Trojan. psw. win32.gameol, Trojan. win32.undef, Trojan. DL. win32.undef, etc. 1

Source: Internet
Author: User

Trojan. psw. win32.gameol, Trojan. win32.undef, Trojan. DL. win32.undef, etc. 1

Original endurer
Version 1st

Today, a friend's computer was very slow. Please help me with the repair.

Start the task manager and find a strange process named kcodn32.exe.

Pe_xscan is used to scan log analysis and the following suspicious items are found:

 
/=
Pe_xscan 08-08-01 by Purple endurer
17:36:12
Windows XP Service Pack 2 (5.1.2600)
MSIE: 6.0.2900.2180
Administrator user group
Normal Mode

[System process] * 0
C:/Windows/system32/tisqctyu. dll | 7:41:14
C:/Windows/system32/mmwlangh1006.dll | 7:44:43, 2000-7-9
C:/Windows/system32/imgutilhx2.dll | 7:42:53, 2001-7-9
C:/Windows/system32/ksuserfy. dll | 7:42:47, 2001-7-9
C:/Windows/system32/dispexcb. dll | 7:42:40, 2001-7-9
C:/Windows/system32/tscfgwmijxsj. dll | 7:42:34
C:/Windows/system32/bootvidgj. dll | 7:42:27, 2001-7-9
C:/Windows/system32/msobjstl. dll | 7:42:21, 2001-7-9
C:/Windows/system32/cliconfgzx. dll | 7:42:14, 2001-7-9
C:/Windows/system32/adsntzt. dll |
C:/Windows/system32/dpvvoxmh. dll |
C:/Windows/system32/winlogon.exe * 640 | MICROSOFT (r) Windows (r) Operating System | 5.1.2600.2180 | Windows NT logon application | (c) Microsoft Corporation. all rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation |? | Winlogon. exe
C:/Windows/system32/nhmxejkl. dll |
C:/Windows/system32/tisqctyu. dll | 7:41:14
C:/Windows/system32/mmwlangh1006.dll | 7:44:43, 2000-7-9
C:/Windows/system32/services.exe * 684 | MICROSOFT (r) Windows (r) Operating System | 5.1.2600.2180 | services and controller app | (c) Microsoft Corporation. all rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation |? | Services.exe
C:/Windows/system32/nhmxejkl. dll |
C:/Windows/system32/tisqctyu. dll | 7:41:14
C:/Windows/system32/mmwlangh1006.dll | 7:44:43, 2000-7-9
C:/Windows/system32/lsass.exe * 696 | MICROSOFT? Windows? Operating System | 5.1.2600.2180 | LSA shell (export version) |? Microsoft Corporation. All Rights Reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation |? | Lsass.exe
C:/Windows/system32/nhmxejkl. dll |
C:/Windows/system32/tisqctyu. dll | 7:41:14
C:/Windows/system32/mmwlangh1006.dll | 7:44:43, 2000-7-9
C:/Windows/system32/svchost.exe * 840 | MICROSOFT? Windows? Operating System | 5.1.2600.2180 | generic host process for Win32 services |? Microsoft Corporation. All Rights Reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation |? | Svchost.exe
C:/Windows/system32/nhmxejkl. dll |
C:/Windows/system32/tisqctyu. dll | 7:41:14
C:/Windows/system32/mmwlangh1006.dll | 7:44:43, 2000-7-9
C:/Windows/system32/kcodn32.dll | 23:58:35
C:/Windows/system32/imgutilhx2.dll | 7:42:53, 2001-7-9
C:/Windows/system32/ksuserfy. dll | 7:42:47, 2001-7-9
C:/Windows/system32/dispexcb. dll | 7:42:40, 2001-7-9
C:/Windows/system32/tscfgwmijxsj. dll | 7:42:34
C:/Windows/system32/bootvidgj. dll | 7:42:27, 2001-7-9
C:/Windows/system32/msobjstl. dll | 7:42:21, 2001-7-9
C:/Windows/system32/cliconfgzx. dll | 7:42:14, 2001-7-9
C:/Windows/system32/adsntzt. dll |
C:/Windows/system32/dpvvoxmh. dll |
R3-urlsearchhook: srchhook class-{F08555B0-9CC3-11D2-AA8E-000000000000}-C:/program files/hottools/iebho. dll
F2-shell = <assumer.exe,, glasf.exe>


O2-BHO-{38093456-9012-4568-9076-908765467183} = C:/Windows/system32/tisqctyu. dll | 7:41:14
O2-BHO-{43512378-9874-5641-1025-985420368734} = C:/Windows/system32/oswxdttb. dll | 7:41:35
O2-BHO-{57ac9076-c898-b098-d098-a18342580975} = C:/Windows/system32/nhmxejkl. dll |
O2-BHO srchhook class-{F08555B0-9CC3-11D2-AA8E-000000000000} = C:/program files/hottools/iebho. dll |
O3-IE Toolbar: shortcut toolbar 3.21-{BE830FD4-E393-417F-9F4B-CC70ABB3384C} = C:/program files/hottools/ietool. dll |

O4-HKLM/../run: [svchost] C:/Windows/MDM. exe
O4-HKLM/../policies/Explorer/run: [kcodn] kcodn32.exe
C:/autorun. inf
/-----
[Autorun]
Opentracing ravmon.exe
Shell/open = open (& O)
Shell/Open/command#ravmon.exe
Shell/volume E = Resource Manager (& X)
Shell/movie E/command = "ravmon.exe-e"
-----/
D:/autorun. inf
/-----
[Autorun]
Opentracing ravmon.exe
Shell/open = open (& O)
Shell/Open/command#ravmon.exe
Shell/volume E = Resource Manager (& X)
Shell/movie E/command = "ravmon.exe-e"
-----/


O20-appinit_dlls = pocolieov. DLL, nhmxejkl. DLL, tisqctyu. DLL, momusi. DLL, hwofw. DLL, webliso. DLL, wisoko. DLL, jerryi. DLL, xxpopo. DLL, jelens. DLL, jozasus. DLL, zbioscok. DLL, mmwlangh1006.dll


O21-ssodl-dpvvoxmh. dll (0)-{00070007-0007-0007-0007-00070007bb15} = C:/Windows/system32/dpvvoxmh. dll |
O21-ssodl-adsntzt. dll (0)-{00010001-0001-0001-0001-0001-00010001bb15} = C:/Windows/system32/adsntzt. dll |
O21-ssodl-cliconfgzx. dll (0)-{00050005-0005-0005-0005-00050005bb15} = C:/Windows/system32/cliconfgzx. dll | 7:42:14
O21-ssodl-msobjstl. dll (1)-{00170017-0017-0017-0017-00170017bb15} = C:/Windows/system32/msobjstl. dll | 7:42:21
O21-ssodl-bootvidgj. dll (0)-{00030003-0003-0003-0003-00030003bb15} = C:/Windows/system32/bootvidgj. dll | 7:42:27
O21-ssodl-tscfgwmijxsj. dll (3)-{00330033-0033-0033-0033-00330033bb15} = C:/Windows/system32/tscfgwmijxsj. dll | 7:42:34
O21-ssodl-dispexcb. dll (0)-{00060006-0006-0006-0006-00060006bb15} = C:/Windows/system32/dispexcb. dll | 7:42:40
O21-ssodl-ksuserfy. dll (1)-{00130013-0013-0013-0013-00130013bb15} = C:/Windows/system32/ksuserfy. dll | 7:42:47
O21-ssodl-imgutilhx2.dll (0)-{00300030-0030-0030-0030-00300030bb15} = C:/Windows/system32/imgutilhx2.dll | 7:42:53
O23-service: 682247f847c41458 (682247f847c41458)-C:/682247f847c41458. dat (manual)
O23-service: 807937ac67f36f77 (807937ac67f36f77)-C:/807937ac67f36f77. dat (manual)
O23-service: aa12ddf439b88f8 (aa12ddf439b88f8)-C:/aa12ddf439b88blob. dat (manual)
O23-service: hiddfldy (hiddfldy)-C:/Windows/system32/d32dx9. sys | 2000-7-9 (automatic)
O23-service: mscodesrv ()-C:/Windows/temp/runassrv.exe runsrv/name: "mscodesrv"/prinum: "32"/inter/Character Line: C: /Windows/autohal.exe-pssp S-1-5-21-2000478354-842925246-1202660629-500 "(automatic)
O24-shlexechook: [5]-{55694105-5108-9405-3695-954187462155} = C:/Windows/system32/mpwdeapi. dll | 7:40:46
O24-shlexechook: [6]-{6c648541-1025-9650-9057-637958720c6} = C:/Windows/system32/mndhfdwd. dll | 7:40:53
O24-shlexechook: [5]-{57ac9076-c898-b098-d098-a18342580975} = C:/Windows/system32/nhmxejkl. dll |
O24-shlexechook: [4]-{4d698451-2015-6358-9871-2015987452d4} = C:/Windows/system32/apzhdtde. dll |
O24-shlexechook: [3]-{38093456-9012-4568-9076-908765467183} = C:/Windows/system32/tisqctyu. dll | 7:41:14
O24-shlexechook: [4]-{40618412-c528-c784-c056-c164d1f7c504} = C:/Windows/system32/detxdiua. dll | 7:41:21, 2004-8-8
O24-shlexechook: [2]-{25fd6584-698f-bcd2-602c-698745210352} = C:/Windows/system32/rijxbkin. dll | 7:41:28
O24-shlexechook: [4]-{43512378-9874-5641-1025-985420368734} = C:/Windows/system32/oswxdttb. dll | 7:41:35
O24-shlexechook: [5]-{528df602-9541-a985-210a-984a698c6f25} = C:/Windows/system32/ptjhehlp. dll | 7:41:41, 2004-8-8
O24-shlexechook: [4]-{49109876-7619-9101-7012-901938475194} = C:/Windows/system32/ietzdpaq. dll | 7:41:48
O24-shlexechook: [4]-{470165f1-9f65-108f-f895-f14f58f000074} = C:/Windows/system32/lofsdjbo. dll | 7:41:55
O24-shlexechook: [5]-{00070007-0007-0007-0007-00070007bb15} = C:/Windows/system32/dpvvoxmh. dll |
O24-shlexechook: [5]-{00010001-0001-0001-0001-00010001bb15} = C:/Windows/system32/adsntzt. dll |
O24-shlexechook: [5]-{00050005-0005-0005-0005-00050005bb15} = C:/Windows/system32/cliconfgzx. dll | 7:42:14
O24-shlexechook: [5]-{00170017-0017-0017-0017-00170017bb15} = C:/Windows/system32/msobjstl. dll | 7:42:21
O24-shlexechook: [5]-{00030003-0003-0003-0003-00030003bb15} = C:/Windows/system32/bootvidgj. dll | 7:42:27
O24-shlexechook: [5]-{00330033-0033-0033-0033-00330033bb15} = C:/Windows/system32/tscfgwmijxsj. dll | 7:42:34, 2001-7-9
O24-shlexechook: [5]-{00060006-0006-0006-0006-00060006bb15} = C:/Windows/system32/dispexcb. dll | 7:42:40
O24-shlexechook: [5]-{00130013-0013-0013-0013-00130013bb15} = C:/Windows/system32/ksuserfy. dll | 7:42:47
O24-shlexechook: [5]-{00300030-0030-0030-0030-00300030bb15} = C:/Windows/system32/imgutilhx2.dll | 7:42:53
O24-shlexechook: [c]-{8942ff57-5cf4-4ef5-9ffa-1b6d48b4d3fc} = C:/Windows/system32/mmwlangh1006.dll | 2000-7-9 7:44:43
O24-shlexechook: [5]-{6351a63c-4042-433a-a64f-6974e875f835} = C:/Windows/system32/mmwlvahb1_5.dll | 7:44:50
O24-shlexechook: [4]-{9a5eed2d-0604-4b25-afc7-f1fd1_93b14} = C:/Windows/system32/mmhadpqg1102.dll | 2000-7-9 7:44:56
O26-ifeo: client.exe-> C:/Windows/system32/windg.exe
HKLM/showall type non-DWORD
===/


(To be continued)

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.