Lab, 5.0.388.1]
[C:\WINDOWS\system32\D16BBD86.DLL] [Microsoft Corporation, ]
[PID: 616][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 628][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 780][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 824][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 928][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1004][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1072][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1348][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\WINDOWS\system32\mdimon.dll] [Microsoft Corporation, 11.3.1897.0]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll] [Microsoft Corporation, 11.3.1897.0]
[PID: 1508][d:\Program Files\Rising\Rav\RavStub.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 4]
[d:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[d:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[PID: 1780][C:\Program Files\Rising\AntiSpyware\runiep.exe] [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6]
[C:\Program Files\Rising\AntiSpyware\iep_ctrl.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 1804][C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe] [Analog Devices, Inc., 4, 0, 4, 11]
[C:\Program Files\Analog Devices\SoundMAX\SMWDMIF.dll] [Analog Device, Inc., 1, 0, 22, 26]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 1852][C:\Program Files\Analog Devices\SoundMAX\Smax4.exe] [Analog Devices, Inc., 4, 0, 4, 25]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 1960][C:\WINDOWS\system32\RUNDLL32.EXE] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\NvMcTray.dll] [NVIDIA Corporation, 6.14.10.8412]
[C:\WINDOWS\system32\NVRSZHC.DLL] [NVIDIA Corporation, 6.14.10.8412]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 1992][C:\WINDOWS\VM_STI.EXE] [VM., 4.2.610.4]
[C:\WINDOWS\system32\msdmo.dll] [, ]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 2000][C:\WINDOWS\system32\CTFMON.EXE] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 328][C:\WINDOWS\system32\E573DE1B.exe] [N/A, ]
[C:\WINDOWS\system32\MSVBVM60.DLL] [Microsoft Corporation, 6.00.9690]
[C:\WINDOWS\system32\vb6chs.dll] [Microsoft Corporation, 6.00.8988]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 1068][C:\WINDOWS\system32\EE4B231C.exe] [N/A, ]
[C:\WINDOWS\system32\MSVBVM60.DLL] [Microsoft Corporation, 6.00.9690]
[C:\WINDOWS\system32\vb6chs.dll] [Microsoft Corporation, 6.00.8988]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 3932][C:\WINDOWS\nortonq.exe] [N/A, ]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\nortonq.dll] [N/A, ]
[PID: 3704][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86]
[d:\Program Files\Tencent\QQDownload\QQIEHelper01.dll] [腾讯公司, 1, 1, 0, 5]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[D:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[PID: 3796][C:\WINDOWS\system32\EE4B231C.exe] [N/A, ]
[C:\WINDOWS\system32\MSVBVM60.DLL] [Microsoft Corporation, 6.00.9690]
[C:\WINDOWS\system32\vb6chs.dll] [Microsoft Corporation, 6.00.8988]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 1484][C:\WINDOWS\system32\E573DE1B.exe] [N/A, ]
[C:\WINDOWS\system32\MSVBVM60.DLL] [Microsoft Corporation, 6.00.9690]
[C:\WINDOWS\system32\vb6chs.dll] [Microsoft Corporation, 6.00.8988]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 3668][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 2836][C:\WINDOWS\explorer.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[C:\WINDOWS\system32\D01AFBE.DLL] [Microsoft Corporation, ]
[D:\卡巴杀毒\Kaspersky Anti-Virus Personal Pro\offguard.dll] [Kaspersky Lab, 5.0.388.1]
[C:\WINDOWS\system32\D16BBD86.DLL] [Microsoft Corporation, ]
[C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] [Autodesk, 16.0.0.86]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\winform.dll] [N/A, ]
[PID: 3084][C:\WINDOWS\system32\EE4B231C.exe] [N/A, ]
[C:\WINDOWS\system32\MSVBVM60.DLL] [Microsoft Corporation, 6.00.9690]
[C:\WINDOWS\system32\vb6chs.dll] [Microsoft Corporation, 6.00.8988]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 2260][C:\WINDOWS\system32\E573DE1B.exe] [N/A, ]
[C:\WINDOWS\system32\MSVBVM60.DLL] [Microsoft Corporation, 6.00.9690]
[C:\WINDOWS\system32\vb6chs.dll] [Microsoft Corporation, 6.00.8988]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 3652][d:\Program Files\Tencent\QQDownload\QQDownload.exe] [Tencent Technology (Shenzhen) Company Limited, 1, 1, 101, 82]
[C:\WINDOWS\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86]
[d:\Program Files\Tencent\QQDownload\QQDownload.dll] [Tencent Technology (Shenzhen) Company Limited, 1, 1, 100, 82]
[d:\Program Files\Tencent\QQDownload\TNProxy.dll] [Tencent Technology(Shenzhen) Company Limited, 2, 1, 101, 60]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[D:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]
[D:\qq\TIMProxy.dll] [tencent, 0, 3, 2, 4]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\msadp32.acm] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1888][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX01.172\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1localhost
202.103.67.180auto.search.msn.com

==================================
API HOOK
RVA 错误： LoadLibraryA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF6B816E0)
RVA 错误： LoadLibraryExA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF6B81820)
RVA 错误： LoadLibraryExW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF6B818E0)
RVA 错误： LoadLibraryW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF6B81780)

==================================
隐藏进程
N/A

==================================

[/CODE]

laicw - 2007-4-1 11:19:00

报告完毕！

newcenturymoon - 2007-4-1 11:28:00

安全模式下(开机后不断按F8键然后出来一个高级菜单选择第一项安全模式进入系统)

打开sreng （就是你扫日志的软件）
启动项目注册表删除如下项目 (如果有哪项你认识或者确认不是病毒请不要删除)
<nortonq><C:\WINDOWS\nortonq.exe> []
<winform><C:\WINDOWS\winform.exe> []
<mppds><C:\WINDOWS\mppds.exe> []
<msccrt><C:\WINDOWS\msccrt.exe> []
<cmdbcs><C:\WINDOWS\cmdbcs.exe> []

“启动项目”-“服务”-“Win32服务应用程序”中点“隐藏经认证的微软项目”，
选中以下项目，点“删除服务”，再点“设置”，在弹出的框中点“否”：
admin / admin
Network IPSEC Connections / BUZOR
D01AFBE / D01AFBE
D16BBD86 / D16BBD86

双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹" 并清除"隐藏受保护的操作系统文件（推荐）"前面的钩。在提示确定更改时，单击“是” 然后确定
然后删除
C:\WINDOWS\Hacker.com.cn.ini
C:\WINDOWS\system32\D16BBD86.EXE
C:\WINDOWS\system32\D01AFBE.EXE
C:\WINDOWS\Hacker.com.cn.ini
C:\WINDOWS\system32\D16BBD86.DLL
C:\WINDOWS\system32\D01AFBE.DLL
C:\WINDOWS\system32\E573DE1B.exe
C:\WINDOWS\system32\EE4B231C.exe
C:\WINDOWS\system32\winform.dll
C:\WINDOWS\nortonq.exe
C:\WINDOWS\winform.exe
<mppds><C:\WINDOWS\mppds.exe
C:\WINDOWS\msccrt.exe
C:\WINDOWS\cmdbcs.exe

laicw - 2007-4-1 11:28:00

等待高手解决```

laicw - 2007-4-1 12:08:00

照你那步骤我都完成了一直到
双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹" 并清除"隐藏受保护的操作系统文件（推荐）"前面的钩（这步我本身钩子没打的）。在提示确定更改时，单击“是” 然后确定
然后在删除以下文件时
未发现文件以下两个
C:\WINDOWS\Hacker.com.cn.ini
C:\WINDOWS\msccrt.exe
其他都删了

还有个问题我在删以下2个文件时
C:\WINDOWS\system32\D16BBD86.EXE
C:\WINDOWS\system32\D01AFBE.EXE
发现还有相似的文件 D16BBD86T.EXE D01AFBET.EXE 被我一起都干掉了，这没事的吧

newcenturymoon - 2007-4-1 12:10:00

C:\WINDOWS\system32\D16BBD86.EXE
C:\WINDOWS\system32\D01AFBE.EXE
发现还有相似的文件 D16BBD86T.EXE D01AFBET.EXE 被我一起都干掉了，这没事的吧
恩这是正确的

瑞星卡卡安全论坛