12   2  /  2  页   跳转

[练习] 7月21日 日志分析 练习4

回复:7月21日 日志分析 练习4

答案
gototop
 

回复:7月21日 日志分析 练习4

学习一下
gototop
 

回复:7月21日 日志分析 练习4

文件关联修复一下

注册表:
<ymmpucn><C:\Program Files\Common Files\System\fbiytty.exe>
    <qphotux><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>
  <SKYNET Personal FireWall><C:\PROGRA~1\SkyNet\FireWall\pfw.exe>

    <IFEO[360rpt.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> 

    <IFEO[360Safe.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> 

    <IFEO[360tray.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> 

    <IFEO[adam.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> 

    <IFEO[AgentSvr.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>

    <IFEO[AppSvc32.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>

    <IFEO[ArSwp.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> 

    <IFEO[AST.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[autoruns.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[avconsol.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[
    <IFEO[avgrssvc.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[AvMonitor.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[avp.com]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[avp.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[CCenter.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[ccSvcHst.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[EGHOST.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[FileDsty.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[FTCleanerShell.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[FYFireWall.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[HijackThis.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[IceSword.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[iparmo.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe]
    <IFEO[Iparmor.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isPwdSvc.exe]
    <IFEO[isPwdSvc.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kabaload.exe]
    <IFEO[kabaload.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KaScrScn.SCR]
    <IFEO[KaScrScn.SCR]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMain.exe]
    <IFEO[KASMain.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASTask.exe]
    <IFEO[KASTask.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe]
    <IFEO[KAV32.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe]
    <IFEO[KAVDX.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPF.exe]
    <IFEO[KAVPF.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.exe]
    <IFEO[KAVPFW.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSetup.exe]
    <IFEO[KAVSetup.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe]
    <IFEO[KAVStart.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLnchr.exe]
    <IFEO[KISLnchr.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMailMon.exe]
    <IFEO[KMailMon.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMFilter.exe]
    <IFEO[KMFilter.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe]
    <IFEO[KPFW32.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32X.exe]
    <IFEO[KPFW32X.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPfwSvc.exe]
    <IFEO[KPfwSvc.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe]
    <IFEO[KRegEx.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRepair.com]
    <IFEO[KRepair.com]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KsLoader.exe]
    <IFEO[KsLoader.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.kxp]
    <IFEO[KVCenter.kxp]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvDetect.exe]
    <IFEO[KvDetect.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvfwMcl.exe]
    <IFEO[KvfwMcl.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp]
    <IFEO[KVMonXP.kxp]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP_1.kxp]
    <IFEO[KVMonXP_1.kxp]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvol.exe]
    <IFEO[kvol.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvolself.exe]
    <IFEO[kvolself.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvReport.kxp]
    <IFEO[KvReport.kxp]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVScan.kxp]
    <IFEO[KVScan.kxp]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe]
    <IFEO[KVSrvXP.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVStub.kxp]
    <IFEO[KVStub.kxp]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvupload.exe]
    <IFEO[kvupload.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvwsc.exe]
    <IFEO[kvwsc.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp]
    <IFEO[KvXP.kxp]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP_1.kxp]
    <IFEO[KvXP_1.kxp]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe]
    <IFEO[KWatch.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch9x.exe]
    <IFEO[KWatch9x.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchX.exe]
    <IFEO[KWatchX.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe]
    <IFEO[loaddll.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe]
    <IFEO[MagicSet.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe]
    <IFEO[mcconsol.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmqczj.exe]
    <IFEO[mmqczj.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmsk.exe]
    <IFEO[mmsk.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapsvc.exe]
    <IFEO[Navapsvc.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapw32.exe]
    <IFEO[Navapw32.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe]
    <IFEO[nod32.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe]
    <IFEO[nod32krn.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe]
    <IFEO[nod32kui.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NPFMntor.exe]
    <IFEO[NPFMntor.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe]
    <IFEO[PFW.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe]
    <IFEO[PFWLiveUpdate.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSET.exe]
    <IFEO[QHSET.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctor.exe]
    <IFEO[QQDoctor.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQKav.exe]
    <IFEO[QQKav.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ras.exe]
    <IFEO[Ras.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe]
    <IFEO[Rav.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe]
    <IFEO[RavMon.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe]
    <IFEO[RavMonD.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe]
    <IFEO[RavStub.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe]
    <IFEO[RavTask.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegClean.exe]
    <IFEO[RegClean.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe]
    <IFEO[rfwcfg.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe]
    <IFEO[rfwmain.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe]
    <IFEO[rfwsrv.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe]
    <IFEO[RsAgent.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe]
    <IFEO[Rsaupd.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe]
    <IFEO[rstrui.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe]
    <IFEO[runiep.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safelive.exe]
    <IFEO[safelive.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe]
    <IFEO[scan32.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shcfg32.exe]
    <IFEO[shcfg32.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[SmartUp.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[SREng.EXE]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[symlcsvc.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[SysSafe.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[TrojanDetector.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[Trojanwall.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[TrojDie.kxp]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[UIHost.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[UmxAgent.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[UmxAttachment.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[UmxCfg.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[UmxFwHlp.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[UmxPol.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[upiea.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[UpLive.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[USBCleaner.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[vsstat.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []
    <IFEO[webscanx.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe>  []

    <IFEO[WoptiClean.exe]><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> 

启动文件夹 虽然没问题但是建议删除

autorun。inf病毒
[D:\]
[AutoRun]
open=qphotux.exe
shell\open=打开(&O)
shell\open\Command=qphotux.exe
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=qphotux.exe
[E:\]
[AutoRun]
open=qphotux.exe
shell\open=打开(&O)
shell\open\Command=qphotux.exe
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=qphotux.exe
[F:\]
[AutoRun]
open=qphotux.exe
shell\open=打开(&O)
shell\open\Command=qphotux.exe
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=qphotux.exe

进程
PID: 1128 [C:\Program Files\Common Files\System\fbiytty.exe] 
PID: 452 [C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe]
哈哈 小流氓来啦 大家快逃啊
gototop
 

回复:7月21日 日志分析 练习4

今天学习了八月病毒,映像劫持。。。。。
哈哈 小流氓来啦 大家快逃啊
gototop
 

回复:7月21日 日志分析 练习4

答案
gototop
 

回复:7月21日 日志分析 练习4

继续学习~
gototop
 
12   2  /  2  页   跳转
页面顶部
Powered by Discuz!NT