Autorun.inf病毒和qhbpriAppInit_DLLs专杀

 

前因：

登陆 www.99hjm.com 在线看电影时中了网站所挂载的木马，本机操作系统为 Microsoft Windows XP Professional (SP2) ，内存 256M 配置低，所以没有装杀毒软件和防火墙，属于裸机上阵

状况：

1 ：系统运行变慢，出现虚拟内存不够的警告

2 ：打开任务管理器，有大量 字母进程出现

3 ：使用优化大 师→开机速度优化，可以看到大量可疑注册表进程，无法移除，优化后反复出现

4 ：使用SREng.EXE→启动项目检查，出现提示 AppInit_DLLS键值被修改，并伴随有大量可疑.dll项目，形如C:/WINDOWS/system32/qjhpri.dll，全部出现在C:/WINDOWS/system32目录下，不可删除

处理过程：本机有ghost备份，遂进行重装

1 ：重装后除系统盘外其他盘无法双击打开，通过右键点击第一项为Auto，通过下面的 打开项目可以打开其他盘，目录操作正常，再次打开 优化大师 和 SREng.EXE症状依旧，锐捷网络软件频繁断线，并出现code:4错误，怀疑 感染 “Autorun.inf” 文件病毒

2 ： Autorun.inf 病毒会自动在本地硬盘的所有分区根目录下面创建一个 “Autorun.inf” 文件，该文件在默认状态下具有隐藏属性，双击后被激活发作

①      运行 →cmd进入命令提示行界面转入其他盘根目录；

②      dir /a 列出所有文件，若发现 Autorun.inf ，则进行下一步

③      attrib Autorun.inf –s –f –r 去掉 Autorun.inf 文件的隐藏和不可删除属性

④      del Autorun.inf

3 ：重启后 锐捷网络软件正常，网络正常，再次打开优化大师 和 SREng.EXE症状依旧

4 ：下载到qhbpriAppInit_DLLs专杀在C:/WINDOWS/system32/检测到.dll木马，予以清除，重新启动电脑，可正常使用电脑，但优化大师和 SREng.EXE可疑项目无法去除

5 ：再次ghost，此时一切恢复原状

 

搜索的时候，发现网络上大部分都是新帖子，貌似刚刚流行起来的变种病毒，偶就中招了，太黑了。郁闷了一个晚上，终于在天亮的时候结束战斗.csdn竟然没有保存，网络有点问题，刷新了一下，文章都丢失了，又重新写了一遍，郁闷

qhbpriAppInit_DLLs专杀

 

附SREng.EXE检测结果：

[CODE]

2007-09-07,02:49:24

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER/Software/Microsoft/Windows/CurrentVersion/Run]
    <ctfmon.exe><C:/WINDOWS/system32/ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_CURRENT_USER/Software/Microsoft/Windows NT/CurrentVersion/Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/Run]
    <IMSCMig><C:/PROGRA~1/COMMON~1/MICROS~1/IME/IMSC40A/IMSCMIG.EXE /Preload>  [(Verified)Microsoft Corporation]
    <upxdnd><C:/WINDOWS/upxdnd.exe>  []
    <DbgHlp32><C:/WINDOWS/DbgHlp32.exe>  []
    <cmdbcs><C:/WINDOWS/cmdbcs.exe>  []
[HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/Policies/Explorer/Run]
    <RavRuneip><C:/WINDOWS/system32/RacvSvc.EXE glrwfjnqux.dll,HFanMa>  [N/A]
[HKEY_LOCAL_MACHINE/Software/Microsoft/Windows NT/CurrentVersion/Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
    <Userinit><C:/WINDOWS/system32/userinit.exe,>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE/Software/Microsoft/Windows NT/CurrentVersion/Windows]
    <AppInit_DLLs><kvdxbma.dll>  []
[HKEY_LOCAL_MACHINE/Software/Microsoft/Windows NT/CurrentVersion/Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Explorer/ShellExecuteHooks]
    <{0EA66AD2-CF26-2E23-532B-B292E22F3266}><C:/Program Files/Internet Explorer/PLUGINS/NewTemp.dll>  []
    <{8562452F-FA36-BA4F-892A-FF5FBBAC5318}><C:/WINDOWS/system32/myhpri.dll>  []
    <{9A65498A-7653-9801-1647-987114AB7F49}><C:/WINDOWS/system32/zxipri.dll>  []
    <{2C87A354-ABC3-DEDE-FF33-3213FD7447C2}><C:/WINDOWS/system32/kvdxbma.dll>  []
    <{2D47B341-43DF-4563-753F-345FFA3157D2}><C:/WINDOWS/system32/kvmxbma.dll>  []
    <{84123FF1-8371-9834-9021-184518451FA8}><C:/WINDOWS/system32/qjhpri.dll>  []
    <{959AFD5B-159F-ACD8-954C-ACD545FA6589}><C:/WINDOWS/system32/jzipri.dll>  []
    <{26650011-3344-6688-4899-345FABCD1562}><C:/WINDOWS/system32/ratbbpi.dll>  []
    <{28907901-1416-3389-9981-372178569982}><C:/WINDOWS/system32/kawdbzy.dll>  []
    <{2A1247C1-53DA-FF43-ABD3-345F323A48D2}><C:/WINDOWS/system32/avwgbmn.dll>  []
    <{37D81718-1314-5200-2597-587901018073}><C:/WINDOWS/system32/kaqhczy.dll>  []
    <{5D83AD9C-3BFC-43F5-979D-2904DBC54A8E}><C:/Program Files/Internet Explorer/PLUGINS/WinSys64.Sys>  []

==================================
启动文件夹
N/A

==================================
服务
[ATI Smart / ATI Smart][Stopped/Auto Start]
  <C:/WINDOWS/system32/ati2sgag.exe><>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:/WINDOWS/System32/svchost.exe -k netsvcs-->%SystemRoot%/System32/hidserv.dll><N/A>
[Visual Studio Analyzer RPC bridge / Visual Studio Analyzer RPC bridge][Stopped/Manual Start]
  <C:/Program Files/Microsoft Visual Studio/Common/Tools/VS-Ent98/Vanalyzr/varpc.exe><Microsoft Corporation>
[Remote Help Session Manager / Rasautol][Stopped/Auto Start]
  <C:/WINDOWS/system32/ntsokele.exe><N/A>

==================================
驱动程序
[6vl2 / 6vl2u][Running/Boot Start]
  </SystemRoot/System32/DRIVERS/6vl2u.sys><N/A>
[Service for WDM 3D Audio Driver / ALCXSENS][Running/Manual Start]
  <system32/drivers/ALCXSENS.SYS><Sensaura Ltd>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32/drivers/ALCXWDM.SYS><Realtek Semiconductor Corp.>
[标准 IDE/ESDI 硬盘控制器 / atapi][Running/Boot Start]
  </SystemRoot/system32/DRIVERS/atapi.sys><N/A>
[ati2mtag / ati2mtag][Running/Manual Start]
  <system32/DRIVERS/ati2mtag.sys><ATI Technologies Inc.>
[d346bus / d346bus][Running/Boot Start]
  </SystemRoot/system32/DRIVERS/d346bus.sys><>
[d346prt / d346prt][Running/Boot Start]
  </SystemRoot/System32/Drivers/d346prt.sys><>
[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Stopped/Manual Start]
  <system32/DRIVERS/fetnd5.sys><VIA Technologies, Inc.>
[VIA Rhine Family Fast Ethernet Adapter Driver Service / FETNDISB][Running/Manual Start]
  <system32/DRIVERS/fetnd5b.sys><VIA Technologies, Inc.>
[n8qawsj / n8qawsj][Running/Auto Start]
  </??/C:/WINDOWS/system32/drivers/n8qawsj.sys><N/A>
[NTSIM / NTSIM][Stopped/Manual Start]
  </??/C:/WINDOWS/system32/ntsim.sys><VIA Technologies, Inc.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32/DRIVERS/ptilink.sys><Parallel Technologies, Inc.>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32/DRIVERS/secdrv.sys><N/A>
[VIA AGP Filter / viaagp1][Running/Boot Start]
  </SystemRoot/system32/DRIVERS/viaagp1.sys><VIA Technologies, Inc.>
[ViaIde / ViaIde][Running/Boot Start]
  </SystemRoot/system32/DRIVERS/viaide.sys><Microsoft Corporation>
[WINIO / WINIO][Stopped/Manual Start]
  </??/I:/winio.sys><N/A>
[PCANDIS5 NDIS Protocol Driver / PCANDIS5][Stopped/Manual Start]
  </??/C:/WINDOWS/system32/PCANDIS5.SYS><Printing Communications Assoc., Inc. (PCAUSA)>
[Netgroup Packet Filter / NPF][Running/Manual Start]
  <system32/drivers/npf.sys><CACE Technologies>

==================================
浏览器加载项
[ThunderAtOnce Class]
  {01443AEC-0FD1-40fd-9C87-E93D1494C233} <C:/Program Files/Thunder Network/Thunder/ComDlls/TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <C:/Program Files/Thunder Network/Thunder/ComDlls/xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[启动迅雷5]
  {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <C:/Program Files/Thunder Network/Thunder/Thunder.exe, Thunder Networking Technologies,LTD>
[番茄花园]
  {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} < http://tomatolei.com, N/A>
[信息检索(&R)]
  {92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:/PROGRA~1/MICROS~2/OFFICE11/REFIEBAR.DLL, Microsoft Corporation>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:/Program Files/Messenger/msmsgs.exe, Microsoft Corporation>
[AxInputControl Class]
  {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:/WINDOWS/DOWNLO~1/INPUTC~1.DLL, >
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:/WINDOWS/system32/Macromed/Flash/Flash9d.ocx, Adobe Systems, Inc.>
[ThunderAtOnce Class]
  {01443AEC-0FD1-40FD-9C87-E93D1494C233} <C:/Program Files/Thunder Network/Thunder/ComDlls/TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[HHCtrl Object]
  {41B23C28-488E-4E5C-ACE2-BB0BBABE99E8} <C:/WINDOWS/system32/hhctrl.ocx, Microsoft Corporation>
[StormPlayer Object]
  {6BE52E1D-E586-474F-A6E2-1A85A9B4D9FB} <C:/Program Files/StormII/mps.dll, Biejing Baofeng Inc.>
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:/WINDOWS/system32/wmp.dll, Microsoft Corporation>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <C:/Program Files/Thunder Network/Thunder/ComDlls/xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[RDS.DataSpace]
  {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:/Program Files/Common Files/system/msadc/msadco.dll, Microsoft Corporation>
[RealPlayer G2 Control]
  {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:/WINDOWS/system32/rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:/WINDOWS/system32/Macromed/Flash/Flash9d.ocx, Adobe Systems, Inc.>
[使用迅雷下载]
  <C:/Program Files/Thunder Network/Thunder/Program/GetUrl.htm, N/A>
[使用迅雷下载全部链接]
  <C:/Program Files/Thunder Network/Thunder/Program/GetAllUrl.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
  <res://C:/PROGRA~1/MICROS~2/OFFICE11/EXCEL.EXE/3000, N/A>

==================================
正在运行的进程
[PID: 560][/SystemRoot/System32/smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 624][/??/C:/WINDOWS/system32/csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 656][/??/C:/WINDOWS/system32/winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:/WINDOWS/system32/msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 700][C:/WINDOWS/system32/services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 712][C:/WINDOWS/system32/lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 864][C:/WINDOWS/system32/svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 964][C:/WINDOWS/system32/svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1072][C:/WINDOWS/system32/svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1096][C:/WINDOWS/system32/svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1200][C:/WINDOWS/system32/svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1348][C:/WINDOWS/Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:/WINDOWS/system32/nsw3yd.dll]  [N/A, ]
    [C:/WINDOWS/system32/msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:/Program Files/WinRAR/rarext.dll]  [N/A, ]
    [C:/WINDOWS/system32/msdmo.dll]  [, ]
    [C:/PROGRA~1/StormII/spfa.dll]  [Biejing Baofeng Inc., 2, 7, 4, 2]
    [C:/Program Files/Internet Explorer/PLUGINS/NewTemp.dll]  [N/A, ]
    [C:/WINDOWS/system32/upxdnd.dll]  [N/A, ]
    [C:/WINDOWS/system32/DbgHlp32.dll]  [N/A, ]
    [C:/WINDOWS/system32/cmdbcs.dll]  [N/A, ]
    [C:/WINDOWS/system32/kvmxbma.dll]  [N/A, ]
    [C:/WINDOWS/system32/jzipri.dll]  [N/A, ]
    [C:/WINDOWS/system32/ratbbpi.dll]  [N/A, ]
    [C:/WINDOWS/system32/zxipri.dll]  [N/A, ]
    [C:/WINDOWS/system32/qjhpri.dll]  [N/A, ]
    [C:/WINDOWS/system32/kvdxbma.dll]  [N/A, ]
    [C:/WINDOWS/system32/myhpri.dll]  [N/A, ]
    [C:/Program Files/Internet Explorer/PLUGINS/WinSys64.Sys]  [N/A, ]
    [C:/WINDOWS/system32/kawdbzy.dll]  [N/A, ]
    [C:/WINDOWS/system32/kaqhczy.dll]  [N/A, ]
    [C:/WINDOWS/system32/avwgbmn.dll]  [N/A, ]
    [C:/WINDOWS/system32/glrwfjnqux.dll]  [N/A, ]
    [C:/Program Files/Thunder Network/Thunder/ComDlls/TDAtOnce_Now.dll]  [Thunder Networking Technologies,LTD, 1.0.5.15]
    [C:/Program Files/Thunder Network/Thunder/ComDlls/xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 8, 18]
    [C:/Program Files/Thunder Network/Thunder/Components/ResWorker/DsBho_00.dll]  [, 1, 0, 0, 11]
    [C:/Program Files/Thunder Network/Thunder/Components/ResWorker/DataProcessor_00.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 12]
    [C:/Program Files/Microsoft Office/OFFICE11/msohev.dll]  [Microsoft Corporation, 11.0.5510]
[PID: 1760][C:/WINDOWS/system32/inetsrv/inetinfo.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 588][C:/WINDOWS/system32/wscntfy.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:/Program Files/Internet Explorer/PLUGINS/WinSys64.Sys]  [N/A, ]
    [C:/WINDOWS/system32/kvmxbma.dll]  [N/A, ]
    [C:/WINDOWS/system32/qjhpri.dll]  [N/A, ]
    [C:/WINDOWS/system32/zxipri.dll]  [N/A, ]
    [C:/WINDOWS/system32/myhpri.dll]  [N/A, ]
    [C:/WINDOWS/system32/ratbbpi.dll]  [N/A, ]
    [C:/WINDOWS/system32/jzipri.dll]  [N/A, ]
    [C:/WINDOWS/system32/kvdxbma.dll]  [N/A, ]
    [C:/WINDOWS/system32/cmdbcs.dll]  [N/A, ]
    [C:/WINDOWS/system32/DbgHlp32.dll]  [N/A, ]
    [C:/WINDOWS/system32/kaqhczy.dll]  [N/A, ]
    [C:/WINDOWS/system32/avwgbmn.dll]  [N/A, ]
    [C:/WINDOWS/system32/kawdbzy.dll]  [N/A, ]
    [C:/WINDOWS/system32/glrwfjnqux.dll]  [N/A, ]
[PID: 832][C:/WINDOWS/system32/ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:/Program Files/Internet Explorer/PLUGINS/WinSys64.Sys]  [N/A, ]
    [C:/WINDOWS/system32/kvmxbma.dll]  [N/A, ]
    [C:/WINDOWS/system32/qjhpri.dll]  [N/A, ]
    [C:/WINDOWS/system32/zxipri.dll]  [N/A, ]
    [C:/WINDOWS/system32/myhpri.dll]  [N/A, ]
    [C:/WINDOWS/system32/ratbbpi.dll]  [N/A, ]
    [C:/WINDOWS/system32/jzipri.dll]  [N/A, ]
    [C:/WINDOWS/system32/kvdxbma.dll]  [N/A, ]
    [C:/WINDOWS/system32/cmdbcs.dll]  [N/A, ]
    [C:/WINDOWS/system32/DbgHlp32.dll]  [N/A, ]
    [C:/WINDOWS/system32/kaqhczy.dll]  [N/A, ]
    [C:/WINDOWS/system32/avwgbmn.dll]  [N/A, ]
    [C:/WINDOWS/system32/kawdbzy.dll]  [N/A, ]
[PID: 168][C:/WINDOWS/system32/conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:/Program Files/Internet Explorer/PLUGINS/WinSys64.Sys]  [N/A, ]
    [C:/WINDOWS/system32/kvmxbma.dll]  [N/A, ]
    [C:/WINDOWS/system32/qjhpri.dll]  [N/A, ]
    [C:/WINDOWS/system32/zxipri.dll]  [N/A, ]
    [C:/WINDOWS/system32/myhpri.dll]  [N/A, ]
    [C:/WINDOWS/system32/ratbbpi.dll]  [N/A, ]
    [C:/WINDOWS/system32/jzipri.dll]  [N/A, ]
    [C:/WINDOWS/system32/kvdxbma.dll]  [N/A, ]
    [C:/WINDOWS/system32/cmdbcs.dll]  [N/A, ]
    [C:/WINDOWS/system32/DbgHlp32.dll]  [N/A, ]
    [C:/WINDOWS/system32/kaqhczy.dll]  [N/A, ]
    [C:/WINDOWS/system32/avwgbmn.dll]  [N/A, ]
    [C:/WINDOWS/system32/kawdbzy.dll]  [N/A, ]
    [C:/WINDOWS/system32/glrwfjnqux.dll]  [N/A, ]
[PID: 1868][C:/WINDOWS/system32/kvdxbis.exe]  [N/A, ]
    [C:/WINDOWS/system32/kvdxbma.dll]  [N/A, ]
[PID: 2732][C:/WINDOWS/system32/kvmxbis.exe]  [N/A, ]
    [C:/WINDOWS/system32/kvmxbma.dll]  [N/A, ]
[PID: 2776][C:/WINDOWS/system32/zxiins.exe]  [N/A, ]
    [C:/WINDOWS/system32/zxipri.dll]  [N/A, ]
[PID: 2324][C:/WINDOWS/system32/qjhins.exe]  [N/A, ]
    [C:/WINDOWS/system32/qjhpri.dll]  [N/A, ]
[PID: 1644][C:/WINDOWS/system32/myhins.exe]  [N/A, ]
    [C:/WINDOWS/system32/myhpri.dll]  [N/A, ]
[PID: 3236][C:/WINDOWS/system32/ratbbtl.exe]  [N/A, ]
    [C:/WINDOWS/system32/ratbbpi.dll]  [N/A, ]
[PID: 2132][C:/WINDOWS/system32/jziins.exe]  [N/A, ]
    [C:/WINDOWS/system32/jzipri.dll]  [N/A, ]
[PID: 3068][C:/WINDOWS/system32/kawdbaz.exe]  [N/A, ]
    [C:/WINDOWS/system32/kvmxbma.dll]  [N/A, ]
    [C:/WINDOWS/system32/kawdbzy.dll]  [N/A, ]
[PID: 3712][C:/WINDOWS/system32/avwgbst.exe]  [N/A, ]
    [C:/WINDOWS/system32/kvdxbma.dll]  [N/A, ]
    [C:/WINDOWS/system32/avwgbmn.dll]  [N/A, ]
[PID: 3496][C:/WINDOWS/system32/kaqhcaz.exe]  [N/A, ]
    [C:/WINDOWS/system32/kvdxbma.dll]  [N/A, ]
    [C:/WINDOWS/system32/kaqhczy.dll]  [N/A, ]
[PID: 2400][C:/WINDOWS/system32/nslkupi.exe]  [N/A, ]
    [C:/WINDOWS/system32/WPCAP.DLL]  [CACE Technologies, 3, 1, 0, 27]
    [C:/WINDOWS/system32/packet.dll]  [CACE Technologies, 3, 1, 0, 27]
    [C:/WINDOWS/system32/WanPacket.dll]  [CACE Technologies, 3, 1, 0, 27]
    [C:/WINDOWS/system32/kvmxbma.dll]  [N/A, ]
    [C:/WINDOWS/system32/glrwfjnqux.dll]  [N/A, ]
    [C:/Program Files/Internet Explorer/PLUGINS/WinSys64.Sys]  [N/A, ]
[PID: 4380][G:/qq_down/sreng2/SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
    [C:/WINDOWS/system32/myhpri.dll]  [N/A, ]
    [C:/WINDOWS/system32/glrwfjnqux.dll]  [N/A, ]
    [C:/Program Files/Internet Explorer/PLUGINS/WinSys64.Sys]  [N/A, ]
    [C:/WINDOWS/system32/kvmxbma.dll]  [N/A, ]
    [C:/WINDOWS/system32/avwgbmn.dll]  [N/A, ]
    [C:/WINDOWS/system32/kaqhczy.dll]  [N/A, ]
    [C:/WINDOWS/system32/zxipri.dll]  [N/A, ]
    [C:/WINDOWS/system32/qjhpri.dll]  [N/A, ]
    [C:/WINDOWS/system32/kawdbzy.dll]  [N/A, ]
    [C:/WINDOWS/system32/ratbbpi.dll]  [N/A, ]
    [C:/WINDOWS/system32/jzipri.dll]  [N/A, ]
    [C:/WINDOWS/system32/kvdxbma.dll]  [N/A, ]
    [C:/WINDOWS/system32/cmdbcs.dll]  [N/A, ]
    [C:/WINDOWS/system32/DbgHlp32.dll]  [N/A, ]

==================================
文件关联
.TXT  OK. [%SystemRoot%/system32/NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:/WINDOWS/hh.exe" %1]
.HLP  OK. [%SystemRoot%/System32/winhlp32.exe %1]
.INI  OK. [%SystemRoot%/System32/NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%/System32/NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%/System32/WScript.exe "%1" %*]
.JS   OK. [%SystemRoot%/System32/WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[C:/]
[autorun]
open=PegeFile.pif
shellexecute=PegeFile.pif
shell/Auto/command=PegeFile.pif
shell=Auto
[D:/]
[autorun]
open=PegeFile.pif
shellexecute=PegeFile.pif
shell/Auto/command=PegeFile.pif
shell=Auto
[E:/]
[autorun]
open=PegeFile.pif
shellexecute=PegeFile.pif
shell/Auto/command=PegeFile.pif
shell=Auto
[F:/]
[autorun]
open=PegeFile.pif
shellexecute=PegeFile.pif
shell/Auto/command=PegeFile.pif
shell=Auto
[G:/]
[autorun]
open=PegeFile.pif
shellexecute=PegeFile.pif
shell/Auto/command=PegeFile.pif
shell=Auto

==================================
HOSTS 文件
127.0.0.1       localhost

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================

[/CODE]