In the event of auto.exe, hack. arpcheater. A (ARP spoofing tool), Trojan. psw. zhengtu, etc. 1

In the event of auto.exe, hack. arpcheater. A (ARP spoofing tool), Trojan. psw. zhengtu, etc. 1

EndurerOriginal
1Version

A netizen said that his computer was on a blue screen when it was used late. After the computer was started, the dialog box appeared, prompting that the "cmd.exe" error occurred. After confirmation, the task bar automatically disappeared, and no shadow was detected in anti-virus software monitoring ...... Allow Remote Assistance via QQ.

Download the pe_xscan scan log and analyze it. The following suspicious items are found (the process module is omitted ):

/=
Pe_xscan 07-07-21 by Purple endurer
2007-7-22 20:27:50
Windows XP Service Pack 2 (5.1.2600)
Administrator user group

[System process] * 0
C:/program files/Internet Explorer/msvcrt. DLL | Microsoft Windows operating system | 6.00.2900.3028 | Microsoft Corporation windows DLL | copyright (c) 2001.01 | 1. 0. 0. 1 | Microsoft Corporation |? | Windows. dll | Windows. dll

C:/Windows/system32/svchost.exe * 724 | MICROSOFT? Windows? Operating System | 5.1.2600.2180 | generic host process for Win32 services |? Microsoft Corporation. All Rights Reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation |? | Svchost.exe
C:/program files/Internet Explorer/msvcrt. DLL | Microsoft Windows operating system | 6.00.2900.3028 | Microsoft Corporation windows DLL | copyright (c) 2001.01 | 1. 0. 0. 1 | Microsoft Corporation |? | Windows. dll | Windows. dll

C:/Windows/system32/ctfmon.exe * 936 | MICROSOFT? Windows? Operating System | 5.1.2600.2180 | CTF loader |? Microsoft Corporation. All Rights Reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation |? | Ctfmon. exe
C:/program files/Internet Explorer/msvcrt. DLL | Microsoft Windows operating system | 6.00.2900.3028 | Microsoft Corporation windows DLL | copyright (c) 2001.01 | 1. 0. 0. 1 | Microsoft Corporation |? | Windows. dll | Windows. dll

C:/Windows/system32/conime.exe * 908 | MICROSOFT? Windows? Operating System | 5.1.2600.2180 | console IME |? Microsoft Corporation. All Rights Reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation |? | Console | conime. exe
C:/program files/Internet Explorer/msvcrt. DLL | Microsoft Windows operating system | 6.00.2900.3028 | Microsoft Corporation windows DLL | copyright (c) 2001.01 | 1. 0. 0. 1 | Microsoft Corporation |? | Windows. dll | Windows. dll

C:/Windows/explorer.exe * 3228 | MICROSOFT (r) Windows (r) Operating System | 6.00.2900.2180 | Windows Explorer | (c) Microsoft Corporation. all rights reserved. | 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation |? | Explorer | EXPLORER. EXE
C:/program files/Internet Explorer/msvcrt. DLL | Microsoft Windows operating system | 6.00.2900.3028 | Microsoft Corporation windows DLL | copyright (c) 2001.01 | 1. 0. 0. 1 | Microsoft Corporation |? | Windows. dll | Windows. dll
C:/program files/common files/relive. DLL | Microsoft Windows operating system | 6.00.2900.3028 | Microsoft Corporation windows DLL | copyright (c) 2001.01 | 1. 0. 0. 1 | Microsoft Corporation |? | Windows. dll | Windows. dll
C:/Windows/system32/alxtb1.dll | alxtb module | 1, 0, 0, 1 | alxtb module | Copyright 2000-2003 | 7, 0, 1, 57 | Alexa Internet | alxtb. DLL

C:/program files/Internet Explorer/msvcrt. Bak * 2236 | 15:27:26
C:/program files/Internet Explorer/msvcrt. Bak | 15:27:26
C:/program files/Internet Explorer/msvcrt. DLL | Microsoft Windows operating system | 6.00.2900.3028 | Microsoft Corporation windows DLL | copyright (c) 2001.01 | 1. 0. 0. 1 | Microsoft Corporation |? | Windows. dll | Windows. dll

C:/Windows/system32/cmd.exe * 876 | MICROSOFT (r) Windows (r) Operating System | 5.1.2600.2180 | Windows command processor | (c) Microsoft Corporation. all rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation |? | Cmd. exe
C:/program files/Internet Explorer/msvcrt. DLL | Microsoft Windows operating system | 6.00.2900.3028 | Microsoft Corporation windows DLL | copyright (c) 2001.01 | 1. 0. 0. 1 | Microsoft Corporation |? | Windows. dll | Windows. dll

C:/Windows/system32/Drivers/smss.exe * 3464 | 19:57:56

O2-BHO-{D3626E66-B13B-C628-ACDF-BDABCFA265E1}-C:/program files/common files/relive. dll
O2-BHO-{D7515C61-A66C-4319-A0E0-D416CB8059E3}-C:/program files/common files/relive. dll
O2-BHO-{E3616E66-C13B-2628-2CDF-EDABCFA235E1}-C:/program files/common files/relive. dll
O2-BHO alxtb BHO class-{F1FABE79-25FC-46de-8C5A-2C6DB9D64333}-C:/Windows/system32/alxtb1.dll

O4-HKLM/../run: [wosa] C:/docume ~ 1/user/locals ~ 1/temp/woso.exe
O4-HKLM/../run: [ztsa] C:/docume ~ 1/user/locals ~ 1/temp/ztso.exe
O4-HKLM/../run: [mhsa] C:/docume ~ 1/user/locals ~ 1/temp/mhso.exe
O4-HKLM/../run: [fysa] C:/docume ~ 1/user/locals ~ 1/temp/fyso.exe
O4-HKLM/../run: [jtsa] C:/docume ~ 1/user/locals ~ 1/temp/jtso.exe
O4-HKLM/../run: [WLSA] C:/docume ~ 1/user/locals ~ 1/temp/wlso.exe
O4-HKLM/../run: [wgsa] C:/docume ~ 1/user/locals ~ 1/temp/wgso.exe
O4-HKLM/../run: [wmsa] C:/docume ~ 1/user/locals ~ 1/temp/wmso.exe
O4-HKLM/../run: [qjsa] C:/docume ~ 1/user/locals ~ 1/temp/qjso.exe
O4-HKLM/../run: [rxsa] C:/docume ~ 1/user/locals ~ 1/temp/rxso.exe
O4-HKLM/../run: [wdsa] C:/docume ~ 1/user/locals ~ 1/temp/wdso.exe
O4-HKLM/../run: [tlsa] C:/docume ~ 1/user/locals ~ 1/temp/tlso.exe
O4-HKLM/../run: [Dasa] C:/docume ~ 1/user/locals ~ 1/temp/daso.exe
O4-HKLM/../run: [zxsa] C:/docume ~ 1/user/locals ~ 1/temp/zxso.exe

O4-HKLM/../policies/Explorer/run: [visin] C:/Windows/system32/visin.exe

C:/autorun. inf
/-----
[Autorun]
Opentracing auto.exe
Shell/open = open (& O)
Shell/Open/command#auto.exe
Hell/explore = Resource Manager (& X)
Shell/cmde/command = "auto.exe"
-----/
D:/autorun. inf
/-----
[Autorun]
Opentracing auto.exe
Shell/open = open (& O)
Shell/Open/command#auto.exe
Hell/explore = Resource Manager (& X)
Shell/cmde/command = "auto.exe"
-----/

O8-ie right-click menu additional item: Alexa Web search-http://client.alexa.com/holiday/script/actions/search.htm
O8-ie right-click menu additional item: Get Alexa data-http://client.alexa.com/holiday/script/actions/sitedata.htm
O8-ie right-click menu additional item: mail to a friend...-http://client.alexa.com/holiday/script/actions/mailto.htm
O8-ie right-click menu additional item: See related links-http://client.alexa.com/holiday/script/actions/related.htm
O8-ie right-click menu additional item: write a review...-http://client.alexa.com/holiday/script/actions/review.htm

O11-ie extension quota group: tbh (Chinese search) =

O23-service: windowsdown (windows_systemdown)-C:/Windows/system32/servet.exe | 16:23:22 (automatic)
O23-service: ws2ifsl (Windows Socket 2.0 non-ifs service provider support environment)-C:/Windows/system32/Drivers/ws2ifsl. sys | MICROSOFT? Windows? Operating System | 5.1.2600.0 | Winsock2 ifs layer |? Microsoft Corporation. All Rights Reserved. | 5.1.2600.0 (xpclient000017-1148) | Microsoft Corporation |? | Ws2ifsl. sys | ws2ifsl. sys (disabled)

O24-shlexechook: []-{03f6e661-0d5f-3fad-3e2b-e261e3cb6cd2} = C:/program files/Internet Explorer/plugins/hijack. dll
O24-shlexechook: []-{0ea12c16-cdef-6ac1-236e-cd3fe82f5213} = C:/program files/Internet Explorer/msvcrt. dll
O24-shlexechook: []-{05ad2e16-c6ef-6ac1-136a-ce3fd8ef5613} = C:/program files/Internet Explorer/msvcrt. dll
O24-shlexechook: []-{0fad2e16-c8ef-5ac1-1e6a-ae3fd8ef56b3} = C:/program files/Internet Explorer/msvcrt. dll

O25-inscom: {11716107-a10d-11cf-64cd-11115fe1cf41} = C:/Windows/system32/nwizzhuxians.exe

The HKLM/showall value is not 1.
===/

Most of my previous experiences ~
The processing process is waiting for the next decomposition ~