遭遇 zgtwfx.dll,DesktopWin.dll
endurer 原创
2008-07-31 第1版
一位网友说他的电脑中标了,运行任一程序AntiVir都会报告发现病毒。请偶帮助检修。
用 pe_xscan 扫描 log 并分析,发现如下可疑项:
pe_xscan 08-07-29 by Purple Endurer
2008-7-30 21:49:38
Windows XP Service Pack 2(5.1.2600)
MSIE:6.0.2900.2180
管理员用户组
正常模式
C:/WINDOWS/Explorer.EXE * 1584|2004-8-17 4:0:0 | Microsoft(R) Windows(R) Operating System | 6.00.2900.3156 | Windows Explorer | (C) Microsoft Corporation. All rights reserved. | 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234) | Microsoft Corporation| ? | explorer | EXPLORER.EXE
C:/WINDOWS/system32/zgtwfx.dll
C:/Program Files/Avira/AntiVir PersonalEdition Classic/avgnt.exe * 1724|2008-6-2 4:24:47 | AntiVir Workstation | 8.00.70.02 | Antivirus System Tray Tool | Copyright ? 2008 Avira GmbH. All rights reserved. | 8.00.70.02 | Avira GmbH | AntiVir? is a registered trademark of Avira GmbH, Germany. | avsystray.exe | avgnt.exe
C:/WINDOWS/system32/zgtwfx.dll
C:/WINDOWS/System32/ctfmon.exe * 1732|2004-8-17 4:0:0 | Microsoft? Windows? Operating System | 5.1.2600.2180 | CTF Loader | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | CTFMON | CTFMON.EXE
C:/WINDOWS/system32/zgtwfx.dll
O21 - SSODL - DesktopWin(-) - {DA191DE0-AA86-4ED0-4B87-292A3D48BE99} = C:/WINDOWS/AppPatch/DesktopWin.dll
O24 - ShlExecHook: [MICROSOFT] - {006CA8A1-61BC-4774-A54C-F49034270BAD} = C:/WINDOWS/system32/zgtwfx.dll
在pe_xscan 扫描的过程中,AntiVir弹出病毒提示框,偶选择rename,就清静了。
下载 瑞星卡卡安全助手,删除病毒启动项。
重启电脑,运行程序,AntiVir不再报告发现病毒了。