瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 请问这是不是灰鸽子木马或者黑客后门?

12   2  /  2  页   跳转

请问这是不是灰鸽子木马或者黑客后门?

浏览器加载项
[NavigatMon Class]
  {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, >
[Web反病毒保护]
  {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll, Kaspersky Lab>
[卡卡上网安全助手]
  {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINNT\system32\KakaTool.dll, Beijing Rising Technology Co., Ltd.>
[Edit Class]
  {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\WINNT\system32\CMBEdit.dll, >
[CMBSafeHelper Class]
  {26BCA338-BB94-4E8F-A082-3E5735875B79} <C:\WINNT\system32\CMBGUARD.dll, >
[CEditCtrl Object]
  {488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINNT\system32\aliedit\AliEdit.dll, www.alipay.com>
[MSN Photo Upload Tool]
  {4F1E5B1A-2A80-42CA-8532-2D05CB959537} <C:\WINNT\Downloaded Program Files\MsnPUpld.dll, Microsoft? Corporation>
[PwdEdit Control]
  {5467862B-C477-437F-886E-EC5006B37DCA} <C:\WINNT\DOWNLO~1\PwdEdit.ocx, adtec>
[WUWebControl Class]
  {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINNT\system32\wuweb.dll, Microsoft Corporation>
[Update Class]
  {9F1C11AA-197B-4942-BA54-47A8489BB47F} <C:\WINNT\system32\iuctl.dll, Microsoft Corporation>
[MsnMessengerSetupDownloadControl Class]
  {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} <C:\WINNT\Downloaded Program Files\MsnMessengerSetupDownloader.ocx, Microsoft Corporation>
[SMI MapView Control]
  {CA828031-4325-11D4-BDB2-00105A776E78} <C:\WINNT\Downloaded Program Files\SMIWMap.dll, 上海市测绘院基础地理信息中心, Shanghai Municipal Instatute of Surveying & Mapping,毕俊, 021-62549550-8122, bj@smi.stn.sh.cn>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[PBActiveX40 Control]
  {F2EB8999-766E-4BF6-AAAD-188D398C0D0B} <C:\WINNT\system32\CMBPB40.ocx, China Merchants Bank>

==================================
正在运行的进程
[PID: 192][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 216][\??\C:\WINNT\system32\csrss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 236][\??\C:\WINNT\system32\winlogon.exe]  [Microsoft Corporation, 5.00.2195.6997]
    [C:\WINNT\system32\klogon.dll]  [Kaspersky Lab, 6.0.0.299]
[PID: 264][C:\WINNT\system32\services.exe]  [Microsoft Corporation, 5.00.2195.7035]
    [C:\WINNT\system32\dmserver.dll]  [VERITAS Software Corp., 2195.6605.297.3]
[PID: 276][C:\WINNT\system32\lsass.exe]  [Microsoft Corporation, 5.00.2195.7011]
[PID: 412][C:\WINNT\System32\SCardSvr.exe]  [Microsoft Corporation, 5.00.2195.6609]
[PID: 448][C:\WINNT\system32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
[PID: 472][C:\Program Files\Intel\Wireless\Bin\EvtEng.exe]  [Intel Corporation, 9, 0, 2, 11]
    [C:\Program Files\Intel\Wireless\Bin\PsRegApi.dll]  [Intel Corporation, 9, 0, 2, 11]
    [C:\Program Files\Intel\Wireless\Bin\TraceAPI.DLL]  [Intel Corporation, 9, 0, 2, 11]
[PID: 516][C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe]  [Intel Corporation , 9, 0, 2, 11]
    [C:\Program Files\Intel\Wireless\Bin\TraceAPI.DLL]  [Intel Corporation, 9, 0, 2, 11]
    [C:\Program Files\Intel\Wireless\Bin\PsRegApi.dll]  [Intel Corporation, 9, 0, 2, 11]
[PID: 548][C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe]  [Intel? Corporation, 9, 0, 2, 11]
    [C:\Program Files\Intel\Wireless\Bin\PfMgrApi.dll]  [Intel Corporation, 9, 0, 2, 11]
    [C:\Program Files\Intel\Wireless\Bin\TraceAPI.DLL]  [Intel Corporation, 9, 0, 2, 11]
    [C:\Program Files\Intel\Wireless\Bin\PsRegApi.dll]  [Intel Corporation, 9, 0, 2, 11]
    [C:\Program Files\Intel\Wireless\Bin\MurocApi.dll]  [Intel Corporation, 9, 0, 2, 11]
    [C:\Program Files\Intel\Wireless\Bin\S24MUDLL.dll]  [Intel Corporation, 9, 0, 2, 11]
    [C:\Program Files\Intel\Wireless\Bin\C1XStngs.dll]  [Intel Corporation, 9, 0, 2, 11]
    [C:\Program Files\Intel\Wireless\Bin\LIBEAY32.dll]  [N/A, N/A]
    [C:\Program Files\Intel\Wireless\Bin\C8021CHS.dll]  [Intel Corporation, 9, 0, 2, 11]
    [C:\Program Files\Intel\Wireless\Bin\LSAWRAPI.dll]  [Intel Corporation, 9, 0, 2, 11]
[PID: 604][C:\WINNT\system32\spoolsv.exe]  [Microsoft Corporation, 5.00.2195.7059]
[PID: 632][C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe]  [Anti-Malware Development a.s., 7, 5, 0, 47]
    [C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\engine.dll]  [Anti-Malware Development a.s., 4, 2, 0, 15]
[PID: 676][C:\WINNT\system32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
[PID: 736][C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe]  [Intel Corporation, 9, 0, 2, 11]
[PID: 752][C:\WINNT\system32\regsvc.exe]  [Microsoft Corporation, 5.00.2195.6701]
[PID: 772][C:\WINNT\system32\MSTask.exe]  [Microsoft Corporation, 4.71.2195.6972]
[PID: 840][C:\WINNT\system32\stisvc.exe]  [Microsoft Corporation, 5.00.2195.6656]
[PID: 900][C:\WINNT\System32\WBEM\WinMgmt.exe]  [Microsoft Corporation, 1.50.1085.0100]
[PID: 912][C:\WINNT\system32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
[PID: 1128][C:\WINNT\Explorer.EXE]  [Microsoft Corporation, 5.00.3700.6690]
    [C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll]  [Anti-Malware Development a.s., 7, 5, 0, 47]
    [C:\WINNT\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.10.11 13May04]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, N/A]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\shellex.dll]  [Kaspersky Lab, 6.0.0.299]
    [C:\Program Files\360safe\safemon\safemon.dll]  [, 1, 0, 0, 1004]
    [C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll]  [Nokia, 6, 60, 15, 3]
    [C:\WINNT\system32\ConnAPI.DLL]  [Nokia., 6, 60, 27, 2]
    [C:\Program Files\Nokia\Nokia PC Suite 6\PCSCM.dll]  [Nokia, 6, 60, 45, 4]
    [C:\Program Files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_chi-sc.nlr]  [Nokia, 6, 60, 5, 1]
    [C:\Program Files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr]  [Nokia, 6, 60, 1, 1]
    [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll]  [Adobe Systems, Inc., 7.0.0.0]
    [C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll]  [Anti-Malware Development a.s., 7, 5, 0, 49]
[PID: 1268][C:\Program Files\iTunes\iTunesHelper.exe]  [Apple Computer, Inc., 6.0.4.2]
    [C:\Program Files\iTunes\iTunesHelper.Resources\zh_CN.lproj\iTunesHelperLocalized.DLL]  [Apple Computer, Inc., 6.0.3.2]
    [C:\Program Files\iTunes\iTunesHelper.Resources\iTunesHelper.DLL]  [Apple Computer, Inc., 6.0.4.2]
[PID: 1372][C:\Program Files\Synaptics\SynTP\SynTPEnh.exe]  [Synaptics, Inc., 7.10.11 13May04]
    [C:\WINNT\system32\SynCOM.dll]  [Synaptics, Inc., 7.10.11 13May04]
    [C:\WINNT\system32\SynTPAPI.dll]  [Synaptics, Inc., 7.10.11 13May04]
    [C:\WINNT\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.10.11 13May04]
[PID: 1416][C:\Program Files\Synaptics\SynTP\SynTPLpr.exe]  [Synaptics, Inc., 7.10.11 13May04]
    [C:\WINNT\system32\SynCOM.dll]  [Synaptics, Inc., 7.10.11 13May04]
    [C:\WINNT\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.10.11 13May04]
[PID: 352][C:\WINNT\system32\SafeSignCertReg.exe]  [A.E.T. Europe B.V., 2.0.0.2]
[PID: 1488][C:\Program Files\iPod\bin\iPodService.exe]  [Apple Computer, Inc., 6.0.4.2]
    [C:\Program Files\iPod\bin\iPodService.Resources\zh_CN.lproj\iPodServiceLocalized.DLL]  [Apple Computer, Inc., 6.0.3.2]
    [C:\Program Files\iPod\bin\iPodService.Resources\iPodService.DLL]  [Apple Computer, Inc., 6.0.4.2]
[PID: 1480][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3249]
    [C:\WINNT\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.10.11 13May04]
[PID: 1576][C:\Program Files\95599 Certificate Tools\CIDC\RegCertTool.exe]  [CIDC, 1, 0, 0, 6]
    [C:\WINNT\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.10.11 13May04]
[PID: 1584][C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe]  [Anti-Malware Development a.s., 7, 5, 0, 50]
    [C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\engine.dll]  [Anti-Malware Development a.s., 4, 2, 0, 15]
    [C:\Program Files\360safe\safemon\safemon.dll]  [, 1, 0, 0, 1004]
    [C:\WINNT\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.10.11 13May04]
[PID: 1504][C:\Program Files\360safe\safemon\360tray.exe]  [奇虎网, 1, 0, 1, 1004]
    [C:\WINNT\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.10.11 13May04]
    [C:\Program Files\360safe\safemon\safemon.dll]  [, 1, 0, 0, 1004]
    [C:\Program Files\360safe\safemon\SafeKrnl.dll]  [奇虎网, 1, 0, 0, 3001]
    [C:\Program Files\360safe\AntiAdwa.dll]  [360Safe.com, 2, 2, 5, 1000]
[PID: 1616][C:\WINNT\system32\internat.exe]  [Microsoft Corporation, 5.00.2920.0000]
    [C:\WINNT\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.10.11 13May04]
[PID: 1628][C:\Program Files\MSN Messenger\msnmsgr.exe]  [Microsoft Corporation, 7.0.0816]
    [C:\Program Files\360safe\safemon\safemon.dll]  [, 1, 0, 0, 1004]
    [C:\WINNT\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.10.11 13May04]
    [C:\WINNT\system32\msdmo.dll]  [N/A, N/A]
    [C:\Program Files\MSN Messenger\RICHED20.dll]  [Fun Web Products, Inc., 1, 0, 0, 9]
    [C:\WINNT\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
[PID: 1636][C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe]  [Adobe Systems Incorporated, 7.0.5.2005092300]
    [C:\Program Files\360safe\safemon\safemon.dll]  [, 1, 0, 0, 1004]
    [C:\WINNT\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.10.11 13May04]
[PID: 1652][C:\WINNT\system32\GDStartDc.exe]  [N/A, N/A]
[PID: 928][C:\Program Files\360safe\360Safe.exe]  [奇虎网, 3, 1, 0, 1003]
    [C:\Program Files\360safe\safemon\safemon.dll]  [, 1, 0, 0, 1004]
    [C:\WINNT\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.10.11 13May04]
    [C:\Program Files\360safe\AntiAdwa.dll]  [360Safe.com, 2, 2, 5, 1000]
    [C:\Program Files\360safe\AntiEng.dll]  [360Safe.com, 3, 0, 2, 2000]
    [C:\Program Files\360safe\Antispy.dll]  [奇虎网, 1, 0, 0, 1002]
    [C:\Program Files\360safe\CleanHis.dll]  [奇虎网, 3, 0, 2, 1000]
    [C:\Program Files\360safe\AntiActi.dll]  [360Safe.com, 2, 0, 0, 3000]
    [C:\Program Files\360safe\safeext.dll]  [360Safe.com, 1, 0, 0, 1021]
    [C:\Program Files\360safe\live.dll]  [360safe.COM, 1, 0, 0, 1011]
[PID: 1056][C:\Program Files\WinRAR\WinRAR.exe]  [N/A, N/A]
    [C:\Program Files\360safe\safemon\safemon.dll]  [, 1, 0, 0, 1004]
    [C:\WINNT\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.10.11 13May04]
    [C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll]  [Nokia, 6, 60, 15, 3]
    [C:\WINNT\system32\ConnAPI.DLL]  [Nokia., 6, 60, 27, 2]
    [C:\Program Files\Nokia\Nokia PC Suite 6\PCSCM.dll]  [Nokia, 6, 60, 45, 4]
    [C:\Program Files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_chi-sc.nlr]  [Nokia, 6, 60, 5, 1]
    [C:\Program Files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr]  [Nokia, 6, 60, 1, 1]
[PID: 488][C:\DOCUME~1\Lucy\LOCALS~1\Temp\Rar$EX00.978\SREng2\SREng.EXE]  [Smallfrogs Studio, 2.3.13.690]
    [C:\Program Files\360safe\safemon\safemon.dll]  [, 1, 0, 0, 1004]
    [C:\WINNT\system32\SynTPFcs.dll]  [Synaptics, Inc., 7.10.11 13May04]
gototop
 

文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
API HOOK
警告!System Repair Engineer 提醒
你下面的函数内容与预期值不符,他
们可能被一些恶意的软件所修改:
RVA  错误: LoadLibraryA
RVA  错误: LoadLibraryExA
RVA  错误: LoadLibraryExW
RVA  错误: LoadLibraryW
入口点错误:CreateProcessA
入口点错误:CreateProcessW

==================================


[/CODE]
gototop
 

麻烦高手帮忙分析一下,这厉害的病毒!!
gototop
 

SAM项是灰色的,而且打开regedt32是这个界面:

附件附件:

下载次数:1123
文件类型:image/pjpeg
文件大小:
上传时间:2007-2-25 16:20:22
描述:



gototop
 

我已经按2楼说的去做的,不行,我也截图出来了,SAM项是灰色的,根本就不能修改,我本以为是我做的不对,然后在自己电脑上按2楼说的去做都可以显示出来。
熊猫烧香病毒让多少网管受苦,他们也是懂电脑的人,病毒入侵让谁都受不了,再说我也只是懂点皮毛,我所说的懂只是让大家知道我不是那种电脑白痴,要一步一步的教,能简单指点一下就能领会。
回28楼,你的意思说是谁在我电脑上新建了用户对吧?那请你赐教了,该如何解决?或者给小弟一点建议,谢谢
PS:我只想能找到这个问题的病因所在,为什么会成这样,不想多说些什么,大家帮帮忙
gototop
 
12   2  /  2  页   跳转
页面顶部
Powered by Discuz!NT