打印

[已解决] 怎么删黑色幽灵？？高手救命！！

xuyi1988

新兵

积分: 3
威望: 6
元宝: 0
铜钱: 6

1楼大中小发表于 2008-6-22 17:08 只看该作者

怎么删黑色幽灵？？高手救命！！

我中了黑色幽灵，中毒后360安全卫士打不开，而且360的网站都进不去，金山在线杀毒等也进不去，但其他网站都正常。据说用金山清理专家可以删，但重启后又有了，不是说金山清理专家可以删黑色幽灵吗？希望高手帮忙。

这是诊断报告：

==============================================================
      金山清理专家系统诊断报告
该诊断报告由金山清理专家提供 http://www.duba.net
==============================================================
诊断时间:          2008-06-22, 16:56
诊断平台:          Windows XP [5.1.2600] Service Pack 2
IE版本:             Internet Explorer V7.0.11.5730
计算机物理内存:    1022(MB)
当前可用内存:       317(MB)
硬盘总大小:       69(GB)
硬盘可用空间:       6(GB)
清理专家版本:       2008.06.13.404
恶意软件库版本:    2008.06.03.1
漏洞库版本:       2008.05.27.1

==============================================================
      启动文件夹位置
==============================================================
Common Startup:    C:\Documents and Settings\All Users\「开始」菜单\程序\启动
Startup:          C:\Documents and Settings\lenovo\「开始」菜单\程序\启动
Common Startup:    %ALLUSERSPROFILE%\「开始」菜单\程序\启动
==============================================================
      Host File
==============================================================
127.0.0.1    localhost
127.0.0.1    www.360Safe.com
127.0.0.1    www.360.cn
127.0.0.1    bbs.360safe.com
127.0.0.1    baike.360.cn
127.0.0.1    kaba.360.cn
127.0.0.1    bbs.360.cn
127.0.0.1    360.cn
127.0.0.1    forum.ikaka.com
127.0.0.1    tool.ikaka.com
127.0.0.1    file.ikaka.com
127.0.0.1    update.ikaka.com
127.0.0.1    bbs.ikaka.com
127.0.0.1    bbs.janmeng.com
127.0.0.1    www.ikaka.com
127.0.0.1    forum.jiangmin.com
127.0.0.1    update.rising.com.cn
127.0.0.1    online.rising.com.cn
127.0.0.1    center.rising.com.cn
127.0.0.1    www.rising.com.cn
127.0.0.1    fw.rising.com.cn
127.0.0.1    csc.rising.com.cn
127.0.0.1    buy.rising.com.cn
127.0.0.1    sos.rising.com.cn
127.0.0.1    download.rising.com.cn
127.0.0.1    help.rising.com.cn
127.0.0.1    go.rising.com.cn
127.0.0.1    up.duba.net
127.0.0.1    shadu.baidu.com
127.0.0.1    security.symantec.com
127.0.0.1    shadu.duba.net
127.0.0.1    online.jiangmin.com
127.0.0.1    cn.mcafee.com
127.0.0.1    bbs.mcafeefans.com
127.0.0.1    mcafeefans.com
127.0.0.1    www.ahn.com.cn
127.0.0.1    www.kaspersky.com.cn
127.0.0.1    www.kaspersky.com
127.0.0.1    www.pcav.cn
127.0.0.1    www.vrv.com.cn
127.0.0.1    bbs.sucop.com
127.0.0.1    www.sucop.com
127.0.0.1    sucop.com
127.0.0.1    bbs.cpcw.com
127.0.0.1    www.shudoo.com
127.0.0.1    alert.rising.com.cn
127.0.0.1    www.dswlab.com
127.0.0.1    dswlab.com
127.0.0.1    bbs.dswlab.com
127.0.0.1    zhidao.ikaka.com
127.0.0.1    bbs.kafan.cn
127.0.0.1    bbs.kaspersky.com.cn
127.0.0.1    www.trendmicro.com.cn
127.0.0.1    bbs.trendmicro.com.cn
127.0.0.1    cn.trendmicro.com
127.0.0.1    www.kpfans.com
127.0.0.1    kpfans.com
127.0.0.1    www.mcafee.com
127.0.0.1    dnl-cn1.kaspersky-labs.com
127.0.0.1    dnl-cn2.kaspersky-labs.com
127.0.0.1    dnl-cn3.kaspersky-labs.com
127.0.0.1    dnl-cn4.kaspersky-labs.com
127.0.0.1    dnl-cn5.kaspersky-labs.com
127.0.0.1    dnl-cn6.kaspersky-labs.com
127.0.0.1    dnl-cn7.kaspersky-labs.com
127.0.0.1    dnl-cn8.kaspersky-labs.com
127.0.0.1    dnl-cn9.kaspersky-labs.com
127.0.0.1    dnl-cn10.kaspersky-labs.com
127.0.0.1    dnl-cn11.kaspersky-labs.com
127.0.0.1    dnl-cn12.kaspersky-labs.com
127.0.0.1    dnl-cn13.kaspersky-labs.com
127.0.0.1    dnl-cn14.kaspersky-labs.com
127.0.0.1    dnl-cn15.kaspersky-labs.com
127.0.0.1    dnl-cd1.kaspersky-labs.com
127.0.0.1    dnl-cd2.kaspersky-labs.com
127.0.0.1    dnl-cd3.kaspersky-labs.com
127.0.0.1    dnl-cd4.kaspersky-labs.com
127.0.0.1    dnl-cd5.kaspersky-labs.com
127.0.0.1    dnl-cd6.kaspersky-labs.com
127.0.0.1    dnl-cd7.kaspersky-labs.com
127.0.0.1    dnl-cd8.kaspersky-labs.com
127.0.0.1    dnl-cd9.kaspersky-labs.com
127.0.0.1    dnl-cd10.kaspersky-labs.com
127.0.0.1    dnl-cd11.kaspersky-labs.com
127.0.0.1    dnl-cd12.kaspersky-labs.com
127.0.0.1    dnl-cd13.kaspersky-labs.com
127.0.0.1    dnl-cd14.kaspersky-labs.com
127.0.0.1    dnl-eu1.kaspersky-labs.com
127.0.0.1    dnl-eu2.kaspersky-labs.com
127.0.0.1    dnl-eu3.kaspersky-labs.com
127.0.0.1    dnl-eu4.kaspersky-labs.com
127.0.0.1    dnl-eu5.kaspersky-labs.com
127.0.0.1    dnl-eu6.kaspersky-labs.com
127.0.0.1    dnl-eu7.kaspersky-labs.com
127.0.0.1    dnl-eu8.kaspersky-labs.com
127.0.0.1    dnl-eu9.kaspersky-labs.com
127.0.0.1    dnl-eu10.kaspersky-labs.com
127.0.0.1    dnl-eu11.kaspersky-labs.com
127.0.0.1    dnl-eu12.kaspersky-labs.com
127.0.0.1    dnl-eu13.kaspersky-labs.com
127.0.0.1    dnl-eu14.kaspersky-labs.com
127.0.0.1    dnl-eu15.kaspersky-labs.com
127.0.0.1    dnl-us1.kaspersky-labs.com
127.0.0.1    dnl-us2.kaspersky-labs.com
127.0.0.1    dnl-us3.kaspersky-labs.com
127.0.0.1    dnl-us4.kaspersky-labs.com
127.0.0.1    dnl-us5.kaspersky-labs.com
127.0.0.1    dnl-us6.kaspersky-labs.com
127.0.0.1    dnl-us7.kaspersky-labs.com
127.0.0.1    dnl-us8.kaspersky-labs.com
127.0.0.1    dnl-us9.kaspersky-labs.com
127.0.0.1    dnl-us10.kaspersky-labs.com
127.0.0.1    dnl-us11.kaspersky-labs.com
127.0.0.1    dnl-us12.kaspersky-labs.com
127.0.0.1    dnl-us13.kaspersky-labs.com
127.0.0.1    dnl-us14.kaspersky-labs.com
127.0.0.1    dnl-us15.kaspersky-labs.com
127.0.0.1    dnl-ru1.kaspersky-labs.com
127.0.0.1    dnl-ru2.kaspersky-labs.com
127.0.0.1    dnl-ru3.kaspersky-labs.com
127.0.0.1    dnl-ru4.kaspersky-labs.com
127.0.0.1    dnl-ru5.kaspersky-labs.com
127.0.0.1    dnl-ru6.kaspersky-labs.com
127.0.0.1    dnl-ru7.kaspersky-labs.com
127.0.0.1    dnl-ru8.kaspersky-labs.com
127.0.0.1    dnl-ru9.kaspersky-labs.com
127.0.0.1    dnl-ru10.kaspersky-labs.com
127.0.0.1    dnl-ru11.kaspersky-labs.com
127.0.0.1    dnl-ru12.kaspersky-labs.com
127.0.0.1    dnl-ru13.kaspersky-labs.com
127.0.0.1    dnl-ru14.kaspersky-labs.com
127.0.0.1    dnl-ru15.kaspersky-labs.com
127.0.0.1    dnl-jp1.kaspersky-labs.com
127.0.0.1    dnl-jp2.kaspersky-labs.com
127.0.0.1    dnl-jp3.kaspersky-labs.com
127.0.0.1    dnl-jp4.kaspersky-labs.com
127.0.0.1    dnl-jp5.kaspersky-labs.com
127.0.0.1    dnl-jp6.kaspersky-labs.com
127.0.0.1    dnl-jp7.kaspersky-labs.com
127.0.0.1    dnl-jp8.kaspersky-labs.com
127.0.0.1    dnl-jp9.kaspersky-labs.com
127.0.0.1    dnl-jp10.kaspersky-labs.com
127.0.0.1    dnl-jp11.kaspersky-labs.com
127.0.0.1    dnl-jp12.kaspersky-labs.com
127.0.0.1    dnl-jp13.kaspersky-labs.com
127.0.0.1    dnl-jp14.kaspersky-labs.com
127.0.0.1    dnl-jp15.kaspersky-labs.com
127.0.0.1    dnl-kr1.kaspersky-labs.com
127.0.0.1    dnl-kr2.kaspersky-labs.com
127.0.0.1    dnl-kr3.kaspersky-labs.com
127.0.0.1    dnl-kr4.kaspersky-labs.com
127.0.0.1    dnl-kr5.kaspersky-labs.com
127.0.0.1    dnl-kr6.kaspersky-labs.com
127.0.0.1    dnl-kr7.kaspersky-labs.com
127.0.0.1    dnl-kr8.kaspersky-labs.com
127.0.0.1    dnl-kr9.kaspersky-labs.com
127.0.0.1    dnl-kr10.kaspersky-labs.com
127.0.0.1    dnl-kr11.kaspersky-labs.com
127.0.0.1    dnl-kr12.kaspersky-labs.com
127.0.0.1    dnl-kr13.kaspersky-labs.com
127.0.0.1    dnl-kr14.kaspersky-labs.com
127.0.0.1    dnl-kr15.kaspersky-labs.com
==============================================================
      系统服务
==============================================================
该项来源: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
      [Adobe LM Service] [已启用] <"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe">
      文件路径: C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [分析中]
      [AppMgmt] [已启用]          <%SystemRoot%\System32\appmgmts.dll>
      [DCOMManager] [已启用]       <c:\windows\inf\pcidevices8.inf>
      [NetSpoolsvs] [已启用]       <C:\WINDOWS\system32\NetSpools.exe>
      文件路径: C:\WINDOWS\system32\NetSpools.exe [分析中]

==============================================================
      驱动程序
==============================================================
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
      [vidc.iv50] [已启用]          <ir50_32.dll>
      文件路径: C:\WINDOWS\system32\ir50_32.dll [分析中]
      [msacm.l3acm] [已启用]       <C:\WINDOWS\system32\l3codeca.acm>
      文件路径: C:\WINDOWS\system32\l3codeca.acm [分析中]
      [msacm.voxacm160] [已启用]    <vct3216.acm>
      文件路径: C:\WINDOWS\system32\vct3216.acm [分析中]
      [vidc.VP6F] [已启用]          <vp6vfw.dll>
      文件路径: d:\Program Files\Ringz Studio\Storm Codec\Codec\vp6vfw.dll [分析中]
      [vidc.FLV4] [已启用]          <vp6vfw.dll>
      文件路径: d:\Program Files\Ringz Studio\Storm Codec\Codec\vp6vfw.dll [分析中]
      [MSVideo8] [已启用]          <VfWWDM32.dll>
      [VIDC.YV12] [已启用]          <yv12vfw.dll>
      文件路径: C:\WINDOWS\system32\yv12vfw.dll [分析中]
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
      [0000b390] [已启用]          <\??\C:\WINDOWS\system32\Drivers\0000b390.sys>
      [0000b70b] [已启用]          <\??\C:\WINDOWS\system32\Drivers\0000b70b.sys>
      [0000bbed] [已启用]          <\??\C:\WINDOWS\system32\Drivers\0000bbed.sys>
      [0000c0a0] [已启用]          <\??\C:\WINDOWS\system32\Drivers\0000c0a0.sys>
      [0001144e] [已启用]          <\??\C:\WINDOWS\system32\Drivers\0001144e.sys>
      [00011d76] [已启用]          <\??\C:\WINDOWS\system32\Drivers\00011d76.sys>
      [0002f468] [已启用]          <\??\C:\WINDOWS\system32\Drivers\0002f468.sys>
      [003195c9] [已启用]          <\??\C:\WINDOWS\system32\Drivers\003195c9.sys>
      [017056bcacc9a780] [已启用] <\??\C:\017056bcacc9a780.dat>
      [ATSpy] [已启用]             <\??\C:\WINDOWS\system32\ATSpy.sys>
      [NetSpoolsvsDrv] [已启用]    <\??\C:\WINDOWS\system32\NetSpools.sys>
      文件路径: C:\WINDOWS\system32\NetSpools.exe [分析中]
      [npkcrypt] [已启用]          <\??\d:\Program Files\Tencent\QQ\npkcrypt.sys>
      文件路径: d:\Program Files\Tencent\QQ\npkcrypt.sys [分析中]
      [SENSE3] [已启用]             <system32\drivers\sense3.sys>
      文件路径: C:\WINDOWS\system32\drivers\sense3.sys [分析中]
      [sfhlp02] [已启用]          <System32\drivers\sfhlp02.sys>
      文件路径: C:\WINDOWS\system32\drivers\sfhlp02.sys [分析中]
      [sptd] [已启用]             <System32\Drivers\sptd.sys>
      文件路径: C:\WINDOWS\system32\Drivers\sptd.sys [文件无法访问]

==============================================================
      第3方IE插件
==============================================================
名称:    nprfxins.dll  [已启用]
文件路径: C:\Program Files\Internet Explorer\PLUGINS\RichFX\Player\nprfxins.dll [分析中]

==============================================================
      IE扩展按钮
==============================================================
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions
      [启动迅雷5]
      <{09BA8F6D-CB54-424B-839C-C2A6C8E6B436}> <d:\Program Files\Thunder Network\Thunder\Thunder.exe>
      文件路径: d:\Program Files\Thunder Network\Thunder\Thunder.exe [分析中]

==============================================================
      IE扩展菜单
==============================================================
该项来源: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt
      <&U使用纳米机器人下载并收藏>       <d:\Program Files\NamiRobot\Data\du.html>
      文件路径: d:\Program Files\NamiRobot\Data\du.html [分析中]
      <使用迅雷下载>       <D:\Program Files\Thunder Network\Thunder\Program\geturl.htm>
      文件路径: D:\Program Files\Thunder Network\Thunder\Program\geturl.htm [分析中]

==============================================================
      ActiveX控件
==============================================================
该项来源: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
      [Thunder Agent Class]
      <{485463B7-8FB2-4B3B-B29B-8B919B0EACCE}>       <D:\Program Files\Thunder Network\Thunder\ComDlls\ThunderAgent_Now.dll>
      文件路径: D:\Program Files\Thunder Network\Thunder\ComDlls\ThunderAgent_Now.dll [分析中]
      [XMP Class]
      <{6483F145-A768-4C41-AACC-52D4D7845851}>       <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xplayer.dll_1_work>
      文件路径: C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xplayer.dll_1_work [分析中]
      [XDRM]
      <{693571CB-54A3-4E90-9D52-EEAE1334E2D3}>       <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xdrm.dll_1_work>
      文件路径: C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xdrm.dll_1_work [分析中]
      [AxInputControl Class]
      <{73E4740C-08EB-4133-896B-8D0A7C9EE3CD}>       <C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL>
      文件路径: C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL [分析中]
      [AxSubmitControl Class]
      <{8D9E0B29-563C-4226-86C1-5FF2AE77E1D2}>       <C:\WINDOWS\DOWNLO~1\SUBMIT~1.DLL>
      文件路径: C:\WINDOWS\DOWNLO~1\SUBMIT~1.DLL [分析中]
      [XPPlayer Class]
      <{F3E70CEA-956E-49CC-B444-73AFE593AD7F}>       <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\pplayer.dll_1_work>
      文件路径: C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\pplayer.dll_1_work [分析中]

==============================================================
      其他安全区域
==============================================================
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
      [显示摇曳 CPL 扩展]       <deskpan.dll>
      [WinRAR]             <C:\Program Files\WinRAR\rarext.dll>
      文件路径: C:\Program Files\WinRAR\rarext.dll [分析中]
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers
      [PDF Shell Extension] <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll>
      文件路径: C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll [分析中]

[ 本帖最后由 xuyi1988 于 2008-6-23 11:53 编辑 ]

TOP

沐浴平凡

中将(版主)

积分: 4504
威望: 9209
元宝: 65
铜钱: 4553

毒霸MVP勋章

2楼大中小发表于 2008-6-22 17:35 只看该作者

进入安全模式杀一下,不行就用专家定位文件(鼠标指上那个文件),找到他老巢用专家工具暴力删除.

个人意见不代表官方立场，仅供参考！
别以为翻过一山就路儿条条通，别以为躲过一浪就可以放松
蚊子是病毒,蚊帐是防火墙,电蚊拍是杀软,蚊香是啥?主动防御就是满屋坟子你不来咬我,我不打你.你一到我身上我就打你.

TOP

无事无非

其实我是一个演员

上将(管理员)

要爱国！

积分: 9592
威望: 16895
元宝: 1
铜钱: 6028

安全精英毒霸MVP勋章一级密保勋章技术达人病毒解剖师安全新秀清理专家电脑清理高手

3楼大中小发表于 2008-6-23 09:19 只看该作者

尝试使用爱毒霸论坛文件延迟删除工具
点击学习使用方法
填入以下列出的病毒文件路径，添加以后选择删除，此时将提示重启，重启后建议打包上传工具目录下生成的_BackUP_文件夹

c:\windows\inf\pcidevices8.inf
C:\WINDOWS\system32\NetSpools.exe
C:\WINDOWS\system32\Drivers\0000b390.sys
C:\WINDOWS\system32\Drivers\0000b70b.sys
C:\WINDOWS\system32\Drivers\0000bbed.sys
C:\WINDOWS\system32\Drivers\0000c0a0.sys
C:\WINDOWS\system32\Drivers\0001144e.sys
C:\WINDOWS\system32\Drivers\00011d76.sys
C:\WINDOWS\system32\Drivers\0002f468.sys
C:\WINDOWS\system32\Drivers\003195c9.sys
C:\017056bcacc9a780.dat

另外，打开windows\system32\drivers\edc下的host文件，保留127.0.0.1这行其他都删。

默默祈祷，愿世界无灾无难，望天下无事无非～

TOP

一把锈剑

菜苗助长队

上将(超级版主)

奋青代表队-常任理事

积分: 11048
威望: 19538
元宝: 89
铜钱: 5940

最勤奋版主天才奖吃喝玩乐总指挥毒霸MVP勋章杀软原创技术写手勋章爱毒霸社区技术大师

4楼大中小发表于 2008-6-23 11:02 只看该作者

http://vi.duba.net/virus/win32-troj-kill360-dr-446464-50679.html

按照ls的处理更多信息楼主可以参考下这里看样子与楼主的情况有些类似从正常的系统恢复beep.sys看看

机器狗/AV终结者/磁碟机
AUTO木马群专杀工具
金山清理专家
一把锈剑的一亩三分地
请新会员务必关注 新手入门版块 AND如何让你的发贴更受关注？请注意发贴技巧

TOP