AI 助理
备案控制台
开发者社区 安全 文章 正文

遭遇scvhost.exe,qsetup.exe,dsound.dll,hnetcfg.dll,olepro32.dll等1

2024-09-27 4
版权
版权声明：
本文内容由阿里云实名注册用户自发贡献，版权归原作者所有，阿里云开发者社区不拥有其著作权，亦不承担相应法律责任。具体规则请查看《 阿里云开发者社区用户服务协议》和 《阿里云开发者社区知识产权保护指引》。如果您发现本社区中有涉嫌抄袭的内容，填写 侵权投诉表单进行举报，一经查实，本社区将立刻删除涉嫌侵权内容。
简介： 遭遇scvhost.exe,qsetup.exe,dsound.dll,hnetcfg.dll,olepro32.dll等1

一位朋友在使用电脑的过程中，360提示发现病毒，当时清除了。但重启电脑后出现故障：桌面无显示。请我帮忙检修。

 按Ctrl+Alt+Del打开任务管理器检查进程，没有发现explorer.exe。检查发现c:/windows文件夹里没有explorer.exe，dllcache文件夹中也没有。

 运行winRAR来搜索，在c:/windows/temp发现了一个explorer.exe，把它移动到c:/windows文件夹再运行，任务栏和桌面图标都显示出来了。使用pe_xscan扫描log并分析，发现如下可疑项（进程模块有省略）：

pe_xscan 11-02-14 by Purple Endurer 
2011-3-11 14:17:16
6.0.2900.5512 
MSIE:6.0.2900.5512
管理员用户组
正常模式
[System Process] * 0 
　　 C:/WINDOWS/system32/kernel32.dll | 2009-8-21 22:22:36 | Microsoft(R) Windows(R) Operating System | 5.1.2600.5781 | Windows NT BASE API Client DLL | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.5781 (xpsp_sp3_qfe.090321-1341) | Microsoft Corporation| ? | kernel32 | kernel32 
　　 C:/WINDOWS/system32/GDI32.dll | 2009-8-21 22:22:37 | Microsoft? Windows? Operating System | 5.1.2600.5698 | GDI Client DLL | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5698 (xpsp_sp3_gdr.081022-1932) | Microsoft Corporation| ? | gdi32 | gdi32 
　　 C:/WINDOWS/system32/RPCRT4.dll | 2009-8-21 22:22:31 | Microsoft? Windows? Operating System | 5.1.2600.5795 | Remote Procedure Call Runtime | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5795 (xpsp_sp3_qfe.090415-1301) | Microsoft Corporation| ? | rpcrt4.dll | rpcrt4.dll 
　　 C:/WINDOWS/system32/netapi32.dll | 2009-8-21 22:22:33 | Microsoft? Windows? Operating System | 5.1.2600.5694 | Net Win32 API DLL | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5694 (xpsp_sp3_gdr.081015-1312) | Microsoft Corporation| ? | NetApi32.DLL | NetApi32.DLL 
　　 C:/WINDOWS/system32/msctfime.ime | 2009-8-10 23:49:15 | Microsoft? Windows? Operating System | 5.1.2600.5768 | Microsoft Text Frame Work Service IME | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5768 (xpsp_sp3_qfe.090226-1518) | Microsoft Corporation| ? | MSCTFIME | MSCTFIME.IME 
　　 C:/WINDOWS/system32/shdocvw.dll | 2009-8-21 22:22:31 | Microsoft(R) Windows(R) Operating System | 6.00.2900.5848 | Shell Doc Object and Control Library | (C) Microsoft Corporation. All rights reserved. | 6.00.2900.5848 (xpsp_sp3_qfe.090718-1313) | Microsoft Corporation| ? | SHDOCVW.DLL | SHDOCVW.DLL 
　　 C:/WINDOWS/system32/WININET.dll | 2009-8-21 22:22:29 | Microsoft(R) Windows(R) Operating System | 6.00.2900.5835 | Internet Extensions for Win32 | (C) Microsoft Corporation. All rights reserved. | 6.00.2900.5835 (xpsp_sp3_qfe.090626-1600) | Microsoft Corporation| ? | wininet.dll | wininet.dll 
　　 C:/WINDOWS/system32/portabledeviceapi.dll | 2009-8-21 22:22:32 | Microsoft? Windows? Operating System | 5.2.5721.5145 | Windows Portable Device API Components | ? Microsoft Corporation. All rights reserved. | 5.2.5721.5145 (WMP_11.061018-2006) | Microsoft Corporation| ? | | PortableDeviceApi.dll 
　　 C:/WINDOWS/system32/mswsock.dll | 2009-8-21 22:22:33 | Microsoft(R) Windows(R) Operating System | 5.1.2600.5625 | Microsoft Windows Sockets 2.0 Service Provider | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.5625 (xpsp_sp3_gdr.080620-1249) | Microsoft Corporation| ? | mswsock.dll | mswsock.dll 
C:/WINDOWS/system32/csrss.exe* 584 | 2009-3-13 10:3:58 
　　 C:/WINDOWS/system32/GDI32.dll | 2009-8-21 22:22:37 | Microsoft? Windows? Operating System | 5.1.2600.5698 | GDI Client DLL | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5698 (xpsp_sp3_gdr.081022-1932) | Microsoft Corporation| ? | gdi32 | gdi32 
　　 C:/WINDOWS/system32/KERNEL32.dll | 2009-8-21 22:22:36 | Microsoft(R) Windows(R) Operating System | 5.1.2600.5781 | Windows NT BASE API Client DLL | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.5781 (xpsp_sp3_qfe.090321-1341) | Microsoft Corporation| ? | kernel32 | kernel32 
　　 C:/WINDOWS/system32/RPCRT4.dll | 2009-8-21 22:22:31 | Microsoft? Windows? Operating System | 5.1.2600.5795 | Remote Procedure Call Runtime | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5795 (xpsp_sp3_qfe.090415-1301) | Microsoft Corporation| ? | rpcrt4.dll | rpcrt4.dll 
 C:/WINDOWS/system32/winlogon.exe * 624 | 2009-3-13 10:3:58 | Microsoft(R) Windows(R) Operating System | 5.1.2600.5512 | Windows NT Logon Application | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.5512 (xpsp.080413-2113) | Microsoft Corporation| ? | winlogon | WINLOGON.EXE 
　　 C:/WINDOWS/system32/kernel32.dll | 2009-8-21 22:22:36 | Microsoft(R) Windows(R) Operating System | 5.1.2600.5781 | Windows NT BASE API Client DLL | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.5781 (xpsp_sp3_qfe.090321-1341) | Microsoft Corporation| ? | kernel32 | kernel32 
　　 C:/WINDOWS/system32/RPCRT4.dll | 2009-8-21 22:22:31 | Microsoft? Windows? Operating System | 5.1.2600.5795 | Remote Procedure Call Runtime | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5795 (xpsp_sp3_qfe.090415-1301) | Microsoft Corporation| ? | rpcrt4.dll | rpcrt4.dll 
　　 C:/WINDOWS/system32/GDI32.dll | 2009-8-21 22:22:37 | Microsoft? Windows? Operating System | 5.1.2600.5698 | GDI Client DLL | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5698 (xpsp_sp3_gdr.081022-1932) | Microsoft Corporation| ? | gdi32 | gdi32 
　　 C:/WINDOWS/system32/NETAPI32.dll | 2009-8-21 22:22:33 | Microsoft? Windows? Operating System | 5.1.2600.5694 | Net Win32 API DLL | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5694 (xpsp_sp3_gdr.081015-1312) | Microsoft Corporation| ? | NetApi32.DLL | NetApi32.DLL 
　　 C:/WINDOWS/system32/msctfime.ime | 2009-8-10 23:49:15 | Microsoft? Windows? Operating System | 5.1.2600.5768 | Microsoft Text Frame Work Service IME | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5768 (xpsp_sp3_qfe.090226-1518) | Microsoft Corporation| ? | MSCTFIME | MSCTFIME.IME 
C:/WINDOWS/system32/services.exe* 700 | 2009-3-13 10:3:58 
　　 C:/WINDOWS/system32/kernel32.dll | 2009-8-21 22:22:36 | Microsoft(R) Windows(R) Operating System | 5.1.2600.5781 | Windows NT BASE API Client DLL | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.5781 (xpsp_sp3_qfe.090321-1341) | Microsoft Corporation| ? | kernel32 | kernel32 
　　 C:/WINDOWS/system32/RPCRT4.dll | 2009-8-21 22:22:31 | Microsoft? Windows? Operating System | 5.1.2600.5795 | Remote Procedure Call Runtime | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5795 (xpsp_sp3_qfe.090415-1301) | Microsoft Corporation| ? | rpcrt4.dll | rpcrt4.dll 
　　 C:/WINDOWS/system32/GDI32.dll | 2009-8-21 22:22:37 | Microsoft? Windows? Operating System | 5.1.2600.5698 | GDI Client DLL | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5698 (xpsp_sp3_gdr.081022-1932) | Microsoft Corporation| ? | gdi32 | gdi32 
　　 C:/WINDOWS/system32/NETAPI32.dll | 2009-8-21 22:22:33 | Microsoft? Windows? Operating System | 5.1.2600.5694 | Net Win32 API DLL | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5694 (xpsp_sp3_gdr.081015-1312) | Microsoft Corporation| ? | NetApi32.DLL | NetApi32.DLL 
C:/WINDOWS/system32/lsass.exe* 720 | 2009-3-13 10:3:58 
　　 C:/WINDOWS/system32/kernel32.dll | 2009-8-21 22:22:36 | Microsoft(R) Windows(R) Operating System | 5.1.2600.5781 | Windows NT BASE API Client DLL | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.5781 (xpsp_sp3_qfe.090321-1341) | Microsoft Corporation| ? | kernel32 | kernel32 
　　 C:/WINDOWS/system32/RPCRT4.dll | 2009-8-21 22:22:31 | Microsoft? Windows? Operating System | 5.1.2600.5795 | Remote Procedure Call Runtime | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5795 (xpsp_sp3_qfe.090415-1301) | Microsoft Corporation| ? | rpcrt4.dll | rpcrt4.dll 
　　 C:/WINDOWS/system32/GDI32.dll | 2009-8-21 22:22:37 | Microsoft? Windows? Operating System | 5.1.2600.5698 | GDI Client DLL | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5698 (xpsp_sp3_gdr.081022-1932) | Microsoft Corporation| ? | gdi32 | gdi32 
　　 C:/WINDOWS/system32/NETAPI32.dll | 2009-8-21 22:22:33 | Microsoft? Windows? Operating System | 5.1.2600.5694 | Net Win32 API DLL | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5694 (xpsp_sp3_gdr.081015-1312) | Microsoft Corporation| ? | NetApi32.DLL | NetApi32.DLL 
C:/WINDOWS/system32/svchost.exe* 1020 | 2009-3-13 10:3:58 
　　 C:/WINDOWS/system32/kernel32.dll | 2009-8-21 22:22:36 | Microsoft(R) Windows(R) Operating System | 5.1.2600.5781 | Windows NT BASE API Client DLL | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.5781 (xpsp_sp3_qfe.090321-1341) | Microsoft Corporation| ? | kernel32 | kernel32 
　　 C:/WINDOWS/system32/RPCRT4.dll | 2009-8-21 22:22:31 | Microsoft? Windows? Operating System | 5.1.2600.5795 | Remote Procedure Call Runtime | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5795 (xpsp_sp3_qfe.090415-1301) | Microsoft Corporation| ? | rpcrt4.dll | rpcrt4.dll 
　　 C:/WINDOWS/system32/GDI32.dll | 2009-8-21 22:22:37 | Microsoft? Windows? Operating System | 5.1.2600.5698 | GDI Client DLL | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5698 (xpsp_sp3_gdr.081022-1932) | Microsoft Corporation| ? | gdi32 | gdi32 
　　 C:/WINDOWS/system32/NETAPI32.dll | 2009-8-21 22:22:33 | Microsoft? Windows? Operating System | 5.1.2600.5694 | Net Win32 API DLL | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5694 (xpsp_sp3_gdr.081015-1312) | Microsoft Corporation| ? | NetApi32.DLL | NetApi32.DLL 
　　 C:/WINDOWS/system32/WININET.dll | 2009-8-21 22:22:29 | Microsoft(R) Windows(R) Operating System | 6.00.2900.5835 | Internet Extensions for Win32 | (C) Microsoft Corporation. All rights reserved. | 6.00.2900.5835 (xpsp_sp3_qfe.090626-1600) | Microsoft Corporation| ? | wininet.dll | wininet.dll 
　　 c:/windows/system32/MSWSOCK.dll | 2009-8-21 22:22:33 | Microsoft(R) Windows(R) Operating System | 5.1.2600.5625 | Microsoft Windows Sockets 2.0 Service Provider | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.5625 (xpsp_sp3_gdr.080620-1249) | Microsoft Corporation| ? | mswsock.dll | mswsock.dll 
　　 C:/Program Files/Common Files/System/kb860088.CNT | 2011-3-10 13:4:5 
O4 - HKLM/../run: [360Soft] C:/WINDOWS/system32/scvhost.exe
O4 - HKLM/../run: [Inst]  "C:/Program Files/qcat/qsetup.exe" -safe
O23 - 服务: Nla (Network Location Awareness (NLA)) - C:/WINDOWS/system32/svchost.exe -k netsvcs | 2009-3-13 10:3:58 
　　-> C:/WINDOWS/System32/mswsock.dll | 2009-8-21 22:22:33(手动) 
O23 - 服务: Srv (Srv) -  system32/DRIVERS/srv.sys | 2009-3-13 10:3:58 | Microsoft? Windows? Operating System | 5.1.2600.5725 | Server driver | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5725 (xpsp_sp3_gdr.081211-1306) | Microsoft Corporation| ? | SRV.SYS | SRV.SYS(手动) 
O23 - 服务: WmdmPmSN (Portable Media Serial Number Service) - C:/WINDOWS/System32/svchost.exe -k netsvcs | 2009-3-13 10:3:58
    -> C:/WINDOWS/system32/mspmsnsv.dll | 2009-8-21 22:22:34(手动) 
O23 - 服务: WudfPf (Windows Driver Foundation - User-mode Driver Framework Platform Driver) -  system32/DRIVERS/WudfPf.sys | 2009-3-13 10:3:58 | Microsoft? Windows? Operating System | 6.0.5716.32 | Windows Driver Foundation - User-mode Driver Framework Platform Driver | ? Microsoft Corporation. All rights reserved. | 6.0.5716.32 (winmain(wmbla).060928-1756) | Microsoft Corporation| ? | WUDFPf.sys | WUDFPf.sys(手动) 
O23 - 服务: WudfRd (Windows Driver Foundation - User-mode Driver Framework Reflector) -  system32/DRIVERS/wudfrd.sys | 2009-3-13 10:3:58 | Microsoft? Windows? Operating System | 6.0.5716.32 | Windows Driver Foundation - User-mode Driver Framework Reflector | ? Microsoft Corporation. All rights reserved. | 6.0.5716.32 (winmain(wmbla).060928-1756) | Microsoft Corporation| ? | WUDFRd.sys | WUDFRd.sys(手动) 
O23 - 服务: WudfSvc (Windows Driver Foundation - User-mode Driver Framework) - C:/WINDOWS/system32/svchost.exe -k WudfServiceGroup | 2009-3-13 10:3:58 
　　-> C:/WINDOWS/System32/WUDFSvc.dll | 2009-8-21 22:22:27(手动)
O29 - HKCU-Start Page = hxxp://www.111dh.com/#5恭喜您,成功登陆本站,请单击“是（Ｙ）”大量免费电影站，名站导航天天看!
O29 - HKUS-Start Page = hxxp://www.537.com

很多系统文件没有通过数字签名验证，估计是被病毒替换或感染了。下载DrWeb CureIt!来查杀……

文章标签：
Windows
安全
游客qeoynko2nmbgk
目录
相关文章
弹性计算-百晓生
|
10天前
|
弹性计算 人工智能 架构师
阿里云携手Altair共拓云上工业仿真新机遇
2024年9月12日，「2024 Altair 技术大会杭州站」成功召开，阿里云弹性计算产品运营与生态负责人何川，与Altair中国技术总监赵阳在会上联合发布了最新的“云上CAE一体机”。
弹性计算-百晓生
82216 14
阿里云携手Altair共拓云上工业仿真新机遇
BetterBench
|
6天前
|
机器学习/深度学习 算法 大数据
【BetterBench博士】2024 “华为杯”第二十一届中国研究生数学建模竞赛 选题分析
2024“华为杯”数学建模竞赛，对ABCDEF每个题进行详细的分析，涵盖风电场功率优化、WLAN网络吞吐量、磁性元件损耗建模、地理环境问题、高速公路应急车道启用和X射线脉冲星建模等多领域问题，解析了问题类型、专业和技能的需要。
BetterBench
2506 14
【BetterBench博士】2024 “华为杯”第二十一届中国研究生数学建模竞赛 选题分析
BetterBench
|
6天前
|
机器学习/深度学习 算法 数据可视化
【BetterBench博士】2024年中国研究生数学建模竞赛 C题：数据驱动下磁性元件的磁芯损耗建模 问题分析、数学模型、python 代码
2024年中国研究生数学建模竞赛C题聚焦磁性元件磁芯损耗建模。题目背景介绍了电能变换技术的发展与应用，强调磁性元件在功率变换器中的重要性。磁芯损耗受多种因素影响，现有模型难以精确预测。题目要求通过数据分析建立高精度磁芯损耗模型。具体任务包括励磁波形分类、修正斯坦麦茨方程、分析影响因素、构建预测模型及优化设计条件。涉及数据预处理、特征提取、机器学习及优化算法等技术。适合电气、材料、计算机等多个专业学生参与。
BetterBench
1519 14
【BetterBench博士】2024年中国研究生数学建模竞赛 C题：数据驱动下磁性元件的磁芯损耗建模 问题分析、数学模型、python 代码
阿里云新鲜事
|
8天前
|
编解码 JSON 自然语言处理
通义千问重磅开源Qwen2.5，性能超越Llama
击败Meta，阿里Qwen2.5再登全球开源大模型王座
阿里云新鲜事
531 13
阿里云云原生
|
1月前
|
运维 Cloud Native Devops
一线实战：运维人少，我们从 0 到 1 实践 DevOps 和云原生
上海经证科技有限公司为有效推进软件项目管理和开发工作，选择了阿里云云效作为 DevOps 解决方案。通过云效，实现了从 0 开始，到现在近百个微服务、数百条流水线与应用交付的全面覆盖，有效支撑了敏捷开发流程。
阿里云云原生
19282 30
灵杰开发者
|
1月前
|
人工智能 自然语言处理 搜索推荐
阿里云Elasticsearch AI搜索实践
本文介绍了阿里云 Elasticsearch 在AI 搜索方面的技术实践与探索。
灵杰开发者
18836 20
灵杰开发者
|
1月前
|
Rust Apache 对象存储
Apache Paimon V0.9最新进展
Apache Paimon V0.9 版本即将发布，此版本带来了多项新特性并解决了关键挑战。Paimon自2022年从Flink社区诞生以来迅速成长，已成为Apache顶级项目，并广泛应用于阿里集团内外的多家企业。
灵杰开发者
17524 13
Apache Paimon V0.9最新进展
阿里云
|
8天前
|
人工智能 自动驾驶 机器人
吴泳铭：AI最大的想象力不在手机屏幕，而是改变物理世界
过去22个月，AI发展速度超过任何历史时期，但我们依然还处于AGI变革的早期。生成式AI最大的想象力，绝不是在手机屏幕上做一两个新的超级app，而是接管数字世界，改变物理世界。
阿里云
458 48
吴泳铭：AI最大的想象力不在手机屏幕，而是改变物理世界
云安全专家
|
1天前
|
云安全 存储 运维
叮咚！您有一份六大必做安全操作清单，请查收
云安全态势管理（CSPM）开启免费试用
云安全专家
354 4
叮咚！您有一份六大必做安全操作清单，请查收
Ganos全空间数据库
|
2天前
|
存储 关系型数据库 分布式数据库
GraphRAG：基于PolarDB+通义千问+LangChain的知识图谱+大模型最佳实践
本文介绍了如何使用PolarDB、通义千问和LangChain搭建GraphRAG系统，结合知识图谱和向量检索提升问答质量。通过实例展示了单独使用向量检索和图检索的局限性，并通过图+向量联合搜索增强了问答准确性。PolarDB支持AGE图引擎和pgvector插件，实现图数据和向量数据的统一存储与检索，提升了RAG系统的性能和效果。
Ganos全空间数据库
442 23