终于搞掂Caepero.dll

这篇可能需要和 遇一中毒贼深的电脑 (trackback)配合使用。

File C:/WINDOWS/system32/Caepero.dll is infected by Win32:Zbot-D [Trj]
这是4个在system32目录下的病毒文件，

 

2004-08-17  12:00            18,944 Voesahit.sys
2004-08-17  12:00            10,752 Caepero.dll
2004-08-17  12:00            19,968 Zageso5.dll
2004-08-17  12:00            33,280 Sitonesa.dll 

 

除此之外，还有一个位于C:/Program Files/Internet Explorer/PLUGINS下，

 

2005-01-12  13:54            33,918 Sy_Win7k.Jmp
Wn_Sys8x.Sys（昨天已干掉 遇一中毒贼深的电脑 ）

 

另外，这个也不是什么好鸟C:/Program Files/Internet Explorer/

 

2005-01-08  14:21            24,202 IEXPLORE32.ime

 

还有C:/windows/system32/目录下还有若干可能存在的文件，mscat.dll   msdtc.dll   msscds32.dll。

 

Documents and Settings/All Users/Application Data/Microsoft/Media Player/sqmnoopt01.sqm
Documents and Settings/All Users/Application Data/Microsoft/Media Player/sqmnoopt02.sqm
Documents and Settings/All Users/Application Data/Microsoft/Media Player/sqmnoopt03.sqm
Documents and Settings/All Users/Application Data/Microsoft/Media Player/sqmnoopt04.sqm
Documents and Settings/All Users/Application Data/Microsoft/Media Player/sqmnoopt05.sqm

 

 

C:/SEHLog.txt
C:/UpdateLog.txt
C:/ManagerLog.txt
~tmp032434.exe
PopupAD.DLL

 

 注意把这个http://ahead.51down.cc网站屏蔽掉，用记事本打开C:/windows/system32/drivers/etc/HOSTS文件，添加一行“127.0.0.1    ahead.51down.cc ”不带引号哦。

Avast一直提示Caepero.dll是病毒，杀掉后，重启电脑就又有了，而且还添加到注册表项appInit_dlls中，Zageso5.dll和Sitonesa.dll 不提示，但这几个文件的创建时间和修改日期都一模一样，令人生疑，一定也是病毒了。不过总是杀不掉，没办法，遂怀疑其它地方还有病毒文件，但是system32，windows，drivers等等目录寻遍了也没找到，后来突然发现浏览器加载项中有个C:/Program Files/Internet Explorer/PLUGINS/Wn_Sys8x.Sys（昨天已干掉），网络上搜索了一下，这个Wn_Sys8x.Sys和Sy_Win7k.Jmp有很大关系，而这个Sy_Win7k.Jmp就在C:/Program Files/Internet Explorer/PLUGINS/下呢，一定是它了，杀。重启电脑，OK，平安无事了。

和前面干掉的那一堆 遇一中毒贼深的电脑 关系还挺大的，又是木马群。

Sy_Win7k.Jmp | 病毒大百科 注：毒霸上这个可能还不一样
恶意木马分析及清除：mscat1.dll,mci321.dll,mmtask1.dll,Proc.sys 注：coding_hello没有彻底解决
中了trojan-downloader.win32.zlob.crl木马，怎么都杀不了！注：arswp论坛上没有解决这个问题，我解决了。

这里还有一群逃过杀毒软件扫描的病毒和可疑文件，用我的眼睛就出来一部分：

2004-08-17  12:00            18,944 Voesahit.sys
2004-08-17  12:00            10,752 Caepero.dll
2004-08-17  12:00            19,968 Zageso5.dll
2004-08-17  12:00            33,280 Sitonesa.dll
2004-08-17  20:00            72,832 Regeroi.sys
2005-01-04  20:00           127,488 uboeza.dll
2005-01-04  20:00            28,672 ylfahj.dll
2005-01-04  20:00            26,112 gqwaln.dll
2005-01-04  20:00            28,672 thsbzq.dll
2005-01-04  20:00            27,136 qosvoi.dll
2005-01-04  20:00            26,624 vxlwak.dll
2005-01-04  20:00            26,112 luubyk.dll
2005-01-04  20:00            28,160 akanhk.dll
2005-01-05  20:30            26,112 mzosty.dll
2005-01-06  11:19           127,488 xohwem.dll
2005-01-06  11:19            28,672 eddfgm.dll
2005-01-06  11:19            26,112 zzdbmi.dll
2005-01-06  11:19            28,672 eilzzq.dll
2005-01-06  11:19            27,136 hwkike.dll
2005-01-06  11:19            31,744 rbkoer.dll
2005-01-06  11:19            26,624 kijykq.dll
2005-01-06  11:19            26,112 znrmnh.dll
2005-01-06  11:19            28,160 mhhzeg.dll
2005-01-06  18:40           127,488 guomzp.dll
2005-01-06  18:40            28,672 lsesci.dll
2005-01-06  18:40            26,112 izcusl.dll
2005-01-06  18:40            28,672 djpkjp.dll
2005-01-06  18:40            27,136 vyhdxq.dll
2005-01-06  18:40            26,624 fzpclp.dll
2005-01-06  18:40            31,744 aqqfje.dll
2005-01-06  18:41            28,160 qjplpz.dll
2005-01-06  18:41            26,112 pvbqsd.dll
2005-01-06  19:11             2,216 cid_store.dat
2005-01-06  19:42           127,488 hdouhb.dll
2005-01-06  19:42            28,672 emhqto.dll
2005-01-06  19:42            29,696 hwqsuv.dll
2005-01-06  19:42            26,112 hihmyk.dll
2005-01-06  19:42            27,648 rdxtgl.dll
2005-01-06  19:42            28,672 uolxpv.dll
2005-01-06  19:42            27,136 mljlwn.dll
2005-01-06  19:42            26,624 wevtrp.dll
2005-01-06  19:42            31,744 jcqqea.dll
2005-01-06  19:43            28,160 gylxlt.dll
2005-01-07  19:10            28,672 cbqdzw.dll
2005-01-07  19:10            27,648 jnalnr.dll
2005-01-07  19:10            28,672 jyornd.dll
2005-01-07  19:10            27,136 obzozb.dll
2005-01-07  19:10            26,624 mwtqqo.dll
2005-01-07  19:10            26,112 bezuhx.dll
2005-01-07  19:10            28,160 yztcls.dll
2005-01-07  22:05            12,750 IGB_DJOL_1007.exe
2005-01-07  22:05             7,874 IGB_DJOL_1007.dll
2005-01-07  22:07            28,672 nsrhqp.dll
2005-01-07  22:07            31,744 sezmke.dll
2005-01-08  14:21            24,202 IEXPLORE32.ime
2005-01-09  19:12            31,093 mswlckc32.dll
2005-01-09  19:13             7,916 IGB_DJOL_1009.dll
2005-01-12  13:53            30,685 mswmkbs32.dll
2005-01-12  13:53            30,285 mstfhmzy32.dll
2005-01-12  13:53            12,788 IGB_DJOL_1009.exe
2005-01-12  13:54            33,918 Sy_Win7k.Jmp
2005-01-12  13:54            27,648 zavnos.dll
2005-01-12  13:54            28,672 aydmbg.dll
2005-01-12  13:54            31,744 vwwxei.dll
2005-01-15  16:13            27,136 aljsyh.dll
2005-01-15  16:29            28,672 wazuxr.dll
2005-01-15  16:35            28,672 xlihje.dll
2005-01-15  16:35            29,696 Kvsc3.dll
2005-01-15  16:35            27,648 DbgHlp32.dll
2005-01-15  16:35            27,648 upxdnd.dll
2005-01-15  16:35            26,112 MsPrint32D.dll
2005-01-15  16:35            28,672 cmdbcs.dll
2005-01-15  16:35            26,624 LotusHlp.dll
2005-01-15  16:35            26,112 NAVMon32.dll
2005-01-15  16:35            27,136 msccrt.dll
2005-01-15  16:35            28,160 WINSvr32.dll
2005-01-15  16:35            28,160 WinForm.dll
2005-01-15  16:50            28,672 bqzrka.dll
2005-01-15  16:55            36,864 B32B22A0.DLL
2005-01-15  16:56            31,744 NVDispDrv.dll
2005-01-15  16:56            28,672 AVPSrv.dll
2006-11-11  08:32             4,608 symlcbrd.sys
2007-06-16  09:23            11,192 nztgtlsh.sys
2007-12-09  10:04           127,488 zxvrud.dll
2007-12-09  22:02            11,156 n1197208933k.exe
2007-12-15  19:17            28,160 zhemeg.dll
2007-12-18  09:06            28,160 mrnvqb.dll
2007-12-18  09:06            27,136 zxqhpt.dll
2007-12-18  09:06            28,672 jqaejf.dll
2007-12-18  19:53            28,672 xzomnw.dll
2007-12-18  19:54            28,160 cdjnoj.dll
2007-12-18  19:55            27,136 ysltyi.dll
2007-12-18  20:02            27,136 wjwkeq.dll
2007-12-18  20:02            28,672 tzulml.dll
2007-12-20  08:54           127,488 pildad.dll
2007-12-20  08:54            28,672 zwzxmm.dll
2007-12-20  08:54            27,136 mopazi.dll
2007-12-20  08:54            28,672 oipkts.dll
2007-12-21  16:42            28,672 sbdawo.dll
2007-12-21  16:42            27,136 vbufuy.dll
2007-12-21  16:45            28,672 dvtdya.dll
2007-12-21  18:45            12,586 n1198233914k.exe
2007-12-24  07:04            28,672 lmarnq.dll
2007-12-24  07:04            27,136 joxncd.dll
2007-12-24  07:04            28,672 gyghhs.dll
2007-12-24  10:35            27,136 cpaitt.dll
2007-12-24  10:35            28,672 wewggb.dll
2007-12-24  13:35            12,585 n1198474516k.exe
2007-12-26  11:38            27,136 iwvcvp.dll
2007-12-26  11:38            28,672 mjkubt.dll
2008-01-01  20:37            28,672 pyoelu.dll
2008-01-01  20:37            28,672 xghegd.dll