刚发现一个巨牛B的病毒主流全无视

d4875163

[:338:卡巴诺顿没扫描到。

vipqinfeng

本人360安全卫士加微点主防，下载完毕时360没有提示。运行时被360拦截

liulangzhecgr

免费得来大丰收...

cwcwcw123321

费尔kill

liulangzhecgr

[XueTr][内核模块]: 128
驱动名  基地址  大小  驱动对象  驱动路径  服务名  加载顺序  文件厂商

QQPCHW.sys  0xF9BF4000  0x00006000  0x8127FBD8  C:\Program Files\Tencent\QQPCMgr\QQPCHW.sys  TcHardWare  99  Tencent

TCSafeBox.sys  0xF9BA4000  0x00007000  0x813279E0  C:\Program Files\Tencent\QQPCMgr\TCSafeBox.sys  TCSafeBox  98

TSSysKit.sys  0xF9AD4000  0x00006000  0x810911A0  C:\Program Files\Tencent\QQPCMgr\TSSysKit.sys  TSSysKit  97  Tencent

TSKsp.sys  0xF4439000  0x00018000  0x81012E60  C:\Program Files\Tencent\QQPCMgr\TSKsp.sys  TSKSP  96  Tencent

ptilink.sys  0xF9B3C000  0x00005000  0x814B3488  C:\WINDOWS\system32\DRIVERS\ptilink.sys  Ptilink  55  Parallel Technologies, Inc.

[XueTr][系统回调]: 26
回调入口  类型  路径  文件厂商  备注
0xF443CB86  CreateProcess  C:\Program Files\Tencent\QQPCMgr\TSKsp.sys  Tencent
0xF9BA7B84  CreateProcess  C:\Program Files\Tencent\QQPCMgr\TCSafeBox.sys
0xF4439F18  Shutdown  C:\Program Files\Tencent\QQPCMgr\TSKsp.sys  Tencent  PDEVICE_OBJECT = 0x81267030

[XueTr][SSDT]: 38
序号  函数名称  当前函数地址  Hook  原始函数地址  当前函数地址所在模块

186  NtReadVirtualMemory  0xF9BA6CDC  ssdt hook  0x8057F4B8  C:\Program Files\Tencent\QQPCMgr\TCSafeBox.sys

277  NtWriteVirtualMemory  0xF9BA6B58  ssdt hook  0x8057F60A  C:\Program Files\Tencent\QQPCMgr\TCSafeBox.sys

37  NtCreateFile  0xF44413E6  ssdt hook  0x8056DF98  C:\Program Files\Tencent\QQPCMgr\TSKsp.sys

41  NtCreateKey  0xF443E5A4  ssdt hook  0x80571833  C:\Program Files\Tencent\QQPCMgr\TSKsp.sys

53  NtCreateThread  0xF4445C6A  ssdt hook  0x80588A3C  C:\Program Files\Tencent\QQPCMgr\TSKsp.sys

63  NtDeleteKey  0xF443E90C  ssdt hook  0x80596316  C:\Program Files\Tencent\QQPCMgr\TSKsp.sys

65  NtDeleteValueKey  0xF443EA88  ssdt hook  0x80593D64  C:\Program Files\Tencent\QQPCMgr\TSKsp.sys

68  NtDuplicateObject  0xF4445E32  ssdt hook  0x805727C5  C:\Program Files\Tencent\QQPCMgr\TSKsp.sys

73  NtEnumerateValueKey  0xF444581E  ssdt hook  0x8058AA67  C:\Program Files\Tencent\QQPCMgr\TSKsp.sys

97  NtLoadDriver  0xF44462AA  ssdt hook  0x805A4B73  C:\Program Files\Tencent\QQPCMgr\TSKsp.sys

122  NtOpenProcess  0xF443DC9C  ssdt hook  0x805729AC  C:\Program Files\Tencent\QQPCMgr\TSKsp.sys

177  NtQueryValueKey  0xF444490A  ssdt hook  0x8056B1F9  C:\Program Files\Tencent\QQPCMgr\TSKsp.sys

200  NtRequestWaitReplyPort  0xF443F13C  ssdt hook  0x80577EC6  C:\Program Files\Tencent\QQPCMgr\TSKsp.sys

224  NtSetInformationFile  0xF4440D54  ssdt hook  0x80575B2A  C:\Program Files\Tencent\QQPCMgr\TSKsp.sys

247  NtSetValueKey  0xF443F5D8  ssdt hook  0x80573A6E  C:\Program Files\Tencent\QQPCMgr\TSKsp.sys

257  NtTerminateProcess  0xF443E05E  ssdt hook  0x805834CC  C:\Program Files\Tencent\QQPCMgr\TSKsp.sys

274  NtWriteFile  0xF44411C8  ssdt hook  0x80575DD5  C:\Program Files\Tencent\QQPCMgr\TSKsp.sys

[XueTr][Kernel Hook]: 33
挂钩对象  挂钩位置  钩子类型  挂钩处当前值  挂钩处原始值

len(5) KeUserModeCallback[ntoskrnl.exe]  [0x80567ABD]->[0xF443DE10][C:\Program Files\Tencent\QQPCMgr\TSKsp.sys]  Inline  E9 4E 63 ED 73  6A 30 68 70 67

ntoskrnl.exe:KeUserModeCallback[win32k.sys]  [0x80567ABD]->[0xF9BA700E][C:\Program Files\Tencent\QQPCMgr\TCSafeBox.sys]  Iat  0E 70 BA F9  BD 7A 56 80

[XueTr][Message Hook]: 8
句柄  类型  函数  模块名  线程Id  进程Id  进程路径

0x001400DF  WH_KEYBOARD_LL  0x0079F72B  QQPCTray.exe  3028  2752  C:\Program Files\Tencent\QQPCMgr\QQPCTray.exe

0x00410395  WH_CBT  0x000032D0  TSVulFWMan.exe  3428  3548  C:\Documents and Settings\All Users\Application Data\Tencent\TSVulFw\TSVulFWMan.exe

[XueTr][启动项]: 74
名称  类型  启动路径  文件厂商

UUSeeMediaCenter  HKLM Run  C:\Program Files\Common Files\uusee\UUSeeMediaCenter.exe  UUSEE

QQPCTray  HKLM Run  C:\Program Files\Tencent\QQPCMgr\QQPCTray.exe  Tencent

QMSoftExt.dll(QMSoftExt)  RightMenu2  C:\Program Files\Tencent\QQPCMgr\plugins\FileSmash\QMSoftExt.dll  Tencent

QMSoftExt.dll(QMSoftExt)  RightMenu3  C:\Program Files\Tencent\QQPCMgr\plugins\FileSmash\QMSoftExt.dll  Tencent

极品桌面  HKCU Run  C:\Program Files\jpdesk(70FA340E)\jpdesk.exe  http://www.jpdesk.com

风行.lnk  C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\风行.lnk  C:\Program Files\Funshion Online\Funshion\Funshion.exe  Funshion Online Technologies Ltd.

SoXunPlayer  HKLM Run  C:\Program Files\SoXun\SXPlayer.exe

bgswitch  HKCU Run  C:\WINDOWS\system32\bgswitch.exe

RarExt.dll(WinRAR)  RightMenu1  C:\Program Files\WinRAR\RarExt.dll

RarExt.dll(WinRAR)  RightMenu3  C:\Program Files\WinRAR\RarExt.dll

({2179C5D3-EBFF-11CF-B6FD-00AA00B4E220})  Installed Components

Microsoft Windows Media Player 6.4({22d6f312-b0f6-11d0-94ab-0080c74c7e95})  Installed Components
[XueTr][服务]: 90
服务名  状态  启动类型  描述  映像路径  文件厂商  服务动态链接库  文件厂商

IeHelpChaJian1129  已停止  自动  Ie插件,辅助浏览器完成更多简单方便的任务1129!  C:\Program Files\ChaJian\Ie1129.exe  Microso遆邐 Corporation

DcomService  已启动  自动    C:\Program Files\Common Files\DcomServer\DcomServer.exe

QQPCRTP  已启动  自动  QQ电脑管家实时防护服务  C:\Program Files\Tencent\QQPCMgr\QQPCRTP.exe -r  Tencent

SoXunService  已启动  自动    C:\Program Files\SoXun\SoXunServer.exe

SXService  已启动  自动    C:\Program Files\SoXun\SXSvr.exe

痛改前非

红伞阻止下载

蓝色飞鱼

saybye

ESS也报了。。。

网之龙

怎么到今天了avast!5.1还不能正确识别拦截？！前楼的有几位不是说上报过avast了吗？难道是avast部门没收到？

橡果公爵

趋势2011杀之