返回信息流发现
nod32和avg查出两个木马,是
C:\WINDOWS\system32\wbz9.dll Win32/TrojanDownloader.Agent.NPO 木马
和C:\WINDOWS\system32\rundllforour.exe
清除
用unlocker和avg成功删除,重启后也没有再出现.重新扫描c:,也没再发现病毒和木马.
但是每次系统正常登录会报错,rundll加载C:\WINDOWS\system32\wbz9.dll失败.
问题
系统运行正常,除了启动登录时比平时慢,会报错.
1搜索注册表wbz,无此键值,搜索rundllforour,发现在一个mobill的项里有.更改键值.没删,因为同时还有键值C:\WINDOWS\SYSTEM32\WBEM\SYUNP.DLL,DllRegisterServer 1087
不知道是不是系统键值.
2检查msconfig,没有此项.
3选择诊断启动,依旧报错,但使用安全模式登录不会报错.
4搜索c: rundllforour,wbz不存在
使用IceSword ,autoruns,sreng没有发现异常启动项,大概是自己太菜了,用的不好.
不想重装,盼各位大牛解答.[em24]
这是一条镜像帖。来源：北邮人论坛 / security / #12602同步于 2007/7/15
该镜像源已超过 30 天没有更新，可能在源站已被删除。
Security机器人发帖
已清除木马,但登录时rundll加载错误
antique
2007/7/15镜像同步11 回复
订阅后，新回复会通过你的通知中心匿名送达。
9 条回复
这是扫描日志
Logfile of HijackThis v1.99.1
Scan saved at 17:26:07, on 2007-7-15
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
E:\setup\ha-hdtune 2.53-kz\HDTune.exe
C:\Program Files\TheWorld 2.0\TheWorld.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
E:\setup\HijackThis.exe
O2 - BHO: Thunder AtOnce - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll
O2 - BHO: ThunderBHO - {06849E9E-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [hkss] C:\Program Files\Compaq\Hotkey Software\hkss.exe
O4 - HKLM\..\Run: [Cpqset] c:\compaq\cpqsetup\cpqset.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Google IME Autoupdater] ; C:\Program Files\Google\Google Pinyin\GooglePinyinDaemon.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - Startup: 快捷方式 到 HDTune.exe.lnk = E:\setup\ha-hdtune 2.53-kz\HDTune.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: 使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\geturl.htm
O8 - Extra context menu item: 使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\getallurl.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O18 - Protocol: dynascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
发现以administrators组成员登录时会报这个错,以guest登录不会.诡异~~~
不知道administrators组成员rundll32加载和guest有什么区别~~
1.HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\MOBILL
EventMessageFile的键值为 C:\WINDOWS\SYSTEM32\WBEM\ rundllforour C:\WINDOWS\SYSTEM32\WBEM\SYUNP.DLL,DllRegisterServer 1087
2.HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MOBILL
ImagePath的键值为 C:\WINDOWS\SYSTEM32\WBEM\ rundllforour C:\WINDOWS\SYSTEM32\WBEM\SYUNP.DLL,DllRegisterServer 1087
3.HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\Application\MOBILL EventMessageFile同上
4.HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\MOBILL ImagePath同上
5.HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\MOBILL EventMessageFile同上
6.HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MOBILL ImagePath同上
【 在 rebirthatsix 的大作中提到: 】
: 把你搜到rundllforour的注册表全路径写出来
[em25]