瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 [B]高手请进!小弟在线静侯佳音![/B]

123   1  /  3  页   跳转

[B]高手请进!小弟在线静侯佳音![/B]

[B]高手请进!小弟在线静侯佳音![/B]

本人今天不小心中了3个病毒,小弟弟想手动删除,请高手指导!
1。文件名:dll.exe
  文件夹:C:\WINDOWS\system32
  病毒名:Trojan.PSW.Lmir.jdl
2。文件名:update.exe
  文件夹:C:\Program Files\Common Files\UPDATE
  病毒名:Trojan.DL.QQhelper.h
3。文件名:Network.exe
  文件夹:C:\Program Files\Common Files\SAND
  病毒名:Adware.Clciker.YNYW.m
下面我把病毒发作的现象简单介绍下!
不知道是哪个病毒发作的时候,机器的显示器突然无视频信号。我这个时候想把机器重新启动,可是重起的按键也不好使,那个大的关机键长按10多秒中也关不了机器,我只有把电源跋掉。
小弟这个菜鸟现在在线等大虾指点!希望高手能给予出现这个现象的原理说明和详细的手动清除这3个病毒的方法。
........
最后编辑2006-01-22 12:05:34
分享到:
gototop
 

哪位大虾能帮帮小弟呀?
gototop
 

哪位大哥能帮帮啊。
gototop
 

操作参考:
结束下列文件的进程<若有的话>
C:\WINDOWS\system32\dll.exe
C:\Program Files\Common FilesUPDATE\update.exe
C:\Program Files\Common Files\SAND\Network.exe

进入注册表
依次搜索dll.exe,update.exe,Network.exe
找到后全部删除
<注意路径>

禁用相关服务
<注意路径>

删除
C:\WINDOWS\system32\dll.exe
C:\Program Files\Common FilesUPDATE
C:\Program Files\Common Files\SAND
gototop
 

大虾我刚才在结束进程里没有发现,这个三个文件
不过我在注册表里发现了他们三个的踪影,都已经删除了。
可是在重起完机器后Torjan.PSW.Lmir.jdl还是没有删除,在次查毒的时候又出现了

请指教!

gototop
 

用HIJACKTHIS导出日志
gototop
 

能告诉我下下在那个东西的网只吗?
我是菜鸟啊,不晓得在哪下啊
gototop
 

【回复“网游爱好者111”的帖子】
http://forum.ikaka.com/topic.asp?board=28&artid=6979213
gototop
 

浏览器加载项
[ThunderIEHelper Class]
  {0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v9.dll, Thunder Networking Technologies,LTD>
[Tencent Browser Helper]
  {0C7C23EF-A848-485B-873C-0ED954731014} <C:\Program Files\TENCENT\AddrPlus\IEHelp1.dll, Tencent>
[CNNIC_IDN]
  {35980F6E-A137-4E50-953D-813BB8556899} <C:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll, >
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[WMHlprObj Class]
  {F5824EFB-728A-4726-A5A5-85A68B20EDC3} <C:\PROGRA~1\CNNIC\Cdn\wmhlpr.dll, >
[免费精彩视频超流畅在线观看]
  {022C4009-5283-4365-97BF-144054B40E2E} <http://itv.mop.com, N/A>
[CNNIC_IDN]
  {35980F6E-A137-4E50-953D-813BB8556899} <C:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll, >
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
  {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[PortalCom Control 2.0]
  {48038521-20FB-11D8-BC64-00B0D07A8A19} <C:\WINDOWS\DOWNLO~1\PORTAL~1.OCX, Huawei Co. Ltd.>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[Rising Web Scan Object]
  {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.>
[ThunderIEHelper Class]
  {0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v9.dll, Thunder Networking Technologies,LTD>
[Tencent Browser Helper]
  {0C7C23EF-A848-485B-873C-0ED954731014} <C:\Program Files\TENCENT\AddrPlus\IEHelp1.dll, Tencent>
[HTML Document]
  {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[CNNIC_IDN]
  {35980F6E-A137-4E50-953D-813BB8556899} <C:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll, >
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[SearchAssistantOC]
  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[Rising Web Scan Object]
  {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.>
[WMHlprObj Class]
  {F5824EFB-728A-4726-A5A5-85A68B20EDC3} <C:\PROGRA~1\CNNIC\Cdn\wmhlpr.dll, >
[&使用迅雷下载]
  <C:\Program Files\Thunder Network\Thunder\geturl.htm, N/A>
[&使用迅雷下载全部链接]
  <C:\Program Files\Thunder Network\Thunder\getallurl.htm, N/A>
[上传到QQ网络硬盘]
  <C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
  <res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
  <C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>
[访问通用网址]
  <C:\Program Files\CNNIC\Cdn\cnnic.htm, N/A>
gototop
 

正在运行的进程
[PID: 396][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 452][\??\C:\WINDOWS\system32\csrss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 484][\??\C:\WINDOWS\system32\winlogon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 528][C:\WINDOWS\system32\services.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 540][C:\WINDOWS\system32\lsass.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 696][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 744][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\cdnns.dll]  <CNNIC><2, 0, 0, 0>
[PID: 812][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 884][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1004][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1140][C:\WINDOWS\system32\spoolsv.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\cdnns.dll]  <CNNIC><2, 0, 0, 0>
[PID: 1376][C:\WINDOWS\Explorer.EXE]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\Program Files\CNNIC\Cdn\cdnspie.dll]  <><2, 0, 0, 9>
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  <cnnic><2, 1, 0, 0>
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  <><2, 1, 0, 1>
    [C:\Program Files\CNNIC\Cdn\cdnglo.dll]  <><2, 1, 0, 1>
[PID: 1472][C:\Program Files\CNNIC\Cdn\cdnup.exe]  <><2, 2, 0, 2>
    [C:\Program Files\CNNIC\Cdn\cdnglo.dll]  <><2, 1, 0, 1>
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  <><2, 1, 0, 1>
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  <cnnic><2, 1, 0, 0>
    [C:\Program Files\CNNIC\Cdn\cdnspie.dll]  <><2, 0, 0, 9>
    [C:\Program Files\CNNIC\Cdn\cdntdns.dll]  <CNNIC><2, 2, 0, 1>
[PID: 1484][C:\WINDOWS\system32\ctfmon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\Program Files\CNNIC\Cdn\cdnspie.dll]  <><2, 0, 0, 9>
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  <cnnic><2, 1, 0, 0>
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  <><2, 1, 0, 1>
    [C:\Program Files\CNNIC\Cdn\cdnglo.dll]  <><2, 1, 0, 1>
[PID: 1548][C:\WINDOWS\system32\conime.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\Program Files\CNNIC\Cdn\cdnspie.dll]  <><2, 0, 0, 9>
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  <cnnic><2, 1, 0, 0>
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  <><2, 1, 0, 1>
    [C:\Program Files\CNNIC\Cdn\cdnglo.dll]  <><2, 1, 0, 1>
[PID: 1760][C:\WINDOWS\System32\alg.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 456][C:\Program Files\Internet Explorer\iexplore.exe]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\Program Files\CNNIC\Cdn\cdnspie.dll]  <><2, 0, 0, 9>
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  <cnnic><2, 1, 0, 0>
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  <><2, 1, 0, 1>
    [C:\Program Files\CNNIC\Cdn\cdnglo.dll]  <><2, 1, 0, 1>
    [C:\WINDOWS\system32\xunleibho_v9.dll]  <Thunder Networking Technologies,LTD><4, 5, 1, 33>
    [C:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll]  <><2, 1, 0, 2>
    [C:\Program Files\Tencent\QQ\QQIEHelper.dll]  <深圳市腾讯计算机系统有限公司><1, 1, 0, 5>
    [C:\PROGRA~1\CNNIC\Cdn\wmhlpr.dll]  <><1, 0, 0, 4>
    [C:\WINDOWS\system32\cdnns.dll]  <CNNIC><2, 0, 0, 0>
    [C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx]  <Macromedia, Inc.><8,0,22,0>
[PID: 344][E:\waigua\Mir2Facility.exe]  <><1, 0, 0, 1>
    [C:\Program Files\CNNIC\Cdn\cdnspie.dll]  <><2, 0, 0, 9>
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  <cnnic><2, 1, 0, 0>
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  <><2, 1, 0, 1>
    [C:\Program Files\CNNIC\Cdn\cdnglo.dll]  <><2, 1, 0, 1>
    [C:\WINDOWS\system32\cdnns.dll]  <CNNIC><2, 0, 0, 0>
[PID: 352][E:\waigua\极限帐号管理器.exe]  <><1, 0, 0, 1>
    [C:\Program Files\CNNIC\Cdn\cdnspie.dll]  <><2, 0, 0, 9>
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  <cnnic><2, 1, 0, 0>
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  <><2, 1, 0, 1>
    [C:\Program Files\CNNIC\Cdn\cdnglo.dll]  <><2, 1, 0, 1>
[PID: 1652][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\Program Files\CNNIC\Cdn\cdnspie.dll]  <><2, 0, 0, 9>
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  <cnnic><2, 1, 0, 0>
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  <><2, 1, 0, 1>
    [C:\Program Files\CNNIC\Cdn\cdnglo.dll]  <><2, 1, 0, 1>
    [C:\WINDOWS\system32\xunleibho_v9.dll]  <Thunder Networking Technologies,LTD><4, 5, 1, 33>
    [C:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll]  <><2, 1, 0, 2>
    [C:\Program Files\Tencent\QQ\QQIEHelper.dll]  <深圳市腾讯计算机系统有限公司><1, 1, 0, 5>
    [C:\PROGRA~1\CNNIC\Cdn\wmhlpr.dll]  <><1, 0, 0, 4>
    [C:\WINDOWS\system32\cdnns.dll]  <CNNIC><2, 0, 0, 0>
[PID: 840][C:\Program Files\Thunder Network\Thunder\Thunder.exe]  <Thunder Networking Technologies,LTD><5.0.6.98>
    [C:\Program Files\Thunder Network\Thunder\UpdateDownload.dll]  <Thunder Networking Technologies,LTD><1, 0, 0, 1>
    [C:\Program Files\Thunder Network\Thunder\download_interface.dll]  <Thunder Networking Technologies,LTD><1, 0, 0, 1>
    [C:\Program Files\Thunder Network\Thunder\log4cplus.dll]  <><1, 0, 2, 1>
    [C:\Program Files\Thunder Network\Thunder\stlport_vc646.dll]  <STLport Consulting, Inc.><4.6.2003.1031>
    [C:\Program Files\Thunder Network\Thunder\historyinfo_manage.dll]  <Thunder Networking Technologies,LTD><5, 0, 0, 73>
    [C:\Program Files\CNNIC\Cdn\cdnspie.dll]  <><2, 0, 0, 9>
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  <cnnic><2, 1, 0, 0>
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  <><2, 1, 0, 1>
    [C:\Program Files\CNNIC\Cdn\cdnglo.dll]  <><2, 1, 0, 1>
    [C:\Program Files\Thunder Network\Thunder\iThunder.dll]  <Thunder Networking Technologies,LTD><1, 0, 0, 30>
    [C:\Program Files\Thunder Network\Thunder\RegisterDll.dll]  <Thunder Networking Technologies,LTD><1, 0, 1, 4>
    [C:\WINDOWS\system32\cdnns.dll]  <CNNIC><2, 0, 0, 0>
    [C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx]  <Macromedia, Inc.><8,0,22,0>
[PID: 204][C:\Documents and Settings\user\桌面\SREng.exe]  <Smallfrogs Studio><2.0.12.350>
    [C:\Program Files\CNNIC\Cdn\cdnspie.dll]  <><2, 0, 0, 9>
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  <cnnic><2, 1, 0, 0>
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  <><2, 1, 0, 1>
    [C:\Program Files\CNNIC\Cdn\cdnglo.dll]  <><2, 1, 0, 1>
    [C:\WINDOWS\system32\cdnns.dll]  <CNNIC><2, 0, 0, 0>
gototop
 
123   1  /  3  页   跳转
页面顶部
Powered by Discuz!NT