瑞星卡卡安全论坛

Mdelk.exe 包括了 trojan.mitglieder.gb 和 troj_mitglied.aa 木马。

命令行删不掉。


MDELK.EXEAUTOMATED MALWARE PROFILE, ANALYSIS, REMOVAL AND SIGNATURE INFORMATION:
DEFINITION OF: MDELK.EXE
Safety Rating: Known Malware, do not run
Malware Family: Part of Malware group - Trojan MitGlieder GB
Determination: Automatically determined using Prevx centralized heuristics
Malware Form: TROJAN
Protection: Prevx provides powerful security products that you can use to detect, remove and protect you from MDELK.EXE and safeguard your PC against viruses, trojans, worms, spyware, rootkits and adware
Why risk having spyware on your PC when it takes less than 2 minutes to thoroughly check it with Prevx CSI? And it is totally free. Click here to check your PC with Prevx CSI Now.
First seen: May 28 2006 (GMT)
Last seen: May 28 2006 (GMT)
File Size: 36,826 bytes
MALWARE ASSESSMENT: PREVX 4 AXES OF EVIL METHODOLOGY1. COVERT ANALYSIS OF: MDELK.EXE
File Names Used: 192
Paths Used: 43
Common File Name: MDELK.EXE
Common Path: %appdata%\m\
Vendor Information: No Vendor details specified
MDELK.EXE may use 192 or more path and file names, these are the most common:
1 :%desktop%\malware on stubbs laptop (stubbs101)\06DE0C25DA69D9718FAD0018DDC7.....EXE
2 :%profiles%\alex\impostazioni locali\temp\~2.EXE
3 :%TEMP%\~12.EXE
4 :%TEMP%\~23C6.EXE
5 :%TEMP%\~23C7.EXE
6 :%TEMP%\~23D1.EXE
7 :%TEMP%\~23D3.EXE
8 :%TEMP%\~23D5.EXE
9 :%TEMP%\~23D7.EXE
10:%TEMP%\~23D9.EXE
11:%TEMP%\~2414.EXE
12:%TEMP%\~241A.EXE
13:%TEMP%\~CE3.EXE
14:?:\A00000000
File Name Structure: Normal
File and Path Structure: Suspicious, code execution from unusual location<br>2. RELATIONSHIP ANALYSIS OF: MDELK.EXE
Malicious Objects Created: 19 objects
Malicious Creators: 2
Malware Run Keys: Creates registry run keys for known malware objects
Self Persists: Yes, creates copies of itself
Antivirus Detection: No third party antivirus detection observed
Anti-Spyware Detection: No third party anti-spyware detection observed
3. ACTIVITY ANALYSIS OF: MDELK.EXE
The following behaviors have been observed for this object:
Installs programs.
Deletes programs.
Invokes dll components.
Creates Run Keys.
Runs other programs.
Communicates with web sites using httpout protocols.
Communicates with other computers across the web.
Has outbound communications.
Creates registry entries.
Creates run keys for known malware.
Creates known malware.
Creates copies of itself.
4. PROPAGATION ANALYSIS OF: MDELK.EXE
Malware Group Propagation Rate: Moderate (spreading)
Malware Group: Trojan MitGlieder GB
Copyright Prevx Limited 2005, 2006




[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; GreenBrowser)

http://www.kztechs.com/index1.html

下载System Repair Engineer 2.5
扫描日志上来

谢谢，扫描结果见附件：

附件: 10134942008212153824.txt

1.建议使用XDelBox删除以下文件：(XDelBox1.6下载)
使用说明：删除时复制所有要删除文件的路径，在待删除文件列表里点击右键选择从剪贴板导入不检查路径，导入后在要删除文件上点击右键，选择立刻重启删除，电脑会重启进入DOS界面进行删除操作。运行xdelbox前最好卸载所有可移动存储介质（包括U盘，MP3，手机存储卡等）。


c:\windows\system32\drivers\srosa.sys
c:\windows\system32\drivers\ring0.sys
c:\windows\system32\drivers\klif.sys
c:\windows\system32\drivers\pnpwmkdrv.sys

2.删除重启后使用SREng修复下面各项：

    启动项目 －－ 服务 －－ Win32服务应用程序之如下项禁用：
[Remote Administrator Service / r_server]    <>

    启动项目 －－ 服务－－ 驱动程序之如下项禁用：
[Megadrv3 / srosa]    <\??\C:\WINDOWS\system32\drivers\srosa.sys>
[NT Ring0 Driver / NT Ring0 Driver]    <\??\C:\WINDOWS\system32\drivers\Ring0.sys>
[KLIF / KLIF]    <\??\C:\WINDOWS\system32\drivers\klif.sys>
[PnpWmkDrv / PnpWmkDrv]    <\??\C:\WINDOWS\system32\drivers\PnpWmkDrv.sys>

哇！侠者秋水回复的速度真快！！谢谢，我马上去试试！

只有这两个存在：
c:\windows\system32\drivers\srosa.sys
c:\windows\system32\drivers\pnpwmkdrv.sys

另外c:\windows\system32\drivers\目录里还有7个文件夹模样的.sys文件：

C:\WINDOWS\system32\drivers\msaclue.sys
C:\WINDOWS\system32\drivers\pcibus.sys
C:\WINDOWS\system32\drivers\pcidisk.sys
C:\WINDOWS\system32\drivers\pcihdd.sys
C:\WINDOWS\system32\drivers\phy.sys
C:\WINDOWS\system32\drivers\puid.sys
C:\WINDOWS\system32\drivers\usb32k.sys

双击都是提示无法打开，这些东西是不是也是危险东西？

我现在“立刻重启执行删除”....

文件夹模样的.sys文件是你用了什么机器狗免疫弄出来的

可以阻止机器狗释放驱动。

我重启删除了，在重启的时候出现多出一个启动项，我选了什么del files那个，结果屏幕一闪，马上就又重启了，重启还是两个启动项。我又选了次del files...不知道到底删除成功了没？

在进行这一步的时候，SREng2.5提示错误：

对 Megadrv3 / srosa 的操作失败。
原因：5 - 拒绝访问。

请问上面两个会不会影响什么？

那你现在到底全盘杀毒，还有没异常？？？？？

没异常就行了。