又见winforms.dll,LYLoadbr.exe,LYLeador.exe,mydata.exe,CnsM.dll等
一位网友说他的电脑在使用瑞星查杀出几百个病毒后，系统反应速度仍然比较慢，CPU使用率有时达100%。请偶帮忙检修。
使用 pe_xscan 扫描 log 并分析，发现如下可疑项：
/===
pe_xscan 08-01-16 by Purple Endurer
2008-1-16 14:0:1
Windows XP Service Pack 2(5.1.2600)
非管理员用户组
[System Process] * 0
C:/PROGRA~1/3721/CnsM.dll | 2007-9-17 18:49:12 | | 2.5.0.1001 | CnsM | 版权所有 (C) 2007 | 2.5.6.1009 | | | CnsM | CnsM.dll
C:/WINDOWS/Explorer.EXE* 1256 | 2007-6-13 21:21:56 | Microsoft(R) Windows(R) Operating System | 6.00.2900.3156 | Windows Explorer | (C) Microsoft Corporation. All rights reserved. | 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234) | Microsoft Corporation| ? | explorer | EXPLORER.EXE
C:/PROGRA~1/3721/CnsM.dll | 2007-9-17 18:49:12 | | 2.5.0.1001 | CnsM | 版权所有 (C) 2007 | 2.5.6.1009 | | | CnsM | CnsM.dll
C:/Program Files/Rising/AntiSpyware/RUNIEP.EXE* 396 | 2007-8-17 14:38:56 | runiep 应用程序 | 4.00 | Rising AntiSpyware Monitor | Rising Corp. All rights reserved. | 4.0.0.18 | Beijing Rising Technology Co., Ltd. | | Beijing Rising Technology Co., Ltd. | runiep.exe
C:/PROGRA~1/3721/CnsM.dll | 2007-9-17 18:49:12 | | 2.5.0.1001 | CnsM | 版权所有 (C) 2007 | 2.5.6.1009 | | | CnsM | CnsM.dll
C:/WINDOWS/System32/RunDll32.exe* 484 | 2005-11-6 0:0:0 | Microsoft(R) Windows(R) Operating System | 5.1.2600.2180 | Run a DLL as an App | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | rundll | RUNDLL.EXE
C:/PROGRA~1/3721/CnsM.dll | 2007-9-17 18:49:12 | | 2.5.0.1001 | CnsM | 版权所有 (C) 2007 | 2.5.6.1009 | | | CnsM | CnsM.dll
C:/Program Files/Rising/Rav/RavTask.exe* 2072 | 2008-1-14 12:4:58 | Rising Antivirus 2008 | 20.00 | RavTimer | Rising Corp.All rights reserved. | 20.0.0.22 | Beijing Rising Technology Co., Ltd.| ? | Beijing Rising Technology Co., Ltd. | RavTask.exe
C:/PROGRA~1/3721/CnsM.dll | 2007-9-17 18:49:12 | | 2.5.0.1001 | CnsM | 版权所有 (C) 2007 | 2.5.6.1009 | | | CnsM | CnsM.dll
C:/WINDOWS/System32/ctfmon.exe* 2080 | 2005-11-6 0:0:0 | Microsoft? Windows? Operating System | 5.1.2600.2180 | CTF Loader | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | CTFMON | CTFMON.EXE
C:/PROGRA~1/3721/CnsM.dll | 2007-9-17 18:49:12 | | 2.5.0.1001 | CnsM | 版权所有 (C) 2007 | 2.5.6.1009 | | | CnsM | CnsM.dll
C:/Program Files/Internet Explorer/IEXPLORE.EXE* 2068 | 2005-11-6 8:0:0 | Microsoft(R) Windows(R) Operating System | 6.00.2900.2180 | Internet Explorer | (C) Microsoft Corporation. All rights reserved. | 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | iexplore | IEXPLORE.EXE
C:/PROGRA~1/3721/CnsM.dll | 2007-9-17 18:49:12 | | 2.5.0.1001 | CnsM | 版权所有 (C) 2007 | 2.5.6.1009 | | | CnsM | CnsM.dll
C:/Program Files/Rising/Rav/RavMon.exe* 3868 | 2008-1-14 12:1:20 | Rising AntiVirus 2008 | 20.00 | Rising realtime monitor shell | Rising Corp. All rights reserved. | 20.0.01.08 | Beijing Rising Technology Co., Ltd.| ? | Beijing Rising Technology Co., Ltd. | RavTray.EXE
C:/PROGRA~1/3721/CnsM.dll | 2007-9-17 18:49:12 | | 2.5.0.1001 | CnsM | 版权所有 (C) 2007 | 2.5.6.1009 | | | CnsM | CnsM.dll
C:/WINDOWS/System32/conime.exe* 2260 | 2005-11-6 0:0:0 | Microsoft? Windows? Operating System | 5.1.2600.2180 | Console IME | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | Console | CONIME.EXE
C:/PROGRA~1/3721/CnsM.dll | 2007-9-17 18:49:12 | | 2.5.0.1001 | CnsM | 版权所有 (C) 2007 | 2.5.6.1009 | | | CnsM | CnsM.dll
O4 - HKLM/../Run: [CnsM.dll] Rundll32.exe C:/PROGRA~1/3721/CnsM.dll,Rundll32
O4 - HKLM/../Run: [WinSysM] C:/WINDOWS/235780M.exe
O4 - HKLM/../Run: [WinSysW] C:/WINDOWS/235780L.exe
O4 - HKLM/../Policies/Explorer/Run: [MSDWG32] LYLoadbr.exe
O4 - HKLM/../Policies/Explorer/Run: [MSDCG32 ] LYLeador.exe
O4 - HKLM/../Policies/Explorer/Run: [MSDOG32] LYLoador.exe
O4 - HKLM/../Policies/Explorer/Run: [MSDSG32] LYLoadar.exe
O4 - HKLM/../Policies/Explorer/Run: [MSDHG32] LYLoadhr.exe
O4 - HKLM/../Policies/Explorer/Run: [MSDQG32] LYLoadqr.exe
O20 - AppInit_DLLs = winforms.dll
O23 - 服务: NPF (NetGroup Packet Filter Driver) - system32/drivers/npf.sys | WinPcap Netgroup Packet Filter Driver | 3, 1, 0, 24 | npf | Copyright ? 1999-2004 | 3, 1, 0, 24 | NetGroup - Politecnico di Torino | | NPF + TME | npf.sys(手动)
O23 - 服务: qfqjp (qfqjp) - C:/WINDOWS/System32/drivers/qfqjp.sys | 2007-10-8 15:18:56 | sys 应用程序 | 1, 0, 1, 3 | sys 应用程序 | 版权所有 (C) 2006 | 1, 0, 1, 3 | 北京三七二一科技有限公司| ? | sys | sys.exe(引导)
O23 - 服务: rpcapd (Remote Packet Capture Protocol v.0 (experimental)) - "%ProgramFiles%/WinPcap/rpcapd.exe" -d -f "%ProgramFiles%/WinPcap/rpcapd.ini"(手动)
O24 - ShlExecHook: [4] - {AEB6717E-7E19-11d0-97EE-00C04FD91974} = winforms.dll
O25 - InsCom: {6A202101-A04D-21cf-65CD-31FF5FE1CF20} = C:/WINDOWS/system32/mydata.exe
===/
