瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 电脑中木马,卡卡不能启动,有诊断文件

1   1  /  1  页   跳转

[求助] 电脑中木马,卡卡不能启动,有诊断文件

电脑中木马,卡卡不能启动,有诊断文件

IE不能打开新连接,全盘杀毒没发现、状态栏没有打开窗口显示,可以复制不能粘贴!请各位帮帮忙!

附件: 2222.rar (2008-11-25 9:46:11, 7.12 K)
该附件被下载次数 117

听诊器诊断结果!
还有

用户系统信息:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)

附件附件:

文件名:SREngLOG.log
下载次数:181
文件类型:application/octet-stream
文件大小:
上传时间:2008-11-25 10:23:20
描述:log

最后编辑kenodh 最后编辑于 2008-11-25 10:23:20
分享到:
gototop
 

回复:电脑中木马,卡卡不能启动,有诊断文件

用sreng
删除启动项目=>注册表
    <HBService32><System.exe>  [N/A]
    <nwiz><cmgot.exe>  [N/A]
    <{16AF66EB-93C8-49F9-BB09-B4F87CEDCE46}><16AF66EB.dll>  [N/A]
    <{AD794E6B-90B7-4F9D-8FD6-0C16E3298FF2}><AD794E6B.dll>  [N/A]
    <{D7C79813-9233-4AE0-832C-99B2E8019673}><D7C79813.dll>  [N/A]
    <{201476D0-2B18-462E-AB9F-3E2B0CC8732B}><201476D0.dll>  [N/A]
    <{58FF3024-8A83-4B1A-88E9-302F47646EEE}><58FF3024.dll>  [N/A]
    <{3B8DA919-1139-4B10-AD8F-91E8FBCFD375}><3B8DA919.dll>  [N/A]
    <{08223B03-1B38-4A33-A83A-A4D3CC1D6E4E}><08223B03.dll>  [N/A]
    <{122B901E-493F-4AD9-BC69-7DE8C3E52FCC}><122B901E.dll>  [N/A]
    <{E1D19FCC-4777-4D71-B863-6A0A5B4E59BC}><E1D19FCC.dll>  [N/A]
    <{9CA963CA-107C-4089-B0AB-31380F90D7E3}><9CA963CA.dll>  [N/A]
    <{8566F82E-03A4-416E-AEAC-66600D8881F1}><8566F82E.dll>  [N/A]
    <{DA63E650-537C-4042-87BB-9D19D844680B}><DA63E650.dll>  [N/A]
    <{4FBFD5A4-5FE8-4444-8BD9-FD0FAFA64F96}><4FBFD5A4.dll>  [N/A]
    <{A1A6BC2E-C6A1-43C1-8884-A31D772F42B8}><A1A6BC2E.dll>  [N/A]
    <{E4814792-EFA3-4C20-93D0-8B130A59F9A8}><E4814792.dll>  [N/A]
    <{BA7EDF54-8408-4B21-B351-7B447B344BA4}><BA7EDF54.dll>  [N/A]
    <{34A25F04-008D-403E-8EE6-2307BC02FA2E}><34A25F04.dll>  [N/A]
    <{B3721C07-62B3-411A-9DC7-F5F27E3E21FF}><B3721C07.dll>  [N/A]
    <{DFEC5CB7-E2AA-4B0A-BEB3-D140E59ED53A}><DFEC5CB7.dll>  [N/A]
    <{C8EB51BC-82D8-4018-8678-5A0580DBA04A}><C8EB51BC.dll>  [N/A]
    <{2EF0D734-21FD-4225-A1A2-BCD296182AAF}><2EF0D734.dll>  [N/A]
    <{B8E83D3C-9466-4091-9AD1-1F89418A6EB7}><B8E83D3C.dll>  [N/A]
    <{202AEF39-2BFA-4A5F-B526-390FDE0BC675}><D:\Program Files\Internet Explorer\VitnNt64.987>  [File is missing]
    <{E0D39066-96D7-4891-8527-488ADAFCD60F}><E0D39066.dll>  [N/A]


删除启动项目=>服务
[Remote Administrator Service / r_server][Stopped/Auto Start]
  <"D:\WINDOWS.0\system32\r_server.exe" /service><(File is missing)>

删除启动项目=>服务=>驱动
[00144f76 / 00144f76][Stopped/Manual Start]
  <\??\D:\WINDOWS.0\system32\Drivers\00144f76.sys><N/A>
[b160485 / b160485][Stopped/Manual Start]
  <\??\D:\WINDOWS.0\system32\b160485.sys><N/A>
[d435fd4 / d435fd4][Stopped/Manual Start]
  <\??\D:\WINDOWS.0\system32\d435fd4.sys><N/A>
[f35ee9e / f35ee9e][Stopped/Manual Start]
  <\??\D:\WINDOWS.0\system32\f35ee9e.sys><N/A>
[HBKernel32 Driver / HBKernel32][Stopped/Boot Start]
  <\SystemRoot\system32\drivers\HBKernel32.sys><N/A>

重启,删除
D:\WINDOWS.0\system32\System.exe
D:\WINDOWS.0\system32\cmgot.exe
D:\WINDOWS.0\system32\16AF66EB.dll
D:\WINDOWS.0\system32\AD794E6B.dll
D:\WINDOWS.0\system32\D7C79813.dll
D:\WINDOWS.0\system32\201476D0.dll
D:\WINDOWS.0\system32\58FF3024.dll
D:\WINDOWS.0\system32\3B8DA919.dll
D:\WINDOWS.0\system32\08223B03.dll
D:\WINDOWS.0\system32\122B901E.dll
D:\WINDOWS.0\system32\E1D19FCC.dll
D:\WINDOWS.0\system32\9CA963CA.dll
D:\WINDOWS.0\system32\8566F82E.dll
D:\WINDOWS.0\system32\DA63E650.dll
D:\WINDOWS.0\system32\4FBFD5A4.dll
D:\WINDOWS.0\system32\A1A6BC2E.dll
D:\WINDOWS.0\system32\E4814792.dll
D:\WINDOWS.0\system32\BA7EDF54.dll
D:\WINDOWS.0\system32\34A25F04.dll
D:\WINDOWS.0\system32\B3721C07.dll
D:\WINDOWS.0\system32\DFEC5CB7.dll
D:\WINDOWS.0\system32\C8EB51BC.dll
D:\WINDOWS.0\system32\2EF0D734.dll
D:\WINDOWS.0\system32\B8E83D3C.dll
D:\Program Files\Internet Explorer\VitnNt64.987
D:\WINDOWS.0\system32\E0D39066.dll
D:\WINDOWS.0\system32\Drivers\00144f76.sys
D:\WINDOWS.0\system32\b160485.sys
D:\WINDOWS.0\system32\d435fd4.sys
D:\WINDOWS.0\system32\f35ee9e.sys
D:\WINDOWS.0\system32\drivers\HBKernel32.sys


http://bbs.ikaka.com/showtopic-8561436.aspx
复制粘贴恢复
gototop
 

回复:电脑中木马,卡卡不能启动,有诊断文件

解决了!谢谢mopery版主!
gototop
 

回复:电脑中木马,卡卡不能启动,有诊断文件

该用户帖子内容已被屏蔽
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT