7月8日日志分析练习3 bbs.ikaka.com

lqqk7 - 2009-7-8 10:25:00

即日起每日会给大家提供一些染毒环境的SREng日志，因为部分实习生是第一次接触SREng这个工具，对日志分析不熟悉，如果冒然跑去反病毒区回帖，一旦出现误判，可能对求助者不利，因此采用这种“内部”交流的方式，希望大家能够多练习，真正分析日志的方法是靠自己实践摸索出来的！

注：日志分析练习情况与大家的实习期总成绩没有关联，请大家不要有顾虑，放心大胆的练习！

附件: 您所在的用户组无法下载或查看附件

========以下为参考分析结果========
异常项见附件（仅保留日志中可疑度较高的项）

注意：
1、C:\WINDOWS\system32\COMRes.dll 缺少版本信息，应该是被病毒修改（替换）过的，不要直接删除，要从相同的系统中拷贝一个过来；

附件: 您所在的用户组无法下载或查看附件

天月来了 - 2009-7-8 10:58:00

又一个时间没了:kaka6:

lqqk7 - 2009-7-8 11:20:00

引用:

原帖由 天月来了 于 2009-7-8 10:58:00 发表
又一个时间没了:kaka6:

嗯，有的日志不是本论坛的，在别的论坛看到就直接复制下来了，好像有人就喜欢从System Repair Engineer 2.7.1.1261这一行来贴日志

菠萝味咖啡 - 2009-7-8 11:26:00

删除以下文件
C:\WINDOWS\system32\56BC86C7.dll
C:\WINDOWS\system32\ACg9ycsarj8y.dll
C:\WINDOWS\system32\yp77Tt3UCG74J.dll
C:\WINDOWS\system32\JBn2ypqY23vWX.dll
C:\WINDOWS\system32\704C3595.dll
C:\WINDOWS\system32\08223B03.dll
C:\WINDOWS\system32\VnTU2WAqUcZA6.dll
C:\WINDOWS\system32\CCCA2FB9.dll
C:\WINDOWS\system32\efc0c52cc1.dll
重启后使用SREng修复以下各项
<{AEB6717E-7E19-11d0-97EE-00C04FD91972}><shell32.dll> [(Verified)Microsoft Windows Component Publisher]
<{56BC86C7-0692-4F94-A2C1-6CF1DBF8096C}><C:\WINDOWS\system32\56BC86C7.dll> []
<{6B74576A-BB20-47B3-AE0A-046B062897D0}><C:\WINDOWS\system32\ACg9ycsarj8y.dll> []
<{E88AE11C-26DF-4F4D-8726-C043F513990E}><C:\WINDOWS\system32\yp77Tt3UCG74J.dll> []
<{A23CA53C-731F-4033-92E8-C1DFB4E71D34}><C:\WINDOWS\system32\JBn2ypqY23vWX.dll> []
<{704C3595-DB85-40F6-A601-8D6F346907BD}><C:\WINDOWS\system32\704C3595.dll> []
<{08223B03-1B38-4A33-A83A-A4D3CC1D6E4E}><C:\WINDOWS\system32\08223B03.dll> []
<{0D267113-499A-4EEF-998D-C45731C1B313}><C:\WINDOWS\system32\VnTU2WAqUcZA6.dll> []
<{CCCA2FB9-2D5D-4481-8BFE-1CDDC458A3F4}><C:\WINDOWS\system32\CCCA2FB9.dll> []
<{028A997C-4262-4107-BD46-2ABBC6143E8C}><C:\WINDOWS\system32\efc0c52cc1.dll> []

gtyre2 - 2009-7-8 11:30:00

handle - 2009-7-8 13:26:00

<{56BC86C7-0692-4F94-A2C1-6CF1DBF8096C}><C:\WINDOWS\system32\56BC86C7.dll> []
<{6B74576A-BB20-47B3-AE0A-046B062897D0}><C:\WINDOWS\system32\ACg9ycsarj8y.dll> []
<{E88AE11C-26DF-4F4D-8726-C043F513990E}><C:\WINDOWS\system32\yp77Tt3UCG74J.dll> []
<{A23CA53C-731F-4033-92E8-C1DFB4E71D34}><C:\WINDOWS\system32\JBn2ypqY23vWX.dll> []
<{704C3595-DB85-40F6-A601-8D6F346907BD}><C:\WINDOWS\system32\704C3595.dll> []
<{08223B03-1B38-4A33-A83A-A4D3CC1D6E4E}><C:\WINDOWS\system32\08223B03.dll> []
<{0D267113-499A-4EEF-998D-C45731C1B313}><C:\WINDOWS\system32\VnTU2WAqUcZA6.dll> []
<{CCCA2FB9-2D5D-4481-8BFE-1CDDC458A3F4}><C:\WINDOWS\system32\CCCA2FB9.dll> []
<{028A997C-4262-4107-BD46-2ABBC6143E8C}><C:\WINDOWS\system32\efc0c52cc1.dll> []

[C:\WINDOWS\system32\COMRes.dll] [N/A, ]
[C:\WINDOWS\fonts\GTH01535.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH02535.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH12541.TTF] [N/A, ]
[C:\WINDOWS\fonts\GTH19535.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH26535.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH30541.TTF] [N/A, ]
[C:\WINDOWS\fonts\GTH33541.TTF] [N/A, ]
[C:\WINDOWS\fonts\GTH36526.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH39541.TTF] [N/A, ]
[C:\WINDOWS\fonts\GTH61386.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH63380.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH64380.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH67380.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH72386.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH78380.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH90373.ttf] [N/A, ]

发现现在越来越多的病毒喜欢往fonts里面插东西.....
不知道病毒的主文件藏在哪~估计光删除以上东西没法解决问题~还请老师明示

merrk_chuan - 2009-7-8 13:48:00

幽灵楠 - 2009-7-8 14:29:00

基牛 - 2009-7-8 14:35:00

C:\WINDOWS\system32\56BC86C7.dll
C:\WINDOWS\system32\ACg9ycsarj8y.dll
C:\WINDOWS\system32\yp77Tt3UCG74J.dll
C:\WINDOWS\system32\JBn2ypqY23vWX.dll
C:\WINDOWS\system32\704C3595.dll
C:\WINDOWS\system32\08223B03.dll
C:\WINDOWS\system32\VnTU2WAqUcZA6.dll
C:\WINDOWS\system32\CCCA2FB9.dll
C:\WINDOWS\system32\efc0c52cc1.dll
删除之
[C:\WINDOWS\system32\efc0c52cc1.dll] [N/A, ]
[C:\WINDOWS\system32\CCCA2FB9.dll] [N/A, ]
[C:\WINDOWS\system32\08223B03.dll] [N/A, ]
[C:\WINDOWS\system32\704C3595.dll] [N/A, ]
[C:\WINDOWS\system32\JBn2ypqY23vWX.dll] [N/A, ]
[C:\WINDOWS\system32\yp77Tt3UCG74J.dll] [N/A, ]
[C:\WINDOWS\system32\56BC86C7.dll] [N/A, ]
删除之
[C:\WINDOWS\system32\efc0c52cc1.dll] [N/A, ]
[C:\WINDOWS\system32\CCCA2FB9.dll] [N/A, ]
[C:\WINDOWS\system32\08223B03.dll] [N/A, ]
[C:\WINDOWS\system32\704C3595.dll] [N/A, ]
[C:\WINDOWS\system32\JBn2ypqY23vWX.dll] [N/A, ]
[C:\WINDOWS\system32\yp77Tt3UCG74J.dll] [N/A, ]
[C:\WINDOWS\system32\56BC86C7.dll] [N/A, ]
删除之
C:\WINDOWS\system32\regedit23.exe
病毒
C:\WINDOWS\system32\efc0c52cc1.dll] [N/A, ]
[C:\WINDOWS\system32\CCCA2FB9.dll] [N/A, ]
[C:\WINDOWS\system32\08223B03.dll] [N/A, ]
[C:\WINDOWS\system32\704C3595.dll] [N/A, ]
[C:\WINDOWS\system32\JBn2ypqY23vWX.dll] [N/A, ]
[C:\WINDOWS\system32\yp77Tt3UCG74J.dll] [N/A, ]
[C:\WINDOWS\system32\56BC86C7.dll] [N/A, ]
[C:\WINDOWS\system32\ACg9ycsarj8y.dll] [N/A, ]
C:\WINDOWS\system32\VnTU2WAqUcZA6.dll
删除之
[C:\WINDOWS\system32\efc0c52cc1.dll] [N/A, ]
[C:\WINDOWS\system32\CCCA2FB9.dll] [N/A, ]
[C:\WINDOWS\system32\08223B03.dll] [N/A, ]
[C:\WINDOWS\system32\704C3595.dll] [N/A, ]
[C:\WINDOWS\system32\JBn2ypqY23vWX.dll] [N/A, ]
[C:\WINDOWS\system32\yp77Tt3UCG74J.dll] [N/A, ]
[C:\WINDOWS\system32\56BC86C7.dll] [N/A, ]
[C:\WINDOWS\system32\ACg9ycsarj8y.dll] [N/A, ]
C:\WINDOWS\system32\VnTU2WAqUcZA6.dll
[C:\WINDOWS\system32\efc0c52cc1.dll] [N/A, ]
[C:\WINDOWS\system32\CCCA2FB9.dll] [N/A, ]
[C:\WINDOWS\system32\08223B03.dll] [N/A, ]
[C:\WINDOWS\system32\704C3595.dll] [N/A, ]
[C:\WINDOWS\system32\JBn2ypqY23vWX.dll] [N/A, ]
[C:\WINDOWS\system32\yp77Tt3UCG74J.dll] [N/A, ]
[C:\WINDOWS\system32\56BC86C7.dll] [N/A, ]
[C:\WINDOWS\system32\ACg9ycsarj8y.dll] [N/A, ]
C:\WINDOWS\system32\efc0c52cc1.dll] [N/A, ]
[C:\WINDOWS\system32\CCCA2FB9.dll] [N/A, ]
[C:\WINDOWS\system32\08223B03.dll] [N/A, ]
[C:\WINDOWS\system32\704C3595.dll] [N/A, ]
[C:\WINDOWS\system32\JBn2ypqY23vWX.dll] [N/A, ]
[C:\WINDOWS\system32\yp77Tt3UCG74J.dll] [N/A, ]
[C:\WINDOWS\system32\56BC86C7.dll] [N/A, ]
[C:\WINDOWS\system32\ACg9ycsarj8y.dll] [N/A, ]
[C:\WINDOWS\system32\VnTU2WAqUcZA6.dll] [N/A, ]
感觉自己查的地方咋这么多

daemonz - 2009-7-8 15:40:00

删除这些应该就可以了吧
C:\WINDOWS\system32\regedit23.exe （这个太狠了，考眼力）
[C:\WINDOWS\system32\COMRes.dll] [N/A, ]
[C:\WINDOWS\fonts\GTH01535.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH02535.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH12541.TTF] [N/A, ]
[C:\WINDOWS\fonts\GTH19535.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH26535.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH30541.TTF] [N/A, ]
[C:\WINDOWS\fonts\GTH33541.TTF] [N/A, ]
[C:\WINDOWS\fonts\GTH36526.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH39541.TTF] [N/A, ]
[C:\WINDOWS\fonts\GTH61386.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH63380.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH64380.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH67380.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH72386.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH78380.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH90373.ttf] [N/A, ]
[C:\WINDOWS\system32\56BC86C7.dll] [N/A, ]
[C:\WINDOWS\system32\ACg9ycsarj8y.dll] [N/A, ]
[C:\WINDOWS\system32\yp77Tt3UCG74J.dll] [N/A, ]
[C:\WINDOWS\system32\JBn2ypqY23vWX.dll] [N/A, ]
[C:\WINDOWS\system32\704C3595.dll] [N/A, ]
[C:\WINDOWS\system32\08223B03.dll] [N/A, ]
[C:\WINDOWS\system32\VnTU2WAqUcZA6.dll] [N/A, ]
[C:\WINDOWS\system32\CCCA2FB9.dll] [N/A, ]
[C:\WINDOWS\system32\efc0c52cc1.dll] [N/A, ]

凡尘之沙 - 2009-7-8 15:49:00

C:\WINDOWS\system32\yp77Tt3UCG74J.dll

C:\WINDOWS\System32\svchost.exe -k netsvcs-->%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll
[/hide]

零度的穷浪漫 - 2009-7-9 6:25:00

这些练习是需要做什么呀？回复之后按照显示的内容进行操作还是怎么的？

精神病院看门的 - 2009-7-10 16:19:00

该用户帖子内容已被屏蔽

学飞的龙 - 2009-7-13 16:39:00

lqqk7 老师提出的
注意：
1、C:\WINDOWS\system32\COMRes.dll 缺少版本信息，应该是被病毒修改（替换）过的，不要直接删除，要从相同的系统中拷贝一个过来；

附件: 参考.log (2009-7-13 15:08:51, 17.29 K)
该附件被下载次数 1

那个C:\WINDOWS\system32\COMRes.dll 文件怎么在日志中找不到呢，是不是错了？

still刀刀 - 2009-7-14 12:57:00

启动项目
注册表

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

<{56BC86C7-0692-4F94-A2C1-6CF1DBF8096C}><C:\WINDOWS\system32\56BC86C7.dll> []
<{6B74576A-BB20-47B3-AE0A-046B062897D0}><C:\WINDOWS\system32\ACg9ycsarj8y.dll> []
<{E88AE11C-26DF-4F4D-8726-C043F513990E}><C:\WINDOWS\system32\yp77Tt3UCG74J.dll> []
<{A23CA53C-731F-4033-92E8-C1DFB4E71D34}><C:\WINDOWS\system32\JBn2ypqY23vWX.dll> []
<{704C3595-DB85-40F6-A601-8D6F346907BD}><C:\WINDOWS\system32\704C3595.dll> []
<{08223B03-1B38-4A33-A83A-A4D3CC1D6E4E}><C:\WINDOWS\system32\08223B03.dll> []
<{0D267113-499A-4EEF-998D-C45731C1B313}><C:\WINDOWS\system32\VnTU2WAqUcZA6.dll> []
<{CCCA2FB9-2D5D-4481-8BFE-1CDDC458A3F4}><C:\WINDOWS\system32\CCCA2FB9.dll> []
<{028A997C-4262-4107-BD46-2ABBC6143E8C}><C:\WINDOWS\system32\efc0c52cc1.dll> []

<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [File is missing]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [File is missing]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [File is missing]

<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [File is missing]

<PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [File is missing]
<PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [File is missing]

服务
[KVSrvXP / KVSrvXP][Stopped/Auto Start]
<C:\Program Files\JiangMin\AntiVirus\kvsrvxp.exe /Service><(File is missing)>

==================================
驱动程序

[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[AmdK8 Compatible Device / AmdK8][Stopped/Manual Start]
<System32\drivers\amdk8.sys><Advanced Micro Devices>
[CSB6IDE / CSB6IDE][Running/Boot Start]
<\SystemRoot\System32\Drivers\csb6ide.sys><ServerWorks Corporation>
[FASTTRAK / FASTTRAK][Running/Boot Start]
<\SystemRoot\System32\Drivers\fasttrak.sys><Promise Technology, Inc.>
[VIA Rhine Family Fast Ethernet Adapter Driver Service / FETNDISB][Stopped/Manual Start]
<system32\DRIVERS\fetnd5b.sys><VIA Technologies, Inc.>
[FTSATA2 / FTSATA2][Running/Boot Start]
<\SystemRoot\System32\Drivers\ftsata2.sys><Promise Technology, Inc.>
[IASTOR / IASTOR][Running/Boot Start]
<\SystemRoot\System32\Drivers\iaStor.sys><Intel Corporation>
[ITERAID / ITERAID][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\iteraid.sys><Integrated Technology Express, Inc.>
[JRAID / JRAID][Running/Boot Start]
<\SystemRoot\System32\Drivers\JRAID.SYS><JMicron Technology Corp.>
[KAnalyser / KAnalyser][Stopped/System Start]
<\??\C:\PROGRA~1\JiangMin\ANTIVI~1\KANALY~1.SYS><Jiangmin Co.,Ltd.>
[KPGuard / KPGuard][Running/System Start]
<\??\C:\PROGRA~1\JiangMin\ANTIVI~1\KPGuard.sys><Jiangmin Co., Ltd.>
[KRegEx / KRegEx][Running/System Start]
<\??\C:\PROGRA~1\JiangMin\ANTIVI~1\KRegEx.sys><Jiangmin Co. Ltd.>
[Jiangmin Antivirus Software / KSysCall][Running/System Start]
<\??\C:\PROGRA~1\JiangMin\common\KSysCall.sys><Jiangmin Co., Ltd.>
[KSysFilter / KSysFilter][Running/Boot Start]
<\SystemRoot\System32\Drivers\KSysFilt.sys><Jiangmin Co. Ltd.>
[KSysMon / KSysMon][Running/System Start]
<\??\C:\PROGRA~1\JiangMin\ANTIVI~1\KSysMon.sys><Jiangmin Co. Ltd.>
[KVDP / KVDP][Stopped/Manual Start]
<\??\C:\Program Files\JiangMin\AntiVirus\KVDP.sys><Jiangmin Co., Ltd.>
[KVRedir / KVRedir][Running/System Start]
<\??\C:\Program Files\JiangMin\AntiVirus\KVREDIR.SYS><Jiangmin Co., Ltd.>
[M5228 / M5228][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\m5228.sys><ALi Corporation.>
[M5281 / M5281][Running/Boot Start]
<\SystemRoot\System32\Drivers\m5281.sys><ALi Corporation>
[M5289 / M5289][Running/Boot Start]
<\SystemRoot\System32\Drivers\m5289.sys><ULi Electronics Inc.>
[npkcrypt / npkcrypt][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\npkcrypt.sys><INCA Internet Co., Ltd.>
[nv / nv][Running/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[NVATABUS / NVATABUS][Running/Boot Start]
<\SystemRoot\System32\Drivers\NVATABUS.SYS><NVIDIA Corporation>
[NVRAID / NVRAID][Running/Boot Start]
<\SystemRoot\System32\Drivers\NVRAID.SYS><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek 10/100/1000 PCI NIC Family NDIS XP Driver / RTL8023xp][Running/Manual Start]
<system32\DRIVERS\Rtnicxp.sys><Realtek Semiconductor Corporation>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[SafeBoxKrnl / SafeBoxKrnl][Running/System Start]
<\??\C:\WINDOWS\system32\Drivers\safeboxkrnl.sys><360安全中心>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
[SI3112R / SI3112R][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\SI3112r.sys><Silicon Image, Inc>
[SI3114R / SI3114R][Stopped/Boot Start]
<\SystemRoot\SYSTEM32\Drivers\SI3114R.sys><Silicon Image, Inc>
[SI3114R5 / SI3114R5][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\Si3114r5.sys><Silicon Image, Inc>
[SI3124 / SI3124][Stopped/Boot Start]
<\SystemRoot\SYSTEM32\Drivers\SI3124.sys><Silicon Image, Inc.>
[SI3124R / SI3124R][Stopped/Boot Start]
<\SystemRoot\SYSTEM32\Drivers\SI3124R.sys><Silicon Image, Inc>
[SI3124R5 / SI3124R5][Stopped/Boot Start]
<\SystemRoot\SYSTEM32\Drivers\Si3124r5.sys><Silicon Image, Inc>
[SI3132 / SI3132][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\SI3132.sys><Silicon Image, Inc.>
[SI3132R5 / SI3132R5][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\Si3132r5.sys><Silicon Image, Inc>
[SISRAID2 / SISRAID2][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\SiSRaid2.sys><Silicon Integrated Systems Corp>
[SISRAID4 / SISRAID4][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\SiSRaid4.sys><Silicon Integrated Systems>
[SYMMPI / SYMMPI][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\symmpi.sys><LSI Logic>
[sym_hi / sym_hi][Running/Boot Start]
<\SystemRoot\System32\Drivers\sym_hi.sys><LSI Logic>
[sym_u3 / sym_u3][Running/Boot Start]
<\SystemRoot\System32\Drivers\sym_u3.sys><LSI Logic>
[TCP/IP Protocol Driver / Tcpip][Running/System Start]
<system32\DRIVERS\tcpip.sys><Microsoft Corporation>
[ULSATA / ULSATA][Running/Boot Start]
<\SystemRoot\System32\Drivers\ulsata.sys><Promise Technology, Inc.>
[ULSATA2 / ULSATA2][Running/Boot Start]
<\SystemRoot\System32\Drivers\ulsata2.sys><Promise Technology, Inc.>
[VIAMRAID / VIAMRAID][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\viamraid.sys><VIA Technologies inc,.ltd>
[VMware Pointing Device / vmmouse][Running/Manual Start]
<system32\DRIVERS\vmmouse.sys><VMware, Inc.>
[vmscsi / vmscsi][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\vmscsi.sys><VMware, Inc.>

==================================
浏览器加载项
>
[]
{06A70D58-8D40-49DD-B46B-DC00AA3ADCA4} <, >
[]
{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <, >

[]
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} <, >

[]
{8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} <, >
[]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <, >
[]
{FB5F1910-F110-11D2-BB9E-00C04F795683} <, >没有公司信息没有加载项名称感觉还是存在问题

==================================
正在运行的进程
[
[PID: 588 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[C:\WINDOWS\system32\COMRes.dll] [N/A, ]
[C:\WINDOWS\fonts\GTH01535.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH02535.TTf] [N/A, ]

[E:\迅雷\Thunder\Program\TaskManager.dll] [Thunder Networking Technologies,LTD, 1, 3, 9, 71]
[E:\迅雷\Thunder\Program\download_interface.dll] [Thunder Networking Technologies,LTD, 3, 100, 2, 322]
[E:\迅雷\Thunder\Program\mp.dll] [Thunder Networking Technologies,LTD, 1, 0, 2, 2]
[E:\迅雷\Thunder\Program\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[E:\迅雷\Thunder\Program\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[E:\迅雷\Thunder\Program\asyn_frame.dll] [Thunder Networking Technologies,LTD, 1, 2, 2, 25]
[E:\迅雷\Thunder\Program\ATL71.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\fonts\GTH01535.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH02535.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH12541.TTF] [N/A, ]
[C:\WINDOWS\fonts\GTH19535.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH26535.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH30541.TTF] [N/A, ]
[C:\WINDOWS\fonts\GTH33541.TTF] [N/A, ]
[C:\WINDOWS\fonts\GTH36526.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH39541.TTF] [N/A, ]
[C:\WINDOWS\fonts\GTH61386.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH63380.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH64380.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH67380.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH72386.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH78380.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH90373.ttf] [N/A, ]
[E:\迅雷\Thunder\Program\fs.dll] [Thunder Networking Technologies,LTD, 1, 1, 2, 12]
[E:\迅雷\Thunder\Program\XLNet.Dll] [Thunder Networking Technologies,LTD, 1, 5, 2, 25]
[E:\迅雷\Thunder\Program\BHOStub.dll] [Thunder Networking Technologies,LTD, 1, 1, 1, 10]
[E:\迅雷\Thunder\Components\DownAndPlay\DownAndPlay.dll] [, 1, 0, 12, 30]
[E:\迅雷\Thunder\Program\backend_agent.dll] [Thunder Networking Technologies,LTD, 1, 2, 2, 24]
[E:\迅雷\Thunder\Program\zlib1.dll] [, 1.2.3]
[C:\WINDOWS\system32\efc0c52cc1.dll] [N/A, ]
[C:\WINDOWS\system32\CCCA2FB9.dll] [N/A, ]
[C:\WINDOWS\system32\08223B03.dll] [N/A, ]
[C:\WINDOWS\system32\704C3595.dll] [N/A, ]
[C:\WINDOWS\system32\JBn2ypqY23vWX.dll] [N/A, ]
[C:\WINDOWS\system32\yp77Tt3UCG74J.dll] [N/A, ]
[C:\WINDOWS\system32\56BC86C7.dll] [N/A, ]
[C:\WINDOWS\system32\ACg9ycsarj8y.dll] [N/A, ]

[PID: 2340 / Administrator][I:\安装包\SREng\SREngLdr.EXE] [Smallfrogs Studio, 2.7.1.1261]
[PID: 3520 / Administrator][I:\安装包\SREng\SRE46903132.EXE] [Smallfrogs Studio, 2.7.1.1261]
[C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\COMRes.dll] [N/A, ]
[C:\WINDOWS\system32\efc0c52cc1.dll] [N/A, ]
[C:\WINDOWS\system32\CCCA2FB9.dll] [N/A, ]
[C:\WINDOWS\system32\08223B03.dll] [N/A, ]
[C:\WINDOWS\system32\704C3595.dll] [N/A, ]
[C:\WINDOWS\system32\JBn2ypqY23vWX.dll] [N/A, ]
[C:\WINDOWS\system32\yp77Tt3UCG74J.dll] [N/A, ]
[C:\WINDOWS\system32\56BC86C7.dll] [N/A, ]
[C:\WINDOWS\system32\ACg9ycsarj8y.dll] [N/A, ]
[C:\WINDOWS\fonts\GTH01535.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH02535.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH12541.TTF] [N/A, ]
[C:\WINDOWS\fonts\GTH19535.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH26535.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH30541.TTF] [N/A, ]
[C:\WINDOWS\fonts\GTH33541.TTF] [N/A, ]
[C:\WINDOWS\fonts\GTH36526.TTf] [N/A, ]
[C:\WINDOWS\fonts\GTH39541.TTF] [N/A, ]
[C:\WINDOWS\fonts\GTH61386.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH63380.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH64380.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH67380.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH72386.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH78380.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH90373.ttf] [N/A, ]

进程特权扫描

特殊特权被允许： SeDebugPrivilege [PID = 2340, I:\安装包\SRENG\SRENGLDR.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2340, I:\安装包\SRENG\SRENGLDR.EXE]

学飞的龙 - 2009-7-14 13:13:00

关于浏览器加载项
[ ]{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <, >是没问题的
lqqk7老师讲解过http://bbs.ikaka.com/showtopic-8640641-5.aspx
建议把老师讲义后的疑问解答看一下，很有帮助的:kaka12:

零度的穷浪漫 - 2009-7-27 16:15:00

好多正在运行的进程都没有公司签名，这算是大量病毒的存在么？

乐陶猪 - 2009-8-4 10:07:00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{56BC86C7-0692-4F94-A2C1-6CF1DBF8096C}><C:\WINDOWS\system32\56BC86C7.dll> []
<{6B74576A-BB20-47B3-AE0A-046B062897D0}><C:\WINDOWS\system32\ACg9ycsarj8y.dll> []
<{E88AE11C-26DF-4F4D-8726-C043F513990E}><C:\WINDOWS\system32\yp77Tt3UCG74J.dll> []
<{A23CA53C-731F-4033-92E8-C1DFB4E71D34}><C:\WINDOWS\system32\JBn2ypqY23vWX.dll> []
<{704C3595-DB85-40F6-A601-8D6F346907BD}><C:\WINDOWS\system32\704C3595.dll> []
<{08223B03-1B38-4A33-A83A-A4D3CC1D6E4E}><C:\WINDOWS\system32\08223B03.dll> []
<{0D267113-499A-4EEF-998D-C45731C1B313}><C:\WINDOWS\system32\VnTU2WAqUcZA6.dll> []
<{CCCA2FB9-2D5D-4481-8BFE-1CDDC458A3F4}><C:\WINDOWS\system32\CCCA2FB9.dll> []
<{028A997C-4262-4107-BD46-2ABBC6143E8C}><C:\WINDOWS\system32\efc0c52cc1.dll> []

瑞星卡卡安全论坛