瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 貌似是机器狗文件,详细入内!BAOHE求助

12   1  /  2  页   跳转

貌似是机器狗文件,详细入内!BAOHE求助

貌似是机器狗文件,详细入内!BAOHE求助

1。安全模式被破坏,无法进入。
2。卡卡安全助手无法自启动。
3。众多专杀无法启动,甚至是扫描软件,如SRENG。双击运行则.EXE文件自动删除。
4。字体库貌似被破坏,KUGOO启动显示乱码

一。
监控中心一直截获Trojan.PSW.Win32.GamesOnline.jc或类似的变种病毒。或者是Trojan.PSW.Win32.OnlineGAME.或者Trojan.PSW.Win32.GamesOL.这3种软件的大量变种。
二。
在c:\widows\system32\driver\下生成1~20.exe 1~20.txt
三。
同时有拼音倒写病毒,如uohsom.dll等等类似网络游戏盗号程序。c:\widows\system32\下有大量类似IGB_CQSJ_1022.exe以IGB开头的EXE程序。
求助了。

[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Mozilla/4.0(Compatible Mozilla/4.0(Compatible-EmbeddedWB 14.59 http://bsalsa.com/ EmbeddedWB- 14.59  from: http://bsalsa.com/ ; Maxthon)
最后编辑2008-01-27 15:52:08
分享到:
gototop
 

我也是中了机器狗,瑞星启动不了,哎~~你还是重装吧
gototop
 

把防火墙的模块功能打开,然后重启,重启后一路拒绝。再用杀软杀毒。
gototop
 

【回复“LMhust”的帖子】
恩。我是这么一路拒绝的
可是那么多病毒。RISING只杀了3个
Logfile of HijackThis v1.99.1
Scan saved at 12:32:12, on 2008-1-26
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
f:\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
F:\RISING\RAV\Ravmond.exe
f:\Rising\Rfw\rfwsrv.exe
f:\Rising\Rfw\rfwProxy.exe
F:\RISING\RAV\RavStub.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\conime.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\spoolsv.exe
F:\RISING\RAV\RavMon.exe
F:\USBCleaner6.0\usbmon.exe
f:\Rising\Rfw\RfwMain.exe
F:\Rising\Rav\RavTask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\attrib.exe
F:\Maxthon\Maxthon.exe
F:\Winamp\Winamp.exe
F:\Thunder\Program\Thunder5.exe
D:\TDDOWNLOAD\hijackthis.exe

F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: Thunder AtOnce - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - F:\Thunder\ComDlls\TDAtOnce_Now.dll
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - F:\Thunder\ComDlls\xunleiBHO_Now.dll
O2 - BHO: (no name) - {9963387B-212E-4643-B207-82DAEA0E713D} - C:\Program Files\Internet Explorer\PLUGINS\Wn_Sys8x.Sys
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [USBMon] F:\USBCleaner6.0\usbmon.exe
O4 - HKLM\..\Run: [RavTask] "f:\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [RfwMain] "f:\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [cmdbcs] C:\WINDOWS\cmdbcs.exe
O4 - HKLM\..\RunOnce: [KKDelay] F:\Rising\AntiSpyware\RunOnce.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: 使用iTudou下载节目 - F:\Tudou\iTudou\iTudou_Link.HTM
O8 - Extra context menu item: 使用迅雷下载 - F:\Thunder\Program\geturl.htm
O8 - Extra context menu item: 使用迅雷下载全部链接 - F:\Thunder\Program\getallurl.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://F:\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ表情 - f:\Tencent\QQ\AddEmotion.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{EFE46161-CACA-4BEE-A99B-9D7C62C15482}: NameServer = 218.85.157.99 202.101.107.54
O18 - Protocol: KuGoo - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - C:\WINDOWS\system32\KuGoo3DownXControl.ocx
O18 - Protocol: KuGoo3 - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - C:\WINDOWS\system32\KuGoo3DownXControl.ocx
O20 - AppInit_DLLs: gnefnaib.dll,rj.dll,aixauh.dll,nuygnef.dll,jmx.dll,oadgnohiac.dll,dgzg.dll,vlihzouhgnfe.dll,sfhx.dll,ijougiemnaw.dll,fmxh.dll,2ty.dll,wtwx.dll,gnaixnauhuoyizqq.dll,gnaixnauhqq.dll,2nauygniqaixnaij.dll,naijihzeuyouhz.dll,iemnaw.dll,eve.dll,ddtj.dll,naijoad.dll,jsfg.dll,zqhs.dll,niluw.dll,naixuhz.dll,jsqc.dll,qcsct.dll,QQ.dll,utgnehz.dll,nauhgnem.dll,nahzij.dll,fz.dll,hz.dll,iqnauhc.dll,3auhad.dll,xhtd.dll,uohsom.dll,uyom.dll,gnolnait.dll,oadnew.dll,ijiq.dll,gsqq.dll,uyomielnux.dll,hjxr.dll,auhad.dll,wtiemnaw.dll,dqncj.dll,lnaixnauhqq.dll,mnauygniqaixnaij.dll,fyom.dll,gnolnait.dll,hjiq.dll,bz.dll,bauhgnem.dll,cuhad.dll,vhqq.dll,gmx.dll,htwx.dll,idtj.dll,duygnef.dll,eohsom.dll,mhtd.dll,nadgnohiac.dll,oqnauhc.dll,pahzij.dll,qnefnaib.dll,rsqq.dll,zadnew.dll,agzg.dll,atgnehz.dll,rfhx.dll,sve.dll,tsqc.dll,utiemnaw.dll,wQ.dll,ej.dll,fmxh.dll,knaixnauhuoyizqq.dll,kiluw.dll,laixuhz.dll,uixauh.dll,jemnaw.dll,jz.dll,pyomielnux.dll,qlihzouhgnfe.dll,cty.dll,dsfg.dll,vauyiqvlnaix.dll,ijougiemnaw.dll,sauh
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - f:\Rising\Rfw\rfwProxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - f:\Rising\Rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - f:\Rising\Rav\CCenter.exe
O23 - Service: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - F:\RISING\RAV\Ravmond.exe

这是HIJACKTHIS的扫描。只有这个扫描软件能用
gototop
 

机器狗已经成为中毒者家常便饭了。


扫SRENG日志发来
http://download.kztechs.com/files/sreng2.zip
下载System Repair Engineer
1 解压缩sreng2.zip
2 运行SREng.exe
3 智能扫描=》扫描=》保存报告
4 把报告保存后,直接将日志内容彻底复制到一个空记事本里,然后再保存,就可以以附件的形式发来了。
一定以附件形式发来
gototop
 

【回复“天月来了”的帖子】我也想。。
但是在我这SRENG根本打不开
gototop
 

将SREng.exe改名为123.com运行试试。
gototop
 

【回复“天月来了”的帖子】
不行。。。

天啊。我可不想重做系统
gototop
 

AppInit_DLLs: gnefnaib.dll,rj.dll,aixauh.dll,nuygnef.dll,jmx.dll,oadgnohiac.dll,dgzg.dll,vlihzouhgnfe.dll,sfhx.dll,ijougiemnaw.dll,fmxh.dll,2ty.dll,wtwx.dll,gnaixnauhuoyizqq.dll,gnaixnauhqq.dll,2nauygniqaixnaij.dll,naijihzeuyouhz.dll,iemnaw.dll,eve.dll,ddtj.dll,naijoad.dll,jsfg.dll,zqhs.dll,niluw.dll,naixuhz.dll,jsqc.dll,qcsct.dll,QQ.dll,utgnehz.dll,nauhgnem.dll,nahzij.dll,fz.dll,hz.dll,iqnauhc.dll,3auhad.dll,xhtd.dll,uohsom.dll,uyom.dll,gnolnait.dll,oadnew.dll,ijiq.dll,gsqq.dll,uyomielnux.dll,hjxr.dll,auhad.dll,wtiemnaw.dll,dqncj.dll,lnaixnauhqq.dll,mnauygniqaixnaij.dll,fyom.dll,gnolnait.dll,hjiq.dll,bz.dll,bauhgnem.dll,cuhad.dll,vhqq.dll,gmx.dll,htwx.dll,idtj.dll,duygnef.dll,eohsom.dll,mhtd.dll,nadgnohiac.dll,oqnauhc.dll,pahzij.dll,qnefnaib.dll,rsqq.dll,zadnew.dll,agzg.dll,atgnehz.dll,rfhx.dll,sve.dll,tsqc.dll,utiemnaw.dll,wQ.dll,ej.dll,fmxh.dll,knaixnauhuoyizqq.dll,kiluw.dll,laixuhz.dll,uixauh.dll,jemnaw.dll,jz.dll,pyomielnux.dll,qlihzouhgnfe.dll,cty.dll,dsfg.dll,vauyiqvlnaix.dll,ijougiemnaw.dll,sauh

不知道病毒作者想干什么,汗……
gototop
 

不想重装的话,可以启动进入DOS手工删除楼上给出的在system32下的病毒文件,然后重启进入安全模式,应该可以用SREng了
gototop
 
12   1  /  2  页   跳转
页面顶部
Powered by Discuz!NT