遭遇scvhost.exe,qsetup.exe,dsound.dll,hnetcfg.dll,olepro32.dll等1

水深无声 2024-02-17 19:44 19阅读 0赞

一位朋友在使用电脑的过程中，360提示发现病毒，当时清除了。但重启电脑后出现故障：桌面无显示。请我帮忙检修。

按Ctrl+Alt+Del打开任务管理器检查进程，没有发现explorer.exe。检查发现c:/windows文件夹里没有explorer.exe，dllcache文件夹中也没有。

运行winRAR来搜索，在c:/windows/temp发现了一个explorer.exe，把它移动到c:/windows文件夹再运行，任务栏和桌面图标都显示出来了。使用pe\_xscan扫描log并分析，发现如下可疑项（进程模块有省略）：

pe_xscan 11-02-14 by Purple Endurer 
    2011-3-11 14:17:16
    6.0.2900.5512 
    MSIE:6.0.2900.5512
    管理员用户组
    正常模式
    [System Process] * 0 
    　　 C:/WINDOWS/system32/kernel32.dll | 2009-8-21 22:22:36 | Microsoft(R) Windows(R) Operating System | 5.1.2600.5781 | Windows NT BASE API Client DLL | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.5781 (xpsp_sp3_qfe.090321-1341) | Microsoft Corporation| ? | kernel32 | kernel32 
    　　 C:/WINDOWS/system32/GDI32.dll | 2009-8-21 22:22:37 | Microsoft? Windows? Operating System | 5.1.2600.5698 | GDI Client DLL | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5698 (xpsp_sp3_gdr.081022-1932) | Microsoft Corporation| ? | gdi32 | gdi32 
    　　 C:/WINDOWS/system32/RPCRT4.dll | 2009-8-21 22:22:31 | Microsoft? Windows? Operating System | 5.1.2600.5795 | Remote Procedure Call Runtime | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5795 (xpsp_sp3_qfe.090415-1301) | Microsoft Corporation| ? | rpcrt4.dll | rpcrt4.dll 
    　　 C:/WINDOWS/system32/netapi32.dll | 2009-8-21 22:22:33 | Microsoft? Windows? Operating System | 5.1.2600.5694 | Net Win32 API DLL | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5694 (xpsp_sp3_gdr.081015-1312) | Microsoft Corporation| ? | NetApi32.DLL | NetApi32.DLL 
    　　 C:/WINDOWS/system32/msctfime.ime | 2009-8-10 23:49:15 | Microsoft? Windows? Operating System | 5.1.2600.5768 | Microsoft Text Frame Work Service IME | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5768 (xpsp_sp3_qfe.090226-1518) | Microsoft Corporation| ? | MSCTFIME | MSCTFIME.IME 
    　　 C:/WINDOWS/system32/shdocvw.dll | 2009-8-21 22:22:31 | Microsoft(R) Windows(R) Operating System | 6.00.2900.5848 | Shell Doc Object and Control Library | (C) Microsoft Corporation. All rights reserved. | 6.00.2900.5848 (xpsp_sp3_qfe.090718-1313) | Microsoft Corporation| ? | SHDOCVW.DLL | SHDOCVW.DLL 
    　　 C:/WINDOWS/system32/WININET.dll | 2009-8-21 22:22:29 | Microsoft(R) Windows(R) Operating System | 6.00.2900.5835 | Internet Extensions for Win32 | (C) Microsoft Corporation. All rights reserved. | 6.00.2900.5835 (xpsp_sp3_qfe.090626-1600) | Microsoft Corporation| ? | wininet.dll | wininet.dll 
    　　 C:/WINDOWS/system32/portabledeviceapi.dll | 2009-8-21 22:22:32 | Microsoft? Windows? Operating System | 5.2.5721.5145 | Windows Portable Device API Components | ? Microsoft Corporation. All rights reserved. | 5.2.5721.5145 (WMP_11.061018-2006) | Microsoft Corporation| ? | | PortableDeviceApi.dll 
    　　 C:/WINDOWS/system32/mswsock.dll | 2009-8-21 22:22:33 | Microsoft(R) Windows(R) Operating System | 5.1.2600.5625 | Microsoft Windows Sockets 2.0 Service Provider | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.5625 (xpsp_sp3_gdr.080620-1249) | Microsoft Corporation| ? | mswsock.dll | mswsock.dll 
    C:/WINDOWS/system32/csrss.exe* 584 | 2009-3-13 10:3:58 
    　　 C:/WINDOWS/system32/GDI32.dll | 2009-8-21 22:22:37 | Microsoft? Windows? Operating System | 5.1.2600.5698 | GDI Client DLL | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5698 (xpsp_sp3_gdr.081022-1932) | Microsoft Corporation| ? | gdi32 | gdi32 
    　　 C:/WINDOWS/system32/KERNEL32.dll | 2009-8-21 22:22:36 | Microsoft(R) Windows(R) Operating System | 5.1.2600.5781 | Windows NT BASE API Client DLL | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.5781 (xpsp_sp3_qfe.090321-1341) | Microsoft Corporation| ? | kernel32 | kernel32 
    　　 C:/WINDOWS/system32/RPCRT4.dll | 2009-8-21 22:22:31 | Microsoft? Windows? Operating System | 5.1.2600.5795 | Remote Procedure Call Runtime | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5795 (xpsp_sp3_qfe.090415-1301) | Microsoft Corporation| ? | rpcrt4.dll | rpcrt4.dll 
     C:/WINDOWS/system32/winlogon.exe * 624 | 2009-3-13 10:3:58 | Microsoft(R) Windows(R) Operating System | 5.1.2600.5512 | Windows NT Logon Application | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.5512 (xpsp.080413-2113) | Microsoft Corporation| ? | winlogon | WINLOGON.EXE 
    　　 C:/WINDOWS/system32/kernel32.dll | 2009-8-21 22:22:36 | Microsoft(R) Windows(R) Operating System | 5.1.2600.5781 | Windows NT BASE API Client DLL | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.5781 (xpsp_sp3_qfe.090321-1341) | Microsoft Corporation| ? | kernel32 | kernel32 
    　　 C:/WINDOWS/system32/RPCRT4.dll | 2009-8-21 22:22:31 | Microsoft? Windows? Operating System | 5.1.2600.5795 | Remote Procedure Call Runtime | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5795 (xpsp_sp3_qfe.090415-1301) | Microsoft Corporation| ? | rpcrt4.dll | rpcrt4.dll 
    　　 C:/WINDOWS/system32/GDI32.dll | 2009-8-21 22:22:37 | Microsoft? Windows? Operating System | 5.1.2600.5698 | GDI Client DLL | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5698 (xpsp_sp3_gdr.081022-1932) | Microsoft Corporation| ? | gdi32 | gdi32 
    　　 C:/WINDOWS/system32/NETAPI32.dll | 2009-8-21 22:22:33 | Microsoft? Windows? Operating System | 5.1.2600.5694 | Net Win32 API DLL | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5694 (xpsp_sp3_gdr.081015-1312) | Microsoft Corporation| ? | NetApi32.DLL | NetApi32.DLL 
    　　 C:/WINDOWS/system32/msctfime.ime | 2009-8-10 23:49:15 | Microsoft? Windows? Operating System | 5.1.2600.5768 | Microsoft Text Frame Work Service IME | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5768 (xpsp_sp3_qfe.090226-1518) | Microsoft Corporation| ? | MSCTFIME | MSCTFIME.IME 
    C:/WINDOWS/system32/services.exe* 700 | 2009-3-13 10:3:58 
    　　 C:/WINDOWS/system32/kernel32.dll | 2009-8-21 22:22:36 | Microsoft(R) Windows(R) Operating System | 5.1.2600.5781 | Windows NT BASE API Client DLL | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.5781 (xpsp_sp3_qfe.090321-1341) | Microsoft Corporation| ? | kernel32 | kernel32 
    　　 C:/WINDOWS/system32/RPCRT4.dll | 2009-8-21 22:22:31 | Microsoft? Windows? Operating System | 5.1.2600.5795 | Remote Procedure Call Runtime | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5795 (xpsp_sp3_qfe.090415-1301) | Microsoft Corporation| ? | rpcrt4.dll | rpcrt4.dll 
    　　 C:/WINDOWS/system32/GDI32.dll | 2009-8-21 22:22:37 | Microsoft? Windows? Operating System | 5.1.2600.5698 | GDI Client DLL | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5698 (xpsp_sp3_gdr.081022-1932) | Microsoft Corporation| ? | gdi32 | gdi32 
    　　 C:/WINDOWS/system32/NETAPI32.dll | 2009-8-21 22:22:33 | Microsoft? Windows? Operating System | 5.1.2600.5694 | Net Win32 API DLL | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5694 (xpsp_sp3_gdr.081015-1312) | Microsoft Corporation| ? | NetApi32.DLL | NetApi32.DLL 
    C:/WINDOWS/system32/lsass.exe* 720 | 2009-3-13 10:3:58 
    　　 C:/WINDOWS/system32/kernel32.dll | 2009-8-21 22:22:36 | Microsoft(R) Windows(R) Operating System | 5.1.2600.5781 | Windows NT BASE API Client DLL | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.5781 (xpsp_sp3_qfe.090321-1341) | Microsoft Corporation| ? | kernel32 | kernel32 
    　　 C:/WINDOWS/system32/RPCRT4.dll | 2009-8-21 22:22:31 | Microsoft? Windows? Operating System | 5.1.2600.5795 | Remote Procedure Call Runtime | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5795 (xpsp_sp3_qfe.090415-1301) | Microsoft Corporation| ? | rpcrt4.dll | rpcrt4.dll 
    　　 C:/WINDOWS/system32/GDI32.dll | 2009-8-21 22:22:37 | Microsoft? Windows? Operating System | 5.1.2600.5698 | GDI Client DLL | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5698 (xpsp_sp3_gdr.081022-1932) | Microsoft Corporation| ? | gdi32 | gdi32 
    　　 C:/WINDOWS/system32/NETAPI32.dll | 2009-8-21 22:22:33 | Microsoft? Windows? Operating System | 5.1.2600.5694 | Net Win32 API DLL | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5694 (xpsp_sp3_gdr.081015-1312) | Microsoft Corporation| ? | NetApi32.DLL | NetApi32.DLL 
    C:/WINDOWS/system32/svchost.exe* 1020 | 2009-3-13 10:3:58 
    　　 C:/WINDOWS/system32/kernel32.dll | 2009-8-21 22:22:36 | Microsoft(R) Windows(R) Operating System | 5.1.2600.5781 | Windows NT BASE API Client DLL | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.5781 (xpsp_sp3_qfe.090321-1341) | Microsoft Corporation| ? | kernel32 | kernel32 
    　　 C:/WINDOWS/system32/RPCRT4.dll | 2009-8-21 22:22:31 | Microsoft? Windows? Operating System | 5.1.2600.5795 | Remote Procedure Call Runtime | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5795 (xpsp_sp3_qfe.090415-1301) | Microsoft Corporation| ? | rpcrt4.dll | rpcrt4.dll 
    　　 C:/WINDOWS/system32/GDI32.dll | 2009-8-21 22:22:37 | Microsoft? Windows? Operating System | 5.1.2600.5698 | GDI Client DLL | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5698 (xpsp_sp3_gdr.081022-1932) | Microsoft Corporation| ? | gdi32 | gdi32 
    　　 C:/WINDOWS/system32/NETAPI32.dll | 2009-8-21 22:22:33 | Microsoft? Windows? Operating System | 5.1.2600.5694 | Net Win32 API DLL | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5694 (xpsp_sp3_gdr.081015-1312) | Microsoft Corporation| ? | NetApi32.DLL | NetApi32.DLL 
    　　 C:/WINDOWS/system32/WININET.dll | 2009-8-21 22:22:29 | Microsoft(R) Windows(R) Operating System | 6.00.2900.5835 | Internet Extensions for Win32 | (C) Microsoft Corporation. All rights reserved. | 6.00.2900.5835 (xpsp_sp3_qfe.090626-1600) | Microsoft Corporation| ? | wininet.dll | wininet.dll 
    　　 c:/windows/system32/MSWSOCK.dll | 2009-8-21 22:22:33 | Microsoft(R) Windows(R) Operating System | 5.1.2600.5625 | Microsoft Windows Sockets 2.0 Service Provider | (C) Microsoft Corporation. All rights reserved. | 5.1.2600.5625 (xpsp_sp3_gdr.080620-1249) | Microsoft Corporation| ? | mswsock.dll | mswsock.dll 
    　　 C:/Program Files/Common Files/System/kb860088.CNT | 2011-3-10 13:4:5 
    O4 - HKLM/../run: [360Soft] C:/WINDOWS/system32/scvhost.exe
    O4 - HKLM/../run: [Inst]  "C:/Program Files/qcat/qsetup.exe" -safe
    O23 - 服务: Nla (Network Location Awareness (NLA)) - C:/WINDOWS/system32/svchost.exe -k netsvcs | 2009-3-13 10:3:58 
    　　-> C:/WINDOWS/System32/mswsock.dll | 2009-8-21 22:22:33(手动) 
    O23 - 服务: Srv (Srv) -  system32/DRIVERS/srv.sys | 2009-3-13 10:3:58 | Microsoft? Windows? Operating System | 5.1.2600.5725 | Server driver | ? Microsoft Corporation. All rights reserved. | 5.1.2600.5725 (xpsp_sp3_gdr.081211-1306) | Microsoft Corporation| ? | SRV.SYS | SRV.SYS(手动) 
    O23 - 服务: WmdmPmSN (Portable Media Serial Number Service) - C:/WINDOWS/System32/svchost.exe -k netsvcs | 2009-3-13 10:3:58
        -> C:/WINDOWS/system32/mspmsnsv.dll | 2009-8-21 22:22:34(手动) 
    O23 - 服务: WudfPf (Windows Driver Foundation - User-mode Driver Framework Platform Driver) -  system32/DRIVERS/WudfPf.sys | 2009-3-13 10:3:58 | Microsoft? Windows? Operating System | 6.0.5716.32 | Windows Driver Foundation - User-mode Driver Framework Platform Driver | ? Microsoft Corporation. All rights reserved. | 6.0.5716.32 (winmain(wmbla).060928-1756) | Microsoft Corporation| ? | WUDFPf.sys | WUDFPf.sys(手动) 
    O23 - 服务: WudfRd (Windows Driver Foundation - User-mode Driver Framework Reflector) -  system32/DRIVERS/wudfrd.sys | 2009-3-13 10:3:58 | Microsoft? Windows? Operating System | 6.0.5716.32 | Windows Driver Foundation - User-mode Driver Framework Reflector | ? Microsoft Corporation. All rights reserved. | 6.0.5716.32 (winmain(wmbla).060928-1756) | Microsoft Corporation| ? | WUDFRd.sys | WUDFRd.sys(手动) 
    O23 - 服务: WudfSvc (Windows Driver Foundation - User-mode Driver Framework) - C:/WINDOWS/system32/svchost.exe -k WudfServiceGroup | 2009-3-13 10:3:58 
    　　-> C:/WINDOWS/System32/WUDFSvc.dll | 2009-8-21 22:22:27(手动)
    O29 - HKCU-Start Page = hxxp://www.111dh.com/#5恭喜您,成功登陆本站,请单击“是（Ｙ）”大量免费电影站，名站导航天天看!
    O29 - HKUS-Start Page = hxxp://www.537.com

很多系统文件没有通过数字签名验证，估计是被病毒替换或感染了。下载DrWeb CureIt!来查杀……

发表评论取消回复

表情：

评论列表（有 0 条评论，19人围观）

还没有评论，来说两句吧...

相关阅读

相关遭遇盗取网络游戏帐号木马等

*endurer**　原创 2006-09-20　第**1**版有位网友的网游帐号被盗了，让我帮忙检查一下。该网友的电脑使用的是Win XP SP2，从瑞星网...

迷南。/ 2024年04月20日 11:18/ 0 赞/ 34 阅读

相关遭遇Worm.UsbSpy.a/Worm.Win32.Delf.aj

*endurer**　原创 2006-09-12 第**1**版有一位朋友，他把移动硬盘接到电脑上使用，上午还正常，但下午用时则有数据保护的出错提示信息。 ...

墨蓝/ 2024年04月20日 11:17/ 0 赞/ 23 阅读

相关遭遇scvhost.exe,qsetup.exe,dsound.dll,hnetcfg.dll,olepro32.dll等1

　　一位朋友在使用电脑的过程中，360提示发现病毒，当时清除了。但重启电脑后出现故障：桌面无显示。请我帮忙检修。　　按Ctrl+Alt+Del打开任务管理器检查进程，没有发

水深无声/ 2024年02月17日 19:44/ 0 赞/ 20 阅读

相关遭遇Trojan-Spy.Win32.Delf.uv,Trojan.PSW.Win32.XYOnline,Trojan.PSW.Win32.ZhengTu等1

遭遇Trojan-Spy.Win32.Delf.uv,Trojan.PSW.Win32.XYOnline,Trojan.PSW.Win32.ZhengTu等1 endurer

﹏ヽ暗。殇╰゛Y/ 2024年02月17日 14:05/ 0 赞/ 3 阅读

相关遭遇修改系统时间、使用映像劫持的xibgptd.exe,netdde32.exe等3

遭遇修改系统时间、使用映像劫持的xibgptd.exe,netdde32.exe等3 endurer 原创 2007-08-13 第1版文件说明符 : C:/WIND

男娘i/ 2024年02月17日 14:05/ 0 赞/ 11 阅读

相关遭遇 Backdoor.Win32.Agent.amb / serivces.exe

遭遇 Backdoor.Win32.Agent.amb / serivces.exe endurer 原创 2007-07-23 第1版有网友说，他用U盘从另一台电脑

你的名字/ 2024年02月17日 14:04/ 0 赞/ 7 阅读

相关遭遇Backdoor.Gpigeon.2007.ca,Trojan-PSW.Win32.QQRob.lg,Backdoor.Win32.Agent.bcn等1

endurer 原创 2007-06-20 第1版这两天晚上都在忙着帮一位网友清除电脑中的病毒~ 先用网友电脑中原有的 HijackThis 扫描 log，发现如下可

今天药忘吃喽~/ 2024年02月17日 14:02/ 0 赞/ 10 阅读

相关遭遇 my.exe,svch0st.exe,iexpl0re.exe,rundl13a.exe,LgSym.dll 等

endurer 原创 2007-02-06 第1版一位网友的电脑，最近瑞星经常报告： /--- 病毒名称处理结果扫描方式路径文件病毒来源 Trojan

约定不等于承诺〃/ 2024年02月17日 13:51/ 0 赞/ 8 阅读

相关 tcnative-1.dll: Can‘t load AMD 64-bit .dll on a IA 32-bit platform

2021-1-5 23:25:39 \[main\] WARN \[AprLifecycleListener\]:175 The APR based Apache Tomcat

曾经终败给现在/ 2023年01月02日 12:30/ 0 赞/ 95 阅读

相关通俗易懂玩QT：libstdc++-6.dll、libgcc_s_dw2-1.dll、libwinpthread-1.dll等文件缺失解决方案

libstdc+±6.dll、libgcc\_s\_dw2-1.dll、libwinpthread-1.dll等文件缺失解决方案开发工具：Qt Creator 4

r囧r小猫/ 2022年09月09日 09:23/ 0 赞/ 354 阅读