瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 auto.exe(Trojan.IMMSG.Win32.TBMSG)及其下载的木马群的处理

«12345678»   5  /  13  页   跳转

auto.exe(Trojan.IMMSG.Win32.TBMSG)及其下载的木马群的处理

==================================
HOSTS 文件
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<title>Drcom上网登录窗                        </title>
<style><!--
a {text-decoration: none}
.f1 { font-size: 9pt; font-family: Verdana; line-height: 14pt }
.f2 { font-size: 8pt; font-family: Verdana; line-height: 12pt }
-->
</style>
</head><body topmargin="0" leftmargin="0"><form name=form1 method=post action="">
<center>
<table width=895 border=0 height=592 cellspacing="0" cellpadding="0" style="border-collapse: collapse" bordercolor="#111111">
<tr>
<td height=300 width="570" background="a01.gif">
<div align="center">
<center>
<table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" bordercolor="#111111" width="80%" height="264">
<tr>
<td width="17%" height="65"> </td>
<td width="29%" height="65"> </td>
<td width="32%" height="65"> </td>
<td width="22%" height="65"> </td>
</tr>
<tr>
<td width="17%" height="37"> </td>
<td width="29%" height="37" align="right" class="f1"><b>
<font color="#FFFFFF" style="font-size: 10.5pt">帐号 Account :</font></b></td>
<td width="32%" height="37"> <input name=DDDDD maxlength=26 style="border:1px solid #999999; FONT-SIZE: 9pt; BACKGROUND: #ffffff; COLOR: #000000; FONT-FAMILY: verdana; 1px:" size="20"></td>
<td width="22%" height="37"> </td>
</tr>
<tr>
<td width="17%" height="29"> </td>
<td width="29%" height="29" align="right" class="f1"><b>
<font color="#FFFFFF" style="font-size: 10.5pt">密码 Password :</font></b></td>
<td width="32%" height="29"> <input type=password name=upass maxlength=16 style="border:1px solid #999999; FONT-SIZE: 9pt; BACKGROUND: #ffffff; COLOR: #000000; FONT-FAMILY: verdana; 1px:" size="20"></td>
<td width="22%" height="29"> </td>
</tr>
<tr>
<td width="17%" height="47"> </td>
<td width="61%" height="47" colspan="2"><p align=center>
<input type=submit name=0MKKey value="登录 Login" style=" BACKGROUND-COLOR: rgb(105,130,150); BORDER-BOTTOM: rgb(100,130,160) 1px solid; BORDER-LEFT: rgb(139,141,218) 1px solid; BORDER-RIGHT: rgb(23,24,79) 1px solid; BORDER-TOP: rgb(194,217,227) 1px solid; COLOR: rgb(255,255,255); font-size: 9pt; font-family: Verdana; height: 25; width: 120">   
<input type=reset name=1MKKey value="重置 Reset" style=" BACKGROUND-COLOR: rgb(105,130,150); BORDER-BOTTOM: rgb(23,24,79) 1px solid; BORDER-LEFT: rgb(139,141,218) 1px solid; BORDER-RIGHT: rgb(23,24,79) 1px solid; BORDER-TOP: rgb(194,217,227) 1px solid; COLOR: rgb(255,255,255); font-size: 9pt; font-family: Verdana; height: 25; width: 120"></td>
<td width="22%" height="47"> </td>
</tr>
<tr>
<td width="17%" height="48"> </td>
<td width="29%" height="48">
<p class=f1 align=center><b><font color=#FFFFFF><a href="9.htm"><u>
<font color="#FFFFFF" style="font-size: 10.5pt">修改密码</font></u></a></font></b></td>
<td width="32%" height="48">
<p align="center" class="f1"><b><font color="#FFFFFF"><a href="a78.htm">
<u><font color="#FFFFFF" style="font-size: 10.5pt">储值卡充值</font></u></a></font></b></td>
<td width="22%" height="48"> </td>
</tr>
<tr>
<td width="17%" height="38"> </td>
<td width="29%" height="38"> </td>
<td width="32%" height="38"> </td>
<td width="22%" height="38"> </td>
</tr>
</table>
</center>
</div>
</td>
<td height=592 rowspan="2" width="325" background="a03.gif">
 </td></tr>
<tr>
<td height=292 width="570" background="a02.gif">
<table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" bordercolor="#111111" width="100%" height="271">
<tr>
<td width="100%" valign="bottom" height="271">
<p align="center" class="f1"><font color="#FFFFFF">本宽带接入服务器由</font><a target="_blank" href="http://www.doctorcom.com"><font color="#FFFFFF"><u>城市热点</u></font></a><font color="#FFFFFF">提供.
Provider </font> <a href="http://www.doctorcom.com"><font color="#FFFFFF">
<u>CITY HOTSPOT</u></font></a><font color="#FFFFFF">.</font></td>
</tr>
</table>
</td></tr></table></center></form></body></html>
gototop
 

==================================
进程特权扫描
特殊特权被允许: SeLoadDriverPrivilege [PID = 832, C:\PROGRAM FILES\RISING\ANTISPYWARE\RUNIEP.EXE]
特殊特权被允许: SeLoadDriverPrivilege [PID = 1228, E:\TOOLS\RISING\RAV\RAVTASK.EXE]
特殊特权被允许: SeLoadDriverPrivilege [PID = 1248, E:\TOOLS\RISING\RAV\RAVMON.EXE]
特殊特权被允许: SeLoadDriverPrivilege [PID = 3624, E:\TOOLS\RISING\RAV\RAV.EXE]
特殊特权被允许: SeLoadDriverPrivilege [PID = 1416, E:\TOOLS\RISING\RAV\RSAGENT.EXE]
特殊特权被允许: SeLoadDriverPrivilege [PID = 3548, C:\PROGRAM FILES\TTPLAYER\TTPLAYER.EXE]

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================


[/CODE]
gototop
 

==================================
进程特权扫描
特殊特权被允许: SeLoadDriverPrivilege [PID = 832, C:\PROGRAM FILES\RISING\ANTISPYWARE\RUNIEP.EXE]
特殊特权被允许: SeLoadDriverPrivilege [PID = 1228, E:\TOOLS\RISING\RAV\RAVTASK.EXE]
特殊特权被允许: SeLoadDriverPrivilege [PID = 1248, E:\TOOLS\RISING\RAV\RAVMON.EXE]
特殊特权被允许: SeLoadDriverPrivilege [PID = 3624, E:\TOOLS\RISING\RAV\RAV.EXE]
特殊特权被允许: SeLoadDriverPrivilege [PID = 1416, E:\TOOLS\RISING\RAV\RSAGENT.EXE]
特殊特权被允许: SeLoadDriverPrivilege [PID = 3548, C:\PROGRAM FILES\TTPLAYER\TTPLAYER.EXE]

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================


[/CODE]
gototop
 

qiu gao shou kuai bang mang sha du
wo shi cainiao ji de
xian zai zhinenABC du yong bu liao le
gototop
 

楼主,我试过了,但还是有呀。怎么办?
gototop
 

我的电脑出现木马Trojan-psw 病毒, 删不掉怎么办?症状是计算机运行慢。虽然瑞星每次都可以删除他们,但重新开机后就又出现了了。有啥办法能根除他们哩。而且这些文件似乎是自动生成的。不知道怎样才能找到那个生成他们的文件。问题不是删不掉他们,问题是删了以后,他们会不断自己生成同时,杀毒软件任务栏图标有时自行由撑开的绿伞变成收拢的红伞;还有就是我的隐藏文件再怎么弄也弄不出来,用工具选项修改、按网友介绍的修改注册表键值等办法都不谢了,版主,我的电脑已经为此折腾我好几天了,到现在都没有解决。晚上下班回家再用你的方法看能解决不。
gototop
 

有没搞错啊.这么麻烦哦.
gototop
 

非常感谢,按照你的帖子,我已杀掉了木马!!
gototop
 

楼主 帮忙呀 我点删除服务后点设置键 没反映呀???
gototop
 

注册表里的不让删除啊
gototop
 
«12345678»   5  /  13  页   跳转
页面顶部
Powered by Discuz!NT