Jeddie - 2005-11-16 12:37:00
用U盘拷过来来几个PPT文档，是放在文件夹里的。
好像拷过来时就已经有病毒，在自己的电脑上看U盘上文件夹已经是.EXE文件了，不过当时没有注意，直接点击运行了。
然后就发现中毒了，因为机器上一直没有杀毒软件，一点防范力都没有。
杀完毒，知道是Worm.DockKill.b.53248和Win32.Troj.DropDoc.c.24576，病毒好像都已经清楚干净了。
问题是资源管理器的菜单项：工具－文件夹选项－查看－高级设置里的“隐藏已知文件类型的扩展名”和“显示所有文件和文件夹”都不能自行选择了。
也就是说：就算我将“隐藏已知文件类型的扩展名”前的对勾去掉，文件的扩展名还是不能显示，再来看时发现对勾还是打上的，根本改不过来，“显示所有文件和文件夹”也是同样的毛病。
以下是HijackThis的扫描报告，可能对问题没有什么帮助，不过还是贴上来，也许有什么新的发现。
Logfile of HijackThis v1.99.1
Scan saved at 22:50:14, on 2005-11-15
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Kingsoft\KIS2006\KWatch.EXE
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Kingsoft\KIS2006\KPfwSvc.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\DrvMon.exe
D:\Program Files\Kingsoft\KIS2006\KMailMon.EXE
C:\WINDOWS\system32\conime.exe
D:\Program Files\联创通信\宽带上网助手\Dot1xClient.exe
D:\Program Files\Maxthon\Maxthon.exe
D:\Program Files\eMule_CN\emule.exe
E:\SOFTWARE\Security\HijackThis.exe
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: CyberArticle Express - {769A6A36-ED24-4376-BC7C-80225BF35698} - D:\Program Files\CyberArticle\CAExp.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [KavStart] "D:\Program Files\Kingsoft\KIS2006\KAVStart.exe" -startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [DrvMon.exe] ; C:\WINDOWS\system32\DrvMon.exe
O4 - HKCU\..\Run: [iDuba Personal FireWall] ;
O4 - HKCU\..\Run: [KavPFW] "D:\Program Files\Kingsoft\KIS2006\KAVPFW.EXE"
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: 使用网际快车下载全部链接 - D:\Program Files\FlashGet\jc_all.htm
O16 - DPF: {4479E594-3B53-4734-8030-61E1ABF07067} (ZSetupClt Control) - http://211.70.215.31/emlib/ZSetupClt.ocx
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://update.microsoft.com/wind ... e.cab?1131449754759
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common
Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Kingsoft Personal Firewall Service (KPfwSvc) - Kingsoft Corporation - D:\Program Files\Kingsoft\KIS2006
\KPfwSvc.EXE
O23 - Service: Kingsoft Antivirus KWatch Service (KWatchSvc) - Kingsoft Corporation - D:\Program Files\Kingsoft\KIS2006
\KWatch.EXE
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%
\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
不言放弃 - 2005-11-16 12:42:00
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
修复
Jeddie - 2005-11-16 13:37:00
是用Hijackthis修复吗？我勾选了那两项进行fix，然后重启。
不过现在问题依旧，不能在资源管理器里查看文件的扩展名，
在工具－文件夹选项－查看－高级设置里的“隐藏已知文件类型的扩展名”修改后它自己又改了回来。
BlackStone - 2005-11-16 14:13:00
用Autoruns保存一个日志发上来
日志保存方法:选择File->Save菜单项
保存日志时注意选择Options->Hide Microsoft Entries菜单项(设置了这项后点工具栏的刷新按钮)
工具的下载、使用参考http://forum.ikaka.com/topic.asp?board=28&artid=7318038第14楼
Jeddie - 2005-11-16 16:42:00
按黑石头老大的要求做了。Sysinternals的软件都是精品啊，好像作者就是微软的吧，还写书来着。
不过Sysinternals的软件字体在我的机器上都太下，在Font里改了也不管用，“行间距”好像固定了，不随字体大小而改变。
我开始用过一段时间微软推荐的CA eTrust(www.my-etrust.com/microsoft)，CaAvTray好像就是留下的痕迹，不过那个东西好像没什么用，我都快忘了机器上装过这东西。
Kingsoft是这次中毒后应急下载的，竟然跑到瑞星的地盘来求助了......
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
+ BigDogPath File not found: ;
+ CaAvTray File not found: ;
+ IMJPMIG8.1 File not found: ;
+ IMSCMig File not found: ;
+ KavStart Kingsoft Security Center 2005 (Not verified) Kingsoft Corporation d:\program files\kingsoft\kis2006\kavstart.exe
+ pdfFactory Pro Dispatcher v2 File not found: ;
+ PHIME2002A File not found: ;
+ PHIME2002ASync File not found: ;
+ SiSUSBRG File not found: ;
+ SunJavaUpdateSched File not found: ;
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
+ DrvMon.exe File not found: ;
+ Google Desktop Search c:\program files\google\google desktop search\googledesktop.exe
+ iDuba Personal FireWall File not found: ;
+ KavPFW Kingsoft Personal Firewall Main Program (Not verified) Kingsoft Corporation d:\program files\kingsoft\kis2006\kavpfw.exe
HKLM\System\CurrentControlSet\Services
+ KPfwSvc 金山网镖网络实时监控服务程序 (Not verified) Kingsoft Corporation d:\program files\kingsoft\kis2006\kpfwsvc.exe
+ KWatchSvc 金山毒霸文件实时防毒服务程序 (Not verified) Kingsoft Corporation d:\program files\kingsoft\kis2006\kwatch.exe
+ MazeSvr d:\program files\天网maze\mazesvr.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
+ Developer Studio Components Microsoft(R) Developer Studio Explorer Shell Extensions (Not verified) Microsoft Corporation d:\program files\microsoft visual studio\common\msdev98\bin\ide\devxpgl.dll
+ Display Panning CPL Extension File not found: deskpan.dll
+ Registered ActiveX Controls Microsoft(R) Developer Studio Explorer Shell Extensions (Not verified) Microsoft Corporation d:\program files\microsoft visual studio\common\msdev98\bin\ide\devxpgl.dll
+ Shell Context Menu Handler for Application Manifests Application Deployment Support Library (Not verified) Microsoft Corporation c:\windows\system32\dfshim.dll
+ Shell Context Menu Handler for Application References Application Deployment Support Library (Not verified) Microsoft Corporation c:\windows\system32\dfshim.dll
+ Shell Extensions for RealOne Player RealPlayer Shell Extensions (Not verified) RealNetworks, Inc. d:\program files\real\realplayer\rpshell.dll
+ Shell Icon Handler for Application References Application Deployment Support Library (Not verified) Microsoft Corporation c:\windows\system32\dfshim.dll
+ WinRAR shell extension d:\program files\winrar\rarext.dll
HKLM\Software\Microsoft\Internet Explorer\Toolbar
+ FlashGet Bar FlashGet IE Bar (Not verified) Amaze Soft d:\program files\flashget\fgiebar.dll
+ FlashGet Bar CyberArticle Express (Not verified) Wizissoft d:\program files\cyberarticle\caexp.dll
HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
+ DllDirectory c:\windows\system32
HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9
+ Google Desktop c:\program files\google\google desktop search\googledesktopnetwork1.dll
+ Google Desktop over [CA ISafe LSP over [MSAFD Tcpip [TCP/IP]]] c:\program files\google\google desktop search\googledesktopnetwork1.dll
+ Google Desktop over [CA ISafe LSP over [MSAFD Tcpip [UDP/IP]]] c:\program files\google\google desktop search\googledesktopnetwork1.dll
xiaoyuwzc21 - 2005-11-16 17:03:00
好多人说上了这个论坛就中这个木马呀 我好怕呀 系米真加
Jeddie - 2005-11-16 18:03:00
肯定不是在这个论坛感染了，因为我在染毒之前（也就是昨天）很少到关于病毒的网站/论坛。
© 2000 - 2026 Rising Corp. Ltd.