瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 惊叹：d9j.com逃避查杀，难倒高手一片！！

1   1  /  1  页   跳转页

惊叹：d9j.com逃避查杀，难倒高手一片！！

收藏
小呀小顽童
头像
快乐黄口狮
  • 帖子:172
  • 注册: 2004-08-07
  • 来自:
发表于： 2007-03-01 10:04 | 只看楼主 短消息 资料
字号： 小 中 大 1楼

惊叹：d9j.com逃避查杀，难倒高手一片！！



[复制到剪贴板]
CODE:


2007-03-01,09:44:29

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows Server 2003 Enterprise Edition  (Build 3790)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <ShStatEXE><"D:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE>  [McAfee, Inc.]
    <McAfeeUpdaterUI><"D:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey>  [Network Associates, Inc.]
    <Network Associates Error Reporting Service><"D:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe">  [Network Associates, Inc.]
    <nod32kui><"D:\Program Files\Eset\nod32kui.exe" /WAITSERVICE>  [(Verified)Eset ]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><D:\WINDOWS\system32\userinit.exe>  [(Verified)Microsoft Corporation]
    <UIHost><%SystemRoot%\system32\logonui.exe>  [(Verified)Microsoft Corporation]

==================================
启动文件夹
N/A

==================================
服务
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <D:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[McAfee Framework 服务 / McAfeeFramework][Running/Auto Start]
  <D:\Program Files\Network Associates\Common Framework\FrameworkService.exe /ServiceStart><Network Associates, Inc.>
[Network Associates McShield / McShield][Running/Auto Start]
  <"D:\Program Files\Network Associates\VirusScan\Mcshield.exe"><McAfee, Inc.>
[Network Associates Task Manager / McTaskManager][Running/Auto Start]
  <"D:\Program Files\Network Associates\VirusScan\VsTskMgr.exe"><Network Associates, Inc.>
[NOD32 Kernel Service / NOD32krn][Running/Auto Start]
  <"D:\Program Files\Eset\nod32krn.exe"><Eset>
[RsRavMon Service / RsRavMon][Stopped/Auto Start]
  <"D:\Program Files\Rising\Rav1\Ravmond.exe"><N/A>
[Windows DHCP Service / WinDHCPsvc][Stopped/Disabled]
  <><N/A>

==================================
驱动程序
[AMON / AMON][Running/Auto Start]
  <\SystemRoot\system32\drivers\amon.sys><Eset>
[ati2mpad / ati2mpad][Running/Manual Start]
  <system32\DRIVERS\ati2mpad.sys><ATI Technologies Inc.>
[Intel(R) PRO/1000 Device Driver / E1000][Running/Manual Start]
  <system32\DRIVERS\e1000325.sys><Intel Corporation>
[ExpScaner / ExpScaner][Stopped/Disabled]
  <\??\D:\Program Files\Rising\Rav1\ExpScan.sys><N/A>
[HookCont / HookCont][Stopped/Disabled]
  <\??\D:\Program Files\Rising\Rav1\HOOKCONT.sys><N/A>
[HookReg / HookReg][Stopped/Disabled]
  <\??\D:\Program Files\Rising\Rav1\HookReg.sys><N/A>
[HookSys / HookSys][Stopped/Disabled]
  <\??\D:\Program Files\Rising\Rav1\HookSys.sys><N/A>
[IP in IP Tunnel Driver / IpInIp][Stopped/Disabled]
  <system32\DRIVERS\ipinip.sys><N/A>
[MEMSCAN / MEMSCAN][Stopped/Disabled]
  <\??\D:\Program Files\Rising\Rav1\MEMSCAN.sys><N/A>
[NaiAvFilter1 / NaiAvFilter1][Running/Manual Start]
  <system32\drivers\naiavf5x.sys><McAfee Inc.>
[NaiAvTdi1 / NaiAvTdi1][Running/System Start]
  <system32\drivers\mvstdi5x.sys><McAfee Inc.>
[nod32drv / nod32drv][Running/System Start]
  <\SystemRoot\system32\drivers\nod32drv.sys><N/A>
[Netgroup Packet Filter / NPF][Stopped/Manual Start]
  <system32\DRIVERS\npf.sys><CACE Technologies>
[npkcrypt / npkcrypt][Running/Auto Start]
  <\??\D:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
  <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[RSPPSYS / RSPPSYS][Stopped/Disabled]
  <\??\D:\Program Files\Rising\Rav1\RSPPSYS.sys><N/A>
[Secdrv / Secdrv][Stopped/Disabled]
  <system32\DRIVERS\secdrv.sys><N/A>
[Sony USB Filter Driver (SONYPVU1) / SONYPVU1][Stopped/Manual Start]
  <system32\DRIVERS\SONYPVU1.SYS><Sony Corporation>
[symmpi / symmpi][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\symmpi.sys><LSI Logic>
[xyfilemon / xyantivirus][Stopped/Disabled]
  <\??\D:\tem\VRV2005\VRV2005\vrv2005\filemon.sys><N/A>
[EntDrv52 / EntDrv52][Running/Manual Start]
  <\??\D:\WINDOWS\system32\drivers\EntDrv52.sys><McAfee, Inc>

==================================
浏览器加载项
[Shell name]
  {D682D42E-BE2C-4758-AB18-926D2E7553B8} <D:\WINDOWS\system32\vmmreg32.dll, Microsoft Corporation>
[kele8]
  {84920E5F-3788-49cd-A274-E365578DF174} <http://www.kele8.com/, N/A>
[Fc2Boot Class]
  {ABA7CC7F-019D-47DB-A0D2-B3C2B3AC1B44} <D:\WINDOWS\Downloaded Program Files\fc2boot.dll, 北京线线通科技开发有限公司>
[&使用BitComet下载]
  <res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm, N/A>
[&使用BitComet下载全部链接]
  <res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm, N/A>
[&使用BitComet下载本页视频]
  <res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm, N/A>
[上传到QQ网络硬盘]
  <D:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
  <D:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <D:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <D:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 404][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 456][\??\D:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 480][\??\D:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 524][D:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
    [D:\WINDOWS\system32\imon.dll]  [Eset , 2, 70, 32 ]
    [D:\WINDOWS\system32\EntApi.dll]  [McAfee, Inc, 8.0.0.453]
[PID: 536][D:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
    [D:\WINDOWS\system32\imon.dll]  [Eset , 2, 70, 32 ]
    [D:\WINDOWS\system32\EntApi.dll]  [McAfee, Inc, 8.0.0.453]
[PID: 688][D:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
    [D:\WINDOWS\system32\imon.dll]  [Eset , 2, 70, 32 ]
    [D:\WINDOWS\system32\EntApi.dll]  [McAfee, Inc, 8.0.0.453]
[PID: 740][D:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
    [D:\WINDOWS\system32\EntApi.dll]  [McAfee, Inc, 8.0.0.453]
[PID: 912][D:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
    [D:\WINDOWS\system32\imon.dll]  [Eset , 2, 70, 32 ]
    [D:\WINDOWS\system32\EntApi.dll]  [McAfee, Inc, 8.0.0.453]
[PID: 980][D:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
    [D:\WINDOWS\system32\EntApi.dll]  [McAfee, Inc, 8.0.0.453]
[PID: 1020][D:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
    [D:\WINDOWS\system32\imon.dll]  [Eset , 2, 70, 32 ]
    [D:\WINDOWS\system32\EntApi.dll]  [McAfee, Inc, 8.0.0.453]
[PID: 1268][D:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
    [D:\WINDOWS\system32\imon.dll]  [Eset , 2, 70, 32 ]
[PID: 1296][D:\WINDOWS\system32\msdtc.exe]  [Microsoft Corporation, 2001.12.4720.0 (srv03_rtm.030324-2048)]
[PID: 1400][D:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
    [D:\WINDOWS\system32\EntApi.dll]  [McAfee, Inc, 8.0.0.453]
[PID: 1432][D:\Program Files\Network Associates\Common Framework\FrameworkService.exe]  [Network Associates, Inc., 3.5.0.412]
    [D:\Program Files\Network Associates\Common Framework\nailog.dll]  [Network Associates, Inc., 3.5.0.474]
    [D:\Program Files\Network Associates\Common Framework\naXML.dll]  [Network Associates, Inc., 3.5.0.474]
    [D:\Program Files\Network Associates\Common Framework\naCmnLib.dll]  [Network Associates, Inc., 3.5.0.474]
    [D:\Program Files\Network Associates\Common Framework\applib.dll]  [Network Associates, Inc., 3.5.0.412]
    [D:\Program Files\Network Associates\Common Framework\0804\AgentRes.dll]  [Network Associates, Inc., 3.5.0.412]
    [D:\Program Files\Network Associates\Common Framework\Logging.dll]  [Network Associates, Inc., 3.5.0.412]
    [D:\Program Files\Network Associates\Common Framework\InternetManager.dll]  [Network Associates, Inc., 3.5.0.412]
    [D:\Program Files\Network Associates\Common Framework\naInet.dll]  [Network Associates, Inc., 3.5.0.474]
    [D:\Program Files\Network Associates\Common Framework\UserSpace.dll]  [Network Associates, Inc., 3.5.0.412]
    [D:\Program Files\Network Associates\Common Framework\SecureFrameworkFactory.dll]  [Network Associates, Inc., 3.5.0.412]
    [D:\Program Files\Network Associates\Common Framework\Management.dll]  [Network Associates, Inc., 3.5.0.412]
    [D:\Program Files\Network Associates\Common Framework\cmalib.dll]  [Network Associates, Inc., 3.5.0.412]
    [D:\Program Files\Network Associates\Common Framework\naPolicyManager.dll]  [Network Associates, Inc., 3.5.0.412]
    [D:\Program Files\Network Associates\Common Framework\PsApi.dll]  [Microsoft Corporation, 4.00]
    [D:\Program Files\Network Associates\Common Framework\ScriptSubSys.dll]  [Network Associates, Inc., 3.5.0.412]
    [D:\Program Files\Network Associates\Common Framework\UpdateSubSys.dll]  [Network Associates, Inc., 3.5.0.412]
    [D:\Program Files\Network Associates\Common Framework\Scheduler.dll]  [Network Associates, Inc., 3.5.0.412]
    [D:\Program Files\Network Associates\Common Framework\TCSubSys.dll]  [Network Associates, Inc., 3.5.0.412]
    [D:\WINDOWS\system32\EntApi.dll]  [McAfee, Inc, 8.0.0.453]
[PID: 1500][D:\Program Files\Network Associates\VirusScan\Mcshield.exe]  [McAfee, Inc., 8.0.0.336]
    [D:\Program Files\Network Associates\VirusScan\Res04\McShield.DLL]  [Network Associates, Inc., 8.0.0.251]



最后编辑2007-03-01 17:49:29.700000000
分享到：
gototop
 
小呀小顽童
头像
快乐黄口狮
  • 帖子:172
  • 注册: 2004-08-07
  • 来自:
发表于： 2007-03-01 10:04 | 只看楼主 短消息 资料
字号： 小 中 大 2楼

[D:\Program Files\Network Associates\VirusScan\FTL.Dll]  [Network Associates, Inc., 8.0.0.135]
    [D:\Program Files\Network Associates\VirusScan\naiann.dll]  [Network Associates, Inc., 8.0.0.308]
    [D:\Program Files\Network Associates\VirusScan\mytilus.dll]  [McAfee, Inc., 8.0.0.337]
    [D:\Program Files\Network Associates\Common Framework\GenEvtInf.dll]  [Network Associates, Inc., 3.5.0.412]
    [D:\Program Files\Network Associates\VirusScan\NaEventU.DLL]  [Network Associates, Inc., 8.0.0.356]
    [D:\Program Files\Network Associates\VirusScan\Res04\naEvtRes.dll]  [Network Associates, Inc., 8.0.0.342]
    [D:\Program Files\Network Associates\VirusScan\VSIDSvr.dll]  [Network Associates, Inc., 8.0.0.291]
    [D:\Program Files\Common Files\Network Associates\Engine\MCSCAN32.DLL]  [McAfee, Inc., 5.1.00]
    [D:\Program Files\Network Associates\Common Framework\SecureFrameworkFactory.dll]  [Network Associates, Inc., 3.5.0.412]
    [D:\Program Files\Network Associates\VirusScan\EntSrv.Dll]  [McAfee, Inc, 8.0.0.453]
    [D:\WINDOWS\system32\msxml4.dll]  [Microsoft Corporation, 4.20.9818.0]
[PID: 1528][D:\Program Files\Network Associates\VirusScan\VsTskMgr.exe]  [Network Associates, Inc., 8.0.0.1004]
    [D:\Program Files\Network Associates\VirusScan\SHUTIL.dll]  [McAfee, Inc., 8.0.0.1036]
    [D:\Program Files\Network Associates\VirusScan\naiwmain.dll]  [Network Associates, Inc., 8.0.0.912]
    [D:\Program Files\Network Associates\VirusScan\naicondl.dll]  [Network Associates, Inc., 8.0.0.912]
    [D:\Program Files\Network Associates\VirusScan\RES04\VsTskMgr.dll]  [Network Associates, Inc., 8.0.0.912]
    [D:\Program Files\Network Associates\VirusScan\MIDUtil.Dll]  [McAfee, Inc., 8.0.0.155]
[PID: 1584][D:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe]  [Network Associates, Inc., 3.5.0.412]
    [D:\PROGRA~1\NETWOR~1\COMMON~1\nailog.dll]  [Network Associates, Inc., 3.5.0.474]
    [D:\PROGRA~1\NETWOR~1\COMMON~1\naCmnLib.dll]  [Network Associates, Inc., 3.5.0.474]
    [D:\PROGRA~1\NETWOR~1\COMMON~1\naXML.dll]  [Network Associates, Inc., 3.5.0.474]
    [D:\PROGRA~1\NETWOR~1\COMMON~1\0804\AgentRes.dll]  [Network Associates, Inc., 3.5.0.412]
    [D:\Program Files\Network Associates\VirusScan\VsPlugin.dll]  [McAfee, Inc., 8.0.0.1039]
    [D:\WINDOWS\system32\EntApi.dll]  [McAfee, Inc, 8.0.0.453]
[PID: 1612][D:\Program Files\Eset\nod32krn.exe]  [Eset , 2, 70, 32 ]
    [D:\Program Files\Eset\ps_amon.dll]  [Eset , 2, 70, 32 ]
    [D:\Program Files\Eset\ps_dmon.dll]  [Eset , 2, 70, 32 ]
    [D:\Program Files\Eset\ps_emon.dll]  [Eset , 2, 70, 32 ]
    [D:\WINDOWS\system32\imon.dll]  [Eset , 2, 70, 32 ]
    [D:\Program Files\Eset\ps_nod32.dll]  [Eset , 2, 70, 32 ]
    [D:\Program Files\Eset\ps_upd.dll]  [Eset , 2, 70, 32 ]
[PID: 1660][D:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
    [D:\WINDOWS\system32\EntApi.dll]  [McAfee, Inc, 8.0.0.453]
[PID: 1728][D:\WINDOWS\system32\Dfssvc.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 660][D:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.3790.0 (srv03_rtm.030324-2048)]
    [D:\WINDOWS\system32\EntApi.dll]  [McAfee, Inc, 8.0.0.453]
    [D:\winrar\rarext.dll]  [N/A, N/A]
[PID: 936][D:\Program Files\Network Associates\VirusScan\SHSTAT.EXE]  [McAfee, Inc., 8.0.0.1040]
    [D:\Program Files\Network Associates\VirusScan\SHUTIL.dll]  [McAfee, Inc., 8.0.0.1036]
    [D:\Program Files\Network Associates\VirusScan\naiwmain.dll]  [Network Associates, Inc., 8.0.0.912]
    [D:\Program Files\Network Associates\VirusScan\RES04\shstat.dll]  [Network Associates, Inc., 8.0.0.912]
    [D:\Program Files\Network Associates\VirusScan\RES04\Product.dll]  [Network Associates, Inc., 8.0.0.912]
    [D:\Program Files\Network Associates\VirusScan\RES04\McShield.dll]  [Network Associates, Inc., 8.0.0.251]
    [D:\Program Files\Network Associates\VirusScan\RES04\Shutilrc.dll]  [Network Associates, Inc., 8.0.0.912]
    [D:\Program Files\Network Associates\VirusScan\Graphics.dll]  [Network Associates, Inc., 8.0.0.912]
[PID: 964][D:\Program Files\Network Associates\Common Framework\UpdaterUI.exe]  [Network Associates, Inc., 3.5.0.412]
    [D:\Program Files\Network Associates\Common Framework\nailog.dll]  [Network Associates, Inc., 3.5.0.474]
    [D:\Program Files\Network Associates\Common Framework\naCmnLib.dll]  [Network Associates, Inc., 3.5.0.474]
    [D:\Program Files\Network Associates\Common Framework\naXML.dll]  [Network Associates, Inc., 3.5.0.474]
    [D:\Program Files\Network Associates\Common Framework\0804\UpdRes.dll]  [Network Associates, Inc., 3.5.0.412]
    [D:\Program Files\Network Associates\Common Framework\0804\AgentRes.dll]  [Network Associates, Inc., 3.5.0.412]
    [D:\Program Files\Network Associates\Common Framework\SecureFrameworkFactory.dll]  [Network Associates, Inc., 3.5.0.412]
[PID: 920][D:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe]  [Network Associates, Inc., 2.0.275.0]
[PID: 1196][D:\Program Files\Eset\nod32kui.exe]  [Eset , 2, 70, 32 ]
    [D:\Program Files\Eset\pu_amon.dll]  [Eset , 2, 70, 32 ]
    [D:\Program Files\Eset\pu_dmon.dll]  [Eset , 2, 70, 32 ]
    [D:\Program Files\Eset\pu_emon.dll]  [Eset , 2, 70, 32 ]
    [D:\Program Files\Eset\pu_imon.dll]  [Eset , 2, 70, 32 ]
    [D:\Program Files\Eset\pu_nod32.dll]  [Eset , 2, 70, 32 ]
    [D:\Program Files\Eset\pu_upd.dll]  [Eset , 2, 70, 32 ]
[PID: 1540][D:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.3790.0 (srv03_rtm.030324-2048)]
    [D:\WINDOWS\system32\vmmreg32.dll]  [Microsoft Corporation, 5.00.3700.6690]
    [D:\WINDOWS\system32\imon.dll]  [Eset , 2, 70, 32 ]
    [D:\Program Files\Network Associates\VirusScan\scriptproxy.dll]  [Network Associates, Inc., 8.0.0.1012]
    [D:\Program Files\Network Associates\VirusScan\mytilus.dll]  [McAfee, Inc., 8.0.0.337]
    [D:\Program Files\Network Associates\VirusScan\Res04\McShield.dll]  [Network Associates, Inc., 8.0.0.251]
    [D:\Program Files\Common Files\Network Associates\Engine\mcscan32.dll]  [McAfee, Inc., 5.1.00]
    [D:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
    [D:\WINDOWS\system32\EntApi.dll]  [McAfee, Inc, 8.0.0.453]
    [D:\WINDOWS\system32\msdmo.dll]  [N/A, N/A]
    [D:\WINDOWS\system32\01668EA6.IME]  [LongWen Corporation, 3.8.200]
[PID: 3228][D:\WINDOWS\system32\wbem\wmiprvse.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 3368][D:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
    [D:\WINDOWS\system32\EntApi.dll]  [McAfee, Inc, 8.0.0.453]
[PID: 4028][D:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.3790.0 (srv03_rtm.030324-2048)]
    [D:\WINDOWS\system32\EntApi.dll]  [McAfee, Inc, 8.0.0.453]
    [D:\WINDOWS\system32\vmmreg32.dll]  [Microsoft Corporation, 5.00.3700.6690]
    [D:\WINDOWS\system32\imon.dll]  [Eset , 2, 70, 32 ]
    [D:\Program Files\Network Associates\VirusScan\scriptproxy.dll]  [Network Associates, Inc., 8.0.0.1012]
    [D:\Program Files\Network Associates\VirusScan\mytilus.dll]  [McAfee, Inc., 8.0.0.337]
    [D:\Program Files\Network Associates\VirusScan\Res04\McShield.dll]  [Network Associates, Inc., 8.0.0.251]
    [D:\Program Files\Common Files\Network Associates\Engine\mcscan32.dll]  [McAfee, Inc., 5.1.00]
    [D:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
[PID: 2472][D:\SREng2.3\SREng.EXE]  [Smallfrogs Studio, 2.3.13.690]
    [D:\WINDOWS\system32\imon.dll]  [Eset , 2, 70, 32 ]
    [D:\SREng2.3\Plugins\SRECXTMG.SRE]  [Smallfrogs Studio, 1, 5, 0, 55]
    [D:\SREng2.3\Plugins\NWMON.SRE]  [Smallfrogs Studio, 1, 0, 0, 8]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  Error. ["hh.exe" %1]
.HLP  Error. [winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
NOD32 protected [MSAFD Tcpip [TCP/IP]]
    D:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning support)
NOD32 protected [MSAFD Tcpip [UDP/IP]]
    D:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning support)
NOD32 protected [MSAFD Tcpip [RAW/IP]]
    D:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning support)
NOD32 protected [RSVP UDP Service Provider]
    D:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning support)
NOD32 protected [RSVP TCP Service Provider]
    D:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning support)
NOD32
    D:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning support)

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
API HOOK
N/A

==================================
gototop
 
小呀小顽童
头像
快乐黄口狮
  • 帖子:172
  • 注册: 2004-08-07
  • 来自:
发表于： 2007-03-01 10:04 | 只看楼主 短消息 资料
字号： 小 中 大 3楼

请指点。怎么样去除？
gototop
 
小呀小顽童
头像
快乐黄口狮
  • 帖子:172
  • 注册: 2004-08-07
  • 来自:
发表于： 2007-03-01 17:24 | 只看楼主 短消息 资料
字号： 小 中 大 4楼

过瘾，这样的病毒，推荐大家都中几回。
gototop
 
oarbznd1
头像
初生襁褓狮
  • 帖子:155
  • 注册: 2007-02-28
  • 来自:
发表于： 2007-03-01 17:28 | 短消息 资料
字号： 小 中 大 5楼

try,看留言
gototop
 
小呀小顽童
头像
快乐黄口狮
  • 帖子:172
  • 注册: 2004-08-07
  • 来自:
发表于： 2007-03-01 17:36 | 只看楼主 短消息 资料
字号： 小 中 大 6楼

引用:
【oarbznd1的贴子】try,看留言
………………

多谢，目前尚未成功，正在进一步测试。

此首页实在是厉害，HACKJACKTHIS，卡卡助手，NOD32，MCAFEE，SRE等都未查出明显异常，而且首页也可以修改，但片刻后改回，服务亦未发现异常。平时处理此类病毒的高手，这次都已无能为力了！
gototop
 
行星001
头像
初生襁褓狮
  • 帖子:34
  • 注册: 2006-08-04
  • 来自:
发表于： 2007-03-01 17:41 | 短消息 资料
字号： 小 中 大 7楼

看一下“反浏览器劫持终极方法之我是流氓我怕谁”，应该能解决。
gototop
 
小呀小顽童
头像
快乐黄口狮
  • 帖子:172
  • 注册: 2004-08-07
  • 来自:
发表于： 2007-03-01 17:49 | 只看楼主 短消息 资料
字号： 小 中 大 8楼

引用:
【行星001的贴子】看一下“反浏览器劫持终极方法之我是流氓我怕谁”，应该能解决。
………………

多谢提醒。
不到万不得已，我不准备改这个，虽然这招很绝。刚才我看了，加个参数应该会有用，但我不知道这次除了浏览器之外，是否还有别的伤害。
gototop
 
<<上一主题|下一主题>>
1   1  /  1  页   跳转页
页面顶部
Powered by Discuz!NT