昨天才提醒，今天就有网友点击QQ信息中的网址，中Worm.Viking.pk/Worm.Win32.Viking.jg了

清疚 2024-02-17 13:52 32阅读 0赞

**endurer** 原创

2007-03-20 第**1**版

昨天才提醒大家小心QQ信息中的网址会传播维金/Viking等病毒：

小心QQ信息中的网址传播维金Worm.Win32.Viking.ix/Worm.Viking.pg  
[http://endurer.bokee.com/6171794.html][http_endurer.bokee.com_6171794.html]  
[http://blog.csdn.net/Purpleendurer/archive/2007/03/19/1534201.aspx][http_blog.csdn.net_Purpleendurer_archive_2007_03_19_1534201.aspx]  
[http://blog.sina.com.cn/u/49926d91010007zy][http_blog.sina.com.cn_u_49926d91010007zy]  
[http://blog.i0778.com/?1314/action\_viewspace\_itemid\_2795.html][http_blog.i0778.com_1314_action_viewspace_itemid_2795.html]

想不到今天就有一位网友中标了。N多病毒，偶都不愿打包了。

pe\_xscan 和 HijackThis 的log中也只包含了其中的一部分而已。

先把pe\_xscan 和 HijackThis 的log。明天再细述。

R3 - URLSearchHook: ToolbarURLSearchHook Class - \{CA3EB689-8F09-4026-AA10-B9534C691CE0\} - C:/PROGRA~1/一起搜/tbu08947/tbhelper.dll  
F2 - REG:system.ini: Shell=Explorer.exe realshed.exe  
F2 - REG:system.ini: UserInit=C:/WINDOWS/system32/userinit.exe,rundll32.exe C:/WINDOWS/System32/winsys16\_070319.dll start

O2 - BHO CAdLogic Object - \{11F09AFD-75AD-4E51-AB43-E09E9351CE16\} - C:/Program Files/Common Files/CPUSH/cpush.dll  
O2 - BHO Cbho Object - \{352E3B3A-CAB5-4DBC-B940-C7F84D0447D8\} - C:/PROGRA~1/CNNIC/Cdn/cdndrag.dll  
O2 - BHO Info cache - \{385AB8C6-FB22-4D17-8834-064E2BA0A6F0\} - C:/Documents and Settings/All Users/Application Data/Microsoft/PCTools/pctools.dll  
O2 - BHO C:/Documents and Settings/All Users/Application Data/Microsoft/PCTools/pctools.dll - \{5B02EBA1-EFDD-477D-A37F-05383165C9C0\} -  
O2 - BHO CdnForIE Class - \{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108\} - C:/PROGRA~1/CNNIC/Cdn/cdnforie.dll  
O2 - BHO IEExt Class - \{634539A8-7FA8-45E2-8DC3-253AF98548A1\} - C:/WINDOWS/system/MFS0FT.DLL  
O2 - BHO 实用搜索 - \{6CFD436C-7AAD-4e50-992F-C0C87A94CAD2\} - C:/Program Files/superutilbar/superutilbar.dll  
O2 - BHO HrefRedirect Class - \{74BC093A-540E-4340-897B-4653A8EB2F47\} - C:/WINDOWS/System32/mslink/mslink.dll  
O2 - BHO SysShellKernel Class - \{E04B27AA-3973-4D68-8F42-B7C2FC8C6CF7\} - C:/WINDOWS/System32/SysShellKernel.dll  
O2 - BHO WMHlprObj Class - \{F5824EFB-728A-4726-A5A5-85A68B20EDC3\} - C:/PROGRA~1/CNNIC/Cdn/wmhlpr.dll  
O2 - BHO TBSB04694 Class - \{F943309C-4AF4-4D85-8064-FD20184B99EA\} - C:/PROGRA~1/一起搜/tbu08947/cneqiso.dll

O3 - IE工具栏: 实用搜索工具条2.0 - \{03465FF5-00AE-411a-9C34-960ED566EC03\} - C:/Program Files/superutilbar/superutilbar.dll  
O3 - IE工具栏: - \{5558D3F3-87EB-4335-BE71-C6E8E468D166\} - C:/Program Files/一起搜/tbu08947/cneqiso.dll

O4 - HKCR/../Run: \[ST0RMSetEx\] C:/WINDOWS/System32/rundll32.exe C:/WINDOWS/system/AV1CAP.dll,Run  
O4 - HKCR/../Run: \[svc\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/byetmr.exe  
O4 - HKCR/../Run: \[ravshell\] C:/WINDOWS/System32/SVCH0ST.EXE  
O4 - HKCR/../Run: \[uv4vmwwc0\] C:/WINDOWS/servicea.exe  
O4 - HKCR/../Run: \[miie7b7y1t51my\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/winlog0n.exe  
O4 - HKCR/../Run: \[r9k5\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/iexpl0re.exe  
O4 - HKCR/../Run: \[hvygr0xm\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/Servere.exe  
O4 - HKCR/../Run: \[v55rkqmt6qgx4\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/crasos.exe  
O4 - HKCR/../Run: \[c7kx\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/rundl132.exe  
O4 - HKCR/../Run: \[e5dms3e6\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/c0nime.exe  
O4 - HKCR/../Run: \[1hg1t6\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/iexp1ore.exe  
O4 - HKCR/../Run: \[2969suv11ri9\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/cftmon.exe  
O4 - HKLM/../Run: \[System\] C:/Program Files/Common Files/System/Updaterun.exe  
O4 - HKLM/../Run: \[CdnCtr\] C:/Program Files/CNNIC/Cdn/cdnup.exe  
O4 - HKLM/../Run: \[load\] C:/WINDOWS/uninstall/rundl132.exe  
O4 - HKLM/../Run: \[wtsttrs\] C:/WINDOWS/wtsttrs.exe  
O4 - HKLM/../Run: \[cmdbgcs\] C:/WINDOWS/cmdbgcs.exe  
O4 - HKLM/../Run: \[mppds\] C:/WINDOWS/mppds.exe  
O4 - HKLM/../Run: \[msccrt\] C:/WINDOWS/msccrt.exe  
O4 - HKLM/../Run: \[mhs3\] C:/WINDOWS/mhs3.exe  
O4 - HKLM/../Run: \[cmdbcs\] C:/WINDOWS/cmdbcs.exe  
O4 - HKLM/../Run: \[upxdnd\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/TIMPLATF0RM.exe  
O4 - HKLM/../Run: \[wgs3\] C:/WINDOWS/wgs3.exe  
O4 - HKLM/../Run: \[wsttrs\] C:/WINDOWS/wsttrs.exe  
O4 - HKLM/../Run: \[FYNEWS\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/sl.exe

O4 - Global Startup: WanSo.lnk ->

O8 - IE右键菜单附加项 : 访问通用网址 - C:/Program Files/CNNIC/Cdn/cnnic.htm

O21 - SSODL - nvwi(Windows nvwi Theme) - \{D0A6302C-859C-471E-9082-6B865C0ACAA2\} = C:/PROGRA~1/muvh/nvwi.dll

O23 - 服务: 7A04BC6 (7A04BC6) - C:/WINDOWS/System32/7A04BC6.EXE -service | 2007-3-20 14:59:36 | Microsoft(R) Windows(R) Operating System | 5.2.3790.1830 | ASN.2 Runtime APIs | (C) Microsoft Corporation. All rights reserved. | 5.2.3790.1830 | Microsoft Corporation| ?| ?| ?(自动)

O23 - 服务: bcjhjgfi (bcjhjgfi) - system32/drivers/bcjhjgfi.sys(引导)

O23 - 服务: bkvtszv () - C:/WINDOWS/System32/svchost.exe -k netsvcs -> C:/PROGRA~1/COMMON~1/okvtyzv/okvtyzv.dll | 2007-3-20 10:50:36 | | 2, 8, 0, 1 | | | 2, 8, 0, 1 | | | | (自动)

O23 - 服务: D0622BED (D0622BED) - C:/WINDOWS/System32/D0622BED.EXE -service | 2007-3-20 15:1:2 | Microsoft(R) Windows(R) Operating System | 5.2.3790.1830 | ASN.2 Runtime APIs | (C) Microsoft Corporation. All rights reserved. | 5.2.3790.1830 | Microsoft Corporation| ?| ?| ?(自动)

O23 - 服务: MOBILL (Windows Install Helper) - C:/WINDOWS/SYSTEM32/RUNDLL2000.EXE C:/WINDOWS/SYSTEM32/WBEM/OZCJI.DLL,Export 1087(自动)

O23 - 服务: Net Event (Net Event) - C:/WINDOWS/system32/netevent.exe | 2007-3-20 10:46:44(自动)

O23 - 服务: pxyk (Std pxyk Service) - C:/WINDOWS/System32/rundll32.exe C:/PROGRA~1/hptc/usdp.dll,Service -s(自动)

O23 - 服务: REM0TEREGISTRY (REM0TE REGISTRY) - C:/WINDOWS/system/REM0REG.EXE | 2007-3-20 10:45:38(自动)

O23 - 服务: Windows Login (Windows Login) - C:/WINDOWS/System32/mslogin.exe | 2007-3-20 10:46:38(自动)

O24 - \[\] - \{A6011F8F-A7F8-49AA-9ADA-49127D43138F\} = C:/Program Files/Common Files/Microsoft Shared/MSINFO/NewInfo.rxk  
O24 - \[\] - \{754FB7D8-B8FE-4810-B363-A788CD060F1F\} = C:/Program Files/Internet Explorer/PLUGINS/SystemKb.sys  
O24 - \[\] - \{99F1D023-7CEB-4586-80F7-BB1A98DB7602\} = C:/Program Files/Internet Explorer/IEXPLORE.Sys  
O24 - \[\] - \{FEB94F5A-69F3-4645-8C2B-9E71D270AF2E\} = C:/Program Files/Internet Explorer/IEXPLORE.Dat  
O24 - \[\] - \{923509F1-45CB-4EC0-BDE0-1DED35B8FD60\} = C:/Program Files/Internet Explorer/IEXPLORE.win

\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

Logfile of HijackThis v1.99.1  
Scan saved at 18:20:11, on 2007-3-20  
Platform: Windows XP SP1 (WinNT 5.01.2600)  
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:  
C:/WINDOWS/System32/SVCH0ST.EXE

R3 - URLSearchHook: ToolbarURLSearchHook Class - \{CA3EB689-8F09-4026-AA10-B9534C691CE0\} - C:/PROGRA~1/一起搜/tbu08947/tbhelper.dll (file missing)  
F2 - REG:system.ini: Shell=Explorer.exe realshed.exe  
F2 - REG:system.ini: UserInit=C:/WINDOWS/system32/userinit.exe,rundll32.exe C:/WINDOWS/System32/winsys16\_070319.dll start  
O2 - BHO: AdPopup - \{11F09AFD-75AD-4E51-AB43-E09E9351CE16\} - C:/Program Files/Common Files/CPUSH/cpush.dll  
O2 - BHO: CNNIC 网络工具Drag - \{352E3B3A-CAB5-4DBC-B940-C7F84D0447D8\} - C:/PROGRA~1/CNNIC/Cdn/cdndrag.dll  
O2 - BHO: Info cache - \{385AB8C6-FB22-4D17-8834-064E2BA0A6F0\} - C:/Documents and Settings/All Users/Application Data/Microsoft/PCTools/pctools.dll  
O2 - BHO: (no name) - \{5B02EBA1-EFDD-477D-A37F-05383165C9C0\} - (no file)  
O2 - BHO: CdnForIE Class - \{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108\} - C:/PROGRA~1/CNNIC/Cdn/cdnforie.dll  
O2 - BHO: IEExt Class - \{634539A8-7FA8-45E2-8DC3-253AF98548A1\} - C:/WINDOWS/system/MFS0FT.DLL  
O2 - BHO: 实用搜索 - \{6CFD436C-7AAD-4e50-992F-C0C87A94CAD2\} - C:/Program Files/superutilbar/superutilbar.dll  
O2 - BHO: mslogin linker - \{74BC093A-540E-4340-897B-4653A8EB2F47\} - C:/WINDOWS/System32/mslink/mslink.dll  
O2 - BHO: SysShellKernel - \{E04B27AA-3973-4D68-8F42-B7C2FC8C6CF7\} - C:/WINDOWS/System32/SysShellKernel.dll  
O2 - BHO: WMHlprObj Class - \{F5824EFB-728A-4726-A5A5-85A68B20EDC3\} - C:/PROGRA~1/CNNIC/Cdn/wmhlpr.dll  
O2 - BHO: TBSB04694 - \{F943309C-4AF4-4D85-8064-FD20184B99EA\} - C:/PROGRA~1/一起搜/tbu08947/cneqiso.dll (file missing)  
O3 - Toolbar: 实用搜索工具条2.0 - \{03465FF5-00AE-411a-9C34-960ED566EC03\} - C:/Program Files/superutilbar/superutilbar.dll  
O3 - Toolbar: 一起搜 - \{5558D3F3-87EB-4335-BE71-C6E8E468D166\} - C:/Program Files/一起搜/tbu08947/cneqiso.dll (file missing)  
O4 - HKLM/../Run: \[System\] C:/Program Files/Common Files/System/Updaterun.exe  
O4 - HKLM/../Run: \[CdnCtr\] C:/Program Files/CNNIC/Cdn/cdnup.exe  
O4 - HKLM/../Run: \[load\] C:/WINDOWS/uninstall/rundl132.exe  
O4 - HKLM/../Run: \[wtsttrs\] C:/WINDOWS/wtsttrs.exe  
O4 - HKLM/../Run: \[cmdbgcs\] C:/WINDOWS/cmdbgcs.exe  
O4 - HKLM/../Run: \[mppds\] C:/WINDOWS/mppds.exe  
O4 - HKLM/../Run: \[msccrt\] C:/WINDOWS/msccrt.exe  
O4 - HKLM/../Run: \[mhs3\] C:/WINDOWS/mhs3.exe  
O4 - HKLM/../Run: \[cmdbcs\] C:/WINDOWS/cmdbcs.exe  
O4 - HKLM/../Run: \[upxdnd\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/TIMPLATF0RM.exe  
O4 - HKLM/../Run: \[wgs3\] C:/WINDOWS/wgs3.exe  
O4 - HKLM/../Run: \[wsttrs\] C:/WINDOWS/wsttrs.exe  
O4 - HKLM/../Run: \[FYNEWS\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/sl.exe  
O4 - HKLM/../Run: \[spoel\] C:/Program Files/Internet Explorer/spoel.exe  
O4 - HKCU/../Run: \[ST0RMSetEx\] C:/WINDOWS/System32/rundll32.exe C:/WINDOWS/system/AV1CAP.dll,Run  
O4 - HKCU/../Run: \[svc\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/byetmr.exe  
O4 - HKCU/../Run: \[ravshell\] C:/WINDOWS/System32/SVCH0ST.EXE  
O4 - HKCU/../Run: \[uv4vmwwc0\] C:/WINDOWS/servicea.exe  
O4 - HKCU/../Run: \[miie7b7y1t51my\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/winlog0n.exe  
O4 - HKCU/../Run: \[r9k5\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/iexpl0re.exe  
O4 - HKCU/../Run: \[hvygr0xm\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/Servere.exe  
O4 - HKCU/../Run: \[v55rkqmt6qgx4\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/crasos.exe  
O4 - HKCU/../Run: \[c7kx\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/rundl132.exe  
O4 - HKCU/../Run: \[e5dms3e6\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/c0nime.exe  
O4 - HKCU/../Run: \[1hg1t6\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/iexp1ore.exe  
O4 - HKCU/../Run: \[2969suv11ri9\] C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/cftmon.exe  
O4 - Global Startup: WanSo.lnk = ?

O8 - Extra context menu item: 访问通用网址 - C:/Program Files/CNNIC/Cdn/cnnic.htm  
O9 - Extra button: 启动迅雷5 - \{09BA8F6D-CB54-424B-839C-C2A6C8E6B436\} - C:/Program Files/Thunder Network/Thunder/Thunder.exe  
O9 - Extra button: 中文上网 - \{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108\} - C:/PROGRA~1/CNNIC/Cdn/cdnforie.dll  
O9 - Extra 'Tools' menuitem: 中文上网 - \{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108\} - C:/PROGRA~1/CNNIC/Cdn/cdnforie.dll  
O10 - Unknown file in Winsock LSP: c:/windows/system32/cdnns.dll  
O11 - Options group: \[CDNCLIENT\] 中文上网  
O21 - SSODL: nvwi - \{D0A6302C-859C-471E-9082-6B865C0ACAA2\} - C:/PROGRA~1/muvh/nvwi.dll  
O23 - Service: 7A04BC6 - Unknown owner - C:/WINDOWS/System32/7A04BC6.EXE (file missing)  
O23 - Service: D0622BED - Unknown owner - C:/WINDOWS/System32/D0622BED.EXE (file missing)  
O23 - Service: sdhcvs (edfscv) - Unknown owner - C:/WINDOWS/System32/fgdfsdf.exe (file missing)  
O23 - Service: KXAgent Service (KXAgentService) - SmartDove - C:/Program Files/LLJAgent/KXAgentS.exe

O23 - Service: Net Event - Unknown owner - C:/WINDOWS/system32/netevent.exe  
O23 - Service: REM0TE REGISTRY (REM0TEREGISTRY) - Unknown owner - C:/WINDOWS/system/REM0REG.EXE

O23 - Service: Messaging (Remote Procedure) - Unknown owner - C:/WINDOWS/system32/explorcr.exe

O23 - Service: Service Transaction Provisioning (Transaction\_Service) - Unknown owner - C:/WINDOWS/System32/explorer.exe  
O23 - Service: Windows Login - Unknown owner - C:/WINDOWS/System32/mslogin.exe  
O23 - Service: Windows Management Instrumentation Driver (WMID) - Unknown owner - C:/WINDOWS/System32/wmid.exe

[http_endurer.bokee.com_6171794.html]: http://endurer.bokee.com/6171794.html
[http_blog.csdn.net_Purpleendurer_archive_2007_03_19_1534201.aspx]: http://blog.csdn.net/Purpleendurer/archive/2007/03/19/1534201.aspx
[http_blog.sina.com.cn_u_49926d91010007zy]: http://blog.sina.com.cn/u/49926d91010007zy
[http_blog.i0778.com_1314_action_viewspace_itemid_2795.html]: http://blog.i0778.com/?1314/action_viewspace_itemid_2795.html