Trojan.qeneric——这到底是个什么东西？

.Mca883 这个东西我已经搞了三天了，卡吧可以查出来，但是处理不掉，那位朋友知道请帮个忙，感谢再感谢！ [code]2007-01-02,10:35:03 System Repair Engineer 2.3.13.690 Smallfrogs (http://www.KZTechs.com) Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能 以下内容被选中： 　 　 所有的启动项目（包括注册表、启动文件夹、服务等） 　 　 浏览器加载项 　 　 正在运行的进程（包括进程模块信息） 　 　 文件关联 　 　 Winsock 提供者 　 　 Autorun.inf 　 　 HOSTS 文件 启动项目 注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] 　 　 ＜ctfmon.exe＞＜C:\WINDOWS\system32\ctfmon.exe＞　[(Verified)Microsoft Corporation] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] 　 　 ＜load＞＜＞　[N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] 　 　 ＜IMJPMIG8.1＞＜＂C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE＂ /Spoil /RemAdvDef /Migration32＞　[(Verified)Microsoft Corporation] 　 　 ＜PHIME2002ASync＞＜C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC＞　[(Verified)Microsoft Corporation] 　 　 ＜PHIME2002A＞＜C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName＞　[(Verified)Microsoft Corporation] 　 　 ＜High Definition Audio Property Page Shortcut＞＜HDAShCut.exe＞　[(Verified)Windows (R) Server 2003 DDK provider] 　 　 ＜RTHDCPL＞＜RTHDCPL.EXE＞　[(Verified)Realtek Semiconductor Corp.] 　 　 ＜SkyTel＞＜SkyTel.EXE＞　[(Verified)Realtek Semiconductor Corp.] 　 　 ＜Alcmtr＞＜ALCMTR.EXE＞　[(Verified)Realtek Semiconductor Corp.] 　 　 ＜0223761167193649mcinstcleanup＞＜C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\022376~1.EXE C:\PROGRA~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog＞　[N/A] 　 　 ＜kav＞＜＂D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe＂＞　[Kaspersky Lab] ; 　 　 ＜StormCodec_Helper＞＜＂d:\Program Files\Ringz Studio\Storm Codec\StormSet.exe＂ /S /opti＞　[N/A] 　 　 ＜Torjan Program＞＜C:\WINDOWS\SERVICES.EXE＞　[Xcd] 　 　 ＜navpens＞＜C:\Program Files\Common Files\3.exe＞　[N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 　 　 ＜twin＞＜C:\WINDOWS\system32\twunk32.exe＞　[N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 　 　 ＜shell＞＜Explorer.exe＞　[(Verified)Microsoft Corporation] 　 　 ＜Userinit＞＜C:\WINDOWS\system32\userinit.exe,＞　[(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] 　 　 ＜AppInit_DLLs＞＜＞　[N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 　 　 ＜UIHost＞＜logonui.exe＞　[(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] 　 　 ＜{08315C1A-9BA9-4B7C-A432-26885F78DF28}＞＜C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp＞　[N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\DfLogon] 　 　 ＜WinlogonNotify: DfLogon＞＜LogonDll.dll＞　[N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon] 　 　 ＜WinlogonNotify: klogon＞＜C:\WINDOWS\system32\klogon.dll＞　[Kaspersky Lab] ================================== 启动文件夹 [Adobe Reader Speed Launch] 　＜C:\Documents and Settings\All Users.WINDOWS\「开始」菜单\程序\启动\Adobe Reader Speed Launch.lnk --＞ D:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE [Adobe Systems Incorporated]＞＜N＞ ================================== 服务 [Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start] 　＜C:\WINDOWS\system32\Ati2evxx.exe＞＜ATI Technologies Inc.＞

本文来自 www.dngz.net

[卡巴斯基反病毒6.0 / AVP][Stopped/Auto Start] 　＜＂D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe＂ -r＞＜Kaspersky Lab＞ [DF5Serv / DF5Serv][Running/Auto Start] 　＜C:\Program Files\Faronics\Deep Freeze\Install C-0\DF5Serv.exe＞＜Faronics Corporation＞ [Human Interface Device Access / HidServ][Stopped/Disabled] 　＜C:\WINDOWS\System32\svchost.exe -k netsvcs--＞%SystemRoot%\System32\hidserv.dll＞＜N/A＞ ================================== 驱动程序 [ati2mtag / ati2mtag][Running/Manual Start] 　＜system32\DRIVERS\ati2mtag.sys＞＜ATI Technologies Inc.＞ [Microsoft UAA Function Driver for High Definition Audio Service / HdAudAddService][Stopped/Manual Start] 　＜system32\drivers\HdAudio.sys＞＜Windows (R) Server 2003 DDK provider＞ [Microsoft UAA Bus Driver for High Definition Audio / HDAudBus][Running/Manual Start] 　＜system32\DRIVERS\HDAudBus.sys＞＜Windows (R) Server 2003 DDK provider＞

[Service for Realtek HD Audio (WDM) / IntcAzAudAddService][Running/Manual Start] 　＜system32\drivers\RtkHDAud.sys＞＜Realtek Semiconductor Corp.＞ [kl1 / kl1][Running/Boot Start] 　＜\SystemRoot\system32\drivers\kl1.sys＞＜Kaspersky Lab＞ [klif / klif][Running/System Start] 　＜\？\C:\WINDOWS\system32\drivers\klif.sys＞＜Kaspersky Lab＞ [Padus ASPI Shell / pfc][Running/Manual Start] 　＜system32\drivers\pfc.sys＞＜Padus, Inc.＞ [Direct Parallel Link Driver / Ptilink][Running/Manual Start] 　＜system32\DRIVERS\ptilink.sys＞＜Parallel Technologies, Inc.＞ [Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver / RTLE8023xp][Running/Manual Start] 　＜system32\DRIVERS\Rtenicxp.sys＞＜Realtek Semiconductor Corporation＞ [Secdrv / Secdrv][Stopped/Manual Start] 　＜system32\DRIVERS\secdrv.sys＞＜N/A＞ ================================== 浏览器加载项

(www.dngz.net)为您排除一切电脑故障

[Adobe PDF Reader Link Helper] 　{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} ＜D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated＞ [Thunder Browser Helper] 　{889D2FEB-5411-4565-8998-1DD2C5261283} ＜d:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_006.dll, Thunder Networking Technologies,LTD＞ [启动迅雷5] 　{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} ＜d:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD＞ [Web反病毒保护] 　{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} ＜D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll, Kaspersky Lab＞ [Messenger] 　{FB5F1910-F110-11d2-BB9E-00C04F795683} ＜C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation＞ [Yahoo! Companion BHO] 　{02478D38-C3F9-4EFB-9B51-7695ECA05670} ＜, N/A＞ [Adobe PDF Reader Link Helper] 　{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} ＜D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated＞ [Windows Media Player] 　{22D6F312-B0F6-11D0-94AB-0080C74C7E95} ＜C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation＞ [Thunder Browser Helper] 　{889D2FEB-5411-4565-8998-1DD2C5261283} ＜d:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_006.dll, Thunder Networking Technologies,LTD＞ [SearchAssistantOC] 　{B45FF030-4447-11D2-85DE-00C04FA35C89} ＜%SystemRoot%\system32\shdocvw.dll, N/A＞ [AUDIO__MID Moniker Class] 　{CD3AFA74-B84F-48F0-9393-7EDC34128127} ＜C:\WINDOWS\system32\wmp.dll, Microsoft Corporation＞ [Shockwave Flash Object] 　{D27CDB6E-AE6D-11CF-96B8-444553540000} ＜C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.＞ [＆使用迅雷下载] 　＜d:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A＞ [＆使用迅雷下载全部链接] 　＜d:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A＞

www.dngz.net

[上传到QQ网络硬盘] 　＜D:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A＞ [添加到QQ自定义面板] 　＜D:\Program Files\Tencent\QQ\AddPanel.htm, N/A＞ [添加到QQ表情] 　＜D:\Program Files\Tencent\QQ\AddEmotion.htm, N/A＞ [用QQ彩信发送该图片] 　＜D:\Program Files\Tencent\QQ\SendMMS.htm, N/A＞ ================================== 正在运行的进程 [PID: 2032][C:\WINDOWS\RTHDCPL.EXE]　[Realtek Semiconductor Corp., 2.0.6.6] 　 　 [C:\WINDOWS\SYSTEMKEY.DLL]　[N/A, N/A] 　 　 [C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp]　[N/A, N/A] [PID: 240][C:\WINDOWS\system32\ctfmon.exe]　[Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] 　 　 [C:\WINDOWS\SYSTEMKEY.DLL]　[N/A, N/A] 　 　 [C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp]　[N/A, N/A] [PID: 1996][C:\WINDOWS\system32\wscntfy.exe]　[Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] 　 　 [C:\WINDOWS\SYSTEMKEY.DLL]　[N/A, N/A] 　 　 [C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp]　[N/A, N/A] [PID: 2532][C:\Program Files\Internet Explorer\IEXPLORE.EXE]　[Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] 　 　 [D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll]　[Adobe Systems Incorporated, 7.0.7.2006011200] 　 　 [d:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_006.dll]　[Thunder Networking Technologies,LTD, 5, 0, 0, 3] 　 　 [C:\WINDOWS\SYSTEMKEY.DLL]　[N/A, N/A] 　 　 [C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp]　[N/A, N/A] [PID: 2876][C:\Program Files\Internet Explorer\IEXPLORE.EXE]　[Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] 　 　 [C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp]　[N/A, N/A] 　 　 [D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll]　[Adobe Systems Incorporated, 7.0.7.2006011200] dngz.net您的电脑医生 　 　 [d:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_006.dll]　[Thunder Networking Technologies,LTD, 5, 0, 0, 3] 　 　 [C:\WINDOWS\SYSTEMKEY.DLL]　[N/A, N/A] [PID: 2908][C:\Program Files\Common Files\3.exe]　[, ] 　 　 [C:\WINDOWS\SYSTEMKEY.DLL]　[N/A, N/A] 　 　 [C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp]　[N/A, N/A] [PID: 3088][C:\WINDOWS\system32\conime.exe]　[Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] 　 　 [C:\WINDOWS\SYSTEMKEY.DLL]　[N/A, N/A] 　 　 [C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp]　[N/A, N/A] [PID: 3444][C:\WINDOWS\explorer.exe]　[Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] 　 　 [C:\WINDOWS\SYSTEMKEY.DLL]　[N/A, N/A] 　 　 [D:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll]　[Adobe Systems, Inc., 7.0.0.0] 　 　 [D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll]　[Adobe Systems Incorporated, 7.0.7.2006011200] 　 　 [d:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_006.dll]　[Thunder Networking Technologies,LTD, 5, 0, 0, 3] 　 　 [C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp]　[N/A, N/A] [PID: 3632][D:\应用软件\sreng2\SREng.EXE]　[Smallfrogs Studio, 2.3.13.690] 　 　 [C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp]　[N/A, N/A] 　 　 [C:\WINDOWS\SYSTEMKEY.DLL]　[N/A, N/A] [PID: 3688][D:\Program Files\GOSURF2\gsfbwsr.exe]　[mmjd.com, 2.62.508.6225] 　 　 [C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp]　[N/A, N/A] 　 　 [C:\WINDOWS\SYSTEMKEY.DLL]　[N/A, N/A] 　 　 [D:\Program Files\GOSURF2\Library\pictures.dll]　[N/A, N/A] 　 　 [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scr_ch_pg.dll]　[Kaspersky Lab, 1.0.6.299] 　 　 [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\klscav.dll]　[Kaspersky Lab, 6.0.0.299]

.

　 　 [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll]　[Kaspersky Lab, 6.0.0.299] ================================== 文件关联 .TXT　OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE　OK. [＂%1＂ %*] .COM　OK. [＂%1＂ %*] .PIF　OK. [＂%1＂ %*] .REG　OK. [regedit.exe ＂%1＂] .BAT　OK. [＂%1＂ %*] .SCR　OK. [＂%1＂ /S] .CHM　OK. [＂C:\WINDOWS\hh.exe＂ %1] .HLP　OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI　OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .INF　OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS　OK. [%SystemRoot%\System32\WScript.exe ＂%1＂ %*] .JS　 　OK. [%SystemRoot%\System32\WScript.exe ＂%1＂ %*] .LNK　OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf

N/A ================================== HOSTS 文件 127.0.0.1　 　 　 localhost ================================== API HOOK 警告！System Repair Engineer 提醒 你下面的函数内容与预期值不符，他 们可能被一些恶意的软件所修改： 入口点错误：NtQuerySystemInformation 入口点错误：NtTerminateProcess 入口点错误：ZwTerminateProcess 入口点错误：RegEnumKeyExA 入口点错误：RegEnumKeyExW 入口点错误：FindNextFileA 入口点错误：FindNextFileW RVA　错误： LoadLibraryA RVA　错误： LoadLibraryExA RVA　错误： LoadLibraryExW RVA　错误： LoadLibraryW ==================================[/code]

木马病毒```，特洛码伊病毒。

如何摆平？ 请赐教！

注册表[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]中删除： ＜0223761167193649mcinstcleanup＞＜C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\022376~1.EXE C:\PROGRA~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog＞　[N/A] (www.dngz.net)为您排除一切电脑故障 　 　 ＜Torjan Program＞＜C:\WINDOWS\SERVICES.EXE＞　[Xcd]（可参看http://www.dngz.net/bbs/thread-55244-6-1.html 77楼） 　 　 ＜navpens＞＜C:\Program Files\Common Files\3.exe＞　[N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]中删除：　 　 ＜twin＞＜C:\WINDOWS\system32\twunk32.exe＞　[N/A] 然后重启清空所有临时文件夹，删除对应的文件； 这两个文件： [C:\WINDOWS\SYSTEMKEY.DLL]　[N/A, N/A]这个没查，哪个里程也有，肯定不是好东西； [C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp]　[N/A, N/A] 两个对应文件及其注册表项目都删除，不能删除的用Icesword删； 也可百度一下，看看有无具体的对付方法； 最后那个警告，对新版SREng的这个功能还不熟悉，不知能不能自动修复

谢谢楼上的，已经摆平了。 现在做了GHOST，比较方便了。呵呵 再次感谢！