遭遇beep.sys/Backdoor.Win32.Agent,DOVA/Backdoor.Win32.Hupigon,myRAT.rmvb/Trojan.Win32.Delf等1
endurer 原创
2008-06-20 第1版
一位朋友的电脑，最近电脑反应很慢，瑞星查杀出病毒，清除后一次开机又出现。另外，系统经常提示系统文件被替换，提示插入系统光盘进行恢复。请偶帮忙处理。 打开任务管理器，发现一个名为 1.exe 的进程占用了大量的CPU时间，先终止了。 使用 pe_xscan 扫描 log 并分析，发现如下可疑项：
pe_xscan 08-04-26 by Purple Endurer 2008-6-16 16:15:56 Windows XP Service Pack 2(5.1.2600) MSIE:6.0.2900.2180 管理员用户组 正常模式 C:/WINDOWS/System32/SVCHOST.EXE* 996 | 2004-8-23 8:0:0 | Microsoft? Windows? Operating System | 5.1.2600.2180 | Generic Host Process for Win32 Services | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | svchost.exe | svchost.exe c:/windows/system32/bitsex.dll | 2004-8-17 12:0:0 | svchost | 5.1.2600.2180 | Microsoft SNMP Manager API (uses WinSNMP) | Copyright @ 2004 | 5.1.2600.2180 | @ Microsoft Corporation. All rights reserved. | | svchost | svchost.dll C:/WINDOWS/System32/shared/smss.exe * 1664 | 2008-6-16 2:44:14 C:/WINDOWS/System32/SVCHOST.EXE* 1696 | 2004-8-23 8:0:0 | Microsoft? Windows? Operating System | 5.1.2600.2180 | Generic Host Process for Win32 Services | ? Microsoft Corporation. All rights reserved. | 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | svchost.exe | svchost.exe c:/program files/myrat/myrat.rmvb | 2008-6-16 2:44:19 | | 1.0.0.0 | | | 1.0.0.500 | | | | C:/WINDOWS/System32/shared/services.exe * 328 | 2008-6-16 8:6:37 F2 - REG: system.ini: UserInit = <USERINIT.EXE ,,C:/WINDOWS/system32/Kinds/1.exe> O23 - 服务: ADHelper (Active Directory Helper) - C:/WINDOWS/system32/shared/smss.exe | 2008-6-16 2:44:14(自动) O23 - 服务: BITS (Background Intelligent Transfer Service) - C:/WINDOWS/system32/svchost.exe -k netsvcs -> C:/WINDOWS/system32/BITSEx.dll | 2004-8-17 12:0:0 | svchost | 5.1.2600.2180 | Microsoft SNMP Manager API (uses WinSNMP) | Copyright @ 2004 | 5.1.2600.2180 | @ Microsoft Corporation. All rights reserved. | | svchost | svchost.dll(自动) O23 - 服务: COM+ Event (COM+ Event irat) - C:/WINDOWS/System32/svchost.exe -k krnlsrvc -> C:/Program Files/myRAT/myRAT.rmvb | 2008-6-16 2:44:19 | | 1.0.0.0 | | | 1.0.0.500 | | | | (自动) O23 - 服务: Drivers Desktop (Drivers Desktop Management) - C:/WINDOWS/system32/explore.exe | 2008-6-13 4:14:2(自动) O23 - 服务: Microsoftpvsy (Microsoftpvsy) - C:/WINDOWS/DOVA | 2008-6-16 2:44:38(自动)
从log 上看，先前终止的进程1.exe对应的文件是 C:/WINDOWS/system32/Kinds/1.exe
（未完待续）