遭遇Trojan.PSW.Lmir.kyo、Trojan.DL.QQHelper等N多木马

Love The Way You Lie 2024-04-06 10:47 69阅读 0赞

**endurer**　原创

2006-09-23　第**1**版

有位网友的电脑经常发现病毒，手动扫描也清除不干净。  
让我帮忙检查一下。

到 [http://endurer.ys168.com][http_endurer.ys168.com] 下载HijackThis扫描log，发现以下可疑项：

/----------  
HijackThis\_zww汉化版扫描日志 V1.99.1  
保存于 0:30:24, 日期 2006-9-19  
操作系统： Windows XP SP2 (WinNT 5.01.2600)  
浏览器： Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程：  
C:/PROGRA~1/svhost32.exe

F3 - REG:win.ini: load=C:/PROGRA~1/svhost32.exe  
O2 - BHO: AdPopup - \{11F09AFD-75AD-4E51-AB43-E09E9351CE16\} - C:/Program Files/Common Files/CPUSH/cpush.dll  
O2 - BHO: MyIEHelper Class - \{16B770A0-0E87-4278-B748-2460D64A8386\} - C:/Documents and Settings/All Users/Application Data/Microsoft/IEHelper/IEHelper2006814\_4593.dll (file missing)  
O2 - BHO: (no name) - \{3A134B8D-CA84-42A9-BF88-CE45F8C395BF\} - C:/WINDOWS/system32/IEOPENGL.DLL  
O2 - BHO: CdnForIE Class - \{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108\} - C:/PROGRA~1/CNNIC/Cdn/cdnforie.dll  
O2 - BHO: (no name) - \{8532B305-4486-4388-939F-341C0430CDFC\} -  
C:/WINDOWS/system32/DxBho.dll  
O2 - BHO: QuickBtn - \{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7\} - C:/Program Files/kuzhan/kuzhan.dll  
O2 - BHO: (no name) - \{D424FE4E-CAF9-4fdd-BC5F-E6E6B91D53BF\} - (no file)  
O2 - BHO: WMHlprObj Class - \{F5824EFB-728A-4726-A5A5-85A68B20EDC3\} - C:/PROGRA~1/CNNIC/Cdn/wmhlpr.dll

O4 - 启动项HKLM//Run: \[Update\] C:/Program Files/Common Files/UPDATE2/Update.exe (kuzhan的项目)  
O4 - 启动项HKLM//Run: \[CdnCtr\] C:/Program Files/CNNIC/Cdn/cdnup.exe  
O4 - 启动项HKCU//Run: \[updatereal\] C:/WINDOWS/realupdate.exe other  
O4 - 启动项HKCU//Run: \[msnnt\] C:/WINDOWS/winampa.exe

O8 - IE右键菜单中的新增项目: 用炫彩图铃发送该图片 - C:/Program Files/CaiShow Tech/CaiShow/SendMMS.htm  
O8 - IE右键菜单中的新增项目: 访问通用网址 - C:/Program Files/CNNIC/Cdn/cnnic.htm  
O9 - 浏览器额外的按钮: 酷站导航 - \{1D901067-2529-4A9B-9B6B-7A1DB3A44CB5\} - C:/Program Files/kuzhan/kuzhan.dll  
O9 - 浏览器额外的按钮: 中文上网 - \{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108\} - C:/PROGRA~1/CNNIC/Cdn/cdnforie.dll  
O9 - 浏览器额外的“工具”菜单项: 中文上网 - \{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108\} - C:/PROGRA~1/CNNIC/Cdn/cdnforie.dll

O10 - 未知的文件在 Winsock LSP: c:/windows/system32/cdnns.dll

O11 - Options group: \[CDNCLIENT\] 中文上网

O23 - NT 服务: Network Logon (NetWorkLogon) - Unknown owner - rundll32.exe (file missing)

到 [http://endurer.ys168.com][http_endurer.ys168.com] 下载 并 运行 procview，终止进程：C:/PROGRA~1/svhost32.exe  
\----------/

停止并禁用服务: Network Logon (NetWorkLogon)，其命令行是：rundll32.exe KB896475.log,start

C:/WINDOWS/system32>dir KB896475.log  
驱动器 C 中的卷没有标签。  
卷的序列号是 1013-3AFE

C:/WINDOWS/system32 的目录

2006-09-18 13:41 123,141 KB896475.log  
1 个文件 123,141 字节

用WinRAR寻找下列文件：

C:/PROGRA~1/svhost32.exe（Kaspersky 报为 **Trojan-PSW.Win32.Lineage.ahq**）  
c:/windows/system32/dllwm.dll（Kaspersky 报为 **Trojan-PSW.Win32.Lineage.ahq**）  
c:/windows/system32/TIMPlatforms.exe  
c:/windows/system32/KB896475.log（瑞星报为 **Trojan.PSW.Lmir.kyo**）

STATUS: FINISHED  
Complete scanning result of "KB896475.log.del", received in VirusTotal at 09.18.2006, 19:28:23 (CET).

Antivirus Version Update Result  
AntiVir 7.2.0.16 09.18.2006 no virus found  
Authentium 4.93.8 09.18.2006 no virus found  
Avast 4.7.844.0 09.15.2006 **Win32:Wow-X**  
AVG 386 09.18.2006 no virus found  
BitDefender 7.2 09.18.2006 no virus found  
CAT-QuickHeal 8.00 09.18.2006 no virus found  
ClamAV devel-20060426 09.18.2006 no virus found  
eTrust-InoculateIT 23.72.127 09.16.2006 no virus found  
eTrust-Vet 30.3.3084 09.18.2006 no virus found  
DrWeb 4.33 09.18.2006 no virus found  
Ewido 4.0 09.18.2006 no virus found  
Fortinet 2.82.0.0 09.18.2006 **suspicious**   
F-Prot 3.16f 09.18.2006 **Possibly a new variant of W32/Threat-IKNP-based!Maximus**  
F-Prot4 4.2.1.29 09.18.2006 **W32/Threat-IKNP-based!Maximus**  
Ikarus 0.2.65.0 09.18.2006 **Backdoor.Win32.PcClient.GV**  
Kaspersky 4.0.2.24 09.18.2006 no virus found  
McAfee 4854 09.18.2006 no virus found  
Microsoft 1.1560 09.17.2006 no virus found  
NOD32v2 1.1761 09.18.2006 no virus found  
Norman 5.80.02 09.18.2006 no virus found  
Panda 9.0.0.4 09.18.2006 Suspicious file  
Sophos 4.09.0 09.18.2006 no virus found  
Symantec 8.0 09.18.2006 no virus found  
TheHacker 6.0.1.071 09.17.2006 no virus found  
UNA 1.83 09.18.2006 no virus found  
VBA32 3.11.1 09.18.2006 no virus found  
VirusBuster 4.3.7:9 09.18.2006 no virus found

Aditional Information  
File size: 123141 bytes  
MD5: 25ea5d35320afb7a4343bed7e205a25c  
SHA1: 3a7a6c51873a60f8e327c2e1da41246c6d8f9f47  
Packers: Packed

**C:/WINDOWS/system32/DxBho.dll**

STATUS: FINISHEDComplete scanning result of "dxbho.dll", received in VirusTotal at 09.18.2006, 18:45:58 (CET).

Antivirus Version Update Result  
AntiVir 7.2.0.16 09.18.2006 no virus found  
Authentium 4.93.8 09.18.2006 no virus found  
Avast 4.7.844.0 09.15.2006 no virus found  
AVG 386 09.18.2006 no virus found  
BitDefender 7.2 09.18.2006 no virus found  
CAT-QuickHeal 8.00 09.18.2006 no virus found  
ClamAV devel-20060426 09.18.2006 no virus found  
DrWeb 4.33 09.18.2006 no virus found  
eTrust-InoculateIT 23.72.127 09.16.2006 no virus found  
eTrust-Vet 30.3.3084 09.18.2006 no virus found  
Ewido 4.0 09.18.2006 no virus found  
Fortinet 2.82.0.0 09.18.2006 no virus found  
F-Prot 3.16f 09.18.2006 no virus found  
F-Prot4 4.2.1.29 09.18.2006 no virus found  
Ikarus 0.2.65.0 09.18.2006 no virus found  
Kaspersky 4.0.2.24 09.18.2006 no virus found  
McAfee 4854 09.18.2006 no virus found  
Microsoft 1.1560 09.17.2006 no virus found  
NOD32v2 1.1761 09.18.2006 no virus found  
Norman 5.90.23 09.18.2006 no virus found  
Panda 9.0.0.4 09.18.2006 no virus found  
Sophos 4.09.0 09.18.2006 no virus found  
Symantec 8.0 09.18.2006 no virus found  
TheHacker 6.0.1.071 09.17.2006 no virus found  
UNA 1.83 09.18.2006 no virus found  
VBA32 3.11.1 09.18.2006 no virus found  
VirusBuster 4.3.7:9 09.18.2006 no virus found

Aditional Information  
File size: 234496 bytes  
MD5: 721f35dbcd412eb68653092845186048  
SHA1: a2bcd6ba5246412323211072909412b9e75fb576  
packers: UPX

**C:/WINDOWS/system32/IEOPENGL.DLL**  
  
STATUS: FINISHEDComplete scanning result of "IEOPENGL.DLL", received in VirusTotal at 09.18.2006, 19:01:37 (CET).

Aditional Information  
File size: 233984 bytes  
MD5: b430c5978fe008802e9d269901ef9980  
SHA1: 7884f2469eff2f55d174ff7c5ad338731db54787  
packers: UPX

C:/WINDOWS/system32/0848/baisoa>dir /s /a  
驱动器 C 中的卷没有标签。  
卷的序列号是 1013-3AFE

C:/WINDOWS/system32/0848/baisoa 的目录

2006-09-17 13:26 <DIR> .  
2006-09-17 13:26 <DIR> ..  
2006-09-18 13:40 71 up.dat  
2006-09-17 13:26 229 verx.dat  
2006-09-08 10:59 12,288 novel.exe  
2006-09-15 14:14 20,992 dllhosta.dll  
2006-09-17 13:26 <DIR> update  
2006-09-17 13:26 69 updatefile.lst  
2006-09-17 13:27 0 waitdown.lst  
2006-09-17 13:27 90,112 avpa.exe  
2006-09-18 13:40 18,432 winampa.exe  
2006-09-18 13:40 465 adout.dat  
9 个文件 142,658 字节

C:/WINDOWS/system32/0848/baisoa/update 的目录

2006-09-17 13:26 <DIR> .  
2006-09-17 13:26 <DIR> ..  
2006-09-18 13:40 71 up.dat  
2006-09-17 13:26 69 updatefile.lst  
2006-09-17 13:27 0 waitdown.lst  
2006-09-17 13:26 229 verx.dat  
2006-09-17 13:27 90,112 avpa.exe  
2006-09-18 13:40 465 adout.dat  
2006-09-18 13:40 18,432 winampa.exe  
7 个文件 109,378 字节

所列文件总数:  
16 个文件 252,036 字节  
5 个目录 1,359,462,400 可用字节

到 [http://endurer.ys168.com][http_endurer.ys168.com] 下载并运行 瑞星杀毒助手，使用瑞星在线病毒扫描 C:/，结果如下：

/----------  
2006-9-19 4:5:15　瑞星杀毒助手  
Windows XP Service Pack 2(5.1.2600)  
文件名 病毒名  
C:/WINDOWS/system32/spoolsv/spoolsv.exe **Trojan.DL.Agent.kij**  
C:/WINDOWS/system32/msicn/plugins/bm.dll **Trojan.Ourxin.e**  
C:/WINDOWS/system32/msicn/plugins/as.dll **Trojan.Ourxin.c**  
C:/WINDOWS/system32/msicn/msibm.dll **Trojan.Spy.Agent.bhs**  
C:/WINDOWS/system32/1116/ntjdo/ntjcn.emm **Trojan.Spy.Agent.bhs**  
C:/WINDOWS/system32/1116/ntjdo/plugins/cn.emm **Trojan.Ourxin.e**  
C:/WINDOWS/system32/1116/ntjdo/plugins/bt.emm **Trojan.Ourxin.c**  
C:/WINDOWS/system32/1116/tzt/xnqesn.emm **Trojan.Ourxin.d**  
C:/WINDOWS/system32/1116/tqppmtw/tqppmtw.fyf **Trojan.DL.Agent.kij**  
C:/WINDOWS/system32/0848/baisoa/update/winampa.exe>>Unpack **Trojan.DL.Agent.ldt**  
C:/WINDOWS/system32/0848/baisoa/winampa.exe>>Unpack **Trojan.DL.Agent.ldt**  
C:/WINDOWS/system32/wmpdrm.dll **Trojan.Ourxin.d**  
C:/WINDOWS/system32/WinSC.dll **Trojan.Clicker.Qhost.i**  
C:/WINDOWS/system32/WinSC64.dll **Trojan.Clicker.Qhost.i**  
C:/WINDOWS/system32/UpdateModule.dll.del **Trojan.Clicker.Agent.ads**  
C:/WINDOWS/system32/KB896475.log.del>>NsPack **Trojan.PSW.Lmir.kyo**  
C:/WINDOWS/system32/ejjf.dll.del **Trojan.DL.Direct.aa**  
C:/WINDOWS/system32/icif.dll.del **Trojan.DL.Direct.aa**  
C:/WINDOWS/system32/jjbi.dll.del **Trojan.DL.Direct.aa**  
C:/WINDOWS/system32/ijcj.dll.del **Trojan.DL.Direct.aa**  
C:/WINDOWS/101628.exe.del **Trojan.DL.ADLoad.ei**  
C:/WINDOWS/10045\_setup.exe.del **Trojan.StartPage.bnx**

C:/Documents and Settings/All Users/Application Data/Microsoft/Crypto/dffj.exe.del **Trojan.Inject.st**  
C:/Documents and Settings/All Users/Application Data/Tencent/bind\_40040.exe **Trojan.DL.Agent.lpu**  
C:/Documents and Settings/All Users/Application Data/Tencent/bind\_40017.exe **Trojan.DL.Agent.lpu**  
C:/Documents and Settings/All Users/Application Data/Tencent/setup72.exe **Dropper.TiHs.g**

C:/Program Files/Common Files/UPDATE2/Update.exe.1 **Trojan.DL.QQHelper.efh**  
C:/Program Files/Windows Media Player/setup\_wm.dll **Trojan.DL.Agent.aph**  
C:/Program Files/Internet Explorer/iedw.dll **Trojan.DL.Agent.aph**  
C:/Program Files/Common Files/System/ddcckl.dat **Trojan.Inject.st**  
C:/Program Files/NetMeeting/nmview.dll **Trojan.Agent.dte**  
C:/Program Files/NetMeeting/conf.dll **Trojan.Agent.dte**  
C:/Program Files/xerox/fcbzc.exe **Trojan.Inject.st**  
C:/Program Files/CNNIC/iebar\_v2.exe **Trojan.DL.QQHelper.eo**

C:/nxldr.dat>>NsPack **Trojan.PSW.Lmir.kyo**  
\----------/

打包备份后，用瑞星杀毒助手清除。  
  
关闭所有浏览器和文件夹窗口，用HijackThis扫描并修复上面所列项目。

清空IE临时文件夹

清空 c:/Documents and Settings/user/Local Settings/temp（其中 user 为用户名）

清空 c:/windows/temp

[http_endurer.ys168.com]: http://endurer.ys168.com