救命啊...上星期中了rising.exe病毒...昨天又中了一个shualai.exe病毒 bbs.ikaka.com

KaKa老大 - 2007-5-4 14:49:00

系统盘下有个猪头叼着烟图标的文件...这是什么病毒啊...

在D盘下还有个myplayer.com的文件.

附上病毒图标:

无比上上狼 - 2007-5-4 14:53:00

我也中了shualai (耍赖)病毒,正在求救呢...这病毒好麻烦的///

UFO不幸外人 - 2007-5-4 15:12:00

扫描一份SRE日志上来

KaKa老大 - 2007-5-4 15:28:00

2005-05-04,15:14:48

System Repair Engineer 2.0.12.350 (2.0 RC 1)
Windows XP Professional Service Pack 2 - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<ATIPTA><atiptaxx.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<cctray><"C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe">
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<CAVRID><"C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe">
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Kvsc3><; C:\WINDOWS\Kvsc3.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<shualai><; C:\WINDOWS\shualai.exe /i>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<Userinit><C:\WINDOWS\System32\userinit.exe,>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><>

==================================
启动文件夹
服务
[Ati HotKey Poller / Ati HotKey Poller]
<C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[ATI Smart / ATI Smart]
<C:\WINDOWS\system32\ati2sgag.exe><>
[CaCCProvSP / CaCCProvSP]
<"C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe"><CA, Inc.>
[CAISafe / CAISafe]
<C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe><Computer Associates International, Inc.>
[VET Message Service / VETMSGNT]
<C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe><CA, Inc.>

==================================
浏览器加载项
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v8.dll, >
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v8.dll, >
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\Flash85.ocx, Macromedia, Inc.>
[&使用迅雷下载]
<C:\Program Files\Thunder Network\Thunder\geturl.htm, N/A>
[&使用迅雷下载全部链接]
<C:\Program Files\Thunder Network\Thunder\getallurl.htm, N/A>
[使用网际快车下载]
<C:\Program Files\FlashGet1.71\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<C:\Program Files\FlashGet1.71\jc_all.htm, N/A>

KaKa老大 - 2007-5-4 15:29:00

==================================
正在运行的进程
[PID: 528][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1112][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1900][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\Ati2evxx.dll] <ATI Technologies Inc.><6.14.10.4118>
[PID: 1132][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1192][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 996][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1960][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\VetRedir.dll] <Computer Associates International, Inc.><Version 8.0.8.0>
[C:\WINDOWS\system32\ISafeIf.dll] <Computer Associates International, Inc.><Version 8.0.8.0>
[PID: 800][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\VetRedir.dll] <Computer Associates International, Inc.><Version 8.0.8.0>
[C:\WINDOWS\system32\ISafeIf.dll] <Computer Associates International, Inc.><Version 8.0.8.0>
[PID: 1468][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\VetRedir.dll] <Computer Associates International, Inc.><Version 8.0.8.0>
[C:\WINDOWS\system32\ISafeIf.dll] <Computer Associates International, Inc.><Version 8.0.8.0>
[PID: 160][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\VetRedir.dll] <Computer Associates International, Inc.><Version 8.0.8.0>
[C:\WINDOWS\system32\ISafeIf.dll] <Computer Associates International, Inc.><Version 8.0.8.0>
[PID: 1148][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)>
[PID: 936][C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe] <Computer Associates International, Inc.><Version 8.0.8.0>
[C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafServ.dll] <Computer Associates International, Inc.><Version 8.0.8.0>
[C:\WINDOWS\system32\iSafProd.dll] <CA, Inc.><Version 8.4.0.24>
[C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\Arclib.dll] <CA, Inc.><7.3.0.9>
[C:\WINDOWS\system32\ISafeIf.dll] <Computer Associates International, Inc.><Version 8.0.8.0>
[C:\WINDOWS\system32\VetRedir.dll] <Computer Associates International, Inc.><Version 8.0.8.0>
[C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafeEngine.dll] <CA, Inc.><Version 30.7.0.0>
[PID: 1800][C:\WINDOWS\system32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: dnsrv(bld4act)>
[PID: 808][C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe] <CA, Inc.><Version 8.4.0.24>
[C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\DriverIf.dll] <CA, Inc.><Version 8.4.0.24>
[C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetNtMsg.dll] <CA, Inc.><Version 8.4.0.24>
[C:\WINDOWS\system32\ISafeIf.dll] <Computer Associates International, Inc.><Version 8.0.8.0>
[C:\WINDOWS\system32\VetRedir.dll] <Computer Associates International, Inc.><Version 8.0.8.0>
[PID: 200][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\VetRedir.dll] <Computer Associates International, Inc.><Version 8.0.8.0>
[C:\WINDOWS\system32\ISafeIf.dll] <Computer Associates International, Inc.><Version 8.0.8.0>
[PID: 404][C:\WINDOWS\system32\wbem\wmiprvse.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 3612][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\pdkpri.dll] <N/A><N/A>
[PID: 1880][C:\WINDOWS\system32\atiptaxx.exe] <ATI Technologies, Inc.><6.14.10.5154>
[C:\WINDOWS\system32\atipdsxx.dll] <ATI Technologies, Inc.><6.14.10.5154>
[C:\WINDOWS\system32\ATRPUIXX.CHS] <ATI Technologies, Inc.><6.14.10.5154>
[C:\WINDOWS\system32\atipdxxx.dll] <ATI Technologies, Inc.><6.14.10.5154>
[PID: 2052][C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe] <CA, Inc.><Version 3.2.1.12>
[C:\Program Files\CA\CA Internet Security Suite\ccGUIFrm.dll] <CA, Inc.><Version 3.2.1.12>
[C:\Program Files\CA\CA Internet Security Suite\ccissImg.dll] <CA, Inc.><Version 3.2.1.12>
[C:\Program Files\CA\CA Internet Security Suite\ccissPrd.dll] <CA, Inc.><Version 3.2.1.12>
[C:\Program Files\CA\CA Internet Security Suite\ccissRes.dll] <CA, Inc.><Version 3.2.1.12>
[C:\Program Files\CA\CA Internet Security Suite\ccGUIFrmRes.dll] <CA, Inc.><Version 3.2.1.12>
[C:\Program Files\CA\CA Internet Security Suite\cctray\cctrayissplugin.dll] <CA, Inc.><Version 3.2.1.12>
[C:\Program Files\CA\CA Internet Security Suite\cctray\cctrayavplugin.dll] <CA, Inc.><Version 8.4.0.24>
[C:\Program Files\CA\CA Internet Security Suite\caissresource.dll] <CA, Inc.><Version 3.2.1.12>
[C:\Program Files\CA\CA Internet Security Suite\caISSImages.dll] <CA, Inc.><Version 3.2.1.12>
[C:\Program Files\CA\CA Internet Security Suite\caISSProduct.dll] <CA, Inc.><Version 3.2.1.12>
[C:\Program Files\CA\CA Internet Security Suite\ccpriv.dll] <Computer Associates International, Inc.><Version 3.2.1.12>
[C:\Program Files\CA\CA Internet Security Suite\EZAVLIC.DLL] <CA, Inc.><Version 3.2.1.12>
[C:\Program Files\CA\CA Internet Security Suite\calic.dll] <CA, Inc.><Version 3.2.1.12>
[C:\Program Files\CA\CA Internet Security Suite\License.dll] <N/A><N/A>
[C:\WINDOWS\system32\ISafeIf.dll] <Computer Associates International, Inc.><Version 8.0.8.0>
[C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\driverif.dll] <CA, Inc.><Version 8.4.0.24>
[C:\WINDOWS\system32\VetRedir.dll] <Computer Associates International, Inc.><Version 8.0.8.0>
[C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\caavProduct.dll] <CA, Inc.><Version 8.4.0.24>
[C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\caavResource.dll] <CA, Inc.><Version 8.4.0.24>
[C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\caavImages.dll] <CA, Inc.><Version 8.4.0.24>
[PID: 2072][C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe] <CA, Inc.><Version 8.4.0.24>
[C:\Program Files\CA\CA Internet Security Suite\ccGUIFrm.dll] <CA, Inc.><Version 3.2.1.12>
[C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\caavProduct.dll] <CA, Inc.><Version 8.4.0.24>
[C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\caavResource.dll] <CA, Inc.><Version 8.4.0.24>
[C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\caavImages.dll] <CA, Inc.><Version 8.4.0.24>
[C:\Program Files\CA\CA Internet Security Suite\ccGUIFrmRes.dll] <CA, Inc.><Version 3.2.1.12>
[PID: 412][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1320][F:\软件\系统工具\System Repair Engineer(调整和修复系统) 2.0.12.350 RC1 绿色版\sreng2\SREng.exe] <Smallfrogs Studio><2.0.12.350>
[C:\WINDOWS\system32\VetRedir.dll] <Computer Associates International, Inc.><Version 8.0.8.0>
[C:\WINDOWS\system32\ISafeIf.dll] <Computer Associates International, Inc.><Version 8.0.8.0>

==================================
文件关联
.TXT Error. [notepad.exe %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI Error. [notepad.exe %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
CA ISafe LSP over [MSAFD Tcpip [TCP/IP]]
C:\WINDOWS\system32\VetRedir.dll(Computer Associates International, Inc., CA ISafe LSP DLL)
CA ISafe LSP over [MSAFD Tcpip [UDP/IP]]
C:\WINDOWS\system32\VetRedir.dll(Computer Associates International, Inc., CA ISafe LSP DLL)
CA ISafe LSP over [MSAFD Tcpip [RAW/IP]]
C:\WINDOWS\system32\VetRedir.dll(Computer Associates International, Inc., CA ISafe LSP DLL)
CA ISafe LSP
C:\WINDOWS\system32\VetRedir.dll(Computer Associates International, Inc., CA ISafe LSP DLL)

==================================

UFO不幸外人 - 2007-5-4 15:40:00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Kvsc3><; C:\WINDOWS\Kvsc3.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<shualai><; C:\WINDOWS\shualai.exe /i>
删除对应的注册表项目和文件

UFO不幸外人 - 2007-5-4 15:41:00

并删除那些猪头的文件，具体如果EXE文件都被感染，那么就要找mopery去处理，我不太会

KaKa老大 - 2007-5-4 15:42:00

<font size=4>另外还有个问题就是..用论坛提供的威金熊猫通用专杀工具..在没有感染病毒的盘中..exe文件会被修复吗..还是..不管exe文件有没有被感染都会去修复....因为我用了之后..发现本来一个软件可以进..但是用了这个软件之后..软件就进不去了...</font>

newcenturymoon - 2007-5-4 15:58:00

那些猪的文件打包压缩发给我密码 123

KaKa老大 - 2007-5-4 16:03:00

引用:

【newcenturymoon的贴子】那些猪的文件打包压缩发给我密码 123
………………

楼上的..坛子里有人有的话就帮发下吧,....我的已经被我删掉了...

再顺便问下楼上的兄弟..我下了那个威金熊猫番茄exe修复专杀..会不会把那些没有中毒的exe文件修改.啊....我好象杀了之后...就运行不了了

newcenturymoon - 2007-5-4 16:15:00

你没中熊猫威金或者番茄花园就不要乱用病毒感染exe的方式是不同的

瑞星卡卡安全论坛