瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 【求助】大侠们帮帮小妹,电脑中了N中木马,救救我啊!!!(附日志)

123   3  /  3  页   跳转

【求助】大侠们帮帮小妹,电脑中了N中木马,救救我啊!!!(附日志)

[PID: 348][C:\WINNT\system32\cmd.exe]  <Microsoft Corporation><5.00.2195.6656>
[PID: 1324][C:\WINNT\system32\conime.exe]  <Microsoft Corporation><5.00.2195.6655>
    [C:\Program Files\Internet Explorer\WinHook.sys]  <N/A><N/A>
    [C:\WINNT\system32\3.dll]  <N/A><N/A>
    [C:\WINNT\regsvr.dll]  <N/A><N/A>
[PID: 984][C:\WINNT\smss.exe]  <N/A><N/A>
    [C:\WINNT\regsvr.dll]  <N/A><N/A>
    [C:\Program Files\Internet Explorer\WinHook.sys]  <N/A><N/A>
    [C:\WINNT\system32\3.dll]  <N/A><N/A>
[PID: 836][C:\Program Files\Tencent\QQ\QQ.exe]  <TENCENT><0, 0, 0, 0>
    [C:\Program Files\Tencent\QQ\QQBaseClassInDll.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\QQ\QQHelperDll.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\QQ\BasicCtrlDll.dll]  <Tencent><5, 0, 200, 14>
    [C:\WINNT\regsvr.dll]  <N/A><N/A>
    [C:\Program Files\Internet Explorer\WinHook.sys]  <N/A><N/A>
    [C:\Program Files\Tencent\QQ\LoginCtrl.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\QQ\npkcntc.dll]  <INCA Internet Co., Ltd.><2005, 9, 1, 1>
    [C:\Program Files\Tencent\QQ\npkpdb.dll]  <INCA Internet Co., Ltd.><2003, 10, 1, 1>
    [C:\Program Files\Tencent\QQ\QQAPI.dll]  <><1, 0, 0, 1>
    [C:\WINNT\system32\3.dll]  <N/A><N/A>
    [C:\WINNT\system32\winfinds.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\QQ\QQRes.dll]  <tencent><1, 0, 0, 1>
    [C:\Program Files\Tencent\QQ\QQMainFrame.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\QQ\CQQApplication.dll]  <N/A><N/A>
    [C:\WINNT\system32\cn_spi32.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\QQ\NewSkin.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\QQ\HostingMgr.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\QQ\CameraDll.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\QQ\MailSummary.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\QQ\QQSpace.dll]  <><1, 0, 0, 1>
    [C:\WINNT\system32\msdmo.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\QQ\QQGroupMng.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\QQ\UserDefinedHead.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\QQ\QQPlugin.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\QQ\QQConfigPlugin.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\QQ\QRingMng.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\QQ\PhoneAPI.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\QQ\DialerAllinOne.dll]  <tencent><1, 4, 0, 0>
    [C:\Program Files\Tencent\QQ\QQAvatar.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\QQ\FlashAvatarDll.dll]  <><1, 4, 0, 1>
    [C:\Program Files\Tencent\QQ\LongConnection.dll]  <tencent><5, 0, 201, 14>
    [C:\Program Files\Tencent\QQ\QQPet.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\QQ\QQSysMsgMng.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\QQ\QQAllInOne.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\QQ\SCCore.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\QQ\QQCustomFace.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\QQ\GroupConnection.dll]  <Tencent><0, 3, 3, 5>
    [C:\Program Files\Tencent\QQ\BQQApplication.dll]  <N/A><N/A>
    [C:\WINNT\system32\RavExt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
    [C:\Program Files\Tencent\QQ\CommercesMng.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Tencent\QQ\PersonalDesktop.dll]  <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2>
    [C:\Program Files\Tencent\QQ\QQAddr.dll]  <深圳市腾讯计算机系统有限公司><5, 0, 101, 140>
    [C:\Program Files\Tencent\QQ\QQSceneMng.dll]  <N/A><N/A>
    [C:\Program Files\Tencent\QQ\QQPhoneHelper.dll]  <腾讯科技(深圳)有限公司><2, 0, 6, 60>
[PID: 1808][D:\sreng2\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>
    [C:\WINNT\regsvr.dll]  <N/A><N/A>
    [C:\Program Files\Internet Explorer\WinHook.sys]  <N/A><N/A>
    [C:\WINNT\system32\3.dll]  <N/A><N/A>
    [C:\WINNT\system32\winfinds.dll]  <N/A><N/A>
    [C:\WINNT\system32\cn_spi32.dll]  <N/A><N/A>

==================================
文件关联
.TXT  Error. [NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================
gototop
 

请到www.27814939.ys168.com,点“我的软件”下载KillBox.exe
重新启动电脑, 开机检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式进入Windows
运行System Repair Engineer,使用“系统修复,文件关联"修复所有文件关联
运行System Repair Engineer,使用“启动项目,注册表”来删除以下选项
<{288BD9BD-F0DC-46B1-81B5-2B61DF8077CE}><C:\WINNT\system32\svchost.dLl> []
<{EFAE7B4A-FA39-4818-ACAC-6B6D851CEFF4}><C:\Program Files\Internet Explorer\WinHook.sys> []
<{CF49F9F2-A8D3-464F-83EC-6AFC6573C267}><C:\WINNT\system32\3.dll> []
<{C09E3B07-E028-4D8D-B754-76807FA8110C}><C:\WINNT\system32\winfinds.dll> []
<{3FDEB171-8F86-4669-B664-69B8DB553683}><C:\NTLDR.DLL> []
双击打开KillBox.exe,分别删除
C:\WINNT\system32\svchost.dLl
C:\Program Files\Internet Explorer\WinHook.sys
C:\WINNT\system32\3.dll
C:\WINNT\system32\winfinds.dll
C:\NTLDR.DLL
(删除时勾选“删除前先结束Explorer.EXE进程”)
注:后缀为.dll的文件如果无法删除,请勾选"反注册""再删除
运行LSPFix ... 勾上 我确定要进行修复操作 ...
然后将cn_spi32.dll移到右边...点下完成...
----------------------------------------------------------------
如果在操作之后不能上网...请用WinsockXPFix.exe 修复一下即可...安全模式下..
gototop
 
123   3  /  3  页   跳转
页面顶部
Powered by Discuz!NT