瑞星卡卡安全论坛

即日起每日会给大家提供一些染毒环境的SREng日志，因为部分实习生是第一次接触SREng这个工具，对日志分析不熟悉，如果冒然跑去反病毒区回帖，一旦出现误判，可能对求助者不利，因此采用这种“内部”交流的方式，希望大家能够多练习，真正分析日志的方法是靠自己实践摸索出来的！

注：日志分析练习情况与大家的实习期总成绩没有关联，请大家不要有顾虑，放心大胆的练习！


 附件: 您所在的用户组无法下载或查看附件


b]========以下为参考分析结果========
异常项见附件（仅保留日志中可疑度较高的项）

注意：
1、C:\windows\system32\XPtoVista\Logonui.exe不一定是有问题的，应该问一下是否是求助者本人使用了美化的登陆界面；
2、虽然有几个劫持项，但是通过文件名判断，是用来免疫病毒的，不需要处理；

 附件: 您所在的用户组无法下载或查看附件

该用户帖子内容已被屏蔽

C:\windows\system32\ablkfkkd.dll
C:\windows\system32\ablkfkkd.dll
ablkfkkd.dll

发现以下问题
1、  <SystemSpeedupWizard_CN><F:\系统加速精灵\SSW.exe>  []
    <Bdangel><F:\安装软件包\系统工具\上网提速王\bdan>  [File is missing]
很可疑
2、[DCOM Server Process Launcher / DcomLaunch][Running/Auto Start]
  <C:\windows\system32\svchost -k DcomLaunch-->%SystemRoot%\system32\rpcss.dll><Microsoft Corporation>后的加载执行的-->%SystemRoot%\system32\rpcss.dll有问题
3、[DHCP Client / Dhcp][Running/Auto Start]
  <C:\windows\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\dhcpcsvc.dll><Microsoft Corporation>
4、[AVG Anti-Spyware Driver / AVG Anti-Spyware Driver][Running/System Start]
  <\??\F:\安装软件包\系统工具\AVGAntiSpyware-v7.5.1.43-green\AVG Anti-Spyware 7.5\guard.sys><N/A>
[klif / klif][Running/System Start]
  <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
5、浏览器加载项
[Web反病毒保护]
  {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll, (Signed) Kaspersky Lab>
[]很可疑
:kaka6:

感觉以下部分很可疑
注册表
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto.exe]
    <IFEO[auto.exe]><AUTOGUARDER GUARDED.>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSDOS.bat]
    <IFEO[MSDOS.bat]><AUTOGUARDER GUARDED.>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntldr.exe]
    <IFEO[ntldr.exe]><AUTOGUARDER GUARDED.>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pagefile.pif]
    <IFEO[pagefile.pif]><AUTOGUARDER GUARDED.>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sos.exe]
    <IFEO[sos.exe]><AUTOGUARDER GUARDED.>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sxs.exe]
    <IFEO[sxs.exe]><AUTOGUARDER GUARDED.>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\test.exe]
    <IFEO[test.exe]><AUTOGUARDER GUARDED.>  [N/A]

进程
[PID: 1628][C:\WINDOWS\system32\shadow\ShadowService.exe]  [N/A, ]
[PID: 1648][F:\安装软件包\系统工具\CPU超线程\ProcessTamerTray.exe]  [, 1, 0, 0, 1]
问一下那个分析助手进程模块列表颜色表示什么
看下我电脑里这个值有问题不？
[HID Input Service / HidServ][Stopped/Auto Start]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>

kaka6: 还有这个:
启动文件夹
[ProcessTamer]
  <C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\ProcessTamer.lnk --> F:\安装软~1\系统工具\CPU超~1\PROCES~1.EXE []><N>

删除C:\windows\system32\ablkfkkd.dll
并用SREngLogA修复AppInit_DLLs选项
下面也很可疑
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto.exe]
    <IFEO[auto.exe]><AUTOGUARDER GUARDED.>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSDOS.bat]
    <IFEO[MSDOS.bat]><AUTOGUARDER GUARDED.>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntldr.exe]
    <IFEO[ntldr.exe]><AUTOGUARDER GUARDED.>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pagefile.pif]
    <IFEO[pagefile.pif]><AUTOGUARDER GUARDED.>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sos.exe]
    <IFEO[sos.exe]><AUTOGUARDER GUARDED.>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sxs.exe]
    <IFEO[sxs.exe]><AUTOGUARDER GUARDED.>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\test.exe]
    <IFEO[test.exe]><AUTOGUARDER GUARDED.>  [N/A]

<AppInit_DLLs><ablkfkkd.dll>  []
<{AB54F44D-652A-447F-B2D8-44FD96937ECE}><C:\windows\system32\ablkfkkd.dll>  []
<AB54F44D><C:\windows\system32\ablkfkkd.dll>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto.exe]
    <IFEO[auto.exe]><AUTOGUARDER GUARDED.>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSDOS.bat]
    <IFEO[MSDOS.bat]><AUTOGUARDER GUARDED.>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntldr.exe]
    <IFEO[ntldr.exe]><AUTOGUARDER GUARDED.>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pagefile.pif]
    <IFEO[pagefile.pif]><AUTOGUARDER GUARDED.>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sos.exe]
    <IFEO[sos.exe]><AUTOGUARDER GUARDED.>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sxs.exe]
    <IFEO[sxs.exe]><AUTOGUARDER GUARDED.>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\test.exe]
    <IFEO[test.exe]><AUTOGUARDER GUARDED.>  [N/A]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1152, C:\WINDOWS\SYSTEM32\SPOOLSV.EXE]

c:\windows\system32\userinit.exe 有可能被感染 建议发到http://www.virscan.org/ 检测下 有问题的话 找同系统文件替换之

删除以下文件
c:\windows\system32\ablkfkkd.dll

SREng修复下面各项：

    启动项目 －－ 注册表之如下项删除：
[AB54F44D]    <C:\windows\system32\ablkfkkd.dll>
[{AB54F44D-652A-447F-B2D8-44FD96937ECE}]    <C:\windows\system32\ablkfkkd.dll>
注意该项[AppInit_DLLs]修改：把<ablkfkkd.dll>修改为<>即清空
[IFEO[auto.exe]]    <AUTOGUARDER GUARDED.>
[IFEO[MSDOS.bat]]    <AUTOGUARDER GUARDED.>
[IFEO[ntldr.exe]]    <AUTOGUARDER GUARDED.>
[IFEO[pagefile.pif]]    <AUTOGUARDER GUARDED.>
[IFEO[sos.exe]]    <AUTOGUARDER GUARDED.>
[IFEO[sxs.exe]]    <AUTOGUARDER GUARDED.>
[IFEO[test.exe]]    <AUTOGUARDER GUARDED.>

启动项目
注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><ablkfkkd.dll>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><C:\windows\system32\XPtoVista\Logonui.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{AB54F44D-652A-447F-B2D8-44FD96937ECE}><C:\windows\system32\ablkfkkd.dll>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    <AB54F44D><C:\windows\system32\ablkfkkd.dll>  []
==================================
正在运行的进程
[PID: 1380][C:\windows\explorer.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\windows\system32\ablkfkkd.dll]  [N/A, ]
[PID: 896][C:\windows\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\windows\system32\ablkfkkd.dll]  [N/A, ]
[PID: 2572][C:\Temp\Rar$EX00.922\SREae94e837.EXE]  [Smallfrogs Studio, 2.7.0.1210]
    [C:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\COMCTL32.dll]  [Microsoft Corporation, 6.0 (xpsp.060825-0040)]
    [C:\windows\system32\ablkfkkd.dll]  [N/A, ]
==================================

可疑的地方：
autoguarder guarded.
C:\windows\system32\ablkfkkd.dll>
把[AppInit_DLLs]项的值清空
镜像劫持：
[IFEO[auto.exe]]    <AUTOGUARDER GUARDED.>
[IFEO[MSDOS.bat]]    <AUTOGUARDER GUARDED.>
[IFEO[ntldr.exe]]    <AUTOGUARDER GUARDED.>
[IFEO[pagefile.pif]]    <AUTOGUARDER GUARDED.>
[IFEO[sos.exe]]    <AUTOGUARDER GUARDED.>
[IFEO[sxs.exe]]    <AUTOGUARDER GUARDED.>
[IFEO[test.exe]]    <AUTOGUARDER GUARDED.>

C:\windows\system32\ablkfkkd.dll
C:\windows\system32\ablkfkkd.dll
还有修复映像挟持

1.[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><ablkfkkd.dll>  []清空
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><C:\windows\system32\XPtoVista\Logonui.exe>  [Microsoft Corporation]
XP  to  Vista？
<{AB54F44D-652A-447F-B2D8-44FD96937ECE}><C:\windows\system32\ablkfkkd.dll>  []
<AB54F44D><C:\windows\system32\ablkfkkd.dll>  []
2.[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto.exe]
    <IFEO[auto.exe]><AUTOGUARDER GUARDED.>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSDOS.bat]
    <IFEO[MSDOS.bat]><AUTOGUARDER GUARDED.>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntldr.exe]
    <IFEO[ntldr.exe]><AUTOGUARDER GUARDED.>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pagefile.pif]
    <IFEO[pagefile.pif]><AUTOGUARDER GUARDED.>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sos.exe]
    <IFEO[sos.exe]><AUTOGUARDER GUARDED.>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sxs.exe]
    <IFEO[sxs.exe]><AUTOGUARDER GUARDED.>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\test.exe]
    <IFEO[test.exe]><AUTOGUARDER GUARDED.>  [N/A]
劫持又是

==================================
[PID: 2572][C:\Temp\Rar$EX00.922\SREae94e837.EXE]  [Smallfrogs Studio, 2.7.0.1210]
    [C:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-

ww_ac3f9c03\COMCTL32.dll]  [Microsoft Corporation, 6.0 (xpsp.060825-0040)]有问题为什么。。




进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 1152, C:\WINDOWS\SYSTEM32\SPOOLSV.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2556, C:\TEMP\RAR$EX00.922\SRENGLDR.EXE]
为什么 没有问题。:kaka2:

为了练习日志分析，今天分析这个日志。
现有以下疑问：

1、关于ablkfkkd.dll此文件觉得很可疑，首先文件名很奇怪有，凡带有此文件的项公司版本信息均无，而且<AppInit_DLLs><ablkfkkd.dll>  []项默认情况为<AppInit_DLLs><>  ，这里也不正常
<AppInit_DLLs><ablkfkkd.dll>  []
<{AB54F44D-652A-447F-B2D8-44FD96937ECE}><C:\windows\system32\ablkfkkd.dll>  []
<AB54F44D><C:\windows\system32\ablkfkkd.dll>  []
  [C:\windows\system32\ablkfkkd.dll]  [N/A]

所以觉得这些项可疑，觉得应该删除这些项，并删除该文件。

2、有些项后面标明[File is missing]，觉得有问题，不知该如何修复。

<Bdangel><F:\安装软件包\系统工具\上网提速王\bdan>  [File is missing]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [File is missing]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [File is missing]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [File is missing]


3、如何判断劫持项，如何判断劫持项是用来免疫病毒的。
记得7月8日 日志分析 练习1中也有IFEO项，那些是病毒搞的鬼。本贴却说明，该日志中通过文件名判断，这些劫持项是用来免疫病毒的，不需要处理。
<IFEO[auto.exe]><AUTOGUARDER GUARDED.>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSDOS.bat]
    <IFEO[MSDOS.bat]><AUTOGUARDER GUARDED.>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntldr.exe]
    <IFEO[ntldr.exe]><AUTOGUARDER GUARDED.>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pagefile.pif]
    <IFEO[pagefile.pif]><AUTOGUARDER GUARDED.>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sos.exe]
    <IFEO[sos.exe]><AUTOGUARDER GUARDED.>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sxs.exe]
    <IFEO[sxs.exe]><AUTOGUARDER GUARDED.>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\test.exe]
    <IFEO[test.exe]><AUTOGUARDER GUARDED.>  [N/A]