遭遇auto.exe,Hack.ArpCheater.a(ARP欺骗工具),Trojan.PSW.ZhengTu等1

最新推荐文章于 2024-09-19 14:54:23 发布

紫郢剑侠

最新推荐文章于 2024-09-19 14:54:23 发布

阅读量2k

点赞数

分类专栏：系统维护文章标签：工具 microsoft windows system c dll

本文链接：https://blog.csdn.net/Purpleendurer/article/details/1704462

版权

系统维护专栏收录该内容

497 篇文章 1 订阅

订阅专栏

遭遇auto.exe,Hack.ArpCheater.a(ARP欺骗工具),Trojan.PSW.ZhengTu等1

endurer 原创
2007-07-23 第1版

一位网友说他的电脑昨晚使用时出现蓝屏，刚才打开电脑后，进入桌面后时弹出对话框，提示explorer.exe出错，确定后任务栏自动消失，杀毒软件监控也没见影子……让偶通过QQ远程协助。

下载 pe_xscan 扫描 log并分析，发现如下可疑项（进程模块部分有省略）：

/===
pe_xscan 07-07-21 by Purple Endurer
2007-7-22 20:27:50
Windows XP Service Pack 2(5.1.2600)
管理员用户组

C:/WINDOWS/system32/drivers/smss.exe * 3464 | 2007-7-18 19:57:56

O2 - BHO - {D3626E66-B13B-C628-ACDF-BDABCFA265E1} - C:/Program Files/Common Files/Relive.dll
O2 - BHO - {D7515C61-A66C-4319-A0E0-D416CB8059E3} - C:/Program Files/Common Files/Relive.dll
O2 - BHO - {E3616E66-C13B-2628-2CDF-EDABCFA235E1} - C:/Program Files/Common Files/Relive.dll
O2 - BHO AlxTB BHO Class - {F1FABE79-25FC-46de-8C5A-2C6DB9D64333} - C:/WINDOWS/system32/AlxTB1.dll

O4 - HKLM/../Run: [wosa] C:/DOCUME~1/user/LOCALS~1/Temp/woso.exe
O4 - HKLM/../Run: [ztsa] C:/DOCUME~1/user/LOCALS~1/Temp/ztso.exe
O4 - HKLM/../Run: [mhsa] C:/DOCUME~1/user/LOCALS~1/Temp/mhso.exe
O4 - HKLM/../Run: [fysa] C:/DOCUME~1/user/LOCALS~1/Temp/fyso.exe
O4 - HKLM/../Run: [jtsa] C:/DOCUME~1/user/LOCALS~1/Temp/jtso.exe
O4 - HKLM/../Run: [wlsa] C:/DOCUME~1/user/LOCALS~1/Temp/wlso.exe
O4 - HKLM/../Run: [wgsa] C:/DOCUME~1/user/LOCALS~1/Temp/wgso.exe
O4 - HKLM/../Run: [wmsa] C:/DOCUME~1/user/LOCALS~1/Temp/wmso.exe
O4 - HKLM/../Run: [qjsa] C:/DOCUME~1/user/LOCALS~1/Temp/qjso.exe
O4 - HKLM/../Run: [rxsa] C:/DOCUME~1/user/LOCALS~1/Temp/rxso.exe
O4 - HKLM/../Run: [wdsa] C:/DOCUME~1/user/LOCALS~1/Temp/wdso.exe
O4 - HKLM/../Run: [tlsa] C:/DOCUME~1/user/LOCALS~1/Temp/tlso.exe
O4 - HKLM/../Run: [dasa] C:/DOCUME~1/user/LOCALS~1/Temp/daso.exe
O4 - HKLM/../Run: [zxsa] C:/DOCUME~1/user/LOCALS~1/Temp/zxso.exe

O4 - HKLM/../Policies/Explorer/Run: [visin] C:/WINDOWS/system32/visin.exe

C:/autorun.inf
/-----
[autorun]
open=auto.exe
shell/open=打开(&O)
shell/open/Command=auto.exe
hell/explore=资源管理器(&X)
shell/explore/Command="auto.exe"
-----/
D:/autorun.inf
/-----
[autorun]
open=auto.exe
shell/open=打开(&O)
shell/open/Command=auto.exe
hell/explore=资源管理器(&X)
shell/explore/Command="auto.exe"
-----/

O8 - IE右键菜单附加项 : Alexa Web Search - http://client.alexa.com/holiday/script/actions/search.htm
O8 - IE右键菜单附加项 : Get Alexa Data - http://client.alexa.com/holiday/script/actions/sitedata.htm
O8 - IE右键菜单附加项 : Mail to a Friend... - http://client.alexa.com/holiday/script/actions/mailto.htm
O8 - IE右键菜单附加项 : See Related Links - http://client.alexa.com/holiday/script/actions/related.htm
O8 - IE右键菜单附加项 : Write a Review... - http://client.alexa.com/holiday/script/actions/review.htm

O11 - IE扩展选项组：TBH (中文搜搜) =

O24 - ShlExecHook: [] - {03F6E661-0D5F-3FAD-3E2B-E261E3CB6CD2} = C:/Program Files/Internet Explorer/PLUGINS/HiJack.dll
O24 - ShlExecHook: [] - {0EA12C16-CDEF-6AC1-236E-CD3FE82F5213} = C:/Program Files/Internet Explorer/msvcrt.dll
O24 - ShlExecHook: [] - {05AD2E16-C6EF-6AC1-136A-CE3FD8EF5613} = C:/Program Files/Internet Explorer/msvcrt.dll
O24 - ShlExecHook: [] - {0FAD2E16-C8EF-5AC1-1E6A-AE3FD8EF56B3} = C:/Program Files/Internet Explorer/msvcrt.dll

O25 - InsCom: {11716107-A10D-11cf-64CD-11115FE1CF41} = C:/WINDOWS/system32/nwizzhuxians.exe

HKLM/SHOWALL 值非1
===/

大部分以前遇到过~
处理过程留待下回分解~