瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 疑似中木马,电脑整体异常...请帮看看日志

1   1  /  1  页   跳转

疑似中木马,电脑整体异常...请帮看看日志

疑似中木马,电脑整体异常...请帮看看日志

非常感谢!

用户系统信息:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Maxthon)

附件附件:

文件名:SREngLOG.txt
下载次数:117
文件类型:text/plain
文件大小:
上传时间:2008-6-1 12:26:06
描述:txt

分享到:
gototop
 

回复:疑似中木马,电脑整体异常...请帮看看日志

1.用XDelBox勾选抑制再生后删除以下文件:(XDelBox1.7支持奥运版下载)
使用说明:删除时复制所有要删除文件的路径,在待删除文件列表里点击右键选择从剪贴板导入不检查路径,导入后在要删除文件上点击右键,选择立刻重启删除,电脑会重启进入DOS界面进行删除操作。运行xdelbox前最好卸载所有可移动存储介质(包括U盘,MP3,手机存储卡等)。

c:\windows\system32\hjmh.dll
c:\windows\system32\jyjlt.dll
c:\windows\system32\njritc.dll
c:\windows\system32\ukrth.dll
c:\windows\system32\nhmxajkl.dll
c:\windows\system32\tisqatyu.dll
c:\program files\internet explorer\iexplore32.dat
c:\program files\internet explorer\iexplore32.sys
c:\program files\internet explorer\iexplore32.win
c:\windows\system32\apfocdet.dll
c:\windows\system32\cedafb.dll
c:\windows\system32\fsrgeb.dll
c:\windows\system32\jhrcar.dll
c:\windows\system32\jkhxaklo.dll
c:\windows\system32\mfdesy.dll
c:\windows\system32\mndhddwd.dll
c:\windows\system32\mnmhfsrv.dll
c:\windows\system32\mpwddapi.dll
c:\windows\system32\oohxdbyt.dll
c:\windows\system32\opshbbty.dll
c:\windows\system32\oswxcttb.dll
c:\windows\system32\ozfydbyt.dll
c:\windows\system32\pedadt.dll
c:\windows\system32\qdsrfn.dll
c:\windows\system32\rfdswc.dll
c:\windows\system32\rijxbkin.dll
c:\windows\system32\sgrefg.dll
c:\windows\system32\wrqszl.dll
c:\windows\system32\wyhesm.dll
c:\windows\system32\wyrsdj.dll
c:\windows\system32\ypdjfbmp.dll
c:\windows\system32\yxcschlp.dll
c:\windows\system32\yxfhcjpg.dll
c:\windows\system32\zdesfx.dll
c:\windows\system32\zgfdet.dll
c:\windows\system32\zptlcsys.dll
c:\windows\system32\zxmscwin.dll
c:\windows\system32\zyzxiime.dll
c:\windows\system32\rp_engine.dll
c:\windows\system32\sonyserver.exe
c:\windows\system32\rp_engine.dll
c:\windows\temp\pandrv.sys
e:\game\ss4s\starxxx\zlportio.sys
c:\program files\internet explorer\plugins\nvsys_55.sys

2.删除重启后使用SREng修复下面各项:

    启动项目 -- 注册表之如下项删除:
[{17AC9076-C898-B098-D098-A18319080971}] 
[{7E54996D-821E-4631-87FA-406383955A10}] 
[{25FD6584-698F-BCD2-602C-698745210352}] 
[{83BA45AF-FAAA-CDDD-BEEE-BCDE1234AB38}] 
[{81954FAC-1023-154F-895A-1458258AD818}] 
[{4A069845-2036-6084-9054-6087502480A4}] 
[{14698742-2059-3025-9058-954023874141}] 
[{F99DEFDD-200B-4410-B572-E90883D527D2}] 
[{CAED0F3B-DF8B-4DBF-BB20-8DFBC3199068}] 
[{EA5D4B0E-B8CE-4761-8C7E-5D26369F0EC6}] 
[{22596546-2036-9451-6058-658402589722}] 
[{8C41B7F7-3168-400D-A702-0E7EFE0BA304}] 
[{45AADFAA-DD36-42AB-83AD-0521BBF58C24}] 
[{1E51C0FD-EE36-434B-AD2A-FD1FF3731C38}] 
[{3E035987-F585-68D1-AC28-98FA58E459E3}] 
[{18093456-9012-4568-9076-908765467181}] 
[{50940F85-F015-14F1-A05F-F69858AC6D05}] 
[{5B1AEF69-DDAE-FDAD-DCAB-698F026ABDB5}] 
[{35671234-7890-ABCD-CDEF-567801237653}] 
[{84143967-B645-4BFF-B873-DA1DC886E9A7}] 
[{9A59145F-315D-BC23-AC1F-145DF81A34A9}] 
[{33512378-9874-5641-1025-985420368733}] 
[{EB71E0B3-E97D-4D30-8733-E28266467617}] 
[{5E907A48-400E-4EA8-9792-FFAE052D59E9}] 
[{4C648541-1025-9650-9057-6541258720C4}] 
[{28EB3777-3E23-4E72-8449-A992D09D24C3}] 
[{461D2AB4-29A5-45C2-9134-D52272D3DE38}] 
[{45694105-5108-9405-3695-954187462154}] 
[{DC3D30AE-0380-4151-8934-EE98A34B0370}] 
[{6C8D1401-A58D-A81C-CD24-A5915C4517C6}] 
[{6A041F13-A111-12A3-B0CF-F99818AA68A6}] 
[{C5E87A05-F463-4841-B19E-DD3EC3862368}] 
[{A45B2C37-01D0-4D3E-BE5E-CC119B17BE9E}] 
[{EE12D60D-AD9A-4095-B839-3BE6862679FD}] 
注意该项[AppInit_DLLs]修改:把<ukrth.dll,hjmh.dll,gyjert.dll,tjdegtr.dll,fyhje.dll,hgnmjsdg.dll,jkhjsd.dll,hjtdrh.dll,hyjmt.dll,fydgky.dll,ytjkyer.dll,dgrgfs.dll,gfcfg.dll,frntrn.dll,qrhhb.dll,drghszd.dll,fngn.dll,gnfctt.dll,xgnfn.dll,xfgnhcgfm.dll,serger.dll,bnxnb.dll,fxgnfx.dll,jzijj.dll,xfgnfx.dll,serghjm.dll,thsddh.dll,xbcvxb.dll,zfdzb.dll,xdndn.dll,xdfntt.dll,hgfhk.dll,dnteh.dll,xfng.dll,njritc.dll,chmfcmh.dll,jwlah.dll,gmnait.dll,hfjg.dll,thurh.dll,mgmgmm.dll,oqrthc.dll,dhugtj.dll,jyjlt.dll,ijatnaw.dll,sehhter.dll,fhjfg.dll,zdbdb.dll,ydgn.dll,dbfb.dll,fjnbv.dll,uyjtd.dll,setrhes.dll,cdxbfxdb.dll,xfgnxfn.dll,gjkhj.dll,xdhdg.dll,rhs.dll,mrjhtjd.dll,zdbfbd.dll,fjyjy.dll,fxnfnh.dll,bjrvm.dll,ektvm.dll,rdthr.dll,yjrfe.dll,dscef.dll,crugd.dll,lariytrz.dll,hjaiq.dll,kduy.dll,hkfgh.dll,awef.dll,dfhsh.dll,ethsh.dll,stehs.dll,sthth.dll,wfhyt.dll,rgghjj.dll,ghjkdr.dll,hfther.dll,,tisqatyu.dll,nhmxajkl.dll>修改为<>即清空
[sonyupdate] 

    启动项目 -- 服务 -- Win32服务应用程序之如下项删除:
[Security Control / seictrl] 

    启动项目 -- 服务-- 驱动程序之如下项删除:
[Pandrv / Pandrv]   
[zlportio / zlportio]

    系统修复-- 浏览器加载项之如下项删除:
[]    <C:\Program Files\Internet Explorer\IEXPLORE32.Dat>
[]    <C:\Program Files\Internet Explorer\IEXPLORE32.Sys>
[]    <C:\Program Files\Internet Explorer\IEXPLORE32.win>
[]    <C:\WINDOWS\system32\zyzxiime.dll>
[]    <C:\WINDOWS\system32\yxfhcjpg.dll>
[]    <C:\WINDOWS\system32\ypdjfbmp.dll>
[]    <C:\WINDOWS\system32\mnmhfsrv.dll>
[]    <C:\WINDOWS\system32\mnmhfsrv.dll>
[]    <C:\WINDOWS\system32\zxmscwin.dll>
[]    <C:\WINDOWS\system32\oohxdbyt.dll>
[]    <C:\WINDOWS\system32\zptlcsys.dll>
[]    <C:\WINDOWS\system32\mndhddwd.dll>
[]    <C:\WINDOWS\system32\ozfydbyt.dll>
[]    <C:\Program Files\Internet Explorer\PLUGINS\NvSys_55.Sys>
[]    <C:\WINDOWS\system32\mpwddapi.dll>
[]    <C:\WINDOWS\system32\apfocdet.dll>
[]    <C:\WINDOWS\system32\yxcschlp.dll>
[]    <C:\WINDOWS\system32\oswxcttb.dll>
[]    <C:\WINDOWS\system32\rijxbkin.dll>
[]    <C:\WINDOWS\system32\opshbbty.dll>
[]    <C:\WINDOWS\system32\tisqatyu.dll>
[]    <C:\WINDOWS\system32\nhmxajkl.dll>
[]    <C:\WINDOWS\system32\jkhxaklo.dll>
[]    <C:\Program Files\Internet Explorer\IEXPLORE32.Dat>
[]    <C:\Program Files\Internet Explorer\IEXPLORE32.Sys>
[]    <C:\Program Files\Internet Explorer\IEXPLORE32.win>
[]    <C:\WINDOWS\system32\zyzxiime.dll>
[]    <C:\WINDOWS\system32\yxfhcjpg.dll>
[]    <C:\WINDOWS\system32\ypdjfbmp.dll>
[]    <C:\WINDOWS\system32\mnmhfsrv.dll>
[]    <C:\WINDOWS\system32\zxmscwin.dll>
[]    <C:\WINDOWS\system32\oohxdbyt.dll>
[]    <C:\WINDOWS\system32\zptlcsys.dll>
[]    <C:\WINDOWS\system32\mndhddwd.dll>
[]    <C:\WINDOWS\system32\ozfydbyt.dll>
[]    <C:\WINDOWS\system32\mpwddapi.dll>
[]    <C:\WINDOWS\system32\apfocdet.dll>
[]    <C:\WINDOWS\system32\yxcschlp.dll>
[]    <C:\WINDOWS\system32\oswxcttb.dll>
[]    <C:\WINDOWS\system32\oswxcttb.dll>
[]    <C:\WINDOWS\system32\rijxbkin.dll>
[]    <C:\WINDOWS\system32\opshbbty.dll>
[]    <C:\WINDOWS\system32\tisqatyu.dll>
[]    <C:\WINDOWS\system32\nhmxajkl.dll>
[]    <C:\WINDOWS\system32\jkhxaklo.dll>

做完下载以下软件清理一次并更新杀毒软件至最新进行全盘杀毒一次

清理系统临时文件和IE临时文件夹
http://www.atribune.org/public-beta/ATF-Cleaner.exe
用金山清理专家清理恶意软件
http://www.duba.net/zt/ksc/down.shtml
下载 windows清理助手清理一遍
http://www.arswp.com/download/arswp2/arswp2.zip
不认识我没关系,因为我也不认识你。
gototop
 

回复:疑似中木马,电脑整体异常...请帮看看日志

谢谢,非常感谢~~~~
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT