1   1  /  1  页   跳转

[求助] 木马病毒,HB inject.exe

木马病毒,HB inject.exe

开机后一个提示窗,内容如下:
HBinject.exe—无法找到组件
没有找到HBmhly.dll,因此这个应用程序未能启动。重新安装应用程序可能会修复此问题。要怎样解决?????瑞星可以杀...不过超慢10秒都可能杀不到1个文件........
下面有附件。。。

用户系统信息:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)

附件附件:

文件名:SREngLOG.log
下载次数:151
文件类型:application/octet-stream
文件大小:
上传时间:2008-8-10 9:56:06
描述:log

分享到:
gototop
 

回复:木马病毒,HB inject.exe

1.建议使用XDelBox删除以下文件:(Xdelbox1.7下载地址:http://www.qispace.com.cn/read.php/1.htm    的工具19)
使用说明:先勾选抑制再生,删除时复制所有要删除文件的路径,在待删除文件列表里点击右键选择从剪贴板导入不检查路径,导入后在要删除文件上点击右键,选择立刻重启删除,电脑会重启进入DOS界面进行删除操作。运行xdelbox前最好卸载所有可移动存储介质(包括U盘,MP3,手机存储卡等)。


c:\windows\system32\gdipro.dll
c:\windows\system32\sys07003.dll
c:\windows\system32\hbmhly.dll
c:\windows\system32\srpcss.dll
c:\windows\system32\hbmhly.dll
c:\windows\system32\hbinject.exe
c:\windows\system32\pdtkmzkb.dll
c:\windows\system32\adsntzt.dll
c:\windows\system32\avicapwm.dll
c:\windows\system32\tscfgwmijxsj.dll
c:\windows\system32\certmgrkd.dll
c:\00f26f58b29bd951.dat
c:\0a4bf60025270afe.dat
c:\106dbfc824af086b.dat
c:\215966f45015ed0d.dat
c:\2320cd18ecd8c4d3.dat
c:\25daa2947c2bb91c.dat
c:\29e75640f68ae7c0.dat
c:\29e75640f68ae7c0.dat
c:\2a0e2e3cdf13dee1.dat
c:\2f34293ccd8fe560.dat
c:\3866d7e87b4b411c.dat
c:\388dafe4532a43d5.dat
c:\39326f443164f4e5.dat
c:\3af9d568f4f0075b.dat
c:\4142772ccc2535f9.dat
c:\457602d410c455df.dat
c:\5096efa07ce54352.dat
c:\516286fc01d013e3.dat
c:\5a174e449aa8a1c7.dat
c:\5c8373c87c17f9ae.dat
c:\5d2833281e4168de.dat
c:\60ddd76cb98ec134.dat
c:\65dcfa708fdb58ea.dat
c:\6a5e3610df99ec59.dat
c:\7390e4bc49219d7d.dat
c:\757f22dc2e092ccd.dat
c:\75fd0a4029dace84.dat
c:\78b6dfbcbb9208fc.dat
c:\7c6c8400d84430e2.dat
c:\7e0d122884b53bf0.dat
c:\7e5ac220b7b3c172.dat
c:\80a00fa87f7b94b0.dat
c:\81e98e683ac61690.dat
c:\88b01790a99c133c.dat
c:\8a9e55b0d252a6ac.dat
c:\8d3153305d84a1ec.dat
c:\90e6f7743a4bb7ea.dat
c:\941eb454aec79bd9.dat
c:\9974e6c0552b3ee6.dat
c:\9c07e440ec7c0125.dat
c:\9cd37b9c3e592dce.dat
c:\9df62260014572b5.dat
c:\9e4d31c813a757e3.dat
c:\a2508604ddcf1b23.dat
c:\a5616ae844b326f2.dat
c:\a7cd906ce5fb6970.dat
c:\a8724fccc7a6ee00.dat
c:\aa608dec6e8e94b0.dat

c:\windows\system32\drivers\hbkernel.sys
c:\f864800c68f195e3.dat
c:\f583d294c04154e1.dat
c:\f3655d089ee12504.dat
c:\f33e850c7646189c.dat
c:\ecf5e34867351de6.dat
c:\ea89bdc406c7c98f.dat
c:\e9e4fe64e3357a3f.dat
c:\dcfcab74c10308b5.dat
c:\dcd5d378a96207fc.dat
c:\db8c54b894d9a51c.dat
c:\d7fd8870ebf79e8f.dat
c:\d543b2f475aab0f7.dat
c:\d20bf614ce544607.dat
c:\d136ff48f871d302.dat
c:\cf21e92c6b894272.dat
c:\ca22c62885f9c933.dat
c:\c194d6dc1ad68308.dat
c:\c16dfee0024fb8d7.dat
c:\b95df6f8e90f071a.dat
c:\b3ba1494fee8fea4.dat
c:\b0a92fb07df0da0e.dat
c:\af8688ec19111037.dat
c:\af5fb0f03154176e.dat

2.删除重启后使用SREng修复下面各项:

    启动项目 -- 注册表之如下项删除:
注意该项[AppInit_DLLs]修改:把<HBmhly.dll>修改为<>即清空
[HBService]    <HBInject.exe>
[{21BE5FDF-D4CB-4850-AD99-21E68B50BF3F}]    <C:\WINDOWS\system32\pdtkmzkb.dll>
[{E0F3526A-4165-4589-80CD-50B6FBAC3BDA}]    <C:\WINDOWS\system32\adsntzt.dll>
[{6B9FEAD7-4319-4312-AB05-D8C9CD255BFE}]    <C:\WINDOWS\system32\avicapwm.dll>
[{2CB77746-8ECC-40ca-8217-10CA8BE5EFC8}]    <C:\WINDOWS\system32\tscfgwmijxsj.dll>
[{9E8287B0-0F3A-48ae-99C5-A6E0AAC36BC5}]    <C:\WINDOWS\system32\certmgrkd.dll>
[rhjkoscl.dll]    <C:\WINDOWS\system32\pdtkmzkb.dll>
[adsntzt.dll]    <C:\WINDOWS\system32\adsntzt.dll>
[avicapwm.dll]    <C:\WINDOWS\system32\avicapwm.dll>
[tscfgwmijxsj.dll]    <C:\WINDOWS\system32\tscfgwmijxsj.dll>
[certmgrkd.dll]    <C:\WINDOWS\system32\certmgrkd.dll>
[pdtkmzkb.dll]    <C:\WINDOWS\system32\pdtkmzkb.dll>

    启动项目 -- 服务-- 驱动程序之如下项禁用:
[00f26f58b29bd951 / 00f26f58b29bd951]    <\??\C:\00f26f58b29bd951.dat>
[0a4bf60025270afe / 0a4bf60025270afe]    <\??\C:\0a4bf60025270afe.dat>
[106dbfc824af086b / 106dbfc824af086b]    <\??\C:\106dbfc824af086b.dat>
[215966f45015ed0d / 215966f45015ed0d]    <\??\C:\215966f45015ed0d.dat>
[2320cd18ecd8c4d3 / 2320cd18ecd8c4d3]    <\??\C:\2320cd18ecd8c4d3.dat>
[25daa2947c2bb91c / 25daa2947c2bb91c]    <\??\C:\25daa2947c2bb91c.dat>
[29e75640f68ae7c0 / 29e75640f68ae7c0]    <\??\C:\29e75640f68ae7c0.dat>
[29e75640f68ae7c0 / 29e75640f68ae7c0]    <\??\C:\29e75640f68ae7c0.dat>
[2a0e2e3cdf13dee1 / 2a0e2e3cdf13dee1]    <\??\C:\2a0e2e3cdf13dee1.dat>
[2f34293ccd8fe560 / 2f34293ccd8fe560]    <\??\C:\2f34293ccd8fe560.dat>
[3866d7e87b4b411c / 3866d7e87b4b411c]    <\??\C:\3866d7e87b4b411c.dat>
[388dafe4532a43d5 / 388dafe4532a43d5]    <\??\C:\388dafe4532a43d5.dat>
[39326f443164f4e5 / 39326f443164f4e5]    <\??\C:\39326f443164f4e5.dat>
[3af9d568f4f0075b / 3af9d568f4f0075b]    <\??\C:\3af9d568f4f0075b.dat>
[4142772ccc2535f9 / 4142772ccc2535f9]    <\??\C:\4142772ccc2535f9.dat>
[457602d410c455df / 457602d410c455df]    <\??\C:\457602d410c455df.dat>
[5096efa07ce54352 / 5096efa07ce54352]    <\??\C:\5096efa07ce54352.dat>
[516286fc01d013e3 / 516286fc01d013e3]    <\??\C:\516286fc01d013e3.dat>
[5a174e449aa8a1c7 / 5a174e449aa8a1c7]    <\??\C:\5a174e449aa8a1c7.dat>
[5c8373c87c17f9ae / 5c8373c87c17f9ae]    <\??\C:\5c8373c87c17f9ae.dat>
[5d2833281e4168de / 5d2833281e4168de]    <\??\C:\5d2833281e4168de.dat>
[60ddd76cb98ec134 / 60ddd76cb98ec134]    <\??\C:\60ddd76cb98ec134.dat>
[65dcfa708fdb58ea / 65dcfa708fdb58ea]    <\??\C:\65dcfa708fdb58ea.dat>
[6a5e3610df99ec59 / 6a5e3610df99ec59]    <\??\C:\6a5e3610df99ec59.dat>
[7390e4bc49219d7d / 7390e4bc49219d7d]    <\??\C:\7390e4bc49219d7d.dat>
[757f22dc2e092ccd / 757f22dc2e092ccd]    <\??\C:\757f22dc2e092ccd.dat>
[75fd0a4029dace84 / 75fd0a4029dace84]    <\??\C:\75fd0a4029dace84.dat>
[78b6dfbcbb9208fc / 78b6dfbcbb9208fc]    <\??\C:\78b6dfbcbb9208fc.dat>
[7c6c8400d84430e2 / 7c6c8400d84430e2]    <\??\C:\7c6c8400d84430e2.dat>
[7e0d122884b53bf0 / 7e0d122884b53bf0]    <\??\C:\7e0d122884b53bf0.dat>
[7e5ac220b7b3c172 / 7e5ac220b7b3c172]    <\??\C:\7e5ac220b7b3c172.dat>
[80a00fa87f7b94b0 / 80a00fa87f7b94b0]    <\??\C:\80a00fa87f7b94b0.dat>
[81e98e683ac61690 / 81e98e683ac61690]    <\??\C:\81e98e683ac61690.dat>
[88b01790a99c133c / 88b01790a99c133c]    <\??\C:\88b01790a99c133c.dat>
[8a9e55b0d252a6ac / 8a9e55b0d252a6ac]    <\??\C:\8a9e55b0d252a6ac.dat>
[8d3153305d84a1ec / 8d3153305d84a1ec]    <\??\C:\8d3153305d84a1ec.dat>
[90e6f7743a4bb7ea / 90e6f7743a4bb7ea]    <\??\C:\90e6f7743a4bb7ea.dat>
[941eb454aec79bd9 / 941eb454aec79bd9]    <\??\C:\941eb454aec79bd9.dat>
[9974e6c0552b3ee6 / 9974e6c0552b3ee6]    <\??\C:\9974e6c0552b3ee6.dat>
[9c07e440ec7c0125 / 9c07e440ec7c0125]    <\??\C:\9c07e440ec7c0125.dat>
[9cd37b9c3e592dce / 9cd37b9c3e592dce]    <\??\C:\9cd37b9c3e592dce.dat>
[9df62260014572b5 / 9df62260014572b5]    <\??\C:\9df62260014572b5.dat>
[9e4d31c813a757e3 / 9e4d31c813a757e3]    <\??\C:\9e4d31c813a757e3.dat>
[a2508604ddcf1b23 / a2508604ddcf1b23]    <\??\C:\a2508604ddcf1b23.dat>
[a5616ae844b326f2 / a5616ae844b326f2]    <\??\C:\a5616ae844b326f2.dat>
[a7cd906ce5fb6970 / a7cd906ce5fb6970]    <\??\C:\a7cd906ce5fb6970.dat>
[a8724fccc7a6ee00 / a8724fccc7a6ee00]    <\??\C:\a8724fccc7a6ee00.dat>
[aa608dec6e8e94b0 / aa608dec6e8e94b0]    <\??\C:\aa608dec6e8e94b0.dat>

[HBKernel Driver / HBKernel]    <\SystemRoot\system32\DRIVERS\HBKernel.sys>
[f864800c68f195e3 / f864800c68f195e3]    <\??\C:\f864800c68f195e3.dat>
[f583d294c04154e1 / f583d294c04154e1]    <\??\C:\f583d294c04154e1.dat>
[f3655d089ee12504 / f3655d089ee12504]    <\??\C:\f3655d089ee12504.dat>
[f33e850c7646189c / f33e850c7646189c]    <\??\C:\f33e850c7646189c.dat>
[ecf5e34867351de6 / ecf5e34867351de6]    <\??\C:\ecf5e34867351de6.dat>
[ea89bdc406c7c98f / ea89bdc406c7c98f]    <\??\C:\ea89bdc406c7c98f.dat>
[e9e4fe64e3357a3f / e9e4fe64e3357a3f]    <\??\C:\e9e4fe64e3357a3f.dat>
[dcfcab74c10308b5 / dcfcab74c10308b5]    <\??\C:\dcfcab74c10308b5.dat>
[dcd5d378a96207fc / dcd5d378a96207fc]    <\??\C:\dcd5d378a96207fc.dat>
[db8c54b894d9a51c / db8c54b894d9a51c]    <\??\C:\db8c54b894d9a51c.dat>
[d7fd8870ebf79e8f / d7fd8870ebf79e8f]    <\??\C:\d7fd8870ebf79e8f.dat>
[d543b2f475aab0f7 / d543b2f475aab0f7]    <\??\C:\d543b2f475aab0f7.dat>
[d20bf614ce544607 / d20bf614ce544607]    <\??\C:\d20bf614ce544607.dat>
[d136ff48f871d302 / d136ff48f871d302]    <\??\C:\d136ff48f871d302.dat>
[cf21e92c6b894272 / cf21e92c6b894272]    <\??\C:\cf21e92c6b894272.dat>
[ca22c62885f9c933 / ca22c62885f9c933]    <\??\C:\ca22c62885f9c933.dat>
[c194d6dc1ad68308 / c194d6dc1ad68308]    <\??\C:\c194d6dc1ad68308.dat>
[c16dfee0024fb8d7 / c16dfee0024fb8d7]    <\??\C:\c16dfee0024fb8d7.dat>
[b95df6f8e90f071a / b95df6f8e90f071a]    <\??\C:\b95df6f8e90f071a.dat>
[b3ba1494fee8fea4 / b3ba1494fee8fea4]    <\??\C:\b3ba1494fee8fea4.dat>
[b0a92fb07df0da0e / b0a92fb07df0da0e]    <\??\C:\b0a92fb07df0da0e.dat>
[af8688ec19111037 / af8688ec19111037]    <\??\C:\af8688ec19111037.dat>
[af5fb0f03154176e / af5fb0f03154176e]    <\??\C:\af5fb0f03154176e.dat>
gototop
 

回复: 木马病毒,HB inject.exe

请使用Xdelbox删除以下文件(关于Xdelbox的下载使用请参考http://bbs.ikaka.com/showtopic-8442813.aspx
C:\WINDOWS\system32\HBInject.exe
C:\WINDOWS\system32\HBInject.dll
C:\WINDOWS\system32\DRIVERS\HBKernel
C:\WINDOWS\system32\pdtkmzkb.dll
C:\WINDOWS\system32\adsntzt.dll
C:\WINDOWS\system32\avicapwm.dll
C:\WINDOWS\system32\tscfgwmijxsj.dll
C:\WINDOWS\system32\certmgrkd.dll
C:\00f26f58b29bd951.dat
C:\0a4bf60025270afe.dat
C:\106dbfc824af086b.dat
C:\215966f45015ed0d.dat
C:\2320cd18ecd8c4d3.dat
C:\25daa2947c2bb91c.dat
C:\29e75640f68ae7c0.dat
C:\2a0e2e3cdf13dee1.dat
C:\2f34293ccd8fe560.dat
C:\3866d7e87b4b411c.dat
C:\388dafe4532a43d5.dat
C:\39326f443164f4e5.dat
C:\3af9d568f4f0075b.dat
C:\4142772ccc2535f9.dat
C:\457602d410c455df.dat
C:\5096efa07ce54352.dat
C:\516286fc01d013e3.dat
C:\5a174e449aa8a1c7.dat
C:\5c8373c87c17f9ae.dat
C:\5d2833281e4168de.dat
C:\60ddd76cb98ec134.dat
C:\65dcfa708fdb58ea.dat
C:\6a5e3610df99ec59.dat
C:\7390e4bc49219d7d.dat
C:\757f22dc2e092ccd.dat
C:\75fd0a4029dace84.dat
C:\78b6dfbcbb9208fc.dat
C:\7c6c8400d84430e2.dat
C:\7e0d122884b53bf0.dat
C:\7e5ac220b7b3c172.dat
C:\80a00fa87f7b94b0.dat
C:\81e98e683ac61690.dat
C:\88b01790a99c133c.dat
C:\8a9e55b0d252a6ac.dat
C:\8d3153305d84a1ec.dat
C:\90e6f7743a4bb7ea.dat
C:\941eb454aec79bd9.dat
C:\9974e6c0552b3ee6.dat
C:\9c07e440ec7c0125.dat
C:\9cd37b9c3e592dce.dat
C:\9df62260014572b5.dat
C:\9e4d31c813a757e3.dat
C:\a2508604ddcf1b23.dat
C:\a5616ae844b326f2.dat
C:\a7cd906ce5fb6970.dat
C:\a8724fccc7a6ee00.dat
C:\aa608dec6e8e94b0.dat
C:\af5fb0f03154176e.dat
C:\af8688ec19111037.dat
C:\b0a92fb07df0da0e.dat
C:\b95df6f8e90f071a.dat
C:\c16dfee0024fb8d7.dat
C:\c194d6dc1ad68308.dat
C:\ca22c62885f9c933.dat
C:\cf21e92c6b894272.dat
C:\d136ff48f871d302.dat
C:\d20bf614ce544607.dat
C:\d543b2f475aab0f7.dat
C:\d7fd8870ebf79e8f.dat
C:\db8c54b894d9a51c.dat
C:\dcd5d378a96207fc.
C:\dcfcab74c10308b5.dat
C:\e9e4fe64e3357a3f.dat
C:\ea89bdc406c7c98f.dat
C:\ecf5e34867351de6.dat
C:\f33e850c7646189c.dat
C:\f3655d089ee12504.dat
C:\f583d294c04154e1.dat
C:\f864800c68f195e3.dat
使用Sreng在注册表启动项目中
将[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]下的<HBService><HBInject.exe>  []删除
将[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]下的
    <AppInit_DLLs><HBmhly.dll> 改成  <AppInit_DLLs>< >
gototop
 

回复:木马病毒,HB inject.exe

删除C:\WINDOWS\system32\svchost -k rpcss-->C:\WINDOWS\system32\srpcss.dll会导致rpc服务无法启动,复制和粘贴无法使用
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT