lqqk7 - 2009-7-22 10:10:00
即日起每日会给大家提供一些染毒环境的SREng日志，因为部分实习生是第一次接触SREng这个工具，对日志分析不熟悉，如果冒然跑去反病毒区回帖，一旦出现误判，可能对求助者不利，因此采用这种“内部”交流的方式，希望大家能够多练习，真正分析日志的方法是靠自己实践摸索出来的！注：日志分析练习情况与大家的实习期总成绩没有关联，请大家不要有顾虑，放心大胆的练习！附件:
SREngLOG4.log
lqqk7 - 2009-7-22 10:10:00
水月虚空 - 2009-7-22 10:44:00
练习还很多哦~继续研究.
gtyre2 - 2009-7-22 19:14:00
学习学习。。
学飞的龙 - 2009-7-24 18:41:00
AV终结者，用c:\program files\common files\microsoft shared\vcxlcph.exe
c:\program files\common files\system\fbiytty.exe
c:\windows\system32\nvapi.dll //NV?
c:\progra~1\skynet\firewall\pfw.exe
c:\windows\system32\drivers\bdguard.sys
c:\qphotux.exe
c:\autorun.inf
d:\qphotux.exe
d:\autorun.inf
e:\qphotux.exe
e:\autorun.inf
f:\qphotux.exe
f:\autorun.inf2.删除重启后使用SREng修复下面各项：
启动项目 －－ 注册表之如下项删除：
[qphotux] <C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>
[ymmpucn] <C:\Program Files\Common Files\System\fbiytty.exe>
[SKYNET Personal FireWall] <C:\PROGRA~1\SkyNet\FireWall\pfw.exe>
启动项目 －－ 服务－－ 驱动程序之如下项禁用：
[BdGuard / BdGuard] <\SystemRoot\system32\drivers\BDGuard.SYS>瑞星橙色八月专杀
或者 删除
c:\program files\common files\microsoft shared\vcxlcph.exe
c:\program files\common files\system\fbiytty.exe
c:\windows\system32\nvapi.dll
c:\progra~1\skynet\firewall\pfw.exe
c:\windows\system32\drivers\bdguard.sys
d:\qphotux.exe
e:\qphotux.exe
2.删除重启后使用SREng修复下面各项：
启动项目 －－ 注册表之如下项删除：
[qphotux] <C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>
[ymmpucn] <C:\Program Files\Common Files\System\fbiytty.exe>
[SKYNET Personal FireWall] <C:\PROGRA~1\SkyNet\FireWall\pfw.exe>
启动项目 －－ 服务－－ 驱动程序之如下项禁用：
[BdGuard / BdGuard] <\SystemRoot\system32\drivers\BDGuard.SYS>
我是天边的风 - 2009-7-26 14:33:00
最进不能上网 所以下载回去练习:kaka6:
Elaine1 - 2011-1-23 12:42:00
看看答案，老师辛苦了
jensh8023 - 2011-1-24 22:40:00
谢谢老师分享:kaka12:
废土游民 - 2011-3-10 19:54:00
答案
McGradyandKobe - 2011-6-29 21:58:00
答案
McGradyandKobe - 2011-6-29 21:59:00
学习一下
deng520 - 2011-7-26 11:37:00
文件关联修复一下
注册表：
<ymmpucn><C:\Program Files\Common Files\System\fbiytty.exe>
<qphotux><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>
<SKYNET Personal FireWall><C:\PROGRA~1\SkyNet\FireWall\pfw.exe>
<IFEO[360rpt.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>
<IFEO[360Safe.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>
<IFEO[360tray.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>
<IFEO[adam.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>
<IFEO[AgentSvr.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>
<IFEO[AppSvc32.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>
<IFEO[ArSwp.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>
<IFEO[AST.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[autoruns.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[avconsol.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[
<IFEO[avgrssvc.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[AvMonitor.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[avp.com]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[avp.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[CCenter.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[ccSvcHst.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[EGHOST.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[FileDsty.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[FTCleanerShell.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[FYFireWall.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[HijackThis.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[IceSword.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[iparmo.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe]
<IFEO[Iparmor.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isPwdSvc.exe]
<IFEO[isPwdSvc.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kabaload.exe]
<IFEO[kabaload.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KaScrScn.SCR]
<IFEO[KaScrScn.SCR]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMain.exe]
<IFEO[KASMain.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASTask.exe]
<IFEO[KASTask.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe]
<IFEO[KAV32.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe]
<IFEO[KAVDX.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPF.exe]
<IFEO[KAVPF.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.exe]
<IFEO[KAVPFW.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSetup.exe]
<IFEO[KAVSetup.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe]
<IFEO[KAVStart.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLnchr.exe]
<IFEO[KISLnchr.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMailMon.exe]
<IFEO[KMailMon.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMFilter.exe]
<IFEO[KMFilter.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe]
<IFEO[KPFW32.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32X.exe]
<IFEO[KPFW32X.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPfwSvc.exe]
<IFEO[KPfwSvc.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe]
<IFEO[KRegEx.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRepair.com]
<IFEO[KRepair.com]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KsLoader.exe]
<IFEO[KsLoader.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.kxp]
<IFEO[KVCenter.kxp]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvDetect.exe]
<IFEO[KvDetect.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvfwMcl.exe]
<IFEO[KvfwMcl.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp]
<IFEO[KVMonXP.kxp]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP_1.kxp]
<IFEO[KVMonXP_1.kxp]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvol.exe]
<IFEO[kvol.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvolself.exe]
<IFEO[kvolself.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvReport.kxp]
<IFEO[KvReport.kxp]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVScan.kxp]
<IFEO[KVScan.kxp]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe]
<IFEO[KVSrvXP.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVStub.kxp]
<IFEO[KVStub.kxp]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvupload.exe]
<IFEO[kvupload.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvwsc.exe]
<IFEO[kvwsc.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp]
<IFEO[KvXP.kxp]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP_1.kxp]
<IFEO[KvXP_1.kxp]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe]
<IFEO[KWatch.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch9x.exe]
<IFEO[KWatch9x.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchX.exe]
<IFEO[KWatchX.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe]
<IFEO[loaddll.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe]
<IFEO[MagicSet.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe]
<IFEO[mcconsol.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmqczj.exe]
<IFEO[mmqczj.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmsk.exe]
<IFEO[mmsk.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapsvc.exe]
<IFEO[Navapsvc.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapw32.exe]
<IFEO[Navapw32.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe]
<IFEO[nod32.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe]
<IFEO[nod32krn.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe]
<IFEO[nod32kui.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NPFMntor.exe]
<IFEO[NPFMntor.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe]
<IFEO[PFW.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe]
<IFEO[PFWLiveUpdate.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSET.exe]
<IFEO[QHSET.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctor.exe]
<IFEO[QQDoctor.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQKav.exe]
<IFEO[QQKav.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ras.exe]
<IFEO[Ras.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe]
<IFEO[Rav.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe]
<IFEO[RavMon.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe]
<IFEO[RavMonD.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe]
<IFEO[RavStub.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe]
<IFEO[RavTask.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegClean.exe]
<IFEO[RegClean.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe]
<IFEO[rfwcfg.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe]
<IFEO[rfwmain.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe]
<IFEO[rfwsrv.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe]
<IFEO[RsAgent.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe]
<IFEO[Rsaupd.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe]
<IFEO[rstrui.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe]
<IFEO[runiep.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safelive.exe]
<IFEO[safelive.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe]
<IFEO[scan32.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shcfg32.exe]
<IFEO[shcfg32.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[SmartUp.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[SREng.EXE]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[symlcsvc.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[SysSafe.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[TrojanDetector.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[Trojanwall.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[TrojDie.kxp]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[UIHost.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[UmxAgent.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[UmxAttachment.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[UmxCfg.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[UmxFwHlp.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[UmxPol.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[upiea.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[UpLive.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[USBCleaner.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[vsstat.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[webscanx.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<IFEO[WoptiClean.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>
启动文件夹 虽然没问题但是建议删除
autorun。inf病毒
[D:\]
[AutoRun]
open=qphotux.exe
shell\open=打开(&O)
shell\open\Command=qphotux.exe
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=qphotux.exe
[E:\]
[AutoRun]
open=qphotux.exe
shell\open=打开(&O)
shell\open\Command=qphotux.exe
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=qphotux.exe
[F:\]
[AutoRun]
open=qphotux.exe
shell\open=打开(&O)
shell\open\Command=qphotux.exe
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=qphotux.exe
进程
PID: 1128 [C:\Program Files\Common Files\System\fbiytty.exe]
PID: 452 [C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe]
deng520 - 2011-7-26 11:45:00
今天学习了八月病毒，映像劫持。。。。。
phb6488 - 2011-7-26 15:58:00
答案
© 2000 - 2026 Rising Corp. Ltd.