瑞星卡卡安全论坛
右手一只鸭 - 2007-6-11 21:37:00
中了这个恶心的热门病毒“诡秘下载器变种YRE”，系统盘重装都没有用，凡是有关杀毒的网站和软件一个都进不去，到底怎么办啊？难道真的要全部都格式化吗？
哪位高人指教一下啊，谢谢！
gerrychen - 2007-6-11 21:51:00
看看我的Trojan系列病毒的帖子,不知道对你有没有帮助
右手一只鸭 - 2007-6-11 21:53:00
哦，谢谢
右手一只鸭 - 2007-6-11 22:15:00
高手再过来帮我看看啊！急
spiritfire - 2007-6-11 22:29:00
http://download.kztechs.com/files/sreng2.zip
上面这个链接下载SREng，
关闭不必要的程序，运行SREng.exe，“智能扫描”－“保存报告”，
分段贴上来！
PS:SRE运行不了的话,改名运行!
rainyj - 2007-6-11 22:29:00
现在瑞星可以杀了！
我刚帮别人杀了！
右手一只鸭 - 2007-6-12 7:22:00
[CODE]
2007-06-11,23:08:11
System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 1 (Build 2600) - 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
右手一只鸭 - 2007-6-12 7:22:00
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><; C:\WINDOWS\System32\ctfmon.exe> [(Verified)Microsoft Windows XP Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<tgiqbee><C:\Program Files\Common Files\System\jgnlkpy.exe> []
<skrmejg><C:\Program Files\Common Files\Microsoft Shared\kplqtjg.exe> []
<MSConfig><C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto> [(Verified)Microsoft Windows XP Publisher]
<Cmaudio><; RunDll32 cmicnfg.cpl,CMICtrlWnd> [N/A]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows XP Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
右手一只鸭 - 2007-6-12 7:23:00
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><; C:\WINDOWS\System32\ctfmon.exe> [(Verified)Microsoft Windows XP Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<tgiqbee><C:\Program Files\Common Files\System\jgnlkpy.exe> []
<skrmejg><C:\Program Files\Common Files\Microsoft Shared\kplqtjg.exe> []
<MSConfig><C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto> [(Verified)Microsoft Windows XP Publisher]
<Cmaudio><; RunDll32 cmicnfg.cpl,CMICtrlWnd> [N/A]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows XP Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
右手一只鸭 - 2007-6-12 7:24:00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<Cmaudio><; RunDll32 cmicnfg.cpl,CMICtrlWnd> [N/A]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><; C:\WINDOWS\System32\ctfmon.exe> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows XP Publisher]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<MsnMsgr><; "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<PHIME2002A><; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows XP Publisher]
<PHIME2002ASync><; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows XP Publisher]
<skrmejg><; C:\Program Files\Common Files\Microsoft Shared\kplqtjg.exe> []
<tgiqbee><; C:\Program Files\Common Files\System\jgnlkpy.exe> []
<UserFaultCheck><; %systemroot%\system32\dumprep 0 -u> [N/A]
右手一只鸭 - 2007-6-12 7:24:00
启动文件夹
N/A
==================================
服务
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\System32\mspmsnsv.dll><Microsoft Corporation>
右手一只鸭 - 2007-6-12 7:25:00
驱动程序
[C-Media WDM Audio Interface / cmuda][Stopped/Manual Start]
<system32\drivers\cmuda.sys><C-Media Inc>
[nv / nv][Running/Manual Start]
<System32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
<System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<System32\DRIVERS\secdrv.sys><N/A>
右手一只鸭 - 2007-6-12 7:25:00
浏览器加载项
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>
[WangWangObj Class]
{6E213FC7-DD5A-4115-B7E6-D4C7838C361E} <D:\Program Files\Alisoft\WangWang\WangWangX4.dll, 阿里软件（中国）有限公司>
右手一只鸭 - 2007-6-12 7:26:00
正在运行的进程
[PID: 416][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 480][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 504][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[PID: 548][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 560][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 720][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 772][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 876][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 892][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1160][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
右手一只鸭 - 2007-6-12 7:26:00
[PID: 1192][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[PID: 1340][C:\Program Files\Common Files\System\jgnlkpy.exe] [N/A, ]
[PID: 1348][C:\Program Files\Common Files\Microsoft Shared\kplqtjg.exe] [N/A, ]
[PID: 1412][C:\WINDOWS\System32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 1352][D:\Program Files\Tencent\QQ\TIMPlatform.exe] [TENCENT, 7,0,225,1651]
[D:\Program Files\Tencent\QQ\TIMProxy.dll] [tencent, 0, 3, 2, 4]
[PID: 988][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\System32\Macromed\Flash\Flash9c.ocx] [Adobe Systems, Inc., 9,0,45,0]
[C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[PID: 1112][D:\Program Files\Tencent\QQ\QQ.exe] [TENCENT, 7,0,225,1651]
[D:\Program Files\Tencent\QQ\QQBaseClassInDll.dll] [TENCENT, 7,0,225,1651]
[D:\Program Files\Tencent\QQ\QQHelperDll.dll] [TENCENT, 7,0,225,1651]
[D:\Program Files\Tencent\QQ\BasicCtrlDll.dll] [TENCENT, 7, 0, 225, 1651]
[D:\Program Files\Tencent\QQ\MFC42.DLL] [Microsoft Corporation, 6.00.8665.0]
[D:\Program Files\Tencent\QQ\RICHED32.DLL] [Microsoft Corporation, 5.00.2134.1]
右手一只鸭 - 2007-6-12 7:27:00
[D:\Program Files\Tencent\QQ\RICHED20.dll] [Microsoft Corporation, 5.31.23.1218]
[D:\Program Files\Tencent\QQ\QQAPI.dll] [TENCENT, 7,0,225,1651]
[D:\Program Files\Tencent\QQ\TIMProxy.dll] [tencent, 0, 3, 2, 4]
[D:\Program Files\Tencent\QQ\LoginCtrl.dll] [TENCENT, 7,0,225,1651]
[D:\Program Files\Tencent\QQ\LoginCtrlRes.dll] [TENCENT, 7,0,225,1651]
[D:\Program Files\Tencent\QQ\QQRes.dll] [TENCENT, 7,0,225,1651]
[D:\Program Files\Tencent\QQ\MailSummary.dll] [TENCENT, 7,0,225,1651]
[D:\Program Files\Tencent\QQ\QQMainFrame.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\gdiplus.dll] [Microsoft Corporation, 5.1.3102.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\Program Files\Tencent\QQ\CQQApplication.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\FlashAvatarDll.dll] [, 1, 4, 0, 1]
[D:\Program Files\Tencent\QQ\NewSkin.dll] [TENCENT, 7,0,225,1651]
[D:\Program Files\Tencent\QQ\HostingMgr.dll] [TENCENT, 7,0,225,1651]
[D:\Program Files\Tencent\QQ\CameraDll.dll] [TENCENT, 7,0,225,1651]
[D:\Program Files\Tencent\QQ\QQKnowledgeSearch.dll] [TENCENT, 7,0,225,1651]
[D:\Program Files\Tencent\QQ\QQAllInOne.dll] [TENCENT, 7,0,225,1651]
[D:\Program Files\Tencent\QQ\SCCore.dll] [TENCENT, 1, 6, 0, 2]
[D:\Program Files\Tencent\QQ\QQSpace.dll] [TENCENT, 7,0,225,1651]
[D:\Program Files\Tencent\QQ\vbscript.dll] [Microsoft Corporation, 5.6.0.7426]
[C:\WINDOWS\System32\msdmo.dll] [, ]
[D:\Program Files\Tencent\QQ\QQGroupMng.dll] [TENCENT, 7,0,225,1651]
右手一只鸭 - 2007-6-12 7:27:00
[D:\Program Files\Tencent\QQ\QQSysMsgMng.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\UserDefinedHead.dll] [TENCENT, 7,0,225,1651]
[D:\Program Files\Tencent\QQ\QQPlugin.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\QQConfigPlugin.dll] [TENCENT, 7,0,225,1651]
[D:\Program Files\Tencent\QQ\QQAvatar.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\QRingMng.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\LongConnection.dll] [TENCENT, 7,0,225,1651]
[D:\Program Files\Tencent\QQ\PhoneAPI.dll] [TENCENT, 7,0,225,1651]
[D:\Program Files\Tencent\QQ\DialerAllinOne.dll] [tencent, 1, 4, 0, 0]
[C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[D:\Program Files\Tencent\QQ\QQPet.dll] [TENCENT, 7,0,225,1651]
[D:\Program Files\Tencent\QQ\BQQApplication.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\QQCustomFace.dll] [N/A, ]
[D:\Program Files\Tencent\QQ\ImageOle.dll] [TENCENT, 7,0,225,1651]
[D:\Program Files\Tencent\QQ\QQLiveQMng.dll] [TENCENT, 7,0,225,1651]
[D:\Program Files\Tencent\QQ\QQMagicFace.dll] [TENCENT, 7,0,225,1651]
[D:\Program Files\Tencent\QQ\QQSceneMng.dll] [N/A, ]
右手一只鸭 - 2007-6-12 7:28:00
[C:\WINDOWS\System32\Macromed\Flash\Flash9c.ocx] [Adobe Systems, Inc., 9,0,45,0]
[D:\Program Files\Tencent\QQ\QQFileTransfer.dll] [TENCENT, 7,0,225,1651]
[D:\Program Files\Tencent\QQ\CommercesMng.dll] [TENCENT, 7,0,225,1651]
[D:\Program Files\Tencent\QQ\PersonalDesktop.dll] [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2]
[D:\Program Files\Tencent\QQ\QQAddr.dll] [深圳市腾讯计算机系统有限公司, 5, 0, 101, 300]
[D:\Program Files\Tencent\QQ\QQPhoneHelper.dll] [腾讯科技（深圳）有限公司, 2, 1, 9, 93]
[PID: 912][C:\WINDOWS\System32\conime.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 1560][C:\Documents and Settings\zzz\桌面\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
右手一只鸭 - 2007-6-12 7:28:00
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
[D:\]
[AutoRun]
open=skrmejg.exe
shell\open=打开(&O)
shell\open\Command=skrmejg.exe
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=skrmejg.exe
[E:\]
[AutoRun]
open=skrmejg.exe
shell\open=打开(&O)
shell\open\Command=skrmejg.exe
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=skrmejg.exe
右手一只鸭 - 2007-6-12 7:28:00
HOSTS 文件
127.0.0.1 localhost
==================================
API HOOK
N/A
==================================
隐藏进程
N/A
==================================
[/CODE]
右手一只鸭 - 2007-6-12 7:29:00
谁可以给个专杀工具啊！
天月来了 - 2007-6-12 7:53:00
用扫日志的SRENG工具删除下面注册表项。
启动项目
注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<tgiqbee><C:\Program Files\Common Files\System\jgnlkpy.exe> []
<skrmejg><C:\Program Files\Common Files\Microsoft Shared\kplqtjg.exe> []
用冰刃删除文件。(或者重启电脑，用WinRAR打开相应文件夹，删除文件）
C:\Program Files\Common Files\System\jgnlkpy.exe
C:\Program Files\Common Files\Microsoft Shared\kplqtjg.exe
用WinRAR打开各磁盘，删除根目录下的文件：
Autorun.inf
skrmejg.exe
哪里诡秘哦！！！标题真吓人
右手一只鸭 - 2007-6-13 0:12:00
谢谢！高人我成功杀毒了！
1
© 2000 - 2026 Rising Corp. Ltd.