卡巴不报!MD5: FCC8C6

The EQs

服了3楼的。。。。。

tiancun

为了我们好的网络环境,为了卡巴,一起努力~~

tiancun

可是他有AV的特性~~百度搜索病毒字样的,就被强制关了,卡巴也被关了~~
怎么解释呢~~`

SONGBOWEN

映像劫持如下项目：

1. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
   
2. 360rpt.exe
   
3. 360Safe.exe
   
4. 360tray.exe
   
5. adam.exe
   
6. AgentSvr.exe
   
7. AppSvc32.exe
   
8. ArSwp.exe
   
9. AST.exe
   
10. autoruns.exe
    
11. AvastU3.exe
    
12. avconsol.exe
    
13. avgrssvc.exe
    
14. AvMonitor.exe
    
15. avp.com
    
16. avp.exe
    
17. CCenter.exe
    
18. ccSvcHst.exe
    
19. EGHOST.exe
    
20. FileDsty.exe
    
21. FTCleanerShell.exe
    
22. FYFireWall.exe
    
23. ghost.exe
    
24. HijackThis.exe
    
25. IceSword.exe
    
26. iparmo.exe
    
27. Iparmor.exe
    
28. irsetup.exe
    
29. isPwdSvc.exe
    
30. kabaload.exe
    
31. KaScrScn.SCR
    
32. KASMain.exe
    
33. KASTask.exe
    
34. KAV32.exe
    
35. KAVDX.exe
    
36. KAVPF.exe
    
37. KAVPFW.exe
    
38. KAVSetup.exe
    
39. KAVStart.exe
    
40. KISLnchr.exe
    
41. KMailMon.exe
    
42. KMFilter.exe
    
43. KPFW32.exe
    
44. KPFW32X.exe
    
45. KPfwSvc.exe
    
46. KRegEx.exe
    
47. KRepair.com
    
48. KsLoader.exe
    
49. KVCenter.kxp
    
50. KvDetect.exe
    
51. KvfwMcl.exe
    
52. KVMonXP.kxp
    
53. KVMonXP_1.kxp
    
54. kvol.exe
    
55. kvolself.exe
    
56. KvReport.kxp
    
57. KVScan.kxp
    
58. KVSrvXP.exe
    
59. KVStub.kxp
    
60. kvupload.exe
    
61. kvwsc.exe
    
62. KvXP.kxp
    
63. KvXP_1.kxp
    
64. KWatch.exe
    
65. KWatch9x.exe
    
66. KWatchX.exe
    
67. loaddll.exe
    
68. MagicSet.exe
    
69. mcconsol.exe
    
70. mmqczj.exe
    
71. mmsk.exe
    
72. Navapsvc.exe
    
73. Navapw32.exe
    
74. nod32.exe
    
75. nod32krn.exe
    
76. nod32kui.exe
    
77. NPFMntor.exe
    
78. PFW.exe
    
79. PFWLiveUpdate.exe
    
80. QHSET.exe
    
81. QQDoctor.exe
    
82. QQKav.exe
    
83. QQSC.exe
    
84. Ras.exe
    
85. Rav.exe
    
86. RavMon.exe
    
87. RavMonD.exe
    
88. RavStub.exe
    
89. RavTask.exe
    
90. RegClean.exe
    
91. rfwcfg.exe
    
92. rfwmain.exe
    
93. rfwsrv.exe
    
94. RsAgent.exe
    
95. Rsaupd.exe
    
96. rstrui.exe
    
97. runiep.exe
    
98. safelive.exe
    
99. scan32.exe
    
100. shcfg32.exe
     
101. SmartUp.exe
     
102. SREng.EXE
     
103. symlcsvc.exe
     
104. SysSafe.exe
     
105. TrojanDetector.exe
     
106. Trojanwall.exe
     
107. TrojDie.kxp
     
108. UIHost.exe
     
109. UmxAgent.exe
     
110. UmxAttachment.exe
     
111. UmxCfg.exe
     
112. UmxFwHlp.exe
     
113. UmxPol.exe
     
114. upiea.exe
     
115. UpLive.exe
     
116. USBCleaner.exe
     
117. vsstat.exe
     
118. webscanx.exe
     
119. WoptiClean.exe
     
120. zjb.exe

复制代码

SONGBOWEN

正在进一步的分析中，大家多等一会吧～

tiancun

恩@@@等你分析~`~这种毒我们这还多者~~~卡巴杀不了,就没法干净了~

SONGBOWEN

添加启动项：

1. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   
2. "otcujrh"="C:\\Program Files\\Common Files\\System\\lxpbnfn.exe"
   
3. "rommabp"="C:\\Program Files\\Common Files\\Microsoft Shared\\cmvrsaw.exe"

复制代码

欠妳緈諨

avast

SONGBOWEN

晕死……
regmon和filemon都被他给关掉了……

SONGBOWEN

看来想要监控它的文件写入和注册表写入有一定的难度了……