刚才接到一位朋友的求助电话，说他的电脑上不了网了，瑞星监控小伞显示为黄色。用雅虎助手修复还是不行，请偶帮忙处理。
先看瑞星监控，发现是邮件监控无法启动。
再看网络，朋友的电脑采用的是局域网上网方式，ping 网关，可以ping通， www.163.com也可以ping通，但就是打不开网页。这样连 pe_xscan 等偶常用的软件都没法下载了。
好在上回帮他处理电脑问题时所用的 Hijackthis 还在，用它扫描 log，发现可疑项：
/--- Logfile of HijackThis v1.99.1 Scan saved at 12:23:43, on 2007-8-6 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) O10 - Broken Internet access because of LSP provider 'c:/windows/system32/mscomm.dll' O23 - Service: 5A8C7ABA - Unknown owner - C:/WINDOWS/system32/1F944EC3.EXE (file missing) ---/
原来是O10引起的，这个一般要用 LspFix 或 winsockfix 来修复，这两个工具都可以从 http://endurer.ys168.com 下载，可惜现在上不了网~
看到桌面上的卡卡安全助手，就用它试试。双击运行，居然还是3.2版本的，看来网友从来没使用过它，最新版本是4.0了，立即升级，提示网址错误~
选择[IE及系统修复]，发现有两项是红色显示的，内容正是 mscomm.dll， 修复~
打开 http://endurer.ys168.com，发现目录列表显示不出来，检查发现是 浏览器无法执行活动脚本，用 /rereg参数来启动IE，无效。还是用regsvr32 命令把 jscript.dll 和 vbscript.dll 注册了，才能正常显示。
先升级卡卡安全助手，再看瑞星杀毒软件，病毒库还是 07-31的，也升级，不料升级过程，来了个蓝屏错误~
只能重启电脑，发现网友电脑中的Administrator用户没设置密码~
进入桌面后，刚开始瑞星监控小伞是绿的，后来文件监控自动关闭，就变成红色的了，手动开启了所有监控，但不一会又变成红色的了，再次手动开启所有监控，接着瑞星就不断报告发现病毒
下载 pe_xscan 扫描 log 分析，发现可疑项：
/===
pe_xscan 07-07-24 by Purple Endurer
2007-8-6 12:56:59
Windows XP Service Pack 2(5.1.2600)
管理员用户组
[System Process] * 0 C:/WINDOWS/system32/k118636446310.DAT | 2007-8-6 12:43:8 C:/WINDOWS/system32/k118636446612.DAT | 2007-8-6 12:43:6 C:/WINDOWS/system32/k118636446511.DAT | 2007-8-6 12:43:6 C:/WINDOWS/system32/k11863644596.DAT | 2007-8-6 12:42:12 C:/WINDOWS/system32/k11863644618.DAT | 2007-8-6 12:42:6 C:/WINDOWS/system32/WinForm.dll | 2007-8-6 12:41:0 C:/WINDOWS/system32/cmdbcs.dll | 2007-8-6 12:43:7 C:/WINDOWS/system32/MsIMMs32.dll | 2007-8-6 12:42:7 C:/WINDOWS/system32/mppds.dll | 2007-8-6 12:41:1 C:/WINDOWS/system32/AVPSrv.dll | 2007-8-6 12:41:1 C:/WINDOWS/system32/Kvsc3.dll | 2007-8-6 12:41:0 C:/WINDOWS/system32/csrss.exe * 860 | 2004-8-23 16:0:0 | Microsoft? Windows? Operating System | 5.1.2600.2180 | Client Server Runtime Process | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | CSRSS.Exe | CSRSS.Exe C:/WINDOWS/system32/AF0D0E8E.DLL | 2007-8-6 12:40:11 | Microsoft(R) Windows(R) Operating System| ?| ? | (C) Microsoft Corporation. All rights reserved.| ? | Microsoft Corporation| ?| ?| ? C:/WINDOWS/system32/winlogon.exe * 948 | 2004-8-23 16:0:0 | Microsoft(R) Windows(R) Operating System | 5.1.2600.2180 | Windows NT Logon Application | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | winlogon | WINLOGON.EXE C:/WINDOWS/system32/AF0D0E8E.DLL | 2007-8-6 12:40:11 | Microsoft(R) Windows(R) Operating System| ?| ? | (C) Microsoft Corporation. All rights reserved.| ? | Microsoft Corporation| ?| ?| ? C:/WINDOWS/system32/A815A0F7.DLL | 2007-8-6 12:43:12 | Microsoft(R) Windows(R) Operating System| ?| ? | (C) Microsoft Corporation. All rights reserved.| ? | Microsoft Corporation| ?| ?| ? C:/WINDOWS/system32/services.exe * 1056 | 2004-8-23 16:0:0 | Microsoft(R) Windows(R) Operating System | 5.1.2600.2180 | Services and Controller app | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | services.exe | services.exe C:/WINDOWS/system32/AF0D0E8E.DLL | 2007-8-6 12:40:11 | Microsoft(R) Windows(R) Operating System| ?| ? | (C) Microsoft Corporation. All rights reserved.| ? | Microsoft Corporation| ?| ?| ? C:/WINDOWS/system32/lsass.exe * 1084 | 2004-8-23 16:0:0 | Microsoft? Windows? Operating System | 5.1.2600.2180 | LSA Shell (Export Version) | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | lsass.exe | lsass.exe C:/WINDOWS/system32/AF0D0E8E.DLL | 2007-8-6 12:40:11 | Microsoft(R) Windows(R) Operating System| ?| ? | (C) Microsoft Corporation. All rights reserved.| ? | Microsoft Corporation| ?| ?| ? C:/WINDOWS/system32/svchost.exe * 1324 | 2004-8-23 16:0:0 | Microsoft? Windows? Operating System | 5.1.2600.2180 | Generic Host Process for Win32 Services | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | svchost.exe | svchost.exe C:/WINDOWS/system32/AF0D0E8E.DLL | 2007-8-6 12:40:11 | Microsoft(R) Windows(R) Operating System| ?| ? | (C) Microsoft Corporation. All rights reserved.| ? | Microsoft Corporation| ?| ?| ? D:/Rising/Rav/CCenter.exe * 1584 | 2006-8-16 17:12:21 | Rising Antivirus Software | 18, 0, 0, 3 | CCenter | Copyright Rising 2002 | 18, 0, 0, 3 | Beijing Rising Technology Co., Ltd. | | Beijing Rising Technology Co., Ltd. | CCenter.exe C:/WINDOWS/System32/svchost.exe * 1600 | 2004-8-23 16:0:0 | Microsoft? Windows? Operating System | 5.1.2600.2180 | Generic Host Process for Win32 Services | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | svchost.exe | svchost.exe C:/WINDOWS/system32/AF0D0E8E.DLL | 2007-8-6 12:40:11 | Microsoft(R) Windows(R) Operating System| ?| ? | (C) Microsoft Corporation. All rights reserved.| ? | Microsoft Corporation| ?| ?| ? C:/WINDOWS/system32/svchost.exe * 1740 | 2004-8-23 16:0:0 | Microsoft? Windows? Operating System | 5.1.2600.2180 | Generic Host Process for Win32 Services | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | svchost.exe | svchost.exe C:/WINDOWS/system32/AF0D0E8E.DLL | 2007-8-6 12:40:11 | Microsoft(R) Windows(R) Operating System| ?| ? | (C) Microsoft Corporation. All rights reserved.| ? | Microsoft Corporation| ?| ?| ? C:/WINDOWS/system32/svchost.exe * 1860 | 2004-8-23 16:0:0 | Microsoft? Windows? Operating System | 5.1.2600.2180 | Generic Host Process for Win32 Services | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | svchost.exe | svchost.exe C:/WINDOWS/system32/AF0D0E8E.DLL | 2007-8-6 12:40:11 | Microsoft(R) Windows(R) Operating System| ?| ? | (C) Microsoft Corporation. All rights reserved.| ? | Microsoft Corporation| ?| ?| ? C:/WINDOWS/Explorer.EXE * 224 | 2004-8-23 16:0:0 | Microsoft(R) Windows(R) Operating System | 6.00.2900.2180 | Windows Explorer | (C) Microsoft Corporation. All rights reserved. | 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | explorer | EXPLORER.EXE C:/WINDOWS/system32/AF0D0E8E.DLL | 2007-8-6 12:40:11 | Microsoft(R) Windows(R) Operating System| ?| ? | (C) Microsoft Corporation. All rights reserved.| ? | Microsoft Corporation| ?| ?| ? C:/WINDOWS/system32/Kvsc3.dll | 2007-8-6 12:41:0 C:/WINDOWS/system32/WinForm.dll | 2007-8-6 12:41:0 C:/WINDOWS/system32/AVPSrv.dll | 2007-8-6 12:41:1 C:/WINDOWS/system32/mppds.dll | 2007-8-6 12:41:1 C:/WINDOWS/system32/k11863644618.DAT | 2007-8-6 12:42:6 C:/WINDOWS/system32/MsIMMs32.dll | 2007-8-6 12:42:7 C:/WINDOWS/system32/TIMHost.dll | 2007-8-6 12:42:11 C:/WINDOWS/system32/k11863644596.DAT | 2007-8-6 12:42:12 C:/WINDOWS/system32/k118636446511.DAT | 2007-8-6 12:43:6 C:/WINDOWS/system32/k118636446612.DAT | 2007-8-6 12:43:6 C:/WINDOWS/system32/cmdbcs.dll | 2007-8-6 12:43:7 C:/WINDOWS/system32/k118636446310.DAT | 2007-8-6 12:43:8 C:/WINDOWS/system32/A815A0F7.DLL | 2007-8-6 12:43:12 | Microsoft(R) Windows(R) Operating System| ?| ? | (C) Microsoft Corporation. All rights reserved.| ? | Microsoft Corporation| ?| ?| ? C:/WINDOWS/system32/ctfmon.exe * 1516 | 2004-8-23 16:0:0 | Microsoft? Windows? Operating System | 5.1.2600.2180 | CTF Loader | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | CTFMON | CTFMON.EXE C:/WINDOWS/system32/WinForm.dll | 2007-8-6 12:41:0 C:/WINDOWS/system32/k11863644596.DAT | 2007-8-6 12:42:12 C:/WINDOWS/system32/k11863644618.DAT | 2007-8-6 12:42:6 C:/WINDOWS/system32/conime.exe * 3800 | 2004-8-23 16:0:0 | Microsoft? Windows? Operating System | 5.1.2600.2180 | Console IME | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | Console | CONIME.EXE C:/WINDOWS/system32/k11863644596.DAT | 2007-8-6 12:42:12 C:/WINDOWS/system32/k11863644618.DAT | 2007-8-6 12:42:6 C:/WINDOWS/system32/WinForm.dll | 2007-8-6 12:41:0 C:/WINDOWS/system32/k118636446511.DAT | 2007-8-6 12:43:6 C:/WINDOWS/system32/k118636446310.DAT | 2007-8-6 12:43:8 C:/WINDOWS/system32/k118636446612.DAT | 2007-8-6 12:43:6 C:/WINDOWS/system32/6BD3F1DC.exe * 2064 | 2007-8-6 12:43:12 C:/WINDOWS/system32/6BD3F1DC.exe | 2007-8-6 12:43:12 C:/WINDOWS/system32/k118636446310.DAT | 2007-8-6 12:43:8 C:/WINDOWS/system32/k118636446612.DAT | 2007-8-6 12:43:6 C:/WINDOWS/system32/k118636446511.DAT | 2007-8-6 12:43:6 C:/WINDOWS/system32/k11863644596.DAT | 2007-8-6 12:42:12 C:/WINDOWS/system32/k11863644618.DAT | 2007-8-6 12:42:6 C:/WINDOWS/system32/WinForm.dll | 2007-8-6 12:41:0 C:/WINDOWS/system32/cmdbcs.dll | 2007-8-6 12:43:7 C:/WINDOWS/system32/MsIMMs32.dll | 2007-8-6 12:42:7 C:/WINDOWS/system32/mppds.dll | 2007-8-6 12:41:1 C:/WINDOWS/system32/AVPSrv.dll | 2007-8-6 12:41:1 C:/WINDOWS/system32/Kvsc3.dll | 2007-8-6 12:41:0 C:/WINDOWS/system32/nslookupi.exe * 2584 | 2007-8-6 12:44:30 C:/WINDOWS/system32/k118636446310.DAT | 2007-8-6 12:43:8 C:/WINDOWS/system32/k118636446612.DAT | 2007-8-6 12:43:6 C:/WINDOWS/system32/k118636446511.DAT | 2007-8-6 12:43:6 C:/WINDOWS/system32/k11863644596.DAT | 2007-8-6 12:42:12 C:/WINDOWS/system32/k11863644618.DAT | 2007-8-6 12:42:6O4 - HKLM/../Run: [WinForm] C:/WINDOWS/WinForm.exe O4 - HKLM/../Run: [Kvsc3] C:/WINDOWS/Kvsc3.exe O4 - HKLM/../Run: [AVPSrv] C:/WINDOWS/AVPSrv.exe O4 - HKLM/../Run: [mppds] C:/WINDOWS/mppds.exe O4 - HKLM/../Run: [MsIMMs32] C:/WINDOWS/MsIMMs32.exe O4 - HKLM/../Run: [cmdbcs] C:/WINDOWS/cmdbcs.exeC:/autorun.inf /----- [AutoRun] open=auto.exe shellexecute=auto.exe shell/Auto/command=auto.exe -----/ D:/autorun.inf /----- [AutoRun] open=auto.exe shellexecute=auto.exe shell/Auto/command=auto.exe -----/ E:/autorun.inf /----- [AutoRun] open=auto.exe shellexecute=auto.exe shell/Auto/command=auto.exe -----/ F:/autorun.inf /----- [AutoRun] open=auto.exe shellexecute=auto.exe shell/Auto/command=auto.exe -----/ G:/autorun.inf /----- [autorun] open=Launcher.exe icon=Launcher.exe -----/
