Svohost.exe‑sxs.exe and command.com

EndurerOriginal

2006-10-231Version

The QQ keyboard encryption technology in a friend's computer cannot be started. Let's take a look.

Download hijackthis and procview from http://endurer.ys168.com.

Use hijackthis to scan logs and find several suspicious items:
/------------
Logfile of hijackthis v1.99.1
Platform: Windows XP SP2 (winnt 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running Processes: C:/Windows/system32/svohost.exe

O4-HKLM/../run: [soundmam] C:/Windows/system32/svohost.exe
-------------/

Svohost.exe has previously encountered a C:/Windows/system32/winscok. dll program with it. (See:Blocks svohost.exe from rising and Yahoo Assistant)
With procview check, we found that C:/Windows/system32/winscok. dll has injected several processes. For example, the exported Process List contains:
/--------
* You are using Windows XP (winnt 5.01.2600 SP2)
13:57:46 Process List
[System process]
C:/Windows/system32/winscok. dll
C:/winnt/EXPLORER. EXE
C:/Windows/system32/winscok. dll
--------/

Restart the computer to safe mode and use WinRAR

/--------
C:/Windows/system32/svohost.exe
C:/Windows/system32/winscok. dll
--------/

After the backup is packaged, delete it.

Check C:/, D:/, E:/and F:/and find the autorun. inf command.com sxs.exe files. The three files on disk D are deleted and are reborn immediately. After deleting the three files on drive E and drive F, you will be back to delete drive D. This will not be reborn again.
Check the QQ Program folder, find the date of the timplatform.exe file exception, pass back, Kaspersky immediately reported as a Trojan-Downloader.Win32.Small.czl.
Uninstall QQ.
Use hijackthis to fix the suspicious items listed above.
Clear the temporary ie folder.
Restart your computer and then reinstall QQ.

Command.comKaspersky reportsTrojan-PSW.Win32.WOW.ki, Dr. Web reportsTrojan. PWS. Wow
Sxs.exeKaspersky reportsTrojan-PSW.Win32.QQPass. OS, Dr. Web reportsTrojan. PWS. qqpass.182
Svohost.exeKaspersky reportsTrojan-PSW.Win32.QQPass. OS, Dr. Web reportsTrojan. PWS. qqpass.182
Timplatform.exeKaspersky reportsTrojan-Downloader.Win32.Small.czl, Dr. Web reportsTrojan. PWS. hert
Winscok. dllUnfortunately, it was not passed back.