What virus or malware is this, the file name is, Kaspersky or 360 cannot determine it is a virus or a *?
Post title:
What virus or malware is this, the file name is, Kaspersky or 360 cannot determine it is a virus or a *?
Post content:
Phenomenon:
Historical operation: I downloaded some screensaver software from the Internet and installed it. I can't detect viruses with Rising or Jiangmin. It runs from time to time, modify the registry RUN entry and automatically run it, modify the HOST file, and make some anti-virus websites point to 127.0.0.1, automatically close the task manager, and continuously transmit data to the network (adsl2m can upload more than 10K
Note: Change to automatic operation, modify the HOST file, automatically close the task manager, and continuously transmit data to the network (adsl2m can upload more than 10K
My diagnostic report:
Dear experts:
Thank you very much for paying attention to my system diagnostic report. The little rookie is waiting for your help in a hurry!
This diagnostic report is provided by 360 Security Guard http://
Diagnosis time: 2007-07-10 09:48:15
Diagnostic platform: Microsoft Windows XP Service Pack 2
IE version: Internet Explorer V6.0.2900.2180 Build:62900.2180
Computer physical memory: 247.48MB - Current available memory: 48.98MB
100 - Unknown - Process: [] - C:\WINDOWS\system32\
O2 - Unknown - BHO: (ThunderAtOnce Class) - [Thunder Browser Advanced Feature Support Module] - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll
O2 - Unknown - BHO: (Thunder Browser Helper) - [XunLeiBHO] - {80BF4636-D65B-43F3-BB60-C5DD3D5FB7B9} - C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll
O8 - Unknown - Extra context menu item: Use Thunder Download - C:\Program Files\Thunder Network\Thunder\Program\
O8 - Unknown - Extra context menu item: Use Thunder to download all links - C:\Program Files\Thunder Network\Thunder\Program\
O8 - Unknown - Extra context menu item: Add to QQ Expression - c:\Tencent QQ 2007 Beta1 V1.6\
O9 - Unknown - Extra button: Start Thunder 5 (HKLM) - C:\Program Files\Thunder Network\Thunder\
O15 - Unknown - Trusted Zone: easyabc.
O15 – Unknown – Trusted Zone:
O16 - Unknown - DPF: {E847C78C-C210-4195-8799-FBF3BF89797D} (Kingsoft Antivirus Online Product Upgrade) - /duba/download/install/onlinescan/
O23 - Unknown - Service: EnGenius Network Analysis Tool [EnGenius Network TCP analysis tool.] - "C:\WINDOWS\system32\dllcache\" - (not running)
O23 - Unknown - Service: MSSQLSERVER [MSSQLSERVER] - C:\Program Files\Microsoft SQL Server\MSSQL\Binn\ -sMSSQLSERVER - (running)
O23 - Unknown - Service: SQLSERVERAGENT [SQLSERVERAGENT] - C:\Program Files\Microsoft SQL Server\MSSQL\Binn\ -i MSSQLSERVER - (not running)
O23 - Unknown - Service: TongBackupSrv [Tong Backup Service] - C:\WINDOWS\system32\ - (running)
O23 - Unknown - Service: UFNet [UFU] - C:\WINDOWS\system32\ - (running)
O30 - Unknown - HKCU\..\Desktop: [] [Mystify Screen Saver] C:\WINDOWS\system32\
=======================================
100 - Security- Process: [The process is used as a session management subsystem to initialize system variables. The ms-dos driver names are similar to lpt1 and com, calling the win32 shell subsystem and running in the Windows login process. ] - C:\WINDOWS\System32\
100 - Security- Process: [Client service subsystem, used to control Windows graphics-related subsystems. ] - C:\WINDOWS\system32\ ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=base
100 - Security- - Process: [windows nt user login program. ] - C:\WINDOWS\system32\
100 - Security- - Process: [Used to manage windows service system processes. ] - C:\WINDOWS\system32\
100 - Security - Process: [Local security permission service controls the windows security mechanism. ] - C:\WINDOWS\system32\
100 - Security- Process: [service host process is a standard dynamic connection library host processing service. ] - C:\WINDOWS\system32\svchost -k DcomLaunch
100 - Security- Process: [service host process is a standard dynamic connection library host processing service. ] - C:\WINDOWS\system32\svchost -k rpcss
100 - Security- Process: [service host process is a standard dynamic connection library host processing service. ] - C:\WINDOWS\system32\ -k NetworkService
100 - Security- Process: [Windows program manager or Windows explorer is used to control Windows graphic shells, including the Start Menu, Taskbar, Desktop and File Management. ] - C:\WINDOWS\
100 - Security- Process: [service host process is a standard dynamic connection library host processing service. ] - C:\WINDOWS\System32\ -k netsvcs
100 - Safety - Process: [Windows Printing Task Control Program, used to prepare the printer. ] - C:\WINDOWS\system32\
100 - Security - Process: [360 Security Guard Real-time Monitoring Program. ] - C:\Program Files\360safe\safemon\
100 - Security- - Process: [Kaspersky Antivirus Software-related Programs. ] -
100 - Security- Process: [This is an application layer gateway service for network sharing. ] - C:\WINDOWS\System32\
100 - Safety - Process: [office xp input method icon. ] - C:\WINDOWS\system32\
100 - Security- - Process: [A virtual optical drive software. ] - C:\Program Files\DAEMON Tools\
100 - Security- - Process: [Kaspersky Antivirus Software-related Programs. ] -
100 - Security- Process: [imapi cd-burning com service Use image mastering applications programming interface (imapi) Manage cd recording. ] - C:\WINDOWS\system32\
100 - Security- Process: [microsoft sql server is used to set up SQL services. ] - C:\Program Files\Microsoft SQL Server\MSSQL\Binn\
100 - Safety- - Process: [A financial management software-related program. ] - C:\WINDOWS\system32\
100 - Security- Process: [Thunder 5, a download tool that supports multi-resource hyperthreading technology] - C:\Program Files\Thunder Network\Thunder\Program\
100 - Security - Process: [360 Security Guard-related procedures. ] - C:\Program Files\360safe\
R1 - Security - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\system32\
R1 - Security - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\system32\
O4 - Safe - HKLM\..\Run: [360Safetray] [360safe real-time protection function module. ] C:\Program Files\360safe\safemon\
O4 - Safety - HKLM\..\Run: [AVP] [Kaspersky Antivirus Software-related programs. ] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\"
O4 - Safety - HKCU\..\Run: [] [office xp input method icon. ] C:\WINDOWS\system32\
O4 - Safety - HKCU\..\Run: [DAEMON Tools] [A virtual optical drive tool. ] "C:\Program Files\DAEMON Tools\" -lang 2052
O8 - Security - Extra context menu item: Export to Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\/3000
O9 - Security- Extra button: Kaspersky Web Anti-Virus Protection Plug-in (HKLM) - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\
O9 - Security- Extra button: Windows Messenger(HKLM) - C:\Program Files\Messenger\
O18 - Safety - Protocol: OFFICE Related - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\
O18 - Safety - Protocol: OFFICE Related - {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\
O23- Security- Service: AVP [Kaspersky Antivirus Software-related programs. ] - "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\" -r - (running)
O23 - Security - Service: MSSQLServerADHelper [Mssqlserveradhelper Service. ] - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\ - (not running)
=======================================
O31 - Unknown - Notify: igfxcui - C:\WINDOWS\system32\ - Intel Corporation - igfxsrvc Module - 3.0.0.3751 - 335872 - 77b0dd12d2c2198e02ea43c807acf628
O31 - Unknown - Notify: klogon - C:\WINDOWS\system32\ - Kaspersky Lab - Logon Visualizer - 6.0.2.621 - 200768 - 2fb94ab158eb54a2212c8087b7e72340
O31 - Unknown - SODL: {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\ - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - Unknown - SODL: {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\ - Microsoft Corporation - Systray shell service object - 5.1.2600.2180 - 106496 - 49927372818d15cedeb466125b3c6bb9
O31 - Unknown - SEApproved: {176d6597-26d3-11d1-b350-080036a75b03} - C:\WINDOWS\system32\ - Microsoft Corporation - Microsoft Color Matching System User Interface DLL - 5.1.2600.0 - 77312 - 57f2a25ac11fc58379354b472a33a6f2
O31 - Unknown - SEApproved: {41E300E0-78B6-11ce-849B-444553540000} - C:\WINDOWS\system32\ - Microsoft Corporation - Windows Theme API - 6.0.2900.2180 - 375296 - 51bb979a160f98bcc9b8000252a8d982
O31 - Unknown - SEApproved: {42071714-76d4-11d1-8b24-00a0c9068ff3} - - - - - - 0- -
O31 - Unknown - SEApproved: {5DB2625A-54DF-11D0-B6C4-0800091AA605} - C:\WINDOWS\System32\ - Microsoft Corporation - Microsoft Color Matching System User Interface DLL - 5.1.2600.0 - 77312 - 57f2a25ac11fc58379354b472a33a6f2
O31 - Unknown - SEApproved: {675F097E-4C4D-11D0-B6C1-0800091AA605} - C:\WINDOWS\system32\ - Microsoft Corporation - Microsoft Color Matching System User Interface DLL - 5.1.2600.0 - 77312 - 57f2a25ac11fc58379354b472a33a6f2
O31 - Unknown - SEApproved: Invalid CLSID: Shell extensions for file compression - - - - - - - - - - - 0-
O31 - Unknown - SEApproved: Invalid CLSID: Encryption context menu - - - - - - 0-
O31 - Unknown - SEApproved: {85BBD920-42A0-1069-A2E4-08002B30309D} - C:\WINDOWS\system32\ - Microsoft Corporation - Windows Briefcase - 5.1.2600.2180 - 204288 - be51f40c779a5635f3c4b5ebdb819586
O31 - Unknown - SEApproved: {BD84B380-8CA2-1069-AB1D-08000948F534} - C:\WINDOWS\system32\ - Microsoft Corporation - Windows Font Folder - 5.1.2600.2180 - 395776 - 8b6723513c8f3375507a6708fd3dba8a
O31 - Unknown - SEApproved: {DBCE2480-C732-101B-BE72-BA78E9AD5B27} - C:\WINDOWS\system32\ - Microsoft Corporation - Microsoft Color Matching System User Interface DLL - 5.1.2600.0 - 77312 - 57f2a25ac11fc58379354b472a33a6f2
O31 - Unknown - SEApproved: {7007ACC7-3202-11D1-AAD2-00805FC1270E} - C:\WINDOWS\system32\ - Microsoft Corporation - Network Connections Shell - 5.1.2600.2180 - 2137088 -
O31 - Unknown - SEApproved: {992CFFA0-F557-101A-88EC-00DD010CCC48} - C:\WINDOWS\system32\ - Microsoft Corporation - Network Connections Shell - 5.1.2600.2180 - 2137088 -
O31 - Unknown - SEApproved: {E211B736-43FD-11D1-9EFB-0000F8757FCD} - C:\WINDOWS\system32\ - Microsoft Corporation - Imaging Devices Shell Folder UI - 5.1.2600.2180 - 751616 - 7169bd54b50911a6ce9fccaa29357ebe
O31 - Unknown - SEApproved: {FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD} - C:\WINDOWS\system32\ - Microsoft Corporation - Imaging Devices Shell Folder UI - 5.1.2600.2180 - 751616 - 7169bd54b50911a6ce9fccaa29357ebe
O31 - Unknown - SEApproved: {905667aa-acd6-11d2-8080-00805f6596d2} - C:\WINDOWS\system32\ - Microsoft Corporation - Imaging Devices Shell Folder UI - 5.1.2600.2180 - 751616 - 7169bd54b50911a6ce9fccaa29357ebe
O31 - Unknown - SEApproved: {3F953603-1008-4f6e-A73A-04AAC7A992F1} - C:\WINDOWS\system32\ - Microsoft Corporation - Imaging Devices Shell Folder UI - 5.1.2600.2180 - 751616 - 7169bd54b50911a6ce9fccaa29357ebe
O31 - Unknown - SEApproved: {83bbcbf3-b28a-4919-a5aa-73027445d672} - C:\WINDOWS\system32\ - Microsoft Corporation - Imaging Devices Shell Folder UI - 5.1.2600.2180 - 751616 - 7169bd54b50911a6ce9fccaa29357ebe
O31 - Unknown - SEApproved: {6C125022-639D-43cc-9F3D-647E6CC69EF1} - C:\WINDOWS\system32\ - Grigri - Apply a background to the shell context menu - 1.0.0.1 - 368640 - edd37826a42283aa3f25a4c639d689fa
O31 - Unknown - SEApproved: {DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF} - C:\WINDOWS\system32\ - Microsoft Corporation - Task Scheduler interface DLL - 5.1.2600.2180 - 316928 - d919668e8d62485c9834d28691761505
O31 - Unknown - SEApproved: {797F1E90-9EDD-11cf-8D8E-00AA0060F5BF} - C:\WINDOWS\system32\ - Microsoft Corporation - Task Scheduler interface DLL - 5.1.2600.2180 - 316928 - d919668e8d62485c9834d28691761505
O31 - Unknown - SEApproved: {D6277990-4C6A-11CF-8D87-00AA0060F5BF} - C:\WINDOWS\system32\ - Microsoft Corporation - Task Scheduler interface DLL - 5.1.2600.2180 - 316928 - d919668e8d62485c9834d28691761505
O31 - Unknown - SEApproved: {5F327514-6C5E-4d60-8F16-D07FA08A78ED} - C:\WINDOWS\system32\ - Microsoft Corporation - Automatic Updates Control - 5.8.0.2469 - 189208 - 734ee38f5eae72e48175a6976319d46d
O31 - Unknown - SEApproved: {0DF44EAA-FF21-4412-828E-260A8728E7F1} - - - - - 0-
O31 - Unknown - SEApproved: {9E56BE60-C50F-11CF-9A2C-00A0C90A90CE} - C:\WINDOWS\system32\ - Microsoft Corporation - Send Mail - 6.0.2900.2180 - 58880 - 5d6e81555a9906ef7469d5d7a35e19ad
O31 - Unknown - SEApproved: {9E56BE61-C50F-11CF-9A2C-00A0C90A90CE} - C:\WINDOWS\system32\ - Microsoft Corporation - Send Mail - 6.0.2900.2180 - 58880 - 5d6e81555a9906ef7469d5d7a35e19ad
O31 - Unknown - SEApproved: {88C6C381-2E85-11D0-94DE-444553540000} - C:\WINDOWS\system32\ - Microsoft Corporation - Object Control Viewer - 6.0.2900.2180 - 122880 - 175736fcd1a6250b459cd2ceb1e71332
O31 - Unknown - SEApproved: {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\ - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - Unknown - SEApproved: {ABBE31D0-6DAE-11D0-BECA-00C04FD940BE} - C:\WINDOWS\system32\ - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - Unknown - SEApproved: {F5175861-2688-11d0-9C5E-00AA00A45957} - C:\WINDOWS\system32\ - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - Unknown - SEApproved: {08165EA0-E946-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\ - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - Unknown - SEApproved: {E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB} - C:\WINDOWS\system32\ - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - Unknown - SEApproved: {E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7} - C:\WINDOWS\system32\ - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - Unknown - SEApproved: {7D559C10-9FE9-11d0-93F7-00AA0059CE02} - C:\WINDOWS\system32\ - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - Unknown - SEApproved: {E6CC6978-6B6E-11D0-BECA-00C04FD940BE} - C:\WINDOWS\system32\ - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - Unknown - SEApproved: {D8BD2030-6FC9-11D0-864F-00AA006809D9} - C:\WINDOWS\system32\ - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - Unknown - SEApproved: {7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB} - C:\WINDOWS\system32\ - Microsoft Corporation - Web Site Monitor - 6.0.2900.2180 - 390656 - 31cfe47fcd0024e16a1c1f7e4826ca25
O31 - Unknown - SEApproved: {352EC2B7-8B9A-11D1-B8AE-006008059382} - C:\WINDOWS\system32\ - Microsoft Corporation - Shell Application Manager - 5.1.2600.2180 - 593408 - eca487e77c813a65914d51084a591f5d
O31 - Unknown - SEApproved: {0B124F8F-91F0-11D1-B8B5-006008059382} - C:\WINDOWS\system32\ - Microsoft Corporation - Shell Application Manager - 5.1.2600.2180 - 593408 - eca487e77c813a65914d51084a591f5d
O31 - Unknown - SEApproved: {CFCCC7A0-A282-11D1-9082-006008059382} - C:\WINDOWS\system32\ - Microsoft Corporation - Shell Application Manager - 5.1.2600.2180 - 593408 - eca487e77c813a65914d51084a591f5d
O31 - Unknown - SEApproved: {e84fda7c-1d6a-45f6-b725-cb260c236066} - C:\WINDOWS\system32\ - Microsoft Corporation - Windows Image and Fax Viewer - 6.0.2900.2180 - 516096 - 51fb20fd3d0b2edda98a2d1e94b91b9d
O31 - Unknown - SEApproved: {66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}- - C:\WINDOWS\system32\ - Microsoft Corporation - Windows Image and Fax Viewer - 6.0.2900.2180 - 516096 - 51fb20fd3d0b2edda98a2d1e94b91b9d
O31 - Unknown - SEApproved: {00E7B358-F65B-4dcf-83DF-CD026B94BFD4} - - - - - - 0-
O31 - Unknown - SEApproved: {3F30C968-480A-4C6C-862D-EFC0897BB84B} - C:\WINDOWS\system32\ - Microsoft Corporation - Windows Image and Fax Viewer - 6.0.2900.2180 - 516096 - 51fb20fd3d0b2edda98a2d1e94b91b9d
O31 - Unknown - SEApproved: {9DBD2C50-62AD-11d0-B806-00C04FD706EC} - C:\WINDOWS\system32\ - Microsoft Corporation - Windows Image and Fax Viewer - 6.0.2900.2180 - 516096 - 51fb20fd3d0b2edda98a2d1e94b91b9d
O31 - Unknown - SEApproved: {EAB841A0-9550-11cf-8C16-00805F1408F3} - C:\WINDOWS\system32\ - Microsoft Corporation - Windows Image and Fax Viewer - 6.0.2900.2180 - 516096 - 51fb20fd3d0b2edda98a2d1e94b91b9d
O31 - Unknown - SEApproved: {eb9b1153-3b57-4e68-959a-a3266bc3d7fe} - C:\WINDOWS\system32\ - Microsoft Corporation - Windows Image and Fax Viewer - 6.0.2900.2180 - 516096 - 51fb20fd3d0b2edda98a2d1e94b91b9d
O31 - Unknown - SEApproved: {7A9D77BD-5403-11d2-8785-2E0420524153} - - - - - 0-
Previous page123Next pageRead the full text