积极答复者
windows 7 Ultimate,杀毒软件经常提示c\users\name\appdata\Local\temp antivirus

问题
-
前几天在网上下载了一个网络软件,最近经常出现c\users\user name\appdata\Local\temp antivirus, 然后重启在安全模式下也删不掉,并且每次提示的文件名不一样,请问是否是中毒啦,该怎么清楚.
The antivirus event as below
Scan type: Auto-Protect Scan
Event: Risk Found!
Security risk detected: Trojan.Gen
File: C:\Users\user name\AppData\Local\Temp\DWH28.tmp
Location: C:\Users\user name\AppData\Local\Temp
Computer:summer User: user name
Action taken: Pending Side Effects Analysis : Access denied
Date found: 2011年7月11日 10:20:42
答案
-
如果希望手動查毒, 那麼你可以嘗試通過 handle 查看那個臨時文件是被什麼進程所有(也可通過 resmon, Process Explorer 進行).
Handle v3.46
如果拒絕訪問, 那麼你可以嘗試通過 psexec 提權到 SYSTEM 賬戶再進行查看.
如果查詢結果顯示是一個系統進程, 比如 svchost,
那麼你可以通過 tasklist 或 Process Explorer 查看該進程運行哪些服務和有哪些模塊,
然後通過 sc, msconfig, services.msc 或 Autoruns 禁用該服務, 並嘗試通過 handle 強行關閉那個臨時文件.
同時也建議你通過 Autoruns 查看啟動有無其他可疑項目, 比如隨系統自動啟動的程序.
http://technet.microsoft.com/en-us/sysinternals/bb896655
PsExec v1.98
http://technet.microsoft.com/en-us/sysinternals/bb897553
Process Explorer v14.12
http://technet.microsoft.com/en-us/sysinternals/bb896653
Autoruns for Windows v10.07
http://technet.microsoft.com/en-us/sysinternals/bb963902
Folding@Home- 已标记为答案 Leon Mong 2011年7月12日 9:23
全部回复
-
是个木马病毒,杀毒软件检测到的可能只是木马生成的马甲,具体藏在什么地方需要进行全盘扫描。--Alexis Zhanghttp://mvp.support.microsoft.com/profile/jiehttp://blogs.itecn.net/blogs/alexis推荐以 NNTP Bridge 桥接新闻组方式访问论坛以获取最佳用户体验。本帖是回复帖,原帖作者是楼上的 "Leon Mong"前几天在网上下载了一个网络软件,最近经常出现c\users\user name\appdata\Local\temp antivirus, 然后重启在安全模式下也删不掉,并且每次提示的文件?灰谎?请问是否是中毒啦,该怎么清楚.
-
如果希望手動查毒, 那麼你可以嘗試通過 handle 查看那個臨時文件是被什麼進程所有(也可通過 resmon, Process Explorer 進行).
Handle v3.46
如果拒絕訪問, 那麼你可以嘗試通過 psexec 提權到 SYSTEM 賬戶再進行查看.
如果查詢結果顯示是一個系統進程, 比如 svchost,
那麼你可以通過 tasklist 或 Process Explorer 查看該進程運行哪些服務和有哪些模塊,
然後通過 sc, msconfig, services.msc 或 Autoruns 禁用該服務, 並嘗試通過 handle 強行關閉那個臨時文件.
同時也建議你通過 Autoruns 查看啟動有無其他可疑項目, 比如隨系統自動啟動的程序.
http://technet.microsoft.com/en-us/sysinternals/bb896655
PsExec v1.98
http://technet.microsoft.com/en-us/sysinternals/bb897553
Process Explorer v14.12
http://technet.microsoft.com/en-us/sysinternals/bb896653
Autoruns for Windows v10.07
http://technet.microsoft.com/en-us/sysinternals/bb963902
Folding@Home- 已标记为答案 Leon Mong 2011年7月12日 9:23
-
你好,
我比较同意张兄的说法,建议你启动到安全模式下,并执行一个全盘扫描来查杀病毒。
如何启动到安全模式,请参考以下:
http://windows.microsoft.com/zh-cn/windows7/Start-your-computer-in-safe-mode
Please mark as "answer" if the problem have been solved, to help more friends find the solution.
Best Regards, Microsoft MVP, Rein Xu
https://mvp.support.microsoft.com/profile/Rein -
Process PID CPU Description Company Name
System Idle Process 0 51.99
System 4 0.89
Interrupts n/a 0.89 Hardware Interrupts and DPCs
smss.exe 280 Windows Session Manager Microsoft Corporation
csrss.exe 392 < 0.01 Client Server Runtime Process Microsoft Corporation
wininit.exe 452 Windows Start-Up Application Microsoft Corporation
services.exe 560 0.05 Services and Controller app Microsoft Corporation
svchost.exe 688 Host Process for Windows Services Microsoft Corporation
ProtectionUtilSurrogate.exe 384 0.49 Symantec AntiVirus Symantec Corporation
igfxsrvc.exe 2944 igfxsrvc Module Intel Corporation
wlcomm.exe 2196 0.01 Windows Live Communications Platform Microsoft Corporation
SavUI.exe 4536 Symantec AntiVirus Symantec Corporation
WmiPrvSE.exe 5732 WMI Provider Host Microsoft Corporation
dllhost.exe 4456 COM Surrogate Microsoft Corporation
svchost.exe 768 0.08 Host Process for Windows Services Microsoft Corporation
svchost.exe 840 Host Process for Windows Services Microsoft Corporation
audiodg.exe 4060 Windows Audio Device Graph Isolation Microsoft Corporation
svchost.exe 908 0.31 Host Process for Windows Services Microsoft Corporation
WUDFHost.exe 1072 Windows Driver Foundation - User-mode Driver Framework Host Process Microsoft Corporation
WUDFHost.exe 2480 Windows Driver Foundation - User-mode Driver Framework Host Process Microsoft Corporation
dwm.exe 2668 Desktop Window Manager Microsoft Corporation
svchost.exe 964 < 0.01 Host Process for Windows Services Microsoft Corporation
svchost.exe 880 Host Process for Windows Services Microsoft Corporation
Smc.exe 1120 0.83 Symantec CMC Smc Symantec Corporation
SmcGui.exe 2916 0.16 Symantec CMC SmcGui Symantec Corporation
ZhuDongFangYu.exe 1156 0.01 360主动防御服务模块 360.cn
svchost.exe 1192 0.02 Host Process for Windows Services Microsoft Corporation
ccSvcHst.exe 1296 0.05 Symantec Service Framework Symantec Corporation
spoolsv.exe 1484 < 0.01 Spooler SubSystem App Microsoft Corporation
svchost.exe 1516 Host Process for Windows Services Microsoft Corporation
svchost.exe 1588 Host Process for Windows Services Microsoft Corporation
AppleMobileDeviceService.exe 1804 < 0.01 MobileDeviceService Apple Inc.
mDNSResponder.exe 1840 Bonjour Service Apple Inc.
HZ_CommSrv.exe 1896 华大智宝USB KEY通讯服务 华大智宝电子系统有限公司
IcbcDaemon.exe 1944 < 0.01
svchost.exe 2004 Host Process for Windows Services Microsoft Corporation
svchost.exe 404 Host Process for Windows Services Microsoft Corporation
svchost.exe 1228 Host Process for Windows Services Microsoft Corporation
WDKeyMonitorCCB.exe 900 < 0.01 建行网银盾服务程序v3.2 Beijing WatchData System Co., Ltd.
svchost.exe 2036 Host Process for Windows Services Microsoft Corporation
svchost.exe 2352 Host Process for Windows Services Microsoft Corporation
taskhost.exe 3020 0.01 Host Process for Windows Tasks Microsoft Corporation
svchost.exe 636 0.01 Host Process for Windows Services Microsoft Corporation
SearchIndexer.exe 1628 < 0.01 Microsoft Windows Search Indexer Microsoft Corporation
SearchProtocolHost.exe 420 < 0.01 Microsoft Windows Search Protocol Host Microsoft Corporation
SearchFilterHost.exe 3692 Microsoft Windows Search Filter Host Microsoft Corporation
OSPPSVC.EXE 4792 Microsoft Office Software Protection Platform Service Microsoft Corporation
Rtvscan.exe 3132 0.02 Symantec AntiVirus Symantec Corporation
lsass.exe 568 0.01 Local Security Authority Process Microsoft Corporation
lsm.exe 576 0.02 Local Session Manager Service Microsoft Corporation
csrss.exe 464 1.04 Client Server Runtime Process Microsoft Corporation
conhost.exe 4356 < 0.01 Console Window Host Microsoft Corporation
winlogon.exe 508 Windows Logon Application Microsoft Corporation
explorer.exe 2736 0.58 Windows Explorer Microsoft Corporation
msnmsgr.exe 1860 0.01 Windows Live Messenger Microsoft Corporation
AliIM.exe 2476 0.06 AliWangWang Alibaba software (Shanghai) Corporation.
Foxmail.exe 2940 0.42 Internet Mail Client Tencent Inc.
SnagIt32.exe 2368 SnagIt 8 TechSmith Corporation
TscHelp.exe 4092 TechSmith HTML Help Helper TechSmith Corporation
SnagPriv.exe 3292 SnagIt RPC Helper TechSmith Corporation
OUTLOOK.EXE 716 0.40 Microsoft Outlook Microsoft Corporation
pcsws.exe 296 0.01 PCSWS.EXE IBM Corporation
pcscm.exe 5104 0.03 PCSCM.EXE IBM Corporation
iexplore.exe 4836 0.02 Internet Explorer Microsoft Corporation
iexplore.exe 3724 0.19 Internet Explorer Microsoft Corporation
iexplore.exe 5088 0.07 Internet Explorer Microsoft Corporation
iexplore.exe 5584 10.26 Internet Explorer Microsoft Corporation
iexplore.exe 6092 0.31 Internet Explorer Microsoft Corporation
ccApp.exe 3168 Symantec User Session Symantec Corporation
360Tray.exe 3176 0.24 360安全卫士 木马防火墙模块 360.cn
360Safe.exe 3080 0.53 360安全卫士 主程序 360.cn
CleanHelper64.exe 1832 360安全卫士 垃圾清理辅助模块 360.cn
DSMain.exe 1792 0.20 360安全卫士 程序加载模块 360.cn
procexp.exe 6056 Sysinternals Process Explorer Sysinternals - www.sysinternals.com
procexp64.exe 6080 29.74 Sysinternals Process Explorer Sysinternals - www.sysinternals.com
splwow64.exe 3800 Print driver host for 32bit applications Microsoft Corporation
Leon Mong- 已建议为答案 Sam2015 2013年8月8日 9:01
-
你可以通過 7-zip 等壓縮軟件從 Windows 7 安裝文件 install.wim 提取出 gathernetworkinfo.vbs, 然後進行比較.
7-zip 下載地址:
Folding@Home -
對於這個情況我覺得有三種可能,
一, 就是之前說的, 那個任務計劃新增了一個操作項. 如果那個計劃任務沒有刪除的話, 你可以查看確認.
二, vbs 的文件關聯被動過手腳. 你可以檢查一下註冊表項 HKCR\VBSFile
三, 或者 WScript.exe 被映像劫持了. 你可以檢查一下註冊表項"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"
是否存在子項
WScript.exe
如果有, 是否存在 Debugger 值.
Folding@Home -
1、该计划任务删除,在Autoruns工具里的Scheduled Tasks中已经看不到\Microsoft\windows\NeTrace\GatherNetwrokinfo, C:\windows\system32\gathernetworkinfo.vbs任务啦,另外有还有三个计划任务,前面都没打沟,应该不会有影响 第一个是\Microsoft\Windows live\soxe\extractor definitions update task,第二个是Sidebarexecute, Windows Desktop Gadgets,第三个是Skype,\(96B8382d-3ecf-4eoe-bbbd-d4a7519729d7)
2、VBEFile里面只有一个了项, FriendlyType Name,它的值是@%SystemRoot%\System32\wshext.dll,-4803
3、HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options不存在子项
如果有条件看能否远程看一下具体情况。
Leon Mong