遭遇Trojan-PSW.Win32.WOW,Trojan.PSW.Win32.OnlineGames,Trojan.MnLess.kks等1
endurer 原创
2007-08-06 第1版
刚才接到一位朋友的求助电话，说他的电脑上不了网了，瑞星监控小伞显示为黄色。用雅虎助手修复还是不行，请偶帮忙处理。
先看瑞星监控，发现是邮件监控无法启动。
再看网络，朋友的电脑采用的是局域网上网方式，ping 网关，可以ping通，www.163.com也可以ping通，但就是打不开网页。这样连 pe_xscan 等偶常用的软件都没法下载了。
好在上回帮他处理电脑问题时所用的 Hijackthis 还在，用它扫描 log，发现可疑项：
/---
Logfile of HijackThis v1.99.1
Scan saved at 12:23:43, on 2007-8-6
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
O10 - Broken Internet access because of LSP provider 'c:/windows/system32/mscomm.dll'
O23 - Service: 5A8C7ABA - Unknown owner - C:/WINDOWS/system32/1F944EC3.EXE (file missing)
---/
原来是O10引起的，这个一般要用 LspFix 或 winsockfix 来修复，这两个工具都可以从 http://endurer.ys168.com 下载，可惜现在上不了网~
看到桌面上的卡卡安全助手，就用它试试。双击运行，居然还是3.2版本的，看来网友从来没使用过它，最新版本是4.0了，立即升级，提示网址错误~
选择[IE及系统修复]，发现有两项是红色显示的，内容正是 mscomm.dll， 修复~
打开 http://endurer.ys168.com，发现目录列表显示不出来，检查发现是 浏览器无法执行活动脚本，用 /rereg参数来启动IE，无效。还是用regsvr32 命令把 jscript.dll 和 vbscript.dll 注册了，才能正常显示。
先升级卡卡安全助手，再看瑞星杀毒软件，病毒库还是 07-31的，也升级，不料升级过程，来了个蓝屏错误~
只能重启电脑，发现网友电脑中的Administrator用户没设置密码~
进入桌面后，刚开始瑞星监控小伞是绿的，后来文件监控自动关闭，就变成红色的了，手动开启了所有监控，但不一会又变成红色的了，再次手动开启所有监控，接着瑞星就不断报告发现病毒
下载 pe_xscan 扫描 log 分析，发现可疑项：
/===
pe_xscan 07-07-24 by Purple Endurer
2007-8-6 12:56:59
Windows XP Service Pack 2(5.1.2600)
管理员用户组
[System Process] * 0
C:/WINDOWS/system32/k118636446310.DAT | 2007-8-6 12:43:8
C:/WINDOWS/system32/k118636446612.DAT | 2007-8-6 12:43:6
C:/WINDOWS/system32/k118636446511.DAT | 2007-8-6 12:43:6
C:/WINDOWS/system32/k11863644596.DAT | 2007-8-6 12:42:12
C:/WINDOWS/system32/k11863644618.DAT | 2007-8-6 12:42:6
C:/WINDOWS/system32/WinForm.dll | 2007-8-6 12:41:0
C:/WINDOWS/system32/cmdbcs.dll | 2007-8-6 12:43:7
C:/WINDOWS/system32/MsIMMs32.dll | 2007-8-6 12:42:7
C:/WINDOWS/system32/mppds.dll | 2007-8-6 12:41:1
C:/WINDOWS/system32/AVPSrv.dll | 2007-8-6 12:41:1
C:/WINDOWS/system32/Kvsc3.dll | 2007-8-6 12:41:0
C:/WINDOWS/system32/csrss.exe * 860 | 2004-8-23 16:0:0 | Microsoft? Windows? Operating System | 5.1.2600.2180 | Client Server Runtime Process | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | CSRSS.Exe | CSRSS.Exe
C:/WINDOWS/system32/AF0D0E8E.DLL | 2007-8-6 12:40:11 | Microsoft(R) Windows(R) Operating System| ?| ? | (C) Microsoft Corporation. All rights reserved.| ? | Microsoft Corporation| ?| ?| ?
C:/WINDOWS/system32/winlogon.exe * 948 | 2004-8-23 16:0:0 | Microsoft(R) Windows(R) Operating System | 5.1.2600.2180 | Windows NT Logon Application | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | winlogon | WINLOGON.EXE
C:/WINDOWS/system32/AF0D0E8E.DLL | 2007-8-6 12:40:11 | Microsoft(R) Windows(R) Operating System| ?| ? | (C) Microsoft Corporation. All rights reserved.| ? | Microsoft Corporation| ?| ?| ?
C:/WINDOWS/system32/A815A0F7.DLL | 2007-8-6 12:43:12 | Microsoft(R) Windows(R) Operating System| ?| ? | (C) Microsoft Corporation. All rights reserved.| ? | Microsoft Corporation| ?| ?| ?
C:/WINDOWS/system32/services.exe * 1056 | 2004-8-23 16:0:0 | Microsoft(R) Windows(R) Operating System | 5.1.2600.2180 | Services and Controller app | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | services.exe | services.exe
C:/WINDOWS/system32/AF0D0E8E.DLL | 2007-8-6 12:40:11 | Microsoft(R) Windows(R) Operating System| ?| ? | (C) Microsoft Corporation. All rights reserved.| ? | Microsoft Corporation| ?| ?| ?
C:/WINDOWS/system32/lsass.exe * 1084 | 2004-8-23 16:0:0 | Microsoft? Windows? Operating System | 5.1.2600.2180 | LSA Shell (Export Version) | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | lsass.exe | lsass.exe
C:/WINDOWS/system32/AF0D0E8E.DLL | 2007-8-6 12:40:11 | Microsoft(R) Windows(R) Operating System| ?| ? | (C) Microsoft Corporation. All rights reserved.| ? | Microsoft Corporation| ?| ?| ?
C:/WINDOWS/system32/svchost.exe * 1324 | 2004-8-23 16:0:0 | Microsoft? Windows? Operating System | 5.1.2600.2180 | Generic Host Process for Win32 Services | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | svchost.exe | svchost.exe
C:/WINDOWS/system32/AF0D0E8E.DLL | 2007-8-6 12:40:11 | Microsoft(R) Windows(R) Operating System| ?| ? | (C) Microsoft Corporation. All rights reserved.| ? | Microsoft Corporation| ?| ?| ?
D:/Rising/Rav/CCenter.exe * 1584 | 2006-8-16 17:12:21 | Rising Antivirus Software | 18, 0, 0, 3 | CCenter | Copyright Rising 2002 | 18, 0, 0, 3 | Beijing Rising Technology Co., Ltd. | | Beijing Rising Technology Co., Ltd. | CCenter.exe
C:/WINDOWS/System32/svchost.exe * 1600 | 2004-8-23 16:0:0 | Microsoft? Windows? Operating System | 5.1.2600.2180 | Generic Host Process for Win32 Services | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | svchost.exe | svchost.exe
C:/WINDOWS/system32/AF0D0E8E.DLL | 2007-8-6 12:40:11 | Microsoft(R) Windows(R) Operating System| ?| ? | (C) Microsoft Corporation. All rights reserved.| ? | Microsoft Corporation| ?| ?| ?
C:/WINDOWS/system32/svchost.exe * 1740 | 2004-8-23 16:0:0 | Microsoft? Windows? Operating System | 5.1.2600.2180 | Generic Host Process for Win32 Services | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | svchost.exe | svchost.exe
C:/WINDOWS/system32/AF0D0E8E.DLL | 2007-8-6 12:40:11 | Microsoft(R) Windows(R) Operating System| ?| ? | (C) Microsoft Corporation. All rights reserved.| ? | Microsoft Corporation| ?| ?| ?
C:/WINDOWS/system32/svchost.exe * 1860 | 2004-8-23 16:0:0 | Microsoft? Windows? Operating System | 5.1.2600.2180 | Generic Host Process for Win32 Services | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | svchost.exe | svchost.exe
C:/WINDOWS/system32/AF0D0E8E.DLL | 2007-8-6 12:40:11 | Microsoft(R) Windows(R) Operating System| ?| ? | (C) Microsoft Corporation. All rights reserved.| ? | Microsoft Corporation| ?| ?| ?
C:/WINDOWS/Explorer.EXE * 224 | 2004-8-23 16:0:0 | Microsoft(R) Windows(R) Operating System | 6.00.2900.2180 | Windows Explorer | (C) Microsoft Corporation. All rights reserved. | 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | explorer | EXPLORER.EXE
C:/WINDOWS/system32/AF0D0E8E.DLL | 2007-8-6 12:40:11 | Microsoft(R) Windows(R) Operating System| ?| ? | (C) Microsoft Corporation. All rights reserved.| ? | Microsoft Corporation| ?| ?| ?
C:/WINDOWS/system32/Kvsc3.dll | 2007-8-6 12:41:0
C:/WINDOWS/system32/WinForm.dll | 2007-8-6 12:41:0
C:/WINDOWS/system32/AVPSrv.dll | 2007-8-6 12:41:1
C:/WINDOWS/system32/mppds.dll | 2007-8-6 12:41:1
C:/WINDOWS/system32/k11863644618.DAT | 2007-8-6 12:42:6
C:/WINDOWS/system32/MsIMMs32.dll | 2007-8-6 12:42:7
C:/WINDOWS/system32/TIMHost.dll | 2007-8-6 12:42:11
C:/WINDOWS/system32/k11863644596.DAT | 2007-8-6 12:42:12
C:/WINDOWS/system32/k118636446511.DAT | 2007-8-6 12:43:6
C:/WINDOWS/system32/k118636446612.DAT | 2007-8-6 12:43:6
C:/WINDOWS/system32/cmdbcs.dll | 2007-8-6 12:43:7
C:/WINDOWS/system32/k118636446310.DAT | 2007-8-6 12:43:8
C:/WINDOWS/system32/A815A0F7.DLL | 2007-8-6 12:43:12 | Microsoft(R) Windows(R) Operating System| ?| ? | (C) Microsoft Corporation. All rights reserved.| ? | Microsoft Corporation| ?| ?| ?
C:/WINDOWS/system32/ctfmon.exe * 1516 | 2004-8-23 16:0:0 | Microsoft? Windows? Operating System | 5.1.2600.2180 | CTF Loader | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | CTFMON | CTFMON.EXE
C:/WINDOWS/system32/WinForm.dll | 2007-8-6 12:41:0
C:/WINDOWS/system32/k11863644596.DAT | 2007-8-6 12:42:12
C:/WINDOWS/system32/k11863644618.DAT | 2007-8-6 12:42:6
C:/WINDOWS/system32/conime.exe * 3800 | 2004-8-23 16:0:0 | Microsoft? Windows? Operating System | 5.1.2600.2180 | Console IME | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | Console | CONIME.EXE
C:/WINDOWS/system32/k11863644596.DAT | 2007-8-6 12:42:12
C:/WINDOWS/system32/k11863644618.DAT | 2007-8-6 12:42:6
C:/WINDOWS/system32/WinForm.dll | 2007-8-6 12:41:0
C:/WINDOWS/system32/k118636446511.DAT | 2007-8-6 12:43:6
C:/WINDOWS/system32/k118636446310.DAT | 2007-8-6 12:43:8
C:/WINDOWS/system32/k118636446612.DAT | 2007-8-6 12:43:6
C:/WINDOWS/system32/6BD3F1DC.exe * 2064 | 2007-8-6 12:43:12
C:/WINDOWS/system32/6BD3F1DC.exe | 2007-8-6 12:43:12
C:/WINDOWS/system32/k118636446310.DAT | 2007-8-6 12:43:8
C:/WINDOWS/system32/k118636446612.DAT | 2007-8-6 12:43:6
C:/WINDOWS/system32/k118636446511.DAT | 2007-8-6 12:43:6
C:/WINDOWS/system32/k11863644596.DAT | 2007-8-6 12:42:12
C:/WINDOWS/system32/k11863644618.DAT | 2007-8-6 12:42:6
C:/WINDOWS/system32/WinForm.dll | 2007-8-6 12:41:0
C:/WINDOWS/system32/cmdbcs.dll | 2007-8-6 12:43:7
C:/WINDOWS/system32/MsIMMs32.dll | 2007-8-6 12:42:7
C:/WINDOWS/system32/mppds.dll | 2007-8-6 12:41:1
C:/WINDOWS/system32/AVPSrv.dll | 2007-8-6 12:41:1
C:/WINDOWS/system32/Kvsc3.dll | 2007-8-6 12:41:0
C:/WINDOWS/system32/nslookupi.exe * 2584 | 2007-8-6 12:44:30
C:/WINDOWS/system32/k118636446310.DAT | 2007-8-6 12:43:8
C:/WINDOWS/system32/k118636446612.DAT | 2007-8-6 12:43:6
C:/WINDOWS/system32/k118636446511.DAT | 2007-8-6 12:43:6
C:/WINDOWS/system32/k11863644596.DAT | 2007-8-6 12:42:12
C:/WINDOWS/system32/k11863644618.DAT | 2007-8-6 12:42:6O4 - HKLM/../Run: [WinForm] C:/WINDOWS/WinForm.exe
O4 - HKLM/../Run: [Kvsc3] C:/WINDOWS/Kvsc3.exe
O4 - HKLM/../Run: [AVPSrv] C:/WINDOWS/AVPSrv.exe
O4 - HKLM/../Run: [mppds] C:/WINDOWS/mppds.exe
O4 - HKLM/../Run: [MsIMMs32] C:/WINDOWS/MsIMMs32.exe
O4 - HKLM/../Run: [cmdbcs] C:/WINDOWS/cmdbcs.exeC:/autorun.inf
/-----
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell/Auto/command=auto.exe
-----/
D:/autorun.inf
/-----
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell/Auto/command=auto.exe
-----/
E:/autorun.inf
/-----
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell/Auto/command=auto.exe
-----/
F:/autorun.inf
/-----
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell/Auto/command=auto.exe
-----/
G:/autorun.inf
/-----
[autorun]
open=Launcher.exe
icon=Launcher.exe
-----/
O23 - 服务: 5A8C7ABA (5A8C7ABA) - C:/WINDOWS/system32/1F944EC3.EXE -5A8C7ABA | 2007-8-6 12:43:11 | Microsoft(R) Windows(R) Operating System| ?| ? | (C) Microsoft Corporation. All rights reserved.| ? | Microsoft Corporation| ?| ?| ?(自动)
O23 - 服务: 5C0D4D9C (5C0D4D9C) - C:/WINDOWS/system32/542DE44.EXE -k | 2007-10-18 23:41:30 | Microsoft(R) Windows(R) Operating System| ?| ? | (C) Microsoft Corporation. All rights reserved.| ? | Microsoft Corporation| ?| ?| ?(自动)
O23 - 服务: bnhoenni (bnhoenni) - System32/DRIVERS/bnhoenni.sys| ? | 1.1.0.1015| ?| ? | 1.1.0.1015| ?| ?| ?| ?(引导)
O23 - 服务: kdlepi (kdlepi) - C:/WINDOWS/System32/drivers/kdlepi.sys | 2007-6-24 21:36:45 | sys 应用程序 | 1, 0, 1, 3 | sys 应用程序 | 版权所有 (C) 2006 | 1, 0, 1, 3 | 北京三七二一科技有限公司| ? | sys | sys.exe(引导)
O23 - 服务: New0 (New0) - C:/WINDOWS/system32/new.sys | 2005-7-8 12:10:3(自动)
O23 - 服务: WS2IFSL (Windows 套接字 2 .0 Non-IFS 服务提供程序支持环境) - C:/WINDOWS/System32/drivers/ws2ifsl.sys | 2004-8-23 16:0:0 | Microsoft? Windows? Operating System | 5.1.2600.0 | Winsock2 IFS Layer | ? Microsoft Corporation. All rights reserved. | 5.1.2600.0 (xpclient.010817-1148) | Microsoft Corporation| ? | ws2ifsl.sys | ws2ifsl.sys(系统)
O24 - ShlExecHook: [4] - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} = 4
===/
呵呵，很多以前都遇到过~
标签：Trojan,12,WINDOWS,Corporation,system32,Microsoft,Win32,2007,PSW From： https://blog.51cto.com/endurer/5881553