中毒症状：电脑莫名重启
病毒把windows目录下的explorer.exe复制到了system32目录下，不清楚是否已被病毒感染；在windows目录下建立了假的ctfmon.exe和svchost.exe，真品在system32目录下，而且文件大小也不一致。其他一大堆小喽啰文件见下面的列表中。
该windows目录下的scfmon.exe&svchost.exe 和 system32目录下的explorer.exe文件在安全模式下也不容易清理，须使用冰刃等工具。
autoruns记录中的病毒信息，可以使用autoruns清理,也可依此手动清理注册表
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
+ Explorer.exe,ysv15.exe Windows Explorer Microsoft Corporation c:\windows\system32\explorer.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
+ midimaptl Microsoft MIDI Mapper Plugin Microsoft Corporation c:\windows\system32\midimaptl.dll
+ midimapwd Microsoft MIDI Mapper Plugin Microsoft Corporation c:\windows\system32\midimapwd.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
+ apfocdet.dll c:\windows\system32\apfocdet.dll
+ cedafb.dll c:\windows\system32\cedafb.dll
+ hhrdxd.dll c:\windows\system32\hhrdxd.dll
+ jdsaex.dll c:\windows\system32\jdsaex.dll
+ jhrcar.dll c:\windows\system32\jhrcar.dll
+ midimaptl.dll Microsoft MIDI Mapper Plugin Microsoft Corporation c:\windows\system32\midimaptl.dll
+ midimapwd.dll Microsoft MIDI Mapper Plugin Microsoft Corporation c:\windows\system32\midimapwd.dll
+ mndhddwd.dll c:\windows\system32\mndhddwd.dll
+ mndsfsrv.dll c:\windows\system32\mndsfsrv.dll
+ mnmhfsrv.dll c:\windows\system32\mnmhfsrv.dll
+ mpmydapi.dll c:\windows\system32\mpmydapi.dll
+ nhmxbjkl.dll c:\windows\system32\nhmxbjkl.dll
+ pedadt.dll c:\windows\system32\pedadt.dll
+ rfdswc.dll c:\windows\system32\rfdswc.dll
+ sgrefg.dll c:\windows\system32\sgrefg.dll
+ wrqszl.dll c:\windows\system32\wrqszl.dll
+ yxcschlp.dll c:\windows\system32\yxcschlp.dll
+ zdesfx.dll c:\windows\system32\zdesfx.dll
+ zgfdet.dll c:\windows\system32\zgfdet.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
+ {27AC9076-C898-B098-D098-A18319080972} c:\windows\system32\nhmxbjkl.dll
+ {35671234-7890-ABCD-CDEF-567801237653} c:\windows\system32\yxcschlp.dll
+ {3E035987-F585-68D1-AC28-98FA58E459E3} c:\windows\system32\apfocdet.dll
+ {4629FF4F-ACDB-5C90-A098-FACB3456A264} c:\windows\system32\mpmydapi.dll
+ {4C648541-1025-9650-9057-6541258720C4} c:\windows\system32\mndhddwd.dll
+ {67FD640A-158F-48AC-FD14-1597F14A9776} c:\windows\system32\mndsfsrv.dll
+ {6C8D1401-A58D-A81C-CD24-A5915C4517C6} c:\windows\system32\mnmhfsrv.dll
HKLM\System\CurrentControlSet\Services
+ axd214fo File not found: C:\WINDOWS\System32\Drivers\axd214fo.sys
+ HiddFldy c:\windows\system32\d32dx9.sys
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls
+ nhmxbjkl.dll c:\windows\system32\nhmxbjkl.dll
+ SysDaJHv.dll Windows XP MSPLAY API DLL Microsoft Corporation c:\windows\system32\sysdajhv.dll
+ SysWmWacz.dll Windows XP MSPLAY API DLL Microsoft Corporation c:\windows\system32\syswmwacz.dll
+ SysZxacC.dll Windows XP MSPLAY API DLL Microsoft Corporation c:\windows\system32\syszxacc.dll
补充SREng记录中的隐藏进程
隐藏进程
[2472] C:\WINDOWS\system32\dlod15.exe
两个位于C:\windows\目录下的病毒体，假冒scvhost.exe和ctfmon.exe
[C:\WINDOWS\svchost.exe] [Microsoft Corporation, 6, 0, 2900, 2180]
MD5值：f09dcd72f53931d3946fcfa384d7c51a
文件大小：976896Byte
C:\WINDOWS\ctfmon.exe
MD5值：a52619ae2702506a346888db5768bdeb
文件大小：5076Byte
C:\windows\system32目录下的病毒体
C:\windows\system32\的目录
2004-08-08 11:20 535,560 apfocdet.dll
2008-06-01 11:20 23,648 biuw13.exe
2008-06-01 11:20 23,444 bwbz8.exe
2008-06-01 11:21 225,792 cedafb.dll
2008-06-01 11:21 6,592 d32dx9.sys
2008-06-01 11:21 23,724 dlod15.exe
2008-06-01 10:43 23,444 eytr8.exe
2004-08-08 11:20 520 gpfoadet.sys
2004-08-08 11:20 520 gsdhadwd.sys
2008-06-01 11:20 232,960 hhrdxd.dll
2004-08-08 11:21 14,979 isdsasrv.exe
2004-08-08 11:20 17,465 ismhasrv.exe
2008-06-01 11:21 215,040 jdsaex.dll
2008-06-01 11:21 218,624 jhrcar.dll
2004-08-08 11:20 15,674 lpfoadet.exe
2004-08-08 11:21 15,666 lpmxajkl.exe
2001-06-01 11:20 288 midimaptl.dat
2001-06-01 11:20 20,768 midimaptl.dll
2001-06-01 11:20 288 midimapwd.dat
2001-06-01 11:20 21,792 midimapwd.dll
2004-08-08 11:20 536,072 mndhddwd.dll
2004-08-08 11:21 533,512 mndsfsrv.dll
2004-08-08 11:20 538,120 mnmhfsrv.dll
2004-08-08 11:20 535,560 mpmydapi.dll
2004-08-08 11:21 535,560 nhmxbjkl.dll
2008-06-01 10:27 23,648 nkjj13.exe
2008-06-01 11:21 225,792 pedadt.dll
2008-06-01 11:15 67,990 perfc009.dat
2008-06-01 11:15 431,832 perfh009.dat
2004-08-08 11:20 16,344 pldhadwd.exe
2008-06-01 10:27 23,444 pnru8.exe
2008-06-01 11:15 181,510 prfc0804.dat
2008-06-01 11:15 359,366 prfh0804.dat
2008-06-01 10:44 23,648 rcqw13.exe
2008-06-01 11:21 250,880 rfdswc.dll
2004-08-08 11:21 520 rnmxajkl.sys
2008-06-01 11:20 218,624 sgrefg.dll
2004-08-08 11:20 15,959 simyaapi.exe
2004-08-08 11:21 520 smdsbsrv.sys
2004-08-08 11:20 520 smmhbsrv.sys
2004-08-08 11:20 520 spmybapi.sys
2008-06-01 11:20 19,113 SysDaJHv.dll
2008-06-01 11:20 18,714 SysWmWacz.dll
2008-06-01 11:20 18,888 SysZxacC.dll
2008-06-01 10:44 23,724 uysv15.exe
2008-06-01 10:26 2,206 wpa.dbl
2008-06-01 11:21 225,792 wrqszl.dll
2008-06-01 11:21 24 wymxajkl.sys
2008-06-01 10:43 23,284 xasr6.exe
2004-08-08 11:21 520 xzcsbhlp.sys
2004-08-08 11:21 533,512 yxcschlp.dll
2008-06-01 10:27 23,284 yydh6.exe
2008-06-01 11:20 218,624 zdesfx.dll
2008-06-01 11:20 229,376 zgfdet.dll
2008-06-01 11:20 23,284 zmph6.exe
2004-08-08 11:21 14,915 zxcsahlp.exe
2004-08-08 10:44 14,915 zxcsahlp.exe
上面的文件不一定完全对应，大部分都是隐藏的，还加了系统属性。还有你应该根据你中毒的时间搜寻出 这些个文件，一般中一次所中的病毒体文件的创建时间应该是一致的。注意，不是所有的病毒体创建日期都一致，但是如果你确定了一个病毒体，那么与这个病毒体创建时间一致的文件都要注意了。
发表于 @ 2008年06月01日 15:14:00|评论(loading...)|编辑