ccfish
中级用户
积分 424
发帖 423
注册 2006-8-21
来自 中关村
|
#12
关键是我系统防得好，只发现这两个文件．．．
system32目录下：
dts3211.exe（不知道怎么回事，隔离区没有）
taskmagr.exe
wmdmpmsvc.dll
可疑程序加载的注册表项：
| Quote: | Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WmdmPmSN]
"Type"=dword:00000010
"Start"=dword:00000004
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
"DisplayName"="Portable Media Serial Number Service"
"ObjectName"="LocalSystem"
"Description"=hex(2):52,00,65,00,74,00,72,00,69,00,65,00,76,00,65,00,73,00,20,\
00,74,00,68,00,65,00,20,00,73,00,65,00,72,00,69,00,61,00,6c,00,20,00,6e,00,\
75,00,6d,00,62,00,65,00,72,00,20,00,6f,00,66,00,20,00,61,00,6e,00,79,00,20,\
00,70,00,6f,00,72,00,74,00,61,00,62,00,6c,00,65,00,20,00,6d,00,65,00,64,00,\
69,00,61,00,20,00,70,00,6c,00,61,00,79,00,65,00,72,00,20,00,63,00,6f,00,6e,\
00,6e,00,65,00,63,00,74,00,65,00,64,00,20,00,74,00,6f,00,20,00,74,00,68,00,\
69,00,73,00,20,00,63,00,6f,00,6d,00,70,00,75,00,74,00,65,00,72,00,2e,00,20,\
00,49,00,66,00,20,00,74,00,68,00,69,00,73,00,20,00,73,00,65,00,72,00,76,00,\
69,00,63,00,65,00,20,00,69,00,73,00,20,00,73,00,74,00,6f,00,70,00,70,00,65,\
00,64,00,2c,00,20,00,70,00,72,00,6f,00,74,00,65,00,63,00,74,00,65,00,64,00,\
20,00,63,00,6f,00,6e,00,74,00,65,00,6e,00,74,00,20,00,6d,00,69,00,67,00,68,\
00,74,00,20,00,6e,00,6f,00,74,00,20,00,62,00,65,00,20,00,64,00,6f,00,77,00,\
6e,00,20,00,6c,00,6f,00,61,00,64,00,65,00,64,00,20,00,74,00,6f,00,20,00,74,\
00,68,00,65,00,20,00,64,00,65,00,76,00,69,00,63,00,65,00,2e,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WmdmPmSN\Parameters]
"ServiceDll"=hex(2):25,00,53,00,59,00,53,00,54,00,45,00,4d,00,52,00,4f,00,4f,\
00,54,00,25,00,5c,00,53,00,59,00,53,00,54,00,45,00,4d,00,33,00,32,00,5c,00,\
4d,00,53,00,50,00,4d,00,53,00,4e,00,53,00,56,00,2e,00,44,00,4c,00,4c,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WmdmPmSN\Security]
"Security"=hex:01,00,14,80,b8,00,00,00,c4,00,00,00,14,00,00,00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
00,00,02,00,88,00,06,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,04,00,00,00,00,\
00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,06,00,00,00,00,00,14,00,00,01,\
00,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,00,18,00,fd,01,02,00,01,02,00,\
00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,00,00,00,00,00,05,12,00,00,00,\
01,01,00,00,00,00,00,05,12,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WmdmPmSN\Enum]
"0"="Root\\LEGACY_WMDMPMSN\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001 |
|
| |
※ ※ ※ 本文纯属【ccfish】个人意见，与【 微点交流论坛 】立场无关※ ※ ※
|
抓到黑客,直接打死~ |
|
|
