dsb2468

百度地图试试

@OwenY 不会，那个只是阿里的 OSS 存储服务，单纯访问是安全的。目前小黑客已经把配置文件下线了。

@kangod 手机上的微信，最好改密后、退出重新下。

@wdlth 上面这一堆，免杀做得不错，VT 基本是 0

从这个病毒的配置文件来看，属于国内的小黑客（关键字 sb360qunimade ）

C:\Users\%USERNAME%\AppData\Local\VirtualStore

Foolish.png=Foolish.png

https://sb360qunimade.oss-cn-hongkong.aliyuncs.com/wps.txt=svchost.exe
https://dlltemasil.oss-cn-hongkong.aliyuncs.com/libcef.dll=libcef.dll
https://platformi.oss-cn-hongkong.aliyuncs.com/Foolish.dat=Foolish.dat
https://sb360qunimade.oss-cn-hongkong.aliyuncs.com/ApexFramework_x86.dll=ApexFramework_x86.dll
https://sb360qunimade.oss-cn-hongkong.aliyuncs.com/AudioLib.dll=AudioLib.dll
https://sb360qunimade.oss-cn-hongkong.aliyuncs.com/CertLib.dll=CertLib.dll
https://sb360qunimade.oss-cn-hongkong.aliyuncs.com/CrashRpt1403.dll=CrashRpt1403.dll
https://sb360qunimade.oss-cn-hongkong.aliyuncs.com/d3dx9_42.dll=d3dx9_42.dll
https://sb360qunimade.oss-cn-hongkong.aliyuncs.com/FreeImage.dll=FreeImage.dll
https://sb360qunimade.oss-cn-hongkong.aliyuncs.com/IMProtocol.dll=IMProtocol.dll
https://sb360qunimade.oss-cn-hongkong.aliyuncs.com/ImShareUtil.DLL=ImShareUtil.DLL
https://sb360qunimade.oss-cn-hongkong.aliyuncs.com/libcrypto-1_1.dll=libcrypto-1_1.dll
https://sb360qunimade.oss-cn-hongkong.aliyuncs.com/libcurl.dll=libcurl.dll
https://sb360qunimade.oss-cn-hongkong.aliyuncs.com/libexpat.dll=libexpat.dll
https://sb360qunimade.oss-cn-hongkong.aliyuncs.com/libogg.dll=libogg.dll
https://sb360qunimade.oss-cn-hongkong.aliyuncs.com/libssl-1_1.dll=libssl-1_1.dll
https://sb360qunimade.oss-cn-hongkong.aliyuncs.com/libvorbis.dll=libvorbis.dll
https://sb360qunimade.oss-cn-hongkong.aliyuncs.com/libvorbisfile.dll=libvorbisfile.dll
https://sb360qunimade.oss-cn-hongkong.aliyuncs.com/MSVCP120.dll=MSVCP120.dll
https://sb360qunimade.oss-cn-hongkong.aliyuncs.com/MSVCR71.dll=MSVCR71.dll
https://sb360qunimade.oss-cn-hongkong.aliyuncs.com/MSVCR90.dll=MSVCR90.dll
https://sb360qunimade.oss-cn-hongkong.aliyuncs.com/MSVCR120.dll=MSVCR120.dll
https://sb360qunimade.oss-cn-hongkong.aliyuncs.com/Physics.dll=Physics.dll
https://sb360qunimade.oss-cn-hongkong.aliyuncs.com/PhysX3_x86.dll=PhysX3_x86.dll
https://sb360qunimade.oss-cn-hongkong.aliyuncs.com/PhysX3Cooking_x86.dll=PhysX3Cooking_x86.dll
https://sb360qunimade.oss-cn-hongkong.aliyuncs.com/PxFoundation_x86.dll=PxFoundation_x86.dll
https://sb360qunimade.oss-cn-hongkong.aliyuncs.com/PxPvdSDK_x86.dll=PxPvdSDK_x86.dll
https://sb360qunimade.oss-cn-hongkong.aliyuncs.com/ResLib.dll=ResLib.dll
https://sb360qunimade.oss-cn-hongkong.aliyuncs.com/ScanEngine.dll=ScanEngine.dll
https://sb360qunimade.oss-cn-hongkong.aliyuncs.com/steam_api.dll=steam_api.dll

@wdlth 后续的模块在这里： https://variety.oss-cn-hongkong.aliyuncs.com/foxconfig?⌁GetRemoteLis

@kangod 你可以把 chm 打包传到网盘上，然后发到这里

你看到的那个 svchost.exe ，只是用来加载恶意 DLL 的

签名都会存在盗用的可能性，公司信息更是可以随便写了。。。

你现在需要检查的是电脑中的远控木马，黑客现在已经进入你电脑了，你要小心公司重要数据泄密、勒索等一系列情况。

联系安全厂商检查电脑吧。

你用的什么安全软件，打开恶意 chm 文件都没拦截提示么？