瑞星卡卡安全论坛

今天瑞星实时监控不停提示在system32目录下发现eppkqppe.dll(从9点12开机到9点36已经查杀50余次),但是却无法彻底查杀。因为在system32目录下根本没有这个文件(我设的所有文件可见,没搜到)。在google搜了一下,只有一个结果,是台湾的一个论坛上,但是没有解决办法。
  不知哪位高手能给个解释
急！！！

先看看你HJ日志吧

1、在C:\WINDOWS\system32\drivers下搜索eppkqppe.SYS如果有这个文件就删除掉
2、进入注册表编辑器，查找eppkqppe.dll，找到注册表项之后删除该注册表项

Logfile of HijackThis v1.99.1
Scan saved at 21:58:58 , on 2005-12-17
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
F:\防护\瑞星\Ravmond.exe
F:\防护\FireWall\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
F:\防护\瑞星\CCENTER.EXE
C:\WINDOWS\Explorer.EXE
F:\防护\FireWall\RfwMain.exe
F:\防护\瑞星\RAVMON.EXE
F:\防护\Iparmor\Iparmor.exe
F:\防护\瑞星\RAVTIMER.EXE
C:\WINDOWS\system32\ctfmon.exe
F:\防护\端口\aports.exe
F:\Maxthon\Maxthon.exe
F:\杂项\WinRAR\WinRAR.exe
C:\DOCUME~1\WINDNI~1\LOCALS~1\Temp\Rar$EX00.570\HijackThis.exe

O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v8.dll
O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yphtb.dll
O2 - BHO: CNNIC_IDN - {35980F6E-A137-4E50-953D-813BB8556899} - C:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll (file missing)
O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yAngling.dll
O2 - BHO: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasbar.dll
O2 - BHO: Router Layer - {5EB7CB50-E375-4718-B4C0-9AD12EFA2F84} - C:\WINDOWS\System32\aclayer.dll (file missing)
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\assist\YDRAGS~1.DLL
O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - C:\Program Files\baidu\bar\BaiduBar.dll (file missing)
O2 - BHO: BHelper - {8A4280AD-9B37-4922-A51D-73F3C3A32AF7} - C:\WINDOWS\system32\msibm\cfsbho.dll (file missing)
O2 - BHO: (no name) - {F5824EFB-728A-4726-A5A5-85A68B20EDC3} - (no file)
O3 - Toolbar: 百度超级搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\Program Files\baidu\bar\BaiduBar.dll (file missing)
O3 - Toolbar: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] rem RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [RfwMain] "F:\防护\FireWall\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [RavMon] F:\防护\瑞星\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [iparmor] F:\防护\Iparmor\Iparmor.exe mini
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [mscfs] RUNDLL32 C:\WINDOWS\system32\msibm\cfsys.DLL,cfs
O4 - HKLM\..\Run: [RavTimer] F:\防护\瑞星\RAVTIMER.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AutoInsQyule] C:\Program Files\office\office\Setup_W0023.exe
O8 - Extra context menu item: &使用迅雷下载 - F:\下载\thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - F:\下载\thunder\getallurl.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 用比特精灵下载(&B) - F:\下载\BitSpirit\bsurl.htm
O8 - Extra context menu item: 百度-搜索MP3 - res://C:\Program Files\baidu\bar\BaiduBar.dll/BAIDUMP3.HTM
O8 - Extra context menu item: 百度-搜索图片 - res://C:\Program Files\baidu\bar\BaiduBar.dll/BAIDUIMG.HTM
O8 - Extra context menu item: 百度-搜索新闻 - res://C:\Program Files\baidu\bar\BaiduBar.dll/BAIDUNEWS.HTM
O8 - Extra context menu item: 百度-搜索歌词 - res://C:\Program Files\baidu\bar\BaiduBar.dll/BAIDULYRIC.HTM
O8 - Extra context menu item: 百度-搜索网页 - res://C:\Program Files\baidu\bar\BaiduBar.dll/BAIDUSEARCH.HTM
O8 - Extra context menu item: 百度-搜索贴吧 - res://C:\Program Files\baidu\bar\BaiduBar.dll/BAIDUPOST.HTM
O8 - Extra context menu item: 百度-词典搜索 - res://C:\Program Files\baidu\bar\BaiduBar.dll/BAIDU_DIC.HTM
O8 - Extra context menu item: 访问通用网址 - C:\Program Files\CNNIC\Cdn\cnnic.htm
O8 - Extra context menu item: 雅虎搜索 - res://C:\PROGRA~1\Yahoo!\Assistant\Assist\yasbar.dll/246
O9 - Extra button: 中文上网 - {35980F6E-A137-4E50-953D-813BB8556899} - C:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll (file missing)
O9 - Extra 'Tools' menuitem: 中文上网 - {35980F6E-A137-4E50-953D-813BB8556899} - C:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll (file missing)
O9 - Extra button: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: 易趣购物 - {DE607144-AC19-424e-869A-9D70ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=5 (file missing)
O9 - Extra 'Tools' menuitem: 易趣购物 - {DE607144-AC19-424e-869A-9D70ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=5 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'c:\windows\system32\cdnns.dll' missing
O11 - Options group: [CDNCLIENT]  中文上网
O17 - HKLM\System\CCS\Services\Tcpip\..\{0C235AB4-F923-4DDD-818F-94BB179AB1C6}: NameServer = 202.102.152.3,202.102.128.68
O17 - HKLM\System\CS1\Services\Tcpip\..\{0C235AB4-F923-4DDD-818F-94BB179AB1C6}: NameServer = 202.102.152.3,202.102.128.68
O17 - HKLM\System\CS2\Services\Tcpip\..\{0C235AB4-F923-4DDD-818F-94BB179AB1C6}: NameServer = 202.102.152.3,202.102.128.68
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - F:\防护\FireWall\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - F:\防护\瑞星\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - F:\防护\瑞星\Ravmond.exe

引用:

【卧龙传说的贴子】1、在C:\WINDOWS\system32\drivers下搜索eppkqppe.SYS如果有这个文件就删除掉 2、进入注册表编辑器，查找eppkqppe.dll，找到注册表项之后删除该注册表项 ...........................

你说的第二项已经找到并删除，第一项没找到
谢谢指点

O2 - BHO: BHelper - {8A4280AD-9B37-4922-A51D-73F3C3A32AF7} - C:\WINDOWS\system32\msibm\cfsbho.dll (file missing)
O4 - HKLM\..\Run: [mscfs] RUNDLL32 C:\WINDOWS\system32\msibm\cfsys.DLL,cfs
O4 - HKCU\..\Run: [AutoInsQyule] C:\Program Files\office\office\Setup_W0023.exe
上面这三项都是和木马有关的，文件夹和DLL文件均已被我删除，注册表刚才在你的指点下也已经清除了
O17 - HKLM\System\CCS\Services\Tcpip\..\{0C235AB4-F923-4DDD-818F-94BB179AB1C6}: NameServer = 202.102.152.3,202.102.128.68
O17 - HKLM\System\CS1\Services\Tcpip\..\{0C235AB4-F923-4DDD-818F-94BB179AB1C6}: NameServer = 202.102.152.3,202.102.128.68
O17 - HKLM\System\CS2\Services\Tcpip\..\{0C235AB4-F923-4DDD-818F-94BB179AB1C6}: NameServer = 202.102.152.3,202.102.128.68

这三项什么意思啊？

我把系统服务中的network dde、network dde dsdm、Remote Desktop Help Session Manager、Remote Registry、Server、Task Scheduler、Telnet均设为禁用，对网络防护是否有用？用处有多大？还请高手卧龙再指教一下

引用:

【windnirvana的贴子】 O17 - HKLM\System\CCS\Services\Tcpip\..\{0C235AB4-F923-4DDD-818F-94BB179AB1C6}: NameServer = 202.102.152.3,202.102.128.68 O17 - HKLM\System\CS1\Services\Tcpip\..\{0C235AB4-F923-4DDD-818F-94BB179AB1C6}: NameServer = 202.102.152.3,202.102.128.68 O17 - HKLM\System\CS2\Services\Tcpip\..\{0C235AB4-F923-4DDD-818F-94BB179AB1C6}: NameServer = 202.102.152.3,202.102.128.68 这三项什么意思啊？ ...........................

自己先晕一下，原来是DNS服务器