|
|
1楼
大
中
小
发表于 2008-12-11 13:27 只看该作者
新发现：QQ强制扫描底裤功能
MSN,TOM的SKYPE,暴风，瑞星，等一系列国产软件后台都有一个木马程序,用来监视你硬盘上"别有用心的内容"然后整理上报……
http://www.onlinedown.net/soft/8986.htm
此软件可以检测出来
8189 22:55:00 QQ.exe:3800 FASTIO_QUERY_STANDARD_INFO
E:\vmware_cn\VMMount\vstor2-ws60.sys SUCCESS Length: 19504
8190 22:55:00 QQ.exe:3800 IRP_MJ_CLEANUP
E:\vmware_cn\VMMount\vstor2-ws60.sys SUCCESS
8191 22:55:00 QQ.exe:3800 IRP_MJ_CLOSE
E:\vmware_cn\VMMount\vstor2-ws60.sys SUCCESS
8192 22:55:00 QQ.exe:3800 FASTIO_QUERY_STANDARD_INFO
E:\vmware_cn\VMMount\vstor2-ws60.sys SUCCESS Length: 19504
8193 22:55:00 QQ.exe:3800 FASTIO_READ
E:\vmware_cn\VMMount\vstor2-ws60.sys SUCCESS Offset: 0 Length: 64
8194 22:55:00 QQ.exe:3800 FASTIO_READ
E:\vmware_cn\VMMount\vstor2-ws60.sys SUCCESS Offset: 600 Length: 248
8195 22:55:00 QQ.exe:3800 FASTIO_READ
E:\vmware_cn\VMMount\vstor2-ws60.sys SUCCESS Offset: 848 Length: 240
8196 22:55:00 QQ.exe:3800 FASTIO_QUERY_STANDARD_INFO
E:\vmware_cn\VMMount\vstor2-ws60.sys SUCCESS Length: 19504
8197 22:55:00 QQ.exe:3800 FASTIO_QUERY_STANDARD_INFO
E:\vmware_cn\VMMount\vstor2-ws60.sys SUCCESS Length: 19504
8198 22:55:00 QQ.exe:3800 FASTIO_READ
E:\vmware_cn\VMMount\vstor2-ws60.sys SUCCESS Offset: 1152 Length: 18352
8199 22:55:00 QQ.exe:3800 FASTIO_QUERY_STANDARD_INFO
E:\vmware_cn\VMMount\vstor2-ws60.sys SUCCESS Length: 19504
8200 22:55:00 QQ.exe:3800 FASTIO_READ
E:\vmware_cn\VMMount\vstor2-ws60.sys SUCCESS Offset: 9344 Length: 10160
8201 22:55:00 QQ.exe:3800 FASTIO_QUERY_STANDARD_INFO
E:\vmware_cn\VMMount\vstor2-ws60.sys SUCCESS Length: 19504
8202 22:55:00 QQ.exe:3800 FASTIO_READ
E:\vmware_cn\VMMount\vstor2-ws60.sys SUCCESS Offset: 15408 Length: 4096
8203 22:55:00 QQ.exe:3800 FASTIO_QUERY_STANDARD_INFO
E:\vmware_cn\VMMount\vstor2-ws60.sys SUCCESS Length: 19504
8204 22:55:00 QQ.exe:3800 FASTIO_READ
E:\vmware_cn\VMMount\vstor2-ws60.sys SUCCESS Offset: 12544 Length: 2048
8205 22:55:00 QQ.exe:3800 IRP_MJ_CLEANUP
E:\vmware_cn\VMMount\vstor2-ws60.sys SUCCESS
8206 22:55:01 QQ.exe:3800 IRP_MJ_CREATE E:\Autorun.inf NOT FOUND
Options: Open Access: Read
8207 22:55:01 QQ.exe:3800 IRP_MJ_CREATE F:\Autorun.inf NOT FOUND
Options: Open Access: Read
8208 22:55:01 QQ.exe:3800 IRP_MJ_CREATE G:\Autorun.inf NOT FOUND
Options: Open Access: Read
8209 22:55:01 QQ.exe:3800 IRP_MJ_CREATE \\.\Pipe\srvsvc SUCCESS
Options: Open Access: 0012019F
8210 22:55:01 QQ.exe:3800 IRP_MJ_SET_INFORMATION \\.\Pipe\srvsvc
SUCCESS FilePipeInformation
|
|
|
|
