注册表

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
(ctfmon.exe)(C:\WINDOWS\system32\ctfmon.exe) [(Verified)Microsoft Windows Publisher]
(RAMSaverPro)(C:\Program Files\RAM Saver Pro\ramsaverpro.exe) []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
(kav)("C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe") [Kaspersky Lab]
(racer)(C:\Program Files\racer-han-cnc\racer.exe) [Putian Runway]
(IMJPMIG8.1)(; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32) [(Verified)Microsoft Windows Publisher]
(PHIME2002A)(; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName) [(Verified)Microsoft Windows Publisher]
(PHIME2002ASync)(; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC) [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
(shell)(Explorer.exe) [(Verified)Microsoft Windows Publisher]
(Userinit)(C:\WINDOWS\system32\userinit.exe,) [(Verified)Microsoft Windows Publisher]
(UIHost)(logonui.exe) [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\({12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
(IE7 Uninstall Stub)(C:\WINDOWS\system32\ieudinit.exe) [(Verified)Microsoft Windows Component Publisher]




--------------------------------------------------------------------------------



启动文件夹

[BlackICE Server Protection]
(C:\Documents and Settings\All Users\「开始」菜单\程序\启动\BlackICE Server Protection.lnk --) C:\PROGRA~1\ISS\BlackICE\blackice.exe [Internet Security Systems, Inc.])(N)



--------------------------------------------------------------------------------



服务

[卡巴斯基反病毒6.0 / AVP][Running/Auto Start]
("C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r)(Kaspersky Lab)
[BlackICE / BlackICE][Running/Auto Start]
("C:\Program Files\ISS\BlackICE\blackd.exe")(Internet Security Systems, Inc.)
[Human Interface Device Access / HidServ][Stopped/Disabled]
(C:\WINDOWS\System32\svchost.exe -k netsvcs--)%SystemRoot%\System32\hidserv.dll)(N/A)



--------------------------------------------------------------------------------



驱动程序

[Agere Systems Soft Modem / AgereSoftModem][Running/Manual Start]
(System32\DRIVERS\AGRSM.sys)(Agere Systems)
[Service for WDM 3D Audio Driver / ALCXSENS][Running/Manual Start]
(system32\drivers\ALCXSENS.SYS)(Sensaura Ltd)
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
(system32\drivers\ALCXWDM.SYS)(Realtek Semiconductor Corp.)
[AVG Anti-Spyware Clean Driver / AvgAsCln][Running/System Start]
(System32\DRIVERS\AvgAsCln.sys)(GRISOFT, s.r.o.)
[black / black][Running/Disabled]
(System32\drivers\BlackDrv.sys)(Internet Security Systems, Inc.)
[ENUS_NDIS_DRIVER / ENUS_NDIS_DRIVER][Running/Boot Start]
(\SystemRoot\system32\enusndis.sys)(N/A)
[ialm / ialm][Running/Manual Start]
(System32\DRIVERS\ialmnt5.sys)(Intel Corporation)
[kl1 / kl1][Running/Boot Start]
(\SystemRoot\system32\drivers\kl1.sys)(Kaspersky Lab)
[klif / klif][Running/System Start]
(\??\C:\WINDOWS\system32\drivers\klif.sys)(Kaspersky Lab)
[NetGroup Packet Filter Driver / NPF][Running/Manual Start]
(system32\drivers\npf.sys)(CACE Technologies)
[npkcrypt / npkcrypt][Running/Auto Start]
(\??\C:\Program Files\Tencent\QQ\npkcrypt.sys)(INCA Internet Co., Ltd.)
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
(System32\DRIVERS\ptilink.sys)(Parallel Technologies, Inc.)
[RapDrv / RapDrv][Running/Manual Start]
(\??\C:\WINDOWS\system32\drivers\RapDrv.sys)(Internet Security Systems, Inc.)
[RapFile / RapFile][Running/Manual Start]
(\??\C:\WINDOWS\system32\drivers\RapFile.sys)(Internet Security Systems, Inc.)
[RapNet / RapNet][Running/Manual Start]
(\??\C:\WINDOWS\system32\drivers\RapNet.sys)(Internet Security Systems, Inc.)
[Realtek RTL8139/810x/8169/8110 all in one NDIS NT Driver / RTL8023][Running/Manual Start]
(System32\DRIVERS\Rtlnic51.sys)(Realtek Semiconductor Corporation)
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
(System32\DRIVERS\RTL8139.SYS)(Realtek Semiconductor Corporation)
[Secdrv / Secdrv][Stopped/Manual Start]
(System32\DRIVERS\secdrv.sys)(N/A)
[Intel(R) PRO/Wireless 7100 Adapter 驱动程序 / w70n51][Stopped/Manual Start]
(System32\DRIVERS\w70n51.sys)(Intel? Corporation)
[Intel(R) Graphics Platform (SoftBIOS) Driver / {6080A529-897E-4629-A488-ABA0C29B635E}][Stopped/Manual Start]
(system32\drivers\ialmsbw.sys)(Intel Corporation)
[Intel(R) Graphics Chipset (KCH) Driver / {D31A0762-0CEB-444e-ACFF-B049A1F6FE91}][Stopped/Manual Start]
(system32\drivers\ialmkchw.sys)(Intel Corporation)
[AIM 3.0 Part 01 Codec Driver CH-7009-A/CH-7011 / {E2B953A6-195A-44F9-9BA3-3D5F4E32BB55}][Stopped/Manual Start]
(system32\drivers\wA301a.sys)(Intel Corporation)
[IEProtect / IEProtect][Running/Boot Start]
(\SystemRoot\System32\DRIVERS\IEProtect.sys)(N/A)

浏览器加载项

[ThunderAtOnce Class]
{01443AEC-0FD1-40fd-9C87-E93D1494C233} (C:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD)
[Adobe PDF Reader Link Helper]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated)
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} (C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD)
[Java Plug-in 1.6.0]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} (C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll, Sun Microsystems, Inc.)
[浩方对战平台]
{0A155D3C-68E2-4215-A47A-E800A446447A} (C:\Program Files\浩方对战平台\GameClient.exe, 上海浩方在线信息技术有限公司)
[Web反病毒保护]
{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} (C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll, Kaspersky Lab)
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} (C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation)
[Java Plug-in 1.6.0]
{8AD9C840-044E-11D1-B3E9-00805F499D93} (C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll, Sun Microsystems, Inc.)
[Java Plug-in 1.6.0]
{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} (C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll, Sun Microsystems, Inc.)
[Java Plug-in 1.6.0]
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll, Sun Microsystems, Inc.)
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} (C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.)
[ThunderAtOnce Class]
{01443AEC-0FD1-40FD-9C87-E93D1494C233} (C:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD)
[Adobe PDF Reader Link Helper]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated)
[Web Browser Applet Control]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} (C:\WINDOWS\system32\Msjava.dll, Microsoft Corporation)
[Active Desktop Mover]
{72267F6A-A6F9-11D0-BC94-00C04FB67863} (%SystemRoot%\system32\SHELL32.dll, N/A)
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} (C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD)
[Java Plug-in 1.6.0]
{8AD9C840-044E-11D1-B3E9-00805F499D93} (C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll, Sun Microsystems, Inc.)
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} (%SystemRoot%\System32\shdocvw.dll, N/A)
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} (C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.)
[使用迅雷下载]
(C:\Program Files\Thunder\Program\geturl.htm, N/A)
[使用迅雷下载全部链接]
(C:\Program Files\Thunder\Program\getallurl.htm, N/A)
[导出到 Microsoft Office Excel(&X)]
(res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A)



--------------------------------------------------------------------------------



正在运行的进程

[PID: 488][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 600][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1628][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 8.0.0.0]
[C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.CHS] [Adobe Systems, Inc., 8.0.0.0]
[C:\WINDOWS\system32\igfxpph.dll] [Intel Corporation, 3.0.0.3943]
[C:\WINDOWS\system32\hccutils.DLL] [Intel Corporation, 3.0.0.3943]
[C:\WINDOWS\system32\igfxres.dll] [Intel Corporation, 3.0.0.3943]
[C:\WINDOWS\system32\igfxsrvc.dll] [Intel Corporation, 3.0.0.3943]
[C:\WINDOWS\system32\igfxdev.dll] [Intel Corporation, 3.0.0.3943]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\pr_remote.dll] [Kaspersky Lab, 6.0.0.299]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll] [Kaspersky Lab, 6.0.0.299]
[C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 8.0.0.2006102200]
[C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 2, 17]
[PID: 1812][C:\Program Files\racer-han-cnc\racer.exe] [Putian Runway, 3,3,116,192]
[C:\Program Files\racer-han-cnc\rwxre.dll] [Mozilla Foundation, 1.7.3: 2006072418]
[C:\Program Files\racer-han-cnc\nspr4.dll] [Netscape Communications Corporation, 4.5 Beta]
[C:\Program Files\racer-han-cnc\xpcom.dll] [Mozilla Foundation, 1.7.3: 2006072418]
[C:\Program Files\racer-han-cnc\nss3.dll] [Netscape Communications Corporation, 3.9.1]
[C:\Program Files\racer-han-cnc\softokn3.dll] [Netscape Communications Corporation, 3.9.1]
[C:\Program Files\racer-han-cnc\gkgfx.dll] [Mozilla Foundation, 1.7.3: 2006072418]
[C:\Program Files\racer-han-cnc\xpcom_compat.dll] [Mozilla Foundation, 1.7.3: 2006072418]
[C:\Program Files\racer-han-cnc\js3250.dll] [Netscape Communications Corporation, 4.0]
[C:\Program Files\racer-han-cnc\components\racer_base_comp.dll] [Putian Runway, 3,3,116,192]
[C:\Program Files\racer-han-cnc\racer_base.dll] [Putian Runway, 3,3,116,192]
[C:\Program Files\racer-han-cnc\kbdhook.dll] [Putian Runway, 3,3,116,192]
[C:\Program Files\racer-han-cnc\components\pipnss.dll] [Mozilla Foundation, 1.7.3: 2006072418]
[C:\Program Files\racer-han-cnc\components\gklayout.dll] [Mozilla Foundation, 1.7.3: 2006072418]
[C:\Program Files\racer-han-cnc\components\jar50.dll] [Mozilla Foundation, 1.7.3: 2006072418]
[C:\Program Files\racer-han-cnc\components\xpcom_compat_c.dll] [Mozilla Foundation, 1.7.3: 2006072418]
[C:\Program Files\racer-han-cnc\components\racer_ad_comp.dll] [Putian Runway, 3,3,116,192]
[C:\Program Files\racer-han-cnc\components\racer_access_pppoe.dll] [Putian Runway, 3,3,116,192]
[C:\Program Files\racer-han-cnc\pppoe.dll] [北京润汇科技有限公司, 9, 0, 22, 48]
[C:\Program Files\racer-han-cnc\components\racer_nss4_comp.dll] [Putian Runway, 3,3,116,192]
[C:\Program Files\racer-han-cnc\nss4.dll] [北京润汇科技有限公司, 1, 0, 0, 4]
[C:\Program Files\racer-han-cnc\wpcap.dll] [CACE Technologies, 3, 2, 0, 29]
[C:\Program Files\racer-han-cnc\packet.dll] [CACE Technologies, 3, 2, 0, 29]
[C:\Program Files\racer-han-cnc\WanPacket.dll] [CACE Technologies, 3, 2, 0, 29]
[PID: 1912][C:\Program Files\RAM Saver Pro\ramsaverpro.exe] [N/A, ]
[PID: 2036][C:\Program Files\ISS\BlackICE\blackice.exe] [Internet Security Systems, Inc., 3.6.320]
[C:\Program Files\ISS\BlackICE\FileSec.dll] [Internet Security Systems, Inc., 3.6.319]
[C:\Program Files\ISS\BlackICE\MFC42.DLL] [Microsoft Corporation, 6.00.8665.0]
[PID: 3044][D:\TEMP\sre2\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
[D:\TEMP\sre2\Plugins\NWMON.SRE] [Smallfrogs Studio, 1, 0, 0, 8]
[D:\TEMP\sre2\Plugins\SRECXTMG.SRE] [Smallfrogs Studio, 1, 5, 0, 55]



--------------------------------------------------------------------------------



文件关联

.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]



--------------------------------------------------------------------------------



Winsock 提供者

N/A



--------------------------------------------------------------------------------



Autorun.inf

N/A



--------------------------------------------------------------------------------



HOSTS 文件

N/A



--------------------------------------------------------------------------------



API HOOK

RVA 错误： LoadLibraryA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xEEC7CB25)
RVA 错误： LoadLibraryExA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xEEC7CD67)
RVA 错误： LoadLibraryExW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xEEC7CF0B)
RVA 错误： LoadLibraryW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xEEC7CC49)
RVA 错误： GetProcAddress (危险等级: 高, 被下面模块所HOOK: Dest Addr: 0xEEC7CE8F)



--------------------------------------------------------------------------------



隐藏进程

N/A

问下...可疑文件怎么上传?

该文件经杀软扫描无毒...但是删了又出...

用卡卡助手查了下...根本没反应...

我现在都怀疑自己是不是神经过敏了...不过AVG和360可以查出...但是删除过后又出来了...

用360查的时候,显示isDrv120恶意软件...点清除时...BlackIce报告Local settings/TEMP下有EXE运行,名字随机...

我把EXE复制了用咔吧和AVG扫,没反应...

刚用AVG全盘扫了下...一个报警是Local setting/TEMP下的,一个是卡卡...

快疯了...

多谢火影、天月。。。

我刚把那个可疑驱动删了。。。SRE驱动里没它。。。不过360清除恶意软件时还是弹出随机数字命名的EXE。。。EXE在LOCALSETTING/TEMP下面。。。

驱动程序
[Agere Systems Soft Modem / AgereSoftModem][Running/Manual Start]
  <System32\DRIVERS\AGRSM.sys><Agere Systems>
[Service for WDM 3D Audio Driver / ALCXSENS][Running/Manual Start]
  <system32\drivers\ALCXSENS.SYS><Sensaura Ltd>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[AVG Anti-Spyware Driver / AVG Anti-Spyware Driver][Running/Disabled]
  <\??\D:\反病毒\AVG Anti-Spyware 7.5\guard.sys><N/A>
[AVG Anti-Spyware Clean Driver / AvgAsCln][Running/Disabled]
  <System32\DRIVERS\AvgAsCln.sys><N/A>
[black / black][Running/Disabled]
  <System32\drivers\BlackDrv.sys><Internet Security Systems, Inc.>
[ialm / ialm][Running/Manual Start]
  <System32\DRIVERS\ialmnt5.sys><Intel Corporation>
[IEProtec / IEProtect][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\IEProtect.sys><N/A>
[kl1 / kl1][Running/Boot Start]
  <\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif][Running/System Start]
  <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[NetGroup Packet Filter Driver / NPF][Running/Manual Start]
  <system32\drivers\npf.sys><CACE Technologies>
[npkcrypt / npkcrypt][Running/Auto Start]
  <\??\C:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RapDrv / RapDrv][Running/Manual Start]
  <\??\C:\WINDOWS\system32\drivers\RapDrv.sys><Internet Security Systems, Inc.>
[RapFile / RapFile][Running/Manual Start]
  <\??\C:\WINDOWS\system32\drivers\RapFile.sys><Internet Security Systems, Inc.>
[RapNet / RapNet][Running/Manual Start]
  <\??\C:\WINDOWS\system32\drivers\RapNet.sys><Internet Security Systems, Inc.>
[Realtek RTL8139/810x/8169/8110 all in one NDIS NT Driver / RTL8023][Running/Manual Start]
  <System32\DRIVERS\Rtlnic51.sys><Realtek Semiconductor Corporation>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
  <System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
  <System32\DRIVERS\secdrv.sys><N/A>
[Intel(R) PRO/Wireless 7100 Adapter 驱动程序 / w70n51][Stopped/Manual Start]
  <System32\DRIVERS\w70n51.sys><Intel? Corporation>
[Intel(R) Graphics Platform (SoftBIOS) Driver / {6080A529-897E-4629-A488-ABA0C29B635E}][Stopped/Manual Start]
  <system32\drivers\ialmsbw.sys><Intel Corporation>
[Intel(R) Graphics Chipset (KCH) Driver / {D31A0762-0CEB-444e-ACFF-B049A1F6FE91}][Stopped/Manual Start]
  <system32\drivers\ialmkchw.sys><Intel Corporation>
[AIM 3.0 Part 01 Codec Driver CH-7009-A/CH-7011 / {E2B953A6-195A-44F9-9BA3-3D5F4E32BB55}][Stopped/Manual Start]
  <system32\drivers\wA301a.sys><Intel Corporation>

引用:

【桃子CiCi的贴子】楼上的 进行扫描SRENG日志前 将临时文件夹内容清空.. ………………

呃...什么意思??

TEMP下一直都空的...那个EXE是在清除的时候自动生成...然后消失的...

我一直感觉见鬼了...平时中毒什么的总能找到文件...最不济也知道可疑进程...

现在...那出毛病了我都不清楚...哭了...

好歹也帮人手杀病毒木马无数...

前两天中次ONLINEGAMES什么的...全感染了...重装...

前几天中次威近...全感染了...AVG等于把我盘格遍地杀...重装...

这次莫名其妙中个没影子的东西...

我干脆买块豆腐撞死算了...

天哪...360耍我么...

刚打开360的时候...更新...然后查恶意软件查不到东西了...

不过...网页照弹...广告照旧...

我真是囧了....

360和卡卡的浏览器反劫持不管用...HOST又正常...呃...这个世界太奇妙了....疯了...