使用映像劫持,ARP欺骗,autorun.inf等技术的AV杀手mgemtjk.exe,sb.exe,qodwjay.exe,smsovct.exe等1...

最新推荐文章于 2022-05-07 14:39:21 发布
最新推荐文章于 2022-05-07 14:39:21 发布
阅读量981 收藏
点赞数
文章标签： 操作系统 shell

使用映像劫持,ARP欺骗,autorun.inf等技术的AV杀手mgemtjk.exe,sb.exe,qodwjay.exe,smsovct.exe等1

endurer 原创
2008-01-07 第1版


　　今天早上办公室的电脑打开任一网页，卡巴就报告：

　　已检测到: 恶意程序 Exploit.JS.RealPlr.tURL: hxxp://***.5*20s**b*.cn/ad/images/*real**.htm

　　典型的ARP病毒作怪。

　　正在检查ARP地址信息，一位同事来说他的电脑不正常，鼠标指针变是带着漏斗形状，系统反应很慢，让偶帮助检修。

　　在同事的电脑中打开msconfig.exe，检查开机启动项，发现如下 pe_xscan 的log中的O4项，其中一项名为：ArpInsert，原来是它在作怪。

　　先把这台电脑的网线拔出来，运行 pe_xscan 扫描 log 并分析，发现如下可疑项（进程模块部分有省略，另外O1部分是安全软件添加的，所以也省略了）：
/===

 

pe_xscan 07-12-26 by Purple Endurer
2008-1-7 9:20:36
Windows XP Service Pack 2(5.1.2600)
管理员用户组
 

[System Process] * 0
　　 C:/WINDOWS/system32/kvdxsmma.dll | 2004-8-4 15:28:16 
　　 C:/WINDOWS/Fonts/hookhelp.dll | 2008-1-4 15:22:30 
　　 C:/WINDOWS/system32/wsmsezx.dll | 2004-8-4 21:28:40 
　　 C:/WINDOWS/Fonts/gjcsdyc.dll | 2004-8-4 8:42:32 
　　 C:/WINDOWS/Fonts/swrcgzc.dll | 2004-8-4 17:7:4 
　　 C:/WINDOWS/Fonts/avwljmn.dll | 2004-8-4 17:6:50 
　　 C:/WINDOWS/system32/avwghmn.dll | 2004-8-4 15:28:40 
　　 C:/WINDOWS/system32/rarjepi.dll | 2004-8-4 15:28:28 
　　 C:/WINDOWS/system32/kawdizy.dll | 2004-8-4 15:28:24 
　　 C:/WINDOWS/system32/avzxmmn.dll | 2004-8-4 15:28:8 
　　 C:/WINDOWS/system32/ratbspi.dll | 2004-8-4 15:28:4 
　　 C:/WINDOWS/system32/kaqhlzy.dll | 2004-8-4 15:27:58 
　　 C:/WINDOWS/system32/rsmyjpm.dll | 2004-8-4 15:27:46 
　　 C:/WINDOWS/system32/okmhdzy.dll | 2004-8-4 15:27:42 
C:/WINDOWS/system32/winlogon.exe * 692 | 2004-8-4 0:52:38 | Microsoft(R) Windows(R) Operating System | 5.1.2600.2180 | Windows NT Logon Application | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | winlogon | WINLOGON.EXE 
　　 C:/WINDOWS/system32/wsmsezx.dll | 2004-8-4 21:28:40 
C:/WINDOWS/system32/services.exe * 740 | 2004-8-4 0:52:38 | Microsoft(R) Windows(R) Operating System | 5.1.2600.2180 | Services and Controller app | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | services.exe | services.exe 
　　 C:/WINDOWS/system32/wsmsezx.dll | 2004-8-4 21:28:40 
C:/WINDOWS/system32/lsass.exe * 752 | 2004-8-4 0:52:32 | Microsoft? Windows? Operating System | 5.1.2600.2180 | LSA Shell (Export Version) | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | lsass.exe | lsass.exe 
　　 C:/WINDOWS/system32/wsmsezx.dll | 2004-8-4 21:28:40 
C:/WINDOWS/system32/svchost.exe * 908 | 2004-8-4 0:52:38 | Microsoft? Windows? Operating System | 5.1.2600.2180 | Generic Host Process for Win32 Services | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | svchost.exe | svchost.exe 
　　 C:/WINDOWS/system32/wsmsezx.dll | 2004-8-4 21:28:40 
C:/WINDOWS/Explorer.EXE * 1548 | 2004-8-4 0:52:32 | Microsoft(R) Windows(R) Operating System | 6.00.2900.2180 | Windows Explorer | (C) Microsoft Corporation. All rights reserved. | 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | explorer | EXPLORER.EXE 
　　 C:/WINDOWS/system32/wsmsezx.dll | 2004-8-4 21:28:40 
　　 C:/WINDOWS/Fonts/hookhelp.dll | 2008-1-4 15:22:30 
　　 C:/WINDOWS/system32/okmhdzy.dll | 2004-8-4 15:27:42 
　　 C:/WINDOWS/system32/rsmyjpm.dll | 2004-8-4 15:27:46 
　　 C:/WINDOWS/system32/kaqhlzy.dll | 2004-8-4 15:27:58 
　　 C:/WINDOWS/system32/ratbspi.dll | 2004-8-4 15:28:4 
　　 C:/WINDOWS/system32/avzxmmn.dll | 2004-8-4 15:28:8 
　　 C:/WINDOWS/system32/kvdxsmma.dll | 2004-8-4 15:28:16 
　　 C:/WINDOWS/system32/kawdizy.dll | 2004-8-4 15:28:24 
　　 C:/WINDOWS/system32/rarjepi.dll | 2004-8-4 15:28:28 
　　 C:/WINDOWS/system32/avwghmn.dll | 2004-8-4 15:28:40 
　　 C:/WINDOWS/Fonts/avwljmn.dll | 2004-8-4 17:6:50 
　　 C:/WINDOWS/Fonts/swrcgzc.dll | 2004-8-4 17:7:4 
　　 C:/WINDOWS/919331MM.DLL | 2008-1-7 9:7:48 
　　 C:/WINDOWS/Fonts/gjcsdyc.dll | 2004-8-4 8:42:32 
　　 C:/PROGRA~1/baidu/bar/baidubar.dll | 2007-11-7 14:40:56 | BaiduBar Module | 2, 0, 2, 158 | BaiduBar Module | Copyright 2005 | 2, 0, 2, 158 | Baidu.com, Inc. | | BaiduBar | BaiduBar.DLL 
C:/Program Files/Common Files/Real/Update_OB/realsched.exe * 1884 | 2007-12-16 21:29:32 | RealPlayer (32-bit) | 0.1.0.4279 | RealNetworks Scheduler | Copyright ? RealNetworks, Inc. 1995-2007 | 0.1.0.4279 | RealNetworks, Inc. | RealAudio(tm) is a trademark of RealNetworks, Inc. | schedapp | realsched.exe 

　　 C:/WINDOWS/system32/kvdxsmma.dll | 2004-8-4 15:28:16 
　　 C:/WINDOWS/Fonts/hookhelp.dll | 2008-1-4 15:22:30 
C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe * 1908 | 2007-12-27 9:18:16 
　　 C:/WINDOWS/Fonts/hookhelp.dll | 2008-1-4 15:22:30 
　　 C:/WINDOWS/system32/kvdxsmma.dll | 2004-8-4 15:28:16 
C:/Program Files/Common Files/System/qodwjay.exe * 1916 | 2007-12-27 9:18:16 
　　 C:/WINDOWS/system32/wsmsezx.dll | 2004-8-4 21:28:40 
　　 C:/WINDOWS/system32/kvdxsmma.dll | 2004-8-4 15:28:16 
　　 C:/WINDOWS/Fonts/hookhelp.dll | 2008-1-4 15:22:30 
　　 C:/WINDOWS/system32/okmhdzy.dll | 2004-8-4 15:27:42 
　　 C:/WINDOWS/system32/rsmyjpm.dll | 2004-8-4 15:27:46 
　　 C:/WINDOWS/system32/kaqhlzy.dll | 2004-8-4 15:27:58 
　　 C:/WINDOWS/system32/ratbspi.dll | 2004-8-4 15:28:4 
　　 C:/WINDOWS/system32/avzxmmn.dll | 2004-8-4 15:28:8 
　　 C:/WINDOWS/system32/kawdizy.dll | 2004-8-4 15:28:24 
　　 C:/WINDOWS/system32/rarjepi.dll | 2004-8-4 15:28:28 
　　 C:/WINDOWS/system32/avwghmn.dll | 2004-8-4 15:28:40 
　　 C:/WINDOWS/Fonts/avwljmn.dll | 2004-8-4 17:6:50 
　　 C:/WINDOWS/Fonts/swrcgzc.dll | 2004-8-4 17:7:4 
　　 C:/WINDOWS/Fonts/gjcsdyc.dll | 2004-8-4 8:42:32 
C:/WINDOWS/system32/ctfmon.exe * 1924 | 2004-8-4 0:52:30 | Microsoft? Windows? Operating System | 5.1.2600.2180 | CTF Loader | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | CTFMON | CTFMON.EXE 
　　 C:/WINDOWS/system32/wsmsezx.dll | 2004-8-4 21:28:40 
　　 C:/WINDOWS/system32/kvdxsmma.dll | 2004-8-4 15:28:16 
　　 C:/WINDOWS/Fonts/hookhelp.dll | 2008-1-4 15:22:30 
C:/WINDOWS/system32/conime.exe * 204 | 2004-8-4 0:52:30 | Microsoft? Windows? Operating System | 5.1.2600.2180 | Console IME | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | Console | CONIME.EXE 
　　 C:/WINDOWS/system32/wsmsezx.dll | 2004-8-4 21:28:40 
　　 C:/WINDOWS/Fonts/hookhelp.dll | 2008-1-4 15:22:30 
　　 C:/WINDOWS/system32/kvdxsmma.dll | 2004-8-4 15:28:16 
C:/WINDOWS/system32/svchost.exe * 224 | 2004-8-4 0:52:38 | Microsoft? Windows? Operating System | 5.1.2600.2180 | Generic Host Process for Win32 Services | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | svchost.exe | svchost.exe 
　　 C:/WINDOWS/system32/sb.dll | 2008-1-7 8:36:34 
C:/WINDOWS/system32/svchost.exe * 412 | 2004-8-4 0:52:38 | Microsoft? Windows? Operating System | 5.1.2600.2180 | Generic Host Process for Win32 Services | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | svchost.exe | svchost.exe 
　　 C:/WINDOWS/system32/npp/ndisnpp.dll | 2004-8-4 0:52:20 | Microsoft? Windows? Operating System | 5.1.2600.2180 | Network Monitor NDIS Network Packet Provider | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | NDISNPP.DLL | NDISNPP.DLL 
C:/WINDOWS/system32/svchost.exe * 1020 | 2004-8-4 0:52:38 | Microsoft? Windows? Operating System | 5.1.2600.2180 | Generic Host Process for Win32 Services | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | svchost.exe | svchost.exe 
　　 C:/WINDOWS/system32/wsmsezx.dll | 2004-8-4 21:28:40 
C:/WINDOWS/system32/svchost.exe * 2068 | 2004-8-4 0:52:38 | Microsoft? Windows? Operating System | 5.1.2600.2180 | Generic Host Process for Win32 Services | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | svchost.exe | svchost.exe 
　　 C:/WINDOWS/system32/kvdxsmma.dll | 2004-8-4 15:28:16 
　　 C:/WINDOWS/Fonts/hookhelp.dll | 2008-1-4 15:22:30 
C:/Program Files/Common Files/System/qodwjay.exe * 10244 | 2007-12-27 9:18:16 
　　 C:/WINDOWS/system32/kvdxsmma.dll | 2004-8-4 15:28:16 
　　 C:/WINDOWS/Fonts/hookhelp.dll | 2008-1-4 15:22:30 
C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe * 9148 | 2007-12-27 9:18:16 
　　 C:/WINDOWS/Fonts/hookhelp.dll | 2008-1-4 15:22:30 
　　 C:/WINDOWS/system32/kvdxsmma.dll | 2004-8-4 15:28:16 
C:/Program Files/Common Files/System/qodwjay.exe * 10916 | 2007-12-27 9:18:16 
　　 C:/WINDOWS/Fonts/hookhelp.dll | 2008-1-4 15:22:30 
　　 C:/WINDOWS/system32/kvdxsmma.dll | 2004-8-4 15:28:16 
C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe * 16572 | 2007-12-27 9:18:16 
　　 C:/WINDOWS/system32/wsmsezx.dll | 2004-8-4 21:28:40 
　　 C:/WINDOWS/system32/kvdxsmma.dll | 2004-8-4 15:28:16 
　　 C:/WINDOWS/Fonts/hookhelp.dll | 2008-1-4 15:22:30 
sb.exe * 32108 
 

O2 - BHO BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - C:/PROGRA~1/baidu/bar/baidubar.dll
O2 - BHO - {9963387B-212E-4643-B207-82DAEA0E713D} - C:/Program Files/Internet Explorer/PLUGINS/Wn_Sys8x.Sys
 

O3 - IE工具栏: - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:/PROGRA~1/baidu/bar/baidubar.dll
 

O4 - HKLM/../Run: [WinSysM] C:/WINDOWS/919331M.exe
O4 - HKLM/../Run: [ArpInsert] C:/WINDOWS/system32/sb.exe
O4 - HKLM/../Run: [smsovct] C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O4 - HKLM/../Run: [jhqocsd] C:/Program Files/Common Files/System/qodwjay.exe
 

C:/autorun.inf
/-----
[AutoRun]
open=smsovct.exe
shell/open=打开(&O)
shell/open/Command=smsovct.exe
shell/open/Default=1
shell/explore=资源管理器(&X)
shell/explore/Command=smsovct.exe
-----/
D:/autorun.inf
/-----
[AutoRun]
open=smsovct.exe
shell/open=打开(&O)
shell/open/Command=smsovct.exe
shell/open/Default=1
shell/explore=资源管理器(&X)
shell/explore/Command=smsovct.exe
-----/
E:/autorun.inf
/-----
[AutoRun]
open=smsovct.exe
shell/open=打开(&O)
shell/open/Command=smsovct.exe
shell/open/Default=1
shell/explore=资源管理器(&X)
shell/explore/Command=smsovct.exe
-----/
F:/autorun.inf
/-----
[AutoRun]
open=smsovct.exe
shell/open=打开(&O)
shell/open/Command=smsovct.exe
shell/open/Default=1
shell/explore=资源管理器(&X)
shell/explore/Command=smsovct.exe
-----/
 

O6 - HKCU/Software/Policies/Microsoft/Internet Explorer/Control Panel 存在 IE或Internet选项可能受到限制
 

O23 - 服务: BdGuard (BdGuard) - system32/drivers/BDGuard.SYS | BDGUARD Dynamic Link Library | 1, 0, 12, 0 | BDGUARD Dynamic Link Library | Copyright (C) 2005 | 1, 0, 12, 0| ?| ? | BDGUARD | Bdguard.dll(引导)
 

O23 - 服务: NPF (Netgroup Packet Filter) - system32/drivers/npf.sys | WinPcap Netgroup Packet Filter Driver | 3, 1, 0, 27 | npf | Copyright ? 2005 CACE Technologies. Copyright ? 2003-2005 NetGroup, Politecnico di Torino. | 3, 1, 0, 27 | CACE Technologies | | NPF + TME | npf.sys(手动)
 

O23 - 服务: PciHardDisk (PciHardDisk) - C:/WINDOWS/system32/drivers/pcidisk.sys(手动)
 

O24 - ShlExecHook: [7] - {792FADFA-BCDE-ACDF-CDEF-21054865CBA7} = C:/WINDOWS/system32/wsmsezx.dll
O24 - ShlExecHook: [E] - {E159854F-6971-3456-6941-10235412974E} = C:/WINDOWS/Fonts/hookhelp.dll
O24 - ShlExecHook: [4] - {4A57CAD1-412F-9547-713F-9641FA3FC7A4} = C:/WINDOWS/system32/okmhdzy.dll
O24 - ShlExecHook: [A] - {AE32FA58-3453-FA2D-BC49-F340348ACCEA} = C:/WINDOWS/system32/rsmyjpm.dll
O24 - ShlExecHook: [C] - {C7D81718-1314-5200-2597-58790101807C} = C:/WINDOWS/system32/kaqhlzy.dll
O24 - ShlExecHook: [4] - {47650011-3344-6688-4899-345FABCD1574} = C:/WINDOWS/system32/ratbspi.dll
O24 - ShlExecHook: [D] - {D859245F-345D-BC13-AC4F-145D47DA34FD} = C:/WINDOWS/system32/avzxmmn.dll
O24 - ShlExecHook: [D] - {DD561258-45F3-A451-F908-A258458226DD} = C:/WINDOWS/system32/kvdxsmma.dll
O24 - ShlExecHook: [9] - {9960356A-458E-DE24-BD50-268F589A56A9} = C:/WINDOWS/system32/avwlimn.dll
O24 - ShlExecHook: [9] - {98907901-1416-3389-9981-372178569989} = C:/WINDOWS/system32/kawdizy.dll
O24 - ShlExecHook: [5] - {5598FF45-DA60-F48A-BC43-10AC47853D55} = C:/WINDOWS/system32/rarjepi.dll
O24 - ShlExecHook: [7] - {778A7521-FA87-34AB-34C2-4893F3AD34C7} = C:/WINDOWS/system32/swrcfzc.dll
O24 - ShlExecHook: [8] - {8A1247C1-53DA-FF43-ABD3-345F323A48D8} = C:/WINDOWS/system32/avwghmn.dll
O24 - ShlExecHook: [A] - {A960356A-458E-DE24-BD50-268F589A56AA} = C:/WINDOWS/Fonts/avwljmn.dll
O24 - ShlExecHook: [8] - {878A7521-FA87-34AB-34C2-4893F3AD34C8} = C:/WINDOWS/Fonts/swrcgzc.dll
O24 - ShlExecHook: [4] - {4FA10261-B890-F432-A453-69F1023513F4} = C:/WINDOWS/Fonts/gjcsdyc.dll
 

O26 - IFEO: 360rpt.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: 360Safe.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: 360tray.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: adam.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: AgentSvr.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: AppSvc32.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: ArSwp.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: AST.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: autoruns.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: AvastU3.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: avconsol.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: avgrssvc.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: AvMonitor.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: avp.com -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: avp.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: CCenter.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: ccSvcHst.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: EGHOST.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: FileDsty.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: FTCleanerShell.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: FYFireWall.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: ghost.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: HijackThis.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: IceSword.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: iparmo.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: Iparmor.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: irsetup.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: isPwdSvc.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: kabaload.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KaScrScn.SCR -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KASMain.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KASTask.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KAV32.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KAVDX.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KAVPF.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KAVPFW.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KAVSetup.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KAVStart.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KISLnchr.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KMailMon.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KMFilter.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KPFW32.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KPFW32X.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KPfwSvc.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KRegEx.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KRepair.com -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KsLoader.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KVCenter.kxp -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KvDetect.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KvfwMcl.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KVMonXP.kxp -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KVMonXP_1.kxp -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: kvol.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: kvolself.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KvReport.kxp -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KVScan.kxp -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KVSrvXP.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KVStub.kxp -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: kvupload.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: kvwsc.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KvXP.kxp -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KvXP_1.kxp -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KWatch.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KWatch9x.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: KWatchX.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: loaddll.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: MagicSet.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: mcconsol.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: mmqczj.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: mmsk.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: Navapsvc.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: Navapw32.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: nod32.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: nod32krn.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: nod32kui.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: NPFMntor.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: PFW.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: PFWLiveUpdate.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: QHSET.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: QQDoctor.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: QQKav.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: QQSC.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: Ras.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: Rav.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: RavMon.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: RavMonD.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: RavStub.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: RavTask.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: RegClean.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: rfwcfg.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: RfwMain.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: rfwsrv.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: RsAgent.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: Rsaupd.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: rstrui.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: runiep.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: safelive.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: scan32.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: shcfg32.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: SmartUp.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: SREng.EXE -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: symlcsvc.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: SysSafe.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: TrojanDetector.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: Trojanwall.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: TrojDie.kxp -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: UIHost.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: UmxAgent.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: UmxAttachment.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: UmxCfg.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: UmxFwHlp.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: UmxPol.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: upiea.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: UpLive.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: USBCleaner.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: vsstat.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: webscanx.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: WoptiClean.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
O26 - IFEO: zjb.exe -> C:/Program Files/Common Files/Microsoft Shared/mgemtjk.exe
===/

                

        

        




    




    

      

        

            

              
                
                  iteye_6637
                
              
            

            

                关注
              
            

        

        

          
    
            
  • 
              
                
                
                
                
                      0
                
              
              
    点赞
    
            
    • 
            
  • 
              
                
                
                
              
              
    踩
    
            
    • 
            
  • 
              
                
                
                
                
                    0
                
              
              
    
                
    
                  
                    收藏
                  
                
    
              
    
              
    
                
    
                  觉得还不错?
                  
                    一键收藏
                  
                 
                
    
              
    
            
    • 
          
  • 
            
    
              
              
            
    
              
              
              
                    0
              
            
            
    评论
    
          
    • 
          
  • 
          
    • 
          
  • 
            
              
            
              
    
            
              
                
            
    
          
    • 
        

      

      










                



	

		

			

				
					
通达信手机版服务器文件夹,【通达信】通达信的一些目录和系统文件，用法说明。以备查询。...

				
			

			

				

					weixin_30195669的博客
				

				

					08-06
					
					6297
					
				

			

		

		

			
				
T0002目录下的文件说明如果重装到一个新位置，只需将整个T0002拷贝过去就可以了,所有的个性化数据都在此目录下Advhq.dat 星空图相关个性化数据Block.cfg 板块设置文件cbset.dat 筹码分析个性化数据CoolInfo.Txt 系统备忘录Line.dat 画线工具数据MyFavZX.dat 资讯收藏夹数据newmodem.ini 交易客户端个性化数据padinfo.dat 定...

			
		

	



                

              
                



	

		

			

				
					
感染explorer.exe,使用映像劫持,ShellExecHook…的AV杀手GRHSGIH.EXE1

				
			

			

				

					caobihole
				

				

					01-18
					
					1731
					
				

			

		

		

			
				
感染explorer.exe,使用映像劫持,ShellExecHook…的AV杀手GRHSGIH.EXE1
endurer 原创2008-01-18 第1版
刚才一位朋友打电话来求助，说他电脑中了病毒，金山毒霸无法启动，无法复制/粘贴……
赶到朋友家，下载 pe_xscan 扫描 log 发现如下可疑项(进程模块部分有省略)：
/===
pe_xscan 08-01-10 by Purp...

			
		

	



                


  
              

                


	

		

			

				
					
牛逼的导航

				
			

			

				

					HkEndless的专栏
				

				

					12-27
					
					6万+
					
				

			

		

		

			
				
It will be read and overwritten.
     DO NOT EDIT! -->

Bookmarks
Bookmarks Menu


    Recently Bookmarked
    Recent Tags
    

    Get
 Bookmark Add-ons
    
    Mozilla Firefox

			
		

	





	

		

			

				
					
91.vido.ws v.php,"token" parameter not in video info for unknown reason;

				
			

			

				

					weixin_35307279的博客
				

				

					03-29
					
					77万+
					
				

			

		

		

			
				
youtube-dl -v --dump-pages https://www.youtube.com/watch?v=USg3NR76XpQ output[debug] System config: [][debug] User config: [u'--add-metadata', u'--user-agent', u'Mozilla/5.0 (X11; Ubuntu; Linux x86_64...

			
		

	



		

			
		



	

		

			

				
					
cuda ,常量内存使用

				
			

			

				

					RtZero的博客
				

				

					03-24
					
					8783
					
				

			

		

		

			
				
#include "cuda_runtime.h"
#include "device_launch_parameters.h"
#include 
#include 
#include "assert.h"
#include "conio.h"
using namespace std;

#define CUDA_CALL(x){const cudaError_t a=(x);if(a!=cuda

			
		

	





	

		

			

				
					
H-JTAG-V0.3.2.rar_H JTAG.EXE_LPC2100.hfc_h-jtag 0.3.2_h-jtag.dll

				
			

			

				

					09-23
				

			

		

		

			
				
嵌入式系统开发工具，为单步调试，映像文件下载等提供便捷

			
		

	





	

		

			

				
					
WimTool.exe

				
			

			

				

					03-19
				

			

		

		

			
				
 2、全图形窗口操作界面(提供包括制作映像、解开映像的中止按钮)；  3、支持自由定义制作映像时捕获文件的规则；  4、高度智能的右键菜单，能完成大部分常规任务；  5、WimTool自己独特简化的命令行参数，包括注册...

			
		

	





	

		

			

				
					
yx映像文件制作工具.exe

				
			

			

				

					04-20
				

			

		

		

			
				
yx映像文件制作工具.exe

			
		

	





	

		

			

				
					
解除映像劫持工具.exe

				
			

			

				

					02-21
				

			

		

		

			
				
解除映像劫持工具可解决因映像劫持导致的程序不能运行问题    显示在红色列表框中为被劫持导致无法运行的程序名（同名程序不能在本机器上正常运行，可通过加号增加对其它程序文件的屏蔽）    显示在绿色列表框中为本...

			
		

	





	

		

			

				
					
Ghost映像一键转WIM&ESD映像_1.0.0.3.exe

				
			

			

				

					07-14
				

			

		

		

			
				
Ghost映像一键转WIM&ESD映像_1.0.0.3.exe

			
		

	





	

		

			

				
					
yanqiyetan V1.0 存档

				
			

			

				

					BRSblackshoot的博客
				

				

					05-07
					
					1万+
					
				

			

		

		

			
				
魇骑夜谭 V1.0 全流程剧情存档将下面的内容保存到txt文本中，将其重命名为 file1.rpgsave ，然后新建一个存档1，把刚才的文件覆盖这个档，就行了

这东西放云盘挂了还得补，就这样直接给本体，动动手再拿去用吧

N4IgzgnmAuCmC2IBcoD6YCGA3WBRAdhgEYA2sAJstAE4CusANCKvLPrQcWZUjfU6jYBjAPa18cap1IVkAMwwkwjZnJHV4GaAEsR+adyp0VqIluhkAwmInIAnAGYBAd235r46PafNYYIRgA.

			
		

	





	

		

			

				
					
CodeForces 552C:Vanya and Scales【技巧】

				
			

			

				

					所谓梦想，就是永不停息的疯狂。。。。。
				

				

					04-21
					
					957
					
				

			

		

		

			
				
C. Vanya and Scales


time limit per test
1 second


memory limit per test
256 megabytes


input
standard input


output
standard output



Vanya has a scales for weighing loads an

			
		

	





	

		

			

				
					
最近流行的一些木马群的查杀方法

				
			

			

				

					海蓝之家
				

				

					10-11
					
					3329
					
				

			

		

		

			
				
                                                                                                     （发在卡卡的一个帖子转到这里来，方便大家查阅）            最近通过木马下载器下载的木马群日益猖獗，写过一些分析，但比较零散，现在总结一下最近流行的一些木马群的

			
		

	





	

		

			

				
					
AVPlayer 播放在线视频和本地文件的设置区别

					
热门推荐

				
			

			

				

					Mr.xiaoma.wen
				

				

					06-13
					
					294万+
					
				

			

		

		

			
				
依赖框架都是AVFoundation 需要da

			
		

	





	

		

			

				
					
dubbo源码导入eclipse

				
			

			

				

					YINYANLI123456的博客
				

				

					03-25
					
					4万+
					
				

			

		

		

			
				
1.  代码环境 
                     dubbo2.5.4源码   win7    java8     maven3.3.3      eclipse64


2.  环境准备maven  本地安装（参考网上）
3.    
    3.1dubbo2.5.4源码    下载https://github.com/alibaba/dubbo
      我的下载

			
		

	





	

		

			

				
					
不怕死就上这些网站

				
			

			

				

					临时工 Temporary's Space 
				

				

					08-14
					
					10万+
					
				

			

		

		

			
				
 1. hxxp:///www.dj3344.com 打开后，重启时你的主页就变成它的，并通过QQ向他人传播，现在正飙行，奇坏无比！2. hxxp:///www.qq168.net 打开后，重启时你的主页就变成它的，并通过QQ向他人传播，而且传波病毒，还狠些！现在正在飙行！3. hxxp:///www.777888.com 　4. hxxp:///WWW.5dsoft.com 　5. hx

			
		

	





	

		

			

				
					
AV不识爱卖克，便看三弟也枉然

				
			

			

				

					weixin_33811961的博客
				

				

					01-07
					
					3109
					
				

			

		

		

			
				
阿凡达，已然无人不知无人不晓。江湖流传：“AV不识爱卖克，便看三弟也枉然”。此处AV自然指的就是Avatar，这句话意思是说，如果你没有看iMax的阿凡达，就算是看了3D版也等于没看过。因此，对于全国只有11块的iMax屏幕，大家自然就是疯抢了。而上海这边，只有位于人民广场的和平影都有这条件，试想全上海有这想法的人都涌到同一个地方，抢这个每日一千多（350 * 4场）人次的机会……是什么景象。
...

			
		

	





	

		

			

				
					
AV1代码学习：函数encode_frame和aom_codec_encode

				
			

			

				

					BigDream123的博客
				

				

					11-03
					
					1130
					
				

			

		

		

			
				
1.encode_frame函数

在编码端aomenc.c的main函数中，在进入编码过程循环后，循环读取视频的每一帧数据，然后通过encode_frame函数对每一帧进行编码。

encode_frame函数主要是进行一些当前帧进行放缩的工作，并启动计时器，然后调用aom_codec_encode函数进行编码。


static void encode_frame(struct stream_state *stream,
                         struct AvxEncode

			
		

	





	

		

			

				
					
notepad.exe -损坏的映像

					
最新发布

				
			

			

				

					05-26
				

			

		

		

			
				
"Notepad.exe - 损坏的映像" 错误可能是由于 Notepad.exe 文件本身已经损坏或者与其相关的系统文件丢失或损坏引起的。以下是几个可能的解决方案：  1. 重新下载 Notepad.exe 文件并替换旧文件。  2. 运行系统文件...

			
		

	



              



  
“相关推荐”对你有帮助么？

  

      
    
          
  • 
              
    
                  
                  
              
    
              
    非常没帮助
    
          
    • 
          
  • 
              
    
                  
                  
              
    
              
    没帮助
    
          
    • 
          
  • 
              
    
                  
                  
              
    
              
    一般
    
          
    • 
          
  • 
              
    
                  
                  
              
    
              
    有帮助
    
          
    • 
          
  • 
              
    
                  
                  
              
    
              
    非常有帮助
    
          
    • 
      

      

      

          
          提交
      

      

  




          




        



    





    



      

      

        
      

      





	

		评论	
	

	
	




  

    

      添加红包
      
    

    

      

        
        

          
          
        

        
请填写红包祝福语或标题

      

      

        
        

          
          个
        

        
红包个数最小为10个

      

      

        
        

          
          元
        

        
红包金额最低5元

      

      

        
        

          当前余额3.43元
          前往充值 >
        

      

      

        

          需支付：10.00元
        

        
        
      

    

  





  

    
    
  

  

    
    
  








  

    

      

        

          

            
            
成就一亿技术人!

          

          

        

        

          

          

            领取后你会自动成为博主和红包主的粉丝
            规则
          

        

      

      

        

          

            
              
            
            

              
hope_wisdom
 发出的红包
            

          

        

        

          

          

          

        

      

    

    

  



      
      

      
实付元

      
使用余额支付

      

        

          

            
            点击重新获取
          

        

        
扫码支付

      

      

        
          
            
          
          
        
      

      

        
        钱包余额
          0
          

            
            

              

                
抵扣说明：

                
 1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
 2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

              

            

          

      

      余额充值