‹‹ 上一主题 | 下一主题 ››
发新话题
打印

我单位N台电脑一样的毛病，用的是金山企业版。

cococcx

新兵

积分
16 
威望
20  
元宝
0  
铜钱
0  
1楼 大 中 小 发表于 2007-7-30 23:05  只看该作者

我单位N台电脑一样的毛病，用的是金山企业版。

首先，我先介绍下！我们单位公安网，我州用的是金山企业版，系统补丁用这个很多打不上，最近发现多台电脑有win32.hack.graybird.al.667648  看样子是灰鸽子，本来都不想理了（木马在公安网上一般没啥作用）可用电脑的人都说电脑反应比以前慢了，而且还很卡（他们的很卡意思是经常出现程序未响应）所以就检查了一下。用金山企业版扫出个WINDOWS\svchost也就是win32.hack.graybird.al.667648病毒 .我下了冰刃去用,发现在家可以打开!去单位就不行.SREng报告7个项被Vrvhook.dll  HOOK~这个我不知道是什么意思!它提示危险 为高~~

我共有2个问题 ~谢谢帮忙!!!
1、win32.hack.graybird.al.667648 怎么杀？开机后又有。冰刃拿过去用不了～！
2、啥是被HOKK？ 我共有8项被HOOK～其中一个是金山的程序，其他7个杂办？

其中一台电脑的报告如下：
复制内容到剪贴板
代码:
2007-07-30,17:01:32
System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件
    进程特权扫描

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
    <Super Rabbit IEPro><; E:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD>  [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
    <run><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Publisher]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Publisher]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows Publisher]
    <SoundMan><SOUNDMAN.EXE>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload>  [(Verified)Microsoft Corporation]
    <OrderReminder><C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder\OrderReminder.exe>  [Hewlett-Packard]
    <KANGUI.EXE><"C:\KavNet\KANGUI.EXE" -s>  [Kingsoft Corporation]
    <YLive.exe><; C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe>  [N/A]
    <eSafeMon><C:\WINDOWS\system32\eSafe_monitor.exe>  []
    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
    <Userinit><C:\WINDOWS\system32\Userinit.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
    <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
    <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
    <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
    <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
    <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
    <Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
    <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
    <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]
==================================
启动文件夹
N/A
==================================
服务
[Crypkey License / Crypkey License][Running/Auto Start]
  <crypserv.exe><Kenonic Controls Ltd.>
[eSafe notification service / eSafeService][Running/Auto Start]
  <C:\WINDOWS\system32\eSafeService.exe><DMWZ>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Sony SPTI Service for DVE / ICDSPTSV][Stopped/Manual Start]
  <C:\WINDOWS\system32\IcdSptSv.exe><Sony Corporation>
[Kingsoft Antivirus Net Communication / KANetCommService][Running/Auto Start]
  <C:\KavNet\KANSvr.EXE><Kingsoft Corporation>
[Pml Driver HPZ12 / Pml Driver HPZ12][Stopped/Manual Start]
  <C:\WINDOWS\system32\HPZipm12.exe><N/A>
[StyleXPService / StyleXPService][Running/Auto Start]
  <"C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe"><>
[VRVWatchServer / VRVWatchServer][Running/Auto Start]
  <"C:\WINDOWS\system32\WatchClient.exe" -service><>
[Distributed Link Tracking Servers / TrkNetsSvcs][Running/Auto Start]
  <C:\WINDOWS\svchost.exe -netsvcs><>
==================================
驱动程序
[Service for WDM 3D Audio Driver / ALCXSENS][Running/Manual Start]
  <system32\drivers\ALCXSENS.SYS><Sensaura Ltd>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[ati2mtag / ati2mtag][Running/Manual Start]
  <system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[eSafe Smartcard Reader driver for 98/2K / ESAFE][Running/Manual Start]
  <System32\Drivers\ESAFE.sys><BDTECH Inc.>
[eSafeSC / eSafeSC][Stopped/Manual Start]
  <System32\Drivers\eSafeSC.sys><BDTECH Inc.>
[Sony IC Recorder (SX) / ICDSX][Stopped/Manual Start]
  <System32\Drivers\ICDSX.sys><Sony Corporation>
[KWatch / KWatch][Running/System Start]
  <\??\C:\WINDOWS\system32\drivers\KWatch.Sys><Kingsoft Corporation>
[NetworkX / NetworkX][Running/System Start]
  <\SystemRoot\system32\ckldrv.sys><N/A>
[Netgroup Packet Filter / NPF][Stopped/Manual Start]
  <system32\drivers\npf.sys><Politecnico di Torino>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[StyleXPHelper / StyleXPHelper][Running/System Start]
  <\??\C:\Program Files\TGTSoft\StyleXP\StyleXPHelper.exe><Windows (R) 2000 DDK provider>
[VRVFW / VRVFW][Running/Boot Start]
  <\SystemRoot\system32\VrvFw.sys><北信源>
==================================
浏览器加载项
[ThunderIEHelper Class]
  {0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v8.dll, >
[AcroIEHlprObj Class]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[豪杰超级解霸V8]
  {367E0A21-8601-4986-9C9A-153BF5ACA118} <d:\Herosoft\HeroV8\STHSDVD.EXE, N/A>
[信息检索(&R)]
  {92780B25-18CC-41C8-B9BE-3C9C571A8263} <D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[KANInstallCtrl Class]
  {7AA83AD1-7234-4132-BA10-3C635D4C4B36} <C:\WINDOWS\Downloaded Program Files\KANOnlineInstall.dll, >
[Microsoft Office PivotTable 11.0]
  {0002E55A-0000-0000-C000-000000000046} <C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL, Microsoft Corporation>
[ThunderIEHelper Class]
  {0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v8.dll, >
[ActiveMovieControl Object]
  {05589FA1-C356-11CE-BF01-00AA0055595A} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[AcroIEHlprObj Class]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[Windows Media Player]
  {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[IETag Factory]
  {38481807-CA0E-42D2-BF39-B33AF135CC4D} <C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\IETAG.DLL, Microsoft Corporation>
[Shell Name Space]
  {55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[KANInstallCtrl Class]
  {7AA83AD1-7234-4132-BA10-3C635D4C4B36} <C:\WINDOWS\Downloaded Program Files\KANOnlineInstall.dll, >
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Microsoft Forms 2.0 ListBox]
  {8BD21D20-EC42-11CE-9E0D-00AA006002F3} <C:\WINDOWS\system32\FM20.DLL, Microsoft Corporation>
[SearchAssistantOC]
  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Microsoft DirectAnimation Control]
  {B6FFC24C-7E13-11D0-9B47-00C04FC2F51D} <C:\WINDOWS\system32\danim.dll, Microsoft Corporation>
[Adobe Acrobat Control for ActiveX]
  {CA8A9780-280D-11CF-A24D-444553540000} <C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\ActiveX\pdf.ocx, Adobe Systems Incorporated>
[RealPlayer G2 Control]
  {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash.ocx, Macromedia, Inc.>
==================================
正在运行的进程
[PID: 444 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 508 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 532 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\vrvhook.dll]  [edp, 6, 4, 19, 15]
[PID: 576 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 588 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 736 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\vrvhook.dll]  [edp, 6, 4, 19, 15]
[PID: 780 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\vrvhook.dll]  [edp, 6, 4, 19, 15]
[PID: 840 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\vrvhook.dll]  [edp, 6, 4, 19, 15]
[PID: 872 / SYSTEM][C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe]  [, 0, 20, 0, 3000]
    [C:\WINDOWS\system32\vrvhook.dll]  [edp, 6, 4, 19, 15]
[PID: 936 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\vrvhook.dll]  [edp, 6, 4, 19, 15]
[PID: 1028 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\vrvhook.dll]  [edp, 6, 4, 19, 15]
[PID: 1164 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\vrvhook.dll]  [edp, 6, 4, 19, 15]
    [C:\WINDOWS\system32\HPBMMON.DLL]  [Hewlett-Packard, 10.00.15]
    [C:\WINDOWS\system32\hpdomon.dll]  [Hewlett-Packard, 03.42.00]
    [C:\WINDOWS\system32\HPBHealr.dll]  [N/A, ]
    [C:\WINDOWS\system32\mdimon.dll]  [Microsoft Corporation, 11.3.1897.0]
    [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\IMFPrint.DLL]  [Zenographics, Inc., 5, 54, 330, 0]
    [C:\WINDOWS\system32\Imf32.dll]  [Zenographics, Inc., 5, 60, 1204, 0]
    [C:\WINDOWS\system32\ZTAG32.dll]  [Zenographics, Inc., 5, 60, 1210, 0]
    [C:\WINDOWS\system32\ZSPOOL.dll]  [Zenographics, Inc., 5, 51, 709, 0]
    [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll]  [Microsoft Corporation, 11.3.1897.0]
[PID: 1208 / LOCAL SERVICE][C:\WINDOWS\System32\SCardSvr.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\vrvhook.dll]  [edp, 6, 4, 19, 15]
[PID: 1532 / xsj][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\vrvhook.dll]  [edp, 6, 4, 19, 15]
    [C:\KavNet\KASocket.dll]  [Kingsoft Corporation, 2006, 3, 17, 235]
    [C:\WINDOWS\system32\VrvKeyBoard.dll]  [, 1, 0, 0, 1]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\mp3infp.dll]  [win32lab.com, 2.52.12.0]
    [C:\WINDOWS\system32\xunleibho_v8.dll]  [, 4, 5, 1, 33]
    [C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll]  [Adobe Systems Incorporated, 6.0.0.2003051500]
    [D:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
    [d:\Program Files\WinRAR\rarext.dll]  [N/A, ]
    [C:\WINDOWS\system32\SIMPLE~1.DLL]  [, 1, 0, 0, 1]
    [C:\KavNet\KANRMenu.DLL]  [, 2005, 3, 30, 5]
    [C:\WINDOWS\system32\eScs.dll]  [, 1, 0, 0, 1]
    [C:\WINDOWS\system32\ESAFEC.dll]  [, 1, 1, 1, 3]
    [C:\WINDOWS\system32\eSUI.dll]  [, 1, 0, 0, 3]
    [C:\WINDOWS\system32\GAKeyPub.dll]  [N/A, ]
[PID: 1612 / SYSTEM][C:\WINDOWS\system32\crypserv.exe]  [Kenonic Controls Ltd., 5.4.0]
    [C:\WINDOWS\system32\vrvhook.dll]  [edp, 6, 4, 19, 15]
[PID: 1640 / SYSTEM][C:\WINDOWS\system32\eSafeService.exe]  [DMWZ, 1, 0, 0, 2]
    [C:\WINDOWS\system32\vrvhook.dll]  [edp, 6, 4, 19, 15]
[PID: 1684 / SYSTEM][C:\KavNet\KANSvr.EXE]  [Kingsoft Corporation, 2006, 7, 10, 58]
    [C:\KavNet\MSVCP60.dll]  [Microsoft Corporation, 6.00.8972.0]
    [C:\KavNet\dump.dll]  [Kingsoft Corporation, 2006, 2, 16, 8]
    [C:\KavNet\KANSvr.DLL]  [kingsoft, 2005, 9, 30, 7]
    [C:\KavNet\StartKSCE.DLL]  [, 2006, 1, 17, 13]
    [C:\KavNet\KSCESendMsgManage.DLL]  [Kingsoft Corporation, 2006, 2, 16, 11]
    [C:\KavNet\KSCEEssentialModules.DLL]  [, 2005, 8, 18, 5]
    [C:\KavNet\CRecvMsgManage.DLL]  [, 2006, 1, 22, 6]
    [C:\KavNet\KSCEEventSystem.DLL]  [Kingsoft Corporation, 2006, 3, 6, 7]
    [C:\KavNet\KANVirusLogLogicModule.DLL]  [Kingsoft Corporation, 2006, 12, 29, 11]
    [C:\KavNet\CKSCEStream.DLL]  [, 2006, 1, 21, 4]
    [C:\KavNet\BaseModule.DLL]  [, 2007, 4, 25, 29]
    [C:\KavNet\WatchModule.DLL]  [, 2006, 2, 8, 20]
    [C:\KavNet\KWatchFn2.DLL]  [Kingsoft Corporation, 2007, 6, 12, 99]
    [C:\KavNet\KPluginInteractive.DLL]  [Kingsoft Corp., 2005, 5, 11, 3]
    [C:\KavNet\NetCommunication.DLL]  [, 2007, 7, 24, 136]
    [C:\KavNet\KANCMain.DLL]  [Kingsoft Corporation, 2006, 11, 29, 50]
    [C:\KavNet\KANSAComm.dll]  [kingsoft, 2007, 7, 17, 12]
    [C:\KavNet\RPCRecvMsg.DLL]  [kingsoft, 2006, 5, 19, 9]
    [C:\KavNet\CKSCEDECodeMsg.DLL]  [, 2005, 3, 23, 5]
    [C:\KavNet\KAVTimer.DLL]  [N/A, ]
    [C:\KavNet\KAEPlat.DLL]  [Kingsoft Corp., 2006, 8, 29, 60]
    [C:\KavNet\KAEMem.DAT]  [Kingsoft, 2006, 9, 25, 16]
    [C:\KavNet\KAEUnpack.DAT]  [Kingsoft Corp., 2007, 5, 9, 120]
    [C:\WINDOWS\system32\vrvhook.dll]  [edp, 6, 4, 19, 15]
    [C:\KavNet\KAVUtils.dll]  [Kingsoft Corp, 2004, 2, 12, 69]
    [C:\KavNet\MFC42.DLL]  [Microsoft Corporation, 6.00.8168.0]
    [C:\KavNet\KAVFilter.DLL]  [kingsoft, 2005, 4, 13, 5]
    [C:\KavNet\KANCFUN.DLL]  [kingsoft, 2006, 12, 29, 10]
    [C:\KavNet\KANSelectIP.DLL]  [Kingsoft Corporation, 2006, 11, 2, 6]
[PID: 1708 / SYSTEM][C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE]  [Microsoft Corporation, 7.00.9466]
    [C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\2052\mdmui.dll]  [Microsoft Corporation, 7.00.9466]
    [C:\WINDOWS\system32\vrvhook.dll]  [edp, 6, 4, 19, 15]
    [C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MSDBG2.DLL]  [Microsoft Corporation, 7.00.9466]
[PID: 1772 / SYSTEM][C:\WINDOWS\system32\WatchClient.exe]  [, 6, 6, 16, 21]
    [C:\WINDOWS\system32\vrvhook.dll]  [edp, 6, 4, 19, 15]
    [C:\KavNet\KASocket.dll]  [Kingsoft Corporation, 2006, 3, 17, 235]
[PID: 1808 / SYSTEM][C:\WINDOWS\system32\VrvEdp_m.exe]  [, 6, 6, 20, 536]
    [C:\WINDOWS\system32\Cipherop.dll]  [Cipherop, 6, 6, 18, 17]
    [C:\KavNet\KASocket.dll]  [Kingsoft Corporation, 2006, 3, 17, 235]
[PID: 120 / xsj][C:\KavNet\KANGUI.EXE]  [Kingsoft Corporation, 2007, 6, 12, 175]
    [C:\KavNet\dump.dll]  [Kingsoft Corporation, 2006, 2, 16, 8]
    [C:\WINDOWS\system32\vrvhook.dll]  [edp, 6, 4, 19, 15]
    [C:\KavNet\KASocket.dll]  [Kingsoft Corporation, 2006, 3, 17, 235]
    [C:\KavNet\KSCESendMsgManage.DLL]  [Kingsoft Corporation, 2006, 2, 16, 11]
    [C:\KavNet\MSVCP60.dll]  [Microsoft Corporation, 6.00.8972.0]
    [C:\KavNet\KSCEEssentialModules.DLL]  [, 2005, 8, 18, 5]
    [C:\KavNet\CRecvMsgManage.DLL]  [, 2006, 1, 22, 6]
    [C:\KavNet\CKSCEStream.DLL]  [, 2006, 1, 21, 4]
    [C:\KavNet\CKSCEDECodeMsg.DLL]  [, 2005, 3, 23, 5]
    [C:\KavNet\RPCRecvMsg.DLL]  [kingsoft, 2006, 5, 19, 9]
    [C:\WINDOWS\system32\VrvKeyBoard.dll]  [, 1, 0, 0, 1]
[PID: 160 / SYSTEM][C:\WINDOWS\system32\ntsd.exe]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [C:\WINDOWS\system32\vrvhook.dll]  [edp, 6, 4, 19, 15]
[PID: 168 / SYSTEM][C:\WINDOWS\system32\vrvsafec.exe]  [edp, 6, 4, 19, 15]
    [C:\WINDOWS\system32\vrvhook.dll]  [edp, 6, 4, 19, 15]
[PID: 184 / SYSTEM][C:\KavNet\KMailMon.exe]  [Kingsoft Corporation, 2007, 4, 18, 961]
    [C:\KavNet\KAntiSpm.dll]  [Kingsoft Corporation, 2007, 3, 7, 130]
    [C:\KavNet\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\KavNet\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\KavNet\KANCMail.dll]  [kingsoft, 2007, 4, 25, 13]
    [C:\WINDOWS\system32\vrvhook.dll]  [edp, 6, 4, 19, 15]
    [C:\KavNet\KSCESendMsgManage.DLL]  [Kingsoft Corporation, 2006, 2, 16, 11]
    [C:\KavNet\MSVCP60.dll]  [Microsoft Corporation, 6.00.8972.0]
    [C:\KavNet\KSCEEssentialModules.DLL]  [, 2005, 8, 18, 5]
    [C:\KavNet\CRecvMsgManage.DLL]  [, 2006, 1, 22, 6]
    [C:\KavNet\CKSCEStream.DLL]  [, 2006, 1, 21, 4]
    [C:\KavNet\CKSCEDECodeMsg.DLL]  [, 2005, 3, 23, 5]
    [C:\KavNet\RPCRecvMsg.DLL]  [kingsoft, 2006, 5, 19, 9]
    [C:\KavNet\KAVIPC2.DLL]  [Kingsoft Corporation, 2006, 8, 18, 25]
    [C:\KavNet\KAECall2.DLL]  [Kingsoft Corporation, 2004, 12, 28, 7]
    [C:\KavNet\KAEPlat.DLL]  [Kingsoft Corp., 2006, 8, 29, 60]
    [C:\KavNet\KAEMem.DAT]  [Kingsoft, 2006, 9, 25, 16]
    [C:\KavNet\KAEUnpack.DAT]  [Kingsoft Corp., 2007, 5, 9, 120]
    [C:\KavNet\KASocket.dll]  [Kingsoft Corporation, 2006, 3, 17, 235]
[PID: 436 / SYSTEM][C:\WINDOWS\system32\vrvrf_c.exe]  [, 6, 6, 6, 11]
    [C:\KavNet\KASocket.dll]  [Kingsoft Corporation, 2006, 3, 17, 235]
    [C:\WINDOWS\system32\vrvpwk.dll]  [, 1, 0, 0, 1]
    [C:\WINDOWS\system32\VrvKeyBoard.dll]  [, 1, 0, 0, 1]
    [C:\WINDOWS\system32\vrvfw_c.dll]  [, 1, 0, 0, 2]
    [C:\WINDOWS\system32\vrvrun_c.dll]  [, 1, 0, 0, 1]
    [C:\WINDOWS\system32\bkfile.dll]  [N/A, ]
    [C:\WINDOWS\system32\edpaudfliter.dll]  [, 1, 0, 0, 1]
[PID: 1836 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1100 / xsj][C:\WINDOWS\SOUNDMAN.EXE]  [Realtek Semiconductor Corp., 5.1.0.24]
    [C:\WINDOWS\system32\VrvHook.dll]  [edp, 6, 4, 19, 15]
    [C:\KavNet\KASocket.dll]  [Kingsoft Corporation, 2006, 3, 17, 235]
[PID: 956 / xsj][C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder\OrderReminder.exe]  [Hewlett-Packard, 1, 0, 0, 24]
    [C:\WINDOWS\system32\VrvHook.dll]  [edp, 6, 4, 19, 15]
[PID: 1944 / xsj][C:\WINDOWS\system32\eSafe_monitor.exe]  [, 1, 0, 0, 1]
    [C:\WINDOWS\system32\VrvHook.dll]  [edp, 6, 4, 19, 15]
    [C:\KavNet\KASocket.dll]  [Kingsoft Corporation, 2006, 3, 17, 235]
[PID: 2052 / xsj][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3275]
    [C:\WINDOWS\system32\VrvHook.dll]  [edp, 6, 4, 19, 15]
    [C:\KavNet\KASocket.dll]  [Kingsoft Corporation, 2006, 3, 17, 235]
[PID: 2128 / xsj][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\VrvHook.dll]  [edp, 6, 4, 19, 15]
    [C:\KavNet\KASocket.dll]  [Kingsoft Corporation, 2006, 3, 17, 235]
[PID: 3472 / SYSTEM][C:\WINDOWS\svchost.exe]  [, 3.0.1.0]
    [C:\KavNet\KASocket.dll]  [Kingsoft Corporation, 2006, 3, 17, 235]
[PID: 2344 / xsj][D:\新建文件夹\sreng2\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
    [C:\WINDOWS\system32\VrvHook.dll]  [edp, 6, 4, 19, 15]
    [C:\KavNet\KASocket.dll]  [Kingsoft Corporation, 2006, 3, 17, 235]
    [C:\WINDOWS\system32\VrvKeyBoard.dll]  [, 1, 0, 0, 1]
    [D:\新建文件夹\sreng2\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]
    [C:\WINDOWS\system32\eScs.dll]  [, 1, 0, 0, 1]
    [C:\WINDOWS\system32\ESAFEC.dll]  [, 1, 1, 1, 3]
    [C:\WINDOWS\system32\eSUI.dll]  [, 1, 0, 0, 3]
    [C:\WINDOWS\system32\GAKeyPub.dll]  [N/A, ]
==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  Error. ["hh.exe" %1]
.HLP  Error. [winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1       localhost
==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 1808, C:\WINDOWS\SYSTEM32\VRVEDP_M.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 120, C:\KAVNET\KANGUI.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 168, C:\WINDOWS\SYSTEM32\VRVSAFEC.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 436, C:\WINDOWS\SYSTEM32\VRVRF_C.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1944, C:\WINDOWS\SYSTEM32\ESAFE_MONITOR.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2052, C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE]
==================================
API HOOK
入口点错误：NtOpenProcess (危险等级: 高,  被下面模块所HOOK: C:\WINDOWS\system32\VrvHook.dll)
入口点错误：ZwOpenProcess (危险等级: 高,  被下面模块所HOOK: C:\WINDOWS\system32\VrvHook.dll)
入口点错误：RegOpenKeyExW (危险等级: 高,  被下面模块所HOOK: C:\WINDOWS\system32\VrvHook.dll)
入口点错误：RegDeleteKeyW (危险等级: 高,  被下面模块所HOOK: C:\WINDOWS\system32\VrvHook.dll)
入口点错误：FindFirstFileExW (危险等级: 高,  被下面模块所HOOK: C:\WINDOWS\system32\VrvHook.dll)
入口点错误：FindFirstFileW (危险等级: 高,  被下面模块所HOOK: C:\WINDOWS\system32\VrvHook.dll)
入口点错误：FindNextFileW (危险等级: 高,  被下面模块所HOOK: C:\WINDOWS\system32\VrvHook.dll)
入口点错误：LoadLibraryExW (危险等级: 高,  被下面模块所HOOK: C:\KavNet\KASocket.dll)
==================================
隐藏进程
N/A
==================================

TOP

铁军

上将(管理员)

积分
11819 
威望
21605  
元宝
96  
铜钱
1159  
2楼 大 中 小 发表于 2007-7-30 23:13  只看该作者
把那个报告 为灰鸽子的EXE和相同目录下主文件名相同，扩展名为DLL的文件用金山清理专家删除掉。在网络版，主程序工具菜单下，有金山反间谍，反间谍的工具中有个文件粉碎器，使用这个操作。
提问请注意详细描述现象、操作过程，如果是病毒报告，应说明病毒名，染毒文件路径、文件名等，什么现象都不描述只发一个日志的帖子将被直接删除。

请新会员关注新手杀毒入门

TOP

李逍遥

小李子


五级士官

猎场看守人

积分
1633 
威望
2997  
元宝
12  
铜钱
956  
3楼 大 中 小 发表于 2007-7-30 23:21  只看该作者
Win32.Hack.GrayBird.al.667648灰鸽子病毒清除方法（仅供参考）
表现：在c盘根目录下存在：“autorun.inf”和“autorun msdos程序的快捷方式”，在c:\windows\下存在dllhost.exe文件，U盘根目录也存在：“autorun.inf”和“autorun msdos程序的快捷方式”。C盘根目录下和U盘根目录下的“autorun.inf”和“autorun msdos程序的快捷方式”可以删除，但重启又会产生，dllhost.exe文件在正常模式下根本就不能删除。

单独执行DubaTool_Huigezi.COM 可以清病毒：win32.hack.graybird.al.667648,不过马上再查、机子下次启动都又会出现，又杀又清除。同样下次启动又会出现，又杀又清除。不能根除！！
NOD32根本就不认识该病毒，而金山毒霸可以发现该病毒，但不能清除，提示处理失败！

这是灰鸽子病毒变种，可以用以下方法清除：
1、首先进入安全模式；
2、打开“我的电脑”，在菜单栏上点“工具”，点“文件夹选项”，出现一个对话框，选择“查看”标签，去掉“隐藏受保护的操作系统文件（推荐）”前面的勾；
3、删除C:\ 下autorun.inf和autorun msdos程序的快捷方式；
4、删除C:\windows\ 下的dllhost.exe文件；
5、运行regedit，查找所有dllhost项、值、数据，删除之。

当然也要删除U盘根目录下的autorun.inf和autorun msdos程序的快捷方式。

TOP

‹‹ 上一主题 | 下一主题 ››
发新话题