带日记中病毒了高手进 bbs.ikaka.com

longlyer - 2008-11-27 12:32:00

附件: SREngLOG1.log (2008-11-27 12:32:05, 21.17 K)
该附件被下载次数 169

这几天电脑好像中病毒了,系统重做了没有用, 瑞星会提示进程C:\DOCUME~1\ADMINI~1\LOCALS~1\TEMP\634390触发了API类规则, 好像是木马可是杀不掉,请大家帮忙看下有的时候开机不到一会卡卡防护就自己消失了,用了完美下载有发现一个系统文件被替换掉了,好郁闷安全状态也杀不掉,请大家帮忙看下怎么杀掉

用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

longlyer - 2008-11-27 12:40:00

这个是金山的日记有没大哥能帮忙看出头绪啊

附件: Report1.txt

帅哥阿福 - 2008-11-27 12:43:00

典型的hbservice问题。
c:\windows\system32\System.exe
C:\Program Files\Internet Explorer\58u1NtMe.2ys
c:\windows\system32\drivers\CnsMinKP.sys
C:\WINDOWS\system32\b160485.sys
C:\WINDOWS\system32\d812a079.sys
C:\WINDOWS\system32\6457aed.sys
[C:\WINDOWS\system32\csrss.dll] [N/A, ]
[C:\WINDOWS\system32\sh01023.dll] [N/A, ]
[C:\WINDOWS\system32\sh03007.dll] [N/A, ]
[C:\WINDOWS\system32\sh05008.dll] [N/A, ]
[C:\WINDOWS\system32\sh14019.dll] [N/A, ]
[C:\WINDOWS\system32\sh15013.dll] [N/A, ]
[C:\WINDOWS\system32\sh18030.dll] [N/A, ]
[C:\WINDOWS\system32\sh23010.dll] [N/A, ]
[C:\WINDOWS\system32\5934EA2B.dll] [N/A, ]
[C:\WINDOWS\system32\56BC86C7.dll] [N/A, ]
[C:\WINDOWS\system32\950D1600.dll] [N/A, ]
[C:\WINDOWS\system32\122B901E.dll] [N/A, ]
[C:\WINDOWS\system32\DFB3DAC5.dll] [N/A, ]
[C:\WINDOWS\system32\14F7F80A.dll] [N/A, ]
[C:\WINDOWS\system32\DA63E650.dll] [N/A, ]
[C:\WINDOWS\system32\D7C79813.dll] [N/A, ]
[C:\WINDOWS\system32\08223B03.dll] [N/A, ]
[C:\WINDOWS\system32\39349BEE.dll] [N/A, ]
[C:\WINDOWS\system32\2EF0D734.dll] [N/A, ]
[C:\WINDOWS\system32\A1A6BC2E.dll] [N/A, ]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\5dcf.dll] [N/A, ]
[C:\WINDOWS\system32\HBDNF.dll] [N/A, ]
[C:\WINDOWS\system32\HBWOW.dll] [N/A, ]
[C:\WINDOWS\system32\HBXMJ.dll] [N/A, ]
[C:\WINDOWS\system32\HBJTLQ.dll] [N/A, ]
提交到这里，或者提交给瑞星，地址如下：http://mailcenter.rising.com.cn/index.shtml

backway - 2008-11-27 12:44:00

注册表

<HBService32><System.exe> []

<{D157330A-9EF3-49F8-9A67-4141AC41ADD4}><> [N/A]
<{5934EA2B-B2C4-4BE7-BF7A-FBA781A12E40}><5934EA2B.dll> []
<{950D1600-DE4A-448D-93B4-7BAE5A7A8052}><950D1600.dll> []
<{14F7F80A-0FE7-4A24-83CC-639D42BE410C}><14F7F80A.dll> []
<{34A25F04-008D-403E-8EE6-2307BC02FA2E}><34A25F04.dll> []
<{DA63E650-537C-4042-87BB-9D19D844680B}><DA63E650.dll> []
<{D7C79813-9233-4AE0-832C-99B2E8019673}><D7C79813.dll> []
<{08223B03-1B38-4A33-A83A-A4D3CC1D6E4E}><08223B03.dll> []
<{E0D39066-96D7-4891-8527-488ADAFCD60F}><E0D39066.dll> []
<{E4814792-EFA3-4C20-93D0-8B130A59F9A8}><E4814792.dll> []
<{06EA0A93-F850-4155-B819-BD0D9B5F25EE}><06EA0A93.dll> []
<{9CA963CA-107C-4089-B0AB-31380F90D7E3}><9CA963CA.dll> []
<{122B901E-493F-4AD9-BC69-7DE8C3E52FCC}><122B901E.dll> []
<{56BC86C7-0692-4F94-A2C1-6CF1DBF8096C}><56BC86C7.dll> []
<{DFB3DAC5-B0B5-4B05-BFCF-FB42737778FA}><DFB3DAC5.dll> []
<{39349BEE-BE43-47E4-8670-8B34570E112D}><39349BEE.dll> []
<{2EF0D734-21FD-4225-A1A2-BCD296182AAF}><2EF0D734.dll> []
<{A1A6BC2E-C6A1-43C1-8884-A31D772F42B8}><A1A6BC2E.dll> []

<{F6A454AE-156A-415E-9F89-3795677A8A91}><C:\Program Files\Internet Explorer\58u1NtMe.2ys> []

驱动程序
[CnsMinKP / CnsMinKP][Stopped/Boot Start]
<\SystemRoot\system32\drivers\CnsMinKP.sys><N/A>

[HBKernel32 Driver / HBKernel32][Stopped/Boot Start]
<\SystemRoot\system32\drivers\HBKernel32.sys><N/A>
[b160485 / b160485][Running/Manual Start]
<\??\C:\WINDOWS\system32\b160485.sys><N/A>
[aliimz / aliimz][Stopped/Manual Start]
<System32\Drivers\aliimz.sys><N/A>
[d812a079 / d812a079][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\d812a079.sys><N/A>
[6457aed / 6457aed][Running/Manual Start]
<\??\C:\WINDOWS\system32\6457aed.sys><N/A>

文件
[C:\WINDOWS\system32\csrss.dll] [N/A, ]
[C:\WINDOWS\system32\sh01023.dll] [N/A, ]
[C:\WINDOWS\system32\sh03007.dll] [N/A, ]
[C:\WINDOWS\system32\sh05008.dll] [N/A, ]
[C:\WINDOWS\system32\sh14019.dll] [N/A, ]
[C:\WINDOWS\system32\sh15013.dll] [N/A, ]
[C:\WINDOWS\system32\sh18030.dll] [N/A, ]

[C:\WINDOWS\system32\5934EA2B.dll] [N/A, ]
[C:\WINDOWS\system32\56BC86C7.dll] [N/A, ]
[C:\WINDOWS\system32\950D1600.dll] [N/A, ]
[C:\WINDOWS\system32\122B901E.dll] [N/A, ]
[C:\WINDOWS\system32\DFB3DAC5.dll] [N/A, ]
[C:\WINDOWS\system32\14F7F80A.dll] [N/A, ]
[C:\WINDOWS\system32\DA63E650.dll] [N/A, ]
[C:\WINDOWS\system32\D7C79813.dll] [N/A, ]
[C:\WINDOWS\system32\08223B03.dll] [N/A, ]
[C:\WINDOWS\system32\39349BEE.dll] [N/A, ]
[C:\WINDOWS\system32\2EF0D734.dll] [N/A, ]
[C:\WINDOWS\system32\A1A6BC2E.dll] [N/A, ]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\5dcf.dll] [N/A, ]

[C:\WINDOWS\system32\HBDNF.dll] [N/A, ]
[C:\WINDOWS\system32\HBWOW.dll] [N/A, ]
[C:\WINDOWS\system32\HBXMJ.dll] [N/A, ]
[C:\WINDOWS\system32\HBJTLQ.dll] [N/A, ]

[C:\WINDOWS\system32\cmdsame.dll] [N/A, ]
[C:\WINDOWS\system32\39349BEE.dll] [N/A, ]
[C:\WINDOWS\system32\2EF0D734.dll] [N/A, ]
[C:\WINDOWS\system32\34A25F04.dll] [N/A, ]
[C:\WINDOWS\system32\E0D39066.dll] [N/A, ]
[C:\WINDOWS\system32\E4814792.dll] [N/A, ]
[C:\WINDOWS\system32\06EA0A93.dll] [N/A, ]
[C:\WINDOWS\system32\9CA963CA.dll] [N/A, ]
[C:\WINDOWS\system32\A1A6BC2E.dll] [N/A, ]

rpcss.dll用正常文件覆盖。

longlyer - 2008-11-27 12:52:00

要崩溃了病毒也太猖狂了.有没有高手帮忙看看啊到底要怎么杀啊郁闷

帅哥阿福 - 2008-11-27 12:55:00

楼主看不到上面的回复吗？

longlyer - 2008-11-27 13:02:00

看了我向瑞星提交了日记给他们工程师了,还没回复这个问题严重吗?现在电脑防毒软件都被屏蔽了可能不是一个病毒还是木马我用AV终结者专杀查出来几个病毒但是杀不到好像会再生

kdfdj - 2008-11-27 13:02:00

注册表
<HBService32><System.exe> []
<nwiz><cmdsame.exe> []
<AppInit_DLLs><kmon.dll,HBDNF.dll,HBWOW.dll,HBXMJ.dll,HBJTLQ.dll,HBWD.dll> [(Verified)Beijing Rising Information Technology Corporation Limited]
这项把kmon.dll后清空修改后既为
<AppInit_DLLs><kmon.dll> [(Verified)Beijing Rising Information Technology Corporation Limited]
<{D157330A-9EF3-49F8-9A67-4141AC41ADD4}><> [N/A]
<{5934EA2B-B2C4-4BE7-BF7A-FBA781A12E40}><5934EA2B.dll> []
<{950D1600-DE4A-448D-93B4-7BAE5A7A8052}><950D1600.dll> []
<{14F7F80A-0FE7-4A24-83CC-639D42BE410C}><14F7F80A.dll> []
<{34A25F04-008D-403E-8EE6-2307BC02FA2E}><34A25F04.dll> []
<{DA63E650-537C-4042-87BB-9D19D844680B}><DA63E650.dll> []
<{D7C79813-9233-4AE0-832C-99B2E8019673}><D7C79813.dll> []
<{08223B03-1B38-4A33-A83A-A4D3CC1D6E4E}><08223B03.dll> []
<{E0D39066-96D7-4891-8527-488ADAFCD60F}><E0D39066.dll> []
<{E4814792-EFA3-4C20-93D0-8B130A59F9A8}><E4814792.dll> []
<{06EA0A93-F850-4155-B819-BD0D9B5F25EE}><06EA0A93.dll> []
<{9CA963CA-107C-4089-B0AB-31380F90D7E3}><9CA963CA.dll> []
<{122B901E-493F-4AD9-BC69-7DE8C3E52FCC}><122B901E.dll> []
<{56BC86C7-0692-4F94-A2C1-6CF1DBF8096C}><56BC86C7.dll> []
<{DFB3DAC5-B0B5-4B05-BFCF-FB42737778FA}><DFB3DAC5.dll> []
<{39349BEE-BE43-47E4-8670-8B34570E112D}><39349BEE.dll> []
<{2EF0D734-21FD-4225-A1A2-BCD296182AAF}><2EF0D734.dll> []
<{A1A6BC2E-C6A1-43C1-8884-A31D772F42B8}><A1A6BC2E.dll> []
<{F6A454AE-156A-415E-9F89-3795677A8A91}><C:\Program Files\Internet Explorer\58u1NtMe.2ys> []
驱动程序
[CnsMinKP / CnsMinKP][Stopped/Boot Start]
<\SystemRoot\system32\drivers\CnsMinKP.sys><N/A>
[HBKernel32 Driver / HBKernel32][Stopped/Boot Start]
<\SystemRoot\system32\drivers\HBKernel32.sys><N/A>
[b160485 / b160485][Running/Manual Start]
<\??\C:\WINDOWS\system32\b160485.sys><N/A>
[aliimz / aliimz][Stopped/Manual Start]
<System32\Drivers\aliimz.sys><N/A>
[d812a079 / d812a079][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\d812a079.sys><N/A>
[6457aed / 6457aed][Running/Manual Start]
<\??\C:\WINDOWS\system32\6457aed.sys><N/A>
正在运行的进程
[C:\WINDOWS\system32\A1A6BC2E.dll] [N/A,
[C:\WINDOWS\system32\HBDNF.dll] [N/A, ]
[C:\WINDOWS\system32\HBWOW.dll] [N/A, ]
[C:\WINDOWS\system32\HBXMJ.dll] [N/A, ]
[C:\WINDOWS\system32\HBJTLQ.dll] [N/A, ]
[C:\WINDOWS\system32\5934EA2B.dll] [N/A, ]
[C:\WINDOWS\system32\56BC86C7.dll] [N/A, ]
[C:\WINDOWS\system32\950D1600.dll] [N/A, ]
[C:\WINDOWS\system32\122B901E.dll] [N/A, ]
[C:\WINDOWS\system32\DFB3DAC5.dll] [N/A, ]
[C:\WINDOWS\system32\14F7F80A.dll] [N/A, ]
[C:\WINDOWS\system32\DA63E650.dll] [N/A, ]
[C:\WINDOWS\system32\D7C79813.dll] [N/A, ]
[C:\WINDOWS\system32\08223B03.dll] [N/A, ]
[C:\WINDOWS\system32\cmdsame.dll] [N/A, ]
[C:\WINDOWS\system32\39349BEE.dll] [N/A, ]
[C:\WINDOWS\system32\2EF0D734.dll] [N/A, ]
[C:\WINDOWS\system32\34A25F04.dll] [N/A, ]
[C:\WINDOWS\system32\E0D39066.dll] [N/A, ]
[C:\WINDOWS\system32\E4814792.dll] [N/A, ]
[C:\WINDOWS\system32\06EA0A93.dll] [N/A, ]
[C:\WINDOWS\system32\9CA963CA.dll] [N/A, ]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\5dcf.dll] [N/A, ]
从正常机拷rpcss.dll文件到本机替换

longlyer - 2008-11-27 13:08:00

郁闷大哥我家里就这一台电脑能把你的复制下给我用吗教我怎么弄感激不尽

天月来了 - 2008-11-27 13:31:00

我置顶木马群的贴看去

瑞星卡卡安全论坛