New face of the robot dog: 0x0000008e blue screen Error 1

New face of the robot dog: 0x0000008e blue screen Error 1

EndurerOriginal
2008-03-14 1st

A friend's computer encountered a 0x0000008e blue screen error before and after system login yesterday. Please help me with the repair.

I. Analysis
Generally, when the program references an incorrect memory address, the 0x0000008e blue screen error may occur. When this error occurs when you log on to the system, it may be caused by the startup Item.

Ii. Detection
To skip the boot item, we press the F8 key during boot and select to start in safe mode with network connection.
The result is normal logon ~
It seems that the problem lies in the startup Item.
Run msconfig.exe, check the startup item, and find several O4 items in the pe_xscan log below. Check that the computer has a virus.

Download the pe_xscan scan log and analyze it. The following suspicious items are found (the same part of the Process Module is omitted ):

/=
Pe_xscan 08-03-03 by Purple endurer

Windows XP Service Pack 2 (5.1.2600)
Administrator user group
Security Mode with network connection

[System process] * 0
C:/Windows/system32/fyom. dll | 10:22:26
C:/Windows/system32/taijoad. dll | 10:22:58
C:/Windows/system32/atgnehz. dll | 10:21:46
C:/Windows/system32/tsqc. dll | 10:22:52
C:/Windows/system32/mnauygniqaixnaij. dll |
C:/Windows/system32/oqnauhc. dll | 10:22:46
C:/Windows/system32/gnolnait. dll |
C:/Windows/system32/duygnef. dll | 10:23:24
C:/Windows/system32/slcs. dll | 10:24:54
C:/Windows/system32/iemnaw. dll | 10:22:24
C:/Windows/system32/Winlogon. EXE * 220 | MICROSOFT (r) Windows (r) Operating System | 5.1.2600.2180 | Windows NT logon application | (c) Microsoft Corporation. all rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation |? | Winlogon. exe
C:/Windows/system32/mnauygniqaixnaij. dll |
C:/Windows/system32/oqnauhc. dll | 10:22:46
C:/Windows/system32/gnolnait. dll |
C:/Windows/system32/duygnef. dll | 10:23:24
C:/Windows/system32/fyom. dll | 10:22:26
C:/Windows/system32/taijoad. dll | 10:22:58
C:/Windows/system32/atgnehz. dll | 10:21:46
C:/Windows/system32/tsqc. dll | 10:22:52
C:/Windows/system32/slcs. dll | 10:24:54
C:/Windows/system32/iemnaw. dll | 10:22:24
C:/Windows/system32/services. EXE * 392 | MICROSOFT (r) Windows (r) Operating System | 5.1.2600.2180 | services and controller app | (c) Microsoft Corporation. all rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation |? | Services.exe
C:/Windows/system32/mnauygniqaixnaij. dll |
C:/Windows/system32/oqnauhc. dll | 10:22:46
C:/Windows/system32/gnolnait. dll |
C:/Windows/system32/duygnef. dll | 10:23:24
C:/Windows/system32/fyom. dll | 10:22:26
C:/Windows/system32/taijoad. dll | 10:22:58
C:/Windows/system32/atgnehz. dll | 10:21:46
C:/Windows/system32/tsqc. dll | 10:22:52
C:/Windows/system32/slcs. dll | 10:24:54
C:/Windows/system32/LSASS. EXE * 412 | MICROSOFT? Windows? Operating System | 5.1.2600.2180 | LSA shell (export version) |? Microsoft Corporation. All Rights Reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation |? | Lsass.exe
C:/Windows/system32/mnauygniqaixnaij. dll |
C:/Windows/system32/oqnauhc. dll | 10:22:46
C:/Windows/system32/gnolnait. dll |
C:/Windows/system32/duygnef. dll | 10:23:24
C:/Windows/system32/fyom. dll | 10:22:26
C:/Windows/system32/taijoad. dll | 10:22:58
C:/Windows/system32/atgnehz. dll | 10:21:46
C:/Windows/system32/tsqc. dll | 10:22:52
C:/Windows/system32/slcs. dll | 10:24:54
C:/Windows/system32/SVCHOST. EXE * 968 | MICROSOFT? Windows? Operating System | 5.1.2600.2180 | generic host process for Win32 services |? Microsoft Corporation. All Rights Reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation |? | Svchost.exe
C:/Windows/system32/mnauygniqaixnaij. dll |
C:/Windows/system32/oqnauhc. dll | 10:22:46
C:/Windows/system32/gnolnait. dll |
C:/Windows/system32/duygnef. dll | 10:23:24
C:/Windows/system32/fyom. dll | 10:22:26
C:/Windows/system32/taijoad. dll | 10:22:58
C:/Windows/system32/atgnehz. dll | 10:21:46
C:/Windows/system32/tsqc. dll | 10:22:52
C:/Windows/system32/slcs. dll | 10:24:54
C:/Windows/system32/conime. EXE * 456 | MICROSOFT? Windows? Operating System | 5.1.2600.2180 | console IME |? Microsoft Corporation. All Rights Reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation |? | Console | conime. exe
C:/Windows/system32/fyom. dll | 10:22:26
C:/Windows/system32/taijoad. dll | 10:22:58
C:/Windows/system32/atgnehz. dll | 10:21:46
C:/Windows/system32/tsqc. dll | 10:22:52
C:/Windows/system32/mnauygniqaixnaij. dll |
C:/Windows/system32/oqnauhc. dll | 10:22:46
C:/Windows/system32/gnolnait. dll |
C:/Windows/system32/duygnef. dll | 10:23:24
C:/Windows/system32/slcs. dll | 10:24:54
O2-BHO-{D29DCEE0-457B-45A2-A92D-741B95B7723B}-C:/program files/Internet Explorer/plugins/ns_sys55.sys
O4-HKLM/../run: [upxdnd] C:/Windows/upxdnd. exe
O4-HKLM/../run: [kvsc3] C:/Windows/kvsc3.exe
O4-HKLM/../run: [msccrt] C:/Windows/msccrt. exe
O4-HKLM/../run: [cmdbcs] C:/Windows/cmdbcs. exe
O4-HKLM/../run: [dbghlp32] C:/Windows/dbghlp32.exe
O4-HKLM/../run: [lotushlp] C:/Windows/lotushlp. exe
O4-HKLM/../run: [shaproc] C:/Windows/shaproc. exe
O4-HKLM/../run: [winsvr32] C:/Windows/winsvr32.exe
O4-HKLM/../run: [wsockdrv32] C:/Windows/wsockdrv32.exe
O4-HKLM/../policies/Explorer/run: [comrepl32] C:/Windows/system32/COM/comrecfg. exe
O4-HKLM/../policies/Explorer/run: [visin] C:/Windows/system32/visin. exe
O20-appinit_dlls = fyom. DLL, taijoad. DLL, atgnehz. DLL, tsqc. DLL, mnauygniqaixnaij. DLL, oqnauhc. DLL, gnolnait. DLL, duygnef. DLL, slcs. DLL, iemnaw. DLL
O23-service: asyncmac (RAS asynchronous media driver)-system32/Drivers/comint32.sys (automatic)
O23-service: comint32 (comint32)-C:/Windows/system32/Drivers/comint32.sys | (manual)
O23-service: msert-system32/Drivers/mselk. sys (automatic)
O23-service: NPF (netgroup Packet Filter)-system32/Drivers/NPF. sys | Winpcap netgroup Packet Filter Driver | 3, 1, 0, 27 | NPF | copyright? 2005 cace technologies. Copyright? 2003-2005 netgroup, Politecnico di Torino. | 3, 1, 0, 27 | cace technologies | NPF + tme | NPF. sys (manual)
O23-service: pciharddisk (pciharddisk)-C:/Windows/system32/Drivers/fat32.sys (manual)
O23-service: windowsdown (windows_systemdown)-C:/Windows/system32/Servet. EXE (disabled)
O24-shlexechook: [Microsoft]-{7914e0aa-eccb-4311-b584-c49538227824} = C:/Windows/system32/jhfrxz. dll
O24-shlexechook: []-{D29DCEE0-457B-45A2-A92D-741B95B7723B} = C:/program files/Internet Explorer/plugins/ns_sys55.sys
O24-shlexechook: [Microsoft]-{84143167-b645-4bff-b873-da1dc886e9a7} = C:/Windows/system32/cedafb. dll
O24-shlexechook: [Microsoft]-{5e907a48-400e-4ea8-9792-ffae052d59e9} = C:/Windows/system32/pedadt. dll
O24-shlexechook: [Microsoft]-{1e51c0fd-ee36-434b-ad2a-fd1ff3731c38} = C:/Windows/system32/wyrsdj. dll

O25-inscom: {11716107-a10d-11cf-64cd-11115fe1cf41} = C:/Windows/system32/nwizzhuxians. exe
 
O26-ifeo: 360rpt.exe-> ntsd-d
O26-ifeo: 360safe.exe-> ntsd-d
O26-ifeo: 360safebox.exe-> ntsd-d
O26-ifeo: 360tray.exe-> ntsd-d
O26-ifeo: adam.exe-> ntsd-d
O26-ifeo: agentsvr.exe-> ntsd-d
O26-ifeo: Prepare vc32.exe-> ntsd-d
O26-ifeo: autoruns.exe-> ntsd-d
O26-ifeo: avconsol.exe-> ntsd-d
O26-ifeo: avgrssvc.exe-> ntsd-d
O26-ifeo: avmonitor.exe-> ntsd-d
O26-ifeo: avp.com-> ntsd-d
O26-ifeo: avp.exe-> ntsd-d
O26-ifeo: ccenter.exe-> ntsd-d
O26-ifeo: ccsvchst.exe-> ntsd-d
O26-ifeo: eghost.exe-> ntsd-d
O26-ifeo: filedsty.exe-> ntsd-d
O26-ifeo: ftcleanershell.exe-> ntsd-d
O26-ifeo: fyfirewall.exe-> ntsd-d
O26-ifeo: hijackthis.exe-> ntsd-d
O26-ifeo: icesword.exe-> ntsd-d
O26-ifeo: iparmo.exe-> ntsd-d
O26-ifeo: iparmor.exe-> ntsd-d
O26-ifeo: ispwdsvc.exe-> ntsd-d
O26-ifeo: kabaload.exe-> ntsd-d
O26-ifeo: kascrscn. scr-> ntsd-d
O26-ifeo: kasmain.exe-> ntsd-d
O26-ifeo: kastask.exe-> ntsd-d
O26-ifeo: kav32.exe-> ntsd-d
O26-ifeo: kavdx.exe-> ntsd-d
O26-ifeo: kavpf.exe-> ntsd-d
O26-ifeo: kavpfw.exe-> ntsd-d
O26-ifeo: kavsetup.exe-> ntsd-d
O26-ifeo: kavstart.exe-> ntsd-d
O26-ifeo: kislnchr.exe-> ntsd-d
O26-ifeo: kmailmon.exe-> ntsd-d
O26-ifeo: kmfilter.exe-> ntsd-d
O26-ifeo: kpfw32.exe-> ntsd-d
O26-ifeo: kpfw32x.exe-> ntsd-d
O26-ifeo: kpfwsvc.exe-> ntsd-d
O26-ifeo: kregex.exe-> ntsd-d
O26-ifeo: krepair.com-> ntsd-d
O26-ifeo: ksloader.exe-> ntsd-d
O26-ifeo: kvcenter. KXP-> ntsd-d
O26-ifeo: kvdetect.exe-> ntsd-d
O26-ifeo: kvfwmcl.exe-> ntsd-d
O26-ifeo: kvmonxp. KXP-> ntsd-d
O26-ifeo: kvmonxp_1.kxp-> ntsd-d
O26-ifeo: kvol.exe-> ntsd-d
O26-ifeo: kvolself.exe-> ntsd-d
O26-ifeo: kvreport. KXP-> ntsd-d
O26-ifeo: kvscan. KXP-> ntsd-d
O26-ifeo: kvsrvxp.exe-> ntsd-d
O26-ifeo: kvstub. KXP-> ntsd-d
O26-ifeo: kvupload.exe-> ntsd-d
O26-ifeo: kvwsc.exe-> ntsd-d
O26-ifeo: kvxp. KXP-> ntsd-d
O26-ifeo: kvxp_1.kxp-> ntsd-d
O26-ifeo: kwatch.exe-> ntsd-d
O26-ifeo: kwatch9x.exe-> ntsd-d
O26-ifeo: kwatchx.exe-> ntsd-d
O26-ifeo: magicset.exe-> ntsd-d
O26-ifeo: mcconsol.exe-> ntsd-d
O26-ifeo: mmqczj.exe-> ntsd-d
O26-ifeo: mmsk.exe-> ntsd-d
O26-ifeo: navapsvc.exe-> ntsd-d
O26-ifeo: navapw32.exe-> ntsd-d
O26-ifeo: nod32.exe-> ntsd-d
O26-ifeo: nod32krn.exe-> ntsd-d
O26-ifeo: nod32kui.exe-> ntsd-d
O26-ifeo: npfmntor.exe-> ntsd-d
O26-ifeo: ollydbg. exe-> ntsd-d
O26-ifeo: ollyice. exe-> ntsd-d
O26-ifeo: pfw.exe-> ntsd-d
O26-ifeo: pfwliveupdate.exe-> ntsd-d
O26-ifeo: procexp.exe-> ntsd-d
O26-ifeo: qhset.exe-> ntsd-d
O26-ifeo: qqdoctor.exe-> ntsd-d
O26-ifeo: qqkav.exe-> ntsd-d
O26-ifeo: ras.exe-> ntsd-d
O26-ifeo: ravmond.exe-> ntsd-d
O26-ifeo: ravstub.exe-> ntsd-d
O26-ifeo: rawcopy.exe-> ntsd-d
O26-ifeo: regclean.exe-> ntsd-d
O26-ifeo: regtool.exe-> ntsd-d
O26-ifeo: rfw.exe .exe-> ntsd-d
O26-ifeo: rfwmain.exe-> ntsd-d
O26-ifeo: rfwproxy.exe-> ntsd-d
O26-ifeo: rfwsrv.exe-> ntsd-d
O26-ifeo: rfwstub.exe-> ntsd-d
O26-ifeo: rsagent.exe-> ntsd-d
O26-ifeo: rsaupd.exe-> ntsd-d
O26-ifeo: runiep.exe-> ntsd-d
O26-ifeo: safebank.exe-> ntsd-d
O26-ifeo: safeboxtray.exe-> ntsd-d
O26-ifeo: safelive.exe-> ntsd-d
O26-ifeo: scan32.exe-> ntsd-d
O26-ifeo: shda-32.exe-> ntsd-d
O26-ifeo: smartup.exe-> ntsd-d
O26-ifeo: Sreng. exe-> ntsd-d
O26-ifeo: symlcsvc.exe-> ntsd-d
O26-ifeo: syssafe.exe-> ntsd-d
O26-ifeo: trojandetector.exe-> ntsd-d
O26-ifeo: trojanwall.exe-> ntsd-d
O26-ifeo: trojdie. KXP-> ntsd-d
O26-ifeo: uihost.exe-> ntsd-d
O26-ifeo: umxagent.exe-> ntsd-d
O26-ifeo: umxattachment.exe-> ntsd-d
O26-ifeo: umxw..exe-> ntsd-d
O26-ifeo: umxfwhlp.exe-> ntsd-d
O26-ifeo: umxpol.exe-> ntsd-d
O26-ifeo: uplive.exe-> ntsd-d
O26-ifeo: vsstat.exe-> ntsd-d
O26-ifeo: webscanx.exe-> ntsd-d
O26-ifeo: windbg.exe-> ntsd-d
O26-ifeo: wopticlean.exe-> ntsd-d
===/

From

O23-service: pciharddisk (pciharddisk)-C:/Windows/system32/Drivers/fat32.sys (manual)

We can see that the computer is equipped with a robot dog, which won the bid more than ten o'clock A.M. on January 1, March 12.

(To be continued)