1.问题描述：要是接网路线 就无法动弹 AVAST PRO无反应 ad-aware se PRO无侦测到危险 请在下面说明碰到的中毒情形，越详细越好(可贴图说明)： 2.扫毒报告：看工具管理员有ISASS.exe此程式执行 请先使用扫毒软体执行全机扫描後将扫毒结果传到置底空间 Combofix ：ComboFix 09-02-19.01 - WHO 2009-02-21 23:41:19.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.0.950.1.1028.18.767.401 [GMT 8:00] 执行位置: c:\documents and settings\WHO\桌面\ComboFix.exe * 成功创造新还原点 注意 - 这台电脑没有安装恢复控制台 ！！ . ((((((((((((((((((((((((( 2009-01-21 至 2009-02-21 的新的档案 ))))))))))))))))))))))))))))))) . 2009-02-21 01:42 . 2009-02-21 01:42 <DIR> d-------- c:\documents and settings\WHO\Application Data\Lavasoft 2009-02-21 01:34 . 2009-02-21 01:34 <DIR> d-------- c:\program files\Alwil Software 2009-02-21 01:05 . 2009-02-21 23:36 <DIR> d-------- c:\documents and settings\WHO\桌面 2009-02-21 01:05 . 2009-02-21 00:23 <DIR> dr------- c:\documents and settings\WHO\「开始」功能表 2009-02-21 01:05 . 2009-02-21 01:05 <DIR> d-------- c:\documents and settings\WHO . (((((((((((((((((((((((((((((((((((((((( 在三个月内被修改的档案 )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-21 15:42 1,606 ----a-w c:\windows\system32\PerfStringBackup.TMP 2009-02-20 16:55 --------- d-----w c:\program files\microsoft frontpage . ------- Sigcheck ------- 2001-10-10 23:10 430080 2b0e480e975ee51f2d5ce5f068fed6e2 c:\windows\system32\winlogon.exe . ((((((((((((((((((((((((((((((((((((( 重要登入点 )))))))))))))))))))))))))))))))))))))))))))))))))) . . *注意* 空白与合法缺省登录将不会被显示 REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AWMON"="c:\documents and settings\WHO\桌面\Ad-Aware SE Professional\Ad-Watch.exe" [2106-02-07 517632] "ctfmon.exe"="c:\windows\System32\ctfmon.exe" [2001-09-06 13312] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-06 81000] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\System32\CTFMON.EXE" [2001-09-06 13312] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2001-09-06 04:00 13312 c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1] --a------ 2001-09-06 04:00 208949 c:\windows\ime\IMJP8_1\imjpmig.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2001-08-02 07:14 1077277 c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A] --a------ 2001-09-06 04:00 737360 c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync] --a------ 2001-09-06 04:00 737360 c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-02-21 114768] . . ------- 而外的扫描 ------- . IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-21 23:42:48 Windows 5.1.2600 NTFS 扫描被隐藏的进程 。。。 扫描被隐藏的启动组 。。。 扫描被隐藏的文件 。。。 扫描完成 被隐藏的档案: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\.Default\AppEvents\Schemes\Apps\Avast\?悐灀送摊烓밪P*S* .Current] @="c:\\Program Files\\Alwil Software\\Avast4\\ChineseT\\vpsupd.wav" [HKEY_USERS\.Default\AppEvents\Schemes\Apps\Avast\?悐灀送摊烓밪P*S* .Modified] @="c:\\Program Files\\Alwil Software\\Avast4\\ChineseT\\vpsupd.wav" [HKEY_USERS\.Default\AppEvents\Schemes\Apps\Conf\摸嗿*Q\.Current] @="c:\\Program Files\\NetMeeting\\Blip.wav" [HKEY_USERS\LocalService\AppEvents\Schemes\Apps\Conf\摸嗿*Q\.Current] @="c:\\Program Files\\NetMeeting\\Blip.wav" [HKEY_USERS\S-1-5-20\AppEvents\Schemes\Apps\Conf\摸嗿*Q\.Current] @="c:\\Program Files\\NetMeeting\\Blip.wav" [HKEY_USERS\S-1-5-21-1715567821-1647877149-839522115-1003\AppEvents\Schemes\Apps\Avast\?悐灀送摊烓밪P*S* .Current] @="c:\\Program Files\\Alwil Software\\Avast4\\ChineseT\\vpsupd.wav" [HKEY_USERS\S-1-5-21-1715567821-1647877149-839522115-1003\AppEvents\Schemes\Apps\Avast\?悐灀送摊烓밪P*S* .Modified] @="c:\\Program Files\\Alwil Software\\Avast4\\ChineseT\\vpsupd.wav" [HKEY_USERS\S-1-5-21-1715567821-1647877149-839522115-1003\AppEvents\Schemes\Apps\Conf\摸嗿*Q\.Current] @="c:\\Program Files\\NetMeeting\\Blip.wav" . --------------------- 运行进程下的动态链接库 --------------------- - - - - - - - > 'winlogon.exe'(520) c:\windows\system32\ODBC32.dll c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll - - - - - - - > 'lsass.exe'(576) c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll c:\windows\System32\dssenh.dll . 完成时间: 2009-02-21 23:43:53 ComboFix-quarantined-files.txt 2009-02-21 15:43:51 Pre-Run: 39,444,389,888 位元组可用 Post-Run: 39,436,562,432 位元组可用 92 EFIX :[code] efix 5.0 20090205.15 - 2009-02-21 1:33:52.96 - ntfs Microsoft Windows XP - WHO 执行位置: F:\efix.exe * 已建立系统还原点. 提示： 未安装安全性更新 KB958644 [MS08-067] 未安装安全性更新 KB960714 [MS08-078] ================================================================================ EF删除的档案列表: 没有删除任何档案. ================================================================================ EF修改的登录值列表: 没有删除任何登录值. ================================================================================ 各磁碟根目录含有隐藏属性的资料夹 : d--h--w 0 2009-02-20 13:05:32 D:\WUTemp d--h--w 0 2008-12-28 09:06:20 F:\.Trashes d--h--w 0 2008-12-28 09:06:20 F:\.Spotlight-V100 ================================================================================ 各磁碟根目录含有隐藏属性的档案 : ---ha-w 4,096 2008-12-28 09:06:20 F:\._.Trashes ********** Created 2009-01 -- 2009-02 Files: ********** NO Files. . ********** Modified 2008-12 -- 2009-02 files: ********** NO Files. . ================================================================================ 执行中的程序: [PID: 960] C:\WINDOWS\system32\spoolsv.exe [Microsoft Corporation] [PID: 1104] C:\WINDOWS\System32\alg.exe [Microsoft Corporation] [PID: 832] C:\WINDOWS\System32\conime.exe [Microsoft Corporation] [PID: 1984] C:\WINDOWS\System32\wbem\wmiprvse.exe [Microsoft Corporation] [PID: 324] F:\setupchtpro.exe [N/A] [PID: 1800] C:\WINDOWS\System32\imapi.exe [Microsoft Corporation] ================================================================================ 登录值列表 *** 注意 : 部分正常值不会显示 *** [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\SHARED TOOLS\MSCONFIG\startupreg\ctfmon.exe] "command"="C:\WINDOWS\system32\ctfmon.exe" [Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\SHARED TOOLS\MSCONFIG\startupreg\IMJPMIG8.1] "command"="C:\WINDOWS\ime\IMJP8_1\imjpmig.exe" [Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\SHARED TOOLS\MSCONFIG\startupreg\MSMSGS] "command"="C:\Program Files\Messenger\msmsgs.exe" [Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\SHARED TOOLS\MSCONFIG\startupreg\PHIME2002A] "command"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\SHARED TOOLS\MSCONFIG\startupreg\PHIME2002ASync] "command"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [Microsoft Corporation] HKCR - open command: htmlfile: C:\Program Files\Internet Explorer\iexplore.exe -nohome 1862fc1943b25fafac14ac5248690426 2001-09-06 04:00 21504 C:\WINDOWS\system32\userinit.exe 1862fc1943b25fafac14ac5248690426 2001-09-06 04:00 21504 C:\WINDOWS\system32\dllcache\userinit.exe 05646ff8c5dfb537a2abb133831fca29 2001-09-06 04:00 1000960 C:\WINDOWS\explorer.exe 05646ff8c5dfb537a2abb133831fca29 2001-09-06 04:00 1000960 C:\WINDOWS\system32\dllcache\explorer.exe "C:\WINDOWS\system32\WUAUCLT1.EXE" not found. 没有数位签章的系统档案 2001-10-10 23:10 430080 C:\WINDOWS\system32\WINLOGON.EXE [Microsoft Corporation] --> 2001-10-10 23:10 430080 C:\WINDOWS\system32\winlogon.exe [Sigcheck failed.] ================================================================================ 服务 \ 驱动 列表: 显示方式 : 启动状态 服务名称;显示名称;档案名称 启动状态 : S0 = Boot Start S1 = System Start S2 = Auto Start S3 = Manual Start S4 = Disable S9 = Unknow ================================================================================ IE 首页设定: Internet Explorer Version: 6.0.2600.0000 HKLM - Extensions: {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm ================================================================================ 磁碟空间 C: - 38,581,129,216 位元组可用 磁碟空间 F: - 4,335,894,528 位元组可用 ================================================================================ 扫描结束时间: 2009-02-21 1:34:19.04 [/CODE] --

※ 发信站: 批踢踢实业坊(ptt.cc) ◆ From: 122.100.83.236