auto.exe/Backdoor.Win32.Agent.bgu,b8u6bvx912.sys/Trojan-Downloader.Win32.Hmir.don等1

auto.exe/Backdoor.Win32.Agent.bgu,b8u6bvx912.sys/Trojan-Downloader.Win32.Hmir.don等1

endurer 原创 2008-06-28 第1版

直接贴上 pe_xscan 的 log：

pe_xscan 08-04-26 by Purple Endurer 
2008-6-28 16:58:49 
Windows XP Service Pack 2(5.1.2600) 
MSIE:6.0.2900.2180 
管理员用户组 
正常模式 

C:/WINDOWS/Explorer.EXE* 1164 | 2004-8-17 4:0:0 | Microsoft(R) Windows(R) Operating System | 6.00.2900.2180 | Windows Explorer | (C) Microsoft Corporation. All rights reserved. | 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | explorer | EXPLORER.EXE 
　　C:/WINDOWS/system32/12t9.dll
　　C:/WINDOWS/system32/iujznmouzpoul.dll | 2008-6-24 13:19:48 | | 1.0.0.0 | Windows Time Update | | 1.0.0.0 | Microsoft Inc. | | | 
　　C:/WINDOWS/system32/qzyejpgucs.dll | 2008-6-28 1:41:48 | | 2.0.0.0 | windows-update | | 2.0.0.0 | Nicrosoft Inc. | | | 
　　C:/WINDOWS/system32/hecowsaukc.dll | 2008-6-27 1:19:48 | | 2.0.0.0 | windows-update | | 2.0.0.0 | Nicrosoft Inc. | | | 
 
O2 - BHO - {0A71FCEB-0184-4347-A345-539CF9F38F6A} -C:/WINDOWS/system32/iujznmouzpoul.dll
O2 - BHO - {A7BE9548-E942-44B0-8EB2-B4D52A8158D7} -C:/WINDOWS/system32/qzyejpgucs.dll
O2 - BHO - {E5ADFAFA-8542-4BBD-BC1C-B295E63CA728} -C:/WINDOWS/system32/hecowsaukc.dll
O2 - BHO SrchHook Class - {F08555B0-9CC3-11D2-AA8E-000000000000} -C:/Program Files/HotTools/iebho.dll
O3 - IE工具栏: 快捷工具条3.21 - {BE830FD4-E393-417F-9F4B-CC70ABB3384C} -C:/Program Files/HotTools/ietool.dll

C:/autorun.inf
/-----
[AutoRun]
OPEN=auto.exe
shellexecute=auto.exe
shell/打开(&O)/command=ntldr.exe
shell/Auto/command=auto.exe
-----/
D:/autorun.inf
/-----
[AutoRun]
OPEN=auto.exe
shellexecute=auto.exe
shell/打开(&O)/command=ntldr.exe
shell/Auto/command=auto.exe
-----/
E:/autorun.inf
/-----
[AutoRun]
OPEN=auto.exe
shellexecute=auto.exe
shell/打开(&O)/command=ntldr.exe
shell/Auto/command=auto.exe
-----/

O23 - 服务: 1028247E (1028247E) -C:/WINDOWS/system32/62F1B80D.EXE -a (自动) 
O23 - 服务: 25yyf (25yyf) - System32/DRIVERS/25yyf.sys | | 1, 0, 0, 1 | File System Driver | (C) Microsoft Corporation. All rights reserved. | 1, 0, 0, 1 | | | | (引导) O23 - 服务: 3A452D83 (3A452D83) -C:/WINDOWS/system32/24E9F3BC.EXE -k (自动) 
O23 - 服务: b8u6bvx912 (b8u6bvx912) - system32/drivers/b8u6bvx912.sys(引导)
O26 - IFEO: 360rpt.exe -> net
O26 - IFEO: 360Safe.exe -> net
O26 - IFEO: 360tray.exe -> net
O26 - IFEO: ACKWIN32.EXE -> net
O26 - IFEO: ANTI-TROJAN.EXE -> net
O26 - IFEO: APVXDWIN.EXE -> net
O26 - IFEO: AUTODOWN.EXE -> net
O26 - IFEO: AVCONSOL.EXE -> net
O26 - IFEO: AVE32.EXE -> net
O26 - IFEO: AVGCTRL.EXE -> net
O26 - IFEO: AVKSERV.EXE -> net
O26 - IFEO: AVNT.EXE -> net
O26 - IFEO: AVP.EXE -> net
O26 - IFEO: AVP32.EXE -> net
O26 - IFEO: AVPCC.EXE -> net
O26 - IFEO: AVPDOS32.EXE -> net
O26 - IFEO: AVPM.EXE -> net
O26 - IFEO: AVPTC32.EXE -> net
O26 - IFEO: AVPUPD.EXE -> net
O26 - IFEO: AVSCHED32.EXE -> net
O26 - IFEO: AVWIN95.EXE -> net
O26 - IFEO: AVWUPD32.EXE -> net
O26 - IFEO: BLACKD.EXE -> net
O26 - IFEO: BLACKICE.EXE -> net
O26 - IFEO: CFIADMIN.EXE -> net
O26 - IFEO: CFIAUDIT.EXE -> net
O26 - IFEO: CFINET.EXE -> net
O26 - IFEO: CFINET32.EXE -> net
O26 - IFEO: CLAW95.EXE -> net
O26 - IFEO: CLAW95CF.EXE -> net
O26 - IFEO: CLEANER.EXE -> net
O26 - IFEO: CLEANER3.EXE -> net
O26 - IFEO: DVP95.EXE -> net
O26 - IFEO: DVP95_0.EXE -> net
O26 - IFEO: ECENGINE.EXE -> net
O26 - IFEO: EGHOST.EXE -> net
O26 - IFEO: ESAFE.EXE -> net
O26 - IFEO: EXPWATCH.EXE -> net
O26 - IFEO: F-AGNT95.EXE -> net
O26 - IFEO: F-PROT.EXE -> net
O26 - IFEO: F-PROT95.EXE -> net
O26 - IFEO: F-STOPW.EXE -> net
O26 - IFEO: FESCUE.EXE -> net
O26 - IFEO: FINDVIRU.EXE -> net
O26 - IFEO: FP-WIN.EXE -> net
O26 - IFEO: FPROT.EXE -> net
O26 - IFEO: FRW.EXE -> net
O26 - IFEO: IAMAPP.EXE -> net
O26 - IFEO: IAMSERV.EXE -> net
O26 - IFEO: IBMASN.EXE -> net
O26 - IFEO: IBMAVSP.EXE -> net
O26 - IFEO: ICLOAD95.EXE -> net
O26 - IFEO: ICLOADNT.EXE -> net
O26 - IFEO: ICMON.EXE -> net
O26 - IFEO: ICSUPP95.EXE -> net
O26 - IFEO: ICSUPPNT.EXE -> net
O26 - IFEO: IFACE.EXE -> net
O26 - IFEO: IOMON98.EXE -> net
O26 - IFEO: Iparmor.exe -> net
O26 - IFEO: JEDI.EXE -> net
O26 - IFEO: KAV32.exe -> net
O26 - IFEO: KAVPFW.EXE -> net
O26 - IFEO: KAVsvc.exe -> net
O26 - IFEO: KAVSvcUI.exe -> net
O26 - IFEO: KVFW.EXE -> net
O26 - IFEO: KVMonXP.exe -> net
O26 - IFEO: KVMonXP.kxp -> net
O26 - IFEO: KVSrvXP.exe -> net
O26 - IFEO: KVwsc.exe -> net
O26 - IFEO: KvXP.kxp -> net
O26 - IFEO: KWatchUI.EXE -> net
O26 - IFEO: LOCKDOWN2000.EXE -> net
O26 - IFEO: Logo1_.exe -> net
O26 - IFEO: Logo_1.exe -> net
O26 - IFEO: LOOKOUT.EXE -> net
O26 - IFEO: LUALL.EXE -> net
O26 - IFEO: MAILMON.EXE -> net
O26 - IFEO: MOOLIVE.EXE -> net
O26 - IFEO: MPFTRAY.EXE -> net
O26 - IFEO: N32SCANW.EXE -> net
O26 - IFEO: Navapsvc.exe -> net
O26 - IFEO: Navapw32.exe -> net
O26 - IFEO: NAVLU32.EXE -> net
O26 - IFEO: NAVNT.EXE -> net
O26 - IFEO: navw32.EXE -> net
O26 - IFEO: NAVWNT.EXE -> net
O26 - IFEO: NISUM.EXE -> net
O26 - IFEO: NMain.exe -> net
O26 - IFEO: NORMIST.EXE -> net
O26 - IFEO: NUPGRADE.EXE -> net
O26 - IFEO: NVC95.EXE -> net
O26 - IFEO: PAVCL.EXE -> net
O26 - IFEO: PAVSCHED.EXE -> net
O26 - IFEO: PAVW.EXE -> net
O26 - IFEO: PCCWIN98.EXE -> net
O26 - IFEO: PCFWALLICON.EXE -> net
O26 - IFEO: PERSFW.EXE -> net
O26 - IFEO: PFW.EXE -> net
O26 - IFEO: Rav.exe -> net
O26 - IFEO: RAV7.EXE -> net
O26 - IFEO: RAV7WIN.EXE -> net
O26 - IFEO: RAVmon.exe -> net
O26 - IFEO: RAVmonD.exe -> net
O26 - IFEO: RAVtimer.exe -> net
O26 - IFEO: Rising.exe -> net
O26 - IFEO: SAFEWEB.EXE -> net
O26 - IFEO: SCAN32.EXE -> net
O26 - IFEO: SCAN95.EXE -> net
O26 - IFEO: SCANPM.EXE -> net
O26 - IFEO: SCRSCAN.EXE -> net
O26 - IFEO: SERV95.EXE -> net
O26 - IFEO: SMC.EXE -> net
O26 - IFEO: SPHINX.EXE -> net
O26 - IFEO: SWEEP95.EXE -> net
O26 - IFEO: TBSCAN.EXE -> net
O26 - IFEO: TCA.EXE -> net
O26 - IFEO: TDS2-98.EXE -> net
O26 - IFEO: TDS2-NT.EXE -> net
O26 - IFEO: THGUARD.EXE -> net
O26 - IFEO: TrojanHunter.exe -> net
O26 - IFEO: VET95.EXE -> net
O26 - IFEO: VETTRAY.EXE -> net
O26 - IFEO: VSCAN40.EXE -> net
O26 - IFEO: VSECOMR.EXE -> net
O26 - IFEO: VSHWIN32.EXE -> net
O26 - IFEO: VSSTAT.EXE -> net
O26 - IFEO: WEBSCANX.EXE -> net
O26 - IFEO: WFINDV32.EXE -> net
O26 - IFEO: ZONEALARM.EXE -> net
O26 - IFEO: _AVP32.EXE -> net
O26 - IFEO: _AVPCC.EXE -> net
O26 - IFEO: _AVPM.EXE -> net
O26 - IFEO: 修复工具.exe -> net
O29 - HKCU-Start Page = hxxp://www.258central.cn/
HKLM/SHOWALL 值非1

（未完待续）