sdbot.atp.rootkit
重起之后，还是有啊
HijackThis_zww汉化版扫描日志 V1.99.1
保存于 9:21:56, 日期 2005-7-19
操作系统： Windows XP SP1 (WinNT 5.01.2600)
浏览器： Internet Explorer v6.00 SP1 (6.00.2800.1106)
当前运行的进程：
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\System32\PROMon.exe
D:\Program Files\Analog Devices\SoundMAX\Smtray.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\WINDOWS\system32\rundll32.exe
C:\KV2004\KVMonXP.kxp
C:\KV2004\KvXP.kxp
D:\WINDOWS\System32\MSRPC32.exe
D:\WINDOWS\System32\wuamk032.exe
D:\WINDOWS\System32\ctfmon.exe
D:\WINDOWS\System32\li32.exe
D:\WINDOWS\System32\DllHost.exe
C:\KV2004\KVSrvXP.exe
D:\WINDOWS\System32\nvsvc32.exe
D:\WINDOWS\System32\MSRPC32.exe
D:\WINDOWS\winmsd.exe
D:\Program Files\KVFW\kvfw.exe
D:\WINDOWS\system32\cmd.exe
D:\Program Files\HijackThis1991汉化版\HijackThis1991zww.exe
R3 - URLSearchHook: 上网助手 - {BB936323-19FA-4521-BA29-ECA6A121BC78} - D:\PROGRA~1\3721\Assist\asbar.dll
O2 - BHO: WebMiscItem Class - {3CD4296F-6CC3-11D9-B888-000C299AA719} - D:\WINDOWS\system32\WebMisc.dll (file missing)
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: BrowseHelper Class - {80BF4637-D65B-43F3-BB60-C5DD3D5FB7B9} - C:\KV2004\KvShell.dll
O2 - BHO: AssistII - {BB936323-19FA-4521-BA29-ECA6A121BC78} - D:\PROGRA~1\3721\Assist\asbar.dll
O2 - BHO: update wnwb - {ED8DFC5C-10EF-45AB-9DC2-0639AFF5A270} - D:\PROGRA~1\COMMON~1\Wnwb\wnwbio.dll
O2 - BHO: YiSou - {EF1D17A9-089F-40cc-8D64-7324CDEBA0DB} - D:\PROGRA~1\YiSou\yisoub.dll
O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - IE工具栏增项: CopySo拷贝搜 - {40987A5C-6AB8-4977-8BE9-A8889DE2EDCC} - D:\Program Files\Copyso\CopysoIE.dll (file missing)
O3 - IE工具栏增项: 上网助手 - {BB936323-19FA-4521-BA29-ECA6A121BC78} - D:\PROGRA~1\3721\Assist\asbar.dll
O3 - IE工具栏增项: 一搜工具条 - {115F6E46-FCBC-41ed-B3B5-3BDDD4AAB5E5} - D:\Program Files\YiSou\yisou.dll
O3 - IE工具栏增项: 江民杀毒工具栏 - {B5A34A93-D538-43A7-8371-864CB6148D12} - C:\KV2004\KvShell.dll
O3 - IE工具栏增项: IE伴郎 - {B225B89D-5E95-4194-98E8-149993071B31} - D:\PROGRA~1\NETMEE~1\CALLCO~1.DLL
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] "D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [PROMon.exe] PROMon.exe
O4 - 启动项HKLM\\Run: [Smapp] D:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - 启动项HKLM\\Run: [nwiz] nwiz.exe /install
O4 - 启动项HKLM\\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - 启动项HKLM\\Run: [helper.dll] D:\WINDOWS\system32\rundll32.exe D:\PROGRA~1\3721\helper.dll,Rundll32
O4 - 启动项HKLM\\Run: [KvMonXP] C:\KV2004\KVMonXP.kxp /auto
O4 - 启动项HKLM\\Run: [KvXP] C:\KV2004\KvXP.kxp /ScanBoot /ScanSys
O4 - 启动项HKLM\\Run: [MS-4011 Memory Patch] D:\Documents and Settings\liu\桌面\RavSasser.exe -Patch
O4 - 启动项HKLM\\Run: [MS Remote Procedure Call Service] MSRPC32.exe
O4 - 启动项HKLM\\Run: [Microsoft Update] wuamk032.exe
O4 - 启动项HKLM\\Run: [li start up] li32.exe
O4 - 启动项HKLM\\RunServices: [MS Remote Procedure Call Service] MSRPC32.exe
O4 - 启动项HKLM\\RunServices: [Microsoft Update] wuamk032.exe
O4 - 启动项HKLM\\RunServices: [li start up] li32.exe
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [WindowsFY] c:\bsw.exe
O4 - HKCU\..\Run: [li start up] li32.exe
O4 - 启动项HKCU\\RunServices: [li start up] li32.exe
O4 - Startup: 腾讯QQ.lnk = D:\Program Files\Tencent\QQ\QQ.exe
O8 - IE右键菜单中的新增项目: !CopySo拷贝搜 - res://D:\Program Files\Copyso\CopysoIE.dll/copyso.htm
O8 - IE右键菜单中的新增项目: !全球排名 - res://D:\Program Files\Copyso\CopysoIE.dll/tops.htm
O8 - IE右键菜单中的新增项目: !反向链接 - res://D:\Program Files\Copyso\CopysoIE.dll/snapshot.htm
O8 - IE右键菜单中的新增项目: !网页快照 - res://D:\Program Files\Copyso\CopysoIE.dll/similar.htm
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - D:\Program Files\Tencent\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - D:\Program Files\Tencent\QQ\SendMMS.htm
O9 - 浏览器额外的按钮: Microsoft AntiSpyware helper - {4FC9B4BC-51D3-4C15-8499-D9E627D55F63} - D:\WINDOWS\System32\wldr.dll
O9 - 浏览器额外的“工具”菜单项: Microsoft AntiSpyware helper - {4FC9B4BC-51D3-4C15-8499-D9E627D55F63} - D:\WINDOWS\System32\wldr.dll
O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的按钮: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - 浏览器额外的“工具”菜单项: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - 浏览器额外的按钮: Microsoft AntiSpyware helper - {4FC9B4BC-51D3-4C15-8499-D9E627D55F63} - D:\WINDOWS\System32\wldr.dll (HKCU)
O9 - 浏览器额外的“工具”菜单项: Microsoft AntiSpyware helper - {4FC9B4BC-51D3-4C15-8499-D9E627D55F63} - D:\WINDOWS\System32\wldr.dll (HKCU)
O10 - 未知的文件在 Winsock LSP: d:\windows\system32\kvwspxp.dll
O10 - 未知的文件在 Winsock LSP: d:\windows\system32\kvwspxp.dll
O10 - 未知的文件在 Winsock LSP: d:\windows\system32\kvwspxp.dll
O11 - Options group: [!CNS] 上网助手-地址栏搜索
O16 - DPF: {11120607-1001-1111-1000-110199901123} - ms-its:mhtml:
file://c:default.mht!http://www.wearehosters.com/v460/dropper.chm::/dropper.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{BB73814D-3D1D-4E36-B56E-CA967CAB3042}: NameServer = 202.106.0.20 202.106.46.151
O23 - NT 服务: KVSrvXP - JiangMin Ltd. - C:\KV2004\KVSrvXP.exe
O23 - NT 服务: Local Security Authority Server (LSA Server) - Unknown owner - D:\WINDOWS\system32\MSASP32.exe (file missing)
O23 - NT 服务: Intel(R) NMS (NMSSvc) - Intel Corporation - D:\WINDOWS\System32\NMSSvc.exe
O23 - NT 服务: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe
O23 - NT 服务: Windows Mess Service - Unknown owner - D:\WINDOWS\winmsd.exe
