瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 单位笔记本中病毒,多种修复后,仍然存在,请指教!

12345   3  /  5  页   跳转

单位笔记本中病毒,多种修复后,仍然存在,请指教!

抱歉,我很菜,能说详细点吗?谢谢
gototop
 

O23 - NT 服务: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)

进程文件:netmon.exe
进程名称:netmon
描述:netmon.exe是病毒mimail.m worm释放出来的文件,建议使用杀毒软件进行扫描。
出品者:未知
属于:mimail.m worm
系统进程:否
后台进程:是
使用网络:是
硬件相关:否
常见错误:未知
内存使用:未知
安全等级:4
间谍软件:否
广告软件:否
病毒:是
木马:否
参考资料:http://www.pctutu.com/TaskList/netmon_exe.Html




O23 - NT 服务: QCONSVC - Unknown owner - C:\WINDOWS\System32\QCONSVC.EXE
O23 - NT 服务: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
这个是笔记本相关程序  不要修复
gototop
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\byxxy]
<WinlogonNotify: byxxy><C:\WINDOWS\System32\byxxy.dll> []

此处无法删除,提示正在运行程序。
删除注册表键值也没办法?用sreng2删除不了
?//
gototop
 

再发新的日志,清查看,帮忙啊!谢谢
gototop
 

2006-09-08,11:51:51

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional  (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中:
    所有的启动项目(包括注册表、启动文件夹、服务等)
    浏览器加载项
    正在运行的进程(包括进程模块信息)
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe>  [Microsoft Corporation]
    <MSMSGS><; "C:\Program Files\Messenger\msmsgs.exe" /background>  [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <!ewido><"D:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized>  [Anti-Malware Development a.s.]
    <AGRSMMSG><; AGRSMMSG.exe>  [Agere Systems]
    <AsShell><; "C:\PROGRA~1\3721\assist\AsShell.exe">  []
    <ATIModeChange><; Ati2mdxx.exe>  [ATI Technologies, Inc.]
    <BIE><; Rundll32.exe C:\WINDOWS\DOWNLO~1\BDSrHook.dll,Rundll32>  []
    <IMEKRMIG6.1><; C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE>  [Microsoft Corporation]
    <IMJPMIG8.1><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32>  [Microsoft Corporation]
    <kpcdst><; D:\Program Files\media\kingplayer2003\cdsprite.exe>  [金山软件股份有限公司]
    <MSPY2002><; C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC>  []
    <NPDTray><; C:\PROGRA~1\ThinkPad\UTILIT~1\NPDTray.exe>  []
    <PHIME2002A><; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [Microsoft Corporation]
    <PHIME2002ASync><; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [Microsoft Corporation]
    <QCTRAY><; C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE>  []
    <QCWLICON><; C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE>  []
    <rfw><; C:\Program Files\rising\Rfw\Rfw.exe>  [Beijing Rising Technology Corporation Limited]
    <RfwMain><; "D:\Program Files\Rising\Rfw\rfwmain.exe" -Startup>  [Beijing Rising Technology Co., Ltd.]
    <StatusClient><; C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto>  [Hewlett-Packard]
    <stup.exe><; C:\PROGRA~1\TENCENT\Adplus\stup.exe>  []
    <SynTPEnh><; C:\Program Files\Synaptics\SynTP\SynTPEnh.exe>  [Synaptics, Inc.]
    <SynTPLpr><; C:\Program Files\Synaptics\SynTP\SynTPLpr.exe>  [Synaptics, Inc.]
    <Thunder><; "D:\迅雷\Thunder.exe" /s>  [Thunder Networking Technologies,LTD]
    <TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot>  [RealNetworks, Inc.]
    <TomcatStartup><; C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe>  [Hewlett-Packard]
    <TP4EX><; tp4ex.exe>  [IBM Corporation]
    <TPHOTKEY><; C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe>  []
    <TPTRAY><; C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE>  []
    <WangWang><; D:\新华字典\淘宝旺旺\WangWang.exe>  [浙江淘宝网络有限公司]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><EXPLORER.EXE>  [Microsoft Corporation]
    <Userinit><userinit.exe,>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\byxxy]
    <WinlogonNotify: byxxy><C:\WINDOWS\System32\byxxy.dll>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\policies]
    <WinlogonNotify: policies><C:\WINDOWS\system32\jt4s07h7e.dll>  []
gototop
 

启动文件夹
服务
[Ati HotKey Poller / Ati HotKey Poller]
  <C:\WINDOWS\System32\Ati2evxx.exe><N/A>
[ewido anti-spyware 4.0 guard / ewido anti-spyware 4.0 guard]
  <D:\Program Files\ewido anti-spyware 4.0\guard.exe><Anti-Malware Development a.s.>
[IBM PM Service / IBMPMSVC]
  <C:\WINDOWS\System32\ibmpmsvc.exe><N/A>
[IMAPI CD-Burning COM Service / ImapiService]
  <C:\WINDOWS\System32\imapi.exe><Microsoft Corporation>
[Network Monitor / Network Monitor]
  <C:\Program Files\Network Monitor\netmon.exe service><N/A>
[QCONSVC / QCONSVC]
  <System32\QCONSVC.EXE><N/A>
[Rising Proxy  Service / RfwProxySrv]
  <d:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService]
  <d:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter]
  <"D:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
  <"D:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
gototop
 

浏览器加载项
[]
  {8C290E1C-9217-46AA-92F9-1E9EE7379D56} <C:\WINDOWS\System32\byxxy.dll, N/A>

==================================
正在运行的进程
[PID: 1208][C:\WINDOWS\system32\rundll32.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
    [C:\WINDOWS\system32\lecalspl.dll]  <N/A><N/A>
[PID: 396][C:\WINDOWS\Explorer.EXE]  <Microsoft Corporation><6.00.2600.0000 (xpclient.010817-1148)>
    [C:\WINDOWS\System32\byxxy.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\lecalspl.dll]  <N/A><N/A>
    [C:\Program Files\tools\WinRAR\rarext.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\RavExt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13>
    [C:\Program Files\Adobe\ActiveX\PDFShell.dll]  <Adobe Systems, Inc.><7.0.0.0>
    [D:\Program Files\ewido anti-spyware 4.0\context.dll]  <Anti-Malware Development a.s.><4, 0, 0, 172>
[PID: 688][d:\program files\rising\rfw\RfwMain.exe]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 51>
    [d:\program files\rising\rfw\RsGuiLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23>
    [d:\program files\rising\rfw\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [d:\program files\rising\rfw\PngDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 1816][D:\Program Files\ewido anti-spyware 4.0\ewido.exe]  <Anti-Malware Development a.s.><4, 0, 0, 172>
    [D:\Program Files\ewido anti-spyware 4.0\engine.dll]  <Anti-Malware Development a.s.><4, 0, 0, 172>
[PID: 1876][C:\WINDOWS\System32\ctfmon.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1000][C:\WINDOWS\System32\wuauclt.exe]  <Microsoft Corporation><5.8.0.2469 built by: lab01_n(wmbla)>
[PID: 3060][C:\Program Files\tools\WinRAR\WinRAR.exe]  <N/A><N/A>
[PID: 3364][C:\DOCUME~1\plh\LOCALS~1\Temp\Rar$EX01.387\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
gototop
 

不要沉了,请帮助!谢
gototop
 

请到www.27814939.ys168.com,点“我的软件”下载KillBox.exe
重新启动电脑, 开机检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式进入Windows
运行(双击)System Repair Engineer,点“启动项目,服务,点“Win32服务应用程序”勾选“隐藏微软服务”选中病毒服务Network Monitor / Network Monitor选择“删除服务”点“设置”选择“否”
运行System Repair Engineer,使用“启动项目,注册表”来删除以下选项
<BIE><; Rundll32.exe C:\WINDOWS\DOWNLO~1\BDSrHook.dll,Rundll32>
<WinlogonNotify: byxxy><C:\WINDOWS\System32\byxxy.dll>
<WinlogonNotify: policies><C:\WINDOWS\system32\jt4s07h7e.dll>
运行System Repair Engineer,使用“系统修复,浏览器加载项”来删除以下选项
{8C290E1C-9217-46AA-92F9-1E9EE7379D56} <C:\WINDOWS\System32\byxxy.dll, N/A>
双击打开KillBox.exe,分别删除
C:\Program Files\Network Monitor\netmon.exe
C:\WINDOWS\DOWNLO~1\BDSrHook.dll
C:\WINDOWS\System32\byxxy.dll
C:\WINDOWS\system32\jt4s07h7e.dll
C:\WINDOWS\system32\lecalspl.dll
(删除时勾选“删除前先结束Explorer.EXE进程”)
注:后缀为.dll的文件如果无法删除,请勾选"反注册""再删除
gototop
 

ok,试一下
gototop
 
12345   3  /  5  页   跳转
页面顶部
Powered by Discuz!NT