瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 求助：Trojan.DL.QQhelper.fck和Trojan.DL.QQHelperJ.a 病毒

123   3  /  3  页   跳转页

求助：Trojan.DL.QQhelper.fck和Trojan.DL.QQHelperJ.a 病毒

收藏
yangli2001
头像
初生襁褓狮
  • 帖子:16
  • 注册: 2007-04-22
  • 来自:
发表于： 2007-04-28 22:51 | 只看楼主 短消息 资料
字号： 小 中 大 21楼

正在运行的进程
[PID: 140][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.00.2195.6601]
    [C:\WINNT\system32\ntdll.dll]  [Microsoft Corporation, 5.00.2195.7006]
    [C:\WINNT\System32\sfcfiles.dll]  [Microsoft Corporation, 5.00.2195.7038]
[PID: 176][\??\C:\WINNT\system32\csrss.exe]  [Microsoft Corporation, 5.00.2195.6601]
    [C:\WINNT\system32\ntdll.dll]  [Microsoft Corporation, 5.00.2195.7006]
    [C:\WINNT\system32\CSRSRV.dll]  [Microsoft Corporation, 5.00.2195.6824]
    [C:\WINNT\system32\basesrv.dll]  [Microsoft Corporation, 5.00.2195.7011]
    [C:\WINNT\system32\winsrv.dll]  [Microsoft Corporation, 5.00.2195.7061]
    [C:\WINNT\system32\USER32.dll]  [Microsoft Corporation, 5.00.2195.7032]
    [C:\WINNT\system32\KERNEL32.dll]  [Microsoft Corporation, 5.00.2195.7099]
    [C:\WINNT\system32\GDI32.dll]  [Microsoft Corporation, 5.00.2195.7073]
    [C:\WINNT\system32\LPK.DLL]  [Microsoft Corporation, 5.00.2195.6692]
    [C:\WINNT\system32\USP10.dll]  [Microsoft Corporation, 1.0325.2195.6692]
    [C:\WINNT\system32\ADVAPI32.dll]  [Microsoft Corporation, 5.00.2195.7038]
    [C:\WINNT\system32\RPCRT4.dll]  [Microsoft Corporation, 5.00.2195.7085]
[PID: 432][C:\WINNT\system32\UserInit.exe]  [Microsoft Corporation, 5.00.2195.6612]
    [C:\WINNT\system32\ntdll.dll]  [Microsoft Corporation, 5.00.2195.7006]
    [C:\WINNT\system32\ADVAPI32.dll]  [Microsoft Corporation, 5.00.2195.7038]
    [C:\WINNT\system32\KERNEL32.dll]  [Microsoft Corporation, 5.00.2195.7099]
    [C:\WINNT\system32\RPCRT4.dll]  [Microsoft Corporation, 5.00.2195.7085]
    [C:\WINNT\system32\CRYPT32.dll]  [Microsoft Corporation, 5.131.2195.6926]
    [C:\WINNT\system32\MSASN1.dll]  [Microsoft Corporation, 5.00.2195.6905]
    [C:\WINNT\system32\MSVCRT.dll]  [Microsoft Corporation, 6.10.9844.0]
    [C:\WINNT\system32\USER32.dll]  [Microsoft Corporation, 5.00.2195.7032]
    [C:\WINNT\system32\GDI32.dll]  [Microsoft Corporation, 5.00.2195.7073]
    [C:\WINNT\system32\WINSPOOL.DRV]  [Microsoft Corporation, 5.00.2195.6659]
    [C:\WINNT\system32\MPR.DLL]  [Microsoft Corporation, 5.00.2195.6824]
    [C:\WINNT\system32\SHELL32.dll]  [Microsoft Corporation, 5.00.3900.7105]
    [C:\WINNT\system32\SHLWAPI.dll]  [Microsoft Corporation, 6.00.2800.1902 (xpsp2.070102-0900)]
    [C:\WINNT\system32\COMCTL32.dll]  [Microsoft Corporation, 5.81]
    [C:\WINNT\system32\IMM32.dll]  [Microsoft Corporation, 5.00.2195.6655]
    [C:\WINNT\system32\USERENV.dll]  [Microsoft Corporation, 5.00.2195.7002]
    [C:\WINNT\system32\LPK.DLL]  [Microsoft Corporation, 5.00.2195.6692]
    [C:\WINNT\system32\USP10.dll]  [Microsoft Corporation, 1.0325.2195.6692]
[PID: 308][C:\WINNT\Explorer.EXE]  [Microsoft Corporation, 5.00.3700.6690]
    [C:\WINNT\system32\ntdll.dll]  [Microsoft Corporation, 5.00.2195.7006]
    [C:\WINNT\system32\ADVAPI32.DLL]  [Microsoft Corporation, 5.00.2195.7038]
    [C:\WINNT\system32\KERNEL32.dll]  [Microsoft Corporation, 5.00.2195.7099]
    [C:\WINNT\system32\RPCRT4.dll]  [Microsoft Corporation, 5.00.2195.7085]
    [C:\WINNT\system32\GDI32.DLL]  [Microsoft Corporation, 5.00.2195.7073]
    [C:\WINNT\system32\USER32.dll]  [Microsoft Corporation, 5.00.2195.7032]
    [C:\WINNT\system32\SHLWAPI.DLL]  [Microsoft Corporation, 6.00.2800.1902 (xpsp2.070102-0900)]
    [C:\WINNT\system32\msvcrt.dll]  [Microsoft Corporation, 6.10.9844.0]
    [C:\WINNT\system32\COMCTL32.DLL]  [Microsoft Corporation, 5.81]
    [C:\WINNT\system32\IMM32.DLL]  [Microsoft Corporation, 5.00.2195.6655]
    [C:\WINNT\system32\LPK.DLL]  [Microsoft Corporation, 5.00.2195.6692]
    [C:\WINNT\system32\USP10.dll]  [Microsoft Corporation, 1.0325.2195.6692]
    [C:\WINNT\system32\shim.dll]  [Microsoft Corporation, 5.00.2195.6717]
    [C:\WINNT\AppPatch\AcLayers.DLL]  [Microsoft Corporation, 5.00.2195.6717]
    [C:\WINNT\system32\SHELL32.dll]  [Microsoft Corporation, 5.00.3900.7105]
    [C:\WINNT\system32\IMSC40A.IME]  [Microsoft Corporation, 6.0.0.2527]
    [C:\WINNT\system32\OLEAUT32.dll]  [Microsoft Corporation, 2.40.4522]
    [C:\WINNT\system32\ole32.dll]  [Microsoft Corporation, 5.00.2195.7059]
    [C:\WINNT\system32\CLBCATQ.DLL]  [Microsoft Corporation, 2000.2.3529.0]
    [C:\WINNT\system32\AcSignIcon.dll]  [Autodesk, 16.0.0.86]
    [C:\WINNT\system32\WINSPOOL.DRV]  [Microsoft Corporation, 5.00.2195.6659]
    [C:\WINNT\system32\MPR.DLL]  [Microsoft Corporation, 5.00.2195.6824]
    [C:\WINNT\system32\OLEACC.dll]  [Microsoft Corporation, 4.2.3100.0]
    [C:\WINNT\system32\msctf.dll]  [Microsoft Corporation, 1.00.2409.34 built by: Lab06_N]
    [C:\WINNT\system32\SHDOCVW.DLL]  [Microsoft Corporation, 6.00.2800.1902 (xpsp2.070102-0900)]
    [C:\WINNT\System32\browseui.dll]  [Microsoft Corporation, 6.00.2800.1902 (xpsp2.070102-0900)]
    [C:\WINNT\system32\LINKINFO.DLL]  [Microsoft Corporation, 5.00.2195.7069]
    [C:\WINNT\system32\ntshrui.dll]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\ATL.DLL]  [Microsoft Corporation, 3.00.9435]
    [C:\WINNT\system32\NETAPI32.DLL]  [Microsoft Corporation, 5.00.2195.7108]
    [C:\WINNT\system32\Secur32.dll]  [Microsoft Corporation, 5.00.2195.6695]
    [C:\WINNT\system32\NTDSAPI.dll]  [Microsoft Corporation, 5.00.2195.6666]
    [C:\WINNT\system32\DNSAPI.DLL]  [Microsoft Corporation, 5.00.2195.7100]
    [C:\WINNT\system32\WSOCK32.dll]  [Microsoft Corporation, 5.00.2195.6603]
    [C:\WINNT\system32\WS2_32.DLL]  [Microsoft Corporation, 5.00.2195.6601]
    [C:\WINNT\system32\WS2HELP.DLL]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\WLDAP32.DLL]  [Microsoft Corporation, 5.00.2195.7017]
    [C:\WINNT\system32\NETRAP.dll]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\SAMLIB.dll]  [Microsoft Corporation, 5.00.2195.6944]
    [C:\WINNT\system32\USERENV.DLL]  [Microsoft Corporation, 5.00.2195.7002]
    [C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll]  [Autodesk, 16.0.0.86]
    [C:\WINNT\system32\CRYPT32.dll]  [Microsoft Corporation, 5.131.2195.6926]
    [C:\WINNT\system32\MSASN1.dll]  [Microsoft Corporation, 5.00.2195.6905]
    [C:\WINNT\system32\WININET.dll]  [Microsoft Corporation, 6.00.2800.1589]
    [C:\WINNT\System32\ntlanman.dll]  [Microsoft Corporation, 5.00.2195.6824]
    [C:\WINNT\System32\NETUI0.dll]  [Microsoft Corporation, 5.00.2195.6601]
    [C:\WINNT\System32\NETUI1.dll]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\urlmon.dll]  [Microsoft Corporation, 6.00.2800.1591]
    [C:\WINNT\system32\VERSION.dll]  [Microsoft Corporation, 5.00.2195.6623]
    [C:\WINNT\system32\LZ32.DLL]  [Microsoft Corporation, 5.00.2195.6611]
    [C:\Program Files\Nero\Nero 7\Nero BackItUp\NBShell.dll]  [Nero AG, 2, 0, 6, 1]
    [C:\Program Files\Nero\Nero 7\Nero BackItUp\MFC71U.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\Program Files\Nero\Nero 7\Nero BackItUp\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\Program Files\Nero\Nero 7\Nero BackItUp\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINNT\system32\MFC71CHS.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
    [C:\Program Files\Unlocker\UnlockerCOM.dll]  [N/A, ]
    [C:\WINNT\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
    [C:\WINNT\System32\browselc.dll]  [Microsoft Corporation, 6.00.2800.1106]
    [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
    [C:\WINNT\system32\WINMM.dll]  [Microsoft Corporation, 5.00.2161.1]
    [C:\WINNT\System32\docprop2.dll]  [Microsoft Corporation, 5.00.2178.1]
    [C:\WINNT\System32\MSVFW32.DLL]  [Microsoft Corporation, 5.00.2195.6612]
    [C:\WINNT\System32\AVIFIL32.DLL]  [Microsoft Corporation, 5.00.2195.6612]
    [C:\WINNT\System32\MSACM32.dll]  [Microsoft Corporation, 5.00.2134.1]
    [C:\Program Files\Common Files\Ahead\lib\NeroDigitalExt.dll]  [Nero AG, 2, 0, 0, 8]
    [C:\Program Files\Common Files\Ahead\lib\MFC71.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINNT\system32\faxshell.dll]  [Microsoft Corporation, 5.00.2134.1]
    [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll]  [Adobe Systems, Inc., 7.0.0.0]
    [C:\WINNT\system32\MSI.DLL]  [Microsoft Corporation, 3.1.4000.2435]
gototop
 
yangli2001
头像
初生襁褓狮
  • 帖子:16
  • 注册: 2007-04-22
  • 来自:
发表于： 2007-04-28 22:52 | 只看楼主 短消息 资料
字号： 小 中 大 22楼

[PID: 488][D:\sreng2\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
    [C:\WINNT\system32\ntdll.dll]  [Microsoft Corporation, 5.00.2195.7006]
    [C:\WINNT\system32\kernel32.dll]  [Microsoft Corporation, 5.00.2195.7099]
    [C:\WINNT\system32\USER32.dll]  [Microsoft Corporation, 5.00.2195.7032]
    [C:\WINNT\system32\GDI32.dll]  [Microsoft Corporation, 5.00.2195.7073]
    [C:\WINNT\system32\comdlg32.dll]  [Microsoft Corporation, 5.00.3700.6693]
    [C:\WINNT\system32\SHLWAPI.DLL]  [Microsoft Corporation, 6.00.2800.1902 (xpsp2.070102-0900)]
    [C:\WINNT\system32\msvcrt.dll]  [Microsoft Corporation, 6.10.9844.0]
    [C:\WINNT\system32\ADVAPI32.dll]  [Microsoft Corporation, 5.00.2195.7038]
    [C:\WINNT\system32\RPCRT4.dll]  [Microsoft Corporation, 5.00.2195.7085]
    [C:\WINNT\system32\COMCTL32.DLL]  [Microsoft Corporation, 5.81]
    [C:\WINNT\system32\SHELL32.DLL]  [Microsoft Corporation, 5.00.3900.7105]
    [C:\WINNT\system32\WINSPOOL.DRV]  [Microsoft Corporation, 5.00.2195.6659]
    [C:\WINNT\system32\MPR.DLL]  [Microsoft Corporation, 5.00.2195.6824]
    [C:\WINNT\system32\oledlg.dll]  [Microsoft Corporation, 1.0]
    [C:\WINNT\system32\ole32.dll]  [Microsoft Corporation, 5.00.2195.7059]
    [C:\WINNT\system32\OLEAUT32.dll]  [Microsoft Corporation, 2.40.4522]
    [C:\WINNT\system32\VERSION.dll]  [Microsoft Corporation, 5.00.2195.6623]
    [C:\WINNT\system32\LZ32.DLL]  [Microsoft Corporation, 5.00.2195.6611]
    [C:\WINNT\system32\CRYPT32.dll]  [Microsoft Corporation, 5.131.2195.6926]
    [C:\WINNT\system32\MSASN1.dll]  [Microsoft Corporation, 5.00.2195.6905]
    [C:\WINNT\system32\WINMM.dll]  [Microsoft Corporation, 5.00.2161.1]
    [C:\WINNT\system32\WS2_32.dll]  [Microsoft Corporation, 5.00.2195.6601]
    [C:\WINNT\system32\WS2HELP.DLL]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\WININET.dll]  [Microsoft Corporation, 6.00.2800.1589]
    [C:\WINNT\system32\IMM32.DLL]  [Microsoft Corporation, 5.00.2195.6655]
    [C:\WINNT\system32\LPK.DLL]  [Microsoft Corporation, 5.00.2195.6692]
    [C:\WINNT\system32\USP10.dll]  [Microsoft Corporation, 1.0325.2195.6692]
    [C:\WINNT\system32\RICHED20.DLL]  [Microsoft Corporation, 5.30.23.1227]
    [C:\WINNT\system32\IMSC40A.IME]  [Microsoft Corporation, 6.0.0.2527]
    [C:\WINNT\system32\msctf.dll]  [Microsoft Corporation, 1.00.2409.34 built by: Lab06_N]
    [C:\WINNT\system32\sfc.dll]  [Microsoft Corporation, 5.00.2195.6673]
    [C:\WINNT\system32\sfcfiles.dll]  [Microsoft Corporation, 5.00.2195.7038]
    [C:\WINNT\system32\Sensapi.dll]  [Microsoft Corporation, 5.00.2195.6627]
    [C:\WINNT\system32\wsock32.dll]  [Microsoft Corporation, 5.00.2195.6603]
    [C:\WINNT\system32\RASAPI32.DLL]  [Microsoft Corporation, 5.00.2195.6920]
    [C:\WINNT\system32\rasman.dll]  [Microsoft Corporation, 5.00.2195.6824]
    [C:\WINNT\system32\TAPI32.dll]  [Microsoft Corporation, 5.00.2195.6664]
    [C:\WINNT\system32\RTUTILS.DLL]  [Microsoft Corporation, 5.00.2168.1]
    [C:\WINNT\system32\USERENV.DLL]  [Microsoft Corporation, 5.00.2195.7002]
    [C:\WINNT\system32\netapi32.dll]  [Microsoft Corporation, 5.00.2195.7108]
    [C:\WINNT\system32\Secur32.dll]  [Microsoft Corporation, 5.00.2195.6695]
    [C:\WINNT\system32\NTDSAPI.dll]  [Microsoft Corporation, 5.00.2195.6666]
    [C:\WINNT\system32\DNSAPI.DLL]  [Microsoft Corporation, 5.00.2195.7100]
    [C:\WINNT\system32\WLDAP32.DLL]  [Microsoft Corporation, 5.00.2195.7017]
    [C:\WINNT\system32\NETRAP.dll]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\SAMLIB.dll]  [Microsoft Corporation, 5.00.2195.6944]
    [C:\WINNT\System32\rnr20.dll]  [Microsoft Corporation, 5.00.2195.6603]
    [C:\WINNT\system32\iphlpapi.dll]  [Microsoft Corporation, 5.00.2195.7097]
    [C:\WINNT\system32\ICMP.dll]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\MPRAPI.dll]  [Microsoft Corporation, 5.00.2181.1]
    [C:\WINNT\system32\ACTIVEDS.DLL]  [Microsoft Corporation, 5.00.2195.6601]
    [C:\WINNT\system32\ADSLDPC.DLL]  [Microsoft Corporation, 5.00.2195.6993]
    [C:\WINNT\system32\SETUPAPI.DLL]  [Microsoft Corporation, 5.00.2195.6622]
    [C:\WINNT\system32\DHCPCSVC.DLL]  [Microsoft Corporation, 5.00.2195.7085]
    [C:\WINNT\System32\winrnr.dll]  [Microsoft Corporation, 5.00.2160.1]
    [C:\WINNT\system32\rasadhlp.dll]  [Microsoft Corporation, 5.00.2195.7098]
    [C:\WINNT\system32\msafd.dll]  [Microsoft Corporation, 5.00.2195.6602]
    [C:\WINNT\System32\wshtcpip.dll]  [Microsoft Corporation, 5.00.2195.6601]
    [C:\WINNT\system32\urlmon.dll]  [Microsoft Corporation, 6.00.2800.1591]
    [C:\WINNT\system32\wintrust.dll]  [Microsoft Corporation, 5.131.2195.6824]
    [C:\WINNT\system32\IMAGEHLP.dll]  [Microsoft Corporation, 5.00.2195.6613]
    [C:\WINNT\system32\rsaenh.dll]  [Microsoft Corporation, 5.00.2195.6611]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================


[/CODE]
gototop
 
yangli2001
头像
初生襁褓狮
  • 帖子:16
  • 注册: 2007-04-22
  • 来自:
发表于： 2007-04-29 20:51 | 只看楼主 短消息 资料
字号： 小 中 大 23楼

大家帮个忙呀！已经两次扫描日志上来了。
gototop
 
yangli2001
头像
初生襁褓狮
  • 帖子:16
  • 注册: 2007-04-22
  • 来自:
发表于： 2007-04-30 23:23 | 只看楼主 短消息 资料
字号： 小 中 大 24楼

难道真没办法了，大家快帮帮忙呀。
gototop
 
<<上一主题|下一主题>>
123   3  /  3  页   跳转页
页面顶部
Powered by Discuz!NT