AI 助理
备案控制台
开发者社区 云计算 文章 正文

遭遇 Trojan-PSW.Win32.QQPass,Trojan.PSW.Win32.GameOL等1

2024-09-28 22
版权
版权声明：
本文内容由阿里云实名注册用户自发贡献，版权归原作者所有，阿里云开发者社区不拥有其著作权，亦不承担相应法律责任。具体规则请查看《 阿里云开发者社区用户服务协议》和 《阿里云开发者社区知识产权保护指引》。如果您发现本社区中有涉嫌抄袭的内容，填写 侵权投诉表单进行举报，一经查实，本社区将立刻删除涉嫌侵权内容。
简介： 遭遇 Trojan-PSW.Win32.QQPass,Trojan.PSW.Win32.GameOL等1

上午帮一位同事的电脑装软件，进入命令提示符状态进行操作时，感觉特别卡，打开 msconfig.exe 检查开机启动项，发现了 pe_xscan 的 log中的部分 O4 项，才知道电脑中标了，不过在GUI界面下操作倒不觉得卡，可见机子硬件配置好，中了标也不倒~

下载 pe_xscan 扫描 log 并分析，发现如下可疑项（进程模块有省略）：

/===
pe_xscan 08-04-26 by Purple Endurer 
2008-5-19 9:20:34 
Windows XP Service Pack 2(5.1.2600) 
MSIE:6.0.2900.2180 
管理员用户组 
正常模式 
 
[System Process] * 0 

 
  　　 
  C:/WINDOWS/system32/SysDaJHv.dll 
  | 2008-5-18 14:8:1 
  | Microsoft(R) Windows(R) Operating System 
  | 5.1.2600.3099 (xpsp_sp2_gdr.070308-0222) 
  | Windows XP MSPLAY API DLL 
  | (C) Microsoft Corporation. All rights resad. 
  | 5.1.2600.3099 
  | Microsoft Corporation 
  | Microsoft 
  | msplay32 
  | msplay32
 
　　 C:/WINDOWS/system32/fmsiocps.dll | 2008-5-18 14:3:19 
　　 C:/WINDOWS/system32/msosptfs00.dll | 2008-5-18 14:7:8 
　　 C:/WINDOWS/system32/msosfmsq00.dll | 2008-5-18 14:7:49 
　　 C:/WINDOWS/system32/msosmnsf00.dll | 2008-5-18 14:5:59 
　　 C:/WINDOWS/system32/msosping00.dll | 2008-5-18 14:7:26 
　　 C:/WINDOWS/system32/msosdohs00.dll | 2008-5-18 14:4:6 
　　 C:/WINDOWS/system32/msoscqit00.dll | 2008-5-18 14:4:16 
　　 C:/WINDOWS/system32/msosdrop00.dll | 2008-5-18 14:8:13 
　　 C:/WINDOWS/system32/msosjtio00.dll | 2008-5-18 14:8:38 
　　 C:/WINDOWS/system32/kbnqzg.dll | 2008-5-18 14:51:9 
　　 C:/WINDOWS/system32/uhwbqp.dll | 2008-5-18 23:59:20 
　　 C:/Program Files/Internet Explorer/PLUGINS/Nt_Sys32.Sys | 2008-5-18 14:8:50 
　　 C:/WINDOWS/system32/mndhcdwd.dll | 2004-8-8 14:29:16 
　　 C:/WINDOWS/system32/yzztfmsn.dll | 2004-8-8 14:28:40 
　　 C:/WINDOWS/system32/mnmhcsrv.dll | 2004-8-8 14:27:6 
　　 C:/WINDOWS/system32/mpwdcapi.dll | 2004-8-8 14:28:38 
　　 C:/WINDOWS/system32/fmbiost.dll | 2008-5-18 14:7:38 
　　 C:/WINDOWS/system32/cinfonmc.dll | 2008-5-18 14:8:26 
　　 C:/WINDOWS/system32/isndntio.dll | 2008-5-18 14:9:1 
　　 C:/WINDOWS/system32/dndsioc.dll | 2008-5-18 14:6:45 
　　 C:/WINDOWS/system32/WINSvr64.dll | 2008-5-18 14:6:56 
　　 C:/WINDOWS/system32/mfchlp64.dll | 2008-5-18 14:6:34 
　　 C:/WINDOWS/system32/yuiabct.dll | 2008-5-18 14:6:23 
　　 C:/WINDOWS/system32/ticisms.dll | 2008-5-18 14:5:48 
　　 C:/WINDOWS/system32/ptshell.dll | 2008-5-18 14:5:38 
　　 C:/WINDOWS/system32/huifitc.dll | 2008-5-18 14:6:11 
　　 C:/WINDOWS/system32/fnqtjjjh.dll | 2008-5-18 14:5:27 
　　 C:/WINDOWS/system32/fmsjhif.dll | 2008-5-18 14:5:13 
　　 C:/WINDOWS/system32/dbhlp32.dlL | 2008-5-18 14:5:3 
　　 C:/WINDOWS/system32/fmsbbqi.dll | 2008-5-18 14:4:44 
　　 C:/WINDOWS/system32/dionpis.dll | 2008-5-18 14:3:47 
　　 C:/WINDOWS/system32/anistio.dll | 2008-5-18 14:3:28 
　　 C:/WINDOWS/system32/tciocp64.dll | 2008-5-18 14:4:35 
　　 C:/WINDOWS/system32/hefcndy.dll | 2008-5-18 14:4:25 
　　 C:/WINDOWS/system32/bincdwsa.dll | 2008-5-18 14:4:54 
C:/WINDOWS/system32/winlogon.exe* 640 | 2005-12-14 16:0:0 | Microsoft(R) Windows(R) Operating System | 5.1.2600.2180 | Windows NT Logon Application | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | winlogon | WINLOGON.EXE 
　　 C:/WINDOWS/system32/SysDaJHv.dll | 2008-5-18 14:8:1 | Microsoft(R) Windows(R) Operating System | 5.1.2600.3099 (xpsp_sp2_gdr.070308-0222) | Windows XP MSPLAY API DLL | (C) Microsoft Corporation. All rights resad. | 5.1.2600.3099 | Microsoft Corporation | Microsoft | msplay32 | msplay32 
　　 C:/WINDOWS/system32/fmsiocps.dll | 2008-5-18 14:3:19 
　　 C:/WINDOWS/system32/msosptfs00.dll | 2008-5-18 14:7:8 
　　 C:/WINDOWS/system32/msosfmsq00.dll | 2008-5-18 14:7:49 
　　 C:/WINDOWS/system32/msosmnsf00.dll | 2008-5-18 14:5:59 
　　 C:/WINDOWS/system32/msosping00.dll | 2008-5-18 14:7:26 
　　 C:/WINDOWS/system32/msosdohs00.dll | 2008-5-18 14:4:6 
　　 C:/WINDOWS/system32/msoscqit00.dll | 2008-5-18 14:4:16 
　　 C:/WINDOWS/system32/msosdrop00.dll | 2008-5-18 14:8:13 
　　 C:/WINDOWS/system32/msosjtio00.dll | 2008-5-18 14:8:38 
　　 C:/WINDOWS/system32/kbnqzg.dll | 2008-5-18 14:51:9 
C:/WINDOWS/system32/services.exe* 732 | 2005-12-14 16:0:0 | Microsoft(R) Windows(R) Operating System | 5.1.2600.2180 | Services and Controller app | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | services.exe | services.exe 
　　 C:/WINDOWS/system32/SysDaJHv.dll | 2008-5-18 14:8:1 | Microsoft(R) Windows(R) Operating System | 5.1.2600.3099 (xpsp_sp2_gdr.070308-0222) | Windows XP MSPLAY API DLL | (C) Microsoft Corporation. All rights resad. | 5.1.2600.3099 | Microsoft Corporation | Microsoft | msplay32 | msplay32 
　　 C:/WINDOWS/system32/fmsiocps.dll | 2008-5-18 14:3:19 
　　 C:/WINDOWS/system32/msosptfs00.dll | 2008-5-18 14:7:8 
　　 C:/WINDOWS/system32/msosfmsq00.dll | 2008-5-18 14:7:49 
　　 C:/WINDOWS/system32/msosmnsf00.dll | 2008-5-18 14:5:59 
　　 C:/WINDOWS/system32/msosping00.dll | 2008-5-18 14:7:26 
　　 C:/WINDOWS/system32/msosdohs00.dll | 2008-5-18 14:4:6 
　　 C:/WINDOWS/system32/msoscqit00.dll | 2008-5-18 14:4:16 
　　 C:/WINDOWS/system32/msosdrop00.dll | 2008-5-18 14:8:13 
　　 C:/WINDOWS/system32/msosjtio00.dll | 2008-5-18 14:8:38 
　　 C:/WINDOWS/system32/kbnqzg.dll | 2008-5-18 14:51:9 
C:/WINDOWS/system32/lsass.exe* 744 | 2005-12-14 16:0:0 | Microsoft? Windows? Operating System | 5.1.2600.2180 | LSA Shell (Export Version) | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | lsass.exe | lsass.exe 
　　 C:/WINDOWS/system32/SysDaJHv.dll | 2008-5-18 14:8:1 | Microsoft(R) Windows(R) Operating System | 5.1.2600.3099 (xpsp_sp2_gdr.070308-0222) | Windows XP MSPLAY API DLL | (C) Microsoft Corporation. All rights resad. | 5.1.2600.3099 | Microsoft Corporation | Microsoft | msplay32 | msplay32 
　　 C:/WINDOWS/system32/fmsiocps.dll | 2008-5-18 14:3:19 
　　 C:/WINDOWS/system32/msosptfs00.dll | 2008-5-18 14:7:8 
　　 C:/WINDOWS/system32/msosfmsq00.dll | 2008-5-18 14:7:49 
　　 C:/WINDOWS/system32/msosmnsf00.dll | 2008-5-18 14:5:59 
　　 C:/WINDOWS/system32/msosping00.dll | 2008-5-18 14:7:26 
　　 C:/WINDOWS/system32/msosdohs00.dll | 2008-5-18 14:4:6 
　　 C:/WINDOWS/system32/msoscqit00.dll | 2008-5-18 14:4:16 
　　 C:/WINDOWS/system32/msosdrop00.dll | 2008-5-18 14:8:13 
　　 C:/WINDOWS/system32/msosjtio00.dll | 2008-5-18 14:8:38 
　　 C:/WINDOWS/system32/kbnqzg.dll | 2008-5-18 14:51:9 
C:/WINDOWS/system32/svchost.exe* 996 | 2005-12-14 16:0:0 | Microsoft? Windows? Operating System | 5.1.2600.2180 | Generic Host Process for Win32 Services | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | svchost.exe | svchost.exe 
　　 C:/WINDOWS/system32/SysDaJHv.dll | 2008-5-18 14:8:1 | Microsoft(R) Windows(R) Operating System | 5.1.2600.3099 (xpsp_sp2_gdr.070308-0222) | Windows XP MSPLAY API DLL | (C) Microsoft Corporation. All rights resad. | 5.1.2600.3099 | Microsoft Corporation | Microsoft | msplay32 | msplay32 
　　 C:/WINDOWS/system32/fmsiocps.dll | 2008-5-18 14:3:19 
　　 C:/WINDOWS/system32/msosptfs00.dll | 2008-5-18 14:7:8 
　　 C:/WINDOWS/system32/msosfmsq00.dll | 2008-5-18 14:7:49 
　　 C:/WINDOWS/system32/msosmnsf00.dll | 2008-5-18 14:5:59 
　　 C:/WINDOWS/system32/msosping00.dll | 2008-5-18 14:7:26 
　　 C:/WINDOWS/system32/msosdohs00.dll | 2008-5-18 14:4:6 
　　 C:/WINDOWS/system32/msoscqit00.dll | 2008-5-18 14:4:16 
　　 C:/WINDOWS/system32/msosdrop00.dll | 2008-5-18 14:8:13 
　　 C:/WINDOWS/system32/msosjtio00.dll | 2008-5-18 14:8:38 
　　 C:/WINDOWS/system32/kbnqzg.dll | 2008-5-18 14:51:9 
C:/WINDOWS/Explorer.EXE* 1824 | 2005-12-14 16:0:0 | Microsoft(R) Windows(R) Operating System | 6.00.2900.2180 | Windows Explorer | (C) Microsoft Corporation. All rights reserved. | 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | explorer | EXPLORER.EXE 
　　 C:/WINDOWS/system32/SysDaJHv.dll | 2008-5-18 14:8:1 | Microsoft(R) Windows(R) Operating System | 5.1.2600.3099 (xpsp_sp2_gdr.070308-0222) | Windows XP MSPLAY API DLL | (C) Microsoft Corporation. All rights resad. | 5.1.2600.3099 | Microsoft Corporation | Microsoft | msplay32 | msplay32 
　　 C:/WINDOWS/system32/fmsiocps.dll | 2008-5-18 14:3:19 
　　 C:/WINDOWS/system32/msosptfs00.dll | 2008-5-18 14:7:8 
　　 C:/WINDOWS/system32/msosfmsq00.dll | 2008-5-18 14:7:49 
　　 C:/WINDOWS/system32/msosmnsf00.dll | 2008-5-18 14:5:59 
　　 C:/WINDOWS/system32/msosping00.dll | 2008-5-18 14:7:26 
　　 C:/WINDOWS/system32/msosdohs00.dll | 2008-5-18 14:4:6 
　　 C:/WINDOWS/system32/msoscqit00.dll | 2008-5-18 14:4:16 
　　 C:/WINDOWS/system32/msosdrop00.dll | 2008-5-18 14:8:13 
　　 C:/WINDOWS/system32/msosjtio00.dll | 2008-5-18 14:8:38 
　　 C:/WINDOWS/system32/kbnqzg.dll | 2008-5-18 14:51:9 
　　 C:/Program Files/Internet Explorer/PLUGINS/Nt_Sys32.Sys | 2008-5-18 14:8:50 
　　 C:/WINDOWS/system32/mnmhcsrv.dll | 2004-8-8 14:27:6 
　　 C:/WINDOWS/system32/mpwdcapi.dll | 2004-8-8 14:28:38 
　　 C:/WINDOWS/system32/yzztfmsn.dll | 2004-8-8 14:28:40 
　　 C:/WINDOWS/system32/mndhcdwd.dll | 2004-8-8 14:29:16 
　　 C:/WINDOWS/system32/uhwbqp.dll | 2008-5-18 23:59:20 
　　 C:/WINDOWS/system32/anistio.dll | 2008-5-18 14:3:28 
　　 C:/WINDOWS/system32/dionpis.dll | 2008-5-18 14:3:47 
　　 C:/WINDOWS/system32/hefcndy.dll | 2008-5-18 14:4:25 
　　 C:/WINDOWS/system32/tciocp64.dll | 2008-5-18 14:4:35 
　　 C:/WINDOWS/system32/bincdwsa.dll | 2008-5-18 14:4:54 
　　 C:/WINDOWS/system32/fmsbbqi.dll | 2008-5-18 14:4:44 
　　 C:/WINDOWS/system32/dbhlp32.dlL | 2008-5-18 14:5:3 
　　 C:/WINDOWS/system32/fmsjhif.dll | 2008-5-18 14:5:13 
　　 C:/WINDOWS/system32/fnqtjjjh.dll | 2008-5-18 14:5:27 
　　 C:/WINDOWS/system32/ptshell.dll | 2008-5-18 14:5:38 
　　 C:/WINDOWS/system32/huifitc.dll | 2008-5-18 14:6:11 
　　 C:/WINDOWS/system32/ticisms.dll | 2008-5-18 14:5:48 
　　 C:/WINDOWS/system32/yuiabct.dll | 2008-5-18 14:6:23 
　　 C:/WINDOWS/system32/mfchlp64.dll | 2008-5-18 14:6:34 
　　 C:/WINDOWS/system32/dndsioc.dll | 2008-5-18 14:6:45 
　　 C:/WINDOWS/system32/cinfonmc.dll | 2008-5-18 14:8:26 
　　 C:/WINDOWS/system32/WINSvr64.dll | 2008-5-18 14:6:56 
　　 C:/WINDOWS/system32/fmbiost.dll | 2008-5-18 14:7:38 
　　 C:/WINDOWS/system32/isndntio.dll | 2008-5-18 14:9:1 
　　 C:/WINDOWS/system32/drivers/usrinit.dll | 2002-1-10 7:4:37 | usrinit Module | 1, 0, 0, 1 | usrinit Module | Copyright 2006 | 1, 0, 0, 1 | | ? | usrinit | usrinit.DLL 
C:/WINDOWS/SoundMan.exe* 508 | 2006-10-18 13:47:14 | 工程1 | 1.00| ?| ? | 1.00 | 1| ? | di2 | di2.exe 
　　 C:/WINDOWS/system32/SysDaJHv.dll | 2008-5-18 14:8:1 | Microsoft(R) Windows(R) Operating System | 5.1.2600.3099 (xpsp_sp2_gdr.070308-0222) | Windows XP MSPLAY API DLL | (C) Microsoft Corporation. All rights resad. | 5.1.2600.3099 | Microsoft Corporation | Microsoft | msplay32 | msplay32 
　　 C:/WINDOWS/system32/fmsiocps.dll | 2008-5-18 14:3:19 
　　 C:/WINDOWS/system32/msosptfs00.dll | 2008-5-18 14:7:8 
　　 C:/WINDOWS/system32/msosfmsq00.dll | 2008-5-18 14:7:49 
　　 C:/WINDOWS/system32/msosmnsf00.dll | 2008-5-18 14:5:59 
　　 C:/WINDOWS/system32/msosping00.dll | 2008-5-18 14:7:26 
　　 C:/WINDOWS/system32/msosdohs00.dll | 2008-5-18 14:4:6 
　　 C:/WINDOWS/system32/msoscqit00.dll | 2008-5-18 14:4:16 
　　 C:/WINDOWS/system32/msosdrop00.dll | 2008-5-18 14:8:13 
　　 C:/WINDOWS/system32/msosjtio00.dll | 2008-5-18 14:8:38 
　　 C:/WINDOWS/system32/kbnqzg.dll | 2008-5-18 14:51:9 
 C:/WINDOWS/bdsclk.exe * 2256 | 2007-12-11 9:43:36 | Microsoft 应用程序 | 1, 0, 0, 1 | Microsoft 基础类应用程序 | 版权所有 (C) 2005 | 1, 0, 0, 1 | | | | 
　　 C:/WINDOWS/system32/SysDaJHv.dll | 2008-5-18 14:8:1 | Microsoft(R) Windows(R) Operating System | 5.1.2600.3099 (xpsp_sp2_gdr.070308-0222) | Windows XP MSPLAY API DLL | (C) Microsoft Corporation. All rights resad. | 5.1.2600.3099 | Microsoft Corporation | Microsoft | msplay32 | msplay32 
　　 C:/WINDOWS/system32/fmsiocps.dll | 2008-5-18 14:3:19 
　　 C:/WINDOWS/system32/msosptfs00.dll | 2008-5-18 14:7:8 
　　 C:/WINDOWS/system32/msosfmsq00.dll | 2008-5-18 14:7:49 
　　 C:/WINDOWS/system32/msosmnsf00.dll | 2008-5-18 14:5:59 
　　 C:/WINDOWS/system32/msosping00.dll | 2008-5-18 14:7:26 
　　 C:/WINDOWS/system32/msosdohs00.dll | 2008-5-18 14:4:6 
　　 C:/WINDOWS/system32/msoscqit00.dll | 2008-5-18 14:4:16 
　　 C:/WINDOWS/system32/msosdrop00.dll | 2008-5-18 14:8:13 
　　 C:/WINDOWS/system32/msosjtio00.dll | 2008-5-18 14:8:38 
　　 C:/WINDOWS/system32/kbnqzg.dll | 2008-5-18 14:51:9 
　　 C:/Program Files/Internet Explorer/PLUGINS/Nt_Sys32.Sys | 2008-5-18 14:8:50 
　　 C:/WINDOWS/system32/mnmhcsrv.dll | 2004-8-8 14:27:6 
　　 C:/WINDOWS/system32/mndhcdwd.dll | 2004-8-8 14:29:16 
　　 C:/WINDOWS/system32/yzztfmsn.dll | 2004-8-8 14:28:40 
　　 C:/WINDOWS/system32/mpwdcapi.dll | 2004-8-8 14:28:38 
　　 C:/WINDOWS/system32/fmbiost.dll | 2008-5-18 14:7:38 
　　 C:/WINDOWS/system32/cinfonmc.dll | 2008-5-18 14:8:26 
　　 C:/WINDOWS/system32/isndntio.dll | 2008-5-18 14:9:1 
　　 C:/WINDOWS/system32/dndsioc.dll | 2008-5-18 14:6:45 
　　 C:/WINDOWS/system32/WINSvr64.dll | 2008-5-18 14:6:56 
　　 C:/WINDOWS/system32/mfchlp64.dll | 2008-5-18 14:6:34 
　　 C:/WINDOWS/system32/yuiabct.dll | 2008-5-18 14:6:23 
　　 C:/WINDOWS/system32/ticisms.dll | 2008-5-18 14:5:48 
　　 C:/WINDOWS/system32/ptshell.dll | 2008-5-18 14:5:38 
　　 C:/WINDOWS/system32/huifitc.dll | 2008-5-18 14:6:11 
　　 C:/WINDOWS/system32/fnqtjjjh.dll | 2008-5-18 14:5:27 
　　 C:/WINDOWS/system32/fmsjhif.dll | 2008-5-18 14:5:13 
　　 C:/WINDOWS/system32/dbhlp32.dlL | 2008-5-18 14:5:3 
　　 C:/WINDOWS/system32/fmsbbqi.dll | 2008-5-18 14:4:44 
　　 C:/WINDOWS/system32/dionpis.dll | 2008-5-18 14:3:47 
　　 C:/WINDOWS/system32/anistio.dll | 2008-5-18 14:3:28 
　　 C:/WINDOWS/system32/tciocp64.dll | 2008-5-18 14:4:35 
　　 C:/WINDOWS/system32/hefcndy.dll | 2008-5-18 14:4:25 
　　 C:/WINDOWS/system32/bincdwsa.dll | 2008-5-18 14:4:54 
　　 C:/WINDOWS/system32/uhwbqp.dll | 2008-5-18 23:59:20 
C:/WINDOWS/system32/conime.exe* 2112 | 2005-12-14 16:0:0 | Microsoft? Windows? Operating System | 5.1.2600.2180 | Console IME | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | Console | CONIME.EXE 
　　 C:/WINDOWS/system32/SysDaJHv.dll | 2008-5-18 14:8:1 | Microsoft(R) Windows(R) Operating System | 5.1.2600.3099 (xpsp_sp2_gdr.070308-0222) | Windows XP MSPLAY API DLL | (C) Microsoft Corporation. All rights resad. | 5.1.2600.3099 | Microsoft Corporation | Microsoft | msplay32 | msplay32 
　　 C:/WINDOWS/system32/fmsiocps.dll | 2008-5-18 14:3:19 
　　 C:/WINDOWS/system32/msosptfs00.dll | 2008-5-18 14:7:8 
　　 C:/WINDOWS/system32/msosfmsq00.dll | 2008-5-18 14:7:49 
　　 C:/WINDOWS/system32/msosmnsf00.dll | 2008-5-18 14:5:59 
　　 C:/WINDOWS/system32/msosping00.dll | 2008-5-18 14:7:26 
　　 C:/WINDOWS/system32/msosdohs00.dll | 2008-5-18 14:4:6 
　　 C:/WINDOWS/system32/msoscqit00.dll | 2008-5-18 14:4:16 
　　 C:/WINDOWS/system32/msosdrop00.dll | 2008-5-18 14:8:13 
　　 C:/WINDOWS/system32/msosjtio00.dll | 2008-5-18 14:8:38 
　　 C:/WINDOWS/system32/kbnqzg.dll | 2008-5-18 14:51:9 
　　 C:/WINDOWS/system32/uhwbqp.dll | 2008-5-18 23:59:20 
　　 C:/Program Files/Internet Explorer/PLUGINS/Nt_Sys32.Sys | 2008-5-18 14:8:50 
　　 C:/WINDOWS/system32/mnmhcsrv.dll | 2004-8-8 14:27:6 
　　 C:/WINDOWS/system32/yzztfmsn.dll | 2004-8-8 14:28:40 
　　 C:/WINDOWS/system32/mndhcdwd.dll | 2004-8-8 14:29:16 
O2 - BHO - {35694105-5108-9405-3695-954187462153} - C:/WINDOWS/system32/mpwdcapi.dll
O2 - BHO - {398C9B84-4EF7-47B5-9862-DE29543B3C42} - C:/Program Files/Internet Explorer/PLUGINS/Nt_Sys32.Sys
O2 - BHO - {3C648541-1025-9650-9057-6541258720C3} - C:/WINDOWS/system32/mndhcdwd.dll
O2 - BHO - {3C8D1401-A58D-A81C-CD24-A5915C4517C3} - C:/WINDOWS/system32/mnmhcsrv.dll
O2 - BHO IEInit Class - {5B02EBA1-EFDD-477D-A37F-05383165C9C0} - C:/WINDOWS/system32/drivers/usrinit.dll
O2 - BHO - {6490415F-65F8-B5C5-D8BA-9405FB120546} - C:/WINDOWS/system32/yzztfmsn.dll
O2 - BHO ChinaBuy Class - {85FAEA13-9C62-4917-8571-B35C563A1943} - C:/WINDOWS/system32/buyunion.dll
O2 - BHO FavHook Class - {CD8BFE70-5809-4C73-9EEE-E5672C2B79D7} - C:/Program Files/Deepdo/DeepdoBar/Favorite/FavBlock.dll
O4 - HKLM/../Run: [RealTray] C:/Program Files/Real/RealPlayer/Realplay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM/../Run: [fmsiocps] C:/WINDOWS/fmsiocps.exe
O4 - HKLM/../Run: [anistio] C:/WINDOWS/anistio.exE
O4 - HKLM/../Run: [dionpis] C:/WINDOWS/dionpis.exe
O4 - HKLM/../Run: [hefcndy] C:/WINDOWS/hefcndy.exe
O4 - HKLM/../Run: [tciocp64] C:/WINDOWS/tciocp64.exe
O4 - HKLM/../Run: [fmsbbqi] C:/WINDOWS/fmsbbqi.exe
O4 - HKLM/../Run: [bincdwsa] C:/WINDOWS/bincdwsa.exe
O4 - HKLM/../Run: [dbhlp32] C:/WINDOWS/dbhlp32.exe
O4 - HKLM/../Run: [fmsjhif] C:/WINDOWS/fmsjhif.exe
O4 - HKLM/../Run: [kangitxp] C:/WINDOWS/agtpshsy.exe
O4 - HKLM/../Run: [ptshell] C:/WINDOWS/ptshell.exe
O4 - HKLM/../Run: [ticisms] C:/WINDOWS/ticisms.exe
O4 - HKLM/../Run: [huifitc] C:/WINDOWS/huifitc.exe
O4 - HKLM/../Run: [yuiabct] C:/WINDOWS/yuiabct.exe
O4 - HKLM/../Run: [mfchlp64] C:/WINDOWS/mfchlp64.exe
O4 - HKLM/../Run: [dndsioc] C:/WINDOWS/dndsioc.exe
O4 - HKLM/../Run: [WINSvr64] C:/WINDOWS/WINSvr64.exe
O4 - HKLM/../Run: [fmbiost] C:/WINDOWS/fmbiost.exe
O4 - HKLM/../Run: [cinfonmc] C:/WINDOWS/cinfonmc.exe
O4 - HKLM/../Run: [isndntio] C:/WINDOWS/isndntio.exe

O4 - HKLM/../Policies/Explorer/Run: [usrinit] C:/WINDOWS/system32/usrinit.exe
O4 - HKLM/../Policies/Explorer/Run: [WinAutoUp] C:/WINDOWS/AutoUp.exe
O4 - HKLM/../Policies/Explorer/Run: [adsnt] C:/WINDOWS/AdsNT.exe
O4 - HKLM/../Policies/Explorer/Run: [bdwinrun] C:/WINDOWS/bdsclk.exe
O20 - AppInit_DLLs =  SysDaJHv.dll,nicozftp00.dll,fmsiocps.dll,msosptfs00.dll,msosfmsq00.dll,msosmnsf00.dll,msosmhfp00.dll,msosping00.dll,msosdohs00.dll,msoscqit00.dll,msosdrop00.dll,msosjtio00.dll,kbnqzg.dll,uhwbqp.dll 
O23 - 服务: cqit (cqit) - C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/tmp17.tmp (自动) 
O23 - 服务: drop (drop) - C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/tmp21.tmp (自动) 
O23 - 服务: fmsq (fmsq) - C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/tmp1F.tmp (自动) 
O23 - 服务: helpsvc (Help and Support) - C:/WINDOWS/system32/interne.exe | 2006-12-14 6:29:29 | 工程1 | 1.00| ?| ? | 1.00 | 1| ? | note | note.exe(自动) 
O23 - 服务: jtio (jtio) - C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/tmp23.tmp (自动) 
O23 - 服务: mnsf (mnsf) - C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/tmp19.tmp (自动) 
O23 - 服务: msfpfis64 (msfpfis64) - C:/WINDOWS/system32/drivers/msosmsfpfis64.sys | 2008-5-18 14:4:6(自动) 
O23 - 服务: msp2p32 (msp2p32) - C:/WINDOWS/system32/drivers/msosmsp2p32.sys | 2008-5-18 14:3:11(自动) 

O23 - 服务: ping (ping) - C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/tmp1D.tmp (自动) 
O23 - 服务: ptfs (ptfs) - C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/tmp1B.tmp (自动) 
O23 - 服务: XPROTECTOR (XPROTECTOR) - C:/WINDOWS/system32/drivers/Xprotector.sys | 2006-2-2 17:54:55(自动) 
O23 - 服务: zftp (zftp) - C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/tmp13.tmp(自动)
O26 - IFEO: 360Loader.exe -> svchost.exe
O26 - IFEO: 360rpt.exe -> ntsd -d
O26 - IFEO: 360safe.exe -> ntsd -d
O26 - IFEO: 360safebox.exe -> ntsd -d
O26 - IFEO: 360tray.exe -> ntsd -d
O26 - IFEO: adam.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: AgentSvr.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: AppSvc32.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: ati2evxx.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: autoruns.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: avconsol.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: avgrssvc.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: AvMonitor.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: avp.com -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: avp.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: CCenter.exe -> ntsd -d
O26 - IFEO: ccSvcHst.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: ctfmon.exe -> SoundMan.exe
O26 - IFEO: egui.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: esafe.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: FileDsty.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: FTCleanerShell.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: HijackThis.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: IceSword -> svchost.exe
O26 - IFEO: IceSword.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: idag.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: Iparmor.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: isPwdSvc.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: kabaload.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: kaccore.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: KaScrScn.SCR -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: KASMain.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: KASTask.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: KAV32.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: KAVDX.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: KAVPF.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: KAVPFW.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: KAVSetup.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: KAVStart.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: kavsvc.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: KAVsvcUI.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: KISLnchr.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: kissvc.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: kmailmon.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: KMFilter.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: KPFW32.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: kpfwsvc.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: KPPMain.exe -> ntsd -d
O26 - IFEO: KRegEx.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: KRepair.com -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: KsLoader.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: KVCenter.kxp -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: KvDetect.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: KVFW.EXE -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: KvfwMcl.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: KVMonXP_1.kxp -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: kvol.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: kvolself.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: KvReport.kxp -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: KVScan.kxp -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: KVsrvXP.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: KVStub.kxp -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: kvupload.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: KVwsc.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: KWatch.exe -> ntsd -d
O26 - IFEO: KWatch9x.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: KWatchX.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: MagicSet.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: mcconsol.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: mmqczj.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: mmsk.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: navapsvc.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: Navapw32.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: nod32krn.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: NPFMntor.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: OllyDBG.EXE -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: OllyICE.EXE -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: PFW.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: PFWLiveUpdate.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: procexp.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: QHSET.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: QQDoctor.exe -> ntsd -d
O26 - IFEO: QQKav.exe -> ntsd -d
O26 - IFEO: qqsc.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: ras -> svchost.exe
O26 - IFEO: Ras.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: rav.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: RavMon.exe -> ntsd -d
O26 - IFEO: RavMonD.exe -> ntsd -d
O26 - IFEO: ravstub.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: ravtask.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: ravtimer.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: ravtool.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: RegClean.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: regtool.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: rfwmain.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: rfwproxy.exeFYFireWall.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: rfwsrv.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: rfwstub.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: rising.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: Rsaupd.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: runiep -> svchost.exe
O26 - IFEO: runiep.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: safebank.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: safeboxTray.exe -> ntsd -d
O26 - IFEO: safelive.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: scan32.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: shcfg32.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: SmartUp.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: SREng.EXE -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: symlcsvc.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: SysSafe.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: tqat.exe -> ntsd -d
O26 - IFEO: TrojanDetector.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: Trojanwall.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: TrojDie.kxp -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: UIHost.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: UmxAgent.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: UmxAttachment.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: UmxCfg.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: UmxFwHlp.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: UmxPol.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: UpLive.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: vsstat.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: webscanx.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: WinDbg.exe -> C:/WINDOWS/system32/svchost.exe
O26 - IFEO: WoptiClean.exe -> C:/WINDOWS/system32/svchost.exe
游客qeoynko2nmbgk
目录
相关文章
游客qeoynko2nmbgk
|
3月前
|
监控 安全 数据安全/隐私保护
遭遇Trojan-PSW.Win32.WOW,Trojan.PSW.Win32.OnlineGames,Trojan.MnLess.kks等1
遭遇Trojan-PSW.Win32.WOW,Trojan.PSW.Win32.OnlineGames,Trojan.MnLess.kks等1
游客qeoynko2nmbgk
23 2
游客qeoynko2nmbgk
|
3月前
|
JavaScript 前端开发 数据安全/隐私保护
下载Trojan-PSW.Win32.QQPass.ra等恶意程序的政府网站
下载Trojan-PSW.Win32.QQPass.ra等恶意程序的政府网站
游客qeoynko2nmbgk
44 1
游客qeoynko2nmbgk
|
3月前
|
安全 Shell
遭遇Trojan-Spy.Win32.Delf.uv,Trojan.PSW.Win32.XYOnline,Trojan.PSW.Win32.ZhengTu等1
遭遇Trojan-Spy.Win32.Delf.uv,Trojan.PSW.Win32.XYOnline,Trojan.PSW.Win32.ZhengTu等1
游客qeoynko2nmbgk
47 2
游客qeoynko2nmbgk
|
3月前
|
安全 Windows
遭遇Backdoor.Gpigeon.2007.ca,Trojan-PSW.Win32.QQRob.lg,Backdoor.Win32.Agent.bcn等1
遭遇Backdoor.Gpigeon.2007.ca,Trojan-PSW.Win32.QQRob.lg,Backdoor.Win32.Agent.bcn等1
游客qeoynko2nmbgk
19 2
游客qeoynko2nmbgk
|
3月前
|
安全
某可人官方网站挂马Trojan-PSW.Win32.OnLineGames.sbg
某可人官方网站挂马Trojan-PSW.Win32.OnLineGames.sbg
游客qeoynko2nmbgk
37 1
游客qeoynko2nmbgk
|
3月前
|
安全 Windows
遭遇RootKit.Win32.GameHack.GEN,Trojan.PSW.Win32.GameOL.GEN,RootKit.Win32.Mnless等2
遭遇RootKit.Win32.GameHack.GEN,Trojan.PSW.Win32.GameOL.GEN,RootKit.Win32.Mnless等2
游客qeoynko2nmbgk
37 2
游客qeoynko2nmbgk
|
3月前
|
安全
遭遇RootKit.Win32.GameHack.GEN,Trojan.PSW.Win32.GameOL.GEN,RootKit.Win32.Mnless等1
遭遇RootKit.Win32.GameHack.GEN,Trojan.PSW.Win32.GameOL.GEN,RootKit.Win32.Mnless等1
游客qeoynko2nmbgk
41 2
游客qeoynko2nmbgk
|
3月前
|
安全 网络协议
刘三姐故乡的某网站被植入下载Worm.Win32.Delf.bse, Worm.Win32.Viking.ls等的代码
刘三姐故乡的某网站被植入下载Worm.Win32.Delf.bse, Worm.Win32.Viking.ls等的代码
游客qeoynko2nmbgk
19 3
游客qeoynko2nmbgk
|
3月前
|
安全 JavaScript 前端开发
某政府网站被挂木马txet.exe/Trojan-PSW.Win32.QQRob.iy
某政府网站被挂木马txet.exe/Trojan-PSW.Win32.QQRob.iy
游客qeoynko2nmbgk
23 2
游客qeoynko2nmbgk
|
3月前
|
安全
遭遇RootKit.Win32.GameHack,Trojan.PSW.Win32.QQPass,Trojan-PSW.Win32.OnLineGames等1
遭遇RootKit.Win32.GameHack,Trojan.PSW.Win32.QQPass,Trojan-PSW.Win32.OnLineGames等1
游客qeoynko2nmbgk
44 0

热门文章

最新文章

  • 1
    四大触点，教你从“用户视角”构建数据分析体系
  • 2
    Spring-boot+Dubbo应用启停源码分析
  • 3
    《Stata统计分析与应用（第2版）》一3.4 图形的保存、合并及修改
  • 4
    RocketMq-Request-Reply消息
  • 5
    Confluence 6 手动添加用户
  • 6
    2013年4月20日 通用权限管理系统组件V3.8功能改进说明
  • 7
    Configuring EIGRP Unequal-Cost Paths
  • 8
    PowerShell 指定关键词遍历文件内容
  • 9
    Windows时间服务出现故障 向用户发送错误的时间
  • 10
    三种dedecms调用相关文章的方法
  • 1
    《鸿蒙HarmonyOS应用开发从入门到精通（第2版）》简介
    39
  • 2
    《Python 助力：人工智能模型的“瘦身”与“加速”之旅》
    102
  • 3
    《非计算机专业者：Python 开启人工智能职业新航道》
    29
  • 4
    《Python赋能：智绘智慧城市新蓝图》
    34
  • 5
    《智育新篇：点亮学生人工智能伦理与社会责任之光》
    38
  • 6
    《数据主权：人工智能时代的核心基石与挑战》
    26
  • 7
    鸿蒙HarmonyOS应用开发 | 探索 HarmonyOS Next-从开发到实战掌握 HarmonyOS Next 的分布式能力
    102
  • 8
    鸿蒙原生开发环境的创新与性能优化：从工具到跨平台支持的全方位提升
    254
  • 9
    鸿蒙HarmonyOS应用开发 | 「鸿蒙技术分享」HarmonyOS NEXT元服务卡片实战体验
    150
  • 10
    Qwen-Coder：通过Qwen 2.5模型实现智能代码生成的技术实践
    33

    • 相关电子书

    更多
  • 低代码开发师（初级）实战教程
  • 冬季实战营第三期：MySQL数据库进阶实战
  • 阿里巴巴DevOps 最佳实践手册
    • 下一篇
    DataWorks